Message ID | 20250325195322.3243734-1-catalin.marinas@arm.com (mailing list archive) |
---|---|
State | New |
Headers | show |
Series | [GIT,PULL] arm64 updates 6.15-rc1 | expand |
On Tue, Mar 25, 2025 at 12:53 PM Catalin Marinas <catalin.marinas@arm.com> wrote: > > Please pull the arm64 updates for 6.15-rc1 below. This was in my spam folder. The reason is that your email configuration is wrong, and lacks the proper DKIM signature. You have From: Catalin Marinas <catalin.marinas@arm.com> but it doesn't actually have the DKIM signature from arm.com... It looks like you sent it through the kernel.org smtp server using git-send-email, but it doesn't have the kernel.org DKIM either (but it may be that kernel.org only signs things that say "From: xyzzy@kernel.org"). Linus
The pull request you sent on Tue, 25 Mar 2025 19:53:22 +0000:
> git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux tags/arm64-upstream
has been merged into torvalds/linux.git:
https://git.kernel.org/torvalds/c/2d09a9449ecd9a2b9fdac62408c12ee20b6307d2
Thank you!
On Tue, Mar 25, 2025 at 01:12:45PM -0700, Linus Torvalds wrote: > On Tue, Mar 25, 2025 at 12:53 PM Catalin Marinas > <catalin.marinas@arm.com> wrote: > > Please pull the arm64 updates for 6.15-rc1 below. > > This was in my spam folder. The reason is that your email > configuration is wrong, and lacks the proper DKIM signature. > > You have > > From: Catalin Marinas <catalin.marinas@arm.com> > > but it doesn't actually have the DKIM signature from arm.com... > > It looks like you sent it through the kernel.org smtp server using > git-send-email, but it doesn't have the kernel.org DKIM either (but it > may be that kernel.org only signs things that say "From: > xyzzy@kernel.org"). Hmm, I thought that setting "Return-Path: cmarinas@kernel.org" would be enough. This header left my machine but seems to have disappeared in the lore archive. Not sure how much difference it would have made, IIUC that's more for SPF than DKIM. If the envelope sender doesn't work, I may have to switch to using cmarinas@kernel.org, at least for pull requests. Arm has an SMTP server that doesn't add the legal disclaimer but I've had similar problems with it in the past (the expected sender was ...@foss.arm.com; maybe IT fixed it in the meantime). Anyway, thanks for letting me know. I'll dig further.
On Tue, 25 Mar 2025 at 17:18, Catalin Marinas <catalin.marinas@arm.com> wrote: > > Hmm, I thought that setting "Return-Path: cmarinas@kernel.org" would be > enough. No, DKIM is designed to make forging emails hard, and that very much means that it checks the "from" address, not some random header that humans never look at. > This header left my machine but seems to have disappeared in the > lore archive. Not sure how much difference it would have made, IIUC > that's more for SPF than DKIM. I do see the Return-Path: <cmarinas@kernel.org> but no, that shouldn't make any difference at all, because that's not what dkim matches. The spf is fine, but honestly, spf on its own is kind of useless. > If the envelope sender doesn't work, I may have to switch to using > cmarinas@kernel.org, at least for pull requests. That's fine, and is probably the easiest thing to do. Linus
On Tue, 25 Mar 2025 17:48:12 -0700 Linus Torvalds <torvalds@linux-foundation.org> wrote: > > This header left my machine but seems to have disappeared in the > > lore archive. Not sure how much difference it would have made, IIUC > > that's more for SPF than DKIM. > > I do see the > > Return-Path: <cmarinas@kernel.org> > > but no, that shouldn't make any difference at all, because that's not > what dkim matches. Now I wonder if you see any of my emails that I have been sending? I have my own email server which is on a dynamic IP which most ISPs will simply drop because of that, so I route my email through kernel.org. I just sent myself a few test emails and there's no DKIM signature, unless I manually edit the From to use my kernel.org email (which I have never used before). > > The spf is fine, but honestly, spf on its own is kind of useless. > > > If the envelope sender doesn't work, I may have to switch to using > > cmarinas@kernel.org, at least for pull requests. > > That's fine, and is probably the easiest thing to do. I may have to do the same if you can see this email (which I manually updated the From address to be kernel.org), but not my previous pull requests. I wonder if there's a way I can work with Konstantin to allow kernel.org to have a signature for goodmis.org ? Not sure if that's even possible. In case you missed my previous pull requests, they are here: https://lore.kernel.org/all/20250325180527.5fc0a1fa@gandalf.local.home/ https://lore.kernel.org/all/20250325193935.66020aa3@gandalf.local.home/ https://lore.kernel.org/all/20250326115109.32b69701@gandalf.local.home/ -- Steve
On Wed, 26 Mar 2025 at 09:39, Steven Rostedt <rostedt@kernel.org> wrote: > > Now I wonder if you see any of my emails that I have been sending? Your emails are fine. You're using a kernel.org address, and you're going through smtp.kernel.org, so they have a perfectly proper DKIM signature: Received: by smtp.kernel.org (Postfix) with ESMTPSA id DF624C4CEE2; Wed, 26 Mar 2025 16:39:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1743007179; [...] > I have my own email server which is on a dynamic IP which most ISPs will > simply drop because of that, so I route my email through kernel.org. > > I just sent myself a few test emails and there's no DKIM signature, unless > I manually edit the From to use my kernel.org email (which I have never > used before). If you don't see a DKIM signature, it's probably because when you send emails to yourself, they never actually go outside your own little smtp setup, and never go through kernel.org at all. Linus
On Wed, 26 Mar 2025 09:51:06 -0700 Linus Torvalds <torvalds@linux-foundation.org> wrote: > If you don't see a DKIM signature, it's probably because when you send > emails to yourself, they never actually go outside your own little > smtp setup, and never go through kernel.org at all. Using claws-mail it just uses kernel.org directly, where as my sendmail scripts use my own server which goes through kernel.org. When sending to another email of mine (rostedt@kihontech.com) the headers are: Return-Path: <SRS0=fOit=WN=goodmis.org=rostedt@kernel.org> X-Spam-Checker-Version: SpamAssassin 4.0.0 (2022-12-13) on mailmammoth X-Spam-Level: X-Spam-Status: No, score=-4.6 required=5.0 tests=BAYES_00,DMARC_MISSING, HEADER_FROM_DIFFERENT_DOMAINS,RCVD_IN_VALIDITY_CERTIFIED, RCVD_IN_VALIDITY_RPBL,RCVD_IN_VALIDITY_SAFE,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=4.0.0 X-Original-To: rostedt@kihontech.com Delivered-To: catchall@goodmis.org Received: from rostedt.homelinux.com [172.100.189.27] by mailmammoth with IMAP (fetchmail-6.4.37) for <rostedt@localhost> (single-drop); Wed, 26 Mar 2025 12:13:10 -0400 (EDT) Received: from sea.source.kernel.org (sea.source.kernel.org [172.234.252.31]) by mailmammoth.local.home (Postfix) with ESMTP id 8EE602014D for <rostedt@kihontech.com>; Wed, 26 Mar 2025 12:13:09 -0400 (EDT) Received: from smtp.kernel.org (transwarp.subspace.kernel.org [100.75.92.58]) by sea.source.kernel.org (Postfix) with ESMTP id 60B5A439EF for <rostedt@kihontech.com>; Wed, 26 Mar 2025 16:13:08 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5492CC4CEE2 for <rostedt@kihontech.com>; Wed, 26 Mar 2025 16:13:08 +0000 (UTC) So it definitely goes through kernel.org. But it has no DKIM headers. -- Steve
On Wed, 26 Mar 2025 at 10:11, Steven Rostedt <rostedt@goodmis.org> wrote: > > So it definitely goes through kernel.org. > > But it has no DKIM headers. Funky. There's definitely something strange going on, because your *previous* email to me did have the DKIM signature: Received: by smtp.kernel.org (Postfix) with ESMTPSA id DF624C4CEE2... DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org;[..] [...] Date: Wed, 26 Mar 2025 12:40:25 -0400 Subject: Re: [GIT PULL] arm64 updates 6.15-rc1 Message-ID: <20250326124025.1966bf8a@gandalf.local.home> and gmail was explicitly happy with it: ARC-Authentication-Results: i=1; mx.google.com; dkim=pass [...] but then this later one didn't: Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4CDA5C4CEE2... [...] Date: Wed, 26 Mar 2025 13:12:00 -0400 Message-ID: <20250326131200.1c86c657@gandalf.local.home> and for some reason gmail also didn't actually react to the lack of DKIM on that second one and only talks about how spf was fine. Konstantin? Can you tell what's going on? Linus
On Wed, 26 Mar 2025 10:25:22 -0700 Linus Torvalds <torvalds@linux-foundation.org> wrote: > On Wed, 26 Mar 2025 at 10:11, Steven Rostedt <rostedt@goodmis.org> wrote: > > > > So it definitely goes through kernel.org. > > > > But it has no DKIM headers. > > Funky. > > There's definitely something strange going on, because your *previous* > email to me did have the DKIM signature: That's because I had manually changed my "From:" from "rostedt@goodmis.org" to "rostedt@kernel.org", which in my test emails, added the DKIM signatures. -- Steve
Hi Linus, On Wed, 26 Mar 2025 10:25:22 -0700 Linus Torvalds <torvalds@linux-foundation.org> wrote: > > On Wed, 26 Mar 2025 at 10:11, Steven Rostedt <rostedt@goodmis.org> wrote: > > > > So it definitely goes through kernel.org. > > > > But it has no DKIM headers. > > Funky. > > There's definitely something strange going on, because your *previous* > email to me did have the DKIM signature: > > Received: by smtp.kernel.org (Postfix) with ESMTPSA id DF624C4CEE2... > DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org;[..] > [...] > Date: Wed, 26 Mar 2025 12:40:25 -0400 > Subject: Re: [GIT PULL] arm64 updates 6.15-rc1 > Message-ID: <20250326124025.1966bf8a@gandalf.local.home> > > and gmail was explicitly happy with it: > > ARC-Authentication-Results: i=1; mx.google.com; > dkim=pass [...] > > but then this later one didn't: > > Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4CDA5C4CEE2... > [...] > Date: Wed, 26 Mar 2025 13:12:00 -0400 > Message-ID: <20250326131200.1c86c657@gandalf.local.home> > > and for some reason gmail also didn't actually react to the lack of > DKIM on that second one and only talks about how spf was fine. > > Konstantin? Can you tell what's going on? My understanding is this: for normal SPF checks (i.e. not DMARC's SPF checks) the test is done on the envelope sender and in Steve's case, goodmis.org DNS SPF record says that anything from goodmis.org can come from the kernel.org servers. DMARC applies the SPF check to the From: header address. for DKIM checks, the test is against the From: header address. The kernel.org servers can only sign emails that have a From header using a kernel.org email address (or any other domain they have access to the private DKIM keys for). So they cannot sign emails that have a From: header using a goodmis.org email address (presumably). Presumably the SPF check passing is sufficient for the GMail servers. DMARC requires that its SPF check or its DKIM check to pass. (But goodmis.org has no DMARC DNS record, while kernel.org does)
On Thu, 27 Mar 2025 09:45:02 +1100 Stephen Rothwell <sfr@canb.auug.org.au> wrote: > My understanding is this: > > for normal SPF checks (i.e. not DMARC's SPF checks) the test is done on > the envelope sender and in Steve's case, goodmis.org DNS SPF record > says that anything from goodmis.org can come from the kernel.org > servers. DMARC applies the SPF check to the From: header address. Ah right. Thanks for looking into this. This brings back a memory where I added: "v=spf1 include:kernel.org" to the DNS TXT record for goodmis.org. -- Steve