Most of my "b4 am" runs fail the DKIM test

Most of my "b4 am" runs fail the DKIM test

[Chuck Lever]

I recently started seeing this quite a bit:

  ✗ [PATCH v4 1/2] SUNRPC: add verbose parameter to __svc_print_addr()
  ✗ [PATCH v4 2/2] NFSD: add rpc_status entry in nfsd debug filesystem
  ---
  ✗ BADSIG: DKIM/kernel.org

In fact, even my own patches (sent via the kernel.org SMTP relay) fail
this check.

What am I doing wrong?


-- 
"We cannot take our next breath without the exhale."
 -- Ellen Scott Grable

Re: Most of my "b4 am" runs fail the DKIM test

[Konstantin Ryabitsev]

On Wed, Aug 02, 2023 at 09:53:10AM -0400, Chuck Lever wrote:
> I recently started seeing this quite a bit:
> 
>   ✗ [PATCH v4 1/2] SUNRPC: add verbose parameter to __svc_print_addr()
>   ✗ [PATCH v4 2/2] NFSD: add rpc_status entry in nfsd debug filesystem
>   ---
>   ✗ BADSIG: DKIM/kernel.org
> 
> In fact, even my own patches (sent via the kernel.org SMTP relay) fail
> this check.
> 
> What am I doing wrong?

It's really hard to troubleshoot, but you can try the following:

    $ curl -s https://lore.kernel.org/linux-nfs/5b0eff4e3ef9bf9621f5095189933f60def40f0d.1690569488.git.lorenzo@kernel.org/raw | dkimverify
    signature ok

If you don't get "signature ok", then my guess would be that there's some
problem performing DNS lookups for public keys.

-K

Re: Most of my "b4 am" runs fail the DKIM test

[Chuck Lever]

On Wed, Aug 2, 2023 at 10:11 AM Konstantin Ryabitsev
<konstantin@linuxfoundation.org> wrote:
>
> On Wed, Aug 02, 2023 at 09:53:10AM -0400, Chuck Lever wrote:
> > I recently started seeing this quite a bit:
> >
> >   ✗ [PATCH v4 1/2] SUNRPC: add verbose parameter to __svc_print_addr()
> >   ✗ [PATCH v4 2/2] NFSD: add rpc_status entry in nfsd debug filesystem
> >   ---
> >   ✗ BADSIG: DKIM/kernel.org
> >
> > In fact, even my own patches (sent via the kernel.org SMTP relay) fail
> > this check.
> >
> > What am I doing wrong?
>
> It's really hard to troubleshoot, but you can try the following:
>
>     $ curl -s https://lore.kernel.org/linux-nfs/5b0eff4e3ef9bf9621f5095189933f60def40f0d.1690569488.git.lorenzo@kernel.org/raw | dkimverify
>     signature ok
>
> If you don't get "signature ok", then my guess would be that there's some
> problem performing DNS lookups for public keys.

curl -s https://lore.kernel.org/linux-nfs/5b0eff4e3ef9bf9621f5095189933f60def40f0d.1690569488.git.lorenzo@kernel.org/raw
| dkimverify
signature verification failed

A DNS issue makes some sense; I've made some DNS/firewall changes here recently.


-- 
"We cannot take our next breath without the exhale."
 -- Ellen Scott Grable

Re: Most of my "b4 am" runs fail the DKIM test

[Konstantin Ryabitsev]

On Wed, Aug 02, 2023 at 10:57:35AM -0400, Chuck Lever wrote:
> curl -s https://lore.kernel.org/linux-nfs/5b0eff4e3ef9bf9621f5095189933f60def40f0d.1690569488.git.lorenzo@kernel.org/raw
> | dkimverify
> signature verification failed
> 
> A DNS issue makes some sense; I've made some DNS/firewall changes here recently.

The following should succeed for you for DKIM to work:

    dig -t txt k20201202._domainkey.kernel.org

-K

Re: Most of my "b4 am" runs fail the DKIM test

[Chuck Lever]

On Wed, Aug 2, 2023 at 11:54 AM Konstantin Ryabitsev
<konstantin@linuxfoundation.org> wrote:
>
> On Wed, Aug 02, 2023 at 10:57:35AM -0400, Chuck Lever wrote:
> > curl -s https://lore.kernel.org/linux-nfs/5b0eff4e3ef9bf9621f5095189933f60def40f0d.1690569488.git.lorenzo@kernel.org/raw
> > | dkimverify
> > signature verification failed
> >
> > A DNS issue makes some sense; I've made some DNS/firewall changes here recently.
>
> The following should succeed for you for DKIM to work:
>
>     dig -t txt k20201202._domainkey.kernel.org

My DNS server is on a different system than the firewall. The firewall
assumed that by default, the DNS service will be provided on the
firewall/gateway system.

I added a firewall rule to pass DNS requests from any host on my LAN.
That enabled the "dig" and the "dkimverify" commands to succeed.


-- 
"We cannot take our next breath without the exhale."
 -- Ellen Scott Grable