panel-dkim-signing stage 1: the panel's DKIM signer, beside OpenDKIM

internal/milter/sign.go: a milter on two sockets (cmd/panel/signer.go):
sign.sock for 465/587, the key of the domain the SASL login belongs to
(Bindings.DomainOf, the sender_login_maps Postfix reads), and
sign-local.sock for the panel's own sendmail(1) mail, the server's name.
go-msgauth/dkim v0.7.0, relaxed/simple, OpenDKIM's dkim_should_signhdrs[]
(libopendkim/dkim.c:223-246) in message order plus From once more; keys
and selectors from the KeyTable the panel writes, a key path outside the
key directory refused; strict - whatever cannot be signed is deferred.

From the sources: Postfix 3.10.13 milter8.c:2329-2400 hands a folded
header \n-separated, so the signer joins its lines with CRLF; inserts are
1-based in cleanup_ins_header() (cleanup_milter.c:1193), so index 0 is the
top, where OpenDKIM puts its own (opendkim.c:3673). go-milter v0.4.1 calls
no Abort when a connection ends, so a watchdog closes go-msgauth's
streaming signer after an hour and a late end of message is deferred.

Postfix: smtpd_milters = sender check, signer, OpenDKIM, journal;
non_smtpd_milters = the signer's local socket, OpenDKIM - both sign every
message until stage 2. disable_mime_output_conversion=yes (default off,
mail_params.h:3088): an 8-bit message is no longer re-encoded after it is
signed.

Tests: unit tests sign and verify folded, tab-led and space-free headers,
an added From:, a changed body, two messages on a connection, odd bodies,
and five cases deferred. e2e: the sink image has python3-dkim (dkimpy
1.1.8-2) and the stand's DNS; on an application's message and on a
notification the two signatures must agree on h=, bh=, c=, s=, a= and each
must pass dkimverify. On the server: make e2e exit 0 (714 s), go vet + go
test 27 packages ok.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

test/e2e/compose.override.yml

@@ -109,6 +109,9 @@ services:
       context: ../sink
     volumes:
       - ./mail-stage:/mail
+    # dkimverify looks the DKIM keys up in the fake zone.
+    dns:
+      - 10.77.0.10
     networks:
       e2e:
         ipv4_address: 10.77.0.11

test/e2e/mail_helpers.go

@@ -28,7 +28,15 @@ const (
 // sleeping a fixed duration is what keeps this deterministic even under a
 // slow CI runner (plan C.4).
 func findSinkMessage(stageDir, token string, timeout time.Duration) ([]byte, error) {
+	_, raw, err := findSinkFile(stageDir, token, timeout)
+	return raw, err
+}
+
+// findSinkFile is findSinkMessage that also says the file's name in the
+// sink's /mail (the same directory, mounted).
+func findSinkFile(stageDir, token string, timeout time.Duration) (string, []byte, error) {
 	dir := filepath.Join(stageDir, "mail-stage")
+	var name string
 	var found []byte
 	err := waitFor(fmt.Sprintf("sink-MX to receive a message tagged %q", token), timeout, 300*time.Millisecond, func() (bool, error) {
 		entries, err := os.ReadDir(dir)
@@ -44,19 +52,20 @@ func findSinkMessage(stageDir, token string, timeout time.Duration) ([]byte, err
 				continue
 			}
 			if bytes.Contains(b, []byte(token)) {
-				found = b
+				name, found = e.Name(), b
 				return true, nil
 			}
 		}
 		return false, fmt.Errorf("no dumped message contains %q yet (%d on disk)", token, len(entries))
 	})
-	return found, err
+	return name, found, err
 }
 
 // verifyDKIM checks that raw (a message dumped by the sink) carries a DKIM
-// signature for domain that validates against the public key published in the
-// fake zone — i.e. exactly what a real receiver would check, using DNS the
-// harness itself controls instead of net.DefaultResolver (plan C.4).
+// signature for domain and that every signature for it validates against the
+// public key published in the fake zone — i.e. exactly what a real receiver
+// would check, using DNS the harness itself controls instead of
+// net.DefaultResolver (plan C.4).
 func verifyDKIM(raw []byte, domain string) error {
 	verifications, err := dkim.VerifyWithOptions(bytes.NewReader(raw), &dkim.VerifyOptions{
 		LookupTXT: lookupTXTFunc(),
@@ -64,15 +73,73 @@ func verifyDKIM(raw []byte, domain string) error {
 	if err != nil {
 		return fmt.Errorf("dkim verify: %w", err)
 	}
+	n := 0
 	for _, v := range verifications {
 		if v.Domain == domain {
 			if v.Err != nil {
 				return fmt.Errorf("dkim signature for %s did not validate: %w", domain, v.Err)
 			}
-			return nil
+			n++
 		}
 	}
-	return fmt.Errorf("no DKIM signature found for domain %s (got %d signature(s))", domain, len(verifications))
+	if n == 0 {
+		return fmt.Errorf("no DKIM signature found for domain %s (got %d signature(s))", domain, len(verifications))
+	}
+	return nil
+}
+
+// checkBothSigners is the oracle of docs/plans/panel-dkim-signing.md, stage
+// 1: the panel's signer and OpenDKIM both sign (OpenDKIM after the panel in
+// the chain, so its signature is the top one - build/postfix-config.sh);
+// the two must agree on what they sign - the same h= and bh= - and each
+// must verify with dkimpy (python3-dkim in the sink image), an
+// implementation that is neither go-msgauth, the panel's library, nor
+// OpenDKIM. name is the file in the sink's /mail.
+func checkBothSigners(s *stack, name string, raw []byte, domain string) error {
+	msg, err := mail.ReadMessage(bytes.NewReader(raw))
+	if err != nil {
+		return fmt.Errorf("parse the delivered message: %w", err)
+	}
+	var sigs []map[string]string
+	for _, v := range msg.Header["Dkim-Signature"] {
+		tags := dkimTags(v)
+		if tags["d"] == domain {
+			sigs = append(sigs, tags)
+		}
+	}
+	if len(sigs) != 2 {
+		return fmt.Errorf("%d DKIM signatures for %s, want 2 (the panel's and OpenDKIM's)", len(sigs), domain)
+	}
+	for _, tag := range []string{"bh", "h", "c", "s", "a"} {
+		a, b := sigs[0][tag], sigs[1][tag]
+		if tag == "h" {
+			a, b = strings.ToLower(a), strings.ToLower(b)
+		}
+		if a != b {
+			return fmt.Errorf("the signatures differ in %s=: OpenDKIM %q, the panel %q", tag, a, b)
+		}
+	}
+	for i := range sigs {
+		out, err := s.execIn("sink", "sh", "-c", fmt.Sprintf("dkimverify --index %d < '/mail/%s'", i, name))
+		if err != nil || !strings.Contains(out, "signature ok") {
+			return fmt.Errorf("dkimpy on signature %d (%s): %v\n%s", i, []string{"OpenDKIM's", "the panel's"}[i], err, out)
+		}
+	}
+	return nil
+}
+
+// dkimTags splits a DKIM-Signature value into its tags, white space removed
+// (RFC 6376 § 3.2: tag=value pairs separated by ";", FWS anywhere).
+func dkimTags(v string) map[string]string {
+	tags := map[string]string{}
+	for _, part := range strings.Split(v, ";") {
+		k, val, ok := strings.Cut(part, "=")
+		if !ok {
+			continue
+		}
+		tags[strings.TrimSpace(k)] = strings.Join(strings.Fields(val), "")
+	}
+	return tags
 }
 
 // postfixReceived returns the Received: headers of raw that a Postfix smtpd

test/e2e/main_test.go

@@ -267,13 +267,16 @@ func TestE2E(t *testing.T) {
 				res.dialErr, res.authErr, res.mailErr, res.rcptErr, res.dataErr)
 		}
 
-		raw, err := findSinkMessage(h.stageDir, token, 30*time.Second)
+		file, raw, err := findSinkFile(h.stageDir, token, 30*time.Second)
 		if err != nil {
 			t.Fatalf("message never reached the sink: %v", err)
 		}
 		if err := verifyDKIM(raw, senderDomain); err != nil {
 			t.Fatalf("DKIM did not verify against the record the panel published: %v", err)
 		}
+		if err := checkBothSigners(h, file, raw, senderDomain); err != nil {
+			t.Fatalf("the panel's signer: %v\n%s", err, raw)
+		}
 		if err := checkReceivedHidden(raw); err != nil {
 			t.Fatalf("port 465 should hide the application's session: %v", err)
 		}

test/e2e/notifications_test.go

@@ -93,7 +93,7 @@ func testNotificationsSetUp(t *testing.T, sc *scenario) {
 // (internal/notify): here it would be a minute of waiting for nothing to happen.
 func testRateLimitRefusalIsNotified(t *testing.T, sc *scenario) {
 	subject := "[SelfPost] " + senderDomain + ": a rate limit is refusing mail"
-	raw, err := findSinkMessage(h.stageDir, subject, 100*time.Second)
+	file, raw, err := findSinkFile(h.stageDir, subject, 100*time.Second)
 	if err != nil {
 		t.Fatalf("no notification reached %s: %v\npanel log:\n%s", adminEmail, err, tailLines(h.logs("selfpost"), "notify", 20))
 	}
@@ -108,6 +108,9 @@ func testRateLimitRefusalIsNotified(t *testing.T, sc *scenario) {
 			t.Errorf("the notification lacks %q:\n%s", want, msg)
 		}
 	}
+	if err := checkBothSigners(h, file, raw, serverName); err != nil {
+		t.Errorf("the panel's signer on its own mail: %v", err)
+	}
 	if err := verifyDKIM(raw, serverName); err != nil {
 		t.Errorf("the notification is not signed as %s with the key Settings shows: %v", serverName, err)
 	}

test/e2e/sink/Dockerfile

@@ -2,14 +2,17 @@
 # each transaction to its own file under /mail, so the test harness can read
 # the raw received message (headers + body, including the DKIM-Signature
 # Postfix/OpenDKIM added) straight off disk. smtp-sink ships in the postfix
-# package itself — no new dependency.
+# package itself. python3-dkim (dkimpy 1.1.8-2 in trixie, /usr/bin/dkimverify)
+# is the independent DKIM verifier the suite holds the panel's signer to
+# (docs/plans/panel-dkim-signing.md); it looks the keys up through the
+# stand's CoreDNS (compose.override.yml, sink's dns).
 FROM debian:trixie-slim
 
 ENV DEBIAN_FRONTEND=noninteractive
 RUN echo "postfix postfix/mailname string localhost" | debconf-set-selections \
  && echo "postfix postfix/main_mailer_type string Internet Site" | debconf-set-selections \
  && apt-get update \
- && apt-get install -y --no-install-recommends postfix \
+ && apt-get install -y --no-install-recommends postfix python3-dkim \
  && rm -rf /var/lib/apt/lists/*
 
 RUN mkdir -p /mail