#956806 lists.debian.org: changes messages with lines starting with "From", breaking DKIM signature

#956806#5
Date:
2020-04-15 12:53:16 UTC
From:
To:
The list setup on lists.d.o seems to have modified a mail I sent by
escaping a "From" at the beginning of the line to ">From". This also
broke the DKIM signature, my mail server reports "body hash mismatch".

The message can be found at [1].

Looking at the headers of my mail I find:

| X-Amavis-Spam-Status: No, score=-12.6 required=4.0
|  tests=DKIM_INVALID,DKIM_SIGNED,

with an invalid signature, but below that (earlier in the pipeline):

| X-Amavis-Spam-Status: No, score=-8.863 tagged_above=-10000 required=5.3
|  tests=[BAYES_00=-2, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1,

So it looks like the lists processing somehow breaks this...

I also noted that the test results are slighly different, only one of
them reports "LDOSUBSCRIBER" in the tests= list.  Maybe the moderation
stuff casuses mails to be scanned twice?

Ansgar

  [1]: https://lists.debian.org/debian-project/2020/04/msg00193.html

#956806#10
Date:
2020-04-15 15:22:37 UTC
From:
To:
report web page to make my comment, instead, I'm apparently writing an email.
I presume this will get to the right place.

Hmm, I probably should not respond to this as I cannot do a complete or maybe
even an adequate job.

I do know this.  When mail is stored in an mbox file, From at the beginning of
a line (admittedly with other requirements after the From) can indicated the
beginning of an mbox header, which separates one email from another.

A "real" mbox header has other stuff on that line that can and should be parsed
and considered to determine if it really is an mbox header, but some software
in the email chain typically escapes a From at the beginning of a line (by
prefixing it with a >, iirc) to, well, distinguish it from an mbox header and
make it easier on the mbox software somewhere in the chain.

I'd hesitate to suggest that "feature" should be disabled, there are probably
lots of places where that would cause a problem.

I don't know if there is another solution.

#956806#15
Date:
2020-04-20 08:04:11 UTC
From:
To:
I don't think this is a moderation-specific problem, as I've had it on
-backports: see below, "From cmake information".

The (non-spam) message
https://lists.debian.org/debian-backports/2020/02/msg00010.html was
"rejected per DMARC policy for yahoo.com" by my email provider.  (Their
settings don't appear to have a way to disable this filtering: the spam
filters I do control are already either off or
accept-and-place-in-junk-folder.)

Was the signature broken by a bug in lists.d.o (it shouldn't be, as
#752084 is closed as fixed), or was it invalid to begin with?
Dear subscriber,

We've encountered some problems while sending listmail to your
emailaddress rebecca_palmer@zoho.com.

In the last seven days we've seen bounces for the following list:
* debian-backports
	1 bounce out of 15 mails in 30 days (6%, kick-score is 80%)
	(https://lists.debian.org/bounces/WTET4qYN3Hfeqy4ZAtgWDQ)

(The link above points to a copy of the latest bounce
and will be valid for seven days.)

If the bounce-rate passes the kick-score, our bounce-detection will forcibly
remove your subscription.

Bounces happen from time to time when spam slips through our filters but are
rejected by your mail provider.  If you are your own mail provider and use
'Before-Queue Content filtering', you should whitelist bendel.debian.org
from
Content filtering.

However: You can safely ignore this message (and you will not be
unsubscribed
:-) ) if your bounce rate remains low.

For more information see https://wiki.debian.org/Teams/ListMaster/FAQ

You are welcome to contact listmaster@lists.debian.org if you think this
message was sent in error.

         Sincerely,
The Listmaster Team
-- 
http://lists.debian.org

That link contains:

 From MAILER-DAEMON  Thu Feb 20 03:33:06 2020
Return-Path: <>
X-Original-To:
bounce-debian-backports=rebecca_palmer=zoho.com@lists.debian.org
Delivered-To:
lists-bounce-debian-backports=rebecca_palmer=zoho.com@bendel.debian.org
Received: by bendel.debian.org (Postfix)
	id 2C0CE204C8; Thu, 20 Feb 2020 03:33:05 +0000 (UTC)
Date: Thu, 20 Feb 2020 03:33:05 +0000 (UTC)
From: MAILER-DAEMON@bendel.debian.org (Mail Delivery System)
Subject: Undelivered Mail Returned to Sender
To: bounce-debian-backports=rebecca_palmer=zoho.com@lists.debian.org
Auto-Submitted: auto-replied
MIME-Version: 1.0
Content-Type: multipart/report; report-type=delivery-status;
	boundary="B172C20236.1582169585/bendel.debian.org"
Message-Id: <20200220033305.2C0CE204C8@bendel.debian.org>

This is a MIME-encapsulated message.
Current cmake in debian is 3.13.4
set of
revisions:https://cmake.org/cmake/help/v3.16/release/3.16.html3.15.4 is
a bit more (seasoned with bug fixes from 3.13 and 3.14) and may be a
good candidate for at least a
backport:https://cmake.org/cmake/help/v3.15/release/3.15.html
As KitWare does NOT time stamp their revisions (slightly frustrating)
it's hard to say how old what revision is, however 3.13.4 says somewhere
2015.

I am aware that TRYING to install cmake from scratch on debian doesn't
work (having tried and failed). So I don't have the same option as I did
with KiCAD.

<html><head></head><body><div class=3D"yahoo-style-wrap" style=3D"font-fami=
ly:Helvetica Neue, Helvetica, Arial, sans-serif;font-size:16px;"><div dir=
=3D"ltr" data-setdir=3D"false"><div>Current cmake in debian is 3.13.4<br></=
div><div>From cmake information the following can be derived.</div><div dir=
=3D"ltr" data-setdir=3D"false">3.16.4 is the last set of revisions:</div><d=
iv dir=3D"ltr" data-setdir=3D"false"><span class=3D"ydp3b9449e0pasted-link"=
=3D"ltr" data-setdir=3D"false">3.15.4 is a bit more (seasoned with bug fixe=
s from 3.13 and 3.14) and may be a good candidate for at least a backport:<=
/div><div dir=3D"ltr" data-setdir=3D"false"><span class=3D"ydpda14a5c6paste=
d-link">https://cmake.org/cmake/help/v3.15/release/3.15.html</span></div><d=
iv dir=3D"ltr" data-setdir=3D"false"><br></div><div dir=3D"ltr" data-setdir=
=3D"false">As KitWare does NOT time stamp their revisions (slightly frustra=
ting) it's hard to say how old what revision is, however 3.13.4 says somewh=
ere 2015.<br></div><div dir=3D"ltr" data-setdir=3D"false"><br></div><div di=
r=3D"ltr" data-setdir=3D"false">I am aware that TRYING to install cmake fro=
m scratch on debian doesn't work (having tried and failed). So I don't have=
  the same option as I did with KiCAD.<br></div></div></div></body></html>
------=_Part_3976001_1565340796.1582168182033--

#956806#20
Date:
2025-02-08 04:48:55 UTC
From:
To:
Final Notice.

You are among the beneficiaries of 2024/2025 grant for all scam victims and relatives reconfirm your email if active for more details

Thank You.

Regards
Mr. Rowland Cole
( Financial Crimes Enforcement Network)