mirror of
https://gitlab.archlinux.org/archlinux/infrastructure.git
synced 2026-09-11 06:40:34 +02:00
Levente Polyak
c54eec4e43
In certain specific cases, OpenPGP signatures that were sent through our
postfix are corrupting and showing as invalid. The culprit is that MUA's
that also populate the multipart section with a User-Agent will have
their signed multipart section chopped. This only affects these MUA's
that do also add the User-Agent not just to the global section, but the
signed multipart section, which is well covered by the spec. One of the
examples is Thunderbird, which started adding it to the multipart
section.
The fix avoids this problem by only allowing the `msa_header_checks`
cleanup for the global section and avoid touching any of the multipart
of nested sections, which are these that are signed in case a signature
is issued. The reason is that `header_checks` is also inherited by
`mime_header_checks` and `nested_header_checks` in case these are not
declared.
Subsequently the fix explicitly declares and empty `mime_header_checks`
and `nested_header_checks`, removing the inherited `header_checks` for
these sections.
Link: https://www.postfix.org/header_checks.5.html
Fixes: 5eb777b9 ("postfix: Strip sensitive headers (user-agent + sender ip)")