Authenticated Received Chain (RFC 8617): verifying the chain of ARC sets a message carries, and sealing it with one more, so the authentication results of earlier hops survive forwarding and mailing lists.
verifier = Sovite.ARC.new(fields)
body = Sovite.DKIM.Body.new(Sovite.ARC.body_specs(verifier))
...
%Sovite.ARC.Result{cv: :pass} = Sovite.ARC.finish(verifier, hashes, resolver)
Sovite.ARC.seal(fields, body_hash, result, auth_results, key)
#=> [arc_authentication_results, arc_message_signature, arc_seal]An ARC set is three fields with the same instance i=:
ARC-Authentication-Results: (the results the sealer saw),
ARC-Message-Signature: (a DKIM-like signature of the message), and
ARC-Seal: (a signature over all ARC sets so far).
Header fields are as returned by Sovite.Message.Headers.parse/1; keys
are Sovite.DKIM.SigningKeys. Body hashes come from
Sovite.DKIM.Body.
Summary
Functions
The body hashes the newest ARC-Message-Signature: needs.
Validates the chain (RFC 8617 §5.2): the newest message signature and every seal must verify.
Reads the ARC sets of header fields and checks their structure.
Adds an ARC set to a message (RFC 8617 §5.1), recording result, the
chain status finish/3 returned, and auth_results, the
Authentication-Results: value this server computed (from
Sovite.AuthResults.value/2, authserv-id first).
Types
Functions
@spec body_specs(t()) :: [Sovite.DKIM.Body.spec()]
The body hashes the newest ARC-Message-Signature: needs.
@spec finish( t(), %{required(Sovite.DKIM.Body.spec()) => {binary(), non_neg_integer()}}, Sovite.DNS.resolver() ) :: Sovite.ARC.Result.t()
Validates the chain (RFC 8617 §5.2): the newest message signature and every seal must verify.
@spec new([Sovite.Message.Headers.field()], keyword()) :: t()
Reads the ARC sets of header fields and checks their structure.
Options
:now- Unix seconds, for expired signatures. Defaults to now.
@spec seal( [Sovite.Message.Headers.field()], binary(), Sovite.ARC.Result.t(), String.t(), Sovite.DKIM.SigningKey.t(), keyword() ) :: [String.t()]
Adds an ARC set to a message (RFC 8617 §5.1), recording result, the
chain status finish/3 returned, and auth_results, the
Authentication-Results: value this server computed (from
Sovite.AuthResults.value/2, authserv-id first).
Returns the three fields to put at the top of the message, or []
when the chain must not be sealed: it already failed, or is at the
limit of 50 instances. body_hash is for Sovite.DKIM.body_spec/0.
Options
:headers- names of the fields the message signature covers when present. Defaults toSovite.DKIM.default_headers/0andDKIM-Signature.:timestamp- Unix seconds fort=. Defaults to now.