0.4.0: implement signing, namespace the library, fix verification bugs

[angrychimp]

Breaking release. Classes move to PSR-4 under angrychimp\DKIM\; signing is implemented; several verification bugs are fixed.

The old global names (DKIM_Sign, DKIM_Verify, DKIM_Exception) still work as Composer-loaded aliases, so existing code keeps running.

Signing

Open since 2012. Reuses the canonicalization the verifier already had, so Sign is small. Supports relaxed/simple, sha1/sha256, configurable signed-header sets, and RFC 6376 5.4.2 bottom-to-top ordering for repeated headers.

$signer = new angrychimp\DKIM\Sign($rawMessage, array(
    'domain' => 'example.com', 'selector' => 'mail',
    'private_key' => file_get_contents('/path/to/private.pem'),
));
echo $signer->sign();

Security fixes

• openssl_verify() returns -1 on internal error, which is truthy. if (!$vResult) therefore reported an errored verification as a pass. Now requires an explicit success.
• a= was never validated. A signature naming any algorithm (e.g. ed25519-sha256) was still verified as RSA. Restricted to rsa-sha1/rsa-sha256, and checked before the DNS lookup so a bogus a= costs no network traffic.

Correctness fixes

Each of these silently produced, or rejected, signatures no other implementation agreed with:

• Header lookup matched on a bare prefix, so Message-ID also matched Message-ID-Hash — the header Mailman 3 adds to every list message.
• Relaxed canonicalization of an empty body emitted CRLF instead of a null input. In the shared parent class, so it broke verification too.
• h= was deduplicated, so a message repeating a header could never verify.
• x= expiration was never enforced, and reading t= unguarded errored when x= appeared alone.
• c= now defaults to simple/simple and tolerates a lone algorithm.

Plus hardening against malformed input: tags and key records with no = or a trailing ; (how real DKIM TXT records are written), q= with no /, headers with no colon, failed DNS lookups, and messages with no blank line — whose body was previously read from the middle of a header.

Testing

Three suites (tests/expiry.php, tests/sign.php, tests/verify.php), no framework, no fixtures, no DNS — keypairs are generated per run.

CI runs them on PHP 7.4–8.4, and cross-checks against dkimpy in both directions. That second job matters: the signer and verifier share _canonicalizeBody(), so this library agreeing with itself proves little. Two of the bugs above survived a fully green round-trip run and were only caught by an independent implementation. The empty-body and h= tests are therefore asserted against the RFC directly rather than round-tripped.

Every fix in this PR was mutation-tested — reverting it must fail the suite.

Not included

l= (deliberately — it lets an attacker append content), ed25519 (RFC 8463), and the phpseclib 1.x code path, which is unreachable with phpseclib 2.x+, untested, and passes a bare base64 key to loadKey(). Tracked in TODO.md; I'd suggest deleting it.

🤖 Generated with Claude Code