X-Git-Url: https://git.distorted.org.uk/~mdw/exim-config/blobdiff_plain/cafa05d1d38121adde469bfa196df7ddac7ee00a..d4f4bfc3ea47f8ba89db46a8b48ded19add391e1:/base.m4

diff --git a/base.m4 b/base.m4
index 0620a9b..1b671ef 100644
--- a/base.m4
+++ b/base.m4
@@ -451,8 +451,20 @@ m4_define(<:DKIM_SIGN:>,
 			{CONF_dkim_keys_dir/$value/active/$dkim_selector.priv}:>)
 	dkim_canon = relaxed
 	dkim_strict = true
-	dkim_sign_headers = CONF_dkim_headers:\
-		X-CONF_header_token-DKIM-Key-Publication
+	## The following ridiculous stunt does two important jobs.  Firstly,
+	## and more obviously, it arranges to include one more copy of each
+	## header name than the message actually contains, thereby causing
+	## the signature to fail if another header with the same name is
+	## added.  And secondly, and far more subtly, it also trims the
+	## spaces from the header names so that they're in the format that
+	## the signing machinery secretly wants.
+	dkim_sign_headers = \
+		${sg {${map {CONF_dkim_headers : \
+			     X-CONF_header_token-DKIM-Key-Publication} \
+			    {$item${sg {${expand:\$h_$item:}\n} \
+				       {((?:[^\n]+|\n\\s+)*)\n} \
+				       {:$item}}}}} \
+		     {::}{:}}
 	headers_add = \
 		${if DKIM_SIGN_P \
 			{DKIM_KEYS_INFO(<:m4_dnl