Add own DKIM key for debian.org address.

Cf. https://lists.debian.org/debian-devel-announce/2020/04/msg00004.html .  \o/

It's also fairly easy to deploy onto the Debian infrastucture:

    $ USERNAME="guilhem"
    $ SELECTOR="5d30c523ff3622ed454230a16a11ddf6.$USERNAME.user"
    $ printf "dkimPubKey: %s %s\n" "$SELECTOR" \
                "$(openssl pkey -pubin -in "./certs/dkim/$SELECTOR:debian.org.pub" -outform DER | base64 -w0)" \
        | gpg --clearsign | s-nail -r "USERNAME@debian.org" -s dkimPubKey changes@db.debian.org

3 files changed, 14 insertions, 1 deletions

diff --git a/certs/dkim/5d30c523ff3622ed454230a16a11ddf6.guilhem.user:debian.org.pub b/certs/dkim/5d30c523ff3622ed454230a16a11ddf6.guilhem.user:debian.org.pub
new file mode 100644
index 0000000..bc14abf
--- /dev/null
+++ b/certs/dkim/5d30c523ff3622ed454230a16a11ddf6.guilhem.user:debian.org.pub
@@ -0,0 +1,9 @@
+-----BEGIN PUBLIC KEY-----
+MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvGwfj6qfh15Nr/fLITGU
+ES9Vxtjqz6XR8uYifT9P6n80yVLLF0mCVvekSsH8Y8ZShmDmlqrNAM8i5MyKSGTq
+nMTABFlXa0bCHSjY3MNTG0PEn2yUGuc2IsmZWps8oaut5AGirEHoKjx/p2TpcFlD
+8DsyojlFbsIYmAQe65nfliDM8Qiu7NgJlghfRTTBTeXJ2yijrPymBFhJ1z1GWxUm
+nJHzj4I5ySvOmNgCVfv6nP6OjaGOdso8hiS6rse84evRlczFp+IQ/3ErP4HyNZlS
+gHFwRzcENwFdiZ9H3KjM5MUwUJ9ifyy1n2bH/5LOVEsqzmbVJqwrTi1gIP3JQL9z
+EwIDAQAB
+-----END PUBLIC KEY-----
diff --git a/group_vars/all.yml b/group_vars/all.yml
index 4fcfc39..abafc8e 100644
--- a/group_vars/all.yml
+++ b/group_vars/all.yml
@@ -41,20 +41,23 @@ postfix_instance:
   MSA:     { name: msa
            , addr: "{{ (groups.all | length > 1) | ternary( ipsec[ hostvars[groups.MSA[0]].inventory_hostname_short ], '127.0.0.1') }}"
            , port: 2587 }
   lists:   { name: lists
            , addr: "{{ (groups.all | length > 1) | ternary( ipsec[ hostvars[groups.lists[0]].inventory_hostname_short ], '127.0.0.1') }}"
            , port: 2527 }
 
 imapsvr_addr: "{{ postfix_instance.IMAP.addr | ipaddr }}"
 
 dkim_keys:
   giraff:
     # match key
     "fripost.org":
       # domain of the entity signing the message (should be unique accross match keys)
       d: fripost.org
       # selector (randomly generated with `xxd -p -l16 </dev/urandom`)
       s: 8f00fb94ec6c37aacb48bd43e073f9b7
     "~": # catch-all, for our virtual domains
       d: x.fripost.org
       s: 9df9cdc7e101629b5003b587945afa70
+    "guilhem@debian.org":
+      d: debian.org
+      s: 5d30c523ff3622ed454230a16a11ddf6.guilhem.user
diff --git a/roles/amavis/templates/etc/amavis/conf.d/50-user.j2 b/roles/amavis/templates/etc/amavis/conf.d/50-user.j2
index a09c366..8563a8c 100644
--- a/roles/amavis/templates/etc/amavis/conf.d/50-user.j2
+++ b/roles/amavis/templates/etc/amavis/conf.d/50-user.j2
@@ -16,46 +16,47 @@ use strict;
 $max_servers = 5;
 $recipient_delimiter = '+';
 
 $mydomain = 'fripost.org';
 $X_HEADER_LINE = "Debian $myproduct_name at $mydomain";
 
 @mynetworks_maps = ();
 @remove_existing_spam_headers_maps = ();
 @bypass_virus_checks_maps = (); # load virus checking code
 
 
 $enable_dkim_verification = 1; # load DKIM signing/verifying code
 {% if 'out' not in group_names %}
 undef $enable_dkim_signing;
 @bypass_spam_checks_maps = (); # load spam checking code
 {% else %}
 $enable_dkim_signing = 1;
 # Sign *all* outgoing mails with *our* key (yes, amavis complains, but this is
 # safe as we force our domain with the 'd' tag).
 {% for x,k in dkim_keys[inventory_hostname_short] | default({}) | dictsort() -%}
-dkim_key({{ (x == "~") | ternary('qr/./', "'"+x+"'") }}, '{{ k.s }}', '/etc/amavis/dkim/{{ k.s }}:{{ k.d }}.pem');
+dkim_key({{ (x == "~") | ternary('qr/./', "'"+(x | regex_replace('^.*@',''))+"'") }}, '{{ k.s }}', '/etc/amavis/dkim/{{ k.s }}:{{ k.d }}.pem');
 {% endfor -%}
 @dkim_signature_options_bysender_maps = (
 {% for x,k in dkim_keys[inventory_hostname_short] | default({}) | dictsort() %}
     { '{{ (x == "~") | ternary('.', x) }}' => {
         d => '{{ k.d }}'
+      , s => '{{ k.s }}'
       , a => 'rsa-sha256'
       , ttl => 21*24*3600
       , c => 'relaxed/simple' }
     }{% if not loop.last %},
 {% endif %}
 {% endfor %}
 );
 # Conform to RFC 4871 and don't sign Received: headers.
 $signed_header_fields{received} = 0;
 {% endif %}
 
 
 
 # Defang viruses and nothing else
 %defang_maps_by_ccat = ( &CC_VIRUS    => 1
                        , &CC_CATCHALL => undef
                        );
 
 # Don't change the subject for unchecked messages (not by-recip)
 delete $subject_tag_maps_by_ccat{+CC_UNCHECKED};