vcswatch reports that
this package seems to have a new changelog entry (version
1.6.0-1, distribution
unstable) and new commits
in its VCS. You should consider whether it's time to make
an upload.
Here are the relevant commit messages:
commit 809092ebfdbe36fbb7f0b1b9db926f7d753200a2
Author: Alberto Bertogli <albertito@blitiri.com.ar>
Date: Sun Aug 23 20:41:54 2026 +0100
Update changelog for release 1.6.0-1
commit d342b450681f0b7670424ddc0e02966e879cc58f
Author: Alberto Bertogli <albertito@blitiri.com.ar>
Date: Sun Aug 23 20:37:52 2026 +0100
Remove now-unnecessary Depends (after debhelper >=14)
commit ae67da0bcbba85a4d0115221bc39a6b3e08e6f8d
Author: Alberto Bertogli <albertito@blitiri.com.ar>
Date: Sun Aug 23 20:35:06 2026 +0100
Add upstream metadata file
commit 5b0e55cd7628f975aae866713bac4567713aaad4
Author: Alberto Bertogli <albertito@blitiri.com.ar>
Date: Sun Aug 23 20:26:11 2026 +0100
debhelper-compat 14 and Standards-Version 4.7.4
commit 38101c2ebcc39338a5ae826e4f90259922e3b962
Author: Alberto Bertogli <albertito@blitiri.com.ar>
Date: Sun Aug 23 20:18:00 2026 +0100
Drop Priority and Rules-Requires-Root, as per new policy
commit c56d0334141338bbcb4573d2e6f7e091e9f02815
Author: Alberto Bertogli <albertito@blitiri.com.ar>
Date: Sun Aug 23 20:12:55 2026 +0100
debian/watch: Update to version 5
commit f815ded3fda9836dbffad67877d3afb03115aefb
Author: Alberto Bertogli <albertito@blitiri.com.ar>
Date: Sun Aug 23 19:54:45 2026 +0100
New upstream release (1.6.0)
commit 1e8ce1ee0edee48b83a443cc28f74a394bbfe87d
Merge: 3140e26 e17a976
Author: Alberto Bertogli <albertito@blitiri.com.ar>
Date: Sun Aug 23 19:54:14 2026 +0100
Merge tag 'upstream/1.6.0'
upstream/1.6.0
commit e17a9766b452624ada6aa39506c3335cd1b2aa43
Author: Alberto Bertogli <albertito@blitiri.com.ar>
Date: Sun Aug 23 13:02:26 2026 +0100
ptr: Make reverse DNS lookup errors fail to match
Currently, when processing a ptr mechanism, if the reverse DNS lookup
fails (with other than NXDOMAIN), then it returns temperror.
However, the standard is clear that we should just fail to match
instead:
> Check all validated domain names to see if they either match the
> <target-name> domain or are a subdomain of the <target-name> domain.
> If any do, this mechanism matches. If no validated domain name can
> be found, or if none of the validated domain names match or are a
> subdomain of the <target-name>, this mechanism fails to match. If a
> DNS error occurs while doing the PTR RR lookup, then this mechanism
> fails to match. If a DNS error occurs while doing an A RR lookup,
> then that domain name is skipped and the search continues.
https://tools.ietf.org/html/rfc7208#section-5.5
This patch fixes this by making those lookup errors fail to match as
described by the standard.
commit d2b814bc9cdd8cb89726a72e8fc3ee8fff7124be
Author: Alberto Bertogli <albertito@blitiri.com.ar>
Date: Sun Aug 23 12:46:31 2026 +0100
test: Remove unnecessary "skip" from passing tests
Some of the tests were marked as "skip", but are currently passing after
recent changes.
This patch removes the now-unnecessary "skip" lines.
commit 856e3a769363512c3a917ebdf81b240327603d8c
Author: Alberto Bertogli <albertito@blitiri.com.ar>
Date: Sat Aug 22 17:02:26 2026 +0100
test: Add more tests from RFC 7208
The existing test suite is fairly comprehensive, and we already have
code coverage. But going through RFC 7208, there are some corner cases
that are not included.
This patch adds more tests based on RFC 7208, including some we are
currently not passing (either intentionally or due to bugs), which are
marked as skipped.
commit 112b78dccc733f1dbc8c8489685af1484d09588e
Author: Alberto Bertogli <albertito@blitiri.com.ar>
Date: Sat Aug 22 10:21:16 2026 +0100
ci: Update versions of actions/checkout and actions/setup-go
The versions of actions/checkout and actions/setup-go we use are
deprecated and may stop working in the future.
This patch updates them to the latest, and also set explicit permissions
to read-only.
commit 5c91a7f1fe51ce590e634da6a1a9f0bce2b8ba3c
Author: Alberto Bertogli <albertito@blitiri.com.ar>
Date: Sat Aug 22 10:06:41 2026 +0100
git: Rename stable branch to "main"
These days `main` is more common, and I find it more intuitive.
commit 774fb1b68a08d8444e600bde83cec41e5c3a1d27
Author: Alberto Bertogli <albertito@blitiri.com.ar>
Date: Fri Aug 21 22:50:01 2026 +0100
a, mx: Reject malformed fields without domain
Fields like "a:" or "mx:/24" are malformed, but currently we accept them
with the current domain. This is fairly harmless in general but can
cause interoperability problems, and checkers to return wrongly positive
results.
This patch fixes the bug by explicitly rejecting those kinds of
malformed fields.
commit a2c34380020b65b39520a2decd74aed0713ccd26
Author: Alberto Bertogli <albertito@blitiri.com.ar>
Date: Fri Aug 21 22:29:50 2026 +0100
Improve redirect= and exp= case-insensitive handling
The redirect= and exp= modifiers should be identified in a
case-insensitive way; however, we handle this inconsistently, and that
can lead to some cases where a duplicated modifier is accepted instead
of rejected.
This patch corrects that by using ascii-case-insensitive comparisons for
identifying the known modifiers.
This is extremely unlikely to appear in practice, but still it's worth
adjusting the implementation to match the standard.
commit 1e7306a69cb5e297e1b13aed95426a6209a9de07
Author: Alberto Bertogli <albertito@blitiri.com.ar>
Date: Fri Aug 21 22:01:56 2026 +0100
Ignore unrecognized modifiers
Currently, if we see any unrecognized modifiers, we return permerror.
This is against the standard, which says they should be ignored:
> Unrecognized modifiers MUST be ignored no matter where, or how often,
> they appear in a record. This allows implementations conforming to
> this document to gracefully handle records with modifiers that are
> defined in other specifications.
https://tools.ietf.org/html/rfc7208#section-6
So this patch explicitly identifies unrecognized modifiers, and ignores
them.
While this is rare in the wild, some places may still be using the
pre-standard "ra=", "rp=" and "rr=" modifiers.
Existing standard tests cover this scenario, but unfortunately were
incorrectly marked as skipped a long time ago. This patch also removes
the skip, incorporating the tests.
commit 2868f0bfddcd7e785526155486bb06469418a45b
Author: Alberto Bertogli <albertito@blitiri.com.ar>
Date: Tue Aug 18 00:09:56 2026 +0100
macro: Reject invalid and non-terminated macros
Currently in the macro parsing we accept (and ignore) invalid macro
characters, and also accept non-terminated macros.
To fix both bugs, and make the parser more standards-compliant, this
patch makes the code more strict in those checks.
In addition to the pre-existing tests, the regexp was cross-checked
against RFC 7208, to make sure we are not going to accidentally reject a
valid macro.
commit 0ae099826d2645f5e4eaf2274d521fe1158afe47
Author: Alberto Bertogli <albertito@blitiri.com.ar>
Date: Mon Aug 17 22:48:19 2026 +0100
ptr: Fix subdomain checking
As per RFC, for ptr matches we want to check the domain is the same, or
a subdomain. From https://tools.ietf.org/html/rfc7208#section-5.5:
> Check all validated domain names to see if they either match the
> <target-name> domain or are a subdomain of the <target-name> domain.
> If any do, this mechanism matches. If no validated domain name can
> be found, or if none of the validated domain names match or are a
> subdomain of the <target-name>, this mechanism fails to match.
Today we check this with a plain suffix comparison, so the match can
happen in the middle of a label: "notexample.com" is accepted as a match
for "ptr:example.com". This is a bug, and can cause incorrect passes.
This patch fixes the problem by using a new isSubdomain helper.
To implement isSubdomain, we have to do ASCII-only case-insensitive
comparison, due to dubtleties around DNS case-sensitivity rules, and the
possibility of non-ASCII data in the names.
commit 991f9bdde46b13b219065fb8d6a4d7ce9215b892
Author: Alberto Bertogli <albertito@blitiri.com.ar>
Date: Mon Aug 17 22:08:40 2026 +0100
ptr: Validate names against the IP being checked
When evaluating a `ptr`, we should check that the IP being checked is
among the ones returned, as per RFC 7208 section 5.5:
> For each record returned, validate the domain name by looking up its
> IP addresses. [...] If <ip> is among the returned IP addresses, then
> that domain name is validated.
Today, the forward resolution only checks that the name resolves to
something, not that it includes the IP we are checking. That is a bug
and can allow some checks to pass incorrectly.
This patch fixes the bug by only adding a name to the list to check if
one of the addresses it resolves to is the IP being checked. None of
the current tests cover this case (that's how the bug snuck in), so this
patch also adds explicits tests for it.
Note the behaviour was cross-checked against libspf2 and pyspf, and both
libraries implement it correctly.
commit 7a83916d6b64d8ef0baf3f2b12432b3eed594f49
Author: Alberto Bertogli <albertito@blitiri.com.ar>
Date: Mon Aug 17 21:27:03 2026 +0100
Update the code to use modern Go features/functions
Now that the minimum supported Go version is 1.25, this patch updates
the code to make use of some new features and functions to improve
readability.
There are no functional changes.
The Result values are now const instead of var, so callers can no longer
reassign them. Note this means "&spf.Pass" and assignments to it (and friends)
no longer compile. But neither are expected in this context, and a review of
all known users found no instances of problematic usage.
commit 245e1de25f72e84bd569f3bc9f35efe00ff50b12
Author: Alberto Bertogli <albertito@blitiri.com.ar>
Date: Mon Aug 17 21:06:43 2026 +0100
test: Remove internal/dnstest package
The internal/dnstest package was needed only due to a limitation in the
previous fuzz testing harness.
In modern tooling, the fuzz tests can make use of other test helpers, so
this patch removes the internal package and moves its code to a normal
test file.
commit 3110cbeb516a12d62ed526f930a0a009590dca6f
Author: Alberto Bertogli <albertito@blitiri.com.ar>
Date: Mon Aug 17 20:47:29 2026 +0100
test: Update and fix fuzz tests to modern tooling
This patch updates the fuzz tests to modern tooling (after the bump in
minimum Go version to 1.25), and also fix a bug that was causing the
record not to be fully evaluated.
As part of this, the fuzzing can now exercise a lot more code, and the
corpus has been updated accordingly, after a 10m run.
Current coverage of the fuzzing corpus (measured with
`go test -run=Fuzz -cover`) is 87.2%.
commit 687a1f11e95cef5b2bdc07a00e8ab70a6941ea88
Author: Alberto Bertogli <albertito@blitiri.com.ar>
Date: Mon Aug 17 20:41:12 2026 +0100
go: Bump minimum supported version to 1.25
This commit bumps the minimum supported Go version to 1.25.
Go 1.25 was released 2025-08-12, a year ago by now, and a lot of changes
have happened since the previous minimum of 1.15.
This is in preparation for some upcoming changes, e.g. update the fuzz
testing to modern tooling.
commit 541dee7040ae1f0ba690e25ec1767ab79e9eb4b1
Author: Alberto Bertogli <albertito@blitiri.com.ar>
Date: Mon Aug 17 20:05:48 2026 +0100
Validate IP addresses given to Check functions
The IP address passed to the Check functions must be valid, otherwise
the library can't properly do an SPF check.
If they're not valid, they can cause a panic in some evaluations. To
protect against this (unlikely) scenario, this patch adds some checks.
Now, if an invalid IP is given, the Check functions return an error.
commit 36663db334c24069e5ea0d348a6e57cfb6287dfd
Author: Alberto Bertogli <albertito@blitiri.com.ar>
Date: Sun Aug 16 14:50:32 2026 +0100
doc: Remove now-defunct Go Report Card from the README
The Go Report Card website has been closed down, remove references to it
from the README file.
commit c7ffeee93a59b68a6f1d280e860b076cbb4ca93e
Author: Alberto Bertogli <albertito@blitiri.com.ar>
Date: Sun Aug 16 14:32:51 2026 +0100
ptr: Fix DNS count check on repeated terms
Each "ptr" term counts against the lookup limit, even if we already have
the names from a previous one and don't need to query DNS again: the RFC
limits the number of terms that cause DNS lookups, not the number of
queries we end up making:
> The following terms cause DNS queries: the "include", "a", "mx",
> "ptr", and "exists" mechanisms, and the "redirect" modifier. SPF
> implementations MUST limit the total number of those terms to 10
> during SPF evaluation, to avoid unreasonable load on the DNS. If this
> limit is exceeded, the implementation MUST return "permerror".
https://tools.ietf.org/html/rfc7208#section-4.6.4
Today, we resolve each address only once per appeareance (so `ptr:a.com
ptr:a.com` does only one actual DNS lookup), but we only count it once
for the purpose of DNS counting limits, which is technically incorrect.
This patch fixes the problem by counting each `ptr` term, regardless of
whether a DNS lookup was actually needed.
This is similar to what was done in commit
5a188ab835d1e8da402a8c6966a57dcd9dd81354 for the `mx` term.
commit 42e35196b3997a40337fed3c1fe37b8cd8e43c21
Author: Alberto Bertogli <albertito@blitiri.com.ar>
Date: Sun Aug 16 14:16:50 2026 +0100
Fix DNS void lookup limit checks
The RFC text for "void lookups" is:
> As described at the end of Section 11.1, there may be cases where it
> is useful to limit the number of "terms" for which DNS queries return
> either a positive answer (RCODE 0) with an answer count of 0, or a
> "Name Error" (RCODE 3) answer. These are sometimes collectively
> referred to as "void lookups". SPF implementations SHOULD limit
> "void lookups" to two. An implementation MAY choose to make such a
> limit configurable. In this case, a default of two is RECOMMENDED.
> Exceeding the limit produces a "permerror" result.
https://datatracker.ietf.org/doc/html/rfc7208#section-4.6.4
Today, we count void lookups as they happen, but only check the limit
when moving on to the next term. If there is no next term, the excess
goes unnoticed: a record ending in a void lookup that goes over the
limit is evaluated to the end, and returns neutral instead of permerror.
The same happens across an "include": the recursive check returns
neutral, so the include is treated as not matching, instead of making
the evaluation return permerror.
The DNS lookup limit had the same problem, and was fixed in commit
8f601a66eb0d7ddb3b976950a42c3c92047891d8. This patch does the equivalent
for the void lookup counter: check the limit in countVoidLookup, right
after incrementing it, and stop the evaluation there.
Note that unlike the lookup limit, we can only tell a lookup was void
after doing it, so the check has to happen after the lookup and not
before it.
commit e1c8fc685fa67b85bde8577b92e36db2c16b2834
Author: Alberto Bertogli <albertito@blitiri.com.ar>
Date: Sun Aug 16 13:26:10 2026 +0100
test: Add YAML test for DNS lookup limits
This patch adds a YAML test for the behaviour around DNS lookup limits,
which were fixed in commit 8f601a66eb0d7ddb3b976950a42c3c92047891d8.
commit 8f601a66eb0d7ddb3b976950a42c3c92047891d8
Author: Christian Joergensen <christian@technobabble.dk>
Date: Sat Aug 8 22:23:27 2026 -0400
Fix off-by-one counting for DNS record lookups
The DNS record lookup limiting has an off-by-one error, and also has some
incorrect logic because of doing the check centrally (instead of before a lookup).
This patch fixes those problems by doing the check in a helper function, and
using it before a DNS lookup on the appropriate locations.
Amended-by: Alberto Bertogli <albertito@blitiri.com.ar>
Adjusted commit message.
commit 3c0f83d66579c39a38dd3adcabc0007a883997a0
Author: tobiloba ogundiyan <apprentice_py@icloud.com>
Date: Thu Mar 27 08:26:07 2025 +0000
test: Group IP address vars into a single block
This commit groups related IP test address variables into a single block
for improved readability and consistency, and to match the coding style
from the rest of the codebase. No functional changes.
From https://github.com/albertito/spf/pull/10.
Amended-by: Alberto Bertogli <albertito@blitiri.com.ar>
Adjusted commit message.
commit 3731c77a3e96a57212e32af95c22e37368df0807
Author: Alberto Bertogli <albertito@blitiri.com.ar>
Date: Wed Jul 5 17:35:06 2023 +0100
doc: Minor wording and formatting updates
This patch removes the list of supported mechanisms and modifiers, which
is unnecessary since we accept all of them, and does a gofmt -s pass to
update some of the other comments to the current standard style.
commit 6140b4090e9e7150741ff4c254866f154af0bb57
Author: Alberto Bertogli <albertito@blitiri.com.ar>
Date: Sun Nov 20 11:30:51 2022 +0000
ci: Use GitHub actions instead of GitLab CI
I'm running against the GitLab CI usage limits, and unfortunately that
causes the pipelines to error out, instead of pausing/not running them.
Those false negatives are confusing and misleading.
Move the CI to GitHub actions for now, which has much higher usage
limits.
commit 3140e26091f8630a1052df5a0b759193d056cf92
Author: Alberto Bertogli <albertito@blitiri.com.ar>
Date: Sat Sep 3 12:10:13 2022 +0100
debian/watch: Update to use upstream's git
commit 231cd74e89f2e06e5723a2902cd8b2212500a83a
Author: Alberto Bertogli <albertito@blitiri.com.ar>
Date: Mon Aug 8 17:09:38 2022 +0100
test: Update fuzz tests to Go's standard toolchain
The fuzz tests were written before Go added fuzzing support to its
standard toolchain, in Go 1.18.
This patch updates them to the standard toolchain.
Note that a tag must still be specified manually in order to run them,
because the minimum supported Go version (1.15) does not have fuzzing
support, and we don't want tests to fail because of it.
Once our minimum supported version is >= 1.18, we will enable them by
default.
https://salsa.debian.org/api/v4/projects/go-team%2Fpackages%2Fgolang-blitiri-go-spf API request failed: 401 Unauthorized at /srv/qa.debian.org/data/vcswatch/vcswatch line 410.
![[bug history graph]](https://qa.debian.org/data/bts/graphs/g/golang-blitiri-go-spf.png){kind=link}