panel-dkim-signing stage 1: the panel's DKIM signer, beside OpenDKIM

internal/milter/sign.go: a milter on two sockets (cmd/panel/signer.go):
sign.sock for 465/587, the key of the domain the SASL login belongs to
(Bindings.DomainOf, the sender_login_maps Postfix reads), and
sign-local.sock for the panel's own sendmail(1) mail, the server's name.
go-msgauth/dkim v0.7.0, relaxed/simple, OpenDKIM's dkim_should_signhdrs[]
(libopendkim/dkim.c:223-246) in message order plus From once more; keys
and selectors from the KeyTable the panel writes, a key path outside the
key directory refused; strict - whatever cannot be signed is deferred.

From the sources: Postfix 3.10.13 milter8.c:2329-2400 hands a folded
header \n-separated, so the signer joins its lines with CRLF; inserts are
1-based in cleanup_ins_header() (cleanup_milter.c:1193), so index 0 is the
top, where OpenDKIM puts its own (opendkim.c:3673). go-milter v0.4.1 calls
no Abort when a connection ends, so a watchdog closes go-msgauth's
streaming signer after an hour and a late end of message is deferred.

Postfix: smtpd_milters = sender check, signer, OpenDKIM, journal;
non_smtpd_milters = the signer's local socket, OpenDKIM - both sign every
message until stage 2. disable_mime_output_conversion=yes (default off,
mail_params.h:3088): an 8-bit message is no longer re-encoded after it is
signed.

Tests: unit tests sign and verify folded, tab-led and space-free headers,
an added From:, a changed body, two messages on a connection, odd bodies,
and five cases deferred. e2e: the sink image has python3-dkim (dkimpy
1.1.8-2) and the stand's DNS; on an application's message and on a
notification the two signatures must agree on h=, bh=, c=, s=, a= and each
must pass dkimverify. On the server: make e2e exit 0 (714 s), go vet + go
test 27 packages ok.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

test/e2e/notifications_test.go

@@ -93,7 +93,7 @@ func testNotificationsSetUp(t *testing.T, sc *scenario) {
 // (internal/notify): here it would be a minute of waiting for nothing to happen.
 func testRateLimitRefusalIsNotified(t *testing.T, sc *scenario) {
 	subject := "[SelfPost] " + senderDomain + ": a rate limit is refusing mail"
-	raw, err := findSinkMessage(h.stageDir, subject, 100*time.Second)
+	file, raw, err := findSinkFile(h.stageDir, subject, 100*time.Second)
 	if err != nil {
 		t.Fatalf("no notification reached %s: %v\npanel log:\n%s", adminEmail, err, tailLines(h.logs("selfpost"), "notify", 20))
 	}
@@ -108,6 +108,9 @@ func testRateLimitRefusalIsNotified(t *testing.T, sc *scenario) {
 			t.Errorf("the notification lacks %q:\n%s", want, msg)
 		}
 	}
+	if err := checkBothSigners(h, file, raw, serverName); err != nil {
+		t.Errorf("the panel's signer on its own mail: %v", err)
+	}
 	if err := verifyDKIM(raw, serverName); err != nil {
 		t.Errorf("the notification is not signed as %s with the key Settings shows: %v", serverName, err)
 	}