base-trixie: the image on Debian trixie, Postfix 3.10.13; Received: hidden on 465/587

The runtime base is debian:trixie-slim, the build stage golang:1.26-trixie:
Postfix 3.10.13 with upstream's 2026 security fixes up to the August
batch, libmilter 8.18.1, OpenSSL 3.5. Every citation of another program in
code, scripts and documents was re-read against the trixie sources
(dev/upstream; bookworm's kept in dev/upstream-bookworm) and updated;
development.md's cited-package table holds the trixie versions.

What the re-reading changed in behaviour:
- logtail: reject lines with sasl_method/sasl_username/sasl_sender
  (smtpd_check.c:1019-1026); cleanup's "removed (canceled)" forgets a
  port-25 id (cleanup_api.c:363-364).
- internal/postfix/retry.go reads postconf's stdout only: since 3.9 a
  deprecated-parameter warning on stderr made one value too many and the
  panel fell back to the compiled-in retry policy.
- logrotate-loop.sh: logrotate 3.22 exits 1 when it ignores a config;
  the loop refuses on that output whatever the status.
- postfix-config.sh: cyrus_sasl_config_path set explicitly (bookworm's
  07_sasl_config.diff is gone); maillog_file_permissions=0640; mynetworks
  explicit; Dockerfile: SYNC_CHROOT= in /etc/default/postfix,
  opendkim-tools dropped, openssl named, systemd-standalone-sysusers so
  cron does not bring the whole of systemd.
- The selfpost group is 10998, outside the system range 100-999: in
  trixie a package took 998 and the build failed (owner's decision:
  a conflict-free id, the distribution's own ids untouched). The
  entrypoint hands /data back by name when the user or the group differs.
  Guide, backup refusal text, help (design commit 68ec8b2), e2e.
- smtpd_hide_client_session=yes on smtps and submission (owner's
  decision): Received: names no client, TLS, login or protocol; port 25
  keeps the full header. e2e checks both.
- test/upstream/opendkim-probe.sh makes keys with openssl genrsa.

Tests: on the server, make e2e exit 0 (674 s, the image built on trixie),
go vet + go test 27 packages ok. CHANGELOG [Unreleased], guide,
architecture.md, security.md, roadmap.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

build/logrotate-loop.sh

@@ -7,25 +7,29 @@
 # before the reload is lost. `create` (rather than `nocreate`) matters here
 # beyond timing: a postlogd-triggered recreate lands the file at 0600 owned by
 # postfix, which the unprivileged panel process cannot read — confirmed on a
-# live container (date not recorded), and so in the source: Postfix 3.7.11,
-# src/util/logwriter.c, logwriter_open_or_die(), creates it 0644 under master's
-# umask(077), src/master/master.c — so logrotate must be the one to create it.
-# The reload: Postfix 3.7.11, conf/postfix-script, "logrotate" (mv, then kill
-# -HUP master); master_conf.c, master_config() -> master_restart_service() ->
-# master_status_cleanup(), on which postlogd exits (src/master/dgram_server.c,
-# dgram_server_abort() on MASTER_STATUS_FD), and the next postlogd opens the
-# path anew (src/postlogd/postlogd.c, logwriter_open_or_die()).
+# live container (date not recorded, Postfix 3.7.11), and so in the source:
+# Postfix 3.10.13, src/util/logwriter.c:99, logwriter_open_or_die(), creates it
+# with logwriter_perms, 0600 (:86) unless maillog_file_permissions says
+# otherwise (Postfix 3.9 and later). build/postfix-config.sh now sets that to
+# 0640, so a file postlogd makes is readable too; logrotate still creates it,
+# so that the new log is there, with its mode and owner, at once.
+# The reload: Postfix 3.10.13, conf/postfix-script:535-566, "logrotate" (mv,
+# then kill -HUP master); master_conf.c:92, master_config() -> :147,
+# master_restart_service() -> master_status_cleanup(), on which postlogd exits
+# (src/master/dgram_server.c:241, dgram_server_abort(), :640 on
+# MASTER_STATUS_FD), and the next postlogd opens the path anew
+# (src/postlogd/postlogd.c:236, logwriter_open_or_die()).
 #
 # logrotate itself only rotates once the configured "daily" period has elapsed
 # (tracked in its state file), so it is safe to invoke this more often than
 # daily — polling merely bounds how late a legitimate rotation runs. The state
 # file is beside the log, under /data, not at the default
-# /var/lib/logrotate/status (logrotate 3.21.0-1: debian/rules,
+# /var/lib/logrotate/status (logrotate 3.22.0-1: debian/rules:11,
 # --with-state-file-path) in the container's own filesystem: a recreated
-# container started without it, logrotate.c, newState(), records a log it has
-# no state for as rotated today, and so a host that recreates the container
+# container started without it, logrotate.c:456, newState(), records a log it
+# has no state for as rotated today, and so a host that recreates the container
 # daily - an .env change, an image bump - never rotated mail.log at all (audit
-# 2026-10-12, M19). (logrotate 3.21.0, logrotate.8.in: "-s, --state
+# 2026-10-12, M19). (logrotate 3.22.0, logrotate.8.in:74: "-s, --state
 # statefile".) The directory is postfix:selfpost 2750 and logrotate runs as
 # root.
 set -eu
@@ -34,13 +38,18 @@ CONFIG=/etc/logrotate.d/mail
 STATE=/data/log/.logrotate.status
 INTERVAL="${LOGROTATE_INTERVAL_SECONDS:-21600}"
 
-# logrotate refuses configs writable by group or others and exits 0 while
-# ignoring them — fail here so supervisord reports the fault. (logrotate
-# 3.21.0, config.c, readConfigFile(): as root, mode & 0022 gives "Ignoring ...
-# because it is writable by group or others." and returns 0, not an error; a
-# config not owned by root is ignored the same way. "Potentially dangerous
-# mode" is only a warning there, for any mode & 07533 other than 0400 - this
-# loop chooses to treat it as fatal too.)
+# logrotate refuses configs writable by group or others and goes on without
+# them — fail here so supervisord reports the fault. (logrotate 3.22.0,
+# config.c:1099, readConfigFile(): as root, mode & 0022 gives (:1160-1165)
+# "Ignoring ... because it is writable by group or others." and returns 1; a
+# config not owned by root is ignored the same way (:1168-1173). Since 3.22.0
+# that makes logrotate's exit status 1 (logrotate.c:3278-3279 and :3301;
+# ChangeLog.md, 3.22.0: "in case a configuration file was skipped due to
+# unsafe permissions the exit status after rotattion will be `1` (#508)");
+# 3.21.0 returned 0 there and exited 0. So the output is looked at whatever
+# the status. "Potentially dangerous mode" is only a warning there
+# (:1154-1157), for any mode & 07533 other than 0400 - this loop chooses to
+# treat it as fatal too.)
 logrotate_config_ok() {
 	mode=$(stat -c '%a' "$CONFIG")
 	mode=${mode#0}
@@ -61,16 +70,19 @@ if ! logrotate_config_ok; then
 fi
 
 run_logrotate() {
-	out=$(logrotate -s "$STATE" "$CONFIG" 2>&1) || {
-		echo "$out" >&2
-		return 1
-	}
+	status=0
+	out=$(logrotate -s "$STATE" "$CONFIG" 2>&1) || status=$?
 	case "$out" in
 		*Ignoring*|*Potentially\ dangerous\ mode*)
 			echo "$out" >&2
-			logrotate_config_fatal
+			echo "logrotate-loop: refusing to run: logrotate did not take $CONFIG as it is (above)" >&2
+			exit 1
 			;;
 	esac
+	if [ "$status" -ne 0 ]; then
+		echo "$out" >&2
+		return 1
+	fi
 	return 0
 }