base-trixie: the image on Debian trixie, Postfix 3.10.13; Received: hidden on 465/587

The runtime base is debian:trixie-slim, the build stage golang:1.26-trixie:
Postfix 3.10.13 with upstream's 2026 security fixes up to the August
batch, libmilter 8.18.1, OpenSSL 3.5. Every citation of another program in
code, scripts and documents was re-read against the trixie sources
(dev/upstream; bookworm's kept in dev/upstream-bookworm) and updated;
development.md's cited-package table holds the trixie versions.

What the re-reading changed in behaviour:
- logtail: reject lines with sasl_method/sasl_username/sasl_sender
  (smtpd_check.c:1019-1026); cleanup's "removed (canceled)" forgets a
  port-25 id (cleanup_api.c:363-364).
- internal/postfix/retry.go reads postconf's stdout only: since 3.9 a
  deprecated-parameter warning on stderr made one value too many and the
  panel fell back to the compiled-in retry policy.
- logrotate-loop.sh: logrotate 3.22 exits 1 when it ignores a config;
  the loop refuses on that output whatever the status.
- postfix-config.sh: cyrus_sasl_config_path set explicitly (bookworm's
  07_sasl_config.diff is gone); maillog_file_permissions=0640; mynetworks
  explicit; Dockerfile: SYNC_CHROOT= in /etc/default/postfix,
  opendkim-tools dropped, openssl named, systemd-standalone-sysusers so
  cron does not bring the whole of systemd.
- The selfpost group is 10998, outside the system range 100-999: in
  trixie a package took 998 and the build failed (owner's decision:
  a conflict-free id, the distribution's own ids untouched). The
  entrypoint hands /data back by name when the user or the group differs.
  Guide, backup refusal text, help (design commit 68ec8b2), e2e.
- smtpd_hide_client_session=yes on smtps and submission (owner's
  decision): Received: names no client, TLS, login or protocol; port 25
  keeps the full header. e2e checks both.
- test/upstream/opendkim-probe.sh makes keys with openssl genrsa.

Tests: on the server, make e2e exit 0 (674 s, the image built on trixie),
go vet + go test 27 packages ok. CHANGELOG [Unreleased], guide,
architecture.md, security.md, roadmap.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

cmd/panel/dmarc_ingest.go

@@ -32,7 +32,7 @@ func runDMARCIngestMode() error {
 		// Not a report this relay keeps. It is dropped: deferring would have
 		// Postfix try it again for days, and a bounce would go to an envelope
 		// sender anyone can write - the report addresses are public. Postfix
-		// 3.7.11: exit 0 is PIPE_STAT_OK, logged "status=sent (delivered via
+		// 3.10.13: exit 0 is PIPE_STAT_OK, logged "status=sent (delivered via
 		// ... service ...)" (src/global/pipe_command.c, pipe_command();
 		// src/pipe/pipe.c, eval_command_status()); a 4.x.x status defers until
 		// maximal_queue_lifetime and a 5.x.x one bounces, either way a notice
@@ -49,7 +49,7 @@ func runDMARCIngestMode() error {
 // what a delivery command wrote - about a hundred bytes - into its own line
 // for the message ("status=sent (delivered via dmarc-ingest service (...))"),
 // so the reason goes out first and bare: no prefix, no date, no recipient,
-// all of which that line already has. Postfix 3.7.11, src/pipe/pipe.c,
+// all of which that line already has. Postfix 3.10.13, src/pipe/pipe.c,
 // eval_command_status(): " (%.100s)" of the output, which
 // src/global/pipe_command.c takes from stdout and stderr together. postlog is
 // no use here: pipe(8) starts the command without the group that may write to
@@ -58,7 +58,9 @@ func runDMARCIngestMode() error {
 // installs it set-gid, Debian's package does not - measured in the image,
 // 2026-10-15: /usr/sbin/postlog is -rwxr-xr-x root:root (postfix
 // 3.7.11-0+deb12u1), and dpkg-statoverride lists only postdrop and
-// postqueue (assumptions A-43).
+// postqueue (assumptions A-43). postfix 3.10.13-0+deb13u1 is the same by its
+// source: debian/postfix.postinst adds statoverrides for /usr/sbin/postdrop
+// and /usr/sbin/postqueue alone, and nothing in debian/ makes postlog set-gid.
 func logRejected(reason error) {
 	fmt.Fprintln(os.Stderr, "dropped: "+logSafe(strings.TrimPrefix(reason.Error(), dmarc.ErrRejected.Error()+": ")))
 }
@@ -83,7 +85,7 @@ func logSafe(s string) string {
 // ingestRecipient is the report address the message was delivered to. Postfix's
 // pipe(8) hands it over as an argument (${recipient} in the service's argv,
 // build/postfix-config.sh) - it sets no RECIPIENT variable, that is local(8).
-// Postfix 3.7.11, src/pipe/pipe.c, deliver_message(): pipe_command() gets only
+// Postfix 3.10.13, src/pipe/pipe.c, deliver_message(): pipe_command() gets only
 // CA_PIPE_CMD_EXPORT(export_environment), no extra environment;
 // src/local/command.c sets "RECIPIENT".
 // Without it the check that a report came to its own domain's address is

cmd/panel/httpserver.go

@@ -99,7 +99,7 @@ func newPanel(cfg config, st *store.Store) (*web.Server, error) {
 	ms := newMailStack(cfg, st)
 	// postfix-config.sh has already run (entrypoint). postconf -h is the
 	// effective config, including a manual override; the panel keeps this
-	// snapshot for the process lifetime (architecture.md). Postfix 3.7.11,
+	// snapshot for the process lifetime (architecture.md). Postfix 3.10.13,
 	// postconf(1): without -d or -n it shows main.cf's value or the default,
 	// and -h drops the "name = " label; values are not $-expanded without -x.
 	retryPolicy := postfix.LoadRetryPolicy()

cmd/panel/main.go

@@ -37,7 +37,7 @@ func main() {
 		log.SetPrefix("dmarc-ingest: ")
 		if err := runDMARCIngestMode(); err != nil {
 			log.Printf("ingest failed: %v", err)
-			// EX_TEMPFAIL — ask Postfix to defer. Postfix 3.7.11,
+			// EX_TEMPFAIL — ask Postfix to defer. Postfix 3.10.13,
 			// src/global/pipe_command.c, pipe_command(): a sysexits code maps
 			// to its DSN (src/global/sys_exits.c: 75 is "4.3.0") and a 4 defers,
 			// unless the output starts with a "D.S.N text" of its own - the
@@ -223,7 +223,7 @@ func antispamAction(raw string) string {
 
 // saslRealm chooses the realm new SASL accounts live under. It mirrors the
 // hostname Postfix's SASL layer uses so a client authenticating with a bare
-// login resolves to the right account. Postfix 3.7.11,
+// login resolves to the right account. Postfix 3.10.13,
 // src/xsasl/xsasl_cyrus_server.c, xsasl_cyrus_server_create(): serverFQDN is
 // $myhostname (= SELFPOST_HOSTNAME, build/postfix-config.sh) and user_realm
 // NULL while smtpd_sasl_local_domain is empty; Cyrus SASL 2.1.28,

cmd/panel/sendercheck.go

@@ -19,7 +19,7 @@ const aliveEvery = 2 * time.Second
 
 // serveSenderCheck runs the sender check (internal/milter/sender.go) on a
 // socket of its own. Postfix attaches that socket strictly
-// (default_action=tempfail in build/postfix-config.sh; Postfix 3.7.11,
+// (default_action=tempfail in build/postfix-config.sh; Postfix 3.10.13,
 // src/milter/milter8.c, milter8_comm_error(): "451 4.7.1 Service unavailable -
 // try again later"), so while this role is not serving, mail is deferred:
 // what that costs is counted here and