base-trixie: the image on Debian trixie, Postfix 3.10.13; Received: hidden on 465/587

The runtime base is debian:trixie-slim, the build stage golang:1.26-trixie:
Postfix 3.10.13 with upstream's 2026 security fixes up to the August
batch, libmilter 8.18.1, OpenSSL 3.5. Every citation of another program in
code, scripts and documents was re-read against the trixie sources
(dev/upstream; bookworm's kept in dev/upstream-bookworm) and updated;
development.md's cited-package table holds the trixie versions.

What the re-reading changed in behaviour:
- logtail: reject lines with sasl_method/sasl_username/sasl_sender
  (smtpd_check.c:1019-1026); cleanup's "removed (canceled)" forgets a
  port-25 id (cleanup_api.c:363-364).
- internal/postfix/retry.go reads postconf's stdout only: since 3.9 a
  deprecated-parameter warning on stderr made one value too many and the
  panel fell back to the compiled-in retry policy.
- logrotate-loop.sh: logrotate 3.22 exits 1 when it ignores a config;
  the loop refuses on that output whatever the status.
- postfix-config.sh: cyrus_sasl_config_path set explicitly (bookworm's
  07_sasl_config.diff is gone); maillog_file_permissions=0640; mynetworks
  explicit; Dockerfile: SYNC_CHROOT= in /etc/default/postfix,
  opendkim-tools dropped, openssl named, systemd-standalone-sysusers so
  cron does not bring the whole of systemd.
- The selfpost group is 10998, outside the system range 100-999: in
  trixie a package took 998 and the build failed (owner's decision:
  a conflict-free id, the distribution's own ids untouched). The
  entrypoint hands /data back by name when the user or the group differs.
  Guide, backup refusal text, help (design commit 68ec8b2), e2e.
- smtpd_hide_client_session=yes on smtps and submission (owner's
  decision): Received: names no client, TLS, login or protocol; port 25
  keeps the full header. e2e checks both.
- test/upstream/opendkim-probe.sh makes keys with openssl genrsa.

Tests: on the server, make e2e exit 0 (674 s, the image built on trixie),
go vet + go test 27 packages ok. CHANGELOG [Unreleased], guide,
architecture.md, security.md, roadmap.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/health/cert.go

@@ -26,7 +26,7 @@ const certWarnDays = 14
 // Postfix itself serves the copy build/postfix-config.sh makes in
 // /etc/postfix/tls-internal, refreshed by build/postfix-cert-reload.sh up to
 // TLS_RELOAD_INTERVAL_SECONDS later, and each smtpd loads it when it starts
-// (Postfix 3.7.11, src/smtpd/smtpd.c, pre_jail_init(), TLS_SERVER_INIT) - so
+// (Postfix 3.10.13, src/smtpd/smtpd.c, pre_jail_init(), TLS_SERVER_INIT) - so
 // the mounted file can be newer than what is served (assumptions A-65).
 // CheckServedCertificate reads the copy, and names the mounted file as a
 // renewal waiting while the two differ.
@@ -52,7 +52,7 @@ type Renewal struct {
 }
 
 // ServedCertPath is the certificate file Postfix serves, smtpd_tls_cert_file
-// as postconf prints it (Postfix 3.7.11, postconf(1): -h, the value without
+// as postconf prints it (Postfix 3.10.13, postconf(1): -h, the value without
 // its name): build/postfix-config.sh's copy when the mounted files were there
 // at the start, the mounted file itself otherwise. "" when postconf fails.
 // It is read once, at the panel's start, as the retry policy is: main.cf is

internal/health/milter.go

@@ -17,7 +17,7 @@ import (
 const milterDialTimeout = time.Second
 
 // CheckMilter probes a milter address in the two forms build/postfix-config.sh
-// lets INBOUND_ANTISPAM_MILTER take (Postfix 3.7.11, src/milter/milter8.c,
+// lets INBOUND_ANTISPAM_MILTER take (Postfix 3.10.13, src/milter/milter8.c,
 // milter8_connect(), also accepts "local:", which that script refuses):
 // unix:/path is stat-ed like any milter socket, and inet:host:port is dialled
 // and the connection closed at once, with nothing written. required says what

internal/health/socket.go

@@ -26,7 +26,7 @@ type Socket struct {
 // stops mail leaving the server, while the journal-milter is attached with
 // default_action=accept and fails open — mail still goes out, only the send
 // log stops being written (build/postfix-config.sh smtpd_milters; Postfix
-// 3.7.11, src/milter/milter8.c, milter8_comm_error(): tempfail answers "451
+// 3.10.13, src/milter/milter8.c, milter8_comm_error(): tempfail answers "451
 // 4.7.1 Service unavailable - try again later", accept answers nothing).
 //
 // The socket is dialled, as Postfix will dial it; a file is not a listener.
@@ -35,7 +35,7 @@ type Socket struct {
 // a killed OpenDKIM or panel leaves a file that refuses every connection -
 // assumptions A-38. The connection is closed before a byte is sent, which
 // none of the three milters logs: OpenDKIM's libmilter reads the EOF as
-// SMFIC_EOF and ends the session without a line (sendmail 8.17.1.9,
+// SMFIC_EOF and ends the session without a line (libmilter 8.18.1,
 // libmilter/comm.c, mi_rd_cmd(); engine.c, mi_engine()), and OpenDKIM's
 // mlfi_close() has no connection to clean up (opendkim 2.11.0~beta2,
 // opendkim/opendkim.c); go-milter v0.4.1 returns quietly on io.EOF