base-trixie: the image on Debian trixie, Postfix 3.10.13; Received: hidden on 465/587

The runtime base is debian:trixie-slim, the build stage golang:1.26-trixie:
Postfix 3.10.13 with upstream's 2026 security fixes up to the August
batch, libmilter 8.18.1, OpenSSL 3.5. Every citation of another program in
code, scripts and documents was re-read against the trixie sources
(dev/upstream; bookworm's kept in dev/upstream-bookworm) and updated;
development.md's cited-package table holds the trixie versions.

What the re-reading changed in behaviour:
- logtail: reject lines with sasl_method/sasl_username/sasl_sender
  (smtpd_check.c:1019-1026); cleanup's "removed (canceled)" forgets a
  port-25 id (cleanup_api.c:363-364).
- internal/postfix/retry.go reads postconf's stdout only: since 3.9 a
  deprecated-parameter warning on stderr made one value too many and the
  panel fell back to the compiled-in retry policy.
- logrotate-loop.sh: logrotate 3.22 exits 1 when it ignores a config;
  the loop refuses on that output whatever the status.
- postfix-config.sh: cyrus_sasl_config_path set explicitly (bookworm's
  07_sasl_config.diff is gone); maillog_file_permissions=0640; mynetworks
  explicit; Dockerfile: SYNC_CHROOT= in /etc/default/postfix,
  opendkim-tools dropped, openssl named, systemd-standalone-sysusers so
  cron does not bring the whole of systemd.
- The selfpost group is 10998, outside the system range 100-999: in
  trixie a package took 998 and the build failed (owner's decision:
  a conflict-free id, the distribution's own ids untouched). The
  entrypoint hands /data back by name when the user or the group differs.
  Guide, backup refusal text, help (design commit 68ec8b2), e2e.
- smtpd_hide_client_session=yes on smtps and submission (owner's
  decision): Received: names no client, TLS, login or protocol; port 25
  keeps the full header. e2e checks both.
- test/upstream/opendkim-probe.sh makes keys with openssl genrsa.

Tests: on the server, make e2e exit 0 (674 s, the image built on trixie),
go vet + go test 27 packages ok. CHANGELOG [Unreleased], guide,
architecture.md, security.md, roadmap.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/postfix/dmarc.go

@@ -41,7 +41,7 @@ func (p *Postfix) RebuildDMARCMaps(cfg DMARCMapsConfig) error {
 	return p.reload()
 }
 
-// Postfix 3.7.11, man/man5/access.5: "OK" accepts the address the key
+// Postfix 3.10.13, man/man5/access.5: "OK" accepts the address the key
 // matches; man/man5/transport.5: "user@domain transport:nexthop", and "a
 // non-null transport field with a null nexthop field resets the nexthop
 // information to the recipient domain"; relay_domains as in renderInboundMaps.

internal/postfix/duration.go

@@ -8,7 +8,7 @@ import (
 	"time"
 )
 
-// ParseTime reads a Postfix time value as Postfix 3.7.11 reads it:
+// ParseTime reads a Postfix time value as Postfix 3.10.13 reads it:
 // src/global/conv_time.c, conv_time(), called by get_mail_conf_time() in
 // src/global/mail_conf_time.c. One number - strtol(), so leading blanks and a
 // "+" are taken, a negative number or one past an int is invalid - followed

internal/postfix/duration_test.go

@@ -5,7 +5,7 @@ import (
 	"time"
 )
 
-// Postfix 3.7.11, src/global/conv_time.c, conv_time(): one number, one
+// Postfix 3.10.13, src/global/conv_time.c, conv_time(): one number, one
 // lower-case unit, the default unit when there is none, the rest ignored.
 func TestParseTime(t *testing.T) {
 	cases := []struct {

internal/postfix/inbound.go

@@ -55,7 +55,7 @@ func (p *Postfix) RebuildInboundMaps(routes []InboundRoute) error {
 	return p.reload()
 }
 
-// Postfix 3.7.11, man/man5/postconf.5: a relay_domains table "is matched when
+// Postfix 3.10.13, man/man5/postconf.5: a relay_domains table "is matched when
 // a (parent) domain appears as lookup key", the value unused; relay_recipient_maps
 // is used as a list, "@domain" its wild-card (src/global/mail_addr_find.c,
 // MA_FIND_AT_DOMAIN, the exact domain only). man/man5/transport.5: "domain
@@ -104,7 +104,7 @@ func renderInboundMaps(routes []InboundRoute) (relay, transport, recipients, tls
 // what disable the MX lookup, so the operator's explicit upstream is used as
 // given; they also delimit a bare IPv6 address.
 //
-// Postfix 3.7.11, src/smtp/smtp_connect.c: no MX lookup for a destination that
+// Postfix 3.10.13, src/smtp/smtp_connect.c: no MX lookup for a destination that
 // starts with "["; src/util/host_port.c, host_port(): "[host]:port", the host
 // a name or an address ("ipv6:" in front is optional), checked by
 // valid_hostaddr().

internal/postfix/postfix.go

@@ -62,7 +62,7 @@ type Binding struct {
 // a comma-separated list, which is how Postfix expects multiple owners of one
 // sender.
 //
-// Postfix 3.7.11, src/smtpd/smtpd_check.c, reject_auth_sender_login_mismatch():
+// Postfix 3.10.13, src/smtpd/smtpd_check.c, reject_auth_sender_login_mismatch():
 // the value is split into owners with mystrtok(&cp, CHARS_COMMA_SP).
 func (p *Postfix) RebuildSenderLoginMaps(bindings []Binding) error {
 	content, err := renderSenderLoginMaps(bindings)
@@ -105,7 +105,7 @@ func renderSenderLoginMaps(bindings []Binding) ([]byte, error) {
 		// One line per key as Postfix folds it: smtpd opens the map with
 		// DICT_FLAG_FOLD_FIX and no DICT_FLAG_DUP_* flag, so two keys that
 		// differ only in case would make the whole table unusable (Postfix
-		// 3.7.11, src/util/dict_thash.c, dict_thash_open()). The panel stores
+		// 3.10.13, src/util/dict_thash.c, dict_thash_open()). The panel stores
 		// addresses in lower case already; this keeps the file safe if a row
 		// ever is not.
 		addr := strings.ToLower(b.Address)
@@ -141,7 +141,7 @@ func appendUnique(list []string, v string) []string {
 // and the backslash. A login additionally may not carry "@" — that would make it
 // look like an address.
 //
-// Postfix 3.7.11, src/util/dict_thash.c, dict_thash_open(): the key ends at
+// Postfix 3.10.13, src/util/dict_thash.c, dict_thash_open(): the key ends at
 // the first blank outside quotes, a backslash escapes the next character;
 // src/util/readlline.c: a newline ends the line (one that starts with a blank
 // continues the one before); the owners split on comma and blank (see
@@ -180,7 +180,7 @@ func assertMapSafe(address, login string) error {
 // Arguments are fixed literals — no user input is interpolated into the command,
 // and it never goes through a shell (security.md).
 //
-// Postfix 3.7.11, conf/postfix-script, start-fg: a process that is not PID 1
+// Postfix 3.10.13, conf/postfix-script, start-fg: a process that is not PID 1
 // runs "$daemon_directory/master -s" as its child, and src/master/master.c
 // puts that master in a session of its own (setsid()). "reload" sends the
 // master SIGHUP; src/master/master.c calls master_refresh(), and

internal/postfix/queue.go

@@ -51,7 +51,7 @@ var postqueueP = func(ctx context.Context) *exec.Cmd {
 // listQueue runs `postqueue -p` and keeps at most maxQueueOutput bytes of it;
 // truncated says whether there was more.
 //
-// Postfix 3.7.11, src/postqueue/postqueue.c, show_queue(): any user passes
+// Postfix 3.10.13, src/postqueue/postqueue.c, show_queue(): any user passes
 // authorized_mailq_users (DEF_SHOWQ_ACL static:anyone), and a failure is
 // msg_fatal_status() - a non-zero exit with the reason on stderr;
 // src/postqueue/showq_compat.c, showq_compat(): "Mail queue is empty".
@@ -107,7 +107,7 @@ func Queue() (string, error) {
 // cut are still in the queue, and a backlog that large is the outage the sweep
 // exists for (audit 2026-10-12, H3). QueueMessages treats its cap the same way.
 //
-// Postfix 3.7.11, src/showq/showq.c, showq_service(): maildrop, active,
+// Postfix 3.10.13, src/showq/showq.c, showq_service(): maildrop, active,
 // incoming, deferred and hold are the queues it lists.
 func QueueIDs() (map[string]struct{}, error) {
 	out, truncated, err := listQueue()
@@ -126,7 +126,7 @@ func QueueIDs() (map[string]struct{}, error) {
 //
 // The id is at the start of the line, optionally flagged '*' (in the active
 // queue) or '!' (on hold), then '#' when the message was forced to expire
-// (Postfix 3.7.11, src/postqueue/showq_compat.c, showq_message(): the flags
+// (Postfix 3.10.13, src/postqueue/showq_compat.c, showq_message(): the flags
 // are appended to the id in that order; assumptions B-PQ1), and is followed
 // by the message size. Requiring the
 // size is what separates an entry from the listing's other left-margin lines:

internal/postfix/queue_test.go

@@ -12,7 +12,7 @@ import (
 
 // TestFakePostqueue is not a test: it is the fake `postqueue -p` the tests
 // below run in place of the real one, writing SP_FAKE_POSTQUEUE_BYTES bytes of
-// queue entries composed by hand after the layout of Postfix 3.7.11's
+// queue entries composed by hand after the layout of Postfix 3.10.13's
 // src/postqueue/showq_compat.c.
 func TestFakePostqueue(t *testing.T) {
 	if os.Getenv("SP_FAKE_POSTQUEUE") != "1" {
@@ -76,7 +76,7 @@ func TestQueueIDsReadsAListingUnderTheCap(t *testing.T) {
 // The reconcile sweep decides whether a message is still Postfix's problem, so
 // the parser must pick queue ids out of a listing and nothing else out of it:
 // not the header, not the byte-count trailer, and above all not a deferred
-// entry's reason line. The listing is composed by hand. Postfix 3.7.11
+// entry's reason line. The listing is composed by hand. Postfix 3.10.13
 // (src/postqueue/showq_compat.c, showq_message()) right-aligns a reason to
 // column 76, so it reaches the left margin only when it is 76 characters or
 // longer; the one here is put at the margin as the hard case.

internal/postfix/queuejson.go

@@ -13,7 +13,7 @@ import (
 // QueuedMessage is one message Postfix is holding, as `postqueue -j` reports
 // it: where it is, and since when.
 //
-// Postfix 3.7.11, src/postqueue/showq_json.c, format_json(): one object and a
+// Postfix 3.10.13, src/postqueue/showq_json.c, format_json(): one object and a
 // newline per message - "queue_name", "queue_id", "arrival_time" (seconds,
 // %ld), "message_size", "forced_expire", "sender", "recipients" [{"address",
 // "delay_reason"}]; the queue names are those of src/global/mail_queue.h that

internal/postfix/queuejson_test.go

@@ -7,7 +7,7 @@ import (
 )
 
 // The listing is composed by hand: its first line in the field order of
-// Postfix 3.7.11's src/postqueue/showq_json.c, format_json(); the others
+// Postfix 3.10.13's src/postqueue/showq_json.c, format_json(); the others
 // short of fields or broken on purpose.
 func TestParseQueueJSON(t *testing.T) {
 	out := []byte(`{"queue_name": "deferred", "queue_id": "41E862C00D9E", "arrival_time": 1791000000, "message_size": 446, "forced_expire": false, "sender": "app@example.com", "recipients": [{"address": "a@example.net", "delay_reason": "connect to mx.example.net[203.0.113.9]:25: Connection timed out"}]}

internal/postfix/retry.go

@@ -29,7 +29,7 @@ type RetryPolicy struct {
 // build/postfix-config.sh does not set. Used when postconf is missing (unit
 // tests, a binary outside the container) so the panel still starts.
 //
-// Postfix 3.7.11, src/global/mail_params.h: DEF_QUEUE_RUN_DELAY "300s",
+// Postfix 3.10.13, src/global/mail_params.h: DEF_QUEUE_RUN_DELAY "300s",
 // DEF_MIN_BACKOFF_TIME DEF_QUEUE_RUN_DELAY, DEF_MAX_BACKOFF_TIME "4000s",
 // DEF_MAX_QUEUE_TIME "5d", DEF_DSN_QUEUE_TIME "5d", DEF_DELAY_WARN_TIME "0h".
 func DefaultRetryPolicy() RetryPolicy {
@@ -56,7 +56,7 @@ var retryConfKeys = []string{
 }
 
 // retryConfUnits is each key's default unit: the last letter of its default
-// value (Postfix 3.7.11, src/global/mail_params.h, DEF_QUEUE_RUN_DELAY
+// value (Postfix 3.10.13, src/global/mail_params.h, DEF_QUEUE_RUN_DELAY
 // "300s", DEF_MIN_BACKOFF_TIME, DEF_MAX_BACKOFF_TIME "4000s",
 // DEF_MAX_QUEUE_TIME "5d", DEF_DSN_QUEUE_TIME "5d", DEF_DELAY_WARN_TIME
 // "0h"; src/global/mail_conf_time.c, get_def_time_unit()).
@@ -66,23 +66,37 @@ var retryConfUnits = []byte{'s', 's', 's', 'd', 'd', 'h'}
 // the same way logtail stubs queueIDs.
 var readRetryConf = postconfRetryValues
 
-func postconfRetryValues() ([]string, error) {
+// postconfRetryCmd builds the `postconf -h -x` command. It is a var so tests
+// can put a fake postconf in its place, the way postqueueP is.
+var postconfRetryCmd = func() *exec.Cmd {
 	// Fixed argv, no user input — same pattern as Queue (security.md).
-	// Postfix 3.7.11, src/postconf/postconf_main.c, pcf_show_parameters():
-	// named parameters are printed in argument order, with -h one "%s\n"
-	// value each; -x expands "$name" as Postfix itself does when it reads
-	// the value (mail_conf_eval()).
-	cmd := exec.Command("postconf", "-h", "-x",
-		"queue_run_delay",
-		"minimal_backoff_time",
-		"maximal_backoff_time",
-		"maximal_queue_lifetime",
-		"bounce_queue_lifetime",
-		"delay_warning_time",
-	)
-	out, err := cmd.CombinedOutput()
+	return exec.Command("postconf", append([]string{"-h", "-x"}, retryConfKeys...)...)
+}
+
+// postconfRetryValues reads the values from postconf's standard output only.
+// Postfix 3.10.13, src/postconf/postconf_main.c, pcf_show_parameters():
+// named parameters are printed to stdout in argument order, with -h one
+// "%s\n" value each, and an unknown one is a msg_warn() with no line;
+// -x expands "$name" (pcf_expand_parameter_value(),
+// src/postconf/postconf_lookup.c) as Postfix itself does when it reads the
+// value (mail_conf_eval()). Warnings go to stderr (src/postconf/postconf.c,
+// main(), msg_vstream_init(argv[0], VSTREAM_ERR)): an unknown name, and after
+// the values (src/postconf/postconf.c, main()) an unused
+// main.cf parameter, and since 3.9 a deprecated one, "support for parameter
+// \"%s\" will be removed; instead, %s" (src/postconf/postconf_unused.c,
+// pcf_flag_unused_parameters(); RELEASE_NOTES-3.9). Read together with stdout,
+// as CombinedOutput did until base-trixie, such a warning was one value too
+// many and the panel fell back to the compiled-in defaults.
+func postconfRetryValues() ([]string, error) {
+	cmd := postconfRetryCmd()
+	var errOut strings.Builder
+	cmd.Stderr = &errOut
+	out, err := cmd.Output()
 	if err != nil {
-		return nil, fmt.Errorf("postconf -h: %w: %s", err, strings.TrimSpace(string(out)))
+		return nil, fmt.Errorf("postconf -h: %w: %s", err, strings.TrimSpace(errOut.String()))
+	}
+	if why := strings.TrimSpace(errOut.String()); why != "" {
+		log.Printf("postfix: postconf -h: %s", why)
 	}
 	lines := strings.Split(strings.TrimSpace(string(out)), "\n")
 	if len(lines) != len(retryConfKeys) {
@@ -123,7 +137,7 @@ func parseRetryPolicy(lines []string) (RetryPolicy, error) {
 		}
 		durs[i] = d
 	}
-	// Postfix 3.7.11, src/qmgr/qmgr.c, qmgr_post_init(): "bounce_queue_lifetime
+	// Postfix 3.10.13, src/qmgr/qmgr.c, qmgr_post_init(): "bounce_queue_lifetime
 	// is larger than maximal_queue_lifetime - adjusting" - qmgr uses the
 	// smaller.
 	if durs[4] > durs[3] {
@@ -155,7 +169,7 @@ func (p RetryPolicy) BackoffCap() string {
 // sender, which an application may submit too. It bounds which stored log
 // lines can be about a send-log row (store.SendLogLines).
 //
-// Postfix 3.7.11, src/qmgr/qmgr_active.c, qmgr_active_done_25_generic(): a
+// Postfix 3.10.13, src/qmgr/qmgr_active.c, qmgr_active_done_25_generic(): a
 // message expires after var_max_queue_time, or var_dsn_queue_time when its
 // sender is null - whoever submitted it; qmgr.c caps the second at the
 // first, and so does parseRetryPolicy, which leaves the first the longer.

internal/postfix/retry_test.go

@@ -2,12 +2,15 @@ package postfix
 
 import (
 	"errors"
+	"fmt"
+	"os"
+	"os/exec"
 	"testing"
 	"time"
 )
 
 // The postconf values in these tests are composed by hand: values main.cf
-// could hold. Stock Postfix 3.7.11 prints "0h" for delay_warning_time
+// could hold. Stock Postfix 3.10.13 prints "0h" for delay_warning_time
 // (src/global/mail_params.h, DEF_DELAY_WARN_TIME), not "0".
 func TestLoadRetryPolicyUsesPostconfValues(t *testing.T) {
 	old := readRetryConf
@@ -29,7 +32,7 @@ func TestLoadRetryPolicyUsesPostconfValues(t *testing.T) {
 	if p.MaximalQueueLifetime != 2*24*time.Hour {
 		t.Errorf("MaximalQueueLifetime = %v, want 2d", p.MaximalQueueLifetime)
 	}
-	// 5d over a maximal 2d: qmgr uses 2d (Postfix 3.7.11, src/qmgr/qmgr.c,
+	// 5d over a maximal 2d: qmgr uses 2d (Postfix 3.10.13, src/qmgr/qmgr.c,
 	// qmgr_post_init(), "adjusting bounce_queue_lifetime").
 	if p.BounceQueueLifetime != 2*24*time.Hour {
 		t.Errorf("BounceQueueLifetime = %v, want 2d", p.BounceQueueLifetime)
@@ -40,7 +43,7 @@ func TestLoadRetryPolicyUsesPostconfValues(t *testing.T) {
 }
 
 // A message lives at most maximal_queue_lifetime: qmgr caps
-// bounce_queue_lifetime at it (Postfix 3.7.11, src/qmgr/qmgr.c,
+// bounce_queue_lifetime at it (Postfix 3.10.13, src/qmgr/qmgr.c,
 // qmgr_post_init()), so a larger bounce lifetime does not lengthen it.
 func TestLongestLifetimeIsTheQueueLifetime(t *testing.T) {
 	p, err := parseRetryPolicy([]string{"300s", "300s", "4000s", "1d", "5d", "0h"})
@@ -95,3 +98,41 @@ func TestParseRetryPolicyStock(t *testing.T) {
 		t.Errorf("parsed = %+v", p)
 	}
 }
+
+// TestFakePostconf is not a test: it is the fake `postconf -h -x` the test
+// below runs in place of the real one. Its warning is composed after Postfix
+// 3.10.13, src/postconf/postconf_unused.c, pcf_flag_unused_parameters(),
+// written to stderr after the values (src/postconf/postconf.c, main()).
+func TestFakePostconf(t *testing.T) {
+	if os.Getenv("SP_FAKE_POSTCONF") != "1" {
+		t.Skip("helper process")
+	}
+	fmt.Fprint(os.Stdout, "300s\n300s\n4000s\n2d\n5d\n0h\n")
+	fmt.Fprint(os.Stderr, "postconf: warning: /etc/postfix/main.cf: support for parameter \"smtpd_use_tls\" will be removed; instead, specify \"smtpd_tls_security_level\"\n")
+	os.Exit(0)
+}
+
+// postconf's warnings are not values: since Postfix 3.9 a deprecated
+// main.cf parameter draws one on every run, and read with the values it made
+// one line too many, so the panel showed the compiled-in defaults.
+func TestPostconfRetryValuesReadsStdoutOnly(t *testing.T) {
+	old := postconfRetryCmd
+	postconfRetryCmd = func() *exec.Cmd {
+		cmd := exec.Command(os.Args[0], "-test.run=^TestFakePostconf$")
+		cmd.Env = append(os.Environ(), "SP_FAKE_POSTCONF=1")
+		return cmd
+	}
+	t.Cleanup(func() { postconfRetryCmd = old })
+
+	lines, err := postconfRetryValues()
+	if err != nil {
+		t.Fatalf("postconfRetryValues: %v", err)
+	}
+	p, err := parseRetryPolicy(lines)
+	if err != nil {
+		t.Fatalf("parse %q: %v", lines, err)
+	}
+	if p.MaximalQueueLifetime != 2*24*time.Hour || p.FromDefaults {
+		t.Errorf("policy = %+v, want the postconf values", p)
+	}
+}