base-trixie: the image on Debian trixie, Postfix 3.10.13; Received: hidden on 465/587

The runtime base is debian:trixie-slim, the build stage golang:1.26-trixie:
Postfix 3.10.13 with upstream's 2026 security fixes up to the August
batch, libmilter 8.18.1, OpenSSL 3.5. Every citation of another program in
code, scripts and documents was re-read against the trixie sources
(dev/upstream; bookworm's kept in dev/upstream-bookworm) and updated;
development.md's cited-package table holds the trixie versions.

What the re-reading changed in behaviour:
- logtail: reject lines with sasl_method/sasl_username/sasl_sender
  (smtpd_check.c:1019-1026); cleanup's "removed (canceled)" forgets a
  port-25 id (cleanup_api.c:363-364).
- internal/postfix/retry.go reads postconf's stdout only: since 3.9 a
  deprecated-parameter warning on stderr made one value too many and the
  panel fell back to the compiled-in retry policy.
- logrotate-loop.sh: logrotate 3.22 exits 1 when it ignores a config;
  the loop refuses on that output whatever the status.
- postfix-config.sh: cyrus_sasl_config_path set explicitly (bookworm's
  07_sasl_config.diff is gone); maillog_file_permissions=0640; mynetworks
  explicit; Dockerfile: SYNC_CHROOT= in /etc/default/postfix,
  opendkim-tools dropped, openssl named, systemd-standalone-sysusers so
  cron does not bring the whole of systemd.
- The selfpost group is 10998, outside the system range 100-999: in
  trixie a package took 998 and the build failed (owner's decision:
  a conflict-free id, the distribution's own ids untouched). The
  entrypoint hands /data back by name when the user or the group differs.
  Guide, backup refusal text, help (design commit 68ec8b2), e2e.
- smtpd_hide_client_session=yes on smtps and submission (owner's
  decision): Received: names no client, TLS, login or protocol; port 25
  keeps the full header. e2e checks both.
- test/upstream/opendkim-probe.sh makes keys with openssl genrsa.

Tests: on the server, make e2e exit 0 (674 s, the image built on trixie),
go vet + go test 27 packages ok. CHANGELOG [Unreleased], guide,
architecture.md, security.md, roadmap.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

test/e2e/mail_helpers.go

@@ -3,9 +3,11 @@ package e2e
 import (
 	"bytes"
 	"fmt"
+	"net/mail"
 	"os"
 	"path/filepath"
 	"regexp"
+	"strings"
 	"time"
 
 	"github.com/emersion/go-msgauth/dkim"
@@ -73,12 +75,50 @@ func verifyDKIM(raw []byte, domain string) error {
 	return fmt.Errorf("no DKIM signature found for domain %s (got %d signature(s))", domain, len(verifications))
 }
 
+// postfixReceived returns the Received: headers of raw that a Postfix smtpd
+// wrote - "(Postfix)" after the host name, the only form it writes (Postfix
+// 3.10.13, src/smtpd/smtpd.c:3627-3645, "by %s (%s)" with var_mail_name).
+// In the stand only SelfPost's Postfix writes one: the sink is smtp-sink,
+// which adds none, and the tests compose their messages without any.
+func postfixReceived(raw []byte) ([]string, error) {
+	msg, err := mail.ReadMessage(bytes.NewReader(raw))
+	if err != nil {
+		return nil, fmt.Errorf("parse the delivered message: %w", err)
+	}
+	var out []string
+	for _, v := range msg.Header["Received"] {
+		if strings.Contains(v, "(Postfix)") {
+			out = append(out, v)
+		}
+	}
+	return out, nil
+}
+
+// checkReceivedHidden: the submission ports set smtpd_hide_client_session
+// (build/postfix-config.sh), so SelfPost's Received: header is the redacted
+// one - it opens with "by", names no client and no protocol (Postfix 3.10.13,
+// src/smtpd/smtpd.c:3495, the "from" part written only when the parameter
+// is off, and with_protocol emptied with it).
+func checkReceivedHidden(raw []byte) error {
+	recv, err := postfixReceived(raw)
+	if err != nil {
+		return err
+	}
+	if len(recv) != 1 {
+		return fmt.Errorf("want one Received: header from SelfPost's Postfix, got %d: %q", len(recv), recv)
+	}
+	if !strings.HasPrefix(recv[0], "by ") || strings.Contains(recv[0], " with ") {
+		return fmt.Errorf("the Received: header names the client session: %q", recv[0])
+	}
+	return nil
+}
+
 // connectFromPattern matches Postfix's smtpd "connect from ...[ADDR]" log
 // line, which is how the harness learns the source address Postfix itself
 // observed for a just-made connection (needed to configure a level-2 rate
 // limit's allowed-IPs list — the address a host-published port is seen as
 // inside the container depends on Docker's NAT and isn't worth hard-coding).
-// Postfix 3.7.11, src/smtpd/smtpd.c, smtpd_service(): msg_info("connect from
+// Postfix 3.10.13, src/smtpd/smtpd.c, smtpd_service(): msg_info("connect from
 // %s", namaddr), namaddr being "name[addr]".
 var connectFromPattern = regexp.MustCompile(`connect from [^\[]*\[([0-9a-fA-F.:]+)\]`)