base-trixie: the image on Debian trixie, Postfix 3.10.13; Received: hidden on 465/587

The runtime base is debian:trixie-slim, the build stage golang:1.26-trixie:
Postfix 3.10.13 with upstream's 2026 security fixes up to the August
batch, libmilter 8.18.1, OpenSSL 3.5. Every citation of another program in
code, scripts and documents was re-read against the trixie sources
(dev/upstream; bookworm's kept in dev/upstream-bookworm) and updated;
development.md's cited-package table holds the trixie versions.

What the re-reading changed in behaviour:
- logtail: reject lines with sasl_method/sasl_username/sasl_sender
  (smtpd_check.c:1019-1026); cleanup's "removed (canceled)" forgets a
  port-25 id (cleanup_api.c:363-364).
- internal/postfix/retry.go reads postconf's stdout only: since 3.9 a
  deprecated-parameter warning on stderr made one value too many and the
  panel fell back to the compiled-in retry policy.
- logrotate-loop.sh: logrotate 3.22 exits 1 when it ignores a config;
  the loop refuses on that output whatever the status.
- postfix-config.sh: cyrus_sasl_config_path set explicitly (bookworm's
  07_sasl_config.diff is gone); maillog_file_permissions=0640; mynetworks
  explicit; Dockerfile: SYNC_CHROOT= in /etc/default/postfix,
  opendkim-tools dropped, openssl named, systemd-standalone-sysusers so
  cron does not bring the whole of systemd.
- The selfpost group is 10998, outside the system range 100-999: in
  trixie a package took 998 and the build failed (owner's decision:
  a conflict-free id, the distribution's own ids untouched). The
  entrypoint hands /data back by name when the user or the group differs.
  Guide, backup refusal text, help (design commit 68ec8b2), e2e.
- smtpd_hide_client_session=yes on smtps and submission (owner's
  decision): Received: names no client, TLS, login or protocol; port 25
  keeps the full header. e2e checks both.
- test/upstream/opendkim-probe.sh makes keys with openssl genrsa.

Tests: on the server, make e2e exit 0 (674 s, the image built on trixie),
go vet + go test 27 packages ok. CHANGELOG [Unreleased], guide,
architecture.md, security.md, roadmap.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

test/e2e/port25_config_check.go

@@ -34,7 +34,7 @@ type port25Case struct {
 // flags=, user= and argv= are arguments of pipe(8); set as -o parameters they
 // are dropped, and a bare "pipe" dies on every report with "fatal: missing
 // user= command-line attribute" - the state of 1.7.0 through 1.9.5 (date not
-// recorded; Postfix 3.7.11, src/pipe/pipe.c, get_service_attr()).
+// recorded; Postfix 3.10.13, src/pipe/pipe.c, get_service_attr()).
 const ingestService = "dmarc-ingest unix - n n - 1 pipe flags=Rq user=panel argv=/usr/local/bin/dmarc-ingest ${recipient}"
 
 var port25Cases = []port25Case{
@@ -51,8 +51,12 @@ var port25Cases = []port25Case{
 			// The log tailer tells this listener's refusals from the
 			// submission ports' by the name they are logged under.
 			{param: "syslog_name", contains: "postfix/inbound", wantExact: true},
-			// The SMTP-smuggling defence, off by default on this Postfix
-			// (own-mta-builds, § 5); testInboundBareNewline drives it.
+			// The SMTP-smuggling defence. Postfix 3.10.13 has it by default
+			// (src/global/mail_params.h, DEF_SMTPD_FORBID_BARE_LF "normalize");
+			// set explicitly since 2.6.1, when the image ran Postfix 3.7.11,
+			// whose default was "no" (own-mta-builds, § 5), and kept so the
+			// listener does not depend on the default. testInboundBareNewline
+			// drives it.
 			{param: "smtpd_forbid_bare_newline", contains: "normalize", wantExact: true},
 			// No antispam milter configured: the inbound journal milter
 			// alone. The submission chain (strict OpenDKIM + journal-milter)
@@ -150,8 +154,9 @@ func checkPort25ConfigCombinations(s *stack) error {
 			// cut at the space and the rest becomes a stray smtpd argument
 			// ("fatal: unexpected command-line argument", port 25 dead while
 			// `postfix check` stays silent). Ask Postfix itself. (Seen in 1.9.1,
-			// date not recorded; Postfix 3.7.11, man/man5/master.5, "-o
-			// name=value (short form)", NOTE 2.)
+			// date not recorded; Postfix 3.10.13, man/man5/master.5, "-o
+			// name=value (short form)": "does not support whitespace
+			// around the "=" or in parameter values".)
 			seen, err := s.execIn("selfpost", "postconf", "-Ph", "smtp/inet/"+c.param)
 			if err != nil {
 				return fmt.Errorf("%s: postconf -P smtp/inet/%s: %v\n%s", tc.name, c.param, err, seen)