base-trixie: the image on Debian trixie, Postfix 3.10.13; Received: hidden on 465/587

The runtime base is debian:trixie-slim, the build stage golang:1.26-trixie:
Postfix 3.10.13 with upstream's 2026 security fixes up to the August
batch, libmilter 8.18.1, OpenSSL 3.5. Every citation of another program in
code, scripts and documents was re-read against the trixie sources
(dev/upstream; bookworm's kept in dev/upstream-bookworm) and updated;
development.md's cited-package table holds the trixie versions.

What the re-reading changed in behaviour:
- logtail: reject lines with sasl_method/sasl_username/sasl_sender
  (smtpd_check.c:1019-1026); cleanup's "removed (canceled)" forgets a
  port-25 id (cleanup_api.c:363-364).
- internal/postfix/retry.go reads postconf's stdout only: since 3.9 a
  deprecated-parameter warning on stderr made one value too many and the
  panel fell back to the compiled-in retry policy.
- logrotate-loop.sh: logrotate 3.22 exits 1 when it ignores a config;
  the loop refuses on that output whatever the status.
- postfix-config.sh: cyrus_sasl_config_path set explicitly (bookworm's
  07_sasl_config.diff is gone); maillog_file_permissions=0640; mynetworks
  explicit; Dockerfile: SYNC_CHROOT= in /etc/default/postfix,
  opendkim-tools dropped, openssl named, systemd-standalone-sysusers so
  cron does not bring the whole of systemd.
- The selfpost group is 10998, outside the system range 100-999: in
  trixie a package took 998 and the build failed (owner's decision:
  a conflict-free id, the distribution's own ids untouched). The
  entrypoint hands /data back by name when the user or the group differs.
  Guide, backup refusal text, help (design commit 68ec8b2), e2e.
- smtpd_hide_client_session=yes on smtps and submission (owner's
  decision): Received: names no client, TLS, login or protocol; port 25
  keeps the full header. e2e checks both.
- test/upstream/opendkim-probe.sh makes keys with openssl genrsa.

Tests: on the server, make e2e exit 0 (674 s, the image built on trixie),
go vet + go test 27 packages ok. CHANGELOG [Unreleased], guide,
architecture.md, security.md, roadmap.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

test/upstream/mailparse-diff.sh

@@ -1,17 +1,17 @@
 #!/bin/sh
 # The From: parser port (internal/milter/mailparse.go) against OpenDKIM's own
 # dkim_mail_parse(): builds internal/milter/testdata/mailparse_harness.c
-# against the libopendkim source the image runs, in a debian:bookworm
+# against the libopendkim source the image runs, in a debian:trixie
 # container, and runs TestMailParseMatchesOpenDKIM with it.
 #
 #   test/upstream/mailparse-diff.sh <opendkim source dir>
 #
-# The source dir is what `apt-get source opendkim` unpacks in debian:bookworm
+# The source dir is what `apt-get source opendkim` unpacks in debian:trixie
 # (docs/development.md); it must contain libopendkim/.
 set -eu
 src=$(cd "$1" && pwd)
 repo=$(cd "$(dirname "$0")/../.." && pwd)
-docker run --rm -v "$src":/src:ro -v "$repo/internal/milter/testdata":/h -w /h debian:bookworm sh -c '
+docker run --rm -v "$src":/src:ro -v "$repo/internal/milter/testdata":/h -w /h debian:trixie sh -c '
 apt-get update -qq >/dev/null && apt-get install -y -qq gcc libc6-dev >/dev/null 2>&1
 gcc -O1 -static -o /h/mailparse_harness -I /src/libopendkim /h/mailparse_harness.c'
 trap 'rm -f "$repo/internal/milter/testdata/mailparse_harness"' EXIT

test/upstream/opendkim-probe.sh

@@ -16,7 +16,7 @@ set -e
 mkdir -p /tmp/odk && cd /tmp/odk
 for d in sender.e2e.test other.e2e.test mail.e2e.test; do
 	mkdir -p keys/$d
-	opendkim-genkey -D keys/$d -d $d -s sel
+	openssl genrsa -out keys/$d/sel.private 2048 2>/dev/null
 	echo "$d $d:sel:/tmp/odk/keys/$d/sel.private" >> KeyTable
 	echo "*@$d $d" >> SigningTable
 done