ci: actions by commit, govulncheck, images pinned, base packages watched (audit I4, I5)

Security audit 2026-10-17, findings I4 and I5 (low), stage 5.

I4: every action is pinned by commit with its version in a comment - the
latest release of the major each used, so nothing changes in behaviour
(checkout v4.4.0, setup-go v5.6.0, setup-buildx-action v3.12.0,
build-push-action v6.19.2, login-action v3.7.0; commits read with git
ls-remote, the tags are lightweight). govulncheck v1.9.0 runs on the
source in test.yml, and in release.yml on the image's panel and
selfpost-backup binaries before the push (-mode=binary: the base image's
Go, which may lag the runner's - a fixed stdlib advisory then fails the
release until golang:1.26-trixie moves, which is the point). certbot is
pinned to v5.8.0 and Caddy to 2.11.7 (Docker Hub, 2026-10-17).
provenance/SBOM stay off until the GHCR cleanup keeps attestations, as the
plan says.

I5: published tags are never rebuilt, so a Debian security fix reaches
operators with the next release. The guide (§ Upgrading) and SECURITY.md
say so; base-packages.yml runs .github/scripts/base-packages.sh every
Monday: what debian:trixie-slim would install for postfix, libsasl2-2,
libsasl2-modules-db, sasl2-bin, openssl, libssl3t64, libdb5.3t64 against
the table in development.md (the 2.14.3 image's versions), red when one
moved. Tried on the test server: green as it stands, red with a version
changed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/development.md

@@ -280,6 +280,26 @@ re-read what changed, update the citations, then this table:
 | `logrotate` | `3.22.0-1` |
 <!-- /cited-package-versions -->
 
+A security update of one of these, or of OpenSSL or Berkeley DB, reaches
+operators only with the next release: published tags are never rebuilt.
+`.github/workflows/base-packages.yml` compares every Monday what
+`debian:trixie-slim` would install with the versions the last release was
+built with, below, and fails when one has moved - the sign to cut a patch
+release. Cutting a release updates this table from the image
+(`dpkg-query -W` of these names; security audit 2026-10-17, I5):
+
+<!-- base-package-versions -->
+| Package | Built with |
+|---|---|
+| `postfix` | `3.10.13-0+deb13u1` |
+| `libsasl2-2` | `2.1.28+dfsg1-9` |
+| `libsasl2-modules-db` | `2.1.28+dfsg1-9` |
+| `sasl2-bin` | `2.1.28+dfsg1-9` |
+| `openssl` | `3.5.7-1~deb13u3` |
+| `libssl3t64` | `3.5.7-1~deb13u3` |
+| `libdb5.3t64` | `5.3.28+dfsg2-9` |
+<!-- /base-package-versions -->
+
 A document instead of source: its URL and section. Where neither answers the
 question, the comment says so and what was measured instead - "measured on
 the e2e stand, 2026-10-14: ..." - and a measurement is never written as if

docs/guide.md

@@ -768,6 +768,13 @@ published, then `docker compose up -d`. The backup version check requires the ru
 to match the version that created a full backup — see [Fixed image
 tag](#fixed-image-tag).
 
+**Base-package fixes come with releases.** The image is Debian trixie, and a
+security update of Postfix, Cyrus SASL, OpenSSL or Berkeley DB reaches you with
+the next SelfPost release built after it: a published image tag is never
+rebuilt. The project checks every week whether one of those has moved and cuts
+a patch release when it has; a release whose notes say "base packages" is one
+of those.
+
 **To 2.8.0** there is nothing to do. From 2.8.0 the panel signs outgoing
 mail itself, in a milter of its own, and OpenDKIM is no longer in the image;
 the keys, the selectors and the DNS records stay as they are. The keys move

docs/security-audit-2026-10-17.md

@@ -824,17 +824,25 @@ the argument.
 
 ### Stage 5 — supply chain and currency (~2.5 h)
 
-- [ ] **I4.** Actions pinned by SHA with the version in a comment;
+- [x] **I4.** Actions pinned by SHA with the version in a comment;
   `govulncheck ./...` in `test.yml` and in `release.yml` before the push (a
   stdlib advisory fixed in the current patch of the pinned minor fails the
   build until the base tag moves — that is the point); `certbot` and
   `caddy` pinned in the fragments. Leave `provenance`/`sbom` off until the
   GHCR cleanup loop is taught to keep attestation manifests (a follow-up,
-  1 h). — **Sonnet**, 1 h.
-- [ ] **I5.** guide § Upgrading and SECURITY.md: base-package fixes arrive
+  1 h). — **Sonnet**, 1 h. *Done 2026-10-17:* actions pinned to the
+  latest release of the major each used (checkout v4.4.0, setup-go v5.6.0,
+  setup-buildx v3.12.0, build-push v6.19.2, login v3.7.0); govulncheck
+  v1.9.0 on the source in test.yml and on the image's two binaries
+  (`-mode=binary`, the base image's Go) in release.yml before the push;
+  certbot v5.8.0, caddy 2.11.7. provenance/SBOM stay off, as planned.
+- [x] **I5.** guide § Upgrading and SECURITY.md: base-package fixes arrive
   with the next patch release; the owner's rule on published tags. A weekly
   workflow that rebuilds the package list in `debian:trixie-slim` and fails
-  when postfix/libsasl2/openssl/libdb moved, as the nudge. — **Sonnet**,
+  when postfix/libsasl2/openssl/libdb moved, as the nudge. — **Sonnet**, *Done 2026-10-17:* the guide, SECURITY.md;
+  `base-packages.yml` + `.github/scripts/base-packages.sh` against a table
+  in development.md (seven packages, from the 2.14.3 image), tried on the
+  test server both ways.
   1.5 h.
 
 ### Stage 6 — the rest, and what to accept (~3 h)