release: 1.0.0: Public 1.0 image; delivery log; docs and SECURITY.md (incl. 1.0.1)

[1.0.0]
Added:
  - A **Delivery log** on each delivery's page (`/deliveries/{id}`): the
  - A **History** block on the same page: the journal's two timestamps stated as
Fixed:
  - Postfix config: copy TLS cert/key from the (often `:ro`, host-owned) mount
  - Postfix config: allow `maillog_file` under `/data` via
  - E2e: read `/data/setup-token` via `docker compose exec` (file is `0600`
  - Entrypoint: check `SELFPOST_HOSTNAME` before `/data` setup (so a bad identity
  - E2e gate: wait for host-published `/healthz` before panel setup, and stop
  … (3 more in CHANGELOG)
Changed:
  - Document what `.spbk` and `.spde` stand for (SelfPost backup / SelfPost domain
  - Docs aligned with the code: setup URL is `/setup/<token>` (README and
  - Full backups no longer carry `/data/log`. It is Postfix's raw log plus its
  - Monitoring screens (status, mail queue, system log, deliveries) use adaptive
  - Documentation package consolidated into `docs/development.md`: Documentation
  … (4 more in CHANGELOG)
[1.0.1]
A documentation and packaging release: no change to the mail path, the database, or the on-disk layout. Upgrading is a tag bump.
Added:
  - `SECURITY.md` — how to report a vulnerability privately (GitHub private
  - [docs/plans/](docs/plans/) — one document per agreed extension: the optional
Changed:
  - The panel's **Account** entry is now called **Settings** — nav link, page
  - The signed-in name in the panel's nav is now labelled `User:`, so it reads as
  - [docs/product.md](docs/product.md) reframes the future line: the inbound
  - [docs/security.md](docs/security.md) is now in English, matching the rest of
  - The README documentation table now points at `SECURITY.md` for reporting a
  … (2 more in CHANGELOG)
Fixed:
  - The panel's static assets are served with a content ETag and

Squashed CHANGELOG sections: [1.0.0], [1.0.1].

Full detail: CHANGELOG.md (1.0.0, 1.0.1).

.github/workflows/release.yml

@@ -7,7 +7,7 @@ name: release
 # can never drift apart (the invariant restore's version check in spec 7.5.A
 # depends on).
 #
-# Native per-architecture builds (plan implementation-plan.md C.4), not qemu:
+# Native per-architecture builds (see docs/development.md), not qemu:
 # running the full Postfix/OpenDKIM stack under emulation for the e2e gate
 # below is impractically slow. Each arch builds, e2e-gates and pushes its own
 # tag on its own native runner; a merge job then combines them into the one
@@ -68,7 +68,7 @@ jobs:
           go-version: "1.26"
           cache-dependency-path: test/e2e/go.sum
 
-      - name: e2e (gates publishing — see docs/implementation-plan.md C.4)
+      - name: e2e (gates publishing — see docs/development.md)
         run: cd test/e2e && go test -v -timeout 20m ./...
 
       - name: Log in to ghcr.io
@@ -79,9 +79,35 @@ jobs:
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Push per-arch tag
+        # GHCR sometimes rejects the final manifest with "unknown blob" after
+        # every layer reports Pushed (registry race / overwrite of the same
+        # version tag). Retries are idempotent for identical local bytes.
         run: |
-          docker tag selfpost:e2e "ghcr.io/${{ github.repository }}:${{ needs.prepare.outputs.version }}-${{ matrix.arch }}"
-          docker push "ghcr.io/${{ github.repository }}:${{ needs.prepare.outputs.version }}-${{ matrix.arch }}"
+          set -euo pipefail
+          image="ghcr.io/${{ github.repository }}:${{ needs.prepare.outputs.version }}-${{ matrix.arch }}"
+          docker tag selfpost:e2e "$image"
+          attempt=1
+          max=4
+          backoff=15
+          while true; do
+            set +e
+            out=$(docker push "$image" 2>&1)
+            rc=$?
+            set -e
+            if [ "$rc" -eq 0 ]; then
+              printf '%s\n' "$out"
+              exit 0
+            fi
+            printf '%s\n' "$out" >&2
+            if [ "$attempt" -ge "$max" ] || ! grep -qiE 'unknown blob|blob unknown|blob upload invalid|manifest unknown|received unexpected HTTP status: 5[0-9]{2}|429 Too Many Requests|temporarily unavailable' <<<"$out"; then
+              echo "::error::docker push failed for ${image} (attempt ${attempt}/${max}, exit ${rc})" >&2
+              exit "$rc"
+            fi
+            echo "::warning::transient GHCR error pushing ${image} (attempt ${attempt}/${max}); retry in ${backoff}s" >&2
+            sleep "$backoff"
+            attempt=$((attempt + 1))
+            backoff=$((backoff * 2))
+          done
 
   merge:
     needs: [prepare, build]
@@ -97,8 +123,32 @@ jobs:
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Merge per-arch tags into the version manifest
+        # Same GHCR "unknown blob" class of failure can hit imagetools create
+        # when assembling the multi-arch version tag.
         run: |
-          docker buildx imagetools create \
-            -t "ghcr.io/${{ github.repository }}:${{ needs.prepare.outputs.version }}" \
-            "ghcr.io/${{ github.repository }}:${{ needs.prepare.outputs.version }}-amd64" \
-            "ghcr.io/${{ github.repository }}:${{ needs.prepare.outputs.version }}-arm64"
+          set -euo pipefail
+          version_tag="ghcr.io/${{ github.repository }}:${{ needs.prepare.outputs.version }}"
+          amd64="ghcr.io/${{ github.repository }}:${{ needs.prepare.outputs.version }}-amd64"
+          arm64="ghcr.io/${{ github.repository }}:${{ needs.prepare.outputs.version }}-arm64"
+          attempt=1
+          max=4
+          backoff=15
+          while true; do
+            set +e
+            out=$(docker buildx imagetools create -t "$version_tag" "$amd64" "$arm64" 2>&1)
+            rc=$?
+            set -e
+            if [ "$rc" -eq 0 ]; then
+              printf '%s\n' "$out"
+              exit 0
+            fi
+            printf '%s\n' "$out" >&2
+            if [ "$attempt" -ge "$max" ] || ! grep -qiE 'unknown blob|blob unknown|blob upload invalid|manifest unknown|received unexpected HTTP status: 5[0-9]{2}|429 Too Many Requests|temporarily unavailable' <<<"$out"; then
+              echo "::error::imagetools create failed for ${version_tag} (attempt ${attempt}/${max}, exit ${rc})" >&2
+              exit "$rc"
+            fi
+            echo "::warning::transient GHCR error merging ${version_tag} (attempt ${attempt}/${max}); retry in ${backoff}s" >&2
+            sleep "$backoff"
+            attempt=$((attempt + 1))
+            backoff=$((backoff * 2))
+          done