panel-dkim-signing: the queue by name, and findings of the reviews

The first rollout of faa3c11 to the test server crash-looped: without
opendkim the image's package accounts got other numbers (postfix 101 ->
100, postdrop 103 -> 102), the queue under /data kept the old ones, and
postsuper, which "postfix check" runs as the mail owner
(src/postsuper/postsuper.c:1442), could not open it. Rolled back within
five minutes. The entrypoint now hands an existing queue to Postfix's users
by name before postfix-config.sh, and again after it (own_queue).

Technical review (F1-F10):
- F1 high: a backup of an upgraded installation carried /data/opendkim, a
  restore left it root's, and the panel refused every start. The tree is
  left out of archives, and the entrypoint makes it the panel's alone
  (0700/0600; also the security review's F3 - nothing of 2.8 needs the
  group any more; a 2.7.x start re-normalises it).
- F2: List-Unsubscribe-Post is signed (RFC 8058); Sender too (security F1).
- F3: SetServerName keeps the name in lower case - a key written under
  "Mail.Example.com" was never found. Only the DKIM side: the SASL realm
  is compared as written.
- F4: the signer rewrites the selector table at every start
  (WriteSelectors, replacing EnsureServerSigned), and tries again every
  10 s while a rewrite fails.
- F5: e2e signature_over_awkward_headers (folded, tab-led, no space, two
  To:, 8-bit body, List-Unsubscribe-Post) checked by dkimpy;
  TestStartsOnA27Data starts on a 2.7 /data (old key tree, a queue of
  foreign numbers) and checks the copied key signs, the old tree's modes
  and the queue's owners; unit tests for repeated headers and the header
  limit.
- F6: the table's writers are serialised (tableMu).
- F7: the table is read for every message; keys the table no longer names
  are dropped from memory.
- F8: the signature's value brings its own space (SMFIP_HDR_LEADSPC gets
  none from Postfix, cleanup_milter.c:1085).
- F9: a body line over 998 bytes is logged with its domain: Postfix's SMTP
  client breaks it after signing (smtp_proto.c:1266-1274).
- F10: the keys are copied while /data/dkim holds none (not only when it
  is absent), after the old tree is made the panel's (an install from 2.6
  had another uid); the plan's rollback note says what a rollback keeps.

Security review: F2 a header section over 1 MiB is refused (552 5.3.4)
and the kept headers freed once the block is built - fifty connections of
header-only messages could take the panel down; F5 the shown headers a
message has (Subject, Date, To, Cc, Reply-To, Sender) are over-signed,
only when present, since cleanup adds a missing Date: after the milters.
F1 (holding Sender: to the login like From:) changes what is refused and
waits for the owner.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/domain/servermail_test.go

@@ -82,10 +82,10 @@ func TestServerNameThatIsAlsoADomain(t *testing.T) {
 	}
 }
 
-// The first start of 2.8.0 finds no selector table - OpenDKIM's tables were
-// the earlier versions' - and an installation may lack the server's line.
-// The start rebuilds, once.
-func TestEnsureServerSignedRebuildsOnce(t *testing.T) {
+// The signer rewrites the table at every start: the first start of 2.8.0
+// finds none (OpenDKIM's tables were the earlier versions'), and a rewrite
+// cut short leaves a domain without its line while the server's is there.
+func TestWriteSelectorsAtTheStart(t *testing.T) {
 	svc, keys := newTestService(t, &fakeApps{})
 	if _, err := svc.Add("example.com"); err != nil {
 		t.Fatal(err)
@@ -95,43 +95,51 @@ func TestEnsureServerSignedRebuildsOnce(t *testing.T) {
 	}
 
 	svc.SetServerName("mail.example.org")
-	if rebuilt, err := svc.EnsureServerSigned(); err != nil || !rebuilt {
-		t.Fatalf("first start: rebuilt = %v, %v; want a rebuild", rebuilt, err)
+	if err := svc.WriteSelectors(); err != nil {
+		t.Fatalf("first start: %v", err)
 	}
-	if got, want := readSelectors(t, keys), "example.com selfpost\nmail.example.org selfpost\n"; got != want {
-		t.Errorf("selector table after the rebuild = %q, want %q", got, want)
+	want := "example.com selfpost" + "\n" + "mail.example.org selfpost" + "\n"
+	if got := readSelectors(t, keys); got != want {
+		t.Errorf("selector table after the first start = %q, want %q", got, want)
 	}
-	if rebuilt, err := svc.EnsureServerSigned(); err != nil || rebuilt {
-		t.Errorf("second start: rebuilt = %v, %v; want nothing to do", rebuilt, err)
+
+	// A domain's line lost (a rewrite cut short): the next start puts it back.
+	if err := os.WriteFile(keys.selectorsPath, []byte("mail.example.org selfpost"+"\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if err := svc.WriteSelectors(); err != nil {
+		t.Fatal(err)
+	}
+	if got := readSelectors(t, keys); got != want {
+		t.Errorf("selector table after the next start = %q, want %q", got, want)
 	}
 
 	// A name that only begins like the server's is not it.
 	other, otherKeys := newTestService(t, &fakeApps{})
 	other.SetServerName("mail.example.org.evil.example")
-	if _, err := other.EnsureServerSigned(); err != nil {
+	if err := other.WriteSelectors(); err != nil {
 		t.Fatal(err)
 	}
-	if signed, err := otherKeys.signs("mail.example.org", "selfpost"); err != nil || signed {
-		t.Errorf("a longer name was taken for the server's: %v, %v", signed, err)
+	if got := readSelectors(t, otherKeys); got != "mail.example.org.evil.example selfpost"+"\n" {
+		t.Errorf("selector table = %q", got)
 	}
 }
 
-// A table that signs the server's name with the key of another selector - the
-// default selector was changed - is rebuilt: the signer must sign with the key
-// whose record the panel shows.
-func TestEnsureServerSignedFollowsTheSelector(t *testing.T) {
+// A changed default selector: the server's name is signed with the key of the
+// new one, whose record the panel shows.
+func TestWriteSelectorsFollowsTheSelector(t *testing.T) {
 	svc, keys := newTestService(t, &fakeApps{})
 	svc.SetServerName("mail.example.org")
-	if _, err := svc.EnsureServerSigned(); err != nil {
+	if err := svc.WriteSelectors(); err != nil {
 		t.Fatal(err)
 	}
 
 	svc.selector = "sp2027"
-	if rebuilt, err := svc.EnsureServerSigned(); err != nil || !rebuilt {
-		t.Fatalf("after the selector changed: rebuilt = %v, %v; want a rebuild", rebuilt, err)
+	if err := svc.WriteSelectors(); err != nil {
+		t.Fatal(err)
 	}
-	if got := readSelectors(t, keys); got != "mail.example.org sp2027\n" {
-		t.Errorf("selector table after the rebuild = %q", got)
+	if got := readSelectors(t, keys); got != "mail.example.org sp2027"+"\n" {
+		t.Errorf("selector table after the change = %q", got)
 	}
 	mail, err := svc.ServerMail()
 	if err != nil || mail.Selector != "sp2027" {
@@ -139,6 +147,26 @@ func TestEnsureServerSignedFollowsTheSelector(t *testing.T) {
 	}
 }
 
+// A hostname written with capitals is the server's name in lower case: the
+// signer looks a key up by the name in lower case, and a key written under the
+// capitals would never be found.
+func TestServerNameInCapitals(t *testing.T) {
+	svc, keys := newTestService(t, &fakeApps{})
+	svc.SetServerName("Mail.Example.ORG")
+	if err := svc.WriteSelectors(); err != nil {
+		t.Fatal(err)
+	}
+	if got := readSelectors(t, keys); got != "mail.example.org selfpost"+"\n" {
+		t.Errorf("selector table = %q", got)
+	}
+	if _, err := os.Stat(KeyPath(keys.keysDir, "mail.example.org", "selfpost")); err != nil {
+		t.Errorf("the key is not under the name in lower case: %v", err)
+	}
+	if mail, err := svc.ServerMail(); err != nil || mail.Name != "mail.example.org" {
+		t.Errorf("server mail = %+v, %v", mail, err)
+	}
+}
+
 // Without a hostname nothing is added and nothing is signed for it.
 func TestNoServerName(t *testing.T) {
 	svc, keys := newTestService(t, &fakeApps{})