audit 2c: the From: parser port checked against OpenDKIM's signing itself

The last check of the port, and the plan's last line of stage 2c. Through
Postfix the sender check refuses most lines before OpenDKIM sees them, so
TestPortAgainstOpenDKIM (internal/milter) talks to OpenDKIM directly:
test/upstream/opendkim-probe.sh starts OpenDKIM from the SelfPost image in
a throwaway container, with keys and a refile SigningTable for three
names, and the test plays it each From: line through go-milter's client,
as a client OpenDKIM trusts (127.0.0.1, InternalHosts' default). For each
line the d= of the signature OpenDKIM adds must be the domain the port
predicts - its address, the domain cut to DKIM_MAXHOSTNAMELEN, the whole
cut to MAXADDRESS, matched against "^.*@<domain>$" case-insensitive as
dkimf_apply_signtable() matches - or neither signs.

Run on the test server, 2026-10-15 (OpenDKIM Filter v2.11.0 from the
image): 385 lines - both shared files and lines composed from display
names plain, quoted, escaped and encoded, comments nested and open,
groups, lists, brackets, source routes, domain literals and quoted local
parts, with the other sender's name and the server's in each place - 385
agree, 287 signed. The two lines padded so that, cut at 256 bytes, they
end in "@other.e2e.test" are signed by OpenDKIM with other.e2e.test's key:
the danger the sender check's 256-byte rule (3584adc) closes is real, and
the test now asserts it.

Measured while writing it: OpenDKIM answers a step it is done with by
accepting the message and then nothing more, and go-milter v0.4.1's client
needs read timeouts set in ClientOptions (the defaults apply only to its
default options) - the probe reads every step's action.

The differential test of the parser and this probe are now scripts in the
repository, test/upstream/mailparse-diff.sh and opendkim-probe.sh, both
run from it on the server: 200 019 lines agree with the C, 385 with the
signing. go vet and go test ./... pass on the server (24 packages). Stage
2c's plan lines are all ticked; roadmap 49/81.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

test/upstream/mailparse-diff.sh

@@ -0,0 +1,19 @@
+#!/bin/sh
+# The From: parser port (internal/milter/mailparse.go) against OpenDKIM's own
+# dkim_mail_parse(): builds internal/milter/testdata/mailparse_harness.c
+# against the libopendkim source the image runs, in a debian:bookworm
+# container, and runs TestMailParseMatchesOpenDKIM with it.
+#
+#   test/upstream/mailparse-diff.sh <opendkim source dir>
+#
+# The source dir is what `apt-get source opendkim` unpacks in debian:bookworm
+# (docs/development.md); it must contain libopendkim/.
+set -eu
+src=$(cd "$1" && pwd)
+repo=$(cd "$(dirname "$0")/../.." && pwd)
+docker run --rm -v "$src":/src:ro -v "$repo/internal/milter/testdata":/h -w /h debian:bookworm sh -c '
+apt-get update -qq >/dev/null && apt-get install -y -qq gcc libc6-dev >/dev/null 2>&1
+gcc -O1 -static -o /h/mailparse_harness -I /src/libopendkim /h/mailparse_harness.c'
+trap 'rm -f "$repo/internal/milter/testdata/mailparse_harness"' EXIT
+cd "$repo" && MAILPARSE_C="$repo/internal/milter/testdata/mailparse_harness" \
+	go test -count=1 -v -run 'TestMailParseMatchesOpenDKIM' ./internal/milter

test/upstream/opendkim-probe.sh

@@ -0,0 +1,28 @@
+#!/bin/sh
+# The From: parser port against OpenDKIM's signing: starts OpenDKIM from the
+# SelfPost image (default selfpost:e2e, the one make e2e builds) in a
+# throwaway container with keys for three names, and runs
+# TestPortAgainstOpenDKIM there against its socket.
+#
+#   test/upstream/opendkim-probe.sh [image]
+set -eu
+image=${1:-selfpost:e2e}
+repo=$(cd "$(dirname "$0")/../.." && pwd)
+bin=$(mktemp)
+trap 'rm -f "$bin"' EXIT
+cd "$repo" && CGO_ENABLED=0 GOOS=linux go test -c -o "$bin" ./internal/milter
+docker run --rm -v "$repo/internal/milter":/pkg:ro -v "$bin":/milter.test:ro --entrypoint sh "$image" -c '
+set -e
+mkdir -p /tmp/odk && cd /tmp/odk
+for d in sender.e2e.test other.e2e.test mail.e2e.test; do
+	mkdir -p keys/$d
+	opendkim-genkey -D keys/$d -d $d -s sel
+	echo "$d $d:sel:/tmp/odk/keys/$d/sel.private" >> KeyTable
+	echo "*@$d $d" >> SigningTable
+done
+printf "Mode s\nKeyTable /tmp/odk/KeyTable\nSigningTable refile:/tmp/odk/SigningTable\nSocket local:/tmp/odk/sock\nSyslog no\nRequireSafeKeys no\nBackground no\n" > o.conf
+opendkim -V | head -1
+opendkim -f -x /tmp/odk/o.conf &
+for i in 1 2 3 4 5 6 7 8 9 10; do [ -S /tmp/odk/sock ] && break; sleep 0.5; done
+cd /pkg
+OPENDKIM_PROBE_SOCKET=/tmp/odk/sock OPENDKIM_PROBE_TABLE=/tmp/odk/SigningTable /milter.test -test.run TestPortAgainstOpenDKIM -test.v -test.timeout 600s'