go-milter: build it patched not to keep every header

The security documentation's last open item of panel-dkim-signing (the
owner's decision, 2026-10-16): go-milter v0.4.1 added every header of a
session to a map of its own, emptied only on ABORT, and handed it to
Headers - which no milter of the panel reads. Postfix bounds one header,
not their number, so a message of nothing but headers up to the message
size limit was held whole by the library in the sender check, the signer
and the journal milter on 465/587 and in the inbound journal milter on port
25, where strangers send; the signer's 1 MiB refusal came after it was all
in.

third_party/go-milter is v0.4.1 from the module cache (BSD 2-Clause,
LICENSE kept) with session.go changed: CodeHeader hands the header to
Header and keeps nothing, CodeEOH hands Headers an empty map. PATCHES.md
says what and why, and how to take a new upstream version. go.mod replaces
the module with it; the Dockerfile copies third_party before "go mod
download". TestTheLibraryKeepsNoHeaders holds it through the library's own
client over two messages of one connection. Comments, security.md (the
accepted risk becomes a note), development.md's library table, the plan and
CHANGELOG follow.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/milter/library_test.go

@@ -0,0 +1,87 @@
+package milter
+
+import (
+	"context"
+	"net"
+	"net/textproto"
+	"sync"
+	"testing"
+
+	"github.com/emersion/go-milter"
+)
+
+// headerRecorder is a backend that notes what the library hands it.
+type headerRecorder struct {
+	milter.NoOpMilter
+	mu       *sync.Mutex
+	headers  *[]string
+	mapSizes *[]int
+}
+
+func (r headerRecorder) Header(name, value string, m *milter.Modifier) (milter.Response, error) {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	*r.headers = append(*r.headers, name)
+	return milter.RespContinue, nil
+}
+
+func (r headerRecorder) Headers(h textproto.MIMEHeader, m *milter.Modifier) (milter.Response, error) {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	*r.mapSizes = append(*r.mapSizes, len(h))
+	return milter.RespContinue, nil
+}
+
+// The go-milter the panel builds (third_party/go-milter/PATCHES.md) hands
+// every header to Header and keeps none: the map Headers gets is empty, on
+// the first message of a connection and on the next - upstream kept every
+// header of the connection until an ABORT.
+func TestTheLibraryKeepsNoHeaders(t *testing.T) {
+	var mu sync.Mutex
+	var headers []string
+	var mapSizes []int
+	ln, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatal(err)
+	}
+	srv := &milter.Server{
+		NewMilter: func() milter.Milter { return headerRecorder{mu: &mu, headers: &headers, mapSizes: &mapSizes} },
+		Protocol:  milter.OptNoBody,
+	}
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	go func() { <-ctx.Done(); _ = srv.Close() }()
+	go func() { _ = srv.Serve(ln) }()
+
+	cl := milter.NewClientWithOptions("tcp", ln.Addr().String(), milter.ClientOptions{})
+	defer cl.Close()
+	s, err := cl.Session()
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer s.Close()
+	for i := 0; i < 2; i++ {
+		if _, err := s.Mail("<a@example.org>", nil); err != nil {
+			t.Fatal(err)
+		}
+		if _, err := s.Rcpt("<b@example.net>", nil); err != nil {
+			t.Fatal(err)
+		}
+		for _, name := range []string{"From", "To", "X-Filler"} {
+			if _, err := s.HeaderField(name, " value"); err != nil {
+				t.Fatal(err)
+			}
+		}
+		if _, err := s.HeaderEnd(); err != nil {
+			t.Fatal(err)
+		}
+	}
+	mu.Lock()
+	defer mu.Unlock()
+	if len(headers) != 6 {
+		t.Errorf("Header saw %v, want the three headers of each of two messages", headers)
+	}
+	if len(mapSizes) != 2 || mapSizes[0] != 0 || mapSizes[1] != 0 {
+		t.Errorf("Headers got maps of %v headers, want two empty ones", mapSizes)
+	}
+}

internal/milter/sender.go

@@ -331,10 +331,11 @@ func (s *senderSession) Header(name, value string, m *milter.Modifier) (milter.R
 // message, and src/smtpd/smtpd.c, common_post_message_handling(), says that
 // reply to the client.
 //
-// h is not read: go-milter v0.4.1 adds every header of the connection to it
-// and empties it only on ABORT (session.go, CodeHeader, CodeAbort), so on a
-// second message it can still hold the first one's From:. The session keeps
-// its own, emptied at each MAIL FROM (audit 2026-10-12, L9).
+// h is not read, and is empty: upstream go-milter v0.4.1 added every header
+// of the connection to it and emptied it only on ABORT, so on a second
+// message it could still hold the first one's From: (audit 2026-10-12, L9);
+// the copy SelfPost builds keeps none (third_party/go-milter/PATCHES.md). The
+// session keeps its own, emptied at each MAIL FROM.
 func (s *senderSession) Headers(h textproto.MIMEHeader, m *milter.Modifier) (milter.Response, error) {
 	field, shown, why, err := s.judge()
 	if err != nil {

internal/milter/sign.go

@@ -276,8 +276,7 @@ func (s *signSession) Header(name, value string, m *milter.Modifier) (milter.Res
 // What cannot be signed is deferred: the socket is attached with
 // default_action=tempfail, and so is every refusal here.
 //
-// h is not read: go-milter v0.4.1 keeps every header of the connection in it
-// (see senderSession.Headers).
+// h is not read, and is empty (see senderSession.Headers).
 func (s *signSession) Headers(h textproto.MIMEHeader, m *milter.Modifier) (milter.Response, error) {
 	if s.tooBig {
 		log.Printf("dkim-signer: login %q: a header section of more than %d bytes - refused", s.login, headerLimit)