2 Commits

Include renames

Author	SHA1	Message	Date
mixandClaude Opus 5.5	af130e268a	findings of the reviews of audit stage 2b ... Technical review (Opus) and security review (Fable) of 5be109b..5154bba; reports in the session's scratchpad. Nothing above low from security; one bug and three risks from the technical review. Migration 0009 is not deployed, so it was extended. - Bug: two refusals of one second swapped their NOQUEUE lines (each line went to the newest lineless row). AttachRefusalLine now matches the client address too (send_log.client_ip, written by the journal milter - Postfix's line names the client and the sender, never the login: the sasl_username part of the pattern never matched and could be fed by HELO, security F1/F2), takes the nearest row in time and the oldest of equals, and a line already on a row goes on no other (security F6). - Waiting lines and recoveries lived only in memory while the saved offset moved past them: a stop within 30 s lost them. The tracker now never saves an offset past the oldest waiting item in its file (tracker.hold, refusalLines.oldest) - for a recovery, the client= line that names its login - so they are read again; the "once" guards make that harmless. - A recovered row whose login the tailer did not see was nobody's: its domain_id falls back to the envelope domain's. - The fingerprint's file identity is the inode alone: the device number can change across a host reboot and make the same log look rotated. - A refused row carries its queue id; UpdateStatus's "newest row" now skips refused rows, so a later message with that id does not flip it to sent. - The alive mark: its age is read first and kept from then on, so asking supervisord for 30 s cannot make it stale; the entrypoint removes it with the sockets - a container restart is not the check's downtime, and a mark from before would have counted the whole outage as "≈". - Security F3: the sender check prints no ";" of the client's in the From: text of its reply, and the tailer reads the envelope after the first ";" - Postfix's own text. - A refused row with a queue id and no stored lines says so (it was told the mail.log text of 2.2.0); the fact's em dash is the house hyphen. - Docs: architecture (client address, no login), guide § Health (warns on either count), help topics log and sender-check (design 1ca87f2). - e2e: refusals_show_postfixs_line wants the refusal's own sender in the line; refusal_recovered_from_the_log waits past the tailer's 30 s and checks that a refusal the panel wrote got no recovered twin. Not changed, written down: review 9 (mail.log.1 read to its end at that moment; postlogd may still write to it until the reload), 10 (a log under 512 bytes has no fingerprint, so places fall back to time briefly after a rotation), 6 (a 451 at MAIL FROM of another milter reads the same - the client and sender must match too now), security F5/F12 (info). Review 12: the refused and closed-by-the-panel variants of out-message were shown to the owner as pictures of the real templates, not drawn in out-message.html: the guard ties every drawn screen to a page of the engine, and a variant has the page's outline. Evidence on the test server for this tree: go vet clean, go test ./... 23 packages ok, make e2e exit 0 (refusal_recovered_from_the_log 70 s). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-14 18:38:22 +03:00
mixandClaude Opus 5.5	4678015bbd	logtail: a log rotated while the panel was down is read to its end (stage 2b) ... At start, a saved offset whose fingerprint was not the current file's meant "start on the new file": what Postfix wrote between the panel's stop and the rotation was never read - delivery statuses, stored lines, refusals, inbound journal rows, the deferred counter. - tracker.resume marks the case (behind, prev); follow calls readRotated before the new file: it opens mail.log.1 (delaycompress leaves it plain), checks by fingerprint that it is the file the place belongs to, reads it from the saved offset to its end through handle (catching up: the once-protections apply) and flushes the stored lines. - Not found, not that file, or the offset past its end (rotated twice): logged, with the saved place's time - from when nothing was read. - The fingerprint gains the file's identity (device.inode, fileid_unix.go; empty elsewhere): two logs that begin alike are two files - the review-2026-08-followups row on collisions. A fingerprint saved before (hash alone) still matches by its hash (sameLog), so the first start after the upgrade resumes where it was. - store.LogtailState reads back updated_at. Tests: stop, append, rotate, append, start - both halves read, once each, the earlier line not again; a mail.log.1 that is another file is not read from the place; sameLog with an old and a new fingerprint. CHANGELOG [Unreleased], audit plan line ticked, roadmap 23/62. Evidence: GOOS=linux go vet ./internal/logtail clean; go test ./internal/logtail ok on Windows but for TestFollowTailsAndRotates; the server run follows before the push. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-14 16:25:29 +03:00