mixandClaude Opus 5.5
1c6e04b7d3
test / test (push) Canceled after 0s
The runtime base is debian:trixie-slim, the build stage golang:1.26-trixie:
Postfix 3.10.13 with upstream's 2026 security fixes up to the August
batch, libmilter 8.18.1, OpenSSL 3.5. Every citation of another program in
code, scripts and documents was re-read against the trixie sources
(dev/upstream; bookworm's kept in dev/upstream-bookworm) and updated;
development.md's cited-package table holds the trixie versions.
What the re-reading changed in behaviour:
- logtail: reject lines with sasl_method/sasl_username/sasl_sender
(smtpd_check.c:1019-1026); cleanup's "removed (canceled)" forgets a
port-25 id (cleanup_api.c:363-364).
- internal/postfix/retry.go reads postconf's stdout only: since 3.9 a
deprecated-parameter warning on stderr made one value too many and the
panel fell back to the compiled-in retry policy.
- logrotate-loop.sh: logrotate 3.22 exits 1 when it ignores a config;
the loop refuses on that output whatever the status.
- postfix-config.sh: cyrus_sasl_config_path set explicitly (bookworm's
07_sasl_config.diff is gone); maillog_file_permissions=0640; mynetworks
explicit; Dockerfile: SYNC_CHROOT= in /etc/default/postfix,
opendkim-tools dropped, openssl named, systemd-standalone-sysusers so
cron does not bring the whole of systemd.
- The selfpost group is 10998, outside the system range 100-999: in
trixie a package took 998 and the build failed (owner's decision:
a conflict-free id, the distribution's own ids untouched). The
entrypoint hands /data back by name when the user or the group differs.
Guide, backup refusal text, help (design commit 68ec8b2), e2e.
- smtpd_hide_client_session=yes on smtps and submission (owner's
decision): Received: names no client, TLS, login or protocol; port 25
keeps the full header. e2e checks both.
- test/upstream/opendkim-probe.sh makes keys with openssl genrsa.
Tests: on the server, make e2e exit 0 (674 s, the image built on trixie),
go vet + go test 27 packages ok. CHANGELOG [Unreleased], guide,
architecture.md, security.md, roadmap.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
111 lines
4.7 KiB
Bash
111 lines
4.7 KiB
Bash
#!/bin/sh
|
|
# Postfix start wrapper: solves the cold-start race where Postfix would try to
|
|
# reach the milter sockets before they are listening.
|
|
#
|
|
# It blocks until the milter sockets — OpenDKIM, the panel's sender check and
|
|
# journal-milter and, with the inbound relay on, its inbound journal milter —
|
|
# are present, then runs `postfix start-fg` and stays its parent. If they are
|
|
# not ready within the timeout it exits non-zero WITHOUT starting Postfix.
|
|
# supervisord counts that exit as one that came too quickly - the program's
|
|
# startsecs is the timeout plus ten seconds (build/entrypoint.sh) - so after
|
|
# startretries it is FATAL and crashexit takes the container down, instead of
|
|
# a relay running blind (supervisor 4.2.5, supervisor/process.py,
|
|
# Subprocess.finish(): an exit before startsecs is "Exited too quickly" and
|
|
# goes to BACKOFF; transition(): BACKOFF past startretries is FATAL;
|
|
# assumptions C-V6).
|
|
#
|
|
# This handles cold start only. Once Postfix runs, a milter that does not
|
|
# answer costs what its default_action says (build/postfix-config.sh): mail is
|
|
# deferred for OpenDKIM and the sender check, and passes the journal-milter.
|
|
set -eu
|
|
|
|
OPENDKIM_SOCK="${OPENDKIM_SOCKET:-/run/opendkim/opendkim.sock}"
|
|
JOURNAL_SOCK="${JOURNAL_MILTER_SOCKET:-/run/selfpost/journal.sock}"
|
|
SENDER_SOCK="${SENDER_CHECK_SOCKET:-/run/selfpost/sender.sock}"
|
|
TIMEOUT="${MILTER_WAIT_TIMEOUT:-30}"
|
|
INTERVAL=1
|
|
|
|
SOCKS="$OPENDKIM_SOCK $JOURNAL_SOCK $SENDER_SOCK"
|
|
if [ "${INBOUND_RELAY_ENABLE:-false}" = "true" ]; then
|
|
SOCKS="$SOCKS ${INBOUND_JOURNAL_MILTER_SOCKET:-/run/selfpost/inbound-journal.sock}"
|
|
fi
|
|
|
|
elapsed=0
|
|
for sock in $SOCKS; do
|
|
while [ ! -S "$sock" ]; do
|
|
if [ "$elapsed" -ge "$TIMEOUT" ]; then
|
|
echo "postfix-wrapper: timed out after ${TIMEOUT}s waiting for milter socket $sock" >&2
|
|
exit 1
|
|
fi
|
|
sleep "$INTERVAL"
|
|
elapsed=$((elapsed + INTERVAL))
|
|
done
|
|
echo "postfix-wrapper: milter socket ready: $sock"
|
|
done
|
|
|
|
echo "postfix-wrapper: milter sockets ready, starting postfix"
|
|
# Postfix 3.10.13: postfix(1) execs conf/postfix-script (src/postfix/postfix.c:669),
|
|
# whose "start-fg" (:200-210) execs master only as PID 1 and otherwise runs
|
|
# "master -s" as its child; master then makes itself a session leader
|
|
# (src/master/master.c:441, setsid()). A signal supervisord sends this
|
|
# program never reaches master
|
|
# (supervisor 4.2.5, supervisor/process.py, Subprocess.kill(): to the pid
|
|
# alone without stopasgroup, and master is not in its group anyway): before,
|
|
# a stop left master running - a restart of the program then found Postfix
|
|
# "already running", and a stop of the container cut Postfix off with
|
|
# SIGKILL (assumptions C-P42). So this shell stays, and on TERM or INT runs
|
|
# "postfix stop" (conf/postfix-script:237-253, "stop": TERM to master, then
|
|
# waits up to five seconds and kills its group; src/master/master_sig.c:205,
|
|
# master_sigdeath(): "terminating on signal 15"). Debian's redirect of
|
|
# "postfix start" to systemd (debian/patches/
|
|
# debian-re-run-startup-through-systemd.patch, conf/postfix-script:170-189)
|
|
# leaves start-fg alone and needs /run/systemd/system, which this container
|
|
# has not.
|
|
#
|
|
# Since Postfix 3.8 postfix(1) and postlog(1) - postfix-script's $INFO, $WARN
|
|
# and $FATAL - write their messages to stderr even when it is not a terminal
|
|
# (src/postfix/postfix.c:546, msg_vstream_init() no longer under isatty();
|
|
# RELEASE_NOTES-3.8:114-115, [Incompat 20230308]), besides maillog_file. So
|
|
# "starting the Postfix mail system", "stopping ..." and check-warn's
|
|
# warnings now reach the container's log through this program's stderr
|
|
# (build/supervisord.conf) as well as /data/log/mail.log; nothing reads them
|
|
# there but a person.
|
|
#
|
|
# "postfix start-fg" spends its first seconds in its checks before master
|
|
# runs; a stop asked then would find nothing to stop, so it is asked again
|
|
# until the child is gone. "master -t" exits 0, silently, while no master
|
|
# holds the lock (src/master/master.c:495-499, test_lock).
|
|
daemon_directory=$(postconf -h daemon_directory)
|
|
child=
|
|
stop_asked=
|
|
stop_postfix() {
|
|
if [ -z "$child" ]; then
|
|
# Between "&" and "child=$!": stopped right after the pid is known.
|
|
stop_asked=1
|
|
return
|
|
fi
|
|
trap '' TERM INT
|
|
while kill -0 "$child" 2>/dev/null; do
|
|
if "$daemon_directory/master" -t 2>/dev/null; then
|
|
sleep 1
|
|
else
|
|
postfix stop || true
|
|
fi
|
|
done
|
|
exit 0
|
|
}
|
|
trap stop_postfix TERM INT
|
|
postfix start-fg &
|
|
child=$!
|
|
if [ -n "$stop_asked" ]; then
|
|
stop_postfix
|
|
fi
|
|
# A trapped signal makes wait return at once, the trap is taken right after
|
|
# (POSIX, Shell Command Language, 2.11 Signals and Error Handling) and exits.
|
|
# Otherwise wait returns when Postfix ended on its own: its status is this
|
|
# program's, and supervisord restarts it.
|
|
status=0
|
|
wait "$child" || status=$?
|
|
echo "postfix-wrapper: postfix exited with status $status" >&2
|
|
exit "$status"
|