mixandClaude Opus 5.5
1c6e04b7d3
test / test (push) Canceled after 0s
The runtime base is debian:trixie-slim, the build stage golang:1.26-trixie:
Postfix 3.10.13 with upstream's 2026 security fixes up to the August
batch, libmilter 8.18.1, OpenSSL 3.5. Every citation of another program in
code, scripts and documents was re-read against the trixie sources
(dev/upstream; bookworm's kept in dev/upstream-bookworm) and updated;
development.md's cited-package table holds the trixie versions.
What the re-reading changed in behaviour:
- logtail: reject lines with sasl_method/sasl_username/sasl_sender
(smtpd_check.c:1019-1026); cleanup's "removed (canceled)" forgets a
port-25 id (cleanup_api.c:363-364).
- internal/postfix/retry.go reads postconf's stdout only: since 3.9 a
deprecated-parameter warning on stderr made one value too many and the
panel fell back to the compiled-in retry policy.
- logrotate-loop.sh: logrotate 3.22 exits 1 when it ignores a config;
the loop refuses on that output whatever the status.
- postfix-config.sh: cyrus_sasl_config_path set explicitly (bookworm's
07_sasl_config.diff is gone); maillog_file_permissions=0640; mynetworks
explicit; Dockerfile: SYNC_CHROOT= in /etc/default/postfix,
opendkim-tools dropped, openssl named, systemd-standalone-sysusers so
cron does not bring the whole of systemd.
- The selfpost group is 10998, outside the system range 100-999: in
trixie a package took 998 and the build failed (owner's decision:
a conflict-free id, the distribution's own ids untouched). The
entrypoint hands /data back by name when the user or the group differs.
Guide, backup refusal text, help (design commit 68ec8b2), e2e.
- smtpd_hide_client_session=yes on smtps and submission (owner's
decision): Received: names no client, TLS, login or protocol; port 25
keeps the full header. e2e checks both.
- test/upstream/opendkim-probe.sh makes keys with openssl genrsa.
Tests: on the server, make e2e exit 0 (674 s, the image built on trixie),
go vet + go test 27 packages ok. CHANGELOG [Unreleased], guide,
architecture.md, security.md, roadmap.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
100 lines
4.2 KiB
Bash
100 lines
4.2 KiB
Bash
#!/bin/sh
|
|
# Periodic logrotate for /data/log/mail.log. Rotation renames the file,
|
|
# recreates it (`create 0640 postfix selfpost`, matching a cold container
|
|
# start), then runs `postfix reload` (the same mechanism `postfix logrotate`
|
|
# uses): postlogd keeps writing to the renamed inode until reload, and the
|
|
# panel's log-tailer holds its own descriptor on that inode, so nothing written
|
|
# before the reload is lost. `create` (rather than `nocreate`) matters here
|
|
# beyond timing: a postlogd-triggered recreate lands the file at 0600 owned by
|
|
# postfix, which the unprivileged panel process cannot read — confirmed on a
|
|
# live container (date not recorded, Postfix 3.7.11), and so in the source:
|
|
# Postfix 3.10.13, src/util/logwriter.c:99, logwriter_open_or_die(), creates it
|
|
# with logwriter_perms, 0600 (:86) unless maillog_file_permissions says
|
|
# otherwise (Postfix 3.9 and later). build/postfix-config.sh now sets that to
|
|
# 0640, so a file postlogd makes is readable too; logrotate still creates it,
|
|
# so that the new log is there, with its mode and owner, at once.
|
|
# The reload: Postfix 3.10.13, conf/postfix-script:535-566, "logrotate" (mv,
|
|
# then kill -HUP master); master_conf.c:92, master_config() -> :147,
|
|
# master_restart_service() -> master_status_cleanup(), on which postlogd exits
|
|
# (src/master/dgram_server.c:241, dgram_server_abort(), :640 on
|
|
# MASTER_STATUS_FD), and the next postlogd opens the path anew
|
|
# (src/postlogd/postlogd.c:236, logwriter_open_or_die()).
|
|
#
|
|
# logrotate itself only rotates once the configured "daily" period has elapsed
|
|
# (tracked in its state file), so it is safe to invoke this more often than
|
|
# daily — polling merely bounds how late a legitimate rotation runs. The state
|
|
# file is beside the log, under /data, not at the default
|
|
# /var/lib/logrotate/status (logrotate 3.22.0-1: debian/rules:11,
|
|
# --with-state-file-path) in the container's own filesystem: a recreated
|
|
# container started without it, logrotate.c:456, newState(), records a log it
|
|
# has no state for as rotated today, and so a host that recreates the container
|
|
# daily - an .env change, an image bump - never rotated mail.log at all (audit
|
|
# 2026-10-12, M19). (logrotate 3.22.0, logrotate.8.in:74: "-s, --state
|
|
# statefile".) The directory is postfix:selfpost 2750 and logrotate runs as
|
|
# root.
|
|
set -eu
|
|
|
|
CONFIG=/etc/logrotate.d/mail
|
|
STATE=/data/log/.logrotate.status
|
|
INTERVAL="${LOGROTATE_INTERVAL_SECONDS:-21600}"
|
|
|
|
# logrotate refuses configs writable by group or others and goes on without
|
|
# them — fail here so supervisord reports the fault. (logrotate 3.22.0,
|
|
# config.c:1099, readConfigFile(): as root, mode & 0022 gives (:1160-1165)
|
|
# "Ignoring ... because it is writable by group or others." and returns 1; a
|
|
# config not owned by root is ignored the same way (:1168-1173). Since 3.22.0
|
|
# that makes logrotate's exit status 1 (logrotate.c:3278-3279 and :3301;
|
|
# ChangeLog.md, 3.22.0: "in case a configuration file was skipped due to
|
|
# unsafe permissions the exit status after rotattion will be `1` (#508)");
|
|
# 3.21.0 returned 0 there and exited 0. So the output is looked at whatever
|
|
# the status. "Potentially dangerous mode" is only a warning there
|
|
# (:1154-1157), for any mode & 07533 other than 0400 - this loop chooses to
|
|
# treat it as fatal too.)
|
|
logrotate_config_ok() {
|
|
mode=$(stat -c '%a' "$CONFIG")
|
|
mode=${mode#0}
|
|
grp=$(( (mode / 10) % 10 ))
|
|
oth=$(( mode % 10 ))
|
|
case $grp in 2|3|6|7) return 1 ;; esac
|
|
case $oth in 2|3|6|7) return 1 ;; esac
|
|
return 0
|
|
}
|
|
|
|
logrotate_config_fatal() {
|
|
echo "logrotate-loop: refusing to run: $CONFIG mode $(stat -c '%a' "$CONFIG") is writable by group or others" >&2
|
|
exit 1
|
|
}
|
|
|
|
if ! logrotate_config_ok; then
|
|
logrotate_config_fatal
|
|
fi
|
|
|
|
run_logrotate() {
|
|
status=0
|
|
out=$(logrotate -s "$STATE" "$CONFIG" 2>&1) || status=$?
|
|
case "$out" in
|
|
*Ignoring*|*Potentially\ dangerous\ mode*)
|
|
echo "$out" >&2
|
|
echo "logrotate-loop: refusing to run: logrotate did not take $CONFIG as it is (above)" >&2
|
|
exit 1
|
|
;;
|
|
esac
|
|
if [ "$status" -ne 0 ]; then
|
|
echo "$out" >&2
|
|
return 1
|
|
fi
|
|
return 0
|
|
}
|
|
|
|
while true; do
|
|
if ! logrotate_config_ok; then
|
|
logrotate_config_fatal
|
|
fi
|
|
if run_logrotate; then
|
|
:
|
|
else
|
|
echo "logrotate-loop: logrotate failed, will retry after ${INTERVAL}s" >&2
|
|
fi
|
|
sleep "${INTERVAL}"
|
|
done
|