[Midnightbsd-cvs] [MidnightBSD/mports] 9a833b: mail/postfix: update to 3.11.7 (#1220)

[Lucas Holt]

  Branch: refs/heads/master
  Home:   https://github.com/MidnightBSD/mports
  Commit: 9a833b0c3a34343a2f13a1e36f4405c91fc53e3a
      https://github.com/MidnightBSD/mports/commit/9a833b0c3a34343a2f13a1e36f4405c91fc53e3a
  Author: Lucas Holt <luke at foolishgames.com>
  Date:   2026-09-11 (Fri, 11 Sep 2026)

  Changed paths:
    M mail/postfix/Makefile
    M mail/postfix/distinfo

  Log Message:
  -----------
  mail/postfix: update to 3.11.7 (#1220)

Update `mail/postfix` from 3.11.6 to 3.11.7.

Upstream announcement:
https://www.postfix.org/announcements/postfix-3.11.7.html

This is a security and bug-fix release. Notable fixes:

**SMTP smuggling** (both via `smtpd_proxy_filter`, which is disabled by
default)
- Smuggling remained possible when the after-filter SMTP server used the
default `smtpd_forbid_bare_newline_exclusions = $mynetworks` /
`smtpd_forbid_bare_newline = normalize` settings. Stray CR is now
removed from the proxy filter input stream.
- Smuggling was possible when the before-filter server added a
`Require-TLS-ESMTP: yes` header, which is on by default
(`requiretls_esmtp_header = yes`).

**Crashes / memory safety**
- Null pointer read in the SMTP server after MAIL FROM, RCPT TO, and
VRFY with a UTF8 address and no SMTPUTF8 parameter; reachable with
`strict_smtputf8 = yes`.
- Null-terminated heap over-read in smtpd while formatting a malformed
multiline response from a malicious Milter or attacker-in-the-middle.
- `postqueue` freed text before logging a fatal error message.

**Other**
- TLS session tickets are now stamped with their `master.cf` service
name, so one SMTP server no longer accepts tickets issued by another.
- `postmap`/`postalias` warn when creating a root-owned database in a
directory not owned by root; `postdrop` rejects null and line-break
characters in queue file envelope records.
- MySQL `tls_verify_cert = yes` had no effect with Oracle MySQL 8 and
later.
- `pipe(8)` no longer drops a command-line argument when it contains
`$user` and `$user` expands to an empty string.

## Testing

Verified on amd64 with the default flavor:

- `bmake makesum` — new distinfo; size (5293599) cross-checked against
an independent mirror (ftp.porcupine.org).
- `bmake patch` — all patches, including `extra-patch-blacklistd` and
`patch-src_tls_tls__server.c`, apply cleanly with no fuzz. The
tls_server patch is a LibreSSL `SSL_CTX_set_num_tickets` guard and is
unaffected by the upstream session-ticket change.
- `bmake` / `bmake fake` / `bmake package` — all succeed;
`postfix-3.11.7,1.mport` created.
- Staged file list diffed against the generated plist: no unpackaged
files. The `fake-qa` "missing from the plist" notices for
`etc/postfix/*` are a pre-existing artifact of the `%%PFETC%%` double
slash, not new gaps.
- `portlint -A` — no findings against the Makefile, distinfo, or plist.
The reported FATALs are all staging-tree artifacts (empty mtree
directories and upstream's own `*_README.html` docs, which postfix
legitimately installs).
- No `bmake test`: the port defines no test target (`TEST_DESC` at
Makefile:132 belongs to the `TEST` option, not a test target).

License re-verified against the 3.11.7 tarball: still dual EPL 2.0 / IPL
1.0, unchanged.

No shared library version change, so no dependent-port `PORTREVISION`
bumps are needed.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_017JRCQA17KgZSRk2vV96wbT

## Summary by Sourcery

Upgrade the Postfix mail server port to the 3.11.7 security and bug-fix
release.

Bug Fixes:
- Update Postfix to 3.11.7, incorporating upstream security and bug
fixes for SMTP smuggling, memory safety, TLS isolation, database
handling, and mail delivery behavior.

Build:
- Refresh the Postfix distribution checksum for version 3.11.7.

Signed-off-by: Lucas Holt <luke at foolishgames.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply at anthropic.com>



To unsubscribe from these emails, change your notification settings at https://github.com/MidnightBSD/mports/settings/notifications