-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Wed, 26 Nov 2025 11:12:30 +0300
Source: postfix
Architecture: source
Version: 3.10.6-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Postfix Team <team+postfix@tracker.debian.org>
Changed-By: Michael Tokarev <mjt@tls.msk.ru>
Changes:
postfix (3.10.6-1) unstable; urgency=medium
.
* new upstream stable release:
.
- Bugfix (defect introduced: Postfix 3.10, date: 20250117).
Symptom: warning messages that smtp_tls_wrappermode requires
"smtp_tls_security_level = encrypt".
Root cause: support for "TLS-Required: no" broke client-side
TLS wrappermode support, by downgrading a connection to TLS
security level 'may'.
The fix changes the downgrade level for wrappermode connections
to 'encrypt'. Rationale: by design, TLS can be optional only
for connections that use STARTTLS. The downgrade to unauthenticated
'encrypt' allows a sender to avoid an email delivery problem.
Problem reported by Joshua Tyler Cochran.
.
- New logging: the Postfix SMTP client will log a warning when
an MX hostname does not match STS policy MX patterns, with
"smtp_tls_enforce_sts_mx_patterns = yes" in Postfix, and with
TLSRPT support enabled in a TLS policy plugin. It will log a
successful match only when verbose logging is enabled.
.
- Bugfix (defect introduced: Postfix 3.10, date: 20240902): SMTP
client null pointer crash when an STS policy plugin sends no
policy_string or no mx_pattern attributes. This can happen only
during tests with a fake STS plugin.
.
- Bugfix (defect introduced: Postfix 2.9, date: 20120307): segfault
when a duplicate parameter name is given to "postconf -X" or
"postconf -#'.
.
- Documentation: removed incorrect text from the parameter
description for smtp_cname_overrides_servername. File:
proto/postconf.proto.
Checksums-Sha1:
e6b720377b09af49dc3e5080d0f0c47289252d8a 3259 postfix_3.10.6-1.dsc
12804c3ad9e0660a677179a54793ef32dd53667d 5039838 postfix_3.10.6.orig.tar.gz
13ec42e73af7c58e03f953eaed05104e21c4d470 220 postfix_3.10.6.orig.tar.gz.asc
ae9ab53c87237b59f07ab282a7c38aa450a6be50 200232 postfix_3.10.6-1.debian.tar.xz
5c8db5ec42fc5c822fdf683065d0898ddf74a1f4 6109 postfix_3.10.6-1_source.buildinfo
Checksums-Sha256:
dc20716d726d4472a12f000e189f609c0a6a2cdade581ce4476ce9d256af2a65 3259 postfix_3.10.6-1.dsc
71b383f57d4cb363201be8a301bcbafe304aadbe7f38ebde41cd5b952248465b 5039838 postfix_3.10.6.orig.tar.gz
5521b26d523c8a8155b2178f2c9111b9c377cd5a05d217269ad0d0a0d4b09da4 220 postfix_3.10.6.orig.tar.gz.asc
3b8b83d64e51b17a5608aa07a0803a2f67f7720d61056d8730b1d2ab8e223291 200232 postfix_3.10.6-1.debian.tar.xz
487719de9cd878823f55116f948ebfd8b57642521a4a3062704c7c467b285323 6109 postfix_3.10.6-1_source.buildinfo
Files:
f30ef36295003d6b0e3cc9922b6e6ef6 3259 mail optional postfix_3.10.6-1.dsc
6dc17ebb8b25df313433573155dd9b08 5039838 mail optional postfix_3.10.6.orig.tar.gz
07e2abc7e025531afd35ad6f63b96bb8 220 mail optional postfix_3.10.6.orig.tar.gz.asc
bd63ac8c9983ecfd93cd4b5da779e043 200232 mail optional postfix_3.10.6-1.debian.tar.xz
42974c877ef31b5dd8ac305562ef5577 6109 mail optional postfix_3.10.6-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
wsG7BAEBCgBvBYJpJrefCRCCqkokOx6UeEcUAAAAAAAeACBzYWx0QG5vdGF0aW9u
cy5zZXF1b2lhLXBncC5vcmd+MxkT4rwqlILvrl7E00n9ocbyn+6k6fBqSJkFk/KB
cBYhBGSqKrUx1WkDNmv++YKqSiQ7HpR4AABy5Q/9GpG3pFTGOChTsYoU/RBCoC4F
f6QCSzaR+Uu/aNtKWdFLroj3dJyFa6v4rInhw3IyAOzgJe1y/DTveGpqWL3F80qY
6ntm+XFayakudrn0f8PoVONhgI9fzAqxOb7MFPUz5AFf/8ErtYZLc1rq6R3yOwD0
HAIlIR3srdhXLcVrWpIHDki+kAY5ZBrnEdpZW1FCDIklNZiwYwAJdy/GJKn6h6A+
dfgvzgqHSiCYWliwVsIlLhNxGBa1oOJfJELa8lpQ8+NbAuW5bpz/wX6IQnaQl/Iz
1axgCrx8s3OvIrqik4B3Gug40Jpz5c7Xzk9C+xs1QKVf/0kziYUv5zS3EmnUrQCE
0vmytddNX5FfwkHXF0W7MHtnEP5p/l1j0yLIbKrehmt01Man8r/vMM4DWH/MHMGj
Iqb64/U448o5cUF205H6lMS0N9WeRyBQmWN2QUJ0h8pfHlXS+iDLOHOXzhUnCxxf
VwDGvCBshc+WMTAi9N7D0X3U87/tZ50wl7N+/x4GbWBU4XzZVywlDNlygXwf9tRD
AG4vMCp3tdko7cVl0d5Y3Nx2uRGLFONCnxIWvRERnCcUYH8g1HUfhAVabECFYIN8
Bz0ZoZiaAY00kXJNUDjDVY1Z4mIrOLL5sFjcBumdGgxYu3PdzK2E927I45nZxYLn
r5uZeuWEH0EY4NCyRpg=
=Ek+8
-----END PGP SIGNATURE-----
