Dear Maintainer,
thanks for maintaining the postfix package!
* What led up to the situation?
Recent Debian upgrade in testing after the release of trixie.
* What exactly did you do (or not do) that was effective (or
ineffective)?
Upgraded testing and rebooted after that.
* What was the outcome of this action?
postfix now writes a message about every certificate (and a couple of
other files) it replicates during startup from /etc to /var/spool/postfix,
like this:
Sep 15 10:50:51 host01 postfix[27587]: updating /etc/host.conf => /var/spool/postfix//etc/host.conf
Sep 15 10:50:51 host01 postfix[27587]: updating /etc/nsswitch.conf => /var/spool/postfix//etc/nsswitch.conf
Sep 15 10:50:51 host01 postfix[27745]: updating /etc/ssl/certs/6a9bdba3.0 => /var/spool/postfix//etc/ssl/certs/6a9bdba3.0
All in all, that amounts to some 150 lines per reboot:
[~]$ journalctl --boot | grep -c 'postfix.*updating.*=>'
151
* What outcome did you expect instead?
No such messages.
* Other information
It might very well be that postfix is not the culprit here -- maybe the
systemd/tmpfiles definitions have changed to "better" clean up /var/spool.
Ah! After downloading the sources it turned out to be the Debian-specific
syncfiles.pl script (below /usr/lib/postfix/syncfiles.pl) which is
responsible for these messages:
30 die "$snm: not a regular file\n"
31 unless S_ISREG($sst[2]);
32
33 print "updating $snm => $dnm\n";
34
35 my $dtnm = "$dnm.tmp";
36 unlink "$dtnm";
And that script got added rather recently, if I understand the git history
on salsa.debian.org correctly. So most likely the addition of that
syncfiles.pl *is* the cuplrit.
Probably that print statement above could be simply removed?
Control: tag -1 + moreinfo This should happen just once when the mail system is first started after an update of the system. On subsequent (re)start, this shouldn't happen anymore, as the files are up to date. Are you saying you see this logging every time you (re)start postfix? Thanks, /mjt
Control: tag -1 - moreinfo I haven't yet tried restarting postfix, but I can see this logging for all *certificate files* at every reboot, as can be seen in the following example. Non-certificate files are indeed only mentioned once in the journal. [~]$ journalctl -o short --since 2025-09-15 | grep updating | egrep '\.conf|6a9bdba3' Sep 15 10:50:51 host01 postfix[27587]: updating /etc/host.conf => /var/spool/postfix//etc/host.conf Sep 15 10:50:51 host01 postfix[27587]: updating /etc/nsswitch.conf => /var/spool/postfix//etc/nsswitch.conf Sep 15 10:50:51 host01 postfix[27745]: updating /etc/ssl/certs/6a9bdba3.0 => /var/spool/postfix//etc/ssl/certs/6a9bdba3.0 Sep 15 11:13:51 host01 postfix[1794]: updating /etc/ssl/certs/6a9bdba3.0 => /var/spool/postfix//etc/ssl/certs/6a9bdba3.0 Sep 15 11:21:42 host01 postfix[1796]: updating /etc/ssl/certs/6a9bdba3.0 => /var/spool/postfix//etc/ssl/certs/6a9bdba3.0 Sep 16 10:41:03 host01 postfix[1861]: updating /etc/ssl/certs/6a9bdba3.0 => /var/spool/postfix//etc/ssl/certs/6a9bdba3.0 Sep 16 18:01:55 host01 postfix[1973]: updating /etc/ssl/certs/6a9bdba3.0 => /var/spool/postfix//etc/ssl/certs/6a9bdba3.0 I tried stat(1)'ing the files below /etc/ssl/certs and /var/spool/postfix/etc/ssl/certs, they have both identical size and mtime when the system is running. If you don't have any other idea, I could try instrumenting the syncfiles.pl script and see why it copies the certificates during every reboot ... Thanks.
On 16.09.2025 23:20, Farblos wrote: .. Restarting system does restart postfix too. Does the same updating happen when you restart just postfix, not whole system? This definitely should not happen - this is why this script does what it does. Do you have a tmpfs mounted somewhere in /var/spool/postfix/* maybe, or some symlinks in there pointing to a tmpfs? Try disabling postfix startup temporarily (systemctl disable postfix), and rebooting, - does /var/spool/postfix/etc have files before the postfix startup procedure copies them? The above should be enough already, I guess. It looks like something changes (removes?) these files during boot. The whole procedure is written to show when files actually needs to be updated, and this should only happen when the source files changes, which definitely does not happen often. Thanks, /mjt
Sorry for disregarding almost all your proposals (but thanks for
them), but I think I found the culprit. It is not syncfiles.pl,
but rather the calling configure-instance.sh, where we have:
find . -mindepth 1 -maxdepth 1 \( \
\( \( -name '[0-9a-f]*[0-9a-f].[0-9]' -o -name ca-certificates.crt \) -type f -print \) \
-o -delete \
\) | while read file; do
# ..and remove files which don't exist in source anymore
[ -f "$caddr/$file" ] || rm -f "$file"
# TYPO-ALERT: ^^^^^^ shouldn't this be $cad*i*r?!
done
Since unset "$caddr" expands to the empty string, the "-f" test
always fails and all certificates get removed in the destination
prior to syncfiles.pl being called.
(And yes, I can observe the copying also during a restart of
postfix in the running system. Which made me dig deeper ...)
WDYT?
Control: tag -1 confirmed pending Wow. You're exactly to the point. And this explains why I can't see the prob locally - I double- and triple-verified the syncfiles.pl script, but not the configure-instance.sh one. And on my system this does not happen because postfix is not configured to use ca-certificates, so this part is being skipped. Wow. Thank you very much for your patience and your excellent detective work! /mjt
We believe that the bug you reported is fixed in the latest version of
postfix, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to 1115412@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Michael Tokarev <mjt@tls.msk.ru> (supplier of updated postfix package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Wed, 17 Sep 2025 12:43:42 +0300
Source: postfix
Architecture: source
Version: 3.10.4-2
Distribution: unstable
Urgency: medium
Maintainer: Debian Postfix Team <team+postfix@tracker.debian.org>
Changed-By: Michael Tokarev <mjt@tls.msk.ru>
Closes: 1097639 1115412
Changes:
postfix (3.10.4-2) unstable; urgency=medium
.
* std23-bool.patch: gcc-15 support (Closes: #1097639)
* configure-instance.in: fix typo which caused recreating
cadir in chroot and excessive logging (Closes: #1115412)
Checksums-Sha1:
d70e61803ad03a68a324eb35c2fe3d27b11161de 3259 postfix_3.10.4-2.dsc
fbf9074618722d7c9a32b24fcbd7abb80ee9b4ec 199000 postfix_3.10.4-2.debian.tar.xz
214f4d659d61563676cb9c1004324e68a3e5db78 6085 postfix_3.10.4-2_source.buildinfo
Checksums-Sha256:
1b71421a89fd164b3ed6b1925809397c8d83085b35dbdfb644efa7f3b521d9a8 3259 postfix_3.10.4-2.dsc
665e7b9d39fa0e01daff50661c16988ed67f17e282e4228d0ad5c4c05174264f 199000 postfix_3.10.4-2.debian.tar.xz
38a5b113c7aab65c2579575e6c1423c0ccefef8751237cdccb812007261570c1 6085 postfix_3.10.4-2_source.buildinfo
Files:
c04ef4ea6a08ddf1bae003b1c82b9343 3259 mail optional postfix_3.10.4-2.dsc
d7dda8aaed55bd477517d7a83d513831 199000 mail optional postfix_3.10.4-2.debian.tar.xz
4fc81bc6c8958ae1c965b6c1137e27e5 6085 mail optional postfix_3.10.4-2_source.buildinfo
-----BEGIN PGP SIGNATURE-----
wsG7BAEBCgBvBYJoyoMKCRCCqkokOx6UeEcUAAAAAAAeACBzYWx0QG5vdGF0aW9u
cy5zZXF1b2lhLXBncC5vcmcc74epQnt6shyRzcP2VPeYPsOW95BphBlySOOZyyta
1hYhBGSqKrUx1WkDNmv++YKqSiQ7HpR4AADDkBAAsAiQLes7aDNemiCmF6VQ6rmp
sJfWDSZFXxmQY4Xaz3vANXGByrjmTPgae+3oMdbb3oBMd2DiU7FR67ILOIoq8GZq
5asQNXO0gYEd/7gqPESJonD8pEB24DWYGYIGnem7vb58YUsVz8+59e4kDwAeFUME
Uz39oiiCDKxNLH4Byz+z5TMenBadO2KPuYVrHReqrEoK1WO9yJWsWVkLXizSGCIS
A4LfvqafAPxxnqGjthKIrAaxq/TrxbDygq2H1Fl3PD+1zjgJw+llGvjk33EiTAYN
gnrnXqDFkzDn3Skgls3XsYBfIwiq0iI8PePCv+Cuxxi9CKil9QfBOMEdTM1XpTB6
qggSK5uZcwybm+Nk1YTtIMWZ6C2uT5B28DH4P0L38Ge5TVLchDszgy1LNdgx8/ef
l0GCOtqWFZzXm1Wew74TesXZVLoM6sGpyKy8HY1082vEy7ZrSTYTGMYB4shlTlGD
zqd+OiOVhUeQfZEtdB8FYeen9lWPIU/x5MM41Y9sfWj5zfm2L2vPwH0IFIKkQbFW
MIFPAnAwXfK/50L+NlonPHHLfmqzmCieVfHr8RbFRGUHTJu8c+m7PSXGKAvPeSW0
AgI1PwrtYQi5JxYYQiRomkaYpWR40FSAR5rpv8SeCTNi6hOveLIKJ8pfAZCnQ0YE
Kz1Nth8OefiRbB2UQgo=
=Gmg4
-----END PGP SIGNATURE-----