Merge postfix from Debian Unstable for r-series

[Bryce Harrington]

Scheduled-For: ubuntu-25.11
Ubuntu: 3.10.2-1ubuntu2
Debian Unstable: 3.10.4-3

A new release of postfix is available for merging from Debian Unstable.

If it turns out this needs a sync rather than a merge, please change the tagging from ['needs-merge', 'upgrade-software-version'] to ['needs-sync', 'upgrade-software-version'], and (optionally) update the title as desired.

If this merge pulls in a new upstream version, also consider adding an entry to the r-series Release Notes: https://discourse.ubuntu.com/c/project/release/38

### New Debian Changes ###

postfix (3.10.4-3) unstable; urgency=medium

  * Revert "std23-bool.patch: gcc-15 support (#1097639)" (didn't work)
  * rules: specify -std=gnu17 for CC for now (actually Closes: #1097639)

 -- Michael Tokarev <email address hidden> Wed, 17 Sep 2025 12:59:25 +0300

postfix (3.10.4-2) unstable; urgency=medium

  * std23-bool.patch: gcc-15 support (Closes: #1097639)
  * configure-instance.in: fix typo which caused recreating
    cadir in chroot and excessive logging (Closes: #1115412)

 -- Michael Tokarev <email address hidden> Wed, 17 Sep 2025 12:43:42 +0300

postfix (3.10.4-1) unstable; urgency=medium

  * New upstream stable/bugfix version 3.10.4, with a handful of fixes
  * d/rules: use pkgconf for mongoc instead of hard-coding paths/libs

 -- Michael Tokarev <email address hidden> Tue, 19 Aug 2025 17:12:54 +0300

postfix (3.10.3-3) unstable; urgency=medium

  * configure-instance.in: fix typo
  * configure-instance.in: limit maxdepth=1 in /etc/ssl/certs dirs
  * configure-instance.in: use home-grown file copy procedure to sync chroot
    There are a few issues with using cp(1) to update files in chroot, -
    a file should be copied even if the source date is *less* than the
    target date (eg, if a package has been downgraded), which is not done
    by `cp -u` (#1110704), a file should be copied atomically (copy+rename,
    not truncate+copy), and care should be taken with extra attributes
    (#1100100). Use a simple perl-based script (using just perl-base)
    to update files instead, which fixes all this stuff.
    (Closes: #1100100, #1110704)

 -- Michael Tokarev <email address hidden> Wed, 13 Aug 2025 14:29:46 +0300

postfix (3.10.3-2) unstable; urgency=medium

  * d/changelog: fix wrongly formatted previous changelog entry (double email)
  * update Portuguese translation (Closes: #1107436)

 -- Michael Tokarev <email address hidden> Fri, 11 Jul 2025 00:50:43 +0300

postfix (3.10.3-1) unstable; urgency=medium

  [ Michael Tokarev ]
  * new upstream stable/bugfix release. From the release announcement:
    This release fixes defects that were introduced in Postfix 3.10.
    The defects exist only with the default configuration
    "tls_required_enable = yes".
  * Bugfix (defect introduced: Postfix-3.10, date 20250117): include
    the current TLS security level in the SMTP connection cache
    lookup key for lookups by next-hop destination, to avoid reusing
    the same SMTP connection when sending messages with and without
    a "TLS-Required: no" header. Likewise, include the current TLS
    security level in the TLS session lookup key, to avoid reusing
    the same TLS session info when sending messages with and without
    a "TLS-Required: no" header.
  * Bugfix (defect introduced: Postfix-3.10, date 20250117): the
    Postfix SMTP client attempted to look up TLSA records even with
    "TLS-Required: no". This could result in unnecessary failures.
    Fix by Viktor Dukhovni & Wietse.

 -- Michael Tokarev <email address hidden> Fri, 11 Jul 2025 00:26:40 +0300

### Old Ubuntu Delta ###

postfix (3.10.2-1ubuntu2) questing; urgency=medium

  * d/rules: set CFLAGS std=gnu17 to fix build errors on gcc15 (LP: #2125198)

 -- Jonas Jelten <email address hidden> Fri, 19 Sep 2025 15:14:55 +0200

postfix (3.10.2-1ubuntu1) questing; urgency=medium

  * Merge with Debian unstable (LP: #2110451). Remaining changes:
  * Dropped:
    - d/rules: ship /var/spool/postfix/dev (#1094571)
      [In 3.10.1-1]
  * Added changes:
    - d/rules, d/control: disable TLSRPT, since libtlsrpt is in Universe

 -- Andreas Hasenack <email address hidden> Tue, 10 Jun 2025 18:30:53 -0300

[Gianfranco Costamagna (costamagnagianfranco)]

I went ahead since it was entagling icu/postgresql and did the merge, looked trivial, fingers crossed