The ihasmail default was a pin that went stale within days, and ihasmail
keeps ten releases' images, so an old default would in time stop pulling.
With no --ihasmail-image the tool now pulls :latest before asking, reads the
version the image carries, confirms the dated tag is the same image, and
writes that tag into compose.yaml (or the digest, if there is no such tag).
Stalwart and Caddy stay pinned. A weekly end-to-end run against the newest
release, three hours after ihasmail publishes, is what keeps it safe.
scripts/build-release.sh builds reproducible linux/amd64 and linux/arm64
archives with SHA256SUMS; the release workflow runs it on a v* tag after
vet, tests and govulncheck, and publishes the release. The README now
covers what the tool is, what it does step by step, why each decision is
made, how to deploy and run a mail host, the security model, and
troubleshooting. -h exits 0.
jcoffey-dev