rpms/dnsmasq
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Update DNSSEC trust anchors with 2024 key (38696)

Browse Source 
The code does not contain it, update only provided configuration file.

Resolves: RHEL-131886
This commit is contained in:
Petr Menšík 2026-08-26 19:25:25 +02:00
parent 0f2a592b77
commit f36ea513b8
2 changed files with 17 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
dnsmasq.spec
View File

@ -13,7 +13,7 @@
Name: dnsmasq
Version: 2.79
Release: 36%{?extraversion:.%{extraversion}}%{?dist}
Release: 37%{?extraversion:.%{extraversion}}%{?dist}
Summary: A lightweight DHCP/caching DNS server
License: GPLv2 or GPLv3
@ -21,6 +21,8 @@ URL: http://www.thekelleys.org.uk/dnsmasq/
Source0: http://www.thekelleys.org.uk/dnsmasq/%{?extrapath}%{name}-%{version}%{?extraversion}.tar.xz
Source1: %{name}.service
Source2: dnsmasq-systemd-sysusers.conf
# https://thekelleys.org.uk/gitweb-noai/?p=dnsmasq.git;a=blob_plain;f=trust-anchors.conf;hb=d6379cd923676dd21bc05ed8bd8fe4fb24337c98
Source6: trust-anchors.conf
# https://bugzilla.redhat.com/show_bug.cgi?id=1495409
Patch1: dnsmasq-2.77-underflow.patch
@ -241,7 +243,7 @@ install src/dnsmasq $RPM_BUILD_ROOT%{_sbindir}/dnsmasq
install dnsmasq.conf.example $RPM_BUILD_ROOT%{_sysconfdir}/dnsmasq.conf
install dbus/dnsmasq.conf $RPM_BUILD_ROOT%{_sysconfdir}/dbus-1/system.d/
install -m 644 man/dnsmasq.8 $RPM_BUILD_ROOT%{_mandir}/man8/
install -D trust-anchors.conf $RPM_BUILD_ROOT%{_datadir}/%{name}/trust-anchors.conf
install -D %{SOURCE6} $RPM_BUILD_ROOT%{_datadir}/%{name}/trust-anchors.conf
# utils sub package
mkdir -p $RPM_BUILD_ROOT%{_bindir} \
@ -297,6 +299,9 @@ install -Dpm 644 %{SOURCE2} %{buildroot}%{_sysusersdir}/dnsmasq.conf
%{_mandir}/man1/dhcp_*
%changelog
* Wed Aug 26 2026 Petr Menšík <pemensik@redhat.com> - 2.79-37
- Update DNSSEC trust anchors with 2024 key (38696) (RHEL-131886)
* Tue May 05 2026 Petr Menšík <pemensik@redhat.com> - 2.79-36
- Prevent overflow in extract_name function (CVE-2026-2291)
- Prevent DoS in DNSSEC validation (CVE-2026-4890)

10
trust-anchors.conf Normal file
View File

@ -0,0 +1,10 @@
# The root DNSSEC trust anchor, valid as at 18/07/2024
# Note that this is a DS record (i.e. a hash of the root Zone Signing Key)
# It was downloaded from https://data.iana.org/root-anchors/root-anchors.xml
trust-anchor=.,20326,8,2,E06D44B80B8F1D39A95C0B0D7C65D08458E880409BBC683457104237C7F8EC8D
trust-anchor=.,38696,8,2,683D2D0ACB8C9B712A1948B27F741219298D0A450D612C483AF444A4C0FB2B16