rpms/unbound
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Install correct trust anchor source in Image Mode

Browse Source 
Cherry-pick from c10s did not contain proper creation of root key in
/etc/unbound. That place is considered authoritative in Image Mode when
/var/lib/unbound/root.key is missing. Create duplicate of the file in
/var/lib, because that will be often modified by unbound-anchor.service.
Copy in /etc should remain unmodified and typically updated only by
package updates.

Resolves: RHEL-127540
This commit is contained in:
Petr Menšík 2026-02-25 16:09:08 +01:00
parent c5baca84a1
commit ab1ad5eeaa
1 changed files with 7 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
unbound.spec
View File

@ -31,7 +31,7 @@
Summary: Validating, recursive, and caching DNS(SEC) resolver
Name: unbound
Version: 1.24.2
Release: 2%{?extra_version:.%{extra_version}}%{?dist}
Release: 3%{?extra_version:.%{extra_version}}%{?dist}
License: BSD
Url: https://nlnetlabs.nl/projects/unbound/
Source: https://nlnetlabs.nl/downloads/%{name}/%{name}-%{version}%{?extra_version}.tar.gz
@ -321,6 +321,8 @@ install -p -m 0644 %{SOURCE27} %{buildroot}%{_tmpfilesdir}/unbound-libs.conf
# install root - we keep a copy of the root key in old location,
# in case user has changed the configuration and we wouldn't update it there
install -p -m 0644 %{SOURCE5} %{buildroot}%{_sysconfdir}/unbound/
# Creates duplicate copy of the same file to improve backward compatibility
install -p -m 0644 %{SOURCE13} %{buildroot}%{_sysconfdir}/unbound/dnssec-root.key
install -p -m 0644 %{SOURCE13} %{buildroot}%{_sharedstatedir}/unbound/root.key
# local root zone fetch to separated configuration file
@ -499,6 +501,7 @@ popd
%{_unitdir}/unbound-anchor.service
%dir %attr(0755,unbound,unbound) %{_sharedstatedir}/%{name}
%attr(0644,unbound,unbound) %verify(not md5 mtime size) %config %{_sharedstatedir}/%{name}/root.key
%attr(0644,root,root) %config %{_sysconfdir}/%{name}/dnssec-root.key
# just left for backwards compat with user changed unbound.conf files - format is different!
%attr(0644,root,root) %config %{_sysconfdir}/%{name}/root.key
@ -506,6 +509,9 @@ popd
%{_prefix}/lib/dracut/modules.d/99unbound
%changelog
* Wed Feb 25 2026 Petr Menšík <pemensik@redhat.com> - 1.24.2-3
- Install correct trust anchor source in Image Mode (RHEL-127540)
* Mon Feb 09 2026 Petr Menšík <pemensik@redhat.com> - 1.24.2-2
- Switch TLS configuration to follow TLS sockets by crypto-policy again
(RHEL-147860)