From ab1ad5eeaa8ff61338959d744655eb591466667e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Wed, 25 Feb 2026 16:09:08 +0100 Subject: [PATCH] Install correct trust anchor source in Image Mode Cherry-pick from c10s did not contain proper creation of root key in /etc/unbound. That place is considered authoritative in Image Mode when /var/lib/unbound/root.key is missing. Create duplicate of the file in /var/lib, because that will be often modified by unbound-anchor.service. Copy in /etc should remain unmodified and typically updated only by package updates. Resolves: RHEL-127540 --- unbound.spec | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/unbound.spec b/unbound.spec index 8d9e8d9..360ad8a 100644 --- a/unbound.spec +++ b/unbound.spec @@ -31,7 +31,7 @@ Summary: Validating, recursive, and caching DNS(SEC) resolver Name: unbound Version: 1.24.2 -Release: 2%{?extra_version:.%{extra_version}}%{?dist} +Release: 3%{?extra_version:.%{extra_version}}%{?dist} License: BSD Url: https://nlnetlabs.nl/projects/unbound/ Source: https://nlnetlabs.nl/downloads/%{name}/%{name}-%{version}%{?extra_version}.tar.gz @@ -321,6 +321,8 @@ install -p -m 0644 %{SOURCE27} %{buildroot}%{_tmpfilesdir}/unbound-libs.conf # install root - we keep a copy of the root key in old location, # in case user has changed the configuration and we wouldn't update it there install -p -m 0644 %{SOURCE5} %{buildroot}%{_sysconfdir}/unbound/ +# Creates duplicate copy of the same file to improve backward compatibility +install -p -m 0644 %{SOURCE13} %{buildroot}%{_sysconfdir}/unbound/dnssec-root.key install -p -m 0644 %{SOURCE13} %{buildroot}%{_sharedstatedir}/unbound/root.key # local root zone fetch to separated configuration file @@ -499,6 +501,7 @@ popd %{_unitdir}/unbound-anchor.service %dir %attr(0755,unbound,unbound) %{_sharedstatedir}/%{name} %attr(0644,unbound,unbound) %verify(not md5 mtime size) %config %{_sharedstatedir}/%{name}/root.key +%attr(0644,root,root) %config %{_sysconfdir}/%{name}/dnssec-root.key # just left for backwards compat with user changed unbound.conf files - format is different! %attr(0644,root,root) %config %{_sysconfdir}/%{name}/root.key @@ -506,6 +509,9 @@ popd %{_prefix}/lib/dracut/modules.d/99unbound %changelog +* Wed Feb 25 2026 Petr Menšík - 1.24.2-3 +- Install correct trust anchor source in Image Mode (RHEL-127540) + * Mon Feb 09 2026 Petr Menšík - 1.24.2-2 - Switch TLS configuration to follow TLS sockets by crypto-policy again (RHEL-147860)