diff --git a/Yorgos.asc b/Yorgos.asc deleted file mode 100644 index e18ec55..0000000 --- a/Yorgos.asc +++ /dev/null @@ -1,128 +0,0 @@ ------BEGIN PGP PUBLIC KEY BLOCK----- - -mQINBFfYHeYBEAC/8SdeXNspt9ZIoZRSL9juNLHA17TXcHdKSthgWBtwwWZbUPq8 -SJr7Y+hr6jMCDKY9800QzLF0nLkyXnZgaBcvR0rRbCT/qvALJ0fpfjcotapZ1hBv -omb9s8Bo28uKn8tbTMXYNsElUae4Ch/CrU1vfe50YoyQgLR8UBa15gV+2RmC+6jI -qxDYS8sylWlDn6Qim+77feLlObPnNdzgfWGZo14eJByTsz0qrh8aS/BS1FAsnEQ6 -W6AqukhpuKuWvoAUXKjfguXQolxeexubmKaLcGOTvecw+cbh/a5SPHRtRVr9qTxp -elk6UEpakY5K9UtZkrG55VWih/4KqY9bNyhJBtpAk1fXA+mYfx5BcFpECYdU9kz4 -UgV5jK0HYRHQTLC91PPVQgH86we+Aae6TaJneCLEIzBK36TgAP8RKrvFfPUym5OP -YbWOom27QTKfRVcyxPKglJxrTSWixnKWS/pqxNY8hF9Ne4crRAF4wX2yBVbGnjNr -S9TpYmjMwURbuYm+rWZk/8w5OJG60V3wax56c0jn/42O3Y2hzQ+PbOv2M4UuuajS -2YL3/KUsRLBapUpPQjzChwzdr/vzFEhk9XxK2VGMN+dh2HjYwDFendc5csyt/cVr -g3LssVS2bKy5g3IhrzCKAk0Sky4S5t/mcN+lWztNvCijuLz58GCym5GwJQARAQAB -tCtZb3Jnb3MgVGhlc3NhbG9uaWtlZnMgPHlvcmdvc0BubG5ldGxhYnMubmw+iQJX -BBMBCABBAhsjBQsJCAcCBhUICQoLAgQWAgMBAh4BAheAAhkBFiEElI60IyLF0At5 -NA9dz/M0TZCHpJAFAmbz0CwFCRD85cYACgkQz/M0TZCHpJBVnhAAkcd79Twxj/tt -C4q2Xpq75+Ew6YR9gLqYiV5vEd6fu0oyhuVoUlfTkjH4ALIoGIKaO9yAVUXsrGrs -n1aJPo1Mw3q6mIwtQOxXz/W44LuFzcvZkHtCYX4YyLrUHXZPvl+r4eYkTOcyyQMU -BmbuvWhufv8MBilvWltQLxfLlgihbfuIrxqjAYDhqCffpgUiZyCut2rrenIgeh1f -DvC+GjZ3cfb1UsIpzm19yr4NCiTHkLkCOAAcAUFwWWeO/jfUsSvFQEHUnYNRREzI -Lth9NlKwPtsOVi+wcNnWQtFQb11BMr407xBib7hLSIFiqvOiYgQABjZdWN+snCRP -ZZSruigjE9ateOloJwmBqrSJLAywxvDE0ivqfSj51W5eJc/JLSXvjrOuW28dJCr8 -RV9PjC9X7zuTiFLzV8SVH71Z43Rix8n7AOp3wgRe3SygEyQXPj4qbm5HHVsx9GEA -zn495L99dJ4wZgjkbEsGhzwUx7N9FHEGS/sz3LiEq+ZYckR6gzTMMrQJgbsS9lnK -9xlXsp37uIYvx9W9JZXtS+AZhw0q3osMYBF68HPX8B9GBYlkQWmWSIMfzRYcD2n1 -5+XsfERK4mxcTWl2sCYpt8Sy3tADj9nQDabAlGUd/hlFS1dvDVQjGh6ER5S0nZjY -nmRsLl8nOTKhb2xY+2p1sDjxxQYJJQe0K0dlb3JnZSBUaGVzc2Fsb25pa2VmcyA8 -Z2VvcmdlQG5sbmV0bGFicy5ubD6JAlQEEwEIAD4CGyMFCwkIBwIGFQgJCgsCBBYC -AwECHgECF4AWIQSUjrQjIsXQC3k0D13P8zRNkIekkAUCZvPQPQUJEPzlxgAKCRDP -8zRNkIekkFfCEACheY1yr2Z+LPjm/Nd2eA4CFFO7nUQHI+a6lYBd57txrRuIicuG -pGjOhnvcioRwICiKNLJD3YTU+WOd+sbO7BXH2sw2KdU9NK1ojKX/SQiTg6upfJsu -gbgar2oPvR88B7oSiuonZnhEf72HfWKDSBXHpi6KC6S3JZ+o50NB3GBpwUL1lfKW -ovymYbN6tYQfqw/+AP5jUUNpkclC0RbcW69rpvrHHqeQV1AVKkm/jNQpWLKYTGF7 -bbdLkgMh3rHp8gmF0/GuK+oyL7xD+TEXfr3iqlDIVuxbxDN8xTti1RrERU/MWQar -qOSFZcr4t+nlwThJidDLF/u3h0Ymrjz92VTfCgELIwCKxGX7jAyLZHzuWAp+0Pr/ -yuHodbweGNcGVoXmIpK93/WZcfFlBcyQLECVcijmxd7Euk0xDk76RQpuuL5VOWqn -aZcf2uNfppwKFZJjcXwK+EQbwN7+RFNvLrwoRn/1xM57T5AYBAgSvKb6h0G5KwW6 -tJfJdSu1MHfCZS1hH1Gr4+UG+VbLCVmQ9N/lUs0bcD7pK+bA1W0YnsIVuaQ+YZUh -KrJoCUF0kVDtW9ETZkp0iVBm1Q9xgTGaxUTVmctOyAbdCLyHNra4fo1BAdGlu+IP -qAcktaBUKFxWxRxf9O5kGihce9anK8CJ/TCnQ7wSvyYrlAoBoQaS78VzYYkBHAQS -AQIABgUCV9kUOAAKCRAwkY2CdXJCIju1B/oCvf1kWYndNeLS6U2O6DtFAL2Ia5tY -Zukcyqb1hkYcrBiMZbQN94gX5a+6Q4pdd2n241r1ZuSWdwUhRUbF4mvbZMVsavnk -cvrRGviVIUXf71W0O/IsmQ9oN0Finhpf14Y4z/xqF8DpvJdkWc6X5g+RJuko6q2w -B7x2UfSyF4USp47LSmUQnC59IF8jzaElgBha3gwEuXL3d2qBepoV/e9RiXJClUAT -+O7qdxzDq1eiZ+NXUjDCmrkuWjHLAZAv0jx1KUTCQ2no62UM95igtJ+Kn56Lc2+J -CqFJztaZeX8CgXXryxNpsyhZJ33dIoLCT03K25wrV5Y+eag05slQ9sC3iQI9BBMB -CAAnBQJX2RCwAhsjBQkFo5qABQsJCAcCBhUICQoLAgQWAgMBAh4BAheAAAoJEM/z -NE2Qh6SQ3JUP/2G3bRNObS7zsfN3rjkbjLxaDOwNggRdbeXM5rHDVEG9SWesCGaI -vyQdkSGQoIaKUgNv7Yp8O8pEnD4IwdhNSaXVIB3pBtdOD0UM1wuxRpfqJOUxZEoW -T2Jr31Tg2qepp6nT7UmdiF7uCBDy8Jm6k6Q+6UT58cPaesRQdSPi6Go7ho2/xVvK -Ve9ufSTSTdG5+7bJDu6Iv7sydKUEG4jPDqo+jjVLn1X6Rfp+E4JAvOvFrSJHW5sa -A332xV40GeV+aM1ndP7dPkz8+AGB3QD7JF2DLcqvLo0TYOvjnlOGYcNp8gzp23g9 -KFwe2sdbdtVpuWaJUSpXXiUZnFzrrVxDNiEBjqsPa5ysOxzJ+1gUbcrIjUeNeAFh -us4XL+IidPATnhTIX3X/uPRB87KaTaA8XUqsuSd2DM9mLxdHKC9Jf8D1t+ywYrek -Cp+K80vCtFPWBM4+w8nGugTNKJEGIXZDGFOF/c7r6xKkaOYK0Y+IGJawlV5LaADl -BmQpPk0ubYclwb07FcegaHSxxIqUo/kbyt1YV5mU+QVymZ+xyvIBrnW8hBuNWRvU -5acnIZibCERayo8ZuI+r/X3bLHfDx0oh2h+cL3utNZUqmgZNR0Di8P+x0hUYsYPO -TJaDBSgvxUtY0Ci+OWX38kffGGvhW3CM8V6skdVc8cp7Db7gxase4BxxtC5HZW9y -Z2UgVGhlc3NhbG9uaWtlZnMgPGdlb3JnZUBvcGVubmV0bGFicy5jb20+iQJUBBMB -CAA+AhsjBQsJCAcCBhUICQoLAgQWAgMBAh4BAheAFiEElI60IyLF0At5NA9dz/M0 -TZCHpJAFAmbz0D0FCRD85cYACgkQz/M0TZCHpJBnFw/8CRLGJnNAP43mBniIP5R1 -/10i4xG5s1Ka/y5C3aRgZUNaGMPLF8VmrC26HTPNhmduhn3j9gnBuSHgRAJUWs2K -o1q0A2/O5fFJvqPyEUl30gG8qkzFl5UGRUr7VNtBa6VpI7g78d3P4/H8THB0tYZ3 -GZv980QXwTE11aXjvPQu4e8sMOR1OVEEH+6hW1T0SvEKAMV1BHwuZAmC6HTfx5e7 -iGNWu/dwJsmwzqcAkuTTSqlmzZdIjZWJDL8pfnschkVilC3pEpEk5ExSkt/onOD2 -WCAKJUiPR6gRI2H6fE0PF8iG9isisvNhQ3MrWUIKS+1WOotoG7Bu7ob46viJKQuN -9t7KBqjdftjJHjmVop3mfX0UUEDPjkZXK5R/aUspXi4IGdM+9JijqxveicQegOhM -LcE8039Z0AaXn9IA0kQB05A4a+CEnoPL7qe+fIBJM5hZDrpMe4fAAGxiQzbRpdkZ -CrXmT+CRkhc/BvUJ5yoE1q++9Fw9eyMbPOak6GLckCIPy+Mqi4z+ZXNCtcPs3Qbc -/7AY8qyswRsD2t5bbe4g+fLEt9IsN3UvKFUKnQ88jcn9Zmps69msMDm9jEj/qo+j -QCriLLu8E1ZwhedNVOQN89w4Zww/BUyEnL4hng8Tw+RTV8Jtq5EvAleW5sZsnTzA -zn1ysZUyO/Pu7Br2jnGRAQyJARwEEgECAAYFAlfZFDwACgkQMJGNgnVyQiIHjAf/ -VrPMgIRjRTYi4cxOr5ewaim1hgJZO1oCJoMopwIvpZ2kAUqL/uPMT3wREe5bi79H -jXYcaX+RbrV4ZdzaajDUFCj867KGErxqtRkANJ1eNLcQmVwGNoFeTQbgEOBfKq1t -hRfMqHF3fxCPJp4z4U3kBPUpIQPERjgUdkH8fxZ34Omo1SLO1b0dVqsneezccBVv -Hj7gVoaWw65Ov7vngwNCKH3fjOkcoINTH/nEw4WWh6UV5ZN49GRqa6oWdUJMZbgB -w8z357RLN6YLe7KMh4oGpUIvfH6Vfq6CIb6s9pfgjAvq8O7p9n0/0FG77j84MuGw -fdhq8eSazO/j9LUCBM+8k4kCPQQTAQgAJwUCV9kQiwIbIwUJBaOagAULCQgHAgYV -CAkKCwIEFgIDAQIeAQIXgAAKCRDP8zRNkIekkN9pD/wI8JAyjJEIjUJNLRuARDDv -pJrQjAo/02naPcGs4yyUd7yRkhzVKLFLvif8XICxxLWk6FdT0PJeKGTvRoe2+Rje -c14rO30niRymWkBi36iDW46Dpt7Jx+LUDhUMYPL+woKSoHmbBGWLSYXKxaD8F93A -nVs97nP4PWpspv2BFiuwKGsSsOyyQPPvr7jCin3H5oPH9qDnIV0KonAYbzzEKod5 -t0Rgzo/nWXZBFXWC5xvKeghwkdT++gYS/ThvQY2ua6A1XRE8BntyldD081NPi3NO -dWa9m8ufFOJsEEiWcpdT+EWoDw5JyGAR7U3IOVl3BTo7shdcYEvRVrDMBpac+ItG -WvogUv7alBdHWi48amvZE06RI/nDJ/rxj13S/4POgMHU++aQI5a1G5H3jBu4cehH -4iT1UKmozfzVEfcHb2dsaKnnuFzQxmol0lZu1ETyof+Lxvs+wErN0QR+VDNweJEJ -PMXiEcjASdLtrEKgFSP2B5yGGzt93C+HbD+VQOU359aAnvVjbTAVz8izuMphd6Bz -Ix1q//q2VmxqjjT3Iv30hBRX02x2M8gsP/e49XWEll7stkMtbYhBU0sHQ2CqzLGh -gJN3ecpi2sKWVqN8HUZOwJFj6f9ZX76YSM23wIugHfscMAVJUXvBrbd151WIshOf -FFPo62sYGt+SEMXWeRcHjbQuWW9yZ29zIFRoZXNzYWxvbmlrZWZzIDx5b3Jnb3NA -b3Blbm5ldGxhYnMuY29tPokCVAQTAQgAPgIbIwULCQgHAgYVCAkKCwIEFgIDAQIe -AQIXgBYhBJSOtCMixdALeTQPXc/zNE2Qh6SQBQJm89A9BQkQ/OXGAAoJEM/zNE2Q -h6SQOf4QAIp5fEn+vVOqDuLrv8Li61UDVPE3v5b9ocPR7OMENeFpRH7K2p8xFkAM -f6JeS2ehbIjyUS8iGc+mZOalvZynJdOiHtys5r4lZanm1Rl+mWXb+nHGE/Oi4gQ3 -aEF/AwolbKi9oNXAiCtA3hmaI6FYWtAh5XOnyMG140dhlXMWzvN1ZAWXWioS33Fp -n9Z7xOsyG2Bmky69JjUQPD119noD4pEFtCipciiACVNdHGfI8QDT/8pMAxv/Q7tW -+7gyFztT1XvKONWyCfHjf1x60JQNPPM31x3xUVRz/sK+GyLq6VLiydvSZeUX3CzM -4bHixKKkSyvsX+bc9K/iLrXwZFhRdrRbpVQFpsdxv48mN5WsDlpN17KgMCyNiMDV -0VagYjZC5AurOo2mmS7PKAYGILaq3YwQ3nXYiuWfdXVW6EXtw/vdFOjFU6ppbaA3 -1+xyMDOLSGLr7f+gdZvlEc+5MX1F3mHpmuKN7clUju/HEOdVq1Bbla7BplPgqCaH -ZYCg/VHNt7ue7MYeEgTJ8OGgUDRNPa3PdU3YHRCuwJH1UzinD39K8R9/g9qiGJbC -87//1FGZp9lhIE5tja6F5pJ5GwJK9zC0iGj2NrwBvTKhuyF6W3ZQc2voYQn+gIq4 -sfbned7qpvpjLcMgIv/y82iVm2EtKtKYl982aA9S53pHqjV27kieuQINBFfYHeYB -EAC2h9yjSe2SgtcB0H+E0ndaewaZaQCE7q+RO43dotGH9eFnVwE4/ftcK1SN42ih -lF5OnTaKPyXvgQ6U8W8VB8eLjeTwA/dSXuJX7kJpEK8saPqJP6zTUmPqp/GSzS6Y -rhKLfpFn4chmywpDFcGNMz0sYXiJgPqKL7W0KuG+ziPToAeWl8ckeXyl77/lHVhW -YylaQJEASklqCViPXSp9vI7/57UEm4MQPXwsDBOwuVVqcSu3ZM5MtY9XlbVPNCYm -ZIMqmh8HgYwbiq9dTfJi+6v17+uDQGZewWK/WwFM+9dDx7YkTeOBiUduYtJPW64N -W/RJ7pskbLAy+OZApTZWg0cISN6GOmPN3F0AiWzUjvSMREHhFHyxj4Y15vuDOFvP -GFxr4xBiyMX1JLCKK6OFnyPfoJ9v/o3UgrQgLrfXCmKdvkwBCgJvN3Fsxzha6Dtf -6RcZ02fr7SCZZhdBrlrflvC1uWZ0g3A87ss7h4Iw3njlO3aX6Bo9R4VOLUkiRKi4 -hmQBxPvXxI2ERmKRomo6lrMaDMzIjD4APSM1vUfZguzQxVYpM8lwy1COeqxsj5p+ -LH6f/EU+4dXZwooJ1uanBOvG2ntnz8SErE+e7wNYE4a/fb8xYM4j7p6qYtnNZPb8 -sj8bvx8iWXp4A1csVetyVSchBhTVQhhNos6ouYpc4ibrYwARAQABiQI8BBgBCAAm -AhsMFiEElI60IyLF0At5NA9dz/M0TZCHpJAFAmbz0dUFCRD8528ACgkQz/M0TZCH -pJA7hg/7Bh0jb7nrp2EuU4BWK55VG+3zbrye/NdDy6eo3sVVOOO1r+jBMoJK3m1A -GWUx40ogZjRn8GMtJfxkL6wsep2P775smm7x1TH6s2dgreTj9J66gitKEgxF0tjo -JztmGJ8YKSGE4wKi37KvvSqCm1ecA8akBzJVo0B8/GtXpg+y/q3/KSY1ujW7Ihu3 -60JXT1FRXOiYfrzUKIBm8/UVnv7guPudaJf0eU4btoy4Ywzn1UXyi8BdxPIQrQDR -tt69ffcjX8BIEloK7FURLre/LhbVxlssdWYIEFQhIlb+nghZlUbWHf0Ue3L0SFFS -xV5otzQL2WjJKtCnTpSopSUmwYyT7wyAL1RokOemXL47WOfiLjiGuS+K/4lT7VHS -fdLsYinS0LYr5dmhc05s//kLyQ0OSKNh3SNAN+lM/klLE/pFwM4mo56C+seNEvCm -sT53VPOOwp6JwsLKSqm8pu1fbVjT6laMc9BPi6KUjN/f7ZahCXNXOrA2uLnTlxw/ -ns1sOXSWZDWciZeL3kJeUQER5YZ59hzLYWAiJ+5KblWRlBMXb71FUp0Mh9V3dA5O -BX3IlcF54qE50chGzLnfQf1YLuh13xxxc2WsdMZjiCj8CVDMkD6ekShfQK8nyQsK -SJgdXcnw1CxcAVvsROtecUiD+DWrJcYExjSZ+zcI4+aRhp7uNt8= -=iknu ------END PGP PUBLIC KEY BLOCK----- diff --git a/releases-g2.asc b/releases-g2.asc new file mode 100644 index 0000000..a8f7de7 --- /dev/null +++ b/releases-g2.asc @@ -0,0 +1,24 @@ +-----BEGIN PGP PUBLIC KEY BLOCK----- + +mQGNBGc7H5IBDADOZfJwZ6zZ/4JbbR2hef4261/zh7YpdjUREUs0dMQSbf+x7sAE +50JgvLQWlvA8sDHzbUMQ9cAYZBGGE6iHb50KboeEfuiP5BdiLe8XWKlo1EIh+Idz +0+e1binxwvXV1/9ACm/UHPRuWjkG7vrP+mVRuhfKglO6xSDxV1cwjYTRtvRtQx8D ++kTdZzprvtzkU7OIWeczKFJRhVHzNDHYFG9SuxvDA9cbVm1KPVJEkRBwoSBPeB0z +Z3LSib2uT6Lc/ghAijOwIpR+zNYKOYxRhzoFArrLa0Fs4nq6//LA42/aVjSienEJ +SR5CVUbZy14WuUsYCkV+ZoORVRYZOcjtPG7FUKDXKzY9/iNhEAZ3OMK7Np2Xq/YO +gaOiUDFXLHU1n2UVH1rwkMiS2o4EMqvO7gINmnL/ccpI2wj2QrQ+JZ9y1Xky7dQM +LIIbtp40e0kGocgyba484rW17xlvXRxb1Pjn93JygD6WcraLLNh9jq87hW/J37qi +S4DL+GUe10H8SeEAEQEAAbQ6TkxuZXQgTGFicyByZWxlYXNlcyBzaWduaW5nIGtl +eSBHMiA8cmVsZWFzZXNAbmxuZXRsYWJzLm5sPokBzgQTAQoAOBYhBCMQGGkMTZA+ +9BkUaqFEMj3qrN9FBQJnOx+SAhsDBQsJCAcCBhUKCQgLAgQWAgMBAh4BAheAAAoJ +EKFEMj3qrN9FZigL/0aVsJ48oe7vko1Mwg9DucFoCL8CESAarA40in1Bauq7p/pT +l5UcNnFPLO8HBAHWGWtDI63pEhNzHacPzSI94GKS4TUMGzCV1H/c0KnxB7wAO55b +HEQOZJ+kFRBFXWxbXORtp86NZuyCvVoSA4QAcnCf4m5ZEBb72H2cmy8xP+/HLkbS +rpr5pyoUWtCYM8FxnjM3bClXSGOlWNl9cSXLqyyVjxvc7cOAS8ytL/zoVStoBmi/ +OwQbeJfAiqDMnipBJNzOHlfniKXE0FGDozKCHWP88ifs8A8OUNtJng7cNq7EQf9K +vTvbJCcF4akUUcXnx4gv9Z1ZQ93Jg5X7h+0MP7Ut4z9hKSIAOowru7GXGEt256Ja +eE1nSviDcqUtZpyqCLjpCDFGPMwSPzSwlPXjJVlVxPkDvPuNt2LUIEd8BR8Wo7z+ +NA5uM/zTHkQXEdUgCcl/rHy6moHYV3Q+YbMb17zU37a5vLb+wQ74doaiYo3b8KoV +K6vVKMmB0qru6ERJ3g== +=4R8U +-----END PGP PUBLIC KEY BLOCK----- diff --git a/sources b/sources index 7d4806d..e5856eb 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (unbound-1.24.2.tar.gz) = 655d63ec5305323e84d82691425d74d98c332d0028517bd729d191e5f968ce9481b49ec7447d4c4906dce7997a998a115db36e911a59d2d877da5840c2080261 -SHA512 (unbound-1.24.2.tar.gz.asc) = 66a3e569a606cc3ed7dac9b411fba347da150728427619bdbf12ac57a5d7db1fc17963b1ba052a95d6c6fed67a6f0c1b5920318f6cd34e5091750626dd63fb21 +SHA512 (unbound-1.25.1.tar.gz) = a536ff1d9b637e4ffa46ab498919ddf089b4498e65c748748c4920a6da52e1f5bacfbba9ac1dc47798d168e2ea64a7ae7ea2a581464d1fcabae241a6e38c8d13 +SHA512 (unbound-1.25.1.tar.gz.asc) = 307ce54a35c47e19dda75154424fe8e35382605cb3541ab2c16f567e28c44cfcace5aa14ca8c18d272647b8ef70cfc75f51c27cb0587bc51bd82d074380825aa diff --git a/unbound-1.25-tls-crypto-policy-default.patch b/unbound-1.25-tls-crypto-policy-default.patch deleted file mode 100644 index 7b532eb..0000000 --- a/unbound-1.25-tls-crypto-policy-default.patch +++ /dev/null @@ -1,61 +0,0 @@ -From 87e5c3ccad91c72166ed72c7366d8681308d84a8 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= -Date: Mon, 9 Feb 2026 15:40:51 +0100 -Subject: [PATCH] Add a new build-time option for system TLS - -We want to use crypto-policy provided configuration always in our -builds. Allow changing the default of tls-use-system-policy-versions at -build time by a simple configure parameter. ---- - unbound-1.24.2/configure.ac | 11 +++++++++++ - unbound-1.24.2/util/config_file.c | 5 ++++- - 2 files changed, 15 insertions(+), 1 deletion(-) - -diff --git a/unbound-1.24.2/configure.ac b/unbound-1.24.2/configure.ac -index 6a43fd5..13c910f 100644 ---- a/unbound-1.24.2/configure.ac -+++ b/unbound-1.24.2/configure.ac -@@ -2067,6 +2067,17 @@ case "$enable_ipsecmod" in - ;; - esac - -+# check for system TLS preference if requested -+AC_ARG_ENABLE(system-tls, AS_HELP_STRING([--enable-system-tls],[Enable preference of system configured TLS socket options])) -+case "$enable_system_tls" in -+ yes) -+ AC_DEFINE([USE_SYSTEM_TLS], [1], [Define to 1 to prefer TLS crypto settings from the system.]) -+ ;; -+ no|*) -+ # nothing -+ ;; -+esac -+ - # check for ipset if requested - AC_ARG_ENABLE(ipset, AS_HELP_STRING([--enable-ipset],[enable ipset module])) - case "$enable_ipset" in -diff --git a/unbound-1.24.2/util/config_file.c b/unbound-1.24.2/util/config_file.c -index 1565b05..8079ec9 100644 ---- a/unbound-1.24.2/util/config_file.c -+++ b/unbound-1.24.2/util/config_file.c -@@ -71,6 +71,9 @@ - #ifdef HAVE_PWD_H - #include - #endif -+#ifndef USE_SYSTEM_TLS -+#define USE_SYSTEM_TLS 0 -+#endif - - /** from cfg username, after daemonize setup performed */ - uid_t cfg_uid = (uid_t)-1; -@@ -129,7 +132,7 @@ config_create(void) - cfg->tls_cert_bundle = NULL; - cfg->tls_win_cert = 0; - cfg->tls_use_sni = 1; -- cfg->tls_use_system_policy_versions = 0; -+ cfg->tls_use_system_policy_versions = USE_SYSTEM_TLS; - cfg->https_port = UNBOUND_DNS_OVER_HTTPS_PORT; - if(!(cfg->http_endpoint = strdup("/dns-query"))) goto error_exit; - cfg->http_max_streams = 100; --- -2.52.0 - diff --git a/unbound-1.25-tls-crypto-policy.patch b/unbound-1.25-tls-crypto-policy.patch deleted file mode 100644 index 7f6f911..0000000 --- a/unbound-1.25-tls-crypto-policy.patch +++ /dev/null @@ -1,483 +0,0 @@ -From 315d29b33f9766e7ecb91fcfd4c1238d92aefd9e Mon Sep 17 00:00:00 2001 -From: Yorgos Thessalonikefs -Date: Mon, 22 Sep 2025 18:22:36 +0200 -Subject: [PATCH] - Fix #1346: [FR] Please allow back TLS 1.2. - 'tls-use-system-policy-versions' is introduced to allow Unbound to use any - system available TLS version when serving TLS. - ---- - unbound-1.24.2/daemon/remote.c | 2 +- - unbound-1.24.2/daemon/unbound.c | 2 +- - unbound-1.24.2/dnstap/unbound-dnstap-socket.c | 2 +- - unbound-1.24.2/doc/example.conf.in | 26 ++++++--- - unbound-1.24.2/doc/unbound.conf.5.in | 55 ++++++++++++++----- - unbound-1.24.2/doc/unbound.conf.rst | 32 ++++++++--- - unbound-1.24.2/util/config_file.c | 3 + - unbound-1.24.2/util/config_file.h | 2 + - unbound-1.24.2/util/configlexer.lex | 1 + - unbound-1.24.2/util/configparser.y | 11 ++++ - unbound-1.24.2/util/net_help.c | 54 +++++++++--------- - unbound-1.24.2/util/net_help.h | 8 ++- - unbound-1.24.2/winrc/win_svc.c | 4 +- - 13 files changed, 138 insertions(+), 64 deletions(-) - -diff --git a/unbound-1.24.2/daemon/remote.c b/unbound-1.24.2/daemon/remote.c -index d8ee7fa..06d1d34 100644 ---- a/unbound-1.24.2/daemon/remote.c -+++ b/unbound-1.24.2/daemon/remote.c -@@ -153,7 +153,7 @@ remote_setup_ctx(struct daemon_remote* rc, struct config_file* cfg) - log_crypto_err("could not SSL_CTX_new"); - return 0; - } -- if(!listen_sslctx_setup(rc->ctx)) { -+ if(!listen_sslctx_setup(rc->ctx, cfg->tls_use_system_policy_versions)) { - return 0; - } - -diff --git a/unbound-1.24.2/daemon/unbound.c b/unbound-1.24.2/daemon/unbound.c -index 164d0fb..6888047 100644 ---- a/unbound-1.24.2/daemon/unbound.c -+++ b/unbound-1.24.2/daemon/unbound.c -@@ -473,7 +473,7 @@ setup_listen_sslctx(void** ctx, int is_dot, int is_doh, struct config_file* cfg) - cfg->tls_ciphers, cfg->tls_ciphersuites, - (cfg->tls_session_ticket_keys.first && - cfg->tls_session_ticket_keys.first->str[0] != 0), -- is_dot, is_doh))) { -+ is_dot, is_doh, cfg->tls_use_system_policy_versions))) { - fatal_exit("could not set up listen SSL_CTX"); - } - } -diff --git a/unbound-1.24.2/dnstap/unbound-dnstap-socket.c b/unbound-1.24.2/dnstap/unbound-dnstap-socket.c -index a01627d..c0d344c 100644 ---- a/unbound-1.24.2/dnstap/unbound-dnstap-socket.c -+++ b/unbound-1.24.2/dnstap/unbound-dnstap-socket.c -@@ -347,7 +347,7 @@ static struct tap_socket* tap_socket_new_tlsaccept(char* ip, - s->ev_cb = ev_cb; - s->data = data; - s->sslctx = listen_sslctx_create(server_key, server_cert, verifypem, -- NULL, NULL, 0, 0, 0); -+ NULL, NULL, 0, 0, 0, 0); - if(!s->sslctx) { - log_err("could not create ssl context"); - free(s->ip); -diff --git a/unbound-1.24.2/doc/example.conf.in b/unbound-1.24.2/doc/example.conf.in -index cf10b85..ecdc65c 100644 ---- a/unbound-1.24.2/doc/example.conf.in -+++ b/unbound-1.24.2/doc/example.conf.in -@@ -950,21 +950,26 @@ server: - # https-port: 443 - # quic-port: 853 - -+ # Also serve tls on these port numbers (eg. 443, ...), by listing -+ # tls-additional-port: portno for each of the port numbers. -+ - # cipher setting for TLSv1.2 - # tls-ciphers: "DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256" - # cipher setting for TLSv1.3 - # tls-ciphersuites: "TLS_AES_128_GCM_SHA256:TLS_AES_128_CCM_8_SHA256:TLS_AES_128_CCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256" - -- # Pad responses to padded queries received over TLS -- # pad-responses: yes -- -- # Padded responses will be padded to the closest multiple of this size. -- # pad-responses-block-size: 468 -- - # Use the SNI extension for TLS connections. Default is yes. - # Changing the value requires a reload. - # tls-use-sni: yes - -+ # Allow general-purpose version-flexible TLS server configuration that -+ # may be further restricted by the system's policy. -+ # Use only if you want to support legacy TLS client connections. -+ # Default is no and Unbound will only use the latest available TLS -+ # version. -+ # Changing the value requires a reload. -+ # tls-use-system-policy-versions: no -+ - # Add the secret file for TLS Session Ticket. - # Secret file must be 80 bytes of random data. - # First key use to encrypt and decrypt TLS session tickets. -@@ -985,15 +990,18 @@ server: - # and on other systems, the default openssl certificates - # tls-system-cert: no - -+ # Pad responses to padded queries received over TLS -+ # pad-responses: yes -+ -+ # Padded responses will be padded to the closest multiple of this size. -+ # pad-responses-block-size: 468 -+ - # Pad queries over TLS upstreams - # pad-queries: yes - - # Padded queries will be padded to the closest multiple of this size. - # pad-queries-block-size: 128 - -- # Also serve tls on these port numbers (eg. 443, ...), by listing -- # tls-additional-port: portno for each of the port numbers. -- - # HTTP endpoint to provide DNS-over-HTTPS service on. - # http-endpoint: "/dns-query" - -diff --git a/unbound-1.24.2/doc/unbound.conf.5.in b/unbound-1.24.2/doc/unbound.conf.5.in -index a5857ac..7ec7860 100644 ---- a/unbound-1.24.2/doc/unbound.conf.5.in -+++ b/unbound-1.24.2/doc/unbound.conf.5.in -@@ -1218,6 +1218,47 @@ Default: \(dq\(dq - .UNINDENT - .INDENT 0.0 - .TP -+.B tls\-use\-sni: \fI\fP -+Enable or disable sending the SNI extension on TLS connections. -+.sp -+\fBNOTE:\fP -+.INDENT 7.0 -+.INDENT 3.5 -+Changing the value requires a reload. -+.UNINDENT -+.UNINDENT -+.sp -+Default: yes -+.UNINDENT -+.INDENT 0.0 -+.TP -+.B tls\-use\-system\-policy\-versions: \fI\fP -+Enable or disable general\-puspose version\-flexible TLS server configuration -+when serving TLS. -+This will allow the whole list of available TLS versions provided by the -+crypto library, which may have been further restricted by the system\(aqs -+crypto policy. -+.sp -+By default Unbound only uses the latest available TLS version. -+.sp -+\fBCAUTION:\fP -+.INDENT 7.0 -+.INDENT 3.5 -+Use only if you want to support legacy TLS client connections. -+.UNINDENT -+.UNINDENT -+.sp -+\fBNOTE:\fP -+.INDENT 7.0 -+.INDENT 3.5 -+Changing the value requires a reload. -+.UNINDENT -+.UNINDENT -+.sp -+Default: no -+.UNINDENT -+.INDENT 0.0 -+.TP - .B pad\-responses: \fI\fP - If enabled, TLS serviced queries that contained an EDNS Padding option will - cause responses padded to the closest multiple of the size specified in -@@ -1251,20 +1292,6 @@ Default: 128 - .UNINDENT - .INDENT 0.0 - .TP --.B tls\-use\-sni: \fI\fP --Enable or disable sending the SNI extension on TLS connections. --.sp --\fBNOTE:\fP --.INDENT 7.0 --.INDENT 3.5 --Changing the value requires a reload. --.UNINDENT --.UNINDENT --.sp --Default: yes --.UNINDENT --.INDENT 0.0 --.TP - .B https\-port: \fI\fP - The port number on which to provide DNS\-over\-HTTPS service. - Only interfaces configured with that port number as @number get the HTTPS -diff --git a/unbound-1.24.2/doc/unbound.conf.rst b/unbound-1.24.2/doc/unbound.conf.rst -index d83816c..555b1c8 100644 ---- a/unbound-1.24.2/doc/unbound.conf.rst -+++ b/unbound-1.24.2/doc/unbound.conf.rst -@@ -1103,6 +1103,30 @@ These options are part of the **server:** clause. - Default: "" - - -+@@UAHL@unbound.conf@tls-use-sni@@: ** -+ Enable or disable sending the SNI extension on TLS connections. -+ -+ .. note:: Changing the value requires a reload. -+ -+ Default: yes -+ -+ -+@@UAHL@unbound.conf@tls-use-system-policy-versions@@: ** -+ Enable or disable general-puspose version-flexible TLS server configuration -+ when serving TLS. -+ This will allow the whole list of available TLS versions provided by the -+ crypto library, which may have been further restricted by the system's -+ crypto policy. -+ -+ By default Unbound only uses the latest available TLS version. -+ -+ .. caution:: Use only if you want to support legacy TLS client connections. -+ -+ .. note:: Changing the value requires a reload. -+ -+ Default: no -+ -+ - @@UAHL@unbound.conf@pad-responses@@: ** - If enabled, TLS serviced queries that contained an EDNS Padding option will - cause responses padded to the closest multiple of the size specified in -@@ -1132,14 +1156,6 @@ These options are part of the **server:** clause. - Default: 128 - - --@@UAHL@unbound.conf@tls-use-sni@@: ** -- Enable or disable sending the SNI extension on TLS connections. -- -- .. note:: Changing the value requires a reload. -- -- Default: yes -- -- - @@UAHL@unbound.conf@https-port@@: ** - The port number on which to provide DNS-over-HTTPS service. - Only interfaces configured with that port number as @number get the HTTPS -diff --git a/unbound-1.24.2/util/config_file.c b/unbound-1.24.2/util/config_file.c -index 25c2b3e..1565b05 100644 ---- a/unbound-1.24.2/util/config_file.c -+++ b/unbound-1.24.2/util/config_file.c -@@ -129,6 +129,7 @@ config_create(void) - cfg->tls_cert_bundle = NULL; - cfg->tls_win_cert = 0; - cfg->tls_use_sni = 1; -+ cfg->tls_use_system_policy_versions = 0; - cfg->https_port = UNBOUND_DNS_OVER_HTTPS_PORT; - if(!(cfg->http_endpoint = strdup("/dns-query"))) goto error_exit; - cfg->http_max_streams = 100; -@@ -629,6 +630,7 @@ int config_set_option(struct config_file* cfg, const char* opt, - else S_STR("tls-ciphers:", tls_ciphers) - else S_STR("tls-ciphersuites:", tls_ciphersuites) - else S_YNO("tls-use-sni:", tls_use_sni) -+ else S_YNO("tls-use-system-policy-versions:", tls_use_system_policy_versions) - else S_NUMBER_NONZERO("https-port:", https_port) - else S_STR("http-endpoint:", http_endpoint) - else S_NUMBER_NONZERO("http-max-streams:", http_max_streams) -@@ -1181,6 +1183,7 @@ config_get_option(struct config_file* cfg, const char* opt, - else O_STR(opt, "tls-ciphers", tls_ciphers) - else O_STR(opt, "tls-ciphersuites", tls_ciphersuites) - else O_YNO(opt, "tls-use-sni", tls_use_sni) -+ else O_YNO(opt, "tls-use-system-policy-versions", tls_use_system_policy_versions) - else O_DEC(opt, "https-port", https_port) - else O_STR(opt, "http-endpoint", http_endpoint) - else O_UNS(opt, "http-max-streams", http_max_streams) -diff --git a/unbound-1.24.2/util/config_file.h b/unbound-1.24.2/util/config_file.h -index f77538b..59b4ae5 100644 ---- a/unbound-1.24.2/util/config_file.h -+++ b/unbound-1.24.2/util/config_file.h -@@ -148,6 +148,8 @@ struct config_file { - char* tls_ciphersuites; - /** if SNI is to be used */ - int tls_use_sni; -+ /** if all TLS versions can be used; based on system policy (if any) */ -+ int tls_use_system_policy_versions; - - /** port on which to provide DNS over HTTPS service */ - int https_port; -diff --git a/unbound-1.24.2/util/configlexer.lex b/unbound-1.24.2/util/configlexer.lex -index 0ba8d60..22f98e4 100644 ---- a/unbound-1.24.2/util/configlexer.lex -+++ b/unbound-1.24.2/util/configlexer.lex -@@ -262,6 +262,7 @@ tls-session-ticket-keys{COLON} { YDVAR(1, VAR_TLS_SESSION_TICKET_KEYS) } - tls-ciphers{COLON} { YDVAR(1, VAR_TLS_CIPHERS) } - tls-ciphersuites{COLON} { YDVAR(1, VAR_TLS_CIPHERSUITES) } - tls-use-sni{COLON} { YDVAR(1, VAR_TLS_USE_SNI) } -+tls-use-system-policy-versions{COLON} { YDVAR(1, VAR_TLS_USE_SYSTEM_POLICY_VERSIONS) } - https-port{COLON} { YDVAR(1, VAR_HTTPS_PORT) } - http-endpoint{COLON} { YDVAR(1, VAR_HTTP_ENDPOINT) } - http-max-streams{COLON} { YDVAR(1, VAR_HTTP_MAX_STREAMS) } -diff --git a/unbound-1.24.2/util/configparser.y b/unbound-1.24.2/util/configparser.y -index bef1fd3..bf9c196 100644 ---- a/unbound-1.24.2/util/configparser.y -+++ b/unbound-1.24.2/util/configparser.y -@@ -199,6 +199,7 @@ extern struct config_parser_state* cfg_parser; - %token VAR_DISCARD_TIMEOUT VAR_WAIT_LIMIT VAR_WAIT_LIMIT_COOKIE - %token VAR_WAIT_LIMIT_NETBLOCK VAR_WAIT_LIMIT_COOKIE_NETBLOCK - %token VAR_STREAM_WAIT_SIZE VAR_TLS_CIPHERS VAR_TLS_CIPHERSUITES VAR_TLS_USE_SNI -+%token VAR_TLS_USE_SYSTEM_POLICY_VERSIONS - %token VAR_IPSET VAR_IPSET_NAME_V4 VAR_IPSET_NAME_V6 - %token VAR_TLS_SESSION_TICKET_KEYS VAR_RPZ VAR_TAGS VAR_RPZ_ACTION_OVERRIDE - %token VAR_RPZ_CNAME_OVERRIDE VAR_RPZ_LOG VAR_RPZ_LOG_NAME -@@ -347,6 +348,7 @@ content_server: server_num_threads | server_verbosity | server_port | - server_tls_ciphersuites | server_tls_session_ticket_keys | - server_answer_cookie | server_cookie_secret | server_ip_ratelimit_cookie | - server_tls_use_sni | server_edns_client_string | -+ server_tls_use_system_policy_versions | - server_edns_client_string_opcode | server_nsid | - server_zonemd_permissive_mode | server_max_reuse_tcp_queries | - server_tcp_reuse_timeout | server_tcp_auth_query_timeout | -@@ -1155,6 +1157,15 @@ server_tls_use_sni: VAR_TLS_USE_SNI STRING_ARG - free($2); - } - ; -+server_tls_use_system_policy_versions: VAR_TLS_USE_SYSTEM_POLICY_VERSIONS STRING_ARG -+ { -+ OUTYY(("P(server_tls_use_system_policy_versions:%s)\n", $2)); -+ if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0) -+ yyerror("expected yes or no."); -+ else cfg_parser->cfg->tls_use_system_policy_versions = (strcmp($2, "yes")==0); -+ free($2); -+ } -+ ; - server_https_port: VAR_HTTPS_PORT STRING_ARG - { - OUTYY(("P(server_https_port:%s)\n", $2)); -diff --git a/unbound-1.24.2/util/net_help.c b/unbound-1.24.2/util/net_help.c -index 6ce0d91..426ace9 100644 ---- a/unbound-1.24.2/util/net_help.c -+++ b/unbound-1.24.2/util/net_help.c -@@ -1226,7 +1226,7 @@ setup_ticket_keys_cb(void* sslctx) - #endif /* HAVE_SSL */ - - int --listen_sslctx_setup(void* ctxt) -+listen_sslctx_setup(void* ctxt, int use_system_versions) - { - #ifdef HAVE_SSL - SSL_CTX* ctx = (SSL_CTX*)ctxt; -@@ -1238,35 +1238,37 @@ listen_sslctx_setup(void* ctxt) - return 0; - } - #endif -- if((SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv3) & SSL_OP_NO_SSLv3) -- != SSL_OP_NO_SSLv3){ -- log_crypto_err("could not set SSL_OP_NO_SSLv3"); -- return 0; -- } -+ if(!use_system_versions) { -+ if((SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv3) & SSL_OP_NO_SSLv3) -+ != SSL_OP_NO_SSLv3){ -+ log_crypto_err("could not set SSL_OP_NO_SSLv3"); -+ return 0; -+ } - #if defined(SSL_OP_NO_TLSv1) && defined(SSL_OP_NO_TLSv1_1) -- /* if we have tls 1.1 disable 1.0 */ -- if((SSL_CTX_set_options(ctx, SSL_OP_NO_TLSv1) & SSL_OP_NO_TLSv1) -- != SSL_OP_NO_TLSv1){ -- log_crypto_err("could not set SSL_OP_NO_TLSv1"); -- return 0; -- } -+ /* if we have tls 1.1 disable 1.0 */ -+ if((SSL_CTX_set_options(ctx, SSL_OP_NO_TLSv1) & SSL_OP_NO_TLSv1) -+ != SSL_OP_NO_TLSv1){ -+ log_crypto_err("could not set SSL_OP_NO_TLSv1"); -+ return 0; -+ } - #endif - #if defined(SSL_OP_NO_TLSv1_1) && defined(SSL_OP_NO_TLSv1_2) -- /* if we have tls 1.2 disable 1.1 */ -- if((SSL_CTX_set_options(ctx, SSL_OP_NO_TLSv1_1) & SSL_OP_NO_TLSv1_1) -- != SSL_OP_NO_TLSv1_1){ -- log_crypto_err("could not set SSL_OP_NO_TLSv1_1"); -- return 0; -- } -+ /* if we have tls 1.2 disable 1.1 */ -+ if((SSL_CTX_set_options(ctx, SSL_OP_NO_TLSv1_1) & SSL_OP_NO_TLSv1_1) -+ != SSL_OP_NO_TLSv1_1){ -+ log_crypto_err("could not set SSL_OP_NO_TLSv1_1"); -+ return 0; -+ } - #endif - #if defined(SSL_OP_NO_TLSv1_2) && defined(SSL_OP_NO_TLSv1_3) -- /* if we have tls 1.3 disable 1.2 */ -- if((SSL_CTX_set_options(ctx, SSL_OP_NO_TLSv1_2) & SSL_OP_NO_TLSv1_2) -- != SSL_OP_NO_TLSv1_2){ -- log_crypto_err("could not set SSL_OP_NO_TLSv1_2"); -- return 0; -- } -+ /* if we have tls 1.3 disable 1.2 */ -+ if((SSL_CTX_set_options(ctx, SSL_OP_NO_TLSv1_2) & SSL_OP_NO_TLSv1_2) -+ != SSL_OP_NO_TLSv1_2){ -+ log_crypto_err("could not set SSL_OP_NO_TLSv1_2"); -+ return 0; -+ } - #endif -+ } - #if defined(SSL_OP_NO_RENEGOTIATION) - /* disable client renegotiation */ - if((SSL_CTX_set_options(ctx, SSL_OP_NO_RENEGOTIATION) & -@@ -1341,7 +1343,7 @@ listen_sslctx_setup_2(void* ctxt) - void* listen_sslctx_create(const char* key, const char* pem, - const char* verifypem, const char* tls_ciphers, - const char* tls_ciphersuites, int set_ticket_keys_cb, -- int is_dot, int is_doh) -+ int is_dot, int is_doh, int use_system_versions) - { - #ifdef HAVE_SSL - SSL_CTX* ctx = SSL_CTX_new(SSLv23_server_method()); -@@ -1359,7 +1361,7 @@ void* listen_sslctx_create(const char* key, const char* pem, - SSL_CTX_free(ctx); - return NULL; - } -- if(!listen_sslctx_setup(ctx)) { -+ if(!listen_sslctx_setup(ctx, use_system_versions)) { - SSL_CTX_free(ctx); - return NULL; - } -diff --git a/unbound-1.24.2/util/net_help.h b/unbound-1.24.2/util/net_help.h -index 278e370..7b8a206 100644 ---- a/unbound-1.24.2/util/net_help.h -+++ b/unbound-1.24.2/util/net_help.h -@@ -478,9 +478,11 @@ void log_cert(unsigned level, const char* str, void* cert); - /** - * Set SSL_OP_NOxxx options on SSL context to disable bad crypto - * @param ctxt: SSL_CTX* -+ * @param use_system_versions: rely on the system policy (if any) for allowed -+ * TLS versions - * @return false on failure. - */ --int listen_sslctx_setup(void* ctxt); -+int listen_sslctx_setup(void* ctxt, int use_system_versions); - - /** - * Further setup of listening SSL context, after keys loaded. -@@ -499,12 +501,14 @@ void listen_sslctx_setup_2(void* ctxt); - * to be set. - * @param is_dot: if the TLS connection is for DoT to set the appropriate ALPN. - * @param is_doh: if the TLS connection is for DoH to set the appropriate ALPN. -+ * @param use_system_versions: rely on the system policy (if any) for allowed -+ * TLS versions - * return SSL_CTX* or NULL on failure (logged). - */ - void* listen_sslctx_create(const char* key, const char* pem, - const char* verifypem, const char* tls_ciphers, - const char* tls_ciphersuites, int set_ticket_keys_cb, -- int is_dot, int is_doh); -+ int is_dot, int is_doh, int use_system_versions); - - /** - * create SSL connect context -diff --git a/unbound-1.24.2/winrc/win_svc.c b/unbound-1.24.2/winrc/win_svc.c -index 429b045..6fca0c7 100644 ---- a/unbound-1.24.2/winrc/win_svc.c -+++ b/unbound-1.24.2/winrc/win_svc.c -@@ -369,7 +369,7 @@ service_init(int r, struct daemon** d, struct config_file** c) - cfg->tls_ciphers, cfg->tls_ciphersuites, - (cfg->tls_session_ticket_keys.first && - cfg->tls_session_ticket_keys.first->str[0] != 0), -- 1, 0))) { -+ 1, 0, cfg->tls_use_system_policy_versions))) { - fatal_exit("could not set up listen SSL_CTX"); - } - #ifdef HAVE_NGHTTP2_NGHTTP2_H -@@ -379,7 +379,7 @@ service_init(int r, struct daemon** d, struct config_file** c) - cfg->tls_ciphers, cfg->tls_ciphersuites, - (cfg->tls_session_ticket_keys.first && - cfg->tls_session_ticket_keys.first->str[0] != 0), -- 0, 1))) { -+ 0, 1, cfg->tls_use_system_policy_versions))) { - fatal_exit("could not set up listen doh SSL_CTX"); - } - } --- -2.52.0 - diff --git a/unbound-1.8.0-rh1633874.patch b/unbound-1.8.0-rh1633874.patch deleted file mode 100644 index 6740a66..0000000 --- a/unbound-1.8.0-rh1633874.patch +++ /dev/null @@ -1,39 +0,0 @@ -From 9be04e6fac3f4ee8fa08d3671dac41d2156d2ced Mon Sep 17 00:00:00 2001 -From: Wouter Wijngaards -Date: Thu, 27 Sep 2018 08:19:29 +0000 -Subject: [PATCH] - Fix #4188: IPv6 forwarders without ipv6 result in SERVFAIL, - fixes qname minimisation with a forwarder when connectivity has issues - from rejecting responses. - -git-svn-id: file:///svn/unbound/trunk@4916 be551aaa-1e26-0410-a405-d3ace91eadb9 ---- - iterator/iterator.c | 6 ++++-- - 1 file changed, 4 insertions(+), 2 deletions(-) - -diff --git a/iterator/iterator.c b/iterator/iterator.c -index 7baf92b7..2f26bd33 100644 ---- a/iterator/iterator.c -+++ b/iterator/iterator.c -@@ -2174,7 +2174,8 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq, - return 0; - } - -- if(iq->minimisation_state == INIT_MINIMISE_STATE) { -+ if(iq->minimisation_state == INIT_MINIMISE_STATE -+ && !(iq->chase_flags & BIT_RD)) { - /* (Re)set qinfo_out to (new) delegation point, except when - * qinfo_out is already a subdomain of dp. This happens when - * increasing by more than one label at once (QNAMEs with more -@@ -2715,7 +2716,8 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq, - sock_list_insert(&qstate->reply_origin, - &qstate->reply->addr, qstate->reply->addrlen, - qstate->region); -- if(iq->minimisation_state != DONOT_MINIMISE_STATE) { -+ if(iq->minimisation_state != DONOT_MINIMISE_STATE -+ && !(iq->chase_flags & BIT_RD)) { - if(FLAGS_GET_RCODE(iq->response->rep->flags) != - LDNS_RCODE_NOERROR) { - if(qstate->env->cfg->qname_minimisation_strict) --- -2.14.4 - diff --git a/unbound-1.8.1-keygen-group-rights.patch b/unbound-1.8.1-keygen-group-rights.patch deleted file mode 100644 index daa9ee8..0000000 --- a/unbound-1.8.1-keygen-group-rights.patch +++ /dev/null @@ -1,29 +0,0 @@ -From 6429b5c298b10b96feb6b90c111948df97269f40 Mon Sep 17 00:00:00 2001 -From: Wouter Wijngaards -Date: Mon, 22 Oct 2018 10:07:13 +0000 -Subject: [PATCH] - Fix #4192: unbound-control-setup generates keys not - readable by group. - -git-svn-id: file:///svn/unbound/trunk@4942 be551aaa-1e26-0410-a405-d3ace91eadb9 ---- - smallapp/unbound-control-setup.sh.in | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/smallapp/unbound-control-setup.sh.in b/smallapp/unbound-control-setup.sh.in -index 0d759f44..f4024b43 100644 ---- a/smallapp/unbound-control-setup.sh.in -+++ b/smallapp/unbound-control-setup.sh.in -@@ -148,8 +148,8 @@ test -f $CTL_BASE.pem || error "could not create $CTL_BASE.pem" - # echo "empty password is used, simply click OK on the password dialog box." - # openssl pkcs12 -export -in $CTL_BASE"_trust.pem" -inkey $CTL_BASE.key -name "unbound remote control client cert" -out $CTL_BASE"_browser.pfx" -password "pass:" || error "could not create browser certificate" - --# remove unused permissions --chmod o-rw $SVR_BASE.pem $SVR_BASE.key $CTL_BASE.pem $CTL_BASE.key -+# set desired permissions -+chmod 0640 $SVR_BASE.pem $SVR_BASE.key $CTL_BASE.pem $CTL_BASE.key - - # remove crap - rm -f request.cfg --- -2.14.4 - diff --git a/unbound-1.8.2-dns64.patch b/unbound-1.8.2-dns64.patch deleted file mode 100644 index e811a3c..0000000 --- a/unbound-1.8.2-dns64.patch +++ /dev/null @@ -1,13 +0,0 @@ -diff --git a/dns64/dns64.c b/dns64/dns64.c -index 6c81192..77e6890 100644 ---- a/dns64/dns64.c -+++ b/dns64/dns64.c -@@ -925,7 +925,7 @@ dns64_inform_super(struct module_qstate* qstate, int id, - * successful or not. This lets the state machine terminate. - */ - if(!super_dq) { -- super_dq = (struct dns64_qstate*)regional_alloc(qstate->region, -+ super_dq = (struct dns64_qstate*)regional_alloc(super->region, - sizeof(*super_dq)); - super->minfo[id] = super_dq; - memset(super_dq, 0, sizeof(*super_dq)); diff --git a/unbound-fedora-config.patch b/unbound-fedora-config.patch index 6fc5649..d6cb0cd 100644 --- a/unbound-fedora-config.patch +++ b/unbound-fedora-config.patch @@ -1,4 +1,4 @@ -From a8be97bada623287cdd911c7a4549bbceef9fea0 Mon Sep 17 00:00:00 2001 +From b57a1fbfb38399a40f6bde25dd49c82468e97298 Mon Sep 17 00:00:00 2001 From: Tomas Korbar Date: Tue, 4 Feb 2025 09:48:12 +0100 Subject: [PATCH] Customize unbound.conf for Fedora defaults @@ -7,13 +7,13 @@ Set some Fedora/RHEL specific changes to example configuration file. By patching upstream provided config file we would not need to manually update external copy in source RPM. --- - unbound-1.24.2/doc/example.conf.in | 33 ++++++++++++++++++++++++++++-- + doc/example.conf.in | 33 +++++++++++++++++++++++++++++++-- 1 file changed, 31 insertions(+), 2 deletions(-) -diff --git a/unbound-1.24.2/doc/example.conf.in b/unbound-1.24.2/doc/example.conf.in -index fda565c..cf10b85 100644 ---- a/unbound-1.24.2/doc/example.conf.in -+++ b/unbound-1.24.2/doc/example.conf.in +diff --git a/unbound-1.25.1/doc/example.conf.in b/unbound-1.25.1/doc/example.conf.in +index 2c6d63409..d722fc4dd 100644 +--- a/unbound-1.25.1/doc/example.conf.in ++++ b/unbound-1.25.1/doc/example.conf.in @@ -51,11 +51,19 @@ server: # specify 0.0.0.0 and ::0 to bind to all available interfaces. # specify every interface[@port] on a new 'interface:' labelled line. @@ -23,7 +23,7 @@ index fda565c..cf10b85 100644 # interface: 192.0.2.153 # interface: 192.0.2.154 # interface: 192.0.2.154@5003 - # interface: 2001:DB8::5 + # interface: 2001:db8::5 # interface: eth0@5003 + # + # for dns over tls and raw dns over port 80 @@ -34,7 +34,7 @@ index fda565c..cf10b85 100644 # enable this feature to copy the source address of queries to reply. # Socket options are not supported on all platforms. experimental. -@@ -295,6 +303,8 @@ server: +@@ -298,6 +306,8 @@ server: # nat64-prefix: 64:ff9b::0/96 # Enable UDP, "yes" or "no". @@ -43,7 +43,7 @@ index fda565c..cf10b85 100644 # do-udp: yes # Enable TCP, "yes" or "no". -@@ -330,6 +340,9 @@ server: +@@ -333,6 +343,9 @@ server: # can be dropped. Default is 0, disabled. In seconds, such as 3. # sock-queue-timeout: 0 @@ -53,7 +53,7 @@ index fda565c..cf10b85 100644 # Use systemd socket activation for UDP, TCP, and control sockets. # use-systemd: no -@@ -919,6 +932,8 @@ server: +@@ -927,6 +940,8 @@ server: # you need to do the reverse notation yourself. # local-data-ptr: "192.0.2.3 www.example.com" @@ -62,7 +62,7 @@ index fda565c..cf10b85 100644 # tag a localzone with a list of tag names (in "" with spaces between) # local-zone-tag: "example.com" "tag2 tag3" -@@ -929,8 +944,8 @@ server: +@@ -953,8 +968,8 @@ server: # the TLS stream, and over HTTPS using HTTP/2 as specified in RFC8484. # Give the certificate to use and private key. # default is "" (disabled). requires restart to take effect. @@ -73,7 +73,7 @@ index fda565c..cf10b85 100644 # tls-port: 853 # https-port: 443 # quic-port: 853 -@@ -1184,6 +1199,12 @@ remote-control: +@@ -1212,6 +1227,12 @@ remote-control: # unbound-control certificate file. # control-cert-file: "@UNBOUND_RUN_DIR@/unbound_control.pem" @@ -86,7 +86,7 @@ index fda565c..cf10b85 100644 # Stub zones. # Create entries like below, to make all queries for 'example.com' and # 'example.org' go to the given list of nameservers. list zero or more -@@ -1204,6 +1225,10 @@ remote-control: +@@ -1232,6 +1253,10 @@ remote-control: # name: "example.org" # stub-host: ns.example.com. @@ -97,7 +97,7 @@ index fda565c..cf10b85 100644 # Forward zones # Create entries like below, to make all queries for 'example.com' and # 'example.org' go to the given list of servers. These servers have to handle -@@ -1221,6 +1246,10 @@ remote-control: +@@ -1249,6 +1274,10 @@ remote-control: # forward-zone: # name: "example.org" # forward-host: fwd.example.com @@ -109,5 +109,5 @@ index fda565c..cf10b85 100644 # Authority zones # The data for these zones is kept locally, from a file or downloaded. -- -2.52.0 +2.54.0 diff --git a/unbound.spec b/unbound.spec index b1f90c8..cca9b82 100644 --- a/unbound.spec +++ b/unbound.spec @@ -31,13 +31,13 @@ Summary: Validating, recursive, and caching DNS(SEC) resolver Name: unbound -Version: 1.24.2 +Version: 1.25.1 Release: %autorelease %{?extra_version:-e %{extra_version}} License: BSD-3-Clause Url: https://nlnetlabs.nl/projects/unbound/ Source: https://nlnetlabs.nl/downloads/%{name}/%{name}-%{version}%{?extra_version}.tar.gz Source1: unbound.service -Source2: https://nlnetlabs.nl/downloads/keys/Yorgos.asc +Source2: https://nlnetlabs.nl/downloads/keys/releases-g2.asc Source3: unbound.munin Source4: unbound_munin_ Source5: root.key @@ -66,11 +66,7 @@ Source27: unbound-initrd.conf Source30: tmpfiles-unbound-libs.conf # Downstream configuration changes -Patch1: unbound-fedora-config.patch -# https://github.com/NLnetLabs/unbound/pull/1349 -Patch2: %{forgeurl}/pull/1349.patch#/unbound-1.25-tls-crypto-policy.patch -# https://github.com/NLnetLabs/unbound/pull/1401 -Patch3: %{forgeurl}/pull/1401.patch#/unbound-1.25-tls-crypto-policy-default.patch +Patch1: unbound-fedora-config.patch BuildRequires: gcc BuildRequires: make @@ -80,6 +76,7 @@ BuildRequires: openssl-devel BuildRequires: libevent-devel BuildRequires: expat-devel BuildRequires: pkgconfig +BuildRequires: gzip %if 0%{?fedora} || 0%{?rhel} >= 10 BuildRequires: gnupg2 %endif @@ -313,6 +310,7 @@ pushd %{dir_secondary} popd %endif +gzip --best -k doc/Changelog %install install -p -m 0644 %{SOURCE16} . @@ -463,6 +461,7 @@ popd %files %doc doc/CREDITS doc/FEATURES +%doc doc/Changelog.* %{_unitdir}/%{name}.service %{_unitdir}/%{name}-keygen.service %attr(0775,unbound,root) %dir %{_rundir}/%{name}