mbox series

[bug#68621,0/2] Provide default DNSSEC trust anchors for knot-resolver

Message ID 20240120212542.17473-1-hello@lnikki.la
Headers show
Series Provide default DNSSEC trust anchors for knot-resolver | expand

Message

Leo Nikkilä Jan. 20, 2024, 9:23 p.m. UTC 
The default DNSSEC trust anchors for knot-resolver are currently
disabled through a build phase, but configured when you use the default
kresd.conf file provided by Guix.

If you write your own configuration, you might expect kresd to have
DNSSEC enabled by default since this is what upstream does [1]. On Guix,
DNSSEC is disabled unless you provide the same custom path in your own
configuration and install the file into the appropriate location.

This set updates the package to be built with the correct path as the
default, and the service to use that path and install the default trust
anchors at activation time when missing.

[1]: https://knot-resolver.readthedocs.io/en/stable/config-dnssec.html

Leo Nikkilä (2):
  gnu: knot-resolver: Re-enable default DNSSEC trust anchors.
  services: knot-resolver: Use default DNSSEC trust anchors.

 gnu/packages/dns.scm | 20 +++++++++++++-------
 gnu/services/dns.scm | 17 +++++++++++++----
 2 files changed, 26 insertions(+), 11 deletions(-)


base-commit: 9072f27f5d3514be22c6af208f2ad56ef4e112f4

Comments

Leo Nikkilä Jan. 20, 2024, 9:37 p.m. UTC | #1 
Forgot to mention, but this is more or less what was done for the upstream RPM package, see:

https://gitlab.nic.cz/knot/knot-resolver/-/issues/513
https://gitlab.nic.cz/knot/knot-resolver/-/merge_requests/888/diffs
Dale Mellor April 23, 2024, 3:59 p.m. UTC | #2 
The patches that follow are:
  * two patches which were originally supposed to accompany this issue
  * a fix to quieten some guix lint warnings
  * a package version micro-bump, to 5.7.2.