diff mbox series

[bug#68621,v2,1/4] gnu: knot-resolver: Re-enable default DNSSEC trust anchors.

Message ID 20240423161226.973140-1-guix-devel-0brg6a@rdmp.org
State New
Headers show
Series [bug#68621,v2,1/4] gnu: knot-resolver: Re-enable default DNSSEC trust anchors. | expand

Commit Message

Dale Mellor April 23, 2024, 4:12 p.m. UTC 
From: Leo Nikkilä <hello@lnikki.la>

* gnu/packages/dns.scm (knot-resolver) [#:configure-flags]: Configure
root keys and managed TA.
[#:phases] Remove `'disable-default-ta', add `'install-root-keys'.
---
 gnu/packages/dns.scm | 20 +++++++++++++-------
 1 file changed, 13 insertions(+), 7 deletions(-)
diff mbox series

Patch

diff --git a/gnu/packages/dns.scm b/gnu/packages/dns.scm
index 36d3eb8b7e..947a6e89ba 100644
--- a/gnu/packages/dns.scm
+++ b/gnu/packages/dns.scm
@@ -995,15 +995,13 @@  (define-public knot-resolver
     (build-system meson-build-system)
     (outputs '("out" "doc"))
     (arguments
-     '(#:configure-flags '("-Ddoc=enabled")
+     `(#:configure-flags
+       '("-Ddoc=enabled"
+         "-Dinstall_root_keys=disabled" ; installed manually outside store
+         "-Dkeyfile_default=/var/cache/knot-resolver/root.keys"
+         "-Dmanaged_ta=enabled")
        #:phases
        (modify-phases %standard-phases
-         (add-before 'configure 'disable-default-ta
-           (lambda _
-             ;;  Disable the default managed root TA, since we don't have
-             ;;  write access to the keyfile and its directory in store.
-             (substitute* "daemon/lua/sandbox.lua.in"
-               (("^trust_anchors\\.add_file.*") ""))))
          (add-after 'build 'build-doc
            (lambda _
              (invoke "ninja" "doc")))
@@ -1021,6 +1019,14 @@  (define-public knot-resolver
                 '("doc/knot-resolver/examples"
                   "doc/knot-resolver/html"
                   "info")))))
+         (add-after 'install 'install-root-keys
+           (lambda* (#:key outputs #:allow-other-keys)
+             (let ((dir (string-append (assoc-ref outputs "out")
+                                       "/etc/knot-resolver")))
+               (mkdir-p dir)
+               (install-file (string-append "../knot-resolver-" ,version
+                                            "/etc/root.keys")
+                             dir))))
          (add-after 'install 'wrap-binary
            (lambda* (#:key inputs outputs #:allow-other-keys)
              (let* ((out (assoc-ref outputs "out"))