GNU bug report logs - #68620
[PATCH 1/2] gnu: knot-resolver: Re-enable default DNSSEC trust anchors.

Previous Next

To add a comment to this bug, you must first unarchive it, by sending
a message to control AT debbugs.gnu.org, with unarchive 68620 in the body.
You can then email your comments to 68620 AT debbugs.gnu.org in the normal way.

Toggle the display of automated, internal messages from the tracker.

Message #5 received at submit <at> debbugs.gnu.org (full text, mbox):

From: Leo Nikkilä <hello <at> lnikki.la>
To: guix-patches <at> gnu.org
Cc: Leo Nikkilä <hello <at> lnikki.la>
Subject: [PATCH 1/2] gnu: knot-resolver: Re-enable default DNSSEC trust
 anchors.
Date: Sat, 20 Jan 2024 23:23:43 +0200

* gnu/packages/dns.scm (knot-resolver) [#:configure-flags]: Configure
root keys and managed TA.
[#:phases] Remove `'disable-default-ta', add `'install-root-keys'.
---
 gnu/packages/dns.scm | 20 +++++++++++++-------
 1 file changed, 13 insertions(+), 7 deletions(-)

diff --git a/gnu/packages/dns.scm b/gnu/packages/dns.scm
index 73a2fac54b..9783e560fa 100644
--- a/gnu/packages/dns.scm
+++ b/gnu/packages/dns.scm
@@ -994,15 +994,13 @@ (define-public knot-resolver
     (build-system meson-build-system)
     (outputs '("out" "doc"))
     (arguments
-     '(#:configure-flags '("-Ddoc=enabled")
+     `(#:configure-flags
+       '("-Ddoc=enabled"
+         "-Dinstall_root_keys=disabled" ; installed manually outside store
+         "-Dkeyfile_default=/var/cache/knot-resolver/root.keys"
+         "-Dmanaged_ta=enabled")
        #:phases
        (modify-phases %standard-phases
-         (add-before 'configure 'disable-default-ta
-           (lambda _
-             ;;  Disable the default managed root TA, since we don't have
-             ;;  write access to the keyfile and its directory in store.
-             (substitute* "daemon/lua/sandbox.lua.in"
-               (("^trust_anchors\\.add_file.*") ""))))
          (add-after 'build 'build-doc
            (lambda _
              (invoke "ninja" "doc")))
@@ -1020,6 +1018,14 @@ (define-public knot-resolver
                 '("doc/knot-resolver/examples"
                   "doc/knot-resolver/html"
                   "info")))))
+         (add-after 'install 'install-root-keys
+           (lambda* (#:key outputs #:allow-other-keys)
+             (let ((dir (string-append (assoc-ref outputs "out")
+                                       "/etc/knot-resolver")))
+               (mkdir-p dir)
+               (install-file (string-append "../knot-resolver-" ,version
+                                            "/etc/root.keys")
+                             dir))))
          (add-after 'install 'wrap-binary
            (lambda* (#:key inputs outputs #:allow-other-keys)
              (let* ((out (assoc-ref outputs "out"))
-- 
2.41.0

Message #8 received at 68620 <at> debbugs.gnu.org (full text, mbox):

From: Dale Mellor <guix-devel-0brg6a <at> rdmp.org>
To: 68620 <at> debbugs.gnu.org
Subject: Moved into 68621
Date: Tue, 23 Apr 2024 17:21:27 +0100

This patch belongs to issue 68621, closing this one.

Message #13 received at 68620 <at> debbugs.gnu.org (full text, mbox):

From: Dale Mellor <"	guix-devel-0brg6a"@rdmp.org>
To: 68620 <at> debbugs.gnu.org
Subject: Moved into 68621
Date: Tue, 23 Apr 2024 17:04:55 +0100

This patch belongs to issue 68621, closing here.

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.