Update upstream servers to zus.nlnetlabs.nl.

Upstream servers no longer have the original IP addresses or that hash. Fix addresses to working set actually instead of uncommenting the very old set. The set were changed in 2014 by upstream commit bafdcd5.
Remove fedora specific servers, fallback to upstream server
2023-07-25 11:37:35 +02:00 · 2023-07-25 09:24:21 +02:00 · 2023-07-25 09:21:19 +02:00 · 2023-07-25 09:21:19 +02:00 · 2023-06-16 07:08:01 +02:00
3 changed files with 19 additions and 47 deletions
--- a/dnssec-trigger-default.conf
+++ b/dnssec-trigger-default.conf
@ -72,28 +72,10 @@ url: "http://fedoraproject.org/static/hotspot.txt OK"
 # hash is output of openssl x509 -sha256 -fingerprint -in server.pem
 # You can add more with extra config lines.

-# Provided by fedoraproject.org, #fedora-admin
-# It is provided on a best effort basis, with no service guarantee.
-ssl443: 140.211.169.201 A8:3E:DA:F0:12:82:55:7E:60:B5:B5:56:F1:66:BB:13:A8:BD:FC:B4:51:41:C0:F2:E7:8E:7B:64:AA:87:E6:F2
-tcp80:  140.211.169.201
-ssl443: 8.43.85.74 A8:3E:DA:F0:12:82:55:7E:60:B5:B5:56:F1:66:BB:13:A8:BD:FC:B4:51:41:C0:F2:E7:8E:7B:64:AA:87:E6:F2
-tcp80:  8.43.85.74
-ssl443: 152.19.134.150 A8:3E:DA:F0:12:82:55:7E:60:B5:B5:56:F1:66:BB:13:A8:BD:FC:B4:51:41:C0:F2:E7:8E:7B:64:AA:87:E6:F2
-tcp80:  152.19.134.150 
-ssl443: 2610:28:3090:3001:dead:beef:cafe:fed9 A8:3E:DA:F0:12:82:55:7E:60:B5:B5:56:F1:66:BB:13:A8:BD:FC:B4:51:41:C0:F2:E7:8E:7B:64:AA:87:E6:F2
-tcp80:  2610:28:3090:3001:dead:beef:cafe:fed9 
-
-# provided by Paul Wouters (pwouters@redhat.com)
-# It is provided on a best effort basis, with no service guarantee.
-# tcp80:  193.110.157.123
-# tcp80:  2001:888:2003:1004::123
-# ssl443: 193.110.157.123 16:41:49:E0:9D:62:CD:DB:79:A7:2B:71:58:C4:D5:E8:70:FA:BF:4D:6D:36:CC:07:35:33:C0:16:17:1B:61:E7
-# ssl443: 2001:888:2003:1004::123 16:41:49:E0:9D:62:CD:DB:79:A7:2B:71:58:C4:D5:E8:70:FA:BF:4D:6D:36:CC:07:35:33:C0:16:17:1B:61:E7
-
 # provided by NLnetLabs (www.nlnetlabs.nl)
 # It is provided on a best effort basis, with no service guarantee.
-# tcp80: 213.154.224.3
-# tcp80: 2001:7b8:206:1:bb::
-# ssl443: 213.154.224.3 DC:22:7B:1C:00:1A:CE:C5:48:49:B1:E3:30:DE:61:93:61:12:4E:CB:5C:B4:33:C4:BC:75:8C:D6:16:9D:F0:9F
-# ssl443: 2001:7b8:206:1:bb:: DC:22:7B:1C:00:1A:CE:C5:48:49:B1:E3:30:DE:61:93:61:12:4E:CB:5C:B4:33:C4:BC:75:8C:D6:16:9D:F0:9F
+tcp80: 185.49.140.67
+tcp80: 2a04:b900::10:0:0:67
+ssl443: 185.49.140.67 7E:CF:B4:BE:B9:9A:56:0D:F7:3B:40:51:A4:78:E6:A6:FD:66:0F:10:58:DC:A8:2E:C0:43:D4:77:5A:71:8A:CF
+ssl443: 2a04:b900::10:0:0:67 7E:CF:B4:BE:B9:9A:56:0D:F7:3B:40:51:A4:78:E6:A6:FD:66:0F:10:58:DC:A8:2E:C0:43:D4:77:5A:71:8A:CF

--- a/dnssec-trigger-workstation.conf
+++ b/dnssec-trigger-workstation.conf
@ -74,28 +74,9 @@ control-cert-file: "/etc/dnssec-trigger/dnssec_trigger_control.pem"
 # hash is output of openssl x509 -sha256 -fingerprint -in server.pem
 # You can add more with extra config lines.

-# Provided by fedoraproject.org, #fedora-admin
-# It is provided on a best effort basis, with no service guarantee.
-ssl443: 140.211.169.201 A8:3E:DA:F0:12:82:55:7E:60:B5:B5:56:F1:66:BB:13:A8:BD:FC:B4:51:41:C0:F2:E7:8E:7B:64:AA:87:E6:F2
-tcp80:  140.211.169.201
-ssl443: 8.43.85.74 A8:3E:DA:F0:12:82:55:7E:60:B5:B5:56:F1:66:BB:13:A8:BD:FC:B4:51:41:C0:F2:E7:8E:7B:64:AA:87:E6:F2
-tcp80:  8.43.85.74
-ssl443: 152.19.134.150 A8:3E:DA:F0:12:82:55:7E:60:B5:B5:56:F1:66:BB:13:A8:BD:FC:B4:51:41:C0:F2:E7:8E:7B:64:AA:87:E6:F2
-tcp80:  152.19.134.150 
-ssl443: 2610:28:3090:3001:dead:beef:cafe:fed9 A8:3E:DA:F0:12:82:55:7E:60:B5:B5:56:F1:66:BB:13:A8:BD:FC:B4:51:41:C0:F2:E7:8E:7B:64:AA:87:E6:F2
-tcp80:  2610:28:3090:3001:dead:beef:cafe:fed9 
-
-# provided by Paul Wouters (pwouters@redhat.com)
-# It is provided on a best effort basis, with no service guarantee.
-# tcp80:  193.110.157.123
-# tcp80:  2001:888:2003:1004::123
-# ssl443: 193.110.157.123 16:41:49:E0:9D:62:CD:DB:79:A7:2B:71:58:C4:D5:E8:70:FA:BF:4D:6D:36:CC:07:35:33:C0:16:17:1B:61:E7
-# ssl443: 2001:888:2003:1004::123 16:41:49:E0:9D:62:CD:DB:79:A7:2B:71:58:C4:D5:E8:70:FA:BF:4D:6D:36:CC:07:35:33:C0:16:17:1B:61:E7
-
 # provided by NLnetLabs (www.nlnetlabs.nl)
 # It is provided on a best effort basis, with no service guarantee.
-# tcp80: 213.154.224.3
-# tcp80: 2001:7b8:206:1:bb::
-# ssl443: 213.154.224.3 DC:22:7B:1C:00:1A:CE:C5:48:49:B1:E3:30:DE:61:93:61:12:4E:CB:5C:B4:33:C4:BC:75:8C:D6:16:9D:F0:9F
-# ssl443: 2001:7b8:206:1:bb:: DC:22:7B:1C:00:1A:CE:C5:48:49:B1:E3:30:DE:61:93:61:12:4E:CB:5C:B4:33:C4:BC:75:8C:D6:16:9D:F0:9F
-
+tcp80: 185.49.140.67
+tcp80: 2a04:b900::10:0:0:67
+ssl443: 185.49.140.67 7E:CF:B4:BE:B9:9A:56:0D:F7:3B:40:51:A4:78:E6:A6:FD:66:0F:10:58:DC:A8:2E:C0:43:D4:77:5A:71:8A:CF
+ssl443: 2a04:b900::10:0:0:67 7E:CF:B4:BE:B9:9A:56:0D:F7:3B:40:51:A4:78:E6:A6:FD:66:0F:10:58:DC:A8:2E:C0:43:D4:77:5A:71:8A:CF
--- a/dnssec-trigger.spec
+++ b/dnssec-trigger.spec
@ -5,7 +5,7 @@
 Summary: Tool for dynamic reconfiguration of validating resolver Unbound
 Name: dnssec-trigger
 Version: 0.17
-Release: 8%{?snapshot:.%{snapshot}git}%{?dist}
+Release: 11%{?snapshot:.%{snapshot}git}%{?dist}
 License: BSD
 Url: https://www.nlnetlabs.nl/projects/dnssec-trigger/

@ -187,7 +187,7 @@ fi
 %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/%{name}/dnssec-trigger-default.conf
 %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/%{name}/dnssec-trigger-workstation.conf
 %attr(0755,root,root) %dir %{_sysconfdir}/ssh/ssh_config.d
-%attr(0755,root,root) %config(noreplace) %{_sysconfdir}/ssh/ssh_config.d/10-%{name}.conf
+%attr(0644,root,root) %config(noreplace) %{_sysconfdir}/ssh/ssh_config.d/10-%{name}.conf
 %dir %{_localstatedir}/run/%{name}
 %{_tmpfilesdir}/%{name}.conf
 %{_mandir}/man8/dnssec-trigger*
@ -201,6 +201,15 @@ fi


 %changelog
+* Tue Jul 25 2023 Petr Menšík <pemensik@redhat.com> - 0.17-11
+- Update upstream servers to zus.nlnetlabs.nl.
+
+* Tue Jul 25 2023 Petr Menšík <pemensik@redhat.com> - 0.17-10
+- Remove fedora specific servers, fallback to upstream server
+
+* Thu Jun 15 2023 Todd Zullinger <tmz@pobox.com> - 0.17-9
+- Remove execute bit on ssh_config.d snippet
+
 * Thu Jul 21 2022 Fedora Release Engineering <releng@fedoraproject.org> - 0.17-8
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
Author	SHA1	Message	Date
Petr Menšík	83370a1698	Update upstream servers to zus.nlnetlabs.nl. Upstream servers no longer have the original IP addresses or that hash. Fix addresses to working set actually instead of uncommenting the very old set. The set were changed in 2014 by upstream commit bafdcd5.	2023-07-25 11:37:35 +02:00
Petr Menšík	0cbfae322a	Remove fedora specific servers, fallback to upstream server	2023-07-25 09:24:21 +02:00
Petr Menšík	c39ba6da7b	Remove Paul's servers They seem to be offline as well. (cherry picked from commit `417bf7426e`)	2023-07-25 09:21:19 +02:00
Petr Menšík	6e7ba4030c	Remove fedora specific servers These servers had not been actively maintained for years. Because we even haven't found some of them had too strict firewall. Direct few users that need them to upstream provided servers. (cherry picked from commit `1c7856199c`)	2023-07-25 09:21:19 +02:00
Todd Zullinger	297a400d1c	Remove execute bit on ssh_config.d snippet There is no need for the file to be executable. It's installed without the execute bit but the %attr() overrides that, unintentionally, I presume.	2023-06-16 07:08:01 +02:00