diff --git a/.gitignore b/.gitignore deleted file mode 100644 index 51e13d0..0000000 --- a/.gitignore +++ /dev/null @@ -1,2 +0,0 @@ -/knot-resolver-*.tar.xz -/knot-resolver-*.tar.xz.asc diff --git a/dead.package b/dead.package new file mode 100644 index 0000000..a72aec0 --- /dev/null +++ b/dead.package @@ -0,0 +1 @@ +epel8-playground decommissioned : https://pagure.io/epel/issue/136 diff --git a/gating.yml b/gating.yml deleted file mode 100644 index f075ad7..0000000 --- a/gating.yml +++ /dev/null @@ -1,15 +0,0 @@ ---- !Policy -product_versions: - - fedora-* -decision_context: bodhi_update_push_testing -subject_type: koji_build -rules: - - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.tier0.functional} - ---- !Policy -product_versions: - - fedora-* -decision_context: bodhi_update_push_stable -subject_type: koji_build -rules: - - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.tier0.functional} diff --git a/knot-resolver.spec b/knot-resolver.spec deleted file mode 100644 index 6dcd618..0000000 --- a/knot-resolver.spec +++ /dev/null @@ -1,1218 +0,0 @@ -%global _hardened_build 1 -%{!?_pkgdocdir: %global _pkgdocdir %{_docdir}/%{name}} - -%define GPG_CHECK 1 -%define repodir %{_builddir}/%{name}-%{version} -%define NINJA ninja-build - -Name: knot-resolver -Version: 5.7.6 -Release: 3%{?dist} -Summary: Caching full DNS Resolver - -License: GPL-3.0-or-later -URL: https://www.knot-resolver.cz/ -Source0: https://secure.nic.cz/files/%{name}/%{name}-%{version}.tar.xz - -# LuaJIT only on these arches -%if 0%{?rhel} == 7 -# RHEL 7 does not have aarch64 LuaJIT -ExclusiveArch: %{ix86} x86_64 -%else -ExclusiveArch: %{arm} aarch64 %{ix86} x86_64 -%endif - -%if 0%{GPG_CHECK} -Source1: https://secure.nic.cz/files/%{name}/%{name}-%{version}.tar.xz.asc -# PGP keys used to sign upstream releases -# Export with --armor using command from https://fedoraproject.org/wiki/PackagingDrafts:GPGSignatures -# Don't forget to update %%prep section when adding/removing keys -# This key is from: https://secure.nic.cz/files/knot-resolver/kresd-keyblock.asc -Source100: kresd-keyblock.asc -BuildRequires: gnupg2 -%endif - -BuildRequires: gcc -BuildRequires: gcc-c++ -BuildRequires: meson -BuildRequires: pkgconfig(cmocka) -BuildRequires: pkgconfig(gnutls) -BuildRequires: pkgconfig(libedit) -BuildRequires: pkgconfig(libknot) >= 3.0.2 -BuildRequires: pkgconfig(libzscanner) >= 3.0.2 -BuildRequires: pkgconfig(libdnssec) >= 3.0.2 -BuildRequires: pkgconfig(libnghttp2) -BuildRequires: pkgconfig(libsystemd) -BuildRequires: pkgconfig(libcap-ng) -BuildRequires: pkgconfig(libuv) -BuildRequires: pkgconfig(luajit) >= 2.0 -BuildRequires: pkgconfig(jemalloc) -BuildRequires: systemd-rpm-macros - -Requires: systemd -Requires(post): systemd - -# dnstap module dependencies -# SUSE is missing protoc protobuf compiler -%if "x%{?suse_version}" == "x" -BuildRequires: pkgconfig(libfstrm) -BuildRequires: pkgconfig(libprotobuf-c) -%endif - -# Distro-dependent dependencies -%if 0%{?rhel} == 7 -BuildRequires: lmdb-devel -# Lua 5.1 version of the libraries have different package names -Requires: lua-basexx -Requires: lua-psl -Requires: lua-http -%endif -%if 0%{?fedora} || 0%{?rhel} > 7 -BuildRequires: pkgconfig(lmdb) -BuildRequires: python3-sphinx -Requires: lua5.1-basexx -Requires: lua5.1-cqueues -Requires: lua5.1-http -Recommends: lua5.1-psl -%endif - -# we do not build HTTP module on SuSE so the build requires is not needed -%if "x%{?suse_version}" == "x" -BuildRequires: openssl-devel -%endif - -%if 0%{?suse_version} -%define NINJA ninja -BuildRequires: lmdb-devel -BuildRequires: python3-Sphinx -Requires(pre): shadow -%endif - -%if "x%{?rhel}" == "x" -# dependencies for doc package -# NOTE: doc isn't possible to build on CentOS 7, 8 -# python2-sphinx is too old and python36-breathe is broken on CentOS 7 -# python3-breathe isn't available for CentOS 8 (yet? rhbz#1808766) -BuildRequires: doxygen -BuildRequires: python3-breathe -BuildRequires: python3-sphinx_rtd_theme -BuildRequires: texinfo -%endif - -%description -The Knot Resolver is a DNSSEC-enabled caching full resolver implementation -written in C and LuaJIT, including both a resolver library and a daemon. -Modular architecture of the library keeps the core tiny and efficient, and -provides a state-machine like API for extensions. - -The package is pre-configured as local caching resolver. -To start using it, start a single kresd instance: -$ systemctl start kresd@1.service - -%package devel -Summary: Development headers for Knot Resolver -Requires: %{name}%{?_isa} = %{version}-%{release} - -%description devel -The package contains development headers for Knot Resolver. - -%if "x%{?rhel}" == "x" -%package doc -Summary: Documentation for Knot Resolver -BuildArch: noarch -Requires: %{name} = %{version}-%{release} - -%description doc -Documentation for Knot Resolver -%endif - -%if "x%{?suse_version}" == "x" -%package module-dnstap -Summary: dnstap module for Knot Resolver -Requires: %{name} = %{version}-%{release} - -%description module-dnstap -dnstap module for Knot Resolver supports logging DNS responses to a unix socket -in dnstap format using fstrm framing library. This logging is useful if you -need effectively log all DNS traffic. -%endif - -%if "x%{?suse_version}" == "x" -%package module-http -Summary: HTTP module for Knot Resolver -Requires: %{name} = %{version}-%{release} -%if 0%{?fedora} || 0%{?rhel} > 7 -Requires: lua5.1-http -Requires: lua5.1-mmdb -%else -Requires: lua-http -Requires: lua-mmdb -%endif - -%description module-http -HTTP module for Knot Resolver can serve as API endpoint for other modules or -provide a web interface for local visualization of the resolver cache and -queries. It can also serve DNS-over-HTTPS, but it is deprecated in favor of -native C implementation, which doesn't require this package. -%endif - -%prep -%if 0%{GPG_CHECK} -export GNUPGHOME=./gpg-keyring -mkdir -m 700 ${GNUPGHOME} -gpg2 --import %{SOURCE100} -gpg2 --verify %{SOURCE1} %{SOURCE0} -%endif -%setup -q -n %{name}-%{version} - -# Create a sysusers.d config file -cat >knot-resolver.sysusers.conf </dev/null | grep -qv masked ; then - systemctl show ${sock} -p Listen > ${UPG_DIR}/${sock} - case "$(systemctl show ${sock} -p BindIPv6Only)" in - *ipv6-only) - touch ${UPG_DIR}/${sock}.v6only - ;; - *default) - if cat /proc/sys/net/ipv6/bindv6only | grep -q 1 ; then - touch ${UPG_DIR}/${sock}.v6only - fi - ;; - esac - fi - done -fi -%endif - - -%post -# upgrade-4-to-5 -%if "x%{?rhel}" == "x" -export UPG_DIR=%{_sharedstatedir}/knot-resolver/.upgrade-4-to-5 -if [ -f ${UPG_DIR}/.unfinished ] ; then - rm -f ${UPG_DIR}/.unfinished - kresd -c %{_libdir}/knot-resolver/upgrade-4-to-5.lua &>/dev/null - echo -e "\n !!! WARNING !!!" - echo -e "Knot Resolver configuration file requires manual upgrade.\n" - cat ${UPG_DIR}/kresd.conf.net 2>/dev/null -fi -%endif - -# 5.0.1 fix to force restart of kres-cache-gc.service, which was missing in systemd_postun_with_restart -# TODO: remove once most users upgrade to 5.0.1+ -systemctl daemon-reload >/dev/null 2>&1 || : -if [ $1 -ge 2 ] ; then - systemctl try-restart kres-cache-gc.service >/dev/null 2>&1 || : -fi - -# systemd_post macro is not needed for anything (calls systemctl preset) -%tmpfiles_create %{_tmpfilesdir}/knot-resolver.conf -%if "x%{?fedora}" == "x" -/sbin/ldconfig -%endif - -%preun -%systemd_preun kres-cache-gc.service kresd.target - -%postun -%systemd_postun_with_restart 'kresd@*.service' kres-cache-gc.service -%if "x%{?fedora}" == "x" -/sbin/ldconfig -%endif - -%files -%dir %{_pkgdocdir} -%license %{_pkgdocdir}/COPYING -%doc %{_pkgdocdir}/AUTHORS -%doc %{_pkgdocdir}/NEWS -%doc %{_pkgdocdir}/examples -%dir %{_sysconfdir}/knot-resolver -%config(noreplace) %{_sysconfdir}/knot-resolver/kresd.conf -%config(noreplace) %{_sysconfdir}/knot-resolver/root.hints -%{_sysconfdir}/knot-resolver/icann-ca.pem -%attr(750,knot-resolver,knot-resolver) %dir %{_sharedstatedir}/knot-resolver -%attr(640,knot-resolver,knot-resolver) %{_sharedstatedir}/knot-resolver/root.keys -%{_unitdir}/kresd@.service -%{_unitdir}/kres-cache-gc.service -%{_unitdir}/kresd.target -%dir %{_unitdir}/multi-user.target.wants -%{_unitdir}/multi-user.target.wants/kresd.target -%{_mandir}/man7/kresd.systemd.7.gz -%{_tmpfilesdir}/knot-resolver.conf -%ghost /run/%{name} -%ghost %{_localstatedir}/cache/%{name} -%attr(750,knot-resolver,knot-resolver) %dir %{_libdir}/%{name} -%{_sbindir}/kresd -%{_sbindir}/kresc -%{_sbindir}/kres-cache-gc -%{_libdir}/libkres.so.* -%{_libdir}/knot-resolver/*.so -%{_libdir}/knot-resolver/*.lua -%dir %{_libdir}/knot-resolver/kres_modules -%{_libdir}/knot-resolver/kres_modules/bogus_log.so -%{_libdir}/knot-resolver/kres_modules/edns_keepalive.so -%{_libdir}/knot-resolver/kres_modules/extended_error.so -%{_libdir}/knot-resolver/kres_modules/hints.so -%{_libdir}/knot-resolver/kres_modules/nsid.so -%{_libdir}/knot-resolver/kres_modules/refuse_nord.so -%{_libdir}/knot-resolver/kres_modules/stats.so -%{_libdir}/knot-resolver/kres_modules/daf -%{_libdir}/knot-resolver/kres_modules/daf.lua -%{_libdir}/knot-resolver/kres_modules/detect_time_jump.lua -%{_libdir}/knot-resolver/kres_modules/detect_time_skew.lua -%{_libdir}/knot-resolver/kres_modules/dns64.lua -%if "x%{?suse_version}" == "x" -%{_libdir}/knot-resolver/kres_modules/experimental_dot_auth.lua -%endif -%{_libdir}/knot-resolver/kres_modules/graphite.lua -%{_libdir}/knot-resolver/kres_modules/policy.lua -%{_libdir}/knot-resolver/kres_modules/predict.lua -%{_libdir}/knot-resolver/kres_modules/prefill.lua -%{_libdir}/knot-resolver/kres_modules/priming.lua -%{_libdir}/knot-resolver/kres_modules/rebinding.lua -%{_libdir}/knot-resolver/kres_modules/renumber.lua -%{_libdir}/knot-resolver/kres_modules/serve_stale.lua -%{_libdir}/knot-resolver/kres_modules/ta_sentinel.lua -%{_libdir}/knot-resolver/kres_modules/ta_signal_query.lua -%{_libdir}/knot-resolver/kres_modules/ta_update.lua -%{_libdir}/knot-resolver/kres_modules/view.lua -%{_libdir}/knot-resolver/kres_modules/watchdog.lua -%{_libdir}/knot-resolver/kres_modules/workarounds.lua -%{_mandir}/man8/kresd.8.gz -%{_sysusersdir}/knot-resolver.conf - -%files devel -%{_includedir}/libkres -%{_libdir}/pkgconfig/libkres.pc -%{_libdir}/libkres.so - -%if "x%{?rhel}" == "x" -%files doc -%dir %{_pkgdocdir} -%doc %{_pkgdocdir}/html -%doc %{_datadir}/info/knot-resolver.info* -%dir %{_datadir}/info/knot-resolver-figures -%doc %{_datadir}/info/knot-resolver-figures/* -%endif - -%if "x%{?suse_version}" == "x" -%files module-dnstap -%{_libdir}/knot-resolver/kres_modules/dnstap.so -%endif - -%if "x%{?suse_version}" == "x" -%files module-http -%{_libdir}/knot-resolver/debug_opensslkeylog.so -%{_libdir}/knot-resolver/kres_modules/http -%{_libdir}/knot-resolver/kres_modules/http*.lua -%{_libdir}/knot-resolver/kres_modules/prometheus.lua -%endif - -%changelog -* Mon Oct 20 2025 Jakub Ružička - 5.7.6-3 -- Rebuilt for Knot DNS 3.5 - -* Thu Jul 24 2025 Fedora Release Engineering - 5.7.6-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild - -* Fri Jul 18 2025 Jakub Ružička - 5.7.6-1 -- New upstream version 5.7.6 - -* Thu Apr 24 2025 Jakub Ružička - 5.7.5-1 -- New upstream version 5.7.5 -- Remove duplicate file listing - -* Tue Feb 11 2025 Zbigniew Jędrzejewski-Szmek - 5.7.4-4 -- Add sysusers.d config file to allow rpm to create users/groups automatically - -* Fri Jan 17 2025 Fedora Release Engineering - 5.7.4-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild - -* Tue Nov 26 2024 Jakub Ružička - 5.7.4-2 -- Rebuilt for Knot DNS 3.4 - -* Wed Jul 24 2024 Jakub Ružička - 5.7.4-1 -- New upstream version 5.7.4 - -* Thu Jul 18 2024 Fedora Release Engineering - 5.7.3-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - -* Tue Jun 04 2024 Jakub Ružička - 5.7.3-1 -- New upstream version 5.7.3 - -* Wed Apr 03 2024 Jakub Ružička - 5.7.2-1 -- New upstream version 5.7.2 - -* Wed Feb 14 2024 Jakub Ružička - 5.7.1-1 -- New upstream version 5.7.1 - -* Thu Jan 25 2024 Fedora Release Engineering - 5.7.0-5 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - -* Sun Jan 21 2024 Fedora Release Engineering - 5.7.0-4 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - -* Thu Nov 09 2023 Jakub Ružička - 5.7.0-3 -- Rebuild for Fedora 40, Knot DNS 3.3.2 - -* Tue Aug 29 2023 Jakub Ružička - 5.7.0-2 -- Rebuilt for Knot DNS 3.3 - -* Tue Aug 22 2023 Jakub Ružička - 5.7.0-1 -- New upstream version 5.7.0 - -* Thu Jul 20 2023 Fedora Release Engineering - 5.6.0-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - -* Thu Jan 26 2023 Jakub Ružička - 5.6.0-1 -- update to upstream version 5.6.0 - -* Thu Jan 19 2023 Fedora Release Engineering - 5.5.3-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - -* Thu Sep 22 2022 Jakub Ružička - 5.5.3-1 -- update to upstream version 5.5.3 - -* Wed Aug 24 2022 Jakub Ružička - 5.5.2-1 -- update to upstream version 5.5.2 -- add BuildRequires: systemd-rpm-macros - -* Thu Jul 21 2022 Fedora Release Engineering - 5.5.1-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - -* Tue Jun 14 2022 Jakub Ružička - 5.5.1-1 -- update to upstream version 5.5.1 - -* Tue Mar 15 2022 Jakub Ružička - 5.5.0-1 -- update to upstream version 5.5.0 -- update upstream signing keys - -* Thu Jan 20 2022 Fedora Release Engineering - 5.4.4-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - -* Wed Jan 05 2022 Jakub Ružička - 5.4.4-1 -- update to upstream version 5.4.4 - -* Wed Dec 01 2021 Jakub Ružička - 5.4.3-1 -- update to upstream version 5.4.3 - -* Sat Nov 06 2021 Adrian Reber - 5.4.2-3 -- Rebuilt for protobuf 3.19.0 - -* Tue Oct 26 2021 Adrian Reber - 5.4.2-2 -- Rebuilt for protobuf 3.18.1 - -* Mon Oct 18 2021 Jakub Ružička - 5.4.2-1 -- update to upstream version 5.4.2 - -* Thu Aug 19 2021 Jakub Ružička - 5.4.1-1 -- update to upstream version 5.4.1 - -* Mon Aug 09 2021 Jakub Ružička - 5.4.0-2 -- rebuild for Knot DNS 3.1 (#1990583) - -* Thu Jul 29 2021 Jakub Ružička - 5.4.0-1 -- update to upstream version 5.4.0 - -* Thu Jul 22 2021 Fedora Release Engineering - 5.3.2-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - -* Fri May 07 2021 Jakub Ružička - 5.3.2-1 -- update to upstream version 5.3.2 - -* Thu Apr 01 2021 Jakub Ružička - 5.3.1-1 -- update to upstream version 5.3.1 - -* Tue Mar 02 2021 Zbigniew Jędrzejewski-Szmek - 5.3.0-2 -- Rebuilt for updated systemd-rpm-macros - See https://pagure.io/fesco/issue/2583. - -* Mon Mar 01 2021 Jakub Ružička - 5.3.0-1 -- update to upstream version 5.3.0 -- add dnstap module subpackage -- required Knot DNS >= 2.9 - -* Tue Jan 26 2021 Fedora Release Engineering - 5.2.1-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - -* Fri Dec 18 2020 Jakub Ružička - 5.2.1-1 -- update to upstream version 5.2.1 - -* Wed Nov 11 2020 Jakub Ružička 5.2.0-1 -- update to upstream version 5.2.0 -- sync packaging from upstream - -* Wed Sep 23 2020 Jakub Ružička 5.1.3-2 -- rebuild for Knot DNS 3.0.0 - -* Tue Sep 08 2020 Jakub Ružička 5.1.3-1 -- update to upstream version 5.1.3 - -* Tue Jul 28 2020 Fedora Release Engineering - 5.1.2-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - -* Wed Jul 01 2020 Tomas Krizek - 5.1.2-1 -- update to upstream version 5.1.2 - -* Tue May 19 2020 Tomas Krizek - 5.1.1-1 -- update to upstream version 5.1.1 (fixes CVE-2020-12667) - -* Wed Apr 29 2020 Tomas Krizek - 5.1.0-1 -- update to upstream version 5.1.0 -- make spec compatible with EPEL 8 (rhbz#1783252) -- support documentation build with Sphinx v3.0.0+ (rhbz#1823534) - -* Thu Apr 02 2020 Tomas Krizek - 5.0.1-2 -- add patch to fix strict aliasing (!971) until next release - -* Wed Feb 05 2020 Tomas Krizek - 5.0.1-1 -- update to upstream version 5.0.1 -- ensure kres-cache-gc.service is restarted on upgrade - -* Wed Jan 29 2020 Fedora Release Engineering - 5.0.0-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - -* Mon Jan 27 2020 Tomas Krizek - 5.0.0-1 -- update to new upstream version 5.0.0 -- removed systemd socket files (no longer supported) -- add upgrade scriptlets for 5.x -- remove lua-sec, lua-socket, lua-filesystem dependencies -- create tmpfiles dirs with macro - -* Wed Dec 04 2019 Tomas Krizek - 4.3.0-1 -- update to new upstream version 4.3.0 -- make config directory read-only for knot-resolver, relocate root.keys to /var/lib -- http module now depends on the exact same binary version of knot-resolver - -* Tue Nov 12 2019 Tomas Krizek - 4.2.2-2 -- rebuild for libknot10 (Knot DNS 2.9.1) - -* Mon Oct 07 2019 Tomas Krizek - 4.2.2-1 -- update to new upstream version 4.2.2 - -* Thu Sep 26 2019 Tomas Krizek - 4.2.1-1 -- update to new upstream version 4.2.1 - -* Wed Aug 21 2019 Tomas Krizek - 4.2.0-1 -- update to new upstream version 4.2.0 -- added lua-psl dependency for policy.slice() functionality - -* Thu Jul 25 2019 Fedora Release Engineering - 4.1.0-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild - -* Wed Jul 10 2019 Tomas Krizek - 4.1.0-1 -- update to new upstream version 4.1.0 -- add kres-cache-gc.service - -* Wed May 29 2019 Tomas Krizek - 4.0.0.-1 -- rebase to new upstream release 4.0.0 -- bump Knot DNS libraries to 2.8 (ABI compat) -- use new upstream build system - meson -- add knot-resolver-module-http package along with new lua dependecies - -* Fri Feb 01 2019 Fedora Release Engineering - 3.2.1-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild - -* Thu Jan 10 2019 Tomas Krizek - 3.2.1-1 -Knot Resolver 3.2.1 (2019-01-10) -================================ - -Bugfixes --------- -- trust_anchors: respect validity time range during TA bootstrap (!748) -- fix TLS rehandshake handling (!739) -- make TLS_FORWARD compatible with GnuTLS 3.3 (!741) -- special thanks to Grigorii Demidov for his long-term work on Knot Resolver! - -Improvements ------------- -- improve handling of timeouted outgoing TCP connections (!734) -- trust_anchors: check syntax of public keys in DNSKEY RRs (!748) -- validator: clarify message about bogus non-authoritative data (!735) -- dnssec validation failures contain more verbose reasoning (!735) -- new function trust_anchors.summary() describes state of DNSSEC TAs (!737), - and logs new state of trust anchors after start up and automatic changes -- trust anchors: refuse revoked DNSKEY even if specified explicitly, - and downgrade missing the SEP bit to a warning - - -* Mon Dec 17 2018 Tomas Krizek - 3.2.0-1 -Knot Resolver 3.2.0 (2018-12-17) -================================ - -New features ------------- -- module edns_keepalive to implement server side of RFC 7828 (#408) -- module nsid to implement server side of RFC 5001 (#289) -- module bogus_log provides .frequent() table (!629, credit Ulrich Wisser) -- module stats collects flags from answer messages (!629, credit Ulrich Wisser) -- module view supports multiple rules with identical address/TSIG specification - and keeps trying rules until a "non-chain" action is executed (!678) -- module experimental_dot_auth implements an DNS-over-TLS to auth protocol - (!711, credit Manu Bretelle) -- net.bpf bindings allow advanced users to use eBPF socket filters - -Bugfixes --------- -- http module: only run prometheus in parent process if using --forks=N, - as the submodule collects metrics from all sub-processes as well. -- TLS fixes for corner cases (!700, !714, !716, !721, !728) -- fix build with -DNOVERBOSELOG (#424) -- policy.{FORWARD,TLS_FORWARD,STUB}: respect net.ipv{4,6} setting (!710) -- avoid SERVFAILs due to certain kind of NS dependency cycles, again - (#374) this time seen as 'circular dependency' in verbose logs -- policy and view modules do not overwrite result finished requests (!678) - -Improvements ------------- -- Dockerfile: rework, basing on Debian instead of Alpine -- policy.{FORWARD,TLS_FORWARD,STUB}: give advantage to IPv6 - when choosing whom to ask, just as for iteration -- use pseudo-randomness from gnutls instead of internal ISAAC (#233) -- tune the way we deal with non-responsive servers (!716, !723) -- documentation clarifies interaction between policy and view modules (!678, !730) - -Module API changes ------------------- -- new layer is added: answer_finalize -- kr_request keeps ::qsource.packet beyond the begin layer -- kr_request::qsource.tcp renamed to ::qsource.flags.tcp -- kr_request::has_tls renamed to ::qsource.flags.tls -- kr_zonecut_add(), kr_zonecut_del() and kr_nsrep_sort() changed parameters slightly - - -* Fri Nov 02 2018 Tomas Krizek - 3.1.0-1 -Knot Resolver 3.1.0 (2018-11-02) -================================ - -Incompatible changes --------------------- -- hints.use_nodata(true) by default; that's what most users want -- libknot >= 2.7.2 is required - -Improvements ------------- -- cache: handle out-of-space SIGBUS slightly better (#197) -- daemon: improve TCP timeout handling (!686) - -Bugfixes --------- -- cache.clear('name'): fix some edge cases in API (#401) -- fix error handling from TLS writes (!669) -- avoid SERVFAILs due to certain kind of NS dependency cycles (#374) - -* Mon Aug 20 2018 Tomas Krizek - 3.0.0-1 -Knot Resolver 3.0.0 (2018-08-20) -================================ - -Incompatible changes --------------------- -- cache: fail lua operations if cache isn't open yet (!639) - By default cache is opened *after* reading the configuration, - and older versions were silently ignoring cache operations. - Valid configuration must open cache using `cache.open()` or `cache.size =` - before executing cache operations like `cache.clear()`. -- libknot >= 2.7.1 is required, which brings also larger API changes -- in case you wrote custom Lua modules, please consult - https://knot-resolver.readthedocs.io/en/latest/lib.html#incompatible-changes-since-3-0-0 -- in case you wrote custom C modules, please see compile against - Knot DNS 2.7 and adjust your module according to messages from C compiler -- DNS cookie module (RFC 7873) is not available in this release, - it will be later reworked to reflect development in IEFT dnsop working group -- version module was permanently removed because it was not really used by users; - if you want to receive notifications abou new releases please subscribe to - https://lists.nic.cz/cgi-bin/mailman/listinfo/knot-resolver-announce - -Bugfixes --------- -- fix multi-process race condition in trust anchor maintenance (!643) -- ta_sentinel: also consider static trust anchors not managed via RFC 5011 - -Improvements ------------- -- reorder_RR() implementation is brought back -- bring in performace improvements provided by libknot 2.7 -- cache.clear() has a new, more powerful API -- cache documentation was improved -- old name "Knot DNS Resolver" is replaced by unambiguous "Knot Resolver" - to prevent confusion with "Knot DNS" authoritative server - -* Thu Aug 02 2018 Tomas Krizek - 2.4.1-1 -Knot Resolver 2.4.1 (2018-08-02) -================================ - -Security --------- -- fix CVE-2018-10920: Improper input validation bug in DNS resolver component - (security!7, security!9) - -Bugfixes --------- -- cache: fix TTL overflow in packet due to min_ttl (#388, security!8) -- TLS session resumption: avoid bad scheduling of rotation (#385) -- HTTP module: fix a regression in 2.4.0 which broke custom certs (!632) -- cache: NSEC3 negative cache even without NS record (#384) - This fixes lower hit rate in NSEC3 zones (since 2.4.0). -- minor TCP and TLS fixes (!623, !624, !626) - - -* Fri Jul 13 2018 Fedora Release Engineering - 2.4.0-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild - -* Tue Jul 03 2018 Tomas Krizek - 2.4.0-1 -Knot Resolver 2.4.0 (2018-07-03) -================================ - -Incompatible changes --------------------- -- minimal libknot version is now 2.6.7 to pull in latest fixes (#366) - -Security --------- -- fix a rare case of zones incorrectly dowgraded to insecure status (!576) - -New features ------------- -- TLS session resumption (RFC 5077), both server and client (!585, #105) - (disabled when compiling with gnutls < 3.5) -- TLS_FORWARD policy uses system CA certificate store by default (!568) -- aggressive caching for NSEC3 zones (!600) -- optional protection from DNS Rebinding attack (module rebinding, !608) -- module bogus_log to log DNSSEC bogus queries without verbose logging (!613) - -Bugfixes --------- -- prefill: fix ability to read certificate bundle (!578) -- avoid turning off qname minimization in some cases, e.g. co.uk. (#339) -- fix validation of explicit wildcard queries (#274) -- dns64 module: more properties from the RFC implemented (incl. bug #375) - -Improvements ------------- -- systemd: multiple enabled kresd instances can now be started using kresd.target -- ta_sentinel: switch to version 14 of the RFC draft (!596) -- support for glibc systems with a non-Linux kernel (!588) -- support per-request variables for Lua modules (!533) -- support custom HTTP endpoints for Lua modules (!527) - - -* Mon Apr 23 2018 Tomas Krizek - 2.3.0-1 -Knot Resolver 2.3.0 (2018-04-23) -================================ - -Security --------- -- fix CVE-2018-1110: denial of service triggered by malformed DNS messages - (!550, !558, security!2, security!4) -- increase resilience against slow lorris attack (security!5) - -Bugfixes --------- -- validation: fix SERVFAIL in case of CNAME to NXDOMAIN in a single zone (!538) -- validation: fix SERVFAIL for DS . query (!544) -- lib/resolve: don't send unecessary queries to parent zone (!513) -- iterate: fix validation for zones where parent and child share NS (!543) -- TLS: improve error handling and documentation (!536, !555, !559) - -Improvements ------------- -- prefill: new module to periodically import root zone into cache - (replacement for RFC 7706, !511) -- network_listen_fd: always create end point for supervisor supplied file descriptor -- use CPPFLAGS build environment variable if set (!547) - - -* Wed Mar 28 2018 Tomas Krizek - 2.2.0-1 -Knot Resolver 2.2.0 (2018-03-28) -================================ - -New features ------------- -- cache server unavailability to prevent flooding unreachable servers - (Please note that caching algorithm needs further optimization - and will change in further versions but we need to gather operational - experience first.) - -Bugfixes --------- -- don't magically -D_FORTIFY_SOURCE=2 in some cases -- allow large responses for outbound over TCP -- fix crash with RR sets with over 255 records - - -* Mon Feb 26 2018 Tomas Krizek - 2.1.1-1 -Knot Resolver 2.1.1 (2018-02-23) -================================ - -Bugfixes --------- -- when iterating, avoid unnecessary queries for NS in insecure parent. - This problem worsened in 2.0.0. (#246) -- prevent UDP packet leaks when using TLS forwarding -- fix the hints module also on some other systems, e.g. Gentoo. - -* Fri Feb 16 2018 Tomas Krizek - 2.1.0-1 -- New upstream release 2.1.0 - -Knot Resolver 2.1.0 (2018-02-16) -================================ - -Incompatible changes --------------------- -- stats: remove tracking of expiring records (predict uses another way) -- systemd: more chages in default unit files (TODO) -- ta_sentinel: implement protocol draft-ietf-dnsop-kskroll-sentinel-01 - (our draft-ietf-dnsop-kskroll-sentinel-00 implementation had inverted logic) -- libknot: require version 2.6.4 or newer to get bugfixes for DNS-over-TLS - -Bugfixes --------- -- detect_time_jump module: don't clear cache on suspend-resume (#284) -- stats module: fix stats.list() returning nothing, regressed in 2.0.0 -- policy.TLS_FORWARD: refusal when configuring with multiple IPs (#306) -- cache: fix broken refresh of insecure records that were about to expire -- fix the hints module on some systems, e.g. Fedora (came back on 2.0.0) -- build with older gnutls (conditionally disable features) -- fix the predict module to work with insecure records & cleanup code - - -Knot Resolver 2.0.0 (2018-01-31) -================================ - -Incompatible changes --------------------- -- systemd: change unit files to allow running multiple instances, - deployments with single instance now must use `kresd@1.service` - instead of `kresd.service`; see kresd.systemd(8) for details -- systemd: the directory for cache is now /var/cache/knot-resolver -- unify default directory and user to `knot-resolver` -- directory with trust anchor file specified by -k option must be writeable -- policy module is now loaded by default to enforce RFC 6761; - see documentation for policy.PASS if you use locally-served DNS zones -- drop support for alternative cache backends memcached, redis, - and for Lua bindings for some specific cache operations -- REORDER_RR option is not implemented (temporarily) - -New features ------------- -- aggressive caching of validated records (RFC 8198) for NSEC zones; - thanks to ICANN for sponsoring this work. -- forwarding over TLS, authenticated by SPKI pin or certificate. - policy.TLS_FORWARD pipelines queries out-of-order over shared TLS connection - Beware: Some resolvers do not support out-of-order query processing. - TLS forwarding to such resolvers will lead to slower resolution or failures. -- trust anchors: you may specify a read-only file via -K or --keyfile-ro -- trust anchors: at build-time you may set KEYFILE_DEFAULT (read-only) -- ta_sentinel module implements draft ietf-dnsop-kskroll-sentinel-00, - enabled by default -- serve_stale module is prototype, subject to change -- extended API for Lua modules - -Bugfixes --------- -- fix build on osx - regressed in 1.5.3 (different linker option name) - -* Wed Feb 07 2018 Fedora Release Engineering - 1.5.3-1.1 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild - -* Tue Jan 23 2018 Tomas Krizek - 1.5.3-1 -- New upstream release 1.5.3 - -Knot Resolver 1.5.3 (2018-01-23) -================================ - -Bugfixes --------- -- fix the hints module on some systems, e.g. Fedora. - Symptom: `undefined symbol: engine_hint_root_file` - - -Knot Resolver 1.5.2 (2018-01-22) -================================ - -Security --------- -- fix CVE-2018-1000002: insufficient DNSSEC validation, allowing - attackers to deny existence of some data by forging packets. - Some combinations pointed out in RFC 6840 sections 4.1 and 4.3 - were not taken into account. - -Bugfixes --------- -- memcached: fix fallout from module rename in 1.5.1 - - -Knot Resolver 1.5.1 (2017-12-12) -================================ - -Incompatible changes --------------------- -- script supervisor.py was removed, please migrate to a real process manager -- module ketcd was renamed to etcd for consistency -- module kmemcached was renamed to memcached for consistency - -Bugfixes --------- -- fix SIGPIPE crashes (#271) -- tests: work around out-of-space for platforms with larger memory pages -- lua: fix mistakes in bindings affecting 1.4.0 and 1.5.0 (and 1.99.1-alpha), - potentially causing problems in dns64 and workarounds modules -- predict module: various fixes (!399) - -Improvements ------------- -- add priming module to implement RFC 8109, enabled by default (#220) -- add modules helping with system time problems, enabled by default; - for details see documentation of detect_time_skew and detect_time_jump - -* Fri Jan 05 2018 Tomas Krizek - 1.5.0-2 -- add doc package -- configure tarball signature verification -- add root.hints file -- use upstream systemd unit files, paths and user name - - migrate configuration to /etc/knot-resolver - - use user knot-resolver - - store cache in /var/cache/knot-resolver - - use systemd alias knot-resolver -> kresd - -* Mon Nov 06 2017 Petr Špaček - 1.5.0-1 -- New upstream release 1.5.0 - -Knot Resolver 1.5.0 (2017-11-02) -================================ - -Bugfixes --------- -- fix loading modules on Darwin - -Improvements ------------- -- new module ta_signal_query supporting Signaling Trust Anchor Knowledge - using Keytag Query (RFC 8145 section 5); it is enabled by default -- attempt validation for more records but require it for fewer of them - (e.g. avoids SERVFAIL when server adds extra records but omits RRSIGs) - - -Knot Resolver 1.4.0 (2017-09-22) -================================ - -Incompatible changes --------------------- -- lua: query flag-sets are no longer represented as plain integers. - kres.query.* no longer works, and kr_query_t lost trivial methods - 'hasflag' and 'resolved'. - You can instead write code like qry.flags.NO_0X20 = true. - -Bugfixes --------- -- fix exiting one of multiple forks (#150) -- cache: change the way of using LMDB transactions. That in particular - fixes some cases of using too much space with multiple kresd forks (#240). - -Improvements ------------- -- policy.suffix: update the aho-corasick code (#200) -- root hints are now loaded from a zonefile; exposed as hints.root_file(). - You can override the path by defining ROOTHINTS during compilation. -- policy.FORWARD: work around resolvers adding unsigned NS records (#248) -- reduce unneeded records previously put into authority in wildcarded answers - - -Knot Resolver 1.3.3 (2017-08-09) -================================ - -Security --------- -- Fix a critical DNSSEC flaw. Signatures might be accepted as valid - even if the signed data was not in bailiwick of the DNSKEY used to - sign it, assuming the trust chain to that DNSKEY was valid. - -Bugfixes --------- -- iterate: skip RRSIGs with bad label count instead of immediate SERVFAIL -- utils: fix possible incorrect seeding of the random generator -- modules/http: fix compatibility with the Prometheus text format - -Improvements ------------- -- policy: implement remaining special-use domain names from RFC6761 (#205), - and make these rules apply only if no other non-chain rule applies - -* Tue Aug 01 2017 Petr Spacek - 1.3.2-1 -New upstream release: -Knot Resolver 1.3.2 (2017-07-28) -================================ - -Security --------- -- fix possible opportunities to use insecure data from cache as keys - for validation - -Bugfixes --------- -- daemon: check existence of config file even if rundir isn't specified -- policy.FORWARD and STUB: use RTT tracking to choose servers (#125, #208) -- dns64: fix CNAME problems (#203) It still won't work with policy.STUB. -- hints: better interpretation of hosts-like files (#204) - also, error out if a bad entry is encountered in the file -- dnssec: handle unknown DNSKEY/DS algorithms (#210) -- predict: fix the module, broken since 1.2.0 (#154) - -Improvements ------------- -- embedded LMDB fallback: update 0.9.18 -> 0.9.21 - -* Wed Jul 26 2017 Fedora Release Engineering - 1.3.1-1.1 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild - -* Tue Jul 11 2017 Petr Spacek - 1.3.1-2 -- build experimental command line interface "kresc" - -* Tue Jul 11 2017 Petr Spacek - 1.3.1-1 -New upstream release: -Knot Resolver 1.3.1 (2017-06-23) -================================ - -Bugfixes --------- -- modules/http: fix finding the static files (bug from 1.3.0) -- policy.FORWARD: fix some cases of CNAMEs obstructing search for zone cuts - - -Knot Resolver 1.3.0 (2017-06-13) -================================ - -Security --------- -- Refactor handling of AD flag and security status of resource records. - In some cases it was possible for secure domains to get cached as - insecure, even for a TLD, leading to disabled validation. - It also fixes answering with non-authoritative data about nameservers. - -Improvements ------------- -- major feature: support for forwarding with validation (#112). - The old policy.FORWARD action now does that; the previous non-validating - mode is still avaliable as policy.STUB except that also uses caching (#122). -- command line: specify ports via @ but still support # for compatibility -- policy: recognize 100.64.0.0/10 as local addresses -- layer/iterate: *do* retry repeatedly if REFUSED, as we can't yet easily - retry with other NSs while avoiding retrying with those who REFUSED -- modules: allow changing the directory where modules are found, - and do not search the default library path anymore. - -Bugfixes --------- -- validate: fix insufficient caching for some cases (relatively rare) -- avoid putting "duplicate" record-sets into the answer (#198) - - -Knot Resolver 1.2.6 (2017-04-24) -================================ - -Security --------- -- dnssec: don't set AD flag for NODATA answers if wildcard non-existence - is not guaranteed due to opt-out in NSEC3 - -Improvements ------------- -- layer/iterate: don't retry repeatedly if REFUSED - -Bugfixes --------- -- lib/nsrep: revert some changes to NS reputation tracking that caused - severe problems to some users of 1.2.5 (#178 and #179) -- dnssec: fix verification of wildcarded non-singleton RRsets -- dnssec: allow wildcards located directly under the root -- layer/rrcache: avoid putting answer records into queries in some cases - -* Thu Apr 06 2017 Petr Spacek - 1.2.5-1 -- new upstream relase - + security: layer/validate: clear AD if closest encloser proof has opt-outed NSEC3 (#169) - + security: layer/validate: check if NSEC3 records in wildcard expansion proof has an opt-out - + security: dnssec/nsec: missed wildcard no-data answers validation has been implemented - + fix: trust anchors: Improve trust anchors storage format (#167) - + fix: trust anchors: support non-root TAs, one domain per file - + fix: policy.DENY: set AA flag and clear AD flag - + fix: lib/resolve: avoid unnecessary DS queries - + fix: lib/nsrep: don't treat servers with NOIP4 + NOIP6 flags as timeouted - + fix: layer/iterate: During packet classification (answer vs. referral) don't analyze - AUTHORITY section in authoritative answer if ANSWER section contains records - that have been requested - + enhancement: modules/dnstap: a DNSTAP support module (Contributed by Vicky Shrestha) - + enhancement: modules/workarounds: a module adding workarounds for known DNS protocol violators - + enhancement: layer/iterate: fix logging of glue addresses - + enhancement: kr_bitcmp: allow bits=0 and consequently 0.0.0.0/0 matches in view and renumber modules. - + enhancement: modules/padding: Improve default padding of responses (Contributed by Daniel Kahn Gillmor) - + enhancement: New kresc client utility (experimental; don't rely on the API yet) - -* Thu Mar 09 2017 Petr Spacek - 1.2.4-1 -- new upstream release - + security: Knot Resolver 1.2.0 and higher could return AD flag for insecure - answer if the daemon received answer with invalid RRSIG several - times in a row. - + fix: layer/iterate: some improvements in cname chain unrolling - + fix: layer/validate: fix duplicate records in AUTHORITY section in case - + fix: of WC expansion proof - + fix: lua: do *not* truncate cache size to unsigned - + fix: forwarding mode: correctly forward +cd flag - + fix: fix a potential memory leak - + fix: don't treat answers that contain DS non-existance proof as insecure - + fix: don't store NSEC3 and their signatures in the cache - + fix: layer/iterate: when processing delegations, - check if qname is at or below new authority - + enhancement: modules/policy: allow QTRACE policy to be chained - with other policies - + enhancement: hints.add_hosts(path): a new property - + enhancement: module: document the API and simplify the code - + enhancement: policy.MIRROR: support IPv6 link-local addresses - + enhancement: policy.FORWARD: support IPv6 link-local addresses - + enhancement: add net.outgoing_{v4,v6} to allow specifying address - to use for connections - -* Mon Feb 27 2017 Petr Spacek - 1.2.3-1 -- new upstream release - + security: a cached negative answer from a CD query would be reused - to construct response for non-CD queries, resulting in Insecure status - instead of Bogus. - + fix: lua: make the map command check its arguments - + fix: -k argument processing to avoid out-of-bounds memory accesses - + fix: lib/resolve: fix zonecut fetching for explicit DS queries - + fix: hints: more NULL checks - + fix: TA bootstrapping for multiple TAs in the IANA XML file - + fix: Disable storing GLUE records into the cache even in the - + fix: (non-default) QUERY_PERMISSIVE mode - + fix: iterate: skip answer RRs that don't match the query - + fix: layer/iterate: some additional processing for referrals - + fix: lib/resolve: zonecut fetching error was fixed - -* Fri Feb 10 2017 Fedora Release Engineering - 1.2.0-2.1 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild - -* Fri Jan 27 2017 Petr Spacek - 1.2.0-2 -- rebuild against knot-2.4.0 - -* Fri Jan 27 2017 Petr Spacek - 1.2.0 -- new upstream release: - + fix: reworked DNSSEC Validation, that fixes several know problems with less standard DNS configurations - + fix: the resolver was setting AD flag when running in a forwarding mode - + fix: correctly return RCODE=NOTIMPL on meta-queries and non IN class queries - + fix: crash in hints module when hints file was empty - + fix: non-lowercase hints - + features: optional EDNS(0) Padding support for DNS over TLS - + features: support for debugging DNSSEC with CD bit - + features: DNS over TLS is now able to create ephemeral certs on the runtime (Thanks Daniel Kahn Gilmore for contributing to DNS over TLS implementation in Knot Resolver.) - + features: configurable minimum and maximum TTL (default 6 days) - + features: configurable pseudo-random reordering of RR sets - + features: new module 'version' that can call home and report new versions and security vulnerabilities to the log file - -* Mon Jan 23 2017 Petr Spacek - 1.2.0-rc1 -- Update to latest upstream version -- Fix packaging bug: depend on proper Lua library versions -- Allow automatic trust anchor management to work - -* Sat Nov 19 2016 Peter Robinson 1.1.1-3 -- Add ExclusiveArch for architectures with LuaJIT - -* Mon Aug 29 2016 Igor Gnatenko - 1.1.1-2 -- Rebuild for LuaJIT 2.1.0 - -* Wed Aug 24 2016 Jan Vcelak - 1.1.1-1 -- new upstream release: - + fix name server fallback in case some of the servers are unreachable - -* Fri Aug 12 2016 Jan Vcelak - 1.1.0-1 -- new upstream release: - + RFC7873 DNS Cookies - + RFC7858 DNS over TLS - + Metrics exported in Prometheus - + DNS firewall module - + Explicit CNAME target fetching in strict mode - + Query minimisation improvements - + Improved integration with systemd - -* Tue May 31 2016 Jan Vcelak - 1.0.0-1 -- final release - -* Thu May 05 2016 Jan Vcelak - 1.0.0-0.3.4f463d7 -- update to latest git version -- re-enable unit-test - -* Sat Apr 09 2016 Jan Vcelak - 1.0.0-0.2.79a8440 -- update to latest git version -- fix package review issues - -* Tue Feb 02 2016 Jan Vcelak - 1.0.0-0.1.beta3 -- initial package diff --git a/kresd-keyblock.asc b/kresd-keyblock.asc deleted file mode 100644 index 1b34475..0000000 --- a/kresd-keyblock.asc +++ /dev/null @@ -1,126 +0,0 @@ ------BEGIN PGP PUBLIC KEY BLOCK----- - -mQINBGImJYQBEACoQzmvkGLYGeltnY2MzvjZlpZk/M670+vxI6e7ofto4AQQmvGW -0eann8bUl8qZnliOvqq57akCRTYLaT9ArFjfaaYs60qFD7KCFTAe4GHry/J4aWiP -Q7jftfpDerTLr+LvikJ9dJrMLV/TA79fgEb3DcGOtuZMventwJbZKS5iiAgaN/mW -ZZIh/kQNvylKy4aTm21yx2XFx4eVDRd1aucJWTrR9DmM3Nm02rpNvQxjxWfDU0cg -ne6iWFHseUDA40B5r/hwaEYD4cDOXh+adI0WkH5662TkrewzxE1LE+uyScTEL57i -zTHyeEW+1DHSyprtTZggUThRay4RLPIW4PVV+kkv/9kwtk1LWIbHbzilbKkKKoea -uIzTGJnxGGbV0uyRbH3QJTtddags5rBskemqPgg9momwMIgUtBSQn10zMX/s5bUF -yP9MwKVNzEkgtxeWvjSmKCpqmmD8oiXO1iL5bcZsJfJH1p9nHqDVG4+EJjSbu+wr -eM424BxXap+bdvoxKr5ofTswEyvlwn47aejQQVciDDb+AN8nufJeOrfyYQ798DXj -PhkR3CFVGfLCGkAAoTrhEePmn1DqKJMxlDB8YSZKTvF+TNBLVpVExu/MsVMX7mMh -uG+OFrDn/mCFe+q0fqMEQOpa5XFzhzaRd93khifR+sYnF5fiE92nG60psQARAQAB -tCBBbGVzIE1yYXplayA8YWxlcy5tcmF6ZWtAbmljLmN6PokCVAQTAQgAPhYhBDBX -7ppEjzYtdCBad5qxINoKdvbeBQJiJiWEAhsDBQkDwmcABQsJCAcCBhUKCQgLAgQW -AgMBAh4BAheAAAoJEJqxINoKdvbe5tsQAI4KnAGf+YkPGLdCTQo7bi9eww3zVoJk -m0WKTf67zLd7JC8puCGPWRVaVSBsuUKDrp57I3h736+Jx0XiwRA6xlFmgvVIWrFr -swGXlLbdutezXE2ke5y+86uj6k5TQKn3jEWfmkRigFLlUy5U+VJEt6b/i7e9EmMb -T9dI4d7JW7MPY74jYlFJ4klZvp/BL5ldz9R2yprOnwBX4Bjwm4FFR71NPC/iK2Dn -19pSH+YeRpsTU1I1vBMzz4qlEkhhE1+pqYbxYpyfkmSxJxGvD7FFr8GHnFwcnqqv -zZuinIz+eGf7iSql6yxz7OxDnVhBYnSQpCkSWtGdhHEVtQo0uA7gcxcdz5URBScQ -ofR/Zs/fvEvWqRXKm+I/qC1nK/glfaoA81xI6OGOPkrYEoLi9WKGK0nWSbnux9qY -/vyzVAKUDjEtYFm/Nk/23D4tBcC0/tZfuVFedWa6rcqKVNoeRdu2Nol9L4quL601 -vm/kIQDhUsQmWbvIkwx6pHZoFw+9COY1NFINOqguBYzyMIlVJpo6Xns+1gldJ7vI -0w6F+wpmUkFNnEACQ3dG/uf6WNzEbgEdKFQ2xgLN4zY7nJI3QLRlrXntk6BzG7Lj -iQe7ZS4uhaQQ9bzTuvhi3qKJEJUGaPQRvYJoCoDQs1gLR/rep0qQpRsUt7Tzb0uZ -xeeZHSvvhDq5uQINBGImJYQBEADaE8cZEkr06+TnlQ+8qSBHRFJSEunNKjUr8t0y -zwPgFZhRIRtw3mCFqDEv/eBPw9tsQeW6aJz5+VI5t7Ifkt8krHPE8GT5N33MyUKj -8sRk1oQNt/2JdDCOy5ZigyqFj31/9XeIWvlQbBLUTL0V3EPAmcipegEx9VFD81FW -qH4TbBer0oLsa7zFnZ455FIn1a76UNC+73DE3+eV1V51euhx3TIgn76SXe8Qf+jg -Asv7Ylfe++g3Smkt5UAgEZQOFwPbYMjS4U5sRq8hpJw+nBkI2n/vHoLeSKWZjt6J -/yth+tLQmsQRwyYk97Tp8mzPpmWSMWIGPDrfyBdV1DmToQkWDozuBs5Mz8gVvrMu -2mNe4O0m5Xv7e80Gm/OJxSeB/o8tEXFE12JEM1c88OZ8Iz/PcfSgotbcS5zVxRcm -yU/ZqMRNvJHtG932DIhZ/s0NdAxnsAeCz9gaR6Z4orVXb8G7/S1pe0ab66k19VX5 -wFoPIz92SUq91VbrCsjfHi4FeE7h2OL9QP10Liv9qOxJFYvy2fvWG9EXuknjaZsD -igmC1DuX/7uWJbrGbp9spnuNsgm7wYG5nFH8fTnNKtaMl2/D8D5WbB0k+MJnBDeW -MyDKPsaCStX2ih90DGSOkWlZy1k3X+v+PTPPxu1ry/MePSo0UHud9L2oWLbnz27I -bBRymwARAQABiQI8BBgBCAAmFiEEMFfumkSPNi10IFp3mrEg2gp29t4FAmImJYQC -GwwFCQPCZwAACgkQmrEg2gp29t7Trw//cN9UEaN1WaH4jFDKIST+xdLnSLvk0Izt -hHqJzzW9sRQYINvqz89EkTUrjelbW3Ib41YVNNk3S7hOm5OJm/fRHdQtItzuY/9E -RafF5+PUiDj5TRDa8bRV7sCAQLoztfr1ozadbGE7e8HrrZv4DcZ10joCpLRZm04j -QMBeZcaaEa2Wh7Xf9VW4aBJ/DU5DevsKeTRpCuwtw2lEf+NMl3PogPa9glm7liQu -DKU4Zlf/31ZCudAb80PugOzWM2i1DG26G/b7z+8N59m6dBYWeSvcqU7Z9Q4rU7bV -R/6nST8GyLIU/PsDalvKm2B3NDcXerN8lT9zU1QBzT3OyL6Uy/UzXl6YnpxFT8m/ -Gm4uiLS+gWD2TXh5BKGsuU4zIHakjglA7Gtb6PJ56+Pkz95apx7vAhmnJxgw7qAX -KAH0Rng7IxEeL8Fj67tzWTQPs0PuAty7qIgbeft8hvhtk9vfFZb8k3bhX59b/+TO -tbTOCjVhmq9bZdaw60SBl3LuyUlnlGmrqvPzVUdcAc2zvnxjEt9yVioS/M8zNRC/ -SmWbagZ/xyf2iiEAbo0y12t3heztdG8jMoMrImmUEubfPiAfCN2ys5zPiXW2jio5 -vvopiu23y37ew3zoAZrnfmFW0D8A8iD2g0kl/Ysb2dXIYocQ423ADN1Em/+1f8j5 -3P6DgfI04ROZAg0EWAOSdgEQAMcRDAsGV+ptULOruphwEUVNzVYIAW2qIp6E6uwh -Ocq6xnDieFjCUpDFy6aCPTXEk6Ft8cEIF4aUPJ1ip6YqDgh9jafBLI/Bllgwmfsv -sAasJ7K2vhUy8MnujuoNmOOKbiJ+/4ZTB2TemVfHqgwXidy16wjxoA64tQcCfQ9+ -sZ82FahqCU4qB04joMaOEj9oaS/L6Osj/5ex0xX7d/VG4Q58j5i7hJcWMnKECaoQ -4FHHF0eoqt4ginPcuDfzJbCJUZ/CBBP6cUjP0GkcfeVaDW5LzEzd7Nx4GZFhXzNP -0+9t5nnsGVpNHqstp7lFjBXf3s9IsGqouQHkfRMNFQUGfAGxShst5tgeYkI7J2/I -2/kAWQuYtns7iPaMWjVY9Iy3dOEzrBHCqucHgaL7qifKtl8TUOdVkypvFndVdr4T -hLljCt8ItQSsYSf53jQ62hFmZBeFE9UCx2OKYyP2gUz1GjFKBSsODohrefQisoVv -77McAVuqRHmDirNeI4wQbrbUZgR7HawMQrP88PgJUqU0j16V3hOgfn3aQDDMmZ36 -wCL5F+izQ0TPG4V3R6QA55ahRGjTOhhNJY+Uw6YUy9ykfos/eV4mZjvHjP9vWeD/ -7tScqidUAtU8VtFsSU6Qh8C0spxQSh/BXWOvsPJgY9qUm2IMk+iYHTjVkcKPZHHJ -dj+hABEBAAG0KVZsYWRpbcOtciDEjHVuw6F0IChwZXJzb25hbCkgPHZAY3VuYXQu -Y3o+iQJUBBMBCAA+FiEEtgBkYLYKgOeCBiRJ50ffH5V1o6oFAmFmsBgCGyMFCRTR -36EFCwkIBwIGFQoJCAsCBBYCAwECHgECF4AACgkQ50ffH5V1o6r5GBAAxkNaB8zi -TVWBZ5geqcQeoqCeTrZjDZ1pY32BbjefGb0z0fmRzH9ESQBGH+b46PO7cibOt3sY -d4ZX8GxG/vnwsU3dOspaIQfHH99yXr+sCRkcr2k7DWTMFSX/5JkhlrouAURpIRN8 -y4+OO/TkWFY3HAIEy3VkhwIoJSUEDfSINb1KHnotNzHc7s1Z3yb14K14XV/LnQL/ -/NTz32NBGSDAt3C3+w4h5WKhg+kPcuno1VVUHM4AcqqLkhEbNN/QwQULWbrQMqcB -+JJWlEgSqkhn2nrw/i8q+tlK7FBi4DhID99xRljt2HcPt7gqhnZ/2OxfoHGHui/f -FPgmeK+c/wHZ22FH4ly0XwsSdIjskhRf/XPTaBlgeorfyIEBFBeFkgjdFUNSpl1M -Tso6ZYxXkLg1UxEFtI+X5Eh7zpirfs6jwc44aMHKabJY3V/MBmYqUBRR3H6xnIFd -gfjVeFAR65w7MElJXRx2kvJ5ixpV5W2+U//MvhkpN6Vk1Y2G9NXmQeGXz2l+2A9V -4qpTn/nVAIchYFtVPzsAJlyPAqB7I45uNMQOcsGdn4W5lLgD4MNdgwIUce9jQ1Oo -F0BnZSCJGLjU0ZxVUOd7fwF+P+Y8RBxBIhVcvxaluI3YmT0roqCXaJaYGAWgXZCF -9g0NnfvR0dRRZRUeT/qLxJNZksK+iFtLIlu0MFZsYWRpbcOtciDEjHVuw6F0ICh3 -b3JrKSA8dmxhZGltaXIuY3VuYXRAbmljLmN6PokCVAQTAQgAPgIbIwUJFNHfoQUL -CQgHAgYVCAkKCwIEFgIDAQIeAQIXgBYhBLYAZGC2CoDnggYkSedH3x+VdaOqBQJh -ZrAYAAoJEOdH3x+VdaOqVjIP/1N5v2soWf7T2OcromFmL76QDqAIwzYtuwookFK8 -UBiGEAw+lz8dHSPqiQF8IiaVxroWeKp7vHKjSeRCr2a9eKsYzTdz3jStwPnKZGpP -5OMJb2x5dZNxyKaL1Fyidq0N9LDIkxanMORPYVA2c1tHmFJFJoj8EmUhIYN8iAl5 -ZG2u3vELI9B3ZvNJb8OJUxAOcvPVyuxKMzpJY2C8K4Ec2joLugG+aCoZh7DTi4EO -tqAOxr/jfCPEdPHEIKEOdqXy5DtoiA5e6uHA+DpseBC/jM2jrvO+IRqnFvr7M7+Q -yfv0ZbkFefsJp5tjojCv6xJPtz/BKwh9wxNtUJrZfFL71Otz4/0YAwiX4z+kljop -x0i4ALVUOiWb7i/2PiP23n4JnPAfLdlClk9CeTkCOu0CAgBvrKi1w/7eEnGqOgTu -4OaGfFaOtTjuFqKS0wOdBRGST5h3pKjxrDxN8HgI+ZpF1EfMd6ovfLWpMVIwE9cV -ueimcpAqfSubQECTjwnsDSmzc26apaCHL8FaXf2pG9J5uDczxdcUzVWfgb+16Wdg -bFoqJ82O2SCysTcEkrNH8m2R5i7iCaO5WlQFLf2FHOBWLd3RjV1ztCImv4di5skw -QLwgW2+wi0QowVPgPc38JAPa73INRhaPK3JUcwqNEr9JUNfRGyL+eTwTX4b5YKHd -dJ9KtCRWbGFkaW3DrXIgxIx1bsOhdCA8dmN1bmF0QGdtYWlsLmNvbT6JAlcEEwEI -AEECGyMFCRTR36EFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AWIQS2AGRgtgqA54IG -JEnnR98flXWjqgUCYWawGAIZAQAKCRDnR98flXWjqjpMEACClbUGJ3e0p1Nty0Lf -kRsoWZMoyeWSoBA0owUsQOyquKKaSj+40qHMDOhbNfJoLpwFsU5zJL4I2rhDlW+z -Y5Het5x1afS0lExzXK3RMPWwhUwMmWevUpW+VFjvPyBhdlEP8E0Ayj6z/p5GEN9Z -9yruZfz9ru48KDvwUYz/f2V0cAPqOIcSM6euGLXnK4ExML+8Wiqgmht8qBozD0Lo -odyAWMR1D+XkAMR+ugwUfs449+x7zzzfkRh8CfggB9mgMK0i2b66MdWFHYW2c9jc -3SIEaWZM56pEG9BCZpcoiiGgCOMWQ7CEn2dOfH2Ah1ZiICyDnL9XvESYJBoRLiNG -cLrD31GJzUrDPRLzK9f8j4AlWN7bNECw5pmPYE2vizFOuasojBV6hlg+c0bXpQSK -ybg1eQb0rE5yOWrA0pP5yNc6ZIBxtjbYLbwmWltb9mWMznVSNfcjvA7QXe3srYYL -AOW1KPz2Ly8qCTZXcpXx2Z2mk4FTNDIj4maQxLTIURHWHckHrXxENxMXNcbaZ4d4 -LVz5f1RBhsFfmAXpVu/FTvXIPlIWaNVlQDWBMxlVidpeztB4XgPUqKWmtMNyCTsN -PeuxrRiyIm2ccXE+fcuPDstLIeQdX+U/rijx1f588i6nt2oD0vy9tEchFeiczql1 -YzYNM5U8u/rCYiOxmQWf7gZecbkCDQRYA5J2ARAAyHww3huLEtsdyqgjiGMhtEKO -Lmp7yFl450HY9oPcHS02U5BC1370ssNShrdOCi2ACDbe41Zxx85WcuaO1OVqung2 -umX047mj2xQsiTAFRDLZsQu8cQFoEy/DBL2bk7ThfK1Lh+NyZAs0UaPpDkGodS0D -e9osA+4T6Nf4POYaeavbYVFSdDKS4lUboBqApKnD/TzKFxFcpuFx6FN92lteTbOo -jGMiLoZvELY86Kn9KuFZ8FM2ZSNHx1Z75KouufGrdkeCoZYVYiuzT+fnt2it4dIp -IlnF+yxMt5LB/MSrmECB5CAFJtxzuMccm6yDUZQSWWi9vUgxIJwvt5w0CIBT353D -GeP4WnH0r5YoBKoRbh7i4fT0lWvMXTG/V2lqyzBdClMebyHffMgba26Kj6oeDygD -fC5aGsVaqw1Ue/qQ5QRqTJcJV7xVLTtS1EamVqkfKwPS0zTfnrF1jQtnO/P4qkfg -BRRG9BXGGrykHpXOyqmX6Z0wbV2P4j+p02oSecDl5yVXplJfsXfbS/xXnaSkaN/7 -mCU29ul26cAVNxDkDPunztSFi9K9LM2T/XWYJQGXM71OpmONQJGF24lx7Wp/kobn -HtbjGDzjDPC4eSL7MA56qtrWaLM+4ePKANct2q0q6c0uSLs0Q2zochS64Mcg0YzL -1sinWPN1rXLDk3lwpIsAEQEAAYkCWgQYAQgADwUCYWawGAIbDAUJFNHfoQA/CRDn -R98flXWjqgkQ50ffH5V1o6oJEOdH3x+VdaOqCRDnR98flXWjqhYhBLYAZGC2CoDn -ggYkSedH3x+VdaOqtBgQALeChWgHEGe/8nwKWrC8CMQyKyiJRlSfvERi5M40PYxw -KC7IHo+ekMdlLc8kVkv5WSq3zQcNoRMjHutZlCVpGJat5PwiCine6I3Z5JfKsU7f -JE4KXPD0jr9kCy/IHlCWsKLZTHH0LOk98tqZcFQwFM5nQEzu8Us86BxlZs5IaN0j -ILD2qUC+EYeg0hd0kya+16UNao9NxCeUEoSwxhtB4IIMCJTUPx0pWErCHxeCUjvx -Pd2h5A106DT/3fa8uhPHr9goHtfreV0soGuxu1rqGrMn7XcorsGdt9XX4tyPHcXD -XCZMLedjYTu7OcYQ63hi+ZWUXJPvcIrB4StCumaFECwLodpdDWB7n6OF8r+X//eP -bjS8qt++A20LGD4l7BrWxDeymrnqLmWN8RBf2xV4ytVfcRx1ercFMGiNRUvGSh+k -gP6J7D4yT4xGTq+fCtS6BHyWMB0loXcWv0Im/6znpIpUcvXyL68s4Jiqukt94rKl -wb/IB6MSWannxk8UzWfGgFXeGUrR8YWLuQSo26AceNOyu2gMW+k9kYi0sqkBzMPk -1zWZN/gSNpDyu7AWGpv4RtOKhJhaux8zwtwqozqSx+plpnYz5ifwCNMuznM6T0j4 -msKQiK1N7lIwKBGaT2P8SJ/ecaJyudIz4ds2+GUl6fxqSR27Egs+EUY0BmS7wESr -=dRuR ------END PGP PUBLIC KEY BLOCK----- diff --git a/rootkeys/README b/rootkeys/README deleted file mode 100644 index b65691c..0000000 --- a/rootkeys/README +++ /dev/null @@ -1,3 +0,0 @@ -Content of the root-anchors.xml file must match DS records in file ../root.keys. - -Obtain these files from a trusted source! diff --git a/rootkeys/checksums-sha256.txt b/rootkeys/checksums-sha256.txt deleted file mode 100644 index f6124b9..0000000 --- a/rootkeys/checksums-sha256.txt +++ /dev/null @@ -1,3 +0,0 @@ -053cbf806a57e7759b8b8ad9cb21d65229b53b4c2b73feece2c62a3aff153b87 icannbundle.pem -ca2cc5aad5af1b7cd853fe1f08c4925dcd8fd8816711821d9e76ad37a5ac52c4 root-anchors.p7s -1b2a628d1ff22d4dc7645cfc89f21b6a575526439c6706ecf853e6fff7099dc8 root-anchors.xml diff --git a/rootkeys/icannbundle.pem b/rootkeys/icannbundle.pem deleted file mode 100644 index d76ce0b..0000000 --- a/rootkeys/icannbundle.pem +++ /dev/null @@ -1,237 +0,0 @@ -Certificate: - Data: - Version: 3 (0x2) - Serial Number: 1 (0x1) - Signature Algorithm: sha256WithRSAEncryption - Issuer: O=ICANN, OU=ICANN Certification Authority, CN=ICANN Root CA, C=US - Validity - Not Before: Dec 23 04:19:12 2009 GMT - Not After : Dec 18 04:19:12 2029 GMT - Subject: O=ICANN, OU=ICANN Certification Authority, CN=ICANN Root CA, C=US - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (2048 bit) - Modulus (2048 bit): - 00:a0:db:70:b8:4f:34:da:9c:d4:d0:7e:bb:ea:15: - bc:e9:c9:11:2a:1f:61:2f:6a:b9:bd:3f:3d:76:a0: - 9a:0a:f7:ee:93:6e:6e:55:53:84:8c:f2:2c:f1:82: - 27:c8:0f:9a:cf:52:1b:54:da:28:d2:2c:30:8e:dd: - fb:92:20:33:2d:d6:c8:f1:0e:10:21:88:71:fa:84: - 22:4b:5d:47:56:16:7c:9b:9f:5d:c3:11:79:9c:14: - e2:ff:c0:74:ac:dd:39:d7:e0:38:d8:b0:73:aa:fb: - d1:db:84:af:52:22:a8:f6:d5:9b:94:f4:e6:5d:5e: - e8:3f:87:90:0b:c7:1a:77:f5:2e:d3:8f:1a:ce:02: - 1d:07:69:21:47:32:da:46:ae:00:4c:b6:a5:a2:9c: - 39:c1:c0:4a:f6:d3:1c:ae:d3:6d:bb:c7:18:f0:7e: - ed:f6:80:ce:d0:01:2e:89:de:12:ba:ee:11:cb:a6: - 7a:d7:0d:7c:f3:08:8d:72:9d:bf:55:75:13:70:bb: - 31:22:4a:cb:e8:c0:aa:a4:09:aa:36:68:40:60:74: - 9d:e7:19:81:43:22:52:fe:c9:2b:52:0f:41:13:36: - 09:72:65:95:cc:89:ae:6f:56:17:16:34:73:52:a3: - 04:ed:bd:88:82:8a:eb:d7:dc:82:52:9c:06:e1:52: - 85:41 - Exponent: 65537 (0x10001) - X509v3 extensions: - X509v3 Basic Constraints: critical - CA:TRUE - X509v3 Key Usage: critical - Digital Signature, Non Repudiation, Key Encipherment, Data Encipherment, Key Agreement, Certificate Sign, CRL Sign - X509v3 Subject Key Identifier: - BA:52:E9:49:83:24:86:52:2F:C7:99:CD:FC:8D:6B:69:08:4D:C0:50 - Signature Algorithm: sha256WithRSAEncryption - 0f:f1:e9:82:a2:0a:87:9f:2d:94:60:5a:b2:c0:4b:a1:2f:2b: - 3b:47:d5:0a:99:86:38:b2:ec:c6:3b:89:e4:6e:07:cf:14:c7: - c7:e8:cf:99:8f:aa:30:c3:19:70:b9:e6:6d:d6:3f:c8:68:26: - b2:a0:a5:37:42:ca:d8:62:80:d1:a2:5a:48:2e:1f:85:3f:0c: - 7b:c2:c7:94:11:5f:19:2a:95:ac:a0:3a:03:d8:91:5b:2e:0d: - 9c:7c:1f:2e:fc:e9:44:e1:16:26:73:1c:45:4a:65:c1:83:4c: - 90:f3:f2:28:42:df:db:c4:e7:04:12:18:62:43:5e:bc:1f:6c: - 84:e6:bc:49:32:df:61:d7:99:ee:e4:90:52:7b:0a:c2:91:8a: - 98:62:66:b1:c8:e0:b7:5a:b5:46:7c:76:71:54:8e:cc:a4:81: - 5c:19:db:d2:6f:66:b5:bb:2b:ae:6b:c9:74:04:a8:24:de:e8: - c5:d3:fc:2c:1c:d7:8f:db:6a:8d:c9:53:be:5d:50:73:ac:cf: - 1f:93:c0:52:50:5b:a2:4f:fe:ad:65:36:17:46:d1:2d:e5:a2: - 90:66:05:db:29:4e:5d:50:5d:e3:4f:da:a0:8f:f0:6b:e4:16: - 70:dd:7f:f3:77:7d:b9:4e:f9:ec:c3:33:02:d7:e9:63:2f:31: - e7:40:61:a4 ------BEGIN CERTIFICATE----- -MIIDdzCCAl+gAwIBAgIBATANBgkqhkiG9w0BAQsFADBdMQ4wDAYDVQQKEwVJQ0FO -TjEmMCQGA1UECxMdSUNBTk4gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxFjAUBgNV -BAMTDUlDQU5OIFJvb3QgQ0ExCzAJBgNVBAYTAlVTMB4XDTA5MTIyMzA0MTkxMloX -DTI5MTIxODA0MTkxMlowXTEOMAwGA1UEChMFSUNBTk4xJjAkBgNVBAsTHUlDQU5O -IENlcnRpZmljYXRpb24gQXV0aG9yaXR5MRYwFAYDVQQDEw1JQ0FOTiBSb290IENB -MQswCQYDVQQGEwJVUzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKDb -cLhPNNqc1NB+u+oVvOnJESofYS9qub0/PXagmgr37pNublVThIzyLPGCJ8gPms9S -G1TaKNIsMI7d+5IgMy3WyPEOECGIcfqEIktdR1YWfJufXcMReZwU4v/AdKzdOdfg -ONiwc6r70duEr1IiqPbVm5T05l1e6D+HkAvHGnf1LtOPGs4CHQdpIUcy2kauAEy2 -paKcOcHASvbTHK7TbbvHGPB+7faAztABLoneErruEcumetcNfPMIjXKdv1V1E3C7 -MSJKy+jAqqQJqjZoQGB0necZgUMiUv7JK1IPQRM2CXJllcyJrm9WFxY0c1KjBO29 -iIKK69fcglKcBuFShUECAwEAAaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8B -Af8EBAMCAf4wHQYDVR0OBBYEFLpS6UmDJIZSL8eZzfyNa2kITcBQMA0GCSqGSIb3 -DQEBCwUAA4IBAQAP8emCogqHny2UYFqywEuhLys7R9UKmYY4suzGO4nkbgfPFMfH -6M+Zj6owwxlwueZt1j/IaCayoKU3QsrYYoDRolpILh+FPwx7wseUEV8ZKpWsoDoD -2JFbLg2cfB8u/OlE4RYmcxxFSmXBg0yQ8/IoQt/bxOcEEhhiQ168H2yE5rxJMt9h -15nu5JBSewrCkYqYYmaxyOC3WrVGfHZxVI7MpIFcGdvSb2a1uyuua8l0BKgk3ujF -0/wsHNeP22qNyVO+XVBzrM8fk8BSUFuiT/6tZTYXRtEt5aKQZgXbKU5dUF3jT9qg -j/Br5BZw3X/zd325TvnswzMC1+ljLzHnQGGk ------END CERTIFICATE----- -Certificate: - Data: - Version: 3 (0x2) - Serial Number: 11 (0xb) - Signature Algorithm: sha256WithRSAEncryption - Issuer: O=ICANN, OU=ICANN Certification Authority, CN=ICANN Root CA, C=US - Validity - Not Before: Nov 8 23:39:47 2016 GMT - Not After : Nov 6 23:39:47 2026 GMT - Subject: O=ICANN, CN=ICANN EMAIL CA - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (2048 bit) - Modulus (2048 bit): - 00:d2:19:1e:22:69:33:f6:a4:d2:76:c5:80:11:75: - 8e:d0:e8:6f:bf:89:f8:2a:6a:da:8a:85:28:40:ba: - c5:23:5f:47:ed:72:e2:8e:d3:5c:c8:8a:3a:99:a9: - 57:2c:0a:2b:22:f3:54:7b:8b:f7:8c:21:a2:50:01: - 4f:8b:af:34:df:72:fc:78:31:d0:1d:eb:bc:9b:e6: - fa:c1:84:d0:05:07:8a:74:53:a5:60:9e:eb:75:9e: - a8:5d:32:c8:02:32:e4:bf:cb:97:9b:7a:fa:2c:f6: - 6a:1d:b8:57:ad:e3:03:22:93:d0:f4:4f:a8:b8:01: - db:82:33:98:b6:87:ed:3d:67:40:00:27:2e:d5:95: - d2:ad:36:46:14:c6:17:79:65:7f:65:f3:88:80:65: - 7c:22:67:08:23:3c:cf:a5:10:38:72:30:97:92:6f: - 20:4a:ba:24:4c:4a:c8:4a:a5:dc:2a:44:a1:29:78: - b4:9f:fe:84:ff:27:5b:3a:72:ea:31:c1:ad:06:22: - d6:44:a0:4a:57:32:9c:f2:46:47:d0:89:6e:20:23: - 2c:ea:b0:83:7e:c1:f3:ea:da:dd:e3:63:59:97:21: - fa:1b:11:39:27:cf:82:8b:56:15:d4:36:92:0c:a5: - 7e:80:e0:18:c9:50:08:42:0a:df:97:3c:9c:b8:0a: - 4d:b1 - Exponent: 65537 (0x10001) - X509v3 extensions: - X509v3 Basic Constraints: critical - CA:TRUE - X509v3 Key Usage: critical - Certificate Sign, CRL Sign - X509v3 Authority Key Identifier: - keyid:BA:52:E9:49:83:24:86:52:2F:C7:99:CD:FC:8D:6B:69:08:4D:C0:50 - - X509v3 Subject Key Identifier: - 7B:3F:BA:CE:A1:B3:A6:13:2E:5A:82:84:D4:D2:EA:A5:24:F1:CD:B4 - Signature Algorithm: sha256WithRSAEncryption - 0e:8a:c9:ea:6f:9c:e9:23:b6:9c:a6:a4:c2:d1:b1:ee:25:18: - 24:2b:79:d4:a8:f2:99:b9:5c:91:4d:e6:2b:32:2e:01:f5:87: - 95:64:fc:6d:f1:87:fa:24:b4:43:4b:49:f3:84:54:44:eb:af: - 41:ab:49:ab:c8:b7:32:6c:14:83:5b:d7:2c:41:f9:89:d5:c4: - 2b:9a:55:c5:b6:ad:17:d5:4d:bc:41:58:56:72:0d:db:b7:7d: - 57:c6:a2:9c:7e:6b:67:ae:26:f8:26:45:bb:c4:95:2e:ea:71: - e3:b4:7a:69:95:a4:8a:80:f8:59:dc:88:6e:e1:a7:fc:bb:8e: - b2:aa:a8:b6:1b:2f:2c:97:a5:12:d5:82:ae:a0:e8:a6:15:fd: - d1:e0:5d:e4:84:b1:76:db:0a:e2:ca:58:2e:d3:df:48:4e:46: - ac:c6:35:79:17:99:ce:e9:be:2c:e4:c2:50:ff:5b:96:15:cd: - 64:ac:1b:db:fe:d2:ac:43:61:c8:5f:ee:24:b6:a4:3b:d2:ff: - 0a:f4:0c:88:58:a1:9d:a4:c1:1f:6a:6c:67:90:98:e8:1f:5e: - 2d:55:60:91:26:2a:b1:66:80:e4:e6:0e:05:2c:75:a9:ca:0b: - e4:a0:8f:e1:47:a8:8f:61:5d:7c:ce:09:60:88:48:c3:46:bf: - be:7e:36:be ------BEGIN CERTIFICATE----- -MIIDZDCCAkygAwIBAgIBCzANBgkqhkiG9w0BAQsFADBdMQ4wDAYDVQQKEwVJQ0FO -TjEmMCQGA1UECxMdSUNBTk4gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxFjAUBgNV -BAMTDUlDQU5OIFJvb3QgQ0ExCzAJBgNVBAYTAlVTMB4XDTE2MTEwODIzMzk0N1oX -DTI2MTEwNjIzMzk0N1owKTEOMAwGA1UEChMFSUNBTk4xFzAVBgNVBAMTDklDQU5O -IEVNQUlMIENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0hkeImkz -9qTSdsWAEXWO0Ohvv4n4KmraioUoQLrFI19H7XLijtNcyIo6malXLAorIvNUe4v3 -jCGiUAFPi68033L8eDHQHeu8m+b6wYTQBQeKdFOlYJ7rdZ6oXTLIAjLkv8uXm3r6 -LPZqHbhXreMDIpPQ9E+ouAHbgjOYtoftPWdAACcu1ZXSrTZGFMYXeWV/ZfOIgGV8 -ImcIIzzPpRA4cjCXkm8gSrokTErISqXcKkShKXi0n/6E/ydbOnLqMcGtBiLWRKBK -VzKc8kZH0IluICMs6rCDfsHz6trd42NZlyH6GxE5J8+Ci1YV1DaSDKV+gOAYyVAI -QgrflzycuApNsQIDAQABo2MwYTAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQE -AwIBBjAfBgNVHSMEGDAWgBS6UulJgySGUi/Hmc38jWtpCE3AUDAdBgNVHQ4EFgQU -ez+6zqGzphMuWoKE1NLqpSTxzbQwDQYJKoZIhvcNAQELBQADggEBAA6KyepvnOkj -tpympMLRse4lGCQredSo8pm5XJFN5isyLgH1h5Vk/G3xh/oktENLSfOEVETrr0Gr -SavItzJsFINb1yxB+YnVxCuaVcW2rRfVTbxBWFZyDdu3fVfGopx+a2euJvgmRbvE -lS7qceO0emmVpIqA+FnciG7hp/y7jrKqqLYbLyyXpRLVgq6g6KYV/dHgXeSEsXbb -CuLKWC7T30hORqzGNXkXmc7pvizkwlD/W5YVzWSsG9v+0qxDYchf7iS2pDvS/wr0 -DIhYoZ2kwR9qbGeQmOgfXi1VYJEmKrFmgOTmDgUsdanKC+Sgj+FHqI9hXXzOCWCI -SMNGv75+Nr4= ------END CERTIFICATE----- -Certificate: - Data: - Version: 3 (0x2) - Serial Number: 10 (0xa) - Signature Algorithm: sha256WithRSAEncryption - Issuer: O=ICANN, OU=ICANN Certification Authority, CN=ICANN Root CA, C=US - Validity - Not Before: Nov 8 23:38:16 2016 GMT - Not After : Nov 6 23:38:16 2026 GMT - Subject: O=ICANN, CN=ICANN SSL CA - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (2048 bit) - Modulus (2048 bit): - 00:dd:c6:ab:bf:7c:66:9d:b3:2b:96:00:14:c7:60: - 7a:8d:62:5b:26:4b:30:d7:b3:4c:82:69:c6:4d:4d: - 73:f3:d4:91:21:5d:ab:35:f0:c8:04:0e:f4:a3:35: - e2:e1:18:a9:98:12:03:58:f8:9f:eb:77:54:5b:89: - 81:26:c9:aa:c2:f4:c9:0c:82:57:2a:5e:05:e9:61: - 17:cc:19:18:71:eb:35:83:c1:86:9d:ec:f1:6b:ca: - dd:a1:96:0b:95:d4:e1:0f:9e:24:6f:dc:3c:d0:28: - 9e:f2:53:47:2b:a1:ad:32:03:c8:3f:0d:80:80:7d: - f0:02:d2:6e:5a:2c:44:21:9b:09:50:15:3f:a1:3d: - d3:c9:c8:24:e7:ea:4e:92:2f:94:90:2e:de:e7:68: - f6:c6:b3:90:1f:bc:c9:7b:a2:65:d7:11:e9:8b:f0: - 3a:5a:b7:17:07:df:69:e3:6e:b9:54:6a:8e:3a:aa: - 94:7f:2c:0a:a1:ad:ba:b7:d9:60:62:27:a7:71:40: - 3b:8e:b0:84:7b:b8:c8:67:ef:66:ba:3d:ac:c3:85: - e5:86:bb:a7:9c:fd:b6:e1:c0:10:53:3d:d4:7e:1b: - 09:e6:9f:22:5c:a7:27:09:7e:27:12:33:fa:df:9b: - 20:2f:14:f7:17:c0:e4:1e:07:91:1f:f9:9a:cd:a8: - e2:c5 - Exponent: 65537 (0x10001) - X509v3 extensions: - X509v3 Basic Constraints: critical - CA:TRUE - X509v3 Key Usage: critical - Certificate Sign, CRL Sign - X509v3 Authority Key Identifier: - keyid:BA:52:E9:49:83:24:86:52:2F:C7:99:CD:FC:8D:6B:69:08:4D:C0:50 - - X509v3 Subject Key Identifier: - 6E:77:A8:40:10:4A:D8:9C:0C:F2:B7:5A:3A:A5:2F:79:4A:61:14:D8 - Signature Algorithm: sha256WithRSAEncryption - 47:46:4f:c7:5f:46:e3:d1:dc:fc:2b:f8:fc:65:ce:36:b1:f4: - 5f:ee:14:75:a3:d9:5f:de:75:4b:fa:7b:88:9f:10:8c:2e:97: - cc:35:1b:ce:24:d3:36:60:95:d5:ae:11:b6:3f:8b:f4:12:69: - 85:b5:3b:2a:b6:ab:7a:81:85:c2:55:57:ed:d0:b5:e7:4f:54: - 37:51:24:c9:d5:07:3a:ef:b6:c5:1a:3e:14:29:a7:a6:f8:08: - 2a:0b:26:79:f9:62:85:4a:e5:ea:90:ca:71:38:16:91:4e:7e: - fd:e3:b3:f3:55:8f:5a:d0:86:cf:33:94:88:f1:90:99:cb:81: - e2:81:92:68:2f:c3:61:d5:52:8d:e6:9a:5b:00:83:42:27:88: - f6:d9:fa:d1:bc:bb:b0:bc:b5:14:0b:4e:1a:54:ef:fa:d6:9d: - c4:0c:fc:ed:15:ab:21:4b:45:b5:d9:3b:ed:3c:d5:1e:2e:7a: - 83:6f:24:45:d4:4c:b4:ef:60:43:18:d0:84:5d:16:7b:f5:50: - 80:b1:a9:c2:8f:3b:c8:90:08:fd:aa:17:13:19:38:19:d1:8e: - 85:7c:1e:57:16:8c:f9:8a:e8:29:25:38:cd:bb:55:8e:4a:6a: - 6f:e5:7d:fc:d7:55:d6:ae:38:07:96:c1:97:ff:e5:2b:4f:99: - 2d:70:f2:08 ------BEGIN CERTIFICATE----- -MIIDYjCCAkqgAwIBAgIBCjANBgkqhkiG9w0BAQsFADBdMQ4wDAYDVQQKEwVJQ0FO -TjEmMCQGA1UECxMdSUNBTk4gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxFjAUBgNV -BAMTDUlDQU5OIFJvb3QgQ0ExCzAJBgNVBAYTAlVTMB4XDTE2MTEwODIzMzgxNloX -DTI2MTEwNjIzMzgxNlowJzEOMAwGA1UEChMFSUNBTk4xFTATBgNVBAMTDElDQU5O -IFNTTCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAN3Gq798Zp2z -K5YAFMdgeo1iWyZLMNezTIJpxk1Nc/PUkSFdqzXwyAQO9KM14uEYqZgSA1j4n+t3 -VFuJgSbJqsL0yQyCVypeBelhF8wZGHHrNYPBhp3s8WvK3aGWC5XU4Q+eJG/cPNAo -nvJTRyuhrTIDyD8NgIB98ALSblosRCGbCVAVP6E908nIJOfqTpIvlJAu3udo9saz -kB+8yXuiZdcR6YvwOlq3FwffaeNuuVRqjjqqlH8sCqGturfZYGInp3FAO46whHu4 -yGfvZro9rMOF5Ya7p5z9tuHAEFM91H4bCeafIlynJwl+JxIz+t+bIC8U9xfA5B4H -kR/5ms2o4sUCAwEAAaNjMGEwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMC -AQYwHwYDVR0jBBgwFoAUulLpSYMkhlIvx5nN/I1raQhNwFAwHQYDVR0OBBYEFG53 -qEAQSticDPK3WjqlL3lKYRTYMA0GCSqGSIb3DQEBCwUAA4IBAQBHRk/HX0bj0dz8 -K/j8Zc42sfRf7hR1o9lf3nVL+nuInxCMLpfMNRvOJNM2YJXVrhG2P4v0EmmFtTsq -tqt6gYXCVVft0LXnT1Q3USTJ1Qc677bFGj4UKaem+AgqCyZ5+WKFSuXqkMpxOBaR -Tn7947PzVY9a0IbPM5SI8ZCZy4HigZJoL8Nh1VKN5ppbAINCJ4j22frRvLuwvLUU -C04aVO/61p3EDPztFashS0W12TvtPNUeLnqDbyRF1Ey072BDGNCEXRZ79VCAsanC -jzvIkAj9qhcTGTgZ0Y6FfB5XFoz5iugpJTjNu1WOSmpv5X3811XWrjgHlsGX/+Ur -T5ktcPII ------END CERTIFICATE----- diff --git a/rootkeys/root-anchors.p7s b/rootkeys/root-anchors.p7s deleted file mode 100644 index ee06fe5..0000000 Binary files a/rootkeys/root-anchors.p7s and /dev/null differ diff --git a/rootkeys/root-anchors.xml b/rootkeys/root-anchors.xml deleted file mode 100644 index bf84089..0000000 --- a/rootkeys/root-anchors.xml +++ /dev/null @@ -1,16 +0,0 @@ - - -. - -19036 -8 -2 -49AAC11D7B6F6446702E54A1607371607A1A41855200FD2CE1CDDE32F24E8FB5 - - -20326 -8 -2 -E06D44B80B8F1D39A95C0B0D7C65D08458E880409BBC683457104237C7F8EC8D - - diff --git a/rootkeys/verify.sh b/rootkeys/verify.sh deleted file mode 100755 index eac0d6e..0000000 --- a/rootkeys/verify.sh +++ /dev/null @@ -1,5 +0,0 @@ -#!/usr/bin/bash -set -o errexit -o xtrace - -sha256sum -c checksums-sha256.txt -openssl smime -CAfile icannbundle.pem -verify -inform DER -in root-anchors.p7s -content root-anchors.xml diff --git a/sources b/sources deleted file mode 100644 index 0ed2cdf..0000000 --- a/sources +++ /dev/null @@ -1,2 +0,0 @@ -SHA512 (knot-resolver-5.7.6.tar.xz) = 4dcaff56b0368bc147e04ffbf6ce4a3595fa3a59e99e73b516edc7813142abcb20823b987824b11a31e3eca3cc62fa176caf4408361daeac67b6f0587f9a0268 -SHA512 (knot-resolver-5.7.6.tar.xz.asc) = 478449d96dddaff9aff134a2a3bc991d8e50423f38a00e7256b54be9ab89d85d66eaa8e83815f4b31700b16fd94f8017493db6347e57d0583feec38bb35655f6 diff --git a/tests/README.md b/tests/README.md deleted file mode 100644 index 8f69da4..0000000 --- a/tests/README.md +++ /dev/null @@ -1,14 +0,0 @@ -Package tests -============= - -These tests implement the standard test interface in Fedora CI. -See https://docs.fedoraproject.org/en-US/ci/tests/ for details. - -Manual execution ----------------- - -Run the following command on your machine. Please note, it will make -modifications to your system. It's best to run these on a clean, throw-away -testing system or a VM. - -ansible-playbook tests/tests.yml -e subjects=/path/to/knot-resolver.rpm -e artifacts=/path/to/artifacts diff --git a/tests/scripts/test_manual_activation.sh b/tests/scripts/test_manual_activation.sh deleted file mode 100755 index c595e05..0000000 --- a/tests/scripts/test_manual_activation.sh +++ /dev/null @@ -1,7 +0,0 @@ -#!/bin/bash -set -ex - -systemctl stop kresd@1.service -systemctl start kresd@1.service - -dig @127.0.0.1 . diff --git a/tests/tests.yml b/tests/tests.yml deleted file mode 100644 index 1f4dc95..0000000 --- a/tests/tests.yml +++ /dev/null @@ -1,15 +0,0 @@ ---- -- hosts: localhost - remote_user: root - roles: - - role: standard-test-basic - tags: - - classic - required_packages: - - bind-utils - tests: - - kresd-show-version: - run: kresd --version - - manual-activation: - dir: scripts - run: ./test_manual_activation.sh