diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..51e13d0 --- /dev/null +++ b/.gitignore @@ -0,0 +1,2 @@ +/knot-resolver-*.tar.xz +/knot-resolver-*.tar.xz.asc diff --git a/dead.package b/dead.package deleted file mode 100644 index a72aec0..0000000 --- a/dead.package +++ /dev/null @@ -1 +0,0 @@ -epel8-playground decommissioned : https://pagure.io/epel/issue/136 diff --git a/gating.yml b/gating.yml new file mode 100644 index 0000000..f075ad7 --- /dev/null +++ b/gating.yml @@ -0,0 +1,15 @@ +--- !Policy +product_versions: + - fedora-* +decision_context: bodhi_update_push_testing +subject_type: koji_build +rules: + - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.tier0.functional} + +--- !Policy +product_versions: + - fedora-* +decision_context: bodhi_update_push_stable +subject_type: koji_build +rules: + - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.tier0.functional} diff --git a/knot-resolver.spec b/knot-resolver.spec new file mode 100644 index 0000000..6dcd618 --- /dev/null +++ b/knot-resolver.spec @@ -0,0 +1,1218 @@ +%global _hardened_build 1 +%{!?_pkgdocdir: %global _pkgdocdir %{_docdir}/%{name}} + +%define GPG_CHECK 1 +%define repodir %{_builddir}/%{name}-%{version} +%define NINJA ninja-build + +Name: knot-resolver +Version: 5.7.6 +Release: 3%{?dist} +Summary: Caching full DNS Resolver + +License: GPL-3.0-or-later +URL: https://www.knot-resolver.cz/ +Source0: https://secure.nic.cz/files/%{name}/%{name}-%{version}.tar.xz + +# LuaJIT only on these arches +%if 0%{?rhel} == 7 +# RHEL 7 does not have aarch64 LuaJIT +ExclusiveArch: %{ix86} x86_64 +%else +ExclusiveArch: %{arm} aarch64 %{ix86} x86_64 +%endif + +%if 0%{GPG_CHECK} +Source1: https://secure.nic.cz/files/%{name}/%{name}-%{version}.tar.xz.asc +# PGP keys used to sign upstream releases +# Export with --armor using command from https://fedoraproject.org/wiki/PackagingDrafts:GPGSignatures +# Don't forget to update %%prep section when adding/removing keys +# This key is from: https://secure.nic.cz/files/knot-resolver/kresd-keyblock.asc +Source100: kresd-keyblock.asc +BuildRequires: gnupg2 +%endif + +BuildRequires: gcc +BuildRequires: gcc-c++ +BuildRequires: meson +BuildRequires: pkgconfig(cmocka) +BuildRequires: pkgconfig(gnutls) +BuildRequires: pkgconfig(libedit) +BuildRequires: pkgconfig(libknot) >= 3.0.2 +BuildRequires: pkgconfig(libzscanner) >= 3.0.2 +BuildRequires: pkgconfig(libdnssec) >= 3.0.2 +BuildRequires: pkgconfig(libnghttp2) +BuildRequires: pkgconfig(libsystemd) +BuildRequires: pkgconfig(libcap-ng) +BuildRequires: pkgconfig(libuv) +BuildRequires: pkgconfig(luajit) >= 2.0 +BuildRequires: pkgconfig(jemalloc) +BuildRequires: systemd-rpm-macros + +Requires: systemd +Requires(post): systemd + +# dnstap module dependencies +# SUSE is missing protoc protobuf compiler +%if "x%{?suse_version}" == "x" +BuildRequires: pkgconfig(libfstrm) +BuildRequires: pkgconfig(libprotobuf-c) +%endif + +# Distro-dependent dependencies +%if 0%{?rhel} == 7 +BuildRequires: lmdb-devel +# Lua 5.1 version of the libraries have different package names +Requires: lua-basexx +Requires: lua-psl +Requires: lua-http +%endif +%if 0%{?fedora} || 0%{?rhel} > 7 +BuildRequires: pkgconfig(lmdb) +BuildRequires: python3-sphinx +Requires: lua5.1-basexx +Requires: lua5.1-cqueues +Requires: lua5.1-http +Recommends: lua5.1-psl +%endif + +# we do not build HTTP module on SuSE so the build requires is not needed +%if "x%{?suse_version}" == "x" +BuildRequires: openssl-devel +%endif + +%if 0%{?suse_version} +%define NINJA ninja +BuildRequires: lmdb-devel +BuildRequires: python3-Sphinx +Requires(pre): shadow +%endif + +%if "x%{?rhel}" == "x" +# dependencies for doc package +# NOTE: doc isn't possible to build on CentOS 7, 8 +# python2-sphinx is too old and python36-breathe is broken on CentOS 7 +# python3-breathe isn't available for CentOS 8 (yet? rhbz#1808766) +BuildRequires: doxygen +BuildRequires: python3-breathe +BuildRequires: python3-sphinx_rtd_theme +BuildRequires: texinfo +%endif + +%description +The Knot Resolver is a DNSSEC-enabled caching full resolver implementation +written in C and LuaJIT, including both a resolver library and a daemon. +Modular architecture of the library keeps the core tiny and efficient, and +provides a state-machine like API for extensions. + +The package is pre-configured as local caching resolver. +To start using it, start a single kresd instance: +$ systemctl start kresd@1.service + +%package devel +Summary: Development headers for Knot Resolver +Requires: %{name}%{?_isa} = %{version}-%{release} + +%description devel +The package contains development headers for Knot Resolver. + +%if "x%{?rhel}" == "x" +%package doc +Summary: Documentation for Knot Resolver +BuildArch: noarch +Requires: %{name} = %{version}-%{release} + +%description doc +Documentation for Knot Resolver +%endif + +%if "x%{?suse_version}" == "x" +%package module-dnstap +Summary: dnstap module for Knot Resolver +Requires: %{name} = %{version}-%{release} + +%description module-dnstap +dnstap module for Knot Resolver supports logging DNS responses to a unix socket +in dnstap format using fstrm framing library. This logging is useful if you +need effectively log all DNS traffic. +%endif + +%if "x%{?suse_version}" == "x" +%package module-http +Summary: HTTP module for Knot Resolver +Requires: %{name} = %{version}-%{release} +%if 0%{?fedora} || 0%{?rhel} > 7 +Requires: lua5.1-http +Requires: lua5.1-mmdb +%else +Requires: lua-http +Requires: lua-mmdb +%endif + +%description module-http +HTTP module for Knot Resolver can serve as API endpoint for other modules or +provide a web interface for local visualization of the resolver cache and +queries. It can also serve DNS-over-HTTPS, but it is deprecated in favor of +native C implementation, which doesn't require this package. +%endif + +%prep +%if 0%{GPG_CHECK} +export GNUPGHOME=./gpg-keyring +mkdir -m 700 ${GNUPGHOME} +gpg2 --import %{SOURCE100} +gpg2 --verify %{SOURCE1} %{SOURCE0} +%endif +%setup -q -n %{name}-%{version} + +# Create a sysusers.d config file +cat >knot-resolver.sysusers.conf </dev/null | grep -qv masked ; then + systemctl show ${sock} -p Listen > ${UPG_DIR}/${sock} + case "$(systemctl show ${sock} -p BindIPv6Only)" in + *ipv6-only) + touch ${UPG_DIR}/${sock}.v6only + ;; + *default) + if cat /proc/sys/net/ipv6/bindv6only | grep -q 1 ; then + touch ${UPG_DIR}/${sock}.v6only + fi + ;; + esac + fi + done +fi +%endif + + +%post +# upgrade-4-to-5 +%if "x%{?rhel}" == "x" +export UPG_DIR=%{_sharedstatedir}/knot-resolver/.upgrade-4-to-5 +if [ -f ${UPG_DIR}/.unfinished ] ; then + rm -f ${UPG_DIR}/.unfinished + kresd -c %{_libdir}/knot-resolver/upgrade-4-to-5.lua &>/dev/null + echo -e "\n !!! WARNING !!!" + echo -e "Knot Resolver configuration file requires manual upgrade.\n" + cat ${UPG_DIR}/kresd.conf.net 2>/dev/null +fi +%endif + +# 5.0.1 fix to force restart of kres-cache-gc.service, which was missing in systemd_postun_with_restart +# TODO: remove once most users upgrade to 5.0.1+ +systemctl daemon-reload >/dev/null 2>&1 || : +if [ $1 -ge 2 ] ; then + systemctl try-restart kres-cache-gc.service >/dev/null 2>&1 || : +fi + +# systemd_post macro is not needed for anything (calls systemctl preset) +%tmpfiles_create %{_tmpfilesdir}/knot-resolver.conf +%if "x%{?fedora}" == "x" +/sbin/ldconfig +%endif + +%preun +%systemd_preun kres-cache-gc.service kresd.target + +%postun +%systemd_postun_with_restart 'kresd@*.service' kres-cache-gc.service +%if "x%{?fedora}" == "x" +/sbin/ldconfig +%endif + +%files +%dir %{_pkgdocdir} +%license %{_pkgdocdir}/COPYING +%doc %{_pkgdocdir}/AUTHORS +%doc %{_pkgdocdir}/NEWS +%doc %{_pkgdocdir}/examples +%dir %{_sysconfdir}/knot-resolver +%config(noreplace) %{_sysconfdir}/knot-resolver/kresd.conf +%config(noreplace) %{_sysconfdir}/knot-resolver/root.hints +%{_sysconfdir}/knot-resolver/icann-ca.pem +%attr(750,knot-resolver,knot-resolver) %dir %{_sharedstatedir}/knot-resolver +%attr(640,knot-resolver,knot-resolver) %{_sharedstatedir}/knot-resolver/root.keys +%{_unitdir}/kresd@.service +%{_unitdir}/kres-cache-gc.service +%{_unitdir}/kresd.target +%dir %{_unitdir}/multi-user.target.wants +%{_unitdir}/multi-user.target.wants/kresd.target +%{_mandir}/man7/kresd.systemd.7.gz +%{_tmpfilesdir}/knot-resolver.conf +%ghost /run/%{name} +%ghost %{_localstatedir}/cache/%{name} +%attr(750,knot-resolver,knot-resolver) %dir %{_libdir}/%{name} +%{_sbindir}/kresd +%{_sbindir}/kresc +%{_sbindir}/kres-cache-gc +%{_libdir}/libkres.so.* +%{_libdir}/knot-resolver/*.so +%{_libdir}/knot-resolver/*.lua +%dir %{_libdir}/knot-resolver/kres_modules +%{_libdir}/knot-resolver/kres_modules/bogus_log.so +%{_libdir}/knot-resolver/kres_modules/edns_keepalive.so +%{_libdir}/knot-resolver/kres_modules/extended_error.so +%{_libdir}/knot-resolver/kres_modules/hints.so +%{_libdir}/knot-resolver/kres_modules/nsid.so +%{_libdir}/knot-resolver/kres_modules/refuse_nord.so +%{_libdir}/knot-resolver/kres_modules/stats.so +%{_libdir}/knot-resolver/kres_modules/daf +%{_libdir}/knot-resolver/kres_modules/daf.lua +%{_libdir}/knot-resolver/kres_modules/detect_time_jump.lua +%{_libdir}/knot-resolver/kres_modules/detect_time_skew.lua +%{_libdir}/knot-resolver/kres_modules/dns64.lua +%if "x%{?suse_version}" == "x" +%{_libdir}/knot-resolver/kres_modules/experimental_dot_auth.lua +%endif +%{_libdir}/knot-resolver/kres_modules/graphite.lua +%{_libdir}/knot-resolver/kres_modules/policy.lua +%{_libdir}/knot-resolver/kres_modules/predict.lua +%{_libdir}/knot-resolver/kres_modules/prefill.lua +%{_libdir}/knot-resolver/kres_modules/priming.lua +%{_libdir}/knot-resolver/kres_modules/rebinding.lua +%{_libdir}/knot-resolver/kres_modules/renumber.lua +%{_libdir}/knot-resolver/kres_modules/serve_stale.lua +%{_libdir}/knot-resolver/kres_modules/ta_sentinel.lua +%{_libdir}/knot-resolver/kres_modules/ta_signal_query.lua +%{_libdir}/knot-resolver/kres_modules/ta_update.lua +%{_libdir}/knot-resolver/kres_modules/view.lua +%{_libdir}/knot-resolver/kres_modules/watchdog.lua +%{_libdir}/knot-resolver/kres_modules/workarounds.lua +%{_mandir}/man8/kresd.8.gz +%{_sysusersdir}/knot-resolver.conf + +%files devel +%{_includedir}/libkres +%{_libdir}/pkgconfig/libkres.pc +%{_libdir}/libkres.so + +%if "x%{?rhel}" == "x" +%files doc +%dir %{_pkgdocdir} +%doc %{_pkgdocdir}/html +%doc %{_datadir}/info/knot-resolver.info* +%dir %{_datadir}/info/knot-resolver-figures +%doc %{_datadir}/info/knot-resolver-figures/* +%endif + +%if "x%{?suse_version}" == "x" +%files module-dnstap +%{_libdir}/knot-resolver/kres_modules/dnstap.so +%endif + +%if "x%{?suse_version}" == "x" +%files module-http +%{_libdir}/knot-resolver/debug_opensslkeylog.so +%{_libdir}/knot-resolver/kres_modules/http +%{_libdir}/knot-resolver/kres_modules/http*.lua +%{_libdir}/knot-resolver/kres_modules/prometheus.lua +%endif + +%changelog +* Mon Oct 20 2025 Jakub Ružička - 5.7.6-3 +- Rebuilt for Knot DNS 3.5 + +* Thu Jul 24 2025 Fedora Release Engineering - 5.7.6-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild + +* Fri Jul 18 2025 Jakub Ružička - 5.7.6-1 +- New upstream version 5.7.6 + +* Thu Apr 24 2025 Jakub Ružička - 5.7.5-1 +- New upstream version 5.7.5 +- Remove duplicate file listing + +* Tue Feb 11 2025 Zbigniew Jędrzejewski-Szmek - 5.7.4-4 +- Add sysusers.d config file to allow rpm to create users/groups automatically + +* Fri Jan 17 2025 Fedora Release Engineering - 5.7.4-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild + +* Tue Nov 26 2024 Jakub Ružička - 5.7.4-2 +- Rebuilt for Knot DNS 3.4 + +* Wed Jul 24 2024 Jakub Ružička - 5.7.4-1 +- New upstream version 5.7.4 + +* Thu Jul 18 2024 Fedora Release Engineering - 5.7.3-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild + +* Tue Jun 04 2024 Jakub Ružička - 5.7.3-1 +- New upstream version 5.7.3 + +* Wed Apr 03 2024 Jakub Ružička - 5.7.2-1 +- New upstream version 5.7.2 + +* Wed Feb 14 2024 Jakub Ružička - 5.7.1-1 +- New upstream version 5.7.1 + +* Thu Jan 25 2024 Fedora Release Engineering - 5.7.0-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + +* Sun Jan 21 2024 Fedora Release Engineering - 5.7.0-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + +* Thu Nov 09 2023 Jakub Ružička - 5.7.0-3 +- Rebuild for Fedora 40, Knot DNS 3.3.2 + +* Tue Aug 29 2023 Jakub Ružička - 5.7.0-2 +- Rebuilt for Knot DNS 3.3 + +* Tue Aug 22 2023 Jakub Ružička - 5.7.0-1 +- New upstream version 5.7.0 + +* Thu Jul 20 2023 Fedora Release Engineering - 5.6.0-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild + +* Thu Jan 26 2023 Jakub Ružička - 5.6.0-1 +- update to upstream version 5.6.0 + +* Thu Jan 19 2023 Fedora Release Engineering - 5.5.3-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild + +* Thu Sep 22 2022 Jakub Ružička - 5.5.3-1 +- update to upstream version 5.5.3 + +* Wed Aug 24 2022 Jakub Ružička - 5.5.2-1 +- update to upstream version 5.5.2 +- add BuildRequires: systemd-rpm-macros + +* Thu Jul 21 2022 Fedora Release Engineering - 5.5.1-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild + +* Tue Jun 14 2022 Jakub Ružička - 5.5.1-1 +- update to upstream version 5.5.1 + +* Tue Mar 15 2022 Jakub Ružička - 5.5.0-1 +- update to upstream version 5.5.0 +- update upstream signing keys + +* Thu Jan 20 2022 Fedora Release Engineering - 5.4.4-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild + +* Wed Jan 05 2022 Jakub Ružička - 5.4.4-1 +- update to upstream version 5.4.4 + +* Wed Dec 01 2021 Jakub Ružička - 5.4.3-1 +- update to upstream version 5.4.3 + +* Sat Nov 06 2021 Adrian Reber - 5.4.2-3 +- Rebuilt for protobuf 3.19.0 + +* Tue Oct 26 2021 Adrian Reber - 5.4.2-2 +- Rebuilt for protobuf 3.18.1 + +* Mon Oct 18 2021 Jakub Ružička - 5.4.2-1 +- update to upstream version 5.4.2 + +* Thu Aug 19 2021 Jakub Ružička - 5.4.1-1 +- update to upstream version 5.4.1 + +* Mon Aug 09 2021 Jakub Ružička - 5.4.0-2 +- rebuild for Knot DNS 3.1 (#1990583) + +* Thu Jul 29 2021 Jakub Ružička - 5.4.0-1 +- update to upstream version 5.4.0 + +* Thu Jul 22 2021 Fedora Release Engineering - 5.3.2-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild + +* Fri May 07 2021 Jakub Ružička - 5.3.2-1 +- update to upstream version 5.3.2 + +* Thu Apr 01 2021 Jakub Ružička - 5.3.1-1 +- update to upstream version 5.3.1 + +* Tue Mar 02 2021 Zbigniew Jędrzejewski-Szmek - 5.3.0-2 +- Rebuilt for updated systemd-rpm-macros + See https://pagure.io/fesco/issue/2583. + +* Mon Mar 01 2021 Jakub Ružička - 5.3.0-1 +- update to upstream version 5.3.0 +- add dnstap module subpackage +- required Knot DNS >= 2.9 + +* Tue Jan 26 2021 Fedora Release Engineering - 5.2.1-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild + +* Fri Dec 18 2020 Jakub Ružička - 5.2.1-1 +- update to upstream version 5.2.1 + +* Wed Nov 11 2020 Jakub Ružička 5.2.0-1 +- update to upstream version 5.2.0 +- sync packaging from upstream + +* Wed Sep 23 2020 Jakub Ružička 5.1.3-2 +- rebuild for Knot DNS 3.0.0 + +* Tue Sep 08 2020 Jakub Ružička 5.1.3-1 +- update to upstream version 5.1.3 + +* Tue Jul 28 2020 Fedora Release Engineering - 5.1.2-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild + +* Wed Jul 01 2020 Tomas Krizek - 5.1.2-1 +- update to upstream version 5.1.2 + +* Tue May 19 2020 Tomas Krizek - 5.1.1-1 +- update to upstream version 5.1.1 (fixes CVE-2020-12667) + +* Wed Apr 29 2020 Tomas Krizek - 5.1.0-1 +- update to upstream version 5.1.0 +- make spec compatible with EPEL 8 (rhbz#1783252) +- support documentation build with Sphinx v3.0.0+ (rhbz#1823534) + +* Thu Apr 02 2020 Tomas Krizek - 5.0.1-2 +- add patch to fix strict aliasing (!971) until next release + +* Wed Feb 05 2020 Tomas Krizek - 5.0.1-1 +- update to upstream version 5.0.1 +- ensure kres-cache-gc.service is restarted on upgrade + +* Wed Jan 29 2020 Fedora Release Engineering - 5.0.0-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild + +* Mon Jan 27 2020 Tomas Krizek - 5.0.0-1 +- update to new upstream version 5.0.0 +- removed systemd socket files (no longer supported) +- add upgrade scriptlets for 5.x +- remove lua-sec, lua-socket, lua-filesystem dependencies +- create tmpfiles dirs with macro + +* Wed Dec 04 2019 Tomas Krizek - 4.3.0-1 +- update to new upstream version 4.3.0 +- make config directory read-only for knot-resolver, relocate root.keys to /var/lib +- http module now depends on the exact same binary version of knot-resolver + +* Tue Nov 12 2019 Tomas Krizek - 4.2.2-2 +- rebuild for libknot10 (Knot DNS 2.9.1) + +* Mon Oct 07 2019 Tomas Krizek - 4.2.2-1 +- update to new upstream version 4.2.2 + +* Thu Sep 26 2019 Tomas Krizek - 4.2.1-1 +- update to new upstream version 4.2.1 + +* Wed Aug 21 2019 Tomas Krizek - 4.2.0-1 +- update to new upstream version 4.2.0 +- added lua-psl dependency for policy.slice() functionality + +* Thu Jul 25 2019 Fedora Release Engineering - 4.1.0-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild + +* Wed Jul 10 2019 Tomas Krizek - 4.1.0-1 +- update to new upstream version 4.1.0 +- add kres-cache-gc.service + +* Wed May 29 2019 Tomas Krizek - 4.0.0.-1 +- rebase to new upstream release 4.0.0 +- bump Knot DNS libraries to 2.8 (ABI compat) +- use new upstream build system - meson +- add knot-resolver-module-http package along with new lua dependecies + +* Fri Feb 01 2019 Fedora Release Engineering - 3.2.1-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild + +* Thu Jan 10 2019 Tomas Krizek - 3.2.1-1 +Knot Resolver 3.2.1 (2019-01-10) +================================ + +Bugfixes +-------- +- trust_anchors: respect validity time range during TA bootstrap (!748) +- fix TLS rehandshake handling (!739) +- make TLS_FORWARD compatible with GnuTLS 3.3 (!741) +- special thanks to Grigorii Demidov for his long-term work on Knot Resolver! + +Improvements +------------ +- improve handling of timeouted outgoing TCP connections (!734) +- trust_anchors: check syntax of public keys in DNSKEY RRs (!748) +- validator: clarify message about bogus non-authoritative data (!735) +- dnssec validation failures contain more verbose reasoning (!735) +- new function trust_anchors.summary() describes state of DNSSEC TAs (!737), + and logs new state of trust anchors after start up and automatic changes +- trust anchors: refuse revoked DNSKEY even if specified explicitly, + and downgrade missing the SEP bit to a warning + + +* Mon Dec 17 2018 Tomas Krizek - 3.2.0-1 +Knot Resolver 3.2.0 (2018-12-17) +================================ + +New features +------------ +- module edns_keepalive to implement server side of RFC 7828 (#408) +- module nsid to implement server side of RFC 5001 (#289) +- module bogus_log provides .frequent() table (!629, credit Ulrich Wisser) +- module stats collects flags from answer messages (!629, credit Ulrich Wisser) +- module view supports multiple rules with identical address/TSIG specification + and keeps trying rules until a "non-chain" action is executed (!678) +- module experimental_dot_auth implements an DNS-over-TLS to auth protocol + (!711, credit Manu Bretelle) +- net.bpf bindings allow advanced users to use eBPF socket filters + +Bugfixes +-------- +- http module: only run prometheus in parent process if using --forks=N, + as the submodule collects metrics from all sub-processes as well. +- TLS fixes for corner cases (!700, !714, !716, !721, !728) +- fix build with -DNOVERBOSELOG (#424) +- policy.{FORWARD,TLS_FORWARD,STUB}: respect net.ipv{4,6} setting (!710) +- avoid SERVFAILs due to certain kind of NS dependency cycles, again + (#374) this time seen as 'circular dependency' in verbose logs +- policy and view modules do not overwrite result finished requests (!678) + +Improvements +------------ +- Dockerfile: rework, basing on Debian instead of Alpine +- policy.{FORWARD,TLS_FORWARD,STUB}: give advantage to IPv6 + when choosing whom to ask, just as for iteration +- use pseudo-randomness from gnutls instead of internal ISAAC (#233) +- tune the way we deal with non-responsive servers (!716, !723) +- documentation clarifies interaction between policy and view modules (!678, !730) + +Module API changes +------------------ +- new layer is added: answer_finalize +- kr_request keeps ::qsource.packet beyond the begin layer +- kr_request::qsource.tcp renamed to ::qsource.flags.tcp +- kr_request::has_tls renamed to ::qsource.flags.tls +- kr_zonecut_add(), kr_zonecut_del() and kr_nsrep_sort() changed parameters slightly + + +* Fri Nov 02 2018 Tomas Krizek - 3.1.0-1 +Knot Resolver 3.1.0 (2018-11-02) +================================ + +Incompatible changes +-------------------- +- hints.use_nodata(true) by default; that's what most users want +- libknot >= 2.7.2 is required + +Improvements +------------ +- cache: handle out-of-space SIGBUS slightly better (#197) +- daemon: improve TCP timeout handling (!686) + +Bugfixes +-------- +- cache.clear('name'): fix some edge cases in API (#401) +- fix error handling from TLS writes (!669) +- avoid SERVFAILs due to certain kind of NS dependency cycles (#374) + +* Mon Aug 20 2018 Tomas Krizek - 3.0.0-1 +Knot Resolver 3.0.0 (2018-08-20) +================================ + +Incompatible changes +-------------------- +- cache: fail lua operations if cache isn't open yet (!639) + By default cache is opened *after* reading the configuration, + and older versions were silently ignoring cache operations. + Valid configuration must open cache using `cache.open()` or `cache.size =` + before executing cache operations like `cache.clear()`. +- libknot >= 2.7.1 is required, which brings also larger API changes +- in case you wrote custom Lua modules, please consult + https://knot-resolver.readthedocs.io/en/latest/lib.html#incompatible-changes-since-3-0-0 +- in case you wrote custom C modules, please see compile against + Knot DNS 2.7 and adjust your module according to messages from C compiler +- DNS cookie module (RFC 7873) is not available in this release, + it will be later reworked to reflect development in IEFT dnsop working group +- version module was permanently removed because it was not really used by users; + if you want to receive notifications abou new releases please subscribe to + https://lists.nic.cz/cgi-bin/mailman/listinfo/knot-resolver-announce + +Bugfixes +-------- +- fix multi-process race condition in trust anchor maintenance (!643) +- ta_sentinel: also consider static trust anchors not managed via RFC 5011 + +Improvements +------------ +- reorder_RR() implementation is brought back +- bring in performace improvements provided by libknot 2.7 +- cache.clear() has a new, more powerful API +- cache documentation was improved +- old name "Knot DNS Resolver" is replaced by unambiguous "Knot Resolver" + to prevent confusion with "Knot DNS" authoritative server + +* Thu Aug 02 2018 Tomas Krizek - 2.4.1-1 +Knot Resolver 2.4.1 (2018-08-02) +================================ + +Security +-------- +- fix CVE-2018-10920: Improper input validation bug in DNS resolver component + (security!7, security!9) + +Bugfixes +-------- +- cache: fix TTL overflow in packet due to min_ttl (#388, security!8) +- TLS session resumption: avoid bad scheduling of rotation (#385) +- HTTP module: fix a regression in 2.4.0 which broke custom certs (!632) +- cache: NSEC3 negative cache even without NS record (#384) + This fixes lower hit rate in NSEC3 zones (since 2.4.0). +- minor TCP and TLS fixes (!623, !624, !626) + + +* Fri Jul 13 2018 Fedora Release Engineering - 2.4.0-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild + +* Tue Jul 03 2018 Tomas Krizek - 2.4.0-1 +Knot Resolver 2.4.0 (2018-07-03) +================================ + +Incompatible changes +-------------------- +- minimal libknot version is now 2.6.7 to pull in latest fixes (#366) + +Security +-------- +- fix a rare case of zones incorrectly dowgraded to insecure status (!576) + +New features +------------ +- TLS session resumption (RFC 5077), both server and client (!585, #105) + (disabled when compiling with gnutls < 3.5) +- TLS_FORWARD policy uses system CA certificate store by default (!568) +- aggressive caching for NSEC3 zones (!600) +- optional protection from DNS Rebinding attack (module rebinding, !608) +- module bogus_log to log DNSSEC bogus queries without verbose logging (!613) + +Bugfixes +-------- +- prefill: fix ability to read certificate bundle (!578) +- avoid turning off qname minimization in some cases, e.g. co.uk. (#339) +- fix validation of explicit wildcard queries (#274) +- dns64 module: more properties from the RFC implemented (incl. bug #375) + +Improvements +------------ +- systemd: multiple enabled kresd instances can now be started using kresd.target +- ta_sentinel: switch to version 14 of the RFC draft (!596) +- support for glibc systems with a non-Linux kernel (!588) +- support per-request variables for Lua modules (!533) +- support custom HTTP endpoints for Lua modules (!527) + + +* Mon Apr 23 2018 Tomas Krizek - 2.3.0-1 +Knot Resolver 2.3.0 (2018-04-23) +================================ + +Security +-------- +- fix CVE-2018-1110: denial of service triggered by malformed DNS messages + (!550, !558, security!2, security!4) +- increase resilience against slow lorris attack (security!5) + +Bugfixes +-------- +- validation: fix SERVFAIL in case of CNAME to NXDOMAIN in a single zone (!538) +- validation: fix SERVFAIL for DS . query (!544) +- lib/resolve: don't send unecessary queries to parent zone (!513) +- iterate: fix validation for zones where parent and child share NS (!543) +- TLS: improve error handling and documentation (!536, !555, !559) + +Improvements +------------ +- prefill: new module to periodically import root zone into cache + (replacement for RFC 7706, !511) +- network_listen_fd: always create end point for supervisor supplied file descriptor +- use CPPFLAGS build environment variable if set (!547) + + +* Wed Mar 28 2018 Tomas Krizek - 2.2.0-1 +Knot Resolver 2.2.0 (2018-03-28) +================================ + +New features +------------ +- cache server unavailability to prevent flooding unreachable servers + (Please note that caching algorithm needs further optimization + and will change in further versions but we need to gather operational + experience first.) + +Bugfixes +-------- +- don't magically -D_FORTIFY_SOURCE=2 in some cases +- allow large responses for outbound over TCP +- fix crash with RR sets with over 255 records + + +* Mon Feb 26 2018 Tomas Krizek - 2.1.1-1 +Knot Resolver 2.1.1 (2018-02-23) +================================ + +Bugfixes +-------- +- when iterating, avoid unnecessary queries for NS in insecure parent. + This problem worsened in 2.0.0. (#246) +- prevent UDP packet leaks when using TLS forwarding +- fix the hints module also on some other systems, e.g. Gentoo. + +* Fri Feb 16 2018 Tomas Krizek - 2.1.0-1 +- New upstream release 2.1.0 + +Knot Resolver 2.1.0 (2018-02-16) +================================ + +Incompatible changes +-------------------- +- stats: remove tracking of expiring records (predict uses another way) +- systemd: more chages in default unit files (TODO) +- ta_sentinel: implement protocol draft-ietf-dnsop-kskroll-sentinel-01 + (our draft-ietf-dnsop-kskroll-sentinel-00 implementation had inverted logic) +- libknot: require version 2.6.4 or newer to get bugfixes for DNS-over-TLS + +Bugfixes +-------- +- detect_time_jump module: don't clear cache on suspend-resume (#284) +- stats module: fix stats.list() returning nothing, regressed in 2.0.0 +- policy.TLS_FORWARD: refusal when configuring with multiple IPs (#306) +- cache: fix broken refresh of insecure records that were about to expire +- fix the hints module on some systems, e.g. Fedora (came back on 2.0.0) +- build with older gnutls (conditionally disable features) +- fix the predict module to work with insecure records & cleanup code + + +Knot Resolver 2.0.0 (2018-01-31) +================================ + +Incompatible changes +-------------------- +- systemd: change unit files to allow running multiple instances, + deployments with single instance now must use `kresd@1.service` + instead of `kresd.service`; see kresd.systemd(8) for details +- systemd: the directory for cache is now /var/cache/knot-resolver +- unify default directory and user to `knot-resolver` +- directory with trust anchor file specified by -k option must be writeable +- policy module is now loaded by default to enforce RFC 6761; + see documentation for policy.PASS if you use locally-served DNS zones +- drop support for alternative cache backends memcached, redis, + and for Lua bindings for some specific cache operations +- REORDER_RR option is not implemented (temporarily) + +New features +------------ +- aggressive caching of validated records (RFC 8198) for NSEC zones; + thanks to ICANN for sponsoring this work. +- forwarding over TLS, authenticated by SPKI pin or certificate. + policy.TLS_FORWARD pipelines queries out-of-order over shared TLS connection + Beware: Some resolvers do not support out-of-order query processing. + TLS forwarding to such resolvers will lead to slower resolution or failures. +- trust anchors: you may specify a read-only file via -K or --keyfile-ro +- trust anchors: at build-time you may set KEYFILE_DEFAULT (read-only) +- ta_sentinel module implements draft ietf-dnsop-kskroll-sentinel-00, + enabled by default +- serve_stale module is prototype, subject to change +- extended API for Lua modules + +Bugfixes +-------- +- fix build on osx - regressed in 1.5.3 (different linker option name) + +* Wed Feb 07 2018 Fedora Release Engineering - 1.5.3-1.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild + +* Tue Jan 23 2018 Tomas Krizek - 1.5.3-1 +- New upstream release 1.5.3 + +Knot Resolver 1.5.3 (2018-01-23) +================================ + +Bugfixes +-------- +- fix the hints module on some systems, e.g. Fedora. + Symptom: `undefined symbol: engine_hint_root_file` + + +Knot Resolver 1.5.2 (2018-01-22) +================================ + +Security +-------- +- fix CVE-2018-1000002: insufficient DNSSEC validation, allowing + attackers to deny existence of some data by forging packets. + Some combinations pointed out in RFC 6840 sections 4.1 and 4.3 + were not taken into account. + +Bugfixes +-------- +- memcached: fix fallout from module rename in 1.5.1 + + +Knot Resolver 1.5.1 (2017-12-12) +================================ + +Incompatible changes +-------------------- +- script supervisor.py was removed, please migrate to a real process manager +- module ketcd was renamed to etcd for consistency +- module kmemcached was renamed to memcached for consistency + +Bugfixes +-------- +- fix SIGPIPE crashes (#271) +- tests: work around out-of-space for platforms with larger memory pages +- lua: fix mistakes in bindings affecting 1.4.0 and 1.5.0 (and 1.99.1-alpha), + potentially causing problems in dns64 and workarounds modules +- predict module: various fixes (!399) + +Improvements +------------ +- add priming module to implement RFC 8109, enabled by default (#220) +- add modules helping with system time problems, enabled by default; + for details see documentation of detect_time_skew and detect_time_jump + +* Fri Jan 05 2018 Tomas Krizek - 1.5.0-2 +- add doc package +- configure tarball signature verification +- add root.hints file +- use upstream systemd unit files, paths and user name + - migrate configuration to /etc/knot-resolver + - use user knot-resolver + - store cache in /var/cache/knot-resolver + - use systemd alias knot-resolver -> kresd + +* Mon Nov 06 2017 Petr Špaček - 1.5.0-1 +- New upstream release 1.5.0 + +Knot Resolver 1.5.0 (2017-11-02) +================================ + +Bugfixes +-------- +- fix loading modules on Darwin + +Improvements +------------ +- new module ta_signal_query supporting Signaling Trust Anchor Knowledge + using Keytag Query (RFC 8145 section 5); it is enabled by default +- attempt validation for more records but require it for fewer of them + (e.g. avoids SERVFAIL when server adds extra records but omits RRSIGs) + + +Knot Resolver 1.4.0 (2017-09-22) +================================ + +Incompatible changes +-------------------- +- lua: query flag-sets are no longer represented as plain integers. + kres.query.* no longer works, and kr_query_t lost trivial methods + 'hasflag' and 'resolved'. + You can instead write code like qry.flags.NO_0X20 = true. + +Bugfixes +-------- +- fix exiting one of multiple forks (#150) +- cache: change the way of using LMDB transactions. That in particular + fixes some cases of using too much space with multiple kresd forks (#240). + +Improvements +------------ +- policy.suffix: update the aho-corasick code (#200) +- root hints are now loaded from a zonefile; exposed as hints.root_file(). + You can override the path by defining ROOTHINTS during compilation. +- policy.FORWARD: work around resolvers adding unsigned NS records (#248) +- reduce unneeded records previously put into authority in wildcarded answers + + +Knot Resolver 1.3.3 (2017-08-09) +================================ + +Security +-------- +- Fix a critical DNSSEC flaw. Signatures might be accepted as valid + even if the signed data was not in bailiwick of the DNSKEY used to + sign it, assuming the trust chain to that DNSKEY was valid. + +Bugfixes +-------- +- iterate: skip RRSIGs with bad label count instead of immediate SERVFAIL +- utils: fix possible incorrect seeding of the random generator +- modules/http: fix compatibility with the Prometheus text format + +Improvements +------------ +- policy: implement remaining special-use domain names from RFC6761 (#205), + and make these rules apply only if no other non-chain rule applies + +* Tue Aug 01 2017 Petr Spacek - 1.3.2-1 +New upstream release: +Knot Resolver 1.3.2 (2017-07-28) +================================ + +Security +-------- +- fix possible opportunities to use insecure data from cache as keys + for validation + +Bugfixes +-------- +- daemon: check existence of config file even if rundir isn't specified +- policy.FORWARD and STUB: use RTT tracking to choose servers (#125, #208) +- dns64: fix CNAME problems (#203) It still won't work with policy.STUB. +- hints: better interpretation of hosts-like files (#204) + also, error out if a bad entry is encountered in the file +- dnssec: handle unknown DNSKEY/DS algorithms (#210) +- predict: fix the module, broken since 1.2.0 (#154) + +Improvements +------------ +- embedded LMDB fallback: update 0.9.18 -> 0.9.21 + +* Wed Jul 26 2017 Fedora Release Engineering - 1.3.1-1.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild + +* Tue Jul 11 2017 Petr Spacek - 1.3.1-2 +- build experimental command line interface "kresc" + +* Tue Jul 11 2017 Petr Spacek - 1.3.1-1 +New upstream release: +Knot Resolver 1.3.1 (2017-06-23) +================================ + +Bugfixes +-------- +- modules/http: fix finding the static files (bug from 1.3.0) +- policy.FORWARD: fix some cases of CNAMEs obstructing search for zone cuts + + +Knot Resolver 1.3.0 (2017-06-13) +================================ + +Security +-------- +- Refactor handling of AD flag and security status of resource records. + In some cases it was possible for secure domains to get cached as + insecure, even for a TLD, leading to disabled validation. + It also fixes answering with non-authoritative data about nameservers. + +Improvements +------------ +- major feature: support for forwarding with validation (#112). + The old policy.FORWARD action now does that; the previous non-validating + mode is still avaliable as policy.STUB except that also uses caching (#122). +- command line: specify ports via @ but still support # for compatibility +- policy: recognize 100.64.0.0/10 as local addresses +- layer/iterate: *do* retry repeatedly if REFUSED, as we can't yet easily + retry with other NSs while avoiding retrying with those who REFUSED +- modules: allow changing the directory where modules are found, + and do not search the default library path anymore. + +Bugfixes +-------- +- validate: fix insufficient caching for some cases (relatively rare) +- avoid putting "duplicate" record-sets into the answer (#198) + + +Knot Resolver 1.2.6 (2017-04-24) +================================ + +Security +-------- +- dnssec: don't set AD flag for NODATA answers if wildcard non-existence + is not guaranteed due to opt-out in NSEC3 + +Improvements +------------ +- layer/iterate: don't retry repeatedly if REFUSED + +Bugfixes +-------- +- lib/nsrep: revert some changes to NS reputation tracking that caused + severe problems to some users of 1.2.5 (#178 and #179) +- dnssec: fix verification of wildcarded non-singleton RRsets +- dnssec: allow wildcards located directly under the root +- layer/rrcache: avoid putting answer records into queries in some cases + +* Thu Apr 06 2017 Petr Spacek - 1.2.5-1 +- new upstream relase + + security: layer/validate: clear AD if closest encloser proof has opt-outed NSEC3 (#169) + + security: layer/validate: check if NSEC3 records in wildcard expansion proof has an opt-out + + security: dnssec/nsec: missed wildcard no-data answers validation has been implemented + + fix: trust anchors: Improve trust anchors storage format (#167) + + fix: trust anchors: support non-root TAs, one domain per file + + fix: policy.DENY: set AA flag and clear AD flag + + fix: lib/resolve: avoid unnecessary DS queries + + fix: lib/nsrep: don't treat servers with NOIP4 + NOIP6 flags as timeouted + + fix: layer/iterate: During packet classification (answer vs. referral) don't analyze + AUTHORITY section in authoritative answer if ANSWER section contains records + that have been requested + + enhancement: modules/dnstap: a DNSTAP support module (Contributed by Vicky Shrestha) + + enhancement: modules/workarounds: a module adding workarounds for known DNS protocol violators + + enhancement: layer/iterate: fix logging of glue addresses + + enhancement: kr_bitcmp: allow bits=0 and consequently 0.0.0.0/0 matches in view and renumber modules. + + enhancement: modules/padding: Improve default padding of responses (Contributed by Daniel Kahn Gillmor) + + enhancement: New kresc client utility (experimental; don't rely on the API yet) + +* Thu Mar 09 2017 Petr Spacek - 1.2.4-1 +- new upstream release + + security: Knot Resolver 1.2.0 and higher could return AD flag for insecure + answer if the daemon received answer with invalid RRSIG several + times in a row. + + fix: layer/iterate: some improvements in cname chain unrolling + + fix: layer/validate: fix duplicate records in AUTHORITY section in case + + fix: of WC expansion proof + + fix: lua: do *not* truncate cache size to unsigned + + fix: forwarding mode: correctly forward +cd flag + + fix: fix a potential memory leak + + fix: don't treat answers that contain DS non-existance proof as insecure + + fix: don't store NSEC3 and their signatures in the cache + + fix: layer/iterate: when processing delegations, + check if qname is at or below new authority + + enhancement: modules/policy: allow QTRACE policy to be chained + with other policies + + enhancement: hints.add_hosts(path): a new property + + enhancement: module: document the API and simplify the code + + enhancement: policy.MIRROR: support IPv6 link-local addresses + + enhancement: policy.FORWARD: support IPv6 link-local addresses + + enhancement: add net.outgoing_{v4,v6} to allow specifying address + to use for connections + +* Mon Feb 27 2017 Petr Spacek - 1.2.3-1 +- new upstream release + + security: a cached negative answer from a CD query would be reused + to construct response for non-CD queries, resulting in Insecure status + instead of Bogus. + + fix: lua: make the map command check its arguments + + fix: -k argument processing to avoid out-of-bounds memory accesses + + fix: lib/resolve: fix zonecut fetching for explicit DS queries + + fix: hints: more NULL checks + + fix: TA bootstrapping for multiple TAs in the IANA XML file + + fix: Disable storing GLUE records into the cache even in the + + fix: (non-default) QUERY_PERMISSIVE mode + + fix: iterate: skip answer RRs that don't match the query + + fix: layer/iterate: some additional processing for referrals + + fix: lib/resolve: zonecut fetching error was fixed + +* Fri Feb 10 2017 Fedora Release Engineering - 1.2.0-2.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild + +* Fri Jan 27 2017 Petr Spacek - 1.2.0-2 +- rebuild against knot-2.4.0 + +* Fri Jan 27 2017 Petr Spacek - 1.2.0 +- new upstream release: + + fix: reworked DNSSEC Validation, that fixes several know problems with less standard DNS configurations + + fix: the resolver was setting AD flag when running in a forwarding mode + + fix: correctly return RCODE=NOTIMPL on meta-queries and non IN class queries + + fix: crash in hints module when hints file was empty + + fix: non-lowercase hints + + features: optional EDNS(0) Padding support for DNS over TLS + + features: support for debugging DNSSEC with CD bit + + features: DNS over TLS is now able to create ephemeral certs on the runtime (Thanks Daniel Kahn Gilmore for contributing to DNS over TLS implementation in Knot Resolver.) + + features: configurable minimum and maximum TTL (default 6 days) + + features: configurable pseudo-random reordering of RR sets + + features: new module 'version' that can call home and report new versions and security vulnerabilities to the log file + +* Mon Jan 23 2017 Petr Spacek - 1.2.0-rc1 +- Update to latest upstream version +- Fix packaging bug: depend on proper Lua library versions +- Allow automatic trust anchor management to work + +* Sat Nov 19 2016 Peter Robinson 1.1.1-3 +- Add ExclusiveArch for architectures with LuaJIT + +* Mon Aug 29 2016 Igor Gnatenko - 1.1.1-2 +- Rebuild for LuaJIT 2.1.0 + +* Wed Aug 24 2016 Jan Vcelak - 1.1.1-1 +- new upstream release: + + fix name server fallback in case some of the servers are unreachable + +* Fri Aug 12 2016 Jan Vcelak - 1.1.0-1 +- new upstream release: + + RFC7873 DNS Cookies + + RFC7858 DNS over TLS + + Metrics exported in Prometheus + + DNS firewall module + + Explicit CNAME target fetching in strict mode + + Query minimisation improvements + + Improved integration with systemd + +* Tue May 31 2016 Jan Vcelak - 1.0.0-1 +- final release + +* Thu May 05 2016 Jan Vcelak - 1.0.0-0.3.4f463d7 +- update to latest git version +- re-enable unit-test + +* Sat Apr 09 2016 Jan Vcelak - 1.0.0-0.2.79a8440 +- update to latest git version +- fix package review issues + +* Tue Feb 02 2016 Jan Vcelak - 1.0.0-0.1.beta3 +- initial package diff --git a/kresd-keyblock.asc b/kresd-keyblock.asc new file mode 100644 index 0000000..1b34475 --- /dev/null +++ b/kresd-keyblock.asc @@ -0,0 +1,126 @@ +-----BEGIN PGP PUBLIC KEY BLOCK----- + +mQINBGImJYQBEACoQzmvkGLYGeltnY2MzvjZlpZk/M670+vxI6e7ofto4AQQmvGW +0eann8bUl8qZnliOvqq57akCRTYLaT9ArFjfaaYs60qFD7KCFTAe4GHry/J4aWiP +Q7jftfpDerTLr+LvikJ9dJrMLV/TA79fgEb3DcGOtuZMventwJbZKS5iiAgaN/mW +ZZIh/kQNvylKy4aTm21yx2XFx4eVDRd1aucJWTrR9DmM3Nm02rpNvQxjxWfDU0cg +ne6iWFHseUDA40B5r/hwaEYD4cDOXh+adI0WkH5662TkrewzxE1LE+uyScTEL57i +zTHyeEW+1DHSyprtTZggUThRay4RLPIW4PVV+kkv/9kwtk1LWIbHbzilbKkKKoea +uIzTGJnxGGbV0uyRbH3QJTtddags5rBskemqPgg9momwMIgUtBSQn10zMX/s5bUF +yP9MwKVNzEkgtxeWvjSmKCpqmmD8oiXO1iL5bcZsJfJH1p9nHqDVG4+EJjSbu+wr +eM424BxXap+bdvoxKr5ofTswEyvlwn47aejQQVciDDb+AN8nufJeOrfyYQ798DXj +PhkR3CFVGfLCGkAAoTrhEePmn1DqKJMxlDB8YSZKTvF+TNBLVpVExu/MsVMX7mMh +uG+OFrDn/mCFe+q0fqMEQOpa5XFzhzaRd93khifR+sYnF5fiE92nG60psQARAQAB +tCBBbGVzIE1yYXplayA8YWxlcy5tcmF6ZWtAbmljLmN6PokCVAQTAQgAPhYhBDBX +7ppEjzYtdCBad5qxINoKdvbeBQJiJiWEAhsDBQkDwmcABQsJCAcCBhUKCQgLAgQW +AgMBAh4BAheAAAoJEJqxINoKdvbe5tsQAI4KnAGf+YkPGLdCTQo7bi9eww3zVoJk +m0WKTf67zLd7JC8puCGPWRVaVSBsuUKDrp57I3h736+Jx0XiwRA6xlFmgvVIWrFr +swGXlLbdutezXE2ke5y+86uj6k5TQKn3jEWfmkRigFLlUy5U+VJEt6b/i7e9EmMb +T9dI4d7JW7MPY74jYlFJ4klZvp/BL5ldz9R2yprOnwBX4Bjwm4FFR71NPC/iK2Dn +19pSH+YeRpsTU1I1vBMzz4qlEkhhE1+pqYbxYpyfkmSxJxGvD7FFr8GHnFwcnqqv +zZuinIz+eGf7iSql6yxz7OxDnVhBYnSQpCkSWtGdhHEVtQo0uA7gcxcdz5URBScQ +ofR/Zs/fvEvWqRXKm+I/qC1nK/glfaoA81xI6OGOPkrYEoLi9WKGK0nWSbnux9qY +/vyzVAKUDjEtYFm/Nk/23D4tBcC0/tZfuVFedWa6rcqKVNoeRdu2Nol9L4quL601 +vm/kIQDhUsQmWbvIkwx6pHZoFw+9COY1NFINOqguBYzyMIlVJpo6Xns+1gldJ7vI +0w6F+wpmUkFNnEACQ3dG/uf6WNzEbgEdKFQ2xgLN4zY7nJI3QLRlrXntk6BzG7Lj +iQe7ZS4uhaQQ9bzTuvhi3qKJEJUGaPQRvYJoCoDQs1gLR/rep0qQpRsUt7Tzb0uZ +xeeZHSvvhDq5uQINBGImJYQBEADaE8cZEkr06+TnlQ+8qSBHRFJSEunNKjUr8t0y +zwPgFZhRIRtw3mCFqDEv/eBPw9tsQeW6aJz5+VI5t7Ifkt8krHPE8GT5N33MyUKj +8sRk1oQNt/2JdDCOy5ZigyqFj31/9XeIWvlQbBLUTL0V3EPAmcipegEx9VFD81FW +qH4TbBer0oLsa7zFnZ455FIn1a76UNC+73DE3+eV1V51euhx3TIgn76SXe8Qf+jg +Asv7Ylfe++g3Smkt5UAgEZQOFwPbYMjS4U5sRq8hpJw+nBkI2n/vHoLeSKWZjt6J +/yth+tLQmsQRwyYk97Tp8mzPpmWSMWIGPDrfyBdV1DmToQkWDozuBs5Mz8gVvrMu +2mNe4O0m5Xv7e80Gm/OJxSeB/o8tEXFE12JEM1c88OZ8Iz/PcfSgotbcS5zVxRcm +yU/ZqMRNvJHtG932DIhZ/s0NdAxnsAeCz9gaR6Z4orVXb8G7/S1pe0ab66k19VX5 +wFoPIz92SUq91VbrCsjfHi4FeE7h2OL9QP10Liv9qOxJFYvy2fvWG9EXuknjaZsD +igmC1DuX/7uWJbrGbp9spnuNsgm7wYG5nFH8fTnNKtaMl2/D8D5WbB0k+MJnBDeW +MyDKPsaCStX2ih90DGSOkWlZy1k3X+v+PTPPxu1ry/MePSo0UHud9L2oWLbnz27I +bBRymwARAQABiQI8BBgBCAAmFiEEMFfumkSPNi10IFp3mrEg2gp29t4FAmImJYQC +GwwFCQPCZwAACgkQmrEg2gp29t7Trw//cN9UEaN1WaH4jFDKIST+xdLnSLvk0Izt +hHqJzzW9sRQYINvqz89EkTUrjelbW3Ib41YVNNk3S7hOm5OJm/fRHdQtItzuY/9E +RafF5+PUiDj5TRDa8bRV7sCAQLoztfr1ozadbGE7e8HrrZv4DcZ10joCpLRZm04j +QMBeZcaaEa2Wh7Xf9VW4aBJ/DU5DevsKeTRpCuwtw2lEf+NMl3PogPa9glm7liQu +DKU4Zlf/31ZCudAb80PugOzWM2i1DG26G/b7z+8N59m6dBYWeSvcqU7Z9Q4rU7bV +R/6nST8GyLIU/PsDalvKm2B3NDcXerN8lT9zU1QBzT3OyL6Uy/UzXl6YnpxFT8m/ +Gm4uiLS+gWD2TXh5BKGsuU4zIHakjglA7Gtb6PJ56+Pkz95apx7vAhmnJxgw7qAX +KAH0Rng7IxEeL8Fj67tzWTQPs0PuAty7qIgbeft8hvhtk9vfFZb8k3bhX59b/+TO +tbTOCjVhmq9bZdaw60SBl3LuyUlnlGmrqvPzVUdcAc2zvnxjEt9yVioS/M8zNRC/ +SmWbagZ/xyf2iiEAbo0y12t3heztdG8jMoMrImmUEubfPiAfCN2ys5zPiXW2jio5 +vvopiu23y37ew3zoAZrnfmFW0D8A8iD2g0kl/Ysb2dXIYocQ423ADN1Em/+1f8j5 +3P6DgfI04ROZAg0EWAOSdgEQAMcRDAsGV+ptULOruphwEUVNzVYIAW2qIp6E6uwh +Ocq6xnDieFjCUpDFy6aCPTXEk6Ft8cEIF4aUPJ1ip6YqDgh9jafBLI/Bllgwmfsv +sAasJ7K2vhUy8MnujuoNmOOKbiJ+/4ZTB2TemVfHqgwXidy16wjxoA64tQcCfQ9+ +sZ82FahqCU4qB04joMaOEj9oaS/L6Osj/5ex0xX7d/VG4Q58j5i7hJcWMnKECaoQ +4FHHF0eoqt4ginPcuDfzJbCJUZ/CBBP6cUjP0GkcfeVaDW5LzEzd7Nx4GZFhXzNP +0+9t5nnsGVpNHqstp7lFjBXf3s9IsGqouQHkfRMNFQUGfAGxShst5tgeYkI7J2/I +2/kAWQuYtns7iPaMWjVY9Iy3dOEzrBHCqucHgaL7qifKtl8TUOdVkypvFndVdr4T +hLljCt8ItQSsYSf53jQ62hFmZBeFE9UCx2OKYyP2gUz1GjFKBSsODohrefQisoVv +77McAVuqRHmDirNeI4wQbrbUZgR7HawMQrP88PgJUqU0j16V3hOgfn3aQDDMmZ36 +wCL5F+izQ0TPG4V3R6QA55ahRGjTOhhNJY+Uw6YUy9ykfos/eV4mZjvHjP9vWeD/ +7tScqidUAtU8VtFsSU6Qh8C0spxQSh/BXWOvsPJgY9qUm2IMk+iYHTjVkcKPZHHJ +dj+hABEBAAG0KVZsYWRpbcOtciDEjHVuw6F0IChwZXJzb25hbCkgPHZAY3VuYXQu +Y3o+iQJUBBMBCAA+FiEEtgBkYLYKgOeCBiRJ50ffH5V1o6oFAmFmsBgCGyMFCRTR +36EFCwkIBwIGFQoJCAsCBBYCAwECHgECF4AACgkQ50ffH5V1o6r5GBAAxkNaB8zi +TVWBZ5geqcQeoqCeTrZjDZ1pY32BbjefGb0z0fmRzH9ESQBGH+b46PO7cibOt3sY +d4ZX8GxG/vnwsU3dOspaIQfHH99yXr+sCRkcr2k7DWTMFSX/5JkhlrouAURpIRN8 +y4+OO/TkWFY3HAIEy3VkhwIoJSUEDfSINb1KHnotNzHc7s1Z3yb14K14XV/LnQL/ +/NTz32NBGSDAt3C3+w4h5WKhg+kPcuno1VVUHM4AcqqLkhEbNN/QwQULWbrQMqcB ++JJWlEgSqkhn2nrw/i8q+tlK7FBi4DhID99xRljt2HcPt7gqhnZ/2OxfoHGHui/f +FPgmeK+c/wHZ22FH4ly0XwsSdIjskhRf/XPTaBlgeorfyIEBFBeFkgjdFUNSpl1M +Tso6ZYxXkLg1UxEFtI+X5Eh7zpirfs6jwc44aMHKabJY3V/MBmYqUBRR3H6xnIFd +gfjVeFAR65w7MElJXRx2kvJ5ixpV5W2+U//MvhkpN6Vk1Y2G9NXmQeGXz2l+2A9V +4qpTn/nVAIchYFtVPzsAJlyPAqB7I45uNMQOcsGdn4W5lLgD4MNdgwIUce9jQ1Oo +F0BnZSCJGLjU0ZxVUOd7fwF+P+Y8RBxBIhVcvxaluI3YmT0roqCXaJaYGAWgXZCF +9g0NnfvR0dRRZRUeT/qLxJNZksK+iFtLIlu0MFZsYWRpbcOtciDEjHVuw6F0ICh3 +b3JrKSA8dmxhZGltaXIuY3VuYXRAbmljLmN6PokCVAQTAQgAPgIbIwUJFNHfoQUL +CQgHAgYVCAkKCwIEFgIDAQIeAQIXgBYhBLYAZGC2CoDnggYkSedH3x+VdaOqBQJh +ZrAYAAoJEOdH3x+VdaOqVjIP/1N5v2soWf7T2OcromFmL76QDqAIwzYtuwookFK8 +UBiGEAw+lz8dHSPqiQF8IiaVxroWeKp7vHKjSeRCr2a9eKsYzTdz3jStwPnKZGpP +5OMJb2x5dZNxyKaL1Fyidq0N9LDIkxanMORPYVA2c1tHmFJFJoj8EmUhIYN8iAl5 +ZG2u3vELI9B3ZvNJb8OJUxAOcvPVyuxKMzpJY2C8K4Ec2joLugG+aCoZh7DTi4EO +tqAOxr/jfCPEdPHEIKEOdqXy5DtoiA5e6uHA+DpseBC/jM2jrvO+IRqnFvr7M7+Q +yfv0ZbkFefsJp5tjojCv6xJPtz/BKwh9wxNtUJrZfFL71Otz4/0YAwiX4z+kljop +x0i4ALVUOiWb7i/2PiP23n4JnPAfLdlClk9CeTkCOu0CAgBvrKi1w/7eEnGqOgTu +4OaGfFaOtTjuFqKS0wOdBRGST5h3pKjxrDxN8HgI+ZpF1EfMd6ovfLWpMVIwE9cV +ueimcpAqfSubQECTjwnsDSmzc26apaCHL8FaXf2pG9J5uDczxdcUzVWfgb+16Wdg +bFoqJ82O2SCysTcEkrNH8m2R5i7iCaO5WlQFLf2FHOBWLd3RjV1ztCImv4di5skw +QLwgW2+wi0QowVPgPc38JAPa73INRhaPK3JUcwqNEr9JUNfRGyL+eTwTX4b5YKHd +dJ9KtCRWbGFkaW3DrXIgxIx1bsOhdCA8dmN1bmF0QGdtYWlsLmNvbT6JAlcEEwEI +AEECGyMFCRTR36EFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AWIQS2AGRgtgqA54IG +JEnnR98flXWjqgUCYWawGAIZAQAKCRDnR98flXWjqjpMEACClbUGJ3e0p1Nty0Lf +kRsoWZMoyeWSoBA0owUsQOyquKKaSj+40qHMDOhbNfJoLpwFsU5zJL4I2rhDlW+z +Y5Het5x1afS0lExzXK3RMPWwhUwMmWevUpW+VFjvPyBhdlEP8E0Ayj6z/p5GEN9Z +9yruZfz9ru48KDvwUYz/f2V0cAPqOIcSM6euGLXnK4ExML+8Wiqgmht8qBozD0Lo +odyAWMR1D+XkAMR+ugwUfs449+x7zzzfkRh8CfggB9mgMK0i2b66MdWFHYW2c9jc +3SIEaWZM56pEG9BCZpcoiiGgCOMWQ7CEn2dOfH2Ah1ZiICyDnL9XvESYJBoRLiNG +cLrD31GJzUrDPRLzK9f8j4AlWN7bNECw5pmPYE2vizFOuasojBV6hlg+c0bXpQSK +ybg1eQb0rE5yOWrA0pP5yNc6ZIBxtjbYLbwmWltb9mWMznVSNfcjvA7QXe3srYYL +AOW1KPz2Ly8qCTZXcpXx2Z2mk4FTNDIj4maQxLTIURHWHckHrXxENxMXNcbaZ4d4 +LVz5f1RBhsFfmAXpVu/FTvXIPlIWaNVlQDWBMxlVidpeztB4XgPUqKWmtMNyCTsN +PeuxrRiyIm2ccXE+fcuPDstLIeQdX+U/rijx1f588i6nt2oD0vy9tEchFeiczql1 +YzYNM5U8u/rCYiOxmQWf7gZecbkCDQRYA5J2ARAAyHww3huLEtsdyqgjiGMhtEKO +Lmp7yFl450HY9oPcHS02U5BC1370ssNShrdOCi2ACDbe41Zxx85WcuaO1OVqung2 +umX047mj2xQsiTAFRDLZsQu8cQFoEy/DBL2bk7ThfK1Lh+NyZAs0UaPpDkGodS0D +e9osA+4T6Nf4POYaeavbYVFSdDKS4lUboBqApKnD/TzKFxFcpuFx6FN92lteTbOo +jGMiLoZvELY86Kn9KuFZ8FM2ZSNHx1Z75KouufGrdkeCoZYVYiuzT+fnt2it4dIp +IlnF+yxMt5LB/MSrmECB5CAFJtxzuMccm6yDUZQSWWi9vUgxIJwvt5w0CIBT353D +GeP4WnH0r5YoBKoRbh7i4fT0lWvMXTG/V2lqyzBdClMebyHffMgba26Kj6oeDygD +fC5aGsVaqw1Ue/qQ5QRqTJcJV7xVLTtS1EamVqkfKwPS0zTfnrF1jQtnO/P4qkfg +BRRG9BXGGrykHpXOyqmX6Z0wbV2P4j+p02oSecDl5yVXplJfsXfbS/xXnaSkaN/7 +mCU29ul26cAVNxDkDPunztSFi9K9LM2T/XWYJQGXM71OpmONQJGF24lx7Wp/kobn +HtbjGDzjDPC4eSL7MA56qtrWaLM+4ePKANct2q0q6c0uSLs0Q2zochS64Mcg0YzL +1sinWPN1rXLDk3lwpIsAEQEAAYkCWgQYAQgADwUCYWawGAIbDAUJFNHfoQA/CRDn +R98flXWjqgkQ50ffH5V1o6oJEOdH3x+VdaOqCRDnR98flXWjqhYhBLYAZGC2CoDn +ggYkSedH3x+VdaOqtBgQALeChWgHEGe/8nwKWrC8CMQyKyiJRlSfvERi5M40PYxw +KC7IHo+ekMdlLc8kVkv5WSq3zQcNoRMjHutZlCVpGJat5PwiCine6I3Z5JfKsU7f +JE4KXPD0jr9kCy/IHlCWsKLZTHH0LOk98tqZcFQwFM5nQEzu8Us86BxlZs5IaN0j +ILD2qUC+EYeg0hd0kya+16UNao9NxCeUEoSwxhtB4IIMCJTUPx0pWErCHxeCUjvx +Pd2h5A106DT/3fa8uhPHr9goHtfreV0soGuxu1rqGrMn7XcorsGdt9XX4tyPHcXD +XCZMLedjYTu7OcYQ63hi+ZWUXJPvcIrB4StCumaFECwLodpdDWB7n6OF8r+X//eP +bjS8qt++A20LGD4l7BrWxDeymrnqLmWN8RBf2xV4ytVfcRx1ercFMGiNRUvGSh+k +gP6J7D4yT4xGTq+fCtS6BHyWMB0loXcWv0Im/6znpIpUcvXyL68s4Jiqukt94rKl +wb/IB6MSWannxk8UzWfGgFXeGUrR8YWLuQSo26AceNOyu2gMW+k9kYi0sqkBzMPk +1zWZN/gSNpDyu7AWGpv4RtOKhJhaux8zwtwqozqSx+plpnYz5ifwCNMuznM6T0j4 +msKQiK1N7lIwKBGaT2P8SJ/ecaJyudIz4ds2+GUl6fxqSR27Egs+EUY0BmS7wESr +=dRuR +-----END PGP PUBLIC KEY BLOCK----- diff --git a/rootkeys/README b/rootkeys/README new file mode 100644 index 0000000..b65691c --- /dev/null +++ b/rootkeys/README @@ -0,0 +1,3 @@ +Content of the root-anchors.xml file must match DS records in file ../root.keys. + +Obtain these files from a trusted source! diff --git a/rootkeys/checksums-sha256.txt b/rootkeys/checksums-sha256.txt new file mode 100644 index 0000000..f6124b9 --- /dev/null +++ b/rootkeys/checksums-sha256.txt @@ -0,0 +1,3 @@ +053cbf806a57e7759b8b8ad9cb21d65229b53b4c2b73feece2c62a3aff153b87 icannbundle.pem +ca2cc5aad5af1b7cd853fe1f08c4925dcd8fd8816711821d9e76ad37a5ac52c4 root-anchors.p7s +1b2a628d1ff22d4dc7645cfc89f21b6a575526439c6706ecf853e6fff7099dc8 root-anchors.xml diff --git a/rootkeys/icannbundle.pem b/rootkeys/icannbundle.pem new file mode 100644 index 0000000..d76ce0b --- /dev/null +++ b/rootkeys/icannbundle.pem @@ -0,0 +1,237 @@ +Certificate: + Data: + Version: 3 (0x2) + Serial Number: 1 (0x1) + Signature Algorithm: sha256WithRSAEncryption + Issuer: O=ICANN, OU=ICANN Certification Authority, CN=ICANN Root CA, C=US + Validity + Not Before: Dec 23 04:19:12 2009 GMT + Not After : Dec 18 04:19:12 2029 GMT + Subject: O=ICANN, OU=ICANN Certification Authority, CN=ICANN Root CA, C=US + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (2048 bit) + Modulus (2048 bit): + 00:a0:db:70:b8:4f:34:da:9c:d4:d0:7e:bb:ea:15: + bc:e9:c9:11:2a:1f:61:2f:6a:b9:bd:3f:3d:76:a0: + 9a:0a:f7:ee:93:6e:6e:55:53:84:8c:f2:2c:f1:82: + 27:c8:0f:9a:cf:52:1b:54:da:28:d2:2c:30:8e:dd: + fb:92:20:33:2d:d6:c8:f1:0e:10:21:88:71:fa:84: + 22:4b:5d:47:56:16:7c:9b:9f:5d:c3:11:79:9c:14: + e2:ff:c0:74:ac:dd:39:d7:e0:38:d8:b0:73:aa:fb: + d1:db:84:af:52:22:a8:f6:d5:9b:94:f4:e6:5d:5e: + e8:3f:87:90:0b:c7:1a:77:f5:2e:d3:8f:1a:ce:02: + 1d:07:69:21:47:32:da:46:ae:00:4c:b6:a5:a2:9c: + 39:c1:c0:4a:f6:d3:1c:ae:d3:6d:bb:c7:18:f0:7e: + ed:f6:80:ce:d0:01:2e:89:de:12:ba:ee:11:cb:a6: + 7a:d7:0d:7c:f3:08:8d:72:9d:bf:55:75:13:70:bb: + 31:22:4a:cb:e8:c0:aa:a4:09:aa:36:68:40:60:74: + 9d:e7:19:81:43:22:52:fe:c9:2b:52:0f:41:13:36: + 09:72:65:95:cc:89:ae:6f:56:17:16:34:73:52:a3: + 04:ed:bd:88:82:8a:eb:d7:dc:82:52:9c:06:e1:52: + 85:41 + Exponent: 65537 (0x10001) + X509v3 extensions: + X509v3 Basic Constraints: critical + CA:TRUE + X509v3 Key Usage: critical + Digital Signature, Non Repudiation, Key Encipherment, Data Encipherment, Key Agreement, Certificate Sign, CRL Sign + X509v3 Subject Key Identifier: + BA:52:E9:49:83:24:86:52:2F:C7:99:CD:FC:8D:6B:69:08:4D:C0:50 + Signature Algorithm: sha256WithRSAEncryption + 0f:f1:e9:82:a2:0a:87:9f:2d:94:60:5a:b2:c0:4b:a1:2f:2b: + 3b:47:d5:0a:99:86:38:b2:ec:c6:3b:89:e4:6e:07:cf:14:c7: + c7:e8:cf:99:8f:aa:30:c3:19:70:b9:e6:6d:d6:3f:c8:68:26: + b2:a0:a5:37:42:ca:d8:62:80:d1:a2:5a:48:2e:1f:85:3f:0c: + 7b:c2:c7:94:11:5f:19:2a:95:ac:a0:3a:03:d8:91:5b:2e:0d: + 9c:7c:1f:2e:fc:e9:44:e1:16:26:73:1c:45:4a:65:c1:83:4c: + 90:f3:f2:28:42:df:db:c4:e7:04:12:18:62:43:5e:bc:1f:6c: + 84:e6:bc:49:32:df:61:d7:99:ee:e4:90:52:7b:0a:c2:91:8a: + 98:62:66:b1:c8:e0:b7:5a:b5:46:7c:76:71:54:8e:cc:a4:81: + 5c:19:db:d2:6f:66:b5:bb:2b:ae:6b:c9:74:04:a8:24:de:e8: + c5:d3:fc:2c:1c:d7:8f:db:6a:8d:c9:53:be:5d:50:73:ac:cf: + 1f:93:c0:52:50:5b:a2:4f:fe:ad:65:36:17:46:d1:2d:e5:a2: + 90:66:05:db:29:4e:5d:50:5d:e3:4f:da:a0:8f:f0:6b:e4:16: + 70:dd:7f:f3:77:7d:b9:4e:f9:ec:c3:33:02:d7:e9:63:2f:31: + e7:40:61:a4 +-----BEGIN CERTIFICATE----- +MIIDdzCCAl+gAwIBAgIBATANBgkqhkiG9w0BAQsFADBdMQ4wDAYDVQQKEwVJQ0FO +TjEmMCQGA1UECxMdSUNBTk4gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxFjAUBgNV +BAMTDUlDQU5OIFJvb3QgQ0ExCzAJBgNVBAYTAlVTMB4XDTA5MTIyMzA0MTkxMloX +DTI5MTIxODA0MTkxMlowXTEOMAwGA1UEChMFSUNBTk4xJjAkBgNVBAsTHUlDQU5O +IENlcnRpZmljYXRpb24gQXV0aG9yaXR5MRYwFAYDVQQDEw1JQ0FOTiBSb290IENB +MQswCQYDVQQGEwJVUzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKDb +cLhPNNqc1NB+u+oVvOnJESofYS9qub0/PXagmgr37pNublVThIzyLPGCJ8gPms9S +G1TaKNIsMI7d+5IgMy3WyPEOECGIcfqEIktdR1YWfJufXcMReZwU4v/AdKzdOdfg +ONiwc6r70duEr1IiqPbVm5T05l1e6D+HkAvHGnf1LtOPGs4CHQdpIUcy2kauAEy2 +paKcOcHASvbTHK7TbbvHGPB+7faAztABLoneErruEcumetcNfPMIjXKdv1V1E3C7 +MSJKy+jAqqQJqjZoQGB0necZgUMiUv7JK1IPQRM2CXJllcyJrm9WFxY0c1KjBO29 +iIKK69fcglKcBuFShUECAwEAAaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8B +Af8EBAMCAf4wHQYDVR0OBBYEFLpS6UmDJIZSL8eZzfyNa2kITcBQMA0GCSqGSIb3 +DQEBCwUAA4IBAQAP8emCogqHny2UYFqywEuhLys7R9UKmYY4suzGO4nkbgfPFMfH +6M+Zj6owwxlwueZt1j/IaCayoKU3QsrYYoDRolpILh+FPwx7wseUEV8ZKpWsoDoD +2JFbLg2cfB8u/OlE4RYmcxxFSmXBg0yQ8/IoQt/bxOcEEhhiQ168H2yE5rxJMt9h +15nu5JBSewrCkYqYYmaxyOC3WrVGfHZxVI7MpIFcGdvSb2a1uyuua8l0BKgk3ujF +0/wsHNeP22qNyVO+XVBzrM8fk8BSUFuiT/6tZTYXRtEt5aKQZgXbKU5dUF3jT9qg +j/Br5BZw3X/zd325TvnswzMC1+ljLzHnQGGk +-----END CERTIFICATE----- +Certificate: + Data: + Version: 3 (0x2) + Serial Number: 11 (0xb) + Signature Algorithm: sha256WithRSAEncryption + Issuer: O=ICANN, OU=ICANN Certification Authority, CN=ICANN Root CA, C=US + Validity + Not Before: Nov 8 23:39:47 2016 GMT + Not After : Nov 6 23:39:47 2026 GMT + Subject: O=ICANN, CN=ICANN EMAIL CA + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (2048 bit) + Modulus (2048 bit): + 00:d2:19:1e:22:69:33:f6:a4:d2:76:c5:80:11:75: + 8e:d0:e8:6f:bf:89:f8:2a:6a:da:8a:85:28:40:ba: + c5:23:5f:47:ed:72:e2:8e:d3:5c:c8:8a:3a:99:a9: + 57:2c:0a:2b:22:f3:54:7b:8b:f7:8c:21:a2:50:01: + 4f:8b:af:34:df:72:fc:78:31:d0:1d:eb:bc:9b:e6: + fa:c1:84:d0:05:07:8a:74:53:a5:60:9e:eb:75:9e: + a8:5d:32:c8:02:32:e4:bf:cb:97:9b:7a:fa:2c:f6: + 6a:1d:b8:57:ad:e3:03:22:93:d0:f4:4f:a8:b8:01: + db:82:33:98:b6:87:ed:3d:67:40:00:27:2e:d5:95: + d2:ad:36:46:14:c6:17:79:65:7f:65:f3:88:80:65: + 7c:22:67:08:23:3c:cf:a5:10:38:72:30:97:92:6f: + 20:4a:ba:24:4c:4a:c8:4a:a5:dc:2a:44:a1:29:78: + b4:9f:fe:84:ff:27:5b:3a:72:ea:31:c1:ad:06:22: + d6:44:a0:4a:57:32:9c:f2:46:47:d0:89:6e:20:23: + 2c:ea:b0:83:7e:c1:f3:ea:da:dd:e3:63:59:97:21: + fa:1b:11:39:27:cf:82:8b:56:15:d4:36:92:0c:a5: + 7e:80:e0:18:c9:50:08:42:0a:df:97:3c:9c:b8:0a: + 4d:b1 + Exponent: 65537 (0x10001) + X509v3 extensions: + X509v3 Basic Constraints: critical + CA:TRUE + X509v3 Key Usage: critical + Certificate Sign, CRL Sign + X509v3 Authority Key Identifier: + keyid:BA:52:E9:49:83:24:86:52:2F:C7:99:CD:FC:8D:6B:69:08:4D:C0:50 + + X509v3 Subject Key Identifier: + 7B:3F:BA:CE:A1:B3:A6:13:2E:5A:82:84:D4:D2:EA:A5:24:F1:CD:B4 + Signature Algorithm: sha256WithRSAEncryption + 0e:8a:c9:ea:6f:9c:e9:23:b6:9c:a6:a4:c2:d1:b1:ee:25:18: + 24:2b:79:d4:a8:f2:99:b9:5c:91:4d:e6:2b:32:2e:01:f5:87: + 95:64:fc:6d:f1:87:fa:24:b4:43:4b:49:f3:84:54:44:eb:af: + 41:ab:49:ab:c8:b7:32:6c:14:83:5b:d7:2c:41:f9:89:d5:c4: + 2b:9a:55:c5:b6:ad:17:d5:4d:bc:41:58:56:72:0d:db:b7:7d: + 57:c6:a2:9c:7e:6b:67:ae:26:f8:26:45:bb:c4:95:2e:ea:71: + e3:b4:7a:69:95:a4:8a:80:f8:59:dc:88:6e:e1:a7:fc:bb:8e: + b2:aa:a8:b6:1b:2f:2c:97:a5:12:d5:82:ae:a0:e8:a6:15:fd: + d1:e0:5d:e4:84:b1:76:db:0a:e2:ca:58:2e:d3:df:48:4e:46: + ac:c6:35:79:17:99:ce:e9:be:2c:e4:c2:50:ff:5b:96:15:cd: + 64:ac:1b:db:fe:d2:ac:43:61:c8:5f:ee:24:b6:a4:3b:d2:ff: + 0a:f4:0c:88:58:a1:9d:a4:c1:1f:6a:6c:67:90:98:e8:1f:5e: + 2d:55:60:91:26:2a:b1:66:80:e4:e6:0e:05:2c:75:a9:ca:0b: + e4:a0:8f:e1:47:a8:8f:61:5d:7c:ce:09:60:88:48:c3:46:bf: + be:7e:36:be +-----BEGIN CERTIFICATE----- +MIIDZDCCAkygAwIBAgIBCzANBgkqhkiG9w0BAQsFADBdMQ4wDAYDVQQKEwVJQ0FO +TjEmMCQGA1UECxMdSUNBTk4gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxFjAUBgNV +BAMTDUlDQU5OIFJvb3QgQ0ExCzAJBgNVBAYTAlVTMB4XDTE2MTEwODIzMzk0N1oX +DTI2MTEwNjIzMzk0N1owKTEOMAwGA1UEChMFSUNBTk4xFzAVBgNVBAMTDklDQU5O +IEVNQUlMIENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0hkeImkz +9qTSdsWAEXWO0Ohvv4n4KmraioUoQLrFI19H7XLijtNcyIo6malXLAorIvNUe4v3 +jCGiUAFPi68033L8eDHQHeu8m+b6wYTQBQeKdFOlYJ7rdZ6oXTLIAjLkv8uXm3r6 +LPZqHbhXreMDIpPQ9E+ouAHbgjOYtoftPWdAACcu1ZXSrTZGFMYXeWV/ZfOIgGV8 +ImcIIzzPpRA4cjCXkm8gSrokTErISqXcKkShKXi0n/6E/ydbOnLqMcGtBiLWRKBK +VzKc8kZH0IluICMs6rCDfsHz6trd42NZlyH6GxE5J8+Ci1YV1DaSDKV+gOAYyVAI +QgrflzycuApNsQIDAQABo2MwYTAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQE +AwIBBjAfBgNVHSMEGDAWgBS6UulJgySGUi/Hmc38jWtpCE3AUDAdBgNVHQ4EFgQU +ez+6zqGzphMuWoKE1NLqpSTxzbQwDQYJKoZIhvcNAQELBQADggEBAA6KyepvnOkj +tpympMLRse4lGCQredSo8pm5XJFN5isyLgH1h5Vk/G3xh/oktENLSfOEVETrr0Gr +SavItzJsFINb1yxB+YnVxCuaVcW2rRfVTbxBWFZyDdu3fVfGopx+a2euJvgmRbvE +lS7qceO0emmVpIqA+FnciG7hp/y7jrKqqLYbLyyXpRLVgq6g6KYV/dHgXeSEsXbb +CuLKWC7T30hORqzGNXkXmc7pvizkwlD/W5YVzWSsG9v+0qxDYchf7iS2pDvS/wr0 +DIhYoZ2kwR9qbGeQmOgfXi1VYJEmKrFmgOTmDgUsdanKC+Sgj+FHqI9hXXzOCWCI +SMNGv75+Nr4= +-----END CERTIFICATE----- +Certificate: + Data: + Version: 3 (0x2) + Serial Number: 10 (0xa) + Signature Algorithm: sha256WithRSAEncryption + Issuer: O=ICANN, OU=ICANN Certification Authority, CN=ICANN Root CA, C=US + Validity + Not Before: Nov 8 23:38:16 2016 GMT + Not After : Nov 6 23:38:16 2026 GMT + Subject: O=ICANN, CN=ICANN SSL CA + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public Key: (2048 bit) + Modulus (2048 bit): + 00:dd:c6:ab:bf:7c:66:9d:b3:2b:96:00:14:c7:60: + 7a:8d:62:5b:26:4b:30:d7:b3:4c:82:69:c6:4d:4d: + 73:f3:d4:91:21:5d:ab:35:f0:c8:04:0e:f4:a3:35: + e2:e1:18:a9:98:12:03:58:f8:9f:eb:77:54:5b:89: + 81:26:c9:aa:c2:f4:c9:0c:82:57:2a:5e:05:e9:61: + 17:cc:19:18:71:eb:35:83:c1:86:9d:ec:f1:6b:ca: + dd:a1:96:0b:95:d4:e1:0f:9e:24:6f:dc:3c:d0:28: + 9e:f2:53:47:2b:a1:ad:32:03:c8:3f:0d:80:80:7d: + f0:02:d2:6e:5a:2c:44:21:9b:09:50:15:3f:a1:3d: + d3:c9:c8:24:e7:ea:4e:92:2f:94:90:2e:de:e7:68: + f6:c6:b3:90:1f:bc:c9:7b:a2:65:d7:11:e9:8b:f0: + 3a:5a:b7:17:07:df:69:e3:6e:b9:54:6a:8e:3a:aa: + 94:7f:2c:0a:a1:ad:ba:b7:d9:60:62:27:a7:71:40: + 3b:8e:b0:84:7b:b8:c8:67:ef:66:ba:3d:ac:c3:85: + e5:86:bb:a7:9c:fd:b6:e1:c0:10:53:3d:d4:7e:1b: + 09:e6:9f:22:5c:a7:27:09:7e:27:12:33:fa:df:9b: + 20:2f:14:f7:17:c0:e4:1e:07:91:1f:f9:9a:cd:a8: + e2:c5 + Exponent: 65537 (0x10001) + X509v3 extensions: + X509v3 Basic Constraints: critical + CA:TRUE + X509v3 Key Usage: critical + Certificate Sign, CRL Sign + X509v3 Authority Key Identifier: + keyid:BA:52:E9:49:83:24:86:52:2F:C7:99:CD:FC:8D:6B:69:08:4D:C0:50 + + X509v3 Subject Key Identifier: + 6E:77:A8:40:10:4A:D8:9C:0C:F2:B7:5A:3A:A5:2F:79:4A:61:14:D8 + Signature Algorithm: sha256WithRSAEncryption + 47:46:4f:c7:5f:46:e3:d1:dc:fc:2b:f8:fc:65:ce:36:b1:f4: + 5f:ee:14:75:a3:d9:5f:de:75:4b:fa:7b:88:9f:10:8c:2e:97: + cc:35:1b:ce:24:d3:36:60:95:d5:ae:11:b6:3f:8b:f4:12:69: + 85:b5:3b:2a:b6:ab:7a:81:85:c2:55:57:ed:d0:b5:e7:4f:54: + 37:51:24:c9:d5:07:3a:ef:b6:c5:1a:3e:14:29:a7:a6:f8:08: + 2a:0b:26:79:f9:62:85:4a:e5:ea:90:ca:71:38:16:91:4e:7e: + fd:e3:b3:f3:55:8f:5a:d0:86:cf:33:94:88:f1:90:99:cb:81: + e2:81:92:68:2f:c3:61:d5:52:8d:e6:9a:5b:00:83:42:27:88: + f6:d9:fa:d1:bc:bb:b0:bc:b5:14:0b:4e:1a:54:ef:fa:d6:9d: + c4:0c:fc:ed:15:ab:21:4b:45:b5:d9:3b:ed:3c:d5:1e:2e:7a: + 83:6f:24:45:d4:4c:b4:ef:60:43:18:d0:84:5d:16:7b:f5:50: + 80:b1:a9:c2:8f:3b:c8:90:08:fd:aa:17:13:19:38:19:d1:8e: + 85:7c:1e:57:16:8c:f9:8a:e8:29:25:38:cd:bb:55:8e:4a:6a: + 6f:e5:7d:fc:d7:55:d6:ae:38:07:96:c1:97:ff:e5:2b:4f:99: + 2d:70:f2:08 +-----BEGIN CERTIFICATE----- +MIIDYjCCAkqgAwIBAgIBCjANBgkqhkiG9w0BAQsFADBdMQ4wDAYDVQQKEwVJQ0FO +TjEmMCQGA1UECxMdSUNBTk4gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxFjAUBgNV +BAMTDUlDQU5OIFJvb3QgQ0ExCzAJBgNVBAYTAlVTMB4XDTE2MTEwODIzMzgxNloX +DTI2MTEwNjIzMzgxNlowJzEOMAwGA1UEChMFSUNBTk4xFTATBgNVBAMTDElDQU5O +IFNTTCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAN3Gq798Zp2z +K5YAFMdgeo1iWyZLMNezTIJpxk1Nc/PUkSFdqzXwyAQO9KM14uEYqZgSA1j4n+t3 +VFuJgSbJqsL0yQyCVypeBelhF8wZGHHrNYPBhp3s8WvK3aGWC5XU4Q+eJG/cPNAo +nvJTRyuhrTIDyD8NgIB98ALSblosRCGbCVAVP6E908nIJOfqTpIvlJAu3udo9saz +kB+8yXuiZdcR6YvwOlq3FwffaeNuuVRqjjqqlH8sCqGturfZYGInp3FAO46whHu4 +yGfvZro9rMOF5Ya7p5z9tuHAEFM91H4bCeafIlynJwl+JxIz+t+bIC8U9xfA5B4H +kR/5ms2o4sUCAwEAAaNjMGEwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMC +AQYwHwYDVR0jBBgwFoAUulLpSYMkhlIvx5nN/I1raQhNwFAwHQYDVR0OBBYEFG53 +qEAQSticDPK3WjqlL3lKYRTYMA0GCSqGSIb3DQEBCwUAA4IBAQBHRk/HX0bj0dz8 +K/j8Zc42sfRf7hR1o9lf3nVL+nuInxCMLpfMNRvOJNM2YJXVrhG2P4v0EmmFtTsq +tqt6gYXCVVft0LXnT1Q3USTJ1Qc677bFGj4UKaem+AgqCyZ5+WKFSuXqkMpxOBaR +Tn7947PzVY9a0IbPM5SI8ZCZy4HigZJoL8Nh1VKN5ppbAINCJ4j22frRvLuwvLUU +C04aVO/61p3EDPztFashS0W12TvtPNUeLnqDbyRF1Ey072BDGNCEXRZ79VCAsanC +jzvIkAj9qhcTGTgZ0Y6FfB5XFoz5iugpJTjNu1WOSmpv5X3811XWrjgHlsGX/+Ur +T5ktcPII +-----END CERTIFICATE----- diff --git a/rootkeys/root-anchors.p7s b/rootkeys/root-anchors.p7s new file mode 100644 index 0000000..ee06fe5 Binary files /dev/null and b/rootkeys/root-anchors.p7s differ diff --git a/rootkeys/root-anchors.xml b/rootkeys/root-anchors.xml new file mode 100644 index 0000000..bf84089 --- /dev/null +++ b/rootkeys/root-anchors.xml @@ -0,0 +1,16 @@ + + +. + +19036 +8 +2 +49AAC11D7B6F6446702E54A1607371607A1A41855200FD2CE1CDDE32F24E8FB5 + + +20326 +8 +2 +E06D44B80B8F1D39A95C0B0D7C65D08458E880409BBC683457104237C7F8EC8D + + diff --git a/rootkeys/verify.sh b/rootkeys/verify.sh new file mode 100755 index 0000000..eac0d6e --- /dev/null +++ b/rootkeys/verify.sh @@ -0,0 +1,5 @@ +#!/usr/bin/bash +set -o errexit -o xtrace + +sha256sum -c checksums-sha256.txt +openssl smime -CAfile icannbundle.pem -verify -inform DER -in root-anchors.p7s -content root-anchors.xml diff --git a/sources b/sources new file mode 100644 index 0000000..0ed2cdf --- /dev/null +++ b/sources @@ -0,0 +1,2 @@ +SHA512 (knot-resolver-5.7.6.tar.xz) = 4dcaff56b0368bc147e04ffbf6ce4a3595fa3a59e99e73b516edc7813142abcb20823b987824b11a31e3eca3cc62fa176caf4408361daeac67b6f0587f9a0268 +SHA512 (knot-resolver-5.7.6.tar.xz.asc) = 478449d96dddaff9aff134a2a3bc991d8e50423f38a00e7256b54be9ab89d85d66eaa8e83815f4b31700b16fd94f8017493db6347e57d0583feec38bb35655f6 diff --git a/tests/README.md b/tests/README.md new file mode 100644 index 0000000..8f69da4 --- /dev/null +++ b/tests/README.md @@ -0,0 +1,14 @@ +Package tests +============= + +These tests implement the standard test interface in Fedora CI. +See https://docs.fedoraproject.org/en-US/ci/tests/ for details. + +Manual execution +---------------- + +Run the following command on your machine. Please note, it will make +modifications to your system. It's best to run these on a clean, throw-away +testing system or a VM. + +ansible-playbook tests/tests.yml -e subjects=/path/to/knot-resolver.rpm -e artifacts=/path/to/artifacts diff --git a/tests/scripts/test_manual_activation.sh b/tests/scripts/test_manual_activation.sh new file mode 100755 index 0000000..c595e05 --- /dev/null +++ b/tests/scripts/test_manual_activation.sh @@ -0,0 +1,7 @@ +#!/bin/bash +set -ex + +systemctl stop kresd@1.service +systemctl start kresd@1.service + +dig @127.0.0.1 . diff --git a/tests/tests.yml b/tests/tests.yml new file mode 100644 index 0000000..1f4dc95 --- /dev/null +++ b/tests/tests.yml @@ -0,0 +1,15 @@ +--- +- hosts: localhost + remote_user: root + roles: + - role: standard-test-basic + tags: + - classic + required_packages: + - bind-utils + tests: + - kresd-show-version: + run: kresd --version + - manual-activation: + dir: scripts + run: ./test_manual_activation.sh