diff --git a/.gitignore b/.gitignore index e69de29..9ec35ec 100644 --- a/.gitignore +++ b/.gitignore @@ -0,0 +1,2 @@ +/knot-*.tar.xz +/knot-*.tar.xz.asc diff --git a/gpgkey-742FA4E95829B6C5EAC6B85710BB7AF6FEBBD6AB.gpg.asc b/gpgkey-742FA4E95829B6C5EAC6B85710BB7AF6FEBBD6AB.gpg.asc new file mode 100644 index 0000000..be2545a --- /dev/null +++ b/gpgkey-742FA4E95829B6C5EAC6B85710BB7AF6FEBBD6AB.gpg.asc @@ -0,0 +1,89 @@ +-----BEGIN PGP PUBLIC KEY BLOCK----- + +mQINBFljlBcBEACuCSBlN1vTS9eEDqowZcLAAF8NytcTlRjXTLWMQtjU+fXkz9Vz +10n9TIFj9Kcec0p0+8F+SowybecwhmYoUzhKI7S9M1ziUmaIhFs2KvZ1GzigE/W5 +L448P/7pugh875e1tIrkrbbcIp6+SxaLbgvXlFl630ILZl/gbYOa/Wk21sLu4RjQ +Y39oHb0WTiwPnKhdMdwlnxm6HeWkHzlvI9N8tlDc6oVnUfqVI8gUyExLnEYjDpZf +orTVgHRq6RNyfTRZkh8zRsXSTnJlk/bVEDW5i/VgIQugzkgpuTGWlCstryi/MRhe +NxU1YEUenT69okb96QStfr1J00n8L4VAs8V5IuFUcSc8UqSpB+LgERRTMRFo9IrE +XAW/gEKlEVR+501BvJ0/Qggxbgz4PEnKNaxXmAnykJzot2VDKTzrr26a9LnrT0GW +om9rg89Ih876PA53vUXBB+FWP9QOFDcOfz3nMjCrLbMzhTsAzrNFXxchzLq+66CL +qsQQytDVFpLI+X++sKRTOHkq6vV1bAPjlljrannLnn1y/DvkOOkiHOdYyjmR7Dfk +vxgcWh/3Gx4J9gipxZITOr7LamEYgHfElY/UWCtc1Vjt8Xvgt4dofDpvSwY9YzgR +WxJKC5ewYdqTCI+zxL1f0fjkeiRYNi959UMMjgdcY7Zpi8oPPQmlyBw15QARAQAB +tCZEYW5pZWwgU2Fsem1hbiA8ZGFuaWVsLnNhbHptYW5AbmljLmN6PokCPQQTAQoA +JwUCWWOUFwIbAwUJA8JnAAULCQgHAwUVCgkICwUWAgMBAAIeAQIXgAAKCRAQu3r2 +/rvWq1+eEAClhOEK2MZOz+nwJSeX7iINKbw477Y+LSvYkKG81pve+xtblQEn7rI3 +cYnDrqlUb3bXdbMHujYrg1fPoccpCvf6d/JvlN6WXCE25R+GR6vxr6v7jycHdSOb +Fe4sTcwce6IViwiWiSizh4UCkz8285LjLcf3AnT2v6GJwHiZbPOeMQUNIRj6PEYL +SQsq0ZlqEx8LGKLTc5Ukrkoi4lN44SI1rzSwDPIqvlvrVnDXcDB8M7E2Ii51zU8/ +TVk920KeayUeCPxpmgQW3USI45NrE/jEgyodyxMGp5lg3OqzHT2wu9BVLWkQvTjF +fLfEsTay4K4kUSbYzbpS93b33J+I20rYLGBBYlTrN5417IgF6Bb8NzyrfVy1Wdqh +cggAEKX5EkOmZM8oduRxsHqiRLC/xKF8GqTo6t3GMS5i8RClNvmdq0WUkQUvld4b +OnXBCZ2QLbjV7sXjcr56ee+qdpiuRQjEidjHzpibcIBN8LVupVgXAZl9lsiBtoJX +OHsvSdU3VgGWnRGtzFjSHzl3TRPIsaVVqD7aCzQDfXDjrGlmhzgDfMwkqmBGgsku +8tSR3Ag0MRAouJFXiZrcM3XGeYVbHT6dt7UMAB27Xc5foc0kGRo5tzlK6rWG2sJI +lcQB7tKvwI/tE9lwJDjw+XNekEdIpcdcQ7mWa1COYkcYTre3oPmN+4kCVAQTAQoA +PgIbAwULCQgHAwUVCgkICwUWAgMBAAIeAQIXgBYhBHQvpOlYKbbF6sa4VxC7evb+ +u9arBQJcZrrTBQkGxY28AAoJEBC7evb+u9arU78QAJOVSul2YTXediwcY1YtpAli +KtHcjOS5PzaezB4c+E89xw6x/XO76KLI6+7GFrcGallPPCHXQfseQh5FmlZ2VMMT +5+f/eTY/s9kwhexAarW8AE8GeKZ/ejt6AqCokjbD/75Sfkx+F6/1Vg20kOoma8Uy +QyIozmUOue0z0VYR3uHJw6BIncGtkuxt5IHzXw5AsAtdNqneuRg5Ibx1gmJqW/Xa +M3cPo2WwF5Arh6JjGZTkUaiBcc4miUS08nqT6hvmxFY9X9KvWMl/NeMiom09HcV+ +JJnrjf1hoW4uy4DxEo6Mt34iZddsjCw3x1Qmgs70BonKpBjCY6fE6KU66c6ykOdt +vx0QrqUnODoHOEyN54TREw+PZDftkfgchwg1nN1SQeWvQ9JGRNKOuQhEGrRq1Wxa +HUH2N6rQP283fnFSrABHTk1laqKwXDMI7IdGChc/QtiHso5gjCi2OdVpuQfp19e6 +8U7+ZWSq71HhFWsR9Y1QlXfV6ADEXtemV/iXA5No1TUTvUmvo7T2k7LBlrSWd+gJ +MyxMn/aUroVm2InU3jPwRUPySUJcX1EZrbWgi/scbKcryJQoH5BEEdOr72V9vNt7 +o6dlMgnYoSkv3JVpJW4T6+PY8HanVFuFNWqOg5fg7xM5CCL7gqVSuWExK1X0rfqu +aeq5Pvm92kMrx+XkzqqFiQJUBBMBCgA+AhsDBQsJCAcDBRUKCQgLBRYCAwEAAh4B +AheAFiEEdC+k6VgptsXqxrhXELt69v671qsFAl+r3lMFCQoKsTwACgkQELt69v67 +1qv/gw/+ILW7CAtgxuOI1h61sUq0YrjQRnnYlya3wk4tTlSqhBa+5fSjasHv5wZ8 +TduWt99yWCmGpDs0Vxffb/jTKKwI40FgTtnzFKPTFtEymLgC1sTTbol3dcrzpX4J +vXMlVDdSjdkChdsdx6mFQWA1ZvdvUtIvBeVrP76mfDQi2fsVMWRoAk98BSQT5Som +vcluc9mMNuVcjiRUdmSqM1TVZarambkhNWelWWYJN1paljugL//TEZKcsFQWJpbf +ECdEnyqXPi9/Fi53/WhS9xi7AdYO8rx8lCurb0JpQwltHXXZcm5mSr99w+7XoUvu +efkSkW2Y5XFXp35dP7x8QeZ8zhSeHL5d187G0q5YKtK2D2M+sEyEDF9WCHya8x8t +b+mMv3LVkHf4mj2LQNGWUtOId08a+AgdOd45wKqG+Z92LXs7l9NMoDLdJGwfu48R +L2LrHfyDHzowUChr0762mdcCiJrBH7Lwmt5j4wRhrPKaPj1XcXQIi6srGcJRbhFa +76E54kPANDa42VzJwS9/4K+bA7uDYWCmMlXF6Uh/EiSoE3CLS6IMgs9BaOHCx4Rq +1+7/U0LQDwseMT8UV+AK0YiYeXpfnGX96nS9yPZtlyE5+96h5c6Vts6QEZo8hcR1 +EXlVsf2NJleZxYELfvcLYPvIeS3qe5WNlCOSUvDAMh7fRwMkWL2JAlQEEwEKAD4C +GwMFCwkIBwMFFQoJCAsFFgIDAQACHgECF4AWIQR0L6TpWCm2xerGuFcQu3r2/rvW +qwUCYadEKgUJEZClEwAKCRAQu3r2/rvWq3QvD/9zDhZM18VNgeNAvWByx/lVOaJr +pxvciARgWEbgYYbYHxwH2JGMZjr0XFz5JzXkf+N7Yx92D5V7GwX90eGg+fTAyMNM +4TAfk1shzC9T/qej4cTUVwiunmikV1vXfv7mnjJHuOoeqrY1at5z4gWirXyyMKhN +pg/ebgpcQ7f+DxsLgNJFihU+w1eIFMKnGalrSBh62NIIJWsk+hdVaPse9XMhjigo +gQ3s7/Sy7hADV+tnwPv/s6xj1jBV+BQNdJZwYsMOXEEFBvNTbq57rzm2CyT3RKfG +9hp5SdDDQHmyxz96hHrZYl1v2h6qH8ors8EgA75Iy2qsEefJSSEbnSBoAypAof2Q +9lAgUw1SwZuQv/mLoubCVqi09HuVObyyKLFxzgyFRMvYwvJpDKmLhvAnqi4iXhqJ +QTRM5aJc1odsnCaGUO4Rpve5jT9jEGs4CE2zeAu5vGO1nSeVdcisPJ+o8ji3hFUt +W/tINkfTygwvLWlR+KO8YM8eTOXeI8m0dt4nPb6Ne1s1i/ipu4heS7XDyjvPB1/m +5kpmWIgnC6wQyD1a7beDh64sIybXvJzpmX0Xp1JiPdqC7gH5YFq0eznZ5JU+j6wB +Dtl+55I6D+IgUY2BV4rGXjXSxhn89gRKD8nxVUGhWY1lsGw0UtqGKiH6+GkP2pL2 +k7Mz34W4LAKvwEtvnLkCDQRZY5QXARAA6RnxYG82/X+A49srgHR9yIxlHqSq6IhN +n+iJQ5lpVpfeBItOG4NDu4Aq5X41pAJ3NKxsCPV62gEald/C7gJrTI5rag/87GYF +Fo6QRrwGsWVGORGs9G1pBF7ZZwhPJwD3MeagGZNfWZzRxXefL1P3mrpO3etSEEwE +NHtCqEMP6x/JHh3SKonKAlL4xfj3F54aKj4upIcjxGBAJH8u66bN1GmYjstBzzbD +4TWNTwfKgp15XxjrTgbThFy7CBoOgcaApiYTPE7D5nB1+AyhGjnO3ZlNgy1ZIHVD +Fk6HEakaqKM9QlkJnZsB2+cTqXlV0etmFQsedCg2sUier0hhIrEOOtGQbY1P+0vv ++VRoaNym3ritl+70RG8WgrHNLMRHVGeLRq3gOFnt+d/3h7meAKbORW/ZY30Upwth +tlZYgciFzoDJCW8Be1i1X4toiUaMkFh79jd7YTvZ87+P4DllC9MNsoq5cY/bHBNZ +YtXf7y6XqVqYo2IbFUR3VXKtzSN5eYm5YpFPczzmg1bNgl3i6WBcOF4EPEJEVjZ+ +u1r59NvfVLQ8XVh/QmLoG7x8oFcvhWctMy17Vdm4qZjpSA+B1sQocehdra+xT+PW +V0kcrYpsqwkYeFRQnJGqIupWHnotqGOBNAyQWIcjK6K5y0CeioJZpNN5Oe5XloMX +sYmgXsR+gTUAEQEAAYkCPAQYAQoAJgIbDBYhBHQvpOlYKbbF6sa4VxC7evb+u9ar +BQJhp0RdBQkRkKVGAAoJEBC7evb+u9araZ8QAIzWIN8OhaTyyeG451OGeu7+5xnY +muP7jTGlFuP4Q64Vt5WAc54dhILCy2pRImMl/0Mfjq3WOOdqSQViaoJpHFkgjy8z +9MFX/hZqLC57oDmNnI8X/bG/ApGMQD7UoeAH4recf7jmtqRyLUeDd2wOEsSRICty +czH/m43Uct4kShXP2ui1vqAP8p9UtfdImgyNWV91J35SjxSiFvp+YAuNn+jsnDiV +BzYJAlk/rdN1h6E+cDfp/GYaXDjVxLy8bipuEN5icZGMH20tkiVsvPQ5J++AOSre +I830E62IJBKU9kwQa9iSbWxtcnxJmOEVBGN2gJ+2WAd2uA9ZCCJafTXiVe57Icxd +2P5zRqrDn0bAmIyl04NKnVAnthQG+b6hEuuaKhTkj2TvhmXkH84BcAvKC82yNBc1 +zrzxfLI/WPZJrh2IVhXWVhW13Yd6eUmqUk8p0hQ5ZhdL9D6fQJSXxkdiauMJov1C +njR/++NOtERBSk+7hbTb921q/brMZXgJ971u31b0sRoefybbbjHSWjNVSP6ENn44 +eQfS06CUmc7oN18bGhHmlmhK4az9i5eQ4HlUE5K9f4z7yQRTM6XfIpzDrWOfFfaY +vYkcC6CbR8xnb+LOlqwKHzKVwoWGLSreeShqPfazQEjR3V52XdFmyVIrltj7JRxi +tW29kqO09AEalR9l +=t42C +-----END PGP PUBLIC KEY BLOCK----- diff --git a/knot.spec b/knot.spec new file mode 100644 index 0000000..4b79d07 --- /dev/null +++ b/knot.spec @@ -0,0 +1,1579 @@ +%global _hardened_build 1 +%{!?_pkgdocdir: %global _pkgdocdir %{_docdir}/%{name}} + +%define GPG_CHECK 1 +%if 0%{?fedora} >= 40 || 0%{?rhel} >= 9 +# use modern %pyproject_* macros on distros which support them +%define PYPROJECT 1 +%else +# use older %py3_* macros on older/other distros +%define PYPROJECT 0 +%endif +%define BASE_VERSION %(echo "%{version}" | sed 's/^\\([^.]\\+\\.[^.]\\+\\).*/\\1/') +%define repodir %{_builddir}/%{name}-%{version} + +Summary: High-performance authoritative DNS server +Name: knot +Version: 3.5.2 +Release: 1%{?dist} +License: GPL-3.0-or-later +URL: https://www.knot-dns.cz +Source0: https://secure.nic.cz/files/knot-dns/%{name}-%{version}.tar.xz + +%if 0%{?GPG_CHECK} +Source1: https://secure.nic.cz/files/knot-dns/%{name}-%{version}.tar.xz.asc +# PGP keys used to sign upstream releases +# Export with --armor using command from https://fedoraproject.org/wiki/PackagingDrafts:GPGSignatures +# Don't forget to update %%prep section when adding/removing keys +Source100: gpgkey-742FA4E95829B6C5EAC6B85710BB7AF6FEBBD6AB.gpg.asc +BuildRequires: gnupg2 +%endif + +# Required dependencies +BuildRequires: autoconf +BuildRequires: automake +BuildRequires: libtool +BuildRequires: make +BuildRequires: gcc +BuildRequires: pkgconfig(liburcu) +BuildRequires: pkgconfig(gnutls) +BuildRequires: pkgconfig(libedit) + +# Optional dependencies +BuildRequires: pkgconfig(libcap-ng) +BuildRequires: pkgconfig(libidn2) +BuildRequires: pkgconfig(libmnl) +BuildRequires: pkgconfig(libnghttp2) +BuildRequires: pkgconfig(libsystemd) +BuildRequires: pkgconfig(systemd) +BuildRequires: pkgconfig(hiredis) +%if 0%{?fedora} || 0%{?rhel} +BuildRequires: softhsm +%endif +# dnstap dependencies +BuildRequires: pkgconfig(libfstrm) +BuildRequires: pkgconfig(libprotobuf-c) +# geoip dependencies +BuildRequires: pkgconfig(libmaxminddb) +# XDP dependencies +BuildRequires: pkgconfig(libbpf) +# Python modules (python3-libknot, knot-exporter) dependencies +BuildRequires: python3-devel +%if 0%{?PYPROJECT} +BuildRequires: pyproject-rpm-macros +BuildRequires: python3-pip +BuildRequires: python3-hatchling +%else +BuildRequires: python3-setuptools +%endif + +# Distro-dependent dependencies +%if 0%{?suse_version} +BuildRequires: python3-Sphinx +BuildRequires: lmdb-devel +BuildRequires: protobuf-c +Requires(pre): pwdutils +%if 0%{?sle_version} != 150400 +BuildRequires: pkgconfig(libxdp) +%endif +%endif +%if 0%{?fedora} || 0%{?rhel} +BuildRequires: python3-sphinx +BuildRequires: pkgconfig(lmdb) +%if 0%{?fedora} || 0%{?rhel} >= 9 +BuildRequires: pkgconfig(libxdp) +%endif +%endif + +%if 0%{?rhel} >= 9 || 0%{?suse_version} || 0%{?fedora} +%define configure_quic --enable-quic=yes +%endif + +Requires(post): systemd %{_sbindir}/runuser +Requires(preun): systemd +Requires(postun): systemd + +Requires: %{name}-libs%{?_isa} = %{version}-%{release} + +Recommends: %{name}-keymgr + +%if 0%{?suse_version} +Provides: group(knot) +%endif + +%description +Knot DNS is a high-performance authoritative DNS server implementation. + +%package libs +Summary: Libraries used by the Knot DNS server and client applications +# Knot DNS 3.5+ isn't compatible with earlier knot-resolver +Conflicts: knot-resolver < 5.7.6-3 + +%description libs +The package contains shared libraries used by the Knot DNS server and +utilities. + +%package devel +Summary: Development header files for the Knot DNS libraries +Requires: %{name}-libs%{?_isa} = %{version}-%{release} + +%description devel +The package contains development header files for the Knot DNS libraries +included in knot-libs package. + +%package utils +Summary: DNS client utilities shipped with the Knot DNS server +Requires: %{name}-libs%{?_isa} = %{version}-%{release} +# Debian package compat +Provides: %{name}-dnsutils = %{version}-%{release} + +%description utils +The package contains DNS client utilities shipped with the Knot DNS server. + +%package dnssecutils +Summary: DNSSEC tools shipped with the Knot DNS server +Requires: %{name}-libs%{?_isa} = %{version}-%{release} + +%description dnssecutils +The package contains DNSSEC tools shipped with the Knot DNS server. + +%package keymgr +Summary: Knot DNS key management utility +Requires: %{name}-libs%{?_isa} = %{version}-%{release} + +%description keymgr +The package contains keymgr program for Knot DNS key management. + +%package module-dnstap +Summary: dnstap module for Knot DNS +Requires: %{name} = %{version}-%{release} + +%description module-dnstap +The package contains dnstap Knot DNS module for logging DNS traffic. + +%package module-geoip +Summary: geoip module for Knot DNS +Requires: %{name} = %{version}-%{release} + +%description module-geoip +The package contains geoip Knot DNS module for geography-based responses. + +%package exporter +Summary: Prometheus exporter for Knot DNS +BuildArch: noarch +Requires: %{name}-libs = %{version}-%{release} + +%description exporter +The package provides Python Prometheus exporter for Knot DNS. + +%package -n python3-libknot +Summary: Python bindings for libknot +BuildArch: noarch +Requires: %{name}-libs = %{version}-%{release} +%{?python_provide:%python_provide python3-libknot} + +%description -n python3-libknot +The package provides Python bindings for the libknot shared library. + +%package -n valkey-module-knot +Summary: Valkey module for Knot DNS. +Requires: %{name}-libs = %{version}-%{release} + +%description -n valkey-module-knot +The package provides Valkey module for Knot DNS. + +%package doc +Summary: Documentation for the Knot DNS server +BuildArch: noarch +Provides: bundled(jquery) + +%description doc +The package contains documentation for the Knot DNS server. +On-line version is available on https://www.knot-dns.cz/documentation/ + +%prep +%if 0%{?GPG_CHECK} +export GNUPGHOME=./gpg-keyring +[ -d ${GNUPGHOME} ] && rm -r ${GNUPGHOME} +mkdir --mode=700 ${GNUPGHOME} +gpg2 --import %{SOURCE100} +gpg2 --verify %{SOURCE1} %{SOURCE0} +%endif +%autosetup -p1 + +# Create a sysusers.d config file +cat >knot.sysusers.conf < 7 +install -p -m 0644 -D %{repodir}/distro/common/cz.nic.knotd.conf %{buildroot}%{_datadir}/dbus-1/system.d/cz.nic.knotd.conf +%endif + +# install systemd files +install -p -m 0644 -D %{repodir}/distro/common/%{name}.service %{buildroot}%{_unitdir}/%{name}.service +%if 0%{?suse_version} +ln -s service %{buildroot}/%{_sbindir}/rcknot +%endif + +# create storage dir +install -d %{buildroot}%{_sharedstatedir} +install -d -m 0770 -D %{buildroot}%{_sharedstatedir}/knot + +# remove libarchive files +find %{buildroot} -type f -name "*.la" -delete -print + +install -m0644 -D knot.sysusers.conf %{buildroot}%{_sysusersdir}/knot.conf + +%check +V=1 make check + +%pre +%if 0%{?suse_version} +%service_add_pre knot.service +%endif + +%post +%if 0%{?suse_version} +%service_add_post knot.service +%else +%systemd_post knot.service +%endif + +%preun +%if 0%{?suse_version} +%service_del_preun knot.service +%else +%systemd_preun knot.service +%endif + +%postun +%if 0%{?suse_version} +%service_del_postun knot.service +%else +%systemd_postun_with_restart knot.service +%endif + +%if 0%{?fedora} || 0%{?rhel} > 7 +# https://fedoraproject.org/wiki/Changes/Removing_ldconfig_scriptlets +%else +%post libs -p /sbin/ldconfig +%postun libs -p /sbin/ldconfig +%endif + +%files +%license COPYING +%doc %{_pkgdocdir} +%exclude %{_pkgdocdir}/html +%attr(750,root,knot) %dir %{_sysconfdir}/knot +%config(noreplace) %attr(640,root,knot) %{_sysconfdir}/knot/knot.conf +%if 0%{?fedora} || 0%{?rhel} > 7 +%config(noreplace) %attr(644,root,root) %{_datadir}/dbus-1/system.d/cz.nic.knotd.conf +%endif +%attr(770,root,knot) %dir %{_sharedstatedir}/knot +%dir %{_libdir}/knot +%dir %{_libdir}/knot/modules-* +%{_unitdir}/knot.service +%{_sbindir}/kcatalogprint +%{_sbindir}/kjournalprint +%{_sbindir}/knotc +%{_sbindir}/knotd +%if 0%{?suse_version} +%{_sbindir}/rcknot +%endif +%{_mandir}/man5/knot.conf.* +%{_mandir}/man8/kcatalogprint.* +%{_mandir}/man8/kjournalprint.* +%{_mandir}/man8/knotc.* +%{_mandir}/man8/knotd.* +%ghost %attr(770,root,knot) %dir %{_rundir}/knot +%{_sysusersdir}/knot.conf + +%files utils +%{_bindir}/kdig +%{_bindir}/khost +%{_bindir}/knsupdate +%{_sbindir}/kxdpgun +%{_mandir}/man8/kxdpgun.* +%{_mandir}/man1/kdig.* +%{_mandir}/man1/khost.* +%{_mandir}/man1/knsupdate.* + +%files dnssecutils +%{_bindir}/knsec3hash +%{_bindir}/kzonecheck +%{_bindir}/kzonesign +%{_mandir}/man1/knsec3hash.* +%{_mandir}/man1/kzonecheck.* +%{_mandir}/man1/kzonesign.* + +%files keymgr +%{_sbindir}/keymgr +%{_mandir}/man8/keymgr.* + +%files module-dnstap +%{_libdir}/knot/modules-*/dnstap.so + +%files module-geoip +%{_libdir}/knot/modules-*/geoip.so + +%files exporter +%{_bindir}/knot-exporter +%{python3_sitelib}/knot_exporter +%{python3_sitelib}/knot_exporter-*-info + +%files -n python3-libknot +%{python3_sitelib}/libknot +%{python3_sitelib}/libknot-*-info + +%files -n valkey-module-knot +%attr(0755, root, root) %{_libdir}/valkey/modules/knot.so + +%files libs +%license COPYING +%doc NEWS +%doc README.md +%{_libdir}/libdnssec.so.* +%{_libdir}/libknot.so.* +%{_libdir}/libzscanner.so.* + +%files devel +%{_includedir}/libdnssec +%{_includedir}/knot +%{_includedir}/libknot +%{_includedir}/libzscanner +%{_libdir}/libdnssec.so +%{_libdir}/libknot.so +%{_libdir}/libzscanner.so +%{_libdir}/pkgconfig/knotd.pc +%{_libdir}/pkgconfig/libdnssec.pc +%{_libdir}/pkgconfig/libknot.pc +%{_libdir}/pkgconfig/libzscanner.pc + +%files doc +%dir %{_pkgdocdir} +%doc %{_pkgdocdir}/html + +%changelog +* Fri Dec 19 2025 Jakub Ružička - 3.5.2-1 +- Update to 3.5.2 + +* Thu Oct 16 2025 Jakub Ružička - 3.5.1-1 +- Update to 3.5.1 +- Add new valkey-module-knot package +- Split keymgr into knot-keymgr package + +* Fri Sep 19 2025 Python Maint - 3.4.8-3 +- Rebuilt for Python 3.14.0rc3 bytecode + +* Fri Aug 15 2025 Python Maint - 3.4.8-2 +- Rebuilt for Python 3.14.0rc2 bytecode + +* Wed Jul 30 2025 Jakub Ružička - 3.4.8-1 +- Update to 3.4.8 + +* Thu Jul 24 2025 Fedora Release Engineering - 3.4.7-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild + +* Thu Jun 12 2025 Jakub Ružička - 3.4.7-1 +- Update to 3.4.7 +- Add new knot-exporter and python3-libknot packages + +* Thu Apr 10 2025 Jakub Ružička - 3.4.6-1 +- Update to 3.4.6 + +* Wed Mar 19 2025 Jakub Ružička - 3.4.5-1 +- Update to 3.4.5 + +* Thu Jan 23 2025 Zbigniew Jędrzejewski-Szmek - 3.4.4-2 +- Add sysusers.d config file to allow rpm to create users/groups automatically + +* Thu Jan 23 2025 Jakub Ružička - 3.4.4-1 +- Update to 3.4.4 + +* Fri Jan 17 2025 Fedora Release Engineering - 3.4.3-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild + +* Tue Dec 10 2024 Jakub Ružička - 3.4.3-1 +- Update to 3.4.3 + +* Mon Nov 25 2024 Jakub Ružička - 3.4.2-1 +- Update to 3.4.2 + +* Mon Aug 26 2024 Jakub Ružička - 3.3.9-1 +- Update to 3.3.9 + +* Mon Jul 22 2024 Jakub Ružička - 3.3.8-1 +- Update to 3.3.8 + +* Thu Jul 18 2024 Fedora Release Engineering - 3.3.7-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild + +* Tue Jun 25 2024 Jakub Ružička - 3.3.7-1 +- Update to 3.3.7 + +* Thu Jun 13 2024 Jakub Ružička - 3.3.6-1 +- Update to 3.3.6 + +* Thu Mar 07 2024 Jakub Ružička - 3.3.5-1 +- Update to 3.3.5 + +* Wed Jan 24 2024 Jakub Ružička - 3.3.4-1 +- Update to 3.3.4 + +* Sun Jan 21 2024 Fedora Release Engineering - 3.3.3-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + +* Wed Dec 13 2023 Jakub Ružička - 3.3.3-1 +- Update to 3.3.3 + +* Fri Oct 20 2023 Jakub Ružička - 3.3.2-1 +- Update to 3.3.2 + +* Tue Sep 12 2023 Jakub Ružička - 3.3.1-1 +- Update to 3.3.1 + +* Mon Aug 28 2023 Jakub Ružička - 3.3.0-1 +- Update to 3.3.0 + +* Thu Jul 27 2023 Jakub Ružička - 3.2.9-1 +- Update to 3.2.9 + +* Thu Jul 20 2023 Fedora Release Engineering - 3.2.8-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild + +* Mon Jun 26 2023 Jakub Ružička - 3.2.8-1 +- Update to 3.2.8 + +* Tue Jun 06 2023 Jakub Ružička - 3.2.7-1 +- Update to 3.2.7 +- Remove unneeded tests patch +- Use _datadir for config + +* Fri May 12 2023 Michel Alexandre Salim - 3.2.6-2 +- Add BR on libxdp on RHEL >= 9 to use with libbpf-1.x + +* Thu Apr 06 2023 Jakub Ružička - 3.2.6-1 +- Update to 3.2.6 +- Sync upstream packaging improvements + +* Thu Feb 02 2023 Jakub Ružička - 3.2.5-1 +- Update to 3.2.5 + +* Thu Jan 19 2023 Fedora Release Engineering - 3.2.4-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild + +* Mon Dec 12 2022 Jakub Ružička - 3.2.4-1 +- Update to 3.2.4 + +* Mon Nov 28 2022 Jakub Ružička - 3.2.3-2 +- Rebuilt for libbpf 1.0 transition + +* Mon Nov 21 2022 Jakub Ružička - 3.2.3-1 +- Update to 3.2.3 + +* Fri Nov 04 2022 Jakub Ružička - 3.2.2-2 +- New BuildRequires: libxdp (needed for libbpf >= 1.0) + +* Tue Nov 01 2022 Jakub Ružička - 3.2.2-1 +- Update to 3.2.2 + +* Fri Sep 09 2022 Jakub Ružička - 3.2.1-1 +- Update to 3.2.1 +- Remove patches included upstream +- Update Conflicts and move to knot-libs + +* Mon Aug 22 2022 Jakub Ružička - 3.2.0-1 +- Update to 3.2.0 +- Patch: fix tests on 32-bit platforms +- Patch: revert problematic hardening of service file +- Enable QUIC +- New knot-dnssecutils subpackage +- Debian compat (knot-utils vs knot-dnsutils) +- Remove bundled(jquery) version as it differes between distros + +* Thu Jul 21 2022 Fedora Release Engineering - 3.1.8-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild + +* Thu Apr 28 2022 Jakub Ružička - 3.1.8-1 +- Update to 3.1.8 + +* Wed Mar 30 2022 Jakub Ružička - 3.1.7-1 +- Update to 3.1.7 + +* Thu Feb 10 2022 Jakub Ružička - 3.1.6-1 +- Update to 3.1.6 +- Add dbus config +- Use _sharedstatedir for home + +* Thu Jan 20 2022 Fedora Release Engineering - 3.1.5-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild + +* Wed Jan 05 2022 Jakub Ružička 3.1.5-1 +- Update to 3.1.5 + +* Sat Nov 06 2021 Adrian Reber - 3.1.4-2 +- Rebuilt for protobuf 3.19.0 + +* Thu Nov 04 2021 Jakub Ružička - 3.1.4-1 +- Update to 3.1.4 + +* Tue Oct 26 2021 Adrian Reber - 3.1.3-2 +- Rebuilt for protobuf 3.18.1 + +* Tue Oct 19 2021 Jakub Ružička - 3.1.3-1 +- Update to 3.1.3 + +* Thu Sep 09 2021 Jakub Ružička - 3.1.2-1 +- Update to 3.1.2 + +* Tue Aug 10 2021 Jakub Ružička - 3.1.1-1 +- Update to 3.1.1 +- Enable XDP on ARM and improve XDP config macros +- Remove patch included upstream + +* Wed Aug 04 2021 Jakub Ružička 3.1.0-2 +- Introduce a patch to fix tests on ppc64le +- Use autosetup macro to apply patches + +* Mon Aug 02 2021 Jakub Ružička - 3.1.0-1 +- Update to 3.1.0 +- Add missing BuildRequires including new libmnl for kxdpgun +- Temporarily disable XDP on ARM until issues are resolved + +* Thu Jul 22 2021 Fedora Release Engineering - 3.0.8-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild + +* Fri Jul 16 2021 Jakub Ružička - 3.0.8-1 +- Update to 3.0.8 +- Print failed tests during check + +* Thu Jun 17 2021 Jakub Ružička - 3.0.7-1 +- Update to 3.0.7 + +* Fri May 14 2021 Jakub Ružička - 3.0.6-1 +- Update to 3.0.6 + +* Tue Mar 30 2021 Jakub Ružička 3.0.5-1 +- Update to 3.0.5 +- Properly escape BASE_VERSION macro +- Include module dirs in main package + +* Tue Mar 02 2021 Zbigniew Jędrzejewski-Szmek - 3.0.4-2 +- Rebuilt for updated systemd-rpm-macros + See https://pagure.io/fesco/issue/2583. + +* Mon Feb 01 2021 Jakub Ružička - 3.0.4-1 +- Update to 3.0.4 +- Move dnstap module to subpackage +- Move geoip module to subpackage +- Remove redundant VERSION macro + +* Tue Jan 26 2021 Fedora Release Engineering - 3.0.3-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild + +* Thu Jan 14 08:45:48 CET 2021 Adrian Reber - 3.0.3-2 +- Rebuilt for protobuf 3.14 + +* Thu Dec 17 2020 Jakub Ružička - 3.0.3-1 +- Update to 3.0.3 + +* Wed Nov 11 2020 Jakub Ružička - 3.0.2-2 +- Remove patch included in upstream release + +* Wed Nov 11 2020 Jakub Ružička - 3.0.2-1 +- Update to 3.0.2 + +* Thu Oct 29 2020 Jakub Ružička - 3.0.1-2 +- Respect GnuTLS insecure algorithms + +* Mon Oct 12 2020 Jakub Ružička - 3.0.1-1 +- Update to 3.0.1 +- Sync packaging from upstream + +* Thu Sep 24 2020 Adrian Reber - 3.0.0-2 +- Rebuilt for protobuf 3.13 + +* Thu Sep 10 2020 Jakub Ružička 3.0.0-1 +- New major upstream release 3.0.0 +- Sync packaging from upstream + +* Wed Sep 02 2020 Jakub Ružička 2.9.6-1 +- Update to 2.9.6 + +* Tue Jul 28 2020 Fedora Release Engineering - 2.9.5-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild + +* Sun Jun 14 2020 Adrian Reber - 2.9.5-2 +- Rebuilt for protobuf 3.12 + +* Mon May 25 2020 Tomas Krizek - 2.9.5-1 +- new upstream release 2.9.5 + +* Tue May 05 2020 Tomas Krizek - 2.9.4-1 +- new upstream release 2.9.4 + +* Tue Mar 03 2020 Tomas Krizek - 2.9.3-1 +- new upstream release 2.9.3 + +* Wed Jan 29 2020 Fedora Release Engineering - 2.9.2-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild + +* Fri Dec 13 2019 Tomas Krizek - 2.9.2-1 +- new upstream release 2.9.2 + +* Tue Nov 12 2019 Tomas Krizek - 2.9.1-1 +- New upstream release 2.9.1 +- add EPEL8 compatibility +- fix unsafe PGP keyring permissions + +* Tue Sep 24 2019 Tomas Krizek - 2.8.4-1 +- new upstream release 2.8.4 + +* Thu Jul 25 2019 Fedora Release Engineering - 2.8.3-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild + +* Tue Jul 16 2019 Tomas Krizek - 2.8.3-1 +- New upstream release 2.8.3 + +* Wed Jun 26 2019 Tomas Krizek - 2.8.2-1 +- New upstream release 2.8.2 + +* Wed May 29 2019 Tomas Krizek - 2.8.1-1 +- New upstream release 2.8.1 +- Resolves BZ#1700251 + +* Thu Feb 28 2019 Tomas Krizek - 2.7.6-3 +- Added 01-test_net-disable-udp-send-on-unconnected.patch to disable + unnecessary failing test. Fixes BZ#1675235 + +* Fri Feb 01 2019 Fedora Release Engineering - 2.7.6-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild + +* Wed Jan 23 2019 Tomas Krizek - 2.7.6-1 +Knot DNS 2.7.6 (2019-01-23) +=========================== + +Improvements: +------------- + - Zone status also shows when the zone load is scheduled + - Server workers status also shows background workers utilization + - Default control timeout for knotc was increased to 10 seconds + - Pkg-config files contain auxiliary variable with library filename + +Bugfixes: +--------- + - Configuration commit or server reload can drop some pending zone events + - Nonempty zone journal is created even though it's disabled #635 + - Zone is completely re-signed during empty dynamic update processing + - Server can crash when storing a big zone difference to the journal + - Failed to link on FreeBSD 12 with Clang + +* Mon Jan 07 2019 Tomas Krizek - 2.7.5-1 +Knot DNS 2.7.5 (2019-01-07) +=========================== + +Features: +--------- + - Keymgr supports NSEC3 salt handling + +Improvements: +------------- + - Zone history in journal is dropped apon AXFR-like zone update + - Libdnssec is no longer linked against libm #628 + - Libdnssec is explicitly linked against libpthread if PKCS #11 enabled #629 + - Better support for libknot packaging in Python + - Manually generated KSK is 'ready' by default + - Kdig supports '+timeout' as an alias for '+time' + - Kdig supports '+nocomments' option + - Kdig no longer prints empty lines between retries + - Kdig returns failure if operations not successfully resolved #632 + - Fixed repeating of the 'KSK submission, waiting for confirmation' log + - Various improvements in documentation, Dockerfile, and tests + +Bugfixes: +--------- + - Knotc fails to unset huge configuration section + - Kjournalprint sometimes fails to display zone journal content + - Improper timing of ZSK removal during ZSK rollover + - Missing UTC time zone indication in the 'iso' keymgr list output + - A race condition in the online signing module + +* Tue Nov 13 2018 Tomas Krizek - 2.7.4-1 +Knot DNS 2.7.4 (2018-11-13) +=========================== + +Features: +--------- + - Added SNI configuration for TLS in kdig (Thanks to Alexander Schultz) + +Improvements: +------------- + - Added warning log when DNSSEC events not successfully scheduled + - New semantic check on timer values in keymgr + - DS query no longer asks other addresses if got a negative answer + - Reintroduced 'rollover' configuration option for CDS/CDNSKEY publication + - Extended logging for zone loading + - Various documentation improvements + +Bugfixes: +--------- + - Failed to import module configuration #613 + - Improper Cflags value in libknot.pc if built with embedded LMDB #615 + - IXFR doesn't fall back to AXFR if malformed reply + - DNSSEC events not correctly scheduled for empty zone updates + - During algorithm rollover old keys get removed before DS TTL expires #617 + - Maximum zone's RRSIG TTL not considered during algorithm rollover #620 + +* Fri Oct 12 2018 Tomas Krizek - 2.7.3-1 +Knot DNS 2.7.3 (2018-10-11) +=========================== + +Features: +--------- + - New queryacl module for query access control + - Configurable answer rrset rotation #612 + - Configurable NSEC bitmap in online signing + +Improvements: +------------- + - Better error logging for KASP DB operations #601 + - Some documentation improvements + +Bugfixes: +--------- + - Keymgr "list" output doesn't show key size for ECDSA algorithms #602 + - Failed to link statically with embedded LMDB + - Configuration commit causes zone reload for all zones + - The statistics module overlooks TSIG record in a request + - Improper processing of an AXFR-style-IXFR response consisting of one-record messages + - Race condition in online signing during key rollover #600 + - Server can crash if geoip module is enabled in the geo mode + +* Wed Aug 29 2018 Tomas Krizek - 2.7.2-1 +Knot DNS 2.7.2 (2018-08-29) +=========================== + +Improvements: +------------- + - Keymgr list command displays also key size + - Kjournalprint displays total occupied size in the debug mode + - Server doesn't stop if failed to load a shared module from the module directory + - Libraries libcap-ng, pthread, and dl are linked selectively if needed + +Bugfixes: +--------- + - Sometimes incorrect result from dnssec_nsec_bitmap_contains (libdnssec) + - Server can crash when loading zone file difference and zone-in-journal is set + - Incorrect treatment of specific queries in the module RRL + - Failed to link module Cookies as a shared library + +* Wed Aug 15 2018 Tomas Krizek - 2.7.1-1 +Knot DNS 2.7.1 (2018-08-14) +=========================== + +Improvements: +------------- + - Added zone wire size information to zone loading log message + - Added debug log message for each unsuccessful remote address operation + - Various improvements for packaging + +Bugfixes: +--------- + - Incompatible handling of RRSIG TTL value when creating a DNS message + - Incorrect RRSIG TTL value in zone differences and knotc zone operation outputs + - Default configure prefix is ignored + +Knot DNS 2.7.0 (2018-08-03) +=========================== + +Features: +--------- + - New DNS Cookies module and related '+cookie' kdig option + - New module for response tailoring according to client's subnet or geographic location + - General EDNS Client Subnet support in the server + - OSS-Fuzz integration (Thanks to Jonathan Foote) + - New '+ednsopt' kdig option (Thanks to Jan Včelák) + - Online Signing support for automatic key rollover + - Non-normal file (e.g. pipe) loading support in zscanner #542 + - Automatic SOA serial incrementation if non-empty zone difference + - New zone file load option for ignoring zone file's SOA serial + - New build-time option for alternative malloc specification + - Structured logging for DNSSEC key submission event + - Empty QNAME support in kdig + +Improvements: +------------- + - Various library and server optimizations + - Reduced memory consumption of outgoing IXFR processing + - Linux capabilities use overhaul #546 (Thanks to Robert Edmonds) + - Online Signing properly signs delegations and CNAME records + - CDS/CDNSKEY rrset is signed with KSK instead of ZSK + - DNSSEC-related records are ignored when loading zone difference with signing enabled + - Minimum allowed RSA key length was increased to 1024 + - Removed explicit dependency on Nettle + +Bugfixes: +--------- + - Possible uninitialized address buffer use in zscanner + - Possible index overflow during multiline record parsing in zscanner + - kdig +tls sometimes consumes 100 % CPU #561 + - Single-Type Signing doesn't work with single ZSK key #566 + - Zone not flushed after re-signing during zone load #594 + - Server crashes when committing empty zone transaction + - Incoming IXFR with on-slave signing sometimes leads to memory corruption #595 + +Compatibility: +-------------- + - Removed obsolete RRL configuration + - Removed obsolete module names 'mod-online-sign' and 'mod-synth-record' + - Removed obsolete 'ixfr-from-differences' configuration option + - Removed old journal migration + - Removed module rosedb + + +* Fri Jul 13 2018 Fedora Release Engineering - 2.6.8-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild + +* Wed Jul 11 2018 Tomas Krizek - 2.6.8-1 +Knot DNS 2.6.8 (2018-07-10) +=========================== + +Features: +--------- + - New 'import-pkcs11' command in keymgr + +Improvements: +------------- + - Unixtime serial policy mimics Bind – increment if lower #593 + +Bugfixes: +--------- + - Creeping memory consuption upon server reload #584 + - Kdig incorrectly detects QNAME if 'notify' is a prefix + - Server crashes when zone sign fails #587 + - CSK->KZSK rollover retires CSK early #588 + - Server crashes when zone expires during outgoing multi-message transfer + - Kjournalprint doesn't convert zone name argument to lower-case + - Cannot switch to a previously used ksk-shared dnssec policy #589 + +* Thu May 17 2018 Tomas Krizek - 2.6.7-1 +Knot DNS 2.6.7 (2018-05-17) +=========================== + +Features: +--------- + - Added 'dateserial' (YYYYMMDDnn) serial policy configuration (Thanks to Wolfgang Jung) + +Improvements: +------------- + - Trailing data indication from the packet parser (libknot) + - Better configuration check for a problematical option combination + +Bugfixes: +--------- + - Incomplete configuration option item name check + - Possible buffer overflow in 'knot_dname_to_str' (libknot) + - Module dnsproxy doesn't preserve letter case of QNAME + - Module dnsproxy duplicates OPT and TSIG in the non-fallback mode + +* Wed Apr 11 2018 Tomas Krizek - 2.6.6-1 +Knot DNS 2.6.6 (2018-04-11) +=========================== + +Features: +--------- + - New EDNS option counters in the statistics module + - New '+orphan' filter for the 'zone-purge' operation + +Improvements: +------------- + - Reduced memory consuption of disabled statistics metrics + - Some spelling fixes (Thanks to Daniel Kahn Gillmor) + - Server no longer fails to start if MODULE_DIR doesn't exist + - Configuration include doesn't fail if empty wildcard match + - Added a configuration check for a problematical option combination + +Bugfixes: +--------- + - NSEC3 chain not re-created when SOA minimum TTL changed + - Failed to start server if no template is configured + - Possibly incorrect SOA serial upon changed zone reload with DNSSEC signing + - Inaccurate outgoing zone transfer size in the log message + - Invalid dname compression if empty question section + - Missing EDNS in EMALF responses + +* Mon Mar 26 2018 Iryna Shcherbina - 2.6.5-2 +- Update Python 2 dependency declarations to new packaging standards + (See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3) + +* Mon Feb 12 2018 Tomas Krizek - 2.6.5-1 +- New upstream release 2.6.5 + +Knot DNS 2.6.5 (2018-02-12) +=========================== + +Features: +--------- + - New 'zone-notify' command in knotc + - Kdig uses '@server' as a hostname for TLS authenticaion if '+tls-ca' is set + +Improvements: +------------- + - Better heap memory trimming for zone operations + - Added proper polling for TLS operations in kdig + - Configuration export uses stdout as a default output + - Simplified detection of atomic operations + - Added '--disable-modules' configure option + - Small documentation updates + +Bugfixes: +--------- + - Zone retransfer doesn't work well if more masters configured + - Kdig can leak or double free memory in corner cases + - Inconsistent error outputs from dynamic configuration operations + - Failed to generate documentation on OpenBSD + +* Fri Feb 09 2018 Igor Gnatenko - 2.6.4-3 +- Escape macros in %%changelog + +* Wed Feb 07 2018 Fedora Release Engineering - 2.6.4-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild + +* Mon Jan 22 2018 Tomas Krizek - 2.6.4-1 +- Added PGP signature verification +- Added integration test + +- New upstream release 2.6.4 + +Knot DNS 2.6.4 (2018-01-02) +=========================== + +Features: +--------- + - Module synthrecord allows multiple 'network' specification + - New CSK handling support in keymgr + +Improvements: +------------- + - Allowed configuration for infinite zsk lifetime + - Increased performance and security of the module synthrecord + - Signing changeset is stored into journal even if 'zonefile-load' is whole + +Bugfixes: +--------- + - Unintentional zone re-sign during reload if empty NSEC3 salt + - Inconsistent zone names in journald structured logs + - Malformed outgoing transfer for big zone with TSIG + - Some minor DNSSEC-related issues + +Knot DNS 2.6.3 (2017-11-24) +=========================== + +Bugfixes: +--------- + - Wrong detection of signing scheme rollover + +Knot DNS 2.6.2 (2017-11-23) +=========================== + +Features: +--------- + - CSK algorithm rollover and (KSK, ZSK) <-> CSK rollover support + +Improvements: +------------- + - Allowed explicit configuration for infinite ksk lifetime + - Proper error messages instead of unclear error codes in server log + - Better support for old compilers + +Bugfixes: +--------- + - Unexpected reply for DS query with an owner below a delegation point + - Old dependencies in the pkg-config file + + +* Mon Nov 06 2017 Petr Špaček - 2.6.1-1 +- New upstream release 2.6.1 + +Knot DNS 2.6.1 (2017-11-02) +=========================== + +Features: +--------- + - NSEC3 Opt-Out support in the DNSSEC signing + - New CDS/CDNSKEY publish configuration option + +Improvements: +------------- + - Simplified DNSSEC log message with DNSKEY details + - +tls-hostname in kdig implies +tls-ca if neither +tls-ca nor +tls-pin is given + - New documentation sections for DNSSEC key rollovers and shared keys + - Keymgr no longer prints useless algorithm number for generated key + - Kdig prints unknown RCODE in a numeric format + - Better support for LLVM libFuzzer + +Bugfixes: +--------- + - Faulty DNAME semantic check if present in the zone apex and NSEC3 is used + - Immediate zone flush not scheduled during the zone load event + - Server crashes upon dynamic zone addition if a query module is loaded + - Kdig fails to connect over TLS due to SNI is set to server IP address + - Possible out-of-bounds memory access at the end of the input + - TCP Fast Open enabled by default in kdig breaks TLS connection + +Knot DNS 2.6.0 (2017-09-29) +=========================== + +Features: +--------- + - On-slave (inline) signing support + - Automatic DNSSEC key algorithm rollover + - Ed25519 algorithm support in DNSSEC (requires GnuTLS 3.6.0) + - New 'journal-content' and 'zonefile-load' configuration options + - keymgr tries to run as user/group set in the configuration + - Public-only DNSSEC key import into KASP DB via keymgr + - NSEC3 resalt and parent DS query events are persistent in timer DB + - New processing state for a response suppression within a query module + - Enabled server side TCP Fast Open if supported + - TCP Fast Open support in kdig + +Improvements: +------------- + - Better record owner compression if related to the previous rdata dname + - NSEC(3) chain is no longer recomputed whole on every update + - Remove inconsistent and unnecessary quoting in log files + - Avoiding of overlapping key rollovers at a time + - More DNSSSEC-related semantic checks + - Extended timestamp format in keymgr + +Bugfixes: +--------- + - Incorrect journal free space computation causing inefficient space handling + - Interface-automatic broken on Linux in the presence of asymmetric routing + +Knot DNS 2.5.5 (2017-09-29) +=========================== + +Improvements: +------------- + - Constant time memory comparison in the TSIG processing + - Proper use of the ctype functions + - Generated RRSIG records have inception time 90 minutes in the past + +Bugfixes: +--------- + - Incorrect online signature for NSEC in the case of a CNAME record + - Incorrect timestamps in dnstap records + - EDNS Subnet Client validation rejects valid payloads + - Module configuration semantic checks are not executed + - Kzonecheck segfaults with unusual inputs + +Knot DNS 2.5.4 (2017-08-31) +=========================== + +Improvements: +------------- + - New minimum and maximum refresh interval config options (Thanks to Manabu Sonoda) + - New warning when unforced flush with disabled zone file synchronization + - New 'dnskey' keymgr command + - Linking with libatomic on architectures that require it (Thanks to Pierre-Olivier Mercier) + - Removed 'OK' from listing keymgr command outputs + - Extended journal and keymgr documentation and logging + +Bugfixes: +--------- + - Incorrect handling of specific corner-cases with zone-in-journal + - The 'share' keymgr command doesn't work + - Server crashes if configured with query-size and reply-size statistics options + - Malformed big integer configuration values on some 32-bit platforms + - Keymgr uses local time when parsing date inputs + - Memory leak in kdig upon IXFR query + +* Mon Jul 31 2017 Petr Spacek - 2.5.3-1 +- new upstream release +WARNING: Automatic upgrade from versions 1.y.z is no longer possible. +To migrate, upgrade your packages gradually or use contacts listed on +https://www.knot-dns.cz/support/ (if you are in trouble). + +Knot DNS 2.5.3 (2017-07-14) +=========================== + +Features: +--------- + - CSK rollover support for Single-Type Signing Scheme + +Improvements: +------------- + - Allowed binding to non-local adresses for TCP (Thanks to Julian Brost!) + - New documentation section for manual DNSSEC key algorithm rollover + - Initial KSK also generated in the submission state + - The 'ds' keymgr command with no parameter uses all KSK keys + - New debug mode in kjournalprint + - Updated keymgr documentation + +Bugfixes: +--------- + - Sometimes missing RRSIG by KSK in submission state. + - Minor DNSSEC-related issues + +Knot DNS 2.5.2 (2017-06-23) +=========================== + +Security: +--------- + - CVE-2017-11104: Improper TSIG validity period check can allow TSIG forgery (Thanks to Synacktiv!) + +Improvements: +------------- + - Extended debug logging for TSIG errors + - Better error message for unknown module section in the configuration + - Module documentation compilation no longer depends on module configuration + - Extended policy section configuration semantic checks + - Improved python version compatibility in pykeymgr + - Extended migration section in the documentation + - Improved DNSSEC event timing on 32-bit systems + - New KSK rollover start log info message + - NULL qtype support in kdig + +Bugfixes: +--------- + - Failed to process included configuration + - dnskey_ttl policy option in the configuration has no effect on DNSKEY TTL + - Corner case journal fixes (huge changesets, OpenWRT operation) + - Confusing event timestamps in knotc zone-status output + - NSEC/NSEC3 bitmap not updated for CDS/CDNSKEY + - CDS/CDNSKEY RRSIG not updated + +Knot DNS 2.5.1 (2017-06-07) +=========================== + +Bugfixes: +--------- + - pykeymgr no longer crash on empty json files in the KASP DB directory + - pykeymgr no longer imports keys in the "removed" state + - Imported keys in the "removed" state no longer makes knotd to crash + - Including an empty configuration directory no longer makes knotd to crash + - pykeymgr is distributed and installed to the distribution tarball + +Knot DNS 2.5.0 (2017-06-05) +=========================== + +Features: +--------- + - KASP database switched from JSON files to LMDB database + - KSK rollover support using CDNSKEY and CDS in the automatic DNSSEC signing + - Dynamic module loading support with proper module API + - Journal can store full zone contents (not only differences) + - Zone freeze/thaw support + - Updated knotc zone-status output with optional column filters + - New '[no]crypto' option in kdig + - New keymgr implementation reflecting KASP database changes + - New pykeymgr for JSON-based KASP database migration + - Removed obsolete knot1to2 utility + +Improvements: +------------- + - Added libidn2 support to kdig (with libidn fallback) + - Maximum timer database switched from configure to the server configuration + +* Wed Jul 26 2017 Fedora Release Engineering - 2.4.5-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild + +* Mon Jul 10 2017 Petr Spacek - 2.4.5-1 +New upstream release: 2.4.5 + +Knot DNS 2.4.5 (2017-06-23) +=========================== + +Security: +--------- + - Improper TSIG validity period check can allow TSIG forgery (Thanks to Synacktiv!) + +Bugfixes: +--------- + - Corner case journal fixes (huge changesets, OpenWRT operation) + +Knot DNS 2.4.4 (2017-06-05) +=========================== + +Improvements: +------------- + - Improved error handling in kjournalprint + +Bugfixes: +--------- + - Zone flush not replanned upon unsuccessful flush + - Journal inconsistency after deleting deleted zone + - Zone events not rescheduled upon server reload (Thanks to Mark Warren) + - Unreliable LMDB mapsize detection in kjournalprint + - Some minor issues found by AddressSanitizer + +Knot DNS 2.4.3 (2017-04-11) +=========================== + +Improvements: +------------- + - New 'journal-db-mode' optimization configuration option + - The default TSIG algorithm for utilities input is HMAC-SHA256 + - Implemented sensible default EDNS(0) padding policy (Thanks to D. K. Gillmor) + - Added some more semantic checks on the knotc configuration operations + +Bugfixes: +--------- + - Missing 'zone' keyword in the YAML output + - Missing trailing dot in the keymgr DS owner output + - Journal logs 'invalid parameter' in several cases + - Some minor journal-related problems + +Knot DNS 2.4.2 (2017-03-23) +=========================== + +Features: +--------- + - Zscanner can store record comments placed on the same line + - Knotc status extension with version, configure, and workers parameters + +Improvements: +------------- + - Significant incoming XFR speed-up in the case of many zones + +Bugfixes: +--------- + - Double OPT RR insertion when a global module returns KNOT_STATE_FAIL + - User-driven zscanner parsing logic inconsistency + - Lower serial at master doesn't trigger any errors + - Queries with too long DNAME substitution do not return YXDOMAIN response + - Incorrect elapsed time in the DDNS log + - Failed to process forwarded DDNS request with TSIG + +* Mon Feb 27 2017 Petr Spacek - 2.4.1-1 +- new upstream release: + + fix: Transfer of a huge rrset goes into an infinite loop + + fix: Huge response over TCP contains useless TC bit instead of SERVFAIL + + fix: Failed to build utilities with disabled daemon + + fix: Memory leaks during keys removal + + fix: Rough TSIG packet reservation causes early truncation + + fix: Minor out-of-bounds string termination write in rrset dump + + fix: Server crash during stop if failed to open timers DB + + fix: Failed to compile on OS X older than Sierra + + fix: Poor minimum UDP-max-size configuration check + + fix: Failed to receive one-record-per-message IXFR-style AXFR + + fix: Kdig timeouts when receiving RCODE != NOERROR on subsequent transfer message + + improvement: Speed-up of rdata addition into a huge rrset + + improvement: Introduce check of minumum timeout for next refresh + + improvement: Dnsproxy module can forward all queries without local resolving + +* Fri Feb 10 2017 Fedora Release Engineering - 2.4.0-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild + +* Tue Jan 24 2017 Petr Spacek - 2.4.0-1 +- new upstream release: + + fix: False positive semantic-check warning about invalid bitmap in NSEC + + fix: Unnecessary SOA queries upon notify with up to date serial + + fix: Timers for expired zones are reset on reload + + fix: Zone doesn't expire when the server is down + + fix: Failed to handle keys with duplicate keytags + + fix: Per zone module and global module insconsistency + + fix: Obsolete online signing module configuration + + fix: Malformed output from kjournalprint + + fix: Redundant SO_REUSEPORT activation on the TCP socket + + fix: Failed to use higher number of background workers + + improvement: Lower memory consumption with qp-trie + + improvement: Zone events and zone timers improvements + + improvement: Print all zone names in the FQDN format + + improvement: Simplified query module interface + + improvement: Shared TCP connection between SOA query and transfer + + improvement: Response Rate Limiting as a module with statistics support + + improvement: Key filters in keymgr + + features: New unified LMDB-based zone journal + + features: Server statistics support + + features: New statistics module for traffic measuring + + features: Automatic deletion of retired DNSSEC keys + + features: New control logging category + +* Fri Dec 09 2016 Jan Vcelak - 2.3.3-1 +- new upstream release: + + fix: double free when failed to apply zone journal + + fix: zone bootstrap retry interval not preserved upon zone reload + + fix: DNSSEC related records not flushed if not signed + + fix: false semantic checks warning about incorrect type in NSEC bitmap + + fix: memory leak in kzonecheck + + improvement: all zone names are fully-qualified in log + + features: new kjournalprint utility + +* Thu Nov 17 2016 Jan Vcelak - 2.3.2-1 +- new upstream release: + + fix: missing glue in some responses + + fix: knsupdate prompt printing on non-terminal + + fix: configuration policy item names in documentation + + fix: segfault on OS X Sierra + + fix: incorrect %%s expansion for the root zone + + fix: refresh not existing slave zone after restart + + fix: immediate zone refresh upon restart if refresh already scheduled + + fix: early zone transfer after restart if transfer already scheduled + + fix: not ignoring empty non-terminal parents during delegation lookup + + fix: CD bit clearing in responses + + fix: compilation error on GNU/kFreeBSD + + fix: server crash after double zone-commit if journal error + + improvement: significant speed-up of conf-commit and conf-diff operations + + improvement: new EDNS Client Subnet API + + improvement: better semantic-checks error messages + + improvement: speed-up of knotc if control operation and known socket + + improvement: zone purge operation purges also zone timers + + feature: print TLS certificate hierarchy in kdig verbose mode + + feature: new +subnet alias for +client + + feature: new mod-whoami and mod-noudp modules + + feature: new zone-purge control command + + feature: new log-queries and log-responses options for mod-dnstap + + feature: simple modules don't require empty configuration section + + feature: new zone journal path configuration option + + feature: new timeout configuration option for module dnsproxy + +* Mon Aug 29 2016 Jan Vcelak - 2.3.0-3 +- fix post-installation scriptlet (RHBZ #1370939) + +* Thu Aug 11 2016 Jan Vcelak - 2.3.0-2 +- endian independent DNS cookies (fixes build on ppc64 and s390x) + +* Tue Aug 09 2016 Jan Vcelak - 2.3.0-1 +- new upstream release: + + fix: No wildcard expansion below empty non-terminal for NSEC signed zone + + fix: Don't ignore non-existing records to be removed in IXFR + + fix: Fix kdig IXFR response processing if the transfer content is empty + + fix: Avoid multiple loads of the same PKCS #11 module + + improvement: Refactored semantic checks and better error messages + + improvement: Set TC flag in delegation only if mandatory glue doesn't fit the response + + improvement: Separate EDNS(0) payload size configuration for IPv4 and IPv6 + + feature: Zone size limit restriction for DDNS, AXFR, and IXFR (CVE-2016-6171) + + feature: DNS-over-TLS support in kdig (RFC 7858) + + feature: EDNS(0) padding and alignment support in kdig (RFC 7830) + +* Fri Jun 24 2016 Jan Vcelak - 2.2.1-2 +- rebuild for updated userspace-rcu + +* Mon May 30 2016 Jan Vcelak - 2.2.1-1 +- new upstream release: + + fix: Separate logging of server and zone events + + fix: Concurrent zone file flushing with many zones + + fix: Control timeout parsing in knotc + + fix: "Environment maxreaders limit reached" error in knotc + + fix: Don't apply journal changes on modified zone file + + fix: Enable multiple zone names completion in interactive knotc + + fix: Set the TC flag in a response if a glue doesn't fit the response + + fix: Disallow server reload when there is an active configuration transaction + + improvement: Distinguish unavailable zones from zones with zero serial in log messages + + improvement: Log warning and error messages to standard error output in all utilities + + improvement: Document tested PKCS #11 devices + + improvement: Extended Python configuration interface +- update requirements for Fedora 25 + +* Sun May 29 2016 Jan Vcelak - 2.2.0-3 +- update default configuration file + +* Sun May 08 2016 Jan Vcelak - 2.2.0-2 +- fix: systemd service starting + +* Tue Apr 26 2016 Jan Vcelak - 2.2.0-1 +- new upstream release: + + fix: Query/response message type setting in dnstap module + + fix: Remote address retrieval from dnstap capture in kdig + + fix: Global modules execution for queries hitting existing zones + + fix: Execution of semantic checks after an IXFR transfer + + fix: kdig failure when the first AXFR message contains just the SOA record + + fix: Exclude non-authoritative types from NSEC/NSEC3 bitmap at a delegation + + fix: Mark PKCS#11 generated keys as sensitive + + fix: Error when removing the only zone from the server + + fix: Don't abort knotc transaction when some check fails + + feature: URI and CAA resource record types support + + feature: RRL client address based white list + + feature: knotc interactive mode + + improvement: Consistent IXFR error messages + + improvement: Various fixes for better compatibility with PKCS#11 devices + + improvement: Various keymgr user interface improvements + + improvement: Better zone event scheduler performance with many zones + + improvement: New server control interface + + improvement: kdig uses local resolver if resolv.conf is empty + +* Wed Feb 10 2016 Jan Vcelak 2.1.1-1 +- new upstream release: + + fix: Allow import of duplicate private key into the KASP + + fix: Avoid duplicate NSEC for Wildcard No Data answer + + fix: Server crash when an incomming transfer is in progress and reload is issued + + fix: Socket polling when configured with many interfaces and threads + + improvement: Use correct source address for UDP messages recieved on ANY address + + improvement: Extend documentation of knotc commands + +* Thu Feb 04 2016 Fedora Release Engineering - 2.1.0-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild + +* Thu Jan 14 2016 Jan Vcelak 2.1.0-1 +- new upstream release: + + improvement: Remove implementation limit for the number of network interfaces + + improvement: Remove possibly insecure server control over a network socket + + fix: Schedule zone bootstrap after slave zone fails to load from disk + +* Sun Dec 20 2015 Jan Vcelak 2.1.0-0.1.rc1 +- new upstream pre-release: + + feature: Per-thread UDP socket binding using SO_REUSEPORT + + feature: Support for dynamic configuration database + + feature: DNSSEC, Support for cryptographic tokens via PKCS #11 interface + + feature: DNSSEC, Experimental support for online signing + + improvement: Support for zone file name patterns + + improvement: Configurable location of zone timer database + + improvement: Non-blocking network operations and better timeout handling + + improvement: Caching of Critical configuration values for better performance + + improvement: Logging of ACL failures + + improvement: RRL: Add rate-limit-slip zero support to drop all responses + + improvement: RRL: Document behavior for different rate-limit-slip options + + improvement: kdig: Warning instead of error on TSIG validation failure + + improvement: Cleanup of support libraries interfaces (libknot, libzscanner, libdnssec) + + fix: synth-record module: Fix application of default configuration options + + fix: TSIG: Allow compressed TSIG name when forwarding DDNS updates + +* Wed Nov 25 2015 Jan Vcelak 2.0.2-1 +- new upstream release: + + security fix: out-of-bound read in packet parser for malformed NAPTR record + +* Thu Sep 03 2015 Jan Vcelak 2.0.1-1 +- new upstream release: + + fix: do not reload expired zones on 'knotc reload' and server startup + + fix: rare race-condition in event scheduling causing delayed event execution + + fix: skipping of non-authoritative nodes in NSEC proofs + + fix: TC flag setting in RRL slipped answers + + fix: disable domain name compression for root label + + fix: fix CNAME following when quering for NSEC RR type + + fix: fix refreshing of DNSSEC signatures for zone keys + + fix: fix binding an unavailable IPv6 address (IP_FREEBIND) + + fix: fix infinite loop in knotc zonestatus and memstats + + fix: fix memory leak in configuration on server shutdown + + fix: fix broken dnsproxy module + + fix: fix multi value parsing on big-endian + + fix: adapt to Nettle 3 API break causing base64 decoding failures on big-endian + + feature: add 'keymgr zone key ds' to show key's DS record + + feature: add 'keymgr tsig generate' to generate TSIG keys + + feature: add query module scoping to process either all queries or zone queries only + + feature: add support for file name globbing in config file includes + + feature: add 'request-edns-option' config option to add custom EDNS0 option into server initiated queries + + improvement: send minimal responses (remove NS from Authority section for NOERROR) + + improvement: update persistent timers only on shutdown for better performance + + improvement: allow change of RR TTL over DDNS + + improvement: documentation fixes, updates, and improvements in formatting + + improvement: install yparser and zscanner header files + +* Mon Jul 20 2015 Jan Vcelak 2.0.0-1 +- new upstream release: + + feature: possibility to disable zone file synchronization + + feature: knsupdate, add input prompt in interactive mode + + feature: knsupdate, TSIG algorithm specification in interactive mode + +* Thu Jun 18 2015 Jan Vcelak 2.0.0-0.1.rc1 +- new upstream pre-release: + + fix: lost NOTIFY message if received during zone transfer + + fix: kdig, record correct dnstap SocketProtocol when retrying over TCP + + fix: kdig, hide TSIG section with +noall + + fix: do not set AA flag for AXFR/IXFR queries + + feature: new configuration format in YAML, binary store im LMDB + + feature: DNSSEC, separate library, switch to GnuTLS, new utilities + + feature: DNSSEC, basic KASP support (generate initial keys, ZSK rollover) + + feature: zone parser, split long TXT/SPF strings into multiple strings + + feature: kdig, add generic dump style option (+generic) + + feature: try all master servers on failure in multi-master environment + + feature: improved remotes and ACLs (multiple addresses, multiple keys) + + feature: basic support for zone file patterns (%%s to substitute zone name) + + improvement: do not write class for SOA record (unified with other RR types) + + improvement: do not write master server address into the zone file + + documentation: manual pages also in HTML and PDF format + +* Wed Jun 17 2015 Fedora Release Engineering - 1.99.1-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild + +* Mon May 04 2015 Kalev Lember - 1.99.1-3 +- Rebuilt for nettle soname bump + +* Fri Feb 13 2015 Jan Vcelak 1.99.1-2 +- fix BuildRequires for systemd integration + +* Fri Feb 13 2015 Jan Vcelak 1.99.1-1 +- new upstream pre-release version: + + DNSSEC: switch from OpenSSL to GnuTLS + + DNSSEC: initial support for KASP +- split package into subpackages +- add documentation building +- restart daemon on updated diff --git a/sources b/sources index e69de29..b941cb1 100644 --- a/sources +++ b/sources @@ -0,0 +1,2 @@ +SHA512 (knot-3.5.2.tar.xz) = 4dd8e42088f792459859da807427024ded926c2a8fb5b9fd4596b631a184269e3d84f0cd4be9192f2546977c598c418f8d44cabccbc393f9f7cf2f0dd5adc595 +SHA512 (knot-3.5.2.tar.xz.asc) = 5f6ee7fedc0d5b904572d2f6d47858065cdc4efa7217b4e9dcbb38ae63a1533646ba2b042bb0c1fe533a3caf6ba41c81010616393d2a0adcea77712608931b38 diff --git a/tests/README.md b/tests/README.md new file mode 100644 index 0000000..e1d6352 --- /dev/null +++ b/tests/README.md @@ -0,0 +1,14 @@ +Package tests +============= + +These tests implement the standard test interface in Fedora CI. +See https://docs.fedoraproject.org/en-US/ci/tests/ for details. + +Manual execution +---------------- + +Run the following command on your machine. Please note, it will make +modifications to your system. It's best to run these on a clean, throw-away +testing system or a VM. + +ansible-playbook tests/tests.yml -e subjects=/path/to/knot.rpm,/path/to/knot-libs.rpm -e artifacts=/path/to/artifacts diff --git a/tests/scripts/test_basic_zone.sh b/tests/scripts/test_basic_zone.sh new file mode 100755 index 0000000..9c08f0e --- /dev/null +++ b/tests/scripts/test_basic_zone.sh @@ -0,0 +1,18 @@ +#!/bin/bash +# test basic system-wide functionality of Knot DNS +set -ex + +# create zone file from examples +cp /usr/share/doc/knot/samples/example.com.zone /var/lib/knot/example.com.zone +# configure knot to serve example.com zone using dark sed magic +sed 's/^#\?\([ \t]*-[ \t]*domain:[ \t]\+example.com\)[ \t]*$/\1/' -i /etc/knot/knot.conf + +# (re)start knotd +systemctl stop knot.service +systemctl start knot.service || systemctl status knot.service + +# check valid query is answered +dig @127.0.0.1 example.com | grep NOERROR + +# check query for non-existent zone is refused +dig @127.0.0.1 bad-example.com | grep REFUSED diff --git a/tests/tests.yml b/tests/tests.yml new file mode 100644 index 0000000..8cf0411 --- /dev/null +++ b/tests/tests.yml @@ -0,0 +1,15 @@ +--- +- hosts: localhost + remote_user: root + roles: + - role: standard-test-basic + tags: + - classic + required_packages: + - bind-utils + tests: + - knotd-show-version: + run: knotd --version + - basic-zone: + dir: scripts + run: ./test_basic_zone.sh