Release 3.2.13-1

Keep EPEL 7 at Knot 3.2.x

01-test_net-disable-udp-send-on-unconnected.patch

@@ -0,0 +1,26 @@
+Author: Tomas Krizek <tomas.krizek@nic.cz>
+Date:   2019-02-28 14:26:56 +0100
+
+    test_net: disable UDP send on unconnected
+    
+    This test started to fail with 5.0 kernel in F30+ on aarch64 and s390x.
+    The functionality isn't used by Knot DNS, so disabling this test until
+    the issue is resolved should be safe.
+    
+    Fixes https://bugzilla.redhat.com/show_bug.cgi?id=1675235
+
+diff --git a/tests/contrib/test_net.c b/tests/contrib/test_net.c
+index 0a22abbbc..6ec4bda31 100644
+--- a/tests/contrib/test_net.c
++++ b/tests/contrib/test_net.c
+@@ -310,10 +310,6 @@ static void test_unconnected(void)
+ 	r = net_dgram_recv(sock, buffer, buffer_len, TIMEOUT_SHORT);
+ 	is_int(KNOT_ETIMEOUT, r, "UDP, receive timeout on unconnected socket");
+ 
+-	struct sockaddr_storage server_addr = addr_from_socket(server);
+-	r = net_dgram_send(sock, buffer, buffer_len, &server_addr);
+-	is_int(buffer_len, r, "UDP, send on defined address");
+-
+ 	close(sock);
+ 
+ 	// TCP

02-revert-AC_PROG_CC.patch

@@ -0,0 +1,18 @@
+From: Daniel Salzman <daniel.salzman@nic.cz>
+Date: Sun, 20 Feb 2022 20:38:35 +0100
+Subject: [PATCH] Revert "configure: upgrade from AC_PROG_CC_C99 to AC_PROG_CC"
+
+diff --git a/configure.ac b/configure.ac
+index 6506197ed..c7df7f815 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -38,7 +38,8 @@ release_date=$($SED -n 's/^Knot DNS .* (\(.*\))/\1/p;q;' ${srcdir}/NEWS)
+ AC_SUBST([RELEASE_DATE], $release_date)
+ 
+ # Set compiler compatibility flags
+-AC_PROG_CC
++AC_PROG_CC_C99 # AC_PROG_CC not supported by CentOS 7
++AM_PROG_CC_C_O # Needed by CentOS 7
+ AC_PROG_CPP_WERROR
+ 
+ # Set default CFLAGS

gpgkey-742FA4E95829B6C5EAC6B85710BB7AF6FEBBD6AB.gpg.asc

@@ -23,29 +23,67 @@ cggAEKX5EkOmZM8oduRxsHqiRLC/xKF8GqTo6t3GMS5i8RClNvmdq0WUkQUvld4b
 OnXBCZ2QLbjV7sXjcr56ee+qdpiuRQjEidjHzpibcIBN8LVupVgXAZl9lsiBtoJX
 OHsvSdU3VgGWnRGtzFjSHzl3TRPIsaVVqD7aCzQDfXDjrGlmhzgDfMwkqmBGgsku
 8tSR3Ag0MRAouJFXiZrcM3XGeYVbHT6dt7UMAB27Xc5foc0kGRo5tzlK6rWG2sJI
-lcQB7tKvwI/tE9lwJDjw+XNekEdIpcdcQ7mWa1COYkcYTre3oPmN+7kCDQRZY5QX
-ARAA6RnxYG82/X+A49srgHR9yIxlHqSq6IhNn+iJQ5lpVpfeBItOG4NDu4Aq5X41
-pAJ3NKxsCPV62gEald/C7gJrTI5rag/87GYFFo6QRrwGsWVGORGs9G1pBF7ZZwhP
-JwD3MeagGZNfWZzRxXefL1P3mrpO3etSEEwENHtCqEMP6x/JHh3SKonKAlL4xfj3
-F54aKj4upIcjxGBAJH8u66bN1GmYjstBzzbD4TWNTwfKgp15XxjrTgbThFy7CBoO
-gcaApiYTPE7D5nB1+AyhGjnO3ZlNgy1ZIHVDFk6HEakaqKM9QlkJnZsB2+cTqXlV
-0etmFQsedCg2sUier0hhIrEOOtGQbY1P+0vv+VRoaNym3ritl+70RG8WgrHNLMRH
-VGeLRq3gOFnt+d/3h7meAKbORW/ZY30UpwthtlZYgciFzoDJCW8Be1i1X4toiUaM
-kFh79jd7YTvZ87+P4DllC9MNsoq5cY/bHBNZYtXf7y6XqVqYo2IbFUR3VXKtzSN5
-eYm5YpFPczzmg1bNgl3i6WBcOF4EPEJEVjZ+u1r59NvfVLQ8XVh/QmLoG7x8oFcv
-hWctMy17Vdm4qZjpSA+B1sQocehdra+xT+PWV0kcrYpsqwkYeFRQnJGqIupWHnot
-qGOBNAyQWIcjK6K5y0CeioJZpNN5Oe5XloMXsYmgXsR+gTUAEQEAAYkCJQQYAQoA
-DwUCWWOUFwIbDAUJA8JnAAAKCRAQu3r2/rvWq+IQD/9ikZ5MtdDOVLtULPqXXeP3
-6Oss2Ie4/4IQ7xkUZZ/Ujig0x1rW+d21o92VryH1s4K+nyCIW31rbtexK/0a54/w
-Zyyjbqfh6Tgo9n3f5bMV9qyubb49cfTSKfgzoOkG8Xdc/TIO1IjWHy1NBDl8GWKJ
-0QPYz78SCCkEFiVCAFBjuIQsoPqDKcZTs7k661w0A75ken88JJLgUgffZJRQK0i1
-dCw8kS4c2pqm24Q6d0AF5EdqXn2IFH82p49Pp5bRMY3LnibRL3Sq0xvXs7i5vY+o
-JLuPAdomiGbdEbxcLytqQ2KitVdrGvrnZJxPs16m0uuTeM06krorDlgGBXFp5+Z9
-JbQpViHkVpLo+vf/GuT9WOWWH8gG0r14ZLVQTvCGXiAR4Aju7W5jPMPmVDJ+wMrD
-cLta1Jv0U0+AnVe67mRXb0n5E/7kVshB3rfGzunPSlqT5kEiOXq6fJWB2l0lzCv0
-WtNuINmU9U3ap1oZBGSYl83vyuRUIlx61/tlnJvwseBL1FmASXOgfedCsxjHIlgF
-SUeScLxnOSyap/4ePqZ0C76Nkvzx43SfM1LJUeCHwon0o+LZv2GlBmlEp6PbekRQ
-Tz1hewLBbfAeXZRnwxvmkRqTP4DJCIVu2AE47+rbqVEjJZuEO4ORlkKoBdLOV3HN
-xWbfbG7+n/h2cnUw3pqbHw==
-=4CxJ
+lcQB7tKvwI/tE9lwJDjw+XNekEdIpcdcQ7mWa1COYkcYTre3oPmN+4kCVAQTAQoA
+PgIbAwULCQgHAwUVCgkICwUWAgMBAAIeAQIXgBYhBHQvpOlYKbbF6sa4VxC7evb+
+u9arBQJcZrrTBQkGxY28AAoJEBC7evb+u9arU78QAJOVSul2YTXediwcY1YtpAli
+KtHcjOS5PzaezB4c+E89xw6x/XO76KLI6+7GFrcGallPPCHXQfseQh5FmlZ2VMMT
+5+f/eTY/s9kwhexAarW8AE8GeKZ/ejt6AqCokjbD/75Sfkx+F6/1Vg20kOoma8Uy
+QyIozmUOue0z0VYR3uHJw6BIncGtkuxt5IHzXw5AsAtdNqneuRg5Ibx1gmJqW/Xa
+M3cPo2WwF5Arh6JjGZTkUaiBcc4miUS08nqT6hvmxFY9X9KvWMl/NeMiom09HcV+
+JJnrjf1hoW4uy4DxEo6Mt34iZddsjCw3x1Qmgs70BonKpBjCY6fE6KU66c6ykOdt
+vx0QrqUnODoHOEyN54TREw+PZDftkfgchwg1nN1SQeWvQ9JGRNKOuQhEGrRq1Wxa
+HUH2N6rQP283fnFSrABHTk1laqKwXDMI7IdGChc/QtiHso5gjCi2OdVpuQfp19e6
+8U7+ZWSq71HhFWsR9Y1QlXfV6ADEXtemV/iXA5No1TUTvUmvo7T2k7LBlrSWd+gJ
+MyxMn/aUroVm2InU3jPwRUPySUJcX1EZrbWgi/scbKcryJQoH5BEEdOr72V9vNt7
+o6dlMgnYoSkv3JVpJW4T6+PY8HanVFuFNWqOg5fg7xM5CCL7gqVSuWExK1X0rfqu
+aeq5Pvm92kMrx+XkzqqFiQJUBBMBCgA+AhsDBQsJCAcDBRUKCQgLBRYCAwEAAh4B
+AheAFiEEdC+k6VgptsXqxrhXELt69v671qsFAl+r3lMFCQoKsTwACgkQELt69v67
+1qv/gw/+ILW7CAtgxuOI1h61sUq0YrjQRnnYlya3wk4tTlSqhBa+5fSjasHv5wZ8
+TduWt99yWCmGpDs0Vxffb/jTKKwI40FgTtnzFKPTFtEymLgC1sTTbol3dcrzpX4J
+vXMlVDdSjdkChdsdx6mFQWA1ZvdvUtIvBeVrP76mfDQi2fsVMWRoAk98BSQT5Som
+vcluc9mMNuVcjiRUdmSqM1TVZarambkhNWelWWYJN1paljugL//TEZKcsFQWJpbf
+ECdEnyqXPi9/Fi53/WhS9xi7AdYO8rx8lCurb0JpQwltHXXZcm5mSr99w+7XoUvu
+efkSkW2Y5XFXp35dP7x8QeZ8zhSeHL5d187G0q5YKtK2D2M+sEyEDF9WCHya8x8t
+b+mMv3LVkHf4mj2LQNGWUtOId08a+AgdOd45wKqG+Z92LXs7l9NMoDLdJGwfu48R
+L2LrHfyDHzowUChr0762mdcCiJrBH7Lwmt5j4wRhrPKaPj1XcXQIi6srGcJRbhFa
+76E54kPANDa42VzJwS9/4K+bA7uDYWCmMlXF6Uh/EiSoE3CLS6IMgs9BaOHCx4Rq
+1+7/U0LQDwseMT8UV+AK0YiYeXpfnGX96nS9yPZtlyE5+96h5c6Vts6QEZo8hcR1
+EXlVsf2NJleZxYELfvcLYPvIeS3qe5WNlCOSUvDAMh7fRwMkWL2JAlQEEwEKAD4C
+GwMFCwkIBwMFFQoJCAsFFgIDAQACHgECF4AWIQR0L6TpWCm2xerGuFcQu3r2/rvW
+qwUCYadEKgUJEZClEwAKCRAQu3r2/rvWq3QvD/9zDhZM18VNgeNAvWByx/lVOaJr
+pxvciARgWEbgYYbYHxwH2JGMZjr0XFz5JzXkf+N7Yx92D5V7GwX90eGg+fTAyMNM
+4TAfk1shzC9T/qej4cTUVwiunmikV1vXfv7mnjJHuOoeqrY1at5z4gWirXyyMKhN
+pg/ebgpcQ7f+DxsLgNJFihU+w1eIFMKnGalrSBh62NIIJWsk+hdVaPse9XMhjigo
+gQ3s7/Sy7hADV+tnwPv/s6xj1jBV+BQNdJZwYsMOXEEFBvNTbq57rzm2CyT3RKfG
+9hp5SdDDQHmyxz96hHrZYl1v2h6qH8ors8EgA75Iy2qsEefJSSEbnSBoAypAof2Q
+9lAgUw1SwZuQv/mLoubCVqi09HuVObyyKLFxzgyFRMvYwvJpDKmLhvAnqi4iXhqJ
+QTRM5aJc1odsnCaGUO4Rpve5jT9jEGs4CE2zeAu5vGO1nSeVdcisPJ+o8ji3hFUt
+W/tINkfTygwvLWlR+KO8YM8eTOXeI8m0dt4nPb6Ne1s1i/ipu4heS7XDyjvPB1/m
+5kpmWIgnC6wQyD1a7beDh64sIybXvJzpmX0Xp1JiPdqC7gH5YFq0eznZ5JU+j6wB
+Dtl+55I6D+IgUY2BV4rGXjXSxhn89gRKD8nxVUGhWY1lsGw0UtqGKiH6+GkP2pL2
+k7Mz34W4LAKvwEtvnLkCDQRZY5QXARAA6RnxYG82/X+A49srgHR9yIxlHqSq6IhN
+n+iJQ5lpVpfeBItOG4NDu4Aq5X41pAJ3NKxsCPV62gEald/C7gJrTI5rag/87GYF
+Fo6QRrwGsWVGORGs9G1pBF7ZZwhPJwD3MeagGZNfWZzRxXefL1P3mrpO3etSEEwE
+NHtCqEMP6x/JHh3SKonKAlL4xfj3F54aKj4upIcjxGBAJH8u66bN1GmYjstBzzbD
+4TWNTwfKgp15XxjrTgbThFy7CBoOgcaApiYTPE7D5nB1+AyhGjnO3ZlNgy1ZIHVD
+Fk6HEakaqKM9QlkJnZsB2+cTqXlV0etmFQsedCg2sUier0hhIrEOOtGQbY1P+0vv
++VRoaNym3ritl+70RG8WgrHNLMRHVGeLRq3gOFnt+d/3h7meAKbORW/ZY30Upwth
+tlZYgciFzoDJCW8Be1i1X4toiUaMkFh79jd7YTvZ87+P4DllC9MNsoq5cY/bHBNZ
+YtXf7y6XqVqYo2IbFUR3VXKtzSN5eYm5YpFPczzmg1bNgl3i6WBcOF4EPEJEVjZ+
+u1r59NvfVLQ8XVh/QmLoG7x8oFcvhWctMy17Vdm4qZjpSA+B1sQocehdra+xT+PW
+V0kcrYpsqwkYeFRQnJGqIupWHnotqGOBNAyQWIcjK6K5y0CeioJZpNN5Oe5XloMX
+sYmgXsR+gTUAEQEAAYkCPAQYAQoAJgIbDBYhBHQvpOlYKbbF6sa4VxC7evb+u9ar
+BQJhp0RdBQkRkKVGAAoJEBC7evb+u9araZ8QAIzWIN8OhaTyyeG451OGeu7+5xnY
+muP7jTGlFuP4Q64Vt5WAc54dhILCy2pRImMl/0Mfjq3WOOdqSQViaoJpHFkgjy8z
+9MFX/hZqLC57oDmNnI8X/bG/ApGMQD7UoeAH4recf7jmtqRyLUeDd2wOEsSRICty
+czH/m43Uct4kShXP2ui1vqAP8p9UtfdImgyNWV91J35SjxSiFvp+YAuNn+jsnDiV
+BzYJAlk/rdN1h6E+cDfp/GYaXDjVxLy8bipuEN5icZGMH20tkiVsvPQ5J++AOSre
+I830E62IJBKU9kwQa9iSbWxtcnxJmOEVBGN2gJ+2WAd2uA9ZCCJafTXiVe57Icxd
+2P5zRqrDn0bAmIyl04NKnVAnthQG+b6hEuuaKhTkj2TvhmXkH84BcAvKC82yNBc1
+zrzxfLI/WPZJrh2IVhXWVhW13Yd6eUmqUk8p0hQ5ZhdL9D6fQJSXxkdiauMJov1C
+njR/++NOtERBSk+7hbTb921q/brMZXgJ971u31b0sRoefybbbjHSWjNVSP6ENn44
+eQfS06CUmc7oN18bGhHmlmhK4az9i5eQ4HlUE5K9f4z7yQRTM6XfIpzDrWOfFfaY
+vYkcC6CbR8xnb+LOlqwKHzKVwoWGLSreeShqPfazQEjR3V52XdFmyVIrltj7JRxi
+tW29kqO09AEalR9l
+=t42C
 -----END PGP PUBLIC KEY BLOCK-----

knot.conf

@@ -1,23 +0,0 @@
-# See knot.conf(5) manual page for documentation.
-
-server:
-    rundir: "/var/run/knot"
-    user: knot:knot
-    listen: [ 127.0.0.1@53, ::1@53 ]
-
-control:
-    listen: "knot.sock"
-
-log:
-  - target: syslog
-    any: info
-
-template:
-  - id: default
-    storage: "/var/lib/knot"
-    file: "%s.zone"
-    kasp-db: "keys"
-    dnssec-signing: false
-
-zone:
-#  - domain: example.com

knot.service

@@ -1,15 +0,0 @@
-[Unit]
-Description=Knot DNS server daemon
-
-[Service]
-Type=notify
-ExecStart=/usr/sbin/knotd
-ExecReload=/usr/sbin/knotc reload
-Restart=on-abort
-ExecStartPre=/usr/sbin/knotc conf-check
-
-# Breaks daemon reload
-#CapabilityBoundingSet=cap_net_bind_service cap_setuid cap_setgid
-
-[Install]
-WantedBy=multi-user.target

knot.spec

@@ -2,20 +2,19 @@
 %{!?_pkgdocdir: %global _pkgdocdir %{_docdir}/%{name}}
 
 %define GPG_CHECK 1
-%define VERSION 2.7.1
+%define BASE_VERSION %(echo "%{version}" | sed 's/^\\([^.]\\+\\.[^.]\\+\\).*/\\1/')
 %define repodir %{_builddir}/%{name}-%{version}
 
 Summary:	High-performance authoritative DNS server
 Name:		knot
-Version: 	%{VERSION}
-Release: 	1%{?dist}
-License:	GPLv3
-Group:		System Environment/Daemons
-URL:		http://www.knot-dns.cz
-Source0:	http://public.nic.cz/files/knot-dns/%{name}-%{version}.tar.xz
+Version:	3.2.13
+Release:	1%{?dist}
+License:	GPL-3.0-or-later
+URL:		https://www.knot-dns.cz
+Source0:	https://secure.nic.cz/files/knot-dns/%{name}-%{version}.tar.xz
 
-%if 0%{GPG_CHECK}
-Source1:	http://public.nic.cz/files/knot-dns/%{name}-%{version}.tar.xz.asc
+%if 0%{?GPG_CHECK}
+Source1:	https://secure.nic.cz/files/knot-dns/%{name}-%{version}.tar.xz.asc
 # PGP keys used to sign upstream releases
 # Export with --armor using command from https://fedoraproject.org/wiki/PackagingDrafts:GPGSignatures
 # Don't forget to update %%prep section when adding/removing keys
@@ -23,44 +22,61 @@ Source100:	gpgkey-742FA4E95829B6C5EAC6B85710BB7AF6FEBBD6AB.gpg.asc
 BuildRequires:	gnupg2
 %endif
 
+# Test fails on F30+ aarch/s390x for unknown reason, but it is not neccassary for Knot DNS
+Patch1:		01-test_net-disable-udp-send-on-unconnected.patch
+# Revert config improvement to support EL 7
+Patch2:		02-revert-AC_PROG_CC.patch
+
 # Required dependencies
+BuildRequires:	autoconf
+BuildRequires:	automake
+BuildRequires:	libtool
+BuildRequires:	make
+%if 0%{?rhel} == 7
+BuildRequires:	devtoolset-12-gcc
+%else
 BuildRequires:	gcc
+%endif
 BuildRequires:	pkgconfig(liburcu)
 BuildRequires:	pkgconfig(gnutls) >= 3.3
 BuildRequires:	pkgconfig(libedit)
 
 # Optional dependencies
 BuildRequires:	pkgconfig(libcap-ng)
-BuildRequires:	pkgconfig(libfstrm)
 BuildRequires:	pkgconfig(libidn2)
-BuildRequires:	pkgconfig(libmaxminddb)
-BuildRequires:	pkgconfig(libprotobuf-c)
+BuildRequires:	pkgconfig(libmnl)
+BuildRequires:	pkgconfig(libnghttp2)
 BuildRequires:	pkgconfig(libsystemd)
 BuildRequires:	pkgconfig(systemd)
+# dnstap dependencies
+BuildRequires:	pkgconfig(libfstrm)
+BuildRequires:	pkgconfig(libprotobuf-c)
+# geoip dependencies
+BuildRequires:	pkgconfig(libmaxminddb)
 
 # Distro-dependent dependencies
 %if 0%{?suse_version}
 BuildRequires:	python3-Sphinx
 BuildRequires:	lmdb-devel
 BuildRequires:	protobuf-c
-Requires(pre):  pwdutils
+Requires(pre):	pwdutils
 %endif
-%if 0%{?rhel}
+%if 0%{?rhel} && 0%{?rhel} <= 7
 BuildRequires:	python-sphinx
 BuildRequires:	lmdb-devel
 %endif
-%if 0%{?fedora}
+%if 0%{?fedora} || 0%{?rhel} > 7
 BuildRequires:	python3-sphinx
 BuildRequires:	pkgconfig(lmdb)
 %endif
 
+# disable XDP on old EL
+%define configure_xdp --enable-xdp=no
+
 Requires(post):		systemd %{_sbindir}/runuser
 Requires(preun):	systemd
 Requires(postun):	systemd
 
-# Knot DNS 2.7+ isn't compatible with earlier knot-resolver
-Conflicts:	knot-resolver < 3.0.0
-
 Requires:	%{name}-libs%{?_isa} = %{version}-%{release}
 
 %description
@@ -84,30 +100,56 @@ included in knot-libs package.
 %package utils
 Summary:	DNS client utilities shipped with the Knot DNS server
 Requires:	%{name}-libs%{?_isa} = %{version}-%{release}
+# Debian package compat
+Provides:	%{name}-dnsutils = %{version}-%{release}
 
 %description utils
 The package contains DNS client utilities shipped with the Knot DNS server.
 
+%package dnssecutils
+Summary:	DNSSEC tools shipped with the Knot DNS server
+Requires:	%{name}-libs%{?_isa} = %{version}-%{release}
+
+%description dnssecutils
+The package contains DNSSEC tools shipped with the Knot DNS server.
+
+%package module-dnstap
+Summary:	dnstap module for Knot DNS
+Requires:	%{name} = %{version}-%{release}
+
+%description module-dnstap
+The package contains dnstap Knot DNS module for logging DNS traffic.
+
+%package module-geoip
+Summary:	geoip module for Knot DNS
+Requires:	%{name} = %{version}-%{release}
+
+%description module-geoip
+The package contains geoip Knot DNS module for geography-based responses.
+
 %package doc
 Summary:	Documentation for the Knot DNS server
-License:	GPLv3 and BSD and MIT
 BuildArch:	noarch
-Provides:	bundled(jquery) = 3.1.0
+Provides:	bundled(jquery)
 
 %description doc
 The package contains documentation for the Knot DNS server.
 On-line version is available on https://www.knot-dns.cz/documentation/
 
 %prep
-%if 0%{GPG_CHECK}
+%if 0%{?GPG_CHECK}
 export GNUPGHOME=./gpg-keyring
-mkdir ${GNUPGHOME}
+[ -d ${GNUPGHOME} ] && rm -r ${GNUPGHOME}
+mkdir --mode=700 ${GNUPGHOME}
 gpg2 --import %{SOURCE100}
 gpg2 --verify %{SOURCE1} %{SOURCE0}
 %endif
-%setup -q
+%autosetup -p1
 
 %build
+%if 0%{?rhel} == 7
+. /opt/rh/devtoolset-12/enable
+%endif
 # disable debug code (causes unused warnings)
 CFLAGS="%{optflags} -DNDEBUG -Wno-unused"
 
@@ -117,16 +159,21 @@ CFLAGS="%{optflags} -DNDEBUG -Wno-unused"
 %define configure_db_sizes --with-conf-mapsize=64
 %endif
 
+autoreconf -if
+
 %configure \
   --sysconfdir=/etc \
   --localstatedir=/var/lib \
   --libexecdir=/usr/lib/knot \
   --with-rundir=/run/knot \
+  --with-moduledir=%{_libdir}/knot/modules-%{BASE_VERSION} \
   --with-storage=/var/lib/knot \
   %{?configure_db_sizes} \
+  %{?configure_xdp} \
   --disable-static \
   --enable-dnstap=yes \
-  --with-module-dnstap=yes
+  --with-module-dnstap=shared \
+  --with-module-geoip=shared
 make %{?_smp_mflags}
 make html
 
@@ -136,34 +183,42 @@ make install DESTDIR=%{buildroot}
 # install documentation
 install -d -m 0755 %{buildroot}%{_pkgdocdir}/samples
 install -p -m 0644 -t %{buildroot}%{_pkgdocdir}/samples samples/*.zone*
-install -p -m 0644 NEWS README %{buildroot}%{_pkgdocdir}
+install -p -m 0644 NEWS README.md %{buildroot}%{_pkgdocdir}
 cp -av doc/_build/html %{buildroot}%{_pkgdocdir}
 [ -r %{buildroot}%{_pkgdocdir}/html/index.html ] || exit 1
 rm -f %{buildroot}%{_pkgdocdir}/html/.buildinfo
 
-# install configuration file
+# install daemon and dbus configuration files
 rm %{buildroot}%{_sysconfdir}/%{name}/*
 install -p -m 0644 -D %{repodir}/samples/%{name}.sample.conf %{buildroot}%{_sysconfdir}/%{name}/%{name}.conf
+%if 0%{?fedora} || 0%{?rhel} > 7
+install -p -m 0644 -D %{repodir}/distro/common/cz.nic.knotd.conf %{buildroot}%{_sysconfdir}/dbus-1/system.d/cz.nic.knotd.conf
+%endif
 
 # install systemd files
-install -p -m 0644 -D %{repodir}/distro/common/%{name}.service %{buildroot}%{_unitdir}/%{name}.service
-install -p -m 0644 -D %{repodir}/distro/common/%{name}.tmpfiles %{buildroot}%{_tmpfilesdir}/%{name}.conf
+install -p -m 0644 -D %{repodir}/distro/pkg/el-7/%{name}.service %{buildroot}%{_unitdir}/%{name}.service
+install -p -m 0644 -D %{repodir}/distro/pkg/el-7/%{name}.tmpfiles %{buildroot}%{_tmpfilesdir}/%{name}.conf
+%if 0%{?suse_version}
+ln -s service %{buildroot}/%{_sbindir}/rcknot
+%endif
 
-# create storage dir and key dir
+# create storage dir
 install -d %{buildroot}%{_sharedstatedir}
-install -d -m 0775 -D %{buildroot}%{_sharedstatedir}/%{name}
-install -d -m 0770 -D %{buildroot}%{_sharedstatedir}/%{name}/keys
+install -d -m 0770 -D %{buildroot}%{_sharedstatedir}/knot
 
 # remove libarchive files
 find %{buildroot} -type f -name "*.la" -delete -print
 
 %check
-make check
+%if 0%{?rhel} == 7
+. /opt/rh/devtoolset-12/enable
+%endif
+V=1 make check
 
 %pre
 getent group knot >/dev/null || groupadd -r knot
 getent passwd knot >/dev/null || \
-  useradd -r -g knot -d %{_sysconfdir}/knot -s /sbin/nologin \
+  useradd -r -g knot -d %{_sharedstatedir}/knot -s /sbin/nologin \
   -c "Knot DNS server" knot
 %if 0%{?suse_version}
 %service_add_pre knot.service
@@ -191,47 +246,73 @@ systemd-tmpfiles --create %{_tmpfilesdir}/knot.conf &>/dev/null || :
 %systemd_postun_with_restart knot.service
 %endif
 
+%if 0%{?fedora} || 0%{?rhel} > 7
+# https://fedoraproject.org/wiki/Changes/Removing_ldconfig_scriptlets
+%else
 %post libs -p /sbin/ldconfig
-
 %postun libs -p /sbin/ldconfig
+%endif
 
 %files
 %license COPYING
-%{_pkgdocdir}/NEWS
-%{_pkgdocdir}/README
-%{_pkgdocdir}/samples
-%dir %attr(750,root,knot) %{_sysconfdir}/%{name}
-%config(noreplace) %attr(640,root,knot) %{_sysconfdir}/%{name}/%{name}.conf
-%dir %attr(775,root,knot) %{_sharedstatedir}/%{name}
-%dir %attr(770,root,knot) %{_sharedstatedir}/%{name}/keys
+%doc %{_pkgdocdir}
+%exclude %{_pkgdocdir}/html
+%attr(770,root,knot) %dir %{_sysconfdir}/knot
+%config(noreplace) %attr(640,root,knot) %{_sysconfdir}/knot/knot.conf
+%if 0%{?fedora} || 0%{?rhel} > 7
+%config(noreplace) %attr(644,root,root) %{_sysconfdir}/dbus-1/system.d/cz.nic.knotd.conf
+%endif
+%attr(770,root,knot) %dir %{_sharedstatedir}/knot
+%dir %{_libdir}/knot
+%dir %{_libdir}/knot/modules-*
 %{_unitdir}/knot.service
-%{_tmpfilesdir}/%{name}.conf
-%{_bindir}/kzonecheck
+%{_tmpfilesdir}/knot.conf
+%{_sbindir}/kcatalogprint
 %{_sbindir}/kjournalprint
 %{_sbindir}/keymgr
 %{_sbindir}/knotc
 %{_sbindir}/knotd
-%{_mandir}/man1/kzonecheck.*
+%if 0%{?suse_version}
+%{_sbindir}/rcknot
+%endif
 %{_mandir}/man5/knot.conf.*
+%{_mandir}/man8/kcatalogprint.*
 %{_mandir}/man8/kjournalprint.*
 %{_mandir}/man8/keymgr.*
 %{_mandir}/man8/knotc.*
 %{_mandir}/man8/knotd.*
+%ghost %attr(770,root,knot) %dir %{_rundir}/knot
 
 %files utils
 %{_bindir}/kdig
 %{_bindir}/khost
-%{_bindir}/knsec3hash
 %{_bindir}/knsupdate
+%if 0%{?use_xdp}
+%{_sbindir}/kxdpgun
+%{_mandir}/man8/kxdpgun.*
+%endif
 %{_mandir}/man1/kdig.*
 %{_mandir}/man1/khost.*
-%{_mandir}/man1/knsec3hash.*
 %{_mandir}/man1/knsupdate.*
 
+%files dnssecutils
+%{_bindir}/knsec3hash
+%{_bindir}/kzonecheck
+%{_bindir}/kzonesign
+%{_mandir}/man1/knsec3hash.*
+%{_mandir}/man1/kzonecheck.*
+%{_mandir}/man1/kzonesign.*
+
+%files module-dnstap
+%{_libdir}/knot/modules-*/dnstap.so
+
+%files module-geoip
+%{_libdir}/knot/modules-*/geoip.so
+
 %files libs
 %license COPYING
 %doc NEWS
-%doc README
+%doc README.md
 %{_libdir}/libdnssec.so.*
 %{_libdir}/libknot.so.*
 %{_libdir}/libzscanner.so.*
@@ -251,73 +332,178 @@ systemd-tmpfiles --create %{_tmpfilesdir}/knot.conf &>/dev/null || :
 
 %files doc
 %dir %{_pkgdocdir}
-%{_pkgdocdir}/html
+%doc %{_pkgdocdir}/html
 
 %changelog
-* Wed Aug 15 2018 Tomas Krizek <tomas.krizek@nic.cz> - 2.7.1-1
-Knot DNS 2.7.1 (2018-08-14)
+* Tue Jun 25 2024 Jakub Ružička <jakub.ruzicka@nic.cz> - 3.2.13-1
+- Update to 3.2.13
+
+* Wed Jan 24 2024 Jakub Ružička <jakub.ruzicka@nic.cz> - 3.2.12-1
+- Update to 3.2.12
+
+* Mon Oct 30 2023 Jakub Ružička <jakub.ruzicka@nic.cz> - 3.2.11-1
+- Update to 3.2.11
+
+* Tue Sep 12 2023 Jakub Ružička <jakub.ruzicka@nic.cz> - 3.2.10-1
+- Update to 3.2.10
+
+* Thu Jul 27 2023 Jakub Ružička <jakub.ruzicka@nic.cz> - 3.2.9-1
+- Update to 3.2.9
+
+* Mon Jun 26 2023 Jakub Ružička <jakub.ruzicka@nic.cz> - 3.2.8-1
+- Update to 3.2.8
+
+* Tue Jun 06 2023 Jakub Ružička <jakub.ruzicka@nic.cz> - 3.2.7-1
+- Update to 3.2.7
+
+* Thu Apr 06 2023 Jakub Ružička <jakub.ruzicka@nic.cz> - 3.2.6-1
+- Update to 3.2.6
+
+* Thu Feb 02 2023 Jakub Ružička <jakub.ruzicka@nic.cz> - 3.2.5-1
+- Update to 3.2.5
+
+* Mon Dec 12 2022 Jakub Ružička <jakub.ruzicka@nic.cz> - 3.2.4-1
+- Update to 3.2.4
+- Use devtoolset-12-gcc on EPEL 7
+
+* Mon Nov 21 2022 Jakub Ružička <jakub.ruzicka@nic.cz> - 3.2.3-1
+- Update to 3.2.3
+
+* Tue Nov 01 2022 Jakub Ružička <jakub.ruzicka@nic.cz> - 3.2.2-1
+- Update to 3.2.2
+
+* Fri Sep 09 2022 Jakub Ružička <jakub.ruzicka@nic.cz> - 3.2.1-1
+- Update to 3.2.1
+- Remove patches included upstream
+- Update Conflicts and move to knot-libs
+
+* Mon Aug 22 2022 Jakub Ružička <jakub.ruzicka@nic.cz> - 3.2.0-1
+- Update to 3.2.0
+- Patch: fix tests on 32-bit platforms
+- Patch: revert problematic hardening of service file
+- Patch: revert config improvement to support EL 7
+- New knot-dnssecutils subpackage
+- Debian compat (knot-utils vs knot-dnsutils)
+- Remove bundled(jquery) version as it differes between distros
+
+* Thu Apr 28 2022 Jakub Ružička <jakub.ruzicka@nic.cz> - 3.1.8-1
+- Update to 3.1.8
+
+* Wed Mar 30 2022 Jakub Ružička <jakub.ruzicka@nic.cz> - 3.1.7-1
+- Update to 3.1.7
+
+* Thu Feb 10 2022 Jakub Ružička <jakub.ruzicka@nic.cz> - 3.1.6-1
+- Update to 3.1.6
+- Use _sharedstatedir for home
+
+* Wed Jan 05 2022 Jakub Ružička <jakub.ruzicka@nic.cz> - 3.1.5-1
+- Update to 3.1.5
+
+* Thu Nov 04 2021 Jakub Ružička <jakub.ruzicka@nic.cz> - 3.1.4-1
+- Update to 3.1.4
+
+* Tue Oct 19 2021 Jakub Ružička <jakub.ruzicka@nic.cz> - 3.1.3-1
+- Update to 3.1.3
+
+* Thu Sep 09 2021 Jakub Ružička <jakub.ruzicka@nic.cz> - 3.1.2-1
+- Update to 3.1.2
+
+* Tue Aug 10 2021 Jakub Ružička <jakub.ruzicka@nic.cz> - 3.1.1-1
+- Update to 3.1.1
+- Enable XDP on ARM and improve XDP config macros
+- Remove patch included upstream
+
+* Wed Aug 04 2021 Jakub Ružička <jakub.ruzicka@nic.cz> 3.1.0-2
+- Introduce a patch to fix tests on ppc64le
+- Use autosetup macro to apply patches
+
+* Mon Aug 02 2021 Jakub Ružička <jakub.ruzicka@nic.cz> - 3.1.0-1
+- Update to 3.1.0
+- Add missing BuildRequires including new libmnl for kxdpgun
+- Temporarily disable XDP on ARM until issues are resolved
+
+* Fri Jul 16 2021 Jakub Ružička <jakub.ruzicka@nic.cz> - 3.0.8-1
+- Update to 3.0.8
+- Print failed tests during check
+
+* Thu Jun 17 2021 Jakub Ružička <jakub.ruzicka@nic.cz> - 3.0.7-1
+- Update to 3.0.7
+
+* Fri May 14 2021 Jakub Ružička <jakub.ruzicka@nic.cz> - 3.0.6-1
+- Update to 3.0.6
+
+* Tue Mar 30 2021 Jakub Ružička <jakub.ruzicka@nic.cz> 3.0.5-1
+- Update to 3.0.5
+- Properly escape BASE_VERSION macro
+- Include module dirs in main package
+
+* Mon Feb 01 2021 Jakub Ružička <jakub.ruzicka@nic.cz> - 3.0.4-1
+- Update to 3.0.4
+- Move dnstap module to subpackage
+- Move geoip module to subpackage
+- Remove redundant VERSION macro
+
+* Thu Dec 17 2020 Jakub Ružička <jakub.ruzicka@nic.cz> - 3.0.3-1
+- Update to 3.0.3
+
+* Wed Nov 11 2020 Jakub Ružička <jakub.ruzicka@nic.cz> - 3.0.2-1
+- Update to 3.0.2
+
+* Mon Oct 12 2020 Jakub Ružička <jakub.ruzicka@nic.cz> - 3.0.1-1
+- Update to 3.0.1
+- Sync packaging from upstream
+
+* Fri Sep 25 2020 Jakub Ružička <jakub.ruzicka@nic.cz> 3.0.0-2
+- Rebuild
+
+* Thu Sep 10 2020 Jakub Ružička <jakub.ruzicka@nic.cz> 3.0.0-1
+- New major upstream release 3.0.0
+- Sync packaging from upstream
+
+* Wed Sep 02 2020 Jakub Ružička <jakub.ruzicka@nic.cz> 2.9.6-1
+- Update to 2.9.6
+
+* Mon May 25 2020 Tomas Krizek <tomas.krizek@nic.cz> - 2.9.5-1
+- new upstream release 2.9.5
+
+* Tue May 05 2020 Tomas Krizek <tomas.krizek@nic.cz> - 2.9.4-1
+- new upstream release 2.9.4
+
+* Tue Mar 03 2020 Tomas Krizek <tomas.krizek@nic.cz> - 2.9.3-1
+- new upstream release 2.9.3
+
+* Fri Dec 13 2019 Tomas Krizek <tomas.krizek@nic.cz> - 2.9.2-1
+- new upstream release 2.9.2
+
+* Tue Nov 12 2019 Tomas Krizek <tomas.krizek@nic.cz> - 2.9.1-1
+- New upstream release 2.9.1
+- add EPEL8 compatibility
+- fix unsafe PGP keyring permissions
+
+* Tue Sep 24 2019 Tomas Krizek <tomas.krizek@nic.cz> - 2.8.4-1
+- new upstream release 2.8.4
+
+* Wed Aug 21 2019 Tomas Krizek <tomas.krizek@nic.cz> - 2.8.3-1
+- new upstream release 2.8.3
+
+* Thu Jul 11 2019 Tomas Krizek <tomas.krizek@nic.cz> - 2.8.2-1
+- rebase to latest upstream version 2.8.2
+
+* Mon Oct 01 2018 Tomas Krizek <tomas.krizek@nic.cz> - 2.6.9-1
+Knot DNS 2.6.9 (2018-08-14)
 ===========================
 
 Improvements:
 -------------
- - Added zone wire size information to zone loading log message
+ - Added zone wire size to zone loading log message
  - Added debug log message for each unsuccessful remote address operation
- - Various improvements for packaging
 
 Bugfixes:
 ---------
- - Incompatible handling of RRSIG TTL value when creating a DNS message
- - Incorrect RRSIG TTL value in zone differences and knotc zone operation outputs
- - Default configure prefix is ignored
-
-Knot DNS 2.7.0 (2018-08-03)
-===========================
-
-Features:
----------
- - New DNS Cookies module and related '+cookie' kdig option
- - New module for response tailoring according to client's subnet or geographic location
- - General EDNS Client Subnet support in the server
- - OSS-Fuzz integration (Thanks to Jonathan Foote)
- - New '+ednsopt' kdig option (Thanks to Jan Včelák)
- - Online Signing support for automatic key rollover
- - Non-normal file (e.g. pipe) loading support in zscanner #542
- - Automatic SOA serial incrementation if non-empty zone difference
- - New zone file load option for ignoring zone file's SOA serial
- - New build-time option for alternative malloc specification
- - Structured logging for DNSSEC key submission event
- - Empty QNAME support in kdig
-
-Improvements:
--------------
- - Various library and server optimizations
- - Reduced memory consumption of outgoing IXFR processing
- - Linux capabilities use overhaul #546 (Thanks to Robert Edmonds)
- - Online Signing properly signs delegations and CNAME records
- - CDS/CDNSKEY rrset is signed with KSK instead of ZSK
- - DNSSEC-related records are ignored when loading zone difference with signing enabled
- - Minimum allowed RSA key length was increased to 1024
- - Removed explicit dependency on Nettle
-
-Bugfixes:
----------
- - Possible uninitialized address buffer use in zscanner
- - Possible index overflow during multiline record parsing in zscanner
- - kdig +tls sometimes consumes 100 % CPU #561
- - Single-Type Signing doesn't work with single ZSK key #566
  - Zone not flushed after re-signing during zone load #594
  - Server crashes when committing empty zone transaction
  - Incoming IXFR with on-slave signing sometimes leads to memory corruption #595
 
-Compatibility:
---------------
- - Removed obsolete RRL configuration
- - Removed obsolete module names 'mod-online-sign' and 'mod-synth-record'
- - Removed obsolete 'ixfr-from-differences' configuration option
- - Removed old journal migration
- - Removed module rosedb
-
-
 * Fri Jul 13 2018 Fedora Release Engineering <releng@fedoraproject.org> - 2.6.8-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
 
@@ -582,6 +768,15 @@ WARNING: Automatic upgrade from versions 1.y.z is no longer possible.
 To migrate, upgrade your packages gradually or use contacts listed on
 https://www.knot-dns.cz/support/ (if you are in trouble).
 
+* Mon Jul 31 2017 Petr Spacek <petr.spacek@nic.cz> - 2.5.3-2
+- disable dnstap on RHEL (depedencies are missing)
+
+* Mon Jul 31 2017 Petr Spacek <petr.spacek@nic.cz> - 2.5.3-1
+- new upstream release
+WARNING: Automatic upgrade from versions 1.y.z is no longer possible.
+To migrate, upgrade your packages gradually or use contacts listed on
+https://www.knot-dns.cz/support/ (if you are in trouble).
+
 Knot DNS 2.5.3 (2017-07-14)
 ===========================
 
@@ -663,23 +858,6 @@ Improvements:
  - Added libidn2 support to kdig (with libidn fallback)
  - Maximum timer database switched from configure to the server configuration
 
-* Wed Jul 26 2017 Fedora Release Engineering <releng@fedoraproject.org> - 2.4.5-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
-
-* Mon Jul 10 2017 Petr Spacek <petr.spacek@nic.cz> - 2.4.5-1
-New upstream release: 2.4.5
-
-Knot DNS 2.4.5 (2017-06-23)
-===========================
-
-Security:
----------
- - Improper TSIG validity period check can allow TSIG forgery (Thanks to Synacktiv!)
-
-Bugfixes:
----------
- - Corner case journal fixes (huge changesets, OpenWRT operation)
-
 Knot DNS 2.4.4 (2017-06-05)
 ===========================
 
@@ -733,22 +911,13 @@ Bugfixes:
  - Incorrect elapsed time in the DDNS log
  - Failed to process forwarded DDNS request with TSIG
 
+* Mon Mar 13 2017 Petr Spacek <petr.spacek@nic.cz> - 2.4.1-2
+- configuration checking was fixed to be compatible with Knot 2.4.x
+
 * Mon Feb 27 2017 Petr Spacek <petr.spacek@nic.cz> - 2.4.1-1
-- new upstream release:
-  + fix: Transfer of a huge rrset goes into an infinite loop
-  + fix: Huge response over TCP contains useless TC bit instead of SERVFAIL
-  + fix: Failed to build utilities with disabled daemon
-  + fix: Memory leaks during keys removal
-  + fix: Rough TSIG packet reservation causes early truncation
-  + fix: Minor out-of-bounds string termination write in rrset dump
-  + fix: Server crash during stop if failed to open timers DB
-  + fix: Failed to compile on OS X older than Sierra
-  + fix: Poor minimum UDP-max-size configuration check
-  + fix: Failed to receive one-record-per-message IXFR-style AXFR
-  + fix: Kdig timeouts when receiving RCODE != NOERROR on subsequent transfer message
-  + improvement: Speed-up of rdata addition into a huge rrset
-  + improvement: Introduce check of minumum timeout for next refresh
-  + improvement: Dnsproxy module can forward all queries without local resolving
+- new upstream release 2.4.1 replaces old 1.6.x series which is not supported
+- configuration should be upgraded automatically using knot1to2 tool
+- make sure you reviewed the new configuration in /etc/knot directory!
 
 * Fri Feb 10 2017 Fedora Release Engineering <releng@fedoraproject.org> - 2.4.0-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
@@ -832,129 +1001,51 @@ Bugfixes:
   + improvement: Set TC flag in delegation only if mandatory glue doesn't fit the response
   + improvement: Separate EDNS(0) payload size configuration for IPv4 and IPv6
   + feature: Zone size limit restriction for DDNS, AXFR, and IXFR (CVE-2016-6171)
-  + feature: DNS-over-TLS support in kdig (RFC 7858)
-  + feature: EDNS(0) padding and alignment support in kdig (RFC 7830)
 
-* Fri Jun 24 2016 Jan Vcelak <jvcelak@fedoraproject.org> - 2.2.1-2
-- rebuild for updated userspace-rcu
-
-* Mon May 30 2016 Jan Vcelak <jvcelak@fedoraproject.org> - 2.2.1-1
+* Tue Aug 09 2016 Jan Vcelak <jvcelak@fedoraproject.org> - 1.6.8-1
 - new upstream release:
-  + fix: Separate logging of server and zone events
-  + fix: Concurrent zone file flushing with many zones
-  + fix: Control timeout parsing in knotc
-  + fix: "Environment maxreaders limit reached" error in knotc
-  + fix: Don't apply journal changes on modified zone file
-  + fix: Enable multiple zone names completion in interactive knotc
-  + fix: Set the TC flag in a response if a glue doesn't fit the response
-  + fix: Disallow server reload when there is an active configuration transaction
-  + improvement: Distinguish unavailable zones from zones with zero serial in log messages
-  + improvement: Log warning and error messages to standard error output in all utilities
-  + improvement: Document tested PKCS #11 devices
-  + improvement: Extended Python configuration interface
-- update requirements for Fedora 25
+  + fix: Transfer of a huge rrset goes into an infinite loop
+  + fix: Huge response over TCP contains useless TC bit instead of SERVFAIL
+  + fix: Failed to build utilities with disabled daemon
+  + fix: Memory leaks during keys removal
+  + fix: Rough TSIG packet reservation causes early truncation
+  + fix: Minor out-of-bounds string termination write in rrset dump
+  + fix: Server crash during stop if failed to open timers DB
+  + fix: Failed to compile on OS X older than Sierra
+  + fix: Poor minimum UDP-max-size configuration check
+  + fix: Failed to receive one-record-per-message IXFR-style AXFR
+  + fix: Kdig timeouts when receiving RCODE != NOERROR on subsequent transfer message
+  + improvement: Speed-up of rdata addition into a huge rrset
+  + improvement: Introduce check of minumum timeout for next refresh
+  + improvement: Dnsproxy module can forward all queries without local resolving
 
-* Sun May 29 2016 Jan Vcelak <jvcelak@fedoraproject.org> - 2.2.0-3
-- update default configuration file
-
-* Sun May 08 2016 Jan Vcelak <jvcelak@fedoraproject.org> - 2.2.0-2
-- fix: systemd service starting
-
-* Tue Apr 26 2016 Jan Vcelak <jvcelak@fedoraproject.org> - 2.2.0-1
+* Wed Feb 10 2016 Jan Vcelak <jvcelak@fedoraproject.org> 1.6.7-1
 - new upstream release:
-  + fix: Query/response message type setting in dnstap module
-  + fix: Remote address retrieval from dnstap capture in kdig
-  + fix: Global modules execution for queries hitting existing zones
-  + fix: Execution of semantic checks after an IXFR transfer
-  + fix: kdig failure when the first AXFR message contains just the SOA record
-  + fix: Exclude non-authoritative types from NSEC/NSEC3 bitmap at a delegation
-  + fix: Mark PKCS#11 generated keys as sensitive
-  + fix: Error when removing the only zone from the server
-  + fix: Don't abort knotc transaction when some check fails
-  + feature: URI and CAA resource record types support
-  + feature: RRL client address based white list
-  + feature: knotc interactive mode
-  + improvement: Consistent IXFR error messages
-  + improvement: Various fixes for better compatibility with PKCS#11 devices
-  + improvement: Various keymgr user interface improvements
-  + improvement: Better zone event scheduler performance with many zones
-  + improvement: New server control interface
-  + improvement: kdig uses local resolver if resolv.conf is empty
+  + improvement: Log change of the zone serial number after IXFR transfer
+  + improvement: Document operational impact of various RRL settings
+  + improvement: Add support for rate-limit-slip zero
+  + improvement: Add 'timer-db' configuration option
 
-* Wed Feb 10 2016 Jan Vcelak <jvcelak@fedoraproject.org> 2.1.1-1
-- new upstream release:
-  + fix: Allow import of duplicate private key into the KASP
-  + fix: Avoid duplicate NSEC for Wildcard No Data answer
-  + fix: Server crash when an incomming transfer is in progress and reload is issued
-  + fix: Socket polling when configured with many interfaces and threads
-  + improvement: Use correct source address for UDP messages recieved on ANY address
-  + improvement: Extend documentation of knotc commands
-
-* Thu Feb 04 2016 Fedora Release Engineering <releng@fedoraproject.org> - 2.1.0-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
-
-* Thu Jan 14 2016 Jan Vcelak <jvcelak@fedoraproject.org> 2.1.0-1
-- new upstream release:
-  + improvement: Remove implementation limit for the number of network interfaces
-  + improvement: Remove possibly insecure server control over a network socket
-  + fix: Schedule zone bootstrap after slave zone fails to load from disk
-
-* Sun Dec 20 2015 Jan Vcelak <jvcelak@fedoraproject.org> 2.1.0-0.1.rc1
-- new upstream pre-release:
-  + feature: Per-thread UDP socket binding using SO_REUSEPORT
-  + feature: Support for dynamic configuration database
-  + feature: DNSSEC, Support for cryptographic tokens via PKCS #11 interface
-  + feature: DNSSEC, Experimental support for online signing
-  + improvement: Support for zone file name patterns
-  + improvement: Configurable location of zone timer database
-  + improvement: Non-blocking network operations and better timeout handling
-  + improvement: Caching of Critical configuration values for better performance
-  + improvement: Logging of ACL failures
-  + improvement: RRL: Add rate-limit-slip zero support to drop all responses
-  + improvement: RRL: Document behavior for different rate-limit-slip options
-  + improvement: kdig: Warning instead of error on TSIG validation failure
-  + improvement: Cleanup of support libraries interfaces (libknot, libzscanner, libdnssec)
-  + fix: synth-record module: Fix application of default configuration options
-  + fix: TSIG: Allow compressed TSIG name when forwarding DDNS updates
-
-* Wed Nov 25 2015 Jan Vcelak <jvcelak@fedoraproject.org> 2.0.2-1
+* Wed Nov 25 2015 Jan Vcelak <jvcelak@fedoraproject.org> 1.6.6-1
 - new upstream release:
   + security fix: out-of-bound read in packet parser for malformed NAPTR record
+  + fix: systemd startup notifications
 
-* Thu Sep 03 2015 Jan Vcelak <jvcelak@fedoraproject.org> 2.0.1-1
+* Wed Sep 02 2015 Jan Vcelak <jvcelak@fedoraproject.org> 1.6.5-1
 - new upstream release:
-  + fix: do not reload expired zones on 'knotc reload' and server startup
-  + fix: rare race-condition in event scheduling causing delayed event execution
-  + fix: skipping of non-authoritative nodes in NSEC proofs
+  + fix: don't load expired zones on reload and startup
+  + fix: remove race condition in scheduling causing delaying of events
+  + fix: NSEC proof construction in zones with many delegations
   + fix: TC flag setting in RRL slipped answers
   + fix: disable domain name compression for root label
-  + fix: fix CNAME following when quering for NSEC RR type
-  + fix: fix refreshing of DNSSEC signatures for zone keys
-  + fix: fix binding an unavailable IPv6 address (IP_FREEBIND)
-  + fix: fix infinite loop in knotc zonestatus and memstats
-  + fix: fix memory leak in configuration on server shutdown
-  + fix: fix broken dnsproxy module
-  + fix: fix multi value parsing on big-endian
-  + fix: adapt to Nettle 3 API break causing base64 decoding failures on big-endian
-  + feature: add 'keymgr zone key ds' to show key's DS record
-  + feature: add 'keymgr tsig generate' to generate TSIG keys
-  + feature: add query module scoping to process either all queries or zone queries only
-  + feature: add support for file name globbing in config file includes
-  + feature: add 'request-edns-option' config option to add custom EDNS0 option into server initiated queries
-  + improvement: send minimal responses (remove NS from Authority section for NOERROR)
-  + improvement: update persistent timers only on shutdown for better performance
-  + improvement: allow change of RR TTL over DDNS
-  + improvement: documentation fixes, updates, and improvements in formatting
-  + improvement: install yparser and zscanner header files
+  + fix: check if executed under systemd before using journald log sink
+  + feature: write persistent timers on server shutdown for better performance
+  + feature: support time unit specification for 'max-conn-idle',
+    'max-conn-handshake', 'max-conn-reply', and 'notify-timeout' config options
+  + feature: add 'request-edns-config' config option
 
-* Mon Jul 20 2015 Jan Vcelak <jvcelak@fedoraproject.org> 2.0.0-1
+* Thu Jun 18 2015 Jan Vcelak <jvcelak@fedoraproject.org> 1.6.4-1
 - new upstream release:
-  + feature: possibility to disable zone file synchronization
-  + feature: knsupdate, add input prompt in interactive mode
-  + feature: knsupdate, TSIG algorithm specification in interactive mode
-
-* Thu Jun 18 2015 Jan Vcelak <jvcelak@fedoraproject.org> 2.0.0-0.1.rc1
-- new upstream pre-release:
   + fix: lost NOTIFY message if received during zone transfer
   + fix: kdig, record correct dnstap SocketProtocol when retrying over TCP
   + fix: kdig, hide TSIG section with +noall

knot.tmpfiles

@@ -1,2 +0,0 @@
-# Knot DNS runtime directory
-d /var/run/knot 0755 knot knot -

sources

@@ -1,2 +1,2 @@
-SHA512 (knot-2.7.1.tar.xz) = 547a146abb882885ff2ba0fe070a03b29138400dad78119e9c550019369a01902bc1c8f0fd12ca19367e716e506e680acc27f4d7801a30fbdec3f4cf6f4105e7
-SHA512 (knot-2.7.1.tar.xz.asc) = 86b9c34be9fd24a153a3261551167273974b9bed06cc8e28b1ce0af02f905dc1b904a4ecc71f0f17475cd76f60ebdf8d288b4a27e5ad808bf13f39f32491e8e6
+SHA512 (knot-3.2.13.tar.xz) = ed68faa1d8eba375ca7e22599bafab782f82c3510ec4e3d8a063cbf55c4ee5d5be91a1a045d71e53a36769ec099e252c959471cbc70c1afee2bee4d453732f10
+SHA512 (knot-3.2.13.tar.xz.asc) = e5c58e06fa637b0a3e020383e7bd8ebca47d094085680a5c65ff4fbbbce47453c887e0ebd4cd05947a704ce1eac2268cdfda27c32c35db7d1ac5b0cb644f311e

tests/README.md

@@ -2,7 +2,7 @@ Package tests
 =============
 
 These tests implement the standard test interface in Fedora CI.
-See https://fedoraproject.org/wiki/CI/Tests for details.
+See https://docs.fedoraproject.org/en-US/ci/tests/ for details.
 
 Manual execution
 ----------------
@@ -12,11 +12,3 @@ modifications to your system. It's best to run these on a clean, throw-away
 testing system or a VM.
 
 ansible-playbook tests/tests.yml -e subjects=/path/to/knot.rpm,/path/to/knot-libs.rpm -e artifacts=/path/to/artifacts
-
-Automatic execution
--------------------
-
-These tests should eventually be automatically executed by the Fedora CI
-pipeline. As of 2018-01-10, it is not supported for packages that aren't part
-of Fedora Atomic. Once it is implemented, the results of these tests should be
-visible in dist-git commits on src.fedoraproject.org

tests/scripts/test_basic_zone.sh

@@ -0,0 +1,18 @@
+#!/bin/bash
+# test basic system-wide functionality of Knot DNS
+set -ex
+
+# create zone file from examples
+cp /usr/share/doc/knot/samples/example.com.zone /var/lib/knot/example.com.zone
+# configure knot to serve example.com zone using dark sed magic
+sed 's/^#\?\([ \t]*-[ \t]*domain:[ \t]\+example.com\)[ \t]*$/\1/' -i /etc/knot/knot.conf
+
+# (re)start knotd
+systemctl stop knot.service
+systemctl start knot.service || systemctl status knot.service
+
+# check valid query is answered
+dig @127.0.0.1 example.com | grep NOERROR
+
+# check query for non-existent zone is refused
+dig @127.0.0.1 bad-example.com | grep REFUSED

tests/test_basic_zone.yml

@@ -1,33 +0,0 @@
----
-- block:
-    - name: create zone file
-      shell: cp /usr/share/doc/knot/samples/example.com.zone /var/lib/knot/example.com.zone
-
-    - name: configure knot to serve example.com zone
-      lineinfile:
-        path: /etc/knot/knot.conf
-        regexp: '^#?  - domain: example.com$'
-        state: present
-        line: '  - domain: example.com'
-
-    - name: start knot.service
-      service:
-        name: knot.service
-        state: restarted
-
-    - name: check if query is answered
-      shell: dig @127.0.0.1 example.com
-      register: res
-      failed_when: "'NOERROR' not in res.stdout"
-
-    - name: check query for non-existent zone is refused
-      shell: dig @127.0.0.1 example2.com
-      register: res
-      failed_when: "'REFUSED' not in res.stdout"
-
-  rescue:
-    - set_fact:
-        test_basic_zone_failed: true
-  always:
-    - name: collect journal
-      shell: journalctl --since -10m > {{ artifacts }}/test_basic_zone_journal.log

tests/tests.yml

@@ -1,25 +1,15 @@
 ---
 - hosts: localhost
   remote_user: root
-  pre_tasks:
-    - package:  # Install additional dependecies
-        name: bind-utils
-        state: latest
   roles:
-    - role: standard-test-rpm
+    - role: standard-test-basic
       tags:
         - classic
-  tasks:
-    - include_tasks: test_basic_zone.yml
-
-    - set_fact:
-        tests_passed: '{{ test_basic_zone_failed is undefined }}'
-    - name: report results
-      debug:
-        msg: |
-          test_basic_zone: {{ 'FAILED' if test_basic_zone_failed is defined else 'OK'}}
-
-    - name: fail playbook if tests failed
-      debug:
-        msg: --- {{ 'PASSED' if tests_passed else 'FAILED' }} ---
-      failed_when: not tests_passed
+      required_packages:
+        - bind-utils
+      tests:
+        - knotd-show-version:
+            run: knotd --version
+        - basic-zone:
+            dir: scripts
+            run: ./test_basic_zone.sh