GNU bug report logs - #68622
[PATCH 2/2] services: knot-resolver: Use default DNSSEC trust anchors.

Previous Next

To add a comment to this bug, you must first unarchive it, by sending
a message to control AT debbugs.gnu.org, with unarchive 68622 in the body.
You can then email your comments to 68622 AT debbugs.gnu.org in the normal way.

Toggle the display of automated, internal messages from the tracker.

Message #5 received at submit <at> debbugs.gnu.org (full text, mbox):

From: Leo Nikkilä <hello <at> lnikki.la>
To: guix-patches <at> gnu.org
Cc: Leo Nikkilä <hello <at> lnikki.la>
Subject: [PATCH 2/2] services: knot-resolver: Use default DNSSEC trust anchors.
Date: Sat, 20 Jan 2024 23:23:44 +0200

* gnu/services/dns.scm (%kresd.conf): Use default anchors.
(knot-resolver-activation): Install default anchors when missing.
---
 gnu/services/dns.scm | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/gnu/services/dns.scm b/gnu/services/dns.scm
index 6608046909..f83c5b6594 100644
--- a/gnu/services/dns.scm
+++ b/gnu/services/dns.scm
@@ -655,7 +655,6 @@ (define-record-type* <knot-resolver-configuration>
 
 (define %kresd.conf
   (plain-file "kresd.conf" "-- -*- mode: lua -*-
-trust_anchors.add_file('/var/cache/knot-resolver/root.keys')
 net = { '127.0.0.1', '::1' }
 user('knot-resolver', 'knot-resolver')
 modules = { 'hints > iterate', 'stats', 'predict' }
@@ -676,10 +675,20 @@ (define %knot-resolver-accounts
 (define (knot-resolver-activation config)
   #~(begin
       (use-modules (guix build utils))
-      (let ((rundir "/var/cache/knot-resolver")
-            (owner (getpwnam "knot-resolver")))
+      (let* ((rundir "/var/cache/knot-resolver")
+             (keyfile (string-append rundir "/root.keys"))
+             (owner (getpwnam "knot-resolver")))
         (mkdir-p rundir)
-        (chown rundir (passwd:uid owner) (passwd:gid owner)))))
+        (chown rundir (passwd:uid owner) (passwd:gid owner))
+
+        ;; Install initial trust anchors when missing.
+        (unless (file-exists? keyfile)
+          (copy-file #$(file-append (knot-resolver-configuration-package
+                                     config)
+                                    "/etc/knot-resolver/root.keys")
+                     keyfile)
+          (chown keyfile (passwd:uid owner) (passwd:gid owner))
+          (chmod keyfile #o755)))))
 
 (define knot-resolver-shepherd-services
   (match-lambda
-- 
2.41.0

Message #8 received at 68622 <at> debbugs.gnu.org (full text, mbox):

From: Dale Mellor <guix-devel-0brg6a <at> rdmp.org>
To: 68622 <at> debbugs.gnu.org
Subject: Moved into 68621
Date: Tue, 23 Apr 2024 17:22:47 +0100

This patch belongs to issue 68621, closing this one.

Message #13 received at 68622 <at> debbugs.gnu.org (full text, mbox):

From: Dale Mellor <"	guix-devel-0brg6a"@rdmp.org>
To: 68622 <at> debbugs.gnu.org
Subject: Moved to 68621
Date: Tue, 23 Apr 2024 17:05:43 +0100

This patch belongs to issue 68621, closing here.

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.