From: "Leo Nikkilä via Guix-patches via" <guix-patches@gnu.org>
To: 68620@debbugs.gnu.org
Cc: "Leo Nikkilä" <hello@lnikki.la>
Subject: [bug#68620] [PATCH 1/2] gnu: knot-resolver: Re-enable default DNSSEC trust anchors.
Date: Sat, 20 Jan 2024 23:23:43 +0200 [thread overview]
Message-ID: <20240120212542.17473-2-hello@lnikki.la> (raw)
In-Reply-To: <20240120212542.17473-1-hello@lnikki.la>
* gnu/packages/dns.scm (knot-resolver) [#:configure-flags]: Configure
root keys and managed TA.
[#:phases] Remove `'disable-default-ta', add `'install-root-keys'.
---
gnu/packages/dns.scm | 20 +++++++++++++-------
1 file changed, 13 insertions(+), 7 deletions(-)
diff --git a/gnu/packages/dns.scm b/gnu/packages/dns.scm
index 73a2fac54b..9783e560fa 100644
--- a/gnu/packages/dns.scm
+++ b/gnu/packages/dns.scm
@@ -994,15 +994,13 @@ (define-public knot-resolver
(build-system meson-build-system)
(outputs '("out" "doc"))
(arguments
- '(#:configure-flags '("-Ddoc=enabled")
+ `(#:configure-flags
+ '("-Ddoc=enabled"
+ "-Dinstall_root_keys=disabled" ; installed manually outside store
+ "-Dkeyfile_default=/var/cache/knot-resolver/root.keys"
+ "-Dmanaged_ta=enabled")
#:phases
(modify-phases %standard-phases
- (add-before 'configure 'disable-default-ta
- (lambda _
- ;; Disable the default managed root TA, since we don't have
- ;; write access to the keyfile and its directory in store.
- (substitute* "daemon/lua/sandbox.lua.in"
- (("^trust_anchors\\.add_file.*") ""))))
(add-after 'build 'build-doc
(lambda _
(invoke "ninja" "doc")))
@@ -1020,6 +1018,14 @@ (define-public knot-resolver
'("doc/knot-resolver/examples"
"doc/knot-resolver/html"
"info")))))
+ (add-after 'install 'install-root-keys
+ (lambda* (#:key outputs #:allow-other-keys)
+ (let ((dir (string-append (assoc-ref outputs "out")
+ "/etc/knot-resolver")))
+ (mkdir-p dir)
+ (install-file (string-append "../knot-resolver-" ,version
+ "/etc/root.keys")
+ dir))))
(add-after 'install 'wrap-binary
(lambda* (#:key inputs outputs #:allow-other-keys)
(let* ((out (assoc-ref outputs "out"))
--
2.41.0
next prev parent reply other threads:[~2024-01-20 21:27 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-01-20 21:23 [bug#68621] [PATCH 0/2] Provide default DNSSEC trust anchors for knot-resolver Leo Nikkilä via Guix-patches via
2024-01-20 21:23 ` Leo Nikkilä via Guix-patches via [this message]
2024-04-23 16:04 ` [bug#68620] Moved into 68621 Dale Mellor
2024-04-23 16:21 ` Dale Mellor
2024-01-20 21:23 ` [bug#68622] [PATCH 2/2] services: knot-resolver: Use default DNSSEC trust anchors Leo Nikkilä via Guix-patches via
2024-04-23 16:05 ` [bug#68622] Moved to 68621 Dale Mellor
2024-04-23 16:22 ` [bug#68622] Moved into 68621 Dale Mellor
2024-01-20 21:37 ` [bug#68621] [PATCH 0/2] Provide default DNSSEC trust anchors for knot-resolver Leo Nikkilä via Guix-patches via
2024-04-23 15:59 ` [bug#68621] Consolidating patches under this one issue number Dale Mellor
2024-04-23 16:12 ` [bug#68621] [PATCH v2 1/4] gnu: knot-resolver: Re-enable default DNSSEC trust anchors Dale Mellor
2024-04-23 16:12 ` [bug#68621] [PATCH v2 2/4] gnu: knot-resolver: Appease some guix lint complaints Dale Mellor
2024-04-23 16:12 ` [bug#68621] [PATCH v2 3/4] services: knot-resolver: Use default DNSSEC trust anchors Dale Mellor
2024-04-23 16:12 ` [bug#68621] [PATCH v2 4/4] gnu: knot-resolver: version to 5.7.2 Dale Mellor
2024-04-23 18:33 ` [bug#68621] [PATCH v2 0/4] Allow use of DNSSEC in knot-resolver service Dale Mellor
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20240120212542.17473-2-hello@lnikki.la \
--to=guix-patches@gnu.org \
--cc=68620@debbugs.gnu.org \
--cc=hello@lnikki.la \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this external index
https://git.savannah.gnu.org/cgit/guix.git
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.