On Thu, 15 Oct 2026 11:28:09 +0200 Marco d'Itri <[email protected]> wrote:
Package: debian-policy
Version: 4.7.4.1
Severity: normal
DNSSEC-enabled DNS resolvers must depend on the dns-root-data package
instead of shipping built-in trust anchors.
The dns-root-data is a trivial, arch:all package whose only purpose is
to provide a current DNS root zone and DNSSEC trust anchors, even for
end of support Debian releases.
I thought about this for unbound resolver. And decided not to go with
a strong dependency but with a recommends instead. The thing is: for
unbound in particular, these files are just a hint which gets copied
to an unbound dir, and there, unbound keeps it current by its own.
So the package - dns-root-data - is not used and not needed after
install.
Additionally, unbound itself ships a copy of root anchor, - this too
can be used by a non-default configuration when not enabling the
root-auto-trust-anchor-file.conf snippet. The default config relies
on dns-root-data files at least initially present, but it is not
mandatory.
I don't think it's viable to disable root anchor embedded in the
upstream unbound sources.
If the decision is "must" I can change this dependency from Recommends
to Depends for sure, but for now I don't see a reason to.
Thanks,
/mjt
