On Tue, 2026-10-13 at 16:40 +0200, Marco d'Itri wrote: > On Oct 13, Jason Bolger <[email protected]> wrote: > > > This package is shipping with outdated dns trust anchor information in > > /usr/share/dnsmasq-base/trust-anchors.conf causing all DNSSEC > > validations to fail.
Hi Jason, According to https://data.iana.org/root-anchors/root-anchors.xml the shipped trust anchor is still valid, however the newest trust anchor is missing from dnsmasq-base 2.90-4~deb12u2. As my tests didn't show failing DNSSEC validations, it would be great you provide more details about how to reproduce your observation. > > > > Rather than correcting it I suggest making the package dependent on > > dns-root-data which appears to be the Debian package for maintaining > > DNS data. > > As the dns-root-data maintainer I fully agree. > Not duplicating the trust anchors should be a policy-level requirement. > > dnsmasq does not read natively any of the file formats provided by > dns-root-data, but its trust-anchor configuration parameters can be > trivially generated from /usr/share/dns/root.ds using e.g. awk. Hi Marco, actually the dnsmasq package (not dnsmasq-base) applies /usr/share/dns/root.ds translating it appropriately. dnsmasq-base does not make use of /usr/share/dnsmasq-base/trust- anchors.conf by itself, so, a solution might be to simply drop /usr/share/dnsmasq-base/trust-anchors.conf from the dnsmasq-base package. Best, Sven -- GPG Fingerprint 3DF5 E8AA 43FC 9FDF D086 F195 ADF5 0EDA F8AD D585
signature.asc
Description: This is a digitally signed message part
