Bug#873371: stretch-pu: package unbound/1.6.0-3+deb9u1
Control: tags -1 + pending
On Fri, 2017-09-08 at 16:01 -0400, Robert Edmonds wrote:
> Adam D. Barratt wrote:
> > Control: tags -1 + confirmed
> >
> > On Sun, 2017-08-27 at 09:19 +0100, Adam D. Barratt wrote:
> > > Control: block -1 by 873054
> > >
> > > On Sun, 2017-08-27 at 01:25 -0400, Robert Edmonds wrote:
> > > > There is a bug in the unbound package shipped in stretch
> > > > (1.6.0-3)
> > > > that
> > > > will cause DNS resolution to fail on systems that install the
> > > > unbound
> > > > package between September 11 and October 11, 2017. The upstream
> > > > developers have released 1.6.5 with a fix for this problem:
> >
> > [...]
> > > > Additionally, since new installs of the unbound package
> > > > initialize
> > > > the
> > > > autotrust anchor file for the DNS root
> > > > (/var/lib/unbound/root.key)
> > > > from
> > > > a copy shipped in the dns-root-data package
> > > > (/usr/share/dns/root.key),
> > > > the dns-root-data package in stretch needs to be updated to
> > > > transition
> > > > the root zone trust anchor KSK-2017 to the RFC 5011 "VALID"
> > > > state.
> > > > (The
> > > > stretch-pu request for the dns-root-data package is #873054.)
> > > > Accordingly, the proposed unbound 1.6.0-3+deb9u1 implements a
> > > > versioned
> > > > dependency on the dns-root-data package that would be shipped
> > > > in
> > > > #873054.
> > >
> > > That means that we'd also need to release dns-root-data via
> > > -updates,
> > > otherwise most users won't be able to install the fixed unbound.
> > > It
> > > also imposes an ordering on the p-u requests, so adding a
> > > blocking
> > > relationship to indicate that.
> >
> > That happened now, please feel free to upload.
>
> Uploaded. Thanks!
Flagged for acceptance; thanks.
Regards,
Adam
Reply to: