Package: release.debian.org
Severity: normal
Tags: trixie
X-Debbugs-Cc: dns-root-data@packages.debian.org, sanvila@debian.org
Control: affects -1 + src:dns-root-data
User: release.debian.org@packages.debian.org
Usertags: pu
[ Reason ]
Santiago Vila really cares about this and I do not want to disappoint
him. See #1091496 for details.
[ Impact ]
Without updating the key, next year it will not be possible anymore to
rebuild the package.
[ Tests ]
Broken, but the binary package is identical anyway.
[ Risks ]
None: the binary package is identical anyway.
Regarding the change to update-root-anchors.sh:
commit 6b7cc74dd54a5e92e0ceb4403c34152e88a37850
Author: Marco d'Itri <md@linux.it>
Date: Sat Feb 22 19:28:10 2025 +0100
update-root-anchors.sh: actually check the new files
(This bug had no practical consequences because the signature is
verified again when building the binary package.)
diff -Nru dns-root-data-2024071801/debian/changelog dns-root-data-2025080400~deb13u1/debian/changelog
--- dns-root-data-2024071801/debian/changelog 2024-11-17 21:57:17.000000000 +0100
+++ dns-root-data-2025080400~deb13u1/debian/changelog 2025-11-08 01:42:11.000000000 +0100
@@ -1,3 +1,21 @@
+dns-root-data (2025080400~deb13u1) trixie; urgency=medium
+
+ * Rebuild the package for trixie to make possible to rebuild it again
+ during the distribution lifetime. (See #1091496.)
+ The content of the binary package is unchanged from version
+ 2024071801, which is the one currently in trixie.
+
+ -- Marco d'Itri <md@linux.it> Sat, 08 Nov 2025 01:42:11 +0100
+
+dns-root-data (2025080400) unstable; urgency=medium
+
+ * Update root-anchors.p7s (the signature of root-anchors.xml) with a new
+ expiration date of Dec 18 04:19:12 2029 GMT.
+ The old signature would expire on Jul 7 22:48:13 2026 GMT.
+ (Closes: #1091496)
+
+ -- Marco d'Itri <md@linux.it> Mon, 18 Aug 2025 12:22:39 +0200
+
dns-root-data (2024071801) unstable; urgency=medium
* Actually add the DNSKEY record for KSK-2024, which was not distributed
diff -Nru dns-root-data-2024071801/debian/control dns-root-data-2025080400~deb13u1/debian/control
--- dns-root-data-2024071801/debian/control 2024-11-17 04:29:34.000000000 +0100
+++ dns-root-data-2025080400~deb13u1/debian/control 2025-08-18 12:30:26.000000000 +0200
@@ -16,7 +16,7 @@
libpath-tiny-perl,
libxml-libxml-perl,
openssl,
-Standards-Version: 4.7.0.0
+Standards-Version: 4.7.2.0
Homepage: https://data.iana.org/root-anchors/
Vcs-Git: https://salsa.debian.org/dns-team/dns-root-data.git
Vcs-Browser: https://salsa.debian.org/dns-team/dns-root-data
diff -Nru dns-root-data-2024071801/debian/gbp.conf dns-root-data-2025080400~deb13u1/debian/gbp.conf
--- dns-root-data-2024071801/debian/gbp.conf 2024-06-11 11:41:13.000000000 +0200
+++ dns-root-data-2025080400~deb13u1/debian/gbp.conf 2025-08-18 12:30:26.000000000 +0200
@@ -1,2 +1,3 @@
[DEFAULT]
debian-branch = debian/master
+debian-tag = debian/%(version)s
Binary files /tmp/emZH5bPUIn/dns-root-data-2024071801/root-anchors.p7s and /tmp/oqzKw_stYv/dns-root-data-2025080400~deb13u1/root-anchors.p7s differ
diff -Nru dns-root-data-2024071801/update-root-anchors.sh dns-root-data-2025080400~deb13u1/update-root-anchors.sh
--- dns-root-data-2024071801/update-root-anchors.sh 2024-11-17 20:35:49.000000000 +0100
+++ dns-root-data-2025080400~deb13u1/update-root-anchors.sh 2025-08-18 12:30:26.000000000 +0200
@@ -13,7 +13,7 @@
wget -O root-anchors.p7s.NEW https://data.iana.org/root-anchors/root-anchors.p7s
-openssl smime -verify -CAfile icannbundle.pem -inform DER -in root-anchors.p7s -content root-anchors.xml -out /dev/null
+openssl smime -verify -CAfile icannbundle.pem -inform DER -in root-anchors.p7s.NEW -content root-anchors.xml.NEW -out /dev/null
mv root-anchors.xml.NEW root-anchors.xml
mv root-anchors.p7s.NEW root-anchors.p7s
--
ciao,
Marco
Attachment:
signature.asc
Description: PGP signature