From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4g5ttr5LFNz3356 for ; Thu, 30 Apr 2026 12:35:48 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [IPv6:2001:678:b28::25]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1 raw public key) server-digest SHA384 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mail01.haj.ipfire.org", Issuer "R12" (not verified)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4g5ttn2VXWz2xMD for ; Thu, 30 Apr 2026 12:35:45 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4g5ttl3FGpz5Xq; Thu, 30 Apr 2026 12:35:43 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1777552543; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=RwgHTL9zWDetsBK/xvchspjkRm9JGIAVoAMgzB233Us=; b=UGBEprI/HLBl9rN7tfpUzk2cchJNUVTng0bZOJv6fb/6bsLXLaIrrC9HUm8eHSmhLQP/rR dbuUfNqeFbyYybAw== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1777552543; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=RwgHTL9zWDetsBK/xvchspjkRm9JGIAVoAMgzB233Us=; b=ZNHEMmhPOjJZiGvBMeGQ4ilw84EamqCa5bUwPBXi+BASVMCNrO0tRel+KjNQo2H9PobP0F mhS68U9FVMwtO3chdJv3FcmgJCgpW4iV/QdlmbrfmgbEolbgzKj02xjHcfb6JsVI8Q3PoC 8JTZnwBSyVYKga5IDO8yNjvwMSPGjZsK1a3JcDfSG5eq6fXtr7mY67ZgRDfhbcRKky750R YWdqzvltdAGSQ72zG2h1m4EhV8STgNbYlDrfxPF19G3iywL5cJmsBvh7F1KaPH9ghbbEgH R0th22OBjNA5HD94TBMVYq3GuBuerVH/0vHq+xmeFfuAfJJKCT9wWvAz0H41QA== From: Matthias Fischer To: development@lists.ipfire.org Cc: Matthias Fischer Subject: [PATCH] unbound: Update to 1.25.0 Date: Thu, 30 Apr 2026 14:35:26 +0200 Message-ID: <20260430123535.3419351-1-matthias.fischer@ipfire.org> Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit For details see: https://nlnetlabs.nl/projects/unbound/download/#unbound-1-25-0 Changelog is IMHO too long for the list ( ;-) ) I'll just mention "Fix #1404: Priming the root key fails after loading ipfire.org RPZ zones. Fixed by including the ZONEMD RRtype in the list of types to ignore for RPZ zones. Analysis and patch provided by ummeegge." => Patch for RPZ ZONEMD has been removed accordingly. Signed-off-by: Matthias Fischer --- config/rootfiles/common/unbound | 2 +- lfs/unbound | 10 +++------- src/patches/unbound-rpz-ignore-zonemd.patch | 21 --------------------- 3 files changed, 4 insertions(+), 29 deletions(-) delete mode 100644 src/patches/unbound-rpz-ignore-zonemd.patch diff --git a/config/rootfiles/common/unbound b/config/rootfiles/common/unbound index 1cd18c99d..4ab2ee5b4 100644 --- a/config/rootfiles/common/unbound +++ b/config/rootfiles/common/unbound @@ -11,7 +11,7 @@ etc/unbound/unbound.conf #usr/lib/libunbound.la #usr/lib/libunbound.so usr/lib/libunbound.so.8 -usr/lib/libunbound.so.8.1.34 +usr/lib/libunbound.so.8.1.36 #usr/lib/pkgconfig/libunbound.pc usr/sbin/unbound usr/sbin/unbound-anchor diff --git a/lfs/unbound b/lfs/unbound index 604e3d4d4..b0691e864 100644 --- a/lfs/unbound +++ b/lfs/unbound @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2025 IPFire Team # +# Copyright (C) 2007-2026 IPFire Team # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 1.24.2 +VER = 1.25.0 THISAPP = unbound-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 05a772193a023d6387067b0d6d67a43d1bbfba2ef805a9602a5d3a9bc93d0564d750a7741e9a60d3a7391822131f382c37a9819f51c141fe876a68fce6f8a1c6 +$(DL_FILE)_BLAKE2 = 4c22e198c2257c251505f6845c42e67481edce2c5e8dc0c475584ef6b8e85907c322f32bd7ecfcb06243ba36fb3d91c63d8c1edd67dca66d374c6a242206e548 install : $(TARGET) @@ -71,10 +71,6 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE) - # Apply unbound RPZ ZONEMD fix. - # Fix should be included in one of the following versions - cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/unbound-rpz-ignore-zonemd.patch - cd $(DIR_APP) && \ ./configure \ --prefix=/usr \ diff --git a/src/patches/unbound-rpz-ignore-zonemd.patch b/src/patches/unbound-rpz-ignore-zonemd.patch deleted file mode 100644 index c761e52a8..000000000 --- a/src/patches/unbound-rpz-ignore-zonemd.patch +++ /dev/null @@ -1,21 +0,0 @@ -Subject: [PATCH] RPZ: ignore ZONEMD records to prevent root priming failure - -RPZ zones with apex ZONEMD RR (type 63) create phantom QNAME trigger for root -zone (.) after strip_dname_origin(), breaking DNSSEC priming: -"rpz: applied [dbl-ads] . rpz-local-data . DNSKEY IN" - -Fixes: https://github.com/NLnetLabs/unbound/issues/1404 -Tested-on: unbound-1.24.2 - -diff -Nur unbound-1.24.2.orig/services/rpz.c unbound-1.24.2/services/rpz.c ---- unbound-1.24.2.orig/services/rpz.c 2025-11-26 10:16:06.000000000 +0000 -+++ unbound-1.24.2/services/rpz.c 2026-02-16 10:00:46.973582336 +0000 -@@ -160,6 +160,7 @@ - case LDNS_RR_TYPE_NSEC: - case LDNS_RR_TYPE_NSEC3: - case LDNS_RR_TYPE_NSEC3PARAM: -+ case LDNS_RR_TYPE_ZONEMD: - return 1; - default: - break; - -- 2.53.0