[git.ipfire.org] IPFire 2.x development tree branch, next, updated. ac747d67d3e6c6cd2b164c67e462ce36402408cc

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. ac747d67d3e6c6cd2b164c67e462ce36402408cc

[Michael Tremer]

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "IPFire 2.x development tree".

The branch, next has been updated
       via  ac747d67d3e6c6cd2b164c67e462ce36402408cc (commit)
      from  c188874cb841fffcbe13dc8e652689630378f388 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit ac747d67d3e6c6cd2b164c67e462ce36402408cc
Author: Matthias Fischer <matthias.fischer@ipfire.org>
Date:   Thu Apr 30 14:35:26 2026 +0200

    unbound: Update to 1.25.0
    
    For details see:
    https://nlnetlabs.nl/projects/unbound/download/#unbound-1-25-0
    
    Changelog is IMHO too long for the list ( ;-) )
    
    I'll just mention "Fix #1404: Priming the root key fails after
    loading ipfire.org RPZ zones. Fixed by including the ZONEMD
    RRtype in the list of types to ignore for RPZ zones. Analysis
    and patch provided by ummeegge."
    
    => Patch for RPZ ZONEMD has been removed accordingly.
    
    Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
    Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

-----------------------------------------------------------------------

Summary of changes:
 config/rootfiles/common/unbound             |  2 +-
 lfs/unbound                                 | 10 +++-------
 src/patches/unbound-rpz-ignore-zonemd.patch | 21 ---------------------
 3 files changed, 4 insertions(+), 29 deletions(-)
 delete mode 100644 src/patches/unbound-rpz-ignore-zonemd.patch

Difference in files:
diff --git a/config/rootfiles/common/unbound b/config/rootfiles/common/unbound
index 1cd18c99d..4ab2ee5b4 100644
--- a/config/rootfiles/common/unbound
+++ b/config/rootfiles/common/unbound
@@ -11,7 +11,7 @@ etc/unbound/unbound.conf
 #usr/lib/libunbound.la
 #usr/lib/libunbound.so
 usr/lib/libunbound.so.8
-usr/lib/libunbound.so.8.1.34
+usr/lib/libunbound.so.8.1.36
 #usr/lib/pkgconfig/libunbound.pc
 usr/sbin/unbound
 usr/sbin/unbound-anchor
diff --git a/lfs/unbound b/lfs/unbound
index 604e3d4d4..b0691e864 100644
--- a/lfs/unbound
+++ b/lfs/unbound
@@ -1,7 +1,7 @@
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2007-2025  IPFire Team  <info@ipfire.org>                     #
+# Copyright (C) 2007-2026  IPFire Team  <info@ipfire.org>                     #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -24,7 +24,7 @@
 
 include Config
 
-VER        = 1.24.2
+VER        = 1.25.0
 
 THISAPP    = unbound-$(VER)
 DL_FILE    = $(THISAPP).tar.gz
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_BLAKE2 = 05a772193a023d6387067b0d6d67a43d1bbfba2ef805a9602a5d3a9bc93d0564d750a7741e9a60d3a7391822131f382c37a9819f51c141fe876a68fce6f8a1c6
+$(DL_FILE)_BLAKE2 = 4c22e198c2257c251505f6845c42e67481edce2c5e8dc0c475584ef6b8e85907c322f32bd7ecfcb06243ba36fb3d91c63d8c1edd67dca66d374c6a242206e548
 
 install : $(TARGET)
 
@@ -71,10 +71,6 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
 	@$(PREBUILD)
 	@rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE)
 
-	# Apply unbound RPZ ZONEMD fix.
-	# Fix should be included in one of the following versions
-	cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/unbound-rpz-ignore-zonemd.patch
-
 	cd $(DIR_APP) && \
 		./configure \
 			--prefix=/usr \
diff --git a/src/patches/unbound-rpz-ignore-zonemd.patch b/src/patches/unbound-rpz-ignore-zonemd.patch
deleted file mode 100644
index c761e52a8..000000000
--- a/src/patches/unbound-rpz-ignore-zonemd.patch
+++ /dev/null
@@ -1,21 +0,0 @@
-Subject: [PATCH] RPZ: ignore ZONEMD records to prevent root priming failure
-
-RPZ zones with apex ZONEMD RR (type 63) create phantom QNAME trigger for root
-zone (.) after strip_dname_origin(), breaking DNSSEC priming:
-"rpz: applied [dbl-ads] . rpz-local-data . DNSKEY IN"
-
-Fixes: https://github.com/NLnetLabs/unbound/issues/1404
-Tested-on: unbound-1.24.2
-
-diff -Nur unbound-1.24.2.orig/services/rpz.c unbound-1.24.2/services/rpz.c
---- unbound-1.24.2.orig/services/rpz.c	2025-11-26 10:16:06.000000000 +0000
-+++ unbound-1.24.2/services/rpz.c	2026-02-16 10:00:46.973582336 +0000
-@@ -160,6 +160,7 @@
- 		case LDNS_RR_TYPE_NSEC:
- 		case LDNS_RR_TYPE_NSEC3:
- 		case LDNS_RR_TYPE_NSEC3PARAM:
-+		case LDNS_RR_TYPE_ZONEMD:
- 			return 1;
- 		default:
- 			break;
-


hooks/post-receive
--
IPFire 2.x development tree