Bug 2116790

Summary: unbound-keygen requires openssl [fedora]
Product: [Fedora] Fedora Reporter: Petr Menšík <pemensik>
Component: unboundAssignee: Paul Wouters <paul.wouters>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 37CC: aegorenkov.91, akhaitovich, bnater, bstinson, jakob, jwboyer, mharri, paul.wouters, pemensik, pj.pandit, psklenar
Target Milestone: ---Keywords: Triaged
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: unbound-1.16.2-3.fc36 unbound-1.16.2-3.fc35 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: 2018806 Environment:
Last Closed: 2022-08-12 01:38:24 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2018806, 2116802    
Bug Blocks:    

Description Petr Menšík 2022-08-09 10:07:50 UTC
+++ This bug was initially created as a clone of Bug #2018806 +++

On a system without openssl installed, the unbound-keygen keygen service will fail:

# systemctl status unbound-keygen.service
● unbound-keygen.service - Unbound Control Key And Certificate Generator
   Loaded: loaded (/usr/lib/systemd/system/unbound-keygen.service; disabled; vendor preset: disabled)
   Active: failed (Result: exit-code) since Sun 2021-10-31 11:28:45 UTC; 2min 16s ago
  Process: 294605 ExecStart=/usr/sbin/unbound-control-setup -d /etc/unbound/ (code=exited, status=1/FAILURE)
 Main PID: 294605 (code=exited, status=1/FAILURE)

Oct 31 11:28:45 vwb01-00.srv.example.net systemd[1]: Starting Unbound Control Key And Certificate Generator...
Oct 31 11:28:45 vwb01-00.srv.example.net unbound-control-setup[294605]: setup in directory /etc/unbound/
Oct 31 11:28:45 vwb01-00.srv.example.net unbound-control-setup[294605]: generating unbound_server.key
Oct 31 11:28:45 vwb01-00.srv.example.net unbound-control-setup[294605]: /usr/sbin/unbound-control-setup: line 100: openssl: command not found
Oct 31 11:28:45 vwb01-00.srv.example.net unbound-control-setup[294605]: /usr/sbin/unbound-control-setup fatal error: could not genrsa
Oct 31 11:28:45 vwb01-00.srv.example.net systemd[1]: unbound-keygen.service: Main process exited, code=exited, status=1/FAILURE
Oct 31 11:28:45 vwb01-00.srv.example.net systemd[1]: unbound-keygen.service: Failed with result 'exit-code'.
Oct 31 11:28:45 vwb01-00.srv.example.net systemd[1]: Failed to start Unbound Control Key And Certificate Generator.

# rpm -qi unbound
Name        : unbound
Version     : 1.7.3
Release     : 17.el8
Architecture: x86_64
Install Date: Sun Oct 31 11:11:01 2021
Group       : Unspecified
Size        : 5344276
License     : BSD
Signature   : RSA/SHA256, Mon May 17 16:12:40 2021, Key ID 05b555b38483c65d
Source RPM  : unbound-1.7.3-17.el8.src.rpm
Build Date  : Mon May 17 15:16:07 2021
Build Host  : x86-02.mbox.centos.org
Relocations : (not relocatable)
Packager    : CentOS Buildsys <bugs>
Vendor      : CentOS
URL         : https://www.unbound.net/
Summary     : Validating, recursive, and caching DNS(SEC) resolver
Description :
Unbound is a validating, recursive, and caching DNS(SEC) resolver.

The C implementation of Unbound is developed and maintained by NLnet
Labs. It is based on ideas and algorithms taken from a java prototype
developed by Verisign labs, Nominet, Kirei and ep.net.

Unbound is designed as a set of modular components, so that also
DNSSEC (secure DNS) validation and stub-resolvers (that do not run
as a server, but are linked into an application) are easily possible.

It should have a dependency on it

Comment 1 Paul Wouters 2022-08-09 12:37:58 UTC
I think this feature should not be abled by default anymore. It used to be the only way for unbound-control to work, but it can now use a socket directly.

maybe default unbound.conf to no longer use it per default, and ship the keygen service but dont activate it so those who do want an TLS cert can still get one? Although those people might want an ACME cert anyway, so perhaps just delete the whole thing?

Comment 2 Fedora Update System 2022-08-09 13:30:54 UTC
FEDORA-2022-e021f05d21 has been submitted as an update to Fedora 36. https://bodhi.fedoraproject.org/updates/FEDORA-2022-e021f05d21

Comment 3 Fedora Update System 2022-08-09 13:31:56 UTC
FEDORA-2022-28fbfb87ef has been submitted as an update to Fedora 35. https://bodhi.fedoraproject.org/updates/FEDORA-2022-28fbfb87ef

Comment 4 Ben Cotton 2022-08-09 13:36:34 UTC
This bug appears to have been reported against 'rawhide' during the Fedora Linux 37 development cycle.
Changing version to 37.

Comment 5 Fedora Update System 2022-08-10 01:38:56 UTC
FEDORA-2022-f89beb0640 has been pushed to the Fedora 36 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2022-f89beb0640`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2022-f89beb0640

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 6 Fedora Update System 2022-08-10 02:10:22 UTC
FEDORA-2022-0a914d5c6b has been pushed to the Fedora 35 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2022-0a914d5c6b`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2022-0a914d5c6b

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 7 Fedora Update System 2022-08-12 01:38:24 UTC
FEDORA-2022-f89beb0640 has been pushed to the Fedora 36 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 8 Fedora Update System 2022-08-25 07:47:49 UTC
FEDORA-2022-0a914d5c6b has been pushed to the Fedora 35 stable repository.
If problem still persists, please make note of it in this bug report.