Bug 2301344
| Summary: | unbound: FTBFS in Fedora rawhide/f41 | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Fedora Release Engineering <releng> | ||||||||
| Component: | unbound | Assignee: | Petr Menšík <pemensik> | ||||||||
| Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> | ||||||||
| Severity: | unspecified | Docs Contact: | |||||||||
| Priority: | unspecified | ||||||||||
| Version: | rawhide | CC: | paul.wouters, pemensik, pj.pandit | ||||||||
| Target Milestone: | --- | ||||||||||
| Target Release: | --- | ||||||||||
| Hardware: | Unspecified | ||||||||||
| OS: | Unspecified | ||||||||||
| Whiteboard: | |||||||||||
| Fixed In Version: | unbound-1.21.1-1.fc41 | Doc Type: | If docs needed, set a value | ||||||||
| Doc Text: | Story Points: | --- | |||||||||
| Clone Of: | Environment: | ||||||||||
| Last Closed: | 2024-10-10 00:16:51 UTC | Type: | --- | ||||||||
| Regression: | --- | Mount Type: | --- | ||||||||
| Documentation: | --- | CRM: | |||||||||
| Verified Versions: | Category: | --- | |||||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||||
| Embargoed: | |||||||||||
| Bug Depends On: | 2296273, 2073068 | ||||||||||
| Bug Blocks: | 2260875, 2255591 | ||||||||||
| Attachments: |
|
||||||||||
|
Description
Fedora Release Engineering
2024-07-29 21:39:38 UTC
Created attachment 2042922 [details]
build.log
file build.log too big, will only attach last 32768 bytes
Created attachment 2042923 [details]
root.log
file root.log too big, will only attach last 32768 bytes
Created attachment 2042924 [details]
state.log
This is caused by change https://fedoraproject.org/wiki/Changes/OpenSSLDistrustSHA1SigVer, where it makes Unbound to fail passing its test suite. This can be avoided by disabling SHA1 completely in Unbound, like we did for RHEL9+ builds. But I do not like that way much, because it does not allow even after configuration change to validate SHA-1 DNSSEC signatures. Which are still a MUST to support, making it deprecated were expired at IETF: https://datatracker.ietf.org/doc/draft-hardaker-dnsop-must-not-sha1/ Oh, it is tracked under different draft: https://datatracker.ietf.org/doc/draft-ietf-dnsop-must-not-sha1/ This is a table, where SHA-1 is still mandatory for validation: https://www.rfc-editor.org/rfc/rfc8624.html#section-3.1 Which with current default policy since F41 is not possible. FEDORA-2024-a5d6cd9f0a (unbound-1.21.1-1.fc41) has been submitted as an update to Fedora 41. https://bodhi.fedoraproject.org/updates/FEDORA-2024-a5d6cd9f0a FEDORA-2024-a5d6cd9f0a has been pushed to the Fedora 41 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2024-a5d6cd9f0a` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2024-a5d6cd9f0a See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates. FEDORA-2024-a5d6cd9f0a (unbound-1.21.1-1.fc41) has been pushed to the Fedora 41 stable repository. If problem still persists, please make note of it in this bug report. |