Bug 1720380 - wrong files in sub package bind-dnssec-utils
Summary: wrong files in sub package bind-dnssec-utils
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: bind
Version: 31
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Petr Menšík
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2019-06-13 21:12 UTC by Paul Wouters
Modified: 2019-10-14 16:40 UTC (History)
8 users (show)

Fixed In Version: bind-9.11.11-1.fc31 bind-9.11.11-1.fc30
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2019-10-08 00:26:54 UTC
Type: Bug


Attachments (Terms of Use)

Description Paul Wouters 2019-06-13 21:12:41 UTC
Note that I think the split out of bind-utils and bind-dnssec-utils is wrong. 

Ignoring the man pages for now, I see:

%files dnssec-utils
%{_sbindir}/ddns-confgen
%{_sbindir}/tsig-keygen
%{_sbindir}/genrandom
%{_sbindir}/nsec3hash
%{_sbindir}/dnssec*
%if %{with PKCS11}
%exclude %{_sbindir}/dnssec*pkcs11
%endif
%{_sbindir}/isc-hmac-fixup
%{_sbindir}/named-checkzone
%{_sbindir}/named-compilezone
%if %{with LMDB}
%{_sbindir}/named-nzd2nzf
%endif


tsig-keygen and ddns-confgen is used for Dynamic Updates and for AXFR/IXFR protection. Neither is related to DNSSEC and these should be moved back to bind-utils since these are used for both named server and dhcp Dynamic Updates client operations.

I dont know which tools call genrandom, it is likely more than just the dnssec* tools, so this tool too should move back into bind-utils

named-checkzone and named-compilezone and isc-hmac-fixup and named-nzd2nzf are also needed for all non-dnssec operations, and are often run on scripts on the primary nameserver to verify zonefiles before loading them in the primary server. Again, not related to dnssec. If you want to move these out of bind-utils, they should go into the package that has the bind daemon, not in a -utils package.

Personally, I think the split from bind-utils makes little sense and prefer it would be moved back into a single package bind-utils package again.

Comment 1 Petr Menšík 2019-07-17 19:06:15 UTC
The move was important especially because two dnssec utils are python based. That way, bind-utils bring python3 into containers that needs only dig and host tools installed. That was the main reason for the split.

When examining requirements of bind-utils, I found all packages that needs bind-utils needs just dig, host or nslookup. Only freeipa-server requires also bind-pkcs11-utils.

I admit I did not choose best name for new subpackage. tsig-keygen and ddns-confgen are usually required just with bind package installed. I admit more tools are included that are not really DNSSEC related. But they are all kind of administrator utilities only useful for DNS server operators. Not client utilities bind-utils usually provides.

I wil not move it all back because of python dependency. I may move back named-checkzone and named-compilezone with ddns-confgen tools, since they do not bring any new dependency. I thought they make more sense together with administrator related things, but lacked idea for a better name. The only single package that uses named-compilezone is nsdiff I made. I do not know any other packages.

Do you know any other projects that need any mentioned tools but do not require bind package? I am thinking about moving them back to bind package like they were long time ago.

I admit Debian has similar split of utilities as I did, but bind-utils are dnsutils package, where bind9utils are more server centric. They have better named (sub)packages, but moving dig to different package is not an option.
I needed some different name and chosen DNSSEC as main difference. Not the great option, but does not make any conflicts or unnecessary conflicts. Altogether, they have just not a great name, but the split makes sense to me.

Comment 2 Ben Cotton 2019-08-13 17:04:59 UTC
This bug appears to have been reported against 'rawhide' during the Fedora 31 development cycle.
Changing version to '31'.

Comment 3 Ben Cotton 2019-08-13 19:01:21 UTC
This bug appears to have been reported against 'rawhide' during the Fedora 31 development cycle.
Changing version to 31.

Comment 4 Petr Menšík 2019-09-05 19:16:24 UTC
Fixed in rawhide build, not yet in stable branches.

Comment 5 Fedora Update System 2019-10-03 10:19:58 UTC
FEDORA-2019-3405ab3960 has been submitted as an update to Fedora 31. https://bodhi.fedoraproject.org/updates/FEDORA-2019-3405ab3960

Comment 6 Fedora Update System 2019-10-03 10:23:50 UTC
FEDORA-2019-a2be1cb2e4 has been submitted as an update to Fedora 30. https://bodhi.fedoraproject.org/updates/FEDORA-2019-a2be1cb2e4

Comment 7 Fedora Update System 2019-10-04 22:14:24 UTC
bind-9.11.11-1.fc30 has been pushed to the Fedora 30 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2019-a2be1cb2e4

Comment 8 Fedora Update System 2019-10-04 22:50:15 UTC
bind-9.11.11-1.fc31 has been pushed to the Fedora 31 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2019-3405ab3960

Comment 9 Fedora Update System 2019-10-08 00:26:54 UTC
bind-9.11.11-1.fc31 has been pushed to the Fedora 31 stable repository. If problems still persist, please make note of it in this bug report.

Comment 10 Fedora Update System 2019-10-14 16:40:43 UTC
bind-9.11.11-1.fc30 has been pushed to the Fedora 30 stable repository. If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.