unbound failed to build from source in Fedora rawhide/f41 https://koji.fedoraproject.org/koji/taskinfo?taskID=120787199 For details on the mass rebuild see: https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild Please fix unbound at your earliest convenience and set the bug's status to ASSIGNED when you start fixing it. If the bug remains in NEW state for 8 weeks, unbound will be orphaned. Before branching of Fedora 42, unbound will be retired, if it still fails to build. For more details on the FTBFS policy, please visit: https://docs.fedoraproject.org/en-US/fesco/Fails_to_build_from_source_Fails_to_install/
Created attachment 2042922 [details] build.log file build.log too big, will only attach last 32768 bytes
Created attachment 2042923 [details] root.log file root.log too big, will only attach last 32768 bytes
Created attachment 2042924 [details] state.log
This is caused by change https://fedoraproject.org/wiki/Changes/OpenSSLDistrustSHA1SigVer, where it makes Unbound to fail passing its test suite. This can be avoided by disabling SHA1 completely in Unbound, like we did for RHEL9+ builds. But I do not like that way much, because it does not allow even after configuration change to validate SHA-1 DNSSEC signatures. Which are still a MUST to support, making it deprecated were expired at IETF: https://datatracker.ietf.org/doc/draft-hardaker-dnsop-must-not-sha1/
Oh, it is tracked under different draft: https://datatracker.ietf.org/doc/draft-ietf-dnsop-must-not-sha1/ This is a table, where SHA-1 is still mandatory for validation: https://www.rfc-editor.org/rfc/rfc8624.html#section-3.1 Which with current default policy since F41 is not possible.
FEDORA-2024-a5d6cd9f0a (unbound-1.21.1-1.fc41) has been submitted as an update to Fedora 41. https://bodhi.fedoraproject.org/updates/FEDORA-2024-a5d6cd9f0a
FEDORA-2024-a5d6cd9f0a has been pushed to the Fedora 41 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2024-a5d6cd9f0a` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2024-a5d6cd9f0a See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2024-a5d6cd9f0a (unbound-1.21.1-1.fc41) has been pushed to the Fedora 41 stable repository. If problem still persists, please make note of it in this bug report.