Marco d'Itri [15/Oct 11:28am +02] wrote: > Package: debian-policy > Version: 4.7.4.1 > Severity: normal > > DNSSEC-enabled DNS resolvers must depend on the dns-root-data package > instead of shipping built-in trust anchors. > The dns-root-data is a trivial, arch:all package whose only purpose is > to provide a current DNS root zone and DNSSEC trust anchors, even for > end of support Debian releases. > > Short summary for people who are not familiar with DNSSEC: domains > resolution will stop working if the trust anchors are not up to date. > There is a mechanism (RFC 5011) to update them automatically in band, > but it requires that the resolver was working *before* the rollover. > > Due to complex reasons (pandemic, end of life HSMs...) only three root > zone KSKs have been deployed so far[1] since 2010, the most recent one > last Sunday, but the current IANA plan[1] is to rotate the root KSK > every 3 years. This means that this failure will be much more frequent > in the future. > > Most important DNS resolvers already depend on dns-root-data: bind9, > pdns-recursor, knot-resolver6. > Some important DNS resolvers only recommend dns-root-data: unbound, > dnsmasq-base. > Only one important DNS resolver does not use dns-root-data (but AFAICT > could with just a symlink): systemd-resolved. > > Embarrassing failures: > https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1150730 > https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/2170538 > > [1] https://www.iana.org/dnssec/files > [2] > https://www.icann.org/en/system/files/files/proposal-future-rz-ksk-rollovers-01nov19-en.pdf
Sounds reasonable, patches welcome please. -- Sean Whitton
