Bug#1069994: systemd-resolved: resolvectl dnssec failed for unsigned domains

[Luca Boccassi]

Control: close -1 256~rc2-1

On Fri, 3 May 2024 14:16:10 +0200 =?utf-8?Q?C=C3=A9dric?= Hannotier
<cedric.hannotier at ulb.be> wrote:
> Dear Luca Boccassi, Dear Maintainers,
> 
> On Sun, 28 Apr 2024 11:42:11 +0100 Luca Boccassi <bluca at debian.org>
wrote:
> > On Sun, 28 Apr 2024 11:53:17 +0200 Adrien CLERC
> > <bugs-debian at antipoul.fr> wrote:
> > > Package: systemd-resolved
> > > Version: 255.5-1
> > > Severity: important
> > > 
> > > Dear Maintainer,
> > > 
> > > Since 255.5-1, resolvectl produces the following:
> > > 
> > > ❯ resolvectl query --validate=yes www.youtube.com
> > > www.youtube.com: resolve call failed: DNSSEC validation failed:
no-
> > signature
> > > 
> > > The domain is unsigned. It worked in 255.4-1+b1, but I'm unable
to
> > rollback,
> > > since it depends on libsystemd which makes a lot of package
unhappy
> > with
> > > dependencies.
> > > 
> > > Did I miss something?
> > > In the meantime, I'll use "DNSSEC=no", but that's not a
definitive
> > answer.
> > > 
> > > Have a nice day,
> > > Adrien
> > > 
> > 
> > There are no resolved patches downstream, report this upstream
> 
> It has been resolved upstream [1] but need backporting for now.
> I think commits to backports from upstream are:
> d840783db5208219c78d73b9b46ef5daae9fea0a
> 5237ffdf2b63a5afea77c3470d9981a2c29643cc
> 414a9b8e5e1e772261b0ffaedc853f5c0aba5719

These are all in unstable and about to migrate to testing, closing

-- 
Kind regards,
Luca Boccassi
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: This is a digitally signed message part
URL: <http://alioth-lists.debian.net/pipermail/pkg-systemd-maintainers/attachments/20240526/fa63f629/attachment.sig>