From owner-freebsd-pkg@freebsd.org Sun May 2 18:55:03 2021 Return-Path: Delivered-To: freebsd-pkg@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id E75A962D598 for ; Sun, 2 May 2021 18:55:03 +0000 (UTC) (envelope-from patrick.prugger@uname.at) Received: from mail.uname.at (mail.uname.at [116.202.23.57]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 4FYFfG2dTCz3CCp; Sun, 2 May 2021 18:55:02 +0000 (UTC) (envelope-from patrick.prugger@uname.at) Received: from mail.uname.at (localhost [127.0.0.1]) by mail.uname.at (Postfix) with ESMTP id B26C021C08; Sun, 2 May 2021 20:54:59 +0200 (CEST) From: To: "'Ryan Steinmetz'" Cc: , References: <0a0c01d73ece$22f1dc60$68d59520$@uname.at> In-Reply-To: Subject: AW: DNSSEC Errors on geo.freebsd.org Date: Sun, 2 May 2021 20:54:56 +0200 Message-ID: <002801d73f84$a590eb50$f0b2c1f0$@uname.at> MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Thread-Index: AQHwyv/Ctb3Vf728hH/7q/mmjMCTDwLnGvjdAiH1TBOqdSn9UA== Content-Language: de X-Virus-Scanned: ClamAV using ClamSMTP X-Rspamd-Queue-Id: 4FYFfG2dTCz3CCp X-Spamd-Bar: ---- X-Spamd-Result: default: False [-4.10 / 15.00]; ARC_NA(0.00)[]; RBL_DBL_DONT_QUERY_IPS(0.00)[116.202.23.57:from]; R_DKIM_ALLOW(-0.20)[uname.at:s=2018]; RCVD_IN_DNSWL_LOW(-0.10)[116.202.23.57:from]; RCPT_COUNT_THREE(0.00)[3]; TO_DN_SOME(0.00)[]; TO_MATCH_ENVRCPT_ALL(0.00)[]; R_SPF_ALLOW(-0.20)[+a:mail.uname.at]; MIME_GOOD(-0.10)[text/plain]; NEURAL_HAM_LONG(-1.00)[-1.000]; SPAMHAUS_ZRD(0.00)[116.202.23.57:from:127.0.2.255]; NEURAL_HAM_MEDIUM(-1.00)[-1.000]; DKIM_TRACE(0.00)[uname.at:+]; DMARC_POLICY_ALLOW(-0.50)[uname.at,reject]; FROM_NO_DN(0.00)[]; NEURAL_HAM_SHORT(-1.00)[-1.000]; FROM_EQ_ENVFROM(0.00)[]; MIME_TRACE(0.00)[0:+]; RCVD_TLS_LAST(0.00)[]; ASN(0.00)[asn:24940, ipnet:116.202.0.0/16, country:DE]; MID_RHS_MATCH_FROM(0.00)[]; MAILMAN_DEST(0.00)[freebsd-pkg]; RCVD_COUNT_TWO(0.00)[2] X-BeenThere: freebsd-pkg@freebsd.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Binary package management and package tools discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 02 May 2021 18:55:04 -0000 Hello everyone! After hours of debugging I found out it actually seems to be a bug in = the TLS interface of unbound 1.9.0.2 I just patched to unbound 1.13.1 from buster-backports and now it works. Thanks for your help! Best regards Patrick Prugger -----Urspr=FCngliche Nachricht----- Von: Ryan Steinmetz =20 Gesendet: Sonntag, 2. Mai 2021 01:23 An: Rainer Duffner Cc: patrick.prugger@uname.at; freebsd-pkg@freebsd.org; = dnsadm@freebsd.org Betreff: Re: DNSSEC Errors on geo.freebsd.org On (05/02/21 01:05), Rainer Duffner wrote: > > >> Am 01.05.2021 um 23:08 schrieb patrick.prugger--- via freebsd-pkg : >> >> Hello everyone! >> >> I just turned on DNSSEC validation on my DNS and it came to my eye=20 >> that pkg now doesn't work anymore. >> Pkg is trying to access http://pkgmir.geo.freebsd.org/ to download de = >> repository catalogue. >> >> Unfortunately it seems freebsd.org is signed with DNSSEC, but=20 >> geo.freebsd.org isn't which leads to a DNSSEC error, broken chain of trust. >> For a diagram look here: >> https://dnsviz.net/d/pkgmir.geo.freebsd.org/dnssec/ >> There's no error here and this host does indeed work fine with a = validating recursive resolver. geo.freebsd.org is delegated to a separate set of nameservers which = handle geo-based replies. DNSSEC is intentionally not present on the zone as = the software that responds with dynamic replies and does not currently = support signing those. You should investigate your setup a bit more. -r >> Does anyone here have a contact to the maintainers of the freebsd.org = >> DNS zone? >> > >https://www.freebsd.org/administration/#t-dnsadm > > > -- Ryan Steinmetz PGP: 9079 51A3 34EF 0CD4 F228 EDC6 1EF8 BA6B D028 46D7 From owner-freebsd-pkg@freebsd.org Sun May 2 21:00:18 2021 Return-Path: Delivered-To: freebsd-pkg@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id 25E3D5F9C6E for ; Sun, 2 May 2021 21:00:18 +0000 (UTC) (envelope-from bugzilla-noreply@FreeBSD.org) Received: from mailman.nyi.freebsd.org (unknown [127.0.1.3]) by mx1.freebsd.org (Postfix) with ESMTP id 4FYJQn6rppz3Kl4 for ; Sun, 2 May 2021 21:00:17 +0000 (UTC) (envelope-from bugzilla-noreply@FreeBSD.org) Received: by mailman.nyi.freebsd.org (Postfix) id E47D75F9CB6; Sun, 2 May 2021 21:00:17 +0000 (UTC) Delivered-To: pkg@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id DFC945F9D0D for ; Sun, 2 May 2021 21:00:17 +0000 (UTC) (envelope-from bugzilla-noreply@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4FYJQn4jcxz3KPF for ; Sun, 2 May 2021 21:00:17 +0000 (UTC) (envelope-from bugzilla-noreply@FreeBSD.org) Received: from kenobi.freebsd.org (kenobi.freebsd.org [IPv6:2610:1c1:1:606c::50:1d]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 90AB011BF7 for ; Sun, 2 May 2021 21:00:17 +0000 (UTC) (envelope-from bugzilla-noreply@FreeBSD.org) Received: from kenobi.freebsd.org ([127.0.1.5]) by kenobi.freebsd.org (8.15.2/8.15.2) with ESMTP id 142L0H2l084855 for ; Sun, 2 May 2021 21:00:17 GMT (envelope-from bugzilla-noreply@FreeBSD.org) Received: (from bugzilla@localhost) by kenobi.freebsd.org (8.15.2/8.15.2/Submit) id 142L0Ham084854 for pkg@FreeBSD.org; Sun, 2 May 2021 21:00:17 GMT (envelope-from bugzilla-noreply@FreeBSD.org) Message-Id: <202105022100.142L0Ham084854@kenobi.freebsd.org> X-Authentication-Warning: kenobi.freebsd.org: bugzilla set sender to bugzilla-noreply@FreeBSD.org using -f From: bugzilla-noreply@FreeBSD.org To: pkg@FreeBSD.org Subject: Problem reports for pkg@FreeBSD.org that need special attention Date: Sun, 2 May 2021 21:00:17 +0000 MIME-Version: 1.0 Content-Type: text/plain; charset="UTF-8" X-Content-Filtered-By: Mailman/MimeDel 2.1.34 X-BeenThere: freebsd-pkg@freebsd.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Binary package management and package tools discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 02 May 2021 21:00:18 -0000 To view an individual PR, use: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=(Bug Id). The following is a listing of current problems submitted by FreeBSD users, which need special attention. These represent problem reports covering all versions including experimental development code and obsolete releases. Status | Bug Id | Description ------------+-----------+--------------------------------------------------- Open | 220049 | ports-mgmt/pkg installs unneeded packages Open | 237369 | ports-mgmt/pkg: pkg delete removes required NLS d 2 problems total for which you should take action.