f38: fatal error: auto-trust-anchor-file: "/var/lib/unbound/root.key" does not exist

[cagney]

nic on f38:

-- Boot 3b522066494a409bbb0b9109c9e6740e --
Oct 16 18:07:51 nic systemd[1]: Starting unbound.service - Unbound recursive Domain Name Server...
Oct 16 18:07:51 nic unbound-checkconf[505]: /var/lib/unbound/root.key: No such file or directory
Oct 16 18:07:51 nic unbound-checkconf[505]: [1697494071] unbound-checkconf[505:0] fatal error: auto-trust-anchor-file: "/var/lib/unbound/root.key" does not exist
Oct 16 18:07:51 nic systemd[1]: unbound.service: Control process exited, code=exited, status=1/FAILURE
Oct 16 18:07:51 nic systemd[1]: unbound.service: Failed with result 'exit-code'.
Oct 16 18:07:51 nic systemd[1]: Failed to start unbound.service - Unbound recursive Domain Name Server.

enable by adding:

KVM_FEDORA_ISO_URL = https://download.fedoraproject.org/pub/fedora/linux/releases/38/Server/x86_64/iso/Fedora-Server-dvd-x86_64-38-1.6.iso

to Makefile.inc.local and then run ./kvm base install check ikev2-71-cp-resolve-name

[cagney]

[root@nic ikev2-71-cp-resolve-name]# ls -l /var/lib/unbound/root.key
lrwxrwxrwx. 1 root root 36 Aug 31 20:00 /var/lib/unbound/root.key -> ../../../etc/unbound/dnssec-root.key
[root@nic ikev2-71-cp-resolve-name]# ls -l /etc/unbound/dnssec-root.key
ls: cannot access '/etc/unbound/dnssec-root.key': No such file or directory

# ls -ld1 /testing/baseconfigs/all/etc/unbound/root.*
-rw-r--r--. 1 1000 1000 409 Mar 14  2023 /testing/baseconfigs/all/etc/unbound/root.anchor
-rw-r--r--. 1 1000 1000 556 Mar 14  2023 /testing/baseconfigs/all/etc/unbound/root.key

[cagney]

copying root.key to dnssec-root.key leads to:

Oct 16 19:21:44 nic systemd[1]: Starting unbound.service - Unbound recursive Domain Name Server...
Oct 16 19:21:44 nic unbound-checkconf[609]: [1697498504] unbound-checkconf[609:0] error: ldns error while converting string to RR at15: Syntax error, could not parse the RR's type: trusted-keys {
Oct 16 19:21:44 nic unbound-checkconf[609]: [1697498504] unbound-checkconf[609:0] error: failed to load trust anchor from /var/lib/unbound/root.key at line 3, skipping
Oct 16 19:21:44 nic unbound-checkconf[609]: [1697498504] unbound-checkconf[609:0] error: ldns error while converting string to RR at10: Syntax error, could not parse the RR's type: "." 257 3 8 "AwE>
Oct 16 19:21:44 nic unbound-checkconf[609]: [1697498504] unbound-checkconf[609:0] error: failed to load trust anchor from /var/lib/unbound/root.key at line 4, skipping
Oct 16 19:21:44 nic unbound-checkconf[609]: [1697498504] unbound-checkconf[609:0] error: ldns error while converting string to RR at3: Syntax error, could not parse the RR's TTL: };
Oct 16 19:21:44 nic unbound-checkconf[609]: [1697498504] unbound-checkconf[609:0] error: failed to load trust anchor from /var/lib/unbound/root.key at line 6, skipping
Oct 16 19:21:44 nic unbound-checkconf[609]: [1697498504] unbound-checkconf[609:0] error: failed to read /var/lib/unbound/root.key
Oct 16 19:21:44 nic unbound-checkconf[609]: [1697498504] unbound-checkconf[609:0] error: error reading auto-trust-anchor-file: /var/lib/unbound/root.key
Oct 16 19:21:44 nic unbound-checkconf[609]: [1697498504] unbound-checkconf[609:0] error: validator: error in trustanchors config
Oct 16 19:21:44 nic unbound-checkconf[609]: [1697498504] unbound-checkconf[609:0] error: validator: could not apply configuration settings.
Oct 16 19:21:44 nic unbound-checkconf[609]: [1697498504] unbound-checkconf[609:0] fatal error: bad config for validator module
Oct 16 19:21:44 nic systemd[1]: unbound.service: Control process exited, code=exited, status=1/FAILURE

[letoams]

It’s the wrong format file.I’ll have a look

[bleve]

It’s the wrong format file.I’ll have a look

That is likely when Petr replaced /var/lib/unbound/root.key with symlink pointing at /etc/unbound/dnssec-root.key. But from fedora unbound spec it looks like he used correct key file.

[cagney]

so creating testing/baseconfigs/all/etc/unbound/dnssec-root.key while leaving testing/baseconfigs/all/etc/unbound/root.key alone should let f36 and f38 both work.

[bleve]

Very likely yes.

[cagney]

new format c2e2636
new file c2e2636