On Mon, 3 Sep 2018 17:18:41 +0200 "Santiago R.R." <santiag...@riseup.net> wrote: > Source: dnsmasq > Version: 2.72-3+deb8u2 > Severity: important > Tags: patch > > Hi Simon, > > The DNS Root Key Signing Key (KSK) Rollover is scheduled for 11 October > 2018 [1]. After this date, DNS resolvers will need to have the new key > (KSK-2017) to perform DNSSEC validation. > > [1] https://www.icann.org/news/announcement-2018-08-22-en
Hi Simon, Please find attached a NMU debdiff that would include the KSK in stretch. May I proceed and ask release team approval, or do you want to handle the change by yourself? Cheers, -- Santiago
diff -u dnsmasq-2.76/debian/changelog dnsmasq-2.76/debian/changelog --- dnsmasq-2.76/debian/changelog +++ dnsmasq-2.76/debian/changelog @@ -1,3 +1,11 @@ +dnsmasq (2.76-5+deb9u1.1) stretch; urgency=medium + + * Non-maintainer upload. + * trust-anchors.conf: include latest DNS trust anchor KSK-2017. + (Closes: #907887) + + -- Santiago Ruano Rincón <santiag...@riseup.net> Fri, 21 Sep 2018 17:06:18 +0200 + dnsmasq (2.76-5+deb9u1) stretch-security; urgency=high * Non-maintainer upload by the Security Team. only in patch2: unchanged: --- dnsmasq-2.76.orig/trust-anchors.conf +++ dnsmasq-2.76/trust-anchors.conf @@ -1,9 +1,10 @@ -# The root DNSSEC trust anchor, valid as at 30/01/2014 +# The root DNSSEC trust anchor, valid as at 10/02/2017 # Note that this is a DS record (ie a hash of the root Zone Signing Key) # If was downloaded from https://data.iana.org/root-anchors/root-anchors.xml trust-anchor=.,19036,8,2,49AAC11D7B6F6446702E54A1607371607A1A41855200FD2CE1CDDE32F24E8FB5 +trust-anchor=.,20326,8,2,E06D44B80B8F1D39A95C0B0D7C65D08458E880409BBC683457104237C7F8EC8D
signature.asc
Description: PGP signature
