Dear maintainer:

During a rebuild of all packages in unstable with the system clock set
at 2030-08-09 (estimated to be three years after the release date of forky),
this package failed to build.

Below you will find the last part of the build log (probably the most
relevant part, but not necessarily). If required, the full build log
is available here:

https://people.debian.org/~sanvila/build-logs/ftbfs-future/

About the archive rebuild: This is an effort to keep forky free from
FTBFS bugs during its lifetime as a supported distribution, as
explained here for trixie:

https://lists.debian.org/debian-devel/2024/05/msg00414.html

This category of bugs is considered to be RC for forky, but I will
wait two months from now before raising to serious to give people a
little bit more time to fix them.

The build was made using sbuild and a reduced chroot with only
build-essential packages.

If you cannot reproduce the bug please contact me privately, as I
am willing to provide ssh access to a virtual machine where the bug is
fully reproducible.

If this is really a bug in one of the build-depends, please use
reassign and add an affects on src:dns-root-data, so that this is still
visible in the BTS web page for this package.

Thanks.
--------------------------------------------------------------------------------
[...]
 debian/rules clean
dh clean
   dh_clean
 debian/rules binary
dh binary
   dh_update_autotools_config
   dh_autoreconf
   debian/rules override_dh_auto_build
make[1]: Entering directory '/<<PKGBUILDDIR>>'
# Verify root-anchors.xml using OpenSSL
openssl smime -verify -CAfile icannbundle.pem -inform DER -in root-anchors.p7s -content root-anchors.xml -out /dev/null
Verification failure
40374256DD7F0000:error:10800075:PKCS7 routines:PKCS7_verify:certificate verify error:../crypto/pkcs7/pk7_smime.c:297:Verify error: certificate has expired
make[1]: *** [debian/rules:12: override_dh_auto_build] Error 4
make[1]: Leaving directory '/<<PKGBUILDDIR>>'
make: *** [debian/rules:8: binary] Error 2
dpkg-buildpackage: error: debian/rules binary subprocess failed with exit status 2
--------------------------------------------------------------------------------

Control: tag -1 wontfix
The plan from now on is to roll the root KSK about every 3 years, so
I will need to update the package at least in 2027.

https://blog.verisign.com/security/2024-2026-root-zone-ksk-rollover-initial-observations/
https://www.icann.org/ru/public-comment/proceeding/proposed-root-ksk-algorithm-rollover-03-02-2026

severity 1127116 normal
thanks

Thanks for this extra documentation.

I'm downgrading to normal to remind myself not to raise this bug to
serious (and as it happened in trixie, I request and will appreciate
that you allow me to keep it open for tracking purposes).

However, this does not explain what would be wrong with allowing the
package to be built after the expiry date in the spirit of
reproducible-builds, as the package could perfectly be built after
such date with minor changes to debian/rules.

We could say that currently we have both a runtime time-bomb and a
buildtime time-bomb. Do they really have to be in sync? (My theory is
that we would be better with no build-time bomb at all, that would
certainly make my life easier regarding this effort).

Thanks.

The issue is that it would not be possibile to verify the data at build
time.

Considering that:
a) there is probably not going to be any practical reason which will
    actually require to rebuild the package, and
b) the package will have to be be updated in stable at least once before
    the certificate expires

I see no reason to disable the verification.

Greetings,

IANA has published the new certificate and updated icannbundle.pem.

The updated bundle contains both the current and replacement CA certificates. It is available at: https://data.iana.org/root-anchors/icannbundle.pem

Signatures chaining to the new certificate are expected to be published in 2028.

The version currently available in Debian sid and forky (dns-root-data version 2025080400) contains the previous certificate bundle:
https://sources.debian.org/src/dns-root-data/2025080400/icannbundle.pem

Could you please review whether icannbundle.pem in the package should now be updated to match the current bundle published by IANA?

For reference, considerations for updating this validation material are described in DNSSEC Trust Anchor Publication for the Root Zone (RFC 9718).

Thank you for maintaining this package.

Best regards,