Separate ldns replacement package (#145)

* Move ldns obsoletion to separate package

* Remove proposed channel from pkg-test

The packages published in proposed are so outdated, they fail pkg-test
anyway.

* Remove EOL versions from build targets

* Update Dockerfile base image to alpine 2.23

* Remove systemd macros from scriptlets

* Change version to 0.2.0-alpha1
This commit is contained in:
Jannik Peters
2026-03-05 13:11:30 +01:00
committed by GitHub
parent 76035ccac5
commit 9c1d36a3af
20 changed files with 308 additions and 118 deletions
+14 -1
View File
@@ -11,7 +11,7 @@ on:
workflow_dispatch:
jobs:
package:
package-dnst:
uses: NLnetLabs/ploutos/.github/workflows/pkg-rust.yml@v9
secrets:
DOCKER_HUB_ID: ${{ vars.DOCKER_HUB_ID }}
@@ -31,3 +31,16 @@ jobs:
deb_extra_build_packages: libssl-dev
rpm_extra_build_packages: make openssl-devel
rpm_scriptlets_path: pkg/rpm/scriptlets.toml
package-dnst-ldnsutils:
# Package empty dnst-ldnsutils package to create symlinks
uses: NLnetLabs/ploutos/.github/workflows/pkg-rust.yml@v9
with:
package_build_rules: pkg/dnst-ldnsutils/pkg/rules/packages-to-build.yml
package_test_rules: pkg/dnst-ldnsutils/pkg/rules/packages-to-test.yml
package_test_scripts_path: pkg/dnst-ldnsutils/pkg/test-scripts/test-<package>.sh
rpm_scriptlets_path: pkg/dnst-ldnsutils/pkg/rpm/scriptlets.toml
manifest_dir: pkg/dnst-ldnsutils
artifact_prefix: dnst-ldnsutils
Generated
+1 -1
View File
@@ -321,7 +321,7 @@ dependencies = [
[[package]]
name = "dnst"
version = "0.1.1-dev"
version = "0.2.0-alpha1"
dependencies = [
"bytes",
"chrono",
+1 -24
View File
@@ -1,6 +1,6 @@
[package]
name = "dnst"
version = "0.1.1-dev"
version = "0.2.0-alpha1"
edition = "2021"
default-run = "dnst"
readme = "README.md"
@@ -99,19 +99,10 @@ assets = [
["doc/manual/build/man/dnst-nsec3-hash.1", "/usr/share/man/man1/dnst-nsec3-hash.1", "644"],
["doc/manual/build/man/dnst-signzone.1", "/usr/share/man/man1/dnst-signzone.1", "644"],
["doc/manual/build/man/dnst-update.1", "/usr/share/man/man1/dnst-update.1", "644"],
["doc/manual/build/man/ldns-key2ds.1", "/usr/share/man/man1/ldns-key2ds.1", "644"],
["doc/manual/build/man/ldns-keygen.1", "/usr/share/man/man1/ldns-keygen.1", "644"],
["doc/manual/build/man/ldns-notify.1", "/usr/share/man/man1/ldns-notify.1", "644"],
["doc/manual/build/man/ldns-nsec3-hash.1", "/usr/share/man/man1/ldns-nsec3-hash.1", "644"],
["doc/manual/build/man/ldns-signzone.1", "/usr/share/man/man1/ldns-signzone.1", "644"],
["doc/manual/build/man/ldns-update.1", "/usr/share/man/man1/ldns-update.1", "644"],
]
changelog = "target/debian/changelog" # this will be generated by the pkg workflow
copyright = "Copyright (c) 2024, NLnet Labs. All rights reserved."
maintainer-scripts = "pkg/debian"
# See: https://www.debian.org/doc/debian-policy/ch-relationships.html#replacing-whole-packages-forcing-their-removal
conflicts = "ldnsutils"
replaces = "ldnsutils"
# Related reading: https://docs.fedoraproject.org/en-US/packaging-guidelines/Rust/
[package.metadata.generate-rpm]
@@ -126,18 +117,4 @@ assets = [
{ source = "doc/manual/build/man/dnst-nsec3-hash.1", dest = "/usr/share/man/man1/dnst-nsec3-hash.1", mode = "644", doc = true },
{ source = "doc/manual/build/man/dnst-signzone.1", dest = "/usr/share/man/man1/dnst-signzone.1", mode = "644", doc = true },
{ source = "doc/manual/build/man/dnst-update.1", dest = "/usr/share/man/man1/dnst-update.1", mode = "644", doc = true },
{ source = "doc/manual/build/man/ldns-key2ds.1", dest = "/usr/share/man/man1/ldns-key2ds.1", mode = "644", doc = true },
{ source = "doc/manual/build/man/ldns-keygen.1", dest = "/usr/share/man/man1/ldns-keygen.1", mode = "644", doc = true },
{ source = "doc/manual/build/man/ldns-notify.1", dest = "/usr/share/man/man1/ldns-notify.1", mode = "644", doc = true },
{ source = "doc/manual/build/man/ldns-nsec3-hash.1", dest = "/usr/share/man/man1/ldns-nsec3-hash.1", mode = "644", doc = true },
{ source = "doc/manual/build/man/ldns-signzone.1", dest = "/usr/share/man/man1/ldns-signzone.1", mode = "644", doc = true },
{ source = "doc/manual/build/man/ldns-update.1", dest = "/usr/share/man/man1/ldns-update.1", mode = "644", doc = true },
]
# These get set using cargo-generate-rpm --set-metadata at package build time.
#post_trans_script = ...
#post_uninstall_script = ...
# Set Obsoletes per https://docs.fedoraproject.org/en-US/packaging-guidelines/#renaming-or-replacing-existing-packages.
[package.metadata.generate-rpm.obsoletes]
ldns-utils = "< 0:1.8.4-2"
+1 -1
View File
@@ -44,7 +44,7 @@ ARG MODE=build
# ========
#
# Only used when MODE=build.
ARG BASE_IMG=alpine:3.21
ARG BASE_IMG=alpine:3.23
# CARGO_ARGS
-7
View File
@@ -2,12 +2,5 @@
# case "$1" in
# configure)
# # Create symbolic links
# ln -f -s /usr/bin/dnst /usr/bin/ldns-keygen
# ln -f -s /usr/bin/dnst /usr/bin/ldns-key2ds
# ln -f -s /usr/bin/dnst /usr/bin/ldns-nsec3-hash
# ln -f -s /usr/bin/dnst /usr/bin/ldns-notify
# ln -f -s /usr/bin/dnst /usr/bin/ldns-signzone
# ln -f -s /usr/bin/dnst /usr/bin/ldns-update
# ;;
# esac
-2
View File
@@ -2,7 +2,5 @@
# case "$1" in
# upgrade|remove)
# # Remove symbolic links
# rm -f /usr/bin/ldns-nsec3-hash
# ;;
# esac
+7
View File
@@ -0,0 +1,7 @@
# This file is automatically @generated by Cargo.
# It is not intended for manual editing.
version = 4
[[package]]
name = "dnst-ldnsutils"
version = "0.2.0-alpha1"
+54
View File
@@ -0,0 +1,54 @@
[package]
# This is a dummy program to build a separate package with ploutos
name = "dnst-ldnsutils"
version = "0.2.0-alpha1"
edition = "2021"
repository = "https://github.com/nlnetlabs/dnst/"
authors = ["NLnet Labs <dns-team@nlnetlabs.nl>"]
description = "Package for dnst's ldns symlinks and man pages"
license = "BSD-3-Clause"
[dependencies]
# Related reading: https://wiki.debian.org/Teams/RustPackaging/Policy
[package.metadata.deb]
depends = "$auto, dnst"
section = "net"
priority = "optional"
assets = [
# TODO: Extend Ploutos to generate the man pages from sources.
["../../doc/manual/build/man/ldns-key2ds.1", "/usr/share/man/man1/ldns-key2ds.1", "644"],
["../../doc/manual/build/man/ldns-keygen.1", "/usr/share/man/man1/ldns-keygen.1", "644"],
["../../doc/manual/build/man/ldns-notify.1", "/usr/share/man/man1/ldns-notify.1", "644"],
["../../doc/manual/build/man/ldns-nsec3-hash.1", "/usr/share/man/man1/ldns-nsec3-hash.1", "644"],
["../../doc/manual/build/man/ldns-signzone.1", "/usr/share/man/man1/ldns-signzone.1", "644"],
["../../doc/manual/build/man/ldns-update.1", "/usr/share/man/man1/ldns-update.1", "644"],
]
copyright = "Copyright (c) 2024, NLnet Labs. All rights reserved."
extended-description = """\
This is a meta package that replaces the original ldnsutils with their dnst
counterparts (where implemented).
"""
maintainer-scripts = "pkg/debian"
# See: https://www.debian.org/doc/debian-policy/ch-relationships.html#replacing-whole-packages-forcing-their-removal
conflicts = "ldnsutils"
replaces = "ldnsutils"
# Related reading: https://docs.fedoraproject.org/en-US/packaging-guidelines/Rust/
[package.metadata.generate-rpm]
assets = [
# TODO: Extend Ploutos to generate the man pages from sources.
{ source = "../../doc/manual/build/man/ldns-key2ds.1", dest = "/usr/share/man/man1/ldns-key2ds.1", mode = "644", doc = true },
{ source = "../../doc/manual/build/man/ldns-keygen.1", dest = "/usr/share/man/man1/ldns-keygen.1", mode = "644", doc = true },
{ source = "../../doc/manual/build/man/ldns-notify.1", dest = "/usr/share/man/man1/ldns-notify.1", mode = "644", doc = true },
{ source = "../../doc/manual/build/man/ldns-nsec3-hash.1", dest = "/usr/share/man/man1/ldns-nsec3-hash.1", mode = "644", doc = true },
{ source = "../../doc/manual/build/man/ldns-signzone.1", dest = "/usr/share/man/man1/ldns-signzone.1", mode = "644", doc = true },
{ source = "../../doc/manual/build/man/ldns-update.1", dest = "/usr/share/man/man1/ldns-update.1", mode = "644", doc = true },
]
[package.metadata.generate-rpm.requires]
dnst = "*"
# Set Obsoletes per https://docs.fedoraproject.org/en-US/packaging-guidelines/#renaming-or-replacing-existing-packages.
[package.metadata.generate-rpm.obsoletes]
ldns-utils = "< 0:1.8.4-2"
+13
View File
@@ -0,0 +1,13 @@
#!/bin/sh -e
case "$1" in
configure)
# Create symbolic links
ln -f -s /usr/bin/dnst /usr/bin/ldns-keygen
ln -f -s /usr/bin/dnst /usr/bin/ldns-key2ds
ln -f -s /usr/bin/dnst /usr/bin/ldns-nsec3-hash
ln -f -s /usr/bin/dnst /usr/bin/ldns-notify
ln -f -s /usr/bin/dnst /usr/bin/ldns-signzone
ln -f -s /usr/bin/dnst /usr/bin/ldns-update
;;
esac
+13
View File
@@ -0,0 +1,13 @@
#!/bin/sh -e
case "$1" in
upgrade|remove)
# Remove symbolic links
rm -f /usr/bin/ldns-keygen
rm -f /usr/bin/ldns-key2ds
rm -f /usr/bin/ldns-nsec3-hash
rm -f /usr/bin/ldns-notify
rm -f /usr/bin/ldns-signzone
rm -f /usr/bin/ldns-update
;;
esac
@@ -0,0 +1,39 @@
post_trans_script = '''
#!/bin/bash -e
# This script will be run _after_ upgrade in the presence of an obsoleted ldns-utils
# package. This is useful because the ldns-utils uninstall script will have been run
# _after_ installation of dnst and so the symbolic links that we create will be
# removed, and we have to make sure here that they get put back
FORCE=
# See: https://docs.fedoraproject.org/en-US/packaging-guidelines/Scriptlets/#_syntax
if [ $1 -eq 2 ]; then
# Upgrade
FORCE=-f
fi
# Create symbolic links
ln -s ${FORCE} /usr/bin/dnst /usr/bin/ldns-keygen
ln -s ${FORCE} /usr/bin/dnst /usr/bin/ldns-key2ds
ln -s ${FORCE} /usr/bin/dnst /usr/bin/ldns-nsec3-hash
ln -s ${FORCE} /usr/bin/dnst /usr/bin/ldns-notify
ln -s ${FORCE} /usr/bin/dnst /usr/bin/ldns-signzone
ln -s ${FORCE} /usr/bin/dnst /usr/bin/ldns-update
'''
post_uninstall_script = '''
#!/bin/bash -e
# See: https://docs.fedoraproject.org/en-US/packaging-guidelines/Scriptlets/#_syntax
if [ $1 -eq 0 ] ; then
# Uninstallation
# Remove symbolic links
rm -f /usr/bin/ldns-keygen
rm -f /usr/bin/ldns-key2ds
rm -f /usr/bin/ldns-nsec3-hash
rm -f /usr/bin/ldns-notify
rm -f /usr/bin/ldns-signzone
rm -f /usr/bin/ldns-update
fi
'''
@@ -0,0 +1,41 @@
# This matrix definition is used as both the package_build_rules and the package_test_rules Ploutos packaging
# workflow inputs.
---
pkg:
- 'dnst-ldnsutils'
image:
- "ubuntu:jammy" # ubuntu/22.04
- "ubuntu:noble" # ubuntu/24.04
- "debian:bullseye" # debian/11
- "debian:bookworm" # debian/12
- "debian:trixie" # debian/13
- 'almalinux:8' # compatible with EOL centos:8
- 'almalinux:9'
- 'almalinux:10'
target:
- 'x86_64'
include:
# package for the Raspberry Pi 4b as an ARMv7 cross compiled variant of the Debian Bullseye upon which
# Raspbian 11 is based.
- pkg: 'dnst-ldnsutils'
image: 'debian:bullseye'
target: 'armv7-unknown-linux-musleabihf'
# package for the Raspberry Pi 1b as an ARMv6 cross compiled variant of the Debian Buster upon which
# Raspbian 10 is based.
- pkg: 'dnst-ldnsutils'
image: 'debian:buster'
target: 'arm-unknown-linux-musleabihf'
# package for the ROCK64 as an AARCH64 cross compiled variant of Debian Buster upon which Armbian 21 is based.
- pkg: 'dnst-ldnsutils'
image: 'debian:buster'
target: 'aarch64-unknown-linux-musl'
# Set rpmlint filters for RHEL rpmlint
- image: 'almalinux:8'
rpm_rpmlint_check_filters: no-binary
- image: 'almalinux:9'
rpm_rpmlint_check_filters: no-binary
- image: 'almalinux:10'
rpm_rpmlint_check_filters: no-binary
@@ -0,0 +1,63 @@
# This matrix definition is used as both the package_build_rules and the package_test_rules Ploutos packaging
# workflow inputs.
---
pkg:
- 'dnst-ldnsutils'
image:
- "ubuntu:jammy" # ubuntu/22.04
- "ubuntu:noble" # ubuntu/24.04
- "debian:bullseye" # debian/11
- "debian:bookworm" # debian/12
- "debian:trixie" # debian/13
published_pkg:
- 'ldnsutils' # correct for Ubuntu/Debian
target:
- 'x86_64'
test-image:
# Set 'test-image' to the empty string for all matrix permutations so that the default ('image') will be used
# to launch an LXC container to test the created packages in. Why explicitly set what is already the default?
# If this isn't present, later entries in the include set below will overwrite earlier entries that differ
# only by their 'test-image' value. If however 'test-image' is present in the original matrix by defining it
# here, then 'included' entries will no longer overwrite each other because they alter a key that is present
# in the original matrix. This is just how GitHub Actions matrix include rules work.
- ""
test-mode:
- 'fresh-install'
- 'upgrade-from-published'
include:
- pkg: 'dnst-ldnsutils'
image: 'almalinux:8'
target: 'x86_64'
test-mode: 'fresh-install'
- pkg: 'dnst-ldnsutils'
image: 'almalinux:8'
target: 'x86_64'
test-mode: 'upgrade-from-published'
published_pkg: 'ldns-utils'
rpm_yum_extra_args: --enablerepo powertools
- pkg: 'dnst-ldnsutils'
image: 'almalinux:9'
target: 'x86_64'
test-mode: 'fresh-install'
- pkg: 'dnst-ldnsutils'
image: 'almalinux:9'
target: 'x86_64'
test-mode: 'upgrade-from-published'
published_pkg: 'ldns-utils'
rpm_yum_extra_args: --enablerepo crb
- pkg: 'dnst-ldnsutils'
image: 'almalinux:10'
target: 'x86_64'
test-mode: 'fresh-install'
- pkg: 'dnst-ldnsutils'
image: 'almalinux:10'
target: 'x86_64'
test-mode: 'upgrade-from-published'
published_pkg: 'ldns-utils'
# --enablerepo crb is no longer needed since alma10 (https://almalinux.org/blog/2025-09-08-enabling-crb-by-default-for-almalinux10/)
# rpm_yum_extra_args: --enablerepo crb
@@ -0,0 +1,21 @@
#!/usr/bin/env bash
set -eo pipefail
set -x
case $1 in
post-install)
# Run some sanity checks
ldns-keygen -v
ldns-nsec3-hash nlnetlabs.nl
man ldns-keygen
;;
post-upgrade)
# Nothing to do.
# Run some sanity checks
ldns-keygen -v
ldns-nsec3-hash nlnetlabs.nl
man ldns-keygen
;;
esac
+1
View File
@@ -0,0 +1 @@
fn main() {}
+3 -22
View File
@@ -1,38 +1,19 @@
post_trans_script = '''
#!/bin/bash -e
# # This script will be run _after_ upgrade in the presence of an obsoleted ldns-utils
# # package. This is useful because the ldns-utils uninstall script will have been run
# # _after_ installation of dnst and so the symbolic links that we create will be
# # removed, and we have to make sure here that they get put back
#
# FORCE=
# # See: https://docs.fedoraproject.org/en-US/packaging-guidelines/Scriptlets/#_syntax
# See: https://docs.fedoraproject.org/en-US/packaging-guidelines/Scriptlets/#_syntax
# if [ $1 -eq 2 ]; then
# # Upgrade
# FORCE=-f
# fi
#
# # Create symbolic links
# ln -f -s ${FORCE} /usr/bin/dnst /usr/bin/ldns-keygen
# ln -f -s ${FORCE} /usr/bin/dnst /usr/bin/ldns-key2ds
# ln -f -s ${FORCE} /usr/bin/dnst /usr/bin/ldns-nsec3-hash
# ln -f -s ${FORCE} /usr/bin/dnst /usr/bin/ldns-notify
# ln -f -s ${FORCE} /usr/bin/dnst /usr/bin/ldns-signzone
# ln -f -s ${FORCE} /usr/bin/dnst /usr/bin/ldns-update
'''
post_uninstall_script = '''
#!/bin/bash -e
# # See: https://docs.fedoraproject.org/en-US/packaging-guidelines/Scriptlets/#_syntax
# See: https://docs.fedoraproject.org/en-US/packaging-guidelines/Scriptlets/#_syntax
# if [ $1 -eq 0 ] ; then
# # Uninstallation
# # Remove symbolic links
# rm -f /usr/bin/ldns-keygen
# rm -f /usr/bin/ldns-key2ds
# rm -f /usr/bin/ldns-nsec3-hash
# rm -f /usr/bin/ldns-notify
# rm -f /usr/bin/ldns-signzone
# rm -f /usr/bin/ldns-update
# fi
'''
+4 -6
View File
@@ -2,12 +2,10 @@
# workflow inputs.
---
pkg:
- 'cascade-dnst'
- 'dnst'
image:
- "ubuntu:focal" # ubuntu/20.04
- "ubuntu:jammy" # ubuntu/22.04
- "ubuntu:noble" # ubuntu/24.04
- "debian:buster" # debian/10
- "debian:bullseye" # debian/11
- "debian:bookworm" # debian/12
- "debian:trixie" # debian/13
@@ -19,17 +17,17 @@ target:
include:
# package for the Raspberry Pi 4b as an ARMv7 cross compiled variant of the Debian Bullseye upon which
# Raspbian 11 is based.
- pkg: 'cascade-dnst'
- pkg: 'dnst'
image: 'debian:bullseye'
target: 'armv7-unknown-linux-musleabihf'
# package for the Raspberry Pi 1b as an ARMv6 cross compiled variant of the Debian Buster upon which
# Raspbian 10 is based.
- pkg: 'cascade-dnst'
- pkg: 'dnst'
image: 'debian:buster'
target: 'arm-unknown-linux-musleabihf'
# package for the ROCK64 as an AARCH64 cross compiled variant of Debian Buster upon which Armbian 21 is based.
- pkg: 'cascade-dnst'
- pkg: 'dnst'
image: 'debian:buster'
target: 'aarch64-unknown-linux-musl'
+9 -20
View File
@@ -2,12 +2,10 @@
# workflow inputs.
---
pkg:
- 'cascade-dnst'
- 'dnst'
image:
- "ubuntu:focal" # ubuntu/20.04
- "ubuntu:jammy" # ubuntu/22.04
- "ubuntu:noble" # ubuntu/24.04
- "debian:buster" # debian/10
- "debian:bullseye" # debian/11
- "debian:bookworm" # debian/12
- "debian:trixie" # debian/13
@@ -27,48 +25,39 @@ test-mode:
- 'fresh-install'
- 'upgrade-from-published'
include:
- pkg: 'cascade-dnst'
- pkg: 'dnst'
image: 'almalinux:8'
target: 'x86_64'
test-mode: 'fresh-install'
- pkg: 'cascade-dnst'
- pkg: 'dnst'
image: 'almalinux:8'
target: 'x86_64'
test-mode: 'upgrade-from-published'
published_pkg: 'ldns-utils'
rpm_yum_extra_args: --enablerepo powertools
- pkg: 'cascade-dnst'
- pkg: 'dnst'
image: 'almalinux:9'
target: 'x86_64'
test-mode: 'fresh-install'
- pkg: 'cascade-dnst'
- pkg: 'dnst'
image: 'almalinux:9'
target: 'x86_64'
test-mode: 'upgrade-from-published'
published_pkg: 'ldns-utils'
rpm_yum_extra_args: --enablerepo crb
- pkg: 'cascade-dnst'
- pkg: 'dnst'
image: 'almalinux:10'
target: 'x86_64'
test-mode: 'fresh-install'
- pkg: 'cascade-dnst'
- pkg: 'dnst'
image: 'almalinux:10'
target: 'x86_64'
test-mode: 'upgrade-from-published'
published_pkg: 'ldns-utils'
rpm_yum_extra_args: --enablerepo crb
# Disable upgrade testing on Rocky Linux 9 and Debian Bookworm as we haven't published any packages for
# those O/S versions yet.
#test-exclude:
# - pkg: 'routinator'
# image: 'rockylinux:9'
# mode: 'upgrade-from-published'
# - pkg: 'routinator'
# image: 'debian:bookworm'
# mode: 'upgrade-from-published'
# --enablerepo crb is no longer needed since alma10 (https://almalinux.org/blog/2025-09-08-enabling-crb-by-default-for-almalinux10/)
# rpm_yum_extra_args: --enablerepo crb
-34
View File
@@ -1,34 +0,0 @@
#!/usr/bin/env bash
set -eo pipefail
set -x
case $1 in
post-install)
# Run some sanity checks
/usr/libexec/cascade/cascade-dnst --version
# ldns-keygen -v
# dnst nsec3-hash nlnetlabs.nl
# ldns-nsec3-hash nlnetlabs.nl
/usr/libexec/cascade/cascade-dnst keyset --help
man cascade-dnst
# man dnst-keygen
# man ldns-keygen
man cascade-dnst-keyset
;;
post-upgrade)
# Nothing to do.
# Run some sanity checks
/usr/libexec/cascade/cascade-dnst --version
# ldns-keygen -v
# dnst nsec3-hash nlnetlabs.nl
# ldns-nsec3-hash nlnetlabs.nl
/usr/libexec/cascade/cascade-dnst keyset --help
man cascade-dnst
# man dnst
# man dnst-keygen
# man ldns-keygen
man cascade-dnst-keyset
;;
esac
+23
View File
@@ -0,0 +1,23 @@
#!/usr/bin/env bash
set -eo pipefail
set -x
case $1 in
post-install)
# Run some sanity checks
dnst --version
dnst nsec3-hash nlnetlabs.nl
man dnst
man dnst-keygen
;;
post-upgrade)
# Nothing to do.
# Run some sanity checks
dnst --version
dnst nsec3-hash nlnetlabs.nl
man dnst
man dnst-keygen
;;
esac