diff options
| author | Vladimír Čunát <vcunat@gmail.com> | 2017-07-15 10:38:01 +0200 |
|---|---|---|
| committer | Vladimír Čunát <vcunat@gmail.com> | 2017-07-15 10:38:01 +0200 |
| commit | 338a19520493f941a3f478bf852074e74a67b03d (patch) | |
| tree | 61c65b2a7e610a6db63bdb34e8df919dffaec70f /pkgs/data/misc/dns-root-data/update-root-key.sh | |
| parent | 3bb9954a6bb977f3e33f766ae5df926495ef7bc4 (diff) | |
| download | nixpkgs-338a19520493f941a3f478bf852074e74a67b03d.tar nixpkgs-338a19520493f941a3f478bf852074e74a67b03d.tar.gz nixpkgs-338a19520493f941a3f478bf852074e74a67b03d.tar.bz2 nixpkgs-338a19520493f941a3f478bf852074e74a67b03d.tar.lz nixpkgs-338a19520493f941a3f478bf852074e74a67b03d.tar.xz nixpkgs-338a19520493f941a3f478bf852074e74a67b03d.tar.zst nixpkgs-338a19520493f941a3f478bf852074e74a67b03d.zip | |
dns-root-data: improve determinism, clear key status
Nitpicks: - The timestamps there were useless. - The generator now switched the two keys; I don't know why. I intentionally remove the comments like "state=1 [ ADDPEND ]". The problem is that keys e.g. in ADDPEND state are *not* immediately usable for validation - see RFC5011 for details. I verified that Unbound does disregard this on the format we and Debian use ATM, presumably due to removing parts of the comments, but it would be confusing nevertheless.
Diffstat (limited to 'pkgs/data/misc/dns-root-data/update-root-key.sh')
| -rwxr-xr-x | pkgs/data/misc/dns-root-data/update-root-key.sh | 9 |
1 files changed, 5 insertions, 4 deletions
diff --git a/pkgs/data/misc/dns-root-data/update-root-key.sh b/pkgs/data/misc/dns-root-data/update-root-key.sh index 5db179621a7..9a3141aef19 100755 --- a/pkgs/data/misc/dns-root-data/update-root-key.sh +++ b/pkgs/data/misc/dns-root-data/update-root-key.sh @@ -2,8 +2,9 @@ #!nix-shell -i bash -p busybox unbound TMP=`mktemp` -unbound-anchor -a $TMP -grep -Ev "^($$|;)" $TMP | sed -e 's/ ;;count=.*//' > root.key -rm $TMP +unbound-anchor -a "$TMP" +grep -Ev "^($$|;)" "$TMP" | sed -e 's/ ;;.*//' > root.key -unbound-anchor -F -a root.ds +unbound-anchor -F -a "$TMP" +sed '/^;/d' < "$TMP" > root.ds +rm $TMP |