CVS commit: pkgsrc/net/unbound

["Adam Ciarcinski" <adam%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   adam
Date:           Mon May 11 15:49:04 UTC 2026

Modified Files:
        pkgsrc/net/unbound: Makefile distinfo
        pkgsrc/net/unbound/patches: patch-configure

Log Message:
unbound: updated to 1.25.0

1.25.0

Features
Merge 1337: 0 TTL cached replies and some TTL behavior changes.
TTL change: Cached records that reach TTL 0 are expired.
TTL change: TTL 0 upstream answers are no longer cached by cachedb, as they should.
TTL change: 'serve-expired-reply-ttl' is now capped by the original TTL value of the record to try and make some sense when replying with expired records.
TTL change: TTL decoding was updated to adhere to RFC8767 section 4 where a 'set high-order bit' means the value is positive instead of 0.
Merge 1374: Mesh reply counters. This adds the statistics num.queries.replyaddr_limit and requestlist.current.replies.
Introduce the 'log-thread-id' configuration option to manage logging the system-wide Linux thread ID for easier debugging with system tools.
Fix 1389: [FR] replacement with ECC-GOST12 according to RFC9558. Patch contributed by Igor V. Ruzanov, available in contrib/gost12.patch.
Merge 1411: Allow synthesized DNAME TTL=0 to be served from cache within grace period. The responses are served from cache within a 1-second grace period. Reduces recursion when authoritative servers 
return DNAME with TTL=0 (RFC 2308). Response still returns TTL=0 to clients. Adds a test for it.
Fix 278: DoT: complete unbound restart required on certificate renew. Fix so that a reload checks if the files have changed, and if so, reload the contexts. Also for DoH, DoQ and outgoing DoT.
For 278: fast_reload can reload tls-service-key, tls-service-pem and tls-cert-bundle changes. It checks the modification time of the tls-service-key and tls-service-pem files for update.
Fix to allow the control-interface config to use ip@port notation.
Fix to shorten RRSIG count in scrubber, this protects against an overly large number of RRSIGs. It can be configured with `iter-scrub-rrsig: 8`, it has default 8. Thanks to Yuxiao Wu, Tsinghua 
University for the report.
Introduce new 'tls-protocols' configuration option that specifies which of the supported TLS protocols will be used. TLSv1.2 is again enabled by default, but can be selectively turned off if desired 
(related to 1303).
Merge 1400: Support pthread_setname_np. Adds support for pthread_setname_np and variants to set the name on spawned threads for easier debugging/monitoring.


To generate a diff of this commit:
cvs rdiff -u -r1.133 -r1.134 pkgsrc/net/unbound/Makefile
cvs rdiff -u -r1.89 -r1.90 pkgsrc/net/unbound/distinfo
cvs rdiff -u -r1.6 -r1.7 pkgsrc/net/unbound/patches/patch-configure

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/net/unbound/Makefile
diff -u pkgsrc/net/unbound/Makefile:1.133 pkgsrc/net/unbound/Makefile:1.134
--- pkgsrc/net/unbound/Makefile:1.133   Wed Jan 14 12:57:36 2026
+++ pkgsrc/net/unbound/Makefile Mon May 11 15:49:04 2026
@@ -1,7 +1,6 @@
-# $NetBSD: Makefile,v 1.133 2026/01/14 12:57:36 wiz Exp $
+# $NetBSD: Makefile,v 1.134 2026/05/11 15:49:04 adam Exp $
 
-DISTNAME=      unbound-1.24.2
-PKGREVISION=   2
+DISTNAME=      unbound-1.25.0
 CATEGORIES=    net
 MASTER_SITES=  https://nlnetlabs.nl/downloads/unbound/
 
@@ -33,7 +32,7 @@ USE_TOOLS+=   pkg-config
 # unbound uses some OpenBSD libc functions such as reallocarray(3).
 # The existing tests just look for the symbol in libc regardless
 # of anything in stdlib.h
-CPPFLAGS.NetBSD+=              -D_OPENBSD_SOURCE
+CPPFLAGS.NetBSD+=      -D_OPENBSD_SOURCE
 
 # Add the same logic as for ldns, so sha2/gost is configured automatically
 CHECK_BUILTIN.openssl= yes

Index: pkgsrc/net/unbound/distinfo
diff -u pkgsrc/net/unbound/distinfo:1.89 pkgsrc/net/unbound/distinfo:1.90
--- pkgsrc/net/unbound/distinfo:1.89    Wed Dec  3 14:09:02 2025
+++ pkgsrc/net/unbound/distinfo Mon May 11 15:49:04 2026
@@ -1,6 +1,6 @@
-$NetBSD: distinfo,v 1.89 2025/12/03 14:09:02 adam Exp $
+$NetBSD: distinfo,v 1.90 2026/05/11 15:49:04 adam Exp $
 
-BLAKE2s (unbound-1.24.2.tar.gz) = 3adcf5d6f7af33475ee864a4ec8825810bed463c90ae0e8196fa8fdb47b11aeb
-SHA512 (unbound-1.24.2.tar.gz) = 655d63ec5305323e84d82691425d74d98c332d0028517bd729d191e5f968ce9481b49ec7447d4c4906dce7997a998a115db36e911a59d2d877da5840c2080261
-Size (unbound-1.24.2.tar.gz) = 6905018 bytes
-SHA1 (patch-configure) = 0779bb9174e358163430fa0b05e81c464776b12f
+BLAKE2s (unbound-1.25.0.tar.gz) = 2ddcc1b064bb905430945537c09648e257037c3c064976b9c7a0b5a8881d32d7
+SHA512 (unbound-1.25.0.tar.gz) = 5b11cb06d768461dc390da989d412e8724403a9cce36e95f7b401d0b512bc81ee5a68d4cd6504c89de9a11cce69b90f09e01ae72e2ddd05130b7c459691d4f85
+Size (unbound-1.25.0.tar.gz) = 6818581 bytes
+SHA1 (patch-configure) = 6a5ac60931ce3f2a2ecaaeccccd66a0f1987d735

Index: pkgsrc/net/unbound/patches/patch-configure
diff -u pkgsrc/net/unbound/patches/patch-configure:1.6 pkgsrc/net/unbound/patches/patch-configure:1.7
--- pkgsrc/net/unbound/patches/patch-configure:1.6      Wed May  8 11:16:49 2024
+++ pkgsrc/net/unbound/patches/patch-configure  Mon May 11 15:49:04 2026
@@ -1,11 +1,23 @@
-$NetBSD: patch-configure,v 1.6 2024/05/08 11:16:49 he Exp $
+$NetBSD: patch-configure,v 1.7 2026/05/11 15:49:04 adam Exp $
+
+Properly detect pthread_set_name_np() by linking, not compiling, as
+-Wno-implicit-function-declaration can result with false positive.
 
 Pretend expat.h is found: it is guaranteed by PkgSrc, but on Darwin it might
 be buried inside an SDK; we don't want the SDK path being exposed in CFLAGS.
 
---- configure.orig     2017-07-09 07:41:42.000000000 +0000
+--- configure.orig     2026-04-29 08:48:39.000000000 +0000
 +++ configure
-@@ -21900,7 +21900,7 @@ fi
+@@ -19226,7 +19226,7 @@ main (void)
+   return 0;
+ }
+ _ACEOF
+-if ac_fn_c_try_compile "$LINENO"
++if ac_fn_c_try_link "$LINENO"
+ then :
+ 
+           { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+@@ -22353,7 +22353,7 @@ fi
  
  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for libexpat" >&5
  printf %s "checking for libexpat... " >&6; }