bin/60447: unbound rc.d fails on fresh install before configuration migration can run

["erik%eriklabine.com@localhost via gnats" <gnats-admin%NetBSD.org@localhost>]

>Number:         60447
>Category:       bin
>Synopsis:       unbound rc.d fails on fresh install before configuration migration can run
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    bin-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Mon Jul 13 21:25:00 +0000 2026
>Originator:     Erik LaBine
>Release:        NetBSD 11.0_RC6
>Organization:
>Environment:
NetBSD crows.email 11.0_RC6 NetBSD 11.0_RC6 (GENERIC) #0: Tue Jul  7 15:10:39 UTC 2026  mkrepro%mkrepro.NetBSD.org@localhost:/usr/src/sys/arch/amd64/compile/GENERIC amd64
>Description:
On a fresh install of NetBSD 11.0_RC6 amd64, setting unbound=YES results in an error message during system startup.

unbound-checkconf[695:0] error: Could not open /var/chroot/unbound/etc/unbound/unbound.conf: No such file or directory
/etc/rc.d/unbound exited with code 1

It appears the script as currently written is running unbound-checkconf before it runs the migration. Since checkconf will fail on a fresh install, the script returns early. It won't reach the call to unbound_migrate().
>How-To-Repeat:
>From a fresh install, add 'unbound=YES' to /etc/rc.conf

Reboot, and the error message will be in the rc.log
>Fix:
Index: external/bsd/unbound/etc/rc.d/unbound
===================================================================
RCS file: /cvsroot/src/external/bsd/unbound/etc/rc.d/unbound,v
retrieving revision 1.2.18.1
diff -u -r1.2.18.1 unbound
--- external/bsd/unbound/etc/rc.d/unbound       3 Jul 2026 17:58:23 -0000       1.2.18.1
+++ external/bsd/unbound/etc/rc.d/unbound       13 Jul 2026 20:58:37 -0000
@@ -63,7 +63,15 @@

 unbound_precmd()
 {
-       local root_key
+       if [ -z "$unbound_chrootdir" ]; then
+               return
+       fi
+
+       if [ ! -h /etc/unbound ]; then
+               unbound_migrate /etc/unbound ${unbound_chrootdir}
+       fi
+
+       local root_key anchor_status

        if checkyesno unbound_auto_trust_anchor; then
                root_key=$(su -m _unbound -c \
@@ -73,16 +81,17 @@
                        echo Bootstrapping Unbound DNS trust anchors.
                        su -m _unbound -c 'unbound-anchor -a "$1"' -- \
                            /etc/unbound/"$root_key"
-               fi
-       fi
-
-       if [ -z "$unbound_chrootdir" ]; then
-               return
-       fi
+                       anchor_status=$?

-       if [ ! -h /etc/unbound ]; then
-               unbound_migrate /etc/unbound ${unbound_chrootdir}
+                       if [ "$anchor_status" -ne 1 ] ||
+                               [ ! -s /etc/unbound/"$root_key" ]
+                       then
+                               echo "Failed to create trust anchor"
+                               return 1
+                       fi
+               fi
        fi
+       return 0
 }

 load_rc_config $name