CVS commit: pkgsrc/net/knot

["Marcin Gondek" <drixter%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   drixter
Date:           Wed Sep  9 14:25:20 UTC 2026

Modified Files:
        pkgsrc/net/knot: Makefile PLIST buildlink3.mk distinfo

Log Message:
knot: Update to 3.6.0

Knot DNS 3.6.0 (2026-09-08)

Features:
knotd: DELEG-aware answering (see 'zone.deleg-aware')
knotd: DELEG-aware zone signing (see 'policy.deleg-adt')
knotd: configurable storage for the last signed serial (see 'zone.dnssec-metadata-db')
knotd: optional jitter for DNSSEC events (see 'policy.dnssec-jitter')
knotd: optional jitter for SOA refresh events (see 'zone.refresh-jitter')
knotd: implemented a "trash bin" for deleted DNSSEC keys (see 'DNSSEC key delete and recovery')
knotc: zone retransfer with automatic IXFR fix-up (see '+fixfr')
kdig: per zone DNSSEC answer validation (see '+validate')
utils: automatic LMDB migration from version 0.9 using embedded LMDB 0.9.35
libknot: support for DELEG and DELEGPARAM record types

Improvements:
knotd: millisecond-precision prefix timestamps in non-syslog logging
knotd: enforced serial policy during initial zone file load if 'difference-no-serial' is enabled
knotd: if NXDOMAIN answering encounters a failure, SERVFAIL is returned
knotd: new check for mismatches between zone and parent NS RRsets
knotd: the control timeout applies to blocking events
knotc: better compatibility with SmartOS #979
kdig: extended IDN transformation configuration (see '+[no]idnin' and '+[no]idnout')
keymgr: optional digest algorithm option for 'ds' command
doc: described cleanup of legacy DNSSEC keys (see 'Cleanup of removed legacy DNSSEC keys')
doc: described the zone deconfiguration procedure (see 'Zone removal')
doc: various improvements

Bugfixes:
knotd: CNAME leading to a different zone is followed
mod-onlinesign: inconsistent SOA TTL in negative responses

Packaging:
distro: Debian 11 and Ubuntu 20.04 no longer supported
debian,ubuntu: i386 and armhf architectures no longer supported

Compatibility:
knotd: default value for 'policy.rrsig-pre-refresh' changed to 0.005 * 'policy.rrsig-lifetime'
knotd: removed TCP Fast Open support ('server.tcp-fastopen' has no effect)
knotd: default storage for the last signed serial is KASP database again
knotd: zone file load with 'difference' no longer tolerates zone changes without incremented SOA serial
knotd: added colon to TZ specification in non-system logging according to ISO 8601
knotd: the maximum allowed number of NSEC3 iterations is restricted to 256
knotd: changing NSEC3PARAM via DDNS is no longer possible
knotc: unified and extended some command output
kdig: removed '+noidn' in favor of '+[no]idnin' and '+[no]idnout'
kdig: removed TCP Fast Open support ('+fastopen')
mod-dnsproxy: removed TCP Fast Open support ('tcp-fastopen')
libs: libdnssec integrated into libknot
libs: minimum required version of GnuTLS is 3.6.12
libs: added a workaround for compatibility with LMDB mdb-drop() version 1.0.0
tests-fuzz: removed AFL support


To generate a diff of this commit:
cvs rdiff -u -r1.103 -r1.104 pkgsrc/net/knot/Makefile
cvs rdiff -u -r1.20 -r1.21 pkgsrc/net/knot/PLIST
cvs rdiff -u -r1.3 -r1.4 pkgsrc/net/knot/buildlink3.mk
cvs rdiff -u -r1.58 -r1.59 pkgsrc/net/knot/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/net/knot/Makefile
diff -u pkgsrc/net/knot/Makefile:1.103 pkgsrc/net/knot/Makefile:1.104
--- pkgsrc/net/knot/Makefile:1.103      Fri Sep  4 18:25:08 2026
+++ pkgsrc/net/knot/Makefile    Wed Sep  9 14:25:20 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.103 2026/09/04 18:25:08 drixter Exp $
+# $NetBSD: Makefile,v 1.104 2026/09/09 14:25:20 drixter Exp $
 
-DISTNAME=      knot-3.5.8
+DISTNAME=      knot-3.6.0
 CATEGORIES=    net
 MASTER_SITES=  https://knot-dns.nic.cz/release/
 EXTRACT_SUFX=  .tar.xz
@@ -10,17 +10,12 @@ HOMEPAGE=   https://www.knot-dns.cz/
 COMMENT=       CZ.NIC Knot (auth) DNS server
 LICENSE=       gnu-gpl-v2
 
-FORCE_C_STD=   c11
-
 BUILD_DEFS+=   VARBASE
 
 GNU_CONFIGURE=         yes
 CONFIGURE_ARGS+=       --localstatedir=${VARBASE}/knot
 CONFIGURE_ARGS+=       --with-rundir=${VARBASE}/run/knot
 CONFIGURE_ARGS+=       --with-storage=${VARBASE}/knot/lib
-CONFIGURE_ARGS+=       --with-urcu=${BUILDLINK_PREFIX.userspace-rcu}
-CONFIGURE_ARGS+=       --with-libidn=${BUILDLINK_PREFIX.libidn}
-CONFIGURE_ARGS+=       --with-libnghttp2=${BUILDLINK_PREFIX.nghttp2}
 
 CONFIGURE_ARGS.NetBSD+=        --enable-recvmmsg=no
 
@@ -39,7 +34,6 @@ USE_TOOLS+=   bison flex gmake pkg-config
 .include "../../lang/python/extension.mk"
 .include "../../lang/python/application.mk"
 
-PKGCONFIG_OVERRIDE=    src/dnssec/libdnssec.pc.in
 PKGCONFIG_OVERRIDE+=   src/knotd.pc.in
 PKGCONFIG_OVERRIDE+=   src/libknot.pc.in
 PKGCONFIG_OVERRIDE+=   src/zscanner/libzscanner.pc.in
@@ -66,7 +60,7 @@ OWN_DIRS+=            ${VARBASE}/knot
 
 .include "../../databases/lmdb/buildlink3.mk"
 .include "../../devel/editline/buildlink3.mk"
-.include "../../devel/libidn/buildlink3.mk"
+.include "../../devel/libidn2/buildlink3.mk"
 .include "../../www/nghttp2/buildlink3.mk"
 .include "../../devel/userspace-rcu/buildlink3.mk"
 .include "../../devel/zlib/buildlink3.mk"

Index: pkgsrc/net/knot/PLIST
diff -u pkgsrc/net/knot/PLIST:1.20 pkgsrc/net/knot/PLIST:1.21
--- pkgsrc/net/knot/PLIST:1.20  Thu Oct 24 13:43:09 2024
+++ pkgsrc/net/knot/PLIST       Wed Sep  9 14:25:20 2026
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.20 2024/10/24 13:43:09 ryoon Exp $
+@comment $NetBSD: PLIST,v 1.21 2026/09/09 14:25:20 drixter Exp $
 bin/kdig
 bin/khost
 bin/knsec3hash
@@ -6,21 +6,6 @@ bin/knsupdate
 bin/kzonecheck
 bin/kzonesign
 include/knot/module.h
-include/libdnssec/binary.h
-include/libdnssec/crypto.h
-include/libdnssec/digest.h
-include/libdnssec/dnssec.h
-include/libdnssec/error.h
-include/libdnssec/key.h
-include/libdnssec/keyid.h
-include/libdnssec/keystore.h
-include/libdnssec/keytag.h
-include/libdnssec/nsec.h
-include/libdnssec/pem.h
-include/libdnssec/random.h
-include/libdnssec/sign.h
-include/libdnssec/tsig.h
-include/libdnssec/version.h
 include/libknot/attribute.h
 include/libknot/codes.h
 include/libknot/consts.h
@@ -31,6 +16,18 @@ include/libknot/db/db_lmdb.h
 include/libknot/db/db_trie.h
 include/libknot/descriptor.h
 include/libknot/dname.h
+include/libknot/dnssec/binary.h
+include/libknot/dnssec/crypto.h
+include/libknot/dnssec/digest.h
+include/libknot/dnssec/key.h
+include/libknot/dnssec/keyid.h
+include/libknot/dnssec/keystore.h
+include/libknot/dnssec/keytag.h
+include/libknot/dnssec/nsec.h
+include/libknot/dnssec/pem.h
+include/libknot/dnssec/random.h
+include/libknot/dnssec/sign.h
+include/libknot/dnssec/tsig.h
 include/libknot/dynarray.h
 include/libknot/endian.h
 include/libknot/errcode.h
@@ -76,11 +73,9 @@ include/libknot/yparser/yptrafo.h
 include/libzscanner/error.h
 include/libzscanner/scanner.h
 include/libzscanner/version.h
-lib/libdnssec.la
 lib/libknot.la
 lib/libzscanner.la
 lib/pkgconfig/knotd.pc
-lib/pkgconfig/libdnssec.pc
 lib/pkgconfig/libknot.pc
 lib/pkgconfig/libzscanner.pc
 man/man1/kdig.1

Index: pkgsrc/net/knot/buildlink3.mk
diff -u pkgsrc/net/knot/buildlink3.mk:1.3 pkgsrc/net/knot/buildlink3.mk:1.4
--- pkgsrc/net/knot/buildlink3.mk:1.3   Fri Sep  4 18:25:08 2026
+++ pkgsrc/net/knot/buildlink3.mk       Wed Sep  9 14:25:20 2026
@@ -1,11 +1,11 @@
-# $NetBSD: buildlink3.mk,v 1.3 2026/09/04 18:25:08 drixter Exp $
+# $NetBSD: buildlink3.mk,v 1.4 2026/09/09 14:25:20 drixter Exp $
 
 BUILDLINK_TREE+=       knot
 
 .if !defined(KNOT_BUILDLINK3_MK)
 KNOT_BUILDLINK3_MK:=
 
-BUILDLINK_API_DEPENDS.knot+=   knot>=3.5.8
+BUILDLINK_API_DEPENDS.knot+=   knot>=3.6.0
 BUILDLINK_PKGSRCDIR.knot?=     ../../net/knot
 
 .endif

Index: pkgsrc/net/knot/distinfo
diff -u pkgsrc/net/knot/distinfo:1.58 pkgsrc/net/knot/distinfo:1.59
--- pkgsrc/net/knot/distinfo:1.58       Fri Sep  4 18:25:08 2026
+++ pkgsrc/net/knot/distinfo    Wed Sep  9 14:25:20 2026
@@ -1,6 +1,6 @@
-$NetBSD: distinfo,v 1.58 2026/09/04 18:25:08 drixter Exp $
+$NetBSD: distinfo,v 1.59 2026/09/09 14:25:20 drixter Exp $
 
-BLAKE2s (knot-3.5.8.tar.xz) = af85cf3c70a4cffb3d7a4657ec5946edb7eb5ef7f5ed1d5ecabd5af2c9326fbd
-SHA512 (knot-3.5.8.tar.xz) = de7212d4b2d6b5868e848db55a3b276ff650bfe46b1fb8df5a6702d6e1408d85ad25b692a95eb26bd5165e8ebf2b2b9bed6fac46d8f6b870698bb32a97c179f3
-Size (knot-3.5.8.tar.xz) = 1736408 bytes
+BLAKE2s (knot-3.6.0.tar.xz) = 79dabdb7837e77fde56795cb6d959de1b9dc292c26786ed511a768001a3356c0
+SHA512 (knot-3.6.0.tar.xz) = 83369a94ce7f35f41b08d599844e4c9586c29ba8efcf841e90560734b81df72054ddd62df609b84149944a36672bb71219c66e6e0c8ee7e41d5c421fc256e64a
+Size (knot-3.6.0.tar.xz) = 1852000 bytes
 SHA1 (patch-samples_Makefile.in) = 499b8742dbd948e489b01d512bc7a8d8e4fe2e7b