Version 2017072601 is needed as it include the upcoming root KSK

[Simon Déziel]

Version 2017072601 should be SRU'ed from Artful to Xenial and Zesty. This will bring the upcoming root KSK (in VALID state) which is required for new installs of other packages (like Unbound) that happen after September 11.

See https://unbound.net/root-11sep-11oct.html for details.

[Andreas Hasenack (ahasenack)]

Isn't this the key that was updated already in artful's bind9 package?

https://wiki.ubuntu.com/ArtfulAardvark/ReleaseNotes#New_Bind9_KSK

[Simon Déziel (sdeziel)]

Yes, that's the same KSK indeed.

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Launchpad Janitor (janitor)]

This bug was fixed in the package dns-root-data - 2018013001~16.04.1

---------------
dns-root-data (2018013001~16.04.1) xenial-security; urgency=medium

  * Rebuild as an update for Ubuntu 16.04 LTS. (LP: #1721129)
    - debian/{control,compat}: relax debhelper version requirement.

dns-root-data (2018013001) unstable; urgency=medium

  * new upstream version of root.hints, 2018013001
  * use wrap-and-sort -ast
  * added myself to uploaders
  * d/control: use <email address hidden> as Maintainer
  * Standards-Version: bump to 4.1.3 (no changes needed)
  * d/control: move Vcs-* to salsa.debian.org
  * move to debhelper 11
  * d/rules: clean up get_orig_source
  * sort generated .ds files by key tag
  * d/rules: trim trailing whitespace
  * d/copyright: Format: use https
  * d/copyright: add my own copyright to debian/*
  * d/copyright: name upstream data grant "ICANN-Public"
  * d/copyright: Source: use https:
  * update README.source to cover the different origins of the data
  * Update order of root.key to follow output of unbound-anchor

dns-root-data (2017072601) unstable; urgency=medium

  * Update root.hints to 2017072601 version

dns-root-data (2017071401) unstable; urgency=medium

  * Update the root.hints to 2017060102 version
  * Change the state of KSK-2017 to VALID

dns-root-data (2017041102) unstable; urgency=high

  [ Robert Edmonds ]
  * Change DS creation to omit TTL and use spaces instead of tabs
    (Closes: #864016)

dns-root-data (2017041101) unstable; urgency=medium

  * Fix parse-root-anchors.sh in non-dash shells (Closes: #862252)
  * Update to 2017041101 version of root zone
  * Remove timestamps from root.key to make the build reproducible
  * Shell syntax cleanup

dns-root-data (2017020200) unstable; urgency=medium

  * Update to 2016102001 version of the root.zone
  * Add KSK-2017 (valid from 2017-02-02) into root.key file
  * Reduce number of IANA files as they don't exist at upstream anymore
  * draft-icann-dnssec-trust-anchor is now RFC 7958
  * Update all other IANA DNSSEC files to 2017-02-02 versions
  * Strip the GPG verification as IANA doesn't provide the GPG signatures
    anymore
  * Rewrite DS creation check to xml2 and ldnsutils, as neither xmllint
    nor bind9utils handle multiple DNSKEY in one file correctly

 -- Marc Deslauriers <email address hidden> Thu, 05 Jul 2018 11:30:13 -0400