Package is missing a depends on openssl for unbound-control-setup

[Simon Déziel]

Binary package hint: unbound

The script /usr/sbin/unbound-control-setup use the openssl command to generate a self-signed certificate but openssl package is not a dependency of unbound package.

[Simon Déziel (sdeziel)]

This bug affects unbound packages from Jaunty to Lucid.

[Simon Déziel (sdeziel)]

Here is a patch for the bug. I'm not sure about the version number to use so I put 1.3.4-1ubuntu2.1

[Simon Déziel (sdeziel)]

I was thinking that the script unbound-control-setup could be called by the postinst script. As unbound-control-setup generates a few certificate files required to use unbound-control it would simplify the setup procedure. That way to make unbound-control work the user would only need to add this to unbound.conf :

remote-control:
    control-enable: yes

The file generated by unbound-control-setup have those permissions :

-rw-r----- 1 root unbound 887 Dec 18 17:30 unbound_control.key
-rw-r----- 1 root unbound 627 Dec 18 17:30 unbound_control.pem
-rw-r----- 1 root unbound 887 Dec 18 17:30 unbound_server.key
-rw-r----- 1 root unbound 619 Dec 18 17:30 unbound_server.pem

[Scott Kitterman (kitterman)]

Certificates generally need configuration information that would be complex to provide in a postinst.

[Simon Déziel (sdeziel)]

Fortunately, the unbound-control-setup script is not interactive and produce all the 4 files needed. I've only add this to unbound.postinst :

/usr/sbin/unbound-control-setup >/dev/null 2>&1 && chown root:unbound /etc/unbound/unbound_{control,server}.{key,pem}

I've merge the 2 patches for convenience.

[Simon Déziel (sdeziel)]

Replace hardy by karmic in debian/changelog.

[Scott Kitterman (kitterman)]

Please send the patch to Debian to review.

[Nigel Babu (nigelbabu)]

This patch has been reviewed as part of operation cleansweep. Simon, have you been able to send this patch to debian for review, if not please do so.

[Simon Déziel (sdeziel)]

I sent a slightly reworked patch to debian to avoid those lintian complains :

W: unbound: possible-bashism-in-maintainer-script postinst:7 '_{control,server}'
W: unbound: command-with-path-in-maintainer-script postinst:7 /usr/sbin/unbound-control-setup

[Nigel Babu (nigelbabu)]

Thank you for sending the bug and patch upstream

[Felix Geyer (debfx)]

Fixed in unbound 1.4.5-1.