New DNSSEC root trust anchor

[Matt Nordhoff]

[ Impact ]

 * ICANN has generated the next DNSSEC root trust anchor, KSK-2024.

 * ICANN's current plan is that it will be required around 2026-10-11
   to 2027-01-11, but the sooner it's updated, the more unmaintained
   installations will have it when the time comes.
 * https://lists.dns-oarc.net/pipermail/dns-operations/2024-November/022711.html

 * On one hand it is "only" annoyance as e.g. named uses them as
   hints and will on start check those hints and spam you
   warnings to the logs.

 * On the other hand this will break. Mid term the old addresses
   will stop to work (by 2026/2027) that is the strong
   deadline until this should be updated everywhere.
   Read more about the general key rollover policy at
   https://www.iana.org/dnssec/files
   In regard to that Ubuntu falls into this category:

"Validators should keep this data up-to-date. Consider the following:
 ...
Software vendors often package and distribute up-to-date trust anchors through their regular software update mechanisms."

[ Test Plan ]

 * In the past on updates the self check on hints of named
   were quite useful here when it was updating to the new
   keys (see bug 2045297). But this time we are not so very
   late (which is good) and thereby that simple test does not
   work yet (not so good).

 * Still as a regression test against those keys being installed
   a valid check is to install bind9 and check named's status with
   the new vs the old keys.

   $ apt install bind9;
   $ systemctl restart named;
   # takes a while to fully start
   $ sleep 20s;
   $ systemctl status named --lines 80 --no-pager

  Run the above as-is and then again with the updated dns-root-data package.

Important should be:
1. no weird behavior with the updated keys, compare to the old
2. Named is happy, check for those two
  status
    Active: active (running)
  log
    Nov 25 09:06:54 f named[13139]: all zones loaded
    Nov 25 09:06:54 f named[13139]: running

 * This is adding the new KSK-2024 key, not removing the old. So one more
   thing that is worth to check is that the key and delegation signer
   contained in
     $ cat /usr/share/dns/root.key
     $ cat /usr/share/dns/root.ds
   are still present after the upgrade. There should be a new second key
   now. Please mind that the new tooling does generate .ds better and
   might switch characters to upper-case as usual in key display.

 * Since the keys are not yet fully active, it won't do an auto-refresh
   using them that we can check for. Instead we need to compare what
   the update delivered against what IANA publishes. To do that you'd
   compare that added second key. It was already generated the official
   way at build time, so not doing the very same again. Instead let us
   doing that in a few ways for extra confidence.

   First:
    Compare that second key with the post on [1]. Other than some
    spacing due to the way displayed it should match that.

   Second:
    Compare he pkg content to the published data by IANA (see
    https://www.iana.org/dnssec/files fo rmore).
     # fetch published keys and signature
     $ wget https://data.iana.org/root-anchors/root-anchors.xml \
          https://data.iana.org/root-anchors/root-anchors.p7s \
          https://data.iana.org/root-anchors/icannbundle.pem
     # verify against the signature
     $ openssl smime -verify -CAfile icannbundle.pem -inform der -in root-anchors.p7s -content root-anchors.xml
<?xml version="1.0" encoding="UTF-8"?>
<TrustAnchor id="0C05FDD6-422C-4910-8ED6-430ED15E11C2" source="http://data.iana.org/root-anchors/root-anchors.xml">
    <Zone>.</Zone>
    <KeyDigest id="Kjqmt7v" validFrom="2010-07-15T00:00:00+00:00" validUntil="2019-01-11T00:00:00+00:00">
        <KeyTag>19036</KeyTag>
        <Algorithm>8</Algorithm>
        <DigestType>2</DigestType>
        <Digest>49AAC11D7B6F6446702E54A1607371607A1A41855200FD2CE1CDDE32F24E8FB5</Digest>
    </KeyDigest>
    <KeyDigest id="Klajeyz" validFrom="2017-02-02T00:00:00+00:00">
        <KeyTag>20326</KeyTag>
        <Algorithm>8</Algorithm>
        <DigestType>2</DigestType>
        <Digest>E06D44B80B8F1D39A95C0B0D7C65D08458E880409BBC683457104237C7F8EC8D</Digest>
        <PublicKey>AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU=</PublicKey>
        <Flags>257</Flags>
    </KeyDigest>
    <KeyDigest id="Kmyv6jo" validFrom="2024-07-18T00:00:00+00:00">
        <KeyTag>38696</KeyTag>
        <Algorithm>8</Algorithm>
        <DigestType>2</DigestType>
        <Digest>683D2D0ACB8C9B712A1948B27F741219298D0A450D612C483AF444A4C0FB2B16</Digest>
        <PublicKey>AwEAAa96jeuknZlaeSrvyAJj6ZHv28hhOKkx3rLGXVaC6rXTsDc449/cidltpkyGwCJNnOAlFNKF2jBosZBU5eeHspaQWOmOElZsjICMQMC3aeHbGiShvZsx4wMYSjH8e7Vrhbu6irwCzVBApESjbUdpWWmEnhathWu1jo+siFUiRAAxm9qyJNg/wOZqqzL/dL/q8PkcRU5oUKEpUge71M3ej2/7CPqpdVwuMoTvoB+ZOT4YeGyxMvHmbrxlFzGOHOijtzN+u1TQNatX2XBuzZNQ1K+s2CXkPIZo7s6JgZyvaBevYtxPvYLw4z9mR7K2vaF18UYH9Z9GNUUeayffKC73PYc=</PublicKey>
        <Flags>257</Flags>
    </KeyDigest>
</TrustAnchor>
Verification successful
     # Once trusted, check that the key, ds and tag matches what
     # the new version of dns-root-data installed
     $ apt install xmlstarlet
     # ensure the new KSK-2024 key is in there
     $ grep $(xmlstarlet sel -t -v "//KeyDigest[@id='Kmyv6jo']/PublicKey" root-anchors.xml) /usr/share/dns/root.key
. IN DNSKEY 257 3 8 AwEAAa96jeuknZlaeSrvyAJj6ZHv28hhOKkx3rLGXVaC6rXTsDc449/cidltpkyGwCJNnOAlFNKF2jBosZBU5eeHspaQWOmOElZsjICMQMC3aeHbGiShvZsx4wMYSjH8e7Vrhbu6irwCzVBApESjbUdpWWmEnhathWu1jo+siFUiRAAxm9qyJNg/wOZqqzL/dL/q8PkcRU5oUKEpUge71M3ej2/7CPqpdVwuMoTvoB+ZOT4YeGyxMvHmbrxlFzGOHOijtzN+u1TQNatX2XBuzZNQ1K+s2CXkPIZo7s6JgZyvaBevYtxPvYLw4z9mR7K2vaF18UYH9Z9GNUUeayffKC73PYc= ; keytag 38696
     $ grep $(xmlstarlet sel -t -v "//KeyDigest[@id='Kmyv6jo']/Digest" root-anchors.xml) /usr/share/dns/root.ds
. IN DS 38696 8 2 683D2D0ACB8C9B712A1948B27F741219298D0A450D612C483AF444A4C0FB2B16
     # ensure we haven't lost the still active key
     $ grep $(xmlstarlet sel -t -v "//KeyDigest[@id='Klajeyz']/PublicKey" root-anchors.xml) /usr/share/dns/root.key
. IN DNSKEY 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ; keytag 20326
     $ grep $(xmlstarlet sel -t -v "//KeyDigest[@id='Klajeyz']/Digest" root-anchors.xml) /usr/share/dns/root.ds
. IN DS 20326 8 2 E06D44B80B8F1D39A95C0B0D7C65D08458E880409BBC683457104237C7F8EC8D

Sorry for this a bit odd approach, but just re-doing what was already done at build seemed not to provide a cross-check of any meaningful way.

[1]: https://lists.dns-oarc.net/pipermail/dns-operations/2024-November/022711.html

[ Where problems could occur ]

 * This isn't code, purely a data file for services that need to know
   about dns root servers. Thereby there is no code in the package itself
   that would fail, but potential regressions would be in the dependencies.
   Those are (and we can more consciously look out for those):

Reverse-Recommends
==================
* dnsmasq-base [amd64 arm64 armhf ppc64el s390x]
* dnsmasq-base-lua [amd64 arm64 armhf ppc64el s390x]
* ldnsutils [amd64 arm64 armhf ppc64el s390x]
* libbellesip2 [amd64 arm64 armhf ppc64el s390x]
* unbound
* unbound-host

Reverse-Depends
===============
* bind9
* dnsviz
* hash-slinger [amd64 arm64 armhf ppc64el s390x]
* knot-resolver [amd64 arm64 armhf]
* libgetdns10 [amd64 arm64 armhf ppc64el s390x]
* libreswan [amd64 arm64 armhf ppc64el s390x]
* opendkim [amd64 arm64 armhf ppc64el s390x]
* pdns-recursor [amd64 arm64 ppc64el s390x]

 * At the same time I think we'd not need to do super advanced tests with
   custom setups of each of them. Those that are reverse dependencies and
   have tests (bind9, libreswan) will be ran by autopkgtest and given the
   change, that should IMHO be sufficient.

 * This is following one change in Debian which SRU thoughts might decide
   otherwise about. root.hints.sig is no more shipped since 2024041802.
   For noble/jammy/focal that means the file is no more around after the
   update. I think this is fine as its use-case really is negelgible,
   and having them consistent across releases has benefits for admins
   and further maintenance. Yet If you disagree let me know and I can
   see if we can re-generate that from the upstream content as well.

[ Other Info ]

 * This is a native package and we are not doing anything special
   The same landed in Debian
   => https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1076995

 * This is structurally a similar update to the past bug 2045297

 * Given that this is changing only data and that we likely need
   to expect updating this more or less regularly I appreciate to
   get all the packaging improvements Debian made like improving
   readme and updating the generation of the key from the verified
   XML at build time to the new rfc.
   Hence I'd (just like Debian did) go for a backport of the most
   recent version, over just picking the key content.
   That is easier to review, easier to maintain, and as long
   as there are no build issues better to ensure all active
   releases are on the same state.

--- original report ---

ICANN has generated the next DNSSEC root trust anchor, KSK-2024.

ICANN's current plan is that it will be required around 2026-10-11 - 2027-01-11, but the sooner it's updated, the more unmaintained installations will have it when the time comes.

<https://www.iana.org/dnssec/files>

<https://lists.dns-oarc.net/pipermail/dns-operations/2024-November/022711.html>

The corresponding Debian bug is <https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1076995>.

(Some software can automatically update the trust anchor, as long as it's running and connected to the Internet often enough; some cannot.)

[Bryce Harrington (bryce)]

Hi Matt,

It looks like dns-root-data should automatically sync this into plucky from Debian once the fix is available in sid, but am guessing you feel it'll need SRUs to all supported releases? Looks like we've needed to do roll out updates for this package in the past (LP: #2045297)

Patch needed: https://salsa.debian.org/dns-team/dns-root-data/-/commit/a842a4a89a39ace00f37e7710f7fb11c8922a331

[Christian Ehrhardt (paelzer)]

Debian has done the update really well also updating the parsing and handling and the documentation.
I think I'll go for backporting the whole instead of just the data, that should be better.

[Christian Ehrhardt (paelzer)]

I was able to come up with steps to verify the build result as delivered by the package as well as adding a simple test with named to ensure it is not breaking by e.g. the key being in the future.
Thereby the associated MRs that are up for review now before upload into the Ubuntu SRU queue.

[Christian Ehrhardt (paelzer)]

The removal of root.hints.sig might need to be discussed in the context of the backports.

I think it isn't needed and it allows easier cross release usage and maintenance with the content being the same. But that is for the SRU team to decide.

I added it to regression considerations to force awareness.

All MRs are reviewed and I uploaded them to -uapproved for the SRU team to have the final call.

[Christian Ehrhardt (paelzer)]

Seeing them in -unapproved, updating state

[Timo Aaltonen (tjaalton)]

Hello Matt, or anyone else affected,

Accepted dns-root-data into oracular-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/dns-root-data/2024071801~ubuntu0.24.10.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-oracular to verification-done-oracular. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-oracular. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Timo Aaltonen (tjaalton)]

Hello Matt, or anyone else affected,

Accepted dns-root-data into noble-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/dns-root-data/2024071801~ubuntu0.24.04.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-noble to verification-done-noble. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-noble. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Timo Aaltonen (tjaalton)]

Hello Matt, or anyone else affected,

Accepted dns-root-data into jammy-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/dns-root-data/2024071801~ubuntu0.22.04.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-jammy to verification-done-jammy. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-jammy. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Timo Aaltonen (tjaalton)]

Hello Matt, or anyone else affected,

Accepted dns-root-data into focal-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/dns-root-data/2024071801~ubuntu0.20.04.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-focal to verification-done-focal. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-focal. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Ubuntu SRU Bot (ubuntu-sru-bot)]

All autopkgtests for the newly accepted dns-root-data (2024071801~ubuntu0.20.04.1) for focal have finished running.
The following regressions have been reported in tests triggered by the package:

bind9/1:9.18.30-0ubuntu0.20.04.2 (ppc64el)

Please visit the excuses page listed below and investigate the failures, proceeding afterwards as per the StableReleaseUpdates policy regarding autopkgtest regressions [1].

https://people.canonical.com/~ubuntu-archive/proposed-migration/focal/update_excuses.html#dns-root-data

[1] https://wiki.ubuntu.com/StableReleaseUpdates#Autopkgtest_Regressions

Thank you!

[Christian Ehrhardt (paelzer)]

FYI The test fail was an infrastructure issue and resolved in https://autopkgtest.ubuntu.com/results/autopkgtest-focal/focal/ppc64el/b/bind9/20250210_090643_8f8e5@/log.gz

[Christian Ehrhardt (paelzer)]

Rechecked official keys of the day, matching:

openssl smime -verify -CAfile icannbundle.pem -inform der -in root-anchors.p7s -content root-anchors.xml
<?xml version="1.0" encoding="UTF-8"?>
<TrustAnchor id="0C05FDD6-422C-4910-8ED6-430ED15E11C2" source="http://data.iana.org/root-anchors/root-anchors.xml">
    <Zone>.</Zone>
    <KeyDigest id="Kjqmt7v" validFrom="2010-07-15T00:00:00+00:00" validUntil="2019-01-11T00:00:00+00:00">
        <KeyTag>19036</KeyTag>
        <Algorithm>8</Algorithm>
        <DigestType>2</DigestType>
        <Digest>49AAC11D7B6F6446702E54A1607371607A1A41855200FD2CE1CDDE32F24E8FB5</Digest>
    </KeyDigest>
    <KeyDigest id="Klajeyz" validFrom="2017-02-02T00:00:00+00:00">
        <KeyTag>20326</KeyTag>
        <Algorithm>8</Algorithm>
        <DigestType>2</DigestType>
        <Digest>E06D44B80B8F1D39A95C0B0D7C65D08458E880409BBC683457104237C7F8EC8D</Digest>
        <PublicKey>AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU=</PublicKey>
        <Flags>257</Flags>
    </KeyDigest>
    <KeyDigest id="Kmyv6jo" validFrom="2024-07-18T00:00:00+00:00">
        <KeyTag>38696</KeyTag>
        <Algorithm>8</Algorithm>
        <DigestType>2</DigestType>
        <Digest>683D2D0ACB8C9B712A1948B27F741219298D0A450D612C483AF444A4C0FB2B16</Digest>
        <PublicKey>AwEAAa96jeuknZlaeSrvyAJj6ZHv28hhOKkx3rLGXVaC6rXTsDc449/cidltpkyGwCJNnOAlFNKF2jBosZBU5eeHspaQWOmOElZsjICMQMC3aeHbGiShvZsx4wMYSjH8e7Vrhbu6irwCzVBApESjbUdpWWmEnhathWu1jo+siFUiRAAxm9qyJNg/wOZqqzL/dL/q8PkcRU5oUKEpUge71M3ej2/7CPqpdVwuMoTvoB+ZOT4YeGyxMvHmbrxlFzGOHOijtzN+u1TQNatX2XBuzZNQ1K+s2CXkPIZo7s6JgZyvaBevYtxPvYLw4z9mR7K2vaF18UYH9Z9GNUUeayffKC73PYc=</PublicKey>
        <Flags>257</Flags>
    </KeyDigest>
</TrustAnchor>
Verification successful

[Christian Ehrhardt (paelzer)]

Focal verification:

root@f-sru:~# apt policy dns-root-data
dns-root-data:
  Installed: 2023112702~ubuntu0.20.04.1
  Candidate: 2024071801~ubuntu0.20.04.1
  Version table:
     2024071801~ubuntu0.20.04.1 500
        500 http://archive.ubuntu.com/ubuntu focal-proposed/main amd64 Packages
 *** 2023112702~ubuntu0.20.04.1 500
        500 http://archive.ubuntu.com/ubuntu focal-updates/main amd64 Packages
        100 /var/lib/dpkg/status
     2019052802 500
        500 http://archive.ubuntu.com/ubuntu focal/main amd64 Packages
root@f-sru:~# apt install dns-root-data
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following packages will be upgraded:
  dns-root-data
1 upgraded, 0 newly installed, 0 to remove and 13 not upgraded.
Need to get 6128 B of archives.
After this operation, 2048 B of additional disk space will be used.
Get:1 http://archive.ubuntu.com/ubuntu focal-proposed/main amd64 dns-root-data all 2024071801~ubuntu0.20.04.1 [6128 B]
Fetched 6128 B in 0s (64.1 kB/s)
(Reading database ... 32423 files and directories currently installed.)
Preparing to unpack .../dns-root-data_2024071801~ubuntu0.20.04.1_all.deb ...
Unpacking dns-root-data (2024071801~ubuntu0.20.04.1) over (2023112702~ubuntu0.20.04.1) ...
Setting up dns-root-data (2024071801~ubuntu0.20.04.1) ...

$ systemctl restart named; sleep 20s; systemctl status named --lines 80 --no-pager
...
As expected in the log we see:
Feb 10 09:47:01 f-sru named[3767]: all zones loaded
Feb 10 09:47:01 f-sru named[3767]: running

old
root@f-sru:~# cat /usr/share/dns/root.key
. 86400 IN DNSKEY 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ;{id = 20326 (ksk), size = 2048b} ;;state=2 [ VALID ]
root@f-sru:~# cat /usr/share/dns/root.ds
. IN DS 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d

new
root@f-sru:~# cat /usr/share/dns/root.key
. IN DNSKEY 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ; keytag 20326
. IN DNSKEY 257 3 8 AwEAAa96jeuknZlaeSrvyAJj6ZHv28hhOKkx3rLGXVaC6rXTsDc449/cidltpkyGwCJNnOAlFNKF2jBosZBU5eeHspaQWOmOElZsjICMQMC3aeHbGiShvZsx4wMYSjH8e7Vrhbu6irwCzVBApESjbUdpWWmEnhathWu1jo+siFUiRAAxm9qyJNg/wOZqqzL/dL/q8PkcRU5oUKEpUge71M3ej2/7CPqpdVwuMoTvoB+ZOT4YeGyxMvHmbrxlFzGOHOijtzN+u1TQNatX2XBuzZNQ1K+s2CXkPIZo7s6JgZyvaBevYtxPvYLw4z9mR7K2vaF18UYH9Z9GNUUeayffKC73PYc= ; keytag 38696
root@f-sru:~# cat /usr/share/dns/root.ds
. IN DS 20326 8 2 E06D44B80B8F1D39A95C0B0D7C65D08458E880409BBC683457104237C7F8EC8D
. IN DS 38696 8 2 683D2D0ACB8C9B712A1948B27F741219298D0A450D612C483AF444A4C0FB2B16

They keys are...

[Christian Ehrhardt (paelzer)]

Jammy verification:

root@j-sru:~# apt policy dns-root-data
dns-root-data:
  Installed: 2023112702~ubuntu0.22.04.1
  Candidate: 2024071801~ubuntu0.22.04.1
  Version table:
     2024071801~ubuntu0.22.04.1 500
        500 http://archive.ubuntu.com/ubuntu jammy-proposed/main amd64 Packages
 *** 2023112702~ubuntu0.22.04.1 500
        500 http://archive.ubuntu.com/ubuntu jammy-updates/main amd64 Packages
        100 /var/lib/dpkg/status
     2021011101 500
        500 http://archive.ubuntu.com/ubuntu jammy/main amd64 Packages
root@j-sru:~# apt install dns-root-data
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
The following packages will be upgraded:
  dns-root-data
1 upgraded, 0 newly installed, 0 to remove and 30 not upgraded.
Need to get 6132 B of archives.
After this operation, 2048 B of additional disk space will be used.
Get:1 http://archive.ubuntu.com/ubuntu jammy-proposed/main amd64 dns-root-data all 2024071801~ubuntu0.22.04.1 [6132 B]
Fetched 6132 B in 0s (83.6 kB/s)
(Reading database ... 34147 files and directories currently installed.)
Preparing to unpack .../dns-root-data_2024071801~ubuntu0.22.04.1_all.deb ...
Unpacking dns-root-data (2024071801~ubuntu0.22.04.1) over (2023112702~ubuntu0.22.04.1) ...
Setting up dns-root-data (2024071801~ubuntu0.22.04.1) ...
Scanning processes...

No services need to be restarted.

No containers need to be restarted.

No user sessions are running outdated binaries.

No VM guests are running outdated hypervisor (qemu) binaries on this host.

$ systemctl restart named; sleep 20s; systemctl status named --lines 80 --no-pager
...
As expected in the log we see:
Feb 10 09:47:03 j-sru named[2624]: all zones loaded
Feb 10 09:47:03 j-sru named[2624]: running

old
root@j-sru:~# cat /usr/share/dns/root.key
. 86400 IN DNSKEY 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ;{id = 20326 (ksk), size = 2048b} ;;state=2 [ VALID ]
root@j-sru:~# cat /usr/share/dns/root.ds
. IN DS 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d

new
root@j-sru:~# cat /usr/share/dns/root.key
. IN DNSKEY 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ; keytag 20326
. IN DNSKEY 257 3 8 AwEAAa96jeuknZlaeSrvyAJj6ZHv28hhOKkx3rLGXVaC6rXTsDc449/cidltpkyGwCJNnOAlFNKF2jBosZBU5eeHspaQWOmOElZsjICMQMC3aeHbGiShvZsx4wMYSjH8e7Vrhbu6irwCzVBApESjbUdpWWmEnhathWu1jo+siFUiRAAxm9qyJNg/wOZqqzL/dL/q8PkcR...

[Christian Ehrhardt (paelzer)]

Noble verification:

root@n-sru:~# apt policy dns-root-data
dns-root-data:
  Installed: 2023112702~willsync1
  Candidate: 2023112702~willsync1
  Version table:
     2024071801~ubuntu0.24.04.1 100
        100 http://archive.ubuntu.com/ubuntu noble-proposed/main amd64 Packages
 *** 2023112702~willsync1 500
        500 http://archive.ubuntu.com/ubuntu noble/main amd64 Packages
        100 /var/lib/dpkg/status
root@n-sru:~# apt install dns-root-data -t noble-proposed
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
The following packages will be upgraded:
  dns-root-data
1 upgraded, 0 newly installed, 0 to remove and 28 not upgraded.
Need to get 5918 B of archives.
After this operation, 2048 B of additional disk space will be used.
Get:1 http://archive.ubuntu.com/ubuntu noble-proposed/main amd64 dns-root-data all 2024071801~ubuntu0.24.04.1 [5918 B]
Fetched 5918 B in 0s (18.1 kB/s)
(Reading database ... 37314 files and directories currently installed.)
Preparing to unpack .../dns-root-data_2024071801~ubuntu0.24.04.1_all.deb ...
Unpacking dns-root-data (2024071801~ubuntu0.24.04.1) over (2023112702~willsync1) ...
Setting up dns-root-data (2024071801~ubuntu0.24.04.1) ...
Scanning processes...
Scanning candidates...

Restarting services...

Service restarts being deferred:
 /etc/needrestart/restart.d/dbus.service
 systemctl restart systemd-logind.service
 systemctl restart unattended-upgrades.service

No containers need to be restarted.

User sessions running outdated binaries:
 root @ user manager service: systemd[533]

No VM guests are running outdated hypervisor (qemu) binaries on this host.

$ systemctl restart named; sleep 20s; systemctl status named --lines 80 --no-pager
...
As expected in the log we see:
Feb 10 09:47:05 n-sru named[4393]: all zones loaded
Feb 10 09:47:05 n-sru named[4393]: running

old
root@n-sru:~# cat /usr/share/dns/root.key
. 86400 IN DNSKEY 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ;{id = 20326 (ksk), size = 2048b} ;;state=2 [ VALID ]
root@n-sru:~# cat /usr/share/dns/root.ds
. IN DS 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d

new
root@n-sru:~# cat /usr/share/dns/root.key
. IN DNSKEY 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnXGX...

[Christian Ehrhardt (paelzer)]

Oracular verification:

root@o-sru:~# apt policy dns-root-data
dns-root-data:
  Installed: 2024041801
  Candidate: 2024041801
  Version table:
     2024071801~ubuntu0.24.10.1 100
        100 http://archive.ubuntu.com/ubuntu oracular-proposed/main amd64 Packages
 *** 2024041801 500
        500 http://archive.ubuntu.com/ubuntu oracular/main amd64 Packages
        100 /var/lib/dpkg/status
root@o-sru:~# apt install dns-root-data -t oracular-proposed
Upgrading:
  dns-root-data

Summary:
  Upgrading: 1, Installing: 0, Removing: 0, Not Upgrading: 4
  Download size: 5928 B
  Space needed: 2048 B / 5166 MB available

Get:1 http://archive.ubuntu.com/ubuntu oracular-proposed/main amd64 dns-root-data all 2024071801~ubuntu0.24.10.1 [5928 B]
Fetched 5928 B in 0s (28.7 kB/s)
(Reading database ... 38336 files and directories currently installed.)
Preparing to unpack .../dns-root-data_2024071801~ubuntu0.24.10.1_all.deb ...
Unpacking dns-root-data (2024071801~ubuntu0.24.10.1) over (2024041801) ...
Setting up dns-root-data (2024071801~ubuntu0.24.10.1) ...
Scanning processes...
Scanning candidates...

Restarting services...

Service restarts being deferred:
 /etc/needrestart/restart.d/dbus.service
 systemctl restart systemd-logind.service
 systemctl restart unattended-upgrades.service

No containers need to be restarted.

User sessions running outdated binaries:
 root @ user manager service: systemd[673]

No VM guests are running outdated hypervisor (qemu) binaries on this host.

$ systemctl restart named; sleep 20s; systemctl status named --lines 80 --no-pager
...
As expected in the log we see:
Feb 10 09:47:07 o-sru named[3007]: all zones loaded
Feb 10 09:47:07 o-sru named[3007]: running

So things are still starting fine
Next we check the content if the old keys are still around.

old
root@o-sru:~# cat /usr/share/dns/root.key
. 86400 IN DNSKEY 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ;{id = 20326 (ksk), size = 2048b} ;;state=2 [ VALID ]
root@o-sru:~# cat /usr/share/dns/root.ds
. IN DS 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d

new
root@o-sru:~# cat /usr/share/dns/root.key
. IN DNSKEY 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ; keytag 20326
. I...

[Christian Ehrhardt (paelzer)]

Since this was more a formal than a functional check it was a bit verbose, but all we defined worked as expected and therefore all verification tags are set to done.

[Andreas Hasenack (ahasenack)]

The verification of the Stable Release Update for dns-root-data has completed successfully and the package is now being released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

[Launchpad Janitor (janitor)]

This bug was fixed in the package dns-root-data - 2024071801~ubuntu0.24.10.1

---------------
dns-root-data (2024071801~ubuntu0.24.10.1) oracular; urgency=medium

  * Backport data update to include DNSSEC root trust anchor of KSK-2024
    (LP: #2086795)

dns-root-data (2024071801) unstable; urgency=medium

  * Actually add the DNSKEY record for KSK-2024, which was not distributed
    in release 2024071800 because it is not yet published in the root zone.
  * Replace the parser of the root-anchors.xml file with a new one which
    follows RFC 7958bis and will output all valid and not expired DS and
    DNSKEY records, no matter if they are currently published in the root
    zone or not.
  * Document the package in README.Debian. (Closes: #995890)

dns-root-data (2024071800) unstable; urgency=medium

  * Update root-anchors.xml and its signature to add the new KSK-2024.
    (Closes: #1076995)

dns-root-data (2024041802) unstable; urgency=medium

  * Stop installing root.hints.sig, since no package actually uses the file.
  * Stop the package from FTBFS in the periods between when root-anchors.xml
    is updated and the new root KSK is actually published in the DNS.

 -- Christian Ehrhardt <email address hidden> Thu, 21 Nov 2024 09:20:11 +0100

[Christian Ehrhardt (paelzer)]

Wow, it seems verifying all releases and doing updates in multiple browser tabs made it re-add the -needed for those releases done in the other tab.
Silly, but lessons learned - updating tags ...

[Launchpad Janitor (janitor)]

This bug was fixed in the package dns-root-data - 2024071801~ubuntu0.24.04.1

---------------
dns-root-data (2024071801~ubuntu0.24.04.1) noble; urgency=medium

  * Backport data update to include DNSSEC root trust anchor of KSK-2024
    (LP: #2086795)

dns-root-data (2024071801) unstable; urgency=medium

  * Actually add the DNSKEY record for KSK-2024, which was not distributed
    in release 2024071800 because it is not yet published in the root zone.
  * Replace the parser of the root-anchors.xml file with a new one which
    follows RFC 7958bis and will output all valid and not expired DS and
    DNSKEY records, no matter if they are currently published in the root
    zone or not.
  * Document the package in README.Debian. (Closes: #995890)

dns-root-data (2024071800) unstable; urgency=medium

  * Update root-anchors.xml and its signature to add the new KSK-2024.
    (Closes: #1076995)

dns-root-data (2024041802) unstable; urgency=medium

  * Stop installing root.hints.sig, since no package actually uses the file.
  * Stop the package from FTBFS in the periods between when root-anchors.xml
    is updated and the new root KSK is actually published in the DNS.

dns-root-data (2024041801) unstable; urgency=medium

  * Add myself to the Uploaders field, as discussed with Ondřej.
  * Fix the package description. (Closes: #1064829)
  * Update the expired Verisign GRS PGP key.
  * Update the root hints file to version 2024041801, with:
    + updated A and AAAA records for B. (Closes: #1054393)

 -- Christian Ehrhardt <email address hidden> Thu, 21 Nov 2024 09:20:11 +0100

[Launchpad Janitor (janitor)]

This bug was fixed in the package dns-root-data - 2024071801~ubuntu0.22.04.1

---------------
dns-root-data (2024071801~ubuntu0.22.04.1) jammy; urgency=medium

  * Backport data update to include DNSSEC root trust anchor of KSK-2024
    (LP: #2086795)

dns-root-data (2024071801) unstable; urgency=medium

  * Actually add the DNSKEY record for KSK-2024, which was not distributed
    in release 2024071800 because it is not yet published in the root zone.
  * Replace the parser of the root-anchors.xml file with a new one which
    follows RFC 7958bis and will output all valid and not expired DS and
    DNSKEY records, no matter if they are currently published in the root
    zone or not.
  * Document the package in README.Debian. (Closes: #995890)

dns-root-data (2024071800) unstable; urgency=medium

  * Update root-anchors.xml and its signature to add the new KSK-2024.
    (Closes: #1076995)

dns-root-data (2024041802) unstable; urgency=medium

  * Stop installing root.hints.sig, since no package actually uses the file.
  * Stop the package from FTBFS in the periods between when root-anchors.xml
    is updated and the new root KSK is actually published in the DNS.

dns-root-data (2024041801) unstable; urgency=medium

  * Add myself to the Uploaders field, as discussed with Ondřej.
  * Fix the package description. (Closes: #1064829)
  * Update the expired Verisign GRS PGP key.
  * Update the root hints file to version 2024041801, with:
    + updated A and AAAA records for B. (Closes: #1054393)

 -- Christian Ehrhardt <email address hidden> Thu, 21 Nov 2024 09:20:11 +0100

[Launchpad Janitor (janitor)]

This bug was fixed in the package dns-root-data - 2024071801~ubuntu0.20.04.1

---------------
dns-root-data (2024071801~ubuntu0.20.04.1) focal; urgency=medium

  * Backport data update to include DNSSEC root trust anchor of KSK-2024
    (LP: #2086795)
    - d/control: downgrade to debhelper-compat 12 as 13 is only in backports
    - parse-root-anchors: set compat to perl 5.30 (no changes needed)

dns-root-data (2024071801) unstable; urgency=medium

  * Actually add the DNSKEY record for KSK-2024, which was not distributed
    in release 2024071800 because it is not yet published in the root zone.
  * Replace the parser of the root-anchors.xml file with a new one which
    follows RFC 7958bis and will output all valid and not expired DS and
    DNSKEY records, no matter if they are currently published in the root
    zone or not.
  * Document the package in README.Debian. (Closes: #995890)

dns-root-data (2024071800) unstable; urgency=medium

  * Update root-anchors.xml and its signature to add the new KSK-2024.
    (Closes: #1076995)

dns-root-data (2024041802) unstable; urgency=medium

  * Stop installing root.hints.sig, since no package actually uses the file.
  * Stop the package from FTBFS in the periods between when root-anchors.xml
    is updated and the new root KSK is actually published in the DNS.

dns-root-data (2024041801) unstable; urgency=medium

  * Add myself to the Uploaders field, as discussed with Ondřej.
  * Fix the package description. (Closes: #1064829)
  * Update the expired Verisign GRS PGP key.
  * Update the root hints file to version 2024041801, with:
    + updated A and AAAA records for B. (Closes: #1054393)

 -- Christian Ehrhardt <email address hidden> Thu, 21 Nov 2024 09:20:11 +0100