[Pkg-dns-devel] Bug#859337: unbound: 1.6.0-3 breaks resolving deb.debian.org

[Julien Cristau]

Package: unbound
Version: 1.6.0-3
Severity: grave

Hi,

after upgrading from 1.6.0-2 to 1.6.0-3 unbound can't seem to be able to
resolve deb.debian.org.  Upping the verbosity I get the feeling it's
alternating between querying deb.debian.org DS and static.debian.org DS,
never going up to debian.org DS.  Downgrading makes things work again.

Apr  2 15:49:55 tomate unbound: [685:0] info: resolving deb.debian.org. A IN
Apr  2 15:49:55 tomate unbound: [685:0] info: resolving deb.debian.org. A IN
Apr  2 15:49:55 tomate unbound: [685:0] info: resolving deb.debian.org.
DS IN
Apr  2 15:49:56 tomate unbound: [685:0] info: response for
deb.debian.org. DS IN
Apr  2 15:49:56 tomate unbound: [685:0] info: reply from <.> 4.2.2.1#53
Apr  2 15:49:56 tomate unbound: [685:0] info: query response was CNAME
Apr  2 15:49:56 tomate unbound: [685:0] info: resolving deb.debian.org.
DS IN
Apr  2 15:49:56 tomate unbound: [685:0] info: response for
deb.debian.org. DS IN
Apr  2 15:49:56 tomate unbound: [685:0] info: reply from <.> 4.2.2.1#53
Apr  2 15:49:56 tomate unbound: [685:0] info: query response was nodata
ANSWER
Apr  2 15:49:56 tomate unbound: [685:0] info: resolving deb.debian.org.
DS IN
Apr  2 15:49:56 tomate unbound: [685:0] info: response for
deb.debian.org. DS IN
Apr  2 15:49:56 tomate unbound: [685:0] info: reply from <.> 4.2.2.1#53
Apr  2 15:49:56 tomate unbound: [685:0] info: query response was CNAME
Apr  2 15:49:56 tomate unbound: [685:0] info: resolving deb.debian.org.
DS IN
Apr  2 15:49:56 tomate unbound: [685:0] info: response for
deb.debian.org. DS IN
Apr  2 15:49:56 tomate unbound: [685:0] info: reply from <.> 4.2.2.1#53
Apr  2 15:49:56 tomate unbound: [685:0] info: query response was nodata
ANSWER
Apr  2 15:49:56 tomate unbound: [685:0] info: resolving deb.debian.org.
DS IN
Apr  2 15:49:56 tomate unbound: [685:0] info: response for
deb.debian.org. DS IN
Apr  2 15:49:56 tomate unbound: [685:0] info: reply from <.> 4.2.2.1#53
Apr  2 15:49:56 tomate unbound: [685:0] info: query response was CNAME
Apr  2 15:49:56 tomate unbound: [685:0] info: resolving deb.debian.org.
DS IN
Apr  2 15:49:56 tomate unbound: [685:0] info: response for
deb.debian.org. DS IN
Apr  2 15:49:56 tomate unbound: [685:0] info: reply from <.> 4.2.2.1#53
Apr  2 15:49:56 tomate unbound: [685:0] info: query response was nodata
ANSWER
Apr  2 15:49:56 tomate unbound: [685:0] info: resolving deb.debian.org.
DS IN
Apr  2 15:49:56 tomate unbound: [685:0] info: response for
deb.debian.org. DS IN
Apr  2 15:49:56 tomate unbound: [685:0] info: reply from <.> 4.2.2.1#53
Apr  2 15:49:56 tomate unbound: [685:0] info: query response was CNAME
Apr  2 15:49:56 tomate unbound: [685:0] info: resolving deb.debian.org.
DS IN
Apr  2 15:49:56 tomate unbound: [685:0] info: response for
deb.debian.org. DS IN
Apr  2 15:49:56 tomate unbound: [685:0] info: reply from <.> 4.2.2.1#53
Apr  2 15:49:56 tomate unbound: [685:0] info: query response was nodata
ANSWER
Apr  2 15:49:56 tomate unbound: [685:0] info: resolving deb.debian.org.
DS IN
Apr  2 15:49:56 tomate unbound: [685:0] info: response for
deb.debian.org. DS IN
Apr  2 15:49:56 tomate unbound: [685:0] info: reply from <.> 4.2.2.1#53
Apr  2 15:49:56 tomate unbound: [685:0] info: query response was CNAME
Apr  2 15:49:56 tomate unbound: [685:0] info: resolving deb.debian.org.
DS IN
Apr  2 15:49:56 tomate unbound: [685:0] info: response for
deb.debian.org. DS IN
Apr  2 15:49:56 tomate unbound: [685:0] info: reply from <.> 4.2.2.1#53
Apr  2 15:49:56 tomate unbound: [685:0] info: query response was nodata
ANSWER
Apr  2 15:49:56 tomate unbound: [685:0] info: resolving deb.debian.org.
DS IN
Apr  2 15:49:56 tomate unbound: [685:0] info: response for
deb.debian.org. DS IN
Apr  2 15:49:56 tomate unbound: [685:0] info: reply from <.> 4.2.2.1#53
Apr  2 15:49:56 tomate unbound: [685:0] info: query response was CNAME
Apr  2 15:49:56 tomate unbound: [685:0] info: resolving deb.debian.org.
DS IN
Apr  2 15:49:56 tomate unbound: [685:0] info: response for
deb.debian.org. DS IN
Apr  2 15:49:56 tomate unbound: [685:0] info: reply from <.> 4.2.2.1#53
Apr  2 15:49:56 tomate unbound: [685:0] info: query response was nodata
ANSWER
Apr  2 15:49:56 tomate unbound: [685:0] info: Could not establish a
chain of trust to keys for deb.debian.org. DNSKEY IN

Cheers,
Julien

-- System Information:
Debian Release: 9.0
  APT prefers testing
  APT policy: (900, 'testing'), (500, 'testing-debug'), (500, 'unstable')
Architecture: amd64 (x86_64)

Kernel: Linux 4.9.0-2-amd64 (SMP w/4 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages unbound depends on:
ii  adduser              3.115
ii  dns-root-data        2015052300+h+1
ii  init-system-helpers  1.47
ii  libc6                2.24-9
ii  libevent-2.0-5       2.0.21-stable-3
ii  libfstrm0            0.3.0-1
ii  libprotobuf-c1       1.2.1-2
ii  libpython3.5         3.5.3-1
ii  libssl1.1            1.1.0e-1
ii  openssl              1.1.0e-1
ii  unbound-anchor       1.6.0-2

unbound recommends no packages.

Versions of packages unbound suggests:
pn  apparmor  <none>

-- no debconf information