## START: Set by rpmautospec
## (rpmautospec version 0.8.3)
## RPMAUTOSPEC: autorelease, autochangelog
%define autorelease(e:s:pb:n) %{?-p:0.}%{lua:
    release_number = 2;
    base_release_number = tonumber(rpm.expand("%{?-b*}%{!?-b:1}"));
    print(release_number + base_release_number - 1);
}%{?-e:.%{-e*}}%{?-s:.%{-s*}}%{!?-n:%{?dist}}
## END: Set by rpmautospec

%global forgeurl https://github.com/pemensik/get-trust-anchor
%global gitcommit e68840988f15155a0be80ae5c36c33a79862ce42
%global upload_sources %{SOURCE0} %{SOURCE3} %{SOURCE5}

Name:           dns-root-data
Version:        2026260100
Release:        %autorelease
Summary:        DNS root hints and DNSSEC trust anchor

License:        BSD-2-Clause and CC0-1.0
# Part of data is covered by https://www.iana.org/help/licensing-terms
URL:            https://data.iana.org/root-anchors/
VCS:            git:%{forgeurl}.git
Source0:        %{forgeurl}/archive/%{gitcommit}/%{name}-%{version}.tar.gz
Source1:        %{url}/icannbundle.pem
Source2:        %{url}/root-anchors.xml
Source3:        %{url}/root-anchors.p7s
Source4:        https://www.internic.net/domain/named.root
Source5:        https://www.internic.net/domain/named.root.sig
# This is DSA 1024b key. But no better signature is provided
Source6:        https://keyserver.ubuntu.com/pks/lookup?op=get&search=0xf0cb1a326bdf3f3efa3a01fa937bb869e3a238c5#/registry-admin.key

BuildRequires:  python3
BuildRequires:  python3-dns
BuildRequires:  openssl
BuildRequires:  gpgverify
BuildRequires:  bind-dnssec-utils
BuildRequires:  sed
BuildArch:      noarch

%description
This package contains various root zone related data as published
by IANA to be used by various DNS software as a common source
of DNS root zone data, namely:
 * Root Hints (root.hints)
 * Root Trust Anchors (root.key, root.ds)

%package utils
Summary:        Tool for fetching and verifying DNSSEC trust anchor
Requires:       %{name} = %{version}-%{release}
Requires:       python3
Requires:       python3-dns
Requires:       openssl
BuildArch:      noarch

%description utils
Python trust anchor verification and fetching tool.


%prep
%autosetup -n get-trust-anchor-%{gitcommit} -p1

%{gpgverify} --keyring=%{SOURCE6} --data=%{SOURCE4} --signature=%{SOURCE5}
openssl smime -verify -CAfile %{SOURCE1} -inform DER -in %{SOURCE3} -content %{SOURCE2} -out /dev/null


%build
sed -e "1 s,^#\!/usr/bin/env python,#\!%{_bindir}/python3," -i get_trust_anchor.py
python3 ./get_trust_anchor.py --root-ca=%{SOURCE1} --local=%{SOURCE2} --local-sig=%{SOURCE3} --ksks-from-trust-anchor
# Reset modification date to match original source
touch -r %{SOURCE2} ksk-as-ds.txt
touch -r %{SOURCE2} ksk-as-dnskey.txt


%install
mkdir -p %{buildroot}%{_datadir}/%{name}
install -p -m 0644 %{SOURCE1} %{buildroot}%{_datadir}/%{name}/icannbundle.pem
install -p -m 0644 %{SOURCE2} %{buildroot}%{_datadir}/%{name}/root-anchors.xml
install -p -m 0644 %{SOURCE3} %{buildroot}%{_datadir}/%{name}/root-anchors.p7s
install -p -m 0644 %{SOURCE4} %{buildroot}%{_datadir}/%{name}/root.hints
install -p -m 0644 %{SOURCE5} %{buildroot}%{_datadir}/%{name}/root.hints.sig
install -p -m 0644 ksk-as-ds.txt %{buildroot}%{_datadir}/%{name}/root.ds
install -p -m 0644 ksk-as-dnskey.txt %{buildroot}%{_datadir}/%{name}/root.key

mkdir -p %{buildroot}%{_bindir}
install -p -m 0755 get_trust_anchor.py %{buildroot}%{_bindir}/get_dnssec_trust_anchor


%check
openssl smime -verify -CAfile %{buildroot}%{_datadir}/%{name}/icannbundle.pem \
              -inform DER -in %{buildroot}%{_datadir}/%{name}/root-anchors.p7s \
              -content %{buildroot}%{_datadir}/%{name}/root-anchors.xml
dnssec-importkey %{buildroot}%{_datadir}/%{name}/root.key
grep -w DS %{buildroot}%{_datadir}/%{name}/root.ds
grep -w DNSKEY %{buildroot}%{_datadir}/%{name}/root.key


%files
%license LICENSE
%dir %{_datadir}/%{name}/
%{_datadir}/%{name}/icannbundle.pem
%{_datadir}/%{name}/root-anchors.xml
%{_datadir}/%{name}/root-anchors.p7s
%{_datadir}/%{name}/root.hints
%{_datadir}/%{name}/root.hints.sig
%{_datadir}/%{name}/root.key
%{_datadir}/%{name}/root.ds

%files utils
%doc README.md
%{_bindir}/get_dnssec_trust_anchor


%changelog
## START: Generated by rpmautospec
* Tue Jan 27 2026 Petr Menšík <pemensik@redhat.com> - 2026260100-2
- Add separate utils subpackage

* Tue Jan 27 2026 Petr Menšík <pemensik@redhat.com> - 2026260100-1
- Switch to python based tool by Paul Hoffman

* Fri Jan 16 2026 Fedora Release Engineering <releng@fedoraproject.org> - 2025080400-4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild

* Fri Jan 16 2026 Fedora Release Engineering <releng@fedoraproject.org> - 2025080400-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild

* Mon Oct 20 2025 Petr Menšík <pemensik@redhat.com> - 2025080400-2
- Ignore specific versions of sources.

* Mon Oct 20 2025 Petr Menšík <pemensik@redhat.com> - 2025080400-1
- Initial version after review
## END: Generated by rpmautospec