Merge ~ahasenack/ubuntu/+source/bind9:disco-re-enable-eddsa-support into ubuntu/+source/bind9:ubuntu/disco-devel

[Andreas Hasenack]

PPA with testing packages: https://launchpad.net/~ahasenack/+archive/ubuntu/bind9-eddsa-1825712
sudo add-apt-repository ppa:ahasenack/bind9-eddsa-1825712

Re-enable eddsa support, which was disabled in the last merge from Debian. It will pull in openssl 1.1.1 (as opposed to just 1.1.0), and that's why it was disabled in Debian, albeit temporarily. This is a regression in Disco, and Eoan.

There are two tests that can be done: offline and online.

Offline test:
dnssec-keygen -a ED25519 example.com

That will fail with bind9 builds that do not have eddsa support.

Online test:
$ delv +dnssec +multiline @127.0.0.1 ed25519.nl
; fully validated
ed25519.nl. 3600 IN A 77.72.150.82
ed25519.nl. 3600 IN RRSIG A 15 2 3600 (
    20190502000000 20190411000000 27662 ed25519.nl.
    f7HjJcbvekrmuLtXDzjddWJZzZAAFO6fV+NoMCg+UiIl
    nQjUxNcCvDWuR38XAJuHrctvQOlAg1JmIGwYyKM2DQ== )

It will either say "fully validated", as is the case above with a build that has eddsa support, or:
$ delv +dnssec +multiline @127.0.0.1 ed25519.nl
;; validating ed25519.nl/A: no valid signature found
; unsigned answer
ed25519.nl. 3600 IN A 77.72.150.82
ed25519.nl. 3200171710 IN RRSIG A 15 2 3600 (
    20190502000000 20190411000000 27662 ed25519.nl.
    f7HjJcbvekrmuLtXDzjddWJZzZAAFO6fV+NoMCg+UiIl
    nQjUxNcCvDWuR38XAJuHrctvQOlAg1JmIGwYyKM2DQ== )

it will say "unsigned answer" and "no valid signature found".

[Christian Ehrhardt  (paelzer)]

Checked the bug, tests and SRU template - all LGTM

[Christian Ehrhardt  (paelzer)]

A few more comments on the Eoan MP

[Christian Ehrhardt  (paelzer)]

As with the Eoan MP +1 on this.

review: Approve

[Andreas Hasenack (ahasenack)]

Updated to match the eoan changes

[Andreas Hasenack (ahasenack)]

Debian bug about re-enabling eddsa support: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=927962

[Andreas Hasenack (ahasenack)]

I added a comment to d/rules, explaining how --with-eddsa works and its implications.

[Christian Ehrhardt  (paelzer)]

Re-Reviewed, thanks for adding the comments.
+1 on the Disco upload once Eoan (I acked that one this morning) is completed.

review: Approve

[Andreas Hasenack (ahasenack)]

Waiting for Eoan to migrate, then I'll upload this one.

[Andreas Hasenack (ahasenack)]

Eoan migration done. Tagged and uploaded to disco:

$ git push pkg upload/1%9.11.5.P1+dfsg-1ubuntu2.4
Enumerating objects: 13, done.
Counting objects: 100% (13/13), done.
Delta compression using up to 4 threads
Compressing objects: 100% (9/9), done.
Writing objects: 100% (9/9), 1.20 KiB | 47.00 KiB/s, done.
Total 9 (delta 6), reused 0 (delta 0)
To ssh://git.launchpad.net/~usd-import-team/ubuntu/+source/bind9
 * [new tag] upload/1%9.11.5.P1+dfsg-1ubuntu2.4 -> upload/1%9.11.5.P1+dfsg-1ubuntu2.4

$ dput ubuntu ../bind9_9.11.5.P1+dfsg-1ubuntu2.4_source.changes
Checking signature on .changes
gpg: ../bind9_9.11.5.P1+dfsg-1ubuntu2.4_source.changes: Valid signature from AC983EB5BF6BCBA9
Checking signature on .dsc
gpg: ../bind9_9.11.5.P1+dfsg-1ubuntu2.4.dsc: Valid signature from AC983EB5BF6BCBA9
Uploading to ubuntu (via ftp to upload.ubuntu.com):
  Uploading bind9_9.11.5.P1+dfsg-1ubuntu2.4.dsc: done.
  Uploading bind9_9.11.5.P1+dfsg-1ubuntu2.4.debian.tar.xz: done.
  Uploading bind9_9.11.5.P1+dfsg-1ubuntu2.4_source.buildinfo: done.
  Uploading bind9_9.11.5.P1+dfsg-1ubuntu2.4_source.changes: done.
Successfully uploaded packages.

diff --git a/debian/changelog b/debian/changelog
index adc178c..6e988f7 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,9 @@
+bind9 (1:9.11.5.P1+dfsg-1ubuntu2.4) disco; urgency=medium
+
+  * d/rules: add back EdDSA support (LP: #1825712)
+
+ -- Andreas Hasenack <[e-mail]>  Fri, 26 Apr 2019 14:20:00 +0000
+
 bind9 (1:9.11.5.P1+dfsg-1ubuntu2.3) disco-security; urgency=medium
 
   * SECURITY UPDATE: limiting simultaneous TCP clients is ineffective
diff --git a/debian/rules b/debian/rules
index 1a22081..905a1da 100755
--- a/debian/rules
+++ b/debian/rules
@@ -76,6 +76,13 @@ override_dh_autoreconf: prepare_native_pkcs11 prepare_version
 
 override_dh_auto_configure:
 	debian/checkapi
+	# Behavior of --with-eddsa:
+	#  yes: enables it for openssl and pkcs11
+	#  no: disables it for openssl and pkcs11
+	#  auto, or absent: enables it for openssl if supported, disables
+	#  it for pkcs11
+	# EDDSA requires openssl 1.1.1 or later.
+	# If EDDSA is enabled, extra symbols will appear in libdns110x.
 	dh_auto_configure -B build -- \
 		--libdir=/usr/lib/$(DEB_HOST_MULTIARCH) \
 		--sysconfdir=/etc/bind \
@@ -101,7 +108,6 @@ override_dh_auto_configure:
 		--enable-native-pkcs11 \
 		--with-pkcs11=\$${prefix}/lib/softhsm/libsofthsm2.so \
 		--with-randomdev=/dev/urandom \
-		--with-eddsa=no \
 		$(EXTRA_FEATURES)
 	dh_auto_configure -B build-udeb -- \
 		--sysconfdir=/etc/bind \
@@ -120,7 +126,6 @@ override_dh_auto_configure:
 		--enable-shared \
 		--with-libtool \
 		--with-gssapi=no \
-		--with-eddsa=no \
 		--libdir=/lib/$(DEB_HOST_MULTIARCH) \
 		--includedir=/usr/include/bind-export
 	sh debian/apply-export-patch