NetBSD Problem Report #60447

From www@netbsd.org  Mon Jul 13 21:21:34 2026
Return-Path: <www@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256
	 client-signature RSA-PSS (2048 bits) client-digest SHA256)
	(Client CN "mail.netbsd.org", Issuer "YR2" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id 695D21A923E
	for <gnats-bugs@gnats.NetBSD.org>; Mon, 13 Jul 2026 21:21:34 +0000 (UTC)
Message-Id: <20260713212133.15F171A923F@mollari.NetBSD.org>
Date: Mon, 13 Jul 2026 21:21:33 +0000 (UTC)
From: erik@eriklabine.com
Reply-To: erik@eriklabine.com
To: gnats-bugs@NetBSD.org
Subject: unbound rc.d fails on fresh install before configuration migration can run
X-Send-Pr-Version: www-1.0
X-From4GNATS: "erik@eriklabine.com via gnats" <gnats-admin@NetBSD.org>

>Number:         60447
>Category:       bin
>Synopsis:       unbound rc.d fails on fresh install before configuration migration can run
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    riastradh
>State:          closed
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Mon Jul 13 21:25:00 +0000 2026
>Closed-Date:    Sun Jul 19 17:22:51 +0000 2026
>Last-Modified:  Sun Jul 19 17:22:51 +0000 2026
>Originator:     Erik LaBine
>Release:        NetBSD 11.0_RC6
>Organization:
>Environment:
NetBSD crows.email 11.0_RC6 NetBSD 11.0_RC6 (GENERIC) #0: Tue Jul  7 15:10:39 UTC 2026  mkrepro@mkrepro.NetBSD.org:/usr/src/sys/arch/amd64/compile/GENERIC amd64
>Description:
On a fresh install of NetBSD 11.0_RC6 amd64, setting unbound=YES results in an error message during system startup.

unbound-checkconf[695:0] error: Could not open /var/chroot/unbound/etc/unbound/unbound.conf: No such file or directory
/etc/rc.d/unbound exited with code 1

It appears the script as currently written is running unbound-checkconf before it runs the migration. Since checkconf will fail on a fresh install, the script returns early. It won't reach the call to unbound_migrate().
>How-To-Repeat:
>From a fresh install, add 'unbound=YES' to /etc/rc.conf

Reboot, and the error message will be in the rc.log
>Fix:
Index: external/bsd/unbound/etc/rc.d/unbound
===================================================================
RCS file: /cvsroot/src/external/bsd/unbound/etc/rc.d/unbound,v
retrieving revision 1.2.18.1
diff -u -r1.2.18.1 unbound
--- external/bsd/unbound/etc/rc.d/unbound       3 Jul 2026 17:58:23 -0000       1.2.18.1
+++ external/bsd/unbound/etc/rc.d/unbound       13 Jul 2026 20:58:37 -0000
@@ -63,7 +63,15 @@

 unbound_precmd()
 {
-       local root_key
+       if [ -z "$unbound_chrootdir" ]; then
+               return
+       fi
+
+       if [ ! -h /etc/unbound ]; then
+               unbound_migrate /etc/unbound ${unbound_chrootdir}
+       fi
+
+       local root_key anchor_status

        if checkyesno unbound_auto_trust_anchor; then
                root_key=$(su -m _unbound -c \
@@ -73,16 +81,17 @@
                        echo Bootstrapping Unbound DNS trust anchors.
                        su -m _unbound -c 'unbound-anchor -a "$1"' -- \
                            /etc/unbound/"$root_key"
-               fi
-       fi
-
-       if [ -z "$unbound_chrootdir" ]; then
-               return
-       fi
+                       anchor_status=$?

-       if [ ! -h /etc/unbound ]; then
-               unbound_migrate /etc/unbound ${unbound_chrootdir}
+                       if [ "$anchor_status" -ne 1 ] ||
+                               [ ! -s /etc/unbound/"$root_key" ]
+                       then
+                               echo "Failed to create trust anchor"
+                               return 1
+                       fi
+               fi
        fi
+       return 0
 }

 load_rc_config $name

>Release-Note:

>Audit-Trail:

Responsible-Changed-From-To: bin-bug-people->riastradh
Responsible-Changed-By: riastradh@NetBSD.org
Responsible-Changed-When: Wed, 15 Jul 2026 03:35:01 +0000
Responsible-Changed-Why:
my mistake


State-Changed-From-To: open->needs-pullups
State-Changed-By: riastradh@NetBSD.org
State-Changed-When: Wed, 15 Jul 2026 03:35:01 +0000
State-Changed-Why:
fixed in HEAD (test, please!), needs pullup-11


From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/60447 CVS commit: src/external/bsd/unbound/etc/rc.d
Date: Wed, 15 Jul 2026 03:34:13 +0000

 Module Name:	src
 Committed By:	riastradh
 Date:		Wed Jul 15 03:34:13 UTC 2026

 Modified Files:
 	src/external/bsd/unbound/etc/rc.d: unbound

 Log Message:
 /etc/rc.d/unbound: Fix order of migration and trust anchor setup.

 Add some comments explaining the order, and make sure we propagate
 various failures back to the caller.

 Based on a patch by Erik LaBine.

 PR bin/60447: unbound rc.d fails on fresh install before
 configuration migration can run


 To generate a diff of this commit:
 cvs rdiff -u -r1.3 -r1.4 src/external/bsd/unbound/etc/rc.d/unbound

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

State-Changed-From-To: needs-pullups->pending-pullups
State-Changed-By: riastradh@NetBSD.org
State-Changed-When: Wed, 15 Jul 2026 12:57:45 +0000
State-Changed-Why:
pullup-11 #382 https://releng.netbsd.org/cgi-bin/req-11.cgi?show=382
inapplicable <11


From: erik@eriklabine.com
To: gnats-bugs@netbsd.org
Cc: 
Subject: Re: PR/60447
Date: Wed, 15 Jul 2026 08:46:53 -0500 (EST)

 Tested v 1.4 on NetBSD 11.0_RC6 amd64 after restoring the original system state to related files.

 Conf migration was successful, the trust anchor was created, and unbound started up as expected. I like the comments that were added!

From: Taylor R Campbell <riastradh@NetBSD.org>
To: gnats-bugs@netbsd.org
Cc: gnats-admin@netbsd.org, netbsd-bugs@netbsd.org, erik@eriklabine.com
Subject: Re: PR/60447
Date: Wed, 15 Jul 2026 14:18:55 +0000

 > Date: Wed, 15 Jul 2026 08:46:53 -0500 (EST)
 > From: erik@eriklabine.com
 > 
 > Tested v 1.4 on NetBSD 11.0_RC6 amd64 after restoring the original
 > system state to related files.
 > 
 > Conf migration was successful, the trust anchor was created, and
 > unbound started up as expected. I like the comments that were added!

 Great, thanks for testing!

From: "Martin Husemann" <martin@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/60447 CVS commit: [netbsd-11] src/external/bsd/unbound/etc/rc.d
Date: Sun, 19 Jul 2026 16:31:37 +0000

 Module Name:	src
 Committed By:	martin
 Date:		Sun Jul 19 16:31:37 UTC 2026

 Modified Files:
 	src/external/bsd/unbound/etc/rc.d [netbsd-11]: unbound

 Log Message:
 Pull up following revision(s) (requested by riastradh in ticket #382):

 	external/bsd/unbound/etc/rc.d/unbound: revision 1.4

 /etc/rc.d/unbound: Fix order of migration and trust anchor setup.

 Add some comments explaining the order, and make sure we propagate
 various failures back to the caller.

 Based on a patch by Erik LaBine.

 PR bin/60447: unbound rc.d fails on fresh install before
 configuration migration can run


 To generate a diff of this commit:
 cvs rdiff -u -r1.2.18.1 -r1.2.18.2 src/external/bsd/unbound/etc/rc.d/unbound

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

State-Changed-From-To: pending-pullups->closed
State-Changed-By: riastradh@NetBSD.org
State-Changed-When: Sun, 19 Jul 2026 17:22:51 +0000
State-Changed-Why:
fixed in HEAD, pulled up to 11, inapplicable <11


>Unformatted:

Home	PR Database Search