Separate ldns replacement package

.github/workflows/pkg.yml

@@ -11,7 +11,7 @@ on:
   workflow_dispatch:
 
 jobs:
-  package:
+  package-dnst:
     uses: NLnetLabs/ploutos/.github/workflows/pkg-rust.yml@v9
     secrets:
       DOCKER_HUB_ID: ${{ vars.DOCKER_HUB_ID }}
@@ -31,3 +31,16 @@ jobs:
       deb_extra_build_packages: libssl-dev
       rpm_extra_build_packages: make openssl-devel
       rpm_scriptlets_path: pkg/rpm/scriptlets.toml
+
+  package-dnst-ldnsutils:
+    # Package empty dnst-ldnsutils package to create symlinks
+    uses: NLnetLabs/ploutos/.github/workflows/pkg-rust.yml@v9
+    with:
+      package_build_rules: pkg/dnst-ldnsutils/pkg/rules/packages-to-build.yml
+      package_test_rules: pkg/dnst-ldnsutils/pkg/rules/packages-to-test.yml
+      package_test_scripts_path: pkg/dnst-ldnsutils/pkg/test-scripts/test-<package>.sh
+
+      rpm_scriptlets_path: pkg/dnst-ldnsutils/pkg/rpm/scriptlets.toml
+
+      manifest_dir: pkg/dnst-ldnsutils
+      artifact_prefix: dnst-ldnsutils

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "dnst"
-version = "0.1.1-dev"
+version = "0.2.0-alpha1"
 edition = "2021"
 default-run = "dnst"
 readme = "README.md"
@@ -97,19 +97,10 @@
     ["doc/manual/build/man/dnst-nsec3-hash.1", "/usr/share/man/man1/dnst-nsec3-hash.1", "644"],
     ["doc/manual/build/man/dnst-signzone.1", "/usr/share/man/man1/dnst-signzone.1", "644"],
     ["doc/manual/build/man/dnst-update.1", "/usr/share/man/man1/dnst-update.1", "644"],
-    ["doc/manual/build/man/ldns-key2ds.1", "/usr/share/man/man1/ldns-key2ds.1", "644"],
-    ["doc/manual/build/man/ldns-keygen.1", "/usr/share/man/man1/ldns-keygen.1", "644"],
-    ["doc/manual/build/man/ldns-notify.1", "/usr/share/man/man1/ldns-notify.1", "644"],
-    ["doc/manual/build/man/ldns-nsec3-hash.1", "/usr/share/man/man1/ldns-nsec3-hash.1", "644"],
-    ["doc/manual/build/man/ldns-signzone.1", "/usr/share/man/man1/ldns-signzone.1", "644"],
-    ["doc/manual/build/man/ldns-update.1", "/usr/share/man/man1/ldns-update.1", "644"],
 ]
 changelog = "target/debian/changelog" # this will be generated by the pkg workflow
 copyright = "Copyright (c) 2024, NLnet Labs. All rights reserved."
 maintainer-scripts = "pkg/debian"
-# See: https://www.debian.org/doc/debian-policy/ch-relationships.html#replacing-whole-packages-forcing-their-removal
-conflicts = "ldnsutils"
-replaces = "ldnsutils"
 
 # Related reading: https://docs.fedoraproject.org/en-US/packaging-guidelines/Rust/
 [package.metadata.generate-rpm]
@@ -124,18 +115,4 @@
     { source = "doc/manual/build/man/dnst-nsec3-hash.1", dest = "/usr/share/man/man1/dnst-nsec3-hash.1", mode = "644", doc = true },
     { source = "doc/manual/build/man/dnst-signzone.1", dest = "/usr/share/man/man1/dnst-signzone.1", mode = "644", doc = true },
     { source = "doc/manual/build/man/dnst-update.1", dest = "/usr/share/man/man1/dnst-update.1", mode = "644", doc = true },
-    { source = "doc/manual/build/man/ldns-key2ds.1", dest = "/usr/share/man/man1/ldns-key2ds.1", mode = "644", doc = true },
-    { source = "doc/manual/build/man/ldns-keygen.1", dest = "/usr/share/man/man1/ldns-keygen.1", mode = "644", doc = true },
-    { source = "doc/manual/build/man/ldns-notify.1", dest = "/usr/share/man/man1/ldns-notify.1", mode = "644", doc = true },
-    { source = "doc/manual/build/man/ldns-nsec3-hash.1", dest = "/usr/share/man/man1/ldns-nsec3-hash.1", mode = "644", doc = true },
-    { source = "doc/manual/build/man/ldns-signzone.1", dest = "/usr/share/man/man1/ldns-signzone.1", mode = "644", doc = true },
-    { source = "doc/manual/build/man/ldns-update.1", dest = "/usr/share/man/man1/ldns-update.1", mode = "644", doc = true },
 ]
-
-# These get set using cargo-generate-rpm --set-metadata at package build time.
-#post_trans_script = ...
-#post_uninstall_script = ...
-
-# Set Obsoletes per https://docs.fedoraproject.org/en-US/packaging-guidelines/#renaming-or-replacing-existing-packages.
-[package.metadata.generate-rpm.obsoletes]
-ldns-utils = "< 0:1.8.4-2"

Dockerfile

@@ -44,7 +44,7 @@ ARG MODE=build
 # ========
 #
 # Only used when MODE=build.
-ARG BASE_IMG=alpine:3.21
+ARG BASE_IMG=alpine:3.23
 
 
 # CARGO_ARGS

pkg/debian/postinst

@@ -2,12 +2,5 @@
 
 # case "$1" in
 # configure)
-#     # Create symbolic links
-#     ln -f -s /usr/bin/dnst /usr/bin/ldns-keygen
-#     ln -f -s /usr/bin/dnst /usr/bin/ldns-key2ds
-#     ln -f -s /usr/bin/dnst /usr/bin/ldns-nsec3-hash
-#     ln -f -s /usr/bin/dnst /usr/bin/ldns-notify
-#     ln -f -s /usr/bin/dnst /usr/bin/ldns-signzone
-#     ln -f -s /usr/bin/dnst /usr/bin/ldns-update
 #     ;;
 # esac

pkg/debian/prerm

@@ -2,7 +2,5 @@
 
 # case "$1" in
 # upgrade|remove)
-#     # Remove symbolic links
-#     rm -f /usr/bin/ldns-nsec3-hash
 #     ;;
 # esac

pkg/dnst-ldnsutils/Cargo.toml

@@ -0,0 +1,54 @@
+[package]
+# This is a dummy program to build a separate package with ploutos
+name = "dnst-ldnsutils"
+version = "0.2.0-alpha1"
+edition = "2021"
+repository = "https://github.com/nlnetlabs/dnst/"
+authors = ["NLnet Labs <dns-team@nlnetlabs.nl>"]
+description = "Package for dnst's ldns symlinks and man pages"
+license = "BSD-3-Clause"
+
+[dependencies]
+
+# Related reading: https://wiki.debian.org/Teams/RustPackaging/Policy
+[package.metadata.deb]
+depends = "$auto, dnst"
+section = "net"
+priority = "optional"
+assets = [
+    # TODO: Extend Ploutos to generate the man pages from sources.
+    ["../../doc/manual/build/man/ldns-key2ds.1", "/usr/share/man/man1/ldns-key2ds.1", "644"],
+    ["../../doc/manual/build/man/ldns-keygen.1", "/usr/share/man/man1/ldns-keygen.1", "644"],
+    ["../../doc/manual/build/man/ldns-notify.1", "/usr/share/man/man1/ldns-notify.1", "644"],
+    ["../../doc/manual/build/man/ldns-nsec3-hash.1", "/usr/share/man/man1/ldns-nsec3-hash.1", "644"],
+    ["../../doc/manual/build/man/ldns-signzone.1", "/usr/share/man/man1/ldns-signzone.1", "644"],
+    ["../../doc/manual/build/man/ldns-update.1", "/usr/share/man/man1/ldns-update.1", "644"],
+]
+copyright = "Copyright (c) 2024, NLnet Labs. All rights reserved."
+extended-description = """\
+This is a meta package that replaces the original ldnsutils with their dnst
+counterparts (where implemented).
+"""
+maintainer-scripts = "pkg/debian"
+# See: https://www.debian.org/doc/debian-policy/ch-relationships.html#replacing-whole-packages-forcing-their-removal
+conflicts = "ldnsutils"
+replaces = "ldnsutils"
+
+# Related reading: https://docs.fedoraproject.org/en-US/packaging-guidelines/Rust/
+[package.metadata.generate-rpm]
+assets = [
+    # TODO: Extend Ploutos to generate the man pages from sources.
+    { source = "../../doc/manual/build/man/ldns-key2ds.1", dest = "/usr/share/man/man1/ldns-key2ds.1", mode = "644", doc = true },
+    { source = "../../doc/manual/build/man/ldns-keygen.1", dest = "/usr/share/man/man1/ldns-keygen.1", mode = "644", doc = true },
+    { source = "../../doc/manual/build/man/ldns-notify.1", dest = "/usr/share/man/man1/ldns-notify.1", mode = "644", doc = true },
+    { source = "../../doc/manual/build/man/ldns-nsec3-hash.1", dest = "/usr/share/man/man1/ldns-nsec3-hash.1", mode = "644", doc = true },
+    { source = "../../doc/manual/build/man/ldns-signzone.1", dest = "/usr/share/man/man1/ldns-signzone.1", mode = "644", doc = true },
+    { source = "../../doc/manual/build/man/ldns-update.1", dest = "/usr/share/man/man1/ldns-update.1", mode = "644", doc = true },
+]
+
+[package.metadata.generate-rpm.requires]
+dnst = "*"
+
+# Set Obsoletes per https://docs.fedoraproject.org/en-US/packaging-guidelines/#renaming-or-replacing-existing-packages.
+[package.metadata.generate-rpm.obsoletes]
+ldns-utils = "< 0:1.8.4-2"

pkg/dnst-ldnsutils/pkg/debian/postinst

@@ -0,0 +1,13 @@
+#!/bin/sh -e
+
+case "$1" in
+configure)
+    # Create symbolic links
+    ln -f -s /usr/bin/dnst /usr/bin/ldns-keygen
+    ln -f -s /usr/bin/dnst /usr/bin/ldns-key2ds
+    ln -f -s /usr/bin/dnst /usr/bin/ldns-nsec3-hash
+    ln -f -s /usr/bin/dnst /usr/bin/ldns-notify
+    ln -f -s /usr/bin/dnst /usr/bin/ldns-signzone
+    ln -f -s /usr/bin/dnst /usr/bin/ldns-update
+    ;;
+esac

pkg/dnst-ldnsutils/pkg/debian/prerm

@@ -0,0 +1,13 @@
+#!/bin/sh -e
+
+case "$1" in
+upgrade|remove)
+    # Remove symbolic links
+    rm -f /usr/bin/ldns-keygen
+    rm -f /usr/bin/ldns-key2ds
+    rm -f /usr/bin/ldns-nsec3-hash
+    rm -f /usr/bin/ldns-notify
+    rm -f /usr/bin/ldns-signzone
+    rm -f /usr/bin/ldns-update
+    ;;
+esac

pkg/dnst-ldnsutils/pkg/rpm/scriptlets.toml

@@ -0,0 +1,39 @@
+post_trans_script = '''
+#!/bin/bash -e
+
+# This script will be run _after_ upgrade in the presence of an obsoleted ldns-utils
+# package. This is useful because the ldns-utils uninstall script will have been run
+# _after_ installation of dnst and so the symbolic links that we create will be
+# removed, and we have to make sure here that they get put back
+
+FORCE=
+# See: https://docs.fedoraproject.org/en-US/packaging-guidelines/Scriptlets/#_syntax
+if [ $1 -eq 2 ]; then
+    # Upgrade
+    FORCE=-f
+fi
+
+# Create symbolic links
+ln -s ${FORCE} /usr/bin/dnst /usr/bin/ldns-keygen
+ln -s ${FORCE} /usr/bin/dnst /usr/bin/ldns-key2ds
+ln -s ${FORCE} /usr/bin/dnst /usr/bin/ldns-nsec3-hash
+ln -s ${FORCE} /usr/bin/dnst /usr/bin/ldns-notify
+ln -s ${FORCE} /usr/bin/dnst /usr/bin/ldns-signzone
+ln -s ${FORCE} /usr/bin/dnst /usr/bin/ldns-update
+'''
+
+post_uninstall_script = '''
+#!/bin/bash -e
+
+# See: https://docs.fedoraproject.org/en-US/packaging-guidelines/Scriptlets/#_syntax
+if [ $1 -eq 0 ] ; then
+    # Uninstallation
+    # Remove symbolic links
+    rm -f /usr/bin/ldns-keygen
+    rm -f /usr/bin/ldns-key2ds
+    rm -f /usr/bin/ldns-nsec3-hash
+    rm -f /usr/bin/ldns-notify
+    rm -f /usr/bin/ldns-signzone
+    rm -f /usr/bin/ldns-update
+fi
+'''

pkg/dnst-ldnsutils/pkg/rules/packages-to-build.yml

@@ -0,0 +1,41 @@
+# This matrix definition is used as both the package_build_rules and the package_test_rules Ploutos packaging
+# workflow inputs.
+---
+pkg:
+  - 'dnst-ldnsutils'
+image:
+  - "ubuntu:jammy"    # ubuntu/22.04
+  - "ubuntu:noble"    # ubuntu/24.04
+  - "debian:bullseye" # debian/11
+  - "debian:bookworm" # debian/12
+  - "debian:trixie"   # debian/13
+  - 'almalinux:8'     # compatible with EOL centos:8
+  - 'almalinux:9'
+  - 'almalinux:10'
+target:
+  - 'x86_64'
+include:
+  # package for the Raspberry Pi 4b as an ARMv7 cross compiled variant of the Debian Bullseye upon which
+  # Raspbian 11 is based.
+  - pkg: 'dnst-ldnsutils'
+    image: 'debian:bullseye'
+    target: 'armv7-unknown-linux-musleabihf'
+
+  # package for the Raspberry Pi 1b as an ARMv6 cross compiled variant of the Debian Buster upon which
+  # Raspbian 10 is based.
+  - pkg: 'dnst-ldnsutils'
+    image: 'debian:buster'
+    target: 'arm-unknown-linux-musleabihf'
+
+  # package for the ROCK64 as an AARCH64 cross compiled variant of Debian Buster upon which Armbian 21 is based.
+  - pkg: 'dnst-ldnsutils'
+    image: 'debian:buster'
+    target: 'aarch64-unknown-linux-musl'
+
+  # Set rpmlint filters for RHEL rpmlint
+  - image: 'almalinux:8'
+    rpm_rpmlint_check_filters: no-binary
+  - image: 'almalinux:9'
+    rpm_rpmlint_check_filters: no-binary
+  - image: 'almalinux:10'
+    rpm_rpmlint_check_filters: no-binary

pkg/dnst-ldnsutils/pkg/rules/packages-to-test.yml

@@ -0,0 +1,63 @@
+# This matrix definition is used as both the package_build_rules and the package_test_rules Ploutos packaging
+# workflow inputs.
+---
+pkg:
+  - 'dnst-ldnsutils'
+image:
+  - "ubuntu:jammy"    # ubuntu/22.04
+  - "ubuntu:noble"    # ubuntu/24.04
+  - "debian:bullseye" # debian/11
+  - "debian:bookworm" # debian/12
+  - "debian:trixie"   # debian/13
+published_pkg:
+  - 'ldnsutils'       # correct for Ubuntu/Debian
+target:
+  - 'x86_64'
+test-image:
+  # Set 'test-image' to the empty string for all matrix permutations so that the default ('image') will be used
+  # to launch an LXC container to test the created packages in. Why explicitly set what is already the default?
+  # If this isn't present, later entries in the include set below will overwrite earlier entries that differ
+  # only by their 'test-image' value. If however 'test-image' is present in the original matrix by defining it
+  # here, then 'included' entries will no longer overwrite each other because they alter a key that is present
+  # in the original matrix. This is just how GitHub Actions matrix include rules work.
+  - ""
+test-mode:   
+  - 'fresh-install'
+  - 'upgrade-from-published'
+include:
+  - pkg: 'dnst-ldnsutils'
+    image: 'almalinux:8'
+    target: 'x86_64'
+    test-mode: 'fresh-install'
+
+  - pkg: 'dnst-ldnsutils'
+    image: 'almalinux:8'
+    target: 'x86_64'
+    test-mode: 'upgrade-from-published'
+    published_pkg: 'ldns-utils'
+    rpm_yum_extra_args: --enablerepo powertools
+
+  - pkg: 'dnst-ldnsutils'
+    image: 'almalinux:9'
+    target: 'x86_64'
+    test-mode: 'fresh-install'
+
+  - pkg: 'dnst-ldnsutils'
+    image: 'almalinux:9'
+    target: 'x86_64'
+    test-mode: 'upgrade-from-published'
+    published_pkg: 'ldns-utils'
+    rpm_yum_extra_args: --enablerepo crb
+
+  - pkg: 'dnst-ldnsutils'
+    image: 'almalinux:10'
+    target: 'x86_64'
+    test-mode: 'fresh-install'
+
+  - pkg: 'dnst-ldnsutils'
+    image: 'almalinux:10'
+    target: 'x86_64'
+    test-mode: 'upgrade-from-published'
+    published_pkg: 'ldns-utils'
+    # --enablerepo crb is no longer needed since alma10 (https://almalinux.org/blog/2025-09-08-enabling-crb-by-default-for-almalinux10/)
+    # rpm_yum_extra_args: --enablerepo crb

pkg/dnst-ldnsutils/pkg/test-scripts/test-dnst-ldnsutils.sh

@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+
+set -eo pipefail
+set -x
+
+case $1 in
+  post-install)
+    # Run some sanity checks
+    ldns-keygen -v
+    ldns-nsec3-hash nlnetlabs.nl
+    man ldns-keygen
+    ;;
+
+  post-upgrade)
+    # Nothing to do.
+    # Run some sanity checks
+    ldns-keygen -v
+    ldns-nsec3-hash nlnetlabs.nl
+    man ldns-keygen
+    ;;
+esac

pkg/dnst-ldnsutils/src/main.rs

@@ -0,0 +1 @@
+fn main() {}