dns-root-data (2025080400~deb13u1) trixie; urgency=medium

  * Rebuild the package for trixie to make possible to rebuild it again
    during the distribution lifetime. (See #1091496.)
    The content of the binary package is unchanged from version
    2024071801, which is the one currently in trixie.

 -- Marco d'Itri <md@linux.it>  Sat, 08 Nov 2025 01:42:11 +0100

dns-root-data (2025080400) unstable; urgency=medium

  * Update root-anchors.p7s (the signature of root-anchors.xml) with a new
    expiration date of Dec 18 04:19:12 2029 GMT.
    The old signature would expire on Jul  7 22:48:13 2026 GMT.
    (Closes: #1091496)

 -- Marco d'Itri <md@linux.it>  Mon, 18 Aug 2025 12:22:39 +0200

dns-root-data (2024071801) unstable; urgency=medium

  * Actually add the DNSKEY record for KSK-2024, which was not distributed
    in release 2024071800 because it is not yet published in the root zone.
  * Replace the parser of the root-anchors.xml file with a new one which
    follows RFC 7958bis and will output all valid and not expired DS and
    DNSKEY records, no matter if they are currently published in the root
    zone or not.
  * Document the package in README.Debian. (Closes: #995890)

 -- Marco d'Itri <md@linux.it>  Sun, 17 Nov 2024 21:57:17 +0100

dns-root-data (2024071800) unstable; urgency=medium

  * Update root-anchors.xml and its signature to add the new KSK-2024.
    (Closes: #1076995)

 -- Marco d'Itri <md@linux.it>  Thu, 07 Nov 2024 22:51:09 +0100

dns-root-data (2024041802) unstable; urgency=medium

  * Stop installing root.hints.sig, since no package actually uses the file.
  * Stop the package from FTBFS in the periods between when root-anchors.xml
    is updated and the new root KSK is actually published in the DNS.

 -- Marco d'Itri <md@linux.it>  Sun, 18 Aug 2024 02:18:32 +0200

dns-root-data (2024041801) unstable; urgency=medium

  * Add myself to the Uploaders field, as discussed with Ondřej.
  * Fix the package description. (Closes: #1064829)
  * Update the expired Verisign GRS PGP key.
  * Update the root hints file to version 2024041801, with:
    + updated A and AAAA records for B. (Closes: #1054393)

 -- Marco d'Itri <md@linux.it>  Tue, 21 May 2024 16:25:44 +0200

dns-root-data (2023010101) unstable; urgency=medium

  * merge current root hints and signatures (same contents as before)
  * d/copyright: bump to 2023

 -- Daniel Kahn Gillmor <dkg@fifthhorseman.net>  Wed, 11 Jan 2023 10:00:11 -0500

dns-root-data (2022120101) unstable; urgency=medium

  * Updated upstream root data (same contents as before)
  * d/copyright: update for 2022
  * Standards-Version: bump to 4.6.1 (no changes needed)

 -- Daniel Kahn Gillmor <dkg@fifthhorseman.net>  Tue, 20 Dec 2022 18:51:44 -0500

dns-root-data (2021011101) unstable; urgency=medium

  * updated upstream root data (same contents as before)
  * wrap-and-sort -ast
  * improve autopkgtest (Closes: #979840)
  * move to dh 13
  * Standards-Version: bump to 4.5.1 (no changes needed)

 -- Daniel Kahn Gillmor <dkg@fifthhorseman.net>  Fri, 12 Feb 2021 20:54:19 -0500

dns-root-data (2019052802) unstable; urgency=medium

  * use https for data.iana.org
  * update root data to 2019052802

 -- Daniel Kahn Gillmor <dkg@fifthhorseman.net>  Wed, 29 May 2019 13:05:03 -0400

dns-root-data (2019031302) unstable; urgency=medium

  * cryptographically verify root.hints
  * get_orig_source: refresh root-anchors.{xml,p7s} as well
  * update root data to 2019031302
  * standards-version: bump to 4.3.0 (no changes needed)
  * parse-root-anchors.sh: account for validity windows
  * check: deliberately skip the TTL generated by ldns-key2ds
  * dns-root-data is Multi-Arch: foreign

 -- Daniel Kahn Gillmor <dkg@fifthhorseman.net>  Sat, 23 Mar 2019 15:33:17 +0100

dns-root-data (2018091102) unstable; urgency=medium

  * new upstream version of root.hints, 2018091102
  * use DEP-14 branches
  * Standards-Version: 4.2.1 (no changes needed)
  * add Rules-Requires-Root: no
  * add baseline autopkgtest

 -- Daniel Kahn Gillmor <dkg@fifthhorseman.net>  Mon, 15 Oct 2018 13:45:59 -0400

dns-root-data (2018013001) unstable; urgency=medium

  * new upstream version of root.hints, 2018013001
  * use wrap-and-sort -ast
  * added myself to uploaders
  * d/control: use dns-root-data@packages.debian.org as Maintainer
  * Standards-Version: bump to 4.1.3 (no changes needed)
  * d/control: move Vcs-* to salsa.debian.org
  * move to debhelper 11
  * d/rules: clean up get_orig_source
  * sort generated .ds files by key tag
  * d/rules: trim trailing whitespace
  * d/copyright: Format: use https
  * d/copyright: add my own copyright to debian/*
  * d/copyright: name upstream data grant "ICANN-Public"
  * d/copyright: Source: use https:
  * update README.source to cover the different origins of the data
  * Update order of root.key to follow output of unbound-anchor

 -- Daniel Kahn Gillmor <dkg@fifthhorseman.net>  Wed, 31 Jan 2018 23:02:05 -0500

dns-root-data (2017072601) unstable; urgency=medium

  * Update root.hints to 2017072601 version

 -- Ondřej Surý <ondrej@debian.org>  Wed, 23 Aug 2017 08:45:33 +0200

dns-root-data (2017071401) unstable; urgency=medium

  * Update the root.hints to 2017060102 version
  * Change the state of KSK-2017 to VALID

 -- Ondřej Surý <ondrej@debian.org>  Fri, 14 Jul 2017 14:12:52 +0200

dns-root-data (2017041102) unstable; urgency=high

  [ Robert Edmonds ]
  * Change DS creation to omit TTL and use spaces instead of tabs
    (Closes: #864016)

 -- Ondřej Surý <ondrej@debian.org>  Tue, 06 Jun 2017 12:54:28 +0200

dns-root-data (2017041101) unstable; urgency=medium

  * Fix parse-root-anchors.sh in non-dash shells (Closes: #862252)
  * Update to 2017041101 version of root zone
  * Remove timestamps from root.key to make the build reproducible
  * Shell syntax cleanup

 -- Ondřej Surý <ondrej@debian.org>  Mon, 29 May 2017 14:05:37 +0200

dns-root-data (2017020200) unstable; urgency=medium

  * Update to 2016102001 version of the root.zone
  * Add KSK-2017 (valid from 2017-02-02) into root.key file
  * Reduce number of IANA files as they don't exist at upstream anymore
  * draft-icann-dnssec-trust-anchor is now RFC 7958
  * Update all other IANA DNSSEC files to 2017-02-02 versions
  * Strip the GPG verification as IANA doesn't provide the GPG signatures
    anymore
  * Rewrite DS creation check to xml2 and ldnsutils, as neither xmllint
    nor bind9utils handle multiple DNSKEY in one file correctly

 -- Ondřej Surý <ondrej@debian.org>  Wed, 22 Mar 2017 09:06:08 +0100

dns-root-data (2015052300+h+1) unstable; urgency=medium

  * Update root.hints to 2015052300 version
  * Move the package under Debian DNS Maintainers umbrella
  * Implement the H.ROOT-SERVERS.NET IP addresses changes
    that's scheduled for December 1st, but operational now

 -- Ondřej Surý <ondrej@debian.org>  Tue, 01 Sep 2015 13:32:02 +0200

dns-root-data (2014060201+2) unstable; urgency=medium

  * Use full path for dnssec-dsfromkey (Closes: #760103)

 -- Ondřej Surý <ondrej@debian.org>  Thu, 04 Sep 2014 13:12:40 +0200

dns-root-data (2014060201+1) unstable; urgency=low

  * Add Robert Edmonds as co-maintainer
  * Don't install root zone (it changes too often) and install static data
    into /usr/share/dns/
  * Also install dnssec-trust-anchor documentation into the package
  * Strip unbound-anchor metadata from root.key when fetching new root.key

 -- Ondřej Surý <ondrej@debian.org>  Mon, 30 Jun 2014 10:42:07 +0200

dns-root-data (2014060201) unstable; urgency=low

  * Initial release (Closes: #752745)

 -- Ondřej Surý <ondrej@debian.org>  Thu, 26 Jun 2014 10:46:45 +0200
