Date: Thu, 26 Mar 2020 12:46:54 +0100
From: Natanael Copa <ncopa@alpinelinux.org>
To: Alpine develmopment <~alpine/devel@lists.alpinelinux.org>
Subject: DNS resolvers and root hints
Message-ID: <20200326124654.1352edb8@ncopa-desktop.copa.dup.pw>
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit

Hi!

We got a request[1] to remove dns-root-hints package, which has been a
source of controversy in the past.

The problem is that a DNS resolver needs the root hints to resolve and
this data is not static, it changes over time. To fetch the updated
root.hints you need an old version of it (eg it is a boot strap
problem), so we ship a copy of root hints with our resolvers.

[1]: https://gitlab.alpinelinux.org/alpine/aports/issues/11324

There are two problems with this: The root.hints gets outdated and need
to be maintained. We have been rightfully critizised for not maintain
this well in the past. To solve this we provide a maintenance cron job
that fetches it regularily. This leads to the second problem:
Maintenance script requires gnupg to verify signature, so it introduces
a big dependency chain for the resolvers.

As I see we have the following options:

1) keep things as it currently is, provide a shared dns-root-hints with
update script/cronjob.
Pros:
  - resolvers work out of the box, inclusive maintenance
  - relatively low maintance for us. we only need keep the version in
    git master updated. (update one branch once every 6 months)
Cons:
  - we have gnupg dependency for all resolvers, which may not be needed
    for everyone.
  - non trivial to remove gnupg if update script is not needed/used



2) keep dns-root-hints as optional package, but remove the hard dependency of it
Pros:
  - relatively low maintenance for us. we only need update git master
    every six months.
  - give flexibility to use own solution or use the dns-roots-hits
    solution from alpine repos.
Cons:
  - resolvers may not work out of the box and users may need to
    explicitly install the extra  dns-root-hints package. This needs to
    be documented.
  - we still need to maintain the optional dns-root-hints package.
  - DNS resolving may break for users when they upgrade



3) keep dns-root-hints but exclude the update script
Pros:
  - resolvers will work out of the box
  - we get rid of gnupg dependency
  - backwards compatible. upgrades will not break anything
Cons:
  - more maintenance on us. we may need update the package every 6
    months for our 5 maintained git branches. (master + 4 x 3.*-stable)



4) remove dns-root-hints and let user deal with it.
Pros:
  - saves us for lots of work
Cons:
  - resolvers will probably not work out of the box (at least unbound
    ships with an internal root.hints so I think unbound will work)
  - inconvenient for users who will have to write their own
  - DNS resolving may break for users when they upgrade



Do we have other options?

What do you think we should do?

Are there any volunteers to do maintenance (for option 3)?


-nc