Import primary data on DNSSEC primaries; add DATA_DROP_IMPORT (0.6.5)

CHANGELOG.md

@@ -5,6 +5,26 @@ versioning once its djbdns-compatible public surface stabilizes.
 
 ## [Unreleased]
 
+## [0.6.5] - 2026-09-12
+
+### Fixed
+
+- `rgbdns-data-import` now works on a DNSSEC primary. In DNSSEC mode
+  `compile-zone` only verifies the already published signed CDB, which the
+  import's private stage does not contain, so every upload failed silently
+  with status 1. The upload is now validated with the plain `tinydns-data`
+  compiler, only the `data` source is replaced, and
+  `rgbdns-dnssec-publish.service` (already started after the import) signs,
+  verifies and publishes `data.cdb`. An unsigned database is never served.
+
+### Added
+
+- `DATA_DROP_IMPORT=disabled` in `/etc/rgbdns/data-drop.env`, written by
+  `rgbdns-setup primary --data-drop-import disabled`, skips the data import
+  for primaries whose data is deployed into the state directory by other
+  means. `rgbdns-data-import.service` checks it with `ExecCondition=`, so a
+  disabled run is skipped rather than failed.
+
 ## [0.6.4] - 2026-09-12
 
 ### Fixed

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "rgbdns"
-version = "0.6.4"
+version = "0.6.5"
 edition = "2024"
 license = "Unlicense"
 description = "A safe, faithful Rust reimplementation of the djbdns suite"

README.md

@@ -172,7 +172,7 @@ On Debian or Ubuntu, build the package with:
 ```sh
 sudo apt install build-essential cargo debhelper rustc
 packaging/build-deb.sh
-sudo apt install ../rgbdns_0.6.4_$(dpkg --print-architecture).deb
+sudo apt install ../rgbdns_0.6.5_$(dpkg --print-architecture).deb
 ```
 
 On openSUSE Leap 16.0, build the RPM with:
@@ -182,7 +182,7 @@ sudo zypper --non-interactive install \
   git cargo rust python3 rpm-build systemd-rpm-macros
 packaging/build-rpm.sh
 sudo zypper --non-interactive --no-gpg-checks install \
-  dist/rpmbuild/RPMS/x86_64/rgbdns-0.6.4-1.x86_64.rpm
+  dist/rpmbuild/RPMS/x86_64/rgbdns-0.6.5-1.x86_64.rpm
 ```
 
 ## Book

debian/changelog

@@ -1,3 +1,13 @@
+rgbdns (0.6.5) unstable; urgency=medium
+
+  * Import primary data uploads on DNSSEC primaries: validate with
+    tinydns-data, replace only the source and let rgbdns-dnssec-publish
+    sign and publish it. The import used to fail silently.
+  * Add DATA_DROP_IMPORT=disabled (rgbdns-setup --data-drop-import) to skip
+    the import where data is deployed into the state directory directly.
+
+ -- Alexy Khrabrov <deliverable@gmail.com>  Sat, 12 Sep 2026 23:55:25 +0200
+
 rgbdns (0.6.4) unstable; urgency=medium
 
   * Publish the newer of the source data serial and the stored ACME serial for

debian/rgbdns.7

@@ -1,4 +1,4 @@
-.TH RGBDNS 7 "2026-08-18" "rgbdns 0.6.4" "System Administration"
+.TH RGBDNS 7 "2026-08-18" "rgbdns 0.6.5" "System Administration"
 .SH NAME
 rgbdns \- authoritative DNS, AXFR, recursion, and djbdns-compatible tools
 .SH SYNOPSIS
@@ -42,6 +42,9 @@ Configured scp drop path and required upload owner.
 .TP
 .I /etc/rgbdns/data-drop.env
 Configured primary-data scp drop path and required upload owner.
+.B DATA_DROP_IMPORT=disabled
+skips the import, for primaries whose data is deployed into the state
+directory directly.
 .TP
 .I /var/lib/rgbdns/tinydns/data
 Tinydns-format zone source.

docs/DEBIAN.md

@@ -20,7 +20,7 @@ sudo apt install build-essential cargo debhelper rustc
 git clone https://github.com/querygraph/rgbdns.git
 cd rgbdns
 packaging/build-deb.sh
-sudo apt install ../rgbdns_0.6.4_$(dpkg --print-architecture).deb
+sudo apt install ../rgbdns_0.6.5_$(dpkg --print-architecture).deb
 ```
 
 `packaging/build-deb.sh` calls `dpkg-buildpackage --build=binary --no-sign`.
@@ -132,6 +132,15 @@ replaces the live `data` and `data.cdb` only after compilation succeeds. It
 then restarts tinydns. A malformed, partial, or symlinked upload leaves the
 currently served database unchanged.
 
+On a DNSSEC primary the import validates the upload with the plain
+`tinydns-data` compiler, replaces only `data`, and leaves `data.cdb` to
+`rgbdns-dnssec-publish.service`, which signs, verifies and publishes it.
+
+A primary whose data is deployed into `/var/lib/rgbdns/tinydns` directly, for
+example by a CI workflow, can turn the import off with
+`--data-drop-import disabled`, or by adding `DATA_DROP_IMPORT=disabled` to
+`/etc/rgbdns/data-drop.env`. Uploads are then skipped, not failed.
+
 To validate before starting anything, add `--no-start`, then inspect:
 
 ```sh
@@ -258,16 +267,16 @@ sudo apt install -y build-essential cargo debhelper rustc git
 git clone https://github.com/querygraph/rgbdns.git
 cd rgbdns
 packaging/build-deb.sh
-dpkg-deb --info ../rgbdns_0.6.4_amd64.deb
+dpkg-deb --info ../rgbdns_0.6.5_amd64.deb
 ```
 
 Copy the package to the EC2 host, then install it there:
 
 ```sh
-scp ../rgbdns_0.6.4_amd64.deb admin@52.10.53.234:/tmp/
+scp ../rgbdns_0.6.5_amd64.deb admin@52.10.53.234:/tmp/
 ssh admin@52.10.53.234
 sudo apt update
-sudo apt install -y /tmp/rgbdns_0.6.4_amd64.deb
+sudo apt install -y /tmp/rgbdns_0.6.5_amd64.deb
 dpkg-query -W rgbdns
 ```
 

docs/DNSSEC-DESIGN.md

@@ -1,6 +1,6 @@
 # DNSSEC design: small tools and visible state
 
-Status: implementation contract for rgbdns 0.6.4.
+Status: implementation contract for rgbdns 0.6.5.
 
 rgbdns DNSSEC follows the tinydns posture: each program does one bounded job,
 configuration is one record per line, persistent state is an ordinary file, and
@@ -152,7 +152,7 @@ they do not resolve the target independently for a signed zone.
 
 Key creation, activation, parent DS publication, rollover, revocation, and
 retirement are distinct operator actions represented by files and policy
-lines. Version 0.6.4 delivers safe single-key operation and DS derivation. A
+lines. Version 0.6.5 delivers safe single-key operation and DS derivation. A
 later feature release will add a deliberately specified multi-key rollover
 state machine; operators must not simulate rollover by silently swapping a key
 file under an unchanged policy line.

docs/DNSSEC.md

@@ -1,6 +1,6 @@
 # Optional authoritative DNSSEC
 
-rgbdns 0.6.4 adds authoritative DNSSEC as an explicit offline publication
+rgbdns 0.6.5 adds authoritative DNSSEC as an explicit offline publication
 pipeline. It is disabled by default. If `/etc/rgbdns/dnssec.env` and the
 working-directory `dnssec` policy are absent, `tinydns-data`, `tinydns`, ACME,
 ANAME, setup, and secondary synchronization follow the existing
@@ -43,7 +43,7 @@ This permits a deliberate mixed signed/unsigned CDB without making omission
 mean “unsigned.”
 
 Keep a recoverable encrypted backup of the key. Key replacement is not an
-implicit file operation: version 0.6.4 deliberately supports one active
+implicit file operation: version 0.6.5 deliberately supports one active
 combined signing key per zone and does not claim an automated multi-key
 rollover state machine.
 

docs/OPENSUSE.md

@@ -55,8 +55,8 @@ sudo zypper --non-interactive install \
 git clone https://github.com/querygraph/rgbdns.git
 cd rgbdns
 packaging/build-rpm.sh
-rpm -qip dist/rpmbuild/RPMS/x86_64/rgbdns-0.6.4-1.x86_64.rpm
-rpm -qlp dist/rpmbuild/RPMS/x86_64/rgbdns-0.6.4-1.x86_64.rpm
+rpm -qip dist/rpmbuild/RPMS/x86_64/rgbdns-0.6.5-1.x86_64.rpm
+rpm -qlp dist/rpmbuild/RPMS/x86_64/rgbdns-0.6.5-1.x86_64.rpm
 ```
 
 `build-rpm.sh` creates a clean rpmbuild tree under `dist/rpmbuild`, archives
@@ -81,9 +81,9 @@ gh run download RUN_ID \
 Inspect an artifact before installation:
 
 ```sh
-rpm -K dist/cloud-rpm/rgbdns-0.6.4-1.x86_64.rpm
-rpm -qip dist/cloud-rpm/rgbdns-0.6.4-1.x86_64.rpm
-rpm -qlp dist/cloud-rpm/rgbdns-0.6.4-1.x86_64.rpm
+rpm -K dist/cloud-rpm/rgbdns-0.6.5-1.x86_64.rpm
+rpm -qip dist/cloud-rpm/rgbdns-0.6.5-1.x86_64.rpm
+rpm -qlp dist/cloud-rpm/rgbdns-0.6.5-1.x86_64.rpm
 ```
 
 The development RPM is not repository-signed. `rpm -K` still verifies the
@@ -96,11 +96,11 @@ Copy a locally built package to the EC2 instance:
 
 ```sh
 scp -i ~/.ssh/KEY.pem \
-  dist/rpmbuild/RPMS/x86_64/rgbdns-0.6.4-1.x86_64.rpm \
+  dist/rpmbuild/RPMS/x86_64/rgbdns-0.6.5-1.x86_64.rpm \
   ec2-user@PUBLIC_ADDRESS:/tmp/
 ssh -i ~/.ssh/KEY.pem ec2-user@PUBLIC_ADDRESS
 sudo zypper --non-interactive --no-gpg-checks install \
-  /tmp/rgbdns-0.6.4-1.x86_64.rpm
+  /tmp/rgbdns-0.6.5-1.x86_64.rpm
 rpm -q rgbdns
 rpm -V rgbdns
 ```

docs/RGBDNS_SETUP.md

@@ -1,6 +1,6 @@
 # End-to-end rgbdns setup: `fieldnotes.es`
 
-This walkthrough deploys rgbdns 0.6.4 on two AWS EC2 instances and retains
+This walkthrough deploys rgbdns 0.6.5 on two AWS EC2 instances and retains
 BuddyNS as an additional secondary network. It covers installation, initial
 role configuration, authoritative data, AXFR, atomic primary and secondary
 updates, verification, upgrades, and recovery.
@@ -118,27 +118,27 @@ gh run download "$RPM_RUN" \
   -D "$HOME/rgbdns-rpm"
 ```
 
-The 0.6.4 artifacts are:
+The 0.6.5 artifacts are:
 
 ```text
-rgbdns_0.6.4_amd64.deb
-RPMS/x86_64/rgbdns-0.6.4-1.x86_64.rpm
-SRPMS/rgbdns-0.6.4-1.src.rpm
+rgbdns_0.6.5_amd64.deb
+RPMS/x86_64/rgbdns-0.6.5-1.x86_64.rpm
+SRPMS/rgbdns-0.6.5-1.src.rpm
 ```
 
 ## 4. Install the Debian package on the primary
 
 Copy the package:
 
 ```sh
-scp "$HOME/rgbdns-deb/rgbdns_0.6.4_amd64.deb" \
+scp "$HOME/rgbdns-deb/rgbdns_0.6.5_amd64.deb" \
   bitnami@52.10.53.234:/tmp/
 ```
 
 On the primary:
 
 ```sh
-sudo apt install /tmp/rgbdns_0.6.4_amd64.deb
+sudo apt install /tmp/rgbdns_0.6.5_amd64.deb
 sudo systemctl daemon-reload
 dpkg-query -W -f='${Package} ${Version}\n' rgbdns
 getent passwd rgbdns
@@ -160,15 +160,15 @@ SUSE_USER=ec2-user
 Copy the package:
 
 ```sh
-scp "$HOME/rgbdns-rpm/RPMS/x86_64/rgbdns-0.6.4-1.x86_64.rpm" \
+scp "$HOME/rgbdns-rpm/RPMS/x86_64/rgbdns-0.6.5-1.x86_64.rpm" \
   "$SUSE_USER"@52.38.177.160:/tmp/
 ```
 
 On the secondary:
 
 ```sh
 sudo zypper --non-interactive --no-gpg-checks install \
-  /tmp/rgbdns-0.6.4-1.x86_64.rpm
+  /tmp/rgbdns-0.6.5-1.x86_64.rpm
 sudo systemctl daemon-reload
 rpm -q rgbdns
 sudo rpm -V rgbdns

docs/conformance.md

@@ -52,7 +52,7 @@ normative RFC that supplies each oracle.
 
 ## Deliberate scope boundaries
 
-The following are not claimed as implemented by rgbdns 0.6.4:
+The following are not claimed as implemented by rgbdns 0.6.5:
 
 - general-purpose dynamic UPDATE, NOTIFY, IXFR, DSO, DNS Cookies, or SIG(0);
 - TSIG algorithms other than the ACME update profile's HMAC-SHA256;

man/acme-materialize.1

@@ -1,4 +1,4 @@
-.TH ACME-MATERIALIZE 1 "2026-08-18" "rgbdns 0.6.4" "User Commands"
+.TH ACME-MATERIALIZE 1 "2026-08-18" "rgbdns 0.6.5" "User Commands"
 .SH NAME
 acme-materialize \- merge durable ACME DNS-01 state into tinydns source
 .SH SYNOPSIS

man/aname-materialize.1

@@ -1,4 +1,4 @@
-.TH ANAME-MATERIALIZE 1 "2026-08-18" "rgbdns 0.6.4" "User Commands"
+.TH ANAME-MATERIALIZE 1 "2026-08-18" "rgbdns 0.6.5" "User Commands"
 .SH NAME
 aname-materialize \- replace rgbdns ANAME directives with address records
 .SH SYNOPSIS

man/axfr-get.1

@@ -1,4 +1,4 @@
-.TH AXFR-GET 1 "2026-07-23" "rgbdns 0.6.4" "User Commands"
+.TH AXFR-GET 1 "2026-07-23" "rgbdns 0.6.5" "User Commands"
 .SH NAME
 axfr-get \- retrieve a DNS zone using AXFR
 .SH SYNOPSIS

man/axfrdns-conf.1

@@ -1,4 +1,4 @@
-.TH AXFRDNS-CONF 1 "2026-07-23" "rgbdns 0.6.4" "User Commands"
+.TH AXFRDNS-CONF 1 "2026-07-23" "rgbdns 0.6.5" "User Commands"
 .SH NAME
 axfrdns-conf \- create an axfrdns service directory
 .SH SYNOPSIS

man/axfrdns.1

@@ -1,4 +1,4 @@
-.TH AXFRDNS 1 "2026-07-23" "rgbdns 0.6.4" "User Commands"
+.TH AXFRDNS 1 "2026-07-23" "rgbdns 0.6.5" "User Commands"
 .SH NAME
 axfrdns \- serve DNS zone transfers
 .SH SYNOPSIS

man/compile-zone.8

@@ -1,4 +1,4 @@
-.TH COMPILE-ZONE 8 "2026-07-23" "rgbdns 0.6.4" "System Administration"
+.TH COMPILE-ZONE 8 "2026-07-23" "rgbdns 0.6.5" "System Administration"
 .SH NAME
 compile-zone \- compile the packaged authoritative zone
 .SH SYNOPSIS

man/dnscache-conf.1

@@ -1,4 +1,4 @@
-.TH DNSCACHE-CONF 1 "2026-07-23" "rgbdns 0.6.4" "User Commands"
+.TH DNSCACHE-CONF 1 "2026-07-23" "rgbdns 0.6.5" "User Commands"
 .SH NAME
 dnscache-conf \- create a dnscache service directory
 .SH SYNOPSIS

man/dnscache.1

@@ -1,4 +1,4 @@
-.TH DNSCACHE 1 "2026-07-23" "rgbdns 0.6.4" "User Commands"
+.TH DNSCACHE 1 "2026-07-23" "rgbdns 0.6.5" "User Commands"
 .SH NAME
 dnscache \- caching recursive DNS resolver
 .SH SYNOPSIS

man/dnsfilter.1

@@ -1,4 +1,4 @@
-.TH DNSFILTER 1 "2026-07-23" "rgbdns 0.6.4" "User Commands"
+.TH DNSFILTER 1 "2026-07-23" "rgbdns 0.6.5" "User Commands"
 .SH NAME
 dnsfilter \- add reverse DNS names to input lines
 .SH SYNOPSIS

man/dnsip.1

@@ -1,4 +1,4 @@
-.TH DNSIP 1 "2026-07-23" "rgbdns 0.6.4" "User Commands"
+.TH DNSIP 1 "2026-07-23" "rgbdns 0.6.5" "User Commands"
 .SH NAME
 dnsip \- look up IPv4 addresses
 .SH SYNOPSIS

man/dnsip6.1

@@ -1,4 +1,4 @@
-.TH DNSIP6 1 "2026-07-23" "rgbdns 0.6.4" "User Commands"
+.TH DNSIP6 1 "2026-07-23" "rgbdns 0.6.5" "User Commands"
 .SH NAME
 dnsip6 \- look up IPv6 addresses
 .SH SYNOPSIS

man/dnsip6q.1

@@ -1,4 +1,4 @@
-.TH DNSIP6Q 1 "2026-07-23" "rgbdns 0.6.4" "User Commands"
+.TH DNSIP6Q 1 "2026-07-23" "rgbdns 0.6.5" "User Commands"
 .SH NAME
 dnsip6q \- look up and label IPv6 addresses
 .SH SYNOPSIS

man/dnsipq.1

@@ -1,4 +1,4 @@
-.TH DNSIPQ 1 "2026-07-23" "rgbdns 0.6.4" "User Commands"
+.TH DNSIPQ 1 "2026-07-23" "rgbdns 0.6.5" "User Commands"
 .SH NAME
 dnsipq \- look up and label IPv4 addresses
 .SH SYNOPSIS

man/dnsmx.1

@@ -1,4 +1,4 @@
-.TH DNSMX 1 "2026-07-23" "rgbdns 0.6.4" "User Commands"
+.TH DNSMX 1 "2026-07-23" "rgbdns 0.6.5" "User Commands"
 .SH NAME
 dnsmx \- look up mail exchangers
 .SH SYNOPSIS

man/dnsname.1

@@ -1,4 +1,4 @@
-.TH DNSNAME 1 "2026-07-23" "rgbdns 0.6.4" "User Commands"
+.TH DNSNAME 1 "2026-07-23" "rgbdns 0.6.5" "User Commands"
 .SH NAME
 dnsname \- look up names for IPv4 addresses
 .SH SYNOPSIS

man/dnsq.1

@@ -1,4 +1,4 @@
-.TH DNSQ 1 "2026-07-23" "rgbdns 0.6.4" "User Commands"
+.TH DNSQ 1 "2026-07-23" "rgbdns 0.6.5" "User Commands"
 .SH NAME
 dnsq \- send a non-recursive DNS query
 .SH SYNOPSIS

man/dnsqr.1

@@ -1,4 +1,4 @@
-.TH DNSQR 1 "2026-07-23" "rgbdns 0.6.4" "User Commands"
+.TH DNSQR 1 "2026-07-23" "rgbdns 0.6.5" "User Commands"
 .SH NAME
 dnsqr \- perform a recursive DNS query
 .SH SYNOPSIS

man/dnstrace.1

@@ -1,4 +1,4 @@
-.TH DNSTRACE 1 "2026-07-23" "rgbdns 0.6.4" "User Commands"
+.TH DNSTRACE 1 "2026-07-23" "rgbdns 0.6.5" "User Commands"
 .SH NAME
 dnstrace \- trace DNS delegation
 .SH SYNOPSIS

man/dnstxt.1

@@ -1,4 +1,4 @@
-.TH DNSTXT 1 "2026-07-23" "rgbdns 0.6.4" "User Commands"
+.TH DNSTXT 1 "2026-07-23" "rgbdns 0.6.5" "User Commands"
 .SH NAME
 dnstxt \- look up DNS text records
 .SH SYNOPSIS

man/multilog.1

@@ -1,4 +1,4 @@
-.TH MULTILOG 1 "2026-07-23" "rgbdns 0.6.4" "User Commands"
+.TH MULTILOG 1 "2026-07-23" "rgbdns 0.6.5" "User Commands"
 .SH NAME
 multilog \- collect and rotate service logs
 .SH SYNOPSIS