2.1 KiB
hickory-dns, vendored
hickory-proto, hickory-net and hickory-resolver 0.26.3 as upstream
builds them since v0.16.26: from its patched branch of
hickory-dns, stalwart/0.26
at commit f8b92b17fa6c7d09a6959672592106ca1410937b (2026-10-11), under
MIT OR Apache-2.0. INBUXA takes them under MIT. The root Cargo.toml
patches them in with [patch.crates-io], so builds never fetch from
upstream's repositories.
That branch is hickory's own release/0.26 (unreleased work after 0.26.3,
including DS lookups that check the parent zone when an answer carries no
insecure proof) plus nine DNSSEC commits: finding the zone cut with DS
queries, accepting opt-out DS proofs for the next closer name, setting the
CD bit while validating, searching ancestors when a DS lookup fails,
wildcard validation for all RRsets, and a TCP retry for a late truncated
UDP answer.
Changes
None. Each directory is cargo package --no-verify of that commit (the
manifest normalized, so it builds outside hickory's workspace), without
Cargo.lock, Cargo.toml.orig and .cargo_vcs_info.json (the
repository ignores dotfiles; the commit is recorded above).
Both answers hickory 0.26.3 called bogus in production (an insecure
delegation below an unsigned zone, and a signed CNAME to a name without the
type asked for) validate with this copy: the --ignored tests at the end of
crates/smtp/src/outbound/dane/dnssec.rs show it, the TLSA one through
Hetzner's resolver (2026-10-12). validated_lookup there still rechecks
answers hickory calls bogus, as a fallback.
Updating
When upstream moves its hickory pin, or hickory publishes a release that
carries these fixes, re-vendor: clone the branch at the new commit, run
cargo package --no-verify -p hickory-proto -p hickory-net -p hickory-resolver, unpack each .crate here, and drop Cargo.lock and
Cargo.toml.orig. If the version changes, Cargo stops using these copies
and only warns that the patch went unused, so check Cargo.lock has no
hickory-* entry with a source line. Update the commit above.