avoid secure.nic.cz URLs

They've been HTTP 301 for quite a long time now.
These legacy aliases still work, but let's not rely on that anymore.

(cherry picked from commit 8391c3961b2d6fe5e4cb7ad50324dc2355a2f490)

diff --git a/distro/config/apkg.toml b/distro/config/apkg.toml
index 19d4d8bead2a232912e9c94429ed4980d71e6537..fb34b5c9fb6d76eca8f0525e9f7efc2cdcc67a0a 100644 (file)
--- a/distro/config/apkg.toml
+++ b/distro/config/apkg.toml
@@ -5,8 +5,8 @@ make_archive_script = "scripts/make-archive.sh"
 
 [upstream]
 # needed for get-archive
-archive_url = "https://secure.nic.cz/files/knot-resolver/knot-resolver-{{ version }}.tar.xz"
-signature_url = "https://secure.nic.cz/files/knot-resolver/knot-resolver-{{ version }}.tar.xz.asc"
+archive_url = "https://knot-resolver.nic.cz/release/knot-resolver-{{ version }}.tar.xz"
+signature_url = "https://knot-resolver.nic.cz/release/knot-resolver-{{ version }}.tar.xz.asc"
 version_script = "scripts/upstream-version.sh"
 
 [apkg]

diff --git a/distro/pkg/nix/default.nix b/distro/pkg/nix/default.nix
index 16c66d0546397b11536d5f9d3ddce2a589ae1842..3e7593854533fe9728ad61120ccd0c05b957f32c 100644 (file)
--- a/distro/pkg/nix/default.nix
+++ b/distro/pkg/nix/default.nix
@@ -20,7 +20,7 @@ unwrapped = stdenv.mkDerivation rec {
   version = "{{ version }}";
 
   src = fetchurl {
-    url = "https://secure.nic.cz/files/knot-resolver/${pname}-${version}.tar.xz";
+    url = "https://knot-resolver.nic.cz/release/${pname}-${version}.tar.xz";
     sha256 = "{{ src_hash }}";
   };
 

diff --git a/distro/pkg/rpm/knot-resolver.spec b/distro/pkg/rpm/knot-resolver.spec
index a5e869519c5ad477c4fa11420f18eef1d8d5c0d8..4c2d9006feeea1c5392c8a8cdb343ca52ca83d61 100644 (file)
--- a/distro/pkg/rpm/knot-resolver.spec
+++ b/distro/pkg/rpm/knot-resolver.spec
@@ -31,7 +31,7 @@ Source1:        knot-resolver-%{version}.tar.xz.asc
 # PGP keys used to sign upstream releases
 # Export with --armor using command from https://fedoraproject.org/wiki/PackagingDrafts:GPGSignatures
 # Don't forget to update %%prep section when adding/removing keys
-# This key is from: https://secure.nic.cz/files/knot-resolver/kresd-keyblock.asc
+# This key is from: https://knot-resolver.nic.cz/release/kresd-keyblock.asc
 Source100:      kresd-keyblock.asc
 BuildRequires:  gnupg2
 %endif

diff --git a/scripts/gen-pgp-keyblock.sh b/scripts/gen-pgp-keyblock.sh
index 29855312420c3b010b0821b06258e3e3d81b2584..3727b74c48d89919fccb7dbf22d18f5f363ad380 100755 (executable)
--- a/scripts/gen-pgp-keyblock.sh
+++ b/scripts/gen-pgp-keyblock.sh
@@ -8,7 +8,7 @@ keys=(
     # '4A8BA48C2AED933BD495C509A1FBA5F7EF8C4869'  # tomas.krizek@nic.cz  expired 2022-03-31
 )
 outfile="kresd-keyblock.asc"
-url="https://secure.nic.cz/files/knot-resolver/kresd-keyblock.asc"
+url="https://knot-resolver.nic.cz/release/kresd-keyblock.asc"
 
 keyring="$(mktemp -d)"
 keyring_import="$(mktemp -d)"
@@ -33,6 +33,6 @@ gpg --homedir "${keyring_import}" -q --import "${outfile}"
 gpg --homedir "${keyring_import}" -k
 echo "Created: ${outfile}"
 
-# check if update of secure.nic.cz keyblock might be needed
+# check if update of kresd-keyblock.asc might be needed
 curl -sfo "${published}" "${url}"
 diff -q "${outfile}" "${published}" &>/dev/null || echo "Generated keyblock differs from ${url}"

diff --git a/security.txt b/security.txt
index 085bbfd0b9d95a504cb362ab749e684da3d79ce9..8229e7acec9ab780a87a388dc10985ee22cb8dd4 100644 (file)
--- a/security.txt
+++ b/security.txt
@@ -4,6 +4,6 @@ address.
 vladimir.cunat@nic.cz
 
 You can obtain our PGP keys from:
-https://secure.nic.cz/files/knot-resolver/kresd-keyblock.asc
+https://knot-resolver.nic.cz/release/kresd-keyblock.asc
 
 More info: https://www.knot-resolver.cz/contact