From: Vladimír Čunát <vladimir.cunat@nic.cz>
Date: Wed, 29 Jul 2026 10:41:06 +0000 (+0200)
Subject: avoid secure.nic.cz URLs
X-Git-Tag: v5.7.8~3^2
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=e4be43d0f184ea023f112c484a300caacc69981d;p=thirdparty%2Fknot-resolver.git

avoid secure.nic.cz URLs

They've been HTTP 301 for quite a long time now.
These legacy aliases still work, but let's not rely on that anymore.

(cherry picked from commit 8391c3961b2d6fe5e4cb7ad50324dc2355a2f490)
---

diff --git a/distro/config/apkg.toml b/distro/config/apkg.toml
index 19d4d8bea..fb34b5c9f 100644
--- a/distro/config/apkg.toml
+++ b/distro/config/apkg.toml
@@ -5,8 +5,8 @@ make_archive_script = "scripts/make-archive.sh"
 
 [upstream]
 # needed for get-archive
-archive_url = "https://secure.nic.cz/files/knot-resolver/knot-resolver-{{ version }}.tar.xz"
-signature_url = "https://secure.nic.cz/files/knot-resolver/knot-resolver-{{ version }}.tar.xz.asc"
+archive_url = "https://knot-resolver.nic.cz/release/knot-resolver-{{ version }}.tar.xz"
+signature_url = "https://knot-resolver.nic.cz/release/knot-resolver-{{ version }}.tar.xz.asc"
 version_script = "scripts/upstream-version.sh"
 
 [apkg]
diff --git a/distro/pkg/nix/default.nix b/distro/pkg/nix/default.nix
index 16c66d054..3e7593854 100644
--- a/distro/pkg/nix/default.nix
+++ b/distro/pkg/nix/default.nix
@@ -20,7 +20,7 @@ unwrapped = stdenv.mkDerivation rec {
   version = "{{ version }}";
 
   src = fetchurl {
-    url = "https://secure.nic.cz/files/knot-resolver/${pname}-${version}.tar.xz";
+    url = "https://knot-resolver.nic.cz/release/${pname}-${version}.tar.xz";
     sha256 = "{{ src_hash }}";
   };
 
diff --git a/distro/pkg/rpm/knot-resolver.spec b/distro/pkg/rpm/knot-resolver.spec
index a5e869519..4c2d9006f 100644
--- a/distro/pkg/rpm/knot-resolver.spec
+++ b/distro/pkg/rpm/knot-resolver.spec
@@ -31,7 +31,7 @@ Source1:        knot-resolver-%{version}.tar.xz.asc
 # PGP keys used to sign upstream releases
 # Export with --armor using command from https://fedoraproject.org/wiki/PackagingDrafts:GPGSignatures
 # Don't forget to update %%prep section when adding/removing keys
-# This key is from: https://secure.nic.cz/files/knot-resolver/kresd-keyblock.asc
+# This key is from: https://knot-resolver.nic.cz/release/kresd-keyblock.asc
 Source100:      kresd-keyblock.asc
 BuildRequires:  gnupg2
 %endif
diff --git a/scripts/gen-pgp-keyblock.sh b/scripts/gen-pgp-keyblock.sh
index 298553124..3727b74c4 100755
--- a/scripts/gen-pgp-keyblock.sh
+++ b/scripts/gen-pgp-keyblock.sh
@@ -8,7 +8,7 @@ keys=(
     # '4A8BA48C2AED933BD495C509A1FBA5F7EF8C4869'  # tomas.krizek@nic.cz  expired 2022-03-31
 )
 outfile="kresd-keyblock.asc"
-url="https://secure.nic.cz/files/knot-resolver/kresd-keyblock.asc"
+url="https://knot-resolver.nic.cz/release/kresd-keyblock.asc"
 
 keyring="$(mktemp -d)"
 keyring_import="$(mktemp -d)"
@@ -33,6 +33,6 @@ gpg --homedir "${keyring_import}" -q --import "${outfile}"
 gpg --homedir "${keyring_import}" -k
 echo "Created: ${outfile}"
 
-# check if update of secure.nic.cz keyblock might be needed
+# check if update of kresd-keyblock.asc might be needed
 curl -sfo "${published}" "${url}"
 diff -q "${outfile}" "${published}" &>/dev/null || echo "Generated keyblock differs from ${url}"
diff --git a/security.txt b/security.txt
index 085bbfd0b..8229e7ace 100644
--- a/security.txt
+++ b/security.txt
@@ -4,6 +4,6 @@ address.
 vladimir.cunat@nic.cz
 
 You can obtain our PGP keys from:
-https://secure.nic.cz/files/knot-resolver/kresd-keyblock.asc
+https://knot-resolver.nic.cz/release/kresd-keyblock.asc
 
 More info: https://www.knot-resolver.cz/contact