main/dnssec-root: upgrade to 20190225 and make reproducible

we store the key in our git repo so we are sure we get exactly same
build from same git checkout.

fixes #9552

(cherry picked from commit f897f1ae96d9a1a398443338afb504d24e8106e3)

2 files changed, 14 insertions, 8 deletions

diff --git a/main/dnssec-root/APKBUILD b/main/dnssec-root/APKBUILD
index 890d8f9330..f6bd8293c3 100644
--- a/main/dnssec-root/APKBUILD
+++ b/main/dnssec-root/APKBUILD
@@ -2,8 +2,8 @@
 # Contributor: Natanael Copa <ncopa@alpinelinux.org>
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=dnssec-root
-pkgver=20170203
-pkgrel=1
+pkgver=20190225
+pkgrel=0
 _commit=67c11662510f5e2db6e6517228e80b794950c43f
 pkgdesc="The DNSSEC root key(s)"
 url="https://www.iana.org/dnssec/"
@@ -14,19 +14,24 @@ makedepends="python3 openssl"
 install=""
 subpackages=""
 options="net"
-source="$pkgname-$pkgver.tar.gz::https://github.com/iana-org/get-trust-anchor/archive/$_commit.tar.gz"
+source="$pkgname-$pkgver.tar.gz::https://github.com/iana-org/get-trust-anchor/archive/$_commit.tar.gz
+        trusted-key.key
+        "
 builddir="$srcdir"/get-trust-anchor-$_commit
 
-build() {
+snapshot() {
+        unpack
         cd "$builddir"
-        python3 get_trust_anchor.py
+        python3 "$builddir"/get_trust_anchor.py
+        sort -k 6 ksk-as-dnskey.txt* > "$startdir"/trusted-key.key
+        abump $pkgname-$(date "+%Y%m%d")
 }
 
 package() {
         cd "$builddir"
-        sort -k 6 ksk-as-dnskey.txt* > trusted-key.key
-        install -Dm644 trusted-key.key \
+        install -Dm644 "$srcdir"/trusted-key.key \
                 "$pkgdir"/usr/share/$pkgname/trusted-key.key
 }
 
-sha512sums="91b8fbecf10ae4d599a93bb69e342942a0f8dc3678c3ec8151dcdaa650eefdc4168eb5e272a4e4182daa180c3f5ff33217a825e2e8f19d489b6dc6171b0b5b56  dnssec-root-20170203.tar.gz"
+sha512sums="91b8fbecf10ae4d599a93bb69e342942a0f8dc3678c3ec8151dcdaa650eefdc4168eb5e272a4e4182daa180c3f5ff33217a825e2e8f19d489b6dc6171b0b5b56  dnssec-root-20190225.tar.gz
+19d43a669c1c4df9d0d72717f35e332d688ebb9f9e6be5adcb00db7388072ea79e71b38d4fb1059ebda255726dcfd6672ff1feb59b856876a476736d8e548d50  trusted-key.key"
diff --git a/main/dnssec-root/trusted-key.key b/main/dnssec-root/trusted-key.key
new file mode 100644
index 0000000000..fa8bde3cfe
--- /dev/null
+++ b/main/dnssec-root/trusted-key.key
@@ -0,0 +1 @@
+. IN DNSKEY 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU=