From ffa4b6c6e941acac3bac80f975a5e53f7282ce93 Mon Sep 17 00:00:00 2001
From: "Benjamin W. Broersma" <bw@broersma.com>
Date: Wed, 29 Jul 2026 23:44:33 +0200
Subject: [PATCH 1/2] Fix #2134 - Wrap unbound-anchor in script to remove
 metadata

---
 Makefile                      |  2 +-
 bin/update_dnssec_root_key.sh | 16 ++++++++++++++++
 remote_data/dns/root.key      | 11 ++---------
 3 files changed, 19 insertions(+), 10 deletions(-)
 create mode 100755 bin/update_dnssec_root_key.sh

diff --git a/Makefile b/Makefile
index 2d4125dde..039b41e0a 100644
--- a/Makefile
+++ b/Makefile
@@ -62,7 +62,7 @@ update_padded_macs: ## update padded MAC information
 	cd $(MACSDIR); ./update-macs.sh
 
 update_root_key_file: ## update root key file
-	${DOCKER_COMPOSE_TOOLS_CMD} run --rm tools /opt/unbound/sbin/unbound-anchor -a $(DNSDIR)/root.key
+	${DOCKER_COMPOSE_TOOLS_CMD} run --rm tools bin/update_dnssec_root_key.sh $(DNSDIR)/root.key
 
 # create some shorthands
 env ?=
diff --git a/bin/update_dnssec_root_key.sh b/bin/update_dnssec_root_key.sh
new file mode 100755
index 000000000..68ecd23d7
--- /dev/null
+++ b/bin/update_dnssec_root_key.sh
@@ -0,0 +1,16 @@
+#!/usr/bin/env sh
+set -u
+
+if [ $# -eq 0 ]; then
+  >&2 echo "Please provide an argument: The root anchor key file, that is read in and written out."
+  exit 1
+fi
+
+/opt/unbound/sbin/unbound-anchor -a "$1"
+# The following sed rules do:
+# s/ *;;.*//g				remove all metadata comments
+# s/^(.\t)[0-9]+\t/\1/g		remove all TTLs
+# /^$/d						delete empty lines
+sed -ri 's/ *;;.*//g;s/^(.\t)[0-9]+\t/\1/g;/^$/d' "$1"
+# use C to have binary order and reverse to put ; above .
+LC_ALL=C sort -ro "$1" "$1"
diff --git a/remote_data/dns/root.key b/remote_data/dns/root.key
index e304ef39c..e951ec70d 100644
--- a/remote_data/dns/root.key
+++ b/remote_data/dns/root.key
@@ -1,10 +1,3 @@
 ; autotrust trust anchor file
-;;id: . 1
-;;last_queried: 1784020545 ;;Tue Jul 14 09:15:45 2026
-;;last_success: 1784020545 ;;Tue Jul 14 09:15:45 2026
-;;next_probe_time: 1784059916 ;;Tue Jul 14 20:11:56 2026
-;;query_failed: 0
-;;query_interval: 43200
-;;retry_time: 8640
-.	86400	IN	DNSKEY	257 3 8 AwEAAa96jeuknZlaeSrvyAJj6ZHv28hhOKkx3rLGXVaC6rXTsDc449/cidltpkyGwCJNnOAlFNKF2jBosZBU5eeHspaQWOmOElZsjICMQMC3aeHbGiShvZsx4wMYSjH8e7Vrhbu6irwCzVBApESjbUdpWWmEnhathWu1jo+siFUiRAAxm9qyJNg/wOZqqzL/dL/q8PkcRU5oUKEpUge71M3ej2/7CPqpdVwuMoTvoB+ZOT4YeGyxMvHmbrxlFzGOHOijtzN+u1TQNatX2XBuzZNQ1K+s2CXkPIZo7s6JgZyvaBevYtxPvYLw4z9mR7K2vaF18UYH9Z9GNUUeayffKC73PYc= ;{id = 38696 (ksk), size = 2048b} ;;state=2 [  VALID  ] ;;count=0 ;;lastchange=1776426131 ;;Fri Apr 17 11:42:11 2026
-.	172800	IN	DNSKEY	257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ;{id = 20326 (ksk), size = 2048b} ;;state=2 [  VALID  ] ;;count=0 ;;lastchange=1519657238 ;;Mon Feb 26 15:00:38 2018
+.	IN	DNSKEY	257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ;{id = 20326 (ksk), size = 2048b}
+.	IN	DNSKEY	257 3 8 AwEAAa96jeuknZlaeSrvyAJj6ZHv28hhOKkx3rLGXVaC6rXTsDc449/cidltpkyGwCJNnOAlFNKF2jBosZBU5eeHspaQWOmOElZsjICMQMC3aeHbGiShvZsx4wMYSjH8e7Vrhbu6irwCzVBApESjbUdpWWmEnhathWu1jo+siFUiRAAxm9qyJNg/wOZqqzL/dL/q8PkcRU5oUKEpUge71M3ej2/7CPqpdVwuMoTvoB+ZOT4YeGyxMvHmbrxlFzGOHOijtzN+u1TQNatX2XBuzZNQ1K+s2CXkPIZo7s6JgZyvaBevYtxPvYLw4z9mR7K2vaF18UYH9Z9GNUUeayffKC73PYc= ;{id = 38696 (ksk), size = 2048b}

From cb7811f605a70641e89a5adbe36dc5594ff45315 Mon Sep 17 00:00:00 2001
From: "Benjamin W. Broersma" <bw@broersma.com>
Date: Wed, 22 Jul 2026 13:34:56 +0200
Subject: [PATCH 2/2] Fix worker-scheduler not starting with integration-test
 target

Signed-off-by: Johan Bloemberg <git@ijohan.nl>
---
 docker/compose.build.yaml | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/docker/compose.build.yaml b/docker/compose.build.yaml
index 088e8834e..0f99659ca 100644
--- a/docker/compose.build.yaml
+++ b/docker/compose.build.yaml
@@ -40,6 +40,15 @@ services:
         # required because current version of nassl cannot be compile for ARM (eg: Apple Silicon)
         - "linux/amd64"
 
+  worker-scheduler:
+    build:
+      context: ..
+      dockerfile: docker/Dockerfile
+      target: app
+      platforms:
+        # required because current version of nassl cannot be compile for ARM (eg: Apple Silicon)
+        - "linux/amd64"
+
   worker-slow:
     build:
       context: ..