Yu Watanabe
c8e5be587d
With DNSSEC on, resolved can't validate anything until the clock is correct, and without an RTC the only thing that fixes the clock is talking to the NTP servers we're trying to resolve. On glibc the timesyncd unit sets SYSTEMD_NSS_RESOLVE_VALIDATE=0 and nss-resolve turns that into a per-query flag, which breaks the chicken/egg. musl and systems not using nss-resolve have no NSS, so nothing reads it there and we're stuck. So talk to resolved directly when it's there, and pass SD_RESOLVED_NO_VALIDATE until we've synced the clock ourselves. Lookups after that are validated normally, which is better than what we get from nss. If resolved isn't around we keep using getaddrinfo(). Tested on musl in qemu with the RTC set to 2020 and DNSSEC=yes. timesyncd syncs when it couldn't before, while `resolvectl query` still fails with signature-expired, so the "relaxation" is scoped to only timesyncd. Once the clock is synced subsequent timesyncd resolver queries no longer include the flag to disable validation. fixes #20235
System and Service Manager
Details
Most documentation is available on systemd's website.
Assorted, older, general information about systemd can be found in the systemd Wiki.
Information about build requirements is provided in the README file.
Consult our NEWS file for information about what's new in the most recent systemd versions.
Please see the Code Map for information about this repository's layout and content.
Please see the Hacking guide for information on how to hack on systemd and test your modifications.
Please see our Contribution Guidelines for more information about filing GitHub Issues and posting GitHub Pull Requests.
When preparing patches for systemd, please follow our Coding Style Guidelines.
If you are looking for support, please contact our mailing list, join our IRC channel #systemd on libera.chat or Matrix channel
Stable branches with backported patches are available in the stable repo.
We have a security bug bounty program sponsored by the Sovereign Tech Fund hosted on YesWeHack
Repositories with distribution packages built from git main are available on OBS, and also repositories with packages built from the latest stable release