[rpms/unbound] rawhide: Update to 1.26.0 (rhbz#2510931)

[rpms/unbound] rawhide: Update to 1.26.0 (rhbz#2510931)

[Fedor Vorobev]

A new commit has been pushed.

Repo   : rpms/unbound
Branch : rawhide
Commit : de1d09b74b8baa4f871078e4ba01d37b4ddebceb
Author : Fedor Vorobev <fvorobev@redhat.com>
Date   : 2026-08-07T11:34:48+02:00
Stats  : +227/-102 in 5 file(s)
URL    : https://src.fedoraproject.org/rpms/unbound/c/de1d09b74b8baa4f871078e4ba01d37b4ddebceb?branch=rawhide

Log:
Update to 1.26.0 (rhbz#2510931)

---
diff --git a/0001-Fix-build-failure-with-openssl4.0.patch b/0001-Fix-build-failure-with-openssl4.0.patch
deleted file mode 100644
index f5b25d7..0000000
--- a/0001-Fix-build-failure-with-openssl4.0.patch
+++ /dev/null
@@ -1,97 +0,0 @@
-From 556eae69c0678f5f0a1faac2d937830461844496 Mon Sep 17 00:00:00 2001
-From: Petr Mensik <pemensik@redhat.com>
-Date: Wed, 15 Apr 2026 17:14:25 +0200
-Subject: [PATCH] Fix build failure with openssl4.0
-
-ASN1_BIT_STRING members are no longer available. Use provided function
-for it.
----
- config.h.in               |  3 +++
- configure                 |  6 ++++++
- configure.ac              |  2 +-
- smallapp/unbound-anchor.c | 10 +++++++++-
- 4 files changed, 19 insertions(+), 2 deletions(-)
-
-diff --git a/config.h.in b/config.h.in
-index 7354859..fe2ca9a 100644
---- a/config.h.in
-+++ b/config.h.in
-@@ -852,6 +852,9 @@
- /* Define to 1 if you have the <ws2tcpip.h> header file. */
- #undef HAVE_WS2TCPIP_H
- 
-+/* Define to 1 if you have the 'X509_get_extended_key_usage' function. */
-+#undef HAVE_X509_GET_EXTENDED_KEY_USAGE
-+
- /* Define to 1 if you have the `X509_VERIFY_PARAM_set1_host' function. */
- #undef HAVE_X509_VERIFY_PARAM_SET1_HOST
- 
-diff --git a/configure b/configure
-index 0642c41..ec7c78a 100755
---- a/configure
-+++ b/configure
-@@ -21087,6 +21087,12 @@ if test "x$ac_cv_func_SSL_get0_peername" = xyes
- then :
-   printf "%s\n" "#define HAVE_SSL_GET0_PEERNAME 1" >>confdefs.h
- 
-+fi
-+ac_fn_c_check_func "$LINENO" "X509_get_extended_key_usage" "ac_cv_func_X509_get_extended_key_usage"
-+if test "x$ac_cv_func_X509_get_extended_key_usage" = xyes
-+then :
-+  printf "%s\n" "#define HAVE_X509_GET_EXTENDED_KEY_USAGE 1" >>confdefs.h
-+
- fi
- ac_fn_c_check_func "$LINENO" "X509_VERIFY_PARAM_set1_host" "ac_cv_func_X509_VERIFY_PARAM_set1_host"
- if test "x$ac_cv_func_X509_VERIFY_PARAM_set1_host" = xyes
-diff --git a/configure.ac b/configure.ac
-index ce1ca64..3e3abc9 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -1083,7 +1083,7 @@ AC_CHECK_FUNCS([OPENSSL_config EVP_sha1 EVP_sha256 EVP_sha512 FIPS_mode EVP_defa
- # these check_funcs need -lssl
- BAKLIBS="$LIBS"
- LIBS="-lssl $LIBS"
--AC_CHECK_FUNCS([OPENSSL_init_ssl SSL_CTX_set_security_level SSL_set1_host SSL_get0_peername X509_VERIFY_PARAM_set1_host SSL_CTX_set_ciphersuites SSL_CTX_set_tlsext_ticket_key_evp_cb SSL_CTX_set_alpn_select_cb SSL_get0_alpn_selected SSL_CTX_set_alpn_protos SSL_get1_peer_certificate])
-+AC_CHECK_FUNCS([OPENSSL_init_ssl SSL_CTX_set_security_level SSL_set1_host SSL_get0_peername X509_get_extended_key_usage X509_VERIFY_PARAM_set1_host SSL_CTX_set_ciphersuites SSL_CTX_set_tlsext_ticket_key_evp_cb SSL_CTX_set_alpn_select_cb SSL_get0_alpn_selected SSL_CTX_set_alpn_protos SSL_get1_peer_certificate])
- LIBS="$BAKLIBS"
- 
- AC_CHECK_DECLS([SSL_COMP_get_compression_methods,sk_SSL_COMP_pop_free,SSL_CTX_set_ecdh_auto,SSL_CTX_set_tmp_ecdh], [], [], [
-diff --git a/smallapp/unbound-anchor.c b/smallapp/unbound-anchor.c
-index fac8676..bb74e01 100644
---- a/smallapp/unbound-anchor.c
-+++ b/smallapp/unbound-anchor.c
-@@ -1674,6 +1674,11 @@ static unsigned long
- get_usage_of_ex(X509* cert)
- {
- 	unsigned long val = 0;
-+#ifdef HAVE_X509_GET_EXTENDED_KEY_USAGE
-+	val = X509_get_extended_key_usage(cert);
-+	if (val == UINT32_MAX)
-+		return 0;
-+#else
- 	ASN1_BIT_STRING* s;
- 	if((s=X509_get_ext_d2i(cert, NID_key_usage, NULL, NULL))) {
- 		if(s->length > 0) {
-@@ -1683,6 +1688,7 @@ get_usage_of_ex(X509* cert)
- 		}
- 		ASN1_BIT_STRING_free(s);
- 	}
-+#endif
- 	return val;
- }
- 
-@@ -1718,8 +1724,10 @@ get_valid_signers(PKCS7* p7, const char* p7signer)
- 			printf("signer %d: Subject: %s\n", i,
- 				nmline?nmline:"no subject");
- 			if(verb >= 3 && X509_NAME_get_text_by_NID(nm,
--				NID_commonName, buf, (int)sizeof(buf)))
-+				NID_commonName, buf, (int)sizeof(buf))) {
-+				
- 				printf("commonName: %s\n", buf);
-+			}
- 			if(verb >= 3 && X509_NAME_get_text_by_NID(nm,
- 				NID_pkcs9_emailAddress, buf, (int)sizeof(buf)))
- 				printf("emailAddress: %s\n", buf);
--- 
-2.54.0
-

diff --git a/sources b/sources
index 0a16ad8..e8b51b4 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (unbound-1.25.2.tar.gz) = f442105849db8d6f7bfb2d8130cd6772e3850ca36c9275fda99c659d0851f7ae3aee0c927bad756bdf5fbe83379e8a058f00fd5c50eedfe5fbe73b4d3ae0e222
-SHA512 (unbound-1.25.2.tar.gz.asc) = 4878caf1df8b41693cd32a61e7ead1b7fd26a866e5075085a55e5095ff6ed7eb5b63447f91ba814d4535c212cb13ede0651a3529f42a185535b28013c57df1ea
+SHA512 (unbound-1.26.0.tar.gz) = d061a4fd89b83e9e2c122b4479547f86548856710c801df01ce0aff8f0b4df9a61760cb7418b8ba7c79d504e6af49d7affc480f0730890bc818709007a931efd
+SHA512 (unbound-1.26.0.tar.gz.asc) = 9df080db5b74faeed42b8d03ca420aa9c276677f77472b0c02408fe2ca8c09e83667f11ff3349d379c1710aebadd0ff5d684cb993b855511031eade41bd0cb28

diff --git a/unbound-1.26.0-disabled-ipsecmod-fix.patch b/unbound-1.26.0-disabled-ipsecmod-fix.patch
new file mode 100644
index 0000000..ad79047
--- /dev/null
+++ b/unbound-1.26.0-disabled-ipsecmod-fix.patch
@@ -0,0 +1,48 @@
+From f63771f3afe8a5d1f9bbb89030937e9393366dea Mon Sep 17 00:00:00 2001
+From: "W.C.A. Wijngaards" <wouter@nlnetlabs.nl>
+Date: Thu, 6 Aug 2026 09:46:18 +0200
+Subject: [PATCH] - Fix #1487: regression in 1.26.0, ipsecmod is now always
+ partly enabled.
+
+---
+ ipsecmod/ipsecmod.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/ipsecmod/ipsecmod.c b/ipsecmod/ipsecmod.c
+index d1c0d44..71b42f1 100644
+--- a/ipsecmod/ipsecmod.c
++++ b/ipsecmod/ipsecmod.c
+@@ -59,6 +59,11 @@
+ static int
+ ipsecmod_apply_cfg(struct ipsecmod_env* ipsecmod_env, struct config_file* cfg)
+ {
++	if(cfg->ipsecmod_whitelist &&
++		!ipsecmod_whitelist_apply_cfg(ipsecmod_env, cfg))
++		return 0;
++	if(!cfg->ipsecmod_enabled)
++		return 1;
+ 	if(!cfg->ipsecmod_hook || (cfg->ipsecmod_hook && !cfg->ipsecmod_hook[0])) {
+ 		log_err("ipsecmod: missing ipsecmod-hook.");
+ 		return 0;
+@@ -68,9 +73,6 @@ ipsecmod_apply_cfg(struct ipsecmod_env* ipsecmod_env, struct config_file* cfg)
+ 			cfg->ipsecmod_hook, strerror(errno));
+ 		return 0;
+ 	}
+-	if(cfg->ipsecmod_whitelist &&
+-		!ipsecmod_whitelist_apply_cfg(ipsecmod_env, cfg))
+-		return 0;
+ 	return 1;
+ }
+ 
+@@ -626,6 +628,8 @@ ipsecmod_inform_super(struct module_qstate* qstate, int id,
+ 		verbose(VERB_ALGO, "super has no ipsecmod state");
+ 		return;
+ 	}
++	if(!siq->enabled)
++		return;
+ 
+ 	if(qstate->return_msg) {
+ 		struct ub_packed_rrset_key* rrset_key = reply_find_answer_rrset(
+-- 
+2.55.0
+

diff --git a/unbound-1.26.0-replace-python2-c-api-macros.patch b/unbound-1.26.0-replace-python2-c-api-macros.patch
new file mode 100644
index 0000000..333ed80
--- /dev/null
+++ b/unbound-1.26.0-replace-python2-c-api-macros.patch
@@ -0,0 +1,172 @@
+From a04cf5ade4d31b3c1dcefa35c2974cc76adaf4f3 Mon Sep 17 00:00:00 2001
+From: "W.C.A. Wijngaards" <wouter@nlnetlabs.nl>
+Date: Fri, 7 Aug 2026 08:57:32 +0200
+Subject: [PATCH] - Fix #1489 from jplesnik: Replace removed Python 2 C API
+ macros for SWIG 4.5.0 compatibility.
+
+---
+ pythonmod/interface.i | 28 ++++++++++++++--------------
+ pythonmod/pythonmod.c |  8 ++++----
+ 2 files changed, 18 insertions(+), 18 deletions(-)
+
+diff --git a/pythonmod/interface.i b/pythonmod/interface.i
+index 735f2ed..7e2a188 100644
+--- a/pythonmod/interface.i
++++ b/pythonmod/interface.i
+@@ -79,7 +79,7 @@
+                 i+(int)((unsigned int)name[i]) < len) {
+                 memmove(buf, name + i + 1, (unsigned int)name[i]);
+                 buf[(unsigned int)name[i]] = 0;
+-                PyList_SetItem(list, cnt, PyString_FromString(buf));
++                PyList_SetItem(list, cnt, PyUnicode_FromString(buf));
+         }
+         i += ((unsigned int)name[i]) + 1;
+         cnt++;
+@@ -96,7 +96,7 @@
+ 
+      list = PyList_New(len);
+      for (i=0; i < len; i++) {
+-            PyList_SET_ITEM(list, i, PyString_FromString(array[i]));
++            PyList_SET_ITEM(list, i, PyUnicode_FromString(array[i]));
+      }
+      return list;
+    }
+@@ -207,7 +207,7 @@ struct query_info {
+        char buf[LDNS_MAX_DOMAINLEN];
+        buf[0] = '\0';
+        dname_str((uint8_t*)PyBytes_AsString(dname), buf);
+-       return PyString_FromString(buf);
++       return PyUnicode_FromString(buf);
+    }
+ %}
+ 
+@@ -345,7 +345,7 @@ struct packed_rrset_data {
+    PyObject* _get_data_rr_len(struct packed_rrset_data* d, int idx) {
+      if ((d != NULL) && (idx >= 0) &&
+              ((size_t)idx < (d->count+d->rrsig_count)))
+-        return PyInt_FromLong(d->rr_len[idx]);
++        return PyLong_FromLong(d->rr_len[idx]);
+      return Py_None;
+    }
+    void _set_data_rr_ttl(struct packed_rrset_data* d, int idx, uint32_t ttl)
+@@ -357,7 +357,7 @@ struct packed_rrset_data {
+    PyObject* _get_data_rr_ttl(struct packed_rrset_data* d, int idx) {
+      if ((d != NULL) && (idx >= 0) &&
+              ((size_t)idx < (d->count+d->rrsig_count)))
+-        return PyInt_FromLong(d->rr_ttl[idx]);
++        return PyLong_FromLong(d->rr_ttl[idx]);
+      return Py_None;
+    }
+    PyObject* _get_data_rr_data(struct packed_rrset_data* d, int idx) {
+@@ -555,12 +555,12 @@ struct sockaddr_storage {};
+ 
+         if (ss->ss_family == AF_INET) {
+             const struct sockaddr_in *sa4 = (struct sockaddr_in *)ss;
+-            return PyInt_FromLong(ntohs(sa4->sin_port));
++            return PyLong_FromLong(ntohs(sa4->sin_port));
+         }
+ 
+         if (ss->ss_family == AF_INET6) {
+             const struct sockaddr_in6 *sa6 = (struct sockaddr_in6 *)ss;
+-            return PyInt_FromLong(ntohs(sa6->sin6_port));
++            return PyLong_FromLong(ntohs(sa6->sin6_port));
+         }
+ 
+         return Py_None;
+@@ -574,7 +574,7 @@ struct sockaddr_storage {};
+         }
+ 
+         sa6 = (struct sockaddr_in6 *)ss;
+-        return PyInt_FromLong(ntohl(sa6->sin6_flowinfo));
++        return PyLong_FromLong(ntohl(sa6->sin6_flowinfo));
+     }
+ 
+     PyObject *_sockaddr_storage_scope_id(const struct sockaddr_storage *ss) {
+@@ -585,7 +585,7 @@ struct sockaddr_storage {};
+         }
+ 
+         sa6 = (struct sockaddr_in6 *)ss;
+-        return PyInt_FromLong(ntohl(sa6->sin6_scope_id));
++        return PyLong_FromLong(ntohl(sa6->sin6_scope_id));
+     }
+ %}
+ 
+@@ -661,7 +661,7 @@ struct edns_option {
+ %inline %{
+     PyObject* _edns_option_opt_code_get(struct edns_option* option) {
+         uint16_t opt_code = option->opt_code;
+-        return PyInt_FromLong(opt_code);
++        return PyLong_FromLong(opt_code);
+     }
+ 
+     PyObject* _edns_option_opt_data_get(struct edns_option* option) {
+@@ -1627,7 +1627,7 @@ int edns_opt_list_append(struct edns_option** list, uint16_t code, size_t len,
+         }
+         result = PyObject_Call(func, py_args, py_kwargs);
+         if (result) {
+-            res = PyInt_AsLong(result);
++            res = PyLong_AsLong(result);
+         }
+ out:
+         Py_XDECREF(py_edns);
+@@ -1711,7 +1711,7 @@ out:
+         }
+         result = PyObject_Call(func, py_args, py_kwargs);
+         if (result) {
+-            res = PyInt_AsLong(result);
++            res = PyLong_AsLong(result);
+         }
+ out:
+         Py_XDECREF(py_qinfo);
+@@ -1765,7 +1765,7 @@ out:
+         }
+         result = PyObject_Call(func, py_args, py_kwargs);
+         if (result) {
+-            res = PyInt_AsLong(result);
++            res = PyLong_AsLong(result);
+         }
+ out:
+         Py_XDECREF(py_qstate);
+@@ -1814,7 +1814,7 @@ out:
+         }
+         result = PyObject_Call(func, py_args, py_kwargs);
+         if (result) {
+-            res = PyInt_AsLong(result);
++            res = PyLong_AsLong(result);
+         }
+ out:
+         Py_XDECREF(py_qstate);
+diff --git a/pythonmod/pythonmod.c b/pythonmod/pythonmod.c
+index 045dd1b..1aef556 100644
+--- a/pythonmod/pythonmod.c
++++ b/pythonmod/pythonmod.c
+@@ -246,14 +246,14 @@ log_py_err(void)
+ 	}
+ 
+ 	/* And it should be a string all ready to go - duplicate it. */
+-	if (!PyString_Check(obResult) && !PyUnicode_Check(obResult)) {
++	if (!PyBytes_Check(obResult) && !PyUnicode_Check(obResult)) {
+ 		log_err("pythonmod: cannot print exception, "
+ 			"StringIO.getvalue() result did not String_Check"
+ 			" or Unicode_Check");
+ 		goto cleanup;
+ 	}
+-	if(PyString_Check(obResult)) {
+-		result = PyString_AsString(obResult);
++	if(PyBytes_Check(obResult)) {
++		result = PyBytes_AsString(obResult);
+ 	} else {
+ 		ascstr = PyUnicode_AsASCIIString(obResult);
+ 		result = PyBytes_AsString(ascstr);
+@@ -450,7 +450,7 @@ int pythonmod_init(struct module_env* env, int id)
+ 
+    pe->data = PyDict_New();
+    /* add the script filename to the global "mod_env" for trivial access */
+-   fname = PyString_FromString(pe->fname);
++   fname = PyUnicode_FromString(pe->fname);
+    if(PyDict_SetItemString(pe->data, "script", fname) < 0) {
+ 	log_err("pythonmod: could not add item to dictionary");
+ 	Py_XDECREF(fname);
+-- 
+2.55.0
+

diff --git a/unbound.spec b/unbound.spec
index 9887df8..20f6edb 100644
--- a/unbound.spec
+++ b/unbound.spec
@@ -42,7 +42,7 @@
 
 Summary: Validating, recursive, and caching DNS(SEC) resolver
 Name: unbound
-Version: 1.25.2
+Version: 1.26.0
 Release: %autorelease %{?extra_version:-e %{extra_version}}
 License: BSD-3-Clause
 Url: https://nlnetlabs.nl/projects/unbound/
@@ -77,8 +77,10 @@ Source29: tmpfiles-unbound-libs.conf
 
 # Downstream configuration changes
 Patch1:   unbound-fedora-config.patch
-# https://github.com/NLnetLabs/unbound/pull/1437
-Patch6:   0001-Fix-build-failure-with-openssl4.0.patch
+# https://github.com/NLnetLabs/unbound/commit/8b33c5d7ffb82d442f3d19021588449cd6b02a17
+Patch6:   unbound-1.26.0-disabled-ipsecmod-fix.patch
+# https://github.com/cgallred/unbound/commit/93a56205cfa6b9a6d34db7245aa71e5ca67d1fd7
+Patch7:   unbound-1.26.0-replace-python2-c-api-macros.patch
 
 BuildRequires: gcc
 BuildRequires: make