Skip to content

Docs: usr-share-doc-unbound copyright and license year(s?) #1449

Description

@devopsbob

Describe the bug
As a compliance analyst I want to ensure projects referenced include appropriate license and copyright files so that software bill of materials and license compliance reports reflect proper current state of the software or hardware utilized.

Notes: Found this while working to reference unbound source build to get latest features and include in final image. I had OARC DNS checker with an 'A' rating using 1.24 and only a 'B' rating with 1.22. The apt catalog gives only 1.22 so was checking for SBOM and license compliances in my 'ke-net-screen' github project to build and apply newer unbound release.

To reproduce
Steps to reproduce the behavior:

  1. Create a SBOM using Syft via rpi-image-gen build tool and include unbound package install

  2. Review generated syft sbom json file, search for unbound
    "spdxElementId": "SPDXRef-Package-deb-unbound-5c388af62716eb96",
    "relatedSpdxElement": "SPDXRef-File-usr-share-doc-unbound-copyright-366ce59e26682283",

  3. Identify copyright file reference at /usr/share/doc/unbound

  4. Consider -V version year reference output

  5. Consider /usr/share/doc/unbound/copyright unbound version year reference

Expected behavior
Appreciate the long history of the product and would expect to see 2001-2026 or year of build release (2001-YearOfRelease).

Also consider additional /usr/share/license/unbound/license file and/or /usr/share/common-license/unbound-license file as suggested by Yocto and "other generated responses" for license file locations and SBOM/Compliances tools checkers...

System:

  • Unbound version: 1.22.0
  • OS: Rasperry Pi 5 with Debian 13/Trixie
  • unbound -V output:
    Version 1.22.0

Configure line: --build=aarch64-linux-gnu --prefix=/usr --includedir=${prefix}/include --mandir=${prefix}/share/man --infodir=${prefix}/share/info --sysconfdir=/etc --localstatedir=/var --disable-option-checking --disable-silent-rules --libdir=${prefix}/lib/aarch64-linux-gnu --runstatedir=/run --disable-maintainer-mode --disable-dependency-tracking --with-pythonmodule --with-pyunbound --enable-subnet --enable-dnstap --enable-systemd --enable-cachedb --with-libhiredis --with-libnghttp2 --with-chroot-dir= --with-dnstap-socket-path=/run/dnstap.sock --disable-rpath --with-pidfile=/run/unbound.pid --with-libevent --enable-tfo-client --with-rootkey-file=/usr/share/dns/root.key --disable-flto --enable-tfo-server
Linked libs: libevent 2.1.12-stable (it uses epoll), OpenSSL 3.5.5 27 Jan 2026
Linked modules: dns64 python cachedb subnetcache respip validator iterator
TCP Fastopen feature available

Additional information
myuser@myhost:/usr/share/doc/unbound$ ls
contrib copyright examples
localadmin@ke-localdns:/usr/share/doc/unbound$ cat copyright
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: unbound

Files: *
Copyright: 2001-2021 NLnet Labs
2008-2009 W.C.A. Wijngaards
2008-2009 Wouter Wijngaards
License: BSD-3-NLnetLabs

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions