After  FS#42146 , Unbound itself has difficulties with DNSSEC.

[Description]

By default Unbound comes configured to chroot into /etc/unbound, but the new rootkey file /etc/trusted-key.key is outside the chroot and therefore unreadable.

It means that Unbound won't perform any DNSSEC validation until I manually add 'auto-trust-anchor-file: "root.key"' in unbound.conf and copy the file to /etc/unbound.

This is actually worse than the pre- FS#42146  state. Previously it would have been enough to just run `sudo unbound-anchor` to fix both Unbound and libunbound. But after  FS#42146 , manual configuration became necessary.

(Also: '--with-rootkey-file' sets up the *auto*-trust-anchor-file option, which means Unbound will periodically update the file using RFC 5011, which might be undesirable from a packaging perspective.)

[Possible fix]

As much as I'd like having one central place for the root key, it's probably not going to work properly.

I suggest dropping '--with-rootkey-file' and instead ensuring that /etc/unbound/root.key exists by default, either by

a) running `cp /etc/trusted-key.key "$pkgdir/etc/unbound/root.key"` in package(),

b) running `unbound-anchor -a "$pkgdir/etc/unbound/root.key"` in package(),

c) adding "ExecStartPre=/usr/bin/unbound-anchor" to unbound.service,

or all of the above.

That way, both Unbound and gnutls-cli (libunbound) will work correctly.