Re: dnsmasq: enable dnssec build option by default

[rvighne <rvighne@users.noreply.github.com>]

[-- Attachment #1: Type: text/plain, Size: 1708 bytes --]

New comment by rvighne on void-packages repository

https://github.com/void-linux/void-packages/pull/41786#issuecomment-1465298617

Comment:
> Don't ping people just because they touched a template. We're a small, volunteer group without strict procedures for review and acceptance. People get to things when they get to them. When somebody comes along that has an interest in this package and in your change to the default build options, that person will likely comment or merge the changes.

Understood. Though I don't see how a new contributor could tell the difference between "reviewers have seen this but they're busy so they'll get to it eventually" and "there's something wrong with this PR so nobody's reviewing it".

> I have no idea whether enabling this option by default will break somebody's workflow. You show that the option works when you enable it, but offer no comments about what impact this change might have in existing users.

This option enables a feature that is disabled by default unless you have `dnssec` in the config file. It's not possible that someone already had this option enabled and their dnsmasq instance will suddenly start to behave differently, because non-dnssec-capable builds of dnsmasq will fail to start up if given that flag.

Enabling the dnssec build option also has the side effect of adding `nettle` as a dependency, which is tiny (600KB).

Also, it's pretty unlikely in 2023 that you would want to set up a DNS resolver that ignores DNSSEC. I don't know if Void has any guidelines for this type of thing, but having secure defaults (and not making users build their own package just to get a basic security feature) seems like a good idea to me.