In particular, avoids unintentional NXDOMAIN on grafted subtrees.
Consequently the users can drop 'NO_CACHE' flag and get caching.

I broke this in 54ab3f78 or closely around, so this never worked well
since 5.4.1, and maybe structured logging (5.4.0) had related issues.

And by default do so iff jemalloc is found.

I chose the simplicity of adding the chosen allocator just
in the single binary.  Other sbin/* don't matter really,
and dynamic libs (e.g. modules) will just follow whoever loaded them.

Last use case was dropped in 36b08eb3,
and I don't expect we'd use this in future anymore.
The "bullseye" in README was clearly a typo (it's the codename for 11).

As the web is now, combination without www doesn't redirect https
(only http).  So let's switch to the final URL; apex is problematic.

In that case there's no need to wait for other jobs, too.

We're usually not interested in CI on older commits,
and this default will help cancelling expensive respdiff jobs.

Also add default runner tags to make them less likely
to get underspecified.  For example, each job should choose
one option in the docker/lxc and amd64/arm64 pairs.

This reverts commit 15c13535, with some modifications.
On LXC we've had issues with
  FileExistsError: [Errno 17] File exists: '/tmp/pytest-kresd-portdir'
.. which disappear with this commit.  (I don't know how/why.)

We're the same as knotd in this; it evolved a bit
with libknot and kernel versions.  Taken from:
https://www.knot-dns.cz/docs/3.2/singlehtml/#mode-xdp-pre-requisites

Reproducible by listening on an interface by name, ASAN reports a
heap-buffer-overflow. This was a regression caused by !1286, which did
not account for null-terminators properly.

Tom Herbers authored 2 years ago and Vladimír Čunát committed 2 years ago

It's resonable to assume that people would also want to disable DNS64 for
IPv4 source addresses if they only enable it for some IPv6 sources.

Close https://github.com/CZ-NIC/knot-resolver/pull/83

https://gitlab.nic.cz/knot/knot-resolver/-/jobs/802541#L272

I don't know how to fix building the image with it.
A few things were tried around different go versions (from -backports).

release 5.5.3

See merge request !1343

It's a mitigation for CVE-2022-40188 and similar DoS attempts.
It's using really trivial approaches, at least for now.

This fixes config_tests on aarch64 macOS.
The key difference is that they use 16k pages,
so LMDB space usage also behaves a bit different.

That option isn't supported there, so the test wouldn't work.
Now the config tests work for me on x86 macOS.

Enums are more like ints anyway (in standard),
even when drawn from a small subset.

So far the message wasn't pointing to freebind at all:
[net   ] bind to '::1@53' (UDP): Operation not supported

I used preprocessor to avoid duplication and unused warnings.

Another way would be to ignore the freebind option if not supported,
but I think it's better to convince users not to specify it.