Bug 282566 - net/chrony: rc script should not depend on DAEMON
Summary: net/chrony: rc script should not depend on DAEMON
Status: Closed FIXED
Alias: None
Product: Ports & Packages
Classification: Unclassified
Component: Individual Port(s) (show other bugs)
Version: Latest
Hardware: Any Any
: --- Affects Only Me
Assignee: Matthias Andree
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2024-11-05 14:36 UTC by Lexi Winter
Modified: 2024-12-08 15:20 UTC (History)
1 user (show)

See Also:
bugzilla: maintainer-feedback? (mandree)


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Lexi Winter freebsd_triage 2024-11-05 14:36:47 UTC
current the chrony rc.d script depends on DAEMON, which means it starts after all other daemons.  this is a problem in some configurations, like mine, where i have other daemons which depends on chrony.

i've tested 'REQUIRE: FILESYSTEMS defaultroute netwait resolv' instead, which seems to work better for me.
Comment 1 Matthias Andree freebsd_committer freebsd_triage 2024-11-05 20:04:45 UTC
What daemon would depend on chrony? 

Haven't you modified a few of your rc.d scripts already to achieve that?

If so, why would I need to change the default?
Comment 2 commit-hook freebsd_committer freebsd_triage 2024-12-08 15:20:58 UTC
A commit in branch main references this bug:

URL: https://cgit.FreeBSD.org/ports/commit/?id=f7c8a6233b5131c572e42a5f4c5bfe8d823e5e01

commit f7c8a6233b5131c572e42a5f4c5bfe8d823e5e01
Author:     Matthias Andree <mandree@FreeBSD.org>
AuthorDate: 2024-12-08 15:15:46 +0000
Commit:     Matthias Andree <mandree@FreeBSD.org>
CommitDate: 2024-12-08 15:19:40 +0000

    net/chrony: dns/dnsmasq: change rcfile ordering

    Make sure that these services start in proper order, and sooner
    such that chrony can synchronize time before other services need it.

    Note that there is a circular dependency or bootstrapping problem
    here in that the system time needs to be halfway correct if you
    require your time servers to be looked up through DNS with DNSSEC
    enabled because crypto usually needs correct clocks for expiration
    checks on signatures to work so the name service needs a correct time,
    and looking up the time server needs a working name service.

    So be sure you can bootstrap with a skewed time.

    Reported by:    Lexi Winter
    PR:             282566

    I am not MFHing this, it's too intrusive.

 dns/dnsmasq/Makefile         | 2 +-
 dns/dnsmasq/files/dnsmasq.in | 4 ++--
 net/chrony/Makefile          | 1 +
 net/chrony/files/chronyd.in  | 2 +-
 4 files changed, 5 insertions(+), 4 deletions(-)