From f803e4d4c83ca797ee4ebdb2fdc9cfa862e4db94 Mon Sep 17 00:00:00 2001 From: Joseph Marrero Corchado Date: Tue, 27 Oct 2026 15:00:14 -0400 Subject: [PATCH] standard: Order CA trust regeneration before systemd-resolved systemd-resolved uses DefaultDependencies=no and orders itself before sysinit.target, so it could start in parallel with the regeneration and read a stale trust store for DNS-over-TLS. Order the service before it. The ordering is ignored when systemd-resolved is not installed. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01Vcy8XfBfUtxbEWMu62CiF6 --- standard/atomic-update-ca-trust.service | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/standard/atomic-update-ca-trust.service b/standard/atomic-update-ca-trust.service index 245766cd..9c0cc8c2 100644 --- a/standard/atomic-update-ca-trust.service +++ b/standard/atomic-update-ca-trust.service @@ -20,6 +20,11 @@ DefaultDependencies=no Requires=local-fs.target After=local-fs.target Before=sysinit.target +# systemd-resolved also uses DefaultDependencies=no and orders itself before +# sysinit.target, so without an explicit ordering it can start in parallel +# with regeneration and read a stale trust store for DNS-over-TLS. Order +# before it; systemd ignores this when the unit is not installed. +Before=systemd-resolved.service [Service] Type=oneshot