[bugfix] allow DoT to work for dig from net/isc-bind

[Pascal Stumpf]

dig needs to access /etc/ssl/cert.pem, so add an unveil().


Index: Makefile
===================================================================
RCS file: /home/cvs/ports/net/isc-bind/Makefile,v
diff -u -p -r1.199 Makefile
--- Makefile    19 Mar 2025 13:56:14 -0000      1.199
+++ Makefile    20 Mar 2025 17:42:32 -0000
@@ -9,7 +9,7 @@ EXTRACT_SUFX=   .tar.xz
 EPOCH=         3
 
 # keep above 7.6-stable; Python ver bumped
-REVISION=      0
+REVISION=      1
 
 DISTNAME=      bind-$V
 PKGNAME=       isc-bind-${V:S/-P/pl/}
Index: patches/patch-bin_dig_dig_c
===================================================================
RCS file: /home/cvs/ports/net/isc-bind/patches/patch-bin_dig_dig_c,v
diff -u -p -r1.39 patch-bin_dig_dig_c
--- patches/patch-bin_dig_dig_c 12 Dec 2024 10:20:04 -0000      1.39
+++ patches/patch-bin_dig_dig_c 20 Mar 2025 17:42:12 -0000
@@ -1,5 +1,6 @@
 Patch to use pledge on OpenBSD.
 locale is needed for idn2.
+cert.pem is needed for DoT.
 
 Index: bin/dig/dig.c
 --- bin/dig/dig.c.orig
@@ -28,7 +29,7 @@ Index: bin/dig/dig.c
        debug("dig_setup()");
  
        /* setup dighost callbacks */
-@@ -3399,6 +3409,21 @@ dig_query_setup(bool is_batchfile, bool config_only, i
+@@ -3399,6 +3409,25 @@ dig_query_setup(bool is_batchfile, bool config_only, i
        } else if (keysecret[0] != 0) {
                setup_text_key();
        }
@@ -37,10 +38,14 @@ Index: bin/dig/dig.c
 +              perror("unveil /usr/share/locale");
 +              exit(1);
 +      }
++      if (unveil("/etc/ssl/cert.pem", "r") == -1) {
++              perror("unveil /etc/ssl/cert.pem");
++              exit(1);
++      }
 +      /*
 +       * dns:   resolv.conf, also allows port 53 sockets
 +       * inet:  needed if we query on port != 53
-+       * rpath: locale
++       * rpath: locale and cert.pem
 +       */
 +      if (pledge("stdio rpath inet dns", NULL) == -1) {
 +              perror("pledge");