fail: the anchor is NOT ok and could not be fixed

[syrkuit]

Describe the bug
unbound does not work on the Linux development environment of a ChromeOS system, which is a debian container.
there are various ways this manifests itself

• running unbound-anchor produces no output, exits with 0
• running unbound-anchor -v produces the following:

/usr/share/dns/root.key has content
fail: the anchor is NOT ok and could not be fixed

now what?

as far as I can tell, this is about running on ChromeOS, same result using an alpine docker container.

Expected behavior
Two things are wrong here:

1. exit code 0 implies everything was fine but it failed silently
2. the error message is obscure and unhelpful

System:

• Unbound version: 1.17.1
• OS: Debian GNU/L:inux 12 (bookworm) on ChromeOS version 131
• unbound -V output:

Version 1.17.1

Configure line: --build=x86_64-linux-gnu --prefix=/usr --includedir=${prefix}/include --mandir=${prefix}/share/man --infodir=${prefix}/share/info --sysconfdir=/etc --localstatedir=/var --disable-option-checking --disable-silent-rules --libdir=${prefix}/lib/x86_64-linux-gnu --runstatedir=/run --disable-maintainer-mode --disable-dependency-tracking --with-pythonmodule --with-pyunbound --enable-subnet --enable-dnstap --enable-systemd --with-libnghttp2 --with-chroot-dir= --with-dnstap-socket-path=/run/dnstap.sock --disable-rpath --with-pidfile=/run/unbound.pid --with-libevent --enable-tfo-client --with-rootkey-file=/usr/share/dns/root.key --enable-tfo-server
Linked libs: libevent 2.1.12-stable (it uses epoll), OpenSSL 3.0.14 4 Jun 2024
Linked modules: dns64 python subnetcache respip validator iterator
TCP Fastopen feature available

same problem running in an alpine:3.21.0 docker container that comes with

Version 1.22.0

Configure line: --build=x86_64-alpine-linux-musl --host=x86_64-alpine-linux-musl --prefix=/usr --sysconfdir=/etc --mandir=/usr/share/man --localstatedir=/var --enable-pie --enable-relro-now --with-username=unbound --with-run-dir= --with-pidfile= --with-rootkey-file=/usr/share/dnssec-root/trusted-key.key --with-libevent --with-pthreads --disable-static --disable-rpath --disable-dsa --disable-gost --enable-dnstap --enable-subnet --with-ssl --without-pythonmodule --with-pyunbound --with-libnghttp2
Linked libs: libevent 2.1.12-stable (it uses epoll), OpenSSL 3.3.2 3 Sep 2024
Linked modules: dns64 subnetcache respip validator iterator

Additional information
Add any other information that you may have gathered about the issue here.