From 7265c4aab1e7df002477a8b397ca003c5e19cf8b Mon Sep 17 00:00:00 2001
From: CroneKorkN <i@ckn.li>
Date: Sun, 10 May 2026 21:03:16 +0200
Subject: [PATCH] letsencrypt: depend on bind9-dnsutils (dnsutils is a trixie
 transitional)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

On Debian 13 trixie `dnsutils` is a transitional package replaced by
`bind9-dnsutils`. Apt installs bind9-dnsutils when you ask for dnsutils,
but `dpkg -s dnsutils` returns 1 because no real package by that name
exists — bw's pkg_apt status check then flags the item as failed every
apply. Switching the dependency to the real package name resolves the
loop.

The bundle just needs `nsupdate` (provided by bind9-dnsutils) for the
DNS-01 challenge hook.
---
 bundles/letsencrypt/metadata.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/bundles/letsencrypt/metadata.py b/bundles/letsencrypt/metadata.py
index 2e03de1..559af14 100644
--- a/bundles/letsencrypt/metadata.py
+++ b/bundles/letsencrypt/metadata.py
@@ -2,7 +2,7 @@ defaults = {
     'apt': {
         'packages': {
             'dehydrated': {},
-            'dnsutils': {},
+            'bind9-dnsutils': {},
         },
     },
     'letsencrypt': {