From 6fd28bf8f7cb00dc509037fe8920f6d2313725bf Mon Sep 17 00:00:00 2001
From: Christian Hesse <mail@eworm.de>
Date: Tue, 13 Jan 2026 21:39:54 +0100
Subject: [PATCH 1/2] netwatch-dns: check the certificate is available for
 fetch

That trust is not needed for DNS functionality (that was checked before),
but for our hacky check with fetch.
---
 netwatch-dns.rsc | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/netwatch-dns.rsc b/netwatch-dns.rsc
index 4172d28e..2edbdf8c 100644
--- a/netwatch-dns.rsc
+++ b/netwatch-dns.rsc
@@ -104,7 +104,8 @@
 
   :foreach DohServer in=$DohServers do={
     :if ([ :len ($DohServer->"doh-cert") ] > 0) do={
-      :if ([ $CertificateAvailable ($DohServer->"doh-cert") "dns" ] = false) do={
+      :if ([ $CertificateAvailable ($DohServer->"doh-cert") "fetch" ] = false || \
+           [ $CertificateAvailable ($DohServer->"doh-cert") "dns" ] = false) do={
         $LogPrint warning $ScriptName ("Downloading certificate failed, trying without.");
       }
     }

From cc56680206ac46c9b0a0838b5e83631c78461b9f Mon Sep 17 00:00:00 2001
From: Christian Hesse <mail@eworm.de>
Date: Tue, 13 Jan 2026 23:01:23 +0100
Subject: [PATCH 2/2] log-forward: try to mitigate a race condition

The old code looped over all new messages, then updated the variable
to the newest message - at that time! Messages in between were lost.
---
 log-forward.rsc | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/log-forward.rsc b/log-forward.rsc
index 26a23761..ed2226f0 100644
--- a/log-forward.rsc
+++ b/log-forward.rsc
@@ -62,7 +62,11 @@
   :set LogForwardInclude [ $EitherOr $LogForwardInclude [] ];
   :set LogForwardIncludeMessage [ $EitherOr $LogForwardIncludeMessage [] ];
 
+  :local LogAll [ /log/find ];
+  :local MaxId ($LogAll->([ :len $LogAll ] - 1));
+  :local MaxNum [ $HexToNum $MaxId ];
   :local LogForwardFilterLogForwardingCached [ $EitherOr [ $LogForwardFilterLogForwarding ] ("\$^") ];
+
   :foreach Message in=[ /log/find where (!(message="") and \
       !(message~$LogForwardFilterLogForwardingCached) and \
       !(topics~$LogForwardFilter) and !(message~$LogForwardFilterMessage)) or \
@@ -70,7 +74,8 @@
     :set MessageVal [ /log/get $Message ];
     :local Bullet "information";
 
-    :if ($Last < [ $HexToNum ($MessageVal->".id") ]) do={
+    :local Current [ $HexToNum ($MessageVal->".id") ];
+    :if ($Last < $Current && $Current <= $MaxNum) do={
       :local DupCount ($MessageDups->($MessageVal->"message"));
       :if ($MessageVal->"topics" ~ "(warning)") do={
         :set Warning true;
@@ -106,8 +111,7 @@
     :set LogForwardRateLimit [ $MAX 0 ($LogForwardRateLimit - 1) ];
   }
 
-  :local LogAll [ /log/find ];
-  :set LogForwardLast ($LogAll->([ :len $LogAll ] - 1) );
+  :set LogForwardLast $MaxId;
 } do={
   :global ExitError; $ExitError $ExitOK [ :jobname ] $Err;
 }