- Fix to elevate the diagnostic for no matches for a wildcard

  trusted-keys-file, make it more descriptive, and more man
  page content for it. Thanks to Qifan Zhang, Palo Alto
  Networks, for the report.

Author: wcawijngaards

doc/Changelog

@@ -1,3 +1,9 @@
+8 September 2026: Wouter
+	- Fix to elevate the diagnostic for no matches for a wildcard
+	  trusted-keys-file, make it more descriptive, and more man
+	  page content for it. Thanks to Qifan Zhang, Palo Alto
+	  Networks, for the report.
+
 4 September 2026: Wouter
 	- Fix to make rpz_config leave the rpz with correct set up
 	  on failure. The struct is not half configured on exit.

doc/unbound.conf.rst

@@ -2237,6 +2237,9 @@ These options are part of the ``server:`` section.
     It is possible to use wildcards with this statement, the wildcard is
     expanded on start and on reload.
 
+    A wildcard that matches no files is not an error: the entry loads no
+    trust anchors, and the condition is logged at operational verbosity.
+
     Default: "" (no trusted keys file)
 
 

validator/val_anchor.c

@@ -829,8 +829,9 @@ anchor_read_bind_file_wild(struct val_anchors* anchors, sldns_buffer* buffer,
 	if(r) {
 		/* some error */
 		if(r == GLOB_NOMATCH) {
-			verbose(VERB_QUERY, "trusted-keys-file: "
-				"no matches for %s", pat);
+			verbose(VERB_OPS, "trusted-keys-file: "
+				"no matches for %s; "
+				"no trust anchors loaded from it", pat);
 			return 1;
 		} else if(r == GLOB_NOSPACE) {
 			log_err("wildcard trusted-keys-file %s: "