fix: switch to a resolved drop-in

config/common/common-scripts.yml

@@ -2,6 +2,5 @@ type: script
 scripts:
   - authselect.sh
   - setfilepermissions.sh
-  - securedns.sh
   # this sets up the proper policy & signing files for signed images to work
   - signing.sh

config/files/usr/etc/systemd/resolved.conf.d/securedns.conf

@@ -0,0 +1,2 @@
+DNSSEC=allow-downgrade
+DNSOverTLS=opportunistic

config/scripts/securedns.sh

@@ -1,10 +0,0 @@
-#!/usr/bin/env bash
-
-# Tell build process to exit if there are any errors.
-set -oue pipefail
-
-# https://wiki.archlinux.org/title/systemd-resolved#DNSSEC
-sed -i 's/#DNSSEC=no/DNSSEC=allow-downgrade/' /usr/etc/systemd/resolved.conf
-
-# https://wiki.archlinux.org/title/systemd-resolved#DNS_over_TLS
-sed -i 's/#DNSOverTLS=no/DNSOverTLS=opportunistic/' /usr/etc/systemd/resolved.conf