3 files changed, 21 insertions, 21 deletions
diff --git a/src/common/CMakeLists.txt b/src/common/CMakeLists.txt
index b712ee6b1..2670182e3 100644
--- a/src/common/CMakeLists.txt
+++ b/src/common/CMakeLists.txt
@@ -67,6 +67,10 @@ monero_add_library(common
   ${common_headers}
   ${common_private_headers}
   DEPENDS generate_translations_header)
+if(STATIC AND NOT MINGW)
+  find_package(ZLIB REQUIRED)
+  find_library(ZSTD_LIBRARY NAMES zstd REQUIRED)
+endif()
 target_link_libraries(common
   PUBLIC
     cncrypto
@@ -80,7 +84,9 @@ target_link_libraries(common
     ${Boost_CHRONO_LIBRARY}
   PRIVATE
     ${OPENSSL_LIBRARIES}
-    ${EXTRA_LIBRARIES})
+    ${EXTRA_LIBRARIES}
+    $<$<AND:$<BOOL:${STATIC}>,$<NOT:$<BOOL:${MINGW}>>>:ZLIB::ZLIB>
+    $<$<AND:$<BOOL:${STATIC}>,$<NOT:$<BOOL:${MINGW}>>>:${ZSTD_LIBRARY}>)
 
 #monero_install_headers(common
 #  ${common_headers})
diff --git a/src/common/dns_utils.cpp b/src/common/dns_utils.cpp
index 40e913800..ef60a3f67 100644
--- a/src/common/dns_utils.cpp
+++ b/src/common/dns_utils.cpp
@@ -289,26 +289,10 @@ DNSResolver::DNSResolver() : m_data(new DNSResolverData())
 
   add_anchors(m_data->m_ub_context);
 
-  if (!DNS_PUBLIC)
-  {
-    // if no DNS_PUBLIC specified, we try a lookup to what we know
-    // should be a valid DNSSEC record, and switch to known good
-    // DNSSEC resolvers if verification fails
-    bool available, valid;
-    static const char *probe_hostname = "updates.moneropulse.org";
-    auto records = get_txt_record(probe_hostname, available, valid);
-    if (!valid)
-    {
-      MINFO("Failed to verify DNSSEC record from " << probe_hostname << ", falling back to TCP with well known DNSSEC resolvers");
-      ub_ctx_delete(m_data->m_ub_context);
-      m_data->m_ub_context = ub_ctx_create();
-      add_anchors(m_data->m_ub_context);
-      for (const auto &ip: DEFAULT_DNS_PUBLIC_ADDR)
-        ub_ctx_set_fwd(m_data->m_ub_context, string_copy(ip));
-      ub_ctx_set_option(m_data->m_ub_context, string_copy("do-udp:"), string_copy("no"));
-      ub_ctx_set_option(m_data->m_ub_context, string_copy("do-tcp:"), string_copy("yes"));
-    }
-  }
+  // The upstream client probes a Monero-operated, DNSSEC-signed TXT record
+  // here and switches to hard-coded resolvers when validation fails. Monzero
+  // has no equivalent signed record yet, so use the operator's configured
+  // resolver. Clearnet bootstrap also has a compiled direct-IP fallback.
 }
 
 DNSResolver::~DNSResolver()
diff --git a/src/common/updates.cpp b/src/common/updates.cpp
index 2a129075b..b68be39b6 100644
--- a/src/common/updates.cpp
+++ b/src/common/updates.cpp
@@ -39,6 +39,15 @@ namespace tools
 {
   bool check_updates(const std::string &software, const std::string &buildtag, std::string &version, std::string &hash)
   {
+    // Do not trust or advertise Monero release records for Monzero binaries.
+    // Re-enable only after project-controlled, signed update infrastructure
+    // has been reviewed and deployed.
+    (void)software;
+    (void)buildtag;
+    (void)version;
+    (void)hash;
+    return false;
+#if 0
     std::vector<std::string> records;
     bool found = false;
 
@@ -98,6 +107,7 @@ namespace tools
       found = true;
     }
     return found;
+#endif
   }
 
   std::string get_update_url(const std::string &software, const std::string &subdir, const std::string &buildtag, const std::string &version, bool user)