Remove non-matching version from conflict

Provide include file bind9/config.h again
It got removed somewhere in repeated rebasing process. Get it packaged again, bind-dyndb-ldap cannot compile without it.
2026-08-25 15:06:59 +02:00 · 2026-08-25 14:36:15 +02:00 · 2026-08-25 14:36:15 +02:00 · 2026-08-25 14:36:12 +02:00 · 2026-08-25 13:33:29 +02:00 · 2026-08-25 13:28:00 +02:00
85 changed files with 13230 additions and 7128 deletions
--- a/.fmf/version
+++ b/.fmf/version
@ -0,0 +1 @@
+1
--- a/.gitignore
+++ b/.gitignore
@ -164,6 +164,10 @@ bind-9.7.2b1.tar.gz
 /bind-9.16.23.tar.xz.asc
 /bind-9.16.24.tar.xz
 /bind-9.16.24.tar.xz.asc
+/bind-9.16.25.tar.xz
+/bind-9.16.25.tar.xz.asc
+/bind-9.16.26.tar.xz
+/bind-9.16.26.tar.xz.asc
 /bind-9.16.27.tar.xz
 /bind-9.16.27.tar.xz.asc
 /bind-9.16.28.tar.xz
@ -172,7 +176,65 @@ bind-9.7.2b1.tar.gz
 /bind-9.16.29.tar.xz.asc
 /bind-9.16.30.tar.xz
 /bind-9.16.30.tar.xz.asc
-/bind-9.16.31.tar.xz
-/bind-9.16.31.tar.xz.asc
-/bind-9.16.33.tar.xz
-/bind-9.16.33.tar.xz.asc
+/bind-9.18.0.tar.xz
+/bind-9.18.0.tar.xz.asc
+/bind-9.18.1.tar.xz
+/bind-9.18.1.tar.xz.asc
+/bind-9.18.2.tar.xz
+/bind-9.18.2.tar.xz.asc
+/bind-9.18.3.tar.xz
+/bind-9.18.3.tar.xz.asc
+/bind-9.18.4.tar.xz
+/bind-9.18.4.tar.xz.asc
+/bind-9.18.5.tar.xz
+/bind-9.18.5.tar.xz.asc
+/bind-9.18.6.tar.xz
+/bind-9.18.6.tar.xz.asc
+/bind-9.18.7.tar.xz
+/bind-9.18.7.tar.xz.asc
+/bind-9.18.8.tar.xz
+/bind-9.18.8.tar.xz.asc
+/bind-9.18.9.tar.xz
+/bind-9.18.9.tar.xz.asc
+/bind-9.18.10.tar.xz
+/bind-9.18.10.tar.xz.asc
+/bind-9.18.11.tar.xz
+/bind-9.18.11.tar.xz.asc
+/bind-9.18.12.tar.xz
+/bind-9.18.12.tar.xz.asc
+/bind-9.18.13.tar.xz
+/bind-9.18.13.tar.xz.asc
+/bind-9.18.14.tar.xz
+/bind-9.18.14.tar.xz.asc
+/bind-9.18.15.tar.xz
+/bind-9.18.15.tar.xz.asc
+/bind-9.18.16.tar.xz
+/bind-9.18.16.tar.xz.asc
+/bind-9.18.17.tar.xz
+/bind-9.18.17.tar.xz.asc
+/bind-9.18.18.tar.xz
+/bind-9.18.18.tar.xz.asc
+/bind-9.18.19.tar.xz
+/bind-9.18.19.tar.xz.asc
+/bind-9.18.20.tar.xz
+/bind-9.18.20.tar.xz.asc
+/bind-9.18.21.tar.xz
+/bind-9.18.21.tar.xz.asc
+/bind-9.18.24.tar.xz
+/bind-9.18.24.tar.xz.asc
+/bind-9.18.26.tar.xz
+/bind-9.18.26.tar.xz.asc
+/bind-9.18.28.tar.xz
+/bind-9.18.28.tar.xz.asc
+/bind-9.18.29.tar.xz
+/bind-9.18.29.tar.xz.asc
+/bind-9.18.30.tar.xz
+/bind-9.18.30.tar.xz.asc
+/bind-9.18.31.tar.xz
+/bind-9.18.31.tar.xz.asc
+/bind-9.18.32.tar.xz
+/bind-9.18.32.tar.xz.asc
+/bind-9.18.33.tar.xz
+/bind-9.18.33.tar.xz.asc
+/bind-9.18.*.tar.xz
+/bind-9.18.*.tar.xz.asc
--- a/0001-Use-variable-PROGRAM_SUFFIX-in-install-target.patch
+++ b/0001-Use-variable-PROGRAM_SUFFIX-in-install-target.patch
@ -0,0 +1,61 @@
+From 31bd3a0996a85c0fced0c6ace3da1241b30dc397 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
+Date: Thu, 30 Apr 2026 17:28:40 +0200
+Subject: [PATCH] Use variable PROGRAM_SUFFIX in install target
+
+--program-suffix is handled by configure itself. But some makefile rules
+need to know it by a special value. Provide that to make multiple
+versions installable together on a single system.
+---
+ Makefile.top            | 1 +
+ bin/check/Makefile.am   | 6 +++---
+ bin/confgen/Makefile.am | 6 +++---
+ 3 files changed, 7 insertions(+), 6 deletions(-)
+
+diff --git a/Makefile.top b/Makefile.top
+index e186d15..91c076b 100644
+--- a/Makefile.top
+++ b/Makefile.top
+@@ -14,6 +14,7 @@ AM_CPPFLAGS =					\
+ AM_LDFLAGS =					\
+ 	$(STD_LDFLAGS)
+ LDADD =
+PROGRAM_SUFFIX =
+ 
+ if HOST_MACOS
+ AM_LDFLAGS +=					\
+diff --git a/bin/check/Makefile.am b/bin/check/Makefile.am
+index 8f63c35..36f232c 100644
+--- a/bin/check/Makefile.am
+++ b/bin/check/Makefile.am
+@@ -27,8 +27,8 @@ LDADD +=			\
+ bin_PROGRAMS = named-checkconf named-checkzone
+ 
+ install-exec-hook:
+-	ln -f $(DESTDIR)$(bindir)/named-checkzone \
+-	      $(DESTDIR)$(bindir)/named-compilezone
+	ln -f $(DESTDIR)$(bindir)/named-checkzone$(PROGRAM_SUFFIX) \
+	      $(DESTDIR)$(bindir)/named-compilezone$(PROGRAM_SUFFIX)
+ 
+ uninstall-hook:
+-	-rm -f $(DESTDIR)$(bindir)/named-compilezone
+	-rm -f $(DESTDIR)$(bindir)/named-compilezone$(PROGRAM_SUFFIX)
+diff --git a/bin/confgen/Makefile.am b/bin/confgen/Makefile.am
+index c1dca43..fe86dd7 100644
+--- a/bin/confgen/Makefile.am
+++ b/bin/confgen/Makefile.am
+@@ -23,8 +23,8 @@ libconfgen_la_SOURCES =		\
+ sbin_PROGRAMS = tsig-keygen rndc-confgen
+ 
+ install-exec-hook:
+-	ln -f $(DESTDIR)$(sbindir)/tsig-keygen \
+-	      $(DESTDIR)$(sbindir)/ddns-confgen
+	ln -f $(DESTDIR)$(sbindir)/tsig-keygen$(PROGRAM_SUFFIX) \
+	      $(DESTDIR)$(sbindir)/ddns-confgen$(PROGRAM_SUFFIX)
+ 
+ uninstall-hook:
+-	-rm -f $(DESTDIR)$(sbindir)/ddns-confgen
+	-rm -f $(DESTDIR)$(sbindir)/ddns-confgen$(PROGRAM_SUFFIX)
+-- 
+2.54.0
+
--- a/README.md
+++ b/README.md
@ -14,6 +14,13 @@ More details about upstream project can be found on their
 only upstream sources and packaging instructions for
 [Fedora Project](https://fedoraproject.org).

+Any rebase requires to be built together with
+[bind-dyndb-ldap](https://src.fedoraproject.org/rpms/bind-dyndb-ldap/) to prevent conflict
+at installation of [freeipa-server-dns](https://src.fedoraproject.org/rpms/freeipa).
+Stable bodhi updates are checked, but rawhide are not checked explicitly.
+Symbol of libraries in *bind-libs* changes with every minor version change of bind,
+therefore they break any package dependent on bind-libs.
+
 ## Subpackages

 The package contains several subpackages, some of them can be disabled on rebuild.
@ -21,15 +28,11 @@ The package contains several subpackages, some of them can be disabled on rebuil
 * **bind** -- *named* daemon providing DNS server
 * **bind-utils** -- set of tools to analyse DNS responses or update entries (dig, host)
 * **bind-doc** -- documentation for current bind, *BIND 9 Administrator Reference Manual*.
-* **bind-license** -- Shared license for all packages but bind-export-libs.
-* **bind-pkcs11** -- *named* daemon built with native PKCS#11 support. Can be disabled by `--without PKCS11`.
-* **bind-libs** and **bind-libs-lite** -- Shared libraries used by some others programs
-* **bind-devel** -- Development headers for libs.
-* **bind-dlz-\*** -- Dynamic loadable [DLZ plugins](http://bind-dlz.sourceforge.net/) with support for external databases
+* **bind-libs** -- Shared libraries used by some others programs
+* **bind-devel** -- Development headers for libs. Can be disabled by `--without DEVEL`


 ## Optional features

 * *GSSTSIG* -- Support for Kerberos authentication in BIND.
 * *LMDB* -- Support for dynamic database for managing runtime added zones. Provides faster removal of added zone with much less overhead. But requires lmdb linked to base libs.
-* *DLZ* -- Support for dynamic loaded modules providing support for features *bind-sdb* provides, but only small module is required.
--- a/bind-9.10-dist-native-pkcs11.patch
+++ b/bind-9.10-dist-native-pkcs11.patch
@ -1,541 +0,0 @@
-From 1cbffe7e8b5bced9134abbae23a2a20c83d39a6a Mon Sep 17 00:00:00 2001
-From: Petr Mensik <pemensik@redhat.com>
-Date: Thu, 21 Jan 2021 10:46:20 +0100
-Subject: [PATCH] Enable custom pkcs11 native build
-
-Share common parts like libisc, libcc and others. But provide native
-pkcs11 libraries as a new copy of libdns and libns.
---
- bin/Makefile.in                  |  2 +-
- bin/confgen/Makefile.in          |  2 +-
- bin/dnssec-pkcs11/Makefile.in    | 39 +++++++++++++++++---------------
- bin/named-pkcs11/Makefile.in     | 31 +++++++++++++------------
- configure.ac                     | 19 ++++++++++++++++
- lib/Makefile.in                  |  2 +-
- lib/dns-pkcs11/Makefile.in       | 22 +++++++++---------
- lib/dns-pkcs11/tests/Makefile.in |  8 +++----
- lib/ns-pkcs11/Makefile.in        | 26 ++++++++++-----------
- lib/ns-pkcs11/tests/Makefile.in  | 12 +++++-----
- make/includes.in                 |  7 ++++++
- 11 files changed, 100 insertions(+), 70 deletions(-)
-
-diff --git a/bin/Makefile.in b/bin/Makefile.in
-index 9ad7f62..094775a 100644
--- a/bin/Makefile.in
-+++ b/bin/Makefile.in
-@@ -11,7 +11,7 @@ srcdir =	@srcdir@
- VPATH =		@srcdir@
- top_srcdir =	@top_srcdir@
- 
-SUBDIRS =	named rndc dig delv dnssec tools nsupdate check confgen \
-+SUBDIRS =	named named-pkcs11 rndc dig delv dnssec dnssec-pkcs11 tools nsupdate check confgen \
- 		@NZD_TOOLS@ @PYTHON_TOOLS@ @PKCS11_TOOLS@ plugins tests
- TARGETS =
- 
-diff --git a/bin/confgen/Makefile.in b/bin/confgen/Makefile.in
-index c126bf3..1b7512d 100644
--- a/bin/confgen/Makefile.in
-+++ b/bin/confgen/Makefile.in
-@@ -22,7 +22,7 @@ VERSION=@BIND9_VERSION@
- CINCLUDES = -I${srcdir}/include ${ISC_INCLUDES} ${ISCCC_INCLUDES} \
- 	${ISCCFG_INCLUDES} ${DNS_INCLUDES} ${BIND9_INCLUDES}
- 
-CDEFINES = @USE_PKCS11@
-+CDEFINES =
- CWARNINGS =
- 
- ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
-diff --git a/bin/dnssec-pkcs11/Makefile.in b/bin/dnssec-pkcs11/Makefile.in
-index ace0e5a..e0f6a00 100644
--- a/bin/dnssec-pkcs11/Makefile.in
-+++ b/bin/dnssec-pkcs11/Makefile.in
-@@ -15,18 +15,18 @@ VERSION=@BIND9_VERSION@
- 
- @BIND9_MAKE_INCLUDES@
- 
-CINCLUDES =	${DNS_INCLUDES} ${ISC_INCLUDES} ${ISCCFG_INCLUDES} \
-+CINCLUDES =	${DNS_PKCS11_INCLUDES} ${ISC_INCLUDES} ${ISCCFG_INCLUDES} \
- 		${OPENSSL_CFLAGS}
- 
-CDEFINES =	-DVERSION=\"${VERSION}\" -DNAMED_CONFFILE=\"${sysconfdir}/named.conf\"
-+CDEFINES =	-DVERSION=\"${VERSION}\" -DNAMED_CONFFILE=\"${sysconfdir}/named.conf\" -DUSE_PKCS11=1
- CWARNINGS =
- 
-DNSLIBS =	../../lib/dns/libdns.@A@ @NO_LIBTOOL_DNSLIBS@
-+DNSLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@ @NO_LIBTOOL_DNSLIBS@
- ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
- ISCLIBS =	../../lib/isc/libisc.@A@ @NO_LIBTOOL_ISCLIBS@
- ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ @NO_LIBTOOL_ISCLIBS@
- 
-DNSDEPLIBS =	../../lib/dns/libdns.@A@
-+DNSDEPLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@
- ISCDEPLIBS =	../../lib/isc/libisc.@A@
- ISCCFGDEPLIBS =	../../lib/isccfg/libisccfg.@A@
- 
-@@ -36,12 +36,15 @@ LIBS =		${DNSLIBS} ${ISCCFGLIBS} ${ISCLIBS} @LIBS@
- 
- NOSYMLIBS =	${DNSLIBS} ${ISCCFGLIBS} ${ISCNOSYMLIBS} @LIBS@
- 
-+# Add suffix to all targets
-+EXEEXT =	-pkcs11@EXEEXT@
-+
- # Alphabetically
-TARGETS =	dnssec-cds@EXEEXT@ dnssec-dsfromkey@EXEEXT@ \
-		dnssec-importkey@EXEEXT@ dnssec-keyfromlabel@EXEEXT@ \
-		dnssec-keygen@EXEEXT@ dnssec-revoke@EXEEXT@ \
-		dnssec-settime@EXEEXT@ dnssec-signzone@EXEEXT@ \
-		dnssec-verify@EXEEXT@
-+TARGETS =	dnssec-cds${EXEEXT} dnssec-dsfromkey${EXEEXT} \
-+		dnssec-importkey${EXEEXT} dnssec-keyfromlabel${EXEEXT} \
-+		dnssec-keygen${EXEEXT} dnssec-revoke${EXEEXT} \
-+		dnssec-settime${EXEEXT} dnssec-signzone${EXEEXT} \
-+		dnssec-verify${EXEEXT}
- 
- OBJS =		dnssectool.@O@
- 
-@@ -52,19 +55,19 @@ SRCS =		dnssec-cds.c dnssec-dsfromkey.c dnssec-importkey.c \
- 
- @BIND9_MAKE_RULES@
- 
-dnssec-cds@EXEEXT@: dnssec-cds.@O@ ${OBJS} ${DEPLIBS}
-+dnssec-cds-pkcs11@EXEEXT@: dnssec-cds.@O@ ${OBJS} ${DEPLIBS}
- 	export BASEOBJS="dnssec-cds.@O@ ${OBJS}"; \
- 	${FINALBUILDCMD}
- 
-dnssec-dsfromkey@EXEEXT@: dnssec-dsfromkey.@O@ ${OBJS} ${DEPLIBS}
-+dnssec-dsfromkey-pkcs11@EXEEXT@: dnssec-dsfromkey.@O@ ${OBJS} ${DEPLIBS}
- 	export BASEOBJS="dnssec-dsfromkey.@O@ ${OBJS}"; \
- 	${FINALBUILDCMD}
- 
-dnssec-keyfromlabel@EXEEXT@: dnssec-keyfromlabel.@O@ ${OBJS} ${DEPLIBS}
-+dnssec-keyfromlabel-pkcs11@EXEEXT@: dnssec-keyfromlabel.@O@ ${OBJS} ${DEPLIBS}
- 	export BASEOBJS="dnssec-keyfromlabel.@O@ ${OBJS}"; \
- 	${FINALBUILDCMD}
- 
-dnssec-keygen@EXEEXT@: dnssec-keygen.@O@ ${OBJS} ${DEPLIBS}
-+dnssec-keygen-pkcs11@EXEEXT@: dnssec-keygen.@O@ ${OBJS} ${DEPLIBS}
- 	export BASEOBJS="dnssec-keygen.@O@ ${OBJS}"; \
- 	${FINALBUILDCMD}
- 
-@@ -72,7 +75,7 @@ dnssec-signzone.@O@: dnssec-signzone.c
- 	${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} -DVERSION=\"${VERSION}\" \
- 		-c ${srcdir}/dnssec-signzone.c
- 
-dnssec-signzone@EXEEXT@: dnssec-signzone.@O@ ${OBJS} ${DEPLIBS}
-+dnssec-signzone-pkcs11@EXEEXT@: dnssec-signzone.@O@ ${OBJS} ${DEPLIBS}
- 	export BASEOBJS="dnssec-signzone.@O@ ${OBJS}"; \
- 	${FINALBUILDCMD}
- 
-@@ -80,19 +83,19 @@ dnssec-verify.@O@: dnssec-verify.c
- 	${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} -DVERSION=\"${VERSION}\" \
- 		-c ${srcdir}/dnssec-verify.c
- 
-dnssec-verify@EXEEXT@: dnssec-verify.@O@ ${OBJS} ${DEPLIBS}
-+dnssec-verify-pkcs11@EXEEXT@: dnssec-verify.@O@ ${OBJS} ${DEPLIBS}
- 	export BASEOBJS="dnssec-verify.@O@ ${OBJS}"; \
- 	${FINALBUILDCMD}
- 
-dnssec-revoke@EXEEXT@: dnssec-revoke.@O@ ${OBJS} ${DEPLIBS}
-+dnssec-revoke-pkcs11@EXEEXT@: dnssec-revoke.@O@ ${OBJS} ${DEPLIBS}
- 	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ \
- 	dnssec-revoke.@O@ ${OBJS} ${LIBS}
- 
-dnssec-settime@EXEEXT@: dnssec-settime.@O@ ${OBJS} ${DEPLIBS}
-+dnssec-settime-pkcs11@EXEEXT@: dnssec-settime.@O@ ${OBJS} ${DEPLIBS}
- 	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ \
- 	dnssec-settime.@O@ ${OBJS} ${LIBS}
- 
-dnssec-importkey@EXEEXT@: dnssec-importkey.@O@ ${OBJS} ${DEPLIBS}
-+dnssec-importkey-pkcs11@EXEEXT@: dnssec-importkey.@O@ ${OBJS} ${DEPLIBS}
- 	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ \
- 	dnssec-importkey.@O@ ${OBJS} ${LIBS}
- 
-diff --git a/bin/named-pkcs11/Makefile.in b/bin/named-pkcs11/Makefile.in
-index debb906..ecfdb6c 100644
--- a/bin/named-pkcs11/Makefile.in
-+++ b/bin/named-pkcs11/Makefile.in
-@@ -37,13 +37,14 @@ DBDRIVER_LIBS =
- 
- DLZ_DRIVER_DIR =	${top_srcdir}/contrib/dlz/drivers
- 
-DLZDRIVER_OBJS =	@DLZ_DRIVER_OBJS@
-DLZDRIVER_SRCS =	@DLZ_DRIVER_SRCS@
-DLZDRIVER_INCLUDES =	@DLZ_DRIVER_INCLUDES@
-DLZDRIVER_LIBS =	@DLZ_DRIVER_LIBS@
-+# Skip building on PKCS11 variant
-+DLZDRIVER_OBJS =
-+DLZDRIVER_SRCS =
-+DLZDRIVER_INCLUDES =
-+DLZDRIVER_LIBS =
- 
- CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include -I. \
-		${NS_INCLUDES} ${DNS_INCLUDES} \
-+		${NS_PKCS11_INCLUDES} ${DNS_PKCS11_INCLUDES} \
- 		${BIND9_INCLUDES} ${ISCCFG_INCLUDES} ${ISCCC_INCLUDES} \
- 		${ISC_INCLUDES} ${DLZDRIVER_INCLUDES} \
- 		${DBDRIVER_INCLUDES} \
-@@ -56,24 +57,24 @@ CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include -I. \
- 		${LIBXML2_CFLAGS} \
- 		${MAXMINDDB_CFLAGS}
- 
-CDEFINES =      @CONTRIB_DLZ@
-+CDEFINES =
- 
- CWARNINGS =
- 
-DNSLIBS =	../../lib/dns/libdns.@A@ @NO_LIBTOOL_DNSLIBS@
-+DNSLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@ @NO_LIBTOOL_DNSLIBS@
- ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
- ISCCCLIBS =	../../lib/isccc/libisccc.@A@
- ISCLIBS =	../../lib/isc/libisc.@A@ @NO_LIBTOOL_ISCLIBS@
- ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ @NO_LIBTOOL_ISCLIBS@
- BIND9LIBS =	../../lib/bind9/libbind9.@A@
-NSLIBS =	../../lib/ns/libns.@A@
-+NSLIBS =	../../lib/ns-pkcs11/libns-pkcs11.@A@
- 
-DNSDEPLIBS =	../../lib/dns/libdns.@A@
-+DNSDEPLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@
- ISCCFGDEPLIBS =	../../lib/isccfg/libisccfg.@A@
- ISCCCDEPLIBS =	../../lib/isccc/libisccc.@A@
- ISCDEPLIBS =	../../lib/isc/libisc.@A@
- BIND9DEPLIBS =	../../lib/bind9/libbind9.@A@
-NSDEPLIBS =	../../lib/ns/libns.@A@
-+NSDEPLIBS =	../../lib/ns-pkcs11/libns-pkcs11.@A@
- 
- DEPLIBS =	${NSDEPLIBS} ${DNSDEPLIBS} ${BIND9DEPLIBS} \
- 		${ISCCFGDEPLIBS} ${ISCCCDEPLIBS} ${ISCDEPLIBS}
-@@ -93,7 +94,7 @@ NOSYMLIBS =	${NSLIBS} ${DNSLIBS} ${BIND9LIBS} \
- 
- SUBDIRS =	unix
- 
-TARGETS =	named@EXEEXT@
-+TARGETS =	named-pkcs11@EXEEXT@
- 
- GEOIP2LINKOBJS = geoip.@O@
- 
-@@ -151,7 +152,7 @@ server.@O@: server.c
- 		-DPRODUCT=\"${PRODUCT}\" \
- 		-DVERSION=\"${VERSION}\" -c ${srcdir}/server.c
- 
-named@EXEEXT@: ${OBJS} ${DEPLIBS}
-+named-pkcs11@EXEEXT@: ${OBJS} ${DEPLIBS}
- 	export MAKE_SYMTABLE="yes"; \
- 	export BASEOBJS="${OBJS} ${UOBJS}"; \
- 	${FINALBUILDCMD}
-@@ -170,11 +171,11 @@ statschannel.@O@: bind9.xsl.h
- installdirs:
- 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${sbindir}
- 
-install:: named@EXEEXT@ installdirs
-	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} named@EXEEXT@ ${DESTDIR}${sbindir}
-+install:: named-pkcs11@EXEEXT@ installdirs
-+	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} named-pkcs11@EXEEXT@ ${DESTDIR}${sbindir}
- 
- uninstall::
-	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${sbindir}/named@EXEEXT@
-+	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${sbindir}/named-pkcs11@EXEEXT@
- 
- @DLZ_DRIVER_RULES@
- 
-diff --git a/configure.ac b/configure.ac
-index e405eaf..efaa5a7 100644
--- a/configure.ac
-+++ b/configure.ac
-@@ -1269,12 +1269,14 @@ AC_SUBST(USE_GSSAPI)
- AC_SUBST(DST_GSSAPI_INC)
- AC_SUBST(DNS_GSSAPI_LIBS)
- DNS_CRYPTO_LIBS="$DNS_GSSAPI_LIBS"
-+DNS_CRYPTO_PK11_LIBS="$DNS_GSSAPI_LIBS $DNS_CRYPTO_PK11_LIBS"
- 
- #
- # Applications linking with libdns also need to link with these libraries.
- #
- 
- AC_SUBST(DNS_CRYPTO_LIBS)
-+AC_SUBST(DNS_CRYPTO_PK11_LIBS)
- 
- #
- # was --with-lmdb specified?
-@@ -2345,6 +2347,8 @@ AC_SUBST(BIND9_DNS_BUILDINCLUDE)
- AC_SUBST(BIND9_NS_BUILDINCLUDE)
- AC_SUBST(BIND9_BIND9_BUILDINCLUDE)
- AC_SUBST(BIND9_IRS_BUILDINCLUDE)
-+AC_SUBST(BIND9_DNS_PKCS11_BUILDINCLUDE)
-+AC_SUBST(BIND9_NS_PKCS11_BUILDINCLUDE)
- if test "X$srcdir" != "X"; then
- 	BIND9_ISC_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/isc/include"
- 	BIND9_ISCCC_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/isccc/include"
-@@ -2353,6 +2357,8 @@ if test "X$srcdir" != "X"; then
- 	BIND9_NS_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/ns/include"
- 	BIND9_BIND9_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/bind9/include"
- 	BIND9_IRS_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/irs/include"
-+	BIND9_DNS_PKCS11_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/dns-pkcs11/include"
-+	BIND9_NS_PKCS11_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/ns-pkcs11/include"
- else
- 	BIND9_ISC_BUILDINCLUDE=""
- 	BIND9_ISCCC_BUILDINCLUDE=""
-@@ -2361,6 +2367,8 @@ else
- 	BIND9_NS_BUILDINCLUDE=""
- 	BIND9_BIND9_BUILDINCLUDE=""
- 	BIND9_IRS_BUILDINCLUDE=""
-+	BIND9_DNS_PKCS11_BUILDINCLUDE=""
-+	BIND9_NS_PKCS11_BUILDINCLUDE=""
- fi
- 
- AC_SUBST_FILE(BIND9_MAKE_INCLUDES)
-@@ -2816,8 +2824,11 @@ AC_CONFIG_FILES([
- 	bin/delv/Makefile
- 	bin/dig/Makefile
- 	bin/dnssec/Makefile
-+	bin/dnssec-pkcs11/Makefile
- 	bin/named/Makefile
- 	bin/named/unix/Makefile
-+	bin/named-pkcs11/Makefile
-+	bin/named-pkcs11/unix/Makefile
- 	bin/nsupdate/Makefile
- 	bin/pkcs11/Makefile
- 	bin/plugins/Makefile
-@@ -2879,6 +2890,10 @@ AC_CONFIG_FILES([
- 	lib/dns/include/dns/Makefile
- 	lib/dns/include/dst/Makefile
- 	lib/dns/tests/Makefile
-+	lib/dns-pkcs11/Makefile
-+	lib/dns-pkcs11/include/Makefile
-+	lib/dns-pkcs11/include/dns/Makefile
-+	lib/dns-pkcs11/include/dst/Makefile
- 	lib/irs/Makefile
- 	lib/irs/include/Makefile
- 	lib/irs/include/irs/Makefile
-@@ -2911,6 +2926,10 @@ AC_CONFIG_FILES([
- 	lib/ns/include/Makefile
- 	lib/ns/include/ns/Makefile
- 	lib/ns/tests/Makefile
-+	lib/ns-pkcs11/Makefile
-+	lib/ns-pkcs11/include/Makefile
-+	lib/ns-pkcs11/include/ns/Makefile
-+	lib/ns-pkcs11/tests/Makefile
- 	make/Makefile
- 	make/mkdep
- 	unit/unittest.sh
-diff --git a/lib/Makefile.in b/lib/Makefile.in
-index 833964e..058ba2f 100644
--- a/lib/Makefile.in
-+++ b/lib/Makefile.in
-@@ -15,7 +15,7 @@ top_srcdir =	@top_srcdir@
- # Attempt to disable parallel processing.
- .NOTPARALLEL:
- .NO_PARALLEL:
-SUBDIRS =	isc isccc dns ns isccfg bind9 irs
-+SUBDIRS =	isc isccc dns dns-pkcs11 ns ns-pkcs11 isccfg bind9 irs
- TARGETS =
- 
- @BIND9_MAKE_RULES@
-diff --git a/lib/dns-pkcs11/Makefile.in b/lib/dns-pkcs11/Makefile.in
-index 58bda3c..d6a45df 100644
--- a/lib/dns-pkcs11/Makefile.in
-+++ b/lib/dns-pkcs11/Makefile.in
-@@ -22,7 +22,7 @@ VERSION=@BIND9_VERSION@
- 
- @BIND9_MAKE_INCLUDES@
- 
-CINCLUDES =	-I. -I${top_srcdir}/lib/dns -Iinclude ${DNS_INCLUDES} \
-+CINCLUDES =	-I. -I${top_srcdir}/lib/dns-pkcs11 -Iinclude ${DNS_PKCS11_INCLUDES} \
- 		${ISC_INCLUDES} \
- 		${FSTRM_CFLAGS} \
- 		${OPENSSL_CFLAGS} @DST_GSSAPI_INC@ \
-@@ -32,7 +32,7 @@ CINCLUDES =	-I. -I${top_srcdir}/lib/dns -Iinclude ${DNS_INCLUDES} \
- 		${LMDB_CFLAGS} \
- 		${MAXMINDDB_CFLAGS}
- 
-CDEFINES =	@USE_GSSAPI@
-+CDEFINES =	@USE_GSSAPI@ @USE_PKCS11@
- 
- CWARNINGS =
- 
-@@ -135,15 +135,15 @@ version.@O@: version.c
- 		-DMAPAPI=\"${MAPAPI}\" \
- 		-c ${srcdir}/version.c
- 
-libdns.@SA@: ${OBJS}
-+libdns-pkcs11.@SA@: ${OBJS}
- 	${AR} ${ARFLAGS} $@ ${OBJS}
- 	${RANLIB} $@
- 
-libdns.la: ${OBJS}
-+libdns-pkcs11.la: ${OBJS}
- 	${LIBTOOL_MODE_LINK} \
-		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libdns.la -rpath ${libdir} \
-+		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libdns-pkcs11.la -rpath ${libdir} \
- 		-release "${VERSION}" \
-		${OBJS} ${ISCLIBS} @DNS_CRYPTO_LIBS@ ${LIBS}
-+		${OBJS} ${ISCLIBS} @DNS_CRYPTO_PK11_LIBS@ ${LIBS}
- 
- include: gen
- 	${MAKE} include/dns/enumtype.h
-@@ -174,22 +174,22 @@ gen: gen.c
- 	${BUILD_CPPFLAGS} ${BUILD_LDFLAGS} -o $@ ${srcdir}/gen.c \
- 	${BUILD_LIBS} ${LFS_LIBS}
- 
-timestamp: include libdns.@A@
-+timestamp: include libdns-pkcs11.@A@
- 	touch timestamp
- 
-testdirs: libdns.@A@
-+testdirs: libdns-pkcs11.@A@
- 
- installdirs:
- 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${libdir}
- 
- install:: timestamp installdirs
-	${LIBTOOL_MODE_INSTALL} ${INSTALL_LIBRARY} libdns.@A@ ${DESTDIR}${libdir}
-+	${LIBTOOL_MODE_INSTALL} ${INSTALL_LIBRARY} libdns-pkcs11.@A@ ${DESTDIR}${libdir}
- 
- uninstall::
-	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${libdir}/libdns.@A@
-+	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${libdir}/libdns-pkcs11.@A@
- 
- clean distclean::
-	rm -f libdns.@A@ timestamp
-+	rm -f libdns-pkcs11.@A@ timestamp
- 	rm -f gen code.h include/dns/enumtype.h include/dns/enumclass.h
- 	rm -f include/dns/rdatastruct.h
- 	rm -f dnstap.pb-c.c dnstap.pb-c.h
-diff --git a/lib/dns-pkcs11/tests/Makefile.in b/lib/dns-pkcs11/tests/Makefile.in
-index da91394..aadb73f 100644
--- a/lib/dns-pkcs11/tests/Makefile.in
-+++ b/lib/dns-pkcs11/tests/Makefile.in
-@@ -15,15 +15,15 @@ VERSION=@BIND9_VERSION@
- 
- @BIND9_MAKE_INCLUDES@
- 
-CINCLUDES =	-I. -Iinclude ${DNS_INCLUDES} ${ISC_INCLUDES} \
-+CINCLUDES =	-I. -Iinclude ${DNS_PKCS11_INCLUDES} ${ISC_INCLUDES} \
- 		${FSTRM_CFLAGS} ${OPENSSL_CFLAGS} \
- 		${PROTOBUF_C_CFLAGS} ${MAXMINDDB_CFLAGS} @CMOCKA_CFLAGS@
-CDEFINES =	-DTESTS="\"${top_builddir}/lib/dns/tests/\""
-+CDEFINES =	@USE_PKCS11@ -DTESTS="\"${top_builddir}/lib/dns-pkcs11/tests/\""
- 
- ISCLIBS =	../../isc/libisc.@A@ @NO_LIBTOOL_ISCLIBS@
- ISCDEPLIBS =	../../isc/libisc.@A@
-DNSLIBS =	../libdns.@A@ @NO_LIBTOOL_DNSLIBS@
-DNSDEPLIBS =	../libdns.@A@
-+DNSLIBS =	../libdns-pkcs11.@A@ @NO_LIBTOOL_DNSLIBS@
-+DNSDEPLIBS =	../libdns-pkcs11.@A@
- 
- LIBS =		@LIBS@ @CMOCKA_LIBS@
- 
-diff --git a/lib/ns-pkcs11/Makefile.in b/lib/ns-pkcs11/Makefile.in
-index bc683ce..7a9d2f2 100644
--- a/lib/ns-pkcs11/Makefile.in
-+++ b/lib/ns-pkcs11/Makefile.in
-@@ -16,12 +16,12 @@ VERSION=@BIND9_VERSION@
- 
- @BIND9_MAKE_INCLUDES@
- 
-CINCLUDES =	-I. -I${top_srcdir}/lib/ns -Iinclude \
-		${NS_INCLUDES} ${DNS_INCLUDES} ${ISC_INCLUDES} \
-+CINCLUDES =	-I. -I${top_srcdir}/lib/ns-pkcs11 -Iinclude \
-+		${NS_PKCS11_INCLUDES} ${DNS_PKCS11_INCLUDES} ${ISC_INCLUDES} \
- 		${OPENSSL_CFLAGS} @DST_GSSAPI_INC@ \
- 		${FSTRM_CFLAGS}
- 
-CDEFINES =	-DNAMED_PLUGINDIR=\"${plugindir}\"
-+CDEFINES =	@USE_PKCS11@ -DNAMED_PLUGINDIR=\"${plugindir}\"
- 
- CWARNINGS =
- 
-@@ -29,9 +29,9 @@ ISCLIBS =	../../lib/isc/libisc.@A@
- 
- ISCDEPLIBS =	../../lib/isc/libisc.@A@
- 
-DNSLIBS =	../../lib/dns/libdns.@A@ @NO_LIBTOOL_DNSLIBS@
-+DNSLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@ @NO_LIBTOOL_DNSLIBS@
- 
-DNSDEPLIBS =	../../lib/dns/libdns.@A@
-+DNSDEPLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@
- 
- LIBS =		@LIBS@
- 
-@@ -60,28 +60,28 @@ version.@O@: version.c
- 		-DMAJOR=\"${MAJOR}\" \
- 		-c ${srcdir}/version.c
- 
-libns.@SA@: ${OBJS}
-+libns-pkcs11.@SA@: ${OBJS}
- 	${AR} ${ARFLAGS} $@ ${OBJS}
- 	${RANLIB} $@
- 
-libns.la: ${OBJS}
-+libns-pkcs11.la: ${OBJS}
- 	${LIBTOOL_MODE_LINK} \
-		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libns.la -rpath ${libdir} \
-+		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libns-pkcs11.la -rpath ${libdir} \
- 		-release "${VERSION}" \
-		${OBJS} ${ISCLIBS} ${DNSLIBS} @DNS_CRYPTO_LIBS@ ${LIBS}
-+		${OBJS} ${ISCLIBS} ${DNSLIBS} @DNS_CRYPTO_PK11_LIBS@ ${LIBS}
- 
-timestamp: libns.@A@
-+timestamp: libns-pkcs11.@A@
- 	touch timestamp
- 
- installdirs:
- 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${libdir}
- 
- install:: timestamp installdirs
-	${LIBTOOL_MODE_INSTALL} ${INSTALL_LIBRARY} libns.@A@ \
-+	${LIBTOOL_MODE_INSTALL} ${INSTALL_LIBRARY} libns-pkcs11.@A@ \
- 		${DESTDIR}${libdir}
- 
- uninstall::
-	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${libdir}/libns.@A@
-+	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${libdir}/libns-pkcs11.@A@
- 
- clean distclean::
-	rm -f libns.@A@ timestamp
-+	rm -f libns-pkcs11.@A@ timestamp
-diff --git a/lib/ns-pkcs11/tests/Makefile.in b/lib/ns-pkcs11/tests/Makefile.in
-index 4c3e694..c1b6d99 100644
--- a/lib/ns-pkcs11/tests/Makefile.in
-+++ b/lib/ns-pkcs11/tests/Makefile.in
-@@ -17,17 +17,17 @@ VERSION=@BIND9_VERSION@
- 
- WRAP_OPTIONS =	-Wl,--wrap=isc__nmhandle_detach -Wl,--wrap=isc__nmhandle_attach
- 
-CINCLUDES =	-I. -Iinclude ${NS_INCLUDES} ${DNS_INCLUDES} ${ISC_INCLUDES} \
-+CINCLUDES =	-I. -Iinclude ${NS_PKCS11_INCLUDES} ${DNS_PKCS11_INCLUDES} ${ISC_INCLUDES} \
- 		${OPENSSL_CFLAGS} \
- 		@CMOCKA_CFLAGS@
-CDEFINES =	-DTESTS="\"${top_builddir}/lib/ns/tests/\"" -DNAMED_PLUGINDIR=\"${plugindir}\"
-+CDEFINES =	-DTESTS="\"${top_builddir}/lib/ns-pkcs11/tests/\"" -DNAMED_PLUGINDIR=\"${plugindir}\" @USE_PKCS11@
- 
- ISCLIBS =	../../isc/libisc.@A@ @NO_LIBTOOL_ISCLIBS@
- ISCDEPLIBS =	../../isc/libisc.@A@
-DNSLIBS =	../../dns/libdns.@A@ @NO_LIBTOOL_DNSLIBS@
-DNSDEPLIBS =	../../dns/libdns.@A@
-NSLIBS =	../libns.@A@
-NSDEPLIBS =	../libns.@A@
-+DNSLIBS =	../../dns-pkcs11/libdns-pkcs11.@A@ @NO_LIBTOOL_DNSLIBS@
-+DNSDEPLIBS =	../../dns-pkcs11/libdns-pkcs11.@A@
-+NSLIBS =	../libns-pkcs11.@A@
-+NSDEPLIBS =	../libns-pkcs11.@A@
- 
- LIBS =		@LIBS@ @CMOCKA_LIBS@
- 
-diff --git a/make/includes.in b/make/includes.in
-index b8317d3..b73b0c4 100644
--- a/make/includes.in
-+++ b/make/includes.in
-@@ -39,3 +39,10 @@ BIND9_INCLUDES = @BIND9_BIND9_BUILDINCLUDE@ \
- 
- TEST_INCLUDES = \
- 	-I${top_srcdir}/lib/tests/include
-+
-+DNS_PKCS11_INCLUDES = @BIND9_DNS_PKCS11_BUILDINCLUDE@ \
-+	-I${top_srcdir}/lib/dns-pkcs11/include
-+
-+NS_PKCS11_INCLUDES = @BIND9_NS_PKCS11_BUILDINCLUDE@ \
-+	-I${top_srcdir}/lib/ns-pkcs11/include
-+
-- 
-2.31.1
-
--- a/bind-9.11-fips-tests.patch
+++ b/bind-9.11-fips-tests.patch
@ -1,971 +0,0 @@
-From 9575852be2344244ac182d7d019869406d3bd963 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
-Date: Thu, 2 Aug 2018 23:46:45 +0200
-Subject: [PATCH] FIPS tests changes
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Squashed commit of the following:
-
-commit 09e5eb48698d4fef2fc1031870de86c553b6bfaa
-Author: Petr Menšík <pemensik@redhat.com>
-Date:   Wed Mar 7 20:35:13 2018 +0100
-
-    Fix nsupdate test. Do not use md5 by default for rndc, skip gracefully md5 if not available.
-
-commit ab303db70082db76ecf36493d0b82ef3e8750cad
-Author: Petr Menšík <pemensik@redhat.com>
-Date:   Wed Mar 7 18:11:10 2018 +0100
-
-    Changed root key to be RSASHA256
-
-    Change bad trusted key to be the same algorithm.
-
-commit 88ab07c0e14cc71247e1f9d11a1ea832b64c1ee8
-Author: Petr Menšík <pemensik@redhat.com>
-Date:   Wed Mar 7 16:56:17 2018 +0100
-
-    Change used key to not use hmac-md5
-
-    Fix upforwd test, do not use hmac-md5
-
-commit aec891571626f053acfb4d0a247240cbc21a84e9
-Author: Petr Menšík <pemensik@redhat.com>
-Date:   Wed Mar 7 15:54:11 2018 +0100
-
-    Increase bitsize of DSA key to pass FIPS 140-2 mode.
-
-commit bca8e164fa0d9aff2f946b8b4eb0f1f7e0bf6696
-Author: Petr Menšík <pemensik@redhat.com>
-Date:   Wed Mar 7 15:41:08 2018 +0100
-
-    Fix tsig and rndc tests for disabled md5
-
-    Use hmac-sha256 instead of hmac-md5.
-
-commit 0d314c1ab6151aa13574a21ad22f28d3b7f42a67
-Author: Petr Menšík <pemensik@redhat.com>
-Date:   Wed Mar 7 13:21:00 2018 +0100
-
-    Add md5 availability detection to featuretest
-
-commit f389a918803e2853e4b55fed62765dc4a492e34f
-Author: Petr Menšík <pemensik@redhat.com>
-Date:   Wed Mar 7 10:44:23 2018 +0100
-
-    Change tests to not use hmac-md5 algorithms if not required
-
-    Use hmac-sha256 instead of default hmac-md5 for allow-query
---
- bin/tests/system/acl/ns2/named1.conf.in       |  4 +-
- bin/tests/system/acl/ns2/named2.conf.in       |  4 +-
- bin/tests/system/acl/ns2/named3.conf.in       |  6 +-
- bin/tests/system/acl/ns2/named4.conf.in       |  4 +-
- bin/tests/system/acl/ns2/named5.conf.in       |  4 +-
- bin/tests/system/acl/tests.sh                 | 32 ++++-----
- .../system/allow-query/ns2/named10.conf.in    |  2 +-
- .../system/allow-query/ns2/named11.conf.in    |  4 +-
- .../system/allow-query/ns2/named12.conf.in    |  2 +-
- .../system/allow-query/ns2/named30.conf.in    |  2 +-
- .../system/allow-query/ns2/named31.conf.in    |  4 +-
- .../system/allow-query/ns2/named32.conf.in    |  2 +-
- .../system/allow-query/ns2/named40.conf.in    |  4 +-
- bin/tests/system/allow-query/tests.sh         | 18 ++---
- bin/tests/system/catz/ns1/named.conf.in       |  2 +-
- bin/tests/system/catz/ns2/named1.conf.in      |  2 +-
- bin/tests/system/catz/ns2/named2.conf.in      |  2 +-
- bin/tests/system/checkconf/bad-tsig.conf      |  2 +-
- bin/tests/system/checkconf/good.conf          |  2 +-
- bin/tests/system/feature-test.c               | 14 ++++
- bin/tests/system/notify/ns5/named.conf.in     |  6 +-
- bin/tests/system/notify/tests.sh              |  6 +-
- bin/tests/system/nsupdate/ns1/named.conf.in   |  2 +-
- bin/tests/system/nsupdate/ns2/named.conf.in   |  2 +-
- bin/tests/system/nsupdate/setup.sh            |  6 +-
- bin/tests/system/nsupdate/tests.sh            | 15 +++--
- bin/tests/system/rndc/setup.sh                |  2 +-
- bin/tests/system/rndc/tests.sh                | 23 ++++---
- bin/tests/system/tsig/ns1/named.conf.in       | 10 +--
- bin/tests/system/tsig/ns1/rndc5.conf.in       | 10 +++
- bin/tests/system/tsig/setup.sh                |  5 ++
- bin/tests/system/tsig/tests.sh                | 65 ++++++++++++-------
- bin/tests/system/upforwd/ns1/named.conf.in    |  2 +-
- bin/tests/system/upforwd/tests.sh             |  2 +-
- 34 files changed, 163 insertions(+), 109 deletions(-)
- create mode 100644 bin/tests/system/tsig/ns1/rndc5.conf.in
-
-diff --git a/bin/tests/system/acl/ns2/named1.conf.in b/bin/tests/system/acl/ns2/named1.conf.in
-index 60f22e1..249f672 100644
--- a/bin/tests/system/acl/ns2/named1.conf.in
-+++ b/bin/tests/system/acl/ns2/named1.conf.in
-@@ -33,12 +33,12 @@ options {
- };
- 
- key one {
-	algorithm hmac-md5;
-+	algorithm hmac-sha256;
- 	secret "1234abcd8765";
- };
- 
- key two {
-	algorithm hmac-md5;
-+	algorithm hmac-sha256;
- 	secret "1234abcd8765";
- };
- 
-diff --git a/bin/tests/system/acl/ns2/named2.conf.in b/bin/tests/system/acl/ns2/named2.conf.in
-index ada97bc..f82d858 100644
--- a/bin/tests/system/acl/ns2/named2.conf.in
-+++ b/bin/tests/system/acl/ns2/named2.conf.in
-@@ -33,12 +33,12 @@ options {
- };
- 
- key one {
-	algorithm hmac-md5;
-+	algorithm hmac-sha256;
- 	secret "1234abcd8765";
- };
- 
- key two {
-	algorithm hmac-md5;
-+	algorithm hmac-sha256;
- 	secret "1234abcd8765";
- };
- 
-diff --git a/bin/tests/system/acl/ns2/named3.conf.in b/bin/tests/system/acl/ns2/named3.conf.in
-index 97684e4..de6a2e9 100644
--- a/bin/tests/system/acl/ns2/named3.conf.in
-+++ b/bin/tests/system/acl/ns2/named3.conf.in
-@@ -33,17 +33,17 @@ options {
- };
- 
- key one {
-	algorithm hmac-md5;
-+	algorithm hmac-sha256;
- 	secret "1234abcd8765";
- };
- 
- key two {
-	algorithm hmac-md5;
-+	algorithm hmac-sha256;
- 	secret "1234abcd8765";
- };
- 
- key three {
-	algorithm hmac-md5;
-+	algorithm hmac-sha256;
- 	secret "1234abcd8765";
- };
- 
-diff --git a/bin/tests/system/acl/ns2/named4.conf.in b/bin/tests/system/acl/ns2/named4.conf.in
-index 462b3fa..994b35c 100644
--- a/bin/tests/system/acl/ns2/named4.conf.in
-+++ b/bin/tests/system/acl/ns2/named4.conf.in
-@@ -33,12 +33,12 @@ options {
- };
- 
- key one {
-	algorithm hmac-md5;
-+	algorithm hmac-sha256;
- 	secret "1234abcd8765";
- };
- 
- key two {
-	algorithm hmac-md5;
-+	algorithm hmac-sha256;
- 	secret "1234abcd8765";
- };
- 
-diff --git a/bin/tests/system/acl/ns2/named5.conf.in b/bin/tests/system/acl/ns2/named5.conf.in
-index 728da58..8f00d09 100644
--- a/bin/tests/system/acl/ns2/named5.conf.in
-+++ b/bin/tests/system/acl/ns2/named5.conf.in
-@@ -35,12 +35,12 @@ options {
- };
- 
- key one {
-	algorithm hmac-md5;
-+	algorithm hmac-sha256;
- 	secret "1234abcd8765";
- };
- 
- key two {
-	algorithm hmac-md5;
-+	algorithm hmac-sha256;
- 	secret "1234abcd8765";
- };
- 
-diff --git a/bin/tests/system/acl/tests.sh b/bin/tests/system/acl/tests.sh
-index be59d64..13d5bdc 100644
--- a/bin/tests/system/acl/tests.sh
-+++ b/bin/tests/system/acl/tests.sh
-@@ -22,14 +22,14 @@ echo_i "testing basic ACL processing"
- # key "one" should fail
- t=`expr $t + 1`
- $DIG $DIGOPTS tsigzone. \
-	@10.53.0.2 -b 10.53.0.1 axfr -y one:1234abcd8765 > dig.out.${t}
-+	@10.53.0.2 -b 10.53.0.1 axfr -y hmac-sha256:one:1234abcd8765 > dig.out.${t}
- grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }
- 
- 
- # any other key should be fine
- t=`expr $t + 1`
- $DIG $DIGOPTS tsigzone. \
-	@10.53.0.2 -b 10.53.0.1 axfr -y two:1234abcd8765 > dig.out.${t}
-+	@10.53.0.2 -b 10.53.0.1 axfr -y hmac-sha256:two:1234abcd8765 > dig.out.${t}
- grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }
- 
- copy_setports ns2/named2.conf.in ns2/named.conf
-@@ -39,18 +39,18 @@ sleep 5
- # prefix 10/8 should fail
- t=`expr $t + 1`
- $DIG $DIGOPTS tsigzone. \
-	@10.53.0.2 -b 10.53.0.1 axfr -y one:1234abcd8765 > dig.out.${t}
-+	@10.53.0.2 -b 10.53.0.1 axfr -y hmac-sha256:one:1234abcd8765 > dig.out.${t}
- grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }
- 
- # any other address should work, as long as it sends key "one"
- t=`expr $t + 1`
- $DIG $DIGOPTS tsigzone. \
-	@10.53.0.2 -b 127.0.0.1 axfr -y two:1234abcd8765 > dig.out.${t}
-+	@10.53.0.2 -b 127.0.0.1 axfr -y hmac-sha256:two:1234abcd8765 > dig.out.${t}
- grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }
- 
- t=`expr $t + 1`
- $DIG $DIGOPTS tsigzone. \
-	@10.53.0.2 -b 127.0.0.1 axfr -y one:1234abcd8765 > dig.out.${t}
-+	@10.53.0.2 -b 127.0.0.1 axfr -y hmac-sha256:one:1234abcd8765 > dig.out.${t}
- grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }
- 
- echo_i "testing nested ACL processing"
-@@ -62,31 +62,31 @@ sleep 5
- # should succeed
- t=`expr $t + 1`
- $DIG $DIGOPTS tsigzone. \
-	@10.53.0.2 -b 10.53.0.2 axfr -y two:1234abcd8765 > dig.out.${t}
-+	@10.53.0.2 -b 10.53.0.2 axfr -y hmac-sha256:two:1234abcd8765 > dig.out.${t}
- grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }
- 
- # should succeed
- t=`expr $t + 1`
- $DIG $DIGOPTS tsigzone. \
-	@10.53.0.2 -b 10.53.0.2 axfr -y one:1234abcd8765 > dig.out.${t}
-+	@10.53.0.2 -b 10.53.0.2 axfr -y hmac-sha256:one:1234abcd8765 > dig.out.${t}
- grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }
- 
- # should succeed
- t=`expr $t + 1`
- $DIG $DIGOPTS tsigzone. \
-	@10.53.0.2 -b 10.53.0.1 axfr -y two:1234abcd8765 > dig.out.${t}
-+	@10.53.0.2 -b 10.53.0.1 axfr -y hmac-sha256:two:1234abcd8765 > dig.out.${t}
- grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }
- 
- # should succeed
- t=`expr $t + 1`
- $DIG $DIGOPTS tsigzone. \
-	@10.53.0.2 -b 10.53.0.1 axfr -y two:1234abcd8765 > dig.out.${t}
-+	@10.53.0.2 -b 10.53.0.1 axfr -y hmac-sha256:two:1234abcd8765 > dig.out.${t}
- grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }
- 
- # but only one or the other should fail
- t=`expr $t + 1`
- $DIG $DIGOPTS tsigzone. \
-	@10.53.0.2 -b 127.0.0.1 axfr -y one:1234abcd8765 > dig.out.${t}
-+	@10.53.0.2 -b 127.0.0.1 axfr -y hmac-sha256:one:1234abcd8765 > dig.out.${t}
- grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }
- 
- t=`expr $t + 1`
-@@ -97,7 +97,7 @@ grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $tt failed" ; status=1
- # and other values? right out
- t=`expr $t + 1`
- $DIG $DIGOPTS tsigzone. \
-	@10.53.0.2 -b 127.0.0.1 axfr -y three:1234abcd8765 > dig.out.${t}
-+	@10.53.0.2 -b 127.0.0.1 axfr -y hmac-sha256:three:1234abcd8765 > dig.out.${t}
- grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }
- 
- # now we only allow 10.53.0.1 *and* key one, or 10.53.0.2 *and* key two
-@@ -108,31 +108,31 @@ sleep 5
- # should succeed
- t=`expr $t + 1`
- $DIG $DIGOPTS tsigzone. \
-	@10.53.0.2 -b 10.53.0.2 axfr -y two:1234abcd8765 > dig.out.${t}
-+	@10.53.0.2 -b 10.53.0.2 axfr -y hmac-sha256:two:1234abcd8765 > dig.out.${t}
- grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }
- 
- # should succeed
- t=`expr $t + 1`
- $DIG $DIGOPTS tsigzone. \
-	@10.53.0.2 -b 10.53.0.1 axfr -y one:1234abcd8765 > dig.out.${t}
-+	@10.53.0.2 -b 10.53.0.1 axfr -y hmac-sha256:one:1234abcd8765 > dig.out.${t}
- grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }
- 
- # should fail
- t=`expr $t + 1`
- $DIG $DIGOPTS tsigzone. \
-	@10.53.0.2 -b 10.53.0.2 axfr -y one:1234abcd8765 > dig.out.${t}
-+	@10.53.0.2 -b 10.53.0.2 axfr -y hmac-sha256:one:1234abcd8765 > dig.out.${t}
- grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }
- 
- # should fail
- t=`expr $t + 1`
- $DIG $DIGOPTS tsigzone. \
-	@10.53.0.2 -b 10.53.0.1 axfr -y two:1234abcd8765 > dig.out.${t}
-+	@10.53.0.2 -b 10.53.0.1 axfr -y hmac-sha256:two:1234abcd8765 > dig.out.${t}
- grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }
- 
- # should fail
- t=`expr $t + 1`
- $DIG $DIGOPTS tsigzone. \
-	@10.53.0.2 -b 10.53.0.3 axfr -y one:1234abcd8765 > dig.out.${t}
-+	@10.53.0.2 -b 10.53.0.3 axfr -y hmac-sha256:one:1234abcd8765 > dig.out.${t}
- grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }
- 
- echo_i "testing allow-query-on ACL processing"
-diff --git a/bin/tests/system/allow-query/ns2/named10.conf.in b/bin/tests/system/allow-query/ns2/named10.conf.in
-index 7d43e36..f7b25f9 100644
--- a/bin/tests/system/allow-query/ns2/named10.conf.in
-+++ b/bin/tests/system/allow-query/ns2/named10.conf.in
-@@ -10,7 +10,7 @@
-  */
- 
- key one {
-	algorithm hmac-md5;
-+	algorithm hmac-sha256;
- 	secret "1234abcd8765";
- };
- 
-diff --git a/bin/tests/system/allow-query/ns2/named11.conf.in b/bin/tests/system/allow-query/ns2/named11.conf.in
-index 2952518..121557e 100644
--- a/bin/tests/system/allow-query/ns2/named11.conf.in
-+++ b/bin/tests/system/allow-query/ns2/named11.conf.in
-@@ -10,12 +10,12 @@
-  */
- 
- key one {
-	algorithm hmac-md5;
-+	algorithm hmac-sha256;
- 	secret "1234abcd8765";
- };
- 
- key two {
-	algorithm hmac-md5;
-+	algorithm hmac-sha256;
- 	secret "1234efgh8765";
- };
- 
-diff --git a/bin/tests/system/allow-query/ns2/named12.conf.in b/bin/tests/system/allow-query/ns2/named12.conf.in
-index 0c01071..ceabbb5 100644
--- a/bin/tests/system/allow-query/ns2/named12.conf.in
-+++ b/bin/tests/system/allow-query/ns2/named12.conf.in
-@@ -10,7 +10,7 @@
-  */
- 
- key one {
-	algorithm hmac-md5;
-+	algorithm hmac-sha256;
- 	secret "1234abcd8765";
- };
- 
-diff --git a/bin/tests/system/allow-query/ns2/named30.conf.in b/bin/tests/system/allow-query/ns2/named30.conf.in
-index 4c17292..9cd9d1f 100644
--- a/bin/tests/system/allow-query/ns2/named30.conf.in
-+++ b/bin/tests/system/allow-query/ns2/named30.conf.in
-@@ -10,7 +10,7 @@
-  */
- 
- key one {
-	algorithm hmac-md5;
-+	algorithm hmac-sha256;
- 	secret "1234abcd8765";
- };
- 
-diff --git a/bin/tests/system/allow-query/ns2/named31.conf.in b/bin/tests/system/allow-query/ns2/named31.conf.in
-index a2690a4..f488730 100644
--- a/bin/tests/system/allow-query/ns2/named31.conf.in
-+++ b/bin/tests/system/allow-query/ns2/named31.conf.in
-@@ -10,12 +10,12 @@
-  */
- 
- key one {
-	algorithm hmac-md5;
-+	algorithm hmac-sha256;
- 	secret "1234abcd8765";
- };
- 
- key two {
-	algorithm hmac-md5;
-+	algorithm hmac-sha256;
- 	secret "1234efgh8765";
- };
- 
-diff --git a/bin/tests/system/allow-query/ns2/named32.conf.in b/bin/tests/system/allow-query/ns2/named32.conf.in
-index a0708c8..51fa457 100644
--- a/bin/tests/system/allow-query/ns2/named32.conf.in
-+++ b/bin/tests/system/allow-query/ns2/named32.conf.in
-@@ -10,7 +10,7 @@
-  */
- 
- key one {
-	algorithm hmac-md5;
-+	algorithm hmac-sha256;
- 	secret "1234abcd8765";
- };
- 
-diff --git a/bin/tests/system/allow-query/ns2/named40.conf.in b/bin/tests/system/allow-query/ns2/named40.conf.in
-index 687768e..d24d6d2 100644
--- a/bin/tests/system/allow-query/ns2/named40.conf.in
-+++ b/bin/tests/system/allow-query/ns2/named40.conf.in
-@@ -14,12 +14,12 @@ acl accept { 10.53.0.2; };
- acl badaccept { 10.53.0.1; };
- 
- key one {
-	algorithm hmac-md5;
-+	algorithm hmac-sha256;
- 	secret "1234abcd8765";
- };
- 
- key two {
-	algorithm hmac-md5;
-+	algorithm hmac-sha256;
- 	secret "1234efgh8765";
- };
- 
-diff --git a/bin/tests/system/allow-query/tests.sh b/bin/tests/system/allow-query/tests.sh
-index fe40635..543c663 100644
--- a/bin/tests/system/allow-query/tests.sh
-+++ b/bin/tests/system/allow-query/tests.sh
-@@ -182,7 +182,7 @@ rndc_reload ns2 10.53.0.2
- 
- echo_i "test $n: key allowed - query allowed"
- ret=0
-$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1
-+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1
- grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1
- grep '^a.normal.example' dig.out.ns2.$n > /dev/null || ret=1
- if [ $ret != 0 ]; then echo_i "failed"; fi
-@@ -195,7 +195,7 @@ rndc_reload ns2 10.53.0.2
- 
- echo_i "test $n: key not allowed - query refused"
- ret=0
-$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y two:1234efgh8765 a.normal.example a > dig.out.ns2.$n || ret=1
-+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:two:1234efgh8765 a.normal.example a > dig.out.ns2.$n || ret=1
- grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
- grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1
- if [ $ret != 0 ]; then echo_i "failed"; fi
-@@ -208,7 +208,7 @@ rndc_reload ns2 10.53.0.2
- 
- echo_i "test $n: key disallowed - query refused"
- ret=0
-$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1
-+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1
- grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
- grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1
- if [ $ret != 0 ]; then echo_i "failed"; fi
-@@ -341,7 +341,7 @@ rndc_reload ns2 10.53.0.2
- 
- echo_i "test $n: views key allowed - query allowed"
- ret=0
-$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1
-+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1
- grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1
- grep '^a.normal.example' dig.out.ns2.$n > /dev/null || ret=1
- if [ $ret != 0 ]; then echo_i "failed"; fi
-@@ -354,7 +354,7 @@ rndc_reload ns2 10.53.0.2
- 
- echo_i "test $n: views key not allowed - query refused"
- ret=0
-$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y two:1234efgh8765 a.normal.example a > dig.out.ns2.$n || ret=1
-+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:two:1234efgh8765 a.normal.example a > dig.out.ns2.$n || ret=1
- grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
- grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1
- if [ $ret != 0 ]; then echo_i "failed"; fi
-@@ -367,7 +367,7 @@ rndc_reload ns2 10.53.0.2
- 
- echo_i "test $n: views key disallowed - query refused"
- ret=0
-$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1
-+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1
- grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
- grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1
- if [ $ret != 0 ]; then echo_i "failed"; fi
-@@ -500,7 +500,7 @@ status=`expr $status + $ret`
- n=`expr $n + 1`
- echo_i "test $n: zone key allowed - query allowed"
- ret=0
-$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.keyallow.example a > dig.out.ns2.$n || ret=1
-+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:one:1234abcd8765 a.keyallow.example a > dig.out.ns2.$n || ret=1
- grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1
- grep '^a.keyallow.example' dig.out.ns2.$n > /dev/null || ret=1
- if [ $ret != 0 ]; then echo_i "failed"; fi
-@@ -510,7 +510,7 @@ status=`expr $status + $ret`
- n=`expr $n + 1`
- echo_i "test $n: zone key not allowed - query refused"
- ret=0
-$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y two:1234efgh8765 a.keyallow.example a > dig.out.ns2.$n || ret=1
-+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:two:1234efgh8765 a.keyallow.example a > dig.out.ns2.$n || ret=1
- grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
- grep '^a.keyallow.example' dig.out.ns2.$n > /dev/null && ret=1
- if [ $ret != 0 ]; then echo_i "failed"; fi
-@@ -520,7 +520,7 @@ status=`expr $status + $ret`
- n=`expr $n + 1`
- echo_i "test $n: zone key disallowed - query refused"
- ret=0
-$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.keydisallow.example a > dig.out.ns2.$n || ret=1
-+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:one:1234abcd8765 a.keydisallow.example a > dig.out.ns2.$n || ret=1
- grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
- grep '^a.keydisallow.example' dig.out.ns2.$n > /dev/null && ret=1
- if [ $ret != 0 ]; then echo_i "failed"; fi
-diff --git a/bin/tests/system/catz/ns1/named.conf.in b/bin/tests/system/catz/ns1/named.conf.in
-index 1218669..e62715e 100644
--- a/bin/tests/system/catz/ns1/named.conf.in
-+++ b/bin/tests/system/catz/ns1/named.conf.in
-@@ -61,5 +61,5 @@ zone "catalog4.example" {
- 
- key tsig_key. {
- 	secret "LSAnCU+Z";
-	algorithm hmac-md5;
-+	algorithm hmac-sha256;
- };
-diff --git a/bin/tests/system/catz/ns2/named1.conf.in b/bin/tests/system/catz/ns2/named1.conf.in
-index 30333e6..4005152 100644
--- a/bin/tests/system/catz/ns2/named1.conf.in
-+++ b/bin/tests/system/catz/ns2/named1.conf.in
-@@ -70,5 +70,5 @@ zone "catalog4.example" {
- 
- key tsig_key. {
- 	secret "LSAnCU+Z";
-	algorithm hmac-md5;
-+	algorithm hmac-sha256;
- };
-diff --git a/bin/tests/system/catz/ns2/named2.conf.in b/bin/tests/system/catz/ns2/named2.conf.in
-index fcd99ca..84c97ca 100644
--- a/bin/tests/system/catz/ns2/named2.conf.in
-+++ b/bin/tests/system/catz/ns2/named2.conf.in
-@@ -56,5 +56,5 @@ zone "catalog4.example" {
- 
- key tsig_key. {
- 	secret "LSAnCU+Z";
-	algorithm hmac-md5;
-+	algorithm hmac-sha256;
- };
-diff --git a/bin/tests/system/checkconf/bad-tsig.conf b/bin/tests/system/checkconf/bad-tsig.conf
-index 21be03e..e57c308 100644
--- a/bin/tests/system/checkconf/bad-tsig.conf
-+++ b/bin/tests/system/checkconf/bad-tsig.conf
-@@ -11,7 +11,7 @@
- 
- /* Bad secret */
- key "badtsig" {
-	algorithm hmac-md5;
-+	algorithm hmac-sha256;
- 	secret "jEdD+BPKg==";
- };
- 
-diff --git a/bin/tests/system/checkconf/good.conf b/bin/tests/system/checkconf/good.conf
-index 616a544..e3a59a5 100644
--- a/bin/tests/system/checkconf/good.conf
-+++ b/bin/tests/system/checkconf/good.conf
-@@ -268,6 +268,6 @@ dyndb "name" "library.so" {
- 	system;
- };
- key "mykey" {
-	algorithm "hmac-md5";
-+	algorithm "hmac-sha256";
- 	secret "qwertyuiopasdfgh";
- };
-diff --git a/bin/tests/system/feature-test.c b/bin/tests/system/feature-test.c
-index 877504f..577660a 100644
--- a/bin/tests/system/feature-test.c
-+++ b/bin/tests/system/feature-test.c
-@@ -14,6 +14,7 @@
- #include <string.h>
- #include <unistd.h>
- 
-+#include <isc/md.h>
- #include <isc/net.h>
- #include <isc/print.h>
- #include <isc/util.h>
-@@ -186,6 +187,19 @@ main(int argc, char **argv) {
- #endif /* ifdef DLZ_FILESYSTEM */
- 	}
- 
-+	if (strcmp(argv[1], "--md5") == 0) {
-+		unsigned char digest[ISC_MAX_MD_SIZE];
-+		const unsigned char test[] = "test";
-+		unsigned int size = sizeof(digest);
-+
-+		if (isc_md(ISC_MD_MD5, test, sizeof(test),
-+		           digest, &size) == ISC_R_SUCCESS) {
-+			return (0);
-+		} else {
-+			return (1);
-+		}
-+	}
-+
- 	if (strcmp(argv[1], "--with-idn") == 0) {
- #ifdef HAVE_LIBIDN2
- 		return (0);
-diff --git a/bin/tests/system/notify/ns5/named.conf.in b/bin/tests/system/notify/ns5/named.conf.in
-index 1ee8df4..2b75d9a 100644
--- a/bin/tests/system/notify/ns5/named.conf.in
-+++ b/bin/tests/system/notify/ns5/named.conf.in
-@@ -10,17 +10,17 @@
-  */
- 
- key "a" {
-	algorithm "hmac-md5";
-+	algorithm "hmac-sha256";
- 	secret "aaaaaaaaaaaaaaaaaaaa";
- };
- 
- key "b" {
-	algorithm "hmac-md5";
-+	algorithm "hmac-sha256";
- 	secret "bbbbbbbbbbbbbbbbbbbb";
- };
- 
- key "c" {
-	algorithm "hmac-md5";
-+	algorithm "hmac-sha256";
- 	secret "cccccccccccccccccccc";
- };
- 
-diff --git a/bin/tests/system/notify/tests.sh b/bin/tests/system/notify/tests.sh
-index 3d7e0b7..ec4d9a7 100644
--- a/bin/tests/system/notify/tests.sh
-+++ b/bin/tests/system/notify/tests.sh
-@@ -212,16 +212,16 @@ ret=0
- $NSUPDATE << EOF
- server 10.53.0.5 ${PORT}
- zone x21
-key a aaaaaaaaaaaaaaaaaaaa
-+key hmac-sha256:a aaaaaaaaaaaaaaaaaaaa
- update add added.x21 0 in txt "test string"
- send
- EOF
- 
- for i in 1 2 3 4 5 6 7 8 9
- do
-	$DIG $DIGOPTS added.x21. -y b:bbbbbbbbbbbbbbbbbbbb @10.53.0.5 \
-+	$DIG $DIGOPTS added.x21. -y hmac-sha256:b:bbbbbbbbbbbbbbbbbbbb @10.53.0.5 \
- 		txt > dig.out.b.ns5.test$n || ret=1
-	$DIG $DIGOPTS added.x21. -y c:cccccccccccccccccccc @10.53.0.5 \
-+	$DIG $DIGOPTS added.x21. -y hmac-sha256:c:cccccccccccccccccccc @10.53.0.5 \
- 		txt > dig.out.c.ns5.test$n || ret=1
- 	grep "test string" dig.out.b.ns5.test$n > /dev/null &&
- 	grep "test string" dig.out.c.ns5.test$n > /dev/null &&
-diff --git a/bin/tests/system/nsupdate/ns1/named.conf.in b/bin/tests/system/nsupdate/ns1/named.conf.in
-index b51e700..436c97d 100644
--- a/bin/tests/system/nsupdate/ns1/named.conf.in
-+++ b/bin/tests/system/nsupdate/ns1/named.conf.in
-@@ -37,7 +37,7 @@ controls {
- };
- 
- key altkey {
-	algorithm hmac-md5;
-+	algorithm hmac-sha512;
- 	secret "1234abcd8765";
- };
- 
-diff --git a/bin/tests/system/nsupdate/ns2/named.conf.in b/bin/tests/system/nsupdate/ns2/named.conf.in
-index da6b3b4..c547e47 100644
--- a/bin/tests/system/nsupdate/ns2/named.conf.in
-+++ b/bin/tests/system/nsupdate/ns2/named.conf.in
-@@ -32,7 +32,7 @@ controls {
- };
- 
- key altkey {
-	algorithm hmac-md5;
-+	algorithm hmac-sha512;
- 	secret "1234abcd8765";
- };
- 
-diff --git a/bin/tests/system/nsupdate/setup.sh b/bin/tests/system/nsupdate/setup.sh
-index 5593a2e..7cd1a74 100644
--- a/bin/tests/system/nsupdate/setup.sh
-+++ b/bin/tests/system/nsupdate/setup.sh
-@@ -71,7 +71,11 @@ EOF
- 
- $DDNSCONFGEN -q -z example.nil > ns1/ddns.key
- 
-$DDNSCONFGEN -q -a hmac-md5 -k md5-key -z keytests.nil > ns1/md5.key
-+if $FEATURETEST --md5; then
-+	$DDNSCONFGEN -q -a hmac-md5 -k md5-key -z keytests.nil > ns1/md5.key
-+else
-+	echo -n > ns1/md5.key
-+fi
- $DDNSCONFGEN -q -a hmac-sha1 -k sha1-key -z keytests.nil > ns1/sha1.key
- $DDNSCONFGEN -q -a hmac-sha224 -k sha224-key -z keytests.nil > ns1/sha224.key
- $DDNSCONFGEN -q -a hmac-sha256 -k sha256-key -z keytests.nil > ns1/sha256.key
-diff --git a/bin/tests/system/nsupdate/tests.sh b/bin/tests/system/nsupdate/tests.sh
-index 8839131..fde6135 100755
--- a/bin/tests/system/nsupdate/tests.sh
-+++ b/bin/tests/system/nsupdate/tests.sh
-@@ -824,7 +824,14 @@ fi
- n=`expr $n + 1`
- ret=0
- echo_i "check TSIG key algorithms (nsupdate -k) ($n)"
-for alg in md5 sha1 sha224 sha256 sha384 sha512; do
-+if $FEATURETEST --md5
-+then
-+	ALGS="md5 sha1 sha224 sha256 sha384 sha512"
-+else
-+	ALGS="sha1 sha224 sha256 sha384 sha512"
-+	echo_i "skipping disabled md5 algorithm"
-+fi
-+for alg in $ALGS; do
-     $NSUPDATE -k ns1/${alg}.key <<END > /dev/null || ret=1
- server 10.53.0.1 ${PORT}
- update add ${alg}.keytests.nil. 600 A 10.10.10.3
-@@ -832,7 +839,7 @@ send
- END
- done
- sleep 2
-for alg in md5 sha1 sha224 sha256 sha384 sha512; do
-+for alg in $ALGS; do
-     $DIG $DIGOPTS +short @10.53.0.1 ${alg}.keytests.nil | grep 10.10.10.3 > /dev/null 2>&1 || ret=1
- done
- if [ $ret -ne 0 ]; then
-@@ -843,7 +850,7 @@ fi
- n=`expr $n + 1`
- ret=0
- echo_i "check TSIG key algorithms (nsupdate -y) ($n)"
-for alg in md5 sha1 sha224 sha256 sha384 sha512; do
-+for alg in $ALGS; do
-     secret=$(sed -n 's/.*secret "\(.*\)";.*/\1/p' ns1/${alg}.key)
-     $NSUPDATE -y "hmac-${alg}:${alg}-key:$secret" <<END > /dev/null || ret=1
- server 10.53.0.1 ${PORT}
-@@ -852,7 +859,7 @@ send
- END
- done
- sleep 2
-for alg in md5 sha1 sha224 sha256 sha384 sha512; do
-+for alg in $ALGS; do
-     $DIG $DIGOPTS +short @10.53.0.1 ${alg}.keytests.nil | grep 10.10.10.50 > /dev/null 2>&1 || ret=1
- done
- if [ $ret -ne 0 ]; then
-diff --git a/bin/tests/system/rndc/setup.sh b/bin/tests/system/rndc/setup.sh
-index 225722f..63ac938 100644
--- a/bin/tests/system/rndc/setup.sh
-+++ b/bin/tests/system/rndc/setup.sh
-@@ -38,7 +38,7 @@ make_key () {
-             sed 's/allow { 10.53.0.4/allow { any/' >> ns4/named.conf
- }
- 
-make_key 1 ${EXTRAPORT1} hmac-md5
-+$FEATURETEST --md5 && make_key 1 ${EXTRAPORT1} hmac-md5
- make_key 2 ${EXTRAPORT2} hmac-sha1
- make_key 3 ${EXTRAPORT3} hmac-sha224
- make_key 4 ${EXTRAPORT4} hmac-sha256
-diff --git a/bin/tests/system/rndc/tests.sh b/bin/tests/system/rndc/tests.sh
-index 9bf86c6..b8a7a1f 100644
--- a/bin/tests/system/rndc/tests.sh
-+++ b/bin/tests/system/rndc/tests.sh
-@@ -349,15 +349,20 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
- status=`expr $status + $ret`
- 
- n=`expr $n + 1`
-echo_i "testing rndc with hmac-md5 ($n)"
-ret=0
-$RNDC -s 10.53.0.4 -p ${EXTRAPORT1} -c ns4/key1.conf status > /dev/null 2>&1 || ret=1
-for i in 2 3 4 5 6
-do
-        $RNDC -s 10.53.0.4 -p ${EXTRAPORT1} -c ns4/key${i}.conf status > /dev/null 2>&1 && ret=1
-done
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-+if $FEATURETEST --md5
-+then
-+	echo_i "testing rndc with hmac-md5 ($n)"
-+	ret=0
-+	$RNDC -s 10.53.0.4 -p ${EXTRAPORT1} -c ns4/key1.conf status > /dev/null 2>&1 || ret=1
-+	for i in 2 3 4 5 6
-+	do
-+		$RNDC -s 10.53.0.4 -p ${EXTRAPORT1} -c ns4/key${i}.conf status > /dev/null 2>&1 && ret=1
-+	done
-+	if [ $ret != 0 ]; then echo_i "failed"; fi
-+	status=`expr $status + $ret`
-+else
-+	echo_i "skipping rndc with hmac-md5 ($n)"
-+fi
- 
- n=`expr $n + 1`
- echo_i "testing rndc with hmac-sha1 ($n)"
-diff --git a/bin/tests/system/tsig/ns1/named.conf.in b/bin/tests/system/tsig/ns1/named.conf.in
-index 3470c4f..cf539cd 100644
--- a/bin/tests/system/tsig/ns1/named.conf.in
-+++ b/bin/tests/system/tsig/ns1/named.conf.in
-@@ -21,10 +21,7 @@ options {
- 	notify no;
- };
- 
-key "md5" {
-	secret "97rnFx24Tfna4mHPfgnerA==";
-	algorithm hmac-md5;
-};
-+# md5 key appended by setup.sh at the end
- 
- key "sha1" {
- 	secret "FrSt77yPTFx6hTs4i2tKLB9LmE0=";
-@@ -51,10 +48,7 @@ key "sha512" {
- 	algorithm hmac-sha512;
- };
- 
-key "md5-trunc" {
-	secret "97rnFx24Tfna4mHPfgnerA==";
-	algorithm hmac-md5-80;
-};
-+# md5-trunc key appended by setup.sh at the end
- 
- key "sha1-trunc" {
- 	secret "FrSt77yPTFx6hTs4i2tKLB9LmE0=";
-diff --git a/bin/tests/system/tsig/ns1/rndc5.conf.in b/bin/tests/system/tsig/ns1/rndc5.conf.in
-new file mode 100644
-index 0000000..0682194
--- /dev/null
-+++ b/bin/tests/system/tsig/ns1/rndc5.conf.in
-@@ -0,0 +1,10 @@
-+# Conditionally included when support for MD5 is available
-+key "md5" {
-+	secret "97rnFx24Tfna4mHPfgnerA==";
-+	algorithm hmac-md5;
-+};
-+
-+key "md5-trunc" {
-+	secret "97rnFx24Tfna4mHPfgnerA==";
-+	algorithm hmac-md5-80;
-+};
-diff --git a/bin/tests/system/tsig/setup.sh b/bin/tests/system/tsig/setup.sh
-index e3b4a45..ae21d04 100644
--- a/bin/tests/system/tsig/setup.sh
-+++ b/bin/tests/system/tsig/setup.sh
-@@ -15,3 +15,8 @@ SYSTEMTESTTOP=..
- $SHELL clean.sh
- 
- copy_setports ns1/named.conf.in ns1/named.conf
-+
-+if $FEATURETEST --md5
-+then
-+	cat ns1/rndc5.conf.in >> ns1/named.conf
-+fi
-diff --git a/bin/tests/system/tsig/tests.sh b/bin/tests/system/tsig/tests.sh
-index 38d842a..668aa6f 100644
--- a/bin/tests/system/tsig/tests.sh
-+++ b/bin/tests/system/tsig/tests.sh
-@@ -26,20 +26,25 @@ sha512="jI/Pa4qRu96t76Pns5Z/Ndxbn3QCkwcxLOgt9vgvnJw5wqTRvNyk3FtD6yIMd1dWVlqZ+Y4f
- 
- status=0
- 
-echo_i "fetching using hmac-md5 (old form)"
-ret=0
-$DIG $DIGOPTS example.nil. -y "md5:$md5" @10.53.0.1 soa > dig.out.md5.old || ret=1
-grep -i "md5.*TSIG.*NOERROR" dig.out.md5.old > /dev/null || ret=1
-if [ $ret -eq 1 ] ; then
-	echo_i "failed"; status=1
-fi
-+if $FEATURETEST --md5
-+then
-+	echo_i "fetching using hmac-md5 (old form)"
-+	ret=0
-+	$DIG $DIGOPTS example.nil. -y "md5:$md5" @10.53.0.1 soa > dig.out.md5.old || ret=1
-+	grep -i "md5.*TSIG.*NOERROR" dig.out.md5.old > /dev/null || ret=1
-+	if [ $ret -eq 1 ] ; then
-+		echo_i "failed"; status=1
-+	fi
- 
-echo_i "fetching using hmac-md5 (new form)"
-ret=0
-$DIG $DIGOPTS example.nil. -y "hmac-md5:md5:$md5" @10.53.0.1 soa > dig.out.md5.new || ret=1
-grep -i "md5.*TSIG.*NOERROR" dig.out.md5.new > /dev/null || ret=1
-if [ $ret -eq 1 ] ; then
-	echo_i "failed"; status=1
-+	echo_i "fetching using hmac-md5 (new form)"
-+	ret=0
-+	$DIG $DIGOPTS example.nil. -y "hmac-md5:md5:$md5" @10.53.0.1 soa > dig.out.md5.new || ret=1
-+	grep -i "md5.*TSIG.*NOERROR" dig.out.md5.new > /dev/null || ret=1
-+	if [ $ret -eq 1 ] ; then
-+		echo_i "failed"; status=1
-+	fi
-+else
-+	echo_i "skipping using hmac-md5"
- fi
- 
- echo_i "fetching using hmac-sha1"
-@@ -87,12 +92,17 @@ fi
- #	Truncated TSIG
- #
- #
-echo_i "fetching using hmac-md5 (trunc)"
-ret=0
-$DIG $DIGOPTS example.nil. -y "hmac-md5-80:md5-trunc:$md5" @10.53.0.1 soa > dig.out.md5.trunc || ret=1
-grep -i "md5-trunc.*TSIG.*NOERROR" dig.out.md5.trunc > /dev/null || ret=1
-if [ $ret -eq 1 ] ; then
-	echo_i "failed"; status=1
-+if $FEATURETEST --md5
-+then
-+	echo_i "fetching using hmac-md5 (trunc)"
-+	ret=0
-+	$DIG $DIGOPTS example.nil. -y "hmac-md5-80:md5-trunc:$md5" @10.53.0.1 soa > dig.out.md5.trunc || ret=1
-+	grep -i "md5-trunc.*TSIG.*NOERROR" dig.out.md5.trunc > /dev/null || ret=1
-+	if [ $ret -eq 1 ] ; then
-+		echo_i "failed"; status=1
-+	fi
-+else
-+	echo_i "skipping using hmac-md5 (trunc)"
- fi
- 
- echo_i "fetching using hmac-sha1 (trunc)"
-@@ -141,12 +151,17 @@ fi
- #	Check for bad truncation.
- #
- #
-echo_i "fetching using hmac-md5-80 (BADTRUNC)"
-ret=0
-$DIG $DIGOPTS example.nil. -y "hmac-md5-80:md5:$md5" @10.53.0.1 soa > dig.out.md5-80 || ret=1
-grep -i "md5.*TSIG.*BADTRUNC" dig.out.md5-80 > /dev/null || ret=1
-if [ $ret -eq 1 ] ; then
-	echo_i "failed"; status=1
-+if $FEATURETEST --md5
-+then
-+	echo_i "fetching using hmac-md5-80 (BADTRUNC)" 
-+	ret=0
-+	$DIG $DIGOPTS example.nil. -y "hmac-md5-80:md5:$md5" @10.53.0.1 soa > dig.out.md5-80 || ret=1
-+	grep -i "md5.*TSIG.*BADTRUNC" dig.out.md5-80 > /dev/null || ret=1
-+	if [ $ret -eq 1 ] ; then
-+		echo_i "failed"; status=1
-+	fi
-+else
-+	echo_i "skipping using hmac-md5-80 (BADTRUNC)" 
- fi
- 
- echo_i "fetching using hmac-sha1-80 (BADTRUNC)"
-diff --git a/bin/tests/system/upforwd/ns1/named.conf.in b/bin/tests/system/upforwd/ns1/named.conf.in
-index 3873c7c..b359a5a 100644
--- a/bin/tests/system/upforwd/ns1/named.conf.in
-+++ b/bin/tests/system/upforwd/ns1/named.conf.in
-@@ -10,7 +10,7 @@
-  */
- 
- key "update.example." {
-	algorithm "hmac-md5";
-+	algorithm "hmac-sha256";
- 	secret "c3Ryb25nIGVub3VnaCBmb3IgYSBtYW4gYnV0IG1hZGUgZm9yIGEgd29tYW4K";
- };
- 
-diff --git a/bin/tests/system/upforwd/tests.sh b/bin/tests/system/upforwd/tests.sh
-index a50c896..8062d68 100644
--- a/bin/tests/system/upforwd/tests.sh
-+++ b/bin/tests/system/upforwd/tests.sh
-@@ -79,7 +79,7 @@ if [ $ret != 0 ] ; then echo_i "failed"; status=`expr $status + $ret`; fi
- 
- echo_i "updating zone (signed) ($n)"
- ret=0
-$NSUPDATE -y update.example:c3Ryb25nIGVub3VnaCBmb3IgYSBtYW4gYnV0IG1hZGUgZm9yIGEgd29tYW4K -- - <<EOF || ret=1
-+$NSUPDATE -y hmac-sha256:update.example:c3Ryb25nIGVub3VnaCBmb3IgYSBtYW4gYnV0IG1hZGUgZm9yIGEgd29tYW4K -- - <<EOF || ret=1
- server 10.53.0.3 ${PORT}
- update add updated.example. 600 A 10.10.10.1
- update add updated.example. 600 TXT Foo
-- 
-2.31.1
-
--- a/bind-9.11-kyua-pkcs11.patch
+++ b/bind-9.11-kyua-pkcs11.patch
@ -1,58 +0,0 @@
-From 1241f2005d08673c28a595c5a6cd61350b95a929 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
-Date: Tue, 2 Jan 2018 18:13:07 +0100
-Subject: [PATCH] Fix pkcs11 variants atf tests
-
-Add dns-pkcs11 tests Makefile to configure
-
-Add pkcs11 Kyuafile, fix dh_test to pass in pkcs11 mode
---
- configure.ac                   | 1 +
- lib/Kyuafile                   | 2 ++
- lib/dns-pkcs11/tests/dh_test.c | 3 ++-
- 3 files changed, 5 insertions(+), 1 deletion(-)
-
-diff --git a/configure.ac b/configure.ac
-index d80ae31..0fb9328 100644
--- a/configure.ac
-+++ b/configure.ac
-@@ -3090,6 +3090,7 @@ AC_CONFIG_FILES([
- 	lib/dns-pkcs11/include/Makefile
- 	lib/dns-pkcs11/include/dns/Makefile
- 	lib/dns-pkcs11/include/dst/Makefile
-+	lib/dns-pkcs11/tests/Makefile
- 	lib/irs/Makefile
- 	lib/irs/include/Makefile
- 	lib/irs/include/irs/Makefile
-diff --git a/lib/Kyuafile b/lib/Kyuafile
-index 39ce986..037e5ef 100644
--- a/lib/Kyuafile
-+++ b/lib/Kyuafile
-@@ -2,8 +2,10 @@ syntax(2)
- test_suite('bind9')
- 
- include('dns/Kyuafile')
-+include('dns-pkcs11/Kyuafile')
- include('irs/Kyuafile')
- include('isc/Kyuafile')
- include('isccc/Kyuafile')
- include('isccfg/Kyuafile')
- include('ns/Kyuafile')
-+include('ns-pkcs11/Kyuafile')
-diff --git a/lib/dns-pkcs11/tests/dh_test.c b/lib/dns-pkcs11/tests/dh_test.c
-index 934e8fd..658d1af 100644
--- a/lib/dns-pkcs11/tests/dh_test.c
-+++ b/lib/dns-pkcs11/tests/dh_test.c
-@@ -87,7 +87,8 @@ dh_computesecret(void **state) {
- 	result = dst_key_computesecret(key, key, &buf);
- 	assert_int_equal(result, DST_R_NOTPRIVATEKEY);
- 	result = key->func->computesecret(key, key, &buf);
-	assert_int_equal(result, DST_R_COMPUTESECRETFAILURE);
-+	/* PKCS11 variant gives different result, accept both */
-+	assert_true(result == DST_R_COMPUTESECRETFAILURE || result == DST_R_INVALIDPRIVATEKEY);
- 
- 	dst_key_free(&key);
- }
-- 
-2.20.1
-
--- a/bind-9.11-rh1666814.patch
+++ b/bind-9.11-rh1666814.patch
@ -1,29 +0,0 @@
-From d05d116da39c0a5c580ceaac6ba069899b82c5a0 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
-Date: Wed, 16 Jan 2019 16:27:33 +0100
-Subject: [PATCH] Fix possible crash when loading corrupted file
-
-Some values passes internal triggers by coincidence. Fix the check and
-check also first_node_offset before even passing it further.
---
- lib/dns/rbt.c | 4 +++-
- 1 file changed, 3 insertions(+), 1 deletion(-)
-
-diff --git a/lib/dns/rbt.c b/lib/dns/rbt.c
-index 5aee5f6..7f2c2d2 100644
--- a/lib/dns/rbt.c
-+++ b/lib/dns/rbt.c
-@@ -945,7 +945,9 @@ dns_rbt_deserialize_tree(void *base_address, size_t filesize,
- 	rbt->root = (dns_rbtnode_t *)((char *)base_address + header_offset +
- 				      header->first_node_offset);
- 
-	if ((header->nodecount * sizeof(dns_rbtnode_t)) > filesize) {
-+	if ((header->nodecount * sizeof(dns_rbtnode_t)) > filesize
-+	    || header->first_node_offset > filesize) {
-+
- 		result = ISC_R_INVALIDFILE;
- 		goto cleanup;
- 	}
-- 
-2.31.1
-
--- a/bind-9.14-config-pkcs11.patch
+++ b/bind-9.14-config-pkcs11.patch
@ -1,83 +0,0 @@
-From e6ab9c67f0a14adc23c1067e03a106da1b1651b7 Mon Sep 17 00:00:00 2001
-From: Petr Mensik <pemensik@redhat.com>
-Date: Fri, 18 Oct 2019 21:30:52 +0200
-Subject: [PATCH] Move USE_PKCS11 and USE_OPENSSL out of config.h
-
-Building two variants with the same common code requires to unset
-USE_PKCS11 on part of build. That is not possible with config.h value.
-Move it as normal define to CDEFINES.
---
- bin/confgen/Makefile.in |  2 +-
- configure.ac            |  8 ++++++--
- lib/dns/dst_internal.h  | 12 +++++++++---
- 3 files changed, 16 insertions(+), 6 deletions(-)
-
-diff --git a/bin/confgen/Makefile.in b/bin/confgen/Makefile.in
-index 1b7512d..c126bf3 100644
--- a/bin/confgen/Makefile.in
-+++ b/bin/confgen/Makefile.in
-@@ -22,7 +22,7 @@ VERSION=@BIND9_VERSION@
- CINCLUDES = -I${srcdir}/include ${ISC_INCLUDES} ${ISCCC_INCLUDES} \
- 	${ISCCFG_INCLUDES} ${DNS_INCLUDES} ${BIND9_INCLUDES}
- 
-CDEFINES =
-+CDEFINES = @USE_PKCS11@
- CWARNINGS =
- 
- ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
-diff --git a/configure.ac b/configure.ac
-index f5483fe..08a7d8a 100644
--- a/configure.ac
-+++ b/configure.ac
-@@ -935,10 +935,14 @@ AC_SUBST([PKCS11_TEST])
- AC_SUBST([PKCS11_TOOLS])
- AC_SUBST([PKCS11_MANS])
- 
-+USE_PKCS11='-DUSE_PKCS11=0'
-+USE_OPENSSL='-DUSE_OPENSSL=0'
- AC_SUBST([CRYPTO])
- AS_CASE([$CRYPTO],
-	[pkcs11],[AC_DEFINE([USE_PKCS11], [1], [define if PKCS11 is used for Public-Key Cryptography])],
-	[AC_DEFINE([USE_OPENSSL], [1], [define if OpenSSL is used for Public-Key Cryptography])])
-+	[pkcs11],[USE_PKCS11='-DUSE_PKCS11=1'],
-+	[USE_OPENSSL='-DUSE_OPENSSL=1'])
-+AC_SUBST(USE_PKCS11)
-+AC_SUBST(USE_OPENSSL)
- 
- # preparation for automake
- # AM_CONDITIONAL([PKCS11_TOOLS], [test "$with_native_pkcs11" = "yes"])
-diff --git a/lib/dns/dst_internal.h b/lib/dns/dst_internal.h
-index 2c3b4a3..55e9dc4 100644
--- a/lib/dns/dst_internal.h
-+++ b/lib/dns/dst_internal.h
-@@ -38,6 +38,13 @@
- #include <isc/stdtime.h>
- #include <isc/types.h>
- 
-+#ifndef USE_PKCS11
-+#define USE_PKCS11 0
-+#endif
-+#ifndef USE_OPENSSL
-+#define USE_OPENSSL (! USE_PKCS11)
-+#endif
-+
- #if USE_PKCS11
- #include <pk11/pk11.h>
- #include <pk11/site.h>
-@@ -116,11 +123,10 @@ struct dst_key {
- 		void *generic;
- 		dns_gss_ctx_id_t gssctx;
- 		DH *dh;
-#if USE_OPENSSL
-		EVP_PKEY *pkey;
-#endif /* if USE_OPENSSL */
- #if USE_PKCS11
- 		pk11_object_t *pkey;
-+#else
-+		EVP_PKEY *pkey;
- #endif /* if USE_PKCS11 */
- 		dst_hmac_key_t *hmac_key;
- 	} keydata; /*%< pointer to key in crypto pkg fmt */
-- 
-2.26.2
-
--- a/bind-9.16-redhat_doc.patch
+++ b/bind-9.16-redhat_doc.patch
@ -1,4 +1,4 @@
-From 3a161af91bffcd457586ab466e32ac8484028763 Mon Sep 17 00:00:00 2001
+From 402403b4bbb4f603693378e86b6c97997ccb0401 Mon Sep 17 00:00:00 2001
 From: Petr Mensik <pemensik@redhat.com>
 Date: Wed, 17 Jun 2020 23:17:13 +0200
 Subject: [PATCH] Update man named with Red Hat specifics
@ -6,15 +6,15 @@ Subject: [PATCH] Update man named with Red Hat specifics
 This is almost unmodified text and requires revalidation. Some of those
 statements are no longer correct.
 ---
- bin/named/named.rst | 35 +++++++++++++++++++++++++++++++++++
- 1 file changed, 35 insertions(+)
+ bin/named/named.rst | 41 +++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 41 insertions(+)

 diff --git a/bin/named/named.rst b/bin/named/named.rst
-index 6fd8f87..3cd6350 100644
+index ea440b2..fa51984 100644
 --- a/bin/named/named.rst
 +++ b/bin/named/named.rst
-@@ -228,6 +228,41 @@ Files
- ``/var/run/named/named.pid``
+@@ -212,6 +212,47 @@ Files
+ |named_pid|
    The default process-id file.
 
 +Notes
@ -24,7 +24,7 @@ index 6fd8f87..3cd6350 100644
 +
 +By default, Red Hat ships BIND with the most secure SELinux policy
 +that will not prevent normal BIND operation and will prevent exploitation
-+of all known BIND security vulnerabilities. See the selinux(8) man page
+of all known BIND security vulnerabilities . See the selinux(8) man page
 +for information about SElinux.
 +
 +It is not necessary to run named in a chroot environment if the Red Hat
@ -34,27 +34,33 @@ index 6fd8f87..3cd6350 100644
 +
 +*With this extra security comes some restrictions:*
 +
-+By default, the SELinux policy does not allow named to write outside directory
-+/var/named. That directory used to be read-only for named, but write access is
-+enabled by default now.
+By default, the SELinux policy does not allow named to write any master
+zone database files. Only the root user may create files in the $ROOTDIR/var/named
+zone database file directory (the options { "directory" } option), where
+$ROOTDIR is set in /etc/sysconfig/named.
 +
 +The "named" group must be granted read privelege to
 +these files in order for named to be enabled to read them.
-+Any file updated by named must be writeable by named user or named group.
 +
 +Any file created in the zone database file directory is automatically assigned
 +the SELinux file context *named_zone_t* .
 +
+By default, SELinux prevents any role from modifying *named_zone_t* files; this
+means that files in the zone database directory cannot be modified by dynamic
+DNS (DDNS) updates or zone transfers.
+
 +The Red Hat BIND distribution and SELinux policy creates three directories where
-+named were allowed to create and modify files: */var/named/slaves*, */var/named/dynamic*
-+*/var/named/data*. The service is able to write and file under */var/named* with appropriate
-+permissions. They are used for better organisation of zones and backward compatibility.
-+Files in these directories are automatically assigned the '*named_cache_t*'
-+file context, which SELinux always allows named to write.
+named is allowed to create and modify files: */var/named/slaves*, */var/named/dynamic*
+*/var/named/data*. By placing files you want named to modify, such as
+slave or DDNS updateable zone files and database / statistics dump files in
+these directories, named will work normally and no further operator action is
+required. Files in these directories are automatically assigned the '*named_cache_t*'
+file context, which SELinux allows named to write.
+
 +
 See Also
 ~~~~~~~~
 
 -- 
-2.26.2
+2.34.1

--- a/bind-9.16-resolv.conf-options-timeout-test.patch
+++ b/bind-9.16-resolv.conf-options-timeout-test.patch
@ -1,113 +0,0 @@
-From 7270604440268bb17b39ae734ff33003a67c8343 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
-Date: Tue, 20 Jul 2021 19:34:42 +0200
-Subject: [PATCH] Check parsed resconf values
-
-Add 'attempts' check, fix 'ndots' data. Create a bunch of verification
-functions and check parsed values, not just return codes.
---
- lib/irs/tests/resconf_test.c                 | 46 ++++++++++++++++++--
- lib/irs/tests/testdata/options-attempts.conf | 10 +++++
- lib/irs/tests/testdata/options-ndots.conf    |  2 +-
- 3 files changed, 54 insertions(+), 4 deletions(-)
- create mode 100644 lib/irs/tests/testdata/options-attempts.conf
-
-diff --git a/lib/irs/tests/resconf_test.c b/lib/irs/tests/resconf_test.c
-index 6951758..ce94345 100644
--- a/lib/irs/tests/resconf_test.c
-+++ b/lib/irs/tests/resconf_test.c
-@@ -45,6 +45,43 @@ setup_test() {
- 	assert_return_code(chdir(TESTS), 0);
- }
- 
-+static isc_result_t
-+check_number(unsigned int n, unsigned int expected) {
-+	return ((n == expected) ? ISC_R_SUCCESS : ISC_R_BADNUMBER);
-+}
-+
-+static isc_result_t
-+check_attempts(irs_resconf_t *resconf) {
-+	return (check_number(irs_resconf_getattempts(resconf), 4));
-+}
-+
-+static isc_result_t
-+check_timeout(irs_resconf_t *resconf) {
-+	return (check_number(irs_resconf_gettimeout(resconf), 1));
-+}
-+
-+static isc_result_t
-+check_ndots(irs_resconf_t *resconf) {
-+	return (check_number(irs_resconf_getndots(resconf), 2));
-+}
-+
-+static isc_result_t
-+check_options(irs_resconf_t *resconf) {
-+	if (irs_resconf_getattempts(resconf) != 3) {
-+		return ISC_R_BADNUMBER; /* default value only */
-+	}
-+
-+	if (irs_resconf_getndots(resconf) != 2) {
-+		return ISC_R_BADNUMBER;
-+	}
-+
-+	if (irs_resconf_gettimeout(resconf) != 1) {
-+		return ISC_R_BADNUMBER;
-+	}
-+
-+	return (ISC_R_SUCCESS);
-+}
-+
- /* test irs_resconf_load() */
- static void
- irs_resconf_load_test(void **state) {
-@@ -64,15 +101,18 @@ irs_resconf_load_test(void **state) {
- 		  ISC_R_SUCCESS },
- 		{ "testdata/nameserver-v6-scoped.conf", ISC_R_SUCCESS, NULL,
- 		  ISC_R_SUCCESS },
-+		{ "testdata/options-attempts.conf", ISC_R_SUCCESS,
-+		  check_attempts, ISC_R_SUCCESS },
- 		{ "testdata/options-debug.conf", ISC_R_SUCCESS, NULL,
- 		  ISC_R_SUCCESS },
-		{ "testdata/options-ndots.conf", ISC_R_SUCCESS, NULL,
-+		{ "testdata/options-ndots.conf", ISC_R_SUCCESS, check_ndots,
- 		  ISC_R_SUCCESS },
-		{ "testdata/options-timeout.conf", ISC_R_SUCCESS, NULL,
-+		{ "testdata/options-timeout.conf", ISC_R_SUCCESS, check_timeout,
- 		  ISC_R_SUCCESS },
- 		{ "testdata/options-unknown.conf", ISC_R_SUCCESS, NULL,
- 		  ISC_R_SUCCESS },
-		{ "testdata/options.conf", ISC_R_SUCCESS, NULL, ISC_R_SUCCESS },
-+		{ "testdata/options.conf", ISC_R_SUCCESS, check_options,
-+		  ISC_R_SUCCESS },
- 		{ "testdata/options-bad-ndots.conf", ISC_R_RANGE, NULL,
- 		  ISC_R_SUCCESS },
- 		{ "testdata/options-empty.conf", ISC_R_UNEXPECTEDEND, NULL,
-diff --git a/lib/irs/tests/testdata/options-attempts.conf b/lib/irs/tests/testdata/options-attempts.conf
-new file mode 100644
-index 0000000..4538643
--- /dev/null
-+++ b/lib/irs/tests/testdata/options-attempts.conf
-@@ -0,0 +1,10 @@
-+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-+#
-+# This Source Code Form is subject to the terms of the Mozilla Public
-+# License, v. 2.0. If a copy of the MPL was not distributed with this
-+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-+#
-+# See the COPYRIGHT file distributed with this work for additional
-+# information regarding copyright ownership.
-+
-+options attempts:4
-diff --git a/lib/irs/tests/testdata/options-ndots.conf b/lib/irs/tests/testdata/options-ndots.conf
-index 5d18d26..f37c712 100644
--- a/lib/irs/tests/testdata/options-ndots.conf
-+++ b/lib/irs/tests/testdata/options-ndots.conf
-@@ -9,4 +9,4 @@
- # See the COPYRIGHT file distributed with this work for additional
- # information regarding copyright ownership.
- 
-option ndots:2
-+options ndots:2
-- 
-2.35.3
-
--- a/bind-9.16-resolv.conf-options-timeout.patch
+++ b/bind-9.16-resolv.conf-options-timeout.patch
@ -1,203 +0,0 @@
-From b0e79979672935ff07bf23703c675ee788940c59 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
-Date: Tue, 22 Jun 2021 16:35:46 +0200
-Subject: [PATCH] Parse 'timeout' and 'attempts' from resolv.conf
-
-It was supported by lwres in BIND 9.11, and is still mentioned in
-the manual page. Restore support for it by adding it to libirs.
---
- bin/dig/dighost.c             | 13 ++++++-
- lib/irs/include/irs/resconf.h | 20 +++++++++++
- lib/irs/resconf.c             | 64 ++++++++++++++++++++++++++++-------
- 3 files changed, 84 insertions(+), 13 deletions(-)
-
-diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c
-index 0222454..274e894 100644
--- a/bin/dig/dighost.c
-+++ b/bin/dig/dighost.c
-@@ -133,7 +133,7 @@ int sendcount = 0;
- int recvcount = 0;
- int sockcount = 0;
- int ndots = -1;
-int tries = 3;
-+int tries = -1;
- int lookup_counter = 0;
- 
- static char servercookie[256];
-@@ -1330,6 +1330,17 @@ setup_system(bool ipv4only, bool ipv6only) {
- 		ndots = irs_resconf_getndots(resconf);
- 		debug("ndots is %d.", ndots);
- 	}
-+	if (timeout == 0) {
-+		timeout = irs_resconf_gettimeout(resconf);
-+		debug("timeout is %d.", timeout);
-+	}
-+	if (tries == -1) {
-+		tries = irs_resconf_getattempts(resconf);
-+		if (tries == 0) {
-+			tries = 3;
-+		}
-+		debug("retries is %d.", tries);
-+	}
- 
- 	/* If user doesn't specify server use nameservers from resolv.conf. */
- 	if (ISC_LIST_EMPTY(server_list)) {
-diff --git a/lib/irs/include/irs/resconf.h b/lib/irs/include/irs/resconf.h
-index 424b795..74fc84a 100644
--- a/lib/irs/include/irs/resconf.h
-+++ b/lib/irs/include/irs/resconf.h
-@@ -113,6 +113,26 @@ irs_resconf_getndots(irs_resconf_t *conf);
-  *\li	'conf' is a valid resconf object.
-  */
- 
-+unsigned int
-+irs_resconf_getattempts(irs_resconf_t *conf);
-+/*%<
-+ * Return the 'attempts' value stored in 'conf'.
-+ *
-+ * Requires:
-+ *
-+ *\li	'conf' is a valid resconf object.
-+ */
-+
-+unsigned int
-+irs_resconf_gettimeout(irs_resconf_t *conf);
-+/*%<
-+ * Return the 'timeout' value stored in 'conf'.
-+ *
-+ * Requires:
-+ *
-+ *\li	'conf' is a valid resconf object.
-+ */
-+
- ISC_LANG_ENDDECLS
- 
- #endif /* IRS_RESCONF_H */
-diff --git a/lib/irs/resconf.c b/lib/irs/resconf.c
-index 096064b..dd51d71 100644
--- a/lib/irs/resconf.c
-+++ b/lib/irs/resconf.c
-@@ -80,6 +80,13 @@
- #define RESCONFMAXLINELEN     256U /*%< max size of a line */
- #define RESCONFMAXSORTLIST    10U  /*%< max 10 */
- 
-+#define CHECK(op)                            \
-+	do {                                 \
-+		result = (op);               \
-+		if (result != ISC_R_SUCCESS) \
-+			goto cleanup;        \
-+	} while (0)
-+
- /*!
-  * configuration data structure
-  */
-@@ -114,6 +121,10 @@ struct irs_resconf {
- 	uint8_t resdebug;
- 	/*%< set to n in 'options ndots:n' */
- 	uint8_t ndots;
-+	/*%< set to n in 'options attempts:n' */
-+	uint8_t attempts;
-+	/*%< set to n in 'options timeout:n' */
-+	uint8_t timeout;
- };
- 
- static isc_result_t
-@@ -176,8 +187,8 @@ eatwhite(FILE *fp) {
-  */
- static int
- getword(FILE *fp, char *buffer, size_t size) {
-+	char *p = NULL;
- 	int ch;
-	char *p;
- 
- 	REQUIRE(buffer != NULL);
- 	REQUIRE(size > 0U);
-@@ -457,11 +468,26 @@ resconf_parsesortlist(irs_resconf_t *conf, FILE *fp) {
- 	return (ISC_R_SUCCESS);
- }
- 
-+static isc_result_t
-+resconf_optionnumber(const char *word, uint8_t *number) {
-+	char *p;
-+	long n;
-+
-+	n = strtol(word, &p, 10);
-+	if (*p != '\0') { /* Bad string. */
-+		return (ISC_R_UNEXPECTEDTOKEN);
-+	}
-+	if (n < 0 || n > 0xff) { /* Out of range. */
-+		return (ISC_R_RANGE);
-+	}
-+	*number = n;
-+	return (ISC_R_SUCCESS);
-+}
-+
- static isc_result_t
- resconf_parseoption(irs_resconf_t *conf, FILE *fp) {
- 	int delim;
-	long ndots;
-	char *p;
-+	isc_result_t result = ISC_R_SUCCESS;
- 	char word[RESCONFMAXLINELEN];
- 
- 	delim = getword(fp, word, sizeof(word));
-@@ -473,14 +499,11 @@ resconf_parseoption(irs_resconf_t *conf, FILE *fp) {
- 		if (strcmp("debug", word) == 0) {
- 			conf->resdebug = 1;
- 		} else if (strncmp("ndots:", word, 6) == 0) {
-			ndots = strtol(word + 6, &p, 10);
-			if (*p != '\0') { /* Bad string. */
-				return (ISC_R_UNEXPECTEDTOKEN);
-			}
-			if (ndots < 0 || ndots > 0xff) { /* Out of range. */
-				return (ISC_R_RANGE);
-			}
-			conf->ndots = (uint8_t)ndots;
-+			CHECK(resconf_optionnumber(word + 6, &conf->ndots));
-+		} else if (strncmp("attempts:", word, 9) == 0) {
-+			CHECK(resconf_optionnumber(word + 9, &conf->attempts));
-+		} else if (strncmp("timeout:", word, 8) == 0) {
-+			CHECK(resconf_optionnumber(word + 8, &conf->timeout));
- 		}
- 
- 		if (delim == EOF || delim == '\n') {
-@@ -490,7 +513,8 @@ resconf_parseoption(irs_resconf_t *conf, FILE *fp) {
- 		}
- 	}
- 
-	return (ISC_R_SUCCESS);
-+cleanup:
-+	return (result);
- }
- 
- static isc_result_t
-@@ -532,6 +556,8 @@ irs_resconf_load(isc_mem_t *mctx, const char *filename, irs_resconf_t **confp) {
- 	conf->sortlistnxt = 0;
- 	conf->resdebug = 0;
- 	conf->ndots = 1;
-+	conf->attempts = 3;
-+	conf->timeout = 0;
- 	for (i = 0; i < RESCONFMAXSEARCH; i++) {
- 		conf->search[i] = NULL;
- 	}
-@@ -687,3 +713,17 @@ irs_resconf_getndots(irs_resconf_t *conf) {
- 
- 	return ((unsigned int)conf->ndots);
- }
-+
-+unsigned int
-+irs_resconf_getattempts(irs_resconf_t *conf) {
-+	REQUIRE(IRS_RESCONF_VALID(conf));
-+
-+	return ((unsigned int)conf->attempts);
-+}
-+
-+unsigned int
-+irs_resconf_gettimeout(irs_resconf_t *conf) {
-+	REQUIRE(IRS_RESCONF_VALID(conf));
-+
-+	return ((unsigned int)conf->timeout);
-+}
-- 
-2.35.3
-
--- a/bind-9.18-CVE-2026-10723-test.patch
+++ b/bind-9.18-CVE-2026-10723-test.patch
@ -0,0 +1,854 @@
+From 2a4786b0edde59274f682c9bd4ae4026c2d08218 Mon Sep 17 00:00:00 2001
+From: Evan Hunt <each@isc.org>
+Date: Wed, 1 Jul 2026 22:56:02 -0700
+Subject: [PATCH] add isctest.mark method for ecdsa_deterinistic
+
+This checks support for ECDSA deterministic mode in the cryptography
+library.
+
+(cherry picked from commit 6e44151466864d3dd783a20da83d01028781d3e2)
+(cherry picked from commit dc3f52388427f4f94087d984d5a2088b925810e2)
+
+Reproducer for #5874 NSEC3 impersonation
+
+LLM generated.
+
+(cherry picked from commit f3e2eb333be3ac636f745aa13cfb8d9ee8af87d8)
+(cherry picked from commit 35e3d49d2222c13786a06021c7ed583d2a656e51)
+
+Update reproducer #5874
+
+Update the llm generated reproducer:
+- Move server.py into ans1/ans.py
+- Remove unnecessary named.conf configuration options
+- Add comments describing the steps (copied from GL issue)
+- Rename system test
+
+(cherry picked from commit c1321fef165a2ef8c2bff971901c58941e8e694c)
+(cherry picked from commit 833dd3b230b92596074e8da15b12298f46c939f2)
+---
+ bin/tests/system/chain/ans3/ans.py            |  10 +-
+ bin/tests/system/chain/ans4/ans.py            |   8 +-
+ bin/tests/system/cookie/ans9/ans.py           |   7 +-
+ bin/tests/system/digdelv/ans8/ans.py          |   7 +-
+ bin/tests/system/dnssec/ans10/ans.py          |  11 +-
+ bin/tests/system/forward/ans11/ans.py         |  12 +-
+ bin/tests/system/isctest/mark.py              |  12 +
+ .../system/nsec3_impersonation/ans1/ans.py    | 280 ++++++++++++++++++
+ .../nsec3_impersonation/ns2/named.conf.j2     |  33 +++
+ .../tests_nsec3_impersonation.py              | 152 ++++++++++
+ bin/tests/system/qmin/ans2/ans.py             |  11 +-
+ bin/tests/system/qmin/ans3/ans.py             |  11 +-
+ bin/tests/system/qmin/ans4/ans.py             |  11 +-
+ bin/tests/system/resolver/ans10/ans.py        |  12 +-
+ 14 files changed, 529 insertions(+), 48 deletions(-)
+ create mode 100644 bin/tests/system/nsec3_impersonation/ans1/ans.py
+ create mode 100644 bin/tests/system/nsec3_impersonation/ns2/named.conf.j2
+ create mode 100644 bin/tests/system/nsec3_impersonation/tests_nsec3_impersonation.py
+
+diff --git a/bin/tests/system/chain/ans3/ans.py b/bin/tests/system/chain/ans3/ans.py
+index 0a031c1145..7c54c3c51a 100644
+--- a/bin/tests/system/chain/ans3/ans.py
+++ b/bin/tests/system/chain/ans3/ans.py
+@@ -19,10 +19,10 @@ import sys
+ import signal
+ import socket
+ import select
+-from datetime import datetime, timedelta
+-import functools
+ 
+-import dns, dns.message, dns.query
+import dns
+import dns.message
+import dns.query
+ from dns.rdatatype import *
+ from dns.rdataclass import *
+ from dns.rcode import *
+@@ -173,9 +173,9 @@ else:
+ while running:
+     try:
+         inputready, outputready, exceptready = select.select(input, [], [])
+-    except select.error as e:
+    except select.error:
+         break
+-    except socket.error as e:
+    except socket.error:
+         break
+     except KeyboardInterrupt:
+         break
+diff --git a/bin/tests/system/chain/ans4/ans.py b/bin/tests/system/chain/ans4/ans.py
+index c969117368..de536b25bd 100755
+--- a/bin/tests/system/chain/ans4/ans.py
+++ b/bin/tests/system/chain/ans4/ans.py
+@@ -22,7 +22,9 @@ import select
+ from datetime import datetime, timedelta
+ import functools
+ 
+-import dns, dns.message, dns.query
+import dns
+import dns.message
+import dns.query
+ from dns.rdatatype import *
+ from dns.rdataclass import *
+ from dns.rcode import *
+@@ -371,9 +373,9 @@ else:
+ while running:
+     try:
+         inputready, outputready, exceptready = select.select(input, [], [])
+-    except select.error as e:
+    except select.error:
+         break
+-    except socket.error as e:
+    except socket.error:
+         break
+     except KeyboardInterrupt:
+         break
+diff --git a/bin/tests/system/cookie/ans9/ans.py b/bin/tests/system/cookie/ans9/ans.py
+index 3b0f82cc1d..2710386d74 100644
+--- a/bin/tests/system/cookie/ans9/ans.py
+++ b/bin/tests/system/cookie/ans9/ans.py
+@@ -15,9 +15,6 @@ import sys
+ import signal
+ import socket
+ import select
+-from datetime import datetime, timedelta
+-import time
+-import functools
+ 
+ import dns
+ import dns.edns
+@@ -257,9 +254,9 @@ else:
+ while running:
+     try:
+         inputready, outputready, exceptready = select.select(input, [], [])
+-    except select.error as e:
+    except select.error:
+         break
+-    except socket.error as e:
+    except socket.error:
+         break
+     except KeyboardInterrupt:
+         break
+diff --git a/bin/tests/system/digdelv/ans8/ans.py b/bin/tests/system/digdelv/ans8/ans.py
+index 3e18edc1cc..1896a2bafc 100644
+--- a/bin/tests/system/digdelv/ans8/ans.py
+++ b/bin/tests/system/digdelv/ans8/ans.py
+@@ -17,7 +17,8 @@ import socket
+ import select
+ import struct
+ 
+-import dns, dns.message
+import dns
+import dns.message
+ from dns.rcode import *
+ 
+ modes = [
+@@ -109,9 +110,9 @@ hung_conns = []
+ while running:
+     try:
+         inputready, outputready, exceptready = select.select(input, [], [])
+-    except select.error as e:
+    except select.error:
+         break
+-    except socket.error as e:
+    except socket.error:
+         break
+     except KeyboardInterrupt:
+         break
+diff --git a/bin/tests/system/dnssec/ans10/ans.py b/bin/tests/system/dnssec/ans10/ans.py
+index 84bf0a2642..46af72a147 100644
+--- a/bin/tests/system/dnssec/ans10/ans.py
+++ b/bin/tests/system/dnssec/ans10/ans.py
+@@ -16,10 +16,11 @@ import signal
+ import socket
+ import select
+ from datetime import datetime, timedelta
+-import time
+-import functools
+ 
+-import dns, dns.message, dns.query, dns.flags
+import dns
+import dns.message
+import dns.query
+import dns.flags
+ from dns.rdatatype import *
+ from dns.rdataclass import *
+ from dns.rcode import *
+@@ -140,9 +141,9 @@ else:
+ while running:
+     try:
+         inputready, outputready, exceptready = select.select(input, [], [])
+-    except select.error as e:
+    except select.error:
+         break
+-    except socket.error as e:
+    except socket.error:
+         break
+     except KeyboardInterrupt:
+         break
+diff --git a/bin/tests/system/forward/ans11/ans.py b/bin/tests/system/forward/ans11/ans.py
+index 00b5895f76..d5b8a5b037 100644
+--- a/bin/tests/system/forward/ans11/ans.py
+++ b/bin/tests/system/forward/ans11/ans.py
+@@ -16,11 +16,11 @@ import signal
+ import socket
+ import select
+ import struct
+-from datetime import datetime, timedelta
+-import time
+-import functools
+ 
+-import dns, dns.message, dns.query, dns.flags
+import dns
+import dns.message
+import dns.query
+import dns.flags
+ from dns.rdatatype import *
+ from dns.rdataclass import *
+ from dns.rcode import *
+@@ -192,9 +192,9 @@ hung_conns = []
+ while running:
+     try:
+         inputready, outputready, exceptready = select.select(input, [], [])
+-    except select.error as e:
+    except select.error:
+         break
+-    except socket.error as e:
+    except socket.error:
+         break
+     except KeyboardInterrupt:
+         break
+diff --git a/bin/tests/system/isctest/mark.py b/bin/tests/system/isctest/mark.py
+index 53860a806c..098af5acfc 100644
+--- a/bin/tests/system/isctest/mark.py
+++ b/bin/tests/system/isctest/mark.py
+@@ -88,3 +88,15 @@ softhsm2_environment = pytest.mark.skipif(
+     ),
+     reason="SOFTHSM2_CONF and SOFTHSM2_MODULE environmental variables must be set and pkcs11-tool and softhsm2-util tools present",
+ )
+
+ecdsa_deterministic = False
+try:
+    from cryptography.hazmat.backends import default_backend
+
+    ecdsa_deterministic = default_backend().ecdsa_deterministic_supported()
+except Exception:  # pylint: disable=broad-except
+    pass
+
+with_ecdsa_deterministic = pytest.mark.skipif(
+    not ecdsa_deterministic, reason="ECDSA deterministic signing is not supported"
+)
+diff --git a/bin/tests/system/nsec3_impersonation/ans1/ans.py b/bin/tests/system/nsec3_impersonation/ans1/ans.py
+new file mode 100644
+index 0000000000..177e79c195
+--- /dev/null
+++ b/bin/tests/system/nsec3_impersonation/ans1/ans.py
+@@ -0,0 +1,280 @@
+#!/usr/bin/python3
+
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+from collections.abc import AsyncGenerator
+from dataclasses import dataclass
+from pathlib import Path
+
+import json
+
+from cryptography.hazmat.primitives import serialization
+
+import dns.dnssec
+import dns.flags
+import dns.message
+import dns.name
+import dns.rcode
+import dns.rdata
+import dns.rdataclass
+import dns.rdatatype
+import dns.rrset
+
+from isctest.asyncserver import (
+    AsyncDnsServer,
+    DnsResponseSend,
+    QueryContext,
+    ResponseHandler,
+)
+
+TTL = 300
+TLD = "tld.test."
+APEX_HASH = "1B40241KFORIOG780N4IKSCRLVETPCTQ"
+ATTACKER = f"{APEX_HASH.lower()}.{TLD}"
+VICTIM = f"victim.{TLD}"
+AUTH_IP = "10.53.0.1"
+
+
+@dataclass(frozen=True)
+class Key:
+    zone: dns.name.Name
+    private_key: object
+    dnskey: dns.rdata.Rdata
+    ds: dns.rdata.Rdata
+
+
+def name(text: str) -> dns.name.Name:
+    return dns.name.from_text(text)
+
+
+def load_keys() -> dict[str, Key]:
+    path = Path(__file__).resolve().parent / "keys.json"
+    with path.open(encoding="utf-8") as keys_file:
+        raw_keys = json.load(keys_file)
+
+    keys = {}
+    for zone, raw_key in raw_keys.items():
+        private_key = serialization.load_pem_private_key(
+            raw_key["private_pem"].encode("ascii"),
+            password=None,
+        )
+        dnskey = dns.rdata.from_text(
+            dns.rdataclass.IN, dns.rdatatype.DNSKEY, raw_key["dnskey"]
+        )
+        ds = dns.rdata.from_text(dns.rdataclass.IN, dns.rdatatype.DS, raw_key["ds"])
+        keys[zone] = Key(name(zone), private_key, dnskey, ds)
+
+    return keys
+
+
+def rrset(owner: str, rdtype: dns.rdatatype.RdataType, *rdatas: str) -> dns.rrset.RRset:
+    return dns.rrset.from_text(owner, TTL, dns.rdataclass.IN, rdtype, *rdatas)
+
+
+def rrset_from_rdata(owner: str, rdata: dns.rdata.Rdata) -> dns.rrset.RRset:
+    return dns.rrset.from_rdata(name(owner), TTL, rdata)
+
+
+def rrsig_rrset(covered: dns.rrset.RRset, signer: Key) -> dns.rrset.RRset:
+    rrsig = dns.dnssec.sign(
+        covered,
+        signer.private_key,
+        signer.zone,
+        signer.dnskey,
+        lifetime=86400,
+        verify=True,
+    )
+    return dns.rrset.from_rdata(covered.name, covered.ttl, rrsig)
+
+
+def add_signed(
+    section: list[dns.rrset.RRset], covered: dns.rrset.RRset, signer: Key
+) -> None:
+    section.append(covered)
+    section.append(rrsig_rrset(covered, signer))
+
+
+def dnskey_rrset(zone: str, zone_key: Key) -> dns.rrset.RRset:
+    return rrset_from_rdata(zone, zone_key.dnskey)
+
+
+def ds_rrset(zone: str, zone_key: Key) -> dns.rrset.RRset:
+    return rrset_from_rdata(zone, zone_key.ds)
+
+
+def soa_rrset(zone: str) -> dns.rrset.RRset:
+    return rrset(
+        zone,
+        dns.rdatatype.SOA,
+        f"ns.{zone} hostmaster.{zone} 1 3600 600 86400 300",
+    )
+
+
+def ns_rrset(zone: str, ns_target: str) -> dns.rrset.RRset:
+    return rrset(zone, dns.rdatatype.NS, ns_target)
+
+
+def glue_rrset(ns_target: str, address: str) -> dns.rrset.RRset:
+    return rrset(ns_target, dns.rdatatype.A, address)
+
+
+def answer_dnskey(response: dns.message.Message, zone: str, zone_key: Key) -> None:
+    add_signed(response.answer, dnskey_rrset(zone, zone_key), zone_key)
+
+
+def answer_soa(response: dns.message.Message, zone: str, zone_key: Key) -> None:
+    add_signed(response.answer, soa_rrset(zone), zone_key)
+
+
+def answer_ns(
+    response: dns.message.Message, zone: str, ns_target: str, zone_key: Key
+) -> None:
+    add_signed(response.answer, ns_rrset(zone, ns_target), zone_key)
+
+
+class SignedResponseHandler(ResponseHandler):
+    def __init__(self, keys: dict[str, Key]) -> None:
+        self.keys = keys
+
+    async def get_responses(
+        self, qctx: QueryContext
+    ) -> AsyncGenerator[DnsResponseSend, None]:
+        qctx.prepare_new_response(with_zone_data=False)
+        qctx.response.flags |= dns.flags.AA
+        qctx.response.set_rcode(dns.rcode.NOERROR)
+        self.respond(qctx)
+        yield DnsResponseSend(qctx.response, authoritative=True)
+
+    def respond(self, qctx: QueryContext) -> None:
+        raise NotImplementedError
+
+
+def child_nsec3_rrset() -> dns.rrset.RRset:
+    rdata = dns.rdata.from_text(
+        dns.rdataclass.IN,
+        dns.rdatatype.NSEC3,
+        f"1 0 0 - {APEX_HASH} NS SOA RRSIG DNSKEY NSEC3PARAM",
+    )
+    return dns.rrset.from_rdata(name(f"{APEX_HASH}.{TLD}"), TTL, rdata)
+
+
+def forged_nxdomain(response: dns.message.Message, keys: dict[str, Key]) -> None:
+    response.set_rcode(dns.rcode.NXDOMAIN)
+
+    add_signed(response.authority, soa_rrset(TLD), keys[TLD])
+
+    # The owner name derives zone "tld.test.", but the RRSIG signer is the
+    # malicious child zone "1b40241kforiog780n4ikscrlvetpctq.tld.test.".
+    add_signed(response.authority, child_nsec3_rrset(), keys[ATTACKER])
+
+
+class VictimForgedNxdomainHandler(SignedResponseHandler):
+    """
+    This serves the forged response for the victim's domain.
+    """
+
+    def match(self, qctx: QueryContext) -> bool:
+        return qctx.qname == name(VICTIM) and qctx.qtype == dns.rdatatype.A
+
+    def respond(self, qctx: QueryContext) -> None:
+        forged_nxdomain(qctx.response, self.keys)
+
+
+class ChildDsHandler(SignedResponseHandler):
+    """
+    This will spoof the response for the malicious zone when qtype is DS.
+    It is actually a validly signed DS response.
+    """
+
+    def match(self, qctx: QueryContext) -> bool:
+        return qctx.qname == name(ATTACKER) and qctx.qtype == dns.rdatatype.DS
+
+    def respond(self, qctx: QueryContext) -> None:
+        response = qctx.response
+        zone = ATTACKER
+        child_key = self.keys[ATTACKER]
+        parent_key = self.keys[TLD]
+
+        add_signed(response.answer, ds_rrset(zone, child_key), parent_key)
+
+
+class AttackerZoneHandler(SignedResponseHandler):
+    """
+    Acts as the malicious authoritative name server. The zone being served
+    is the hashed label of the parent zone (tld.test). This will respond
+    for all queries qtype SOA, DNSKEY, NS at the apex. Any names below
+    the apex are answered with an NXDOMAIN with no NSEC or NSEC3 present.
+    """
+
+    def match(self, qctx: QueryContext) -> bool:
+        return qctx.qname.is_subdomain(name(ATTACKER))
+
+    def respond(self, qctx: QueryContext) -> None:
+        if qctx.qname == name(ATTACKER):
+            if qctx.qtype == dns.rdatatype.DNSKEY:
+                answer_dnskey(qctx.response, ATTACKER, self.keys[ATTACKER])
+            elif qctx.qtype == dns.rdatatype.SOA:
+                answer_soa(qctx.response, ATTACKER, self.keys[ATTACKER])
+            else:
+                answer_ns(
+                    qctx.response, ATTACKER, f"ns.{ATTACKER}", self.keys[ATTACKER]
+                )
+                qctx.response.additional.append(glue_rrset(f"ns.{ATTACKER}", AUTH_IP))
+            return
+
+        qctx.response.set_rcode(dns.rcode.NXDOMAIN)
+        add_signed(qctx.response.authority, soa_rrset(ATTACKER), self.keys[ATTACKER])
+
+
+class TldZoneHandler(SignedResponseHandler):
+    """
+    Acts as the TLD who is being used in the attack, but is not a standard
+    name server. It only responds with validly signed records for DNSKEY, SOA
+    and NS on the apex. Any names below the apex are answered with an NXDOMAIN
+    with no NSEC or NSEC3 present.
+
+    If we turn this into a regular name server than the attack won't work.
+    The attack assumes that the adversary can inject these responses on-path.
+    """
+
+    def match(self, qctx: QueryContext) -> bool:
+        return qctx.qname.is_subdomain(name(TLD))
+
+    def respond(self, qctx: QueryContext) -> None:
+        if qctx.qname == name(TLD):
+            if qctx.qtype == dns.rdatatype.DNSKEY:
+                answer_dnskey(qctx.response, TLD, self.keys[TLD])
+            elif qctx.qtype == dns.rdatatype.SOA:
+                answer_soa(qctx.response, TLD, self.keys[TLD])
+            else:
+                answer_ns(qctx.response, TLD, "ns.tld.test.", self.keys[TLD])
+                qctx.response.additional.append(glue_rrset("ns.tld.test.", AUTH_IP))
+            return
+
+        qctx.response.set_rcode(dns.rcode.NXDOMAIN)
+        add_signed(qctx.response.authority, soa_rrset(TLD), self.keys[TLD])
+
+
+def main() -> None:
+    keys = load_keys()
+    server = AsyncDnsServer(default_aa=True)
+    server.install_response_handlers(
+        VictimForgedNxdomainHandler(keys),
+        ChildDsHandler(keys),
+        AttackerZoneHandler(keys),
+        TldZoneHandler(keys),
+    )
+    server.run()
+
+
+if __name__ == "__main__":
+    main()
+diff --git a/bin/tests/system/nsec3_impersonation/ns2/named.conf.j2 b/bin/tests/system/nsec3_impersonation/ns2/named.conf.j2
+new file mode 100644
+index 0000000000..2c9b0bba9e
+--- /dev/null
+++ b/bin/tests/system/nsec3_impersonation/ns2/named.conf.j2
+@@ -0,0 +1,33 @@
+// validating resolver
+
+options {
+	query-source address 10.53.0.2;
+	notify-source 10.53.0.2;
+	transfer-source 10.53.0.2;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.2; };
+	listen-on-v6 { none; };
+	recursion yes;
+	dnssec-validation yes;
+};
+
+controls {
+	inet 10.53.0.2 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+include "../../_common/rndc.key";
+
+zone "." {
+	type hint;
+	file "../../_common/root.hint";
+};
+
+zone "tld.test" {
+	type static-stub;
+	server-addresses { 10.53.0.1; };
+};
+
+trust-anchors {
+	tld.test. static-key 257 3 13 "@TLD_DNSKEY@";
+};
+diff --git a/bin/tests/system/nsec3_impersonation/tests_nsec3_impersonation.py b/bin/tests/system/nsec3_impersonation/tests_nsec3_impersonation.py
+new file mode 100644
+index 0000000000..bd9bd275b6
+--- /dev/null
+++ b/bin/tests/system/nsec3_impersonation/tests_nsec3_impersonation.py
+@@ -0,0 +1,152 @@
+#!/usr/bin/python3
+
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+from pathlib import Path
+
+import json
+
+from cryptography.hazmat.primitives import serialization
+from cryptography.hazmat.primitives.asymmetric import ec
+
+import dns.dnssec
+import dns.flags
+import dns.name
+import dns.rdataclass
+import dns.rdatatype
+import pytest
+
+import isctest
+import isctest.mark
+
+APEX_HASH = "1B40241KFORIOG780N4IKSCRLVETPCTQ"
+ATTACKER = f"{APEX_HASH.lower()}.tld.test."
+VICTIM = "victim.tld.test."
+AUTH = "10.53.0.1"
+RESOLVER = "10.53.0.2"
+
+pytestmark = [
+    isctest.mark.with_ecdsa_deterministic,
+    pytest.mark.extra_artifacts(
+        [
+            "ans*/ans.run",
+            "ans*/keys.json",
+        ]
+    ),
+]
+
+
+def _make_key(zone):
+    private_key = ec.generate_private_key(ec.SECP256R1())
+    dnskey = dns.dnssec.make_dnskey(
+        private_key.public_key(),
+        algorithm="ECDSAP256SHA256",
+        flags=257,
+    )
+    ds = dns.dnssec.make_ds(dns.name.from_text(zone), dnskey, "SHA256")
+    private_pem = private_key.private_bytes(
+        encoding=serialization.Encoding.PEM,
+        format=serialization.PrivateFormat.PKCS8,
+        encryption_algorithm=serialization.NoEncryption(),
+    ).decode("ascii")
+    return {
+        "private_pem": private_pem,
+        "dnskey": dnskey.to_text(),
+        "ds": ds.to_text(),
+    }
+
+
+def bootstrap():
+    zones = ["tld.test.", ATTACKER]
+    keys = {zone: _make_key(zone) for zone in zones}
+
+    Path("ans1/keys.json").write_text(json.dumps(keys, indent=2), encoding="ascii")
+
+    tld_dnskey = "".join(keys["tld.test."]["dnskey"].split()[3:])
+    return {"TLD_DNSKEY": tld_dnskey}
+
+
+def check_dnskey_response(zone):
+    query = isctest.query.create(zone, "DNSKEY")
+    response = isctest.query.tcp(query, AUTH)
+
+    isctest.check.noerror(response)
+    assert response.flags & dns.flags.AA
+    assert (
+        response.get_rrset(
+            response.answer,
+            dns.name.from_text(zone),
+            dns.rdataclass.IN,
+            dns.rdatatype.DNSKEY,
+        )
+        is not None
+    ), response
+
+
+def check_ds_response(zone):
+    query = isctest.query.create(zone, "DS")
+    response = isctest.query.tcp(query, AUTH)
+
+    isctest.check.noerror(response)
+    assert response.flags & dns.flags.AA
+    assert (
+        response.get_rrset(
+            response.answer,
+            dns.name.from_text(zone),
+            dns.rdataclass.IN,
+            dns.rdatatype.DS,
+        )
+        is not None
+    ), response
+
+
+def test_attack_responses():
+    check_dnskey_response("tld.test.")
+    check_dnskey_response(ATTACKER)
+    check_ds_response(ATTACKER)
+
+    query = isctest.query.create(VICTIM, "A")
+    response = isctest.query.tcp(query, AUTH)
+
+    isctest.check.nxdomain(response)
+    assert response.flags & dns.flags.AA
+
+    nsec3_owner = dns.name.from_text(f"{APEX_HASH}.tld.test.")
+    nsec3 = response.get_rrset(
+        response.authority,
+        nsec3_owner,
+        dns.rdataclass.IN,
+        dns.rdatatype.NSEC3,
+    )
+    rrsig = response.get_rrset(
+        response.authority,
+        nsec3_owner,
+        dns.rdataclass.IN,
+        dns.rdatatype.RRSIG,
+        covers=dns.rdatatype.NSEC3,
+    )
+
+    assert nsec3 is not None, response
+    assert rrsig is not None, response
+    assert rrsig[0].signer == dns.name.from_text(ATTACKER)
+
+
+def test_nsec3_impersonation():
+    """
+    Reproducer for #5874:
+    F-006 DNSSEC Validation Bypass NSEC3 Apex Hash Label Parent Impersonation
+    """
+    query = isctest.query.create(VICTIM, "A")
+    response = isctest.query.tcp(query, RESOLVER)
+
+    isctest.check.noadflag(response)
+    isctest.check.servfail(response)
+diff --git a/bin/tests/system/qmin/ans2/ans.py b/bin/tests/system/qmin/ans2/ans.py
+index d372c2003b..9343fbc8ef 100755
+--- a/bin/tests/system/qmin/ans2/ans.py
+++ b/bin/tests/system/qmin/ans2/ans.py
+@@ -15,11 +15,12 @@ import sys
+ import signal
+ import socket
+ import select
+-from datetime import datetime, timedelta
+ import time
+-import functools
+ 
+-import dns, dns.message, dns.query, dns.flags
+import dns
+import dns.message
+import dns.query
+import dns.flags
+ from dns.rdatatype import *
+ from dns.rdataclass import *
+ from dns.rcode import *
+@@ -432,9 +433,9 @@ else:
+ while running:
+     try:
+         inputready, outputready, exceptready = select.select(input, [], [])
+-    except select.error as e:
+    except select.error:
+         break
+-    except socket.error as e:
+    except socket.error:
+         break
+     except KeyboardInterrupt:
+         break
+diff --git a/bin/tests/system/qmin/ans3/ans.py b/bin/tests/system/qmin/ans3/ans.py
+index b5ae73c3fa..4e7250790f 100755
+--- a/bin/tests/system/qmin/ans3/ans.py
+++ b/bin/tests/system/qmin/ans3/ans.py
+@@ -15,11 +15,12 @@ import sys
+ import signal
+ import socket
+ import select
+-from datetime import datetime, timedelta
+ import time
+-import functools
+ 
+-import dns, dns.message, dns.query, dns.flags
+import dns
+import dns.message
+import dns.query
+import dns.flags
+ from dns.rdatatype import *
+ from dns.rdataclass import *
+ from dns.rcode import *
+@@ -261,9 +262,9 @@ else:
+ while running:
+     try:
+         inputready, outputready, exceptready = select.select(input, [], [])
+-    except select.error as e:
+    except select.error:
+         break
+-    except socket.error as e:
+    except socket.error:
+         break
+     except KeyboardInterrupt:
+         break
+diff --git a/bin/tests/system/qmin/ans4/ans.py b/bin/tests/system/qmin/ans4/ans.py
+index 517217aec1..2d5556daff 100755
+--- a/bin/tests/system/qmin/ans4/ans.py
+++ b/bin/tests/system/qmin/ans4/ans.py
+@@ -15,11 +15,12 @@ import sys
+ import signal
+ import socket
+ import select
+-from datetime import datetime, timedelta
+ import time
+-import functools
+ 
+-import dns, dns.message, dns.query, dns.flags
+import dns
+import dns.message
+import dns.query
+import dns.flags
+ from dns.rdatatype import *
+ from dns.rdataclass import *
+ from dns.rcode import *
+@@ -320,9 +321,9 @@ else:
+ while running:
+     try:
+         inputready, outputready, exceptready = select.select(input, [], [])
+-    except select.error as e:
+    except select.error:
+         break
+-    except socket.error as e:
+    except socket.error:
+         break
+     except KeyboardInterrupt:
+         break
+diff --git a/bin/tests/system/resolver/ans10/ans.py b/bin/tests/system/resolver/ans10/ans.py
+index 6e95dbbfc6..d637c63e5a 100644
+--- a/bin/tests/system/resolver/ans10/ans.py
+++ b/bin/tests/system/resolver/ans10/ans.py
+@@ -15,11 +15,11 @@ import sys
+ import signal
+ import socket
+ import select
+-from datetime import datetime, timedelta
+-import time
+-import functools
+ 
+-import dns, dns.message, dns.query, dns.flags
+import dns
+import dns.message
+import dns.query
+import dns.flags
+ from dns.rdatatype import *
+ from dns.rdataclass import *
+ from dns.rcode import *
+@@ -128,9 +128,9 @@ else:
+ while running:
+     try:
+         inputready, outputready, exceptready = select.select(input, [], [])
+-    except select.error as e:
+    except select.error:
+         break
+-    except socket.error as e:
+    except socket.error:
+         break
+     except KeyboardInterrupt:
+         break
+-- 
+2.55.0
+
--- a/bind-9.18-CVE-2026-10723.patch
+++ b/bind-9.18-CVE-2026-10723.patch
@ -0,0 +1,67 @@
+From 608026780a43abe5b23a9af3af21808369032158 Mon Sep 17 00:00:00 2001
+From: Evan Hunt <each@isc.org>
+Date: Thu, 21 May 2026 14:41:55 -0700
+Subject: [PATCH] Check NSEC3 signer matches the owning zone
+
+When validating NSEC3 records, reject any signature whose signer field
+does not match the zone owning the NSEC3.
+
+This ensures that a child zone cannot impersonate its parent and forge
+NXDOMAIN responses for sibling domains.
+
+Fixes: isc-projects/bind9#5874
+(cherry picked from commit 6e5066bb1f0f12d090e8707adb7d6ccf74f8012b)
+(cherry picked from commit c9cb6a5e24e43489cf3fd4d4cc2193b6a74499cb)
+---
+ lib/dns/dnssec.c | 19 +++++++++++++++++--
+ lib/isc/result.c |  2 +-
+ 2 files changed, 18 insertions(+), 3 deletions(-)
+
+diff --git a/lib/dns/dnssec.c b/lib/dns/dnssec.c
+index b12529b5d5..9b9b1f2bb2 100644
+--- a/lib/dns/dnssec.c
+++ b/lib/dns/dnssec.c
+@@ -424,10 +424,25 @@ dns_dnssec_verify(const dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
+ 	}
+ 
+ 	/*
+-	 * NS, SOA and DNSKEY records are signed by their owner.
+-	 * DS records are signed by the parent.
+	 * NS, SOA and DNSKEY records are signed by their owners.
+	 * NSEC3 records are signed by the apex, exactly one level up
+	 * from their owner names.
+	 * DS records are signed by the parent zone.
+ 	 */
+ 	switch (set->type) {
+	case dns_rdatatype_nsec3: {
+		dns_name_t apex = DNS_NAME_INITEMPTY;
+		labels = dns_name_countlabels(name);
+		if (labels <= 1) {
+			inc_stat(dns_dnssecstats_fail);
+			return DNS_R_INVALIDNSEC3;
+		}
+		dns_name_split(name, labels - 1, NULL, &apex);
+		if (!dns_name_equal(&apex, &sig.signer)) {
+			inc_stat(dns_dnssecstats_fail);
+			return DNS_R_SIGINVALID;
+		}
+	} break;
+ 	case dns_rdatatype_ns:
+ 	case dns_rdatatype_soa:
+ 	case dns_rdatatype_dnskey:
+diff --git a/lib/isc/result.c b/lib/isc/result.c
+index 83e8cfeed7..b76c3d1f7b 100644
+--- a/lib/isc/result.c
+++ b/lib/isc/result.c
+@@ -198,7 +198,7 @@ static const char *description[ISC_R_NRESULTS] = {
+ 	[DNS_R_COVERINGNSEC] = "covering NSEC record returned",
+ 	[DNS_R_MXISADDRESS] = "MX is an address",
+ 	[DNS_R_DUPLICATE] = "duplicate query",
+-	[DNS_R_INVALIDNSEC3] = "invalid NSEC3 owner name (wildcard)",
+	[DNS_R_INVALIDNSEC3] = "invalid NSEC3 owner name",
+ 	[DNS_R_NOTPRIMARY] = "not primary",
+ 	[DNS_R_BROKENCHAIN] = "broken trust chain",
+ 	[DNS_R_EXPIRED] = "expired",
+-- 
+2.55.0
+
--- a/bind-9.18-CVE-2026-10822-test.patch
+++ b/bind-9.18-CVE-2026-10822-test.patch
@ -0,0 +1,320 @@
+From a4ce4c0ce5b8d7630417730dc1b98bf554e0801f Mon Sep 17 00:00:00 2001
+From: Mark Andrews <marka@isc.org>
+Date: Tue, 19 May 2026 10:44:04 +1000
+Subject: [PATCH] Check that dns_name_fromwire honours the active region
+
+When reading DNS records from the wire the active region of the
+source buffer is set to the end of the current record. dns_name_fromwire
+should fail if it attempts to read past this setting.
+
+(cherry picked from commit 3ed821d68b15fe4e6288e3054397d6bce7e65968)
+(cherry picked from commit d413c9ac2e29a728531354a69c8c8234c01b7d1e)
+
+Check that a short PRIVATEDNS record is rejected
+
+A bug in dns_name_fromwire meant that short PRIVATEDNS key
+records where being accepted.  Test that this is no longer
+the case.
+
+(cherry picked from commit f48d48027384d8c2210b5ce9e3eac7af101ead3d)
+(cherry picked from commit 19ac8b8e46aeb0a15e217bc7bdf485b31b87d9b4)
+
+POC for PRIVATEDNS DNSKEY overrun not being detected
+
+Construct a DNS message where a PRIVATEDNS DNSKEY identifier
+overruns the record boundary by 3 byte so that the label ends
+at the end of the compression pointer for the next record. The
+next type is less than 256 so the next octet is 00 terminating
+the identifier name.  The transfered zone is then written to
+disk using master-format text triggering the assertion when the
+truncated identier is discovered.
+
+Note this test will produce a false result in versions of
+BIND that do not check the PRIVATEDNS identifier as it looks
+for the error message when the transfer is aborted.
+
+(cherry picked from commit 9ce3bce8bc8b4e9c6a9b1e84b5849c33eb27830e)
+(cherry picked from commit 8e066d3fc369e3346f22bb5cfb67a7ab08a74034)
+---
+ bin/tests/system/xfer/ans9/ans.py       | 142 ++++++++++++++++++++++++
+ bin/tests/system/xfer/ns6/named.conf.in |   9 ++
+ bin/tests/system/xfer/tests.sh          |  16 +++
+ tests/dns/name_test.c                   |  30 +++++
+ tests/dns/rdata_test.c                  |  21 ++++
+ 5 files changed, 218 insertions(+)
+ create mode 100644 bin/tests/system/xfer/ans9/ans.py
+
+diff --git a/bin/tests/system/xfer/ans9/ans.py b/bin/tests/system/xfer/ans9/ans.py
+new file mode 100644
+index 0000000000..a9e73953ee
+--- /dev/null
+++ b/bin/tests/system/xfer/ans9/ans.py
+@@ -0,0 +1,142 @@
+"""
+Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+
+SPDX-License-Identifier: MPL-2.0
+
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0.  If a copy of the MPL was not distributed with this
+file, you can obtain one at https://mozilla.org/MPL/2.0/.
+
+See the COPYRIGHT file distributed with this work for additional
+information regarding copyright ownership.
+"""
+
+from collections.abc import AsyncGenerator
+
+import dns.name
+import dns.rcode
+import dns.rdatatype
+import dns.rrset
+
+from isctest.asyncserver import (
+    ControllableAsyncDnsServer,
+    DnsResponseSend,
+    DomainHandler,
+    QueryContext,
+    ResponseAction,
+    ToggleResponsesCommand,
+)
+
+
+class AXFRServer(DomainHandler):
+    """
+    Yield SOA and AXFR responses. Every new AXFR response increments the SOA
+    version.
+    """
+
+    domains = ["xfr-and-reconfig", "private-dns-overrun"]
+
+    def __init__(self) -> None:
+        super().__init__()
+        self.soa_version = 0
+
+    async def get_responses(
+        self, qctx: QueryContext
+    ) -> AsyncGenerator[ResponseAction, None]:
+        # This is oversimplified because I am lazy - we are appending the SOA
+        # RRset to the ANSWER section for _every_ QTYPE.  named is only
+        # expected to send a SOA query over UDP and then an AXFR query over
+        # TCP.  Responses to both of those start with a SOA RRset in the ANSWER
+        # section :-)
+        soa_message = qctx.response
+        soa_rrset = dns.rrset.from_text(
+            qctx.qname,
+            300,
+            qctx.qclass,
+            dns.rdatatype.SOA,
+            f". . {self.soa_version} 0 0 0 0",
+        )
+        soa_message.answer.append(soa_rrset)
+
+        yield DnsResponseSend(soa_message)
+
+        if qctx.qtype == dns.rdatatype.SOA:
+            # If QTYPE=SOA, the SOA record is the complete response.
+            return
+
+        if qctx.qtype != dns.rdatatype.AXFR:
+            # If QTYPE=AXFR, we will continue cramming RRsets into the ANSWER
+            # section of a subsequent DNS message below.
+            #
+            # If QTYPE was not SOA or AXFR, abort.  Yeah, we just sent a broken
+            # response by yielding DnsResponseSend() with a SOA RRset in the
+            # ANSWER section above.  We will have to carry that burden for the
+            # rest of our lives.
+            return
+
+        # Send just the obligatory NS RRset at zone apex in the next message.
+        # This is stupidly inefficient, but makes looping below simpler as we
+        # will already have been done with the mandatory stuff by then.
+        ns_message = qctx.prepare_new_response()
+        ns_rrset = dns.rrset.from_text(
+            qctx.qname, 300, qctx.qclass, dns.rdatatype.NS, "."
+        )
+        ns_message.answer.append(ns_rrset)
+
+        yield DnsResponseSend(ns_message)
+
+        # Generate the AXFR with a txt rrset.
+        txt_message = qctx.prepare_new_response()
+        txt_rrset = dns.rrset.from_text(
+            qctx.qname,
+            300,
+            qctx.qclass,
+            dns.rdatatype.TXT,
+            "foo bar",
+        )
+        txt_message.answer.append(txt_rrset)
+
+        yield DnsResponseSend(txt_message)
+
+        if qctx.qname == dns.name.from_text("private-dns-overrun"):
+            # A message where the malformed DNSKEY algorithm identifier
+            # finishes on a 00 byte in the next record. Assumes the
+            # next record starts with a compression pointer which is
+            # followed by the type which starts with 00.
+
+            # Generate malformed PRIVATE DNS DNSKEY
+            dnskey_message = qctx.prepare_new_response()
+            dnskey_rrset = dns.rrset.from_text(
+                qctx.qname,
+                300,
+                qctx.qclass,
+                dns.rdatatype.DNSKEY,
+                "\\# 12 00 00 00 fd 09 00 00 00 00 00 00 00",
+            )
+            dnskey_message.answer.append(dnskey_rrset)
+            # Generate well formed PRIVATE DNS DNSKEY
+            dnskey_rrset = dns.rrset.from_text(
+                qctx.qname,
+                300,
+                qctx.qclass,
+                dns.rdatatype.DNSKEY,
+                "\\# 12 00 00 00 fd 06 00 00 00 00 00 00 00",
+            )
+            dnskey_message.answer.append(dnskey_rrset)
+
+            yield DnsResponseSend(dnskey_message)
+
+        # Finish the AXFR transaction by sending the second SOA RRset.
+        yield DnsResponseSend(soa_message)
+
+        # This makes sure that the next SOA request causes a new zone transfer
+        self.soa_version += 1
+
+
+if __name__ == "__main__":
+    server = ControllableAsyncDnsServer(
+        default_aa=True, default_rcode=dns.rcode.NOERROR
+    )
+    server.install_control_command(ToggleResponsesCommand())
+    server.install_response_handler(AXFRServer())
+    server.run()
+diff --git a/bin/tests/system/xfer/ns6/named.conf.in b/bin/tests/system/xfer/ns6/named.conf.in
+index 142383c89a..63809448f0 100644
+--- a/bin/tests/system/xfer/ns6/named.conf.in
+++ b/bin/tests/system/xfer/ns6/named.conf.in
+@@ -83,3 +83,12 @@ zone "ixfr-too-big" {
+ 	primaries { 10.53.0.1; };
+ 	file "ixfr-too-big.bk";
+ };
+
+# GL#6004
+zone "private-dns-overrun" {
+	type secondary;
+	primaries { 10.53.0.9; };
+	file "private-dns-overrun.bk";
+	masterfile-format text; # force bug to be exercised
+	request-ixfr no; # ans9 supports only axfr
+};
+diff --git a/bin/tests/system/xfer/tests.sh b/bin/tests/system/xfer/tests.sh
+index a2c0adbc28..e08be175b7 100755
+--- a/bin/tests/system/xfer/tests.sh
+++ b/bin/tests/system/xfer/tests.sh
+@@ -622,5 +622,21 @@ if [ $tmp -eq 0 ]; then
+ fi
+ status=$((status + tmp))
+ 
+# def test_malformed_private_dns_identifier_overrun(ns6):
+#    isctest.log.info(
+#        "Check that a malformed PRIVATEDNS DNSKEY which overruns the record is rejected"
+#    )
+#    with ns6.watch_log_from_start(timeout=60) as watcher_transfer_completed:
+#        watcher_transfer_completed.wait_for_line(
+#            "zone private-dns-overrun/IN: zone transfer finished: unexpected end of input"
+#        )
+n=$((n + 1))
+echo_i "Check that a malformed PRIVATEDNS DNSKEY which overruns the record is rejected ($n)"
+tmp=0
+nextpartreset ns6/named.run
+retry 60 wait_for_message "zone private-dns-overrun/IN: zone transfer finished: unexpected end of input" || tmp=1
+if test $tmp != 0; then echo_i "failed"; fi
+status=$((status + tmp))
+
+ echo_i "exit status: $status"
+ [ $status -eq 0 ] || exit 1
+diff --git a/tests/dns/name_test.c b/tests/dns/name_test.c
+index fb34dcace1..95f6598eb8 100644
+--- a/tests/dns/name_test.c
+++ b/tests/dns/name_test.c
+@@ -335,6 +335,35 @@ ISC_RUN_TEST_IMPL(fromregion) {
+ 	assert_false(dns_name_isabsolute(&name));
+ }
+ 
+ISC_RUN_TEST_IMPL(fromwire) {
+	dns_decompress_t dctx;
+	dns_fixedname_t fixed;
+	dns_name_t *name = dns_fixedname_initname(&fixed);
+	isc_buffer_t b;
+	unsigned char source[] = { 0x03, 'o', 'n', 'e',	 0x00, 0x03,
+				   't',	 'w', 'o', 0x00, 0x05, 't',
+				   'h',	 'r', 'e', 'e',	 0x00 };
+	isc_result_t result;
+
+	isc_buffer_init(&b, source, sizeof(source));
+	isc_buffer_add(&b, sizeof(source));
+	isc_buffer_setactive(&b, 10); /* names 'one.' and 'two.' */
+
+	/*
+	 * We should only be able to read two names from the buffer
+	 * as the active region has been set to cover only the first
+	 * two.
+	 */
+	dns_decompress_init(&dctx, -1, DNS_DECOMPRESS_STRICT);
+	dns_decompress_setmethods(&dctx, DNS_COMPRESS_NONE);
+	result = dns_name_fromwire(name, &b, &dctx, 0, NULL);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	result = dns_name_fromwire(name, &b, &dctx, 0, NULL);
+	assert_int_equal(result, ISC_R_SUCCESS);
+	result = dns_name_fromwire(name, &b, &dctx, 0, NULL);
+	assert_int_not_equal(result, ISC_R_SUCCESS);
+}
+
+ /* is trust-anchor-telemetry test */
+ ISC_RUN_TEST_IMPL(istat) {
+ 	dns_fixedname_t fixed;
+@@ -778,6 +807,7 @@ ISC_TEST_LIST_START
+ ISC_TEST_ENTRY(fullcompare)
+ ISC_TEST_ENTRY(compression)
+ ISC_TEST_ENTRY(fromregion)
+ISC_TEST_ENTRY(fromwire)
+ ISC_TEST_ENTRY(istat)
+ ISC_TEST_ENTRY(init)
+ ISC_TEST_ENTRY(invalidate)
+diff --git a/tests/dns/rdata_test.c b/tests/dns/rdata_test.c
+index 6354819d10..7f0df6e046 100644
+--- a/tests/dns/rdata_test.c
+++ b/tests/dns/rdata_test.c
+@@ -2199,6 +2199,27 @@ ISC_RUN_TEST_IMPL(key) {
+ 
+ 	check_rdata(NULL, wire_ok, NULL, false, dns_rdataclass_in,
+ 		    dns_rdatatype_key, sizeof(dns_rdata_key_t));
+
+	/*
+	 * A valid PRIVATEDNS record with an active region shorter than the
+	 * actual record length.  A bug in dns_name_fromwire meant that this
+	 * was previously accepted.
+	 */
+	dns_decompress_t dctx;
+	unsigned char key[] = { 0x00, 0x00, 0x00, 253, 0x07, 'e', 'x',
+				'a',  'm',  'p',  'l', 'e',  0x00 };
+	unsigned char buf[sizeof(key)];
+	isc_buffer_t source, target;
+	isc_result_t result;
+
+	isc_buffer_init(&source, key, sizeof(key));
+	isc_buffer_add(&source, sizeof(key));
+	isc_buffer_setactive(&source, sizeof(key) - 1);
+	isc_buffer_init(&target, buf, sizeof(buf));
+	dns_decompress_init(&dctx, -1, DNS_DECOMPRESS_ANY);
+	result = dns_rdata_fromwire(NULL, dns_rdataclass_in, dns_rdatatype_key,
+				    &source, &dctx, 0, &target);
+	assert_int_not_equal(result, ISC_R_SUCCESS);
+ }
+ 
+ /*
+-- 
+2.55.0
+
--- a/bind-9.18-CVE-2026-10822.patch
+++ b/bind-9.18-CVE-2026-10822.patch
@ -0,0 +1,54 @@
+From 7596cbc240b0492461943f7c34d040fb66a7554c Mon Sep 17 00:00:00 2001
+From: Mark Andrews <marka@isc.org>
+Date: Tue, 19 May 2026 15:00:17 +1000
+Subject: [PATCH] Fix the yaml query zone name code in dnstap-read
+
+When the buffer to read the query zone name was constructed
+isc_buffer_setactive was not called.  This is now needed as
+dns_name_fromwire is being corrected to check the active region.
+
+(cherry picked from commit a25522c28c46655a81d2bf1d96374c81d834b157)
+(cherry picked from commit a5f1a9d0d2ec021618924b14202ac96ead8299c1)
+
+Fix dns_name_fromwire to honour the active region
+
+dns_name_fromwire was not honouring the source buffer's active
+region when reading names from the wire.  This allowed malformed
+records to be accepted when they shouldn't have been.  This has
+been corrected.
+
+(cherry picked from commit 7c4f07a7ef6b571073327b02209df7f75b9363ff)
+(cherry picked from commit e73b70a64453e7d97a11cb5f0afe8bb02d34aaf8)
+---
+ bin/tools/dnstap-read.c | 1 +
+ lib/dns/name.c          | 2 +-
+ 2 files changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/bin/tools/dnstap-read.c b/bin/tools/dnstap-read.c
+index a1d0243a1a..bb78ae12b1 100644
+--- a/bin/tools/dnstap-read.c
+++ b/bin/tools/dnstap-read.c
+@@ -298,6 +298,7 @@ print_yaml(dns_dtdata_t *dt) {
+ 
+ 		isc_buffer_init(&b, m->query_zone.data, m->query_zone.len);
+ 		isc_buffer_add(&b, m->query_zone.len);
+		isc_buffer_setactive(&b, m->query_zone.len);
+ 
+ 		dns_decompress_init(&dctx, -1, DNS_DECOMPRESS_NONE);
+ 		result = dns_name_fromwire(name, &b, &dctx, 0, NULL);
+diff --git a/lib/dns/name.c b/lib/dns/name.c
+index cc0e30e5b5..2ce868a2ba 100644
+--- a/lib/dns/name.c
+++ b/lib/dns/name.c
+@@ -1833,7 +1833,7 @@ dns_name_fromwire(dns_name_t *const name, isc_buffer_t *const source,
+ 	 * The amount of the source we consumed is set once.
+ 	 */
+ 	const uint8_t *const source_buf = isc_buffer_base(source);
+-	const uint8_t *const source_max = isc_buffer_used(source);
+	const uint8_t *const source_max = isc_buffer_active(source);
+ 	const uint8_t *const start = isc_buffer_current(source);
+ 	const uint8_t *marker = start;
+ 	const uint8_t *cursor = start;
+-- 
+2.55.0
+
--- a/bind-9.18-CVE-2026-11331-test.patch
+++ b/bind-9.18-CVE-2026-11331-test.patch
@ -0,0 +1,69 @@
+From cde8bb21e09205a7bd1f41fd07ed011fc80d8d71 Mon Sep 17 00:00:00 2001
+From: Mark Andrews <marka@isc.org>
+Date: Fri, 10 Apr 2026 10:24:06 +1000
+Subject: [PATCH] Fix TTL extraction from A/AAAA record
+
+(cherry picked from commit 89c86e338db2492b92e6618c586f146c6928dc6d)
+(cherry picked from commit adc8285d23e2eac6ec463f5dbc5a9596fdd36c60)
+
+Check rpz name too long wildcard CNAME expansion handling
+
+(cherry picked from commit 9345394e2097031b55b3ef34ceaadf5a7ebbeef2)
+(cherry picked from commit 095b11f20f911f5b8059bdc349b256d6c64ece30)
+---
+ bin/tests/system/rpz/ns2/tld2.db | 2 ++
+ bin/tests/system/rpz/ns4/tld4.db | 2 ++
+ bin/tests/system/rpz/tests.sh    | 7 +++++--
+ 3 files changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/bin/tests/system/rpz/ns2/tld2.db b/bin/tests/system/rpz/ns2/tld2.db
+index c6f2556db5..c091ee27b7 100644
+--- a/bin/tests/system/rpz/ns2/tld2.db
+++ b/bin/tests/system/rpz/ns2/tld2.db
+@@ -123,3 +123,5 @@ a7-1		A	192.168.7.1
+ 
+ a7-2		A	192.168.7.2
+ 		TXT	"a7-2 tld2 text"
+
+*.wild		A	192.168.9.1
+diff --git a/bin/tests/system/rpz/ns4/tld4.db b/bin/tests/system/rpz/ns4/tld4.db
+index fca419c6dd..8accd76baf 100644
+--- a/bin/tests/system/rpz/ns4/tld4.db
+++ b/bin/tests/system/rpz/ns4/tld4.db
+@@ -59,6 +59,8 @@ a3-6.tld2	A	56.56.56.56
+ 
+ a3-7.sub1.tld2	A	57.57.57.57
+ 
+*.wild.sub1.tld2	A	57.57.57.57
+
+ a3-8.tld2	A	58.58.58.58
+ 
+ a3-9.sub9.tld2	A	59.59.59.59
+diff --git a/bin/tests/system/rpz/tests.sh b/bin/tests/system/rpz/tests.sh
+index 87e4118ca3..5297437694 100644
+--- a/bin/tests/system/rpz/tests.sh
+++ b/bin/tests/system/rpz/tests.sh
+@@ -391,7 +391,7 @@ addr() {
+   digcmd $2 >$DIGNM
+   #ckalive "$2" "server crashed by 'dig $2'" || return 1
+   ADDR_ESC=$(echo "$ADDR" | sed -e 's/\./\\./g')
+-  ADDR_TTL=$(sed -n -e "s/^[-.a-z0-9]\{1,\}[	 ]*\([0-9]*\)	IN	AA*	${ADDR_ESC}\$/\1/p" $DIGNM)
+  ADDR_TTL=$(sed -n -e "s/^[-.a-z0-9]\{1,\}[	 ]*\([0-9]*\)[ 	]IN[ 	]AA*[ 	]${ADDR_ESC}\$/\1/p" $DIGNM)
+   if test -z "$ADDR_TTL"; then
+     setret "'dig $2' wrong; no address $ADDR record in $DIGNM"
+     return 0
+@@ -516,7 +516,10 @@ nochange TCP a3-9.tld2                # 33 tcp-only
+ here x.servfail <<'EOF'               # 34 qname-wait-recurse yes
+   ;; status: SERVFAIL, x
+ EOF
+-addr 35.35.35.35 "x.servfail @$ns5" # 35 qname-wait-recurse no
+addr 35.35.35.35 "x.servfail @$ns5"                                                                                                                                                                                                                                    # 35 qname-wait-recurse no
+here aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.wild.sub1.tld2 <<'EOF' # 36 wildcard CNAME name to long
+    ;; status: YXDOMAIN, x
+EOF
+ end_group
+ ckstats $ns3 test1 ns3 22
+ ckstats $ns5 test1 ns5 1
+-- 
+2.55.0
+
--- a/bind-9.18-CVE-2026-11331.patch
+++ b/bind-9.18-CVE-2026-11331.patch
@ -0,0 +1,31 @@
+From 49f4cc4e93f14f1d5b6a472124e6aa457167fede Mon Sep 17 00:00:00 2001
+From: Mark Andrews <marka@isc.org>
+Date: Fri, 10 Apr 2026 10:26:14 +1000
+Subject: [PATCH] Properly handle rpz name to long wildcard expansion
+
+Previously a self referential CNAME and the original address
+record were returned.  We now return a YXDOMAIN response.
+
+(cherry picked from commit cfc4c4f69870ce492deaaa429453563d1621ded3)
+(cherry picked from commit dc328a199f96222e0c30cc20b7b795bfc2c9b2e4)
+---
+ lib/ns/query.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/lib/ns/query.c b/lib/ns/query.c
+index d3a10be9ba..3bd7daf79c 100644
+--- a/lib/ns/query.c
+++ b/lib/ns/query.c
+@@ -7591,7 +7591,8 @@ query_rpzcname(query_ctx_t *qctx, dns_name_t *cname) {
+ 					      qctx->fname, NULL);
+ 		if (result == DNS_R_NAMETOOLONG) {
+ 			client->message->rcode = dns_rcode_yxdomain;
+-		} else if (result != ISC_R_SUCCESS) {
+		}
+		if (result != ISC_R_SUCCESS) {
+ 			return result;
+ 		}
+ 	} else {
+-- 
+2.55.0
+
--- a/bind-9.18-CVE-2026-11622.patch
+++ b/bind-9.18-CVE-2026-11622.patch
@ -0,0 +1,280 @@
+From d7e1f4495d6bac8c29b332e04e9b27140339375b Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@sury.org>
+Date: Tue, 23 Jun 2026 10:59:38 +0200
+Subject: [PATCH] Make the dns_slabheaders in the cache reference counted
+
+Instead of only reference counting the enclosing qpcnode, add the
+reference counting directly to the slabheaders.  The reference is
+incremented when an rdataset is bound to the header and decremented when
+the rdataset is disassociated, so a stale slabheader can be removed from
+the node's down chain as soon as its own reference count reaches zero,
+instead of waiting for the whole qpcnode to become unreferenced.
+
+Building on that, clean up the ancient headers eagerly: mark_ancient()
+is made idempotent, releases the header's own (container) reference and
+reaps the stale headers from the node's down chain as soon as their
+references reach zero.  A header evicted over the per-name type limit is
+expired only after the new rdataset has been bound, so the bind's
+increment always precedes mark_ancient()'s decrement.
+
+Because a header can now be reclaimed independently of its node, the
+rdataset iterators must keep the header they are positioned on alive:
+each iterator takes a reference on its current header and releases it
+when it advances or is destroyed.  Iteration otherwise stays lazy and
+re-reads the node on every step, so it still observes records added to
+the node while the iterator is live, as zone signing requires.
+
+The slab headers are shared with the zone databases, so the matching
+increment is added to every bind path.  The noqname/closest proofs hand
+out rdatasets backed by bare slabs that have no header, so they are
+given a separate dns_rdataproof_rdatasetmethods that leaves the
+reference count untouched.
+
+(cherry picked from commit 2dabf117e1264fd13fb33096f87e78a039fd1c6c)
+(cherry picked from commit 231b1ca3edfb26389e1af39181aa6b4413e87ec4)
+---
+ bin/tests/system/reclimit/tests.sh |  4 +-
+ lib/dns/include/dns/rdataslab.h    |  1 +
+ lib/dns/rbtdb.c                    | 77 +++++++++++++++++++++++++-----
+ 3 files changed, 69 insertions(+), 13 deletions(-)
+
+diff --git a/bin/tests/system/reclimit/tests.sh b/bin/tests/system/reclimit/tests.sh
+index c15225488f..55ccac7759 100644
+--- a/bin/tests/system/reclimit/tests.sh
+++ b/bin/tests/system/reclimit/tests.sh
+@@ -338,13 +338,13 @@ echo_i "checking that NXDOMAIN names over the max-types-per-name limit don't get
+ 
+ # Query for 10 NXDOMAIN types
+ for ntype in $(seq 65270 65279); do
+-  check_manytypes 1 manytypes.big "TYPE${ntype}" NOERROR big SOA 0 || ret=1
+  check_manytypes 1 manytypes.big "TYPE${ntype}" NOERROR big SOA 120 || ret=1
+ done
+ # Wait at least 1 second
+ sleep 1
+ # Query for 10 NXDOMAIN types again - these should not be cached
+ for ntype in $(seq 65270 65279); do
+-  check_manytypes 2 manytypes.big "TYPE${ntype}" NOERROR big SOA 0 || ret=1
+  check_manytypes 2 manytypes.big "TYPE${ntype}" NOERROR big SOA 120 || ret=1
+ done
+ 
+ if [ $ret -ne 0 ]; then echo_i "failed"; fi
+diff --git a/lib/dns/include/dns/rdataslab.h b/lib/dns/include/dns/rdataslab.h
+index 5729c004ca..6bd3b5997d 100644
+--- a/lib/dns/include/dns/rdataslab.h
+++ b/lib/dns/include/dns/rdataslab.h
+@@ -44,6 +44,7 @@
+ #include <stdbool.h>
+ 
+ #include <isc/lang.h>
+#include <isc/refcount.h>
+ 
+ #include <dns/types.h>
+ 
+diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
+index 62bc97d783..0b8547950f 100644
+--- a/lib/dns/rbtdb.c
+++ b/lib/dns/rbtdb.c
+@@ -158,6 +158,7 @@ struct noqname {
+ };
+ 
+ typedef struct rdatasetheader {
+	isc_refcount_t references;
+ 	/*%
+ 	 * Locked by the owning node's lock.
+ 	 */
+@@ -1447,6 +1448,7 @@ init_rdataset(dns_rbtdb_t *rbtdb, rdatasetheader_t *h) {
+ 	h->heap_index = 0;
+ 	atomic_init(&h->attributes, 0);
+ 	atomic_init(&h->last_refresh_fail_ts, 0);
+	isc_refcount_init(&h->references, 1);
+ 
+ 	STATIC_ASSERT(sizeof(h->attributes) == 2,
+ 		      "The .attributes field of rdatasetheader_t needs to be "
+@@ -1559,6 +1561,9 @@ rollback_node(dns_rbtnode_t *node, rbtdb_serial_t serial) {
+ 	}
+ }
+ 
+static void
+clean_stale_headers(dns_rbtdb_t *rbtdb, isc_mem_t *mctx, rdatasetheader_t *top);
+
+ static void
+ mark_header_ancient(dns_rbtdb_t *rbtdb, rdatasetheader_t *header) {
+ 	uint_least16_t attributes = atomic_load_acquire(&header->attributes);
+@@ -1584,8 +1589,12 @@ mark_header_ancient(dns_rbtdb_t *rbtdb, rdatasetheader_t *header) {
+ 	update_rrsetstats(rbtdb, header->type, attributes, false);
+ 	header->node->dirty = 1;
+ 
+	isc_refcount_decrement(&header->references);
+
+ 	/* Increment the stats counter for the ancient RRtype. */
+ 	update_rrsetstats(rbtdb, header->type, newattributes, true);
+
+	clean_stale_headers(rbtdb, rbtdb->common.mctx, header);
+ }
+ 
+ static void
+@@ -1621,12 +1630,19 @@ static void
+ clean_stale_headers(dns_rbtdb_t *rbtdb, isc_mem_t *mctx,
+ 		    rdatasetheader_t *top) {
+ 	rdatasetheader_t *d, *down_next;
+	rdatasetheader_t *down_parent = top;
+ 
+ 	for (d = top->down; d != NULL; d = down_next) {
+ 		down_next = d->down;
+-		free_rdataset(rbtdb, mctx, d);
+		d->next = down_parent;
+
+		if (isc_refcount_current(&d->references) == 0) {
+			free_rdataset(rbtdb, mctx, d);
+			down_parent->down = down_next;
+		} else {
+			down_parent = d;
+		}
+ 	}
+-	top->down = NULL;
+ }
+ 
+ static void
+@@ -1642,6 +1658,7 @@ clean_cache_node(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node) {
+ 	for (current = node->data; current != NULL; current = top_next) {
+ 		top_next = current->next;
+ 		clean_stale_headers(rbtdb, mctx, current);
+		INSIST(current->down == NULL);
+ 		/*
+ 		 * If current is nonexistent, ancient, or stale and
+ 		 * we are not keeping stale, we can clean it up.
+@@ -3114,6 +3131,8 @@ bind_rdataset(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node, rdatasetheader_t *header,
+ 		return;
+ 	}
+ 
+	isc_refcount_increment(&header->references);
+
+ 	dns__rbtnode_acquire(rbtdb, node, locktype);
+ 
+ 	INSIST(rdataset->methods == NULL); /* We must be disassociated. */
+@@ -6307,6 +6326,7 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, const dns_name_t *nodename,
+ 	bool header_nx;
+ 	bool newheader_nx;
+ 	bool merge;
+	bool do_expireheader = false;
+ 	dns_rdatatype_t rdtype, covers;
+ 	rbtdb_rdatatype_t negtype, sigtype;
+ 	dns_trust_t trust;
+@@ -6856,6 +6876,7 @@ find_header:
+ 			}
+ 
+ 			if (IS_CACHE(rbtdb) && overmaxtype(rbtdb, ntypes)) {
+				do_expireheader = true;
+ 				if (expireheader == NULL) {
+ 					expireheader = newheader;
+ 				}
+@@ -6869,15 +6890,6 @@ find_header:
+ 					 */
+ 					expireheader = newheader;
+ 				}
+-
+-				set_ttl(rbtdb, expireheader, 0);
+-				mark_header_ancient(rbtdb, expireheader);
+-				/*
+-				 * FIXME: In theory, we should mark the RRSIG
+-				 * and the header at the same time, but there is
+-				 * no direct link between those two header, so
+-				 * we would have to check the whole list again.
+-				 */
+ 			}
+ 		}
+ 	}
+@@ -6901,6 +6913,15 @@ find_header:
+ 			      isc_rwlocktype_write, addedrdataset);
+ 	}
+ 
+	/*
+	 * We need to delay the expiration of the header until we are bound to
+	 * it to prevent decrement-then-increment on the header references.
+	 */
+	if (do_expireheader) {
+		set_ttl(rbtdb, expireheader, 0);
+		mark_header_ancient(rbtdb, expireheader);
+	}
+
+ 	return ISC_R_SUCCESS;
+ }
+ 
+@@ -8692,6 +8713,12 @@ rdataset_disassociate(dns_rdataset_t *rdataset) {
+ 	dns_db_t *db = rdataset->private1;
+ 	dns_dbnode_t *node = rdataset->private2;
+ 
+	if (rdataset->methods == &rdataset_methods) {
+		rdatasetheader_t *header = rdataset->private3;
+		header--;
+		isc_refcount_decrement(&header->references);
+	}
+
+ 	detachnode(db, &node);
+ }
+ 
+@@ -8806,6 +8833,11 @@ rdataset_clone(dns_rdataset_t *source, dns_rdataset_t *target) {
+ 	dns_dbnode_t *cloned_node = NULL;
+ 
+ 	attachnode(db, node, &cloned_node);
+	if (source->methods == &rdataset_methods) {
+		rdatasetheader_t *header = source->private3;
+		header--;
+		isc_refcount_increment(&header->references);
+	}
+ 	INSIST(!ISC_LINK_LINKED(target, link));
+ 	*target = *source;
+ 	ISC_LINK_INIT(target, link);
+@@ -8969,6 +9001,11 @@ rdatasetiter_destroy(dns_rdatasetiter_t **iteratorp) {
+ 
+ 	rbtiterator = (rbtdb_rdatasetiter_t *)(*iteratorp);
+ 
+	if (rbtiterator->current != NULL) {
+		isc_refcount_decrement(&rbtiterator->current->references);
+		rbtiterator->current = NULL;
+	}
+
+ 	if (rbtiterator->common.version != NULL) {
+ 		closeversion(rbtiterator->common.db,
+ 			     &rbtiterator->common.version, false);
+@@ -9046,9 +9083,18 @@ rdatasetiter_first(dns_rdatasetiter_t *iterator) {
+ 		}
+ 	}
+ 
+	if (header != NULL) {
+		isc_refcount_increment0(&header->references);
+	}
+
+ 	NODE_UNLOCK(&rbtdb->node_locks[rbtnode->locknum].lock,
+ 		    isc_rwlocktype_read);
+ 
+	if (rbtiterator->current != NULL) {
+		isc_refcount_decrement(&rbtiterator->current->references);
+		rbtiterator->current = NULL;
+	}
+
+ 	rbtiterator->current = header;
+ 
+ 	if (header == NULL) {
+@@ -9140,9 +9186,18 @@ rdatasetiter_next(dns_rdatasetiter_t *iterator) {
+ 		}
+ 	}
+ 
+	if (header != NULL) {
+		isc_refcount_increment0(&header->references);
+	}
+
+ 	NODE_UNLOCK(&rbtdb->node_locks[rbtnode->locknum].lock,
+ 		    isc_rwlocktype_read);
+ 
+	if (rbtiterator->current != NULL) {
+		isc_refcount_decrement(&rbtiterator->current->references);
+		rbtiterator->current = NULL;
+	}
+
+ 	rbtiterator->current = header;
+ 
+ 	if (header == NULL) {
+-- 
+2.55.0
+
--- a/bind-9.18-CVE-2026-11721-test.patch
+++ b/bind-9.18-CVE-2026-11721-test.patch
@ -0,0 +1,144 @@
+From b08e0876639ab9f3dae3813202861fd1098f2611 Mon Sep 17 00:00:00 2001
+From: Mark Andrews <marka@isc.org>
+Date: Tue, 14 Apr 2026 13:46:22 +1000
+Subject: [PATCH] Test RRSIG record parsing
+
+In particular test that labels and signer fields are consistent.
+
+(cherry picked from commit 5a95e64731afe63d348d272cc4d3b2f9847150c2)
+(cherry picked from commit 19e496ca260b6a756ae1378e8ebcbdb666b7d9ed)
+---
+ tests/dns/rdata_test.c | 110 +++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 110 insertions(+)
+
+diff --git a/tests/dns/rdata_test.c b/tests/dns/rdata_test.c
+index 7f0df6e046..c704d98ed1 100644
+--- a/tests/dns/rdata_test.c
+++ b/tests/dns/rdata_test.c
+@@ -2504,6 +2504,115 @@ ISC_RUN_TEST_IMPL(rkey) {
+ 		    dns_rdatatype_rkey, sizeof(dns_rdata_rkey_t));
+ }
+ 
+ISC_RUN_TEST_IMPL(rrsig) {
+	text_ok_t text_ok[] = {
+		TEXT_VALID("SOA 8 0 86400 20260426170000 20260413160000 54393 "
+			   ". "
+			   "tFbcoVP8MnpecUquJ/aj+XeNgV7ts9GSHVkXaXRJrJ/"
+			   "TEkOZApVG0F6E "
+			   "9sYpxGk2ItweLL43ujioGj0HWwZDRR+vbur+O/"
+			   "dIdheiig1VvU+9HXLi "
+			   "QOViY9Kc64ixdyJhYCC5K+bO1qsHxd+"
+			   "KJXOaxyHbqchYkDFy4PL6qftE "
+			   "VaLkueRgjXgOsq/"
+			   "NxvCXDgAa5xy0+3Sl0myxIs8rJ5KeXfJQFe7qxgaw "
+			   "VjJsJTKw8neOTw2rQfLaigWu2LIWw+"
+			   "IyVrLjZJdLqGkiLBGd1w4X3U12 "
+			   "fFxoY3eqzNgBEtduoGKPZ/"
+			   "NpP9cuKJORJ18283aV8hR4WO91VR0q1zcM jLwqUg=="),
+		/* labels too short for signer */
+		TEXT_INVALID("SOA 8 0 86400 20260426170000 20260413160000 "
+			     "54393 example. "
+			     "tFbcoVP8MnpecUquJ/aj+XeNgV7ts9GSHVkXaXRJrJ/"
+			     "TEkOZApVG0F6E "
+			     "9sYpxGk2ItweLL43ujioGj0HWwZDRR+vbur+O/"
+			     "dIdheiig1VvU+9HXLi "
+			     "QOViY9Kc64ixdyJhYCC5K+bO1qsHxd+"
+			     "KJXOaxyHbqchYkDFy4PL6qftE "
+			     "VaLkueRgjXgOsq/"
+			     "NxvCXDgAa5xy0+3Sl0myxIs8rJ5KeXfJQFe7qxgaw "
+			     "VjJsJTKw8neOTw2rQfLaigWu2LIWw+"
+			     "IyVrLjZJdLqGkiLBGd1w4X3U12 "
+			     "fFxoY3eqzNgBEtduoGKPZ/"
+			     "NpP9cuKJORJ18283aV8hR4WO91VR0q1zcM jLwqUg=="),
+		/*
+		 * Sentinel.
+		 */
+		TEXT_SENTINEL()
+	};
+	wire_ok_t wire_ok[] = {
+		WIRE_VALID(0x00, 0x06, 0x08, 0x00, 0x00, 0x01, 0x51, 0x80, 0x69,
+			   0xee, 0x44, 0x90, 0x69, 0xdd, 0x13, 0x00, 0xd4, 0x79,
+			   0x00, 0xb4, 0x56, 0xdc, 0xa1, 0x53, 0xfc, 0x32, 0x7a,
+			   0x5e, 0x71, 0x4a, 0xae, 0x27, 0xf6, 0xa3, 0xf9, 0x77,
+			   0x8d, 0x81, 0x5e, 0xed, 0xb3, 0xd1, 0x92, 0x1d, 0x59,
+			   0x17, 0x69, 0x74, 0x49, 0xac, 0x9f, 0xd3, 0x12, 0x43,
+			   0x99, 0x02, 0x95, 0x46, 0xd0, 0x5e, 0x84, 0xf6, 0xc6,
+			   0x29, 0xc4, 0x69, 0x36, 0x22, 0xdc, 0x1e, 0x2c, 0xbe,
+			   0x37, 0xba, 0x38, 0xa8, 0x1a, 0x3d, 0x07, 0x5b, 0x06,
+			   0x43, 0x45, 0x1f, 0xaf, 0x6e, 0xea, 0xfe, 0x3b, 0xf7,
+			   0x48, 0x76, 0x17, 0xa2, 0x8a, 0x0d, 0x55, 0xbd, 0x4f,
+			   0xbd, 0x1d, 0x72, 0xe2, 0x40, 0xe5, 0x62, 0x63, 0xd2,
+			   0x9c, 0xeb, 0x88, 0xb1, 0x77, 0x22, 0x61, 0x60, 0x20,
+			   0xb9, 0x2b, 0xe6, 0xce, 0xd6, 0xab, 0x07, 0xc5, 0xdf,
+			   0x8a, 0x25, 0x73, 0x9a, 0xc7, 0x21, 0xdb, 0xa9, 0xc8,
+			   0x58, 0x90, 0x31, 0x72, 0xe0, 0xf2, 0xfa, 0xa9, 0xfb,
+			   0x44, 0x55, 0xa2, 0xe4, 0xb9, 0xe4, 0x60, 0x8d, 0x78,
+			   0x0e, 0xb2, 0xaf, 0xcd, 0xc6, 0xf0, 0x97, 0x0e, 0x00,
+			   0x1a, 0xe7, 0x1c, 0xb4, 0xfb, 0x74, 0xa5, 0xd2, 0x6c,
+			   0xb1, 0x22, 0xcf, 0x2b, 0x27, 0x92, 0x9e, 0x5d, 0xf2,
+			   0x50, 0x15, 0xee, 0xea, 0xc6, 0x06, 0xb0, 0x56, 0x32,
+			   0x6c, 0x25, 0x32, 0xb0, 0xf2, 0x77, 0x8e, 0x4f, 0x0d,
+			   0xab, 0x41, 0xf2, 0xda, 0x8a, 0x05, 0xae, 0xd8, 0xb2,
+			   0x16, 0xc3, 0xe2, 0x32, 0x56, 0xb2, 0xe3, 0x64, 0x97,
+			   0x4b, 0xa8, 0x69, 0x22, 0x2c, 0x11, 0x9d, 0xd7, 0x0e,
+			   0x17, 0xdd, 0x4d, 0x76, 0x7c, 0x5c, 0x68, 0x63, 0x77,
+			   0xaa, 0xcc, 0xd8, 0x01, 0x12, 0xd7, 0x6e, 0xa0, 0x62,
+			   0x8f, 0x67, 0xf3, 0x69, 0x3f, 0xd7, 0x2e, 0x28, 0x93,
+			   0x91, 0x27, 0x5f, 0x36, 0xf3, 0x76, 0x95, 0xf2, 0x14,
+			   0x78, 0x58, 0xef, 0x75, 0x55, 0x1d, 0x2a, 0xd7, 0x37,
+			   0x0c, 0x8c, 0xbc, 0x2a, 0x52),
+		/* labels too short for signer */
+		WIRE_INVALID(
+			0x00, 0x06, 0x08, 0x00, 0x00, 0x01, 0x51, 0x80, 0x69,
+			0xee, 0x44, 0x90, 0x69, 0xdd, 0x13, 0x00, 0xd4, 0x79,
+			0x07, 0x65, 0x78, 0x61, 0x6d, 0x70, 0x6c, 0x65, 0x00,
+			0xb4, 0x56, 0xdc, 0xa1, 0x53, 0xfc, 0x32, 0x7a, 0x5e,
+			0x71, 0x4a, 0xae, 0x27, 0xf6, 0xa3, 0xf9, 0x77, 0x8d,
+			0x81, 0x5e, 0xed, 0xb3, 0xd1, 0x92, 0x1d, 0x59, 0x17,
+			0x69, 0x74, 0x49, 0xac, 0x9f, 0xd3, 0x12, 0x43, 0x99,
+			0x02, 0x95, 0x46, 0xd0, 0x5e, 0x84, 0xf6, 0xc6, 0x29,
+			0xc4, 0x69, 0x36, 0x22, 0xdc, 0x1e, 0x2c, 0xbe, 0x37,
+			0xba, 0x38, 0xa8, 0x1a, 0x3d, 0x07, 0x5b, 0x06, 0x43,
+			0x45, 0x1f, 0xaf, 0x6e, 0xea, 0xfe, 0x3b, 0xf7, 0x48,
+			0x76, 0x17, 0xa2, 0x8a, 0x0d, 0x55, 0xbd, 0x4f, 0xbd,
+			0x1d, 0x72, 0xe2, 0x40, 0xe5, 0x62, 0x63, 0xd2, 0x9c,
+			0xeb, 0x88, 0xb1, 0x77, 0x22, 0x61, 0x60, 0x20, 0xb9,
+			0x2b, 0xe6, 0xce, 0xd6, 0xab, 0x07, 0xc5, 0xdf, 0x8a,
+			0x25, 0x73, 0x9a, 0xc7, 0x21, 0xdb, 0xa9, 0xc8, 0x58,
+			0x90, 0x31, 0x72, 0xe0, 0xf2, 0xfa, 0xa9, 0xfb, 0x44,
+			0x55, 0xa2, 0xe4, 0xb9, 0xe4, 0x60, 0x8d, 0x78, 0x0e,
+			0xb2, 0xaf, 0xcd, 0xc6, 0xf0, 0x97, 0x0e, 0x00, 0x1a,
+			0xe7, 0x1c, 0xb4, 0xfb, 0x74, 0xa5, 0xd2, 0x6c, 0xb1,
+			0x22, 0xcf, 0x2b, 0x27, 0x92, 0x9e, 0x5d, 0xf2, 0x50,
+			0x15, 0xee, 0xea, 0xc6, 0x06, 0xb0, 0x56, 0x32, 0x6c,
+			0x25, 0x32, 0xb0, 0xf2, 0x77, 0x8e, 0x4f, 0x0d, 0xab,
+			0x41, 0xf2, 0xda, 0x8a, 0x05, 0xae, 0xd8, 0xb2, 0x16,
+			0xc3, 0xe2, 0x32, 0x56, 0xb2, 0xe3, 0x64, 0x97, 0x4b,
+			0xa8, 0x69, 0x22, 0x2c, 0x11, 0x9d, 0xd7, 0x0e, 0x17,
+			0xdd, 0x4d, 0x76, 0x7c, 0x5c, 0x68, 0x63, 0x77, 0xaa,
+			0xcc, 0xd8, 0x01, 0x12, 0xd7, 0x6e, 0xa0, 0x62, 0x8f,
+			0x67, 0xf3, 0x69, 0x3f, 0xd7, 0x2e, 0x28, 0x93, 0x91,
+			0x27, 0x5f, 0x36, 0xf3, 0x76, 0x95, 0xf2, 0x14, 0x78,
+			0x58, 0xef, 0x75, 0x55, 0x1d, 0x2a, 0xd7, 0x37, 0x0c,
+			0x8c, 0xbc, 0x2a, 0x52),
+
+		WIRE_SENTINEL()
+	};
+	check_rdata(text_ok, wire_ok, NULL, false, dns_rdataclass_in,
+		    dns_rdatatype_rrsig, sizeof(dns_rdata_rrsig_t));
+}
+
+ ISC_RUN_TEST_IMPL(resinfo) {
+ 	text_ok_t text_ok[] = {
+ 		TEXT_VALID_CHANGED("qnamemin exterr=15,16,17 "
+@@ -3357,6 +3466,7 @@ ISC_TEST_ENTRY(nsec3)
+ ISC_TEST_ENTRY(nxt)
+ ISC_TEST_ENTRY(resinfo)
+ ISC_TEST_ENTRY(rkey)
+ISC_TEST_ENTRY(rrsig)
+ ISC_TEST_ENTRY(sshfp)
+ ISC_TEST_ENTRY(wallet)
+ ISC_TEST_ENTRY(wks)
+-- 
+2.55.0
+
--- a/bind-9.18-CVE-2026-11721.patch
+++ b/bind-9.18-CVE-2026-11721.patch
@ -0,0 +1,267 @@
+From 7a8a1f74c742e98fb5e105b013e7c2bd7af4a76c Mon Sep 17 00:00:00 2001
+From: Mark Andrews <marka@isc.org>
+Date: Tue, 14 Apr 2026 15:14:06 +1000
+Subject: [PATCH] Don't sign out of zone records in dnssec-signzone
+
+dnssec-signzone was signing extraneous records that were not within
+the namespace of the zone.  This no longer occurs.
+
+(cherry picked from commit e45c9af7051421fd370f20ba8325199c606223fd)
+
+Don't sign out of zone records in dnssec-signzone
+
+dnssec-signzone was signing extraneous records that were not within
+the namespace of the zone.  This no longer occurs.
+
+(cherry picked from commit e45c9af7051421fd370f20ba8325199c606223fd)
+(cherry picked from commit 1a4986e2533f87e80eb21da3f06708d335aff1e2)
+
+Invalid signed wildcard records were being accepted
+
+An RRSIG whose Labels field indicates fewer labels than its signer
+name requires was being accepted.  When such a record covers a
+wildcard, the validator reconstructs a wildcard owner name above the
+signer's zone and caches it as secure.  RFC 8198 cache synthesis
+(synth-from-dnssec) then serves that forged wildcard for unrelated
+names, poisoning the cache.
+
+These records are now rejected, both when an RRSIG is parsed and when
+its signature is verified.
+
+(cherry picked from commit 084ca5ee10515e461d46b63df9660b8394bc7de9)
+(cherry picked from commit 15089066b15f826d7487c3d160b5872820f84b83)
+---
+ bin/dnssec/dnssec-signzone.c     |  5 ++++
+ lib/dns/dnssec.c                 | 43 +++++++++++++++++++++++---------
+ lib/dns/rdata/generic/rrsig_46.c | 37 ++++++++++++++++++++-------
+ 3 files changed, 64 insertions(+), 21 deletions(-)
+
+diff --git a/bin/dnssec/dnssec-signzone.c b/bin/dnssec/dnssec-signzone.c
+index 73855e6284..9e3a48a592 100644
+--- a/bin/dnssec/dnssec-signzone.c
+++ b/bin/dnssec/dnssec-signzone.c
+@@ -1643,6 +1643,11 @@ assignwork(isc_task_t *task, isc_task_t *worker) {
+ 			dns_db_detachnode(gdb, &node);
+ 			goto next;
+ 		}
+		if (!dns_name_issubdomain(name, gorigin)) {
+			dumpnode(name, node);
+			dns_db_detachnode(gdb, &node);
+			goto next;
+		}
+ 		/*
+ 		 * Sort the zone data from the glue and out-of-zone data.
+ 		 * For NSEC zones nodes with zone data have NSEC records.
+diff --git a/lib/dns/dnssec.c b/lib/dns/dnssec.c
+index c7e922437c..b12529b5d5 100644
+--- a/lib/dns/dnssec.c
+++ b/lib/dns/dnssec.c
+@@ -130,11 +130,11 @@ dns_dnssec_keyfromrdata(const dns_name_t *name, const dns_rdata_t *rdata,
+ 	isc_buffer_t b;
+ 	isc_region_t r;
+ 
+-	INSIST(name != NULL);
+-	INSIST(rdata != NULL);
+-	INSIST(mctx != NULL);
+-	INSIST(key != NULL);
+-	INSIST(*key == NULL);
+	REQUIRE(name != NULL);
+	REQUIRE(rdata != NULL);
+	REQUIRE(mctx != NULL);
+	REQUIRE(key != NULL);
+	REQUIRE(*key == NULL);
+ 	REQUIRE(rdata->type == dns_rdatatype_key ||
+ 		rdata->type == dns_rdatatype_dnskey);
+ 
+@@ -187,12 +187,14 @@ dns_dnssec_sign(const dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
+ 	isc_result_t ret;
+ 	isc_buffer_t *databuf = NULL;
+ 	char data[256 + 8];
+	unsigned int labels;
+ 	unsigned int sigsize;
+ 	dns_fixedname_t fnewname;
+ 	dns_fixedname_t fsigner;
+ 
+ 	REQUIRE(name != NULL);
+-	REQUIRE(dns_name_countlabels(name) <= 255);
+	labels = dns_name_countlabels(name);
+	REQUIRE(labels <= 255 && labels > 0);
+ 	REQUIRE(set != NULL);
+ 	REQUIRE(key != NULL);
+ 	REQUIRE(inception != NULL);
+@@ -221,7 +223,7 @@ dns_dnssec_sign(const dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
+ 
+ 	sig.covered = set->type;
+ 	sig.algorithm = dst_key_alg(key);
+-	sig.labels = dns_name_countlabels(name) - 1;
+	sig.labels = labels - 1;
+ 	if (dns_name_iswildcard(name)) {
+ 		sig.labels--;
+ 	}
+@@ -365,10 +367,13 @@ dns_dnssec_verify(const dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
+ 	isc_result_t ret;
+ 	unsigned char data[300];
+ 	dst_context_t *ctx = NULL;
+-	int labels = 0;
+	unsigned int labels;
+	unsigned int siglabels;
+ 	bool downcase = false;
+ 
+ 	REQUIRE(name != NULL);
+	labels = dns_name_countlabels(name);
+	REQUIRE(labels > 0);
+ 	REQUIRE(set != NULL);
+ 	REQUIRE(key != NULL);
+ 	REQUIRE(mctx != NULL);
+@@ -383,6 +388,21 @@ dns_dnssec_verify(const dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
+ 		return DNS_R_SIGINVALID;
+ 	}
+ 
+	/*
+	 * The RRSIG labels field can't indicate fewer labels than the
+	 * signer.  Also the labels shouldn't be greater than that of
+	 * the owner name.
+	 *
+	 * sig.labels doesn't include the root label, so add 1 to account
+	 * for it.
+	 */
+	siglabels = sig.labels + 1;
+	if (siglabels < dns_name_countlabels(&sig.signer) || siglabels > labels)
+	{
+		inc_stat(dns_dnssecstats_fail);
+		return DNS_R_SIGINVALID;
+	}
+
+ 	if (isc_serial_lt(sig.timeexpire, sig.timesigned)) {
+ 		inc_stat(dns_dnssecstats_fail);
+ 		return DNS_R_SIGINVALID;
+@@ -449,10 +469,9 @@ again:
+ 	 * If the name is an expanded wildcard, use the wildcard name.
+ 	 */
+ 	dns_fixedname_init(&fnewname);
+-	labels = dns_name_countlabels(name) - 1;
+ 	RUNTIME_CHECK(dns_name_downcase(name, dns_fixedname_name(&fnewname),
+ 					NULL) == ISC_R_SUCCESS);
+-	if (labels - sig.labels > 0) {
+	if (labels > siglabels) {
+ 		dns_name_split(dns_fixedname_name(&fnewname), sig.labels + 1,
+ 			       NULL, dns_fixedname_name(&fnewname));
+ 	}
+@@ -463,7 +482,7 @@ again:
+ 	 * Create an envelope for each rdata: <name|type|class|ttl>.
+ 	 */
+ 	isc_buffer_init(&envbuf, data, sizeof(data));
+-	if (labels - sig.labels > 0) {
+	if (labels > siglabels) {
+ 		isc_buffer_putuint8(&envbuf, 1);
+ 		isc_buffer_putuint8(&envbuf, '*');
+ 		memmove(data + 2, r.base, r.length);
+@@ -559,7 +578,7 @@ cleanup_struct:
+ 		inc_stat(dns_dnssecstats_fail);
+ 	}
+ 
+-	if (ret == ISC_R_SUCCESS && labels - sig.labels > 0) {
+	if (ret == ISC_R_SUCCESS && labels > siglabels) {
+ 		if (wild != NULL) {
+ 			RUNTIME_CHECK(dns_name_concatenate(
+ 					      dns_wildcardname,
+diff --git a/lib/dns/rdata/generic/rrsig_46.c b/lib/dns/rdata/generic/rrsig_46.c
+index 10bc039e93..4cf4259c2b 100644
+--- a/lib/dns/rdata/generic/rrsig_46.c
+++ b/lib/dns/rdata/generic/rrsig_46.c
+@@ -23,12 +23,12 @@
+ static isc_result_t
+ fromtext_rrsig(ARGS_FROMTEXT) {
+ 	isc_token_t token;
+-	unsigned char c;
+	unsigned char alg, labels;
+ 	long i;
+ 	dns_rdatatype_t covered;
+-	char *e;
+	char *e = NULL;
+ 	isc_result_t result;
+-	dns_name_t name;
+	dns_name_t signer;
+ 	isc_buffer_t buffer;
+ 	uint32_t time_signed, time_expire;
+ 
+@@ -61,8 +61,8 @@ fromtext_rrsig(ARGS_FROMTEXT) {
+ 	 */
+ 	RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_string,
+ 				      false));
+-	RETTOK(dns_secalg_fromtext(&c, &token.value.as_textregion));
+-	RETERR(mem_tobuffer(target, &c, 1));
+	RETTOK(dns_secalg_fromtext(&alg, &token.value.as_textregion));
+	RETERR(mem_tobuffer(target, &alg, 1));
+ 
+ 	/*
+ 	 * Labels.
+@@ -72,8 +72,8 @@ fromtext_rrsig(ARGS_FROMTEXT) {
+ 	if (token.value.as_ulong > 0xffU) {
+ 		RETTOK(ISC_R_RANGE);
+ 	}
+-	c = (unsigned char)token.value.as_ulong;
+-	RETERR(mem_tobuffer(target, &c, 1));
+	labels = (unsigned char)token.value.as_ulong;
+	RETERR(mem_tobuffer(target, &labels, 1));
+ 
+ 	/*
+ 	 * Original ttl.
+@@ -144,12 +144,20 @@ fromtext_rrsig(ARGS_FROMTEXT) {
+ 	 */
+ 	RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_string,
+ 				      false));
+-	dns_name_init(&name, NULL);
+	dns_name_init(&signer, NULL);
+ 	buffer_fromregion(&buffer, &token.value.as_region);
+ 	if (origin == NULL) {
+ 		origin = dns_rootname;
+ 	}
+-	RETTOK(dns_name_fromtext(&name, &buffer, origin, options, target));
+	RETTOK(dns_name_fromtext(&signer, &buffer, origin, options, target));
+
+	/*
+	 * (RRSIG labels doesn't include the root label, so add one
+	 * to normalize it before checking against the signer.)
+	 */
+	if ((unsigned int)(labels + 1) < dns_name_countlabels(&signer)) {
+		RETTOK(ISC_R_RANGE);
+	}
+ 
+ 	/*
+ 	 * Sig.
+@@ -278,6 +286,7 @@ static isc_result_t
+ fromwire_rrsig(ARGS_FROMWIRE) {
+ 	isc_region_t sr;
+ 	dns_name_t name;
+	unsigned char labels;
+ 
+ 	REQUIRE(type == dns_rdatatype_rrsig);
+ 
+@@ -300,6 +309,8 @@ fromwire_rrsig(ARGS_FROMWIRE) {
+ 		return ISC_R_UNEXPECTEDEND;
+ 	}
+ 
+	labels = sr.base[3];
+
+ 	isc_buffer_forward(source, 18);
+ 	RETERR(mem_tobuffer(target, sr.base, 18));
+ 
+@@ -309,6 +320,14 @@ fromwire_rrsig(ARGS_FROMWIRE) {
+ 	dns_name_init(&name, NULL);
+ 	RETERR(dns_name_fromwire(&name, source, dctx, options, target));
+ 
+	/*
+	 * (RRSIG labels doesn't include the root label, so add one
+	 * to normalize it before checking against the signer.)
+	 */
+	if ((unsigned int)(labels + 1) < dns_name_countlabels(&name)) {
+		RETERR(DNS_R_FORMERR);
+	}
+
+ 	/*
+ 	 * Sig.
+ 	 */
+-- 
+2.55.0
+
--- a/bind-9.18-CVE-2026-12617-test.patch
+++ b/bind-9.18-CVE-2026-12617-test.patch
@ -0,0 +1,435 @@
+From a31296b120efc985fb1fc3c932882e965156473b Mon Sep 17 00:00:00 2001
+From: Colin Vidal <colin@isc.org>
+Date: Mon, 15 Jun 2026 11:34:08 +0200
+Subject: [PATCH] Reproducer for #5946 (assertion in some CNAME/DNAME queries)
+
+Add a system test reproducing the issue reported by #5946, which
+is also CVE-2026-12617. There are two scenarios:
+
+- A client send queries for a DNAME and A record to the resolver (ns3),
+  and the authoritative server (ans2) responds positively to the A query
+  but delay the DNAME response and respond later negatively;
+
+- A client send queries for a CNAME and A record to the resolver (ns3),
+  and the authoritative server (ans2) responds positively to the A query
+  but delay the CNAME response and respond later with a self-referential
+  CNAME.
+
+The test does not check the results of the queries, however, it expects
+the resolver to correctly handle those and do not assert.
+
+(cherry picked from commit e88271f2e584010157b068cc998dd76451273562)
+(cherry picked from commit bb92832fb6ae899bee7206c2d8966258461c2f71)
+
+Stabilize timing in the cname_dname_negcache test
+
+The #5946 reproducer relied on ans2 answering the negative DNAME/CNAME
+query a fixed second after receiving it, racing that delay against the
+resolver's per-query timeout.  When the timeout fired first -- which
+happens under load, most notably under ThreadSanitizer, where named is
+slowed but ans2 (wall-clock) is not -- the resolver dropped the late
+answer, never processed the negative response, and the watched SOA never
+appeared, so the test timed out.  This made it flaky on the
+security-bind-9.20 CI.  Merely shortening the fixed delay would trade
+that for the opposite, worse failure: the negative answer arriving
+before the positive one is cached, silently not exercising the bug.
+
+Release the negative answer based on the resolver's progress instead of
+a wall-clock deadline: hold it until ans2 has sent the positive answer
+(a shared event), then wait a short settle for the resolver to cache it.
+Both queries traverse the same delegation, so any latency reaching ans2
+shifts the positive send and the negative fetch's deadline together and
+cancels out; only the settle, kept well under MINIMUM_QUERY_TIMEOUT
+(301 ms), has to fit inside the per-query timeout.
+
+Verified that the stabilized test still triggers the
+INSIST(namereln == dns_namereln_subdomain) assertion when the resolver
+fix is reverted.
+
+Assisted-by: Claude:claude-opus-4-8
+(cherry picked from commit 738456d91564526e6f15c3858b4c809cd6749e1e)
+(cherry picked from commit 0c20ee4e8e68999ca617434cde65dd3808f57d8c)
+
+Split cname_dname_negcache into per-scenario modules
+
+The DNAME and CNAME scenarios shared a single module, hence a single
+module-scoped ns3 (the framework sets servers up per module, not per
+test function).  test_dname_negcache cached foo.test. DNAME bar.test.;
+when test_cname_negcache ran next against the same resolver,
+cname.foo.test. was DNAME-mapped to cname.bar.test., so the resolver
+never queried ans2 for the self-referential CNAME and that half of the
+bug was never exercised.  The hardcoded, unanchored "foo.test." watcher
+still matched test_dname's leftover SOA, so test_cname passed without
+testing anything -- the CNAME assertion had no coverage.
+
+Give each scenario its own module so each gets a fresh server set, and
+anchor the watcher to the queried name so a test cannot pass on an
+unrelated record.
+
+With the resolver fix reverted, each module now independently triggers
+its own assertion:
+
+    DNAME  query.c INSIST(namereln == dns_namereln_subdomain)
+    CNAME  query.c INSIST(qctx->rdataset == NULL || qctx->qtype == dname)
+
+Assisted-by: Claude:claude-opus-4-8
+(cherry picked from commit 3ef0b8d04a1653407cfb9ee88772ae18689b1318)
+(cherry picked from commit 887124315f03a006c4dc76e48ae3d0d8aac3c407)
+---
+ .../system/cname_dname_negcache/ans2/ans.py   | 148 ++++++++++++++++++
+ .../system/cname_dname_negcache/common.py     |  46 ++++++
+ .../cname_dname_negcache/ns1/bar.test.db      |   5 +
+ .../cname_dname_negcache/ns1/named.conf.j2    |  24 +++
+ .../system/cname_dname_negcache/ns1/root.db   |   6 +
+ .../system/cname_dname_negcache/ns1/test.db   |   8 +
+ .../cname_dname_negcache/ns3/named.conf.j2    |  11 ++
+ .../tests_cname_negcache.py                   |  16 ++
+ .../tests_dname_negcache.py                   |  16 ++
+ 9 files changed, 280 insertions(+)
+ create mode 100644 bin/tests/system/cname_dname_negcache/ans2/ans.py
+ create mode 100644 bin/tests/system/cname_dname_negcache/common.py
+ create mode 100644 bin/tests/system/cname_dname_negcache/ns1/bar.test.db
+ create mode 100644 bin/tests/system/cname_dname_negcache/ns1/named.conf.j2
+ create mode 100644 bin/tests/system/cname_dname_negcache/ns1/root.db
+ create mode 100644 bin/tests/system/cname_dname_negcache/ns1/test.db
+ create mode 100644 bin/tests/system/cname_dname_negcache/ns3/named.conf.j2
+ create mode 100644 bin/tests/system/cname_dname_negcache/tests_cname_negcache.py
+ create mode 100644 bin/tests/system/cname_dname_negcache/tests_dname_negcache.py
+
+diff --git a/bin/tests/system/cname_dname_negcache/ans2/ans.py b/bin/tests/system/cname_dname_negcache/ans2/ans.py
+new file mode 100644
+index 0000000000..392fe1e088
+--- /dev/null
+++ b/bin/tests/system/cname_dname_negcache/ans2/ans.py
+@@ -0,0 +1,148 @@
+"""
+Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+
+SPDX-License-Identifier: MPL-2.0
+
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0.  If a copy of the MPL was not distributed with this
+file, you can obtain one at https://mozilla.org/MPL/2.0/.
+
+See the COPYRIGHT file distributed with this work for additional
+information regarding copyright ownership.
+"""
+
+from collections.abc import AsyncGenerator
+
+import asyncio
+
+from dns import name, rcode, rdataclass, rdatatype, rrset
+
+from isctest.asyncserver import (
+    AsyncDnsServer,
+    DnsResponseSend,
+    QnameQtypeHandler,
+    QueryContext,
+    StaticResponseHandler,
+)
+
+# The attack relies on the resolver caching the positive CNAME/DNAME answer
+# *before* it processes the negative answer for the same name.  The negative
+# answer must therefore be held back until the positive one has been sent, but
+# released again while the negative fetch is still waiting for it.
+#
+# Releasing it at a fixed wall-clock delay (the original approach) is racy: the
+# delay must be larger than the time it takes the resolver to cache the
+# positive answer, yet smaller than the resolver's per-query timeout.  Under
+# load -- most notably ThreadSanitizer, which slows down `named` but not this
+# (wall-clock) server -- those bounds can be violated in either direction,
+# making the test either time out (#5946 CI failures) or, worse, silently stop
+# exercising the bug.
+#
+# Instead, gate the negative answer on an event set right after the positive
+# answer is sent.  Both queries traverse the same delegation, so any latency in
+# reaching this server shifts the positive send and the negative fetch's
+# deadline together and cancels out; only the small settle below has to fit
+# inside the per-query timeout.
+#
+# _SETTLE must be longer than the few milliseconds the resolver needs to cache
+# the positive answer, and shorter than MINIMUM_QUERY_TIMEOUT (301 ms in
+# lib/dns/resolver.c) so the in-flight negative fetch has not given up yet.
+_SETTLE = 0.1
+
+_dname_positive_sent = asyncio.Event()
+_cname_positive_sent = asyncio.Event()
+
+
+async def _hold_until_positive_cached(positive_sent: asyncio.Event) -> None:
+    await positive_sent.wait()
+    await asyncio.sleep(_SETTLE)
+
+
+def build_rrset(
+    qname: name.Name | str,
+    rtype: rdatatype.RdataType,
+    rdata: str,
+    ttl: int = 300,
+) -> rrset.RRset:
+    return rrset.from_text(qname, ttl, rdataclass.IN, rtype, rdata)
+
+
+class FooTestNsHandler(QnameQtypeHandler, StaticResponseHandler):
+    qnames = ["foo.test."]
+    qtypes = [rdatatype.NS]
+    answer = [build_rrset("foo.test.", rdatatype.NS, "ns.foo.test.")]
+    additional = [build_rrset("ns.foo.test.", rdatatype.A, "10.53.0.2")]
+
+
+class DelayedDnameNegHandler(QnameQtypeHandler, StaticResponseHandler):
+    qnames = ["foo.test."]
+    qtypes = [rdatatype.DNAME]
+    authority = [
+        build_rrset(
+            "foo.test.",
+            rdatatype.SOA,
+            "ns.test. op.ns.test. 2081509183 86400 3600 3600000 300",
+        )
+    ]
+
+    async def get_responses(
+        self, qctx: QueryContext
+    ) -> AsyncGenerator[DnsResponseSend, None]:
+        await _hold_until_positive_cached(_dname_positive_sent)
+        async for response in super().get_responses(qctx):
+            yield response
+
+
+class DnamePosHandler(QnameQtypeHandler, StaticResponseHandler):
+    qnames = ["a.foo.test."]
+    qtypes = [rdatatype.A]
+    answer = [
+        build_rrset("foo.test.", rdatatype.DNAME, "bar.test."),
+        build_rrset("a.foo.test.", rdatatype.CNAME, "a.bar.test."),
+    ]
+
+    async def get_responses(
+        self, qctx: QueryContext
+    ) -> AsyncGenerator[DnsResponseSend, None]:
+        async for response in super().get_responses(qctx):
+            yield response
+        _dname_positive_sent.set()
+
+
+class CnameHandler(QnameQtypeHandler):
+    qnames = ["cname.foo.test."]
+    qtypes = [rdatatype.CNAME, rdatatype.A]
+    answer = [build_rrset("cname.foo.test.", rdatatype.CNAME, "cname.foo.test.")]
+    authority = [
+        build_rrset(
+            "cname.foo.test.",
+            rdatatype.SOA,
+            "ns.test. op.ns.test. 2081509183 86400 3600 3600000 300",
+        )
+    ]
+
+    async def get_responses(
+        self, qctx: QueryContext
+    ) -> AsyncGenerator[DnsResponseSend, None]:
+        if qctx.qtype == rdatatype.CNAME:
+            await _hold_until_positive_cached(_cname_positive_sent)
+            qctx.prepare_new_response(with_zone_data=False)
+            qctx.response.authority.extend(self.authority)
+            yield DnsResponseSend(qctx.response, authoritative=True)
+        else:
+            qctx.prepare_new_response(with_zone_data=False)
+            qctx.response.answer.extend(self.answer)
+            yield DnsResponseSend(qctx.response, authoritative=True)
+            _cname_positive_sent.set()
+
+
+def main() -> None:
+    server = AsyncDnsServer(default_aa=True, default_rcode=rcode.NOERROR)
+    server.install_response_handlers(
+        FooTestNsHandler(), DelayedDnameNegHandler(), DnamePosHandler(), CnameHandler()
+    )
+    server.run()
+
+
+if __name__ == "__main__":
+    main()
+diff --git a/bin/tests/system/cname_dname_negcache/common.py b/bin/tests/system/cname_dname_negcache/common.py
+new file mode 100644
+index 0000000000..397cfdfa3d
+--- /dev/null
+++ b/bin/tests/system/cname_dname_negcache/common.py
+@@ -0,0 +1,46 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+from os import environ
+from re import compile as Re
+from re import escape
+from socket import AF_INET, SOCK_DGRAM, socket
+
+import isctest
+
+
+def run_attack(ns, name1, type1, name2, type2):
+    msg1 = isctest.query.create(name1, type1, cd=True)
+    msg2 = isctest.query.create(name2, type2, cd=True)
+    port = int(environ["PORT"])
+
+    with socket(AF_INET, SOCK_DGRAM) as sock:
+        # The order the requests go out doesn't matter. What is important is
+        # that the first query starts recursion before the second query returns
+        # the answer, and the second query returns the answer before the first
+        # query returns the answer. (So, when the NOERROR/NODATA comes back from
+        # the first query, the cache is queried and we get the positive response
+        # cached from the second query attached to the fresp rdataset of the
+        # response of the first query.)
+        # That ordering is enforced by ans2, which holds back the negative
+        # answer to the first query until it has answered the second one (see
+        # ans2/ans.py); the resolver must not crash while reconciling them.
+        sock.sendto(msg1.to_wire(), (ns.ip, port))
+        sock.sendto(msg2.to_wire(), (ns.ip, port))
+
+    # The second query comes back immediately, the resolver caches the DNAME.
+    # The first query comes back shortly after, once ans2 has released the
+    # negative answer, and should not crash the server.  Wait for the negative
+    # SOA for this specific name (not just any foo.test. one) so the test cannot
+    # pass on an unrelated record.
+    soa = Re(rf"(?<![\w.]){escape(name1)}.*IN\s+SOA\s+ns\.test\.\s+op\.ns\.test\.")
+    with ns.watch_log_from_start(timeout=15) as watcher:
+        watcher.wait_for_sequence([soa])
+diff --git a/bin/tests/system/cname_dname_negcache/ns1/bar.test.db b/bin/tests/system/cname_dname_negcache/ns1/bar.test.db
+new file mode 100644
+index 0000000000..840b9c3a2c
+--- /dev/null
+++ b/bin/tests/system/cname_dname_negcache/ns1/bar.test.db
+@@ -0,0 +1,5 @@
+$TTL 300
+bar.test.        IN SOA  ns.bar.test. hostmaster.bar.test. 1 600 600 1200 600
+bar.test.        NS      ns.bar.test.
+ns    		 A       10.53.0.1
+a      		 A       10.0.0.1
+diff --git a/bin/tests/system/cname_dname_negcache/ns1/named.conf.j2 b/bin/tests/system/cname_dname_negcache/ns1/named.conf.j2
+new file mode 100644
+index 0000000000..d72dd1181d
+--- /dev/null
+++ b/bin/tests/system/cname_dname_negcache/ns1/named.conf.j2
+@@ -0,0 +1,24 @@
+options {
+    query-source address @ns.ip@;
+    port @PORT@;
+    pid-file "named.pid";
+    listen-on { @ns.ip@; };
+    listen-on-v6 { none; };
+    recursion no;
+    dnssec-validation no;
+};
+
+zone "." {
+	type primary;
+	file "root.db";
+};
+
+zone "test." {
+	type primary;
+	file "test.db";
+};
+
+zone "bar.test." {
+	type primary;
+	file "bar.test.db";
+};
+diff --git a/bin/tests/system/cname_dname_negcache/ns1/root.db b/bin/tests/system/cname_dname_negcache/ns1/root.db
+new file mode 100644
+index 0000000000..c456c45b9d
+--- /dev/null
+++ b/bin/tests/system/cname_dname_negcache/ns1/root.db
+@@ -0,0 +1,6 @@
+$TTL 300
+.        IN SOA  ns. hostmaster. 1 600 600 1200 600
+.	         	NS      a.root-servers.nil.
+a.root-servers.nil.    	A       10.53.0.1
+test    	 	NS      ns.test
+ns.test		 	A	 10.53.0.1
+diff --git a/bin/tests/system/cname_dname_negcache/ns1/test.db b/bin/tests/system/cname_dname_negcache/ns1/test.db
+new file mode 100644
+index 0000000000..acb68e00f8
+--- /dev/null
+++ b/bin/tests/system/cname_dname_negcache/ns1/test.db
+@@ -0,0 +1,8 @@
+$TTL 300
+test.        IN SOA  ns.test. hostmaster.test. 1 600 600 1200 600
+test.	         NS      ns.test.
+ns    		 A       10.53.0.1
+bar    		 NS      ns.bar
+ns.bar		 A	 10.53.0.1
+foo		 NS	 ns.foo
+ns.foo		 A	 10.53.0.2
+diff --git a/bin/tests/system/cname_dname_negcache/ns3/named.conf.j2 b/bin/tests/system/cname_dname_negcache/ns3/named.conf.j2
+new file mode 100644
+index 0000000000..197d72756b
+--- /dev/null
+++ b/bin/tests/system/cname_dname_negcache/ns3/named.conf.j2
+@@ -0,0 +1,11 @@
+options {
+    query-source address @ns.ip@;
+    port @PORT@;
+    pid-file "named.pid";
+    listen-on { @ns.ip@; };
+    listen-on-v6 { none; };
+    recursion yes;
+    dnssec-validation no;
+};
+
+{% include "_common/root.hint.conf" %}
+diff --git a/bin/tests/system/cname_dname_negcache/tests_cname_negcache.py b/bin/tests/system/cname_dname_negcache/tests_cname_negcache.py
+new file mode 100644
+index 0000000000..a546d29109
+--- /dev/null
+++ b/bin/tests/system/cname_dname_negcache/tests_cname_negcache.py
+@@ -0,0 +1,16 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+from cname_dname_negcache.common import run_attack
+
+
+def test_cname_negcache(ns3):
+    run_attack(ns3, "cname.foo.test.", "CNAME", "cname.foo.test.", "A")
+diff --git a/bin/tests/system/cname_dname_negcache/tests_dname_negcache.py b/bin/tests/system/cname_dname_negcache/tests_dname_negcache.py
+new file mode 100644
+index 0000000000..41a80b4e05
+--- /dev/null
+++ b/bin/tests/system/cname_dname_negcache/tests_dname_negcache.py
+@@ -0,0 +1,16 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+from cname_dname_negcache.common import run_attack
+
+
+def test_dname_negcache(ns3):
+    run_attack(ns3, "foo.test.", "DNAME", "a.foo.test.", "A")
+-- 
+2.55.0
+
--- a/bind-9.18-CVE-2026-12617.patch
+++ b/bind-9.18-CVE-2026-12617.patch
@ -0,0 +1,280 @@
+From 3138886f3767c0a6b933fd147c5465472209bac6 Mon Sep 17 00:00:00 2001
+From: Colin Vidal <colin@isc.org>
+Date: Thu, 18 Jun 2026 18:17:05 +0200
+Subject: [PATCH] Do not assert in some CNAME/DNAME queries
+
+Fix a `named` crash because of a fail assertion for certains types of
+CNAME and DNAME queries:
+
+- If a client queries for a DNAME and A record to the resolver, and the
+  authoritative server responds positively to the A query but delay the
+  DNAME response and respond later negatively;
+
+- If a client queries for a CNAME and A record to the resolver, and the
+  authoritative server responds positively to the A query but delay the
+  CNAME response and respond later with a self-referential CNAME.
+
+The first scenario consists of sending two queries: `foo.test./DNAME`
+and `a.foo.test./A`. The authoritative server delays the answer for
+`foo.test./DNAME` but immediately answers the DNAME record for the
+second query: `foo.test. DNAME bar.test.`. The resolver caches it,
+follows the DNAME, and resolves `a.bar.test./A`. The authoritative
+server eventually answers negatively for `foo.test./DNAME`
+(NOERROR/NODATA, with only an SOA in the authority section). The
+resolver pulls out the previously cached rdataset (because it has a
+higher trust level than the received negative answer), and wrongly (this
+is the first bug) sets the result to `DNS_R_DNAME` instead of
+`ISC_R_SUCCESS`. The code in `ns/query.c` that handles the resolver
+result interprets this as "this is a non-DNAME query and we got a DNAME
+rdataset, so follow the chain". It goes into the `query_dname()`
+function, which asserts that the qname is a subdomain of the owner name
+in the rdataset. That assertion fails because the qname (`foo.test.`) is
+exactly equal to the owner name of the DNAME (`foo.test.`), rather than
+being a subdomain of it. `DNS_R_DNAME` must only be set when the qtype
+is something other than DNAME and the resolver has obtained a DNAME that
+needs to be followed.
+
+The second scenario consists of sending two queries:
+`cname.foo.test./CNAME` and `cname.foo.test./A`. The authoritative
+server delays the answer for `cname.foo.test./CNAME` but immediately
+answers the CNAME record for the second query: `cname.foo.test. CNAME
+cname.foo.test.`. Note that the CNAME is self-referential. The resolver
+caches it and sets the result code to `DNS_R_CNAME`. Then `ns/query.c`
+interprets this as "this is a non-CNAME query and we got a CNAME
+rdataset, so follow the chain" (which is correct in this case; however,
+because the CNAME rdataset is self-referential, the resolver responds
+with SERVFAIL, which is expected). The authoritative server eventually
+answers negatively for `cname.foo.test./CNAME`. The resolver then pulls
+out the previously cached CNAME rdataset (obtained from the A answer,
+even though it was self-referential, the resolver cached it) and wrongly
+sets the result to `DNS_R_CNAME` (this is the second bug). As noted
+above, `ns/query.c` interprets this as "this is a non-CNAME query and we
+got a CNAME rdataset, so follow the chain". The internals here are
+slightly more subtle: it first goes into `query_cname()` and sets the
+CNAME rdataset in the message answer section, then restarts the query to
+follow the CNAME. The restart retrieves the CNAME rdataset from the
+cache directly (without going to the resolver), and this time the query
+context result is `ISC_R_SUCCESS` (since it was found) and
+`qctx->rdataset` points to the same CNAME again (as it is
+self-referential), so it goes directly into the
+`query_prepresponse()/query_respond()` flow, which attempts to add the
+rdataset to the message answer again. However, this fails because the
+rdataset is already in the message, and the assertion which expects that
+operation to succeed fails (due to `qctx->rdataset` being set to `NULL`
+when ownership of the rdataset was transferred). `DNS_R_CNAME` must only
+be set when the qtype is something other than CNAME and the resolver has
+obtained a CNAME that needs to be followed.
+
+In both cases, the correct answer from the resolver should have been
+`ISC_R_SUCCESS` (instead of respectively `DNS_R_DNAME` and
+`DNS_R_CNAME`) becuase the rdataset that has been looked up was found.
+
+(cherry picked from commit 773d46d58c693047a5945c8fe40512edd0ac214e)
+(cherry picked from commit c740c37689f234e21a9b0ef760471ef2cf1133f5)
+---
+ lib/dns/resolver.c | 137 ++++++++++++++++++++-------------------------
+ 1 file changed, 60 insertions(+), 77 deletions(-)
+
+diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
+index edc9c207e1..1f8b5058d1 100644
+--- a/lib/dns/resolver.c
+++ b/lib/dns/resolver.c
+@@ -692,10 +692,10 @@ fctx_destroy(fetchctx_t *fctx, bool exiting);
+ static void
+ send_shutdown_events(dns_resolver_t *res);
+ static isc_result_t
+-ncache_adderesult(dns_message_t *message, dns_db_t *cache, dns_dbnode_t *node,
+-		  dns_rdatatype_t covers, isc_stdtime_t now, dns_ttl_t minttl,
+-		  dns_ttl_t maxttl, bool optout, bool secure,
+-		  dns_rdataset_t *ardataset, isc_result_t *eresultp);
+ncache_adderesult(fetchctx_t *fctx, dns_message_t *message, dns_dbnode_t *node,
+		  dns_rdatatype_t covers, isc_stdtime_t now, dns_ttl_t maxttl,
+		  bool optout, bool secure, dns_rdataset_t *ardataset,
+		  isc_result_t *eresultp);
+ static void
+ validated(isc_task_t *task, isc_event_t *event);
+ static void
+@@ -5563,6 +5563,46 @@ has_000_label(dns_rdataset_t *nsecset) {
+ 	return false;
+ }
+ 
+/*
+ * After a (non-error) negative-cache add, 'rdataset' is bound to whatever
+ * rdataset the cache authoritatively holds for the queried name and type.
+ * Map that to the result code the fetch should report:
+ *
+ *   - A negative cache entry (the one we just added, or a pre-existing one):
+ *     DNS_R_NCACHENXDOMAIN or DNS_R_NCACHENXRRSET, depending on NXDOMAIN vs
+ *     NODATA.
+ *
+ *   - A positive rdataset that was already cached at higher trust, which
+ *     caused our negative entry to be discarded (e.g. a CNAME or DNAME cached
+ *     by a concurrent query): ISC_R_SUCCESS, because that cached positive
+ *     answer is what gets returned.  Note the specific case for CNAME and
+ *     DNAME *if* the query type is not the same as the rdataset type. There
+ *     is a chain to follow *only* if the query type doesn't ask for the CNAME
+ *     or the DNAME.
+ */
+static isc_result_t
+fctx_setresult(fetchctx_t *fctx, dns_rdataset_t *rdataset) {
+	isc_result_t result = ISC_R_SUCCESS;
+
+	if (NEGATIVE(rdataset)) {
+		result = NXDOMAIN(rdataset) ? DNS_R_NCACHENXDOMAIN
+					    : DNS_R_NCACHENXRRSET;
+	} else if (result == ISC_R_SUCCESS && rdataset->type != fctx->type) {
+		switch (rdataset->type) {
+		case dns_rdatatype_cname:
+			result = DNS_R_CNAME;
+			break;
+		case dns_rdatatype_dname:
+			result = DNS_R_DNAME;
+			break;
+		default:
+			break;
+		}
+	}
+
+	return result;
+}
+
+ /*
+  * The validator has finished.
+  */
+@@ -5836,8 +5876,7 @@ validated(isc_task_t *task, isc_event_t *event) {
+ 			ttl = 0;
+ 		}
+ 
+-		result = ncache_adderesult(message, fctx->cache, node, covers,
+-					   now, fctx->res->view->minncachettl,
+		result = ncache_adderesult(fctx, message, node, covers, now,
+ 					   ttl, vevent->optout, vevent->secure,
+ 					   ardataset, &eresult);
+ 		if (result != ISC_R_SUCCESS) {
+@@ -6081,23 +6120,7 @@ answer_response:
+ 		 */
+ 		INSIST(hevent->rdataset != NULL);
+ 		if (dns_rdataset_isassociated(hevent->rdataset)) {
+-			if (NEGATIVE(hevent->rdataset)) {
+-				INSIST(eresult == DNS_R_NCACHENXDOMAIN ||
+-				       eresult == DNS_R_NCACHENXRRSET);
+-			} else if (eresult == ISC_R_SUCCESS &&
+-				   hevent->rdataset->type != fctx->type)
+-			{
+-				switch (hevent->rdataset->type) {
+-				case dns_rdatatype_cname:
+-					eresult = DNS_R_CNAME;
+-					break;
+-				case dns_rdatatype_dname:
+-					eresult = DNS_R_DNAME;
+-					break;
+-				default:
+-					break;
+-				}
+-			}
+			eresult = fctx_setresult(fctx, hevent->rdataset);
+ 		}
+ 
+ 		hevent->result = eresult;
+@@ -6747,24 +6770,7 @@ cache_name(fetchctx_t *fctx, dns_name_t *name, dns_message_t *message,
+ 			 * event->result.
+ 			 */
+ 			if (dns_rdataset_isassociated(event->rdataset)) {
+-				if (NEGATIVE(event->rdataset)) {
+-					INSIST(eresult ==
+-						       DNS_R_NCACHENXDOMAIN ||
+-					       eresult == DNS_R_NCACHENXRRSET);
+-				} else if (eresult == ISC_R_SUCCESS &&
+-					   event->rdataset->type != fctx->type)
+-				{
+-					switch (event->rdataset->type) {
+-					case dns_rdatatype_cname:
+-						eresult = DNS_R_CNAME;
+-						break;
+-					case dns_rdatatype_dname:
+-						eresult = DNS_R_DNAME;
+-						break;
+-					default:
+-						break;
+-					}
+-				}
+				eresult = fctx_setresult(fctx, event->rdataset);
+ 			}
+ 			event->result = eresult;
+ 			if (adbp != NULL && *adbp != NULL) {
+@@ -6833,12 +6839,14 @@ cache_message(fetchctx_t *fctx, dns_message_t *message,
+  * eresult.
+  */
+ static isc_result_t
+-ncache_adderesult(dns_message_t *message, dns_db_t *cache, dns_dbnode_t *node,
+-		  dns_rdatatype_t covers, isc_stdtime_t now, dns_ttl_t minttl,
+-		  dns_ttl_t maxttl, bool optout, bool secure,
+-		  dns_rdataset_t *ardataset, isc_result_t *eresultp) {
+ncache_adderesult(fetchctx_t *fctx, dns_message_t *message, dns_dbnode_t *node,
+		  dns_rdatatype_t covers, isc_stdtime_t now, dns_ttl_t maxttl,
+		  bool optout, bool secure, dns_rdataset_t *ardataset,
+		  isc_result_t *eresultp) {
+ 	isc_result_t result;
+ 	dns_rdataset_t rdataset;
+	dns_db_t *cache = fctx->cache;
+	dns_ttl_t minttl = fctx->res->view->minncachettl;
+ 
+ 	if (ardataset == NULL) {
+ 		dns_rdataset_init(&rdataset);
+@@ -6854,37 +6862,13 @@ ncache_adderesult(dns_message_t *message, dns_db_t *cache, dns_dbnode_t *node,
+ 	}
+ 	if (result == DNS_R_UNCHANGED || result == ISC_R_SUCCESS) {
+ 		/*
+-		 * If the cache now contains a negative entry and we
+-		 * care about whether it is DNS_R_NCACHENXDOMAIN or
+-		 * DNS_R_NCACHENXRRSET then extract it.
+		 * The cache settled successfully (DNS_R_UNCHANGED means our
+		 * negative entry was discarded in favour of existing
+		 * higher-trust data).  Either way 'ardataset' is now bound to
+		 * the rdataset the cache holds for this name and type; derive
+		 * the result code from it.
+ 		 */
+-		if (NEGATIVE(ardataset)) {
+-			/*
+-			 * The cache data is a negative cache entry.
+-			 */
+-			if (NXDOMAIN(ardataset)) {
+-				*eresultp = DNS_R_NCACHENXDOMAIN;
+-			} else {
+-				*eresultp = DNS_R_NCACHENXRRSET;
+-			}
+-		} else {
+-			/*
+-			 * The attempt to add a negative cache entry
+-			 * was rejected.  Set *eresultp to reflect
+-			 * the type of the dataset being returned.
+-			 */
+-			switch (ardataset->type) {
+-			case dns_rdatatype_cname:
+-				*eresultp = DNS_R_CNAME;
+-				break;
+-			case dns_rdatatype_dname:
+-				*eresultp = DNS_R_DNAME;
+-				break;
+-			default:
+-				*eresultp = ISC_R_SUCCESS;
+-				break;
+-			}
+-		}
+		*eresultp = fctx_setresult(fctx, ardataset);
+ 		result = ISC_R_SUCCESS;
+ 	}
+ 	if (ardataset == &rdataset && dns_rdataset_isassociated(ardataset)) {
+@@ -7029,8 +7013,7 @@ ncache_message(fetchctx_t *fctx, dns_message_t *message,
+ 		ttl = 0;
+ 	}
+ 
+-	result = ncache_adderesult(message, fctx->cache, node, covers, now,
+-				   fctx->res->view->minncachettl, ttl, false,
+	result = ncache_adderesult(fctx, message, node, covers, now, ttl, false,
+ 				   false, ardataset, &eresult);
+ 	if (result != ISC_R_SUCCESS) {
+ 		goto unlock;
+-- 
+2.55.0
+
--- a/bind-9.18-CVE-2026-13204-test.patch
+++ b/bind-9.18-CVE-2026-13204-test.patch
@ -0,0 +1,416 @@
+From 89e950d215e9922e5af6e3c69b9d6a8750346bb6 Mon Sep 17 00:00:00 2001
+From: Alessio Podda <alessio@isc.org>
+Date: Fri, 12 Jun 2026 11:16:01 +0200
+Subject: [PATCH] Reproducer for #5985 addnoqname mismatch
+
+LLM generated.
+
+(cherry picked from commit 5f4de929b3e4749b6e32c51660be11c47c2514e6)
+(cherry picked from commit 0cf010c153518f1f9831e201891ecba8d8ba65e1)
+
+Update reproducer #5985
+
+Update the llm generated reproducer:
+- Move server.py into ans/ans1.py
+- Remove unncessary named.conf configuration options
+- Add comments describing the steps
+- Rename system test
+
+(cherry picked from commit fd539807829dd7d2eb76c8b503083f5d84fec6f0)
+(cherry picked from commit 6c0e599ea85c0c53a4af09742e64e193da089bb4)
+---
+ .../dnssec_findnoqname_mismatch/ans1/ans.py   | 207 ++++++++++++++++++
+ .../ns2/named.conf.j2                         |  33 +++
+ .../tests_findnoqname_mismatch.py             | 126 +++++++++++
+ 3 files changed, 366 insertions(+)
+ create mode 100644 bin/tests/system/dnssec_findnoqname_mismatch/ans1/ans.py
+ create mode 100644 bin/tests/system/dnssec_findnoqname_mismatch/ns2/named.conf.j2
+ create mode 100644 bin/tests/system/dnssec_findnoqname_mismatch/tests_findnoqname_mismatch.py
+
+diff --git a/bin/tests/system/dnssec_findnoqname_mismatch/ans1/ans.py b/bin/tests/system/dnssec_findnoqname_mismatch/ans1/ans.py
+new file mode 100644
+index 0000000000..b36fc831c8
+--- /dev/null
+++ b/bin/tests/system/dnssec_findnoqname_mismatch/ans1/ans.py
+@@ -0,0 +1,207 @@
+#!/usr/bin/python3
+
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+
+from collections.abc import AsyncGenerator
+from dataclasses import dataclass
+from datetime import datetime, timedelta, timezone
+from pathlib import Path
+
+import base64
+import json
+
+from cryptography.hazmat.primitives import serialization
+
+import dns.dnssec
+import dns.flags
+import dns.message
+import dns.name
+import dns.rdata
+import dns.rdataclass
+import dns.rcode
+import dns.rdatatype
+import dns.rrset
+
+from isctest.asyncserver import (
+    AsyncDnsServer,
+    DnsResponseSend,
+    QueryContext,
+    ResponseHandler,
+)
+
+TTL = 300
+ZONE = "f217.test."
+CHILD = f"evil.{ZONE}"
+ATTACK = f"www.{CHILD}"
+NSEC_OWNER = f"00000000.{CHILD}"
+NSEC_NEXT = f"zzz.{CHILD}"
+FORGED_A = "192.0.2.217"
+
+
+@dataclass(frozen=True)
+class Key:
+    zone: dns.name.Name
+    private_key: object
+    dnskey: dns.rdata.Rdata
+
+
+def name(text: str) -> dns.name.Name:
+    return dns.name.from_text(text)
+
+
+def load_key() -> Key:
+    path = Path(__file__).resolve().parent / "keys.json"
+    with path.open(encoding="utf-8") as keys_file:
+        raw_key = json.load(keys_file)[ZONE]
+
+    private_key = serialization.load_pem_private_key(
+        raw_key["private_pem"].encode("ascii"),
+        password=None,
+    )
+    dnskey = dns.rdata.from_text(
+        dns.rdataclass.IN, dns.rdatatype.DNSKEY, raw_key["dnskey"]
+    )
+    return Key(name(ZONE), private_key, dnskey)
+
+
+def rrset(owner: str, rdtype: dns.rdatatype.RdataType, *rdatas: str) -> dns.rrset.RRset:
+    return dns.rrset.from_text(owner, TTL, dns.rdataclass.IN, rdtype, *rdatas)
+
+
+def rrset_from_rdata(owner: str, rdata: dns.rdata.Rdata) -> dns.rrset.RRset:
+    return dns.rrset.from_rdata(name(owner), TTL, rdata)
+
+
+def add_signed(
+    section: list[dns.rrset.RRset], covered: dns.rrset.RRset, signer: Key
+) -> None:
+    rrsig = dns.dnssec.sign(
+        covered,
+        signer.private_key,
+        signer.zone,
+        signer.dnskey,
+        lifetime=86400,
+        verify=True,
+    )
+    section.append(covered)
+    section.append(dns.rrset.from_rdata(covered.name, covered.ttl, rrsig))
+
+
+def soa_rrset(zone: str) -> dns.rrset.RRset:
+    return rrset(
+        zone,
+        dns.rdatatype.SOA,
+        f"ns.{ZONE} hostmaster.{ZONE} 1 7200 3600 1209600 300",
+    )
+
+
+def garbage_rrsig(
+    owner: str, covered: dns.rdatatype.RdataType, labels: int, signer: str
+) -> dns.rrset.RRset:
+    now = datetime.now(timezone.utc)
+    inception = (now - timedelta(hours=1)).strftime("%Y%m%d%H%M%S")
+    expiration = (now + timedelta(days=1)).strftime("%Y%m%d%H%M%S")
+    signature = base64.b64encode(bytes(64)).decode("ascii")
+    text = (
+        f"{dns.rdatatype.to_text(covered)} 13 {labels} {TTL} "
+        f"{expiration} {inception} 12345 {signer} {signature}"
+    )
+    rdata = dns.rdata.from_text(dns.rdataclass.IN, dns.rdatatype.RRSIG, text)
+    return dns.rrset.from_rdata(name(owner), TTL, rdata)
+
+
+def add_ds_denial(response: dns.message.Message, key: Key) -> None:
+    add_signed(response.authority, soa_rrset(ZONE), key)
+    nsec = rrset(CHILD, dns.rdatatype.NSEC, f"ns.{ZONE} NS RRSIG NSEC")
+    add_signed(response.authority, nsec, key)
+
+
+def add_attack_answer(response: dns.message.Message) -> None:
+    """
+    Crafted authoritative response to <q>.evil.f217.hack./A
+
+        ;; ANSWER
+        <q>.evil.f217.hack.        300 IN A     192.0.2.217
+        <q>.evil.f217.hack.        300 IN RRSIG A 13 1 300 <exp> <inc> 12345 evil.f217.hack. <base64 of 64×0x00>
+                                                    ^^^ Labels = 1, qname has 4 labels, wildcard heuristic fires
+
+        ;; AUTHORITY (single owner, three rdatasets in this wire order)
+        00000000.evil.f217.hack.   300 IN NSEC  zzz.evil.f217.hack. A RRSIG NSEC
+        00000000.evil.f217.hack.   300 IN RRSIG NSEC 13 4 300 <exp> <inc> 12345 evil.f217.hack. <base64 of 64×0x00>
+        00000000.evil.f217.hack.   300 IN NSEC3 1 0 0 - VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV A RRSIG
+    """
+    # A + RRSIG
+    response.answer.append(rrset(ATTACK, dns.rdatatype.A, FORGED_A))
+    response.answer.append(garbage_rrsig(ATTACK, dns.rdatatype.A, 1, CHILD))
+    # NSEC
+    nsec = rrset(
+        NSEC_OWNER,
+        dns.rdatatype.NSEC,
+        f"{NSEC_NEXT} A RRSIG NSEC",
+    )
+    response.authority.append(nsec)
+    # RRSIG(NSEC)
+    response.authority.append(
+        garbage_rrsig(
+            NSEC_OWNER,
+            dns.rdatatype.NSEC,
+            len(name(NSEC_OWNER).labels) - 1,
+            CHILD,
+        )
+    )
+    # NSEC3
+    nsec3 = rrset(
+        NSEC_OWNER,
+        dns.rdatatype.NSEC3,
+        "1 0 0 - VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV A RRSIG",
+    )
+    response.authority.append(nsec3)
+
+
+class RuntimeCheckHandler(ResponseHandler):
+    def __init__(self, key: Key) -> None:
+        self.key = key
+        self.zone = name(ZONE)
+        self.child = name(CHILD)
+        self.attack = name(ATTACK)
+
+    def match(self, qctx: QueryContext) -> bool:
+        return qctx.qname.is_subdomain(self.zone)
+
+    async def get_responses(
+        self, qctx: QueryContext
+    ) -> AsyncGenerator[DnsResponseSend, None]:
+        qctx.prepare_new_response(with_zone_data=False)
+        qctx.response.flags |= dns.flags.AA
+        qctx.response.set_rcode(dns.rcode.NOERROR)
+
+        if qctx.qname == self.zone and qctx.qtype == dns.rdatatype.DNSKEY:
+            add_signed(
+                qctx.response.answer,
+                rrset_from_rdata(ZONE, self.key.dnskey),
+                self.key,
+            )
+        elif qctx.qname == self.zone and qctx.qtype == dns.rdatatype.SOA:
+            add_signed(qctx.response.answer, soa_rrset(ZONE), self.key)
+        elif qctx.qname == self.child and qctx.qtype == dns.rdatatype.DS:
+            add_ds_denial(qctx.response, self.key)
+        elif qctx.qname == self.child and qctx.qtype == dns.rdatatype.DNSKEY:
+            qctx.response.authority.append(soa_rrset(CHILD))
+        elif qctx.qname == self.attack and qctx.qtype == dns.rdatatype.A:
+            add_attack_answer(qctx.response)
+        else:
+            add_signed(qctx.response.authority, soa_rrset(ZONE), self.key)
+
+        yield DnsResponseSend(qctx.response, authoritative=True)
+
+
+def main() -> None:
+    server = AsyncDnsServer(default_aa=True)
+    server.install_response_handlers(RuntimeCheckHandler(load_key()))
+    server.run()
+
+
+if __name__ == "__main__":
+    main()
+diff --git a/bin/tests/system/dnssec_findnoqname_mismatch/ns2/named.conf.j2 b/bin/tests/system/dnssec_findnoqname_mismatch/ns2/named.conf.j2
+new file mode 100644
+index 0000000000..f4fbd8a617
+--- /dev/null
+++ b/bin/tests/system/dnssec_findnoqname_mismatch/ns2/named.conf.j2
+@@ -0,0 +1,33 @@
+// validating resolver
+
+options {
+	query-source address 10.53.0.2;
+	notify-source 10.53.0.2;
+	transfer-source 10.53.0.2;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.2; };
+	listen-on-v6 { none; };
+	recursion yes;
+	dnssec-validation yes;
+};
+
+controls {
+	inet 10.53.0.2 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+include "../../_common/rndc.key";
+
+zone "." {
+	type hint;
+	file "../../_common/root.hint";
+};
+
+zone "f217.test" {
+	type static-stub;
+	server-addresses { 10.53.0.1; };
+};
+
+trust-anchors {
+	f217.test. static-key 257 3 13 "@ZONE_DNSKEY@";
+};
+diff --git a/bin/tests/system/dnssec_findnoqname_mismatch/tests_findnoqname_mismatch.py b/bin/tests/system/dnssec_findnoqname_mismatch/tests_findnoqname_mismatch.py
+new file mode 100644
+index 0000000000..f3e332a360
+--- /dev/null
+++ b/bin/tests/system/dnssec_findnoqname_mismatch/tests_findnoqname_mismatch.py
+@@ -0,0 +1,126 @@
+#!/usr/bin/python3
+
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+
+from pathlib import Path
+
+import json
+
+from cryptography.hazmat.primitives import serialization
+from cryptography.hazmat.primitives.asymmetric import ec
+
+import dns.dnssec
+import dns.name
+import dns.rdataclass
+import dns.rdatatype
+import pytest
+
+import isctest
+import isctest.mark
+
+ZONE = "f217.test."
+CHILD = f"evil.{ZONE}"
+ATTACK = f"www.{CHILD}"
+NSEC_OWNER = f"00000000.{CHILD}"
+FORGED_A = "192.0.2.217"
+AUTH = "10.53.0.1"
+RESOLVER = "10.53.0.2"
+
+pytestmark = [
+    isctest.mark.with_ecdsa_deterministic,
+    pytest.mark.extra_artifacts(
+        [
+            "ans1/ans.run",
+            "ans1/keys.json",
+        ]
+    ),
+]
+
+
+def _make_key():
+    private_key = ec.generate_private_key(ec.SECP256R1())
+    dnskey = dns.dnssec.make_dnskey(
+        private_key.public_key(),
+        algorithm="ECDSAP256SHA256",
+        flags=257,
+    )
+    private_pem = private_key.private_bytes(
+        encoding=serialization.Encoding.PEM,
+        format=serialization.PrivateFormat.PKCS8,
+        encryption_algorithm=serialization.NoEncryption(),
+    ).decode("ascii")
+    return {
+        "private_pem": private_pem,
+        "dnskey": dnskey.to_text(),
+    }
+
+
+def bootstrap():
+    keys = {ZONE: _make_key()}
+    Path("ans1/keys.json").write_text(json.dumps(keys, indent=2), encoding="ascii")
+    zone_dnskey = "".join(keys[ZONE]["dnskey"].split()[3:])
+    return {"ZONE_DNSKEY": zone_dnskey}
+
+
+def _query(server, qname, qtype):
+    query = isctest.query.create(qname, qtype)
+    return isctest.query.tcp(query, server, attempts=1, timeout=5)
+
+
+def _rrset(response, section, owner, rdtype, covers=None):
+    if covers is None:
+        return response.get_rrset(
+            section, dns.name.from_text(owner), dns.rdataclass.IN, rdtype
+        )
+    return response.get_rrset(
+        section,
+        dns.name.from_text(owner),
+        dns.rdataclass.IN,
+        rdtype,
+        covers=covers,
+    )
+
+
+def _has_a(response, section, owner, address):
+    rrset = _rrset(response, section, owner, dns.rdatatype.A)
+    return rrset is not None and any(rdata.address == address for rdata in rrset)
+
+
+def _check_rrsig(response, section, owner, rdtype, signer, labels=None):
+    rrsig = _rrset(response, section, owner, dns.rdatatype.RRSIG, covers=rdtype)
+    assert rrsig is not None, response.to_text()
+    assert rrsig[0].signer == dns.name.from_text(signer), response.to_text()
+    if labels is not None:
+        assert rrsig[0].labels == labels, response.to_text()
+
+
+def test_malicious_findnoqname_addnoqname_mismatch():
+    response = _query(AUTH, ATTACK, "A")
+    isctest.check.noerror(response)
+    assert _has_a(response, response.answer, ATTACK, FORGED_A), response.to_text()
+    _check_rrsig(response, response.answer, ATTACK, dns.rdatatype.A, CHILD, labels=1)
+
+    # Has NSEC
+    assert _rrset(response, response.authority, NSEC_OWNER, dns.rdatatype.NSEC)
+    _check_rrsig(response, response.authority, NSEC_OWNER, dns.rdatatype.NSEC, CHILD)
+    # Has NSEC3
+    assert _rrset(response, response.authority, NSEC_OWNER, dns.rdatatype.NSEC3)
+    assert (
+        _rrset(
+            response,
+            response.authority,
+            NSEC_OWNER,
+            dns.rdatatype.RRSIG,
+            covers=dns.rdatatype.NSEC3,
+        )
+        is None
+    )
+
+
+def test_resolver_findnoqname_addnoqname_mismatch():
+    # Send one trigger query
+    _query(RESOLVER, ATTACK, "A")
+    response = _query(RESOLVER, ZONE, "SOA")
+    isctest.check.noerror(response)
+-- 
+2.55.0
+
--- a/bind-9.18-CVE-2026-13204.patch
+++ b/bind-9.18-CVE-2026-13204.patch
@ -0,0 +1,158 @@
+From 895cac04332d85489ddf881b28e18e9956f6e348 Mon Sep 17 00:00:00 2001
+From: Evan Hunt <each@isc.org>
+Date: Wed, 13 May 2026 20:45:57 -0700
+Subject: [PATCH] dns_rdataset_addnoqname() could find unsigned NSEC/NSEC3
+
+The dns_rdatalist addnoqname() implementation searches for the first
+NSEC or NSEC3 record in a message, then for the first RRSIG covering
+that type in the same message.  Previously, if no RRSIG for the type was
+found, the function accepted the unsigned record. Now, it will instead
+continue searching until an NSEC or NSEC3 that does have a matching
+signature is found.
+
+When this function is called from validated() in resolver.c, a
+non-success return code is now treated as an error instead of triggering
+an assertion failure.
+
+Fixes: isc-projects/bind9#5985
+(cherry picked from commit 57cba571ee31311e54d8a11cb38094d439f04e09)
+(cherry picked from commit 48f5aa5fb3746d6194edcc57e8792a8b3cc3b454)
+---
+ lib/dns/rbtdb.c     | 10 +++++++---
+ lib/dns/rdatalist.c | 33 ++++++++++++++++-----------------
+ lib/dns/resolver.c  |  4 +++-
+ lib/ns/query.c      |  3 +--
+ 4 files changed, 27 insertions(+), 23 deletions(-)
+
+diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
+index 0b8547950f..c922df557b 100644
+--- a/lib/dns/rbtdb.c
+++ b/lib/dns/rbtdb.c
+@@ -6946,7 +6946,7 @@ delegating_type(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node,
+ static isc_result_t
+ addnoqname(dns_rbtdb_t *rbtdb, rdatasetheader_t *newheader,
+ 	   uint32_t maxrrperset, dns_rdataset_t *rdataset) {
+-	struct noqname *noqname;
+	struct noqname *noqname = NULL;
+ 	isc_mem_t *mctx = rbtdb->common.mctx;
+ 	dns_name_t name;
+ 	dns_rdataset_t neg, negsig;
+@@ -6958,7 +6958,9 @@ addnoqname(dns_rbtdb_t *rbtdb, rdatasetheader_t *newheader,
+ 	dns_rdataset_init(&negsig);
+ 
+ 	result = dns_rdataset_getnoqname(rdataset, &name, &neg, &negsig);
+-	RUNTIME_CHECK(result == ISC_R_SUCCESS);
+	if (result != ISC_R_SUCCESS) {
+		goto cleanup;
+	}
+ 
+ 	noqname = isc_mem_get(mctx, sizeof(*noqname));
+ 	dns_name_init(&noqname->name, NULL);
+@@ -6984,7 +6986,9 @@ addnoqname(dns_rbtdb_t *rbtdb, rdatasetheader_t *newheader,
+ cleanup:
+ 	dns_rdataset_disassociate(&neg);
+ 	dns_rdataset_disassociate(&negsig);
+-	free_noqname(mctx, &noqname);
+	if (noqname != NULL) {
+		free_noqname(mctx, &noqname);
+	}
+ 	return result;
+ }
+ 
+diff --git a/lib/dns/rdatalist.c b/lib/dns/rdatalist.c
+index 98036f9cb3..2cca8d64be 100644
+--- a/lib/dns/rdatalist.c
+++ b/lib/dns/rdatalist.c
+@@ -192,6 +192,7 @@ isc__rdatalist_addnoqname(dns_rdataset_t *rdataset, const dns_name_t *name) {
+ 	dns_rdataset_t *neg = NULL;
+ 	dns_rdataset_t *negsig = NULL;
+ 	dns_rdataset_t *rdset;
+	dns_rdataset_t *sigset;
+ 	dns_ttl_t ttl;
+ 
+ 	REQUIRE(rdataset != NULL);
+@@ -199,30 +200,27 @@ isc__rdatalist_addnoqname(dns_rdataset_t *rdataset, const dns_name_t *name) {
+ 	for (rdset = ISC_LIST_HEAD(name->list); rdset != NULL;
+ 	     rdset = ISC_LIST_NEXT(rdset, link))
+ 	{
+-		if (rdset->rdclass != rdataset->rdclass) {
+-			continue;
+-		}
+-		if (rdset->type == dns_rdatatype_nsec ||
+-		    rdset->type == dns_rdatatype_nsec3)
+		if (rdset->rdclass != rdataset->rdclass ||
+		    (rdset->type != dns_rdatatype_nsec &&
+		     rdset->type != dns_rdatatype_nsec3))
+ 		{
+-			neg = rdset;
+			continue;
+ 		}
+-	}
+-	if (neg == NULL) {
+-		return ISC_R_NOTFOUND;
+-	}
+ 
+-	for (rdset = ISC_LIST_HEAD(name->list); rdset != NULL;
+-	     rdset = ISC_LIST_NEXT(rdset, link))
+-	{
+-		if (rdset->type == dns_rdatatype_rrsig &&
+-		    rdset->covers == neg->type)
+		for (sigset = ISC_LIST_HEAD(name->list); sigset != NULL;
+		     sigset = ISC_LIST_NEXT(sigset, link))
+ 		{
+-			negsig = rdset;
+			if (sigset->type == dns_rdatatype_rrsig &&
+			    sigset->covers == rdset->type)
+			{
+				neg = rdset;
+				negsig = sigset;
+				break;
+			}
+ 		}
+ 	}
+ 
+-	if (negsig == NULL) {
+	if (neg == NULL || negsig == NULL) {
+ 		return ISC_R_NOTFOUND;
+ 	}
+ 	/*
+@@ -238,6 +236,7 @@ isc__rdatalist_addnoqname(dns_rdataset_t *rdataset, const dns_name_t *name) {
+ 	rdataset->ttl = neg->ttl = negsig->ttl = ttl;
+ 	rdataset->attributes |= DNS_RDATASETATTR_NOQNAME;
+ 	rdataset->private6 = name;
+
+ 	return ISC_R_SUCCESS;
+ }
+ 
+diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
+index 1f8b5058d1..059ce53a9e 100644
+--- a/lib/dns/resolver.c
+++ b/lib/dns/resolver.c
+@@ -5893,7 +5893,9 @@ validated(isc_task_t *task, isc_event_t *event) {
+ 		result = dns_rdataset_addnoqname(
+ 			vevent->rdataset,
+ 			vevent->proofs[DNS_VALIDATOR_NOQNAMEPROOF]);
+-		RUNTIME_CHECK(result == ISC_R_SUCCESS);
+		if (result != ISC_R_SUCCESS) {
+			goto noanswer_response;
+		}
+ 		INSIST(vevent->sigrdataset != NULL);
+ 		vevent->sigrdataset->ttl = vevent->rdataset->ttl;
+ 		if (vevent->proofs[DNS_VALIDATOR_CLOSESTENCLOSER] != NULL) {
+diff --git a/lib/ns/query.c b/lib/ns/query.c
+index 3bd7daf79c..2a2ba1daba 100644
+--- a/lib/ns/query.c
+++ b/lib/ns/query.c
+@@ -7953,8 +7953,7 @@ query_addnoqnameproof(query_ctx_t *qctx) {
+ 		goto cleanup;
+ 	}
+ 
+-	result = dns_rdataset_getnoqname(qctx->noqname, fname, neg, negsig);
+-	RUNTIME_CHECK(result == ISC_R_SUCCESS);
+	CHECK(dns_rdataset_getnoqname(qctx->noqname, fname, neg, negsig));
+ 
+ 	query_addrrset(qctx, &fname, &neg, &negsig, dbuf,
+ 		       DNS_SECTION_AUTHORITY);
+-- 
+2.55.0
+
--- a/bind-9.18-CVE-2026-13321-test.patch
+++ b/bind-9.18-CVE-2026-13321-test.patch
@ -0,0 +1,445 @@
+From eaa35628f4a201049295a8944f4d28e8a1013199 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ayd=C4=B1n=20Mercan?= <aydin@isc.org>
+Date: Wed, 6 May 2026 16:54:57 +0300
+Subject: [PATCH] Add system test for out-of-zone nsec dnssec bypass
+
+A malicious zone with out-of-zone NSEC entries can get a DNSSEC
+validating resolver's cache to cover the victim zone for non-existence
+and prevent nameserver queries without DNSSEC failure.
+
+Test for this case with an `evil.test` zone that tries to cover the
+`victim.test` zone.
+
+(cherry picked from commit 654f9773c0af59965c343bdfeb096b3dffe9dd53)
+(cherry picked from commit c969ad2c17b43dd999e358bfeb280d3df6fab822)
+---
+ .../system/dnssec_bypass/ns1/named.conf.j2    |  31 ++++
+ bin/tests/system/dnssec_bypass/ns1/root.db    |  19 +++
+ bin/tests/system/dnssec_bypass/ns1/test.db    |  23 +++
+ .../system/dnssec_bypass/ns2/named.conf.j2    |  26 +++
+ bin/tests/system/dnssec_bypass/ns2/victim.db  |  18 +++
+ bin/tests/system/dnssec_bypass/ns3/evil.db    |  23 +++
+ .../system/dnssec_bypass/ns3/named.conf.j2    |  26 +++
+ .../system/dnssec_bypass/ns4/named.conf.j2    |  35 ++++
+ .../system/dnssec_bypass/tests_bypass.py      | 152 ++++++++++++++++++
+ 9 files changed, 353 insertions(+)
+ create mode 100644 bin/tests/system/dnssec_bypass/ns1/named.conf.j2
+ create mode 100644 bin/tests/system/dnssec_bypass/ns1/root.db
+ create mode 100644 bin/tests/system/dnssec_bypass/ns1/test.db
+ create mode 100644 bin/tests/system/dnssec_bypass/ns2/named.conf.j2
+ create mode 100644 bin/tests/system/dnssec_bypass/ns2/victim.db
+ create mode 100644 bin/tests/system/dnssec_bypass/ns3/evil.db
+ create mode 100644 bin/tests/system/dnssec_bypass/ns3/named.conf.j2
+ create mode 100644 bin/tests/system/dnssec_bypass/ns4/named.conf.j2
+ create mode 100644 bin/tests/system/dnssec_bypass/tests_bypass.py
+
+diff --git a/bin/tests/system/dnssec_bypass/ns1/named.conf.j2 b/bin/tests/system/dnssec_bypass/ns1/named.conf.j2
+new file mode 100644
+index 0000000000..59ced1831a
+--- /dev/null
+++ b/bin/tests/system/dnssec_bypass/ns1/named.conf.j2
+@@ -0,0 +1,31 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.1; };
+	listen-on-v6 { none; };
+	recursion no;
+	dnssec-validation no;
+};
+
+zone "test." {
+	type primary;
+	file "test.db.signed";
+};
+
+zone "." {
+	type primary;
+	file "root.db.signed";
+};
+diff --git a/bin/tests/system/dnssec_bypass/ns1/root.db b/bin/tests/system/dnssec_bypass/ns1/root.db
+new file mode 100644
+index 0000000000..8d98a0456c
+--- /dev/null
+++ b/bin/tests/system/dnssec_bypass/ns1/root.db
+@@ -0,0 +1,19 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 3600
+.			IN SOA	a.nil. a.nil. 1 3600 600 86400 300
+.			IN NS	a.root-servers.nil.
+
+a.root-servers.nil.	IN A	10.53.0.1
+
+test.			IN NS	ns1.test.
+ns1.test.		IN A	10.53.0.1
+diff --git a/bin/tests/system/dnssec_bypass/ns1/test.db b/bin/tests/system/dnssec_bypass/ns1/test.db
+new file mode 100644
+index 0000000000..6efcd95e42
+--- /dev/null
+++ b/bin/tests/system/dnssec_bypass/ns1/test.db
+@@ -0,0 +1,23 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$ORIGIN test.
+$TTL 3600
+
+@		IN SOA a a 1 3600 600 86400 300
+		IN NS	ns1.test.
+ns1		IN A	10.53.0.1
+
+evil		IN NS	ns1.evil
+ns1.evil	IN A	10.53.0.3
+
+victim		IN NS	ns1.victim
+ns1.victim	IN A	10.53.0.2
+diff --git a/bin/tests/system/dnssec_bypass/ns2/named.conf.j2 b/bin/tests/system/dnssec_bypass/ns2/named.conf.j2
+new file mode 100644
+index 0000000000..e81cee7cac
+--- /dev/null
+++ b/bin/tests/system/dnssec_bypass/ns2/named.conf.j2
+@@ -0,0 +1,26 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.2; };
+	listen-on-v6 { none; };
+	recursion no;
+	dnssec-validation no;
+};
+
+zone "victim.test." {
+	type primary;
+	file "victim.db.signed";
+};
+diff --git a/bin/tests/system/dnssec_bypass/ns2/victim.db b/bin/tests/system/dnssec_bypass/ns2/victim.db
+new file mode 100644
+index 0000000000..edcc234322
+--- /dev/null
+++ b/bin/tests/system/dnssec_bypass/ns2/victim.db
+@@ -0,0 +1,18 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$ORIGIN victim.test.
+$TTL 3600
+
+@		IN SOA	ns1 hostmaster 1 3600 600 86400 2147483647
+		IN NS	ns1
+
+ns1		IN A	10.53.0.2
+diff --git a/bin/tests/system/dnssec_bypass/ns3/evil.db b/bin/tests/system/dnssec_bypass/ns3/evil.db
+new file mode 100644
+index 0000000000..618f9d3e85
+--- /dev/null
+++ b/bin/tests/system/dnssec_bypass/ns3/evil.db
+@@ -0,0 +1,23 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$ORIGIN evil.test.
+$TTL 300
+
+@		IN SOA	ns1 hostmaster 1 3600 600 86400 300
+		IN NS	ns1
+; Try to poison the victim zone in a resolver cache.
+; If admitted, the aggressive NSEC cache will accept a range such as
+; [evil.test, b.victim.test) and will cause the victim nameserver to
+; be never queried.
+		IN NSEC	b.victim.test. NS SOA RRSIG NSEC DNSKEY
+
+ns1		IN A	10.53.0.3
+diff --git a/bin/tests/system/dnssec_bypass/ns3/named.conf.j2 b/bin/tests/system/dnssec_bypass/ns3/named.conf.j2
+new file mode 100644
+index 0000000000..17d3e18e4e
+--- /dev/null
+++ b/bin/tests/system/dnssec_bypass/ns3/named.conf.j2
+@@ -0,0 +1,26 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.3; };
+	listen-on-v6 { none; };
+	recursion no;
+	dnssec-validation no;
+};
+
+zone "evil.test." {
+	type primary;
+	file "evil.db.signed";
+};
+diff --git a/bin/tests/system/dnssec_bypass/ns4/named.conf.j2 b/bin/tests/system/dnssec_bypass/ns4/named.conf.j2
+new file mode 100644
+index 0000000000..039695d9b7
+--- /dev/null
+++ b/bin/tests/system/dnssec_bypass/ns4/named.conf.j2
+@@ -0,0 +1,35 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+	query-source address 10.53.0.4;
+	notify-source 10.53.0.4;
+	transfer-source 10.53.0.4;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.4; };
+	listen-on-v6 { none; };
+	allow-transfer { any; };
+	recursion yes;
+	dnssec-validation yes;
+	synth-from-dnssec yes;
+};
+
+trust-anchors {
+	@root.domain@ @root.type@ @root.contents@;
+};
+
+zone "." {
+	type hint;
+	file "../../_common/root.hint";
+};
+diff --git a/bin/tests/system/dnssec_bypass/tests_bypass.py b/bin/tests/system/dnssec_bypass/tests_bypass.py
+new file mode 100644
+index 0000000000..c41bb7e016
+--- /dev/null
+++ b/bin/tests/system/dnssec_bypass/tests_bypass.py
+@@ -0,0 +1,152 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+from datetime import datetime, timedelta, timezone
+
+import shutil
+
+from cryptography.hazmat.primitives.asymmetric import ec
+
+import dns.dnssec
+import dns.name
+import dns.rdataclass
+import dns.rdataset
+import dns.rdatatype
+import dns.rrset
+import dns.zone
+
+from isctest.run import EnvCmd
+
+import isctest
+
+TTL = 3600
+
+
+def bootstrap():
+    keygen = EnvCmd("KEYGEN", "-q -a ECDSA256")
+    signer = EnvCmd("SIGNER", "-S -g -O full")
+
+    def sign_regular_zone(ns: str, zone: str, database: str) -> isctest.kasp.Key:
+        isctest.log.info(f"{zone}: generate keys")
+        keygen(zone, cwd=ns).out.strip()
+        ksk = keygen(f"-f KSK {zone}", cwd=ns).out.strip()
+
+        isctest.log.info(f"{zone}: sign zone")
+        signer(f"-o {zone} {database}", cwd=ns)
+
+        if ns != "ns1":
+            shutil.copy(f"{ns}/dsset-{zone}", f"ns1/dsset-{zone}")
+            shutil.copy(f"{ns}/{ksk}.key", f"ns1/{ksk}.key")
+
+        return isctest.kasp.Key(ksk, keydir=ns)
+
+    # dnssec-signzone and `dns.dnssec.sign_zone` correctly disregard the invalid
+    # NSEC entries when signing the zone. However, for this test we actualy *want*
+    # to serve invalid yet signed zones. To accomplish this we sign the zone and then
+    # replace the correct entries with the faulty ones accompanied by its RRSIG.
+    #
+    # TODO(aydin): move this to `isctest` to sign broken zones
+    def sign_rogue_zone(ns: str, zone: str, database: str) -> None:
+        # Read zone.
+        origin = dns.name.from_text(zone)
+        data = dns.zone.from_file(f"{ns}/{database}", origin=origin, relativize=False)
+
+        # Get key for signing.
+        isctest.log.info(f"{zone}: generate keys")
+        private_key = ec.generate_private_key(ec.SECP256R1())
+        dnskey = dns.dnssec.make_dnskey(
+            public_key=private_key.public_key(),
+            algorithm=dns.dnssec.Algorithm.ECDSAP256SHA256,
+            flags=257,
+        )
+
+        # Sign zone.
+        isctest.log.info(f"{zone}: sign zone")
+        now = datetime.now(timezone.utc)
+        inception = now - timedelta(hours=1)
+        expiration = now + timedelta(days=30)
+
+        for name, node in data.nodes.items():
+            owner = name.derelativize(origin)
+            rdatasets = list(node.rdatasets)
+
+            for rdataset in rdatasets:
+                rrset = dns.rrset.RRset(owner, rdataset.rdclass, rdataset.rdtype)
+                rrset.update(rdataset)
+
+                rrsig = dns.dnssec.sign(
+                    rrset=rrset,
+                    private_key=private_key,
+                    signer=origin,
+                    dnskey=dnskey,
+                    inception=inception,
+                    expiration=expiration,
+                    deterministic=False,
+                )
+
+                rdataset = dns.rdataset.Rdataset(rrset.rdclass, dns.rdatatype.RRSIG)
+                rdataset.add(rrsig, rrset.ttl)
+                node.replace_rdataset(rdataset)
+
+        # Sign DNSKEY RRset.
+        dnskey_rrset = dns.rrset.RRset(origin, dns.rdataclass.IN, dns.rdatatype.DNSKEY)
+        dnskey_rrset.add(dnskey, ttl=TTL)
+
+        apex_node = data.nodes[origin]
+        apex_node.replace_rdataset(dnskey_rrset)
+
+        rrsig = dns.dnssec.sign(
+            rrset=dnskey_rrset,
+            private_key=private_key,
+            signer=origin,
+            dnskey=dnskey,
+            inception=inception,
+            expiration=expiration,
+            deterministic=False,
+        )
+        rdataset = dns.rdataset.Rdataset(rrset.rdclass, dns.rdatatype.RRSIG)
+        rdataset.add(rrsig, dnskey_rrset.ttl)
+        apex_node.replace_rdataset(rdataset)
+
+        # Output zone.
+        data.to_file(f"{ns}/{database}.signed", relativize=False)
+
+        # Output DS.
+        ds = dns.dnssec.make_ds(name=origin, key=dnskey, algorithm="SHA256")
+        with open(f"ns1/dsset-{zone}", "w", encoding="utf-8") as f:
+            f.write(f"{zone} {TTL} IN DS {ds.to_text()}\n")
+
+    sign_rogue_zone("ns3", "evil.test.", "evil.db")
+    sign_regular_zone("ns2", "victim.test.", "victim.db")
+    sign_regular_zone("ns1", "test.", "test.db")
+    root_ksk = sign_regular_zone("ns1", ".", "root.db")
+
+    return {
+        "root": root_ksk.into_ta("static-key"),
+    }
+
+
+def test_out_of_zone_nsec(ns4):
+    isctest.log.info("trying to poison aggressive nsec cache")
+    msg = isctest.query.create("nx.evil.test", "A")
+    res = isctest.query.tcp(msg, ns4.ip)
+    isctest.check.noadflag(res)
+
+    isctest.log.info("query victim from recursive")
+    msg = isctest.query.create("victim.test", "SOA")
+    res = isctest.query.tcp(msg, ns4.ip, attempts=1)
+    isctest.check.noerror(res)
+    isctest.check.adflag(res)
+    isctest.check.rr_count_eq(res.answer, 2)
+
+    isctest.log.info("checking for query history on victim nameserver")
+    with open("ns2/named.run", "r", encoding="utf-8") as f:
+        assert "(victim.test): query 'victim.test/SOA/IN' approved" in f.read()
+-- 
+2.55.0
+
--- a/bind-9.18-CVE-2026-13321.patch
+++ b/bind-9.18-CVE-2026-13321.patch
@ -0,0 +1,277 @@
+From 72967445f37a01d28b4ecb0e8f907e22fddd5087 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ayd=C4=B1n=20Mercan?= <aydin@isc.org>
+Date: Thu, 7 May 2026 18:59:20 +0300
+Subject: [PATCH] Reject out-of-zone NSEC next owner names
+
+When verifying DNSSEC records, make sure that a next owner name of
+an NSEC record is a subdomain of the signer field.
+
+This follows the specification RFC 4034, section 4.1.1:
+
+ Owner names of RRsets for which the given zone is not authoritative
+ (such as glue records) MUST NOT be listed in the Next Domain Name
+ unless at least one authoritative RRset exists at the same owner
+ name.
+
+While the above paragraph is intended for glue records, it also
+applies to out-of-zone data.
+
+(cherry picked from commit 4065512d25b71605b9502bb69dfb903776d35aa9)
+(cherry picked from commit 058023c66f11d78590d4aa8c4f98946c4c965e21)
+
+change dns_nsec_requiredtypespresent to dns_nsec_is_legal
+
+Change `dns_nsec_requiredtypespresent` to `dns_nsec_is_legal` as a
+function for checking multiple NSEC validity rules.
+
+Currently we now additionally check for out-of-zone NSEC entries.
+
+(cherry picked from commit be2a6a497312469890b552907d039d2de0b44ccc)
+(cherry picked from commit f751e19a30d107f04c2f644aff9f8dab8fed03ab)
+---
+ lib/dns/dnssec.c             | 13 ++++++++++
+ lib/dns/include/dns/dnssec.h |  6 +++++
+ lib/dns/include/dns/nsec.h   | 18 ++++++++++----
+ lib/dns/nsec.c               | 17 ++++++++++---
+ lib/dns/resolver.c           | 48 ++++++++++++++++++++++++++++++++++--
+ lib/ns/query.c               |  6 ++---
+ 6 files changed, 94 insertions(+), 14 deletions(-)
+
+diff --git a/lib/dns/dnssec.c b/lib/dns/dnssec.c
+index 9b9b1f2bb2..5acaea9ecb 100644
+--- a/lib/dns/dnssec.c
+++ b/lib/dns/dnssec.c
+@@ -357,8 +357,10 @@ isc_result_t
+ dns_dnssec_verify(const dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
+ 		  bool ignoretime, unsigned int maxbits, isc_mem_t *mctx,
+ 		  dns_rdata_t *sigrdata, dns_name_t *wild) {
+	dns_rdata_nsec_t nsec;
+ 	dns_rdata_rrsig_t sig;
+ 	dns_fixedname_t fnewname;
+	dns_rdata_t rdata = DNS_RDATA_INIT;
+ 	isc_region_t r;
+ 	isc_buffer_t envbuf;
+ 	dns_rdata_t *rdatas;
+@@ -464,6 +466,17 @@ dns_dnssec_verify(const dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
+ 		}
+ 		break;
+ 	}
+	/*
+	 * Check for out of zone NSEC entries.
+	 */
+	if (set->type == dns_rdatatype_nsec) {
+		RETERR(dns_rdataset_first(set));
+		dns_rdataset_current(set, &rdata);
+		RETERR(dns_rdata_tostruct(&rdata, &nsec, NULL));
+		if (!dns_name_issubdomain(&nsec.next, &sig.signer)) {
+			return DNS_R_NOVALIDNSEC;
+		}
+	}
+ 
+ again:
+ 	ret = dst_context_create(key, mctx, DNS_LOGCATEGORY_DNSSEC, false,
+diff --git a/lib/dns/include/dns/dnssec.h b/lib/dns/include/dns/dnssec.h
+index cb8fd9dc20..2be11b9144 100644
+--- a/lib/dns/include/dns/dnssec.h
+++ b/lib/dns/include/dns/dnssec.h
+@@ -151,6 +151,9 @@ dns_dnssec_verify(const dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
+  *	this record, as this requires a resolver or database.
+  *	If 'ignoretime' is true, temporal validity will not be checked.
+  *
+ *	If 'set' is of type NSEC, this function also verifies that the
+ *	Next Name is a subdomain of the Signer's Name from 'sigrdata'.
+ *
+  *	'maxbits' specifies the maximum number of rsa exponent bits accepted.
+  *
+  *	Requires:
+@@ -173,6 +176,9 @@ dns_dnssec_verify(const dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
+  *\li		#DNS_R_KEYUNAUTHORIZED - the key cannot sign this data (either
+  *			it is not a zone key or its flags prevent
+  *			authentication)
+ *
+ *\li		#DNS_R_NOVALIDNSEC - the NSEC rdata is not valid
+ *\li		#DNS_R_KEYUNAUTHORIZED - the key cannot sign this data
+  *\li		DST_R_*
+  */
+ 
+diff --git a/lib/dns/include/dns/nsec.h b/lib/dns/include/dns/nsec.h
+index 50df8e45f1..1e71bf14e8 100644
+--- a/lib/dns/include/dns/nsec.h
+++ b/lib/dns/include/dns/nsec.h
+@@ -119,13 +119,21 @@ dns_nsec_noexistnodata(dns_rdatatype_t type, const dns_name_t *name,
+  */
+ 
+ bool
+-dns_nsec_requiredtypespresent(dns_rdataset_t *rdataset);
+-/*
+- * Return true if all the NSEC records in rdataset have both
+- * NSEC and RRSIG present.
+dns_nsec_is_legal(dns_rdataset_t *rdataset, const dns_name_t *name);
+/**<
+ * \brief
+ * Validates a rdataset of type NSEC.
+  *
+- * Requires:
+ * This functions checks for the following in the given rdataset:
+ * \li All NSEC records have both NSEC and RRSIG present
+ * \li All NSEC entries are under the `name`
+ *
+ * \par Requires:
+  * \li	rdataset to be a NSEC rdataset.
+ * \li  `name` is a valid dns_name_t
+ *
+ * \retval true if all the checks pass
+ * \retval false otherwise
+  */
+ 
+ ISC_LANG_ENDDECLS
+diff --git a/lib/dns/nsec.c b/lib/dns/nsec.c
+index 80ee8d7d58..5abcce5f7f 100644
+--- a/lib/dns/nsec.c
+++ b/lib/dns/nsec.c
+@@ -21,6 +21,7 @@
+ #include <isc/util.h>
+ 
+ #include <dns/db.h>
+#include <dns/name.h>
+ #include <dns/nsec.h>
+ #include <dns/rdata.h>
+ #include <dns/rdatalist.h>
+@@ -497,8 +498,9 @@ dns_nsec_noexistnodata(dns_rdatatype_t type, const dns_name_t *name,
+ }
+ 
+ bool
+-dns_nsec_requiredtypespresent(dns_rdataset_t *nsecset) {
+-	dns_rdataset_t rdataset;
+dns_nsec_is_legal(dns_rdataset_t *nsecset, const dns_name_t *name) {
+	dns_rdataset_t rdataset = DNS_RDATASET_INIT;
+	dns_rdata_nsec_t nsec;
+ 	isc_result_t result;
+ 	bool found = false;
+ 
+@@ -513,12 +515,19 @@ dns_nsec_requiredtypespresent(dns_rdataset_t *nsecset) {
+ 	{
+ 		dns_rdata_t rdata = DNS_RDATA_INIT;
+ 		dns_rdataset_current(&rdataset, &rdata);
+-		if (!dns_nsec_typepresent(&rdata, dns_rdatatype_nsec) ||
+-		    !dns_nsec_typepresent(&rdata, dns_rdatatype_rrsig))
+
+		/* must never fail */
+		result = dns_rdata_tostruct(&rdata, &nsec, NULL);
+		INSIST(result == ISC_R_SUCCESS);
+
+		if (!dns_name_issubdomain(&nsec.next, name) ||
+		    !dns_nsec_typepresent(&rdata, dns_rdatatype_rrsig) ||
+		    !dns_nsec_typepresent(&rdata, dns_rdatatype_nsec))
+ 		{
+ 			dns_rdataset_disassociate(&rdataset);
+ 			return false;
+ 		}
+
+ 		found = true;
+ 	}
+ 	dns_rdataset_disassociate(&rdataset);
+diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
+index 059ce53a9e..eac67f7a19 100644
+--- a/lib/dns/resolver.c
+++ b/lib/dns/resolver.c
+@@ -65,7 +65,9 @@
+ #include <dns/rootns.h>
+ #include <dns/stats.h>
+ #include <dns/tsig.h>
+#include <dns/types.h>
+ #include <dns/validator.h>
+#include <dns/view.h>
+ #include <dns/zone.h>
+ 
+ /* Detailed logging of fctx attach/detach */
+@@ -5603,6 +5605,36 @@ fctx_setresult(fetchctx_t *fctx, dns_rdataset_t *rdataset) {
+ 	return result;
+ }
+ 
+static bool
+get_and_check_signer_name(dns_name_t *signer, dns_rdataset_t *sigrdataset) {
+	dns_rdata_rrsig_t rrsig;
+	isc_result_t result;
+	dns_rdata_t rdata;
+
+	if (dns_rdataset_first(sigrdataset) != ISC_R_SUCCESS) {
+		return false;
+	}
+
+	rdata = (dns_rdata_t)DNS_RDATA_INIT;
+	dns_rdataset_current(sigrdataset, &rdata);
+	result = dns_rdata_tostruct(&rdata, &rrsig, NULL);
+	INSIST(result == ISC_R_SUCCESS);
+	dns_name_copy(&rrsig.signer, signer);
+
+	while (dns_rdataset_next(sigrdataset) == ISC_R_SUCCESS) {
+		rdata = (dns_rdata_t)DNS_RDATA_INIT;
+		dns_rdataset_current(sigrdataset, &rdata);
+		result = dns_rdata_tostruct(&rdata, &rrsig, NULL);
+		INSIST(result == ISC_R_SUCCESS);
+
+		if (!dns_name_equal(signer, &rrsig.signer)) {
+			return false;
+		}
+	}
+
+	return true;
+}
+
+ /*
+  * The validator has finished.
+  */
+@@ -5633,6 +5665,8 @@ validated(isc_task_t *task, isc_event_t *event) {
+ 	dns_fixedname_t fwild;
+ 	dns_name_t *wild = NULL;
+ 	dns_message_t *message = NULL;
+	dns_fixedname_t fsigner;
+	dns_name_t *signer = NULL;
+ 
+ 	UNUSED(task); /* for now */
+ 
+@@ -6021,10 +6055,20 @@ answer_response:
+ 			}
+ 
+ 			/*
+-			 * Don't cache NSEC if missing NSEC or RRSIG types.
+			 * Don't cache if all the RRSIGs don't have the same
+			 * signer.
+			 */
+			signer = dns_fixedname_initname(&fsigner);
+			if (!get_and_check_signer_name(signer, sigrdataset)) {
+				continue;
+			}
+
+			/*
+			 * Don't cache NSEC if missing NSEC or RRSIG
+			 * types.
+ 			 */
+ 			if (rdataset->type == dns_rdatatype_nsec &&
+-			    !dns_nsec_requiredtypespresent(rdataset))
+			    !dns_nsec_is_legal(rdataset, signer))
+ 			{
+ 				continue;
+ 			}
+diff --git a/lib/ns/query.c b/lib/ns/query.c
+index 2a2ba1daba..8bbcd7ff30 100644
+--- a/lib/ns/query.c
+++ b/lib/ns/query.c
+@@ -10370,10 +10370,10 @@ query_coveringnsec(query_ctx_t *qctx) {
+ 	}
+ 
+ 	/*
+-	 * If NSEC or RRSIG are missing from the type map
+-	 * reject the NSEC RRset.
+	 * Check that the NSEC entry is legal.
+	 * (NSEC + RRSIG present and the entry isn't out-of-zone)
+ 	 */
+-	if (!dns_nsec_requiredtypespresent(qctx->rdataset)) {
+	if (!dns_nsec_is_legal(qctx->rdataset, signer)) {
+ 		goto cleanup;
+ 	}
+ 
+-- 
+2.55.0
+
--- a/bind-9.18-dig-idn-input-always-test.patch
+++ b/bind-9.18-dig-idn-input-always-test.patch
@ -0,0 +1,76 @@
+From 12f50726b6bd8f6b3ed6709695e0f6893bc865c6 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
+Date: Tue, 16 Sep 2025 11:46:03 +0200
+Subject: [PATCH] Fix expectations on idna system test
+
+IDNA tests always redirect output into the file. That means its
+behaviour has changed and is now processing IDN input by default and
+just disables IDN output by default.
+
+New behaviour when redirected is the same as +idnin +noidnout, but does
+not fail hard on input errors.
+---
+ bin/tests/system/idna/tests.sh | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/bin/tests/system/idna/tests.sh b/bin/tests/system/idna/tests.sh
+index 398b7e1..37f02b1 100644
+--- a/bin/tests/system/idna/tests.sh
+++ b/bin/tests/system/idna/tests.sh
+@@ -194,7 +194,7 @@ idna_enabled_test() {
+   # Note that ASCII characters are converted to lower-case.
+ 
+   text="Checking valid non-ASCII label"
+-  idna_test "$text" "" "München" "M\195\188nchen."
+  idna_test "$text" "" "München" "xn--mnchen-3ya."
+   idna_test "$text" "+noidnin +noidnout" "München" "M\195\188nchen."
+   idna_test "$text" "+noidnin +idnout" "München" "M\195\188nchen."
+   idna_test "$text" "+idnin   +noidnout" "München" "xn--mnchen-3ya."
+@@ -218,7 +218,7 @@ idna_enabled_test() {
+   # for the valid U-label.
+ 
+   text="Checking that non-transitional IDNA processing is used"
+-  idna_test "$text" "" "faß.de" "fa\195\159.de."
+  idna_test "$text" "" "faß.de" "xn--fa-hia.de."
+   idna_test "$text" "+noidnin +noidnout" "faß.de" "fa\195\159.de."
+   idna_test "$text" "+noidnin +idnout" "faß.de" "fa\195\159.de."
+   idna_test "$text" "+idnin   +noidnout" "faß.de" "xn--fa-hia.de."
+@@ -228,7 +228,7 @@ idna_enabled_test() {
+   # onto the Greek sigma character ("σ") in IDNA2003.
+ 
+   text="Second check that non-transitional IDNA processing is used"
+-  idna_test "$text" "" "βόλος.com" "\206\178\207\140\206\187\206\191\207\130.com."
+  idna_test "$text" "" "βόλος.com"  "xn--nxasmm1c.com."
+   idna_test "$text" "+noidnin +noidnout" "βόλος.com" "\206\178\207\140\206\187\206\191\207\130.com."
+   idna_test "$text" "+noidnin +idnout" "βόλος.com" "\206\178\207\140\206\187\206\191\207\130.com."
+   idna_test "$text" "+idnin   +noidnout" "βόλος.com" "xn--nxasmm1c.com."
+@@ -288,7 +288,7 @@ idna_enabled_test() {
+   idna_test "$text" "" "xn--xx" "xn--xx."
+   idna_test "$text" "+noidnin +noidnout" "xn--xx" "xn--xx."
+   idna_fail "$text" "+noidnin   +idnout" "xn--xx"
+-  idna_fail "$text" "+idnin   +noidnout" "xn--xx"
+  idna_test "$text" "+idnin   +noidnout" "xn--xx" "xn--xx."
+   idna_fail "$text" "+idnin     +idnout" "xn--xx"
+ 
+   # Fake A-label - the string does not translate to anything.
+@@ -297,7 +297,7 @@ idna_enabled_test() {
+   idna_test "$text" "" "xn--ahahah" "xn--ahahah."
+   idna_test "$text" "+noidnin +noidnout" "xn--ahahah" "xn--ahahah."
+   idna_fail "$text" "+noidnin   +idnout" "xn--ahahah"
+-  idna_fail "$text" "+idnin   +noidnout" "xn--ahahah"
+  idna_test "$text" "+idnin   +noidnout" "xn--ahahah" "xn--ahahah."
+   idna_fail "$text" "+idnin     +idnout" "xn--ahahah"
+ 
+   # Too long a label. The punycode string is too long (at 64 characters).
+@@ -324,7 +324,7 @@ idna_enabled_test() {
+   # The +[no]idnout options should not have any effect on the test.
+ 
+   text="Checking invalid input U-label"
+-  idna_test "$text" "" "√.com" "\226\136\154.com."
+  idna_test "$text" "" "√.com" "xn--19g.com."
+   idna_test "$text" "+noidnin +noidnout" "√.com" "\226\136\154.com."
+   idna_test "$text" "+noidnin +idnout" "√.com" "\226\136\154.com."
+   idna_test "$text" "+idnin   +noidnout" "√.com" "xn--19g.com."
+-- 
+2.51.0
+
--- a/bind-9.18-dig-idn-input-always.patch
+++ b/bind-9.18-dig-idn-input-always.patch
@ -0,0 +1,98 @@
+From fcc50604359a05e24003f3ff51c3812d8f307814 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
+Date: Wed, 6 Nov 2024 21:29:47 +0100
+Subject: [PATCH] Allow always IDN input in dig
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Even when stdout is non-interactive terminal, allow unicode characters
+to be encoded into ACE form. Still disable IDN output, but unless
+noidnin or IDN_DISABLE=1 env is detected, consider input as locale
+defined name.
+
+Provides more isolated change, which issue #3527 introduced similar
+behavior into 9.19 with more changes.
+
+Ignore input IDN errors when stdout is not terminal
+
+Attempt to prevent visible regressions when enabling IDN on input
+always. Instead of new hard failures preventing IDN decoding of input
+name just use original input.
+
+Should make the change backward compatible. When on interactive terminal
+behave the same way as before and emit hard errors. Become more
+forgiving in scripts where stdout leads to script. Decoding output is
+not enabled there and if input decoding fails, just use input as it was.
+
+Change dig manual +idnin
+
+Note in manual IDN input is always enabled. But it silently ignores
+errors when stdout is not a terminal to prevent regressions.
+
+Signed-off-by: Petr Menšík <pemensik@redhat.com>
+---
+ bin/dig/dig.rst   |  5 ++---
+ bin/dig/dighost.c | 16 ++++++++++++----
+ 2 files changed, 14 insertions(+), 7 deletions(-)
+
+diff --git a/bin/dig/dig.rst b/bin/dig/dig.rst
+index 88b0a40307..e2bf3764d3 100644
+--- a/bin/dig/dig.rst
+++ b/bin/dig/dig.rst
+@@ -453,9 +453,8 @@ abbreviation is unambiguous; for example, :option:`+cd` is equivalent to
+    This option processes [or does not process] IDN domain names on input. This requires
+    ``IDN SUPPORT`` to have been enabled at compile time.
+ 
+-   The default is to process IDN input when standard output is a tty.
+-   The IDN processing on input is disabled when :program:`dig` output is redirected
+-   to files, pipes, and other non-tty file descriptors.
+   The default is to process IDN input. The input IDN processing errors are ignored
+   when :program:`dig` output is redirected to files, pipes, and other non-tty file descriptors.
+ 
+ .. option:: +idnout, +noidnout
+ 
+diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c
+index 0f8ac1335c..1307346192 100644
+--- a/bin/dig/dighost.c
+++ b/bin/dig/dighost.c
+@@ -604,7 +604,7 @@ dig_lookup_t *
+ make_empty_lookup(void) {
+ 	dig_lookup_t *looknew;
+ #ifdef HAVE_LIBIDN2
+-	bool idn_allowed = isatty(1) ? (getenv("IDN_DISABLE") == NULL) : false;
+	bool idn_allowed = (getenv("IDN_DISABLE") == NULL);
+ #endif /* HAVE_LIBIDN2 */
+ 
+ 	debug("make_empty_lookup()");
+@@ -623,7 +623,7 @@ make_empty_lookup(void) {
+ 		.badcookie = true,
+ #ifdef HAVE_LIBIDN2
+ 		.idnin = idn_allowed,
+-		.idnout = idn_allowed,
+		.idnout = isatty(1) && idn_allowed,
+ #endif /* HAVE_LIBIDN2 */
+ 		.udpsize = -1,
+ 		.edns = -1,
+@@ -4871,8 +4871,16 @@ idn_locale_to_ace(const char *src, char *dst, size_t dstlen) {
+ 		res = idn2_to_ascii_lz(src, &ascii_src, IDN2_TRANSITIONAL);
+ 	}
+ 	if (res != IDN2_OK) {
+-		fatal("'%s' is not a legal IDNA2008 name (%s), use +noidnin",
+-		      src, idn2_strerror(res));
+		if (isatty(1)) {
+			fatal("'%s' is not a legal IDNA2008 name (%s), use +noidnin",
+			      src, idn2_strerror(res));
+		} else {
+			/* In case of non-terminal output silently ignore errors
+			 * in IDN input decoding. */
+			(void)strlcpy(dst, src, dstlen);
+			resetlocale(LC_ALL);
+			return;
+		}
+ 	}
+ 
+ 	/*
+-- 
+2.50.1
+
--- a/bind-9.18-partial-additional-records.patch
+++ b/bind-9.18-partial-additional-records.patch
@ -0,0 +1,54 @@
+From 3f686891729c7d39d879e8b5bb1aa17d874d265d Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
+Date: Thu, 19 Jun 2025 19:51:43 +0200
+Subject: [PATCH] Limit number of additional records fetched
+
+Limit number of started fetches for additional zone instead of doing
+none. Keep limit of NS filled with additional records, but present at
+least some if possible.
+
+Might help broken implementations relying on receiving addresses in the
+response for NS query in authoritative zone.
+---
+ lib/dns/rdataset.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+diff --git a/lib/dns/rdataset.c b/lib/dns/rdataset.c
+index 532e49a..bfa8e37 100644
+--- a/lib/dns/rdataset.c
+++ b/lib/dns/rdataset.c
+@@ -581,6 +581,7 @@ dns_rdataset_additionaldata(dns_rdataset_t *rdataset,
+ 			    size_t limit) {
+ 	dns_rdata_t rdata = DNS_RDATA_INIT;
+ 	isc_result_t result;
+	size_t n = 0;
+ 
+ 	/*
+ 	 * For each rdata in rdataset, call 'add' for each name and type in the
+@@ -590,10 +591,6 @@ dns_rdataset_additionaldata(dns_rdataset_t *rdataset,
+ 	REQUIRE(DNS_RDATASET_VALID(rdataset));
+ 	REQUIRE((rdataset->attributes & DNS_RDATASETATTR_QUESTION) == 0);
+ 
+-	if (limit != 0 && dns_rdataset_count(rdataset) > limit) {
+-		return DNS_R_TOOMANYRECORDS;
+-	}
+-
+ 	result = dns_rdataset_first(rdataset);
+ 	if (result != ISC_R_SUCCESS) {
+ 		return result;
+@@ -603,7 +600,11 @@ dns_rdataset_additionaldata(dns_rdataset_t *rdataset,
+ 		dns_rdataset_current(rdataset, &rdata);
+ 		result = dns_rdata_additionaldata(&rdata, owner_name, add, arg);
+ 		if (result == ISC_R_SUCCESS) {
+-			result = dns_rdataset_next(rdataset);
+			if (limit != 0 && ++n >= limit) {
+				result = DNS_R_TOOMANYRECORDS;
+			} else {
+				result = dns_rdataset_next(rdataset);
+			}
+ 		}
+ 		dns_rdata_reset(&rdata);
+ 	} while (result == ISC_R_SUCCESS);
+-- 
+2.50.1
+
--- a/bind-9.18-pkcs11-provider.patch
+++ b/bind-9.18-pkcs11-provider.patch
@ -0,0 +1,897 @@
+From 5bd1369eb7781ad2b349b99f783a7ed07fb7d6ac Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
+Date: Thu, 13 Feb 2025 13:20:28 +0100
+Subject: [PATCH] Backport OpenSSL 3 provider support
+
+Use gist of 451edf324281d30fbbe5669223dcea331670847c and
+5fd6cfc625aa84005618236f4cd699c07367a3dc upstream commits, but do not do
+significant rebase together. Move engine loading of EVP_PKEY from label to
+openssl_link and copy provider variant from newer.
+
+Remove legacy RSA calls from _fromlabel to separate engine handling
+code. Make rsa_check accepting EVP_PKEY pair only and use conditional
+compilation to verify them. Move checking of max exponent bits to
+rsa_check too, because it is done from all usages anyway.
+
+Use rsa_check_legacy in places where bit checking is not necessary.
+
+Fix keyfromlabel to not use engine parameter for provider keys
+
+- Rework key checks to not require 'engine' tag, private key
+  is valid with 'label' tag alone
+
+- Fix _fromlabel() functions to work with engine == NULL
+
+- Update dst__openssl_fromlabel_engine() to do provider lookup
+  only when engine is not set
+
+(cherry picked from commit de486d0ec5d5642ddb1820a1269f5406a2bb1c64)
+
+Use dst_key_t label to signal isprivate property as a downstream
+alternative to upstream commit 74361b0b6e5a6b17ebeea6afe1ca990395d7a6dd.
+That would require additional heavier changes.
+
+Downstream change:
+Move RSA bits check to legacy, let it use rsa_check for newer
+
+rsabigexponent tests got broken by this change.
+---
+ lib/dns/dst_openssl.h       |   4 +
+ lib/dns/dst_parse.c         |  21 ++---
+ lib/dns/openssl_link.c      | 161 +++++++++++++++++++++++++++-----
+ lib/dns/openssldh_link.c    |   5 +
+ lib/dns/opensslecdsa_link.c | 109 +++++++++++-----------
+ lib/dns/openssleddsa_link.c |  40 +++-----
+ lib/dns/opensslrsa_link.c   | 181 ++++++++++++++----------------------
+ 7 files changed, 296 insertions(+), 225 deletions(-)
+
+diff --git a/lib/dns/dst_openssl.h b/lib/dns/dst_openssl.h
+index 819af0f..cd386c0 100644
+--- a/lib/dns/dst_openssl.h
+++ b/lib/dns/dst_openssl.h
+@@ -64,4 +64,8 @@ ENGINE *
+ dst__openssl_getengine(const char *engine);
+ #endif /* if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000 */
+ 
+isc_result_t
+dst__openssl_fromlabel(int key_base_id, const char *engine, const char *label,
+		       const char *pin, EVP_PKEY **ppub, EVP_PKEY **ppriv);
+
+ ISC_LANG_ENDDECLS
+diff --git a/lib/dns/dst_parse.c b/lib/dns/dst_parse.c
+index a353b86..7f3fe51 100644
+--- a/lib/dns/dst_parse.c
+++ b/lib/dns/dst_parse.c
+@@ -195,10 +195,9 @@ check_rsa(const dst_private_t *priv, bool external) {
+ 
+ 	mask = (1ULL << TAG_SHIFT) - 1;
+ 
+-	if (have[TAG_RSA_ENGINE & mask]) {
+	if (have[TAG_RSA_LABEL & mask]) {
+ 		ok = have[TAG_RSA_MODULUS & mask] &&
+-		     have[TAG_RSA_PUBLICEXPONENT & mask] &&
+-		     have[TAG_RSA_LABEL & mask];
+		     have[TAG_RSA_PUBLICEXPONENT & mask];
+ 	} else {
+ 		ok = have[TAG_RSA_MODULUS & mask] &&
+ 		     have[TAG_RSA_PUBLICEXPONENT & mask] &&
+@@ -259,11 +258,9 @@ check_ecdsa(const dst_private_t *priv, bool external) {
+ 
+ 	mask = (1ULL << TAG_SHIFT) - 1;
+ 
+-	if (have[TAG_ECDSA_ENGINE & mask]) {
+-		ok = have[TAG_ECDSA_LABEL & mask];
+-	} else {
+-		ok = have[TAG_ECDSA_PRIVATEKEY & mask];
+-	}
+	ok = have[TAG_ECDSA_LABEL & mask] ||
+	     have[TAG_ECDSA_PRIVATEKEY & mask];
+
+ 	return ok ? 0 : -1;
+ }
+ 
+@@ -295,11 +292,9 @@ check_eddsa(const dst_private_t *priv, bool external) {
+ 
+ 	mask = (1ULL << TAG_SHIFT) - 1;
+ 
+-	if (have[TAG_EDDSA_ENGINE & mask]) {
+-		ok = have[TAG_EDDSA_LABEL & mask];
+-	} else {
+-		ok = have[TAG_EDDSA_PRIVATEKEY & mask];
+-	}
+	ok = have[TAG_EDDSA_LABEL & mask] ||
+	     have[TAG_EDDSA_PRIVATEKEY & mask];
+
+ 	return ok ? 0 : -1;
+ }
+ 
+diff --git a/lib/dns/openssl_link.c b/lib/dns/openssl_link.c
+index e3a89f4..2495be4 100644
+--- a/lib/dns/openssl_link.c
+++ b/lib/dns/openssl_link.c
+@@ -44,6 +44,9 @@
+ #if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000
+ #include <openssl/engine.h>
+ #endif /* if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000 */
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+#include <openssl/store.h>
+#endif
+ 
+ #include "openssl_shim.h"
+ 
+@@ -51,6 +54,12 @@
+ static ENGINE *e = NULL;
+ #endif /* if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000 */
+ 
+#define DST_RET(a)        \
+	{                 \
+		result = a;  \
+		goto cleanup; \
+	}
+
+ static void
+ enable_fips_mode(void) {
+ #ifdef HAVE_FIPS_MODE
+@@ -70,32 +79,28 @@ enable_fips_mode(void) {
+ 
+ isc_result_t
+ dst__openssl_init(const char *engine) {
+-	isc_result_t result = ISC_R_SUCCESS;
+-
+ 	enable_fips_mode();
+ 
+-#if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000
+ 	if (engine != NULL && *engine == '\0') {
+ 		engine = NULL;
+ 	}
+ 
+-	if (engine != NULL) {
+-		e = ENGINE_by_id(engine);
+-		if (e == NULL) {
+-			result = DST_R_NOENGINE;
+-			goto cleanup_rm;
+-		}
+-		if (!ENGINE_init(e)) {
+-			result = DST_R_NOENGINE;
+-			goto cleanup_rm;
+-		}
+-		/* This will init the engine. */
+-		if (!ENGINE_set_default(e, ENGINE_METHOD_ALL)) {
+-			result = DST_R_NOENGINE;
+-			goto cleanup_init;
+-		}
+	if (engine == NULL) {
+		return (ISC_R_SUCCESS);
+ 	}
+ 
+#if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000
+	e = ENGINE_by_id(engine);
+	if (e == NULL) {
+		goto cleanup_rm;
+	}
+		if (!ENGINE_init(e)) {
+		goto cleanup_rm;
+	}
+	/* This will init the engine. */
+	if (!ENGINE_set_default(e, ENGINE_METHOD_ALL)) {
+		goto cleanup_init;
+	}
+ 	return ISC_R_SUCCESS;
+ cleanup_init:
+ 	ENGINE_finish(e);
+@@ -105,10 +110,8 @@ cleanup_rm:
+ 	}
+ 	e = NULL;
+ 	ERR_clear_error();
+-#else
+-	UNUSED(engine);
+ #endif /* if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000 */
+-	return result;
+	return (DST_R_NOENGINE);
+ }
+ 
+ void
+@@ -220,4 +223,120 @@ dst__openssl_getengine(const char *engine) {
+ }
+ #endif /* if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000 */
+ 
+static isc_result_t
+dst__openssl_fromlabel_engine(int key_base_id, const char *engine,
+			      const char *label,
+			      EVP_PKEY **ppub, EVP_PKEY **ppriv) {
+#if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000
+	isc_result_t result = ISC_R_SUCCESS;
+	ENGINE *e = NULL;
+	EVP_PKEY *pkey = NULL, *pubpkey = NULL;
+
+	UNUSED(key_base_id);
+
+	e = dst__openssl_getengine(engine);
+	if (e == NULL) {
+		DST_RET(dst__openssl_toresult(DST_R_NOENGINE));
+	}
+
+	pubpkey = ENGINE_load_public_key(e, label, NULL, NULL);
+	if (pubpkey == NULL) {
+		DST_RET(dst__openssl_toresult2("ENGINE_load_public_key",
+					       DST_R_OPENSSLFAILURE));
+	}
+	if (EVP_PKEY_get_base_id(pubpkey) != key_base_id) {
+		DST_RET(DST_R_BADKEYTYPE);
+	}
+	pkey = ENGINE_load_private_key(e, label, NULL, NULL);
+	if (pkey == NULL) {
+		DST_RET(dst__openssl_toresult2("ENGINE_load_private_key",
+					       DST_R_OPENSSLFAILURE));
+	}
+	if (EVP_PKEY_base_id(pkey) != key_base_id) {
+		DST_RET(DST_R_INVALIDPRIVATEKEY);
+	}
+	*ppub = pubpkey;
+	*ppriv = pkey;
+cleanup:
+	return result;
+#else
+	UNUSED(key_base_id);
+	UNUSED(engine);
+	UNUSED(label);
+	UNUSED(ppub);
+	UNUSED(ppriv);
+	return DST_R_NOENGINE;
+#endif
+}
+
+
+static isc_result_t
+dst__openssl_fromlabel_provider(int key_base_id, const char *label, const char *pin,
+				EVP_PKEY **ppub, EVP_PKEY **ppriv) {
+	UNUSED(pin);
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+	isc_result_t result = DST_R_OPENSSLFAILURE;
+	OSSL_STORE_CTX *ctx = NULL;
+
+
+	ctx = OSSL_STORE_open(label, NULL, NULL, NULL, NULL);
+	if (!ctx) {
+		DST_RET(dst__openssl_toresult2("OSSL_STORE_open_ex",
+					       DST_R_OPENSSLFAILURE));
+	}
+
+	while (!OSSL_STORE_eof(ctx)) {
+		OSSL_STORE_INFO *info = OSSL_STORE_load(ctx);
+		if (info == NULL) {
+			continue;
+		}
+		switch (OSSL_STORE_INFO_get_type(info)) {
+		case OSSL_STORE_INFO_PKEY:
+			if (*ppriv != NULL) {
+				DST_RET(DST_R_INVALIDPRIVATEKEY);
+			}
+			*ppriv = OSSL_STORE_INFO_get1_PKEY(info);
+			if (EVP_PKEY_get_base_id(*ppriv) != key_base_id) {
+				DST_RET(DST_R_BADKEYTYPE);
+			}
+			break;
+		case OSSL_STORE_INFO_PUBKEY:
+			if (*ppub != NULL) {
+				DST_RET(DST_R_INVALIDPUBLICKEY);
+			}
+			*ppub = OSSL_STORE_INFO_get1_PUBKEY(info);
+			if (EVP_PKEY_get_base_id(*ppub) != key_base_id) {
+				DST_RET(DST_R_BADKEYTYPE);
+			}
+			break;
+		}
+		OSSL_STORE_INFO_free(info);
+	}
+	if (*ppriv != NULL && *ppub != NULL) {
+		result = ISC_R_SUCCESS;
+	}
+cleanup:
+	OSSL_STORE_close(ctx);
+	return result;
+#else
+	UNUSED(key_base_id);
+	UNUSED(label);
+	UNUSED(ppub);
+	UNUSED(ppriv);
+	return (DST_R_OPENSSLFAILURE);
+#endif
+}
+
+isc_result_t
+dst__openssl_fromlabel(int key_base_id, const char *engine, const char *label,
+		       const char *pin, EVP_PKEY **ppub, EVP_PKEY **ppriv) {
+	if (engine == NULL) {
+		return (dst__openssl_fromlabel_provider(key_base_id, label,
+						        pin, ppub, ppriv));
+	}
+
+	return (dst__openssl_fromlabel_engine(key_base_id, engine, label,
+					      ppub, ppriv));
+}
+
+ /*! \file */
+diff --git a/lib/dns/openssldh_link.c b/lib/dns/openssldh_link.c
+index a4ba0f7..38345e6 100644
+--- a/lib/dns/openssldh_link.c
+++ b/lib/dns/openssldh_link.c
+@@ -610,6 +610,11 @@ err:
+ 
+ static bool
+ openssldh_isprivate(const dst_key_t *key) {
+	if (key->label != NULL) {
+		/* assume that _fromlabel will not pass without loading private key,
+		 * but for non-exportable key cannot get d value on the object. */
+		return true;
+	}
+ #if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+ 	DH *dh = key->keydata.dh;
+ 	const BIGNUM *priv_key = NULL;
+diff --git a/lib/dns/opensslecdsa_link.c b/lib/dns/opensslecdsa_link.c
+index af45fdc..8b49b5d 100644
+--- a/lib/dns/opensslecdsa_link.c
+++ b/lib/dns/opensslecdsa_link.c
+@@ -617,6 +617,12 @@ opensslecdsa_isprivate(const dst_key_t *key) {
+ 		return false;
+ 	}
+ 
+	if (key->label != NULL) {
+		/* assume that _fromlabel will not pass without loading private key,
+		 * but for non-exportable key cannot get d value on the object. */
+		return true;
+	}
+
+ #if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+ 	eckey = EVP_PKEY_get1_EC_KEY(pkey);
+ 
+@@ -916,7 +922,7 @@ cleanup:
+ 
+ #if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+ static isc_result_t
+-ecdsa_check(EC_KEY *eckey, EC_KEY *pubeckey) {
+ecdsa_check_legacy(EC_KEY *eckey, EC_KEY *pubeckey) {
+ 	const EC_POINT *pubkey;
+ 
+ 	pubkey = EC_KEY_get0_public_key(eckey);
+@@ -937,9 +943,42 @@ ecdsa_check(EC_KEY *eckey, EC_KEY *pubeckey) {
+ 
+ 	return ISC_R_FAILURE;
+ }
+
+static isc_result_t
+ecdsa_check(EVP_PKEY **pkey, EVP_PKEY *pubpkey, int group_nid) {
+	isc_result_t result = ISC_R_FAILURE;
+	EC_KEY *eckey;
+	EC_KEY *pubeckey;
+
+	eckey = EVP_PKEY_get1_EC_KEY(*pkey);
+	if (eckey == NULL) {
+		DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE));
+	}
+	if (EC_GROUP_get_curve_name(EC_KEY_get0_group(eckey)) != group_nid) {
+		DST_RET(DST_R_INVALIDPRIVATEKEY);
+	}
+
+	pubeckey = EVP_PKEY_get1_EC_KEY(pubpkey);
+	if (pubeckey == NULL) {
+		DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE));
+	}
+	if (EC_GROUP_get_curve_name(EC_KEY_get0_group(pubeckey)) != group_nid) {
+		DST_RET(DST_R_INVALIDPUBLICKEY);
+	}
+
+	CHECK(ecdsa_check_legacy(eckey, pubeckey));
+cleanup:
+	if (pubeckey != NULL) {
+		EC_KEY_free(pubeckey);
+	}
+	if (eckey != NULL) {
+		EC_KEY_free(eckey);
+	}
+	return result;
+}
+ #else
+ static isc_result_t
+-ecdsa_check(EVP_PKEY **pkey, EVP_PKEY *pubpkey) {
+ecdsa_check(EVP_PKEY **pkey, EVP_PKEY *pubpkey, int group_nid) {
+ 	isc_result_t result = ISC_R_FAILURE;
+ 	int status;
+ 	size_t pkey_len = 0;
+@@ -954,6 +993,8 @@ ecdsa_check(EVP_PKEY **pkey, EVP_PKEY *pubpkey) {
+ 	EVP_PKEY_CTX *ctx = NULL;
+ 	EVP_PKEY *pkey_new = NULL;
+ 
+	UNUSED(group_nid);
+
+ 	/* Check if `pkey` has a public key. */
+ 	status = EVP_PKEY_get_octet_string_param(*pkey, OSSL_PKEY_PARAM_PUB_KEY,
+ 						 NULL, 0, &pkey_len);
+@@ -1267,7 +1308,7 @@ opensslecdsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
+ 		pubeckey = EVP_PKEY_get1_EC_KEY(pub->keydata.pkey);
+ 	}
+ 
+-	if (ecdsa_check(eckey, pubeckey) != ISC_R_SUCCESS) {
+	if (ecdsa_check_legacy(eckey, pubeckey) != ISC_R_SUCCESS) {
+ 		DST_RET(dst__openssl_toresult(DST_R_INVALIDPRIVATEKEY));
+ 	}
+ 
+@@ -1276,7 +1317,7 @@ opensslecdsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
+ 	}
+ #else
+ 	if (ecdsa_check(&key->keydata.pkey,
+-			pub == NULL ? NULL : pub->keydata.pkey) !=
+			pub == NULL ? NULL : pub->keydata.pkey, NID_undef) !=
+ 	    ISC_R_SUCCESS)
+ 	{
+ 		DST_RET(dst__openssl_toresult(DST_R_INVALIDPRIVATEKEY));
+@@ -1309,11 +1350,7 @@ cleanup:
+ static isc_result_t
+ opensslecdsa_fromlabel(dst_key_t *key, const char *engine, const char *label,
+ 		       const char *pin) {
+-#if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000
+ 	isc_result_t result = ISC_R_SUCCESS;
+-	ENGINE *e;
+-	EC_KEY *eckey = NULL;
+-	EC_KEY *pubeckey = NULL;
+ 	int group_nid;
+ 	EVP_PKEY *pkey = NULL;
+ 	EVP_PKEY *pubpkey = NULL;
+@@ -1323,13 +1360,9 @@ opensslecdsa_fromlabel(dst_key_t *key, const char *engine, const char *label,
+ 
+ 	UNUSED(pin);
+ 
+-	if (engine == NULL || label == NULL) {
+	if (label == NULL) {
+ 		return DST_R_NOENGINE;
+ 	}
+-	e = dst__openssl_getengine(engine);
+-	if (e == NULL) {
+-		DST_RET(DST_R_NOENGINE);
+-	}
+ 
+ 	if (key->key_alg == DST_ALG_ECDSA256) {
+ 		group_nid = NID_X9_62_prime256v1;
+@@ -1337,48 +1370,27 @@ opensslecdsa_fromlabel(dst_key_t *key, const char *engine, const char *label,
+ 		group_nid = NID_secp384r1;
+ 	}
+ 
+-	/* Load private key. */
+-	pkey = ENGINE_load_private_key(e, label, NULL, NULL);
+-	if (pkey == NULL) {
+-		DST_RET(dst__openssl_toresult2("ENGINE_load_private_key",
+-					       DST_R_OPENSSLFAILURE));
+-	}
+	CHECK(dst__openssl_fromlabel(EVP_PKEY_EC, engine, label, pin,
+				       &pubpkey, &pkey));
+
+ 	/* Check base id, group nid */
+ 	if (EVP_PKEY_base_id(pkey) != EVP_PKEY_EC) {
+ 		DST_RET(DST_R_INVALIDPRIVATEKEY);
+ 	}
+-	eckey = EVP_PKEY_get1_EC_KEY(pkey);
+-	if (eckey == NULL) {
+-		DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE));
+-	}
+-	if (EC_GROUP_get_curve_name(EC_KEY_get0_group(eckey)) != group_nid) {
+-		DST_RET(DST_R_INVALIDPRIVATEKEY);
+-	}
+-
+-	/* Load public key. */
+-	pubpkey = ENGINE_load_public_key(e, label, NULL, NULL);
+-	if (pubpkey == NULL) {
+-		DST_RET(dst__openssl_toresult2("ENGINE_load_public_key",
+-					       DST_R_OPENSSLFAILURE));
+-	}
+ 	/* Check base id, group nid */
+ 	if (EVP_PKEY_base_id(pubpkey) != EVP_PKEY_EC) {
+ 		DST_RET(DST_R_INVALIDPUBLICKEY);
+ 	}
+-	pubeckey = EVP_PKEY_get1_EC_KEY(pubpkey);
+-	if (pubeckey == NULL) {
+-		DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE));
+-	}
+-	if (EC_GROUP_get_curve_name(EC_KEY_get0_group(pubeckey)) != group_nid) {
+-		DST_RET(DST_R_INVALIDPUBLICKEY);
+-	}
+ 
+-	if (ecdsa_check(eckey, pubeckey) != ISC_R_SUCCESS) {
+	if (ecdsa_check(&pkey, pubpkey, group_nid) != ISC_R_SUCCESS) {
+ 		DST_RET(dst__openssl_toresult(DST_R_INVALIDPRIVATEKEY));
+ 	}
+ 
+	if (engine != NULL)
+		key->engine = isc_mem_strdup(key->mctx, engine);
+	else
+		key->engine = NULL;
+ 	key->label = isc_mem_strdup(key->mctx, label);
+-	key->engine = isc_mem_strdup(key->mctx, engine);
+ 	key->key_size = EVP_PKEY_bits(pkey);
+ 	key->keydata.pkey = pkey;
+ 	pkey = NULL;
+@@ -1390,21 +1402,8 @@ cleanup:
+ 	if (pkey != NULL) {
+ 		EVP_PKEY_free(pkey);
+ 	}
+-	if (pubeckey != NULL) {
+-		EC_KEY_free(pubeckey);
+-	}
+-	if (eckey != NULL) {
+-		EC_KEY_free(eckey);
+-	}
+ 
+ 	return result;
+-#else
+-	UNUSED(key);
+-	UNUSED(engine);
+-	UNUSED(label);
+-	UNUSED(pin);
+-	return DST_R_NOENGINE;
+-#endif /* !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000 */
+ }
+ 
+ static dst_func_t opensslecdsa_functions = {
+diff --git a/lib/dns/openssleddsa_link.c b/lib/dns/openssleddsa_link.c
+index 6301db4..08d505b 100644
+--- a/lib/dns/openssleddsa_link.c
+++ b/lib/dns/openssleddsa_link.c
+@@ -362,6 +362,12 @@ openssleddsa_isprivate(const dst_key_t *key) {
+ 		return false;
+ 	}
+ 
+	if (key->label != NULL) {
+		/* assume that _fromlabel will not pass without loading private key,
+		 * but for non-exportable key cannot get d value on the object. */
+		return true;
+	}
+
+ 	/* Must have a buffer to actually check if there is a private key. */
+ 	if (EVP_PKEY_get_raw_private_key(pkey, buf, &len) == 1) {
+ 		return true;
+@@ -591,9 +597,7 @@ cleanup:
+ static isc_result_t
+ openssleddsa_fromlabel(dst_key_t *key, const char *engine, const char *label,
+ 		       const char *pin) {
+-#if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000
+ 	isc_result_t result;
+-	ENGINE *e;
+ 	EVP_PKEY *pkey = NULL, *pubpkey = NULL;
+ 	int baseid = EVP_PKEY_NONE;
+ 
+@@ -616,28 +620,17 @@ openssleddsa_fromlabel(dst_key_t *key, const char *engine, const char *label,
+ 		return ISC_R_NOTIMPLEMENTED;
+ 	}
+ 
+-	if (engine == NULL) {
+-		return DST_R_NOENGINE;
+-	}
+-	e = dst__openssl_getengine(engine);
+-	if (e == NULL) {
+-		return DST_R_NOENGINE;
+-	}
+-	pkey = ENGINE_load_private_key(e, label, NULL, NULL);
+-	if (pkey == NULL) {
+-		return dst__openssl_toresult2("ENGINE_load_private_key",
+-					      ISC_R_NOTFOUND);
+-	}
+-	if (EVP_PKEY_base_id(pkey) != baseid) {
+-		DST_RET(DST_R_INVALIDPRIVATEKEY);
+-	}
+	DST_RET(dst__openssl_fromlabel(baseid, engine, label, pin,
+				       &pubpkey, &pkey));
+ 
+-	pubpkey = ENGINE_load_public_key(e, label, NULL, NULL);
+-	if (eddsa_check(pkey, pubpkey) != ISC_R_SUCCESS) {
+	if (EVP_PKEY_base_id(pkey) != baseid) {
+ 		DST_RET(DST_R_INVALIDPRIVATEKEY);
+ 	}
+ 
+-	key->engine = isc_mem_strdup(key->mctx, engine);
+	if (engine != NULL)
+		key->engine = isc_mem_strdup(key->mctx, engine);
+	else
+		key->engine = NULL;
+ 	key->label = isc_mem_strdup(key->mctx, label);
+ 	key->key_size = EVP_PKEY_bits(pkey);
+ 	key->keydata.pkey = pkey;
+@@ -652,13 +645,6 @@ cleanup:
+ 		EVP_PKEY_free(pkey);
+ 	}
+ 	return result;
+-#else  /* if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000 */
+-	UNUSED(key);
+-	UNUSED(engine);
+-	UNUSED(label);
+-	UNUSED(pin);
+-	return DST_R_NOENGINE;
+-#endif /* if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000 */
+ }
+ 
+ static dst_func_t openssleddsa_functions = {
+diff --git a/lib/dns/opensslrsa_link.c b/lib/dns/opensslrsa_link.c
+index b92e1bf..12210e8 100644
+--- a/lib/dns/opensslrsa_link.c
+++ b/lib/dns/opensslrsa_link.c
+@@ -545,6 +545,12 @@ opensslrsa_isprivate(const dst_key_t *key) {
+ 		return false;
+ 	}
+ 
+	if (key->label != NULL) {
+		/* assume that _fromlabel will not pass without loading private key,
+		 * but for non-exportable key cannot get d value on the object. */
+		return true;
+	}
+
+ #if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+ 	rsa = EVP_PKEY_get1_RSA(pkey);
+ 	INSIST(rsa != NULL);
+@@ -995,7 +1001,7 @@ cleanup:
+ 
+ #if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000
+ static isc_result_t
+-rsa_check(RSA *rsa, RSA *pub) {
+rsa_check_legacy(RSA *rsa, RSA *pub) {
+ 	const BIGNUM *n1 = NULL, *n2 = NULL;
+ 	const BIGNUM *e1 = NULL, *e2 = NULL;
+ 	BIGNUM *n = NULL, *e = NULL;
+@@ -1050,6 +1056,46 @@ rsa_check(RSA *rsa, RSA *pub) {
+ 
+ 	return ISC_R_SUCCESS;
+ }
+
+static isc_result_t
+rsa_check(EVP_PKEY *pkey, EVP_PKEY *pubpkey) {
+	isc_result_t ret = ISC_R_FAILURE;
+	RSA *rsa = NULL, *pubrsa = NULL;
+	const BIGNUM *ex = NULL;
+
+	pubrsa = EVP_PKEY_get1_RSA(pubpkey);
+	if (pubrsa == NULL) {
+		DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE));
+	}
+
+	rsa = EVP_PKEY_get1_RSA(pkey);
+	if (rsa == NULL) {
+		DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE));
+	}
+
+	ret = rsa_check_legacy(rsa, pubrsa);
+	if (ret != ISC_R_SUCCESS) {
+		DST_RET(ret);
+	}
+
+	RSA_get0_key(rsa, NULL, &ex, NULL);
+
+	if (ex == NULL) {
+		DST_RET(dst__openssl_toresult(DST_R_INVALIDPRIVATEKEY));
+	}
+	if (BN_num_bits(ex) > RSA_MAX_PUBEXP_BITS) {
+		DST_RET(ISC_R_RANGE);
+	}
+
+err:
+	if (rsa != NULL) {
+		RSA_free(rsa);
+	}
+	if (pubrsa != NULL) {
+		RSA_free(pubrsa);
+	}
+	return ret;
+}
+ #else
+ static isc_result_t
+ rsa_check(EVP_PKEY *pkey, EVP_PKEY *pubpkey) {
+@@ -1097,6 +1143,10 @@ rsa_check(EVP_PKEY *pkey, EVP_PKEY *pubpkey) {
+ 		}
+ 	}
+ 
+	if (BN_num_bits(e1) > RSA_MAX_PUBEXP_BITS) {
+		DST_RET(ISC_R_RANGE);
+	}
+
+ 	if (EVP_PKEY_eq(pkey, pubpkey) == 1) {
+ 		DST_RET(ISC_R_SUCCESS);
+ 	}
+@@ -1119,6 +1169,10 @@ cleanup:
+ }
+ #endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
+ 
+static isc_result_t
+opensslrsa_fromlabel(dst_key_t *key, const char *engine, const char *label,
+		     const char *pin);
+
+ static isc_result_t
+ opensslrsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
+ 	dst_private_t priv;
+@@ -1131,12 +1185,8 @@ opensslrsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
+ 	OSSL_PARAM *params = NULL;
+ 	EVP_PKEY_CTX *ctx = NULL;
+ #endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
+-#if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000
+-	const BIGNUM *ex = NULL;
+-	ENGINE *ep = NULL;
+-	const char *engine = NULL;
+-#endif /* if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000 */
+ 	isc_mem_t *mctx = NULL;
+	const char *engine = NULL;
+ 	const char *label = NULL;
+ 	EVP_PKEY *pkey = NULL;
+ 	BIGNUM *n = NULL, *e = NULL, *d = NULL;
+@@ -1190,46 +1240,7 @@ opensslrsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
+ 	 * See if we can fetch it.
+ 	 */
+ 	if (label != NULL) {
+-#if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000
+-		if (engine == NULL) {
+-			DST_RET(DST_R_NOENGINE);
+-		}
+-		ep = dst__openssl_getengine(engine);
+-		if (ep == NULL) {
+-			DST_RET(dst__openssl_toresult(DST_R_NOENGINE));
+-		}
+-		pkey = ENGINE_load_private_key(ep, label, NULL, NULL);
+-		if (pkey == NULL) {
+-			DST_RET(dst__openssl_toresult2("ENGINE_load_private_"
+-						       "key",
+-						       ISC_R_NOTFOUND));
+-		}
+-		key->engine = isc_mem_strdup(key->mctx, engine);
+-		key->label = isc_mem_strdup(key->mctx, label);
+-
+-		rsa = EVP_PKEY_get1_RSA(pkey);
+-		if (rsa == NULL) {
+-			DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE));
+-		}
+-		if (rsa_check(rsa, pubrsa) != ISC_R_SUCCESS) {
+-			DST_RET(dst__openssl_toresult(DST_R_INVALIDPRIVATEKEY));
+-		}
+-		RSA_get0_key(rsa, NULL, &ex, NULL);
+-
+-		if (ex == NULL) {
+-			DST_RET(dst__openssl_toresult(DST_R_INVALIDPRIVATEKEY));
+-		}
+-		if (BN_num_bits(ex) > RSA_MAX_PUBEXP_BITS) {
+-			DST_RET(ISC_R_RANGE);
+-		}
+-
+-		key->key_size = EVP_PKEY_bits(pkey);
+-		key->keydata.pkey = pkey;
+-		pkey = NULL;
+-		DST_RET(ISC_R_SUCCESS);
+-#else  /* if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000 */
+-		DST_RET(DST_R_NOENGINE);
+-#endif /* if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000 */
+		DST_RET(opensslrsa_fromlabel(key, engine, label, NULL));
+ 	}
+ 
+ 	for (i = 0; i < priv.nelements; i++) {
+@@ -1318,9 +1329,14 @@ opensslrsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
+ 			BN_clear_free(iqmp);
+ 		}
+ 	}
+-	if (rsa_check(rsa, pubrsa) != ISC_R_SUCCESS) {
+	if (rsa_check_legacy(rsa, pubrsa) != ISC_R_SUCCESS) {
+ 		DST_RET(dst__openssl_toresult(DST_R_INVALIDPRIVATEKEY));
+ 	}
+
+	if (BN_num_bits(e) > RSA_MAX_PUBEXP_BITS) {
+		DST_RET(ISC_R_RANGE);
+	}
+
+ #else
+ 	bld = OSSL_PARAM_BLD_new();
+ 	if (bld == NULL) {
+@@ -1387,17 +1403,9 @@ opensslrsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
+ 		DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE));
+ 	}
+ 
+-	if (rsa_check(pkey, pub != NULL ? pub->keydata.pkey : NULL) !=
+-	    ISC_R_SUCCESS)
+-	{
+-		DST_RET(dst__openssl_toresult(DST_R_INVALIDPRIVATEKEY));
+-	}
+	CHECK(rsa_check(pkey, pub != NULL ? pub->keydata.pkey : NULL));
+ #endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */
+ 
+-	if (BN_num_bits(e) > RSA_MAX_PUBEXP_BITS) {
+-		DST_RET(ISC_R_RANGE);
+-	}
+-
+ 	key->key_size = BN_num_bits(n);
+ 	key->keydata.pkey = pkey;
+ 	pkey = NULL;
+@@ -1461,69 +1469,31 @@ cleanup:
+ static isc_result_t
+ opensslrsa_fromlabel(dst_key_t *key, const char *engine, const char *label,
+ 		     const char *pin) {
+-#if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000
+-	ENGINE *e = NULL;
+ 	isc_result_t result = ISC_R_SUCCESS;
+ 	EVP_PKEY *pkey = NULL, *pubpkey = NULL;
+-	RSA *rsa = NULL, *pubrsa = NULL;
+-	const BIGNUM *ex = NULL;
+ 
+ 	UNUSED(pin);
+ 
+-	if (engine == NULL) {
+-		DST_RET(DST_R_NOENGINE);
+-	}
+-	e = dst__openssl_getengine(engine);
+-	if (e == NULL) {
+-		DST_RET(dst__openssl_toresult(DST_R_NOENGINE));
+-	}
+	CHECK(dst__openssl_fromlabel(EVP_PKEY_RSA, engine, label, pin,
+				       &pubpkey, &pkey));
+	CHECK(rsa_check(pkey, pubpkey));
+ 
+-	pubpkey = ENGINE_load_public_key(e, label, NULL, NULL);
+-	if (pubpkey == NULL) {
+-		DST_RET(dst__openssl_toresult2("ENGINE_load_public_key",
+-					       DST_R_OPENSSLFAILURE));
+-	}
+-	pubrsa = EVP_PKEY_get1_RSA(pubpkey);
+-	if (pubrsa == NULL) {
+-		DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE));
+-	}
+-
+-	pkey = ENGINE_load_private_key(e, label, NULL, NULL);
+ 	if (pkey == NULL) {
+-		DST_RET(dst__openssl_toresult2("ENGINE_load_private_key",
+		DST_RET(dst__openssl_toresult2("dst__openssl_fromlabel",
+ 					       DST_R_OPENSSLFAILURE));
+ 	}
+ 
+-	key->engine = isc_mem_strdup(key->mctx, engine);
+	if (engine != NULL)
+		key->engine = isc_mem_strdup(key->mctx, engine);
+	else
+		key->engine = NULL;
+ 	key->label = isc_mem_strdup(key->mctx, label);
+ 
+-	rsa = EVP_PKEY_get1_RSA(pkey);
+-	if (rsa == NULL) {
+-		DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE));
+-	}
+-	if (rsa_check(rsa, pubrsa) != ISC_R_SUCCESS) {
+-		DST_RET(dst__openssl_toresult(DST_R_INVALIDPRIVATEKEY));
+-	}
+-	RSA_get0_key(rsa, NULL, &ex, NULL);
+-
+-	if (ex == NULL) {
+-		DST_RET(dst__openssl_toresult(DST_R_INVALIDPRIVATEKEY));
+-	}
+-	if (BN_num_bits(ex) > RSA_MAX_PUBEXP_BITS) {
+-		DST_RET(ISC_R_RANGE);
+-	}
+-
+ 	key->key_size = EVP_PKEY_bits(pkey);
+ 	key->keydata.pkey = pkey;
+ 	pkey = NULL;
+ 
+ cleanup:
+-	if (rsa != NULL) {
+-		RSA_free(rsa);
+-	}
+-	if (pubrsa != NULL) {
+-		RSA_free(pubrsa);
+-	}
+ 	if (pkey != NULL) {
+ 		EVP_PKEY_free(pkey);
+ 	}
+@@ -1531,13 +1501,6 @@ cleanup:
+ 		EVP_PKEY_free(pubpkey);
+ 	}
+ 	return result;
+-#else  /* if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000 */
+-	UNUSED(key);
+-	UNUSED(engine);
+-	UNUSED(label);
+-	UNUSED(pin);
+-	return DST_R_NOENGINE;
+-#endif /* if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000 */
+ }
+ 
+ static dst_func_t opensslrsa_functions = {
+-- 
+2.52.0
+
--- a/bind-9.18-unittest-netmgr-unstable.patch
+++ b/bind-9.18-unittest-netmgr-unstable.patch
@ -0,0 +1,75 @@
+From 0f3a398fe813189c5dd56b0367a72c7b3f19504b Mon Sep 17 00:00:00 2001
+From: Petr Mensik <pemensik@redhat.com>
+Date: Wed, 14 Sep 2022 13:06:24 +0200
+Subject: [PATCH] Disable some often failing tests
+
+Make those tests skipped in default build, when CI=true environment is
+set. It is not clear why they fail mostly on COPR, but they do fail
+often.
+---
+ tests/isc/netmgr_test.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/tests/isc/netmgr_test.c b/tests/isc/netmgr_test.c
+index 94e4bf7..7f9629c 100644
+--- a/tests/isc/netmgr_test.c
+++ b/tests/isc/netmgr_test.c
+@@ -1567,13 +1567,13 @@ stream_half_recv_half_send(void **state __attribute__((unused))) {
+ /* TCP */
+ ISC_RUN_TEST_IMPL(tcp_noop) { stream_noop(state); }
+ 
+-ISC_RUN_TEST_IMPL(tcp_noresponse) { stream_noresponse(state); }
+ISC_RUN_TEST_IMPL(tcp_noresponse) { SKIP_IN_CI; stream_noresponse(state); }
+ 
+ ISC_RUN_TEST_IMPL(tcp_timeout_recovery) { stream_timeout_recovery(state); }
+ 
+ ISC_RUN_TEST_IMPL(tcp_recv_one) { stream_recv_one(state); }
+ 
+-ISC_RUN_TEST_IMPL(tcp_recv_two) { stream_recv_two(state); }
+ISC_RUN_TEST_IMPL(tcp_recv_two) { SKIP_IN_CI; stream_recv_two(state); }
+ 
+ ISC_RUN_TEST_IMPL(tcp_recv_send) {
+ 	SKIP_IN_CI;
+@@ -1623,6 +1623,7 @@ ISC_RUN_TEST_IMPL(tcp_recv_one_quota) {
+ }
+ 
+ ISC_RUN_TEST_IMPL(tcp_recv_two_quota) {
+	SKIP_IN_CI;
+ 	atomic_store(&check_listener_quota, true);
+ 	stream_recv_two(state);
+ }
+@@ -1836,6 +1837,7 @@ ISC_RUN_TEST_IMPL(tcpdns_recv_two) {
+ 	isc_result_t result = ISC_R_SUCCESS;
+ 	isc_nmsocket_t *listen_sock = NULL;
+ 
+	SKIP_IN_CI;
+ 	atomic_store(&nsends, 2);
+ 
+ 	result = isc_nm_listentcpdns(listen_nm, &tcp_listen_addr,
+@@ -2095,6 +2097,7 @@ ISC_RUN_TEST_IMPL(tls_recv_one) {
+ }
+ 
+ ISC_RUN_TEST_IMPL(tls_recv_two) {
+	SKIP_IN_CI;
+ 	stream_use_TLS = true;
+ 	stream_recv_two(state);
+ }
+@@ -2160,6 +2163,7 @@ ISC_RUN_TEST_IMPL(tls_recv_one_quota) {
+ }
+ 
+ ISC_RUN_TEST_IMPL(tls_recv_two_quota) {
+	SKIP_IN_CI;
+ 	stream_use_TLS = true;
+ 	atomic_store(&check_listener_quota, true);
+ 	stream_recv_two(state);
+@@ -2395,6 +2399,7 @@ ISC_RUN_TEST_IMPL(tlsdns_recv_two) {
+ 	isc_result_t result = ISC_R_SUCCESS;
+ 	isc_nmsocket_t *listen_sock = NULL;
+ 
+	SKIP_IN_CI;
+ 	atomic_store(&nsends, 2);
+ 
+ 	result = isc_nm_listentlsdns(listen_nm, &tcp_listen_addr,
+-- 
+2.37.2
+
--- a/bind-9.20-nsupdate-tls-doc.patch
+++ b/bind-9.20-nsupdate-tls-doc.patch
@ -0,0 +1,114 @@
+From c5c756ce2ac4c1563d024428e148ca27c7721f71 Mon Sep 17 00:00:00 2001
+From: Aram Sargsyan <aram@isc.org>
+Date: Wed, 21 Sep 2022 15:05:11 +0000
+Subject: [PATCH 2/3] Document nsupdate options related to DoT
+
+Add documentation for the newly implemented DoT feature of the
+nsupdate program.
+
+(cherry picked from commit bd8299d7b501234263a6aee98049f879b1c700b7)
+---
+ bin/nsupdate/nsupdate.rst | 48 ++++++++++++++++++++++++++++++++++++++-
+ 1 file changed, 47 insertions(+), 1 deletion(-)
+
+diff --git a/bin/nsupdate/nsupdate.rst b/bin/nsupdate/nsupdate.rst
+index 81bb4815cf4..f1ab5c76fa7 100644
+--- a/bin/nsupdate/nsupdate.rst
+++ b/bin/nsupdate/nsupdate.rst
+@@ -19,7 +19,7 @@ nsupdate - dynamic DNS update utility
+ Synopsis
+ ~~~~~~~~
+ 
+-:program:`nsupdate` [**-d**] [**-D**] [**-i**] [**-L** level] [ [**-g**] | [**-o**] | [**-l**] | [**-y** [hmac:]keyname:secret] | [**-k** keyfile] ] [**-t** timeout] [**-u** udptimeout] [**-r** udpretries] [**-v**] [**-T**] [**-P**] [**-V**] [ [**-4**] | [**-6**] ] [filename]
+:program:`nsupdate` [**-d**] [**-D**] [**-i**] [**-L** level] [ [**-g**] | [**-o**] | [**-l**] | [**-y** [hmac:]keyname:secret] | [**-k** keyfile] ] [ [**-S**] [**-K** tlskeyfile] [**-E** tlscertfile] [**-A** tlscafile] [**-H** tlshostname] [-O] ] [**-t** timeout] [**-u** udptimeout] [**-r** udpretries] [**-v**] [**-T**] [**-P**] [**-V**] [ [**-4**] | [**-6**] ] [filename]
+ 
+ Description
+ ~~~~~~~~~~~
+@@ -71,6 +71,15 @@ Options
+ 
+    This option sets use of IPv6 only.
+ 
+.. option:: -A tlscafile
+
+   This option specifies the file of the certificate authorities (CA) certificates
+   (in PEM format) in order to verify the remote server TLS certificate when
+   using DNS-over-TLS (DoT), to achieve Strict or Mutual TLS. When used, it will
+   override the certificates from the global certificates store, which are
+   otherwise used by default when :option:`-S` is enabled. This option can not
+   be used in conjuction with :option:`-O`, and it implies :option:`-S`.
+
+ .. option:: -C
+ 
+    Overrides the default `resolv.conf` file. This is only intended for testing.
+@@ -84,10 +93,23 @@ Options
+ 
+    This option sets extra debug mode.
+ 
+.. option:: -E tlscertfile
+
+   This option sets the certificate(s) file for authentication for the
+   DNS-over-TLS (DoT) transport to the remote server. The certificate
+   chain file is expected to be in PEM format. This option implies :option:`-S`,
+   and can only be used with :option:`-K`.
+
+ .. option:: -g
+ 
+    This option enables standard GSS-TSIG mode.
+ 
+.. option:: -H tlshostname
+
+   This option makes :program:`nsupdate` use the provided hostname during remote
+   server TLS certificate verification. Otherwise, the DNS server name
+   is used. This option implies :option:`-S`.
+
+ .. option:: -i
+ 
+    This option forces interactive mode, even when standard input is not a terminal.
+@@ -104,6 +126,13 @@ Options
+    key used to authenticate Dynamic DNS update requests. In this case,
+    the key specified is not an HMAC-MD5 key.
+ 
+.. option:: -K tlskeyfile
+
+   This option sets the key file for authenticated encryption for the
+   DNS-over-TLS (DoT) transport with the remote server. The private key file is
+   expected to be in PEM format. This option implies :option:`-S`, and can only
+   be used with :option:`-E`.
+
+ .. option:: -l
+ 
+    This option sets local-host only mode, which sets the server address to localhost
+@@ -123,6 +152,14 @@ Options
+    This option enables a non-standards-compliant variant of GSS-TSIG
+    used by Windows 2000.
+ 
+.. option:: -O
+
+   This option enables Opportunistic TLS. When used, the remote peer's TLS
+   certificate will not be verified. This option should be used for debugging
+   purposes only, and it is not recommended to use it in production. This
+   option can not be used in conjuction with :option:`-A`, and it implies
+   :option:`-S`.
+
+ .. option:: -p port
+ 
+    This option sets the port to use for connections to a name server. The default is
+@@ -138,6 +175,15 @@ Options
+    This option sets the number of UDP retries. The default is 3. If zero, only one update
+    request is made.
+ 
+.. option:: -S
+
+   This option indicates whether to use DNS-over-TLS (DoT) when querying
+   name servers specified by ``server servername port`` syntax in the input
+   file, and the primary server discovered through a SOA request. When the
+   :option:`-K` and :option:`-E` options are used, then the specified TLS
+   client certificate and private key pair are used for authentication
+   (Mutual TLS). This option implies :option:`-v`.
+
+ .. option:: -t timeout
+ 
+    This option sets the maximum time an update request can take before it is aborted. The
+-- 
+2.47.0
+
--- a/bind-9.20-nsupdate-tls-test.patch
+++ b/bind-9.20-nsupdate-tls-test.patch
--- a/bind-9.20-nsupdate-tls.patch
+++ b/bind-9.20-nsupdate-tls.patch
--- a/bind-9.20-tsig-keygen-suffix.patch
+++ b/bind-9.20-tsig-keygen-suffix.patch
@ -0,0 +1,45 @@
+From 32f203d4e3c711cde5b1546a054be42b16436822 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
+Date: Fri, 17 Jul 2026 19:42:39 +0200
+Subject: [PATCH] Support program suffixes of tsig-confgen and ddns-confgen
+
+Suffixes different than .exe are used on Fedora. But those commands
+require exact names only. Allow switching between two variants only from
+prefix. That should work on all platforms. It should support also names
+like tsig-confgen-9.18 or tsig-confgen-9.20.
+
+The same case applies to named-checkzone and named-compilezone.
+---
+ bin/check/named-checkzone.c | 2 +-
+ bin/confgen/tsig-keygen.c   | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/bin/check/named-checkzone.c b/bin/check/named-checkzone.c
+index ae8feafc8c..5a1f712463 100644
+--- a/bin/check/named-checkzone.c
+++ b/bin/check/named-checkzone.c
+@@ -137,7 +137,7 @@ main(int argc, char **argv) {
+ 	}
+ 
+ #define PROGCMP(X) \
+-	(strcasecmp(prog_name, X) == 0 || strcasecmp(prog_name, X ".exe") == 0)
+	(strncasecmp(prog_name, X, strlen(X)) == 0)
+ 
+ 	if (PROGCMP("named-checkzone")) {
+ 		progmode = progmode_check;
+diff --git a/bin/confgen/tsig-keygen.c b/bin/confgen/tsig-keygen.c
+index f0d2f9a245..9b13312b5b 100644
+--- a/bin/confgen/tsig-keygen.c
+++ b/bin/confgen/tsig-keygen.c
+@@ -113,7 +113,7 @@ main(int argc, char **argv) {
+ 	}
+ 
+ #define PROGCMP(X) \
+-	(strcasecmp(progname, X) == 0 || strcasecmp(progname, X ".exe") == 0)
+	(strncasecmp(progname, X, strlen(X)) == 0)
+ 
+ 	if (PROGCMP("tsig-keygen")) {
+ 		progmode = progmode_keygen;
+-- 
+2.54.0
+
--- a/bind-9.5-PIE.patch
+++ b/bind-9.5-PIE.patch
@ -1,30 +1,28 @@
-diff --git a/bin/named/Makefile.in b/bin/named/Makefile.in
-index eb622d1..37053a7 100644
--- a/bin/named/Makefile.in
-+++ b/bin/named/Makefile.in
-@@ -117,8 +117,12 @@ SRCS =		builtin.c config.c control.c \
- 		tkeyconf.c tsigconf.c zoneconf.c \
- 		${DLZDRIVER_SRCS} ${DBDRIVER_SRCS}
+From 13348a5fc64387bf53ef450688e181100d0ceddb Mon Sep 17 00:00:00 2001
+From: Petr Mensik <pemensik@redhat.com>
+Date: Thu, 12 Dec 2024 15:56:13 +0100
+Subject: [PATCH] Harden named service build flags
+
+---
+ bin/named/Makefile.am | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/bin/named/Makefile.am b/bin/named/Makefile.am
+index 57a023b..b832e9c 100644
+--- a/bin/named/Makefile.am
+++ b/bin/named/Makefile.am
+@@ -33,7 +33,10 @@ endif HAVE_LIBXML2
 
-+EXT_CFLAGS = -fpie
+ AM_CPPFLAGS +=						\
+ 	-DNAMED_LOCALSTATEDIR=\"${localstatedir}\"	\
+-	-DNAMED_SYSCONFDIR=\"${sysconfdir}\"
+	-DNAMED_SYSCONFDIR=\"${sysconfdir}\"		\
+	-fpie
 +
- @BIND9_MAKE_RULES@
+AM_LDFLAGS  += -pie -Wl,-z,relro,-z,now,-z,nodlopen,-z,noexecstack
 
-+LDFLAGS += -pie -Wl,-z,relro,-z,now,-z,nodlopen,-z,noexecstack
-+
- main.@O@: main.c
- 	${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} \
- 		-DVERSION=\"${VERSION}\" \
-diff --git a/bin/named/unix/Makefile.in b/bin/named/unix/Makefile.in
-index fd9ca8d..f1c102c 100644
--- a/bin/named/unix/Makefile.in
-+++ b/bin/named/unix/Makefile.in
-@@ -11,6 +11,8 @@ srcdir =	@srcdir@
- VPATH =		@srcdir@
- top_srcdir =	@top_srcdir@
+ sbin_PROGRAMS = named
 
-+EXT_CFLAGS = -fpie
-+
- @BIND9_MAKE_INCLUDES@
- 
- CINCLUDES =	-I${srcdir}/include -I${srcdir}/../include \
+-- 
+2.47.1
+
--- a/bind-9.5-dlz-64bit.patch
+++ b/bind-9.5-dlz-64bit.patch
@ -1,53 +0,0 @@
-diff --git a/contrib/dlz/config.dlz.in b/contrib/dlz/config.dlz.in
-index 47525af..eefe3c3 100644
--- a/contrib/dlz/config.dlz.in
-+++ b/contrib/dlz/config.dlz.in
-@@ -17,6 +17,13 @@
- #
- dlzdir='${DLZ_DRIVER_DIR}'
- 
-+AC_MSG_CHECKING([for target libdir])
-+AC_RUN_IFELSE([int main(void) {exit((sizeof(void *) == 8) ? 0 : 1);}],
-+	[target_lib=lib64],
-+	[target_lib=lib],
-+)
-+AC_MSG_RESULT(["$target_lib"])
-+
- #
- # Private autoconf macro to simplify configuring drivers:
- #
-@@ -292,9 +299,9 @@ case "$use_dlz_bdb" in
- 					then
- 						break
- 					fi
-				elif test -f "$dd/lib/lib${d}.so"
-+				elif test -f "$dd/${target_lib}/lib${d}.so"
- 				then
-					dlz_bdb_libs="-L${dd}/lib -l${d}"
-+					dlz_bdb_libs="-L${dd}/${target_lib} -l${d}"
- 					break
- 				fi
- 			done
-@@ -396,7 +403,7 @@ case "$use_dlz_ldap" in
- 	*)
- 		DLZ_ADD_DRIVER(LDAP, dlz_ldap_driver,
- 				[-I$use_dlz_ldap/include],
-				[-L$use_dlz_ldap/lib -lldap -llber])
-+				[-L$use_dlz_ldap/${target_lib} -lldap -llber])
- 
- 		AC_MSG_RESULT(
- [using LDAP from $use_dlz_ldap/lib and $use_dlz_ldap/include])
-@@ -432,11 +439,11 @@ then
- 		odbcdirs="/usr /usr/local /usr/pkg"
- 		for d in $odbcdirs
- 		do
-			if test -f $d/include/sql.h -a -f $d/lib/libodbc.a
-+			if test -f $d/include/sql.h -a -f $d/${target_lib}/libodbc.a
- 			then
- 				use_dlz_odbc=$d
- 				dlz_odbc_include="-I$use_dlz_odbc/include"
-				dlz_odbc_libs="-L$use_dlz_odbc/lib -lodbc"
-+				dlz_odbc_libs="-L$use_dlz_odbc/${target_lib} -lodbc"
- 				break
- 			fi
- 		done
--- a/bind-9.9.1-P2-dlz-libdb.patch
+++ b/bind-9.9.1-P2-dlz-libdb.patch
@ -1,31 +0,0 @@
-diff -up bind-9.10.1b1/contrib/dlz/config.dlz.in.libdb bind-9.10.1b1/contrib/dlz/config.dlz.in
--- bind-9.10.1b1/contrib/dlz/config.dlz.in.libdb	2014-08-04 12:33:09.320735111 +0200
-+++ bind-9.10.1b1/contrib/dlz/config.dlz.in	2014-08-04 12:41:46.888241910 +0200
-@@ -263,7 +263,7 @@ case "$use_dlz_bdb" in
- 			# Check other locations for includes.
- 			# Order is important (sigh).
- 
-			bdb_incdirs="/db53 /db51 /db48 /db47 /db46 /db45 /db44 /db43 /db42 /db41 /db4 /db"
-+			bdb_incdirs="/db53 /db51 /db48 /db47 /db46 /db45 /db44 /db43 /db42 /db41 /db4 /libdb /db"
- 			# include a blank element first
- 			for d in "" $bdb_incdirs
- 			do
-@@ -288,16 +288,9 @@ case "$use_dlz_bdb" in
- 			bdb_libnames="db53 db-5.3 db51 db-5.1 db48 db-4.8 db47 db-4.7 db46 db-4.6 db45 db-4.5 db44 db-4.4 db43 db-4.3 db42 db-4.2 db41 db-4.1 db"
- 			for d in $bdb_libnames
- 			do
-				if test "$dd" = "/usr"
-+				if test -f "$dd/${target_lib}/lib${d}.so"
- 				then
-					AC_CHECK_LIB($d, db_create, dlz_bdb_libs="-l${d}")
-					if test $dlz_bdb_libs != "yes"
-					then
-						break
-					fi
-				elif test -f "$dd/${target_lib}/lib${d}.so"
-				then
-					dlz_bdb_libs="-L${dd}/${target_lib} -l${d}"
-+					dlz_bdb_libs="-L${dd}/${target_lib}/libdb -l${d}"
- 					break
- 				fi
- 			done
--- a/bind-chroot.tmpfiles.d
+++ b/bind-chroot.tmpfiles.d
@ -0,0 +1,38 @@
+# vim: ft=conf:
+# TODO: these definitions are in different form in rpm spec %files chroot section
+# find a way to have it defined only once
+#defattr(0664,root,named,-)
+c /var/named/chroot/dev/null    0664 root named - 1:3
+c /var/named/chroot/dev/random  0664 root named - 1:8
+c /var/named/chroot/dev/urandom 0664 root named - 1:9
+c /var/named/chroot/dev/zero    0664 root named - 1:5
+#defattr(0640,root,named,0750)
+d /var/named/chroot             0750 root named -
+d /var/named/chroot/dev         0750 root named -
+d /var/named/chroot/etc         0750 root named -
+d /var/named/chroot/etc/named   0750 root named -
+d /var/named/chroot/etc/pki     0750 root named -
+d /var/named/chroot/etc/pki/dnssec-keys 0750 root named -
+d /var/named/chroot/etc/crypto-policies 0750 root named -
+d /var/named/chroot/etc/crypto-policies/back-ends 0750 root named -
+d /var/named/chroot/var         0750 root named -
+d /var/named/chroot/run         0750 root named -
+#defattr(-,root,root,-)
+d /var/named/chroot/usr             - root root -
+d /var/named/chroot/usr/lib64       - root root -
+d /var/named/chroot/usr/lib64/bind  - root root -
+d /var/named/chroot/usr/lib64/named - root root -
+d /var/named/chroot/usr/share/GeoIP - root root -
+d /var/named/chroot/usr/share/named - root root -
+d /var/named/chroot/proc            - root root -
+d /var/named/chroot/proc/sys        - root root -
+d /var/named/chroot/proc/sys/net    - root root -
+d /var/named/chroot/proc/sys/net/ipv4 - root root -
+#defattr(0660,root,named,01770)
+d /var/named/chroot/var/named   01770 root named -
+#defattr(0660,named,named,0770)
+d /var/named/chroot/var/tmp      0770 named named -
+d /var/named/chroot/var/log      0770 named named -
+#defattr(-,named,named,-)
+d /var/named/chroot/run/named       - named named -
+L /var/named/chroot/var/run         - named named - ../run
--- a/bind.spec
+++ b/bind.spec
--- a/bind.tmpfiles.d
+++ b/bind.tmpfiles.d
@ -1 +1,10 @@
+# vim: ft=conf:
 d /run/named 0755 named named -
+d /var/named 01770 root named -
+d /var/named/slaves  0770 named named -
+d /var/named/data    0770 named named -
+d /var/named/dynamic 0770 named named -
+L /var/named/named.ca        0640 named named - ../../../etc/named.ca
+L /var/named/named.localhost 0640 named named - ../../../usr/share/named/named.localhost
+L /var/named/named.loopback  0640 named named - ../../../usr/share/named/named.loopback
+L /var/named/named.empty     0640 named named - ../../../usr/share/named/named.empty
--- a/bind93-rh490837.patch
+++ b/bind93-rh490837.patch
@ -1,34 +0,0 @@
-diff --git a/lib/isc/lex.c b/lib/isc/lex.c
-index cd44fe3..5b7c539 100644
--- a/lib/isc/lex.c
-+++ b/lib/isc/lex.c
-@@ -27,6 +27,8 @@
- #include <isc/string.h>
- #include <isc/util.h>
- 
-+#include "../errno2result.h"
-+
- typedef struct inputsource {
- 	isc_result_t result;
- 	bool is_file;
-@@ -422,7 +424,7 @@ isc_lex_gettoken(isc_lex_t *lex, unsigned int options, isc_token_t *tokenp) {
- #endif /* if defined(HAVE_FLOCKFILE) && defined(HAVE_GETC_UNLOCKED) */
- 				if (c == EOF) {
- 					if (ferror(stream)) {
-						source->result = ISC_R_IOERROR;
-+						source->result = isc__errno2result(errno);
- 						result = source->result;
- 						goto done;
- 					}
-diff --git a/lib/isc/unix/errno2result.c b/lib/isc/unix/errno2result.c
-index e3e2644..5e58600 100644
--- a/lib/isc/unix/errno2result.c
-+++ b/lib/isc/unix/errno2result.c
-@@ -37,6 +37,7 @@ isc___errno2result(int posixerrno, bool dolog, const char *file,
- 	case EINVAL: /* XXX sometimes this is not for files */
- 	case ENAMETOOLONG:
- 	case EBADF:
-+	case EISDIR:
- 		return (ISC_R_INVALIDFILE);
- 	case ENOENT:
- 		return (ISC_R_FILENOTFOUND);
--- a/bind97-rh645544.patch
+++ b/bind97-rh645544.patch
@ -1,31 +0,0 @@
-diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
-index 31549c6..65a14b6 100644
--- a/lib/dns/resolver.c
-+++ b/lib/dns/resolver.c
-@@ -1762,7 +1762,7 @@ log_edns(fetchctx_t *fctx) {
- 	 */
- 	dns_name_format(&fctx->domain, domainbuf, sizeof(domainbuf));
- 	isc_log_write(dns_lctx, DNS_LOGCATEGORY_EDNS_DISABLED,
-		      DNS_LOGMODULE_RESOLVER, ISC_LOG_INFO,
-+		      DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(1),
- 		      "success resolving '%s' (in '%s'?) after %s", fctx->info,
- 		      domainbuf, fctx->reason);
- }
-@@ -5298,7 +5298,7 @@ log_lame(fetchctx_t *fctx, dns_adbaddrinfo_t *addrinfo) {
- 	dns_name_format(&fctx->domain, domainbuf, sizeof(domainbuf));
- 	isc_sockaddr_format(&addrinfo->sockaddr, addrbuf, sizeof(addrbuf));
- 	isc_log_write(dns_lctx, DNS_LOGCATEGORY_LAME_SERVERS,
-		      DNS_LOGMODULE_RESOLVER, ISC_LOG_INFO,
-+		      DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(1),
- 		      "lame server resolving '%s' (in '%s'?): %s", namebuf,
- 		      domainbuf, addrbuf);
- }
-@@ -5316,7 +5316,7 @@ log_formerr(fetchctx_t *fctx, const char *format, ...) {
- 	isc_sockaddr_format(&fctx->addrinfo->sockaddr, nsbuf, sizeof(nsbuf));
- 
- 	isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER,
-		      DNS_LOGMODULE_RESOLVER, ISC_LOG_NOTICE,
-+		      DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(1),
- 		      "DNS format error from %s resolving %s for %s: %s", nsbuf,
- 		      fctx->info, fctx->clientstr, msgbuf);
- }
--- a/3190
+++ b/3190
--- a/ci.fmf
+++ b/ci.fmf
@ -1,13 +1 @@
-/test:
-    summary:
-        CI plan, picks Tier1 tests, runs in beakerlib.
-    description:
-        This special plan has to be named ci.fmf to run in CI.
-        It selects test which have 'tier 1' in their main.fmf file
-    discover:
-      - name: tier1
-        how: fmf
-        filter: 'tier: 1'
-        repository: "https://src.fedoraproject.org/tests/bind.git"
-    execute:
-        how: tmt
+resultsdb-testcase: separate
--- a/codesign2019.txt
+++ b/codesign2019.txt
@ -0,0 +1,252 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Comment: GPGTools - http://gpgtools.org
+
+mQINBFwq9BQBEADHjPDCwsHVtxnMNilgu187W8a9rYTMLgLfQwioSbjsF7dUJu8m
+r1w2stcsatRs7HBk/j26RNJagY2Jt0QufOQLlTePpTl6UPU8EeiJ8c15DNf45TMk
+pa/3MdIVpDnBioyD1JNqsI4z+yCYZ7p/TRVCyh5vCcwmt5pdKjKMTcu7aD2PtTtI
+yhTIetJavy1HQmgOl4/t/nKL7Lll2xtZ56JFUt7epo0h69fiUvPewkhykzoEf4UG
+ZFHSLZKqdMNPs/Jr9n7zS+iOgEXJnKDkp8SoXpAcgJ5fncROMXpxgY2U+G5rB9n0
+/hvV1zG+EP6OLIGqekiDUga84LdmR/8Cyc7DimUmaoIZXrAo0Alpt0aZ8GimdKmh
+qirIguJOSrrsZTeZLilCWu37fRIjCQ3dSMNyhHJaOhRJQpQOEDG7jHxFak7627aF
+UnVwBAOK3NlFfbomapXQm64lYNoONGrpV0ctueD3VoPipxIyzNHHgcsXDZ6C00sv
+SbuuS9jlFEDonA6S8tApKgkEJuToBuopM4xqqwHNJ4e6QoXYjERIgIBTco3r/76D
+o22ZxSK1m2m2i+p0gnWTlFn6RH+r6gfLwZRj8iR4fa0yMn3DztyTO6H8AiaslONt
+LV2kvkhBar1/6dzlBvMdiRBejrVnw+Jg2bOmYTncFN00szPOXbEalps8wwARAQAB
+tE1JbnRlcm5ldCBTeXN0ZW1zIENvbnNvcnRpdW0sIEluYy4gKFNpZ25pbmcga2V5
+LCAyMDE5LTIwMjApIDxjb2Rlc2lnbkBpc2Mub3JnPokCVAQTAQgAPhYhBK4/rHln
+EexZ/AB6pHS7a5pMuz04BQJcKvQUAhsDBQkD7JcABQsJCAcCBhUKCQgLAgQWAgMB
+Ah4BAheAAAoJEHS7a5pMuz0476oP/1+UaSHfe4WVHV43QaQ/z1rw7vg2aHEwyWJA
+1D1tBr9+LvfohswwWBLIjcKRaoXZ4pLBFjuiYHBTsdaAQFeQQvQTXMmBx21ZyUZj
+tjim8f9T1JhmIrMx6tF14NbqFpjw82Mv0rc8y74pdRvkdnFigqLKUoN2tFQlKeG+
+5T24zNwrGrlR3S7gnM47nD1JqKwt4GnczLnMBW/0gbLscMUpAeNo/gY4g0GV/zkn
+Rt91bLpcEyDAv+ZhQZbkJ49dnNzl5cTK5+uQWnlAZAdPecdLkvBNRNgj/FKL41RF
+JGN6eqq3+jlPbyj9okeJoGQ64Ibv1ZHVTQIx5vT1+PuVX/Nm0GqSUZdLqR33daKI
+hjpgUdUK/D0AnN5ulVuE1NnZWjVDTXVEeU8DFvi4lxZVHnZixejxFIZ7vRMvyaHa
+xLwbevwEUuPLzWn3XhC5yQeqCe6zmzzaPhPlg6NTnM5wgzcKORqCXgxzmtnX+Pbd
+gXTwNKAJId/141vj1OtZQKJexG9QLufMjBg5rg/qdKooozremeM+FovIocbdFnmX
+pzP8it8r8FKi7FpXRE3fwxwba4Y9AS2/owtuixlJ2+7M2OXwZEtxyXTXw2v5GFOP
+vN64G/b71l9c3yKVlQ3BXD0jErv9XcieeFDR9PK0XGlsxykPcIXZYVy2KSWptkSf
+6f2op3tMiQEzBBABCAAdFiEEFcm6uMUTPAcGawLtlumWUDlMmawFAlwuSqAACgkQ
+lumWUDlMmaz+igf/ZW8OY5aWjRk7QiXp93jkWRIbMi8kB9jW5u6tfYXFjMADpqiQ
+yYdzEHFayRF92PQwj81UzIWzOWjErFWLDE2xol9sP5LdzeqoyED+XTqKggpVsIs+
+Lq672qnumQoZKp1YGb8MDocU2DNg/VsMdi7kCnEnPbcSuBxksmxGYomusXNrAF94
+1OJ2sqd9BuFamLIyn8XUCGGYlsvMoe4kTCg6Cc1sQvx0lDG8urKN57jBKWbP4alV
+JBV5KQcf74gzPmE3ypgY1tMEwxyH/WyS9ekDbai0qauX6eUAsM1bduH8fIcknLS
+Zl5hrJTrzWFF9/DKOth8QOwhJ9zoIF1fcAsx9okBMwQQAQgAHRYhBHpqR7X54SM6
+0lUrXL2X3GOe6MR7BQJcLktcAAoJEL2X3GOe6MR7jwEH/iaolMeno1oeWAgzN6Mg
+bx3maweh/9Vqty1fwk7Crq1G78X5i1OCkknEL2p0Bfle4ApwcC4HZVcqCgoYpRV3
+/EEXtwkMNy3plWdBbLCQSev/E1D39GzgAHiMnv7NUJnkoJbvMrvrAiUTXPTtARMM
+gjEpvgEs60wuJxS8ESomRhe/KW4myxDoBxF+K+e5bOkOvvWVcAYJHWZ1BIZs4n6b
+C2vO8q5aKTkQ/XvNT7utbTOqj1SGhItRaAQKXHBdzkQ1Et3wTA4+uRg4gK12624
+9LperYs26w9X9UzApl+qVxQhtWUw3tnUXMastDfQrRcvJgq1xpv++OqX5Uc93RTf
+SNWJAjMEEAEIAB0WIQS+DpdItxglOii7if/xsRvwXPAuVwUCXC5LlQAKCRDxsRvw
+XPAuV29KEACEwlTVVKe4gnBYHnlAD7csoQ0+gJ6C+Ofzlw+UItRIcFeVCAknSGBs
+NPxr9JStIvKpmsbSKpCNUEAYnRP2immh94y/C6BuTe1uUUmqBGr1f4OAUwZpmI29
+ixYeY/uUs9FZO3bS0/WtG46tdcJK41qtM0DYAGT3oeZhJMTW15dfvMGlFukauSOU
+BbR+6sZhqdbWl/AOTE/6x5otnAaW0GObY/BW240Xq/KTgBrzVdK5qNoYsMVsiTd
+0im0JKvFG08ED+ZfcILhlO6G9jRhoTkhtYuf8CKN1dPf2IoB5FrRFf0xqRr9hNlk
+X7ViNMP9OPb8i3BubWvRi5rNSquCwrFATSiAgaA9Yi1BNzQsmQxOql9lsh7eCH7m
+8zzUg9umWI6PkSv8vHBo2kPX73wmtEsF6vxJlk0yDBuQw7y0uuKh406tEEk4cP2
+8U4baq+ihpioupDhNuEII1h1Eh/RBE408RAOpcr+2F0m/fKOoJyz7u+AxyV81Ia6
+fyBnUfZnlfKo16w87c1HJRs9dKkRa5yGziBf9TcED3sru58Pftes2Nr80/iOh26i
+P2pRihcIyrmeAqDWnneErVCmPMDTe6zkMrm/0iZ25/Jfq+M8IHEzFEw3Y1FBOeFg
+9TyMDwYG2biJPTNTDO0BQ+Rrvs4SjFWEYSxgJSvG1jMfSPt5AR6MJrkCDQRcKvQU
+ARAAufZX5WzJr0lZAhxaGpHY6JMBr4jVOCP4TrDZhwC2K4CXNM/PLLNisWzquiWa
+FvUDhB89kCxrEhipwVFYhBr16CDQxrr8yhah3RIxrBMYhRTxgIAkANgkhGWfDJSE
+zXauA7krYtS3rYwhfXe4cNsTkLPbnMUlyLJcqj2wnZcZIt97aL+NFRPyfIw1KfUb
+9u3tB9seDYbvTEULeL07aTnHpWM5f3bTwJrJ2OFPzXseCCzPiVNh3Bv+YtJ1pMTr
+c/UHO5DoJuHLsF0wicPSrpD0twspFdR/0rT6eNycsaCtV4GQzBcMPvY7qai5XrZm
+Cqgluo1W6l6+F5YrKvRMtyyFkUNGcPywdjSlP44JyRrS2uzvFUViSsJArcmFG2TJ
+LCohnse8wqjw0dIUVbmDbE4zjaG56zkvu0k+04Wwp3XPgOZrbl6cbhX3yLhu/Gt0
+dzd9EReoNfKXk32hBzKas/vdeB5DZejbOOOWYftqyZC1LvDvvrYFhFK6VGozfZ6L
+Fml1hzn+xPahp5tRv93/T9zXeVPm9zilGMqm/gjRgh8ojWxNQoNzJyqTPWIvWmbu
+EIP3T3cTFq6lJpJsg3+sfzofGWZCGnBZQGqm8rEOoUWiaKe1BvQCX1x8p4/x8/tX
+TaVDpQCGoqxXt09plkDuGMuiDICxBlaHWUR2jLoHc2cLrB8AEQEAAYkCPAQYAQgA
+JhYhBK4/rHlnEexZ/AB6pHS7a5pMuz04BQJcKvQUAhsMBQkD7JcAAAoJEHS7a5pM
+uz04pB8P/Amfg54IFeALiPOrKbjC3bVAQzrsf09IL8sUln/LCZIx9HgGAJj/f35S
+Q35sK2ucjWiDX6qCxVrWmC6caQXFgXOFSKIlqladmmgj4sIdLM5wj4nbomHChpB5
+rqV/GgkFwWBQ3kPCatXvc8Bg+zKJ+wXgTuPFXefyE9R+SLuas2grQ9hAjvTGHYbq
+iYxSlNDFc1aHLAQ3bS76351MHuMHOpLzoB0OkZDCVNW4GNEqrLbINdr50RAK+Loo
+Z2UBIobEZjXYor9A2FWkSvdjyz6X1QKMdQMath6R91k/O0abBa7ly4/805eAGXM3
+w1Xf2eMlpiUs69BeYoJBklK8aNMntpDREunJjhiPU4JoDzSxl5Qv7LuXylyo0YJA
+9YmydKhTTcRdwsKc//nGr/ckg4BRl+VbtJBYvd3xGB7IQ+pT/TOakv9qCospAhr3
+EQjVP/XpnWJRd+x+dq8UXqwWmTenWDE42cNr7BDFJdOqS5ZWy4sIz4sdjpSxXMB9
+8iiRtKSpKRCJgXScB7SYebh835EgG2YyQGdhJMO7C6ok9POYQBqL8sBqRzImJKoT
+VDvOH42WArKwJWTHa4mPdiDHEIZlkONerec3JXtl4Mfv8cwZ5Lb8fSiB/x8AWvqs
+puc/7hQtkus4TcgutS1fwhAwpnFItpVF6+73CMQrJsblBdTjW0T+uQINBFxbVHwB
+EADebZOJbhPdhHeBPdlZYE3rRjB8scDpWdjrCupfmeTC9MM6JgCE4DEMBtBXk+h1
+7wfpblYYNFwGVFvytG5nvGRDtHWxwd1Z9O8Fx4Zqu0Fx/wAn7ZL3ryE+tdHR7JK
+7SLxOa2X49T/8LY0U8Q65I4ZRo/b4VMcXApCmncw3QSRqHT/mYdNnf+HHPvi3jza
+md3iVptCS4Iaisc079DFda+htWXspBc13lmPi2vGQkWjjS3B4yO8JackyQPVhpsg
+KYbRBzOH0Kii8bXmyA6O5uIJYEddp5Veged4FE/ej3CrgGP1D0Yk1epx8lLbi9RB
+kwFS7DA5rQ23UnbSy1WyV1ZgPrWqQAWuGpjMTVTWN0ElI3AGxAnE8lZlSXyE+XyV
+uHjjIVrayBjLKVqDuSLdKZeCvI4QsyHH6F0NKJQkngvXxLZYxO6s0c2EFFLzdVWT
+1V9GMP8UsDrrb+JsZjUVmPR1tTP4xqEQG6KjfFoQm5XWpGtFwh91OK1lwf/Bx2/C
+j+PquLLFcj7hEP79VDTUZPQAduTTxIeTzHXH+x1PCHFB10xxH3e82VSdJeBUrJxn
+riXzK50SKTTmF+uYpHqE8Jg1N2Y1n5ksuxeYUy8PFjhAeBCqZ6ZcldUDf4999e/z
+PT8bwfCDr8jRdqJHrq7RxTJiP5RsMudWpKeohzJGwQ5uZwARAQABiQRyBBgBCAAm
+FiEErj+seWcR7Fn8AHqkdLtrmky7PTgFAlxbVHwCGwIFCQO9IQACQAkQdLtrmky7
+PTjBdCAEGQEIAB0WIQSVztolaxygoV8wL7WVIaftXazpGAUCXFtUfAAKCRCVIaft
+XazpGPeMEACm9nxA/VKf8RxDo2ZuTgyuSwlR8tCjAE4k3+UoiYUbamkW4pjx9Vgd
+1zC5bNxSWZ5vlJ4CH8ArKFqNK5LBVDZqhYureAo/1Af2b9vRJw0/QQHhuXz/jqeT
+wwrLuKpy796Gpt+aFfcmS0ZC4QXfxJERhAP6tu1p6YmAsSb+bjziQVkKrt9mhOrL
+dtz6WP0Fg1joRj33FgnnLtayHvtgQrNFI3ztCjk/B2FjYZxqbBGfk5gyo0cTE2Fi
+oLhG/XrxIoZepFMJkGYETnYQXrOt2KuJLvawV70YQmG8EqHYY8drKA0XDZs8TVdT
+5cvGvtm8ERz5znsssRBxQMI5Ml6O2ahrXp8Eq4htCzlvO8t2MOtzvqAJRiyAd6bA
+Uo+MGVRpnvePOR1SAgBXCd416rF0iCXc1utZxnqwdq9kJAZ+8mCLx4N4jk6AdGpX
+zcNkLg7QmUzXn75RxZ6GrIUYZJNMlswXq5XhSW4o8ePlaxWjh9+QTtU964AZhpA1
+uoHsKGTBxHJs0w6McZm14kb2PuaO2/rpf8s8IZyc93+Y5O/gHZ6/agBjA9qN6wkQ
+R1d5UhJC4QS/m35rBGBKK9X3fqQxaBCio6Qz+m4A3GchrztJpq+2P+ma5ylsTq5j
+V4njky26WNtrV7+N0C4Moj3I4Qn6YU/eSManTXzHzoiPZCEH/IOxgXIiD/9Zm3Zz
+I+h4NCfSGyP11/w1gEzlTHQ4at/FXIIDh0Y2ZNpWPffuFQLtcER2vyKPwhDYpGMy
+NNHXks4azfrXVCv0wmSNBbeS8pJrYtopZpCEBrAbg/YLv9m5lpDSRHaR3gv/qMZ7
+QxY+NwqciqTwGq68PuF4mDSvtfuFmbEES9Iybiie+eL/6DU2knfBjgshUe6vElR+
+LYoPQ45GY2IxRTJ1pMXaZw1+evwH3UvseRGkRygiaBgoU/qR4prynvjMQcacCa+C
+aRnXZJYp/usVBeY0xut9toc9/OcLGoBr5h9l5YjruO2vu8VHou8N0tarVQn3YbQR
+Fi+YtNtclWJa8Pq1AsKRTCFwDwP6eODv6mNOrEFydNRcpiQmzp47VWF/YHRfHzCq
+A1wHLxLUrpQTaVw6J4FqedAQ31aAO4faA7MS+ZMNBqZCZ7lTGC6TvojqqBAN2yX7
+AnnYpZHM+lGpi2/ukVzLqSkGmdNOgbu+UZvoej3YnHYig4yWP+z2xrlJl8bkhU/d
+r9IQE5aRCEPB/JWhHJ2/GqYl9qjshlB52+6X2KDarwptOtzT9ooArYhpMwKIYh34
+c7X8tlAKYk7V5j7txIRFDKKAftC7dM82PntXJxSkWyR70GYnYjiXyrqqerqT7xIC
+mDEQgFOPpy09zFW62paO9uiZw6qwybwqgGpoX7kCDQRcW1TbARAA3ERo2mPv2VVg
+ZUFr4MtPDm4UG00YJW/LYa3D3k0e9tdSScACXprk1sAoxUlQx/CSdErPKwXG4rax
+iN4t5nICUUNYSC0dh09G25jC7nwsWc0AYyZu+h/FzfvpOm3fBwmBlzILlGh0URwH
+Ffj9fHt6hos4C+3PFZZ/X24aMJF/cov1oYi9rqFwt/l0mgtPE88Iyj2/Vp3Lergg
+QMzKfEuyluj9fL2cgU0Qa7oAPXmaxhHtua4cvbM5SXGo3FXjIgzH9OfM+2orebeN
+wH1M3ec6w+nPmRmCJLvPKGOeS7GVXL5/aOyPlDWzSXYnpCKS2ntw4K4nt0IA8n8z
+1db109l/C2noDrDSJEqOo843ShNGTYOMVUrj3a+Y7o2ATc9pNZalf0PwnKas7NDb
+IJ152PEQw665iYXcv2awjLF6W0yuSq8kfiaAxIrsie2Dto0zgqOs0Ot9Y74u11Hh
+wBSHUO3mEZJScAAcI/yDF2PvjvCQSzu4mdXb77t6X2O6YHULz4A7bVQCMazcTDI9
+/S0W2+ixPnnJVnE3xgjK9zuizji8JDJw1hJCQM+yTLVqq9pfvcRfQ6uwpMRzz/O3
+S0zDRiA69/GyfNwkpgz5QaGpY02IK5WrQU1doRjIz4BHAYzoIOkMkRqTtjdElQZw
+/D3wSO2uwsEMNwRzibR/Lz1JF2aGn6EAEQEAAYkEcgQYAQgAJhYhBK4/rHlnEexZ
+/AB6pHS7a5pMuz04BQJcW1TbAhsCBQkDvSEAAkAJEHS7a5pMuz04wXQgBBkBCAAd
+FiEE1wyE5ktVjlvM7AchMuIXXx11eioFAlxbVNsACgkQMuIXXx11eiqCfQ//SFDf
+rOIEoslp6n6vlCuavOg02wvjskKQGP1P1Q4v40Fw1Gl87n9uXAoMpeF4H+pzUxOi
+BHYCQi+EemwocSThzaWfPzd3JG/0OcRymf+ZOcBb+58VJL7p88QdMFIAi5J+KMuA
+fEG0zLkc9anEnXoVMmQJX5K+6PyeVDvBbYGjLjQAsWTZTiVuQI0w3WxFtDGWqQII
+8e/qE0DA7c/auGn7j2hid308+FcdfpmLefW9YesWjE1yYvHoCRdFOJ/7Sft4MQCI
+Re7UET3TRMBvtisP2DcqyzGPp22s4ZYFCCJJNiB92bXdEl5zXe4Ff7JTfNE/QrR7
+Wg5R9hZHgHdbp8p8bA3f0y29YCx3puYg7BbmQWiMh3rXWE5b090pSpw0K9BQU3vO
+irr+5/2TaFOJXHl4VF03GrWsSncShCbdsdRIv4TB0lY2mN4q+e7bjlAzJJeoaS97
+GIqu3DBlAJyx/ZwWW23DXXwoQ4jNuJhpl2jaCE7rVQB0uLjbp0i9Zdd4SdYZxmO/
+Y+JfgoJz8eyx8wZi4eDz1ijN0WKsIGjxJH5VUK9STjijDMeG6ZZRLc6b1QCGhe97
+ZbDkEUTdQGoeu4L5Fiqoma13NEsf8ofBDv+myJm/O67Va9JI3gxhIrhmF7LMzQQp
+lYx2peZC1CmhEnn83dtt83mhXvX6Dth657BW/Qd+GQ//SVuTPuNkBXfrTi4dbnv+
+cU6IsoIBodTF/WsQ6h4kbtsPhO5DbrsLNuNumrqVEN8jw+HUsEeNvFNeMrTPdG2V
+87ShQ4BQGkCf+GFRBj0myxxXOFZYQx6RpY5fCe7yOcTzpkbnPWmm7V8HdOuZ0NnL
+JNQ5YogOI6UvXVKv35R9qBo+G9jkhhb0eaAu6BERzKVANKfsGN7545ElZ1qlffMh
+AQhXGb6TsvCeSg2cWGb2cnVL2d58uVukD4PDiq4qqwgClkF3bOO70SIgGrCteHbi
+4Hseopex5m6GqqjoUYXr7QQBwSaQdc+gKtEjMHCsHbUyHRk0qEHdEe+2RmL0d0ra
+QMJfKyYQjcCR7tnrgN4WD1h4NKRdC/KRW31MDmH9XVPrkOMQCUCnArXkOwdKWsKf
+h8af9HqweXOT1FHJN/M3tWaBpv6KoduF2f2pj1VhPZ2EqFUycJ26lrHyOpsynQR6
+TD+c1uXotDwKN5RW+YL1cydk6mhib64fdOyPUeTcHehjMAFgM2f5wi35Ujcj8id
+37cWOqRsggSbMnGO4AUA/YtcVNG8TjZbakson8ENK7e8q4sEiNFUZ7/CtzNokwHQ
+5uOG1+qB85Y4ImGnIZVeiBpjt73VVawg4Zvm/omtW50P9R+4rVhMJZZFAgrWg8BH
+H/KNznW0vUuShG8B+2FA/eu5Ag0EXFtVDAEQAL5ftI1GgVJEFgX5VsuFnfBnH95c
+zqmwEXaTP4s7Xm3O0Wy579EzRUD1eEw/UaD/q2OHScwvMP65cZYQ9w4hnCN6H96P
+96Teo7LOMCssvSXIO7gqP33LKTqDzsIoAFHwWE3dq1jbyP6T1Je85mr0Edvk8kOC
+B1hudswAARno/7X9zGulhhwuEHk5Iey7R59yRUQqBctdNcetGyaiFjjX0evuVADi
+/z/s07XhDLDt7+3Vglh1/7XGC64QhB9QjZ8j0u7+0xfmLLjhi+7EpkDlAHIJXX1H
+0wAsPOGKlYruQUmIsMNfBINZeulHEBZ4cAd30xsM296DzJ6QL9sAGfYMhRs0YHB/
+EJ10Zv0iw1pU2jCCUv/9Kf4F4nwgHQWQP7JAbfhOIUOUq/YlxjTLnkd25+7vD3KH
+NQ6UiRDROR9Jwetpd/zokpf5O5iTBpVL+sCq+NsTZyDOjITve2sY0V8v10M+Z+pL
+cp/cUZ4JEDS/WJ4/ovBNJP8b+YwN/RBgCjl8UBX/N+e7AA52eYP2H9GK9XPkzSCE
+VxEf5PyjGrwedpoLkzagrHsDuWo3uBquLyneT/ozihqKQAuInUy5B7rWU4mpKHe5
+Vto5o6Zuj+6MgHgIQzRK6Da2ziMNEmroxwZibcYCtUPdvcvxGh+byclnzBclKjOw
+kAalFPx0SxEbHmzPABEBAAGJBHIEGAEIACYWIQSuP6x5ZxHsWfwAeqR0u2uaTLs9
+OAUCXFtVDAIbAgUJA70hAAJACRB0u2uaTLs9OMF0IAQZAQgAHRYhBK7WIv4CB360
+tcFGwUKiedJIzcMQBQJcW1UMAAoJEEKiedJIzcMQH+cQAIQYXDnqi4Hl21LtAgky
+pZxug+x/LECVlwkrIfaQF337+fG+H9J7SdU87Sn1Xe/YUgQnF0XP/fjIVFM0e/Tb
+xVlmTFqiejLnIwJJDgUaHO3POT2sGEyO3tc0mqSzyRBxtMQ8yvApccBhL5QODv3h
+hlRWgk5MXU0IPeXw134IWm+o/PRiPBoXPawvVfEVIBlUFaiSZASf4BAiSad4aJQe
+P8PyP7FPvQB1xiib0iSetn6ZmNeN2OSUJPiPA8aE9JCKuFtomVQEDM0BqQDl5A7h
+5O2uyf0Li+/ArqBvfBjrH03e5zbID02dO3D2BjsV3jUeVPQ5WDgVg8LH+nfg/rRy
+wfCsx9zFp1mt3K4xN2v7IKwxGndApgCcx17gsjzMvLz0J7sSGov4MNjzqvGEDKCl
+uUvNKXqy7je9xcQLpoyvWtoWFXWTbQAcK5Vv+hC67r9bHpjI1KuqA8hYqNKxsv7s
+wiLZdd4SK9SIuwf0j8/XTZwmoFfGolJil0ZNxyqBF39+CMVpaHdLM1qKZz99TVzS
+h4obOOjkUjK458xSo0XCbJ4qXYp7PgxyWK6GIbTozbbG/1ldw+LUnqxt8Shf797L
+J9lbI3ICuR2P5PYlKJf3b6D9GyfqyrP387fKAKhHsYkZ1XD54/8wIgTrdfeNPtL0
+1mjWDjw5KvO9kuPBjcmzgt+NrtsQAJwKeZsiqLLcY8kJ9xP+/xtTlh2iVuZMfxwq
+hwlo4MMCzpobLDZ/JKU398m77eboTKJSBfeUYxQd4ATn1L8NLKjLxKAaBkjEk0nN
+8w9OUQbFlhQ/asLzzF7Z9IGGh9/SEgBZ8V67a0O3Qw9Xdi3ARK3bbZ8RIVJ0+P9G
+CGrfq9j4ZmGA2L4irLjsvDAv7CSMb4WBKW8j0Jz5LFMwOMJgG1TT5c6lNqFj6y09
+rZcVLnt8+lUv2Bw3LC0oI1TjFkrrCzIdfg++mPi3K/ZFc50bvnWF4eCOjgZ5U9Vb
+sxFZq3+vTRcIfI9z2lZ9CNDRA1O5jGvuVtEGLiSLF2aJ6kiNriLuuGTlXfg/Fpgh
+GTvyppOTzF7PtHzHBQ/ZjnhWojnc/jyJRwLK8cCl6+EOc887v8BDmqgFWtmycsE2
+5fDJ7UFGP13g/eDL3ZUgMDty5dQaUOTX145t2KT+lMqpY6ZK2EC+eoqrnIGJ+tYy
+0l4RRxi10mbNhuPIIDdph7X+mUHgCeA9gyF0Y+LqiB6CX+zFg7ovLvnCbMPxdGXq
+z7AjfwqZBKI+BVuBeDtyW4onmElCu5cXNKsg3W0IlQlZf9PMDU6Ht0XLUs7EPfbQ
+sH1Vqi1XE1W/tGnkmjcpG/qlt9Gx1uwFGLP6iomqUBc2c0GZ6R1xplXvd3w3yC8d
+8lAgPGImuQINBFxbVToBEADkuxhQx9gxlzzCc0nUu2v82XsD+GzONp9irt14gslx
+te96eKaTXTi0t5eya0X5TIY3wbREwjlfAeM9AfcAmWcsM4izrfPtANM6WOxB2Tbz
+EY2cqv7NBQii7Z5aqPyjcIiT0b0Gs2evlDkn3xEBBqTSrNcnGSA29bZPIkaUb7Qo
+p/Ani0S3/tgcR21gXsJwkgpfNKwvPT03Lz3/o5rXAyag0M/25adgk9SVKNcXc8h2
+HSGv5ENjwUKNNnowVbNLw4287mFUM2Vd6unGJ2MBj7aUwTrfBl7gNV96mMdDJWcB
+hGKYkxUvibuHCa2KH7gTrnV6X7sdrgD5CbJMPq6OZNSP6n6bUVg22eHxoETplFwT
+4NvV3clRMWIAG1XgXR1l99LAh7PPnPMM1pHQGPwYHQskoBFS4g5knzHpB9h9TfZ3
+MM4cDZR5NgWmE0fYVnWe5ax+wW0/IOklUoHv3qoL4yiN9wFJq2oLzUNQd9+tsqiy
+vxSTh8iYmHegyn5KuBPsrMPgvqiKOdalTZKkak9DOx4cGQL2qHspKxiBOb6uox2v
+fjMQ5bDeUn+4DYMdnZNHeywCUegJmDakUtlfvN+136IDHGwfdGcitqzswzd3+PI2
+qlwPE19gkrp9NUaD3Qj2ZtDP7sU2cThc6Gra5KRFW8f98bI77j1Wu6pCnYFLqPz4
+QQARAQABiQRyBBgBCAAmFiEErj+seWcR7Fn8AHqkdLtrmky7PTgFAlxbVToCGwIF
+CQO9IQACQAkQdLtrmky7PTjBdCAEGQEIAB0WIQR5HX64jryNAThDSqwz3zWa56YK
+eQUCXFtVOgAKCRAz3zWa56YKeSWOEADK8u03LESGSQlZQqnnCAI8iYs1s+XRMEnG
+2tAQ1OK7/4eNgr1yZckmaW4FBMgeEgYIBJ7v3SlW7Hf7dE10TYPNGbP6UxVW8HIP
+rA4CINcGZXWWwpS374JNMS6A5eb6viuEgEMEi00jx0MmLvCMZKypmwXQUl5YJ5nB
+ytpQ1681mCQxGBMhT1eKQt3B4nAsoEnP+HnqVM/nKxBemSBNXX+C0b/YeQoLC3sD
+L+Z0NRI8U6PZl9Rokod3uynH0vfBYCEJd6MvsjtnJlVVaseYIA3ESNrFG12tw95I
+wKNrVCANZ1DBSyK4ovmmWsDrH+uFTHSLNjlxIuVxUfmXcLfgcepVCmd/7Z7UrWYr
+SXSvP0VG4ZmEPE7tNb8bfyADftO1cVsmcHBQeSrgvpSrTv9L8MocojpR5vJc1f+a
+sBT7rAeGzZP9riz1GmryXawaZgdLfaaJfzRQkc1uTChb7kMN+UMhVUdCAXmho0XO
+SfcsW84u/LpjdYh2Ww41xQO6EWvbZDNgD/Fdmp8Uh1MqJ1Dejri6kjNn6wPImXJd
+Eu6nHqWDRdYsfT4XUB18tB+4aIpFzCyIgpf7p1uaVU7Oqip5sZkc/WXKr77lV23m
+PQvpGRNCzgU2TJY7ktR3LOvUVN6wNfLMHzeQk18NdmcEGUrJ0YYtl9vE5/Eg9L6x
+LBH9PKt17IQ8D/9DLwQX8pl3fuTM8ZbzIPLxiXhbgzBBTXKRE2u1888+RIq9xE7c
+aVFjwq4qpgqZ5SFonTcG4Pi5ck3mFAzyA5zLRF+ckpmBpwSPMpLwCpv10369D1jh
+AF3JsUwt6DIb2BISMhh2ThSUMSKO75q8GSotsKjJyjD6vl1x4L7WXubTWxEiNuwD
+3kAjFWS1Z1VWtA9SURWAbsDaCV4VmwCCpSIwRr9OTbyu9XuMdMxGNpl8SwW7MVQb
+x4aYNvR7Hl/wIR71AHAXoSfrKp3p12anXjYYASHmbm16ugP4H7HLMBfznKet2f76
+gIxJr1CsAMTSqypcC1UoVb6Gz8djeIR+GU+6efHI4TIUMy5uMIUx8tYbwSEeo/y6
+NnjpJFYYjJa671iSABInNxs4+X+1zrFa+wl45EnaFxziEet2Qzv/VsusoLvLwnYi
+BZckclAS5xoVGFW0WJ01OfLUDHxGMt9GSheL8c+GLMaMtaCWunpmmt9zZ9WdpBOu
+AGluMG1Cee50TrhXaGE8CdNr8nOdSeLNAveBAPmuVa0JDSe20/D/RuYJLKeG9Vsq
+BZvjuGlOUsfl6UjtiGRbgS9OWpxeez5ugc9yyV+rBGIpmnIb+9quz2HmGxE65eA2
+cRNsZRIjFLzeAx/0RMaT1nlLFTBbUuZ+tJ+fgFtRGMhifZn1pb2dMQo0N7kCDQRc
+W1VuARAAv4LYaNq2Zev/v7M5DnxLpgHRcMkG7TOQpycrlK5653llpZzTy3mh5peW
+vcq3IDmdeUIJxQ+WDh2f0vS+NIKDC/HAddfHrZPbhO7zLxLcMW5KmV05ancaRSP0
+s0+IyQmvVxUNrgPinZiphlvRGoLXS6pdgfc4jIR9B2umPecfvfu/6EWFPnXZgG8K
+yY3Z+mwrmEO0FaXHBQuu6nactiPe79N4bLe8hk9RW6yIxLBeJzIoOlIcJmuRHapt
+nS2lV3mfhZdFnkAp1o6a2TL5BwgMY0wZUKZr78HEMKh6LbPN9rPepf0neUeq/k1l
+NJU7V6XMS+rezF31vgSJ5KoNGYhxtWZ54uksH2rcw7+ltpSVtqY91G/vibpRCJG3
+LdX/kxHni1NEWyZlpS/6ntuH6HSoNYsR9IMsbESs3QVCH74ApK88CxYCRB0SEo0M
+yAElbQ3bfEKCKl/FwC4IzAYAJ2arWKwBHRSJlsrNCtczrjG7j3EyJrn8+Tm5yjO6
+0THQjvc/nBxrNE09r1Lzz7jrDWC9Rl+BH6wqdniymoYyUAQsX2rZ+Jhah1Zkf+Gu
+76qtY+EH494dPM+0FazcBlgBd6/J5mh3Wk9JuecXLTEUGtzd1GmI9CENPAklCauX
+tNOWeTop27djuKWsZxuP1GyV6UYixFVOSWteyAbA32cncVv/2ZUAEQEAAYkEcgQY
+AQgAJhYhBK4/rHlnEexZ/AB6pHS7a5pMuz04BQJcW1VuAhsCBQkDvSEAAkAJEHS7
+a5pMuz04wXQgBBkBCAAdFiEEFWiQaF6g32oTce8gF8xdsfAIhAcFAlxbVW4ACgkQ
+F8xdsfAIhAd4jxAAiO9+VRQQ3eBOsJRgANdgL/l51kq7qE3u8xnSqNkrmdYDdT2H
+TYH5W4n2AmGo50BDafdjd6tut0qtzA3/hGWCooydxKFOsnIYziUeoHvlICj3RkHO
+y7utcFhAgRWi+kzFwnnXGf13dMU9iG7yvKrCrCEw44gzoQ1KnY1Xsj18n5JkqxeT
+94bzcSbz20OpOSIMfSQPrpy18WrZYwHodcIZ3IUUACCpMZdfTa9c/qHRQ/rcwl+B
+0JlHx0V4AYiSAsiMVgflO1Eqi7apPuwxPPd5nnHkrdDM9CYC3LdBORBXwncG3oZ5
+eTSXmsvFxHXH41JHsm/1QFcVmFAYhu9qJFCGiD+8UeTFtT+nnHU69BszgtUskqX8
+k9PqLdK7Vxkp16wc6WOp1NeIQ6Fd4PxTGrPqs9bJk7TlYtTFWpA0X+EMj/San+Ku
+PxqLEa4Ab12R4vs1pCrn/g1z3C/6ujH4B70HOrRTIeTjULJ6xdwXGtwUA09hio0r
+pHhtyZhAh5irUJNto4ZOk/Qyd+dfMsNvRJfbVIK2mmeRaBnp902AsQNgYVdi2Aki
+0h4kz3bVLGw7iD/xV2hV69+JwLSijkkmOpz/EjMwj0hDDYrHH3Y3o0dV3dNdk/5i
+6lQgcxSVsl9kWlHcoEllKbf0Hb1muKVwoGGYxFYna2jsLFVjG29M7iPSgrHjmg/+
+I3fmsLZ0VI9kmxniUlZ6gz5NB5PJ3RXmwKO9LkBgE5C1wpuZbNEQ1NsR2bprlJPm
++GNSo8HaheuTRJn42kkOgfIJwjuvXih3FE/NtRA/W8H2uF6YLDjBKGZJbxQcmsd
+CTEuCRCVP8X7C5n3rl1YqzfWfNr8QFxvH7ivG7KOlSxvyTKcYatWb9uDUPrnr74f
+ZaMljHGsNyKj70MzZcrrsmt61yWGR0h+02rmIKlskl4hkh+qF5ehI+Bkd7eblsBy
+rxEREHq/ij2Vd7l0Z606YCE8vj8WfcsJj8JjwR3A+nND/oNJTTbQ3b8OvasvqIey
+WqqmGg73nbHjd/VIAUsfvnsEYatDk4pAA/wQr9c4T4s5Q/QRwDrAsa4J89FrDjWC
+hQBPL7TaP8Af/3Y3/86jLCN4lnW1qjPXv5rhBFeI0EVi1k1qdV06qr5HOk7CwQTT
+uc4rCdFcEnw8kVKZa/yFnlJfRa0Z4IwSahdp5fdFEuad6LpOcFFnYxWtIWhcg4GT
+RcMha/OZnsfqOqiAt6In+1IwuJBz3uMM7xw2AMaxzAejGEL63F81C5iJ6Ld6kQK+
+XblDW0G643bVbzkBb46MAT+UnLuWQUs3NDtk1FEioJyWUgbO/srMH4MoWM7rG8ZT
+nQPohNmPBrqL2phmE27HQsQ0rTjH2Z2ol7iy9OFMtT0=
+=MkGo
+-----END PGP PUBLIC KEY BLOCK-----
--- a/codesign2021.txt
+++ b/codesign2021.txt
@ -1,534 +0,0 @@
-----BEGIN PGP PUBLIC KEY BLOCK-----
-
-mQINBFwq9BQBEADHjPDCwsHVtxnMNilgu187W8a9rYTMLgLfQwioSbjsF7dUJu8m
-r1w2stcsatRs7HBk/j26RNJagY2Jt0QufOQLlTePpTl6UPU8EeiJ8c15DNf45TMk
-pa/3MdIVpDnBioyD1JNqsI4z+yCYZ7p/TRVCyh5vCcwmt5pdKjKMTcu7aD2PtTtI
-yhTIetJavy1HQmgOl4/t/nKL7Lll2xtZ56JFUt7epo0h69fiUvPewkhykzoEf4UG
-ZFHSLZKqdMNPs/Jr9n7zS+iOgEXJnKDkp8SoXpAcgJ5fncROMXpxgY2U+G5rB9n0
-/hvV1zG+EP6OLIGqekiDUga84LdmR/8Cyc7DimUmaoIZXrAo0Alpt0aZ8GimdKmh
-qirIguJOSrrsZTeZLilCWu37fRIjCQ3dSMNyhHJaOhRJQpQOEDG7jHxFak7627aF
-UnVwBAOK3NlFfbomapXQm64lYNoONGrpV0ctueD3VoPipxIyzNHHgcsXDZ6C00sv
-SbuuS9jlFEDonA6S8tApKgkEJuToBuopM4xqqwHNJ4e6QoXYjERIgIBTco3r/76D
-o22ZxSK1m2m2i+p0gnWTlFn6RH+r6gfLwZRj8iR4fa0yMn3DztyTO6H8AiaslONt
-LV2kvkhBar1/6dzlBvMdiRBejrVnw+Jg2bOmYTncFN00szPOXbEalps8wwARAQAB
-tE1JbnRlcm5ldCBTeXN0ZW1zIENvbnNvcnRpdW0sIEluYy4gKFNpZ25pbmcga2V5
-LCAyMDE5LTIwMjApIDxjb2Rlc2lnbkBpc2Mub3JnPokCVAQTAQgAPhYhBK4/rHln
-EexZ/AB6pHS7a5pMuz04BQJcKvQUAhsDBQkD7JcABQsJCAcCBhUKCQgLAgQWAgMB
-Ah4BAheAAAoJEHS7a5pMuz0476oP/1+UaSHfe4WVHV43QaQ/z1rw7vg2aHEwyWJA
-1D1tBr9+LvfohswwWBLIjcKRaoXZ4pLBFjuiYHBTsdaAQFeQQvQTXMmBx21ZyUZj
-tjim8f9T1JhmIrMx6tF14NbqFpjw82Mv0rc8y74pdRvkdnFigqLKUoN2tFQlKeG+
-5T24zNwrGrlR3S7gnM47nD1JqKwt4GnczLnMBW/0gbLscMUpAeNo/gY4g0GV/zkn
-Rt91bLpcEyDAv+ZhQZbkJ49dnNzl5cTK5+uQWnlAZAdPecdLkvBNRNgj/FKL41RF
-JGN6eqq3+jlPbyj9okeJoGQ64Ibv1ZHVTQIx5vT1+PuVX/Nm0GqSUZdLqR33daKI
-hjpgUdUK/D0AnN5ulVuE1NnZWjVDTXVEeU8DFvi4lxZVHnZixejxFIZ7vRMvyaHa
-xLwbevwEUuPLzWn3XhC5yQeqCe6zmzzaPhPlg6NTnM5wgzcKORqCXgxzmtnX+Pbd
-gXTwNKAJId/141vj1OtZQKJexG9QLufMjBg5rg/qdKooozremeM+FovIocbdFnmX
-pzP8it8r8FKi7FpXRE3fwxwba4Y9AS2/owtuixlJ2+7M2OXwZEtxyXTXw2v5GFOP
-vN64G/b71l9c3yKVlQ3BXD0jErv9XcieeFDR9PK0XGlsxykPcIXZYVy2KSWptkSf
-6f2op3tMuQINBFwq9BQBEAC59lflbMmvSVkCHFoakdjokwGviNU4I/hOsNmHALYr
-gJc0z88ss2KxbOq6JZoW9QOEHz2QLGsSGKnBUViEGvXoINDGuvzKFqHdEjGsExiF
-FPGAgCQA2CSEZZ8MlITNdq4DuSti1LetjCF9d7hw2xOQs9ucxSXIslyqPbCdlxki
-33tov40VE/J8jDUp9Rv27e0H2x4Nhu9MRQt4vTtpOcelYzl/dtPAmsnY4U/Nex4I
-LM+JU2HcG/5i0nWkxOtz9Qc7kOgm4cuwXTCJw9KukPS3CykV1H/StPp43JyxoK1X
-gZDMFww+9jupqLletmYKqCW6jVbqXr4Xlisq9Ey3LIWRQ0Zw/LB2NKU/jgnJGtLa
-7O8VRWJKwkCtyYUbZMksKiGex7zCqPDR0hRVuYNsTjONobnrOS+7ST7ThbCndc+A
-5mtuXpxuFffIuG78a3R3N30RF6g18peTfaEHMpqz+914HkNl6Ns445Zh+2rJkLUu
-8O++tgWEUrpUajN9nosWaXWHOf7E9qGnm1G/3f9P3Nd5U+b3OKUYyqb+CNGCHyiN
-bE1Cg3MnKpM9Yi9aZu4Qg/dPdxMWrqUmkmyDf6x/Oh8ZZkIacFlAaqbysQ6hRaJo
-p7UG9AJfXHynj/Hz+1dNpUOlAIairFe3T2mWQO4Yy6IMgLEGVodZRHaMugdzZwus
-HwARAQABiQI8BBgBCAAmFiEErj+seWcR7Fn8AHqkdLtrmky7PTgFAlwq9BQCGwwF
-CQPslwAACgkQdLtrmky7PTikHw/8CZ+DnggV4AuI86spuMLdtUBDOux/T0gvyxSW
-f8sJkjH0eAYAmP9/flJDfmwra5yNaINfqoLFWtaYLpxpBcWBc4VIoiWqVp2aaCPi
-wh0sznCPiduiYcKGkHmupX8aCQXBYFDeQ8Jq1e9zwGD7Mon7BeBO48Vd5/IT1H5I
-u5qzaCtD2ECO9MYdhuqJjFKU0MVzVocsBDdtLvrfnUwe4wc6kvOgHQ6RkMJU1bgY
-0Sqstsg12vnREAr4uihnZQEihsRmNdiiv0DYVaRK92PLPpfVAox1Axq2HpH3WT87
-RpsFruXLj/zTl4AZczfDVd/Z4yWmJSzr0F5igkGSUrxo0ye2kNES6cmOGI9TgmgP
-NLGXlC/su5fKXKjRgkD1ibJ0qFNNxF3Cwpz/+cav9ySDgFGX5Vu0kFi93fEYHshD
-6lP9M5qS/2oKiykCGvcRCNU/9emdYlF37H52rxRerBaZN6dYMTjZw2vsEMUl06pL
-llbLiwjPix2OlLFcwH3yKJG0pKkpEImBdJwHtJh5uHzfkSAbZjJAZ2Ekw7sLqiT0
-85hAGovywGpHMiYkqhNUO84fjZYCsrAlZMdriY92IMcQhmWQ416t5zcle2Xgx+/x
-zBnktvx9KIH/HwBa+qym5z/uFC2S6zhNyC61LV/CEDCmcUi2lUXr7vcIxCsmxuUF
-1ONbRP65Ag0EXFtUfAEQAN5tk4luE92Ed4E92VlgTetGMHyxwOlZ2OsK6l+Z5ML0
-wzomAITgMQwG0FeT6HX7vB+luVhg0XAZUW/K0bme8ZEO0dbHB3Vn07wXHhmq7QXH
-/ACftkvevIT610dHskrtIvE5rZfj1P/wtjRTxDrkjhlGj9vhUxxcCkKadzDdBJGo
-dP+Zh02d/4cc++LePNqZ3eJWm0JLghqKxzTv0MV1r6G1ZeykFzXeWY+La8ZCRaON
-LcHjI7wlpyTJA9WGmyAphtEHM4fQqKLxtebIDo7m4glgR12nlV6B53gUT96PcKuA
-Y/UPRiTV6nHyUtuL1EGTAVLsMDmtDbdSdtLLVbJXVmA+tapABa4amMxNVNY3QSUj
-cAbECcTyVmVJfIT5fJW4eOMhWtrIGMspWoO5It0pl4K8jhCzIcfoXQ0olCSeC9fE
-tljE7qzRzYQUUvN1VZPVX0Yw/xSwOutv4mxmNRWY9HW1M/jGoRAboqN8WhCbldak
-a0XCH3U4rWXB/8HHb8KP4+q4ssVyPuEQ/v1UNNRk9AB25NPEh5PMdcf7HU8IcUHX
-THEfd7zZVJ0l4FSsnGeuJfMrnRIpNOYX65ikeoTwmDU3ZjWfmSy7F5hTLw8WOEB4
-EKpnplyV1QN/j3317/M9PxvB8IOvyNF2okeurtHFMmI/lGwy51akp6iHMkbBDm5n
-ABEBAAGJBHIEGAEIACYWIQSuP6x5ZxHsWfwAeqR0u2uaTLs9OAUCXFtUfAIbAgUJ
-A70hAAJACRB0u2uaTLs9OMF0IAQZAQgAHRYhBJXO2iVrHKChXzAvtZUhp+1drOkY
-BQJcW1R8AAoJEJUhp+1drOkY94wQAKb2fED9Up/xHEOjZm5ODK5LCVHy0KMATiTf
-5SiJhRtqaRbimPH1WB3XMLls3FJZnm+UngIfwCsoWo0rksFUNmqFi6t4Cj/UB/Zv
-29EnDT9BAeG5fP+Op5PDCsu4qnLv3oam35oV9yZLRkLhBd/EkRGEA/q27WnpiYCx
-Jv5uPOJBWQqu32aE6st23PpY/QWDWOhGPfcWCecu1rIe+2BCs0UjfO0KOT8HYWNh
-nGpsEZ+TmDKjRxMTYWKguEb9evEihl6kUwmQZgROdhBes63Yq4ku9rBXvRhCYbwS
-odhjx2soDRcNmzxNV1Ply8a+2bwRHPnOeyyxEHFAwjkyXo7ZqGtenwSriG0LOW87
-y3Yw63O+oAlGLIB3psBSj4wZVGme9485HVICAFcJ3jXqsXSIJdzW61nGerB2r2Qk
-Bn7yYIvHg3iOToB0alfNw2QuDtCZTNefvlHFnoashRhkk0yWzBerleFJbijx4+Vr
-FaOH35BO1T3rgBmGkDW6gewoZMHEcmzTDoxxmbXiRvY+5o7b+ul/yzwhnJz3f5jk
-7+Adnr9qAGMD2o3rCRBHV3lSEkLhBL+bfmsEYEor1fd+pDFoEKKjpDP6bgDcZyGv
-O0mmr7Y/6ZrnKWxOrmNXieOTLbpY22tXv43QLgyiPcjhCfphT95IxqdNfMfOiI9k
-IQf8g7GBciIP/1mbdnMj6Hg0J9IbI/XX/DWATOVMdDhq38VcggOHRjZk2lY99+4V
-Au1wRHa/Io/CENikYzI00deSzhrN+tdUK/TCZI0Ft5Lykmti2ilmkIQGsBuD9gu/
-2bmWkNJEdpHeC/+oxntDFj43CpyKpPAarrw+4XiYNK+1+4WZsQRL0jJuKJ754v/o
-NTaSd8GOCyFR7q8SVH4tig9DjkZjYjFFMnWkxdpnDX56/AfdS+x5EaRHKCJoGChT
-+pHimvKe+MxBxpwJr4JpGddklin+6xUF5jTG6322hz385wsagGvmH2XliOu47a+7
-xUei7w3S1qtVCfdhtBEWL5i021yVYlrw+rUCwpFMIXAPA/p44O/qY06sQXJ01Fym
-JCbOnjtVYX9gdF8fMKoDXAcvEtSulBNpXDongWp50BDfVoA7h9oDsxL5kw0GpkJn
-uVMYLpO+iOqoEA3bJfsCedilkcz6UamLb+6RXMupKQaZ006Bu75Rm+h6PdicdiKD
-jJY/7PbGuUmXxuSFT92v0hATlpEIQ8H8laEcnb8apiX2qOyGUHnb7pfYoNqvCm06
-3NP2igCtiGkzAohiHfhztfy2UApiTtXmPu3EhEUMooB+0Lt0zzY+e1cnFKRbJHvQ
-ZidiOJfKuqp6upPvEgKYMRCAU4+nLT3MVbralo726JnDqrDJvCqAamhfuQINBFxb
-VNsBEADcRGjaY+/ZVWBlQWvgy08ObhQbTRglb8thrcPeTR7211JJwAJemuTWwCjF
-SVDH8JJ0Ss8rBcbitrGI3i3mcgJRQ1hILR2HT0bbmMLufCxZzQBjJm76H8XN++k6
-bd8HCYGXMguUaHRRHAcV+P18e3qGizgL7c8Vln9fbhowkX9yi/WhiL2uoXC3+XSa
-C08TzwjKPb9Wnct6uCBAzMp8S7KW6P18vZyBTRBrugA9eZrGEe25rhy9szlJcajc
-VeMiDMf058z7ait5t43AfUzd5zrD6c+ZGYIku88oY55LsZVcvn9o7I+UNbNJdiek
-IpLae3Dgrie3QgDyfzPV1vXT2X8LaegOsNIkSo6jzjdKE0ZNg4xVSuPdr5jujYBN
-z2k1lqV/Q/Ccpqzs0NsgnXnY8RDDrrmJhdy/ZrCMsXpbTK5KryR+JoDEiuyJ7YO2
-jTOCo6zQ631jvi7XUeHAFIdQ7eYRklJwABwj/IMXY++O8JBLO7iZ1dvvu3pfY7pg
-dQvPgDttVAIxrNxMMj39LRbb6LE+eclWcTfGCMr3O6LOOLwkMnDWEkJAz7JMtWqr
-2l+9xF9Dq7CkxHPP87dLTMNGIDr38bJ83CSmDPlBoaljTYgrlatBTV2hGMjPgEcB
-jOgg6QyRGpO2N0SVBnD8PfBI7a7CwQw3BHOJtH8vPUkXZoafoQARAQABiQRyBBgB
-CAAmFiEErj+seWcR7Fn8AHqkdLtrmky7PTgFAlxbVNsCGwIFCQO9IQACQAkQdLtr
-mky7PTjBdCAEGQEIAB0WIQTXDITmS1WOW8zsByEy4hdfHXV6KgUCXFtU2wAKCRAy
-4hdfHXV6KoJ9D/9IUN+s4gSiyWnqfq+UK5q86DTbC+OyQpAY/U/VDi/jQXDUaXzu
-f25cCgyl4Xgf6nNTE6IEdgJCL4R6bChxJOHNpZ8/N3ckb/Q5xHKZ/5k5wFv7nxUk
-vunzxB0wUgCLkn4oy4B8QbTMuRz1qcSdehUyZAlfkr7o/J5UO8FtgaMuNACxZNlO
-JW5AjTDdbEW0MZapAgjx7+oTQMDtz9q4afuPaGJ3fTz4Vx1+mYt59b1h6xaMTXJi
-8egJF0U4n/tJ+3gxAIhF7tQRPdNEwG+2Kw/YNyrLMY+nbazhlgUIIkk2IH3Ztd0S
-XnNd7gV/slN80T9CtHtaDlH2FkeAd1unynxsDd/TLb1gLHem5iDsFuZBaIyHetdY
-TlvT3SlKnDQr0FBTe86Kuv7n/ZNoU4lceXhUXTcataxKdxKEJt2x1Ei/hMHSVjaY
-3ir57tuOUDMkl6hpL3sYiq7cMGUAnLH9nBZbbcNdfChDiM24mGmXaNoITutVAHS4
-uNunSL1l13hJ1hnGY79j4l+CgnPx7LHzBmLh4PPWKM3RYqwgaPEkflVQr1JOOKMM
-x4bpllEtzpvVAIaF73tlsOQRRN1Aah67gvkWKqiZrXc0Sx/yh8EO/6bImb87rtVr
-0kjeDGEiuGYXsszNBCmVjHal5kLUKaESefzd223zeaFe9foO2HrnsFb9B34ZD/9J
-W5M+42QFd+tOLh1ue/5xToiyggGh1MX9axDqHiRu2w+E7kNuuws2426aupUQ3yPD
-4dSwR428U14ytM90bZXztKFDgFAaQJ/4YVEGPSbLHFc4VlhDHpGljl8J7vI5xPOm
-Ruc9aabtXwd065nQ2csk1DliiA4jpS9dUq/flH2oGj4b2OSGFvR5oC7oERHMpUA0
-p+wY3vnjkSVnWqV98yEBCFcZvpOy8J5KDZxYZvZydUvZ3ny5W6QPg8OKriqrCAKW
-QXds47vRIiAasK14duLgex6il7HmboaqqOhRhevtBAHBJpB1z6Aq0SMwcKwdtTId
-GTSoQd0R77ZGYvR3StpAwl8rJhCNwJHu2euA3hYPWHg0pF0L8pFbfUwOYf1dU+uQ
-4xAJQKcCteQ7B0pawp+Hxp/0erB5c5PUUck38ze1ZoGm/oqh24XZ/amPVWE9nYSo
-VTJwnbqWsfI6mzKdBHr5MP5zW5ei0PAo3lFb5gvVzJ2TqaGJvrh907I9R5Nwd6GM
-wAWAzZ/nCLflSNyPyJ3ftxY6pGyCBJsycY7gBQD9i1xU0bxONltqSyifwQ0rt7yr
-iwSI0VRnv8K3M2iTAdDm44bX6oHzljgiYachlV6IGmO3vdVVrCDhm+b+ia1bnQ/1
-H7itWEwllkUCCtaDwEcf8o3OdbS9S5KEbwH7YUD967kCDQRcW1UMARAAvl+0jUaB
-UkQWBflWy4Wd8Gcf3lzOqbARdpM/iztebc7RbLnv0TNFQPV4TD9RoP+rY4dJzC8w
-/rlxlhD3DiGcI3of3o/3pN6jss4wKyy9Jcg7uCo/fcspOoPOwigAUfBYTd2rWNvI
-/pPUl7zmavQR2+TyQ4IHWG52zAABGej/tf3Ma6WGHC4QeTkh7LtHn3JFRCoFy101
-x60bJqIWONfR6+5UAOL/P+zTteEMsO3v7dWCWHX/tcYLrhCEH1CNnyPS7v7TF+Ys
-uOGL7sSmQOUAcgldfUfTACw84YqViu5BSYiww18Eg1l66UcQFnhwB3fTGwzb3oPM
-npAv2wAZ9gyFGzRgcH8QnXRm/SLDWlTaMIJS//0p/gXifCAdBZA/skBt+E4hQ5Sr
-9iXGNMueR3bn7u8Pcoc1DpSJENE5H0nB62l3/OiSl/k7mJMGlUv6wKr42xNnIM6M
-hO97axjRXy/XQz5n6ktyn9xRngkQNL9Ynj+i8E0k/xv5jA39EGAKOXxQFf8357sA
-DnZ5g/Yf0Yr1c+TNIIRXER/k/KMavB52mguTNqCsewO5aje4Gq4vKd5P+jOKGopA
-C4idTLkHutZTiakod7lW2jmjpm6P7oyAeAhDNEroNrbOIw0SaujHBmJtxgK1Q929
-y/EaH5vJyWfMFyUqM7CQBqUU/HRLERsebM8AEQEAAYkEcgQYAQgAJhYhBK4/rHln
-EexZ/AB6pHS7a5pMuz04BQJcW1UMAhsCBQkDvSEAAkAJEHS7a5pMuz04wXQgBBkB
-CAAdFiEErtYi/gIHfrS1wUbBQqJ50kjNwxAFAlxbVQwACgkQQqJ50kjNwxAf5xAA
-hBhcOeqLgeXbUu0CCTKlnG6D7H8sQJWXCSsh9pAXffv58b4f0ntJ1TztKfVd79hS
-BCcXRc/9+MhUUzR79NvFWWZMWqJ6MucjAkkOBRoc7c85PawYTI7e1zSapLPJEHG0
-xDzK8ClxwGEvlA4O/eGGVFaCTkxdTQg95fDXfghab6j89GI8Ghc9rC9V8RUgGVQV
-qJJkBJ/gECJJp3holB4/w/I/sU+9AHXGKJvSJJ62fpmY143Y5JQk+I8DxoT0kIq4
-W2iZVAQMzQGpAOXkDuHk7a7J/QuL78CuoG98GOsfTd7nNsgPTZ07cPYGOxXeNR5U
-9DlYOBWDwsf6d+D+tHLB8KzH3MWnWa3crjE3a/sgrDEad0CmAJzHXuCyPMy8vPQn
-uxIai/gw2POq8YQMoKW5S80perLuN73FxAumjK9a2hYVdZNtABwrlW/6ELruv1se
-mMjUq6oDyFio0rGy/uzCItl13hIr1Ii7B/SPz9dNnCagV8aiUmKXRk3HKoEXf34I
-xWlod0szWopnP31NXNKHihs46ORSMrjnzFKjRcJsnipdins+DHJYroYhtOjNtsb/
-WV3D4tSerG3xKF/v3ssn2VsjcgK5HY/k9iUol/dvoP0bJ+rKs/fzt8oAqEexiRnV
-cPnj/zAiBOt1940+0vTWaNYOPDkq872S48GNybOC342u2xAAnAp5myKostxjyQn3
-E/7/G1OWHaJW5kx/HCqHCWjgwwLOmhssNn8kpTf3ybvt5uhMolIF95RjFB3gBOfU
-vw0sqMvEoBoGSMSTSc3zD05RBsWWFD9qwvPMXtn0gYaH39ISAFnxXrtrQ7dDD1d2
-LcBErdttnxEhUnT4/0YIat+r2PhmYYDYviKsuOy8MC/sJIxvhYEpbyPQnPksUzA4
-wmAbVNPlzqU2oWPrLT2tlxUue3z6VS/YHDcsLSgjVOMWSusLMh1+D76Y+Lcr9kVz
-nRu+dYXh4I6OBnlT1VuzEVmrf69NFwh8j3PaVn0I0NEDU7mMa+5W0QYuJIsXZonq
-SI2uIu64ZOVd+D8WmCEZO/Kmk5PMXs+0fMcFD9mOeFaiOdz+PIlHAsrxwKXr4Q5z
-zzu/wEOaqAVa2bJywTbl8MntQUY/XeD94MvdlSAwO3Ll1BpQ5NfXjm3YpP6Uyqlj
-pkrYQL56iqucgYn61jLSXhFHGLXSZs2G48ggN2mHtf6ZQeAJ4D2DIXRj4uqIHoJf
-7MWDui8u+cJsw/F0ZerPsCN/CpkEoj4FW4F4O3JbiieYSUK7lxc0qyDdbQiVCVl/
-08wNToe3RctSzsQ99tCwfVWqLVcTVb+0aeSaNykb+qW30bHW7AUYs/qKiapQFzZz
-QZnpHXGmVe93fDfILx3yUCA8Yia5Ag0EXFtVOgEQAOS7GFDH2DGXPMJzSdS7a/zZ
-ewP4bM42n2Ku3XiCyXG173p4ppNdOLS3l7JrRflMhjfBtETCOV8B4z0B9wCZZywz
-iLOt8+0A0zpY7EHZNvMRjZyq/s0FCKLtnlqo/KNwiJPRvQazZ6+UOSffEQEGpNKs
-1ycZIDb1tk8iRpRvtCin8CeLRLf+2BxHbWBewnCSCl80rC89PTcvPf+jmtcDJqDQ
-z/blp2CT1JUo1xdzyHYdIa/kQ2PBQo02ejBVs0vDjbzuYVQzZV3q6cYnYwGPtpTB
-Ot8GXuA1X3qYx0MlZwGEYpiTFS+Ju4cJrYofuBOudXpfux2uAPkJskw+ro5k1I/q
-fptRWDbZ4fGgROmUXBPg29XdyVExYgAbVeBdHWX30sCHs8+c8wzWkdAY/BgdCySg
-EVLiDmSfMekH2H1N9ncwzhwNlHk2BaYTR9hWdZ7lrH7BbT8g6SVSge/eqgvjKI33
-AUmragvNQ1B3362yqLK/FJOHyJiYd6DKfkq4E+ysw+C+qIo51qVNkqRqT0M7HhwZ
-AvaoeykrGIE5vq6jHa9+MxDlsN5Sf7gNgx2dk0d7LAJR6AmYNqRS2V+837XfogMc
-bB90ZyK2rOzDN3f48jaqXA8TX2CSun01RoPdCPZm0M/uxTZxOFzoatrkpEVbx/3x
-sjvuPVa7qkKdgUuo/PhBABEBAAGJBHIEGAEIACYWIQSuP6x5ZxHsWfwAeqR0u2ua
-TLs9OAUCXFtVOgIbAgUJA70hAAJACRB0u2uaTLs9OMF0IAQZAQgAHRYhBHkdfriO
-vI0BOENKrDPfNZrnpgp5BQJcW1U6AAoJEDPfNZrnpgp5JY4QAMry7TcsRIZJCVlC
-qecIAjyJizWz5dEwScba0BDU4rv/h42CvXJlySZpbgUEyB4SBggEnu/dKVbsd/t0
-TXRNg80Zs/pTFVbwcg+sDgIg1wZldZbClLfvgk0xLoDl5vq+K4SAQwSLTSPHQyYu
-8IxkrKmbBdBSXlgnmcHK2lDXrzWYJDEYEyFPV4pC3cHicCygSc/4eepUz+crEF6Z
-IE1df4LRv9h5CgsLewMv5nQ1EjxTo9mX1GiSh3e7KcfS98FgIQl3oy+yO2cmVVVq
-x5ggDcRI2sUbXa3D3kjAo2tUIA1nUMFLIrii+aZawOsf64VMdIs2OXEi5XFR+Zdw
-t+Bx6lUKZ3/tntStZitJdK8/RUbhmYQ8Tu01vxt/IAN+07VxWyZwcFB5KuC+lKtO
-/0vwyhyiOlHm8lzV/5qwFPusB4bNk/2uLPUaavJdrBpmB0t9pol/NFCRzW5MKFvu
-Qw35QyFVR0IBeaGjRc5J9yxbzi78umN1iHZbDjXFA7oRa9tkM2AP8V2anxSHUyon
-UN6OuLqSM2frA8iZcl0S7qcepYNF1ix9PhdQHXy0H7hoikXMLIiCl/unW5pVTs6q
-KnmxmRz9ZcqvvuVXbeY9C+kZE0LOBTZMljuS1Hcs69RU3rA18swfN5CTXw12ZwQZ
-SsnRhi2X28Tn8SD0vrEsEf08q3XshDwP/0MvBBfymXd+5MzxlvMg8vGJeFuDMEFN
-cpETa7Xzzz5Eir3ETtxpUWPCriqmCpnlIWidNwbg+LlyTeYUDPIDnMtEX5ySmYGn
-BI8ykvAKm/XTfr0PWOEAXcmxTC3oMhvYEhIyGHZOFJQxIo7vmrwZKi2wqMnKMPq+
-XXHgvtZe5tNbESI27APeQCMVZLVnVVa0D1JRFYBuwNoJXhWbAIKlIjBGv05NvK71
-e4x0zEY2mXxLBbsxVBvHhpg29HseX/AhHvUAcBehJ+sqnenXZqdeNhgBIeZubXq6
-A/gfscswF/Ocp63Z/vqAjEmvUKwAxNKrKlwLVShVvobPx2N4hH4ZT7p58cjhMhQz
-Lm4whTHy1hvBIR6j/Lo2eOkkVhiMlrrvWJIAEic3Gzj5f7XOsVr7CXjkSdoXHOIR
-63ZDO/9Wy6ygu8vCdiIFlyRyUBLnGhUYVbRYnTU58tQMfEYy30ZKF4vxz4Ysxoy1
-oJa6emaa33Nn1Z2kE64AaW4wbUJ57nROuFdoYTwJ02vyc51J4s0C94EA+a5VrQkN
-J7bT8P9G5gksp4b1WyoFm+O4aU5Sx+XpSO2IZFuBL05anF57Pm6Bz3LJX6sEYima
-chv72q7PYeYbETrl4DZxE2xlEiMUvN4DH/RExpPWeUsVMFtS5n60n5+AW1EYyGJ9
-mfWlvZ0xCjQ3uQINBFxbVW4BEAC/gtho2rZl6/+/szkOfEumAdFwyQbtM5CnJyuU
-rnrneWWlnNPLeaHml5a9yrcgOZ15QgnFD5YOHZ/S9L40goML8cB118etk9uE7vMv
-EtwxbkqZXTlqdxpFI/SzT4jJCa9XFQ2uA+KdmKmGW9EagtdLql2B9ziMhH0Ha6Y9
-5x+9+7/oRYU+ddmAbwrJjdn6bCuYQ7QVpccFC67qdpy2I97v03hst7yGT1FbrIjE
-sF4nMig6Uhwma5Edqm2dLaVXeZ+Fl0WeQCnWjprZMvkHCAxjTBlQpmvvwcQwqHot
-s832s96l/Sd5R6r+TWU0lTtXpcxL6t7MXfW+BInkqg0ZiHG1Znni6SwfatzDv6W2
-lJW2pj3Ub++JulEIkbct1f+TEeeLU0RbJmWlL/qe24fodKg1ixH0gyxsRKzdBUIf
-vgCkrzwLFgJEHRISjQzIASVtDdt8QoIqX8XALgjMBgAnZqtYrAEdFImWys0K1zOu
-MbuPcTImufz5ObnKM7rRMdCO9z+cHGs0TT2vUvPPuOsNYL1GX4EfrCp2eLKahjJQ
-BCxfatn4mFqHVmR/4a7vqq1j4Qfj3h08z7QVrNwGWAF3r8nmaHdaT0m55xctMRQa
-3N3UaYj0IQ08CSUJq5e005Z5Oinbt2O4paxnG4/UbJXpRiLEVU5Ja17IBsDfZydx
-W//ZlQARAQABiQRyBBgBCAAmFiEErj+seWcR7Fn8AHqkdLtrmky7PTgFAlxbVW4C
-GwIFCQO9IQACQAkQdLtrmky7PTjBdCAEGQEIAB0WIQQVaJBoXqDfahNx7yAXzF2x
-8AiEBwUCXFtVbgAKCRAXzF2x8AiEB3iPEACI735VFBDd4E6wlGAA12Av+XnWSruo
-Te7zGdKo2SuZ1gN1PYdNgflbifYCYajnQENp92N3q263Sq3MDf+EZYKijJ3EoU6y
-chjOJR6ge+UgKPdGQc7Lu61wWECBFaL6TMXCedcZ/Xd0xT2IbvK8qsKsITDjiDOh
-DUqdjVeyPXyfkmSrF5P3hvNxJvPbQ6k5Igx9JA+unLXxatljAeh1whnchRQAIKkx
-l19Nr1z+odFD+tzCX4HQmUfHRXgBiJICyIxWB+U7USqLtqk+7DE893meceSt0Mz0
-JgLct0E5EFfCdwbehnl5NJeay8XEdcfjUkeyb/VAVxWYUBiG72okUIaIP7xR5MW1
-P6ecdTr0GzOC1SySpfyT0+ot0rtXGSnXrBzpY6nU14hDoV3g/FMas+qz1smTtOVi
-1MVakDRf4QyP9Jqf4q4/GosRrgBvXZHi+zWkKuf+DXPcL/q6MfgHvQc6tFMh5ONQ
-snrF3Bca3BQDT2GKjSukeG3JmECHmKtQk22jhk6T9DJ3518yw29El9tUgraaZ5Fo
-Gen3TYCxA2BhV2LYCSLSHiTPdtUsbDuIP/FXaFXr34nAtKKOSSY6nP8SMzCPSEMN
-iscfdjejR1Xd012T/mLqVCBzFJWyX2RaUdygSWUpt/QdvWa4pXCgYZjEVidraOws
-VWMbb0zuI9KCseOaD/4jd+awtnRUj2SbGeJSVnqDPk0Hk8ndFebAo70uQGATkLXC
-m5ls0RDU2xHZumuUk+b74Y1KjwdqF65NEmfjaSQ6B8gnCO69eKHcUT821ED9bwfa
-4XpgsOMEoZklvFByax0JMS4JEJU/xfsLmfeuXVirN9Z82vxAXG8fuK8bso6VLG/J
-Mpxhq1Zv24NQ+uevvh9loyWMcaw3IqPvQzNlyuuya3rXJYZHSH7TauYgqWySXiGS
-H6oXl6Ej4GR3t5uWwHKvEREQer+KPZV3uXRnrTpgITy+PxZ9ywmPwmPBHcD6c0P+
-g0lNNtDdvw69qy+oh7JaqqYaDvedseN39UgBSx++ewRhq0OTikAD/BCv1zhPizlD
-9BHAOsCxrgnz0WsONYKFAE8vtNo/wB//djf/zqMsI3iWdbWqM9e/muEEV4jQRWLW
-TWp1XTqqvkc6TsLBBNO5zisJ0VwSfDyRUplr/IWeUl9FrRngjBJqF2nl90US5p3o
-uk5wUWdjFa0haFyDgZNFwyFr85mex+o6qIC3oif7UjC4kHPe4wzvHDYAxrHMB6MY
-QvrcXzULmInot3qRAr5duUNbQbrjdtVvOQFvjowBP5Scu5ZBSzc0O2TUUSKgnJZS
-Bs7+yswfgyhYzusbxlOdA+iE2Y8GuovamGYTbsdCxDStOMfZnaiXuLL04Uy1PQ==
-=fX+D
-----END PGP PUBLIC KEY BLOCK-----
-----BEGIN PGP PUBLIC KEY BLOCK-----
-
-mQINBF/u5KMBEAC0hPiTonjYEe5FqNzFn73KmcN8KGD2wzujmWWLnFXGEVDEpFcS
-ULQDshhCclwNeXUArUey4nficwpqUe+Xl2h4dP4z7yh3WiL5nA5JRjJjw8KJQGVW
-AkgiZTnJHH8DrzNt9LnDL516qMDJarTHemDUUUZLNxnuv0RDEhDxsXWiVCQZZcw/
-41yIY97uCf30dsDwnckVl3iEmYaGTYavWbKP60S8WaxO0YG57RI1etmlIQ0nMmka
-4bvFnwwb9Jdnwle4LIiRMCGymsheaKCKrEZgIJY+idyBuExLLykiL8iNBj2Pzi7z
-XSCniH9qcEwfqgZlP/KZwujLhGOc4c4peNwpuDGcmYZoAsUD8CZ8H/LU1FIR2A1u
-/UrRREtC8nNTDGxCckSMEquHNURfMk1QmDbJ9gaa9aOk0AArxuTxyj6Cn+KQd5l5
-0mN0R1sDVQq9xWdvnB7N0d3MDhnV7f19iUhi3KYvjVTkCMXjhNXjDH/KXFKoFhKa
-9SkxYGfW25inwSQoqbP1TE5+rESf57bo+XFxfVQuYfVJ5BlZobz+sRl2iDQyBJDM
-uDFyXE/t+E76BmwyHeOI1weqUMYebqHgu0x76dTYj9yWgWdQAC1pXi15/MTIaOtQ
-hWezb5rkI2yZqaZLaRBOIRBIPM5C5AOjL2XbfwUuSr2W4+TvxLocxi48DwARAQAB
-tE1JbnRlcm5ldCBTeXN0ZW1zIENvbnNvcnRpdW0sIEluYy4gKFNpZ25pbmcga2V5
-LCAyMDIxLTIwMjIpIDxjb2Rlc2lnbkBpc2Mub3JnPokCVAQTAQgAPhYhBH4ckayA
-MKWlnR76uXUPPIdyPkASBQJf7uSjAhsPBQkD60WABQsJCAcCBhUKCQgLAgQWAgMB
-Ah4BAheAAAoJEHUPPIdyPkAS0lMP/2IgMErScBUaXrZXqYXoluR8xU0p9DyZEBx+
-ZGNAcJ2CTPAbn3FrkNGNpK4SOCLXEZPKOQ09umaIxl8H6uEGaTut1JLj1qGaZ8ID
-4gAeQcTIN9OQA5ElQo+ci20XE9JSvzqY1zb04EkMuVL678xPCYJhUSLS0MAQkcDJ
-JQLN17SwNi4vGqzVhnwKUviQU9/s+LRUkThsTg4qT0fNnmGoVJXqrshxJa2ZWM6J
-QtOWBgJiC6xZ+zRiZS898L0tekU4o9yxtnnDWry2bI+mJbxAp94ZAXgKahOU7LKV
-3SPxkx7TAng24nOWi1EaP51pe7usTFH1BR3CUHZdoIQ4xruZGkt/qPumskofzl+1
-8bw1bEFbq8S6jC+twT3JUcE02HbEIbrd6l2T8pYBXaojFggGjUTSv9d5YUN5N9U/
-/Qy0o3xZwHNdXLx6xSrUO+NT5JU1Nh/0sutEH7ru/YqFZof9vfCbV86y8fIOPgk8
-LkJNUSu4QCJ1PHKB+fJp7yAhlPkOXNG1b9+W/hVp96rdkovpCUkLD83s+suQyJGk
-QB7Qpem7nS4zp7/Naui+g3M3p/uRSzZgELTnXNyY//bw9fOqx5SDLjSUslUMz+TH
-sFTwfo/Mot70MPHMe6aE6tdTDoJTcv4Iim/8MDhJ6yqKt8sxprataZoWwFi6zAF9
-BzWkJcrbuQINBF/u5P4BEACso8iLzFJ+M1wqcsCDup+GtRMzte04CAlLmaLgyzfL
-3xxBo4AUgX6UbUCGycG878JVn52S6Nsl6FlasmyH00MGjZt1CuNz4htfSmLGcBMj
-IwQv1CYR8bm9EPwR15NaWdgzJHShCduMHv4HdfqSa6UQfzO/P8mwioER19fkDQSE
-U1KsY0yl//ipWiW3ZJGShGHLnn4YbxogQtsRPESKUsQ9MtzuMt3ehGtkN4RguOXC
-6pCWP8J4F9lgjSZ+uLOQKV4rmpbSMXntOJi2nu+14Zj36enW8xyAXO/w5z/wci2G
-LN/aa/v2a3GM3WJQsPNzpDwB+pr1n0Kp+wK6K7siVmDoV+WecD2KNNgOuSyUve7h
-BjWRM9W13LsgLGhKJA8yUpPvhXk91vLRUhwFJ2GUirxLPLs2TSTjHlHvhcPy6aX2
-HxbHkcOt53n2h0zx7ntl1N7XHozMWmHphPsSvOZ5StuQRAFvfE63EyfR84KUPIbZ
-kvftbAJPKCJC8W6GqhfORzYZqldDNNva5iYHF1OItF79ZLGI56diNsBV9SOVKk4d
-f9Qp6urYOd+9RGQGmCQte/WSFaU9z9QYPEGl1NlmGAWt7KKyB6QXZH1oEMwXtPd8
-4GQX3XGtyggEp6BGwkFFWRQzF1EZ0maRPrpN4bpQqLXSJiqQxsX+FAcOkhpo6X7b
-8QARAQABiQRyBBgBCAAmFiEEfhyRrIAwpaWdHvq5dQ88h3I+QBIFAl/u5P4CGwIF
-CQPrRYACQAkQdQ88h3I+QBLBdCAEGQEIAB0WIQTpq255IzwEFuiZP0UMA6+pClln
-xAUCX+7k/gAKCRAMA6+pCllnxDtmD/0YCUccmKudW9PiQw7mI1HSuwL6aS+MlG6/
-LJ79nmi6TTpe87NDcEv2bBpVWYcQK87smCxIYyuj4SCZuBQivjyuecipRoG14PUh
-KU8UiqdF+vKDvUAA7huOBlR4dgr7/KvjirnbwO3mGouwZszDOLvaHuO403+TPm1b
-mJtEA9y6Wbk/+PTtfPymQwnaiJkPhQ6Q7ZbyasRIisO3MRPacUjt2DXFi5VV/Mya
-8o5Pae3zY+5SjMyE2siPnVE4/nzp424jDzSq4DGEUip/x+QYHFwxhCJmdZlRIFmn
-vSCAGXBpyPVbckC0Gw8kZ8HsGzNbMbx/VjDG3LFT8TR2Djsh99/6icO1J+jDkPNn
-IFEsYjAw7Tos5IPhIT1XkSCW84KqBG5pGI5h7fJzf19sR7Ki6XyFe6VYvggeQIS7
-VN1ISl3tRN/dk0GbrKkUKr0OVfaRD0wXQHTzbec8Fs43G0z/DKoFutGB/J3yjAmw
-IOcP5R6rqjhVp4APQpsB51XCaaqEXaXZyMWrKILbPIjlE6FHeh1qd+zdIjullnF2
-YZv89HU9dIXxKr35CM8f3BWm4D4cRjsUOWoGhMNwdHzHYOdys6T72KBK9D2irz8C
-L0bycjN+SIpde/auo+dQKqKD3/ipr4dyKJyOUsls9cyhxkFp031cZ5rWbXcLJ8/s
-1BeVPjFCngqPD/9rMKA6kCSnTo+rSqZRxo9RlQwy4K6xfPPdHZvBi3A4UYCsurgl
-qLtFtGG8SMWigmUZWLT6uhsi0orR5wfG7vzajF0Hcd8yuWa4zGeu0rFJXgG64Pyj
-nJHtv2Tzi8DNY5Y+8mfXqUewyEUXQLxnLqpGlPjNUAJKvjm4SstNadewgWeb6F8x
-UQJc8owGmK5+yZQ5LZj6bjt9Dr3SCM3Og/iS5XK5POGUJgtgXLXp3uy7p9SzsJ73
-qhrDII/YqSwToMu8tUv4xEGxyceVPDm+ywde5SXYmtvMYrq5DBdlalZ9kBlC5fyc
-IIzKoIOOkKKpa/YAyKdLTk8ZByjDk1RrdcOyP4VNpCvyisf6JPwWfKdM5mxf47hb
-s7zioUH7miUGA6i5TNi1e+DU2mL92sJwQ0WkHw6KaUez2Y9CaD8hZnQw/h/JcNq6
-nb8y0GR8h7qWms3K0rtSs8SuDXUsdZrFAeURivccmohXddtt0FDzkheKGXs27SSl
-8oOCh+jl/hEUzz2mJGFwRBo0FI5ipN51IfjhMJ8zzSmvfrtdwT2Tu6wSY9DLsYR7
-0tWGOc2HA6o7kdcC1V0p2jvQct281FrC9dTXFgcDuGUBYhzEZeWwjuYQXBzMquF6
-ersVnPo/Z5l1SnkK+wVBQbf4igHOaobl0AQxnb86W4CXBTZ3CvRq6o8vWbkCDQRf
-7uUlARAA7oTlVZXhdVlPnSQlnI5JwovG2jEIrRifpbyavlhlosX+rgtQ5EILn0DS
-PJ35CNfOAeOcLQeRrJAZj6w/x9FHWfKRAHUeiTTsVDzTrDyJBCVuC40ck587KVUc
-GuB3vee03/y8qAczj5TZNaDdl+4qAzOFQuV4MjwJOx5fsXZw3dUAS7pw1mTkAYTh
-nz557buc8JJCxrebT6FvN8bugk7LJ8SYmI154Q5wCdXB6Q42sdSMFlKKPYRRmIvX
-vI4Ytl/J35v43gCLbXccTWQpBX+ra75sndS2hYGQhcC+WdNtt4THgU6Sb7ErpJK7
-7A1r1Wf0WSioQ2VWjT0QbUE+6IXD1J8duh6ZgzuqppMm13aDdMDZGwdcxlFw+vlo
-bM+IAX+QgzPjslM3FHVvvfCLka+ctMO+lL0bz1G4njNEXcIAILhmoqRI4ItVH7Nl
-ZI3pAfLLB4qbhTKTIiS+uIoA82RU86ozr5oJZCsJa5N5EpJnYxnjv2tYhU42eh+j
-hyM+5ra1dXtveKvL5SkVuRUlPZvgOuwQ14Qnj6sv8CmtBpyVpupHmY2RbNtLVLdH
-Ix3lyQbgVo9iMJIoXiPXmcRWCgLgOeuETjFXsEcFLxuN+D0My0dtwWcg+271vtPn
-0orTObxkctFK+V32ByJYxVvytNCW245bICpxCicxmh5kYEmQCnMAEQEAAYkEcgQY
-AQgAJhYhBH4ckayAMKWlnR76uXUPPIdyPkASBQJf7uUlAhsCBQkD60WAAkAJEHUP
-PIdyPkASwXQgBBkBCAAdFiEEqtu6UHTxQC97adVrxbTukxqfnf0FAl/u5SUACgkQ
-xbTukxqfnf2aeg//ZspIr4ETVf3ai0dXCm2Pf6gpM7QUfI9fPUHymvBhNrNhfZqN
-ADpzbJefzLif8as7kUr904zTc5Jse5a0MzCrMyEwTDIoCKDv2ktLq1L20bwflZs+
-oP27CYC5FkJYgLYPrQZ/7hRC8EWjgn6v3seJtEo8G73kiVEBOnxVEfGZ8zxmX1Cp
-aOWfhiFYCmkEe6Ck9hG+OaWt7+WW0wWT1UFiluzRRAEMROcCUtyB5IPCqCH/Rz/m
-/bE6G+lHZo6OY/wY2q/oW2f9JB/4QyJeSI+fkjY/wDjfNQjiPMLfZctv25IeZYVY
-ZvIKrdnjbzRe+GwYLg5G/SbpSOEb5O55Ps8mNUpYFaMCfefW+DG48a4WyUGzFr52
-BMKvHKtc6c7P3+muBAqcNZYxRqyLIQiYiV9CCjpIV1WgUeedroHUXvJF/SAvNVvB
-ZR00I/D2hsD9BFh3B1FEYbw7GuYuG27Z6fgRolOQUeTabjQLI386SV3IxZ1KFwm4
-GU8BTbUA2zwT3hu/BaaCI5jTSLyBpdo10b1wgMEnqmXG6AbNdxFVEWwE+CE++BHW
-0YBhKp8fghHwwN1fwTCV+QyA4Qn6EBVDkTrUPKqTeCmHzt3AQh8WVrsmrodyr5Yp
-69LoRnlkLcGJiOCKMOmkop9Z32ckGieYHrl24Dw6hmUSWDG+pBn0ezbSPit3FhAA
-qD2y1VzqxsaCOD634Ltq8AbvphP8XZPrrsC3DIA36ITaCQDa5Cn7madLCXy/uP6N
-+tojtzXf4tUzumwGJGFLtdMXNmuEuXrj++NrU1xcscbvDn5O4NDMadwI1EDlQo7w
-uWK9jaQAVhF7iDEBEazZe26knQFxC0my4SyO1uQaEg3BKHj6z7dkAjzWJaQZhzql
-yrRzbCiVUUI8ZkrgM/+/6NJohUG/had6DoefgK6H8/yjgVx1Wtx+XAuBQ2cvclhc
-TAmHs128dWduNHxI2Yx+uM4kuHYpPKBwdEh91ZNeNqtBJURfSVjBCjKkTYiS7kiv
-XyvQOBdZVeSVpj/QoAfaUlQoBVm7aF6xf7GtYlVzjMsLYdpjXhy4ZbQQVUuPI+1f
-yFkw8PpASZ3gvO6KQ4V2w3hOYAxYQ1kSwTtaA7+18nyv65VolTmAotmLun94UKn7
-zjopByBnC/XEqsU3tibg9A7xQ2KUpWkpmG35f4ZR9aEIxSe2Jmm+Se0JfiAq6Szf
-dyWvr/TzaS/BZL4WEPk2Vw/mzWEPZOscpIkBFGK+Ul7yuXvbrbwr+zmAikHmTb1V
-XfPb9eBnwDDuRHhLBym4FMrPjzeziAxxkScTfDjWq6rvMmaEe1CX+dj6ldx9Jp9d
-iUngol89eSgAQOtptjcit5o0Y0Mu/RF6KIBG89ghFly5Ag0EX+7lVAEQAKFx5asK
-W7A9BNKPkaXgym0AlW2szQR1nwxi3APLVLS0Al9Y/3mnBbYyO84HDr82AtMSWSMY
-UZIKtkUj2sVqUb+xHOPkY/MenyoBrCl2qaTVJ89nnWMUjtrX2qk0O09+ByoYXTit
-BVPAIZ/qZfGNB+Dsp1haNKRdowkf6WXkw7A9dHB5isVmaM/Z0THNJRHwc6mcqbEV
-M4fDL+OCx6m2KQHTHirk+OE9Nwral82IIqj3d5UBHmjHAbQNXTDzZbWg6tYbLN3I
-EYxSRQpkJZIVheyBmWFZuivm4hCDZxJlZ1sgxQeIZk6wR2LBR6ccTW6PH11PhIpr
-6O8aQh8JUMg+/aJK2eQXINozYdjOTUjnWAUeUqML7Pg/vERRAgHXO9Z+NTIEWEOo
-Ee+8WOFmrmfjb9Uz27DtymhUjOl0ryiG6F1b90t1rZvVKWR2OaCUhICm88o3MCgb
-HFeOh7v3tnQb2Uot7kY1hgch6j1MNYWGb8LjwoTAmx9okEv9mh119k+SdVJP6wsX
-ZtL4860vTfTw6RQM7rkZBzTyf4qCvU5uRSd2u6JqtUhw4m/gkKQyW8jLEkqX7JaT
-+iEBgPzjALvfSWDbDgst0szqU5jltYpgjG3On7/ZGFFJrkB06orUvovxLThWWvm1
-iugw4/av3n64hl/yfxvKQHLQA3Kfkjjzc3oPABEBAAGJBHIEGAEIACYWIQR+HJGs
-gDClpZ0e+rl1DzyHcj5AEgUCX+7lVAIbAgUJA+tFgAJACRB1DzyHcj5AEsF0IAQZ
-AQgAHRYhBGFPhWcuJXtdQn6ZBiGZBzrXgrS4BQJf7uVUAAoJECGZBzrXgrS4jfkP
-/ApYZIRnBL+LdTPYdbZDYXotkE6RO6ZsPdcV1G6na5jJ7igdVuvoz5nP3rX+oQoH
-6k9DysQzyh/SkXRPnbOOyvQsI7atmH7SkhNn7ke8zmEJLzApHA0ZMGXtBJHQkZwA
-5LDWIQb8HbtJTBr2DyJcQdpRmP3hHDgyYgwg0AUG/2JEwYqps+/pqJCrLSP+GLOA
-ia+wRH9xwv1Vl2gIxWXqEO6U3puqUg+0z1Av4Gj/xzuw1F3eLrOfgklhpASc8QtC
-89kx1nhFS+OybQfRAH7YN9DKE5L1kJxQ4t+uW8TiXf9r+MdcVMEI3LATZRtgowFc
-493g7EkTppmqabFns9OamyxXdIzLAKoKvykr7HPCBWUnZn2I2RrcGQltRBQlR0Mb
-jO+sFi89XnFPwXIw/t/9zoq1bXCGTt7H5RtrfxC1wTYXqLEdV9pptNj7j5mlff9g
-DMw1v3MfUxbz9gIDzs7ANnw3SkWi+d0v0bLadWdItkq2WKvvgB58NJtKPc8Jwilh
-nO7W31U/kv8FR9JcFXzS9+Y6ejIClF4FAwr5tK07N/xSFAKEs5kyAYEKxP6vI59m
-5h+tO8cws+pi4gqfWa3t3b+dVzKl9AIkWAYjq9FvbfiqZgKTlTviSUMpmK5qJVld
-72+NiolUVniJbw9Z10ps4G4zmXSl1ZxyKnehUzcKyPieEEsP/1/tctQx1LhVu0TJ
-RLtWrE523hqxpqDdF8/QrNp9dX3YVoEkMQW3YYir2oERtaosWXmRjldq5dNfgtwc
-lhG+/CP5rxNeCJlI+b64pC/yQMCrbz/V74aAipuv7ZZMflgr7ZD5i3jyM/7/AunS
-qOUPwkKrjetNF85eibeO7c0Y9/HhILkLQ8EoNfJshdc0/scwMZEpLHTMAHSrxCAV
-FuhLsF9epenA6IbtuMsp43aSxshX05RH7F94uj4VCMUSs/90viB5njItpPdZCqUH
-eXSvLSjxqsmS4Tz9Dn+uWvxleBLRRcpZykuNLGgwVXafWftWbA+U9KaJnDWFdzjJ
-+gAsWfHfFBOa1RfXYP++e+VJflcHaEZ4byLG5Zf1HqAvvcaShAVuMXY1hoYJinvh
-uk1zJRW9dP7apZx7BXWxbWcn8LMR5GFfunl/M2iNASmkqxJ9gvy6TBRWJu2QeNbN
-5Ks0/GDUawQqvhmM3V6zFQWVsPwaHpufIaGqnKC2gXaIHXPP0ldyXdLXwgZ+6A7D
-IEqHQB2BDbiJtovk6GaK8PUCEHTiDmRF/mBzlpBJOn+Hc5ELufgr9E2lkrKJzFag
-CBCucNhVEaUedFrycxfSALing7DJPWb5cobu9K+3T9L3k57XgxSAj+g6vOxHuxHL
-ve1IPheCWfkKpJH5faFDWKpJYYPauQINBF/u5YABEADgWTS7wFA39XvpWNHSfAAR
-2/nlGWuTvD7zoirzUwOd2+I2XYwgl910KsznhlqDrHZlqKuGRjQlbpyTbsOH2N5k
-IE+0uEXidU3iwslSZ33RLL0h9+czDnlgijYXLCg5ScswBEC1E/kXX685AUCTPX2n
-D1+Ymxxgov3AvItVxKDd3N5ERsy6hYWPK4ACXt47hJFqPfPtnQe2IdFkRm3bOuX/
-X79Kb5N6cAoao65Tpsix1pm6tTNww0+THzIWzK/yhi1/tUOv/QJMEVAxeBAPr+Pm
-mvjHvsI9RNQt7VnoHVkqJhPDxyQZR2IOVQXvlYyCtkPA4WQlyxLzWM24TG8xhD1v
-zZzA8qs//o9QI8OLg2ZYxplC4lW6GEZk3GnrTXs7bW6HUq+RlayIbDw7oMs30jAv
-YyDdQpZrYuZvsWKbKu+65Yi3M5kW0v96LT3ueMJaL/RanL9JhAWuEqyezffsBZ5a
-88/i0n9FJ8cQ1fZq2/GLq/mN2JZ3e/HSWynTnlmk+qGk2bq0cRFJNHAs2HNAm0Id
-pjSFCPmek9j30wp2c2knML+SsSw5h6570mwILuKwFr6i2hyFlPk4H7nP04vPQ8P2
-Pu5O/Cfg9rPSBjIi9FsNS8/a29sSuOmsSGHZnMrVUpGw+iKmx/jVejOtqe6hYydu
-MSQtIU59E2fq5TM4tub6qwARAQABiQRyBBgBCAAmFiEEfhyRrIAwpaWdHvq5dQ88
-h3I+QBIFAl/u5YACGwIFCQPrRYACQAkQdQ88h3I+QBLBdCAEGQEIAB0WIQQjoUGa
-YHzyVyZWN3UsTffOV4ELlAUCX+7lgAAKCRAsTffOV4ELlDerEACBP9kAH17GHloL
-XJjd1IHttRWU2Qs/VV0H14g14hgRz2/Qa7KRR4mGrXPKS/ctMkDXwlvs4HPUTeO4
-MMT38hwxv54AjW7CtF8DR3EQFXKR51roICQognvqpPe1auNERdLzAdcn+NoHEQB7
-eyPqjQM3OGGq0SVRwNnv777o+Kd8Ncv/4fR1xvA20Ds94G5vCYpHB6J+lPPVXBmz
-rOYSf+QZWsXjAZdnAAYkpEjfJhNrqvqSoRxZ0dweCqieenm8Nzt/vdL9nT3+4AGy
-5hmaAG2ENj5AhI194gtgACvKwCl5hF0VKMhtm5d9SWS+1quHzgn3UFh3VZrfjPid
-CR64mIu3RpZe7EcR+lMl7gCJxdFlHVD3z1lbz2V6u+xH4ZsLrTY+v8kDxzY8ojM/
-zDbnlEK+xzA9akhlaD3D3wKXRVuSlrxfEVv14mwKN5AYHN7bLL3bjOo9WYtLznH6
-Av4GqXSQ+LOl0+6bLKmD68/N0q2IiZwUSOsxTE1fUdYPF8eiN8L+35Qt0jwybieU
-a3JYtmO8EW4ZEmjJGwKgyrf+eigJN2/0AeBwcJyUw1YfzaqqS35NNyn5eKANyFQ2
-ZhIjuXRyBOoUMBAx2TSm7FGeFOIw+aQgap6HuGbZ0EZBz6hr9ogNC9FVXCPENKo+
-GdTGoIEs0n6gGOPP5ssp7xUK3420AM3HEACSmYaNC1Gfq2d81fI0TBJ9ATCRPo14
-MjJGiWaFaXoVp/lQeOvlX2JyBG2I6fhMGPGKntCfX+/MERLNAiahQgOjvnOCQdlL
-hbq+6loQ1eSTX2AXpRlQpvyxLuebbM+HX3N/9mqAksgQdljmqoJQbiE/HqXqjmKe
-16ylU3Rjabyc2p/31p7hm0IJ/3yqDsM06FUBJ108SALQyVvKqRA6q1t/Odb3xgt2
-isbCEgvhJ8kYz3LQkvTW75rSa1cM53Udd1rbyo1t0PaOSGeUZw73/nY1+6LtUEg7
-Q0x4ohL1UE7z7+14mAtn4OvGDuZJil7Lf4cPszf0SFoHPs8iUFpSorBwn3u+5ZXW
-NYFblPU2WK3O52qZqsjuQI/gK7uQhXjJO5nA5M8Yv7bVrbLMOj64hdOpNbd56Ycc
-qwYbHZL3WyRAN7TNg5ZlHgIVac22StawjXiHWDGaAXpCaHJn8ryM3LY+LTz16R2M
-bi+HVaw+0fY9f/mIcOdT6AyDg+V200GkGXL6aw0LZkBZmDin+OMmL7AS8TZ4dvZt
-zj+sykcT8DsaFj5Au6zHJoCnsuShMquHOA/vcUkhoe8/E2Y2QdiX7zwDM8vFM8tX
-DujFLNPIZuItcVEpE3ysFV2ZfVgBXoxTlZUQxdgJBQ0zg6Ez7rDYEAhVqo2gY9sk
-XtN80X/unsjGSbkCDQRf7uWiARAA3i7pu8/QvukeIBoIk1V0GHGPjX+GeV3fR4fu
-ciYgx+NKTXT/oJ/89KVeetT4CSnGEZcEpAvsBL3hsiblJYyLVmeoCniFlU+rMem4
-zYP2PnEX70Q56d6SjBArs3K1FZK25S5qqv5ceM10NVRwPufV1RIuui6mQLm2ZwlY
-JyyANZZXMrHMJdaHpK9mMBSSF42MFQZhcauQCrhMhcpmZKn0D2+PpRveYwSr43Qi
-qBWR2INTDmj/V3ERMviE7vLajWQcmDdcrBp4u3miAJcJSn3XR5SiuL5W77jFEzgJ
-zR8yTC4hWE60nWJOk8UrEbpLyr7mBE0Tr7+1IBMgVXh8WHyzLE2ENREFvtp8KlSS
-y47Ky9n+5aqPI4M7epMNwU/ZGQnC8o3yX0zZL1tKq0fTAw1Ly4NGE1gRbmzrQcCh
-qUHg/J4KFYBMg8eCAzuPp4CRk8wUzu4fRWrOraoz/7bvhH8ilgPu1teLLKzDdOdx
-QAaiz/nGy00ICNbYqifR5m73K/rDdjtIqgsMp9Az0mEpgVNq8SPzM5grqAnP/iww
-QxwFftiXq/pEP2d8rn65e8NikN42Q28PH1D/uBYnOuVdZUvjU9wwywmfyr+NZMaH
-X9sN8R3Kk990W9VxwdOTITpAjz0qMtpE7i/GwPEtpZPTIfl54+cVKvyUjBuTXkWn
-vXN+6MkAEQEAAYkEcgQYAQgAJhYhBH4ckayAMKWlnR76uXUPPIdyPkASBQJf7uWi
-AhsCBQkD60WAAkAJEHUPPIdyPkASwXQgBBkBCAAdFiEEBjEqvVaiYb6sKxATk1aQ
-aqvQi4MFAl/u5aIACgkQk1aQaqvQi4P2Mg/9FXfsIZAgPN/Dq95y1fHG8jsPXEoY
-VNY1codxxAaNqvBXZkfJbFwSYpLY3xIbyxHuGuOtC9NpIy9M1+PR7MsxtZAvSjP+
-flP/12x+6nP2H3NWOICpsY1tNOnQe2SjKJxZXHFnDqDBgKpv3QfKUHmYEdExJe3p
-NQrjZAgmdbEHeoj+P2VV5vqRrJoqNV/pUbM9czfEHeMVMm/mwWNOi/paCh1y/PxZ
-Mkj2bqLMRFfML9O/7QOJRxu3wQwl6jJHj4o6CHks6t237FSB+qZhhQP+vR2CZl5w
-lQ4trw0wpNgbZRIMlU3tUfFQ+KdFsM7UqwzwrVgWFur5r7KrFzJN88EKSplrIY0q
-se6S5b58H7Tw1jtfjb/xF6jQz5aoZ9xemd8roLReRpKPq70o2eIP1HkjCtqmd5Xc
-RQaVEUvlv34WZQ5w2eA1bEBESjbrKhX+H0Un0msUS0JpnpegRNZqW3Bedeos0usy
-MsfqMYmZEcZb3hw51XnSb8B/WhkSmcoEuECRxeCu1tw0pn7o4GemAeqT5ng8LXeE
-RJhrUTlCIyRab8TIQZvmf6XjneT0stZLKCoZUXO+7FH7F7nPsew1dU+WFIauQX71
-PkZp2JMT7W57HKPuEillF8v5+H1k9Jq/2k+ZdgmT1Gd27nALBOc7q8rr00Lf6BU3
-K+XsfWo+p08CXKudfQ/+JFzzpyKeX5nVqiqbxqUakPy/Ot010/7457YVpvcLmcvT
-Yn4cR0dottl96lp5wT1jN7VXfZu/tsHEtTg1ofeExNuCL8DZVsSN836idRmObhLP
-dnYmThZcXBJ3RgSniQNwvuuGUtpH7OXb5vnAOe42+n3yucxhPI9Gzo5g6fTqWwb+
-qwh39ydxtiv3v3jgFixJLj/HH3MsxTm6cNUTWNLzvX+HugBeuOfyDG9++fe3UmZe
-MczAF9N9tDFP+0b1diXywJWfSdVLBmMARYeh0Swjud60SQLTqaqXVfPSECGo9LVc
-wot2u4q67QhUC2OTKiTkF6QVE05iKoPEPkCTmMvSpbHF3ERZE3J6YsVg17Uc7LrZ
-7DRRF+03mu4njS8LvIoeBuqsB96mNQNH/PwLSANWTtclCwj2C9W1HKy3zKjnu3kC
-PHLzwQFEO28TE5EsblnBdA8ozNIV887V7yw89MxPhpuXRn8BVAU1S9Dj7j3mNHLj
-rVAgZmr/nx3oDt8VfOZpK8u3u1voZdC+cnTBdcG2gzM8Ya+h8C60Y8dFzykr8hr4
-b5gDeDI1OkQ2vOQHtnQPdscYKl0v1ntHq2wrFuCIol4WneKh3Jrvdb37cL971u4g
-dpw0jTO/ykCvLlipxjJ/NrnXFb6TriZRgWZqiIwY2lKEfZDXqc/iOa2L0yBr21a5
-Ag0EX+7luwEQAM/CQdinTzIHaEJsCe42g6tt4dBC/UC4wD367rJcyJbEd+qaLJwS
-CQUbg/wrEdRT+aROHVKLwrvXxtgJs0x15vvFTurkn1BnNMh7p8woYwip7PKrNn2+
-96Yg7Aqc3a3gkDQeF8Q7uipOH/5feJh6l7Iu718pvnDUw4UFZt/RUrdqseFXVwr/
-ffSalLx7gJhL3mYuU1qpJZxsonNwAS43eViagI0FHSqixB5kPgFcbBf3BIiisOCy
-a1L9a+zSt1y1aEFC7m+9YlGJA3C0/X8s+dK0VWOrJlP/WmKUp3Epxpu6srsBItcT
-YMuGA82/03YAJ+jpGMRb+X1Dq9vuOUxvDjG+G10Cgew2EjiAkXpVg/1NsCrQWRbs
-KtFf5PXGfKCO0i8hEzwmJLd5OlNIIiup450iX4eS77Tey69hGyweLIC4YDPDwFpp
-bkDdRG6nDvePbEHi5z1L41NaWNa0wEyh28OqrmD0FCcGukk24pBVemVEx0En4siQ
-la6/1QXQlG/wTi7Yi71V/4oz7iZ4lSPWs0ACFGD9W5InlRykiRXC1cV27f+qMw9u
-Y6UbgvN70cWflK5C7e2h/eAQfxj+seYFUjMnJTkXiZE85m63p1Yu2A1c9+jqJ0L3
-Lfn5YIQdtWdY3Qc1RIQYPVRl5NcgXIPV7TwjvnjowuHjWX0IQbhv61lNABEBAAGJ
-BHIEGAEIACYWIQR+HJGsgDClpZ0e+rl1DzyHcj5AEgUCX+7luwIbAgUJA+tFgAJA
-CRB1DzyHcj5AEsF0IAQZAQgAHRYhBOJesM8c6ASdR/HZpjPhDkoYOo5GBQJf7uW7
-AAoJEDPhDkoYOo5GhpcQALowCpZ8UowMWlQFfZ2ySJalnZM6S2RxCFiss4W9pGuu
-9PKuN2wdXW3HGkBGDAuQgLwanSfhGSt/urT3+DT40OlDMzanRwEK0qiSaSs/xBtK
-dNL7JmGbcWTXpNP3aHhfYhVOg7NJnsfZ8Ti3dfuv3ZrjcLvgdnZ/s6O9S3gU8DtH
-fpnOfE3hxjUEHEw9hs9Otc6foCqMDZDvfU3emYduD5AvTiXYdeD/mZBD4OmF99II
-XWNuQexAJ+xgOPdvXaYt0lBuXmfMcn/1hrU3RJqguwnPZ2cU5zo41/uSbdsFrTHK
-yEOLTn0XYYk07mZGdscljzmXbpsbAC4Jp8CDBhUfdzfi1n3AOyblk1nywfionLlz
-HDtfWQYCxp16N8S2MU7tA1w8rFNwVDVwmxIfgjLrjPAgvqSpCmLHTXNBfdLUYRAv
-SpY9TR+U4YOOuEx2Niwnprdjm1qilN+fmPR3tWvVChlD3kHmSpi1+9ix+xizlBjN
-eZ08Eq5rDBPsTpqJmoNS8pHE0EL3IVpcB1pZ5rd6UBSa7LoMLeWwWm7Ap5VZALfp
-jMNws4SA2q5OTRY2or/+m1+cfDWIP+2XQV4YaNFMbO7XKr3vnUOxY9gyADqfRJiv
-DljHiw5iLzbkaHs7dYJOPNMGMlRzZfkkxg6Patx44TQ2rO7LnyCgVdFZWDHNevgR
-Z8AP/152xfh3qsOnT+R32Rt8CcwXmKFxLylgpjegcUmbutow9zdlX26qZ67cJ/3p
-hNLZgAYKPrGecGA0BJ2UzsPEKKz8I/dAp96LpHo/24WqUamh1z2PRAgyJGC43zm0
-rA/KAlcht8bbI/VuZ5eAYXjH01QfPS7i7fFOryYYFqfH+BTp3ZEr/A7FkcOZXmNV
-Gg4+oC2t6cJnzDsM0MUJ7dgNAHTLGx6RZZahdE3LJ8oVJ8Vek9KtjJbPr143EZLt
-ymkiy93pzLUaKWfCZJCCI9nfJnNZnvoQXv0l3wnrQIFE14Fv0jbTALHRgRJlB4cZ
-i3teEuf7shSDsd13JDdfmxMsxnfeVsIUPa+J0GBSbe14JHXlcd0t03cpbzO547Qb
-rFpD98XO6Y7OefWD3pwDF2Izjnn4Cny/hpUIEO1A2j4qHhUkqmnFmBO6yIFic637
-CJnYe3uU7ss/TNIUKLhujqlcNl8WeOMVPbhnCuOhyQh2aioAKn1yiQ1EgNSIGIVD
-LwqMt0kxI52/aDkZgCcEfBFC1c17IeUH+G0HMGm49/acFHkhX61S4efXhvzH5J0l
-Dr+0qk4aVKNwqkUNp56GSMLhiiSYivX9Xa4qQGNlmrki1pC2DamlTXDLB67XQcRp
-dAc+4nNTK4E/czrr0+wlkgz7pC1MAllCLilyTSPGnKIPlOd2uQINBF/u5d0BEADF
-+6hDuKvzbmKWZNXjJK6Em/5nnzBOa155YQLN91zMs6COI4p+YuIVPPzVWZYR0yHs
-gTWw45cMV+RYwuL/P+1Z84bgOyPloIVF9VQjOC+wB3Gn4qmTzobr6q+UfQVvUiUQ
-8fGG11teWvYpWiG91uialjHZmrpAOQxjHRxHPpi0cZtTFEqinCIy6c942xbtZnzf
-nzPpxkKl0a8s1eKZ0KlDK6Ab59nxAinilohXRg/U6sqypsyLl41L0qMZek5dEt4C
-r3spdSkZgxqJpLTqQy/5VB4pcfEaIaank3sLxhpil/oQiq+38WA0VkICQyeiCsvf
-eEKyt1C6COBNH+olegUxudTKDHFthyGMPRz3McI5jHxCyru0mfLJag2hHXzgGoaD
-VkYIwkvyVsHWDqrZMMXcCIUVlpphxtHo1M32AATnWFe4K1nFdbejR9XC5xWOgwbT
-zCblqporHzU0c8WBbfJ0Y10IDrHsa/F08PkFvVN48Ydik6rcwowSPxP+59Q9AKLh
-Isd2hzfWU2zAbG5Ph1wecwlYR3tp/0i3uSTDXfuuaY+vrqpoECN6fnSg8NxiBbjU
-JR0Ju6KDM2SeBUz5hp9BzL8+OPTogRZoinxBogrRAvdGLOnLG5hMjBezzF8UEvp6
-IMisGHBZgXoX4Juvf78RE8JOwHa+HUejj5kYiQW6TwARAQABiQRyBBgBCAAmFiEE
-fhyRrIAwpaWdHvq5dQ88h3I+QBIFAl/u5d0CGwIFCQPrRYACQAkQdQ88h3I+QBLB
-dCAEGQEIAB0WIQT2AU9wN9W7TuO6I3E56nu98JFFWwUCX+7l3QAKCRA56nu98JFF
-W5whD/9Hu5cnJ0hnzqk3MQsdMXbTNLsv+KePV71kcMRat4hjw2Li/TUaC8xtA81d
-O/1obmsuoDAgv82KlQ7DLDXjFk2q45lJdgZxAkN3dEoYakdTIEi11FvwbhV+qxZK
-jTq3jFQho4i3GDLgrvBMG4B1TGMH0IPux9fmBGpxYKmp1GjhpgoMXp9bqzsV/mPZ
-TxPlmIpeJEO2jeCWKhHHw6rzwGjF68G3HiJ0TqvjdCtcNrwd3GTDsdEJtUl49aqF
-M7VfoqKjVdRO/YDL//+TJNOYz5EBGjIZxbhgZJ9Qz+geSBx9GJtDWdq193ofFi39
-oleTFnEMj+OeIr1Bc2pc8Z3HJttFknicJDkeze3mM0CZAkhVkLFy6DvAQkXrgvfp
-AUYFACQW8E2XmRBiKd4huojWYz5QGSEIk2fYRVhse2HAUZ9gTODSX2L13nls+BEi
-sArsmSFA/RQslDXW+Jl+P0e37BzN51uk2Dg4ylJUBgcpTRUn4Q8c1DgHDhkEVnBI
-ny2H/MFuhImw9g5xqlBfCEKh5D8D0e4fX28MhSsBlOCeIKJoY85U3GNY0tlIwAt8
-M7IIHe1n1qncPbAMmq0K48J1lfyTEbXpnSfArzEdbnosjBUaiQX5EwA656eZ6wb3
-Vq02UDei6KPuOosl4Voy+Ffq5MCkanVMA97/0wV3CeCvQYGbsvsUD/9fLYc3yH7A
-0xksK7PImztDR8MLsUPoiv/vnfZ+WJJ+YJ0TKAHm1ZO3NqeZmD7XoWHKwh83zsK8
-x/JUASCBN16isC+Ym6IwF83/HXJfKNvvotkr2WG6Dv8Vg1Hhk2Iv5y3EMbFa9rfv
-6vjxho+0sYrraJH8qQAM08IIOi7+afrkR/ikgA8V7ymqmdxtMMHZqG+h5R0VGTVw
-QBxZ5/ZiY56Qn5UH2m0Tc2AHOcAQTvCEwyb19IPyhif+rek3npSvKtDc6WBJioyi
-gvDhl+jgIfcIo77w6GthgbFc9k68Je56Peu2J30zWj76Z+Di1OJhAj1wFr4/XT5o
-c1MB/Vfyx3hEPRDNz7dRaDqoVnYVdoI0blyCiSkD9I4/axb4X3xN2SK4XA/zv+Lb
-1FbCM1XFL2aF+09tk+77EVdWsBmQpOArD0d54E1YulBGaxVm5QKfov23KiqHIFVF
-8WYqJqNJwbJRZii7klczkVm3wFte3NWK7HW8kfF147lv0z3AiZYnk0O6Mj1ip3R8
-Qm5yiv57DbbgIMkSPWCpEtFGHIoK2msJ2bQcizh2WGxLos00RTx3IVAeSAS54+kr
-rMBg50wNczcGHKPDUKLwkYczgHonUtljAkeXnTl69rifChI+KpjHNtF6dFgC1aSt
-MOud6HhAcd0f3lmuPzCGGp4YOQx9tV139bkCDQRf7uX4ARAAxaybudQK4fMIzLiV
-grIzthhb3/DK83PNohTNMemM2V2z1Ij5Dlu2XNDypMdR0rKM/QI3zWud1+vd2h/l
-QZlg58FspvrY6I7hI+cbdRldVaAKDGQHo5Bi0a7BkonZvS/0wnNUPIhy/znzXtXR
-f4L7ePZMofH/2shz4TZ1yNpU8zaomY6eNjSc51P4vVxtDQ4QofQeJEn8aO9a4whu
-O0TVEAPKRYBRgjM8faDuUJtLfiC3OrhLg+B7JVSF3di4JITAyafPbZACLjV7Umxb
-SUL3qTJZVpIuhF0xQOCE+WRx3Xs7lkPdHMqP2OaJ8Y4ymR08cSfIP2XFKsQFtoqT
-VyMQgGgI6VXF8OfnCnGgx0Do1vJNoL0neFzVXpCPPzh1RbcrtndZWum/1R4egkYg
-J8TPQH5X391J58Uwd5l9/ZDdoSeeQYdtTR4YQ8//ATFO3hoSRvES4U6ZwO8LM6di
-ra6pqb6j0liT+DdcBwE4C1bGJMJ6d93S5SfH3llDIMJo7uJDbKILFMES9rg7S6I8
-+SW75TjKUk4Y7L8R8qwURqEyuOOGfaQXirqvji4PdcGDBiIk2Oq69Ky6lmlJgyIH
-SZ7SO1JXk0yAJTXb+a6FJTLFxidkIZzu+LhLBn/MhAPjVyv3qCTQ7O0lu8Mfcqg5
-8hhJ6IE79PBHS3z8ok+mFK0iGrcAEQEAAYkEcgQYAQgAJhYhBH4ckayAMKWlnR76
-uXUPPIdyPkASBQJf7uX4AhsCBQkD60WAAkAJEHUPPIdyPkASwXQgBBkBCAAdFiEE
-JFV3TUL9/mucOD64/hACvFlwgR8FAl/u5fgACgkQ/hACvFlwgR+LoRAAgtIgaKb4
-ZY8qoAFZeph+Syg+mMKfPJkBuGUedJl6IxbHBSg2mhnCjJ0bmdqxsAXgtcSUqmtZ
-Yw9NyoGgiVjs+gu5sQp1Oxc2/keQXaVksTkoXwdnf+2iXyp1WPeeLGySHmzuwy9c
-eExt+h0mVmBgFls2wNdFGPbVfiT3PvFkwqsnta6HebDTN4pMzvG1IIGV7L5KRo1E
-dmkrt3lXQWmdgHl3JoNQ9v/Jgf4jo6gDw53YvJFKJcaOOAS3d4CzPWmcLzcy4mf0
-9YI3DoQCbYL3cRNelUwzUF2L6QyPCwonXemLCmfkBgsSVqvW4fq8qbEHGF2fK7x3
-d7bZEsUiGCt/tXOkDkNJ31T/mC35nxZfcj8AMPixO+BnAeKeYC37LbQD76jrw526
-tUXsAF+QON5DPeot+e8bIx9qSbvdqpXDkK4lGcRTuS2OVC8J9XfDTch4wm3Kd4P4
-lDdRAJWnLfVay0m05LGlekWdEzcjP8KDaICH9rEs6f9e1gy6mTEBnBW//41BxELT
-KxoTGlcX3yEhCmK36g5C/+d6b7Ji5arGGTCa96v/xG32KYc1zfn3TYkCx06pPUbz
-iAl2l0MTpGeqz2hJMOGA3JuxwlksJKqnPYy0hHKdVW4Pnn25NeXcBp8wpkt8VZOR
-bzjw/TJB7qvJHoRo1tat85Uij9rAXqTyO8Ea0hAAi/EfuiDDy3GV7bvjFSA1XEjL
-d+F40g2X0QG/PHTScYB4rFJwV0GFUxLHr4g7iypAVI+BB4EYikx8gpee6B0g3J+r
-aCFDDrRPDKdqrpZK53oYcBPkdSBbCr5MAa/M3DerKBEgoBVUbaSHWN7OH2ae+5R6
-X2ERmYZdW4PCj6lw7a+RhkAsgKo8RjonjV61ehQPZh20noI19Q80BYYSCfHHvzy5
-vwvByhmTMJNrl3PDpBy9/TwBR5DpnHfOPJX6bnl3pdu65F2TRM6yoFbfoUiEqrXV
-4wC1I++N9VjrQvXSp0ik/XaMWq87wLIg+1owElJIzwyZWukQkZMAYtesVFz20YwC
-7Nu8SNr/NTSCH1EqLsS4YhBTsjpc2T8AqUlgxKrilmLbrj64PXgMsQ9WYm5zwlC5
-UA5eky5YhETFJ25dIaplMm47aIbPSH5f9y5eYPkfOCoMu5oDzDzoXdH9V1YfsHqa
-8bboSgTdariC23x38E9PaWQNyY2MFKL6cFt2ilIsMSSD6JAm1x8kBtn1bBopG588
-7mTDtlqHCw/QrTuLreJG9KJ1dQFJ/Q42+csH09l081wlv4BBuVlN1Xmj+c2sWn90
-l1BPZfYHd9jhggI96yTZhfTfFbSMSuGPQyqHnwDYdA3cNj5BYievBkO5FZaCe9SZ
-4xcYgqlVpv15O7VrD+I=
-=Uugw
-----END PGP PUBLIC KEY BLOCK-----
--- a/gating.yaml
+++ b/gating.yaml
@ -1,6 +1,16 @@
 --- !Policy
 product_versions:
  - fedora-*
-decision_context: bodhi_update_push_stable
-rules: []
-# fedora-ci.koji-build.tier0.functional is not yet stable, cannot enable it
+decision_contexts: [bodhi_update_push_testing]
+subject_type: koji_build
+rules:
+  - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build./plans/tier1-public.functional}
+
+#gating rawhide
+--- !Policy
+product_versions:
+  - fedora-*
+decision_contexts: [bodhi_update_push_stable]
+subject_type: koji_build
+rules:
+  - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build./plans/tier1-public.functional}
--- a/generate-rndc-key.sh
+++ b/generate-rndc-key.sh
@ -15,7 +15,7 @@ fi

 # This script generates /etc/rndc.key if doesn't exist AND if there is no rndc.conf

-if [ ! -s /etc/rndc.key -a ! -s /etc/rndc.conf ]; then
+if [ ! -s /etc/rndc.key ] && [ ! -s /etc/rndc.conf ]; then
  echo -n $"Generating /etc/rndc.key:"
  if /usr/sbin/rndc-confgen -a -A hmac-sha256 > /dev/null 2>&1
  then
--- a/isc-keyblock.asc
+++ b/isc-keyblock.asc
@ -0,0 +1,175 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQINBGNjen4BEADDHiUVNbkFtiKPaMWjKxbKmF1nmv7XKjDhwSww6WFiGPbQyxNM
+r8EHlEJx5kMT67rx0IYMhTLiXm/9C4dGYyUfFWc35CGetuzstzCNkwJs7vZAhEyk
+06CX4GFiHPOmWIupGCxFkNz1Qopz3ZePMlZRslVCHzW4dbg5NKLI0ojXlNaTDU5
+mgUXpsPi/6l6QE6q3ouvmWPF4u71cZ1+W4UkIRAXOlbVsDzGaMaoHjJd8cOM8DrZ
+gKHACNPjzqOvEujXDC2vyKw6XpxR+pHz0QcrRtlKnVhPNiKcDfw2mJJ5zxi9uSDc
+dh5FomMn9sS4gy2Tub2urELnPf9xnURftRGG3VO6nZc81ufQB4s1BNT2ny0Uhx5V
+mXUJwefMypMBfAvWCWBCeyWYtBeo7LT3NmtLq3oVGPfl7+a0ToFAYeghspK8/nOX
+6/fqF1MEtzvWjXljz6K7FSDYSY9AoaESLHGwCo6dtff5S7f1+l6PCUNo6aM/B5Ke
+SIAN9Lm6z2iVuy9Lukw+5IRoRKHHV4rJauPtDeYoWnNiSd7Q4vFtotUIjRpDARpm
+xWS711Q2T+knHFLEiU8QzxjLhOnTzh4n9dDLHCkOY5WM5krldVeL5EuTyPKinuSn
+oE01A7I4IGJp753CshibxjNYDiEOVeK93R38Y543edlIrYxnfyMVsiqPkwARAQAB
+tDRNaWNoYcWCIEvEmXBpZcWEIChDb2RlLVNpZ25pbmcgS2V5KSA8bWljaGFsQGlz
+Yy5vcmc+iQJOBBMBCgA4FiEEcGtsKGIOdvkdEfffUQpkKgbFLOwFAmNjen4CGwMF
+CwkIBwMFFQoJCAsFFgIDAQACHgECF4AACgkQUQpkKgbFLOwiLxAAjYuI4JQ8mPq7
+YrV9m4tu+jOKvoKfpjct2Rh02n/X3ChOgrdcXU898eH56tRk8Mv/E+cBTPN9zQn6
+rLprbYR2t2R+zgvuUZWA8In7aewoPIJw8OdlG0gTK9m3VHJIOhIX07qcFttSZw4m
+4rEU5mdxi9FatBWBzqnVm4Pn577aqRXK908j+6TvgWbZ6Cq0tw3syVT4kGj+93+P
+uIQQQkTYN8UDQPsAKzfzkbQC9I5YXBKUoB9CfhXig8V9N75R0gsWkJ8Vy/8wsPXT
+9/EPIIzhnhSuUIjvvBPbLGrzDgbhrfUQ/QVuXDVN8xl3rAWM/tiNGOnmzoYORyM5
+ftrnCDIaO4aVKR6rtEzfdQa5Kid1StfhFien/U8jYErxkEn2HRt2gVEX5nYq31T+
+0jgVode2Dzkm4+HKHmfOYsQeC07Mu6wZw9raNYqFjTcfh0ajFpLIT3j2YqOJE2jy
+KbcveJcy2NiOiUl13exIZuBkZm0wEVbvgVX1PlgL3GJqnbU/Q+maRTb8FBoQVsOd
+GIm7U/phU91qR+00SkOcp2LgHCCNKrmHXgiBNYBbInNIp6ze3bFvfKTRFn8WdY9v
+Z7vNfKar8rt90mpjYG9qMhmvh4E9icfp3wRUtOwyi7VVtVTTUq0iFTe2C0m0v6KW
+XcDwwwaTbl79BOqOH3Gp1flS2ECBsyiZAg0EY2N8xQEQAMWcyZbpxEyefX4JTszG
+ocpz8C8yqvZJQUfoDK5AecQWR7OegPkIqwJcHEH5cz+MduklXNQdra/snn6pxGig
+At3xCwfzRTH/aYXdjcjnma1elzZSTgk6Maw4zR/W9wea2DcUtMCcsys0gviN/VUe
+Aqt+5pmhy2PlEWfJG+Mzyrqgz3Q8hRyAJAKONAwNhs1A4ZqQX/6iuCkJbH1CBeoW
+c+5qJHYEXsx25qR1yiKOFo5b90QOcwaebUq+xKQRlnESn75FTgDjDfDm9BqrHcn
+Tv79kOuIN5vhz4BCsuo5QbNu4RGrs/1VSTPvMf5AN7xs9pYNMAEde7pSF1Ps3B5p
+CE6iUw9L53ytV4iJQKXpzG29LofUu65YQjIXPgK7NbBO7FUHA41YbSfoWiOAjfMh
+iE025YM2+RPQh/Nrc3PqBj4h21ycT+d8eEXKfc/okbVFFE9dKS1hUwKgSrs7baOG
+CBZdpiB+t3jWrr8UrteALab7v0rndco3QKOe9U3f+Gm3MdgLK1TGiRgpdyiIXEel
+J7zhsdoYEvaKMgUOjhf+COdlf8b9ITg93mDKe8h0OcpirCXw4O2ma3sklabzZKZf
+CPhhja6Ro5gmO5pxaLau+esQWNrjEikynNIs+GRphtcFsVVH+ww26mR0nI65Llgv
+kb4+DrbDGSPP6R/C2q/LMLM1ABEBAAG0ME1pY2hhbCBOb3dhayAoQ29kZS1TaWdu
+aW5nIEtleSkgPG1ub3dha0Bpc2Mub3JnPokCTgQTAQoAOBYhBNmczq+Hl0cBTwON
+YxguI1eUYu+qBQJjY3zFAhsDBQsJCAcDBRUKCQgLBRYCAwEAAh4BAheAAAoJEBgu
+I1eUYu+q9IAP/j/GGneuvjwbXdATiQAmkiFlOxjs+SsO/hgA/mmWcm+Kpg4cAlbP
+C2xEDa6biJyZ8TmLZEqPNrRm/umiisC8JnIJpIbInn42n4aDCRDW35lrYGdnP1Ft
+fexnEOWAJBDRVvh9OnfRfvf+HLFfLFl40b/15YzkTYGIfrMR9y8zalkzXxsVNsyr
+9Eq2pmYR7BT2z8d/9SAVuh8D3qgUylIgcFcCFJodsrI4zJSpIMfMntwVsZxDlis8
+JVFN8/pfhuBBe6vjqX/cGJnj6OL3T12jvvniv13W3rar2Ocm6XA9j1t5TZNhKqAy
+azAKu52NtdJjh25B6C/H+haXAX1eduCCE74uSarqS3F1wf6JI3p8fnWzk4hZNzxp
+nZjIk3vrHNjE4jXTZosXCf5DoVRfMpNbxj3YEnXV+kNZQRYPPatUPgFYbxz91hbN
+tHyCiy0GmTyf0QId8LTc0y9mPtP9QureJJ6rL8lt7pvXyrYglqhxDgRhJIGKMKdw
+0bQtTEF4tyNzC4/sg4/omAGH66clhXlqMmuUjHSUiQyA4LL1mJl63Q+bwqXX4B8t
+898tSUmb4Jmg3jLZ3Z9Hl7H8Sp3yYPOLzb2YUF6w3xFsUrNNzVxHFo8tAtEhtEfX
+D+ypkowZq8g41WqMlOBrrzQFuExUSXckH2Cn97lV6lkBoueqxP+Zv0bbmQINBGNj
+qIkBEADDw/CKszyuFKpVp4Z26rKJ3ooOlp8p9a+fmfuknPtMjJMSX8xK8pOlK739
+K83yvDRUidT4+R9IAUKM7TqGA0hoPZmZQLiK0YLlAAXufKxO9IsDZI/7DuF2d8fu
+usKQfS4oJC/IbzOAVwgwodnvKhttLWutT09GxiHrnfVPu6Uf4A+GWtrcTIWhXuxE
+m7+16ToxBOTLtQ3hh79/RndUuM0ldKRRzJUzASGIPmdQJDLCKgSSeaGjZAdq6gkl
+qT/K/R8eoLWSOaBRq8lBE1k7Tq4nSwthMHtCQq4+vxFWH3VF9hwy6ixccROPqt9s
+fNfJK3KF4KGhfejMuVn/Lxp1v+Ne2DsdnVofFakAbBMpMyauzAyXPncYSfFhzLBD
+kkn7THkfRznmHD8ux89kV534EyqYLjAy8AAD6zNc3tSYgfC0UUw7yz05Sl/eV9Xc
+pbezu2ipONlXko8jpCQiiHck599cy+StrjjYPwcHF5m8uUlNnzHoUj8qsoK5SA8u
+RnTW2I4DFbL0+x8eL7gmNQYFdMaA4azogtaTFWgPL2jPJ3B+/bUfHDZflvR0FB5+
+OD/QHsDv4SB6uX8TOhGbFsHpt7E0scb2U9B8gQeQQJZ3jmcIRp+K18mjYh/ErDFW
+23ixBe7h3tn2MGUTOhv1ibOYDE3GYBuGLQiom6yhCs8zrneuAQARAQABtDFXbG9k
+ZWsgV2VuY2VsIChDb2RlLVNpZ25pbmcgS2V5KSA8d2xvZGVrQGlzYy5vcmc+iQJO
+BBMBCgA4FiEEAlmjO19aOkRmzzRcel4ITKylGIQFAmNjqIkCGwMFCwkIBwMFFQoJ
+CAsFFgIDAQACHgECF4AACgkQel4ITKylGIRk9g//XrvOYy9zQkpo4Dkol8yLxr99
+Dq9Ur2v8F5Ba4za4QdUxeYrlq8J827mkUqMtnlyb/+3zSMy2I6HAI8QxlDZL5K0g
+Gm7iLrwVTM8nAQiNU5vAe4D6PeO5ATBEvRdAUTQGz4xeaTrUXbmNUSC1dZEPvH1z
+Fa/Z1WZoy9GLeuWDXix6OXTP8FlQWUTL4/ILLtfJDsWCCX7efkyfnvad8Ye2NfU9
+tBjRX5QQ0Dpvgpr8/7El44XcmaHxPWEiq8X2p/d6j3nU/7LspUXRu3ptu5Q2RqMM
+iRDZme2c8zieHETpC7m5sshzGxRtT5jWEtZ6V37On5DNTObvXCiaGV95qgiHi5VG
+s3MFD3QSo1jJI951k68UM8V+OnzbJGN7TezZ3fTn5Pwdd4C4035QMl0E5NXCcXc8
+9d+3DeFmewRRGCaOKPuO/jFPLWcwMlQqp5tkNx8LpqEZfD7/t6FrSvDUsUDU8Rn0
+TQILnUZioO68HmeuJbhKaUCMuZGjBIbBqviiufFRiJuEFOVKADQ1u/P5ct/0T/gE
+JAho3aubzdYMH5DLsaw03W5KfOjeTLW10zSmSK65wnR6fdwlo5l/Sg6Z63QXD+/H
+/OIFgzviJkyoh6MkH55z2K8BDWbhOmaUBjNAcQEXV1KyHeLDkQ+TJfLjctv4KIpv
+D7i6kNIp1b6OSdDS9W+ZAg0EY2OzdwEQAMRWPO237ohaXNpKO+dw1qkfOYYisiTQ
+yfkT7BG0Xvu8jxeOdRuvUzzplgOfwWhOQkyEEXd205/PpwReeeRwhiu0BDSrzYGM
+KZdw9Bw4enoaOinf5WTqM76mc5WUYfvDJIiHies+ANxj4EqTzvSif9hxvvzrbKYV
+lHdaGtLm40D6yZSzDEe3X49DmEABM4g/Bs7NfVJcJ3LtLo6qbLy2tKEgNPW+VN/s
+harufucxnH5HM6BUUOGZx8L04UCNJu+jvZ0zjLc5DqubNO1526kZclAo94DfTkb+
+ir9nxKn7RkdcseibeYPdeIh3le6aU6M0KhTJs3RCxaQF9At08Vrrkh+wkK2Jr5QW
+bs8cHpEJ+Q7BwDuAQetFi94eq7Sswh4mjhJ6ZnFCx8v9EbQnvL76afMbhZOezpaQ
+aAwXVuIio2fsJpHfxWnXb93H1QKiOQdBZZLQGowcFQCqAWg7h2FwWWbKMV1smGHr
+/28tLZtk/4aSCd9cZ9+nofFPPemPLbYwnBECIZN21QKZ2oBXKxb3hchy4EBTKWtC
+G/fbTsjSfTCUpMNZ57HO3rGXchjSdIf+tTGJpAqWkTcXuhWXBMWPK6/2REk/DKis
+XHugHg9R9hqGs2DaMpGh5NrOLly9+0dsjU15iTQucXbCS9895bRtmDjIN8dLSo9H
+6DDw4yO7SHTlABEBAAG0NE1hcmNpbiBHb2R6aW5hIChDb2RlLVNpZ25pbmcgS2V5
+KSA8bWdvZHppbmFAaXNjLm9yZz6JAk4EEwEKADgWIQQJCioHkj+SW1dngDpC5d94
+yDJx2wUCY2OzdwIbAwULCQgHAwUVCgkICwUWAgMBAAIeAQIXgAAKCRBC5d94yDJx
+29U0D/41C8WaGEphQW1N5lT/1284qiPuz3w3iSciAAoAe8iHUGBcSNpAWQmWvWXI
+buKb92Gtt8JtSOHwQj8qiHjqRsUu02t/tEgQMQUq6p2jqbxODJfHR8oMFMMB0i0I
+RgKtEQeq5wRJpVtH+zIFSl9PorsJtHHfhVbqxvE/axcNKa+WaqZdHuKMqADupQEw
+6rD7yYVX6YPiHxMhba2AAAoHT/3VpHC0JidZ5BWGwkfnGbV1/7O91GHfJx6KN/AK
+DKb5hFl4TrieDLJzphBWg0y4FJ4K7WSIKvcT2cLel9f9pHV6ysqSZWkCbkjkaVIi
+LyoA0o7l263WU0D5oG2ihW6Pa2YrWHDDjfTem+kOEFsMjN+Gw74I4KWUBtldfnHK
+A8TyeviKkVok1lwDAoJ3LJi/bcyCLgBZLInOU31mQ7mIXq1ENCOIvQvaG0Lwdt59
+sBI8sknHkt+54t/VCaKbWSBOzgGur6EDf9WtPHWvHNCKEleDiHCELdhRYYtENO7T
+vTv6Fq6Lh26dor26LnARLPvGLAKwONJ0vlTEG8IyoD5AHz9MwdXYgzh8wIvc/HtD
+/0FlQGLd0WYVI6UjZfPxHOZAzARJKXLJMqiSn8hnO8v6JZaUcOF0yRKTKtzqsjzU
+v9TubCGdQAaCSCaD2fmA0BEs/FpOnZ8P1fXMpcHGEtMV0qc0wZkCDQRjY7/GARAA
+ubCCHkdiMblMA9ZlcOVN1Wep7TuYxQouATTb+73iHDQRNIU7DvluHoSq5zJe1Qst
+zjTmtlkr2dyI5JnBexUEKrw2X7gPXfLaXY01gLLB/Jn8tU9VxPqBybxmjmEdP58B
+I7BwmCyMYNqDuvPSfTMlogH/pF35Al+c8UbOfDEQqxSO2nKPNa4T5ZoVxvMxV4gn
+hEJPv8Xte/wiE+CxxbmO2we6rwJjWe7O3T0mNmqvpO8iIsLlQnwTFD5L1huywPc0
+UDHK0nl8k2lkue2buaOiancLatXt/i+L1DIimCgZwOt3DlVLURH5lz5ALXE/fn+5
+wKkp+XVyNTAEFhSGifgBDYFw3nZeRTU7unMsRssL8SjuwPWoCcRI/3VE08xCuXc+
+h6NpGfeJjLRgUSSBF+958djY320TcXaRLrqRhjcJ34dBsDYsRSC15nnq2JU6Vj5t
+rJL9qOdwVAFwKeAfROUULcy/LHZ3QgKLN5jOfdqYzE2KHk1+VANttRPTG34i6uq6
+yzCFFYadwST22+QWvxh2ohYj2INvvrzRf3lVxssWyb4USB0JPajgnGeNY/hSYfDa
+KArqOr9S+3q7h0v4RgoPxDRFIC8v/10W4wPC7R3wj0m/1WHkSm951Wtzq3V84uCF
+LLhx2ByNpnJFRFqklonAH3WHUIeYcdXAsTeunrGU/XsAEQEAAbQuR3JlZyBDaG91
+bGVzIChDb2RlLVNpZ25pbmcgS2V5KSA8Z3JlZ0Bpc2Mub3JnPokCTgQTAQoAOBYh
+BJWA1r8syA8eO7ESUt6rkdVLE8m4BQJjY7/GAhsDBQsJCAcDBRUKCQgLBRYCAwEA
+Ah4BAheAAAoJEN6rkdVLE8m42PwP/RFmUzgsoM23Z/NQ2AacCFTmHweEllkmf+25
+3hP80BuSHKsdzlmllFux+xbKZEpQK0nL3fqW8yyv69WmsoKZPpZJxmQ6bwUbtXC7
+rHkt5gfOXiTaxDBmgO2dcnDsKLb+bEQ7C5hay1P8rOvf13a4UZeTP37gRGmMr38+
+LvADIspIxBdSvFa7Hb4HKG4VVDai8jaPCF0q8daEWMJxyKSfOQBtSVVAzjLcGrYR
+bCPDAI1DEASyQOru52WREe4vJCwSaq9dZyGhaWcnyTVQO8bsSLxu7cUVxA3SOheQ
+izYKkYNbaBDmWlZxLYFsTUf5izEYdW5BwHaowmw22hSspFod+c37BoY/ePfkR5iQ
+YuEff/unyqvdHMDqIXWZqpAi5o5hW3jdCd7ZL5T0WWjz4CQ8eko1ZYYnYzZlDrge
+F0veW8+lzHBLx3Ad8HyVGwtRe+VV1V0AZ0lpWMtxo02ZDRtqNDqPqVfLT5P87ZPv
+r5GhKtedgrjwY2clgmCT0xgAKNxi2SC+c/vI5PRkIoqwbTiryLIYq8tl6T1k6AMY
+eN1ZNQR7eNEXpIvYRD/BZw7IWKkCRaKwfDVhUHCm0ikylwdLXIfEEEA5mu2LJeZh
+vCddhks0S8+lRyWR/3okurF6rlloNtM1pslceh2AMDwfs3fORhYJxFsV7O7fyRnD
+NS93fq56mQINBGNj8P4BEADXK//p0lWEUNUYirsm6BUyUXqPlPrpVTdPB1tJPj1o
+zgeMKFOpYRPU1IZF1G6pbKD09gL6y19LehQYx1a57PF7kCx2ZvvcFN24EHto1H1p
+Ti48dZ7KyyEO1rBeLY5Zjgz6YvQZcSH3cd6cTrAo7hPIAjtgSTWp04FjtYJqf+tT
+gf+9ZWY+i4nQ6/Q5Z5NUd8jsOcOoFDsmY6Fds+lzn0aZSg2yfd8fnX5QFOIwDv66
+aM25q2kvkrX0wtvSQbulC8x5g6fIB3xEL6MWbXcEBYkBMW5Cnw/Kmyj7lJwVwvEO
+FFhKaOH/d2LG3rM66gl048aJYLhEJyFSyooBynXs8S/NLDgca94Bvb54FPX8LC3p
+lqJRLxhdkha5NLcUYiHOq/L7LWdThh5rRAy87Ggog8TVza118K3oiYujlyVEzLhB
+NVMT8x5kl15YknVgOKJAv9j28bSZihHrS7aga1BtYFD8yA9MuuDaHARV6YmThkdg
+OEz/PNECjsxCLcT5Bbthzg6Jg1qo3Unyeup0UbyX4zxSphCVmerDmMYddLjJ/ydc
+1uxyn4IPINBSx2sAPuUIymhVC29MB6N+SnB37/poTvSsIH15Vg264OVdaervIpuC
+W3eUANr7zrdO85nc1CTWGhugFwccXv9nyxAt8zUF/ci17p1/mLpy9K3LqlStVI9j
+MwARAQABtDBDYXRoeSBBbG1vbmQgKENvZGUtU2lnbmluZyBLZXkpIDxjYXRoeWFA
+aXNjLm9yZz6JAk4EEwEKADgWIQT8h0w+P+hncHCscb617/asfhrd+AUCY2Pw/gIb
+AwULCQgHAwUVCgkICwUWAgMBAAIeAQIXgAAKCRC17/asfhrd+HM6D/9KD/n245Fq
+jVzew92lJtufAxAFkTA5WO6fXweMlUeqMOub4vpVMLPLoFe5TzWbJMtF0m/P5+aU
+YbcvZBWFHsrnwTgA55c1VrhggLOxpw4EU0TvBdwrO7PFOYc2WznaMG+mJdqw+uNM
+yK+G44aIaC6rvi3ILSo5HPnbgQWHs39QIRLLcUjtqvavQQeyYAl0zrvNI9Xrs/Nf
+eE6PS4hIXg90A9VJRhay18w9hA+STb+xmK+3oSwP1ayLqqQ43OnV/pExSHBsjBQk
+4p1nIPlRFL30lGp/o2MoBsRvQM1tELpgBTk1LaTHzuKEpOskrWU37xu0QgEtj7YE
+r0X+GGBxgJuUzqSyLsaDgH1sEDqE+AthFfv2dxDadcXM2cdch9y3OyuSMo89aWGc
+mEVyesjYoV40tDCG73qLtfehhV/iARDMCfnZGyGYIZdDBL+tZTNeLKVDIUi/R3x9
+OmpEl8ZuCuYltyEsJnCF/rQBVMgcTOmsMu6CMx+qT3kC8iGtHqkUT2ufpKISahTn
+e329FQjClEWwBHkr0T4K80Z0REjSo6UBtio73IOCxXe0RqO37L/qgo8xKZbLxy86
+857PRWJhgbw169FJ2kR5p+M5d/g/MUeYnigvWlORW5LyrFg6RnZ1ZbULZI80QhHN
+aSFf/w020HBsLCkzWA/XM6MO2ifJTSn8NpkCDQRkSjCrARAApLUMHAbmxUMWLgDQ
+apRZBwWXriEyIVqA/SIy1PyWPPFXqs3LZ5Kn5Gw1WO8PfzkPZNtccGmNLjujIoRB
+qR41nV5zxcpS896SujBoYl80A4F4v9Op9i2pFeI9r9acFcUDjbGWBqNro4EfRcJN
+Ctkd9+pl3TUvFX06QCTxmmHy3M81SW3b4NWI+jia1cKjCd+qBFBgKWdjSMBeVTBC
+R9eKqsBQ1UJql2bRzc8pReS+TYCeEbhaOCvUCCKCwGtsSUOW726iNB/4zR4OOuQV
+B9ORufwed+E/RXa8N08/l5O96uXG0krJtOVm0/qQcXOaKxiDo6djnAgCdjFK5zaj
+7594wqbI7de58alWb/egqIhjBTgk+/cO+epZ05qx5SoJZL7ny2ottrfS2cBqP4g1
+SIt1sYl9ImHmJkNrNDy0s25nE9Nga6OfRqVbwnwot4ouTGwj0oZsCjw+gWjDdztH
+1fUWSnlA8jaX9/RZG2wKt9dI+Tp/U4d5dyTb8lIIzzgtAzDmDfPxwwT0rxAAL13A
+gDkJ0AzXA4WTOxb/JE2yfCz//kt7n8SYM//LixL4VAB7e/wnfZBhTq0OFpaPjFU0
+h/k0dc40AqcUuK3lSSjQr3KTzRHtjz8qtN4DFSuyZac83QSVtWE1rFKjS8bl3XHC
+kFFRJ2dMt2WRSkLOYNiTGbYLvmEAEQEAAbQwQW5kcmVpIFBhdmVsIChDb2RlLVNp
+Z25pbmcgS2V5KSA8YW5kcmVpQGlzYy5vcmc+iQJOBBMBCgA4FiEE2mo1COZypJ3T
+gq/ZW49NkbiO2QkFAmRKMKsCGwMFCwkIBwMFFQoJCAsFFgIDAQACHgECF4AACgkQ
+W49NkbiO2QnQZw//XCpeqT0z/sqtu4FYWwYLz1OvWqhe+uA45f9BccnNSVkGFa7w
+3hlLQC/FLUIx2cVy9AluJBP29iQge/bCcXnzo/QvCbhe/4lCTxhr7nsBe1bWpuNI
+4Pl+cQxZQBwcz74zZ1jjaaQOqm3XtdZxeKNfCQmNvz389UZEk2m8K6qJD23fy20V
+n5Y2C502UuP3MitbYKBxBSbs+Auwy1evz/prQ9VeD4Nv3Zr+jWbWFW+dSDC8jkrX
+cGdwWrUQ51QD8VBB9lPWPGY6yTbRmacr4AlVSo2DAfyjHRrGHigRF/VAD5p1+u2g
+3UFLJaEyujfzwU1kG4+zQCWZ2W2UBOekklq/yefxEY5vU1/Lad7vQhBmogQNF21T
+FvLUE6ez7XNsdMZStDPiT8OoTyFZYLRM4yw5rWKw+1mICBv7NV82YD/8hoMoZPyX
+2tNRTXv2MZ6qD++0dMCIZNEyFTB344srvQSyJ7K7vwxulc7iFWngRA8oe6JkAhH4
+B0yNq1FJm6jIL41S2FmnDL3DlfAdKWapBqzgqkv+X5DQBaTlG9a4BcSsdMJgU/Yx
+dD03YsKhDtEWTqBmmEamR1K1CgCC3mOJfsHB5z+Qhdraz2hMr00EQrD5lnpLLpcF
+rYWoilvVlRy7Y7U5wfhY4074L2ZfB+yElKsvtfGKJX/8g+eJdeRuII+hjEc=
+=NX7P
+-----END PGP PUBLIC KEY BLOCK-----
--- a/named-chroot-setup.service.in
+++ b/named-chroot-setup.service.in
@ -8,5 +8,5 @@ After=named-setup-rndc.service
 [Service]
 Type=oneshot
 RemainAfterExit=yes
-ExecStart=/usr/libexec/setup-named-chroot.sh /var/named/chroot on /etc/named-chroot.files
-ExecStop=/usr/libexec/setup-named-chroot.sh /var/named/chroot off /etc/named-chroot.files
+ExecStart=/usr/libexec/%{name}/setup-named-chroot.sh /var/named/chroot on /etc/named-chroot.files
+ExecStop=/usr/libexec/%{name}/setup-named-chroot.sh /var/named/chroot off /etc/named-chroot.files
--- a/named-chroot.files
+++ b/named-chroot.files
@ -3,6 +3,7 @@
 # if they are missing or empty in target directory.
 /etc/localtime
 /etc/named.root.key
+/etc/named.ca
 /etc/named.conf
 /etc/named.rfc1912.zones
 /etc/rndc.conf
@ -16,10 +17,10 @@
 /etc/named
 /usr/lib64/bind
 /usr/lib/bind
-/usr/lib64/named
-/usr/lib/named
 /usr/share/GeoIP
+/usr/share/named
 /run/named
+/proc/sys/net/ipv4/ip_local_port_range
 # Warning: the order is important
 # If a directory containing $ROOTDIR is listed here,
 # it MUST be listed last. (/var/named contains /var/named/chroot)
--- a/named-chroot.service.in
+++ b/named-chroot.service.in
@ -12,19 +12,21 @@ After=network.target

 [Service]
 Type=forking
+Environment=OPTIONS=
 Environment=NAMEDCONF=/etc/named.conf
 EnvironmentFile=-/etc/sysconfig/named
 Environment=KRB5_KTNAME=/etc/named.keytab
 PIDFile=/var/named/chroot/run/named/named.pid

-ExecStartPre=/bin/bash -c 'if [ ! "$DISABLE_ZONE_CHECKING" == "yes" ]; then /usr/sbin/named-checkconf -t /var/named/chroot -z "$NAMEDCONF"; else echo "Checking of zone files is disabled"; fi'
-ExecStart=/usr/sbin/named -u named -c ${NAMEDCONF} -t /var/named/chroot $OPTIONS
+ExecStartPre=/bin/bash -c 'if [ ! "$DISABLE_ZONE_CHECKING" == "yes" ]; then %{_bindir}/named-checkconf%{program_suffix} -t /var/named/chroot -z "$NAMEDCONF"; else echo "Checking of zone files is disabled"; fi'
+ExecStart=%{_sbindir}/named%{program_suffix} -u named -c ${NAMEDCONF} -t /var/named/chroot $OPTIONS

-ExecReload=/bin/sh -c 'if /usr/sbin/rndc null > /dev/null 2>&1; then /usr/sbin/rndc reload; else /bin/kill -HUP $MAINPID; fi'
+ExecReload=/bin/sh -c 'if %{_sbindir}/rndc%{program_suffix} null > /dev/null 2>&1; then %{_sbindir}/rndc%{program_suffix} reload; else %{_bindir}/kill -HUP $MAINPID; fi'

-ExecStop=/bin/sh -c '/usr/sbin/rndc stop > /dev/null 2>&1 || /bin/kill -TERM $MAINPID'
+ExecStop=/bin/sh -c '%{_sbindir}/rndc%{program_suffix} stop > /dev/null 2>&1 || %{_bindir}/kill -TERM $MAINPID'

 PrivateTmp=false
+Restart=on-abnormal

 [Install]
 WantedBy=multi-user.target
--- a/named-pkcs11.service
+++ b/named-pkcs11.service
@ -1,26 +0,0 @@
-[Unit]
-Description=Berkeley Internet Name Domain (DNS) with native PKCS#11
-Wants=nss-lookup.target
-Wants=named-setup-rndc.service
-Before=nss-lookup.target
-After=network.target
-After=named-setup-rndc.service
-
-[Service]
-Type=forking
-Environment=NAMEDCONF=/etc/named.conf
-EnvironmentFile=-/etc/sysconfig/named
-Environment=KRB5_KTNAME=/etc/named.keytab
-PIDFile=/run/named/named.pid
-
-ExecStartPre=/bin/bash -c 'if [ ! "$DISABLE_ZONE_CHECKING" == "yes" ]; then /usr/sbin/named-checkconf -z "$NAMEDCONF"; else echo "Checking of zone files is disabled"; fi'
-ExecStart=/usr/sbin/named-pkcs11 -u named -c ${NAMEDCONF} $OPTIONS
-
-ExecReload=/bin/sh -c 'if /usr/sbin/rndc null > /dev/null 2>&1; then /usr/sbin/rndc reload; else /bin/kill -HUP $MAINPID; fi'
-
-ExecStop=/bin/sh -c '/usr/sbin/rndc stop > /dev/null 2>&1 || /bin/kill -TERM $MAINPID'
-
-PrivateTmp=true
-
-[Install]
-WantedBy=multi-user.target
--- a/named-setup-rndc.service.in
+++ b/named-setup-rndc.service.in
@ -4,4 +4,4 @@ Description=Generate rndc key for BIND (DNS)
 [Service]
 Type=oneshot

-ExecStart=/usr/libexec/generate-rndc-key.sh
+ExecStart=/usr/libexec/%{name}/generate-rndc-key.sh
--- a/named.conf
+++ b/named.conf
@ -51,7 +51,7 @@ logging {

 zone "." IN {
 	type hint;
-	file "named.ca";
+	file "/etc/named.ca";
 };

 include "/etc/named.rfc1912.zones";
--- a/named.conf.sample
+++ b/named.conf.sample
@ -159,17 +159,17 @@ view "internal"
 	*/

 	zone "my.internal.zone" { 
-		type master;
+		type primary;
 		file "my.internal.zone.db";
 	};
 	zone "my.slave.internal.zone" {
-		type slave;
+		type secondary;
 		file "slaves/my.slave.internal.zone.db";
 		masters { /* put master nameserver IPs here */ 127.0.0.1; } ;
 		// put slave zones in the slaves/ directory so named can update them
 	};	
 	zone "my.ddns.internal.zone" {
-		type master;
+		type primary;
 		allow-update { key ddns_key; };
 		file "dynamic/my.ddns.internal.zone.db";
 		// put dynamically updateable zones in the slaves/ directory so named can update them
@ -202,7 +202,7 @@ view "external"
        // contain entries for just your web and mail servers:

 	zone "my.external.zone" { 
-		type master;
+		type primary;
 		file "my.external.zone.db";
 	};
 };
--- a/named.logrotate
+++ b/named.logrotate
@ -2,11 +2,9 @@
    missingok
    su named named
    create 0644 named named
+    notifempty
    postrotate
        /usr/bin/systemctl reload named.service > /dev/null 2>&1 || true
        /usr/bin/systemctl reload named-chroot.service > /dev/null 2>&1 || true
-        /usr/bin/systemctl reload named-sdb.service > /dev/null 2>&1 || true
-        /usr/bin/systemctl reload named-sdb-chroot.service > /dev/null 2>&1 || true
-        /usr/bin/systemctl reload named-pkcs11.service > /dev/null 2>&1 || true
    endscript
 }
--- a/named.rfc1912.zones
+++ b/named.rfc1912.zones
@ -1,4 +1,5 @@
 // named.rfc1912.zones:
+// vim: ft=named:
 //
 // Provided by Red Hat caching-nameserver package 
 //
@ -15,31 +16,31 @@
 // 

 zone "localhost.localdomain" IN {
-	type master;
-	file "named.localhost";
+	type primary;
+	file "/usr/share/named/named.localhost";
 	allow-update { none; };
 };

 zone "localhost" IN {
-	type master;
-	file "named.localhost";
+	type primary;
+	file "/usr/share/named/named.localhost";
 	allow-update { none; };
 };

 zone "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa" IN {
-	type master;
-	file "named.loopback";
+	type primary;
+	file "/usr/share/named/named.loopback";
 	allow-update { none; };
 };

 zone "1.0.0.127.in-addr.arpa" IN {
-	type master;
-	file "named.loopback";
+	type primary;
+	file "/usr/share/named/named.loopback";
 	allow-update { none; };
 };

 zone "0.in-addr.arpa" IN {
-	type master;
-	file "named.empty";
+	type primary;
+	file "/usr/share/named/named.empty";
 	allow-update { none; };
 };
--- a/named.root
+++ b/named.root
@ -1,61 +1,92 @@
-
-; <<>> DiG 9.11.3-RedHat-9.11.3-3.fc27 <<>> +bufsize=1200 +norec @a.root-servers.net
-; (2 servers found)
-;; global options: +cmd
-;; Got answer:
-;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 46900
-;; flags: qr aa; QUERY: 1, ANSWER: 13, AUTHORITY: 0, ADDITIONAL: 27
-
-;; OPT PSEUDOSECTION:
-; EDNS: version: 0, flags:; udp: 1472
-;; QUESTION SECTION:
-;.				IN	NS
-
-;; ANSWER SECTION:
-.			518400	IN	NS	a.root-servers.net.
-.			518400	IN	NS	b.root-servers.net.
-.			518400	IN	NS	c.root-servers.net.
-.			518400	IN	NS	d.root-servers.net.
-.			518400	IN	NS	e.root-servers.net.
-.			518400	IN	NS	f.root-servers.net.
-.			518400	IN	NS	g.root-servers.net.
-.			518400	IN	NS	h.root-servers.net.
-.			518400	IN	NS	i.root-servers.net.
-.			518400	IN	NS	j.root-servers.net.
-.			518400	IN	NS	k.root-servers.net.
-.			518400	IN	NS	l.root-servers.net.
-.			518400	IN	NS	m.root-servers.net.
-
-;; ADDITIONAL SECTION:
-a.root-servers.net.	518400	IN	A	198.41.0.4
-b.root-servers.net.	518400	IN	A	199.9.14.201
-c.root-servers.net.	518400	IN	A	192.33.4.12
-d.root-servers.net.	518400	IN	A	199.7.91.13
-e.root-servers.net.	518400	IN	A	192.203.230.10
-f.root-servers.net.	518400	IN	A	192.5.5.241
-g.root-servers.net.	518400	IN	A	192.112.36.4
-h.root-servers.net.	518400	IN	A	198.97.190.53
-i.root-servers.net.	518400	IN	A	192.36.148.17
-j.root-servers.net.	518400	IN	A	192.58.128.30
-k.root-servers.net.	518400	IN	A	193.0.14.129
-l.root-servers.net.	518400	IN	A	199.7.83.42
-m.root-servers.net.	518400	IN	A	202.12.27.33
-a.root-servers.net.	518400	IN	AAAA	2001:503:ba3e::2:30
-b.root-servers.net.	518400	IN	AAAA	2001:500:200::b
-c.root-servers.net.	518400	IN	AAAA	2001:500:2::c
-d.root-servers.net.	518400	IN	AAAA	2001:500:2d::d
-e.root-servers.net.	518400	IN	AAAA	2001:500:a8::e
-f.root-servers.net.	518400	IN	AAAA	2001:500:2f::f
-g.root-servers.net.	518400	IN	AAAA	2001:500:12::d0d
-h.root-servers.net.	518400	IN	AAAA	2001:500:1::53
-i.root-servers.net.	518400	IN	AAAA	2001:7fe::53
-j.root-servers.net.	518400	IN	AAAA	2001:503:c27::2:30
-k.root-servers.net.	518400	IN	AAAA	2001:7fd::1
-l.root-servers.net.	518400	IN	AAAA	2001:500:9f::42
-m.root-servers.net.	518400	IN	AAAA	2001:dc3::35
-
-;; Query time: 24 msec
-;; SERVER: 198.41.0.4#53(198.41.0.4)
-;; WHEN: Thu Apr 05 15:57:34 CEST 2018
-;; MSG SIZE  rcvd: 811
-
+;       This file holds the information on root name servers needed to 
+;       initialize cache of Internet domain name servers
+;       (e.g. reference this file in the "cache  .  <file>"
+;       configuration file of BIND domain name servers). 
+; 
+;       This file is made available by InterNIC 
+;       under anonymous FTP as
+;           file                /domain/named.cache 
+;           on server           FTP.INTERNIC.NET
+;       -OR-                    RS.INTERNIC.NET
+;
+;       last update:     December 20, 2023
+;       related version of root zone:     2023122001
+; 
+; FORMERLY NS.INTERNIC.NET 
+;
+.                        3600000      NS    A.ROOT-SERVERS.NET.
+A.ROOT-SERVERS.NET.      3600000      A     198.41.0.4
+A.ROOT-SERVERS.NET.      3600000      AAAA  2001:503:ba3e::2:30
+; 
+; FORMERLY NS1.ISI.EDU 
+;
+.                        3600000      NS    B.ROOT-SERVERS.NET.
+B.ROOT-SERVERS.NET.      3600000      A     170.247.170.2
+B.ROOT-SERVERS.NET.      3600000      AAAA  2801:1b8:10::b
+; 
+; FORMERLY C.PSI.NET 
+;
+.                        3600000      NS    C.ROOT-SERVERS.NET.
+C.ROOT-SERVERS.NET.      3600000      A     192.33.4.12
+C.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:2::c
+; 
+; FORMERLY TERP.UMD.EDU 
+;
+.                        3600000      NS    D.ROOT-SERVERS.NET.
+D.ROOT-SERVERS.NET.      3600000      A     199.7.91.13
+D.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:2d::d
+; 
+; FORMERLY NS.NASA.GOV
+;
+.                        3600000      NS    E.ROOT-SERVERS.NET.
+E.ROOT-SERVERS.NET.      3600000      A     192.203.230.10
+E.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:a8::e
+; 
+; FORMERLY NS.ISC.ORG
+;
+.                        3600000      NS    F.ROOT-SERVERS.NET.
+F.ROOT-SERVERS.NET.      3600000      A     192.5.5.241
+F.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:2f::f
+; 
+; FORMERLY NS.NIC.DDN.MIL
+;
+.                        3600000      NS    G.ROOT-SERVERS.NET.
+G.ROOT-SERVERS.NET.      3600000      A     192.112.36.4
+G.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:12::d0d
+; 
+; FORMERLY AOS.ARL.ARMY.MIL
+;
+.                        3600000      NS    H.ROOT-SERVERS.NET.
+H.ROOT-SERVERS.NET.      3600000      A     198.97.190.53
+H.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:1::53
+; 
+; FORMERLY NIC.NORDU.NET
+;
+.                        3600000      NS    I.ROOT-SERVERS.NET.
+I.ROOT-SERVERS.NET.      3600000      A     192.36.148.17
+I.ROOT-SERVERS.NET.      3600000      AAAA  2001:7fe::53
+; 
+; OPERATED BY VERISIGN, INC.
+;
+.                        3600000      NS    J.ROOT-SERVERS.NET.
+J.ROOT-SERVERS.NET.      3600000      A     192.58.128.30
+J.ROOT-SERVERS.NET.      3600000      AAAA  2001:503:c27::2:30
+; 
+; OPERATED BY RIPE NCC
+;
+.                        3600000      NS    K.ROOT-SERVERS.NET.
+K.ROOT-SERVERS.NET.      3600000      A     193.0.14.129
+K.ROOT-SERVERS.NET.      3600000      AAAA  2001:7fd::1
+; 
+; OPERATED BY ICANN
+;
+.                        3600000      NS    L.ROOT-SERVERS.NET.
+L.ROOT-SERVERS.NET.      3600000      A     199.7.83.42
+L.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:9f::42
+; 
+; OPERATED BY WIDE
+;
+.                        3600000      NS    M.ROOT-SERVERS.NET.
+M.ROOT-SERVERS.NET.      3600000      A     202.12.27.33
+M.ROOT-SERVERS.NET.      3600000      AAAA  2001:dc3::35
+; End of file
--- a/named.root.key
+++ b/named.root.key
@ -10,4 +10,9 @@ trust-anchors {
        # managed key database will be trusted and maintained
        # automatically.
        . initial-ds 20326 8 2 "E06D44B80B8F1D39A95C0B0D7C65D08458E880409BBC683457104237C7F8EC8D";
+        # This key (38696) will be pre-published in the root zone in 2025
+        # and is scheduled to begin signing in late 2026. At that time,
+        # servers which were already using the old key (20326) should roll
+        # seamlessly to this new one via RFC 5011 rollover.
+        . initial-ds 38696 8 2 "683D2D0ACB8C9B712A1948B27F741219298D0A450D612C483AF444A4C0FB2B16";
 };
--- a/named.rwtab
+++ b/named.rwtab
@ -1,6 +0,0 @@
-dirs    /var/named
-
-files	/var/named/named.ca
-files	/var/named/named.empty
-files	/var/named/named.localhost
-files	/var/named/named.loopback
--- a/named.service
+++ b/named.service
@ -1,25 +0,0 @@
-[Unit]
-Description=Berkeley Internet Name Domain (DNS)
-Wants=nss-lookup.target
-Wants=named-setup-rndc.service
-Before=nss-lookup.target
-After=named-setup-rndc.service
-After=network.target
-
-[Service]
-Type=forking
-Environment=NAMEDCONF=/etc/named.conf
-EnvironmentFile=-/etc/sysconfig/named
-Environment=KRB5_KTNAME=/etc/named.keytab
-PIDFile=/run/named/named.pid
-
-ExecStartPre=/bin/bash -c 'if [ ! "$DISABLE_ZONE_CHECKING" == "yes" ]; then /usr/sbin/named-checkconf -z "$NAMEDCONF"; else echo "Checking of zone files is disabled"; fi'
-ExecStart=/usr/sbin/named -u named -c ${NAMEDCONF} $OPTIONS
-ExecReload=/bin/sh -c 'if /usr/sbin/rndc null > /dev/null 2>&1; then /usr/sbin/rndc reload; else /bin/kill -HUP $MAINPID; fi'
-
-ExecStop=/bin/sh -c '/usr/sbin/rndc stop > /dev/null 2>&1 || /bin/kill -TERM $MAINPID'
-
-PrivateTmp=true
-
-[Install]
-WantedBy=multi-user.target
--- a/named.service.in
+++ b/named.service.in
@ -0,0 +1,28 @@
+[Unit]
+Description=Berkeley Internet Name Domain (DNS)
+Wants=nss-lookup.target
+Wants=named-setup-rndc.service
+Before=nss-lookup.target
+After=named-setup-rndc.service
+After=network.target
+
+[Service]
+Type=forking
+Environment=OPTIONS=
+Environment=NAMEDCONF=/etc/named.conf
+EnvironmentFile=-/etc/sysconfig/named
+Environment=KRB5_KTNAME=/etc/named.keytab
+PIDFile=/run/named/named.pid
+
+ExecStartPre=/bin/bash -c 'if [ ! "$DISABLE_ZONE_CHECKING" == "yes" ]; then %{_sbindir}/named-checkconf%{program_suffix} -z "$NAMEDCONF"; else echo "Checking of zone files is disabled"; fi'
+ExecStart=%{_sbindir}/named%{program_suffix} -u named -c ${NAMEDCONF} $OPTIONS
+
+ExecReload=/bin/sh -c 'if %{_sbindir}/rndc%{program_suffix} null > /dev/null 2>&1; then %{_sbindir}/rndc%{program_suffix} reload; else %{_bindir}/kill -HUP $MAINPID; fi'
+
+ExecStop=/bin/sh -c '%{_sbindir}/rndc%{program_suffix} stop > /dev/null 2>&1 || %{_bindir}/kill -TERM $MAINPID'
+
+PrivateTmp=true
+Restart=on-abnormal
+
+[Install]
+WantedBy=multi-user.target
--- a/named.sysusers
+++ b/named.sysusers
@ -0,0 +1,3 @@
+#Type Name       ID                  GECOS              Home directory Shell
+u     named      25                 "Named"             /var/named     /sbin/nologin
+g     named      25
--- a/plans/all.fmf
+++ b/plans/all.fmf
@ -0,0 +1,10 @@
+summary: Test plan with all beakerlib tests
+environment+:
+    PACKAGE: bind
+discover:
+    how: fmf
+    url: https://gitlab.com/redhat/centos-stream/tests/bind.git
+execute:
+    how: tmt
+context:
+    component: bind
--- a/plans/tier1-public.fmf
+++ b/plans/tier1-public.fmf
@ -0,0 +1,11 @@
+summary: Public (Fedora) Tier1 beakerlib tests
+environment+:
+    PACKAGE: bind
+discover:
+    how: fmf
+    url: https://gitlab.com/redhat/centos-stream/tests/bind.git
+    filter: 'tier: 1'
+execute:
+    how: tmt
+context:
+    component: bind
--- a/4
+++ b/4
@ -1,2 +1,2 @@
-SHA512 (bind-9.16.33.tar.xz) = 43fd2cea52dfd1115a4cca83830ab5b93208be401cdbbdff2bbf204b8f0d99fb434ad3156d3a21649488cc904ae09f145feba97b9b6918b0cf063ff5e2b10af5
-SHA512 (bind-9.16.33.tar.xz.asc) = 08623d5fbc95f0709ba3a548c747d37a747a1ea329412eb594cf5302f6d4891474c8a4a2ff730919986e8bb180207397782f239024fd2a9d0cc6a8104d2d5a6d
+SHA512 (bind-9.18.50.tar.xz) = 5ae70c95f19868f41fd609bf34a908c38769401ee5b89e4782b94081032a579c00ba9010b2feb2789a95cfd12289cfe250e6488b3b47ff666bfa8cd7edf74d43
+SHA512 (bind-9.18.50.tar.xz.asc) = 41df6df786cd33055a3fd6632ffd2968d6600e314140c547bba3452ec9f7726f44df27c3bd53a5a937ad11407d7391641e0b7b1aff7ebf87f25c65e2a76707b6
--- a/tests/Master-server-chrooted/Makefile
+++ b/tests/Master-server-chrooted/Makefile
@ -1,63 +0,0 @@
-# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-#
-#   Makefile of /CoreOS/tests/Sanity/Master-server-chrooted
-#   Description: Run basic empty named service and try to resolve localhost on it
-#   Author: Petr Mensik <pemensik@redhat.com>
-#
-# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-#
-#   Copyright (c) 2018 Red Hat, Inc.
-#
-#   This program is free software: you can redistribute it and/or
-#   modify it under the terms of the GNU General Public License as
-#   published by the Free Software Foundation, either version 2 of
-#   the License, or (at your option) any later version.
-#
-#   This program is distributed in the hope that it will be
-#   useful, but WITHOUT ANY WARRANTY; without even the implied
-#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
-#   PURPOSE.  See the GNU General Public License for more details.
-#
-#   You should have received a copy of the GNU General Public License
-#   along with this program. If not, see http://www.gnu.org/licenses/.
-#
-# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-export TEST=/CoreOS/tests/Sanity/Master-server-chrooted
-export TESTVERSION=1.0
-
-BUILT_FILES=
-
-FILES=$(METADATA) runtest.sh Makefile PURPOSE
-
-.PHONY: all install download clean
-
-run: $(FILES) build
-	./runtest.sh
-
-build: $(BUILT_FILES)
-	test -x runtest.sh || chmod a+x runtest.sh
-
-clean:
-	rm -f *~ $(BUILT_FILES)
-
-
-include /usr/share/rhts/lib/rhts-make.include
-
-$(METADATA): Makefile
-	@echo "Owner:           Petr Mensik <pemensik@redhat.com>" > $(METADATA)
-	@echo "Name:            $(TEST)" >> $(METADATA)
-	@echo "TestVersion:     $(TESTVERSION)" >> $(METADATA)
-	@echo "Path:            $(TEST_DIR)" >> $(METADATA)
-	@echo "Description:     Run basic empty named-chroot service and try to resolve localhost on it" >> $(METADATA)
-	@echo "Type:            Sanity" >> $(METADATA)
-	@echo "TestTime:        5m" >> $(METADATA)
-	@echo "RunFor:          bind" >> $(METADATA)
-	@echo "Requires:        bind bind-utils bind-chroot bind-sdb-chroot" >> $(METADATA)
-	@echo "Priority:        Normal" >> $(METADATA)
-	@echo "License:         GPLv2+" >> $(METADATA)
-	@echo "Confidential:    no" >> $(METADATA)
-	@echo "Destructive:     no" >> $(METADATA)
-	@echo "Releases:        -RHEL4 -RHELClient5 -RHELServer5 -RHEL6" >> $(METADATA)
-
-	rhts-lint $(METADATA)
--- a/tests/Master-server-chrooted/PURPOSE
+++ b/tests/Master-server-chrooted/PURPOSE
@ -1,6 +0,0 @@
-PURPOSE of /CoreOS/tests/Sanity/Master-server-chrooted
-Description: Run basic empty named-chroot service and try to resolve localhost on it
-Author: Petr Mensik <pemensik@redhat.com>
-
-Check also clean package both when running and finished.
-https://bugzilla.redhat.com/show_bug.cgi?id=1592873
--- a/tests/Master-server-chrooted/runtest.sh
+++ b/tests/Master-server-chrooted/runtest.sh
@ -1,73 +0,0 @@
-#!/bin/bash
-# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
-# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-#
-#   runtest.sh of /CoreOS/tests/Sanity/Master-server-chrooted
-#   Description: Run basic empty named-chroot service and try to resolve localhost on it
-#   Author: Petr Mensik <pemensik@redhat.com>
-#
-# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-#
-#   Copyright (c) 2018 Red Hat, Inc.
-#
-#   This program is free software: you can redistribute it and/or
-#   modify it under the terms of the GNU General Public License as
-#   published by the Free Software Foundation, either version 2 of
-#   the License, or (at your option) any later version.
-#
-#   This program is distributed in the hope that it will be
-#   useful, but WITHOUT ANY WARRANTY; without even the implied
-#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
-#   PURPOSE.  See the GNU General Public License for more details.
-#
-#   You should have received a copy of the GNU General Public License
-#   along with this program. If not, see http://www.gnu.org/licenses/.
-#
-# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-# Include Beaker environment
-. /usr/bin/rhts-environment.sh || exit 1
-. /usr/share/beakerlib/beakerlib.sh || exit 1
-
-PACKAGE="bind"
-
-test_service()
-{
-    local SERVICE="$1"
-    local PACKAGE="$2"
-	rlRun "rlServiceStart $SERVICE"
-	rlRun "dig @localhost localhost | grep '^localhost'"
-	rlRun "dig @localhost -x 127.0.0.1 | grep 'PTR[[:space:]]\+localhost.$'" 0 "Reverse address works"
-	rlRun "rpm -V $PACKAGE" 0 "Checking $SERVICE package when running"
-	rlRun "rlServiceRestore $SERVICE"
-	rlRun "rpm -V $PACKAGE" 0 "Checking $SERVICE package when stopped"
-}
-
-rlJournalStart
-    rlPhaseStartSetup
-        rlAssertRpm bind
-	rlAssertRpm bind-utils
-	rlAssertRpm bind-chroot
-    rlPhaseEnd
-
-    rlPhaseStartTest "Testing named"
-	test_service named bind
-    rlPhaseEnd
-
-    rlPhaseStartTest "Testing named-chroot"
-	test_service named-chroot bind-chroot
-    rlPhaseEnd
-
-    rlPhaseStartTest "Testing named-sdb-chroot"
-	    if rpm -q bind-sdb-chroot; then
-		test_service named-sdb-chroot bind-sdb-chroot
-	    else
-		rlLog "bind-sdb-chroot not installed, skipping it"
-	    fi
-    rlPhaseEnd
-
-    rlPhaseStartCleanup
-	# noop
-    rlPhaseEnd
-rlJournalPrintText
-rlJournalEnd
--- a/tests/Master-server-not-chrooted/Makefile
+++ b/tests/Master-server-not-chrooted/Makefile
@ -1,65 +0,0 @@
-# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-#
-#   Makefile of /CoreOS/bind/Sanity/Master-server-not-chrooted
-#   Description: Set up master nameserver, test it.
-#   Author: Martin Cermak <mcermak@redhat.com>
-#
-# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-#
-#   Copyright (c) 2009 Red Hat, Inc. All rights reserved.
-#
-#   This copyrighted material is made available to anyone wishing
-#   to use, modify, copy, or redistribute it subject to the terms
-#   and conditions of the GNU General Public License version 2.
-#
-#   This program is distributed in the hope that it will be
-#   useful, but WITHOUT ANY WARRANTY; without even the implied
-#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
-#   PURPOSE. See the GNU General Public License for more details.
-#
-#   You should have received a copy of the GNU General Public
-#   License along with this program; if not, write to the Free
-#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-#   Boston, MA 02110-1301, USA.
-#
-# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-export TEST=/CoreOS/bind/Sanity/Master-server-not-chrooted
-export TESTVERSION=1.0
-
-BUILT_FILES=
-
-FILES=$(METADATA) runtest.sh Makefile PURPOSE named.conf zonefile 
-
-.PHONY: all install download clean
-
-run: $(FILES) build
-	./runtest.sh
-
-build: $(BUILT_FILES)
-	chmod a+x runtest.sh
-
-clean:
-	rm -f *~ $(BUILT_FILES)
-
-
-include /usr/share/rhts/lib/rhts-make.include
-
-$(METADATA): Makefile
-	@echo "Owner:           Martin Cermak <mcermak@redhat.com>" > $(METADATA)
-	@echo "Name:            $(TEST)" >> $(METADATA)
-	@echo "TestVersion:     $(TESTVERSION)" >> $(METADATA)
-	@echo "Path:            $(TEST_DIR)" >> $(METADATA)
-	@echo "Description:     Set up master nameserver in chrooted env, test it." >> $(METADATA)
-	@echo "Type:            Sanity" >> $(METADATA)
-	@echo "TestTime:        5m" >> $(METADATA)
-	@echo "RunFor:          bind" >> $(METADATA)
-	@echo "Requires:        bind bind-chroot redhat-lsb" >> $(METADATA)
-	@echo "Requires:        bind-utils" >> $(METADATA)
-	@echo "Priority:        Normal" >> $(METADATA)
-	@echo "License:         GPLv2" >> $(METADATA)
-	@echo "Confidential:    no" >> $(METADATA)
-	@echo "Destructive:     no" >> $(METADATA)
-	@echo "RhtsRequires: library(bind/bind-setup)" >> $(METADATA)
-
-	rhts-lint $(METADATA)
--- a/tests/Master-server-not-chrooted/PURPOSE
+++ b/tests/Master-server-not-chrooted/PURPOSE
@ -1,6 +0,0 @@
-PURPOSE of /CoreOS/bind/Sanity/Master-server-not-chrooted
-Description: Set up master nameserver in chrooted env, test it.
-             This is a very basic sanity test for bind9.
-             The main purpose for me was to learn how
-             bind works :-)
-Author: Martin Cermak <mcermak@redhat.com>
--- a/tests/Master-server-not-chrooted/named.conf
+++ b/tests/Master-server-not-chrooted/named.conf
@ -1,11 +0,0 @@
-options {
-        directory       "/var/named";
-        allow-query     { any; };
-};
-
-zone "<DOMAIN>" IN {
-  type master;
-  file "<DOMAIN>.zone";
-  allow-update { none; };
-};
-
--- a/tests/Master-server-not-chrooted/runtest.sh
+++ b/tests/Master-server-not-chrooted/runtest.sh
@ -1,109 +0,0 @@
-#!/bin/bash
-# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
-# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-#
-#   runtest.sh of /CoreOS/bind/Sanity/Master-server-not-chrooted
-#   Description: Set up master nameserver, test it.
-#   Author: Martin Cermak <mcermak@redhat.com>
-#
-# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-#
-#   Copyright (c) 2009 Red Hat, Inc. All rights reserved.
-#
-#   This copyrighted material is made available to anyone wishing
-#   to use, modify, copy, or redistribute it subject to the terms
-#   and conditions of the GNU General Public License version 2.
-#
-#   This program is distributed in the hope that it will be
-#   useful, but WITHOUT ANY WARRANTY; without even the implied
-#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
-#   PURPOSE. See the GNU General Public License for more details.
-#
-#   You should have received a copy of the GNU General Public
-#   License along with this program; if not, write to the Free
-#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-#   Boston, MA 02110-1301, USA.
-#
-# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-# Include rhts environment
-#set -x
-. /usr/bin/rhts-environment.sh
-. /usr/lib/beakerlib/beakerlib.sh
-
-# Some heplful functions
-randomString () {
-    TEMPSTR=`date +%c%N | md5sum | awk '{print $1}'`
-    echo ${TEMPSTR:0:8}
-    unset TEMPSTR
-}
-
-randomIp () {
-    echo "192.168.1.`echo $[ $RANDOM / 256 + 1 ]`"
-}
-
-randomSerial () {
-    date +%N
-}
-
-# Variable declarations
-CONF="/etc/named.conf"
-IP1=`randomIp`
-IP2=`randomIp`
-IP3=`randomIp`
-IP4=`randomIp`
-IP5=`randomIp`
-SERIAL=`randomSerial`
-ORIGPWD=`pwd`
-
-# The test
-rlJournalStart
-    rlPhaseStartSetup
-        rlRun "TmpDir=\`mktemp -d\`" 0 "Creating tmp directory"
-        rlRun "pushd $TmpDir"
-
-        rlRun "rlImport bind/bind-setup"
-
-        bsBindSetupStart "$ORIGPWD/named.conf" "off"
-
-        rlRun "TDOMAIN=`randomString`.cz"
-        rlRun "TZONEFILE=$ROOTDIR/var/named/$TDOMAIN.zone"
-
-        # set up /etc/named.conf
-        rlRun "sed -i \"s/<DOMAIN>/$TDOMAIN/g\" $CONF"
-
-        # set up zonefile
-        rlRun "cp $ORIGPWD/zonefile $TZONEFILE"
-        rlRun "chmod a+r $TZONEFILE"
-        rlRun "sed -i \"s/<DOMAIN>/$TDOMAIN/g\" $TZONEFILE"
-        rlRun "sed -i \"s/<IP1>/$IP1/g\" $TZONEFILE"
-        rlRun "sed -i \"s/<IP2>/$IP2/g\" $TZONEFILE"
-        rlRun "sed -i \"s/<IP3>/$IP3/g\" $TZONEFILE"
-        rlRun "sed -i \"s/<IP4>/$IP4/g\" $TZONEFILE"
-        rlRun "sed -i \"s/<IP5>/$IP5/g\" $TZONEFILE"
-        rlRun "sed -i \"s/<SERIAL>/$SERIAL/g\" $TZONEFILE"
-
-        bsBindSetupDone
-    rlPhaseEnd
-
-    rlPhaseStartTest
-        # perform tests
-        rlRun "dig @localhost $TDOMAIN | grep \"^$TDOMAIN\" | head -n 1 | grep \"$IP1\""
-        rlRun "dig @localhost server1.$TDOMAIN | grep \"^server1.$TDOMAIN\" | grep \"$IP2\""
-        rlRun "dig @localhost server2.$TDOMAIN | grep \"^server2.$TDOMAIN\" | grep \"$IP3\""
-        rlRun "dig @localhost dns1.$TDOMAIN | grep \"^dns1.$TDOMAIN\" | grep \"$IP4\""
-        rlRun "dig @localhost dns2.$TDOMAIN | grep \"^dns2.$TDOMAIN\" | grep \"$IP5\""
-        rlRun "dig @localhost ftp.$TDOMAIN | grep \"^ftp.$TDOMAIN\" | grep \"server1.$TDOMAIN\""
-        rlRun "dig @localhost mail.$TDOMAIN | grep \"^mail.$TDOMAIN\" | grep \"server1.$TDOMAIN\""
-        rlRun "dig @localhost mail2.$TDOMAIN | grep \"^mail2.$TDOMAIN\" | grep \"server2.$TDOMAIN\""
-        rlRun "dig @localhost www.$TDOMAIN | grep \"^www.$TDOMAIN\" | grep \"server2.$TDOMAIN\""
-
-    rlPhaseEnd
-
-    rlPhaseStartCleanup
-        bsBindSetupCleanup
-        rlRun "popd"
-        rlRun "rm -r $TmpDir" 0 "Removing tmp directory"
-        rlRun "rm -rf $TZONEFILE"
-    rlPhaseEnd
-rlJournalEnd
--- a/tests/Master-server-not-chrooted/zonefile
+++ b/tests/Master-server-not-chrooted/zonefile
@ -1,27 +0,0 @@
-$ORIGIN <DOMAIN>.
-$TTL 86400
-@     IN     SOA    dns1.<DOMAIN>.  hostmaster.<DOMAIN>. (
-                    <SERIAL>  ; serial
-                    21600      ; refresh after 6 hours
-                    3600       ; retry after 1 hour
-                    604800     ; expire after 1 week
-                    86400 )    ; minimum TTL of 1 day
-
-      IN     NS     dns1.<DOMAIN>.
-      IN     NS     dns2.<DOMAIN>.
-
-      IN     MX     10     mail.<DOMAIN>.
-      IN     MX     20     mail2.<DOMAIN>.
-
-             IN     A       <IP1>
-
-server1      IN     A       <IP2>
-server2      IN     A       <IP3>
-dns1         IN     A       <IP4>
-dns2         IN     A       <IP5>
-
-ftp          IN     CNAME   server1
-mail         IN     CNAME   server1
-mail2        IN     CNAME   server2
-www          IN     CNAME   server2
-
--- a/tests/Run-internal-BIND-test-suite/Makefile
+++ b/tests/Run-internal-BIND-test-suite/Makefile
@ -1,77 +0,0 @@
-# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-#
-#   Makefile of tests/Run-internal-BIND-test-suite
-#   Description: Run internal BIND test suite
-#   Author: Martin Cermak <mcermak@redhat.com>
-#   Author: Petr Mensik <pemensik@redhat.com>
-#
-# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-#
-#   Copyright (c) 2010 Red Hat, Inc. All rights reserved.
-#
-#   This copyrighted material is made available to anyone wishing
-#   to use, modify, copy, or redistribute it subject to the terms
-#   and conditions of the GNU General Public License version 2.
-#
-#   This program is distributed in the hope that it will be
-#   useful, but WITHOUT ANY WARRANTY; without even the implied
-#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
-#   PURPOSE. See the GNU General Public License for more details.
-#
-#   You should have received a copy of the GNU General Public
-#   License along with this program; if not, write to the Free
-#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-#   Boston, MA 02110-1301, USA.
-#
-# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-export TEST=tests/Run-internal-BIND-test-suite
-export TESTVERSION=1.3
-
-BUILT_FILES=
-
-FILES=$(METADATA) runtest.sh Makefile PURPOSE knownerror* setup-named-softhsm.sh bind-systest-filter.sh
-
-.PHONY: all install download clean
-
-run: $(FILES) build
-	./runtest.sh
-
-build: $(BUILT_FILES)
-	chmod a+x runtest.sh
-
-clean:
-	rm -f *~ $(BUILT_FILES)
-
-
-include /usr/share/rhts/lib/rhts-make.include
-
-$(METADATA): Makefile
-	@echo "Owner:           Martin Cermak <mcermak@redhat.com>" > $(METADATA)
-	@echo "Name:            $(TEST)" >> $(METADATA)
-	@echo "TestVersion:     $(TESTVERSION)" >> $(METADATA)
-	@echo "Path:            $(TEST_DIR)" >> $(METADATA)
-	@echo "Description:     Run internal BIND test suite" >> $(METADATA)
-	@echo "Type:            Sanity" >> $(METADATA)
-	@echo "TestTime:        8h" >> $(METADATA)
-	@echo "RunFor:          bind" >> $(METADATA)
-	@echo "Requires:        bind rpm-build bind-utils" >> $(METADATA)
-	@echo "Requires:        perl-Net-DNS perl-Net-DNS-Nameserver" >> $(METADATA)
-	@echo "Requires:        perl-Time-HiRes" >> $(METADATA)
-	@echo "Requires:        bind-pkcs11 bind-pkcs11-utils softhsm" >> $(METADATA)
-	@echo "Requires:        openssl-devel libtool autoconf" >> $(METADATA)
-# Try to satisfy all build dependencies from here
-	@echo "Requires:        bind-devel" >> $(METADATA)
-	@echo "Requires:        net-tools" >> $(METADATA)
-	@echo "Requires:        dnf-utils" >> $(METADATA)
-	@echo "Requires:        kyua" >> $(METADATA)
-	@echo "Requires:        libcmocka-devel" >> $(METADATA)
-# Obsolete, uses cmocka
-#	@echo "Requires:        libatf-c gcc-c++" >> $(METADATA)
-	@echo "Priority:        Normal" >> $(METADATA)
-	@echo "License:         GPLv2" >> $(METADATA)
-	@echo "Confidential:    no" >> $(METADATA)
-	@echo "Destructive:     no" >> $(METADATA)
-	@echo "Bug:             642970" >> $(METADATA)
-
-	rhts-lint $(METADATA)
--- a/tests/Run-internal-BIND-test-suite/PURPOSE
+++ b/tests/Run-internal-BIND-test-suite/PURPOSE
@ -1,6 +0,0 @@
-PURPOSE of tests/Run-internal-BIND-test-suite
-Description: Run internal BIND test suite
-Author: Martin Cermak <mcermak@redhat.com>
-Bug summary: Run internal BIND test suite
-Bugzilla link: https://bugzilla.redhat.com/show_bug.cgi?id=642970
-
--- a/tests/Run-internal-BIND-test-suite/bind-systest-filter.sh
+++ b/tests/Run-internal-BIND-test-suite/bind-systest-filter.sh
@ -1,47 +0,0 @@
-#!/bin/bash
-#
-# This script will filter out output from BINDs tests
-# It supports form from BIND 9.9 and BIND 9.11
-# Its purpose is to display only failed tests from list of all tests
-
-CURRENT_TEST=
-CURRENT_OUTPUT=
-STATUS_ONLY=
-
-for P; do
-	case "$P" in
-		-s|--status)	STATUS_ONLY=yes; shift ;;
-	esac
-done
-
-cat $@ | while read LINE; do
-	if [ "${LINE#S:}" != "$LINE" ]; then
-		CURRENT_TEST=`echo $LINE | cut -d: -f2`
-		CURRENT_OUTPUT="$LINE"$'\n'
-	elif [ "${LINE#R:}" != "$LINE" ]; then
-		# echo "$CURRENT_TEST $LINE"
-		if [ "${LINE/#R:*:*}" != "$LINE" ]; then
-			# more recent results contain test name
-			# R:dlz:FAIL
-			CURRENT_TEST="${LINE#R:}"
-			CURRENT_TEST="${CURRENT_TEST/%:*}"
-			RESULT="${LINE/#*:}"
-		else
-			# S:dlz:time
-			# R:FAIL
-			RESULT="${LINE/#R*:/}"
-		fi
-		if [ "$RESULT" != "PASS" ]; then
-			if [ -n "$STATUS_ONLY" ]; then
-				echo "$RESULT $CURRENT_TEST"
-			else
-				CURRENT_OUTPUT+="$LINE"
-				echo "$CURRENT_OUTPUT"
-				echo
-			fi
-		fi
-		CURRENT_OUTPUT=
-	else
-		CURRENT_OUTPUT+="$LINE"$'\n'
-	fi
-done
--- a/tests/Run-internal-BIND-test-suite/knownerror
+++ b/tests/Run-internal-BIND-test-suite/knownerror
@ -1,2 +0,0 @@
-A:System test dlz
-A:System test idna
--- a/tests/Run-internal-BIND-test-suite/runtest.sh
+++ b/tests/Run-internal-BIND-test-suite/runtest.sh
@ -1,185 +0,0 @@
-#!/bin/bash
-# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
-# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-#
-#   runtest.sh of tests/Run-internal-BIND-test-suite
-#   Description: Run internal BIND test suite
-#   Author: Martin Cermak <mcermak@redhat.com>
-#
-# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-#
-#   Copyright (c) 2010 Red Hat, Inc. All rights reserved.
-#
-#   This copyrighted material is made available to anyone wishing
-#   to use, modify, copy, or redistribute it subject to the terms
-#   and conditions of the GNU General Public License version 2.
-#
-#   This program is distributed in the hope that it will be
-#   useful, but WITHOUT ANY WARRANTY; without even the implied
-#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
-#   PURPOSE. See the GNU General Public License for more details.
-#
-#   You should have received a copy of the GNU General Public
-#   License along with this program; if not, write to the Free
-#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-#   Boston, MA 02110-1301, USA.
-#
-# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-# Include rhts environment
-. /usr/bin/rhts-environment.sh
-. /usr/lib/beakerlib/beakerlib.sh
-
-PACKAGE="bind"
-
-# Set those variables to n to skip tests on variants
-#DEFAULT_VARIANTS="normal pkcs11 sdb"
-DEFAULT_VARIANTS="normal"
-#TEST_VARIANTS="normal"
-
-#
-# Runs test suite and checks known errors
-# Prepared to be repeated with another variants
-run_testsuite()
-{
-	local RESULT_TEXT="$TMPDIR/test${NAMED_VARIANT}.txt"
-	local FOUNDERROR=`mktemp found-XXXXXXXX.err`
-	local KNOWNERROR=/dev/null
-
-	if [ -f "$ORIG/knownerror${NAMED_VARIANT}.$TAG" ]; then
-		KNOWNERROR=`readlink -f $ORIG/knownerror.$TAG`
-	elif [ -f "$ORIG/knownerror${NAMED_VARIANT}" ]; then
-		KNOWNERROR=`readlink -f $ORIG/knownerror`
-	fi
-
-	# Sometime it can fail. Report just failures that are not known
-        rlRun "make test -j${CORES:-1} &> $RESULT_TEXT" 0-255 "Perform the test."
-        rlRun "grep -C 10 FAIL $RESULT_TEXT" 0-255 "Quickly show the test error (if any)."
-
-	rlRun "$FILTER $RESULT_TEXT" 0 "Showing unsuccessful tests"
-	rlRun "$FILTER -s $RESULT_TEXT > $FOUNDERROR" 0
-	rlRun "ls $KNOWNERROR $FOUNDERROR $RESULT_TEXT" 0 'check if there is needed files'
-	rlLog "`cat $FOUNDERROR`"
-
-	rlAssertLesserOrEqual "Checking number of found errors is in limits" "$(grep '^FAIL' $FOUNDERROR | wc -l)" "$(wc -l <$KNOWNERROR)"
-        cat $FOUNDERROR | while read STATUS TEST ; do
-		if [ "$STATUS" = FAIL ]; then
-			rlRun "grep '$TEST' $KNOWNERROR" 0 "Check $TEST failure is expected"
-		else
-			rlLog "$STATUS $TEST"
-		fi
-        done
-}
-
-rlJournalStart
-    rlPhaseStartSetup
-        # package assertions
-        rlAssertRpm $PACKAGE 
-        rlAssertRpm rpm-build
-        rlAssertRpm perl-Net-DNS-Nameserver
-
-	#pwd
-	ORIG=`pwd`
-	SETUP_SOFTHSM=`readlink -f setup-named-softhsm.sh`
-	FILTER=`readlink -f bind-systest-filter.sh`
-	CORES=`grep 'processor\s*:' /proc/cpuinfo | wc -l`
-
-	TAG=generic
-	if [ -f /etc/os-release ]; then
-		# extract platform tag
-		TAG=`(source /etc/os-release && echo ${PLATFORM_ID#platform:})`
-	fi
-
-        #tempdir
-        rlRun "TMPDIR=\`mktemp -d\`" 0 "Creating tmp directory"
-        rlRun "pushd $TMPDIR"
-
-        # topdir
-	TOPDIR=`rpm -E '%{_topdir}'`
-
-        # cleanup in topdir
-        mkdir -p $TOPDIR/{BUILD,SOURCES,SPECS}
-        rm -rf $TOPDIR/{BUILD,SOURCES,SPECS}/*
-
-        # download src rpm
-	if ! ls bind*.src.rpm; then
-		rlRun "dnf --enablerepo='*-source' download --source bind" 0 "Fetch source from repository"
-		rlRun "rpm -i bind*.src.rpm"
-	fi
-	
-        rlRun "rpm --define '_topdir $TOPDIR' -Uvh *rpm &> $TMPDIR/install.txt"
-        rlRun "cd $TOPDIR/SPECS" 
-
-	rlRun "dnf -y builddep *.spec"
-
-        # stop bind if it is running
-        rlServiceStop named
-    rlPhaseEnd
-
-    rlPhaseStartTest
-        # rebuild from source
-        rlRun "rpmbuild -ba *.spec &> $TMPDIR/build.txt"
-
-        # the test
-        rlRun "cd $TOPDIR/BUILD/bind*"
-
-        rlLogInfo "Test takes place in `pwd`"
-
-        rlRun "chown -R root ."
-
-	if [ -x "$SETUP_SOFTHSM" ]; then
-		rlRun "eval \"$(bash $SETUP_SOFTHSM -A)\"" 0 "Preparing PKCS#11 token slot"
-		rlRun "pkcs11-tokens" 0 "Testing token slot availability"
-	else
-		rlLog "PKCS#11 not initialized"
-	fi
-
-	if [ -d build ]; then
-		BUILD=build
-	else
-		BUILD=.
-	fi
-
-        rlRun "./bin/tests/system/ifconfig.sh up" 0 "Setup fake network interfaces."
-
-	# required by idna test 
-	export LC_ALL=en_US.UTF-8
-
-        rlRun "pushd $BUILD"
-
-	if echo "${TEST_VARIANTS:-$DEFAULT_VARIANTS}" | grep -q normal; then
-		rlLog "Running normal variant"
-		export NAMED_VARIANT= DNSSEC_VARIANT=
-		run_testsuite
-		rlLog "Finished normal variant"
-	fi
-
-	if echo "${TEST_VARIANTS:-$DEFAULT_VARIANTS}" | grep -q sdb; then
-		rlLog "Running sdb variant"
-		export NAMED_VARIANT=-sdb DNSSEC_VARIANT=
-		run_testsuite
-		rlLog "Finished sdb variant"
-	fi
-
-	if echo "${TEST_VARIANTS:-$DEFAULT_VARIANTS}" | grep -q pkcs11; then
-		rlLog "Running pkcs11 variant"
-		# Unfortunately, PKCS11 variant uses shared key storage
-		# It cannot use more threads for that reason
-		export NAMED_VARIANT=-pkcs11 DNSSEC_VARIANT=-pkcs11
-		CORES=1 run_testsuite
-		rlLog "Finished pkcs11 variant"
-	fi
-
-        rlRun "popd"
-
-        rlRun "./bin/tests/system/ifconfig.sh down" 0 "Remove fake network interfaces."
-
-    rlPhaseEnd
-
-    rlPhaseStartCleanup
-        rlBundleLogs "BUILD_LOGS" "$TMPDIR/install.txt" "$TMPDIR/builddeps.txt" "$TMPDIR/build.txt"
-        rlBundleLogs "TEST_LOGS" "$TMPDIR"/test*.txt
-        rlRun "popd"
-        rlRun "rm -r $TMPDIR" 0 "Removing tmp directory"
-    rlPhaseEnd
-rlJournalEnd
--- a/tests/Run-internal-BIND-test-suite/setup-named-softhsm.sh
+++ b/tests/Run-internal-BIND-test-suite/setup-named-softhsm.sh
@ -1,123 +0,0 @@
-#!/bin/sh
-#
-# This script will initialise token storage of softhsm PKCS11 provider
-# in custom location. Is useful to store tokens in non-standard location.
-#
-# Output can be evaluated from bash, it will prepare it for usage of temporary tokens.
-# Recommended use:
-# eval $(bash setup-named-softhsm.sh -A)
-#
-
-SOFTHSM2_CONF="$1"
-TOKENPATH="$2"
-GROUPNAME="$3"
-# Do not use this script for real keys worth protection
-# This is intended for crypto accelerators using PKCS11 interface.
-# Uninitialized token would fail any crypto operation.
-PIN=1234
-SO_PIN=1234
-LABEL=rpm
-
-set -e
-
-echo_i()
-{
-	echo "#" $@
-}
-
-random()
-{
-	if [ -x "$(which openssl 2>/dev/null)" ]; then
-		openssl rand -base64 $1
-	else
-		dd if=/dev/urandom bs=1c count=$1 | base64
-	fi
-}
-
-usage()
-{
-	echo "Usage: $0 -A [token directory] [group]"
-	echo "   or: $0 <config file> <token directory> [group]"
-}
-
-if [ "$SOFTHSM2_CONF" = "-A" -a -z "$TOKENPATH" ]; then
-	TOKENPATH=$(mktemp -d /var/tmp/softhsm-XXXXXX)
-fi
-
-if [ -z "$SOFTHSM2_CONF" -o -z "$TOKENPATH" ]; then
-	usage >&2
-	exit 1
-fi
-
-if [ "$SOFTHSM2_CONF" = "-A" ]; then
-	# Automagic mode instead
-	MODE=secure
-	SOFTHSM2_CONF="$TOKENPATH/softhsm2.conf"
-	PIN_SOURCE="$TOKENPATH/pin"
-	SOPIN_SOURCE="$TOKENPATH/so-pin"
-	TOKENPATH="$TOKENPATH/tokens"
-else
-	MODE=legacy
-fi
-
-[ -d "$TOKENPATH" ] || mkdir -p "$TOKENPATH"
-
-umask 0022
-
-if ! [ -f "$SOFTHSM2_CONF" ]; then
-cat  << SED > "$SOFTHSM2_CONF"
-# SoftHSM v2 configuration file
-
-directories.tokendir = ${TOKENPATH}
-objectstore.backend = file
-
-# ERROR, WARNING, INFO, DEBUG
-log.level = ERROR
-
-# If CKF_REMOVABLE_DEVICE flag should be set
-slots.removable = false
-SED
-else
-	echo_i "Config file $SOFTHSM2_CONF already exists" >&2
-fi
-
-if [ -n "$PIN_SOURCE" ]; then
-	touch "$PIN_SOURCE" "$SOPIN_SOURCE"
-	chmod 0600 "$PIN_SOURCE" "$SOPIN_SOURCE"
-	if [ -n "$GROUPNAME" ]; then
-		chgrp "$GROUPNAME" "$PIN_SOURCE" "$SOPIN_SOURCE"
-		chmod g+r "$PIN_SOURCE" "$SOPIN_SOURCE"
-	fi
-fi
-
-export SOFTHSM2_CONF
-
-if softhsm2-util --show-slots | grep 'Initialized:[[:space:]]*yes' > /dev/null
-then
-	echo_i "Token in ${TOKENPATH} is already initialized" >&2
-
-	[ -f "$PIN_SOURCE" ] && PIN=$(cat "$PIN_SOURCE")
-	[ -f "$SOPIN_SOURCE" ] && SO_PIN=$(cat "$SOPIN_SOURCE")
-else
-	PIN=$(random 6)
-	SO_PIN=$(random 18)
-	if [ -n "$PIN_SOURCE" ]; then
-		echo -n "$PIN" > "$PIN_SOURCE"
-		echo -n "$SO_PIN" > "$SOPIN_SOURCE"
-	fi
-
-	echo_i "Initializing tokens to ${TOKENPATH}..."
-	softhsm2-util --init-token --free --label "$LABEL" --pin "$PIN" --so-pin "$SO_PIN" | sed -e 's/^/# /'
-
-	if [ -n "$GROUPNAME" ]; then
-		chgrp -R -- "$GROUPNAME" "$TOKENPATH"
-		chmod -R -- g=rX,o= "$TOKENPATH"
-	fi
-fi
-
-echo "export SOFTHSM2_CONF=\"$SOFTHSM2_CONF\""
-echo "export PIN_SOURCE=\"$PIN_SOURCE\""
-echo "export SOPIN_SOURCE=\"$SOPIN_SOURCE\""
-# These are intentionaly not exported
-echo "PIN=\"$PIN\""
-echo "SO_PIN=\"$SO_PIN\""
--- a/tests/tests.yml
+++ b/tests/tests.yml
@ -1,11 +0,0 @@
---
-# This first play always runs on the local staging system
- hosts: localhost
-  roles:
-  - role: standard-test-beakerlib
-    tags:
-    - classic
-    repositories:
-    - repo: "https://src.fedoraproject.org/tests/bind.git"
-      dest: "bind-tests"
-      fmf_filter: "tier: 1"
--- a/trusted-key.key
+++ b/trusted-key.key
@ -1 +1,2 @@
 . 3600 IN DNSKEY 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU=
+. 3600 IN DNSKEY 257 3 8 AwEAAa96jeuknZlaeSrvyAJj6ZHv28hhOKkx3rLGXVaC6rXTsDc449/cidltpkyGwCJNnOAlFNKF2jBosZBU5eeHspaQWOmOElZsjICMQMC3aeHbGiShvZsx4wMYSjH8e7Vrhbu6irwCzVBApESjbUdpWWmEnhathWu1jo+siFUiRAAxm9qyJNg/wOZqqzL/dL/q8PkcRU5oUKEpUge71M3ej2/7CPqpdVwuMoTvoB+ZOT4YeGyxMvHmbrxlFzGOHOijtzN+u1TQNatX2XBuzZNQ1K+s2CXkPIZo7s6JgZyvaBevYtxPvYLw4z9mR7K2vaF18UYH9Z9GNUUeayffKC73PYc=