Update to 9.11.31

Resolves CVE-2021-25215 and CVE-2021-25214.
Removes disable-isc-spnego flag, because custom isc spnego code were
removed with also this flag. It is default (and the only) option now.

https://downloads.isc.org/isc/bind9/9.11.31/RELEASE-NOTES-bind-9.11.31.html

.gitignore

@@ -106,3 +106,25 @@ bind-9.7.2b1.tar.gz
 /bind-9.11.17.tar.gz.asc
 /bind-9.11.18.tar.gz
 /bind-9.11.18.tar.gz.asc
+/bind-9.11.19.tar.gz
+/bind-9.11.19.tar.gz.asc
+/bind-9.11.20.tar.gz
+/bind-9.11.20.tar.gz.asc
+/bind-9.11.21.tar.gz
+/bind-9.11.21.tar.gz.asc
+/bind-9.11.22.tar.gz
+/bind-9.11.22.tar.gz.asc
+/bind-9.11.23.tar.gz
+/bind-9.11.23.tar.gz.asc
+/bind-9.11.24.tar.gz
+/bind-9.11.24.tar.gz.asc
+/bind-9.11.25.tar.gz
+/bind-9.11.25.tar.gz.asc
+/bind-9.11.26.tar.gz
+/bind-9.11.26.tar.gz.asc
+/bind-9.11.27.tar.gz
+/bind-9.11.27.tar.gz.asc
+/bind-9.11.28.tar.gz
+/bind-9.11.28.tar.gz.asc
+/bind-9.11.31.tar.gz
+/bind-9.11.31.tar.gz.asc

bind-9.10-dist-native-pkcs11.patch

@@ -1,5 +1,5 @@
 diff --git a/bin/Makefile.in b/bin/Makefile.in
-index f0c504a..ce7a2da 100644
+index a18b222..26a7e4e 100644
 --- a/bin/Makefile.in
 +++ b/bin/Makefile.in
 @@ -11,8 +11,8 @@ srcdir =	@srcdir@
@@ -14,7 +14,7 @@ index f0c504a..ce7a2da 100644
  
  @BIND9_MAKE_RULES@
 diff --git a/bin/dnssec-pkcs11/Makefile.in b/bin/dnssec-pkcs11/Makefile.in
-index 4b8ca13..32f4470 100644
+index 390aa0c..e59a118 100644
 --- a/bin/dnssec-pkcs11/Makefile.in
 +++ b/bin/dnssec-pkcs11/Makefile.in
 @@ -15,18 +15,18 @@ VERSION=@BIND9_VERSION@
@@ -130,7 +130,7 @@ index 4b8ca13..32f4470 100644
  
  clean distclean::
 diff --git a/bin/dnssec/Makefile.in b/bin/dnssec/Makefile.in
-index 4b8ca13..4175996 100644
+index 390aa0c..851a008 100644
 --- a/bin/dnssec/Makefile.in
 +++ b/bin/dnssec/Makefile.in
 @@ -17,7 +17,7 @@ VERSION=@BIND9_VERSION@
@@ -143,7 +143,7 @@ index 4b8ca13..4175996 100644
  CWARNINGS =
  
 diff --git a/bin/named-pkcs11/Makefile.in b/bin/named-pkcs11/Makefile.in
-index 70e5571..b5a4a6b 100644
+index 7a490fa..1f56836 100644
 --- a/bin/named-pkcs11/Makefile.in
 +++ b/bin/named-pkcs11/Makefile.in
 @@ -43,27 +43,27 @@ DLZDRIVER_INCLUDES =	@DLZ_DRIVER_INCLUDES@
@@ -268,7 +268,7 @@ index 70e5571..b5a4a6b 100644
  @DLZ_DRIVER_RULES@
  
 diff --git a/bin/named/Makefile.in b/bin/named/Makefile.in
-index 70e5571..4cfed4d 100644
+index 7a490fa..3d8655f 100644
 --- a/bin/named/Makefile.in
 +++ b/bin/named/Makefile.in
 @@ -48,7 +48,7 @@ CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include -I. \
@@ -281,10 +281,10 @@ index 70e5571..4cfed4d 100644
  CWARNINGS =
  
 diff --git a/bin/pkcs11/Makefile.in b/bin/pkcs11/Makefile.in
-index a058c91..d4b689a 100644
+index 2c19e7e..8223d5e 100644
 --- a/bin/pkcs11/Makefile.in
 +++ b/bin/pkcs11/Makefile.in
-@@ -15,13 +15,13 @@ top_srcdir =	@top_srcdir@
+@@ -13,13 +13,13 @@ top_srcdir =	@top_srcdir@
  
  @BIND9_MAKE_INCLUDES@
  
@@ -302,10 +302,10 @@ index a058c91..d4b689a 100644
  DEPLIBS =	${ISCDEPLIBS}
  
 diff --git a/configure.ac b/configure.ac
-index 9b7d778..59ba20b 100644
+index ab92837..be23d99 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -1139,12 +1139,14 @@ AC_SUBST(USE_GSSAPI)
+@@ -1176,12 +1176,14 @@ AC_SUBST(USE_GSSAPI)
  AC_SUBST(DST_GSSAPI_INC)
  AC_SUBST(DNS_GSSAPI_LIBS)
  DNS_CRYPTO_LIBS="$DNS_GSSAPI_LIBS $DNS_CRYPTO_LIBS"
@@ -320,24 +320,26 @@ index 9b7d778..59ba20b 100644
  
  #
  # was --with-randomdev specified?
-@@ -1494,11 +1496,11 @@ AC_ARG_ENABLE(openssl-hash,
+@@ -1554,12 +1556,12 @@ AC_ARG_ENABLE(openssl-hash,
  AC_MSG_CHECKING(for OpenSSL library)
  OPENSSL_WARNING=
  openssldirs="/usr /usr/local /usr/local/ssl /opt/local /usr/pkg /usr/sfw"
 -if test "yes" = "$want_native_pkcs11"
 -then
 -	use_openssl="native_pkcs11"
+-	want_openssl_hash="no"
 -	AC_MSG_RESULT(use of native PKCS11 instead)
 -fi
-+# if test "yes" = "$want_native_pkcs11"
-+# then
-+# 	use_openssl="native_pkcs11"
-+# 	AC_MSG_RESULT(use of native PKCS11 instead)
-+# fi
++#if test "yes" = "$want_native_pkcs11"
++#then
++#	use_openssl="native_pkcs11"
++#	want_openssl_hash="no"
++#	AC_MSG_RESULT(use of native PKCS11 instead)
++#fi
  
  if test "auto" = "$use_openssl"
  then
-@@ -1511,6 +1513,7 @@ then
+@@ -1572,6 +1574,7 @@ then
  		fi
  	done
  fi
@@ -345,7 +347,7 @@ index 9b7d778..59ba20b 100644
  OPENSSL_ECDSA=""
  OPENSSL_GOST=""
  OPENSSL_ED25519=""
-@@ -1532,11 +1535,10 @@ case "$with_gost" in
+@@ -1593,11 +1596,10 @@ case "$with_gost" in
  		;;
  esac
  
@@ -360,7 +362,7 @@ index 9b7d778..59ba20b 100644
  		CRYPTOLIB="pkcs11"
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
-@@ -1546,7 +1548,9 @@ case "$use_openssl" in
+@@ -1607,7 +1609,9 @@ case "$use_openssl" in
  		OPENSSLGOSTLINKSRCS=""
  		OPENSSLLINKOBJS=""
  		OPENSSLLINKSRCS=""
@@ -371,7 +373,7 @@ index 9b7d778..59ba20b 100644
  	no)
  		AC_MSG_RESULT(no)
  		DST_OPENSSL_INC=""
-@@ -1578,7 +1582,7 @@ case "$use_openssl" in
+@@ -1639,7 +1643,7 @@ case "$use_openssl" in
  If you do not want OpenSSL, use --without-openssl])
  		;;
  	*)
@@ -380,7 +382,7 @@ index 9b7d778..59ba20b 100644
  		then
  			AC_MSG_RESULT()
  			AC_MSG_ERROR([OpenSSL and native PKCS11 cannot be used together.])
-@@ -2006,6 +2010,7 @@ AC_SUBST(OPENSSL_ED25519)
+@@ -2075,6 +2079,7 @@ AC_SUBST(OPENSSL_ED25519)
  AC_SUBST(OPENSSL_GOST)
  
  DNS_CRYPTO_LIBS="$DNS_CRYPTO_LIBS $DST_OPENSSL_LIBS"
@@ -388,7 +390,7 @@ index 9b7d778..59ba20b 100644
  
  ISC_PLATFORM_WANTAES="#undef ISC_PLATFORM_WANTAES"
  if test "yes" = "$with_aes"
-@@ -2291,6 +2296,7 @@ esac
+@@ -2361,6 +2366,7 @@ esac
  AC_SUBST(PKCS11LINKOBJS)
  AC_SUBST(PKCS11LINKSRCS)
  AC_SUBST(CRYPTO)
@@ -396,7 +398,7 @@ index 9b7d778..59ba20b 100644
  AC_SUBST(PKCS11_ECDSA)
  AC_SUBST(PKCS11_GOST)
  AC_SUBST(PKCS11_ED25519)
-@@ -5405,8 +5411,11 @@ AC_CONFIG_FILES([
+@@ -5489,8 +5495,11 @@ AC_CONFIG_FILES([
  	bin/delv/Makefile
  	bin/dig/Makefile
  	bin/dnssec/Makefile
@@ -408,7 +410,7 @@ index 9b7d778..59ba20b 100644
  	bin/nsupdate/Makefile
  	bin/pkcs11/Makefile
  	bin/python/Makefile
-@@ -5479,6 +5488,10 @@ AC_CONFIG_FILES([
+@@ -5563,6 +5572,10 @@ AC_CONFIG_FILES([
  	lib/dns/include/dns/Makefile
  	lib/dns/include/dst/Makefile
  	lib/dns/tests/Makefile
@@ -419,7 +421,7 @@ index 9b7d778..59ba20b 100644
  	lib/irs/Makefile
  	lib/irs/include/Makefile
  	lib/irs/include/irs/Makefile
-@@ -5503,6 +5516,24 @@ AC_CONFIG_FILES([
+@@ -5587,6 +5600,24 @@ AC_CONFIG_FILES([
  	lib/isc/unix/include/Makefile
  	lib/isc/unix/include/isc/Makefile
  	lib/isc/unix/include/pkcs11/Makefile
@@ -445,7 +447,7 @@ index 9b7d778..59ba20b 100644
  	lib/isccc/include/Makefile
  	lib/isccc/include/isccc/Makefile
 diff --git a/lib/Makefile.in b/lib/Makefile.in
-index 81270a0..bcb5312 100644
+index f089bea..3ed939b 100644
 --- a/lib/Makefile.in
 +++ b/lib/Makefile.in
 @@ -15,7 +15,7 @@ top_srcdir =	@top_srcdir@
@@ -458,21 +460,20 @@ index 81270a0..bcb5312 100644
  
  @BIND9_MAKE_RULES@
 diff --git a/lib/dns-pkcs11/Makefile.in b/lib/dns-pkcs11/Makefile.in
-index 7f09bd6..c388d9e 100644
+index 1d0f5df..0ec7eeb 100644
 --- a/lib/dns-pkcs11/Makefile.in
 +++ b/lib/dns-pkcs11/Makefile.in
-@@ -26,17 +26,16 @@ VERSION=@BIND9_VERSION@
+@@ -24,17 +24,17 @@ VERSION=@BIND9_VERSION@
  
- USE_ISC_SPNEGO = @USE_ISC_SPNEGO@
+ @BIND9_MAKE_INCLUDES@
  
 -CINCLUDES =	-I. -I${top_srcdir}/lib/dns -Iinclude ${DNS_INCLUDES} \
--		${ISC_INCLUDES} ${MAXMINDDB_CFLAGS} \
--		@DST_OPENSSL_INC@ @DST_GSSAPI_INC@
 +CINCLUDES =	-I. -I${top_srcdir}/lib/dns-pkcs11 -Iinclude ${DNS_PKCS11_INCLUDES} \
-+		${ISC_PKCS11_INCLUDES} ${MAXMINDDB_CFLAGS} @DST_OPENSSL_INC@ @DST_GSSAPI_INC@
+ 		${ISC_INCLUDES} ${MAXMINDDB_CFLAGS} \
+ 		@DST_OPENSSL_INC@ @DST_GSSAPI_INC@
  
--CDEFINES =	-DUSE_MD5 @CRYPTO@ @USE_GSSAPI@ ${USE_ISC_SPNEGO}
-+CDEFINES =	-DUSE_MD5 @CRYPTO_PK11@ @USE_GSSAPI@ ${USE_ISC_SPNEGO}
+-CDEFINES =	-DUSE_MD5 @CRYPTO@ @USE_GSSAPI@
++CDEFINES =	-DUSE_MD5 @CRYPTO_PK11@ @USE_GSSAPI@
  
  CWARNINGS =
  
@@ -484,7 +485,7 @@ index 7f09bd6..c388d9e 100644
  
  LIBS =		${MAXMINDDB_LIBS} @LIBS@
  
-@@ -150,15 +149,15 @@ version.@O@: version.c
+@@ -148,15 +148,15 @@ version.@O@: version.c
  		-DLIBAGE=${LIBAGE} \
  		-c ${srcdir}/version.c
  
@@ -504,7 +505,7 @@ index 7f09bd6..c388d9e 100644
  
  include: gen
  	${MAKE} include/dns/enumtype.h
-@@ -189,22 +188,22 @@ gen: gen.c
+@@ -187,22 +187,22 @@ gen: gen.c
  	${BUILD_CPPFLAGS} ${BUILD_LDFLAGS} -o $@ ${srcdir}/gen.c \
  	${BUILD_LIBS} ${LFS_LIBS}
  
@@ -533,7 +534,7 @@ index 7f09bd6..c388d9e 100644
  	rm -f include/dns/rdatastruct.h
  	rm -f dnstap.pb-c.c dnstap.pb-c.h
 diff --git a/lib/isc-pkcs11/Makefile.in b/lib/isc-pkcs11/Makefile.in
-index 8ad54bb..a3ecdfb 100644
+index 7e3e9ce..58d7466 100644
 --- a/lib/isc-pkcs11/Makefile.in
 +++ b/lib/isc-pkcs11/Makefile.in
 @@ -23,8 +23,8 @@ CINCLUDES =	-I${srcdir}/unix/include \
@@ -547,7 +548,7 @@ index 8ad54bb..a3ecdfb 100644
  CWARNINGS =
  
  # Alphabetically
-@@ -103,40 +103,40 @@ version.@O@: version.c
+@@ -107,40 +107,40 @@ version.@O@: version.c
  		-DLIBAGE=${LIBAGE} \
  		-c ${srcdir}/version.c
  
@@ -601,10 +602,10 @@ index 8ad54bb..a3ecdfb 100644
 +	rm -f libisc-pkcs11.@A@ libisc-pkcs11-nosymtbl.@A@ libisc-pkcs11.la \
 +	libisc-pkcs11-nosymtbl.la timestamp
 diff --git a/make/includes.in b/make/includes.in
-index fa86ad1..3cfbe9f 100644
+index 66efe68..966671f 100644
 --- a/make/includes.in
 +++ b/make/includes.in
-@@ -43,3 +43,13 @@ BIND9_INCLUDES = @BIND9_BIND9_BUILDINCLUDE@ \
+@@ -41,3 +41,13 @@ BIND9_INCLUDES = @BIND9_BIND9_BUILDINCLUDE@ \
  
  TEST_INCLUDES = \
  	-I${top_srcdir}/lib/tests/include

bind-9.11-fips-tests.patch

@@ -1,4 +1,4 @@
-From c23daf334d5487fa53fef88c82312e439a2d8523 Mon Sep 17 00:00:00 2001
+From 14ad3e0b42bc999072d30268396412bec158a22d Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Thu, 2 Aug 2018 23:46:45 +0200
 Subject: [PATCH] FIPS tests changes
@@ -80,7 +80,7 @@ Date:   Wed Mar 7 10:44:23 2018 +0100
  bin/tests/system/digdelv/tests.sh             | 20 +++---
  bin/tests/system/dlv/ns1/sign.sh              |  4 +-
  bin/tests/system/dlv/ns2/sign.sh              |  4 +-
- bin/tests/system/dlv/ns6/sign.sh              | 66 +++++++++---------
+ bin/tests/system/dlv/ns6/sign.sh              | 66 ++++++++++---------
  bin/tests/system/dnssec/ns2/sign.sh           |  8 +--
  bin/tests/system/dnssec/ns5/trusted.conf.bad  |  2 +-
  bin/tests/system/dnssec/tests.sh              |  4 +-
@@ -92,22 +92,19 @@ Date:   Wed Mar 7 10:44:23 2018 +0100
  bin/tests/system/nsupdate/ns1/named.conf.in   |  2 +-
  bin/tests/system/nsupdate/ns2/named.conf.in   |  2 +-
  bin/tests/system/nsupdate/setup.sh            |  7 +-
- bin/tests/system/nsupdate/tests.sh            | 11 ++-
+ bin/tests/system/nsupdate/tests.sh            | 11 +++-
  bin/tests/system/rndc/setup.sh                |  2 +-
  bin/tests/system/rndc/tests.sh                | 23 ++++---
- bin/tests/system/tsig/clean.sh                |  1 +
  bin/tests/system/tsig/ns1/named.conf.in       | 10 +--
  bin/tests/system/tsig/setup.sh                |  5 ++
- bin/tests/system/tsig/tests.sh                | 67 ++++++++++++-------
+ bin/tests/system/tsig/tests.sh                | 65 +++++++++++-------
  bin/tests/system/tsiggss/setup.sh             |  2 +-
  bin/tests/system/upforwd/ns1/named.conf.in    |  2 +-
  bin/tests/system/upforwd/tests.sh             |  2 +-
- bin/tests/system/tsig/ns1/rndc5.conf.in | 10 +++
- 45 files changed, 232 insertions(+), 171 deletions(-)
- create mode 100644 bin/tests/system/tsig/ns1/rndc5.conf.in
+ 43 files changed, 220 insertions(+), 170 deletions(-)
 
 diff --git a/bin/tests/system/acl/ns2/named1.conf.in b/bin/tests/system/acl/ns2/named1.conf.in
-index 0ea6502..026db3f 100644
+index 9999ada..e3f8d0e 100644
 --- a/bin/tests/system/acl/ns2/named1.conf.in
 +++ b/bin/tests/system/acl/ns2/named1.conf.in
 @@ -33,12 +33,12 @@ options {
@@ -126,7 +123,7 @@ index 0ea6502..026db3f 100644
  };
  
 diff --git a/bin/tests/system/acl/ns2/named2.conf.in b/bin/tests/system/acl/ns2/named2.conf.in
-index b877880..d8f50be 100644
+index f8ec34e..d2d6ad3 100644
 --- a/bin/tests/system/acl/ns2/named2.conf.in
 +++ b/bin/tests/system/acl/ns2/named2.conf.in
 @@ -33,12 +33,12 @@ options {
@@ -145,7 +142,7 @@ index b877880..d8f50be 100644
  };
  
 diff --git a/bin/tests/system/acl/ns2/named3.conf.in b/bin/tests/system/acl/ns2/named3.conf.in
-index 0a95062..aa54088 100644
+index 2acb813..6a00344 100644
 --- a/bin/tests/system/acl/ns2/named3.conf.in
 +++ b/bin/tests/system/acl/ns2/named3.conf.in
 @@ -33,17 +33,17 @@ options {
@@ -170,7 +167,7 @@ index 0a95062..aa54088 100644
  };
  
 diff --git a/bin/tests/system/acl/ns2/named4.conf.in b/bin/tests/system/acl/ns2/named4.conf.in
-index 7cdcb6e..606a345 100644
+index bca3ee1..5913420 100644
 --- a/bin/tests/system/acl/ns2/named4.conf.in
 +++ b/bin/tests/system/acl/ns2/named4.conf.in
 @@ -33,12 +33,12 @@ options {
@@ -189,7 +186,7 @@ index 7cdcb6e..606a345 100644
  };
  
 diff --git a/bin/tests/system/acl/ns2/named5.conf.in b/bin/tests/system/acl/ns2/named5.conf.in
-index 4b4e050..0e679a8 100644
+index 9ef8171..5ae8d38 100644
 --- a/bin/tests/system/acl/ns2/named5.conf.in
 +++ b/bin/tests/system/acl/ns2/named5.conf.in
 @@ -34,12 +34,12 @@ options {
@@ -208,7 +205,7 @@ index 4b4e050..0e679a8 100644
  };
  
 diff --git a/bin/tests/system/acl/tests.sh b/bin/tests/system/acl/tests.sh
-index 09f31f2..f88f0d4 100644
+index 2ee34a0..a73a54e 100644
 --- a/bin/tests/system/acl/tests.sh
 +++ b/bin/tests/system/acl/tests.sh
 @@ -22,14 +22,14 @@ echo_i "testing basic ACL processing"
@@ -334,7 +331,7 @@ index 09f31f2..f88f0d4 100644
  
  echo_i "testing allow-query-on ACL processing"
 diff --git a/bin/tests/system/allow-query/ns2/named10.conf.in b/bin/tests/system/allow-query/ns2/named10.conf.in
-index 1569913..e9c5c2d 100644
+index a579f32..3b8f853 100644
 --- a/bin/tests/system/allow-query/ns2/named10.conf.in
 +++ b/bin/tests/system/allow-query/ns2/named10.conf.in
 @@ -12,7 +12,7 @@
@@ -347,7 +344,7 @@ index 1569913..e9c5c2d 100644
  };
  
 diff --git a/bin/tests/system/allow-query/ns2/named11.conf.in b/bin/tests/system/allow-query/ns2/named11.conf.in
-index 18ac91c..2b1c873 100644
+index 166afa1..997ece9 100644
 --- a/bin/tests/system/allow-query/ns2/named11.conf.in
 +++ b/bin/tests/system/allow-query/ns2/named11.conf.in
 @@ -12,12 +12,12 @@
@@ -366,7 +363,7 @@ index 18ac91c..2b1c873 100644
  };
  
 diff --git a/bin/tests/system/allow-query/ns2/named12.conf.in b/bin/tests/system/allow-query/ns2/named12.conf.in
-index b824844..dd48945 100644
+index 25271a5..a9cb65d 100644
 --- a/bin/tests/system/allow-query/ns2/named12.conf.in
 +++ b/bin/tests/system/allow-query/ns2/named12.conf.in
 @@ -12,7 +12,7 @@
@@ -379,7 +376,7 @@ index b824844..dd48945 100644
  };
  
 diff --git a/bin/tests/system/allow-query/ns2/named30.conf.in b/bin/tests/system/allow-query/ns2/named30.conf.in
-index aeb1540..bfce58b 100644
+index c7c8254..f165e65 100644
 --- a/bin/tests/system/allow-query/ns2/named30.conf.in
 +++ b/bin/tests/system/allow-query/ns2/named30.conf.in
 @@ -12,7 +12,7 @@
@@ -392,7 +389,7 @@ index aeb1540..bfce58b 100644
  };
  
 diff --git a/bin/tests/system/allow-query/ns2/named31.conf.in b/bin/tests/system/allow-query/ns2/named31.conf.in
-index d4b7432..e0f5252 100644
+index 567bbcc..4fd2035 100644
 --- a/bin/tests/system/allow-query/ns2/named31.conf.in
 +++ b/bin/tests/system/allow-query/ns2/named31.conf.in
 @@ -12,12 +12,12 @@
@@ -411,7 +408,7 @@ index d4b7432..e0f5252 100644
  };
  
 diff --git a/bin/tests/system/allow-query/ns2/named32.conf.in b/bin/tests/system/allow-query/ns2/named32.conf.in
-index c025938..87afb3f 100644
+index b75161f..7b254e6 100644
 --- a/bin/tests/system/allow-query/ns2/named32.conf.in
 +++ b/bin/tests/system/allow-query/ns2/named32.conf.in
 @@ -12,7 +12,7 @@
@@ -424,7 +421,7 @@ index c025938..87afb3f 100644
  };
  
 diff --git a/bin/tests/system/allow-query/ns2/named40.conf.in b/bin/tests/system/allow-query/ns2/named40.conf.in
-index d83b376..d726b94 100644
+index 9e17818..22f5001 100644
 --- a/bin/tests/system/allow-query/ns2/named40.conf.in
 +++ b/bin/tests/system/allow-query/ns2/named40.conf.in
 @@ -16,12 +16,12 @@ acl accept { 10.53.0.2; };
@@ -443,7 +440,7 @@ index d83b376..d726b94 100644
  };
  
 diff --git a/bin/tests/system/allow-query/tests.sh b/bin/tests/system/allow-query/tests.sh
-index fb6059d..f960156 100644
+index 791a1a4..95cd971 100644
 --- a/bin/tests/system/allow-query/tests.sh
 +++ b/bin/tests/system/allow-query/tests.sh
 @@ -190,7 +190,7 @@ rndc_reload
@@ -528,7 +525,7 @@ index fb6059d..f960156 100644
  grep '^a.keydisallow.example' dig.out.ns2.$n > /dev/null && ret=1
  if [ $ret != 0 ]; then echo_i "failed"; fi
 diff --git a/bin/tests/system/catz/ns1/named.conf.in b/bin/tests/system/catz/ns1/named.conf.in
-index 74b7d37..c353766 100644
+index 6856ec7..0ac1fa3 100644
 --- a/bin/tests/system/catz/ns1/named.conf.in
 +++ b/bin/tests/system/catz/ns1/named.conf.in
 @@ -61,5 +61,5 @@ zone "catalog4.example" {
@@ -539,7 +536,7 @@ index 74b7d37..c353766 100644
 +	algorithm hmac-sha256;
  };
 diff --git a/bin/tests/system/catz/ns2/named.conf.in b/bin/tests/system/catz/ns2/named.conf.in
-index ee83efb..35ced08 100644
+index dd3a9dc..77b8d96 100644
 --- a/bin/tests/system/catz/ns2/named.conf.in
 +++ b/bin/tests/system/catz/ns2/named.conf.in
 @@ -70,5 +70,5 @@ zone "catalog4.example" {
@@ -550,7 +547,7 @@ index ee83efb..35ced08 100644
 +	algorithm hmac-sha256;
  };
 diff --git a/bin/tests/system/checkconf/bad-tsig.conf b/bin/tests/system/checkconf/bad-tsig.conf
-index 21be03e..e57c308 100644
+index 338dddb..90cd424 100644
 --- a/bin/tests/system/checkconf/bad-tsig.conf
 +++ b/bin/tests/system/checkconf/bad-tsig.conf
 @@ -11,7 +11,7 @@
@@ -563,10 +560,10 @@ index 21be03e..e57c308 100644
  };
  
 diff --git a/bin/tests/system/checkconf/good.conf b/bin/tests/system/checkconf/good.conf
-index 9ab35b3..486551a 100644
+index 2282f87..1359cf3 100644
 --- a/bin/tests/system/checkconf/good.conf
 +++ b/bin/tests/system/checkconf/good.conf
-@@ -153,6 +153,6 @@ dyndb "name" "library.so" {
+@@ -159,6 +159,6 @@ dyndb "name" "library.so" {
  	system;
  };
  key "mykey" {
@@ -575,7 +572,7 @@ index 9ab35b3..486551a 100644
  	secret "qwertyuiopasdfgh";
  };
 diff --git a/bin/tests/system/digdelv/ns2/example.db b/bin/tests/system/digdelv/ns2/example.db
-index f4e30f5..9f53e31 100644
+index b66207a..359b220 100644
 --- a/bin/tests/system/digdelv/ns2/example.db
 +++ b/bin/tests/system/digdelv/ns2/example.db
 @@ -38,12 +38,15 @@ foo			SSHFP	2 1 123456789abcdef67890123456789abcdef67890
@@ -601,10 +598,10 @@ index f4e30f5..9f53e31 100644
  ; TTL of 3 weeks
  weeks		1814400	A	10.53.0.2
 diff --git a/bin/tests/system/digdelv/tests.sh b/bin/tests/system/digdelv/tests.sh
-index ade45ce..d3aff24 100644
+index 2109001..ded5557 100644
 --- a/bin/tests/system/digdelv/tests.sh
 +++ b/bin/tests/system/digdelv/tests.sh
-@@ -106,7 +106,7 @@ if [ -x "$DIG" ] ; then
+@@ -155,7 +155,7 @@ if [ -x "$DIG" ] ; then
    echo_i "checking dig +rrcomments works for DNSKEY($n)"
    ret=0
    $DIG $DIGOPTS +tcp @10.53.0.3 +rrcomments DNSKEY dnskey.example > dig.out.test$n || ret=1
@@ -613,7 +610,7 @@ index ade45ce..d3aff24 100644
    check_ttl_range dig.out.test$n "DNSKEY" 300 || ret=1
    if [ $ret != 0 ]; then echo_i "failed"; fi
    status=`expr $status + $ret`
-@@ -115,7 +115,7 @@ if [ -x "$DIG" ] ; then
+@@ -164,7 +164,7 @@ if [ -x "$DIG" ] ; then
    echo_i "checking dig +short +rrcomments works for DNSKEY ($n)"
    ret=0
    $DIG $DIGOPTS +tcp @10.53.0.3 +short +rrcomments DNSKEY dnskey.example > dig.out.test$n || ret=1
@@ -622,7 +619,7 @@ index ade45ce..d3aff24 100644
    if [ $ret != 0 ]; then echo_i "failed"; fi
    status=`expr $status + $ret`
  
-@@ -123,7 +123,7 @@ if [ -x "$DIG" ] ; then
+@@ -172,7 +172,7 @@ if [ -x "$DIG" ] ; then
    echo_i "checking dig +short +nosplit works($n)"
    ret=0
    $DIG $DIGOPTS +tcp @10.53.0.3 +short +nosplit DNSKEY dnskey.example > dig.out.test$n || ret=1
@@ -631,7 +628,7 @@ index ade45ce..d3aff24 100644
    if [ $ret != 0 ]; then echo_i "failed"; fi
    status=`expr $status + $ret`
  
-@@ -131,7 +131,7 @@ if [ -x "$DIG" ] ; then
+@@ -180,7 +180,7 @@ if [ -x "$DIG" ] ; then
    echo_i "checking dig +short +rrcomments works($n)"
    ret=0
    $DIG $DIGOPTS +tcp @10.53.0.3 +short +rrcomments DNSKEY dnskey.example > dig.out.test$n || ret=1
@@ -640,7 +637,7 @@ index ade45ce..d3aff24 100644
    if [ $ret != 0 ]; then echo_i "failed"; fi
    status=`expr $status + $ret`
  
-@@ -148,7 +148,7 @@ if [ -x "$DIG" ] ; then
+@@ -197,7 +197,7 @@ if [ -x "$DIG" ] ; then
    echo_i "checking dig +short +rrcomments works($n)"
    ret=0
    $DIG $DIGOPTS +tcp @10.53.0.3 +short +rrcomments DNSKEY dnskey.example > dig.out.test$n || ret=1
@@ -649,7 +646,7 @@ index ade45ce..d3aff24 100644
    if [ $ret != 0 ]; then echo_i "failed"; fi
    status=`expr $status + $ret`
  
-@@ -695,7 +695,7 @@ if [ -x ${DELV} ] ; then
+@@ -827,7 +827,7 @@ if [ -x ${DELV} ] ; then
    echo_i "checking delv +rrcomments works for DNSKEY($n)"
    ret=0
    $DELV $DELVOPTS +tcp @10.53.0.3 +rrcomments DNSKEY dnskey.example > delv.out.test$n || ret=1
@@ -658,7 +655,7 @@ index ade45ce..d3aff24 100644
    check_ttl_range delv.out.test$n "DNSKEY" 300 || ret=1
    if [ $ret != 0 ]; then echo_i "failed"; fi
    status=`expr $status + $ret`
-@@ -704,7 +704,7 @@ if [ -x ${DELV} ] ; then
+@@ -836,7 +836,7 @@ if [ -x ${DELV} ] ; then
    echo_i "checking delv +short +rrcomments works for DNSKEY ($n)"
    ret=0
    $DELV $DELVOPTS +tcp @10.53.0.3 +short +rrcomments DNSKEY dnskey.example > delv.out.test$n || ret=1
@@ -667,7 +664,7 @@ index ade45ce..d3aff24 100644
    if [ $ret != 0 ]; then echo_i "failed"; fi
    status=`expr $status + $ret`
  
-@@ -712,7 +712,7 @@ if [ -x ${DELV} ] ; then
+@@ -844,7 +844,7 @@ if [ -x ${DELV} ] ; then
    echo_i "checking delv +short +rrcomments works ($n)"
    ret=0
    $DELV $DELVOPTS +tcp @10.53.0.3 +short +rrcomments DNSKEY dnskey.example > delv.out.test$n || ret=1
@@ -676,7 +673,7 @@ index ade45ce..d3aff24 100644
    if [ $ret != 0 ]; then echo_i "failed"; fi
    status=`expr $status + $ret`
  
-@@ -720,7 +720,7 @@ if [ -x ${DELV} ] ; then
+@@ -852,7 +852,7 @@ if [ -x ${DELV} ] ; then
    echo_i "checking delv +short +nosplit works ($n)"
    ret=0
    $DELV $DELVOPTS +tcp @10.53.0.3 +short +nosplit DNSKEY dnskey.example > delv.out.test$n || ret=1
@@ -685,7 +682,7 @@ index ade45ce..d3aff24 100644
    if test `wc -l < delv.out.test$n` != 1 ; then ret=1 ; fi
    f=`awk '{print NF}' < delv.out.test$n`
    test "${f:-0}" -eq 14 || ret=1
-@@ -731,7 +731,7 @@ if [ -x ${DELV} ] ; then
+@@ -863,7 +863,7 @@ if [ -x ${DELV} ] ; then
    echo_i "checking delv +short +nosplit +norrcomments works ($n)"
    ret=0
    $DELV $DELVOPTS +tcp @10.53.0.3 +short +nosplit +norrcomments DNSKEY dnskey.example > delv.out.test$n || ret=1
@@ -695,7 +692,7 @@ index ade45ce..d3aff24 100644
    f=`awk '{print NF}' < delv.out.test$n`
    test "${f:-0}" -eq 4 || ret=1
 diff --git a/bin/tests/system/dlv/ns1/sign.sh b/bin/tests/system/dlv/ns1/sign.sh
-index 606e7cc..a3a0d60 100755
+index 14ca5db..3f522d0 100755
 --- a/bin/tests/system/dlv/ns1/sign.sh
 +++ b/bin/tests/system/dlv/ns1/sign.sh
 @@ -23,8 +23,8 @@ infile=root.db.in
@@ -710,7 +707,7 @@ index 606e7cc..a3a0d60 100755
  cat $infile $keyname1.key $keyname2.key >$zonefile
  
 diff --git a/bin/tests/system/dlv/ns2/sign.sh b/bin/tests/system/dlv/ns2/sign.sh
-index 9825c57..202c978 100755
+index d870798..b0ab372 100755
 --- a/bin/tests/system/dlv/ns2/sign.sh
 +++ b/bin/tests/system/dlv/ns2/sign.sh
 @@ -24,8 +24,8 @@ zonefile=druz.db
@@ -725,7 +722,7 @@ index 9825c57..202c978 100755
  cat $infile $keyname1.key $keyname2.key >$zonefile
  
 diff --git a/bin/tests/system/dlv/ns6/sign.sh b/bin/tests/system/dlv/ns6/sign.sh
-index 1e39862..4ed19ac 100755
+index ba39f90..f20a2dd 100755
 --- a/bin/tests/system/dlv/ns6/sign.sh
 +++ b/bin/tests/system/dlv/ns6/sign.sh
 @@ -16,13 +16,15 @@ SYSTESTDIR=dlv
@@ -912,7 +909,7 @@ index 1e39862..4ed19ac 100755
  cat $infile $keyname1.key $keyname2.key >$zonefile
  
 diff --git a/bin/tests/system/dnssec/ns2/sign.sh b/bin/tests/system/dnssec/ns2/sign.sh
-index 13fb924..1ffa279 100644
+index e28b3f1..29c169b 100644
 --- a/bin/tests/system/dnssec/ns2/sign.sh
 +++ b/bin/tests/system/dnssec/ns2/sign.sh
 @@ -126,8 +126,8 @@ zone=in-addr.arpa.
@@ -945,7 +942,7 @@ index 13fb924..1ffa279 100644
  cat $dlvinfile $dlvkeyname.key $dlvsetfile > $dlvzonefile
  
 diff --git a/bin/tests/system/dnssec/ns5/trusted.conf.bad b/bin/tests/system/dnssec/ns5/trusted.conf.bad
-index ed30460..e6b1126 100644
+index 75cf699..b4d848c 100644
 --- a/bin/tests/system/dnssec/ns5/trusted.conf.bad
 +++ b/bin/tests/system/dnssec/ns5/trusted.conf.bad
 @@ -10,5 +10,5 @@
@@ -956,10 +953,10 @@ index ed30460..e6b1126 100644
 +    "." 256 3 8 "AwEAAarwAdjV4gIhpBCjXVAScRFEx3co7k8smJdxrnqoGsl5NB7EZ9jRdgvCXbJn6v8y9jlNWVHvaC8ilhfhLh0A1vLWiWv4ijd/12xcnrY7xpG7Cu3YkxUxaXJ7Jdg/Iw1+9mGgXF1v4UbCIcw/3U3cxyk7OxYg+VSb5KBAQSR0upxV";
  };
 diff --git a/bin/tests/system/dnssec/tests.sh b/bin/tests/system/dnssec/tests.sh
-index b31c1b4..a5e237b 100644
+index 3e8e4d5..da692f9 100644
 --- a/bin/tests/system/dnssec/tests.sh
 +++ b/bin/tests/system/dnssec/tests.sh
-@@ -3235,8 +3235,8 @@ do
+@@ -3257,8 +3257,8 @@ do
  	   alg=`expr $alg + 1`
  	   continue;;
  	3) size="-b 512";;
@@ -971,7 +968,7 @@ index b31c1b4..a5e237b 100644
  	8) size="-b 512";;
  	10) size="-b 1024";;
 diff --git a/bin/tests/system/feature-test.c b/bin/tests/system/feature-test.c
-index c1249ed..20a3139 100644
+index 5e473ab..b08692e 100644
 --- a/bin/tests/system/feature-test.c
 +++ b/bin/tests/system/feature-test.c
 @@ -19,6 +19,7 @@
@@ -983,14 +980,14 @@ index c1249ed..20a3139 100644
  
  #ifdef WIN32
 @@ -47,6 +48,7 @@ usage() {
- 	fprintf(stderr, "	--have-geoip2\n");
- 	fprintf(stderr, "	--have-libxml2\n");
- 	fprintf(stderr, "	--ipv6only=no\n");
-+	fprintf(stderr, "       --md5\n");
- 	fprintf(stderr, "	--rpz-nsdname\n");
- 	fprintf(stderr, "	--rpz-nsip\n");
- 	fprintf(stderr, "	--with-idn\n");
-@@ -155,6 +157,18 @@ main(int argc, char **argv) {
+ 	fprintf(stderr, "\t--have-geoip\n");
+ 	fprintf(stderr, "\t--have-libxml2\n");
+ 	fprintf(stderr, "\t--ipv6only=no\n");
++	fprintf(stderr, "\t--md5\n");
+ 	fprintf(stderr, "\t--rpz-log-qtype-qclass\n");
+ 	fprintf(stderr, "\t--rpz-nsdname\n");
+ 	fprintf(stderr, "\t--rpz-nsip\n");
+@@ -194,6 +196,18 @@ main(int argc, char **argv) {
  #endif
  	}
  
@@ -1010,7 +1007,7 @@ index c1249ed..20a3139 100644
  #ifdef ENABLE_RPZ_NSIP
  		return (0);
 diff --git a/bin/tests/system/filter-aaaa/ns1/sign.sh b/bin/tests/system/filter-aaaa/ns1/sign.sh
-index f755581..4a7d890 100755
+index 479f98c..4d4a765 100755
 --- a/bin/tests/system/filter-aaaa/ns1/sign.sh
 +++ b/bin/tests/system/filter-aaaa/ns1/sign.sh
 @@ -21,8 +21,8 @@ infile=signed.db.in
@@ -1025,7 +1022,7 @@ index f755581..4a7d890 100755
  cat $infile $keyname1.key $keyname2.key >$zonefile
  
 diff --git a/bin/tests/system/filter-aaaa/ns4/sign.sh b/bin/tests/system/filter-aaaa/ns4/sign.sh
-index f755581..4a7d890 100755
+index 479f98c..4d4a765 100755
 --- a/bin/tests/system/filter-aaaa/ns4/sign.sh
 +++ b/bin/tests/system/filter-aaaa/ns4/sign.sh
 @@ -21,8 +21,8 @@ infile=signed.db.in
@@ -1040,7 +1037,7 @@ index f755581..4a7d890 100755
  cat $infile $keyname1.key $keyname2.key >$zonefile
  
 diff --git a/bin/tests/system/notify/ns5/named.conf.in b/bin/tests/system/notify/ns5/named.conf.in
-index cfcfe8f..0a1614d 100644
+index 157ef16..b802288 100644
 --- a/bin/tests/system/notify/ns5/named.conf.in
 +++ b/bin/tests/system/notify/ns5/named.conf.in
 @@ -10,17 +10,17 @@
@@ -1065,7 +1062,7 @@ index cfcfe8f..0a1614d 100644
  };
  
 diff --git a/bin/tests/system/notify/tests.sh b/bin/tests/system/notify/tests.sh
-index 1f6e6d0..c08bd25 100644
+index f9fd3f5..916af75 100644
 --- a/bin/tests/system/notify/tests.sh
 +++ b/bin/tests/system/notify/tests.sh
 @@ -212,16 +212,16 @@ ret=0
@@ -1089,7 +1086,7 @@ index 1f6e6d0..c08bd25 100644
  	grep "test string" dig.out.b.ns5.test$n > /dev/null &&
  	grep "test string" dig.out.c.ns5.test$n > /dev/null &&
 diff --git a/bin/tests/system/nsupdate/ns1/named.conf.in b/bin/tests/system/nsupdate/ns1/named.conf.in
-index 1d999ad..26b6b7c 100644
+index b0ded3a..cb80269 100644
 --- a/bin/tests/system/nsupdate/ns1/named.conf.in
 +++ b/bin/tests/system/nsupdate/ns1/named.conf.in
 @@ -32,7 +32,7 @@ controls {
@@ -1102,7 +1099,7 @@ index 1d999ad..26b6b7c 100644
  };
  
 diff --git a/bin/tests/system/nsupdate/ns2/named.conf.in b/bin/tests/system/nsupdate/ns2/named.conf.in
-index 4549184..cb7dccd 100644
+index e6e2382..b0a94e0 100644
 --- a/bin/tests/system/nsupdate/ns2/named.conf.in
 +++ b/bin/tests/system/nsupdate/ns2/named.conf.in
 @@ -33,7 +33,7 @@ controls {
@@ -1115,10 +1112,10 @@ index 4549184..cb7dccd 100644
  };
  
 diff --git a/bin/tests/system/nsupdate/setup.sh b/bin/tests/system/nsupdate/setup.sh
-index 21805c5..0d3d85c 100644
+index 6fbf1d7..a712b17 100644
 --- a/bin/tests/system/nsupdate/setup.sh
 +++ b/bin/tests/system/nsupdate/setup.sh
-@@ -58,7 +58,12 @@ EOF
+@@ -53,7 +53,12 @@ EOF
  
  $DDNSCONFGEN -q -r $RANDFILE -z example.nil > ns1/ddns.key
  
@@ -1133,10 +1130,10 @@ index 21805c5..0d3d85c 100644
  $DDNSCONFGEN -q -r $RANDFILE -a hmac-sha224 -k sha224-key -z keytests.nil > ns1/sha224.key
  $DDNSCONFGEN -q -r $RANDFILE -a hmac-sha256 -k sha256-key -z keytests.nil > ns1/sha256.key
 diff --git a/bin/tests/system/nsupdate/tests.sh b/bin/tests/system/nsupdate/tests.sh
-index 4da4849..b3bc807 100755
+index 6b2c8f6..96ad95e 100755
 --- a/bin/tests/system/nsupdate/tests.sh
 +++ b/bin/tests/system/nsupdate/tests.sh
-@@ -708,7 +708,14 @@ fi
+@@ -788,7 +788,14 @@ fi
  n=`expr $n + 1`
  ret=0
  echo_i "check TSIG key algorithms ($n)"
@@ -1152,7 +1149,7 @@ index 4da4849..b3bc807 100755
      $NSUPDATE -k ns1/${alg}.key <<END > /dev/null || ret=1
  server 10.53.0.1 ${PORT}
  update add ${alg}.keytests.nil. 600 A 10.10.10.3
-@@ -716,7 +723,7 @@ send
+@@ -796,7 +803,7 @@ send
  END
  done
  sleep 2
@@ -1162,10 +1159,10 @@ index 4da4849..b3bc807 100755
  done
  if [ $ret -ne 0 ]; then
 diff --git a/bin/tests/system/rndc/setup.sh b/bin/tests/system/rndc/setup.sh
-index 343869e..c30efb0 100644
+index 2eb2cd5..36f5114 100644
 --- a/bin/tests/system/rndc/setup.sh
 +++ b/bin/tests/system/rndc/setup.sh
-@@ -37,7 +37,7 @@ make_key () {
+@@ -35,7 +35,7 @@ make_key () {
              sed 's/allow { 10.53.0.4/allow { any/' >> ns4/named.conf
  }
  
@@ -1175,7 +1172,7 @@ index 343869e..c30efb0 100644
  make_key 3 ${EXTRAPORT3} hmac-sha224
  make_key 4 ${EXTRAPORT4} hmac-sha256
 diff --git a/bin/tests/system/rndc/tests.sh b/bin/tests/system/rndc/tests.sh
-index 57e066d..186a723 100644
+index 4e25e51..cb8934c 100644
 --- a/bin/tests/system/rndc/tests.sh
 +++ b/bin/tests/system/rndc/tests.sh
 @@ -348,15 +348,20 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
@@ -1208,17 +1205,8 @@ index 57e066d..186a723 100644
  
  n=`expr $n + 1`
  echo_i "testing rndc with hmac-sha1 ($n)"
-diff --git a/bin/tests/system/tsig/clean.sh b/bin/tests/system/tsig/clean.sh
-index 576ec70..cb7a852 100644
---- a/bin/tests/system/tsig/clean.sh
-+++ b/bin/tests/system/tsig/clean.sh
-@@ -20,3 +20,4 @@ rm -f */named.run
- rm -f ns*/named.lock
- rm -f Kexample.net.+163+*
- rm -f keygen.out?
-+rm -f ns1/named.conf
 diff --git a/bin/tests/system/tsig/ns1/named.conf.in b/bin/tests/system/tsig/ns1/named.conf.in
-index fbf30c6..f61657d 100644
+index 4905ffd..958d9fb 100644
 --- a/bin/tests/system/tsig/ns1/named.conf.in
 +++ b/bin/tests/system/tsig/ns1/named.conf.in
 @@ -21,10 +21,7 @@ options {
@@ -1246,10 +1234,10 @@ index fbf30c6..f61657d 100644
  key "sha1-trunc" {
  	secret "FrSt77yPTFx6hTs4i2tKLB9LmE0=";
 diff --git a/bin/tests/system/tsig/setup.sh b/bin/tests/system/tsig/setup.sh
-index 4dd4a25..aa0f966 100644
+index f42aa79..bfcf4a6 100644
 --- a/bin/tests/system/tsig/setup.sh
 +++ b/bin/tests/system/tsig/setup.sh
-@@ -17,3 +17,8 @@ $SHELL clean.sh
+@@ -15,3 +15,8 @@ SYSTEMTESTTOP=..
  copy_setports ns1/named.conf.in ns1/named.conf
  
  test -r $RANDFILE || $GENRANDOM $RANDOMSIZE $RANDFILE
@@ -1259,7 +1247,7 @@ index 4dd4a25..aa0f966 100644
 +	cat ns1/rndc5.conf.in >> ns1/named.conf
 +fi
 diff --git a/bin/tests/system/tsig/tests.sh b/bin/tests/system/tsig/tests.sh
-index f731fa6..cade35b 100644
+index ed41e1d..98c542e 100644
 --- a/bin/tests/system/tsig/tests.sh
 +++ b/bin/tests/system/tsig/tests.sh
 @@ -26,20 +26,25 @@ sha512="jI/Pa4qRu96t76Pns5Z/Ndxbn3QCkwcxLOgt9vgvnJw5wqTRvNyk3FtD6yIMd1dWVlqZ+Y4f
@@ -1273,13 +1261,6 @@ index f731fa6..cade35b 100644
 -if [ $ret -eq 1 ] ; then
 -	echo_i "failed"; status=1
 -fi
--
--echo_i "fetching using hmac-md5 (new form)"
--ret=0
--$DIG $DIGOPTS example.nil. -y "hmac-md5:md5:$md5" @10.53.0.1 soa > dig.out.md5.new || ret=1
--grep -i "md5.*TSIG.*NOERROR" dig.out.md5.new > /dev/null || ret=1
--if [ $ret -eq 1 ] ; then
--	echo_i "failed"; status=1
 +if $FEATURETEST --md5
 +then
 +	echo_i "fetching using hmac-md5 (old form)"
@@ -1289,7 +1270,13 @@ index f731fa6..cade35b 100644
 +	if [ $ret -eq 1 ] ; then
 +		echo_i "failed"; status=1
 +	fi
-+
+ 
+-echo_i "fetching using hmac-md5 (new form)"
+-ret=0
+-$DIG $DIGOPTS example.nil. -y "hmac-md5:md5:$md5" @10.53.0.1 soa > dig.out.md5.new || ret=1
+-grep -i "md5.*TSIG.*NOERROR" dig.out.md5.new > /dev/null || ret=1
+-if [ $ret -eq 1 ] ; then
+-	echo_i "failed"; status=1
 +	echo_i "fetching using hmac-md5 (new form)"
 +	ret=0
 +	$DIG $DIGOPTS example.nil. -y "hmac-md5:md5:$md5" @10.53.0.1 soa > dig.out.md5.new || ret=1
@@ -1351,10 +1338,10 @@ index f731fa6..cade35b 100644
  
  echo_i "fetching using hmac-sha1-80 (BADTRUNC)"
 diff --git a/bin/tests/system/tsiggss/setup.sh b/bin/tests/system/tsiggss/setup.sh
-index 0d21c7b..dbcb7b4 100644
+index f04c907..09da5f9 100644
 --- a/bin/tests/system/tsiggss/setup.sh
 +++ b/bin/tests/system/tsiggss/setup.sh
-@@ -18,5 +18,5 @@ test -r $RANDFILE || $GENRANDOM $RANDOMSIZE $RANDFILE
+@@ -16,5 +16,5 @@ test -r $RANDFILE || $GENRANDOM $RANDOMSIZE $RANDFILE
  
  copy_setports ns1/named.conf.in ns1/named.conf
  
@@ -1362,7 +1349,7 @@ index 0d21c7b..dbcb7b4 100644
 +key=`$KEYGEN -Cq -K ns1 -a DSA -b 1024 -r $RANDFILE -n HOST -T KEY key.example.nil.`
  cat ns1/example.nil.db.in ns1/${key}.key > ns1/example.nil.db
 diff --git a/bin/tests/system/upforwd/ns1/named.conf.in b/bin/tests/system/upforwd/ns1/named.conf.in
-index e0a30cd..6a77b1c 100644
+index 4ddd7a4..238f52a 100644
 --- a/bin/tests/system/upforwd/ns1/named.conf.in
 +++ b/bin/tests/system/upforwd/ns1/named.conf.in
 @@ -10,7 +10,7 @@
@@ -1375,7 +1362,7 @@ index e0a30cd..6a77b1c 100644
  };
  
 diff --git a/bin/tests/system/upforwd/tests.sh b/bin/tests/system/upforwd/tests.sh
-index b0694bb..9adae82 100644
+index 1cf8d3b..f4c3216 100644
 --- a/bin/tests/system/upforwd/tests.sh
 +++ b/bin/tests/system/upforwd/tests.sh
 @@ -68,7 +68,7 @@ if [ $ret != 0 ] ; then echo_i "failed"; status=`expr $status + $ret`; fi
@@ -1387,22 +1374,6 @@ index b0694bb..9adae82 100644
  server 10.53.0.3 ${PORT}
  update add updated.example. 600 A 10.10.10.1
  update add updated.example. 600 TXT Foo
-diff --git a/bin/tests/system/tsig/ns1/rndc5.conf.in b/bin/tests/system/tsig/ns1/rndc5.conf.in
-new file mode 100644
-index 0000000..0682194
---- /dev/null
-+++ b/bin/tests/system/tsig/ns1/rndc5.conf.in
-@@ -0,0 +1,10 @@
-+# Conditionally included when support for MD5 is available
-+key "md5" {
-+	secret "97rnFx24Tfna4mHPfgnerA==";
-+	algorithm hmac-md5;
-+};
-+
-+key "md5-trunc" {
-+	secret "97rnFx24Tfna4mHPfgnerA==";
-+	algorithm hmac-md5-80;
-+};
 -- 
-2.20.1
+2.26.2
 

bind-9.11-rh1624100.patch

@@ -1,288 +0,0 @@
-From 76594cba9a1e910bb36160d96fc3872349341799 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@sury.org>
-Date: Wed, 25 Apr 2018 14:04:31 +0200
-Subject: [PATCH] Replace isc_safe routines with their OpenSSL counter parts
-
-(cherry picked from commit 66ba2fdad583d962a1f4971c85d58381f0849e4d)
-
-Remove isc_safe_memcompare, it's not needed anywhere and can't be replaced with CRYPTO_memcmp()
-
-(cherry picked from commit b105ccee68ccc3c18e6ea530063b3c8e5a42571c)
-
-Fix the isc_safe_memwipe() usage with (NULL, >0)
-
-(cherry picked from commit 083461d3329ff6f2410745848a926090586a9846)
----
- bin/dnssec/dnssec-signzone.c |  2 +-
- lib/dns/nsec3.c              |  4 +-
- lib/dns/spnego.c             |  4 +-
- lib/isc/Makefile.in          |  8 +---
- lib/isc/include/isc/safe.h   | 18 ++------
- lib/isc/safe.c               | 83 ------------------------------------
- lib/isc/tests/safe_test.c    | 18 --------
- 7 files changed, 11 insertions(+), 126 deletions(-)
- delete mode 100644 lib/isc/safe.c
-
-diff --git a/bin/dnssec/dnssec-signzone.c b/bin/dnssec/dnssec-signzone.c
-index 6ddaebe..d921870 100644
---- a/bin/dnssec/dnssec-signzone.c
-+++ b/bin/dnssec/dnssec-signzone.c
-@@ -787,7 +787,7 @@ hashlist_add_dns_name(hashlist_t *l, /*const*/ dns_name_t *name,
- 
- static int
- hashlist_comp(const void *a, const void *b) {
--	return (isc_safe_memcompare(a, b, hash_length + 1));
-+	return (memcmp(a, b, hash_length + 1));
- }
- 
- static void
-diff --git a/lib/dns/nsec3.c b/lib/dns/nsec3.c
-index 6ae7ca8..01426d6 100644
---- a/lib/dns/nsec3.c
-+++ b/lib/dns/nsec3.c
-@@ -1963,7 +1963,7 @@ dns_nsec3_noexistnodata(dns_rdatatype_t type, dns_name_t* name,
- 	 * Work out what this NSEC3 covers.
- 	 * Inside (<0) or outside (>=0).
- 	 */
--	scope = isc_safe_memcompare(owner, nsec3.next, nsec3.next_length);
-+	scope = memcmp(owner, nsec3.next, nsec3.next_length);
- 
- 	/*
- 	 * Prepare to compute all the hashes.
-@@ -1987,7 +1987,7 @@ dns_nsec3_noexistnodata(dns_rdatatype_t type, dns_name_t* name,
- 			return (ISC_R_IGNORE);
- 		}
- 
--		order = isc_safe_memcompare(hash, owner, length);
-+		order = memcmp(hash, owner, length);
- 		if (first && order == 0) {
- 			/*
- 			 * The hashes are the same.
-diff --git a/lib/dns/spnego.c b/lib/dns/spnego.c
-index ad77f24..670982a 100644
---- a/lib/dns/spnego.c
-+++ b/lib/dns/spnego.c
-@@ -371,7 +371,7 @@ gssapi_spnego_decapsulate(OM_uint32 *,
- 
- /* mod_auth_kerb.c */
- 
--static int
-+static isc_boolean_t
- cmp_gss_type(gss_buffer_t token, gss_OID gssoid)
- {
- 	unsigned char *p;
-@@ -395,7 +395,7 @@ cmp_gss_type(gss_buffer_t token, gss_OID gssoid)
- 	if (((OM_uint32) *p++) != gssoid->length)
- 		return (GSS_S_DEFECTIVE_TOKEN);
- 
--	return (isc_safe_memcompare(p, gssoid->elements, gssoid->length));
-+	return (!isc_safe_memequal(p, gssoid->elements, gssoid->length));
- }
- 
- /* accept_sec_context.c */
-diff --git a/lib/isc/Makefile.in b/lib/isc/Makefile.in
-index 0fd0837..8ad54bb 100644
---- a/lib/isc/Makefile.in
-+++ b/lib/isc/Makefile.in
-@@ -60,7 +60,7 @@ OBJS =		@ISC_EXTRA_OBJS@ @ISC_PK11_O@ @ISC_PK11_RESULT_O@ \
- 		parseint.@O@ portset.@O@ quota.@O@ radix.@O@ random.@O@ \
- 		ratelimiter.@O@ refcount.@O@ region.@O@ regex.@O@ result.@O@ \
- 		rwlock.@O@ \
--		safe.@O@ serial.@O@ siphash.@O@ sha1.@O@ sha2.@O@ sockaddr.@O@ stats.@O@ \
-+		serial.@O@ siphash.@O@ sha1.@O@ sha2.@O@ sockaddr.@O@ stats.@O@ \
- 		string.@O@ strtoul.@O@ symtab.@O@ task.@O@ taskpool.@O@ \
- 		tm.@O@ timer.@O@ version.@O@ \
- 		${UNIXOBJS} ${NLSOBJS} ${THREADOBJS}
-@@ -79,7 +79,7 @@ SRCS =		@ISC_EXTRA_SRCS@ @ISC_PK11_C@ @ISC_PK11_RESULT_C@ \
- 		netaddr.c netscope.c pool.c ondestroy.c \
- 		parseint.c portset.c quota.c radix.c random.c ${CHACHASRCS} \
- 		ratelimiter.c refcount.c region.c regex.c result.c rwlock.c \
--		safe.c serial.c siphash.c sha1.c sha2.c sockaddr.c stats.c string.c \
-+		serial.c siphash.c sha1.c sha2.c sockaddr.c stats.c string.c \
- 		strtoul.c symtab.c task.c taskpool.c timer.c \
- 		tm.c version.c
- 
-@@ -95,10 +95,6 @@ TESTDIRS =	@UNITTESTS@
- 
- @BIND9_MAKE_RULES@
- 
--safe.@O@: safe.c
--	${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} @CCNOOPT@ \
--		-c ${srcdir}/safe.c
--
- version.@O@: version.c
- 	${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} \
- 		-DVERSION=\"${VERSION}\" \
-diff --git a/lib/isc/include/isc/safe.h b/lib/isc/include/isc/safe.h
-index 66ed08b..88b8f47 100644
---- a/lib/isc/include/isc/safe.h
-+++ b/lib/isc/include/isc/safe.h
-@@ -15,29 +15,19 @@
- 
- /*! \file isc/safe.h */
- 
--#include <stdbool.h>
--
--#include <isc/types.h>
--#include <stdlib.h>
-+#include <isc/lang.h>
-+#include <openssl/crypto.h>
- 
- ISC_LANG_BEGINDECLS
- 
--bool
--isc_safe_memequal(const void *s1, const void *s2, size_t n);
-+#define isc_safe_memequal(s1, s2, n) !CRYPTO_memcmp(s1, s2, n)
- /*%<
-  * Returns true iff. two blocks of memory are equal, otherwise
-  * false.
-  *
-  */
- 
--int
--isc_safe_memcompare(const void *b1, const void *b2, size_t len);
--/*%<
-- * Clone of libc memcmp() which is safe to differential timing attacks.
-- */
--
--void
--isc_safe_memwipe(void *ptr, size_t len);
-+#define isc_safe_memwipe(ptr, len) OPENSSL_cleanse(ptr, len)
- /*%<
-  * Clear the memory of length `len` pointed to by `ptr`.
-  *
-diff --git a/lib/isc/safe.c b/lib/isc/safe.c
-deleted file mode 100644
-index 7a464b6..0000000
---- a/lib/isc/safe.c
-+++ /dev/null
-@@ -1,83 +0,0 @@
--/*
-- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-- *
-- * This Source Code Form is subject to the terms of the Mozilla Public
-- * License, v. 2.0. If a copy of the MPL was not distributed with this
-- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
-- *
-- * See the COPYRIGHT file distributed with this work for additional
-- * information regarding copyright ownership.
-- */
--
--/*! \file */
--
--#include <config.h>
--
--#include <stdbool.h>
--
--#include <isc/safe.h>
--#include <isc/string.h>
--#include <isc/util.h>
--
--#ifdef WIN32
--#include <windows.h>
--#endif
--
--#ifdef _MSC_VER
--#pragma optimize("", off)
--#endif
--
--bool
--isc_safe_memequal(const void *s1, const void *s2, size_t n) {
--	uint8_t acc = 0;
--
--	if (n != 0U) {
--		const uint8_t *p1 = s1, *p2 = s2;
--
--		do {
--			acc |= *p1++ ^ *p2++;
--		} while (--n != 0U);
--	}
--	return (acc == 0);
--}
--
--
--int
--isc_safe_memcompare(const void *b1, const void *b2, size_t len) {
--	const unsigned char *p1 = b1, *p2 = b2;
--	size_t i;
--	int res = 0, done = 0;
--
--	for (i = 0; i < len; i++) {
--		/* lt is -1 if p1[i] < p2[i]; else 0. */
--		int lt = (p1[i] - p2[i]) >> CHAR_BIT;
--
--		/* gt is -1 if p1[i] > p2[i]; else 0. */
--		int gt = (p2[i] - p1[i]) >> CHAR_BIT;
--
--		/* cmp is 1 if p1[i] > p2[i]; -1 if p1[i] < p2[i]; else 0. */
--		int cmp = lt - gt;
--
--		/* set res = cmp if !done. */
--		res |= cmp & ~done;
--
--		/* set done if p1[i] != p2[i]. */
--		done |= lt | gt;
--	}
--
--	return (res);
--}
--
--void
--isc_safe_memwipe(void *ptr, size_t len) {
--	if (ISC_UNLIKELY(ptr == NULL || len == 0))
--		return;
--
--#ifdef WIN32
--	SecureZeroMemory(ptr, len);
--#elif HAVE_EXPLICIT_BZERO
--	explicit_bzero(ptr, len);
--#else
--	memset(ptr, 0, len);
--#endif
--}
-diff --git a/lib/isc/tests/safe_test.c b/lib/isc/tests/safe_test.c
-index 266ac75..60e9181 100644
---- a/lib/isc/tests/safe_test.c
-+++ b/lib/isc/tests/safe_test.c
-@@ -45,22 +45,6 @@ isc_safe_memequal_test(void **state) {
- 				       "\x00\x00\x00\x00", 4));
- }
- 
--/* test isc_safe_memcompare() */
--static void
--isc_safe_memcompare_test(void **state) {
--	UNUSED(state);
--
--	assert_int_equal(isc_safe_memcompare("test", "test", 4), 0);
--	assert_true(isc_safe_memcompare("test", "tesc", 4) > 0);
--	assert_true(isc_safe_memcompare("test", "tesy", 4) < 0);
--	assert_int_equal(isc_safe_memcompare("\x00\x00\x00\x00",
--					     "\x00\x00\x00\x00", 4), 0);
--	assert_true(isc_safe_memcompare("\x00\x00\x00\x00",
--					"\x00\x00\x00\x01", 4) < 0);
--	assert_true(isc_safe_memcompare("\x00\x00\x00\x02",
--					"\x00\x00\x00\x00", 4) > 0);
--}
--
- /* test isc_safe_memwipe() */
- static void
- isc_safe_memwipe_test(void **state) {
-@@ -69,7 +53,6 @@ isc_safe_memwipe_test(void **state) {
- 	/* These should pass. */
- 	isc_safe_memwipe(NULL, 0);
- 	isc_safe_memwipe((void *) -1, 0);
--	isc_safe_memwipe(NULL, 42);
- 
- 	/*
- 	 * isc_safe_memwipe(ptr, size) should function same as
-@@ -108,7 +91,6 @@ main(void) {
- 	const struct CMUnitTest tests[] = {
- 		cmocka_unit_test(isc_safe_memequal_test),
- 		cmocka_unit_test(isc_safe_memwipe_test),
--		cmocka_unit_test(isc_safe_memcompare_test),
- 	};
- 
- 	return (cmocka_run_group_tests(tests, NULL, NULL));
--- 
-2.20.1
-

bind-9.11-rh1736762-5.patch

@@ -1,59 +0,0 @@
-From 6257d829c9d7e71ac51bcdc6b5b981c7a19200e2 Mon Sep 17 00:00:00 2001
-From: Mark Andrews <marka@isc.org>
-Date: Mon, 25 Nov 2019 05:46:55 +0000
-Subject: [PATCH] Merge branch
- '1373-threadsanitizer-data-race-rbtdb-c-5193-in-detachnode' into 'master'
-
-Resolve "ThreadSanitizer: data race rbtdb.c:5193 in detachnode"
-
-Closes #1373
-
-See merge request isc-projects/bind9!2598
----
- lib/dns/include/dns/rbt.h | 22 +++++++++-------------
- 1 file changed, 9 insertions(+), 13 deletions(-)
-
-diff --git a/lib/dns/include/dns/rbt.h b/lib/dns/include/dns/rbt.h
-index 67ac3e4d8a..a084bd6193 100644
---- a/lib/dns/include/dns/rbt.h
-+++ b/lib/dns/include/dns/rbt.h
-@@ -49,10 +49,7 @@ ISC_LANG_BEGINDECLS
- 
- #define DNS_RBT_USEMAGIC 1
- 
--/*
-- * These should add up to 30.
-- */
--#define DNS_RBT_LOCKLENGTH                      10
-+#define DNS_RBT_LOCKLENGTH		(sizeof(((dns_rbtnode_t *)0)->locknum)*8)
- #define DNS_RBT_REFLENGTH                       20
- 
- #define DNS_RBTNODE_MAGIC               ISC_MAGIC('R','B','N','O')
-@@ -159,16 +156,15 @@ struct dns_rbtnode {
- 	 * separate region of memory.
- 	 */
- 	void *data;
--	unsigned int :0;                /* start of bitfields c/o node lock */
--	unsigned int dirty:1;
--	unsigned int wild:1;
--	unsigned int locknum:DNS_RBT_LOCKLENGTH;
--#ifndef DNS_RBT_USEISCREFCOUNT
--	unsigned int references:DNS_RBT_REFLENGTH;
--#endif
--	unsigned int :0;                /* end of bitfields c/o node lock */
-+	uint8_t :0;                /* start of bitfields c/o node lock */
-+	uint8_t dirty:1;
-+	uint8_t wild:1;
-+	uint8_t :0;                /* end of bitfields c/o node lock */
-+	uint16_t locknum;	   /* note that this is not in the bitfield */
- #ifdef DNS_RBT_USEISCREFCOUNT
--	isc_refcount_t references; /* note that this is not in the bitfield */
-+	isc_refcount_t references;
-+#else
-+	unsigned int references:DNS_RBT_REFLENGTH;
- #endif
- 	/*@}*/
- };
--- 
-2.21.0
-

bind-9.11-rt31459.patch

@@ -1,4 +1,4 @@
-From 5c29299e43db5a4e6f8b1b07af84dfe1687c4c2b Mon Sep 17 00:00:00 2001
+From 08003079bbb017325bf7a52c2f902308a22dd0d7 Mon Sep 17 00:00:00 2001
 From: Evan Hunt <each@isc.org>
 Date: Tue, 12 Sep 2017 19:05:46 -0700
 Subject: [PATCH] rebased rt31459c
@@ -53,7 +53,7 @@ Include new unit test
  create mode 100644 lib/dns/tests/dstrandom_test.c
 
 diff --git a/bin/confgen/keygen.c b/bin/confgen/keygen.c
-index 5015abb..295e16f 100644
+index 40cf74c..bd269e7 100644
 --- a/bin/confgen/keygen.c
 +++ b/bin/confgen/keygen.c
 @@ -165,6 +165,13 @@ generate_key(isc_mem_t *mctx, const char *randomfile, dns_secalg_t alg,
@@ -71,7 +71,7 @@ index 5015abb..295e16f 100644
  							     &entropy_source,
  							     randomfile,
 diff --git a/bin/dnssec/dnssec-dsfromkey.c b/bin/dnssec/dnssec-dsfromkey.c
-index d9d6bb9..de4b15f 100644
+index 4420f2d..9cb63a8 100644
 --- a/bin/dnssec/dnssec-dsfromkey.c
 +++ b/bin/dnssec/dnssec-dsfromkey.c
 @@ -498,14 +498,14 @@ main(int argc, char **argv) {
@@ -103,7 +103,7 @@ index d9d6bb9..de4b15f 100644
  	dns_name_destroy();
  	if (verbose > 10)
 diff --git a/bin/dnssec/dnssec-importkey.c b/bin/dnssec/dnssec-importkey.c
-index d65a514..04b3094 100644
+index dc9a293..52863a1 100644
 --- a/bin/dnssec/dnssec-importkey.c
 +++ b/bin/dnssec/dnssec-importkey.c
 @@ -404,14 +404,14 @@ main(int argc, char **argv) {
@@ -135,7 +135,7 @@ index d65a514..04b3094 100644
  	dns_name_destroy();
  	if (verbose > 10)
 diff --git a/bin/dnssec/dnssec-revoke.c b/bin/dnssec/dnssec-revoke.c
-index 7d82dbf..10f9359 100644
+index 0121a34..74a99b0 100644
 --- a/bin/dnssec/dnssec-revoke.c
 +++ b/bin/dnssec/dnssec-revoke.c
 @@ -184,14 +184,14 @@ main(int argc, char **argv) {
@@ -167,10 +167,10 @@ index 7d82dbf..10f9359 100644
  	if (verbose > 10)
  		isc_mem_stats(mctx, stdout);
 diff --git a/bin/dnssec/dnssec-settime.c b/bin/dnssec/dnssec-settime.c
-index 7afcaee..1cfa511 100644
+index f017895..2c568fc 100644
 --- a/bin/dnssec/dnssec-settime.c
 +++ b/bin/dnssec/dnssec-settime.c
-@@ -380,14 +380,14 @@ main(int argc, char **argv) {
+@@ -391,14 +391,14 @@ main(int argc, char **argv) {
  
  	if (ectx == NULL)
  		setup_entropy(mctx, NULL, &ectx);
@@ -188,7 +188,7 @@ index 7afcaee..1cfa511 100644
  	isc_entropy_stopcallbacksources(ectx);
  
  	if (predecessor != NULL) {
-@@ -672,8 +672,8 @@ main(int argc, char **argv) {
+@@ -683,8 +683,8 @@ main(int argc, char **argv) {
  	if (prevkey != NULL)
  		dst_key_free(&prevkey);
  	dst_key_free(&key);
@@ -199,10 +199,10 @@ index 7afcaee..1cfa511 100644
  	if (verbose > 10)
  		isc_mem_stats(mctx, stdout);
 diff --git a/bin/dnssec/dnssec-signzone.c b/bin/dnssec/dnssec-signzone.c
-index 319a805..27ae4d4 100644
+index dde1b2f..7308fc6 100644
 --- a/bin/dnssec/dnssec-signzone.c
 +++ b/bin/dnssec/dnssec-signzone.c
-@@ -3460,14 +3460,15 @@ main(int argc, char *argv[]) {
+@@ -3465,14 +3465,15 @@ main(int argc, char *argv[]) {
  	if (!pseudorandom)
  		eflags |= ISC_ENTROPY_GOODONLY;
  
@@ -222,7 +222,7 @@ index 319a805..27ae4d4 100644
  	isc_stdtime_get(&now);
  
  	if (startstr != NULL) {
-@@ -3879,8 +3880,8 @@ main(int argc, char *argv[]) {
+@@ -3884,8 +3885,8 @@ main(int argc, char *argv[]) {
  	dns_master_styledestroy(&dsstyle, mctx);
  
  	cleanup_logging(&log);
@@ -233,7 +233,7 @@ index 319a805..27ae4d4 100644
  	dns_name_destroy();
  	if (verbose > 10)
 diff --git a/bin/dnssec/dnssec-verify.c b/bin/dnssec/dnssec-verify.c
-index 4c293bf..3263cbc 100644
+index 087cd5d..07c7294 100644
 --- a/bin/dnssec/dnssec-verify.c
 +++ b/bin/dnssec/dnssec-verify.c
 @@ -281,15 +281,15 @@ main(int argc, char *argv[]) {
@@ -257,7 +257,7 @@ index 4c293bf..3263cbc 100644
  
  	rdclass = strtoclass(classname);
 diff --git a/bin/dnssec/dnssectool.c b/bin/dnssec/dnssectool.c
-index 618ec5b..5654435 100644
+index 7f045e8..2a0f9c6 100644
 --- a/bin/dnssec/dnssectool.c
 +++ b/bin/dnssec/dnssectool.c
 @@ -34,6 +34,7 @@
@@ -293,7 +293,7 @@ index 618ec5b..5654435 100644
  					   usekeyboard);
  
 diff --git a/bin/named/server.c b/bin/named/server.c
-index 4e503e5..f27071f 100644
+index 30d38be..b2ae57c 100644
 --- a/bin/named/server.c
 +++ b/bin/named/server.c
 @@ -36,6 +36,7 @@
@@ -304,7 +304,7 @@ index 4e503e5..f27071f 100644
  #include <isc/portset.h>
  #include <isc/print.h>
  #include <isc/random.h>
-@@ -8217,6 +8218,10 @@ load_configuration(const char *filename, ns_server_t *server,
+@@ -8286,6 +8287,10 @@ load_configuration(const char *filename, ns_server_t *server,
  				      "no source of entropy found");
  		} else {
  			const char *randomdev = cfg_obj_asstring(obj);
@@ -315,7 +315,7 @@ index 4e503e5..f27071f 100644
  			int level = ISC_LOG_ERROR;
  			result = isc_entropy_createfilesource(ns_g_entropy,
  							      randomdev);
-@@ -8251,6 +8256,7 @@ load_configuration(const char *filename, ns_server_t *server,
+@@ -8320,6 +8325,7 @@ load_configuration(const char *filename, ns_server_t *server,
  				}
  				isc_entropy_detach(&ns_g_fallbackentropy);
  			}
@@ -324,10 +324,10 @@ index 4e503e5..f27071f 100644
  		}
  
 diff --git a/bin/nsupdate/nsupdate.c b/bin/nsupdate/nsupdate.c
-index bbb3936..0286987 100644
+index c20c6e3..db47b3b 100644
 --- a/bin/nsupdate/nsupdate.c
 +++ b/bin/nsupdate/nsupdate.c
-@@ -272,7 +272,8 @@ setup_entropy(isc_mem_t *mctx, const char *randomfile, isc_entropy_t **ectx) {
+@@ -278,7 +278,8 @@ setup_entropy(isc_mem_t *mctx, const char *randomfile, isc_entropy_t **ectx) {
  	if (*ectx == NULL) {
  		result = isc_entropy_create(mctx, ectx);
  		if (result != ISC_R_SUCCESS)
@@ -337,7 +337,7 @@ index bbb3936..0286987 100644
  		ISC_LIST_INIT(sources);
  	}
  
-@@ -281,6 +282,13 @@ setup_entropy(isc_mem_t *mctx, const char *randomfile, isc_entropy_t **ectx) {
+@@ -287,6 +288,13 @@ setup_entropy(isc_mem_t *mctx, const char *randomfile, isc_entropy_t **ectx) {
  		randomfile = NULL;
  	}
  
@@ -351,7 +351,7 @@ index bbb3936..0286987 100644
  	result = isc_entropy_usebestsource(*ectx, &source, randomfile,
  					   usekeyboard);
  
-@@ -979,11 +987,11 @@ setup_system(void) {
+@@ -989,11 +997,11 @@ setup_system(void) {
  		}
  	}
  
@@ -366,7 +366,7 @@ index bbb3936..0286987 100644
  	result = dns_dispatchmgr_create(gmctx, entropy, &dispatchmgr);
  	check_result(result, "dns_dispatchmgr_create");
 diff --git a/bin/tests/makejournal.c b/bin/tests/makejournal.c
-index 61a41b0..acc71a1 100644
+index 68b5e5a..cd54c8d 100644
 --- a/bin/tests/makejournal.c
 +++ b/bin/tests/makejournal.c
 @@ -102,12 +102,12 @@ main(int argc, char **argv) {
@@ -386,7 +386,7 @@ index 61a41b0..acc71a1 100644
  	isc_log_registercategories(lctx, categories);
  	isc_log_setcontext(lctx);
 diff --git a/bin/tests/system/pipelined/pipequeries.c b/bin/tests/system/pipelined/pipequeries.c
-index c6ab7f8..f0a6ff2 100644
+index e16ec11..95b65bf 100644
 --- a/bin/tests/system/pipelined/pipequeries.c
 +++ b/bin/tests/system/pipelined/pipequeries.c
 @@ -204,6 +204,7 @@ sendqueries(isc_task_t *task, isc_event_t *event) {
@@ -448,7 +448,7 @@ index c6ab7f8..f0a6ff2 100644
  
  	isc_log_destroy(&lctx);
 diff --git a/bin/tests/system/pipelined/tests.sh b/bin/tests/system/pipelined/tests.sh
-index 61f1ff7..ed1302a 100644
+index c0a99a2..0245527 100644
 --- a/bin/tests/system/pipelined/tests.sh
 +++ b/bin/tests/system/pipelined/tests.sh
 @@ -19,7 +19,7 @@ status=0
@@ -470,7 +470,7 @@ index 61f1ff7..ed1302a 100644
  $DIFF refb outputb || ret=1
  if [ $ret != 0 ]; then echo_i "failed"; fi
 diff --git a/bin/tests/system/rsabigexponent/bigkey.c b/bin/tests/system/rsabigexponent/bigkey.c
-index 4462f2e..f06268d 100644
+index abf12ed..fa5182c 100644
 --- a/bin/tests/system/rsabigexponent/bigkey.c
 +++ b/bin/tests/system/rsabigexponent/bigkey.c
 @@ -20,6 +20,7 @@
@@ -492,7 +492,7 @@ index 4462f2e..f06268d 100644
  					"../random.data",
  					ISC_ENTROPY_KEYBOARDNO),
 diff --git a/bin/tests/system/tkey/keycreate.c b/bin/tests/system/tkey/keycreate.c
-index 653c951..fe8698e 100644
+index 34360aa..3236968 100644
 --- a/bin/tests/system/tkey/keycreate.c
 +++ b/bin/tests/system/tkey/keycreate.c
 @@ -206,6 +206,7 @@ sendquery(isc_task_t *task, isc_event_t *event) {
@@ -561,7 +561,7 @@ index 653c951..fe8698e 100644
  
  	isc_mem_destroy(&mctx);
 diff --git a/bin/tests/system/tkey/keydelete.c b/bin/tests/system/tkey/keydelete.c
-index 70a40c3..2146f9b 100644
+index 4b5b901..43fb6b0 100644
 --- a/bin/tests/system/tkey/keydelete.c
 +++ b/bin/tests/system/tkey/keydelete.c
 @@ -136,6 +136,7 @@ sendquery(isc_task_t *task, isc_event_t *event) {
@@ -630,50 +630,50 @@ index 70a40c3..2146f9b 100644
  
  	isc_mem_destroy(&mctx);
 diff --git a/bin/tests/system/tkey/tests.sh b/bin/tests/system/tkey/tests.sh
-index 9f90dd7..fad6c83 100644
+index b265156..bcd60a6 100644
 --- a/bin/tests/system/tkey/tests.sh
 +++ b/bin/tests/system/tkey/tests.sh
 @@ -33,7 +33,7 @@ for owner in . foo.example.
  do
- 	echo "I:creating new key using owner name \"$owner\""
+ 	echo_i "creating new key using owner name \"$owner\" ($n)"
  	ret=0
 -	keyname=`$KEYCREATE $dhkeyname $owner` || ret=1
 +	keyname=`$KEYCREATE -r $RANDFILE $dhkeyname $owner` || ret=1
  	if [ $ret != 0 ]; then
- 		echo "I:failed"
- 		status=`expr $status + $ret`
-@@ -55,7 +55,7 @@ do
+ 		echo_i "failed"
+ 		status=$((status+ret))
+@@ -57,7 +57,7 @@ do
  
- 	echo "I:deleting new key"
+ 	echo_i "deleting new key ($n)"
  	ret=0
 -	$KEYDELETE $keyname || ret=1
 +	$KEYDELETE -r $RANDFILE $keyname || ret=1
  	if [ $ret != 0 ]; then
- 		echo "I:failed"
+ 		echo_i "failed"
  	fi
-@@ -75,7 +75,7 @@ done
+@@ -79,7 +79,7 @@ done
  
- echo "I:creating new key using owner name bar.example."
+ echo_i "creating new key using owner name bar.example. ($n)"
  ret=0
 -keyname=`$KEYCREATE $dhkeyname bar.example.` || ret=1
 +keyname=`$KEYCREATE -r $RANDFILE $dhkeyname bar.example.` || ret=1
  if [ $ret != 0 ]; then
-         echo "I:failed"
- 	status=`expr $status + $ret`
-@@ -116,7 +116,7 @@ status=`expr $status + $ret`
+         echo_i "failed"
+ 	status=$((status+ret))
+@@ -124,7 +124,7 @@ n=$((n+1))
  
- echo "I:recreating the bar.example. key"
+ echo_i "recreating the bar.example. key ($n)"
  ret=0
 -keyname=`$KEYCREATE $dhkeyname bar.example.` || ret=1
 +keyname=`$KEYCREATE -r $RANDFILE $dhkeyname bar.example.` || ret=1
  if [ $ret != 0 ]; then
-         echo "I:failed"
- 	status=`expr $status + $ret`
+         echo_i "failed"
+ 	status=$((status+ret))
 diff --git a/bin/tools/mdig.c b/bin/tools/mdig.c
-index bf6dbb6..0416b21 100644
+index 26fa609..fb34aa0 100644
 --- a/bin/tools/mdig.c
 +++ b/bin/tools/mdig.c
-@@ -1972,12 +1972,11 @@ main(int argc, char *argv[]) {
+@@ -2005,12 +2005,11 @@ main(int argc, char *argv[]) {
  
  	ectx = NULL;
  	RUNCHECK(isc_entropy_create(mctx, &ectx));
@@ -688,7 +688,7 @@ index bf6dbb6..0416b21 100644
  	parse_args(false, argc, argv);
  	if (server == NULL)
 diff --git a/configure b/configure
-index 6d05371..33689c9 100755
+index 97e184f..36a6330 100755
 --- a/configure
 +++ b/configure
 @@ -640,6 +640,7 @@ ac_includes_default="\
@@ -699,7 +699,7 @@ index 6d05371..33689c9 100755
  BUILD_LIBS
  BUILD_LDFLAGS
  BUILD_CPPFLAGS
-@@ -823,6 +824,7 @@ LIBXML2_CFLAGS
+@@ -822,6 +823,7 @@ LIBXML2_CFLAGS
  NZDTARGETS
  NZDSRCS
  NZD_TOOLS
@@ -707,7 +707,7 @@ index 6d05371..33689c9 100755
  PKCS11_TEST
  PKCS11_ED25519
  PKCS11_GOST
-@@ -1047,6 +1049,7 @@ with_eddsa
+@@ -1046,6 +1048,7 @@ with_eddsa
  with_aes
  enable_openssl_hash
  with_cc_alg
@@ -715,7 +715,7 @@ index 6d05371..33689c9 100755
  with_lmdb
  with_libxml2
  with_libjson
-@@ -1749,6 +1752,7 @@ Optional Features:
+@@ -1747,6 +1750,7 @@ Optional Features:
    --enable-threads        enable multithreading
    --enable-native-pkcs11  use native PKCS11 for all crypto [default=no]
    --enable-openssl-hash   use OpenSSL for hash functions [default=no]
@@ -723,7 +723,7 @@ index 6d05371..33689c9 100755
    --enable-largefile      64-bit file support
    --enable-backtrace      log stack backtrace on abort [default=yes]
    --enable-symtable       use internal symbol table for backtrace
-@@ -17144,6 +17148,7 @@ case "$use_openssl" in
+@@ -17202,6 +17206,7 @@ case "$use_openssl" in
  $as_echo "disabled because of native PKCS11" >&6; }
  		DST_OPENSSL_INC=""
  		CRYPTO="-DPKCS11CRYPTO"
@@ -731,7 +731,7 @@ index 6d05371..33689c9 100755
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -17158,6 +17163,7 @@ $as_echo "disabled because of native PKCS11" >&6; }
+@@ -17216,6 +17221,7 @@ $as_echo "disabled because of native PKCS11" >&6; }
  $as_echo "no" >&6; }
  		DST_OPENSSL_INC=""
  		CRYPTO=""
@@ -739,7 +739,7 @@ index 6d05371..33689c9 100755
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -17170,6 +17176,7 @@ $as_echo "no" >&6; }
+@@ -17228,6 +17234,7 @@ $as_echo "no" >&6; }
  	auto)
  		DST_OPENSSL_INC=""
  		CRYPTO=""
@@ -747,7 +747,7 @@ index 6d05371..33689c9 100755
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -17179,7 +17186,7 @@ $as_echo "no" >&6; }
+@@ -17237,7 +17244,7 @@ $as_echo "no" >&6; }
  		OPENSSLLINKOBJS=""
  		OPENSSLLINKSRCS=""
  		as_fn_error $? "OpenSSL was not found in any of $openssldirs; use --with-openssl=/path
@@ -756,7 +756,7 @@ index 6d05371..33689c9 100755
  		;;
  	*)
  		if test "yes" = "$want_native_pkcs11"
-@@ -17210,6 +17217,7 @@ $as_echo "not found" >&6; }
+@@ -17268,6 +17275,7 @@ $as_echo "not found" >&6; }
  			as_fn_error $? "\"$use_openssl/include/openssl/opensslv.h\" not found" "$LINENO" 5
  		fi
  		CRYPTO='-DOPENSSL'
@@ -764,7 +764,7 @@ index 6d05371..33689c9 100755
  		if test "/usr" = "$use_openssl"
  		then
  			DST_OPENSSL_INC=""
-@@ -17835,8 +17843,6 @@ fi
+@@ -17902,8 +17910,6 @@ fi
  # Use OpenSSL for hash functions
  #
  
@@ -773,7 +773,7 @@ index 6d05371..33689c9 100755
  ISC_PLATFORM_OPENSSLHASH="#undef ISC_PLATFORM_OPENSSLHASH"
  case $want_openssl_hash in
  	yes)
-@@ -18211,6 +18217,86 @@ if test "rt" = "$have_clock_gt"; then
+@@ -18278,6 +18284,86 @@ if test "rt" = "$have_clock_gt"; then
  	LIBS="-lrt $LIBS"
  fi
  
@@ -860,7 +860,7 @@ index 6d05371..33689c9 100755
  #
  # was --with-lmdb specified?
  #
-@@ -20441,9 +20527,12 @@ _ACEOF
+@@ -20554,9 +20640,12 @@ _ACEOF
  if ac_fn_c_try_compile "$LINENO"; then :
    { $as_echo "$as_me:${as_lineno-$LINENO}: result: size_t for buflen; int for flags" >&5
  $as_echo "size_t for buflen; int for flags" >&6; }
@@ -875,7 +875,7 @@ index 6d05371..33689c9 100755
  
  	 $as_echo "#define IRS_GETNAMEINFO_FLAGS_T int" >>confdefs.h
  
-@@ -21758,12 +21847,7 @@ ISC_PLATFORM_USEGCCASM="#undef ISC_PLATFORM_USEGCCASM"
+@@ -21854,12 +21943,7 @@ ISC_PLATFORM_USEGCCASM="#undef ISC_PLATFORM_USEGCCASM"
  ISC_PLATFORM_USESTDASM="#undef ISC_PLATFORM_USESTDASM"
  ISC_PLATFORM_USEMACASM="#undef ISC_PLATFORM_USEMACASM"
  if test "yes" = "$use_atomic"; then
@@ -889,7 +889,7 @@ index 6d05371..33689c9 100755
  # version HP92453-01 B.11.11.23709.GP, which incorrectly rejects
  # declarations like `int a3[[(sizeof (unsigned char)) >= 0]];'.
  # This bug is HP SR number 8606223364.
-@@ -21796,6 +21880,11 @@ cat >>confdefs.h <<_ACEOF
+@@ -21892,6 +21976,11 @@ cat >>confdefs.h <<_ACEOF
  _ACEOF
  
  
@@ -901,7 +901,7 @@ index 6d05371..33689c9 100755
  		if test $ac_cv_sizeof_void_p = 8; then
  			arch=x86_64
  			have_xaddq=yes
-@@ -21804,39 +21893,6 @@ _ACEOF
+@@ -21900,39 +21989,6 @@ _ACEOF
  		fi
  	;;
  	x86_64-*|amd64-*)
@@ -941,7 +941,7 @@ index 6d05371..33689c9 100755
  		if test $ac_cv_sizeof_void_p = 8; then
  			arch=x86_64
  			have_xaddq=yes
-@@ -21867,6 +21923,10 @@ $as_echo_n "checking architecture type for atomic operations... " >&6; }
+@@ -21963,6 +22019,10 @@ $as_echo_n "checking architecture type for atomic operations... " >&6; }
  $as_echo "$arch" >&6; }
  fi
  
@@ -952,7 +952,7 @@ index 6d05371..33689c9 100755
  if test "yes" = "$have_atomic"; then
  	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking compiler support for inline assembly code" >&5
  $as_echo_n "checking compiler support for inline assembly code... " >&6; }
-@@ -24421,6 +24481,30 @@ CFLAGS="$CFLAGS $SO_CFLAGS"
+@@ -24545,6 +24605,30 @@ CFLAGS="$CFLAGS $SO_CFLAGS"
  #
  dlzdir='${DLZ_DRIVER_DIR}'
  
@@ -983,7 +983,7 @@ index 6d05371..33689c9 100755
  #
  # Private autoconf macro to simplify configuring drivers:
  #
-@@ -24751,11 +24835,11 @@ $as_echo "no" >&6; }
+@@ -24875,11 +24959,11 @@ $as_echo "no" >&6; }
  $as_echo "using mysql with libs ${mysql_lib} and includes ${mysql_include}" >&6; }
  		;;
  	*)
@@ -998,7 +998,7 @@ index 6d05371..33689c9 100755
  		fi
  
  	CONTRIB_DLZ="$CONTRIB_DLZ -DDLZ_MYSQL"
-@@ -24840,7 +24924,7 @@ $as_echo "" >&6; }
+@@ -24964,7 +25048,7 @@ $as_echo "" >&6; }
  			# Check other locations for includes.
  			# Order is important (sigh).
  
@@ -1007,7 +1007,7 @@ index 6d05371..33689c9 100755
  			# include a blank element first
  			for d in "" $bdb_incdirs
  			do
-@@ -24865,57 +24949,9 @@ $as_echo "" >&6; }
+@@ -24989,57 +25073,9 @@ $as_echo "" >&6; }
  			bdb_libnames="db53 db-5.3 db51 db-5.1 db48 db-4.8 db47 db-4.7 db46 db-4.6 db45 db-4.5 db44 db-4.4 db43 db-4.3 db42 db-4.2 db41 db-4.1 db"
  			for d in $bdb_libnames
  			do
@@ -1067,7 +1067,7 @@ index 6d05371..33689c9 100755
  					break
  				fi
  			done
-@@ -25074,10 +25110,10 @@ $as_echo "no" >&6; }
+@@ -25198,10 +25234,10 @@ $as_echo "no" >&6; }
  		DLZ_DRIVER_INCLUDES="$DLZ_DRIVER_INCLUDES -I$use_dlz_ldap/include"
  		DLZ_DRIVER_LDAP_INCLUDES="-I$use_dlz_ldap/include"
  	fi
@@ -1081,7 +1081,7 @@ index 6d05371..33689c9 100755
  	fi
  
  
-@@ -25163,11 +25199,11 @@ fi
+@@ -25287,11 +25323,11 @@ fi
  		odbcdirs="/usr /usr/local /usr/pkg"
  		for d in $odbcdirs
  		do
@@ -1095,7 +1095,7 @@ index 6d05371..33689c9 100755
  				break
  			fi
  		done
-@@ -25442,6 +25478,8 @@ DNS_CRYPTO_LIBS="$NEWFLAGS"
+@@ -25566,6 +25602,8 @@ DNS_CRYPTO_LIBS="$NEWFLAGS"
  
  
  
@@ -1104,7 +1104,7 @@ index 6d05371..33689c9 100755
  #
  # Commands to run at the end of config.status.
  # Don't just put these into configure, it won't work right if somebody
-@@ -27819,6 +27857,8 @@ report() {
+@@ -27944,6 +27982,8 @@ report() {
  	    echo "    IPv6 support (--enable-ipv6)"
  	test "X$CRYPTO" = "X" -o "yes" = "$want_native_pkcs11" || \
  		echo "    OpenSSL cryptography/DNSSEC (--with-openssl)"
@@ -1113,7 +1113,7 @@ index 6d05371..33689c9 100755
  	test "X$PYTHON" = "X" || echo "    Python tools (--with-python)"
  	test "X$XMLSTATS" = "X" || echo "    XML statistics (--with-libxml2)"
  	test "X$JSONSTATS" = "X" || echo "    JSON statistics (--with-libjson)"
-@@ -27859,6 +27899,8 @@ report() {
+@@ -27984,6 +28024,8 @@ report() {
  	echo "    Very verbose query trace logging (--enable-querytrace)"
      test "no" = "$with_cmocka" || echo "    CMocka Unit Testing Framework (--with-cmocka)"
  
@@ -1122,7 +1122,7 @@ index 6d05371..33689c9 100755
      echo "    Dynamically loadable zone (DLZ) drivers:"
      test "no" = "$use_dlz_bdb" || \
  	echo "        Berkeley DB (--with-dlz-bdb)"
-@@ -27906,6 +27948,8 @@ report() {
+@@ -28031,6 +28073,8 @@ report() {
  	echo "    ECDSA algorithm support (--with-ecdsa)"
      test "X$CRYPTO" = "X" -o "yes" = "$OPENSSL_ED25519" -o "yes" = "$PKCS11_ED25519" || \
  	echo "    EDDSA algorithm support (--with-eddsa)"
@@ -1132,10 +1132,10 @@ index 6d05371..33689c9 100755
      test "yes" = "$enable_seccomp" || \
  	echo "    Use libseccomp system call filtering (--enable-seccomp)"
 diff --git a/configure.ac b/configure.ac
-index d10cde5..68bead8 100644
+index 6ddbd7b..c312a9a 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -1550,6 +1550,7 @@ case "$use_openssl" in
+@@ -1598,6 +1598,7 @@ case "$use_openssl" in
  		AC_MSG_RESULT(disabled because of native PKCS11)
  		DST_OPENSSL_INC=""
  		CRYPTO="-DPKCS11CRYPTO"
@@ -1143,7 +1143,7 @@ index d10cde5..68bead8 100644
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -1563,6 +1564,7 @@ case "$use_openssl" in
+@@ -1611,6 +1612,7 @@ case "$use_openssl" in
  		AC_MSG_RESULT(no)
  		DST_OPENSSL_INC=""
  		CRYPTO=""
@@ -1151,7 +1151,7 @@ index d10cde5..68bead8 100644
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -1575,6 +1577,7 @@ case "$use_openssl" in
+@@ -1623,6 +1625,7 @@ case "$use_openssl" in
  	auto)
  		DST_OPENSSL_INC=""
  		CRYPTO=""
@@ -1159,7 +1159,7 @@ index d10cde5..68bead8 100644
  		OPENSSLECDSALINKOBJS=""
  		OPENSSLECDSALINKSRCS=""
  		OPENSSLEDDSALINKOBJS=""
-@@ -1585,7 +1588,7 @@ case "$use_openssl" in
+@@ -1633,7 +1636,7 @@ case "$use_openssl" in
  		OPENSSLLINKSRCS=""
  		AC_MSG_ERROR(
  [OpenSSL was not found in any of $openssldirs; use --with-openssl=/path
@@ -1168,7 +1168,7 @@ index d10cde5..68bead8 100644
  		;;
  	*)
  		if test "yes" = "$want_native_pkcs11"
-@@ -1615,6 +1618,7 @@ If you don't want OpenSSL, use --without-openssl])
+@@ -1663,6 +1666,7 @@ If you don't want OpenSSL, use --without-openssl])
  			AC_MSG_ERROR(["$use_openssl/include/openssl/opensslv.h" not found])
  		fi
  		CRYPTO='-DOPENSSL'
@@ -1176,7 +1176,7 @@ index d10cde5..68bead8 100644
  		if test "/usr" = "$use_openssl"
  		then
  			DST_OPENSSL_INC=""
-@@ -2050,7 +2054,6 @@ fi
+@@ -2107,7 +2111,6 @@ fi
  # Use OpenSSL for hash functions
  #
  
@@ -1184,7 +1184,7 @@ index d10cde5..68bead8 100644
  ISC_PLATFORM_OPENSSLHASH="#undef ISC_PLATFORM_OPENSSLHASH"
  case $want_openssl_hash in
  	yes)
-@@ -2322,6 +2325,67 @@ if test "rt" = "$have_clock_gt"; then
+@@ -2379,6 +2382,67 @@ if test "rt" = "$have_clock_gt"; then
  	LIBS="-lrt $LIBS"
  fi
  
@@ -1252,7 +1252,7 @@ index d10cde5..68bead8 100644
  #
  # was --with-lmdb specified?
  #
-@@ -4098,12 +4162,12 @@ ISC_PLATFORM_USEGCCASM="#undef ISC_PLATFORM_USEGCCASM"
+@@ -4172,12 +4236,12 @@ ISC_PLATFORM_USEGCCASM="#undef ISC_PLATFORM_USEGCCASM"
  ISC_PLATFORM_USESTDASM="#undef ISC_PLATFORM_USESTDASM"
  ISC_PLATFORM_USEMACASM="#undef ISC_PLATFORM_USEMACASM"
  if test "yes" = "$use_atomic"; then
@@ -1266,7 +1266,7 @@ index d10cde5..68bead8 100644
  		if test $ac_cv_sizeof_void_p = 8; then
  			arch=x86_64
  			have_xaddq=yes
-@@ -4112,7 +4176,6 @@ if test "yes" = "$use_atomic"; then
+@@ -4186,7 +4250,6 @@ if test "yes" = "$use_atomic"; then
  		fi
  	;;
  	x86_64-*|amd64-*)
@@ -1274,7 +1274,7 @@ index d10cde5..68bead8 100644
  		if test $ac_cv_sizeof_void_p = 8; then
  			arch=x86_64
  			have_xaddq=yes
-@@ -5518,6 +5581,8 @@ report() {
+@@ -5620,6 +5683,8 @@ report() {
  	    echo "    IPv6 support (--enable-ipv6)"
  	test "X$CRYPTO" = "X" -o "yes" = "$want_native_pkcs11" || \
  		echo "    OpenSSL cryptography/DNSSEC (--with-openssl)"
@@ -1283,7 +1283,7 @@ index d10cde5..68bead8 100644
  	test "X$PYTHON" = "X" || echo "    Python tools (--with-python)"
  	test "X$XMLSTATS" = "X" || echo "    XML statistics (--with-libxml2)"
  	test "X$JSONSTATS" = "X" || echo "    JSON statistics (--with-libjson)"
-@@ -5558,6 +5623,8 @@ report() {
+@@ -5660,6 +5725,8 @@ report() {
  	echo "    Very verbose query trace logging (--enable-querytrace)"
      test "no" = "$with_cmocka" || echo "    CMocka Unit Testing Framework (--with-cmocka)"
  
@@ -1292,7 +1292,7 @@ index d10cde5..68bead8 100644
      echo "    Dynamically loadable zone (DLZ) drivers:"
      test "no" = "$use_dlz_bdb" || \
  	echo "        Berkeley DB (--with-dlz-bdb)"
-@@ -5605,6 +5672,8 @@ report() {
+@@ -5707,6 +5774,8 @@ report() {
  	echo "    ECDSA algorithm support (--with-ecdsa)"
      test "X$CRYPTO" = "X" -o "yes" = "$OPENSSL_ED25519" -o "yes" = "$PKCS11_ED25519" || \
  	echo "    EDDSA algorithm support (--with-eddsa)"
@@ -1302,7 +1302,7 @@ index d10cde5..68bead8 100644
      test "yes" = "$enable_seccomp" || \
  	echo "    Use libseccomp system call filtering (--enable-seccomp)"
 diff --git a/lib/dns/dst_api.c b/lib/dns/dst_api.c
-index 65bf25d..1eccbe7 100644
+index 7a86506..aa54afc 100644
 --- a/lib/dns/dst_api.c
 +++ b/lib/dns/dst_api.c
 @@ -277,6 +277,12 @@ dst_lib_init2(isc_mem_t *mctx, isc_entropy_t *ectx,
@@ -1366,7 +1366,7 @@ index 65bf25d..1eccbe7 100644
  #endif
  }
 diff --git a/lib/dns/include/dst/dst.h b/lib/dns/include/dst/dst.h
-index 1924e74..6813c96 100644
+index 5b42ab4..3aba028 100644
 --- a/lib/dns/include/dst/dst.h
 +++ b/lib/dns/include/dst/dst.h
 @@ -159,6 +159,14 @@ dst_lib_destroy(void);
@@ -1385,10 +1385,10 @@ index 1924e74..6813c96 100644
  dst_algorithm_supported(unsigned int alg);
  /*%<
 diff --git a/lib/dns/lib.c b/lib/dns/lib.c
-index 304814b..60543c4 100644
+index d9417de..0dc935d 100644
 --- a/lib/dns/lib.c
 +++ b/lib/dns/lib.c
-@@ -18,6 +18,7 @@
+@@ -16,6 +16,7 @@
  #include <stdbool.h>
  #include <stddef.h>
  
@@ -1396,7 +1396,7 @@ index 304814b..60543c4 100644
  #include <isc/hash.h>
  #include <isc/mem.h>
  #include <isc/msgcat.h>
-@@ -78,6 +79,7 @@ static unsigned int references = 0;
+@@ -76,6 +77,7 @@ static unsigned int references = 0;
  static void
  initialize(void) {
  	isc_result_t result;
@@ -1404,7 +1404,7 @@ index 304814b..60543c4 100644
  
  	REQUIRE(initialize_done == false);
  
-@@ -88,11 +90,14 @@ initialize(void) {
+@@ -86,11 +88,14 @@ initialize(void) {
  	result = dns_ecdb_register(dns_g_mctx, &dbimp);
  	if (result != ISC_R_SUCCESS)
  		goto cleanup_mctx;
@@ -1421,7 +1421,7 @@ index 304814b..60543c4 100644
  	if (result != ISC_R_SUCCESS)
  		goto cleanup_hash;
  
-@@ -100,11 +105,17 @@ initialize(void) {
+@@ -98,11 +103,17 @@ initialize(void) {
  	if (result != ISC_R_SUCCESS)
  		goto cleanup_dst;
  
@@ -1440,7 +1440,7 @@ index 304814b..60543c4 100644
  	isc_hash_destroy();
    cleanup_db:
 diff --git a/lib/dns/openssl_link.c b/lib/dns/openssl_link.c
-index 13e838f..ffe0a69 100644
+index 1e57c71..3f4f822 100644
 --- a/lib/dns/openssl_link.c
 +++ b/lib/dns/openssl_link.c
 @@ -31,6 +31,7 @@
@@ -1624,7 +1624,7 @@ index 13e838f..ffe0a69 100644
  #endif /* OPENSSL */
  /*! \file */
 diff --git a/lib/dns/pkcs11.c b/lib/dns/pkcs11.c
-index 5a2c502..8eaef53 100644
+index 6b30309..20552fa 100644
 --- a/lib/dns/pkcs11.c
 +++ b/lib/dns/pkcs11.c
 @@ -13,12 +13,15 @@
@@ -1692,7 +1692,7 @@ index 937b548..f3c0e38 100644
  tap_test_program{name='gost_test'}
  tap_test_program{name='keytable_test'}
 diff --git a/lib/dns/tests/Makefile.in b/lib/dns/tests/Makefile.in
-index 90dc3a6..7671e1d 100644
+index 4126372..30cab17 100644
 --- a/lib/dns/tests/Makefile.in
 +++ b/lib/dns/tests/Makefile.in
 @@ -37,6 +37,7 @@ SRCS =		acl_test.c \
@@ -1845,10 +1845,10 @@ index 0000000..bd3d164
 +
 +#endif
 diff --git a/lib/dns/win32/libdns.def.in b/lib/dns/win32/libdns.def.in
-index 63be973..40b21fa 100644
+index 9c2ef79..f597049 100644
 --- a/lib/dns/win32/libdns.def.in
 +++ b/lib/dns/win32/libdns.def.in
-@@ -1485,6 +1485,13 @@ dst_lib_destroy
+@@ -1487,6 +1487,13 @@ dst_lib_destroy
  dst_lib_init
  dst_lib_init2
  dst_lib_initmsgcat
@@ -1863,7 +1863,7 @@ index 63be973..40b21fa 100644
  dst_region_computerid
  dst_result_register
 diff --git a/lib/isc/entropy.c b/lib/isc/entropy.c
-index 907e470..451544d 100644
+index 0c1f3ed..fdd17d7 100644
 --- a/lib/isc/entropy.c
 +++ b/lib/isc/entropy.c
 @@ -104,11 +104,15 @@ struct isc_entropy {
@@ -1921,7 +1921,7 @@ index 907e470..451544d 100644
 +	hook = myhook;
 +}
 diff --git a/lib/isc/include/isc/entropy.h b/lib/isc/include/isc/entropy.h
-index e8733db..c40a18c 100644
+index b5bc956..f32c9dc 100644
 --- a/lib/isc/include/isc/entropy.h
 +++ b/lib/isc/include/isc/entropy.h
 @@ -302,6 +302,18 @@ isc_entropy_usebestsource(isc_entropy_t *ectx, isc_entropysource_t **source,
@@ -1944,7 +1944,7 @@ index e8733db..c40a18c 100644
  
  #endif /* ISC_ENTROPY_H */
 diff --git a/lib/isc/include/isc/platform.h.in b/lib/isc/include/isc/platform.h.in
-index 61960f1..d22993d 100644
+index 2bf8758..f4c684e 100644
 --- a/lib/isc/include/isc/platform.h.in
 +++ b/lib/isc/include/isc/platform.h.in
 @@ -359,6 +359,11 @@
@@ -1960,10 +1960,10 @@ index 61960f1..d22993d 100644
   * Define if the hash functions must be provided by OpenSSL.
   */
 diff --git a/lib/isc/include/isc/types.h b/lib/isc/include/isc/types.h
-index da9d66f..4205400 100644
+index 3bdd54f..d5acd39 100644
 --- a/lib/isc/include/isc/types.h
 +++ b/lib/isc/include/isc/types.h
-@@ -97,6 +97,8 @@ typedef struct isc_time			isc_time_t;		/*%< Time */
+@@ -95,6 +95,8 @@ typedef struct isc_time			isc_time_t;		/*%< Time */
  typedef struct isc_timer		isc_timer_t;		/*%< Timer */
  typedef struct isc_timermgr		isc_timermgr_t;		/*%< Timer Manager */
  
@@ -1973,7 +1973,7 @@ index da9d66f..4205400 100644
  typedef int (*isc_sockfdwatch_t)(isc_task_t *, isc_socket_t *, void *, int);
  
 diff --git a/lib/isc/pk11.c b/lib/isc/pk11.c
-index 68aebdc..4b85527 100644
+index 227f807..4a63fdf 100644
 --- a/lib/isc/pk11.c
 +++ b/lib/isc/pk11.c
 @@ -321,14 +321,16 @@ pk11_rand_seed_fromfile(const char *randomfile) {
@@ -1999,7 +1999,7 @@ index 68aebdc..4b85527 100644
      cleanup:
  	if (stream != NULL)
 diff --git a/lib/isc/win32/include/isc/platform.h.in b/lib/isc/win32/include/isc/platform.h.in
-index 8ade705..fa72f9d 100644
+index 1f785e0..f9051c3 100644
 --- a/lib/isc/win32/include/isc/platform.h.in
 +++ b/lib/isc/win32/include/isc/platform.h.in
 @@ -73,6 +73,11 @@
@@ -2015,7 +2015,7 @@ index 8ade705..fa72f9d 100644
   * Define if the hash functions must be provided by OpenSSL.
   */
 diff --git a/win32utils/Configure b/win32utils/Configure
-index 79d682e..6c78cb2 100644
+index 7ac30fb..55b6c23 100644
 --- a/win32utils/Configure
 +++ b/win32utils/Configure
 @@ -382,6 +382,7 @@ my @substdefh = ("ALLOW_FILTER_AAAA",
@@ -2026,7 +2026,7 @@ index 79d682e..6c78cb2 100644
                   "ISC_PLATFORM_HAVEATOMICSTORE",
                   "ISC_PLATFORM_HAVEATOMICSTOREQ",
                   "ISC_PLATFORM_HAVECMPXCHG",
-@@ -517,7 +518,8 @@ my @allcond = (@substcond, "NOTYET", "NOLONGER");
+@@ -516,7 +517,8 @@ my @allcond = (@substcond, "NOTYET", "NOLONGER");
  
  # enable-xxx/disable-xxx
  
@@ -2035,16 +2035,16 @@ index 79d682e..6c78cb2 100644
 +                  "developer",
                    "fixed-rrset",
                    "intrinsics",
-                   "isc-spnego",
-@@ -580,6 +582,7 @@ my @help = (
+                   "native-pkcs11",
+@@ -578,6 +580,7 @@ my @help = (
  "\nOptional Features:\n",
  "  enable-intrinsics     enable intrinsic/atomic functions [default=yes]\n",
  "  enable-native-pkcs11  use native PKCS#11 for all crypto [default=no]\n",
 +"  enable-crypto-rand    use crypto provider for random [default=yes]\n",
  "  enable-openssl-hash   use OpenSSL for hash functions [default=yes]\n",
- "  enable-isc-spnego     use SPNEGO from lib/dns [default=yes]\n",
  "  enable-filter-aaaa    enable filtering of AAAA records [default=yes]\n",
-@@ -628,7 +631,9 @@ my $want_clean = "no";
+ "  enable-fixed-rrset    enable fixed rrset ordering [default=no]\n",
+@@ -625,7 +628,9 @@ my $want_clean = "no";
  my $want_unknown = "no";
  my $unknown_value;
  my $enable_intrinsics = "yes";
@@ -2053,8 +2053,8 @@ index 79d682e..6c78cb2 100644
 +my $enable_crypto_rand = "yes";
  my $enable_openssl_hash = "auto";
  my $enable_filter_aaaa = "yes";
- my $enable_isc_spnego = "yes";
-@@ -847,6 +852,10 @@ sub myenable {
+ my $enable_fixed_rrset = "no";
+@@ -844,6 +849,10 @@ sub myenable {
          if ($val =~ /^yes$/i) {
              $enable_native_pkcs11 = "yes";
          }
@@ -2065,7 +2065,7 @@ index 79d682e..6c78cb2 100644
      } elsif ($key =~ /^openssl-hash$/i) {
          if ($val =~ /^yes$/i) {
              $enable_openssl_hash = "yes";
-@@ -1153,6 +1162,11 @@ if ($verbose) {
+@@ -1146,6 +1155,11 @@ if ($verbose) {
      } else {
          print "native-pkcs11: disabled\n";
      }
@@ -2077,7 +2077,7 @@ index 79d682e..6c78cb2 100644
      if ($enable_openssl_hash eq "yes") {
          print "openssl-hash: enabled\n";
      } else {
-@@ -1510,6 +1524,7 @@ if ($enable_intrinsics eq "yes") {
+@@ -1498,6 +1512,7 @@ if ($enable_intrinsics eq "yes") {
  
  # enable-native-pkcs11
  if ($enable_native_pkcs11 eq "yes") {
@@ -2085,15 +2085,15 @@ index 79d682e..6c78cb2 100644
      if ($use_openssl eq "auto") {
          $use_openssl = "no";
      }
-@@ -1719,6 +1734,7 @@ if ($use_openssl eq "yes") {
+@@ -1707,6 +1722,7 @@ if ($use_openssl eq "yes") {
          $openssl_dll = File::Spec->catdir($openssl_path, "@dirlist[0]");
-     }   
+     }
  
 +    $cryptolib = "openssl";
      $configcond{"OPENSSL"} = 1;
      $configdefd{"CRYPTO"} = "OPENSSL";
      $configvar{"OPENSSL_PATH"} = "$openssl_path";
-@@ -2290,6 +2306,15 @@ if ($use_aes eq "yes") {
+@@ -2278,6 +2294,15 @@ if ($use_aes eq "yes") {
  }
  
  
@@ -2109,7 +2109,7 @@ index 79d682e..6c78cb2 100644
  # enable-openssl-hash
  if ($enable_openssl_hash eq "yes") {
      if ($use_openssl eq "no") {
-@@ -3665,6 +3690,7 @@ exit 0;
+@@ -3650,6 +3675,7 @@ exit 0;
  #  --enable-developer partially supported
  #  --enable-newstats (9.9/9.9sub only)
  #  --enable-native-pkcs11 supported
@@ -2118,5 +2118,5 @@ index 79d682e..6c78cb2 100644
  #  --enable-openssl-hash supported
  #  --enable-threads included without a way to disable it
 -- 
-2.21.1
+2.26.3
 

bind-9.11-rt46047.patch

@@ -1,4 +1,4 @@
-From 344c19ad4b3f058e65a4b41650bb0ee20692cc5c Mon Sep 17 00:00:00 2001
+From af3b530773231f8cff6548e36962ad1f25e38c5d Mon Sep 17 00:00:00 2001
 From: Evan Hunt <each@isc.org>
 Date: Thu, 28 Sep 2017 10:09:22 -0700
 Subject: [PATCH] completed and corrected the crypto-random change
@@ -45,13 +45,13 @@ Subject: [PATCH] completed and corrected the crypto-random change
  lib/dns/include/dst/dst.h                | 14 +++++-
  lib/dns/openssl_link.c                   |  3 +-
  lib/isc/include/isc/entropy.h            | 48 +++++++++++++++------
- lib/isc/include/isc/random.h             | 28 +++++++-----
+ lib/isc/include/isc/random.h             | 26 +++++++----
  lib/isccfg/namedconf.c                   |  2 +-
- 23 files changed, 240 insertions(+), 104 deletions(-)
+ 23 files changed, 240 insertions(+), 102 deletions(-)
  create mode 100644 doc/arm/notes-rh-changes.xml
 
 diff --git a/bin/confgen/keygen.c b/bin/confgen/keygen.c
-index 295e16f..0f79aa8 100644
+index bd269e7..1ac775f 100644
 --- a/bin/confgen/keygen.c
 +++ b/bin/confgen/keygen.c
 @@ -161,17 +161,15 @@ generate_key(isc_mem_t *mctx, const char *randomfile, dns_secalg_t alg,
@@ -78,7 +78,7 @@ index 295e16f..0f79aa8 100644
  							     &entropy_source,
  							     randomfile,
 diff --git a/bin/dnssec/dnssec-keygen.docbook b/bin/dnssec/dnssec-keygen.docbook
-index 1826919..96543fc 100644
+index bd19e1d..2c09b30 100644
 --- a/bin/dnssec/dnssec-keygen.docbook
 +++ b/bin/dnssec/dnssec-keygen.docbook
 @@ -349,15 +349,23 @@
@@ -114,7 +114,7 @@ index 1826919..96543fc 100644
  	</listitem>
        </varlistentry>
 diff --git a/bin/dnssec/dnssectool.c b/bin/dnssec/dnssectool.c
-index 5654435..24c0d5a 100644
+index 2a0f9c6..6fcd411 100644
 --- a/bin/dnssec/dnssectool.c
 +++ b/bin/dnssec/dnssectool.c
 @@ -241,18 +241,16 @@ setup_entropy(isc_mem_t *mctx, const char *randomfile, isc_entropy_t **ectx) {
@@ -142,10 +142,10 @@ index 5654435..24c0d5a 100644
  					   usekeyboard);
  
 diff --git a/bin/named/client.c b/bin/named/client.c
-index 9a0d3c8..c573177 100644
+index 4a50ad9..4d140e8 100644
 --- a/bin/named/client.c
 +++ b/bin/named/client.c
-@@ -1765,7 +1765,8 @@ ns_client_addopt(ns_client_t *client, dns_message_t *message,
+@@ -1768,7 +1768,8 @@ ns_client_addopt(ns_client_t *client, dns_message_t *message,
  
  		isc_buffer_init(&buf, cookie, sizeof(cookie));
  		isc_stdtime_get(&now);
@@ -156,7 +156,7 @@ index 9a0d3c8..c573177 100644
  		compute_cookie(client, now, nonce, ns_g_server->secret, &buf);
  
 diff --git a/bin/named/config.c b/bin/named/config.c
-index dbdff64..63da4b0 100644
+index 9b343fa..5e663c6 100644
 --- a/bin/named/config.c
 +++ b/bin/named/config.c
 @@ -98,7 +98,9 @@ options {\n\
@@ -171,10 +171,10 @@ index dbdff64..63da4b0 100644
  #endif
  "	recursing-file \"named.recursing\";\n\
 diff --git a/bin/named/controlconf.c b/bin/named/controlconf.c
-index d955c2f..40621f2 100644
+index 9fdf49b..42128dc 100644
 --- a/bin/named/controlconf.c
 +++ b/bin/named/controlconf.c
-@@ -325,9 +325,10 @@ log_invalid(isccc_ccmsg_t *ccmsg, isc_result_t result) {
+@@ -327,9 +327,10 @@ log_invalid(isccc_ccmsg_t *ccmsg, isc_result_t result) {
  
  static void
  control_recvmessage(isc_task_t *task, isc_event_t *event) {
@@ -188,7 +188,7 @@ index d955c2f..40621f2 100644
  	isccc_sexpr_t *request = NULL;
  	isccc_sexpr_t *response = NULL;
  	uint32_t algorithm;
-@@ -338,16 +339,17 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {
+@@ -340,16 +341,17 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {
  	isc_buffer_t *text;
  	isc_result_t result;
  	isc_result_t eresult;
@@ -208,7 +208,7 @@ index d955c2f..40621f2 100644
  	algorithm = DST_ALG_UNKNOWN;
  	secret.rstart = NULL;
  	text = NULL;
-@@ -458,8 +460,11 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {
+@@ -462,8 +464,11 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {
  	 * Establish nonce.
  	 */
  	if (conn->nonce == 0) {
@@ -223,7 +223,7 @@ index d955c2f..40621f2 100644
  	} else
  		eresult = ns_control_docommand(request, listener->readonly, &text);
 diff --git a/bin/named/include/named/server.h b/bin/named/include/named/server.h
-index 3f96b7b..c92922e 100644
+index 4fd0194..0ba2627 100644
 --- a/bin/named/include/named/server.h
 +++ b/bin/named/include/named/server.h
 @@ -20,6 +20,7 @@
@@ -234,7 +234,7 @@ index 3f96b7b..c92922e 100644
  #include <isc/sockaddr.h>
  #include <isc/types.h>
  #include <isc/xml.h>
-@@ -134,6 +135,7 @@ struct ns_server {
+@@ -135,6 +136,7 @@ struct ns_server {
  	char *			lockfile;
  
  	uint16_t		transfer_tcp_message_size;
@@ -243,7 +243,7 @@ index 3f96b7b..c92922e 100644
  
  struct ns_altsecret {
 diff --git a/bin/named/interfacemgr.c b/bin/named/interfacemgr.c
-index 9dea7c1..272d300 100644
+index 93aac31..e12fad9 100644
 --- a/bin/named/interfacemgr.c
 +++ b/bin/named/interfacemgr.c
 @@ -17,6 +17,7 @@
@@ -255,22 +255,22 @@ index 9dea7c1..272d300 100644
  #include <isc/task.h>
  #include <isc/util.h>
 diff --git a/bin/named/query.c b/bin/named/query.c
-index 203f1e6..25eeced 100644
+index 58b5914..edf42d2 100644
 --- a/bin/named/query.c
 +++ b/bin/named/query.c
-@@ -19,6 +19,7 @@
- #include <isc/hex.h>
+@@ -20,6 +20,7 @@
  #include <isc/mem.h>
+ #include <isc/platform.h>
  #include <isc/print.h>
 +#include <isc/random.h>
  #include <isc/rwlock.h>
  #include <isc/serial.h>
  #include <isc/stats.h>
 diff --git a/bin/named/server.c b/bin/named/server.c
-index f27071f..f132c19 100644
+index b2ae57c..cca7fe8 100644
 --- a/bin/named/server.c
 +++ b/bin/named/server.c
-@@ -8210,21 +8210,32 @@ load_configuration(const char *filename, ns_server_t *server,
+@@ -8279,21 +8279,32 @@ load_configuration(const char *filename, ns_server_t *server,
  	 * Open the source of entropy.
  	 */
  	if (first_time) {
@@ -312,7 +312,7 @@ index f27071f..f132c19 100644
  #ifdef PATH_RANDOMDEV
  			if (ns_g_fallbackentropy != NULL) {
  				level = ISC_LOG_INFO;
-@@ -8235,8 +8246,8 @@ load_configuration(const char *filename, ns_server_t *server,
+@@ -8304,8 +8315,8 @@ load_configuration(const char *filename, ns_server_t *server,
  					      NS_LOGCATEGORY_GENERAL,
  					      NS_LOGMODULE_SERVER,
  					      level,
@@ -323,7 +323,7 @@ index f27071f..f132c19 100644
  					      randomdev,
  					      isc_result_totext(result));
  			}
-@@ -8256,7 +8267,6 @@ load_configuration(const char *filename, ns_server_t *server,
+@@ -8325,7 +8336,6 @@ load_configuration(const char *filename, ns_server_t *server,
  				}
  				isc_entropy_detach(&ns_g_fallbackentropy);
  			}
@@ -331,7 +331,7 @@ index f27071f..f132c19 100644
  #endif
  		}
  
-@@ -9025,6 +9035,7 @@ ns_server_create(isc_mem_t *mctx, ns_server_t **serverp) {
+@@ -9097,6 +9107,7 @@ ns_server_create(isc_mem_t *mctx, ns_server_t **serverp) {
  	server->in_roothints = NULL;
  	server->blackholeacl = NULL;
  	server->keepresporder = NULL;
@@ -339,7 +339,7 @@ index f27071f..f132c19 100644
  
  	/* Must be first. */
  	CHECKFATAL(dst_lib_init2(ns_g_mctx, ns_g_entropy,
-@@ -9051,6 +9062,9 @@ ns_server_create(isc_mem_t *mctx, ns_server_t **serverp) {
+@@ -9123,6 +9134,9 @@ ns_server_create(isc_mem_t *mctx, ns_server_t **serverp) {
  	CHECKFATAL(dns_tkeyctx_create(ns_g_mctx, ns_g_entropy,
  				      &server->tkeyctx),
  		   "creating TKEY context");
@@ -349,7 +349,7 @@ index f27071f..f132c19 100644
  
  	/*
  	 * Setup the server task, which is responsible for coordinating
-@@ -9257,7 +9271,8 @@ ns_server_destroy(ns_server_t **serverp) {
+@@ -9329,7 +9343,8 @@ ns_server_destroy(ns_server_t **serverp) {
  
  	if (server->zonemgr != NULL)
  		dns_zonemgr_detach(&server->zonemgr);
@@ -359,7 +359,7 @@ index f27071f..f132c19 100644
  	if (server->tkeyctx != NULL)
  		dns_tkeyctx_destroy(&server->tkeyctx);
  
-@@ -13263,10 +13278,10 @@ newzone_cfgctx_destroy(void **cfgp) {
+@@ -13366,10 +13381,10 @@ newzone_cfgctx_destroy(void **cfgp) {
  
  static isc_result_t
  generate_salt(unsigned char *salt, size_t saltlen) {
@@ -372,7 +372,7 @@ index f27071f..f132c19 100644
  	} rnd;
  	unsigned char text[512 + 1];
  	isc_region_t r;
-@@ -13276,9 +13291,10 @@ generate_salt(unsigned char *salt, size_t saltlen) {
+@@ -13379,9 +13394,10 @@ generate_salt(unsigned char *salt, size_t saltlen) {
  	if (saltlen > 256U)
  		return (ISC_R_RANGE);
  
@@ -387,10 +387,10 @@ index f27071f..f132c19 100644
  	memmove(salt, rnd.rnd, saltlen);
  
 diff --git a/bin/nsupdate/nsupdate.c b/bin/nsupdate/nsupdate.c
-index 0286987..0376377 100644
+index 7f15cbc..458aa76 100644
 --- a/bin/nsupdate/nsupdate.c
 +++ b/bin/nsupdate/nsupdate.c
-@@ -283,9 +283,7 @@ setup_entropy(isc_mem_t *mctx, const char *randomfile, isc_entropy_t **ectx) {
+@@ -289,9 +289,7 @@ setup_entropy(isc_mem_t *mctx, const char *randomfile, isc_entropy_t **ectx) {
  	}
  
  #ifdef ISC_PLATFORM_CRYPTORANDOM
@@ -402,7 +402,7 @@ index 0286987..0376377 100644
  	}
  #endif
 diff --git a/bin/tests/system/pipelined/pipequeries.c b/bin/tests/system/pipelined/pipequeries.c
-index f0a6ff2..55064f6 100644
+index 95b65bf..7a81d4e 100644
 --- a/bin/tests/system/pipelined/pipequeries.c
 +++ b/bin/tests/system/pipelined/pipequeries.c
 @@ -280,9 +280,7 @@ main(int argc, char *argv[]) {
@@ -417,7 +417,7 @@ index f0a6ff2..55064f6 100644
  	}
  #endif
 diff --git a/bin/tests/system/tkey/keycreate.c b/bin/tests/system/tkey/keycreate.c
-index fe8698e..937fcc3 100644
+index 3236968..4fa77b6 100644
 --- a/bin/tests/system/tkey/keycreate.c
 +++ b/bin/tests/system/tkey/keycreate.c
 @@ -255,9 +255,7 @@ main(int argc, char *argv[]) {
@@ -432,7 +432,7 @@ index fe8698e..937fcc3 100644
  	}
  #endif
 diff --git a/bin/tests/system/tkey/keydelete.c b/bin/tests/system/tkey/keydelete.c
-index 2146f9b..64b8e74 100644
+index 43fb6b0..105e151 100644
 --- a/bin/tests/system/tkey/keydelete.c
 +++ b/bin/tests/system/tkey/keydelete.c
 @@ -171,6 +171,7 @@ main(int argc, char **argv) {
@@ -455,22 +455,22 @@ index 2146f9b..64b8e74 100644
  	}
  #endif
 diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml
-index 93c7a08..bb1e81d 100644
+index ca98726..1f9df2c 100644
 --- a/doc/arm/Bv9ARM-book.xml
 +++ b/doc/arm/Bv9ARM-book.xml
-@@ -5081,22 +5081,45 @@ badresp:1,adberr:0,findfail:0,valfail:0]
+@@ -5034,22 +5034,45 @@ badresp:1,adberr:0,findfail:0,valfail:0]
  	    <term><command>random-device</command></term>
  	    <listitem>
  	      <para>
--		The source of entropy to be used by the server.  Entropy is
+-		This specifies a source of entropy to be used by the server.  Entropy is
 -		primarily needed
 -		for DNSSEC operations, such as TKEY transactions and dynamic
 -		update of signed
--		zones.  This options specifies the device (or file) from which
+-		zones.  This option specifies the device (or file) from which
 -		to read
--		entropy.  If this is a file, operations requiring entropy will
+-		entropy.  If it is a file, operations requiring entropy will
 -		fail when the
--		file has been exhausted.  If not specified, the default value
+-		file has been exhausted.  If <command>random-device</command> is not specified, the default value
 -		is
 -		<filename>/dev/random</filename>
 -		(or equivalent) when present, and none otherwise.  The
@@ -569,10 +569,10 @@ index 0000000..89a4961
 +</section>
 +
 diff --git a/doc/arm/notes.xml b/doc/arm/notes.xml
-index 589a347..052a0bd 100644
+index a5e42c0..f8cb1f9 100644
 --- a/doc/arm/notes.xml
 +++ b/doc/arm/notes.xml
-@@ -40,6 +40,7 @@
+@@ -47,6 +47,7 @@
    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="notes-9.11.1.xml"/>
    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="notes-9.11.0.xml"/>
  
@@ -581,7 +581,7 @@ index 589a347..052a0bd 100644
    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="notes-thankyou.xml"/>
  </section>
 diff --git a/lib/dns/dst_api.c b/lib/dns/dst_api.c
-index 1eccbe7..1933993 100644
+index aa54afc..2156384 100644
 --- a/lib/dns/dst_api.c
 +++ b/lib/dns/dst_api.c
 @@ -2017,10 +2017,12 @@ dst__entropy_getdata(void *buf, unsigned int len, bool pseudo) {
@@ -599,7 +599,7 @@ index 1eccbe7..1933993 100644
  }
  
 diff --git a/lib/dns/include/dst/dst.h b/lib/dns/include/dst/dst.h
-index 6813c96..665574d 100644
+index 3aba028..180c841 100644
 --- a/lib/dns/include/dst/dst.h
 +++ b/lib/dns/include/dst/dst.h
 @@ -163,8 +163,18 @@ isc_result_t
@@ -624,7 +624,7 @@ index 6813c96..665574d 100644
  
  bool
 diff --git a/lib/dns/openssl_link.c b/lib/dns/openssl_link.c
-index ffe0a69..5e48686 100644
+index 3f4f822..cfdc757 100644
 --- a/lib/dns/openssl_link.c
 +++ b/lib/dns/openssl_link.c
 @@ -484,7 +484,8 @@ dst__openssl_getengine(const char *engine) {
@@ -638,7 +638,7 @@ index ffe0a69..5e48686 100644
  #ifndef DONT_REQUIRE_DST_LIB_INIT
  	INSIST(dst__memory_pool != NULL);
 diff --git a/lib/isc/include/isc/entropy.h b/lib/isc/include/isc/entropy.h
-index c40a18c..c7cb17d 100644
+index f32c9dc..bed276b 100644
 --- a/lib/isc/include/isc/entropy.h
 +++ b/lib/isc/include/isc/entropy.h
 @@ -189,9 +189,8 @@ isc_entropy_createcallbacksource(isc_entropy_t *ent,
@@ -718,26 +718,21 @@ index c40a18c..c7cb17d 100644
  
  ISC_LANG_ENDDECLS
 diff --git a/lib/isc/include/isc/random.h b/lib/isc/include/isc/random.h
-index f8aed34..17c551b 100644
+index f38e80d..3cb1c56 100644
 --- a/lib/isc/include/isc/random.h
 +++ b/lib/isc/include/isc/random.h
-@@ -9,8 +9,6 @@
-  * information regarding copyright ownership.
-  */
- 
--/* $Id: random.h,v 1.20 2009/01/17 23:47:43 tbox Exp $ */
--
- #ifndef ISC_RANDOM_H
- #define ISC_RANDOM_H 1
- 
-@@ -21,13 +19,23 @@
+@@ -19,13 +19,23 @@
  #include <isc/mutex.h>
  
  /*! \file isc/random.h
 - * \brief Implements a random state pool which will let the caller return a
 - * series of possibly non-reproducible random values.
 + * \brief Implements pseudo random number generators.
-+ *
+  *
+- * Note that the
+- * strength of these numbers is not all that high, and should not be
+- * used in cryptography functions.  It is useful for jittering values
+- * a bit here and there, such as timeouts, etc.
 + * Two pseudo-random number generators are implemented, in isc_random_*
 + * and isc_rng_*. Neither one is very strong; they should not be used
 + * in cryptography functions.
@@ -747,11 +742,7 @@ index f8aed34..17c551b 100644
 + * It is useful for jittering values a bit here and there, such as
 + * timeouts, etc, but should not be relied upon to generate
 + * unpredictable sequences (for example, when choosing transaction IDs).
-  *
-- * Note that the
-- * strength of these numbers is not all that high, and should not be
-- * used in cryptography functions.  It is useful for jittering values
-- * a bit here and there, such as timeouts, etc.
++  *
 + * isc_rng_* is based on ChaCha20, and is seeded and stirred from the
 + * system entropy source. It is stronger than isc_random_* and can
 + * be used for generating unpredictable sequences. It is still not as
@@ -760,7 +751,7 @@ index f8aed34..17c551b 100644
   */
  
  ISC_LANG_BEGINDECLS
-@@ -115,8 +123,8 @@ isc_rng_random(isc_rng_t *rngctx);
+@@ -113,8 +123,8 @@ isc_rng_random(isc_rng_t *rngctx);
  uint16_t
  isc_rng_uniformrandom(isc_rng_t *rngctx, uint16_t upper_bound);
  /*%<
@@ -772,7 +763,7 @@ index f8aed34..17c551b 100644
  
  ISC_LANG_ENDDECLS
 diff --git a/lib/isccfg/namedconf.c b/lib/isccfg/namedconf.c
-index 1c45d5c..91693b5 100644
+index e74c93b..212194e 100644
 --- a/lib/isccfg/namedconf.c
 +++ b/lib/isccfg/namedconf.c
 @@ -1109,7 +1109,7 @@ options_clauses[] = {
@@ -785,5 +776,5 @@ index 1c45d5c..91693b5 100644
  	{ "recursive-clients", &cfg_type_uint32, 0 },
  	{ "reserved-sockets", &cfg_type_uint32, 0 },
 -- 
-2.21.1
+2.26.2
 

bind-9.11-serve-stale.patch

@@ -1,4 +1,4 @@
-From 521fc8dcc0ac064ae8bc521418f5b03f0ceec657 Mon Sep 17 00:00:00 2001
+From d55a57427ee696dec51149950478394e43019607 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Thu, 7 Nov 2019 14:31:03 +0100
 Subject: [PATCH] Implement serve-stale in 9.11
@@ -240,7 +240,7 @@ Signed-off-by: Petr Menšík <pemensik@redhat.com>
  bin/tests/system/serve-stale/prereq.sh        |  38 ++
  bin/tests/system/serve-stale/setup.sh         |  13 +
  bin/tests/system/serve-stale/tests.sh         | 536 ++++++++++++++++++
- doc/arm/Bv9ARM-book.xml                       |  69 ++-
+ doc/arm/Bv9ARM-book.xml                       |  77 ++-
  doc/arm/logging-categories.xml                |  11 +
  doc/arm/notes-rh-changes.xml                  |  14 +-
  doc/misc/options                              |  10 +
@@ -263,7 +263,7 @@ Signed-off-by: Petr Menšík <pemensik@redhat.com>
  lib/dns/tests/db_test.c                       | 198 ++++++-
  lib/dns/view.c                                |   3 +
  lib/isccfg/namedconf.c                        |   5 +
- 48 files changed, 2122 insertions(+), 102 deletions(-)
+ 48 files changed, 2126 insertions(+), 106 deletions(-)
  create mode 100644 bin/tests/system/serve-stale/.gitignore
  create mode 100644 bin/tests/system/serve-stale/ans2/ans.pl.in
  create mode 100644 bin/tests/system/serve-stale/clean.sh
@@ -276,7 +276,7 @@ Signed-off-by: Petr Menšík <pemensik@redhat.com>
  create mode 100755 bin/tests/system/serve-stale/tests.sh
 
 diff --git a/bin/named/config.c b/bin/named/config.c
-index 63da4b0..b598f9b 100644
+index 9e071bb..d2cd3bc 100644
 --- a/bin/named/config.c
 +++ b/bin/named/config.c
 @@ -182,13 +182,14 @@ options {\n\
@@ -291,7 +291,7 @@ index 63da4b0..b598f9b 100644
  	max-clients-per-query 100;\n\
  	max-ncache-ttl 10800; /* 3 hours */\n\
  	max-recursion-depth 7;\n\
- 	max-recursion-queries 75;\n\
+ 	max-recursion-queries 100;\n\
 +	max-stale-ttl 604800; /* 1 week */\n\
  	message-compression yes;\n\
  #	min-roots <obsolete>;\n\
@@ -312,7 +312,7 @@ index 63da4b0..b598f9b 100644
  	transfer-format many-answers;\n\
  	v6-bias 50;\n\
 diff --git a/bin/named/control.c b/bin/named/control.c
-index df23c26..8b79850 100644
+index 23620b4..0756c73 100644
 --- a/bin/named/control.c
 +++ b/bin/named/control.c
 @@ -282,6 +282,8 @@ ns_control_docommand(isccc_sexpr_t *message, bool readonly,
@@ -325,10 +325,10 @@ index df23c26..8b79850 100644
  		isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
  			      NS_LOGMODULE_CONTROL, ISC_LOG_WARNING,
 diff --git a/bin/named/include/named/control.h b/bin/named/include/named/control.h
-index 8705fdd..1634154 100644
+index 56bad8d..37403f1 100644
 --- a/bin/named/include/named/control.h
 +++ b/bin/named/include/named/control.h
-@@ -69,6 +69,7 @@
+@@ -67,6 +67,7 @@
  #define NS_COMMAND_MKEYS	"managed-keys"
  #define NS_COMMAND_DNSTAPREOPEN	"dnstap-reopen"
  #define NS_COMMAND_DNSTAP	"dnstap"
@@ -337,10 +337,10 @@ index 8705fdd..1634154 100644
  isc_result_t
  ns_controls_create(ns_server_t *server, ns_controls_t **ctrlsp);
 diff --git a/bin/named/include/named/log.h b/bin/named/include/named/log.h
-index 56bfcd4..cd8db60 100644
+index 76e3a51..0d1d985 100644
 --- a/bin/named/include/named/log.h
 +++ b/bin/named/include/named/log.h
-@@ -32,6 +32,7 @@
+@@ -30,6 +30,7 @@
  #define NS_LOGCATEGORY_UPDATE_SECURITY	(&ns_g_categories[6])
  #define NS_LOGCATEGORY_QUERY_ERRORS	(&ns_g_categories[7])
  #define NS_LOGCATEGORY_TAT		(&ns_g_categories[8])
@@ -349,7 +349,7 @@ index 56bfcd4..cd8db60 100644
  /*
   * Backwards compatibility.
 diff --git a/bin/named/include/named/query.h b/bin/named/include/named/query.h
-index 9661f56..445b578 100644
+index ef1b172..53c052b 100644
 --- a/bin/named/include/named/query.h
 +++ b/bin/named/include/named/query.h
 @@ -35,6 +35,18 @@ typedef struct ns_dbversion {
@@ -389,10 +389,10 @@ index 9661f56..445b578 100644
  	bool root_key_sentinel_is_ta;
  	bool root_key_sentinel_not_ta;
 diff --git a/bin/named/include/named/server.h b/bin/named/include/named/server.h
-index c92922e..588bf2d 100644
+index 0ba2627..08a02dc 100644
 --- a/bin/named/include/named/server.h
 +++ b/bin/named/include/named/server.h
-@@ -226,7 +226,10 @@ enum {
+@@ -227,7 +227,10 @@ enum {
  
  	dns_nsstatscounter_reclimitdropped = 58,
  
@@ -404,7 +404,7 @@ index c92922e..588bf2d 100644
  };
  
  /*%
-@@ -765,4 +768,12 @@ ns_server_mkeys(ns_server_t *server, isc_lex_t *lex, isc_buffer_t **text);
+@@ -766,4 +769,12 @@ ns_server_mkeys(ns_server_t *server, isc_lex_t *lex, isc_buffer_t **text);
  isc_result_t
  ns_server_dnstap(ns_server_t *server, isc_lex_t *lex, isc_buffer_t **text);
  
@@ -418,7 +418,7 @@ index c92922e..588bf2d 100644
 +		     isc_buffer_t **text);
  #endif /* NAMED_SERVER_H */
 diff --git a/bin/named/log.c b/bin/named/log.c
-index 3aa25e9..12f178b 100644
+index acfa766..ea6f114 100644
 --- a/bin/named/log.c
 +++ b/bin/named/log.c
 @@ -38,6 +38,7 @@ static isc_logcategory_t categories[] = {
@@ -430,10 +430,10 @@ index 3aa25e9..12f178b 100644
  };
  
 diff --git a/bin/named/query.c b/bin/named/query.c
-index 25eeced..162e4ea 100644
+index b14f081..a95f5ad 100644
 --- a/bin/named/query.c
 +++ b/bin/named/query.c
-@@ -125,10 +125,14 @@
+@@ -149,10 +149,14 @@ last_cmpxchg(isc_stdtime_t *x, isc_stdtime_t *e, isc_stdtime_t r) {
  #define REDIRECT(c)		(((c)->query.attributes & \
  				  NS_QUERYATTR_REDIRECT) != 0)
  
@@ -449,7 +449,7 @@ index 25eeced..162e4ea 100644
  #ifdef WANT_QUERYTRACE
  static inline void
  client_trace(ns_client_t *client, int level, const char *message) {
-@@ -217,6 +221,10 @@ static bool
+@@ -241,6 +245,10 @@ static bool
  rpz_ck_dnssec(ns_client_t *client, isc_result_t qresult,
  	      dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset);
  
@@ -460,7 +460,7 @@ index 25eeced..162e4ea 100644
  /*%
   * Increment query statistics counters.
   */
-@@ -470,6 +478,7 @@ query_reset(ns_client_t *client, bool everything) {
+@@ -494,6 +502,7 @@ query_reset(ns_client_t *client, bool everything) {
  	client->query.isreferral = false;
  	client->query.dns64_options = 0;
  	client->query.dns64_ttl = UINT32_MAX;
@@ -468,8 +468,8 @@ index 25eeced..162e4ea 100644
  	client->query.root_key_sentinel_keyid = 0;
  	client->query.root_key_sentinel_is_ta = false;
  	client->query.root_key_sentinel_not_ta = false;
-@@ -4254,6 +4263,54 @@ query_prefetch(ns_client_t *client, dns_name_t *qname,
- 	dns_rdataset_clearprefetch(rdataset);
+@@ -4305,6 +4314,54 @@ log_quota(ns_client_t *client, isc_stdtime_t *last, isc_stdtime_t now,
+ 	}
  }
  
 +/*%
@@ -523,7 +523,7 @@ index 25eeced..162e4ea 100644
  static isc_result_t
  query_recurse(ns_client_t *client, dns_rdatatype_t qtype, dns_name_t *qname,
  	      dns_name_t *qdomain, dns_rdataset_t *nameservers,
-@@ -4263,6 +4320,19 @@ query_recurse(ns_client_t *client, dns_rdatatype_t qtype, dns_name_t *qname,
+@@ -4314,6 +4371,19 @@ query_recurse(ns_client_t *client, dns_rdatatype_t qtype, dns_name_t *qname,
  	dns_rdataset_t *rdataset, *sigrdataset;
  	isc_sockaddr_t *peeraddr;
  
@@ -543,7 +543,7 @@ index 25eeced..162e4ea 100644
  	if (!resuming)
  		inc_stats(client, dns_nsstatscounter_recursion);
  
-@@ -6780,6 +6850,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
+@@ -6821,6 +6891,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
  	int line = -1;
  	bool dns64_exclude, dns64, rpz;
  	bool nxrewrite = false;
@@ -551,7 +551,7 @@ index 25eeced..162e4ea 100644
  	bool redirected = false;
  	dns_clientinfomethods_t cm;
  	dns_clientinfo_t ci;
-@@ -7089,6 +7160,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
+@@ -7130,6 +7201,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
  		type = qtype;
  
   restart:
@@ -559,7 +559,7 @@ index 25eeced..162e4ea 100644
  	CTRACE(ISC_LOG_DEBUG(3), "query_find: restart");
  	want_restart = false;
  	authoritative = false;
-@@ -7233,6 +7305,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
+@@ -7274,6 +7346,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
  	}
  
   db_find:
@@ -567,7 +567,7 @@ index 25eeced..162e4ea 100644
  	CTRACE(ISC_LOG_DEBUG(3), "query_find: db_find");
  	/*
  	 * We'll need some resources...
-@@ -7290,6 +7363,35 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
+@@ -7331,6 +7404,35 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
  	if (!is_zone)
  		dns_cache_updatestats(client->view->cache, result);
  
@@ -603,7 +603,7 @@ index 25eeced..162e4ea 100644
   resume:
  	CTRACE(ISC_LOG_DEBUG(3), "query_find: resume");
  
-@@ -7635,6 +7737,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
+@@ -7676,6 +7778,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
  		 * The cache doesn't even have the root NS.  Get them from
  		 * the hints DB.
  		 */
@@ -611,7 +611,7 @@ index 25eeced..162e4ea 100644
  		INSIST(!is_zone);
  		if (db != NULL)
  			dns_db_detach(&db);
-@@ -7697,12 +7800,14 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
+@@ -7738,12 +7841,14 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
  		 */
  		/* FALLTHROUGH */
  	case DNS_R_DELEGATION:
@@ -626,7 +626,7 @@ index 25eeced..162e4ea 100644
  			if (!RECURSIONOK(client) &&
  			    (options & DNS_GETDB_NOEXACT) != 0 &&
  			    qtype == dns_rdatatype_ds) {
-@@ -8089,6 +8194,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
+@@ -8130,6 +8235,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
  						       false, true);
  			}
  		}
@@ -634,7 +634,7 @@ index 25eeced..162e4ea 100644
  		if (dns_rdataset_isassociated(rdataset)) {
  			/*
  			 * If we've got a NSEC record, we need to save the
-@@ -8409,7 +8515,8 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
+@@ -8450,7 +8556,8 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
  		/*
  		 * If we have a zero ttl from the cache refetch it.
  		 */
@@ -644,7 +644,7 @@ index 25eeced..162e4ea 100644
  		    RECURSIONOK(client))
  		{
  			if (dns_rdataset_isassociated(rdataset))
-@@ -8627,7 +8734,11 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
+@@ -8676,7 +8783,11 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
  			 "query_find: unexpected error after resuming: %s",
  			 isc_result_totext(result));
  		CTRACE(ISC_LOG_ERROR, errmsg);
@@ -657,7 +657,7 @@ index 25eeced..162e4ea 100644
  		goto cleanup;
  	}
  
-@@ -8883,7 +8994,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
+@@ -8932,7 +9043,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
  		/*
  		 * If we have a zero ttl from the cache refetch it.
  		 */
@@ -666,7 +666,7 @@ index 25eeced..162e4ea 100644
  		    RECURSIONOK(client))
  		{
  			if (dns_rdataset_isassociated(rdataset))
-@@ -8894,6 +9005,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
+@@ -8943,6 +9054,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
  			if (node != NULL)
  				dns_db_detachnode(db, &node);
  
@@ -674,7 +674,7 @@ index 25eeced..162e4ea 100644
  			INSIST(!REDIRECT(client));
  			result = query_recurse(client, qtype,
  					       client->query.qname,
-@@ -9174,6 +9286,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
+@@ -9223,6 +9335,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
  				       dns_fixedname_name(&wildcardname),
  				       true, false);
   cleanup:
@@ -682,7 +682,7 @@ index 25eeced..162e4ea 100644
  	CTRACE(ISC_LOG_DEBUG(3), "query_find: cleanup");
  	/*
  	 * General cleanup.
-@@ -9230,6 +9343,49 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
+@@ -9279,6 +9392,49 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
  		goto restart;
  	}
  
@@ -733,7 +733,7 @@ index 25eeced..162e4ea 100644
  	    (!PARTIALANSWER(client) || WANTRECURSION(client)
  	     || eresult == DNS_R_DROP)) {
 diff --git a/bin/named/server.c b/bin/named/server.c
-index 1f23cf0..1fa836f 100644
+index 2bdf690..3a5ba91 100644
 --- a/bin/named/server.c
 +++ b/bin/named/server.c
 @@ -1720,7 +1720,8 @@ static bool
@@ -843,7 +843,7 @@ index 1f23cf0..1fa836f 100644
  	/*
  	 * Set supported DNSSEC algorithms.
  	 */
-@@ -14456,3 +14500,132 @@ ns_server_dnstap(ns_server_t *server, isc_lex_t *lex, isc_buffer_t **text) {
+@@ -14559,3 +14603,132 @@ ns_server_dnstap(ns_server_t *server, isc_lex_t *lex, isc_buffer_t **text) {
  	return (ISC_R_NOTIMPLEMENTED);
  #endif
  }
@@ -977,7 +977,7 @@ index 1f23cf0..1fa836f 100644
 +	return (result);
 +}
 diff --git a/bin/named/statschannel.c b/bin/named/statschannel.c
-index 4b8d972..8c68737 100644
+index 12ab048..4938c03 100644
 --- a/bin/named/statschannel.c
 +++ b/bin/named/statschannel.c
 @@ -300,6 +300,12 @@ init_desc(void) {
@@ -994,7 +994,7 @@ index 4b8d972..8c68737 100644
  
  	/* Initialize resolver statistics */
 diff --git a/bin/rndc/rndc.c b/bin/rndc/rndc.c
-index 8083654..d519983 100644
+index 0acfe3a..2c21c1d 100644
 --- a/bin/rndc/rndc.c
 +++ b/bin/rndc/rndc.c
 @@ -160,6 +160,8 @@ command is one of the following:\n\
@@ -1007,7 +1007,7 @@ index 8083654..d519983 100644
  		Print a zone's configuration.\n\
    sign zone [class [view]]\n\
 diff --git a/bin/rndc/rndc.docbook b/bin/rndc/rndc.docbook
-index e14a17e..eaf32d3 100644
+index 159ded9..12a7208 100644
 --- a/bin/rndc/rndc.docbook
 +++ b/bin/rndc/rndc.docbook
 @@ -689,6 +689,25 @@
@@ -1037,7 +1037,7 @@ index e14a17e..eaf32d3 100644
  	<term><userinput>secroots <optional>-</optional> <optional><replaceable>view ...</replaceable></optional></userinput></term>
  	<listitem>
 diff --git a/bin/tests/system/chain/prereq.sh b/bin/tests/system/chain/prereq.sh
-index f3f1939..9ff3f07 100644
+index 23bedcd..43385de 100644
 --- a/bin/tests/system/chain/prereq.sh
 +++ b/bin/tests/system/chain/prereq.sh
 @@ -48,3 +48,10 @@ else
@@ -1052,7 +1052,7 @@ index f3f1939..9ff3f07 100644
 +    exit 1
 +fi
 diff --git a/bin/tests/system/conf.sh.in b/bin/tests/system/conf.sh.in
-index 22749b9..a247fd5 100644
+index f6412f6..26c8901 100644
 --- a/bin/tests/system/conf.sh.in
 +++ b/bin/tests/system/conf.sh.in
 @@ -128,7 +128,7 @@ PARALLELDIRS="dnssec rpzrecurse \
@@ -2039,10 +2039,10 @@ index 0000000..201c996
 +echo "I:exit status: $status"
 +[ $status -eq 0 ] || exit 1
 diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml
-index bb1e81d..6dbbfad 100644
+index 99c8680..5fbabfe 100644
 --- a/doc/arm/Bv9ARM-book.xml
 +++ b/doc/arm/Bv9ARM-book.xml
-@@ -4381,6 +4381,9 @@ badresp:1,adberr:0,findfail:0,valfail:0]
+@@ -4336,6 +4336,9 @@ badresp:1,adberr:0,findfail:0,valfail:0]
  	  statement in the <filename>named.conf</filename> file:
  	</para>
  	<xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="options.grammar.xml"/>
@@ -2052,7 +2052,7 @@ index bb1e81d..6dbbfad 100644
        </section>
  
        <section xml:id="options"><info><title><command>options</command> Statement Definition and
-@@ -4474,6 +4477,7 @@ badresp:1,adberr:0,findfail:0,valfail:0]
+@@ -4429,6 +4432,7 @@ badresp:1,adberr:0,findfail:0,valfail:0]
  		  <command>dnssec-validation</command>,
  		  <command>max-cache-ttl</command>,
  		  <command>max-ncache-ttl</command>,
@@ -2060,7 +2060,7 @@ index bb1e81d..6dbbfad 100644
  		  <command>max-cache-size</command>, and
  		  <command>zero-no-soa-ttl</command>.
  		</para>
-@@ -5485,7 +5489,6 @@ options {
+@@ -5438,7 +5442,6 @@ options {
  	    </listitem>
  	  </varlistentry>
  
@@ -2068,7 +2068,7 @@ index bb1e81d..6dbbfad 100644
  	  <varlistentry>
  	    <term><command>max-zone-ttl</command></term>
  	    <listitem>
-@@ -5521,6 +5524,21 @@ options {
+@@ -5474,6 +5477,21 @@ options {
  	    </listitem>
  	  </varlistentry>
  
@@ -2090,7 +2090,7 @@ index bb1e81d..6dbbfad 100644
  	  <varlistentry>
  	    <term><command>serial-update-method</command></term>
  	    <listitem>
-@@ -6280,6 +6298,22 @@ options {
+@@ -6227,6 +6245,22 @@ options {
  	      </listitem>
  	    </varlistentry>
  
@@ -2113,31 +2113,34 @@ index bb1e81d..6dbbfad 100644
  	    <varlistentry>
  	      <term><command>nocookie-udp-size</command></term>
  	      <listitem>
-@@ -7501,14 +7535,20 @@ options {
+@@ -7449,13 +7483,19 @@ options {
  	      <term><command>resolver-query-timeout</command></term>
  	      <listitem>
  		<para>
--		  The amount of time in seconds that the resolver
-+		  The amount of time in milliseconds that the resolver
- 		  will spend attempting to resolve a recursive
- 		  query before failing.  The default and minimum
+-		  This is the amount of time in seconds that the
+-		  resolver spends attempting to resolve a recursive
+-		  query before failing.  The default and minimum
 -		  is <literal>10</literal> and the maximum is
 -		  <literal>30</literal>.  Setting it to
+-		  <literal>0</literal> results in the default
+-		  being used.
++		  The amount of time in milliseconds that the resolver
++ 		  will spend attempting to resolve a recursive
++ 		  query before failing.  The default and minimum
 +		  is <literal>10000</literal> and the maximum is
 +		  <literal>30000</literal>.  Setting it to
- 		  <literal>0</literal> will result in the default
- 		  being used.
- 		</para>
++ 		  <literal>0</literal> will result in the default
++ 		  being used.
++ 		</para>
 +		<para>
 +		  This value was originally specified in seconds.
 +		  Values less than or equal to 300 will be be treated
 +		  as seconds and converted to milliseconds before
 +		  applying the above limits.
-+		</para>
+ 		</para>
  	      </listitem>
  	    </varlistentry>
- 	  </variablelist>
-@@ -8994,6 +9034,27 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
+@@ -9016,6 +9056,27 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
  	      </listitem>
  	    </varlistentry>
  
@@ -2166,7 +2169,7 @@ index bb1e81d..6dbbfad 100644
  	      <term><command>min-roots</command></term>
  	      <listitem>
 diff --git a/doc/arm/logging-categories.xml b/doc/arm/logging-categories.xml
-index 181def7..59f6afb 100644
+index 56d05e8..098342b 100644
 --- a/doc/arm/logging-categories.xml
 +++ b/doc/arm/logging-categories.xml
 @@ -311,6 +311,17 @@
@@ -2278,7 +2281,7 @@ index e11beed..fde93c7 100644
          topology { <address_match_element>; ... }; // not implemented
          transfer-format ( many-answers | one-answer );
 diff --git a/lib/bind9/check.c b/lib/bind9/check.c
-index eaac5ba..a89d78f 100644
+index bf769fe..6c57fa4 100644
 --- a/lib/bind9/check.c
 +++ b/lib/bind9/check.c
 @@ -99,7 +99,8 @@ check_orderent(const cfg_obj_t *ent, isc_log_t *logctx) {
@@ -2522,7 +2525,7 @@ index eaac5ba..a89d78f 100644
  }
  
 diff --git a/lib/dns/cache.c b/lib/dns/cache.c
-index 4701ff8..97e427a 100644
+index 2965a4f..617737a 100644
 --- a/lib/dns/cache.c
 +++ b/lib/dns/cache.c
 @@ -138,6 +138,7 @@ struct dns_cache {
@@ -2592,7 +2595,7 @@ index 4701ff8..97e427a 100644
   * The cleaner task is shutting down; do the necessary cleanup.
   */
 diff --git a/lib/dns/db.c b/lib/dns/db.c
-index ee3e00d..576aa65 100644
+index a28a566..c581646 100644
 --- a/lib/dns/db.c
 +++ b/lib/dns/db.c
 @@ -1130,3 +1130,25 @@ dns_db_nodefullname(dns_db_t *db, dns_dbnode_t *node, dns_name_t *name) {
@@ -2622,7 +2625,7 @@ index ee3e00d..576aa65 100644
 +	return (ISC_R_NOTIMPLEMENTED);
 +}
 diff --git a/lib/dns/ecdb.c b/lib/dns/ecdb.c
-index 47994ea..23bfe7d 100644
+index fc94ccf..76d0417 100644
 --- a/lib/dns/ecdb.c
 +++ b/lib/dns/ecdb.c
 @@ -588,7 +588,9 @@ static dns_dbmethods_t ecdb_methods = {
@@ -2637,7 +2640,7 @@ index 47994ea..23bfe7d 100644
  
  static isc_result_t
 diff --git a/lib/dns/include/dns/cache.h b/lib/dns/include/dns/cache.h
-index 62797db..714b78e 100644
+index ab4b0b5..e158014 100644
 --- a/lib/dns/include/dns/cache.h
 +++ b/lib/dns/include/dns/cache.h
 @@ -260,6 +260,27 @@ dns_cache_getcachesize(dns_cache_t *cache);
@@ -2669,7 +2672,7 @@ index 62797db..714b78e 100644
  dns_cache_flush(dns_cache_t *cache);
  /*%<
 diff --git a/lib/dns/include/dns/db.h b/lib/dns/include/dns/db.h
-index 6f0eed0..e3917f2 100644
+index 96f3a8f..452770f 100644
 --- a/lib/dns/include/dns/db.h
 +++ b/lib/dns/include/dns/db.h
 @@ -195,6 +195,8 @@ typedef struct dns_dbmethods {
@@ -2729,7 +2732,7 @@ index 6f0eed0..e3917f2 100644
  
  #endif /* DNS_DB_H */
 diff --git a/lib/dns/include/dns/rdataset.h b/lib/dns/include/dns/rdataset.h
-index 5295d8e..97071ed 100644
+index ed9119a..710e97c 100644
 --- a/lib/dns/include/dns/rdataset.h
 +++ b/lib/dns/include/dns/rdataset.h
 @@ -128,6 +128,7 @@ struct dns_rdataset {
@@ -2783,7 +2786,7 @@ index 5295d8e..97071ed 100644
  /*%
   * _OMITDNSSEC:
 diff --git a/lib/dns/include/dns/resolver.h b/lib/dns/include/dns/resolver.h
-index 0b66c75..4b4b6bd 100644
+index 7b3c047..bd7d225 100644
 --- a/lib/dns/include/dns/resolver.h
 +++ b/lib/dns/include/dns/resolver.h
 @@ -547,9 +547,12 @@ dns_resolver_getmustbesecure(dns_resolver_t *resolver, dns_name_t *name);
@@ -2852,12 +2855,12 @@ index 0b66c75..4b4b6bd 100644
  dns_resolver_getoptions(dns_resolver_t *resolver);
  
 diff --git a/lib/dns/include/dns/types.h b/lib/dns/include/dns/types.h
-index 567e8a8..7bf2b60 100644
+index 2468e3c..934a641 100644
 --- a/lib/dns/include/dns/types.h
 +++ b/lib/dns/include/dns/types.h
-@@ -385,6 +385,12 @@ typedef enum {
- 	dns_updatemethod_date
- } dns_updatemethod_t;
+@@ -390,6 +390,12 @@ typedef struct {
+ 	size_t      count;
+ } dns_indent_t;
  
 +typedef enum {
 +	dns_stale_answer_no,
@@ -2869,7 +2872,7 @@ index 567e8a8..7bf2b60 100644
   * Functions.
   */
 diff --git a/lib/dns/include/dns/view.h b/lib/dns/include/dns/view.h
-index c849dec..647ca2a 100644
+index 53f1db1..96148c7 100644
 --- a/lib/dns/include/dns/view.h
 +++ b/lib/dns/include/dns/view.h
 @@ -229,6 +229,9 @@ struct dns_view {
@@ -2883,7 +2886,7 @@ index c849dec..647ca2a 100644
  
  #define DNS_VIEW_MAGIC			ISC_MAGIC('V','i','e','w')
 diff --git a/lib/dns/master.c b/lib/dns/master.c
-index 8edd732..8c9f00e 100644
+index 7d26b81..36999b5 100644
 --- a/lib/dns/master.c
 +++ b/lib/dns/master.c
 @@ -1948,12 +1948,18 @@ load_text(dns_loadctx_t *lctx) {
@@ -2910,7 +2913,7 @@ index 8edd732..8c9f00e 100644
  
  		/*
 diff --git a/lib/dns/masterdump.c b/lib/dns/masterdump.c
-index 13d1a3e..873b694 100644
+index fa839a0..91b3cab 100644
 --- a/lib/dns/masterdump.c
 +++ b/lib/dns/masterdump.c
 @@ -81,6 +81,9 @@ struct dns_master_style {
@@ -2979,10 +2982,10 @@ index 13d1a3e..873b694 100644
  			RUNTIME_CHECK(result == ISC_R_SUCCESS);
  			isc_buffer_usedregion(&buffer, &r);
 diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
-index 02f2c84..fda991d 100644
+index 3a60bcf..8ea4d47 100644
 --- a/lib/dns/rbtdb.c
 +++ b/lib/dns/rbtdb.c
-@@ -490,6 +490,7 @@ typedef ISC_LIST(rdatasetheader_t)      rdatasetheaderlist_t;
+@@ -511,6 +511,7 @@ typedef ISC_LIST(rdatasetheader_t)      rdatasetheaderlist_t;
  typedef ISC_LIST(dns_rbtnode_t)         rbtnodelist_t;
  
  #define RDATASET_ATTR_NONEXISTENT       0x0001
@@ -2990,7 +2993,7 @@ index 02f2c84..fda991d 100644
  #define RDATASET_ATTR_STALE             0x0002
  #define RDATASET_ATTR_IGNORE            0x0004
  #define RDATASET_ATTR_RETAIN            0x0008
-@@ -502,6 +503,8 @@ typedef ISC_LIST(dns_rbtnode_t)         rbtnodelist_t;
+@@ -523,6 +524,8 @@ typedef ISC_LIST(dns_rbtnode_t)         rbtnodelist_t;
  #define RDATASET_ATTR_CASESET           0x0400
  #define RDATASET_ATTR_ZEROTTL           0x0800
  #define RDATASET_ATTR_CASEFULLYLOWER    0x1000
@@ -2999,7 +3002,7 @@ index 02f2c84..fda991d 100644
  
  typedef struct acache_cbarg {
  	dns_rdatasetadditional_t        type;
-@@ -552,6 +555,8 @@ struct acachectl {
+@@ -573,6 +576,8 @@ struct acachectl {
  	(((header)->attributes & RDATASET_ATTR_ZEROTTL) != 0)
  #define CASEFULLYLOWER(header) \
  	(((header)->attributes & RDATASET_ATTR_CASEFULLYLOWER) != 0)
@@ -3008,7 +3011,7 @@ index 02f2c84..fda991d 100644
  
  
  #define ACTIVE(header, now) \
-@@ -611,6 +616,12 @@ typedef enum {
+@@ -632,6 +637,12 @@ typedef enum {
  	expire_flush
  } expire_t;
  
@@ -3021,7 +3024,7 @@ index 02f2c84..fda991d 100644
  typedef struct rbtdb_version {
  	/* Not locked */
  	rbtdb_serial_t                  serial;
-@@ -678,6 +689,12 @@ struct dns_rbtdb {
+@@ -699,6 +710,12 @@ struct dns_rbtdb {
  	dns_dbnode_t                    *soanode;
  	dns_dbnode_t                    *nsnode;
  
@@ -3034,7 +3037,7 @@ index 02f2c84..fda991d 100644
  	/*
  	 * This is a linked list used to implement the LRU cache.  There will
  	 * be node_lock_count linked lists here.  Nodes in bucket 1 will be
-@@ -721,6 +738,8 @@ struct dns_rbtdb {
+@@ -742,6 +759,8 @@ struct dns_rbtdb {
  #define RBTDB_ATTR_LOADED               0x01
  #define RBTDB_ATTR_LOADING              0x02
  
@@ -3043,7 +3046,7 @@ index 02f2c84..fda991d 100644
  /*%
   * Search Context
   */
-@@ -1791,15 +1810,15 @@ rollback_node(dns_rbtnode_t *node, rbtdb_serial_t serial) {
+@@ -1816,15 +1835,15 @@ rollback_node(dns_rbtnode_t *node, rbtdb_serial_t serial) {
  }
  
  static inline void
@@ -3063,7 +3066,7 @@ index 02f2c84..fda991d 100644
  	header->node->dirty = 1;
  
  	/*
-@@ -1840,8 +1859,8 @@ clean_cache_node(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node) {
+@@ -1865,8 +1884,8 @@ clean_cache_node(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node) {
  		/*
  		 * If current is nonexistent or stale, we can clean it up.
  		 */
@@ -3074,7 +3077,7 @@ index 02f2c84..fda991d 100644
  			if (top_prev != NULL)
  				top_prev->next = current->next;
  			else
-@@ -2086,6 +2105,80 @@ delete_node(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node) {
+@@ -2111,6 +2130,80 @@ delete_node(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node) {
  	}
  }
  
@@ -3155,7 +3158,7 @@ index 02f2c84..fda991d 100644
  /*
   * Caller must be holding the node lock.
   */
-@@ -3313,6 +3406,12 @@ bind_rdataset(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node,
+@@ -3343,6 +3436,12 @@ bind_rdataset(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node, rdatasetheader_t *header,
  		rdataset->attributes |= DNS_RDATASETATTR_OPTOUT;
  	if (PREFETCH(header))
  		rdataset->attributes |= DNS_RDATASETATTR_PREFETCH;
@@ -3168,7 +3171,7 @@ index 02f2c84..fda991d 100644
  	rdataset->private1 = rbtdb;
  	rdataset->private2 = node;
  	raw = (unsigned char *)header + sizeof(*header);
-@@ -4653,6 +4752,19 @@ check_stale_header(dns_rbtnode_t *node, rdatasetheader_t *header,
+@@ -4698,6 +4797,19 @@ check_stale_header(dns_rbtnode_t *node, rdatasetheader_t *header,
  #endif
  
  	if (!ACTIVE(header, search->now)) {
@@ -3188,7 +3191,7 @@ index 02f2c84..fda991d 100644
  		/*
  		 * This rdataset is stale.  If no one else is using the
  		 * node, we can clean it up right now, otherwise we mark
-@@ -4692,7 +4804,7 @@ check_stale_header(dns_rbtnode_t *node, rdatasetheader_t *header,
+@@ -4737,7 +4849,7 @@ check_stale_header(dns_rbtnode_t *node, rdatasetheader_t *header,
  					node->data = header->next;
  				free_rdataset(search->rbtdb, mctx, header);
  			} else {
@@ -3197,7 +3200,7 @@ index 02f2c84..fda991d 100644
  				*header_prev = header;
  			}
  		} else
-@@ -5130,7 +5242,7 @@ cache_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version,
+@@ -5178,7 +5290,7 @@ cache_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version,
  				       &locktype, lock, &search,
  				       &header_prev)) {
  			/* Do nothing. */
@@ -3206,7 +3209,7 @@ index 02f2c84..fda991d 100644
  			/*
  			 * We now know that there is at least one active
  			 * non-stale rdataset at this node.
-@@ -5608,7 +5720,7 @@ expirenode(dns_db_t *db, dns_dbnode_t *node, isc_stdtime_t now) {
+@@ -5661,7 +5773,7 @@ expirenode(dns_db_t *db, dns_dbnode_t *node, isc_stdtime_t now) {
  			 * refcurrent(rbtnode) must be non-zero.  This is so
  			 * because 'node' is an argument to the function.
  			 */
@@ -3215,7 +3218,7 @@ index 02f2c84..fda991d 100644
  			if (log)
  				isc_log_write(dns_lctx, category, module,
  					      level, "overmem cache: stale %s",
-@@ -5616,7 +5728,7 @@ expirenode(dns_db_t *db, dns_dbnode_t *node, isc_stdtime_t now) {
+@@ -5669,7 +5781,7 @@ expirenode(dns_db_t *db, dns_dbnode_t *node, isc_stdtime_t now) {
  		} else if (force_expire) {
  			if (! RETAIN(header)) {
  				set_ttl(rbtdb, header, 0);
@@ -3224,7 +3227,7 @@ index 02f2c84..fda991d 100644
  			} else if (log) {
  				isc_log_write(dns_lctx, category, module,
  					      level, "overmem cache: "
-@@ -5873,9 +5985,9 @@ cache_findrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
+@@ -5928,9 +6040,9 @@ cache_findrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
  				 * non-zero.  This is so because 'node' is an
  				 * argument to the function.
  				 */
@@ -3236,7 +3239,7 @@ index 02f2c84..fda991d 100644
  			if (header->type == matchtype)
  				found = header;
  			else if (header->type == RBTDB_RDATATYPE_NCACHEANY ||
-@@ -6167,7 +6279,7 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
+@@ -6232,7 +6344,7 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
  				     topheader = topheader->next)
  				{
  					set_ttl(rbtdb, topheader, 0);
@@ -3245,7 +3248,7 @@ index 02f2c84..fda991d 100644
  				}
  				goto find_header;
  			}
-@@ -6225,7 +6337,7 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
+@@ -6293,7 +6405,7 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
  				 * ncache entry.
  				 */
  				set_ttl(rbtdb, topheader, 0);
@@ -3254,7 +3257,7 @@ index 02f2c84..fda991d 100644
  				topheader = NULL;
  				goto find_header;
  			}
-@@ -6263,8 +6375,11 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
+@@ -6331,8 +6443,11 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
  		}
  
  		/*
@@ -3268,7 +3271,7 @@ index 02f2c84..fda991d 100644
  		 */
  		if (rbtversion == NULL && trust < header->trust &&
  		    (ACTIVE(header, now) || header_nx)) {
-@@ -6293,6 +6408,10 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
+@@ -6362,6 +6477,10 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
  
  			if ((options & DNS_DBADD_EXACT) != 0)
  				flags |= DNS_RDATASLAB_EXACT;
@@ -3279,7 +3282,7 @@ index 02f2c84..fda991d 100644
  			if ((options & DNS_DBADD_EXACTTTL) != 0 &&
  			     newheader->rdh_ttl != header->rdh_ttl)
  					result = DNS_R_NOTEXACT;
-@@ -6336,11 +6455,12 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
+@@ -6405,11 +6524,12 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
  			}
  		}
  		/*
@@ -3297,7 +3300,7 @@ index 02f2c84..fda991d 100644
  		 */
  		if (IS_CACHE(rbtdb) && ACTIVE(header, now) &&
  		    header->type == dns_rdatatype_ns &&
-@@ -6511,10 +6631,10 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
+@@ -6582,10 +6702,10 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
  				changed->dirty = true;
  			if (rbtversion == NULL) {
  				set_ttl(rbtdb, header, 0);
@@ -3310,7 +3313,7 @@ index 02f2c84..fda991d 100644
  				}
  			}
  			if (rbtversion != NULL && !header_nx) {
-@@ -8331,6 +8451,30 @@ nodefullname(dns_db_t *db, dns_dbnode_t *node, dns_name_t *name) {
+@@ -8436,6 +8556,30 @@ nodefullname(dns_db_t *db, dns_dbnode_t *node, dns_name_t *name) {
  	return (result);
  }
  
@@ -3341,7 +3344,7 @@ index 02f2c84..fda991d 100644
  static dns_dbmethods_t zone_methods = {
  	attach,
  	detach,
-@@ -8376,7 +8520,9 @@ static dns_dbmethods_t zone_methods = {
+@@ -8481,7 +8625,9 @@ static dns_dbmethods_t zone_methods = {
  	NULL,
  	hashsize,
  	nodefullname,
@@ -3352,7 +3355,7 @@ index 02f2c84..fda991d 100644
  };
  
  static dns_dbmethods_t cache_methods = {
-@@ -8424,7 +8570,9 @@ static dns_dbmethods_t cache_methods = {
+@@ -8529,7 +8675,9 @@ static dns_dbmethods_t cache_methods = {
  	setcachestats,
  	hashsize,
  	nodefullname,
@@ -3363,7 +3366,7 @@ index 02f2c84..fda991d 100644
  };
  
  isc_result_t
-@@ -8695,7 +8843,7 @@ dns_rbtdb_create
+@@ -8800,7 +8948,7 @@ dns_rbtdb_create
  	rbtdb->rpzs = NULL;
  	rbtdb->load_rpzs = NULL;
  	rbtdb->rpz_num = DNS_RPZ_INVALID_NUM;
@@ -3372,7 +3375,7 @@ index 02f2c84..fda991d 100644
  	/*
  	 * Version Initialization.
  	 */
-@@ -9113,7 +9261,8 @@ rdatasetiter_first(dns_rdatasetiter_t *iterator) {
+@@ -9218,7 +9366,8 @@ rdatasetiter_first(dns_rdatasetiter_t *iterator) {
  				 * rdatasets to work.
  				 */
  				if (NONEXISTENT(header) ||
@@ -3382,7 +3385,7 @@ index 02f2c84..fda991d 100644
  					header = NULL;
  				break;
  			} else
-@@ -10322,7 +10471,7 @@ static inline bool
+@@ -10427,7 +10576,7 @@ static inline bool
  need_headerupdate(rdatasetheader_t *header, isc_stdtime_t now) {
  	if ((header->attributes &
  	     (RDATASET_ATTR_NONEXISTENT |
@@ -3391,7 +3394,7 @@ index 02f2c84..fda991d 100644
  	      RDATASET_ATTR_ZEROTTL)) != 0)
  		return (false);
  
-@@ -10428,7 +10577,7 @@ expire_header(dns_rbtdb_t *rbtdb, rdatasetheader_t *header,
+@@ -10533,7 +10682,7 @@ expire_header(dns_rbtdb_t *rbtdb, rdatasetheader_t *header,
  	      bool tree_locked, expire_t reason)
  {
  	set_ttl(rbtdb, header, 0);
@@ -3401,7 +3404,7 @@ index 02f2c84..fda991d 100644
  	/*
  	 * Caller must hold the node (write) lock.
 diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
-index 337a2f3..24e14d2 100644
+index 49ec49c..2de70a6 100644
 --- a/lib/dns/resolver.c
 +++ b/lib/dns/resolver.c
 @@ -141,16 +141,17 @@
@@ -3434,7 +3437,7 @@ index 337a2f3..24e14d2 100644
  #endif
  
  /* The default maximum number of recursions to follow before giving up. */
-@@ -515,6 +516,11 @@ struct dns_resolver {
+@@ -529,6 +530,11 @@ struct dns_resolver {
  	dns_fetch_t *			primefetch;
  	/* Locked by nlock. */
  	unsigned int			nfctx;
@@ -3446,7 +3449,7 @@ index 337a2f3..24e14d2 100644
  };
  
  #define RES_MAGIC			ISC_MAGIC('R', 'e', 's', '!')
-@@ -1625,14 +1631,12 @@ fctx_setretryinterval(fetchctx_t *fctx, unsigned int rtt) {
+@@ -1650,14 +1656,12 @@ fctx_setretryinterval(fetchctx_t *fctx, unsigned int rtt) {
  	unsigned int seconds;
  	unsigned int us;
  
@@ -3465,7 +3468,7 @@ index 337a2f3..24e14d2 100644
  
  	/*
  	 * Add a fudge factor to the expected rtt based on the current
-@@ -4494,7 +4498,8 @@ fctx_create(dns_resolver_t *res, dns_name_t *name, dns_rdatatype_t type,
+@@ -4542,7 +4546,8 @@ fctx_create(dns_resolver_t *res, dns_name_t *name, dns_rdatatype_t type,
  	/*
  	 * Compute an expiration time for the entire fetch.
  	 */
@@ -3475,7 +3478,7 @@ index 337a2f3..24e14d2 100644
  	iresult = isc_time_nowplusinterval(&fctx->expires, &interval);
  	if (iresult != ISC_R_SUCCESS) {
  		UNEXPECTED_ERROR(__FILE__, __LINE__,
-@@ -8983,6 +8988,8 @@ dns_resolver_create(dns_view_t *view,
+@@ -9105,6 +9110,8 @@ dns_resolver_create(dns_view_t *view,
  	res->spillattimer = NULL;
  	res->zspill = 0;
  	res->zero_no_soa_ttl = false;
@@ -3484,7 +3487,7 @@ index 337a2f3..24e14d2 100644
  	res->query_timeout = DEFAULT_QUERY_TIMEOUT;
  	res->maxdepth = DEFAULT_RECURSION_DEPTH;
  	res->maxqueries = DEFAULT_MAX_QUERIES;
-@@ -10317,17 +10324,20 @@ dns_resolver_gettimeout(dns_resolver_t *resolver) {
+@@ -10439,17 +10446,20 @@ dns_resolver_gettimeout(dns_resolver_t *resolver) {
  }
  
  void
@@ -3513,7 +3516,7 @@ index 337a2f3..24e14d2 100644
  }
  
  void
-@@ -10424,3 +10434,34 @@ dns_resolver_getquotaresponse(dns_resolver_t *resolver, dns_quotatype_t which)
+@@ -10546,3 +10556,34 @@ dns_resolver_getquotaresponse(dns_resolver_t *resolver, dns_quotatype_t which)
  
  	return (resolver->quotaresp[which]);
  }
@@ -3549,10 +3552,10 @@ index 337a2f3..24e14d2 100644
 +	resolver->nonbackofftries = tries;
 +}
 diff --git a/lib/dns/sdb.c b/lib/dns/sdb.c
-index d4c8c67..ee9be79 100644
+index 477bb74..09cf932 100644
 --- a/lib/dns/sdb.c
 +++ b/lib/dns/sdb.c
-@@ -1368,7 +1368,9 @@ static dns_dbmethods_t sdb_methods = {
+@@ -1370,7 +1370,9 @@ static dns_dbmethods_t sdb_methods = {
  	NULL,			/* setcachestats */
  	NULL,			/* hashsize */
  	NULL,			/* nodefullname */
@@ -3564,7 +3567,7 @@ index d4c8c67..ee9be79 100644
  
  static isc_result_t
 diff --git a/lib/dns/sdlz.c b/lib/dns/sdlz.c
-index 0b9620c..331992e 100644
+index 037d74a..9218fed 100644
 --- a/lib/dns/sdlz.c
 +++ b/lib/dns/sdlz.c
 @@ -1336,7 +1336,9 @@ static dns_dbmethods_t sdlzdb_methods = {
@@ -3579,7 +3582,7 @@ index 0b9620c..331992e 100644
  
  /*
 diff --git a/lib/dns/tests/db_test.c b/lib/dns/tests/db_test.c
-index 2849775..812f750 100644
+index bc1cc3f..60fdb81 100644
 --- a/lib/dns/tests/db_test.c
 +++ b/lib/dns/tests/db_test.c
 @@ -28,8 +28,9 @@
@@ -3810,7 +3813,7 @@ index 2849775..812f750 100644
  						_setup, _teardown),
  		cmocka_unit_test_setup_teardown(dbtype_test,
 diff --git a/lib/dns/view.c b/lib/dns/view.c
-index 0fca1d9..55ede81 100644
+index a7ba613..a644c5f 100644
 --- a/lib/dns/view.c
 +++ b/lib/dns/view.c
 @@ -229,6 +229,9 @@ dns_view_create(isc_mem_t *mctx, dns_rdataclass_t rdclass,
@@ -3824,7 +3827,7 @@ index 0fca1d9..55ede81 100644
  	view->maxbits = 0;
  	view->v4_aaaa = dns_aaaa_ok;
 diff --git a/lib/isccfg/namedconf.c b/lib/isccfg/namedconf.c
-index 91693b5..5771774 100644
+index 212194e..b562f95 100644
 --- a/lib/isccfg/namedconf.c
 +++ b/lib/isccfg/namedconf.c
 @@ -1778,6 +1778,7 @@ view_clauses[] = {
@@ -3855,5 +3858,5 @@ index 91693b5..5771774 100644
  	{ "topology", &cfg_type_bracketed_aml, CFG_CLAUSEFLAG_NOTIMP },
  	{ "transfer-format", &cfg_type_transferformat, 0 },
 -- 
-2.21.1
+2.26.2
 

bind-9.3.2-redhat_doc.patch

@@ -1,68 +1,98 @@
-diff --git a/bin/named/named.8 b/bin/named/named.8
-index ef10ef4..3150b22 100644
---- a/bin/named/named.8
-+++ b/bin/named/named.8
-@@ -349,6 +349,63 @@ The default configuration file\&.
- /var/run/named/named\&.pid
- .RS 4
- The default process\-id file\&.
-+.PP
-+.SH "NOTES"
-+.PP
-+.TP
-+\fBRed Hat SELinux BIND Security Profile:\fR
-+.PP
-+By default, Red Hat ships BIND with the most secure SELinux policy
-+that will not prevent normal BIND operation and will prevent exploitation
-+of all known BIND security vulnerabilities . See the selinux(8) man page
-+for information about SElinux.
-+.PP
-+It is not necessary to run named in a chroot environment if the Red Hat
-+SELinux policy for named is enabled. When enabled, this policy is far
-+more secure than a chroot environment. Users are recommended to enable
-+SELinux and remove the bind-chroot package.
-+.PP
-+With this extra security comes some restrictions:
-+.PP
-+By default, the SELinux policy does not allow named to write any master
-+zone database files. Only the root user may create files in the $ROOTDIR/var/named
-+zone database file directory (the options { "directory" } option), where
-+$ROOTDIR is set in /etc/sysconfig/named.
-+.PP
-+The "named" group must be granted read privelege to
-+these files in order for named to be enabled to read them.
-+.PP
-+Any file created in the zone database file directory is automatically assigned
-+the SELinux file context named_zone_t .
-+.PP
-+By default, SELinux prevents any role from modifying named_zone_t files; this
-+means that files in the zone database directory cannot be modified by dynamic
-+DNS (DDNS) updates or zone transfers.
-+.PP
-+The Red Hat BIND distribution and SELinux policy creates three directories where
-+named is allowed to create and modify files: /var/named/slaves, /var/named/dynamic
-+/var/named/data. By placing files you want named to modify, such as
-+slave or DDNS updateable zone files and database / statistics dump files in
-+these directories, named will work normally and no further operator action is
-+required. Files in these directories are automatically assigned the 'named_cache_t'
-+file context, which SELinux allows named to write.
-+.PP
-+\fBRed Hat BIND SDB support:\fR
-+.PP
-+Red Hat ships named with compiled in Simplified Database Backend modules that ISC
-+provides in the "contrib/sdb" directory. Install bind-sdb package if you want use them
-+.PP
-+The SDB modules for LDAP, PostGreSQL, DirDB and SQLite are compiled into named-sdb.
-+.PP
-+See the documentation for the various SDB modules in /usr/share/doc/bind-sdb-*/ .
-+.br
-+.PP
-+\fBRed Hat system-config-bind:\fR
-+.PP
-+Red Hat provides the system-config-bind GUI to configure named.conf and zone
-+database files. Run the "system-config-bind" command and access the manual
-+by selecting the Help menu.
-+.PP
- .RE
- .SH "SEE ALSO"
- .PP
+From facdbb0f2a266c6a3a1fa823afaa09cbd3fc38a5 Mon Sep 17 00:00:00 2001
+From: Petr Mensik <pemensik@redhat.com>
+Date: Thu, 26 Nov 2020 12:13:10 +0100
+Subject: [PATCH] Note specific Red Hat changes in manual page
+
+Change docbook template instead of generated manual page. Remove
+system-config-bind reference, package were discontinued.
+---
+ bin/named/named.docbook | 73 +++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 73 insertions(+)
+
+diff --git a/bin/named/named.docbook b/bin/named/named.docbook
+index 7e743a9..802bec3 100644
+--- a/bin/named/named.docbook
++++ b/bin/named/named.docbook
+@@ -516,6 +516,79 @@
+ 
+   </refsection>
+ 
++  <refsection><info><title>NOTES</title></info>
++    <refsection><info><title>Red Hat SELinux BIND Security Profile</title></info>
++
++    <para>
++    By default, Red Hat ships BIND with the most secure SELinux policy
++    that will not prevent normal BIND operation and will prevent exploitation
++    of all known BIND security vulnerabilities . See the selinux(8) man page
++    for information about SElinux.
++    </para>
++
++    <para>
++    It is not necessary to run named in a chroot environment if the Red Hat
++    SELinux policy for named is enabled. When enabled, this policy is far
++    more secure than a chroot environment. Users are recommended to enable
++    SELinux and remove the bind-chroot package.
++    </para>
++
++    <para>
++    With this extra security comes some restrictions:
++    </para>
++
++    <para>
++    By default, the SELinux policy allows named to write any master
++    zone database files. Only the root user may create files in the $ROOTDIR/var/named
++    zone database file directory (the options { "directory" } option), where
++    $ROOTDIR is set in /etc/sysconfig/named.
++    </para>
++
++    <para>
++    The "named" group must be granted read privelege to
++    these files in order for named to be enabled to read them.
++    </para>
++
++    <para>
++    Any file created in the zone database file directory is automatically assigned
++    the SELinux file context named_zone_t .
++    </para>
++
++    <para>
++    By default, SELinux prevents any role from modifying named_zone_t files; this
++    means that files in the zone database directory cannot be modified by dynamic
++    DNS (DDNS) updates or zone transfers.
++    </para>
++
++    <para>
++    The Red Hat BIND distribution and SELinux policy creates three directories where
++    named is allowed to create and modify files: /var/named/slaves, /var/named/dynamic
++    /var/named/data. By placing files you want named to modify, such as
++    slave or DDNS updateable zone files and database / statistics dump files in
++    these directories, named will work normally and no further operator action is
++    required. Files in these directories are automatically assigned the 'named_cache_t'
++    file context, which SELinux allows named to write.
++    </para>
++    </refsection>
++
++    <refsection><info><title>Red Hat BIND SDB support</title></info>
++
++    <para>
++    Red Hat ships named with compiled in Simplified Database Backend modules that ISC
++    provides in the "contrib/sdb" directory. Install bind-sdb package if you want use them.
++    </para>
++
++    <para>
++    The SDB modules for LDAP, PostGreSQL, DirDB and SQLite are compiled into <command>named-sdb</command>.
++    </para>
++
++    <para>
++    See the documentation for the various SDB modules in /usr/share/doc/bind-sdb-*/ .
++    </para>
++    </refsection>
++
++  </refsection>
++
+   <refsection><info><title>SEE ALSO</title></info>
+ 
+     <para><citetitle>RFC 1033</citetitle>,
+-- 
+2.26.2
+

bind.spec

@@ -57,15 +57,15 @@
 #
 
 # lib*.so.X versions of selected libraries
-%global sover_dns 1110
-%global sover_isc 1105
+%global sover_dns 1114
+%global sover_isc 1107
 %global sover_irs 161
 %global sover_isccfg 163
 
 Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
 Name:     bind
 License:  MPLv2.0
-Version:  9.11.18
+Version:  9.11.31
 Release:  1%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
@@ -74,7 +74,7 @@ Source:   https://ftp.isc.org/isc/bind9/%{BINDVERSION}/bind-%{BINDVERSION}.tar.g
 Source1:  named.sysconfig
 Source2:  https://ftp.isc.org/isc/bind9/%{BINDVERSION}/bind-%{BINDVERSION}.tar.gz.asc
 Source3:  named.logrotate
-Source4:  https://downloads.isc.org/isc/pgpkeys/codesign2019.txt
+Source4:  https://downloads.isc.org/isc/pgpkeys/codesign2021.txt
 Source7:  bind-9.3.1rc1-sdb_tools-Makefile.in
 Source8:  dnszone.schema
 Source12: README.sdb_pgsql
@@ -144,10 +144,6 @@ Patch157:bind-9.11-fips-tests.patch
 Patch158:bind-9.11-rt31459.patch
 # [RT #46047] commit 24172bd2eeba91441ab1c65d2717b0692309244a ISC 4724
 Patch159:bind-9.11-rt46047.patch
-# commit 66ba2fdad583d962a1f4971c85d58381f0849e4d
-# commit b105ccee68ccc3c18e6ea530063b3c8e5a42571c
-# commit 083461d3329ff6f2410745848a926090586a9846
-Patch160:bind-9.11-rh1624100.patch
 # https://gitlab.isc.org/isc-projects/bind9/issues/555
 Patch161:bind-9.11-host-idn-disable.patch
 # https://gitlab.isc.org/isc-projects/bind9/commit/8a98277811e
@@ -165,8 +161,6 @@ Patch174:bind-9.11-json-c.patch
 Patch175:bind-9.11-fips-disable.patch
 Patch177: bind-9.11-serve-stale.patch
 Patch178: bind-9.11-serve-stale-dbfix.patch
-# https://bugzilla.redhat.com/show_bug.cgi?id=1736762
-Patch183: bind-9.11-rh1736762-5.patch
 
 # SDB patches
 Patch11: bind-9.3.2b2-sdbsrc.patch
@@ -242,10 +236,14 @@ BuildRequires:  libmaxminddb-devel
 BuildRequires:  fstrm-devel protobuf-c-devel
 %endif
 # Needed to regenerate dig.1 manpage
-BuildRequires: docbook-style-xsl, libxslt
+# Docbook5 with namespace is required.
+# Visit for details: https://gitlab.isc.org/isc-projects/bind9/-/issues/2310
+BuildRequires:  docbook5-style-xsl, libxslt
 %if %{with TSAN}
 BuildRequires: libtsan
 %endif
+BuildRequires:  dblatex
+BuildRequires:  doxygen
 
 %description
 BIND (Berkeley Internet Name Domain) is an implementation of the DNS
@@ -273,6 +271,7 @@ For other supported HSM modules please check the BIND documentation.
 Summary: Bind tools with native PKCS#11 for using DNSSEC
 Requires: bind-pkcs11-libs%{?_isa} = %{epoch}:%{version}-%{release}
 Obsoletes: bind-pkcs11 < 32:9.9.4-16.P2
+Requires: bind-dnssec-doc = %{epoch}:%{version}-%{release}
 
 %description pkcs11-utils
 This is a set of PKCS#11 utilities that when used together create rsa
@@ -361,10 +360,11 @@ You should install bind-utils if you need to get information from DNS name
 servers.
 
 %package dnssec-utils
-Summary: Utilities for DNSSEC keys and DNS zone files management
+Summary: DNSSEC keys and zones management utilities
 Requires: bind-libs-lite%{?_isa} = %{epoch}:%{version}-%{release}
 Recommends: bind-utils
 Requires: python3-bind = %{epoch}:%{version}-%{release}
+Requires: bind-dnssec-doc = %{epoch}:%{version}-%{release}
 
 %description dnssec-utils
 Bind-dnssec-utils contains a collection of utilities for editing
@@ -375,6 +375,14 @@ You should install bind-dnssec-utils if you need to sign a DNS zone
 or maintain keys for it.
 
 %if %{with DEVEL}
+%package dnssec-doc
+Summary: Manual pages of DNSSEC utilities
+Requires: bind-license = %{epoch}:%{version}-%{release}
+BuildArch:noarch
+
+%description dnssec-doc
+Bind-dnssec-doc contains manual pages for bind-dnssec-utils.
+
 %package devel
 Summary:  Header files and libraries needed for BIND DNS development
 Obsoletes:bind-libbind-devel < 31:9.3.3-4.fc7
@@ -391,11 +399,13 @@ required for development with ISC BIND 9
 Summary:  Lite version of header files and libraries needed for BIND DNS development
 Requires: bind-libs-lite%{?_isa} = %{epoch}:%{version}-%{release}
 Requires: openssl-devel%{?_isa} libxml2-devel%{?_isa}
+# Not required by headers, but "isc-config.sh --libs isc" requires it
+Requires: libcap-devel%{?_isa}
 %if %{with GSSTSIG}
 Requires: krb5-devel%{?_isa}
 %endif
 %if %{with LMDB}
-Requires: lmdb-devel
+Requires: lmdb-devel%{?_isa}
 %endif
 %if %{with JSON}
 Requires:  json-c-devel%{?_isa}
@@ -554,7 +564,6 @@ are used for building ISC DHCP.
 %patch157 -p1 -b .fips-tests
 %patch158 -p1 -b .rt31459
 %patch159 -p1 -b .rt46047
-%patch160 -p1 -b .rh1624100
 %patch161 -p1 -b .host-idn-disable
 %patch163 -p1 -b .rh1663318
 %patch164 -p1 -b .rh1666814
@@ -567,11 +576,15 @@ are used for building ISC DHCP.
 %patch175 -p1 -b .rh1709553
 %patch177 -p1 -b .serve-stale
 %patch178 -p1 -b .rh1770492
-%patch183 -p1 -b .rh1736762-5
 
 mkdir lib/dns/tests/testdata/dstrandom
 cp -a %{SOURCE50} lib/dns/tests/testdata/dstrandom/random.data
 
+# Avoid having [FIXME: manual] on top of generated manual pages
+# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/4524
+find bin lib/lwres/man -name '*.docbook' -exec \
+  sed -e 's|<refmiscinfo>BIND9|<refmiscinfo class="manual">BIND9|' -i '{}' ';'
+
 %if %{with PKCS11}
 cp -r bin/named{,-pkcs11}
 cp -r bin/dnssec{,-pkcs11}
@@ -699,7 +712,6 @@ export LIBDIR_SUFFIX
 %endif
 %if %{with GSSTSIG}
   --with-gssapi=yes \
-  --disable-isc-spnego \
 %endif
 %if %{with LMDB}
   --with-lmdb=yes \
@@ -716,7 +728,7 @@ export LIBDIR_SUFFIX
   --with-cmocka \
 %endif
   --enable-fixed-rrset \
-  --with-docbook-xsl=%{_datadir}/sgml/docbook/xsl-stylesheets \
+  --with-docbook-xsl=%{_datadir}/sgml/docbook/xsl-ns-stylesheets \
   --enable-full-report \
 ;
 %if %{with DNSTAP}
@@ -728,7 +740,7 @@ export LIBDIR_SUFFIX
 %endif
   popd
 %endif
-make %{?_smp_mflags}
+%make_build
 
 ### FIXME hack!!!
 ### xsltproc doesn't find properly configured files
@@ -745,6 +757,17 @@ pushd bin/python
 make man
 popd
 
+  # Because oot is not supported in docbook, copy required sources to build directory
+  pushd ..
+  find -name '*.docbook' | while read F; do install -Dvp "$F" "build/$F"; done
+  find doc -name '*.xml' | while read F; do [ -f "build/$F" ] || install -Dvp "$F" "build/$F"; done
+  popd
+  cp -upv ../doc/xsl/*.xsl doc/xsl/
+  cp -Rupv ../doc/xsl/graphics doc/xsl/
+  cp -upv ../doc/tex/notestyle.sty doc/tex/
+  cp -upv ../doc/arm/*.conf ../doc/arm/isc-logo.pdf doc/arm/
+  cp -upv ../doc/doxygen/*.html doc/doxygen
+  make doc
 %if %{with DLZ}
   pushd contrib/dlz
   pushd modules
@@ -787,7 +810,6 @@ export LIBDIR_SUFFIX
         --enable-openssl-hash \
 %if %{with GSSTSIG}
         --with-gssapi=yes \
-        --disable-isc-spnego \
 %endif
 %if %{with UNITTEST}
         --with-cmocka \
@@ -826,7 +848,7 @@ do
             -i isc-export-config.sh
 done;
 
-make %{?_smp_mflags}
+%make_build
 popd
 
 # export library unit tests
@@ -949,12 +971,12 @@ touch ${RPM_BUILD_ROOT}/%{chroot_sdb_prefix}%{_sysconfdir}/named.conf
 #end sdb-chroot
 
 pushd build
-make DESTDIR=${RPM_BUILD_ROOT} install
+%make_install
 popd
 
 %if %{with EXPORT_LIBS}
 pushd export-libs
-make DESTDIR=${RPM_BUILD_ROOT} install
+%make_install
 mkdir -p ${RPM_BUILD_ROOT}%{_sysconfdir}/ld.so.conf.d
 echo "%{_libdir}/%{_export_dir}" > %{buildroot}%{_sysconfdir}/ld.so.conf.d/%{name}-export-%{_arch}.conf
 cp -fp config.h ${RPM_BUILD_ROOT}/%{_includedir}%{_export_dir}
@@ -1006,16 +1028,16 @@ install -m 644 %{SOURCE12} contrib/sdb/pgsql/
   pushd contrib/dlz
   pushd modules
   for DIR in filesystem ldap mysql mysqldyn sqlite3; do
-    make -C $DIR DESTDIR=${RPM_BUILD_ROOT} libdir=%{_libdir}/bind install
+    %make_install -C $DIR libdir=%{_libdir}/bind
   done
   mv mysqldyn/testing/README mysqldyn/testing/README.testing
   %if %{with BDB}
-    make -C bdbhpt DESTDIR=${RPM_BUILD_ROOT} libdir=%{_libdir}/bind install
+    %make_install -C bdbhpt libdir=%{_libdir}/bind
   %endif
   popd
   %if %{with BDB}
     pushd bin/dlzbdb
-      make DESTDIR=${RPM_BUILD_ROOT} install
+      %make_install
     popd
   %endif
   popd
@@ -1393,9 +1415,13 @@ fi;
 
 %files dnssec-utils
 %{_sbindir}/dnssec*
-%{_mandir}/man8/dnssec*.8*
 %if %{with PKCS11}
 %exclude %{_sbindir}/dnssec*pkcs11
+%endif
+
+%files dnssec-doc
+%{_mandir}/man8/dnssec*.8*
+%if %{with PKCS11}
 %exclude %{_mandir}/man8/dnssec*-pkcs11.8*
 %endif
 
@@ -1518,9 +1544,6 @@ fi;
 %{_sbindir}/pkcs11-tokens
 %{_mandir}/man8/pkcs11*.8*
 %{_mandir}/man8/dnssec*-pkcs11.8*
-%{_mandir}/man8/dnssec*.8*
-%exclude %{_mandir}/man8/dnssec-coverage.8*
-%exclude %{_mandir}/man8/dnssec-keymgr.8*
 
 %files pkcs11-libs
 %{_libdir}/libdns-pkcs11.so.%{sover_dns}*
@@ -1604,6 +1627,53 @@ fi;
 
 
 %changelog
+* Thu Apr 29 2021 Petr Menšík <pemensik@redhat.com> - 32:9.11.31-1
+- Update to 9.11.31
+
+* Fri Feb 19 2021 Petr Menšík <pemensik@redhat.com> - 32:9.11.28-1
+- Update to 9.11.28
+
+* Fri Jan 22 2021 Petr Menšík <pemensik@redhat.com> - 32:9.11.27-1
+- Update to 9.11.27
+
+* Wed Jan 06 2021 Petr Menšík <pemensik@redhat.com> - 32:9.11.26-2
+- Use make macros
+- https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro
+
+* Mon Jan 04 2021 Petr Menšík <pemensik@redhat.com> - 32:9.11.26-1
+- Update to 9.11.26
+
+* Mon Nov 30 2020 Petr Menšík <pemensik@redhat.com> - 32:9.11.25-2
+- Regenerate all manual pages on build
+
+* Thu Nov 26 2020 Petr Menšík <pemensik@redhat.com> - 32:9.11.25-1
+- Update to 9.11.25
+
+* Wed Nov 04 2020 Petr Menšík <pemensik@redhat.com> - 32:9.11.24-2
+- Fix crash on NTA recheck failure (#1893761)
+
+* Fri Oct 23 2020 Petr Menšík <pemensik@redhat.com> - 32:9.11.24-1
+- Update to 9.11.24
+
+* Thu Sep 17 2020 Petr Menšík <pemensik@redhat.com> - 32:9.11.23-1
+- Update to 9.11.23
+
+* Tue Sep 01 2020 Petr Menšík <pemensik@redhat.com> - 32:9.11.22-2
+- Require libcap from devel package
+
+* Thu Aug 20 2020 Petr Menšík <pemensik@redhat.com> - 32:9.11.22-1
+- Update to 9.11.22
+
+* Wed Jul 15 2020 Petr Menšík <pemensik@redhat.com> - 32:9.11.21-1
+- Update to 9.11.21
+
+* Wed Jun 17 2020 Petr Menšík <pemensik@redhat.com> - 32:9.11.20-1
+- Update to 9.11.20
+
+* Fri May 15 2020 Petr Menšík <pemensik@redhat.com> - 32:9.11.19-1
+- Update to 9.11.19 (CVE-2020-8616, CVE-2020-8617)
+- Make initscripts just optional dependency
+
 * Thu Apr 16 2020 Petr Menšík <pemensik@redhat.com> - 32:9.11.18-1
 - Update to 9.11.18
 

bind97-rh645544.patch

@@ -1,7 +1,8 @@
-diff -up bind-9.9.4rc2/lib/dns/resolver.c.rh645544 bind-9.9.4rc2/lib/dns/resolver.c
---- bind-9.9.4rc2/lib/dns/resolver.c.rh645544	2013-08-19 10:30:52.000000000 +0200
-+++ bind-9.9.4rc2/lib/dns/resolver.c	2013-09-06 17:58:03.864165823 +0200
-@@ -1138,7 +1138,7 @@ log_edns(fetchctx_t *fctx) {
+diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
+index ecb3ddb..f7f73cd 100644
+--- a/lib/dns/resolver.c
++++ b/lib/dns/resolver.c
+@@ -1456,7 +1456,7 @@ log_edns(fetchctx_t *fctx) {
  	 */
  	dns_name_format(&fctx->domain, domainbuf, sizeof(domainbuf));
  	isc_log_write(dns_lctx, DNS_LOGCATEGORY_EDNS_DISABLED,
@@ -10,7 +11,7 @@ diff -up bind-9.9.4rc2/lib/dns/resolver.c.rh645544 bind-9.9.4rc2/lib/dns/resolve
  		      "success resolving '%s' (in '%s'?) after %s",
  		      fctx->info, domainbuf, fctx->reason);
  
-@@ -3804,7 +3804,7 @@ log_lame(fetchctx_t *fctx, dns_adbaddrin
+@@ -4667,7 +4667,7 @@ log_lame(fetchctx_t *fctx, dns_adbaddrinfo_t *addrinfo) {
  	dns_name_format(&fctx->domain, domainbuf, sizeof(domainbuf));
  	isc_sockaddr_format(&addrinfo->sockaddr, addrbuf, sizeof(addrbuf));
  	isc_log_write(dns_lctx, DNS_LOGCATEGORY_LAME_SERVERS,
@@ -19,12 +20,12 @@ diff -up bind-9.9.4rc2/lib/dns/resolver.c.rh645544 bind-9.9.4rc2/lib/dns/resolve
  		      "lame server resolving '%s' (in '%s'?): %s",
  		      namebuf, domainbuf, addrbuf);
  }
-@@ -3831,7 +3831,7 @@ log_formerr(fetchctx_t *fctx, const char
- 	}
+@@ -4685,7 +4685,7 @@ log_formerr(fetchctx_t *fctx, const char *format, ...) {
+ 	isc_sockaddr_format(&fctx->addrinfo->sockaddr, nsbuf, sizeof(nsbuf));
  
  	isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER,
 -		      DNS_LOGMODULE_RESOLVER, ISC_LOG_NOTICE,
 +		      DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(1),
- 		      "DNS format error from %s resolving %s%s%s: %s",
- 		      nsbuf, fctx->info, clmsg, clbuf, msgbuf);
+ 		      "DNS format error from %s resolving %s for %s: %s",
+ 		      nsbuf, fctx->info, fctx->clientstr, msgbuf);
  }

bind99-rh640538.patch

@@ -1,40 +1,58 @@
+From a76716d5d039947d6fe2cd49a151b16a29e12d42 Mon Sep 17 00:00:00 2001
+From: Petr Mensik <pemensik@redhat.com>
+Date: Mon, 4 Jan 2021 12:55:49 +0100
+Subject: [PATCH] .rh640538
+---
+ bin/dig/dig.docbook | 43 +++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 43 insertions(+)
+
 diff --git a/bin/dig/dig.docbook b/bin/dig/dig.docbook
-index 1079421..f11abd1 100644
+index 8ccf207..6d16d37 100644
 --- a/bin/dig/dig.docbook
 +++ b/bin/dig/dig.docbook
-@@ -1177,6 +1177,39 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
+@@ -1336,6 +1336,49 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
      </para>
    </refsection>
  
 +  <refsection><info><title>RETURN CODES</title></info>
++
 +    <para>
 +      <command>Dig</command> return codes are:
++
 +      <variablelist>
-+        <varlistentry>
-+          <listitem>
-+            <para>0: Everything went well, including things like NXDOMAIN</para>
-+          </listitem>
-+        </varlistentry>
-+        <varlistentry>
-+          <listitem>
-+            <para>1: Usage error</para>
-+          </listitem>
-+        </varlistentry>
-+        <varlistentry>
-+          <listitem>
-+            <para>8: Couldn't open batch file</para>
-+          </listitem>
-+        </varlistentry>
-+        <varlistentry>
-+          <listitem>
-+            <para>9: No reply from server</para>
-+          </listitem>
-+        </varlistentry>
-+        <varlistentry>
-+          <listitem>
-+            <para>10: Internal error</para>
-+          </listitem>
-+        </varlistentry>
++	<varlistentry>
++	  <term>0</term>
++	  <listitem>
++	    <para>Everything went well, including things like NXDOMAIN.</para>
++	  </listitem>
++	</varlistentry>
++	<varlistentry>
++	  <term>1</term>
++	  <listitem>
++	    <para>Usage error.</para>
++	  </listitem>
++	</varlistentry>
++
++	<varlistentry>
++	  <term>8</term>
++	  <listitem>
++	    <para>Could not open batch file.</para>
++	  </listitem>
++	</varlistentry>
++	<varlistentry>
++	  <term>9</term>
++	  <listitem>
++	    <para>No reply from server.
++	    </para>
++	  </listitem>
++	</varlistentry>
++	<varlistentry>
++	  <term>10</term>
++	  <listitem>
++	    <para>Internal error.
++	    </para>
++	  </listitem>
++	</varlistentry>
 +      </variablelist>
 +    </para>
 +  </refsection>
@@ -42,3 +60,6 @@ index 1079421..f11abd1 100644
    <refsection><info><title>FILES</title></info>
  
      <para><filename>/etc/resolv.conf</filename>
+-- 
+2.26.2
+

ci.fmf

@@ -0,0 +1,13 @@
+/test:
+    summary:
+        CI plan, picks Tier1 tests, runs in beakerlib.
+    description:
+        This special plan has to be named ci.fmf to run in CI.
+        It selects test which have 'tier 1' in their main.fmf file
+    discover:
+      - name: tier1
+        how: fmf
+        filter: 'tier: 1'
+        repository: "https://src.fedoraproject.org/tests/bind.git"
+    execute:
+        how: tmt

codesign2019.txt

@@ -1,252 +0,0 @@
------BEGIN PGP PUBLIC KEY BLOCK-----
-Comment: GPGTools - http://gpgtools.org
-
-mQINBFwq9BQBEADHjPDCwsHVtxnMNilgu187W8a9rYTMLgLfQwioSbjsF7dUJu8m
-r1w2stcsatRs7HBk/j26RNJagY2Jt0QufOQLlTePpTl6UPU8EeiJ8c15DNf45TMk
-pa/3MdIVpDnBioyD1JNqsI4z+yCYZ7p/TRVCyh5vCcwmt5pdKjKMTcu7aD2PtTtI
-yhTIetJavy1HQmgOl4/t/nKL7Lll2xtZ56JFUt7epo0h69fiUvPewkhykzoEf4UG
-ZFHSLZKqdMNPs/Jr9n7zS+iOgEXJnKDkp8SoXpAcgJ5fncROMXpxgY2U+G5rB9n0
-/hvV1zG+EP6OLIGqekiDUga84LdmR/8Cyc7DimUmaoIZXrAo0Alpt0aZ8GimdKmh
-qirIguJOSrrsZTeZLilCWu37fRIjCQ3dSMNyhHJaOhRJQpQOEDG7jHxFak7627aF
-UnVwBAOK3NlFfbomapXQm64lYNoONGrpV0ctueD3VoPipxIyzNHHgcsXDZ6C00sv
-SbuuS9jlFEDonA6S8tApKgkEJuToBuopM4xqqwHNJ4e6QoXYjERIgIBTco3r/76D
-o22ZxSK1m2m2i+p0gnWTlFn6RH+r6gfLwZRj8iR4fa0yMn3DztyTO6H8AiaslONt
-LV2kvkhBar1/6dzlBvMdiRBejrVnw+Jg2bOmYTncFN00szPOXbEalps8wwARAQAB
-tE1JbnRlcm5ldCBTeXN0ZW1zIENvbnNvcnRpdW0sIEluYy4gKFNpZ25pbmcga2V5
-LCAyMDE5LTIwMjApIDxjb2Rlc2lnbkBpc2Mub3JnPokCVAQTAQgAPhYhBK4/rHln
-EexZ/AB6pHS7a5pMuz04BQJcKvQUAhsDBQkD7JcABQsJCAcCBhUKCQgLAgQWAgMB
-Ah4BAheAAAoJEHS7a5pMuz0476oP/1+UaSHfe4WVHV43QaQ/z1rw7vg2aHEwyWJA
-1D1tBr9+LvfohswwWBLIjcKRaoXZ4pLBFjuiYHBTsdaAQFeQQvQTXMmBx21ZyUZj
-tjim8f9T1JhmIrMx6tF14NbqFpjw82Mv0rc8y74pdRvkdnFigqLKUoN2tFQlKeG+
-5T24zNwrGrlR3S7gnM47nD1JqKwt4GnczLnMBW/0gbLscMUpAeNo/gY4g0GV/zkn
-Rt91bLpcEyDAv+ZhQZbkJ49dnNzl5cTK5+uQWnlAZAdPecdLkvBNRNgj/FKL41RF
-JGN6eqq3+jlPbyj9okeJoGQ64Ibv1ZHVTQIx5vT1+PuVX/Nm0GqSUZdLqR33daKI
-hjpgUdUK/D0AnN5ulVuE1NnZWjVDTXVEeU8DFvi4lxZVHnZixejxFIZ7vRMvyaHa
-xLwbevwEUuPLzWn3XhC5yQeqCe6zmzzaPhPlg6NTnM5wgzcKORqCXgxzmtnX+Pbd
-gXTwNKAJId/141vj1OtZQKJexG9QLufMjBg5rg/qdKooozremeM+FovIocbdFnmX
-pzP8it8r8FKi7FpXRE3fwxwba4Y9AS2/owtuixlJ2+7M2OXwZEtxyXTXw2v5GFOP
-vN64G/b71l9c3yKVlQ3BXD0jErv9XcieeFDR9PK0XGlsxykPcIXZYVy2KSWptkSf
-6f2op3tMiQEzBBABCAAdFiEEFcm6uMUTPAcGawLtlumWUDlMmawFAlwuSqAACgkQ
-lumWUDlMmaz+igf/ZW8OY5aWjRk7QiXp93jkWRIbMi8kB9jW5u6tfYXFjMADpqiQ
-yYdzEHFayRF92PQwj81UzIWzOWjErFWLDE2xol9sP5LdzeqoyED+XTqKggpVsIs+
-Lq672qnumQoZKp1YGb8MDocU2DNg/VsMdi7kCnEnPbcSuBxksmxGYomusXNrAF94
-1OJ2sqd9BuFamLIyn8XUCGGYlsvMoe4kTCg6Cc1sQvx0lDG8urKN57jBKWbP4alV
-+JBV5KQcf74gzPmE3ypgY1tMEwxyH/WyS9ekDbai0qauX6eUAsM1bduH8fIcknLS
-Zl5hrJTrzWFF9/DKOth8QOwhJ9zoIF1fcAsx9okBMwQQAQgAHRYhBHpqR7X54SM6
-0lUrXL2X3GOe6MR7BQJcLktcAAoJEL2X3GOe6MR7jwEH/iaolMeno1oeWAgzN6Mg
-bx3maweh/9Vqty1fwk7Crq1G78X5i1OCkknEL2p0Bfle4ApwcC4HZVcqCgoYpRV3
-/EEXtwkMNy3plWdBbLCQSev/E1D39GzgAHiMnv7NUJnkoJbvMrvrAiUTXPTtARMM
-gjEpvgEs60wuJxS8ESomRhe/KW4myxDoBxF+K+e5bOkOvvWVcAYJHWZ1BIZs4n6b
-+C2vO8q5aKTkQ/XvNT7utbTOqj1SGhItRaAQKXHBdzkQ1Et3wTA4+uRg4gK12624
-9LperYs26w9X9UzApl+qVxQhtWUw3tnUXMastDfQrRcvJgq1xpv++OqX5Uc93RTf
-SNWJAjMEEAEIAB0WIQS+DpdItxglOii7if/xsRvwXPAuVwUCXC5LlQAKCRDxsRvw
-XPAuV29KEACEwlTVVKe4gnBYHnlAD7csoQ0+gJ6C+Ofzlw+UItRIcFeVCAknSGBs
-NPxr9JStIvKpmsbSKpCNUEAYnRP2immh94y/C6BuTe1uUUmqBGr1f4OAUwZpmI29
-ixYeY/uUs9FZO3bS0/WtG46tdcJK41qtM0DYAGT3oeZhJMTW15dfvMGlFukauSOU
-+BbR+6sZhqdbWl/AOTE/6x5otnAaW0GObY/BW240Xq/KTgBrzVdK5qNoYsMVsiTd
-0im0JKvFG08ED+ZfcILhlO6G9jRhoTkhtYuf8CKN1dPf2IoB5FrRFf0xqRr9hNlk
-X7ViNMP9OPb8i3BubWvRi5rNSquCwrFATSiAgaA9Yi1BNzQsmQxOql9lsh7eCH7m
-+8zzUg9umWI6PkSv8vHBo2kPX73wmtEsF6vxJlk0yDBuQw7y0uuKh406tEEk4cP2
-8U4baq+ihpioupDhNuEII1h1Eh/RBE408RAOpcr+2F0m/fKOoJyz7u+AxyV81Ia6
-fyBnUfZnlfKo16w87c1HJRs9dKkRa5yGziBf9TcED3sru58Pftes2Nr80/iOh26i
-P2pRihcIyrmeAqDWnneErVCmPMDTe6zkMrm/0iZ25/Jfq+M8IHEzFEw3Y1FBOeFg
-9TyMDwYG2biJPTNTDO0BQ+Rrvs4SjFWEYSxgJSvG1jMfSPt5AR6MJrkCDQRcKvQU
-ARAAufZX5WzJr0lZAhxaGpHY6JMBr4jVOCP4TrDZhwC2K4CXNM/PLLNisWzquiWa
-FvUDhB89kCxrEhipwVFYhBr16CDQxrr8yhah3RIxrBMYhRTxgIAkANgkhGWfDJSE
-zXauA7krYtS3rYwhfXe4cNsTkLPbnMUlyLJcqj2wnZcZIt97aL+NFRPyfIw1KfUb
-9u3tB9seDYbvTEULeL07aTnHpWM5f3bTwJrJ2OFPzXseCCzPiVNh3Bv+YtJ1pMTr
-c/UHO5DoJuHLsF0wicPSrpD0twspFdR/0rT6eNycsaCtV4GQzBcMPvY7qai5XrZm
-Cqgluo1W6l6+F5YrKvRMtyyFkUNGcPywdjSlP44JyRrS2uzvFUViSsJArcmFG2TJ
-LCohnse8wqjw0dIUVbmDbE4zjaG56zkvu0k+04Wwp3XPgOZrbl6cbhX3yLhu/Gt0
-dzd9EReoNfKXk32hBzKas/vdeB5DZejbOOOWYftqyZC1LvDvvrYFhFK6VGozfZ6L
-Fml1hzn+xPahp5tRv93/T9zXeVPm9zilGMqm/gjRgh8ojWxNQoNzJyqTPWIvWmbu
-EIP3T3cTFq6lJpJsg3+sfzofGWZCGnBZQGqm8rEOoUWiaKe1BvQCX1x8p4/x8/tX
-TaVDpQCGoqxXt09plkDuGMuiDICxBlaHWUR2jLoHc2cLrB8AEQEAAYkCPAQYAQgA
-JhYhBK4/rHlnEexZ/AB6pHS7a5pMuz04BQJcKvQUAhsMBQkD7JcAAAoJEHS7a5pM
-uz04pB8P/Amfg54IFeALiPOrKbjC3bVAQzrsf09IL8sUln/LCZIx9HgGAJj/f35S
-Q35sK2ucjWiDX6qCxVrWmC6caQXFgXOFSKIlqladmmgj4sIdLM5wj4nbomHChpB5
-rqV/GgkFwWBQ3kPCatXvc8Bg+zKJ+wXgTuPFXefyE9R+SLuas2grQ9hAjvTGHYbq
-iYxSlNDFc1aHLAQ3bS76351MHuMHOpLzoB0OkZDCVNW4GNEqrLbINdr50RAK+Loo
-Z2UBIobEZjXYor9A2FWkSvdjyz6X1QKMdQMath6R91k/O0abBa7ly4/805eAGXM3
-w1Xf2eMlpiUs69BeYoJBklK8aNMntpDREunJjhiPU4JoDzSxl5Qv7LuXylyo0YJA
-9YmydKhTTcRdwsKc//nGr/ckg4BRl+VbtJBYvd3xGB7IQ+pT/TOakv9qCospAhr3
-EQjVP/XpnWJRd+x+dq8UXqwWmTenWDE42cNr7BDFJdOqS5ZWy4sIz4sdjpSxXMB9
-8iiRtKSpKRCJgXScB7SYebh835EgG2YyQGdhJMO7C6ok9POYQBqL8sBqRzImJKoT
-VDvOH42WArKwJWTHa4mPdiDHEIZlkONerec3JXtl4Mfv8cwZ5Lb8fSiB/x8AWvqs
-puc/7hQtkus4TcgutS1fwhAwpnFItpVF6+73CMQrJsblBdTjW0T+uQINBFxbVHwB
-EADebZOJbhPdhHeBPdlZYE3rRjB8scDpWdjrCupfmeTC9MM6JgCE4DEMBtBXk+h1
-+7wfpblYYNFwGVFvytG5nvGRDtHWxwd1Z9O8Fx4Zqu0Fx/wAn7ZL3ryE+tdHR7JK
-7SLxOa2X49T/8LY0U8Q65I4ZRo/b4VMcXApCmncw3QSRqHT/mYdNnf+HHPvi3jza
-md3iVptCS4Iaisc079DFda+htWXspBc13lmPi2vGQkWjjS3B4yO8JackyQPVhpsg
-KYbRBzOH0Kii8bXmyA6O5uIJYEddp5Veged4FE/ej3CrgGP1D0Yk1epx8lLbi9RB
-kwFS7DA5rQ23UnbSy1WyV1ZgPrWqQAWuGpjMTVTWN0ElI3AGxAnE8lZlSXyE+XyV
-uHjjIVrayBjLKVqDuSLdKZeCvI4QsyHH6F0NKJQkngvXxLZYxO6s0c2EFFLzdVWT
-1V9GMP8UsDrrb+JsZjUVmPR1tTP4xqEQG6KjfFoQm5XWpGtFwh91OK1lwf/Bx2/C
-j+PquLLFcj7hEP79VDTUZPQAduTTxIeTzHXH+x1PCHFB10xxH3e82VSdJeBUrJxn
-riXzK50SKTTmF+uYpHqE8Jg1N2Y1n5ksuxeYUy8PFjhAeBCqZ6ZcldUDf4999e/z
-PT8bwfCDr8jRdqJHrq7RxTJiP5RsMudWpKeohzJGwQ5uZwARAQABiQRyBBgBCAAm
-FiEErj+seWcR7Fn8AHqkdLtrmky7PTgFAlxbVHwCGwIFCQO9IQACQAkQdLtrmky7
-PTjBdCAEGQEIAB0WIQSVztolaxygoV8wL7WVIaftXazpGAUCXFtUfAAKCRCVIaft
-XazpGPeMEACm9nxA/VKf8RxDo2ZuTgyuSwlR8tCjAE4k3+UoiYUbamkW4pjx9Vgd
-1zC5bNxSWZ5vlJ4CH8ArKFqNK5LBVDZqhYureAo/1Af2b9vRJw0/QQHhuXz/jqeT
-wwrLuKpy796Gpt+aFfcmS0ZC4QXfxJERhAP6tu1p6YmAsSb+bjziQVkKrt9mhOrL
-dtz6WP0Fg1joRj33FgnnLtayHvtgQrNFI3ztCjk/B2FjYZxqbBGfk5gyo0cTE2Fi
-oLhG/XrxIoZepFMJkGYETnYQXrOt2KuJLvawV70YQmG8EqHYY8drKA0XDZs8TVdT
-5cvGvtm8ERz5znsssRBxQMI5Ml6O2ahrXp8Eq4htCzlvO8t2MOtzvqAJRiyAd6bA
-Uo+MGVRpnvePOR1SAgBXCd416rF0iCXc1utZxnqwdq9kJAZ+8mCLx4N4jk6AdGpX
-zcNkLg7QmUzXn75RxZ6GrIUYZJNMlswXq5XhSW4o8ePlaxWjh9+QTtU964AZhpA1
-uoHsKGTBxHJs0w6McZm14kb2PuaO2/rpf8s8IZyc93+Y5O/gHZ6/agBjA9qN6wkQ
-R1d5UhJC4QS/m35rBGBKK9X3fqQxaBCio6Qz+m4A3GchrztJpq+2P+ma5ylsTq5j
-V4njky26WNtrV7+N0C4Moj3I4Qn6YU/eSManTXzHzoiPZCEH/IOxgXIiD/9Zm3Zz
-I+h4NCfSGyP11/w1gEzlTHQ4at/FXIIDh0Y2ZNpWPffuFQLtcER2vyKPwhDYpGMy
-NNHXks4azfrXVCv0wmSNBbeS8pJrYtopZpCEBrAbg/YLv9m5lpDSRHaR3gv/qMZ7
-QxY+NwqciqTwGq68PuF4mDSvtfuFmbEES9Iybiie+eL/6DU2knfBjgshUe6vElR+
-LYoPQ45GY2IxRTJ1pMXaZw1+evwH3UvseRGkRygiaBgoU/qR4prynvjMQcacCa+C
-aRnXZJYp/usVBeY0xut9toc9/OcLGoBr5h9l5YjruO2vu8VHou8N0tarVQn3YbQR
-Fi+YtNtclWJa8Pq1AsKRTCFwDwP6eODv6mNOrEFydNRcpiQmzp47VWF/YHRfHzCq
-A1wHLxLUrpQTaVw6J4FqedAQ31aAO4faA7MS+ZMNBqZCZ7lTGC6TvojqqBAN2yX7
-AnnYpZHM+lGpi2/ukVzLqSkGmdNOgbu+UZvoej3YnHYig4yWP+z2xrlJl8bkhU/d
-r9IQE5aRCEPB/JWhHJ2/GqYl9qjshlB52+6X2KDarwptOtzT9ooArYhpMwKIYh34
-c7X8tlAKYk7V5j7txIRFDKKAftC7dM82PntXJxSkWyR70GYnYjiXyrqqerqT7xIC
-mDEQgFOPpy09zFW62paO9uiZw6qwybwqgGpoX7kCDQRcW1TbARAA3ERo2mPv2VVg
-ZUFr4MtPDm4UG00YJW/LYa3D3k0e9tdSScACXprk1sAoxUlQx/CSdErPKwXG4rax
-iN4t5nICUUNYSC0dh09G25jC7nwsWc0AYyZu+h/FzfvpOm3fBwmBlzILlGh0URwH
-Ffj9fHt6hos4C+3PFZZ/X24aMJF/cov1oYi9rqFwt/l0mgtPE88Iyj2/Vp3Lergg
-QMzKfEuyluj9fL2cgU0Qa7oAPXmaxhHtua4cvbM5SXGo3FXjIgzH9OfM+2orebeN
-wH1M3ec6w+nPmRmCJLvPKGOeS7GVXL5/aOyPlDWzSXYnpCKS2ntw4K4nt0IA8n8z
-1db109l/C2noDrDSJEqOo843ShNGTYOMVUrj3a+Y7o2ATc9pNZalf0PwnKas7NDb
-IJ152PEQw665iYXcv2awjLF6W0yuSq8kfiaAxIrsie2Dto0zgqOs0Ot9Y74u11Hh
-wBSHUO3mEZJScAAcI/yDF2PvjvCQSzu4mdXb77t6X2O6YHULz4A7bVQCMazcTDI9
-/S0W2+ixPnnJVnE3xgjK9zuizji8JDJw1hJCQM+yTLVqq9pfvcRfQ6uwpMRzz/O3
-S0zDRiA69/GyfNwkpgz5QaGpY02IK5WrQU1doRjIz4BHAYzoIOkMkRqTtjdElQZw
-/D3wSO2uwsEMNwRzibR/Lz1JF2aGn6EAEQEAAYkEcgQYAQgAJhYhBK4/rHlnEexZ
-/AB6pHS7a5pMuz04BQJcW1TbAhsCBQkDvSEAAkAJEHS7a5pMuz04wXQgBBkBCAAd
-FiEE1wyE5ktVjlvM7AchMuIXXx11eioFAlxbVNsACgkQMuIXXx11eiqCfQ//SFDf
-rOIEoslp6n6vlCuavOg02wvjskKQGP1P1Q4v40Fw1Gl87n9uXAoMpeF4H+pzUxOi
-BHYCQi+EemwocSThzaWfPzd3JG/0OcRymf+ZOcBb+58VJL7p88QdMFIAi5J+KMuA
-fEG0zLkc9anEnXoVMmQJX5K+6PyeVDvBbYGjLjQAsWTZTiVuQI0w3WxFtDGWqQII
-8e/qE0DA7c/auGn7j2hid308+FcdfpmLefW9YesWjE1yYvHoCRdFOJ/7Sft4MQCI
-Re7UET3TRMBvtisP2DcqyzGPp22s4ZYFCCJJNiB92bXdEl5zXe4Ff7JTfNE/QrR7
-Wg5R9hZHgHdbp8p8bA3f0y29YCx3puYg7BbmQWiMh3rXWE5b090pSpw0K9BQU3vO
-irr+5/2TaFOJXHl4VF03GrWsSncShCbdsdRIv4TB0lY2mN4q+e7bjlAzJJeoaS97
-GIqu3DBlAJyx/ZwWW23DXXwoQ4jNuJhpl2jaCE7rVQB0uLjbp0i9Zdd4SdYZxmO/
-Y+JfgoJz8eyx8wZi4eDz1ijN0WKsIGjxJH5VUK9STjijDMeG6ZZRLc6b1QCGhe97
-ZbDkEUTdQGoeu4L5Fiqoma13NEsf8ofBDv+myJm/O67Va9JI3gxhIrhmF7LMzQQp
-lYx2peZC1CmhEnn83dtt83mhXvX6Dth657BW/Qd+GQ//SVuTPuNkBXfrTi4dbnv+
-cU6IsoIBodTF/WsQ6h4kbtsPhO5DbrsLNuNumrqVEN8jw+HUsEeNvFNeMrTPdG2V
-87ShQ4BQGkCf+GFRBj0myxxXOFZYQx6RpY5fCe7yOcTzpkbnPWmm7V8HdOuZ0NnL
-JNQ5YogOI6UvXVKv35R9qBo+G9jkhhb0eaAu6BERzKVANKfsGN7545ElZ1qlffMh
-AQhXGb6TsvCeSg2cWGb2cnVL2d58uVukD4PDiq4qqwgClkF3bOO70SIgGrCteHbi
-4Hseopex5m6GqqjoUYXr7QQBwSaQdc+gKtEjMHCsHbUyHRk0qEHdEe+2RmL0d0ra
-QMJfKyYQjcCR7tnrgN4WD1h4NKRdC/KRW31MDmH9XVPrkOMQCUCnArXkOwdKWsKf
-h8af9HqweXOT1FHJN/M3tWaBpv6KoduF2f2pj1VhPZ2EqFUycJ26lrHyOpsynQR6
-+TD+c1uXotDwKN5RW+YL1cydk6mhib64fdOyPUeTcHehjMAFgM2f5wi35Ujcj8id
-37cWOqRsggSbMnGO4AUA/YtcVNG8TjZbakson8ENK7e8q4sEiNFUZ7/CtzNokwHQ
-5uOG1+qB85Y4ImGnIZVeiBpjt73VVawg4Zvm/omtW50P9R+4rVhMJZZFAgrWg8BH
-H/KNznW0vUuShG8B+2FA/eu5Ag0EXFtVDAEQAL5ftI1GgVJEFgX5VsuFnfBnH95c
-zqmwEXaTP4s7Xm3O0Wy579EzRUD1eEw/UaD/q2OHScwvMP65cZYQ9w4hnCN6H96P
-96Teo7LOMCssvSXIO7gqP33LKTqDzsIoAFHwWE3dq1jbyP6T1Je85mr0Edvk8kOC
-B1hudswAARno/7X9zGulhhwuEHk5Iey7R59yRUQqBctdNcetGyaiFjjX0evuVADi
-/z/s07XhDLDt7+3Vglh1/7XGC64QhB9QjZ8j0u7+0xfmLLjhi+7EpkDlAHIJXX1H
-0wAsPOGKlYruQUmIsMNfBINZeulHEBZ4cAd30xsM296DzJ6QL9sAGfYMhRs0YHB/
-EJ10Zv0iw1pU2jCCUv/9Kf4F4nwgHQWQP7JAbfhOIUOUq/YlxjTLnkd25+7vD3KH
-NQ6UiRDROR9Jwetpd/zokpf5O5iTBpVL+sCq+NsTZyDOjITve2sY0V8v10M+Z+pL
-cp/cUZ4JEDS/WJ4/ovBNJP8b+YwN/RBgCjl8UBX/N+e7AA52eYP2H9GK9XPkzSCE
-VxEf5PyjGrwedpoLkzagrHsDuWo3uBquLyneT/ozihqKQAuInUy5B7rWU4mpKHe5
-Vto5o6Zuj+6MgHgIQzRK6Da2ziMNEmroxwZibcYCtUPdvcvxGh+byclnzBclKjOw
-kAalFPx0SxEbHmzPABEBAAGJBHIEGAEIACYWIQSuP6x5ZxHsWfwAeqR0u2uaTLs9
-OAUCXFtVDAIbAgUJA70hAAJACRB0u2uaTLs9OMF0IAQZAQgAHRYhBK7WIv4CB360
-tcFGwUKiedJIzcMQBQJcW1UMAAoJEEKiedJIzcMQH+cQAIQYXDnqi4Hl21LtAgky
-pZxug+x/LECVlwkrIfaQF337+fG+H9J7SdU87Sn1Xe/YUgQnF0XP/fjIVFM0e/Tb
-xVlmTFqiejLnIwJJDgUaHO3POT2sGEyO3tc0mqSzyRBxtMQ8yvApccBhL5QODv3h
-hlRWgk5MXU0IPeXw134IWm+o/PRiPBoXPawvVfEVIBlUFaiSZASf4BAiSad4aJQe
-P8PyP7FPvQB1xiib0iSetn6ZmNeN2OSUJPiPA8aE9JCKuFtomVQEDM0BqQDl5A7h
-5O2uyf0Li+/ArqBvfBjrH03e5zbID02dO3D2BjsV3jUeVPQ5WDgVg8LH+nfg/rRy
-wfCsx9zFp1mt3K4xN2v7IKwxGndApgCcx17gsjzMvLz0J7sSGov4MNjzqvGEDKCl
-uUvNKXqy7je9xcQLpoyvWtoWFXWTbQAcK5Vv+hC67r9bHpjI1KuqA8hYqNKxsv7s
-wiLZdd4SK9SIuwf0j8/XTZwmoFfGolJil0ZNxyqBF39+CMVpaHdLM1qKZz99TVzS
-h4obOOjkUjK458xSo0XCbJ4qXYp7PgxyWK6GIbTozbbG/1ldw+LUnqxt8Shf797L
-J9lbI3ICuR2P5PYlKJf3b6D9GyfqyrP387fKAKhHsYkZ1XD54/8wIgTrdfeNPtL0
-1mjWDjw5KvO9kuPBjcmzgt+NrtsQAJwKeZsiqLLcY8kJ9xP+/xtTlh2iVuZMfxwq
-hwlo4MMCzpobLDZ/JKU398m77eboTKJSBfeUYxQd4ATn1L8NLKjLxKAaBkjEk0nN
-8w9OUQbFlhQ/asLzzF7Z9IGGh9/SEgBZ8V67a0O3Qw9Xdi3ARK3bbZ8RIVJ0+P9G
-CGrfq9j4ZmGA2L4irLjsvDAv7CSMb4WBKW8j0Jz5LFMwOMJgG1TT5c6lNqFj6y09
-rZcVLnt8+lUv2Bw3LC0oI1TjFkrrCzIdfg++mPi3K/ZFc50bvnWF4eCOjgZ5U9Vb
-sxFZq3+vTRcIfI9z2lZ9CNDRA1O5jGvuVtEGLiSLF2aJ6kiNriLuuGTlXfg/Fpgh
-GTvyppOTzF7PtHzHBQ/ZjnhWojnc/jyJRwLK8cCl6+EOc887v8BDmqgFWtmycsE2
-5fDJ7UFGP13g/eDL3ZUgMDty5dQaUOTX145t2KT+lMqpY6ZK2EC+eoqrnIGJ+tYy
-0l4RRxi10mbNhuPIIDdph7X+mUHgCeA9gyF0Y+LqiB6CX+zFg7ovLvnCbMPxdGXq
-z7AjfwqZBKI+BVuBeDtyW4onmElCu5cXNKsg3W0IlQlZf9PMDU6Ht0XLUs7EPfbQ
-sH1Vqi1XE1W/tGnkmjcpG/qlt9Gx1uwFGLP6iomqUBc2c0GZ6R1xplXvd3w3yC8d
-8lAgPGImuQINBFxbVToBEADkuxhQx9gxlzzCc0nUu2v82XsD+GzONp9irt14gslx
-te96eKaTXTi0t5eya0X5TIY3wbREwjlfAeM9AfcAmWcsM4izrfPtANM6WOxB2Tbz
-EY2cqv7NBQii7Z5aqPyjcIiT0b0Gs2evlDkn3xEBBqTSrNcnGSA29bZPIkaUb7Qo
-p/Ani0S3/tgcR21gXsJwkgpfNKwvPT03Lz3/o5rXAyag0M/25adgk9SVKNcXc8h2
-HSGv5ENjwUKNNnowVbNLw4287mFUM2Vd6unGJ2MBj7aUwTrfBl7gNV96mMdDJWcB
-hGKYkxUvibuHCa2KH7gTrnV6X7sdrgD5CbJMPq6OZNSP6n6bUVg22eHxoETplFwT
-4NvV3clRMWIAG1XgXR1l99LAh7PPnPMM1pHQGPwYHQskoBFS4g5knzHpB9h9TfZ3
-MM4cDZR5NgWmE0fYVnWe5ax+wW0/IOklUoHv3qoL4yiN9wFJq2oLzUNQd9+tsqiy
-vxSTh8iYmHegyn5KuBPsrMPgvqiKOdalTZKkak9DOx4cGQL2qHspKxiBOb6uox2v
-fjMQ5bDeUn+4DYMdnZNHeywCUegJmDakUtlfvN+136IDHGwfdGcitqzswzd3+PI2
-qlwPE19gkrp9NUaD3Qj2ZtDP7sU2cThc6Gra5KRFW8f98bI77j1Wu6pCnYFLqPz4
-QQARAQABiQRyBBgBCAAmFiEErj+seWcR7Fn8AHqkdLtrmky7PTgFAlxbVToCGwIF
-CQO9IQACQAkQdLtrmky7PTjBdCAEGQEIAB0WIQR5HX64jryNAThDSqwz3zWa56YK
-eQUCXFtVOgAKCRAz3zWa56YKeSWOEADK8u03LESGSQlZQqnnCAI8iYs1s+XRMEnG
-2tAQ1OK7/4eNgr1yZckmaW4FBMgeEgYIBJ7v3SlW7Hf7dE10TYPNGbP6UxVW8HIP
-rA4CINcGZXWWwpS374JNMS6A5eb6viuEgEMEi00jx0MmLvCMZKypmwXQUl5YJ5nB
-ytpQ1681mCQxGBMhT1eKQt3B4nAsoEnP+HnqVM/nKxBemSBNXX+C0b/YeQoLC3sD
-L+Z0NRI8U6PZl9Rokod3uynH0vfBYCEJd6MvsjtnJlVVaseYIA3ESNrFG12tw95I
-wKNrVCANZ1DBSyK4ovmmWsDrH+uFTHSLNjlxIuVxUfmXcLfgcepVCmd/7Z7UrWYr
-SXSvP0VG4ZmEPE7tNb8bfyADftO1cVsmcHBQeSrgvpSrTv9L8MocojpR5vJc1f+a
-sBT7rAeGzZP9riz1GmryXawaZgdLfaaJfzRQkc1uTChb7kMN+UMhVUdCAXmho0XO
-SfcsW84u/LpjdYh2Ww41xQO6EWvbZDNgD/Fdmp8Uh1MqJ1Dejri6kjNn6wPImXJd
-Eu6nHqWDRdYsfT4XUB18tB+4aIpFzCyIgpf7p1uaVU7Oqip5sZkc/WXKr77lV23m
-PQvpGRNCzgU2TJY7ktR3LOvUVN6wNfLMHzeQk18NdmcEGUrJ0YYtl9vE5/Eg9L6x
-LBH9PKt17IQ8D/9DLwQX8pl3fuTM8ZbzIPLxiXhbgzBBTXKRE2u1888+RIq9xE7c
-aVFjwq4qpgqZ5SFonTcG4Pi5ck3mFAzyA5zLRF+ckpmBpwSPMpLwCpv10369D1jh
-AF3JsUwt6DIb2BISMhh2ThSUMSKO75q8GSotsKjJyjD6vl1x4L7WXubTWxEiNuwD
-3kAjFWS1Z1VWtA9SURWAbsDaCV4VmwCCpSIwRr9OTbyu9XuMdMxGNpl8SwW7MVQb
-x4aYNvR7Hl/wIR71AHAXoSfrKp3p12anXjYYASHmbm16ugP4H7HLMBfznKet2f76
-gIxJr1CsAMTSqypcC1UoVb6Gz8djeIR+GU+6efHI4TIUMy5uMIUx8tYbwSEeo/y6
-NnjpJFYYjJa671iSABInNxs4+X+1zrFa+wl45EnaFxziEet2Qzv/VsusoLvLwnYi
-BZckclAS5xoVGFW0WJ01OfLUDHxGMt9GSheL8c+GLMaMtaCWunpmmt9zZ9WdpBOu
-AGluMG1Cee50TrhXaGE8CdNr8nOdSeLNAveBAPmuVa0JDSe20/D/RuYJLKeG9Vsq
-BZvjuGlOUsfl6UjtiGRbgS9OWpxeez5ugc9yyV+rBGIpmnIb+9quz2HmGxE65eA2
-cRNsZRIjFLzeAx/0RMaT1nlLFTBbUuZ+tJ+fgFtRGMhifZn1pb2dMQo0N7kCDQRc
-W1VuARAAv4LYaNq2Zev/v7M5DnxLpgHRcMkG7TOQpycrlK5653llpZzTy3mh5peW
-vcq3IDmdeUIJxQ+WDh2f0vS+NIKDC/HAddfHrZPbhO7zLxLcMW5KmV05ancaRSP0
-s0+IyQmvVxUNrgPinZiphlvRGoLXS6pdgfc4jIR9B2umPecfvfu/6EWFPnXZgG8K
-yY3Z+mwrmEO0FaXHBQuu6nactiPe79N4bLe8hk9RW6yIxLBeJzIoOlIcJmuRHapt
-nS2lV3mfhZdFnkAp1o6a2TL5BwgMY0wZUKZr78HEMKh6LbPN9rPepf0neUeq/k1l
-NJU7V6XMS+rezF31vgSJ5KoNGYhxtWZ54uksH2rcw7+ltpSVtqY91G/vibpRCJG3
-LdX/kxHni1NEWyZlpS/6ntuH6HSoNYsR9IMsbESs3QVCH74ApK88CxYCRB0SEo0M
-yAElbQ3bfEKCKl/FwC4IzAYAJ2arWKwBHRSJlsrNCtczrjG7j3EyJrn8+Tm5yjO6
-0THQjvc/nBxrNE09r1Lzz7jrDWC9Rl+BH6wqdniymoYyUAQsX2rZ+Jhah1Zkf+Gu
-76qtY+EH494dPM+0FazcBlgBd6/J5mh3Wk9JuecXLTEUGtzd1GmI9CENPAklCauX
-tNOWeTop27djuKWsZxuP1GyV6UYixFVOSWteyAbA32cncVv/2ZUAEQEAAYkEcgQY
-AQgAJhYhBK4/rHlnEexZ/AB6pHS7a5pMuz04BQJcW1VuAhsCBQkDvSEAAkAJEHS7
-a5pMuz04wXQgBBkBCAAdFiEEFWiQaF6g32oTce8gF8xdsfAIhAcFAlxbVW4ACgkQ
-F8xdsfAIhAd4jxAAiO9+VRQQ3eBOsJRgANdgL/l51kq7qE3u8xnSqNkrmdYDdT2H
-TYH5W4n2AmGo50BDafdjd6tut0qtzA3/hGWCooydxKFOsnIYziUeoHvlICj3RkHO
-y7utcFhAgRWi+kzFwnnXGf13dMU9iG7yvKrCrCEw44gzoQ1KnY1Xsj18n5JkqxeT
-94bzcSbz20OpOSIMfSQPrpy18WrZYwHodcIZ3IUUACCpMZdfTa9c/qHRQ/rcwl+B
-0JlHx0V4AYiSAsiMVgflO1Eqi7apPuwxPPd5nnHkrdDM9CYC3LdBORBXwncG3oZ5
-eTSXmsvFxHXH41JHsm/1QFcVmFAYhu9qJFCGiD+8UeTFtT+nnHU69BszgtUskqX8
-k9PqLdK7Vxkp16wc6WOp1NeIQ6Fd4PxTGrPqs9bJk7TlYtTFWpA0X+EMj/San+Ku
-PxqLEa4Ab12R4vs1pCrn/g1z3C/6ujH4B70HOrRTIeTjULJ6xdwXGtwUA09hio0r
-pHhtyZhAh5irUJNto4ZOk/Qyd+dfMsNvRJfbVIK2mmeRaBnp902AsQNgYVdi2Aki
-0h4kz3bVLGw7iD/xV2hV69+JwLSijkkmOpz/EjMwj0hDDYrHH3Y3o0dV3dNdk/5i
-6lQgcxSVsl9kWlHcoEllKbf0Hb1muKVwoGGYxFYna2jsLFVjG29M7iPSgrHjmg/+
-I3fmsLZ0VI9kmxniUlZ6gz5NB5PJ3RXmwKO9LkBgE5C1wpuZbNEQ1NsR2bprlJPm
-++GNSo8HaheuTRJn42kkOgfIJwjuvXih3FE/NtRA/W8H2uF6YLDjBKGZJbxQcmsd
-CTEuCRCVP8X7C5n3rl1YqzfWfNr8QFxvH7ivG7KOlSxvyTKcYatWb9uDUPrnr74f
-ZaMljHGsNyKj70MzZcrrsmt61yWGR0h+02rmIKlskl4hkh+qF5ehI+Bkd7eblsBy
-rxEREHq/ij2Vd7l0Z606YCE8vj8WfcsJj8JjwR3A+nND/oNJTTbQ3b8OvasvqIey
-WqqmGg73nbHjd/VIAUsfvnsEYatDk4pAA/wQr9c4T4s5Q/QRwDrAsa4J89FrDjWC
-hQBPL7TaP8Af/3Y3/86jLCN4lnW1qjPXv5rhBFeI0EVi1k1qdV06qr5HOk7CwQTT
-uc4rCdFcEnw8kVKZa/yFnlJfRa0Z4IwSahdp5fdFEuad6LpOcFFnYxWtIWhcg4GT
-RcMha/OZnsfqOqiAt6In+1IwuJBz3uMM7xw2AMaxzAejGEL63F81C5iJ6Ld6kQK+
-XblDW0G643bVbzkBb46MAT+UnLuWQUs3NDtk1FEioJyWUgbO/srMH4MoWM7rG8ZT
-nQPohNmPBrqL2phmE27HQsQ0rTjH2Z2ol7iy9OFMtT0=
-=MkGo
------END PGP PUBLIC KEY BLOCK-----

codesign2021.txt

@@ -0,0 +1,534 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQINBFwq9BQBEADHjPDCwsHVtxnMNilgu187W8a9rYTMLgLfQwioSbjsF7dUJu8m
+r1w2stcsatRs7HBk/j26RNJagY2Jt0QufOQLlTePpTl6UPU8EeiJ8c15DNf45TMk
+pa/3MdIVpDnBioyD1JNqsI4z+yCYZ7p/TRVCyh5vCcwmt5pdKjKMTcu7aD2PtTtI
+yhTIetJavy1HQmgOl4/t/nKL7Lll2xtZ56JFUt7epo0h69fiUvPewkhykzoEf4UG
+ZFHSLZKqdMNPs/Jr9n7zS+iOgEXJnKDkp8SoXpAcgJ5fncROMXpxgY2U+G5rB9n0
+/hvV1zG+EP6OLIGqekiDUga84LdmR/8Cyc7DimUmaoIZXrAo0Alpt0aZ8GimdKmh
+qirIguJOSrrsZTeZLilCWu37fRIjCQ3dSMNyhHJaOhRJQpQOEDG7jHxFak7627aF
+UnVwBAOK3NlFfbomapXQm64lYNoONGrpV0ctueD3VoPipxIyzNHHgcsXDZ6C00sv
+SbuuS9jlFEDonA6S8tApKgkEJuToBuopM4xqqwHNJ4e6QoXYjERIgIBTco3r/76D
+o22ZxSK1m2m2i+p0gnWTlFn6RH+r6gfLwZRj8iR4fa0yMn3DztyTO6H8AiaslONt
+LV2kvkhBar1/6dzlBvMdiRBejrVnw+Jg2bOmYTncFN00szPOXbEalps8wwARAQAB
+tE1JbnRlcm5ldCBTeXN0ZW1zIENvbnNvcnRpdW0sIEluYy4gKFNpZ25pbmcga2V5
+LCAyMDE5LTIwMjApIDxjb2Rlc2lnbkBpc2Mub3JnPokCVAQTAQgAPhYhBK4/rHln
+EexZ/AB6pHS7a5pMuz04BQJcKvQUAhsDBQkD7JcABQsJCAcCBhUKCQgLAgQWAgMB
+Ah4BAheAAAoJEHS7a5pMuz0476oP/1+UaSHfe4WVHV43QaQ/z1rw7vg2aHEwyWJA
+1D1tBr9+LvfohswwWBLIjcKRaoXZ4pLBFjuiYHBTsdaAQFeQQvQTXMmBx21ZyUZj
+tjim8f9T1JhmIrMx6tF14NbqFpjw82Mv0rc8y74pdRvkdnFigqLKUoN2tFQlKeG+
+5T24zNwrGrlR3S7gnM47nD1JqKwt4GnczLnMBW/0gbLscMUpAeNo/gY4g0GV/zkn
+Rt91bLpcEyDAv+ZhQZbkJ49dnNzl5cTK5+uQWnlAZAdPecdLkvBNRNgj/FKL41RF
+JGN6eqq3+jlPbyj9okeJoGQ64Ibv1ZHVTQIx5vT1+PuVX/Nm0GqSUZdLqR33daKI
+hjpgUdUK/D0AnN5ulVuE1NnZWjVDTXVEeU8DFvi4lxZVHnZixejxFIZ7vRMvyaHa
+xLwbevwEUuPLzWn3XhC5yQeqCe6zmzzaPhPlg6NTnM5wgzcKORqCXgxzmtnX+Pbd
+gXTwNKAJId/141vj1OtZQKJexG9QLufMjBg5rg/qdKooozremeM+FovIocbdFnmX
+pzP8it8r8FKi7FpXRE3fwxwba4Y9AS2/owtuixlJ2+7M2OXwZEtxyXTXw2v5GFOP
+vN64G/b71l9c3yKVlQ3BXD0jErv9XcieeFDR9PK0XGlsxykPcIXZYVy2KSWptkSf
+6f2op3tMuQINBFwq9BQBEAC59lflbMmvSVkCHFoakdjokwGviNU4I/hOsNmHALYr
+gJc0z88ss2KxbOq6JZoW9QOEHz2QLGsSGKnBUViEGvXoINDGuvzKFqHdEjGsExiF
+FPGAgCQA2CSEZZ8MlITNdq4DuSti1LetjCF9d7hw2xOQs9ucxSXIslyqPbCdlxki
+33tov40VE/J8jDUp9Rv27e0H2x4Nhu9MRQt4vTtpOcelYzl/dtPAmsnY4U/Nex4I
+LM+JU2HcG/5i0nWkxOtz9Qc7kOgm4cuwXTCJw9KukPS3CykV1H/StPp43JyxoK1X
+gZDMFww+9jupqLletmYKqCW6jVbqXr4Xlisq9Ey3LIWRQ0Zw/LB2NKU/jgnJGtLa
+7O8VRWJKwkCtyYUbZMksKiGex7zCqPDR0hRVuYNsTjONobnrOS+7ST7ThbCndc+A
+5mtuXpxuFffIuG78a3R3N30RF6g18peTfaEHMpqz+914HkNl6Ns445Zh+2rJkLUu
+8O++tgWEUrpUajN9nosWaXWHOf7E9qGnm1G/3f9P3Nd5U+b3OKUYyqb+CNGCHyiN
+bE1Cg3MnKpM9Yi9aZu4Qg/dPdxMWrqUmkmyDf6x/Oh8ZZkIacFlAaqbysQ6hRaJo
+p7UG9AJfXHynj/Hz+1dNpUOlAIairFe3T2mWQO4Yy6IMgLEGVodZRHaMugdzZwus
+HwARAQABiQI8BBgBCAAmFiEErj+seWcR7Fn8AHqkdLtrmky7PTgFAlwq9BQCGwwF
+CQPslwAACgkQdLtrmky7PTikHw/8CZ+DnggV4AuI86spuMLdtUBDOux/T0gvyxSW
+f8sJkjH0eAYAmP9/flJDfmwra5yNaINfqoLFWtaYLpxpBcWBc4VIoiWqVp2aaCPi
+wh0sznCPiduiYcKGkHmupX8aCQXBYFDeQ8Jq1e9zwGD7Mon7BeBO48Vd5/IT1H5I
+u5qzaCtD2ECO9MYdhuqJjFKU0MVzVocsBDdtLvrfnUwe4wc6kvOgHQ6RkMJU1bgY
+0Sqstsg12vnREAr4uihnZQEihsRmNdiiv0DYVaRK92PLPpfVAox1Axq2HpH3WT87
+RpsFruXLj/zTl4AZczfDVd/Z4yWmJSzr0F5igkGSUrxo0ye2kNES6cmOGI9TgmgP
+NLGXlC/su5fKXKjRgkD1ibJ0qFNNxF3Cwpz/+cav9ySDgFGX5Vu0kFi93fEYHshD
+6lP9M5qS/2oKiykCGvcRCNU/9emdYlF37H52rxRerBaZN6dYMTjZw2vsEMUl06pL
+llbLiwjPix2OlLFcwH3yKJG0pKkpEImBdJwHtJh5uHzfkSAbZjJAZ2Ekw7sLqiT0
+85hAGovywGpHMiYkqhNUO84fjZYCsrAlZMdriY92IMcQhmWQ416t5zcle2Xgx+/x
+zBnktvx9KIH/HwBa+qym5z/uFC2S6zhNyC61LV/CEDCmcUi2lUXr7vcIxCsmxuUF
+1ONbRP65Ag0EXFtUfAEQAN5tk4luE92Ed4E92VlgTetGMHyxwOlZ2OsK6l+Z5ML0
+wzomAITgMQwG0FeT6HX7vB+luVhg0XAZUW/K0bme8ZEO0dbHB3Vn07wXHhmq7QXH
+/ACftkvevIT610dHskrtIvE5rZfj1P/wtjRTxDrkjhlGj9vhUxxcCkKadzDdBJGo
+dP+Zh02d/4cc++LePNqZ3eJWm0JLghqKxzTv0MV1r6G1ZeykFzXeWY+La8ZCRaON
+LcHjI7wlpyTJA9WGmyAphtEHM4fQqKLxtebIDo7m4glgR12nlV6B53gUT96PcKuA
+Y/UPRiTV6nHyUtuL1EGTAVLsMDmtDbdSdtLLVbJXVmA+tapABa4amMxNVNY3QSUj
+cAbECcTyVmVJfIT5fJW4eOMhWtrIGMspWoO5It0pl4K8jhCzIcfoXQ0olCSeC9fE
+tljE7qzRzYQUUvN1VZPVX0Yw/xSwOutv4mxmNRWY9HW1M/jGoRAboqN8WhCbldak
+a0XCH3U4rWXB/8HHb8KP4+q4ssVyPuEQ/v1UNNRk9AB25NPEh5PMdcf7HU8IcUHX
+THEfd7zZVJ0l4FSsnGeuJfMrnRIpNOYX65ikeoTwmDU3ZjWfmSy7F5hTLw8WOEB4
+EKpnplyV1QN/j3317/M9PxvB8IOvyNF2okeurtHFMmI/lGwy51akp6iHMkbBDm5n
+ABEBAAGJBHIEGAEIACYWIQSuP6x5ZxHsWfwAeqR0u2uaTLs9OAUCXFtUfAIbAgUJ
+A70hAAJACRB0u2uaTLs9OMF0IAQZAQgAHRYhBJXO2iVrHKChXzAvtZUhp+1drOkY
+BQJcW1R8AAoJEJUhp+1drOkY94wQAKb2fED9Up/xHEOjZm5ODK5LCVHy0KMATiTf
+5SiJhRtqaRbimPH1WB3XMLls3FJZnm+UngIfwCsoWo0rksFUNmqFi6t4Cj/UB/Zv
+29EnDT9BAeG5fP+Op5PDCsu4qnLv3oam35oV9yZLRkLhBd/EkRGEA/q27WnpiYCx
+Jv5uPOJBWQqu32aE6st23PpY/QWDWOhGPfcWCecu1rIe+2BCs0UjfO0KOT8HYWNh
+nGpsEZ+TmDKjRxMTYWKguEb9evEihl6kUwmQZgROdhBes63Yq4ku9rBXvRhCYbwS
+odhjx2soDRcNmzxNV1Ply8a+2bwRHPnOeyyxEHFAwjkyXo7ZqGtenwSriG0LOW87
+y3Yw63O+oAlGLIB3psBSj4wZVGme9485HVICAFcJ3jXqsXSIJdzW61nGerB2r2Qk
+Bn7yYIvHg3iOToB0alfNw2QuDtCZTNefvlHFnoashRhkk0yWzBerleFJbijx4+Vr
+FaOH35BO1T3rgBmGkDW6gewoZMHEcmzTDoxxmbXiRvY+5o7b+ul/yzwhnJz3f5jk
+7+Adnr9qAGMD2o3rCRBHV3lSEkLhBL+bfmsEYEor1fd+pDFoEKKjpDP6bgDcZyGv
+O0mmr7Y/6ZrnKWxOrmNXieOTLbpY22tXv43QLgyiPcjhCfphT95IxqdNfMfOiI9k
+IQf8g7GBciIP/1mbdnMj6Hg0J9IbI/XX/DWATOVMdDhq38VcggOHRjZk2lY99+4V
+Au1wRHa/Io/CENikYzI00deSzhrN+tdUK/TCZI0Ft5Lykmti2ilmkIQGsBuD9gu/
+2bmWkNJEdpHeC/+oxntDFj43CpyKpPAarrw+4XiYNK+1+4WZsQRL0jJuKJ754v/o
+NTaSd8GOCyFR7q8SVH4tig9DjkZjYjFFMnWkxdpnDX56/AfdS+x5EaRHKCJoGChT
++pHimvKe+MxBxpwJr4JpGddklin+6xUF5jTG6322hz385wsagGvmH2XliOu47a+7
+xUei7w3S1qtVCfdhtBEWL5i021yVYlrw+rUCwpFMIXAPA/p44O/qY06sQXJ01Fym
+JCbOnjtVYX9gdF8fMKoDXAcvEtSulBNpXDongWp50BDfVoA7h9oDsxL5kw0GpkJn
+uVMYLpO+iOqoEA3bJfsCedilkcz6UamLb+6RXMupKQaZ006Bu75Rm+h6PdicdiKD
+jJY/7PbGuUmXxuSFT92v0hATlpEIQ8H8laEcnb8apiX2qOyGUHnb7pfYoNqvCm06
+3NP2igCtiGkzAohiHfhztfy2UApiTtXmPu3EhEUMooB+0Lt0zzY+e1cnFKRbJHvQ
+ZidiOJfKuqp6upPvEgKYMRCAU4+nLT3MVbralo726JnDqrDJvCqAamhfuQINBFxb
+VNsBEADcRGjaY+/ZVWBlQWvgy08ObhQbTRglb8thrcPeTR7211JJwAJemuTWwCjF
+SVDH8JJ0Ss8rBcbitrGI3i3mcgJRQ1hILR2HT0bbmMLufCxZzQBjJm76H8XN++k6
+bd8HCYGXMguUaHRRHAcV+P18e3qGizgL7c8Vln9fbhowkX9yi/WhiL2uoXC3+XSa
+C08TzwjKPb9Wnct6uCBAzMp8S7KW6P18vZyBTRBrugA9eZrGEe25rhy9szlJcajc
+VeMiDMf058z7ait5t43AfUzd5zrD6c+ZGYIku88oY55LsZVcvn9o7I+UNbNJdiek
+IpLae3Dgrie3QgDyfzPV1vXT2X8LaegOsNIkSo6jzjdKE0ZNg4xVSuPdr5jujYBN
+z2k1lqV/Q/Ccpqzs0NsgnXnY8RDDrrmJhdy/ZrCMsXpbTK5KryR+JoDEiuyJ7YO2
+jTOCo6zQ631jvi7XUeHAFIdQ7eYRklJwABwj/IMXY++O8JBLO7iZ1dvvu3pfY7pg
+dQvPgDttVAIxrNxMMj39LRbb6LE+eclWcTfGCMr3O6LOOLwkMnDWEkJAz7JMtWqr
+2l+9xF9Dq7CkxHPP87dLTMNGIDr38bJ83CSmDPlBoaljTYgrlatBTV2hGMjPgEcB
+jOgg6QyRGpO2N0SVBnD8PfBI7a7CwQw3BHOJtH8vPUkXZoafoQARAQABiQRyBBgB
+CAAmFiEErj+seWcR7Fn8AHqkdLtrmky7PTgFAlxbVNsCGwIFCQO9IQACQAkQdLtr
+mky7PTjBdCAEGQEIAB0WIQTXDITmS1WOW8zsByEy4hdfHXV6KgUCXFtU2wAKCRAy
+4hdfHXV6KoJ9D/9IUN+s4gSiyWnqfq+UK5q86DTbC+OyQpAY/U/VDi/jQXDUaXzu
+f25cCgyl4Xgf6nNTE6IEdgJCL4R6bChxJOHNpZ8/N3ckb/Q5xHKZ/5k5wFv7nxUk
+vunzxB0wUgCLkn4oy4B8QbTMuRz1qcSdehUyZAlfkr7o/J5UO8FtgaMuNACxZNlO
+JW5AjTDdbEW0MZapAgjx7+oTQMDtz9q4afuPaGJ3fTz4Vx1+mYt59b1h6xaMTXJi
+8egJF0U4n/tJ+3gxAIhF7tQRPdNEwG+2Kw/YNyrLMY+nbazhlgUIIkk2IH3Ztd0S
+XnNd7gV/slN80T9CtHtaDlH2FkeAd1unynxsDd/TLb1gLHem5iDsFuZBaIyHetdY
+TlvT3SlKnDQr0FBTe86Kuv7n/ZNoU4lceXhUXTcataxKdxKEJt2x1Ei/hMHSVjaY
+3ir57tuOUDMkl6hpL3sYiq7cMGUAnLH9nBZbbcNdfChDiM24mGmXaNoITutVAHS4
+uNunSL1l13hJ1hnGY79j4l+CgnPx7LHzBmLh4PPWKM3RYqwgaPEkflVQr1JOOKMM
+x4bpllEtzpvVAIaF73tlsOQRRN1Aah67gvkWKqiZrXc0Sx/yh8EO/6bImb87rtVr
+0kjeDGEiuGYXsszNBCmVjHal5kLUKaESefzd223zeaFe9foO2HrnsFb9B34ZD/9J
+W5M+42QFd+tOLh1ue/5xToiyggGh1MX9axDqHiRu2w+E7kNuuws2426aupUQ3yPD
+4dSwR428U14ytM90bZXztKFDgFAaQJ/4YVEGPSbLHFc4VlhDHpGljl8J7vI5xPOm
+Ruc9aabtXwd065nQ2csk1DliiA4jpS9dUq/flH2oGj4b2OSGFvR5oC7oERHMpUA0
+p+wY3vnjkSVnWqV98yEBCFcZvpOy8J5KDZxYZvZydUvZ3ny5W6QPg8OKriqrCAKW
+QXds47vRIiAasK14duLgex6il7HmboaqqOhRhevtBAHBJpB1z6Aq0SMwcKwdtTId
+GTSoQd0R77ZGYvR3StpAwl8rJhCNwJHu2euA3hYPWHg0pF0L8pFbfUwOYf1dU+uQ
+4xAJQKcCteQ7B0pawp+Hxp/0erB5c5PUUck38ze1ZoGm/oqh24XZ/amPVWE9nYSo
+VTJwnbqWsfI6mzKdBHr5MP5zW5ei0PAo3lFb5gvVzJ2TqaGJvrh907I9R5Nwd6GM
+wAWAzZ/nCLflSNyPyJ3ftxY6pGyCBJsycY7gBQD9i1xU0bxONltqSyifwQ0rt7yr
+iwSI0VRnv8K3M2iTAdDm44bX6oHzljgiYachlV6IGmO3vdVVrCDhm+b+ia1bnQ/1
+H7itWEwllkUCCtaDwEcf8o3OdbS9S5KEbwH7YUD967kCDQRcW1UMARAAvl+0jUaB
+UkQWBflWy4Wd8Gcf3lzOqbARdpM/iztebc7RbLnv0TNFQPV4TD9RoP+rY4dJzC8w
+/rlxlhD3DiGcI3of3o/3pN6jss4wKyy9Jcg7uCo/fcspOoPOwigAUfBYTd2rWNvI
+/pPUl7zmavQR2+TyQ4IHWG52zAABGej/tf3Ma6WGHC4QeTkh7LtHn3JFRCoFy101
+x60bJqIWONfR6+5UAOL/P+zTteEMsO3v7dWCWHX/tcYLrhCEH1CNnyPS7v7TF+Ys
+uOGL7sSmQOUAcgldfUfTACw84YqViu5BSYiww18Eg1l66UcQFnhwB3fTGwzb3oPM
+npAv2wAZ9gyFGzRgcH8QnXRm/SLDWlTaMIJS//0p/gXifCAdBZA/skBt+E4hQ5Sr
+9iXGNMueR3bn7u8Pcoc1DpSJENE5H0nB62l3/OiSl/k7mJMGlUv6wKr42xNnIM6M
+hO97axjRXy/XQz5n6ktyn9xRngkQNL9Ynj+i8E0k/xv5jA39EGAKOXxQFf8357sA
+DnZ5g/Yf0Yr1c+TNIIRXER/k/KMavB52mguTNqCsewO5aje4Gq4vKd5P+jOKGopA
+C4idTLkHutZTiakod7lW2jmjpm6P7oyAeAhDNEroNrbOIw0SaujHBmJtxgK1Q929
+y/EaH5vJyWfMFyUqM7CQBqUU/HRLERsebM8AEQEAAYkEcgQYAQgAJhYhBK4/rHln
+EexZ/AB6pHS7a5pMuz04BQJcW1UMAhsCBQkDvSEAAkAJEHS7a5pMuz04wXQgBBkB
+CAAdFiEErtYi/gIHfrS1wUbBQqJ50kjNwxAFAlxbVQwACgkQQqJ50kjNwxAf5xAA
+hBhcOeqLgeXbUu0CCTKlnG6D7H8sQJWXCSsh9pAXffv58b4f0ntJ1TztKfVd79hS
+BCcXRc/9+MhUUzR79NvFWWZMWqJ6MucjAkkOBRoc7c85PawYTI7e1zSapLPJEHG0
+xDzK8ClxwGEvlA4O/eGGVFaCTkxdTQg95fDXfghab6j89GI8Ghc9rC9V8RUgGVQV
+qJJkBJ/gECJJp3holB4/w/I/sU+9AHXGKJvSJJ62fpmY143Y5JQk+I8DxoT0kIq4
+W2iZVAQMzQGpAOXkDuHk7a7J/QuL78CuoG98GOsfTd7nNsgPTZ07cPYGOxXeNR5U
+9DlYOBWDwsf6d+D+tHLB8KzH3MWnWa3crjE3a/sgrDEad0CmAJzHXuCyPMy8vPQn
+uxIai/gw2POq8YQMoKW5S80perLuN73FxAumjK9a2hYVdZNtABwrlW/6ELruv1se
+mMjUq6oDyFio0rGy/uzCItl13hIr1Ii7B/SPz9dNnCagV8aiUmKXRk3HKoEXf34I
+xWlod0szWopnP31NXNKHihs46ORSMrjnzFKjRcJsnipdins+DHJYroYhtOjNtsb/
+WV3D4tSerG3xKF/v3ssn2VsjcgK5HY/k9iUol/dvoP0bJ+rKs/fzt8oAqEexiRnV
+cPnj/zAiBOt1940+0vTWaNYOPDkq872S48GNybOC342u2xAAnAp5myKostxjyQn3
+E/7/G1OWHaJW5kx/HCqHCWjgwwLOmhssNn8kpTf3ybvt5uhMolIF95RjFB3gBOfU
+vw0sqMvEoBoGSMSTSc3zD05RBsWWFD9qwvPMXtn0gYaH39ISAFnxXrtrQ7dDD1d2
+LcBErdttnxEhUnT4/0YIat+r2PhmYYDYviKsuOy8MC/sJIxvhYEpbyPQnPksUzA4
+wmAbVNPlzqU2oWPrLT2tlxUue3z6VS/YHDcsLSgjVOMWSusLMh1+D76Y+Lcr9kVz
+nRu+dYXh4I6OBnlT1VuzEVmrf69NFwh8j3PaVn0I0NEDU7mMa+5W0QYuJIsXZonq
+SI2uIu64ZOVd+D8WmCEZO/Kmk5PMXs+0fMcFD9mOeFaiOdz+PIlHAsrxwKXr4Q5z
+zzu/wEOaqAVa2bJywTbl8MntQUY/XeD94MvdlSAwO3Ll1BpQ5NfXjm3YpP6Uyqlj
+pkrYQL56iqucgYn61jLSXhFHGLXSZs2G48ggN2mHtf6ZQeAJ4D2DIXRj4uqIHoJf
+7MWDui8u+cJsw/F0ZerPsCN/CpkEoj4FW4F4O3JbiieYSUK7lxc0qyDdbQiVCVl/
+08wNToe3RctSzsQ99tCwfVWqLVcTVb+0aeSaNykb+qW30bHW7AUYs/qKiapQFzZz
+QZnpHXGmVe93fDfILx3yUCA8Yia5Ag0EXFtVOgEQAOS7GFDH2DGXPMJzSdS7a/zZ
+ewP4bM42n2Ku3XiCyXG173p4ppNdOLS3l7JrRflMhjfBtETCOV8B4z0B9wCZZywz
+iLOt8+0A0zpY7EHZNvMRjZyq/s0FCKLtnlqo/KNwiJPRvQazZ6+UOSffEQEGpNKs
+1ycZIDb1tk8iRpRvtCin8CeLRLf+2BxHbWBewnCSCl80rC89PTcvPf+jmtcDJqDQ
+z/blp2CT1JUo1xdzyHYdIa/kQ2PBQo02ejBVs0vDjbzuYVQzZV3q6cYnYwGPtpTB
+Ot8GXuA1X3qYx0MlZwGEYpiTFS+Ju4cJrYofuBOudXpfux2uAPkJskw+ro5k1I/q
+fptRWDbZ4fGgROmUXBPg29XdyVExYgAbVeBdHWX30sCHs8+c8wzWkdAY/BgdCySg
+EVLiDmSfMekH2H1N9ncwzhwNlHk2BaYTR9hWdZ7lrH7BbT8g6SVSge/eqgvjKI33
+AUmragvNQ1B3362yqLK/FJOHyJiYd6DKfkq4E+ysw+C+qIo51qVNkqRqT0M7HhwZ
+AvaoeykrGIE5vq6jHa9+MxDlsN5Sf7gNgx2dk0d7LAJR6AmYNqRS2V+837XfogMc
+bB90ZyK2rOzDN3f48jaqXA8TX2CSun01RoPdCPZm0M/uxTZxOFzoatrkpEVbx/3x
+sjvuPVa7qkKdgUuo/PhBABEBAAGJBHIEGAEIACYWIQSuP6x5ZxHsWfwAeqR0u2ua
+TLs9OAUCXFtVOgIbAgUJA70hAAJACRB0u2uaTLs9OMF0IAQZAQgAHRYhBHkdfriO
+vI0BOENKrDPfNZrnpgp5BQJcW1U6AAoJEDPfNZrnpgp5JY4QAMry7TcsRIZJCVlC
+qecIAjyJizWz5dEwScba0BDU4rv/h42CvXJlySZpbgUEyB4SBggEnu/dKVbsd/t0
+TXRNg80Zs/pTFVbwcg+sDgIg1wZldZbClLfvgk0xLoDl5vq+K4SAQwSLTSPHQyYu
+8IxkrKmbBdBSXlgnmcHK2lDXrzWYJDEYEyFPV4pC3cHicCygSc/4eepUz+crEF6Z
+IE1df4LRv9h5CgsLewMv5nQ1EjxTo9mX1GiSh3e7KcfS98FgIQl3oy+yO2cmVVVq
+x5ggDcRI2sUbXa3D3kjAo2tUIA1nUMFLIrii+aZawOsf64VMdIs2OXEi5XFR+Zdw
+t+Bx6lUKZ3/tntStZitJdK8/RUbhmYQ8Tu01vxt/IAN+07VxWyZwcFB5KuC+lKtO
+/0vwyhyiOlHm8lzV/5qwFPusB4bNk/2uLPUaavJdrBpmB0t9pol/NFCRzW5MKFvu
+Qw35QyFVR0IBeaGjRc5J9yxbzi78umN1iHZbDjXFA7oRa9tkM2AP8V2anxSHUyon
+UN6OuLqSM2frA8iZcl0S7qcepYNF1ix9PhdQHXy0H7hoikXMLIiCl/unW5pVTs6q
+KnmxmRz9ZcqvvuVXbeY9C+kZE0LOBTZMljuS1Hcs69RU3rA18swfN5CTXw12ZwQZ
+SsnRhi2X28Tn8SD0vrEsEf08q3XshDwP/0MvBBfymXd+5MzxlvMg8vGJeFuDMEFN
+cpETa7Xzzz5Eir3ETtxpUWPCriqmCpnlIWidNwbg+LlyTeYUDPIDnMtEX5ySmYGn
+BI8ykvAKm/XTfr0PWOEAXcmxTC3oMhvYEhIyGHZOFJQxIo7vmrwZKi2wqMnKMPq+
+XXHgvtZe5tNbESI27APeQCMVZLVnVVa0D1JRFYBuwNoJXhWbAIKlIjBGv05NvK71
+e4x0zEY2mXxLBbsxVBvHhpg29HseX/AhHvUAcBehJ+sqnenXZqdeNhgBIeZubXq6
+A/gfscswF/Ocp63Z/vqAjEmvUKwAxNKrKlwLVShVvobPx2N4hH4ZT7p58cjhMhQz
+Lm4whTHy1hvBIR6j/Lo2eOkkVhiMlrrvWJIAEic3Gzj5f7XOsVr7CXjkSdoXHOIR
+63ZDO/9Wy6ygu8vCdiIFlyRyUBLnGhUYVbRYnTU58tQMfEYy30ZKF4vxz4Ysxoy1
+oJa6emaa33Nn1Z2kE64AaW4wbUJ57nROuFdoYTwJ02vyc51J4s0C94EA+a5VrQkN
+J7bT8P9G5gksp4b1WyoFm+O4aU5Sx+XpSO2IZFuBL05anF57Pm6Bz3LJX6sEYima
+chv72q7PYeYbETrl4DZxE2xlEiMUvN4DH/RExpPWeUsVMFtS5n60n5+AW1EYyGJ9
+mfWlvZ0xCjQ3uQINBFxbVW4BEAC/gtho2rZl6/+/szkOfEumAdFwyQbtM5CnJyuU
+rnrneWWlnNPLeaHml5a9yrcgOZ15QgnFD5YOHZ/S9L40goML8cB118etk9uE7vMv
+EtwxbkqZXTlqdxpFI/SzT4jJCa9XFQ2uA+KdmKmGW9EagtdLql2B9ziMhH0Ha6Y9
+5x+9+7/oRYU+ddmAbwrJjdn6bCuYQ7QVpccFC67qdpy2I97v03hst7yGT1FbrIjE
+sF4nMig6Uhwma5Edqm2dLaVXeZ+Fl0WeQCnWjprZMvkHCAxjTBlQpmvvwcQwqHot
+s832s96l/Sd5R6r+TWU0lTtXpcxL6t7MXfW+BInkqg0ZiHG1Znni6SwfatzDv6W2
+lJW2pj3Ub++JulEIkbct1f+TEeeLU0RbJmWlL/qe24fodKg1ixH0gyxsRKzdBUIf
+vgCkrzwLFgJEHRISjQzIASVtDdt8QoIqX8XALgjMBgAnZqtYrAEdFImWys0K1zOu
+MbuPcTImufz5ObnKM7rRMdCO9z+cHGs0TT2vUvPPuOsNYL1GX4EfrCp2eLKahjJQ
+BCxfatn4mFqHVmR/4a7vqq1j4Qfj3h08z7QVrNwGWAF3r8nmaHdaT0m55xctMRQa
+3N3UaYj0IQ08CSUJq5e005Z5Oinbt2O4paxnG4/UbJXpRiLEVU5Ja17IBsDfZydx
+W//ZlQARAQABiQRyBBgBCAAmFiEErj+seWcR7Fn8AHqkdLtrmky7PTgFAlxbVW4C
+GwIFCQO9IQACQAkQdLtrmky7PTjBdCAEGQEIAB0WIQQVaJBoXqDfahNx7yAXzF2x
+8AiEBwUCXFtVbgAKCRAXzF2x8AiEB3iPEACI735VFBDd4E6wlGAA12Av+XnWSruo
+Te7zGdKo2SuZ1gN1PYdNgflbifYCYajnQENp92N3q263Sq3MDf+EZYKijJ3EoU6y
+chjOJR6ge+UgKPdGQc7Lu61wWECBFaL6TMXCedcZ/Xd0xT2IbvK8qsKsITDjiDOh
+DUqdjVeyPXyfkmSrF5P3hvNxJvPbQ6k5Igx9JA+unLXxatljAeh1whnchRQAIKkx
+l19Nr1z+odFD+tzCX4HQmUfHRXgBiJICyIxWB+U7USqLtqk+7DE893meceSt0Mz0
+JgLct0E5EFfCdwbehnl5NJeay8XEdcfjUkeyb/VAVxWYUBiG72okUIaIP7xR5MW1
+P6ecdTr0GzOC1SySpfyT0+ot0rtXGSnXrBzpY6nU14hDoV3g/FMas+qz1smTtOVi
+1MVakDRf4QyP9Jqf4q4/GosRrgBvXZHi+zWkKuf+DXPcL/q6MfgHvQc6tFMh5ONQ
+snrF3Bca3BQDT2GKjSukeG3JmECHmKtQk22jhk6T9DJ3518yw29El9tUgraaZ5Fo
+Gen3TYCxA2BhV2LYCSLSHiTPdtUsbDuIP/FXaFXr34nAtKKOSSY6nP8SMzCPSEMN
+iscfdjejR1Xd012T/mLqVCBzFJWyX2RaUdygSWUpt/QdvWa4pXCgYZjEVidraOws
+VWMbb0zuI9KCseOaD/4jd+awtnRUj2SbGeJSVnqDPk0Hk8ndFebAo70uQGATkLXC
+m5ls0RDU2xHZumuUk+b74Y1KjwdqF65NEmfjaSQ6B8gnCO69eKHcUT821ED9bwfa
+4XpgsOMEoZklvFByax0JMS4JEJU/xfsLmfeuXVirN9Z82vxAXG8fuK8bso6VLG/J
+Mpxhq1Zv24NQ+uevvh9loyWMcaw3IqPvQzNlyuuya3rXJYZHSH7TauYgqWySXiGS
+H6oXl6Ej4GR3t5uWwHKvEREQer+KPZV3uXRnrTpgITy+PxZ9ywmPwmPBHcD6c0P+
+g0lNNtDdvw69qy+oh7JaqqYaDvedseN39UgBSx++ewRhq0OTikAD/BCv1zhPizlD
+9BHAOsCxrgnz0WsONYKFAE8vtNo/wB//djf/zqMsI3iWdbWqM9e/muEEV4jQRWLW
+TWp1XTqqvkc6TsLBBNO5zisJ0VwSfDyRUplr/IWeUl9FrRngjBJqF2nl90US5p3o
+uk5wUWdjFa0haFyDgZNFwyFr85mex+o6qIC3oif7UjC4kHPe4wzvHDYAxrHMB6MY
+QvrcXzULmInot3qRAr5duUNbQbrjdtVvOQFvjowBP5Scu5ZBSzc0O2TUUSKgnJZS
+Bs7+yswfgyhYzusbxlOdA+iE2Y8GuovamGYTbsdCxDStOMfZnaiXuLL04Uy1PQ==
+=fX+D
+-----END PGP PUBLIC KEY BLOCK-----
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQINBF/u5KMBEAC0hPiTonjYEe5FqNzFn73KmcN8KGD2wzujmWWLnFXGEVDEpFcS
+ULQDshhCclwNeXUArUey4nficwpqUe+Xl2h4dP4z7yh3WiL5nA5JRjJjw8KJQGVW
+AkgiZTnJHH8DrzNt9LnDL516qMDJarTHemDUUUZLNxnuv0RDEhDxsXWiVCQZZcw/
+41yIY97uCf30dsDwnckVl3iEmYaGTYavWbKP60S8WaxO0YG57RI1etmlIQ0nMmka
+4bvFnwwb9Jdnwle4LIiRMCGymsheaKCKrEZgIJY+idyBuExLLykiL8iNBj2Pzi7z
+XSCniH9qcEwfqgZlP/KZwujLhGOc4c4peNwpuDGcmYZoAsUD8CZ8H/LU1FIR2A1u
+/UrRREtC8nNTDGxCckSMEquHNURfMk1QmDbJ9gaa9aOk0AArxuTxyj6Cn+KQd5l5
+0mN0R1sDVQq9xWdvnB7N0d3MDhnV7f19iUhi3KYvjVTkCMXjhNXjDH/KXFKoFhKa
+9SkxYGfW25inwSQoqbP1TE5+rESf57bo+XFxfVQuYfVJ5BlZobz+sRl2iDQyBJDM
+uDFyXE/t+E76BmwyHeOI1weqUMYebqHgu0x76dTYj9yWgWdQAC1pXi15/MTIaOtQ
+hWezb5rkI2yZqaZLaRBOIRBIPM5C5AOjL2XbfwUuSr2W4+TvxLocxi48DwARAQAB
+tE1JbnRlcm5ldCBTeXN0ZW1zIENvbnNvcnRpdW0sIEluYy4gKFNpZ25pbmcga2V5
+LCAyMDIxLTIwMjIpIDxjb2Rlc2lnbkBpc2Mub3JnPokCVAQTAQgAPhYhBH4ckayA
+MKWlnR76uXUPPIdyPkASBQJf7uSjAhsPBQkD60WABQsJCAcCBhUKCQgLAgQWAgMB
+Ah4BAheAAAoJEHUPPIdyPkAS0lMP/2IgMErScBUaXrZXqYXoluR8xU0p9DyZEBx+
+ZGNAcJ2CTPAbn3FrkNGNpK4SOCLXEZPKOQ09umaIxl8H6uEGaTut1JLj1qGaZ8ID
+4gAeQcTIN9OQA5ElQo+ci20XE9JSvzqY1zb04EkMuVL678xPCYJhUSLS0MAQkcDJ
+JQLN17SwNi4vGqzVhnwKUviQU9/s+LRUkThsTg4qT0fNnmGoVJXqrshxJa2ZWM6J
+QtOWBgJiC6xZ+zRiZS898L0tekU4o9yxtnnDWry2bI+mJbxAp94ZAXgKahOU7LKV
+3SPxkx7TAng24nOWi1EaP51pe7usTFH1BR3CUHZdoIQ4xruZGkt/qPumskofzl+1
+8bw1bEFbq8S6jC+twT3JUcE02HbEIbrd6l2T8pYBXaojFggGjUTSv9d5YUN5N9U/
+/Qy0o3xZwHNdXLx6xSrUO+NT5JU1Nh/0sutEH7ru/YqFZof9vfCbV86y8fIOPgk8
+LkJNUSu4QCJ1PHKB+fJp7yAhlPkOXNG1b9+W/hVp96rdkovpCUkLD83s+suQyJGk
+QB7Qpem7nS4zp7/Naui+g3M3p/uRSzZgELTnXNyY//bw9fOqx5SDLjSUslUMz+TH
+sFTwfo/Mot70MPHMe6aE6tdTDoJTcv4Iim/8MDhJ6yqKt8sxprataZoWwFi6zAF9
+BzWkJcrbuQINBF/u5P4BEACso8iLzFJ+M1wqcsCDup+GtRMzte04CAlLmaLgyzfL
+3xxBo4AUgX6UbUCGycG878JVn52S6Nsl6FlasmyH00MGjZt1CuNz4htfSmLGcBMj
+IwQv1CYR8bm9EPwR15NaWdgzJHShCduMHv4HdfqSa6UQfzO/P8mwioER19fkDQSE
+U1KsY0yl//ipWiW3ZJGShGHLnn4YbxogQtsRPESKUsQ9MtzuMt3ehGtkN4RguOXC
+6pCWP8J4F9lgjSZ+uLOQKV4rmpbSMXntOJi2nu+14Zj36enW8xyAXO/w5z/wci2G
+LN/aa/v2a3GM3WJQsPNzpDwB+pr1n0Kp+wK6K7siVmDoV+WecD2KNNgOuSyUve7h
+BjWRM9W13LsgLGhKJA8yUpPvhXk91vLRUhwFJ2GUirxLPLs2TSTjHlHvhcPy6aX2
+HxbHkcOt53n2h0zx7ntl1N7XHozMWmHphPsSvOZ5StuQRAFvfE63EyfR84KUPIbZ
+kvftbAJPKCJC8W6GqhfORzYZqldDNNva5iYHF1OItF79ZLGI56diNsBV9SOVKk4d
+f9Qp6urYOd+9RGQGmCQte/WSFaU9z9QYPEGl1NlmGAWt7KKyB6QXZH1oEMwXtPd8
+4GQX3XGtyggEp6BGwkFFWRQzF1EZ0maRPrpN4bpQqLXSJiqQxsX+FAcOkhpo6X7b
+8QARAQABiQRyBBgBCAAmFiEEfhyRrIAwpaWdHvq5dQ88h3I+QBIFAl/u5P4CGwIF
+CQPrRYACQAkQdQ88h3I+QBLBdCAEGQEIAB0WIQTpq255IzwEFuiZP0UMA6+pClln
+xAUCX+7k/gAKCRAMA6+pCllnxDtmD/0YCUccmKudW9PiQw7mI1HSuwL6aS+MlG6/
+LJ79nmi6TTpe87NDcEv2bBpVWYcQK87smCxIYyuj4SCZuBQivjyuecipRoG14PUh
+KU8UiqdF+vKDvUAA7huOBlR4dgr7/KvjirnbwO3mGouwZszDOLvaHuO403+TPm1b
+mJtEA9y6Wbk/+PTtfPymQwnaiJkPhQ6Q7ZbyasRIisO3MRPacUjt2DXFi5VV/Mya
+8o5Pae3zY+5SjMyE2siPnVE4/nzp424jDzSq4DGEUip/x+QYHFwxhCJmdZlRIFmn
+vSCAGXBpyPVbckC0Gw8kZ8HsGzNbMbx/VjDG3LFT8TR2Djsh99/6icO1J+jDkPNn
+IFEsYjAw7Tos5IPhIT1XkSCW84KqBG5pGI5h7fJzf19sR7Ki6XyFe6VYvggeQIS7
+VN1ISl3tRN/dk0GbrKkUKr0OVfaRD0wXQHTzbec8Fs43G0z/DKoFutGB/J3yjAmw
+IOcP5R6rqjhVp4APQpsB51XCaaqEXaXZyMWrKILbPIjlE6FHeh1qd+zdIjullnF2
+YZv89HU9dIXxKr35CM8f3BWm4D4cRjsUOWoGhMNwdHzHYOdys6T72KBK9D2irz8C
+L0bycjN+SIpde/auo+dQKqKD3/ipr4dyKJyOUsls9cyhxkFp031cZ5rWbXcLJ8/s
+1BeVPjFCngqPD/9rMKA6kCSnTo+rSqZRxo9RlQwy4K6xfPPdHZvBi3A4UYCsurgl
+qLtFtGG8SMWigmUZWLT6uhsi0orR5wfG7vzajF0Hcd8yuWa4zGeu0rFJXgG64Pyj
+nJHtv2Tzi8DNY5Y+8mfXqUewyEUXQLxnLqpGlPjNUAJKvjm4SstNadewgWeb6F8x
+UQJc8owGmK5+yZQ5LZj6bjt9Dr3SCM3Og/iS5XK5POGUJgtgXLXp3uy7p9SzsJ73
+qhrDII/YqSwToMu8tUv4xEGxyceVPDm+ywde5SXYmtvMYrq5DBdlalZ9kBlC5fyc
+IIzKoIOOkKKpa/YAyKdLTk8ZByjDk1RrdcOyP4VNpCvyisf6JPwWfKdM5mxf47hb
+s7zioUH7miUGA6i5TNi1e+DU2mL92sJwQ0WkHw6KaUez2Y9CaD8hZnQw/h/JcNq6
+nb8y0GR8h7qWms3K0rtSs8SuDXUsdZrFAeURivccmohXddtt0FDzkheKGXs27SSl
+8oOCh+jl/hEUzz2mJGFwRBo0FI5ipN51IfjhMJ8zzSmvfrtdwT2Tu6wSY9DLsYR7
+0tWGOc2HA6o7kdcC1V0p2jvQct281FrC9dTXFgcDuGUBYhzEZeWwjuYQXBzMquF6
+ersVnPo/Z5l1SnkK+wVBQbf4igHOaobl0AQxnb86W4CXBTZ3CvRq6o8vWbkCDQRf
+7uUlARAA7oTlVZXhdVlPnSQlnI5JwovG2jEIrRifpbyavlhlosX+rgtQ5EILn0DS
+PJ35CNfOAeOcLQeRrJAZj6w/x9FHWfKRAHUeiTTsVDzTrDyJBCVuC40ck587KVUc
+GuB3vee03/y8qAczj5TZNaDdl+4qAzOFQuV4MjwJOx5fsXZw3dUAS7pw1mTkAYTh
+nz557buc8JJCxrebT6FvN8bugk7LJ8SYmI154Q5wCdXB6Q42sdSMFlKKPYRRmIvX
+vI4Ytl/J35v43gCLbXccTWQpBX+ra75sndS2hYGQhcC+WdNtt4THgU6Sb7ErpJK7
+7A1r1Wf0WSioQ2VWjT0QbUE+6IXD1J8duh6ZgzuqppMm13aDdMDZGwdcxlFw+vlo
+bM+IAX+QgzPjslM3FHVvvfCLka+ctMO+lL0bz1G4njNEXcIAILhmoqRI4ItVH7Nl
+ZI3pAfLLB4qbhTKTIiS+uIoA82RU86ozr5oJZCsJa5N5EpJnYxnjv2tYhU42eh+j
+hyM+5ra1dXtveKvL5SkVuRUlPZvgOuwQ14Qnj6sv8CmtBpyVpupHmY2RbNtLVLdH
+Ix3lyQbgVo9iMJIoXiPXmcRWCgLgOeuETjFXsEcFLxuN+D0My0dtwWcg+271vtPn
+0orTObxkctFK+V32ByJYxVvytNCW245bICpxCicxmh5kYEmQCnMAEQEAAYkEcgQY
+AQgAJhYhBH4ckayAMKWlnR76uXUPPIdyPkASBQJf7uUlAhsCBQkD60WAAkAJEHUP
+PIdyPkASwXQgBBkBCAAdFiEEqtu6UHTxQC97adVrxbTukxqfnf0FAl/u5SUACgkQ
+xbTukxqfnf2aeg//ZspIr4ETVf3ai0dXCm2Pf6gpM7QUfI9fPUHymvBhNrNhfZqN
+ADpzbJefzLif8as7kUr904zTc5Jse5a0MzCrMyEwTDIoCKDv2ktLq1L20bwflZs+
+oP27CYC5FkJYgLYPrQZ/7hRC8EWjgn6v3seJtEo8G73kiVEBOnxVEfGZ8zxmX1Cp
+aOWfhiFYCmkEe6Ck9hG+OaWt7+WW0wWT1UFiluzRRAEMROcCUtyB5IPCqCH/Rz/m
+/bE6G+lHZo6OY/wY2q/oW2f9JB/4QyJeSI+fkjY/wDjfNQjiPMLfZctv25IeZYVY
+ZvIKrdnjbzRe+GwYLg5G/SbpSOEb5O55Ps8mNUpYFaMCfefW+DG48a4WyUGzFr52
+BMKvHKtc6c7P3+muBAqcNZYxRqyLIQiYiV9CCjpIV1WgUeedroHUXvJF/SAvNVvB
+ZR00I/D2hsD9BFh3B1FEYbw7GuYuG27Z6fgRolOQUeTabjQLI386SV3IxZ1KFwm4
+GU8BTbUA2zwT3hu/BaaCI5jTSLyBpdo10b1wgMEnqmXG6AbNdxFVEWwE+CE++BHW
+0YBhKp8fghHwwN1fwTCV+QyA4Qn6EBVDkTrUPKqTeCmHzt3AQh8WVrsmrodyr5Yp
+69LoRnlkLcGJiOCKMOmkop9Z32ckGieYHrl24Dw6hmUSWDG+pBn0ezbSPit3FhAA
+qD2y1VzqxsaCOD634Ltq8AbvphP8XZPrrsC3DIA36ITaCQDa5Cn7madLCXy/uP6N
++tojtzXf4tUzumwGJGFLtdMXNmuEuXrj++NrU1xcscbvDn5O4NDMadwI1EDlQo7w
+uWK9jaQAVhF7iDEBEazZe26knQFxC0my4SyO1uQaEg3BKHj6z7dkAjzWJaQZhzql
+yrRzbCiVUUI8ZkrgM/+/6NJohUG/had6DoefgK6H8/yjgVx1Wtx+XAuBQ2cvclhc
+TAmHs128dWduNHxI2Yx+uM4kuHYpPKBwdEh91ZNeNqtBJURfSVjBCjKkTYiS7kiv
+XyvQOBdZVeSVpj/QoAfaUlQoBVm7aF6xf7GtYlVzjMsLYdpjXhy4ZbQQVUuPI+1f
+yFkw8PpASZ3gvO6KQ4V2w3hOYAxYQ1kSwTtaA7+18nyv65VolTmAotmLun94UKn7
+zjopByBnC/XEqsU3tibg9A7xQ2KUpWkpmG35f4ZR9aEIxSe2Jmm+Se0JfiAq6Szf
+dyWvr/TzaS/BZL4WEPk2Vw/mzWEPZOscpIkBFGK+Ul7yuXvbrbwr+zmAikHmTb1V
+XfPb9eBnwDDuRHhLBym4FMrPjzeziAxxkScTfDjWq6rvMmaEe1CX+dj6ldx9Jp9d
+iUngol89eSgAQOtptjcit5o0Y0Mu/RF6KIBG89ghFly5Ag0EX+7lVAEQAKFx5asK
+W7A9BNKPkaXgym0AlW2szQR1nwxi3APLVLS0Al9Y/3mnBbYyO84HDr82AtMSWSMY
+UZIKtkUj2sVqUb+xHOPkY/MenyoBrCl2qaTVJ89nnWMUjtrX2qk0O09+ByoYXTit
+BVPAIZ/qZfGNB+Dsp1haNKRdowkf6WXkw7A9dHB5isVmaM/Z0THNJRHwc6mcqbEV
+M4fDL+OCx6m2KQHTHirk+OE9Nwral82IIqj3d5UBHmjHAbQNXTDzZbWg6tYbLN3I
+EYxSRQpkJZIVheyBmWFZuivm4hCDZxJlZ1sgxQeIZk6wR2LBR6ccTW6PH11PhIpr
+6O8aQh8JUMg+/aJK2eQXINozYdjOTUjnWAUeUqML7Pg/vERRAgHXO9Z+NTIEWEOo
+Ee+8WOFmrmfjb9Uz27DtymhUjOl0ryiG6F1b90t1rZvVKWR2OaCUhICm88o3MCgb
+HFeOh7v3tnQb2Uot7kY1hgch6j1MNYWGb8LjwoTAmx9okEv9mh119k+SdVJP6wsX
+ZtL4860vTfTw6RQM7rkZBzTyf4qCvU5uRSd2u6JqtUhw4m/gkKQyW8jLEkqX7JaT
++iEBgPzjALvfSWDbDgst0szqU5jltYpgjG3On7/ZGFFJrkB06orUvovxLThWWvm1
+iugw4/av3n64hl/yfxvKQHLQA3Kfkjjzc3oPABEBAAGJBHIEGAEIACYWIQR+HJGs
+gDClpZ0e+rl1DzyHcj5AEgUCX+7lVAIbAgUJA+tFgAJACRB1DzyHcj5AEsF0IAQZ
+AQgAHRYhBGFPhWcuJXtdQn6ZBiGZBzrXgrS4BQJf7uVUAAoJECGZBzrXgrS4jfkP
+/ApYZIRnBL+LdTPYdbZDYXotkE6RO6ZsPdcV1G6na5jJ7igdVuvoz5nP3rX+oQoH
+6k9DysQzyh/SkXRPnbOOyvQsI7atmH7SkhNn7ke8zmEJLzApHA0ZMGXtBJHQkZwA
+5LDWIQb8HbtJTBr2DyJcQdpRmP3hHDgyYgwg0AUG/2JEwYqps+/pqJCrLSP+GLOA
+ia+wRH9xwv1Vl2gIxWXqEO6U3puqUg+0z1Av4Gj/xzuw1F3eLrOfgklhpASc8QtC
+89kx1nhFS+OybQfRAH7YN9DKE5L1kJxQ4t+uW8TiXf9r+MdcVMEI3LATZRtgowFc
+493g7EkTppmqabFns9OamyxXdIzLAKoKvykr7HPCBWUnZn2I2RrcGQltRBQlR0Mb
+jO+sFi89XnFPwXIw/t/9zoq1bXCGTt7H5RtrfxC1wTYXqLEdV9pptNj7j5mlff9g
+DMw1v3MfUxbz9gIDzs7ANnw3SkWi+d0v0bLadWdItkq2WKvvgB58NJtKPc8Jwilh
+nO7W31U/kv8FR9JcFXzS9+Y6ejIClF4FAwr5tK07N/xSFAKEs5kyAYEKxP6vI59m
+5h+tO8cws+pi4gqfWa3t3b+dVzKl9AIkWAYjq9FvbfiqZgKTlTviSUMpmK5qJVld
+72+NiolUVniJbw9Z10ps4G4zmXSl1ZxyKnehUzcKyPieEEsP/1/tctQx1LhVu0TJ
+RLtWrE523hqxpqDdF8/QrNp9dX3YVoEkMQW3YYir2oERtaosWXmRjldq5dNfgtwc
+lhG+/CP5rxNeCJlI+b64pC/yQMCrbz/V74aAipuv7ZZMflgr7ZD5i3jyM/7/AunS
+qOUPwkKrjetNF85eibeO7c0Y9/HhILkLQ8EoNfJshdc0/scwMZEpLHTMAHSrxCAV
+FuhLsF9epenA6IbtuMsp43aSxshX05RH7F94uj4VCMUSs/90viB5njItpPdZCqUH
+eXSvLSjxqsmS4Tz9Dn+uWvxleBLRRcpZykuNLGgwVXafWftWbA+U9KaJnDWFdzjJ
++gAsWfHfFBOa1RfXYP++e+VJflcHaEZ4byLG5Zf1HqAvvcaShAVuMXY1hoYJinvh
+uk1zJRW9dP7apZx7BXWxbWcn8LMR5GFfunl/M2iNASmkqxJ9gvy6TBRWJu2QeNbN
+5Ks0/GDUawQqvhmM3V6zFQWVsPwaHpufIaGqnKC2gXaIHXPP0ldyXdLXwgZ+6A7D
+IEqHQB2BDbiJtovk6GaK8PUCEHTiDmRF/mBzlpBJOn+Hc5ELufgr9E2lkrKJzFag
+CBCucNhVEaUedFrycxfSALing7DJPWb5cobu9K+3T9L3k57XgxSAj+g6vOxHuxHL
+ve1IPheCWfkKpJH5faFDWKpJYYPauQINBF/u5YABEADgWTS7wFA39XvpWNHSfAAR
+2/nlGWuTvD7zoirzUwOd2+I2XYwgl910KsznhlqDrHZlqKuGRjQlbpyTbsOH2N5k
+IE+0uEXidU3iwslSZ33RLL0h9+czDnlgijYXLCg5ScswBEC1E/kXX685AUCTPX2n
+D1+Ymxxgov3AvItVxKDd3N5ERsy6hYWPK4ACXt47hJFqPfPtnQe2IdFkRm3bOuX/
+X79Kb5N6cAoao65Tpsix1pm6tTNww0+THzIWzK/yhi1/tUOv/QJMEVAxeBAPr+Pm
+mvjHvsI9RNQt7VnoHVkqJhPDxyQZR2IOVQXvlYyCtkPA4WQlyxLzWM24TG8xhD1v
+zZzA8qs//o9QI8OLg2ZYxplC4lW6GEZk3GnrTXs7bW6HUq+RlayIbDw7oMs30jAv
+YyDdQpZrYuZvsWKbKu+65Yi3M5kW0v96LT3ueMJaL/RanL9JhAWuEqyezffsBZ5a
+88/i0n9FJ8cQ1fZq2/GLq/mN2JZ3e/HSWynTnlmk+qGk2bq0cRFJNHAs2HNAm0Id
+pjSFCPmek9j30wp2c2knML+SsSw5h6570mwILuKwFr6i2hyFlPk4H7nP04vPQ8P2
+Pu5O/Cfg9rPSBjIi9FsNS8/a29sSuOmsSGHZnMrVUpGw+iKmx/jVejOtqe6hYydu
+MSQtIU59E2fq5TM4tub6qwARAQABiQRyBBgBCAAmFiEEfhyRrIAwpaWdHvq5dQ88
+h3I+QBIFAl/u5YACGwIFCQPrRYACQAkQdQ88h3I+QBLBdCAEGQEIAB0WIQQjoUGa
+YHzyVyZWN3UsTffOV4ELlAUCX+7lgAAKCRAsTffOV4ELlDerEACBP9kAH17GHloL
+XJjd1IHttRWU2Qs/VV0H14g14hgRz2/Qa7KRR4mGrXPKS/ctMkDXwlvs4HPUTeO4
+MMT38hwxv54AjW7CtF8DR3EQFXKR51roICQognvqpPe1auNERdLzAdcn+NoHEQB7
+eyPqjQM3OGGq0SVRwNnv777o+Kd8Ncv/4fR1xvA20Ds94G5vCYpHB6J+lPPVXBmz
+rOYSf+QZWsXjAZdnAAYkpEjfJhNrqvqSoRxZ0dweCqieenm8Nzt/vdL9nT3+4AGy
+5hmaAG2ENj5AhI194gtgACvKwCl5hF0VKMhtm5d9SWS+1quHzgn3UFh3VZrfjPid
+CR64mIu3RpZe7EcR+lMl7gCJxdFlHVD3z1lbz2V6u+xH4ZsLrTY+v8kDxzY8ojM/
+zDbnlEK+xzA9akhlaD3D3wKXRVuSlrxfEVv14mwKN5AYHN7bLL3bjOo9WYtLznH6
+Av4GqXSQ+LOl0+6bLKmD68/N0q2IiZwUSOsxTE1fUdYPF8eiN8L+35Qt0jwybieU
+a3JYtmO8EW4ZEmjJGwKgyrf+eigJN2/0AeBwcJyUw1YfzaqqS35NNyn5eKANyFQ2
+ZhIjuXRyBOoUMBAx2TSm7FGeFOIw+aQgap6HuGbZ0EZBz6hr9ogNC9FVXCPENKo+
+GdTGoIEs0n6gGOPP5ssp7xUK3420AM3HEACSmYaNC1Gfq2d81fI0TBJ9ATCRPo14
+MjJGiWaFaXoVp/lQeOvlX2JyBG2I6fhMGPGKntCfX+/MERLNAiahQgOjvnOCQdlL
+hbq+6loQ1eSTX2AXpRlQpvyxLuebbM+HX3N/9mqAksgQdljmqoJQbiE/HqXqjmKe
+16ylU3Rjabyc2p/31p7hm0IJ/3yqDsM06FUBJ108SALQyVvKqRA6q1t/Odb3xgt2
+isbCEgvhJ8kYz3LQkvTW75rSa1cM53Udd1rbyo1t0PaOSGeUZw73/nY1+6LtUEg7
+Q0x4ohL1UE7z7+14mAtn4OvGDuZJil7Lf4cPszf0SFoHPs8iUFpSorBwn3u+5ZXW
+NYFblPU2WK3O52qZqsjuQI/gK7uQhXjJO5nA5M8Yv7bVrbLMOj64hdOpNbd56Ycc
+qwYbHZL3WyRAN7TNg5ZlHgIVac22StawjXiHWDGaAXpCaHJn8ryM3LY+LTz16R2M
+bi+HVaw+0fY9f/mIcOdT6AyDg+V200GkGXL6aw0LZkBZmDin+OMmL7AS8TZ4dvZt
+zj+sykcT8DsaFj5Au6zHJoCnsuShMquHOA/vcUkhoe8/E2Y2QdiX7zwDM8vFM8tX
+DujFLNPIZuItcVEpE3ysFV2ZfVgBXoxTlZUQxdgJBQ0zg6Ez7rDYEAhVqo2gY9sk
+XtN80X/unsjGSbkCDQRf7uWiARAA3i7pu8/QvukeIBoIk1V0GHGPjX+GeV3fR4fu
+ciYgx+NKTXT/oJ/89KVeetT4CSnGEZcEpAvsBL3hsiblJYyLVmeoCniFlU+rMem4
+zYP2PnEX70Q56d6SjBArs3K1FZK25S5qqv5ceM10NVRwPufV1RIuui6mQLm2ZwlY
+JyyANZZXMrHMJdaHpK9mMBSSF42MFQZhcauQCrhMhcpmZKn0D2+PpRveYwSr43Qi
+qBWR2INTDmj/V3ERMviE7vLajWQcmDdcrBp4u3miAJcJSn3XR5SiuL5W77jFEzgJ
+zR8yTC4hWE60nWJOk8UrEbpLyr7mBE0Tr7+1IBMgVXh8WHyzLE2ENREFvtp8KlSS
+y47Ky9n+5aqPI4M7epMNwU/ZGQnC8o3yX0zZL1tKq0fTAw1Ly4NGE1gRbmzrQcCh
+qUHg/J4KFYBMg8eCAzuPp4CRk8wUzu4fRWrOraoz/7bvhH8ilgPu1teLLKzDdOdx
+QAaiz/nGy00ICNbYqifR5m73K/rDdjtIqgsMp9Az0mEpgVNq8SPzM5grqAnP/iww
+QxwFftiXq/pEP2d8rn65e8NikN42Q28PH1D/uBYnOuVdZUvjU9wwywmfyr+NZMaH
+X9sN8R3Kk990W9VxwdOTITpAjz0qMtpE7i/GwPEtpZPTIfl54+cVKvyUjBuTXkWn
+vXN+6MkAEQEAAYkEcgQYAQgAJhYhBH4ckayAMKWlnR76uXUPPIdyPkASBQJf7uWi
+AhsCBQkD60WAAkAJEHUPPIdyPkASwXQgBBkBCAAdFiEEBjEqvVaiYb6sKxATk1aQ
+aqvQi4MFAl/u5aIACgkQk1aQaqvQi4P2Mg/9FXfsIZAgPN/Dq95y1fHG8jsPXEoY
+VNY1codxxAaNqvBXZkfJbFwSYpLY3xIbyxHuGuOtC9NpIy9M1+PR7MsxtZAvSjP+
+flP/12x+6nP2H3NWOICpsY1tNOnQe2SjKJxZXHFnDqDBgKpv3QfKUHmYEdExJe3p
+NQrjZAgmdbEHeoj+P2VV5vqRrJoqNV/pUbM9czfEHeMVMm/mwWNOi/paCh1y/PxZ
+Mkj2bqLMRFfML9O/7QOJRxu3wQwl6jJHj4o6CHks6t237FSB+qZhhQP+vR2CZl5w
+lQ4trw0wpNgbZRIMlU3tUfFQ+KdFsM7UqwzwrVgWFur5r7KrFzJN88EKSplrIY0q
+se6S5b58H7Tw1jtfjb/xF6jQz5aoZ9xemd8roLReRpKPq70o2eIP1HkjCtqmd5Xc
+RQaVEUvlv34WZQ5w2eA1bEBESjbrKhX+H0Un0msUS0JpnpegRNZqW3Bedeos0usy
+MsfqMYmZEcZb3hw51XnSb8B/WhkSmcoEuECRxeCu1tw0pn7o4GemAeqT5ng8LXeE
+RJhrUTlCIyRab8TIQZvmf6XjneT0stZLKCoZUXO+7FH7F7nPsew1dU+WFIauQX71
+PkZp2JMT7W57HKPuEillF8v5+H1k9Jq/2k+ZdgmT1Gd27nALBOc7q8rr00Lf6BU3
+K+XsfWo+p08CXKudfQ/+JFzzpyKeX5nVqiqbxqUakPy/Ot010/7457YVpvcLmcvT
+Yn4cR0dottl96lp5wT1jN7VXfZu/tsHEtTg1ofeExNuCL8DZVsSN836idRmObhLP
+dnYmThZcXBJ3RgSniQNwvuuGUtpH7OXb5vnAOe42+n3yucxhPI9Gzo5g6fTqWwb+
+qwh39ydxtiv3v3jgFixJLj/HH3MsxTm6cNUTWNLzvX+HugBeuOfyDG9++fe3UmZe
+MczAF9N9tDFP+0b1diXywJWfSdVLBmMARYeh0Swjud60SQLTqaqXVfPSECGo9LVc
+wot2u4q67QhUC2OTKiTkF6QVE05iKoPEPkCTmMvSpbHF3ERZE3J6YsVg17Uc7LrZ
+7DRRF+03mu4njS8LvIoeBuqsB96mNQNH/PwLSANWTtclCwj2C9W1HKy3zKjnu3kC
+PHLzwQFEO28TE5EsblnBdA8ozNIV887V7yw89MxPhpuXRn8BVAU1S9Dj7j3mNHLj
+rVAgZmr/nx3oDt8VfOZpK8u3u1voZdC+cnTBdcG2gzM8Ya+h8C60Y8dFzykr8hr4
+b5gDeDI1OkQ2vOQHtnQPdscYKl0v1ntHq2wrFuCIol4WneKh3Jrvdb37cL971u4g
+dpw0jTO/ykCvLlipxjJ/NrnXFb6TriZRgWZqiIwY2lKEfZDXqc/iOa2L0yBr21a5
+Ag0EX+7luwEQAM/CQdinTzIHaEJsCe42g6tt4dBC/UC4wD367rJcyJbEd+qaLJwS
+CQUbg/wrEdRT+aROHVKLwrvXxtgJs0x15vvFTurkn1BnNMh7p8woYwip7PKrNn2+
+96Yg7Aqc3a3gkDQeF8Q7uipOH/5feJh6l7Iu718pvnDUw4UFZt/RUrdqseFXVwr/
+ffSalLx7gJhL3mYuU1qpJZxsonNwAS43eViagI0FHSqixB5kPgFcbBf3BIiisOCy
+a1L9a+zSt1y1aEFC7m+9YlGJA3C0/X8s+dK0VWOrJlP/WmKUp3Epxpu6srsBItcT
+YMuGA82/03YAJ+jpGMRb+X1Dq9vuOUxvDjG+G10Cgew2EjiAkXpVg/1NsCrQWRbs
+KtFf5PXGfKCO0i8hEzwmJLd5OlNIIiup450iX4eS77Tey69hGyweLIC4YDPDwFpp
+bkDdRG6nDvePbEHi5z1L41NaWNa0wEyh28OqrmD0FCcGukk24pBVemVEx0En4siQ
+la6/1QXQlG/wTi7Yi71V/4oz7iZ4lSPWs0ACFGD9W5InlRykiRXC1cV27f+qMw9u
+Y6UbgvN70cWflK5C7e2h/eAQfxj+seYFUjMnJTkXiZE85m63p1Yu2A1c9+jqJ0L3
+Lfn5YIQdtWdY3Qc1RIQYPVRl5NcgXIPV7TwjvnjowuHjWX0IQbhv61lNABEBAAGJ
+BHIEGAEIACYWIQR+HJGsgDClpZ0e+rl1DzyHcj5AEgUCX+7luwIbAgUJA+tFgAJA
+CRB1DzyHcj5AEsF0IAQZAQgAHRYhBOJesM8c6ASdR/HZpjPhDkoYOo5GBQJf7uW7
+AAoJEDPhDkoYOo5GhpcQALowCpZ8UowMWlQFfZ2ySJalnZM6S2RxCFiss4W9pGuu
+9PKuN2wdXW3HGkBGDAuQgLwanSfhGSt/urT3+DT40OlDMzanRwEK0qiSaSs/xBtK
+dNL7JmGbcWTXpNP3aHhfYhVOg7NJnsfZ8Ti3dfuv3ZrjcLvgdnZ/s6O9S3gU8DtH
+fpnOfE3hxjUEHEw9hs9Otc6foCqMDZDvfU3emYduD5AvTiXYdeD/mZBD4OmF99II
+XWNuQexAJ+xgOPdvXaYt0lBuXmfMcn/1hrU3RJqguwnPZ2cU5zo41/uSbdsFrTHK
+yEOLTn0XYYk07mZGdscljzmXbpsbAC4Jp8CDBhUfdzfi1n3AOyblk1nywfionLlz
+HDtfWQYCxp16N8S2MU7tA1w8rFNwVDVwmxIfgjLrjPAgvqSpCmLHTXNBfdLUYRAv
+SpY9TR+U4YOOuEx2Niwnprdjm1qilN+fmPR3tWvVChlD3kHmSpi1+9ix+xizlBjN
+eZ08Eq5rDBPsTpqJmoNS8pHE0EL3IVpcB1pZ5rd6UBSa7LoMLeWwWm7Ap5VZALfp
+jMNws4SA2q5OTRY2or/+m1+cfDWIP+2XQV4YaNFMbO7XKr3vnUOxY9gyADqfRJiv
+DljHiw5iLzbkaHs7dYJOPNMGMlRzZfkkxg6Patx44TQ2rO7LnyCgVdFZWDHNevgR
+Z8AP/152xfh3qsOnT+R32Rt8CcwXmKFxLylgpjegcUmbutow9zdlX26qZ67cJ/3p
+hNLZgAYKPrGecGA0BJ2UzsPEKKz8I/dAp96LpHo/24WqUamh1z2PRAgyJGC43zm0
+rA/KAlcht8bbI/VuZ5eAYXjH01QfPS7i7fFOryYYFqfH+BTp3ZEr/A7FkcOZXmNV
+Gg4+oC2t6cJnzDsM0MUJ7dgNAHTLGx6RZZahdE3LJ8oVJ8Vek9KtjJbPr143EZLt
+ymkiy93pzLUaKWfCZJCCI9nfJnNZnvoQXv0l3wnrQIFE14Fv0jbTALHRgRJlB4cZ
+i3teEuf7shSDsd13JDdfmxMsxnfeVsIUPa+J0GBSbe14JHXlcd0t03cpbzO547Qb
+rFpD98XO6Y7OefWD3pwDF2Izjnn4Cny/hpUIEO1A2j4qHhUkqmnFmBO6yIFic637
+CJnYe3uU7ss/TNIUKLhujqlcNl8WeOMVPbhnCuOhyQh2aioAKn1yiQ1EgNSIGIVD
+LwqMt0kxI52/aDkZgCcEfBFC1c17IeUH+G0HMGm49/acFHkhX61S4efXhvzH5J0l
+Dr+0qk4aVKNwqkUNp56GSMLhiiSYivX9Xa4qQGNlmrki1pC2DamlTXDLB67XQcRp
+dAc+4nNTK4E/czrr0+wlkgz7pC1MAllCLilyTSPGnKIPlOd2uQINBF/u5d0BEADF
++6hDuKvzbmKWZNXjJK6Em/5nnzBOa155YQLN91zMs6COI4p+YuIVPPzVWZYR0yHs
+gTWw45cMV+RYwuL/P+1Z84bgOyPloIVF9VQjOC+wB3Gn4qmTzobr6q+UfQVvUiUQ
+8fGG11teWvYpWiG91uialjHZmrpAOQxjHRxHPpi0cZtTFEqinCIy6c942xbtZnzf
+nzPpxkKl0a8s1eKZ0KlDK6Ab59nxAinilohXRg/U6sqypsyLl41L0qMZek5dEt4C
+r3spdSkZgxqJpLTqQy/5VB4pcfEaIaank3sLxhpil/oQiq+38WA0VkICQyeiCsvf
+eEKyt1C6COBNH+olegUxudTKDHFthyGMPRz3McI5jHxCyru0mfLJag2hHXzgGoaD
+VkYIwkvyVsHWDqrZMMXcCIUVlpphxtHo1M32AATnWFe4K1nFdbejR9XC5xWOgwbT
+zCblqporHzU0c8WBbfJ0Y10IDrHsa/F08PkFvVN48Ydik6rcwowSPxP+59Q9AKLh
+Isd2hzfWU2zAbG5Ph1wecwlYR3tp/0i3uSTDXfuuaY+vrqpoECN6fnSg8NxiBbjU
+JR0Ju6KDM2SeBUz5hp9BzL8+OPTogRZoinxBogrRAvdGLOnLG5hMjBezzF8UEvp6
+IMisGHBZgXoX4Juvf78RE8JOwHa+HUejj5kYiQW6TwARAQABiQRyBBgBCAAmFiEE
+fhyRrIAwpaWdHvq5dQ88h3I+QBIFAl/u5d0CGwIFCQPrRYACQAkQdQ88h3I+QBLB
+dCAEGQEIAB0WIQT2AU9wN9W7TuO6I3E56nu98JFFWwUCX+7l3QAKCRA56nu98JFF
+W5whD/9Hu5cnJ0hnzqk3MQsdMXbTNLsv+KePV71kcMRat4hjw2Li/TUaC8xtA81d
+O/1obmsuoDAgv82KlQ7DLDXjFk2q45lJdgZxAkN3dEoYakdTIEi11FvwbhV+qxZK
+jTq3jFQho4i3GDLgrvBMG4B1TGMH0IPux9fmBGpxYKmp1GjhpgoMXp9bqzsV/mPZ
+TxPlmIpeJEO2jeCWKhHHw6rzwGjF68G3HiJ0TqvjdCtcNrwd3GTDsdEJtUl49aqF
+M7VfoqKjVdRO/YDL//+TJNOYz5EBGjIZxbhgZJ9Qz+geSBx9GJtDWdq193ofFi39
+oleTFnEMj+OeIr1Bc2pc8Z3HJttFknicJDkeze3mM0CZAkhVkLFy6DvAQkXrgvfp
+AUYFACQW8E2XmRBiKd4huojWYz5QGSEIk2fYRVhse2HAUZ9gTODSX2L13nls+BEi
+sArsmSFA/RQslDXW+Jl+P0e37BzN51uk2Dg4ylJUBgcpTRUn4Q8c1DgHDhkEVnBI
+ny2H/MFuhImw9g5xqlBfCEKh5D8D0e4fX28MhSsBlOCeIKJoY85U3GNY0tlIwAt8
+M7IIHe1n1qncPbAMmq0K48J1lfyTEbXpnSfArzEdbnosjBUaiQX5EwA656eZ6wb3
+Vq02UDei6KPuOosl4Voy+Ffq5MCkanVMA97/0wV3CeCvQYGbsvsUD/9fLYc3yH7A
+0xksK7PImztDR8MLsUPoiv/vnfZ+WJJ+YJ0TKAHm1ZO3NqeZmD7XoWHKwh83zsK8
+x/JUASCBN16isC+Ym6IwF83/HXJfKNvvotkr2WG6Dv8Vg1Hhk2Iv5y3EMbFa9rfv
+6vjxho+0sYrraJH8qQAM08IIOi7+afrkR/ikgA8V7ymqmdxtMMHZqG+h5R0VGTVw
+QBxZ5/ZiY56Qn5UH2m0Tc2AHOcAQTvCEwyb19IPyhif+rek3npSvKtDc6WBJioyi
+gvDhl+jgIfcIo77w6GthgbFc9k68Je56Peu2J30zWj76Z+Di1OJhAj1wFr4/XT5o
+c1MB/Vfyx3hEPRDNz7dRaDqoVnYVdoI0blyCiSkD9I4/axb4X3xN2SK4XA/zv+Lb
+1FbCM1XFL2aF+09tk+77EVdWsBmQpOArD0d54E1YulBGaxVm5QKfov23KiqHIFVF
+8WYqJqNJwbJRZii7klczkVm3wFte3NWK7HW8kfF147lv0z3AiZYnk0O6Mj1ip3R8
+Qm5yiv57DbbgIMkSPWCpEtFGHIoK2msJ2bQcizh2WGxLos00RTx3IVAeSAS54+kr
+rMBg50wNczcGHKPDUKLwkYczgHonUtljAkeXnTl69rifChI+KpjHNtF6dFgC1aSt
+MOud6HhAcd0f3lmuPzCGGp4YOQx9tV139bkCDQRf7uX4ARAAxaybudQK4fMIzLiV
+grIzthhb3/DK83PNohTNMemM2V2z1Ij5Dlu2XNDypMdR0rKM/QI3zWud1+vd2h/l
+QZlg58FspvrY6I7hI+cbdRldVaAKDGQHo5Bi0a7BkonZvS/0wnNUPIhy/znzXtXR
+f4L7ePZMofH/2shz4TZ1yNpU8zaomY6eNjSc51P4vVxtDQ4QofQeJEn8aO9a4whu
+O0TVEAPKRYBRgjM8faDuUJtLfiC3OrhLg+B7JVSF3di4JITAyafPbZACLjV7Umxb
+SUL3qTJZVpIuhF0xQOCE+WRx3Xs7lkPdHMqP2OaJ8Y4ymR08cSfIP2XFKsQFtoqT
+VyMQgGgI6VXF8OfnCnGgx0Do1vJNoL0neFzVXpCPPzh1RbcrtndZWum/1R4egkYg
+J8TPQH5X391J58Uwd5l9/ZDdoSeeQYdtTR4YQ8//ATFO3hoSRvES4U6ZwO8LM6di
+ra6pqb6j0liT+DdcBwE4C1bGJMJ6d93S5SfH3llDIMJo7uJDbKILFMES9rg7S6I8
++SW75TjKUk4Y7L8R8qwURqEyuOOGfaQXirqvji4PdcGDBiIk2Oq69Ky6lmlJgyIH
+SZ7SO1JXk0yAJTXb+a6FJTLFxidkIZzu+LhLBn/MhAPjVyv3qCTQ7O0lu8Mfcqg5
+8hhJ6IE79PBHS3z8ok+mFK0iGrcAEQEAAYkEcgQYAQgAJhYhBH4ckayAMKWlnR76
+uXUPPIdyPkASBQJf7uX4AhsCBQkD60WAAkAJEHUPPIdyPkASwXQgBBkBCAAdFiEE
+JFV3TUL9/mucOD64/hACvFlwgR8FAl/u5fgACgkQ/hACvFlwgR+LoRAAgtIgaKb4
+ZY8qoAFZeph+Syg+mMKfPJkBuGUedJl6IxbHBSg2mhnCjJ0bmdqxsAXgtcSUqmtZ
+Yw9NyoGgiVjs+gu5sQp1Oxc2/keQXaVksTkoXwdnf+2iXyp1WPeeLGySHmzuwy9c
+eExt+h0mVmBgFls2wNdFGPbVfiT3PvFkwqsnta6HebDTN4pMzvG1IIGV7L5KRo1E
+dmkrt3lXQWmdgHl3JoNQ9v/Jgf4jo6gDw53YvJFKJcaOOAS3d4CzPWmcLzcy4mf0
+9YI3DoQCbYL3cRNelUwzUF2L6QyPCwonXemLCmfkBgsSVqvW4fq8qbEHGF2fK7x3
+d7bZEsUiGCt/tXOkDkNJ31T/mC35nxZfcj8AMPixO+BnAeKeYC37LbQD76jrw526
+tUXsAF+QON5DPeot+e8bIx9qSbvdqpXDkK4lGcRTuS2OVC8J9XfDTch4wm3Kd4P4
+lDdRAJWnLfVay0m05LGlekWdEzcjP8KDaICH9rEs6f9e1gy6mTEBnBW//41BxELT
+KxoTGlcX3yEhCmK36g5C/+d6b7Ji5arGGTCa96v/xG32KYc1zfn3TYkCx06pPUbz
+iAl2l0MTpGeqz2hJMOGA3JuxwlksJKqnPYy0hHKdVW4Pnn25NeXcBp8wpkt8VZOR
+bzjw/TJB7qvJHoRo1tat85Uij9rAXqTyO8Ea0hAAi/EfuiDDy3GV7bvjFSA1XEjL
+d+F40g2X0QG/PHTScYB4rFJwV0GFUxLHr4g7iypAVI+BB4EYikx8gpee6B0g3J+r
+aCFDDrRPDKdqrpZK53oYcBPkdSBbCr5MAa/M3DerKBEgoBVUbaSHWN7OH2ae+5R6
+X2ERmYZdW4PCj6lw7a+RhkAsgKo8RjonjV61ehQPZh20noI19Q80BYYSCfHHvzy5
+vwvByhmTMJNrl3PDpBy9/TwBR5DpnHfOPJX6bnl3pdu65F2TRM6yoFbfoUiEqrXV
+4wC1I++N9VjrQvXSp0ik/XaMWq87wLIg+1owElJIzwyZWukQkZMAYtesVFz20YwC
+7Nu8SNr/NTSCH1EqLsS4YhBTsjpc2T8AqUlgxKrilmLbrj64PXgMsQ9WYm5zwlC5
+UA5eky5YhETFJ25dIaplMm47aIbPSH5f9y5eYPkfOCoMu5oDzDzoXdH9V1YfsHqa
+8bboSgTdariC23x38E9PaWQNyY2MFKL6cFt2ilIsMSSD6JAm1x8kBtn1bBopG588
+7mTDtlqHCw/QrTuLreJG9KJ1dQFJ/Q42+csH09l081wlv4BBuVlN1Xmj+c2sWn90
+l1BPZfYHd9jhggI96yTZhfTfFbSMSuGPQyqHnwDYdA3cNj5BYievBkO5FZaCe9SZ
+4xcYgqlVpv15O7VrD+I=
+=Uugw
+-----END PGP PUBLIC KEY BLOCK-----

gating.yaml

@@ -0,0 +1,7 @@
+--- !Policy
+product_versions:
+  - fedora-*
+decision_context: bodhi_update_push_stable
+rules:
+  - !PassingTestCaseRule {test_case_name: update.server_freeipa_replication_master}
+# fedora-ci.koji-build.tier0.functional is not yet stable, cannot enable it

generate-rndc-key.sh

@@ -1,6 +1,17 @@
 #!/bin/bash
 
-. /etc/rc.d/init.d/functions
+if [ -r /etc/rc.d/init.d/functions ]; then
+	. /etc/rc.d/init.d/functions
+else
+success() {
+	echo $" OK "
+}
+
+failure() {
+	echo -n " "
+	echo $"FAILED"
+}
+fi
 
 # This script generates /etc/rndc.key if doesn't exist AND if there is no rndc.conf
 
@@ -14,7 +25,9 @@ if [ ! -s /etc/rndc.key -a ! -s /etc/rndc.conf ]; then
     success $"/etc/rndc.key generation"
     echo
   else
+    rc=$?
     failure $"/etc/rndc.key generation"
     echo
+    exit $rc
   fi
 fi

sources

@@ -1,2 +1,2 @@
-SHA512 (bind-9.11.18.tar.gz) = 947a7f9f58ac40744c541b2c23ef3eb9d8b6ecc8e3bb4f4b102ba5aafcc20c58ad5e8bacdd338821369c1f7de9d1073c264208e45f054ff7e3a9391894b424ab
-SHA512 (bind-9.11.18.tar.gz.asc) = aeeef8b211199a5d2715b63da9d648322241726e60b8cffae883bcec0e6335fd6c5ee431755a0bcb5b2a39ce540986edb0c9f51c6365aa226cff83ba358bac1a
+SHA512 (bind-9.11.31.tar.gz) = 791adcb382b0cc6767dedccd0cbdbc48b5d32507c569f672397c9f2de59241433c39027cc3099957fea0885e1bc8db882cf83ae27fe0127d543cec8fc2e89f04
+SHA512 (bind-9.11.31.tar.gz.asc) = 9425d70ac0e083ea2274b3a12d126c49ebe36251a51cb1e90b6569963c2f0f8e235b14e451634852c200857f2ec9737d8042ceb5dd3d452f9a3f90573803f896

tests/tests.yml

@@ -6,6 +6,6 @@
     tags:
     - classic
     repositories:
-    - repo: "https://github.com/InfrastructureServices/bind-tests.git"
+    - repo: "https://src.fedoraproject.org/tests/bind.git"
       dest: "bind-tests"
       fmf_filter: "tier: 1"