Add test case into dnssec system test for new regression

https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/11195

Related: rhbz#2405830

.gitignore

@@ -232,3 +232,7 @@ bind-9.7.2b1.tar.gz
 /bind-9.18.30.tar.xz.asc
 /bind-9.18.31.tar.xz
 /bind-9.18.31.tar.xz.asc
+/bind-9.18.32.tar.xz
+/bind-9.18.32.tar.xz.asc
+/bind-9.18.33.tar.xz
+/bind-9.18.33.tar.xz.asc

bind-9.18-dig-idn-input-always.patch

@@ -0,0 +1,98 @@
+From fcc50604359a05e24003f3ff51c3812d8f307814 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
+Date: Wed, 6 Nov 2024 21:29:47 +0100
+Subject: [PATCH] Allow always IDN input in dig
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Even when stdout is non-interactive terminal, allow unicode characters
+to be encoded into ACE form. Still disable IDN output, but unless
++noidnin or IDN_DISABLE=1 env is detected, consider input as locale
+defined name.
+
+Provides more isolated change, which issue #3527 introduced similar
+behavior into 9.19 with more changes.
+
+Ignore input IDN errors when stdout is not terminal
+
+Attempt to prevent visible regressions when enabling IDN on input
+always. Instead of new hard failures preventing IDN decoding of input
+name just use original input.
+
+Should make the change backward compatible. When on interactive terminal
+behave the same way as before and emit hard errors. Become more
+forgiving in scripts where stdout leads to script. Decoding output is
+not enabled there and if input decoding fails, just use input as it was.
+
+Change dig manual +idnin
+
+Note in manual IDN input is always enabled. But it silently ignores
+errors when stdout is not a terminal to prevent regressions.
+
+Signed-off-by: Petr Menšík <pemensik@redhat.com>
+---
+ bin/dig/dig.rst   |  5 ++---
+ bin/dig/dighost.c | 16 ++++++++++++----
+ 2 files changed, 14 insertions(+), 7 deletions(-)
+
+diff --git a/bin/dig/dig.rst b/bin/dig/dig.rst
+index 88b0a40307..e2bf3764d3 100644
+--- a/bin/dig/dig.rst
++++ b/bin/dig/dig.rst
+@@ -453,9 +453,8 @@ abbreviation is unambiguous; for example, :option:`+cd` is equivalent to
+    This option processes [or does not process] IDN domain names on input. This requires
+    ``IDN SUPPORT`` to have been enabled at compile time.
+ 
+-   The default is to process IDN input when standard output is a tty.
+-   The IDN processing on input is disabled when :program:`dig` output is redirected
+-   to files, pipes, and other non-tty file descriptors.
++   The default is to process IDN input. The input IDN processing errors are ignored
++   when :program:`dig` output is redirected to files, pipes, and other non-tty file descriptors.
+ 
+ .. option:: +idnout, +noidnout
+ 
+diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c
+index 0f8ac1335c..1307346192 100644
+--- a/bin/dig/dighost.c
++++ b/bin/dig/dighost.c
+@@ -604,7 +604,7 @@ dig_lookup_t *
+ make_empty_lookup(void) {
+ 	dig_lookup_t *looknew;
+ #ifdef HAVE_LIBIDN2
+-	bool idn_allowed = isatty(1) ? (getenv("IDN_DISABLE") == NULL) : false;
++	bool idn_allowed = (getenv("IDN_DISABLE") == NULL);
+ #endif /* HAVE_LIBIDN2 */
+ 
+ 	debug("make_empty_lookup()");
+@@ -623,7 +623,7 @@ make_empty_lookup(void) {
+ 		.badcookie = true,
+ #ifdef HAVE_LIBIDN2
+ 		.idnin = idn_allowed,
+-		.idnout = idn_allowed,
++		.idnout = isatty(1) && idn_allowed,
+ #endif /* HAVE_LIBIDN2 */
+ 		.udpsize = -1,
+ 		.edns = -1,
+@@ -4871,8 +4871,16 @@ idn_locale_to_ace(const char *src, char *dst, size_t dstlen) {
+ 		res = idn2_to_ascii_lz(src, &ascii_src, IDN2_TRANSITIONAL);
+ 	}
+ 	if (res != IDN2_OK) {
+-		fatal("'%s' is not a legal IDNA2008 name (%s), use +noidnin",
+-		      src, idn2_strerror(res));
++		if (isatty(1)) {
++			fatal("'%s' is not a legal IDNA2008 name (%s), use +noidnin",
++			      src, idn2_strerror(res));
++		} else {
++			/* In case of non-terminal output silently ignore errors
++			 * in IDN input decoding. */
++			(void)strlcpy(dst, src, dstlen);
++			resetlocale(LC_ALL);
++			return;
++		}
+ 	}
+ 
+ 	/*
+-- 
+2.50.1
+

bind-9.18-partial-additional-records.patch

@@ -0,0 +1,54 @@
+From 3f686891729c7d39d879e8b5bb1aa17d874d265d Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
+Date: Thu, 19 Jun 2025 19:51:43 +0200
+Subject: [PATCH] Limit number of additional records fetched
+
+Limit number of started fetches for additional zone instead of doing
+none. Keep limit of NS filled with additional records, but present at
+least some if possible.
+
+Might help broken implementations relying on receiving addresses in the
+response for NS query in authoritative zone.
+---
+ lib/dns/rdataset.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+diff --git a/lib/dns/rdataset.c b/lib/dns/rdataset.c
+index 532e49a..bfa8e37 100644
+--- a/lib/dns/rdataset.c
++++ b/lib/dns/rdataset.c
+@@ -581,6 +581,7 @@ dns_rdataset_additionaldata(dns_rdataset_t *rdataset,
+ 			    size_t limit) {
+ 	dns_rdata_t rdata = DNS_RDATA_INIT;
+ 	isc_result_t result;
++	size_t n = 0;
+ 
+ 	/*
+ 	 * For each rdata in rdataset, call 'add' for each name and type in the
+@@ -590,10 +591,6 @@ dns_rdataset_additionaldata(dns_rdataset_t *rdataset,
+ 	REQUIRE(DNS_RDATASET_VALID(rdataset));
+ 	REQUIRE((rdataset->attributes & DNS_RDATASETATTR_QUESTION) == 0);
+ 
+-	if (limit != 0 && dns_rdataset_count(rdataset) > limit) {
+-		return DNS_R_TOOMANYRECORDS;
+-	}
+-
+ 	result = dns_rdataset_first(rdataset);
+ 	if (result != ISC_R_SUCCESS) {
+ 		return result;
+@@ -603,7 +600,11 @@ dns_rdataset_additionaldata(dns_rdataset_t *rdataset,
+ 		dns_rdataset_current(rdataset, &rdata);
+ 		result = dns_rdata_additionaldata(&rdata, owner_name, add, arg);
+ 		if (result == ISC_R_SUCCESS) {
+-			result = dns_rdataset_next(rdataset);
++			if (limit != 0 && ++n >= limit) {
++				result = DNS_R_TOOMANYRECORDS;
++			} else {
++				result = dns_rdataset_next(rdataset);
++			}
+ 		}
+ 		dns_rdata_reset(&rdata);
+ 	} while (result == ISC_R_SUCCESS);
+-- 
+2.50.1
+

bind-9.20-CVE-2025-8677-dual-signing-test.patch

@@ -0,0 +1,172 @@
+From 1cbe670c421ca866fe8cbde661801e89e254a46d Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
+Date: Sat, 1 Nov 2025 12:00:59 +0100
+Subject: [PATCH] Add a system test with one good and one bad algorithm
+
+The case where there would be one supported algorithm and one already
+unsupported (like RSAMD5 or RSASHA1) was missing.
+
+(cherry picked from commit 3aa6f585e0466700e5d4b64fffccf883bb1c21dd)
+---
+ bin/tests/system/dnssec/ns2/example.db.in  |  4 +++
+ bin/tests/system/dnssec/ns2/sign.sh        |  3 ++-
+ bin/tests/system/dnssec/ns3/named.conf.in  |  6 +++++
+ bin/tests/system/dnssec/ns3/sign.sh        | 31 ++++++++++++++++++++++
+ bin/tests/system/dnssec/ns3/template.db.in | 27 +++++++++++++++++++
+ bin/tests/system/dnssec/tests.sh           | 11 ++++++++
+ bin/tests/system/dnssec/tests_sh_dnssec.py |  1 +
+ 7 files changed, 82 insertions(+), 1 deletion(-)
+ create mode 100644 bin/tests/system/dnssec/ns3/template.db.in
+
+diff --git a/bin/tests/system/dnssec/ns2/example.db.in b/bin/tests/system/dnssec/ns2/example.db.in
+index f711f5823f..63d41e5e00 100644
+--- a/bin/tests/system/dnssec/ns2/example.db.in
++++ b/bin/tests/system/dnssec/ns2/example.db.in
+@@ -168,4 +168,8 @@ ns.managed-future	A	10.53.0.3
+ revkey			NS	ns.revkey
+ ns.revkey		A	10.53.0.3
+ 
++; A secure subdomain with extra bad key
++extrabadkey		NS	ns3.extrabadkey
++ns3.extrabadkey		A	10.53.0.3
++
+ dname-at-apex-nsec3	NS	ns3
+diff --git a/bin/tests/system/dnssec/ns2/sign.sh b/bin/tests/system/dnssec/ns2/sign.sh
+index b60e82a631..eb008067a4 100644
+--- a/bin/tests/system/dnssec/ns2/sign.sh
++++ b/bin/tests/system/dnssec/ns2/sign.sh
+@@ -62,7 +62,8 @@ for subdomain in secure badds bogus dynamic keyless nsec3 optout \
+   ttlpatch split-dnssec split-smart expired expiring upper lower \
+   dnskey-unknown dnskey-unsupported dnskey-unsupported-2 \
+   dnskey-nsec3-unknown managed-future revkey \
+-  dname-at-apex-nsec3 occluded; do
++  dname-at-apex-nsec3 occluded rsasha1 rsasha1-1024 \
++  extrabadkey; do
+   cp "../ns3/dsset-$subdomain.example." .
+ done
+ 
+diff --git a/bin/tests/system/dnssec/ns3/named.conf.in b/bin/tests/system/dnssec/ns3/named.conf.in
+index 680cff58d5..3536046319 100644
+--- a/bin/tests/system/dnssec/ns3/named.conf.in
++++ b/bin/tests/system/dnssec/ns3/named.conf.in
+@@ -84,6 +84,12 @@ zone "insecure2.example" {
+ 	allow-update { any; };
+ };
+ 
++zone "extrabadkey.example" {
++	type primary;
++	file "extrabadkey.example.db.signed";
++	allow-update { any; };
++};
++
+ zone "insecure.nsec3.example" {
+ 	type primary;
+ 	file "insecure.nsec3.example.db";
+diff --git a/bin/tests/system/dnssec/ns3/sign.sh b/bin/tests/system/dnssec/ns3/sign.sh
+index 14fc709bfb..743a0e4121 100644
+--- a/bin/tests/system/dnssec/ns3/sign.sh
++++ b/bin/tests/system/dnssec/ns3/sign.sh
+@@ -673,3 +673,34 @@ $DSFROMKEY "$dnskeyname.key" >"dsset-delegation.${zone}."
+ cat "$infile" "${kskname}.key" "${zskname}.key" "${keyname}.key" \
+   "${dnskeyname}.key" "dsset-delegation.${zone}." >"$zonefile"
+ "$SIGNER" -P -o "$zone" "$zonefile" >/dev/null
++
++#
++#
++#
++zone=extrabadkey.example.
++infile=template.db.in
++zonefile=extrabadkey.example.db
++
++# Add KSK and ZSK that we will mangle to RSAMD5
++ksk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK "$zone")
++zsk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
++cat "$infile" "$ksk.key" "$zsk.key" > "$zonefile"
++"$SIGNER" -g -O full -o "$zone" "$zonefile" >/dev/null 2>&1
++
++# Mangle the signatures to RSAMD5 and save them for future use
++sed -ne "s/\(IN[[:space:]]*RRSIG[[:space:]]*[A-Z]*\) $DEFAULT_ALGORITHM_NUMBER /\1 1 /p" < "$zonefile.signed" > "$zonefile.signed.rsamd5"
++
++# Now add normal KSK and ZSK to the zone file
++ksk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK "$zone")
++zsk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
++cat "$infile" "$ksk.key" "$zsk.key" > "$zonefile"
++
++# Mangle the DNSKEY algorithm numbers and add them to the signed zone file
++cat "$ksk.key" "$zsk.key" | sed -e "s/\(IN[[:space:]]*DNSKEY[[:space:]]*[0-9]* 3\) $DEFAULT_ALGORITHM_NUMBER /\1 1 /" >> "$zonefile"
++
++# Sign normally
++"$SIGNER" -g -o "$zone" "$zonefile" >/dev/null 2>&1
++
++# Add the mangled signatures to signed zone file
++cat "$zonefile.signed.rsamd5" >> "$zonefile.signed"
++rm "$zonefile.signed.rsamd5"
+diff --git a/bin/tests/system/dnssec/ns3/template.db.in b/bin/tests/system/dnssec/ns3/template.db.in
+new file mode 100644
+index 0000000000..f603e448ff
+--- /dev/null
++++ b/bin/tests/system/dnssec/ns3/template.db.in
+@@ -0,0 +1,27 @@
++; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
++;
++; SPDX-License-Identifier: MPL-2.0
++;
++; This Source Code Form is subject to the terms of the Mozilla Public
++; License, v. 2.0.  If a copy of the MPL was not distributed with this
++; file, you can obtain one at https://mozilla.org/MPL/2.0/.
++;
++; See the COPYRIGHT file distributed with this work for additional
++; information regarding copyright ownership.
++
++$TTL 300	; 5 minutes
++@			IN SOA	mname1. . (
++				2000042407 ; serial
++				20         ; refresh (20 seconds)
++				20         ; retry (20 seconds)
++				1814400    ; expire (3 weeks)
++				3600       ; minimum (1 hour)
++				)
++			NS	ns3
++ns3			A	10.53.0.3
++
++a			A	10.0.0.1
++a.b			A	10.0.0.1
++b			A	10.0.0.2
++d			A	10.0.0.4
++z			A	10.0.0.26
+diff --git a/bin/tests/system/dnssec/tests.sh b/bin/tests/system/dnssec/tests.sh
+index b58b11a5c7..d3690eee6b 100644
+--- a/bin/tests/system/dnssec/tests.sh
++++ b/bin/tests/system/dnssec/tests.sh
+@@ -4497,5 +4497,16 @@ n=$((n + 1))
+ if [ "$ret" -ne 0 ]; then echo_i "failed"; fi
+ status=$((status + ret))
+ 
++echo_i "checking extra-bad-algorithm positive validation ($n)"
++ret=0
++dig_with_opts +noauth a.extrabadkey.example. @10.53.0.3 A >dig.out.ns3.test$n || ret=1
++dig_with_opts +noauth a.extrabadkey.example. @10.53.0.4 A >dig.out.ns4.test$n || ret=1
++digcomp --lc dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
++grep "status: NOERROR" dig.out.ns4.test$n >/dev/null || ret=1
++grep "flags:.*ad.*QUERY" dig.out.ns4.test$n >/dev/null || ret=1
++n=$((n + 1))
++test "$ret" -eq 0 || echo_i "failed"
++status=$((status + ret))
++
+ echo_i "exit status: $status"
+ [ $status -eq 0 ] || exit 1
+diff --git a/bin/tests/system/dnssec/tests_sh_dnssec.py b/bin/tests/system/dnssec/tests_sh_dnssec.py
+index 529a4a0e10..f731ea2ab4 100644
+--- a/bin/tests/system/dnssec/tests_sh_dnssec.py
++++ b/bin/tests/system/dnssec/tests_sh_dnssec.py
+@@ -92,6 +92,7 @@ pytestmark = pytest.mark.extra_artifacts(
+         "ns3/example.bk",
+         "ns3/expired.example.db",
+         "ns3/expiring.example.db",
++        "ns3/extrabadkey.example.db",
+         "ns3/future.example.db",
+         "ns3/keyless.example.db",
+         "ns3/kskonly.example.db",
+-- 
+2.51.1
+

bind-9.20-CVE-2025-8677-dual-signing.patch

@@ -0,0 +1,36 @@
+From 5126c74ec19f56294cbfdc312f75778d8f249e59 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
+Date: Mon, 3 Nov 2025 22:03:54 +0100
+Subject: [PATCH] Do not abort key search on unsupported algorithm
+
+When supported and unsupported algorithm rrsig is present, some keys may
+return unsupported algorithm error. Continue to next key without
+counting this to validation failures.
+
+(cherry picked from commit 38ddff3336e08983a4c0b5f3ea4eb35bb0f6ac81)
+---
+ lib/dns/validator.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/lib/dns/validator.c b/lib/dns/validator.c
+index 15e177e4d7..a9db844c27 100644
+--- a/lib/dns/validator.c
++++ b/lib/dns/validator.c
+@@ -1163,7 +1163,13 @@ select_signing_key(dns_validator_t *val, dns_rdataset_t *rdataset) {
+ 				goto done;
+ 			}
+ 			dst_key_free(&val->key);
+-		} else {
++		} else if (result != DST_R_UNSUPPORTEDALG) {
++			/* Unsupported alg happens when RRset is signed by both
++			 * supported and unsupported alg. */
++			validator_log(val, ISC_LOG_DEBUG(3),
++				      "select_signing_key alg %d keyid %d: %s",
++				      siginfo->algorithm, siginfo->keyid,
++				      isc_result_totext(result));
+ 			break;
+ 		}
+ 		dns_rdata_reset(&rdata);
+-- 
+2.51.1
+

bind-9.20-nsupdate-tls.patch

@@ -1,7 +1,7 @@
-From ec00ba4b215963af5e05892cf2ce1a62222ede46 Mon Sep 17 00:00:00 2001
+From 5536f80f32ad22160ab98acf31e49768d3cf76fc Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Mon, 11 Nov 2024 18:09:07 +0100
-Subject: [PATCH 1/3] Backport nsupdate TLS support into 9.18
+Subject: [PATCH] Backport nsupdate TLS support into 9.18
 
 Attempt to support TLS from nsupdate even in 9.18 release.
 
@@ -40,9 +40,11 @@ implementation as a model for the newly added features.
 
 [pemensik] Adapted to previous 9.18 changes.
 Add usage and command line parsing
+
+Adapted to 9.18.32
 ---
  bin/nsupdate/nsupdate.c         | 192 ++++++++++++++++++++----
- lib/dns/dispatch.c              | 107 ++++++++++++--
+ lib/dns/dispatch.c              | 113 ++++++++++++--
  lib/dns/include/dns/dispatch.h  |  22 +++
  lib/dns/include/dns/request.h   |  23 +++
  lib/dns/include/dns/transport.h |  45 +++++-
@@ -50,10 +52,10 @@ Add usage and command line parsing
  lib/dns/request.c               |  63 ++++++--
  lib/dns/transport.c             | 253 ++++++++++++++++++++++++++++++++
  lib/dns/xfrin.c                 | 232 +----------------------------
- 9 files changed, 649 insertions(+), 290 deletions(-)
+ 9 files changed, 652 insertions(+), 293 deletions(-)
 
 diff --git a/bin/nsupdate/nsupdate.c b/bin/nsupdate/nsupdate.c
-index 45ba90fba7b..93c7ea6cb17 100644
+index 293ed28..819925e 100644
 --- a/bin/nsupdate/nsupdate.c
 +++ b/bin/nsupdate/nsupdate.c
 @@ -45,6 +45,7 @@
@@ -449,7 +451,7 @@ index 45ba90fba7b..93c7ea6cb17 100644
  	if (answer != NULL) {
  		dns_message_detach(&answer);
 diff --git a/lib/dns/dispatch.c b/lib/dns/dispatch.c
-index d737363fea4..44a2896cb03 100644
+index eb37198..9b263db 100644
 --- a/lib/dns/dispatch.c
 +++ b/lib/dns/dispatch.c
 @@ -30,6 +30,7 @@
@@ -497,7 +499,7 @@ index d737363fea4..44a2896cb03 100644
  	dns_dispatchstate_t state;
  	isc_refcount_t references;
  
-@@ -220,13 +227,27 @@ udp_dispatch_getnext(dns_dispentry_t *resp, int32_t timeout);
+@@ -220,16 +227,30 @@ udp_dispatch_getnext(dns_dispentry_t *resp, int32_t timeout);
  
  static const char *
  socktype2str(dns_dispentry_t *resp) {
@@ -517,17 +519,23 @@ index d737363fea4..44a2896cb03 100644
 +
 +	switch (transport_type) {
 +	case DNS_TRANSPORT_UDP:
- 		return ("UDP");
+ 		return "UDP";
 -	case isc_socktype_tcp:
 +	case DNS_TRANSPORT_TCP:
- 		return ("TCP");
+ 		return "TCP";
+-	default:
+-		return "<unexpected>";
+-	}
 +	case DNS_TRANSPORT_TLS:
 +		return "TLS";
 +	case DNS_TRANSPORT_HTTP:
 +		return "HTTP";
- 	default:
- 		return ("<unexpected>");
- 	}
++ 	default:
++ 		return ("<unexpected>");
++ 	}
+ }
+ 
+ static const char *
 @@ -1161,6 +1182,15 @@ dispatch_allocate(dns_dispatchmgr_t *mgr, isc_socktype_t type,
  isc_result_t
  dns_dispatch_createtcp(dns_dispatchmgr_t *mgr, const isc_sockaddr_t *localaddr,
@@ -627,7 +635,7 @@ index d737363fea4..44a2896cb03 100644
  #if DNS_DISPATCH_TRACE
  	fprintf(stderr, "dns_dispentry__init:%s:%s:%d:%p->references = 1\n",
 @@ -1530,6 +1587,14 @@ dns_dispatch_add(dns_dispatch_t *disp, unsigned int options,
- 		return (ISC_R_NOMORE);
+ 		return ISC_R_NOMORE;
  	}
  
 +	if (transport != NULL) {
@@ -678,7 +686,7 @@ index d737363fea4..44a2896cb03 100644
  	LOCK(&disp->lock);
  	switch (disp->state) {
 diff --git a/lib/dns/include/dns/dispatch.h b/lib/dns/include/dns/dispatch.h
-index ad377f078ed..cfdc37481ce 100644
+index ad377f0..cfdc374 100644
 --- a/lib/dns/include/dns/dispatch.h
 +++ b/lib/dns/include/dns/dispatch.h
 @@ -56,6 +56,7 @@
@@ -739,7 +747,7 @@ index ad377f078ed..cfdc37481ce 100644
   * Add a response entry for this dispatch.
   *
 diff --git a/lib/dns/include/dns/request.h b/lib/dns/include/dns/request.h
-index d00574f9827..17bcbf68c3b 100644
+index d00574f..17bcbf6 100644
 --- a/lib/dns/include/dns/request.h
 +++ b/lib/dns/include/dns/request.h
 @@ -44,6 +44,7 @@
@@ -787,7 +795,7 @@ index d00574f9827..17bcbf68c3b 100644
   * \brief Create and send a request.
   *
 diff --git a/lib/dns/include/dns/transport.h b/lib/dns/include/dns/transport.h
-index e74ccd7f970..e6499a97e73 100644
+index e74ccd7..e6499a9 100644
 --- a/lib/dns/include/dns/transport.h
 +++ b/lib/dns/include/dns/transport.h
 @@ -13,7 +13,9 @@
@@ -874,7 +882,7 @@ index e74ccd7f970..e6499a97e73 100644
   * Requires:
   *\li	'transport' is valid.
 diff --git a/lib/dns/include/dns/types.h b/lib/dns/include/dns/types.h
-index 6465962bd41..f0aaa24e936 100644
+index 6465962..f0aaa24 100644
 --- a/lib/dns/include/dns/types.h
 +++ b/lib/dns/include/dns/types.h
 @@ -141,6 +141,8 @@ typedef struct dns_ssutable	     dns_ssutable_t;
@@ -887,7 +895,7 @@ index 6465962bd41..f0aaa24e936 100644
  typedef struct dns_tsec		     dns_tsec_t;
  typedef struct dns_tsig_keyring	     dns_tsig_keyring_t;
 diff --git a/lib/dns/request.c b/lib/dns/request.c
-index fb17ed2262e..463a7ca6d63 100644
+index 8aaa29f..badedab 100644
 --- a/lib/dns/request.c
 +++ b/lib/dns/request.c
 @@ -399,12 +399,12 @@ isblackholed(dns_dispatchmgr_t *dispatchmgr, const isc_sockaddr_t *destaddr) {
@@ -914,7 +922,7 @@ index fb17ed2262e..463a7ca6d63 100644
 -					destaddr, dispatchp);
 +	result = dns_dispatch_createtcp2(requestmgr->dispatchmgr, srcaddr,
 +					 destaddr, transport, 0, dispatchp);
- 	return (result);
+ 	return result;
  }
  
 @@ -452,12 +452,12 @@ udp_dispatch(dns_requestmgr_t *requestmgr, const isc_sockaddr_t *srcaddr,
@@ -1021,7 +1029,7 @@ index fb17ed2262e..463a7ca6d63 100644
  		goto detach;
  	}
 diff --git a/lib/dns/transport.c b/lib/dns/transport.c
-index ae1ab7415b1..59eba1db252 100644
+index 88a3df4..2a779ba 100644
 --- a/lib/dns/transport.c
 +++ b/lib/dns/transport.c
 @@ -15,9 +15,11 @@
@@ -1302,7 +1310,7 @@ index ae1ab7415b1..59eba1db252 100644
  transport_destroy(dns_transport_t *transport) {
  	isc_refcount_destroy(&transport->references);
 diff --git a/lib/dns/xfrin.c b/lib/dns/xfrin.c
-index 72b24e15ac3..73bd834070c 100644
+index 3a4f761..3695815 100644
 --- a/lib/dns/xfrin.c
 +++ b/lib/dns/xfrin.c
 @@ -962,234 +962,6 @@ xfrin_create(isc_mem_t *mctx, dns_zone_t *zone, dns_db_t *db, isc_nm_t *netmgr,
@@ -1516,7 +1524,7 @@ index 72b24e15ac3..73bd834070c 100644
 -		*pctx = found;
 -	}
 -
--	return (ISC_R_SUCCESS);
+-	return ISC_R_SUCCESS;
 -
 -failure:
 -	if (tlsctx != NULL) {
@@ -1534,7 +1542,7 @@ index 72b24e15ac3..73bd834070c 100644
 -		isc_tls_cert_store_free(&store);
 -	}
 -
--	return (result);
+-	return result;
 -}
 -
  static isc_result_t
@@ -1552,5 +1560,5 @@ index 72b24e15ac3..73bd834070c 100644
  			goto failure;
  		}
 -- 
-2.47.0
+2.47.1
 

bind-9.20-openssl-no-engine.patch

@@ -1,47 +0,0 @@
-From b487bd340ae1b635ce5cffe76f748ddc97f301f7 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
-Date: Sat, 3 Aug 2024 01:28:36 +0200
-Subject: [PATCH] Remove unused <openssl/{hmac,engine}.h> headers from OpenSSL
- shims
-
-The <openssl/{hmac,engine}.h> headers were unused and including the
-<openssl/engine.h> header might cause build failure when OpenSSL
-doesn't have Engines support enabled.
-
-See https://fedoraproject.org/wiki/Changes/OpensslDeprecateEngine
----
- lib/isc/openssl_shim.c | 2 --
- lib/isc/openssl_shim.h | 2 --
- 2 files changed, 4 deletions(-)
-
-diff --git a/lib/isc/openssl_shim.c b/lib/isc/openssl_shim.c
-index c39ba8c6827..02d0105eb9e 100644
---- a/lib/isc/openssl_shim.c
-+++ b/lib/isc/openssl_shim.c
-@@ -16,9 +16,7 @@
- #include <string.h>
- 
- #include <openssl/crypto.h>
--#include <openssl/engine.h>
- #include <openssl/evp.h>
--#include <openssl/hmac.h>
- #include <openssl/opensslv.h>
- #include <openssl/ssl.h>
- 
-diff --git a/lib/isc/openssl_shim.h b/lib/isc/openssl_shim.h
-index b2916e20a90..95b2f08e231 100644
---- a/lib/isc/openssl_shim.h
-+++ b/lib/isc/openssl_shim.h
-@@ -14,9 +14,7 @@
- #pragma once
- 
- #include <openssl/crypto.h>
--#include <openssl/engine.h>
- #include <openssl/evp.h>
--#include <openssl/hmac.h>
- #include <openssl/opensslv.h>
- #include <openssl/ssl.h>
- 
--- 
-2.46.2
-

bind-9.5-PIE.patch

@@ -1,17 +1,28 @@
+From 13348a5fc64387bf53ef450688e181100d0ceddb Mon Sep 17 00:00:00 2001
+From: Petr Mensik <pemensik@redhat.com>
+Date: Thu, 12 Dec 2024 15:56:13 +0100
+Subject: [PATCH] Harden named service build flags
+
+---
+ bin/named/Makefile.am | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
 diff --git a/bin/named/Makefile.am b/bin/named/Makefile.am
-index 57a023b..085f2f7 100644
+index 57a023b..b832e9c 100644
 --- a/bin/named/Makefile.am
 +++ b/bin/named/Makefile.am
-@@ -32,9 +32,12 @@ AM_CPPFLAGS +=				\
- endif HAVE_LIBXML2
+@@ -33,7 +33,10 @@ endif HAVE_LIBXML2
  
  AM_CPPFLAGS +=						\
-+	-fpie                                           \
  	-DNAMED_LOCALSTATEDIR=\"${localstatedir}\"	\
- 	-DNAMED_SYSCONFDIR=\"${sysconfdir}\"
- 
-+AM_LDFLAGS += -pie -Wl,-z,relro,-z,now,-z,nodlopen,-z,noexecstack
+-	-DNAMED_SYSCONFDIR=\"${sysconfdir}\"
++	-DNAMED_SYSCONFDIR=\"${sysconfdir}\"		\
++	-fpie
 +
++AM_LDFLAGS  += -pie -Wl,-z,relro,-z,now,-z,nodlopen,-z,noexecstack
+ 
  sbin_PROGRAMS = named
  
- nodist_named_SOURCES = xsl.c
+-- 
+2.47.1
+

bind.spec

@@ -8,12 +8,10 @@
 %bcond_with    SYSTEMTEST
 %bcond_without GSSTSIG
 %bcond_without JSON
-%if ! 0%{?rhel}
-# FIXME: Not ready. Should it be worked on?
-%bcond_without DLZ
-%endif
 # New MaxMind GeoLite support
 %bcond_without GEOIP2
+# Jemalloc linked together
+%bcond_with    JEMALLOC
 # Disabled temporarily until kyua is fixed on rawhide, bug #1926779
 %bcond_without UNITTEST
 # Do not set CI environment, include more unit tests, even less stable
@@ -24,11 +22,9 @@
 # Because of issues with PDF rebuild, include only HTML pages
 # Current error: unable top find isc-logo.pdf
 %if 0%{?fedora}
-# xindy fails on s390x now. Not sure why.
-%ifnarch s390x
 # RHEL and ELN do not have all required packages
-%bcond_without DOCPDF
-%endif
+# xindy fails on s390x now. Not sure why. rhbz#2332076
+%bcond_with    DOCPDF
 %endif
 %bcond_with    TSAN
 # Add experimental extra verbose logging of query processing
@@ -38,8 +34,6 @@
   %bcond_without OPENSSL_ENGINE
 %endif
 
-%{?!bind_uid:  %global bind_uid  25}
-%{?!bind_gid:  %global bind_gid  25}
 %{!?_pkgdocdir:%global _pkgdocdir %{_docdir}/%{name}-%{version}}
 %global        bind_dir          /var/named
 %global        chroot_prefix     %{bind_dir}/chroot
@@ -89,8 +83,8 @@ License:  MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause
 #
 # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it.
 # Updating just bind will cause freeipa-dns-server package to be uninstallable.
-Version:  9.18.31
-Release:  3%{?dist}
+Version:  9.18.41
+Release:  2%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -120,6 +114,7 @@ Source44: named-chroot-setup.service
 Source46: named-setup-rndc.service
 Source48: setup-named-softhsm.sh
 Source49: named-chroot.files
+Source50: named.sysusers
 
 # Common patches
 # FIXME: Is this still required?
@@ -127,10 +122,6 @@ Patch10: bind-9.5-PIE.patch
 Patch16: bind-9.16-redhat_doc.patch
 # https://bugzilla.redhat.com/show_bug.cgi?id=2122010
 Patch26: bind-9.18-unittest-netmgr-unstable.patch
-# https://fedoraproject.org/wiki/Changes/OpensslDeprecateEngine
-# Correct support for building without openssl/engine.h header
-# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/9593
-Patch27: bind-9.20-openssl-no-engine.patch
 # Downstream backport from 9.20
 # https://issues.redhat.com/browse/FREEIPA-11706
 # https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/6751
@@ -140,10 +131,20 @@ Patch28: bind-9.20-nsupdate-tls.patch
 Patch29: bind-9.20-nsupdate-tls-doc.patch
 # Test suport for patch28 nsupdate
 Patch30: bind-9.20-nsupdate-tls-test.patch
+# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/10611
+Patch32: bind-9.18-partial-additional-records.patch
+# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/9723
+# downstream only
+Patch33: bind-9.18-dig-idn-input-always.patch
+# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/11194
+Patch35: bind-9.20-CVE-2025-8677-dual-signing.patch
+# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/11195
+Patch36: bind-9.20-CVE-2025-8677-dual-signing-test.patch
 
 %{?systemd_ordering}
+# https://fedoraproject.org/wiki/Changes/RPMSuportForSystemdSysusers
+%{?sysusers_requires_compat}
 Requires:       coreutils
-Requires(pre):  shadow-utils
 Requires(post): shadow-utils
 Requires(post): glibc-common
 Requires(post): grep
@@ -162,16 +163,13 @@ BuildRequires:  systemd-rpm-macros
 BuildRequires:  selinux-policy
 BuildRequires:  findutils sed
 BuildRequires:  libnghttp2-devel
-%if 0%{?fedora}
+%if %{with JEMALLOC} && 0%{?fedora}
 BuildRequires:  jemalloc-devel
+%endif
+%if 0%{?fedora}
 BuildRequires:  gnupg2
 %endif
 BuildRequires:  libuv-devel
-%if %{with DLZ}
-BuildRequires:  openldap-devel
-BuildRequires:  sqlite-devel
-BuildRequires:  mariadb-connector-c-devel
-%endif
 %if %{with UNITTEST}
 # make unit dependencies
 BuildRequires:  libcmocka-devel
@@ -214,6 +212,12 @@ BuildRequires:  python3-sphinx-latex latexmk texlive-xetex texlive-xindy
 BuildRequires: libtsan
 %endif
 
+# https://fedoraproject.org/wiki/Changes/RPMSuportForSystemdSysusers
+# since we don't follow the guidelines on how users and groups should
+# be created we must explicitly specify these provides
+Provides: user(named)
+Provides: group(named)
+
 %description
 BIND (Berkeley Internet Name Domain) is an implementation of the DNS
 (Domain Name System) protocols. BIND includes a DNS server (named),
@@ -312,40 +316,6 @@ This package contains a tree of files which can be used as a
 chroot(2) jail for the named(8) program from the BIND package.
 Based on the code from Jan "Yenya" Kasprzak <kas@fi.muni.cz>
 
-
-%if %{with DLZ}
-%package dlz-filesystem
-Summary: BIND server filesystem DLZ module
-Requires: %{name}%{?_isa} = %{epoch}:%{version}-%{release}
-
-%description dlz-filesystem
-Dynamic Loadable Zones filesystem module for BIND server.
-
-%package dlz-ldap
-Summary: BIND server ldap DLZ module
-Requires: %{name}%{?_isa} = %{epoch}:%{version}-%{release}
-
-%description dlz-ldap
-Dynamic Loadable Zones LDAP module for BIND server.
-
-%package dlz-mysql
-Summary: BIND server mysql and mysqldyn DLZ modules
-Requires: %{name}%{?_isa} = %{epoch}:%{version}-%{release}
-Provides: %{name}-dlz-mysqldyn = %{epoch}:%{version}-%{release}
-Obsoletes: %{name}-dlz-mysqldyn < 32:9.16.6-3
-
-%description dlz-mysql
-Dynamic Loadable Zones MySQL module for BIND server.
-Contains also mysqldyn module with dynamic DNS updates (DDNS) support.
-
-%package dlz-sqlite3
-Summary: BIND server sqlite3 DLZ module
-Requires: %{name}%{?_isa} = %{epoch}:%{version}-%{release}
-
-%description dlz-sqlite3
-Dynamic Loadable Zones sqlite3 module for BIND server.
-%endif
-
 %if %{with DOC}
 %package doc
 Summary:   BIND 9 Administrator Reference Manual
@@ -418,12 +388,6 @@ autoreconf --force --install
 
 mkdir build
 
-%if %{with DLZ}
-# DLZ modules do not support oot builds. Copy files into build
-mkdir -p build/contrib/dlz
-cp -frp contrib/dlz/modules build/contrib/dlz/modules
-%endif
-
 pushd build
 LIBDIR_SUFFIX=
 export LIBDIR_SUFFIX
@@ -453,6 +417,9 @@ export LIBDIR_SUFFIX
 %endif
 %if %{with UNITTEST}
   --with-cmocka \
+%endif
+%if %{without JEMALLOC}
+  --without-jemalloc \
 %endif
   --enable-fixed-rrset \
   --enable-full-report \
@@ -479,13 +446,6 @@ fmtutil-user --missing || :
   make doc
 %endif
 
-%if %{with DLZ}
-  pushd contrib/dlz/modules
-  for DIR in filesystem ldap mysql mysqldyn sqlite3; do
-    make -C $DIR CFLAGS="-fPIC -I../include $CFLAGS $LDFLAGS -DPTHREADS=1" LDFLAGS="$LDFLAGS"
-  done
-  popd
-%endif
 popd # build
 
 %unit_prepare_build build
@@ -594,6 +554,9 @@ install -m 644 %{SOURCE38} ${RPM_BUILD_ROOT}%{_unitdir}
 install -m 644 %{SOURCE44} ${RPM_BUILD_ROOT}%{_unitdir}
 install -m 644 %{SOURCE46} ${RPM_BUILD_ROOT}%{_unitdir}
 
+mkdir -p ${RPM_BUILD_ROOT}%{_sysusersdir}
+install -m 644 %{SOURCE50} ${RPM_BUILD_ROOT}%{_sysusersdir}/named.conf
+
 mkdir -p ${RPM_BUILD_ROOT}%{_libexecdir}
 install -m 755 %{SOURCE41} ${RPM_BUILD_ROOT}%{_libexecdir}/setup-named-chroot.sh
 install -m 755 %{SOURCE42} ${RPM_BUILD_ROOT}%{_libexecdir}/generate-rndc-key.sh
@@ -610,23 +573,6 @@ install -m 644 %{SOURCE49} ${RPM_BUILD_ROOT}%{_sysconfdir}/named-chroot.files
 ln -s ../bin/{named-checkconf,named-checkzone,named-compilezone} %{buildroot}%{_sbindir}/
 %endif
 
-%if %{with DLZ}
-  pushd build
-  pushd contrib/dlz/modules
-  for DIR in filesystem ldap mysql mysqldyn sqlite3; do
-    %make_install -C $DIR libdir=%{_libdir}/bind
-  done
-  pushd ${RPM_BUILD_ROOT}/%{_libdir}/named
-    cp -s ../bind/dlz_*.so .
-  popd
-  mkdir -p doc/{mysql,mysqldyn}
-  cp -p mysqldyn/testing/README doc/mysqldyn/README.testing
-  cp -p mysqldyn/testing/* doc/mysqldyn
-  cp -p mysql/testing/* doc/mysql
-  popd
-  popd
-%endif
-
 # Remove libtool .la files:
 find ${RPM_BUILD_ROOT}/%{_libdir} -name '*.la' -exec '/bin/rm' '-f' '{}' ';';
 
@@ -706,8 +652,7 @@ install -m 644 %{SOURCE43} ${RPM_BUILD_ROOT}%{_sysconfdir}/rwtab.d/named
 
 %pre
 if [ "$1" -eq 1 ]; then
-  /usr/sbin/groupadd -g %{bind_gid} -f -r named >/dev/null 2>&1 || :;
-  /usr/sbin/useradd  -u %{bind_uid} -r -N -M -g named -s /sbin/nologin -d /var/named -c Named named >/dev/null 2>&1 || :;
+  %sysusers_create_compat %{SOURCE50}
 fi;
 :;
 
@@ -806,6 +751,7 @@ fi;
 %{_sysconfdir}/rwtab.d/named
 %{_unitdir}/named.service
 %{_unitdir}/named-setup-rndc.service
+%{_sysusersdir}/named.conf
 %{_bindir}/named-journalprint
 %{_bindir}/named-checkconf
 %{_bindir}/named-rrchecker
@@ -827,7 +773,7 @@ fi;
 %{_mandir}/man8/rndc-confgen.8*
 %{_mandir}/man1/named-journalprint.1*
 %{_mandir}/man8/filter-*.8.gz
-%doc CHANGES README.md named.conf.default
+%doc README.md named.conf.default
 %doc sample/
 
 # Hide configuration
@@ -962,26 +908,6 @@ fi;
 %dir %{chroot_prefix}/run/named
 %{chroot_prefix}%{_localstatedir}/run
 
-%if %{with DLZ}
-%files dlz-filesystem
-%{_libdir}/{named,bind}/dlz_filesystem_dynamic.so
-
-%files dlz-mysql
-%{_libdir}/{named,bind}/dlz_mysql_dynamic.so
-%doc build/contrib/dlz/modules/doc/mysql
-%{_libdir}/{named,bind}/dlz_mysqldyn_mod.so
-%doc build/contrib/dlz/modules/doc/mysqldyn
-
-%files dlz-ldap
-%{_libdir}/{named,bind}/dlz_ldap_dynamic.so
-%doc contrib/dlz/modules/ldap/testing/*
-
-%files dlz-sqlite3
-%{_libdir}/{named,bind}/dlz_sqlite3_dynamic.so
-%doc contrib/dlz/modules/sqlite3/testing/*
-
-%endif
-
 %if %{with DOC}
 %files doc
 %dir %{_pkgdocdir}
@@ -994,8 +920,51 @@ fi;
 %endif
 
 %changelog
+* Fri Oct 31 2025 Petr Menšík <pemensik@redhat.com> - 32:9.18.41-2
+- Fix upstream reported regression in recent CVE fix (CVE-2025-8677)
+- Add upstream dnssec system test testcase for this problem
+
+* Fri Oct 24 2025 Petr Menšík <pemensik@redhat.com> - 32:9.18.41-1
+- Update to 9.18.41 (rhbz#2405786, CVE-2025-8677 CVE-2025-40778 CVE-2025-40780)
+
+* Wed Sep 10 2025 Petr Menšík <pemensik@redhat.com> - 32:9.18.39-3.1
+- Rebuild with bind-dyndb-ldap side tag again
+
+* Wed Sep 03 2025 Petr Menšík <pemensik@redhat.com> - 32:9.18.39-3
+- Decode IDN names on input in all situations in utilities (rhbz#2324186)
+
+* Mon Sep 01 2025 Petr Menšík <pemensik@redhat.com> - 32:9.18.39-2
+- Offer up to 13 additional servers records if there are more servers
+
+* Thu Aug 21 2025 Petr Menšík <pemensik@redhat.com> - 32:9.18.39-1
+- Update to 9.18.39 (rhbz#2389765)
+
+* Wed Jul 30 2025 Petr Mensik <pemensik@redhat.com> - 32:9.18.38-1
+- Update to 9.18.38 (rhbz#2367771)
+
+* Tue Jun 10 2025 Petr Mensik <pemensik@redhat.com> - 32:9.18.33-3
+- Prevent name.c:670 attributes assertion failed
+- Add extra checks for relative names
+
+* Mon Feb 10 2025 Petr Menšík <pemensik@redhat.com> - 32:9.18.33-2
+- Permanently remove DLZ parts build
+- Deactivate jemalloc default linking
+
+* Sun Feb 02 2025 Petr Menšík <pemensik@redhat.com> - 32:9.18.33-1
+- Update to 9.16.33 (rhbz#2342784)
+
+* Fri Jan 17 2025 Petr Menšík <pemensik@redhat.com> - 32:9.18.32-4
+- Add sysusers named user creation (rhbz#2105415)
+
+* Thu Dec 12 2024 Petr Menšík <pemensik@redhat.com> - 32:9.18.32-1
+- Update to 9.18.32 (#2331675)
+- Remove CHANGES file from package
+- Disable DLZ plugins, they are not shipped with bind anymore
+
+- Add new root key 38696 into package files too
+
 * Thu Dec 12 2024 Petr Menšík <pemensik@redhat.com> - 32:9.18.31-3
-- Disable temporarily PDF generation on s390x
+- Disable temporarily PDF generation on all platforms
 
 * Wed Dec 04 2024 Petr Menšík <pemensik@redhat.com> - 32:9.18.31-2
 - Add nsupdate TLS support (FREEIPA-11706)

named.logrotate

@@ -2,11 +2,9 @@
     missingok
     su named named
     create 0644 named named
+    notifempty
     postrotate
         /usr/bin/systemctl reload named.service > /dev/null 2>&1 || true
         /usr/bin/systemctl reload named-chroot.service > /dev/null 2>&1 || true
-        /usr/bin/systemctl reload named-sdb.service > /dev/null 2>&1 || true
-        /usr/bin/systemctl reload named-sdb-chroot.service > /dev/null 2>&1 || true
-        /usr/bin/systemctl reload named-pkcs11.service > /dev/null 2>&1 || true
     endscript
 }

named.root.key

@@ -10,4 +10,9 @@ trust-anchors {
         # managed key database will be trusted and maintained
         # automatically.
         . initial-ds 20326 8 2 "E06D44B80B8F1D39A95C0B0D7C65D08458E880409BBC683457104237C7F8EC8D";
+        # This key (38696) will be pre-published in the root zone in 2025
+        # and is scheduled to begin signing in late 2026. At that time,
+        # servers which were already using the old key (20326) should roll
+        # seamlessly to this new one via RFC 5011 rollover.
+        . initial-ds 38696 8 2 "683D2D0ACB8C9B712A1948B27F741219298D0A450D612C483AF444A4C0FB2B16";
 };

named.sysusers

@@ -0,0 +1,3 @@
+#Type Name       ID                  GECOS              Home directory Shell
+u     named      25                 "Named"             /var/named     /sbin/nologin
+g     named      25

plans/all.fmf

@@ -3,7 +3,7 @@ environment+:
     PACKAGE: bind
 discover:
     how: fmf
-    url: https://src.fedoraproject.org/tests/bind.git
+    url: https://gitlab.com/redhat/centos-stream/tests/bind.git
 execute:
     how: tmt
 context:

plans/tier1-public.fmf

@@ -3,7 +3,7 @@ environment+:
     PACKAGE: bind
 discover:
     how: fmf
-    url: https://src.fedoraproject.org/tests/bind.git
+    url: https://gitlab.com/redhat/centos-stream/tests/bind.git
     filter: 'tier: 1'
 execute:
     how: tmt

sources

@@ -1,2 +1,2 @@
-SHA512 (bind-9.18.31.tar.xz) = e51873484be3ee367eb1e601b8e0adc45abcdb16df04021ea42ffcc51b99821f8b30f67b2a693a90ad3efa51698a651c8da9d7947ee8fa19680f627afe1f7034
-SHA512 (bind-9.18.31.tar.xz.asc) = 2c17d9a9f153264ed18b287e081b432b5310746964be3e35dfd31597622182e822e62fc3cc4034c0e1c7041949e624c43ffb10d134145d6300f8135f86e38cc6
+SHA512 (bind-9.18.41.tar.xz) = aba4a0add07f1feb2825852faeed14bc946628b818adac93401890cd67ead17c2fd8d820bca70ba7f8c2788dc65195baccc93f87249fb7e47077354341ff0839
+SHA512 (bind-9.18.41.tar.xz.asc) = 5b5a2f969e6da6a64908dba7f94f9877ce2d729e59c3b9c23fa3459cc74059b10479df63b3223c738b4fbfecde5e51dd9906fb34e6763c0b5909dda195afb71b

trusted-key.key

@@ -1 +1,2 @@
 . 3600 IN DNSKEY 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU=
+. 3600 IN DNSKEY 257 3 8 AwEAAa96jeuknZlaeSrvyAJj6ZHv28hhOKkx3rLGXVaC6rXTsDc449/cidltpkyGwCJNnOAlFNKF2jBosZBU5eeHspaQWOmOElZsjICMQMC3aeHbGiShvZsx4wMYSjH8e7Vrhbu6irwCzVBApESjbUdpWWmEnhathWu1jo+siFUiRAAxm9qyJNg/wOZqqzL/dL/q8PkcRU5oUKEpUge71M3ej2/7CPqpdVwuMoTvoB+ZOT4YeGyxMvHmbrxlFzGOHOijtzN+u1TQNatX2XBuzZNQ1K+s2CXkPIZo7s6JgZyvaBevYtxPvYLw4z9mR7K2vaF18UYH9Z9GNUUeayffKC73PYc=