From cfcac9d28df58fab5024433ce9eea1db02dec7bd Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 25 Mar 2026 19:36:24 +0100
Subject: [PATCH] Update to 9.21.20 (rhbz#2440560)

Security Fixes:

- Fix unbounded NSEC3 iterations when validating referrals to unsigned delegations. (CVE-2026-1519)
- Fix memory leaks in code preparing DNSSEC proofs of non-existence. (CVE-2026-3104)
- Prevent a crash in code processing queries containing a TKEY record. (CVE-2026-3119)
- Fix a stack use-after-return flaw in SIG(0) handling code. (CVE-2026-3591)

New Features:

- Provide response round-trip time (RTT) counters via statistics channel.
- Introduce max-delegation-servers configuration option.

Bug Fixes:

- Fix parsing key inactivation time in KASP code.
- Fix the handling of key statements defined inside views.

Source: https://downloads.isc.org/isc/bind9/9.21.20/doc/arm/html/notes.html#notes-for-bind-9-21-20
---
 bind9-next.spec | 4 +++-
 sources         | 4 ++--
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/bind9-next.spec b/bind9-next.spec
index 39018bf..91c1a56 100644
--- a/bind9-next.spec
+++ b/bind9-next.spec
@@ -32,6 +32,8 @@
 %global        chroot_create_directories /dev /run/named %{_localstatedir}/{log,named,tmp} \\\
                                          %{_sysconfdir}/{crypto-policies/back-ends,pki/dnssec-keys,pki/tls,named} \\\
                                          %{_libdir}/bind %{_libdir}/named %{_datadir}/{GeoIP,dns-root-data} /proc/sys/net/ipv4
+%global        upstream_sources 0 2
+%global        pgp_signed_sources 2
 
 %global forgeurl0 https://gitlab.isc.org/isc-projects/bind9
 
@@ -53,7 +55,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind9-next
 License:  MPL-2.0 AND ISC AND BSD-3-clause AND MIT AND BSD-2-clause
 #
-Version:  9.21.17
+Version:  9.21.20
 Release:  %autorelease
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
diff --git a/sources b/sources
index 5eede3e..fa2afc0 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.21.17.tar.xz) = b53fcea8db7d1b4e8fba7055f175289a7d1e3380be77e0899986101ffc3ff9222be5bf249b8f0162b0c88b0b463f42b778fa11f3ed86f913e17cd62561c65063
-SHA512 (bind-9.21.17.tar.xz.asc) = 62e344ae5deae40c4f647f4b99bee56d63cc7be5dd882f24993771c537eb7817dd2a5d2b8f6396fd906df9ef11afb4c1f874f61bd25329f50f7ca952d508482c
+SHA512 (bind-9.21.20.tar.xz) = 4bd65612ff851720eba7f88495d51eb8a41b6a946c377b9dcd62f58f8c5a3e9338af44abc9df76b2ead9461eca4eb81f088619e3cc481f35fa0fc5d0926a93e3
+SHA512 (bind-9.21.20.tar.xz.asc) = 7431540d942fe23222b2812f9d80e67d0fa38516f9d536095a6544b156dc0306aba5752ba6c03cc2935d92a74860e70e8fc53b4cb481b8afe226e49dd51f695f