From 1f8fb8d255d8f3eaad837b2e30df3c91d7840a50 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 5 Jun 2025 20:06:32 +0200
Subject: [PATCH 01/22] Try limiting maximal tasks in unit tests

Limit also number of internal tasks to some smaller number.
---
 bind9-next.spec | 1 +
 1 file changed, 1 insertion(+)

diff --git a/bind9-next.spec b/bind9-next.spec
index f149a09..9648b66 100644
--- a/bind9-next.spec
+++ b/bind9-next.spec
@@ -443,6 +443,7 @@ export TSAN_OPTIONS="log_exe_name=true log_path=ThreadSanitizer exitcode=0"
   if [ "$CPUS" -gt 16 ]; then
     ORIGFILES=$(ulimit -n)
     THREADS=16
+    export ISC_TASK_WORKERS="$THREADS"
     ulimit -n 8092 || : # Requires on some machines with many cores
   fi
   echo "core.%%P" > /proc/sys/kernel/core_pattern || :

From d44dce14123d6d10fa755db5b6914d699b0bec5b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 5 Jun 2025 20:12:44 +0200
Subject: [PATCH 02/22] Revert "Skip qpdb_test on some builders"

This reverts commit 7fe8c161383f2bb386cd9894f9a5013c46e5ba88.

(cherry picked from commit 07899c889d96f45ee7c48670f54ce892c57e27b0)
---
 bind9-next.spec | 7 -------
 1 file changed, 7 deletions(-)

diff --git a/bind9-next.spec b/bind9-next.spec
index 9648b66..f715a34 100644
--- a/bind9-next.spec
+++ b/bind9-next.spec
@@ -360,13 +360,6 @@ configure.ac
 sed -e 's/-W\s//' -i Makefile.docs
 %endif
 
-%if %{with UNITTEST}
-if grep 'Intel(R) Xeon(R) CPU E5-2670 v3' /proc/cpuinfo; then
-  echo "Detected builder troubling unit tests, skiping some"
-  # https://gitlab.isc.org/isc-projects/bind9/-/issues/5328
-  sed -i -e 's/\sqpdb_test//' tests/dns/Makefile.am
-fi
-%endif
 autoreconf --force --install
 
 mkdir build

From 6286528f8094be4a8e472b60860fe0c7ea50be5b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 30 Jul 2025 14:42:06 +0200
Subject: [PATCH 03/22] Update to 9.21.10 (rhbz#2380940)

Security Fixes:

- Fix a possible assertion failure when stale-answer-client-timeout is set to 0.

New Features:

- Add code paths to fully support PRIVATEDNS and PRIVATEOID keys.
- Add named-makejournal tool.
- Add support for the CO flag to dig.

https://downloads.isc.org/isc/bind9/9.21.10/doc/arm/html/notes.html#notes-for-bind-9-21-10
---
 bind9-next.spec | 2 +-
 sources         | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/bind9-next.spec b/bind9-next.spec
index f715a34..ab06bc7 100644
--- a/bind9-next.spec
+++ b/bind9-next.spec
@@ -55,7 +55,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind9-next
 License:  MPL-2.0 AND ISC AND BSD-3-clause AND Expat AND BSD-2-clause
 #
-Version:  9.21.8
+Version:  9.21.10
 Release:  %autorelease
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
diff --git a/sources b/sources
index 06b6126..877f116 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.21.8.tar.xz) = 8fdba5fa9e8c4659119074b54477d22bfb7301f6244f8df8df9f4b45f0512374a071c0d0d3f0f8e06f668fa59aa8a56d269900b6f6431461a770f11e21443d19
-SHA512 (bind-9.21.8.tar.xz.asc) = c48d2e3607a4c346ff12be6da43a9103ab935058662a14bd20abe5193db8cdede38a52bc59a1ad45ff1264f72a6175c61266edab92df3a3771580fd20d0570fb
+SHA512 (bind-9.21.10.tar.xz) = fa814d43f0e7ec137617f0f2772ebd2e008a647d2158fa1a7765e38551506ee704cc1c6106d4c620b571d16d7cdecb40a8b03943aaeca29f984a3bf19c6205d2
+SHA512 (bind-9.21.10.tar.xz.asc) = 0f25cf6a74b3cc8df1b3c043e5aa2ad772001b2bf9aea0e3b48db2bc207b4508c2848bbe293d81b4cd82011284e5c73463a24ed489120dc9cfa59c4e7698120e

From 14089f422f7a323bcec647e971e83a272c58bdb7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 30 Jul 2025 16:39:27 +0200
Subject: [PATCH 04/22] Attempt to switch to meson build system

---
 bind9-next.spec | 83 ++++++++++++++++++++++++-------------------------
 1 file changed, 40 insertions(+), 43 deletions(-)

diff --git a/bind9-next.spec b/bind9-next.spec
index ab06bc7..d9f320f 100644
--- a/bind9-next.spec
+++ b/bind9-next.spec
@@ -108,12 +108,20 @@ Recommends:     %{name}-utils %{name}-dnssec-utils
 Obsoletes:      %{name}-pkcs11 < 32:9.18.4-2
 Conflicts:      bind-dyndb-ldap
 
-BuildRequires:  gcc, make
-BuildRequires:  openssl-devel, libtool, autoconf, pkgconfig, libcap-devel
-BuildRequires:  libidn2-devel, libxml2-devel
+BuildRequires:  gcc
+BuildRequires:  make
+BuildRequires:  openssl-devel
+BuildRequires:  libtool
+BuildRequires:  meson
+BuildRequires:  ninja-build
+BuildRequires:  pkgconfig
+BuildRequires:  libcap-devel
+BuildRequires:  libidn2-devel
+BuildRequires:  libxml2-devel
 BuildRequires:  systemd-rpm-macros
 BuildRequires:  selinux-policy
-BuildRequires:  findutils sed
+BuildRequires:  findutils
+BuildRequires:  sed
 BuildRequires:  libnghttp2-devel
 BuildRequires:  userspace-rcu-devel
 # Compress the changelog
@@ -328,8 +336,6 @@ EOF
 
 
 %build
-## We use out of tree configure/build for export libs
-%define _configure "../configure"
 
 # normal and pkcs11 unit tests
 %define unit_prepare_build() \
@@ -351,48 +357,45 @@ CPPFLAGS="$CPPFLAGS -DOPENSSL_NO_ENGINE=1"
 export CFLAGS CPPFLAGS
 export STD_CDEFINES="$CPPFLAGS"
 
-sed -i -e \
-'s/([bind_VERSION_EXTRA],\s*\([^)]*\))/([bind_VERSION_EXTRA], \1-RH)/' \
-configure.ac
+#sed -i -e \
+#'s/([bind_VERSION_EXTRA],\s*\([^)]*\))/([bind_VERSION_EXTRA], \1-RH)/' \
+#configure.ac
 
 %if 0%{?rhel} && 0%{?rhel} < 9
 # disable Sphinx warnings as errors, epel8 does not pass cleanly
 sed -e 's/-W\s//' -i Makefile.docs
 %endif
 
-autoreconf --force --install
 
-mkdir build
-
-pushd build
 LIBDIR_SUFFIX=
 export LIBDIR_SUFFIX
-%configure \
-  --with-pic \
-  --disable-static \
+
+%meson \
   --includedir=%{_includedir}/bind9 \
-  --with-libidn2 \
+  -Didn=enabled \
 %if %{with GEOIP2}
-  --with-maxminddb \
+  -Dgeoip=enabled \
 %endif
 %if %{with GSSTSIG}
-  --with-gssapi=yes \
+  -Dgssapi=enabled \
 %endif
 %if %{with LMDB}
-  --with-lmdb=yes \
+  -Dlmdb=enabled \
 %else
-  --with-lmdb=no \
+  -Dlmdb=disabled \
 %endif
 %if %{with JSON}
-  --with-json-c \
+  -Dstats-json=enabled \
 %endif
 %if %{with DNSTAP}
-  --enable-dnstap \
+  -Ddnstap=enabled \
 %endif
 %if %{with UNITTEST}
-  --with-cmocka \
+  -Dcmocka=enabled \
+%endif
+%if %{with DOC}
+  -Ddoc=enabled \
 %endif
-  --enable-full-report \
 ;
 %if %{with DNSTAP}
   pushd lib
@@ -401,19 +404,17 @@ export LIBDIR_SUFFIX
   popd
 %endif
 
-%make_build SPHINX_W=''
+%meson_build
 
 %if %{with DOC}
-  %make_build doc SPHINX_W=''
+  %meson_build man arm arm-epub
 %endif
 
-popd # build
-
 # Compress changelog by default
 gzip doc/changelog/changelog-*.rst
 
-%unit_prepare_build build
-%systemtest_prepare_build build
+#unit_prepare_build build
+#systemtest_prepare_build build
 
 %check
 %if %{with UNITTEST} || %{with SYSTEMTEST}
@@ -426,7 +427,6 @@ export TSAN_OPTIONS="log_exe_name=true log_path=ThreadSanitizer exitcode=0"
 %endif
 
 %if %{with UNITTEST}
-  pushd build
   CPUS=$(lscpu -p=cpu,core | grep -v '^#' | wc -l)
   THREADS="$CPUS"
   COREPATTERN="$(cat /proc/sys/kernel/core_pattern)"
@@ -441,7 +441,7 @@ export TSAN_OPTIONS="log_exe_name=true log_path=ThreadSanitizer exitcode=0"
   fi
   echo "core.%%P" > /proc/sys/kernel/core_pattern || :
   e=0
-  %make_build unit -j${THREADS} || e=$?
+  %meson_build unit -j${THREADS} || e=$?
   # Display details of failure
   cat tests/*/test-suite.log
 
@@ -460,7 +460,6 @@ export TSAN_OPTIONS="log_exe_name=true log_path=ThreadSanitizer exitcode=0"
     exit $e;
   fi;
   [ "$CPUS" -gt 16 ] && ulimit -n $ORIGFILES || :
-  popd
 ## End of UNITTEST
 %endif
 
@@ -468,7 +467,7 @@ export TSAN_OPTIONS="log_exe_name=true log_path=ThreadSanitizer exitcode=0"
 # Runs system test if ip addresses are already configured
 # or it is able to configure them
   SUDO=
-  pushd build/bin/tests/system/
+  pushd bin/tests/system/
   if perl ./testsock.pl
   then
     CONFIGURED=already
@@ -489,10 +488,10 @@ export TSAN_OPTIONS="log_exe_name=true log_path=ThreadSanitizer exitcode=0"
   if [ -n "$CONFIGURED" ]
   then
     set -e
-    pushd build/bin/tests
+    pushd bin/tests
     export CI_SYSTEM=yes # allow running tests as root
     chown -R ${USER} . # Can be unknown user
-    %make_build test 2>&1 | tee test.log
+    %meson_build test 2>&1 | tee test.log
     e=$?
     [ "$CONFIGURED" = build ] && $SUDO sh ./ifconfig.sh down
     popd
@@ -530,9 +529,7 @@ popd
 touch ${RPM_BUILD_ROOT}/%{chroot_prefix}%{_sysconfdir}/named.conf
 #end chroot
 
-pushd build
-%make_install
-popd
+%meson_install
 
 # Remove unwanted files
 rm -f ${RPM_BUILD_ROOT}/etc/bind.keys
@@ -579,8 +576,8 @@ popd
 
 %if %{with DOC}
 mkdir -p ${RPM_BUILD_ROOT}%{_pkgdocdir}
-cp -a build/doc/arm/_build/html ${RPM_BUILD_ROOT}%{_pkgdocdir}
-rm -rf ${RPM_BUILD_ROOT}%{_pkgdocdir}/html/.{buildinfo,doctrees}
+#cp -a doc/arm/_build/html ${RPM_BUILD_ROOT}%{_pkgdocdir}
+#rm -rf ${RPM_BUILD_ROOT}%{_pkgdocdir}/html/.{buildinfo,doctrees}
 # Backward compatible link to 9.11 documentation
 (cd ${RPM_BUILD_ROOT}%{_pkgdocdir} && ln -s html/index.html Bv9ARM.html)
 # Share static data from original sphinx package
@@ -593,7 +590,7 @@ do
     ln -sr "${RPM_BUILD_ROOT}${DIR}" "$BINDTHEMEDIR"
   fi
 done
-cp -p build/doc/arm/_build/epub/Bv9ARM.epub ${RPM_BUILD_ROOT}%{_pkgdocdir}
+#cp -p doc/arm/_build/epub/Bv9ARM.epub ${RPM_BUILD_ROOT}%{_pkgdocdir}
 %endif
 
 # Ghost config files:

From c6386b8f0810b3507e5247b695a973ab182eb95b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 31 Jul 2025 20:45:46 +0200
Subject: [PATCH 05/22] WIP: Pass meson build and test

Install phase not yet solved.
---
 bind9-next.spec | 23 ++++++++---------------
 1 file changed, 8 insertions(+), 15 deletions(-)

diff --git a/bind9-next.spec b/bind9-next.spec
index d9f320f..144f07a 100644
--- a/bind9-next.spec
+++ b/bind9-next.spec
@@ -122,8 +122,10 @@ BuildRequires:  systemd-rpm-macros
 BuildRequires:  selinux-policy
 BuildRequires:  findutils
 BuildRequires:  sed
+#BuildRequires:  systemtap
 BuildRequires:  libnghttp2-devel
 BuildRequires:  userspace-rcu-devel
+BuildRequires:  pkgconfig(libedit)
 # Compress the changelog
 BuildRequires:  gzip
 %if 0%{?fedora}
@@ -334,6 +336,9 @@ g named %{bind_gid}
 u named %{bind_uid} 'Named' /var/named -
 EOF
 
+# get rid of rpath issues
+sed -e '/install_rpath:/ d' -i meson.build
+
 
 %build
 
@@ -373,6 +378,7 @@ export LIBDIR_SUFFIX
 %meson \
   --includedir=%{_includedir}/bind9 \
   -Didn=enabled \
+  -Dtracing=disabled \
 %if %{with GEOIP2}
   -Dgeoip=enabled \
 %endif
@@ -439,24 +445,11 @@ export TSAN_OPTIONS="log_exe_name=true log_path=ThreadSanitizer exitcode=0"
     export ISC_TASK_WORKERS="$THREADS"
     ulimit -n 8092 || : # Requires on some machines with many cores
   fi
-  echo "core.%%P" > /proc/sys/kernel/core_pattern || :
   e=0
-  %meson_build unit -j${THREADS} || e=$?
-  # Display details of failure
-  cat tests/*/test-suite.log
+  %meson_test --num-processes ${THREADS} || e=$?
 
-  echo "$COREPATTERN" > /proc/sys/kernel/core_pattern || :
   if [ "$e" -ne 0 ]; then
-    echo "ERROR: this build of BIND failed 'make unit'. Aborting."
-    for CORE in $(find -name 'core.*'); do
-      echo "# Found core: $CORE"
-      gdb --batch -ex 'bt full' -c "$CORE"
-      echo
-      xz -k "$CORE"
-      echo "# core base64 begin: $CORE"
-      base64 "$CORE.xz"
-      echo "# core base64 end: $CORE"
-    done
+    echo "ERROR: test failed. Aborting."
     exit $e;
   fi;
   [ "$CPUS" -gt 16 ] && ulimit -n $ORIGFILES || :

From 64924425a39d103053747af0acdc20685a7e520c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 31 Jul 2025 21:13:20 +0200
Subject: [PATCH 06/22] Make versioned libraries

Devel package not yet solved.
---
 bind9-next.spec  |  2 ++
 meson-libs.patch | 62 ++++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 64 insertions(+)
 create mode 100644 meson-libs.patch

diff --git a/bind9-next.spec b/bind9-next.spec
index 144f07a..303c1ac 100644
--- a/bind9-next.spec
+++ b/bind9-next.spec
@@ -96,6 +96,8 @@ Patch3: bind-9.21-unittest-isc_rwlock-s390x.patch
 # https://gitlab.isc.org/isc-projects/bind9/-/issues/5328
 # avoid often fails on i386, unsupported upstream
 Patch4: bind-9.21-unittest-qpdb-i386.patch
+# Downstream patch to include version in libraries
+Patch5: meson-libs.patch
 
 %{?systemd_ordering}
 Requires:       coreutils
diff --git a/meson-libs.patch b/meson-libs.patch
new file mode 100644
index 0000000..4ba0723
--- /dev/null
+++ b/meson-libs.patch
@@ -0,0 +1,62 @@
+From 0e03b4c1c4fed5b149969b25df2bc6b45a089b79 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
+Date: Thu, 31 Jul 2025 20:54:08 +0200
+Subject: [PATCH] Add version to shared libraries
+
+Allow coexistence of different bind libraries and utilities by it.
+---
+ meson.build | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/meson.build b/meson.build
+index 432af24..dac4212 100644
+--- a/meson.build
++++ b/meson.build
+@@ -957,7 +957,7 @@ subdir('util')
+ isc_srcconf = isc_srcset.apply(config, strict: false)
+ 
+ libisc = library(
+-    'isc',
++    'isc-'+meson.project_version(),
+     isc_srcconf.sources(),
+     objects: isc_probe_objects,
+     install: true,
+@@ -984,7 +984,7 @@ libisc_dep = declare_dependency(
+ dns_srcconf = dns_srcset.apply(config, strict: false)
+ 
+ libdns = library(
+-    'dns',
++    'dns-'+meson.project_version(),
+     dns_srcconf.sources(),
+     include_directories: dns_inc,
+     install: true,
+@@ -1018,7 +1018,7 @@ libdns_dep = declare_dependency(
+ ns_srcconf = ns_srcset.apply(config, strict: false)
+ 
+ libns = library(
+-    'ns',
++    'ns-'+meson.project_version(),
+     ns_srcconf.sources(),
+     objects: ns_probe_objects,
+     install: true,
+@@ -1044,7 +1044,7 @@ libns_dep = declare_dependency(
+ isccc_srcconf = isccc_srcset.apply(config, strict: false)
+ 
+ libisccc = library(
+-    'isccc',
++    'isccc-'+meson.project_version(),
+     isccc_srcconf.sources(),
+     implicit_include_directories: false,
+     include_directories: isccc_inc,
+@@ -1065,7 +1065,7 @@ libisccc_dep = declare_dependency(
+ isccfg_srcconf = isccfg_srcset.apply(config, strict: false)
+ 
+ libisccfg = library(
+-    'isccfg',
++    'isccfg-'+meson.project_version(),
+     isccfg_srcconf.sources(),
+     implicit_include_directories: false,
+     include_directories: isccfg_inc,
+-- 
+2.50.1
+

From bb2bf86fc74a3c68c6cbd5062eb8599f2fc151b0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 5 Sep 2025 17:25:14 +0200
Subject: [PATCH 07/22] Use smarter action on lograte script

BIND 9.21 has rndc closelogs action, which just reopens logs and nothing
more. Use that from logrotate. Skip this action if the log is empty.
---
 named.logrotate | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/named.logrotate b/named.logrotate
index 5df448f..17f41d9 100644
--- a/named.logrotate
+++ b/named.logrotate
@@ -2,11 +2,8 @@
     missingok
     su named named
     create 0644 named named
+    notifempty
     postrotate
-        /usr/bin/systemctl reload named.service > /dev/null 2>&1 || true
-        /usr/bin/systemctl reload named-chroot.service > /dev/null 2>&1 || true
-        /usr/bin/systemctl reload named-sdb.service > /dev/null 2>&1 || true
-        /usr/bin/systemctl reload named-sdb-chroot.service > /dev/null 2>&1 || true
-        /usr/bin/systemctl reload named-pkcs11.service > /dev/null 2>&1 || true
+        /usr/bin/rndc closelogs > /dev/null 2>&1 || true
     endscript
 }

From bdaaec7389dc15a0adc551ae693f20fc30d91c40 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 5 Sep 2025 18:02:20 +0200
Subject: [PATCH 08/22] Disable devel package and fix doc building

---
 bind9-next.spec | 19 ++++++++++++++-----
 1 file changed, 14 insertions(+), 5 deletions(-)

diff --git a/bind9-next.spec b/bind9-next.spec
index 303c1ac..7d5b8d7 100644
--- a/bind9-next.spec
+++ b/bind9-next.spec
@@ -571,7 +571,8 @@ popd
 
 %if %{with DOC}
 mkdir -p ${RPM_BUILD_ROOT}%{_pkgdocdir}
-#cp -a doc/arm/_build/html ${RPM_BUILD_ROOT}%{_pkgdocdir}
+pushd %{_vpath_builddir}
+cp -a arm/ ${RPM_BUILD_ROOT}%{_pkgdocdir}/html/
 #rm -rf ${RPM_BUILD_ROOT}%{_pkgdocdir}/html/.{buildinfo,doctrees}
 # Backward compatible link to 9.11 documentation
 (cd ${RPM_BUILD_ROOT}%{_pkgdocdir} && ln -s html/index.html Bv9ARM.html)
@@ -585,7 +586,10 @@ do
     ln -sr "${RPM_BUILD_ROOT}${DIR}" "$BINDTHEMEDIR"
   fi
 done
-#cp -p doc/arm/_build/epub/Bv9ARM.epub ${RPM_BUILD_ROOT}%{_pkgdocdir}
+cp -p arm-epub/Bv9ARM.epub ${RPM_BUILD_ROOT}%{_pkgdocdir}
+popd
+cp -p doc/changelog/changelog-history.rst* doc/notes/notes-*.rst* \
+      ${RPM_BUILD_ROOT}%{_pkgdocdir}
 %endif
 
 # Ghost config files:
@@ -731,6 +735,7 @@ fi;
 %{_bindir}/named-journalprint
 %{_bindir}/named-checkconf
 %{_bindir}/named-rrchecker
+%{_bindir}/named-makejournal
 %{_bindir}/mdig
 %{_sbindir}/named
 %{_sbindir}/rndc*
@@ -748,7 +753,8 @@ fi;
 %{_mandir}/man1/named-checkconf.1*
 %{_mandir}/man8/rndc-confgen.8*
 %{_mandir}/man1/named-journalprint.1*
-%{_mandir}/man8/filter-*.8.gz
+#{_mandir}/man1/named-makejournal.1*
+%{_mandir}/man8/filter-*.8*
 %doc README.md named.conf.default
 %doc doc/changelog/changelog-9.*.rst*
 %doc sample/
@@ -830,6 +836,8 @@ fi;
 %{_bindir}/dnssec*
 %{_mandir}/man1/dnssec*.1*
 
+%if 0
+# TODO: remove devel subpackage or create custom installation part
 %files devel
 %{_libdir}/libisccc.so
 %{_libdir}/libns.so
@@ -844,6 +852,7 @@ fi;
 %{_includedir}/bind9/irs
 %{_includedir}/bind9/isc
 %{_includedir}/bind9/isccfg
+%endif
 
 %files chroot
 %config(noreplace) %{_sysconfdir}/named-chroot.files
@@ -890,8 +899,8 @@ fi;
 %doc %{_pkgdocdir}/html
 %doc %{_pkgdocdir}/Bv9ARM.html
 %doc %{_pkgdocdir}/Bv9ARM.epub
-%doc doc/changelog/changelog-history.rst*
-%doc doc/notes/notes-*.rst*
+%doc %{_pkgdocdir}/changelog-history.rst*
+%doc %{_pkgdocdir}/notes-*.rst*
 %endif
 
 %changelog

From 8352e0ab73100728018d6966f8d2a37e1dfeddf9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 5 Sep 2025 18:04:49 +0200
Subject: [PATCH 09/22] Update to 9.21.11

New Features:

- Support for parsing DSYNC records has been added.

Feature changes:

- Reword the shut down hung fetch while resolving message.
- Plugin extension in plugin path is now optional.
- Add deprecation warnings for RSASHA1, RSASHA1-NSEC3SHA1, and DS digest type 1.

And multiple bug fixes.

https://downloads.isc.org/isc/bind9/9.21.11/doc/arm/html/notes.html#notes-for-bind-9-21-11
---
 bind-9.21-unittest-qpdb-i386.patch | 24 +++++++++++-------------
 bind9-next.spec                    |  4 ++--
 sources                            |  4 ++--
 3 files changed, 15 insertions(+), 17 deletions(-)

diff --git a/bind-9.21-unittest-qpdb-i386.patch b/bind-9.21-unittest-qpdb-i386.patch
index 1701ded..7c84880 100644
--- a/bind-9.21-unittest-qpdb-i386.patch
+++ b/bind-9.21-unittest-qpdb-i386.patch
@@ -1,15 +1,15 @@
-From 574db9dac1c4bd6b19da887a58da1126e336b9e5 Mon Sep 17 00:00:00 2001
+From af1e4bf375000fc532c55ff6df841661185a2451 Mon Sep 17 00:00:00 2001
 From: Petr Mensik <pemensik@redhat.com>
 Date: Wed, 28 May 2025 19:40:05 +0200
 Subject: [PATCH] Try rcu_barrier
 
 https://gitlab.isc.org/isc-projects/bind9/-/issues/5328
 ---
- tests/dns/qpdb_test.c | 5 +++++
- 1 file changed, 5 insertions(+)
+ tests/dns/qpdb_test.c | 3 +++
+ 1 file changed, 3 insertions(+)
 
 diff --git a/tests/dns/qpdb_test.c b/tests/dns/qpdb_test.c
-index 4b1de18..a11af52 100644
+index 1c840e2..b6ad0f4 100644
 --- a/tests/dns/qpdb_test.c
 +++ b/tests/dns/qpdb_test.c
 @@ -24,6 +24,7 @@
@@ -20,24 +20,22 @@ index 4b1de18..a11af52 100644
  #include <isc/util.h>
  
  #include <dns/lib.h>
-@@ -170,6 +171,8 @@ ISC_LOOP_TEST_IMPL(overmempurge_bigrdata) {
+@@ -170,6 +171,7 @@ ISC_LOOP_TEST_IMPL(overmempurge_bigrdata) {
  
  	dns_db_detach(&db);
- 	isc_mem_detach(&mctx2);
-+
+ 	isc_mem_detach(&mctx);
 +	rcu_barrier();
- 	isc_loopmgr_shutdown(loopmgr);
+ 	isc_loopmgr_shutdown();
  }
  
-@@ -221,6 +224,8 @@ ISC_LOOP_TEST_IMPL(overmempurge_longname) {
+@@ -221,6 +223,7 @@ ISC_LOOP_TEST_IMPL(overmempurge_longname) {
  
  	dns_db_detach(&db);
- 	isc_mem_detach(&mctx2);
-+
+ 	isc_mem_detach(&mctx);
 +	rcu_barrier();
- 	isc_loopmgr_shutdown(loopmgr);
+ 	isc_loopmgr_shutdown();
  }
  
 -- 
-2.49.0
+2.51.0
 
diff --git a/bind9-next.spec b/bind9-next.spec
index 7d5b8d7..c0bf8fc 100644
--- a/bind9-next.spec
+++ b/bind9-next.spec
@@ -55,7 +55,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind9-next
 License:  MPL-2.0 AND ISC AND BSD-3-clause AND Expat AND BSD-2-clause
 #
-Version:  9.21.10
+Version:  9.21.11
 Release:  %autorelease
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
@@ -753,7 +753,7 @@ fi;
 %{_mandir}/man1/named-checkconf.1*
 %{_mandir}/man8/rndc-confgen.8*
 %{_mandir}/man1/named-journalprint.1*
-#{_mandir}/man1/named-makejournal.1*
+%{_mandir}/man1/named-makejournal.1*
 %{_mandir}/man8/filter-*.8*
 %doc README.md named.conf.default
 %doc doc/changelog/changelog-9.*.rst*
diff --git a/sources b/sources
index 877f116..d12b4a2 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.21.10.tar.xz) = fa814d43f0e7ec137617f0f2772ebd2e008a647d2158fa1a7765e38551506ee704cc1c6106d4c620b571d16d7cdecb40a8b03943aaeca29f984a3bf19c6205d2
-SHA512 (bind-9.21.10.tar.xz.asc) = 0f25cf6a74b3cc8df1b3c043e5aa2ad772001b2bf9aea0e3b48db2bc207b4508c2848bbe293d81b4cd82011284e5c73463a24ed489120dc9cfa59c4e7698120e
+SHA512 (bind-9.21.11.tar.xz) = dc4a20fc063b6dcec18d5241117eeb741a1e9e8f9e0bdac2743458b87de6a5496fff1e610c3c0676ae65e76b2741c86badb83df5b9278df8595194687359b5d6
+SHA512 (bind-9.21.11.tar.xz.asc) = 25ada3e81c3f60665f0b7f8ef24ba6e81ebd85627126e03ffcfecb02c78aa3f309fc25dce258495c1f5087072f0abad8932b2cd009f85180a27a9bd5f8ed6e80

From 0bad3962c1a776d1305fa52bf34139909226506f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 5 Sep 2025 18:29:26 +0200
Subject: [PATCH 10/22] Try fixing i686 platform

---
 bind9-next.spec | 17 -----------------
 1 file changed, 17 deletions(-)

diff --git a/bind9-next.spec b/bind9-next.spec
index c0bf8fc..1d17ad8 100644
--- a/bind9-next.spec
+++ b/bind9-next.spec
@@ -318,18 +318,6 @@ in HTML and PDF format.
 %endif
 %autosetup -n %{upname}-%{version} -p1
 
-# Sparc and s390 arches need to use -fPIE
-%ifarch sparcv9 sparc64 s390 s390x
-for i in bin/named/Makefile.am; do
-  sed -i 's|fpie|fPIE|g' $i
-done
-%endif
-
-%ifarch %{ix86}
-# f40 FTBFS on quota_test, bug #2261010
-  sed -e '/^\s*quota_test/ d' -i tests/isc/Makefile.am
-%endif
-
 :;
 
 # Create a sysusers.d config file
@@ -368,11 +356,6 @@ export STD_CDEFINES="$CPPFLAGS"
 #'s/([bind_VERSION_EXTRA],\s*\([^)]*\))/([bind_VERSION_EXTRA], \1-RH)/' \
 #configure.ac
 
-%if 0%{?rhel} && 0%{?rhel} < 9
-# disable Sphinx warnings as errors, epel8 does not pass cleanly
-sed -e 's/-W\s//' -i Makefile.docs
-%endif
-
 
 LIBDIR_SUFFIX=
 export LIBDIR_SUFFIX

From de80f009a905c3ec94543537454d1b66e8357bdb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 5 Sep 2025 18:48:00 +0200
Subject: [PATCH 11/22] Reenable systemtap and dtrace

These are enabled by default, just provide dependencies to pass
automatic test.
---
 bind9-next.spec | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/bind9-next.spec b/bind9-next.spec
index 1d17ad8..021b6c3 100644
--- a/bind9-next.spec
+++ b/bind9-next.spec
@@ -124,7 +124,6 @@ BuildRequires:  systemd-rpm-macros
 BuildRequires:  selinux-policy
 BuildRequires:  findutils
 BuildRequires:  sed
-#BuildRequires:  systemtap
 BuildRequires:  libnghttp2-devel
 BuildRequires:  userspace-rcu-devel
 BuildRequires:  pkgconfig(libedit)
@@ -187,7 +186,9 @@ BuildRequires: libtsan
 %endif
 %if %{with DTRACE}
 # https://gitlab.isc.org/isc-projects/bind9/-/issues/4041
-BuildRequires: systemtap-sdt-devel
+BuildRequires:  systemtap
+BuildRequires:  systemtap-sdt-devel
+BuildRequires:  systemtap-sdt-dtrace
 %endif
 
 %description
@@ -363,7 +364,9 @@ export LIBDIR_SUFFIX
 %meson \
   --includedir=%{_includedir}/bind9 \
   -Didn=enabled \
+%if %{without DTRACE}
   -Dtracing=disabled \
+%endif
 %if %{with GEOIP2}
   -Dgeoip=enabled \
 %endif

From 60658fe41a9c3f054417aa2a64c4dd681f4d7b26 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 5 Sep 2025 19:45:43 +0200
Subject: [PATCH 12/22] Replace Expat license with MIT

---
 bind9-next.spec | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/bind9-next.spec b/bind9-next.spec
index 021b6c3..6a82f4e 100644
--- a/bind9-next.spec
+++ b/bind9-next.spec
@@ -53,7 +53,7 @@ Conflicts: %1 \
 
 Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
 Name:     bind9-next
-License:  MPL-2.0 AND ISC AND BSD-3-clause AND Expat AND BSD-2-clause
+License:  MPL-2.0 AND ISC AND BSD-3-clause AND MIT AND BSD-2-clause
 #
 Version:  9.21.11
 Release:  %autorelease

From d412d0ebd0e712f7a5057042048591b31bc8ad30 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 10 Sep 2025 23:08:11 +0200
Subject: [PATCH 13/22] Remove license and devel packages from README

Remove also reference to DLZ removed during recent updates.

[skip changelog]
---
 README.md | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/README.md b/README.md
index b7cfab1..7f59b23 100644
--- a/README.md
+++ b/README.md
@@ -26,13 +26,9 @@ The package contains several subpackages, some of them can be disabled on rebuil
 * **bind9-next** -- *named* daemon providing DNS server
 * **bind9-next-utils** -- set of tools to analyse DNS responses or update entries (dig, host)
 * **bind9-next-doc** -- documentation for current bind, *BIND 9 Administrator Reference Manual*.
-* **bind9-next-license** -- Shared license for all packages but bind-export-libs.
 * **bind9-next-libs** -- Shared libraries used by some others programs
-* **bind9-next-devel** -- Development headers for libs. Can be disabled by `--without DEVEL`
-
 
 ## Optional features
 
 * *GSSTSIG* -- Support for Kerberos authentication in BIND.
 * *LMDB* -- Support for dynamic database for managing runtime added zones. Provides faster removal of added zone with much less overhead. But requires lmdb linked to base libs.
-* *DLZ* -- Support for dynamic loaded modules providing support for features *bind-sdb* provides, but only small module is required.

From 78617f988493148732d9eb9adab9b53fede2f343 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 11 Sep 2025 12:34:06 +0200
Subject: [PATCH 14/22] Meson libs include version in upstream already

Libraries include version name right in the upstream. No need for
downstream patch doing the same.
---
 bind9-next.spec  |  2 --
 meson-libs.patch | 62 ------------------------------------------------
 2 files changed, 64 deletions(-)
 delete mode 100644 meson-libs.patch

diff --git a/bind9-next.spec b/bind9-next.spec
index 6a82f4e..5239282 100644
--- a/bind9-next.spec
+++ b/bind9-next.spec
@@ -96,8 +96,6 @@ Patch3: bind-9.21-unittest-isc_rwlock-s390x.patch
 # https://gitlab.isc.org/isc-projects/bind9/-/issues/5328
 # avoid often fails on i386, unsupported upstream
 Patch4: bind-9.21-unittest-qpdb-i386.patch
-# Downstream patch to include version in libraries
-Patch5: meson-libs.patch
 
 %{?systemd_ordering}
 Requires:       coreutils
diff --git a/meson-libs.patch b/meson-libs.patch
deleted file mode 100644
index 4ba0723..0000000
--- a/meson-libs.patch
+++ /dev/null
@@ -1,62 +0,0 @@
-From 0e03b4c1c4fed5b149969b25df2bc6b45a089b79 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
-Date: Thu, 31 Jul 2025 20:54:08 +0200
-Subject: [PATCH] Add version to shared libraries
-
-Allow coexistence of different bind libraries and utilities by it.
----
- meson.build | 10 +++++-----
- 1 file changed, 5 insertions(+), 5 deletions(-)
-
-diff --git a/meson.build b/meson.build
-index 432af24..dac4212 100644
---- a/meson.build
-+++ b/meson.build
-@@ -957,7 +957,7 @@ subdir('util')
- isc_srcconf = isc_srcset.apply(config, strict: false)
- 
- libisc = library(
--    'isc',
-+    'isc-'+meson.project_version(),
-     isc_srcconf.sources(),
-     objects: isc_probe_objects,
-     install: true,
-@@ -984,7 +984,7 @@ libisc_dep = declare_dependency(
- dns_srcconf = dns_srcset.apply(config, strict: false)
- 
- libdns = library(
--    'dns',
-+    'dns-'+meson.project_version(),
-     dns_srcconf.sources(),
-     include_directories: dns_inc,
-     install: true,
-@@ -1018,7 +1018,7 @@ libdns_dep = declare_dependency(
- ns_srcconf = ns_srcset.apply(config, strict: false)
- 
- libns = library(
--    'ns',
-+    'ns-'+meson.project_version(),
-     ns_srcconf.sources(),
-     objects: ns_probe_objects,
-     install: true,
-@@ -1044,7 +1044,7 @@ libns_dep = declare_dependency(
- isccc_srcconf = isccc_srcset.apply(config, strict: false)
- 
- libisccc = library(
--    'isccc',
-+    'isccc-'+meson.project_version(),
-     isccc_srcconf.sources(),
-     implicit_include_directories: false,
-     include_directories: isccc_inc,
-@@ -1065,7 +1065,7 @@ libisccc_dep = declare_dependency(
- isccfg_srcconf = isccfg_srcset.apply(config, strict: false)
- 
- libisccfg = library(
--    'isccfg',
-+    'isccfg-'+meson.project_version(),
-     isccfg_srcconf.sources(),
-     implicit_include_directories: false,
-     include_directories: isccfg_inc,
--- 
-2.50.1
-

From 0ed5fc08dd99f63cc69edc33fe9d8a88b0a6caf6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 30 Oct 2025 13:33:48 +0100
Subject: [PATCH 15/22] Update to 9.21.14 (rhbz#2394406)

Security Fixes:

- DNSSEC validation fails if matching but invalid DNSKEY is found. (CVE-2025-8677)
- Address various spoofing attacks. (CVE-2025-40778)
- Cache-poisoning due to weak pseudo-random number generator. (CVE-2025-40780)

New Features:

- Add dnssec-policy keys configuration check to named-checkconf.
- Add support for synthetic records.
- Support for zone-specific plugins.
- Support for additional tokens in the zone file name template.

Removed Features:

- Remove randomized RRset ordering.

and bug fixes

https://downloads.isc.org/isc/bind9/9.21.14/doc/arm/html/notes.html#notes-for-bind-9-21-14
---
 bind9-next.spec | 4 +++-
 sources         | 4 ++--
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/bind9-next.spec b/bind9-next.spec
index 5239282..c888c65 100644
--- a/bind9-next.spec
+++ b/bind9-next.spec
@@ -55,7 +55,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind9-next
 License:  MPL-2.0 AND ISC AND BSD-3-clause AND MIT AND BSD-2-clause
 #
-Version:  9.21.11
+Version:  9.21.14
 Release:  %autorelease
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
@@ -362,6 +362,7 @@ export LIBDIR_SUFFIX
 %meson \
   --includedir=%{_includedir}/bind9 \
   -Didn=enabled \
+  -Dfuzzing=disabled \
 %if %{without DTRACE}
   -Dtracing=disabled \
 %endif
@@ -707,6 +708,7 @@ fi;
 # FIXME: current build targets filters into %%_libdir/bind again?
 %dir %{_libdir}/bind
 %{_libdir}/bind/filter*.so
+%{_libdir}/bind/synthrecord.so
 %dir %{_libdir}/named
 %config(noreplace) %verify(not md5 size mtime) %{_sysconfdir}/sysconfig/named
 %config(noreplace) %attr(0644,root,named) %{_sysconfdir}/named.root.key
diff --git a/sources b/sources
index d12b4a2..714e4db 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.21.11.tar.xz) = dc4a20fc063b6dcec18d5241117eeb741a1e9e8f9e0bdac2743458b87de6a5496fff1e610c3c0676ae65e76b2741c86badb83df5b9278df8595194687359b5d6
-SHA512 (bind-9.21.11.tar.xz.asc) = 25ada3e81c3f60665f0b7f8ef24ba6e81ebd85627126e03ffcfecb02c78aa3f309fc25dce258495c1f5087072f0abad8932b2cd009f85180a27a9bd5f8ed6e80
+SHA512 (bind-9.21.14.tar.xz) = bf4bd0f5613d6c6d53f749f3269a34f3a5c74a7dc81e05922d58ba30f19d418e565838dd1182dd6052b9a62b3799d2d0f12451f2797af3279259df59cfc4be05
+SHA512 (bind-9.21.14.tar.xz.asc) = 91ccc82ca54d07dba07821c3410f92b563290ead48546d605b0dbd9958a831d9b90130002fbb325e0cdc913de64813d8ba4c48ec958ebba7f5f462d43f578394

From 9b6df11143011ee9d5011d43700298f6ae9d0a19 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 6 Nov 2025 15:55:40 +0100
Subject: [PATCH 16/22] Prevent SERVFAIL on dual signed zones with one
 unsupported signature (rhbz#2413104)

---
 bind-9.21-dual-sign-continue-test.patch | 115 ++++++++++++++++++++++++
 bind-9.21-dual-sign-continue.patch      |  42 +++++++++
 bind9-next.spec                         |   2 +
 3 files changed, 159 insertions(+)
 create mode 100644 bind-9.21-dual-sign-continue-test.patch
 create mode 100644 bind-9.21-dual-sign-continue.patch

diff --git a/bind-9.21-dual-sign-continue-test.patch b/bind-9.21-dual-sign-continue-test.patch
new file mode 100644
index 0000000..18408af
--- /dev/null
+++ b/bind-9.21-dual-sign-continue-test.patch
@@ -0,0 +1,115 @@
+From 488d7bfc75f2988c6e461b8677bc0e27e58bd82e Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
+Date: Sat, 1 Nov 2025 12:00:59 +0100
+Subject: [PATCH] Add a system test with one good and one bad algorithm
+
+The case where there would be one supported algorithm and one already
+unsupported (like RSAMD5 or RSASHA1) was missing.
+---
+ bin/tests/system/dnssec/ns2/example.db.in   |  4 +++
+ bin/tests/system/dnssec/ns2/sign.sh         |  2 +-
+ bin/tests/system/dnssec/ns3/named.conf.j2   |  6 ++++
+ bin/tests/system/dnssec/ns3/sign.sh         | 31 +++++++++++++++++++++
+ bin/tests/system/dnssec/tests_validation.py |  8 ++++++
+ 5 files changed, 50 insertions(+), 1 deletion(-)
+
+diff --git a/bin/tests/system/dnssec/ns2/example.db.in b/bin/tests/system/dnssec/ns2/example.db.in
+index 47c2eb7f0e..07429366ee 100644
+--- a/bin/tests/system/dnssec/ns2/example.db.in
++++ b/bin/tests/system/dnssec/ns2/example.db.in
+@@ -202,3 +202,7 @@ ns3.extradsunknownoid	A	10.53.0.3
+ 
+ extended-ds-unknown-oid	NS	ns3.extended-ds-unknown-oid
+ ns3.extended-ds-unknown-oid A	10.53.0.3
++
++; A secure subdomain with extra bad key
++extrabadkey		NS	ns3.extrabadkey
++ns3.extrabadkey		A	10.53.0.3
+diff --git a/bin/tests/system/dnssec/ns2/sign.sh b/bin/tests/system/dnssec/ns2/sign.sh
+index e3f18af15e..da9f5f07fc 100644
+--- a/bin/tests/system/dnssec/ns2/sign.sh
++++ b/bin/tests/system/dnssec/ns2/sign.sh
+@@ -92,7 +92,7 @@ for subdomain in digest-alg-unsupported ds-unsupported secure badds \
+   dnskey-nsec3-unknown managed-future future revkey \
+   dname-at-apex-nsec3 occluded rsasha1 rsasha1-1024 \
+   rsasha256oid rsasha512oid unknownoid extradsoid extradsunknownoid \
+-  extended-ds-unknown-oid; do
++  extended-ds-unknown-oid extrabadkey; do
+   cp "../ns3/dsset-$subdomain.example." .
+ done
+ 
+diff --git a/bin/tests/system/dnssec/ns3/named.conf.j2 b/bin/tests/system/dnssec/ns3/named.conf.j2
+index 1a0edc14bb..9cbc58892c 100644
+--- a/bin/tests/system/dnssec/ns3/named.conf.j2
++++ b/bin/tests/system/dnssec/ns3/named.conf.j2
+@@ -141,6 +141,12 @@ zone "extrakey.example" {
+ 	allow-update { any; };
+ };
+ 
++zone "extrabadkey.example" {
++	type primary;
++	file "extrabadkey.example.db.signed";
++	allow-update { any; };
++};
++
+ zone "insecure.nsec3.example" {
+ 	type primary;
+ 	file "insecure.nsec3.example.db";
+diff --git a/bin/tests/system/dnssec/ns3/sign.sh b/bin/tests/system/dnssec/ns3/sign.sh
+index 5512888b2f..ea81381eb2 100644
+--- a/bin/tests/system/dnssec/ns3/sign.sh
++++ b/bin/tests/system/dnssec/ns3/sign.sh
+@@ -905,3 +905,34 @@ ksk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK "$zone")
+ zsk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
+ cat "$infile" "$ksk.key" "$zsk.key" >"$zonefile"
+ "$SIGNER" -g -o "$zone" "$zonefile" >/dev/null 2>&1
++
++#
++#
++#
++zone=extrabadkey.example.
++infile=template.db.in
++zonefile=extrabadkey.example.db
++
++# Add KSK and ZSK that we will mangle to RSAMD5
++ksk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK "$zone")
++zsk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
++cat "$infile" "$ksk.key" "$zsk.key" >"$zonefile"
++"$SIGNER" -g -O full -o "$zone" "$zonefile" >/dev/null 2>&1
++
++# Mangle the signatures to RSAMD5 and save them for future use
++sed -ne "s/\(IN[[:space:]]*RRSIG[[:space:]]*[A-Z]*\) $DEFAULT_ALGORITHM_NUMBER /\1 1 /p" <"$zonefile.signed" >"$zonefile.signed.rsamd5"
++
++# Now add normal KSK and ZSK to the zone file
++ksk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK "$zone")
++zsk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
++cat "$infile" "$ksk.key" "$zsk.key" >"$zonefile"
++
++# Mangle the DNSKEY algorithm numbers and add them to the signed zone file
++cat "$ksk.key" "$zsk.key" | sed -e "s/\(IN[[:space:]]*DNSKEY[[:space:]]*[0-9]* 3\) $DEFAULT_ALGORITHM_NUMBER /\1 1 /" >>"$zonefile"
++
++# Sign normally
++"$SIGNER" -g -o "$zone" "$zonefile" >/dev/null 2>&1
++
++# Add the mangled signatures to signed zone file
++cat "$zonefile.signed.rsamd5" >>"$zonefile.signed"
++rm "$zonefile.signed.rsamd5"
+diff --git a/bin/tests/system/dnssec/tests_validation.py b/bin/tests/system/dnssec/tests_validation.py
+index e6d8ccc734..a27a899987 100644
+--- a/bin/tests/system/dnssec/tests_validation.py
++++ b/bin/tests/system/dnssec/tests_validation.py
+@@ -1385,3 +1385,11 @@ def test_rrsigs_for_glue():
+         record.rdtype == rdatatype.RRSIG and record.covers == rdatatype.A
+         for record in res.answer
+     )
++
++
++def test_extra_bad_algorithm():
++    msg = isctest.query.create("a.extrabadkey.example", "A")
++    res1 = isctest.query.tcp(msg, "10.53.0.3")
++    res2 = isctest.query.tcp(msg, "10.53.0.4")
++    isctest.check.same_answer(res1, res2)
++    isctest.check.adflag(res2)
+-- 
+2.51.1
+
diff --git a/bind-9.21-dual-sign-continue.patch b/bind-9.21-dual-sign-continue.patch
new file mode 100644
index 0000000..22e3cef
--- /dev/null
+++ b/bind-9.21-dual-sign-continue.patch
@@ -0,0 +1,42 @@
+From a94a7c1a1e6eecbead995a08bace33d23899a5da Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
+Date: Tue, 4 Nov 2025 02:09:38 +0100
+Subject: [PATCH] Skip unsupported algorithms when looking for signing key
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+When looking for a signing key in select_signing_key(), the result code
+indicating unsupported algorithm would abort the search.  Instead, skip
+such keys and continue searching for the right key.
+
+Co-Authored-By: Aram Sargsyan <aram@isc.org>
+Co-Authored-By: Petr Menšík <pemensik@redhat.com>
+---
+ lib/dns/validator.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/lib/dns/validator.c b/lib/dns/validator.c
+index c6781544b9..52677fbd80 100644
+--- a/lib/dns/validator.c
++++ b/lib/dns/validator.c
+@@ -1092,8 +1092,14 @@ select_signing_key(dns_validator_t *val, dns_rdataset_t *rdataset) {
+ 			continue;
+ 		}
+ 
+-		return dns_dnssec_keyfromrdata(&siginfo->signer, &rdata,
+-					       val->view->mctx, &val->key);
++		result = dns_dnssec_keyfromrdata(&siginfo->signer, &rdata,
++						 val->view->mctx, &val->key);
++		/* Don't count unsupported algorithm towards max fails */
++		if (result == DST_R_UNSUPPORTEDALG) {
++			/* Continue with the next key */
++			continue;
++		}
++		return result;
+ 	}
+ 
+ 	return ISC_R_NOTFOUND;
+-- 
+2.51.1
+
diff --git a/bind9-next.spec b/bind9-next.spec
index c888c65..406feab 100644
--- a/bind9-next.spec
+++ b/bind9-next.spec
@@ -96,6 +96,8 @@ Patch3: bind-9.21-unittest-isc_rwlock-s390x.patch
 # https://gitlab.isc.org/isc-projects/bind9/-/issues/5328
 # avoid often fails on i386, unsupported upstream
 Patch4: bind-9.21-unittest-qpdb-i386.patch
+Patch5: bind-9.21-dual-sign-continue.patch
+Patch6: bind-9.21-dual-sign-continue-test.patch
 
 %{?systemd_ordering}
 Requires:       coreutils

From 07c6012166c42221b43352df952c3c5340858e66 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 11 Nov 2025 12:07:48 +0100
Subject: [PATCH 17/22] Fix running SYSTEMTEST during build

Needs prepared network scripts.

Can be used like:
fedpkg mockbuild --enable-network --with SYSTEMTEST
---
 bind9-next.spec | 22 ++++++++++++++++------
 1 file changed, 16 insertions(+), 6 deletions(-)

diff --git a/bind9-next.spec b/bind9-next.spec
index 406feab..346cec9 100644
--- a/bind9-next.spec
+++ b/bind9-next.spec
@@ -154,6 +154,8 @@ BuildRequires:  softhsm
 BuildRequires:  perl(Net::DNS) perl(Net::DNS::Nameserver) perl(Time::HiRes) perl(Getopt::Long)
 BuildRequires:  perl(English)
 BuildRequires:  python3-pytest
+BuildRequires:  python3-pytest-xdist
+BuildRequires:  python3-dns
 # manual configuration requires this tool
 BuildRequires:  iproute
 BuildRequires:  python3-jinja2
@@ -404,6 +406,9 @@ export LIBDIR_SUFFIX
 %if %{with DOC}
   %meson_build man arm arm-epub
 %endif
+%if %{with SYSTEMTEST}
+  %meson_build system-test-dependencies
+%endif
 
 # Compress changelog by default
 gzip doc/changelog/changelog-*.rst
@@ -469,18 +474,23 @@ export TSAN_OPTIONS="log_exe_name=true log_path=ThreadSanitizer exitcode=0"
 
   if [ -n "$CONFIGURED" ]
   then
-    set -e
-    pushd bin/tests
+    pushd bin/tests/system
     export CI_SYSTEM=yes # allow running tests as root
     chown -R ${USER} . # Can be unknown user
-    %meson_build test 2>&1 | tee test.log
-    e=$?
+    e=0
+    pytest -n ${THREADS} --capture=tee-sys || e=$?
     [ "$CONFIGURED" = build ] && $SUDO sh ./ifconfig.sh down
-    popd
     if [ "$e" -ne 0 ]; then
-      echo "ERROR: this build of BIND failed 'make test'. Aborting."
+      echo "ERROR: failed running 'pytest' in system tests. Aborting."
+      ls -1 "$(pwd)"/*_tmp_*
+      for TMPTEST in *_tmp_*
+      do
+        echo "# $TMPTEST"
+        cat $TMPTEST/pytest.log.txt
+      done
       exit $e;
     fi;
+    popd
   else
     echo 'SKIPPED: tests require root, CAP_NET_ADMIN or already configured test addresses.'
   fi

From 8c947ce9c412e00f95af99e726468f00448ec509 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 21 Nov 2025 23:51:11 +0100
Subject: [PATCH 18/22] Use dns-root-data package for hints source

Use trusted root source and hints from separate package.
---
 bind9-next.spec    | 26 ++++++++-----
 named-chroot.files |  1 +
 named-mkroot.sh    | 20 ++++++++++
 named.root         | 92 ----------------------------------------------
 named.root.key     | 23 +++---------
 trusted-key.key    |  2 -
 6 files changed, 42 insertions(+), 122 deletions(-)
 create mode 100755 named-mkroot.sh
 delete mode 100644 named.root
 delete mode 100644 trusted-key.key

diff --git a/bind9-next.spec b/bind9-next.spec
index 346cec9..0621952 100644
--- a/bind9-next.spec
+++ b/bind9-next.spec
@@ -30,7 +30,7 @@
 %global        chroot_prefix     %{bind_dir}/chroot
 %global        chroot_create_directories /dev /run/named %{_localstatedir}/{log,named,tmp} \\\
                                          %{_sysconfdir}/{crypto-policies/back-ends,pki/dnssec-keys,pki/tls,named} \\\
-                                         %{_libdir}/bind %{_libdir}/named %{_datadir}/GeoIP /proc/sys/net/ipv4
+                                         %{_libdir}/bind %{_libdir}/named %{_datadir}/{GeoIP,dns-root-data} /proc/sys/net/ipv4
 
 %global forgeurl0 https://gitlab.isc.org/isc-projects/bind9
 
@@ -67,17 +67,13 @@ Source2:  https://downloads.isc.org/isc/bind9/%{version}/%{upname}-%{version}.ta
 Source3:  named.logrotate
 Source4:  https://www.isc.org/docs/isc-keyblock.asc
 Source16: named.conf
-# Refresh by command: dig @a.root-servers.net. +tcp +norec
-# or from URL
-Source17: https://www.internic.net/domain/named.root
 Source18: named.localhost
 Source19: named.loopback
 Source20: named.empty
 Source23: named.rfc1912.zones
 Source25: named.conf.sample
-Source27: named.root.key
+Source27: named-mkroot.sh
 Source35: bind.tmpfiles.d
-Source36: trusted-key.key
 Source37: named.service
 Source38: named-chroot.service
 Source41: setup-named-chroot.sh
@@ -104,6 +100,7 @@ Requires:       coreutils
 Requires(post): shadow-utils
 Requires(post): glibc-common
 Requires(post): grep
+Requires:       dns-root-data
 Requires:       %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release}
 Recommends:     %{name}-utils %{name}-dnssec-utils
 %upname_compat %{upname}
@@ -127,6 +124,7 @@ BuildRequires:  sed
 BuildRequires:  libnghttp2-devel
 BuildRequires:  userspace-rcu-devel
 BuildRequires:  pkgconfig(libedit)
+BuildRequires:  dns-root-data
 # Compress the changelog
 BuildRequires:  gzip
 %if 0%{?fedora}
@@ -359,6 +357,10 @@ export STD_CDEFINES="$CPPFLAGS"
 #'s/([bind_VERSION_EXTRA],\s*\([^)]*\))/([bind_VERSION_EXTRA], \1-RH)/' \
 #configure.ac
 
+install -p -m 0755 %{SOURCE27} ./named-mkroot.sh # create named.root.key
+./named-mkroot.sh
+[ -f named.root.key ]
+
 
 LIBDIR_SUFFIX=
 export LIBDIR_SUFFIX
@@ -426,6 +428,10 @@ gzip doc/changelog/changelog-*.rst
 export TSAN_OPTIONS="log_exe_name=true log_path=ThreadSanitizer exitcode=0"
 %endif
 
+# We produce it runtime. Check it has valid syntax.
+LD_LIBRARY_PATH="$LD_LIBRARY_PATH:${RPM_BUILD_ROOT}%{_libdir}" \
+  ${RPM_BUILD_ROOT}%{_bindir}/named-checkconf ${RPM_BUILD_ROOT}%{_sysconfdir}/named.root.key
+
 %if %{with UNITTEST}
   CPUS=$(lscpu -p=cpu,core | grep -v '^#' | wc -l)
   THREADS="$CPUS"
@@ -595,13 +601,13 @@ touch ${RPM_BUILD_ROOT}%{_localstatedir}/log/named.log
 # configuration files:
 install -m 640 %{SOURCE16} ${RPM_BUILD_ROOT}%{_sysconfdir}/named.conf
 touch ${RPM_BUILD_ROOT}%{_sysconfdir}/rndc.{key,conf}
-install -m 644 %{SOURCE27} ${RPM_BUILD_ROOT}%{_sysconfdir}/named.root.key
-install -m 644 %{SOURCE36} ${RPM_BUILD_ROOT}%{_sysconfdir}/trusted-key.key
+install -m 644 -p named.root.key ${RPM_BUILD_ROOT}%{_sysconfdir}/named.root.key
+ln -s "%{_datadir}/dns-root-data/root.key" ${RPM_BUILD_ROOT}%{_sysconfdir}/trusted-key.key
 mkdir -p ${RPM_BUILD_ROOT}%{_sysconfdir}/named
 
 # data files:
 mkdir -p ${RPM_BUILD_ROOT}%{_localstatedir}/named
-install -m 640 %{SOURCE17} ${RPM_BUILD_ROOT}%{_localstatedir}/named/named.ca
+ln -s "%{_datadir}/dns-root-data/root.hints" ${RPM_BUILD_ROOT}%{_localstatedir}/named/named.ca
 install -m 640 %{SOURCE18} ${RPM_BUILD_ROOT}%{_localstatedir}/named/named.localhost
 install -m 640 %{SOURCE19} ${RPM_BUILD_ROOT}%{_localstatedir}/named/named.loopback
 install -m 640 %{SOURCE20} ${RPM_BUILD_ROOT}%{_localstatedir}/named/named.empty
@@ -614,7 +620,7 @@ install -m 644 %{SOURCE25} sample/etc/named.conf
 install -m 644 %{SOURCE16} named.conf.default
 install -m 644 %{SOURCE23} sample/etc/named.rfc1912.zones
 install -m 644 %{SOURCE18} %{SOURCE19} %{SOURCE20}  sample/var/named
-install -m 644 %{SOURCE17} sample/var/named/named.ca
+ln -s "%{_datadir}/dns-root-data/root.hints" sample/var/named/named.ca
 for f in my.internal.zone.db slaves/my.slave.internal.zone.db slaves/my.ddns.internal.zone.db my.external.zone.db; do 
   echo '@ in soa localhost. root 1 3H 15M 1W 1D
   ns localhost.' > sample/var/named/$f; 
diff --git a/named-chroot.files b/named-chroot.files
index c186664..c901664 100644
--- a/named-chroot.files
+++ b/named-chroot.files
@@ -18,6 +18,7 @@
 /usr/lib64/bind
 /usr/lib/bind
 /usr/share/GeoIP
+/usr/share/dns-root-data
 /run/named
 /proc/sys/net/ipv4/ip_local_port_range
 # Warning: the order is important
diff --git a/named-mkroot.sh b/named-mkroot.sh
new file mode 100755
index 0000000..288725b
--- /dev/null
+++ b/named-mkroot.sh
@@ -0,0 +1,20 @@
+#!/bin/sh
+# Create named.root.key from dns-root-data package
+
+ROOT_DS=/usr/share/dns-root-data/root.ds
+: ${OUTPUT:=named.root.key}
+
+if ! [ -r "$ROOT_DS" ]; then
+	echo "Root trust file is not readable: $ROOT_DS"
+	exit 1
+fi
+
+echo "# Autogenerated from $ROOT_DS" > "$OUTPUT"
+echo "trust-anchors {" >> "$OUTPUT"
+cat "$ROOT_DS" | while read DOMAIN CLS QTYPE KEYTAG ALG DIG HASH;
+do
+	echo "$DOMAIN initial-ds $KEYTAG $ALG $DIG \"$HASH\";" >> "$OUTPUT";
+done
+echo "}; " >> "$OUTPUT"
+# Set the same modification time as data source.
+touch -r $ROOT_DS "$OUTPUT"
diff --git a/named.root b/named.root
deleted file mode 100644
index 8b8a3b1..0000000
--- a/named.root
+++ /dev/null
@@ -1,92 +0,0 @@
-;       This file holds the information on root name servers needed to 
-;       initialize cache of Internet domain name servers
-;       (e.g. reference this file in the "cache  .  <file>"
-;       configuration file of BIND domain name servers). 
-; 
-;       This file is made available by InterNIC 
-;       under anonymous FTP as
-;           file                /domain/named.cache 
-;           on server           FTP.INTERNIC.NET
-;       -OR-                    RS.INTERNIC.NET
-;
-;       last update:     December 20, 2023
-;       related version of root zone:     2023122001
-; 
-; FORMERLY NS.INTERNIC.NET 
-;
-.                        3600000      NS    A.ROOT-SERVERS.NET.
-A.ROOT-SERVERS.NET.      3600000      A     198.41.0.4
-A.ROOT-SERVERS.NET.      3600000      AAAA  2001:503:ba3e::2:30
-; 
-; FORMERLY NS1.ISI.EDU 
-;
-.                        3600000      NS    B.ROOT-SERVERS.NET.
-B.ROOT-SERVERS.NET.      3600000      A     170.247.170.2
-B.ROOT-SERVERS.NET.      3600000      AAAA  2801:1b8:10::b
-; 
-; FORMERLY C.PSI.NET 
-;
-.                        3600000      NS    C.ROOT-SERVERS.NET.
-C.ROOT-SERVERS.NET.      3600000      A     192.33.4.12
-C.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:2::c
-; 
-; FORMERLY TERP.UMD.EDU 
-;
-.                        3600000      NS    D.ROOT-SERVERS.NET.
-D.ROOT-SERVERS.NET.      3600000      A     199.7.91.13
-D.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:2d::d
-; 
-; FORMERLY NS.NASA.GOV
-;
-.                        3600000      NS    E.ROOT-SERVERS.NET.
-E.ROOT-SERVERS.NET.      3600000      A     192.203.230.10
-E.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:a8::e
-; 
-; FORMERLY NS.ISC.ORG
-;
-.                        3600000      NS    F.ROOT-SERVERS.NET.
-F.ROOT-SERVERS.NET.      3600000      A     192.5.5.241
-F.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:2f::f
-; 
-; FORMERLY NS.NIC.DDN.MIL
-;
-.                        3600000      NS    G.ROOT-SERVERS.NET.
-G.ROOT-SERVERS.NET.      3600000      A     192.112.36.4
-G.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:12::d0d
-; 
-; FORMERLY AOS.ARL.ARMY.MIL
-;
-.                        3600000      NS    H.ROOT-SERVERS.NET.
-H.ROOT-SERVERS.NET.      3600000      A     198.97.190.53
-H.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:1::53
-; 
-; FORMERLY NIC.NORDU.NET
-;
-.                        3600000      NS    I.ROOT-SERVERS.NET.
-I.ROOT-SERVERS.NET.      3600000      A     192.36.148.17
-I.ROOT-SERVERS.NET.      3600000      AAAA  2001:7fe::53
-; 
-; OPERATED BY VERISIGN, INC.
-;
-.                        3600000      NS    J.ROOT-SERVERS.NET.
-J.ROOT-SERVERS.NET.      3600000      A     192.58.128.30
-J.ROOT-SERVERS.NET.      3600000      AAAA  2001:503:c27::2:30
-; 
-; OPERATED BY RIPE NCC
-;
-.                        3600000      NS    K.ROOT-SERVERS.NET.
-K.ROOT-SERVERS.NET.      3600000      A     193.0.14.129
-K.ROOT-SERVERS.NET.      3600000      AAAA  2001:7fd::1
-; 
-; OPERATED BY ICANN
-;
-.                        3600000      NS    L.ROOT-SERVERS.NET.
-L.ROOT-SERVERS.NET.      3600000      A     199.7.83.42
-L.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:9f::42
-; 
-; OPERATED BY WIDE
-;
-.                        3600000      NS    M.ROOT-SERVERS.NET.
-M.ROOT-SERVERS.NET.      3600000      A     202.12.27.33
-M.ROOT-SERVERS.NET.      3600000      AAAA  2001:dc3::35
-; End of file
\ No newline at end of file
diff --git a/named.root.key b/named.root.key
index b57e61d..6d0904d 100644
--- a/named.root.key
+++ b/named.root.key
@@ -1,18 +1,5 @@
-trust-anchors {
-        # ROOT KEYS: See https://data.iana.org/root-anchors/root-anchors.xml
-        # for current trust anchor information.
-        #
-        # This key (20326) was published in the root zone in 2017.
-        # Servers which were already using the old key (19036) should
-        # roll seamlessly to this new one via RFC 5011 rollover. Servers
-        # being set up for the first time can use the contents of this
-        # file as initializing keys; thereafter, the keys in the
-        # managed key database will be trusted and maintained
-        # automatically.
-        . initial-ds 20326 8 2 "E06D44B80B8F1D39A95C0B0D7C65D08458E880409BBC683457104237C7F8EC8D";
-        # This key (38696) will be pre-published in the root zone in 2025
-        # and is scheduled to begin signing in late 2026. At that time,
-        # servers which were already using the old key (20326) should roll
-        # seamlessly to this new one via RFC 5011 rollover.
-        . initial-ds 38696 8 2 "683D2D0ACB8C9B712A1948B27F741219298D0A450D612C483AF444A4C0FB2B16";
-};
+# Autogenerated from /usr/share/dns-root-data/root.ds
+truste-anchors {
+. initial-ds 20326 8 2 "E06D44B80B8F1D39A95C0B0D7C65D08458E880409BBC683457104237C7F8EC8D";
+. initial-ds 38696 8 2 "683D2D0ACB8C9B712A1948B27F741219298D0A450D612C483AF444A4C0FB2B16";
+}; 
diff --git a/trusted-key.key b/trusted-key.key
deleted file mode 100644
index 2ef50c7..0000000
--- a/trusted-key.key
+++ /dev/null
@@ -1,2 +0,0 @@
-. 3600 IN DNSKEY 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU=
-. 3600 IN DNSKEY 257 3 8 AwEAAa96jeuknZlaeSrvyAJj6ZHv28hhOKkx3rLGXVaC6rXTsDc449/cidltpkyGwCJNnOAlFNKF2jBosZBU5eeHspaQWOmOElZsjICMQMC3aeHbGiShvZsx4wMYSjH8e7Vrhbu6irwCzVBApESjbUdpWWmEnhathWu1jo+siFUiRAAxm9qyJNg/wOZqqzL/dL/q8PkcRU5oUKEpUge71M3ej2/7CPqpdVwuMoTvoB+ZOT4YeGyxMvHmbrxlFzGOHOijtzN+u1TQNatX2XBuzZNQ1K+s2CXkPIZo7s6JgZyvaBevYtxPvYLw4z9mR7K2vaF18UYH9Z9GNUUeayffKC73PYc=

From ac3ef15e89884c082466f1f25e902667a7df0b4b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Mon, 19 Jan 2026 13:26:29 +0100
Subject: [PATCH 19/22] Fix build for RHEL, disable JEMALLOC there

---
 bind9-next.spec | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/bind9-next.spec b/bind9-next.spec
index 0621952..d8c9236 100644
--- a/bind9-next.spec
+++ b/bind9-next.spec
@@ -22,6 +22,7 @@
 %bcond_with    TSAN
 %bcond_without DTRACE
 %bcond_with    OPENSSL_ENGINE
+%bcond         JEMALLOC  0%{?fedora}
 
 %{?!bind_uid:  %global bind_uid  25}
 %{?!bind_gid:  %global bind_gid  25}
@@ -127,9 +128,11 @@ BuildRequires:  pkgconfig(libedit)
 BuildRequires:  dns-root-data
 # Compress the changelog
 BuildRequires:  gzip
-%if 0%{?fedora}
+%if %{with JEMALLOC}
 BuildRequires:  jemalloc-devel
-BuildRequires:  gnupg2
+%endif
+%if ! 0%{?rhel}
+BuildRequires:  gpgverify
 %endif
 BuildRequires:  libuv-devel
 %if %{with OPENSSL_ENGINE}
@@ -313,8 +316,8 @@ in HTML and PDF format.
 %endif
 
 %prep
-%if 0%{?fedora}
-# RHEL does not yet support this verification
+%if ! 0%{?rhel} || 0%{?rhel} > 10
+# RHEL does not (again?) support this verification
 %{gpgverify} --keyring='%{SOURCE4}' --signature='%{SOURCE2}' --data='%{SOURCE0}'
 %endif
 %autosetup -n %{upname}-%{version} -p1
@@ -395,6 +398,9 @@ export LIBDIR_SUFFIX
 %if %{with DOC}
   -Ddoc=enabled \
 %endif
+%if %{without JEMALLOC}
+  -Djemalloc=disabled \
+%endif
 ;
 %if %{with DNSTAP}
   pushd lib

From 13d07a1939f85ba389e4211b8f8b41b14a4d906e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 22 Jan 2026 10:58:43 +0100
Subject: [PATCH 20/22] Update to 9.21.17 (rhbz#2415843)

Security Fixes:

- Fix incorrect length checks for BRID and HHIT records. (CVE-2025-13878)

New Features:

- Add support for Extended DNS Error 9 (Missing DNSKEY).
- Add support for Extended DNS Error 13 (Cached Error).
- Add support for Generalized DNS Notifications.

Features Changes:

- Add more information to the rndc recursing output about fetches.
- Enforce bounds of multiple configuration options.

Bug Fixes:

- Fix inbound IXFR performance regression.
- Make DNSSEC key rollovers more robust.
- Fix a catalog zone issue, where member zones could fail to load.
- Fix slow speed when signing a large delegation zone with NSEC3 opt-out.
- Reconfiguring an NSEC3 opt-out zone to NSEC caused the zone to be invalid.
- Fix a possible catalog zone issue during reconfiguration.
- Fix the charts in the statistics channel.

https://downloads.isc.org/isc/bind9/9.21.17/doc/arm/html/notes.html#notes-for-bind-9-21-17
---
 bind9-next.spec | 4 +---
 sources         | 4 ++--
 2 files changed, 3 insertions(+), 5 deletions(-)

diff --git a/bind9-next.spec b/bind9-next.spec
index d8c9236..2166935 100644
--- a/bind9-next.spec
+++ b/bind9-next.spec
@@ -56,7 +56,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind9-next
 License:  MPL-2.0 AND ISC AND BSD-3-clause AND MIT AND BSD-2-clause
 #
-Version:  9.21.14
+Version:  9.21.17
 Release:  %autorelease
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
@@ -93,8 +93,6 @@ Patch3: bind-9.21-unittest-isc_rwlock-s390x.patch
 # https://gitlab.isc.org/isc-projects/bind9/-/issues/5328
 # avoid often fails on i386, unsupported upstream
 Patch4: bind-9.21-unittest-qpdb-i386.patch
-Patch5: bind-9.21-dual-sign-continue.patch
-Patch6: bind-9.21-dual-sign-continue-test.patch
 
 %{?systemd_ordering}
 Requires:       coreutils
diff --git a/sources b/sources
index 714e4db..5eede3e 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.21.14.tar.xz) = bf4bd0f5613d6c6d53f749f3269a34f3a5c74a7dc81e05922d58ba30f19d418e565838dd1182dd6052b9a62b3799d2d0f12451f2797af3279259df59cfc4be05
-SHA512 (bind-9.21.14.tar.xz.asc) = 91ccc82ca54d07dba07821c3410f92b563290ead48546d605b0dbd9958a831d9b90130002fbb325e0cdc913de64813d8ba4c48ec958ebba7f5f462d43f578394
+SHA512 (bind-9.21.17.tar.xz) = b53fcea8db7d1b4e8fba7055f175289a7d1e3380be77e0899986101ffc3ff9222be5bf249b8f0162b0c88b0b463f42b778fa11f3ed86f913e17cd62561c65063
+SHA512 (bind-9.21.17.tar.xz.asc) = 62e344ae5deae40c4f647f4b99bee56d63cc7be5dd882f24993771c537eb7817dd2a5d2b8f6396fd906df9ef11afb4c1f874f61bd25329f50f7ca952d508482c

From a6ae9a839ea14383b96d10c814d3793b0dbcd766 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 19 Jun 2024 20:41:31 +0200
Subject: [PATCH 21/22] Remove separate license subpackage

Move license to libs subpackage, it is required for everything except
documentation. Include license file in docs and bind-libs, avoid extra
package just for single file.
---
 bind9-next.spec | 14 +++-----------
 1 file changed, 3 insertions(+), 11 deletions(-)

diff --git a/bind9-next.spec b/bind9-next.spec
index 2166935..c7530b7 100644
--- a/bind9-next.spec
+++ b/bind9-next.spec
@@ -201,7 +201,8 @@ tools for verifying that the DNS server is operating properly.
 
 %package libs
 Summary: Libraries used by the BIND DNS packages
-Requires: %{name}-license = %{epoch}:%{version}-%{release}
+Provides: %{name}-license = %{epoch}:%{version}-%{release}
+Obsoletes: %{name}-license < 32:9.21.17-1
 Provides: %{name}-libs-lite = %{epoch}:%{version}-%{release}
 Obsoletes: %{name}-libs-lite < 32:9.16.13
 Obsoletes: %{name}-pkcs11-libs < 32:9.18.4-2
@@ -210,13 +211,6 @@ Obsoletes: %{name}-pkcs11-libs < 32:9.18.4-2
 Contains heavyweight version of BIND suite libraries used by both named DNS
 server and utilities in %{name}-utils package.
 
-%package license
-Summary:  License of the BIND DNS suite
-BuildArch:noarch
-
-%description license
-Contains license of the BIND DNS suite.
-
 %package utils
 Summary: Utilities for querying DNS name servers
 Requires: %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release}
@@ -296,7 +290,6 @@ Based on the code from Jan "Yenya" Kasprzak <kas@fi.muni.cz>
 %if %{with DOC}
 %package doc
 Summary:   BIND 9 Administrator Reference Manual
-Requires:  %{name}-license = %{epoch}:%{version}-%{release}
 Requires:  python3-sphinx_rtd_theme
 BuildArch: noarch
 
@@ -798,8 +791,6 @@ fi;
 %{_libdir}/libdns-%{version}*.so
 %{_libdir}/libisc-%{version}*.so
 %{_libdir}/libisccfg-%{version}*.so
-
-%files license
 %{!?_licensedir:%global license %%doc}
 %license COPYRIGHT
 
@@ -909,6 +900,7 @@ fi;
 %doc %{_pkgdocdir}/Bv9ARM.epub
 %doc %{_pkgdocdir}/changelog-history.rst*
 %doc %{_pkgdocdir}/notes-*.rst*
+%license COPYRIGHT
 %endif
 
 %changelog

From 36bbdbb7e32339b6eb4734ac7b2cbbe34b97a9ad Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 25 Mar 2026 19:36:24 +0100
Subject: [PATCH 22/22] Update to 9.21.20 (rhbz#2440560)

Security Fixes:

- Fix unbounded NSEC3 iterations when validating referrals to unsigned delegations. (CVE-2026-1519)
- Fix memory leaks in code preparing DNSSEC proofs of non-existence. (CVE-2026-3104)
- Prevent a crash in code processing queries containing a TKEY record. (CVE-2026-3119)
- Fix a stack use-after-return flaw in SIG(0) handling code. (CVE-2026-3591)

New Features:

- Provide response round-trip time (RTT) counters via statistics channel.
- Introduce max-delegation-servers configuration option.

Bug Fixes:

- Fix parsing key inactivation time in KASP code.
- Fix the handling of key statements defined inside views.

Source: https://downloads.isc.org/isc/bind9/9.21.20/doc/arm/html/notes.html#notes-for-bind-9-21-20
---
 bind9-next.spec | 4 +++-
 sources         | 4 ++--
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/bind9-next.spec b/bind9-next.spec
index c7530b7..20685fb 100644
--- a/bind9-next.spec
+++ b/bind9-next.spec
@@ -32,6 +32,8 @@
 %global        chroot_create_directories /dev /run/named %{_localstatedir}/{log,named,tmp} \\\
                                          %{_sysconfdir}/{crypto-policies/back-ends,pki/dnssec-keys,pki/tls,named} \\\
                                          %{_libdir}/bind %{_libdir}/named %{_datadir}/{GeoIP,dns-root-data} /proc/sys/net/ipv4
+%global        upstream_sources 0 2
+%global        pgp_signed_sources 2
 
 %global forgeurl0 https://gitlab.isc.org/isc-projects/bind9
 
@@ -56,7 +58,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind9-next
 License:  MPL-2.0 AND ISC AND BSD-3-clause AND MIT AND BSD-2-clause
 #
-Version:  9.21.17
+Version:  9.21.20
 Release:  %autorelease
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
diff --git a/sources b/sources
index 5eede3e..fa2afc0 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.21.17.tar.xz) = b53fcea8db7d1b4e8fba7055f175289a7d1e3380be77e0899986101ffc3ff9222be5bf249b8f0162b0c88b0b463f42b778fa11f3ed86f913e17cd62561c65063
-SHA512 (bind-9.21.17.tar.xz.asc) = 62e344ae5deae40c4f647f4b99bee56d63cc7be5dd882f24993771c537eb7817dd2a5d2b8f6396fd906df9ef11afb4c1f874f61bd25329f50f7ca952d508482c
+SHA512 (bind-9.21.20.tar.xz) = 4bd65612ff851720eba7f88495d51eb8a41b6a946c377b9dcd62f58f8c5a3e9338af44abc9df76b2ead9461eca4eb81f088619e3cc481f35fa0fc5d0926a93e3
+SHA512 (bind-9.21.20.tar.xz.asc) = 7431540d942fe23222b2812f9d80e67d0fa38516f9d536095a6544b156dc0306aba5752ba6c03cc2935d92a74860e70e8fc53b4cb481b8afe226e49dd51f695f