From 1f8fb8d255d8f3eaad837b2e30df3c91d7840a50 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 5 Jun 2025 20:06:32 +0200
Subject: [PATCH 01/64] Try limiting maximal tasks in unit tests

Limit also number of internal tasks to some smaller number.
---
 bind9-next.spec | 1 +
 1 file changed, 1 insertion(+)

diff --git a/bind9-next.spec b/bind9-next.spec
index f149a09..9648b66 100644
--- a/bind9-next.spec
+++ b/bind9-next.spec
@@ -443,6 +443,7 @@ export TSAN_OPTIONS="log_exe_name=true log_path=ThreadSanitizer exitcode=0"
   if [ "$CPUS" -gt 16 ]; then
     ORIGFILES=$(ulimit -n)
     THREADS=16
+    export ISC_TASK_WORKERS="$THREADS"
     ulimit -n 8092 || : # Requires on some machines with many cores
   fi
   echo "core.%%P" > /proc/sys/kernel/core_pattern || :

From ffc57d2dc5d288cf4c4fa187dc9e05b1c0420f65 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 5 Jun 2025 20:06:32 +0200
Subject: [PATCH 02/64] Try limiting maximal tasks in unit tests

Limit also number of internal tasks to some smaller number.

https://gitlab.isc.org/isc-projects/bind9/-/issues/5328
---
 bind9-next.spec | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/bind9-next.spec b/bind9-next.spec
index f149a09..aee73f2 100644
--- a/bind9-next.spec
+++ b/bind9-next.spec
@@ -443,6 +443,8 @@ export TSAN_OPTIONS="log_exe_name=true log_path=ThreadSanitizer exitcode=0"
   if [ "$CPUS" -gt 16 ]; then
     ORIGFILES=$(ulimit -n)
     THREADS=16
+    # https://gitlab.isc.org/isc-projects/bind9/-/issues/5328
+    export ISC_TASK_WORKERS="$THREADS"
     ulimit -n 8092 || : # Requires on some machines with many cores
   fi
   echo "core.%%P" > /proc/sys/kernel/core_pattern || :

From 07899c889d96f45ee7c48670f54ce892c57e27b0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 5 Jun 2025 20:12:44 +0200
Subject: [PATCH 03/64] Revert "Skip qpdb_test on some builders"

This reverts commit 7fe8c161383f2bb386cd9894f9a5013c46e5ba88.
---
 bind9-next.spec | 7 -------
 1 file changed, 7 deletions(-)

diff --git a/bind9-next.spec b/bind9-next.spec
index aee73f2..b8b3ca5 100644
--- a/bind9-next.spec
+++ b/bind9-next.spec
@@ -360,13 +360,6 @@ configure.ac
 sed -e 's/-W\s//' -i Makefile.docs
 %endif
 
-%if %{with UNITTEST}
-if grep 'Intel(R) Xeon(R) CPU E5-2670 v3' /proc/cpuinfo; then
-  echo "Detected builder troubling unit tests, skiping some"
-  # https://gitlab.isc.org/isc-projects/bind9/-/issues/5328
-  sed -i -e 's/\sqpdb_test//' tests/dns/Makefile.am
-fi
-%endif
 autoreconf --force --install
 
 mkdir build

From c2d352150279d13c440e4685cd8b747473f053b6 Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Wed, 23 Jul 2025 17:41:56 +0000
Subject: [PATCH 04/64] Rebuilt for
 https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild


From 3a608aabcf98728c302e098e28ff92a1e3d6c5f6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 30 Jul 2025 14:42:06 +0200
Subject: [PATCH 05/64] Update to 9.21.10 (rhbz#2380940)

Security Fixes:

- Fix a possible assertion failure when stale-answer-client-timeout is set to 0.

New Features:

- Add code paths to fully support PRIVATEDNS and PRIVATEOID keys.
- Add named-makejournal tool.
- Add support for the CO flag to dig.

https://downloads.isc.org/isc/bind9/9.21.10/doc/arm/html/notes.html#notes-for-bind-9-21-10
---
 bind9-next.spec | 2 +-
 sources         | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/bind9-next.spec b/bind9-next.spec
index b8b3ca5..732b92c 100644
--- a/bind9-next.spec
+++ b/bind9-next.spec
@@ -55,7 +55,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind9-next
 License:  MPL-2.0 AND ISC AND BSD-3-clause AND Expat AND BSD-2-clause
 #
-Version:  9.21.8
+Version:  9.21.10
 Release:  %autorelease
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
diff --git a/sources b/sources
index 06b6126..877f116 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.21.8.tar.xz) = 8fdba5fa9e8c4659119074b54477d22bfb7301f6244f8df8df9f4b45f0512374a071c0d0d3f0f8e06f668fa59aa8a56d269900b6f6431461a770f11e21443d19
-SHA512 (bind-9.21.8.tar.xz.asc) = c48d2e3607a4c346ff12be6da43a9103ab935058662a14bd20abe5193db8cdede38a52bc59a1ad45ff1264f72a6175c61266edab92df3a3771580fd20d0570fb
+SHA512 (bind-9.21.10.tar.xz) = fa814d43f0e7ec137617f0f2772ebd2e008a647d2158fa1a7765e38551506ee704cc1c6106d4c620b571d16d7cdecb40a8b03943aaeca29f984a3bf19c6205d2
+SHA512 (bind-9.21.10.tar.xz.asc) = 0f25cf6a74b3cc8df1b3c043e5aa2ad772001b2bf9aea0e3b48db2bc207b4508c2848bbe293d81b4cd82011284e5c73463a24ed489120dc9cfa59c4e7698120e

From 0982292286b13309c78a3cb1a953841272f6337b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 30 Jul 2025 16:39:27 +0200
Subject: [PATCH 06/64] Attempt to switch to meson build system

---
 bind9-next.spec | 83 ++++++++++++++++++++++++-------------------------
 1 file changed, 40 insertions(+), 43 deletions(-)

diff --git a/bind9-next.spec b/bind9-next.spec
index 732b92c..1a76d00 100644
--- a/bind9-next.spec
+++ b/bind9-next.spec
@@ -108,12 +108,20 @@ Recommends:     %{name}-utils %{name}-dnssec-utils
 Obsoletes:      %{name}-pkcs11 < 32:9.18.4-2
 Conflicts:      bind-dyndb-ldap
 
-BuildRequires:  gcc, make
-BuildRequires:  openssl-devel, libtool, autoconf, pkgconfig, libcap-devel
-BuildRequires:  libidn2-devel, libxml2-devel
+BuildRequires:  gcc
+BuildRequires:  make
+BuildRequires:  openssl-devel
+BuildRequires:  libtool
+BuildRequires:  meson
+BuildRequires:  ninja-build
+BuildRequires:  pkgconfig
+BuildRequires:  libcap-devel
+BuildRequires:  libidn2-devel
+BuildRequires:  libxml2-devel
 BuildRequires:  systemd-rpm-macros
 BuildRequires:  selinux-policy
-BuildRequires:  findutils sed
+BuildRequires:  findutils
+BuildRequires:  sed
 BuildRequires:  libnghttp2-devel
 BuildRequires:  userspace-rcu-devel
 # Compress the changelog
@@ -328,8 +336,6 @@ EOF
 
 
 %build
-## We use out of tree configure/build for export libs
-%define _configure "../configure"
 
 # normal and pkcs11 unit tests
 %define unit_prepare_build() \
@@ -351,48 +357,45 @@ CPPFLAGS="$CPPFLAGS -DOPENSSL_NO_ENGINE=1"
 export CFLAGS CPPFLAGS
 export STD_CDEFINES="$CPPFLAGS"
 
-sed -i -e \
-'s/([bind_VERSION_EXTRA],\s*\([^)]*\))/([bind_VERSION_EXTRA], \1-RH)/' \
-configure.ac
+#sed -i -e \
+#'s/([bind_VERSION_EXTRA],\s*\([^)]*\))/([bind_VERSION_EXTRA], \1-RH)/' \
+#configure.ac
 
 %if 0%{?rhel} && 0%{?rhel} < 9
 # disable Sphinx warnings as errors, epel8 does not pass cleanly
 sed -e 's/-W\s//' -i Makefile.docs
 %endif
 
-autoreconf --force --install
 
-mkdir build
-
-pushd build
 LIBDIR_SUFFIX=
 export LIBDIR_SUFFIX
-%configure \
-  --with-pic \
-  --disable-static \
+
+%meson \
   --includedir=%{_includedir}/bind9 \
-  --with-libidn2 \
+  -Didn=enabled \
 %if %{with GEOIP2}
-  --with-maxminddb \
+  -Dgeoip=enabled \
 %endif
 %if %{with GSSTSIG}
-  --with-gssapi=yes \
+  -Dgssapi=enabled \
 %endif
 %if %{with LMDB}
-  --with-lmdb=yes \
+  -Dlmdb=enabled \
 %else
-  --with-lmdb=no \
+  -Dlmdb=disabled \
 %endif
 %if %{with JSON}
-  --with-json-c \
+  -Dstats-json=enabled \
 %endif
 %if %{with DNSTAP}
-  --enable-dnstap \
+  -Ddnstap=enabled \
 %endif
 %if %{with UNITTEST}
-  --with-cmocka \
+  -Dcmocka=enabled \
+%endif
+%if %{with DOC}
+  -Ddoc=enabled \
 %endif
-  --enable-full-report \
 ;
 %if %{with DNSTAP}
   pushd lib
@@ -401,19 +404,17 @@ export LIBDIR_SUFFIX
   popd
 %endif
 
-%make_build SPHINX_W=''
+%meson_build
 
 %if %{with DOC}
-  %make_build doc SPHINX_W=''
+  %meson_build man arm arm-epub
 %endif
 
-popd # build
-
 # Compress changelog by default
 gzip doc/changelog/changelog-*.rst
 
-%unit_prepare_build build
-%systemtest_prepare_build build
+#unit_prepare_build build
+#systemtest_prepare_build build
 
 %check
 %if %{with UNITTEST} || %{with SYSTEMTEST}
@@ -426,7 +427,6 @@ export TSAN_OPTIONS="log_exe_name=true log_path=ThreadSanitizer exitcode=0"
 %endif
 
 %if %{with UNITTEST}
-  pushd build
   CPUS=$(lscpu -p=cpu,core | grep -v '^#' | wc -l)
   THREADS="$CPUS"
   COREPATTERN="$(cat /proc/sys/kernel/core_pattern)"
@@ -442,7 +442,7 @@ export TSAN_OPTIONS="log_exe_name=true log_path=ThreadSanitizer exitcode=0"
   fi
   echo "core.%%P" > /proc/sys/kernel/core_pattern || :
   e=0
-  %make_build unit -j${THREADS} || e=$?
+  %meson_build unit -j${THREADS} || e=$?
   # Display details of failure
   cat tests/*/test-suite.log
 
@@ -461,7 +461,6 @@ export TSAN_OPTIONS="log_exe_name=true log_path=ThreadSanitizer exitcode=0"
     exit $e;
   fi;
   [ "$CPUS" -gt 16 ] && ulimit -n $ORIGFILES || :
-  popd
 ## End of UNITTEST
 %endif
 
@@ -469,7 +468,7 @@ export TSAN_OPTIONS="log_exe_name=true log_path=ThreadSanitizer exitcode=0"
 # Runs system test if ip addresses are already configured
 # or it is able to configure them
   SUDO=
-  pushd build/bin/tests/system/
+  pushd bin/tests/system/
   if perl ./testsock.pl
   then
     CONFIGURED=already
@@ -490,10 +489,10 @@ export TSAN_OPTIONS="log_exe_name=true log_path=ThreadSanitizer exitcode=0"
   if [ -n "$CONFIGURED" ]
   then
     set -e
-    pushd build/bin/tests
+    pushd bin/tests
     export CI_SYSTEM=yes # allow running tests as root
     chown -R ${USER} . # Can be unknown user
-    %make_build test 2>&1 | tee test.log
+    %meson_build test 2>&1 | tee test.log
     e=$?
     [ "$CONFIGURED" = build ] && $SUDO sh ./ifconfig.sh down
     popd
@@ -531,9 +530,7 @@ popd
 touch ${RPM_BUILD_ROOT}/%{chroot_prefix}%{_sysconfdir}/named.conf
 #end chroot
 
-pushd build
-%make_install
-popd
+%meson_install
 
 # Remove unwanted files
 rm -f ${RPM_BUILD_ROOT}/etc/bind.keys
@@ -580,8 +577,8 @@ popd
 
 %if %{with DOC}
 mkdir -p ${RPM_BUILD_ROOT}%{_pkgdocdir}
-cp -a build/doc/arm/_build/html ${RPM_BUILD_ROOT}%{_pkgdocdir}
-rm -rf ${RPM_BUILD_ROOT}%{_pkgdocdir}/html/.{buildinfo,doctrees}
+#cp -a doc/arm/_build/html ${RPM_BUILD_ROOT}%{_pkgdocdir}
+#rm -rf ${RPM_BUILD_ROOT}%{_pkgdocdir}/html/.{buildinfo,doctrees}
 # Backward compatible link to 9.11 documentation
 (cd ${RPM_BUILD_ROOT}%{_pkgdocdir} && ln -s html/index.html Bv9ARM.html)
 # Share static data from original sphinx package
@@ -594,7 +591,7 @@ do
     ln -sr "${RPM_BUILD_ROOT}${DIR}" "$BINDTHEMEDIR"
   fi
 done
-cp -p build/doc/arm/_build/epub/Bv9ARM.epub ${RPM_BUILD_ROOT}%{_pkgdocdir}
+#cp -p doc/arm/_build/epub/Bv9ARM.epub ${RPM_BUILD_ROOT}%{_pkgdocdir}
 %endif
 
 # Ghost config files:

From 7d2341cfb7bc15c79a5f7aea4fb5c41750e608c7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 31 Jul 2025 20:45:46 +0200
Subject: [PATCH 07/64] WIP: Pass meson build and test

Install phase not yet solved.
---
 bind9-next.spec | 23 ++++++++---------------
 1 file changed, 8 insertions(+), 15 deletions(-)

diff --git a/bind9-next.spec b/bind9-next.spec
index 1a76d00..9e5f3cd 100644
--- a/bind9-next.spec
+++ b/bind9-next.spec
@@ -122,8 +122,10 @@ BuildRequires:  systemd-rpm-macros
 BuildRequires:  selinux-policy
 BuildRequires:  findutils
 BuildRequires:  sed
+#BuildRequires:  systemtap
 BuildRequires:  libnghttp2-devel
 BuildRequires:  userspace-rcu-devel
+BuildRequires:  pkgconfig(libedit)
 # Compress the changelog
 BuildRequires:  gzip
 %if 0%{?fedora}
@@ -334,6 +336,9 @@ g named %{bind_gid}
 u named %{bind_uid} 'Named' /var/named -
 EOF
 
+# get rid of rpath issues
+sed -e '/install_rpath:/ d' -i meson.build
+
 
 %build
 
@@ -373,6 +378,7 @@ export LIBDIR_SUFFIX
 %meson \
   --includedir=%{_includedir}/bind9 \
   -Didn=enabled \
+  -Dtracing=disabled \
 %if %{with GEOIP2}
   -Dgeoip=enabled \
 %endif
@@ -440,24 +446,11 @@ export TSAN_OPTIONS="log_exe_name=true log_path=ThreadSanitizer exitcode=0"
     export ISC_TASK_WORKERS="$THREADS"
     ulimit -n 8092 || : # Requires on some machines with many cores
   fi
-  echo "core.%%P" > /proc/sys/kernel/core_pattern || :
   e=0
-  %meson_build unit -j${THREADS} || e=$?
-  # Display details of failure
-  cat tests/*/test-suite.log
+  %meson_test --num-processes ${THREADS} || e=$?
 
-  echo "$COREPATTERN" > /proc/sys/kernel/core_pattern || :
   if [ "$e" -ne 0 ]; then
-    echo "ERROR: this build of BIND failed 'make unit'. Aborting."
-    for CORE in $(find -name 'core.*'); do
-      echo "# Found core: $CORE"
-      gdb --batch -ex 'bt full' -c "$CORE"
-      echo
-      xz -k "$CORE"
-      echo "# core base64 begin: $CORE"
-      base64 "$CORE.xz"
-      echo "# core base64 end: $CORE"
-    done
+    echo "ERROR: test failed. Aborting."
     exit $e;
   fi;
   [ "$CPUS" -gt 16 ] && ulimit -n $ORIGFILES || :

From b2f0d0c0cff12bb010b1da62a374478d2a08bfa8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 31 Jul 2025 21:13:20 +0200
Subject: [PATCH 08/64] Make versioned libraries

Devel package not yet solved.
---
 bind9-next.spec  |  2 ++
 meson-libs.patch | 62 ++++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 64 insertions(+)
 create mode 100644 meson-libs.patch

diff --git a/bind9-next.spec b/bind9-next.spec
index 9e5f3cd..9f6f89c 100644
--- a/bind9-next.spec
+++ b/bind9-next.spec
@@ -96,6 +96,8 @@ Patch3: bind-9.21-unittest-isc_rwlock-s390x.patch
 # https://gitlab.isc.org/isc-projects/bind9/-/issues/5328
 # avoid often fails on i386, unsupported upstream
 Patch4: bind-9.21-unittest-qpdb-i386.patch
+# Downstream patch to include version in libraries
+Patch5: meson-libs.patch
 
 %{?systemd_ordering}
 Requires:       coreutils
diff --git a/meson-libs.patch b/meson-libs.patch
new file mode 100644
index 0000000..4ba0723
--- /dev/null
+++ b/meson-libs.patch
@@ -0,0 +1,62 @@
+From 0e03b4c1c4fed5b149969b25df2bc6b45a089b79 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
+Date: Thu, 31 Jul 2025 20:54:08 +0200
+Subject: [PATCH] Add version to shared libraries
+
+Allow coexistence of different bind libraries and utilities by it.
+---
+ meson.build | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/meson.build b/meson.build
+index 432af24..dac4212 100644
+--- a/meson.build
++++ b/meson.build
+@@ -957,7 +957,7 @@ subdir('util')
+ isc_srcconf = isc_srcset.apply(config, strict: false)
+ 
+ libisc = library(
+-    'isc',
++    'isc-'+meson.project_version(),
+     isc_srcconf.sources(),
+     objects: isc_probe_objects,
+     install: true,
+@@ -984,7 +984,7 @@ libisc_dep = declare_dependency(
+ dns_srcconf = dns_srcset.apply(config, strict: false)
+ 
+ libdns = library(
+-    'dns',
++    'dns-'+meson.project_version(),
+     dns_srcconf.sources(),
+     include_directories: dns_inc,
+     install: true,
+@@ -1018,7 +1018,7 @@ libdns_dep = declare_dependency(
+ ns_srcconf = ns_srcset.apply(config, strict: false)
+ 
+ libns = library(
+-    'ns',
++    'ns-'+meson.project_version(),
+     ns_srcconf.sources(),
+     objects: ns_probe_objects,
+     install: true,
+@@ -1044,7 +1044,7 @@ libns_dep = declare_dependency(
+ isccc_srcconf = isccc_srcset.apply(config, strict: false)
+ 
+ libisccc = library(
+-    'isccc',
++    'isccc-'+meson.project_version(),
+     isccc_srcconf.sources(),
+     implicit_include_directories: false,
+     include_directories: isccc_inc,
+@@ -1065,7 +1065,7 @@ libisccc_dep = declare_dependency(
+ isccfg_srcconf = isccfg_srcset.apply(config, strict: false)
+ 
+ libisccfg = library(
+-    'isccfg',
++    'isccfg-'+meson.project_version(),
+     isccfg_srcconf.sources(),
+     implicit_include_directories: false,
+     include_directories: isccfg_inc,
+-- 
+2.50.1
+

From 75731f5eabcd2d4e0c11493bfbea66b71f9380ac Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 5 Sep 2025 17:25:14 +0200
Subject: [PATCH 09/64] Use smarter action on lograte script

BIND 9.21 has rndc closelogs action, which just reopens logs and nothing
more. Use that from logrotate. Skip this action if the log is empty.
---
 named.logrotate | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/named.logrotate b/named.logrotate
index 5df448f..17f41d9 100644
--- a/named.logrotate
+++ b/named.logrotate
@@ -2,11 +2,8 @@
     missingok
     su named named
     create 0644 named named
+    notifempty
     postrotate
-        /usr/bin/systemctl reload named.service > /dev/null 2>&1 || true
-        /usr/bin/systemctl reload named-chroot.service > /dev/null 2>&1 || true
-        /usr/bin/systemctl reload named-sdb.service > /dev/null 2>&1 || true
-        /usr/bin/systemctl reload named-sdb-chroot.service > /dev/null 2>&1 || true
-        /usr/bin/systemctl reload named-pkcs11.service > /dev/null 2>&1 || true
+        /usr/bin/rndc closelogs > /dev/null 2>&1 || true
     endscript
 }

From 2a3d8b5d6ce2aeb230b380379d8b81f78b0d2ef7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 5 Sep 2025 18:02:20 +0200
Subject: [PATCH 10/64] Disable devel package and fix doc building

---
 bind9-next.spec | 19 ++++++++++++++-----
 1 file changed, 14 insertions(+), 5 deletions(-)

diff --git a/bind9-next.spec b/bind9-next.spec
index 9f6f89c..0ede6b6 100644
--- a/bind9-next.spec
+++ b/bind9-next.spec
@@ -572,7 +572,8 @@ popd
 
 %if %{with DOC}
 mkdir -p ${RPM_BUILD_ROOT}%{_pkgdocdir}
-#cp -a doc/arm/_build/html ${RPM_BUILD_ROOT}%{_pkgdocdir}
+pushd %{_vpath_builddir}
+cp -a arm/ ${RPM_BUILD_ROOT}%{_pkgdocdir}/html/
 #rm -rf ${RPM_BUILD_ROOT}%{_pkgdocdir}/html/.{buildinfo,doctrees}
 # Backward compatible link to 9.11 documentation
 (cd ${RPM_BUILD_ROOT}%{_pkgdocdir} && ln -s html/index.html Bv9ARM.html)
@@ -586,7 +587,10 @@ do
     ln -sr "${RPM_BUILD_ROOT}${DIR}" "$BINDTHEMEDIR"
   fi
 done
-#cp -p doc/arm/_build/epub/Bv9ARM.epub ${RPM_BUILD_ROOT}%{_pkgdocdir}
+cp -p arm-epub/Bv9ARM.epub ${RPM_BUILD_ROOT}%{_pkgdocdir}
+popd
+cp -p doc/changelog/changelog-history.rst* doc/notes/notes-*.rst* \
+      ${RPM_BUILD_ROOT}%{_pkgdocdir}
 %endif
 
 # Ghost config files:
@@ -732,6 +736,7 @@ fi;
 %{_bindir}/named-journalprint
 %{_bindir}/named-checkconf
 %{_bindir}/named-rrchecker
+%{_bindir}/named-makejournal
 %{_bindir}/mdig
 %{_sbindir}/named
 %{_sbindir}/rndc*
@@ -749,7 +754,8 @@ fi;
 %{_mandir}/man1/named-checkconf.1*
 %{_mandir}/man8/rndc-confgen.8*
 %{_mandir}/man1/named-journalprint.1*
-%{_mandir}/man8/filter-*.8.gz
+#{_mandir}/man1/named-makejournal.1*
+%{_mandir}/man8/filter-*.8*
 %doc README.md named.conf.default
 %doc doc/changelog/changelog-9.*.rst*
 %doc sample/
@@ -831,6 +837,8 @@ fi;
 %{_bindir}/dnssec*
 %{_mandir}/man1/dnssec*.1*
 
+%if 0
+# TODO: remove devel subpackage or create custom installation part
 %files devel
 %{_libdir}/libisccc.so
 %{_libdir}/libns.so
@@ -845,6 +853,7 @@ fi;
 %{_includedir}/bind9/irs
 %{_includedir}/bind9/isc
 %{_includedir}/bind9/isccfg
+%endif
 
 %files chroot
 %config(noreplace) %{_sysconfdir}/named-chroot.files
@@ -891,8 +900,8 @@ fi;
 %doc %{_pkgdocdir}/html
 %doc %{_pkgdocdir}/Bv9ARM.html
 %doc %{_pkgdocdir}/Bv9ARM.epub
-%doc doc/changelog/changelog-history.rst*
-%doc doc/notes/notes-*.rst*
+%doc %{_pkgdocdir}/changelog-history.rst*
+%doc %{_pkgdocdir}/notes-*.rst*
 %endif
 
 %changelog

From f903cdb74079742b2f9765437d8a09951fb04c7a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 5 Sep 2025 18:04:49 +0200
Subject: [PATCH 11/64] Update to 9.21.11

New Features:

- Support for parsing DSYNC records has been added.

Feature changes:

- Reword the shut down hung fetch while resolving message.
- Plugin extension in plugin path is now optional.
- Add deprecation warnings for RSASHA1, RSASHA1-NSEC3SHA1, and DS digest type 1.

And multiple bug fixes.

https://downloads.isc.org/isc/bind9/9.21.11/doc/arm/html/notes.html#notes-for-bind-9-21-11
---
 bind-9.21-unittest-qpdb-i386.patch | 24 +++++++++++-------------
 bind9-next.spec                    |  4 ++--
 sources                            |  4 ++--
 3 files changed, 15 insertions(+), 17 deletions(-)

diff --git a/bind-9.21-unittest-qpdb-i386.patch b/bind-9.21-unittest-qpdb-i386.patch
index 1701ded..7c84880 100644
--- a/bind-9.21-unittest-qpdb-i386.patch
+++ b/bind-9.21-unittest-qpdb-i386.patch
@@ -1,15 +1,15 @@
-From 574db9dac1c4bd6b19da887a58da1126e336b9e5 Mon Sep 17 00:00:00 2001
+From af1e4bf375000fc532c55ff6df841661185a2451 Mon Sep 17 00:00:00 2001
 From: Petr Mensik <pemensik@redhat.com>
 Date: Wed, 28 May 2025 19:40:05 +0200
 Subject: [PATCH] Try rcu_barrier
 
 https://gitlab.isc.org/isc-projects/bind9/-/issues/5328
 ---
- tests/dns/qpdb_test.c | 5 +++++
- 1 file changed, 5 insertions(+)
+ tests/dns/qpdb_test.c | 3 +++
+ 1 file changed, 3 insertions(+)
 
 diff --git a/tests/dns/qpdb_test.c b/tests/dns/qpdb_test.c
-index 4b1de18..a11af52 100644
+index 1c840e2..b6ad0f4 100644
 --- a/tests/dns/qpdb_test.c
 +++ b/tests/dns/qpdb_test.c
 @@ -24,6 +24,7 @@
@@ -20,24 +20,22 @@ index 4b1de18..a11af52 100644
  #include <isc/util.h>
  
  #include <dns/lib.h>
-@@ -170,6 +171,8 @@ ISC_LOOP_TEST_IMPL(overmempurge_bigrdata) {
+@@ -170,6 +171,7 @@ ISC_LOOP_TEST_IMPL(overmempurge_bigrdata) {
  
  	dns_db_detach(&db);
- 	isc_mem_detach(&mctx2);
-+
+ 	isc_mem_detach(&mctx);
 +	rcu_barrier();
- 	isc_loopmgr_shutdown(loopmgr);
+ 	isc_loopmgr_shutdown();
  }
  
-@@ -221,6 +224,8 @@ ISC_LOOP_TEST_IMPL(overmempurge_longname) {
+@@ -221,6 +223,7 @@ ISC_LOOP_TEST_IMPL(overmempurge_longname) {
  
  	dns_db_detach(&db);
- 	isc_mem_detach(&mctx2);
-+
+ 	isc_mem_detach(&mctx);
 +	rcu_barrier();
- 	isc_loopmgr_shutdown(loopmgr);
+ 	isc_loopmgr_shutdown();
  }
  
 -- 
-2.49.0
+2.51.0
 
diff --git a/bind9-next.spec b/bind9-next.spec
index 0ede6b6..5ff8976 100644
--- a/bind9-next.spec
+++ b/bind9-next.spec
@@ -55,7 +55,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind9-next
 License:  MPL-2.0 AND ISC AND BSD-3-clause AND Expat AND BSD-2-clause
 #
-Version:  9.21.10
+Version:  9.21.11
 Release:  %autorelease
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
@@ -754,7 +754,7 @@ fi;
 %{_mandir}/man1/named-checkconf.1*
 %{_mandir}/man8/rndc-confgen.8*
 %{_mandir}/man1/named-journalprint.1*
-#{_mandir}/man1/named-makejournal.1*
+%{_mandir}/man1/named-makejournal.1*
 %{_mandir}/man8/filter-*.8*
 %doc README.md named.conf.default
 %doc doc/changelog/changelog-9.*.rst*
diff --git a/sources b/sources
index 877f116..d12b4a2 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.21.10.tar.xz) = fa814d43f0e7ec137617f0f2772ebd2e008a647d2158fa1a7765e38551506ee704cc1c6106d4c620b571d16d7cdecb40a8b03943aaeca29f984a3bf19c6205d2
-SHA512 (bind-9.21.10.tar.xz.asc) = 0f25cf6a74b3cc8df1b3c043e5aa2ad772001b2bf9aea0e3b48db2bc207b4508c2848bbe293d81b4cd82011284e5c73463a24ed489120dc9cfa59c4e7698120e
+SHA512 (bind-9.21.11.tar.xz) = dc4a20fc063b6dcec18d5241117eeb741a1e9e8f9e0bdac2743458b87de6a5496fff1e610c3c0676ae65e76b2741c86badb83df5b9278df8595194687359b5d6
+SHA512 (bind-9.21.11.tar.xz.asc) = 25ada3e81c3f60665f0b7f8ef24ba6e81ebd85627126e03ffcfecb02c78aa3f309fc25dce258495c1f5087072f0abad8932b2cd009f85180a27a9bd5f8ed6e80

From 602ce8cc76f3fb41cb335aa343c6b9ce5e7551e6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 5 Sep 2025 18:29:26 +0200
Subject: [PATCH 12/64] Try fixing i686 platform

---
 bind9-next.spec | 17 -----------------
 1 file changed, 17 deletions(-)

diff --git a/bind9-next.spec b/bind9-next.spec
index 5ff8976..74bffb7 100644
--- a/bind9-next.spec
+++ b/bind9-next.spec
@@ -318,18 +318,6 @@ in HTML and PDF format.
 %endif
 %autosetup -n %{upname}-%{version} -p1
 
-# Sparc and s390 arches need to use -fPIE
-%ifarch sparcv9 sparc64 s390 s390x
-for i in bin/named/Makefile.am; do
-  sed -i 's|fpie|fPIE|g' $i
-done
-%endif
-
-%ifarch %{ix86}
-# f40 FTBFS on quota_test, bug #2261010
-  sed -e '/^\s*quota_test/ d' -i tests/isc/Makefile.am
-%endif
-
 :;
 
 # Create a sysusers.d config file
@@ -368,11 +356,6 @@ export STD_CDEFINES="$CPPFLAGS"
 #'s/([bind_VERSION_EXTRA],\s*\([^)]*\))/([bind_VERSION_EXTRA], \1-RH)/' \
 #configure.ac
 
-%if 0%{?rhel} && 0%{?rhel} < 9
-# disable Sphinx warnings as errors, epel8 does not pass cleanly
-sed -e 's/-W\s//' -i Makefile.docs
-%endif
-
 
 LIBDIR_SUFFIX=
 export LIBDIR_SUFFIX

From 1b3cc2301226db467215d4c37de22a7fccd6ba35 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 5 Sep 2025 18:48:00 +0200
Subject: [PATCH 13/64] Reenable systemtap and dtrace

These are enabled by default, just provide dependencies to pass
automatic test.
---
 bind9-next.spec | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/bind9-next.spec b/bind9-next.spec
index 74bffb7..618986f 100644
--- a/bind9-next.spec
+++ b/bind9-next.spec
@@ -124,7 +124,6 @@ BuildRequires:  systemd-rpm-macros
 BuildRequires:  selinux-policy
 BuildRequires:  findutils
 BuildRequires:  sed
-#BuildRequires:  systemtap
 BuildRequires:  libnghttp2-devel
 BuildRequires:  userspace-rcu-devel
 BuildRequires:  pkgconfig(libedit)
@@ -187,7 +186,9 @@ BuildRequires: libtsan
 %endif
 %if %{with DTRACE}
 # https://gitlab.isc.org/isc-projects/bind9/-/issues/4041
-BuildRequires: systemtap-sdt-devel
+BuildRequires:  systemtap
+BuildRequires:  systemtap-sdt-devel
+BuildRequires:  systemtap-sdt-dtrace
 %endif
 
 %description
@@ -363,7 +364,9 @@ export LIBDIR_SUFFIX
 %meson \
   --includedir=%{_includedir}/bind9 \
   -Didn=enabled \
+%if %{without DTRACE}
   -Dtracing=disabled \
+%endif
 %if %{with GEOIP2}
   -Dgeoip=enabled \
 %endif

From bf9234893ddad754cf0b06271ab745058dad9909 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 5 Sep 2025 19:45:43 +0200
Subject: [PATCH 14/64] Replace Expat license with MIT

---
 bind9-next.spec | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/bind9-next.spec b/bind9-next.spec
index 618986f..39e1677 100644
--- a/bind9-next.spec
+++ b/bind9-next.spec
@@ -53,7 +53,7 @@ Conflicts: %1 \
 
 Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
 Name:     bind9-next
-License:  MPL-2.0 AND ISC AND BSD-3-clause AND Expat AND BSD-2-clause
+License:  MPL-2.0 AND ISC AND BSD-3-clause AND MIT AND BSD-2-clause
 #
 Version:  9.21.11
 Release:  %autorelease

From d44dce14123d6d10fa755db5b6914d699b0bec5b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 5 Jun 2025 20:12:44 +0200
Subject: [PATCH 15/64] Revert "Skip qpdb_test on some builders"

This reverts commit 7fe8c161383f2bb386cd9894f9a5013c46e5ba88.

(cherry picked from commit 07899c889d96f45ee7c48670f54ce892c57e27b0)
---
 bind9-next.spec | 7 -------
 1 file changed, 7 deletions(-)

diff --git a/bind9-next.spec b/bind9-next.spec
index 9648b66..f715a34 100644
--- a/bind9-next.spec
+++ b/bind9-next.spec
@@ -360,13 +360,6 @@ configure.ac
 sed -e 's/-W\s//' -i Makefile.docs
 %endif
 
-%if %{with UNITTEST}
-if grep 'Intel(R) Xeon(R) CPU E5-2670 v3' /proc/cpuinfo; then
-  echo "Detected builder troubling unit tests, skiping some"
-  # https://gitlab.isc.org/isc-projects/bind9/-/issues/5328
-  sed -i -e 's/\sqpdb_test//' tests/dns/Makefile.am
-fi
-%endif
 autoreconf --force --install
 
 mkdir build

From 6286528f8094be4a8e472b60860fe0c7ea50be5b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 30 Jul 2025 14:42:06 +0200
Subject: [PATCH 16/64] Update to 9.21.10 (rhbz#2380940)

Security Fixes:

- Fix a possible assertion failure when stale-answer-client-timeout is set to 0.

New Features:

- Add code paths to fully support PRIVATEDNS and PRIVATEOID keys.
- Add named-makejournal tool.
- Add support for the CO flag to dig.

https://downloads.isc.org/isc/bind9/9.21.10/doc/arm/html/notes.html#notes-for-bind-9-21-10
---
 bind9-next.spec | 2 +-
 sources         | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/bind9-next.spec b/bind9-next.spec
index f715a34..ab06bc7 100644
--- a/bind9-next.spec
+++ b/bind9-next.spec
@@ -55,7 +55,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind9-next
 License:  MPL-2.0 AND ISC AND BSD-3-clause AND Expat AND BSD-2-clause
 #
-Version:  9.21.8
+Version:  9.21.10
 Release:  %autorelease
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
diff --git a/sources b/sources
index 06b6126..877f116 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.21.8.tar.xz) = 8fdba5fa9e8c4659119074b54477d22bfb7301f6244f8df8df9f4b45f0512374a071c0d0d3f0f8e06f668fa59aa8a56d269900b6f6431461a770f11e21443d19
-SHA512 (bind-9.21.8.tar.xz.asc) = c48d2e3607a4c346ff12be6da43a9103ab935058662a14bd20abe5193db8cdede38a52bc59a1ad45ff1264f72a6175c61266edab92df3a3771580fd20d0570fb
+SHA512 (bind-9.21.10.tar.xz) = fa814d43f0e7ec137617f0f2772ebd2e008a647d2158fa1a7765e38551506ee704cc1c6106d4c620b571d16d7cdecb40a8b03943aaeca29f984a3bf19c6205d2
+SHA512 (bind-9.21.10.tar.xz.asc) = 0f25cf6a74b3cc8df1b3c043e5aa2ad772001b2bf9aea0e3b48db2bc207b4508c2848bbe293d81b4cd82011284e5c73463a24ed489120dc9cfa59c4e7698120e

From 14089f422f7a323bcec647e971e83a272c58bdb7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 30 Jul 2025 16:39:27 +0200
Subject: [PATCH 17/64] Attempt to switch to meson build system

---
 bind9-next.spec | 83 ++++++++++++++++++++++++-------------------------
 1 file changed, 40 insertions(+), 43 deletions(-)

diff --git a/bind9-next.spec b/bind9-next.spec
index ab06bc7..d9f320f 100644
--- a/bind9-next.spec
+++ b/bind9-next.spec
@@ -108,12 +108,20 @@ Recommends:     %{name}-utils %{name}-dnssec-utils
 Obsoletes:      %{name}-pkcs11 < 32:9.18.4-2
 Conflicts:      bind-dyndb-ldap
 
-BuildRequires:  gcc, make
-BuildRequires:  openssl-devel, libtool, autoconf, pkgconfig, libcap-devel
-BuildRequires:  libidn2-devel, libxml2-devel
+BuildRequires:  gcc
+BuildRequires:  make
+BuildRequires:  openssl-devel
+BuildRequires:  libtool
+BuildRequires:  meson
+BuildRequires:  ninja-build
+BuildRequires:  pkgconfig
+BuildRequires:  libcap-devel
+BuildRequires:  libidn2-devel
+BuildRequires:  libxml2-devel
 BuildRequires:  systemd-rpm-macros
 BuildRequires:  selinux-policy
-BuildRequires:  findutils sed
+BuildRequires:  findutils
+BuildRequires:  sed
 BuildRequires:  libnghttp2-devel
 BuildRequires:  userspace-rcu-devel
 # Compress the changelog
@@ -328,8 +336,6 @@ EOF
 
 
 %build
-## We use out of tree configure/build for export libs
-%define _configure "../configure"
 
 # normal and pkcs11 unit tests
 %define unit_prepare_build() \
@@ -351,48 +357,45 @@ CPPFLAGS="$CPPFLAGS -DOPENSSL_NO_ENGINE=1"
 export CFLAGS CPPFLAGS
 export STD_CDEFINES="$CPPFLAGS"
 
-sed -i -e \
-'s/([bind_VERSION_EXTRA],\s*\([^)]*\))/([bind_VERSION_EXTRA], \1-RH)/' \
-configure.ac
+#sed -i -e \
+#'s/([bind_VERSION_EXTRA],\s*\([^)]*\))/([bind_VERSION_EXTRA], \1-RH)/' \
+#configure.ac
 
 %if 0%{?rhel} && 0%{?rhel} < 9
 # disable Sphinx warnings as errors, epel8 does not pass cleanly
 sed -e 's/-W\s//' -i Makefile.docs
 %endif
 
-autoreconf --force --install
 
-mkdir build
-
-pushd build
 LIBDIR_SUFFIX=
 export LIBDIR_SUFFIX
-%configure \
-  --with-pic \
-  --disable-static \
+
+%meson \
   --includedir=%{_includedir}/bind9 \
-  --with-libidn2 \
+  -Didn=enabled \
 %if %{with GEOIP2}
-  --with-maxminddb \
+  -Dgeoip=enabled \
 %endif
 %if %{with GSSTSIG}
-  --with-gssapi=yes \
+  -Dgssapi=enabled \
 %endif
 %if %{with LMDB}
-  --with-lmdb=yes \
+  -Dlmdb=enabled \
 %else
-  --with-lmdb=no \
+  -Dlmdb=disabled \
 %endif
 %if %{with JSON}
-  --with-json-c \
+  -Dstats-json=enabled \
 %endif
 %if %{with DNSTAP}
-  --enable-dnstap \
+  -Ddnstap=enabled \
 %endif
 %if %{with UNITTEST}
-  --with-cmocka \
+  -Dcmocka=enabled \
+%endif
+%if %{with DOC}
+  -Ddoc=enabled \
 %endif
-  --enable-full-report \
 ;
 %if %{with DNSTAP}
   pushd lib
@@ -401,19 +404,17 @@ export LIBDIR_SUFFIX
   popd
 %endif
 
-%make_build SPHINX_W=''
+%meson_build
 
 %if %{with DOC}
-  %make_build doc SPHINX_W=''
+  %meson_build man arm arm-epub
 %endif
 
-popd # build
-
 # Compress changelog by default
 gzip doc/changelog/changelog-*.rst
 
-%unit_prepare_build build
-%systemtest_prepare_build build
+#unit_prepare_build build
+#systemtest_prepare_build build
 
 %check
 %if %{with UNITTEST} || %{with SYSTEMTEST}
@@ -426,7 +427,6 @@ export TSAN_OPTIONS="log_exe_name=true log_path=ThreadSanitizer exitcode=0"
 %endif
 
 %if %{with UNITTEST}
-  pushd build
   CPUS=$(lscpu -p=cpu,core | grep -v '^#' | wc -l)
   THREADS="$CPUS"
   COREPATTERN="$(cat /proc/sys/kernel/core_pattern)"
@@ -441,7 +441,7 @@ export TSAN_OPTIONS="log_exe_name=true log_path=ThreadSanitizer exitcode=0"
   fi
   echo "core.%%P" > /proc/sys/kernel/core_pattern || :
   e=0
-  %make_build unit -j${THREADS} || e=$?
+  %meson_build unit -j${THREADS} || e=$?
   # Display details of failure
   cat tests/*/test-suite.log
 
@@ -460,7 +460,6 @@ export TSAN_OPTIONS="log_exe_name=true log_path=ThreadSanitizer exitcode=0"
     exit $e;
   fi;
   [ "$CPUS" -gt 16 ] && ulimit -n $ORIGFILES || :
-  popd
 ## End of UNITTEST
 %endif
 
@@ -468,7 +467,7 @@ export TSAN_OPTIONS="log_exe_name=true log_path=ThreadSanitizer exitcode=0"
 # Runs system test if ip addresses are already configured
 # or it is able to configure them
   SUDO=
-  pushd build/bin/tests/system/
+  pushd bin/tests/system/
   if perl ./testsock.pl
   then
     CONFIGURED=already
@@ -489,10 +488,10 @@ export TSAN_OPTIONS="log_exe_name=true log_path=ThreadSanitizer exitcode=0"
   if [ -n "$CONFIGURED" ]
   then
     set -e
-    pushd build/bin/tests
+    pushd bin/tests
     export CI_SYSTEM=yes # allow running tests as root
     chown -R ${USER} . # Can be unknown user
-    %make_build test 2>&1 | tee test.log
+    %meson_build test 2>&1 | tee test.log
     e=$?
     [ "$CONFIGURED" = build ] && $SUDO sh ./ifconfig.sh down
     popd
@@ -530,9 +529,7 @@ popd
 touch ${RPM_BUILD_ROOT}/%{chroot_prefix}%{_sysconfdir}/named.conf
 #end chroot
 
-pushd build
-%make_install
-popd
+%meson_install
 
 # Remove unwanted files
 rm -f ${RPM_BUILD_ROOT}/etc/bind.keys
@@ -579,8 +576,8 @@ popd
 
 %if %{with DOC}
 mkdir -p ${RPM_BUILD_ROOT}%{_pkgdocdir}
-cp -a build/doc/arm/_build/html ${RPM_BUILD_ROOT}%{_pkgdocdir}
-rm -rf ${RPM_BUILD_ROOT}%{_pkgdocdir}/html/.{buildinfo,doctrees}
+#cp -a doc/arm/_build/html ${RPM_BUILD_ROOT}%{_pkgdocdir}
+#rm -rf ${RPM_BUILD_ROOT}%{_pkgdocdir}/html/.{buildinfo,doctrees}
 # Backward compatible link to 9.11 documentation
 (cd ${RPM_BUILD_ROOT}%{_pkgdocdir} && ln -s html/index.html Bv9ARM.html)
 # Share static data from original sphinx package
@@ -593,7 +590,7 @@ do
     ln -sr "${RPM_BUILD_ROOT}${DIR}" "$BINDTHEMEDIR"
   fi
 done
-cp -p build/doc/arm/_build/epub/Bv9ARM.epub ${RPM_BUILD_ROOT}%{_pkgdocdir}
+#cp -p doc/arm/_build/epub/Bv9ARM.epub ${RPM_BUILD_ROOT}%{_pkgdocdir}
 %endif
 
 # Ghost config files:

From c6386b8f0810b3507e5247b695a973ab182eb95b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 31 Jul 2025 20:45:46 +0200
Subject: [PATCH 18/64] WIP: Pass meson build and test

Install phase not yet solved.
---
 bind9-next.spec | 23 ++++++++---------------
 1 file changed, 8 insertions(+), 15 deletions(-)

diff --git a/bind9-next.spec b/bind9-next.spec
index d9f320f..144f07a 100644
--- a/bind9-next.spec
+++ b/bind9-next.spec
@@ -122,8 +122,10 @@ BuildRequires:  systemd-rpm-macros
 BuildRequires:  selinux-policy
 BuildRequires:  findutils
 BuildRequires:  sed
+#BuildRequires:  systemtap
 BuildRequires:  libnghttp2-devel
 BuildRequires:  userspace-rcu-devel
+BuildRequires:  pkgconfig(libedit)
 # Compress the changelog
 BuildRequires:  gzip
 %if 0%{?fedora}
@@ -334,6 +336,9 @@ g named %{bind_gid}
 u named %{bind_uid} 'Named' /var/named -
 EOF
 
+# get rid of rpath issues
+sed -e '/install_rpath:/ d' -i meson.build
+
 
 %build
 
@@ -373,6 +378,7 @@ export LIBDIR_SUFFIX
 %meson \
   --includedir=%{_includedir}/bind9 \
   -Didn=enabled \
+  -Dtracing=disabled \
 %if %{with GEOIP2}
   -Dgeoip=enabled \
 %endif
@@ -439,24 +445,11 @@ export TSAN_OPTIONS="log_exe_name=true log_path=ThreadSanitizer exitcode=0"
     export ISC_TASK_WORKERS="$THREADS"
     ulimit -n 8092 || : # Requires on some machines with many cores
   fi
-  echo "core.%%P" > /proc/sys/kernel/core_pattern || :
   e=0
-  %meson_build unit -j${THREADS} || e=$?
-  # Display details of failure
-  cat tests/*/test-suite.log
+  %meson_test --num-processes ${THREADS} || e=$?
 
-  echo "$COREPATTERN" > /proc/sys/kernel/core_pattern || :
   if [ "$e" -ne 0 ]; then
-    echo "ERROR: this build of BIND failed 'make unit'. Aborting."
-    for CORE in $(find -name 'core.*'); do
-      echo "# Found core: $CORE"
-      gdb --batch -ex 'bt full' -c "$CORE"
-      echo
-      xz -k "$CORE"
-      echo "# core base64 begin: $CORE"
-      base64 "$CORE.xz"
-      echo "# core base64 end: $CORE"
-    done
+    echo "ERROR: test failed. Aborting."
     exit $e;
   fi;
   [ "$CPUS" -gt 16 ] && ulimit -n $ORIGFILES || :

From 64924425a39d103053747af0acdc20685a7e520c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 31 Jul 2025 21:13:20 +0200
Subject: [PATCH 19/64] Make versioned libraries

Devel package not yet solved.
---
 bind9-next.spec  |  2 ++
 meson-libs.patch | 62 ++++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 64 insertions(+)
 create mode 100644 meson-libs.patch

diff --git a/bind9-next.spec b/bind9-next.spec
index 144f07a..303c1ac 100644
--- a/bind9-next.spec
+++ b/bind9-next.spec
@@ -96,6 +96,8 @@ Patch3: bind-9.21-unittest-isc_rwlock-s390x.patch
 # https://gitlab.isc.org/isc-projects/bind9/-/issues/5328
 # avoid often fails on i386, unsupported upstream
 Patch4: bind-9.21-unittest-qpdb-i386.patch
+# Downstream patch to include version in libraries
+Patch5: meson-libs.patch
 
 %{?systemd_ordering}
 Requires:       coreutils
diff --git a/meson-libs.patch b/meson-libs.patch
new file mode 100644
index 0000000..4ba0723
--- /dev/null
+++ b/meson-libs.patch
@@ -0,0 +1,62 @@
+From 0e03b4c1c4fed5b149969b25df2bc6b45a089b79 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
+Date: Thu, 31 Jul 2025 20:54:08 +0200
+Subject: [PATCH] Add version to shared libraries
+
+Allow coexistence of different bind libraries and utilities by it.
+---
+ meson.build | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/meson.build b/meson.build
+index 432af24..dac4212 100644
+--- a/meson.build
++++ b/meson.build
+@@ -957,7 +957,7 @@ subdir('util')
+ isc_srcconf = isc_srcset.apply(config, strict: false)
+ 
+ libisc = library(
+-    'isc',
++    'isc-'+meson.project_version(),
+     isc_srcconf.sources(),
+     objects: isc_probe_objects,
+     install: true,
+@@ -984,7 +984,7 @@ libisc_dep = declare_dependency(
+ dns_srcconf = dns_srcset.apply(config, strict: false)
+ 
+ libdns = library(
+-    'dns',
++    'dns-'+meson.project_version(),
+     dns_srcconf.sources(),
+     include_directories: dns_inc,
+     install: true,
+@@ -1018,7 +1018,7 @@ libdns_dep = declare_dependency(
+ ns_srcconf = ns_srcset.apply(config, strict: false)
+ 
+ libns = library(
+-    'ns',
++    'ns-'+meson.project_version(),
+     ns_srcconf.sources(),
+     objects: ns_probe_objects,
+     install: true,
+@@ -1044,7 +1044,7 @@ libns_dep = declare_dependency(
+ isccc_srcconf = isccc_srcset.apply(config, strict: false)
+ 
+ libisccc = library(
+-    'isccc',
++    'isccc-'+meson.project_version(),
+     isccc_srcconf.sources(),
+     implicit_include_directories: false,
+     include_directories: isccc_inc,
+@@ -1065,7 +1065,7 @@ libisccc_dep = declare_dependency(
+ isccfg_srcconf = isccfg_srcset.apply(config, strict: false)
+ 
+ libisccfg = library(
+-    'isccfg',
++    'isccfg-'+meson.project_version(),
+     isccfg_srcconf.sources(),
+     implicit_include_directories: false,
+     include_directories: isccfg_inc,
+-- 
+2.50.1
+

From bb2bf86fc74a3c68c6cbd5062eb8599f2fc151b0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 5 Sep 2025 17:25:14 +0200
Subject: [PATCH 20/64] Use smarter action on lograte script

BIND 9.21 has rndc closelogs action, which just reopens logs and nothing
more. Use that from logrotate. Skip this action if the log is empty.
---
 named.logrotate | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/named.logrotate b/named.logrotate
index 5df448f..17f41d9 100644
--- a/named.logrotate
+++ b/named.logrotate
@@ -2,11 +2,8 @@
     missingok
     su named named
     create 0644 named named
+    notifempty
     postrotate
-        /usr/bin/systemctl reload named.service > /dev/null 2>&1 || true
-        /usr/bin/systemctl reload named-chroot.service > /dev/null 2>&1 || true
-        /usr/bin/systemctl reload named-sdb.service > /dev/null 2>&1 || true
-        /usr/bin/systemctl reload named-sdb-chroot.service > /dev/null 2>&1 || true
-        /usr/bin/systemctl reload named-pkcs11.service > /dev/null 2>&1 || true
+        /usr/bin/rndc closelogs > /dev/null 2>&1 || true
     endscript
 }

From bdaaec7389dc15a0adc551ae693f20fc30d91c40 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 5 Sep 2025 18:02:20 +0200
Subject: [PATCH 21/64] Disable devel package and fix doc building

---
 bind9-next.spec | 19 ++++++++++++++-----
 1 file changed, 14 insertions(+), 5 deletions(-)

diff --git a/bind9-next.spec b/bind9-next.spec
index 303c1ac..7d5b8d7 100644
--- a/bind9-next.spec
+++ b/bind9-next.spec
@@ -571,7 +571,8 @@ popd
 
 %if %{with DOC}
 mkdir -p ${RPM_BUILD_ROOT}%{_pkgdocdir}
-#cp -a doc/arm/_build/html ${RPM_BUILD_ROOT}%{_pkgdocdir}
+pushd %{_vpath_builddir}
+cp -a arm/ ${RPM_BUILD_ROOT}%{_pkgdocdir}/html/
 #rm -rf ${RPM_BUILD_ROOT}%{_pkgdocdir}/html/.{buildinfo,doctrees}
 # Backward compatible link to 9.11 documentation
 (cd ${RPM_BUILD_ROOT}%{_pkgdocdir} && ln -s html/index.html Bv9ARM.html)
@@ -585,7 +586,10 @@ do
     ln -sr "${RPM_BUILD_ROOT}${DIR}" "$BINDTHEMEDIR"
   fi
 done
-#cp -p doc/arm/_build/epub/Bv9ARM.epub ${RPM_BUILD_ROOT}%{_pkgdocdir}
+cp -p arm-epub/Bv9ARM.epub ${RPM_BUILD_ROOT}%{_pkgdocdir}
+popd
+cp -p doc/changelog/changelog-history.rst* doc/notes/notes-*.rst* \
+      ${RPM_BUILD_ROOT}%{_pkgdocdir}
 %endif
 
 # Ghost config files:
@@ -731,6 +735,7 @@ fi;
 %{_bindir}/named-journalprint
 %{_bindir}/named-checkconf
 %{_bindir}/named-rrchecker
+%{_bindir}/named-makejournal
 %{_bindir}/mdig
 %{_sbindir}/named
 %{_sbindir}/rndc*
@@ -748,7 +753,8 @@ fi;
 %{_mandir}/man1/named-checkconf.1*
 %{_mandir}/man8/rndc-confgen.8*
 %{_mandir}/man1/named-journalprint.1*
-%{_mandir}/man8/filter-*.8.gz
+#{_mandir}/man1/named-makejournal.1*
+%{_mandir}/man8/filter-*.8*
 %doc README.md named.conf.default
 %doc doc/changelog/changelog-9.*.rst*
 %doc sample/
@@ -830,6 +836,8 @@ fi;
 %{_bindir}/dnssec*
 %{_mandir}/man1/dnssec*.1*
 
+%if 0
+# TODO: remove devel subpackage or create custom installation part
 %files devel
 %{_libdir}/libisccc.so
 %{_libdir}/libns.so
@@ -844,6 +852,7 @@ fi;
 %{_includedir}/bind9/irs
 %{_includedir}/bind9/isc
 %{_includedir}/bind9/isccfg
+%endif
 
 %files chroot
 %config(noreplace) %{_sysconfdir}/named-chroot.files
@@ -890,8 +899,8 @@ fi;
 %doc %{_pkgdocdir}/html
 %doc %{_pkgdocdir}/Bv9ARM.html
 %doc %{_pkgdocdir}/Bv9ARM.epub
-%doc doc/changelog/changelog-history.rst*
-%doc doc/notes/notes-*.rst*
+%doc %{_pkgdocdir}/changelog-history.rst*
+%doc %{_pkgdocdir}/notes-*.rst*
 %endif
 
 %changelog

From 8352e0ab73100728018d6966f8d2a37e1dfeddf9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 5 Sep 2025 18:04:49 +0200
Subject: [PATCH 22/64] Update to 9.21.11

New Features:

- Support for parsing DSYNC records has been added.

Feature changes:

- Reword the shut down hung fetch while resolving message.
- Plugin extension in plugin path is now optional.
- Add deprecation warnings for RSASHA1, RSASHA1-NSEC3SHA1, and DS digest type 1.

And multiple bug fixes.

https://downloads.isc.org/isc/bind9/9.21.11/doc/arm/html/notes.html#notes-for-bind-9-21-11
---
 bind-9.21-unittest-qpdb-i386.patch | 24 +++++++++++-------------
 bind9-next.spec                    |  4 ++--
 sources                            |  4 ++--
 3 files changed, 15 insertions(+), 17 deletions(-)

diff --git a/bind-9.21-unittest-qpdb-i386.patch b/bind-9.21-unittest-qpdb-i386.patch
index 1701ded..7c84880 100644
--- a/bind-9.21-unittest-qpdb-i386.patch
+++ b/bind-9.21-unittest-qpdb-i386.patch
@@ -1,15 +1,15 @@
-From 574db9dac1c4bd6b19da887a58da1126e336b9e5 Mon Sep 17 00:00:00 2001
+From af1e4bf375000fc532c55ff6df841661185a2451 Mon Sep 17 00:00:00 2001
 From: Petr Mensik <pemensik@redhat.com>
 Date: Wed, 28 May 2025 19:40:05 +0200
 Subject: [PATCH] Try rcu_barrier
 
 https://gitlab.isc.org/isc-projects/bind9/-/issues/5328
 ---
- tests/dns/qpdb_test.c | 5 +++++
- 1 file changed, 5 insertions(+)
+ tests/dns/qpdb_test.c | 3 +++
+ 1 file changed, 3 insertions(+)
 
 diff --git a/tests/dns/qpdb_test.c b/tests/dns/qpdb_test.c
-index 4b1de18..a11af52 100644
+index 1c840e2..b6ad0f4 100644
 --- a/tests/dns/qpdb_test.c
 +++ b/tests/dns/qpdb_test.c
 @@ -24,6 +24,7 @@
@@ -20,24 +20,22 @@ index 4b1de18..a11af52 100644
  #include <isc/util.h>
  
  #include <dns/lib.h>
-@@ -170,6 +171,8 @@ ISC_LOOP_TEST_IMPL(overmempurge_bigrdata) {
+@@ -170,6 +171,7 @@ ISC_LOOP_TEST_IMPL(overmempurge_bigrdata) {
  
  	dns_db_detach(&db);
- 	isc_mem_detach(&mctx2);
-+
+ 	isc_mem_detach(&mctx);
 +	rcu_barrier();
- 	isc_loopmgr_shutdown(loopmgr);
+ 	isc_loopmgr_shutdown();
  }
  
-@@ -221,6 +224,8 @@ ISC_LOOP_TEST_IMPL(overmempurge_longname) {
+@@ -221,6 +223,7 @@ ISC_LOOP_TEST_IMPL(overmempurge_longname) {
  
  	dns_db_detach(&db);
- 	isc_mem_detach(&mctx2);
-+
+ 	isc_mem_detach(&mctx);
 +	rcu_barrier();
- 	isc_loopmgr_shutdown(loopmgr);
+ 	isc_loopmgr_shutdown();
  }
  
 -- 
-2.49.0
+2.51.0
 
diff --git a/bind9-next.spec b/bind9-next.spec
index 7d5b8d7..c0bf8fc 100644
--- a/bind9-next.spec
+++ b/bind9-next.spec
@@ -55,7 +55,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind9-next
 License:  MPL-2.0 AND ISC AND BSD-3-clause AND Expat AND BSD-2-clause
 #
-Version:  9.21.10
+Version:  9.21.11
 Release:  %autorelease
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
@@ -753,7 +753,7 @@ fi;
 %{_mandir}/man1/named-checkconf.1*
 %{_mandir}/man8/rndc-confgen.8*
 %{_mandir}/man1/named-journalprint.1*
-#{_mandir}/man1/named-makejournal.1*
+%{_mandir}/man1/named-makejournal.1*
 %{_mandir}/man8/filter-*.8*
 %doc README.md named.conf.default
 %doc doc/changelog/changelog-9.*.rst*
diff --git a/sources b/sources
index 877f116..d12b4a2 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.21.10.tar.xz) = fa814d43f0e7ec137617f0f2772ebd2e008a647d2158fa1a7765e38551506ee704cc1c6106d4c620b571d16d7cdecb40a8b03943aaeca29f984a3bf19c6205d2
-SHA512 (bind-9.21.10.tar.xz.asc) = 0f25cf6a74b3cc8df1b3c043e5aa2ad772001b2bf9aea0e3b48db2bc207b4508c2848bbe293d81b4cd82011284e5c73463a24ed489120dc9cfa59c4e7698120e
+SHA512 (bind-9.21.11.tar.xz) = dc4a20fc063b6dcec18d5241117eeb741a1e9e8f9e0bdac2743458b87de6a5496fff1e610c3c0676ae65e76b2741c86badb83df5b9278df8595194687359b5d6
+SHA512 (bind-9.21.11.tar.xz.asc) = 25ada3e81c3f60665f0b7f8ef24ba6e81ebd85627126e03ffcfecb02c78aa3f309fc25dce258495c1f5087072f0abad8932b2cd009f85180a27a9bd5f8ed6e80

From 0bad3962c1a776d1305fa52bf34139909226506f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 5 Sep 2025 18:29:26 +0200
Subject: [PATCH 23/64] Try fixing i686 platform

---
 bind9-next.spec | 17 -----------------
 1 file changed, 17 deletions(-)

diff --git a/bind9-next.spec b/bind9-next.spec
index c0bf8fc..1d17ad8 100644
--- a/bind9-next.spec
+++ b/bind9-next.spec
@@ -318,18 +318,6 @@ in HTML and PDF format.
 %endif
 %autosetup -n %{upname}-%{version} -p1
 
-# Sparc and s390 arches need to use -fPIE
-%ifarch sparcv9 sparc64 s390 s390x
-for i in bin/named/Makefile.am; do
-  sed -i 's|fpie|fPIE|g' $i
-done
-%endif
-
-%ifarch %{ix86}
-# f40 FTBFS on quota_test, bug #2261010
-  sed -e '/^\s*quota_test/ d' -i tests/isc/Makefile.am
-%endif
-
 :;
 
 # Create a sysusers.d config file
@@ -368,11 +356,6 @@ export STD_CDEFINES="$CPPFLAGS"
 #'s/([bind_VERSION_EXTRA],\s*\([^)]*\))/([bind_VERSION_EXTRA], \1-RH)/' \
 #configure.ac
 
-%if 0%{?rhel} && 0%{?rhel} < 9
-# disable Sphinx warnings as errors, epel8 does not pass cleanly
-sed -e 's/-W\s//' -i Makefile.docs
-%endif
-
 
 LIBDIR_SUFFIX=
 export LIBDIR_SUFFIX

From de80f009a905c3ec94543537454d1b66e8357bdb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 5 Sep 2025 18:48:00 +0200
Subject: [PATCH 24/64] Reenable systemtap and dtrace

These are enabled by default, just provide dependencies to pass
automatic test.
---
 bind9-next.spec | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/bind9-next.spec b/bind9-next.spec
index 1d17ad8..021b6c3 100644
--- a/bind9-next.spec
+++ b/bind9-next.spec
@@ -124,7 +124,6 @@ BuildRequires:  systemd-rpm-macros
 BuildRequires:  selinux-policy
 BuildRequires:  findutils
 BuildRequires:  sed
-#BuildRequires:  systemtap
 BuildRequires:  libnghttp2-devel
 BuildRequires:  userspace-rcu-devel
 BuildRequires:  pkgconfig(libedit)
@@ -187,7 +186,9 @@ BuildRequires: libtsan
 %endif
 %if %{with DTRACE}
 # https://gitlab.isc.org/isc-projects/bind9/-/issues/4041
-BuildRequires: systemtap-sdt-devel
+BuildRequires:  systemtap
+BuildRequires:  systemtap-sdt-devel
+BuildRequires:  systemtap-sdt-dtrace
 %endif
 
 %description
@@ -363,7 +364,9 @@ export LIBDIR_SUFFIX
 %meson \
   --includedir=%{_includedir}/bind9 \
   -Didn=enabled \
+%if %{without DTRACE}
   -Dtracing=disabled \
+%endif
 %if %{with GEOIP2}
   -Dgeoip=enabled \
 %endif

From 60658fe41a9c3f054417aa2a64c4dd681f4d7b26 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 5 Sep 2025 19:45:43 +0200
Subject: [PATCH 25/64] Replace Expat license with MIT

---
 bind9-next.spec | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/bind9-next.spec b/bind9-next.spec
index 021b6c3..6a82f4e 100644
--- a/bind9-next.spec
+++ b/bind9-next.spec
@@ -53,7 +53,7 @@ Conflicts: %1 \
 
 Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
 Name:     bind9-next
-License:  MPL-2.0 AND ISC AND BSD-3-clause AND Expat AND BSD-2-clause
+License:  MPL-2.0 AND ISC AND BSD-3-clause AND MIT AND BSD-2-clause
 #
 Version:  9.21.11
 Release:  %autorelease

From 1cdf57678be8e31950d6df23c359fccc7986a73f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 19 Jun 2024 20:41:31 +0200
Subject: [PATCH 26/64] Remove separate license subpackage

Move license to libs subpackage, it is required for everything except
documentation. Include license file in docs and bind-libs, avoid extra
package just for single file.
---
 bind9-next.spec | 14 +++-----------
 1 file changed, 3 insertions(+), 11 deletions(-)

diff --git a/bind9-next.spec b/bind9-next.spec
index 39e1677..ab02f0b 100644
--- a/bind9-next.spec
+++ b/bind9-next.spec
@@ -200,7 +200,8 @@ tools for verifying that the DNS server is operating properly.
 
 %package libs
 Summary: Libraries used by the BIND DNS packages
-Requires: %{name}-license = %{epoch}:%{version}-%{release}
+Provides: %{name}-license = %{epoch}:%{version}-%{release}
+Obsoletes: %{name}-license < 32:9.21.11-5
 Provides: %{name}-libs-lite = %{epoch}:%{version}-%{release}
 Obsoletes: %{name}-libs-lite < 32:9.16.13
 Obsoletes: %{name}-pkcs11-libs < 32:9.18.4-2
@@ -209,13 +210,6 @@ Obsoletes: %{name}-pkcs11-libs < 32:9.18.4-2
 Contains heavyweight version of BIND suite libraries used by both named DNS
 server and utilities in %{name}-utils package.
 
-%package license
-Summary:  License of the BIND DNS suite
-BuildArch:noarch
-
-%description license
-Contains license of the BIND DNS suite.
-
 %package utils
 Summary: Utilities for querying DNS name servers
 Requires: %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release}
@@ -295,7 +289,6 @@ Based on the code from Jan "Yenya" Kasprzak <kas@fi.muni.cz>
 %if %{with DOC}
 %package doc
 Summary:   BIND 9 Administrator Reference Manual
-Requires:  %{name}-license = %{epoch}:%{version}-%{release}
 Requires:  python3-sphinx_rtd_theme
 BuildArch: noarch
 
@@ -777,8 +770,6 @@ fi;
 %{_libdir}/libdns-%{version}*.so
 %{_libdir}/libisc-%{version}*.so
 %{_libdir}/libisccfg-%{version}*.so
-
-%files license
 %{!?_licensedir:%global license %%doc}
 %license COPYRIGHT
 
@@ -888,6 +879,7 @@ fi;
 %doc %{_pkgdocdir}/Bv9ARM.epub
 %doc %{_pkgdocdir}/changelog-history.rst*
 %doc %{_pkgdocdir}/notes-*.rst*
+%license COPYRIGHT
 %endif
 
 %changelog

From 7401d29d7fe5fabd8e1846710b884a32edd3be44 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 10 Sep 2025 22:38:34 +0200
Subject: [PATCH 27/64] Return back fortify=3 source

Should fix rpminspect annocheck report.
---
 bind9-next.spec | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/bind9-next.spec b/bind9-next.spec
index ab02f0b..6804059 100644
--- a/bind9-next.spec
+++ b/bind9-next.spec
@@ -39,9 +39,6 @@
 # Visit https://bugzilla.redhat.com/show_bug.cgi?id=1540300
 %undefine _strict_symbol_defs_build
 
-# BIND9 does not work with fortify 3 level, make builds work on Fedora
-%global _fortify_level 2
-
 # Upstream package name
 %global upname bind
 # Provide only bind-utils on f37+, it has better behaviour

From f71c2455259938cb3f957e0ff20e186228e27ac9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 10 Sep 2025 22:41:05 +0200
Subject: [PATCH 28/64] Update to 9.21.12 (rhbz#2394406)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

New Features:

- Add a new option manual-mode to dnssec-policy.
- Add a new option servfail-until-ready to response-policy zones.
- Support for parsing HHIT and BRID records has been added.

Removed Features:

- Deprecate the tkey-gssapi-credential statement.
- Obsolete the “tkey-domain” statement.

Bug Fixes:

- Prevent spurious SERVFAILs for certain 0-TTL resource records.
- Fix unexpected termination if catalog-zones had undefined default-primaries.

https://downloads.isc.org/isc/bind9/9.21.12/doc/arm/html/notes.html#notes-for-bind-9-21-12
---
 bind9-next.spec | 2 +-
 sources         | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/bind9-next.spec b/bind9-next.spec
index 6804059..3afc27d 100644
--- a/bind9-next.spec
+++ b/bind9-next.spec
@@ -52,7 +52,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind9-next
 License:  MPL-2.0 AND ISC AND BSD-3-clause AND MIT AND BSD-2-clause
 #
-Version:  9.21.11
+Version:  9.21.12
 Release:  %autorelease
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
diff --git a/sources b/sources
index d12b4a2..ef3a8e7 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.21.11.tar.xz) = dc4a20fc063b6dcec18d5241117eeb741a1e9e8f9e0bdac2743458b87de6a5496fff1e610c3c0676ae65e76b2741c86badb83df5b9278df8595194687359b5d6
-SHA512 (bind-9.21.11.tar.xz.asc) = 25ada3e81c3f60665f0b7f8ef24ba6e81ebd85627126e03ffcfecb02c78aa3f309fc25dce258495c1f5087072f0abad8932b2cd009f85180a27a9bd5f8ed6e80
+SHA512 (bind-9.21.12.tar.xz) = aa881fbef7fc4913f9ace41fd6c7c154cd0533dc790a95018fa52add77f5253f6abea8b8c34d6f11c0c065a1973cf2d83d1635046c87500203df88b5290dc55e
+SHA512 (bind-9.21.12.tar.xz.asc) = 956dfda33e728215a8178f7033fd346e47f07047a03535e50ceb7765f740e6ef9db7f6221e3411e37eec2d0434a889e19330723d1a74e47faa7c4d8056c23b2f

From 9c905f8e3e929b837f158243565c67fa5aa9e9c5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 10 Sep 2025 23:08:11 +0200
Subject: [PATCH 29/64] Remove license and devel packages from README

Remove also reference to DLZ removed during recent updates.

[skip changelog]
---
 README.md | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/README.md b/README.md
index b7cfab1..7f59b23 100644
--- a/README.md
+++ b/README.md
@@ -26,13 +26,9 @@ The package contains several subpackages, some of them can be disabled on rebuil
 * **bind9-next** -- *named* daemon providing DNS server
 * **bind9-next-utils** -- set of tools to analyse DNS responses or update entries (dig, host)
 * **bind9-next-doc** -- documentation for current bind, *BIND 9 Administrator Reference Manual*.
-* **bind9-next-license** -- Shared license for all packages but bind-export-libs.
 * **bind9-next-libs** -- Shared libraries used by some others programs
-* **bind9-next-devel** -- Development headers for libs. Can be disabled by `--without DEVEL`
-
 
 ## Optional features
 
 * *GSSTSIG* -- Support for Kerberos authentication in BIND.
 * *LMDB* -- Support for dynamic database for managing runtime added zones. Provides faster removal of added zone with much less overhead. But requires lmdb linked to base libs.
-* *DLZ* -- Support for dynamic loaded modules providing support for features *bind-sdb* provides, but only small module is required.

From 702274da0491b9343f3fc11f8a3fdd9fac4f0003 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 11 Sep 2025 12:34:06 +0200
Subject: [PATCH 30/64] Meson libs include version in upstream already

Libraries include version name right in the upstream. No need for
downstream patch doing the same.
---
 bind9-next.spec  |  2 --
 meson-libs.patch | 62 ------------------------------------------------
 2 files changed, 64 deletions(-)
 delete mode 100644 meson-libs.patch

diff --git a/bind9-next.spec b/bind9-next.spec
index 3afc27d..db14ac0 100644
--- a/bind9-next.spec
+++ b/bind9-next.spec
@@ -93,8 +93,6 @@ Patch3: bind-9.21-unittest-isc_rwlock-s390x.patch
 # https://gitlab.isc.org/isc-projects/bind9/-/issues/5328
 # avoid often fails on i386, unsupported upstream
 Patch4: bind-9.21-unittest-qpdb-i386.patch
-# Downstream patch to include version in libraries
-Patch5: meson-libs.patch
 
 %{?systemd_ordering}
 Requires:       coreutils
diff --git a/meson-libs.patch b/meson-libs.patch
deleted file mode 100644
index 4ba0723..0000000
--- a/meson-libs.patch
+++ /dev/null
@@ -1,62 +0,0 @@
-From 0e03b4c1c4fed5b149969b25df2bc6b45a089b79 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
-Date: Thu, 31 Jul 2025 20:54:08 +0200
-Subject: [PATCH] Add version to shared libraries
-
-Allow coexistence of different bind libraries and utilities by it.
----
- meson.build | 10 +++++-----
- 1 file changed, 5 insertions(+), 5 deletions(-)
-
-diff --git a/meson.build b/meson.build
-index 432af24..dac4212 100644
---- a/meson.build
-+++ b/meson.build
-@@ -957,7 +957,7 @@ subdir('util')
- isc_srcconf = isc_srcset.apply(config, strict: false)
- 
- libisc = library(
--    'isc',
-+    'isc-'+meson.project_version(),
-     isc_srcconf.sources(),
-     objects: isc_probe_objects,
-     install: true,
-@@ -984,7 +984,7 @@ libisc_dep = declare_dependency(
- dns_srcconf = dns_srcset.apply(config, strict: false)
- 
- libdns = library(
--    'dns',
-+    'dns-'+meson.project_version(),
-     dns_srcconf.sources(),
-     include_directories: dns_inc,
-     install: true,
-@@ -1018,7 +1018,7 @@ libdns_dep = declare_dependency(
- ns_srcconf = ns_srcset.apply(config, strict: false)
- 
- libns = library(
--    'ns',
-+    'ns-'+meson.project_version(),
-     ns_srcconf.sources(),
-     objects: ns_probe_objects,
-     install: true,
-@@ -1044,7 +1044,7 @@ libns_dep = declare_dependency(
- isccc_srcconf = isccc_srcset.apply(config, strict: false)
- 
- libisccc = library(
--    'isccc',
-+    'isccc-'+meson.project_version(),
-     isccc_srcconf.sources(),
-     implicit_include_directories: false,
-     include_directories: isccc_inc,
-@@ -1065,7 +1065,7 @@ libisccc_dep = declare_dependency(
- isccfg_srcconf = isccfg_srcset.apply(config, strict: false)
- 
- libisccfg = library(
--    'isccfg',
-+    'isccfg-'+meson.project_version(),
-     isccfg_srcconf.sources(),
-     implicit_include_directories: false,
-     include_directories: isccfg_inc,
--- 
-2.50.1
-

From 3b309a9098266d8c82cda44ef9754671593a1292 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 7 Oct 2025 17:08:00 +0200
Subject: [PATCH 31/64] Update a bit sample named.conf

Have it possibly checked by named-checkconf. Make there secret present.
---
 named.conf.sample | 28 ++++++++++++----------------
 1 file changed, 12 insertions(+), 16 deletions(-)

diff --git a/named.conf.sample b/named.conf.sample
index 0f3ae98..61229b7 100644
--- a/named.conf.sample
+++ b/named.conf.sample
@@ -1,11 +1,11 @@
+# vim: ft=named:
 /*
  Sample named.conf BIND DNS server 'named' configuration file
  for the Red Hat BIND distribution.
 
  See the BIND Administrator's Reference Manual (ARM) for details, in:
-   file:///usr/share/doc/bind-{version}/arm/Bv9ARM.html
- Also see the BIND Configuration GUI : /usr/bin/system-config-bind and 
- its manual.
+   file:///usr/share/doc/bind/html/index.html
+ Or on upstream site: https://bind9.readthedocs.org/
 */
 
 options
@@ -47,6 +47,7 @@ options
 
 	allow-query		{ localhost; };
 	allow-query-cache	{ localhost; };
+	allow-transfer		{ localhost; };
 
 	/* Enable/disable recursion - recursion yes/no;
 
@@ -64,7 +65,7 @@ options
 	/* DNSSEC related options. See information about keys ("Trusted keys", bellow) */
 
 	/* Enable DNSSEC validation on recursive servers */
-	dnssec-validation yes;
+	dnssec-validation auto;
 
 	/* In Fedora we use /run/named instead of default /var/run/named
 	   so we have to configure paths properly. */
@@ -165,7 +166,7 @@ view "internal"
 	zone "my.slave.internal.zone" {
 		type secondary;
 		file "slaves/my.slave.internal.zone.db";
-		masters { /* put master nameserver IPs here */ 127.0.0.1; } ;
+		primaries { /* put master nameserver IPs here */ 127.0.0.1; } ;
 		// put slave zones in the slaves/ directory so named can update them
 	};	
 	zone "my.ddns.internal.zone" {
@@ -179,7 +180,8 @@ view "internal"
 key ddns_key
 {
 	algorithm hmac-sha256;
-	secret "use /usr/sbin/ddns-confgen to generate TSIG keys";
+	#secret "use /usr/sbin/ddns-confgen to generate TSIG keys";
+	secret "dXNlIC91c3Ivc2Jpbi9kZG5zLWNvbmZnZW4gdG8gZ2VuZXJhdGUgVFNJRyBrZXlz";
 };
 
 view "external"
@@ -212,19 +214,13 @@ view "external"
   This statement contains DNSSEC keys. If you want DNSSEC aware resolver you
   should configure at least one trusted key.
 
-  Note that no key written below is valid. Especially root key because root zone
-  is not signed yet.
+  Note that no key written below is valid. Especially root key is maintained in
+  /etc/named.root.key file.
 */
 /*
 trust-anchors {
 // Root Key
-. initial-key 257 3 8 "AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3
-		      +/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kv
-		      ArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF
-		      0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+e
-		      oZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfd
-		      RUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwN
-		      R1AkUTV74bU=";
+. initial-ds 38696 8 2 "683D2D0ACB8C9B712A1948B27F741219298D0A450D612C483AF444A4C0FB2B16";
 
 // Key for forward zone
 example.com. static-key 257 3 8 "AwEAAZ0aqu1rJ6orJynrRfNpPmayJZoAx9Ic2/Rl9VQW
@@ -238,6 +234,6 @@ example.com. static-key 257 3 8 "AwEAAZ0aqu1rJ6orJynrRfNpPmayJZoAx9Ic2/Rl9VQW
 
 
 // Key for reverse zone.
-2.0.192.IN-ADDRPA.NET. initial-ds 31406 8 2 "F78CF3344F72137235098ECBBD08947C2C9001C7F6A085A17F518B5D8F6B916D";
+2.0.192.IN-ADDRPA.NET. static-ds 31406 8 2 "F78CF3344F72137235098ECBBD08947C2C9001C7F6A085A17F518B5D8F6B916D";
 };
 */

From 75e66e6628e5899e6233391eb6c3e769c84a56fe Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 30 Oct 2025 13:33:48 +0100
Subject: [PATCH 32/64] Update to 9.21.14 (rhbz#2394406)

Security Fixes:

- DNSSEC validation fails if matching but invalid DNSKEY is found. (CVE-2025-8677)
- Address various spoofing attacks. (CVE-2025-40778)
- Cache-poisoning due to weak pseudo-random number generator. (CVE-2025-40780)

New Features:

- Add dnssec-policy keys configuration check to named-checkconf.
- Add support for synthetic records.
- Support for zone-specific plugins.
- Support for additional tokens in the zone file name template.

Removed Features:

- Remove randomized RRset ordering.

and bug fixes

https://downloads.isc.org/isc/bind9/9.21.14/doc/arm/html/notes.html#notes-for-bind-9-21-14
---
 bind9-next.spec | 4 +++-
 sources         | 4 ++--
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/bind9-next.spec b/bind9-next.spec
index db14ac0..53b72ab 100644
--- a/bind9-next.spec
+++ b/bind9-next.spec
@@ -52,7 +52,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind9-next
 License:  MPL-2.0 AND ISC AND BSD-3-clause AND MIT AND BSD-2-clause
 #
-Version:  9.21.12
+Version:  9.21.14
 Release:  %autorelease
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
@@ -352,6 +352,7 @@ export LIBDIR_SUFFIX
 %meson \
   --includedir=%{_includedir}/bind9 \
   -Didn=enabled \
+  -Dfuzzing=disabled \
 %if %{without DTRACE}
   -Dtracing=disabled \
 %endif
@@ -698,6 +699,7 @@ fi;
 # FIXME: current build targets filters into %%_libdir/bind again?
 %dir %{_libdir}/bind
 %{_libdir}/bind/filter*.so
+%{_libdir}/bind/synthrecord.so
 %dir %{_libdir}/named
 %config(noreplace) %verify(not md5 size mtime) %{_sysconfdir}/sysconfig/named
 %config(noreplace) %attr(0644,root,named) %{_sysconfdir}/named.root.key
diff --git a/sources b/sources
index ef3a8e7..714e4db 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.21.12.tar.xz) = aa881fbef7fc4913f9ace41fd6c7c154cd0533dc790a95018fa52add77f5253f6abea8b8c34d6f11c0c065a1973cf2d83d1635046c87500203df88b5290dc55e
-SHA512 (bind-9.21.12.tar.xz.asc) = 956dfda33e728215a8178f7033fd346e47f07047a03535e50ceb7765f740e6ef9db7f6221e3411e37eec2d0434a889e19330723d1a74e47faa7c4d8056c23b2f
+SHA512 (bind-9.21.14.tar.xz) = bf4bd0f5613d6c6d53f749f3269a34f3a5c74a7dc81e05922d58ba30f19d418e565838dd1182dd6052b9a62b3799d2d0f12451f2797af3279259df59cfc4be05
+SHA512 (bind-9.21.14.tar.xz.asc) = 91ccc82ca54d07dba07821c3410f92b563290ead48546d605b0dbd9958a831d9b90130002fbb325e0cdc913de64813d8ba4c48ec958ebba7f5f462d43f578394

From 17658f2e301f8566ac9357b62846deb9db04150d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 6 Nov 2025 15:55:40 +0100
Subject: [PATCH 33/64] Prevent SERVFAIL on dual signed zones with one
 unsupported signature (rhbz#2413104)

---
 bind-9.21-dual-sign-continue-test.patch | 115 ++++++++++++++++++++++++
 bind-9.21-dual-sign-continue.patch      |  42 +++++++++
 bind9-next.spec                         |   2 +
 3 files changed, 159 insertions(+)
 create mode 100644 bind-9.21-dual-sign-continue-test.patch
 create mode 100644 bind-9.21-dual-sign-continue.patch

diff --git a/bind-9.21-dual-sign-continue-test.patch b/bind-9.21-dual-sign-continue-test.patch
new file mode 100644
index 0000000..18408af
--- /dev/null
+++ b/bind-9.21-dual-sign-continue-test.patch
@@ -0,0 +1,115 @@
+From 488d7bfc75f2988c6e461b8677bc0e27e58bd82e Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
+Date: Sat, 1 Nov 2025 12:00:59 +0100
+Subject: [PATCH] Add a system test with one good and one bad algorithm
+
+The case where there would be one supported algorithm and one already
+unsupported (like RSAMD5 or RSASHA1) was missing.
+---
+ bin/tests/system/dnssec/ns2/example.db.in   |  4 +++
+ bin/tests/system/dnssec/ns2/sign.sh         |  2 +-
+ bin/tests/system/dnssec/ns3/named.conf.j2   |  6 ++++
+ bin/tests/system/dnssec/ns3/sign.sh         | 31 +++++++++++++++++++++
+ bin/tests/system/dnssec/tests_validation.py |  8 ++++++
+ 5 files changed, 50 insertions(+), 1 deletion(-)
+
+diff --git a/bin/tests/system/dnssec/ns2/example.db.in b/bin/tests/system/dnssec/ns2/example.db.in
+index 47c2eb7f0e..07429366ee 100644
+--- a/bin/tests/system/dnssec/ns2/example.db.in
++++ b/bin/tests/system/dnssec/ns2/example.db.in
+@@ -202,3 +202,7 @@ ns3.extradsunknownoid	A	10.53.0.3
+ 
+ extended-ds-unknown-oid	NS	ns3.extended-ds-unknown-oid
+ ns3.extended-ds-unknown-oid A	10.53.0.3
++
++; A secure subdomain with extra bad key
++extrabadkey		NS	ns3.extrabadkey
++ns3.extrabadkey		A	10.53.0.3
+diff --git a/bin/tests/system/dnssec/ns2/sign.sh b/bin/tests/system/dnssec/ns2/sign.sh
+index e3f18af15e..da9f5f07fc 100644
+--- a/bin/tests/system/dnssec/ns2/sign.sh
++++ b/bin/tests/system/dnssec/ns2/sign.sh
+@@ -92,7 +92,7 @@ for subdomain in digest-alg-unsupported ds-unsupported secure badds \
+   dnskey-nsec3-unknown managed-future future revkey \
+   dname-at-apex-nsec3 occluded rsasha1 rsasha1-1024 \
+   rsasha256oid rsasha512oid unknownoid extradsoid extradsunknownoid \
+-  extended-ds-unknown-oid; do
++  extended-ds-unknown-oid extrabadkey; do
+   cp "../ns3/dsset-$subdomain.example." .
+ done
+ 
+diff --git a/bin/tests/system/dnssec/ns3/named.conf.j2 b/bin/tests/system/dnssec/ns3/named.conf.j2
+index 1a0edc14bb..9cbc58892c 100644
+--- a/bin/tests/system/dnssec/ns3/named.conf.j2
++++ b/bin/tests/system/dnssec/ns3/named.conf.j2
+@@ -141,6 +141,12 @@ zone "extrakey.example" {
+ 	allow-update { any; };
+ };
+ 
++zone "extrabadkey.example" {
++	type primary;
++	file "extrabadkey.example.db.signed";
++	allow-update { any; };
++};
++
+ zone "insecure.nsec3.example" {
+ 	type primary;
+ 	file "insecure.nsec3.example.db";
+diff --git a/bin/tests/system/dnssec/ns3/sign.sh b/bin/tests/system/dnssec/ns3/sign.sh
+index 5512888b2f..ea81381eb2 100644
+--- a/bin/tests/system/dnssec/ns3/sign.sh
++++ b/bin/tests/system/dnssec/ns3/sign.sh
+@@ -905,3 +905,34 @@ ksk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK "$zone")
+ zsk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
+ cat "$infile" "$ksk.key" "$zsk.key" >"$zonefile"
+ "$SIGNER" -g -o "$zone" "$zonefile" >/dev/null 2>&1
++
++#
++#
++#
++zone=extrabadkey.example.
++infile=template.db.in
++zonefile=extrabadkey.example.db
++
++# Add KSK and ZSK that we will mangle to RSAMD5
++ksk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK "$zone")
++zsk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
++cat "$infile" "$ksk.key" "$zsk.key" >"$zonefile"
++"$SIGNER" -g -O full -o "$zone" "$zonefile" >/dev/null 2>&1
++
++# Mangle the signatures to RSAMD5 and save them for future use
++sed -ne "s/\(IN[[:space:]]*RRSIG[[:space:]]*[A-Z]*\) $DEFAULT_ALGORITHM_NUMBER /\1 1 /p" <"$zonefile.signed" >"$zonefile.signed.rsamd5"
++
++# Now add normal KSK and ZSK to the zone file
++ksk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK "$zone")
++zsk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
++cat "$infile" "$ksk.key" "$zsk.key" >"$zonefile"
++
++# Mangle the DNSKEY algorithm numbers and add them to the signed zone file
++cat "$ksk.key" "$zsk.key" | sed -e "s/\(IN[[:space:]]*DNSKEY[[:space:]]*[0-9]* 3\) $DEFAULT_ALGORITHM_NUMBER /\1 1 /" >>"$zonefile"
++
++# Sign normally
++"$SIGNER" -g -o "$zone" "$zonefile" >/dev/null 2>&1
++
++# Add the mangled signatures to signed zone file
++cat "$zonefile.signed.rsamd5" >>"$zonefile.signed"
++rm "$zonefile.signed.rsamd5"
+diff --git a/bin/tests/system/dnssec/tests_validation.py b/bin/tests/system/dnssec/tests_validation.py
+index e6d8ccc734..a27a899987 100644
+--- a/bin/tests/system/dnssec/tests_validation.py
++++ b/bin/tests/system/dnssec/tests_validation.py
+@@ -1385,3 +1385,11 @@ def test_rrsigs_for_glue():
+         record.rdtype == rdatatype.RRSIG and record.covers == rdatatype.A
+         for record in res.answer
+     )
++
++
++def test_extra_bad_algorithm():
++    msg = isctest.query.create("a.extrabadkey.example", "A")
++    res1 = isctest.query.tcp(msg, "10.53.0.3")
++    res2 = isctest.query.tcp(msg, "10.53.0.4")
++    isctest.check.same_answer(res1, res2)
++    isctest.check.adflag(res2)
+-- 
+2.51.1
+
diff --git a/bind-9.21-dual-sign-continue.patch b/bind-9.21-dual-sign-continue.patch
new file mode 100644
index 0000000..22e3cef
--- /dev/null
+++ b/bind-9.21-dual-sign-continue.patch
@@ -0,0 +1,42 @@
+From a94a7c1a1e6eecbead995a08bace33d23899a5da Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
+Date: Tue, 4 Nov 2025 02:09:38 +0100
+Subject: [PATCH] Skip unsupported algorithms when looking for signing key
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+When looking for a signing key in select_signing_key(), the result code
+indicating unsupported algorithm would abort the search.  Instead, skip
+such keys and continue searching for the right key.
+
+Co-Authored-By: Aram Sargsyan <aram@isc.org>
+Co-Authored-By: Petr Menšík <pemensik@redhat.com>
+---
+ lib/dns/validator.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/lib/dns/validator.c b/lib/dns/validator.c
+index c6781544b9..52677fbd80 100644
+--- a/lib/dns/validator.c
++++ b/lib/dns/validator.c
+@@ -1092,8 +1092,14 @@ select_signing_key(dns_validator_t *val, dns_rdataset_t *rdataset) {
+ 			continue;
+ 		}
+ 
+-		return dns_dnssec_keyfromrdata(&siginfo->signer, &rdata,
+-					       val->view->mctx, &val->key);
++		result = dns_dnssec_keyfromrdata(&siginfo->signer, &rdata,
++						 val->view->mctx, &val->key);
++		/* Don't count unsupported algorithm towards max fails */
++		if (result == DST_R_UNSUPPORTEDALG) {
++			/* Continue with the next key */
++			continue;
++		}
++		return result;
+ 	}
+ 
+ 	return ISC_R_NOTFOUND;
+-- 
+2.51.1
+
diff --git a/bind9-next.spec b/bind9-next.spec
index 53b72ab..5d27915 100644
--- a/bind9-next.spec
+++ b/bind9-next.spec
@@ -93,6 +93,8 @@ Patch3: bind-9.21-unittest-isc_rwlock-s390x.patch
 # https://gitlab.isc.org/isc-projects/bind9/-/issues/5328
 # avoid often fails on i386, unsupported upstream
 Patch4: bind-9.21-unittest-qpdb-i386.patch
+Patch5: bind-9.21-dual-sign-continue.patch
+Patch6: bind-9.21-dual-sign-continue-test.patch
 
 %{?systemd_ordering}
 Requires:       coreutils

From d412d0ebd0e712f7a5057042048591b31bc8ad30 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 10 Sep 2025 23:08:11 +0200
Subject: [PATCH 34/64] Remove license and devel packages from README

Remove also reference to DLZ removed during recent updates.

[skip changelog]
---
 README.md | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/README.md b/README.md
index b7cfab1..7f59b23 100644
--- a/README.md
+++ b/README.md
@@ -26,13 +26,9 @@ The package contains several subpackages, some of them can be disabled on rebuil
 * **bind9-next** -- *named* daemon providing DNS server
 * **bind9-next-utils** -- set of tools to analyse DNS responses or update entries (dig, host)
 * **bind9-next-doc** -- documentation for current bind, *BIND 9 Administrator Reference Manual*.
-* **bind9-next-license** -- Shared license for all packages but bind-export-libs.
 * **bind9-next-libs** -- Shared libraries used by some others programs
-* **bind9-next-devel** -- Development headers for libs. Can be disabled by `--without DEVEL`
-
 
 ## Optional features
 
 * *GSSTSIG* -- Support for Kerberos authentication in BIND.
 * *LMDB* -- Support for dynamic database for managing runtime added zones. Provides faster removal of added zone with much less overhead. But requires lmdb linked to base libs.
-* *DLZ* -- Support for dynamic loaded modules providing support for features *bind-sdb* provides, but only small module is required.

From 78617f988493148732d9eb9adab9b53fede2f343 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 11 Sep 2025 12:34:06 +0200
Subject: [PATCH 35/64] Meson libs include version in upstream already

Libraries include version name right in the upstream. No need for
downstream patch doing the same.
---
 bind9-next.spec  |  2 --
 meson-libs.patch | 62 ------------------------------------------------
 2 files changed, 64 deletions(-)
 delete mode 100644 meson-libs.patch

diff --git a/bind9-next.spec b/bind9-next.spec
index 6a82f4e..5239282 100644
--- a/bind9-next.spec
+++ b/bind9-next.spec
@@ -96,8 +96,6 @@ Patch3: bind-9.21-unittest-isc_rwlock-s390x.patch
 # https://gitlab.isc.org/isc-projects/bind9/-/issues/5328
 # avoid often fails on i386, unsupported upstream
 Patch4: bind-9.21-unittest-qpdb-i386.patch
-# Downstream patch to include version in libraries
-Patch5: meson-libs.patch
 
 %{?systemd_ordering}
 Requires:       coreutils
diff --git a/meson-libs.patch b/meson-libs.patch
deleted file mode 100644
index 4ba0723..0000000
--- a/meson-libs.patch
+++ /dev/null
@@ -1,62 +0,0 @@
-From 0e03b4c1c4fed5b149969b25df2bc6b45a089b79 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
-Date: Thu, 31 Jul 2025 20:54:08 +0200
-Subject: [PATCH] Add version to shared libraries
-
-Allow coexistence of different bind libraries and utilities by it.
----
- meson.build | 10 +++++-----
- 1 file changed, 5 insertions(+), 5 deletions(-)
-
-diff --git a/meson.build b/meson.build
-index 432af24..dac4212 100644
---- a/meson.build
-+++ b/meson.build
-@@ -957,7 +957,7 @@ subdir('util')
- isc_srcconf = isc_srcset.apply(config, strict: false)
- 
- libisc = library(
--    'isc',
-+    'isc-'+meson.project_version(),
-     isc_srcconf.sources(),
-     objects: isc_probe_objects,
-     install: true,
-@@ -984,7 +984,7 @@ libisc_dep = declare_dependency(
- dns_srcconf = dns_srcset.apply(config, strict: false)
- 
- libdns = library(
--    'dns',
-+    'dns-'+meson.project_version(),
-     dns_srcconf.sources(),
-     include_directories: dns_inc,
-     install: true,
-@@ -1018,7 +1018,7 @@ libdns_dep = declare_dependency(
- ns_srcconf = ns_srcset.apply(config, strict: false)
- 
- libns = library(
--    'ns',
-+    'ns-'+meson.project_version(),
-     ns_srcconf.sources(),
-     objects: ns_probe_objects,
-     install: true,
-@@ -1044,7 +1044,7 @@ libns_dep = declare_dependency(
- isccc_srcconf = isccc_srcset.apply(config, strict: false)
- 
- libisccc = library(
--    'isccc',
-+    'isccc-'+meson.project_version(),
-     isccc_srcconf.sources(),
-     implicit_include_directories: false,
-     include_directories: isccc_inc,
-@@ -1065,7 +1065,7 @@ libisccc_dep = declare_dependency(
- isccfg_srcconf = isccfg_srcset.apply(config, strict: false)
- 
- libisccfg = library(
--    'isccfg',
-+    'isccfg-'+meson.project_version(),
-     isccfg_srcconf.sources(),
-     implicit_include_directories: false,
-     include_directories: isccfg_inc,
--- 
-2.50.1
-

From 0ed5fc08dd99f63cc69edc33fe9d8a88b0a6caf6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 30 Oct 2025 13:33:48 +0100
Subject: [PATCH 36/64] Update to 9.21.14 (rhbz#2394406)

Security Fixes:

- DNSSEC validation fails if matching but invalid DNSKEY is found. (CVE-2025-8677)
- Address various spoofing attacks. (CVE-2025-40778)
- Cache-poisoning due to weak pseudo-random number generator. (CVE-2025-40780)

New Features:

- Add dnssec-policy keys configuration check to named-checkconf.
- Add support for synthetic records.
- Support for zone-specific plugins.
- Support for additional tokens in the zone file name template.

Removed Features:

- Remove randomized RRset ordering.

and bug fixes

https://downloads.isc.org/isc/bind9/9.21.14/doc/arm/html/notes.html#notes-for-bind-9-21-14
---
 bind9-next.spec | 4 +++-
 sources         | 4 ++--
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/bind9-next.spec b/bind9-next.spec
index 5239282..c888c65 100644
--- a/bind9-next.spec
+++ b/bind9-next.spec
@@ -55,7 +55,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind9-next
 License:  MPL-2.0 AND ISC AND BSD-3-clause AND MIT AND BSD-2-clause
 #
-Version:  9.21.11
+Version:  9.21.14
 Release:  %autorelease
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
@@ -362,6 +362,7 @@ export LIBDIR_SUFFIX
 %meson \
   --includedir=%{_includedir}/bind9 \
   -Didn=enabled \
+  -Dfuzzing=disabled \
 %if %{without DTRACE}
   -Dtracing=disabled \
 %endif
@@ -707,6 +708,7 @@ fi;
 # FIXME: current build targets filters into %%_libdir/bind again?
 %dir %{_libdir}/bind
 %{_libdir}/bind/filter*.so
+%{_libdir}/bind/synthrecord.so
 %dir %{_libdir}/named
 %config(noreplace) %verify(not md5 size mtime) %{_sysconfdir}/sysconfig/named
 %config(noreplace) %attr(0644,root,named) %{_sysconfdir}/named.root.key
diff --git a/sources b/sources
index d12b4a2..714e4db 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.21.11.tar.xz) = dc4a20fc063b6dcec18d5241117eeb741a1e9e8f9e0bdac2743458b87de6a5496fff1e610c3c0676ae65e76b2741c86badb83df5b9278df8595194687359b5d6
-SHA512 (bind-9.21.11.tar.xz.asc) = 25ada3e81c3f60665f0b7f8ef24ba6e81ebd85627126e03ffcfecb02c78aa3f309fc25dce258495c1f5087072f0abad8932b2cd009f85180a27a9bd5f8ed6e80
+SHA512 (bind-9.21.14.tar.xz) = bf4bd0f5613d6c6d53f749f3269a34f3a5c74a7dc81e05922d58ba30f19d418e565838dd1182dd6052b9a62b3799d2d0f12451f2797af3279259df59cfc4be05
+SHA512 (bind-9.21.14.tar.xz.asc) = 91ccc82ca54d07dba07821c3410f92b563290ead48546d605b0dbd9958a831d9b90130002fbb325e0cdc913de64813d8ba4c48ec958ebba7f5f462d43f578394

From 9b6df11143011ee9d5011d43700298f6ae9d0a19 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 6 Nov 2025 15:55:40 +0100
Subject: [PATCH 37/64] Prevent SERVFAIL on dual signed zones with one
 unsupported signature (rhbz#2413104)

---
 bind-9.21-dual-sign-continue-test.patch | 115 ++++++++++++++++++++++++
 bind-9.21-dual-sign-continue.patch      |  42 +++++++++
 bind9-next.spec                         |   2 +
 3 files changed, 159 insertions(+)
 create mode 100644 bind-9.21-dual-sign-continue-test.patch
 create mode 100644 bind-9.21-dual-sign-continue.patch

diff --git a/bind-9.21-dual-sign-continue-test.patch b/bind-9.21-dual-sign-continue-test.patch
new file mode 100644
index 0000000..18408af
--- /dev/null
+++ b/bind-9.21-dual-sign-continue-test.patch
@@ -0,0 +1,115 @@
+From 488d7bfc75f2988c6e461b8677bc0e27e58bd82e Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
+Date: Sat, 1 Nov 2025 12:00:59 +0100
+Subject: [PATCH] Add a system test with one good and one bad algorithm
+
+The case where there would be one supported algorithm and one already
+unsupported (like RSAMD5 or RSASHA1) was missing.
+---
+ bin/tests/system/dnssec/ns2/example.db.in   |  4 +++
+ bin/tests/system/dnssec/ns2/sign.sh         |  2 +-
+ bin/tests/system/dnssec/ns3/named.conf.j2   |  6 ++++
+ bin/tests/system/dnssec/ns3/sign.sh         | 31 +++++++++++++++++++++
+ bin/tests/system/dnssec/tests_validation.py |  8 ++++++
+ 5 files changed, 50 insertions(+), 1 deletion(-)
+
+diff --git a/bin/tests/system/dnssec/ns2/example.db.in b/bin/tests/system/dnssec/ns2/example.db.in
+index 47c2eb7f0e..07429366ee 100644
+--- a/bin/tests/system/dnssec/ns2/example.db.in
++++ b/bin/tests/system/dnssec/ns2/example.db.in
+@@ -202,3 +202,7 @@ ns3.extradsunknownoid	A	10.53.0.3
+ 
+ extended-ds-unknown-oid	NS	ns3.extended-ds-unknown-oid
+ ns3.extended-ds-unknown-oid A	10.53.0.3
++
++; A secure subdomain with extra bad key
++extrabadkey		NS	ns3.extrabadkey
++ns3.extrabadkey		A	10.53.0.3
+diff --git a/bin/tests/system/dnssec/ns2/sign.sh b/bin/tests/system/dnssec/ns2/sign.sh
+index e3f18af15e..da9f5f07fc 100644
+--- a/bin/tests/system/dnssec/ns2/sign.sh
++++ b/bin/tests/system/dnssec/ns2/sign.sh
+@@ -92,7 +92,7 @@ for subdomain in digest-alg-unsupported ds-unsupported secure badds \
+   dnskey-nsec3-unknown managed-future future revkey \
+   dname-at-apex-nsec3 occluded rsasha1 rsasha1-1024 \
+   rsasha256oid rsasha512oid unknownoid extradsoid extradsunknownoid \
+-  extended-ds-unknown-oid; do
++  extended-ds-unknown-oid extrabadkey; do
+   cp "../ns3/dsset-$subdomain.example." .
+ done
+ 
+diff --git a/bin/tests/system/dnssec/ns3/named.conf.j2 b/bin/tests/system/dnssec/ns3/named.conf.j2
+index 1a0edc14bb..9cbc58892c 100644
+--- a/bin/tests/system/dnssec/ns3/named.conf.j2
++++ b/bin/tests/system/dnssec/ns3/named.conf.j2
+@@ -141,6 +141,12 @@ zone "extrakey.example" {
+ 	allow-update { any; };
+ };
+ 
++zone "extrabadkey.example" {
++	type primary;
++	file "extrabadkey.example.db.signed";
++	allow-update { any; };
++};
++
+ zone "insecure.nsec3.example" {
+ 	type primary;
+ 	file "insecure.nsec3.example.db";
+diff --git a/bin/tests/system/dnssec/ns3/sign.sh b/bin/tests/system/dnssec/ns3/sign.sh
+index 5512888b2f..ea81381eb2 100644
+--- a/bin/tests/system/dnssec/ns3/sign.sh
++++ b/bin/tests/system/dnssec/ns3/sign.sh
+@@ -905,3 +905,34 @@ ksk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK "$zone")
+ zsk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
+ cat "$infile" "$ksk.key" "$zsk.key" >"$zonefile"
+ "$SIGNER" -g -o "$zone" "$zonefile" >/dev/null 2>&1
++
++#
++#
++#
++zone=extrabadkey.example.
++infile=template.db.in
++zonefile=extrabadkey.example.db
++
++# Add KSK and ZSK that we will mangle to RSAMD5
++ksk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK "$zone")
++zsk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
++cat "$infile" "$ksk.key" "$zsk.key" >"$zonefile"
++"$SIGNER" -g -O full -o "$zone" "$zonefile" >/dev/null 2>&1
++
++# Mangle the signatures to RSAMD5 and save them for future use
++sed -ne "s/\(IN[[:space:]]*RRSIG[[:space:]]*[A-Z]*\) $DEFAULT_ALGORITHM_NUMBER /\1 1 /p" <"$zonefile.signed" >"$zonefile.signed.rsamd5"
++
++# Now add normal KSK and ZSK to the zone file
++ksk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK "$zone")
++zsk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
++cat "$infile" "$ksk.key" "$zsk.key" >"$zonefile"
++
++# Mangle the DNSKEY algorithm numbers and add them to the signed zone file
++cat "$ksk.key" "$zsk.key" | sed -e "s/\(IN[[:space:]]*DNSKEY[[:space:]]*[0-9]* 3\) $DEFAULT_ALGORITHM_NUMBER /\1 1 /" >>"$zonefile"
++
++# Sign normally
++"$SIGNER" -g -o "$zone" "$zonefile" >/dev/null 2>&1
++
++# Add the mangled signatures to signed zone file
++cat "$zonefile.signed.rsamd5" >>"$zonefile.signed"
++rm "$zonefile.signed.rsamd5"
+diff --git a/bin/tests/system/dnssec/tests_validation.py b/bin/tests/system/dnssec/tests_validation.py
+index e6d8ccc734..a27a899987 100644
+--- a/bin/tests/system/dnssec/tests_validation.py
++++ b/bin/tests/system/dnssec/tests_validation.py
+@@ -1385,3 +1385,11 @@ def test_rrsigs_for_glue():
+         record.rdtype == rdatatype.RRSIG and record.covers == rdatatype.A
+         for record in res.answer
+     )
++
++
++def test_extra_bad_algorithm():
++    msg = isctest.query.create("a.extrabadkey.example", "A")
++    res1 = isctest.query.tcp(msg, "10.53.0.3")
++    res2 = isctest.query.tcp(msg, "10.53.0.4")
++    isctest.check.same_answer(res1, res2)
++    isctest.check.adflag(res2)
+-- 
+2.51.1
+
diff --git a/bind-9.21-dual-sign-continue.patch b/bind-9.21-dual-sign-continue.patch
new file mode 100644
index 0000000..22e3cef
--- /dev/null
+++ b/bind-9.21-dual-sign-continue.patch
@@ -0,0 +1,42 @@
+From a94a7c1a1e6eecbead995a08bace33d23899a5da Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
+Date: Tue, 4 Nov 2025 02:09:38 +0100
+Subject: [PATCH] Skip unsupported algorithms when looking for signing key
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+When looking for a signing key in select_signing_key(), the result code
+indicating unsupported algorithm would abort the search.  Instead, skip
+such keys and continue searching for the right key.
+
+Co-Authored-By: Aram Sargsyan <aram@isc.org>
+Co-Authored-By: Petr Menšík <pemensik@redhat.com>
+---
+ lib/dns/validator.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/lib/dns/validator.c b/lib/dns/validator.c
+index c6781544b9..52677fbd80 100644
+--- a/lib/dns/validator.c
++++ b/lib/dns/validator.c
+@@ -1092,8 +1092,14 @@ select_signing_key(dns_validator_t *val, dns_rdataset_t *rdataset) {
+ 			continue;
+ 		}
+ 
+-		return dns_dnssec_keyfromrdata(&siginfo->signer, &rdata,
+-					       val->view->mctx, &val->key);
++		result = dns_dnssec_keyfromrdata(&siginfo->signer, &rdata,
++						 val->view->mctx, &val->key);
++		/* Don't count unsupported algorithm towards max fails */
++		if (result == DST_R_UNSUPPORTEDALG) {
++			/* Continue with the next key */
++			continue;
++		}
++		return result;
+ 	}
+ 
+ 	return ISC_R_NOTFOUND;
+-- 
+2.51.1
+
diff --git a/bind9-next.spec b/bind9-next.spec
index c888c65..406feab 100644
--- a/bind9-next.spec
+++ b/bind9-next.spec
@@ -96,6 +96,8 @@ Patch3: bind-9.21-unittest-isc_rwlock-s390x.patch
 # https://gitlab.isc.org/isc-projects/bind9/-/issues/5328
 # avoid often fails on i386, unsupported upstream
 Patch4: bind-9.21-unittest-qpdb-i386.patch
+Patch5: bind-9.21-dual-sign-continue.patch
+Patch6: bind-9.21-dual-sign-continue-test.patch
 
 %{?systemd_ordering}
 Requires:       coreutils

From fcb909a9a9640619647f7f6421dc0704e51fb0ae Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Fri, 16 Jan 2026 04:24:06 +0000
Subject: [PATCH 38/64] Rebuilt for
 https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild


From 8b3576433e13bc1a5839e2f568cd52ad3ae4982a Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Fri, 16 Jan 2026 08:20:58 +0000
Subject: [PATCH 39/64] Rebuilt for
 https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild


From 5d8736bccddfcbdafecc161c3aa390473a287b1f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 11 Nov 2025 12:07:48 +0100
Subject: [PATCH 40/64] Fix running SYSTEMTEST during build

Needs prepared network scripts.

Can be used like:
fedpkg mockbuild --enable-network --with SYSTEMTEST
---
 bind9-next.spec | 22 ++++++++++++++++------
 1 file changed, 16 insertions(+), 6 deletions(-)

diff --git a/bind9-next.spec b/bind9-next.spec
index 5d27915..fd0bb15 100644
--- a/bind9-next.spec
+++ b/bind9-next.spec
@@ -151,6 +151,8 @@ BuildRequires:  softhsm
 BuildRequires:  perl(Net::DNS) perl(Net::DNS::Nameserver) perl(Time::HiRes) perl(Getopt::Long)
 BuildRequires:  perl(English)
 BuildRequires:  python3-pytest
+BuildRequires:  python3-pytest-xdist
+BuildRequires:  python3-dns
 # manual configuration requires this tool
 BuildRequires:  iproute
 BuildRequires:  python3-jinja2
@@ -394,6 +396,9 @@ export LIBDIR_SUFFIX
 %if %{with DOC}
   %meson_build man arm arm-epub
 %endif
+%if %{with SYSTEMTEST}
+  %meson_build system-test-dependencies
+%endif
 
 # Compress changelog by default
 gzip doc/changelog/changelog-*.rst
@@ -460,18 +465,23 @@ export TSAN_OPTIONS="log_exe_name=true log_path=ThreadSanitizer exitcode=0"
 
   if [ -n "$CONFIGURED" ]
   then
-    set -e
-    pushd bin/tests
+    pushd bin/tests/system
     export CI_SYSTEM=yes # allow running tests as root
     chown -R ${USER} . # Can be unknown user
-    %meson_build test 2>&1 | tee test.log
-    e=$?
+    e=0
+    pytest -n ${THREADS} --capture=tee-sys || e=$?
     [ "$CONFIGURED" = build ] && $SUDO sh ./ifconfig.sh down
-    popd
     if [ "$e" -ne 0 ]; then
-      echo "ERROR: this build of BIND failed 'make test'. Aborting."
+      echo "ERROR: failed running 'pytest' in system tests. Aborting."
+      ls -1 "$(pwd)"/*_tmp_*
+      for TMPTEST in *_tmp_*
+      do
+        echo "# $TMPTEST"
+        cat $TMPTEST/pytest.log.txt
+      done
       exit $e;
     fi;
+    popd
   else
     echo 'SKIPPED: tests require root, CAP_NET_ADMIN or already configured test addresses.'
   fi

From 8ac024600e0649a582af044cfe54e5ba0fa10878 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 21 Nov 2025 22:32:42 +0100
Subject: [PATCH 41/64] Update to 9.21.15 (rhbz#2415843)

New features:

- New rndc showconf command.
- named-checkconf -b dumps the built-in configuration.
- named-checkconf -e prints the effective configuration.
- Add support for Extended DNS Error 24 (Invalid Data).

Removed features:

- Remove the tkey-domain statement.
- Remove the tkey-gssapi-credential statement.

Feature changes:

- Minimal Meson version required is 1.3.0.

Bug fixes:

- Skip unsupported algorithms when looking for a signing key.
- Report when a zone reload is already in progress.
- Fix dnssec-keygen key collision checking for KEY RRtype keys.
- dnssec-verify now uses exit code 1 when failing due to illegal options.
- Prevent assertion failures of dig when a server is specified before the -b option.
- Skip buffer allocations if not logging.

https://downloads.isc.org/isc/bind9/9.21.15/doc/arm/html/notes.html#notes-for-bind-9-21-15
---
 bind-9.21-dual-sign-continue-test.patch | 115 ------------------------
 bind-9.21-dual-sign-continue.patch      |  42 ---------
 bind9-next.spec                         |   6 +-
 sources                                 |   4 +-
 4 files changed, 4 insertions(+), 163 deletions(-)
 delete mode 100644 bind-9.21-dual-sign-continue-test.patch
 delete mode 100644 bind-9.21-dual-sign-continue.patch

diff --git a/bind-9.21-dual-sign-continue-test.patch b/bind-9.21-dual-sign-continue-test.patch
deleted file mode 100644
index 18408af..0000000
--- a/bind-9.21-dual-sign-continue-test.patch
+++ /dev/null
@@ -1,115 +0,0 @@
-From 488d7bfc75f2988c6e461b8677bc0e27e58bd82e Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
-Date: Sat, 1 Nov 2025 12:00:59 +0100
-Subject: [PATCH] Add a system test with one good and one bad algorithm
-
-The case where there would be one supported algorithm and one already
-unsupported (like RSAMD5 or RSASHA1) was missing.
----
- bin/tests/system/dnssec/ns2/example.db.in   |  4 +++
- bin/tests/system/dnssec/ns2/sign.sh         |  2 +-
- bin/tests/system/dnssec/ns3/named.conf.j2   |  6 ++++
- bin/tests/system/dnssec/ns3/sign.sh         | 31 +++++++++++++++++++++
- bin/tests/system/dnssec/tests_validation.py |  8 ++++++
- 5 files changed, 50 insertions(+), 1 deletion(-)
-
-diff --git a/bin/tests/system/dnssec/ns2/example.db.in b/bin/tests/system/dnssec/ns2/example.db.in
-index 47c2eb7f0e..07429366ee 100644
---- a/bin/tests/system/dnssec/ns2/example.db.in
-+++ b/bin/tests/system/dnssec/ns2/example.db.in
-@@ -202,3 +202,7 @@ ns3.extradsunknownoid	A	10.53.0.3
- 
- extended-ds-unknown-oid	NS	ns3.extended-ds-unknown-oid
- ns3.extended-ds-unknown-oid A	10.53.0.3
-+
-+; A secure subdomain with extra bad key
-+extrabadkey		NS	ns3.extrabadkey
-+ns3.extrabadkey		A	10.53.0.3
-diff --git a/bin/tests/system/dnssec/ns2/sign.sh b/bin/tests/system/dnssec/ns2/sign.sh
-index e3f18af15e..da9f5f07fc 100644
---- a/bin/tests/system/dnssec/ns2/sign.sh
-+++ b/bin/tests/system/dnssec/ns2/sign.sh
-@@ -92,7 +92,7 @@ for subdomain in digest-alg-unsupported ds-unsupported secure badds \
-   dnskey-nsec3-unknown managed-future future revkey \
-   dname-at-apex-nsec3 occluded rsasha1 rsasha1-1024 \
-   rsasha256oid rsasha512oid unknownoid extradsoid extradsunknownoid \
--  extended-ds-unknown-oid; do
-+  extended-ds-unknown-oid extrabadkey; do
-   cp "../ns3/dsset-$subdomain.example." .
- done
- 
-diff --git a/bin/tests/system/dnssec/ns3/named.conf.j2 b/bin/tests/system/dnssec/ns3/named.conf.j2
-index 1a0edc14bb..9cbc58892c 100644
---- a/bin/tests/system/dnssec/ns3/named.conf.j2
-+++ b/bin/tests/system/dnssec/ns3/named.conf.j2
-@@ -141,6 +141,12 @@ zone "extrakey.example" {
- 	allow-update { any; };
- };
- 
-+zone "extrabadkey.example" {
-+	type primary;
-+	file "extrabadkey.example.db.signed";
-+	allow-update { any; };
-+};
-+
- zone "insecure.nsec3.example" {
- 	type primary;
- 	file "insecure.nsec3.example.db";
-diff --git a/bin/tests/system/dnssec/ns3/sign.sh b/bin/tests/system/dnssec/ns3/sign.sh
-index 5512888b2f..ea81381eb2 100644
---- a/bin/tests/system/dnssec/ns3/sign.sh
-+++ b/bin/tests/system/dnssec/ns3/sign.sh
-@@ -905,3 +905,34 @@ ksk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK "$zone")
- zsk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
- cat "$infile" "$ksk.key" "$zsk.key" >"$zonefile"
- "$SIGNER" -g -o "$zone" "$zonefile" >/dev/null 2>&1
-+
-+#
-+#
-+#
-+zone=extrabadkey.example.
-+infile=template.db.in
-+zonefile=extrabadkey.example.db
-+
-+# Add KSK and ZSK that we will mangle to RSAMD5
-+ksk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK "$zone")
-+zsk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
-+cat "$infile" "$ksk.key" "$zsk.key" >"$zonefile"
-+"$SIGNER" -g -O full -o "$zone" "$zonefile" >/dev/null 2>&1
-+
-+# Mangle the signatures to RSAMD5 and save them for future use
-+sed -ne "s/\(IN[[:space:]]*RRSIG[[:space:]]*[A-Z]*\) $DEFAULT_ALGORITHM_NUMBER /\1 1 /p" <"$zonefile.signed" >"$zonefile.signed.rsamd5"
-+
-+# Now add normal KSK and ZSK to the zone file
-+ksk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK "$zone")
-+zsk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
-+cat "$infile" "$ksk.key" "$zsk.key" >"$zonefile"
-+
-+# Mangle the DNSKEY algorithm numbers and add them to the signed zone file
-+cat "$ksk.key" "$zsk.key" | sed -e "s/\(IN[[:space:]]*DNSKEY[[:space:]]*[0-9]* 3\) $DEFAULT_ALGORITHM_NUMBER /\1 1 /" >>"$zonefile"
-+
-+# Sign normally
-+"$SIGNER" -g -o "$zone" "$zonefile" >/dev/null 2>&1
-+
-+# Add the mangled signatures to signed zone file
-+cat "$zonefile.signed.rsamd5" >>"$zonefile.signed"
-+rm "$zonefile.signed.rsamd5"
-diff --git a/bin/tests/system/dnssec/tests_validation.py b/bin/tests/system/dnssec/tests_validation.py
-index e6d8ccc734..a27a899987 100644
---- a/bin/tests/system/dnssec/tests_validation.py
-+++ b/bin/tests/system/dnssec/tests_validation.py
-@@ -1385,3 +1385,11 @@ def test_rrsigs_for_glue():
-         record.rdtype == rdatatype.RRSIG and record.covers == rdatatype.A
-         for record in res.answer
-     )
-+
-+
-+def test_extra_bad_algorithm():
-+    msg = isctest.query.create("a.extrabadkey.example", "A")
-+    res1 = isctest.query.tcp(msg, "10.53.0.3")
-+    res2 = isctest.query.tcp(msg, "10.53.0.4")
-+    isctest.check.same_answer(res1, res2)
-+    isctest.check.adflag(res2)
--- 
-2.51.1
-
diff --git a/bind-9.21-dual-sign-continue.patch b/bind-9.21-dual-sign-continue.patch
deleted file mode 100644
index 22e3cef..0000000
--- a/bind-9.21-dual-sign-continue.patch
+++ /dev/null
@@ -1,42 +0,0 @@
-From a94a7c1a1e6eecbead995a08bace33d23899a5da Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
-Date: Tue, 4 Nov 2025 02:09:38 +0100
-Subject: [PATCH] Skip unsupported algorithms when looking for signing key
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-When looking for a signing key in select_signing_key(), the result code
-indicating unsupported algorithm would abort the search.  Instead, skip
-such keys and continue searching for the right key.
-
-Co-Authored-By: Aram Sargsyan <aram@isc.org>
-Co-Authored-By: Petr Menšík <pemensik@redhat.com>
----
- lib/dns/validator.c | 10 ++++++++--
- 1 file changed, 8 insertions(+), 2 deletions(-)
-
-diff --git a/lib/dns/validator.c b/lib/dns/validator.c
-index c6781544b9..52677fbd80 100644
---- a/lib/dns/validator.c
-+++ b/lib/dns/validator.c
-@@ -1092,8 +1092,14 @@ select_signing_key(dns_validator_t *val, dns_rdataset_t *rdataset) {
- 			continue;
- 		}
- 
--		return dns_dnssec_keyfromrdata(&siginfo->signer, &rdata,
--					       val->view->mctx, &val->key);
-+		result = dns_dnssec_keyfromrdata(&siginfo->signer, &rdata,
-+						 val->view->mctx, &val->key);
-+		/* Don't count unsupported algorithm towards max fails */
-+		if (result == DST_R_UNSUPPORTEDALG) {
-+			/* Continue with the next key */
-+			continue;
-+		}
-+		return result;
- 	}
- 
- 	return ISC_R_NOTFOUND;
--- 
-2.51.1
-
diff --git a/bind9-next.spec b/bind9-next.spec
index fd0bb15..5dde8c8 100644
--- a/bind9-next.spec
+++ b/bind9-next.spec
@@ -52,7 +52,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind9-next
 License:  MPL-2.0 AND ISC AND BSD-3-clause AND MIT AND BSD-2-clause
 #
-Version:  9.21.14
+Version:  9.21.15
 Release:  %autorelease
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
@@ -93,8 +93,6 @@ Patch3: bind-9.21-unittest-isc_rwlock-s390x.patch
 # https://gitlab.isc.org/isc-projects/bind9/-/issues/5328
 # avoid often fails on i386, unsupported upstream
 Patch4: bind-9.21-unittest-qpdb-i386.patch
-Patch5: bind-9.21-dual-sign-continue.patch
-Patch6: bind-9.21-dual-sign-continue-test.patch
 
 %{?systemd_ordering}
 Requires:       coreutils
@@ -111,7 +109,7 @@ BuildRequires:  gcc
 BuildRequires:  make
 BuildRequires:  openssl-devel
 BuildRequires:  libtool
-BuildRequires:  meson
+BuildRequires:  meson >= 1.3.0
 BuildRequires:  ninja-build
 BuildRequires:  pkgconfig
 BuildRequires:  libcap-devel
diff --git a/sources b/sources
index 714e4db..62a6afc 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.21.14.tar.xz) = bf4bd0f5613d6c6d53f749f3269a34f3a5c74a7dc81e05922d58ba30f19d418e565838dd1182dd6052b9a62b3799d2d0f12451f2797af3279259df59cfc4be05
-SHA512 (bind-9.21.14.tar.xz.asc) = 91ccc82ca54d07dba07821c3410f92b563290ead48546d605b0dbd9958a831d9b90130002fbb325e0cdc913de64813d8ba4c48ec958ebba7f5f462d43f578394
+SHA512 (bind-9.21.15.tar.xz) = 6c18c2a0a915e6c42036b6869a1d495872de7c94b67f036d8074a8d45c1cefff57d8df64b0d8a34611d3cdc1b09b2e6d3e4989d4cdf450643735e8ecb8d49d86
+SHA512 (bind-9.21.15.tar.xz.asc) = ca422a14adc3027a7301b628afad73dc2f5759456b27180402b707f30fba41dc9af4dfb2f0c8f25b1f1eed0a78dc16cabcd0ec19e5455966cf8e1b5a67296b57

From f0a10662c1d8844e0433b57a3c15211dcfcc1af2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 21 Nov 2025 23:51:11 +0100
Subject: [PATCH 42/64] Use dns-root-data package for hints source

Use trusted root source and hints from separate package.
---
 bind9-next.spec    | 26 ++++++++-----
 named-chroot.files |  1 +
 named-mkroot.sh    | 20 ++++++++++
 named.root         | 92 ----------------------------------------------
 named.root.key     | 23 +++---------
 trusted-key.key    |  2 -
 6 files changed, 42 insertions(+), 122 deletions(-)
 create mode 100755 named-mkroot.sh
 delete mode 100644 named.root
 delete mode 100644 trusted-key.key

diff --git a/bind9-next.spec b/bind9-next.spec
index 5dde8c8..3d287b6 100644
--- a/bind9-next.spec
+++ b/bind9-next.spec
@@ -30,7 +30,7 @@
 %global        chroot_prefix     %{bind_dir}/chroot
 %global        chroot_create_directories /dev /run/named %{_localstatedir}/{log,named,tmp} \\\
                                          %{_sysconfdir}/{crypto-policies/back-ends,pki/dnssec-keys,pki/tls,named} \\\
-                                         %{_libdir}/bind %{_libdir}/named %{_datadir}/GeoIP /proc/sys/net/ipv4
+                                         %{_libdir}/bind %{_libdir}/named %{_datadir}/{GeoIP,dns-root-data} /proc/sys/net/ipv4
 
 %global forgeurl0 https://gitlab.isc.org/isc-projects/bind9
 
@@ -64,17 +64,13 @@ Source2:  https://downloads.isc.org/isc/bind9/%{version}/%{upname}-%{version}.ta
 Source3:  named.logrotate
 Source4:  https://www.isc.org/docs/isc-keyblock.asc
 Source16: named.conf
-# Refresh by command: dig @a.root-servers.net. +tcp +norec
-# or from URL
-Source17: https://www.internic.net/domain/named.root
 Source18: named.localhost
 Source19: named.loopback
 Source20: named.empty
 Source23: named.rfc1912.zones
 Source25: named.conf.sample
-Source27: named.root.key
+Source27: named-mkroot.sh
 Source35: bind.tmpfiles.d
-Source36: trusted-key.key
 Source37: named.service
 Source38: named-chroot.service
 Source41: setup-named-chroot.sh
@@ -99,6 +95,7 @@ Requires:       coreutils
 Requires(post): shadow-utils
 Requires(post): glibc-common
 Requires(post): grep
+Requires:       dns-root-data
 Requires:       %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release}
 Recommends:     %{name}-utils %{name}-dnssec-utils
 %upname_compat %{upname}
@@ -122,6 +119,7 @@ BuildRequires:  sed
 BuildRequires:  libnghttp2-devel
 BuildRequires:  userspace-rcu-devel
 BuildRequires:  pkgconfig(libedit)
+BuildRequires:  dns-root-data
 # Compress the changelog
 BuildRequires:  gzip
 %if 0%{?fedora}
@@ -347,6 +345,10 @@ export STD_CDEFINES="$CPPFLAGS"
 #'s/([bind_VERSION_EXTRA],\s*\([^)]*\))/([bind_VERSION_EXTRA], \1-RH)/' \
 #configure.ac
 
+install -p -m 0755 %{SOURCE27} ./named-mkroot.sh # create named.root.key
+./named-mkroot.sh
+[ -f named.root.key ]
+
 
 LIBDIR_SUFFIX=
 export LIBDIR_SUFFIX
@@ -414,6 +416,10 @@ gzip doc/changelog/changelog-*.rst
 export TSAN_OPTIONS="log_exe_name=true log_path=ThreadSanitizer exitcode=0"
 %endif
 
+# We produce it runtime. Check it has valid syntax.
+LD_LIBRARY_PATH="$LD_LIBRARY_PATH:${RPM_BUILD_ROOT}%{_libdir}" \
+  ${RPM_BUILD_ROOT}%{_bindir}/named-checkconf ${RPM_BUILD_ROOT}%{_sysconfdir}/named.root.key
+
 %if %{with UNITTEST}
   CPUS=$(lscpu -p=cpu,core | grep -v '^#' | wc -l)
   THREADS="$CPUS"
@@ -584,13 +590,13 @@ touch ${RPM_BUILD_ROOT}%{_localstatedir}/log/named.log
 # configuration files:
 install -m 640 %{SOURCE16} ${RPM_BUILD_ROOT}%{_sysconfdir}/named.conf
 touch ${RPM_BUILD_ROOT}%{_sysconfdir}/rndc.{key,conf}
-install -m 644 %{SOURCE27} ${RPM_BUILD_ROOT}%{_sysconfdir}/named.root.key
-install -m 644 %{SOURCE36} ${RPM_BUILD_ROOT}%{_sysconfdir}/trusted-key.key
+install -m 644 -p named.root.key ${RPM_BUILD_ROOT}%{_sysconfdir}/named.root.key
+ln -s "%{_datadir}/dns-root-data/root.key" ${RPM_BUILD_ROOT}%{_sysconfdir}/trusted-key.key
 mkdir -p ${RPM_BUILD_ROOT}%{_sysconfdir}/named
 
 # data files:
 mkdir -p ${RPM_BUILD_ROOT}%{_localstatedir}/named
-install -m 640 %{SOURCE17} ${RPM_BUILD_ROOT}%{_localstatedir}/named/named.ca
+ln -s "%{_datadir}/dns-root-data/root.hints" ${RPM_BUILD_ROOT}%{_localstatedir}/named/named.ca
 install -m 640 %{SOURCE18} ${RPM_BUILD_ROOT}%{_localstatedir}/named/named.localhost
 install -m 640 %{SOURCE19} ${RPM_BUILD_ROOT}%{_localstatedir}/named/named.loopback
 install -m 640 %{SOURCE20} ${RPM_BUILD_ROOT}%{_localstatedir}/named/named.empty
@@ -603,7 +609,7 @@ install -m 644 %{SOURCE25} sample/etc/named.conf
 install -m 644 %{SOURCE16} named.conf.default
 install -m 644 %{SOURCE23} sample/etc/named.rfc1912.zones
 install -m 644 %{SOURCE18} %{SOURCE19} %{SOURCE20}  sample/var/named
-install -m 644 %{SOURCE17} sample/var/named/named.ca
+ln -s "%{_datadir}/dns-root-data/root.hints" sample/var/named/named.ca
 for f in my.internal.zone.db slaves/my.slave.internal.zone.db slaves/my.ddns.internal.zone.db my.external.zone.db; do 
   echo '@ in soa localhost. root 1 3H 15M 1W 1D
   ns localhost.' > sample/var/named/$f; 
diff --git a/named-chroot.files b/named-chroot.files
index c186664..c901664 100644
--- a/named-chroot.files
+++ b/named-chroot.files
@@ -18,6 +18,7 @@
 /usr/lib64/bind
 /usr/lib/bind
 /usr/share/GeoIP
+/usr/share/dns-root-data
 /run/named
 /proc/sys/net/ipv4/ip_local_port_range
 # Warning: the order is important
diff --git a/named-mkroot.sh b/named-mkroot.sh
new file mode 100755
index 0000000..288725b
--- /dev/null
+++ b/named-mkroot.sh
@@ -0,0 +1,20 @@
+#!/bin/sh
+# Create named.root.key from dns-root-data package
+
+ROOT_DS=/usr/share/dns-root-data/root.ds
+: ${OUTPUT:=named.root.key}
+
+if ! [ -r "$ROOT_DS" ]; then
+	echo "Root trust file is not readable: $ROOT_DS"
+	exit 1
+fi
+
+echo "# Autogenerated from $ROOT_DS" > "$OUTPUT"
+echo "trust-anchors {" >> "$OUTPUT"
+cat "$ROOT_DS" | while read DOMAIN CLS QTYPE KEYTAG ALG DIG HASH;
+do
+	echo "$DOMAIN initial-ds $KEYTAG $ALG $DIG \"$HASH\";" >> "$OUTPUT";
+done
+echo "}; " >> "$OUTPUT"
+# Set the same modification time as data source.
+touch -r $ROOT_DS "$OUTPUT"
diff --git a/named.root b/named.root
deleted file mode 100644
index 8b8a3b1..0000000
--- a/named.root
+++ /dev/null
@@ -1,92 +0,0 @@
-;       This file holds the information on root name servers needed to 
-;       initialize cache of Internet domain name servers
-;       (e.g. reference this file in the "cache  .  <file>"
-;       configuration file of BIND domain name servers). 
-; 
-;       This file is made available by InterNIC 
-;       under anonymous FTP as
-;           file                /domain/named.cache 
-;           on server           FTP.INTERNIC.NET
-;       -OR-                    RS.INTERNIC.NET
-;
-;       last update:     December 20, 2023
-;       related version of root zone:     2023122001
-; 
-; FORMERLY NS.INTERNIC.NET 
-;
-.                        3600000      NS    A.ROOT-SERVERS.NET.
-A.ROOT-SERVERS.NET.      3600000      A     198.41.0.4
-A.ROOT-SERVERS.NET.      3600000      AAAA  2001:503:ba3e::2:30
-; 
-; FORMERLY NS1.ISI.EDU 
-;
-.                        3600000      NS    B.ROOT-SERVERS.NET.
-B.ROOT-SERVERS.NET.      3600000      A     170.247.170.2
-B.ROOT-SERVERS.NET.      3600000      AAAA  2801:1b8:10::b
-; 
-; FORMERLY C.PSI.NET 
-;
-.                        3600000      NS    C.ROOT-SERVERS.NET.
-C.ROOT-SERVERS.NET.      3600000      A     192.33.4.12
-C.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:2::c
-; 
-; FORMERLY TERP.UMD.EDU 
-;
-.                        3600000      NS    D.ROOT-SERVERS.NET.
-D.ROOT-SERVERS.NET.      3600000      A     199.7.91.13
-D.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:2d::d
-; 
-; FORMERLY NS.NASA.GOV
-;
-.                        3600000      NS    E.ROOT-SERVERS.NET.
-E.ROOT-SERVERS.NET.      3600000      A     192.203.230.10
-E.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:a8::e
-; 
-; FORMERLY NS.ISC.ORG
-;
-.                        3600000      NS    F.ROOT-SERVERS.NET.
-F.ROOT-SERVERS.NET.      3600000      A     192.5.5.241
-F.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:2f::f
-; 
-; FORMERLY NS.NIC.DDN.MIL
-;
-.                        3600000      NS    G.ROOT-SERVERS.NET.
-G.ROOT-SERVERS.NET.      3600000      A     192.112.36.4
-G.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:12::d0d
-; 
-; FORMERLY AOS.ARL.ARMY.MIL
-;
-.                        3600000      NS    H.ROOT-SERVERS.NET.
-H.ROOT-SERVERS.NET.      3600000      A     198.97.190.53
-H.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:1::53
-; 
-; FORMERLY NIC.NORDU.NET
-;
-.                        3600000      NS    I.ROOT-SERVERS.NET.
-I.ROOT-SERVERS.NET.      3600000      A     192.36.148.17
-I.ROOT-SERVERS.NET.      3600000      AAAA  2001:7fe::53
-; 
-; OPERATED BY VERISIGN, INC.
-;
-.                        3600000      NS    J.ROOT-SERVERS.NET.
-J.ROOT-SERVERS.NET.      3600000      A     192.58.128.30
-J.ROOT-SERVERS.NET.      3600000      AAAA  2001:503:c27::2:30
-; 
-; OPERATED BY RIPE NCC
-;
-.                        3600000      NS    K.ROOT-SERVERS.NET.
-K.ROOT-SERVERS.NET.      3600000      A     193.0.14.129
-K.ROOT-SERVERS.NET.      3600000      AAAA  2001:7fd::1
-; 
-; OPERATED BY ICANN
-;
-.                        3600000      NS    L.ROOT-SERVERS.NET.
-L.ROOT-SERVERS.NET.      3600000      A     199.7.83.42
-L.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:9f::42
-; 
-; OPERATED BY WIDE
-;
-.                        3600000      NS    M.ROOT-SERVERS.NET.
-M.ROOT-SERVERS.NET.      3600000      A     202.12.27.33
-M.ROOT-SERVERS.NET.      3600000      AAAA  2001:dc3::35
-; End of file
\ No newline at end of file
diff --git a/named.root.key b/named.root.key
index b57e61d..6d0904d 100644
--- a/named.root.key
+++ b/named.root.key
@@ -1,18 +1,5 @@
-trust-anchors {
-        # ROOT KEYS: See https://data.iana.org/root-anchors/root-anchors.xml
-        # for current trust anchor information.
-        #
-        # This key (20326) was published in the root zone in 2017.
-        # Servers which were already using the old key (19036) should
-        # roll seamlessly to this new one via RFC 5011 rollover. Servers
-        # being set up for the first time can use the contents of this
-        # file as initializing keys; thereafter, the keys in the
-        # managed key database will be trusted and maintained
-        # automatically.
-        . initial-ds 20326 8 2 "E06D44B80B8F1D39A95C0B0D7C65D08458E880409BBC683457104237C7F8EC8D";
-        # This key (38696) will be pre-published in the root zone in 2025
-        # and is scheduled to begin signing in late 2026. At that time,
-        # servers which were already using the old key (20326) should roll
-        # seamlessly to this new one via RFC 5011 rollover.
-        . initial-ds 38696 8 2 "683D2D0ACB8C9B712A1948B27F741219298D0A450D612C483AF444A4C0FB2B16";
-};
+# Autogenerated from /usr/share/dns-root-data/root.ds
+truste-anchors {
+. initial-ds 20326 8 2 "E06D44B80B8F1D39A95C0B0D7C65D08458E880409BBC683457104237C7F8EC8D";
+. initial-ds 38696 8 2 "683D2D0ACB8C9B712A1948B27F741219298D0A450D612C483AF444A4C0FB2B16";
+}; 
diff --git a/trusted-key.key b/trusted-key.key
deleted file mode 100644
index 2ef50c7..0000000
--- a/trusted-key.key
+++ /dev/null
@@ -1,2 +0,0 @@
-. 3600 IN DNSKEY 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU=
-. 3600 IN DNSKEY 257 3 8 AwEAAa96jeuknZlaeSrvyAJj6ZHv28hhOKkx3rLGXVaC6rXTsDc449/cidltpkyGwCJNnOAlFNKF2jBosZBU5eeHspaQWOmOElZsjICMQMC3aeHbGiShvZsx4wMYSjH8e7Vrhbu6irwCzVBApESjbUdpWWmEnhathWu1jo+siFUiRAAxm9qyJNg/wOZqqzL/dL/q8PkcRU5oUKEpUge71M3ej2/7CPqpdVwuMoTvoB+ZOT4YeGyxMvHmbrxlFzGOHOijtzN+u1TQNatX2XBuzZNQ1K+s2CXkPIZo7s6JgZyvaBevYtxPvYLw4z9mR7K2vaF18UYH9Z9GNUUeayffKC73PYc=

From 6059fcadaa19d8625ea5534e43d27b81253b1687 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 16 Jan 2026 15:15:39 +0100
Subject: [PATCH 43/64] Update to 9.21.16 (rhbz#2415843)

New Features:

- Add +[no]showtruncated and +[no]showallmessages to dig.

Feature Changes:

- Reduce the number of outgoing queries.
- Improve output of rndc dnssec -status
- Change the QNAME minimization algorithm to follow the standard.
- Enforce bounds of prefetch configuration option.
- Enforce the fact that catalog zones cannot be used in non-IN views.
- Provide more information when memory allocation fails.

Bug Fixes:

- Adding NSEC3 opt-out records could leave invalid records in chain.
- Fix spurious timeouts while resolving names.
- Fix bug where zone switches from NSEC3 to NSEC after retransfer.
- Fix caching RRSIG covering cached NODATA record.
- AMTRELAY type 0 presentation format handling was wrong.
- Fix parsing bug in remote-servers with key or TLS.
- Fix allow-recursion/allow-query-cache inheritance.
- Fix DoT reconfigure/reload bug in the resolver.

https://downloads.isc.org/isc/bind9/9.21.16/doc/arm/html/notes.html#notes-for-bind-9-21-16
---
 bind9-next.spec | 2 +-
 sources         | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/bind9-next.spec b/bind9-next.spec
index 3d287b6..f38af33 100644
--- a/bind9-next.spec
+++ b/bind9-next.spec
@@ -52,7 +52,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind9-next
 License:  MPL-2.0 AND ISC AND BSD-3-clause AND MIT AND BSD-2-clause
 #
-Version:  9.21.15
+Version:  9.21.16
 Release:  %autorelease
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
diff --git a/sources b/sources
index 62a6afc..d0edb5d 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.21.15.tar.xz) = 6c18c2a0a915e6c42036b6869a1d495872de7c94b67f036d8074a8d45c1cefff57d8df64b0d8a34611d3cdc1b09b2e6d3e4989d4cdf450643735e8ecb8d49d86
-SHA512 (bind-9.21.15.tar.xz.asc) = ca422a14adc3027a7301b628afad73dc2f5759456b27180402b707f30fba41dc9af4dfb2f0c8f25b1f1eed0a78dc16cabcd0ec19e5455966cf8e1b5a67296b57
+SHA512 (bind-9.21.16.tar.xz) = 9536de96f80efe092e149fef9c4f71f022b3d9b8cbfa2ecf4aaa3bcf5afdc6b8a2d201d00b35f3c909161eb02b96fa587fd674c4fe292f96ba9ad91d6d86248e
+SHA512 (bind-9.21.16.tar.xz.asc) = db21fc697957090055a9cc4f42aea78cb9c4d692c0754d96fb47ca38a76fdba227a3731c44fb5e4f129cfdf9301ffbe529305a4de1e49bdfb8ed5850e005cc6a

From a4fb8fbe496e07da6afa8e5cb73129f95965381c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Mon, 19 Jan 2026 13:26:29 +0100
Subject: [PATCH 44/64] Fix build for RHEL, disable JEMALLOC there

---
 bind9-next.spec | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/bind9-next.spec b/bind9-next.spec
index f38af33..b5253ed 100644
--- a/bind9-next.spec
+++ b/bind9-next.spec
@@ -22,6 +22,7 @@
 %bcond_with    TSAN
 %bcond_without DTRACE
 %bcond_with    OPENSSL_ENGINE
+%bcond         JEMALLOC  0%{?fedora}
 
 %{?!bind_uid:  %global bind_uid  25}
 %{?!bind_gid:  %global bind_gid  25}
@@ -122,9 +123,11 @@ BuildRequires:  pkgconfig(libedit)
 BuildRequires:  dns-root-data
 # Compress the changelog
 BuildRequires:  gzip
-%if 0%{?fedora}
+%if %{with JEMALLOC}
 BuildRequires:  jemalloc-devel
-BuildRequires:  gnupg2
+%endif
+%if ! 0%{?rhel}
+BuildRequires:  gpgverify
 %endif
 BuildRequires:  libuv-devel
 %if %{with OPENSSL_ENGINE}
@@ -301,8 +304,8 @@ in HTML and PDF format.
 %endif
 
 %prep
-%if 0%{?fedora}
-# RHEL does not yet support this verification
+%if ! 0%{?rhel} || 0%{?rhel} > 10
+# RHEL does not (again?) support this verification
 %{gpgverify} --keyring='%{SOURCE4}' --signature='%{SOURCE2}' --data='%{SOURCE0}'
 %endif
 %autosetup -n %{upname}-%{version} -p1
@@ -383,6 +386,9 @@ export LIBDIR_SUFFIX
 %if %{with DOC}
   -Ddoc=enabled \
 %endif
+%if %{without JEMALLOC}
+  -Djemalloc=disabled \
+%endif
 ;
 %if %{with DNSTAP}
   pushd lib

From 7238eb8b29341bb8a4b7694223141ea6c19481de Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 22 Jan 2026 10:58:43 +0100
Subject: [PATCH 45/64] Update to 9.21.17 (rhbz#2415843)

Security Fixes:

- Fix incorrect length checks for BRID and HHIT records. (CVE-2025-13878)

New Features:

- Add support for Extended DNS Error 9 (Missing DNSKEY).
- Add support for Extended DNS Error 13 (Cached Error).
- Add support for Generalized DNS Notifications.

Features Changes:

- Add more information to the rndc recursing output about fetches.
- Enforce bounds of multiple configuration options.

Bug Fixes:

- Fix inbound IXFR performance regression.
- Make DNSSEC key rollovers more robust.
- Fix a catalog zone issue, where member zones could fail to load.
- Fix slow speed when signing a large delegation zone with NSEC3 opt-out.
- Reconfiguring an NSEC3 opt-out zone to NSEC caused the zone to be invalid.
- Fix a possible catalog zone issue during reconfiguration.
- Fix the charts in the statistics channel.

https://downloads.isc.org/isc/bind9/9.21.17/doc/arm/html/notes.html#notes-for-bind-9-21-17
---
 bind9-next.spec | 2 +-
 sources         | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/bind9-next.spec b/bind9-next.spec
index b5253ed..39018bf 100644
--- a/bind9-next.spec
+++ b/bind9-next.spec
@@ -53,7 +53,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind9-next
 License:  MPL-2.0 AND ISC AND BSD-3-clause AND MIT AND BSD-2-clause
 #
-Version:  9.21.16
+Version:  9.21.17
 Release:  %autorelease
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
diff --git a/sources b/sources
index d0edb5d..5eede3e 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.21.16.tar.xz) = 9536de96f80efe092e149fef9c4f71f022b3d9b8cbfa2ecf4aaa3bcf5afdc6b8a2d201d00b35f3c909161eb02b96fa587fd674c4fe292f96ba9ad91d6d86248e
-SHA512 (bind-9.21.16.tar.xz.asc) = db21fc697957090055a9cc4f42aea78cb9c4d692c0754d96fb47ca38a76fdba227a3731c44fb5e4f129cfdf9301ffbe529305a4de1e49bdfb8ed5850e005cc6a
+SHA512 (bind-9.21.17.tar.xz) = b53fcea8db7d1b4e8fba7055f175289a7d1e3380be77e0899986101ffc3ff9222be5bf249b8f0162b0c88b0b463f42b778fa11f3ed86f913e17cd62561c65063
+SHA512 (bind-9.21.17.tar.xz.asc) = 62e344ae5deae40c4f647f4b99bee56d63cc7be5dd882f24993771c537eb7817dd2a5d2b8f6396fd906df9ef11afb4c1f874f61bd25329f50f7ca952d508482c

From 07c6012166c42221b43352df952c3c5340858e66 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 11 Nov 2025 12:07:48 +0100
Subject: [PATCH 46/64] Fix running SYSTEMTEST during build

Needs prepared network scripts.

Can be used like:
fedpkg mockbuild --enable-network --with SYSTEMTEST
---
 bind9-next.spec | 22 ++++++++++++++++------
 1 file changed, 16 insertions(+), 6 deletions(-)

diff --git a/bind9-next.spec b/bind9-next.spec
index 406feab..346cec9 100644
--- a/bind9-next.spec
+++ b/bind9-next.spec
@@ -154,6 +154,8 @@ BuildRequires:  softhsm
 BuildRequires:  perl(Net::DNS) perl(Net::DNS::Nameserver) perl(Time::HiRes) perl(Getopt::Long)
 BuildRequires:  perl(English)
 BuildRequires:  python3-pytest
+BuildRequires:  python3-pytest-xdist
+BuildRequires:  python3-dns
 # manual configuration requires this tool
 BuildRequires:  iproute
 BuildRequires:  python3-jinja2
@@ -404,6 +406,9 @@ export LIBDIR_SUFFIX
 %if %{with DOC}
   %meson_build man arm arm-epub
 %endif
+%if %{with SYSTEMTEST}
+  %meson_build system-test-dependencies
+%endif
 
 # Compress changelog by default
 gzip doc/changelog/changelog-*.rst
@@ -469,18 +474,23 @@ export TSAN_OPTIONS="log_exe_name=true log_path=ThreadSanitizer exitcode=0"
 
   if [ -n "$CONFIGURED" ]
   then
-    set -e
-    pushd bin/tests
+    pushd bin/tests/system
     export CI_SYSTEM=yes # allow running tests as root
     chown -R ${USER} . # Can be unknown user
-    %meson_build test 2>&1 | tee test.log
-    e=$?
+    e=0
+    pytest -n ${THREADS} --capture=tee-sys || e=$?
     [ "$CONFIGURED" = build ] && $SUDO sh ./ifconfig.sh down
-    popd
     if [ "$e" -ne 0 ]; then
-      echo "ERROR: this build of BIND failed 'make test'. Aborting."
+      echo "ERROR: failed running 'pytest' in system tests. Aborting."
+      ls -1 "$(pwd)"/*_tmp_*
+      for TMPTEST in *_tmp_*
+      do
+        echo "# $TMPTEST"
+        cat $TMPTEST/pytest.log.txt
+      done
       exit $e;
     fi;
+    popd
   else
     echo 'SKIPPED: tests require root, CAP_NET_ADMIN or already configured test addresses.'
   fi

From 8c947ce9c412e00f95af99e726468f00448ec509 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Fri, 21 Nov 2025 23:51:11 +0100
Subject: [PATCH 47/64] Use dns-root-data package for hints source

Use trusted root source and hints from separate package.
---
 bind9-next.spec    | 26 ++++++++-----
 named-chroot.files |  1 +
 named-mkroot.sh    | 20 ++++++++++
 named.root         | 92 ----------------------------------------------
 named.root.key     | 23 +++---------
 trusted-key.key    |  2 -
 6 files changed, 42 insertions(+), 122 deletions(-)
 create mode 100755 named-mkroot.sh
 delete mode 100644 named.root
 delete mode 100644 trusted-key.key

diff --git a/bind9-next.spec b/bind9-next.spec
index 346cec9..0621952 100644
--- a/bind9-next.spec
+++ b/bind9-next.spec
@@ -30,7 +30,7 @@
 %global        chroot_prefix     %{bind_dir}/chroot
 %global        chroot_create_directories /dev /run/named %{_localstatedir}/{log,named,tmp} \\\
                                          %{_sysconfdir}/{crypto-policies/back-ends,pki/dnssec-keys,pki/tls,named} \\\
-                                         %{_libdir}/bind %{_libdir}/named %{_datadir}/GeoIP /proc/sys/net/ipv4
+                                         %{_libdir}/bind %{_libdir}/named %{_datadir}/{GeoIP,dns-root-data} /proc/sys/net/ipv4
 
 %global forgeurl0 https://gitlab.isc.org/isc-projects/bind9
 
@@ -67,17 +67,13 @@ Source2:  https://downloads.isc.org/isc/bind9/%{version}/%{upname}-%{version}.ta
 Source3:  named.logrotate
 Source4:  https://www.isc.org/docs/isc-keyblock.asc
 Source16: named.conf
-# Refresh by command: dig @a.root-servers.net. +tcp +norec
-# or from URL
-Source17: https://www.internic.net/domain/named.root
 Source18: named.localhost
 Source19: named.loopback
 Source20: named.empty
 Source23: named.rfc1912.zones
 Source25: named.conf.sample
-Source27: named.root.key
+Source27: named-mkroot.sh
 Source35: bind.tmpfiles.d
-Source36: trusted-key.key
 Source37: named.service
 Source38: named-chroot.service
 Source41: setup-named-chroot.sh
@@ -104,6 +100,7 @@ Requires:       coreutils
 Requires(post): shadow-utils
 Requires(post): glibc-common
 Requires(post): grep
+Requires:       dns-root-data
 Requires:       %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release}
 Recommends:     %{name}-utils %{name}-dnssec-utils
 %upname_compat %{upname}
@@ -127,6 +124,7 @@ BuildRequires:  sed
 BuildRequires:  libnghttp2-devel
 BuildRequires:  userspace-rcu-devel
 BuildRequires:  pkgconfig(libedit)
+BuildRequires:  dns-root-data
 # Compress the changelog
 BuildRequires:  gzip
 %if 0%{?fedora}
@@ -359,6 +357,10 @@ export STD_CDEFINES="$CPPFLAGS"
 #'s/([bind_VERSION_EXTRA],\s*\([^)]*\))/([bind_VERSION_EXTRA], \1-RH)/' \
 #configure.ac
 
+install -p -m 0755 %{SOURCE27} ./named-mkroot.sh # create named.root.key
+./named-mkroot.sh
+[ -f named.root.key ]
+
 
 LIBDIR_SUFFIX=
 export LIBDIR_SUFFIX
@@ -426,6 +428,10 @@ gzip doc/changelog/changelog-*.rst
 export TSAN_OPTIONS="log_exe_name=true log_path=ThreadSanitizer exitcode=0"
 %endif
 
+# We produce it runtime. Check it has valid syntax.
+LD_LIBRARY_PATH="$LD_LIBRARY_PATH:${RPM_BUILD_ROOT}%{_libdir}" \
+  ${RPM_BUILD_ROOT}%{_bindir}/named-checkconf ${RPM_BUILD_ROOT}%{_sysconfdir}/named.root.key
+
 %if %{with UNITTEST}
   CPUS=$(lscpu -p=cpu,core | grep -v '^#' | wc -l)
   THREADS="$CPUS"
@@ -595,13 +601,13 @@ touch ${RPM_BUILD_ROOT}%{_localstatedir}/log/named.log
 # configuration files:
 install -m 640 %{SOURCE16} ${RPM_BUILD_ROOT}%{_sysconfdir}/named.conf
 touch ${RPM_BUILD_ROOT}%{_sysconfdir}/rndc.{key,conf}
-install -m 644 %{SOURCE27} ${RPM_BUILD_ROOT}%{_sysconfdir}/named.root.key
-install -m 644 %{SOURCE36} ${RPM_BUILD_ROOT}%{_sysconfdir}/trusted-key.key
+install -m 644 -p named.root.key ${RPM_BUILD_ROOT}%{_sysconfdir}/named.root.key
+ln -s "%{_datadir}/dns-root-data/root.key" ${RPM_BUILD_ROOT}%{_sysconfdir}/trusted-key.key
 mkdir -p ${RPM_BUILD_ROOT}%{_sysconfdir}/named
 
 # data files:
 mkdir -p ${RPM_BUILD_ROOT}%{_localstatedir}/named
-install -m 640 %{SOURCE17} ${RPM_BUILD_ROOT}%{_localstatedir}/named/named.ca
+ln -s "%{_datadir}/dns-root-data/root.hints" ${RPM_BUILD_ROOT}%{_localstatedir}/named/named.ca
 install -m 640 %{SOURCE18} ${RPM_BUILD_ROOT}%{_localstatedir}/named/named.localhost
 install -m 640 %{SOURCE19} ${RPM_BUILD_ROOT}%{_localstatedir}/named/named.loopback
 install -m 640 %{SOURCE20} ${RPM_BUILD_ROOT}%{_localstatedir}/named/named.empty
@@ -614,7 +620,7 @@ install -m 644 %{SOURCE25} sample/etc/named.conf
 install -m 644 %{SOURCE16} named.conf.default
 install -m 644 %{SOURCE23} sample/etc/named.rfc1912.zones
 install -m 644 %{SOURCE18} %{SOURCE19} %{SOURCE20}  sample/var/named
-install -m 644 %{SOURCE17} sample/var/named/named.ca
+ln -s "%{_datadir}/dns-root-data/root.hints" sample/var/named/named.ca
 for f in my.internal.zone.db slaves/my.slave.internal.zone.db slaves/my.ddns.internal.zone.db my.external.zone.db; do 
   echo '@ in soa localhost. root 1 3H 15M 1W 1D
   ns localhost.' > sample/var/named/$f; 
diff --git a/named-chroot.files b/named-chroot.files
index c186664..c901664 100644
--- a/named-chroot.files
+++ b/named-chroot.files
@@ -18,6 +18,7 @@
 /usr/lib64/bind
 /usr/lib/bind
 /usr/share/GeoIP
+/usr/share/dns-root-data
 /run/named
 /proc/sys/net/ipv4/ip_local_port_range
 # Warning: the order is important
diff --git a/named-mkroot.sh b/named-mkroot.sh
new file mode 100755
index 0000000..288725b
--- /dev/null
+++ b/named-mkroot.sh
@@ -0,0 +1,20 @@
+#!/bin/sh
+# Create named.root.key from dns-root-data package
+
+ROOT_DS=/usr/share/dns-root-data/root.ds
+: ${OUTPUT:=named.root.key}
+
+if ! [ -r "$ROOT_DS" ]; then
+	echo "Root trust file is not readable: $ROOT_DS"
+	exit 1
+fi
+
+echo "# Autogenerated from $ROOT_DS" > "$OUTPUT"
+echo "trust-anchors {" >> "$OUTPUT"
+cat "$ROOT_DS" | while read DOMAIN CLS QTYPE KEYTAG ALG DIG HASH;
+do
+	echo "$DOMAIN initial-ds $KEYTAG $ALG $DIG \"$HASH\";" >> "$OUTPUT";
+done
+echo "}; " >> "$OUTPUT"
+# Set the same modification time as data source.
+touch -r $ROOT_DS "$OUTPUT"
diff --git a/named.root b/named.root
deleted file mode 100644
index 8b8a3b1..0000000
--- a/named.root
+++ /dev/null
@@ -1,92 +0,0 @@
-;       This file holds the information on root name servers needed to 
-;       initialize cache of Internet domain name servers
-;       (e.g. reference this file in the "cache  .  <file>"
-;       configuration file of BIND domain name servers). 
-; 
-;       This file is made available by InterNIC 
-;       under anonymous FTP as
-;           file                /domain/named.cache 
-;           on server           FTP.INTERNIC.NET
-;       -OR-                    RS.INTERNIC.NET
-;
-;       last update:     December 20, 2023
-;       related version of root zone:     2023122001
-; 
-; FORMERLY NS.INTERNIC.NET 
-;
-.                        3600000      NS    A.ROOT-SERVERS.NET.
-A.ROOT-SERVERS.NET.      3600000      A     198.41.0.4
-A.ROOT-SERVERS.NET.      3600000      AAAA  2001:503:ba3e::2:30
-; 
-; FORMERLY NS1.ISI.EDU 
-;
-.                        3600000      NS    B.ROOT-SERVERS.NET.
-B.ROOT-SERVERS.NET.      3600000      A     170.247.170.2
-B.ROOT-SERVERS.NET.      3600000      AAAA  2801:1b8:10::b
-; 
-; FORMERLY C.PSI.NET 
-;
-.                        3600000      NS    C.ROOT-SERVERS.NET.
-C.ROOT-SERVERS.NET.      3600000      A     192.33.4.12
-C.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:2::c
-; 
-; FORMERLY TERP.UMD.EDU 
-;
-.                        3600000      NS    D.ROOT-SERVERS.NET.
-D.ROOT-SERVERS.NET.      3600000      A     199.7.91.13
-D.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:2d::d
-; 
-; FORMERLY NS.NASA.GOV
-;
-.                        3600000      NS    E.ROOT-SERVERS.NET.
-E.ROOT-SERVERS.NET.      3600000      A     192.203.230.10
-E.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:a8::e
-; 
-; FORMERLY NS.ISC.ORG
-;
-.                        3600000      NS    F.ROOT-SERVERS.NET.
-F.ROOT-SERVERS.NET.      3600000      A     192.5.5.241
-F.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:2f::f
-; 
-; FORMERLY NS.NIC.DDN.MIL
-;
-.                        3600000      NS    G.ROOT-SERVERS.NET.
-G.ROOT-SERVERS.NET.      3600000      A     192.112.36.4
-G.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:12::d0d
-; 
-; FORMERLY AOS.ARL.ARMY.MIL
-;
-.                        3600000      NS    H.ROOT-SERVERS.NET.
-H.ROOT-SERVERS.NET.      3600000      A     198.97.190.53
-H.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:1::53
-; 
-; FORMERLY NIC.NORDU.NET
-;
-.                        3600000      NS    I.ROOT-SERVERS.NET.
-I.ROOT-SERVERS.NET.      3600000      A     192.36.148.17
-I.ROOT-SERVERS.NET.      3600000      AAAA  2001:7fe::53
-; 
-; OPERATED BY VERISIGN, INC.
-;
-.                        3600000      NS    J.ROOT-SERVERS.NET.
-J.ROOT-SERVERS.NET.      3600000      A     192.58.128.30
-J.ROOT-SERVERS.NET.      3600000      AAAA  2001:503:c27::2:30
-; 
-; OPERATED BY RIPE NCC
-;
-.                        3600000      NS    K.ROOT-SERVERS.NET.
-K.ROOT-SERVERS.NET.      3600000      A     193.0.14.129
-K.ROOT-SERVERS.NET.      3600000      AAAA  2001:7fd::1
-; 
-; OPERATED BY ICANN
-;
-.                        3600000      NS    L.ROOT-SERVERS.NET.
-L.ROOT-SERVERS.NET.      3600000      A     199.7.83.42
-L.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:9f::42
-; 
-; OPERATED BY WIDE
-;
-.                        3600000      NS    M.ROOT-SERVERS.NET.
-M.ROOT-SERVERS.NET.      3600000      A     202.12.27.33
-M.ROOT-SERVERS.NET.      3600000      AAAA  2001:dc3::35
-; End of file
\ No newline at end of file
diff --git a/named.root.key b/named.root.key
index b57e61d..6d0904d 100644
--- a/named.root.key
+++ b/named.root.key
@@ -1,18 +1,5 @@
-trust-anchors {
-        # ROOT KEYS: See https://data.iana.org/root-anchors/root-anchors.xml
-        # for current trust anchor information.
-        #
-        # This key (20326) was published in the root zone in 2017.
-        # Servers which were already using the old key (19036) should
-        # roll seamlessly to this new one via RFC 5011 rollover. Servers
-        # being set up for the first time can use the contents of this
-        # file as initializing keys; thereafter, the keys in the
-        # managed key database will be trusted and maintained
-        # automatically.
-        . initial-ds 20326 8 2 "E06D44B80B8F1D39A95C0B0D7C65D08458E880409BBC683457104237C7F8EC8D";
-        # This key (38696) will be pre-published in the root zone in 2025
-        # and is scheduled to begin signing in late 2026. At that time,
-        # servers which were already using the old key (20326) should roll
-        # seamlessly to this new one via RFC 5011 rollover.
-        . initial-ds 38696 8 2 "683D2D0ACB8C9B712A1948B27F741219298D0A450D612C483AF444A4C0FB2B16";
-};
+# Autogenerated from /usr/share/dns-root-data/root.ds
+truste-anchors {
+. initial-ds 20326 8 2 "E06D44B80B8F1D39A95C0B0D7C65D08458E880409BBC683457104237C7F8EC8D";
+. initial-ds 38696 8 2 "683D2D0ACB8C9B712A1948B27F741219298D0A450D612C483AF444A4C0FB2B16";
+}; 
diff --git a/trusted-key.key b/trusted-key.key
deleted file mode 100644
index 2ef50c7..0000000
--- a/trusted-key.key
+++ /dev/null
@@ -1,2 +0,0 @@
-. 3600 IN DNSKEY 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU=
-. 3600 IN DNSKEY 257 3 8 AwEAAa96jeuknZlaeSrvyAJj6ZHv28hhOKkx3rLGXVaC6rXTsDc449/cidltpkyGwCJNnOAlFNKF2jBosZBU5eeHspaQWOmOElZsjICMQMC3aeHbGiShvZsx4wMYSjH8e7Vrhbu6irwCzVBApESjbUdpWWmEnhathWu1jo+siFUiRAAxm9qyJNg/wOZqqzL/dL/q8PkcRU5oUKEpUge71M3ej2/7CPqpdVwuMoTvoB+ZOT4YeGyxMvHmbrxlFzGOHOijtzN+u1TQNatX2XBuzZNQ1K+s2CXkPIZo7s6JgZyvaBevYtxPvYLw4z9mR7K2vaF18UYH9Z9GNUUeayffKC73PYc=

From ac3ef15e89884c082466f1f25e902667a7df0b4b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Mon, 19 Jan 2026 13:26:29 +0100
Subject: [PATCH 48/64] Fix build for RHEL, disable JEMALLOC there

---
 bind9-next.spec | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/bind9-next.spec b/bind9-next.spec
index 0621952..d8c9236 100644
--- a/bind9-next.spec
+++ b/bind9-next.spec
@@ -22,6 +22,7 @@
 %bcond_with    TSAN
 %bcond_without DTRACE
 %bcond_with    OPENSSL_ENGINE
+%bcond         JEMALLOC  0%{?fedora}
 
 %{?!bind_uid:  %global bind_uid  25}
 %{?!bind_gid:  %global bind_gid  25}
@@ -127,9 +128,11 @@ BuildRequires:  pkgconfig(libedit)
 BuildRequires:  dns-root-data
 # Compress the changelog
 BuildRequires:  gzip
-%if 0%{?fedora}
+%if %{with JEMALLOC}
 BuildRequires:  jemalloc-devel
-BuildRequires:  gnupg2
+%endif
+%if ! 0%{?rhel}
+BuildRequires:  gpgverify
 %endif
 BuildRequires:  libuv-devel
 %if %{with OPENSSL_ENGINE}
@@ -313,8 +316,8 @@ in HTML and PDF format.
 %endif
 
 %prep
-%if 0%{?fedora}
-# RHEL does not yet support this verification
+%if ! 0%{?rhel} || 0%{?rhel} > 10
+# RHEL does not (again?) support this verification
 %{gpgverify} --keyring='%{SOURCE4}' --signature='%{SOURCE2}' --data='%{SOURCE0}'
 %endif
 %autosetup -n %{upname}-%{version} -p1
@@ -395,6 +398,9 @@ export LIBDIR_SUFFIX
 %if %{with DOC}
   -Ddoc=enabled \
 %endif
+%if %{without JEMALLOC}
+  -Djemalloc=disabled \
+%endif
 ;
 %if %{with DNSTAP}
   pushd lib

From 13d07a1939f85ba389e4211b8f8b41b14a4d906e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 22 Jan 2026 10:58:43 +0100
Subject: [PATCH 49/64] Update to 9.21.17 (rhbz#2415843)

Security Fixes:

- Fix incorrect length checks for BRID and HHIT records. (CVE-2025-13878)

New Features:

- Add support for Extended DNS Error 9 (Missing DNSKEY).
- Add support for Extended DNS Error 13 (Cached Error).
- Add support for Generalized DNS Notifications.

Features Changes:

- Add more information to the rndc recursing output about fetches.
- Enforce bounds of multiple configuration options.

Bug Fixes:

- Fix inbound IXFR performance regression.
- Make DNSSEC key rollovers more robust.
- Fix a catalog zone issue, where member zones could fail to load.
- Fix slow speed when signing a large delegation zone with NSEC3 opt-out.
- Reconfiguring an NSEC3 opt-out zone to NSEC caused the zone to be invalid.
- Fix a possible catalog zone issue during reconfiguration.
- Fix the charts in the statistics channel.

https://downloads.isc.org/isc/bind9/9.21.17/doc/arm/html/notes.html#notes-for-bind-9-21-17
---
 bind9-next.spec | 4 +---
 sources         | 4 ++--
 2 files changed, 3 insertions(+), 5 deletions(-)

diff --git a/bind9-next.spec b/bind9-next.spec
index d8c9236..2166935 100644
--- a/bind9-next.spec
+++ b/bind9-next.spec
@@ -56,7 +56,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind9-next
 License:  MPL-2.0 AND ISC AND BSD-3-clause AND MIT AND BSD-2-clause
 #
-Version:  9.21.14
+Version:  9.21.17
 Release:  %autorelease
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
@@ -93,8 +93,6 @@ Patch3: bind-9.21-unittest-isc_rwlock-s390x.patch
 # https://gitlab.isc.org/isc-projects/bind9/-/issues/5328
 # avoid often fails on i386, unsupported upstream
 Patch4: bind-9.21-unittest-qpdb-i386.patch
-Patch5: bind-9.21-dual-sign-continue.patch
-Patch6: bind-9.21-dual-sign-continue-test.patch
 
 %{?systemd_ordering}
 Requires:       coreutils
diff --git a/sources b/sources
index 714e4db..5eede3e 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.21.14.tar.xz) = bf4bd0f5613d6c6d53f749f3269a34f3a5c74a7dc81e05922d58ba30f19d418e565838dd1182dd6052b9a62b3799d2d0f12451f2797af3279259df59cfc4be05
-SHA512 (bind-9.21.14.tar.xz.asc) = 91ccc82ca54d07dba07821c3410f92b563290ead48546d605b0dbd9958a831d9b90130002fbb325e0cdc913de64813d8ba4c48ec958ebba7f5f462d43f578394
+SHA512 (bind-9.21.17.tar.xz) = b53fcea8db7d1b4e8fba7055f175289a7d1e3380be77e0899986101ffc3ff9222be5bf249b8f0162b0c88b0b463f42b778fa11f3ed86f913e17cd62561c65063
+SHA512 (bind-9.21.17.tar.xz.asc) = 62e344ae5deae40c4f647f4b99bee56d63cc7be5dd882f24993771c537eb7817dd2a5d2b8f6396fd906df9ef11afb4c1f874f61bd25329f50f7ca952d508482c

From a6ae9a839ea14383b96d10c814d3793b0dbcd766 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 19 Jun 2024 20:41:31 +0200
Subject: [PATCH 50/64] Remove separate license subpackage

Move license to libs subpackage, it is required for everything except
documentation. Include license file in docs and bind-libs, avoid extra
package just for single file.
---
 bind9-next.spec | 14 +++-----------
 1 file changed, 3 insertions(+), 11 deletions(-)

diff --git a/bind9-next.spec b/bind9-next.spec
index 2166935..c7530b7 100644
--- a/bind9-next.spec
+++ b/bind9-next.spec
@@ -201,7 +201,8 @@ tools for verifying that the DNS server is operating properly.
 
 %package libs
 Summary: Libraries used by the BIND DNS packages
-Requires: %{name}-license = %{epoch}:%{version}-%{release}
+Provides: %{name}-license = %{epoch}:%{version}-%{release}
+Obsoletes: %{name}-license < 32:9.21.17-1
 Provides: %{name}-libs-lite = %{epoch}:%{version}-%{release}
 Obsoletes: %{name}-libs-lite < 32:9.16.13
 Obsoletes: %{name}-pkcs11-libs < 32:9.18.4-2
@@ -210,13 +211,6 @@ Obsoletes: %{name}-pkcs11-libs < 32:9.18.4-2
 Contains heavyweight version of BIND suite libraries used by both named DNS
 server and utilities in %{name}-utils package.
 
-%package license
-Summary:  License of the BIND DNS suite
-BuildArch:noarch
-
-%description license
-Contains license of the BIND DNS suite.
-
 %package utils
 Summary: Utilities for querying DNS name servers
 Requires: %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release}
@@ -296,7 +290,6 @@ Based on the code from Jan "Yenya" Kasprzak <kas@fi.muni.cz>
 %if %{with DOC}
 %package doc
 Summary:   BIND 9 Administrator Reference Manual
-Requires:  %{name}-license = %{epoch}:%{version}-%{release}
 Requires:  python3-sphinx_rtd_theme
 BuildArch: noarch
 
@@ -798,8 +791,6 @@ fi;
 %{_libdir}/libdns-%{version}*.so
 %{_libdir}/libisc-%{version}*.so
 %{_libdir}/libisccfg-%{version}*.so
-
-%files license
 %{!?_licensedir:%global license %%doc}
 %license COPYRIGHT
 
@@ -909,6 +900,7 @@ fi;
 %doc %{_pkgdocdir}/Bv9ARM.epub
 %doc %{_pkgdocdir}/changelog-history.rst*
 %doc %{_pkgdocdir}/notes-*.rst*
+%license COPYRIGHT
 %endif
 
 %changelog

From 6e8f7344bd22a90cfbafad5d93c90d6a0f6d56d1 Mon Sep 17 00:00:00 2001
From: Yanko Kaneti <yaneti@declera.com>
Date: Mon, 2 Feb 2026 18:27:38 +0200
Subject: [PATCH 51/64] Reduce test loops for tests/isc/{mutex/spinlock/rwlock}

Allow rwlock(isc_rwlock_benchmark) to finish within the 300 seconds
timeout limit on platforms (riscv64,s390x) where it is slow

TODO: find out why it is slow
---
 bind-9.21-unittest-isc_rwlock-s390x.patch | 29 -----------------------
 bind9-next.spec                           |  7 ++++--
 2 files changed, 5 insertions(+), 31 deletions(-)
 delete mode 100644 bind-9.21-unittest-isc_rwlock-s390x.patch

diff --git a/bind-9.21-unittest-isc_rwlock-s390x.patch b/bind-9.21-unittest-isc_rwlock-s390x.patch
deleted file mode 100644
index 5697450..0000000
--- a/bind-9.21-unittest-isc_rwlock-s390x.patch
+++ /dev/null
@@ -1,29 +0,0 @@
-From b8bc86834311e4ea27fe75052db08279045f027b Mon Sep 17 00:00:00 2001
-From: Petr Mensik <pemensik@redhat.com>
-Date: Wed, 20 Nov 2024 15:34:29 +0100
-Subject: [PATCH] Skip isc_rwlock_benchmark on s390x
-
-Not sure why, but it repeatedly failed on isc_rwlock_benchmark function.
-Not sure if it requires more time only or there is some strange error.
----
- tests/isc/rwlock_test.c | 3 +++
- 1 file changed, 3 insertions(+)
-
-diff --git a/tests/isc/rwlock_test.c b/tests/isc/rwlock_test.c
-index 4c5b8e0..a28b7d9 100644
---- a/tests/isc/rwlock_test.c
-+++ b/tests/isc/rwlock_test.c
-@@ -340,7 +340,10 @@ ISC_TEST_ENTRY_CUSTOM(isc_rwlock_wrlock, rwlock_setup, rwlock_teardown)
- #if !defined(__SANITIZE_THREAD__)
- ISC_TEST_ENTRY_CUSTOM(isc_rwlock_tryupgrade, rwlock_setup, rwlock_teardown)
- ISC_TEST_ENTRY_CUSTOM(isc_rwlock_trylock, rwlock_setup, rwlock_teardown)
-+#ifndef __s390x__
-+// TODO: find why this stucks.
- ISC_TEST_ENTRY_CUSTOM(isc_rwlock_benchmark, rwlock_setup, rwlock_teardown)
-+#endif
- #endif /* __SANITIZE_THREAD__ */
- 
- ISC_TEST_LIST_END
--- 
-2.47.0
-
diff --git a/bind9-next.spec b/bind9-next.spec
index 39018bf..f941085 100644
--- a/bind9-next.spec
+++ b/bind9-next.spec
@@ -85,8 +85,6 @@ Source49: named-chroot.files
 # Common patches
 # Red Hat specific documentation is not relevant to upstream
 Patch1: bind-9.16-redhat_doc.patch
-# Downstream only. TODO: find a cause and remove this workaround
-Patch3: bind-9.21-unittest-isc_rwlock-s390x.patch
 # https://gitlab.isc.org/isc-projects/bind9/-/issues/5328
 # avoid often fails on i386, unsupported upstream
 Patch4: bind-9.21-unittest-qpdb-i386.patch
@@ -413,6 +411,11 @@ gzip doc/changelog/changelog-*.rst
 #systemtest_prepare_build build
 
 %check
+# reduce test loops (from default 100) for isc/{mutex/spinlock/rwlock}
+# to allow rwlock(isc_rwlock_benchmark) to finish within the 300 seconds
+# timeout limit on platforms (riscv64,s390x) where it is slow
+# TODO: find out why it is slow
+export ISC_BENCHMARK_LOOPS=20
 %if %{with UNITTEST} || %{with SYSTEMTEST}
   # Tests require initialization of pkcs11 token
   eval "$(bash %{SOURCE48} -A "`pwd`/softhsm-tokens")"

From ad180eead35da6dfdcb4e65f7b60b32814ac18d1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 25 Mar 2026 19:36:24 +0100
Subject: [PATCH 52/64] Update to 9.21.20 (rhbz#2440560)

Security Fixes:

- Fix unbounded NSEC3 iterations when validating referrals to unsigned delegations. (CVE-2026-1519)
- Fix memory leaks in code preparing DNSSEC proofs of non-existence. (CVE-2026-3104)
- Prevent a crash in code processing queries containing a TKEY record. (CVE-2026-3119)
- Fix a stack use-after-return flaw in SIG(0) handling code. (CVE-2026-3591)

New Features:

- Provide response round-trip time (RTT) counters via statistics channel.
- Introduce max-delegation-servers configuration option.

Bug Fixes:

- Fix parsing key inactivation time in KASP code.
- Fix the handling of key statements defined inside views.

Source: https://downloads.isc.org/isc/bind9/9.21.20/doc/arm/html/notes.html#notes-for-bind-9-21-20
---
 bind9-next.spec | 4 +++-
 sources         | 4 ++--
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/bind9-next.spec b/bind9-next.spec
index f941085..96bd47e 100644
--- a/bind9-next.spec
+++ b/bind9-next.spec
@@ -32,6 +32,8 @@
 %global        chroot_create_directories /dev /run/named %{_localstatedir}/{log,named,tmp} \\\
                                          %{_sysconfdir}/{crypto-policies/back-ends,pki/dnssec-keys,pki/tls,named} \\\
                                          %{_libdir}/bind %{_libdir}/named %{_datadir}/{GeoIP,dns-root-data} /proc/sys/net/ipv4
+%global        upstream_sources 0 2
+%global        pgp_signed_sources 2
 
 %global forgeurl0 https://gitlab.isc.org/isc-projects/bind9
 
@@ -53,7 +55,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind9-next
 License:  MPL-2.0 AND ISC AND BSD-3-clause AND MIT AND BSD-2-clause
 #
-Version:  9.21.17
+Version:  9.21.20
 Release:  %autorelease
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
diff --git a/sources b/sources
index 5eede3e..fa2afc0 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.21.17.tar.xz) = b53fcea8db7d1b4e8fba7055f175289a7d1e3380be77e0899986101ffc3ff9222be5bf249b8f0162b0c88b0b463f42b778fa11f3ed86f913e17cd62561c65063
-SHA512 (bind-9.21.17.tar.xz.asc) = 62e344ae5deae40c4f647f4b99bee56d63cc7be5dd882f24993771c537eb7817dd2a5d2b8f6396fd906df9ef11afb4c1f874f61bd25329f50f7ca952d508482c
+SHA512 (bind-9.21.20.tar.xz) = 4bd65612ff851720eba7f88495d51eb8a41b6a946c377b9dcd62f58f8c5a3e9338af44abc9df76b2ead9461eca4eb81f088619e3cc481f35fa0fc5d0926a93e3
+SHA512 (bind-9.21.20.tar.xz.asc) = 7431540d942fe23222b2812f9d80e67d0fa38516f9d536095a6544b156dc0306aba5752ba6c03cc2935d92a74860e70e8fc53b4cb481b8afe226e49dd51f695f

From 36bbdbb7e32339b6eb4734ac7b2cbbe34b97a9ad Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 25 Mar 2026 19:36:24 +0100
Subject: [PATCH 53/64] Update to 9.21.20 (rhbz#2440560)

Security Fixes:

- Fix unbounded NSEC3 iterations when validating referrals to unsigned delegations. (CVE-2026-1519)
- Fix memory leaks in code preparing DNSSEC proofs of non-existence. (CVE-2026-3104)
- Prevent a crash in code processing queries containing a TKEY record. (CVE-2026-3119)
- Fix a stack use-after-return flaw in SIG(0) handling code. (CVE-2026-3591)

New Features:

- Provide response round-trip time (RTT) counters via statistics channel.
- Introduce max-delegation-servers configuration option.

Bug Fixes:

- Fix parsing key inactivation time in KASP code.
- Fix the handling of key statements defined inside views.

Source: https://downloads.isc.org/isc/bind9/9.21.20/doc/arm/html/notes.html#notes-for-bind-9-21-20
---
 bind9-next.spec | 4 +++-
 sources         | 4 ++--
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/bind9-next.spec b/bind9-next.spec
index c7530b7..20685fb 100644
--- a/bind9-next.spec
+++ b/bind9-next.spec
@@ -32,6 +32,8 @@
 %global        chroot_create_directories /dev /run/named %{_localstatedir}/{log,named,tmp} \\\
                                          %{_sysconfdir}/{crypto-policies/back-ends,pki/dnssec-keys,pki/tls,named} \\\
                                          %{_libdir}/bind %{_libdir}/named %{_datadir}/{GeoIP,dns-root-data} /proc/sys/net/ipv4
+%global        upstream_sources 0 2
+%global        pgp_signed_sources 2
 
 %global forgeurl0 https://gitlab.isc.org/isc-projects/bind9
 
@@ -56,7 +58,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind9-next
 License:  MPL-2.0 AND ISC AND BSD-3-clause AND MIT AND BSD-2-clause
 #
-Version:  9.21.17
+Version:  9.21.20
 Release:  %autorelease
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
diff --git a/sources b/sources
index 5eede3e..fa2afc0 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.21.17.tar.xz) = b53fcea8db7d1b4e8fba7055f175289a7d1e3380be77e0899986101ffc3ff9222be5bf249b8f0162b0c88b0b463f42b778fa11f3ed86f913e17cd62561c65063
-SHA512 (bind-9.21.17.tar.xz.asc) = 62e344ae5deae40c4f647f4b99bee56d63cc7be5dd882f24993771c537eb7817dd2a5d2b8f6396fd906df9ef11afb4c1f874f61bd25329f50f7ca952d508482c
+SHA512 (bind-9.21.20.tar.xz) = 4bd65612ff851720eba7f88495d51eb8a41b6a946c377b9dcd62f58f8c5a3e9338af44abc9df76b2ead9461eca4eb81f088619e3cc481f35fa0fc5d0926a93e3
+SHA512 (bind-9.21.20.tar.xz.asc) = 7431540d942fe23222b2812f9d80e67d0fa38516f9d536095a6544b156dc0306aba5752ba6c03cc2935d92a74860e70e8fc53b4cb481b8afe226e49dd51f695f

From 70ecf4eb59b2a7b9bc2f7026d297e149ee122963 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 8 Apr 2026 14:13:17 +0200
Subject: [PATCH 54/64] Update to 9.21.21 (rhbz#2453811)

Security Fixes:

- Fix crash when reconfiguring zone update policy during active updates.

New Features:

- Add switch to disable cookie checking in delv.

Removed Features:

- Remove -C option from dnssec-keygen and dnssec-keyfromlabel.
- Remove NZF file support in favor of NZD.

Feature Changes:

- Parent-centric resolver.
- Switch to LRU-only cache eviction, enforce minimum cache size.

Bug Fixes:

- Fix intermittent named crashes during asynchronous zone operations.
- Count temporal problems with DNSSEC validation as attempts.
- Fix a possible deadlock in RPZ processing.
- Fix update-policy per-type max quota bypass via crafted UPDATE messages.
- Fix a crash triggered by rndc modzone on a zone from a configuration file.
- Fix the processing of empty catalog zone ACLs.
- Fix potential resource leak during resolver error handling.

Source: https://downloads.isc.org/isc/bind9/9.21.21/doc/arm/html/notes.html#notes-for-bind-9-21-21
---
 bind9-next.spec | 9 +++------
 sources         | 4 ++--
 2 files changed, 5 insertions(+), 8 deletions(-)

diff --git a/bind9-next.spec b/bind9-next.spec
index 96bd47e..bb62fba 100644
--- a/bind9-next.spec
+++ b/bind9-next.spec
@@ -55,7 +55,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind9-next
 License:  MPL-2.0 AND ISC AND BSD-3-clause AND MIT AND BSD-2-clause
 #
-Version:  9.21.20
+Version:  9.21.21
 Release:  %autorelease
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
@@ -123,6 +123,7 @@ BuildRequires:  pkgconfig(libedit)
 BuildRequires:  dns-root-data
 # Compress the changelog
 BuildRequires:  gzip
+BuildRequires:  pkgconfig(lmdb)
 %if %{with JEMALLOC}
 BuildRequires:  jemalloc-devel
 %endif
@@ -152,6 +153,7 @@ BuildRequires:  perl(English)
 BuildRequires:  python3-pytest
 BuildRequires:  python3-pytest-xdist
 BuildRequires:  python3-dns
+BuildRequires:  python3-hypothesis
 # manual configuration requires this tool
 BuildRequires:  iproute
 BuildRequires:  python3-jinja2
@@ -369,11 +371,6 @@ export LIBDIR_SUFFIX
 %if %{with GSSTSIG}
   -Dgssapi=enabled \
 %endif
-%if %{with LMDB}
-  -Dlmdb=enabled \
-%else
-  -Dlmdb=disabled \
-%endif
 %if %{with JSON}
   -Dstats-json=enabled \
 %endif
diff --git a/sources b/sources
index fa2afc0..4641049 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.21.20.tar.xz) = 4bd65612ff851720eba7f88495d51eb8a41b6a946c377b9dcd62f58f8c5a3e9338af44abc9df76b2ead9461eca4eb81f088619e3cc481f35fa0fc5d0926a93e3
-SHA512 (bind-9.21.20.tar.xz.asc) = 7431540d942fe23222b2812f9d80e67d0fa38516f9d536095a6544b156dc0306aba5752ba6c03cc2935d92a74860e70e8fc53b4cb481b8afe226e49dd51f695f
+SHA512 (bind-9.21.21.tar.xz) = ebb05d1141d38bd1897bb0de1475194ca6e9335e1a295ab388376d880de1a0569279b734433f469565eccdea91cc8e6e3603b2879be700bf27082ff075bdbe49
+SHA512 (bind-9.21.21.tar.xz.asc) = bad3fa0355742b57bc711c2f3f6bddd220bf5a5d4f5fa3b3ef9f2172247f184e637688080b0fc8cc67d37e1ee41bf484062f3a529d9942454b243a46091761b3

From 3fb06e6ad0706bffa43db6c9037cd7f7159c62e4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 8 Apr 2026 14:54:35 +0200
Subject: [PATCH 55/64] Remove LMDB conditional builds

LMDB is now required, no conditional will help. Remove always present
condition.
---
 bind9-next.spec | 14 ++------------
 1 file changed, 2 insertions(+), 12 deletions(-)

diff --git a/bind9-next.spec b/bind9-next.spec
index bb62fba..2562b0b 100644
--- a/bind9-next.spec
+++ b/bind9-next.spec
@@ -17,7 +17,6 @@
 # Do not set CI environment, include more unit tests, even less stable
 %bcond_with    UNITTEST_ALL
 %bcond_without DNSTAP
-%bcond_without LMDB
 %bcond_without DOC
 %bcond_with    TSAN
 %bcond_without DTRACE
@@ -157,6 +156,7 @@ BuildRequires:  python3-hypothesis
 # manual configuration requires this tool
 BuildRequires:  iproute
 BuildRequires:  python3-jinja2
+BuildRequires:  lmdb-devel
 %if %{with SUDO}
 BuildRequires:  libcap sudo
 %endif
@@ -164,9 +164,6 @@ BuildRequires:  libcap sudo
 %if %{with GSSTSIG}
 BuildRequires:  krb5-devel
 %endif
-%if %{with LMDB}
-BuildRequires:  lmdb-devel
-%endif
 %if %{with JSON}
 BuildRequires:  json-c-devel
 %endif
@@ -251,13 +248,11 @@ Obsoletes: %{name}-lite-devel < 32:9.16.6-3
 Requires: %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release}
 Requires: openssl-devel%{?_isa} libxml2-devel%{?_isa}
 Requires: libcap-devel%{?_isa}
+Requires: lmdb-devel%{?_isa}
 %upname_compat %{upname}-devel
 %if %{with GSSTSIG}
 Requires: krb5-devel%{?_isa}
 %endif
-%if %{with LMDB}
-Requires: lmdb-devel%{?_isa}
-%endif
 %if %{with JSON}
 Requires:  json-c-devel%{?_isa}
 %endif
@@ -558,9 +553,6 @@ find ${RPM_BUILD_ROOT}/%{_libdir} -name '*.la' -exec '/bin/rm' '-f' '{}' ';';
 %if %{without DNSTAP}
 rm -f ${RPM_BUILD_ROOT}%{_mandir}/man1/dnstap-read.1* || true
 %endif
-%if %{without LMDB}
-rm -f ${RPM_BUILD_ROOT}%{_mandir}/man8/named-nzd2nzf.8* || true
-%endif
 
 pushd ${RPM_BUILD_ROOT}%{_mandir}/man8
 ln -s ddns-confgen.8.gz tsig-keygen.8.gz
@@ -814,10 +806,8 @@ fi;
 %{_bindir}/dnstap-read
 %{_mandir}/man1/dnstap-read.1*
 %endif
-%if %{with LMDB}
 %{_bindir}/named-nzd2nzf
 %{_mandir}/man1/named-nzd2nzf.1*
-%endif
 %{_mandir}/man1/host.1*
 %{_mandir}/man1/nsupdate.1*
 %{_mandir}/man1/dig.1*

From 33dbe7720fb0490e581b0a623a8486075db2821b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 9 Apr 2026 11:52:10 +0200
Subject: [PATCH 56/64] Switch devel libraries to pkgconfig dependencies

Should be more portable across different distributions.
---
 bind9-next.spec | 19 ++++++++++---------
 1 file changed, 10 insertions(+), 9 deletions(-)

diff --git a/bind9-next.spec b/bind9-next.spec
index 2562b0b..6b06eda 100644
--- a/bind9-next.spec
+++ b/bind9-next.spec
@@ -109,33 +109,33 @@ BuildRequires:  libtool
 BuildRequires:  meson >= 1.3.0
 BuildRequires:  ninja-build
 BuildRequires:  pkgconfig
-BuildRequires:  libcap-devel
-BuildRequires:  libidn2-devel
-BuildRequires:  libxml2-devel
+BuildRequires:  pkgconfig(libcap)
+BuildRequires:  pkgconfig(libidn2)
+BuildRequires:  pkgconfig(libxml-2.0)
 BuildRequires:  systemd-rpm-macros
 BuildRequires:  selinux-policy
 BuildRequires:  findutils
 BuildRequires:  sed
-BuildRequires:  libnghttp2-devel
-BuildRequires:  userspace-rcu-devel
+BuildRequires:  pkgconfig(libnghttp2)
+BuildRequires:  pkgconfig(liburcu)
 BuildRequires:  pkgconfig(libedit)
 BuildRequires:  dns-root-data
 # Compress the changelog
 BuildRequires:  gzip
 BuildRequires:  pkgconfig(lmdb)
 %if %{with JEMALLOC}
-BuildRequires:  jemalloc-devel
+BuildRequires:  pkgconfig(jemalloc)
 %endif
 %if ! 0%{?rhel}
 BuildRequires:  gpgverify
 %endif
-BuildRequires:  libuv-devel
+BuildRequires:  pkgconfig(libuv)
 %if %{with OPENSSL_ENGINE}
 BuildRequires:  openssl-devel-engine
 %endif
 %if %{with UNITTEST}
 # make unit dependencies
-BuildRequires:  libcmocka-devel
+BuildRequires:  pkgconfig(cmocka)
 # Ensure we have lscpu
 BuildRequires:  util-linux
 # Catch failing unittests coredumps
@@ -246,7 +246,8 @@ Summary:  Header files and libraries needed for bind-dyndb-ldap
 Provides: %{name}-lite-devel = %{epoch}:%{version}-%{release}
 Obsoletes: %{name}-lite-devel < 32:9.16.6-3
 Requires: %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release}
-Requires: openssl-devel%{?_isa} libxml2-devel%{?_isa}
+Requires: openssl-devel%{?_isa}
+Requires: libxml2-devel%{?_isa}
 Requires: libcap-devel%{?_isa}
 Requires: lmdb-devel%{?_isa}
 %upname_compat %{upname}-devel

From e1d95fa29846dece9befcf2f4ad8543034d08c94 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 9 Apr 2026 11:52:58 +0200
Subject: [PATCH 57/64] Fix failing unittest on 32 bits

---
 bind-9.21-unittest-32b-mem.patch | 94 ++++++++++++++++++++++++++++++++
 bind9-next.spec                  |  2 +
 2 files changed, 96 insertions(+)
 create mode 100644 bind-9.21-unittest-32b-mem.patch

diff --git a/bind-9.21-unittest-32b-mem.patch b/bind-9.21-unittest-32b-mem.patch
new file mode 100644
index 0000000..ba968d8
--- /dev/null
+++ b/bind-9.21-unittest-32b-mem.patch
@@ -0,0 +1,94 @@
+From 0ec3954222bab0c7a74b379fc1982c55f89a90e4 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
+Date: Thu, 9 Apr 2026 10:51:57 +0200
+Subject: [PATCH] Accept significantly lower memory consumption on 32b system
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Memory usage might be significantly lower on legacy platforms. Allow
+testing of them and pass there. Move repeated checks to shared
+functions, include phase in minimal range to simplify identification of
+failed place.
+
+Signed-off-by: Petr Menšík <pemensik@redhat.com>
+---
+ tests/dns/deleg_test.c | 27 +++++++++++++++++++++------
+ 1 file changed, 21 insertions(+), 6 deletions(-)
+
+diff --git a/tests/dns/deleg_test.c b/tests/dns/deleg_test.c
+index 904eaeef00..cc4772977f 100644
+--- a/tests/dns/deleg_test.c
++++ b/tests/dns/deleg_test.c
+@@ -567,6 +567,22 @@ typedef struct {
+ 	isc_stdtime_t now;
+ } cleanup_ctx_t;
+ 
++static void cleanuptests_memcheck1(isc_mem_t *mctx, unsigned int phase) {
++	size_t inuse = isc_mem_inuse(mctx);
++	if (sizeof(void *) == 4)
++		assert_int_in_range(inuse, 3100000+phase, 3300000);
++	else
++		assert_int_in_range(inuse, 4000000+phase, 4100000);
++}
++
++static void cleanuptests_memcheck2(isc_mem_t *mctx, unsigned int phase) {
++	size_t inuse = isc_mem_inuse(mctx);
++	if (sizeof(void *) == 4)
++		assert_int_in_range(inuse, 6400000+phase, 6500000);
++	else
++		assert_int_in_range(inuse, 8000000+phase, 8100000);
++}
++
+ static void
+ cleanuptests_phase3(void *arg) {
+ 	cleanup_ctx_t *ctx = arg;
+@@ -575,7 +591,7 @@ cleanuptests_phase3(void *arg) {
+ 	dns_delegset_t *delegset = NULL;
+ 	isc_result_t result;
+ 
+-	assert_int_in_range(isc_mem_inuse(db->mctx), 4000000, 4100000);
++	cleanuptests_memcheck1(db->mctx, 3);
+ 
+ 	/*
+ 	 * baz. is there, but bar. is gone, as it has been
+@@ -600,7 +616,7 @@ cleanuptests_phase2(void *arg) {
+ 	dns_delegset_t *delegset = NULL;
+ 	isc_result_t result;
+ 
+-	assert_int_in_range(isc_mem_inuse(db->mctx), 4000000, 4100000);
++	cleanuptests_memcheck1(db->mctx, 2);
+ 
+ 	/*
+ 	 * bar. is there
+@@ -620,7 +636,7 @@ cleanuptests_phase2(void *arg) {
+ 	for (size_t i = 0; i < 99999; i++) {
+ 		addipdeleg(AF_INET6, "1111::2222", delegset, deleg);
+ 	}
+-	assert_int_in_range(isc_mem_inuse(db->mctx), 8000000, 8100000);
++	cleanuptests_memcheck2(db->mctx, 2);
+ 	writedb(db, "baz.", 30, &delegset, true);
+ 	deleg = NULL;
+ 
+@@ -669,8 +685,7 @@ cleanuptests(ISC_ATTR_UNUSED void *arg) {
+ 		addipdeleg(AF_INET6, "1111::2222", delegset, deleg);
+ 	}
+ 
+-	assert_int_in_range(isc_mem_inuse(db->mctx), 4000000, 4100000);
+-
++	cleanuptests_memcheck1(db->mctx, 1);
+ 	writedb(db, "stuff.", 10, &delegset, true);
+ 	deleg = NULL;
+ 	stdtime_now += 10;
+@@ -691,7 +706,7 @@ cleanuptests(ISC_ATTR_UNUSED void *arg) {
+ 	 * with DB mem context) overmem conditions will be detected, and the
+ 	 * expired node will be removed
+ 	 */
+-	assert_int_in_range(isc_mem_inuse(db->mctx), 8000000, 8100000);
++	cleanuptests_memcheck2(db->mctx, 1);
+ 	writedb(db, "bar.", 30, &delegset, true);
+ 	deleg = NULL;
+ 
+-- 
+2.53.0
+
diff --git a/bind9-next.spec b/bind9-next.spec
index 6b06eda..aaac824 100644
--- a/bind9-next.spec
+++ b/bind9-next.spec
@@ -89,6 +89,8 @@ Patch1: bind-9.16-redhat_doc.patch
 # https://gitlab.isc.org/isc-projects/bind9/-/issues/5328
 # avoid often fails on i386, unsupported upstream
 Patch4: bind-9.21-unittest-qpdb-i386.patch
+# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/11825
+Patch5: bind-9.21-unittest-32b-mem.patch
 
 %{?systemd_ordering}
 Requires:       coreutils

From cd2cf2d5762b95546c8b3b31427edd9be026df26 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 30 Apr 2026 19:05:23 +0200
Subject: [PATCH 58/64] Stop publishing rwtab.d/named

It is not used for anything interesting anymore. Stop providing it.
---
 bind9-next.spec | 5 -----
 named.rwtab     | 6 ------
 2 files changed, 11 deletions(-)
 delete mode 100644 named.rwtab

diff --git a/bind9-next.spec b/bind9-next.spec
index aaac824..0696d42 100644
--- a/bind9-next.spec
+++ b/bind9-next.spec
@@ -77,7 +77,6 @@ Source37: named.service
 Source38: named-chroot.service
 Source41: setup-named-chroot.sh
 Source42: generate-rndc-key.sh
-Source43: named.rwtab
 Source44: named-chroot-setup.service
 Source46: named-setup-rndc.service
 Source48: setup-named-softhsm.sh
@@ -622,9 +621,6 @@ done
 mkdir -p ${RPM_BUILD_ROOT}%{_tmpfilesdir}
 install -m 644 %{SOURCE35} ${RPM_BUILD_ROOT}%{_tmpfilesdir}/named.conf
 
-mkdir -p ${RPM_BUILD_ROOT}%{_sysconfdir}/rwtab.d
-install -m 644 %{SOURCE43} ${RPM_BUILD_ROOT}%{_sysconfdir}/rwtab.d/named
-
 install -m0644 -D bind9-next.sysusers.conf %{buildroot}%{_sysusersdir}/bind9-next.conf
 
 %post
@@ -725,7 +721,6 @@ fi;
 %config(noreplace) %{_sysconfdir}/logrotate.d/named
 %{_tmpfilesdir}/named.conf
 %{_sysusersdir}/bind9-next.conf
-%{_sysconfdir}/rwtab.d/named
 %{_unitdir}/named.service
 %{_unitdir}/named-setup-rndc.service
 %{_bindir}/named-journalprint
diff --git a/named.rwtab b/named.rwtab
deleted file mode 100644
index 2cb3a41..0000000
--- a/named.rwtab
+++ /dev/null
@@ -1,6 +0,0 @@
-dirs    /var/named
-
-files	/var/named/named.ca
-files	/var/named/named.empty
-files	/var/named/named.localhost
-files	/var/named/named.loopback

From 683924bd6091ab2419c742025b7154bcc8f7633a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 29 Apr 2026 18:16:07 +0200
Subject: [PATCH 59/64] Remove unused forgotten files

---
 bind-9.11.12.tar.gz.asc |  16 ---
 bind-9.14.7.tar.gz.asc  |  16 ---
 bind97-exportlib.patch  | 226 ----------------------------------------
 3 files changed, 258 deletions(-)
 delete mode 100644 bind-9.11.12.tar.gz.asc
 delete mode 100644 bind-9.14.7.tar.gz.asc
 delete mode 100644 bind97-exportlib.patch

diff --git a/bind-9.11.12.tar.gz.asc b/bind-9.11.12.tar.gz.asc
deleted file mode 100644
index 6d7992f..0000000
--- a/bind-9.11.12.tar.gz.asc
+++ /dev/null
@@ -1,16 +0,0 @@
------BEGIN PGP SIGNATURE-----
-
-iQIzBAABAgAdFiEErj+seWcR7Fn8AHqkdLtrmky7PTgFAl2WMooACgkQdLtrmky7
-PThv2RAAnXNLYTzXtH6ls29tRm5Hc+D6UaeqcWDNQ4BpkRVhrFxtukalGCi9mmB6
-NPJzFyXmaOW654pypCIuEgqJNFUpDtLzLzT7SUF+mhm+5plsaRSBnh4mq87l5KSp
-twODAPnfCJV+HBk5RmToLEstAbGQ7xEBTyQtZoFkY+V7zEFwENKiCvWsoSWOkYR3
-zXo3sKjc83HV9ShbW/mCtbZf5L0qlbrKOAzqJfAFMhNNJi8kMbmr/Zi2sIfN+Rhv
-g8HQo89Epv6r51yAdeED8idIX4rKjjcEtHrZeDmLdCcdHgSEj2sIlH92Joce6vL0
-S59A0rItIXm6fW8sz6WNpcj4tVtWYbIYjXZ4SPFNkaUrHv8cUekq+5vbI+v07Gh3
-2bhtDsDyTY5I1/AsY/EFmwkCAjUS00jZryBnuJpLB3v5JtUog4ek32yLBzPrqRBo
-1876j4nlXAia8mG0OgJNWZ0gHyUPe/TgfR8fQDLmHxHHlKrJNTEwY6bLW8jzFTX1
-zk510fI1K7J9tiQgf5wcBQ2h3EBlqzDNIJDovoATzLYIf0HKyVegh/vnQdtdEhUR
-1DzJAt3bsBfAP1AFfWPD/ACu5Zdm7SxY1wE/pjkwttDU3sRZqOfuwNBGeolu3cVN
-O9/h1zsyVeVS0ui2vu4+V4EvNitmXsVbG2doDq9L5yBiIKGO2Ew=
-=GCy6
------END PGP SIGNATURE-----
diff --git a/bind-9.14.7.tar.gz.asc b/bind-9.14.7.tar.gz.asc
deleted file mode 100644
index 1134ae1..0000000
--- a/bind-9.14.7.tar.gz.asc
+++ /dev/null
@@ -1,16 +0,0 @@
------BEGIN PGP SIGNATURE-----
-
-iQIzBAABAgAdFiEErj+seWcR7Fn8AHqkdLtrmky7PTgFAl2WMpEACgkQdLtrmky7
-PTh/sg//QbNRAQvADQfwF1PPo+JxB+3WzQ9oJAWeHbOoiubwkUwO9xE+BEnTNd5o
-oM1lSLqFxNykOTaoeJlqPftPod1cxo7lSzkwflugGyB/59wliCpqCg053YV4x9mO
-QggvA/E50+0FI/Om/7v4GHGADu/JE83FovOueWAB0LgqfDSD6QFcNFF9sUJJ4P7r
-FcEXSWj8QbrHMWBKncZUOpD2ECotvtrYmi0DTHl1XfigESDQpWtsnTFuabCCsvkh
-ch9wQRplAes2Mf/aS5tl1y0QKKBFuEjtGiTdgrDl6o9GLnx6CueX5saZehu2EVkr
-fq2vEYUC2lRQSjuxSMMJ3L0TGUcl7+ixlAIISS2K9L5Xx7MhBXt/EH5KiKPfsEet
-3EH+DhxV5uXjDU7MgvREnxT+ssV23e0HWTz4tVVQ9LpvYmWPIgLcSOhHCc57yoQF
-c46V0f69dMWbMAlQ93EZSG274ZvpIszpK8+3hGI3/TuDFFgiQJeJJBFVtYJMle69
-3mEEclfzO7fBiXZFec6nVx2309bL64bafN7zszPKXl4XgoefOfD0v0eWqQT4fxfm
-dnGC0qMqSZs5F+d0fISV5JUUNYzt9PZjvnzqLLGOeTF6l3/n9G1mmNsXcxJ1OEIF
-6qh1oO7JTPjt0MFhKac4QjNQi/Bnp25O3I/PRyWZCbiwXkyvyQU=
-=ZT7s
------END PGP SIGNATURE-----
diff --git a/bind97-exportlib.patch b/bind97-exportlib.patch
deleted file mode 100644
index 4468ef5..0000000
--- a/bind97-exportlib.patch
+++ /dev/null
@@ -1,226 +0,0 @@
-diff -up bind-9.9.3rc2/isc-config.sh.in.exportlib bind-9.9.3rc2/isc-config.sh.in
-diff -up bind-9.9.3rc2/lib/export/dns/Makefile.in.exportlib bind-9.9.3rc2/lib/export/dns/Makefile.in
---- bind-9.9.3rc2/lib/export/dns/Makefile.in.exportlib	2013-04-30 08:38:46.000000000 +0200
-+++ bind-9.9.3rc2/lib/export/dns/Makefile.in	2013-05-13 10:45:22.574089729 +0200
-@@ -35,9 +35,9 @@ CDEFINES =	-DUSE_MD5 @USE_OPENSSL@ @USE_
- 
- CWARNINGS =
- 
--ISCLIBS =	../isc/libisc.@A@
-+ISCLIBS =	../isc/libisc-export.@A@
- 
--ISCDEPLIBS =	../isc/libisc.@A@
-+ISCDEPLIBS =	../isc/libisc-export.@A@
- 
- LIBS =		@LIBS@
- 
-@@ -116,29 +116,29 @@ version.@O@: ${srcdir}/version.c
- 		-DLIBAGE=${LIBAGE} \
- 		-c ${srcdir}/version.c
- 
--libdns.@SA@: ${OBJS}
-+libdns-export.@SA@: ${OBJS}
- 	${AR} ${ARFLAGS} $@ ${OBJS}
- 	${RANLIB} $@
- 
--libdns.la: ${OBJS}
-+libdns-export.la: ${OBJS}
- 	${LIBTOOL_MODE_LINK} \
--		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libdns.la \
-+		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libdns-export.la \
- 		-rpath ${export_libdir} \
- 		-version-info ${LIBINTERFACE}:${LIBREVISION}:${LIBAGE} \
- 		${OBJS} ${ISCLIBS} @DNS_CRYPTO_LIBS@ ${LIBS}
- 
--timestamp: libdns.@A@
-+timestamp: libdns-export.@A@
- 	touch timestamp
- 
- installdirs:
- 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${export_libdir}
- 
- install:: timestamp installdirs
--	${LIBTOOL_MODE_INSTALL} ${INSTALL_DATA} libdns.@A@ \
-+	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} libdns-export.@A@ \
- 	${DESTDIR}${export_libdir}/
- 
- clean distclean::
--	rm -f libdns.@A@ timestamp
-+	rm -f libdns-export.@A@ timestamp
- 	rm -f gen code.h include/dns/enumtype.h include/dns/enumclass.h
- 	rm -f include/dns/rdatastruct.h
- 
-diff -up bind-9.9.3rc2/lib/export/irs/Makefile.in.exportlib bind-9.9.3rc2/lib/export/irs/Makefile.in
---- bind-9.9.3rc2/lib/export/irs/Makefile.in.exportlib	2013-04-30 08:38:46.000000000 +0200
-+++ bind-9.9.3rc2/lib/export/irs/Makefile.in	2013-05-13 10:45:22.575089729 +0200
-@@ -43,9 +43,9 @@ SRCS =		context.c \
- 		gai_sterror.c getaddrinfo.c getnameinfo.c \
- 		resconf.c
- 
--ISCLIBS =	../isc/libisc.@A@
--DNSLIBS =	../dns/libdns.@A@
--ISCCFGLIBS =	../isccfg/libisccfg.@A@
-+ISCLIBS =	../isc/libisc-export.@A@
-+DNSLIBS =	../dns/libdns-export.@A@
-+ISCCFGLIBS =	../isccfg/libisccfg-export.@A@
- 
- LIBS =		@LIBS@
- 
-@@ -62,26 +62,26 @@ version.@O@: ${srcdir}/version.c
- 		-DLIBAGE=${LIBAGE} \
- 		-c ${srcdir}/version.c
- 
--libirs.@SA@: ${OBJS} version.@O@
-+libirs-export.@SA@: ${OBJS} version.@O@
- 	${AR} ${ARFLAGS} $@ ${OBJS} version.@O@
- 	${RANLIB} $@
- 
--libirs.la: ${OBJS} version.@O@
-+libirs-export.la: ${OBJS} version.@O@
- 	${LIBTOOL_MODE_LINK} \
--		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libirs.la \
-+		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libirs-export.la \
- 		-rpath ${export_libdir} \
- 		-version-info ${LIBINTERFACE}:${LIBREVISION}:${LIBAGE} \
- 		${OBJS} version.@O@ ${LIBS} ${ISCCFGLIBS} ${DNSLIBS} ${ISCLIBS}
- 
--timestamp: libirs.@A@
-+timestamp: libirs-export.@A@
- 	touch timestamp
- 
- installdirs:
- 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${export_libdir}
- 
- install:: timestamp installdirs
--	${LIBTOOL_MODE_INSTALL} ${INSTALL_DATA} libirs.@A@ \
-+	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} libirs-export.@A@ \
- 	${DESTDIR}${export_libdir}/
- 
- clean distclean::
--	rm -f libirs.@A@ libirs.la timestamp
-+	rm -f libirs-export.@A@ libirs-export.la timestamp
-diff -up bind-9.9.3rc2/lib/export/isccfg/Makefile.in.exportlib bind-9.9.3rc2/lib/export/isccfg/Makefile.in
---- bind-9.9.3rc2/lib/export/isccfg/Makefile.in.exportlib	2013-04-30 08:38:46.000000000 +0200
-+++ bind-9.9.3rc2/lib/export/isccfg/Makefile.in	2013-05-13 10:45:22.576089729 +0200
-@@ -30,11 +30,11 @@ CINCLUDES =	-I. ${DNS_INCLUDES} -I${expo
- CDEFINES =
- CWARNINGS =
- 
--ISCLIBS =	../isc/libisc.@A@
--DNSLIBS =	../dns/libdns.@A@ @DNS_CRYPTO_LIBS@
-+ISCLIBS =	../isc/libisc-export.@A@
-+DNSLIBS =	../dns/libdns-export.@A@ @DNS_CRYPTO_LIBS@
- 
- ISCDEPLIBS =	../../lib/isc/libisc.@A@
--ISCCFGDEPLIBS =	libisccfg.@A@
-+ISCCFGDEPLIBS =	libisccfg-export.@A@
- 
- LIBS =		@LIBS@
- 
-@@ -58,26 +58,26 @@ version.@O@: ${srcdir}/version.c
- 		-DLIBAGE=${LIBAGE} \
- 		-c ${srcdir}/version.c
- 
--libisccfg.@SA@: ${OBJS}
-+libisccfg-export.@SA@: ${OBJS}
- 	${AR} ${ARFLAGS} $@ ${OBJS}
- 	${RANLIB} $@
- 
--libisccfg.la: ${OBJS}
-+libisccfg-export.la: ${OBJS}
- 	 ${LIBTOOL_MODE_LINK} \
--		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libisccfg.la \
-+		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libisccfg-export.la \
- 		-rpath ${export_libdir} \
- 		-version-info ${LIBINTERFACE}:${LIBREVISION}:${LIBAGE} \
- 		${OBJS} ${LIBS} ${DNSLIBS} ${ISCLIBS}
- 
--timestamp: libisccfg.@A@
-+timestamp: libisccfg-export.@A@
- 	touch timestamp
- 
- installdirs:
- 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${export_libdir}
- 
- install:: timestamp installdirs
--	${LIBTOOL_MODE_INSTALL} ${INSTALL_DATA} libisccfg.@A@ \
-+	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} libisccfg-export.@A@ \
- 	${DESTDIR}${export_libdir}/
- 
- clean distclean::
--	rm -f libisccfg.@A@ timestamp
-+	rm -f libisccfg-export.@A@ timestamp
-diff -up bind-9.9.3rc2/lib/export/isc/Makefile.in.exportlib bind-9.9.3rc2/lib/export/isc/Makefile.in
---- bind-9.9.3rc2/lib/export/isc/Makefile.in.exportlib	2013-04-30 08:38:46.000000000 +0200
-+++ bind-9.9.3rc2/lib/export/isc/Makefile.in	2013-05-13 10:45:22.576089729 +0200
-@@ -100,6 +100,10 @@ SRCS =		@ISC_EXTRA_SRCS@ \
- 
- LIBS =		@LIBS@
- 
-+# Note: the order of SUBDIRS is important.
-+# Attempt to disable parallel processing.
-+.NOTPARALLEL:
-+.NO_PARALLEL:
- SUBDIRS =	include unix nls @ISC_THREAD_DIR@
- TARGETS =	timestamp
- 
-@@ -113,26 +117,26 @@ version.@O@: ${srcdir}/version.c
- 		-DLIBAGE=${LIBAGE} \
- 		-c ${srcdir}/version.c
- 
--libisc.@SA@: ${OBJS}
-+libisc-export.@SA@: ${OBJS}
- 	${AR} ${ARFLAGS} $@ ${OBJS}
- 	${RANLIB} $@
- 
--libisc.la: ${OBJS}
-+libisc-export.la: ${OBJS}
- 	${LIBTOOL_MODE_LINK} \
--		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libisc.la \
-+		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libisc-export.la \
- 		-rpath ${export_libdir} \
- 		-version-info ${LIBINTERFACE}:${LIBREVISION}:${LIBAGE} \
- 		${OBJS} ${LIBS}
- 
--timestamp: libisc.@A@
-+timestamp: libisc-export.@A@
- 	touch timestamp
- 
- installdirs:
- 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${export_libdir}
- 
- install:: timestamp installdirs
--	${LIBTOOL_MODE_INSTALL} ${INSTALL_DATA} libisc.@A@ \
-+	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} libisc-export.@A@ \
- 	${DESTDIR}${export_libdir}
- 
- clean distclean::
--	rm -f libisc.@A@ libisc.la timestamp
-+	rm -f libisc-export.@A@ libisc-export.la timestamp
-diff -up bind-9.9.3rc2/lib/export/samples/Makefile.in.exportlib bind-9.9.3rc2/lib/export/samples/Makefile.in
---- bind-9.9.3rc2/lib/export/samples/Makefile.in.exportlib	2013-04-30 08:38:46.000000000 +0200
-+++ bind-9.9.3rc2/lib/export/samples/Makefile.in	2013-05-13 10:45:22.577089729 +0200
-@@ -31,15 +31,15 @@ CINCLUDES =	-I${srcdir}/include -I../dns
- CDEFINES =
- CWARNINGS =
- 
--DNSLIBS =	../dns/libdns.@A@ @DNS_CRYPTO_LIBS@
--ISCLIBS =	../isc/libisc.@A@
--ISCCFGLIBS =	../isccfg/libisccfg.@A@
--IRSLIBS =	../irs/libirs.@A@
-+DNSLIBS =	../dns/libdns-export.@A@ @DNS_CRYPTO_LIBS@
-+ISCLIBS =	../isc/libisc-export.@A@
-+ISCCFGLIBS =	../isccfg/libisccfg-export.@A@
-+IRSLIBS =	../irs/libirs-export.@A@
- 
--DNSDEPLIBS =	../dns/libdns.@A@
--ISCDEPLIBS =	../isc/libisc.@A@
--ISCCFGDEPLIBS =	../isccfg/libisccfg.@A@
--IRSDEPLIBS =	../irs/libirs.@A@
-+DNSDEPLIBS =	../dns/libdns-export.@A@
-+ISCDEPLIBS =	../isc/libisc-export.@A@
-+ISCCFGDEPLIBS =	../isccfg/libisccfg-export.@A@
-+IRSDEPLIBS =	../irs/libirs-export.@A@
- 
- DEPLIBS =	${DNSDEPLIBS} ${ISCCFGDEPLIBS} ${ISCDEPLIBS}
- 

From 4f4bfde477ee9f5686374bd72be0a782913421dc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Tue, 5 May 2026 12:23:31 +0200
Subject: [PATCH 60/64] Fix build with openssl4 (rhbz#2463851)

Use upstream way to fix problem with openssl 4.0. That is removing whole
openssl crypto tracking.
---
 bind-9.21-openssl4-malloc.patch | 150 ++++++++++++++++++++++++++++++++
 bind9-next.spec                 |   2 +
 2 files changed, 152 insertions(+)
 create mode 100644 bind-9.21-openssl4-malloc.patch

diff --git a/bind-9.21-openssl4-malloc.patch b/bind-9.21-openssl4-malloc.patch
new file mode 100644
index 0000000..693cad4
--- /dev/null
+++ b/bind-9.21-openssl4-malloc.patch
@@ -0,0 +1,150 @@
+From c4b7f67b7d79150007412e370de3c21cc80057d6 Mon Sep 17 00:00:00 2001
+From: Aram Sargsyan <aram@isc.org>
+Date: Thu, 16 Apr 2026 17:31:04 +0000
+Subject: [PATCH] Remove OpenSSL memory tracking support from the ossl3.c
+ module
+
+OPENSSL_cleanup() in OpenSSL 4 doesn't free the memory, and that is
+not compatible with BIND 9's memory leak detection code. Don't use
+custom allocation/deallocation functions for OpenSSL's internal memory
+management in the ossl3.c module.
+
+See https://github.com/openssl/openssl/pull/29721
+
+(cherry picked from commit 4ede6edc547109af81dc5c5ec25cf3ff7991bc10)
+---
+ lib/isc/crypto/ossl3.c | 90 +++++-------------------------------------
+ 1 file changed, 9 insertions(+), 81 deletions(-)
+
+diff --git a/lib/isc/crypto/ossl3.c b/lib/isc/crypto/ossl3.c
+index 1c2f3cab9d..35344dc8b1 100644
+--- a/lib/isc/crypto/ossl3.c
++++ b/lib/isc/crypto/ossl3.c
+@@ -44,8 +44,6 @@ struct isc_hmac_key {
+ 
+ constexpr uint32_t hmac_key_magic = ISC_MAGIC('H', 'M', 'A', 'C');
+ 
+-static isc_mem_t *isc__crypto_mctx = NULL;
+-
+ static OSSL_PROVIDER *base = NULL, *fips = NULL;
+ 
+ static EVP_MAC *evp_hmac = NULL;
+@@ -320,69 +318,6 @@ isc_hmac_final(isc_hmac_t *hmac, isc_buffer_t *out) {
+ 	return ISC_R_SUCCESS;
+ }
+ 
+-#if ISC_MEM_TRACKLINES
+-/*
+- * We use the internal isc__mem API here, so we can pass the file and line
+- * arguments passed from OpenSSL >= 1.1.0 to our memory functions for better
+- * tracking of the OpenSSL allocations.  Without this, we would always just see
+- * isc__crypto_{malloc,realloc,free} in the tracking output, but with this in
+- * place we get to see the places in the OpenSSL code where the allocations
+- * happen.
+- */
+-
+-static void *
+-isc__crypto_malloc_ex(size_t size, const char *file, int line) {
+-	return isc__mem_allocate(isc__crypto_mctx, size, 0, __func__, file,
+-				 (unsigned int)line);
+-}
+-
+-static void *
+-isc__crypto_realloc_ex(void *ptr, size_t size, const char *file, int line) {
+-	return isc__mem_reallocate(isc__crypto_mctx, ptr, size, 0, __func__,
+-				   file, (unsigned int)line);
+-}
+-
+-static void
+-isc__crypto_free_ex(void *ptr, const char *file, int line) {
+-	if (ptr == NULL) {
+-		return;
+-	}
+-	if (isc__crypto_mctx != NULL) {
+-		isc__mem_free(isc__crypto_mctx, ptr, 0, __func__, file,
+-			      (unsigned int)line);
+-	}
+-}
+-
+-#else /* ISC_MEM_TRACKLINES */
+-
+-static void *
+-isc__crypto_malloc_ex(size_t size, const char *file, int line) {
+-	UNUSED(file);
+-	UNUSED(line);
+-	return isc_mem_allocate(isc__crypto_mctx, size);
+-}
+-
+-static void *
+-isc__crypto_realloc_ex(void *ptr, size_t size, const char *file, int line) {
+-	UNUSED(file);
+-	UNUSED(line);
+-	return isc_mem_reallocate(isc__crypto_mctx, ptr, size);
+-}
+-
+-static void
+-isc__crypto_free_ex(void *ptr, const char *file, int line) {
+-	UNUSED(file);
+-	UNUSED(line);
+-	if (ptr == NULL) {
+-		return;
+-	}
+-	if (isc__crypto_mctx != NULL) {
+-		isc__mem_free(isc__crypto_mctx, ptr, 0);
+-	}
+-}
+-
+-#endif /* ISC_MEM_TRACKLINES */
+-
+ bool
+ isc_crypto_fips_mode(void) {
+ 	return EVP_default_properties_is_fips_enabled(NULL) != 0;
+@@ -424,9 +359,17 @@ isc_crypto_fips_enable(void) {
+ 	return ISC_R_SUCCESS;
+ }
+ 
++/*
++ * OPENSSL_cleanup() in OpenSSL 4 doesn't free the memory, which is not
++ * compatible with BIND 9's memory leak detection code, that is why the memory
++ * tracking has been disabled in this module, and this function is a no-op.
++ * This can be cleaned up once OpenSSL 1.1.x support is removed.
++ *
++ * See https://github.com/openssl/openssl/pull/29721
++ */
+ void
+ isc__crypto_setdestroycheck(bool check) {
+-	isc_mem_setdestroycheck(isc__crypto_mctx, check);
++	UNUSED(check);
+ }
+ 
+ void
+@@ -437,19 +380,6 @@ isc__crypto_initialize(void) {
+ 	 */
+ 	uint64_t opts = OPENSSL_INIT_LOAD_CONFIG | OPENSSL_INIT_NO_ATEXIT;
+ 
+-	isc_mem_create("OpenSSL", &isc__crypto_mctx);
+-	isc_mem_setdebugging(isc__crypto_mctx, 0);
+-	isc_mem_setdestroycheck(isc__crypto_mctx, false);
+-
+-	/*
+-	 * CRYPTO_set_mem_(_ex)_functions() returns 1 on success or 0 on
+-	 * failure, which means OpenSSL already allocated some memory.  There's
+-	 * nothing we can do about it.
+-	 */
+-	(void)CRYPTO_set_mem_functions(isc__crypto_malloc_ex,
+-				       isc__crypto_realloc_ex,
+-				       isc__crypto_free_ex);
+-
+ 	RUNTIME_CHECK(OPENSSL_init_ssl(opts, NULL) == 1);
+ 
+ 	register_algorithms();
+@@ -486,6 +416,4 @@ isc__crypto_shutdown(void) {
+ 	}
+ 
+ 	OPENSSL_cleanup();
+-
+-	isc_mem_detach(&isc__crypto_mctx);
+ }
+-- 
+2.54.0
+
diff --git a/bind9-next.spec b/bind9-next.spec
index 0696d42..c7343da 100644
--- a/bind9-next.spec
+++ b/bind9-next.spec
@@ -90,6 +90,8 @@ Patch1: bind-9.16-redhat_doc.patch
 Patch4: bind-9.21-unittest-qpdb-i386.patch
 # https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/11825
 Patch5: bind-9.21-unittest-32b-mem.patch
+# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/11865
+Patch6: bind-9.21-openssl4-malloc.patch
 
 %{?systemd_ordering}
 Requires:       coreutils

From 7ec75a1e1cf5c78d7fbddc15e415d63e0cfde575 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 3 Jun 2026 12:05:47 +0200
Subject: [PATCH 61/64] Update to 9.21.22 (rhbz#2480122)

Security Fixes:

- Limit resolver server list size. (CVE-2026-3592)
- Fix GSS-API resource leak. (CVE-2026-3039)
- Disable recursion, UPDATE, and NOTIFY for non-IN views. (CVE-2026-5946)
- Avoid unbounded recursion loop. (CVE-2026-5950)
- Fix crash in resolver when SIG(0)-signed responses are received under load. (CVE-2026-5947)
- Fix use-after-free error in DNS-over-HTTPS when processing HTTP/2 SETTINGS frames. (CVE-2026-3593)
- Fix outgoing zone transfers' quota issue.

Feature Changes:

- Fix CPU spikes and slow queries when cache approaches memory limit.
- Implement RFC 3645 Section 4.1.1 key expiry check in TKEY.
- Reduce memory footprint by actively returning unused memory to the OS.

An multiple bugfixes.

Source: https://downloads.isc.org/isc/bind9/9.21.22/doc/arm/html/notes.html#notes-for-bind-9-21-22
---
 bind-9.21-openssl4-malloc.patch  | 150 -------------------------------
 bind-9.21-unittest-32b-mem.patch |  20 ++---
 bind9-next.spec                  |   4 +-
 sources                          |   4 +-
 4 files changed, 13 insertions(+), 165 deletions(-)
 delete mode 100644 bind-9.21-openssl4-malloc.patch

diff --git a/bind-9.21-openssl4-malloc.patch b/bind-9.21-openssl4-malloc.patch
deleted file mode 100644
index 693cad4..0000000
--- a/bind-9.21-openssl4-malloc.patch
+++ /dev/null
@@ -1,150 +0,0 @@
-From c4b7f67b7d79150007412e370de3c21cc80057d6 Mon Sep 17 00:00:00 2001
-From: Aram Sargsyan <aram@isc.org>
-Date: Thu, 16 Apr 2026 17:31:04 +0000
-Subject: [PATCH] Remove OpenSSL memory tracking support from the ossl3.c
- module
-
-OPENSSL_cleanup() in OpenSSL 4 doesn't free the memory, and that is
-not compatible with BIND 9's memory leak detection code. Don't use
-custom allocation/deallocation functions for OpenSSL's internal memory
-management in the ossl3.c module.
-
-See https://github.com/openssl/openssl/pull/29721
-
-(cherry picked from commit 4ede6edc547109af81dc5c5ec25cf3ff7991bc10)
----
- lib/isc/crypto/ossl3.c | 90 +++++-------------------------------------
- 1 file changed, 9 insertions(+), 81 deletions(-)
-
-diff --git a/lib/isc/crypto/ossl3.c b/lib/isc/crypto/ossl3.c
-index 1c2f3cab9d..35344dc8b1 100644
---- a/lib/isc/crypto/ossl3.c
-+++ b/lib/isc/crypto/ossl3.c
-@@ -44,8 +44,6 @@ struct isc_hmac_key {
- 
- constexpr uint32_t hmac_key_magic = ISC_MAGIC('H', 'M', 'A', 'C');
- 
--static isc_mem_t *isc__crypto_mctx = NULL;
--
- static OSSL_PROVIDER *base = NULL, *fips = NULL;
- 
- static EVP_MAC *evp_hmac = NULL;
-@@ -320,69 +318,6 @@ isc_hmac_final(isc_hmac_t *hmac, isc_buffer_t *out) {
- 	return ISC_R_SUCCESS;
- }
- 
--#if ISC_MEM_TRACKLINES
--/*
-- * We use the internal isc__mem API here, so we can pass the file and line
-- * arguments passed from OpenSSL >= 1.1.0 to our memory functions for better
-- * tracking of the OpenSSL allocations.  Without this, we would always just see
-- * isc__crypto_{malloc,realloc,free} in the tracking output, but with this in
-- * place we get to see the places in the OpenSSL code where the allocations
-- * happen.
-- */
--
--static void *
--isc__crypto_malloc_ex(size_t size, const char *file, int line) {
--	return isc__mem_allocate(isc__crypto_mctx, size, 0, __func__, file,
--				 (unsigned int)line);
--}
--
--static void *
--isc__crypto_realloc_ex(void *ptr, size_t size, const char *file, int line) {
--	return isc__mem_reallocate(isc__crypto_mctx, ptr, size, 0, __func__,
--				   file, (unsigned int)line);
--}
--
--static void
--isc__crypto_free_ex(void *ptr, const char *file, int line) {
--	if (ptr == NULL) {
--		return;
--	}
--	if (isc__crypto_mctx != NULL) {
--		isc__mem_free(isc__crypto_mctx, ptr, 0, __func__, file,
--			      (unsigned int)line);
--	}
--}
--
--#else /* ISC_MEM_TRACKLINES */
--
--static void *
--isc__crypto_malloc_ex(size_t size, const char *file, int line) {
--	UNUSED(file);
--	UNUSED(line);
--	return isc_mem_allocate(isc__crypto_mctx, size);
--}
--
--static void *
--isc__crypto_realloc_ex(void *ptr, size_t size, const char *file, int line) {
--	UNUSED(file);
--	UNUSED(line);
--	return isc_mem_reallocate(isc__crypto_mctx, ptr, size);
--}
--
--static void
--isc__crypto_free_ex(void *ptr, const char *file, int line) {
--	UNUSED(file);
--	UNUSED(line);
--	if (ptr == NULL) {
--		return;
--	}
--	if (isc__crypto_mctx != NULL) {
--		isc__mem_free(isc__crypto_mctx, ptr, 0);
--	}
--}
--
--#endif /* ISC_MEM_TRACKLINES */
--
- bool
- isc_crypto_fips_mode(void) {
- 	return EVP_default_properties_is_fips_enabled(NULL) != 0;
-@@ -424,9 +359,17 @@ isc_crypto_fips_enable(void) {
- 	return ISC_R_SUCCESS;
- }
- 
-+/*
-+ * OPENSSL_cleanup() in OpenSSL 4 doesn't free the memory, which is not
-+ * compatible with BIND 9's memory leak detection code, that is why the memory
-+ * tracking has been disabled in this module, and this function is a no-op.
-+ * This can be cleaned up once OpenSSL 1.1.x support is removed.
-+ *
-+ * See https://github.com/openssl/openssl/pull/29721
-+ */
- void
- isc__crypto_setdestroycheck(bool check) {
--	isc_mem_setdestroycheck(isc__crypto_mctx, check);
-+	UNUSED(check);
- }
- 
- void
-@@ -437,19 +380,6 @@ isc__crypto_initialize(void) {
- 	 */
- 	uint64_t opts = OPENSSL_INIT_LOAD_CONFIG | OPENSSL_INIT_NO_ATEXIT;
- 
--	isc_mem_create("OpenSSL", &isc__crypto_mctx);
--	isc_mem_setdebugging(isc__crypto_mctx, 0);
--	isc_mem_setdestroycheck(isc__crypto_mctx, false);
--
--	/*
--	 * CRYPTO_set_mem_(_ex)_functions() returns 1 on success or 0 on
--	 * failure, which means OpenSSL already allocated some memory.  There's
--	 * nothing we can do about it.
--	 */
--	(void)CRYPTO_set_mem_functions(isc__crypto_malloc_ex,
--				       isc__crypto_realloc_ex,
--				       isc__crypto_free_ex);
--
- 	RUNTIME_CHECK(OPENSSL_init_ssl(opts, NULL) == 1);
- 
- 	register_algorithms();
-@@ -486,6 +416,4 @@ isc__crypto_shutdown(void) {
- 	}
- 
- 	OPENSSL_cleanup();
--
--	isc_mem_detach(&isc__crypto_mctx);
- }
--- 
-2.54.0
-
diff --git a/bind-9.21-unittest-32b-mem.patch b/bind-9.21-unittest-32b-mem.patch
index ba968d8..90dee92 100644
--- a/bind-9.21-unittest-32b-mem.patch
+++ b/bind-9.21-unittest-32b-mem.patch
@@ -1,4 +1,4 @@
-From 0ec3954222bab0c7a74b379fc1982c55f89a90e4 Mon Sep 17 00:00:00 2001
+From e81b125a9c7eb9222b5f8298bec689e23287969b Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Thu, 9 Apr 2026 10:51:57 +0200
 Subject: [PATCH] Accept significantly lower memory consumption on 32b system
@@ -17,10 +17,10 @@ Signed-off-by: Petr Menšík <pemensik@redhat.com>
  1 file changed, 21 insertions(+), 6 deletions(-)
 
 diff --git a/tests/dns/deleg_test.c b/tests/dns/deleg_test.c
-index 904eaeef00..cc4772977f 100644
+index d3af6ab..cbab065 100644
 --- a/tests/dns/deleg_test.c
 +++ b/tests/dns/deleg_test.c
-@@ -567,6 +567,22 @@ typedef struct {
+@@ -579,6 +579,22 @@ typedef struct {
  	isc_stdtime_t now;
  } cleanup_ctx_t;
  
@@ -43,16 +43,16 @@ index 904eaeef00..cc4772977f 100644
  static void
  cleanuptests_phase3(void *arg) {
  	cleanup_ctx_t *ctx = arg;
-@@ -575,7 +591,7 @@ cleanuptests_phase3(void *arg) {
+@@ -587,7 +603,7 @@ cleanuptests_phase3(void *arg) {
  	dns_delegset_t *delegset = NULL;
  	isc_result_t result;
  
--	assert_int_in_range(isc_mem_inuse(db->mctx), 4000000, 4100000);
+-	assert_int_in_range(isc_mem_inuse(db->mctx), 8000000, 8100000);
 +	cleanuptests_memcheck1(db->mctx, 3);
  
  	/*
  	 * baz. is there, but bar. is gone, as it has been
-@@ -600,7 +616,7 @@ cleanuptests_phase2(void *arg) {
+@@ -612,7 +628,7 @@ cleanuptests_phase2(void *arg) {
  	dns_delegset_t *delegset = NULL;
  	isc_result_t result;
  
@@ -61,7 +61,7 @@ index 904eaeef00..cc4772977f 100644
  
  	/*
  	 * bar. is there
-@@ -620,7 +636,7 @@ cleanuptests_phase2(void *arg) {
+@@ -632,7 +648,7 @@ cleanuptests_phase2(void *arg) {
  	for (size_t i = 0; i < 99999; i++) {
  		addipdeleg(AF_INET6, "1111::2222", delegset, deleg);
  	}
@@ -70,7 +70,7 @@ index 904eaeef00..cc4772977f 100644
  	writedb(db, "baz.", 30, &delegset, true);
  	deleg = NULL;
  
-@@ -669,8 +685,7 @@ cleanuptests(ISC_ATTR_UNUSED void *arg) {
+@@ -681,8 +697,7 @@ cleanuptests(ISC_ATTR_UNUSED void *arg) {
  		addipdeleg(AF_INET6, "1111::2222", delegset, deleg);
  	}
  
@@ -80,7 +80,7 @@ index 904eaeef00..cc4772977f 100644
  	writedb(db, "stuff.", 10, &delegset, true);
  	deleg = NULL;
  	stdtime_now += 10;
-@@ -691,7 +706,7 @@ cleanuptests(ISC_ATTR_UNUSED void *arg) {
+@@ -703,7 +718,7 @@ cleanuptests(ISC_ATTR_UNUSED void *arg) {
  	 * with DB mem context) overmem conditions will be detected, and the
  	 * expired node will be removed
  	 */
@@ -90,5 +90,5 @@ index 904eaeef00..cc4772977f 100644
  	deleg = NULL;
  
 -- 
-2.53.0
+2.54.0
 
diff --git a/bind9-next.spec b/bind9-next.spec
index c7343da..2dc204d 100644
--- a/bind9-next.spec
+++ b/bind9-next.spec
@@ -54,7 +54,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind9-next
 License:  MPL-2.0 AND ISC AND BSD-3-clause AND MIT AND BSD-2-clause
 #
-Version:  9.21.21
+Version:  9.21.22
 Release:  %autorelease
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
@@ -90,8 +90,6 @@ Patch1: bind-9.16-redhat_doc.patch
 Patch4: bind-9.21-unittest-qpdb-i386.patch
 # https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/11825
 Patch5: bind-9.21-unittest-32b-mem.patch
-# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/11865
-Patch6: bind-9.21-openssl4-malloc.patch
 
 %{?systemd_ordering}
 Requires:       coreutils
diff --git a/sources b/sources
index 4641049..c97ab7f 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (bind-9.21.21.tar.xz) = ebb05d1141d38bd1897bb0de1475194ca6e9335e1a295ab388376d880de1a0569279b734433f469565eccdea91cc8e6e3603b2879be700bf27082ff075bdbe49
-SHA512 (bind-9.21.21.tar.xz.asc) = bad3fa0355742b57bc711c2f3f6bddd220bf5a5d4f5fa3b3ef9f2172247f184e637688080b0fc8cc67d37e1ee41bf484062f3a529d9942454b243a46091761b3
+SHA512 (bind-9.21.22.tar.xz) = f9e11d150162661c755dabdd7862c0565e6a10077e2a6aee04f8cefce94c262d8928ff9e42f8c8750242aee3b0992afe2f49f72f0f8cab8b7e4ae1c9fc06e0fa
+SHA512 (bind-9.21.22.tar.xz.asc) = 1e0bd14fad5754e12b6a4855dbed698dba74468790948316e17442e5bc840fc81d18e590fd78186a1e26e9526870b13470dcef6a15644e91775cc8883813ad24

From e6c0c1b6974349b4dd6f99d6f72c8df0659fb9b9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Wed, 3 Jun 2026 16:36:26 +0200
Subject: [PATCH 62/64] Switch downstream change to upstream for 32b mem check

Downstream fix was not working anymore and upstream fix is better.
---
 bind-9.21-unittest-32b-mem.patch | 114 ++++++++++++++++++-------------
 bind9-next.spec                  |   2 +-
 2 files changed, 67 insertions(+), 49 deletions(-)

diff --git a/bind-9.21-unittest-32b-mem.patch b/bind-9.21-unittest-32b-mem.patch
index 90dee92..ba4e0fd 100644
--- a/bind-9.21-unittest-32b-mem.patch
+++ b/bind-9.21-unittest-32b-mem.patch
@@ -1,91 +1,109 @@
-From e81b125a9c7eb9222b5f8298bec689e23287969b Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
-Date: Thu, 9 Apr 2026 10:51:57 +0200
-Subject: [PATCH] Accept significantly lower memory consumption on 32b system
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
+From 4623873e588c86c6add4d53708e754e2d6f3e087 Mon Sep 17 00:00:00 2001
+From: Michal Nowak <mnowak@isc.org>
+Date: Wed, 20 May 2026 08:59:49 +0000
+Subject: [PATCH] Make deleg cleanuptests memory assertions 32-bit-safe
 
-Memory usage might be significantly lower on legacy platforms. Allow
-testing of them and pass there. Move repeated checks to shared
-functions, include phase in minimal range to simplify identification of
-failed place.
+Each address entry stored by dns_delegset_addaddr() is an
+isc_netaddrlink_t, whose size depends on sizeof(void *) via the
+ISC_LINK macro (24 bytes of address + two prev/next pointers): 40
+bytes on 64-bit, 32 bytes on 32-bit. The hardcoded 4 MB / 8 MB
+ranges only held on 64-bit, so dns_deleg_cleanuptests failed on
+armv7l with isc_mem_inuse() returning ~3.2 MB.
 
-Signed-off-by: Petr Menšík <pemensik@redhat.com>
+Express the expected ranges in terms of sizeof(isc_netaddrlink_t)
+so they scale with pointer width, and pull the 99999 entry count
+out into a NENTRIES macro.
+
+Assisted-by: Claude:claude-opus-4-7
 ---
- tests/dns/deleg_test.c | 27 +++++++++++++++++++++------
- 1 file changed, 21 insertions(+), 6 deletions(-)
+ tests/dns/deleg_test.c | 30 ++++++++++++++++++++++--------
+ 1 file changed, 22 insertions(+), 8 deletions(-)
 
 diff --git a/tests/dns/deleg_test.c b/tests/dns/deleg_test.c
-index d3af6ab..cbab065 100644
+index d3af6aba966..9497caf2753 100644
 --- a/tests/dns/deleg_test.c
 +++ b/tests/dns/deleg_test.c
-@@ -579,6 +579,22 @@ typedef struct {
- 	isc_stdtime_t now;
- } cleanup_ctx_t;
+@@ -52,6 +52,15 @@ isc_stdtime_now(void) {
  
-+static void cleanuptests_memcheck1(isc_mem_t *mctx, unsigned int phase) {
-+	size_t inuse = isc_mem_inuse(mctx);
-+	if (sizeof(void *) == 4)
-+		assert_int_in_range(inuse, 3100000+phase, 3300000);
-+	else
-+		assert_int_in_range(inuse, 4000000+phase, 4100000);
-+}
-+
-+static void cleanuptests_memcheck2(isc_mem_t *mctx, unsigned int phase) {
-+	size_t inuse = isc_mem_inuse(mctx);
-+	if (sizeof(void *) == 4)
-+		assert_int_in_range(inuse, 6400000+phase, 6500000);
-+	else
-+		assert_int_in_range(inuse, 8000000+phase, 8100000);
-+}
+ #include <tests/isc.h>
+ 
++/*
++ * cleanuptests adds NENTRIES address entries to a delegset; each is an
++ * isc_netaddrlink_t whose size depends on sizeof(void *) via ISC_LINK.
++ * Express memory expectations in terms of that struct so the test works
++ * on both 32-bit and 64-bit targets.
++ */
++#define NENTRIES       99999
++#define ENTRIES_MEM(n) ((size_t)(n) * sizeof(isc_netaddrlink_t))
 +
  static void
- cleanuptests_phase3(void *arg) {
- 	cleanup_ctx_t *ctx = arg;
-@@ -587,7 +603,7 @@ cleanuptests_phase3(void *arg) {
+ shutdownloop(ISC_ATTR_UNUSED void *arg) {
+ 	isc_loopmgr_shutdown();
+@@ -587,7 +596,8 @@ cleanuptests_phase3(void *arg) {
  	dns_delegset_t *delegset = NULL;
  	isc_result_t result;
  
 -	assert_int_in_range(isc_mem_inuse(db->mctx), 8000000, 8100000);
-+	cleanuptests_memcheck1(db->mctx, 3);
++	assert_int_in_range(isc_mem_inuse(db->mctx), ENTRIES_MEM(2 * NENTRIES),
++			    ENTRIES_MEM(2 * NENTRIES) + 100000);
  
  	/*
  	 * baz. is there, but bar. is gone, as it has been
-@@ -612,7 +628,7 @@ cleanuptests_phase2(void *arg) {
+@@ -612,7 +622,8 @@ cleanuptests_phase2(void *arg) {
  	dns_delegset_t *delegset = NULL;
  	isc_result_t result;
  
 -	assert_int_in_range(isc_mem_inuse(db->mctx), 4000000, 4100000);
-+	cleanuptests_memcheck1(db->mctx, 2);
++	assert_int_in_range(isc_mem_inuse(db->mctx), ENTRIES_MEM(NENTRIES),
++			    ENTRIES_MEM(NENTRIES) + 100000);
  
  	/*
  	 * bar. is there
-@@ -632,7 +648,7 @@ cleanuptests_phase2(void *arg) {
- 	for (size_t i = 0; i < 99999; i++) {
+@@ -629,10 +640,11 @@ cleanuptests_phase2(void *arg) {
+ 	dns_delegset_allocdeleg(delegset, DNS_DELEGTYPE_DELEG_ADDRESSES,
+ 				&deleg);
+ 
+-	for (size_t i = 0; i < 99999; i++) {
++	for (size_t i = 0; i < NENTRIES; i++) {
  		addipdeleg(AF_INET6, "1111::2222", delegset, deleg);
  	}
 -	assert_int_in_range(isc_mem_inuse(db->mctx), 8000000, 8100000);
-+	cleanuptests_memcheck2(db->mctx, 2);
++	assert_int_in_range(isc_mem_inuse(db->mctx), ENTRIES_MEM(2 * NENTRIES),
++			    ENTRIES_MEM(2 * NENTRIES) + 100000);
  	writedb(db, "baz.", 30, &delegset, true);
  	deleg = NULL;
  
-@@ -681,8 +697,7 @@ cleanuptests(ISC_ATTR_UNUSED void *arg) {
+@@ -677,11 +689,12 @@ cleanuptests(ISC_ATTR_UNUSED void *arg) {
+ 
+ 	assert_int_in_range(isc_mem_inuse(db->mctx), 500, 2000);
+ 
+-	for (size_t i = 0; i < 99999; i++) {
++	for (size_t i = 0; i < NENTRIES; i++) {
  		addipdeleg(AF_INET6, "1111::2222", delegset, deleg);
  	}
  
 -	assert_int_in_range(isc_mem_inuse(db->mctx), 4000000, 4100000);
--
-+	cleanuptests_memcheck1(db->mctx, 1);
++	assert_int_in_range(isc_mem_inuse(db->mctx), ENTRIES_MEM(NENTRIES),
++			    ENTRIES_MEM(NENTRIES) + 100000);
+ 
  	writedb(db, "stuff.", 10, &delegset, true);
  	deleg = NULL;
- 	stdtime_now += 10;
-@@ -703,7 +718,7 @@ cleanuptests(ISC_ATTR_UNUSED void *arg) {
+@@ -694,7 +707,7 @@ cleanuptests(ISC_ATTR_UNUSED void *arg) {
+ 	dns_delegset_allocdeleg(delegset, DNS_DELEGTYPE_DELEG_ADDRESSES,
+ 				&deleg);
+ 
+-	for (size_t i = 0; i < 99999; i++) {
++	for (size_t i = 0; i < NENTRIES; i++) {
+ 		addipdeleg(AF_INET6, "1111::2222", delegset, deleg);
+ 	}
+ 
+@@ -703,7 +716,8 @@ cleanuptests(ISC_ATTR_UNUSED void *arg) {
  	 * with DB mem context) overmem conditions will be detected, and the
  	 * expired node will be removed
  	 */
 -	assert_int_in_range(isc_mem_inuse(db->mctx), 8000000, 8100000);
-+	cleanuptests_memcheck2(db->mctx, 1);
++	assert_int_in_range(isc_mem_inuse(db->mctx), ENTRIES_MEM(2 * NENTRIES),
++			    ENTRIES_MEM(2 * NENTRIES) + 100000);
  	writedb(db, "bar.", 30, &delegset, true);
  	deleg = NULL;
  
diff --git a/bind9-next.spec b/bind9-next.spec
index 2dc204d..4939fa1 100644
--- a/bind9-next.spec
+++ b/bind9-next.spec
@@ -88,7 +88,7 @@ Patch1: bind-9.16-redhat_doc.patch
 # https://gitlab.isc.org/isc-projects/bind9/-/issues/5328
 # avoid often fails on i386, unsupported upstream
 Patch4: bind-9.21-unittest-qpdb-i386.patch
-# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/11825
+# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/12061
 Patch5: bind-9.21-unittest-32b-mem.patch
 
 %{?systemd_ordering}

From dd3ddef0d0c5480d099f3f47d6d92140406a7b23 Mon Sep 17 00:00:00 2001
From: Yaakov Selkowitz <yselkowi@redhat.com>
Date: Fri, 12 Jun 2026 18:19:38 -0400
Subject: [PATCH 63/64] Rebuilt for openssl 4.0


From d3d83b7ded86392d3de557a0dd090868f4523e67 Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Wed, 15 Jul 2026 20:11:31 +0000
Subject: [PATCH 64/64] Rebuilt for
 https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild