Include changelog in the new format

CHANGES did not contain anything useful recently. Skip bigger
changelog-history in normal package. Include also history in doc
package.

Include original release notes in rst format inside doc package. That
format is nice to use from terminal interface, especially when syntax is
highlighted by vim for example.

.gitignore

@@ -222,3 +222,11 @@ bind-9.7.2b1.tar.gz
 /bind-9.19.21.tar.xz.asc
 /bind-9.19.22.tar.xz
 /bind-9.19.22.tar.xz.asc
+/bind-9.19.24.tar.xz
+/bind-9.19.24.tar.xz.asc
+/bind-9.21.0.tar.xz
+/bind-9.21.0.tar.xz.asc
+/bind-9.21.2.tar.xz
+/bind-9.21.2.tar.xz.asc
+/bind-9.21.3.tar.xz
+/bind-9.21.3.tar.xz.asc

bind-9.21-unittest-isc_rwlock-s390x.patch

@@ -0,0 +1,29 @@
+From b8bc86834311e4ea27fe75052db08279045f027b Mon Sep 17 00:00:00 2001
+From: Petr Mensik <pemensik@redhat.com>
+Date: Wed, 20 Nov 2024 15:34:29 +0100
+Subject: [PATCH] Skip isc_rwlock_benchmark on s390x
+
+Not sure why, but it repeatedly failed on isc_rwlock_benchmark function.
+Not sure if it requires more time only or there is some strange error.
+---
+ tests/isc/rwlock_test.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/tests/isc/rwlock_test.c b/tests/isc/rwlock_test.c
+index 4c5b8e0..a28b7d9 100644
+--- a/tests/isc/rwlock_test.c
++++ b/tests/isc/rwlock_test.c
+@@ -340,7 +340,10 @@ ISC_TEST_ENTRY_CUSTOM(isc_rwlock_wrlock, rwlock_setup, rwlock_teardown)
+ #if !defined(__SANITIZE_THREAD__)
+ ISC_TEST_ENTRY_CUSTOM(isc_rwlock_tryupgrade, rwlock_setup, rwlock_teardown)
+ ISC_TEST_ENTRY_CUSTOM(isc_rwlock_trylock, rwlock_setup, rwlock_teardown)
++#ifndef __s390x__
++// TODO: find why this stucks.
+ ISC_TEST_ENTRY_CUSTOM(isc_rwlock_benchmark, rwlock_setup, rwlock_teardown)
++#endif
+ #endif /* __SANITIZE_THREAD__ */
+ 
+ ISC_TEST_LIST_END
+-- 
+2.47.0
+

bind9-next.spec

@@ -10,7 +10,6 @@
 %bcond_without SUDO
 %bcond_without GSSTSIG
 %bcond_without JSON
-%bcond_without DLZ
 # New MaxMind GeoLite support
 %bcond_without GEOIP2
 # Disabled temporarily until kyua is fixed on rawhide, bug #1926779
@@ -22,6 +21,7 @@
 %bcond_without DOC
 %bcond_with    TSAN
 %bcond_without DTRACE
+%bcond_with    OPENSSL_ENGINE
 
 %{?!bind_uid:  %global bind_uid  25}
 %{?!bind_gid:  %global bind_gid  25}
@@ -39,6 +39,9 @@
 # Visit https://bugzilla.redhat.com/show_bug.cgi?id=1540300
 %undefine _strict_symbol_defs_build
 
+# BIND9 does not work with fortify 3 level, make builds work on Fedora
+%global _fortify_level 2
+
 # Upstream package name
 %global upname bind
 # Provide only bind-utils on f37+, it has better behaviour
@@ -52,7 +55,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind9-next
 License:  MPL-2.0 AND ISC AND BSD-3-clause AND Expat AND BSD-2-clause
 #
-Version:  9.19.22
+Version:  9.21.3
 Release:  %autorelease
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
@@ -88,6 +91,8 @@ Source49: named-chroot.files
 # Common patches
 # Red Hat specific documentation is not relevant to upstream
 Patch1: bind-9.16-redhat_doc.patch
+# Downstream only. TODO: find a cause and remove this workaround
+Patch3: bind-9.21-unittest-isc_rwlock-s390x.patch
 
 %{?systemd_ordering}
 Requires:       coreutils
@@ -109,13 +114,15 @@ BuildRequires:  selinux-policy
 BuildRequires:  findutils sed
 BuildRequires:  libnghttp2-devel
 BuildRequires:  userspace-rcu-devel
+# Compress the changelog
+BuildRequires:  gzip
 %if 0%{?fedora}
 BuildRequires:  jemalloc-devel
 BuildRequires:  gnupg2
 %endif
 BuildRequires:  libuv-devel
-%if %{with DLZ}
-BuildRequires:  openldap-devel, libpq-devel, sqlite-devel, mariadb-connector-c-devel
+%if %{with OPENSSL_ENGINE}
+BuildRequires:  openssl-devel-engine
 %endif
 %if %{with UNITTEST}
 # make unit dependencies
@@ -266,39 +273,6 @@ chroot(2) jail for the named(8) program from the BIND package.
 Based on the code from Jan "Yenya" Kasprzak <kas@fi.muni.cz>
 
 
-%if %{with DLZ}
-%package dlz-filesystem
-Summary: BIND server filesystem DLZ module
-Requires: %{name}%{?_isa} = %{epoch}:%{version}-%{release}
-
-%description dlz-filesystem
-Dynamic Loadable Zones filesystem module for BIND server.
-
-%package dlz-ldap
-Summary: BIND server ldap DLZ module
-Requires: %{name}%{?_isa} = %{epoch}:%{version}-%{release}
-
-%description dlz-ldap
-Dynamic Loadable Zones LDAP module for BIND server.
-
-%package dlz-mysql
-Summary: BIND server mysql and mysqldyn DLZ modules
-Requires: %{name}%{?_isa} = %{epoch}:%{version}-%{release}
-Provides: %{name}-dlz-mysqldyn = %{epoch}:%{version}-%{release}
-Obsoletes: %{name}-dlz-mysqldyn < 32:9.16.6-3
-
-%description dlz-mysql
-Dynamic Loadable Zones MySQL module for BIND server.
-Contains also mysqldyn module with dynamic DNS updates (DDNS) support.
-
-%package dlz-sqlite3
-Summary: BIND server sqlite3 DLZ module
-Requires: %{name}%{?_isa} = %{epoch}:%{version}-%{release}
-
-%description dlz-sqlite3
-Dynamic Loadable Zones sqlite3 module for BIND server.
-%endif
-
 %if %{with DOC}
 %package doc
 Summary:   BIND 9 Administrator Reference Manual
@@ -354,8 +328,11 @@ done
 %define systemtest_prepare_build() \
   cp -Tuav bin/tests "%{1}/bin/tests/" \
 
-CFLAGS="$CFLAGS $RPM_OPT_FLAGS"
+%if %{with OPENSSL_ENGINE}
 CPPFLAGS="$CPPFLAGS -DOPENSSL_API_COMPAT=10100"
+%else
+CPPFLAGS="$CPPFLAGS -DOPENSSL_NO_ENGINE=1"
+%endif
 %if %{with TSAN}
   CFLAGS+=" -O1 -fsanitize=thread -fPIE -pie"
 %endif
@@ -375,12 +352,6 @@ autoreconf --force --install
 
 mkdir build
 
-%if %{with DLZ}
-# DLZ modules do not support oot builds. Copy files into build
-mkdir -p build/contrib/dlz
-cp -frp contrib/dlz/modules build/contrib/dlz/modules
-%endif
-
 pushd build
 LIBDIR_SUFFIX=
 export LIBDIR_SUFFIX
@@ -424,15 +395,11 @@ export LIBDIR_SUFFIX
   %make_build doc SPHINX_W=''
 %endif
 
-%if %{with DLZ}
-  pushd contrib/dlz/modules
-  for DIR in filesystem ldap mysql mysqldyn sqlite3; do
-    %make_build -C $DIR CFLAGS="-fPIC -I../include $CFLAGS $LDFLAGS -DPTHREADS=1" LDFLAGS="$LDFLAGS"
-  done
-  popd
-%endif
 popd # build
 
+# Compress changelog by default
+gzip doc/changelog/changelog-*.rst
+
 %unit_prepare_build build
 %systemtest_prepare_build build
 
@@ -566,23 +533,6 @@ install -pm 644 %{SOURCE49} ${RPM_BUILD_ROOT}%{_sysconfdir}/named-chroot.files
   ln -s ../bin/{named-checkconf,named-checkzone,named-compilezone} %{buildroot}%{_sbindir}/
 %endif
 
-%if %{with DLZ}
-  pushd build
-  pushd contrib/dlz/modules
-  for DIR in filesystem ldap mysql mysqldyn sqlite3; do
-    %make_install -C $DIR libdir=%{_libdir}/bind
-  done
-  pushd ${RPM_BUILD_ROOT}/%{_libdir}/named
-    cp -s ../bind/dlz_*.so .
-  popd
-  mkdir -p doc/{mysql,mysqldyn}
-  cp -p mysqldyn/testing/README doc/mysqldyn/README.testing
-  cp -p mysqldyn/testing/* doc/mysqldyn
-  cp -p mysql/testing/* doc/mysql
-  popd
-  popd
-%endif
-
 # Remove libtool .la files:
 find ${RPM_BUILD_ROOT}/%{_libdir} -name '*.la' -exec '/bin/rm' '-f' '{}' ';';
 
@@ -614,7 +564,7 @@ do
   BINDTHEMEDIR="${RPM_BUILD_ROOT}%{_pkgdocdir}/html/_static/$BASE"
   if [ -d "$BINDTHEMEDIR" ]; then
     rm -rf "$BINDTHEMEDIR"
-    ln -s "$DIR" "$BINDTHEMEDIR"
+    ln -sr "${RPM_BUILD_ROOT}${DIR}" "$BINDTHEMEDIR"
   fi
 done
 cp -p build/doc/arm/_build/epub/Bv9ARM.epub ${RPM_BUILD_ROOT}%{_pkgdocdir}
@@ -785,7 +735,8 @@ fi;
 %{_mandir}/man8/rndc-confgen.8*
 %{_mandir}/man1/named-journalprint.1*
 %{_mandir}/man8/filter-*.8.gz
-%doc CHANGES README.md named.conf.default
+%doc README.md named.conf.default
+%doc doc/changelog/changelog-9.*.rst*
 %doc sample/
 
 # Hide configuration
@@ -919,32 +870,14 @@ fi;
 %dir %{chroot_prefix}/run/named
 %{chroot_prefix}%{_localstatedir}/run
 
-%if %{with DLZ}
-%files dlz-filesystem
-%{_libdir}/{named,bind}/dlz_filesystem_dynamic.so
-
-%files dlz-mysql
-%{_libdir}/{named,bind}/dlz_mysql_dynamic.so
-%doc build/contrib/dlz/modules/doc/mysql
-%{_libdir}/{named,bind}/dlz_mysqldyn_mod.so
-%doc build/contrib/dlz/modules/doc/mysqldyn
-
-%files dlz-ldap
-%{_libdir}/{named,bind}/dlz_ldap_dynamic.so
-%doc contrib/dlz/modules/ldap/testing/*
-
-%files dlz-sqlite3
-%{_libdir}/{named,bind}/dlz_sqlite3_dynamic.so
-%doc contrib/dlz/modules/sqlite3/testing/*
-
-%endif
-
 %if %{with DOC}
 %files doc
 %dir %{_pkgdocdir}
 %doc %{_pkgdocdir}/html
 %doc %{_pkgdocdir}/Bv9ARM.html
 %doc %{_pkgdocdir}/Bv9ARM.epub
+%doc doc/changelog/changelog-history.rst*
+%doc doc/notes/notes-*.rst*
 %endif
 
 %changelog

named-chroot.service

@@ -25,6 +25,7 @@ ExecReload=/bin/sh -c 'if /usr/sbin/rndc null > /dev/null 2>&1; then /usr/sbin/r
 ExecStop=/bin/sh -c '/usr/sbin/rndc stop > /dev/null 2>&1 || /bin/kill -TERM $MAINPID'
 
 PrivateTmp=false
+Restart=on-abnormal
 
 [Install]
 WantedBy=multi-user.target

named.root.key

@@ -10,4 +10,9 @@ trust-anchors {
         # managed key database will be trusted and maintained
         # automatically.
         . initial-ds 20326 8 2 "E06D44B80B8F1D39A95C0B0D7C65D08458E880409BBC683457104237C7F8EC8D";
+        # This key (38696) will be pre-published in the root zone in 2025
+        # and is scheduled to begin signing in late 2026. At that time,
+        # servers which were already using the old key (20326) should roll
+        # seamlessly to this new one via RFC 5011 rollover.
+        . initial-ds 38696 8 2 "683D2D0ACB8C9B712A1948B27F741219298D0A450D612C483AF444A4C0FB2B16";
 };

named.service

@@ -20,6 +20,7 @@ ExecReload=/bin/sh -c 'if /usr/sbin/rndc null > /dev/null 2>&1; then /usr/sbin/r
 ExecStop=/bin/sh -c '/usr/sbin/rndc stop > /dev/null 2>&1 || /bin/kill -TERM $MAINPID'
 
 PrivateTmp=true
+Restart=on-abnormal
 
 [Install]
 WantedBy=multi-user.target

sources

@@ -1,2 +1,2 @@
-SHA512 (bind-9.19.22.tar.xz) = 609f73ab7e34e9ef0e5854a0bf150009c1ae34615c5f8c7fecf0352ea65ce0d92fecc02b918a0b3b90b3c303dad659e4981a97b1413d02724b20a5ed2d1d905f
-SHA512 (bind-9.19.22.tar.xz.asc) = 4839365da593ab6b924372019bbb8b8212856116c563e4f9b6d0b03681234fb855b7f3c85766919fac400be7508f7b72bc9d2a3d8496ce9ee21c6b5fb4369cf3
+SHA512 (bind-9.21.3.tar.xz) = cc00929f0a3923bb7486cffe6791f6a25a98e58cf2ade4bbd99d8df61380113b5e3286d82c48bed4c9af00a9affba337e16963060847a03859b89e2ce12c85ce
+SHA512 (bind-9.21.3.tar.xz.asc) = e76e4158c3d269c1bbf6890a8d4cc6c78d0282e612324354e8f04b7099eb2704707cbaaf7e522b1fbea08f839bafdd4998da4d479c6f76d02df066fc83860fb7

trusted-key.key

@@ -1 +1,2 @@
 . 3600 IN DNSKEY 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU=
+. 3600 IN DNSKEY 257 3 8 AwEAAa96jeuknZlaeSrvyAJj6ZHv28hhOKkx3rLGXVaC6rXTsDc449/cidltpkyGwCJNnOAlFNKF2jBosZBU5eeHspaQWOmOElZsjICMQMC3aeHbGiShvZsx4wMYSjH8e7Vrhbu6irwCzVBApESjbUdpWWmEnhathWu1jo+siFUiRAAxm9qyJNg/wOZqqzL/dL/q8PkcRU5oUKEpUge71M3ej2/7CPqpdVwuMoTvoB+ZOT4YeGyxMvHmbrxlFzGOHOijtzN+u1TQNatX2XBuzZNQ1K+s2CXkPIZo7s6JgZyvaBevYtxPvYLw4z9mR7K2vaF18UYH9Z9GNUUeayffKC73PYc=