Update to 9.21.20 (rhbz#2440560)

Security Fixes: - Fix unbounded NSEC3 iterations when validating referrals to unsigned delegations. (CVE-2026-1519) - Fix memory leaks in code preparing DNSSEC proofs of non-existence. (CVE-2026-3104) - Prevent a crash in code processing queries containing a TKEY record. (CVE-2026-3119) - Fix a stack use-after-return flaw in SIG(0) handling code. (CVE-2026-3591) New Features: - Provide response round-trip time (RTT) counters via statistics channel. - Introduce max-delegation-servers configuration option. Bug Fixes: - Fix parsing key inactivation time in KASP code. - Fix the handling of key statements defined inside views. Source: https://downloads.isc.org/isc/bind9/9.21.20/doc/arm/html/notes.html#notes-for-bind-9-21-20
Remove separate license subpackage
2026-03-25 20:07:44 +01:00 · 2026-01-22 16:48:07 +01:00 · 2026-01-22 16:23:58 +01:00 · 2026-01-22 16:22:35 +01:00 · 2026-01-22 16:22:35 +01:00 · 2026-01-22 16:22:35 +01:00
12 changed files with 310 additions and 251 deletions
--- a/README.md
+++ b/README.md
@ -26,13 +26,9 @@ The package contains several subpackages, some of them can be disabled on rebuil
 * **bind9-next** -- *named* daemon providing DNS server
 * **bind9-next-utils** -- set of tools to analyse DNS responses or update entries (dig, host)
 * **bind9-next-doc** -- documentation for current bind, *BIND 9 Administrator Reference Manual*.
-* **bind9-next-license** -- Shared license for all packages but bind-export-libs.
 * **bind9-next-libs** -- Shared libraries used by some others programs
-* **bind9-next-devel** -- Development headers for libs. Can be disabled by `--without DEVEL`
-

 ## Optional features

 * *GSSTSIG* -- Support for Kerberos authentication in BIND.
 * *LMDB* -- Support for dynamic database for managing runtime added zones. Provides faster removal of added zone with much less overhead. But requires lmdb linked to base libs.
-* *DLZ* -- Support for dynamic loaded modules providing support for features *bind-sdb* provides, but only small module is required.
--- a/bind-9.21-dual-sign-continue-test.patch
+++ b/bind-9.21-dual-sign-continue-test.patch
@ -0,0 +1,115 @@
+From 488d7bfc75f2988c6e461b8677bc0e27e58bd82e Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
+Date: Sat, 1 Nov 2025 12:00:59 +0100
+Subject: [PATCH] Add a system test with one good and one bad algorithm
+
+The case where there would be one supported algorithm and one already
+unsupported (like RSAMD5 or RSASHA1) was missing.
+---
+ bin/tests/system/dnssec/ns2/example.db.in   |  4 +++
+ bin/tests/system/dnssec/ns2/sign.sh         |  2 +-
+ bin/tests/system/dnssec/ns3/named.conf.j2   |  6 ++++
+ bin/tests/system/dnssec/ns3/sign.sh         | 31 +++++++++++++++++++++
+ bin/tests/system/dnssec/tests_validation.py |  8 ++++++
+ 5 files changed, 50 insertions(+), 1 deletion(-)
+
+diff --git a/bin/tests/system/dnssec/ns2/example.db.in b/bin/tests/system/dnssec/ns2/example.db.in
+index 47c2eb7f0e..07429366ee 100644
+--- a/bin/tests/system/dnssec/ns2/example.db.in
+++ b/bin/tests/system/dnssec/ns2/example.db.in
+@@ -202,3 +202,7 @@ ns3.extradsunknownoid	A	10.53.0.3
+ 
+ extended-ds-unknown-oid	NS	ns3.extended-ds-unknown-oid
+ ns3.extended-ds-unknown-oid A	10.53.0.3
+
+; A secure subdomain with extra bad key
+extrabadkey		NS	ns3.extrabadkey
+ns3.extrabadkey		A	10.53.0.3
+diff --git a/bin/tests/system/dnssec/ns2/sign.sh b/bin/tests/system/dnssec/ns2/sign.sh
+index e3f18af15e..da9f5f07fc 100644
+--- a/bin/tests/system/dnssec/ns2/sign.sh
+++ b/bin/tests/system/dnssec/ns2/sign.sh
+@@ -92,7 +92,7 @@ for subdomain in digest-alg-unsupported ds-unsupported secure badds \
+   dnskey-nsec3-unknown managed-future future revkey \
+   dname-at-apex-nsec3 occluded rsasha1 rsasha1-1024 \
+   rsasha256oid rsasha512oid unknownoid extradsoid extradsunknownoid \
+-  extended-ds-unknown-oid; do
+  extended-ds-unknown-oid extrabadkey; do
+   cp "../ns3/dsset-$subdomain.example." .
+ done
+ 
+diff --git a/bin/tests/system/dnssec/ns3/named.conf.j2 b/bin/tests/system/dnssec/ns3/named.conf.j2
+index 1a0edc14bb..9cbc58892c 100644
+--- a/bin/tests/system/dnssec/ns3/named.conf.j2
+++ b/bin/tests/system/dnssec/ns3/named.conf.j2
+@@ -141,6 +141,12 @@ zone "extrakey.example" {
+ 	allow-update { any; };
+ };
+ 
+zone "extrabadkey.example" {
+	type primary;
+	file "extrabadkey.example.db.signed";
+	allow-update { any; };
+};
+
+ zone "insecure.nsec3.example" {
+ 	type primary;
+ 	file "insecure.nsec3.example.db";
+diff --git a/bin/tests/system/dnssec/ns3/sign.sh b/bin/tests/system/dnssec/ns3/sign.sh
+index 5512888b2f..ea81381eb2 100644
+--- a/bin/tests/system/dnssec/ns3/sign.sh
+++ b/bin/tests/system/dnssec/ns3/sign.sh
+@@ -905,3 +905,34 @@ ksk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK "$zone")
+ zsk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
+ cat "$infile" "$ksk.key" "$zsk.key" >"$zonefile"
+ "$SIGNER" -g -o "$zone" "$zonefile" >/dev/null 2>&1
+
+#
+#
+#
+zone=extrabadkey.example.
+infile=template.db.in
+zonefile=extrabadkey.example.db
+
+# Add KSK and ZSK that we will mangle to RSAMD5
+ksk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK "$zone")
+zsk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
+cat "$infile" "$ksk.key" "$zsk.key" >"$zonefile"
+"$SIGNER" -g -O full -o "$zone" "$zonefile" >/dev/null 2>&1
+
+# Mangle the signatures to RSAMD5 and save them for future use
+sed -ne "s/\(IN[[:space:]]*RRSIG[[:space:]]*[A-Z]*\) $DEFAULT_ALGORITHM_NUMBER /\1 1 /p" <"$zonefile.signed" >"$zonefile.signed.rsamd5"
+
+# Now add normal KSK and ZSK to the zone file
+ksk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK "$zone")
+zsk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
+cat "$infile" "$ksk.key" "$zsk.key" >"$zonefile"
+
+# Mangle the DNSKEY algorithm numbers and add them to the signed zone file
+cat "$ksk.key" "$zsk.key" | sed -e "s/\(IN[[:space:]]*DNSKEY[[:space:]]*[0-9]* 3\) $DEFAULT_ALGORITHM_NUMBER /\1 1 /" >>"$zonefile"
+
+# Sign normally
+"$SIGNER" -g -o "$zone" "$zonefile" >/dev/null 2>&1
+
+# Add the mangled signatures to signed zone file
+cat "$zonefile.signed.rsamd5" >>"$zonefile.signed"
+rm "$zonefile.signed.rsamd5"
+diff --git a/bin/tests/system/dnssec/tests_validation.py b/bin/tests/system/dnssec/tests_validation.py
+index e6d8ccc734..a27a899987 100644
+--- a/bin/tests/system/dnssec/tests_validation.py
+++ b/bin/tests/system/dnssec/tests_validation.py
+@@ -1385,3 +1385,11 @@ def test_rrsigs_for_glue():
+         record.rdtype == rdatatype.RRSIG and record.covers == rdatatype.A
+         for record in res.answer
+     )
+
+
+def test_extra_bad_algorithm():
+    msg = isctest.query.create("a.extrabadkey.example", "A")
+    res1 = isctest.query.tcp(msg, "10.53.0.3")
+    res2 = isctest.query.tcp(msg, "10.53.0.4")
+    isctest.check.same_answer(res1, res2)
+    isctest.check.adflag(res2)
+-- 
+2.51.1
+
--- a/bind-9.21-dual-sign-continue.patch
+++ b/bind-9.21-dual-sign-continue.patch
@ -0,0 +1,42 @@
+From a94a7c1a1e6eecbead995a08bace33d23899a5da Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
+Date: Tue, 4 Nov 2025 02:09:38 +0100
+Subject: [PATCH] Skip unsupported algorithms when looking for signing key
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+When looking for a signing key in select_signing_key(), the result code
+indicating unsupported algorithm would abort the search.  Instead, skip
+such keys and continue searching for the right key.
+
+Co-Authored-By: Aram Sargsyan <aram@isc.org>
+Co-Authored-By: Petr Menšík <pemensik@redhat.com>
+---
+ lib/dns/validator.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/lib/dns/validator.c b/lib/dns/validator.c
+index c6781544b9..52677fbd80 100644
+--- a/lib/dns/validator.c
+++ b/lib/dns/validator.c
+@@ -1092,8 +1092,14 @@ select_signing_key(dns_validator_t *val, dns_rdataset_t *rdataset) {
+ 			continue;
+ 		}
+ 
+-		return dns_dnssec_keyfromrdata(&siginfo->signer, &rdata,
+-					       val->view->mctx, &val->key);
+		result = dns_dnssec_keyfromrdata(&siginfo->signer, &rdata,
+						 val->view->mctx, &val->key);
+		/* Don't count unsupported algorithm towards max fails */
+		if (result == DST_R_UNSUPPORTEDALG) {
+			/* Continue with the next key */
+			continue;
+		}
+		return result;
+ 	}
+ 
+ 	return ISC_R_NOTFOUND;
+-- 
+2.51.1
+
--- a/bind-9.21-unittest-qpdb-i386.patch
+++ b/bind-9.21-unittest-qpdb-i386.patch
@ -1,15 +1,15 @@
-From 574db9dac1c4bd6b19da887a58da1126e336b9e5 Mon Sep 17 00:00:00 2001
+From af1e4bf375000fc532c55ff6df841661185a2451 Mon Sep 17 00:00:00 2001
 From: Petr Mensik <pemensik@redhat.com>
 Date: Wed, 28 May 2025 19:40:05 +0200
 Subject: [PATCH] Try rcu_barrier

 https://gitlab.isc.org/isc-projects/bind9/-/issues/5328
 ---
- tests/dns/qpdb_test.c | 5 +++++
- 1 file changed, 5 insertions(+)
+ tests/dns/qpdb_test.c | 3 +++
+ 1 file changed, 3 insertions(+)

 diff --git a/tests/dns/qpdb_test.c b/tests/dns/qpdb_test.c
-index 4b1de18..a11af52 100644
+index 1c840e2..b6ad0f4 100644
 --- a/tests/dns/qpdb_test.c
 +++ b/tests/dns/qpdb_test.c
@@ -24,6 +24,7 @@
@ -20,24 +20,22 @@ index 4b1de18..a11af52 100644
 #include <isc/util.h>
 
 #include <dns/lib.h>
-@@ -170,6 +171,8 @@ ISC_LOOP_TEST_IMPL(overmempurge_bigrdata) {
+@@ -170,6 +171,7 @@ ISC_LOOP_TEST_IMPL(overmempurge_bigrdata) {
 
 	dns_db_detach(&db);
- 	isc_mem_detach(&mctx2);
-+
+ 	isc_mem_detach(&mctx);
 +	rcu_barrier();
- 	isc_loopmgr_shutdown(loopmgr);
+ 	isc_loopmgr_shutdown();
 }
 
-@@ -221,6 +224,8 @@ ISC_LOOP_TEST_IMPL(overmempurge_longname) {
+@@ -221,6 +223,7 @@ ISC_LOOP_TEST_IMPL(overmempurge_longname) {
 
 	dns_db_detach(&db);
- 	isc_mem_detach(&mctx2);
-+
+ 	isc_mem_detach(&mctx);
 +	rcu_barrier();
- 	isc_loopmgr_shutdown(loopmgr);
+ 	isc_loopmgr_shutdown();
 }
 
 -- 
-2.49.0
+2.51.0

--- a/bind9-next.spec
+++ b/bind9-next.spec
@ -22,6 +22,7 @@
 %bcond_with    TSAN
 %bcond_without DTRACE
 %bcond_with    OPENSSL_ENGINE
+%bcond         JEMALLOC  0%{?fedora}

 %{?!bind_uid:  %global bind_uid  25}
 %{?!bind_gid:  %global bind_gid  25}
@ -30,7 +31,9 @@
 %global        chroot_prefix     %{bind_dir}/chroot
 %global        chroot_create_directories /dev /run/named %{_localstatedir}/{log,named,tmp} \\\
                                         %{_sysconfdir}/{crypto-policies/back-ends,pki/dnssec-keys,pki/tls,named} \\\
-                                         %{_libdir}/bind %{_libdir}/named %{_datadir}/GeoIP /proc/sys/net/ipv4
+                                         %{_libdir}/bind %{_libdir}/named %{_datadir}/{GeoIP,dns-root-data} /proc/sys/net/ipv4
+%global        upstream_sources 0 2
+%global        pgp_signed_sources 2

 %global forgeurl0 https://gitlab.isc.org/isc-projects/bind9

@ -53,9 +56,9 @@ Conflicts: %1 \

 Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
 Name:     bind9-next
-License:  MPL-2.0 AND ISC AND BSD-3-clause AND Expat AND BSD-2-clause
+License:  MPL-2.0 AND ISC AND BSD-3-clause AND MIT AND BSD-2-clause
 #
-Version:  9.21.8
+Version:  9.21.20
 Release:  %autorelease
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
@ -67,17 +70,13 @@ Source2:  https://downloads.isc.org/isc/bind9/%{version}/%{upname}-%{version}.ta
 Source3:  named.logrotate
 Source4:  https://www.isc.org/docs/isc-keyblock.asc
 Source16: named.conf
-# Refresh by command: dig @a.root-servers.net. +tcp +norec
-# or from URL
-Source17: https://www.internic.net/domain/named.root
 Source18: named.localhost
 Source19: named.loopback
 Source20: named.empty
 Source23: named.rfc1912.zones
 Source25: named.conf.sample
-Source27: named.root.key
+Source27: named-mkroot.sh
 Source35: bind.tmpfiles.d
-Source36: trusted-key.key
 Source37: named.service
 Source38: named-chroot.service
 Source41: setup-named-chroot.sh
@ -102,25 +101,38 @@ Requires:       coreutils
 Requires(post): shadow-utils
 Requires(post): glibc-common
 Requires(post): grep
+Requires:       dns-root-data
 Requires:       %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release}
 Recommends:     %{name}-utils %{name}-dnssec-utils
 %upname_compat %{upname}
 Obsoletes:      %{name}-pkcs11 < 32:9.18.4-2
 Conflicts:      bind-dyndb-ldap

-BuildRequires:  gcc, make
-BuildRequires:  openssl-devel, libtool, autoconf, pkgconfig, libcap-devel
-BuildRequires:  libidn2-devel, libxml2-devel
+BuildRequires:  gcc
+BuildRequires:  make
+BuildRequires:  openssl-devel
+BuildRequires:  libtool
+BuildRequires:  meson
+BuildRequires:  ninja-build
+BuildRequires:  pkgconfig
+BuildRequires:  libcap-devel
+BuildRequires:  libidn2-devel
+BuildRequires:  libxml2-devel
 BuildRequires:  systemd-rpm-macros
 BuildRequires:  selinux-policy
-BuildRequires:  findutils sed
+BuildRequires:  findutils
+BuildRequires:  sed
 BuildRequires:  libnghttp2-devel
 BuildRequires:  userspace-rcu-devel
+BuildRequires:  pkgconfig(libedit)
+BuildRequires:  dns-root-data
 # Compress the changelog
 BuildRequires:  gzip
-%if 0%{?fedora}
+%if %{with JEMALLOC}
 BuildRequires:  jemalloc-devel
-BuildRequires:  gnupg2
+%endif
+%if ! 0%{?rhel}
+BuildRequires:  gpgverify
 %endif
 BuildRequires:  libuv-devel
 %if %{with OPENSSL_ENGINE}
@ -143,6 +155,8 @@ BuildRequires:  softhsm
 BuildRequires:  perl(Net::DNS) perl(Net::DNS::Nameserver) perl(Time::HiRes) perl(Getopt::Long)
 BuildRequires:  perl(English)
 BuildRequires:  python3-pytest
+BuildRequires:  python3-pytest-xdist
+BuildRequires:  python3-dns
 # manual configuration requires this tool
 BuildRequires:  iproute
 BuildRequires:  python3-jinja2
@ -175,7 +189,9 @@ BuildRequires: libtsan
 %endif
 %if %{with DTRACE}
 # https://gitlab.isc.org/isc-projects/bind9/-/issues/4041
-BuildRequires: systemtap-sdt-devel
+BuildRequires:  systemtap
+BuildRequires:  systemtap-sdt-devel
+BuildRequires:  systemtap-sdt-dtrace
 %endif

 %description
@ -187,7 +203,8 @@ tools for verifying that the DNS server is operating properly.

 %package libs
 Summary: Libraries used by the BIND DNS packages
-Requires: %{name}-license = %{epoch}:%{version}-%{release}
+Provides: %{name}-license = %{epoch}:%{version}-%{release}
+Obsoletes: %{name}-license < 32:9.21.17-1
 Provides: %{name}-libs-lite = %{epoch}:%{version}-%{release}
 Obsoletes: %{name}-libs-lite < 32:9.16.13
 Obsoletes: %{name}-pkcs11-libs < 32:9.18.4-2
@ -196,13 +213,6 @@ Obsoletes: %{name}-pkcs11-libs < 32:9.18.4-2
 Contains heavyweight version of BIND suite libraries used by both named DNS
 server and utilities in %{name}-utils package.

-%package license
-Summary:  License of the BIND DNS suite
-BuildArch:noarch
-
-%description license
-Contains license of the BIND DNS suite.
-
 %package utils
 Summary: Utilities for querying DNS name servers
 Requires: %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release}
@ -282,7 +292,6 @@ Based on the code from Jan "Yenya" Kasprzak <kas@fi.muni.cz>
 %if %{with DOC}
 %package doc
 Summary:   BIND 9 Administrator Reference Manual
-Requires:  %{name}-license = %{epoch}:%{version}-%{release}
 Requires:  python3-sphinx_rtd_theme
 BuildArch: noarch

@ -300,24 +309,12 @@ in HTML and PDF format.
 %endif

 %prep
-%if 0%{?fedora}
-# RHEL does not yet support this verification
+%if ! 0%{?rhel} || 0%{?rhel} > 10
+# RHEL does not (again?) support this verification
 %{gpgverify} --keyring='%{SOURCE4}' --signature='%{SOURCE2}' --data='%{SOURCE0}'
 %endif
 %autosetup -n %{upname}-%{version} -p1

-# Sparc and s390 arches need to use -fPIE
-%ifarch sparcv9 sparc64 s390 s390x
-for i in bin/named/Makefile.am; do
-  sed -i 's|fpie|fPIE|g' $i
-done
-%endif
-
-%ifarch %{ix86}
-# f40 FTBFS on quota_test, bug #2261010
-  sed -e '/^\s*quota_test/ d' -i tests/isc/Makefile.am
-%endif
-
 :;

 # Create a sysusers.d config file
@ -326,10 +323,11 @@ g named %{bind_gid}
 u named %{bind_uid} 'Named' /var/named -
 EOF

+# get rid of rpath issues
+sed -e '/install_rpath:/ d' -i meson.build
+

 %build
-## We use out of tree configure/build for export libs
-%define _configure "../configure"

 # normal and pkcs11 unit tests
 %define unit_prepare_build() \
@ -351,55 +349,51 @@ CPPFLAGS="$CPPFLAGS -DOPENSSL_NO_ENGINE=1"
 export CFLAGS CPPFLAGS
 export STD_CDEFINES="$CPPFLAGS"

-sed -i -e \
-'s/([bind_VERSION_EXTRA],\s*\([^)]*\))/([bind_VERSION_EXTRA], \1-RH)/' \
-configure.ac
+#sed -i -e \
+#'s/([bind_VERSION_EXTRA],\s*\([^)]*\))/([bind_VERSION_EXTRA], \1-RH)/' \
+#configure.ac

-%if 0%{?rhel} && 0%{?rhel} < 9
-# disable Sphinx warnings as errors, epel8 does not pass cleanly
-sed -e 's/-W\s//' -i Makefile.docs
-%endif
+install -p -m 0755 %{SOURCE27} ./named-mkroot.sh # create named.root.key
+./named-mkroot.sh
+[ -f named.root.key ]

-%if %{with UNITTEST}
-if grep 'Intel(R) Xeon(R) CPU E5-2670 v3' /proc/cpuinfo; then
-  echo "Detected builder troubling unit tests, skiping some"
-  # https://gitlab.isc.org/isc-projects/bind9/-/issues/5328
-  sed -i -e 's/\sqpdb_test//' tests/dns/Makefile.am
-fi
-%endif
-autoreconf --force --install

-mkdir build
-
-pushd build
 LIBDIR_SUFFIX=
 export LIBDIR_SUFFIX
-%configure \
-  --with-pic \
-  --disable-static \
+
+%meson \
  --includedir=%{_includedir}/bind9 \
-  --with-libidn2 \
+  -Didn=enabled \
+  -Dfuzzing=disabled \
+%if %{without DTRACE}
+  -Dtracing=disabled \
+%endif
 %if %{with GEOIP2}
-  --with-maxminddb \
+  -Dgeoip=enabled \
 %endif
 %if %{with GSSTSIG}
-  --with-gssapi=yes \
+  -Dgssapi=enabled \
 %endif
 %if %{with LMDB}
-  --with-lmdb=yes \
+  -Dlmdb=enabled \
 %else
-  --with-lmdb=no \
+  -Dlmdb=disabled \
 %endif
 %if %{with JSON}
-  --with-json-c \
+  -Dstats-json=enabled \
 %endif
 %if %{with DNSTAP}
-  --enable-dnstap \
+  -Ddnstap=enabled \
 %endif
 %if %{with UNITTEST}
-  --with-cmocka \
+  -Dcmocka=enabled \
+%endif
+%if %{with DOC}
+  -Ddoc=enabled \
+%endif
+%if %{without JEMALLOC}
+  -Djemalloc=disabled \
 %endif
-  --enable-full-report \
 ;
 %if %{with DNSTAP}
  pushd lib
@ -408,19 +402,20 @@ export LIBDIR_SUFFIX
  popd
 %endif

-%make_build SPHINX_W=''
+%meson_build

 %if %{with DOC}
-  %make_build doc SPHINX_W=''
+  %meson_build man arm arm-epub
+%endif
+%if %{with SYSTEMTEST}
+  %meson_build system-test-dependencies
 %endif
-
-popd # build

 # Compress changelog by default
 gzip doc/changelog/changelog-*.rst

-%unit_prepare_build build
-%systemtest_prepare_build build
+#unit_prepare_build build
+#systemtest_prepare_build build

 %check
 %if %{with UNITTEST} || %{with SYSTEMTEST}
@ -432,8 +427,11 @@ gzip doc/changelog/changelog-*.rst
 export TSAN_OPTIONS="log_exe_name=true log_path=ThreadSanitizer exitcode=0"
 %endif

+# We produce it runtime. Check it has valid syntax.
+LD_LIBRARY_PATH="$LD_LIBRARY_PATH:${RPM_BUILD_ROOT}%{_libdir}" \
+  ${RPM_BUILD_ROOT}%{_bindir}/named-checkconf ${RPM_BUILD_ROOT}%{_sysconfdir}/named.root.key
+
 %if %{with UNITTEST}
-  pushd build
  CPUS=$(lscpu -p=cpu,core | grep -v '^#' | wc -l)
  THREADS="$CPUS"
  COREPATTERN="$(cat /proc/sys/kernel/core_pattern)"
@ -443,30 +441,17 @@ export TSAN_OPTIONS="log_exe_name=true log_path=ThreadSanitizer exitcode=0"
  if [ "$CPUS" -gt 16 ]; then
    ORIGFILES=$(ulimit -n)
    THREADS=16
+    export ISC_TASK_WORKERS="$THREADS"
    ulimit -n 8092 || : # Requires on some machines with many cores
  fi
-  echo "core.%%P" > /proc/sys/kernel/core_pattern || :
  e=0
-  %make_build unit -j${THREADS} || e=$?
-  # Display details of failure
-  cat tests/*/test-suite.log
+  %meson_test --num-processes ${THREADS} || e=$?

-  echo "$COREPATTERN" > /proc/sys/kernel/core_pattern || :
  if [ "$e" -ne 0 ]; then
-    echo "ERROR: this build of BIND failed 'make unit'. Aborting."
-    for CORE in $(find -name 'core.*'); do
-      echo "# Found core: $CORE"
-      gdb --batch -ex 'bt full' -c "$CORE"
-      echo
-      xz -k "$CORE"
-      echo "# core base64 begin: $CORE"
-      base64 "$CORE.xz"
-      echo "# core base64 end: $CORE"
-    done
+    echo "ERROR: test failed. Aborting."
    exit $e;
  fi;
  [ "$CPUS" -gt 16 ] && ulimit -n $ORIGFILES || :
-  popd
 ## End of UNITTEST
 %endif

@ -474,7 +459,7 @@ export TSAN_OPTIONS="log_exe_name=true log_path=ThreadSanitizer exitcode=0"
 # Runs system test if ip addresses are already configured
 # or it is able to configure them
  SUDO=
-  pushd build/bin/tests/system/
+  pushd bin/tests/system/
  if perl ./testsock.pl
  then
    CONFIGURED=already
@ -494,18 +479,23 @@ export TSAN_OPTIONS="log_exe_name=true log_path=ThreadSanitizer exitcode=0"

  if [ -n "$CONFIGURED" ]
  then
-    set -e
-    pushd build/bin/tests
+    pushd bin/tests/system
    export CI_SYSTEM=yes # allow running tests as root
    chown -R ${USER} . # Can be unknown user
-    %make_build test 2>&1 | tee test.log
-    e=$?
+    e=0
+    pytest -n ${THREADS} --capture=tee-sys || e=$?
    [ "$CONFIGURED" = build ] && $SUDO sh ./ifconfig.sh down
-    popd
    if [ "$e" -ne 0 ]; then
-      echo "ERROR: this build of BIND failed 'make test'. Aborting."
+      echo "ERROR: failed running 'pytest' in system tests. Aborting."
+      ls -1 "$(pwd)"/*_tmp_*
+      for TMPTEST in *_tmp_*
+      do
+        echo "# $TMPTEST"
+        cat $TMPTEST/pytest.log.txt
+      done
      exit $e;
    fi;
+    popd
  else
    echo 'SKIPPED: tests require root, CAP_NET_ADMIN or already configured test addresses.'
  fi
@ -536,9 +526,7 @@ popd
 touch ${RPM_BUILD_ROOT}/%{chroot_prefix}%{_sysconfdir}/named.conf
 #end chroot

-pushd build
-%make_install
-popd
+%meson_install

 # Remove unwanted files
 rm -f ${RPM_BUILD_ROOT}/etc/bind.keys
@ -585,8 +573,9 @@ popd

 %if %{with DOC}
 mkdir -p ${RPM_BUILD_ROOT}%{_pkgdocdir}
-cp -a build/doc/arm/_build/html ${RPM_BUILD_ROOT}%{_pkgdocdir}
-rm -rf ${RPM_BUILD_ROOT}%{_pkgdocdir}/html/.{buildinfo,doctrees}
+pushd %{_vpath_builddir}
+cp -a arm/ ${RPM_BUILD_ROOT}%{_pkgdocdir}/html/
+#rm -rf ${RPM_BUILD_ROOT}%{_pkgdocdir}/html/.{buildinfo,doctrees}
 # Backward compatible link to 9.11 documentation
 (cd ${RPM_BUILD_ROOT}%{_pkgdocdir} && ln -s html/index.html Bv9ARM.html)
 # Share static data from original sphinx package
@ -599,7 +588,10 @@ do
    ln -sr "${RPM_BUILD_ROOT}${DIR}" "$BINDTHEMEDIR"
  fi
 done
-cp -p build/doc/arm/_build/epub/Bv9ARM.epub ${RPM_BUILD_ROOT}%{_pkgdocdir}
+cp -p arm-epub/Bv9ARM.epub ${RPM_BUILD_ROOT}%{_pkgdocdir}
+popd
+cp -p doc/changelog/changelog-history.rst* doc/notes/notes-*.rst* \
+      ${RPM_BUILD_ROOT}%{_pkgdocdir}
 %endif

 # Ghost config files:
@ -608,13 +600,13 @@ touch ${RPM_BUILD_ROOT}%{_localstatedir}/log/named.log
 # configuration files:
 install -m 640 %{SOURCE16} ${RPM_BUILD_ROOT}%{_sysconfdir}/named.conf
 touch ${RPM_BUILD_ROOT}%{_sysconfdir}/rndc.{key,conf}
-install -m 644 %{SOURCE27} ${RPM_BUILD_ROOT}%{_sysconfdir}/named.root.key
-install -m 644 %{SOURCE36} ${RPM_BUILD_ROOT}%{_sysconfdir}/trusted-key.key
+install -m 644 -p named.root.key ${RPM_BUILD_ROOT}%{_sysconfdir}/named.root.key
+ln -s "%{_datadir}/dns-root-data/root.key" ${RPM_BUILD_ROOT}%{_sysconfdir}/trusted-key.key
 mkdir -p ${RPM_BUILD_ROOT}%{_sysconfdir}/named

 # data files:
 mkdir -p ${RPM_BUILD_ROOT}%{_localstatedir}/named
-install -m 640 %{SOURCE17} ${RPM_BUILD_ROOT}%{_localstatedir}/named/named.ca
+ln -s "%{_datadir}/dns-root-data/root.hints" ${RPM_BUILD_ROOT}%{_localstatedir}/named/named.ca
 install -m 640 %{SOURCE18} ${RPM_BUILD_ROOT}%{_localstatedir}/named/named.localhost
 install -m 640 %{SOURCE19} ${RPM_BUILD_ROOT}%{_localstatedir}/named/named.loopback
 install -m 640 %{SOURCE20} ${RPM_BUILD_ROOT}%{_localstatedir}/named/named.empty
@ -627,7 +619,7 @@ install -m 644 %{SOURCE25} sample/etc/named.conf
 install -m 644 %{SOURCE16} named.conf.default
 install -m 644 %{SOURCE23} sample/etc/named.rfc1912.zones
 install -m 644 %{SOURCE18} %{SOURCE19} %{SOURCE20}  sample/var/named
-install -m 644 %{SOURCE17} sample/var/named/named.ca
+ln -s "%{_datadir}/dns-root-data/root.hints" sample/var/named/named.ca
 for f in my.internal.zone.db slaves/my.slave.internal.zone.db slaves/my.ddns.internal.zone.db my.external.zone.db; do 
  echo '@ in soa localhost. root 1 3H 15M 1W 1D
  ns localhost.' > sample/var/named/$f; 
@ -733,6 +725,7 @@ fi;
 # FIXME: current build targets filters into %%_libdir/bind again?
 %dir %{_libdir}/bind
 %{_libdir}/bind/filter*.so
+%{_libdir}/bind/synthrecord.so
 %dir %{_libdir}/named
 %config(noreplace) %verify(not md5 size mtime) %{_sysconfdir}/sysconfig/named
 %config(noreplace) %attr(0644,root,named) %{_sysconfdir}/named.root.key
@ -745,6 +738,7 @@ fi;
 %{_bindir}/named-journalprint
 %{_bindir}/named-checkconf
 %{_bindir}/named-rrchecker
+%{_bindir}/named-makejournal
 %{_bindir}/mdig
 %{_sbindir}/named
 %{_sbindir}/rndc*
@ -762,7 +756,8 @@ fi;
 %{_mandir}/man1/named-checkconf.1*
 %{_mandir}/man8/rndc-confgen.8*
 %{_mandir}/man1/named-journalprint.1*
-%{_mandir}/man8/filter-*.8.gz
+%{_mandir}/man1/named-makejournal.1*
+%{_mandir}/man8/filter-*.8*
 %doc README.md named.conf.default
 %doc doc/changelog/changelog-9.*.rst*
 %doc sample/
@ -798,8 +793,6 @@ fi;
 %{_libdir}/libdns-%{version}*.so
 %{_libdir}/libisc-%{version}*.so
 %{_libdir}/libisccfg-%{version}*.so
-
-%files license
 %{!?_licensedir:%global license %%doc}
 %license COPYRIGHT

@ -844,6 +837,8 @@ fi;
 %{_bindir}/dnssec*
 %{_mandir}/man1/dnssec*.1*

+%if 0
+# TODO: remove devel subpackage or create custom installation part
 %files devel
 %{_libdir}/libisccc.so
 %{_libdir}/libns.so
@ -858,6 +853,7 @@ fi;
 %{_includedir}/bind9/irs
 %{_includedir}/bind9/isc
 %{_includedir}/bind9/isccfg
+%endif

 %files chroot
 %config(noreplace) %{_sysconfdir}/named-chroot.files
@ -904,8 +900,9 @@ fi;
 %doc %{_pkgdocdir}/html
 %doc %{_pkgdocdir}/Bv9ARM.html
 %doc %{_pkgdocdir}/Bv9ARM.epub
-%doc doc/changelog/changelog-history.rst*
-%doc doc/notes/notes-*.rst*
+%doc %{_pkgdocdir}/changelog-history.rst*
+%doc %{_pkgdocdir}/notes-*.rst*
+%license COPYRIGHT
 %endif

 %changelog
--- a/named-chroot.files
+++ b/named-chroot.files
@ -18,6 +18,7 @@
 /usr/lib64/bind
 /usr/lib/bind
 /usr/share/GeoIP
+/usr/share/dns-root-data
 /run/named
 /proc/sys/net/ipv4/ip_local_port_range
 # Warning: the order is important
--- a/named-mkroot.sh
+++ b/named-mkroot.sh
@ -0,0 +1,20 @@
+#!/bin/sh
+# Create named.root.key from dns-root-data package
+
+ROOT_DS=/usr/share/dns-root-data/root.ds
+: ${OUTPUT:=named.root.key}
+
+if ! [ -r "$ROOT_DS" ]; then
+	echo "Root trust file is not readable: $ROOT_DS"
+	exit 1
+fi
+
+echo "# Autogenerated from $ROOT_DS" > "$OUTPUT"
+echo "trust-anchors {" >> "$OUTPUT"
+cat "$ROOT_DS" | while read DOMAIN CLS QTYPE KEYTAG ALG DIG HASH;
+do
+	echo "$DOMAIN initial-ds $KEYTAG $ALG $DIG \"$HASH\";" >> "$OUTPUT";
+done
+echo "}; " >> "$OUTPUT"
+# Set the same modification time as data source.
+touch -r $ROOT_DS "$OUTPUT"
--- a/named.logrotate
+++ b/named.logrotate
@ -2,11 +2,8 @@
    missingok
    su named named
    create 0644 named named
+    notifempty
    postrotate
-        /usr/bin/systemctl reload named.service > /dev/null 2>&1 || true
-        /usr/bin/systemctl reload named-chroot.service > /dev/null 2>&1 || true
-        /usr/bin/systemctl reload named-sdb.service > /dev/null 2>&1 || true
-        /usr/bin/systemctl reload named-sdb-chroot.service > /dev/null 2>&1 || true
-        /usr/bin/systemctl reload named-pkcs11.service > /dev/null 2>&1 || true
+        /usr/bin/rndc closelogs > /dev/null 2>&1 || true
    endscript
 }
--- a/named.root
+++ b/named.root
@ -1,92 +0,0 @@
-;       This file holds the information on root name servers needed to 
-;       initialize cache of Internet domain name servers
-;       (e.g. reference this file in the "cache  .  <file>"
-;       configuration file of BIND domain name servers). 
-; 
-;       This file is made available by InterNIC 
-;       under anonymous FTP as
-;           file                /domain/named.cache 
-;           on server           FTP.INTERNIC.NET
-;       -OR-                    RS.INTERNIC.NET
-;
-;       last update:     December 20, 2023
-;       related version of root zone:     2023122001
-; 
-; FORMERLY NS.INTERNIC.NET 
-;
-.                        3600000      NS    A.ROOT-SERVERS.NET.
-A.ROOT-SERVERS.NET.      3600000      A     198.41.0.4
-A.ROOT-SERVERS.NET.      3600000      AAAA  2001:503:ba3e::2:30
-; 
-; FORMERLY NS1.ISI.EDU 
-;
-.                        3600000      NS    B.ROOT-SERVERS.NET.
-B.ROOT-SERVERS.NET.      3600000      A     170.247.170.2
-B.ROOT-SERVERS.NET.      3600000      AAAA  2801:1b8:10::b
-; 
-; FORMERLY C.PSI.NET 
-;
-.                        3600000      NS    C.ROOT-SERVERS.NET.
-C.ROOT-SERVERS.NET.      3600000      A     192.33.4.12
-C.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:2::c
-; 
-; FORMERLY TERP.UMD.EDU 
-;
-.                        3600000      NS    D.ROOT-SERVERS.NET.
-D.ROOT-SERVERS.NET.      3600000      A     199.7.91.13
-D.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:2d::d
-; 
-; FORMERLY NS.NASA.GOV
-;
-.                        3600000      NS    E.ROOT-SERVERS.NET.
-E.ROOT-SERVERS.NET.      3600000      A     192.203.230.10
-E.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:a8::e
-; 
-; FORMERLY NS.ISC.ORG
-;
-.                        3600000      NS    F.ROOT-SERVERS.NET.
-F.ROOT-SERVERS.NET.      3600000      A     192.5.5.241
-F.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:2f::f
-; 
-; FORMERLY NS.NIC.DDN.MIL
-;
-.                        3600000      NS    G.ROOT-SERVERS.NET.
-G.ROOT-SERVERS.NET.      3600000      A     192.112.36.4
-G.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:12::d0d
-; 
-; FORMERLY AOS.ARL.ARMY.MIL
-;
-.                        3600000      NS    H.ROOT-SERVERS.NET.
-H.ROOT-SERVERS.NET.      3600000      A     198.97.190.53
-H.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:1::53
-; 
-; FORMERLY NIC.NORDU.NET
-;
-.                        3600000      NS    I.ROOT-SERVERS.NET.
-I.ROOT-SERVERS.NET.      3600000      A     192.36.148.17
-I.ROOT-SERVERS.NET.      3600000      AAAA  2001:7fe::53
-; 
-; OPERATED BY VERISIGN, INC.
-;
-.                        3600000      NS    J.ROOT-SERVERS.NET.
-J.ROOT-SERVERS.NET.      3600000      A     192.58.128.30
-J.ROOT-SERVERS.NET.      3600000      AAAA  2001:503:c27::2:30
-; 
-; OPERATED BY RIPE NCC
-;
-.                        3600000      NS    K.ROOT-SERVERS.NET.
-K.ROOT-SERVERS.NET.      3600000      A     193.0.14.129
-K.ROOT-SERVERS.NET.      3600000      AAAA  2001:7fd::1
-; 
-; OPERATED BY ICANN
-;
-.                        3600000      NS    L.ROOT-SERVERS.NET.
-L.ROOT-SERVERS.NET.      3600000      A     199.7.83.42
-L.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:9f::42
-; 
-; OPERATED BY WIDE
-;
-.                        3600000      NS    M.ROOT-SERVERS.NET.
-M.ROOT-SERVERS.NET.      3600000      A     202.12.27.33
-M.ROOT-SERVERS.NET.      3600000      AAAA  2001:dc3::35
-; End of file
--- a/named.root.key
+++ b/named.root.key
@ -1,18 +1,5 @@
-trust-anchors {
-        # ROOT KEYS: See https://data.iana.org/root-anchors/root-anchors.xml
-        # for current trust anchor information.
-        #
-        # This key (20326) was published in the root zone in 2017.
-        # Servers which were already using the old key (19036) should
-        # roll seamlessly to this new one via RFC 5011 rollover. Servers
-        # being set up for the first time can use the contents of this
-        # file as initializing keys; thereafter, the keys in the
-        # managed key database will be trusted and maintained
-        # automatically.
-        . initial-ds 20326 8 2 "E06D44B80B8F1D39A95C0B0D7C65D08458E880409BBC683457104237C7F8EC8D";
-        # This key (38696) will be pre-published in the root zone in 2025
-        # and is scheduled to begin signing in late 2026. At that time,
-        # servers which were already using the old key (20326) should roll
-        # seamlessly to this new one via RFC 5011 rollover.
-        . initial-ds 38696 8 2 "683D2D0ACB8C9B712A1948B27F741219298D0A450D612C483AF444A4C0FB2B16";
-};
+# Autogenerated from /usr/share/dns-root-data/root.ds
+truste-anchors {
+. initial-ds 20326 8 2 "E06D44B80B8F1D39A95C0B0D7C65D08458E880409BBC683457104237C7F8EC8D";
+. initial-ds 38696 8 2 "683D2D0ACB8C9B712A1948B27F741219298D0A450D612C483AF444A4C0FB2B16";
+}; 
--- a/4
+++ b/4
@ -1,2 +1,2 @@
-SHA512 (bind-9.21.8.tar.xz) = 8fdba5fa9e8c4659119074b54477d22bfb7301f6244f8df8df9f4b45f0512374a071c0d0d3f0f8e06f668fa59aa8a56d269900b6f6431461a770f11e21443d19
-SHA512 (bind-9.21.8.tar.xz.asc) = c48d2e3607a4c346ff12be6da43a9103ab935058662a14bd20abe5193db8cdede38a52bc59a1ad45ff1264f72a6175c61266edab92df3a3771580fd20d0570fb
+SHA512 (bind-9.21.20.tar.xz) = 4bd65612ff851720eba7f88495d51eb8a41b6a946c377b9dcd62f58f8c5a3e9338af44abc9df76b2ead9461eca4eb81f088619e3cc481f35fa0fc5d0926a93e3
+SHA512 (bind-9.21.20.tar.xz.asc) = 7431540d942fe23222b2812f9d80e67d0fa38516f9d536095a6544b156dc0306aba5752ba6c03cc2935d92a74860e70e8fc53b4cb481b8afe226e49dd51f695f
--- a/trusted-key.key
+++ b/trusted-key.key
@ -1,2 +0,0 @@
-. 3600 IN DNSKEY 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU=
-. 3600 IN DNSKEY 257 3 8 AwEAAa96jeuknZlaeSrvyAJj6ZHv28hhOKkx3rLGXVaC6rXTsDc449/cidltpkyGwCJNnOAlFNKF2jBosZBU5eeHspaQWOmOElZsjICMQMC3aeHbGiShvZsx4wMYSjH8e7Vrhbu6irwCzVBApESjbUdpWWmEnhathWu1jo+siFUiRAAxm9qyJNg/wOZqqzL/dL/q8PkcRU5oUKEpUge71M3ej2/7CPqpdVwuMoTvoB+ZOT4YeGyxMvHmbrxlFzGOHOijtzN+u1TQNatX2XBuzZNQ1K+s2CXkPIZo7s6JgZyvaBevYtxPvYLw4z9mR7K2vaF18UYH9Z9GNUUeayffKC73PYc=
Author	SHA1	Message	Date
Petr Menšík	36bbdbb7e3	Update to 9.21.20 (rhbz#2440560) Security Fixes: - Fix unbounded NSEC3 iterations when validating referrals to unsigned delegations. (CVE-2026-1519) - Fix memory leaks in code preparing DNSSEC proofs of non-existence. (CVE-2026-3104) - Prevent a crash in code processing queries containing a TKEY record. (CVE-2026-3119) - Fix a stack use-after-return flaw in SIG(0) handling code. (CVE-2026-3591) New Features: - Provide response round-trip time (RTT) counters via statistics channel. - Introduce max-delegation-servers configuration option. Bug Fixes: - Fix parsing key inactivation time in KASP code. - Fix the handling of key statements defined inside views. Source: https://downloads.isc.org/isc/bind9/9.21.20/doc/arm/html/notes.html#notes-for-bind-9-21-20	2026-03-25 20:07:44 +01:00
Petr Menšík	a6ae9a839e	Remove separate license subpackage Move license to libs subpackage, it is required for everything except documentation. Include license file in docs and bind-libs, avoid extra package just for single file.	2026-01-22 16:48:07 +01:00
Petr Menšík	13d07a1939	Update to 9.21.17 (rhbz#2415843) Security Fixes: - Fix incorrect length checks for BRID and HHIT records. (CVE-2025-13878) New Features: - Add support for Extended DNS Error 9 (Missing DNSKEY). - Add support for Extended DNS Error 13 (Cached Error). - Add support for Generalized DNS Notifications. Features Changes: - Add more information to the rndc recursing output about fetches. - Enforce bounds of multiple configuration options. Bug Fixes: - Fix inbound IXFR performance regression. - Make DNSSEC key rollovers more robust. - Fix a catalog zone issue, where member zones could fail to load. - Fix slow speed when signing a large delegation zone with NSEC3 opt-out. - Reconfiguring an NSEC3 opt-out zone to NSEC caused the zone to be invalid. - Fix a possible catalog zone issue during reconfiguration. - Fix the charts in the statistics channel. https://downloads.isc.org/isc/bind9/9.21.17/doc/arm/html/notes.html#notes-for-bind-9-21-17	2026-01-22 16:23:58 +01:00
Petr Menšík	ac3ef15e89	Fix build for RHEL, disable JEMALLOC there	2026-01-22 16:22:35 +01:00
Petr Menšík	8c947ce9c4	Use dns-root-data package for hints source Use trusted root source and hints from separate package.	2026-01-22 16:22:35 +01:00
Petr Menšík	07c6012166	Fix running SYSTEMTEST during build Needs prepared network scripts. Can be used like: fedpkg mockbuild --enable-network --with SYSTEMTEST	2026-01-22 16:22:35 +01:00
Petr Menšík	9b6df11143	Prevent SERVFAIL on dual signed zones with one unsupported signature (rhbz#2413104)	2025-11-06 17:12:20 +01:00
Petr Menšík	0ed5fc08dd	Update to 9.21.14 (rhbz#2394406) Security Fixes: - DNSSEC validation fails if matching but invalid DNSKEY is found. (CVE-2025-8677) - Address various spoofing attacks. (CVE-2025-40778) - Cache-poisoning due to weak pseudo-random number generator. (CVE-2025-40780) New Features: - Add dnssec-policy keys configuration check to named-checkconf. - Add support for synthetic records. - Support for zone-specific plugins. - Support for additional tokens in the zone file name template. Removed Features: - Remove randomized RRset ordering. and bug fixes https://downloads.isc.org/isc/bind9/9.21.14/doc/arm/html/notes.html#notes-for-bind-9-21-14	2025-11-06 17:12:18 +01:00
Petr Menšík	78617f9884	Meson libs include version in upstream already Libraries include version name right in the upstream. No need for downstream patch doing the same.	2025-11-06 17:11:46 +01:00
Petr Menšík	d412d0ebd0	Remove license and devel packages from README Remove also reference to DLZ removed during recent updates. [skip changelog]	2025-11-06 17:11:46 +01:00
Petr Menšík	60658fe41a	Replace Expat license with MIT	2025-09-08 10:20:40 +02:00
Petr Menšík	de80f009a9	Reenable systemtap and dtrace These are enabled by default, just provide dependencies to pass automatic test.	2025-09-08 10:20:40 +02:00
Petr Menšík	0bad3962c1	Try fixing i686 platform	2025-09-08 10:20:40 +02:00
Petr Menšík	8352e0ab73	Update to 9.21.11 New Features: - Support for parsing DSYNC records has been added. Feature changes: - Reword the shut down hung fetch while resolving message. - Plugin extension in plugin path is now optional. - Add deprecation warnings for RSASHA1, RSASHA1-NSEC3SHA1, and DS digest type 1. And multiple bug fixes. https://downloads.isc.org/isc/bind9/9.21.11/doc/arm/html/notes.html#notes-for-bind-9-21-11	2025-09-08 10:20:40 +02:00
Petr Menšík	bdaaec7389	Disable devel package and fix doc building	2025-09-08 10:20:40 +02:00
Petr Menšík	bb2bf86fc7	Use smarter action on lograte script BIND 9.21 has rndc closelogs action, which just reopens logs and nothing more. Use that from logrotate. Skip this action if the log is empty.	2025-09-08 10:20:40 +02:00
Petr Menšík	64924425a3	Make versioned libraries Devel package not yet solved.	2025-09-08 10:20:40 +02:00
Petr Menšík	c6386b8f08	WIP: Pass meson build and test Install phase not yet solved.	2025-09-08 10:20:40 +02:00
Petr Menšík	14089f422f	Attempt to switch to meson build system	2025-09-08 10:20:40 +02:00
Petr Menšík	6286528f80	Update to 9.21.10 (rhbz#2380940) Security Fixes: - Fix a possible assertion failure when stale-answer-client-timeout is set to 0. New Features: - Add code paths to fully support PRIVATEDNS and PRIVATEOID keys. - Add named-makejournal tool. - Add support for the CO flag to dig. https://downloads.isc.org/isc/bind9/9.21.10/doc/arm/html/notes.html#notes-for-bind-9-21-10	2025-09-08 10:20:40 +02:00
Petr Menšík	d44dce1412	Revert "Skip qpdb_test on some builders" This reverts commit `7fe8c16138`. (cherry picked from commit `07899c889d`)	2025-09-08 10:20:24 +02:00
Petr Menšík	1f8fb8d255	Try limiting maximal tasks in unit tests Limit also number of internal tasks to some smaller number.	2025-06-05 20:06:32 +02:00