Update to 9.21.20 (rhbz#2440560)

Security Fixes:

- Fix unbounded NSEC3 iterations when validating referrals to unsigned delegations. (CVE-2026-1519)
- Fix memory leaks in code preparing DNSSEC proofs of non-existence. (CVE-2026-3104)
- Prevent a crash in code processing queries containing a TKEY record. (CVE-2026-3119)
- Fix a stack use-after-return flaw in SIG(0) handling code. (CVE-2026-3591)

New Features:

- Provide response round-trip time (RTT) counters via statistics channel.
- Introduce max-delegation-servers configuration option.

Bug Fixes:

- Fix parsing key inactivation time in KASP code.
- Fix the handling of key statements defined inside views.

Source: https://downloads.isc.org/isc/bind9/9.21.20/doc/arm/html/notes.html#notes-for-bind-9-21-20

README.md

@@ -26,13 +26,9 @@ The package contains several subpackages, some of them can be disabled on rebuil
 * **bind9-next** -- *named* daemon providing DNS server
 * **bind9-next-utils** -- set of tools to analyse DNS responses or update entries (dig, host)
 * **bind9-next-doc** -- documentation for current bind, *BIND 9 Administrator Reference Manual*.
-* **bind9-next-license** -- Shared license for all packages but bind-export-libs.
 * **bind9-next-libs** -- Shared libraries used by some others programs
-* **bind9-next-devel** -- Development headers for libs. Can be disabled by `--without DEVEL`
-
 
 ## Optional features
 
 * *GSSTSIG* -- Support for Kerberos authentication in BIND.
 * *LMDB* -- Support for dynamic database for managing runtime added zones. Provides faster removal of added zone with much less overhead. But requires lmdb linked to base libs.
-* *DLZ* -- Support for dynamic loaded modules providing support for features *bind-sdb* provides, but only small module is required.

bind-9.21-dual-sign-continue-test.patch

@@ -0,0 +1,115 @@
+From 488d7bfc75f2988c6e461b8677bc0e27e58bd82e Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
+Date: Sat, 1 Nov 2025 12:00:59 +0100
+Subject: [PATCH] Add a system test with one good and one bad algorithm
+
+The case where there would be one supported algorithm and one already
+unsupported (like RSAMD5 or RSASHA1) was missing.
+---
+ bin/tests/system/dnssec/ns2/example.db.in   |  4 +++
+ bin/tests/system/dnssec/ns2/sign.sh         |  2 +-
+ bin/tests/system/dnssec/ns3/named.conf.j2   |  6 ++++
+ bin/tests/system/dnssec/ns3/sign.sh         | 31 +++++++++++++++++++++
+ bin/tests/system/dnssec/tests_validation.py |  8 ++++++
+ 5 files changed, 50 insertions(+), 1 deletion(-)
+
+diff --git a/bin/tests/system/dnssec/ns2/example.db.in b/bin/tests/system/dnssec/ns2/example.db.in
+index 47c2eb7f0e..07429366ee 100644
+--- a/bin/tests/system/dnssec/ns2/example.db.in
++++ b/bin/tests/system/dnssec/ns2/example.db.in
+@@ -202,3 +202,7 @@ ns3.extradsunknownoid	A	10.53.0.3
+ 
+ extended-ds-unknown-oid	NS	ns3.extended-ds-unknown-oid
+ ns3.extended-ds-unknown-oid A	10.53.0.3
++
++; A secure subdomain with extra bad key
++extrabadkey		NS	ns3.extrabadkey
++ns3.extrabadkey		A	10.53.0.3
+diff --git a/bin/tests/system/dnssec/ns2/sign.sh b/bin/tests/system/dnssec/ns2/sign.sh
+index e3f18af15e..da9f5f07fc 100644
+--- a/bin/tests/system/dnssec/ns2/sign.sh
++++ b/bin/tests/system/dnssec/ns2/sign.sh
+@@ -92,7 +92,7 @@ for subdomain in digest-alg-unsupported ds-unsupported secure badds \
+   dnskey-nsec3-unknown managed-future future revkey \
+   dname-at-apex-nsec3 occluded rsasha1 rsasha1-1024 \
+   rsasha256oid rsasha512oid unknownoid extradsoid extradsunknownoid \
+-  extended-ds-unknown-oid; do
++  extended-ds-unknown-oid extrabadkey; do
+   cp "../ns3/dsset-$subdomain.example." .
+ done
+ 
+diff --git a/bin/tests/system/dnssec/ns3/named.conf.j2 b/bin/tests/system/dnssec/ns3/named.conf.j2
+index 1a0edc14bb..9cbc58892c 100644
+--- a/bin/tests/system/dnssec/ns3/named.conf.j2
++++ b/bin/tests/system/dnssec/ns3/named.conf.j2
+@@ -141,6 +141,12 @@ zone "extrakey.example" {
+ 	allow-update { any; };
+ };
+ 
++zone "extrabadkey.example" {
++	type primary;
++	file "extrabadkey.example.db.signed";
++	allow-update { any; };
++};
++
+ zone "insecure.nsec3.example" {
+ 	type primary;
+ 	file "insecure.nsec3.example.db";
+diff --git a/bin/tests/system/dnssec/ns3/sign.sh b/bin/tests/system/dnssec/ns3/sign.sh
+index 5512888b2f..ea81381eb2 100644
+--- a/bin/tests/system/dnssec/ns3/sign.sh
++++ b/bin/tests/system/dnssec/ns3/sign.sh
+@@ -905,3 +905,34 @@ ksk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK "$zone")
+ zsk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
+ cat "$infile" "$ksk.key" "$zsk.key" >"$zonefile"
+ "$SIGNER" -g -o "$zone" "$zonefile" >/dev/null 2>&1
++
++#
++#
++#
++zone=extrabadkey.example.
++infile=template.db.in
++zonefile=extrabadkey.example.db
++
++# Add KSK and ZSK that we will mangle to RSAMD5
++ksk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK "$zone")
++zsk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
++cat "$infile" "$ksk.key" "$zsk.key" >"$zonefile"
++"$SIGNER" -g -O full -o "$zone" "$zonefile" >/dev/null 2>&1
++
++# Mangle the signatures to RSAMD5 and save them for future use
++sed -ne "s/\(IN[[:space:]]*RRSIG[[:space:]]*[A-Z]*\) $DEFAULT_ALGORITHM_NUMBER /\1 1 /p" <"$zonefile.signed" >"$zonefile.signed.rsamd5"
++
++# Now add normal KSK and ZSK to the zone file
++ksk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK "$zone")
++zsk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
++cat "$infile" "$ksk.key" "$zsk.key" >"$zonefile"
++
++# Mangle the DNSKEY algorithm numbers and add them to the signed zone file
++cat "$ksk.key" "$zsk.key" | sed -e "s/\(IN[[:space:]]*DNSKEY[[:space:]]*[0-9]* 3\) $DEFAULT_ALGORITHM_NUMBER /\1 1 /" >>"$zonefile"
++
++# Sign normally
++"$SIGNER" -g -o "$zone" "$zonefile" >/dev/null 2>&1
++
++# Add the mangled signatures to signed zone file
++cat "$zonefile.signed.rsamd5" >>"$zonefile.signed"
++rm "$zonefile.signed.rsamd5"
+diff --git a/bin/tests/system/dnssec/tests_validation.py b/bin/tests/system/dnssec/tests_validation.py
+index e6d8ccc734..a27a899987 100644
+--- a/bin/tests/system/dnssec/tests_validation.py
++++ b/bin/tests/system/dnssec/tests_validation.py
+@@ -1385,3 +1385,11 @@ def test_rrsigs_for_glue():
+         record.rdtype == rdatatype.RRSIG and record.covers == rdatatype.A
+         for record in res.answer
+     )
++
++
++def test_extra_bad_algorithm():
++    msg = isctest.query.create("a.extrabadkey.example", "A")
++    res1 = isctest.query.tcp(msg, "10.53.0.3")
++    res2 = isctest.query.tcp(msg, "10.53.0.4")
++    isctest.check.same_answer(res1, res2)
++    isctest.check.adflag(res2)
+-- 
+2.51.1
+

bind-9.21-dual-sign-continue.patch

@@ -0,0 +1,42 @@
+From a94a7c1a1e6eecbead995a08bace33d23899a5da Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
+Date: Tue, 4 Nov 2025 02:09:38 +0100
+Subject: [PATCH] Skip unsupported algorithms when looking for signing key
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+When looking for a signing key in select_signing_key(), the result code
+indicating unsupported algorithm would abort the search.  Instead, skip
+such keys and continue searching for the right key.
+
+Co-Authored-By: Aram Sargsyan <aram@isc.org>
+Co-Authored-By: Petr Menšík <pemensik@redhat.com>
+---
+ lib/dns/validator.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/lib/dns/validator.c b/lib/dns/validator.c
+index c6781544b9..52677fbd80 100644
+--- a/lib/dns/validator.c
++++ b/lib/dns/validator.c
+@@ -1092,8 +1092,14 @@ select_signing_key(dns_validator_t *val, dns_rdataset_t *rdataset) {
+ 			continue;
+ 		}
+ 
+-		return dns_dnssec_keyfromrdata(&siginfo->signer, &rdata,
+-					       val->view->mctx, &val->key);
++		result = dns_dnssec_keyfromrdata(&siginfo->signer, &rdata,
++						 val->view->mctx, &val->key);
++		/* Don't count unsupported algorithm towards max fails */
++		if (result == DST_R_UNSUPPORTEDALG) {
++			/* Continue with the next key */
++			continue;
++		}
++		return result;
+ 	}
+ 
+ 	return ISC_R_NOTFOUND;
+-- 
+2.51.1
+

bind-9.21-unittest-qpdb-i386.patch

@@ -1,15 +1,15 @@
-From 574db9dac1c4bd6b19da887a58da1126e336b9e5 Mon Sep 17 00:00:00 2001
+From af1e4bf375000fc532c55ff6df841661185a2451 Mon Sep 17 00:00:00 2001
 From: Petr Mensik <pemensik@redhat.com>
 Date: Wed, 28 May 2025 19:40:05 +0200
 Subject: [PATCH] Try rcu_barrier
 
 https://gitlab.isc.org/isc-projects/bind9/-/issues/5328
 ---
- tests/dns/qpdb_test.c | 5 +++++
+ tests/dns/qpdb_test.c | 3 +++
- 1 file changed, 5 insertions(+)
+ 1 file changed, 3 insertions(+)
 
 diff --git a/tests/dns/qpdb_test.c b/tests/dns/qpdb_test.c
-index 4b1de18..a11af52 100644
+index 1c840e2..b6ad0f4 100644
 --- a/tests/dns/qpdb_test.c
 +++ b/tests/dns/qpdb_test.c
 @@ -24,6 +24,7 @@
@@ -20,24 +20,22 @@ index 4b1de18..a11af52 100644
  #include <isc/util.h>
  
  #include <dns/lib.h>
-@@ -170,6 +171,8 @@ ISC_LOOP_TEST_IMPL(overmempurge_bigrdata) {
+@@ -170,6 +171,7 @@ ISC_LOOP_TEST_IMPL(overmempurge_bigrdata) {
  
  	dns_db_detach(&db);
- 	isc_mem_detach(&mctx2);
+ 	isc_mem_detach(&mctx);
-+
 +	rcu_barrier();
- 	isc_loopmgr_shutdown(loopmgr);
+ 	isc_loopmgr_shutdown();
  }
  
-@@ -221,6 +224,8 @@ ISC_LOOP_TEST_IMPL(overmempurge_longname) {
+@@ -221,6 +223,7 @@ ISC_LOOP_TEST_IMPL(overmempurge_longname) {
  
  	dns_db_detach(&db);
- 	isc_mem_detach(&mctx2);
+ 	isc_mem_detach(&mctx);
-+
 +	rcu_barrier();
- 	isc_loopmgr_shutdown(loopmgr);
+ 	isc_loopmgr_shutdown();
  }
  
 -- 
-2.49.0
+2.51.0
 

bind9-next.spec

@@ -22,6 +22,7 @@
 %bcond_with    TSAN
 %bcond_without DTRACE
 %bcond_with    OPENSSL_ENGINE
+%bcond         JEMALLOC  0%{?fedora}
 
 %{?!bind_uid:  %global bind_uid  25}
 %{?!bind_gid:  %global bind_gid  25}
@@ -30,7 +31,9 @@
 %global        chroot_prefix     %{bind_dir}/chroot
 %global        chroot_create_directories /dev /run/named %{_localstatedir}/{log,named,tmp} \\\
                                          %{_sysconfdir}/{crypto-policies/back-ends,pki/dnssec-keys,pki/tls,named} \\\
-                                         %{_libdir}/bind %{_libdir}/named %{_datadir}/GeoIP /proc/sys/net/ipv4
+                                         %{_libdir}/bind %{_libdir}/named %{_datadir}/{GeoIP,dns-root-data} /proc/sys/net/ipv4
+%global        upstream_sources 0 2
+%global        pgp_signed_sources 2
 
 %global forgeurl0 https://gitlab.isc.org/isc-projects/bind9
 
@@ -53,9 +56,9 @@ Conflicts: %1 \
 
 Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
 Name:     bind9-next
-License:  MPL-2.0 AND ISC AND BSD-3-clause AND Expat AND BSD-2-clause
+License:  MPL-2.0 AND ISC AND BSD-3-clause AND MIT AND BSD-2-clause
 #
-Version:  9.21.8
+Version:  9.21.20
 Release:  %autorelease
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
@@ -67,17 +70,13 @@ Source2:  https://downloads.isc.org/isc/bind9/%{version}/%{upname}-%{version}.ta
 Source3:  named.logrotate
 Source4:  https://www.isc.org/docs/isc-keyblock.asc
 Source16: named.conf
-# Refresh by command: dig @a.root-servers.net. +tcp +norec
-# or from URL
-Source17: https://www.internic.net/domain/named.root
 Source18: named.localhost
 Source19: named.loopback
 Source20: named.empty
 Source23: named.rfc1912.zones
 Source25: named.conf.sample
-Source27: named.root.key
+Source27: named-mkroot.sh
 Source35: bind.tmpfiles.d
-Source36: trusted-key.key
 Source37: named.service
 Source38: named-chroot.service
 Source41: setup-named-chroot.sh
@@ -102,25 +101,38 @@ Requires:       coreutils
 Requires(post): shadow-utils
 Requires(post): glibc-common
 Requires(post): grep
+Requires:       dns-root-data
 Requires:       %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release}
 Recommends:     %{name}-utils %{name}-dnssec-utils
 %upname_compat %{upname}
 Obsoletes:      %{name}-pkcs11 < 32:9.18.4-2
 Conflicts:      bind-dyndb-ldap
 
-BuildRequires:  gcc, make
+BuildRequires:  gcc
-BuildRequires:  openssl-devel, libtool, autoconf, pkgconfig, libcap-devel
+BuildRequires:  make
-BuildRequires:  libidn2-devel, libxml2-devel
+BuildRequires:  openssl-devel
+BuildRequires:  libtool
+BuildRequires:  meson
+BuildRequires:  ninja-build
+BuildRequires:  pkgconfig
+BuildRequires:  libcap-devel
+BuildRequires:  libidn2-devel
+BuildRequires:  libxml2-devel
 BuildRequires:  systemd-rpm-macros
 BuildRequires:  selinux-policy
-BuildRequires:  findutils sed
+BuildRequires:  findutils
+BuildRequires:  sed
 BuildRequires:  libnghttp2-devel
 BuildRequires:  userspace-rcu-devel
+BuildRequires:  pkgconfig(libedit)
+BuildRequires:  dns-root-data
 # Compress the changelog
 BuildRequires:  gzip
-%if 0%{?fedora}
+%if %{with JEMALLOC}
 BuildRequires:  jemalloc-devel
-BuildRequires:  gnupg2
+%endif
+%if ! 0%{?rhel}
+BuildRequires:  gpgverify
 %endif
 BuildRequires:  libuv-devel
 %if %{with OPENSSL_ENGINE}
@@ -143,6 +155,8 @@ BuildRequires:  softhsm
 BuildRequires:  perl(Net::DNS) perl(Net::DNS::Nameserver) perl(Time::HiRes) perl(Getopt::Long)
 BuildRequires:  perl(English)
 BuildRequires:  python3-pytest
+BuildRequires:  python3-pytest-xdist
+BuildRequires:  python3-dns
 # manual configuration requires this tool
 BuildRequires:  iproute
 BuildRequires:  python3-jinja2
@@ -175,7 +189,9 @@ BuildRequires: libtsan
 %endif
 %if %{with DTRACE}
 # https://gitlab.isc.org/isc-projects/bind9/-/issues/4041
-BuildRequires: systemtap-sdt-devel
+BuildRequires:  systemtap
+BuildRequires:  systemtap-sdt-devel
+BuildRequires:  systemtap-sdt-dtrace
 %endif
 
 %description
@@ -187,7 +203,8 @@ tools for verifying that the DNS server is operating properly.
 
 %package libs
 Summary: Libraries used by the BIND DNS packages
-Requires: %{name}-license = %{epoch}:%{version}-%{release}
+Provides: %{name}-license = %{epoch}:%{version}-%{release}
+Obsoletes: %{name}-license < 32:9.21.17-1
 Provides: %{name}-libs-lite = %{epoch}:%{version}-%{release}
 Obsoletes: %{name}-libs-lite < 32:9.16.13
 Obsoletes: %{name}-pkcs11-libs < 32:9.18.4-2
@@ -196,13 +213,6 @@ Obsoletes: %{name}-pkcs11-libs < 32:9.18.4-2
 Contains heavyweight version of BIND suite libraries used by both named DNS
 server and utilities in %{name}-utils package.
 
-%package license
-Summary:  License of the BIND DNS suite
-BuildArch:noarch
-
-%description license
-Contains license of the BIND DNS suite.
-
 %package utils
 Summary: Utilities for querying DNS name servers
 Requires: %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release}
@@ -282,7 +292,6 @@ Based on the code from Jan "Yenya" Kasprzak <kas@fi.muni.cz>
 %if %{with DOC}
 %package doc
 Summary:   BIND 9 Administrator Reference Manual
-Requires:  %{name}-license = %{epoch}:%{version}-%{release}
 Requires:  python3-sphinx_rtd_theme
 BuildArch: noarch
 
@@ -300,24 +309,12 @@ in HTML and PDF format.
 %endif
 
 %prep
-%if 0%{?fedora}
+%if ! 0%{?rhel} || 0%{?rhel} > 10
-# RHEL does not yet support this verification
+# RHEL does not (again?) support this verification
 %{gpgverify} --keyring='%{SOURCE4}' --signature='%{SOURCE2}' --data='%{SOURCE0}'
 %endif
 %autosetup -n %{upname}-%{version} -p1
 
-# Sparc and s390 arches need to use -fPIE
-%ifarch sparcv9 sparc64 s390 s390x
-for i in bin/named/Makefile.am; do
-  sed -i 's|fpie|fPIE|g' $i
-done
-%endif
-
-%ifarch %{ix86}
-# f40 FTBFS on quota_test, bug #2261010
-  sed -e '/^\s*quota_test/ d' -i tests/isc/Makefile.am
-%endif
-
 :;
 
 # Create a sysusers.d config file
@@ -326,10 +323,11 @@ g named %{bind_gid}
 u named %{bind_uid} 'Named' /var/named -
 EOF
 
+# get rid of rpath issues
+sed -e '/install_rpath:/ d' -i meson.build
+
 
 %build
-## We use out of tree configure/build for export libs
-%define _configure "../configure"
 
 # normal and pkcs11 unit tests
 %define unit_prepare_build() \
@@ -351,55 +349,51 @@ CPPFLAGS="$CPPFLAGS -DOPENSSL_NO_ENGINE=1"
 export CFLAGS CPPFLAGS
 export STD_CDEFINES="$CPPFLAGS"
 
-sed -i -e \
+#sed -i -e \
-'s/([bind_VERSION_EXTRA],\s*\([^)]*\))/([bind_VERSION_EXTRA], \1-RH)/' \
+#'s/([bind_VERSION_EXTRA],\s*\([^)]*\))/([bind_VERSION_EXTRA], \1-RH)/' \
-configure.ac
+#configure.ac
 
-%if 0%{?rhel} && 0%{?rhel} < 9
+install -p -m 0755 %{SOURCE27} ./named-mkroot.sh # create named.root.key
-# disable Sphinx warnings as errors, epel8 does not pass cleanly
+./named-mkroot.sh
-sed -e 's/-W\s//' -i Makefile.docs
+[ -f named.root.key ]
-%endif
 
-%if %{with UNITTEST}
-if grep 'Intel(R) Xeon(R) CPU E5-2670 v3' /proc/cpuinfo; then
-  echo "Detected builder troubling unit tests, skiping some"
-  # https://gitlab.isc.org/isc-projects/bind9/-/issues/5328
-  sed -i -e 's/\sqpdb_test//' tests/dns/Makefile.am
-fi
-%endif
-autoreconf --force --install
 
-mkdir build
-
-pushd build
 LIBDIR_SUFFIX=
 export LIBDIR_SUFFIX
-%configure \
+
-  --with-pic \
+%meson \
-  --disable-static \
   --includedir=%{_includedir}/bind9 \
-  --with-libidn2 \
+  -Didn=enabled \
+  -Dfuzzing=disabled \
+%if %{without DTRACE}
+  -Dtracing=disabled \
+%endif
 %if %{with GEOIP2}
-  --with-maxminddb \
+  -Dgeoip=enabled \
 %endif
 %if %{with GSSTSIG}
-  --with-gssapi=yes \
+  -Dgssapi=enabled \
 %endif
 %if %{with LMDB}
-  --with-lmdb=yes \
+  -Dlmdb=enabled \
 %else
-  --with-lmdb=no \
+  -Dlmdb=disabled \
 %endif
 %if %{with JSON}
-  --with-json-c \
+  -Dstats-json=enabled \
 %endif
 %if %{with DNSTAP}
-  --enable-dnstap \
+  -Ddnstap=enabled \
 %endif
 %if %{with UNITTEST}
-  --with-cmocka \
+  -Dcmocka=enabled \
+%endif
+%if %{with DOC}
+  -Ddoc=enabled \
+%endif
+%if %{without JEMALLOC}
+  -Djemalloc=disabled \
 %endif
-  --enable-full-report \
 ;
 %if %{with DNSTAP}
   pushd lib
@@ -408,19 +402,20 @@ export LIBDIR_SUFFIX
   popd
 %endif
 
-%make_build SPHINX_W=''
+%meson_build
 
 %if %{with DOC}
-  %make_build doc SPHINX_W=''
+  %meson_build man arm arm-epub
+%endif
+%if %{with SYSTEMTEST}
+  %meson_build system-test-dependencies
 %endif
-
-popd # build
 
 # Compress changelog by default
 gzip doc/changelog/changelog-*.rst
 
-%unit_prepare_build build
+#unit_prepare_build build
-%systemtest_prepare_build build
+#systemtest_prepare_build build
 
 %check
 %if %{with UNITTEST} || %{with SYSTEMTEST}
@@ -432,8 +427,11 @@ gzip doc/changelog/changelog-*.rst
 export TSAN_OPTIONS="log_exe_name=true log_path=ThreadSanitizer exitcode=0"
 %endif
 
+# We produce it runtime. Check it has valid syntax.
+LD_LIBRARY_PATH="$LD_LIBRARY_PATH:${RPM_BUILD_ROOT}%{_libdir}" \
+  ${RPM_BUILD_ROOT}%{_bindir}/named-checkconf ${RPM_BUILD_ROOT}%{_sysconfdir}/named.root.key
+
 %if %{with UNITTEST}
-  pushd build
   CPUS=$(lscpu -p=cpu,core | grep -v '^#' | wc -l)
   THREADS="$CPUS"
   COREPATTERN="$(cat /proc/sys/kernel/core_pattern)"
@@ -443,30 +441,17 @@ export TSAN_OPTIONS="log_exe_name=true log_path=ThreadSanitizer exitcode=0"
   if [ "$CPUS" -gt 16 ]; then
     ORIGFILES=$(ulimit -n)
     THREADS=16
+    export ISC_TASK_WORKERS="$THREADS"
     ulimit -n 8092 || : # Requires on some machines with many cores
   fi
-  echo "core.%%P" > /proc/sys/kernel/core_pattern || :
   e=0
-  %make_build unit -j${THREADS} || e=$?
+  %meson_test --num-processes ${THREADS} || e=$?
-  # Display details of failure
-  cat tests/*/test-suite.log
 
-  echo "$COREPATTERN" > /proc/sys/kernel/core_pattern || :
   if [ "$e" -ne 0 ]; then
-    echo "ERROR: this build of BIND failed 'make unit'. Aborting."
+    echo "ERROR: test failed. Aborting."
-    for CORE in $(find -name 'core.*'); do
-      echo "# Found core: $CORE"
-      gdb --batch -ex 'bt full' -c "$CORE"
-      echo
-      xz -k "$CORE"
-      echo "# core base64 begin: $CORE"
-      base64 "$CORE.xz"
-      echo "# core base64 end: $CORE"
-    done
     exit $e;
   fi;
   [ "$CPUS" -gt 16 ] && ulimit -n $ORIGFILES || :
-  popd
 ## End of UNITTEST
 %endif
 
@@ -474,7 +459,7 @@ export TSAN_OPTIONS="log_exe_name=true log_path=ThreadSanitizer exitcode=0"
 # Runs system test if ip addresses are already configured
 # or it is able to configure them
   SUDO=
-  pushd build/bin/tests/system/
+  pushd bin/tests/system/
   if perl ./testsock.pl
   then
     CONFIGURED=already
@@ -494,18 +479,23 @@ export TSAN_OPTIONS="log_exe_name=true log_path=ThreadSanitizer exitcode=0"
 
   if [ -n "$CONFIGURED" ]
   then
-    set -e
+    pushd bin/tests/system
-    pushd build/bin/tests
     export CI_SYSTEM=yes # allow running tests as root
     chown -R ${USER} . # Can be unknown user
-    %make_build test 2>&1 | tee test.log
+    e=0
-    e=$?
+    pytest -n ${THREADS} --capture=tee-sys || e=$?
     [ "$CONFIGURED" = build ] && $SUDO sh ./ifconfig.sh down
-    popd
     if [ "$e" -ne 0 ]; then
-      echo "ERROR: this build of BIND failed 'make test'. Aborting."
+      echo "ERROR: failed running 'pytest' in system tests. Aborting."
+      ls -1 "$(pwd)"/*_tmp_*
+      for TMPTEST in *_tmp_*
+      do
+        echo "# $TMPTEST"
+        cat $TMPTEST/pytest.log.txt
+      done
       exit $e;
     fi;
+    popd
   else
     echo 'SKIPPED: tests require root, CAP_NET_ADMIN or already configured test addresses.'
   fi
@@ -536,9 +526,7 @@ popd
 touch ${RPM_BUILD_ROOT}/%{chroot_prefix}%{_sysconfdir}/named.conf
 #end chroot
 
-pushd build
+%meson_install
-%make_install
-popd
 
 # Remove unwanted files
 rm -f ${RPM_BUILD_ROOT}/etc/bind.keys
@@ -585,8 +573,9 @@ popd
 
 %if %{with DOC}
 mkdir -p ${RPM_BUILD_ROOT}%{_pkgdocdir}
-cp -a build/doc/arm/_build/html ${RPM_BUILD_ROOT}%{_pkgdocdir}
+pushd %{_vpath_builddir}
-rm -rf ${RPM_BUILD_ROOT}%{_pkgdocdir}/html/.{buildinfo,doctrees}
+cp -a arm/ ${RPM_BUILD_ROOT}%{_pkgdocdir}/html/
+#rm -rf ${RPM_BUILD_ROOT}%{_pkgdocdir}/html/.{buildinfo,doctrees}
 # Backward compatible link to 9.11 documentation
 (cd ${RPM_BUILD_ROOT}%{_pkgdocdir} && ln -s html/index.html Bv9ARM.html)
 # Share static data from original sphinx package
@@ -599,7 +588,10 @@ do
     ln -sr "${RPM_BUILD_ROOT}${DIR}" "$BINDTHEMEDIR"
   fi
 done
-cp -p build/doc/arm/_build/epub/Bv9ARM.epub ${RPM_BUILD_ROOT}%{_pkgdocdir}
+cp -p arm-epub/Bv9ARM.epub ${RPM_BUILD_ROOT}%{_pkgdocdir}
+popd
+cp -p doc/changelog/changelog-history.rst* doc/notes/notes-*.rst* \
+      ${RPM_BUILD_ROOT}%{_pkgdocdir}
 %endif
 
 # Ghost config files:
@@ -608,13 +600,13 @@ touch ${RPM_BUILD_ROOT}%{_localstatedir}/log/named.log
 # configuration files:
 install -m 640 %{SOURCE16} ${RPM_BUILD_ROOT}%{_sysconfdir}/named.conf
 touch ${RPM_BUILD_ROOT}%{_sysconfdir}/rndc.{key,conf}
-install -m 644 %{SOURCE27} ${RPM_BUILD_ROOT}%{_sysconfdir}/named.root.key
+install -m 644 -p named.root.key ${RPM_BUILD_ROOT}%{_sysconfdir}/named.root.key
-install -m 644 %{SOURCE36} ${RPM_BUILD_ROOT}%{_sysconfdir}/trusted-key.key
+ln -s "%{_datadir}/dns-root-data/root.key" ${RPM_BUILD_ROOT}%{_sysconfdir}/trusted-key.key
 mkdir -p ${RPM_BUILD_ROOT}%{_sysconfdir}/named
 
 # data files:
 mkdir -p ${RPM_BUILD_ROOT}%{_localstatedir}/named
-install -m 640 %{SOURCE17} ${RPM_BUILD_ROOT}%{_localstatedir}/named/named.ca
+ln -s "%{_datadir}/dns-root-data/root.hints" ${RPM_BUILD_ROOT}%{_localstatedir}/named/named.ca
 install -m 640 %{SOURCE18} ${RPM_BUILD_ROOT}%{_localstatedir}/named/named.localhost
 install -m 640 %{SOURCE19} ${RPM_BUILD_ROOT}%{_localstatedir}/named/named.loopback
 install -m 640 %{SOURCE20} ${RPM_BUILD_ROOT}%{_localstatedir}/named/named.empty
@@ -627,7 +619,7 @@ install -m 644 %{SOURCE25} sample/etc/named.conf
 install -m 644 %{SOURCE16} named.conf.default
 install -m 644 %{SOURCE23} sample/etc/named.rfc1912.zones
 install -m 644 %{SOURCE18} %{SOURCE19} %{SOURCE20}  sample/var/named
-install -m 644 %{SOURCE17} sample/var/named/named.ca
+ln -s "%{_datadir}/dns-root-data/root.hints" sample/var/named/named.ca
 for f in my.internal.zone.db slaves/my.slave.internal.zone.db slaves/my.ddns.internal.zone.db my.external.zone.db; do 
   echo '@ in soa localhost. root 1 3H 15M 1W 1D
   ns localhost.' > sample/var/named/$f; 
@@ -733,6 +725,7 @@ fi;
 # FIXME: current build targets filters into %%_libdir/bind again?
 %dir %{_libdir}/bind
 %{_libdir}/bind/filter*.so
+%{_libdir}/bind/synthrecord.so
 %dir %{_libdir}/named
 %config(noreplace) %verify(not md5 size mtime) %{_sysconfdir}/sysconfig/named
 %config(noreplace) %attr(0644,root,named) %{_sysconfdir}/named.root.key
@@ -745,6 +738,7 @@ fi;
 %{_bindir}/named-journalprint
 %{_bindir}/named-checkconf
 %{_bindir}/named-rrchecker
+%{_bindir}/named-makejournal
 %{_bindir}/mdig
 %{_sbindir}/named
 %{_sbindir}/rndc*
@@ -762,7 +756,8 @@ fi;
 %{_mandir}/man1/named-checkconf.1*
 %{_mandir}/man8/rndc-confgen.8*
 %{_mandir}/man1/named-journalprint.1*
-%{_mandir}/man8/filter-*.8.gz
+%{_mandir}/man1/named-makejournal.1*
+%{_mandir}/man8/filter-*.8*
 %doc README.md named.conf.default
 %doc doc/changelog/changelog-9.*.rst*
 %doc sample/
@@ -798,8 +793,6 @@ fi;
 %{_libdir}/libdns-%{version}*.so
 %{_libdir}/libisc-%{version}*.so
 %{_libdir}/libisccfg-%{version}*.so
-
-%files license
 %{!?_licensedir:%global license %%doc}
 %license COPYRIGHT
 
@@ -844,6 +837,8 @@ fi;
 %{_bindir}/dnssec*
 %{_mandir}/man1/dnssec*.1*
 
+%if 0
+# TODO: remove devel subpackage or create custom installation part
 %files devel
 %{_libdir}/libisccc.so
 %{_libdir}/libns.so
@@ -858,6 +853,7 @@ fi;
 %{_includedir}/bind9/irs
 %{_includedir}/bind9/isc
 %{_includedir}/bind9/isccfg
+%endif
 
 %files chroot
 %config(noreplace) %{_sysconfdir}/named-chroot.files
@@ -904,8 +900,9 @@ fi;
 %doc %{_pkgdocdir}/html
 %doc %{_pkgdocdir}/Bv9ARM.html
 %doc %{_pkgdocdir}/Bv9ARM.epub
-%doc doc/changelog/changelog-history.rst*
+%doc %{_pkgdocdir}/changelog-history.rst*
-%doc doc/notes/notes-*.rst*
+%doc %{_pkgdocdir}/notes-*.rst*
+%license COPYRIGHT
 %endif
 
 %changelog

named-chroot.files

@@ -18,6 +18,7 @@
 /usr/lib64/bind
 /usr/lib/bind
 /usr/share/GeoIP
+/usr/share/dns-root-data
 /run/named
 /proc/sys/net/ipv4/ip_local_port_range
 # Warning: the order is important

named-mkroot.sh

@@ -0,0 +1,20 @@
+#!/bin/sh
+# Create named.root.key from dns-root-data package
+
+ROOT_DS=/usr/share/dns-root-data/root.ds
+: ${OUTPUT:=named.root.key}
+
+if ! [ -r "$ROOT_DS" ]; then
+	echo "Root trust file is not readable: $ROOT_DS"
+	exit 1
+fi
+
+echo "# Autogenerated from $ROOT_DS" > "$OUTPUT"
+echo "trust-anchors {" >> "$OUTPUT"
+cat "$ROOT_DS" | while read DOMAIN CLS QTYPE KEYTAG ALG DIG HASH;
+do
+	echo "$DOMAIN initial-ds $KEYTAG $ALG $DIG \"$HASH\";" >> "$OUTPUT";
+done
+echo "}; " >> "$OUTPUT"
+# Set the same modification time as data source.
+touch -r $ROOT_DS "$OUTPUT"

named.logrotate

@@ -2,11 +2,8 @@
     missingok
     su named named
     create 0644 named named
+    notifempty
     postrotate
-        /usr/bin/systemctl reload named.service > /dev/null 2>&1 || true
+        /usr/bin/rndc closelogs > /dev/null 2>&1 || true
-        /usr/bin/systemctl reload named-chroot.service > /dev/null 2>&1 || true
-        /usr/bin/systemctl reload named-sdb.service > /dev/null 2>&1 || true
-        /usr/bin/systemctl reload named-sdb-chroot.service > /dev/null 2>&1 || true
-        /usr/bin/systemctl reload named-pkcs11.service > /dev/null 2>&1 || true
     endscript
 }

named.root

@@ -1,92 +0,0 @@
-;       This file holds the information on root name servers needed to 
-;       initialize cache of Internet domain name servers
-;       (e.g. reference this file in the "cache  .  <file>"
-;       configuration file of BIND domain name servers). 
-; 
-;       This file is made available by InterNIC 
-;       under anonymous FTP as
-;           file                /domain/named.cache 
-;           on server           FTP.INTERNIC.NET
-;       -OR-                    RS.INTERNIC.NET
-;
-;       last update:     December 20, 2023
-;       related version of root zone:     2023122001
-; 
-; FORMERLY NS.INTERNIC.NET 
-;
-.                        3600000      NS    A.ROOT-SERVERS.NET.
-A.ROOT-SERVERS.NET.      3600000      A     198.41.0.4
-A.ROOT-SERVERS.NET.      3600000      AAAA  2001:503:ba3e::2:30
-; 
-; FORMERLY NS1.ISI.EDU 
-;
-.                        3600000      NS    B.ROOT-SERVERS.NET.
-B.ROOT-SERVERS.NET.      3600000      A     170.247.170.2
-B.ROOT-SERVERS.NET.      3600000      AAAA  2801:1b8:10::b
-; 
-; FORMERLY C.PSI.NET 
-;
-.                        3600000      NS    C.ROOT-SERVERS.NET.
-C.ROOT-SERVERS.NET.      3600000      A     192.33.4.12
-C.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:2::c
-; 
-; FORMERLY TERP.UMD.EDU 
-;
-.                        3600000      NS    D.ROOT-SERVERS.NET.
-D.ROOT-SERVERS.NET.      3600000      A     199.7.91.13
-D.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:2d::d
-; 
-; FORMERLY NS.NASA.GOV
-;
-.                        3600000      NS    E.ROOT-SERVERS.NET.
-E.ROOT-SERVERS.NET.      3600000      A     192.203.230.10
-E.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:a8::e
-; 
-; FORMERLY NS.ISC.ORG
-;
-.                        3600000      NS    F.ROOT-SERVERS.NET.
-F.ROOT-SERVERS.NET.      3600000      A     192.5.5.241
-F.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:2f::f
-; 
-; FORMERLY NS.NIC.DDN.MIL
-;
-.                        3600000      NS    G.ROOT-SERVERS.NET.
-G.ROOT-SERVERS.NET.      3600000      A     192.112.36.4
-G.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:12::d0d
-; 
-; FORMERLY AOS.ARL.ARMY.MIL
-;
-.                        3600000      NS    H.ROOT-SERVERS.NET.
-H.ROOT-SERVERS.NET.      3600000      A     198.97.190.53
-H.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:1::53
-; 
-; FORMERLY NIC.NORDU.NET
-;
-.                        3600000      NS    I.ROOT-SERVERS.NET.
-I.ROOT-SERVERS.NET.      3600000      A     192.36.148.17
-I.ROOT-SERVERS.NET.      3600000      AAAA  2001:7fe::53
-; 
-; OPERATED BY VERISIGN, INC.
-;
-.                        3600000      NS    J.ROOT-SERVERS.NET.
-J.ROOT-SERVERS.NET.      3600000      A     192.58.128.30
-J.ROOT-SERVERS.NET.      3600000      AAAA  2001:503:c27::2:30
-; 
-; OPERATED BY RIPE NCC
-;
-.                        3600000      NS    K.ROOT-SERVERS.NET.
-K.ROOT-SERVERS.NET.      3600000      A     193.0.14.129
-K.ROOT-SERVERS.NET.      3600000      AAAA  2001:7fd::1
-; 
-; OPERATED BY ICANN
-;
-.                        3600000      NS    L.ROOT-SERVERS.NET.
-L.ROOT-SERVERS.NET.      3600000      A     199.7.83.42
-L.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:9f::42
-; 
-; OPERATED BY WIDE
-;
-.                        3600000      NS    M.ROOT-SERVERS.NET.
-M.ROOT-SERVERS.NET.      3600000      A     202.12.27.33
-M.ROOT-SERVERS.NET.      3600000      AAAA  2001:dc3::35
-; End of file

named.root.key

@@ -1,18 +1,5 @@
-trust-anchors {
+# Autogenerated from /usr/share/dns-root-data/root.ds
-        # ROOT KEYS: See https://data.iana.org/root-anchors/root-anchors.xml
+truste-anchors {
-        # for current trust anchor information.
+. initial-ds 20326 8 2 "E06D44B80B8F1D39A95C0B0D7C65D08458E880409BBC683457104237C7F8EC8D";
-        #
+. initial-ds 38696 8 2 "683D2D0ACB8C9B712A1948B27F741219298D0A450D612C483AF444A4C0FB2B16";
-        # This key (20326) was published in the root zone in 2017.
+}; 
-        # Servers which were already using the old key (19036) should
-        # roll seamlessly to this new one via RFC 5011 rollover. Servers
-        # being set up for the first time can use the contents of this
-        # file as initializing keys; thereafter, the keys in the
-        # managed key database will be trusted and maintained
-        # automatically.
-        . initial-ds 20326 8 2 "E06D44B80B8F1D39A95C0B0D7C65D08458E880409BBC683457104237C7F8EC8D";
-        # This key (38696) will be pre-published in the root zone in 2025
-        # and is scheduled to begin signing in late 2026. At that time,
-        # servers which were already using the old key (20326) should roll
-        # seamlessly to this new one via RFC 5011 rollover.
-        . initial-ds 38696 8 2 "683D2D0ACB8C9B712A1948B27F741219298D0A450D612C483AF444A4C0FB2B16";
-};

sources

@@ -1,2 +1,2 @@
-SHA512 (bind-9.21.8.tar.xz) = 8fdba5fa9e8c4659119074b54477d22bfb7301f6244f8df8df9f4b45f0512374a071c0d0d3f0f8e06f668fa59aa8a56d269900b6f6431461a770f11e21443d19
+SHA512 (bind-9.21.20.tar.xz) = 4bd65612ff851720eba7f88495d51eb8a41b6a946c377b9dcd62f58f8c5a3e9338af44abc9df76b2ead9461eca4eb81f088619e3cc481f35fa0fc5d0926a93e3
-SHA512 (bind-9.21.8.tar.xz.asc) = c48d2e3607a4c346ff12be6da43a9103ab935058662a14bd20abe5193db8cdede38a52bc59a1ad45ff1264f72a6175c61266edab92df3a3771580fd20d0570fb
+SHA512 (bind-9.21.20.tar.xz.asc) = 7431540d942fe23222b2812f9d80e67d0fa38516f9d536095a6544b156dc0306aba5752ba6c03cc2935d92a74860e70e8fc53b4cb481b8afe226e49dd51f695f

trusted-key.key

@@ -1,2 +0,0 @@
-. 3600 IN DNSKEY 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU=
-. 3600 IN DNSKEY 257 3 8 AwEAAa96jeuknZlaeSrvyAJj6ZHv28hhOKkx3rLGXVaC6rXTsDc449/cidltpkyGwCJNnOAlFNKF2jBosZBU5eeHspaQWOmOElZsjICMQMC3aeHbGiShvZsx4wMYSjH8e7Vrhbu6irwCzVBApESjbUdpWWmEnhathWu1jo+siFUiRAAxm9qyJNg/wOZqqzL/dL/q8PkcRU5oUKEpUge71M3ej2/7CPqpdVwuMoTvoB+ZOT4YeGyxMvHmbrxlFzGOHOijtzN+u1TQNatX2XBuzZNQ1K+s2CXkPIZo7s6JgZyvaBevYtxPvYLw4z9mR7K2vaF18UYH9Z9GNUUeayffKC73PYc=