39 changed files with 4762 additions and 3429 deletions
--- a/.gitignore
+++ b/.gitignore
@ -198,39 +198,3 @@ bind-9.7.2b1.tar.gz
 /bind-9.19.8.tar.xz.asc
 /bind-9.19.9.tar.xz
 /bind-9.19.9.tar.xz.asc
-/bind-9.19.10.tar.xz
-/bind-9.19.10.tar.xz.asc
-/bind-9.19.11.tar.xz
-/bind-9.19.11.tar.xz.asc
-/bind-9.19.12.tar.xz
-/bind-9.19.12.tar.xz.asc
-/bind-9.19.13.tar.xz
-/bind-9.19.13.tar.xz.asc
-/bind-9.19.14.tar.xz
-/bind-9.19.14.tar.xz.asc
-/bind-9.19.15.tar.xz
-/bind-9.19.15.tar.xz.asc
-/bind-9.19.16.tar.xz
-/bind-9.19.16.tar.xz.asc
-/bind-9.19.17.tar.xz
-/bind-9.19.17.tar.xz.asc
-/bind-9.19.18.tar.xz
-/bind-9.19.18.tar.xz.asc
-/bind-9.19.19.tar.xz
-/bind-9.19.19.tar.xz.asc
-/bind-9.19.21.tar.xz
-/bind-9.19.21.tar.xz.asc
-/bind-9.19.22.tar.xz
-/bind-9.19.22.tar.xz.asc
-/bind-9.19.24.tar.xz
-/bind-9.19.24.tar.xz.asc
-/bind-9.21.0.tar.xz
-/bind-9.21.0.tar.xz.asc
-/bind-9.21.2.tar.xz
-/bind-9.21.2.tar.xz.asc
-/bind-9.21.3.tar.xz
-/bind-9.21.3.tar.xz.asc
-/bind-9.21.4.tar.xz
-/bind-9.21.4.tar.xz.asc
-/bind-9.21.*.tar.xz
-/bind-9.21.*.tar.xz.asc
--- a/README.md
+++ b/README.md
@ -26,9 +26,13 @@ The package contains several subpackages, some of them can be disabled on rebuil
 * **bind9-next** -- *named* daemon providing DNS server
 * **bind9-next-utils** -- set of tools to analyse DNS responses or update entries (dig, host)
 * **bind9-next-doc** -- documentation for current bind, *BIND 9 Administrator Reference Manual*.
+* **bind9-next-license** -- Shared license for all packages but bind-export-libs.
 * **bind9-next-libs** -- Shared libraries used by some others programs
+* **bind9-next-devel** -- Development headers for libs. Can be disabled by `--without DEVEL`
+

 ## Optional features

 * *GSSTSIG* -- Support for Kerberos authentication in BIND.
 * *LMDB* -- Support for dynamic database for managing runtime added zones. Provides faster removal of added zone with much less overhead. But requires lmdb linked to base libs.
+* *DLZ* -- Support for dynamic loaded modules providing support for features *bind-sdb* provides, but only small module is required.
--- a/bind-9.11-fips-tests.patch
+++ b/bind-9.11-fips-tests.patch
@ -0,0 +1,309 @@
+From 75c029a38b59deb4f1b1861faf9113220e438253 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
+Date: Thu, 2 Aug 2018 23:46:45 +0200
+Subject: [PATCH] FIPS tests changes for RHEL
+
+Include MD5 feature detection in featuretest tool and use it in some
+places. When RHEL distribution or Fedora ELN is in FIPS mode, then MD5
+algorithm is unavailable completely and even hmac-md5 algorithm usage
+will always fail. Work that around by checking MD5 works and if not,
+skipping its usage.
+
+Those changes were dragged as downstream patch bind-9.11-fips-tests.patch
+in Fedora and RHEL.
+---
+ bin/tests/system/acl/tests.sh           |  2 +-
+ bin/tests/system/feature-test.c         | 14 ++++++
+ bin/tests/system/nsupdate/setup.sh      |  6 ++-
+ bin/tests/system/nsupdate/tests.sh      | 11 +++-
+ bin/tests/system/rndc/setup.sh          |  2 +-
+ bin/tests/system/rndc/tests.sh          | 22 ++++----
+ bin/tests/system/tsig/ns1/named.conf.in | 10 +---
+ bin/tests/system/tsig/setup.sh          | 16 ++++++
+ bin/tests/system/tsig/tests.sh          | 67 +++++++++++++++----------
+ 9 files changed, 102 insertions(+), 48 deletions(-)
+
+diff --git a/bin/tests/system/acl/tests.sh b/bin/tests/system/acl/tests.sh
+index df23d6a2f1..0984d85ed9 100644
+--- a/bin/tests/system/acl/tests.sh
+++ b/bin/tests/system/acl/tests.sh
+@@ -98,7 +98,7 @@ grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $tt failed" ; status=1
+ # and other values? right out
+ t=`expr $t + 1`
+ $DIG $DIGOPTS tsigzone. \
+-	@10.53.0.2 -b 127.0.0.1 axfr -y three:1234abcd8765 > dig.out.${t}
+	@10.53.0.2 -b 127.0.0.1 axfr -y "${DEFAULT_HMAC}:three:1234abcd8765" > dig.out.${t}
+ grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }
+ 
+ # now we only allow 10.53.0.1 *and* key one, or 10.53.0.2 *and* key two
+diff --git a/bin/tests/system/feature-test.c b/bin/tests/system/feature-test.c
+index b1adaedade..4dd76fb187 100644
+--- a/bin/tests/system/feature-test.c
+++ b/bin/tests/system/feature-test.c
+@@ -17,6 +17,7 @@
+ #include <string.h>
+ #include <unistd.h>
+ 
+#include <isc/md.h>
+ #include <isc/net.h>
+ #include <isc/print.h>
+ #include <isc/util.h>
+@@ -143,6 +144,19 @@ main(int argc, char **argv) {
+ #endif
+ 	}
+ 
+	if (strcmp(argv[1], "--md5") == 0) {
+		unsigned char digest[ISC_MAX_MD_SIZE];
+		const unsigned char test[] = "test";
+		unsigned int size = sizeof(digest);
+
+		if (isc_md(ISC_MD_MD5, test, sizeof(test), digest, &size) ==
+		    ISC_R_SUCCESS) {
+			return (0);
+		} else {
+			return (1);
+		}
+	}
+
+ 	if (strcmp(argv[1], "--ipv6only=no") == 0) {
+ #if defined(IPPROTO_IPV6) && defined(IPV6_V6ONLY)
+ 		int s;
+diff --git a/bin/tests/system/nsupdate/setup.sh b/bin/tests/system/nsupdate/setup.sh
+index b7d7b38107..25c4cb4d8b 100644
+--- a/bin/tests/system/nsupdate/setup.sh
+++ b/bin/tests/system/nsupdate/setup.sh
+@@ -73,7 +73,11 @@ EOF
+ 
+ $TSIGKEYGEN ddns-key.example.nil > ns1/ddns.key
+ 
+-$TSIGKEYGEN -a hmac-md5 md5-key > ns1/md5.key
+if $FEATURETEST --md5; then
+	$TSIGKEYGEN -a hmac-md5 md5-key > ns1/md5.key
+else
+	echo -n > ns1/md5.key
+fi
+ $TSIGKEYGEN -a hmac-sha1 sha1-key > ns1/sha1.key
+ $TSIGKEYGEN -a hmac-sha224 sha224-key > ns1/sha224.key
+ $TSIGKEYGEN -a hmac-sha256 sha256-key > ns1/sha256.key
+diff --git a/bin/tests/system/nsupdate/tests.sh b/bin/tests/system/nsupdate/tests.sh
+index 5adc99ce5c..54e1d531a6 100755
+--- a/bin/tests/system/nsupdate/tests.sh
+++ b/bin/tests/system/nsupdate/tests.sh
+@@ -959,7 +959,14 @@ fi
+ n=$((n + 1))
+ ret=0
+ echo_i "check TSIG key algorithms (nsupdate -k) ($n)"
+-for alg in md5 sha1 sha224 sha256 sha384 sha512; do
+if $FEATURETEST --md5
+then
+	ALGS="md5 sha1 sha224 sha256 sha384 sha512"
+else
+	ALGS="sha1 sha224 sha256 sha384 sha512"
+	echo_i "skipping disabled md5 algorithm"
+fi
+for alg in $ALGS; do
+     $NSUPDATE -k ns1/${alg}.key <<END > /dev/null || ret=1
+ server 10.53.0.1 ${PORT}
+ update add ${alg}.keytests.nil. 600 A 10.10.10.3
+@@ -967,7 +974,7 @@ send
+ END
+ done
+ sleep 2
+-for alg in md5 sha1 sha224 sha256 sha384 sha512; do
+for alg in $ALGS; do
+     $DIG $DIGOPTS +short @10.53.0.1 ${alg}.keytests.nil | grep 10.10.10.3 > /dev/null 2>&1 || ret=1
+ done
+ if [ $ret -ne 0 ]; then
+diff --git a/bin/tests/system/rndc/setup.sh b/bin/tests/system/rndc/setup.sh
+index a8793f36d9..e6714c0991 100644
+--- a/bin/tests/system/rndc/setup.sh
+++ b/bin/tests/system/rndc/setup.sh
+@@ -48,7 +48,7 @@ make_key () {
+             sed 's/allow { 10.53.0.4/allow { any/' >> ns4/named.conf
+ }
+ 
+-make_key 1 ${EXTRAPORT1} hmac-md5
+$FEATURETEST --md5 && make_key 1 ${EXTRAPORT1} hmac-md5
+ make_key 2 ${EXTRAPORT2} hmac-sha1
+ make_key 3 ${EXTRAPORT3} hmac-sha224
+ make_key 4 ${EXTRAPORT4} hmac-sha256
+diff --git a/bin/tests/system/rndc/tests.sh b/bin/tests/system/rndc/tests.sh
+index 424ac2befe..27219a3df8 100644
+--- a/bin/tests/system/rndc/tests.sh
+++ b/bin/tests/system/rndc/tests.sh
+@@ -350,15 +350,19 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
+ status=$((status+ret))
+ 
+ n=$((n+1))
+-echo_i "testing rndc with hmac-md5 ($n)"
+-ret=0
+-$RNDC -s 10.53.0.4 -p ${EXTRAPORT1} -c ns4/key1.conf status > /dev/null 2>&1 || ret=1
+-for i in 2 3 4 5 6
+-do
+-        $RNDC -s 10.53.0.4 -p ${EXTRAPORT1} -c ns4/key${i}.conf status > /dev/null 2>&1 && ret=1
+-done
+-if [ $ret != 0 ]; then echo_i "failed"; fi
+-status=$((status+ret))
+if $FEATURETEST --md5; then
+	echo_i "testing rndc with hmac-md5 ($n)"
+	ret=0
+	$RNDC -s 10.53.0.4 -p ${EXTRAPORT1} -c ns4/key1.conf status > /dev/null 2>&1 || ret=1
+	for i in 2 3 4 5 6
+	do
+	        $RNDC -s 10.53.0.4 -p ${EXTRAPORT1} -c ns4/key${i}.conf status > /dev/null 2>&1 && ret=1
+	done
+	if [ $ret != 0 ]; then echo_i "failed"; fi
+	status=$((status+ret))
+else
+	echo_i "skipping rndc with hmac-md5 ($n)"
+fi
+ 
+ n=$((n+1))
+ echo_i "testing rndc with hmac-sha1 ($n)"
+diff --git a/bin/tests/system/tsig/ns1/named.conf.in b/bin/tests/system/tsig/ns1/named.conf.in
+index 76cf970397..22637af901 100644
+--- a/bin/tests/system/tsig/ns1/named.conf.in
+++ b/bin/tests/system/tsig/ns1/named.conf.in
+@@ -23,10 +23,7 @@ options {
+ 	notify no;
+ };
+ 
+-key "md5" {
+-	secret "97rnFx24Tfna4mHPfgnerA==";
+-	algorithm hmac-md5;
+-};
+# md5 key appended by setup.sh at the end
+ 
+ key "sha1" {
+ 	secret "FrSt77yPTFx6hTs4i2tKLB9LmE0=";
+@@ -53,10 +50,7 @@ key "sha512" {
+ 	algorithm hmac-sha512;
+ };
+ 
+-key "md5-trunc" {
+-	secret "97rnFx24Tfna4mHPfgnerA==";
+-	algorithm hmac-md5-80;
+-};
+# md5-trunc key appended by setup.sh at the end
+ 
+ key "sha1-trunc" {
+ 	secret "FrSt77yPTFx6hTs4i2tKLB9LmE0=";
+diff --git a/bin/tests/system/tsig/setup.sh b/bin/tests/system/tsig/setup.sh
+index 34cc73bf53..6a739f7eb1 100644
+--- a/bin/tests/system/tsig/setup.sh
+++ b/bin/tests/system/tsig/setup.sh
+@@ -16,3 +16,19 @@
+ $SHELL clean.sh
+ 
+ copy_setports ns1/named.conf.in ns1/named.conf
+
+if $FEATURETEST --md5
+then
+	cat >> ns1/named.conf << EOF
+# Conditionally included when support for MD5 is available
+key "md5" {
+        secret "97rnFx24Tfna4mHPfgnerA==";
+        algorithm hmac-md5;
+};
+
+key "md5-trunc" {
+        secret "97rnFx24Tfna4mHPfgnerA==";
+        algorithm hmac-md5-80;
+};
+EOF
+fi
+diff --git a/bin/tests/system/tsig/tests.sh b/bin/tests/system/tsig/tests.sh
+index 106722741c..ee05e838c1 100644
+--- a/bin/tests/system/tsig/tests.sh
+++ b/bin/tests/system/tsig/tests.sh
+@@ -27,20 +27,25 @@ sha512="jI/Pa4qRu96t76Pns5Z/Ndxbn3QCkwcxLOgt9vgvnJw5wqTRvNyk3FtD6yIMd1dWVlqZ+Y4f
+ 
+ status=0
+ 
+-echo_i "fetching using hmac-md5 (old form)"
+-ret=0
+-$DIG $DIGOPTS example.nil. -y "md5:$md5" @10.53.0.1 soa > dig.out.md5.old || ret=1
+-grep -i "md5.*TSIG.*NOERROR" dig.out.md5.old > /dev/null || ret=1
+-if [ $ret -eq 1 ] ; then
+-	echo_i "failed"; status=1
+-fi
+-
+-echo_i "fetching using hmac-md5 (new form)"
+-ret=0
+-$DIG $DIGOPTS example.nil. -y "hmac-md5:md5:$md5" @10.53.0.1 soa > dig.out.md5.new || ret=1
+-grep -i "md5.*TSIG.*NOERROR" dig.out.md5.new > /dev/null || ret=1
+-if [ $ret -eq 1 ] ; then
+-	echo_i "failed"; status=1
+if $FEATURETEST --md5
+then
+	echo_i "fetching using hmac-md5 (old form)"
+	ret=0
+	$DIG $DIGOPTS example.nil. -y "md5:$md5" @10.53.0.1 soa > dig.out.md5.old || ret=1
+	grep -i "md5.*TSIG.*NOERROR" dig.out.md5.old > /dev/null || ret=1
+	if [ $ret -eq 1 ] ; then
+		echo_i "failed"; status=1
+	fi
+
+	echo_i "fetching using hmac-md5 (new form)"
+	ret=0
+	$DIG $DIGOPTS example.nil. -y "hmac-md5:md5:$md5" @10.53.0.1 soa > dig.out.md5.new || ret=1
+	grep -i "md5.*TSIG.*NOERROR" dig.out.md5.new > /dev/null || ret=1
+	if [ $ret -eq 1 ] ; then
+		echo_i "failed"; status=1
+	fi
+else
+	echo_i "skipping using hmac-md5"
+ fi
+ 
+ echo_i "fetching using hmac-sha1"
+@@ -88,12 +93,17 @@ fi
+ #	Truncated TSIG
+ #
+ #
+-echo_i "fetching using hmac-md5 (trunc)"
+-ret=0
+-$DIG $DIGOPTS example.nil. -y "hmac-md5-80:md5-trunc:$md5" @10.53.0.1 soa > dig.out.md5.trunc || ret=1
+-grep -i "md5-trunc.*TSIG.*NOERROR" dig.out.md5.trunc > /dev/null || ret=1
+-if [ $ret -eq 1 ] ; then
+-	echo_i "failed"; status=1
+if $FEATURETEST --md5
+then
+	echo_i "fetching using hmac-md5 (trunc)"
+	ret=0
+	$DIG $DIGOPTS example.nil. -y "hmac-md5-80:md5-trunc:$md5" @10.53.0.1 soa > dig.out.md5.trunc || ret=1
+	grep -i "md5-trunc.*TSIG.*NOERROR" dig.out.md5.trunc > /dev/null || ret=1
+	if [ $ret -eq 1 ] ; then
+		echo_i "failed"; status=1
+	fi
+else
+	echo_i "skipping using hmac-md5 (trunc)"
+ fi
+ 
+ echo_i "fetching using hmac-sha1 (trunc)"
+@@ -142,12 +152,17 @@ fi
+ #	Check for bad truncation.
+ #
+ #
+-echo_i "fetching using hmac-md5-80 (BADTRUNC)"
+-ret=0
+-$DIG $DIGOPTS example.nil. -y "hmac-md5-80:md5:$md5" @10.53.0.1 soa > dig.out.md5-80 || ret=1
+-grep -i "md5.*TSIG.*BADTRUNC" dig.out.md5-80 > /dev/null || ret=1
+-if [ $ret -eq 1 ] ; then
+-	echo_i "failed"; status=1
+if $FEATURETEST --md5
+then
+	echo_i "fetching using hmac-md5-80 (BADTRUNC)" 
+	ret=0
+	$DIG $DIGOPTS example.nil. -y "hmac-md5-80:md5:$md5" @10.53.0.1 soa > dig.out.md5-80 || ret=1
+	grep -i "md5.*TSIG.*BADTRUNC" dig.out.md5-80 > /dev/null || ret=1
+	if [ $ret -eq 1 ] ; then
+		echo_i "failed"; status=1
+	fi
+else
+	echo_i "skipping using hmac-md5-80 (BADTRUNC)" 
+ fi
+ 
+ echo_i "fetching using hmac-sha1-80 (BADTRUNC)"
+-- 
+2.39.0
+
--- a/bind-9.11.12.tar.gz.asc
+++ b/bind-9.11.12.tar.gz.asc
@ -0,0 +1,16 @@
+-----BEGIN PGP SIGNATURE-----
+
+iQIzBAABAgAdFiEErj+seWcR7Fn8AHqkdLtrmky7PTgFAl2WMooACgkQdLtrmky7
+PThv2RAAnXNLYTzXtH6ls29tRm5Hc+D6UaeqcWDNQ4BpkRVhrFxtukalGCi9mmB6
+NPJzFyXmaOW654pypCIuEgqJNFUpDtLzLzT7SUF+mhm+5plsaRSBnh4mq87l5KSp
+twODAPnfCJV+HBk5RmToLEstAbGQ7xEBTyQtZoFkY+V7zEFwENKiCvWsoSWOkYR3
+zXo3sKjc83HV9ShbW/mCtbZf5L0qlbrKOAzqJfAFMhNNJi8kMbmr/Zi2sIfN+Rhv
+g8HQo89Epv6r51yAdeED8idIX4rKjjcEtHrZeDmLdCcdHgSEj2sIlH92Joce6vL0
+S59A0rItIXm6fW8sz6WNpcj4tVtWYbIYjXZ4SPFNkaUrHv8cUekq+5vbI+v07Gh3
+2bhtDsDyTY5I1/AsY/EFmwkCAjUS00jZryBnuJpLB3v5JtUog4ek32yLBzPrqRBo
+1876j4nlXAia8mG0OgJNWZ0gHyUPe/TgfR8fQDLmHxHHlKrJNTEwY6bLW8jzFTX1
+zk510fI1K7J9tiQgf5wcBQ2h3EBlqzDNIJDovoATzLYIf0HKyVegh/vnQdtdEhUR
+1DzJAt3bsBfAP1AFfWPD/ACu5Zdm7SxY1wE/pjkwttDU3sRZqOfuwNBGeolu3cVN
+O9/h1zsyVeVS0ui2vu4+V4EvNitmXsVbG2doDq9L5yBiIKGO2Ew=
+=GCy6
+-----END PGP SIGNATURE-----
--- a/bind-9.14.7.tar.gz.asc
+++ b/bind-9.14.7.tar.gz.asc
@ -0,0 +1,16 @@
+-----BEGIN PGP SIGNATURE-----
+
+iQIzBAABAgAdFiEErj+seWcR7Fn8AHqkdLtrmky7PTgFAl2WMpEACgkQdLtrmky7
+PTh/sg//QbNRAQvADQfwF1PPo+JxB+3WzQ9oJAWeHbOoiubwkUwO9xE+BEnTNd5o
+oM1lSLqFxNykOTaoeJlqPftPod1cxo7lSzkwflugGyB/59wliCpqCg053YV4x9mO
+QggvA/E50+0FI/Om/7v4GHGADu/JE83FovOueWAB0LgqfDSD6QFcNFF9sUJJ4P7r
+FcEXSWj8QbrHMWBKncZUOpD2ECotvtrYmi0DTHl1XfigESDQpWtsnTFuabCCsvkh
+ch9wQRplAes2Mf/aS5tl1y0QKKBFuEjtGiTdgrDl6o9GLnx6CueX5saZehu2EVkr
+fq2vEYUC2lRQSjuxSMMJ3L0TGUcl7+ixlAIISS2K9L5Xx7MhBXt/EH5KiKPfsEet
+3EH+DhxV5uXjDU7MgvREnxT+ssV23e0HWTz4tVVQ9LpvYmWPIgLcSOhHCc57yoQF
+c46V0f69dMWbMAlQ93EZSG274ZvpIszpK8+3hGI3/TuDFFgiQJeJJBFVtYJMle69
+3mEEclfzO7fBiXZFec6nVx2309bL64bafN7zszPKXl4XgoefOfD0v0eWqQT4fxfm
+dnGC0qMqSZs5F+d0fISV5JUUNYzt9PZjvnzqLLGOeTF6l3/n9G1mmNsXcxJ1OEIF
+6qh1oO7JTPjt0MFhKac4QjNQi/Bnp25O3I/PRyWZCbiwXkyvyQU=
+=ZT7s
+-----END PGP SIGNATURE-----
--- a/bind-9.21-unittest-32b-mem.patch
+++ b/bind-9.21-unittest-32b-mem.patch
@ -1,112 +0,0 @@
-From 4623873e588c86c6add4d53708e754e2d6f3e087 Mon Sep 17 00:00:00 2001
-From: Michal Nowak <mnowak@isc.org>
-Date: Wed, 20 May 2026 08:59:49 +0000
-Subject: [PATCH] Make deleg cleanuptests memory assertions 32-bit-safe
-
-Each address entry stored by dns_delegset_addaddr() is an
-isc_netaddrlink_t, whose size depends on sizeof(void *) via the
-ISC_LINK macro (24 bytes of address + two prev/next pointers): 40
-bytes on 64-bit, 32 bytes on 32-bit. The hardcoded 4 MB / 8 MB
-ranges only held on 64-bit, so dns_deleg_cleanuptests failed on
-armv7l with isc_mem_inuse() returning ~3.2 MB.
-
-Express the expected ranges in terms of sizeof(isc_netaddrlink_t)
-so they scale with pointer width, and pull the 99999 entry count
-out into a NENTRIES macro.
-
-Assisted-by: Claude:claude-opus-4-7
---
- tests/dns/deleg_test.c | 30 ++++++++++++++++++++++--------
- 1 file changed, 22 insertions(+), 8 deletions(-)
-
-diff --git a/tests/dns/deleg_test.c b/tests/dns/deleg_test.c
-index d3af6aba966..9497caf2753 100644
--- a/tests/dns/deleg_test.c
-+++ b/tests/dns/deleg_test.c
-@@ -52,6 +52,15 @@ isc_stdtime_now(void) {
- 
- #include <tests/isc.h>
- 
-+/*
-+ * cleanuptests adds NENTRIES address entries to a delegset; each is an
-+ * isc_netaddrlink_t whose size depends on sizeof(void *) via ISC_LINK.
-+ * Express memory expectations in terms of that struct so the test works
-+ * on both 32-bit and 64-bit targets.
-+ */
-+#define NENTRIES       99999
-+#define ENTRIES_MEM(n) ((size_t)(n) * sizeof(isc_netaddrlink_t))
-+
- static void
- shutdownloop(ISC_ATTR_UNUSED void *arg) {
- 	isc_loopmgr_shutdown();
-@@ -587,7 +596,8 @@ cleanuptests_phase3(void *arg) {
- 	dns_delegset_t *delegset = NULL;
- 	isc_result_t result;
- 
-	assert_int_in_range(isc_mem_inuse(db->mctx), 8000000, 8100000);
-+	assert_int_in_range(isc_mem_inuse(db->mctx), ENTRIES_MEM(2 * NENTRIES),
-+			    ENTRIES_MEM(2 * NENTRIES) + 100000);
- 
- 	/*
- 	 * baz. is there, but bar. is gone, as it has been
-@@ -612,7 +622,8 @@ cleanuptests_phase2(void *arg) {
- 	dns_delegset_t *delegset = NULL;
- 	isc_result_t result;
- 
-	assert_int_in_range(isc_mem_inuse(db->mctx), 4000000, 4100000);
-+	assert_int_in_range(isc_mem_inuse(db->mctx), ENTRIES_MEM(NENTRIES),
-+			    ENTRIES_MEM(NENTRIES) + 100000);
- 
- 	/*
- 	 * bar. is there
-@@ -629,10 +640,11 @@ cleanuptests_phase2(void *arg) {
- 	dns_delegset_allocdeleg(delegset, DNS_DELEGTYPE_DELEG_ADDRESSES,
- 				&deleg);
- 
-	for (size_t i = 0; i < 99999; i++) {
-+	for (size_t i = 0; i < NENTRIES; i++) {
- 		addipdeleg(AF_INET6, "1111::2222", delegset, deleg);
- 	}
-	assert_int_in_range(isc_mem_inuse(db->mctx), 8000000, 8100000);
-+	assert_int_in_range(isc_mem_inuse(db->mctx), ENTRIES_MEM(2 * NENTRIES),
-+			    ENTRIES_MEM(2 * NENTRIES) + 100000);
- 	writedb(db, "baz.", 30, &delegset, true);
- 	deleg = NULL;
- 
-@@ -677,11 +689,12 @@ cleanuptests(ISC_ATTR_UNUSED void *arg) {
- 
- 	assert_int_in_range(isc_mem_inuse(db->mctx), 500, 2000);
- 
-	for (size_t i = 0; i < 99999; i++) {
-+	for (size_t i = 0; i < NENTRIES; i++) {
- 		addipdeleg(AF_INET6, "1111::2222", delegset, deleg);
- 	}
- 
-	assert_int_in_range(isc_mem_inuse(db->mctx), 4000000, 4100000);
-+	assert_int_in_range(isc_mem_inuse(db->mctx), ENTRIES_MEM(NENTRIES),
-+			    ENTRIES_MEM(NENTRIES) + 100000);
- 
- 	writedb(db, "stuff.", 10, &delegset, true);
- 	deleg = NULL;
-@@ -694,7 +707,7 @@ cleanuptests(ISC_ATTR_UNUSED void *arg) {
- 	dns_delegset_allocdeleg(delegset, DNS_DELEGTYPE_DELEG_ADDRESSES,
- 				&deleg);
- 
-	for (size_t i = 0; i < 99999; i++) {
-+	for (size_t i = 0; i < NENTRIES; i++) {
- 		addipdeleg(AF_INET6, "1111::2222", delegset, deleg);
- 	}
- 
-@@ -703,7 +716,8 @@ cleanuptests(ISC_ATTR_UNUSED void *arg) {
- 	 * with DB mem context) overmem conditions will be detected, and the
- 	 * expired node will be removed
- 	 */
-	assert_int_in_range(isc_mem_inuse(db->mctx), 8000000, 8100000);
-+	assert_int_in_range(isc_mem_inuse(db->mctx), ENTRIES_MEM(2 * NENTRIES),
-+			    ENTRIES_MEM(2 * NENTRIES) + 100000);
- 	writedb(db, "bar.", 30, &delegset, true);
- 	deleg = NULL;
- 
-- 
-2.54.0
-
--- a/bind-9.21-unittest-qpdb-i386.patch
+++ b/bind-9.21-unittest-qpdb-i386.patch
@ -1,41 +0,0 @@
-From af1e4bf375000fc532c55ff6df841661185a2451 Mon Sep 17 00:00:00 2001
-From: Petr Mensik <pemensik@redhat.com>
-Date: Wed, 28 May 2025 19:40:05 +0200
-Subject: [PATCH] Try rcu_barrier
-
-https://gitlab.isc.org/isc-projects/bind9/-/issues/5328
---
- tests/dns/qpdb_test.c | 3 +++
- 1 file changed, 3 insertions(+)
-
-diff --git a/tests/dns/qpdb_test.c b/tests/dns/qpdb_test.c
-index 1c840e2..b6ad0f4 100644
--- a/tests/dns/qpdb_test.c
-+++ b/tests/dns/qpdb_test.c
-@@ -24,6 +24,7 @@
- #include <cmocka.h>
- 
- #include <isc/lib.h>
-+#include <isc/urcu.h>
- #include <isc/util.h>
- 
- #include <dns/lib.h>
-@@ -170,6 +171,7 @@ ISC_LOOP_TEST_IMPL(overmempurge_bigrdata) {
- 
- 	dns_db_detach(&db);
- 	isc_mem_detach(&mctx);
-+	rcu_barrier();
- 	isc_loopmgr_shutdown();
- }
- 
-@@ -221,6 +223,7 @@ ISC_LOOP_TEST_IMPL(overmempurge_longname) {
- 
- 	dns_db_detach(&db);
- 	isc_mem_detach(&mctx);
-+	rcu_barrier();
- 	isc_loopmgr_shutdown();
- }
- 
-- 
-2.51.0
-
--- a/bind9-next.spec
+++ b/bind9-next.spec
--- a/bind97-exportlib.patch
+++ b/bind97-exportlib.patch
@ -0,0 +1,226 @@
+diff -up bind-9.9.3rc2/isc-config.sh.in.exportlib bind-9.9.3rc2/isc-config.sh.in
+diff -up bind-9.9.3rc2/lib/export/dns/Makefile.in.exportlib bind-9.9.3rc2/lib/export/dns/Makefile.in
+--- bind-9.9.3rc2/lib/export/dns/Makefile.in.exportlib	2013-04-30 08:38:46.000000000 +0200
+++ bind-9.9.3rc2/lib/export/dns/Makefile.in	2013-05-13 10:45:22.574089729 +0200
+@@ -35,9 +35,9 @@ CDEFINES =	-DUSE_MD5 @USE_OPENSSL@ @USE_
+ 
+ CWARNINGS =
+ 
+-ISCLIBS =	../isc/libisc.@A@
+ISCLIBS =	../isc/libisc-export.@A@
+ 
+-ISCDEPLIBS =	../isc/libisc.@A@
+ISCDEPLIBS =	../isc/libisc-export.@A@
+ 
+ LIBS =		@LIBS@
+ 
+@@ -116,29 +116,29 @@ version.@O@: ${srcdir}/version.c
+ 		-DLIBAGE=${LIBAGE} \
+ 		-c ${srcdir}/version.c
+ 
+-libdns.@SA@: ${OBJS}
+libdns-export.@SA@: ${OBJS}
+ 	${AR} ${ARFLAGS} $@ ${OBJS}
+ 	${RANLIB} $@
+ 
+-libdns.la: ${OBJS}
+libdns-export.la: ${OBJS}
+ 	${LIBTOOL_MODE_LINK} \
+-		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libdns.la \
+		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libdns-export.la \
+ 		-rpath ${export_libdir} \
+ 		-version-info ${LIBINTERFACE}:${LIBREVISION}:${LIBAGE} \
+ 		${OBJS} ${ISCLIBS} @DNS_CRYPTO_LIBS@ ${LIBS}
+ 
+-timestamp: libdns.@A@
+timestamp: libdns-export.@A@
+ 	touch timestamp
+ 
+ installdirs:
+ 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${export_libdir}
+ 
+ install:: timestamp installdirs
+-	${LIBTOOL_MODE_INSTALL} ${INSTALL_DATA} libdns.@A@ \
+	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} libdns-export.@A@ \
+ 	${DESTDIR}${export_libdir}/
+ 
+ clean distclean::
+-	rm -f libdns.@A@ timestamp
+	rm -f libdns-export.@A@ timestamp
+ 	rm -f gen code.h include/dns/enumtype.h include/dns/enumclass.h
+ 	rm -f include/dns/rdatastruct.h
+ 
+diff -up bind-9.9.3rc2/lib/export/irs/Makefile.in.exportlib bind-9.9.3rc2/lib/export/irs/Makefile.in
+--- bind-9.9.3rc2/lib/export/irs/Makefile.in.exportlib	2013-04-30 08:38:46.000000000 +0200
+++ bind-9.9.3rc2/lib/export/irs/Makefile.in	2013-05-13 10:45:22.575089729 +0200
+@@ -43,9 +43,9 @@ SRCS =		context.c \
+ 		gai_sterror.c getaddrinfo.c getnameinfo.c \
+ 		resconf.c
+ 
+-ISCLIBS =	../isc/libisc.@A@
+-DNSLIBS =	../dns/libdns.@A@
+-ISCCFGLIBS =	../isccfg/libisccfg.@A@
+ISCLIBS =	../isc/libisc-export.@A@
+DNSLIBS =	../dns/libdns-export.@A@
+ISCCFGLIBS =	../isccfg/libisccfg-export.@A@
+ 
+ LIBS =		@LIBS@
+ 
+@@ -62,26 +62,26 @@ version.@O@: ${srcdir}/version.c
+ 		-DLIBAGE=${LIBAGE} \
+ 		-c ${srcdir}/version.c
+ 
+-libirs.@SA@: ${OBJS} version.@O@
+libirs-export.@SA@: ${OBJS} version.@O@
+ 	${AR} ${ARFLAGS} $@ ${OBJS} version.@O@
+ 	${RANLIB} $@
+ 
+-libirs.la: ${OBJS} version.@O@
+libirs-export.la: ${OBJS} version.@O@
+ 	${LIBTOOL_MODE_LINK} \
+-		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libirs.la \
+		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libirs-export.la \
+ 		-rpath ${export_libdir} \
+ 		-version-info ${LIBINTERFACE}:${LIBREVISION}:${LIBAGE} \
+ 		${OBJS} version.@O@ ${LIBS} ${ISCCFGLIBS} ${DNSLIBS} ${ISCLIBS}
+ 
+-timestamp: libirs.@A@
+timestamp: libirs-export.@A@
+ 	touch timestamp
+ 
+ installdirs:
+ 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${export_libdir}
+ 
+ install:: timestamp installdirs
+-	${LIBTOOL_MODE_INSTALL} ${INSTALL_DATA} libirs.@A@ \
+	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} libirs-export.@A@ \
+ 	${DESTDIR}${export_libdir}/
+ 
+ clean distclean::
+-	rm -f libirs.@A@ libirs.la timestamp
+	rm -f libirs-export.@A@ libirs-export.la timestamp
+diff -up bind-9.9.3rc2/lib/export/isccfg/Makefile.in.exportlib bind-9.9.3rc2/lib/export/isccfg/Makefile.in
+--- bind-9.9.3rc2/lib/export/isccfg/Makefile.in.exportlib	2013-04-30 08:38:46.000000000 +0200
+++ bind-9.9.3rc2/lib/export/isccfg/Makefile.in	2013-05-13 10:45:22.576089729 +0200
+@@ -30,11 +30,11 @@ CINCLUDES =	-I. ${DNS_INCLUDES} -I${expo
+ CDEFINES =
+ CWARNINGS =
+ 
+-ISCLIBS =	../isc/libisc.@A@
+-DNSLIBS =	../dns/libdns.@A@ @DNS_CRYPTO_LIBS@
+ISCLIBS =	../isc/libisc-export.@A@
+DNSLIBS =	../dns/libdns-export.@A@ @DNS_CRYPTO_LIBS@
+ 
+ ISCDEPLIBS =	../../lib/isc/libisc.@A@
+-ISCCFGDEPLIBS =	libisccfg.@A@
+ISCCFGDEPLIBS =	libisccfg-export.@A@
+ 
+ LIBS =		@LIBS@
+ 
+@@ -58,26 +58,26 @@ version.@O@: ${srcdir}/version.c
+ 		-DLIBAGE=${LIBAGE} \
+ 		-c ${srcdir}/version.c
+ 
+-libisccfg.@SA@: ${OBJS}
+libisccfg-export.@SA@: ${OBJS}
+ 	${AR} ${ARFLAGS} $@ ${OBJS}
+ 	${RANLIB} $@
+ 
+-libisccfg.la: ${OBJS}
+libisccfg-export.la: ${OBJS}
+ 	 ${LIBTOOL_MODE_LINK} \
+-		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libisccfg.la \
+		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libisccfg-export.la \
+ 		-rpath ${export_libdir} \
+ 		-version-info ${LIBINTERFACE}:${LIBREVISION}:${LIBAGE} \
+ 		${OBJS} ${LIBS} ${DNSLIBS} ${ISCLIBS}
+ 
+-timestamp: libisccfg.@A@
+timestamp: libisccfg-export.@A@
+ 	touch timestamp
+ 
+ installdirs:
+ 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${export_libdir}
+ 
+ install:: timestamp installdirs
+-	${LIBTOOL_MODE_INSTALL} ${INSTALL_DATA} libisccfg.@A@ \
+	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} libisccfg-export.@A@ \
+ 	${DESTDIR}${export_libdir}/
+ 
+ clean distclean::
+-	rm -f libisccfg.@A@ timestamp
+	rm -f libisccfg-export.@A@ timestamp
+diff -up bind-9.9.3rc2/lib/export/isc/Makefile.in.exportlib bind-9.9.3rc2/lib/export/isc/Makefile.in
+--- bind-9.9.3rc2/lib/export/isc/Makefile.in.exportlib	2013-04-30 08:38:46.000000000 +0200
+++ bind-9.9.3rc2/lib/export/isc/Makefile.in	2013-05-13 10:45:22.576089729 +0200
+@@ -100,6 +100,10 @@ SRCS =		@ISC_EXTRA_SRCS@ \
+ 
+ LIBS =		@LIBS@
+ 
+# Note: the order of SUBDIRS is important.
+# Attempt to disable parallel processing.
+.NOTPARALLEL:
+.NO_PARALLEL:
+ SUBDIRS =	include unix nls @ISC_THREAD_DIR@
+ TARGETS =	timestamp
+ 
+@@ -113,26 +117,26 @@ version.@O@: ${srcdir}/version.c
+ 		-DLIBAGE=${LIBAGE} \
+ 		-c ${srcdir}/version.c
+ 
+-libisc.@SA@: ${OBJS}
+libisc-export.@SA@: ${OBJS}
+ 	${AR} ${ARFLAGS} $@ ${OBJS}
+ 	${RANLIB} $@
+ 
+-libisc.la: ${OBJS}
+libisc-export.la: ${OBJS}
+ 	${LIBTOOL_MODE_LINK} \
+-		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libisc.la \
+		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libisc-export.la \
+ 		-rpath ${export_libdir} \
+ 		-version-info ${LIBINTERFACE}:${LIBREVISION}:${LIBAGE} \
+ 		${OBJS} ${LIBS}
+ 
+-timestamp: libisc.@A@
+timestamp: libisc-export.@A@
+ 	touch timestamp
+ 
+ installdirs:
+ 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${export_libdir}
+ 
+ install:: timestamp installdirs
+-	${LIBTOOL_MODE_INSTALL} ${INSTALL_DATA} libisc.@A@ \
+	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} libisc-export.@A@ \
+ 	${DESTDIR}${export_libdir}
+ 
+ clean distclean::
+-	rm -f libisc.@A@ libisc.la timestamp
+	rm -f libisc-export.@A@ libisc-export.la timestamp
+diff -up bind-9.9.3rc2/lib/export/samples/Makefile.in.exportlib bind-9.9.3rc2/lib/export/samples/Makefile.in
+--- bind-9.9.3rc2/lib/export/samples/Makefile.in.exportlib	2013-04-30 08:38:46.000000000 +0200
+++ bind-9.9.3rc2/lib/export/samples/Makefile.in	2013-05-13 10:45:22.577089729 +0200
+@@ -31,15 +31,15 @@ CINCLUDES =	-I${srcdir}/include -I../dns
+ CDEFINES =
+ CWARNINGS =
+ 
+-DNSLIBS =	../dns/libdns.@A@ @DNS_CRYPTO_LIBS@
+-ISCLIBS =	../isc/libisc.@A@
+-ISCCFGLIBS =	../isccfg/libisccfg.@A@
+-IRSLIBS =	../irs/libirs.@A@
+DNSLIBS =	../dns/libdns-export.@A@ @DNS_CRYPTO_LIBS@
+ISCLIBS =	../isc/libisc-export.@A@
+ISCCFGLIBS =	../isccfg/libisccfg-export.@A@
+IRSLIBS =	../irs/libirs-export.@A@
+ 
+-DNSDEPLIBS =	../dns/libdns.@A@
+-ISCDEPLIBS =	../isc/libisc.@A@
+-ISCCFGDEPLIBS =	../isccfg/libisccfg.@A@
+-IRSDEPLIBS =	../irs/libirs.@A@
+DNSDEPLIBS =	../dns/libdns-export.@A@
+ISCDEPLIBS =	../isc/libisc-export.@A@
+ISCCFGDEPLIBS =	../isccfg/libisccfg-export.@A@
+IRSDEPLIBS =	../irs/libirs-export.@A@
+ 
+ DEPLIBS =	${DNSDEPLIBS} ${ISCCFGDEPLIBS} ${ISCDEPLIBS}
+ 
--- a/2983
+++ b/2983
--- a/isc-keyblock.asc
+++ b/isc-keyblock.asc
@ -146,30 +146,6 @@ mEVyesjYoV40tDCG73qLtfehhV/iARDMCfnZGyGYIZdDBL+tZTNeLKVDIUi/R3x9
 OmpEl8ZuCuYltyEsJnCF/rQBVMgcTOmsMu6CMx+qT3kC8iGtHqkUT2ufpKISahTn
 e329FQjClEWwBHkr0T4K80Z0REjSo6UBtio73IOCxXe0RqO37L/qgo8xKZbLxy86
 857PRWJhgbw169FJ2kR5p+M5d/g/MUeYnigvWlORW5LyrFg6RnZ1ZbULZI80QhHN
-aSFf/w020HBsLCkzWA/XM6MO2ifJTSn8NpkCDQRkSjCrARAApLUMHAbmxUMWLgDQ
-apRZBwWXriEyIVqA/SIy1PyWPPFXqs3LZ5Kn5Gw1WO8PfzkPZNtccGmNLjujIoRB
-qR41nV5zxcpS896SujBoYl80A4F4v9Op9i2pFeI9r9acFcUDjbGWBqNro4EfRcJN
-Ctkd9+pl3TUvFX06QCTxmmHy3M81SW3b4NWI+jia1cKjCd+qBFBgKWdjSMBeVTBC
-R9eKqsBQ1UJql2bRzc8pReS+TYCeEbhaOCvUCCKCwGtsSUOW726iNB/4zR4OOuQV
-B9ORufwed+E/RXa8N08/l5O96uXG0krJtOVm0/qQcXOaKxiDo6djnAgCdjFK5zaj
-7594wqbI7de58alWb/egqIhjBTgk+/cO+epZ05qx5SoJZL7ny2ottrfS2cBqP4g1
-SIt1sYl9ImHmJkNrNDy0s25nE9Nga6OfRqVbwnwot4ouTGwj0oZsCjw+gWjDdztH
-1fUWSnlA8jaX9/RZG2wKt9dI+Tp/U4d5dyTb8lIIzzgtAzDmDfPxwwT0rxAAL13A
-gDkJ0AzXA4WTOxb/JE2yfCz//kt7n8SYM//LixL4VAB7e/wnfZBhTq0OFpaPjFU0
-h/k0dc40AqcUuK3lSSjQr3KTzRHtjz8qtN4DFSuyZac83QSVtWE1rFKjS8bl3XHC
-kFFRJ2dMt2WRSkLOYNiTGbYLvmEAEQEAAbQwQW5kcmVpIFBhdmVsIChDb2RlLVNp
-Z25pbmcgS2V5KSA8YW5kcmVpQGlzYy5vcmc+iQJOBBMBCgA4FiEE2mo1COZypJ3T
-gq/ZW49NkbiO2QkFAmRKMKsCGwMFCwkIBwMFFQoJCAsFFgIDAQACHgECF4AACgkQ
-W49NkbiO2QnQZw//XCpeqT0z/sqtu4FYWwYLz1OvWqhe+uA45f9BccnNSVkGFa7w
-3hlLQC/FLUIx2cVy9AluJBP29iQge/bCcXnzo/QvCbhe/4lCTxhr7nsBe1bWpuNI
-4Pl+cQxZQBwcz74zZ1jjaaQOqm3XtdZxeKNfCQmNvz389UZEk2m8K6qJD23fy20V
-n5Y2C502UuP3MitbYKBxBSbs+Auwy1evz/prQ9VeD4Nv3Zr+jWbWFW+dSDC8jkrX
-cGdwWrUQ51QD8VBB9lPWPGY6yTbRmacr4AlVSo2DAfyjHRrGHigRF/VAD5p1+u2g
-3UFLJaEyujfzwU1kG4+zQCWZ2W2UBOekklq/yefxEY5vU1/Lad7vQhBmogQNF21T
-FvLUE6ez7XNsdMZStDPiT8OoTyFZYLRM4yw5rWKw+1mICBv7NV82YD/8hoMoZPyX
-2tNRTXv2MZ6qD++0dMCIZNEyFTB344srvQSyJ7K7vwxulc7iFWngRA8oe6JkAhH4
-B0yNq1FJm6jIL41S2FmnDL3DlfAdKWapBqzgqkv+X5DQBaTlG9a4BcSsdMJgU/Yx
-dD03YsKhDtEWTqBmmEamR1K1CgCC3mOJfsHB5z+Qhdraz2hMr00EQrD5lnpLLpcF
-rYWoilvVlRy7Y7U5wfhY4074L2ZfB+yElKsvtfGKJX/8g+eJdeRuII+hjEc=
-=NX7P
+aSFf/w020HBsLCkzWA/XM6MO2ifJTSn8Ng==
+=C1ed
 -----END PGP PUBLIC KEY BLOCK-----
--- a/named-chroot.files
+++ b/named-chroot.files
@ -13,12 +13,10 @@
 /etc/services
 /etc/named.dnssec.keys
 /etc/pki/dnssec-keys
-/etc/pki/tls/cert.pem
 /etc/named
 /usr/lib64/bind
 /usr/lib/bind
 /usr/share/GeoIP
-/usr/share/dns-root-data
 /run/named
 /proc/sys/net/ipv4/ip_local_port_range
 # Warning: the order is important
--- a/named-chroot.service
+++ b/named-chroot.service
@ -25,7 +25,6 @@ ExecReload=/bin/sh -c 'if /usr/sbin/rndc null > /dev/null 2>&1; then /usr/sbin/r
 ExecStop=/bin/sh -c '/usr/sbin/rndc stop > /dev/null 2>&1 || /bin/kill -TERM $MAINPID'

 PrivateTmp=false
-Restart=on-abnormal

 [Install]
 WantedBy=multi-user.target
--- a/named-mkroot.sh
+++ b/named-mkroot.sh
@ -1,20 +0,0 @@
-#!/bin/sh
-# Create named.root.key from dns-root-data package
-
-ROOT_DS=/usr/share/dns-root-data/root.ds
-: ${OUTPUT:=named.root.key}
-
-if ! [ -r "$ROOT_DS" ]; then
-	echo "Root trust file is not readable: $ROOT_DS"
-	exit 1
-fi
-
-echo "# Autogenerated from $ROOT_DS" > "$OUTPUT"
-echo "trust-anchors {" >> "$OUTPUT"
-cat "$ROOT_DS" | while read DOMAIN CLS QTYPE KEYTAG ALG DIG HASH;
-do
-	echo "$DOMAIN initial-ds $KEYTAG $ALG $DIG \"$HASH\";" >> "$OUTPUT";
-done
-echo "}; " >> "$OUTPUT"
-# Set the same modification time as data source.
-touch -r $ROOT_DS "$OUTPUT"
--- a/named.conf.sample
+++ b/named.conf.sample
@ -1,11 +1,11 @@
-# vim: ft=named:
 /*
 Sample named.conf BIND DNS server 'named' configuration file
 for the Red Hat BIND distribution.

 See the BIND Administrator's Reference Manual (ARM) for details, in:
-   file:///usr/share/doc/bind/html/index.html
- Or on upstream site: https://bind9.readthedocs.org/
+   file:///usr/share/doc/bind-{version}/arm/Bv9ARM.html
+ Also see the BIND Configuration GUI : /usr/bin/system-config-bind and 
+ its manual.
 */

 options
@ -47,7 +47,6 @@ options

 	allow-query		{ localhost; };
 	allow-query-cache	{ localhost; };
-	allow-transfer		{ localhost; };

 	/* Enable/disable recursion - recursion yes/no;

@ -65,7 +64,7 @@ options
 	/* DNSSEC related options. See information about keys ("Trusted keys", bellow) */

 	/* Enable DNSSEC validation on recursive servers */
-	dnssec-validation auto;
+	dnssec-validation yes;

 	/* In Fedora we use /run/named instead of default /var/run/named
 	   so we have to configure paths properly. */
@ -166,7 +165,7 @@ view "internal"
 	zone "my.slave.internal.zone" {
 		type secondary;
 		file "slaves/my.slave.internal.zone.db";
-		primaries { /* put master nameserver IPs here */ 127.0.0.1; } ;
+		masters { /* put master nameserver IPs here */ 127.0.0.1; } ;
 		// put slave zones in the slaves/ directory so named can update them
 	};	
 	zone "my.ddns.internal.zone" {
@ -180,8 +179,7 @@ view "internal"
 key ddns_key
 {
 	algorithm hmac-sha256;
-	#secret "use /usr/sbin/ddns-confgen to generate TSIG keys";
-	secret "dXNlIC91c3Ivc2Jpbi9kZG5zLWNvbmZnZW4gdG8gZ2VuZXJhdGUgVFNJRyBrZXlz";
+	secret "use /usr/sbin/ddns-confgen to generate TSIG keys";
 };

 view "external"
@ -214,13 +212,19 @@ view "external"
  This statement contains DNSSEC keys. If you want DNSSEC aware resolver you
  should configure at least one trusted key.

-  Note that no key written below is valid. Especially root key is maintained in
-  /etc/named.root.key file.
+  Note that no key written below is valid. Especially root key because root zone
+  is not signed yet.
 */
 /*
 trust-anchors {
 // Root Key
-. initial-ds 38696 8 2 "683D2D0ACB8C9B712A1948B27F741219298D0A450D612C483AF444A4C0FB2B16";
+. initial-key 257 3 8 "AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3
+		      +/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kv
+		      ArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF
+		      0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+e
+		      oZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfd
+		      RUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwN
+		      R1AkUTV74bU=";

 // Key for forward zone
 example.com. static-key 257 3 8 "AwEAAZ0aqu1rJ6orJynrRfNpPmayJZoAx9Ic2/Rl9VQW
@ -234,6 +238,6 @@ example.com. static-key 257 3 8 "AwEAAZ0aqu1rJ6orJynrRfNpPmayJZoAx9Ic2/Rl9VQW


 // Key for reverse zone.
-2.0.192.IN-ADDRPA.NET. static-ds 31406 8 2 "F78CF3344F72137235098ECBBD08947C2C9001C7F6A085A17F518B5D8F6B916D";
+2.0.192.IN-ADDRPA.NET. initial-ds 31406 8 2 "F78CF3344F72137235098ECBBD08947C2C9001C7F6A085A17F518B5D8F6B916D";
 };
 */
--- a/named.logrotate
+++ b/named.logrotate
@ -2,8 +2,11 @@
    missingok
    su named named
    create 0644 named named
-    notifempty
    postrotate
-        /usr/bin/rndc closelogs > /dev/null 2>&1 || true
+        /usr/bin/systemctl reload named.service > /dev/null 2>&1 || true
+        /usr/bin/systemctl reload named-chroot.service > /dev/null 2>&1 || true
+        /usr/bin/systemctl reload named-sdb.service > /dev/null 2>&1 || true
+        /usr/bin/systemctl reload named-sdb-chroot.service > /dev/null 2>&1 || true
+        /usr/bin/systemctl reload named-pkcs11.service > /dev/null 2>&1 || true
    endscript
 }
--- a/named.root
+++ b/named.root
@ -0,0 +1,92 @@
+;       This file holds the information on root name servers needed to 
+;       initialize cache of Internet domain name servers
+;       (e.g. reference this file in the "cache  .  <file>"
+;       configuration file of BIND domain name servers). 
+; 
+;       This file is made available by InterNIC 
+;       under anonymous FTP as
+;           file                /domain/named.cache 
+;           on server           FTP.INTERNIC.NET
+;       -OR-                    RS.INTERNIC.NET
+; 
+;       last update:     June 24, 2021 
+;       related version of root zone:     2021062401
+; 
+; FORMERLY NS.INTERNIC.NET 
+;
+.                        3600000      NS    A.ROOT-SERVERS.NET.
+A.ROOT-SERVERS.NET.      3600000      A     198.41.0.4
+A.ROOT-SERVERS.NET.      3600000      AAAA  2001:503:ba3e::2:30
+; 
+; FORMERLY NS1.ISI.EDU 
+;
+.                        3600000      NS    B.ROOT-SERVERS.NET.
+B.ROOT-SERVERS.NET.      3600000      A     199.9.14.201
+B.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:200::b
+; 
+; FORMERLY C.PSI.NET 
+;
+.                        3600000      NS    C.ROOT-SERVERS.NET.
+C.ROOT-SERVERS.NET.      3600000      A     192.33.4.12
+C.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:2::c
+; 
+; FORMERLY TERP.UMD.EDU 
+;
+.                        3600000      NS    D.ROOT-SERVERS.NET.
+D.ROOT-SERVERS.NET.      3600000      A     199.7.91.13
+D.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:2d::d
+; 
+; FORMERLY NS.NASA.GOV
+;
+.                        3600000      NS    E.ROOT-SERVERS.NET.
+E.ROOT-SERVERS.NET.      3600000      A     192.203.230.10
+E.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:a8::e
+; 
+; FORMERLY NS.ISC.ORG
+;
+.                        3600000      NS    F.ROOT-SERVERS.NET.
+F.ROOT-SERVERS.NET.      3600000      A     192.5.5.241
+F.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:2f::f
+; 
+; FORMERLY NS.NIC.DDN.MIL
+;
+.                        3600000      NS    G.ROOT-SERVERS.NET.
+G.ROOT-SERVERS.NET.      3600000      A     192.112.36.4
+G.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:12::d0d
+; 
+; FORMERLY AOS.ARL.ARMY.MIL
+;
+.                        3600000      NS    H.ROOT-SERVERS.NET.
+H.ROOT-SERVERS.NET.      3600000      A     198.97.190.53
+H.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:1::53
+; 
+; FORMERLY NIC.NORDU.NET
+;
+.                        3600000      NS    I.ROOT-SERVERS.NET.
+I.ROOT-SERVERS.NET.      3600000      A     192.36.148.17
+I.ROOT-SERVERS.NET.      3600000      AAAA  2001:7fe::53
+; 
+; OPERATED BY VERISIGN, INC.
+;
+.                        3600000      NS    J.ROOT-SERVERS.NET.
+J.ROOT-SERVERS.NET.      3600000      A     192.58.128.30
+J.ROOT-SERVERS.NET.      3600000      AAAA  2001:503:c27::2:30
+; 
+; OPERATED BY RIPE NCC
+;
+.                        3600000      NS    K.ROOT-SERVERS.NET.
+K.ROOT-SERVERS.NET.      3600000      A     193.0.14.129
+K.ROOT-SERVERS.NET.      3600000      AAAA  2001:7fd::1
+; 
+; OPERATED BY ICANN
+;
+.                        3600000      NS    L.ROOT-SERVERS.NET.
+L.ROOT-SERVERS.NET.      3600000      A     199.7.83.42
+L.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:9f::42
+; 
+; OPERATED BY WIDE
+;
+.                        3600000      NS    M.ROOT-SERVERS.NET.
+M.ROOT-SERVERS.NET.      3600000      A     202.12.27.33
+M.ROOT-SERVERS.NET.      3600000      AAAA  2001:dc3::35
+; End of file
--- a/named.root.key
+++ b/named.root.key
@ -1,5 +1,13 @@
-# Autogenerated from /usr/share/dns-root-data/root.ds
-truste-anchors {
-. initial-ds 20326 8 2 "E06D44B80B8F1D39A95C0B0D7C65D08458E880409BBC683457104237C7F8EC8D";
-. initial-ds 38696 8 2 "683D2D0ACB8C9B712A1948B27F741219298D0A450D612C483AF444A4C0FB2B16";
-}; 
+trust-anchors {
+        # ROOT KEYS: See https://data.iana.org/root-anchors/root-anchors.xml
+        # for current trust anchor information.
+        #
+        # This key (20326) was published in the root zone in 2017.
+        # Servers which were already using the old key (19036) should
+        # roll seamlessly to this new one via RFC 5011 rollover. Servers
+        # being set up for the first time can use the contents of this
+        # file as initializing keys; thereafter, the keys in the
+        # managed key database will be trusted and maintained
+        # automatically.
+        . initial-ds 20326 8 2 "E06D44B80B8F1D39A95C0B0D7C65D08458E880409BBC683457104237C7F8EC8D";
+};
--- a/named.rwtab
+++ b/named.rwtab
@ -0,0 +1,6 @@
+dirs    /var/named
+
+files	/var/named/named.ca
+files	/var/named/named.empty
+files	/var/named/named.localhost
+files	/var/named/named.loopback
--- a/named.service
+++ b/named.service
@ -20,7 +20,6 @@ ExecReload=/bin/sh -c 'if /usr/sbin/rndc null > /dev/null 2>&1; then /usr/sbin/r
 ExecStop=/bin/sh -c '/usr/sbin/rndc stop > /dev/null 2>&1 || /bin/kill -TERM $MAINPID'

 PrivateTmp=true
-Restart=on-abnormal

 [Install]
 WantedBy=multi-user.target
--- a/plans/all.fmf
+++ b/plans/all.fmf
@ -4,5 +4,3 @@ discover:
    url: https://src.fedoraproject.org/tests/bind.git
 execute:
    how: tmt
-context:
-    component: bind9-next
--- a/plans/tier1-public.fmf
+++ b/plans/tier1-public.fmf
@ -1,11 +1,7 @@
 summary: Public (Fedora) Tier1 beakerlib tests
-environment+:
-    PACKAGE: bind9-next
 discover:
    how: fmf
    url: https://src.fedoraproject.org/tests/bind.git
    filter: 'tier: 1'
 execute:
    how: tmt
-context:
-    component: bind9-next
--- a/4
+++ b/4
@ -1,2 +1,2 @@
-SHA512 (bind-9.21.22.tar.xz) = f9e11d150162661c755dabdd7862c0565e6a10077e2a6aee04f8cefce94c262d8928ff9e42f8c8750242aee3b0992afe2f49f72f0f8cab8b7e4ae1c9fc06e0fa
-SHA512 (bind-9.21.22.tar.xz.asc) = 1e0bd14fad5754e12b6a4855dbed698dba74468790948316e17442e5bc840fc81d18e590fd78186a1e26e9526870b13470dcef6a15644e91775cc8883813ad24
+SHA512 (bind-9.19.9.tar.xz) = 7f1c352047d339198fa76e6825cb61747f8ad02ff65a2a4b4a06b250c1c6403fdbfaae3fa7dcceaac150e5995160eb741b8f62e62ad2ad473a5aef64e36b0a33
+SHA512 (bind-9.19.9.tar.xz.asc) = e9a53cb0908b77b3f0311e3eae0ae42dcd7a9dc8e82ff8a183bbad6e83964cb8b30cca4437002d0cf188b607d52570926fd7b03048174176922788ce685c5d3e
--- a/tests/Master-server-chrooted/Makefile
+++ b/tests/Master-server-chrooted/Makefile
@ -0,0 +1,63 @@
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Makefile of /CoreOS/tests/Sanity/Master-server-chrooted
+#   Description: Run basic empty named service and try to resolve localhost on it
+#   Author: Petr Mensik <pemensik@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2018 Red Hat, Inc.
+#
+#   This program is free software: you can redistribute it and/or
+#   modify it under the terms of the GNU General Public License as
+#   published by the Free Software Foundation, either version 2 of
+#   the License, or (at your option) any later version.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE.  See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public License
+#   along with this program. If not, see http://www.gnu.org/licenses/.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+export TEST=/CoreOS/tests/Sanity/Master-server-chrooted
+export TESTVERSION=1.0
+
+BUILT_FILES=
+
+FILES=$(METADATA) runtest.sh Makefile PURPOSE
+
+.PHONY: all install download clean
+
+run: $(FILES) build
+	./runtest.sh
+
+build: $(BUILT_FILES)
+	test -x runtest.sh || chmod a+x runtest.sh
+
+clean:
+	rm -f *~ $(BUILT_FILES)
+
+
+include /usr/share/rhts/lib/rhts-make.include
+
+$(METADATA): Makefile
+	@echo "Owner:           Petr Mensik <pemensik@redhat.com>" > $(METADATA)
+	@echo "Name:            $(TEST)" >> $(METADATA)
+	@echo "TestVersion:     $(TESTVERSION)" >> $(METADATA)
+	@echo "Path:            $(TEST_DIR)" >> $(METADATA)
+	@echo "Description:     Run basic empty named-chroot service and try to resolve localhost on it" >> $(METADATA)
+	@echo "Type:            Sanity" >> $(METADATA)
+	@echo "TestTime:        5m" >> $(METADATA)
+	@echo "RunFor:          bind" >> $(METADATA)
+	@echo "Requires:        bind bind-utils bind-chroot bind-sdb-chroot" >> $(METADATA)
+	@echo "Priority:        Normal" >> $(METADATA)
+	@echo "License:         GPLv2+" >> $(METADATA)
+	@echo "Confidential:    no" >> $(METADATA)
+	@echo "Destructive:     no" >> $(METADATA)
+	@echo "Releases:        -RHEL4 -RHELClient5 -RHELServer5 -RHEL6" >> $(METADATA)
+
+	rhts-lint $(METADATA)
--- a/tests/Master-server-chrooted/PURPOSE
+++ b/tests/Master-server-chrooted/PURPOSE
@ -0,0 +1,6 @@
+PURPOSE of /CoreOS/tests/Sanity/Master-server-chrooted
+Description: Run basic empty named-chroot service and try to resolve localhost on it
+Author: Petr Mensik <pemensik@redhat.com>
+
+Check also clean package both when running and finished.
+https://bugzilla.redhat.com/show_bug.cgi?id=1592873
--- a/tests/Master-server-chrooted/runtest.sh
+++ b/tests/Master-server-chrooted/runtest.sh
@ -0,0 +1,73 @@
+#!/bin/bash
+# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   runtest.sh of /CoreOS/tests/Sanity/Master-server-chrooted
+#   Description: Run basic empty named-chroot service and try to resolve localhost on it
+#   Author: Petr Mensik <pemensik@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2018 Red Hat, Inc.
+#
+#   This program is free software: you can redistribute it and/or
+#   modify it under the terms of the GNU General Public License as
+#   published by the Free Software Foundation, either version 2 of
+#   the License, or (at your option) any later version.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE.  See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public License
+#   along with this program. If not, see http://www.gnu.org/licenses/.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+# Include Beaker environment
+. /usr/bin/rhts-environment.sh || exit 1
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+PACKAGE="bind"
+
+test_service()
+{
+    local SERVICE="$1"
+    local PACKAGE="$2"
+	rlRun "rlServiceStart $SERVICE"
+	rlRun "dig @localhost localhost | grep '^localhost'"
+	rlRun "dig @localhost -x 127.0.0.1 | grep 'PTR[[:space:]]\+localhost.$'" 0 "Reverse address works"
+	rlRun "rpm -V $PACKAGE" 0 "Checking $SERVICE package when running"
+	rlRun "rlServiceRestore $SERVICE"
+	rlRun "rpm -V $PACKAGE" 0 "Checking $SERVICE package when stopped"
+}
+
+rlJournalStart
+    rlPhaseStartSetup
+        rlAssertRpm bind
+	rlAssertRpm bind-utils
+	rlAssertRpm bind-chroot
+    rlPhaseEnd
+
+    rlPhaseStartTest "Testing named"
+	test_service named bind
+    rlPhaseEnd
+
+    rlPhaseStartTest "Testing named-chroot"
+	test_service named-chroot bind-chroot
+    rlPhaseEnd
+
+    rlPhaseStartTest "Testing named-sdb-chroot"
+	    if rpm -q bind-sdb-chroot; then
+		test_service named-sdb-chroot bind-sdb-chroot
+	    else
+		rlLog "bind-sdb-chroot not installed, skipping it"
+	    fi
+    rlPhaseEnd
+
+    rlPhaseStartCleanup
+	# noop
+    rlPhaseEnd
+rlJournalPrintText
+rlJournalEnd
--- a/tests/Master-server-not-chrooted/Makefile
+++ b/tests/Master-server-not-chrooted/Makefile
@ -0,0 +1,65 @@
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Makefile of /CoreOS/bind/Sanity/Master-server-not-chrooted
+#   Description: Set up master nameserver, test it.
+#   Author: Martin Cermak <mcermak@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2009 Red Hat, Inc. All rights reserved.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+export TEST=/CoreOS/bind/Sanity/Master-server-not-chrooted
+export TESTVERSION=1.0
+
+BUILT_FILES=
+
+FILES=$(METADATA) runtest.sh Makefile PURPOSE named.conf zonefile 
+
+.PHONY: all install download clean
+
+run: $(FILES) build
+	./runtest.sh
+
+build: $(BUILT_FILES)
+	chmod a+x runtest.sh
+
+clean:
+	rm -f *~ $(BUILT_FILES)
+
+
+include /usr/share/rhts/lib/rhts-make.include
+
+$(METADATA): Makefile
+	@echo "Owner:           Martin Cermak <mcermak@redhat.com>" > $(METADATA)
+	@echo "Name:            $(TEST)" >> $(METADATA)
+	@echo "TestVersion:     $(TESTVERSION)" >> $(METADATA)
+	@echo "Path:            $(TEST_DIR)" >> $(METADATA)
+	@echo "Description:     Set up master nameserver in chrooted env, test it." >> $(METADATA)
+	@echo "Type:            Sanity" >> $(METADATA)
+	@echo "TestTime:        5m" >> $(METADATA)
+	@echo "RunFor:          bind" >> $(METADATA)
+	@echo "Requires:        bind bind-chroot redhat-lsb" >> $(METADATA)
+	@echo "Requires:        bind-utils" >> $(METADATA)
+	@echo "Priority:        Normal" >> $(METADATA)
+	@echo "License:         GPLv2" >> $(METADATA)
+	@echo "Confidential:    no" >> $(METADATA)
+	@echo "Destructive:     no" >> $(METADATA)
+	@echo "RhtsRequires: library(bind/bind-setup)" >> $(METADATA)
+
+	rhts-lint $(METADATA)
--- a/tests/Master-server-not-chrooted/PURPOSE
+++ b/tests/Master-server-not-chrooted/PURPOSE
@ -0,0 +1,6 @@
+PURPOSE of /CoreOS/bind/Sanity/Master-server-not-chrooted
+Description: Set up master nameserver in chrooted env, test it.
+             This is a very basic sanity test for bind9.
+             The main purpose for me was to learn how
+             bind works :-)
+Author: Martin Cermak <mcermak@redhat.com>
--- a/tests/Master-server-not-chrooted/named.conf
+++ b/tests/Master-server-not-chrooted/named.conf
@ -0,0 +1,11 @@
+options {
+        directory       "/var/named";
+        allow-query     { any; };
+};
+
+zone "<DOMAIN>" IN {
+  type master;
+  file "<DOMAIN>.zone";
+  allow-update { none; };
+};
+
--- a/tests/Master-server-not-chrooted/runtest.sh
+++ b/tests/Master-server-not-chrooted/runtest.sh
@ -0,0 +1,109 @@
+#!/bin/bash
+# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   runtest.sh of /CoreOS/bind/Sanity/Master-server-not-chrooted
+#   Description: Set up master nameserver, test it.
+#   Author: Martin Cermak <mcermak@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2009 Red Hat, Inc. All rights reserved.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+# Include rhts environment
+#set -x
+. /usr/bin/rhts-environment.sh
+. /usr/lib/beakerlib/beakerlib.sh
+
+# Some heplful functions
+randomString () {
+    TEMPSTR=`date +%c%N | md5sum | awk '{print $1}'`
+    echo ${TEMPSTR:0:8}
+    unset TEMPSTR
+}
+
+randomIp () {
+    echo "192.168.1.`echo $[ $RANDOM / 256 + 1 ]`"
+}
+
+randomSerial () {
+    date +%N
+}
+
+# Variable declarations
+CONF="/etc/named.conf"
+IP1=`randomIp`
+IP2=`randomIp`
+IP3=`randomIp`
+IP4=`randomIp`
+IP5=`randomIp`
+SERIAL=`randomSerial`
+ORIGPWD=`pwd`
+
+# The test
+rlJournalStart
+    rlPhaseStartSetup
+        rlRun "TmpDir=\`mktemp -d\`" 0 "Creating tmp directory"
+        rlRun "pushd $TmpDir"
+
+        rlRun "rlImport bind/bind-setup"
+
+        bsBindSetupStart "$ORIGPWD/named.conf" "off"
+
+        rlRun "TDOMAIN=`randomString`.cz"
+        rlRun "TZONEFILE=$ROOTDIR/var/named/$TDOMAIN.zone"
+
+        # set up /etc/named.conf
+        rlRun "sed -i \"s/<DOMAIN>/$TDOMAIN/g\" $CONF"
+
+        # set up zonefile
+        rlRun "cp $ORIGPWD/zonefile $TZONEFILE"
+        rlRun "chmod a+r $TZONEFILE"
+        rlRun "sed -i \"s/<DOMAIN>/$TDOMAIN/g\" $TZONEFILE"
+        rlRun "sed -i \"s/<IP1>/$IP1/g\" $TZONEFILE"
+        rlRun "sed -i \"s/<IP2>/$IP2/g\" $TZONEFILE"
+        rlRun "sed -i \"s/<IP3>/$IP3/g\" $TZONEFILE"
+        rlRun "sed -i \"s/<IP4>/$IP4/g\" $TZONEFILE"
+        rlRun "sed -i \"s/<IP5>/$IP5/g\" $TZONEFILE"
+        rlRun "sed -i \"s/<SERIAL>/$SERIAL/g\" $TZONEFILE"
+
+        bsBindSetupDone
+    rlPhaseEnd
+
+    rlPhaseStartTest
+        # perform tests
+        rlRun "dig @localhost $TDOMAIN | grep \"^$TDOMAIN\" | head -n 1 | grep \"$IP1\""
+        rlRun "dig @localhost server1.$TDOMAIN | grep \"^server1.$TDOMAIN\" | grep \"$IP2\""
+        rlRun "dig @localhost server2.$TDOMAIN | grep \"^server2.$TDOMAIN\" | grep \"$IP3\""
+        rlRun "dig @localhost dns1.$TDOMAIN | grep \"^dns1.$TDOMAIN\" | grep \"$IP4\""
+        rlRun "dig @localhost dns2.$TDOMAIN | grep \"^dns2.$TDOMAIN\" | grep \"$IP5\""
+        rlRun "dig @localhost ftp.$TDOMAIN | grep \"^ftp.$TDOMAIN\" | grep \"server1.$TDOMAIN\""
+        rlRun "dig @localhost mail.$TDOMAIN | grep \"^mail.$TDOMAIN\" | grep \"server1.$TDOMAIN\""
+        rlRun "dig @localhost mail2.$TDOMAIN | grep \"^mail2.$TDOMAIN\" | grep \"server2.$TDOMAIN\""
+        rlRun "dig @localhost www.$TDOMAIN | grep \"^www.$TDOMAIN\" | grep \"server2.$TDOMAIN\""
+
+    rlPhaseEnd
+
+    rlPhaseStartCleanup
+        bsBindSetupCleanup
+        rlRun "popd"
+        rlRun "rm -r $TmpDir" 0 "Removing tmp directory"
+        rlRun "rm -rf $TZONEFILE"
+    rlPhaseEnd
+rlJournalEnd
--- a/tests/Master-server-not-chrooted/zonefile
+++ b/tests/Master-server-not-chrooted/zonefile
@ -0,0 +1,27 @@
+$ORIGIN <DOMAIN>.
+$TTL 86400
+@     IN     SOA    dns1.<DOMAIN>.  hostmaster.<DOMAIN>. (
+                    <SERIAL>  ; serial
+                    21600      ; refresh after 6 hours
+                    3600       ; retry after 1 hour
+                    604800     ; expire after 1 week
+                    86400 )    ; minimum TTL of 1 day
+
+      IN     NS     dns1.<DOMAIN>.
+      IN     NS     dns2.<DOMAIN>.
+
+      IN     MX     10     mail.<DOMAIN>.
+      IN     MX     20     mail2.<DOMAIN>.
+
+             IN     A       <IP1>
+
+server1      IN     A       <IP2>
+server2      IN     A       <IP3>
+dns1         IN     A       <IP4>
+dns2         IN     A       <IP5>
+
+ftp          IN     CNAME   server1
+mail         IN     CNAME   server1
+mail2        IN     CNAME   server2
+www          IN     CNAME   server2
+
--- a/tests/Run-internal-BIND-test-suite/Makefile
+++ b/tests/Run-internal-BIND-test-suite/Makefile
@ -0,0 +1,77 @@
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Makefile of tests/Run-internal-BIND-test-suite
+#   Description: Run internal BIND test suite
+#   Author: Martin Cermak <mcermak@redhat.com>
+#   Author: Petr Mensik <pemensik@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2010 Red Hat, Inc. All rights reserved.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+export TEST=tests/Run-internal-BIND-test-suite
+export TESTVERSION=1.3
+
+BUILT_FILES=
+
+FILES=$(METADATA) runtest.sh Makefile PURPOSE knownerror* setup-named-softhsm.sh bind-systest-filter.sh
+
+.PHONY: all install download clean
+
+run: $(FILES) build
+	./runtest.sh
+
+build: $(BUILT_FILES)
+	chmod a+x runtest.sh
+
+clean:
+	rm -f *~ $(BUILT_FILES)
+
+
+include /usr/share/rhts/lib/rhts-make.include
+
+$(METADATA): Makefile
+	@echo "Owner:           Martin Cermak <mcermak@redhat.com>" > $(METADATA)
+	@echo "Name:            $(TEST)" >> $(METADATA)
+	@echo "TestVersion:     $(TESTVERSION)" >> $(METADATA)
+	@echo "Path:            $(TEST_DIR)" >> $(METADATA)
+	@echo "Description:     Run internal BIND test suite" >> $(METADATA)
+	@echo "Type:            Sanity" >> $(METADATA)
+	@echo "TestTime:        8h" >> $(METADATA)
+	@echo "RunFor:          bind" >> $(METADATA)
+	@echo "Requires:        bind rpm-build bind-utils" >> $(METADATA)
+	@echo "Requires:        perl-Net-DNS perl-Net-DNS-Nameserver" >> $(METADATA)
+	@echo "Requires:        perl-Time-HiRes" >> $(METADATA)
+	@echo "Requires:        bind-pkcs11 bind-pkcs11-utils softhsm" >> $(METADATA)
+	@echo "Requires:        openssl-devel libtool autoconf" >> $(METADATA)
+# Try to satisfy all build dependencies from here
+	@echo "Requires:        bind-devel" >> $(METADATA)
+	@echo "Requires:        net-tools" >> $(METADATA)
+	@echo "Requires:        dnf-utils" >> $(METADATA)
+	@echo "Requires:        kyua" >> $(METADATA)
+	@echo "Requires:        libcmocka-devel" >> $(METADATA)
+# Obsolete, uses cmocka
+#	@echo "Requires:        libatf-c gcc-c++" >> $(METADATA)
+	@echo "Priority:        Normal" >> $(METADATA)
+	@echo "License:         GPLv2" >> $(METADATA)
+	@echo "Confidential:    no" >> $(METADATA)
+	@echo "Destructive:     no" >> $(METADATA)
+	@echo "Bug:             642970" >> $(METADATA)
+
+	rhts-lint $(METADATA)
--- a/tests/Run-internal-BIND-test-suite/PURPOSE
+++ b/tests/Run-internal-BIND-test-suite/PURPOSE
@ -0,0 +1,6 @@
+PURPOSE of tests/Run-internal-BIND-test-suite
+Description: Run internal BIND test suite
+Author: Martin Cermak <mcermak@redhat.com>
+Bug summary: Run internal BIND test suite
+Bugzilla link: https://bugzilla.redhat.com/show_bug.cgi?id=642970
+
--- a/tests/Run-internal-BIND-test-suite/bind-systest-filter.sh
+++ b/tests/Run-internal-BIND-test-suite/bind-systest-filter.sh
@ -0,0 +1,47 @@
+#!/bin/bash
+#
+# This script will filter out output from BINDs tests
+# It supports form from BIND 9.9 and BIND 9.11
+# Its purpose is to display only failed tests from list of all tests
+
+CURRENT_TEST=
+CURRENT_OUTPUT=
+STATUS_ONLY=
+
+for P; do
+	case "$P" in
+		-s|--status)	STATUS_ONLY=yes; shift ;;
+	esac
+done
+
+cat $@ | while read LINE; do
+	if [ "${LINE#S:}" != "$LINE" ]; then
+		CURRENT_TEST=`echo $LINE | cut -d: -f2`
+		CURRENT_OUTPUT="$LINE"$'\n'
+	elif [ "${LINE#R:}" != "$LINE" ]; then
+		# echo "$CURRENT_TEST $LINE"
+		if [ "${LINE/#R:*:*}" != "$LINE" ]; then
+			# more recent results contain test name
+			# R:dlz:FAIL
+			CURRENT_TEST="${LINE#R:}"
+			CURRENT_TEST="${CURRENT_TEST/%:*}"
+			RESULT="${LINE/#*:}"
+		else
+			# S:dlz:time
+			# R:FAIL
+			RESULT="${LINE/#R*:/}"
+		fi
+		if [ "$RESULT" != "PASS" ]; then
+			if [ -n "$STATUS_ONLY" ]; then
+				echo "$RESULT $CURRENT_TEST"
+			else
+				CURRENT_OUTPUT+="$LINE"
+				echo "$CURRENT_OUTPUT"
+				echo
+			fi
+		fi
+		CURRENT_OUTPUT=
+	else
+		CURRENT_OUTPUT+="$LINE"$'\n'
+	fi
+done
--- a/tests/Run-internal-BIND-test-suite/knownerror
+++ b/tests/Run-internal-BIND-test-suite/knownerror
@ -0,0 +1,2 @@
+A:System test dlz
+A:System test idna
--- a/tests/Run-internal-BIND-test-suite/runtest.sh
+++ b/tests/Run-internal-BIND-test-suite/runtest.sh
@ -0,0 +1,185 @@
+#!/bin/bash
+# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   runtest.sh of tests/Run-internal-BIND-test-suite
+#   Description: Run internal BIND test suite
+#   Author: Martin Cermak <mcermak@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2010 Red Hat, Inc. All rights reserved.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+# Include rhts environment
+. /usr/bin/rhts-environment.sh
+. /usr/lib/beakerlib/beakerlib.sh
+
+PACKAGE="bind"
+
+# Set those variables to n to skip tests on variants
+#DEFAULT_VARIANTS="normal pkcs11 sdb"
+DEFAULT_VARIANTS="normal"
+#TEST_VARIANTS="normal"
+
+#
+# Runs test suite and checks known errors
+# Prepared to be repeated with another variants
+run_testsuite()
+{
+	local RESULT_TEXT="$TMPDIR/test${NAMED_VARIANT}.txt"
+	local FOUNDERROR=`mktemp found-XXXXXXXX.err`
+	local KNOWNERROR=/dev/null
+
+	if [ -f "$ORIG/knownerror${NAMED_VARIANT}.$TAG" ]; then
+		KNOWNERROR=`readlink -f $ORIG/knownerror.$TAG`
+	elif [ -f "$ORIG/knownerror${NAMED_VARIANT}" ]; then
+		KNOWNERROR=`readlink -f $ORIG/knownerror`
+	fi
+
+	# Sometime it can fail. Report just failures that are not known
+        rlRun "make test -j${CORES:-1} &> $RESULT_TEXT" 0-255 "Perform the test."
+        rlRun "grep -C 10 FAIL $RESULT_TEXT" 0-255 "Quickly show the test error (if any)."
+
+	rlRun "$FILTER $RESULT_TEXT" 0 "Showing unsuccessful tests"
+	rlRun "$FILTER -s $RESULT_TEXT > $FOUNDERROR" 0
+	rlRun "ls $KNOWNERROR $FOUNDERROR $RESULT_TEXT" 0 'check if there is needed files'
+	rlLog "`cat $FOUNDERROR`"
+
+	rlAssertLesserOrEqual "Checking number of found errors is in limits" "$(grep '^FAIL' $FOUNDERROR | wc -l)" "$(wc -l <$KNOWNERROR)"
+        cat $FOUNDERROR | while read STATUS TEST ; do
+		if [ "$STATUS" = FAIL ]; then
+			rlRun "grep '$TEST' $KNOWNERROR" 0 "Check $TEST failure is expected"
+		else
+			rlLog "$STATUS $TEST"
+		fi
+        done
+}
+
+rlJournalStart
+    rlPhaseStartSetup
+        # package assertions
+        rlAssertRpm $PACKAGE 
+        rlAssertRpm rpm-build
+        rlAssertRpm perl-Net-DNS-Nameserver
+
+	#pwd
+	ORIG=`pwd`
+	SETUP_SOFTHSM=`readlink -f setup-named-softhsm.sh`
+	FILTER=`readlink -f bind-systest-filter.sh`
+	CORES=`grep 'processor\s*:' /proc/cpuinfo | wc -l`
+
+	TAG=generic
+	if [ -f /etc/os-release ]; then
+		# extract platform tag
+		TAG=`(source /etc/os-release && echo ${PLATFORM_ID#platform:})`
+	fi
+
+        #tempdir
+        rlRun "TMPDIR=\`mktemp -d\`" 0 "Creating tmp directory"
+        rlRun "pushd $TMPDIR"
+
+        # topdir
+	TOPDIR=`rpm -E '%{_topdir}'`
+
+        # cleanup in topdir
+        mkdir -p $TOPDIR/{BUILD,SOURCES,SPECS}
+        rm -rf $TOPDIR/{BUILD,SOURCES,SPECS}/*
+
+        # download src rpm
+	if ! ls bind*.src.rpm; then
+		rlRun "dnf --enablerepo='*-source' download --source bind" 0 "Fetch source from repository"
+		rlRun "rpm -i bind*.src.rpm"
+	fi
+	
+        rlRun "rpm --define '_topdir $TOPDIR' -Uvh *rpm &> $TMPDIR/install.txt"
+        rlRun "cd $TOPDIR/SPECS" 
+
+	rlRun "dnf -y builddep *.spec"
+
+        # stop bind if it is running
+        rlServiceStop named
+    rlPhaseEnd
+
+    rlPhaseStartTest
+        # rebuild from source
+        rlRun "rpmbuild -ba *.spec &> $TMPDIR/build.txt"
+
+        # the test
+        rlRun "cd $TOPDIR/BUILD/bind*"
+
+        rlLogInfo "Test takes place in `pwd`"
+
+        rlRun "chown -R root ."
+
+	if [ -x "$SETUP_SOFTHSM" ]; then
+		rlRun "eval \"$(bash $SETUP_SOFTHSM -A)\"" 0 "Preparing PKCS#11 token slot"
+		rlRun "pkcs11-tokens" 0 "Testing token slot availability"
+	else
+		rlLog "PKCS#11 not initialized"
+	fi
+
+	if [ -d build ]; then
+		BUILD=build
+	else
+		BUILD=.
+	fi
+
+        rlRun "./bin/tests/system/ifconfig.sh up" 0 "Setup fake network interfaces."
+
+	# required by idna test 
+	export LC_ALL=en_US.UTF-8
+
+        rlRun "pushd $BUILD"
+
+	if echo "${TEST_VARIANTS:-$DEFAULT_VARIANTS}" | grep -q normal; then
+		rlLog "Running normal variant"
+		export NAMED_VARIANT= DNSSEC_VARIANT=
+		run_testsuite
+		rlLog "Finished normal variant"
+	fi
+
+	if echo "${TEST_VARIANTS:-$DEFAULT_VARIANTS}" | grep -q sdb; then
+		rlLog "Running sdb variant"
+		export NAMED_VARIANT=-sdb DNSSEC_VARIANT=
+		run_testsuite
+		rlLog "Finished sdb variant"
+	fi
+
+	if echo "${TEST_VARIANTS:-$DEFAULT_VARIANTS}" | grep -q pkcs11; then
+		rlLog "Running pkcs11 variant"
+		# Unfortunately, PKCS11 variant uses shared key storage
+		# It cannot use more threads for that reason
+		export NAMED_VARIANT=-pkcs11 DNSSEC_VARIANT=-pkcs11
+		CORES=1 run_testsuite
+		rlLog "Finished pkcs11 variant"
+	fi
+
+        rlRun "popd"
+
+        rlRun "./bin/tests/system/ifconfig.sh down" 0 "Remove fake network interfaces."
+
+    rlPhaseEnd
+
+    rlPhaseStartCleanup
+        rlBundleLogs "BUILD_LOGS" "$TMPDIR/install.txt" "$TMPDIR/builddeps.txt" "$TMPDIR/build.txt"
+        rlBundleLogs "TEST_LOGS" "$TMPDIR"/test*.txt
+        rlRun "popd"
+        rlRun "rm -r $TMPDIR" 0 "Removing tmp directory"
+    rlPhaseEnd
+rlJournalEnd
--- a/tests/Run-internal-BIND-test-suite/setup-named-softhsm.sh
+++ b/tests/Run-internal-BIND-test-suite/setup-named-softhsm.sh
@ -0,0 +1,123 @@
+#!/bin/sh
+#
+# This script will initialise token storage of softhsm PKCS11 provider
+# in custom location. Is useful to store tokens in non-standard location.
+#
+# Output can be evaluated from bash, it will prepare it for usage of temporary tokens.
+# Recommended use:
+# eval $(bash setup-named-softhsm.sh -A)
+#
+
+SOFTHSM2_CONF="$1"
+TOKENPATH="$2"
+GROUPNAME="$3"
+# Do not use this script for real keys worth protection
+# This is intended for crypto accelerators using PKCS11 interface.
+# Uninitialized token would fail any crypto operation.
+PIN=1234
+SO_PIN=1234
+LABEL=rpm
+
+set -e
+
+echo_i()
+{
+	echo "#" $@
+}
+
+random()
+{
+	if [ -x "$(which openssl 2>/dev/null)" ]; then
+		openssl rand -base64 $1
+	else
+		dd if=/dev/urandom bs=1c count=$1 | base64
+	fi
+}
+
+usage()
+{
+	echo "Usage: $0 -A [token directory] [group]"
+	echo "   or: $0 <config file> <token directory> [group]"
+}
+
+if [ "$SOFTHSM2_CONF" = "-A" -a -z "$TOKENPATH" ]; then
+	TOKENPATH=$(mktemp -d /var/tmp/softhsm-XXXXXX)
+fi
+
+if [ -z "$SOFTHSM2_CONF" -o -z "$TOKENPATH" ]; then
+	usage >&2
+	exit 1
+fi
+
+if [ "$SOFTHSM2_CONF" = "-A" ]; then
+	# Automagic mode instead
+	MODE=secure
+	SOFTHSM2_CONF="$TOKENPATH/softhsm2.conf"
+	PIN_SOURCE="$TOKENPATH/pin"
+	SOPIN_SOURCE="$TOKENPATH/so-pin"
+	TOKENPATH="$TOKENPATH/tokens"
+else
+	MODE=legacy
+fi
+
+[ -d "$TOKENPATH" ] || mkdir -p "$TOKENPATH"
+
+umask 0022
+
+if ! [ -f "$SOFTHSM2_CONF" ]; then
+cat  << SED > "$SOFTHSM2_CONF"
+# SoftHSM v2 configuration file
+
+directories.tokendir = ${TOKENPATH}
+objectstore.backend = file
+
+# ERROR, WARNING, INFO, DEBUG
+log.level = ERROR
+
+# If CKF_REMOVABLE_DEVICE flag should be set
+slots.removable = false
+SED
+else
+	echo_i "Config file $SOFTHSM2_CONF already exists" >&2
+fi
+
+if [ -n "$PIN_SOURCE" ]; then
+	touch "$PIN_SOURCE" "$SOPIN_SOURCE"
+	chmod 0600 "$PIN_SOURCE" "$SOPIN_SOURCE"
+	if [ -n "$GROUPNAME" ]; then
+		chgrp "$GROUPNAME" "$PIN_SOURCE" "$SOPIN_SOURCE"
+		chmod g+r "$PIN_SOURCE" "$SOPIN_SOURCE"
+	fi
+fi
+
+export SOFTHSM2_CONF
+
+if softhsm2-util --show-slots | grep 'Initialized:[[:space:]]*yes' > /dev/null
+then
+	echo_i "Token in ${TOKENPATH} is already initialized" >&2
+
+	[ -f "$PIN_SOURCE" ] && PIN=$(cat "$PIN_SOURCE")
+	[ -f "$SOPIN_SOURCE" ] && SO_PIN=$(cat "$SOPIN_SOURCE")
+else
+	PIN=$(random 6)
+	SO_PIN=$(random 18)
+	if [ -n "$PIN_SOURCE" ]; then
+		echo -n "$PIN" > "$PIN_SOURCE"
+		echo -n "$SO_PIN" > "$SOPIN_SOURCE"
+	fi
+
+	echo_i "Initializing tokens to ${TOKENPATH}..."
+	softhsm2-util --init-token --free --label "$LABEL" --pin "$PIN" --so-pin "$SO_PIN" | sed -e 's/^/# /'
+
+	if [ -n "$GROUPNAME" ]; then
+		chgrp -R -- "$GROUPNAME" "$TOKENPATH"
+		chmod -R -- g=rX,o= "$TOKENPATH"
+	fi
+fi
+
+echo "export SOFTHSM2_CONF=\"$SOFTHSM2_CONF\""
+echo "export PIN_SOURCE=\"$PIN_SOURCE\""
+echo "export SOPIN_SOURCE=\"$SOPIN_SOURCE\""
+# These are intentionaly not exported
+echo "PIN=\"$PIN\""
+echo "SO_PIN=\"$SO_PIN\""
--- a/tests/tests.yml
+++ b/tests/tests.yml
@ -0,0 +1,26 @@
+---
+# This first play always runs on the local staging system
+- hosts: localhost
+  roles:
+  - role: standard-test-beakerlib
+    tags:
+    - classic
+    tests:
+    - Master-server-chrooted
+    - Master-server-not-chrooted
+    - Run-internal-BIND-test-suite
+    required_packages:
+    - bind
+    - bind-chroot
+    - bind-sdb-chroot
+    - redhat-lsb
+    - bind-utils
+    - dnf-utils
+    - kyua
+    - bind-devel
+    - perl-Net-DNS
+    - perl-Net-DNS-Nameserver
+    - perl-Time-HiRes
+    - softhsm
+    - bind-pkcs11
+    - bind-pkcs11-utils
--- a/trusted-key.key
+++ b/trusted-key.key
@ -0,0 +1 @@
+. 3600 IN DNSKEY 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU=
				`@ -0,0 +1 @@`
				`. 3600 IN DNSKEY 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU=`