Update to 9.19.22 (rhbz#2270475)

https://downloads.isc.org/isc/bind9/9.19.22/doc/arm/html/notes.html#notes-for-bind-9-19-22
Update to 9.19.21 (#2264048 )
2024-04-15 21:27:34 +02:00 · 2024-02-17 03:12:52 +01:00 · 2024-01-16 13:40:37 +01:00 · 2024-01-16 11:08:38 +01:00 · 2024-01-16 11:08:38 +01:00 · 2023-11-20 12:30:29 +01:00
36 changed files with 1441 additions and 380 deletions
--- a/.gitignore
+++ b/.gitignore
@ -222,15 +222,3 @@ bind-9.7.2b1.tar.gz
 /bind-9.19.21.tar.xz.asc
 /bind-9.19.22.tar.xz
 /bind-9.19.22.tar.xz.asc
-/bind-9.19.24.tar.xz
-/bind-9.19.24.tar.xz.asc
-/bind-9.21.0.tar.xz
-/bind-9.21.0.tar.xz.asc
-/bind-9.21.2.tar.xz
-/bind-9.21.2.tar.xz.asc
-/bind-9.21.3.tar.xz
-/bind-9.21.3.tar.xz.asc
-/bind-9.21.4.tar.xz
-/bind-9.21.4.tar.xz.asc
-/bind-9.21.*.tar.xz
-/bind-9.21.*.tar.xz.asc
--- a/README.md
+++ b/README.md
@ -26,9 +26,13 @@ The package contains several subpackages, some of them can be disabled on rebuil
 * **bind9-next** -- *named* daemon providing DNS server
 * **bind9-next-utils** -- set of tools to analyse DNS responses or update entries (dig, host)
 * **bind9-next-doc** -- documentation for current bind, *BIND 9 Administrator Reference Manual*.
+* **bind9-next-license** -- Shared license for all packages but bind-export-libs.
 * **bind9-next-libs** -- Shared libraries used by some others programs
+* **bind9-next-devel** -- Development headers for libs. Can be disabled by `--without DEVEL`
+

 ## Optional features

 * *GSSTSIG* -- Support for Kerberos authentication in BIND.
 * *LMDB* -- Support for dynamic database for managing runtime added zones. Provides faster removal of added zone with much less overhead. But requires lmdb linked to base libs.
+* *DLZ* -- Support for dynamic loaded modules providing support for features *bind-sdb* provides, but only small module is required.
--- a/bind-9.11.12.tar.gz.asc
+++ b/bind-9.11.12.tar.gz.asc
@ -0,0 +1,16 @@
+-----BEGIN PGP SIGNATURE-----
+
+iQIzBAABAgAdFiEErj+seWcR7Fn8AHqkdLtrmky7PTgFAl2WMooACgkQdLtrmky7
+PThv2RAAnXNLYTzXtH6ls29tRm5Hc+D6UaeqcWDNQ4BpkRVhrFxtukalGCi9mmB6
+NPJzFyXmaOW654pypCIuEgqJNFUpDtLzLzT7SUF+mhm+5plsaRSBnh4mq87l5KSp
+twODAPnfCJV+HBk5RmToLEstAbGQ7xEBTyQtZoFkY+V7zEFwENKiCvWsoSWOkYR3
+zXo3sKjc83HV9ShbW/mCtbZf5L0qlbrKOAzqJfAFMhNNJi8kMbmr/Zi2sIfN+Rhv
+g8HQo89Epv6r51yAdeED8idIX4rKjjcEtHrZeDmLdCcdHgSEj2sIlH92Joce6vL0
+S59A0rItIXm6fW8sz6WNpcj4tVtWYbIYjXZ4SPFNkaUrHv8cUekq+5vbI+v07Gh3
+2bhtDsDyTY5I1/AsY/EFmwkCAjUS00jZryBnuJpLB3v5JtUog4ek32yLBzPrqRBo
+1876j4nlXAia8mG0OgJNWZ0gHyUPe/TgfR8fQDLmHxHHlKrJNTEwY6bLW8jzFTX1
+zk510fI1K7J9tiQgf5wcBQ2h3EBlqzDNIJDovoATzLYIf0HKyVegh/vnQdtdEhUR
+1DzJAt3bsBfAP1AFfWPD/ACu5Zdm7SxY1wE/pjkwttDU3sRZqOfuwNBGeolu3cVN
+O9/h1zsyVeVS0ui2vu4+V4EvNitmXsVbG2doDq9L5yBiIKGO2Ew=
+=GCy6
+-----END PGP SIGNATURE-----
--- a/bind-9.14.7.tar.gz.asc
+++ b/bind-9.14.7.tar.gz.asc
@ -0,0 +1,16 @@
+-----BEGIN PGP SIGNATURE-----
+
+iQIzBAABAgAdFiEErj+seWcR7Fn8AHqkdLtrmky7PTgFAl2WMpEACgkQdLtrmky7
+PTh/sg//QbNRAQvADQfwF1PPo+JxB+3WzQ9oJAWeHbOoiubwkUwO9xE+BEnTNd5o
+oM1lSLqFxNykOTaoeJlqPftPod1cxo7lSzkwflugGyB/59wliCpqCg053YV4x9mO
+QggvA/E50+0FI/Om/7v4GHGADu/JE83FovOueWAB0LgqfDSD6QFcNFF9sUJJ4P7r
+FcEXSWj8QbrHMWBKncZUOpD2ECotvtrYmi0DTHl1XfigESDQpWtsnTFuabCCsvkh
+ch9wQRplAes2Mf/aS5tl1y0QKKBFuEjtGiTdgrDl6o9GLnx6CueX5saZehu2EVkr
+fq2vEYUC2lRQSjuxSMMJ3L0TGUcl7+ixlAIISS2K9L5Xx7MhBXt/EH5KiKPfsEet
+3EH+DhxV5uXjDU7MgvREnxT+ssV23e0HWTz4tVVQ9LpvYmWPIgLcSOhHCc57yoQF
+c46V0f69dMWbMAlQ93EZSG274ZvpIszpK8+3hGI3/TuDFFgiQJeJJBFVtYJMle69
+3mEEclfzO7fBiXZFec6nVx2309bL64bafN7zszPKXl4XgoefOfD0v0eWqQT4fxfm
+dnGC0qMqSZs5F+d0fISV5JUUNYzt9PZjvnzqLLGOeTF6l3/n9G1mmNsXcxJ1OEIF
+6qh1oO7JTPjt0MFhKac4QjNQi/Bnp25O3I/PRyWZCbiwXkyvyQU=
+=ZT7s
+-----END PGP SIGNATURE-----
--- a/bind-9.21-unittest-32b-mem.patch
+++ b/bind-9.21-unittest-32b-mem.patch
@ -1,112 +0,0 @@
-From 4623873e588c86c6add4d53708e754e2d6f3e087 Mon Sep 17 00:00:00 2001
-From: Michal Nowak <mnowak@isc.org>
-Date: Wed, 20 May 2026 08:59:49 +0000
-Subject: [PATCH] Make deleg cleanuptests memory assertions 32-bit-safe
-
-Each address entry stored by dns_delegset_addaddr() is an
-isc_netaddrlink_t, whose size depends on sizeof(void *) via the
-ISC_LINK macro (24 bytes of address + two prev/next pointers): 40
-bytes on 64-bit, 32 bytes on 32-bit. The hardcoded 4 MB / 8 MB
-ranges only held on 64-bit, so dns_deleg_cleanuptests failed on
-armv7l with isc_mem_inuse() returning ~3.2 MB.
-
-Express the expected ranges in terms of sizeof(isc_netaddrlink_t)
-so they scale with pointer width, and pull the 99999 entry count
-out into a NENTRIES macro.
-
-Assisted-by: Claude:claude-opus-4-7
---
- tests/dns/deleg_test.c | 30 ++++++++++++++++++++++--------
- 1 file changed, 22 insertions(+), 8 deletions(-)
-
-diff --git a/tests/dns/deleg_test.c b/tests/dns/deleg_test.c
-index d3af6aba966..9497caf2753 100644
--- a/tests/dns/deleg_test.c
-+++ b/tests/dns/deleg_test.c
-@@ -52,6 +52,15 @@ isc_stdtime_now(void) {
- 
- #include <tests/isc.h>
- 
-+/*
-+ * cleanuptests adds NENTRIES address entries to a delegset; each is an
-+ * isc_netaddrlink_t whose size depends on sizeof(void *) via ISC_LINK.
-+ * Express memory expectations in terms of that struct so the test works
-+ * on both 32-bit and 64-bit targets.
-+ */
-+#define NENTRIES       99999
-+#define ENTRIES_MEM(n) ((size_t)(n) * sizeof(isc_netaddrlink_t))
-+
- static void
- shutdownloop(ISC_ATTR_UNUSED void *arg) {
- 	isc_loopmgr_shutdown();
-@@ -587,7 +596,8 @@ cleanuptests_phase3(void *arg) {
- 	dns_delegset_t *delegset = NULL;
- 	isc_result_t result;
- 
-	assert_int_in_range(isc_mem_inuse(db->mctx), 8000000, 8100000);
-+	assert_int_in_range(isc_mem_inuse(db->mctx), ENTRIES_MEM(2 * NENTRIES),
-+			    ENTRIES_MEM(2 * NENTRIES) + 100000);
- 
- 	/*
- 	 * baz. is there, but bar. is gone, as it has been
-@@ -612,7 +622,8 @@ cleanuptests_phase2(void *arg) {
- 	dns_delegset_t *delegset = NULL;
- 	isc_result_t result;
- 
-	assert_int_in_range(isc_mem_inuse(db->mctx), 4000000, 4100000);
-+	assert_int_in_range(isc_mem_inuse(db->mctx), ENTRIES_MEM(NENTRIES),
-+			    ENTRIES_MEM(NENTRIES) + 100000);
- 
- 	/*
- 	 * bar. is there
-@@ -629,10 +640,11 @@ cleanuptests_phase2(void *arg) {
- 	dns_delegset_allocdeleg(delegset, DNS_DELEGTYPE_DELEG_ADDRESSES,
- 				&deleg);
- 
-	for (size_t i = 0; i < 99999; i++) {
-+	for (size_t i = 0; i < NENTRIES; i++) {
- 		addipdeleg(AF_INET6, "1111::2222", delegset, deleg);
- 	}
-	assert_int_in_range(isc_mem_inuse(db->mctx), 8000000, 8100000);
-+	assert_int_in_range(isc_mem_inuse(db->mctx), ENTRIES_MEM(2 * NENTRIES),
-+			    ENTRIES_MEM(2 * NENTRIES) + 100000);
- 	writedb(db, "baz.", 30, &delegset, true);
- 	deleg = NULL;
- 
-@@ -677,11 +689,12 @@ cleanuptests(ISC_ATTR_UNUSED void *arg) {
- 
- 	assert_int_in_range(isc_mem_inuse(db->mctx), 500, 2000);
- 
-	for (size_t i = 0; i < 99999; i++) {
-+	for (size_t i = 0; i < NENTRIES; i++) {
- 		addipdeleg(AF_INET6, "1111::2222", delegset, deleg);
- 	}
- 
-	assert_int_in_range(isc_mem_inuse(db->mctx), 4000000, 4100000);
-+	assert_int_in_range(isc_mem_inuse(db->mctx), ENTRIES_MEM(NENTRIES),
-+			    ENTRIES_MEM(NENTRIES) + 100000);
- 
- 	writedb(db, "stuff.", 10, &delegset, true);
- 	deleg = NULL;
-@@ -694,7 +707,7 @@ cleanuptests(ISC_ATTR_UNUSED void *arg) {
- 	dns_delegset_allocdeleg(delegset, DNS_DELEGTYPE_DELEG_ADDRESSES,
- 				&deleg);
- 
-	for (size_t i = 0; i < 99999; i++) {
-+	for (size_t i = 0; i < NENTRIES; i++) {
- 		addipdeleg(AF_INET6, "1111::2222", delegset, deleg);
- 	}
- 
-@@ -703,7 +716,8 @@ cleanuptests(ISC_ATTR_UNUSED void *arg) {
- 	 * with DB mem context) overmem conditions will be detected, and the
- 	 * expired node will be removed
- 	 */
-	assert_int_in_range(isc_mem_inuse(db->mctx), 8000000, 8100000);
-+	assert_int_in_range(isc_mem_inuse(db->mctx), ENTRIES_MEM(2 * NENTRIES),
-+			    ENTRIES_MEM(2 * NENTRIES) + 100000);
- 	writedb(db, "bar.", 30, &delegset, true);
- 	deleg = NULL;
- 
-- 
-2.54.0
-
--- a/bind-9.21-unittest-qpdb-i386.patch
+++ b/bind-9.21-unittest-qpdb-i386.patch
@ -1,41 +0,0 @@
-From af1e4bf375000fc532c55ff6df841661185a2451 Mon Sep 17 00:00:00 2001
-From: Petr Mensik <pemensik@redhat.com>
-Date: Wed, 28 May 2025 19:40:05 +0200
-Subject: [PATCH] Try rcu_barrier
-
-https://gitlab.isc.org/isc-projects/bind9/-/issues/5328
---
- tests/dns/qpdb_test.c | 3 +++
- 1 file changed, 3 insertions(+)
-
-diff --git a/tests/dns/qpdb_test.c b/tests/dns/qpdb_test.c
-index 1c840e2..b6ad0f4 100644
--- a/tests/dns/qpdb_test.c
-+++ b/tests/dns/qpdb_test.c
-@@ -24,6 +24,7 @@
- #include <cmocka.h>
- 
- #include <isc/lib.h>
-+#include <isc/urcu.h>
- #include <isc/util.h>
- 
- #include <dns/lib.h>
-@@ -170,6 +171,7 @@ ISC_LOOP_TEST_IMPL(overmempurge_bigrdata) {
- 
- 	dns_db_detach(&db);
- 	isc_mem_detach(&mctx);
-+	rcu_barrier();
- 	isc_loopmgr_shutdown();
- }
- 
-@@ -221,6 +223,7 @@ ISC_LOOP_TEST_IMPL(overmempurge_longname) {
- 
- 	dns_db_detach(&db);
- 	isc_mem_detach(&mctx);
-+	rcu_barrier();
- 	isc_loopmgr_shutdown();
- }
- 
-- 
-2.51.0
-
--- a/bind9-next.spec
+++ b/bind9-next.spec
@ -10,6 +10,7 @@
 %bcond_without SUDO
 %bcond_without GSSTSIG
 %bcond_without JSON
+%bcond_without DLZ
 # New MaxMind GeoLite support
 %bcond_without GEOIP2
 # Disabled temporarily until kyua is fixed on rawhide, bug #1926779
@ -17,11 +18,10 @@
 # Do not set CI environment, include more unit tests, even less stable
 %bcond_with    UNITTEST_ALL
 %bcond_without DNSTAP
+%bcond_without LMDB
 %bcond_without DOC
 %bcond_with    TSAN
 %bcond_without DTRACE
-%bcond_with    OPENSSL_ENGINE
-%bcond         JEMALLOC  0%{?fedora}

 %{?!bind_uid:  %global bind_uid  25}
 %{?!bind_gid:  %global bind_gid  25}
@ -30,9 +30,7 @@
 %global        chroot_prefix     %{bind_dir}/chroot
 %global        chroot_create_directories /dev /run/named %{_localstatedir}/{log,named,tmp} \\\
                                         %{_sysconfdir}/{crypto-policies/back-ends,pki/dnssec-keys,pki/tls,named} \\\
-                                         %{_libdir}/bind %{_libdir}/named %{_datadir}/{GeoIP,dns-root-data} /proc/sys/net/ipv4
-%global        upstream_sources 0 2
-%global        pgp_signed_sources 2
+                                         %{_libdir}/bind %{_libdir}/named %{_datadir}/GeoIP /proc/sys/net/ipv4

 %global forgeurl0 https://gitlab.isc.org/isc-projects/bind9

@ -52,9 +50,9 @@ Conflicts: %1 \

 Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
 Name:     bind9-next
-License:  MPL-2.0 AND ISC AND BSD-3-clause AND MIT AND BSD-2-clause
+License:  MPL-2.0 AND ISC AND BSD-3-clause AND Expat AND BSD-2-clause
 #
-Version:  9.21.22
+Version:  9.19.22
 Release:  %autorelease
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
@ -66,17 +64,22 @@ Source2:  https://downloads.isc.org/isc/bind9/%{version}/%{upname}-%{version}.ta
 Source3:  named.logrotate
 Source4:  https://www.isc.org/docs/isc-keyblock.asc
 Source16: named.conf
+# Refresh by command: dig @a.root-servers.net. +tcp +norec
+# or from URL
+Source17: https://www.internic.net/domain/named.root
 Source18: named.localhost
 Source19: named.loopback
 Source20: named.empty
 Source23: named.rfc1912.zones
 Source25: named.conf.sample
-Source27: named-mkroot.sh
+Source27: named.root.key
 Source35: bind.tmpfiles.d
+Source36: trusted-key.key
 Source37: named.service
 Source38: named-chroot.service
 Source41: setup-named-chroot.sh
 Source42: generate-rndc-key.sh
+Source43: named.rwtab
 Source44: named-chroot-setup.service
 Source46: named-setup-rndc.service
 Source48: setup-named-softhsm.sh
@ -85,63 +88,40 @@ Source49: named-chroot.files
 # Common patches
 # Red Hat specific documentation is not relevant to upstream
 Patch1: bind-9.16-redhat_doc.patch
-# https://gitlab.isc.org/isc-projects/bind9/-/issues/5328
-# avoid often fails on i386, unsupported upstream
-Patch4: bind-9.21-unittest-qpdb-i386.patch
-# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/12061
-Patch5: bind-9.21-unittest-32b-mem.patch

 %{?systemd_ordering}
 Requires:       coreutils
+Requires(pre):  shadow-utils
 Requires(post): shadow-utils
 Requires(post): glibc-common
 Requires(post): grep
-Requires:       dns-root-data
 Requires:       %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release}
 Recommends:     %{name}-utils %{name}-dnssec-utils
 %upname_compat %{upname}
 Obsoletes:      %{name}-pkcs11 < 32:9.18.4-2
 Conflicts:      bind-dyndb-ldap

-BuildRequires:  gcc
-BuildRequires:  make
-BuildRequires:  openssl-devel
-BuildRequires:  libtool
-BuildRequires:  meson >= 1.3.0
-BuildRequires:  ninja-build
-BuildRequires:  pkgconfig
-BuildRequires:  pkgconfig(libcap)
-BuildRequires:  pkgconfig(libidn2)
-BuildRequires:  pkgconfig(libxml-2.0)
+BuildRequires:  gcc, make
+BuildRequires:  openssl-devel, libtool, autoconf, pkgconfig, libcap-devel
+BuildRequires:  libidn2-devel, libxml2-devel
 BuildRequires:  systemd-rpm-macros
 BuildRequires:  selinux-policy
-BuildRequires:  findutils
-BuildRequires:  sed
-BuildRequires:  pkgconfig(libnghttp2)
-BuildRequires:  pkgconfig(liburcu)
-BuildRequires:  pkgconfig(libedit)
-BuildRequires:  dns-root-data
-# Compress the changelog
-BuildRequires:  gzip
-BuildRequires:  pkgconfig(lmdb)
-%if %{with JEMALLOC}
-BuildRequires:  pkgconfig(jemalloc)
+BuildRequires:  findutils sed
+BuildRequires:  libnghttp2-devel
+BuildRequires:  userspace-rcu-devel
+%if 0%{?fedora}
+BuildRequires:  jemalloc-devel
+BuildRequires:  gnupg2
 %endif
-%if ! 0%{?rhel}
-BuildRequires:  gpgverify
-%endif
-BuildRequires:  pkgconfig(libuv)
-%if %{with OPENSSL_ENGINE}
-BuildRequires:  openssl-devel-engine
+BuildRequires:  libuv-devel
+%if %{with DLZ}
+BuildRequires:  openldap-devel, libpq-devel, sqlite-devel, mariadb-connector-c-devel
 %endif
 %if %{with UNITTEST}
 # make unit dependencies
-BuildRequires:  pkgconfig(cmocka)
+BuildRequires:  libcmocka-devel
 # Ensure we have lscpu
 BuildRequires:  util-linux
-# Catch failing unittests coredumps
-BuildRequires:  gdb
-BuildRequires:  xz
 %endif
 %if %{with UNITTEST} || %{with SYSTEMTEST}
 BuildRequires:  softhsm
@ -151,13 +131,8 @@ BuildRequires:  softhsm
 BuildRequires:  perl(Net::DNS) perl(Net::DNS::Nameserver) perl(Time::HiRes) perl(Getopt::Long)
 BuildRequires:  perl(English)
 BuildRequires:  python3-pytest
-BuildRequires:  python3-pytest-xdist
-BuildRequires:  python3-dns
-BuildRequires:  python3-hypothesis
 # manual configuration requires this tool
 BuildRequires:  iproute
-BuildRequires:  python3-jinja2
-BuildRequires:  lmdb-devel
 %if %{with SUDO}
 BuildRequires:  libcap sudo
 %endif
@ -165,6 +140,9 @@ BuildRequires:  libcap sudo
 %if %{with GSSTSIG}
 BuildRequires:  krb5-devel
 %endif
+%if %{with LMDB}
+BuildRequires:  lmdb-devel
+%endif
 %if %{with JSON}
 BuildRequires:  json-c-devel
 %endif
@ -184,9 +162,7 @@ BuildRequires: libtsan
 %endif
 %if %{with DTRACE}
 # https://gitlab.isc.org/isc-projects/bind9/-/issues/4041
-BuildRequires:  systemtap
-BuildRequires:  systemtap-sdt-devel
-BuildRequires:  systemtap-sdt-dtrace
+BuildRequires: systemtap-sdt-devel
 %endif

 %description
@ -198,8 +174,7 @@ tools for verifying that the DNS server is operating properly.

 %package libs
 Summary: Libraries used by the BIND DNS packages
-Provides: %{name}-license = %{epoch}:%{version}-%{release}
-Obsoletes: %{name}-license < 32:9.21.11-5
+Requires: %{name}-license = %{epoch}:%{version}-%{release}
 Provides: %{name}-libs-lite = %{epoch}:%{version}-%{release}
 Obsoletes: %{name}-libs-lite < 32:9.16.13
 Obsoletes: %{name}-pkcs11-libs < 32:9.18.4-2
@ -208,6 +183,13 @@ Obsoletes: %{name}-pkcs11-libs < 32:9.18.4-2
 Contains heavyweight version of BIND suite libraries used by both named DNS
 server and utilities in %{name}-utils package.

+%package license
+Summary:  License of the BIND DNS suite
+BuildArch:noarch
+
+%description license
+Contains license of the BIND DNS suite.
+
 %package utils
 Summary: Utilities for querying DNS name servers
 Requires: %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release}
@ -247,14 +229,15 @@ Summary:  Header files and libraries needed for bind-dyndb-ldap
 Provides: %{name}-lite-devel = %{epoch}:%{version}-%{release}
 Obsoletes: %{name}-lite-devel < 32:9.16.6-3
 Requires: %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release}
-Requires: openssl-devel%{?_isa}
-Requires: libxml2-devel%{?_isa}
+Requires: openssl-devel%{?_isa} libxml2-devel%{?_isa}
 Requires: libcap-devel%{?_isa}
-Requires: lmdb-devel%{?_isa}
 %upname_compat %{upname}-devel
 %if %{with GSSTSIG}
 Requires: krb5-devel%{?_isa}
 %endif
+%if %{with LMDB}
+Requires: lmdb-devel%{?_isa}
+%endif
 %if %{with JSON}
 Requires:  json-c-devel%{?_isa}
 %endif
@ -283,9 +266,43 @@ chroot(2) jail for the named(8) program from the BIND package.
 Based on the code from Jan "Yenya" Kasprzak <kas@fi.muni.cz>


+%if %{with DLZ}
+%package dlz-filesystem
+Summary: BIND server filesystem DLZ module
+Requires: %{name}%{?_isa} = %{epoch}:%{version}-%{release}
+
+%description dlz-filesystem
+Dynamic Loadable Zones filesystem module for BIND server.
+
+%package dlz-ldap
+Summary: BIND server ldap DLZ module
+Requires: %{name}%{?_isa} = %{epoch}:%{version}-%{release}
+
+%description dlz-ldap
+Dynamic Loadable Zones LDAP module for BIND server.
+
+%package dlz-mysql
+Summary: BIND server mysql and mysqldyn DLZ modules
+Requires: %{name}%{?_isa} = %{epoch}:%{version}-%{release}
+Provides: %{name}-dlz-mysqldyn = %{epoch}:%{version}-%{release}
+Obsoletes: %{name}-dlz-mysqldyn < 32:9.16.6-3
+
+%description dlz-mysql
+Dynamic Loadable Zones MySQL module for BIND server.
+Contains also mysqldyn module with dynamic DNS updates (DDNS) support.
+
+%package dlz-sqlite3
+Summary: BIND server sqlite3 DLZ module
+Requires: %{name}%{?_isa} = %{epoch}:%{version}-%{release}
+
+%description dlz-sqlite3
+Dynamic Loadable Zones sqlite3 module for BIND server.
+%endif
+
 %if %{with DOC}
 %package doc
 Summary:   BIND 9 Administrator Reference Manual
+Requires:  %{name}-license = %{epoch}:%{version}-%{release}
 Requires:  python3-sphinx_rtd_theme
 BuildArch: noarch

@ -303,25 +320,25 @@ in HTML and PDF format.
 %endif

 %prep
-%if ! 0%{?rhel} || 0%{?rhel} > 10
-# RHEL does not (again?) support this verification
+%if 0%{?fedora}
+# RHEL does not yet support this verification
 %{gpgverify} --keyring='%{SOURCE4}' --signature='%{SOURCE2}' --data='%{SOURCE0}'
 %endif
 %autosetup -n %{upname}-%{version} -p1

+# Sparc and s390 arches need to use -fPIE
+%ifarch sparcv9 sparc64 s390 s390x
+for i in bin/named/Makefile.am; do
+  sed -i 's|fpie|fPIE|g' $i
+done
+%endif
+
 :;

-# Create a sysusers.d config file
-cat >bind9-next.sysusers.conf <<EOF
-g named %{bind_gid}
-u named %{bind_uid} 'Named' /var/named -
-EOF
-
-# get rid of rpath issues
-sed -e '/install_rpath:/ d' -i meson.build
-

 %build
+## We use out of tree configure/build for export libs
+%define _configure "../configure"

 # normal and pkcs11 unit tests
 %define unit_prepare_build() \
@ -332,57 +349,62 @@ sed -e '/install_rpath:/ d' -i meson.build
 %define systemtest_prepare_build() \
  cp -Tuav bin/tests "%{1}/bin/tests/" \

-%if %{with OPENSSL_ENGINE}
+CFLAGS="$CFLAGS $RPM_OPT_FLAGS"
 CPPFLAGS="$CPPFLAGS -DOPENSSL_API_COMPAT=10100"
-%else
-CPPFLAGS="$CPPFLAGS -DOPENSSL_NO_ENGINE=1"
-%endif
 %if %{with TSAN}
  CFLAGS+=" -O1 -fsanitize=thread -fPIE -pie"
 %endif
 export CFLAGS CPPFLAGS
 export STD_CDEFINES="$CPPFLAGS"

-#sed -i -e \
-#'s/([bind_VERSION_EXTRA],\s*\([^)]*\))/([bind_VERSION_EXTRA], \1-RH)/' \
-#configure.ac
+sed -i -e \
+'s/([bind_VERSION_EXTRA],\s*\([^)]*\))/([bind_VERSION_EXTRA], \1-RH)/' \
+configure.ac

-install -p -m 0755 %{SOURCE27} ./named-mkroot.sh # create named.root.key
-./named-mkroot.sh
-[ -f named.root.key ]
+%if 0%{?rhel} && 0%{?rhel} < 9
+# disable Sphinx warnings as errors, epel8 does not pass cleanly
+sed -e 's/-W\s//' -i Makefile.docs
+%endif

+autoreconf --force --install

+mkdir build
+
+%if %{with DLZ}
+# DLZ modules do not support oot builds. Copy files into build
+mkdir -p build/contrib/dlz
+cp -frp contrib/dlz/modules build/contrib/dlz/modules
+%endif
+
+pushd build
 LIBDIR_SUFFIX=
 export LIBDIR_SUFFIX
-
-%meson \
+%configure \
+  --with-pic \
+  --disable-static \
  --includedir=%{_includedir}/bind9 \
-  -Didn=enabled \
-  -Dfuzzing=disabled \
-%if %{without DTRACE}
-  -Dtracing=disabled \
-%endif
+  --with-libidn2 \
 %if %{with GEOIP2}
-  -Dgeoip=enabled \
+  --with-maxminddb \
 %endif
 %if %{with GSSTSIG}
-  -Dgssapi=enabled \
+  --with-gssapi=yes \
+%endif
+%if %{with LMDB}
+  --with-lmdb=yes \
+%else
+  --with-lmdb=no \
 %endif
 %if %{with JSON}
-  -Dstats-json=enabled \
+  --with-json-c \
 %endif
 %if %{with DNSTAP}
-  -Ddnstap=enabled \
+  --enable-dnstap \
 %endif
 %if %{with UNITTEST}
-  -Dcmocka=enabled \
-%endif
-%if %{with DOC}
-  -Ddoc=enabled \
-%endif
-%if %{without JEMALLOC}
-  -Djemalloc=disabled \
+  --with-cmocka \
 %endif
+  --enable-full-report \
 ;
 %if %{with DNSTAP}
  pushd lib
@ -391,27 +413,25 @@ export LIBDIR_SUFFIX
  popd
 %endif

-%meson_build
+%make_build SPHINX_W=''

 %if %{with DOC}
-  %meson_build man arm arm-epub
-%endif
-%if %{with SYSTEMTEST}
-  %meson_build system-test-dependencies
+  %make_build doc SPHINX_W=''
 %endif

-# Compress changelog by default
-gzip doc/changelog/changelog-*.rst
+%if %{with DLZ}
+  pushd contrib/dlz/modules
+  for DIR in filesystem ldap mysql mysqldyn sqlite3; do
+    %make_build -C $DIR CFLAGS="-fPIC -I../include $CFLAGS $LDFLAGS -DPTHREADS=1" LDFLAGS="$LDFLAGS"
+  done
+  popd
+%endif
+popd # build

-#unit_prepare_build build
-#systemtest_prepare_build build
+%unit_prepare_build build
+%systemtest_prepare_build build

 %check
-# reduce test loops (from default 100) for isc/{mutex/spinlock/rwlock}
-# to allow rwlock(isc_rwlock_benchmark) to finish within the 300 seconds
-# timeout limit on platforms (riscv64,s390x) where it is slow
-# TODO: find out why it is slow
-export ISC_BENCHMARK_LOOPS=20
 %if %{with UNITTEST} || %{with SYSTEMTEST}
  # Tests require initialization of pkcs11 token
  eval "$(bash %{SOURCE48} -A "`pwd`/softhsm-tokens")"
@ -421,32 +441,28 @@ export ISC_BENCHMARK_LOOPS=20
 export TSAN_OPTIONS="log_exe_name=true log_path=ThreadSanitizer exitcode=0"
 %endif

-# We produce it runtime. Check it has valid syntax.
-LD_LIBRARY_PATH="$LD_LIBRARY_PATH:${RPM_BUILD_ROOT}%{_libdir}" \
-  ${RPM_BUILD_ROOT}%{_bindir}/named-checkconf ${RPM_BUILD_ROOT}%{_sysconfdir}/named.root.key
-
 %if %{with UNITTEST}
+  pushd build
  CPUS=$(lscpu -p=cpu,core | grep -v '^#' | wc -l)
  THREADS="$CPUS"
-  COREPATTERN="$(cat /proc/sys/kernel/core_pattern)"
 %if %{without UNITTEST_ALL}
  export CI=true
 %endif
  if [ "$CPUS" -gt 16 ]; then
    ORIGFILES=$(ulimit -n)
    THREADS=16
-    # https://gitlab.isc.org/isc-projects/bind9/-/issues/5328
-    export ISC_TASK_WORKERS="$THREADS"
    ulimit -n 8092 || : # Requires on some machines with many cores
  fi
  e=0
-  %meson_test --num-processes ${THREADS} || e=$?
-
+  %make_build unit -j${THREADS} || e=$?
+  # Display details of failure
+  cat tests/*/test-suite.log
  if [ "$e" -ne 0 ]; then
-    echo "ERROR: test failed. Aborting."
+    echo "ERROR: this build of BIND failed 'make unit'. Aborting."
    exit $e;
  fi;
  [ "$CPUS" -gt 16 ] && ulimit -n $ORIGFILES || :
+  popd
 ## End of UNITTEST
 %endif

@ -454,7 +470,7 @@ LD_LIBRARY_PATH="$LD_LIBRARY_PATH:${RPM_BUILD_ROOT}%{_libdir}" \
 # Runs system test if ip addresses are already configured
 # or it is able to configure them
  SUDO=
-  pushd bin/tests/system/
+  pushd build/bin/tests/system/
  if perl ./testsock.pl
  then
    CONFIGURED=already
@ -474,23 +490,18 @@ LD_LIBRARY_PATH="$LD_LIBRARY_PATH:${RPM_BUILD_ROOT}%{_libdir}" \

  if [ -n "$CONFIGURED" ]
  then
-    pushd bin/tests/system
+    set -e
+    pushd build/bin/tests
    export CI_SYSTEM=yes # allow running tests as root
    chown -R ${USER} . # Can be unknown user
-    e=0
-    pytest -n ${THREADS} --capture=tee-sys || e=$?
+    %make_build test 2>&1 | tee test.log
+    e=$?
    [ "$CONFIGURED" = build ] && $SUDO sh ./ifconfig.sh down
+    popd
    if [ "$e" -ne 0 ]; then
-      echo "ERROR: failed running 'pytest' in system tests. Aborting."
-      ls -1 "$(pwd)"/*_tmp_*
-      for TMPTEST in *_tmp_*
-      do
-        echo "# $TMPTEST"
-        cat $TMPTEST/pytest.log.txt
-      done
+      echo "ERROR: this build of BIND failed 'make test'. Aborting."
      exit $e;
    fi;
-    popd
  else
    echo 'SKIPPED: tests require root, CAP_NET_ADMIN or already configured test addresses.'
  fi
@ -521,7 +532,9 @@ popd
 touch ${RPM_BUILD_ROOT}/%{chroot_prefix}%{_sysconfdir}/named.conf
 #end chroot

-%meson_install
+pushd build
+%make_install
+popd

 # Remove unwanted files
 rm -f ${RPM_BUILD_ROOT}/etc/bind.keys
@ -544,8 +557,29 @@ mkdir -p ${RPM_BUILD_ROOT}%{_sysconfdir}/sysconfig
 install -pm 644 %{SOURCE1} ${RPM_BUILD_ROOT}%{_sysconfdir}/sysconfig/named
 install -pm 644 %{SOURCE49} ${RPM_BUILD_ROOT}%{_sysconfdir}/named-chroot.files

-%if "%{_sbindir}" != "%{_bindir}"
-  ln -s ../bin/{named-checkconf,named-checkzone,named-compilezone} %{buildroot}%{_sbindir}/
+pushd ${RPM_BUILD_ROOT}%{_sbindir}
+# Compatibility with previous major versions, only for selected binaries
+for BIN in named-checkconf named-checkzone named-compilezone
+do
+  ln -s ../bin/$BIN $BIN
+done
+popd
+
+%if %{with DLZ}
+  pushd build
+  pushd contrib/dlz/modules
+  for DIR in filesystem ldap mysql mysqldyn sqlite3; do
+    %make_install -C $DIR libdir=%{_libdir}/bind
+  done
+  pushd ${RPM_BUILD_ROOT}/%{_libdir}/named
+    cp -s ../bind/dlz_*.so .
+  popd
+  mkdir -p doc/{mysql,mysqldyn}
+  cp -p mysqldyn/testing/README doc/mysqldyn/README.testing
+  cp -p mysqldyn/testing/* doc/mysqldyn
+  cp -p mysql/testing/* doc/mysql
+  popd
+  popd
 %endif

 # Remove libtool .la files:
@ -555,6 +589,9 @@ find ${RPM_BUILD_ROOT}/%{_libdir} -name '*.la' -exec '/bin/rm' '-f' '{}' ';';
 %if %{without DNSTAP}
 rm -f ${RPM_BUILD_ROOT}%{_mandir}/man1/dnstap-read.1* || true
 %endif
+%if %{without LMDB}
+rm -f ${RPM_BUILD_ROOT}%{_mandir}/man8/named-nzd2nzf.8* || true
+%endif

 pushd ${RPM_BUILD_ROOT}%{_mandir}/man8
 ln -s ddns-confgen.8.gz tsig-keygen.8.gz
@ -565,9 +602,8 @@ popd

 %if %{with DOC}
 mkdir -p ${RPM_BUILD_ROOT}%{_pkgdocdir}
-pushd %{_vpath_builddir}
-cp -a arm/ ${RPM_BUILD_ROOT}%{_pkgdocdir}/html/
-#rm -rf ${RPM_BUILD_ROOT}%{_pkgdocdir}/html/.{buildinfo,doctrees}
+cp -a build/doc/arm/_build/html ${RPM_BUILD_ROOT}%{_pkgdocdir}
+rm -rf ${RPM_BUILD_ROOT}%{_pkgdocdir}/html/.{buildinfo,doctrees}
 # Backward compatible link to 9.11 documentation
 (cd ${RPM_BUILD_ROOT}%{_pkgdocdir} && ln -s html/index.html Bv9ARM.html)
 # Share static data from original sphinx package
@ -577,13 +613,10 @@ do
  BINDTHEMEDIR="${RPM_BUILD_ROOT}%{_pkgdocdir}/html/_static/$BASE"
  if [ -d "$BINDTHEMEDIR" ]; then
    rm -rf "$BINDTHEMEDIR"
-    ln -sr "${RPM_BUILD_ROOT}${DIR}" "$BINDTHEMEDIR"
+    ln -s "$DIR" "$BINDTHEMEDIR"
  fi
 done
-cp -p arm-epub/Bv9ARM.epub ${RPM_BUILD_ROOT}%{_pkgdocdir}
-popd
-cp -p doc/changelog/changelog-history.rst* doc/notes/notes-*.rst* \
-      ${RPM_BUILD_ROOT}%{_pkgdocdir}
+cp -p build/doc/arm/_build/epub/Bv9ARM.epub ${RPM_BUILD_ROOT}%{_pkgdocdir}
 %endif

 # Ghost config files:
@ -592,13 +625,13 @@ touch ${RPM_BUILD_ROOT}%{_localstatedir}/log/named.log
 # configuration files:
 install -m 640 %{SOURCE16} ${RPM_BUILD_ROOT}%{_sysconfdir}/named.conf
 touch ${RPM_BUILD_ROOT}%{_sysconfdir}/rndc.{key,conf}
-install -m 644 -p named.root.key ${RPM_BUILD_ROOT}%{_sysconfdir}/named.root.key
-ln -s "%{_datadir}/dns-root-data/root.key" ${RPM_BUILD_ROOT}%{_sysconfdir}/trusted-key.key
+install -m 644 %{SOURCE27} ${RPM_BUILD_ROOT}%{_sysconfdir}/named.root.key
+install -m 644 %{SOURCE36} ${RPM_BUILD_ROOT}%{_sysconfdir}/trusted-key.key
 mkdir -p ${RPM_BUILD_ROOT}%{_sysconfdir}/named

 # data files:
 mkdir -p ${RPM_BUILD_ROOT}%{_localstatedir}/named
-ln -s "%{_datadir}/dns-root-data/root.hints" ${RPM_BUILD_ROOT}%{_localstatedir}/named/named.ca
+install -m 640 %{SOURCE17} ${RPM_BUILD_ROOT}%{_localstatedir}/named/named.ca
 install -m 640 %{SOURCE18} ${RPM_BUILD_ROOT}%{_localstatedir}/named/named.localhost
 install -m 640 %{SOURCE19} ${RPM_BUILD_ROOT}%{_localstatedir}/named/named.loopback
 install -m 640 %{SOURCE20} ${RPM_BUILD_ROOT}%{_localstatedir}/named/named.empty
@ -611,7 +644,7 @@ install -m 644 %{SOURCE25} sample/etc/named.conf
 install -m 644 %{SOURCE16} named.conf.default
 install -m 644 %{SOURCE23} sample/etc/named.rfc1912.zones
 install -m 644 %{SOURCE18} %{SOURCE19} %{SOURCE20}  sample/var/named
-ln -s "%{_datadir}/dns-root-data/root.hints" sample/var/named/named.ca
+install -m 644 %{SOURCE17} sample/var/named/named.ca
 for f in my.internal.zone.db slaves/my.slave.internal.zone.db slaves/my.ddns.internal.zone.db my.external.zone.db; do 
  echo '@ in soa localhost. root 1 3H 15M 1W 1D
  ns localhost.' > sample/var/named/$f; 
@ -621,7 +654,15 @@ done
 mkdir -p ${RPM_BUILD_ROOT}%{_tmpfilesdir}
 install -m 644 %{SOURCE35} ${RPM_BUILD_ROOT}%{_tmpfilesdir}/named.conf

-install -m0644 -D bind9-next.sysusers.conf %{buildroot}%{_sysusersdir}/bind9-next.conf
+mkdir -p ${RPM_BUILD_ROOT}%{_sysconfdir}/rwtab.d
+install -m 644 %{SOURCE43} ${RPM_BUILD_ROOT}%{_sysconfdir}/rwtab.d/named
+
+%pre
+if [ "$1" -eq 1 ]; then
+  /usr/sbin/groupadd -g %{bind_gid} -f -r named >/dev/null 2>&1 || :;
+  /usr/sbin/useradd  -u %{bind_uid} -r -N -M -g named -s /sbin/nologin -d /var/named -c Named named >/dev/null 2>&1 || :;
+fi;
+:;

 %post
 %?ldconfig
@ -714,25 +755,21 @@ fi;
 # FIXME: current build targets filters into %%_libdir/bind again?
 %dir %{_libdir}/bind
 %{_libdir}/bind/filter*.so
-%{_libdir}/bind/synthrecord.so
 %dir %{_libdir}/named
 %config(noreplace) %verify(not md5 size mtime) %{_sysconfdir}/sysconfig/named
 %config(noreplace) %attr(0644,root,named) %{_sysconfdir}/named.root.key
 %config(noreplace) %{_sysconfdir}/logrotate.d/named
 %{_tmpfilesdir}/named.conf
-%{_sysusersdir}/bind9-next.conf
+%{_sysconfdir}/rwtab.d/named
 %{_unitdir}/named.service
 %{_unitdir}/named-setup-rndc.service
 %{_bindir}/named-journalprint
 %{_bindir}/named-checkconf
 %{_bindir}/named-rrchecker
-%{_bindir}/named-makejournal
 %{_bindir}/mdig
 %{_sbindir}/named
 %{_sbindir}/rndc*
-%if "%{_sbindir}" != "%{_bindir}"
 %{_sbindir}/named-checkconf
-%endif
 %{_libexecdir}/generate-rndc-key.sh
 %{_libexecdir}/setup-named-softhsm.sh
 %{_mandir}/man1/mdig.1*
@ -744,10 +781,8 @@ fi;
 %{_mandir}/man1/named-checkconf.1*
 %{_mandir}/man8/rndc-confgen.8*
 %{_mandir}/man1/named-journalprint.1*
-%{_mandir}/man1/named-makejournal.1*
-%{_mandir}/man8/filter-*.8*
-%doc README.md named.conf.default
-%doc doc/changelog/changelog-9.*.rst*
+%{_mandir}/man8/filter-*.8.gz
+%doc CHANGES README.md named.conf.default
 %doc sample/

 # Hide configuration
@ -781,6 +816,8 @@ fi;
 %{_libdir}/libdns-%{version}*.so
 %{_libdir}/libisc-%{version}*.so
 %{_libdir}/libisccfg-%{version}*.so
+
+%files license
 %{!?_licensedir:%global license %%doc}
 %license COPYRIGHT

@ -796,16 +833,16 @@ fi;
 %{_bindir}/nsec3hash
 %{_bindir}/named-checkzone
 %{_bindir}/named-compilezone
-%if "%{_sbindir}" != "%{_bindir}"
 %{_sbindir}/named-checkzone
 %{_sbindir}/named-compilezone
-%endif
 %if %{with DNSTAP}
 %{_bindir}/dnstap-read
 %{_mandir}/man1/dnstap-read.1*
 %endif
+%if %{with LMDB}
 %{_bindir}/named-nzd2nzf
 %{_mandir}/man1/named-nzd2nzf.1*
+%endif
 %{_mandir}/man1/host.1*
 %{_mandir}/man1/nsupdate.1*
 %{_mandir}/man1/dig.1*
@ -823,8 +860,6 @@ fi;
 %{_bindir}/dnssec*
 %{_mandir}/man1/dnssec*.1*

-%if 0
-# TODO: remove devel subpackage or create custom installation part
 %files devel
 %{_libdir}/libisccc.so
 %{_libdir}/libns.so
@ -839,7 +874,6 @@ fi;
 %{_includedir}/bind9/irs
 %{_includedir}/bind9/isc
 %{_includedir}/bind9/isccfg
-%endif

 %files chroot
 %config(noreplace) %{_sysconfdir}/named-chroot.files
@ -880,15 +914,32 @@ fi;
 %dir %{chroot_prefix}/run/named
 %{chroot_prefix}%{_localstatedir}/run

+%if %{with DLZ}
+%files dlz-filesystem
+%{_libdir}/{named,bind}/dlz_filesystem_dynamic.so
+
+%files dlz-mysql
+%{_libdir}/{named,bind}/dlz_mysql_dynamic.so
+%doc build/contrib/dlz/modules/doc/mysql
+%{_libdir}/{named,bind}/dlz_mysqldyn_mod.so
+%doc build/contrib/dlz/modules/doc/mysqldyn
+
+%files dlz-ldap
+%{_libdir}/{named,bind}/dlz_ldap_dynamic.so
+%doc contrib/dlz/modules/ldap/testing/*
+
+%files dlz-sqlite3
+%{_libdir}/{named,bind}/dlz_sqlite3_dynamic.so
+%doc contrib/dlz/modules/sqlite3/testing/*
+
+%endif
+
 %if %{with DOC}
 %files doc
 %dir %{_pkgdocdir}
 %doc %{_pkgdocdir}/html
 %doc %{_pkgdocdir}/Bv9ARM.html
 %doc %{_pkgdocdir}/Bv9ARM.epub
-%doc %{_pkgdocdir}/changelog-history.rst*
-%doc %{_pkgdocdir}/notes-*.rst*
-%license COPYRIGHT
 %endif

 %changelog
--- a/bind97-exportlib.patch
+++ b/bind97-exportlib.patch
@ -0,0 +1,226 @@
+diff -up bind-9.9.3rc2/isc-config.sh.in.exportlib bind-9.9.3rc2/isc-config.sh.in
+diff -up bind-9.9.3rc2/lib/export/dns/Makefile.in.exportlib bind-9.9.3rc2/lib/export/dns/Makefile.in
+--- bind-9.9.3rc2/lib/export/dns/Makefile.in.exportlib	2013-04-30 08:38:46.000000000 +0200
+++ bind-9.9.3rc2/lib/export/dns/Makefile.in	2013-05-13 10:45:22.574089729 +0200
+@@ -35,9 +35,9 @@ CDEFINES =	-DUSE_MD5 @USE_OPENSSL@ @USE_
+ 
+ CWARNINGS =
+ 
+-ISCLIBS =	../isc/libisc.@A@
+ISCLIBS =	../isc/libisc-export.@A@
+ 
+-ISCDEPLIBS =	../isc/libisc.@A@
+ISCDEPLIBS =	../isc/libisc-export.@A@
+ 
+ LIBS =		@LIBS@
+ 
+@@ -116,29 +116,29 @@ version.@O@: ${srcdir}/version.c
+ 		-DLIBAGE=${LIBAGE} \
+ 		-c ${srcdir}/version.c
+ 
+-libdns.@SA@: ${OBJS}
+libdns-export.@SA@: ${OBJS}
+ 	${AR} ${ARFLAGS} $@ ${OBJS}
+ 	${RANLIB} $@
+ 
+-libdns.la: ${OBJS}
+libdns-export.la: ${OBJS}
+ 	${LIBTOOL_MODE_LINK} \
+-		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libdns.la \
+		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libdns-export.la \
+ 		-rpath ${export_libdir} \
+ 		-version-info ${LIBINTERFACE}:${LIBREVISION}:${LIBAGE} \
+ 		${OBJS} ${ISCLIBS} @DNS_CRYPTO_LIBS@ ${LIBS}
+ 
+-timestamp: libdns.@A@
+timestamp: libdns-export.@A@
+ 	touch timestamp
+ 
+ installdirs:
+ 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${export_libdir}
+ 
+ install:: timestamp installdirs
+-	${LIBTOOL_MODE_INSTALL} ${INSTALL_DATA} libdns.@A@ \
+	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} libdns-export.@A@ \
+ 	${DESTDIR}${export_libdir}/
+ 
+ clean distclean::
+-	rm -f libdns.@A@ timestamp
+	rm -f libdns-export.@A@ timestamp
+ 	rm -f gen code.h include/dns/enumtype.h include/dns/enumclass.h
+ 	rm -f include/dns/rdatastruct.h
+ 
+diff -up bind-9.9.3rc2/lib/export/irs/Makefile.in.exportlib bind-9.9.3rc2/lib/export/irs/Makefile.in
+--- bind-9.9.3rc2/lib/export/irs/Makefile.in.exportlib	2013-04-30 08:38:46.000000000 +0200
+++ bind-9.9.3rc2/lib/export/irs/Makefile.in	2013-05-13 10:45:22.575089729 +0200
+@@ -43,9 +43,9 @@ SRCS =		context.c \
+ 		gai_sterror.c getaddrinfo.c getnameinfo.c \
+ 		resconf.c
+ 
+-ISCLIBS =	../isc/libisc.@A@
+-DNSLIBS =	../dns/libdns.@A@
+-ISCCFGLIBS =	../isccfg/libisccfg.@A@
+ISCLIBS =	../isc/libisc-export.@A@
+DNSLIBS =	../dns/libdns-export.@A@
+ISCCFGLIBS =	../isccfg/libisccfg-export.@A@
+ 
+ LIBS =		@LIBS@
+ 
+@@ -62,26 +62,26 @@ version.@O@: ${srcdir}/version.c
+ 		-DLIBAGE=${LIBAGE} \
+ 		-c ${srcdir}/version.c
+ 
+-libirs.@SA@: ${OBJS} version.@O@
+libirs-export.@SA@: ${OBJS} version.@O@
+ 	${AR} ${ARFLAGS} $@ ${OBJS} version.@O@
+ 	${RANLIB} $@
+ 
+-libirs.la: ${OBJS} version.@O@
+libirs-export.la: ${OBJS} version.@O@
+ 	${LIBTOOL_MODE_LINK} \
+-		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libirs.la \
+		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libirs-export.la \
+ 		-rpath ${export_libdir} \
+ 		-version-info ${LIBINTERFACE}:${LIBREVISION}:${LIBAGE} \
+ 		${OBJS} version.@O@ ${LIBS} ${ISCCFGLIBS} ${DNSLIBS} ${ISCLIBS}
+ 
+-timestamp: libirs.@A@
+timestamp: libirs-export.@A@
+ 	touch timestamp
+ 
+ installdirs:
+ 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${export_libdir}
+ 
+ install:: timestamp installdirs
+-	${LIBTOOL_MODE_INSTALL} ${INSTALL_DATA} libirs.@A@ \
+	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} libirs-export.@A@ \
+ 	${DESTDIR}${export_libdir}/
+ 
+ clean distclean::
+-	rm -f libirs.@A@ libirs.la timestamp
+	rm -f libirs-export.@A@ libirs-export.la timestamp
+diff -up bind-9.9.3rc2/lib/export/isccfg/Makefile.in.exportlib bind-9.9.3rc2/lib/export/isccfg/Makefile.in
+--- bind-9.9.3rc2/lib/export/isccfg/Makefile.in.exportlib	2013-04-30 08:38:46.000000000 +0200
+++ bind-9.9.3rc2/lib/export/isccfg/Makefile.in	2013-05-13 10:45:22.576089729 +0200
+@@ -30,11 +30,11 @@ CINCLUDES =	-I. ${DNS_INCLUDES} -I${expo
+ CDEFINES =
+ CWARNINGS =
+ 
+-ISCLIBS =	../isc/libisc.@A@
+-DNSLIBS =	../dns/libdns.@A@ @DNS_CRYPTO_LIBS@
+ISCLIBS =	../isc/libisc-export.@A@
+DNSLIBS =	../dns/libdns-export.@A@ @DNS_CRYPTO_LIBS@
+ 
+ ISCDEPLIBS =	../../lib/isc/libisc.@A@
+-ISCCFGDEPLIBS =	libisccfg.@A@
+ISCCFGDEPLIBS =	libisccfg-export.@A@
+ 
+ LIBS =		@LIBS@
+ 
+@@ -58,26 +58,26 @@ version.@O@: ${srcdir}/version.c
+ 		-DLIBAGE=${LIBAGE} \
+ 		-c ${srcdir}/version.c
+ 
+-libisccfg.@SA@: ${OBJS}
+libisccfg-export.@SA@: ${OBJS}
+ 	${AR} ${ARFLAGS} $@ ${OBJS}
+ 	${RANLIB} $@
+ 
+-libisccfg.la: ${OBJS}
+libisccfg-export.la: ${OBJS}
+ 	 ${LIBTOOL_MODE_LINK} \
+-		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libisccfg.la \
+		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libisccfg-export.la \
+ 		-rpath ${export_libdir} \
+ 		-version-info ${LIBINTERFACE}:${LIBREVISION}:${LIBAGE} \
+ 		${OBJS} ${LIBS} ${DNSLIBS} ${ISCLIBS}
+ 
+-timestamp: libisccfg.@A@
+timestamp: libisccfg-export.@A@
+ 	touch timestamp
+ 
+ installdirs:
+ 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${export_libdir}
+ 
+ install:: timestamp installdirs
+-	${LIBTOOL_MODE_INSTALL} ${INSTALL_DATA} libisccfg.@A@ \
+	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} libisccfg-export.@A@ \
+ 	${DESTDIR}${export_libdir}/
+ 
+ clean distclean::
+-	rm -f libisccfg.@A@ timestamp
+	rm -f libisccfg-export.@A@ timestamp
+diff -up bind-9.9.3rc2/lib/export/isc/Makefile.in.exportlib bind-9.9.3rc2/lib/export/isc/Makefile.in
+--- bind-9.9.3rc2/lib/export/isc/Makefile.in.exportlib	2013-04-30 08:38:46.000000000 +0200
+++ bind-9.9.3rc2/lib/export/isc/Makefile.in	2013-05-13 10:45:22.576089729 +0200
+@@ -100,6 +100,10 @@ SRCS =		@ISC_EXTRA_SRCS@ \
+ 
+ LIBS =		@LIBS@
+ 
+# Note: the order of SUBDIRS is important.
+# Attempt to disable parallel processing.
+.NOTPARALLEL:
+.NO_PARALLEL:
+ SUBDIRS =	include unix nls @ISC_THREAD_DIR@
+ TARGETS =	timestamp
+ 
+@@ -113,26 +117,26 @@ version.@O@: ${srcdir}/version.c
+ 		-DLIBAGE=${LIBAGE} \
+ 		-c ${srcdir}/version.c
+ 
+-libisc.@SA@: ${OBJS}
+libisc-export.@SA@: ${OBJS}
+ 	${AR} ${ARFLAGS} $@ ${OBJS}
+ 	${RANLIB} $@
+ 
+-libisc.la: ${OBJS}
+libisc-export.la: ${OBJS}
+ 	${LIBTOOL_MODE_LINK} \
+-		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libisc.la \
+		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libisc-export.la \
+ 		-rpath ${export_libdir} \
+ 		-version-info ${LIBINTERFACE}:${LIBREVISION}:${LIBAGE} \
+ 		${OBJS} ${LIBS}
+ 
+-timestamp: libisc.@A@
+timestamp: libisc-export.@A@
+ 	touch timestamp
+ 
+ installdirs:
+ 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${export_libdir}
+ 
+ install:: timestamp installdirs
+-	${LIBTOOL_MODE_INSTALL} ${INSTALL_DATA} libisc.@A@ \
+	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} libisc-export.@A@ \
+ 	${DESTDIR}${export_libdir}
+ 
+ clean distclean::
+-	rm -f libisc.@A@ libisc.la timestamp
+	rm -f libisc-export.@A@ libisc-export.la timestamp
+diff -up bind-9.9.3rc2/lib/export/samples/Makefile.in.exportlib bind-9.9.3rc2/lib/export/samples/Makefile.in
+--- bind-9.9.3rc2/lib/export/samples/Makefile.in.exportlib	2013-04-30 08:38:46.000000000 +0200
+++ bind-9.9.3rc2/lib/export/samples/Makefile.in	2013-05-13 10:45:22.577089729 +0200
+@@ -31,15 +31,15 @@ CINCLUDES =	-I${srcdir}/include -I../dns
+ CDEFINES =
+ CWARNINGS =
+ 
+-DNSLIBS =	../dns/libdns.@A@ @DNS_CRYPTO_LIBS@
+-ISCLIBS =	../isc/libisc.@A@
+-ISCCFGLIBS =	../isccfg/libisccfg.@A@
+-IRSLIBS =	../irs/libirs.@A@
+DNSLIBS =	../dns/libdns-export.@A@ @DNS_CRYPTO_LIBS@
+ISCLIBS =	../isc/libisc-export.@A@
+ISCCFGLIBS =	../isccfg/libisccfg-export.@A@
+IRSLIBS =	../irs/libirs-export.@A@
+ 
+-DNSDEPLIBS =	../dns/libdns.@A@
+-ISCDEPLIBS =	../isc/libisc.@A@
+-ISCCFGDEPLIBS =	../isccfg/libisccfg.@A@
+-IRSDEPLIBS =	../irs/libirs.@A@
+DNSDEPLIBS =	../dns/libdns-export.@A@
+ISCDEPLIBS =	../isc/libisc-export.@A@
+ISCCFGDEPLIBS =	../isccfg/libisccfg-export.@A@
+IRSDEPLIBS =	../irs/libirs-export.@A@
+ 
+ DEPLIBS =	${DNSDEPLIBS} ${ISCCFGDEPLIBS} ${ISCDEPLIBS}
+ 
--- a/named-chroot.files
+++ b/named-chroot.files
@ -18,7 +18,6 @@
 /usr/lib64/bind
 /usr/lib/bind
 /usr/share/GeoIP
-/usr/share/dns-root-data
 /run/named
 /proc/sys/net/ipv4/ip_local_port_range
 # Warning: the order is important
--- a/named-chroot.service
+++ b/named-chroot.service
@ -25,7 +25,6 @@ ExecReload=/bin/sh -c 'if /usr/sbin/rndc null > /dev/null 2>&1; then /usr/sbin/r
 ExecStop=/bin/sh -c '/usr/sbin/rndc stop > /dev/null 2>&1 || /bin/kill -TERM $MAINPID'

 PrivateTmp=false
-Restart=on-abnormal

 [Install]
 WantedBy=multi-user.target
--- a/named-mkroot.sh
+++ b/named-mkroot.sh
@ -1,20 +0,0 @@
-#!/bin/sh
-# Create named.root.key from dns-root-data package
-
-ROOT_DS=/usr/share/dns-root-data/root.ds
-: ${OUTPUT:=named.root.key}
-
-if ! [ -r "$ROOT_DS" ]; then
-	echo "Root trust file is not readable: $ROOT_DS"
-	exit 1
-fi
-
-echo "# Autogenerated from $ROOT_DS" > "$OUTPUT"
-echo "trust-anchors {" >> "$OUTPUT"
-cat "$ROOT_DS" | while read DOMAIN CLS QTYPE KEYTAG ALG DIG HASH;
-do
-	echo "$DOMAIN initial-ds $KEYTAG $ALG $DIG \"$HASH\";" >> "$OUTPUT";
-done
-echo "}; " >> "$OUTPUT"
-# Set the same modification time as data source.
-touch -r $ROOT_DS "$OUTPUT"
--- a/named.conf.sample
+++ b/named.conf.sample
@ -1,11 +1,11 @@
-# vim: ft=named:
 /*
 Sample named.conf BIND DNS server 'named' configuration file
 for the Red Hat BIND distribution.

 See the BIND Administrator's Reference Manual (ARM) for details, in:
-   file:///usr/share/doc/bind/html/index.html
- Or on upstream site: https://bind9.readthedocs.org/
+   file:///usr/share/doc/bind-{version}/arm/Bv9ARM.html
+ Also see the BIND Configuration GUI : /usr/bin/system-config-bind and 
+ its manual.
 */

 options
@ -47,7 +47,6 @@ options

 	allow-query		{ localhost; };
 	allow-query-cache	{ localhost; };
-	allow-transfer		{ localhost; };

 	/* Enable/disable recursion - recursion yes/no;

@ -65,7 +64,7 @@ options
 	/* DNSSEC related options. See information about keys ("Trusted keys", bellow) */

 	/* Enable DNSSEC validation on recursive servers */
-	dnssec-validation auto;
+	dnssec-validation yes;

 	/* In Fedora we use /run/named instead of default /var/run/named
 	   so we have to configure paths properly. */
@ -166,7 +165,7 @@ view "internal"
 	zone "my.slave.internal.zone" {
 		type secondary;
 		file "slaves/my.slave.internal.zone.db";
-		primaries { /* put master nameserver IPs here */ 127.0.0.1; } ;
+		masters { /* put master nameserver IPs here */ 127.0.0.1; } ;
 		// put slave zones in the slaves/ directory so named can update them
 	};	
 	zone "my.ddns.internal.zone" {
@ -180,8 +179,7 @@ view "internal"
 key ddns_key
 {
 	algorithm hmac-sha256;
-	#secret "use /usr/sbin/ddns-confgen to generate TSIG keys";
-	secret "dXNlIC91c3Ivc2Jpbi9kZG5zLWNvbmZnZW4gdG8gZ2VuZXJhdGUgVFNJRyBrZXlz";
+	secret "use /usr/sbin/ddns-confgen to generate TSIG keys";
 };

 view "external"
@ -214,13 +212,19 @@ view "external"
  This statement contains DNSSEC keys. If you want DNSSEC aware resolver you
  should configure at least one trusted key.

-  Note that no key written below is valid. Especially root key is maintained in
-  /etc/named.root.key file.
+  Note that no key written below is valid. Especially root key because root zone
+  is not signed yet.
 */
 /*
 trust-anchors {
 // Root Key
-. initial-ds 38696 8 2 "683D2D0ACB8C9B712A1948B27F741219298D0A450D612C483AF444A4C0FB2B16";
+. initial-key 257 3 8 "AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3
+		      +/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kv
+		      ArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF
+		      0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+e
+		      oZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfd
+		      RUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwN
+		      R1AkUTV74bU=";

 // Key for forward zone
 example.com. static-key 257 3 8 "AwEAAZ0aqu1rJ6orJynrRfNpPmayJZoAx9Ic2/Rl9VQW
@ -234,6 +238,6 @@ example.com. static-key 257 3 8 "AwEAAZ0aqu1rJ6orJynrRfNpPmayJZoAx9Ic2/Rl9VQW


 // Key for reverse zone.
-2.0.192.IN-ADDRPA.NET. static-ds 31406 8 2 "F78CF3344F72137235098ECBBD08947C2C9001C7F6A085A17F518B5D8F6B916D";
+2.0.192.IN-ADDRPA.NET. initial-ds 31406 8 2 "F78CF3344F72137235098ECBBD08947C2C9001C7F6A085A17F518B5D8F6B916D";
 };
 */
--- a/named.logrotate
+++ b/named.logrotate
@ -2,8 +2,11 @@
    missingok
    su named named
    create 0644 named named
-    notifempty
    postrotate
-        /usr/bin/rndc closelogs > /dev/null 2>&1 || true
+        /usr/bin/systemctl reload named.service > /dev/null 2>&1 || true
+        /usr/bin/systemctl reload named-chroot.service > /dev/null 2>&1 || true
+        /usr/bin/systemctl reload named-sdb.service > /dev/null 2>&1 || true
+        /usr/bin/systemctl reload named-sdb-chroot.service > /dev/null 2>&1 || true
+        /usr/bin/systemctl reload named-pkcs11.service > /dev/null 2>&1 || true
    endscript
 }
--- a/named.root
+++ b/named.root
@ -0,0 +1,92 @@
+;       This file holds the information on root name servers needed to 
+;       initialize cache of Internet domain name servers
+;       (e.g. reference this file in the "cache  .  <file>"
+;       configuration file of BIND domain name servers). 
+; 
+;       This file is made available by InterNIC 
+;       under anonymous FTP as
+;           file                /domain/named.cache 
+;           on server           FTP.INTERNIC.NET
+;       -OR-                    RS.INTERNIC.NET
+;
+;       last update:     December 20, 2023
+;       related version of root zone:     2023122001
+; 
+; FORMERLY NS.INTERNIC.NET 
+;
+.                        3600000      NS    A.ROOT-SERVERS.NET.
+A.ROOT-SERVERS.NET.      3600000      A     198.41.0.4
+A.ROOT-SERVERS.NET.      3600000      AAAA  2001:503:ba3e::2:30
+; 
+; FORMERLY NS1.ISI.EDU 
+;
+.                        3600000      NS    B.ROOT-SERVERS.NET.
+B.ROOT-SERVERS.NET.      3600000      A     170.247.170.2
+B.ROOT-SERVERS.NET.      3600000      AAAA  2801:1b8:10::b
+; 
+; FORMERLY C.PSI.NET 
+;
+.                        3600000      NS    C.ROOT-SERVERS.NET.
+C.ROOT-SERVERS.NET.      3600000      A     192.33.4.12
+C.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:2::c
+; 
+; FORMERLY TERP.UMD.EDU 
+;
+.                        3600000      NS    D.ROOT-SERVERS.NET.
+D.ROOT-SERVERS.NET.      3600000      A     199.7.91.13
+D.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:2d::d
+; 
+; FORMERLY NS.NASA.GOV
+;
+.                        3600000      NS    E.ROOT-SERVERS.NET.
+E.ROOT-SERVERS.NET.      3600000      A     192.203.230.10
+E.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:a8::e
+; 
+; FORMERLY NS.ISC.ORG
+;
+.                        3600000      NS    F.ROOT-SERVERS.NET.
+F.ROOT-SERVERS.NET.      3600000      A     192.5.5.241
+F.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:2f::f
+; 
+; FORMERLY NS.NIC.DDN.MIL
+;
+.                        3600000      NS    G.ROOT-SERVERS.NET.
+G.ROOT-SERVERS.NET.      3600000      A     192.112.36.4
+G.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:12::d0d
+; 
+; FORMERLY AOS.ARL.ARMY.MIL
+;
+.                        3600000      NS    H.ROOT-SERVERS.NET.
+H.ROOT-SERVERS.NET.      3600000      A     198.97.190.53
+H.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:1::53
+; 
+; FORMERLY NIC.NORDU.NET
+;
+.                        3600000      NS    I.ROOT-SERVERS.NET.
+I.ROOT-SERVERS.NET.      3600000      A     192.36.148.17
+I.ROOT-SERVERS.NET.      3600000      AAAA  2001:7fe::53
+; 
+; OPERATED BY VERISIGN, INC.
+;
+.                        3600000      NS    J.ROOT-SERVERS.NET.
+J.ROOT-SERVERS.NET.      3600000      A     192.58.128.30
+J.ROOT-SERVERS.NET.      3600000      AAAA  2001:503:c27::2:30
+; 
+; OPERATED BY RIPE NCC
+;
+.                        3600000      NS    K.ROOT-SERVERS.NET.
+K.ROOT-SERVERS.NET.      3600000      A     193.0.14.129
+K.ROOT-SERVERS.NET.      3600000      AAAA  2001:7fd::1
+; 
+; OPERATED BY ICANN
+;
+.                        3600000      NS    L.ROOT-SERVERS.NET.
+L.ROOT-SERVERS.NET.      3600000      A     199.7.83.42
+L.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:9f::42
+; 
+; OPERATED BY WIDE
+;
+.                        3600000      NS    M.ROOT-SERVERS.NET.
+M.ROOT-SERVERS.NET.      3600000      A     202.12.27.33
+M.ROOT-SERVERS.NET.      3600000      AAAA  2001:dc3::35
+; End of file
--- a/named.root.key
+++ b/named.root.key
@ -1,5 +1,13 @@
-# Autogenerated from /usr/share/dns-root-data/root.ds
-truste-anchors {
-. initial-ds 20326 8 2 "E06D44B80B8F1D39A95C0B0D7C65D08458E880409BBC683457104237C7F8EC8D";
-. initial-ds 38696 8 2 "683D2D0ACB8C9B712A1948B27F741219298D0A450D612C483AF444A4C0FB2B16";
-}; 
+trust-anchors {
+        # ROOT KEYS: See https://data.iana.org/root-anchors/root-anchors.xml
+        # for current trust anchor information.
+        #
+        # This key (20326) was published in the root zone in 2017.
+        # Servers which were already using the old key (19036) should
+        # roll seamlessly to this new one via RFC 5011 rollover. Servers
+        # being set up for the first time can use the contents of this
+        # file as initializing keys; thereafter, the keys in the
+        # managed key database will be trusted and maintained
+        # automatically.
+        . initial-ds 20326 8 2 "E06D44B80B8F1D39A95C0B0D7C65D08458E880409BBC683457104237C7F8EC8D";
+};
--- a/named.rwtab
+++ b/named.rwtab
@ -0,0 +1,6 @@
+dirs    /var/named
+
+files	/var/named/named.ca
+files	/var/named/named.empty
+files	/var/named/named.localhost
+files	/var/named/named.loopback
--- a/named.service
+++ b/named.service
@ -20,7 +20,6 @@ ExecReload=/bin/sh -c 'if /usr/sbin/rndc null > /dev/null 2>&1; then /usr/sbin/r
 ExecStop=/bin/sh -c '/usr/sbin/rndc stop > /dev/null 2>&1 || /bin/kill -TERM $MAINPID'

 PrivateTmp=true
-Restart=on-abnormal

 [Install]
 WantedBy=multi-user.target
--- a/plans/all.fmf
+++ b/plans/all.fmf
@ -4,5 +4,3 @@ discover:
    url: https://src.fedoraproject.org/tests/bind.git
 execute:
    how: tmt
-context:
-    component: bind9-next
--- a/plans/tier1-public.fmf
+++ b/plans/tier1-public.fmf
@ -7,5 +7,3 @@ discover:
    filter: 'tier: 1'
 execute:
    how: tmt
-context:
-    component: bind9-next
--- a/4
+++ b/4
@ -1,2 +1,2 @@
-SHA512 (bind-9.21.22.tar.xz) = f9e11d150162661c755dabdd7862c0565e6a10077e2a6aee04f8cefce94c262d8928ff9e42f8c8750242aee3b0992afe2f49f72f0f8cab8b7e4ae1c9fc06e0fa
-SHA512 (bind-9.21.22.tar.xz.asc) = 1e0bd14fad5754e12b6a4855dbed698dba74468790948316e17442e5bc840fc81d18e590fd78186a1e26e9526870b13470dcef6a15644e91775cc8883813ad24
+SHA512 (bind-9.19.22.tar.xz) = 609f73ab7e34e9ef0e5854a0bf150009c1ae34615c5f8c7fecf0352ea65ce0d92fecc02b918a0b3b90b3c303dad659e4981a97b1413d02724b20a5ed2d1d905f
+SHA512 (bind-9.19.22.tar.xz.asc) = 4839365da593ab6b924372019bbb8b8212856116c563e4f9b6d0b03681234fb855b7f3c85766919fac400be7508f7b72bc9d2a3d8496ce9ee21c6b5fb4369cf3
--- a/tests/Master-server-chrooted/Makefile
+++ b/tests/Master-server-chrooted/Makefile
@ -0,0 +1,63 @@
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Makefile of /CoreOS/tests/Sanity/Master-server-chrooted
+#   Description: Run basic empty named service and try to resolve localhost on it
+#   Author: Petr Mensik <pemensik@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2018 Red Hat, Inc.
+#
+#   This program is free software: you can redistribute it and/or
+#   modify it under the terms of the GNU General Public License as
+#   published by the Free Software Foundation, either version 2 of
+#   the License, or (at your option) any later version.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE.  See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public License
+#   along with this program. If not, see http://www.gnu.org/licenses/.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+export TEST=/CoreOS/tests/Sanity/Master-server-chrooted
+export TESTVERSION=1.0
+
+BUILT_FILES=
+
+FILES=$(METADATA) runtest.sh Makefile PURPOSE
+
+.PHONY: all install download clean
+
+run: $(FILES) build
+	./runtest.sh
+
+build: $(BUILT_FILES)
+	test -x runtest.sh || chmod a+x runtest.sh
+
+clean:
+	rm -f *~ $(BUILT_FILES)
+
+
+include /usr/share/rhts/lib/rhts-make.include
+
+$(METADATA): Makefile
+	@echo "Owner:           Petr Mensik <pemensik@redhat.com>" > $(METADATA)
+	@echo "Name:            $(TEST)" >> $(METADATA)
+	@echo "TestVersion:     $(TESTVERSION)" >> $(METADATA)
+	@echo "Path:            $(TEST_DIR)" >> $(METADATA)
+	@echo "Description:     Run basic empty named-chroot service and try to resolve localhost on it" >> $(METADATA)
+	@echo "Type:            Sanity" >> $(METADATA)
+	@echo "TestTime:        5m" >> $(METADATA)
+	@echo "RunFor:          bind" >> $(METADATA)
+	@echo "Requires:        bind bind-utils bind-chroot bind-sdb-chroot" >> $(METADATA)
+	@echo "Priority:        Normal" >> $(METADATA)
+	@echo "License:         GPLv2+" >> $(METADATA)
+	@echo "Confidential:    no" >> $(METADATA)
+	@echo "Destructive:     no" >> $(METADATA)
+	@echo "Releases:        -RHEL4 -RHELClient5 -RHELServer5 -RHEL6" >> $(METADATA)
+
+	rhts-lint $(METADATA)
--- a/tests/Master-server-chrooted/PURPOSE
+++ b/tests/Master-server-chrooted/PURPOSE
@ -0,0 +1,6 @@
+PURPOSE of /CoreOS/tests/Sanity/Master-server-chrooted
+Description: Run basic empty named-chroot service and try to resolve localhost on it
+Author: Petr Mensik <pemensik@redhat.com>
+
+Check also clean package both when running and finished.
+https://bugzilla.redhat.com/show_bug.cgi?id=1592873
--- a/tests/Master-server-chrooted/runtest.sh
+++ b/tests/Master-server-chrooted/runtest.sh
@ -0,0 +1,73 @@
+#!/bin/bash
+# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   runtest.sh of /CoreOS/tests/Sanity/Master-server-chrooted
+#   Description: Run basic empty named-chroot service and try to resolve localhost on it
+#   Author: Petr Mensik <pemensik@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2018 Red Hat, Inc.
+#
+#   This program is free software: you can redistribute it and/or
+#   modify it under the terms of the GNU General Public License as
+#   published by the Free Software Foundation, either version 2 of
+#   the License, or (at your option) any later version.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE.  See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public License
+#   along with this program. If not, see http://www.gnu.org/licenses/.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+# Include Beaker environment
+. /usr/bin/rhts-environment.sh || exit 1
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+PACKAGE="bind"
+
+test_service()
+{
+    local SERVICE="$1"
+    local PACKAGE="$2"
+	rlRun "rlServiceStart $SERVICE"
+	rlRun "dig @localhost localhost | grep '^localhost'"
+	rlRun "dig @localhost -x 127.0.0.1 | grep 'PTR[[:space:]]\+localhost.$'" 0 "Reverse address works"
+	rlRun "rpm -V $PACKAGE" 0 "Checking $SERVICE package when running"
+	rlRun "rlServiceRestore $SERVICE"
+	rlRun "rpm -V $PACKAGE" 0 "Checking $SERVICE package when stopped"
+}
+
+rlJournalStart
+    rlPhaseStartSetup
+        rlAssertRpm bind
+	rlAssertRpm bind-utils
+	rlAssertRpm bind-chroot
+    rlPhaseEnd
+
+    rlPhaseStartTest "Testing named"
+	test_service named bind
+    rlPhaseEnd
+
+    rlPhaseStartTest "Testing named-chroot"
+	test_service named-chroot bind-chroot
+    rlPhaseEnd
+
+    rlPhaseStartTest "Testing named-sdb-chroot"
+	    if rpm -q bind-sdb-chroot; then
+		test_service named-sdb-chroot bind-sdb-chroot
+	    else
+		rlLog "bind-sdb-chroot not installed, skipping it"
+	    fi
+    rlPhaseEnd
+
+    rlPhaseStartCleanup
+	# noop
+    rlPhaseEnd
+rlJournalPrintText
+rlJournalEnd
--- a/tests/Master-server-not-chrooted/Makefile
+++ b/tests/Master-server-not-chrooted/Makefile
@ -0,0 +1,65 @@
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Makefile of /CoreOS/bind/Sanity/Master-server-not-chrooted
+#   Description: Set up master nameserver, test it.
+#   Author: Martin Cermak <mcermak@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2009 Red Hat, Inc. All rights reserved.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+export TEST=/CoreOS/bind/Sanity/Master-server-not-chrooted
+export TESTVERSION=1.0
+
+BUILT_FILES=
+
+FILES=$(METADATA) runtest.sh Makefile PURPOSE named.conf zonefile 
+
+.PHONY: all install download clean
+
+run: $(FILES) build
+	./runtest.sh
+
+build: $(BUILT_FILES)
+	chmod a+x runtest.sh
+
+clean:
+	rm -f *~ $(BUILT_FILES)
+
+
+include /usr/share/rhts/lib/rhts-make.include
+
+$(METADATA): Makefile
+	@echo "Owner:           Martin Cermak <mcermak@redhat.com>" > $(METADATA)
+	@echo "Name:            $(TEST)" >> $(METADATA)
+	@echo "TestVersion:     $(TESTVERSION)" >> $(METADATA)
+	@echo "Path:            $(TEST_DIR)" >> $(METADATA)
+	@echo "Description:     Set up master nameserver in chrooted env, test it." >> $(METADATA)
+	@echo "Type:            Sanity" >> $(METADATA)
+	@echo "TestTime:        5m" >> $(METADATA)
+	@echo "RunFor:          bind" >> $(METADATA)
+	@echo "Requires:        bind bind-chroot redhat-lsb" >> $(METADATA)
+	@echo "Requires:        bind-utils" >> $(METADATA)
+	@echo "Priority:        Normal" >> $(METADATA)
+	@echo "License:         GPLv2" >> $(METADATA)
+	@echo "Confidential:    no" >> $(METADATA)
+	@echo "Destructive:     no" >> $(METADATA)
+	@echo "RhtsRequires: library(bind/bind-setup)" >> $(METADATA)
+
+	rhts-lint $(METADATA)
--- a/tests/Master-server-not-chrooted/PURPOSE
+++ b/tests/Master-server-not-chrooted/PURPOSE
@ -0,0 +1,6 @@
+PURPOSE of /CoreOS/bind/Sanity/Master-server-not-chrooted
+Description: Set up master nameserver in chrooted env, test it.
+             This is a very basic sanity test for bind9.
+             The main purpose for me was to learn how
+             bind works :-)
+Author: Martin Cermak <mcermak@redhat.com>
--- a/tests/Master-server-not-chrooted/named.conf
+++ b/tests/Master-server-not-chrooted/named.conf
@ -0,0 +1,11 @@
+options {
+        directory       "/var/named";
+        allow-query     { any; };
+};
+
+zone "<DOMAIN>" IN {
+  type master;
+  file "<DOMAIN>.zone";
+  allow-update { none; };
+};
+
--- a/tests/Master-server-not-chrooted/runtest.sh
+++ b/tests/Master-server-not-chrooted/runtest.sh
@ -0,0 +1,109 @@
+#!/bin/bash
+# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   runtest.sh of /CoreOS/bind/Sanity/Master-server-not-chrooted
+#   Description: Set up master nameserver, test it.
+#   Author: Martin Cermak <mcermak@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2009 Red Hat, Inc. All rights reserved.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+# Include rhts environment
+#set -x
+. /usr/bin/rhts-environment.sh
+. /usr/lib/beakerlib/beakerlib.sh
+
+# Some heplful functions
+randomString () {
+    TEMPSTR=`date +%c%N | md5sum | awk '{print $1}'`
+    echo ${TEMPSTR:0:8}
+    unset TEMPSTR
+}
+
+randomIp () {
+    echo "192.168.1.`echo $[ $RANDOM / 256 + 1 ]`"
+}
+
+randomSerial () {
+    date +%N
+}
+
+# Variable declarations
+CONF="/etc/named.conf"
+IP1=`randomIp`
+IP2=`randomIp`
+IP3=`randomIp`
+IP4=`randomIp`
+IP5=`randomIp`
+SERIAL=`randomSerial`
+ORIGPWD=`pwd`
+
+# The test
+rlJournalStart
+    rlPhaseStartSetup
+        rlRun "TmpDir=\`mktemp -d\`" 0 "Creating tmp directory"
+        rlRun "pushd $TmpDir"
+
+        rlRun "rlImport bind/bind-setup"
+
+        bsBindSetupStart "$ORIGPWD/named.conf" "off"
+
+        rlRun "TDOMAIN=`randomString`.cz"
+        rlRun "TZONEFILE=$ROOTDIR/var/named/$TDOMAIN.zone"
+
+        # set up /etc/named.conf
+        rlRun "sed -i \"s/<DOMAIN>/$TDOMAIN/g\" $CONF"
+
+        # set up zonefile
+        rlRun "cp $ORIGPWD/zonefile $TZONEFILE"
+        rlRun "chmod a+r $TZONEFILE"
+        rlRun "sed -i \"s/<DOMAIN>/$TDOMAIN/g\" $TZONEFILE"
+        rlRun "sed -i \"s/<IP1>/$IP1/g\" $TZONEFILE"
+        rlRun "sed -i \"s/<IP2>/$IP2/g\" $TZONEFILE"
+        rlRun "sed -i \"s/<IP3>/$IP3/g\" $TZONEFILE"
+        rlRun "sed -i \"s/<IP4>/$IP4/g\" $TZONEFILE"
+        rlRun "sed -i \"s/<IP5>/$IP5/g\" $TZONEFILE"
+        rlRun "sed -i \"s/<SERIAL>/$SERIAL/g\" $TZONEFILE"
+
+        bsBindSetupDone
+    rlPhaseEnd
+
+    rlPhaseStartTest
+        # perform tests
+        rlRun "dig @localhost $TDOMAIN | grep \"^$TDOMAIN\" | head -n 1 | grep \"$IP1\""
+        rlRun "dig @localhost server1.$TDOMAIN | grep \"^server1.$TDOMAIN\" | grep \"$IP2\""
+        rlRun "dig @localhost server2.$TDOMAIN | grep \"^server2.$TDOMAIN\" | grep \"$IP3\""
+        rlRun "dig @localhost dns1.$TDOMAIN | grep \"^dns1.$TDOMAIN\" | grep \"$IP4\""
+        rlRun "dig @localhost dns2.$TDOMAIN | grep \"^dns2.$TDOMAIN\" | grep \"$IP5\""
+        rlRun "dig @localhost ftp.$TDOMAIN | grep \"^ftp.$TDOMAIN\" | grep \"server1.$TDOMAIN\""
+        rlRun "dig @localhost mail.$TDOMAIN | grep \"^mail.$TDOMAIN\" | grep \"server1.$TDOMAIN\""
+        rlRun "dig @localhost mail2.$TDOMAIN | grep \"^mail2.$TDOMAIN\" | grep \"server2.$TDOMAIN\""
+        rlRun "dig @localhost www.$TDOMAIN | grep \"^www.$TDOMAIN\" | grep \"server2.$TDOMAIN\""
+
+    rlPhaseEnd
+
+    rlPhaseStartCleanup
+        bsBindSetupCleanup
+        rlRun "popd"
+        rlRun "rm -r $TmpDir" 0 "Removing tmp directory"
+        rlRun "rm -rf $TZONEFILE"
+    rlPhaseEnd
+rlJournalEnd
--- a/tests/Master-server-not-chrooted/zonefile
+++ b/tests/Master-server-not-chrooted/zonefile
@ -0,0 +1,27 @@
+$ORIGIN <DOMAIN>.
+$TTL 86400
+@     IN     SOA    dns1.<DOMAIN>.  hostmaster.<DOMAIN>. (
+                    <SERIAL>  ; serial
+                    21600      ; refresh after 6 hours
+                    3600       ; retry after 1 hour
+                    604800     ; expire after 1 week
+                    86400 )    ; minimum TTL of 1 day
+
+      IN     NS     dns1.<DOMAIN>.
+      IN     NS     dns2.<DOMAIN>.
+
+      IN     MX     10     mail.<DOMAIN>.
+      IN     MX     20     mail2.<DOMAIN>.
+
+             IN     A       <IP1>
+
+server1      IN     A       <IP2>
+server2      IN     A       <IP3>
+dns1         IN     A       <IP4>
+dns2         IN     A       <IP5>
+
+ftp          IN     CNAME   server1
+mail         IN     CNAME   server1
+mail2        IN     CNAME   server2
+www          IN     CNAME   server2
+
--- a/tests/Run-internal-BIND-test-suite/Makefile
+++ b/tests/Run-internal-BIND-test-suite/Makefile
@ -0,0 +1,77 @@
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Makefile of tests/Run-internal-BIND-test-suite
+#   Description: Run internal BIND test suite
+#   Author: Martin Cermak <mcermak@redhat.com>
+#   Author: Petr Mensik <pemensik@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2010 Red Hat, Inc. All rights reserved.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+export TEST=tests/Run-internal-BIND-test-suite
+export TESTVERSION=1.3
+
+BUILT_FILES=
+
+FILES=$(METADATA) runtest.sh Makefile PURPOSE knownerror* setup-named-softhsm.sh bind-systest-filter.sh
+
+.PHONY: all install download clean
+
+run: $(FILES) build
+	./runtest.sh
+
+build: $(BUILT_FILES)
+	chmod a+x runtest.sh
+
+clean:
+	rm -f *~ $(BUILT_FILES)
+
+
+include /usr/share/rhts/lib/rhts-make.include
+
+$(METADATA): Makefile
+	@echo "Owner:           Martin Cermak <mcermak@redhat.com>" > $(METADATA)
+	@echo "Name:            $(TEST)" >> $(METADATA)
+	@echo "TestVersion:     $(TESTVERSION)" >> $(METADATA)
+	@echo "Path:            $(TEST_DIR)" >> $(METADATA)
+	@echo "Description:     Run internal BIND test suite" >> $(METADATA)
+	@echo "Type:            Sanity" >> $(METADATA)
+	@echo "TestTime:        8h" >> $(METADATA)
+	@echo "RunFor:          bind" >> $(METADATA)
+	@echo "Requires:        bind rpm-build bind-utils" >> $(METADATA)
+	@echo "Requires:        perl-Net-DNS perl-Net-DNS-Nameserver" >> $(METADATA)
+	@echo "Requires:        perl-Time-HiRes" >> $(METADATA)
+	@echo "Requires:        bind-pkcs11 bind-pkcs11-utils softhsm" >> $(METADATA)
+	@echo "Requires:        openssl-devel libtool autoconf" >> $(METADATA)
+# Try to satisfy all build dependencies from here
+	@echo "Requires:        bind-devel" >> $(METADATA)
+	@echo "Requires:        net-tools" >> $(METADATA)
+	@echo "Requires:        dnf-utils" >> $(METADATA)
+	@echo "Requires:        kyua" >> $(METADATA)
+	@echo "Requires:        libcmocka-devel" >> $(METADATA)
+# Obsolete, uses cmocka
+#	@echo "Requires:        libatf-c gcc-c++" >> $(METADATA)
+	@echo "Priority:        Normal" >> $(METADATA)
+	@echo "License:         GPLv2" >> $(METADATA)
+	@echo "Confidential:    no" >> $(METADATA)
+	@echo "Destructive:     no" >> $(METADATA)
+	@echo "Bug:             642970" >> $(METADATA)
+
+	rhts-lint $(METADATA)
--- a/tests/Run-internal-BIND-test-suite/PURPOSE
+++ b/tests/Run-internal-BIND-test-suite/PURPOSE
@ -0,0 +1,6 @@
+PURPOSE of tests/Run-internal-BIND-test-suite
+Description: Run internal BIND test suite
+Author: Martin Cermak <mcermak@redhat.com>
+Bug summary: Run internal BIND test suite
+Bugzilla link: https://bugzilla.redhat.com/show_bug.cgi?id=642970
+
--- a/tests/Run-internal-BIND-test-suite/bind-systest-filter.sh
+++ b/tests/Run-internal-BIND-test-suite/bind-systest-filter.sh
@ -0,0 +1,47 @@
+#!/bin/bash
+#
+# This script will filter out output from BINDs tests
+# It supports form from BIND 9.9 and BIND 9.11
+# Its purpose is to display only failed tests from list of all tests
+
+CURRENT_TEST=
+CURRENT_OUTPUT=
+STATUS_ONLY=
+
+for P; do
+	case "$P" in
+		-s|--status)	STATUS_ONLY=yes; shift ;;
+	esac
+done
+
+cat $@ | while read LINE; do
+	if [ "${LINE#S:}" != "$LINE" ]; then
+		CURRENT_TEST=`echo $LINE | cut -d: -f2`
+		CURRENT_OUTPUT="$LINE"$'\n'
+	elif [ "${LINE#R:}" != "$LINE" ]; then
+		# echo "$CURRENT_TEST $LINE"
+		if [ "${LINE/#R:*:*}" != "$LINE" ]; then
+			# more recent results contain test name
+			# R:dlz:FAIL
+			CURRENT_TEST="${LINE#R:}"
+			CURRENT_TEST="${CURRENT_TEST/%:*}"
+			RESULT="${LINE/#*:}"
+		else
+			# S:dlz:time
+			# R:FAIL
+			RESULT="${LINE/#R*:/}"
+		fi
+		if [ "$RESULT" != "PASS" ]; then
+			if [ -n "$STATUS_ONLY" ]; then
+				echo "$RESULT $CURRENT_TEST"
+			else
+				CURRENT_OUTPUT+="$LINE"
+				echo "$CURRENT_OUTPUT"
+				echo
+			fi
+		fi
+		CURRENT_OUTPUT=
+	else
+		CURRENT_OUTPUT+="$LINE"$'\n'
+	fi
+done
--- a/tests/Run-internal-BIND-test-suite/knownerror
+++ b/tests/Run-internal-BIND-test-suite/knownerror
@ -0,0 +1,2 @@
+A:System test dlz
+A:System test idna
--- a/tests/Run-internal-BIND-test-suite/runtest.sh
+++ b/tests/Run-internal-BIND-test-suite/runtest.sh
@ -0,0 +1,185 @@
+#!/bin/bash
+# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   runtest.sh of tests/Run-internal-BIND-test-suite
+#   Description: Run internal BIND test suite
+#   Author: Martin Cermak <mcermak@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2010 Red Hat, Inc. All rights reserved.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+# Include rhts environment
+. /usr/bin/rhts-environment.sh
+. /usr/lib/beakerlib/beakerlib.sh
+
+PACKAGE="bind"
+
+# Set those variables to n to skip tests on variants
+#DEFAULT_VARIANTS="normal pkcs11 sdb"
+DEFAULT_VARIANTS="normal"
+#TEST_VARIANTS="normal"
+
+#
+# Runs test suite and checks known errors
+# Prepared to be repeated with another variants
+run_testsuite()
+{
+	local RESULT_TEXT="$TMPDIR/test${NAMED_VARIANT}.txt"
+	local FOUNDERROR=`mktemp found-XXXXXXXX.err`
+	local KNOWNERROR=/dev/null
+
+	if [ -f "$ORIG/knownerror${NAMED_VARIANT}.$TAG" ]; then
+		KNOWNERROR=`readlink -f $ORIG/knownerror.$TAG`
+	elif [ -f "$ORIG/knownerror${NAMED_VARIANT}" ]; then
+		KNOWNERROR=`readlink -f $ORIG/knownerror`
+	fi
+
+	# Sometime it can fail. Report just failures that are not known
+        rlRun "make test -j${CORES:-1} &> $RESULT_TEXT" 0-255 "Perform the test."
+        rlRun "grep -C 10 FAIL $RESULT_TEXT" 0-255 "Quickly show the test error (if any)."
+
+	rlRun "$FILTER $RESULT_TEXT" 0 "Showing unsuccessful tests"
+	rlRun "$FILTER -s $RESULT_TEXT > $FOUNDERROR" 0
+	rlRun "ls $KNOWNERROR $FOUNDERROR $RESULT_TEXT" 0 'check if there is needed files'
+	rlLog "`cat $FOUNDERROR`"
+
+	rlAssertLesserOrEqual "Checking number of found errors is in limits" "$(grep '^FAIL' $FOUNDERROR | wc -l)" "$(wc -l <$KNOWNERROR)"
+        cat $FOUNDERROR | while read STATUS TEST ; do
+		if [ "$STATUS" = FAIL ]; then
+			rlRun "grep '$TEST' $KNOWNERROR" 0 "Check $TEST failure is expected"
+		else
+			rlLog "$STATUS $TEST"
+		fi
+        done
+}
+
+rlJournalStart
+    rlPhaseStartSetup
+        # package assertions
+        rlAssertRpm $PACKAGE 
+        rlAssertRpm rpm-build
+        rlAssertRpm perl-Net-DNS-Nameserver
+
+	#pwd
+	ORIG=`pwd`
+	SETUP_SOFTHSM=`readlink -f setup-named-softhsm.sh`
+	FILTER=`readlink -f bind-systest-filter.sh`
+	CORES=`grep 'processor\s*:' /proc/cpuinfo | wc -l`
+
+	TAG=generic
+	if [ -f /etc/os-release ]; then
+		# extract platform tag
+		TAG=`(source /etc/os-release && echo ${PLATFORM_ID#platform:})`
+	fi
+
+        #tempdir
+        rlRun "TMPDIR=\`mktemp -d\`" 0 "Creating tmp directory"
+        rlRun "pushd $TMPDIR"
+
+        # topdir
+	TOPDIR=`rpm -E '%{_topdir}'`
+
+        # cleanup in topdir
+        mkdir -p $TOPDIR/{BUILD,SOURCES,SPECS}
+        rm -rf $TOPDIR/{BUILD,SOURCES,SPECS}/*
+
+        # download src rpm
+	if ! ls bind*.src.rpm; then
+		rlRun "dnf --enablerepo='*-source' download --source bind" 0 "Fetch source from repository"
+		rlRun "rpm -i bind*.src.rpm"
+	fi
+	
+        rlRun "rpm --define '_topdir $TOPDIR' -Uvh *rpm &> $TMPDIR/install.txt"
+        rlRun "cd $TOPDIR/SPECS" 
+
+	rlRun "dnf -y builddep *.spec"
+
+        # stop bind if it is running
+        rlServiceStop named
+    rlPhaseEnd
+
+    rlPhaseStartTest
+        # rebuild from source
+        rlRun "rpmbuild -ba *.spec &> $TMPDIR/build.txt"
+
+        # the test
+        rlRun "cd $TOPDIR/BUILD/bind*"
+
+        rlLogInfo "Test takes place in `pwd`"
+
+        rlRun "chown -R root ."
+
+	if [ -x "$SETUP_SOFTHSM" ]; then
+		rlRun "eval \"$(bash $SETUP_SOFTHSM -A)\"" 0 "Preparing PKCS#11 token slot"
+		rlRun "pkcs11-tokens" 0 "Testing token slot availability"
+	else
+		rlLog "PKCS#11 not initialized"
+	fi
+
+	if [ -d build ]; then
+		BUILD=build
+	else
+		BUILD=.
+	fi
+
+        rlRun "./bin/tests/system/ifconfig.sh up" 0 "Setup fake network interfaces."
+
+	# required by idna test 
+	export LC_ALL=en_US.UTF-8
+
+        rlRun "pushd $BUILD"
+
+	if echo "${TEST_VARIANTS:-$DEFAULT_VARIANTS}" | grep -q normal; then
+		rlLog "Running normal variant"
+		export NAMED_VARIANT= DNSSEC_VARIANT=
+		run_testsuite
+		rlLog "Finished normal variant"
+	fi
+
+	if echo "${TEST_VARIANTS:-$DEFAULT_VARIANTS}" | grep -q sdb; then
+		rlLog "Running sdb variant"
+		export NAMED_VARIANT=-sdb DNSSEC_VARIANT=
+		run_testsuite
+		rlLog "Finished sdb variant"
+	fi
+
+	if echo "${TEST_VARIANTS:-$DEFAULT_VARIANTS}" | grep -q pkcs11; then
+		rlLog "Running pkcs11 variant"
+		# Unfortunately, PKCS11 variant uses shared key storage
+		# It cannot use more threads for that reason
+		export NAMED_VARIANT=-pkcs11 DNSSEC_VARIANT=-pkcs11
+		CORES=1 run_testsuite
+		rlLog "Finished pkcs11 variant"
+	fi
+
+        rlRun "popd"
+
+        rlRun "./bin/tests/system/ifconfig.sh down" 0 "Remove fake network interfaces."
+
+    rlPhaseEnd
+
+    rlPhaseStartCleanup
+        rlBundleLogs "BUILD_LOGS" "$TMPDIR/install.txt" "$TMPDIR/builddeps.txt" "$TMPDIR/build.txt"
+        rlBundleLogs "TEST_LOGS" "$TMPDIR"/test*.txt
+        rlRun "popd"
+        rlRun "rm -r $TMPDIR" 0 "Removing tmp directory"
+    rlPhaseEnd
+rlJournalEnd
--- a/tests/Run-internal-BIND-test-suite/setup-named-softhsm.sh
+++ b/tests/Run-internal-BIND-test-suite/setup-named-softhsm.sh
@ -0,0 +1,123 @@
+#!/bin/sh
+#
+# This script will initialise token storage of softhsm PKCS11 provider
+# in custom location. Is useful to store tokens in non-standard location.
+#
+# Output can be evaluated from bash, it will prepare it for usage of temporary tokens.
+# Recommended use:
+# eval $(bash setup-named-softhsm.sh -A)
+#
+
+SOFTHSM2_CONF="$1"
+TOKENPATH="$2"
+GROUPNAME="$3"
+# Do not use this script for real keys worth protection
+# This is intended for crypto accelerators using PKCS11 interface.
+# Uninitialized token would fail any crypto operation.
+PIN=1234
+SO_PIN=1234
+LABEL=rpm
+
+set -e
+
+echo_i()
+{
+	echo "#" $@
+}
+
+random()
+{
+	if [ -x "$(which openssl 2>/dev/null)" ]; then
+		openssl rand -base64 $1
+	else
+		dd if=/dev/urandom bs=1c count=$1 | base64
+	fi
+}
+
+usage()
+{
+	echo "Usage: $0 -A [token directory] [group]"
+	echo "   or: $0 <config file> <token directory> [group]"
+}
+
+if [ "$SOFTHSM2_CONF" = "-A" -a -z "$TOKENPATH" ]; then
+	TOKENPATH=$(mktemp -d /var/tmp/softhsm-XXXXXX)
+fi
+
+if [ -z "$SOFTHSM2_CONF" -o -z "$TOKENPATH" ]; then
+	usage >&2
+	exit 1
+fi
+
+if [ "$SOFTHSM2_CONF" = "-A" ]; then
+	# Automagic mode instead
+	MODE=secure
+	SOFTHSM2_CONF="$TOKENPATH/softhsm2.conf"
+	PIN_SOURCE="$TOKENPATH/pin"
+	SOPIN_SOURCE="$TOKENPATH/so-pin"
+	TOKENPATH="$TOKENPATH/tokens"
+else
+	MODE=legacy
+fi
+
+[ -d "$TOKENPATH" ] || mkdir -p "$TOKENPATH"
+
+umask 0022
+
+if ! [ -f "$SOFTHSM2_CONF" ]; then
+cat  << SED > "$SOFTHSM2_CONF"
+# SoftHSM v2 configuration file
+
+directories.tokendir = ${TOKENPATH}
+objectstore.backend = file
+
+# ERROR, WARNING, INFO, DEBUG
+log.level = ERROR
+
+# If CKF_REMOVABLE_DEVICE flag should be set
+slots.removable = false
+SED
+else
+	echo_i "Config file $SOFTHSM2_CONF already exists" >&2
+fi
+
+if [ -n "$PIN_SOURCE" ]; then
+	touch "$PIN_SOURCE" "$SOPIN_SOURCE"
+	chmod 0600 "$PIN_SOURCE" "$SOPIN_SOURCE"
+	if [ -n "$GROUPNAME" ]; then
+		chgrp "$GROUPNAME" "$PIN_SOURCE" "$SOPIN_SOURCE"
+		chmod g+r "$PIN_SOURCE" "$SOPIN_SOURCE"
+	fi
+fi
+
+export SOFTHSM2_CONF
+
+if softhsm2-util --show-slots | grep 'Initialized:[[:space:]]*yes' > /dev/null
+then
+	echo_i "Token in ${TOKENPATH} is already initialized" >&2
+
+	[ -f "$PIN_SOURCE" ] && PIN=$(cat "$PIN_SOURCE")
+	[ -f "$SOPIN_SOURCE" ] && SO_PIN=$(cat "$SOPIN_SOURCE")
+else
+	PIN=$(random 6)
+	SO_PIN=$(random 18)
+	if [ -n "$PIN_SOURCE" ]; then
+		echo -n "$PIN" > "$PIN_SOURCE"
+		echo -n "$SO_PIN" > "$SOPIN_SOURCE"
+	fi
+
+	echo_i "Initializing tokens to ${TOKENPATH}..."
+	softhsm2-util --init-token --free --label "$LABEL" --pin "$PIN" --so-pin "$SO_PIN" | sed -e 's/^/# /'
+
+	if [ -n "$GROUPNAME" ]; then
+		chgrp -R -- "$GROUPNAME" "$TOKENPATH"
+		chmod -R -- g=rX,o= "$TOKENPATH"
+	fi
+fi
+
+echo "export SOFTHSM2_CONF=\"$SOFTHSM2_CONF\""
+echo "export PIN_SOURCE=\"$PIN_SOURCE\""
+echo "export SOPIN_SOURCE=\"$SOPIN_SOURCE\""
+# These are intentionaly not exported
+echo "PIN=\"$PIN\""
+echo "SO_PIN=\"$SO_PIN\""
--- a/tests/tests.yml
+++ b/tests/tests.yml
@ -0,0 +1,26 @@
+---
+# This first play always runs on the local staging system
+- hosts: localhost
+  roles:
+  - role: standard-test-beakerlib
+    tags:
+    - classic
+    tests:
+    - Master-server-chrooted
+    - Master-server-not-chrooted
+    - Run-internal-BIND-test-suite
+    required_packages:
+    - bind
+    - bind-chroot
+    - bind-sdb-chroot
+    - redhat-lsb
+    - bind-utils
+    - dnf-utils
+    - kyua
+    - bind-devel
+    - perl-Net-DNS
+    - perl-Net-DNS-Nameserver
+    - perl-Time-HiRes
+    - softhsm
+    - bind-pkcs11
+    - bind-pkcs11-utils
--- a/trusted-key.key
+++ b/trusted-key.key
@ -0,0 +1 @@
+. 3600 IN DNSKEY 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU=
Author	SHA1	Message	Date
Petr Menšík	7ffdde8fe1	Update to 9.19.22 (rhbz#2270475) https://downloads.isc.org/isc/bind9/9.19.22/doc/arm/html/notes.html#notes-for-bind-9-19-22	2024-04-15 21:27:34 +02:00
Petr Menšík	46841be611	Update to 9.19.21 (#2264048 ) https://downloads.isc.org/isc/bind9/9.19.21/RELEASE-NOTES-bind-9.19.21.html Security Fixes - Validating DNS messages containing a lot of DNSSEC signatures could cause excessive CPU load, leading to a denial-of-service condition. This has been fixed. (CVE-2023-50387) ISC would like to thank Elias Heftrig, Haya Schulmann, Niklas Vogel, and Michael Waidner from the German National Research Center for Applied Cybersecurity ATHENE for bringing this vulnerability to our attention. [GL #4424] - Parsing DNS messages with many different names could cause excessive CPU load. This has been fixed. (CVE-2023-4408) ISC would like to thank Shoham Danino from Reichman University, Anat Bremler-Barr from Tel-Aviv University, Yehuda Afek from Tel-Aviv University, and Yuval Shavitt from Tel-Aviv University for bringing this vulnerability to our attention. [GL #4234] - Specific queries could cause named to crash with an assertion failure when nxdomain-redirect was enabled. This has been fixed. (CVE-2023-5517) [GL #4281] - A bad interaction between DNS64 and serve-stale could cause named to crash with an assertion failure, when both of these features were enabled. This has been fixed. (CVE-2023-5679) [GL #4334] Resolves: CVE-2023-50387 CVE-2023-4408 CVE-2023-5517 CVE-2023-5679	2024-02-17 03:12:52 +01:00
Petr Menšík	f17a799334	Update changed b.root-servers.net address in hints (#2253463 )	2024-01-16 13:40:37 +01:00
Petr Menšík	06cb24cfdc	Remove i686 compatibility changes It should now work with upstream changes included, thanks to: https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/8516	2024-01-16 11:08:38 +01:00
Petr Menšík	c1c7621d71	Update to 9.19.19 (#2255406 ) https://downloads.isc.org/isc/bind9/9.19.19/doc/arm/html/notes.html#notes-for-bind-9-19-19 New Features - Initial support for the PROXYv2 protocol was added. named can now accept PROXYv2 headers over all currently implemented DNS transports and dig can insert these headers into the queries it sends. Please consult the related documentation (allow-proxy, allow-proxy-on, listen-on, and listen-on-v6 for named, dig +proxy and dig +proxy-plain for dig) for additional details. [GL #4388] Removed Features - Support for using AES as the DNS COOKIE algorithm (cookie-algorithm aes;) has been removed. The only supported DNS COOKIE algorithm is now the current default, SipHash-2-4. [GL #4421] - The resolver-nonbackoff-tries and resolver-retry-interval statements have been removed. Using them is now a fatal error. [GL #4405] Feature Changes - The maximum number of NSEC3 iterations allowed for validation purposes has been lowered from 150 to 50. DNSSEC responses containing NSEC3 records with iteration counts greater than 50 are now treated as insecure. [GL #4363] - Following RFC 9276 recommendations, dnssec-policy now only allows an NSEC3 iteration count of 0 for the DNSSEC-signed zones using NSEC3 that the policy manages. [GL #4363]	2024-01-16 11:08:38 +01:00
Petr Menšík	d1d29058a6	Fully remove PDF building support Upstream has discontinued and remove support for local PDF building in commit 561a83a29182b00bda9237ae30343d76a68dcdf4. Just remove remaining bits, it is not likely to return.	2023-11-20 12:30:29 +01:00
Petr Menšík	6eaef8126b	Disable PDF building and enable epub inclusion Ship built epub ARM in doc subpackage. But disable latex pdf building, since it is not built anymore and does not even exist.	2023-11-20 12:30:29 +01:00
Petr Menšík	b5d7143a46	Update to 9.19.18 (#2249833 ) https://downloads.isc.org/isc/bind9/9.19.18/doc/arm/html/notes.html#notes-for-bind-9-19-18	2023-11-20 12:30:29 +01:00
				`@ -0,0 +1 @@`
				`. 3600 IN DNSKEY 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU=`