18 changed files with 566 additions and 344 deletions
--- a/.gitignore
+++ b/.gitignore
@ -230,7 +230,3 @@ bind-9.7.2b1.tar.gz
 /bind-9.21.2.tar.xz.asc
 /bind-9.21.3.tar.xz
 /bind-9.21.3.tar.xz.asc
-/bind-9.21.4.tar.xz
-/bind-9.21.4.tar.xz.asc
-/bind-9.21.*.tar.xz
-/bind-9.21.*.tar.xz.asc
--- a/README.md
+++ b/README.md
@ -26,9 +26,13 @@ The package contains several subpackages, some of them can be disabled on rebuil
 * **bind9-next** -- *named* daemon providing DNS server
 * **bind9-next-utils** -- set of tools to analyse DNS responses or update entries (dig, host)
 * **bind9-next-doc** -- documentation for current bind, *BIND 9 Administrator Reference Manual*.
+* **bind9-next-license** -- Shared license for all packages but bind-export-libs.
 * **bind9-next-libs** -- Shared libraries used by some others programs
+* **bind9-next-devel** -- Development headers for libs. Can be disabled by `--without DEVEL`
+

 ## Optional features

 * *GSSTSIG* -- Support for Kerberos authentication in BIND.
 * *LMDB* -- Support for dynamic database for managing runtime added zones. Provides faster removal of added zone with much less overhead. But requires lmdb linked to base libs.
+* *DLZ* -- Support for dynamic loaded modules providing support for features *bind-sdb* provides, but only small module is required.
--- a/bind-9.11.12.tar.gz.asc
+++ b/bind-9.11.12.tar.gz.asc
@ -0,0 +1,16 @@
+-----BEGIN PGP SIGNATURE-----
+
+iQIzBAABAgAdFiEErj+seWcR7Fn8AHqkdLtrmky7PTgFAl2WMooACgkQdLtrmky7
+PThv2RAAnXNLYTzXtH6ls29tRm5Hc+D6UaeqcWDNQ4BpkRVhrFxtukalGCi9mmB6
+NPJzFyXmaOW654pypCIuEgqJNFUpDtLzLzT7SUF+mhm+5plsaRSBnh4mq87l5KSp
+twODAPnfCJV+HBk5RmToLEstAbGQ7xEBTyQtZoFkY+V7zEFwENKiCvWsoSWOkYR3
+zXo3sKjc83HV9ShbW/mCtbZf5L0qlbrKOAzqJfAFMhNNJi8kMbmr/Zi2sIfN+Rhv
+g8HQo89Epv6r51yAdeED8idIX4rKjjcEtHrZeDmLdCcdHgSEj2sIlH92Joce6vL0
+S59A0rItIXm6fW8sz6WNpcj4tVtWYbIYjXZ4SPFNkaUrHv8cUekq+5vbI+v07Gh3
+2bhtDsDyTY5I1/AsY/EFmwkCAjUS00jZryBnuJpLB3v5JtUog4ek32yLBzPrqRBo
+1876j4nlXAia8mG0OgJNWZ0gHyUPe/TgfR8fQDLmHxHHlKrJNTEwY6bLW8jzFTX1
+zk510fI1K7J9tiQgf5wcBQ2h3EBlqzDNIJDovoATzLYIf0HKyVegh/vnQdtdEhUR
+1DzJAt3bsBfAP1AFfWPD/ACu5Zdm7SxY1wE/pjkwttDU3sRZqOfuwNBGeolu3cVN
+O9/h1zsyVeVS0ui2vu4+V4EvNitmXsVbG2doDq9L5yBiIKGO2Ew=
+=GCy6
+-----END PGP SIGNATURE-----
--- a/bind-9.14.7.tar.gz.asc
+++ b/bind-9.14.7.tar.gz.asc
@ -0,0 +1,16 @@
+-----BEGIN PGP SIGNATURE-----
+
+iQIzBAABAgAdFiEErj+seWcR7Fn8AHqkdLtrmky7PTgFAl2WMpEACgkQdLtrmky7
+PTh/sg//QbNRAQvADQfwF1PPo+JxB+3WzQ9oJAWeHbOoiubwkUwO9xE+BEnTNd5o
+oM1lSLqFxNykOTaoeJlqPftPod1cxo7lSzkwflugGyB/59wliCpqCg053YV4x9mO
+QggvA/E50+0FI/Om/7v4GHGADu/JE83FovOueWAB0LgqfDSD6QFcNFF9sUJJ4P7r
+FcEXSWj8QbrHMWBKncZUOpD2ECotvtrYmi0DTHl1XfigESDQpWtsnTFuabCCsvkh
+ch9wQRplAes2Mf/aS5tl1y0QKKBFuEjtGiTdgrDl6o9GLnx6CueX5saZehu2EVkr
+fq2vEYUC2lRQSjuxSMMJ3L0TGUcl7+ixlAIISS2K9L5Xx7MhBXt/EH5KiKPfsEet
+3EH+DhxV5uXjDU7MgvREnxT+ssV23e0HWTz4tVVQ9LpvYmWPIgLcSOhHCc57yoQF
+c46V0f69dMWbMAlQ93EZSG274ZvpIszpK8+3hGI3/TuDFFgiQJeJJBFVtYJMle69
+3mEEclfzO7fBiXZFec6nVx2309bL64bafN7zszPKXl4XgoefOfD0v0eWqQT4fxfm
+dnGC0qMqSZs5F+d0fISV5JUUNYzt9PZjvnzqLLGOeTF6l3/n9G1mmNsXcxJ1OEIF
+6qh1oO7JTPjt0MFhKac4QjNQi/Bnp25O3I/PRyWZCbiwXkyvyQU=
+=ZT7s
+-----END PGP SIGNATURE-----
--- a/bind-9.21-unittest-32b-mem.patch
+++ b/bind-9.21-unittest-32b-mem.patch
@ -1,112 +0,0 @@
-From 4623873e588c86c6add4d53708e754e2d6f3e087 Mon Sep 17 00:00:00 2001
-From: Michal Nowak <mnowak@isc.org>
-Date: Wed, 20 May 2026 08:59:49 +0000
-Subject: [PATCH] Make deleg cleanuptests memory assertions 32-bit-safe
-
-Each address entry stored by dns_delegset_addaddr() is an
-isc_netaddrlink_t, whose size depends on sizeof(void *) via the
-ISC_LINK macro (24 bytes of address + two prev/next pointers): 40
-bytes on 64-bit, 32 bytes on 32-bit. The hardcoded 4 MB / 8 MB
-ranges only held on 64-bit, so dns_deleg_cleanuptests failed on
-armv7l with isc_mem_inuse() returning ~3.2 MB.
-
-Express the expected ranges in terms of sizeof(isc_netaddrlink_t)
-so they scale with pointer width, and pull the 99999 entry count
-out into a NENTRIES macro.
-
-Assisted-by: Claude:claude-opus-4-7
---
- tests/dns/deleg_test.c | 30 ++++++++++++++++++++++--------
- 1 file changed, 22 insertions(+), 8 deletions(-)
-
-diff --git a/tests/dns/deleg_test.c b/tests/dns/deleg_test.c
-index d3af6aba966..9497caf2753 100644
--- a/tests/dns/deleg_test.c
-+++ b/tests/dns/deleg_test.c
-@@ -52,6 +52,15 @@ isc_stdtime_now(void) {
- 
- #include <tests/isc.h>
- 
-+/*
-+ * cleanuptests adds NENTRIES address entries to a delegset; each is an
-+ * isc_netaddrlink_t whose size depends on sizeof(void *) via ISC_LINK.
-+ * Express memory expectations in terms of that struct so the test works
-+ * on both 32-bit and 64-bit targets.
-+ */
-+#define NENTRIES       99999
-+#define ENTRIES_MEM(n) ((size_t)(n) * sizeof(isc_netaddrlink_t))
-+
- static void
- shutdownloop(ISC_ATTR_UNUSED void *arg) {
- 	isc_loopmgr_shutdown();
-@@ -587,7 +596,8 @@ cleanuptests_phase3(void *arg) {
- 	dns_delegset_t *delegset = NULL;
- 	isc_result_t result;
- 
-	assert_int_in_range(isc_mem_inuse(db->mctx), 8000000, 8100000);
-+	assert_int_in_range(isc_mem_inuse(db->mctx), ENTRIES_MEM(2 * NENTRIES),
-+			    ENTRIES_MEM(2 * NENTRIES) + 100000);
- 
- 	/*
- 	 * baz. is there, but bar. is gone, as it has been
-@@ -612,7 +622,8 @@ cleanuptests_phase2(void *arg) {
- 	dns_delegset_t *delegset = NULL;
- 	isc_result_t result;
- 
-	assert_int_in_range(isc_mem_inuse(db->mctx), 4000000, 4100000);
-+	assert_int_in_range(isc_mem_inuse(db->mctx), ENTRIES_MEM(NENTRIES),
-+			    ENTRIES_MEM(NENTRIES) + 100000);
- 
- 	/*
- 	 * bar. is there
-@@ -629,10 +640,11 @@ cleanuptests_phase2(void *arg) {
- 	dns_delegset_allocdeleg(delegset, DNS_DELEGTYPE_DELEG_ADDRESSES,
- 				&deleg);
- 
-	for (size_t i = 0; i < 99999; i++) {
-+	for (size_t i = 0; i < NENTRIES; i++) {
- 		addipdeleg(AF_INET6, "1111::2222", delegset, deleg);
- 	}
-	assert_int_in_range(isc_mem_inuse(db->mctx), 8000000, 8100000);
-+	assert_int_in_range(isc_mem_inuse(db->mctx), ENTRIES_MEM(2 * NENTRIES),
-+			    ENTRIES_MEM(2 * NENTRIES) + 100000);
- 	writedb(db, "baz.", 30, &delegset, true);
- 	deleg = NULL;
- 
-@@ -677,11 +689,12 @@ cleanuptests(ISC_ATTR_UNUSED void *arg) {
- 
- 	assert_int_in_range(isc_mem_inuse(db->mctx), 500, 2000);
- 
-	for (size_t i = 0; i < 99999; i++) {
-+	for (size_t i = 0; i < NENTRIES; i++) {
- 		addipdeleg(AF_INET6, "1111::2222", delegset, deleg);
- 	}
- 
-	assert_int_in_range(isc_mem_inuse(db->mctx), 4000000, 4100000);
-+	assert_int_in_range(isc_mem_inuse(db->mctx), ENTRIES_MEM(NENTRIES),
-+			    ENTRIES_MEM(NENTRIES) + 100000);
- 
- 	writedb(db, "stuff.", 10, &delegset, true);
- 	deleg = NULL;
-@@ -694,7 +707,7 @@ cleanuptests(ISC_ATTR_UNUSED void *arg) {
- 	dns_delegset_allocdeleg(delegset, DNS_DELEGTYPE_DELEG_ADDRESSES,
- 				&deleg);
- 
-	for (size_t i = 0; i < 99999; i++) {
-+	for (size_t i = 0; i < NENTRIES; i++) {
- 		addipdeleg(AF_INET6, "1111::2222", delegset, deleg);
- 	}
- 
-@@ -703,7 +716,8 @@ cleanuptests(ISC_ATTR_UNUSED void *arg) {
- 	 * with DB mem context) overmem conditions will be detected, and the
- 	 * expired node will be removed
- 	 */
-	assert_int_in_range(isc_mem_inuse(db->mctx), 8000000, 8100000);
-+	assert_int_in_range(isc_mem_inuse(db->mctx), ENTRIES_MEM(2 * NENTRIES),
-+			    ENTRIES_MEM(2 * NENTRIES) + 100000);
- 	writedb(db, "bar.", 30, &delegset, true);
- 	deleg = NULL;
- 
-- 
-2.54.0
-
--- a/bind-9.21-unittest-isc_rwlock-s390x.patch
+++ b/bind-9.21-unittest-isc_rwlock-s390x.patch
@ -0,0 +1,29 @@
+From b8bc86834311e4ea27fe75052db08279045f027b Mon Sep 17 00:00:00 2001
+From: Petr Mensik <pemensik@redhat.com>
+Date: Wed, 20 Nov 2024 15:34:29 +0100
+Subject: [PATCH] Skip isc_rwlock_benchmark on s390x
+
+Not sure why, but it repeatedly failed on isc_rwlock_benchmark function.
+Not sure if it requires more time only or there is some strange error.
+---
+ tests/isc/rwlock_test.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/tests/isc/rwlock_test.c b/tests/isc/rwlock_test.c
+index 4c5b8e0..a28b7d9 100644
+--- a/tests/isc/rwlock_test.c
+++ b/tests/isc/rwlock_test.c
+@@ -340,7 +340,10 @@ ISC_TEST_ENTRY_CUSTOM(isc_rwlock_wrlock, rwlock_setup, rwlock_teardown)
+ #if !defined(__SANITIZE_THREAD__)
+ ISC_TEST_ENTRY_CUSTOM(isc_rwlock_tryupgrade, rwlock_setup, rwlock_teardown)
+ ISC_TEST_ENTRY_CUSTOM(isc_rwlock_trylock, rwlock_setup, rwlock_teardown)
+#ifndef __s390x__
+// TODO: find why this stucks.
+ ISC_TEST_ENTRY_CUSTOM(isc_rwlock_benchmark, rwlock_setup, rwlock_teardown)
+#endif
+ #endif /* __SANITIZE_THREAD__ */
+ 
+ ISC_TEST_LIST_END
+-- 
+2.47.0
+
--- a/bind-9.21-unittest-qpdb-i386.patch
+++ b/bind-9.21-unittest-qpdb-i386.patch
@ -1,41 +0,0 @@
-From af1e4bf375000fc532c55ff6df841661185a2451 Mon Sep 17 00:00:00 2001
-From: Petr Mensik <pemensik@redhat.com>
-Date: Wed, 28 May 2025 19:40:05 +0200
-Subject: [PATCH] Try rcu_barrier
-
-https://gitlab.isc.org/isc-projects/bind9/-/issues/5328
---
- tests/dns/qpdb_test.c | 3 +++
- 1 file changed, 3 insertions(+)
-
-diff --git a/tests/dns/qpdb_test.c b/tests/dns/qpdb_test.c
-index 1c840e2..b6ad0f4 100644
--- a/tests/dns/qpdb_test.c
-+++ b/tests/dns/qpdb_test.c
-@@ -24,6 +24,7 @@
- #include <cmocka.h>
- 
- #include <isc/lib.h>
-+#include <isc/urcu.h>
- #include <isc/util.h>
- 
- #include <dns/lib.h>
-@@ -170,6 +171,7 @@ ISC_LOOP_TEST_IMPL(overmempurge_bigrdata) {
- 
- 	dns_db_detach(&db);
- 	isc_mem_detach(&mctx);
-+	rcu_barrier();
- 	isc_loopmgr_shutdown();
- }
- 
-@@ -221,6 +223,7 @@ ISC_LOOP_TEST_IMPL(overmempurge_longname) {
- 
- 	dns_db_detach(&db);
- 	isc_mem_detach(&mctx);
-+	rcu_barrier();
- 	isc_loopmgr_shutdown();
- }
- 
-- 
-2.51.0
-
--- a/bind9-next.spec
+++ b/bind9-next.spec
@ -17,11 +17,11 @@
 # Do not set CI environment, include more unit tests, even less stable
 %bcond_with    UNITTEST_ALL
 %bcond_without DNSTAP
+%bcond_without LMDB
 %bcond_without DOC
 %bcond_with    TSAN
 %bcond_without DTRACE
 %bcond_with    OPENSSL_ENGINE
-%bcond         JEMALLOC  0%{?fedora}

 %{?!bind_uid:  %global bind_uid  25}
 %{?!bind_gid:  %global bind_gid  25}
@ -30,9 +30,7 @@
 %global        chroot_prefix     %{bind_dir}/chroot
 %global        chroot_create_directories /dev /run/named %{_localstatedir}/{log,named,tmp} \\\
                                         %{_sysconfdir}/{crypto-policies/back-ends,pki/dnssec-keys,pki/tls,named} \\\
-                                         %{_libdir}/bind %{_libdir}/named %{_datadir}/{GeoIP,dns-root-data} /proc/sys/net/ipv4
-%global        upstream_sources 0 2
-%global        pgp_signed_sources 2
+                                         %{_libdir}/bind %{_libdir}/named %{_datadir}/GeoIP /proc/sys/net/ipv4

 %global forgeurl0 https://gitlab.isc.org/isc-projects/bind9

@ -41,6 +39,9 @@
 # Visit https://bugzilla.redhat.com/show_bug.cgi?id=1540300
 %undefine _strict_symbol_defs_build

+# BIND9 does not work with fortify 3 level, make builds work on Fedora
+%global _fortify_level 2
+
 # Upstream package name
 %global upname bind
 # Provide only bind-utils on f37+, it has better behaviour
@ -52,9 +53,9 @@ Conflicts: %1 \

 Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
 Name:     bind9-next
-License:  MPL-2.0 AND ISC AND BSD-3-clause AND MIT AND BSD-2-clause
+License:  MPL-2.0 AND ISC AND BSD-3-clause AND Expat AND BSD-2-clause
 #
-Version:  9.21.22
+Version:  9.21.3
 Release:  %autorelease
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
@ -66,17 +67,22 @@ Source2:  https://downloads.isc.org/isc/bind9/%{version}/%{upname}-%{version}.ta
 Source3:  named.logrotate
 Source4:  https://www.isc.org/docs/isc-keyblock.asc
 Source16: named.conf
+# Refresh by command: dig @a.root-servers.net. +tcp +norec
+# or from URL
+Source17: https://www.internic.net/domain/named.root
 Source18: named.localhost
 Source19: named.loopback
 Source20: named.empty
 Source23: named.rfc1912.zones
 Source25: named.conf.sample
-Source27: named-mkroot.sh
+Source27: named.root.key
 Source35: bind.tmpfiles.d
+Source36: trusted-key.key
 Source37: named.service
 Source38: named-chroot.service
 Source41: setup-named-chroot.sh
 Source42: generate-rndc-key.sh
+Source43: named.rwtab
 Source44: named-chroot-setup.service
 Source46: named-setup-rndc.service
 Source48: setup-named-softhsm.sh
@ -85,63 +91,44 @@ Source49: named-chroot.files
 # Common patches
 # Red Hat specific documentation is not relevant to upstream
 Patch1: bind-9.16-redhat_doc.patch
-# https://gitlab.isc.org/isc-projects/bind9/-/issues/5328
-# avoid often fails on i386, unsupported upstream
-Patch4: bind-9.21-unittest-qpdb-i386.patch
-# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/12061
-Patch5: bind-9.21-unittest-32b-mem.patch
+# Downstream only. TODO: find a cause and remove this workaround
+Patch3: bind-9.21-unittest-isc_rwlock-s390x.patch

 %{?systemd_ordering}
 Requires:       coreutils
+Requires(pre):  shadow-utils
 Requires(post): shadow-utils
 Requires(post): glibc-common
 Requires(post): grep
-Requires:       dns-root-data
 Requires:       %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release}
 Recommends:     %{name}-utils %{name}-dnssec-utils
 %upname_compat %{upname}
 Obsoletes:      %{name}-pkcs11 < 32:9.18.4-2
 Conflicts:      bind-dyndb-ldap

-BuildRequires:  gcc
-BuildRequires:  make
-BuildRequires:  openssl-devel
-BuildRequires:  libtool
-BuildRequires:  meson >= 1.3.0
-BuildRequires:  ninja-build
-BuildRequires:  pkgconfig
-BuildRequires:  pkgconfig(libcap)
-BuildRequires:  pkgconfig(libidn2)
-BuildRequires:  pkgconfig(libxml-2.0)
+BuildRequires:  gcc, make
+BuildRequires:  openssl-devel, libtool, autoconf, pkgconfig, libcap-devel
+BuildRequires:  libidn2-devel, libxml2-devel
 BuildRequires:  systemd-rpm-macros
 BuildRequires:  selinux-policy
-BuildRequires:  findutils
-BuildRequires:  sed
-BuildRequires:  pkgconfig(libnghttp2)
-BuildRequires:  pkgconfig(liburcu)
-BuildRequires:  pkgconfig(libedit)
-BuildRequires:  dns-root-data
+BuildRequires:  findutils sed
+BuildRequires:  libnghttp2-devel
+BuildRequires:  userspace-rcu-devel
 # Compress the changelog
 BuildRequires:  gzip
-BuildRequires:  pkgconfig(lmdb)
-%if %{with JEMALLOC}
-BuildRequires:  pkgconfig(jemalloc)
+%if 0%{?fedora}
+BuildRequires:  jemalloc-devel
+BuildRequires:  gnupg2
 %endif
-%if ! 0%{?rhel}
-BuildRequires:  gpgverify
-%endif
-BuildRequires:  pkgconfig(libuv)
+BuildRequires:  libuv-devel
 %if %{with OPENSSL_ENGINE}
 BuildRequires:  openssl-devel-engine
 %endif
 %if %{with UNITTEST}
 # make unit dependencies
-BuildRequires:  pkgconfig(cmocka)
+BuildRequires:  libcmocka-devel
 # Ensure we have lscpu
 BuildRequires:  util-linux
-# Catch failing unittests coredumps
-BuildRequires:  gdb
-BuildRequires:  xz
 %endif
 %if %{with UNITTEST} || %{with SYSTEMTEST}
 BuildRequires:  softhsm
@ -151,13 +138,8 @@ BuildRequires:  softhsm
 BuildRequires:  perl(Net::DNS) perl(Net::DNS::Nameserver) perl(Time::HiRes) perl(Getopt::Long)
 BuildRequires:  perl(English)
 BuildRequires:  python3-pytest
-BuildRequires:  python3-pytest-xdist
-BuildRequires:  python3-dns
-BuildRequires:  python3-hypothesis
 # manual configuration requires this tool
 BuildRequires:  iproute
-BuildRequires:  python3-jinja2
-BuildRequires:  lmdb-devel
 %if %{with SUDO}
 BuildRequires:  libcap sudo
 %endif
@ -165,6 +147,9 @@ BuildRequires:  libcap sudo
 %if %{with GSSTSIG}
 BuildRequires:  krb5-devel
 %endif
+%if %{with LMDB}
+BuildRequires:  lmdb-devel
+%endif
 %if %{with JSON}
 BuildRequires:  json-c-devel
 %endif
@ -184,9 +169,7 @@ BuildRequires: libtsan
 %endif
 %if %{with DTRACE}
 # https://gitlab.isc.org/isc-projects/bind9/-/issues/4041
-BuildRequires:  systemtap
-BuildRequires:  systemtap-sdt-devel
-BuildRequires:  systemtap-sdt-dtrace
+BuildRequires: systemtap-sdt-devel
 %endif

 %description
@ -198,8 +181,7 @@ tools for verifying that the DNS server is operating properly.

 %package libs
 Summary: Libraries used by the BIND DNS packages
-Provides: %{name}-license = %{epoch}:%{version}-%{release}
-Obsoletes: %{name}-license < 32:9.21.11-5
+Requires: %{name}-license = %{epoch}:%{version}-%{release}
 Provides: %{name}-libs-lite = %{epoch}:%{version}-%{release}
 Obsoletes: %{name}-libs-lite < 32:9.16.13
 Obsoletes: %{name}-pkcs11-libs < 32:9.18.4-2
@ -208,6 +190,13 @@ Obsoletes: %{name}-pkcs11-libs < 32:9.18.4-2
 Contains heavyweight version of BIND suite libraries used by both named DNS
 server and utilities in %{name}-utils package.

+%package license
+Summary:  License of the BIND DNS suite
+BuildArch:noarch
+
+%description license
+Contains license of the BIND DNS suite.
+
 %package utils
 Summary: Utilities for querying DNS name servers
 Requires: %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release}
@ -247,14 +236,15 @@ Summary:  Header files and libraries needed for bind-dyndb-ldap
 Provides: %{name}-lite-devel = %{epoch}:%{version}-%{release}
 Obsoletes: %{name}-lite-devel < 32:9.16.6-3
 Requires: %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release}
-Requires: openssl-devel%{?_isa}
-Requires: libxml2-devel%{?_isa}
+Requires: openssl-devel%{?_isa} libxml2-devel%{?_isa}
 Requires: libcap-devel%{?_isa}
-Requires: lmdb-devel%{?_isa}
 %upname_compat %{upname}-devel
 %if %{with GSSTSIG}
 Requires: krb5-devel%{?_isa}
 %endif
+%if %{with LMDB}
+Requires: lmdb-devel%{?_isa}
+%endif
 %if %{with JSON}
 Requires:  json-c-devel%{?_isa}
 %endif
@ -286,6 +276,7 @@ Based on the code from Jan "Yenya" Kasprzak <kas@fi.muni.cz>
 %if %{with DOC}
 %package doc
 Summary:   BIND 9 Administrator Reference Manual
+Requires:  %{name}-license = %{epoch}:%{version}-%{release}
 Requires:  python3-sphinx_rtd_theme
 BuildArch: noarch

@ -303,25 +294,30 @@ in HTML and PDF format.
 %endif

 %prep
-%if ! 0%{?rhel} || 0%{?rhel} > 10
-# RHEL does not (again?) support this verification
+%if 0%{?fedora}
+# RHEL does not yet support this verification
 %{gpgverify} --keyring='%{SOURCE4}' --signature='%{SOURCE2}' --data='%{SOURCE0}'
 %endif
 %autosetup -n %{upname}-%{version} -p1

+# Sparc and s390 arches need to use -fPIE
+%ifarch sparcv9 sparc64 s390 s390x
+for i in bin/named/Makefile.am; do
+  sed -i 's|fpie|fPIE|g' $i
+done
+%endif
+
+%ifarch %{ix86}
+# f40 FTBFS on quota_test, bug #2261010
+  sed -e '/^\s*quota_test/ d' -i tests/isc/Makefile.am
+%endif
+
 :;

-# Create a sysusers.d config file
-cat >bind9-next.sysusers.conf <<EOF
-g named %{bind_gid}
-u named %{bind_uid} 'Named' /var/named -
-EOF
-
-# get rid of rpath issues
-sed -e '/install_rpath:/ d' -i meson.build
-

 %build
+## We use out of tree configure/build for export libs
+%define _configure "../configure"

 # normal and pkcs11 unit tests
 %define unit_prepare_build() \
@ -343,46 +339,48 @@ CPPFLAGS="$CPPFLAGS -DOPENSSL_NO_ENGINE=1"
 export CFLAGS CPPFLAGS
 export STD_CDEFINES="$CPPFLAGS"

-#sed -i -e \
-#'s/([bind_VERSION_EXTRA],\s*\([^)]*\))/([bind_VERSION_EXTRA], \1-RH)/' \
-#configure.ac
+sed -i -e \
+'s/([bind_VERSION_EXTRA],\s*\([^)]*\))/([bind_VERSION_EXTRA], \1-RH)/' \
+configure.ac

-install -p -m 0755 %{SOURCE27} ./named-mkroot.sh # create named.root.key
-./named-mkroot.sh
-[ -f named.root.key ]
+%if 0%{?rhel} && 0%{?rhel} < 9
+# disable Sphinx warnings as errors, epel8 does not pass cleanly
+sed -e 's/-W\s//' -i Makefile.docs
+%endif

+autoreconf --force --install

+mkdir build
+
+pushd build
 LIBDIR_SUFFIX=
 export LIBDIR_SUFFIX
-
-%meson \
+%configure \
+  --with-pic \
+  --disable-static \
  --includedir=%{_includedir}/bind9 \
-  -Didn=enabled \
-  -Dfuzzing=disabled \
-%if %{without DTRACE}
-  -Dtracing=disabled \
-%endif
+  --with-libidn2 \
 %if %{with GEOIP2}
-  -Dgeoip=enabled \
+  --with-maxminddb \
 %endif
 %if %{with GSSTSIG}
-  -Dgssapi=enabled \
+  --with-gssapi=yes \
+%endif
+%if %{with LMDB}
+  --with-lmdb=yes \
+%else
+  --with-lmdb=no \
 %endif
 %if %{with JSON}
-  -Dstats-json=enabled \
+  --with-json-c \
 %endif
 %if %{with DNSTAP}
-  -Ddnstap=enabled \
+  --enable-dnstap \
 %endif
 %if %{with UNITTEST}
-  -Dcmocka=enabled \
-%endif
-%if %{with DOC}
-  -Ddoc=enabled \
-%endif
-%if %{without JEMALLOC}
-  -Djemalloc=disabled \
+  --with-cmocka \
 %endif
+  --enable-full-report \
 ;
 %if %{with DNSTAP}
  pushd lib
@ -391,27 +389,21 @@ export LIBDIR_SUFFIX
  popd
 %endif

-%meson_build
+%make_build SPHINX_W=''

 %if %{with DOC}
-  %meson_build man arm arm-epub
-%endif
-%if %{with SYSTEMTEST}
-  %meson_build system-test-dependencies
+  %make_build doc SPHINX_W=''
 %endif

+popd # build
+
 # Compress changelog by default
 gzip doc/changelog/changelog-*.rst

-#unit_prepare_build build
-#systemtest_prepare_build build
+%unit_prepare_build build
+%systemtest_prepare_build build

 %check
-# reduce test loops (from default 100) for isc/{mutex/spinlock/rwlock}
-# to allow rwlock(isc_rwlock_benchmark) to finish within the 300 seconds
-# timeout limit on platforms (riscv64,s390x) where it is slow
-# TODO: find out why it is slow
-export ISC_BENCHMARK_LOOPS=20
 %if %{with UNITTEST} || %{with SYSTEMTEST}
  # Tests require initialization of pkcs11 token
  eval "$(bash %{SOURCE48} -A "`pwd`/softhsm-tokens")"
@ -421,32 +413,28 @@ export ISC_BENCHMARK_LOOPS=20
 export TSAN_OPTIONS="log_exe_name=true log_path=ThreadSanitizer exitcode=0"
 %endif

-# We produce it runtime. Check it has valid syntax.
-LD_LIBRARY_PATH="$LD_LIBRARY_PATH:${RPM_BUILD_ROOT}%{_libdir}" \
-  ${RPM_BUILD_ROOT}%{_bindir}/named-checkconf ${RPM_BUILD_ROOT}%{_sysconfdir}/named.root.key
-
 %if %{with UNITTEST}
+  pushd build
  CPUS=$(lscpu -p=cpu,core | grep -v '^#' | wc -l)
  THREADS="$CPUS"
-  COREPATTERN="$(cat /proc/sys/kernel/core_pattern)"
 %if %{without UNITTEST_ALL}
  export CI=true
 %endif
  if [ "$CPUS" -gt 16 ]; then
    ORIGFILES=$(ulimit -n)
    THREADS=16
-    # https://gitlab.isc.org/isc-projects/bind9/-/issues/5328
-    export ISC_TASK_WORKERS="$THREADS"
    ulimit -n 8092 || : # Requires on some machines with many cores
  fi
  e=0
-  %meson_test --num-processes ${THREADS} || e=$?
-
+  %make_build unit -j${THREADS} || e=$?
+  # Display details of failure
+  cat tests/*/test-suite.log
  if [ "$e" -ne 0 ]; then
-    echo "ERROR: test failed. Aborting."
+    echo "ERROR: this build of BIND failed 'make unit'. Aborting."
    exit $e;
  fi;
  [ "$CPUS" -gt 16 ] && ulimit -n $ORIGFILES || :
+  popd
 ## End of UNITTEST
 %endif

@ -454,7 +442,7 @@ LD_LIBRARY_PATH="$LD_LIBRARY_PATH:${RPM_BUILD_ROOT}%{_libdir}" \
 # Runs system test if ip addresses are already configured
 # or it is able to configure them
  SUDO=
-  pushd bin/tests/system/
+  pushd build/bin/tests/system/
  if perl ./testsock.pl
  then
    CONFIGURED=already
@ -474,23 +462,18 @@ LD_LIBRARY_PATH="$LD_LIBRARY_PATH:${RPM_BUILD_ROOT}%{_libdir}" \

  if [ -n "$CONFIGURED" ]
  then
-    pushd bin/tests/system
+    set -e
+    pushd build/bin/tests
    export CI_SYSTEM=yes # allow running tests as root
    chown -R ${USER} . # Can be unknown user
-    e=0
-    pytest -n ${THREADS} --capture=tee-sys || e=$?
+    %make_build test 2>&1 | tee test.log
+    e=$?
    [ "$CONFIGURED" = build ] && $SUDO sh ./ifconfig.sh down
+    popd
    if [ "$e" -ne 0 ]; then
-      echo "ERROR: failed running 'pytest' in system tests. Aborting."
-      ls -1 "$(pwd)"/*_tmp_*
-      for TMPTEST in *_tmp_*
-      do
-        echo "# $TMPTEST"
-        cat $TMPTEST/pytest.log.txt
-      done
+      echo "ERROR: this build of BIND failed 'make test'. Aborting."
      exit $e;
    fi;
-    popd
  else
    echo 'SKIPPED: tests require root, CAP_NET_ADMIN or already configured test addresses.'
  fi
@ -521,7 +504,9 @@ popd
 touch ${RPM_BUILD_ROOT}/%{chroot_prefix}%{_sysconfdir}/named.conf
 #end chroot

-%meson_install
+pushd build
+%make_install
+popd

 # Remove unwanted files
 rm -f ${RPM_BUILD_ROOT}/etc/bind.keys
@ -555,6 +540,9 @@ find ${RPM_BUILD_ROOT}/%{_libdir} -name '*.la' -exec '/bin/rm' '-f' '{}' ';';
 %if %{without DNSTAP}
 rm -f ${RPM_BUILD_ROOT}%{_mandir}/man1/dnstap-read.1* || true
 %endif
+%if %{without LMDB}
+rm -f ${RPM_BUILD_ROOT}%{_mandir}/man8/named-nzd2nzf.8* || true
+%endif

 pushd ${RPM_BUILD_ROOT}%{_mandir}/man8
 ln -s ddns-confgen.8.gz tsig-keygen.8.gz
@ -565,9 +553,8 @@ popd

 %if %{with DOC}
 mkdir -p ${RPM_BUILD_ROOT}%{_pkgdocdir}
-pushd %{_vpath_builddir}
-cp -a arm/ ${RPM_BUILD_ROOT}%{_pkgdocdir}/html/
-#rm -rf ${RPM_BUILD_ROOT}%{_pkgdocdir}/html/.{buildinfo,doctrees}
+cp -a build/doc/arm/_build/html ${RPM_BUILD_ROOT}%{_pkgdocdir}
+rm -rf ${RPM_BUILD_ROOT}%{_pkgdocdir}/html/.{buildinfo,doctrees}
 # Backward compatible link to 9.11 documentation
 (cd ${RPM_BUILD_ROOT}%{_pkgdocdir} && ln -s html/index.html Bv9ARM.html)
 # Share static data from original sphinx package
@ -580,10 +567,7 @@ do
    ln -sr "${RPM_BUILD_ROOT}${DIR}" "$BINDTHEMEDIR"
  fi
 done
-cp -p arm-epub/Bv9ARM.epub ${RPM_BUILD_ROOT}%{_pkgdocdir}
-popd
-cp -p doc/changelog/changelog-history.rst* doc/notes/notes-*.rst* \
-      ${RPM_BUILD_ROOT}%{_pkgdocdir}
+cp -p build/doc/arm/_build/epub/Bv9ARM.epub ${RPM_BUILD_ROOT}%{_pkgdocdir}
 %endif

 # Ghost config files:
@ -592,13 +576,13 @@ touch ${RPM_BUILD_ROOT}%{_localstatedir}/log/named.log
 # configuration files:
 install -m 640 %{SOURCE16} ${RPM_BUILD_ROOT}%{_sysconfdir}/named.conf
 touch ${RPM_BUILD_ROOT}%{_sysconfdir}/rndc.{key,conf}
-install -m 644 -p named.root.key ${RPM_BUILD_ROOT}%{_sysconfdir}/named.root.key
-ln -s "%{_datadir}/dns-root-data/root.key" ${RPM_BUILD_ROOT}%{_sysconfdir}/trusted-key.key
+install -m 644 %{SOURCE27} ${RPM_BUILD_ROOT}%{_sysconfdir}/named.root.key
+install -m 644 %{SOURCE36} ${RPM_BUILD_ROOT}%{_sysconfdir}/trusted-key.key
 mkdir -p ${RPM_BUILD_ROOT}%{_sysconfdir}/named

 # data files:
 mkdir -p ${RPM_BUILD_ROOT}%{_localstatedir}/named
-ln -s "%{_datadir}/dns-root-data/root.hints" ${RPM_BUILD_ROOT}%{_localstatedir}/named/named.ca
+install -m 640 %{SOURCE17} ${RPM_BUILD_ROOT}%{_localstatedir}/named/named.ca
 install -m 640 %{SOURCE18} ${RPM_BUILD_ROOT}%{_localstatedir}/named/named.localhost
 install -m 640 %{SOURCE19} ${RPM_BUILD_ROOT}%{_localstatedir}/named/named.loopback
 install -m 640 %{SOURCE20} ${RPM_BUILD_ROOT}%{_localstatedir}/named/named.empty
@ -611,7 +595,7 @@ install -m 644 %{SOURCE25} sample/etc/named.conf
 install -m 644 %{SOURCE16} named.conf.default
 install -m 644 %{SOURCE23} sample/etc/named.rfc1912.zones
 install -m 644 %{SOURCE18} %{SOURCE19} %{SOURCE20}  sample/var/named
-ln -s "%{_datadir}/dns-root-data/root.hints" sample/var/named/named.ca
+install -m 644 %{SOURCE17} sample/var/named/named.ca
 for f in my.internal.zone.db slaves/my.slave.internal.zone.db slaves/my.ddns.internal.zone.db my.external.zone.db; do 
  echo '@ in soa localhost. root 1 3H 15M 1W 1D
  ns localhost.' > sample/var/named/$f; 
@ -621,7 +605,15 @@ done
 mkdir -p ${RPM_BUILD_ROOT}%{_tmpfilesdir}
 install -m 644 %{SOURCE35} ${RPM_BUILD_ROOT}%{_tmpfilesdir}/named.conf

-install -m0644 -D bind9-next.sysusers.conf %{buildroot}%{_sysusersdir}/bind9-next.conf
+mkdir -p ${RPM_BUILD_ROOT}%{_sysconfdir}/rwtab.d
+install -m 644 %{SOURCE43} ${RPM_BUILD_ROOT}%{_sysconfdir}/rwtab.d/named
+
+%pre
+if [ "$1" -eq 1 ]; then
+  /usr/sbin/groupadd -g %{bind_gid} -f -r named >/dev/null 2>&1 || :;
+  /usr/sbin/useradd  -u %{bind_uid} -r -N -M -g named -s /sbin/nologin -d /var/named -c Named named >/dev/null 2>&1 || :;
+fi;
+:;

 %post
 %?ldconfig
@ -714,19 +706,17 @@ fi;
 # FIXME: current build targets filters into %%_libdir/bind again?
 %dir %{_libdir}/bind
 %{_libdir}/bind/filter*.so
-%{_libdir}/bind/synthrecord.so
 %dir %{_libdir}/named
 %config(noreplace) %verify(not md5 size mtime) %{_sysconfdir}/sysconfig/named
 %config(noreplace) %attr(0644,root,named) %{_sysconfdir}/named.root.key
 %config(noreplace) %{_sysconfdir}/logrotate.d/named
 %{_tmpfilesdir}/named.conf
-%{_sysusersdir}/bind9-next.conf
+%{_sysconfdir}/rwtab.d/named
 %{_unitdir}/named.service
 %{_unitdir}/named-setup-rndc.service
 %{_bindir}/named-journalprint
 %{_bindir}/named-checkconf
 %{_bindir}/named-rrchecker
-%{_bindir}/named-makejournal
 %{_bindir}/mdig
 %{_sbindir}/named
 %{_sbindir}/rndc*
@ -744,8 +734,7 @@ fi;
 %{_mandir}/man1/named-checkconf.1*
 %{_mandir}/man8/rndc-confgen.8*
 %{_mandir}/man1/named-journalprint.1*
-%{_mandir}/man1/named-makejournal.1*
-%{_mandir}/man8/filter-*.8*
+%{_mandir}/man8/filter-*.8.gz
 %doc README.md named.conf.default
 %doc doc/changelog/changelog-9.*.rst*
 %doc sample/
@ -781,6 +770,8 @@ fi;
 %{_libdir}/libdns-%{version}*.so
 %{_libdir}/libisc-%{version}*.so
 %{_libdir}/libisccfg-%{version}*.so
+
+%files license
 %{!?_licensedir:%global license %%doc}
 %license COPYRIGHT

@ -804,8 +795,10 @@ fi;
 %{_bindir}/dnstap-read
 %{_mandir}/man1/dnstap-read.1*
 %endif
+%if %{with LMDB}
 %{_bindir}/named-nzd2nzf
 %{_mandir}/man1/named-nzd2nzf.1*
+%endif
 %{_mandir}/man1/host.1*
 %{_mandir}/man1/nsupdate.1*
 %{_mandir}/man1/dig.1*
@ -823,8 +816,6 @@ fi;
 %{_bindir}/dnssec*
 %{_mandir}/man1/dnssec*.1*

-%if 0
-# TODO: remove devel subpackage or create custom installation part
 %files devel
 %{_libdir}/libisccc.so
 %{_libdir}/libns.so
@ -839,7 +830,6 @@ fi;
 %{_includedir}/bind9/irs
 %{_includedir}/bind9/isc
 %{_includedir}/bind9/isccfg
-%endif

 %files chroot
 %config(noreplace) %{_sysconfdir}/named-chroot.files
@ -886,9 +876,8 @@ fi;
 %doc %{_pkgdocdir}/html
 %doc %{_pkgdocdir}/Bv9ARM.html
 %doc %{_pkgdocdir}/Bv9ARM.epub
-%doc %{_pkgdocdir}/changelog-history.rst*
-%doc %{_pkgdocdir}/notes-*.rst*
-%license COPYRIGHT
+%doc doc/changelog/changelog-history.rst*
+%doc doc/notes/notes-*.rst*
 %endif

 %changelog
--- a/bind97-exportlib.patch
+++ b/bind97-exportlib.patch
@ -0,0 +1,226 @@
+diff -up bind-9.9.3rc2/isc-config.sh.in.exportlib bind-9.9.3rc2/isc-config.sh.in
+diff -up bind-9.9.3rc2/lib/export/dns/Makefile.in.exportlib bind-9.9.3rc2/lib/export/dns/Makefile.in
+--- bind-9.9.3rc2/lib/export/dns/Makefile.in.exportlib	2013-04-30 08:38:46.000000000 +0200
+++ bind-9.9.3rc2/lib/export/dns/Makefile.in	2013-05-13 10:45:22.574089729 +0200
+@@ -35,9 +35,9 @@ CDEFINES =	-DUSE_MD5 @USE_OPENSSL@ @USE_
+ 
+ CWARNINGS =
+ 
+-ISCLIBS =	../isc/libisc.@A@
+ISCLIBS =	../isc/libisc-export.@A@
+ 
+-ISCDEPLIBS =	../isc/libisc.@A@
+ISCDEPLIBS =	../isc/libisc-export.@A@
+ 
+ LIBS =		@LIBS@
+ 
+@@ -116,29 +116,29 @@ version.@O@: ${srcdir}/version.c
+ 		-DLIBAGE=${LIBAGE} \
+ 		-c ${srcdir}/version.c
+ 
+-libdns.@SA@: ${OBJS}
+libdns-export.@SA@: ${OBJS}
+ 	${AR} ${ARFLAGS} $@ ${OBJS}
+ 	${RANLIB} $@
+ 
+-libdns.la: ${OBJS}
+libdns-export.la: ${OBJS}
+ 	${LIBTOOL_MODE_LINK} \
+-		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libdns.la \
+		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libdns-export.la \
+ 		-rpath ${export_libdir} \
+ 		-version-info ${LIBINTERFACE}:${LIBREVISION}:${LIBAGE} \
+ 		${OBJS} ${ISCLIBS} @DNS_CRYPTO_LIBS@ ${LIBS}
+ 
+-timestamp: libdns.@A@
+timestamp: libdns-export.@A@
+ 	touch timestamp
+ 
+ installdirs:
+ 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${export_libdir}
+ 
+ install:: timestamp installdirs
+-	${LIBTOOL_MODE_INSTALL} ${INSTALL_DATA} libdns.@A@ \
+	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} libdns-export.@A@ \
+ 	${DESTDIR}${export_libdir}/
+ 
+ clean distclean::
+-	rm -f libdns.@A@ timestamp
+	rm -f libdns-export.@A@ timestamp
+ 	rm -f gen code.h include/dns/enumtype.h include/dns/enumclass.h
+ 	rm -f include/dns/rdatastruct.h
+ 
+diff -up bind-9.9.3rc2/lib/export/irs/Makefile.in.exportlib bind-9.9.3rc2/lib/export/irs/Makefile.in
+--- bind-9.9.3rc2/lib/export/irs/Makefile.in.exportlib	2013-04-30 08:38:46.000000000 +0200
+++ bind-9.9.3rc2/lib/export/irs/Makefile.in	2013-05-13 10:45:22.575089729 +0200
+@@ -43,9 +43,9 @@ SRCS =		context.c \
+ 		gai_sterror.c getaddrinfo.c getnameinfo.c \
+ 		resconf.c
+ 
+-ISCLIBS =	../isc/libisc.@A@
+-DNSLIBS =	../dns/libdns.@A@
+-ISCCFGLIBS =	../isccfg/libisccfg.@A@
+ISCLIBS =	../isc/libisc-export.@A@
+DNSLIBS =	../dns/libdns-export.@A@
+ISCCFGLIBS =	../isccfg/libisccfg-export.@A@
+ 
+ LIBS =		@LIBS@
+ 
+@@ -62,26 +62,26 @@ version.@O@: ${srcdir}/version.c
+ 		-DLIBAGE=${LIBAGE} \
+ 		-c ${srcdir}/version.c
+ 
+-libirs.@SA@: ${OBJS} version.@O@
+libirs-export.@SA@: ${OBJS} version.@O@
+ 	${AR} ${ARFLAGS} $@ ${OBJS} version.@O@
+ 	${RANLIB} $@
+ 
+-libirs.la: ${OBJS} version.@O@
+libirs-export.la: ${OBJS} version.@O@
+ 	${LIBTOOL_MODE_LINK} \
+-		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libirs.la \
+		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libirs-export.la \
+ 		-rpath ${export_libdir} \
+ 		-version-info ${LIBINTERFACE}:${LIBREVISION}:${LIBAGE} \
+ 		${OBJS} version.@O@ ${LIBS} ${ISCCFGLIBS} ${DNSLIBS} ${ISCLIBS}
+ 
+-timestamp: libirs.@A@
+timestamp: libirs-export.@A@
+ 	touch timestamp
+ 
+ installdirs:
+ 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${export_libdir}
+ 
+ install:: timestamp installdirs
+-	${LIBTOOL_MODE_INSTALL} ${INSTALL_DATA} libirs.@A@ \
+	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} libirs-export.@A@ \
+ 	${DESTDIR}${export_libdir}/
+ 
+ clean distclean::
+-	rm -f libirs.@A@ libirs.la timestamp
+	rm -f libirs-export.@A@ libirs-export.la timestamp
+diff -up bind-9.9.3rc2/lib/export/isccfg/Makefile.in.exportlib bind-9.9.3rc2/lib/export/isccfg/Makefile.in
+--- bind-9.9.3rc2/lib/export/isccfg/Makefile.in.exportlib	2013-04-30 08:38:46.000000000 +0200
+++ bind-9.9.3rc2/lib/export/isccfg/Makefile.in	2013-05-13 10:45:22.576089729 +0200
+@@ -30,11 +30,11 @@ CINCLUDES =	-I. ${DNS_INCLUDES} -I${expo
+ CDEFINES =
+ CWARNINGS =
+ 
+-ISCLIBS =	../isc/libisc.@A@
+-DNSLIBS =	../dns/libdns.@A@ @DNS_CRYPTO_LIBS@
+ISCLIBS =	../isc/libisc-export.@A@
+DNSLIBS =	../dns/libdns-export.@A@ @DNS_CRYPTO_LIBS@
+ 
+ ISCDEPLIBS =	../../lib/isc/libisc.@A@
+-ISCCFGDEPLIBS =	libisccfg.@A@
+ISCCFGDEPLIBS =	libisccfg-export.@A@
+ 
+ LIBS =		@LIBS@
+ 
+@@ -58,26 +58,26 @@ version.@O@: ${srcdir}/version.c
+ 		-DLIBAGE=${LIBAGE} \
+ 		-c ${srcdir}/version.c
+ 
+-libisccfg.@SA@: ${OBJS}
+libisccfg-export.@SA@: ${OBJS}
+ 	${AR} ${ARFLAGS} $@ ${OBJS}
+ 	${RANLIB} $@
+ 
+-libisccfg.la: ${OBJS}
+libisccfg-export.la: ${OBJS}
+ 	 ${LIBTOOL_MODE_LINK} \
+-		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libisccfg.la \
+		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libisccfg-export.la \
+ 		-rpath ${export_libdir} \
+ 		-version-info ${LIBINTERFACE}:${LIBREVISION}:${LIBAGE} \
+ 		${OBJS} ${LIBS} ${DNSLIBS} ${ISCLIBS}
+ 
+-timestamp: libisccfg.@A@
+timestamp: libisccfg-export.@A@
+ 	touch timestamp
+ 
+ installdirs:
+ 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${export_libdir}
+ 
+ install:: timestamp installdirs
+-	${LIBTOOL_MODE_INSTALL} ${INSTALL_DATA} libisccfg.@A@ \
+	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} libisccfg-export.@A@ \
+ 	${DESTDIR}${export_libdir}/
+ 
+ clean distclean::
+-	rm -f libisccfg.@A@ timestamp
+	rm -f libisccfg-export.@A@ timestamp
+diff -up bind-9.9.3rc2/lib/export/isc/Makefile.in.exportlib bind-9.9.3rc2/lib/export/isc/Makefile.in
+--- bind-9.9.3rc2/lib/export/isc/Makefile.in.exportlib	2013-04-30 08:38:46.000000000 +0200
+++ bind-9.9.3rc2/lib/export/isc/Makefile.in	2013-05-13 10:45:22.576089729 +0200
+@@ -100,6 +100,10 @@ SRCS =		@ISC_EXTRA_SRCS@ \
+ 
+ LIBS =		@LIBS@
+ 
+# Note: the order of SUBDIRS is important.
+# Attempt to disable parallel processing.
+.NOTPARALLEL:
+.NO_PARALLEL:
+ SUBDIRS =	include unix nls @ISC_THREAD_DIR@
+ TARGETS =	timestamp
+ 
+@@ -113,26 +117,26 @@ version.@O@: ${srcdir}/version.c
+ 		-DLIBAGE=${LIBAGE} \
+ 		-c ${srcdir}/version.c
+ 
+-libisc.@SA@: ${OBJS}
+libisc-export.@SA@: ${OBJS}
+ 	${AR} ${ARFLAGS} $@ ${OBJS}
+ 	${RANLIB} $@
+ 
+-libisc.la: ${OBJS}
+libisc-export.la: ${OBJS}
+ 	${LIBTOOL_MODE_LINK} \
+-		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libisc.la \
+		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libisc-export.la \
+ 		-rpath ${export_libdir} \
+ 		-version-info ${LIBINTERFACE}:${LIBREVISION}:${LIBAGE} \
+ 		${OBJS} ${LIBS}
+ 
+-timestamp: libisc.@A@
+timestamp: libisc-export.@A@
+ 	touch timestamp
+ 
+ installdirs:
+ 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${export_libdir}
+ 
+ install:: timestamp installdirs
+-	${LIBTOOL_MODE_INSTALL} ${INSTALL_DATA} libisc.@A@ \
+	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} libisc-export.@A@ \
+ 	${DESTDIR}${export_libdir}
+ 
+ clean distclean::
+-	rm -f libisc.@A@ libisc.la timestamp
+	rm -f libisc-export.@A@ libisc-export.la timestamp
+diff -up bind-9.9.3rc2/lib/export/samples/Makefile.in.exportlib bind-9.9.3rc2/lib/export/samples/Makefile.in
+--- bind-9.9.3rc2/lib/export/samples/Makefile.in.exportlib	2013-04-30 08:38:46.000000000 +0200
+++ bind-9.9.3rc2/lib/export/samples/Makefile.in	2013-05-13 10:45:22.577089729 +0200
+@@ -31,15 +31,15 @@ CINCLUDES =	-I${srcdir}/include -I../dns
+ CDEFINES =
+ CWARNINGS =
+ 
+-DNSLIBS =	../dns/libdns.@A@ @DNS_CRYPTO_LIBS@
+-ISCLIBS =	../isc/libisc.@A@
+-ISCCFGLIBS =	../isccfg/libisccfg.@A@
+-IRSLIBS =	../irs/libirs.@A@
+DNSLIBS =	../dns/libdns-export.@A@ @DNS_CRYPTO_LIBS@
+ISCLIBS =	../isc/libisc-export.@A@
+ISCCFGLIBS =	../isccfg/libisccfg-export.@A@
+IRSLIBS =	../irs/libirs-export.@A@
+ 
+-DNSDEPLIBS =	../dns/libdns.@A@
+-ISCDEPLIBS =	../isc/libisc.@A@
+-ISCCFGDEPLIBS =	../isccfg/libisccfg.@A@
+-IRSDEPLIBS =	../irs/libirs.@A@
+DNSDEPLIBS =	../dns/libdns-export.@A@
+ISCDEPLIBS =	../isc/libisc-export.@A@
+ISCCFGDEPLIBS =	../isccfg/libisccfg-export.@A@
+IRSDEPLIBS =	../irs/libirs-export.@A@
+ 
+ DEPLIBS =	${DNSDEPLIBS} ${ISCCFGDEPLIBS} ${ISCDEPLIBS}
+ 
--- a/named-chroot.files
+++ b/named-chroot.files
@ -18,7 +18,6 @@
 /usr/lib64/bind
 /usr/lib/bind
 /usr/share/GeoIP
-/usr/share/dns-root-data
 /run/named
 /proc/sys/net/ipv4/ip_local_port_range
 # Warning: the order is important
--- a/named-mkroot.sh
+++ b/named-mkroot.sh
@ -1,20 +0,0 @@
-#!/bin/sh
-# Create named.root.key from dns-root-data package
-
-ROOT_DS=/usr/share/dns-root-data/root.ds
-: ${OUTPUT:=named.root.key}
-
-if ! [ -r "$ROOT_DS" ]; then
-	echo "Root trust file is not readable: $ROOT_DS"
-	exit 1
-fi
-
-echo "# Autogenerated from $ROOT_DS" > "$OUTPUT"
-echo "trust-anchors {" >> "$OUTPUT"
-cat "$ROOT_DS" | while read DOMAIN CLS QTYPE KEYTAG ALG DIG HASH;
-do
-	echo "$DOMAIN initial-ds $KEYTAG $ALG $DIG \"$HASH\";" >> "$OUTPUT";
-done
-echo "}; " >> "$OUTPUT"
-# Set the same modification time as data source.
-touch -r $ROOT_DS "$OUTPUT"
--- a/named.conf.sample
+++ b/named.conf.sample
@ -1,11 +1,11 @@
-# vim: ft=named:
 /*
 Sample named.conf BIND DNS server 'named' configuration file
 for the Red Hat BIND distribution.

 See the BIND Administrator's Reference Manual (ARM) for details, in:
-   file:///usr/share/doc/bind/html/index.html
- Or on upstream site: https://bind9.readthedocs.org/
+   file:///usr/share/doc/bind-{version}/arm/Bv9ARM.html
+ Also see the BIND Configuration GUI : /usr/bin/system-config-bind and 
+ its manual.
 */

 options
@ -47,7 +47,6 @@ options

 	allow-query		{ localhost; };
 	allow-query-cache	{ localhost; };
-	allow-transfer		{ localhost; };

 	/* Enable/disable recursion - recursion yes/no;

@ -65,7 +64,7 @@ options
 	/* DNSSEC related options. See information about keys ("Trusted keys", bellow) */

 	/* Enable DNSSEC validation on recursive servers */
-	dnssec-validation auto;
+	dnssec-validation yes;

 	/* In Fedora we use /run/named instead of default /var/run/named
 	   so we have to configure paths properly. */
@ -166,7 +165,7 @@ view "internal"
 	zone "my.slave.internal.zone" {
 		type secondary;
 		file "slaves/my.slave.internal.zone.db";
-		primaries { /* put master nameserver IPs here */ 127.0.0.1; } ;
+		masters { /* put master nameserver IPs here */ 127.0.0.1; } ;
 		// put slave zones in the slaves/ directory so named can update them
 	};	
 	zone "my.ddns.internal.zone" {
@ -180,8 +179,7 @@ view "internal"
 key ddns_key
 {
 	algorithm hmac-sha256;
-	#secret "use /usr/sbin/ddns-confgen to generate TSIG keys";
-	secret "dXNlIC91c3Ivc2Jpbi9kZG5zLWNvbmZnZW4gdG8gZ2VuZXJhdGUgVFNJRyBrZXlz";
+	secret "use /usr/sbin/ddns-confgen to generate TSIG keys";
 };

 view "external"
@ -214,13 +212,19 @@ view "external"
  This statement contains DNSSEC keys. If you want DNSSEC aware resolver you
  should configure at least one trusted key.

-  Note that no key written below is valid. Especially root key is maintained in
-  /etc/named.root.key file.
+  Note that no key written below is valid. Especially root key because root zone
+  is not signed yet.
 */
 /*
 trust-anchors {
 // Root Key
-. initial-ds 38696 8 2 "683D2D0ACB8C9B712A1948B27F741219298D0A450D612C483AF444A4C0FB2B16";
+. initial-key 257 3 8 "AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3
+		      +/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kv
+		      ArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF
+		      0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+e
+		      oZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfd
+		      RUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwN
+		      R1AkUTV74bU=";

 // Key for forward zone
 example.com. static-key 257 3 8 "AwEAAZ0aqu1rJ6orJynrRfNpPmayJZoAx9Ic2/Rl9VQW
@ -234,6 +238,6 @@ example.com. static-key 257 3 8 "AwEAAZ0aqu1rJ6orJynrRfNpPmayJZoAx9Ic2/Rl9VQW


 // Key for reverse zone.
-2.0.192.IN-ADDRPA.NET. static-ds 31406 8 2 "F78CF3344F72137235098ECBBD08947C2C9001C7F6A085A17F518B5D8F6B916D";
+2.0.192.IN-ADDRPA.NET. initial-ds 31406 8 2 "F78CF3344F72137235098ECBBD08947C2C9001C7F6A085A17F518B5D8F6B916D";
 };
 */
--- a/named.logrotate
+++ b/named.logrotate
@ -2,8 +2,11 @@
    missingok
    su named named
    create 0644 named named
-    notifempty
    postrotate
-        /usr/bin/rndc closelogs > /dev/null 2>&1 || true
+        /usr/bin/systemctl reload named.service > /dev/null 2>&1 || true
+        /usr/bin/systemctl reload named-chroot.service > /dev/null 2>&1 || true
+        /usr/bin/systemctl reload named-sdb.service > /dev/null 2>&1 || true
+        /usr/bin/systemctl reload named-sdb-chroot.service > /dev/null 2>&1 || true
+        /usr/bin/systemctl reload named-pkcs11.service > /dev/null 2>&1 || true
    endscript
 }
--- a/named.root
+++ b/named.root
@ -0,0 +1,92 @@
+;       This file holds the information on root name servers needed to 
+;       initialize cache of Internet domain name servers
+;       (e.g. reference this file in the "cache  .  <file>"
+;       configuration file of BIND domain name servers). 
+; 
+;       This file is made available by InterNIC 
+;       under anonymous FTP as
+;           file                /domain/named.cache 
+;           on server           FTP.INTERNIC.NET
+;       -OR-                    RS.INTERNIC.NET
+;
+;       last update:     December 20, 2023
+;       related version of root zone:     2023122001
+; 
+; FORMERLY NS.INTERNIC.NET 
+;
+.                        3600000      NS    A.ROOT-SERVERS.NET.
+A.ROOT-SERVERS.NET.      3600000      A     198.41.0.4
+A.ROOT-SERVERS.NET.      3600000      AAAA  2001:503:ba3e::2:30
+; 
+; FORMERLY NS1.ISI.EDU 
+;
+.                        3600000      NS    B.ROOT-SERVERS.NET.
+B.ROOT-SERVERS.NET.      3600000      A     170.247.170.2
+B.ROOT-SERVERS.NET.      3600000      AAAA  2801:1b8:10::b
+; 
+; FORMERLY C.PSI.NET 
+;
+.                        3600000      NS    C.ROOT-SERVERS.NET.
+C.ROOT-SERVERS.NET.      3600000      A     192.33.4.12
+C.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:2::c
+; 
+; FORMERLY TERP.UMD.EDU 
+;
+.                        3600000      NS    D.ROOT-SERVERS.NET.
+D.ROOT-SERVERS.NET.      3600000      A     199.7.91.13
+D.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:2d::d
+; 
+; FORMERLY NS.NASA.GOV
+;
+.                        3600000      NS    E.ROOT-SERVERS.NET.
+E.ROOT-SERVERS.NET.      3600000      A     192.203.230.10
+E.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:a8::e
+; 
+; FORMERLY NS.ISC.ORG
+;
+.                        3600000      NS    F.ROOT-SERVERS.NET.
+F.ROOT-SERVERS.NET.      3600000      A     192.5.5.241
+F.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:2f::f
+; 
+; FORMERLY NS.NIC.DDN.MIL
+;
+.                        3600000      NS    G.ROOT-SERVERS.NET.
+G.ROOT-SERVERS.NET.      3600000      A     192.112.36.4
+G.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:12::d0d
+; 
+; FORMERLY AOS.ARL.ARMY.MIL
+;
+.                        3600000      NS    H.ROOT-SERVERS.NET.
+H.ROOT-SERVERS.NET.      3600000      A     198.97.190.53
+H.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:1::53
+; 
+; FORMERLY NIC.NORDU.NET
+;
+.                        3600000      NS    I.ROOT-SERVERS.NET.
+I.ROOT-SERVERS.NET.      3600000      A     192.36.148.17
+I.ROOT-SERVERS.NET.      3600000      AAAA  2001:7fe::53
+; 
+; OPERATED BY VERISIGN, INC.
+;
+.                        3600000      NS    J.ROOT-SERVERS.NET.
+J.ROOT-SERVERS.NET.      3600000      A     192.58.128.30
+J.ROOT-SERVERS.NET.      3600000      AAAA  2001:503:c27::2:30
+; 
+; OPERATED BY RIPE NCC
+;
+.                        3600000      NS    K.ROOT-SERVERS.NET.
+K.ROOT-SERVERS.NET.      3600000      A     193.0.14.129
+K.ROOT-SERVERS.NET.      3600000      AAAA  2001:7fd::1
+; 
+; OPERATED BY ICANN
+;
+.                        3600000      NS    L.ROOT-SERVERS.NET.
+L.ROOT-SERVERS.NET.      3600000      A     199.7.83.42
+L.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:9f::42
+; 
+; OPERATED BY WIDE
+;
+.                        3600000      NS    M.ROOT-SERVERS.NET.
+M.ROOT-SERVERS.NET.      3600000      A     202.12.27.33
+M.ROOT-SERVERS.NET.      3600000      AAAA  2001:dc3::35
+; End of file
--- a/named.root.key
+++ b/named.root.key
@ -1,5 +1,18 @@
-# Autogenerated from /usr/share/dns-root-data/root.ds
-truste-anchors {
-. initial-ds 20326 8 2 "E06D44B80B8F1D39A95C0B0D7C65D08458E880409BBC683457104237C7F8EC8D";
-. initial-ds 38696 8 2 "683D2D0ACB8C9B712A1948B27F741219298D0A450D612C483AF444A4C0FB2B16";
-}; 
+trust-anchors {
+        # ROOT KEYS: See https://data.iana.org/root-anchors/root-anchors.xml
+        # for current trust anchor information.
+        #
+        # This key (20326) was published in the root zone in 2017.
+        # Servers which were already using the old key (19036) should
+        # roll seamlessly to this new one via RFC 5011 rollover. Servers
+        # being set up for the first time can use the contents of this
+        # file as initializing keys; thereafter, the keys in the
+        # managed key database will be trusted and maintained
+        # automatically.
+        . initial-ds 20326 8 2 "E06D44B80B8F1D39A95C0B0D7C65D08458E880409BBC683457104237C7F8EC8D";
+        # This key (38696) will be pre-published in the root zone in 2025
+        # and is scheduled to begin signing in late 2026. At that time,
+        # servers which were already using the old key (20326) should roll
+        # seamlessly to this new one via RFC 5011 rollover.
+        . initial-ds 38696 8 2 "683D2D0ACB8C9B712A1948B27F741219298D0A450D612C483AF444A4C0FB2B16";
+};
--- a/named.rwtab
+++ b/named.rwtab
@ -0,0 +1,6 @@
+dirs    /var/named
+
+files	/var/named/named.ca
+files	/var/named/named.empty
+files	/var/named/named.localhost
+files	/var/named/named.loopback
--- a/4
+++ b/4
@ -1,2 +1,2 @@
-SHA512 (bind-9.21.22.tar.xz) = f9e11d150162661c755dabdd7862c0565e6a10077e2a6aee04f8cefce94c262d8928ff9e42f8c8750242aee3b0992afe2f49f72f0f8cab8b7e4ae1c9fc06e0fa
-SHA512 (bind-9.21.22.tar.xz.asc) = 1e0bd14fad5754e12b6a4855dbed698dba74468790948316e17442e5bc840fc81d18e590fd78186a1e26e9526870b13470dcef6a15644e91775cc8883813ad24
+SHA512 (bind-9.21.3.tar.xz) = cc00929f0a3923bb7486cffe6791f6a25a98e58cf2ade4bbd99d8df61380113b5e3286d82c48bed4c9af00a9affba337e16963060847a03859b89e2ce12c85ce
+SHA512 (bind-9.21.3.tar.xz.asc) = e76e4158c3d269c1bbf6890a8d4cc6c78d0282e612324354e8f04b7099eb2704707cbaaf7e522b1fbea08f839bafdd4998da4d479c6f76d02df066fc83860fb7
--- a/trusted-key.key
+++ b/trusted-key.key
@ -0,0 +1,2 @@
+. 3600 IN DNSKEY 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU=
+. 3600 IN DNSKEY 257 3 8 AwEAAa96jeuknZlaeSrvyAJj6ZHv28hhOKkx3rLGXVaC6rXTsDc449/cidltpkyGwCJNnOAlFNKF2jBosZBU5eeHspaQWOmOElZsjICMQMC3aeHbGiShvZsx4wMYSjH8e7Vrhbu6irwCzVBApESjbUdpWWmEnhathWu1jo+siFUiRAAxm9qyJNg/wOZqqzL/dL/q8PkcRU5oUKEpUge71M3ej2/7CPqpdVwuMoTvoB+ZOT4YeGyxMvHmbrxlFzGOHOijtzN+u1TQNatX2XBuzZNQ1K+s2CXkPIZo7s6JgZyvaBevYtxPvYLw4z9mR7K2vaF18UYH9Z9GNUUeayffKC73PYc=