Update to 9.21.20 (rhbz#2440560)

Security Fixes:

- Fix unbounded NSEC3 iterations when validating referrals to unsigned delegations. (CVE-2026-1519)
- Fix memory leaks in code preparing DNSSEC proofs of non-existence. (CVE-2026-3104)
- Prevent a crash in code processing queries containing a TKEY record. (CVE-2026-3119)
- Fix a stack use-after-return flaw in SIG(0) handling code. (CVE-2026-3591)

New Features:

- Provide response round-trip time (RTT) counters via statistics channel.
- Introduce max-delegation-servers configuration option.

Bug Fixes:

- Fix parsing key inactivation time in KASP code.
- Fix the handling of key statements defined inside views.

Source: https://downloads.isc.org/isc/bind9/9.21.20/doc/arm/html/notes.html#notes-for-bind-9-21-20

bind-9.11.12.tar.gz.asc

@@ -0,0 +1,16 @@
+-----BEGIN PGP SIGNATURE-----
+
+iQIzBAABAgAdFiEErj+seWcR7Fn8AHqkdLtrmky7PTgFAl2WMooACgkQdLtrmky7
+PThv2RAAnXNLYTzXtH6ls29tRm5Hc+D6UaeqcWDNQ4BpkRVhrFxtukalGCi9mmB6
+NPJzFyXmaOW654pypCIuEgqJNFUpDtLzLzT7SUF+mhm+5plsaRSBnh4mq87l5KSp
+twODAPnfCJV+HBk5RmToLEstAbGQ7xEBTyQtZoFkY+V7zEFwENKiCvWsoSWOkYR3
+zXo3sKjc83HV9ShbW/mCtbZf5L0qlbrKOAzqJfAFMhNNJi8kMbmr/Zi2sIfN+Rhv
+g8HQo89Epv6r51yAdeED8idIX4rKjjcEtHrZeDmLdCcdHgSEj2sIlH92Joce6vL0
+S59A0rItIXm6fW8sz6WNpcj4tVtWYbIYjXZ4SPFNkaUrHv8cUekq+5vbI+v07Gh3
+2bhtDsDyTY5I1/AsY/EFmwkCAjUS00jZryBnuJpLB3v5JtUog4ek32yLBzPrqRBo
+1876j4nlXAia8mG0OgJNWZ0gHyUPe/TgfR8fQDLmHxHHlKrJNTEwY6bLW8jzFTX1
+zk510fI1K7J9tiQgf5wcBQ2h3EBlqzDNIJDovoATzLYIf0HKyVegh/vnQdtdEhUR
+1DzJAt3bsBfAP1AFfWPD/ACu5Zdm7SxY1wE/pjkwttDU3sRZqOfuwNBGeolu3cVN
+O9/h1zsyVeVS0ui2vu4+V4EvNitmXsVbG2doDq9L5yBiIKGO2Ew=
+=GCy6
+-----END PGP SIGNATURE-----

bind-9.14.7.tar.gz.asc

@@ -0,0 +1,16 @@
+-----BEGIN PGP SIGNATURE-----
+
+iQIzBAABAgAdFiEErj+seWcR7Fn8AHqkdLtrmky7PTgFAl2WMpEACgkQdLtrmky7
+PTh/sg//QbNRAQvADQfwF1PPo+JxB+3WzQ9oJAWeHbOoiubwkUwO9xE+BEnTNd5o
+oM1lSLqFxNykOTaoeJlqPftPod1cxo7lSzkwflugGyB/59wliCpqCg053YV4x9mO
+QggvA/E50+0FI/Om/7v4GHGADu/JE83FovOueWAB0LgqfDSD6QFcNFF9sUJJ4P7r
+FcEXSWj8QbrHMWBKncZUOpD2ECotvtrYmi0DTHl1XfigESDQpWtsnTFuabCCsvkh
+ch9wQRplAes2Mf/aS5tl1y0QKKBFuEjtGiTdgrDl6o9GLnx6CueX5saZehu2EVkr
+fq2vEYUC2lRQSjuxSMMJ3L0TGUcl7+ixlAIISS2K9L5Xx7MhBXt/EH5KiKPfsEet
+3EH+DhxV5uXjDU7MgvREnxT+ssV23e0HWTz4tVVQ9LpvYmWPIgLcSOhHCc57yoQF
+c46V0f69dMWbMAlQ93EZSG274ZvpIszpK8+3hGI3/TuDFFgiQJeJJBFVtYJMle69
+3mEEclfzO7fBiXZFec6nVx2309bL64bafN7zszPKXl4XgoefOfD0v0eWqQT4fxfm
+dnGC0qMqSZs5F+d0fISV5JUUNYzt9PZjvnzqLLGOeTF6l3/n9G1mmNsXcxJ1OEIF
+6qh1oO7JTPjt0MFhKac4QjNQi/Bnp25O3I/PRyWZCbiwXkyvyQU=
+=ZT7s
+-----END PGP SIGNATURE-----

bind-9.21-dual-sign-continue-test.patch

@@ -0,0 +1,115 @@
+From 488d7bfc75f2988c6e461b8677bc0e27e58bd82e Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
+Date: Sat, 1 Nov 2025 12:00:59 +0100
+Subject: [PATCH] Add a system test with one good and one bad algorithm
+
+The case where there would be one supported algorithm and one already
+unsupported (like RSAMD5 or RSASHA1) was missing.
+---
+ bin/tests/system/dnssec/ns2/example.db.in   |  4 +++
+ bin/tests/system/dnssec/ns2/sign.sh         |  2 +-
+ bin/tests/system/dnssec/ns3/named.conf.j2   |  6 ++++
+ bin/tests/system/dnssec/ns3/sign.sh         | 31 +++++++++++++++++++++
+ bin/tests/system/dnssec/tests_validation.py |  8 ++++++
+ 5 files changed, 50 insertions(+), 1 deletion(-)
+
+diff --git a/bin/tests/system/dnssec/ns2/example.db.in b/bin/tests/system/dnssec/ns2/example.db.in
+index 47c2eb7f0e..07429366ee 100644
+--- a/bin/tests/system/dnssec/ns2/example.db.in
++++ b/bin/tests/system/dnssec/ns2/example.db.in
+@@ -202,3 +202,7 @@ ns3.extradsunknownoid	A	10.53.0.3
+ 
+ extended-ds-unknown-oid	NS	ns3.extended-ds-unknown-oid
+ ns3.extended-ds-unknown-oid A	10.53.0.3
++
++; A secure subdomain with extra bad key
++extrabadkey		NS	ns3.extrabadkey
++ns3.extrabadkey		A	10.53.0.3
+diff --git a/bin/tests/system/dnssec/ns2/sign.sh b/bin/tests/system/dnssec/ns2/sign.sh
+index e3f18af15e..da9f5f07fc 100644
+--- a/bin/tests/system/dnssec/ns2/sign.sh
++++ b/bin/tests/system/dnssec/ns2/sign.sh
+@@ -92,7 +92,7 @@ for subdomain in digest-alg-unsupported ds-unsupported secure badds \
+   dnskey-nsec3-unknown managed-future future revkey \
+   dname-at-apex-nsec3 occluded rsasha1 rsasha1-1024 \
+   rsasha256oid rsasha512oid unknownoid extradsoid extradsunknownoid \
+-  extended-ds-unknown-oid; do
++  extended-ds-unknown-oid extrabadkey; do
+   cp "../ns3/dsset-$subdomain.example." .
+ done
+ 
+diff --git a/bin/tests/system/dnssec/ns3/named.conf.j2 b/bin/tests/system/dnssec/ns3/named.conf.j2
+index 1a0edc14bb..9cbc58892c 100644
+--- a/bin/tests/system/dnssec/ns3/named.conf.j2
++++ b/bin/tests/system/dnssec/ns3/named.conf.j2
+@@ -141,6 +141,12 @@ zone "extrakey.example" {
+ 	allow-update { any; };
+ };
+ 
++zone "extrabadkey.example" {
++	type primary;
++	file "extrabadkey.example.db.signed";
++	allow-update { any; };
++};
++
+ zone "insecure.nsec3.example" {
+ 	type primary;
+ 	file "insecure.nsec3.example.db";
+diff --git a/bin/tests/system/dnssec/ns3/sign.sh b/bin/tests/system/dnssec/ns3/sign.sh
+index 5512888b2f..ea81381eb2 100644
+--- a/bin/tests/system/dnssec/ns3/sign.sh
++++ b/bin/tests/system/dnssec/ns3/sign.sh
+@@ -905,3 +905,34 @@ ksk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK "$zone")
+ zsk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
+ cat "$infile" "$ksk.key" "$zsk.key" >"$zonefile"
+ "$SIGNER" -g -o "$zone" "$zonefile" >/dev/null 2>&1
++
++#
++#
++#
++zone=extrabadkey.example.
++infile=template.db.in
++zonefile=extrabadkey.example.db
++
++# Add KSK and ZSK that we will mangle to RSAMD5
++ksk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK "$zone")
++zsk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
++cat "$infile" "$ksk.key" "$zsk.key" >"$zonefile"
++"$SIGNER" -g -O full -o "$zone" "$zonefile" >/dev/null 2>&1
++
++# Mangle the signatures to RSAMD5 and save them for future use
++sed -ne "s/\(IN[[:space:]]*RRSIG[[:space:]]*[A-Z]*\) $DEFAULT_ALGORITHM_NUMBER /\1 1 /p" <"$zonefile.signed" >"$zonefile.signed.rsamd5"
++
++# Now add normal KSK and ZSK to the zone file
++ksk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK "$zone")
++zsk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
++cat "$infile" "$ksk.key" "$zsk.key" >"$zonefile"
++
++# Mangle the DNSKEY algorithm numbers and add them to the signed zone file
++cat "$ksk.key" "$zsk.key" | sed -e "s/\(IN[[:space:]]*DNSKEY[[:space:]]*[0-9]* 3\) $DEFAULT_ALGORITHM_NUMBER /\1 1 /" >>"$zonefile"
++
++# Sign normally
++"$SIGNER" -g -o "$zone" "$zonefile" >/dev/null 2>&1
++
++# Add the mangled signatures to signed zone file
++cat "$zonefile.signed.rsamd5" >>"$zonefile.signed"
++rm "$zonefile.signed.rsamd5"
+diff --git a/bin/tests/system/dnssec/tests_validation.py b/bin/tests/system/dnssec/tests_validation.py
+index e6d8ccc734..a27a899987 100644
+--- a/bin/tests/system/dnssec/tests_validation.py
++++ b/bin/tests/system/dnssec/tests_validation.py
+@@ -1385,3 +1385,11 @@ def test_rrsigs_for_glue():
+         record.rdtype == rdatatype.RRSIG and record.covers == rdatatype.A
+         for record in res.answer
+     )
++
++
++def test_extra_bad_algorithm():
++    msg = isctest.query.create("a.extrabadkey.example", "A")
++    res1 = isctest.query.tcp(msg, "10.53.0.3")
++    res2 = isctest.query.tcp(msg, "10.53.0.4")
++    isctest.check.same_answer(res1, res2)
++    isctest.check.adflag(res2)
+-- 
+2.51.1
+

bind-9.21-dual-sign-continue.patch

@@ -0,0 +1,42 @@
+From a94a7c1a1e6eecbead995a08bace33d23899a5da Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
+Date: Tue, 4 Nov 2025 02:09:38 +0100
+Subject: [PATCH] Skip unsupported algorithms when looking for signing key
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+When looking for a signing key in select_signing_key(), the result code
+indicating unsupported algorithm would abort the search.  Instead, skip
+such keys and continue searching for the right key.
+
+Co-Authored-By: Aram Sargsyan <aram@isc.org>
+Co-Authored-By: Petr Menšík <pemensik@redhat.com>
+---
+ lib/dns/validator.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/lib/dns/validator.c b/lib/dns/validator.c
+index c6781544b9..52677fbd80 100644
+--- a/lib/dns/validator.c
++++ b/lib/dns/validator.c
+@@ -1092,8 +1092,14 @@ select_signing_key(dns_validator_t *val, dns_rdataset_t *rdataset) {
+ 			continue;
+ 		}
+ 
+-		return dns_dnssec_keyfromrdata(&siginfo->signer, &rdata,
+-					       val->view->mctx, &val->key);
++		result = dns_dnssec_keyfromrdata(&siginfo->signer, &rdata,
++						 val->view->mctx, &val->key);
++		/* Don't count unsupported algorithm towards max fails */
++		if (result == DST_R_UNSUPPORTEDALG) {
++			/* Continue with the next key */
++			continue;
++		}
++		return result;
+ 	}
+ 
+ 	return ISC_R_NOTFOUND;
+-- 
+2.51.1
+

bind-9.21-unittest-32b-mem.patch

@@ -1,112 +0,0 @@
-From 4623873e588c86c6add4d53708e754e2d6f3e087 Mon Sep 17 00:00:00 2001
-From: Michal Nowak <mnowak@isc.org>
-Date: Wed, 20 May 2026 08:59:49 +0000
-Subject: [PATCH] Make deleg cleanuptests memory assertions 32-bit-safe
-
-Each address entry stored by dns_delegset_addaddr() is an
-isc_netaddrlink_t, whose size depends on sizeof(void *) via the
-ISC_LINK macro (24 bytes of address + two prev/next pointers): 40
-bytes on 64-bit, 32 bytes on 32-bit. The hardcoded 4 MB / 8 MB
-ranges only held on 64-bit, so dns_deleg_cleanuptests failed on
-armv7l with isc_mem_inuse() returning ~3.2 MB.
-
-Express the expected ranges in terms of sizeof(isc_netaddrlink_t)
-so they scale with pointer width, and pull the 99999 entry count
-out into a NENTRIES macro.
-
-Assisted-by: Claude:claude-opus-4-7
----
- tests/dns/deleg_test.c | 30 ++++++++++++++++++++++--------
- 1 file changed, 22 insertions(+), 8 deletions(-)
-
-diff --git a/tests/dns/deleg_test.c b/tests/dns/deleg_test.c
-index d3af6aba966..9497caf2753 100644
---- a/tests/dns/deleg_test.c
-+++ b/tests/dns/deleg_test.c
-@@ -52,6 +52,15 @@ isc_stdtime_now(void) {
- 
- #include <tests/isc.h>
- 
-+/*
-+ * cleanuptests adds NENTRIES address entries to a delegset; each is an
-+ * isc_netaddrlink_t whose size depends on sizeof(void *) via ISC_LINK.
-+ * Express memory expectations in terms of that struct so the test works
-+ * on both 32-bit and 64-bit targets.
-+ */
-+#define NENTRIES       99999
-+#define ENTRIES_MEM(n) ((size_t)(n) * sizeof(isc_netaddrlink_t))
-+
- static void
- shutdownloop(ISC_ATTR_UNUSED void *arg) {
- 	isc_loopmgr_shutdown();
-@@ -587,7 +596,8 @@ cleanuptests_phase3(void *arg) {
- 	dns_delegset_t *delegset = NULL;
- 	isc_result_t result;
- 
--	assert_int_in_range(isc_mem_inuse(db->mctx), 8000000, 8100000);
-+	assert_int_in_range(isc_mem_inuse(db->mctx), ENTRIES_MEM(2 * NENTRIES),
-+			    ENTRIES_MEM(2 * NENTRIES) + 100000);
- 
- 	/*
- 	 * baz. is there, but bar. is gone, as it has been
-@@ -612,7 +622,8 @@ cleanuptests_phase2(void *arg) {
- 	dns_delegset_t *delegset = NULL;
- 	isc_result_t result;
- 
--	assert_int_in_range(isc_mem_inuse(db->mctx), 4000000, 4100000);
-+	assert_int_in_range(isc_mem_inuse(db->mctx), ENTRIES_MEM(NENTRIES),
-+			    ENTRIES_MEM(NENTRIES) + 100000);
- 
- 	/*
- 	 * bar. is there
-@@ -629,10 +640,11 @@ cleanuptests_phase2(void *arg) {
- 	dns_delegset_allocdeleg(delegset, DNS_DELEGTYPE_DELEG_ADDRESSES,
- 				&deleg);
- 
--	for (size_t i = 0; i < 99999; i++) {
-+	for (size_t i = 0; i < NENTRIES; i++) {
- 		addipdeleg(AF_INET6, "1111::2222", delegset, deleg);
- 	}
--	assert_int_in_range(isc_mem_inuse(db->mctx), 8000000, 8100000);
-+	assert_int_in_range(isc_mem_inuse(db->mctx), ENTRIES_MEM(2 * NENTRIES),
-+			    ENTRIES_MEM(2 * NENTRIES) + 100000);
- 	writedb(db, "baz.", 30, &delegset, true);
- 	deleg = NULL;
- 
-@@ -677,11 +689,12 @@ cleanuptests(ISC_ATTR_UNUSED void *arg) {
- 
- 	assert_int_in_range(isc_mem_inuse(db->mctx), 500, 2000);
- 
--	for (size_t i = 0; i < 99999; i++) {
-+	for (size_t i = 0; i < NENTRIES; i++) {
- 		addipdeleg(AF_INET6, "1111::2222", delegset, deleg);
- 	}
- 
--	assert_int_in_range(isc_mem_inuse(db->mctx), 4000000, 4100000);
-+	assert_int_in_range(isc_mem_inuse(db->mctx), ENTRIES_MEM(NENTRIES),
-+			    ENTRIES_MEM(NENTRIES) + 100000);
- 
- 	writedb(db, "stuff.", 10, &delegset, true);
- 	deleg = NULL;
-@@ -694,7 +707,7 @@ cleanuptests(ISC_ATTR_UNUSED void *arg) {
- 	dns_delegset_allocdeleg(delegset, DNS_DELEGTYPE_DELEG_ADDRESSES,
- 				&deleg);
- 
--	for (size_t i = 0; i < 99999; i++) {
-+	for (size_t i = 0; i < NENTRIES; i++) {
- 		addipdeleg(AF_INET6, "1111::2222", delegset, deleg);
- 	}
- 
-@@ -703,7 +716,8 @@ cleanuptests(ISC_ATTR_UNUSED void *arg) {
- 	 * with DB mem context) overmem conditions will be detected, and the
- 	 * expired node will be removed
- 	 */
--	assert_int_in_range(isc_mem_inuse(db->mctx), 8000000, 8100000);
-+	assert_int_in_range(isc_mem_inuse(db->mctx), ENTRIES_MEM(2 * NENTRIES),
-+			    ENTRIES_MEM(2 * NENTRIES) + 100000);
- 	writedb(db, "bar.", 30, &delegset, true);
- 	deleg = NULL;
- 
--- 
-2.54.0
-

bind-9.21-unittest-isc_rwlock-s390x.patch

@@ -0,0 +1,29 @@
+From b8bc86834311e4ea27fe75052db08279045f027b Mon Sep 17 00:00:00 2001
+From: Petr Mensik <pemensik@redhat.com>
+Date: Wed, 20 Nov 2024 15:34:29 +0100
+Subject: [PATCH] Skip isc_rwlock_benchmark on s390x
+
+Not sure why, but it repeatedly failed on isc_rwlock_benchmark function.
+Not sure if it requires more time only or there is some strange error.
+---
+ tests/isc/rwlock_test.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/tests/isc/rwlock_test.c b/tests/isc/rwlock_test.c
+index 4c5b8e0..a28b7d9 100644
+--- a/tests/isc/rwlock_test.c
++++ b/tests/isc/rwlock_test.c
+@@ -340,7 +340,10 @@ ISC_TEST_ENTRY_CUSTOM(isc_rwlock_wrlock, rwlock_setup, rwlock_teardown)
+ #if !defined(__SANITIZE_THREAD__)
+ ISC_TEST_ENTRY_CUSTOM(isc_rwlock_tryupgrade, rwlock_setup, rwlock_teardown)
+ ISC_TEST_ENTRY_CUSTOM(isc_rwlock_trylock, rwlock_setup, rwlock_teardown)
++#ifndef __s390x__
++// TODO: find why this stucks.
+ ISC_TEST_ENTRY_CUSTOM(isc_rwlock_benchmark, rwlock_setup, rwlock_teardown)
++#endif
+ #endif /* __SANITIZE_THREAD__ */
+ 
+ ISC_TEST_LIST_END
+-- 
+2.47.0
+

bind9-next.spec

@@ -17,6 +17,7 @@
 # Do not set CI environment, include more unit tests, even less stable
 %bcond_with    UNITTEST_ALL
 %bcond_without DNSTAP
+%bcond_without LMDB
 %bcond_without DOC
 %bcond_with    TSAN
 %bcond_without DTRACE
@@ -41,6 +42,9 @@
 # Visit https://bugzilla.redhat.com/show_bug.cgi?id=1540300
 %undefine _strict_symbol_defs_build
 
+# BIND9 does not work with fortify 3 level, make builds work on Fedora
+%global _fortify_level 2
+
 # Upstream package name
 %global upname bind
 # Provide only bind-utils on f37+, it has better behaviour
@@ -54,7 +58,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind9-next
 License:  MPL-2.0 AND ISC AND BSD-3-clause AND MIT AND BSD-2-clause
 #
-Version:  9.21.22
+Version:  9.21.20
 Release:  %autorelease
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
@@ -77,6 +81,7 @@ Source37: named.service
 Source38: named-chroot.service
 Source41: setup-named-chroot.sh
 Source42: generate-rndc-key.sh
+Source43: named.rwtab
 Source44: named-chroot-setup.service
 Source46: named-setup-rndc.service
 Source48: setup-named-softhsm.sh
@@ -85,11 +90,11 @@ Source49: named-chroot.files
 # Common patches
 # Red Hat specific documentation is not relevant to upstream
 Patch1: bind-9.16-redhat_doc.patch
+# Downstream only. TODO: find a cause and remove this workaround
+Patch3: bind-9.21-unittest-isc_rwlock-s390x.patch
 # https://gitlab.isc.org/isc-projects/bind9/-/issues/5328
 # avoid often fails on i386, unsupported upstream
 Patch4: bind-9.21-unittest-qpdb-i386.patch
-# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/12061
-Patch5: bind-9.21-unittest-32b-mem.patch
 
 %{?systemd_ordering}
 Requires:       coreutils
@@ -107,36 +112,35 @@ BuildRequires:  gcc
 BuildRequires:  make
 BuildRequires:  openssl-devel
 BuildRequires:  libtool
-BuildRequires:  meson >= 1.3.0
+BuildRequires:  meson
 BuildRequires:  ninja-build
 BuildRequires:  pkgconfig
-BuildRequires:  pkgconfig(libcap)
-BuildRequires:  pkgconfig(libidn2)
-BuildRequires:  pkgconfig(libxml-2.0)
+BuildRequires:  libcap-devel
+BuildRequires:  libidn2-devel
+BuildRequires:  libxml2-devel
 BuildRequires:  systemd-rpm-macros
 BuildRequires:  selinux-policy
 BuildRequires:  findutils
 BuildRequires:  sed
-BuildRequires:  pkgconfig(libnghttp2)
-BuildRequires:  pkgconfig(liburcu)
+BuildRequires:  libnghttp2-devel
+BuildRequires:  userspace-rcu-devel
 BuildRequires:  pkgconfig(libedit)
 BuildRequires:  dns-root-data
 # Compress the changelog
 BuildRequires:  gzip
-BuildRequires:  pkgconfig(lmdb)
 %if %{with JEMALLOC}
-BuildRequires:  pkgconfig(jemalloc)
+BuildRequires:  jemalloc-devel
 %endif
 %if ! 0%{?rhel}
 BuildRequires:  gpgverify
 %endif
-BuildRequires:  pkgconfig(libuv)
+BuildRequires:  libuv-devel
 %if %{with OPENSSL_ENGINE}
 BuildRequires:  openssl-devel-engine
 %endif
 %if %{with UNITTEST}
 # make unit dependencies
-BuildRequires:  pkgconfig(cmocka)
+BuildRequires:  libcmocka-devel
 # Ensure we have lscpu
 BuildRequires:  util-linux
 # Catch failing unittests coredumps
@@ -153,11 +157,9 @@ BuildRequires:  perl(English)
 BuildRequires:  python3-pytest
 BuildRequires:  python3-pytest-xdist
 BuildRequires:  python3-dns
-BuildRequires:  python3-hypothesis
 # manual configuration requires this tool
 BuildRequires:  iproute
 BuildRequires:  python3-jinja2
-BuildRequires:  lmdb-devel
 %if %{with SUDO}
 BuildRequires:  libcap sudo
 %endif
@@ -165,6 +167,9 @@ BuildRequires:  libcap sudo
 %if %{with GSSTSIG}
 BuildRequires:  krb5-devel
 %endif
+%if %{with LMDB}
+BuildRequires:  lmdb-devel
+%endif
 %if %{with JSON}
 BuildRequires:  json-c-devel
 %endif
@@ -199,7 +204,7 @@ tools for verifying that the DNS server is operating properly.
 %package libs
 Summary: Libraries used by the BIND DNS packages
 Provides: %{name}-license = %{epoch}:%{version}-%{release}
-Obsoletes: %{name}-license < 32:9.21.11-5
+Obsoletes: %{name}-license < 32:9.21.17-1
 Provides: %{name}-libs-lite = %{epoch}:%{version}-%{release}
 Obsoletes: %{name}-libs-lite < 32:9.16.13
 Obsoletes: %{name}-pkcs11-libs < 32:9.18.4-2
@@ -247,14 +252,15 @@ Summary:  Header files and libraries needed for bind-dyndb-ldap
 Provides: %{name}-lite-devel = %{epoch}:%{version}-%{release}
 Obsoletes: %{name}-lite-devel < 32:9.16.6-3
 Requires: %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release}
-Requires: openssl-devel%{?_isa}
-Requires: libxml2-devel%{?_isa}
+Requires: openssl-devel%{?_isa} libxml2-devel%{?_isa}
 Requires: libcap-devel%{?_isa}
-Requires: lmdb-devel%{?_isa}
 %upname_compat %{upname}-devel
 %if %{with GSSTSIG}
 Requires: krb5-devel%{?_isa}
 %endif
+%if %{with LMDB}
+Requires: lmdb-devel%{?_isa}
+%endif
 %if %{with JSON}
 Requires:  json-c-devel%{?_isa}
 %endif
@@ -368,6 +374,11 @@ export LIBDIR_SUFFIX
 %if %{with GSSTSIG}
   -Dgssapi=enabled \
 %endif
+%if %{with LMDB}
+  -Dlmdb=enabled \
+%else
+  -Dlmdb=disabled \
+%endif
 %if %{with JSON}
   -Dstats-json=enabled \
 %endif
@@ -407,11 +418,6 @@ gzip doc/changelog/changelog-*.rst
 #systemtest_prepare_build build
 
 %check
-# reduce test loops (from default 100) for isc/{mutex/spinlock/rwlock}
-# to allow rwlock(isc_rwlock_benchmark) to finish within the 300 seconds
-# timeout limit on platforms (riscv64,s390x) where it is slow
-# TODO: find out why it is slow
-export ISC_BENCHMARK_LOOPS=20
 %if %{with UNITTEST} || %{with SYSTEMTEST}
   # Tests require initialization of pkcs11 token
   eval "$(bash %{SOURCE48} -A "`pwd`/softhsm-tokens")"
@@ -435,7 +441,6 @@ LD_LIBRARY_PATH="$LD_LIBRARY_PATH:${RPM_BUILD_ROOT}%{_libdir}" \
   if [ "$CPUS" -gt 16 ]; then
     ORIGFILES=$(ulimit -n)
     THREADS=16
-    # https://gitlab.isc.org/isc-projects/bind9/-/issues/5328
     export ISC_TASK_WORKERS="$THREADS"
     ulimit -n 8092 || : # Requires on some machines with many cores
   fi
@@ -555,6 +560,9 @@ find ${RPM_BUILD_ROOT}/%{_libdir} -name '*.la' -exec '/bin/rm' '-f' '{}' ';';
 %if %{without DNSTAP}
 rm -f ${RPM_BUILD_ROOT}%{_mandir}/man1/dnstap-read.1* || true
 %endif
+%if %{without LMDB}
+rm -f ${RPM_BUILD_ROOT}%{_mandir}/man8/named-nzd2nzf.8* || true
+%endif
 
 pushd ${RPM_BUILD_ROOT}%{_mandir}/man8
 ln -s ddns-confgen.8.gz tsig-keygen.8.gz
@@ -621,6 +629,9 @@ done
 mkdir -p ${RPM_BUILD_ROOT}%{_tmpfilesdir}
 install -m 644 %{SOURCE35} ${RPM_BUILD_ROOT}%{_tmpfilesdir}/named.conf
 
+mkdir -p ${RPM_BUILD_ROOT}%{_sysconfdir}/rwtab.d
+install -m 644 %{SOURCE43} ${RPM_BUILD_ROOT}%{_sysconfdir}/rwtab.d/named
+
 install -m0644 -D bind9-next.sysusers.conf %{buildroot}%{_sysusersdir}/bind9-next.conf
 
 %post
@@ -721,6 +732,7 @@ fi;
 %config(noreplace) %{_sysconfdir}/logrotate.d/named
 %{_tmpfilesdir}/named.conf
 %{_sysusersdir}/bind9-next.conf
+%{_sysconfdir}/rwtab.d/named
 %{_unitdir}/named.service
 %{_unitdir}/named-setup-rndc.service
 %{_bindir}/named-journalprint
@@ -804,8 +816,10 @@ fi;
 %{_bindir}/dnstap-read
 %{_mandir}/man1/dnstap-read.1*
 %endif
+%if %{with LMDB}
 %{_bindir}/named-nzd2nzf
 %{_mandir}/man1/named-nzd2nzf.1*
+%endif
 %{_mandir}/man1/host.1*
 %{_mandir}/man1/nsupdate.1*
 %{_mandir}/man1/dig.1*

bind97-exportlib.patch

@@ -0,0 +1,226 @@
+diff -up bind-9.9.3rc2/isc-config.sh.in.exportlib bind-9.9.3rc2/isc-config.sh.in
+diff -up bind-9.9.3rc2/lib/export/dns/Makefile.in.exportlib bind-9.9.3rc2/lib/export/dns/Makefile.in
+--- bind-9.9.3rc2/lib/export/dns/Makefile.in.exportlib	2013-04-30 08:38:46.000000000 +0200
++++ bind-9.9.3rc2/lib/export/dns/Makefile.in	2013-05-13 10:45:22.574089729 +0200
+@@ -35,9 +35,9 @@ CDEFINES =	-DUSE_MD5 @USE_OPENSSL@ @USE_
+ 
+ CWARNINGS =
+ 
+-ISCLIBS =	../isc/libisc.@A@
++ISCLIBS =	../isc/libisc-export.@A@
+ 
+-ISCDEPLIBS =	../isc/libisc.@A@
++ISCDEPLIBS =	../isc/libisc-export.@A@
+ 
+ LIBS =		@LIBS@
+ 
+@@ -116,29 +116,29 @@ version.@O@: ${srcdir}/version.c
+ 		-DLIBAGE=${LIBAGE} \
+ 		-c ${srcdir}/version.c
+ 
+-libdns.@SA@: ${OBJS}
++libdns-export.@SA@: ${OBJS}
+ 	${AR} ${ARFLAGS} $@ ${OBJS}
+ 	${RANLIB} $@
+ 
+-libdns.la: ${OBJS}
++libdns-export.la: ${OBJS}
+ 	${LIBTOOL_MODE_LINK} \
+-		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libdns.la \
++		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libdns-export.la \
+ 		-rpath ${export_libdir} \
+ 		-version-info ${LIBINTERFACE}:${LIBREVISION}:${LIBAGE} \
+ 		${OBJS} ${ISCLIBS} @DNS_CRYPTO_LIBS@ ${LIBS}
+ 
+-timestamp: libdns.@A@
++timestamp: libdns-export.@A@
+ 	touch timestamp
+ 
+ installdirs:
+ 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${export_libdir}
+ 
+ install:: timestamp installdirs
+-	${LIBTOOL_MODE_INSTALL} ${INSTALL_DATA} libdns.@A@ \
++	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} libdns-export.@A@ \
+ 	${DESTDIR}${export_libdir}/
+ 
+ clean distclean::
+-	rm -f libdns.@A@ timestamp
++	rm -f libdns-export.@A@ timestamp
+ 	rm -f gen code.h include/dns/enumtype.h include/dns/enumclass.h
+ 	rm -f include/dns/rdatastruct.h
+ 
+diff -up bind-9.9.3rc2/lib/export/irs/Makefile.in.exportlib bind-9.9.3rc2/lib/export/irs/Makefile.in
+--- bind-9.9.3rc2/lib/export/irs/Makefile.in.exportlib	2013-04-30 08:38:46.000000000 +0200
++++ bind-9.9.3rc2/lib/export/irs/Makefile.in	2013-05-13 10:45:22.575089729 +0200
+@@ -43,9 +43,9 @@ SRCS =		context.c \
+ 		gai_sterror.c getaddrinfo.c getnameinfo.c \
+ 		resconf.c
+ 
+-ISCLIBS =	../isc/libisc.@A@
+-DNSLIBS =	../dns/libdns.@A@
+-ISCCFGLIBS =	../isccfg/libisccfg.@A@
++ISCLIBS =	../isc/libisc-export.@A@
++DNSLIBS =	../dns/libdns-export.@A@
++ISCCFGLIBS =	../isccfg/libisccfg-export.@A@
+ 
+ LIBS =		@LIBS@
+ 
+@@ -62,26 +62,26 @@ version.@O@: ${srcdir}/version.c
+ 		-DLIBAGE=${LIBAGE} \
+ 		-c ${srcdir}/version.c
+ 
+-libirs.@SA@: ${OBJS} version.@O@
++libirs-export.@SA@: ${OBJS} version.@O@
+ 	${AR} ${ARFLAGS} $@ ${OBJS} version.@O@
+ 	${RANLIB} $@
+ 
+-libirs.la: ${OBJS} version.@O@
++libirs-export.la: ${OBJS} version.@O@
+ 	${LIBTOOL_MODE_LINK} \
+-		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libirs.la \
++		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libirs-export.la \
+ 		-rpath ${export_libdir} \
+ 		-version-info ${LIBINTERFACE}:${LIBREVISION}:${LIBAGE} \
+ 		${OBJS} version.@O@ ${LIBS} ${ISCCFGLIBS} ${DNSLIBS} ${ISCLIBS}
+ 
+-timestamp: libirs.@A@
++timestamp: libirs-export.@A@
+ 	touch timestamp
+ 
+ installdirs:
+ 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${export_libdir}
+ 
+ install:: timestamp installdirs
+-	${LIBTOOL_MODE_INSTALL} ${INSTALL_DATA} libirs.@A@ \
++	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} libirs-export.@A@ \
+ 	${DESTDIR}${export_libdir}/
+ 
+ clean distclean::
+-	rm -f libirs.@A@ libirs.la timestamp
++	rm -f libirs-export.@A@ libirs-export.la timestamp
+diff -up bind-9.9.3rc2/lib/export/isccfg/Makefile.in.exportlib bind-9.9.3rc2/lib/export/isccfg/Makefile.in
+--- bind-9.9.3rc2/lib/export/isccfg/Makefile.in.exportlib	2013-04-30 08:38:46.000000000 +0200
++++ bind-9.9.3rc2/lib/export/isccfg/Makefile.in	2013-05-13 10:45:22.576089729 +0200
+@@ -30,11 +30,11 @@ CINCLUDES =	-I. ${DNS_INCLUDES} -I${expo
+ CDEFINES =
+ CWARNINGS =
+ 
+-ISCLIBS =	../isc/libisc.@A@
+-DNSLIBS =	../dns/libdns.@A@ @DNS_CRYPTO_LIBS@
++ISCLIBS =	../isc/libisc-export.@A@
++DNSLIBS =	../dns/libdns-export.@A@ @DNS_CRYPTO_LIBS@
+ 
+ ISCDEPLIBS =	../../lib/isc/libisc.@A@
+-ISCCFGDEPLIBS =	libisccfg.@A@
++ISCCFGDEPLIBS =	libisccfg-export.@A@
+ 
+ LIBS =		@LIBS@
+ 
+@@ -58,26 +58,26 @@ version.@O@: ${srcdir}/version.c
+ 		-DLIBAGE=${LIBAGE} \
+ 		-c ${srcdir}/version.c
+ 
+-libisccfg.@SA@: ${OBJS}
++libisccfg-export.@SA@: ${OBJS}
+ 	${AR} ${ARFLAGS} $@ ${OBJS}
+ 	${RANLIB} $@
+ 
+-libisccfg.la: ${OBJS}
++libisccfg-export.la: ${OBJS}
+ 	 ${LIBTOOL_MODE_LINK} \
+-		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libisccfg.la \
++		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libisccfg-export.la \
+ 		-rpath ${export_libdir} \
+ 		-version-info ${LIBINTERFACE}:${LIBREVISION}:${LIBAGE} \
+ 		${OBJS} ${LIBS} ${DNSLIBS} ${ISCLIBS}
+ 
+-timestamp: libisccfg.@A@
++timestamp: libisccfg-export.@A@
+ 	touch timestamp
+ 
+ installdirs:
+ 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${export_libdir}
+ 
+ install:: timestamp installdirs
+-	${LIBTOOL_MODE_INSTALL} ${INSTALL_DATA} libisccfg.@A@ \
++	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} libisccfg-export.@A@ \
+ 	${DESTDIR}${export_libdir}/
+ 
+ clean distclean::
+-	rm -f libisccfg.@A@ timestamp
++	rm -f libisccfg-export.@A@ timestamp
+diff -up bind-9.9.3rc2/lib/export/isc/Makefile.in.exportlib bind-9.9.3rc2/lib/export/isc/Makefile.in
+--- bind-9.9.3rc2/lib/export/isc/Makefile.in.exportlib	2013-04-30 08:38:46.000000000 +0200
++++ bind-9.9.3rc2/lib/export/isc/Makefile.in	2013-05-13 10:45:22.576089729 +0200
+@@ -100,6 +100,10 @@ SRCS =		@ISC_EXTRA_SRCS@ \
+ 
+ LIBS =		@LIBS@
+ 
++# Note: the order of SUBDIRS is important.
++# Attempt to disable parallel processing.
++.NOTPARALLEL:
++.NO_PARALLEL:
+ SUBDIRS =	include unix nls @ISC_THREAD_DIR@
+ TARGETS =	timestamp
+ 
+@@ -113,26 +117,26 @@ version.@O@: ${srcdir}/version.c
+ 		-DLIBAGE=${LIBAGE} \
+ 		-c ${srcdir}/version.c
+ 
+-libisc.@SA@: ${OBJS}
++libisc-export.@SA@: ${OBJS}
+ 	${AR} ${ARFLAGS} $@ ${OBJS}
+ 	${RANLIB} $@
+ 
+-libisc.la: ${OBJS}
++libisc-export.la: ${OBJS}
+ 	${LIBTOOL_MODE_LINK} \
+-		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libisc.la \
++		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libisc-export.la \
+ 		-rpath ${export_libdir} \
+ 		-version-info ${LIBINTERFACE}:${LIBREVISION}:${LIBAGE} \
+ 		${OBJS} ${LIBS}
+ 
+-timestamp: libisc.@A@
++timestamp: libisc-export.@A@
+ 	touch timestamp
+ 
+ installdirs:
+ 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${export_libdir}
+ 
+ install:: timestamp installdirs
+-	${LIBTOOL_MODE_INSTALL} ${INSTALL_DATA} libisc.@A@ \
++	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} libisc-export.@A@ \
+ 	${DESTDIR}${export_libdir}
+ 
+ clean distclean::
+-	rm -f libisc.@A@ libisc.la timestamp
++	rm -f libisc-export.@A@ libisc-export.la timestamp
+diff -up bind-9.9.3rc2/lib/export/samples/Makefile.in.exportlib bind-9.9.3rc2/lib/export/samples/Makefile.in
+--- bind-9.9.3rc2/lib/export/samples/Makefile.in.exportlib	2013-04-30 08:38:46.000000000 +0200
++++ bind-9.9.3rc2/lib/export/samples/Makefile.in	2013-05-13 10:45:22.577089729 +0200
+@@ -31,15 +31,15 @@ CINCLUDES =	-I${srcdir}/include -I../dns
+ CDEFINES =
+ CWARNINGS =
+ 
+-DNSLIBS =	../dns/libdns.@A@ @DNS_CRYPTO_LIBS@
+-ISCLIBS =	../isc/libisc.@A@
+-ISCCFGLIBS =	../isccfg/libisccfg.@A@
+-IRSLIBS =	../irs/libirs.@A@
++DNSLIBS =	../dns/libdns-export.@A@ @DNS_CRYPTO_LIBS@
++ISCLIBS =	../isc/libisc-export.@A@
++ISCCFGLIBS =	../isccfg/libisccfg-export.@A@
++IRSLIBS =	../irs/libirs-export.@A@
+ 
+-DNSDEPLIBS =	../dns/libdns.@A@
+-ISCDEPLIBS =	../isc/libisc.@A@
+-ISCCFGDEPLIBS =	../isccfg/libisccfg.@A@
+-IRSDEPLIBS =	../irs/libirs.@A@
++DNSDEPLIBS =	../dns/libdns-export.@A@
++ISCDEPLIBS =	../isc/libisc-export.@A@
++ISCCFGDEPLIBS =	../isccfg/libisccfg-export.@A@
++IRSDEPLIBS =	../irs/libirs-export.@A@
+ 
+ DEPLIBS =	${DNSDEPLIBS} ${ISCCFGDEPLIBS} ${ISCDEPLIBS}
+ 

named.conf.sample

@@ -1,11 +1,11 @@
-# vim: ft=named:
 /*
  Sample named.conf BIND DNS server 'named' configuration file
  for the Red Hat BIND distribution.
 
  See the BIND Administrator's Reference Manual (ARM) for details, in:
-   file:///usr/share/doc/bind/html/index.html
- Or on upstream site: https://bind9.readthedocs.org/
+   file:///usr/share/doc/bind-{version}/arm/Bv9ARM.html
+ Also see the BIND Configuration GUI : /usr/bin/system-config-bind and 
+ its manual.
 */
 
 options
@@ -47,7 +47,6 @@ options
 
 	allow-query		{ localhost; };
 	allow-query-cache	{ localhost; };
-	allow-transfer		{ localhost; };
 
 	/* Enable/disable recursion - recursion yes/no;
 
@@ -65,7 +64,7 @@ options
 	/* DNSSEC related options. See information about keys ("Trusted keys", bellow) */
 
 	/* Enable DNSSEC validation on recursive servers */
-	dnssec-validation auto;
+	dnssec-validation yes;
 
 	/* In Fedora we use /run/named instead of default /var/run/named
 	   so we have to configure paths properly. */
@@ -166,7 +165,7 @@ view "internal"
 	zone "my.slave.internal.zone" {
 		type secondary;
 		file "slaves/my.slave.internal.zone.db";
-		primaries { /* put master nameserver IPs here */ 127.0.0.1; } ;
+		masters { /* put master nameserver IPs here */ 127.0.0.1; } ;
 		// put slave zones in the slaves/ directory so named can update them
 	};	
 	zone "my.ddns.internal.zone" {
@@ -180,8 +179,7 @@ view "internal"
 key ddns_key
 {
 	algorithm hmac-sha256;
-	#secret "use /usr/sbin/ddns-confgen to generate TSIG keys";
-	secret "dXNlIC91c3Ivc2Jpbi9kZG5zLWNvbmZnZW4gdG8gZ2VuZXJhdGUgVFNJRyBrZXlz";
+	secret "use /usr/sbin/ddns-confgen to generate TSIG keys";
 };
 
 view "external"
@@ -214,13 +212,19 @@ view "external"
   This statement contains DNSSEC keys. If you want DNSSEC aware resolver you
   should configure at least one trusted key.
 
-  Note that no key written below is valid. Especially root key is maintained in
-  /etc/named.root.key file.
+  Note that no key written below is valid. Especially root key because root zone
+  is not signed yet.
 */
 /*
 trust-anchors {
 // Root Key
-. initial-ds 38696 8 2 "683D2D0ACB8C9B712A1948B27F741219298D0A450D612C483AF444A4C0FB2B16";
+. initial-key 257 3 8 "AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3
+		      +/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kv
+		      ArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF
+		      0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+e
+		      oZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfd
+		      RUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwN
+		      R1AkUTV74bU=";
 
 // Key for forward zone
 example.com. static-key 257 3 8 "AwEAAZ0aqu1rJ6orJynrRfNpPmayJZoAx9Ic2/Rl9VQW
@@ -234,6 +238,6 @@ example.com. static-key 257 3 8 "AwEAAZ0aqu1rJ6orJynrRfNpPmayJZoAx9Ic2/Rl9VQW
 
 
 // Key for reverse zone.
-2.0.192.IN-ADDRPA.NET. static-ds 31406 8 2 "F78CF3344F72137235098ECBBD08947C2C9001C7F6A085A17F518B5D8F6B916D";
+2.0.192.IN-ADDRPA.NET. initial-ds 31406 8 2 "F78CF3344F72137235098ECBBD08947C2C9001C7F6A085A17F518B5D8F6B916D";
 };
 */

named.rwtab

@@ -0,0 +1,6 @@
+dirs    /var/named
+
+files	/var/named/named.ca
+files	/var/named/named.empty
+files	/var/named/named.localhost
+files	/var/named/named.loopback

sources

@@ -1,2 +1,2 @@
-SHA512 (bind-9.21.22.tar.xz) = f9e11d150162661c755dabdd7862c0565e6a10077e2a6aee04f8cefce94c262d8928ff9e42f8c8750242aee3b0992afe2f49f72f0f8cab8b7e4ae1c9fc06e0fa
-SHA512 (bind-9.21.22.tar.xz.asc) = 1e0bd14fad5754e12b6a4855dbed698dba74468790948316e17442e5bc840fc81d18e590fd78186a1e26e9526870b13470dcef6a15644e91775cc8883813ad24
+SHA512 (bind-9.21.20.tar.xz) = 4bd65612ff851720eba7f88495d51eb8a41b6a946c377b9dcd62f58f8c5a3e9338af44abc9df76b2ead9461eca4eb81f088619e3cc481f35fa0fc5d0926a93e3
+SHA512 (bind-9.21.20.tar.xz.asc) = 7431540d942fe23222b2812f9d80e67d0fa38516f9d536095a6544b156dc0306aba5752ba6c03cc2935d92a74860e70e8fc53b4cb481b8afe226e49dd51f695f