From eb1fe5d710387ecd66ce004d4b706b418402dd58 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
Date: Thu, 12 Dec 2024 21:25:14 +0100
Subject: [PATCH] Add new root key 38696 into package files

Add KSK 2024 into bind package files too.

Resolves: RHEL-131888
---
 bind9.16.spec   | 5 ++++-
 named.root.key  | 5 +++++
 trusted-key.key | 1 +
 3 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/bind9.16.spec b/bind9.16.spec
index c74211e..7945c91 100644
--- a/bind9.16.spec
+++ b/bind9.16.spec
@@ -62,7 +62,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind9.16
 License:  MPLv2.0
 Version:  9.16.23
-Release:  0.22%{?dist}.12
+Release:  0.22%{?dist}.13
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@@ -1297,6 +1297,9 @@ fi;
 %endif
 
 %changelog
+* Wed Sep 02 2026 Petr Menšík <pemensik@redhat.com> - 32:9.16.23-0.22.13
+- Add new root key 38696 into package files (RHEL-131888)
+
 * Thu Jul 23 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 32:9.16.23-0.22.12
 - Fix NSEC3 signer validation (CVE-2026-10723)
 - Resolves: RHEL-213499
diff --git a/named.root.key b/named.root.key
index fbcb5d3..b57e61d 100644
--- a/named.root.key
+++ b/named.root.key
@@ -10,4 +10,9 @@ trust-anchors {
         # managed key database will be trusted and maintained
         # automatically.
         . initial-ds 20326 8 2 "E06D44B80B8F1D39A95C0B0D7C65D08458E880409BBC683457104237C7F8EC8D";
+        # This key (38696) will be pre-published in the root zone in 2025
+        # and is scheduled to begin signing in late 2026. At that time,
+        # servers which were already using the old key (20326) should roll
+        # seamlessly to this new one via RFC 5011 rollover.
+        . initial-ds 38696 8 2 "683D2D0ACB8C9B712A1948B27F741219298D0A450D612C483AF444A4C0FB2B16";
 };
diff --git a/trusted-key.key b/trusted-key.key
index 7b845f3..2ef50c7 100644
--- a/trusted-key.key
+++ b/trusted-key.key
@@ -1 +1,2 @@
 . 3600 IN DNSKEY 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU=
+. 3600 IN DNSKEY 257 3 8 AwEAAa96jeuknZlaeSrvyAJj6ZHv28hhOKkx3rLGXVaC6rXTsDc449/cidltpkyGwCJNnOAlFNKF2jBosZBU5eeHspaQWOmOElZsjICMQMC3aeHbGiShvZsx4wMYSjH8e7Vrhbu6irwCzVBApESjbUdpWWmEnhathWu1jo+siFUiRAAxm9qyJNg/wOZqqzL/dL/q8PkcRU5oUKEpUge71M3ej2/7CPqpdVwuMoTvoB+ZOT4YeGyxMvHmbrxlFzGOHOijtzN+u1TQNatX2XBuzZNQ1K+s2CXkPIZo7s6JgZyvaBevYtxPvYLw4z9mR7K2vaF18UYH9Z9GNUUeayffKC73PYc=