import CS bind9.18-9.18.29-16.el9

import CS bind9.18-9.18.29-13.el9
import CS bind9.18-9.18.29-4.el9_6
2026-08-24 08:53:40 -04:00 · 2026-03-30 10:16:22 -04:00 · 2025-09-15 11:35:28 +00:00 · 2025-03-11 07:02:01 +00:00 · 2024-09-30 16:52:48 +00:00
66 changed files with 8354 additions and 1486 deletions
--- a/.bind9.18.metadata
+++ b/.bind9.18.metadata
@ -0,0 +1 @@
+33ff5a86e56d65859358749654ea848809bd4532 SOURCES/bind-9.18.29.tar.xz
--- a/.fmf/version
+++ b/.fmf/version
@ -1 +0,0 @@
-1
--- a/.gitignore
+++ b/.gitignore
@ -1,232 +1 @@
-bind-9.7.1-P2.tar.gz
-config-8.tar.bz2
-bind-9.7.2b1.tar.gz
-/config-8.tar.bz2
-/bind-9.7.2rc1.tar.gz
-/bind-9.7.2.tar.gz
-/bind-9.7.2-P2.tar.gz
-/bind-9.7.2-P3.tar.gz
-/bind-9.7.3b1.tar.gz
-/bind-9.7.3rc1.tar.gz
-/bind-9.7.3.tar.gz
-/bind-9.8.0rc1.tar.gz
-/bind-9.8.0.tar.gz
-/bind-9.8.0-P1.tar.gz
-/bind-9.8.0-P2.tar.gz
-/bind-9.8.0-P4.tar.gz
-/bind-9.8.1rc1.tar.gz
-/bind-9.8.1.tar.gz
-/bind-9.9.0b1.tar.gz
-/bind-9.9.0b2.tar.gz
-/bind-9.9.0rc1.tar.gz
-/bind-9.9.0rc2.tar.gz
-/bind-9.9.0.tar.gz
-/bind-9.9.1.tar.gz
-/bind-9.9.1-P1.tar.gz
-/bind-9.9.1-P2.tar.gz
-/bind-9.9.1-P3.tar.gz
-/bind-9.9.2.tar.gz
-/bind-9.9.2-P1.tar.gz
-/config-9.tar.bz2
-/config-10.tar.bz2
-/bind-9.9.2-P2.tar.gz
-/bind-9.9.3rc1.tar.gz
-/config-11.tar.bz2
-/bind-9.9.3rc2.tar.gz
-/bind-9.9.3.tar.gz
-/bind-9.9.3-P1.tar.gz
-/bind-9.9.4b1.tar.gz
-/bind-9.9.4rc1.tar.gz
-/bind-9.9.4rc2.tar.gz
-/bind-9.9.4.tar.gz
-/config-12.tar.bz2
-/bind-9.9.5b1.tar.gz
-/bind-9.9.5rc2.tar.gz
-/bind-9.9.5.tar.gz
-/bind-9.9.5-P1.tar.gz
-/bind-9.9.6.tar.gz
-/bind-9.9.6-P1.tar.gz
-/bind-9.10.1b2.tar.gz
-/bind-9.10.1.tar.gz
-/bind-9.10.1-P1.tar.gz
-/bind-9.10.2rc1.tar.gz
-/bind-9.10.2rc2.tar.gz
-/bind-9.10.2.tar.gz
-/config-13.tar.bz2
-/config-14.tar.bz2
-/bind-9.10.2-P1.tar.gz
-/bind-9.10.2-P2.tar.gz
-/bind-9.10.2-P3.tar.gz
-/bind-9.10.3rc1.tar.gz
-/bind-9.10.3.tar.gz
-/bind-9.10.3-P2.tar.gz
-/config-15.tar.bz2
-/bind-9.10.3-P3.tar.gz
-/bind-9.10.3-P4.tar.gz
-/bind-9.10.4-P1.tar.gz
-/bind-9.10.4-P2.tar.gz
-/bind-9.10.4-P3.tar.gz
-/bind-9.10.4-P4.tar.gz
-/bind-9.11.0-P1.tar.gz
-/bind-9.11.0-P2.tar.gz
-/bind-9.11.0-P3.tar.gz
-/bind-9.11.0-P5.tar.gz
-/config-16.tar.bz2
-/bind-9.11.1-P1.tar.gz
-/bind-9.11.1-P2.tar.gz
-/bind-9.11.1-P3.tar.gz
-/bind-9.11.2b1.tar.gz
-/bind-9.11.2.tar.gz
-/config-17.tar.bz2
-/bind-9.11.2-P1.tar.gz
-/bind-9.11.3b1.tar.gz
-/bind-9.11.3.tar.gz
-/config-18.tar.bz2
-/bind-9.11.4rc1.tar.gz
-/bind-9.11.4.tar.gz
-/bind-9.11.4-P1.tar.gz
-/bind-9.11.4-P2.tar.gz
-/bind-9.11.5.tar.gz
-/bind-9.11.5-P1.tar.gz
-/config-19.tar.bz2
-/bind-9.11.5-P4.tar.gz
-/bind-9.11.6.tar.gz
-/bind-9.11.6-P1.tar.gz
-/bind-9.11.7.tar.gz
-/bind-9.11.8.tar.gz
-/bind-9.11.9.tar.gz
-/bind-9.11.10.tar.gz
-/bind-9.11.11.tar.gz
-/bind-9.11.12.tar.gz
-/bind-9.11.13.tar.gz
-/bind-9.11.13.tar.gz.asc
-/bind-9.11.14.tar.gz
-/bind-9.11.14.tar.gz.asc
-/bind-9.11.17.tar.gz
-/bind-9.11.17.tar.gz.asc
-/bind-9.11.18.tar.gz
-/bind-9.11.18.tar.gz.asc
-/bind-9.11.19.tar.gz
-/bind-9.11.19.tar.gz.asc
-/bind-9.11.20.tar.gz
-/bind-9.11.20.tar.gz.asc
-/bind-9.11.21.tar.gz
-/bind-9.11.21.tar.gz.asc
-/bind-9.11.22.tar.gz
-/bind-9.11.22.tar.gz.asc
-/bind-9.11.23.tar.gz
-/bind-9.11.23.tar.gz.asc
-/bind-9.11.24.tar.gz
-/bind-9.11.24.tar.gz.asc
-/bind-9.11.25.tar.gz
-/bind-9.11.25.tar.gz.asc
-/bind-9.11.26.tar.gz
-/bind-9.11.26.tar.gz.asc
-/bind-9.16.1.tar.xz
-/bind-9.16.1.tar.xz.asc
-/bind-9.16.2.tar.xz
-/bind-9.16.2.tar.xz.asc
-/bind-9.16.4.tar.xz
-/bind-9.16.4.tar.xz.asc
-/bind-9.16.5.tar.xz
-/bind-9.16.5.tar.xz.asc
-/bind-9.16.6.tar.xz
-/bind-9.16.6.tar.xz.asc
-/bind-9.16.7.tar.xz
-/bind-9.16.7.tar.xz.asc
-/bind-9.16.8.tar.xz
-/bind-9.16.8.tar.xz.asc
-/bind-9.16.9.tar.xz
-/bind-9.16.9.tar.xz.asc
-/bind-9.16.10.tar.xz
-/bind-9.16.10.tar.xz.asc
-/bind-9.16.11.tar.xz
-/bind-9.16.11.tar.xz.asc
-/bind-9.16.13.tar.xz
-/bind-9.16.13.tar.xz.asc
-/bind-9.16.15.tar.xz
-/bind-9.16.15.tar.xz.asc
-/bind-9.16.16.tar.xz
-/bind-9.16.16.tar.xz.asc
-/bind-9.16.17.tar.xz
-/bind-9.16.17.tar.xz.asc
-/bind-9.16.18.tar.xz
-/bind-9.16.18.tar.xz.asc
-/bind-9.16.19.tar.xz
-/bind-9.16.19.tar.xz.asc
-/bind-9.16.20.tar.xz
-/bind-9.16.20.tar.xz.asc
-/bind-9.16.21.tar.xz
-/bind-9.16.21.tar.xz.asc
-/bind-9.16.22.tar.xz
-/bind-9.16.22.tar.xz.asc
-/bind-9.16.23.tar.xz
-/bind-9.16.23.tar.xz.asc
-/bind-9.16.24.tar.xz
-/bind-9.16.24.tar.xz.asc
-/bind-9.16.25.tar.xz
-/bind-9.16.25.tar.xz.asc
-/bind-9.16.26.tar.xz
-/bind-9.16.26.tar.xz.asc
-/bind-9.16.27.tar.xz
-/bind-9.16.27.tar.xz.asc
-/bind-9.16.28.tar.xz
-/bind-9.16.28.tar.xz.asc
-/bind-9.16.29.tar.xz
-/bind-9.16.29.tar.xz.asc
-/bind-9.16.30.tar.xz
-/bind-9.16.30.tar.xz.asc
-/bind-9.18.0.tar.xz
-/bind-9.18.0.tar.xz.asc
-/bind-9.18.1.tar.xz
-/bind-9.18.1.tar.xz.asc
-/bind-9.18.2.tar.xz
-/bind-9.18.2.tar.xz.asc
-/bind-9.18.3.tar.xz
-/bind-9.18.3.tar.xz.asc
-/bind-9.18.4.tar.xz
-/bind-9.18.4.tar.xz.asc
-/bind-9.18.5.tar.xz
-/bind-9.18.5.tar.xz.asc
-/bind-9.18.6.tar.xz
-/bind-9.18.6.tar.xz.asc
-/bind-9.18.7.tar.xz
-/bind-9.18.7.tar.xz.asc
-/bind-9.18.8.tar.xz
-/bind-9.18.8.tar.xz.asc
-/bind-9.18.9.tar.xz
-/bind-9.18.9.tar.xz.asc
-/bind-9.18.10.tar.xz
-/bind-9.18.10.tar.xz.asc
-/bind-9.18.11.tar.xz
-/bind-9.18.11.tar.xz.asc
-/bind-9.18.12.tar.xz
-/bind-9.18.12.tar.xz.asc
-/bind-9.18.13.tar.xz
-/bind-9.18.13.tar.xz.asc
-/bind-9.18.14.tar.xz
-/bind-9.18.14.tar.xz.asc
-/bind-9.18.15.tar.xz
-/bind-9.18.15.tar.xz.asc
-/bind-9.18.16.tar.xz
-/bind-9.18.16.tar.xz.asc
-/bind-9.18.17.tar.xz
-/bind-9.18.17.tar.xz.asc
-/bind-9.18.18.tar.xz
-/bind-9.18.18.tar.xz.asc
-/bind-9.18.19.tar.xz
-/bind-9.18.19.tar.xz.asc
-/bind-9.18.20.tar.xz
-/bind-9.18.20.tar.xz.asc
-/bind-9.18.21.tar.xz
-/bind-9.18.21.tar.xz.asc
-/bind-9.18.24.tar.xz
-/bind-9.18.24.tar.xz.asc
-/bind-9.18.26.tar.xz
-/bind-9.18.26.tar.xz.asc
-/bind-9.18.27.tar.xz
-/bind-9.18.27.tar.xz.asc
-/bind-9.18.28.tar.xz
-/bind-9.18.28.tar.xz.asc
-/bind-9.18.29.tar.xz
-/bind-9.18.29.tar.xz.asc
+SOURCES/bind-9.18.29.tar.xz
--- a/Changes.md
+++ b/Changes.md
@ -1,43 +0,0 @@
-# Significant Changes in BIND9 package
-
-## BIND 9.16
-
-### New features
-
- *libuv* is used for network subsystem as a mandatory dependency
- *dnssec-policy* support in named.conf is introduced, providing a a key and signing policy
-  ([KASP](https://gitlab.isc.org/isc-projects/bind9/-/wikis/DNSSEC-Key-and-Signing-Policy-(KASP)))
- *trusted-keys* and *managed-keys* are deprecated, replaced by *trust-anchors*
- *trust-anchors* support also anchor in a *DS* format, in addition to *DNSKEY* format
- **dig, mdig** and **delv** support **+yaml** parameter to print detailed machine parseable output
-
-### Feature changes
-
- Static trust anchor and *dnssec-validation auto;* are incompatible and cause fatal error, when used together.
- *DS* and *CDS* now generates only SHA-256 digest, SHA-1 is no longer generated by default
- SipHash 2-4 DNS Cookie ([RFC 7873](https://www.rfc-editor.org/rfc/rfc7873.html) is now default).
-  Only AES alternative algorithm is kept, HMAC-SHA cookie support were removed.
- **dnssec-signzone** and **dnssec-verify** commands print output to stdout, *-q* parameter can silence them
-
-### Features removed
-
- *dnssec-enable* option is obsolete, DNSSEC support is always enabled
- *dnssec-lookaside* option is deprecated and support for it removed from all tools
- *cleaning-interval* option is removed
-
-### Upstream release notes
-
- [9.16.10 notes](https://downloads.isc.org/isc/bind9/9.16.10/doc/arm/html/notes.html#notes-for-bind-9-16-10)
- [9.16.0 notes](https://downloads.isc.org/isc/bind9/9.16.0/doc/arm/html/notes.html#notes-for-bind-9-16-0)
-
-## BIND 9.14
-
- single thread support removed. Cannot provide *bind-export-libs* for DHCP
- *lwres* support completely removed. Both daemon and library
- common parts of daemon moved into *libns* shared library
- introduced plugin for filtering aaaa responses
- some SDB utilities no longer supported
-
-### Upstream release notes
-
- [9.14.7 notes](https://downloads.isc.org/isc/bind9/9.14.7/RELEASE-NOTES-bind-9.14.7.html)
--- a/README.md
+++ b/README.md
@ -1,33 +0,0 @@
-# BIND 9
-
-[BIND (Berkeley Internet Name Domain)](https://www.isc.org/downloads/bind/doc/) is a complete, highly portable
-implementation of the DNS (Domain Name System) protocol.
-
-Internet Systems Consortium
-([https://www.isc.org](https://www.isc.org)), a 501(c)(3) public benefit
-corporation dedicated to providing software and services in support of the
-Internet infrastructure, developed BIND 9 and is responsible for its
-ongoing maintenance and improvement.
-
-More details about upstream project can be found on their
-[gitlab](https://gitlab.isc.org/isc-projects/bind9). This repository contains
-only upstream sources and packaging instructions for
-[Fedora Project](https://fedoraproject.org).
-
-## Subpackages
-
-The package contains several subpackages, some of them can be disabled on rebuild.
-
-* **bind** -- *named* daemon providing DNS server
-* **bind-utils** -- set of tools to analyse DNS responses or update entries (dig, host)
-* **bind-doc** -- documentation for current bind, *BIND 9 Administrator Reference Manual*.
-* **bind-license** -- Shared license for all packages but bind-export-libs.
-* **bind-libs** -- Shared libraries used by some others programs
-* **bind-devel** -- Development headers for libs. Can be disabled by `--without DEVEL`
-
-
-## Optional features
-
-* *GSSTSIG* -- Support for Kerberos authentication in BIND.
-* *LMDB* -- Support for dynamic database for managing runtime added zones. Provides faster removal of added zone with much less overhead. But requires lmdb linked to base libs.
-* *DLZ* -- Support for dynamic loaded modules providing support for features *bind-sdb* provides, but only small module is required.
--- a/SOURCES/bind-9.16-redhat_doc.patch
+++ b/SOURCES/bind-9.16-redhat_doc.patch
--- a/SOURCES/bind-9.18-CVE-2024-11187-pre-test.patch
+++ b/SOURCES/bind-9.18-CVE-2024-11187-pre-test.patch
@ -0,0 +1,68 @@
+From cd48dcb0f87f8bed8138cbc4635a6a46f3148620 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
+Date: Tue, 7 Jan 2025 15:22:40 +0100
+Subject: [PATCH] Isolate using the -T noaa flag only for part of the resolver
+ test
+
+Instead of running the whole resolver/ns4 server with -T noaa flag,
+use it only for the part where it is actually needed.  The -T noaa
+could interfere with other parts of the test because the answers don't
+have the authoritative-answer bit set, and we could have false
+positives (or false negatives) in the test because the authoritative
+server doesn't follow the DNS protocol for all the tests in the resolver
+system test.
+
+(cherry picked from commit e51d4d3b88af00d6667f2055087ebfc47fb3107c)
+---
+ bin/tests/system/resolver/ns4/named.noaa | 12 ------------
+ bin/tests/system/resolver/tests.sh       |  8 ++++++++
+ 2 files changed, 8 insertions(+), 12 deletions(-)
+ delete mode 100644 bin/tests/system/resolver/ns4/named.noaa
+
+diff --git a/bin/tests/system/resolver/ns4/named.noaa b/bin/tests/system/resolver/ns4/named.noaa
+deleted file mode 100644
+index be78cc2c949..00000000000
+--- a/bin/tests/system/resolver/ns4/named.noaa
+++ /dev/null
+@@ -1,12 +0,0 @@
+-Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+-
+-SPDX-License-Identifier: MPL-2.0
+-
+-This Source Code Form is subject to the terms of the Mozilla Public
+-License, v. 2.0.  If a copy of the MPL was not distributed with this
+-file, you can obtain one at https://mozilla.org/MPL/2.0/.
+-
+-See the COPYRIGHT file distributed with this work for additional
+-information regarding copyright ownership.
+-
+-Add -T noaa.
+diff --git a/bin/tests/system/resolver/tests.sh b/bin/tests/system/resolver/tests.sh
+index 982ff9761be..23b42f728cd 100755
+--- a/bin/tests/system/resolver/tests.sh
+++ b/bin/tests/system/resolver/tests.sh
+@@ -322,6 +322,10 @@ done
+ if [ $ret != 0 ]; then echo_i "failed"; fi
+ status=$((status + ret))
+ 
+stop_server ns4
+touch ns4/named.noaa
+start_server --noclean --restart --port ${PORT} ns4 || ret=1
+
+ n=$((n + 1))
+ echo_i "RT21594 regression test check setup ($n)"
+ ret=0
+@@ -358,6 +362,10 @@ grep "status: NXDOMAIN" dig.ns5.out.${n} >/dev/null || ret=1
+ if [ $ret != 0 ]; then echo_i "failed"; fi
+ status=$((status + ret))
+ 
+stop_server ns4
+rm ns4/named.noaa
+start_server --noclean --restart --port ${PORT} ns4 || ret=1
+
+ n=$((n + 1))
+ echo_i "check that replacement of additional data by a negative cache no data entry clears the additional RRSIGs ($n)"
+ ret=0
+-- 
+2.48.1
+
--- a/SOURCES/bind-9.18-CVE-2024-11187.patch
+++ b/SOURCES/bind-9.18-CVE-2024-11187.patch
@ -0,0 +1,226 @@
+From 7ded6b358ced23bb6214c7309cff0850b7d1b77d Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
+Date: Thu, 14 Nov 2024 10:37:29 +0100
+Subject: [PATCH] Limit the additional processing for large RDATA sets
+
+When answering queries, don't add data to the additional section if
+the answer has more than 13 names in the RDATA.  This limits the
+number of lookups into the database(s) during a single client query,
+reducing query processing load.
+
+Also, don't append any additional data to type=ANY queries. The
+answer to ANY is already big enough.
+
+(cherry picked from commit a1982cf1bb95c818aa7b58988b5611dec80f2408)
+---
+ bin/tests/system/additional/tests.sh |  2 +-
+ lib/dns/include/dns/rdataset.h       | 10 +++++++++-
+ lib/dns/rbtdb.c                      |  2 +-
+ lib/dns/rdataset.c                   |  7 ++++++-
+ lib/dns/resolver.c                   | 19 ++++++++++++-------
+ lib/ns/query.c                       | 12 ++++++++----
+ 6 files changed, 37 insertions(+), 15 deletions(-)
+
+diff --git a/bin/tests/system/additional/tests.sh b/bin/tests/system/additional/tests.sh
+index 193c9f9..e1b0cfb 100644
+--- a/bin/tests/system/additional/tests.sh
+++ b/bin/tests/system/additional/tests.sh
+@@ -279,7 +279,7 @@ n=$((n + 1))
+ echo_i "testing with 'minimal-any no;' ($n)"
+ ret=0
+ $DIG $DIGOPTS -t ANY www.rt.example @10.53.0.1 >dig.out.$n || ret=1
+-grep "ANSWER: 3, AUTHORITY: 2, ADDITIONAL: 2" dig.out.$n >/dev/null || ret=1
+grep "ANSWER: 3, AUTHORITY: 2, ADDITIONAL: 1" dig.out.$n >/dev/null || ret=1
+ if [ $ret -eq 1 ]; then
+   echo_i "failed"
+   status=$((status + 1))
+diff --git a/lib/dns/include/dns/rdataset.h b/lib/dns/include/dns/rdataset.h
+index f63591c..b28686a 100644
+--- a/lib/dns/include/dns/rdataset.h
+++ b/lib/dns/include/dns/rdataset.h
+@@ -54,6 +54,8 @@
+ #include <dns/rdatastruct.h>
+ #include <dns/types.h>
+ 
+#define DNS_RDATASET_MAXADDITIONAL 13
+
+ ISC_LANG_BEGINDECLS
+ 
+ typedef enum {
+@@ -453,7 +455,8 @@ dns_rdataset_towirepartial(dns_rdataset_t   *rdataset,
+ isc_result_t
+ dns_rdataset_additionaldata(dns_rdataset_t	    *rdataset,
+ 			    const dns_name_t	    *owner_name,
+-			    dns_additionaldatafunc_t add, void *arg);
+			    dns_additionaldatafunc_t add, void *arg,
+			    size_t limit);
+ /*%<
+  * For each rdata in rdataset, call 'add' for each name and type in the
+  * rdata which is subject to additional section processing.
+@@ -472,10 +475,15 @@ dns_rdataset_additionaldata(dns_rdataset_t	    *rdataset,
+  *\li	If a call to dns_rdata_additionaldata() is not successful, the
+  *	result returned will be the result of dns_rdataset_additionaldata().
+  *
+ *\li	If 'limit' is non-zero and the number of the rdatasets is larger
+ *	than 'limit', no additional data will be processed.
+ *
+  * Returns:
+  *
+  *\li	#ISC_R_SUCCESS
+  *
+ *\li	#DNS_R_TOOMANYRECORDS in case rdataset count is larger than 'limit'
+ *
+  *\li	Any error that dns_rdata_additionaldata() can return.
+  */
+ 
+diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
+index 5c2f0b2..c4db047 100644
+--- a/lib/dns/rbtdb.c
+++ b/lib/dns/rbtdb.c
+@@ -10317,7 +10317,7 @@ no_glue:
+ 	idx = hash_32(hash, rbtversion->glue_table_bits);
+ 
+ 	(void)dns_rdataset_additionaldata(rdataset, dns_rootname,
+-					  glue_nsdname_cb, &ctx);
+					  glue_nsdname_cb, &ctx, 0);
+ 
+ 	cur = isc_mem_get(rbtdb->common.mctx, sizeof(*cur));
+ 
+diff --git a/lib/dns/rdataset.c b/lib/dns/rdataset.c
+index 4d48203..0b450a9 100644
+--- a/lib/dns/rdataset.c
+++ b/lib/dns/rdataset.c
+@@ -577,7 +577,8 @@ dns_rdataset_towire(dns_rdataset_t *rdataset, const dns_name_t *owner_name,
+ isc_result_t
+ dns_rdataset_additionaldata(dns_rdataset_t *rdataset,
+ 			    const dns_name_t *owner_name,
+-			    dns_additionaldatafunc_t add, void *arg) {
+			    dns_additionaldatafunc_t add, void *arg,
+			    size_t limit) {
+ 	dns_rdata_t rdata = DNS_RDATA_INIT;
+ 	isc_result_t result;
+ 
+@@ -589,6 +590,10 @@ dns_rdataset_additionaldata(dns_rdataset_t *rdataset,
+ 	REQUIRE(DNS_RDATASET_VALID(rdataset));
+ 	REQUIRE((rdataset->attributes & DNS_RDATASETATTR_QUESTION) == 0);
+ 
+	if (limit != 0 && dns_rdataset_count(rdataset) > limit) {
+		return DNS_R_TOOMANYRECORDS;
+	}
+
+ 	result = dns_rdataset_first(rdataset);
+ 	if (result != ISC_R_SUCCESS) {
+ 		return (result);
+diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
+index f8f53d2..bb0bfa1 100644
+--- a/lib/dns/resolver.c
+++ b/lib/dns/resolver.c
+@@ -8904,7 +8904,7 @@ rctx_answer_any(respctx_t *rctx) {
+ 		rdataset->trust = rctx->trust;
+ 
+ 		(void)dns_rdataset_additionaldata(rdataset, rctx->aname,
+-						  check_related, rctx);
+						  check_related, rctx, 0);
+ 	}
+ 
+ 	return (ISC_R_SUCCESS);
+@@ -8952,7 +8952,7 @@ rctx_answer_match(respctx_t *rctx) {
+ 	rctx->ardataset->attributes |= DNS_RDATASETATTR_CACHE;
+ 	rctx->ardataset->trust = rctx->trust;
+ 	(void)dns_rdataset_additionaldata(rctx->ardataset, rctx->aname,
+-					  check_related, rctx);
+					  check_related, rctx, 0);
+ 
+ 	for (sigrdataset = ISC_LIST_HEAD(rctx->aname->list);
+ 	     sigrdataset != NULL;
+@@ -9159,7 +9159,7 @@ rctx_authority_positive(respctx_t *rctx) {
+ 					 */
+ 					(void)dns_rdataset_additionaldata(
+ 						rdataset, name, check_related,
+-						rctx);
+						rctx, 0);
+ 					done = true;
+ 				}
+ 			}
+@@ -9666,8 +9666,12 @@ rctx_referral(respctx_t *rctx) {
+ 	 */
+ 	INSIST(rctx->ns_rdataset != NULL);
+ 	FCTX_ATTR_SET(fctx, FCTX_ATTR_GLUING);
+
+	/*
+	 * Mark the glue records in the additional section to be cached.
+	 */
+ 	(void)dns_rdataset_additionaldata(rctx->ns_rdataset, rctx->ns_name,
+-					  check_related, rctx);
+					  check_related, rctx, 0);
+ #if CHECK_FOR_GLUE_IN_ANSWER
+ 	/*
+ 	 * Look in the answer section for "glue" that is incorrectly
+@@ -9679,8 +9683,9 @@ rctx_referral(respctx_t *rctx) {
+ 	if (rctx->glue_in_answer &&
+ 	    (fctx->type == dns_rdatatype_aaaa || fctx->type == dns_rdatatype_a))
+ 	{
+-		(void)dns_rdataset_additionaldata(
+-			rctx->ns_rdataset, rctx->ns_name, check_answer, fctx);
+		(void)dns_rdataset_additionaldata(rctx->ns_rdataset,
+						  rctx->ns_name, check_answer,
+						  fctx, 0);
+ 	}
+ #endif /* if CHECK_FOR_GLUE_IN_ANSWER */
+ 	FCTX_ATTR_CLR(fctx, FCTX_ATTR_GLUING);
+@@ -9782,7 +9787,7 @@ again:
+ 			if (CHASE(rdataset)) {
+ 				rdataset->attributes &= ~DNS_RDATASETATTR_CHASE;
+ 				(void)dns_rdataset_additionaldata(
+-					rdataset, name, check_related, rctx);
+					rdataset, name, check_related, rctx, 0);
+ 				rescan = true;
+ 			}
+ 		}
+diff --git a/lib/ns/query.c b/lib/ns/query.c
+index 5549e20..ded1eae 100644
+--- a/lib/ns/query.c
+++ b/lib/ns/query.c
+@@ -2094,7 +2094,8 @@ addname:
+ 	if (trdataset != NULL && dns_rdatatype_followadditional(type)) {
+ 		if (client->additionaldepth++ < client->view->max_restarts) {
+ 			eresult = dns_rdataset_additionaldata(
+-				trdataset, fname, query_additional_cb, qctx);
+				trdataset, fname, query_additional_cb, qctx,
+				DNS_RDATASET_MAXADDITIONAL);
+ 		}
+ 		client->additionaldepth--;
+ 	}
+@@ -2194,7 +2195,7 @@ regular:
+ 	 * We don't care if dns_rdataset_additionaldata() fails.
+ 	 */
+ 	(void)dns_rdataset_additionaldata(rdataset, name, query_additional_cb,
+-					  qctx);
+					  qctx, DNS_RDATASET_MAXADDITIONAL);
+ 	CTRACE(ISC_LOG_DEBUG(3), "query_additional: done");
+ }
+ 
+@@ -2220,7 +2221,8 @@ query_addrrset(query_ctx_t *qctx, dns_name_t **namep,
+ 	 * To the current response for 'client', add the answer RRset
+ 	 * '*rdatasetp' and an optional signature set '*sigrdatasetp', with
+ 	 * owner name '*namep', to section 'section', unless they are
+-	 * already there.  Also add any pertinent additional data.
+	 * already there.  Also add any pertinent additional data, unless
+	 * the query was for type ANY.
+ 	 *
+ 	 * If 'dbuf' is not NULL, then '*namep' is the name whose data is
+ 	 * stored in 'dbuf'.  In this case, query_addrrset() guarantees that
+@@ -2275,7 +2277,9 @@ query_addrrset(query_ctx_t *qctx, dns_name_t **namep,
+ 	 */
+ 	query_addtoname(mname, rdataset);
+ 	query_setorder(qctx, mname, rdataset);
+-	query_additional(qctx, mname, rdataset);
+	if (qctx->qtype != dns_rdatatype_any) {
+		query_additional(qctx, mname, rdataset);
+	}
+ 
+ 	/*
+ 	 * Note: we only add SIGs if we've added the type they cover, so
+-- 
+2.48.1
+
--- a/SOURCES/bind-9.18-CVE-2024-12705.patch
+++ b/SOURCES/bind-9.18-CVE-2024-12705.patch
--- a/SOURCES/bind-9.18-CVE-2025-40778.patch
+++ b/SOURCES/bind-9.18-CVE-2025-40778.patch
@ -0,0 +1,781 @@
+From 69783c72b5db5f96518839508829e20b75b96f86 Mon Sep 17 00:00:00 2001
+From: Mark Andrews <marka@isc.org>
+Date: Thu, 10 Jul 2025 09:37:36 +1000
+Subject: [PATCH] Tighten restrictions on caching NS RRsets in authority
+ section
+
+To prevent certain spoofing attacks, a new check has been added
+to the existing rules for whether NS data can be cached: the owner
+name of the NS RRset must be an ancestor of the name being queried.
+
+(cherry picked from commit fa153f791f9324bf84abf8d259e11c0531fe6e25)
+(cherry picked from commit 025d61bacd0f57f994a631654aff7a933d89a547)
+
+Further restrict addresses that are cached when processing referrals
+
+Use the owner name of the NS record as the bailwick apex name
+when determining which additional records to cache, rather than
+the name of the delegating zone (or a parent thereof).
+
+(cherry picked from commit a41054e9e606a61f1b3c8bc0c54e2f1059347165)
+(cherry picked from commit cd17dfe696cdf9b8ef23fbc8738de7c79f957846)
+
+Retry lookups with unsigned DNAME over TCP
+
+To prevent spoofed unsigned DNAME responses being accepted retry
+response with unsigned DNAMEs over TCP if the response is not TSIG
+signed or there isn't a good DNS CLIENT COOKIE.
+
+To prevent test failures, this required adding TCP support to the
+ans3 and ans4 servers in the chain system test.
+
+(cherry picked from commit 2e40705c06831988106335ed77db3cf924d431f6)
+(cherry picked from commit 4c6d03b0bb2ffbafcde8e8a5bc0e49908b978a72)
+---
+ bin/tests/system/chain/ans3/ans.pl | 143 -------------------
+ bin/tests/system/chain/ans3/ans.py | 217 +++++++++++++++++++++++++++++
+ bin/tests/system/chain/ans4/ans.py |  57 ++++++--
+ lib/dns/include/dns/message.h      |   8 ++
+ lib/dns/message.c                  |  12 ++
+ lib/dns/resolver.c                 | 110 ++++++++++++---
+ 6 files changed, 374 insertions(+), 173 deletions(-)
+ delete mode 100644 bin/tests/system/chain/ans3/ans.pl
+ create mode 100644 bin/tests/system/chain/ans3/ans.py
+
+diff --git a/bin/tests/system/chain/ans3/ans.pl b/bin/tests/system/chain/ans3/ans.pl
+deleted file mode 100644
+index e42240b..0000000
+--- a/bin/tests/system/chain/ans3/ans.pl
+++ /dev/null
+@@ -1,143 +0,0 @@
+-#!/usr/bin/env perl
+-
+-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+-#
+-# SPDX-License-Identifier: MPL-2.0
+-#
+-# This Source Code Form is subject to the terms of the Mozilla Public
+-# License, v. 2.0.  If a copy of the MPL was not distributed with this
+-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+-#
+-# See the COPYRIGHT file distributed with this work for additional
+-# information regarding copyright ownership.
+-
+-use strict;
+-use warnings;
+-
+-use IO::File;
+-use Getopt::Long;
+-use Net::DNS::Nameserver;
+-
+-my $pidf = new IO::File "ans.pid", "w" or die "cannot open pid file: $!";
+-print $pidf "$$\n" or die "cannot write pid file: $!";
+-$pidf->close or die "cannot close pid file: $!";
+-sub rmpid { unlink "ans.pid"; exit 1; };
+-sub term { };
+-
+-$SIG{INT} = \&rmpid;
+-if ($Net::DNS::VERSION > 1.41) {
+-    $SIG{TERM} = \&term;
+-} else {
+-    $SIG{TERM} = \&rmpid;
+-}
+-
+-my $localaddr = "10.53.0.3";
+-
+-my $localport = int($ENV{'PORT'});
+-if (!$localport) { $localport = 5300; }
+-
+-my $verbose = 0;
+-my $ttl = 60;
+-my $zone = "example.broken";
+-my $nsname = "ns3.$zone";
+-my $synth = "synth-then-dname.$zone";
+-my $synth2 = "synth2-then-dname.$zone";
+-
+-sub reply_handler {
+-    my ($qname, $qclass, $qtype, $peerhost, $query, $conn) = @_;
+-    my ($rcode, @ans, @auth, @add);
+-
+-    print ("request: $qname/$qtype\n");
+-    STDOUT->flush();
+-
+-    if ($qname eq "example.broken") {
+-        if ($qtype eq "SOA") {
+-	    my $rr = new Net::DNS::RR("$qname $ttl $qclass SOA . . 0 0 0 0 0");
+-	    push @ans, $rr;
+-        } elsif ($qtype eq "NS") {
+-	    my $rr = new Net::DNS::RR("$qname $ttl $qclass NS $nsname");
+-	    push @ans, $rr;
+-	    $rr = new Net::DNS::RR("$nsname $ttl $qclass A $localaddr");
+-	    push @add, $rr;
+-        }
+-        $rcode = "NOERROR";
+-    } elsif ($qname eq "cname-to-$synth2") {
+-        my $rr = new Net::DNS::RR("$qname $ttl $qclass CNAME name.$synth2");
+-	push @ans, $rr;
+-        $rr = new Net::DNS::RR("name.$synth2 $ttl $qclass CNAME name");
+-	push @ans, $rr;
+-        $rr = new Net::DNS::RR("$synth2 $ttl $qclass DNAME .");
+-	push @ans, $rr;
+-	$rcode = "NOERROR";
+-    } elsif ($qname eq "$synth" || $qname eq "$synth2") {
+-	if ($qtype eq "DNAME") {
+-	    my $rr = new Net::DNS::RR("$qname $ttl $qclass DNAME .");
+-	    push @ans, $rr;
+-	}
+-	$rcode = "NOERROR";
+-    } elsif ($qname eq "name.$synth") {
+-	my $rr = new Net::DNS::RR("$qname $ttl $qclass CNAME name.");
+-	push @ans, $rr;
+-	$rr = new Net::DNS::RR("$synth $ttl $qclass DNAME .");
+-	push @ans, $rr;
+-	$rcode = "NOERROR";
+-    } elsif ($qname eq "name.$synth2") {
+-	my $rr = new Net::DNS::RR("$qname $ttl $qclass CNAME name.");
+-	push @ans, $rr;
+-	$rr = new Net::DNS::RR("$synth2 $ttl $qclass DNAME .");
+-	push @ans, $rr;
+-	$rcode = "NOERROR";
+-    # The following three code branches referring to the "example.dname"
+-    # zone are necessary for the resolver variant of the CVE-2021-25215
+-    # regression test to work.  A named instance cannot be used for
+-    # serving the DNAME records below as a version of BIND vulnerable to
+-    # CVE-2021-25215 would crash while answering the queries asked by
+-    # the tested resolver.
+-    } elsif ($qname eq "ns3.example.dname") {
+-	if ($qtype eq "A") {
+-		my $rr = new Net::DNS::RR("$qname $ttl $qclass A 10.53.0.3");
+-		push @ans, $rr;
+-	}
+-	if ($qtype eq "AAAA") {
+-		my $rr = new Net::DNS::RR("example.dname. $ttl $qclass SOA . . 0 0 0 0 $ttl");
+-		push @auth, $rr;
+-	}
+-	$rcode = "NOERROR";
+-    } elsif ($qname eq "self.example.self.example.dname") {
+-	my $rr = new Net::DNS::RR("self.example.dname. $ttl $qclass DNAME dname.");
+-	push @ans, $rr;
+-	$rr = new Net::DNS::RR("$qname $ttl $qclass CNAME self.example.dname.");
+-	push @ans, $rr;
+-	$rcode = "NOERROR";
+-    } elsif ($qname eq "self.example.dname") {
+-	if ($qtype eq "DNAME") {
+-		my $rr = new Net::DNS::RR("$qname $ttl $qclass DNAME dname.");
+-		push @ans, $rr;
+-	}
+-	$rcode = "NOERROR";
+-    } else {
+-	$rcode = "REFUSED";
+-    }
+-    return ($rcode, \@ans, \@auth, \@add, { aa => 1 });
+-}
+-
+-GetOptions(
+-    'port=i' => \$localport,
+-    'verbose!' => \$verbose,
+-);
+-
+-my $ns = Net::DNS::Nameserver->new(
+-    LocalAddr => $localaddr,
+-    LocalPort => $localport,
+-    ReplyHandler => \&reply_handler,
+-    Verbose => $verbose,
+-);
+-
+-if ($Net::DNS::VERSION >= 1.42) {
+-    $ns->start_server();
+-    select(undef, undef, undef, undef);
+-    $ns->stop_server();
+-    unlink "ans.pid";
+-} else {
+-    $ns->main_loop;
+-}
+diff --git a/bin/tests/system/chain/ans3/ans.py b/bin/tests/system/chain/ans3/ans.py
+new file mode 100644
+index 0000000..0a031c1
+--- /dev/null
+++ b/bin/tests/system/chain/ans3/ans.py
+@@ -0,0 +1,217 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+############################################################################
+# ans.py: See README.anspy for details.
+############################################################################
+
+from __future__ import print_function
+import os
+import sys
+import signal
+import socket
+import select
+from datetime import datetime, timedelta
+import functools
+
+import dns, dns.message, dns.query
+from dns.rdatatype import *
+from dns.rdataclass import *
+from dns.rcode import *
+from dns.name import *
+
+
+############################################################################
+# Respond to a DNS query.
+############################################################################
+def create_response(msg):
+    ttl = 60
+    zone = "example.broken."
+    nsname = f"ns3.{zone}"
+    synth = f"synth-then-dname.{zone}"
+    synth2 = f"synth2-then-dname.{zone}"
+
+    m = dns.message.from_wire(msg)
+    qname = m.question[0].name.to_text()
+
+    # prepare the response and convert to wire format
+    r = dns.message.make_response(m)
+
+    # get qtype
+    rrtype = m.question[0].rdtype
+    qtype = dns.rdatatype.to_text(rrtype)
+    print(f"request: {qname}/{qtype}")
+
+    rcode = "NOERROR"
+    if qname == zone:
+        if qtype == "SOA":
+            r.answer.append(dns.rrset.from_text(qname, ttl, IN, SOA, ". . 0 0 0 0 0"))
+        elif qtype == "NS":
+            r.answer.append(dns.rrset.from_text(qname, ttl, IN, NS, nsname))
+            r.additional.append(dns.rrset.from_text(nsname, ttl, IN, A, ip4))
+    elif qname == f"cname-to-{synth2}":
+        r.answer.append(dns.rrset.from_text(qname, ttl, IN, CNAME, f"name.{synth2}"))
+        r.answer.append(dns.rrset.from_text(f"name.{synth2}", ttl, IN, CNAME, "name."))
+        r.answer.append(dns.rrset.from_text(synth2, ttl, IN, DNAME, "."))
+    elif qname == f"{synth}" or qname == f"{synth2}":
+        if qtype == "DNAME":
+            r.answer.append(dns.rrset.from_text(qname, ttl, IN, DNAME, "."))
+    elif qname == f"name.{synth}":
+        r.answer.append(dns.rrset.from_text(qname, ttl, IN, CNAME, "name."))
+        r.answer.append(dns.rrset.from_text(synth, ttl, IN, DNAME, "."))
+    elif qname == f"name.{synth2}":
+        r.answer.append(dns.rrset.from_text(qname, ttl, IN, CNAME, "name."))
+        r.answer.append(dns.rrset.from_text(synth2, ttl, IN, DNAME, "."))
+    elif qname == "ns3.example.dname.":
+        # This and the next two code branches referring to the "example.dname"
+        # zone are necessary for the resolver variant of the CVE-2021-25215
+        # regression test to work.  A named instance cannot be used for
+        # serving the DNAME records below as a version of BIND vulnerable to
+        # CVE-2021-25215 would crash while answering the queries asked by
+        # the tested resolver.
+        if qtype == "A":
+            r.answer.append(dns.rrset.from_text(qname, ttl, IN, A, ip4))
+        elif qtype == "AAAA":
+            r.authority.append(
+                dns.rrset.from_text("example.dname.", ttl, IN, SOA, ". . 0 0 0 0 0")
+            )
+    elif qname == "self.example.self..example.dname.":
+        r.answer.append(
+            dns.rrset.from_text("self.example.dname.", ttl, IN, DNAME, "dname.")
+        )
+        r.answer.append(
+            dns.rrset.from_text(qname, ttl, IN, CNAME, "self.example.dname.")
+        )
+    elif qname == "self.example.dname.":
+        if qtype == "DNAME":
+            r.answer.append(dns.rrset.from_text(qname, ttl, IN, DNAME, "dname."))
+    else:
+        rcode = "REFUSED"
+
+    r.flags |= dns.flags.AA
+    r.use_edns()
+    return r.to_wire()
+
+
+def sigterm(signum, frame):
+    print("Shutting down now...")
+    os.remove("ans.pid")
+    running = False
+    sys.exit(0)
+
+
+############################################################################
+# Main
+#
+# Set up responder and control channel, open the pid file, and start
+# the main loop, listening for queries on the query channel or commands
+# on the control channel and acting on them.
+############################################################################
+ip4 = "10.53.0.3"
+ip6 = "fd92:7065:b8e:ffff::3"
+
+try:
+    port = int(os.environ["PORT"])
+except:
+    port = 5300
+
+query4_udp = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
+query4_udp.bind((ip4, port))
+
+query4_tcp = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+query4_tcp.bind((ip4, port))
+query4_tcp.listen(1)
+query4_tcp.settimeout(1)
+
+havev6 = True
+try:
+    query6_udp = socket.socket(socket.AF_INET6, socket.SOCK_DGRAM)
+    try:
+        query6_udp.bind((ip6, port))
+    except:
+        query6_udp.close()
+        havev6 = False
+
+    query6_tcp = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+    try:
+        query6_tcp.bind((ip4, port))
+        query6_tcp.listen(1)
+        query6_tcp.settimeout(1)
+    except:
+        query6_tcp.close()
+        havev6 = False
+except:
+    havev6 = False
+
+signal.signal(signal.SIGTERM, sigterm)
+
+f = open("ans.pid", "w")
+pid = os.getpid()
+print(pid, file=f)
+f.close()
+
+running = True
+
+print("Listening on %s port %d" % (ip4, port))
+if havev6:
+    print("Listening on %s port %d" % (ip6, port))
+print("Ctrl-c to quit")
+
+if havev6:
+    input = [query4_udp, query4_tcp, query6_udp, query6_tcp]
+else:
+    input = [query4_udp, query4_tcp]
+
+while running:
+    try:
+        inputready, outputready, exceptready = select.select(input, [], [])
+    except select.error as e:
+        break
+    except socket.error as e:
+        break
+    except KeyboardInterrupt:
+        break
+
+    for s in inputready:
+        if s == query4_udp or s == query6_udp:
+            print("Query received on %s" % (ip4 if s == query4_udp else ip6))
+            # Handle incoming queries
+            msg = s.recvfrom(65535)
+            rsp = create_response(msg[0])
+            if rsp:
+                s.sendto(rsp, msg[1])
+        elif s == query4_tcp or s == query6_tcp:
+            try:
+                conn, _ = s.accept()
+                if s == query4_tcp or s == query6_tcp:
+                    print(
+                        "TCP Query received on %s" % (ip4 if s == query4_tcp else ip6),
+                        end=" ",
+                    )
+                # get TCP message length
+                msg = conn.recv(2)
+                if len(msg) != 2:
+                    print("couldn't read TCP message length")
+                    continue
+                length = struct.unpack(">H", msg[:2])[0]
+                msg = conn.recv(length)
+                if len(msg) != length:
+                    print("couldn't read TCP message")
+                    continue
+                rsp = create_response(msg)
+                if rsp:
+                    conn.send(struct.pack(">H", len(rsp)))
+                    conn.send(rsp)
+                conn.close()
+            except socket.error as e:
+                print("error: %s" % str(e))
+    if not running:
+        break
+diff --git a/bin/tests/system/chain/ans4/ans.py b/bin/tests/system/chain/ans4/ans.py
+index 839067f..66f0193 100755
+--- a/bin/tests/system/chain/ans4/ans.py
+++ b/bin/tests/system/chain/ans4/ans.py
+@@ -316,16 +316,30 @@ try:
+ except:
+     ctrlport = 5300
+ 
+-query4_socket = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
+-query4_socket.bind((ip4, port))
+query4_udp = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
+query4_udp.bind((ip4, port))
+
+query4_tcp = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+query4_tcp.bind((ip4, port))
+query4_tcp.listen(1)
+query4_tcp.settimeout(1)
+ 
+ havev6 = True
+ try:
+-    query6_socket = socket.socket(socket.AF_INET6, socket.SOCK_DGRAM)
+    query6_udp = socket.socket(socket.AF_INET6, socket.SOCK_DGRAM)
+    try:
+        query6_udp.bind((ip6, port))
+    except:
+        query6_udp.close()
+        havev6 = False
+
+    query6_tcp = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+     try:
+-        query6_socket.bind((ip6, port))
+        query6_tcp.bind((ip4, port))
+        query6_tcp.listen(1)
+        query6_tcp.settimeout(1)
+     except:
+-        query6_socket.close()
+        query6_tcp.close()
+         havev6 = False
+ except:
+     havev6 = False
+@@ -350,9 +364,9 @@ print("Control channel on %s port %d" % (ip4, ctrlport))
+ print("Ctrl-c to quit")
+ 
+ if havev6:
+-    input = [query4_socket, query6_socket, ctrl_socket]
+    input = [query4_udp, query4_tcp, query6_udp, query6_tcp, ctrl_socket]
+ else:
+-    input = [query4_socket, ctrl_socket]
+    input = [query4_udp, query4_tcp, ctrl_socket]
+ 
+ while running:
+     try:
+@@ -375,12 +389,37 @@ while running:
+                     break
+                 ctl_channel(msg)
+             conn.close()
+-        if s == query4_socket or s == query6_socket:
+-            print("Query received on %s" % (ip4 if s == query4_socket else ip6))
+        elif s == query4_udp or s == query6_udp:
+            print("Query received on %s" % (ip4 if s == query4_udp else ip6))
+             # Handle incoming queries
+             msg = s.recvfrom(65535)
+             rsp = create_response(msg[0])
+             if rsp:
+                 s.sendto(rsp, msg[1])
+        elif s == query4_tcp or s == query6_tcp:
+            try:
+                conn, _ = s.accept()
+                if s == query4_tcp or s == query6_tcp:
+                    print(
+                        "TCP Query received on %s" % (ip4 if s == query4_tcp else ip6),
+                        end=" ",
+                    )
+                # get TCP message length
+                msg = conn.recv(2)
+                if len(msg) != 2:
+                    print("couldn't read TCP message length")
+                    continue
+                length = struct.unpack(">H", msg[:2])[0]
+                msg = conn.recv(length)
+                if len(msg) != length:
+                    print("couldn't read TCP message")
+                    continue
+                rsp = create_response(msg)
+                if rsp:
+                    conn.send(struct.pack(">H", len(rsp)))
+                    conn.send(rsp)
+                conn.close()
+            except socket.error as e:
+                print("error: %s" % str(e))
+     if not running:
+         break
+diff --git a/lib/dns/include/dns/message.h b/lib/dns/include/dns/message.h
+index f15884a..c2efc19 100644
+--- a/lib/dns/include/dns/message.h
+++ b/lib/dns/include/dns/message.h
+@@ -283,6 +283,7 @@ struct dns_message {
+ 	unsigned int tkey	      : 1;
+ 	unsigned int rdclass_set      : 1;
+ 	unsigned int fuzzing	      : 1;
+	unsigned int has_dname	      : 1;
+ 
+ 	unsigned int opt_reserved;
+ 	unsigned int sig_reserved;
+@@ -1526,4 +1527,11 @@ dns_message_response_minttl(dns_message_t *msg, dns_ttl_t *pttl);
+  * \li   'pttl != NULL'.
+  */
+ 
+bool
+dns_message_hasdname(dns_message_t *msg);
+/*%<
+ * Return whether a DNAME was detected in the ANSWER section of a QUERY
+ * message when it was parsed.
+ */
+
+ ISC_LANG_ENDDECLS
+diff --git a/lib/dns/message.c b/lib/dns/message.c
+index 67190af..4dae88a 100644
+--- a/lib/dns/message.c
+++ b/lib/dns/message.c
+@@ -428,6 +428,7 @@ msginit(dns_message_t *m) {
+ 	m->cc_bad = 0;
+ 	m->tkey = 0;
+ 	m->rdclass_set = 0;
+	m->has_dname = 0;
+ 	m->querytsig = NULL;
+ 	m->indent.string = "\t";
+ 	m->indent.count = 0;
+@@ -1710,6 +1711,11 @@ getsection(isc_buffer_t *source, dns_message_t *msg, dns_decompress_t *dctx,
+ 			 */
+ 			msg->tsigname->attributes |= DNS_NAMEATTR_NOCOMPRESS;
+ 			free_name = false;
+		} else if (rdtype == dns_rdatatype_dname &&
+			   sectionid == DNS_SECTION_ANSWER &&
+			   msg->opcode == dns_opcode_query)
+		{
+			msg->has_dname = 1;
+ 		}
+ 		rdataset = NULL;
+ 
+@@ -4861,3 +4867,9 @@ dns_message_response_minttl(dns_message_t *msg, dns_ttl_t *pttl) {
+ 
+ 	return (ISC_R_SUCCESS);
+ }
+
+bool
+dns_message_hasdname(dns_message_t *msg) {
+	REQUIRE(DNS_MESSAGE_VALID(msg));
+	return msg->has_dname;
+}
+diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
+index 19b9b1a..72d83b6 100644
+--- a/lib/dns/resolver.c
+++ b/lib/dns/resolver.c
+@@ -796,6 +796,7 @@ typedef struct respctx {
+ 	bool get_nameservers; /* get a new NS rrset at
+ 			       * zone cut? */
+ 	bool resend;	      /* resend this query? */
+	bool secured;	      /* message was signed or had a valid cookie */
+ 	bool nextitem;	      /* invalid response; keep
+ 			       * listening for the correct one */
+ 	bool truncated;	      /* response was truncated */
+@@ -6972,7 +6973,8 @@ mark_related(dns_name_t *name, dns_rdataset_t *rdataset, bool external,
+  * locally served zone.
+  */
+ static inline bool
+-name_external(const dns_name_t *name, dns_rdatatype_t type, fetchctx_t *fctx) {
+name_external(const dns_name_t *name, dns_rdatatype_t type, respctx_t *rctx) {
+	fetchctx_t *fctx = rctx->fctx;
+ 	isc_result_t result;
+ 	dns_forwarders_t *forwarders = NULL;
+ 	dns_fixedname_t fixed, zfixed;
+@@ -6985,7 +6987,7 @@ name_external(const dns_name_t *name, dns_rdatatype_t type, fetchctx_t *fctx) {
+ 	dns_namereln_t rel;
+ 
+ 	apex = (ISDUALSTACK(fctx->addrinfo) || !ISFORWARDER(fctx->addrinfo))
+-		       ? fctx->domain
+		       ? rctx->ns_name != NULL ? rctx->ns_name : fctx->domain
+ 		       : fctx->fwdname;
+ 
+ 	/*
+@@ -7094,7 +7096,7 @@ check_section(void *arg, const dns_name_t *addname, dns_rdatatype_t type,
+ 	result = dns_message_findname(rctx->query->rmessage, section, addname,
+ 				      dns_rdatatype_any, 0, &name, NULL);
+ 	if (result == ISC_R_SUCCESS) {
+-		external = name_external(name, type, fctx);
+		external = name_external(name, type, rctx);
+ 		if (type == dns_rdatatype_a) {
+ 			for (rdataset = ISC_LIST_HEAD(name->list);
+ 			     rdataset != NULL;
+@@ -7725,6 +7727,47 @@ betterreferral(respctx_t *rctx) {
+ 	return (false);
+ }
+ 
+static bool
+rctx_need_tcpretry(respctx_t *rctx) {
+	resquery_t *query = rctx->query;
+	if ((rctx->retryopts & DNS_FETCHOPT_TCP) != 0) {
+		/* TCP is already in the retry flags */
+		return false;
+	}
+
+	/*
+	 * If the message was secured, no need to continue.
+	 */
+	if (rctx->secured) {
+		return false;
+	}
+
+	/*
+	 * Currently the only extra reason why we might need to
+	 * retry a UDP response over TCP is a DNAME in the message.
+	 */
+	if (dns_message_hasdname(query->rmessage)) {
+		return true;
+	}
+
+	return false;
+}
+
+static isc_result_t
+rctx_tcpretry(respctx_t *rctx) {
+	/*
+	 * Do we need to retry a UDP response over TCP?
+	 */
+	if (rctx_need_tcpretry(rctx)) {
+		rctx->retryopts |= DNS_FETCHOPT_TCP;
+		rctx->resend = true;
+		rctx_done(rctx, ISC_R_SUCCESS);
+		return ISC_R_COMPLETE;
+	}
+
+	return ISC_R_SUCCESS;
+}
+
+ /*
+  * resquery_response():
+  * Handles responses received in response to iterative queries sent by
+@@ -7914,6 +7957,17 @@ resquery_response(isc_result_t eresult, isc_region_t *region, void *arg) {
+ 		return;
+ 	}
+ 
+	/*
+	 * Remember whether this message was signed or had a
+	 * valid client cookie; if not, we may need to retry over
+	 * TCP later.
+	 */
+	if (query->rmessage->cc_ok || query->rmessage->tsig != NULL ||
+	    query->rmessage->sig0 != NULL)
+	{
+		rctx.secured = true;
+	}
+
+ 	/*
+ 	 * The dispatcher should ensure we only get responses with QR
+ 	 * set.
+@@ -7925,10 +7979,7 @@ resquery_response(isc_result_t eresult, isc_region_t *region, void *arg) {
+ 	 * TCP. This may be a misconfigured anycast server or an attempt
+ 	 * to send a spoofed response.  Skip if we have a valid tsig.
+ 	 */
+-	if (dns_message_gettsig(query->rmessage, NULL) == NULL &&
+-	    !query->rmessage->cc_ok && !query->rmessage->cc_bad &&
+-	    (rctx.retryopts & DNS_FETCHOPT_TCP) == 0)
+-	{
+	if (!rctx.secured && (rctx.retryopts & DNS_FETCHOPT_TCP) == 0) {
+ 		unsigned char cookie[COOKIE_BUFFER_SIZE];
+ 		if (dns_adb_getcookie(fctx->adb, query->addrinfo, cookie,
+ 				      sizeof(cookie)) > CLIENT_COOKIE_SIZE)
+@@ -7940,8 +7991,7 @@ resquery_response(isc_result_t eresult, isc_region_t *region, void *arg) {
+ 				isc_log_write(
+ 					dns_lctx, DNS_LOGCATEGORY_RESOLVER,
+ 					DNS_LOGMODULE_RESOLVER, ISC_LOG_INFO,
+-					"missing expected cookie "
+-					"from %s",
+					"missing expected cookie from %s",
+ 					addrbuf);
+ 			}
+ 			rctx.retryopts |= DNS_FETCHOPT_TCP;
+@@ -7951,6 +8001,17 @@ resquery_response(isc_result_t eresult, isc_region_t *region, void *arg) {
+ 		}
+ 	}
+ 
+	/*
+	 * Check whether we need to retry over TCP for some other reason.
+	 */
+	result = rctx_tcpretry(&rctx);
+	if (result == ISC_R_COMPLETE) {
+		return;
+	}
+
+	/*
+	 * Check for EDNS issues.
+	 */
+ 	rctx_edns(&rctx);
+ 
+ 	/*
+@@ -8733,8 +8794,8 @@ rctx_answer_positive(respctx_t *rctx) {
+ 	}
+ 
+ 	/*
+-	 * Cache records in the authority section, if
+-	 * there are any suitable for caching.
+	 * Cache records in the authority section, if there are
+	 * any suitable for caching.
+ 	 */
+ 	rctx_authority_positive(rctx);
+ 
+@@ -8806,7 +8867,7 @@ rctx_answer_scan(respctx_t *rctx) {
+ 			/*
+ 			 * Don't accept DNAME from parent namespace.
+ 			 */
+-			if (name_external(name, dns_rdatatype_dname, fctx)) {
+			if (name_external(name, dns_rdatatype_dname, rctx)) {
+ 				continue;
+ 			}
+ 
+@@ -9107,14 +9168,14 @@ rctx_answer_dname(respctx_t *rctx) {
+ 
+ /*
+  * rctx_authority_positive():
+- * Examine the records in the authority section (if there are any) for a
+- * positive answer.  We expect the names for all rdatasets in this
+- * section to be subdomains of the domain being queried; any that are
+- * not are skipped.  We expect to find only *one* owner name; any names
+- * after the first one processed are ignored. We expect to find only
+- * rdatasets of type NS, RRSIG, or SIG; all others are ignored. Whatever
+- * remains can be cached at trust level authauthority or additional
+- * (depending on whether the AA bit was set on the answer).
+ * If a positive answer was received over TCP or secured with a cookie
+ * or TSIG, examine the authority section.  We expect names for all
+ * rdatasets in this section to be subdomains of the domain being queried;
+ * any that are not are skipped.  We expect to find only *one* owner name;
+ * any names after the first one processed are ignored. We expect to find
+ * only rdatasets of type NS; all others are ignored. Whatever remains can
+ * be cached at trust level authauthority or additional (depending on
+ * whether the AA bit was set on the answer).
+  */
+ static void
+ rctx_authority_positive(respctx_t *rctx) {
+@@ -9122,6 +9183,11 @@ rctx_authority_positive(respctx_t *rctx) {
+ 	bool done = false;
+ 	isc_result_t result;
+ 
+	/* If it's spoofable, don't cache it. */
+	if (!rctx->secured && (rctx->query->options & DNS_FETCHOPT_TCP) == 0) {
+		return;
+	}
+
+ 	result = dns_message_firstname(rctx->query->rmessage,
+ 				       DNS_SECTION_AUTHORITY);
+ 	while (!done && result == ISC_R_SUCCESS) {
+@@ -9130,7 +9196,9 @@ rctx_authority_positive(respctx_t *rctx) {
+ 		dns_message_currentname(rctx->query->rmessage,
+ 					DNS_SECTION_AUTHORITY, &name);
+ 
+-		if (!name_external(name, dns_rdatatype_ns, fctx)) {
+		if (!name_external(name, dns_rdatatype_ns, rctx) &&
+		    dns_name_issubdomain(fctx->name, name))
+		{
+ 			dns_rdataset_t *rdataset = NULL;
+ 
+ 			/*
+-- 
+2.51.1
+
--- a/SOURCES/bind-9.18-CVE-2025-40780.patch
+++ b/SOURCES/bind-9.18-CVE-2025-40780.patch
@ -0,0 +1,120 @@
+From c7d94eb33a2de5a0f3fdcb4eae7ffdee711cc3e1 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
+Date: Tue, 19 Aug 2025 19:22:18 +0200
+Subject: [PATCH] Use cryptographically-secure pseudo-random generator
+ everywhere
+
+It was discovered in an upcoming academic paper that a xoshiro128**
+internal state can be recovered by an external 3rd party allowing to
+predict UDP ports and DNS IDs in the outgoing queries.  This could lead
+to an attacker spoofing the DNS answers with great efficiency and
+poisoning the DNS cache.
+
+Change the internal random generator to system CSPRNG with buffering to
+avoid excessive syscalls.
+
+Thanks Omer Ben Simhon and Amit Klein of Hebrew University of Jerusalem
+for responsibly reporting this to us.  Very cool research!
+
+(cherry picked from commit cffcab9d5f3e709002f331b72498fcc229786ae2)
+(cherry picked from commit 8330b49fb90bfeae14b47b7983e9459cc2bbaffe)
+---
+ lib/isc/include/isc/random.h |  2 +-
+ lib/isc/random.c             | 14 +++++++-------
+ tests/isc/random_test.c      |  4 +++-
+ 3 files changed, 11 insertions(+), 9 deletions(-)
+
+diff --git a/lib/isc/include/isc/random.h b/lib/isc/include/isc/random.h
+index 1e30d0c..fd55343 100644
+--- a/lib/isc/include/isc/random.h
+++ b/lib/isc/include/isc/random.h
+@@ -20,7 +20,7 @@
+ #include <isc/types.h>
+ 
+ /*! \file isc/random.h
+- * \brief Implements wrapper around a non-cryptographically secure
+ * \brief Implements wrapper around a cryptographically secure
+  * pseudo-random number generator.
+  *
+  */
+diff --git a/lib/isc/random.c b/lib/isc/random.c
+index 7eead66..fb04669 100644
+--- a/lib/isc/random.c
+++ b/lib/isc/random.c
+@@ -85,7 +85,7 @@ static thread_local uint32_t seed[4] = { 0 };
+ 
+ static uint32_t
+ rotl(const uint32_t x, int k) {
+-	return ((x << k) | (x >> (32 - k)));
+	return (x << k) | (x >> (32 - k));
+ }
+ 
+ static uint32_t
+@@ -104,7 +104,7 @@ next(void) {
+ 
+ 	seed[3] = rotl(seed[3], 11);
+ 
+-	return (result_starstar);
+	return result_starstar;
+ }
+ 
+ static thread_local isc_once_t isc_random_once = ISC_ONCE_INIT;
+@@ -128,21 +128,21 @@ uint8_t
+ isc_random8(void) {
+ 	RUNTIME_CHECK(isc_once_do(&isc_random_once, isc_random_initialize) ==
+ 		      ISC_R_SUCCESS);
+-	return (next() & 0xff);
+	return next() & 0xff;
+ }
+ 
+ uint16_t
+ isc_random16(void) {
+ 	RUNTIME_CHECK(isc_once_do(&isc_random_once, isc_random_initialize) ==
+ 		      ISC_R_SUCCESS);
+-	return (next() & 0xffff);
+	return next() & 0xffff;
+ }
+ 
+ uint32_t
+ isc_random32(void) {
+ 	RUNTIME_CHECK(isc_once_do(&isc_random_once, isc_random_initialize) ==
+ 		      ISC_R_SUCCESS);
+-	return (next());
+	return next();
+ }
+ 
+ void
+@@ -174,7 +174,7 @@ isc_random_uniform(uint32_t upper_bound) {
+ 		      ISC_R_SUCCESS);
+ 
+ 	if (upper_bound < 2) {
+-		return (0);
+		return 0;
+ 	}
+ 
+ #if (ULONG_MAX > 0xffffffffUL)
+@@ -202,5 +202,5 @@ isc_random_uniform(uint32_t upper_bound) {
+ 		}
+ 	}
+ 
+-	return (r % upper_bound);
+	return r % upper_bound;
+ }
+diff --git a/tests/isc/random_test.c b/tests/isc/random_test.c
+index 1935846..0016252 100644
+--- a/tests/isc/random_test.c
+++ b/tests/isc/random_test.c
+@@ -321,7 +321,9 @@ random_test(pvalue_func_t *func, isc_random_func test_func) {
+ 			}
+ 			break;
+ 		case ISC_RANDOM_BYTES:
+-			isc_random_buf(values, sizeof(values));
+			for (i = 0; i < ARRAY_SIZE(values); i++) {
+				values[i] = isc_random32();
+			}
+ 			break;
+ 		case ISC_RANDOM_UNIFORM:
+ 			uniform_values = (uint16_t *)values;
+-- 
+2.51.1
+
--- a/SOURCES/bind-9.18-CVE-2025-8677.patch
+++ b/SOURCES/bind-9.18-CVE-2025-8677.patch
@ -0,0 +1,223 @@
+From c30c944e424a6c2281e0b1d53e25fc8ed3f71d41 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
+Date: Tue, 22 Jul 2025 08:07:02 +0200
+Subject: [PATCH] Fail the DNSSEC validation if matching but invalid DNSKEY is
+ found
+
+If a matching but cryptographically invalid key was encountered during
+the DNSSEC validation, the key would be just skipped and not counted
+towards validation failures.  Treat such DNSSEC keys as hard failures
+and fail the DNSSEC validation immediatelly instead of continuing the
+DNSSEC validation with the next DNSKEYs in the RRset.
+
+Co-authored-by: Matthijs Mekking <matthijs@isc.org>
+
+(cherry picked from commit f00117a4226be90d1bc865aff19bddf114242914)
+(cherry picked from commit 7c5b8ef055900224f0424c341927562c5a9ebe19)
+
+Fix an issue with selfsigned_dnskey() return value
+
+The selfsigned_dnskey() function currently returns boolean. There
+was a recent change to make it return a isc_result_t error code,
+which is implicitly converted to bool, which is obviously an error.
+
+If instead of the result code we return true/false, it still doesn't
+indicate the error to the caller that has happened before.
+
+Change the function to return isc_result_t, and change the caller
+routine to process the new return type.
+
+(cherry picked from commit 40c396ba2d955c32d70db04e900e40bf96519c59)
+---
+ lib/dns/validator.c | 79 +++++++++++++++++++++++++++++----------------
+ 1 file changed, 51 insertions(+), 28 deletions(-)
+
+diff --git a/lib/dns/validator.c b/lib/dns/validator.c
+index 696a464..1d84b75 100644
+--- a/lib/dns/validator.c
+++ b/lib/dns/validator.c
+@@ -431,6 +431,8 @@ fetch_callback_dnskey(isc_task_t *task, isc_event_t *event) {
+ 			result = select_signing_key(val, rdataset);
+ 			if (result == ISC_R_SUCCESS) {
+ 				val->keyset = &val->frdataset;
+			} else {
+				val->failed = true;
+ 			}
+ 		}
+ 		result = validate_answer(val, true);
+@@ -1161,6 +1163,8 @@ select_signing_key(dns_validator_t *val, dns_rdataset_t *rdataset) {
+ 				goto done;
+ 			}
+ 			dst_key_free(&val->key);
+		} else {
+			break;
+ 		}
+ 		dns_rdata_reset(&rdata);
+ 		result = dns_rdataset_next(rdataset);
+@@ -1285,13 +1289,15 @@ seek_dnskey(dns_validator_t *val) {
+ 				      "keyset with trust %s",
+ 				      dns_trust_totext(val->frdataset.trust));
+ 			result = select_signing_key(val, val->keyset);
+-			if (result != ISC_R_SUCCESS) {
+			if (result == ISC_R_NOTFOUND) {
+ 				/*
+-				 * Either the key we're looking for is not
+-				 * in the rrset, or something bad happened.
+-				 * Give up.
+				 * The key we're looking for is not
+				 * in the rrset
+ 				 */
+ 				result = DNS_R_CONTINUE;
+			} else if (result != ISC_R_SUCCESS) {
+				/* Something bad happened. Give up. */
+				break;
+ 			}
+ 		}
+ 		break;
+@@ -1352,17 +1358,17 @@ compute_keytag(dns_rdata_t *rdata) {
+ /*%
+  * Is the DNSKEY rrset in val->event->rdataset self-signed?
+  */
+-static bool
+static isc_result_t
+ selfsigned_dnskey(dns_validator_t *val) {
+ 	dns_rdataset_t *rdataset = val->event->rdataset;
+ 	dns_rdataset_t *sigrdataset = val->event->sigrdataset;
+ 	dns_name_t *name = val->event->name;
+ 	isc_result_t result;
+ 	isc_mem_t *mctx = val->view->mctx;
+-	bool answer = false;
+	bool match = false;
+ 
+ 	if (rdataset->type != dns_rdatatype_dnskey) {
+-		return (false);
+		return DNS_R_NOKEYMATCH;
+ 	}
+ 
+ 	for (result = dns_rdataset_first(rdataset); result == ISC_R_SUCCESS;
+@@ -1384,8 +1390,6 @@ selfsigned_dnskey(dns_validator_t *val) {
+ 		     result == ISC_R_SUCCESS;
+ 		     result = dns_rdataset_next(sigrdataset))
+ 		{
+-			dst_key_t *dstkey = NULL;
+-
+ 			dns_rdata_reset(&sigrdata);
+ 			dns_rdataset_current(sigrdataset, &sigrdata);
+ 			result = dns_rdata_tostruct(&sigrdata, &sig, NULL);
+@@ -1400,18 +1404,16 @@ selfsigned_dnskey(dns_validator_t *val) {
+ 
+ 			/*
+ 			 * If the REVOKE bit is not set we have a
+-			 * theoretically self signed DNSKEY RRset.
+-			 * This will be verified later.
+			 * theoretically self-signed DNSKEY RRset;
+			 * this will be verified later.
+			 *
+			 * We don't return the answer yet, though,
+			 * because we need to check the remaining keys
+			 * and possbly remove them if they're revoked.
+ 			 */
+ 			if ((key.flags & DNS_KEYFLAG_REVOKE) == 0) {
+-				answer = true;
+-				continue;
+-			}
+-
+-			result = dns_dnssec_keyfromrdata(name, &keyrdata, mctx,
+-							 &dstkey);
+-			if (result != ISC_R_SUCCESS) {
+-				continue;
+				match = true;
+				break;
+ 			}
+ 
+ 			/*
+@@ -1421,6 +1423,14 @@ selfsigned_dnskey(dns_validator_t *val) {
+ 			if (DNS_TRUST_PENDING(rdataset->trust) &&
+ 			    dns_view_istrusted(val->view, name, &key))
+ 			{
+				dst_key_t *dstkey = NULL;
+
+				result = dns_dnssec_keyfromrdata(
+					name, &keyrdata, mctx, &dstkey);
+				if (result != ISC_R_SUCCESS) {
+					break;
+				}
+
+ 				result = dns_dnssec_verify(
+ 					name, rdataset, dstkey, true,
+ 					val->view->maxbits, mctx, &sigrdata,
+@@ -1433,6 +1443,8 @@ selfsigned_dnskey(dns_validator_t *val) {
+ 					 */
+ 					dns_view_untrust(val->view, name, &key);
+ 				}
+
+				dst_key_free(&dstkey);
+ 			} else if (rdataset->trust >= dns_trust_secure) {
+ 				/*
+ 				 * We trust this RRset so if the key is
+@@ -1440,12 +1452,14 @@ selfsigned_dnskey(dns_validator_t *val) {
+ 				 */
+ 				dns_view_untrust(val->view, name, &key);
+ 			}
+-
+-			dst_key_free(&dstkey);
+ 		}
+ 	}
+ 
+-	return (answer);
+	if (!match) {
+		return DNS_R_NOKEYMATCH;
+	}
+
+	return ISC_R_SUCCESS;
+ }
+ 
+ /*%
+@@ -1680,10 +1694,7 @@ check_signer(dns_validator_t *val, dns_rdata_t *keyrdata, uint16_t keyid,
+ 				val->event->name, keyrdata, val->view->mctx,
+ 				&dstkey);
+ 			if (result != ISC_R_SUCCESS) {
+-				/*
+-				 * This really shouldn't happen, but...
+-				 */
+-				continue;
+				return result;
+ 			}
+ 		}
+ 		result = verify(val, dstkey, &rdata, sig.keyid);
+@@ -3064,11 +3075,22 @@ validator_start(isc_task_t *task, isc_event_t *event) {
+ 
+ 		INSIST(dns_rdataset_isassociated(val->event->rdataset));
+ 		INSIST(dns_rdataset_isassociated(val->event->sigrdataset));
+-		if (selfsigned_dnskey(val)) {
+
+		result = selfsigned_dnskey(val);
+		switch (result) {
+		case ISC_R_SUCCESS:
+ 			result = validate_dnskey(val);
+-		} else {
+			break;
+		case DNS_R_NOKEYMATCH:
+ 			result = validate_answer(val, false);
+			break;
+		default:
+			validator_log(val, ISC_LOG_INFO,
+				      "invalid selfsigned DNSKEY: %s",
+				      isc_result_totext(result));
+			goto cleanup;
+ 		}
+
+ 		if (result == DNS_R_NOVALIDSIG &&
+ 		    (val->attributes & VALATTR_TRIEDVERIFY) == 0)
+ 		{
+@@ -3137,6 +3159,7 @@ validator_start(isc_task_t *task, isc_event_t *event) {
+ 		UNREACHABLE();
+ 	}
+ 
+cleanup:
+ 	if (result != DNS_R_WAIT) {
+ 		want_destroy = exit_check(val);
+ 		validator_done(val, result);
+-- 
+2.51.1
+
--- a/SOURCES/bind-9.18-CVE-2026-1519-test.patch
+++ b/SOURCES/bind-9.18-CVE-2026-1519-test.patch
@ -0,0 +1,337 @@
+From 7df00188c93d1fb8496328976e00192dd657d5aa Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Nicki=20K=C5=99=C3=AD=C5=BEek?= <nicki@isc.org>
+Date: Tue, 3 Feb 2026 18:25:04 +0100
+Subject: [PATCH] Reproducer for CVE-2026-1519
+
+When a validating resolver processes a delegation from a DNSSEC-signed
+zone which uses too many NSEC3 iterations, it should cease the attempt
+to validate due to an NSEC3 iteration limit being exceeded and fall back
+to insecure.
+
+(cherry picked from commit 9bc14a89f1313aa38330e84674ac3b7691db3383)
+(cherry picked from commit 2c82f99a3c95f356861d5977f12ef9bbe2063cb6)
+---
+ .../system/nsec3-delegation/ns1/named.conf.j2 | 35 +++++++++++
+ bin/tests/system/nsec3-delegation/ns1/root.db | 25 ++++++++
+ .../ns2/iter-too-many.db.j2.manual            | 31 ++++++++++
+ .../system/nsec3-delegation/ns2/named.conf.j2 | 40 ++++++++++++
+ .../nsec3-delegation/ns2/sub.iter-too-many.db | 24 ++++++++
+ .../system/nsec3-delegation/ns3/named.conf.j2 | 37 +++++++++++
+ .../nsec3-delegation/ns3/trusted.conf.j2      |  1 +
+ .../tests_excessive_nsec3_iterations.py       | 61 +++++++++++++++++++
+ 8 files changed, 254 insertions(+)
+ create mode 100644 bin/tests/system/nsec3-delegation/ns1/named.conf.j2
+ create mode 100644 bin/tests/system/nsec3-delegation/ns1/root.db
+ create mode 100644 bin/tests/system/nsec3-delegation/ns2/iter-too-many.db.j2.manual
+ create mode 100644 bin/tests/system/nsec3-delegation/ns2/named.conf.j2
+ create mode 100644 bin/tests/system/nsec3-delegation/ns2/sub.iter-too-many.db
+ create mode 100644 bin/tests/system/nsec3-delegation/ns3/named.conf.j2
+ create mode 120000 bin/tests/system/nsec3-delegation/ns3/trusted.conf.j2
+ create mode 100644 bin/tests/system/nsec3-delegation/tests_excessive_nsec3_iterations.py
+
+diff --git a/bin/tests/system/nsec3-delegation/ns1/named.conf.j2 b/bin/tests/system/nsec3-delegation/ns1/named.conf.j2
+new file mode 100644
+index 0000000000..65016d1c67
+--- /dev/null
+++ b/bin/tests/system/nsec3-delegation/ns1/named.conf.j2
+@@ -0,0 +1,35 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+	query-source address 10.53.0.1;
+	notify-source 10.53.0.1;
+	transfer-source 10.53.0.1;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.1; };
+	listen-on-v6 { none; };
+	recursion no;
+	dnssec-validation no;
+};
+
+controls {
+	inet 10.53.0.1 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+include "../../_common/rndc.key";
+
+zone "." {
+	type primary;
+	file "root.db";
+};
+diff --git a/bin/tests/system/nsec3-delegation/ns1/root.db b/bin/tests/system/nsec3-delegation/ns1/root.db
+new file mode 100644
+index 0000000000..c3f80d0d4b
+--- /dev/null
+++ b/bin/tests/system/nsec3-delegation/ns1/root.db
+@@ -0,0 +1,25 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300
+.			IN SOA	. . (
+				2025063000	; serial
+				600		; refresh
+				600		; retry
+				1200		; expire
+				600		; minimum
+				)
+.			NS	a.root-servers.nil.
+
+a.root-servers.nil	A	10.53.0.1
+
+iter-too-many.		NS	ns2.iter-too-many.
+ns2.iter-too-many.	A	10.53.0.2
+diff --git a/bin/tests/system/nsec3-delegation/ns2/iter-too-many.db.j2.manual b/bin/tests/system/nsec3-delegation/ns2/iter-too-many.db.j2.manual
+new file mode 100644
+index 0000000000..fa5023d21b
+--- /dev/null
+++ b/bin/tests/system/nsec3-delegation/ns2/iter-too-many.db.j2.manual
+@@ -0,0 +1,31 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+{% raw %}
+$TTL 300
+@			IN SOA	ns2.iter-too-many. hostmaster.iter-too-many. (
+				2026020300	; serial
+				20		; refresh (20 seconds)
+				20		; retry (20 seconds)
+				1814400		; expire (3 weeks)
+				3600		; minimum (1 hour)
+)
+
+@	IN	NS	ns2.iter-too-many.
+ns2	IN	A	10.53.0.2
+
+sub	IN	NS	ns2.sub.iter-too-many.
+ns2.sub	IN	A	10.53.0.2
+{% endraw %}
+
+{% for dnskey in dnskeys %}
+@dnskey@
+{% endfor %}
+diff --git a/bin/tests/system/nsec3-delegation/ns2/named.conf.j2 b/bin/tests/system/nsec3-delegation/ns2/named.conf.j2
+new file mode 100644
+index 0000000000..2f4823574f
+--- /dev/null
+++ b/bin/tests/system/nsec3-delegation/ns2/named.conf.j2
+@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+	query-source address 10.53.0.2;
+	notify-source 10.53.0.2;
+	transfer-source 10.53.0.2;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.2; };
+	listen-on-v6 { none; };
+	recursion no;
+	dnssec-validation no;
+};
+
+controls {
+	inet 10.53.0.2 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+include "../../_common/rndc.key";
+
+zone "iter-too-many" {
+	type primary;
+	file "iter-too-many.signed.db";
+};
+
+zone "sub.iter-too-many" {
+	type primary;
+	file "sub.iter-too-many.db";
+};
+diff --git a/bin/tests/system/nsec3-delegation/ns2/sub.iter-too-many.db b/bin/tests/system/nsec3-delegation/ns2/sub.iter-too-many.db
+new file mode 100644
+index 0000000000..09b2bb6fb3
+--- /dev/null
+++ b/bin/tests/system/nsec3-delegation/ns2/sub.iter-too-many.db
+@@ -0,0 +1,24 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300
+@			IN SOA	ns2.sub.iter-too-many. hostmaster.sub.iter-too-many. (
+				2026020300	; serial
+				20		; refresh (20 seconds)
+				20		; retry (20 seconds)
+				1814400		; expire (3 weeks)
+				3600		; minimum (1 hour)
+)
+
+@	IN	NS	ns2.sub.iter-too-many.
+ns2	IN	A	10.53.0.2
+
+example	IN	A	127.0.0.1
+diff --git a/bin/tests/system/nsec3-delegation/ns3/named.conf.j2 b/bin/tests/system/nsec3-delegation/ns3/named.conf.j2
+new file mode 100644
+index 0000000000..e36b88c53e
+--- /dev/null
+++ b/bin/tests/system/nsec3-delegation/ns3/named.conf.j2
+@@ -0,0 +1,37 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+	query-source address 10.53.0.3;
+	notify-source 10.53.0.3;
+	transfer-source 10.53.0.3;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.3; };
+	listen-on-v6 { none; };
+	recursion yes;
+	dnssec-validation yes;
+};
+
+controls {
+	inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+include "../../_common/rndc.key";
+
+zone "." {
+	type hint;
+	file "../../_common/root.hint";
+};
+
+include "trusted.conf";
+diff --git a/bin/tests/system/nsec3-delegation/ns3/trusted.conf.j2 b/bin/tests/system/nsec3-delegation/ns3/trusted.conf.j2
+new file mode 120000
+index 0000000000..cb0be77b22
+--- /dev/null
+++ b/bin/tests/system/nsec3-delegation/ns3/trusted.conf.j2
+@@ -0,0 +1 @@
+../../_common/trusted.conf.j2
+\ No newline at end of file
+diff --git a/bin/tests/system/nsec3-delegation/tests_excessive_nsec3_iterations.py b/bin/tests/system/nsec3-delegation/tests_excessive_nsec3_iterations.py
+new file mode 100644
+index 0000000000..f85384bb1e
+--- /dev/null
+++ b/bin/tests/system/nsec3-delegation/tests_excessive_nsec3_iterations.py
+@@ -0,0 +1,61 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+from isctest.run import EnvCmd
+
+import isctest
+
+
+def bootstrap():
+    templates = isctest.template.TemplateEngine(".")
+    keygen = EnvCmd("KEYGEN", "-a ECDSA256")
+    signer = EnvCmd("SIGNER")
+
+    isctest.log.info("setup iter-too-many.")
+    zonename = "iter-too-many."
+    ksk_name = keygen(f"-f KSK {zonename}", cwd="ns2").out.strip()
+    zsk_name = keygen(f"{zonename}", cwd="ns2").out.strip()
+    ksk = isctest.kasp.Key(ksk_name, keydir="ns2")
+    zsk = isctest.kasp.Key(zsk_name, keydir="ns2")
+    dnskeys = [ksk.dnskey, zsk.dnskey]
+
+    tdata = {
+        "dnskeys": dnskeys,
+    }
+    templates.render(f"ns2/{zonename}db", tdata, template=f"ns2/{zonename}db.j2.manual")
+    signer(
+        f"-P -o {zonename} -f {zonename}signed.db -3 A1B2C3D4 -H too-many -H 151 -S {zonename}db",
+        cwd="ns2",
+    )
+
+    return {
+        "trust_anchors": [
+            ksk.into_ta("static-key"),
+        ],
+    }
+
+
+def test_excessive_nsec3_iterations_delegation(ns3):
+    # reproducer for CVE-2026-1519 [GL#5708]
+    zone = "example.sub.iter-too-many"
+    msg = isctest.query.create(zone, "A")
+    res = isctest.query.tcp(msg, ns3.ip)
+
+    # an insecure response is expected regardless of the NSEC3 iteration limit,
+    # because the sub.iter-too-many. zone is unsigned. the real difference is
+    # in the CPU usage required for generating such response, but that can't be
+    # easily and reliably tested in an automated fashion
+    isctest.check.noerror(res)
+
+    with ns3.watch_log_from_start() as watcher:
+        watcher.wait_for_line(
+            f"validating {zone}/A: validator_callback_ds: too many iterations"
+        )
+-- 
+2.53.0
+
--- a/SOURCES/bind-9.18-CVE-2026-1519.patch
+++ b/SOURCES/bind-9.18-CVE-2026-1519.patch
@ -0,0 +1,259 @@
+From ca79e7575d281e3859afce73ac3276771ce7edbf Mon Sep 17 00:00:00 2001
+From: Matthijs Mekking <matthijs@isc.org>
+Date: Tue, 3 Mar 2026 10:40:36 +0100
+Subject: [PATCH] Check iterations in isdelegation()
+
+When looking up an NSEC3 as part of an insecurity proof, check the
+number of iterations. If this is too high, treat the answer as insecure
+by marking the answer with trust level "answer", indicating that they
+did not validate, but could be cached as insecure.
+
+(cherry picked from commit 988040a5e02f86f4a8cdb0704e8d501f9082a89c)
+(cherry picked from commit 85c21feff9acb0982fe60f2c88201bf55533bd0e)
+
+Don't verify already trusted rdatasets
+
+If we already marked an rdataset as secure (or it has even stronger
+trust), there is no need to cryptographically verify it again.
+
+(cherry picked from commit 0ec08c212022d08c9717f2bc6bd3e8ebd6f034ce)
+(cherry picked from commit 8890a91c1c16129333139b9d8a4381e0f741f0d6)
+
+Check RRset trust in validate_neg_rrset()
+
+In many places we only create a validator if the RRset has too low
+trust (the RRset is pending validation, or could not be validated
+before). This check was missing prior to validating negative response
+data.
+
+(cherry picked from commit 6ca67f65cd685cf8699540a852c1e3775bd48d64)
+(cherry picked from commit 85fcd704e2f7cc2a25d2195bc4bb28398c889ed3)
+---
+ lib/dns/include/dns/types.h |  1 +
+ lib/dns/validator.c         | 91 ++++++++++++++++++++++++++++---------
+ 2 files changed, 70 insertions(+), 22 deletions(-)
+
+diff --git a/lib/dns/include/dns/types.h b/lib/dns/include/dns/types.h
+index f0aaa24..a945f0e 100644
+--- a/lib/dns/include/dns/types.h
+++ b/lib/dns/include/dns/types.h
+@@ -353,6 +353,7 @@ enum {
+ 	((x) == dns_trust_additional || (x) == dns_trust_pending_additional)
+ #define DNS_TRUST_GLUE(x)   ((x) == dns_trust_glue)
+ #define DNS_TRUST_ANSWER(x) ((x) == dns_trust_answer)
+#define DNS_TRUST_SECURE(x) ((x) >= dns_trust_secure)
+ 
+ /*%
+  * Name checking severities.
+diff --git a/lib/dns/validator.c b/lib/dns/validator.c
+index 5bc0b40..ae98b5f 100644
+--- a/lib/dns/validator.c
+++ b/lib/dns/validator.c
+@@ -252,12 +252,25 @@ exit_check(dns_validator_t *val) {
+ }
+ 
+ /*%
+- * Look in the NSEC record returned from a DS query to see if there is
+- * a NS RRset at this name.  If it is found we are at a delegation point.
+ * The isdelegation() function is called as part of seeking the DS record.
+ * Look in the NSEC or NSEC3 record returned from a DS query to see if the
+ * record has the NS bitmap set. If so, we are at a delegation point.
+ *
+ * If the response contains NSEC3 records with too high iterations, we cannot
+ * (or rather we are not going to) validate the insecurity proof. Instead we
+ * are going to treat the message as insecure and just assume the DS was at
+ * the delegation.
+ *
+ * Returns:
+ *\li	#ISC_R_SUCCESS	the NS bitmap was set in the NSEC or NSEC3 record, or
+ *			the NSEC3 covers the name (in case of opt-out), or
+ *			we cannot validate the insecurity proof and are going
+ *			to treat the message as isnecure.
+ *\li	#ISC_R_NOTFOUND the NS bitmap was not set,
+  */
+-static bool
+-isdelegation(dns_name_t *name, dns_rdataset_t *rdataset,
+-	     isc_result_t dbresult) {
+static isc_result_t
+isdelegation(dns_validator_t *val, dns_name_t *name, dns_rdataset_t *rdataset,
+	     isc_result_t dbresult, const char *caller) {
+ 	dns_fixedname_t fixed;
+ 	dns_label_t hashlabel;
+ 	dns_name_t nsec3name;
+@@ -285,7 +298,7 @@ isdelegation(dns_name_t *name, dns_rdataset_t *rdataset,
+ 			goto trynsec3;
+ 		}
+ 		if (result != ISC_R_SUCCESS) {
+-			return (false);
+			return ISC_R_NOTFOUND;
+ 		}
+ 	}
+ 
+@@ -299,7 +312,7 @@ isdelegation(dns_name_t *name, dns_rdataset_t *rdataset,
+ 		dns_rdata_reset(&rdata);
+ 	}
+ 	dns_rdataset_disassociate(&set);
+-	return (found);
+	return found ? ISC_R_SUCCESS : ISC_R_NOTFOUND;
+ 
+ trynsec3:
+ 	/*
+@@ -335,6 +348,18 @@ trynsec3:
+ 			if (nsec3.hash != 1) {
+ 				continue;
+ 			}
+			/*
+			 * If there are too many iterations assume bad things
+			 * are happening and bail out early. Treat as if the
+			 * DS was at the delegation.
+			 */
+			if (nsec3.iterations > DNS_NSEC3_MAXITERATIONS) {
+				validator_log(val, ISC_LOG_DEBUG(3),
+					      "%s: too many iterations",
+					      caller);
+				dns_rdataset_disassociate(&set);
+				return ISC_R_SUCCESS;
+			}
+ 			length = isc_iterated_hash(
+ 				hash, nsec3.hash, nsec3.iterations, nsec3.salt,
+ 				nsec3.salt_length, name->ndata, name->length);
+@@ -346,7 +371,7 @@ trynsec3:
+ 				found = dns_nsec3_typepresent(&rdata,
+ 							      dns_rdatatype_ns);
+ 				dns_rdataset_disassociate(&set);
+-				return (found);
+				return found ? ISC_R_SUCCESS : ISC_R_NOTFOUND;
+ 			}
+ 			if ((nsec3.flags & DNS_NSEC3FLAG_OPTOUT) == 0) {
+ 				continue;
+@@ -362,12 +387,12 @@ trynsec3:
+ 			      memcmp(hash, nsec3.next, length) < 0)))
+ 			{
+ 				dns_rdataset_disassociate(&set);
+-				return (true);
+				return ISC_R_SUCCESS;
+ 			}
+ 		}
+ 		dns_rdataset_disassociate(&set);
+ 	}
+-	return (found);
+	return found ? ISC_R_SUCCESS : ISC_R_NOTFOUND;
+ }
+ 
+ /*%
+@@ -583,8 +608,9 @@ fetch_callback_ds(isc_task_t *task, isc_event_t *event) {
+ 		} else if (eresult == DNS_R_SERVFAIL) {
+ 			goto unexpected;
+ 		} else if (eresult != DNS_R_CNAME &&
+-			   isdelegation(devent->foundname, &val->frdataset,
+-					eresult))
+			   isdelegation(val, devent->foundname, &val->frdataset,
+					eresult,
+					"fetch_callback_ds") == ISC_R_SUCCESS)
+ 		{
+ 			/*
+ 			 * Failed to find a DS while trying to prove
+@@ -744,10 +770,13 @@ validator_callback_ds(isc_task_t *task, isc_event_t *event) {
+ 			      dns_trust_totext(val->frdataset.trust));
+ 		have_dsset = (val->frdataset.type == dns_rdatatype_ds);
+ 		name = dns_fixedname_name(&val->fname);
+
+ 		if ((val->attributes & VALATTR_INSECURITY) != 0 &&
+ 		    val->frdataset.covers == dns_rdatatype_ds &&
+ 		    NEGATIVE(&val->frdataset) &&
+-		    isdelegation(name, &val->frdataset, DNS_R_NCACHENXRRSET))
+		    isdelegation(val, name, &val->frdataset,
+				 DNS_R_NCACHENXRRSET,
+				 "validator_callback_ds") == ISC_R_SUCCESS)
+ 		{
+ 			result = markanswer(val, "validator_callback_ds",
+ 					    "no DS and this is a delegation");
+@@ -1485,6 +1514,13 @@ verify(dns_validator_t *val, dst_key_t *key, dns_rdata_t *rdata,
+ 	bool ignore = false;
+ 	dns_name_t *wild;
+ 
+	if (DNS_TRUST_SECURE(val->event->rdataset->trust)) {
+		/*
+		 * This RRset was already verified before.
+		 */
+		return ISC_R_SUCCESS;
+	}
+
+ 	val->attributes |= VALATTR_TRIEDVERIFY;
+ 	wild = dns_fixedname_initname(&fixed);
+ again:
+@@ -2425,6 +2461,17 @@ validate_neg_rrset(dns_validator_t *val, dns_name_t *name,
+ 		}
+ 	}
+ 
+	if (rdataset->type != dns_rdatatype_nsec &&
+	    DNS_TRUST_SECURE(rdataset->trust))
+	{
+		/*
+		 * The negative response data is already verified.
+		 * We skip NSEC records, because they require special
+		 * processing in validator_callback_nsec().
+		 */
+		return DNS_R_CONTINUE;
+	}
+
+ 	val->currentset = rdataset;
+ 	result = create_validator(val, name, rdataset->type, rdataset,
+ 				  sigrdataset, validator_callback_nsec,
+@@ -2535,11 +2582,9 @@ validate_ncache(dns_validator_t *val, bool resume) {
+ 		}
+ 
+ 		result = validate_neg_rrset(val, name, rdataset, sigrdataset);
+-		if (result == DNS_R_CONTINUE) {
+-			continue;
+		if (result != DNS_R_CONTINUE) {
+			return result;
+ 		}
+-
+-		return (result);
+ 	}
+ 	if (result == ISC_R_NOMORE) {
+ 		result = ISC_R_SUCCESS;
+@@ -2566,7 +2611,7 @@ validate_nx(dns_validator_t *val, bool resume) {
+ 	isc_result_t result;
+ 
+ 	if (resume) {
+-		validator_log(val, ISC_LOG_DEBUG(3), "resuming validate_nx");
+		validator_log(val, ISC_LOG_DEBUG(3), "%s: resuming validate_nx", __func__);
+ 	}
+ 
+ 	if (val->event->message == NULL) {
+@@ -2588,7 +2633,7 @@ validate_nx(dns_validator_t *val, bool resume) {
+ 			result = findnsec3proofs(val);
+ 			if (result == DNS_R_NSEC3ITERRANGE) {
+ 				validator_log(val, ISC_LOG_DEBUG(3),
+-					      "too many iterations");
+					      "%s: too many iterations", __func__);
+ 				markanswer(val, "validate_nx (3)", NULL);
+ 				return (ISC_R_SUCCESS);
+ 			}
+@@ -2624,7 +2669,7 @@ validate_nx(dns_validator_t *val, bool resume) {
+ 		result = findnsec3proofs(val);
+ 		if (result == DNS_R_NSEC3ITERRANGE) {
+ 			validator_log(val, ISC_LOG_DEBUG(3),
+-				      "too many iterations");
+				      "%s: too many iterations", __func__);
+ 			markanswer(val, "validate_nx (4)", NULL);
+ 			return (ISC_R_SUCCESS);
+ 		}
+@@ -2841,8 +2886,10 @@ seek_ds(dns_validator_t *val, isc_result_t *resp) {
+ 			return (ISC_R_COMPLETE);
+ 		}
+ 
+-		if (isdelegation(tname, &val->frdataset, result)) {
+-			*resp = markanswer(val, "proveunsecure (4)",
+		result = isdelegation(val, tname, &val->frdataset, result,
+				      "seek_ds");
+		if (result == ISC_R_SUCCESS) {
+			*resp = markanswer(val, "seek_ds (3)",
+ 					   "this is a delegation");
+ 			return (ISC_R_COMPLETE);
+ 		}
+-- 
+2.53.0
+
--- a/SOURCES/bind-9.18-nsupdate-TLS-doc.patch
+++ b/SOURCES/bind-9.18-nsupdate-TLS-doc.patch
@ -0,0 +1,114 @@
+From 146811cdc40459129b20df9b3bb31bd152570b72 Mon Sep 17 00:00:00 2001
+From: Aram Sargsyan <aram@isc.org>
+Date: Wed, 21 Sep 2022 15:05:11 +0000
+Subject: [PATCH 2/3] Document nsupdate options related to DoT
+
+Add documentation for the newly implemented DoT feature of the
+nsupdate program.
+
+(cherry picked from commit bd8299d7b501234263a6aee98049f879b1c700b7)
+---
+ bin/nsupdate/nsupdate.rst | 48 ++++++++++++++++++++++++++++++++++++++-
+ 1 file changed, 47 insertions(+), 1 deletion(-)
+
+diff --git a/bin/nsupdate/nsupdate.rst b/bin/nsupdate/nsupdate.rst
+index 81bb4815cf4..f1ab5c76fa7 100644
+--- a/bin/nsupdate/nsupdate.rst
+++ b/bin/nsupdate/nsupdate.rst
+@@ -19,7 +19,7 @@ nsupdate - dynamic DNS update utility
+ Synopsis
+ ~~~~~~~~
+ 
+-:program:`nsupdate` [**-d**] [**-D**] [**-i**] [**-L** level] [ [**-g**] | [**-o**] | [**-l**] | [**-y** [hmac:]keyname:secret] | [**-k** keyfile] ] [**-t** timeout] [**-u** udptimeout] [**-r** udpretries] [**-v**] [**-T**] [**-P**] [**-V**] [ [**-4**] | [**-6**] ] [filename]
+:program:`nsupdate` [**-d**] [**-D**] [**-i**] [**-L** level] [ [**-g**] | [**-o**] | [**-l**] | [**-y** [hmac:]keyname:secret] | [**-k** keyfile] ] [ [**-S**] [**-K** tlskeyfile] [**-E** tlscertfile] [**-A** tlscafile] [**-H** tlshostname] [-O] ] [**-t** timeout] [**-u** udptimeout] [**-r** udpretries] [**-v**] [**-T**] [**-P**] [**-V**] [ [**-4**] | [**-6**] ] [filename]
+ 
+ Description
+ ~~~~~~~~~~~
+@@ -71,6 +71,15 @@ Options
+ 
+    This option sets use of IPv6 only.
+ 
+.. option:: -A tlscafile
+
+   This option specifies the file of the certificate authorities (CA) certificates
+   (in PEM format) in order to verify the remote server TLS certificate when
+   using DNS-over-TLS (DoT), to achieve Strict or Mutual TLS. When used, it will
+   override the certificates from the global certificates store, which are
+   otherwise used by default when :option:`-S` is enabled. This option can not
+   be used in conjuction with :option:`-O`, and it implies :option:`-S`.
+
+ .. option:: -C
+ 
+    Overrides the default `resolv.conf` file. This is only intended for testing.
+@@ -84,10 +93,23 @@ Options
+ 
+    This option sets extra debug mode.
+ 
+.. option:: -E tlscertfile
+
+   This option sets the certificate(s) file for authentication for the
+   DNS-over-TLS (DoT) transport to the remote server. The certificate
+   chain file is expected to be in PEM format. This option implies :option:`-S`,
+   and can only be used with :option:`-K`.
+
+ .. option:: -g
+ 
+    This option enables standard GSS-TSIG mode.
+ 
+.. option:: -H tlshostname
+
+   This option makes :program:`nsupdate` use the provided hostname during remote
+   server TLS certificate verification. Otherwise, the DNS server name
+   is used. This option implies :option:`-S`.
+
+ .. option:: -i
+ 
+    This option forces interactive mode, even when standard input is not a terminal.
+@@ -104,6 +126,13 @@ Options
+    key used to authenticate Dynamic DNS update requests. In this case,
+    the key specified is not an HMAC-MD5 key.
+ 
+.. option:: -K tlskeyfile
+
+   This option sets the key file for authenticated encryption for the
+   DNS-over-TLS (DoT) transport with the remote server. The private key file is
+   expected to be in PEM format. This option implies :option:`-S`, and can only
+   be used with :option:`-E`.
+
+ .. option:: -l
+ 
+    This option sets local-host only mode, which sets the server address to localhost
+@@ -123,6 +152,14 @@ Options
+    This option enables a non-standards-compliant variant of GSS-TSIG
+    used by Windows 2000.
+ 
+.. option:: -O
+
+   This option enables Opportunistic TLS. When used, the remote peer's TLS
+   certificate will not be verified. This option should be used for debugging
+   purposes only, and it is not recommended to use it in production. This
+   option can not be used in conjuction with :option:`-A`, and it implies
+   :option:`-S`.
+
+ .. option:: -p port
+ 
+    This option sets the port to use for connections to a name server. The default is
+@@ -138,6 +175,15 @@ Options
+    This option sets the number of UDP retries. The default is 3. If zero, only one update
+    request is made.
+ 
+.. option:: -S
+
+   This option indicates whether to use DNS-over-TLS (DoT) when querying
+   name servers specified by ``server servername port`` syntax in the input
+   file, and the primary server discovered through a SOA request. When the
+   :option:`-K` and :option:`-E` options are used, then the specified TLS
+   client certificate and private key pair are used for authentication
+   (Mutual TLS). This option implies :option:`-v`.
+
+ .. option:: -t timeout
+ 
+    This option sets the maximum time an update request can take before it is aborted. The
+-- 
+2.48.1
+
--- a/SOURCES/bind-9.18-nsupdate-TLS-tests.patch
+++ b/SOURCES/bind-9.18-nsupdate-TLS-tests.patch
--- a/SOURCES/bind-9.18-nsupdate-TLS.patch
+++ b/SOURCES/bind-9.18-nsupdate-TLS.patch
--- a/SOURCES/bind-9.18-query-fname-relative.patch
+++ b/SOURCES/bind-9.18-query-fname-relative.patch
@ -0,0 +1,90 @@
+From 5bc7cd7a7b9c37e5c70ccf74c5485a02411aaef5 Mon Sep 17 00:00:00 2001
+From: Petr Mensik <pemensik@redhat.com>
+Date: Fri, 25 Apr 2025 02:00:00 +0200
+Subject: [PATCH] Insert additional checks ensuring name is not relative
+
+Mitigation for crashes put in various places, where obviously relative
+uninitialized name must not appear. This seems unnecessary once true
+cause were identified, but may prevent similar places.
+---
+ lib/ns/query.c | 35 +++++++++++++++++++++++++++++++++++
+ 1 file changed, 35 insertions(+)
+
+diff --git a/lib/ns/query.c b/lib/ns/query.c
+index 11d2520..7e8a4d2 100644
+--- a/lib/ns/query.c
+++ b/lib/ns/query.c
+@@ -2203,6 +2203,20 @@ regular:
+ 	CTRACE(ISC_LOG_DEBUG(3), "query_additional: done");
+ }
+ 
+static void
+log_query_relative(query_ctx_t *qctx, const char *func, const dns_name_t *name) {
+	if (isc_log_wouldlog(ns_lctx, ISC_LOG_DEBUG(1))) {
+		char namebuf[DNS_NAME_FORMATSIZE] = "!";
+		dns_name_format(name, namebuf, sizeof(namebuf));
+		ns_client_log(
+			qctx->client, NS_LOGCATEGORY_CLIENT, NS_LOGMODULE_QUERY,
+			ISC_LOG_DEBUG(1),
+			"%s: fname=%s leading to relative name, aborting query.",
+			func, namebuf
+		);
+	}
+}
+
+ static void
+ query_addrrset(query_ctx_t *qctx, dns_name_t **namep,
+ 	       dns_rdataset_t **rdatasetp, dns_rdataset_t **sigrdatasetp,
+@@ -2275,6 +2289,11 @@ query_addrrset(query_ctx_t *qctx, dns_name_t **namep,
+ 		client->query.attributes &= ~NS_QUERYATTR_SECURE;
+ 	}
+ 
+	if (!qctx->is_zone && mname && !dns_name_isabsolute(mname)) {
+		log_query_relative(qctx, "query_addrrset", mname);
+		QUERY_ERROR(qctx, DNS_R_SERVFAIL);
+		return;
+	}
+ 	/*
+ 	 * Update message name, set rdataset order, and do additional
+ 	 * section processing if needed.
+@@ -8074,6 +8093,11 @@ query_respond_any(query_ctx_t *qctx) {
+ 							     : qctx->tname;
+ 				query_prefetch(qctx->client, name,
+ 					       qctx->rdataset);
+				if (name && !dns_name_isabsolute(name)) {
+					log_query_relative(qctx, "query_respond_any", name);
+					result = DNS_R_DROP;
+					break;
+				}
+ 			}
+ 
+ 			/*
+@@ -10696,6 +10720,11 @@ query_cname(query_ctx_t *qctx) {
+ 
+ 	if (!qctx->is_zone && RECURSIONOK(qctx->client)) {
+ 		query_prefetch(qctx->client, qctx->fname, qctx->rdataset);
+		if (qctx->fname && !dns_name_isabsolute(qctx->fname)) {
+			log_query_relative(qctx, "query_cname", qctx->fname);
+			QUERY_ERROR(qctx, DNS_R_SERVFAIL);
+			return (ns_query_done(qctx));
+		}
+ 	}
+ 
+ 	query_addrrset(qctx, &qctx->fname, &qctx->rdataset, sigrdatasetp,
+@@ -10801,7 +10830,13 @@ query_dname(query_ctx_t *qctx) {
+ 
+ 	if (!qctx->is_zone && RECURSIONOK(qctx->client)) {
+ 		query_prefetch(qctx->client, qctx->fname, qctx->rdataset);
+		if (qctx->fname && !dns_name_isabsolute(qctx->fname)) {
+			log_query_relative(qctx, "query_dname", qctx->fname);
+			QUERY_ERROR(qctx, DNS_R_SERVFAIL);
+			return (ns_query_done(qctx));
+		}
+ 	}
+
+ 	query_addrrset(qctx, &qctx->fname, &qctx->rdataset, sigrdatasetp,
+ 		       qctx->dbuf, DNS_SECTION_ANSWER);
+ 
+-- 
+2.49.0
+
--- a/SOURCES/bind-9.18-unittest-netmgr-unstable.patch
+++ b/SOURCES/bind-9.18-unittest-netmgr-unstable.patch
--- a/SOURCES/bind-9.18.29.tar.xz.asc
+++ b/SOURCES/bind-9.18.29.tar.xz.asc
@ -0,0 +1,16 @@
+-----BEGIN PGP SIGNATURE-----
+
+iQIzBAABCgAdFiEE2ZzOr4eXRwFPA41jGC4jV5Ri76oFAma+DmEACgkQGC4jV5Ri
+76q1FQ/8CXrIA21FAdnGuGqC53EVOzFl3QptFMThoVTO0kzp7rQcwv8xE/gphXnT
+j4DWMAZ/tDW6ZalDbmCh6t+z/0pXewHB+43CILSkzU9Gi5gnAUHdIdlGQnYH/x2N
+eyHBKuB9Wubmi87Yu8zjtF+Xu43qgcYqNKP/QqU9YwsqPQ+7GgcKAETVidFMB9/4
+QZiMT4gMawguft+BwFZ1eYvk0Bemk0OkKhofyWDcVnl5r93pvTIK3SsIHyEHx7xu
+dbG9Z5HhoaJ8b48djahrrYSQCQ0Dn9KbEVLu+/BS5tz+k+V1VI1pk4OS15wn7yBZ
+8EqAGc5xj4MEKW7PEteOK7QQQE59yKY6SGwt+tQwokUZ/Rq4bAx2bHXY83oRBULo
+BIRDdgoxc9X44YQ/a55La+7/xq2eCYwW2s364R4To3K58nPCNlkdEQUziY1V7guR
+3zOcHPAZNe5bK7bN3BMDusQgtoerfSUC1x+zj5Nm9Xnb/yAtVUyiP/k/zlIds9W3
+rKSCM5FAuacZdWQKeVpRa1EaXhObm08qLO9a/Dc/Qvll8GKAmrMoll2WwEoUVlZ3
+HwZPRsPIWYSCemtHmp36b7nOZ0vo4NMXjb2nV7xW3a8BqOD3RW0XiTlC814qmqsU
+x16eOHowvtDw58abeBzPJ2k1yne1Ic2zBdJzUM9wqdJCoBN5g0A=
+=2EW2
+-----END PGP SIGNATURE-----
--- a/SOURCES/bind-9.20-CVE-2025-8677-dual-signing-test.patch
+++ b/SOURCES/bind-9.20-CVE-2025-8677-dual-signing-test.patch
@ -0,0 +1,137 @@
+From 748bf1ee0681bd2a2bc0b3dfa8634787017818c3 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@isc.org>
+Date: Sat, 1 Nov 2025 12:00:59 +0100
+Subject: [PATCH] Add a system test with one good and one bad algorithm
+
+The case where there would be one supported algorithm and one already
+unsupported (like RSAMD5 or RSASHA1) was missing.
+
+(cherry picked from commit 3aa6f585e0466700e5d4b64fffccf883bb1c21dd)
+---
+ bin/tests/system/dnssec/clean.sh          |  1 +
+ bin/tests/system/dnssec/ns2/example.db.in |  4 +++
+ bin/tests/system/dnssec/ns2/sign.sh       |  3 ++-
+ bin/tests/system/dnssec/ns3/named.conf.in |  6 +++++
+ bin/tests/system/dnssec/ns3/sign.sh       | 31 +++++++++++++++++++++++
+ bin/tests/system/dnssec/tests.sh          | 11 ++++++++
+ 6 files changed, 55 insertions(+), 1 deletion(-)
+
+diff --git a/bin/tests/system/dnssec/clean.sh b/bin/tests/system/dnssec/clean.sh
+index 1a933ad..aa35122 100644
+--- a/bin/tests/system/dnssec/clean.sh
+++ b/bin/tests/system/dnssec/clean.sh
+@@ -69,6 +69,7 @@ rm -f ./ns3/dnskey-unsupported.example.db.tmp
+ rm -f ./ns3/dynamic.example.db ./ns3/dynamic.example.db.signed.jnl
+ rm -f ./ns3/expired.example.db ./ns3/update-nsec3.example.db
+ rm -f ./ns3/expiring.example.db ./ns3/nosign.example.db
+rm -f ./ns3/extrabadkey.example.db
+ rm -f ./ns3/future.example.db ./ns3/trusted-future.key
+ rm -f ./ns3/inline.example.db.signed
+ rm -f ./ns3/kskonly.example.db
+diff --git a/bin/tests/system/dnssec/ns2/example.db.in b/bin/tests/system/dnssec/ns2/example.db.in
+index f711f58..63d41e5 100644
+--- a/bin/tests/system/dnssec/ns2/example.db.in
+++ b/bin/tests/system/dnssec/ns2/example.db.in
+@@ -168,4 +168,8 @@ ns.managed-future	A	10.53.0.3
+ revkey			NS	ns.revkey
+ ns.revkey		A	10.53.0.3
+ 
+; A secure subdomain with extra bad key
+extrabadkey		NS	ns3.extrabadkey
+ns3.extrabadkey		A	10.53.0.3
+
+ dname-at-apex-nsec3	NS	ns3
+diff --git a/bin/tests/system/dnssec/ns2/sign.sh b/bin/tests/system/dnssec/ns2/sign.sh
+index b60e82a..eb00806 100644
+--- a/bin/tests/system/dnssec/ns2/sign.sh
+++ b/bin/tests/system/dnssec/ns2/sign.sh
+@@ -62,7 +62,8 @@ for subdomain in secure badds bogus dynamic keyless nsec3 optout \
+   ttlpatch split-dnssec split-smart expired expiring upper lower \
+   dnskey-unknown dnskey-unsupported dnskey-unsupported-2 \
+   dnskey-nsec3-unknown managed-future revkey \
+-  dname-at-apex-nsec3 occluded; do
+  dname-at-apex-nsec3 occluded rsasha1 rsasha1-1024 \
+  extrabadkey; do
+   cp "../ns3/dsset-$subdomain.example." .
+ done
+ 
+diff --git a/bin/tests/system/dnssec/ns3/named.conf.in b/bin/tests/system/dnssec/ns3/named.conf.in
+index 680cff5..3536046 100644
+--- a/bin/tests/system/dnssec/ns3/named.conf.in
+++ b/bin/tests/system/dnssec/ns3/named.conf.in
+@@ -84,6 +84,12 @@ zone "insecure2.example" {
+ 	allow-update { any; };
+ };
+ 
+zone "extrabadkey.example" {
+	type primary;
+	file "extrabadkey.example.db.signed";
+	allow-update { any; };
+};
+
+ zone "insecure.nsec3.example" {
+ 	type primary;
+ 	file "insecure.nsec3.example.db";
+diff --git a/bin/tests/system/dnssec/ns3/sign.sh b/bin/tests/system/dnssec/ns3/sign.sh
+index 14fc709..743a0e4 100644
+--- a/bin/tests/system/dnssec/ns3/sign.sh
+++ b/bin/tests/system/dnssec/ns3/sign.sh
+@@ -673,3 +673,34 @@ $DSFROMKEY "$dnskeyname.key" >"dsset-delegation.${zone}."
+ cat "$infile" "${kskname}.key" "${zskname}.key" "${keyname}.key" \
+   "${dnskeyname}.key" "dsset-delegation.${zone}." >"$zonefile"
+ "$SIGNER" -P -o "$zone" "$zonefile" >/dev/null
+
+#
+#
+#
+zone=extrabadkey.example.
+infile=template.db.in
+zonefile=extrabadkey.example.db
+
+# Add KSK and ZSK that we will mangle to RSAMD5
+ksk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK "$zone")
+zsk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
+cat "$infile" "$ksk.key" "$zsk.key" > "$zonefile"
+"$SIGNER" -g -O full -o "$zone" "$zonefile" >/dev/null 2>&1
+
+# Mangle the signatures to RSAMD5 and save them for future use
+sed -ne "s/\(IN[[:space:]]*RRSIG[[:space:]]*[A-Z]*\) $DEFAULT_ALGORITHM_NUMBER /\1 1 /p" < "$zonefile.signed" > "$zonefile.signed.rsamd5"
+
+# Now add normal KSK and ZSK to the zone file
+ksk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK "$zone")
+zsk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
+cat "$infile" "$ksk.key" "$zsk.key" > "$zonefile"
+
+# Mangle the DNSKEY algorithm numbers and add them to the signed zone file
+cat "$ksk.key" "$zsk.key" | sed -e "s/\(IN[[:space:]]*DNSKEY[[:space:]]*[0-9]* 3\) $DEFAULT_ALGORITHM_NUMBER /\1 1 /" >> "$zonefile"
+
+# Sign normally
+"$SIGNER" -g -o "$zone" "$zonefile" >/dev/null 2>&1
+
+# Add the mangled signatures to signed zone file
+cat "$zonefile.signed.rsamd5" >> "$zonefile.signed"
+rm "$zonefile.signed.rsamd5"
+diff --git a/bin/tests/system/dnssec/tests.sh b/bin/tests/system/dnssec/tests.sh
+index c7b1c3a..e908317 100644
+--- a/bin/tests/system/dnssec/tests.sh
+++ b/bin/tests/system/dnssec/tests.sh
+@@ -4468,5 +4468,16 @@ n=$((n + 1))
+ if [ "$ret" -ne 0 ]; then echo_i "failed"; fi
+ status=$((status + ret))
+ 
+echo_i "checking extra-bad-algorithm positive validation ($n)"
+ret=0
+dig_with_opts +noauth a.extrabadkey.example. @10.53.0.3 A >dig.out.ns3.test$n || ret=1
+dig_with_opts +noauth a.extrabadkey.example. @10.53.0.4 A >dig.out.ns4.test$n || ret=1
+digcomp --lc dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
+grep "status: NOERROR" dig.out.ns4.test$n >/dev/null || ret=1
+grep "flags:.*ad.*QUERY" dig.out.ns4.test$n >/dev/null || ret=1
+n=$((n + 1))
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status + ret))
+
+ echo_i "exit status: $status"
+ [ $status -eq 0 ] || exit 1
+-- 
+2.51.1
+
--- a/SOURCES/bind-9.20-CVE-2025-8677-dual-signing.patch
+++ b/SOURCES/bind-9.20-CVE-2025-8677-dual-signing.patch
@ -0,0 +1,36 @@
+From 5126c74ec19f56294cbfdc312f75778d8f249e59 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
+Date: Mon, 3 Nov 2025 22:03:54 +0100
+Subject: [PATCH] Do not abort key search on unsupported algorithm
+
+When supported and unsupported algorithm rrsig is present, some keys may
+return unsupported algorithm error. Continue to next key without
+counting this to validation failures.
+
+(cherry picked from commit 38ddff3336e08983a4c0b5f3ea4eb35bb0f6ac81)
+---
+ lib/dns/validator.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/lib/dns/validator.c b/lib/dns/validator.c
+index 15e177e4d7..a9db844c27 100644
+--- a/lib/dns/validator.c
+++ b/lib/dns/validator.c
+@@ -1163,7 +1163,13 @@ select_signing_key(dns_validator_t *val, dns_rdataset_t *rdataset) {
+ 				goto done;
+ 			}
+ 			dst_key_free(&val->key);
+-		} else {
+		} else if (result != DST_R_UNSUPPORTEDALG) {
+			/* Unsupported alg happens when RRset is signed by both
+			 * supported and unsupported alg. */
+			validator_log(val, ISC_LOG_DEBUG(3),
+				      "select_signing_key alg %d keyid %d: %s",
+				      siginfo->algorithm, siginfo->keyid,
+				      isc_result_totext(result));
+ 			break;
+ 		}
+ 		dns_rdata_reset(&rdata);
+-- 
+2.51.1
+
--- a/SOURCES/bind-9.20-robust-key-rollovers-tests.patch
+++ b/SOURCES/bind-9.20-robust-key-rollovers-tests.patch
@ -0,0 +1,144 @@
+diff --git a/bin/tests/system/nsec3/ns3/named.conf.in b/bin/tests/system/nsec3/ns3/named.conf.in
+index 022e9421bc..2bee4f898a 100644
+--- a/bin/tests/system/nsec3/ns3/named.conf.in
+++ b/bin/tests/system/nsec3/ns3/named.conf.in
+@@ -68,7 +68,7 @@ zone "nsec-to-nsec3.kasp" {
+ 
+ /*
+  * This zone starts with NSEC, but will be reconfigured to use NSEC3.
+- * This should work despite the incompatible RSAHSHA1 algorithm,
+ * This should work despite the incompatible RSASHA1 algorithm,
+  * because the DS is still in hidden state.
+  */
+ zone "rsasha1-to-nsec3.kasp" {
+@@ -92,7 +92,7 @@ zone "rsasha1-to-nsec3-wait.kasp" {
+ 
+ /*
+  * This zone starts with NSEC3, but will be reconfigured to use NSEC with an
+- * NSEC only algorithm. This should work despite the incompatible RSAHSHA1
+ * NSEC only algorithm. This should work despite the incompatible RSASHA1
+  * algorithm, because the DS is still in hidden state.
+  */
+ zone "nsec3-to-rsasha1.kasp" {
+diff --git a/bin/tests/system/nsec3/ns3/setup.sh b/bin/tests/system/nsec3/ns3/setup.sh
+index 5ddcfc01b0..3cd7210192 100644
+--- a/bin/tests/system/nsec3/ns3/setup.sh
+++ b/bin/tests/system/nsec3/ns3/setup.sh
+@@ -35,24 +35,23 @@ if (
+   cd ..
+   $SHELL ../testcrypto.sh -q RSASHA1
+ ); then
+-  for zn in rsasha1-to-nsec3 rsasha1-to-nsec3-wait nsec3-to-rsasha1 \
+-    nsec3-to-rsasha1-ds; do
+-    setup "${zn}.kasp"
+-  done
+-
+   longago="now-1y"
+-  keytimes="-P ${longago} -A ${longago}"
+  keytimes="-P ${longago} -A ${longago} -P sync ${longago}"
+   O="omnipresent"
+ 
+-  zone="rsasha1-to-nsec3-wait.kasp"
+-  CSK=$($KEYGEN -k "rsasha1" -l named.conf $keytimes $zone 2>keygen.out.$zone)
+-  echo_i "Created key file $CSK"
+-  $SETTIME -s -g $O -k $O $longago -r $O $longago -z $O $longago -d $O $longago "$CSK" >settime.out.$zone 2>&1
+  for zn in nsec3-to-rsasha1 nsec3-to-rsasha1-ds; do
+    setup "${zn}.kasp"
+    CSK=$($KEYGEN -k "default" -l named.conf $keytimes $zone 2>keygen.out.$zone)
+    $SETTIME -s -g $O -k $O $longago -r $O $longago -z $O $longago -d $O $longago "$CSK" >settime.out.$zone 2>&1
+    cat $CSK.key >>$zonefile
+  done
+ 
+-  zone="nsec3-to-rsasha1-ds.kasp"
+-  CSK=$($KEYGEN -k "default" -l named.conf $keytimes $zone 2>keygen.out.$zone)
+-  echo_i "Created key file $CSK"
+-  $SETTIME -s -g $O -k $O $longago -r $O $longago -z $O $longago -d $O $longago "$CSK" >settime.out.$zone 2>&1
+  for zn in rsasha1-to-nsec3 rsasha1-to-nsec3-wait; do
+    setup "${zn}.kasp"
+    CSK=$($KEYGEN -k "rsasha1" -l named.conf $keytimes $zone 2>keygen.out.$zone)
+    $SETTIME -s -g $O -k $O $longago -r $O $longago -z $O $longago -d $O $longago "$CSK" >settime.out.$zone 2>&1
+    cat $CSK.key >>$zonefile
+  done
+ else
+   echo_i "skip: skip rsasha1 zones - signing with RSASHA1 not supported"
+ fi
+diff --git a/bin/tests/system/nsec3/tests.sh b/bin/tests/system/nsec3/tests.sh
+index 6cb28583c6..b8e9152cf9 100644
+--- a/bin/tests/system/nsec3/tests.sh
+++ b/bin/tests/system/nsec3/tests.sh
+@@ -80,10 +80,10 @@ set_key_rsasha1_values() {
+   set_zonesigning $1 "yes"
+ 
+   set_keystate $1 "GOAL" "omnipresent"
+-  set_keystate $1 "STATE_DNSKEY" "rumoured"
+-  set_keystate $1 "STATE_KRRSIG" "rumoured"
+-  set_keystate $1 "STATE_ZRRSIG" "rumoured"
+-  set_keystate $1 "STATE_DS" "hidden"
+  set_keystate $1 "STATE_DNSKEY" "omnipresent"
+  set_keystate $1 "STATE_KRRSIG" "omnipresent"
+  set_keystate $1 "STATE_ZRRSIG" "omnipresent"
+  set_keystate $1 "STATE_DS" "omnipresent"
+ }
+ 
+ # Update the key states.
+@@ -251,21 +251,21 @@ if ($SHELL ../testcrypto.sh -q RSASHA1); then
+   set_zone_policy "rsasha1-to-nsec3-wait.kasp" "rsasha1" 1 3600
+   set_server "ns3" "10.53.0.3"
+   set_key_rsasha1_values "KEY1"
+-  set_key_states "KEY1" "omnipresent" "omnipresent" "omnipresent" "omnipresent" "omnipresent"
+   echo_i "initial check zone ${ZONE}"
+   check_nsec
+ 
+   # Zone: nsec3-to-rsasha1.kasp.
+   set_zone_policy "nsec3-to-rsasha1.kasp" "nsec3" 1 3600
+   set_server "ns3" "10.53.0.3"
+-  set_key_rsasha1_values "KEY1"
+  set_key_default_values "KEY1"
+  set_key_states "KEY1" "omnipresent" "omnipresent" "omnipresent" "omnipresent" "omnipresent"
+   echo_i "initial check zone ${ZONE}"
+   check_nsec3
+ 
+   # Zone: nsec3-to-rsasha1-ds.kasp.
+   set_zone_policy "nsec3-to-rsasha1-ds.kasp" "nsec3" 1 3600
+   set_server "ns3" "10.53.0.3"
+-  set_key_rsasha1_values "KEY1"
+  set_key_default_values "KEY1"
+   set_key_states "KEY1" "omnipresent" "omnipresent" "omnipresent" "omnipresent" "omnipresent"
+   echo_i "initial check zone ${ZONE}"
+   check_nsec3
+@@ -385,12 +385,10 @@ if ($SHELL ../testcrypto.sh -q RSASHA1); then
+   set_zone_policy "rsasha1-to-nsec3.kasp" "nsec3" 2 3600
+   set_server "ns3" "10.53.0.3"
+   set_key_rsasha1_values "KEY1"
+-  set_key_states "KEY1" "hidden" "unretentive" "unretentive" "unretentive" "hidden"
+-  set_keysigning "KEY1" "no"
+-  set_zonesigning "KEY1" "no"
+  set_key_states "KEY1" "hidden" "omnipresent" "omnipresent" "omnipresent" "omnipresent"
+   set_key_default_values "KEY2"
+   echo_i "check zone ${ZONE} after reconfig"
+-  check_nsec3
+  check_nsec
+ 
+   # Zone: rsasha1-to-nsec3-wait.kasp.
+   set_zone_policy "rsasha1-to-nsec3-wait.kasp" "nsec3" 2 3600
+@@ -406,10 +404,9 @@ if ($SHELL ../testcrypto.sh -q RSASHA1); then
+   set_nsec3param "1" "0" "0"
+   set_server "ns3" "10.53.0.3"
+   set_key_default_values "KEY1"
+-  set_key_states "KEY1" "hidden" "unretentive" "unretentive" "unretentive" "hidden"
+-  set_keysigning "KEY1" "no"
+-  set_zonesigning "KEY1" "no"
+  set_key_states "KEY1" "hidden" "omnipresent" "omnipresent" "omnipresent" "omnipresent"
+   set_key_rsasha1_values "KEY2"
+  set_key_states "KEY2" "omnipresent" "rumoured" "rumoured" "rumoured" "hidden"
+   echo_i "check zone ${ZONE} after reconfig"
+   check_nsec
+ 
+@@ -420,6 +417,7 @@ if ($SHELL ../testcrypto.sh -q RSASHA1); then
+   set_key_default_values "KEY1"
+   set_key_states "KEY1" "hidden" "omnipresent" "omnipresent" "omnipresent" "omnipresent"
+   set_key_rsasha1_values "KEY2"
+  set_key_states "KEY2" "omnipresent" "rumoured" "rumoured" "rumoured" "hidden"
+   echo_i "check zone ${ZONE} after reconfig"
+   check_nsec
+ 
--- a/SOURCES/bind-9.20-robust-key-rollovers.patch
+++ b/SOURCES/bind-9.20-robust-key-rollovers.patch
@ -0,0 +1,97 @@
+diff --git a/lib/dns/keymgr.c b/lib/dns/keymgr.c
+index 4fbebbcb6d..789f68a146 100644
+--- a/lib/dns/keymgr.c
+++ b/lib/dns/keymgr.c
+@@ -1224,19 +1224,18 @@ static bool
+ keymgr_transition_allowed(dns_dnsseckeylist_t *keyring, dns_dnsseckey_t *key,
+ 			  int type, dst_key_state_t next_state,
+ 			  bool secure_to_insecure) {
+	bool rule1a, rule1b, rule2a, rule2b, rule3a, rule3b;
+	rule1a = keymgr_have_ds(keyring, key, type, NA, secure_to_insecure);
+	rule1b = keymgr_have_ds(keyring, key, type, next_state, secure_to_insecure);
+	rule2a = keymgr_have_dnskey(keyring, key, type, NA);
+	rule2b = keymgr_have_dnskey(keyring, key, type, next_state);
+	rule3a = keymgr_have_rrsig(keyring, key, type, NA);
+	rule3b = keymgr_have_rrsig(keyring, key, type, next_state);
+
+ 	/* Debug logging. */
+ 	if (isc_log_wouldlog(dns_lctx, ISC_LOG_DEBUG(1))) {
+-		bool rule1a, rule1b, rule2a, rule2b, rule3a, rule3b;
+ 		char keystr[DST_KEY_FORMATSIZE];
+ 		dst_key_format(key->key, keystr, sizeof(keystr));
+-		rule1a = keymgr_have_ds(keyring, key, type, NA,
+-					secure_to_insecure);
+-		rule1b = keymgr_have_ds(keyring, key, type, next_state,
+-					secure_to_insecure);
+-		rule2a = keymgr_have_dnskey(keyring, key, type, NA);
+-		rule2b = keymgr_have_dnskey(keyring, key, type, next_state);
+-		rule3a = keymgr_have_rrsig(keyring, key, type, NA);
+-		rule3b = keymgr_have_rrsig(keyring, key, type, next_state);
+ 		isc_log_write(
+ 			dns_lctx, DNS_LOGCATEGORY_DNSSEC, DNS_LOGMODULE_DNSSEC,
+ 			ISC_LOG_DEBUG(1),
+@@ -1249,30 +1248,40 @@ keymgr_transition_allowed(dns_dnsseckeylist_t *keyring, dns_dnsseckey_t *key,
+ 			rule3a ? "true" : "false", rule3b ? "true" : "false");
+ 	}
+ 
+-	return (
+-		/*
+-		 * Rule 1: There must be a DS at all times.
+-		 * First check the current situation: if the rule check fails,
+-		 * we allow the transition to attempt to move us out of the
+-		 * invalid state.  If the rule check passes, also check if
+-		 * the next state is also still a valid situation.
+-		 */
+-		(!keymgr_have_ds(keyring, key, type, NA, secure_to_insecure) ||
+-		 keymgr_have_ds(keyring, key, type, next_state,
+-				secure_to_insecure)) &&
+-		/*
+-		 * Rule 2: There must be a DNSKEY at all times.  Again, first
+-		 * check the current situation, then assess the next state.
+-		 */
+-		(!keymgr_have_dnskey(keyring, key, type, NA) ||
+-		 keymgr_have_dnskey(keyring, key, type, next_state)) &&
+-		/*
+-		 * Rule 3: There must be RRSIG records at all times. Again,
+-		 * first check the current situation, then assess the next
+-		 * state.
+-		 */
+-		(!keymgr_have_rrsig(keyring, key, type, NA) ||
+-		 keymgr_have_rrsig(keyring, key, type, next_state)));
+	/*
+	 * Rule checking:
+	 * First check the current situation: if the rule check fails,
+	 * we allow the transition to attempt to move us out of the
+	 * invalid state.  If the rule check passes, also check if
+	 * the next state is also still a valid situation.
+	 */
+	char keystr2[DST_KEY_FORMATSIZE];
+	dst_key_format(key->key, keystr2, sizeof(keystr2));
+
+	/*
+	 * Rule 1: There must be a DS at all times.
+	 */
+	if (!rule1a && !rule1b && next_state == UNRETENTIVE) {
+		return false;
+	}
+	/*
+	 * Rule 2: There must be a DNSKEY at all times.  Again, first
+	 * check the current situation, then assess the next state.
+	 */
+	if (!rule2a && !rule2b && next_state == UNRETENTIVE) {
+		return false;
+	}
+	/*
+	 * Rule 3: There must be RRSIG records at all times. Again,
+	 * first check the current situation, then assess the next
+	 * state.
+	 */
+	if (!rule3a && !rule3b && next_state == UNRETENTIVE) {
+		return false;
+	}
+
+	return (!rule1a || rule1b) && (!rule2a || rule2b) &&
+	       (!rule3a || rule3b);
+ }
+ 
+ /*
--- a/SOURCES/bind-9.20-stale-cname-tests.patch
+++ b/SOURCES/bind-9.20-stale-cname-tests.patch
@ -0,0 +1,94 @@
+diff --git a/bin/tests/system/serve-stale/ns1/stale.test.db b/bin/tests/system/serve-stale/ns1/stale.test.db
+index d389e7c6a6..128fb25a10 100644
+--- a/bin/tests/system/serve-stale/ns1/stale.test.db
+++ b/bin/tests/system/serve-stale/ns1/stale.test.db
+@@ -17,3 +17,11 @@ cname1.stale.test.	1	CNAME	a1.stale.test.
+ a1.stale.test.		1	A	192.0.2.1
+ cname2.stale.test.	1	CNAME	a2.stale.test.
+ a2.stale.test.		300	A	192.0.2.2
+
+cname-a1		1	CNAME	cname-a2
+cname-a2		300	CNAME	cname-a3
+cname-a3		300	A	192.0.2.1
+
+cname-b1		300	CNAME	cname-b2
+cname-b2		1	CNAME	cname-b3
+cname-b3		1	A	192.0.2.2
+diff --git a/bin/tests/system/serve-stale/tests.sh b/bin/tests/system/serve-stale/tests.sh
+index 96cd26505f..a30896b6a4 100755
+--- a/bin/tests/system/serve-stale/tests.sh
+++ b/bin/tests/system/serve-stale/tests.sh
+@@ -2256,6 +2256,73 @@ if [ $ret != 0 ]; then
+ fi
+ status=$((status + ret))
+ 
+# New CNAME scenario (GL #5243)
+n=$((n + 1))
+echo_i "prime cache cname-a1.stale.test A (stale-answer-client-timeout 0) ($n)"
+ret=0
+$DIG -p ${PORT} @10.53.0.3 cname-a1.stale.test A >dig.out.test$n || ret=1
+grep "status: NOERROR" dig.out.test$n >/dev/null || ret=1
+grep "ANSWER: 3," dig.out.test$n >/dev/null || ret=1
+grep "cname-a1\.stale\.test\..*1.*IN.*CNAME.*cname-a2\.stale\.test\." dig.out.test$n >/dev/null || ret=1
+grep "cname-a2\.stale\.test\..*300.*IN.*CNAME.*cname-a3\.stale\.test\." dig.out.test$n >/dev/null || ret=1
+grep "cname-a3\.stale\.test\..*300.*IN.*A.*192\.0\.2\.1" dig.out.test$n >/dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+n=$((n + 1))
+echo_i "prime cache cname-b1.stale.test A (stale-answer-client-timeout 0) ($n)"
+ret=0
+$DIG -p ${PORT} @10.53.0.3 cname-b1.stale.test A >dig.out.test$n || ret=1
+grep "status: NOERROR" dig.out.test$n >/dev/null || ret=1
+grep "ANSWER: 3," dig.out.test$n >/dev/null || ret=1
+grep "cname-b1\.stale\.test\..*300.*IN.*CNAME.*cname-b2\.stale\.test\." dig.out.test$n >/dev/null || ret=1
+grep "cname-b2\.stale\.test\..*1.*IN.*CNAME.*cname-b3\.stale\.test\." dig.out.test$n >/dev/null || ret=1
+grep "cname-b3\.stale\.test\..*1.*IN.*A.*192\.0\.2\.2" dig.out.test$n >/dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+# Allow RRset to become stale.
+sleep 1
+
+n=$((n + 1))
+ret=0
+echo_i "check stale cname-a1.stale.test A comes from cache (stale-answer-client-timeout 0) ($n)"
+nextpart ns3/named.run >/dev/null
+$DIG -p ${PORT} @10.53.0.3 cname-a1.stale.test A >dig.out.test$n || ret=1
+wait_for_log 5 "cname-a1.stale.test A stale answer used, an attempt to refresh the RRset" ns3/named.run || ret=1
+# Other records in chain are still good, so do not attempt a refresh
+grep "cname-a2.stale.test A stale answer used, an attempt to refresh the RRset" ns3/named.run && ret=1
+grep "cname-a3.stale.test A stale answer used, an attempt to refresh the RRset" ns3/named.run && ret=1
+# Check answer
+grep "status: NOERROR" dig.out.test$n >/dev/null || ret=1
+grep "EDE: 3 (Stale Answer): (stale data prioritized over lookup)" dig.out.test$n >/dev/null || ret=1
+grep "ANSWER: 3," dig.out.test$n >/dev/null || ret=1
+grep "cname-a1\.stale\.test\..*3.*IN.*CNAME.*cname-a2\.stale\.test\." dig.out.test$n >/dev/null || ret=1
+grep "cname-a2\.stale\.test\..*29[0-9].*IN.*CNAME.*cname-a3\.stale\.test\." dig.out.test$n >/dev/null || ret=1
+grep "cname-a3\.stale\.test\..*29[0-9].*IN.*A.*192\.0\.2\.1" dig.out.test$n >/dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+n=$((n + 1))
+ret=0
+echo_i "check stale cname-b1.stale.test A comes from cache (stale-answer-client-timeout 0) ($n)"
+nextpart ns3/named.run >/dev/null
+$DIG -p ${PORT} @10.53.0.3 cname-b1.stale.test A >dig.out.test$n || ret=1
+wait_for_log 5 "cname-b2.stale.test A stale answer used, an attempt to refresh the RRset" ns3/named.run || ret=1
+# The next one in the chain (cname-b3.stale.test) is likely not logged because
+# there is already a refresh in progress. And the first record in the chain is
+# still good, so do not attempt a refresh.
+grep "cname-b1.stale.test A stale answer used, an attempt to refresh the RRset" ns3/named.run && ret=1
+# Check answer
+grep "status: NOERROR" dig.out.test$n >/dev/null || ret=1
+grep "EDE: 3 (Stale Answer): (stale data prioritized over lookup)" dig.out.test$n >/dev/null || ret=1
+grep "ANSWER: 3," dig.out.test$n >/dev/null || ret=1
+grep "cname-b1\.stale\.test\..*29[0-9].*IN.*CNAME.*cname-b2\.stale\.test\." dig.out.test$n >/dev/null || ret=1
+grep "cname-b2\.stale\.test\..*3.*IN.*CNAME.*cname-b3\.stale\.test\." dig.out.test$n >/dev/null || ret=1
+grep "cname-b3\.stale\.test\..*3.*IN.*A.*192\.0\.2\.2" dig.out.test$n >/dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+ ####################################################################
+ # Test for stale-answer-client-timeout 0 and stale-refresh-time 4. #
+ ####################################################################
--- a/SOURCES/bind-9.20-stale-cname.patch
+++ b/SOURCES/bind-9.20-stale-cname.patch
@ -0,0 +1,711 @@
+diff --git a/bin/tests/system/serve-stale/tests.sh b/bin/tests/system/serve-stale/tests.sh
+index c001e7a071..96cd26505f 100755
+--- a/bin/tests/system/serve-stale/tests.sh
+++ b/bin/tests/system/serve-stale/tests.sh
+@@ -2053,7 +2053,7 @@ ret=0
+ echo_i "check stale nodata.example TXT comes from cache (stale-answer-client-timeout 0) ($n)"
+ nextpart ns3/named.run >/dev/null
+ $DIG -p ${PORT} @10.53.0.3 nodata.example TXT >dig.out.test$n || ret=1
+-wait_for_log 5 "nodata.example stale answer used, an attempt to refresh the RRset" ns3/named.run || ret=1
+wait_for_log 5 "nodata.example TXT stale answer used, an attempt to refresh the RRset" ns3/named.run || ret=1
+ grep "status: NOERROR" dig.out.test$n >/dev/null || ret=1
+ grep "EDE: 3 (Stale Answer): (stale data prioritized over lookup)" dig.out.test$n >/dev/null || ret=1
+ grep "ANSWER: 0," dig.out.test$n >/dev/null || ret=1
+@@ -2066,7 +2066,7 @@ ret=0
+ echo_i "check stale data.example TXT comes from cache (stale-answer-client-timeout 0) ($n)"
+ nextpart ns3/named.run >/dev/null
+ $DIG -p ${PORT} @10.53.0.3 data.example TXT >dig.out.test$n || ret=1
+-wait_for_log 5 "data.example stale answer used, an attempt to refresh the RRset" ns3/named.run || ret=1
+wait_for_log 5 "data.example TXT stale answer used, an attempt to refresh the RRset" ns3/named.run || ret=1
+ grep "status: NOERROR" dig.out.test$n >/dev/null || ret=1
+ grep "EDE: 3 (Stale Answer): (stale data prioritized over lookup)" dig.out.test$n >/dev/null || ret=1
+ grep "ANSWER: 1," dig.out.test$n >/dev/null || ret=1
+@@ -2196,7 +2196,7 @@ ret=0
+ echo_i "check stale cname1.stale.test A comes from cache (stale-answer-client-timeout 0) ($n)"
+ nextpart ns3/named.run >/dev/null
+ $DIG -p ${PORT} @10.53.0.3 cname1.stale.test A >dig.out.test$n || ret=1
+-wait_for_log 5 "cname1.stale.test stale answer used, an attempt to refresh the RRset" ns3/named.run || ret=1
+wait_for_log 5 "cname1.stale.test A stale answer used, an attempt to refresh the RRset" ns3/named.run || ret=1
+ grep "status: NOERROR" dig.out.test$n >/dev/null || ret=1
+ grep "EDE: 3 (Stale Answer): (stale data prioritized over lookup)" dig.out.test$n >/dev/null || ret=1
+ grep "ANSWER: 2," dig.out.test$n >/dev/null || ret=1
+@@ -2235,7 +2235,7 @@ ret=0
+ echo_i "check stale cname2.stale.test A comes from cache (stale-answer-client-timeout 0) ($n)"
+ nextpart ns3/named.run >/dev/null
+ $DIG -p ${PORT} @10.53.0.3 cname2.stale.test A >dig.out.test$n || ret=1
+-wait_for_log 5 "cname2.stale.test stale answer used, an attempt to refresh the RRset" ns3/named.run || ret=1
+wait_for_log 5 "cname2.stale.test A stale answer used, an attempt to refresh the RRset" ns3/named.run || ret=1
+ grep "status: NOERROR" dig.out.test$n >/dev/null || ret=1
+ grep "EDE: 3 (Stale Answer): (stale data prioritized over lookup)" dig.out.test$n >/dev/null || ret=1
+ grep "ANSWER: 2," dig.out.test$n >/dev/null || ret=1
+@@ -2312,7 +2312,7 @@ ret=0
+ echo_i "check stale data.example TXT comes from cache (stale-answer-client-timeout 0 stale-refresh-time 4) ($n)"
+ nextpart ns3/named.run >/dev/null
+ $DIG -p ${PORT} @10.53.0.3 data.example TXT >dig.out.test$n || ret=1
+-wait_for_log 5 "data.example stale answer used, an attempt to refresh the RRset" ns3/named.run || ret=1
+wait_for_log 5 "data.example TXT stale answer used, an attempt to refresh the RRset" ns3/named.run || ret=1
+ grep "status: NOERROR" dig.out.test$n >/dev/null || ret=1
+ grep "EDE: 3 (Stale Answer): (stale data prioritized over lookup)" dig.out.test$n >/dev/null || ret=1
+ grep "ANSWER: 1," dig.out.test$n >/dev/null || ret=1
+@@ -2356,7 +2356,7 @@ ret=0
+ echo_i "check stale data.example TXT comes from cache (stale-answer-client-timeout 0 stale-refresh-time 4) ($n)"
+ nextpart ns3/named.run >/dev/null
+ $DIG -p ${PORT} @10.53.0.3 data.example TXT >dig.out.test$n || ret=1
+-wait_for_log 5 "data.example stale answer used, an attempt to refresh the RRset" ns3/named.run || ret=1
+wait_for_log 5 "data.example TXT stale answer used, an attempt to refresh the RRset" ns3/named.run || ret=1
+ grep "status: NOERROR" dig.out.test$n >/dev/null || ret=1
+ grep "EDE: 3 (Stale Answer): (stale data prioritized over lookup)" dig.out.test$n >/dev/null || ret=1
+ grep "ANSWER: 1," dig.out.test$n >/dev/null || ret=1
+@@ -2368,7 +2368,7 @@ status=$((status + ret))
+ n=$((n + 1))
+ ret=0
+ echo_i "wait until resolver query times out, activating stale-refresh-time"
+-wait_for_log 15 "data.example resolver failure, stale answer used" ns3/named.run || ret=1
+wait_for_log 15 "data.example/TXT stale refresh failed: timed out" ns3/named.run || ret=1
+ if [ $ret != 0 ]; then echo_i "failed"; fi
+ status=$((status + ret))
+ 
+@@ -2419,7 +2419,7 @@ n=$((n + 1))
+ ret=0
+ echo_i "check stale data.example TXT comes from cache (stale-answer-client-timeout 0 stale-refresh-time 4) ($n)"
+ $DIG -p ${PORT} @10.53.0.3 data.example TXT >dig.out.test$n || ret=1
+-wait_for_log 5 "data.example stale answer used, an attempt to refresh the RRset" ns3/named.run || ret=1
+wait_for_log 5 "data.example TXT stale answer used, an attempt to refresh the RRset" ns3/named.run || ret=1
+ grep "status: NOERROR" dig.out.test$n >/dev/null || ret=1
+ grep "EDE: 3 (Stale Answer): (stale data prioritized over lookup)" dig.out.test$n >/dev/null || ret=1
+ grep "ANSWER: 1," dig.out.test$n >/dev/null || ret=1
+diff --git a/lib/dns/include/dns/rdataset.h b/lib/dns/include/dns/rdataset.h
+index f63591c5c7..f3f257ad7e 100644
+--- a/lib/dns/include/dns/rdataset.h
+++ b/lib/dns/include/dns/rdataset.h
+@@ -199,7 +199,9 @@ struct dns_rdataset {
+ #define DNS_RDATASETATTR_STALE	      0x01000000
+ #define DNS_RDATASETATTR_ANCIENT      0x02000000
+ #define DNS_RDATASETATTR_STALE_WINDOW 0x04000000
+-#define DNS_RDATASETATTR_STALE_ADDED  0x08000000
+#define DNS_RDATASETATTR_KEEPCASE     0x10000000
+#define DNS_RDATASETATTR_STATICSTUB   0x20000000
+
+ 
+ /*%
+  * _OMITDNSSEC:
+diff --git a/lib/ns/include/ns/client.h b/lib/ns/include/ns/client.h
+index ea2d83e079..db17f01d79 100644
+--- a/lib/ns/include/ns/client.h
+++ b/lib/ns/include/ns/client.h
+@@ -184,6 +184,7 @@ struct ns_client {
+ 					   (query, update, notify) */
+ 	isc_nmhandle_t *fetchhandle;	/* Waiting for recursive fetch */
+ 	isc_nmhandle_t *prefetchhandle; /* Waiting for prefetch / rpzfetch */
+	isc_nmhandle_t *stalerefreshhandle;
+ 	isc_nmhandle_t *updatehandle;	/* Waiting for update callback */
+ 	unsigned char  *tcpbuf;
+ 	size_t		tcpbuf_size;
+diff --git a/lib/ns/include/ns/query.h b/lib/ns/include/ns/query.h
+index 37e55671c2..ce97643297 100644
+--- a/lib/ns/include/ns/query.h
+++ b/lib/ns/include/ns/query.h
+@@ -68,6 +68,7 @@ struct ns_query {
+ 	isc_mutex_t	 fetchlock;
+ 	dns_fetch_t	*fetch;
+ 	dns_fetch_t	*prefetch;
+	dns_fetch_t	*stalerefresh;
+ 	ns_hookasync_t	*hookactx;
+ 	dns_rpz_st_t	*rpz_st;
+ 	isc_bufferlist_t namebufs;
+@@ -119,7 +120,6 @@ struct ns_query {
+ #define NS_QUERYATTR_RRL_CHECKED     0x010000
+ #define NS_QUERYATTR_REDIRECT	     0x020000
+ #define NS_QUERYATTR_ANSWERED	     0x040000
+-#define NS_QUERYATTR_STALEOK	     0x080000
+ #define NS_QUERYATTR_STALEPENDING    0x100000
+ 
+ typedef struct query_ctx query_ctx_t;
+@@ -148,7 +148,6 @@ struct query_ctx {
+ 	bool authoritative;		    /* authoritative query? */
+ 	bool want_restart;		    /* CNAME chain or other
+ 					     * restart needed */
+-	bool		refresh_rrset;	    /* stale RRset refresh needed */
+ 	bool		need_wildcardproof; /* wildcard proof needed */
+ 	bool		nxrewrite;	    /* negative answer from RPZ */
+ 	bool		findcoveringnsec;   /* lookup covering NSEC */
+diff --git a/lib/ns/query.c b/lib/ns/query.c
+index 5549e202df..274c044172 100644
+--- a/lib/ns/query.c
+++ b/lib/ns/query.c
+@@ -139,9 +139,6 @@
+ #define QUERY_STALEPENDING(q) \
+ 	(((q)->attributes & NS_QUERYATTR_STALEPENDING) != 0)
+ 
+-/*% Does the query allow stale data in the response? */
+-#define QUERY_STALEOK(q) (((q)->attributes & NS_QUERYATTR_STALEOK) != 0)
+-
+ /*% Does the query wants to check for stale RRset due to a timeout? */
+ #define QUERY_STALETIMEOUT(q) (((q)->dboptions & DNS_DBFIND_STALETIMEOUT) != 0)
+ 
+@@ -248,6 +245,15 @@ query_addanswer(query_ctx_t *qctx);
+ static isc_result_t
+ query_prepare_delegation_response(query_ctx_t *qctx);
+ 
+static isc_result_t
+qctx_prepare_buffers(query_ctx_t *qctx, isc_buffer_t *buffer);
+
+static void
+qctx_freedata(query_ctx_t *qctx);
+
+static void
+qctx_destroy(query_ctx_t *qctx);
+
+ /*
+  * Return the hooktable in use with 'qctx', or if there isn't one
+  * set, return the default hooktable.
+@@ -503,9 +509,6 @@ query_addwildcardproof(query_ctx_t *qctx, bool ispositive, bool nodata);
+ static void
+ query_addauth(query_ctx_t *qctx);
+ 
+-static void
+-query_clear_stale(ns_client_t *client);
+-
+ /*
+  * Increment query statistics counters.
+  */
+@@ -811,6 +814,7 @@ ns_query_init(ns_client_t *client) {
+ 
+ 	client->query.fetch = NULL;
+ 	client->query.prefetch = NULL;
+	client->query.stalerefresh = NULL;
+ 	client->query.authdb = NULL;
+ 	client->query.authzone = NULL;
+ 	client->query.authdbset = false;
+@@ -2241,10 +2245,6 @@ query_addrrset(query_ctx_t *qctx, dns_name_t **namep,
+ 		if ((rdataset->attributes & DNS_RDATASETATTR_REQUIRED) != 0) {
+ 			mrdataset->attributes |= DNS_RDATASETATTR_REQUIRED;
+ 		}
+-		if ((rdataset->attributes & DNS_RDATASETATTR_STALE_ADDED) != 0)
+-		{
+-			mrdataset->attributes |= DNS_RDATASETATTR_STALE_ADDED;
+-		}
+ 		return;
+ 	} else if (result == DNS_R_NXDOMAIN) {
+ 		/*
+@@ -2530,6 +2530,88 @@ free_devent(ns_client_t *client, isc_event_t **eventp,
+ 	isc_event_free(eventp);
+ }
+ 
+static void
+stale_refresh_aftermath(ns_client_t *client, isc_result_t result) {
+	dns_db_t *db = NULL;
+	unsigned int dboptions;
+	isc_buffer_t buffer;
+	query_ctx_t qctx;
+	dns_clientinfomethods_t cm;
+	dns_clientinfo_t ci;
+	char namebuf[DNS_NAME_FORMATSIZE];
+	char typebuf[DNS_RDATATYPE_FORMATSIZE];
+
+	/*
+	 * If refreshing a stale RRset failed, we need to set the
+	 * stale-refresh-time window, so that on future requests for this
+	 * RRset the stale entry may be used immediately.
+	 */
+	switch (result) {
+	case ISC_R_SUCCESS:
+	case DNS_R_GLUE:
+	case DNS_R_ZONECUT:
+	case ISC_R_NOTFOUND:
+	case DNS_R_DELEGATION:
+	case DNS_R_EMPTYNAME:
+	case DNS_R_NXRRSET:
+	case DNS_R_EMPTYWILD:
+	case DNS_R_NXDOMAIN:
+	case DNS_R_COVERINGNSEC:
+	case DNS_R_NCACHENXDOMAIN:
+	case DNS_R_NCACHENXRRSET:
+	case DNS_R_CNAME:
+	case DNS_R_DNAME:
+		break;
+	default:
+		dns_name_format(client->query.qname, namebuf, sizeof(namebuf));
+		dns_rdatatype_format(client->query.qtype, typebuf,
+				     sizeof(typebuf));
+		ns_client_log(client, NS_LOGCATEGORY_SERVE_STALE,
+			      NS_LOGMODULE_QUERY, ISC_LOG_NOTICE,
+			      "%s/%s stale refresh failed: timed out", namebuf,
+			      typebuf);
+
+		/*
+		 * Set up a short lived query context, solely to set the
+		 * last refresh failure time on the RRset in the cache
+		 * database, starting the stale-refresh-time window for it.
+		 * This is a condensed form of query_lookup().
+		 */
+		isc_stdtime_get(&client->now);
+		client->query.attributes &= ~NS_QUERYATTR_RECURSIONOK;
+		qctx_init(client, NULL, 0, &qctx);
+
+		dns_clientinfomethods_init(&cm, ns_client_sourceip);
+		dns_clientinfo_init(&ci, qctx.client, NULL);
+		if (HAVEECS(qctx.client)) {
+			dns_clientinfo_setecs(&ci, &qctx.client->ecs);
+		}
+
+		result = qctx_prepare_buffers(&qctx, &buffer);
+		if (result != ISC_R_SUCCESS) {
+			goto cleanup;
+		}
+
+		dboptions = qctx.client->query.dboptions;
+		dboptions |= DNS_DBFIND_STALEOK;
+		dboptions |= DNS_DBFIND_STALESTART;
+
+		dns_db_attach(qctx.client->view->cachedb, &db);
+		(void)dns_db_findext(db, qctx.client->query.qname, NULL,
+				     qctx.client->query.qtype, dboptions,
+				     qctx.client->now, &qctx.node, qctx.fname,
+				     &cm, &ci, qctx.rdataset, qctx.sigrdataset);
+		if (qctx.node != NULL) {
+			dns_db_detachnode(db, &qctx.node);
+		}
+		dns_db_detach(&db);
+
+	cleanup:
+		qctx_freedata(&qctx);
+		qctx_destroy(&qctx);
+	}
+}
+
+ static void
+ prefetch_done(isc_task_t *task, isc_event_t *event) {
+ 	dns_fetchevent_t *devent = (dns_fetchevent_t *)event;
+@@ -2564,6 +2646,133 @@ prefetch_done(isc_task_t *task, isc_event_t *event) {
+ 	isc_nmhandle_detach(&client->prefetchhandle);
+ }
+ 
+static void
+refresh_done(isc_task_t *task, isc_event_t *event) {
+	dns_fetchevent_t *devent = (dns_fetchevent_t *)event;
+	ns_client_t *client;
+
+	UNUSED(task);
+
+	REQUIRE(event->ev_type == DNS_EVENT_FETCHDONE);
+	client = devent->ev_arg;
+	REQUIRE(NS_CLIENT_VALID(client));
+	REQUIRE(task == client->task);
+
+	CTRACE(ISC_LOG_DEBUG(3), "refresh_done");
+
+	LOCK(&client->query.fetchlock);
+	if (client->query.stalerefresh != NULL) {
+		INSIST(devent->fetch == client->query.stalerefresh);
+		client->query.stalerefresh = NULL;
+	}
+	UNLOCK(&client->query.fetchlock);
+
+	stale_refresh_aftermath(client, devent->result);
+
+	if (client->recursionquota != NULL) {
+		isc_quota_detach(&client->recursionquota);
+		ns_stats_decrement(client->sctx->nsstats,
+				   ns_statscounter_recursclients);
+	}
+
+	free_devent(client, &event, &devent);
+	isc_nmhandle_detach(&client->stalerefreshhandle);
+}
+
+static void
+query_stale_refresh(ns_client_t *client, dns_name_t *qname,
+					dns_rdataset_t *rdataset) {
+	isc_result_t result;
+	isc_sockaddr_t *peeraddr;
+	dns_rdataset_t *tmprdataset;
+	unsigned int options;
+
+	CTRACE(ISC_LOG_DEBUG(3), "query_stale_refresh");
+
+	bool stale_refresh_window = false;
+	bool stale_rrset = true;
+
+	if (rdataset != NULL) {
+		stale_refresh_window =
+			(STALE_WINDOW(rdataset) &&
+			(client->query.dboptions & DNS_DBFIND_STALEENABLED) != 0);
+		stale_rrset = STALE(rdataset);
+	}
+
+	if (client->query.stalerefresh != NULL ||
+		(client->query.dboptions & DNS_DBFIND_STALETIMEOUT) == 0 ||
+		!stale_rrset || stale_refresh_window)
+	{
+		return;
+	}
+
+	char namebuf[DNS_NAME_FORMATSIZE];
+	char typebuf[DNS_RDATATYPE_FORMATSIZE];
+	dns_name_format(qname, namebuf, sizeof(namebuf));
+	dns_rdatatype_format(client->query.qtype, typebuf, sizeof(typebuf));
+	isc_log_write(ns_lctx, NS_LOGCATEGORY_SERVE_STALE, NS_LOGMODULE_QUERY,
+			ISC_LOG_INFO,
+			"%s %s stale answer used, an attempt "
+			"to refresh the RRset will still be "
+			"made",
+			namebuf, typebuf);
+
+	client->query.dboptions &= ~(DNS_DBFIND_STALETIMEOUT |
+				     DNS_DBFIND_STALEOK |
+				     DNS_DBFIND_STALEENABLED);
+
+	if (client->recursionquota == NULL) {
+		result = isc_quota_attach(&client->sctx->recursionquota,
+					  &client->recursionquota);
+		switch (result) {
+			case ISC_R_SUCCESS:
+				ns_stats_increment(client->sctx->nsstats,
+						   ns_statscounter_recursclients);
+				break;
+			case ISC_R_SOFTQUOTA:
+				isc_quota_detach(&client->recursionquota);
+				FALLTHROUGH;
+			default:
+				return;
+		}
+	}
+
+	tmprdataset = ns_client_newrdataset(client);
+	if (tmprdataset == NULL) {
+		return;
+	}
+
+	if (!TCP(client)) {
+		peeraddr = &client->peeraddr;
+	} else {
+		peeraddr = NULL;
+	}
+
+	isc_nmhandle_attach(client->handle, &client->stalerefreshhandle);
+	options = client->query.fetchoptions;
+	result = dns_resolver_createfetch(
+		client->view->resolver, qname, client->query.qtype, NULL, NULL, NULL,
+		peeraddr, client->message->id, options, 0, NULL, client->task,
+		refresh_done, client, tmprdataset, NULL,
+		&client->query.stalerefresh);
+	if (result != ISC_R_SUCCESS) {
+		ns_client_putrdataset(client, &tmprdataset);
+		isc_nmhandle_detach(&client->stalerefreshhandle);
+	}
+}
+
+static void
+query_stale_refresh_ncache(ns_client_t *client) {
+	dns_name_t *qname;
+
+	if (client->query.origqname != NULL) {
+		qname = client->query.origqname;
+	} else {
+		qname = client->query.qname;
+	}
+	query_stale_refresh(client, qname, NULL);
+}
+
+ static void
+ query_prefetch(ns_client_t *client, dns_name_t *qname,
+ 	       dns_rdataset_t *rdataset) {
+@@ -2579,6 +2788,7 @@ query_prefetch(ns_client_t *client, dns_name_t *qname,
+ 	    rdataset->ttl > client->view->prefetch_trigger ||
+ 	    (rdataset->attributes & DNS_RDATASETATTR_PREFETCH) == 0)
+ 	{
+		query_stale_refresh(client, qname, rdataset);
+ 		return;
+ 	}
+ 
+@@ -2623,6 +2833,7 @@ query_prefetch(ns_client_t *client, dns_name_t *qname,
+ 
+ 	dns_rdataset_clearprefetch(rdataset);
+ 	ns_stats_increment(client->sctx->nsstats, ns_statscounter_prefetch);
+	return;
+ }
+ 
+ static void
+@@ -5801,55 +6012,6 @@ error:
+ 	return (ISC_R_NOMEMORY);
+ }
+ 
+-/*
+- * Setup a new query context for resolving a query.
+- *
+- * This function is only called if both these conditions are met:
+- *    1. BIND is configured with stale-answer-client-timeout 0.
+- *    2. A stale RRset is found in cache during initial query
+- *       database lookup.
+- *
+- * We continue with this function for refreshing/resolving an RRset
+- * after answering a client with stale data.
+- */
+-static void
+-query_refresh_rrset(query_ctx_t *orig_qctx) {
+-	isc_buffer_t buffer;
+-	query_ctx_t qctx;
+-
+-	REQUIRE(orig_qctx != NULL);
+-	REQUIRE(orig_qctx->client != NULL);
+-
+-	qctx_copy(orig_qctx, &qctx);
+-	qctx.client->query.dboptions &= ~(DNS_DBFIND_STALETIMEOUT |
+-					  DNS_DBFIND_STALEOK |
+-					  DNS_DBFIND_STALEENABLED);
+-	qctx.client->nodetach = false;
+-
+-	/*
+-	 * We'll need some resources...
+-	 */
+-	if (qctx_prepare_buffers(&qctx, &buffer) != ISC_R_SUCCESS) {
+-		dns_db_detach(&qctx.db);
+-		qctx_destroy(&qctx);
+-		return;
+-	}
+-
+-	/*
+-	 * Pretend we didn't find anything in cache.
+-	 */
+-	(void)query_gotanswer(&qctx, ISC_R_NOTFOUND);
+-
+-	if (qctx.fname != NULL) {
+-		ns_client_releasename(qctx.client, &qctx.fname);
+-	}
+-	if (qctx.rdataset != NULL) {
+-		ns_client_putrdataset(qctx.client, &qctx.rdataset);
+-	}
+-
+-	qctx_destroy(&qctx);
+-}
+-
+ /*%
+  * Depending on the db lookup result, we can respond to the
+  * client this stale answer.
+@@ -5921,7 +6083,7 @@ query_lookup(query_ctx_t *qctx) {
+ 		rpzqname = qctx->client->query.qname;
+ 	}
+ 
+-	if ((qctx->options & DNS_GETDB_STALEFIRST) != 0) {
+	if ((qctx->options & DNS_GETDB_STALEFIRST) != 0 && !qctx->is_zone) {
+ 		/*
+ 		 * If DNS_GETDB_STALEFIRST is set, it means that a stale
+ 		 * RRset may be returned as part of this lookup. An attempt
+@@ -5931,19 +6093,19 @@ query_lookup(query_ctx_t *qctx) {
+ 		qctx->client->query.dboptions |= DNS_DBFIND_STALETIMEOUT;
+ 	}
+ 
+-	dboptions = qctx->client->query.dboptions;
+-	if (!qctx->is_zone && qctx->findcoveringnsec &&
+-	    (qctx->type != dns_rdatatype_null || !dns_name_istat(rpzqname)))
+-	{
+-		dboptions |= DNS_DBFIND_COVERINGNSEC;
+-	}
+-
+ 	(void)dns_db_getservestalerefresh(qctx->client->view->cachedb,
+ 					  &stale_refresh);
+ 	if (stale_refresh > 0 &&
+ 	    dns_view_staleanswerenabled(qctx->client->view))
+ 	{
+-		dboptions |= DNS_DBFIND_STALEENABLED;
+		qctx->client->query.dboptions |= DNS_DBFIND_STALEENABLED;
+	}
+
+	dboptions = qctx->client->query.dboptions;
+	if (!qctx->is_zone && qctx->findcoveringnsec &&
+		(qctx->type != dns_rdatatype_null || !dns_name_istat(rpzqname)))
+	{
+		dboptions |= DNS_DBFIND_COVERINGNSEC;
+ 	}
+ 
+ 	result = dns_db_findext(qctx->db, rpzqname, qctx->version, qctx->type,
+@@ -6092,19 +6254,7 @@ query_lookup(query_ctx_t *qctx) {
+ 				 * Immediately return the stale answer, start a
+ 				 * resolver fetch to refresh the data in cache.
+ 				 */
+-				isc_log_write(
+-					ns_lctx, NS_LOGCATEGORY_SERVE_STALE,
+-					NS_LOGMODULE_QUERY, ISC_LOG_INFO,
+-					"%s stale answer used, an attempt to "
+-					"refresh the RRset will still be made",
+-					namebuf);
+-
+-				qctx->refresh_rrset = STALE(qctx->rdataset);
+-				/*
+-				 * If we are refreshing the RRSet, we must not
+-				 * detach from the client in query_send().
+-				 */
+-				qctx->client->nodetach = qctx->refresh_rrset;
+				qctx->client->nodetach = false;
+ 
+ 				if (stale_found) {
+ 					ns_client_extendederror(
+@@ -6144,76 +6294,12 @@ query_lookup(query_ctx_t *qctx) {
+ 		}
+ 	}
+ 
+-	if (stale_timeout && (answer_found || stale_found)) {
+-		/*
+-		 * Mark RRsets that we are adding to the client message on a
+-		 * lookup during 'stale-answer-client-timeout', so we can
+-		 * clean it up if needed when we resume from recursion.
+-		 */
+-		qctx->client->query.attributes |= NS_QUERYATTR_STALEOK;
+-		qctx->rdataset->attributes |= DNS_RDATASETATTR_STALE_ADDED;
+-	}
+-
+ 	result = query_gotanswer(qctx, result);
+ 
+ cleanup:
+ 	return (result);
+ }
+ 
+-/*
+- * Clear all rdatasets from the message that are in the given section and
+- * that have the 'attr' attribute set.
+- */
+-static void
+-message_clearrdataset(dns_message_t *msg, unsigned int attr) {
+-	unsigned int i;
+-	dns_name_t *name, *next_name;
+-	dns_rdataset_t *rds, *next_rds;
+-
+-	/*
+-	 * Clean up name lists by calling the rdataset disassociate function.
+-	 */
+-	for (i = DNS_SECTION_ANSWER; i < DNS_SECTION_MAX; i++) {
+-		name = ISC_LIST_HEAD(msg->sections[i]);
+-		while (name != NULL) {
+-			next_name = ISC_LIST_NEXT(name, link);
+-
+-			rds = ISC_LIST_HEAD(name->list);
+-			while (rds != NULL) {
+-				next_rds = ISC_LIST_NEXT(rds, link);
+-				if ((rds->attributes & attr) != attr) {
+-					rds = next_rds;
+-					continue;
+-				}
+-				ISC_LIST_UNLINK(name->list, rds, link);
+-				INSIST(dns_rdataset_isassociated(rds));
+-				dns_rdataset_disassociate(rds);
+-				isc_mempool_put(msg->rdspool, rds);
+-				rds = next_rds;
+-			}
+-
+-			if (ISC_LIST_EMPTY(name->list)) {
+-				ISC_LIST_UNLINK(msg->sections[i], name, link);
+-				if (dns_name_dynamic(name)) {
+-					dns_name_free(name, msg->mctx);
+-				}
+-				isc_mempool_put(msg->namepool, name);
+-			}
+-
+-			name = next_name;
+-		}
+-	}
+-}
+-
+-/*
+- * Clear any rdatasets from the client's message that were added on a lookup
+- * due to a client timeout.
+- */
+-static void
+-query_clear_stale(ns_client_t *client) {
+-	message_clearrdataset(client->message, DNS_RDATASETATTR_STALE_ADDED);
+-}
+-
+ /*
+  * Create a new query context with the sole intent of looking up for a stale
+  * RRset in cache. If an entry is found, we mark the original query as
+@@ -6293,6 +6379,7 @@ fetch_callback(isc_task_t *task, isc_event_t *event) {
+ 	}
+ 	client->query.fetchoptions &= ~DNS_FETCHOPT_TRYSTALE_ONTIMEOUT;
+ 	client->query.dboptions &= ~DNS_DBFIND_STALETIMEOUT;
+	client->query.dboptions &= ~DNS_DBFIND_STALEENABLED;
+ 	client->nodetach = false;
+ 
+ 	LOCK(&client->query.fetchlock);
+@@ -7660,14 +7747,6 @@ query_usestale(query_ctx_t *qctx, isc_result_t result) {
+ 		return (false);
+ 	}
+ 
+-	if (qctx->refresh_rrset) {
+-		/*
+-		 * This is a refreshing query, we have already prioritized
+-		 * stale data, so don't enable serve-stale again.
+-		 */
+-		return (false);
+-	}
+-
+ 	if (result == DNS_R_DUPLICATE || result == DNS_R_DROP ||
+ 	    result == ISC_R_ALREADYRUNNING)
+ 	{
+@@ -8207,24 +8286,6 @@ query_addanswer(query_ctx_t *qctx) {
+ 
+ 	CALL_HOOK(NS_QUERY_ADDANSWER_BEGIN, qctx);
+ 
+-	/*
+-	 * On normal lookups, clear any rdatasets that were added on a
+-	 * lookup due to stale-answer-client-timeout. Do not clear if we
+-	 * are going to refresh the RRset, because the stale contents are
+-	 * prioritized.
+-	 */
+-	if (QUERY_STALEOK(&qctx->client->query) &&
+-	    !QUERY_STALETIMEOUT(&qctx->client->query) && !qctx->refresh_rrset)
+-	{
+-		CCTRACE(ISC_LOG_DEBUG(3), "query_clear_stale");
+-		query_clear_stale(qctx->client);
+-		/*
+-		 * We can clear the attribute to prevent redundant clearing
+-		 * in subsequent lookups.
+-		 */
+-		qctx->client->query.attributes &= ~NS_QUERYATTR_STALEOK;
+-	}
+-
+ 	if (qctx->dns64) {
+ 		result = query_dns64(qctx);
+ 		qctx->noqname = NULL;
+@@ -8258,9 +8319,7 @@ query_addanswer(query_ctx_t *qctx) {
+ 		query_filter64(qctx);
+ 		ns_client_putrdataset(qctx->client, &qctx->rdataset);
+ 	} else {
+-		if (!qctx->is_zone && RECURSIONOK(qctx->client) &&
+-		    !QUERY_STALETIMEOUT(&qctx->client->query))
+-		{
+		if (!qctx->is_zone && RECURSIONOK(qctx->client)) {
+ 			query_prefetch(qctx->client, qctx->fname,
+ 				       qctx->rdataset);
+ 		}
+@@ -10542,6 +10601,10 @@ query_ncache(query_ctx_t *qctx, isc_result_t result) {
+ 		}
+ 	}
+ 
+	if (!qctx->is_zone && RECURSIONOK(qctx->client)) {
+		query_stale_refresh_ncache(qctx->client);
+	}
+
+ 	return (query_nodata(qctx, result));
+ 
+ cleanup:
+@@ -12044,20 +12107,6 @@ ns_query_done(query_ctx_t *qctx) {
+ 	nodetach = qctx->client->nodetach;
+ 	query_send(qctx->client);
+ 
+-	if (qctx->refresh_rrset) {
+-		/*
+-		 * If we reached this point then it means that we have found a
+-		 * stale RRset entry in cache and BIND is configured to allow
+-		 * queries to be answered with stale data if no active RRset
+-		 * is available, i.e. "stale-anwer-client-timeout 0". But, we
+-		 * still need to refresh the RRset. To prevent adding duplicate
+-		 * RRsets, clear the RRsets from the message before doing the
+-		 * refresh.
+-		 */
+-		message_clearrdataset(qctx->client->message, 0);
+-		query_refresh_rrset(qctx);
+-	}
+-
+ 	if (!nodetach) {
+ 		qctx->detach_client = true;
+ 	}
--- a/SOURCES/bind-9.21-resume-qmin-cname.patch
+++ b/SOURCES/bind-9.21-resume-qmin-cname.patch
@ -0,0 +1,44 @@
+From ac0c3b0477d97fe5c968910f603bb8d04c740da7 Mon Sep 17 00:00:00 2001
+From: Petr Mensik <pemensik@redhat.com>
+Date: Tue, 3 Jun 2025 21:00:58 +0200
+Subject: [PATCH] Handle CNAME and DNAME in resume_min in a special way
+
+When authoritative zone is loaded when query minimization query for the
+same zone is already pending, it might receive unexpected result codes.
+
+Normally DNS_R_CNAME would follow to query_cname after processing sent
+events, but dns_view_findzonecut does not fill CNAME target into
+event->foundevent. Usual lookup via query_lookup would always have that
+filled.
+
+Ideally we would restart the query with unmodified search name, if
+unexpected change from recursing to local zone cut were detected. Until
+dns_view_findzonecut is modified to export zone/cache source of the cut,
+at least fail queries which went into unexpected state.
+---
+ lib/dns/resolver.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
+index 795791246b..39a294437e 100644
+--- a/lib/dns/resolver.c
+++ b/lib/dns/resolver.c
+@@ -4497,6 +4497,15 @@ resume_qmin(isc_task_t *task, isc_event_t *event) {
+ 	if (result == DNS_R_NXDOMAIN) {
+ 		result = DNS_R_SERVFAIL;
+ 	}
+	/*
+	 * CNAME or DNAME means zone were added with that record
+	 * after the start of query minimization queries. It means
+	 * we do not have initialized correct hevent->foundname
+	 * and have to fail.
+	 */
+	if (result == DNS_R_CNAME || result == DNS_R_DNAME) {
+		result = DNS_R_SERVFAIL;
+	}
+ 
+ 	if (result != ISC_R_SUCCESS) {
+ 		goto cleanup;
+-- 
+2.49.0
+
--- a/SOURCES/bind-9.5-PIE.patch
+++ b/SOURCES/bind-9.5-PIE.patch
@ -0,0 +1,28 @@
+From 13348a5fc64387bf53ef450688e181100d0ceddb Mon Sep 17 00:00:00 2001
+From: Petr Mensik <pemensik@redhat.com>
+Date: Thu, 12 Dec 2024 15:56:13 +0100
+Subject: [PATCH] Harden named service build flags
+
+---
+ bin/named/Makefile.am | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/bin/named/Makefile.am b/bin/named/Makefile.am
+index 57a023b..b832e9c 100644
+--- a/bin/named/Makefile.am
+++ b/bin/named/Makefile.am
+@@ -33,7 +33,10 @@ endif HAVE_LIBXML2
+ 
+ AM_CPPFLAGS +=						\
+ 	-DNAMED_LOCALSTATEDIR=\"${localstatedir}\"	\
+-	-DNAMED_SYSCONFDIR=\"${sysconfdir}\"
+	-DNAMED_SYSCONFDIR=\"${sysconfdir}\"		\
+	-fpie
+
+AM_LDFLAGS  += -pie -Wl,-z,relro,-z,now,-z,nodlopen,-z,noexecstack
+ 
+ sbin_PROGRAMS = named
+ 
+-- 
+2.47.1
+
--- a/SOURCES/bind-chroot.tmpfiles.d
+++ b/SOURCES/bind-chroot.tmpfiles.d
@ -0,0 +1,38 @@
+# vim: ft=conf:
+# TODO: these definitions are in different form in rpm spec %files chroot section
+# find a way to have it defined only once
+#defattr(0664,root,named,-)
+c /var/named/chroot/dev/null    0664 root named - 1:3
+c /var/named/chroot/dev/random  0664 root named - 1:8
+c /var/named/chroot/dev/urandom 0664 root named - 1:9
+c /var/named/chroot/dev/zero    0664 root named - 1:5
+#defattr(0640,root,named,0750)
+d /var/named/chroot             0750 root named -
+d /var/named/chroot/dev         0750 root named -
+d /var/named/chroot/etc         0750 root named -
+d /var/named/chroot/etc/named   0750 root named -
+d /var/named/chroot/etc/pki     0750 root named -
+d /var/named/chroot/etc/pki/dnssec-keys 0750 root named -
+d /var/named/chroot/etc/crypto-policies 0750 root named -
+d /var/named/chroot/etc/crypto-policies/back-ends 0750 root named -
+d /var/named/chroot/var         0750 root named -
+d /var/named/chroot/run         0750 root named -
+#defattr(-,root,root,-)
+d /var/named/chroot/usr             - root root -
+d /var/named/chroot/usr/lib64       - root root -
+d /var/named/chroot/usr/lib64/bind  - root root -
+d /var/named/chroot/usr/lib64/named - root root -
+d /var/named/chroot/usr/share/GeoIP - root root -
+d /var/named/chroot/usr/share/named - root root -
+d /var/named/chroot/proc            - root root -
+d /var/named/chroot/proc/sys        - root root -
+d /var/named/chroot/proc/sys/net    - root root -
+d /var/named/chroot/proc/sys/net/ipv4 - root root -
+#defattr(0660,root,named,01770)
+d /var/named/chroot/var/named   01770 root named -
+#defattr(0660,named,named,0770)
+d /var/named/chroot/var/tmp      0770 named named -
+d /var/named/chroot/var/log      0770 named named -
+#defattr(-,named,named,-)
+d /var/named/chroot/run/named       - named named -
+L /var/named/chroot/var/run         - named named - ../run
--- a/SOURCES/bind.tmpfiles.d
+++ b/SOURCES/bind.tmpfiles.d
@ -0,0 +1,10 @@
+# vim: ft=conf:
+d /run/named 0755 named named -
+d /var/named 01770 root named -
+d /var/named/slaves  0770 named named -
+d /var/named/data    0770 named named -
+d /var/named/dynamic 0770 named named -
+L /var/named/named.ca        0640 named named - ../../../usr/share/named/named.ca
+L /var/named/named.localhost 0640 named named - ../../../usr/share/named/named.localhost
+L /var/named/named.loopback  0640 named named - ../../../usr/share/named/named.loopback
+L /var/named/named.empty     0640 named named - ../../../usr/share/named/named.empty
--- a/SOURCES/generate-rndc-key.sh
+++ b/SOURCES/generate-rndc-key.sh
--- a/SOURCES/isc-keyblock.asc
+++ b/SOURCES/isc-keyblock.asc
--- a/SOURCES/named-chroot-setup.service
+++ b/SOURCES/named-chroot-setup.service
--- a/SOURCES/named-chroot.files
+++ b/SOURCES/named-chroot.files
@ -3,6 +3,7 @@
 # if they are missing or empty in target directory.
 /etc/localtime
 /etc/named.root.key
+/etc/named.ca
 /etc/named.conf
 /etc/named.rfc1912.zones
 /etc/rndc.conf
@ -17,6 +18,7 @@
 /usr/lib64/bind
 /usr/lib/bind
 /usr/share/GeoIP
+/usr/share/named
 /run/named
 /proc/sys/net/ipv4/ip_local_port_range
 # Warning: the order is important
--- a/SOURCES/named-chroot.service
+++ b/SOURCES/named-chroot.service
--- a/SOURCES/named-setup-rndc.service
+++ b/SOURCES/named-setup-rndc.service
--- a/SOURCES/named.conf
+++ b/SOURCES/named.conf
--- a/SOURCES/named.conf.sample
+++ b/SOURCES/named.conf.sample
--- a/SOURCES/named.empty
+++ b/SOURCES/named.empty
--- a/SOURCES/named.localhost
+++ b/SOURCES/named.localhost
--- a/SOURCES/named.logrotate
+++ b/SOURCES/named.logrotate
@ -2,11 +2,9 @@
    missingok
    su named named
    create 0644 named named
+    notifempty
    postrotate
        /usr/bin/systemctl reload named.service > /dev/null 2>&1 || true
        /usr/bin/systemctl reload named-chroot.service > /dev/null 2>&1 || true
-        /usr/bin/systemctl reload named-sdb.service > /dev/null 2>&1 || true
-        /usr/bin/systemctl reload named-sdb-chroot.service > /dev/null 2>&1 || true
-        /usr/bin/systemctl reload named-pkcs11.service > /dev/null 2>&1 || true
    endscript
 }
--- a/SOURCES/named.loopback
+++ b/SOURCES/named.loopback
--- a/SOURCES/named.rfc1912.zones
+++ b/SOURCES/named.rfc1912.zones
--- a/SOURCES/named.root
+++ b/SOURCES/named.root
--- a/SOURCES/named.root.key
+++ b/SOURCES/named.root.key
--- a/SOURCES/named.rwtab
+++ b/SOURCES/named.rwtab
--- a/SOURCES/named.service
+++ b/SOURCES/named.service
--- a/SOURCES/named.sysconfig
+++ b/SOURCES/named.sysconfig
--- a/SOURCES/named.sysusers
+++ b/SOURCES/named.sysusers
@ -0,0 +1,3 @@
+#Type Name       ID                  GECOS              Home directory Shell
+u     named      25                 "Named"             /var/named     /sbin/nologin
+g     named      25
--- a/SOURCES/setup-named-chroot.sh
+++ b/SOURCES/setup-named-chroot.sh
--- a/SOURCES/setup-named-softhsm.sh
+++ b/SOURCES/setup-named-softhsm.sh
--- a/SOURCES/trusted-key.key
+++ b/SOURCES/trusted-key.key
--- a/SPECS/bind9.18.spec
+++ b/SPECS/bind9.18.spec
@ -27,14 +27,12 @@
 %endif
 %bcond_with    TSAN

-%{?!bind_uid:  %global bind_uid  25}
-%{?!bind_gid:  %global bind_gid  25}
 %{!?_pkgdocdir:%global _pkgdocdir %{_docdir}/%{name}-%{version}}
 %global        bind_dir          /var/named
 %global        chroot_prefix     %{bind_dir}/chroot
 %global        chroot_create_directories /dev /run/named %{_localstatedir}/{log,named,tmp} \\\
                                         %{_sysconfdir}/{crypto-policies/back-ends,pki/dnssec-keys,named} \\\
-                                         %{_libdir}/bind %{_libdir}/named %{_datadir}/GeoIP /proc/sys/net/ipv4
+                                         %{_libdir}/bind %{_libdir}/named %{_datadir}/{GeoIP,named} /proc/sys/net/ipv4

 %global        selinuxbooleans   named_write_master_zones=1
 ## The order of libs is important. See lib/Makefile.in for details
@ -77,7 +75,7 @@ License:  MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause
 # ./lib/isc/tm.c BSD-2-clause and/or MPL-2.0
 # ./lib/isccfg/parser.c BSD-2-clause and/or MPL-2.0
 Version:  9.18.29
-Release:  1%{?dist}
+Release:  16%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
 #
@ -107,6 +105,8 @@ Source44: named-chroot-setup.service
 Source46: named-setup-rndc.service
 Source48: setup-named-softhsm.sh
 Source49: named-chroot.files
+Source50: named.sysusers
+Source51: bind-chroot.tmpfiles.d

 # Common patches
 # FIXME: Is this still required?
@ -114,10 +114,49 @@ Patch10: bind-9.5-PIE.patch
 Patch16: bind-9.16-redhat_doc.patch
 # https://bugzilla.redhat.com/show_bug.cgi?id=2122010
 Patch26: bind-9.18-unittest-netmgr-unstable.patch
+# https://issues.redhat.com/browse/FREEIPA-11706
+# https://issues.redhat.com/browse/RHEL-76331
+Patch27: bind-9.18-nsupdate-TLS.patch
+Patch28: bind-9.18-nsupdate-TLS-doc.patch
+Patch29: bind-9.18-nsupdate-TLS-tests.patch
+# https://gitlab.isc.org/isc-projects/bind9/-/commit/c6e6a7af8ac6b575dd3657b0f5cf4248d734c2b0
+Patch30: bind-9.18-CVE-2024-11187-pre-test.patch
+Patch31: bind-9.18-CVE-2024-11187.patch
+# https://gitlab.isc.org/isc-projects/bind9/-/commit/e733e624147155d6cbee7f0f150c79c7ac6b54bb
+Patch32: bind-9.18-CVE-2024-12705.patch
+# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/10562
+# https://gitlab.isc.org/isc-projects/bind9/-/issues/5357
+# downstream patch fixing bind-dyndb-ldap causing issue
+Patch33: bind-9.21-resume-qmin-cname.patch
+# downstream only, extra check for above change, RHEL-30407
+Patch34: bind-9.18-query-fname-relative.patch
+# https://gitlab.isc.org/isc-projects/bind9/commit/40c396ba2d955c32d70db04e900e40bf96519c59
+# https://gitlab.isc.org/isc-projects/bind9/commit/7c5b8ef055900224f0424c341927562c5a9ebe19
+Patch223: bind-9.18-CVE-2025-8677.patch
+# https://gitlab.isc.org/isc-projects/bind9/commit/025d61bacd0f57f994a631654aff7a933d89a547
+# https://gitlab.isc.org/isc-projects/bind9/commit/cd17dfe696cdf9b8ef23fbc8738de7c79f957846
+# https://gitlab.isc.org/isc-projects/bind9/commit/4c6d03b0bb2ffbafcde8e8a5bc0e49908b978a72
+Patch224: bind-9.18-CVE-2025-40778.patch
+# https://gitlab.isc.org/isc-projects/bind9/commit/8330b49fb90bfeae14b47b7983e9459cc2bbaffe
+Patch225: bind-9.18-CVE-2025-40780.patch
+# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/11194
+Patch226: bind-9.20-CVE-2025-8677-dual-signing.patch
+# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/11195
+Patch227: bind-9.20-CVE-2025-8677-dual-signing-test.patch
+# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/11329
+Patch228: bind-9.20-robust-key-rollovers.patch
+Patch229: bind-9.20-robust-key-rollovers-tests.patch
+# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/10767
+Patch230: bind-9.20-stale-cname.patch
+Patch231: bind-9.20-stale-cname-tests.patch
+# https://gitlab.isc.org/isc-projects/bind9/-/commit/5ef459eeaa92222ad28d2186f5eae9a586dece70
+Patch232: bind-9.18-CVE-2026-1519.patch
+Patch233: bind-9.18-CVE-2026-1519-test.patch

 %{?systemd_ordering}
+# https://fedoraproject.org/wiki/Changes/RPMSuportForSystemdSysusers
+%{?sysusers_requires_compat}
 Requires:       coreutils
-Requires(pre):  shadow-utils
 Requires(post): shadow-utils
 Requires(post): glibc-common
 Requires(post): grep
@ -476,6 +515,7 @@ export TSAN_OPTIONS="log_exe_name=true log_path=ThreadSanitizer exitcode=0"
    THREADS=16
    ulimit -n 8092 || : # Requires on some machines with many cores
  fi
+  export ISC_TASK_WORKERS="$THREADS"
  e=0
  make unit -j${THREADS} || e=$?
  # Display details of failure
@ -557,6 +597,9 @@ install -m 644 %{SOURCE38} ${RPM_BUILD_ROOT}%{_unitdir}
 install -m 644 %{SOURCE44} ${RPM_BUILD_ROOT}%{_unitdir}
 install -m 644 %{SOURCE46} ${RPM_BUILD_ROOT}%{_unitdir}

+mkdir -p ${RPM_BUILD_ROOT}%{_sysusersdir}
+install -m 644 %{SOURCE50} ${RPM_BUILD_ROOT}%{_sysusersdir}/%{name}.conf
+
 mkdir -p ${RPM_BUILD_ROOT}%{_libexecdir}
 install -m 755 %{SOURCE41} ${RPM_BUILD_ROOT}%{_libexecdir}/setup-named-chroot.sh
 install -m 755 %{SOURCE42} ${RPM_BUILD_ROOT}%{_libexecdir}/generate-rndc-key.sh
@ -638,21 +681,28 @@ touch ${RPM_BUILD_ROOT}%{_sysconfdir}/rndc.{key,conf}
 install -m 644 %{SOURCE27} ${RPM_BUILD_ROOT}%{_sysconfdir}/named.root.key
 install -m 644 %{SOURCE36} ${RPM_BUILD_ROOT}%{_sysconfdir}/trusted-key.key
 mkdir -p ${RPM_BUILD_ROOT}%{_sysconfdir}/named
+mkdir -p ${RPM_BUILD_ROOT}%{_datadir}/named
+install -p -m 644 %{SOURCE17} ${RPM_BUILD_ROOT}%{_datadir}/named/named.ca
+install -p -m 644 %{SOURCE18} ${RPM_BUILD_ROOT}%{_datadir}/named/named.localhost
+install -p -m 644 %{SOURCE19} ${RPM_BUILD_ROOT}%{_datadir}/named/named.loopback
+install -p -m 644 %{SOURCE20} ${RPM_BUILD_ROOT}%{_datadir}/named/named.empty

 # data files:
 mkdir -p ${RPM_BUILD_ROOT}%{_localstatedir}/named
-install -m 640 %{SOURCE17} ${RPM_BUILD_ROOT}%{_localstatedir}/named/named.ca
-install -m 640 %{SOURCE18} ${RPM_BUILD_ROOT}%{_localstatedir}/named/named.localhost
-install -m 640 %{SOURCE19} ${RPM_BUILD_ROOT}%{_localstatedir}/named/named.loopback
-install -m 640 %{SOURCE20} ${RPM_BUILD_ROOT}%{_localstatedir}/named/named.empty
-install -m 640 %{SOURCE23} ${RPM_BUILD_ROOT}%{_sysconfdir}/named.rfc1912.zones
+# Create duplicate copies for maximal backward compatibility
+install -p -m 644 %{SOURCE17} ${RPM_BUILD_ROOT}%{_localstatedir}/named/named.ca
+install -p -m 644 %{SOURCE18} ${RPM_BUILD_ROOT}%{_localstatedir}/named/named.localhost
+install -p -m 644 %{SOURCE19} ${RPM_BUILD_ROOT}%{_localstatedir}/named/named.loopback
+install -p -m 644 %{SOURCE20} ${RPM_BUILD_ROOT}%{_localstatedir}/named/named.empty
+install -p -m 640 %{SOURCE23} ${RPM_BUILD_ROOT}%{_sysconfdir}/named.rfc1912.zones

 # sample bind configuration files for %%doc:
 mkdir -p sample/etc sample/var/named/{data,slaves}
 install -m 644 %{SOURCE25} sample/etc/named.conf
-# Copy default configuration to %%doc to make it usable from system-config-bind
+# Copy default configuration to %%doc
 install -m 644 %{SOURCE16} named.conf.default
 install -m 644 %{SOURCE23} sample/etc/named.rfc1912.zones
+# Extra copies in documentation too.
 install -m 644 %{SOURCE18} %{SOURCE19} %{SOURCE20}  sample/var/named
 install -m 644 %{SOURCE17} sample/var/named/named.ca
 for f in my.internal.zone.db slaves/my.slave.internal.zone.db slaves/my.ddns.internal.zone.db my.external.zone.db; do 
@ -662,15 +712,15 @@ done
 :;

 mkdir -p ${RPM_BUILD_ROOT}%{_tmpfilesdir}
-install -m 644 %{SOURCE35} ${RPM_BUILD_ROOT}%{_tmpfilesdir}/named.conf
+install -p -m 644 %{SOURCE35} ${RPM_BUILD_ROOT}%{_tmpfilesdir}/named.conf
+install -p -m 644 %{SOURCE51} ${RPM_BUILD_ROOT}%{_tmpfilesdir}/%{name}-chroot.conf

 mkdir -p ${RPM_BUILD_ROOT}%{_sysconfdir}/rwtab.d
-install -m 644 %{SOURCE43} ${RPM_BUILD_ROOT}%{_sysconfdir}/rwtab.d/named
+install -p -m 644 %{SOURCE43} ${RPM_BUILD_ROOT}%{_sysconfdir}/rwtab.d/named

 %pre
 if [ "$1" -eq 1 ]; then
-  /usr/sbin/groupadd -g %{bind_gid} -f -r named >/dev/null 2>&1 || :;
-  /usr/sbin/useradd  -u %{bind_uid} -r -N -M -g named -s /sbin/nologin -d /var/named -c Named named >/dev/null 2>&1 || :;
+  %sysusers_create_compat %{SOURCE50}
 fi;
 :;

@ -775,6 +825,7 @@ fi;
 %{_unitdir}/named-setup-rndc.service
 %{_bindir}/named-journalprint
 %{_bindir}/named-checkconf
+%{_sysusersdir}/%{name}.conf
 %{_bindir}/named-rrchecker
 %{_bindir}/mdig
 %{_sbindir}/named
@ -810,6 +861,7 @@ fi;
 %dir %{_localstatedir}/named/dynamic
 %ghost %{_localstatedir}/log/named.log
 %defattr(0640,root,named,0750)
+%{_datadir}/named/
 %config %verify(not link) %{_localstatedir}/named/named.ca
 %config %verify(not link) %{_localstatedir}/named/named.localhost
 %config %verify(not link) %{_localstatedir}/named/named.loopback
@ -897,6 +949,7 @@ fi;
 %{_unitdir}/named-chroot.service
 %{_unitdir}/named-chroot-setup.service
 %{_libexecdir}/setup-named-chroot.sh
+%{_tmpfilesdir}/%{name}-chroot.conf
 %defattr(0664,root,named,-)
 %ghost %dev(c,1,3) %verify(not mtime) %{chroot_prefix}/dev/null
 %ghost %dev(c,1,8) %verify(not mtime) %{chroot_prefix}/dev/random
@ -919,6 +972,7 @@ fi;
 %dir %{chroot_prefix}/%{_libdir}
 %dir %{chroot_prefix}/%{_libdir}/bind
 %dir %{chroot_prefix}/%{_datadir}/GeoIP
+%dir %{chroot_prefix}/%{_datadir}/named
 %{chroot_prefix}/proc
 %defattr(0660,root,named,01770)
 %dir %{chroot_prefix}%{_localstatedir}/named
@ -961,6 +1015,60 @@ fi;
 %endif

 %changelog
+* Fri Mar 27 2026 Petr Menšík <pemensik@redhat.com> - 32:9.18.29-16
+- Prevent Denial of Service via maliciously crafted DNSSEC-validated zone
+  (CVE-2026-1519)
+- Correct backport issue in the patch (CVE-2026-1519)
+
+* Thu Feb 26 2026 Fedor Vorobev <fvorobev@redhat.com> - 32:9.18.29-15
+- Backport fixes for stale CNAME chains. (RHEL-86172)
+
+* Fri Jan 30 2026 Fedor Vorobev <fvorobev@redhat.com> - 32:9.18.29-14
+- Backport fix for manual DNSSEC key rolllovers. (RHEL-144422)
+
+* Thu Jan 29 2026 Petr Menšík <pemensik@redhat.com> - 32:9.18.29-13
+- Correct changelog version of previous change
+
+* Wed Jan 28 2026 Petr Menšík <pemensik@redhat.com> - 32:9.18.29-12
+- Add forgotten _libdir/named into bind-chroot tmpfiles (RHEL-132053)
+
+* Fri Dec 12 2025 Petr Menšík <pemensik@redhat.com> - 32:9.18.29-11
+- Add sysusers named user creation (RHEL-132053)
+
+* Fri Dec 12 2025 Petr Menšík <pemensik@redhat.com> - 32:9.18.29-10
+- Add missing bind-chroot subdirectories
+
+* Fri Dec 12 2025 Petr Menšík <pemensik@redhat.com> - 32:9.18.29-9
+- Create /var/named directories for bind-chroot (RHEL-132053)
+
+* Fri Oct 31 2025 Petr Menšík <pemensik@redhat.com> - 32:9.18.29-8
+- Copy named.* files from /usr/share/named into var/named
+
+* Fri Oct 31 2025 Petr Menšík <pemensik@redhat.com> - 32:9.18.29-7
+- Fix upstream reported regression in recent CVE fix (CVE-2025-8677)
+- Add upstream created test to this regression
+
+* Thu Oct 23 2025 Petr Menšík <pemensik@redhat.com> - 32:9.18.29-6
+- Refuse malformed DNSKEY records (CVE-2025-8677)
+- Address various spoofing attacks (CVE-2025-40778)
+- Prevent cache poisoning due to weak PRNG (CVE-2025-40780)
+
+* Fri Sep 12 2025 Petr Menšík <pemensik@redhat.com> - 32:9.18.29-5
+- logrotate: skip if empty and remove old variants (RHEL-113942)
+
+* Tue Jun 10 2025 Petr Mensik <pemensik@redhat.com> - 32:9.18.29-4
+- Prevent name.c:670 attributes assertion failed (RHEL-30407)
+- Add extra checks for relative names
+
+* Mon Feb 03 2025 Petr Menšík <pemensik@redhat.com> - 32:9.18.29-3
+- Limit additional section records CPU processing (CVE-2024-11187)
+- Read HTTPS requests in limited chunks and prevent overload (CVE-2024-12705)
+
+* Mon Jan 27 2025 Petr Menšík <pemensik@redhat.com> - 32:9.18.29-2
+- Backport nsupdate TLS support into 9.18 (RHEL-76331)
+- Update nsupdate manual about new TLS options
+- Test nsupdate TLS support
+
 * Wed Aug 21 2024 Petr Menšík <pemensik@redhat.com> - 32:9.18.29-1
 - Update to 9.18.29 (RHEL-53015)

--- a/bind-9.11.12.tar.gz.asc
+++ b/bind-9.11.12.tar.gz.asc
@ -1,16 +0,0 @@
-----BEGIN PGP SIGNATURE-----
-
-iQIzBAABAgAdFiEErj+seWcR7Fn8AHqkdLtrmky7PTgFAl2WMooACgkQdLtrmky7
-PThv2RAAnXNLYTzXtH6ls29tRm5Hc+D6UaeqcWDNQ4BpkRVhrFxtukalGCi9mmB6
-NPJzFyXmaOW654pypCIuEgqJNFUpDtLzLzT7SUF+mhm+5plsaRSBnh4mq87l5KSp
-twODAPnfCJV+HBk5RmToLEstAbGQ7xEBTyQtZoFkY+V7zEFwENKiCvWsoSWOkYR3
-zXo3sKjc83HV9ShbW/mCtbZf5L0qlbrKOAzqJfAFMhNNJi8kMbmr/Zi2sIfN+Rhv
-g8HQo89Epv6r51yAdeED8idIX4rKjjcEtHrZeDmLdCcdHgSEj2sIlH92Joce6vL0
-S59A0rItIXm6fW8sz6WNpcj4tVtWYbIYjXZ4SPFNkaUrHv8cUekq+5vbI+v07Gh3
-2bhtDsDyTY5I1/AsY/EFmwkCAjUS00jZryBnuJpLB3v5JtUog4ek32yLBzPrqRBo
-1876j4nlXAia8mG0OgJNWZ0gHyUPe/TgfR8fQDLmHxHHlKrJNTEwY6bLW8jzFTX1
-zk510fI1K7J9tiQgf5wcBQ2h3EBlqzDNIJDovoATzLYIf0HKyVegh/vnQdtdEhUR
-1DzJAt3bsBfAP1AFfWPD/ACu5Zdm7SxY1wE/pjkwttDU3sRZqOfuwNBGeolu3cVN
-O9/h1zsyVeVS0ui2vu4+V4EvNitmXsVbG2doDq9L5yBiIKGO2Ew=
-=GCy6
-----END PGP SIGNATURE-----
--- a/bind-9.14.7.tar.gz.asc
+++ b/bind-9.14.7.tar.gz.asc
@ -1,16 +0,0 @@
-----BEGIN PGP SIGNATURE-----
-
-iQIzBAABAgAdFiEErj+seWcR7Fn8AHqkdLtrmky7PTgFAl2WMpEACgkQdLtrmky7
-PTh/sg//QbNRAQvADQfwF1PPo+JxB+3WzQ9oJAWeHbOoiubwkUwO9xE+BEnTNd5o
-oM1lSLqFxNykOTaoeJlqPftPod1cxo7lSzkwflugGyB/59wliCpqCg053YV4x9mO
-QggvA/E50+0FI/Om/7v4GHGADu/JE83FovOueWAB0LgqfDSD6QFcNFF9sUJJ4P7r
-FcEXSWj8QbrHMWBKncZUOpD2ECotvtrYmi0DTHl1XfigESDQpWtsnTFuabCCsvkh
-ch9wQRplAes2Mf/aS5tl1y0QKKBFuEjtGiTdgrDl6o9GLnx6CueX5saZehu2EVkr
-fq2vEYUC2lRQSjuxSMMJ3L0TGUcl7+ixlAIISS2K9L5Xx7MhBXt/EH5KiKPfsEet
-3EH+DhxV5uXjDU7MgvREnxT+ssV23e0HWTz4tVVQ9LpvYmWPIgLcSOhHCc57yoQF
-c46V0f69dMWbMAlQ93EZSG274ZvpIszpK8+3hGI3/TuDFFgiQJeJJBFVtYJMle69
-3mEEclfzO7fBiXZFec6nVx2309bL64bafN7zszPKXl4XgoefOfD0v0eWqQT4fxfm
-dnGC0qMqSZs5F+d0fISV5JUUNYzt9PZjvnzqLLGOeTF6l3/n9G1mmNsXcxJ1OEIF
-6qh1oO7JTPjt0MFhKac4QjNQi/Bnp25O3I/PRyWZCbiwXkyvyQU=
-=ZT7s
-----END PGP SIGNATURE-----
--- a/bind-9.5-PIE.patch
+++ b/bind-9.5-PIE.patch
@ -1,17 +0,0 @@
-diff --git a/bin/named/Makefile.am b/bin/named/Makefile.am
-index 57a023b..085f2f7 100644
--- a/bin/named/Makefile.am
-+++ b/bin/named/Makefile.am
-@@ -32,9 +32,12 @@ AM_CPPFLAGS +=				\
- endif HAVE_LIBXML2
- 
- AM_CPPFLAGS +=						\
-+	-fpie                                           \
- 	-DNAMED_LOCALSTATEDIR=\"${localstatedir}\"	\
- 	-DNAMED_SYSCONFDIR=\"${sysconfdir}\"
- 
-+AM_LDFLAGS += -pie -Wl,-z,relro,-z,now,-z,nodlopen,-z,noexecstack
-+
- sbin_PROGRAMS = named
- 
- nodist_named_SOURCES = xsl.c
--- a/bind.tmpfiles.d
+++ b/bind.tmpfiles.d
@ -1 +0,0 @@
-d /run/named 0755 named named -
--- a/bind97-exportlib.patch
+++ b/bind97-exportlib.patch
@ -1,226 +0,0 @@
-diff -up bind-9.9.3rc2/isc-config.sh.in.exportlib bind-9.9.3rc2/isc-config.sh.in
-diff -up bind-9.9.3rc2/lib/export/dns/Makefile.in.exportlib bind-9.9.3rc2/lib/export/dns/Makefile.in
--- bind-9.9.3rc2/lib/export/dns/Makefile.in.exportlib	2013-04-30 08:38:46.000000000 +0200
-+++ bind-9.9.3rc2/lib/export/dns/Makefile.in	2013-05-13 10:45:22.574089729 +0200
-@@ -35,9 +35,9 @@ CDEFINES =	-DUSE_MD5 @USE_OPENSSL@ @USE_
- 
- CWARNINGS =
- 
-ISCLIBS =	../isc/libisc.@A@
-+ISCLIBS =	../isc/libisc-export.@A@
- 
-ISCDEPLIBS =	../isc/libisc.@A@
-+ISCDEPLIBS =	../isc/libisc-export.@A@
- 
- LIBS =		@LIBS@
- 
-@@ -116,29 +116,29 @@ version.@O@: ${srcdir}/version.c
- 		-DLIBAGE=${LIBAGE} \
- 		-c ${srcdir}/version.c
- 
-libdns.@SA@: ${OBJS}
-+libdns-export.@SA@: ${OBJS}
- 	${AR} ${ARFLAGS} $@ ${OBJS}
- 	${RANLIB} $@
- 
-libdns.la: ${OBJS}
-+libdns-export.la: ${OBJS}
- 	${LIBTOOL_MODE_LINK} \
-		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libdns.la \
-+		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libdns-export.la \
- 		-rpath ${export_libdir} \
- 		-version-info ${LIBINTERFACE}:${LIBREVISION}:${LIBAGE} \
- 		${OBJS} ${ISCLIBS} @DNS_CRYPTO_LIBS@ ${LIBS}
- 
-timestamp: libdns.@A@
-+timestamp: libdns-export.@A@
- 	touch timestamp
- 
- installdirs:
- 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${export_libdir}
- 
- install:: timestamp installdirs
-	${LIBTOOL_MODE_INSTALL} ${INSTALL_DATA} libdns.@A@ \
-+	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} libdns-export.@A@ \
- 	${DESTDIR}${export_libdir}/
- 
- clean distclean::
-	rm -f libdns.@A@ timestamp
-+	rm -f libdns-export.@A@ timestamp
- 	rm -f gen code.h include/dns/enumtype.h include/dns/enumclass.h
- 	rm -f include/dns/rdatastruct.h
- 
-diff -up bind-9.9.3rc2/lib/export/irs/Makefile.in.exportlib bind-9.9.3rc2/lib/export/irs/Makefile.in
--- bind-9.9.3rc2/lib/export/irs/Makefile.in.exportlib	2013-04-30 08:38:46.000000000 +0200
-+++ bind-9.9.3rc2/lib/export/irs/Makefile.in	2013-05-13 10:45:22.575089729 +0200
-@@ -43,9 +43,9 @@ SRCS =		context.c \
- 		gai_sterror.c getaddrinfo.c getnameinfo.c \
- 		resconf.c
- 
-ISCLIBS =	../isc/libisc.@A@
-DNSLIBS =	../dns/libdns.@A@
-ISCCFGLIBS =	../isccfg/libisccfg.@A@
-+ISCLIBS =	../isc/libisc-export.@A@
-+DNSLIBS =	../dns/libdns-export.@A@
-+ISCCFGLIBS =	../isccfg/libisccfg-export.@A@
- 
- LIBS =		@LIBS@
- 
-@@ -62,26 +62,26 @@ version.@O@: ${srcdir}/version.c
- 		-DLIBAGE=${LIBAGE} \
- 		-c ${srcdir}/version.c
- 
-libirs.@SA@: ${OBJS} version.@O@
-+libirs-export.@SA@: ${OBJS} version.@O@
- 	${AR} ${ARFLAGS} $@ ${OBJS} version.@O@
- 	${RANLIB} $@
- 
-libirs.la: ${OBJS} version.@O@
-+libirs-export.la: ${OBJS} version.@O@
- 	${LIBTOOL_MODE_LINK} \
-		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libirs.la \
-+		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libirs-export.la \
- 		-rpath ${export_libdir} \
- 		-version-info ${LIBINTERFACE}:${LIBREVISION}:${LIBAGE} \
- 		${OBJS} version.@O@ ${LIBS} ${ISCCFGLIBS} ${DNSLIBS} ${ISCLIBS}
- 
-timestamp: libirs.@A@
-+timestamp: libirs-export.@A@
- 	touch timestamp
- 
- installdirs:
- 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${export_libdir}
- 
- install:: timestamp installdirs
-	${LIBTOOL_MODE_INSTALL} ${INSTALL_DATA} libirs.@A@ \
-+	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} libirs-export.@A@ \
- 	${DESTDIR}${export_libdir}/
- 
- clean distclean::
-	rm -f libirs.@A@ libirs.la timestamp
-+	rm -f libirs-export.@A@ libirs-export.la timestamp
-diff -up bind-9.9.3rc2/lib/export/isccfg/Makefile.in.exportlib bind-9.9.3rc2/lib/export/isccfg/Makefile.in
--- bind-9.9.3rc2/lib/export/isccfg/Makefile.in.exportlib	2013-04-30 08:38:46.000000000 +0200
-+++ bind-9.9.3rc2/lib/export/isccfg/Makefile.in	2013-05-13 10:45:22.576089729 +0200
-@@ -30,11 +30,11 @@ CINCLUDES =	-I. ${DNS_INCLUDES} -I${expo
- CDEFINES =
- CWARNINGS =
- 
-ISCLIBS =	../isc/libisc.@A@
-DNSLIBS =	../dns/libdns.@A@ @DNS_CRYPTO_LIBS@
-+ISCLIBS =	../isc/libisc-export.@A@
-+DNSLIBS =	../dns/libdns-export.@A@ @DNS_CRYPTO_LIBS@
- 
- ISCDEPLIBS =	../../lib/isc/libisc.@A@
-ISCCFGDEPLIBS =	libisccfg.@A@
-+ISCCFGDEPLIBS =	libisccfg-export.@A@
- 
- LIBS =		@LIBS@
- 
-@@ -58,26 +58,26 @@ version.@O@: ${srcdir}/version.c
- 		-DLIBAGE=${LIBAGE} \
- 		-c ${srcdir}/version.c
- 
-libisccfg.@SA@: ${OBJS}
-+libisccfg-export.@SA@: ${OBJS}
- 	${AR} ${ARFLAGS} $@ ${OBJS}
- 	${RANLIB} $@
- 
-libisccfg.la: ${OBJS}
-+libisccfg-export.la: ${OBJS}
- 	 ${LIBTOOL_MODE_LINK} \
-		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libisccfg.la \
-+		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libisccfg-export.la \
- 		-rpath ${export_libdir} \
- 		-version-info ${LIBINTERFACE}:${LIBREVISION}:${LIBAGE} \
- 		${OBJS} ${LIBS} ${DNSLIBS} ${ISCLIBS}
- 
-timestamp: libisccfg.@A@
-+timestamp: libisccfg-export.@A@
- 	touch timestamp
- 
- installdirs:
- 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${export_libdir}
- 
- install:: timestamp installdirs
-	${LIBTOOL_MODE_INSTALL} ${INSTALL_DATA} libisccfg.@A@ \
-+	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} libisccfg-export.@A@ \
- 	${DESTDIR}${export_libdir}/
- 
- clean distclean::
-	rm -f libisccfg.@A@ timestamp
-+	rm -f libisccfg-export.@A@ timestamp
-diff -up bind-9.9.3rc2/lib/export/isc/Makefile.in.exportlib bind-9.9.3rc2/lib/export/isc/Makefile.in
--- bind-9.9.3rc2/lib/export/isc/Makefile.in.exportlib	2013-04-30 08:38:46.000000000 +0200
-+++ bind-9.9.3rc2/lib/export/isc/Makefile.in	2013-05-13 10:45:22.576089729 +0200
-@@ -100,6 +100,10 @@ SRCS =		@ISC_EXTRA_SRCS@ \
- 
- LIBS =		@LIBS@
- 
-+# Note: the order of SUBDIRS is important.
-+# Attempt to disable parallel processing.
-+.NOTPARALLEL:
-+.NO_PARALLEL:
- SUBDIRS =	include unix nls @ISC_THREAD_DIR@
- TARGETS =	timestamp
- 
-@@ -113,26 +117,26 @@ version.@O@: ${srcdir}/version.c
- 		-DLIBAGE=${LIBAGE} \
- 		-c ${srcdir}/version.c
- 
-libisc.@SA@: ${OBJS}
-+libisc-export.@SA@: ${OBJS}
- 	${AR} ${ARFLAGS} $@ ${OBJS}
- 	${RANLIB} $@
- 
-libisc.la: ${OBJS}
-+libisc-export.la: ${OBJS}
- 	${LIBTOOL_MODE_LINK} \
-		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libisc.la \
-+		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libisc-export.la \
- 		-rpath ${export_libdir} \
- 		-version-info ${LIBINTERFACE}:${LIBREVISION}:${LIBAGE} \
- 		${OBJS} ${LIBS}
- 
-timestamp: libisc.@A@
-+timestamp: libisc-export.@A@
- 	touch timestamp
- 
- installdirs:
- 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${export_libdir}
- 
- install:: timestamp installdirs
-	${LIBTOOL_MODE_INSTALL} ${INSTALL_DATA} libisc.@A@ \
-+	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} libisc-export.@A@ \
- 	${DESTDIR}${export_libdir}
- 
- clean distclean::
-	rm -f libisc.@A@ libisc.la timestamp
-+	rm -f libisc-export.@A@ libisc-export.la timestamp
-diff -up bind-9.9.3rc2/lib/export/samples/Makefile.in.exportlib bind-9.9.3rc2/lib/export/samples/Makefile.in
--- bind-9.9.3rc2/lib/export/samples/Makefile.in.exportlib	2013-04-30 08:38:46.000000000 +0200
-+++ bind-9.9.3rc2/lib/export/samples/Makefile.in	2013-05-13 10:45:22.577089729 +0200
-@@ -31,15 +31,15 @@ CINCLUDES =	-I${srcdir}/include -I../dns
- CDEFINES =
- CWARNINGS =
- 
-DNSLIBS =	../dns/libdns.@A@ @DNS_CRYPTO_LIBS@
-ISCLIBS =	../isc/libisc.@A@
-ISCCFGLIBS =	../isccfg/libisccfg.@A@
-IRSLIBS =	../irs/libirs.@A@
-+DNSLIBS =	../dns/libdns-export.@A@ @DNS_CRYPTO_LIBS@
-+ISCLIBS =	../isc/libisc-export.@A@
-+ISCCFGLIBS =	../isccfg/libisccfg-export.@A@
-+IRSLIBS =	../irs/libirs-export.@A@
- 
-DNSDEPLIBS =	../dns/libdns.@A@
-ISCDEPLIBS =	../isc/libisc.@A@
-ISCCFGDEPLIBS =	../isccfg/libisccfg.@A@
-IRSDEPLIBS =	../irs/libirs.@A@
-+DNSDEPLIBS =	../dns/libdns-export.@A@
-+ISCDEPLIBS =	../isc/libisc-export.@A@
-+ISCCFGDEPLIBS =	../isccfg/libisccfg-export.@A@
-+IRSDEPLIBS =	../irs/libirs-export.@A@
- 
- DEPLIBS =	${DNSDEPLIBS} ${ISCCFGDEPLIBS} ${ISCDEPLIBS}
- 
--- a/ci.fmf
+++ b/ci.fmf
@ -1 +0,0 @@
-resultsdb-testcase: separate
--- a/codesign2019.txt
+++ b/codesign2019.txt
@ -1,252 +0,0 @@
-----BEGIN PGP PUBLIC KEY BLOCK-----
-Comment: GPGTools - http://gpgtools.org
-
-mQINBFwq9BQBEADHjPDCwsHVtxnMNilgu187W8a9rYTMLgLfQwioSbjsF7dUJu8m
-r1w2stcsatRs7HBk/j26RNJagY2Jt0QufOQLlTePpTl6UPU8EeiJ8c15DNf45TMk
-pa/3MdIVpDnBioyD1JNqsI4z+yCYZ7p/TRVCyh5vCcwmt5pdKjKMTcu7aD2PtTtI
-yhTIetJavy1HQmgOl4/t/nKL7Lll2xtZ56JFUt7epo0h69fiUvPewkhykzoEf4UG
-ZFHSLZKqdMNPs/Jr9n7zS+iOgEXJnKDkp8SoXpAcgJ5fncROMXpxgY2U+G5rB9n0
-/hvV1zG+EP6OLIGqekiDUga84LdmR/8Cyc7DimUmaoIZXrAo0Alpt0aZ8GimdKmh
-qirIguJOSrrsZTeZLilCWu37fRIjCQ3dSMNyhHJaOhRJQpQOEDG7jHxFak7627aF
-UnVwBAOK3NlFfbomapXQm64lYNoONGrpV0ctueD3VoPipxIyzNHHgcsXDZ6C00sv
-SbuuS9jlFEDonA6S8tApKgkEJuToBuopM4xqqwHNJ4e6QoXYjERIgIBTco3r/76D
-o22ZxSK1m2m2i+p0gnWTlFn6RH+r6gfLwZRj8iR4fa0yMn3DztyTO6H8AiaslONt
-LV2kvkhBar1/6dzlBvMdiRBejrVnw+Jg2bOmYTncFN00szPOXbEalps8wwARAQAB
-tE1JbnRlcm5ldCBTeXN0ZW1zIENvbnNvcnRpdW0sIEluYy4gKFNpZ25pbmcga2V5
-LCAyMDE5LTIwMjApIDxjb2Rlc2lnbkBpc2Mub3JnPokCVAQTAQgAPhYhBK4/rHln
-EexZ/AB6pHS7a5pMuz04BQJcKvQUAhsDBQkD7JcABQsJCAcCBhUKCQgLAgQWAgMB
-Ah4BAheAAAoJEHS7a5pMuz0476oP/1+UaSHfe4WVHV43QaQ/z1rw7vg2aHEwyWJA
-1D1tBr9+LvfohswwWBLIjcKRaoXZ4pLBFjuiYHBTsdaAQFeQQvQTXMmBx21ZyUZj
-tjim8f9T1JhmIrMx6tF14NbqFpjw82Mv0rc8y74pdRvkdnFigqLKUoN2tFQlKeG+
-5T24zNwrGrlR3S7gnM47nD1JqKwt4GnczLnMBW/0gbLscMUpAeNo/gY4g0GV/zkn
-Rt91bLpcEyDAv+ZhQZbkJ49dnNzl5cTK5+uQWnlAZAdPecdLkvBNRNgj/FKL41RF
-JGN6eqq3+jlPbyj9okeJoGQ64Ibv1ZHVTQIx5vT1+PuVX/Nm0GqSUZdLqR33daKI
-hjpgUdUK/D0AnN5ulVuE1NnZWjVDTXVEeU8DFvi4lxZVHnZixejxFIZ7vRMvyaHa
-xLwbevwEUuPLzWn3XhC5yQeqCe6zmzzaPhPlg6NTnM5wgzcKORqCXgxzmtnX+Pbd
-gXTwNKAJId/141vj1OtZQKJexG9QLufMjBg5rg/qdKooozremeM+FovIocbdFnmX
-pzP8it8r8FKi7FpXRE3fwxwba4Y9AS2/owtuixlJ2+7M2OXwZEtxyXTXw2v5GFOP
-vN64G/b71l9c3yKVlQ3BXD0jErv9XcieeFDR9PK0XGlsxykPcIXZYVy2KSWptkSf
-6f2op3tMiQEzBBABCAAdFiEEFcm6uMUTPAcGawLtlumWUDlMmawFAlwuSqAACgkQ
-lumWUDlMmaz+igf/ZW8OY5aWjRk7QiXp93jkWRIbMi8kB9jW5u6tfYXFjMADpqiQ
-yYdzEHFayRF92PQwj81UzIWzOWjErFWLDE2xol9sP5LdzeqoyED+XTqKggpVsIs+
-Lq672qnumQoZKp1YGb8MDocU2DNg/VsMdi7kCnEnPbcSuBxksmxGYomusXNrAF94
-1OJ2sqd9BuFamLIyn8XUCGGYlsvMoe4kTCg6Cc1sQvx0lDG8urKN57jBKWbP4alV
-+JBV5KQcf74gzPmE3ypgY1tMEwxyH/WyS9ekDbai0qauX6eUAsM1bduH8fIcknLS
-Zl5hrJTrzWFF9/DKOth8QOwhJ9zoIF1fcAsx9okBMwQQAQgAHRYhBHpqR7X54SM6
-0lUrXL2X3GOe6MR7BQJcLktcAAoJEL2X3GOe6MR7jwEH/iaolMeno1oeWAgzN6Mg
-bx3maweh/9Vqty1fwk7Crq1G78X5i1OCkknEL2p0Bfle4ApwcC4HZVcqCgoYpRV3
-/EEXtwkMNy3plWdBbLCQSev/E1D39GzgAHiMnv7NUJnkoJbvMrvrAiUTXPTtARMM
-gjEpvgEs60wuJxS8ESomRhe/KW4myxDoBxF+K+e5bOkOvvWVcAYJHWZ1BIZs4n6b
-+C2vO8q5aKTkQ/XvNT7utbTOqj1SGhItRaAQKXHBdzkQ1Et3wTA4+uRg4gK12624
-9LperYs26w9X9UzApl+qVxQhtWUw3tnUXMastDfQrRcvJgq1xpv++OqX5Uc93RTf
-SNWJAjMEEAEIAB0WIQS+DpdItxglOii7if/xsRvwXPAuVwUCXC5LlQAKCRDxsRvw
-XPAuV29KEACEwlTVVKe4gnBYHnlAD7csoQ0+gJ6C+Ofzlw+UItRIcFeVCAknSGBs
-NPxr9JStIvKpmsbSKpCNUEAYnRP2immh94y/C6BuTe1uUUmqBGr1f4OAUwZpmI29
-ixYeY/uUs9FZO3bS0/WtG46tdcJK41qtM0DYAGT3oeZhJMTW15dfvMGlFukauSOU
-+BbR+6sZhqdbWl/AOTE/6x5otnAaW0GObY/BW240Xq/KTgBrzVdK5qNoYsMVsiTd
-0im0JKvFG08ED+ZfcILhlO6G9jRhoTkhtYuf8CKN1dPf2IoB5FrRFf0xqRr9hNlk
-X7ViNMP9OPb8i3BubWvRi5rNSquCwrFATSiAgaA9Yi1BNzQsmQxOql9lsh7eCH7m
-+8zzUg9umWI6PkSv8vHBo2kPX73wmtEsF6vxJlk0yDBuQw7y0uuKh406tEEk4cP2
-8U4baq+ihpioupDhNuEII1h1Eh/RBE408RAOpcr+2F0m/fKOoJyz7u+AxyV81Ia6
-fyBnUfZnlfKo16w87c1HJRs9dKkRa5yGziBf9TcED3sru58Pftes2Nr80/iOh26i
-P2pRihcIyrmeAqDWnneErVCmPMDTe6zkMrm/0iZ25/Jfq+M8IHEzFEw3Y1FBOeFg
-9TyMDwYG2biJPTNTDO0BQ+Rrvs4SjFWEYSxgJSvG1jMfSPt5AR6MJrkCDQRcKvQU
-ARAAufZX5WzJr0lZAhxaGpHY6JMBr4jVOCP4TrDZhwC2K4CXNM/PLLNisWzquiWa
-FvUDhB89kCxrEhipwVFYhBr16CDQxrr8yhah3RIxrBMYhRTxgIAkANgkhGWfDJSE
-zXauA7krYtS3rYwhfXe4cNsTkLPbnMUlyLJcqj2wnZcZIt97aL+NFRPyfIw1KfUb
-9u3tB9seDYbvTEULeL07aTnHpWM5f3bTwJrJ2OFPzXseCCzPiVNh3Bv+YtJ1pMTr
-c/UHO5DoJuHLsF0wicPSrpD0twspFdR/0rT6eNycsaCtV4GQzBcMPvY7qai5XrZm
-Cqgluo1W6l6+F5YrKvRMtyyFkUNGcPywdjSlP44JyRrS2uzvFUViSsJArcmFG2TJ
-LCohnse8wqjw0dIUVbmDbE4zjaG56zkvu0k+04Wwp3XPgOZrbl6cbhX3yLhu/Gt0
-dzd9EReoNfKXk32hBzKas/vdeB5DZejbOOOWYftqyZC1LvDvvrYFhFK6VGozfZ6L
-Fml1hzn+xPahp5tRv93/T9zXeVPm9zilGMqm/gjRgh8ojWxNQoNzJyqTPWIvWmbu
-EIP3T3cTFq6lJpJsg3+sfzofGWZCGnBZQGqm8rEOoUWiaKe1BvQCX1x8p4/x8/tX
-TaVDpQCGoqxXt09plkDuGMuiDICxBlaHWUR2jLoHc2cLrB8AEQEAAYkCPAQYAQgA
-JhYhBK4/rHlnEexZ/AB6pHS7a5pMuz04BQJcKvQUAhsMBQkD7JcAAAoJEHS7a5pM
-uz04pB8P/Amfg54IFeALiPOrKbjC3bVAQzrsf09IL8sUln/LCZIx9HgGAJj/f35S
-Q35sK2ucjWiDX6qCxVrWmC6caQXFgXOFSKIlqladmmgj4sIdLM5wj4nbomHChpB5
-rqV/GgkFwWBQ3kPCatXvc8Bg+zKJ+wXgTuPFXefyE9R+SLuas2grQ9hAjvTGHYbq
-iYxSlNDFc1aHLAQ3bS76351MHuMHOpLzoB0OkZDCVNW4GNEqrLbINdr50RAK+Loo
-Z2UBIobEZjXYor9A2FWkSvdjyz6X1QKMdQMath6R91k/O0abBa7ly4/805eAGXM3
-w1Xf2eMlpiUs69BeYoJBklK8aNMntpDREunJjhiPU4JoDzSxl5Qv7LuXylyo0YJA
-9YmydKhTTcRdwsKc//nGr/ckg4BRl+VbtJBYvd3xGB7IQ+pT/TOakv9qCospAhr3
-EQjVP/XpnWJRd+x+dq8UXqwWmTenWDE42cNr7BDFJdOqS5ZWy4sIz4sdjpSxXMB9
-8iiRtKSpKRCJgXScB7SYebh835EgG2YyQGdhJMO7C6ok9POYQBqL8sBqRzImJKoT
-VDvOH42WArKwJWTHa4mPdiDHEIZlkONerec3JXtl4Mfv8cwZ5Lb8fSiB/x8AWvqs
-puc/7hQtkus4TcgutS1fwhAwpnFItpVF6+73CMQrJsblBdTjW0T+uQINBFxbVHwB
-EADebZOJbhPdhHeBPdlZYE3rRjB8scDpWdjrCupfmeTC9MM6JgCE4DEMBtBXk+h1
-+7wfpblYYNFwGVFvytG5nvGRDtHWxwd1Z9O8Fx4Zqu0Fx/wAn7ZL3ryE+tdHR7JK
-7SLxOa2X49T/8LY0U8Q65I4ZRo/b4VMcXApCmncw3QSRqHT/mYdNnf+HHPvi3jza
-md3iVptCS4Iaisc079DFda+htWXspBc13lmPi2vGQkWjjS3B4yO8JackyQPVhpsg
-KYbRBzOH0Kii8bXmyA6O5uIJYEddp5Veged4FE/ej3CrgGP1D0Yk1epx8lLbi9RB
-kwFS7DA5rQ23UnbSy1WyV1ZgPrWqQAWuGpjMTVTWN0ElI3AGxAnE8lZlSXyE+XyV
-uHjjIVrayBjLKVqDuSLdKZeCvI4QsyHH6F0NKJQkngvXxLZYxO6s0c2EFFLzdVWT
-1V9GMP8UsDrrb+JsZjUVmPR1tTP4xqEQG6KjfFoQm5XWpGtFwh91OK1lwf/Bx2/C
-j+PquLLFcj7hEP79VDTUZPQAduTTxIeTzHXH+x1PCHFB10xxH3e82VSdJeBUrJxn
-riXzK50SKTTmF+uYpHqE8Jg1N2Y1n5ksuxeYUy8PFjhAeBCqZ6ZcldUDf4999e/z
-PT8bwfCDr8jRdqJHrq7RxTJiP5RsMudWpKeohzJGwQ5uZwARAQABiQRyBBgBCAAm
-FiEErj+seWcR7Fn8AHqkdLtrmky7PTgFAlxbVHwCGwIFCQO9IQACQAkQdLtrmky7
-PTjBdCAEGQEIAB0WIQSVztolaxygoV8wL7WVIaftXazpGAUCXFtUfAAKCRCVIaft
-XazpGPeMEACm9nxA/VKf8RxDo2ZuTgyuSwlR8tCjAE4k3+UoiYUbamkW4pjx9Vgd
-1zC5bNxSWZ5vlJ4CH8ArKFqNK5LBVDZqhYureAo/1Af2b9vRJw0/QQHhuXz/jqeT
-wwrLuKpy796Gpt+aFfcmS0ZC4QXfxJERhAP6tu1p6YmAsSb+bjziQVkKrt9mhOrL
-dtz6WP0Fg1joRj33FgnnLtayHvtgQrNFI3ztCjk/B2FjYZxqbBGfk5gyo0cTE2Fi
-oLhG/XrxIoZepFMJkGYETnYQXrOt2KuJLvawV70YQmG8EqHYY8drKA0XDZs8TVdT
-5cvGvtm8ERz5znsssRBxQMI5Ml6O2ahrXp8Eq4htCzlvO8t2MOtzvqAJRiyAd6bA
-Uo+MGVRpnvePOR1SAgBXCd416rF0iCXc1utZxnqwdq9kJAZ+8mCLx4N4jk6AdGpX
-zcNkLg7QmUzXn75RxZ6GrIUYZJNMlswXq5XhSW4o8ePlaxWjh9+QTtU964AZhpA1
-uoHsKGTBxHJs0w6McZm14kb2PuaO2/rpf8s8IZyc93+Y5O/gHZ6/agBjA9qN6wkQ
-R1d5UhJC4QS/m35rBGBKK9X3fqQxaBCio6Qz+m4A3GchrztJpq+2P+ma5ylsTq5j
-V4njky26WNtrV7+N0C4Moj3I4Qn6YU/eSManTXzHzoiPZCEH/IOxgXIiD/9Zm3Zz
-I+h4NCfSGyP11/w1gEzlTHQ4at/FXIIDh0Y2ZNpWPffuFQLtcER2vyKPwhDYpGMy
-NNHXks4azfrXVCv0wmSNBbeS8pJrYtopZpCEBrAbg/YLv9m5lpDSRHaR3gv/qMZ7
-QxY+NwqciqTwGq68PuF4mDSvtfuFmbEES9Iybiie+eL/6DU2knfBjgshUe6vElR+
-LYoPQ45GY2IxRTJ1pMXaZw1+evwH3UvseRGkRygiaBgoU/qR4prynvjMQcacCa+C
-aRnXZJYp/usVBeY0xut9toc9/OcLGoBr5h9l5YjruO2vu8VHou8N0tarVQn3YbQR
-Fi+YtNtclWJa8Pq1AsKRTCFwDwP6eODv6mNOrEFydNRcpiQmzp47VWF/YHRfHzCq
-A1wHLxLUrpQTaVw6J4FqedAQ31aAO4faA7MS+ZMNBqZCZ7lTGC6TvojqqBAN2yX7
-AnnYpZHM+lGpi2/ukVzLqSkGmdNOgbu+UZvoej3YnHYig4yWP+z2xrlJl8bkhU/d
-r9IQE5aRCEPB/JWhHJ2/GqYl9qjshlB52+6X2KDarwptOtzT9ooArYhpMwKIYh34
-c7X8tlAKYk7V5j7txIRFDKKAftC7dM82PntXJxSkWyR70GYnYjiXyrqqerqT7xIC
-mDEQgFOPpy09zFW62paO9uiZw6qwybwqgGpoX7kCDQRcW1TbARAA3ERo2mPv2VVg
-ZUFr4MtPDm4UG00YJW/LYa3D3k0e9tdSScACXprk1sAoxUlQx/CSdErPKwXG4rax
-iN4t5nICUUNYSC0dh09G25jC7nwsWc0AYyZu+h/FzfvpOm3fBwmBlzILlGh0URwH
-Ffj9fHt6hos4C+3PFZZ/X24aMJF/cov1oYi9rqFwt/l0mgtPE88Iyj2/Vp3Lergg
-QMzKfEuyluj9fL2cgU0Qa7oAPXmaxhHtua4cvbM5SXGo3FXjIgzH9OfM+2orebeN
-wH1M3ec6w+nPmRmCJLvPKGOeS7GVXL5/aOyPlDWzSXYnpCKS2ntw4K4nt0IA8n8z
-1db109l/C2noDrDSJEqOo843ShNGTYOMVUrj3a+Y7o2ATc9pNZalf0PwnKas7NDb
-IJ152PEQw665iYXcv2awjLF6W0yuSq8kfiaAxIrsie2Dto0zgqOs0Ot9Y74u11Hh
-wBSHUO3mEZJScAAcI/yDF2PvjvCQSzu4mdXb77t6X2O6YHULz4A7bVQCMazcTDI9
-/S0W2+ixPnnJVnE3xgjK9zuizji8JDJw1hJCQM+yTLVqq9pfvcRfQ6uwpMRzz/O3
-S0zDRiA69/GyfNwkpgz5QaGpY02IK5WrQU1doRjIz4BHAYzoIOkMkRqTtjdElQZw
-/D3wSO2uwsEMNwRzibR/Lz1JF2aGn6EAEQEAAYkEcgQYAQgAJhYhBK4/rHlnEexZ
-/AB6pHS7a5pMuz04BQJcW1TbAhsCBQkDvSEAAkAJEHS7a5pMuz04wXQgBBkBCAAd
-FiEE1wyE5ktVjlvM7AchMuIXXx11eioFAlxbVNsACgkQMuIXXx11eiqCfQ//SFDf
-rOIEoslp6n6vlCuavOg02wvjskKQGP1P1Q4v40Fw1Gl87n9uXAoMpeF4H+pzUxOi
-BHYCQi+EemwocSThzaWfPzd3JG/0OcRymf+ZOcBb+58VJL7p88QdMFIAi5J+KMuA
-fEG0zLkc9anEnXoVMmQJX5K+6PyeVDvBbYGjLjQAsWTZTiVuQI0w3WxFtDGWqQII
-8e/qE0DA7c/auGn7j2hid308+FcdfpmLefW9YesWjE1yYvHoCRdFOJ/7Sft4MQCI
-Re7UET3TRMBvtisP2DcqyzGPp22s4ZYFCCJJNiB92bXdEl5zXe4Ff7JTfNE/QrR7
-Wg5R9hZHgHdbp8p8bA3f0y29YCx3puYg7BbmQWiMh3rXWE5b090pSpw0K9BQU3vO
-irr+5/2TaFOJXHl4VF03GrWsSncShCbdsdRIv4TB0lY2mN4q+e7bjlAzJJeoaS97
-GIqu3DBlAJyx/ZwWW23DXXwoQ4jNuJhpl2jaCE7rVQB0uLjbp0i9Zdd4SdYZxmO/
-Y+JfgoJz8eyx8wZi4eDz1ijN0WKsIGjxJH5VUK9STjijDMeG6ZZRLc6b1QCGhe97
-ZbDkEUTdQGoeu4L5Fiqoma13NEsf8ofBDv+myJm/O67Va9JI3gxhIrhmF7LMzQQp
-lYx2peZC1CmhEnn83dtt83mhXvX6Dth657BW/Qd+GQ//SVuTPuNkBXfrTi4dbnv+
-cU6IsoIBodTF/WsQ6h4kbtsPhO5DbrsLNuNumrqVEN8jw+HUsEeNvFNeMrTPdG2V
-87ShQ4BQGkCf+GFRBj0myxxXOFZYQx6RpY5fCe7yOcTzpkbnPWmm7V8HdOuZ0NnL
-JNQ5YogOI6UvXVKv35R9qBo+G9jkhhb0eaAu6BERzKVANKfsGN7545ElZ1qlffMh
-AQhXGb6TsvCeSg2cWGb2cnVL2d58uVukD4PDiq4qqwgClkF3bOO70SIgGrCteHbi
-4Hseopex5m6GqqjoUYXr7QQBwSaQdc+gKtEjMHCsHbUyHRk0qEHdEe+2RmL0d0ra
-QMJfKyYQjcCR7tnrgN4WD1h4NKRdC/KRW31MDmH9XVPrkOMQCUCnArXkOwdKWsKf
-h8af9HqweXOT1FHJN/M3tWaBpv6KoduF2f2pj1VhPZ2EqFUycJ26lrHyOpsynQR6
-+TD+c1uXotDwKN5RW+YL1cydk6mhib64fdOyPUeTcHehjMAFgM2f5wi35Ujcj8id
-37cWOqRsggSbMnGO4AUA/YtcVNG8TjZbakson8ENK7e8q4sEiNFUZ7/CtzNokwHQ
-5uOG1+qB85Y4ImGnIZVeiBpjt73VVawg4Zvm/omtW50P9R+4rVhMJZZFAgrWg8BH
-H/KNznW0vUuShG8B+2FA/eu5Ag0EXFtVDAEQAL5ftI1GgVJEFgX5VsuFnfBnH95c
-zqmwEXaTP4s7Xm3O0Wy579EzRUD1eEw/UaD/q2OHScwvMP65cZYQ9w4hnCN6H96P
-96Teo7LOMCssvSXIO7gqP33LKTqDzsIoAFHwWE3dq1jbyP6T1Je85mr0Edvk8kOC
-B1hudswAARno/7X9zGulhhwuEHk5Iey7R59yRUQqBctdNcetGyaiFjjX0evuVADi
-/z/s07XhDLDt7+3Vglh1/7XGC64QhB9QjZ8j0u7+0xfmLLjhi+7EpkDlAHIJXX1H
-0wAsPOGKlYruQUmIsMNfBINZeulHEBZ4cAd30xsM296DzJ6QL9sAGfYMhRs0YHB/
-EJ10Zv0iw1pU2jCCUv/9Kf4F4nwgHQWQP7JAbfhOIUOUq/YlxjTLnkd25+7vD3KH
-NQ6UiRDROR9Jwetpd/zokpf5O5iTBpVL+sCq+NsTZyDOjITve2sY0V8v10M+Z+pL
-cp/cUZ4JEDS/WJ4/ovBNJP8b+YwN/RBgCjl8UBX/N+e7AA52eYP2H9GK9XPkzSCE
-VxEf5PyjGrwedpoLkzagrHsDuWo3uBquLyneT/ozihqKQAuInUy5B7rWU4mpKHe5
-Vto5o6Zuj+6MgHgIQzRK6Da2ziMNEmroxwZibcYCtUPdvcvxGh+byclnzBclKjOw
-kAalFPx0SxEbHmzPABEBAAGJBHIEGAEIACYWIQSuP6x5ZxHsWfwAeqR0u2uaTLs9
-OAUCXFtVDAIbAgUJA70hAAJACRB0u2uaTLs9OMF0IAQZAQgAHRYhBK7WIv4CB360
-tcFGwUKiedJIzcMQBQJcW1UMAAoJEEKiedJIzcMQH+cQAIQYXDnqi4Hl21LtAgky
-pZxug+x/LECVlwkrIfaQF337+fG+H9J7SdU87Sn1Xe/YUgQnF0XP/fjIVFM0e/Tb
-xVlmTFqiejLnIwJJDgUaHO3POT2sGEyO3tc0mqSzyRBxtMQ8yvApccBhL5QODv3h
-hlRWgk5MXU0IPeXw134IWm+o/PRiPBoXPawvVfEVIBlUFaiSZASf4BAiSad4aJQe
-P8PyP7FPvQB1xiib0iSetn6ZmNeN2OSUJPiPA8aE9JCKuFtomVQEDM0BqQDl5A7h
-5O2uyf0Li+/ArqBvfBjrH03e5zbID02dO3D2BjsV3jUeVPQ5WDgVg8LH+nfg/rRy
-wfCsx9zFp1mt3K4xN2v7IKwxGndApgCcx17gsjzMvLz0J7sSGov4MNjzqvGEDKCl
-uUvNKXqy7je9xcQLpoyvWtoWFXWTbQAcK5Vv+hC67r9bHpjI1KuqA8hYqNKxsv7s
-wiLZdd4SK9SIuwf0j8/XTZwmoFfGolJil0ZNxyqBF39+CMVpaHdLM1qKZz99TVzS
-h4obOOjkUjK458xSo0XCbJ4qXYp7PgxyWK6GIbTozbbG/1ldw+LUnqxt8Shf797L
-J9lbI3ICuR2P5PYlKJf3b6D9GyfqyrP387fKAKhHsYkZ1XD54/8wIgTrdfeNPtL0
-1mjWDjw5KvO9kuPBjcmzgt+NrtsQAJwKeZsiqLLcY8kJ9xP+/xtTlh2iVuZMfxwq
-hwlo4MMCzpobLDZ/JKU398m77eboTKJSBfeUYxQd4ATn1L8NLKjLxKAaBkjEk0nN
-8w9OUQbFlhQ/asLzzF7Z9IGGh9/SEgBZ8V67a0O3Qw9Xdi3ARK3bbZ8RIVJ0+P9G
-CGrfq9j4ZmGA2L4irLjsvDAv7CSMb4WBKW8j0Jz5LFMwOMJgG1TT5c6lNqFj6y09
-rZcVLnt8+lUv2Bw3LC0oI1TjFkrrCzIdfg++mPi3K/ZFc50bvnWF4eCOjgZ5U9Vb
-sxFZq3+vTRcIfI9z2lZ9CNDRA1O5jGvuVtEGLiSLF2aJ6kiNriLuuGTlXfg/Fpgh
-GTvyppOTzF7PtHzHBQ/ZjnhWojnc/jyJRwLK8cCl6+EOc887v8BDmqgFWtmycsE2
-5fDJ7UFGP13g/eDL3ZUgMDty5dQaUOTX145t2KT+lMqpY6ZK2EC+eoqrnIGJ+tYy
-0l4RRxi10mbNhuPIIDdph7X+mUHgCeA9gyF0Y+LqiB6CX+zFg7ovLvnCbMPxdGXq
-z7AjfwqZBKI+BVuBeDtyW4onmElCu5cXNKsg3W0IlQlZf9PMDU6Ht0XLUs7EPfbQ
-sH1Vqi1XE1W/tGnkmjcpG/qlt9Gx1uwFGLP6iomqUBc2c0GZ6R1xplXvd3w3yC8d
-8lAgPGImuQINBFxbVToBEADkuxhQx9gxlzzCc0nUu2v82XsD+GzONp9irt14gslx
-te96eKaTXTi0t5eya0X5TIY3wbREwjlfAeM9AfcAmWcsM4izrfPtANM6WOxB2Tbz
-EY2cqv7NBQii7Z5aqPyjcIiT0b0Gs2evlDkn3xEBBqTSrNcnGSA29bZPIkaUb7Qo
-p/Ani0S3/tgcR21gXsJwkgpfNKwvPT03Lz3/o5rXAyag0M/25adgk9SVKNcXc8h2
-HSGv5ENjwUKNNnowVbNLw4287mFUM2Vd6unGJ2MBj7aUwTrfBl7gNV96mMdDJWcB
-hGKYkxUvibuHCa2KH7gTrnV6X7sdrgD5CbJMPq6OZNSP6n6bUVg22eHxoETplFwT
-4NvV3clRMWIAG1XgXR1l99LAh7PPnPMM1pHQGPwYHQskoBFS4g5knzHpB9h9TfZ3
-MM4cDZR5NgWmE0fYVnWe5ax+wW0/IOklUoHv3qoL4yiN9wFJq2oLzUNQd9+tsqiy
-vxSTh8iYmHegyn5KuBPsrMPgvqiKOdalTZKkak9DOx4cGQL2qHspKxiBOb6uox2v
-fjMQ5bDeUn+4DYMdnZNHeywCUegJmDakUtlfvN+136IDHGwfdGcitqzswzd3+PI2
-qlwPE19gkrp9NUaD3Qj2ZtDP7sU2cThc6Gra5KRFW8f98bI77j1Wu6pCnYFLqPz4
-QQARAQABiQRyBBgBCAAmFiEErj+seWcR7Fn8AHqkdLtrmky7PTgFAlxbVToCGwIF
-CQO9IQACQAkQdLtrmky7PTjBdCAEGQEIAB0WIQR5HX64jryNAThDSqwz3zWa56YK
-eQUCXFtVOgAKCRAz3zWa56YKeSWOEADK8u03LESGSQlZQqnnCAI8iYs1s+XRMEnG
-2tAQ1OK7/4eNgr1yZckmaW4FBMgeEgYIBJ7v3SlW7Hf7dE10TYPNGbP6UxVW8HIP
-rA4CINcGZXWWwpS374JNMS6A5eb6viuEgEMEi00jx0MmLvCMZKypmwXQUl5YJ5nB
-ytpQ1681mCQxGBMhT1eKQt3B4nAsoEnP+HnqVM/nKxBemSBNXX+C0b/YeQoLC3sD
-L+Z0NRI8U6PZl9Rokod3uynH0vfBYCEJd6MvsjtnJlVVaseYIA3ESNrFG12tw95I
-wKNrVCANZ1DBSyK4ovmmWsDrH+uFTHSLNjlxIuVxUfmXcLfgcepVCmd/7Z7UrWYr
-SXSvP0VG4ZmEPE7tNb8bfyADftO1cVsmcHBQeSrgvpSrTv9L8MocojpR5vJc1f+a
-sBT7rAeGzZP9riz1GmryXawaZgdLfaaJfzRQkc1uTChb7kMN+UMhVUdCAXmho0XO
-SfcsW84u/LpjdYh2Ww41xQO6EWvbZDNgD/Fdmp8Uh1MqJ1Dejri6kjNn6wPImXJd
-Eu6nHqWDRdYsfT4XUB18tB+4aIpFzCyIgpf7p1uaVU7Oqip5sZkc/WXKr77lV23m
-PQvpGRNCzgU2TJY7ktR3LOvUVN6wNfLMHzeQk18NdmcEGUrJ0YYtl9vE5/Eg9L6x
-LBH9PKt17IQ8D/9DLwQX8pl3fuTM8ZbzIPLxiXhbgzBBTXKRE2u1888+RIq9xE7c
-aVFjwq4qpgqZ5SFonTcG4Pi5ck3mFAzyA5zLRF+ckpmBpwSPMpLwCpv10369D1jh
-AF3JsUwt6DIb2BISMhh2ThSUMSKO75q8GSotsKjJyjD6vl1x4L7WXubTWxEiNuwD
-3kAjFWS1Z1VWtA9SURWAbsDaCV4VmwCCpSIwRr9OTbyu9XuMdMxGNpl8SwW7MVQb
-x4aYNvR7Hl/wIR71AHAXoSfrKp3p12anXjYYASHmbm16ugP4H7HLMBfznKet2f76
-gIxJr1CsAMTSqypcC1UoVb6Gz8djeIR+GU+6efHI4TIUMy5uMIUx8tYbwSEeo/y6
-NnjpJFYYjJa671iSABInNxs4+X+1zrFa+wl45EnaFxziEet2Qzv/VsusoLvLwnYi
-BZckclAS5xoVGFW0WJ01OfLUDHxGMt9GSheL8c+GLMaMtaCWunpmmt9zZ9WdpBOu
-AGluMG1Cee50TrhXaGE8CdNr8nOdSeLNAveBAPmuVa0JDSe20/D/RuYJLKeG9Vsq
-BZvjuGlOUsfl6UjtiGRbgS9OWpxeez5ugc9yyV+rBGIpmnIb+9quz2HmGxE65eA2
-cRNsZRIjFLzeAx/0RMaT1nlLFTBbUuZ+tJ+fgFtRGMhifZn1pb2dMQo0N7kCDQRc
-W1VuARAAv4LYaNq2Zev/v7M5DnxLpgHRcMkG7TOQpycrlK5653llpZzTy3mh5peW
-vcq3IDmdeUIJxQ+WDh2f0vS+NIKDC/HAddfHrZPbhO7zLxLcMW5KmV05ancaRSP0
-s0+IyQmvVxUNrgPinZiphlvRGoLXS6pdgfc4jIR9B2umPecfvfu/6EWFPnXZgG8K
-yY3Z+mwrmEO0FaXHBQuu6nactiPe79N4bLe8hk9RW6yIxLBeJzIoOlIcJmuRHapt
-nS2lV3mfhZdFnkAp1o6a2TL5BwgMY0wZUKZr78HEMKh6LbPN9rPepf0neUeq/k1l
-NJU7V6XMS+rezF31vgSJ5KoNGYhxtWZ54uksH2rcw7+ltpSVtqY91G/vibpRCJG3
-LdX/kxHni1NEWyZlpS/6ntuH6HSoNYsR9IMsbESs3QVCH74ApK88CxYCRB0SEo0M
-yAElbQ3bfEKCKl/FwC4IzAYAJ2arWKwBHRSJlsrNCtczrjG7j3EyJrn8+Tm5yjO6
-0THQjvc/nBxrNE09r1Lzz7jrDWC9Rl+BH6wqdniymoYyUAQsX2rZ+Jhah1Zkf+Gu
-76qtY+EH494dPM+0FazcBlgBd6/J5mh3Wk9JuecXLTEUGtzd1GmI9CENPAklCauX
-tNOWeTop27djuKWsZxuP1GyV6UYixFVOSWteyAbA32cncVv/2ZUAEQEAAYkEcgQY
-AQgAJhYhBK4/rHlnEexZ/AB6pHS7a5pMuz04BQJcW1VuAhsCBQkDvSEAAkAJEHS7
-a5pMuz04wXQgBBkBCAAdFiEEFWiQaF6g32oTce8gF8xdsfAIhAcFAlxbVW4ACgkQ
-F8xdsfAIhAd4jxAAiO9+VRQQ3eBOsJRgANdgL/l51kq7qE3u8xnSqNkrmdYDdT2H
-TYH5W4n2AmGo50BDafdjd6tut0qtzA3/hGWCooydxKFOsnIYziUeoHvlICj3RkHO
-y7utcFhAgRWi+kzFwnnXGf13dMU9iG7yvKrCrCEw44gzoQ1KnY1Xsj18n5JkqxeT
-94bzcSbz20OpOSIMfSQPrpy18WrZYwHodcIZ3IUUACCpMZdfTa9c/qHRQ/rcwl+B
-0JlHx0V4AYiSAsiMVgflO1Eqi7apPuwxPPd5nnHkrdDM9CYC3LdBORBXwncG3oZ5
-eTSXmsvFxHXH41JHsm/1QFcVmFAYhu9qJFCGiD+8UeTFtT+nnHU69BszgtUskqX8
-k9PqLdK7Vxkp16wc6WOp1NeIQ6Fd4PxTGrPqs9bJk7TlYtTFWpA0X+EMj/San+Ku
-PxqLEa4Ab12R4vs1pCrn/g1z3C/6ujH4B70HOrRTIeTjULJ6xdwXGtwUA09hio0r
-pHhtyZhAh5irUJNto4ZOk/Qyd+dfMsNvRJfbVIK2mmeRaBnp902AsQNgYVdi2Aki
-0h4kz3bVLGw7iD/xV2hV69+JwLSijkkmOpz/EjMwj0hDDYrHH3Y3o0dV3dNdk/5i
-6lQgcxSVsl9kWlHcoEllKbf0Hb1muKVwoGGYxFYna2jsLFVjG29M7iPSgrHjmg/+
-I3fmsLZ0VI9kmxniUlZ6gz5NB5PJ3RXmwKO9LkBgE5C1wpuZbNEQ1NsR2bprlJPm
-++GNSo8HaheuTRJn42kkOgfIJwjuvXih3FE/NtRA/W8H2uF6YLDjBKGZJbxQcmsd
-CTEuCRCVP8X7C5n3rl1YqzfWfNr8QFxvH7ivG7KOlSxvyTKcYatWb9uDUPrnr74f
-ZaMljHGsNyKj70MzZcrrsmt61yWGR0h+02rmIKlskl4hkh+qF5ehI+Bkd7eblsBy
-rxEREHq/ij2Vd7l0Z606YCE8vj8WfcsJj8JjwR3A+nND/oNJTTbQ3b8OvasvqIey
-WqqmGg73nbHjd/VIAUsfvnsEYatDk4pAA/wQr9c4T4s5Q/QRwDrAsa4J89FrDjWC
-hQBPL7TaP8Af/3Y3/86jLCN4lnW1qjPXv5rhBFeI0EVi1k1qdV06qr5HOk7CwQTT
-uc4rCdFcEnw8kVKZa/yFnlJfRa0Z4IwSahdp5fdFEuad6LpOcFFnYxWtIWhcg4GT
-RcMha/OZnsfqOqiAt6In+1IwuJBz3uMM7xw2AMaxzAejGEL63F81C5iJ6Ld6kQK+
-XblDW0G643bVbzkBb46MAT+UnLuWQUs3NDtk1FEioJyWUgbO/srMH4MoWM7rG8ZT
-nQPohNmPBrqL2phmE27HQsQ0rTjH2Z2ol7iy9OFMtT0=
-=MkGo
-----END PGP PUBLIC KEY BLOCK-----
--- a/gating.yaml
+++ b/gating.yaml
@ -1,25 +0,0 @@
--- !Policy
-product_versions:
-  - fedora-*
-decision_context: bodhi_update_push_testing
-subject_type: koji_build
-rules:
-  - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build./plans/tier1-public.functional}
- 
-#Rawhide
--- !Policy
-product_versions:
-  - fedora-*
-decision_context: bodhi_update_push_stable
-subject_type: koji_build
-rules:
-  - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build./plans/tier1-public.functional}
- 
-#gating rhel
--- !Policy
-product_versions:
-  - rhel-*
-decision_context: osci_compose_gate
-rules:
-  - !PassingTestCaseRule {test_case_name: osci.brew-build./plans/tier1-public.functional}
-  - !PassingTestCaseRule {test_case_name: osci.brew-build./plans/tier1-internal.functional}
--- a/ldap2zone.c
+++ b/ldap2zone.c
@ -1,411 +0,0 @@
-/*
- * Copyright (C) 2004, 2005 Stig Venaas <venaas@uninett.no>
- * $Id: ldap2zone.c,v 1.1 2007/07/24 15:18:00 atkac Exp $
- *
- * Permission to use, copy, modify, and distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
- */
-
-#define LDAP_DEPRECATED 1
-
-#include <sys/types.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <ctype.h>
-
-#include <ldap.h>
-
-struct string {
-    void *data;
-    size_t len;
-};
-
-struct assstack_entry {
-    struct string key;
-    struct string val;
-    struct assstack_entry *next;
-};
-
-struct assstack_entry *assstack_find(struct assstack_entry *stack, struct string *key);
-void assstack_push(struct assstack_entry **stack, struct assstack_entry *item);
-void assstack_insertbottom(struct assstack_entry **stack, struct assstack_entry *item);
-void printsoa(struct string *soa);
-void printrrs(char *defaultttl, struct assstack_entry *item);
-void print_zone(char *defaultttl, struct assstack_entry *stack);
-void usage(char *name);
-void err(char *name, const char *msg);
-int putrr(struct assstack_entry **stack, struct berval *name, char *type, char *ttl, struct berval *val);
-
-struct assstack_entry *assstack_find(struct assstack_entry *stack, struct string *key) {
-    for (; stack; stack = stack->next)
-	if (stack->key.len == key->len && !memcmp(stack->key.data, key->data, key->len))
-	    return stack;
-    return NULL;
-}
-
-void assstack_push(struct assstack_entry **stack, struct assstack_entry *item) {
-    item->next = *stack;
-    *stack = item;
-}
-
-void assstack_insertbottom(struct assstack_entry **stack, struct assstack_entry *item) {
-    struct assstack_entry *p;
-    
-    item->next = NULL;
-    if (!*stack) {
-	*stack = item;
-	return;
-    }
-    /* find end, should keep track of end somewhere */
-    /* really a queue, not a stack */
-    p = *stack;
-    while (p->next)
-	p = p->next;
-    p->next = item;
-}
-
-void printsoa(struct string *soa) {
-    char *s;
-    size_t i;
-    
-    s = (char *)soa->data;
-    i = 0;
-    while (i < soa->len) {
-	putchar(s[i]);
-	if (s[i++] == ' ')
-	    break;
-    }
-    while (i < soa->len) {
-	putchar(s[i]);
-	if (s[i++] == ' ')
-	    break;
-    } 
-    printf("(\n\t\t\t\t");
-    while (i < soa->len) {
-	putchar(s[i]);
-	if (s[i++] == ' ')
-	    break;
-    }
-    printf("; Serialnumber\n\t\t\t\t");
-    while (i < soa->len) {
-	if (s[i] == ' ')
-	    break;
-	putchar(s[i++]);
-    }
-    i++;
-    printf("\t; Refresh\n\t\t\t\t");
-    while (i < soa->len) {
-	if (s[i] == ' ')
-	    break;
-	putchar(s[i++]);
-    }
-    i++;
-    printf("\t; Retry\n\t\t\t\t");
-    while (i < soa->len) {
-	if (s[i] == ' ')
-	    break;
-	putchar(s[i++]);
-    }
-    i++;
-    printf("\t; Expire\n\t\t\t\t");
-    while (i < soa->len) {
-	putchar(s[i++]);
-    }
-    printf(" )\t; Minimum TTL\n");
-}
-
-void printrrs(char *defaultttl, struct assstack_entry *item) {
-    struct assstack_entry *stack;
-    char *s;
-    int first;
-    size_t i;
-    char *ttl, *type;
-    int top;
-    
-    s = (char *)item->key.data;
-
-    if (item->key.len == 1 && *s == '@') {
-	top = 1;
-	printf("@\t");
-    } else {
-	top = 0;
-	for (i = 0; i < item->key.len; i++)
-	    putchar(s[i]);
-	if (item->key.len < 8)
-	    putchar('\t');
-	putchar('\t');
-    }
-    
-    first = 1;
-    for (stack = (struct assstack_entry *) item->val.data; stack; stack = stack->next) {
-	ttl = (char *)stack->key.data;
-	s = strchr(ttl, ' ');
-	*s++ = '\0';
-	type = s;
-	
-	if (first)
-	    first = 0;
-        else
-	    printf("\t\t");
-	    
-	if (strcmp(defaultttl, ttl))
-	    printf("%s", ttl);
-	putchar('\t');
-	
-	if (top) {
-	    top = 0;
-	    printf("IN\t%s\t", type);
-	    /* Should always be SOA here */
-	    if (!strcmp(type, "SOA")) {
-		printsoa(&stack->val);
-		continue;
-	    }
-	} else
-	    printf("%s\t", type);
-
-	s = (char *)stack->val.data;
-	for (i = 0; i < stack->val.len; i++)
-	    putchar(s[i]);
-	putchar('\n');
-    }
-}
-
-void print_zone(char *defaultttl, struct assstack_entry *stack) {
-    printf("$TTL %s\n", defaultttl);
-    for (; stack; stack = stack->next)
-	printrrs(defaultttl, stack);
-};
-
-void usage(char *name) {
-    fprintf(stderr, "Usage:%s zone-name LDAP-URL default-ttl [serial]\n", name);
-    exit(1);
-};
-
-void err(char *name, const char *msg) {
-    fprintf(stderr, "%s: %s\n", name, msg);
-    exit(1);
-};
-
-int putrr(struct assstack_entry **stack, struct berval *name, char *type, char *ttl, struct berval *val) {
-    struct string key;
-    struct assstack_entry *rr, *rrdata;
-    
-    /* Do nothing if name or value have 0 length */
-    if (!name->bv_len || !val->bv_len)
-	return 0;
-
-    /* see if already have an entry for this name */
-    key.len = name->bv_len;
-    key.data = name->bv_val;
-
-    rr = assstack_find(*stack, &key);
-    if (!rr) {
-	/* Not found, create and push new entry */
-	rr = (struct assstack_entry *) malloc(sizeof(struct assstack_entry));
-	if (!rr)
-	    return -1;
-	rr->key.len = name->bv_len;
-	rr->key.data = (void *) malloc(rr->key.len);
-	if (!rr->key.data) {
-	    free(rr);
-	    return -1;
-	}
-	memcpy(rr->key.data, name->bv_val, name->bv_len);
-	rr->val.len = sizeof(void *);
-	rr->val.data = NULL;
-	if (name->bv_len == 1 && *(char *)name->bv_val == '@')
-	    assstack_push(stack, rr);
-	else
-	    assstack_insertbottom(stack, rr);
-    }
-
-    rrdata = (struct assstack_entry *) malloc(sizeof(struct assstack_entry));
-    if (!rrdata) {
-	free(rr->key.data);
-	free(rr);
-	return -1;
-    }
-    rrdata->key.len = strlen(type) + strlen(ttl) + 1;
-    rrdata->key.data = (void *) malloc(rrdata->key.len);
-    if (!rrdata->key.data) {
-	free(rrdata);
-	free(rr->key.data);
-	free(rr);
-	return -1;
-    }
-    sprintf((char *)rrdata->key.data, "%s %s", ttl, type);
-	
-    rrdata->val.len = val->bv_len;
-    rrdata->val.data = (void *) malloc(val->bv_len);
-    if (!rrdata->val.data) {
-	free(rrdata->key.data);
-	free(rrdata);
-	free(rr->key.data);
-	free(rr);
-	return -1;
-    }
-    memcpy(rrdata->val.data, val->bv_val, val->bv_len);
-
-    if (!strcmp(type, "SOA"))
-	assstack_push((struct assstack_entry **) &(rr->val.data), rrdata);
-    else
-	assstack_insertbottom((struct assstack_entry **) &(rr->val.data), rrdata);
-    return 0;
-}
-
-int main(int argc, char **argv) {
-    char *s, *hostporturl, *base = NULL;
-    char *ttl, *defaultttl;
-    LDAP *ld;
-    char *fltr = NULL;
-    LDAPMessage *res, *e;
-    char *a, **ttlvals, **soavals, *serial;
-    struct berval **vals, **names;
-    char type[64];
-    BerElement *ptr;
-    int i, j, rc, msgid;
-    struct assstack_entry *zone = NULL;
-    
-    if (argc < 4 || argc > 5)
-        usage(argv[0]);
-
-    hostporturl = argv[2];
-
-    if (hostporturl != strstr( hostporturl, "ldap"))
-	err(argv[0], "Not an LDAP URL");
-
-    s = strchr(hostporturl, ':');
-
-    if (!s || strlen(s) < 3 || s[1] != '/' || s[2] != '/')
-	err(argv[0], "Not an LDAP URL");
-
-    s = strchr(s+3, '/');
-    if (s) {
-	*s++ = '\0';
-	base = s;
-	s = strchr(base, '?');
-	if (s)
-	    err(argv[0], "LDAP URL can only contain host, port and base");
-    }
-
-    defaultttl = argv[3];
-    
-    rc = ldap_initialize(&ld, hostporturl);
-    if (rc != LDAP_SUCCESS)
-	err(argv[0], "ldap_initialize() failed");
-
-    if (argc == 5) {
-	/* serial number specified, check if different from one in SOA */
-	fltr = (char *)malloc(strlen(argv[1]) + strlen("(&(relativeDomainName=@)(zoneName=))") + 1);
-	sprintf(fltr, "(&(relativeDomainName=@)(zoneName=%s))", argv[1]);
-	msgid = ldap_search(ld, base, LDAP_SCOPE_SUBTREE, fltr, NULL, 0);
-	if (msgid == -1)
-	    err(argv[0], "ldap_search() failed");
-
-	while ((rc = ldap_result(ld, msgid, 0, NULL, &res)) != LDAP_RES_SEARCH_RESULT ) {
-	    /* not supporting continuation references at present */
-	    if (rc != LDAP_RES_SEARCH_ENTRY)
-		err(argv[0], "ldap_result() returned cont.ref? Exiting");
-
-	    /* only one entry per result message */
-	    e = ldap_first_entry(ld, res);
-	    if (e == NULL) {
-		ldap_msgfree(res);
-		err(argv[0], "ldap_first_entry() failed");
-	    }
-	
-	    soavals = ldap_get_values(ld, e, "SOARecord");
-	    if (soavals)
-		break;
-	}
-
-	ldap_msgfree(res);
-	if (!soavals) {
-		err(argv[0], "No SOA Record found");
-	}
-	
-	/* We have a SOA, compare serial numbers */
-	/* Only checkinf first value, should be only one */
-	s = strchr(soavals[0], ' ');
-	s++;
-	s = strchr(s, ' ');
-	s++;
-	serial = s;
-	s = strchr(s, ' ');
-	*s = '\0';
-	if (!strcmp(serial, argv[4])) {
-	    ldap_value_free(soavals);
-	    err(argv[0], "serial numbers match");
-	}
-	ldap_value_free(soavals);
-    }
-
-    if (!fltr)
-	fltr = (char *)malloc(strlen(argv[1]) + strlen("(zoneName=)") + 1);
-    if (!fltr)
-	err(argv[0], "Malloc failed");
-    sprintf(fltr, "(zoneName=%s)", argv[1]);
-
-    msgid = ldap_search(ld, base, LDAP_SCOPE_SUBTREE, fltr, NULL, 0);
-    if (msgid == -1)
-	err(argv[0], "ldap_search() failed");
-
-    while ((rc = ldap_result(ld, msgid, 0, NULL, &res)) != LDAP_RES_SEARCH_RESULT ) {
-	/* not supporting continuation references at present */
-	if (rc != LDAP_RES_SEARCH_ENTRY)
-	    err(argv[0], "ldap_result() returned cont.ref? Exiting");
-
-	/* only one entry per result message */
-	e = ldap_first_entry(ld, res);
-	if (e == NULL) {
-	    ldap_msgfree(res);
-	    err(argv[0], "ldap_first_entry() failed");
-	}
-	
-	names = ldap_get_values_len(ld, e, "relativeDomainName");
-	if (!names)
-	    continue;
-	
-	ttlvals = ldap_get_values(ld, e, "dNSTTL");
-	ttl = ttlvals ? ttlvals[0] : defaultttl;
-
-	for (a = ldap_first_attribute(ld, e, &ptr); a != NULL; a = ldap_next_attribute(ld, e, ptr)) {
-	    char *s;
-
-	    for (s = a; *s; s++)
-		*s = toupper(*s);
-	    s = strstr(a, "RECORD");
-	    if ((s == NULL) || (s == a) || (s - a >= (signed int)sizeof(type))) {
-		ldap_memfree(a);
-		continue;
-	    }
-			
-	    strncpy(type, a, s - a);
-	    type[s - a] = '\0';
-	    vals = ldap_get_values_len(ld, e, a);
-	    if (vals) {
-		for (i = 0; vals[i]; i++)
-		    for (j = 0; names[j]; j++)
-			if (putrr(&zone, names[j], type, ttl, vals[i]))
-			    err(argv[0], "malloc failed");
-		ldap_value_free_len(vals);
-	    }
-	    ldap_memfree(a);
-	}
-
-	if (ptr)
-	    ber_free(ptr, 0);
-	if (ttlvals)
-	    ldap_value_free(ttlvals);
-	ldap_value_free_len(names);
-	/* free this result */
-	ldap_msgfree(res);
-    }
-
-    /* free final result */
-    ldap_msgfree(res);
-
-    print_zone(defaultttl, zone);
-    return 0;
-}
--- a/makefile-replace-libs.py
+++ b/makefile-replace-libs.py
@ -1,143 +0,0 @@
-#!/usr/bin/python3
-#
-# Makefile modificator
-#
-# Should help in building bin/tests/system tests standalone,
-# linked to libraries installed into the system.
-# TODO:
-# - Fix top_srcdir, because dyndb/driver/Makefile uses $TOPSRC/mkinstalldirs
-# - Fix conf.sh to contain paths to system tools
-# - Export $TOP/version somewhere, where it would be used
-# - system tests needs bin/tests code. Do not include just bin/tests/system
-#
-# Possible solution:
-#
-# sed -e 's/$TOP\/s\?bin\/\(delv\|confgen\|named\|nsupdate\|pkcs11\|python\|rndc\|check\|dig\|dnssec\|tools\)\/\([[:alnum:]-]\+\)/`type -p \2`/' conf.sh
-# sed -e 's,../../../../\(isc-config.sh\),\1,' builtin/tests.sh
-# or use: $NAMED -V | head -1 | cut -d ' ' -f 2
-
-import re
-import argparse
-
-"""
-Script for replacing Makefile ISC_INCLUDES with runtime flags.
-
-Should translate part of Makefile to use isc-config.sh instead static linked sources.
-ISC_INCLUDES = -I/home/pemensik/rhel/bind/bind-9.11.12/build/lib/isc/include \
-        -I${top_srcdir}/lib/isc \
-        -I${top_srcdir}/lib/isc/include \
-        -I${top_srcdir}/lib/isc/unix/include \
-        -I${top_srcdir}/lib/isc/pthreads/include \
-        -I${top_srcdir}/lib/isc/x86_32/include
-
-Should be translated to:
-ISC_INCLUDES = $(shell isc-config.sh --cflags isc)
-"""
-
-def isc_config(mode, lib):
-    if mode:
-        return '$(shell isc-config.sh {mode} {lib})'.format(mode=mode, lib=lib)
-    else:
-        return ''
-
-def check_match(match, debug=False):
-    """
-    Check this definition is handled by internal library
-    """
-    if not match:
-        return False
-    lib = match.group(2).lower()
-    ok = not lib_filter or lib in lib_filter
-    if debug:
-        print('{status} {lib}: {text}'.format(status=ok, lib=lib, text=match.group(1)))
-    return ok
-
-def fix_line(match, mode):
-    lib = match.group(2).lower()
-    return match.group(1)+isc_config(mode, lib)+"\n"
-
-def fix_file_lines(path, debug=False):
-    """
-    Opens file and scans fixes selected parameters
-
-    Returns list of lines if something should be changed,
-    None if no action is required
-    """
-    fixed = []
-    changed = False
-    with open(path, 'r') as fin:
-        fout = None
-
-        line = next(fin, None)
-        while line:
-            appended = False
-            while line.endswith("\\\n"):
-                line += next(fin, None)
-
-            inc = re_includes.match(line)
-            deplibs = re_deplibs.match(line)
-            libs = re_libs.match(line)
-            newline = None
-            if check_match(inc, debug=debug):
-                newline = fix_line(inc, '--cflags')
-            elif check_match(deplibs, debug=debug):
-                newline = fix_line(libs, None)
-            elif check_match(libs, debug=debug):
-                newline = fix_line(libs, '--libs')
-
-            if newline and line != newline:
-                changed = True
-                line = newline
-
-            fixed.append(line)
-            line = next(fin, None)
-
-    if not changed:
-        return None
-    else:
-        return fixed
-
-def write_lines(path, lines):
-    fout = open(path, 'w')
-    for line in lines:
-        fout.write(line)
-    fout.close()
-
-def print_lines(lines):
-    for line in lines:
-        print(line, end='')
-
-if __name__ == '__main__':
-    parser = argparse.ArgumentParser(description='Makefile multiline include replacer')
-    parser.add_argument('files', nargs='+')
-    parser.add_argument('--filter', type=str,
-            default='isc isccc isccfg dns lwres bind9 irs',
-            help='List of libraries supported by isc-config.sh')
-    parser.add_argument('--check', action='store_true',
-            help='Test file only')
-    parser.add_argument('--print', action='store_true',
-            help='Print changed file only')
-    parser.add_argument('--debug', action='store_true',
-            help='Enable debug outputs')
-
-    args = parser.parse_args()
-    lib_filter = None
-
-    re_includes = re.compile(r'^\s*((\w+)_INCLUDES\s+=\s*).*')
-    re_deplibs = re.compile(r'^\s*((\w+)DEPLIBS\s*=).*')
-    re_libs = re.compile(r'^\s*((\w+)LIBS\s*=).*')
-
-    if args.filter:
-        lib_filter = set(args.filter.split(' '))
-        pass
-
-    for path in args.files:
-        lines = fix_file_lines(path, debug=args.debug)
-        if lines:
-            if args.print:
-                print_lines(lines)
-            elif not args.check:
-                write_lines(path, lines)
-                print('File {path} was fixed'.format(path=path))
-        else:
-            print('File {path} does not need fixing'.format(path=path))
--- a/plans.fmf
+++ b/plans.fmf
@ -1,39 +0,0 @@
-environment+:
-  PACKAGE: bind9.18
-
-/tier1-internal:
-  plan:
-    import:
-      url: https://src.fedoraproject.org/tests/bind.git
-      name: /plans/bind9.18/tier1/internal
-
-/tier1-public:
-  plan:
-    import:
-      url: https://src.fedoraproject.org/tests/bind.git
-      name: /plans/bind9.18/tier1/public
-
-
-/tier2-tier3-internal:
-  plan:
-    import:
-      url: https://src.fedoraproject.org/tests/bind.git
-      name: /plans/bind9.18/tier2-tier3/internal
-
-/tier2-tier3-public:
-  plan:
-    import:
-      url: https://src.fedoraproject.org/tests/bind.git
-      name: /plans/bind9.18/tier2-tier3/public
-
-/others-internal:
-  plan:
-    import:
-      url: https://src.fedoraproject.org/tests/bind.git
-      name: /plans/bind9.18/others/internal
-
-/others-public:
-  plan:
-    import:
-      url: https://src.fedoraproject.org/tests/bind.git
-      name: /plans/bind9.18/others/public
--- a/softhsm2.conf.in
+++ b/softhsm2.conf.in
@ -1,10 +0,0 @@
-# SoftHSM v2 configuration file
-
-directories.tokendir = @TOKENPATH@
-objectstore.backend = file
-
-# ERROR, WARNING, INFO, DEBUG
-log.level = ERROR
-
-# If CKF_REMOVABLE_DEVICE flag should be set
-slots.removable = false
--- a/2
+++ b/2
@ -1,2 +0,0 @@
-SHA512 (bind-9.18.29.tar.xz) = 6c2676e2e2cb90f3bd73afb367813c54d1c961e12df1e12e41b9d0ee5a1d5cdf368d81410469753eaef37e43358b56796f078f3b2f20c3b247c4bef91d56c716
-SHA512 (bind-9.18.29.tar.xz.asc) = 6612c7151c4c1736e0237b8219cefbafbc1dcd4b04ad9b12b99cba703e6debde90d2f9838dd1465a47b9a002a598d9b8f3221dfe1a3bdc41436a92e6d06db472
Author	SHA1	Message	Date
AlmaLinux RelEng Bot	49ea88a72a	import CS bind9.18-9.18.29-16.el9	2026-08-24 08:53:40 -04:00
AlmaLinux RelEng Bot	13c63d0259	import CS bind9.18-9.18.29-13.el9	2026-03-30 10:16:22 -04:00
eabdullin	b49d075cce	import CS bind9.18-9.18.29-4.el9_6	2025-09-15 11:35:28 +00:00
eabdullin	2683c619eb	import CS bind9.18-9.18.29-2.el9	2025-03-11 07:02:01 +00:00
eabdullin	e4326ff34b	import CS bind9.18-9.18.29-1.el9	2024-09-30 16:52:48 +00:00
				`@ -0,0 +1 @@`
				`33ff5a86e56d65859358749654ea848809bd4532 SOURCES/bind-9.18.29.tar.xz`