pkg/60864: Root Zone DNSSEC Trust Anchor change on Oct 11

["james.mitchell%iana.org@localhost via gnats" <gnats-admin%NetBSD.org@localhost>]

>Number:         60864
>Category:       pkg
>Synopsis:       Root Zone DNSSEC Trust Anchor change on Oct 11
>Confidential:   no
>Severity:       critical
>Priority:       medium
>Responsible:    pkg-manager
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri Oct 09 20:05:00 +0000 2026
>Originator:     James Mitchell
>Release:        
>Organization:
IANA
>Environment:
>From code repository only.
https://github.com/NetBSD/src/blob/afadf85a22a1c686a80767d9b55ca1b57c051631/etc/namedb/bind.keys#L56-L69
>Description:
The version of bind.keys does not contain the DNSSEC Trust Anchor that will become active on Oct 11 2026 (id/tag=38696).

ISC BIND notes that supported versions of BIND have the keys built in, so is unclear if this will affect NetBSD installs. If so, it may be prudent to remove the bind.keys file.

However, if this bind.keys file is used, validating resolvers that do not also have automatic trust anchor management enabled may be unable to resolve domains.

Please see https://www.iana.org/dnssec/files for links to the new DNSSEC trust anchors.
>How-To-Repeat:
Verified from code repository only. Sorry for choosing critical; I hope it is triaged to be a non-issue.
>Fix:
If necessary, update bind.keys from upstream? I haven't verified the version of BIND installed and whether the linked file is correct for that version.

https://gitlab.isc.org/isc-projects/bind9/-/blob/main/bind.keys