Re: pkg/60864 (Root Zone DNSSEC Trust Anchor change on Oct 11)

[riastradh%NetBSD.org@localhost]

Synopsis: Root Zone DNSSEC Trust Anchor change on Oct 11

Responsible-Changed-From-To: pkg-manager->christos
Responsible-Changed-By: riastradh%NetBSD.org@localhost
Responsible-Changed-When: Fri, 09 Oct 2026 20:43:42 +0000
Responsible-Changed-Why:
christos, you made the last change to src/etc/namedb/bind.keys -- can
you take a look at this?

We seem to have three copies of the same file, not all up-to-date:

src/etc/namedb/bind.keys
src/external/mpl/bind/dist/bind.keys
src/external/mpl/bind/include/bind.keys.h

I'm not clear on which one is used for what purpose, or what the
process is for updating any of them -- bind.keys.h is not mentioned in
bind2netbsd, so I suspect everything outside dist/ is out-of-date and
should maybe deleted and autogenerated by a makefile recipe.

I'm also not clear on how to test, given a freshly installed running
BIND system, which keys it will use to bootstrap.  E.g., if you keep
the fresh installation offline, does `dig @127.0.0.1 . dnskey' DTRT?
Except, it looks like the new key is only available in the bind.keys
file through its DS hash, not DNSKEY?  So how do you test this
operationally before the flag day?