From: riastradh%NetBSD.org@localhost <riastradh%NetBSD.org@localhost>
Date: Friday, October 9, 2026 at 1:43 PM
To: christos%netbsd.org@localhost <christos%netbsd.org@localhost>; pkg-manager%netbsd.org@localhost <pkg-manager%netbsd.org@localhost>; pkgsrc-bugs%netbsd.org@localhost <pkgsrc-bugs%netbsd.org@localhost>; gnats-admin%netbsd.org@localhost <gnats-admin%netbsd.org@localhost>; riastradh%NetBSD.org@localhost <riastradh%NetBSD.org@localhost>; James Mitchell
<james.mitchell%iana.org@localhost>
Subject: [Ext] Re: pkg/60864 (Root Zone DNSSEC Trust Anchor change on Oct 11)
Synopsis: Root Zone DNSSEC Trust Anchor change on Oct 11
Responsible-Changed-From-To: pkg-manager->christos
Responsible-Changed-By: riastradh%NetBSD.org@localhost
Responsible-Changed-When: Fri, 09 Oct 2026 20:43:42 +0000
Responsible-Changed-Why:
christos, you made the last change to src/etc/namedb/bind.keys -- can
you take a look at this?
We seem to have three copies of the same file, not all up-to-date:
src/etc/namedb/bind.keys
src/external/mpl/bind/dist/bind.keys
src/external/mpl/bind/include/bind.keys.h
I'm not clear on which one is used for what purpose, or what the
process is for updating any of them -- bind.keys.h is not mentioned in
bind2netbsd, so I suspect everything outside dist/ is out-of-date and
should maybe deleted and autogenerated by a makefile recipe.
I'm also not clear on how to test, given a freshly installed running
BIND system, which keys it will use to bootstrap. E.g., if you keep
the fresh installation offline, does `dig @127.0.0.1 . dnskey' DTRT?
Except, it looks like the new key is only available in the bind.keys
file through its DS hash, not DNSKEY? So how do you test this
operationally before the flag day?