4487. [test] Make system tests work on Windows. [RT #42931]

4401. [misc] Change LICENSE to MPL 2.0.

[master] fixed revoked key regression 4436. [bug] Fixed a regression introduced in change #4337 which caused signed domains with revoked KSKs to fail validation. [RT #42147]

update copyright notice / whitespace

4331. [func] When loading managed signed zones detect if the RRSIG's inception time is in the future and regenerate the RRSIG immediately. [RT #41808]

update copyright notice / whitespace

4127. [protocol] CDS and CDNSKEY need to be signed by the key signing key as per RFC 7344, Section 4.1. [RT #37215]

3990. [testing] Add tests for unknown DNSSEC algorithm handling. [RT #37541]

3925. [bug] DS lookup of RFC 1918 empty zones failed. [RT #36917

[master] complete NTA work 3882. [func] By default, negative trust anchors will be tested periodically to see whether data below them can be validated, and if so, they will be allowed to expire early. The "rndc nta -force" option overrides this behvaior. The default NTA lifetime and the recheck frequency can be configured by the "nta-lifetime" and "nta-recheck" options. [RT #36146]

[master] use posix-compatible shell in system tests 3839. [test] Use only posix-compatible shell in system tests. [RT #35625]

update copyright notice

[master] testcrypto.sh in system tests 3714. [test] System tests that need to test for cryptography support before running can now use a common "testcrypto.sh" script to do so. [RT #35213]

3356. [bug] Cap the TTL of signed RRsets when RRSIGs are approaching their expiry, so they don't remain in caches after expiry. [RT #26429]

reverse bad copyright update

update copyright notice

update copyright notice

Handle RRSIG signer case consistently 3329. [bug] Handle RRSIG signer-name case consistently: We generate RRSIG records with the signer-name in lower case. We accept them with any case, but if they fail to validate, we try again in lower case. [RT #27451]

3203. [bug] Increase log level to 'info' for validation failures from expired or not-yet-valid RRSIGs. [RT #21796]

adjust rt23702 test to take less time

3083. [bug] NOTIFY messages were not being sent when generating a NSEC3 chain incrementally. [RT #23702]

3061. [func] New option "dnssec-signzone -D", only write out generated DNSSEC records. [RT #22896]

Use RRSIG original TTL in validated RRset TTL [RT #23332]

3040. [bug] Named failed to validate insecure zones where a node with a CNAME existed between the trust anchor and the top of the zone. [RT #23338]

update copyright notice

3020. [bug] auto-dnssec failed to correctly update the zone when changing the DNSKEY RRset. [RT #23232]

3019. [func] Test: check apex NSEC3 records after adding DNSKEY record via UPDATE. [RT #23229]

2968. [security] Named could fail to prove a data set was insecure before marking it as insecure. One set of conditions that can trigger this occurs naturally when rolling DNSKEY algorithms. [RT #22309]

2951. [bug] named failed to generate a correct signed response in a optout, delegation only zone with no secure delegations. [RT #22007]

2938. [bug] When skipping NSEC3 records that don't match the current NSEC3PARAM record in use for zone named could dereference a uninitialised pointer attempting to obtain a lock. [RT# 21868]

update copyright notice

2841. [func] Added "smartsign" and improved "autosign" and "dnssec" regression tests. [RT #20865]

2828. [security] Cached CNAME or DNAME RR could be returned to clients without DNSSEC validation. [RT #20737] 9.4-ESV, 9.5.3, 9.6.2, 9.7.0, 9.8.0(?)

2741. [func] Allow the dnssec-keygen progress messages to be suppressed (dnssec-keygen -q). Automatically suppress the progress messages when stdin is not a tty. [RT #20474]

2738. [func] Add RSASHA256 and RSASHA512 tests to the dnssec system test. [RT #20453]

2636. [func] Simplify zone signing and key maintenance with the dnssec-* tools. Major changes: - all dnssec-* tools now take a -K option to specify a directory in which key files will be stored - DNSSEC can now store metadata indicating when they are scheduled to be published, acttivated, revoked or removed; these values can be set by dnssec-keygen or overwritten by the new dnssec-settime command - dnssec-signzone -S (for "smart") option reads key metadata and uses it to determine automatically which keys to publish to the zone, use for signing, revoke, or remove from the zone [RT #19816]

update copyright notice

2608. [func] Perform post signing verification checks in dnssec-signzone. These can be disabled with -P. The post sign verification test ensures that for each algorithm in use there is at least one non revoked self signed KSK key. That all revoked KSK keys are self signed. That all records in the zone are signed by the algorithm. [RT #19653]

update copyright notice

2448. [func] Add NSEC3 support. [RT #15452]

update copyright notice

update copyright notice

update copyright notice