use DS style trust anchors in all system tests

this adds functions in conf.sh.common to create DS-style trust anchor
files. those functions are then used to create nearly all of the trust
anchors in the system tests.

there are a few exceptions:
 - some tests in dnssec and mkeys rely on detection of unsupported
   algorithms, which only works with key-style trust anchors, so those
   are used for those tests in particular.
 - the mirror test had a problem with the use of a CSK without a
   SEP bit, which still needs addressing

in the future, some of these tests should be changed back to using
traditional trust anchors, so that both types will be exercised going
forward.

diff --git a/bin/tests/system/autosign/ns1/keygen.sh b/bin/tests/system/autosign/ns1/keygen.sh
index 6ba8f95df9fcc45dc0c72b180a951d381be69f8b..47d3eefe10773d27cba3c2e3f1fc89e933fed47e 100644 (file)
--- a/bin/tests/system/autosign/ns1/keygen.sh
+++ b/bin/tests/system/autosign/ns1/keygen.sh
@@ -33,12 +33,12 @@ rm $zsknopriv.private
 ksksby=`$KEYGEN -3 -a RSASHA1 -q -P now -A now+15s -fk $zone`
 kskrev=`$KEYGEN -3 -a RSASHA1 -q -R now+15s -fk $zone`
 
-keyfile_to_static_keys $ksksby > trusted.conf
+keyfile_to_static_ds $ksksby > trusted.conf
 cp trusted.conf ../ns2/trusted.conf
 cp trusted.conf ../ns3/trusted.conf
 cp trusted.conf ../ns4/trusted.conf
 
-keyfile_to_static_keys $kskrev > trusted.conf
+keyfile_to_static_ds $kskrev > trusted.conf
 cp trusted.conf ../ns5/trusted.conf
 
 echo $zskact > ../active.key

diff --git a/bin/tests/system/autosign/ns2/keygen.sh b/bin/tests/system/autosign/ns2/keygen.sh
index de557d76e2be4463ba5deab6a18354941a90dbca..9d40b7fa34805c2a1462924cafc7e97ebd6a7c98 100644 (file)
--- a/bin/tests/system/autosign/ns2/keygen.sh
+++ b/bin/tests/system/autosign/ns2/keygen.sh
@@ -37,7 +37,7 @@ zonefile="${zone}.db"
 infile="${zonefile}.in"
 ksk=`$KEYGEN -a RSASHA1 -3 -q -fk $zone`
 $KEYGEN -a RSASHA1 -3 -q $zone > /dev/null
-keyfile_to_static_keys $ksk > private.conf
+keyfile_to_static_ds $ksk > private.conf
 cp private.conf ../ns4/private.conf
 $SIGNER -S -3 beef -A -o $zone -f $zonefile $infile > /dev/null
 

diff --git a/bin/tests/system/conf.sh.common b/bin/tests/system/conf.sh.common
index 51c0f399f5528b39d0f0a45ec3aa5f735371267b..f2bafa76ce2967e3595a12a406cb28cf4988f1a3 100644 (file)
--- a/bin/tests/system/conf.sh.common
+++ b/bin/tests/system/conf.sh.common
@@ -221,9 +221,9 @@ assert_int_equal() {
 }
 
 # keyfile_to_keys_section: helper function for keyfile_to_*_keys() which
-# converts keyfile data into a configuration section using the supplied
-# parameters
-keyfile_to_keys_section() {
+# converts keyfile data into a key-style trust anchor configuration
+# section using the supplied parameters
+keyfile_to_keys() {
     section_name=$1
     key_prefix=$2
     shift
@@ -241,18 +241,54 @@ keyfile_to_keys_section() {
     echo "};"
 }
 
+# keyfile_to_dskeys_section: helper function for keyfile_to_*_dskeys()
+# converts keyfile data into a DS-style trust anchor configuration
+# section using the supplied parameters
+keyfile_to_dskeys() {
+    section_name=$1
+    key_prefix=$2
+    shift
+    shift
+    echo "$section_name {"
+    for keyname in $*; do
+        $DSFROMKEY $keyname.key | \
+       awk '!/^; /{
+           printf "\t\""$1"\" "
+           printf "'"$key_prefix "'"
+           printf $4 " " $5 " " $6 " \""
+           for (i=7; i<=NF; i++) printf $i
+           printf "\";\n"
+       }'
+    done
+    echo "};"
+}
+
 # keyfile_to_static_keys: convert key data contained in the keyfile(s)
-# provided to a *static* "dnssec-keys" section suitable for including in a
+# provided to a *static-key* "dnssec-keys" section suitable for including in a
 # resolver's configuration file
 keyfile_to_static_keys() {
-    keyfile_to_keys_section "dnssec-keys" "static-key" $*
+    keyfile_to_keys "dnssec-keys" "static-key" $*
 }
 
 # keyfile_to_initial_keys: convert key data contained in the keyfile(s)
-# provided to an *initialzing* "dnssec-keys" section suitable for including
+# provided to an *initial-key* "dnssec-keys" section suitable for including
 # in a resolver's configuration file
 keyfile_to_initial_keys() {
-    keyfile_to_keys_section "dnssec-keys" "initial-key" $*
+    keyfile_to_keys "dnssec-keys" "initial-key" $*
+}
+
+# keyfile_to_static_ds_keys: convert key data contained in the keyfile(s)
+# provided to a *static-ds* "dnssec-keys" section suitable for including in a
+# resolver's configuration file
+keyfile_to_static_ds() {
+    keyfile_to_dskeys "dnssec-keys" "static-ds" $*
+}
+
+# keyfile_to_initial_ds_keys: convert key data contained in the keyfile(s)
+# provided to an *initial-ds* "dnssec-keys" section suitable for including
+# in a resolver's configuration file
+keyfile_to_initial_ds() {
+    keyfile_to_dskeys "dnssec-keys" "initial-ds" $*
 }
 
 # keyfile_to_key_id: convert a key file name to a key ID

diff --git a/bin/tests/system/dnssec/ns1/sign.sh b/bin/tests/system/dnssec/ns1/sign.sh
index fe8a432eebcf0b9dec63747e79fdff0097b6efd9..66254b7cfe383509a23ccc3cac2dd4cf5dc3e5f8 100644 (file)
--- a/bin/tests/system/dnssec/ns1/sign.sh
+++ b/bin/tests/system/dnssec/ns1/sign.sh
@@ -38,7 +38,7 @@ cat "$infile" "$ksk.key" "$zsk.key" > "$zonefile"
 "$SIGNER" -P -g -o "$zone" "$zonefile" > /dev/null 2>&1
 
 # Configure the resolving server with a staitc key.
-keyfile_to_static_keys "$ksk" > trusted.conf
+keyfile_to_static_ds "$ksk" > trusted.conf
 cp trusted.conf ../ns2/trusted.conf
 cp trusted.conf ../ns3/trusted.conf
 cp trusted.conf ../ns4/trusted.conf
@@ -47,7 +47,7 @@ cp trusted.conf ../ns7/trusted.conf
 cp trusted.conf ../ns9/trusted.conf
 
 # ...or with an initializing key.
-keyfile_to_initial_keys "$ksk" > managed.conf
+keyfile_to_initial_ds "$ksk" > managed.conf
 cp managed.conf ../ns4/managed.conf
 
 #

diff --git a/bin/tests/system/dnssec/ns5/sign.sh b/bin/tests/system/dnssec/ns5/sign.sh
index 1c226d5f95fa237ab56fd7c53e491fc26516df8c..54ae148e0cae83d944076f69649cd75a0238cd02 100644 (file)
--- a/bin/tests/system/dnssec/ns5/sign.sh
+++ b/bin/tests/system/dnssec/ns5/sign.sh
@@ -23,7 +23,7 @@ zonefile=root.db.signed
 keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK "$zone")
 
 # copy the KSK out first, then revoke it
-keyfile_to_initial_keys "$keyname" > revoked.conf
+keyfile_to_initial_ds "$keyname" > revoked.conf
 
 "$SETTIME" -R now "${keyname}.key" > /dev/null
 
@@ -34,4 +34,4 @@ keyfile_to_initial_keys "$keyname" > revoked.conf
 
 keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone ".")
 
-keyfile_to_static_keys "$keyname" > trusted.conf
+keyfile_to_static_ds "$keyname" > trusted.conf

diff --git a/bin/tests/system/dsdigest/ns1/sign.sh b/bin/tests/system/dsdigest/ns1/sign.sh
index dc893b16319f46afcd7000fc01c530b4172b2d88..9f0ef6b036a03e0554ac70581879ad0a13b54820 100644 (file)
--- a/bin/tests/system/dsdigest/ns1/sign.sh
+++ b/bin/tests/system/dsdigest/ns1/sign.sh
@@ -29,7 +29,7 @@ cat $infile $key1.key $key2.key > $zonefile
 $SIGNER -P -g -o $zone $zonefile > /dev/null
 
 # Configure the resolving server with a static key.
-keyfile_to_static_keys $key2 > trusted.conf
+keyfile_to_static_ds $key2 > trusted.conf
 cp trusted.conf ../ns2/trusted.conf
 cp trusted.conf ../ns3/trusted.conf
 cp trusted.conf ../ns4/trusted.conf

diff --git a/bin/tests/system/ecdsa/ns1/sign.sh b/bin/tests/system/ecdsa/ns1/sign.sh
index 518e01d8d10d829241cd555e099f12856bb38ea5..673aac8ac09abd1bcc9d3ac9f184eb31cc5cb909 100644 (file)
--- a/bin/tests/system/ecdsa/ns1/sign.sh
+++ b/bin/tests/system/ecdsa/ns1/sign.sh
@@ -25,5 +25,5 @@ cat $infile $key1.key $key2.key > $zonefile
 $SIGNER -P -g -o $zone $zonefile > /dev/null 2> signer.err || cat signer.err
 
 # Configure the resolving server with a static key.
-keyfile_to_static_keys $key1 > trusted.conf
+keyfile_to_static_ds $key1 > trusted.conf
 cp trusted.conf ../ns2/trusted.conf

diff --git a/bin/tests/system/eddsa/ns1/sign.sh b/bin/tests/system/eddsa/ns1/sign.sh
index 6806db8c5cee49987335b426b4802bb937f37555..761ee134289661c8627de6d3fbfe5a4f5595fc48 100644 (file)
--- a/bin/tests/system/eddsa/ns1/sign.sh
+++ b/bin/tests/system/eddsa/ns1/sign.sh
@@ -26,7 +26,7 @@ cat $infile $key1.key $key2.key > $zonefile
 $SIGNER -P -g -o $zone $zonefile > /dev/null 2> signer.err || cat signer.err
 
 # Configure the resolving server with a static key.
-keyfile_to_static_keys $key1 > trusted.conf
+keyfile_to_static_ds $key1 > trusted.conf
 cp trusted.conf ../ns2/trusted.conf
 
 cd ../ns2 && $SHELL sign.sh

diff --git a/bin/tests/system/filter-aaaa/ns1/sign.sh b/bin/tests/system/filter-aaaa/ns1/sign.sh
index 44e27ed488e499d48b13a082d8540012925cbbe0..3223ffd4fa43bc5094a7c2292e2af2b2eb0ce3cc 100755 (executable)
--- a/bin/tests/system/filter-aaaa/ns1/sign.sh
+++ b/bin/tests/system/filter-aaaa/ns1/sign.sh
@@ -24,7 +24,7 @@ $KEYGEN -f KSK -a $DEFAULT_ALGORITHM $zone 2>&1 > keygen.out | cat_i
 keyname=`cat keygen.out`
 rm -f keygen.out
 
-keyfile_to_static_keys $keyname > trusted.conf
+keyfile_to_static_ds $keyname > trusted.conf
 cp trusted.conf ../ns2/trusted.conf
 cp trusted.conf ../ns3/trusted.conf
 cp trusted.conf ../ns5/trusted.conf

diff --git a/bin/tests/system/inline/ns1/sign.sh b/bin/tests/system/inline/ns1/sign.sh
index c14a83837eb3ef6e2844e53999ee7ed30893f074..72fc52eb4bc35b232340a5f1701ca4dc3c5e6cc8 100644 (file)
--- a/bin/tests/system/inline/ns1/sign.sh
+++ b/bin/tests/system/inline/ns1/sign.sh
@@ -20,5 +20,5 @@ keyname=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone -f KSK $zone`
 $SIGNER -S -x -T 1200 -o ${zone} root.db > signer.out
 [ $? = 0 ] || cat signer.out
 
-keyfile_to_static_keys $keyname > trusted.conf
+keyfile_to_static_ds $keyname > trusted.conf
 cp trusted.conf ../ns6/trusted.conf

diff --git a/bin/tests/system/legacy/ns7/sign.sh b/bin/tests/system/legacy/ns7/sign.sh
index 21ab3d1e5a4acb90be9bda5df7cbb6eb501a8f14..51719c22c15dda478056e18203786e096d85c568 100755 (executable)
--- a/bin/tests/system/legacy/ns7/sign.sh
+++ b/bin/tests/system/legacy/ns7/sign.sh
@@ -28,5 +28,5 @@ cat $infile $keyname1.key $keyname2.key >$zonefile
 
 $SIGNER -g -o $zone -f $outfile -e +30y $zonefile > /dev/null 2> signer.err || cat signer.err
 
-keyfile_to_static_keys $keyname2 > trusted.conf
+keyfile_to_static_ds $keyname2 > trusted.conf
 cp trusted.conf ../ns1

diff --git a/bin/tests/system/mkeys/ns1/sign.sh b/bin/tests/system/mkeys/ns1/sign.sh
index 135080a4676b6f9dac24cbf9a7f1110b95c294f0..483ed4ed5559cad3b41c52017167be79db2f8e9a 100644 (file)
--- a/bin/tests/system/mkeys/ns1/sign.sh
+++ b/bin/tests/system/mkeys/ns1/sign.sh
@@ -21,13 +21,13 @@ zskkeyname=`$KEYGEN -a rsasha256 -q $zone`
 $SIGNER -Sg -o $zone $zonefile > /dev/null 2>/dev/null
 
 # Configure the resolving server with an initializing key.
-keyfile_to_initial_keys $keyname > managed.conf
+keyfile_to_initial_ds $keyname > managed.conf
 cp managed.conf ../ns2/managed.conf
 cp managed.conf ../ns4/managed.conf
 cp managed.conf ../ns5/managed.conf
 
 # Configure a static key to be used by delv.
-keyfile_to_static_keys $keyname > trusted.conf
+keyfile_to_static_ds $keyname > trusted.conf
 
 # Prepare an unsupported algorithm key.
 unsupportedkey=Kunknown.+255+00000

diff --git a/bin/tests/system/mkeys/ns6/setup.sh b/bin/tests/system/mkeys/ns6/setup.sh
index 2e032e710ab4f1ae50d7aa334b02080aad2850a4..3fead4bcf786d7fcf20eb4e30bd33dba7f0b487f 100644 (file)
--- a/bin/tests/system/mkeys/ns6/setup.sh
+++ b/bin/tests/system/mkeys/ns6/setup.sh
@@ -27,4 +27,6 @@ rootkey=`cat ../ns1/managed.key`
 cp "../ns1/${rootkey}.key" .
 
 # Configure the resolving server with an initializing key.
+# (We use key-format trust anchors here because otherwise the
+# unsupported algorithm test won't work.)
 keyfile_to_initial_keys $unsupportedkey $rsakey $rootkey > managed.conf

diff --git a/bin/tests/system/mkeys/tests.sh b/bin/tests/system/mkeys/tests.sh
index 80c19beb03e4c409c8b3b2bcaae920af878cd29e..da19c20264537991c6b0889c1e3cae43557accdf 100644 (file)
--- a/bin/tests/system/mkeys/tests.sh
+++ b/bin/tests/system/mkeys/tests.sh
@@ -301,7 +301,7 @@ status=`expr $status + $ret`
 echo_i "reinitialize trust anchors, add second key to bind.keys"
 $PERL $SYSTEMTESTTOP/stop.pl --use-rndc --port ${CONTROLPORT} mkeys ns2
 rm -f ns2/managed-keys.bind*
-keyfile_to_initial_keys ns1/$original ns1/$standby1 > ns2/managed.conf
+keyfile_to_initial_ds ns1/$original ns1/$standby1 > ns2/managed.conf
 nextpart ns2/named.run > /dev/null
 $PERL $SYSTEMTESTTOP/start.pl --noclean --restart --port ${PORT} mkeys ns2
 

diff --git a/bin/tests/system/pending/ns1/sign.sh b/bin/tests/system/pending/ns1/sign.sh
index 284eb4f680fc4de43aa80dbee56d7a4fdfef7479..aa6bf6ee3275d00a738301bf5e149189cf459f3c 100644 (file)
--- a/bin/tests/system/pending/ns1/sign.sh
+++ b/bin/tests/system/pending/ns1/sign.sh
@@ -28,7 +28,7 @@ cat $infile $keyname1.key $keyname2.key > $zonefile
 $SIGNER -g -o $zone $zonefile > /dev/null
 
 # Configure the resolving server with a static key.
-keyfile_to_static_keys $keyname2 > trusted.conf
+keyfile_to_static_ds $keyname2 > trusted.conf
 cp trusted.conf ../ns2/trusted.conf
 cp trusted.conf ../ns3/trusted.conf
 cp trusted.conf ../ns4/trusted.conf

diff --git a/bin/tests/system/resolver/ns6/keygen.sh b/bin/tests/system/resolver/ns6/keygen.sh
index a6c5c5b176c75c5024316cce26ccf3b14f6eaf41..34ca7dc01a49d931ff6c169a95882cb63dfd04c4 100644 (file)
--- a/bin/tests/system/resolver/ns6/keygen.sh
+++ b/bin/tests/system/resolver/ns6/keygen.sh
@@ -31,4 +31,4 @@ cat $ksk.key $zsk.key dsset-ds.example.net$TP >> $zonefile
 $SIGNER -P -o $zone $zonefile > /dev/null
 
 # Configure a static key to be used by delv
-keyfile_to_static_keys $ksk > ../ns5/trusted.conf
+keyfile_to_static_ds $ksk > ../ns5/trusted.conf

diff --git a/bin/tests/system/rootkeysentinel/ns1/sign.sh b/bin/tests/system/rootkeysentinel/ns1/sign.sh
index 50eb562763432f27546ed5e457e434543e4b7a2c..cfbed026bae7fc4801ff8a9d583c8a4bd1e287af 100644 (file)
--- a/bin/tests/system/rootkeysentinel/ns1/sign.sh
+++ b/bin/tests/system/rootkeysentinel/ns1/sign.sh
@@ -28,7 +28,7 @@ cat $infile $keyname.key > $zonefile
 $SIGNER -P -g -o $zone $zonefile > /dev/null
 
 # Configure the resolving server with a static key.
-keyfile_to_static_keys $keyname > trusted.conf
+keyfile_to_static_ds $keyname > trusted.conf
 cp trusted.conf ../ns2/trusted.conf
 cp trusted.conf ../ns3/trusted.conf
 cp trusted.conf ../ns4/trusted.conf

diff --git a/bin/tests/system/rsabigexponent/ns1/sign.sh b/bin/tests/system/rsabigexponent/ns1/sign.sh
index 3b8d4adf69faa2cd3915ff8cc8c33a998727400a..cdc61327b855cbd80f0a011c2d4222481cc97228 100755 (executable)
--- a/bin/tests/system/rsabigexponent/ns1/sign.sh
+++ b/bin/tests/system/rsabigexponent/ns1/sign.sh
@@ -25,7 +25,7 @@ cat $infile $keyname.key > $zonefile
 $SIGNER -P -g -o $zone $zonefile > /dev/null
 
 # Configure the resolving server with a static key.
-keyfile_to_static_keys $keyname > trusted.conf
+keyfile_to_static_ds $keyname > trusted.conf
 cp trusted.conf ../ns2/trusted.conf
 cp trusted.conf ../ns3/trusted.conf
 

diff --git a/bin/tests/system/sfcache/ns1/sign.sh b/bin/tests/system/sfcache/ns1/sign.sh
index c1acdce5009aa5a3f1bfc9a25427219770d79ead..7e5b2b3beda35a3a2542535a7296e754e9cdc57a 100644 (file)
--- a/bin/tests/system/sfcache/ns1/sign.sh
+++ b/bin/tests/system/sfcache/ns1/sign.sh
@@ -29,8 +29,8 @@ cat "$infile" "$keyname.key" > "$zonefile"
 $SIGNER -P -g -o $zone $zonefile > /dev/null
 
 # Configure the resolving server with a static key.
-keyfile_to_static_keys "$keyname" > trusted.conf
+keyfile_to_static_ds "$keyname" > trusted.conf
 cp trusted.conf ../ns2/trusted.conf
 
 # ...or with an initializing key.
-keyfile_to_initial_keys "$keyname" > managed.conf
+keyfile_to_initial_ds "$keyname" > managed.conf

diff --git a/bin/tests/system/sfcache/ns5/sign.sh b/bin/tests/system/sfcache/ns5/sign.sh
index c369e545eb7e59f9fe28aaaf67696fab0f70d40d..82b4301804528a8e8798cea0b8c53f566ae42003 100644 (file)
--- a/bin/tests/system/sfcache/ns5/sign.sh
+++ b/bin/tests/system/sfcache/ns5/sign.sh
@@ -16,4 +16,4 @@ set -e
 
 keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone ".")
 
-keyfile_to_static_keys "$keyname" > trusted.conf
+keyfile_to_static_ds "$keyname" > trusted.conf

diff --git a/bin/tests/system/staticstub/ns3/sign.sh b/bin/tests/system/staticstub/ns3/sign.sh
index ce7a0f7d131c93a05160b506a9e3cf332c722a6c..0fe84ff66d656f5fec202da434fa92822a74dc41 100755 (executable)
--- a/bin/tests/system/staticstub/ns3/sign.sh
+++ b/bin/tests/system/staticstub/ns3/sign.sh
@@ -27,7 +27,7 @@ cat $infile $keyname1.key $keyname2.key > $zonefile
 $SIGNER -g -o $zone $zonefile > /dev/null
 
 # Configure the resolving server with a trusted key.
-keyfile_to_static_keys $keyname2 > trusted.conf
+keyfile_to_static_ds $keyname2 > trusted.conf
 
 zone=undelegated
 infile=undelegated.db.in
@@ -38,5 +38,5 @@ cat $infile $keyname1.key $keyname2.key > $zonefile
 
 $SIGNER -g -o $zone $zonefile > /dev/null
 
-keyfile_to_static_keys $keyname2 >> trusted.conf
+keyfile_to_static_ds $keyname2 >> trusted.conf
 cp trusted.conf ../ns2/trusted.conf

diff --git a/bin/tests/system/synthfromdnssec/ns1/sign.sh b/bin/tests/system/synthfromdnssec/ns1/sign.sh
index 710d9f4633b30b9ed72423808d2b1550522ac9e8..b45c577fd45264721846830454f483b2ed5791e1 100644 (file)
--- a/bin/tests/system/synthfromdnssec/ns1/sign.sh
+++ b/bin/tests/system/synthfromdnssec/ns1/sign.sh
@@ -40,4 +40,4 @@ cat "$infile" "$keyname.key" > "$zonefile"
 $SIGNER -P -g -o $zone $zonefile > /dev/null
 
 # Configure the resolving server with a static key.
-keyfile_to_static_keys "$keyname" > trusted.conf
+keyfile_to_static_ds "$keyname" > trusted.conf

diff --git a/bin/tests/system/wildcard/ns1/sign.sh b/bin/tests/system/wildcard/ns1/sign.sh
index b89331ce3e913301cbe2c91f23f994d2f9ce8bc4..497e2759a482fa806e61de9a4da5997d27d1e548 100755 (executable)
--- a/bin/tests/system/wildcard/ns1/sign.sh
+++ b/bin/tests/system/wildcard/ns1/sign.sh
@@ -43,7 +43,7 @@ cat $infile $keyname1.key $keyname2.key > $zonefile
 $SIGNER -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err
 echo_i "signed $zone"
 
-keyfile_to_static_keys $keyname2 > private.nsec.conf
+keyfile_to_static_ds $keyname2 > private.nsec.conf
 
 zone=nsec3
 infile=nsec3.db.in
@@ -72,7 +72,7 @@ cat $infile $keyname1.key $keyname2.key > $zonefile
 $SIGNER -3 - -H 10 -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err
 echo_i "signed $zone"
 
-keyfile_to_static_keys $keyname2 > private.nsec3.conf
+keyfile_to_static_ds $keyname2 > private.nsec3.conf
 
 zone=.
 infile=root.db.in
@@ -87,4 +87,4 @@ cat $infile $keyname1.key $keyname2.key $dssets >$zonefile
 $SIGNER -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err
 echo_i "signed $zone"
 
-keyfile_to_static_keys $keyname2 > trusted.conf
+keyfile_to_static_ds $keyname2 > trusted.conf