From: Matthijs Mekking <matthijs@isc.org>
Date: Fri, 5 Dec 2025 12:07:39 +0000 (+0000)
Subject: fix: usr: Make key rollovers more robust
X-Git-Tag: v9.21.17~60
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=42b0046d1e2625d7b3d00bc9c59533165bb8b5b8;p=thirdparty%2Fbind9.git

fix: usr: Make key rollovers more robust

A manual rollover when the zone is in an invalid DNSSEC state causes predecessor keys to be removed too quickly. Additional safeguards to prevent this have been added. DNSSEC records will not be removed from the zone until the underlying state machine has moved back into a valid DNSSEC state.

Closes #5458

Merge branch '5458-safeguard-against-key-rollovers-when-in-invalid-state' into 'main'

See merge request isc-projects/bind9!10813
---

42b0046d1e2625d7b3d00bc9c59533165bb8b5b8