From: Matthijs Mekking <matthijs@isc.org>
Date: Thu, 2 Apr 2026 08:54:53 +0000 (+0200)
Subject: Also fix off by one error in system test
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=d9b6036e0f3b6a407e0035edbe6da613660219f4;p=thirdparty%2Fbind9.git

Also fix off by one error in system test

The system test was also subject to the same off by one bug that also
existed in the code. That is: if the inception time of the signature
is exactly equal to the inactive time of the key, we still have to
expect the signature.
---

diff --git a/bin/tests/system/ksr/tests_ksr.py b/bin/tests/system/ksr/tests_ksr.py
index 0d71fdae9c8..75d36f94cdf 100644
--- a/bin/tests/system/ksr/tests_ksr.py
+++ b/bin/tests/system/ksr/tests_ksr.py
@@ -338,7 +338,7 @@ def check_keysigningrequest(path, zsks, start, end):
     line_no = 0
 
     inception = start
-    while inception < end:
+    while inception <= end:
         next_bundle = end + 1
         # expect bundle header
         assert f";; KeySigningRequest 1.0 {inception}" in lines[line_no]
@@ -402,7 +402,7 @@ def check_signedkeyresponse(
     dnskey_ttl = int(config["dnskey-ttl"].total_seconds())
 
     inception = start
-    while inception < end:
+    while inception <= end:
         # A single signed key response may consist of:
         # ;; SignedKeyResponse (header)
         # ;; DNSKEY 257 (one per published key in ksks)
@@ -487,7 +487,7 @@ def check_signedkeyresponse(
             inactive = key.get_timing("Inactive", must_exist=False)
             if active > inception:
                 continue
-            if inactive is not None and inception >= inactive:
+            if inactive is not None and inception > inactive:
                 continue
 
             # collect keys that should be in this bundle
@@ -537,7 +537,7 @@ def check_signedkeyresponse(
                 inactive = key.get_timing("Inactive", must_exist=False)
                 if active > inception:
                     continue
-                if inactive is not None and inception >= inactive:
+                if inactive is not None and inception > inactive:
                     continue
 
                 # collect keys that should be in this bundle
@@ -595,7 +595,7 @@ def check_signedkeyresponse(
                 inactive = key.get_timing("Inactive", must_exist=False)
                 if active > inception:
                     continue
-                if inactive is not None and inception >= inactive:
+                if inactive is not None and inception > inactive:
                     continue
 
                 # collect keys that should be in this bundle