From: Matthijs Mekking <matthijs@isc.org>
Date: Thu, 2 Apr 2026 08:54:53 +0000 (+0200)
Subject: Also fix off by one error in system test
X-Git-Tag: v9.20.23~50^2
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=eed010c3a54e057d57d4f7413051d16269f3275e;p=thirdparty%2Fbind9.git

Also fix off by one error in system test

The system test was also subject to the same off by one bug that also
existed in the code. That is: if the inception time of the signature
is exactly equal to the inactive time of the key, we still have to
expect the signature.

(cherry picked from commit d9b6036e0f3b6a407e0035edbe6da613660219f4)
---

diff --git a/bin/tests/system/ksr/tests_ksr.py b/bin/tests/system/ksr/tests_ksr.py
index b9e7972fd43..206bf2fba29 100644
--- a/bin/tests/system/ksr/tests_ksr.py
+++ b/bin/tests/system/ksr/tests_ksr.py
@@ -338,7 +338,7 @@ def check_keysigningrequest(path, zsks, start, end):
     line_no = 0
 
     inception = start
-    while inception < end:
+    while inception <= end:
         next_bundle = end + 1
         # expect bundle header
         assert f";; KeySigningRequest 1.0 {inception}" in lines[line_no]
@@ -402,7 +402,7 @@ def check_signedkeyresponse(
     dnskey_ttl = int(config["dnskey-ttl"].total_seconds())
 
     inception = start
-    while inception < end:
+    while inception <= end:
         # A single signed key response may consist of:
         # ;; SignedKeyResponse (header)
         # ;; DNSKEY 257 (one per published key in ksks)
@@ -487,7 +487,7 @@ def check_signedkeyresponse(
             inactive = key.get_timing("Inactive", must_exist=False)
             if active > inception:
                 continue
-            if inactive is not None and inception >= inactive:
+            if inactive is not None and inception > inactive:
                 continue
 
             # collect keys that should be in this bundle
@@ -537,7 +537,7 @@ def check_signedkeyresponse(
                 inactive = key.get_timing("Inactive", must_exist=False)
                 if active > inception:
                     continue
-                if inactive is not None and inception >= inactive:
+                if inactive is not None and inception > inactive:
                     continue
 
                 # collect keys that should be in this bundle
@@ -595,7 +595,7 @@ def check_signedkeyresponse(
                 inactive = key.get_timing("Inactive", must_exist=False)
                 if active > inception:
                     continue
-                if inactive is not None and inception >= inactive:
+                if inactive is not None and inception > inactive:
                     continue
 
                 # collect keys that should be in this bundle