Zone signer (#911)

* first cut at NSEC support

* use transactions, fix delegations

* rename to add_nsec_to_zone

* optimize NSEC generation

* split out function to get all secure names (could be useful for NSEC3 later)

* add `Bitmap.from_rdtypes()` and add missing typing

* more typing

* add missing import

* add more typing

* fix tok type

* remove _get_secure_names, optimize

* better zone testing (compare as text)
add test example with delegation below other delegation

* include NSEC itself in the bitmap

* lint

* Add names iteration to transactions via iterate_names().

Also make rdataset iteration more obvious by adding an
explicit iterate_rdatasets() API.

* use iterate_names()

* typo

* black

* use single iteration

* better type fix

* add optional transaction to add_nsec_to_zone

* idea for zone signer

* do not sign RRSIGs

* fix signer

* correctly sign DS

* simplify

* simplify by passing rrset to signer

* fix typing

* nit

* add DS

* add more test

* rewrite zone signer

* compact

* simplify

* make easier to read

* bring back rrset_signer

* move default RRset signer

* more

* more

* prettier context handling (mypy issue pending)

* make NSEC zone signer less complex

* update

* fix txn, sign as defined by SEP

* docs

* add back missing dnskey_include

* rename dnskey_include to add_dnskey

* check KSK/ZSK key tags in signed zone

---------

Co-authored-by: Bob Halley <halley@dnspython.org>

linting + have asyncio HTTP code actually connect to right address

re-run black

More curio cleanups.

Better DNS-over-HTTPS support. (#908)

This change:

Allows resolution hostnames in URLs using dnspython's resolver
or via a bootstrap address, without rewriting URLs.

Adds full support for source addresses and ports to
httpx, except for asyncio I/O where only the source address
can be specified.

Removes support for requests.

Add names iteration to transactions via iterate_names(). (#907)

Also make rdataset iteration more obvious by adding an
explicit iterate_rdatasets() API.

Update wheel requirement from ^0.38.1 to ^0.40.0 (#910)

Updates the requirements on [wheel](https://github.com/pypa/wheel) to permit the latest version.
- [Release notes](https://github.com/pypa/wheel/releases)
- [Changelog](https://github.com/pypa/wheel/blob/main/docs/news.rst)
- [Commits](https://github.com/pypa/wheel/compare/0.38.1...0.40.0)

---
updated-dependencies:
- dependency-name: wheel
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

remove a curio reference that missed the first pass

Remove curio support.

lint

add Bitmap.from_rdtypes() (#906)

* add `Bitmap.from_rdtypes()` and add missing typing

* more typing

* add missing import

* add more typing

* fix tok type

Add dns.resolver.resolve_name(). (#903)

* Add dns.resolver.resolve_name().

* Add missing type annotations.

* Add async resolve_name().

* Replace List[Answer] with HostAnswers.

* Switch addresses_and_families() tuple order

* Fix comment.

Remove the DSA signature test, as it can fail in certain
OpenSSL 3 with the FIPS 140-3 module, as the module will not
generate keys with a "q" size that is representable in DNSSEC.

Fix hangs when QUIC connection fails [#899]. (#900)

This also fixes problems with computing the wait_for() timeout for
the sync and asyncio ports, and fixes delivery of the timeout for
the sync port.

Make a few nameserver changes that missed getting added to the PR.

Resolver "nameserver" object support. (#897)

* Resolver "nameserver" object support.

This turns the list of nameserver strings in the resolver into a tuple
of nameserver objects, which abstract away making queries to a
nameserver of a given type.

The resolver's legacy nameserver list is "enriched" into a tuple of
nameserver objects whenever it is set.  Note that you cannot mutate
the object other than by setting,
e.g. res.nameservers.append("1.2.3.4") will not work.

Error message accumulation has been updated to refer to the
nameservers using a descriptive text form.

* doco fix

* more doco fixes

* do enrichment at Resolution time

* require a later mypy, fix type issues

* add nameserver doc

Fix typos.

Add dns.quic to setup.cfg for legacy setup.py installs [#896]

Bump sphinx-rtd-theme from 1.1.1 to 1.2.0 (#894)

Bumps [sphinx-rtd-theme](https://github.com/readthedocs/sphinx_rtd_theme) from 1.1.1 to 1.2.0.
- [Release notes](https://github.com/readthedocs/sphinx_rtd_theme/releases)
- [Changelog](https://github.com/readthedocs/sphinx_rtd_theme/blob/master/docs/changelog.rst)
- [Commits](https://github.com/readthedocs/sphinx_rtd_theme/compare/1.1.1...1.2.0)

---
updated-dependencies:
- dependency-name: sphinx-rtd-theme
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

add more minor typehints (#889)

Update black requirement from ^22.1.0 to ^23.1.0 (#892)

Updates the requirements on [black](https://github.com/psf/black) to permit the latest version.
- [Release notes](https://github.com/psf/black/releases)
- [Changelog](https://github.com/psf/black/blob/main/CHANGES.md)
- [Commits](https://github.com/psf/black/compare/22.1.0...23.1.0)

---
updated-dependencies:
- dependency-name: black
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bump readthedocs-sphinx-search from 0.1.2 to 0.2.0 (#891)

Bumps [readthedocs-sphinx-search](https://github.com/readthedocs/readthedocs-sphinx-search) from 0.1.2 to 0.2.0.
- [Release notes](https://github.com/readthedocs/readthedocs-sphinx-search/releases)
- [Changelog](https://github.com/readthedocs/readthedocs-sphinx-search/blob/main/CHANGELOG.rst)
- [Commits](https://github.com/readthedocs/readthedocs-sphinx-search/commits)

---
updated-dependencies:
- dependency-name: readthedocs-sphinx-search
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

The DS digest_type field is now made a DSDigest instance by the constructor (#890)

Hey @rthalley

I found another place in the code there, you may have gotten "distracted" 😉 as you phrased it in
https://github.com/rthalley/dnspython/issues/888#issuecomment-1402198449

So, I just made a pull request this time

The DNSKEY flags field is now made a Flag instance by the constructor.

More doco updates for 2.4

Add missing quic files to setup.py cythonize [#887].

Add deprecation note about the Resolver nameserver attribute.

Make Coverity happier [#882].

Use 'https' instead of 'http' for dnspython.org (#883)

These days, 'https' should be used instead of 'http' for almost
anything, and Coverity is warning that dnspython.org URL in 'setup.cfg'
uses 'http'.

This patch changes the use of 'http' to 'https' on setup.cfg and
documentation, where it does not affect module code, tests or examples.

remove obsolete lgtm link

Remove obsolete comment (#873)

Update cryptography requirement from >=2.6,<39.0 to >=2.6,<40.0 (#878)

Updates the requirements on [cryptography](https://github.com/pyca/cryptography) to permit the latest version.
- [Release notes](https://github.com/pyca/cryptography/releases)
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](https://github.com/pyca/cryptography/compare/2.6...39.0.0)

---
updated-dependencies:
- dependency-name: cryptography
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Update SECURITY.md to 2.3.x

Update versions and CI post 2.3 branch.

update whatsnew

lint

DNSSEC doco fixes.

CDS/CDNSKEY utilities (#872)

Add CDS and CDNSKEY utilities:

make_cdnskey()
make_cds()
make_ds_rdataset()
cds_rdataset_to_ds_rdataset()
dnskey_rdataset_to_cds_rdataset()
dnskey_rdataset_to_cdnskey_rdataset()

Update pocov Makefile rule for coverage 7.0.0.

Update coverage requirement from ^6.0 to ^7.0 (#874)

Updates the requirements on [coverage](https://github.com/nedbat/coveragepy) to permit the latest version.
- [Release notes](https://github.com/nedbat/coveragepy/releases)
- [Changelog](https://github.com/nedbat/coveragepy/blob/master/CHANGES.rst)
- [Commits](https://github.com/nedbat/coveragepy/compare/6.0...7.0.0)

---
updated-dependencies:
- dependency-name: coverage
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Fix async quic() doco.

Properly pass source and source_port to connect() in the sync version of quic().

Fix misc. lint.

Remove unsupported python case (#871)

DNSSEC policy. (#869)

add DNSSEC sign() to whatsnew

add sign and make_dnskey functions (#868)

Improve DNSSEC _doco, minor DNSSEC and typing tweaks.

DNSSEC signer (#866)

* first cut at key_to_dnskey

* update docs

* typo

* use real test vectors for DNSKEY

* comment

* split

* add test for large exponent size

* rename to make_dnskey

* no default algorithm

* rename and add comment

* split out function to create rrsig signature data

* docs

* add type for public key

* more typing

* make RSA exponent key test easier to read

* work in progress for dns.dnssec.sign

* better docs

* docs

* simplify

* add test with RSASHA1

* initial support for DSA

* update docs

* clean up DSA, t still not clear

* allow inception/expiration to be specified as datetime, string, float or in

* allow rrset to be specified as a tuple

* calculate dsa_t

* reformat

* more rrset tuple fixes

* support DSA

* improve exception handling

* fix return type error

* fix typing issue to silence mypy

* make test case more verbose

* ensure UTC and use sigtime_to_posixtime to convert text to timestamp

Add NSEC3 RFC to doco.

Add more DNSSEC RFCs.

One more RFC text tweak.

More RFC updates.

More whatsnew updates.

Merge pull request #863 from rbrins/master

changed docs dns.resolver.Answer response to QueryMessage

changed docs dns.resolver.Answer response to QueryMessage

Basic SVCB and HTTPS doco.

Add some more RFCs.

Improve AMTRELAY doco.

Add doco for AMTRELAY, L32, L64, LP, and NID.

Make generate-rdatatype-doc.py work properly again.

Test on 3.10 still for windows as aioquic does not build without openssl source.

DoQ packing and testing tweaks

Fix type lint from latest mypy.

Merge pull request #842 from rthalley/quic

Initial DoQ support.

Merge pull request #858 from rthalley/dependabot/pip/sphinx-rtd-theme-1.1.1

Bump sphinx-rtd-theme from 1.1.0 to 1.1.1

Bump sphinx-rtd-theme from 1.1.0 to 1.1.1

Bumps [sphinx-rtd-theme](https://github.com/readthedocs/sphinx_rtd_theme) from 1.1.0 to 1.1.1.
- [Release notes](https://github.com/readthedocs/sphinx_rtd_theme/releases)
- [Changelog](https://github.com/readthedocs/sphinx_rtd_theme/blob/master/docs/changelog.rst)
- [Commits](https://github.com/readthedocs/sphinx_rtd_theme/compare/1.1.0...1.1.1)

---
updated-dependencies:
- dependency-name: sphinx-rtd-theme
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

Merge pull request #856 from GlennChia/docs/fix-typo-examples

docs: programs typo

docs: programs typo

Merge pull request #852 from rthalley/dependabot/pip/sphinx-rtd-theme-1.1.0

Bump sphinx-rtd-theme from 1.0.0 to 1.1.0

Merge pull request #855 from rthalley/dependabot/pip/wheel-tw-0.38.1

Update wheel requirement from ^0.37.1 to ^0.38.1

Merge pull request #853 from jameshilliard/no-wheel

Remove spurious wheel build dependency

Update wheel requirement from ^0.37.1 to ^0.38.1

Updates the requirements on [wheel](https://github.com/pypa/wheel) to permit the latest version.
- [Release notes](https://github.com/pypa/wheel/releases)
- [Changelog](https://github.com/pypa/wheel/blob/main/docs/news.rst)
- [Commits](https://github.com/pypa/wheel/compare/0.37.1...0.38.1)

---
updated-dependencies:
- dependency-name: wheel
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>

Remove spurious wheel build dependency

Wheel isn't a build dependency so it shouldn't be in setup_requires.

Bump sphinx-rtd-theme from 1.0.0 to 1.1.0

Bumps [sphinx-rtd-theme](https://github.com/readthedocs/sphinx_rtd_theme) from 1.0.0 to 1.1.0.
- [Release notes](https://github.com/readthedocs/sphinx_rtd_theme/releases)
- [Changelog](https://github.com/readthedocs/sphinx_rtd_theme/blob/master/docs/changelog.rst)
- [Commits](https://github.com/readthedocs/sphinx_rtd_theme/compare/1.0.0...1.1.0)

---
updated-dependencies:
- dependency-name: sphinx-rtd-theme
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

update to dev version

Merge pull request #849 from eaglegai/master

fix missing version in setup.cfg

fix missing version in setup.cfg

Signed-off-by: eaglegai <eaglegai@163.com>

For async send_udp(), return a length and clarify the expiration
is meaningless.

For async receive_udp(), document that the return type is always a
3-tuple, as opposed to being either a pair or a 3-tuple as in the
sync version.  (I chose to document rather than change the behavior
as changing it broke dnspython tests and might possibly break other
code.)  [#848]

fix doco typo

temporarily add aioquic

add missing skip marks

Initial DoQ support.

Merge pull request #845 from rthalley/asyncio-timeout-fix

Asyncio sockets should work after a timeout [#843].

Merge pull request #846 from rthalley/dependabot/pip/requests-toolbelt-gte-0.9.1-and-lt-0.11.0

Update requests-toolbelt requirement from ^0.9.1 to >=0.9.1,<0.11.0

Update requests-toolbelt requirement from ^0.9.1 to >=0.9.1,<0.11.0

Updates the requirements on [requests-toolbelt](https://github.com/requests/toolbelt) to permit the latest version.
- [Release notes](https://github.com/requests/toolbelt/releases)
- [Changelog](https://github.com/requests/toolbelt/blob/master/HISTORY.rst)
- [Commits](https://github.com/requests/toolbelt/compare/0.9.1...0.10.0)

---
updated-dependencies:
- dependency-name: requests-toolbelt
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>

Asyncio sockets should work after a timeout [#843].

Deal with leading dots in search lists on Windows [#844].

more lint

try again to fix CodeQL

lint

try to fix codeql

Merge pull request #841 from rthalley/dependabot/pip/pytest-cov-tw-4.0.0

Update pytest-cov requirement from ^3.0.0 to ^4.0.0

Update pytest-cov requirement from ^3.0.0 to ^4.0.0

Updates the requirements on [pytest-cov](https://github.com/pytest-dev/pytest-cov) to permit the latest version.
- [Release notes](https://github.com/pytest-dev/pytest-cov/releases)
- [Changelog](https://github.com/pytest-dev/pytest-cov/blob/master/CHANGELOG.rst)
- [Commits](https://github.com/pytest-dev/pytest-cov/compare/v3.0.0...v4.0.0)

---
updated-dependencies:
- dependency-name: pytest-cov
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>

Merge pull request #840 from rthalley/dependabot/pip/trio-gte-0.14-and-lt-0.23

Update trio requirement from >=0.14,<0.22 to >=0.14,<0.23

Update trio requirement from >=0.14,<0.22 to >=0.14,<0.23

Updates the requirements on [trio](https://github.com/python-trio/trio) to permit the latest version.
- [Release notes](https://github.com/python-trio/trio/releases)
- [Commits](https://github.com/python-trio/trio/compare/v0.14.0...v0.22.0)

---
updated-dependencies:
- dependency-name: trio
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>

Merge pull request #837 from rthalley/dependabot/pip/cryptography-gte-2.6-and-lt-39.0

Update cryptography requirement from >=2.6,<38.0 to >=2.6,<39.0

Update cryptography requirement from >=2.6,<38.0 to >=2.6,<39.0

Updates the requirements on [cryptography](https://github.com/pyca/cryptography) to permit the latest version.
- [Release notes](https://github.com/pyca/cryptography/releases)
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](https://github.com/pyca/cryptography/compare/2.6...38.0.1)

---
updated-dependencies:
- dependency-name: cryptography
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>

Merge pull request #836 from rthalley/dependabot/pip/wheel-tw-0.37.1

Update wheel requirement from ^0.35.0 to ^0.37.1

Update wheel requirement from ^0.35.0 to ^0.37.1

Updates the requirements on [wheel](https://github.com/pypa/wheel) to permit the latest version.
- [Release notes](https://github.com/pypa/wheel/releases)
- [Changelog](https://github.com/pypa/wheel/blob/main/docs/news.rst)
- [Commits](https://github.com/pypa/wheel/compare/0.35.0...0.37.1)

---
updated-dependencies:
- dependency-name: wheel
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>