Merge tag 'v9_17_4' into main

BIND 9.17.4

diff --cc CHANGES
index 36a9eae78a64189edb112f0242bdaf93aef96f42,fa60aa5516ad7766863d1e18427780806603fcd4..103a360cc5e80a6cb1c312bfd1e47ea9e04fe576
--- 1/CHANGES
--- 2/CHANGES
+++ b/CHANGES
@@@ -1,29 -1,9 +1,31 @@@
 +5490. [func]          Refactor the readline support to use pkg-config and
 +                      add support for editline library. [GL !3942]
 +
 +5489. [bug]           Named failed to reject some invalid records resulting
 +                      in records that, after being printed, could not be
 +                      loaded or would result in DNSSEC validation failures
 +                      when re-read from zone files as the wire format
 +                      differed.  The covered records records are: CERT,
 +                      IPSECKEY, NSEC3, NSEC3PARAM, NXT, SIG, TLSA, WKS, and
 +                      X25. [GL !3953]
 +
 +5488. [bug]           nta needed to have a weak reference on view to prevent
 +                      the view being deleted while nta tests are being
 +                      performed. [GL #2067]
 +
 +5487. [cleanup]       Update managed keys log messages to be less confusing.
 +                      [GL #2027]
 +
 +5486. [func]          Add 'rndc dnssec -checkds' command to tell named
 +                      that the DS record has been published in the parent.
 +                      [GL #1613]
 +
+       --- 9.17.4 released ---
+ 
  5485. [placeholder]
  
- 5484. [func]          Expire the 0 TTL RRSet quickly rather using them for
-                       stale answers. [GL #1829]
+ 5484. [func]          Expire zero TTL records quickly rather than using them
+                       for stale answers. [GL #1829]
  
  5483. [func]          Keeping "stale" answers in cache has been disabled by
                        default and can be re-enabled with a new configuration

diff --cc bin/tests/system/run.sh.in
Simple merge

diff --cc configure.ac
Simple merge

diff --cc doc/arm/notes.rst
index 16a8227d75870f16501146f37d9ae61d9eb18378,334d021820429d23e1c3195604f559e5aaa20df1..681624f3f9ac61a0e00e3b08598a3d914631ed21
--- 1/doc/arm/notes.rst
--- 2/doc/arm/notes.rst
+++ b/doc/arm/notes.rst
@@@ -52,7 -52,7 +52,8 @@@ https://www.isc.org/download/. There yo
  information about each release, source code, and pre-compiled versions
  for Microsoft Windows operating systems.
  
 +.. include:: ../notes/notes-current.rst
+ .. include:: ../notes/notes-9.17.4.rst
  .. include:: ../notes/notes-9.17.3.rst
  .. include:: ../notes/notes-9.17.2.rst
  .. include:: ../notes/notes-9.17.1.rst

diff --cc doc/notes/notes-current.rst
index bb2edc12783c33495aba0d5cf257f0a798504ed5,0000000000000000000000000000000000000000..3c367f9cdef5638cfc2f52d1de0c70456648f2df
mode 100644,000000..100644
--- 1/doc/notes/notes-current.rst
--- /dev/null
+++ b/doc/notes/notes-current.rst
@@@ -1,84 -1,0 +1,40 @@@
- Notes for BIND 9.17.4
 +.. 
 +   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 +   
 +   This Source Code Form is subject to the terms of the Mozilla Public
 +   License, v. 2.0. If a copy of the MPL was not distributed with this
 +   file, You can obtain one at http://mozilla.org/MPL/2.0/.
 +   
 +   See the COPYRIGHT file distributed with this work for additional
 +   information regarding copyright ownership.
 +
- - ``rndc`` has been updated to use the new BIND network manager API.
-   This change had the side effect of altering the TCP timeout for RNDC
-   connections from 60 seconds to the ``tcp-idle-timeout`` value, which
-   defaults to 30 seconds. Also, because the network manager currently
-   has no support for UNIX-domain sockets, those cannot now be used
-   with ``rndc``. This will be addressed in a future release, either by
-   restoring UNIX-domain socket support or by formally declaring them
-   to be obsolete in the control channel. [GL #1759]
- 
- - Statistics channels have also been updated to use the new BIND network
-   manager API. [GL #2022]
- 
- - A new configuration option ``stale-cache-enable`` has been introduced to
-   enable or disable the keeping of stale answers in cache. [GL #1712]
- 
++Notes for BIND 9.17.5
 +---------------------
 +
 +Security Fixes
 +~~~~~~~~~~~~~~
 +
 +- None.
 +
 +Known Issues
 +~~~~~~~~~~~~
 +
 +- None.
 +
 +New Features
 +~~~~~~~~~~~~
 +
 +- New ``rndc`` command ``rndc dnssec -checkds`` to tell ``named``
 +  that a DS record for a given zone or key has been published or withdrawn
 +  from the parent. Replaces the time-based ``parent-registration-delay``
 +  configuration option. [GL #1613]
 +
- - BIND's cache database implementation has been updated to use a faster
-   hash-function with better distribution.  In addition, the effective
-   max-cache-size (configured explicitly, defaulting to a value based on system
-   memory or set to 'unlimited') now pre-allocates fixed size hash tables. This
-   prevents interruption to query resolution when the hash tables need to be
-   increased in size. [GL #1775]
- 
- - Keeping stale answers in cache has been disabled by default.
- 
- - The resource records received with 0 TTL are no longer kept in the cache
-   to be used for stale answers. [GL #1829]
 +Feature Changes
 +~~~~~~~~~~~~~~~
 +
- - Addressed an error in recursive clients stats reporting.
-   There were occasions when an incoming query could trigger a prefetch for
-   some eligible rrset, and if the prefetch code were executed before recursion,
-   no increment in recursive clients stats would take place. Conversely,
-   when processing the answers, if the recursion code were executed before the
-   prefetch, the same counter would be decremented without a matching increment.
-   [GL #1719]
- 
- - The introduction of KASP support broke whether the second field
-   of sig-validity-interval was treated as days or hours. (Thanks to
-   Tony Finch.) [GL !3735]
- 
- - The IPv6 Duplicate Address Detection (DAD) mechanism could cause the operating
-   system to report the new IPv6 addresses to the applications via the
-   getifaddrs() API in a tentative (DAD not yet finished) or duplicate (DAD
-   failed) state. Such addresses cannot be bound by an application, and named
-   failed to listen on IPv6 addresses after the DAD mechanism finished. It is
-   possible to work around the issue by setting the IP_FREEBIND option on the
-   socket and trying to bind() to the IPv6 address again if the first bind() call
-   fails with EADDRNOTAVAIL. [GL #2038]
++- None.
 +
 +Bug Fixes
 +~~~~~~~~~
 +
++- None.

diff --cc util/copyrights
Simple merge