From: Matthijs Mekking <matthijs@isc.org>
Date: Tue, 9 Feb 2021 13:42:05 +0000 (+0100)
Subject: Add changes and notes for [#2408]
X-Git-Tag: v9.17.11~35^2
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=5a99a124fb61cd56fb0f199a07524dd84312d8ff;p=thirdparty%2Fbind9.git

Add changes and notes for [#2408]
---

diff --git a/CHANGES b/CHANGES
index 28aef3bef53..89f9500843a 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,7 @@
+5588.	[func]		Add "purge-keys" option to "dnssec-policy". This sets
+			the time how long key files should be retained after
+			they have become obsolete. [GL #2408]
+
 5587.	[bug]		A standalone libtool script no longer needs to be
 			present in PATH in order to build BIND 9 from a source
 			tarball prepared using "make dist". [GL #2504]
diff --git a/doc/notes/notes-current.rst b/doc/notes/notes-current.rst
index 508fbb02260..c08c6f6954b 100644
--- a/doc/notes/notes-current.rst
+++ b/doc/notes/notes-current.rst
@@ -26,6 +26,11 @@ New Features
 
 - None.
 
+- A new option, ``purge-keys``, has been added to ``dnssec-policy``. It sets
+  the time how long key files should be retained after they have become
+  obsolete (due to a key rollover). Default is 90 days, and the feature can
+  be disabled by setting it to 0. [GL #2408]
+
 Removed Features
 ~~~~~~~~~~~~~~~~