From: Nicki Křížek <nicki@isc.org>
Date: Tue, 9 Jun 2026 08:34:32 +0000 (+0200)
Subject: chg: test: Add mixed DS test to dnssec_py
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=c866bd5baa6ef03f3c2262998053360f17f02f85;p=thirdparty%2Fbind9.git

chg: test: Add mixed DS test to dnssec_py

Rewrite dnssec_unsupported_ds/tests_mixed_ds.py as
dnssec_py/tests_mixed_ds.py using the isctest.zone helpers for zone
setup.

The test verifies that a zone whose DS RRset contains only an
unsupported algorithm DS and a bogus DS record is treated as insecure
by a validating resolver, resulting in SERVFAIL for queries to that
zone. The DS set for child.mixed-ds. is deliberately corrupted after
signing to contain a DS record with an unsupported algorithm (12) and
a DS record with an invalid digest, exercising the mixed-DS insecurity
proof path.

Assisted-by: Claude:claude-opus-4-8

Merge branch 'nicki/pytest-dnssec-py-mixed-ds' into 'main'

See merge request isc-projects/bind9!12206
---

c866bd5baa6ef03f3c2262998053360f17f02f85