From d0375933dd0805e77ebe53765c51c8c8afa4a29e Mon Sep 17 00:00:00 2001
From: =?utf8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <vladimir.cunat@nic.cz>
Date: Fri, 24 Oct 2025 17:18:07 +0200
Subject: [PATCH] treewide: centralize inclusion of libdnssec headers

---
 daemon/ratelimiting.test/tests.inc.c | 3 +--
 daemon/zimport.c                     | 2 --
 lib/cache/impl.h                     | 3 +--
 lib/dnssec.c                         | 5 -----
 lib/dnssec.h                         | 4 ++++
 lib/dnssec/nsec.c                    | 3 +--
 lib/dnssec/nsec3.c                   | 4 +---
 lib/dnssec/nsec3.h                   | 2 +-
 lib/dnssec/signature.c               | 4 +---
 lib/dnssec/signature.h               | 2 +-
 lib/dnssec/ta.c                      | 2 --
 lib/kru.inc.c                        | 6 ++++--
 lib/layer/validate.c                 | 2 --
 13 files changed, 15 insertions(+), 27 deletions(-)

diff --git a/daemon/ratelimiting.test/tests.inc.c b/daemon/ratelimiting.test/tests.inc.c
index 1434ee47a..e1854cb38 100644
--- a/daemon/ratelimiting.test/tests.inc.c
+++ b/daemon/ratelimiting.test/tests.inc.c
@@ -20,8 +20,7 @@
 #include <stdatomic.h>
 
 #include "tests/unit/test.h"
-#include "libdnssec/crypto.h"
-#include "libdnssec/random.h"
+#include "lib/dnssec.h"
 #include "libknot/libknot.h"
 #include "contrib/openbsd/siphash.h"
 #include "lib/resolve.h"
diff --git a/daemon/zimport.c b/daemon/zimport.c
index 2f546354b..99ec1f914 100644
--- a/daemon/zimport.c
+++ b/daemon/zimport.c
@@ -32,8 +32,6 @@
 #include <libknot/rrset.h>
 #include <libzscanner/scanner.h>
 
-#include <libdnssec/digest.h>
-
 #include "daemon/worker.h"
 #include "lib/dnssec/ta.h"
 #include "lib/dnssec.h"
diff --git a/lib/cache/impl.h b/lib/cache/impl.h
index c585ef6a4..bafaecf59 100644
--- a/lib/cache/impl.h
+++ b/lib/cache/impl.h
@@ -11,8 +11,7 @@
 #include <stdbool.h>
 #include <stdint.h>
 
-#include <libdnssec/error.h>
-#include <libdnssec/nsec.h>
+#include "lib/dnssec.h"
 #include <libknot/consts.h>
 #include <libknot/db/db.h>
 #include <libknot/dname.h>
diff --git a/lib/dnssec.c b/lib/dnssec.c
index 169ce2bf7..67e91fd11 100644
--- a/lib/dnssec.c
+++ b/lib/dnssec.c
@@ -2,11 +2,6 @@
  *  SPDX-License-Identifier: GPL-3.0-or-later
  */
 
-#include <libdnssec/binary.h>
-#include <libdnssec/crypto.h>
-#include <libdnssec/error.h>
-#include <libdnssec/key.h>
-#include <libdnssec/sign.h>
 #include <libknot/descriptor.h>
 #include <libknot/packet/wire.h>
 #include <libknot/rdataset.h>
diff --git a/lib/dnssec.h b/lib/dnssec.h
index b9f854d06..8bafaa9ce 100644
--- a/lib/dnssec.h
+++ b/lib/dnssec.h
@@ -8,6 +8,10 @@
 #include "lib/utils.h"
 #include <libknot/packet/pkt.h>
 
+// This is the central place in Knot Resolver which includes the (former) libdnssec.
+#include <libdnssec/dnssec.h>
+#include <libdnssec/digest.h>
+
 /**
  * Initialise cryptographic back-end.
  */
diff --git a/lib/dnssec/nsec.c b/lib/dnssec/nsec.c
index 07672cc8c..0f1c11f7f 100644
--- a/lib/dnssec/nsec.c
+++ b/lib/dnssec/nsec.c
@@ -10,10 +10,9 @@
 #include <libknot/rrset.h>
 #include <libknot/rrtype/nsec.h>
 #include <libknot/rrtype/rrsig.h>
-#include <libdnssec/error.h>
-#include <libdnssec/nsec.h>
 
 #include "lib/defines.h"
+#include "lib/dnssec.h"
 #include "lib/dnssec/nsec.h"
 #include "lib/utils.h"
 #include "lib/resolve.h"
diff --git a/lib/dnssec/nsec3.c b/lib/dnssec/nsec3.c
index 7db93dc58..2e9363d10 100644
--- a/lib/dnssec/nsec3.c
+++ b/lib/dnssec/nsec3.c
@@ -4,15 +4,13 @@
 
 #include <string.h>
 
-#include <libdnssec/binary.h>
-#include <libdnssec/error.h>
-#include <libdnssec/nsec.h>
 #include <libknot/descriptor.h>
 #include <contrib/base32hex.h>
 #include <libknot/rrset.h>
 #include <libknot/rrtype/nsec3.h>
 
 #include "lib/defines.h"
+#include "lib/dnssec.h"
 #include "lib/dnssec/nsec.h"
 #include "lib/dnssec/nsec3.h"
 #include "lib/utils.h"
diff --git a/lib/dnssec/nsec3.h b/lib/dnssec/nsec3.h
index 1a3a6d60b..3ecac8bc4 100644
--- a/lib/dnssec/nsec3.h
+++ b/lib/dnssec/nsec3.h
@@ -6,7 +6,7 @@
 
 #include <libknot/packet/pkt.h>
 #include <libknot/rrtype/nsec3.h>
-#include <libdnssec/nsec.h>
+#include "lib/dnssec.h"
 
 
 static inline unsigned int kr_nsec3_price(unsigned int iterations, unsigned int salt_len)
diff --git a/lib/dnssec/signature.c b/lib/dnssec/signature.c
index 6e443cf95..b2ef2d550 100644
--- a/lib/dnssec/signature.c
+++ b/lib/dnssec/signature.c
@@ -5,9 +5,6 @@
 #include <arpa/inet.h>
 #include <string.h>
 
-#include <libdnssec/error.h>
-#include <libdnssec/key.h>
-#include <libdnssec/sign.h>
 #include <libknot/descriptor.h>
 #include <libknot/packet/rrset-wire.h>
 #include <libknot/packet/wire.h>
@@ -18,6 +15,7 @@
 
 #include "lib/defines.h"
 #include "lib/utils.h"
+#include "lib/dnssec.h"
 #include "lib/dnssec/signature.h"
 
 static int authenticate_ds(const dnssec_key_t *key, dnssec_binary_t *ds_rdata, uint8_t digest_type)
diff --git a/lib/dnssec/signature.h b/lib/dnssec/signature.h
index 1cc6c8f61..4d193efbf 100644
--- a/lib/dnssec/signature.h
+++ b/lib/dnssec/signature.h
@@ -4,7 +4,7 @@
 
 #pragma once
 
-#include <libdnssec/key.h>
+#include "lib/dnssec.h"
 #include <libknot/rrset.h>
 
 /**
diff --git a/lib/dnssec/ta.c b/lib/dnssec/ta.c
index 6593b2f32..af53e2ed9 100644
--- a/lib/dnssec/ta.c
+++ b/lib/dnssec/ta.c
@@ -7,8 +7,6 @@
 #include <libknot/rdataset.h>
 #include <libknot/rrset.h>
 #include <libknot/packet/wire.h>
-#include <libdnssec/key.h>
-#include <libdnssec/error.h>
 
 #include "lib/defines.h"
 #include "lib/dnssec.h"
diff --git a/lib/kru.inc.c b/lib/kru.inc.c
index cf23516b5..6526c6305 100644
--- a/lib/kru.inc.c
+++ b/lib/kru.inc.c
@@ -50,8 +50,10 @@ Size (`loads_bits` = log2 length):
 
 #include "./kru.h"
 #include "contrib/ucw/lib.h"
-#include "libdnssec/error.h"
-#include "libdnssec/random.h"
+
+// We only need the original libdnssec here, but...
+#include "lib/dnssec.h"
+
 #if USE_AES
 	/// 4-8 rounds should be an OK choice, most likely.
 	#define AES_ROUNDS 4
diff --git a/lib/layer/validate.c b/lib/layer/validate.c
index 549d99a82..0d4f4462a 100644
--- a/lib/layer/validate.c
+++ b/lib/layer/validate.c
@@ -11,8 +11,6 @@
 #include <libknot/packet/wire.h>
 #include <libknot/rrtype/rdname.h>
 #include <libknot/rrtype/rrsig.h>
-#include <libdnssec/error.h>
-#include <libdnssec/key.h>
 
 #include "lib/dnssec/nsec.h"
 #include "lib/dnssec/nsec3.h"
-- 
2.47.3