Extend the check_dnssec_verify retry window to 60 seconds

A fixed ten-iteration poll could be too short for a freshly signed
zone to become fully valid on a heavily loaded host, occasionally
yielding a spurious "zone not verified".

Bump the budget to a 60-second window and, in the process, replace the
hand-rolled retry loop with the standard isctest.run.retry_with_timeout
helper already used by check_next_key_event.

Assisted-by: Claude:claude-opus-4-8

diff --git a/bin/tests/system/isctest/kasp.py b/bin/tests/system/isctest/kasp.py
index 0bc7bd9b4be920c410f52b57b89cca3e8c27fb84..b53aaedf7cc31e509d72cc9481f3bbd51d7e402a 100644 (file)
--- a/bin/tests/system/isctest/kasp.py
+++ b/bin/tests/system/isctest/kasp.py
@@ -18,7 +18,6 @@ from re import compile as Re
 import glob
 import os
 import re
-import time
 
 import dns.exception
 import dns.message
@@ -870,32 +869,30 @@ def check_keyrelationships(keys, expected):
 
 
 def check_dnssec_verify(server, zone, tsig=None):
-    # Check if zone if DNSSEC valid with dnssec-verify.
+    # Check if zone is DNSSEC valid with dnssec-verify.
     fqdn = f"{zone}."
 
-    verified = False
-    for _ in range(10):
+    def _verify_zone():
         transfer = _query(server, fqdn, dns.rdatatype.AXFR, tsig=tsig)
         if not isinstance(transfer, dns.message.Message):
             isctest.log.debug(f"no response for {fqdn} AXFR from {server.ip}")
-        elif transfer.rcode() != dns.rcode.NOERROR:
+            return False
+        if transfer.rcode() != dns.rcode.NOERROR:
             rcode = dns.rcode.to_text(transfer.rcode())
             isctest.log.debug(f"{rcode} response for {fqdn} AXFR from {server.ip}")
-        else:
-            zonefile = f"{zone}.axfr"
-            with open(zonefile, "w", encoding="utf-8") as file:
-                for rr in transfer.answer:
-                    file.write(rr.to_text())
-                    file.write("\n")
+            return False
 
-            verify_command = [os.environ.get("VERIFY"), "-z", "-o", fqdn, zonefile]
-            verified = isctest.run.cmd(verify_command, raise_on_exception=False)
-            if verified.rc == 0:
-                return
+        zonefile = f"{zone}.axfr"
+        with open(zonefile, "w", encoding="utf-8") as file:
+            for rr in transfer.answer:
+                file.write(rr.to_text())
+                file.write("\n")
 
-        time.sleep(1)
+        verify_command = [os.environ.get("VERIFY"), "-z", "-o", fqdn, zonefile]
+        verified = isctest.run.cmd(verify_command, raise_on_exception=False)
+        return verified.rc == 0
 
-    assert False, "zone not verified"
+    isctest.run.retry_with_timeout(_verify_zone, timeout=60, msg="zone not verified")
 
 
 def check_dnssecstatus(server, zone, keys, policy=None, view=None, verbose=False):