Add changes and notes for [#2408]

(cherry picked from commit 5a99a124fb61cd56fb0f199a07524dd84312d8ff)

diff --git a/CHANGES b/CHANGES
index e7f12484bc5486e9f1319d593963357e53362976..732f85bd8b6c150d7846152cbb943994b702e80a 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,7 @@
+5588.  [func]          Add "purge-keys" option to "dnssec-policy". This sets
+                       the time how long key files should be retained after
+                       they have become obsolete. [GL #2408]
+
 5586.  [bug]           An invalid direction field in a LOC record resulted in
                        an INSIST failure. [GL #2499]
 

diff --git a/doc/notes/notes-current.rst b/doc/notes/notes-current.rst
index 44fcea7ab87a7abc1545a33113099508867d2ec6..0a0437cdc8b8bb59f6b4a807e7d42f06f6adfd3b 100644 (file)
--- a/doc/notes/notes-current.rst
+++ b/doc/notes/notes-current.rst
@@ -31,6 +31,11 @@ New Features
   this case, ``named`` attempts to answer DNS requests with stale data,
   but does not start the ``stale-refresh-time`` window. [GL #2434]
 
+- A new option, ``purge-keys``, has been added to ``dnssec-policy``. It sets
+  the time how long key files should be retained after they have become
+  obsolete (due to a key rollover). Default is 90 days, and the feature can
+  be disabled by setting it to 0. [GL #2408]
+
 Removed Features
 ~~~~~~~~~~~~~~~~