#!/bin/sh
# Regenerates the signed zone variants used by issue #104 tests.
# Run from this directory. Requires BIND 9 tools: dnssec-keygen, dnssec-signzone.

set -eu
cd "$(dirname "$0")"

# Wipe previous artifacts (keep the unsigned source zone and helper files)
rm -f K*.key K*.private dsset-*.example.sec. \
    example.sec.signed.nsec example.sec.signed.nsec3 example.sec.signed.policy

# Keys: RSASHA256 throughout so apex sigs validate on every platform
# (including RHEL9 where SHA-1 is disabled).
dnssec-keygen -q -a RSASHA256 -b 1024     -K . example.sec >/dev/null
dnssec-keygen -q -a RSASHA256 -b 2048 -fK -K . example.sec >/dev/null

# Signing window: wide enough that test-time stays inside it for years.
INCEPTION=20260101000000
EXPIRATION=20300101000000

# Substitute the algorithm field in DS / CDS / DLV records of the source
# zone before signing, so that the resulting RRSIGs cover the synthetic
# (post-substitution) RDATA and validate cleanly.
# Pattern: "IN <DS|CDS|DLV> <key-tag> 8 <digest-type> ..." with 8 -> $new_alg.
sign_with_alg() {
    new_alg="$1"
    out="$2"
    shift 2
    src="example.sec.zone.$$"
    sed -E \
        "s/(IN[[:space:]]+(DS|CDS|DLV)[[:space:]]+[0-9]+)[[:space:]]+8([[:space:]]+[0-9]+[[:space:]])/\\1 ${new_alg}\\3/g" \
        example.sec.zone > "$src"
    dnssec-signzone -q -S -o example.sec -K . -N keep \
        -s "$INCEPTION" -e "$EXPIRATION" -O full \
        "$@" \
        -f "$out" "$src"
    rm -f "$src"
}

# 1) NSEC variant, alg = 99 (UNKNOWN)
sign_with_alg 99 example.sec.signed.nsec

# 2) NSEC3 opt-out variant, alg = 99 (UNKNOWN). -3 takes a salt; -A enables opt-out.
sign_with_alg 99 example.sec.signed.nsec3 -3 12345678 -A

# 3) Policy variant, alg = 5 (RSASHA1, POLICY_OFF on RHEL9)
sign_with_alg 5 example.sec.signed.policy

echo "Regenerated. Inspect with: grep -E 'IN (DS|CDS|DLV)' example.sec.signed.*"
