#!/bin/sh
# Regenerate svcb.zone.signed. Run from src/t/zones/.
# Requires BIND tools (dnssec-signzone).
set -e

INCEPTION=20260101000000   # well before any reasonable test -t value
EXPIRATION=20310101000000  # 5-year validity

dnssec-signzone \
    -P \
    -o example.sec. \
    -K . \
    -s "$INCEPTION" \
    -e "$EXPIRATION" \
    -f svcb.zone.signed.tmp \
    svcb-unsigned.zone \
    Kexample.sec.+008+48381

mv svcb.zone.signed.tmp svcb.zone.signed
