#!/bin/sh
# Regenerates the signed zone variants used by issue #89 tests.
# Run from this directory. Requires BIND 9 tools: dnssec-keygen, dnssec-signzone.

set -eu
cd "$(dirname "$0")"

# Wipe previous artifacts (keep the unsigned source zone and helper files)
rm -f K*.key K*.private dsset-*.example.sec. \
    example.sec.signed.across-2038 example.sec.signed.after-2038

# Keys: RSASHA256 throughout so signatures validate on every platform
# (including RHEL9 where SHA-1 is disabled).
dnssec-keygen -q -a RSASHA256 -b 1024     -K . example.sec >/dev/null
dnssec-keygen -q -a RSASHA256 -b 2048 -fK -K . example.sec >/dev/null

sign_window() {
    inception="$1"
    expiration="$2"
    out="$3"
    # -P disables dnssec-signzone's own post-sign verification, which would
    # otherwise reject windows that don't include "now".
    dnssec-signzone -q -P -S -o example.sec -K . -N keep \
        -s "$inception" -e "$expiration" -O full \
        -f "$out" example.sec.zone
}

# Window 1: spans the 2038-01-19 03:14:07 UTC boundary.
#   Inception  2026-01-01 (epoch 1767225600)
#   Expiration 2040-01-01 (epoch 2208988800)
# Test-time used by test.pl: -t1778407200 (2026-05-10, inside window).
sign_window 20260101000000 20400101000000 example.sec.signed.across-2038

# Window 2: entirely after the boundary.
#   Inception  2040-01-01 (epoch 2208988800)
#   Expiration 2040-12-31 23:59:59 (epoch 2240611199)
# Test-time used by test.pl: -t2220480000 (mid-2040, inside window).
sign_window 20400101000000 20401231235959 example.sec.signed.after-2038

echo "Regenerated. Signed zones:"
ls -1 example.sec.signed.*
