#!/bin/sh
# Regenerates the signed zone fixture used by issue #65 tests.
# Run from this directory. Requires BIND 9 tools: dnssec-keygen, dnssec-signzone.

set -eu
cd "$(dirname "$0")"

rm -f K*.key K*.private dsset-*.example.sec. example.sec.signed

# RSASHA256 throughout — works on every platform including RHEL9 with SHA-1 disabled.
dnssec-keygen -q -a RSASHA256 -b 1024     -K . example.sec >/dev/null
dnssec-keygen -q -a RSASHA256 -b 2048 -fK -K . example.sec >/dev/null

# 30-day signing window — modern operator practice (BIND default, ~Route 53).
#   Inception  2027-01-01 00:00 UTC (epoch 1798761600)
#   Expiration 2027-01-31 00:00 UTC (epoch 1801353600)
# Test-time used by test.pl: -t1800057600 (2027-01-15 12:00 UTC, mid-window).
dnssec-signzone -q -P -S -o example.sec -K . -N keep \
    -s 20270101000000 -e 20270131000000 -O full \
    -f example.sec.signed example.sec.zone

echo "Regenerated. Signed zone: example.sec.signed"
