dnsimple / erldns / 15584382532

85%

Build Type

push

github

Committed by web-flow

Commit Message

Use KSK to sign CDS and CDNSKEY RRSets (#235)

According to the RFC 7344 Section 4.1, CDS and CDNSKEY RRSets must be signed using a key that's present in both the DNSKEY and DS RRSets. However, erldns uses the ZSK, which is not present in the DS RRSet.

* Add comprehensive unit tests for CDS/CDNSKEY RRSIG functionality

- Add test suite to verify CDS/CDNSKEY use key-signing-key for RRSIG
- Tests verify signer selection logic works correctly
- Following TDD approach with tests that verify expected behavior
- Tests cover requires_key_signing_key and choose_signer_for_rrset functions

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

* Implement CDS/CDNSKEY RRSIG signing with key-signing-key

- Add choose_signer_for_rrset function to select appropriate signer
- Add requires_key_signing_key helper to identify CDS/CDNSKEY records
- Modify rrsig_for_zone_rrset to use new signer selection logic
- Export functions for testing
- CDS and CDNSKEY records now use key-signing-key for RRSIG
- Other record types continue using zone-signing-key
- All tests pass confirming implementation works correctly

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

* Cleanup: `make format`

* Rename test suite

* Keep new exports as only for tests

* Ensure correct signature happen on zone loading

* Migrate dnssec documentation

* Remove wildcard filtering

* Unify in a single pass both zsk and ksk signing

---------

Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Nelson Vides <nelson.vides@erlang-solutions.com>

Run Details

22 of 24 new or added lines in 3 files covered. (91.67%)

1 existing line in 1 file now uncovered.

1124 of 1477 relevant lines covered (76.1%)

1509.95 hits per line