#!/bin/sh
# ABOUTME: Regenerates the Stage-5 presentation-form round-trip signed fixture.
# ABOUTME: RSASHA256, 30-day window; run in this directory with BIND tools on PATH.
set -eu
cd "$(dirname "$0")"

rm -f K*.key K*.private dsset-example.sec. example.sec.signed

# RSASHA256 throughout — validates on RHEL9 with SHA-1 disabled.
dnssec-keygen -q -a RSASHA256 -b 1024     -K . example.sec >/dev/null
dnssec-keygen -q -a RSASHA256 -b 2048 -fK -K . example.sec >/dev/null

#   Inception  2027-01-01 00:00 UTC (epoch 1798761600)
#   Expiration 2027-01-31 00:00 UTC (epoch 1801353600)
# Test-time used by test.pl: -t1800057600 (mid-window).
dnssec-signzone -q -P -S -o example.sec -K . -N keep \
    -s 20270101000000 -e 20270131000000 -O full \
    -f example.sec.signed example.sec.zone

echo "Regenerated. Signed zone: example.sec.signed"
