#!/bin/sh
# Regenerate the signed fixture for the base64 *_human round-trip (stage 2).
# RSASHA256 so it validates on RHEL/CentOS default (SHA-1-disabled) policy.
#
#   Inception  2027-01-01 00:00 UTC (epoch 1798761600)
#   Expiration 2027-01-31 00:00 UTC (epoch 1801353600)
# Test-time used by test.pl: -t1800057600 (2027-01-16 00:00 UTC, mid-window).
set -e
cd "$(dirname "$0")"
rm -f K*.key K*.private dsset-* example.sec.signed

KSK=$(dnssec-keygen -a RSASHA256 -b 2048 -f KSK -K . -n ZONE example.sec)
ZSK=$(dnssec-keygen -a RSASHA256 -b 1024 -K . -n ZONE example.sec)

dnssec-signzone -q -P -S -o example.sec -K . -N keep \
    -s 20270101000000 -e 20270131000000 -O full \
    -f example.sec.signed example.sec.zone
