#!/bin/sh
# Regenerates the signed zone variants used by issue #16 tests.
# Run from this directory. Requires BIND 9 tools: dnssec-keygen, dnssec-signzone.
#
# Signing window (30 days, per the fixture conventions in .claude/CLAUDE.md):
#   Inception  2027-02-01 00:00 UTC (epoch 1801440000)
#   Expiration 2027-03-03 00:00 UTC (epoch 1804032000)
# Test-time used by test.pl: -t1802692800 (2027-02-15 12:00 UTC, mid-window).

set -eu
cd "$(dirname "$0")"

INCEPTION=20270201000000
EXPIRATION=20270303000000

rm -f K*.key K*.private dsset-* \
    example.sec.signed.nsec example.sec.signed.nsec3 \
    example.sec.signed.nsec3optout \
    example.sec.signed.nsec.noleafsig example.sec.signed.nsec.nodssig \
    example.sec.signed.nsec3.nonsec3sig \
    alg2.example.sec.signed alg2.example.sec.signed.missing-alg

# Main fixture keys: RSASHA256 ZSK+KSK (RHEL9-safe, never SHA-1).
dnssec-keygen -q -a RSASHA256 -b 1024     -K . example.sec >/dev/null
dnssec-keygen -q -a RSASHA256 -b 2048 -fK -K . example.sec >/dev/null

# -P skips post-sign verification: the window lies in the future.
# The occluded record below signed-del is deliberate; BIND signs around it.
sign() {
    out="$1"; shift
    dnssec-signzone -q -P -S -o example.sec -K . -N keep \
        -s "$INCEPTION" -e "$EXPIRATION" -O full \
        "$@" -f "$out" example.sec.zone
}
sign example.sec.signed.nsec
sign example.sec.signed.nsec3 -3 12345678
sign example.sec.signed.nsec3optout -3 12345678 -A

# Negative variants: strip exactly one RRSIG line each. -O full keeps one
# record per line, so a single grep/awk removes one whole signature.
grep -Ev '^leaf\.example\.sec\.[[:space:]].*IN[[:space:]]+RRSIG[[:space:]]+A[[:space:]]' \
    example.sec.signed.nsec > example.sec.signed.nsec.noleafsig
grep -Ev '^signed-del\.example\.sec\.[[:space:]].*IN[[:space:]]+RRSIG[[:space:]]+DS[[:space:]]' \
    example.sec.signed.nsec > example.sec.signed.nsec.nodssig
awk '!done && /IN[[:space:]]+RRSIG[[:space:]]+NSEC3[[:space:]]/ { done=1; next } { print }' \
    example.sec.signed.nsec3 > example.sec.signed.nsec3.nonsec3sig

# Two-algorithm fixture: RSASHA256 + ECDSAP256SHA256, ZSK+KSK each.
dnssec-keygen -q -a RSASHA256        -b 1024     -K . alg2.example.sec >/dev/null
dnssec-keygen -q -a RSASHA256        -b 2048 -fK -K . alg2.example.sec >/dev/null
dnssec-keygen -q -a ECDSAP256SHA256             -K . alg2.example.sec >/dev/null
dnssec-keygen -q -a ECDSAP256SHA256         -fK -K . alg2.example.sec >/dev/null
dnssec-signzone -q -P -S -o alg2.example.sec -K . -N keep \
    -s "$INCEPTION" -e "$EXPIRATION" -O full \
    -f alg2.example.sec.signed alg2.example.sec.zone

# Algorithm-gap variant: drop the ECDSAP256SHA256 (13) signature over leaf's A.
grep -Ev '^leaf\.alg2\.example\.sec\.[[:space:]].*IN[[:space:]]+RRSIG[[:space:]]+A[[:space:]]+13[[:space:]]' \
    alg2.example.sec.signed > alg2.example.sec.signed.missing-alg

rm -f dsset-*
echo "Regenerated."
