Commit 411d3273bc for bind

commit 411d3273bc552ec5d2e39e1ccb13810bcb7e5a8a
Author: Matthijs Mekking <matthijs@isc.org>
Date:   Tue Sep 22 14:42:20 2026 +0200

    Add sign delay to ZRRSIG state timing with offline KSK

    When determining key states from the metadata in offline KSK mode,
    the calculations did not take into account the sign delay (Dsgn).

    Similar to rollovers that keymgr maintains (in keymgr_transition_time),
    we need to add the sign delay before the ZRRSIG state can become
    OMNIPRESENT / HIDDEN. The retire-safety, so far only part of the next
    change time, now counts towards the state change as well.

    Keys from dnssec-ksr carry no predecessor or successor, so this applies
    to every ZSK, including the first one of a zone. It matches the removal
    time that dnssec-ksr already sets for ZSKs.

diff --git a/lib/dns/keymgr.c b/lib/dns/keymgr.c
index 083b704698..e634a40689 100644
--- a/lib/dns/keymgr.c
+++ b/lib/dns/keymgr.c
@@ -3036,17 +3036,18 @@ dns_keymgr_offline(const dns_name_t *origin, dns_dnsseckeylist_t *keyring,

 		/* Determine key states from the metadata. */
 		if (active <= now) {
-			dns_ttl_t ttlsig = dns_kasp_zonemaxttl(kasp, true);
-			ttlsig += dns_kasp_zonepropagationdelay(kasp);
-			if ((active + ttlsig) <= now) {
+			dns_ttl_t sigdelay = dns_kasp_zonemaxttl(kasp, true);
+			sigdelay += dns_kasp_zonepropagationdelay(kasp);
+			sigdelay += dns_kasp_retiresafety(kasp);
+			sigdelay += dns_kasp_signdelay(kasp);
+			if ((active + sigdelay) <= now) {
 				zrrsig_state = OMNIPRESENT;
 			} else {
 				zrrsig_state = RUMOURED;
 				(void)dst_key_gettime(dkey->key,
 						      DST_TIME_ZRRSIG,
 						      &lastchange);
-				nextchange = lastchange + ttlsig +
-					     dns_kasp_retiresafety(kasp);
+				nextchange = lastchange + sigdelay;
 			}
 			goal_state = OMNIPRESENT;
 		}
@@ -3068,17 +3069,18 @@ dns_keymgr_offline(const dns_name_t *origin, dns_dnsseckeylist_t *keyring,
 		}

 		if (inactive > 0 && inactive <= now) {
-			dns_ttl_t ttlsig = dns_kasp_zonemaxttl(kasp, true);
-			ttlsig += dns_kasp_zonepropagationdelay(kasp);
-			if ((inactive + ttlsig) <= now) {
+			dns_ttl_t sigdelay = dns_kasp_zonemaxttl(kasp, true);
+			sigdelay += dns_kasp_zonepropagationdelay(kasp);
+			sigdelay += dns_kasp_retiresafety(kasp);
+			sigdelay += dns_kasp_signdelay(kasp);
+			if ((inactive + sigdelay) <= now) {
 				zrrsig_state = HIDDEN;
 			} else {
 				zrrsig_state = UNRETENTIVE;
 				(void)dst_key_gettime(dkey->key,
 						      DST_TIME_ZRRSIG,
 						      &lastchange);
-				nextchange = lastchange + ttlsig +
-					     dns_kasp_retiresafety(kasp);
+				nextchange = lastchange + sigdelay;
 			}
 			goal_state = HIDDEN;
 		}