Commit 7452c6fa0e for bind

commit 7452c6fa0e55fb4d42c0a561a230e722e9df551b
Author: Matthijs Mekking <matthijs@isc.org>
Date:   Sat Oct 10 09:56:15 2026 +0200

    Add kasp test cases

    Add some test cases that utilize the new key 'flags' parameter.

diff --git a/bin/tests/system/kasp/kasp.conf b/bin/tests/system/kasp/kasp.conf
index 364c22abc5..ffad97c576 100644
--- a/bin/tests/system/kasp/kasp.conf
+++ b/bin/tests/system/kasp/kasp.conf
@@ -9,6 +9,6 @@ dnssec-policy "kasp" {
 		csk key-directory lifetime P1Y  algorithm 13;
 		ksk key-directory lifetime P1Y  algorithm 8;
 		zsk key-directory lifetime P30D algorithm 8 2048;
-		zsk key-directory lifetime P6M  algorithm 8 3072;
+		zsk key-directory lifetime P6M  algorithm 8 3072 flags adt;
 	};
 };
diff --git a/bin/tests/system/kasp/ns3/named-fips.conf.j2 b/bin/tests/system/kasp/ns3/named-fips.conf.j2
index a6b59fb04d..5b3f46ce00 100644
--- a/bin/tests/system/kasp/ns3/named-fips.conf.j2
+++ b/bin/tests/system/kasp/ns3/named-fips.conf.j2
@@ -50,6 +50,20 @@ zone "unlimited.kasp" {
 	dnssec-policy "unlimited";
 };

+/* DELEG-aware, key flags have ADT bit set. */
+zone "adt.kasp" {
+	type primary;
+	file "adt.kasp.db";
+	dnssec-policy "adt";
+};
+
+/* KSK no SEP, ZSK with SEP. Crazy. */
+zone "crazy-flags.kasp" {
+	type primary;
+	file "crazy-flags.kasp.db";
+	dnssec-policy "crazy-flags";
+};
+
 /* A zone that inherits dnssec-policy. */
 zone "inherit.kasp" {
 	type primary;
diff --git a/bin/tests/system/kasp/ns3/policies/kasp-fips.conf.j2 b/bin/tests/system/kasp/ns3/policies/kasp-fips.conf.j2
index 955f57ebee..5d1db0197c 100644
--- a/bin/tests/system/kasp/ns3/policies/kasp-fips.conf.j2
+++ b/bin/tests/system/kasp/ns3/policies/kasp-fips.conf.j2
@@ -10,6 +10,25 @@ dnssec-policy "default-dynamic" {
 	inline-signing no;
 };

+dnssec-policy "adt" {
+	dnskey-ttl 1234;
+
+	keys {
+		ksk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@ flags sep adt;
+		zsk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+	};
+};
+
+dnssec-policy "crazy-flags" {
+	dnskey-ttl 1234;
+
+	keys {
+		ksk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@ flags;
+		zsk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@ flags sep;
+		zsk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@ flags adt;
+	};
+};
+
 dnssec-policy "migrate-to-dnssec-policy" {
 	dnskey-ttl 1234;

diff --git a/bin/tests/system/kasp/ns3/setup.sh b/bin/tests/system/kasp/ns3/setup.sh
index 89fa8f5b99..5ef0932110 100644
--- a/bin/tests/system/kasp/ns3/setup.sh
+++ b/bin/tests/system/kasp/ns3/setup.sh
@@ -46,8 +46,8 @@ U="UNRETENTIVE"
 #
 # Set up zones that will be initially signed.
 #
-for zn in default dnssec-keygen some-keys legacy-keys pregenerated \
-  rumoured rsasha256 rsasha512 ecdsa256 ecdsa384 \
+for zn in adt crazy-flags default dnssec-keygen some-keys legacy-keys \
+  pregenerated rumoured rsasha256 rsasha512 ecdsa256 ecdsa384 \
   dynamic dynamic-inline-signing inline-signing \
   checkds-ksk checkds-doubleksk checkds-csk inherit unlimited \
   keystore cds-cdnskey; do
diff --git a/bin/tests/system/kasp/tests_kasp.py b/bin/tests/system/kasp/tests_kasp.py
index 7489ee9446..28747b5b8c 100644
--- a/bin/tests/system/kasp/tests_kasp.py
+++ b/bin/tests/system/kasp/tests_kasp.py
@@ -655,6 +655,31 @@ def cb_remove_keyfiles(params, ksks=None, zsks=None):
             id="ed448.kasp",
             marks=isctest.mark.with_algorithm("ED448"),
         ),
+        pytest.param(
+            {
+                "zone": "adt.kasp",
+                "policy": "adt",
+                "config": kasp_config,
+                "key-properties": [
+                    f"ksk 0 {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:rumoured krrsig:rumoured ds:hidden sep adt",
+                    f"zsk 0 {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:rumoured zrrsig:rumoured",
+                ],
+            },
+            id="adt.kasp",
+        ),
+        pytest.param(
+            {
+                "zone": "crazy-flags.kasp",
+                "policy": "crazy-flags",
+                "config": kasp_config,
+                "key-properties": [
+                    f"ksk 0 {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:rumoured krrsig:rumoured ds:hidden",
+                    f"zsk 0 {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:rumoured zrrsig:rumoured sep",
+                    f"zsk 0 {Algorithm.default().number} {Algorithm.default().bits} goal:omnipresent dnskey:rumoured zrrsig:rumoured adt",
+                ],
+            },
+            id="crazy-flags.kasp",
+        ),
     ],
 )
 def test_kasp_case(servers, ns3, params):
@@ -1372,7 +1397,7 @@ def test_kasp_dnssec_keygen():
         f"csk {lifetime['P1Y']} 13 256 sep",
         f"ksk {lifetime['P1Y']} 8 2048 sep",
         f"zsk {lifetime['P30D']} 8 2048",
-        f"zsk {lifetime['P6M']} 8 3072",
+        f"zsk {lifetime['P6M']} 8 3072 adt",
     ]
     keydir = "keys"
     out = keygen("kasp", "kasp", keydir)