Commit a7d86725f0 for bind

commit a7d86725f0ef911df67d3dd47b4eff2914141f35
Author: Martin Basti <mbasti@isc.org>
Date:   Mon Sep 7 17:35:33 2026 +0000

    Finish sizing algorithm format buffers with DST_ALG_FORMATSIZE

    Extend the DST_ALG_FORMATSIZE conversion to the sites the earlier
    commits missed: four dnssec-verify buffers still sized with
    DNS_SECALG_FORMATSIZE, and the DST_KEY_FORMATSIZE and SIG_FORMATSIZE
    identifier sizes still built from DNS_SECALG_FORMATSIZE while their
    formatters print a DST algorithm mnemonic. The two sizes are equal
    today; this keeps every dst_algorithm_format buffer on one macro.

    Assisted-by: Claude:claude-fable-5

diff --git a/bin/dnssec/dnssectool.h b/bin/dnssec/dnssectool.h
index c5e1e4ba93..bdb15e3794 100644
--- a/bin/dnssec/dnssectool.h
+++ b/bin/dnssec/dnssectool.h
@@ -69,7 +69,7 @@ version(const char *program);
 void
 sig_format(dns_rdata_rrsig_t *sig, char *cp, unsigned int size);
 #define SIG_FORMATSIZE \
-	(DNS_NAME_FORMATSIZE + DNS_SECALG_FORMATSIZE + sizeof("65535"))
+	(DNS_NAME_FORMATSIZE + DST_ALG_FORMATSIZE + sizeof("65535"))

 void
 setup_logging(void);
diff --git a/lib/dns/include/dst/dst.h b/lib/dns/include/dst/dst.h
index 3692ae26b2..9089c630ec 100644
--- a/lib/dns/include/dst/dst.h
+++ b/lib/dns/include/dst/dst.h
@@ -1002,7 +1002,7 @@ dst_key_setprivateformat(dst_key_t *key, int major, int minor);
  */
 #define DST_ALG_FORMATSIZE 20

-#define DST_KEY_FORMATSIZE (DNS_NAME_FORMATSIZE + DNS_SECALG_FORMATSIZE + 7)
+#define DST_KEY_FORMATSIZE (DNS_NAME_FORMATSIZE + DST_ALG_FORMATSIZE + 7)

 void
 dst_key_format(const dst_key_t *key, char *cp, unsigned int size);
diff --git a/lib/dns/zoneverify.c b/lib/dns/zoneverify.c
index 2ea7175cef..925a5059dc 100644
--- a/lib/dns/zoneverify.c
+++ b/lib/dns/zoneverify.c
@@ -789,7 +789,7 @@ verifyset(vctx_t *vctx, dns_rdataset_t *rdataset, const dns_name_t *name,
 	  dns_dbnode_t *node, dst_key_t **dstkeys, size_t nkeys) {
 	unsigned char set_algorithms[DST_MAX_ALGS] = { 0 };
 	char namebuf[DNS_NAME_FORMATSIZE];
-	char algbuf[DNS_SECALG_FORMATSIZE];
+	char algbuf[DST_ALG_FORMATSIZE];
 	char typebuf[DNS_RDATATYPE_FORMATSIZE];
 	dns_rdataset_t sigrdataset = DNS_RDATASET_INIT;
 	dns_rdatasetiter_t *rdsiter = NULL;
@@ -1592,7 +1592,7 @@ static void
 determine_active_algorithms(vctx_t *vctx, bool ignore_kskflag,
 			    bool keyset_kskonly,
 			    void (*report)(const char *, ...)) {
-	char algbuf[DNS_SECALG_FORMATSIZE];
+	char algbuf[DST_ALG_FORMATSIZE];

 	report("Verifying the zone using the following algorithms:");

@@ -1857,7 +1857,7 @@ done:

 static isc_result_t
 check_bad_algorithms(const vctx_t *vctx, void (*report)(const char *, ...)) {
-	char algbuf[DNS_SECALG_FORMATSIZE];
+	char algbuf[DST_ALG_FORMATSIZE];
 	bool first = true;

 	for (size_t i = 0; i < ARRAY_SIZE(vctx->bad_algorithms); i++) {
@@ -1883,7 +1883,7 @@ check_bad_algorithms(const vctx_t *vctx, void (*report)(const char *, ...)) {
 static void
 print_summary(const vctx_t *vctx, bool keyset_kskonly,
 	      void (*report)(const char *, ...)) {
-	char algbuf[DNS_SECALG_FORMATSIZE];
+	char algbuf[DST_ALG_FORMATSIZE];

 	report("Zone fully signed:");
 	for (size_t i = 0; i < ARRAY_SIZE(vctx->ksk_algorithms); i++) {
diff --git a/tests/dns/dst_test.c b/tests/dns/dst_test.c
index 6c4aafaa3d..d73718af85 100644
--- a/tests/dns/dst_test.c
+++ b/tests/dns/dst_test.c
@@ -122,6 +122,43 @@ ISC_RUN_TEST_IMPL(algorithm_format) {
 	}
 }

+ISC_RUN_TEST_IMPL(key_format) {
+	isc_result_t result;
+	dst_key_t *key = NULL;
+	dns_fixedname_t fname;
+	dns_name_t *name;
+	char keystr[DST_KEY_FORMATSIZE];
+	char expected[DST_KEY_FORMATSIZE];
+
+	/*
+	 * The identifier buffer must fit any name plus any algorithm
+	 * mnemonic and key id.
+	 */
+	assert_true(DST_KEY_FORMATSIZE >=
+		    DNS_NAME_FORMATSIZE + DST_ALG_FORMATSIZE + sizeof("65535"));
+
+	if (!dst_algorithm_supported(DST_ALG_RSASHA256PRIVATEOID)) {
+		skip();
+		return;
+	}
+
+	dns_test_namefromstring("example.", &fname);
+	name = dns_fixedname_name(&fname);
+
+	result = dst_key_generate(name, DST_ALG_RSASHA256PRIVATEOID, 2048, 0,
+				  DNS_KEYOWNER_ZONE, DNS_KEYPROTO_DNSSEC,
+				  dns_rdataclass_in, NULL, isc_g_mctx, &key,
+				  NULL);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	dst_key_format(key, keystr, sizeof(keystr));
+	snprintf(expected, sizeof(expected), "example/RSASHA256OID/%d",
+		 dst_key_id(key));
+	assert_string_equal(keystr, expected);
+
+	dst_key_free(&key);
+}
+
 /* Read sig in file at path to buf. Check signature ineffability */
 static isc_result_t
 sig_fromfile(const char *path, isc_buffer_t *buf) {
@@ -564,6 +601,7 @@ ISC_RUN_TEST_IMPL(ecdsa_determinism_test) {
 ISC_TEST_LIST_START
 ISC_TEST_ENTRY(algorithm_fromdata)
 ISC_TEST_ENTRY(algorithm_format)
+ISC_TEST_ENTRY(key_format)
 ISC_TEST_ENTRY(sig_test)
 ISC_TEST_ENTRY(cmp_test)
 ISC_TEST_ENTRY(ecdsa_determinism_test)
diff --git a/tests/dns/skr_test.c b/tests/dns/skr_test.c
index a151680200..4b6ed7ea54 100644
--- a/tests/dns/skr_test.c
+++ b/tests/dns/skr_test.c
@@ -103,7 +103,7 @@ static dns_name_t *dname = NULL;
 #define LIFETIME 864000

 #define SIG_FORMATSIZE \
-	(DNS_NAME_FORMATSIZE + DNS_SECALG_FORMATSIZE + sizeof("65535"))
+	(DNS_NAME_FORMATSIZE + DST_ALG_FORMATSIZE + sizeof("65535"))

 static void
 print_rdata(FILE *fp, dns_rdata_t *rdata) {