Don't sign the raw zone

The raw zone is not supposed to be signed.  DNSKEY records in a raw zone
should not trigger zone signing.  The update code needs to be able to
identify when it is working on a raw zone.  Add dns_zone_israw() to
enable it to do this.

(cherry picked from commit 4b287ac02170351ce16f0d60a89b95a7f84ab0f2)

lib/dns/include/dns/zone.h

@@ -2523,6 +2523,9 @@ dns_zone_link(dns_zone_t *zone, dns_zone_t *raw);
 void
 dns_zone_getraw(dns_zone_t *zone, dns_zone_t **raw);
 
+bool
+dns_zone_israw(dns_zone_t *zone);
+
 isc_result_t
 dns_zone_keydone(dns_zone_t *zone, const char *data);
 

lib/dns/zone.c

@@ -22563,6 +22563,16 @@ dns_zone_getraw(dns_zone_t *zone, dns_zone_t **raw) {
 	UNLOCK(&zone->lock);
 }
 
+bool
+dns_zone_israw(dns_zone_t *zone) {
+	bool result;
+	REQUIRE(DNS_ZONE_VALID(zone));
+	LOCK(&zone->lock);
+	result = zone->secure != NULL;
+	UNLOCK(&zone->lock);
+	return (result);
+}
+
 struct keydone {
 	isc_event_t event;
 	bool all;

lib/ns/update.c

@@ -3413,7 +3413,9 @@ update_action(isc_task_t *task, isc_event_t *event) {
 
 		CHECK(rollback_private(db, privatetype, ver, &diff));
 
-		CHECK(add_signing_records(db, privatetype, ver, &diff));
+		if (!dns_zone_israw(zone)) {
+			CHECK(add_signing_records(db, privatetype, ver, &diff));
+		}
 
 		CHECK(add_nsec3param_records(client, zone, db, ver, &diff));
 
@@ -3426,7 +3428,9 @@ update_action(isc_task_t *task, isc_event_t *event) {
 			 */
 			CHECK(dns_nsec3param_deletechains(db, ver, zone, true,
 							  &diff));
-		} else if (has_dnskey && isdnssec(db, ver, privatetype)) {
+		} else if (!dns_zone_israw(zone) && has_dnskey &&
+			   isdnssec(db, ver, privatetype))
+		{
 			dns_update_log_t log;
 			uint32_t interval =
 				dns_zone_getsigvalidityinterval(zone);