system tests: if USE_RR environmental variable is set then the tests are run under rr in chaos mode

2019-12-10 09:01:39 +01:00
151 changed files with 3263 additions and 4034 deletions
@@ -1,10 +1,2 @@
 *.sln.in eol=crlf
 *.vcxproj.* eol=crlf
-
-.gitignore			 export-ignore
-/conftools			 export-ignore
-/doc/design			 export-ignore
-/doc/dev			 export-ignore
-/util/**			 export-ignore
-/util/bindkeys.pl		-export-ignore
-/util/mksymtbl.pl		-export-ignore
@@ -60,4 +60,3 @@ timestamp
 /compile_commands.json
 /cppcheck_html/
 /cppcheck.results
-/tsan
@@ -18,17 +18,9 @@ variables:
  MAKE: make
  CONFIGURE: ./configure
  SCAN_BUILD: scan-build-9
-  SYMBOLIZER: /usr/lib/llvm-9/bin/llvm-symbolizer
-  ASAN_SYMBOLIZER_PATH: "$SYMBOLIZER"

  CFLAGS_COMMON: -fno-omit-frame-pointer -fno-optimize-sibling-calls -O1 -g -Wall -Wextra 

-  # Pass run-time flags to AddressSanitizer to get core dumps on error.
-  ASAN_OPTIONS_COMMON: abort_on_error=1:disable_coredump=0:unmap_shadow_on_exit=1
-
-  TARBALL_COMPRESSOR: xz
-  TARBALL_EXTENSION: xz
-
 stages:
  - precheck
  - build
@@ -37,7 +29,6 @@ stages:
  - docs
  - push
  - postcheck
-  - release

 ### Runner Tag Templates

@@ -113,8 +104,8 @@ stages:

 # Fedora

-.fedora-31-amd64: &fedora_31_amd64_image
-  image: "$CI_REGISTRY_IMAGE:fedora-31-amd64"
+.fedora-30-amd64: &fedora_30_amd64_image
+  image: "$CI_REGISTRY_IMAGE:fedora-30-amd64"
  <<: *linux_amd64

 # Ubuntu
@@ -142,14 +133,12 @@ stages:
    - merge_requests
    - tags
    - web
-    - schedules

 .release-branch-triggering-rules: &release_branch_triggering_rules
  only:
    - merge_requests
    - tags
    - web
-    - schedules
    - master@isc-projects/bind9
    - /^v9_[1-9][0-9]$/@isc-projects/bind9

@@ -185,7 +174,7 @@ stages:
    --without-make-clean \
    $EXTRA_CONFIGURE \
    || cat config.log
-
+    
 .build: &build_job
  <<: *default_triggering_rules
  stage: build
@@ -203,36 +192,6 @@ stages:
    untracked: true
    expire_in: "1 week"

-.windows_build: &windows_build_job
-  stage: build
-  tags:
-    - windows
-    - amd64
-  script:
-    - 'Push-Location "C:/Program Files (x86)/Microsoft Visual Studio/2017/BuildTools/VC/Auxiliary/Build"'
-    - '& cmd.exe /C "vcvarsall.bat x64 & set" | Foreach-Object { if ($_ -match "(.*?)=(.*)") { Set-Item -force -path "Env:\$($matches[1])" -value "$($matches[2])" } }'
-    - 'Pop-Location'
-    - 'Set-Location win32utils'
-    - '& "C:/Strawberry/perl/bin/perl.exe" Configure
-         "with-tools-version=15.0"
-         "with-platform-toolset=v141"
-         "with-platform-version=10.0.17763.0"
-         "with-vcredist=C:/Program Files (x86)/Microsoft Visual Studio/2017/BuildTools/VC/Redist/MSVC/14.16.27012/vcredist_x64.exe"
-         "with-openssl=C:/OpenSSL"
-         "with-libxml2=C:/libxml2"
-         "with-libuv=C:/libuv"
-         "without-python"
-         "with-system-tests"
-         x64'
-    - 'Set-Item -path "Env:CL" -value "/MP$([Math]::Truncate($BUILD_PARALLEL_JOBS/2))"'
-    - '& msbuild.exe /maxCpuCount:2 /t:Build /p:Configuration=$VSCONF bind9.sln'
-  dependencies: []
-  needs:
-    - autoreconf:sid:amd64
-  artifacts:
-    untracked: true
-    expire_in: "1 week"
-
 .setup_interfaces: &setup_interfaces |
    if [ "$(id -u)" -eq "0" ]; then
      sh -x bin/tests/system/ifconfig.sh up;
@@ -241,7 +200,7 @@ stages:
    fi

 .setup_softhsm: &setup_softhsm |
-    sh -x bin/tests/prepare-softhsm2.sh
+    sh -x util/prepare-softhsm2.sh

 .system_test: &system_test_job
  <<: *default_triggering_rules
@@ -264,30 +223,6 @@ stages:
       --results-filter "" \
       --output kyua_html

-.windows_system_test: &windows_system_test_job
-  stage: system
-  tags:
-    - windows
-    - amd64
-  script:
-    - 'Push-Location bin/tests/system'
-    - '$ifIndex = Get-NetIPInterface -AddressFamily IPv4 -InterfaceMetric 75 | Select-Object -ExpandProperty ifIndex'
-    - '& C:/tools/cygwin/bin/sed.exe -i "s/^exit.*/netsh interface ipv4 set dnsservers $ifIndex dhcp/; s/\(name\|interface\)=Loopback/$ifIndex/;" ifconfig.bat'
-    - '& C:/tools/cygwin/bin/sed.exe -i "s/kill -f/kill -W/;" conf.sh stop.pl'
-    - '& cmd.exe /C ifconfig.bat up; ""'
-    - 'Start-Sleep 2'
-    - '$Env:Path = "C:/tools/cygwin/bin;$Env:Path"'
-    - '& sh.exe runall.sh $TEST_PARALLEL_JOBS'
-    - 'If (Test-Path C:/CrashDumps/*) { dir C:/CrashDumps; Throw }'
-  artifacts:
-    untracked: true
-    expire_in: "1 week"
-    when: on_failure
-  only:
-    - schedules
-    - tags
-    - web
-
 .unit_test: &unit_test_job
  <<: *default_triggering_rules
  stage: unit
@@ -381,23 +316,6 @@ misc:sid:amd64:
    - util/check-cocci
    - if test "$(git status --porcelain | grep -Ev '\?\?' | wc -l)" -gt "0"; then git status --short; exit 1; fi

-tarball-create:sid:amd64:
-  <<: *debian_sid_amd64_image
-  stage: precheck
-  script:
-    - source version
-    - export BIND_DIRECTORY="bind-${MAJORVER}.${MINORVER}.${PATCHVER}${RELEASETYPE}${RELEASEVER}"
-    - git archive --prefix="${BIND_DIRECTORY}/" --output="${BIND_DIRECTORY}.tar" HEAD
-    - mkdir "${BIND_DIRECTORY}"
-    - echo "SRCID=$(git rev-list --max-count=1 HEAD | cut -b1-7)" > "${BIND_DIRECTORY}/srcid"
-    - tar --append --file="${BIND_DIRECTORY}.tar" "${BIND_DIRECTORY}/srcid"
-    - ${TARBALL_COMPRESSOR} "${BIND_DIRECTORY}.tar"
-  artifacts:
-    paths:
-      - bind-*.tar.${TARBALL_EXTENSION}
-  only:
-    - tags
-
 # Jobs for doc builds on Debian Sid (amd64)

 docs:sid:amd64:
@@ -658,48 +576,6 @@ cppcheck:gcc:sid:amd64:
    - gcc:sid:amd64
  needs: ["gcc:sid:amd64"]

-# Jobs for tarball GCC builds on Debian Sid (amd64)
-
-tarball:sid:amd64:
-  variables:
-    CC: gcc
-    EXTRA_CONFIGURE: "--enable-dnstap --with-libidn2"
-    RUN_MAKE_INSTALL: 1
-  <<: *debian_sid_amd64_image
-  <<: *build_job
-  before_script:
-    - tar --extract --file bind-*.tar.${TARBALL_EXTENSION}
-    - rm -f bind-*.tar.${TARBALL_EXTENSION}
-    - cd bind-*
-  dependencies:
-    - tarball-create:sid:amd64
-  needs: ["tarball-create:sid:amd64"]
-  only:
-    - tags
-
-system:tarball:sid:amd64:
-  <<: *debian_sid_amd64_image
-  <<: *system_test_job
-  before_script:
-    - cd bind-*
-    - *setup_interfaces
-  dependencies:
-    - tarball:sid:amd64
-  needs: ["tarball:sid:amd64"]
-  only:
-    - tags
-
-unit:tarball:sid:amd64:
-  <<: *debian_sid_amd64_image
-  <<: *unit_test_job
-  before_script:
-    - cd bind-*
-  dependencies:
-    - tarball:sid:amd64
-  needs: ["tarball:sid:amd64"]
-  only:
-    - tags
-
 # Jobs for regular GCC builds on Debian Sid (i386)

 gcc:sid:i386:
@@ -724,29 +600,29 @@ unit:gcc:sid:i386:
    - gcc:sid:i386
  needs: ["gcc:sid:i386"]

-# Jobs for regular GCC builds on Fedora 31 (amd64)
+# Jobs for regular GCC builds on Fedora 30 (amd64)

-gcc:fedora31:amd64:
+gcc:fedora30:amd64:
  variables:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON} -O1"
    EXTRA_CONFIGURE: "--with-libidn2"
-  <<: *fedora_31_amd64_image
+  <<: *fedora_30_amd64_image
  <<: *build_job

-system:gcc:fedora31:amd64:
-  <<: *fedora_31_amd64_image
+system:gcc:fedora30:amd64:
+  <<: *fedora_30_amd64_image
  <<: *system_test_job
  dependencies:
-    - gcc:fedora31:amd64
-  needs: ["gcc:fedora31:amd64"]
+    - gcc:fedora30:amd64
+  needs: ["gcc:fedora30:amd64"]

-unit:gcc:fedora31:amd64:
-  <<: *fedora_31_amd64_image
+unit:gcc:fedora30:amd64:
+  <<: *fedora_30_amd64_image
  <<: *unit_test_job
  dependencies:
-    - gcc:fedora31:amd64
-  needs: ["gcc:fedora31:amd64"]
+    - gcc:fedora30:amd64
+  needs: ["gcc:fedora30:amd64"]

 # Jobs for regular GCC builds on Ubuntu 16.04 Xenial Xerus (amd64)

@@ -808,8 +684,6 @@ asan:sid:amd64:
  <<: *build_job

 system:asan:sid:amd64:
-  variables:
-    ASAN_OPTIONS: ${ASAN_OPTIONS_COMMON}
  <<: *debian_sid_amd64_image
  <<: *system_test_job
  dependencies:
@@ -817,71 +691,12 @@ system:asan:sid:amd64:
  needs: ["asan:sid:amd64"]

 unit:asan:sid:amd64:
-  variables:
-    ASAN_OPTIONS: ${ASAN_OPTIONS_COMMON}
  <<: *debian_sid_amd64_image
  <<: *unit_test_job
  dependencies:
    - asan:sid:amd64
  needs: ["asan:sid:amd64"]

-# Jobs for GCC builds with TSAN enabled on Debian Sid (amd64)
-
-tsan:buster:amd64:
-  <<: *debian_buster_amd64_image
-  <<: *build_job
-  variables:
-    CC: clang-9
-    CFLAGS: "${CFLAGS_COMMON} -fsanitize=thread -DISC_MEM_USE_INTERNAL_MALLOC=0"
-    LDFLAGS: "-fsanitize=thread"
-    EXTRA_CONFIGURE: "--with-libidn2 --enable-pthread-rwlock"
-
-system:tsan:buster:amd64:
-  variables:
-    TSAN_OPTIONS: "second_deadlock_stack=1 history_size=7 log_exe_name=true log_path=tsan external_symbolizer_path=$SYMBOLIZER exitcode=0"
-  before_script:
-    - *setup_interfaces
-    - echo $TSAN_OPTIONS
-  <<: *debian_buster_amd64_image
-  <<: *system_test_job
-  dependencies:
-    - tsan:buster:amd64
-  needs: ["tsan:buster:amd64"]
-  allow_failure: true
-  after_script:
-    - find bin -name 'tsan.*' -exec python3 util/parse_tsan.py {} \;
-  artifacts:
-    expire_in: "1 week"
-    paths:
-      - bin/tests/system/*/tsan.*
-      - bin/tests/system/*/*/tsan.*
-      - tsan/
-    when: on_failure
-
-unit:tsan:buster:amd64:
-  variables:
-    TSAN_OPTIONS: "second_deadlock_stack=1 history_size=7 log_exe_name=true log_path=tsan external_symbolizer_path=$SYMBOLIZER"
-  before_script:
-    - echo $TSAN_OPTIONS
-    - lib/isc/tests/result_test
-  <<: *debian_buster_amd64_image
-  <<: *unit_test_job
-  dependencies:
-    - tsan:buster:amd64
-  needs: ["tsan:buster:amd64"]
-  allow_failure: true
-  after_script:
-    - find lib -name 'tsan.*' -exec python3 util/parse_tsan.py {} \;
-  artifacts:
-    expire_in: "1 week"
-    paths:
-      - lib/*/tests/tsan.*
-      - tsan/
-      - kyua.log
-      - kyua.results
-      - kyua_html/
-    when: on_failure
-
 rwlock:sid:amd64:
  variables:
    CC: gcc
@@ -1039,7 +854,6 @@ system:clang:openbsd6.5:amd64:
    - clang:openbsd6.5:amd64
  needs: ["clang:openbsd6.5:amd64"]
  only:
-    - schedules
    - tags
    - web

@@ -1070,74 +884,62 @@ unit:nolibtool:sid:amd64:
 # Jobs for Visual Studio 2017 builds on Windows (amd64)

 msvc:windows:amd64:
-  <<: *windows_build_job
  <<: *default_triggering_rules
+  stage: build
+  tags:
+    - windows
+    - amd64
  variables:
    VSCONF: Release
+  script:
+    - 'Push-Location "C:/Program Files (x86)/Microsoft Visual Studio/2017/BuildTools/VC/Auxiliary/Build"'
+    - '& cmd.exe /C "vcvarsall.bat x64 & set" | Foreach-Object { if ($_ -match "(.*?)=(.*)") { Set-Item -force -path "Env:\$($matches[1])" -value "$($matches[2])" } }'
+    - 'Pop-Location'
+    - 'Set-Location win32utils'
+    - '& "C:/Strawberry/perl/bin/perl.exe" Configure
+         "with-tools-version=15.0"
+         "with-platform-toolset=v141"
+         "with-platform-version=10.0.17763.0"
+         "with-vcredist=C:/Program Files (x86)/Microsoft Visual Studio/2017/BuildTools/VC/Redist/MSVC/14.16.27012/vcredist_x64.exe"
+         "with-openssl=C:/OpenSSL"
+         "with-libxml2=C:/libxml2"
+         "with-libuv=C:/libuv"
+         "without-python"
+         "with-system-tests"
+         x64'
+    - 'Set-Item -path "Env:CL" -value "/MP$([Math]::Truncate($BUILD_PARALLEL_JOBS/2))"'
+    - '& msbuild.exe /maxCpuCount:2 /t:Build /p:Configuration=$VSCONF bind9.sln'
+  dependencies: []
+  needs:
+    - autoreconf:sid:amd64
+  artifacts:
+    untracked: true
+    expire_in: "1 week"

 system:msvc:windows:amd64:
-  <<: *windows_system_test_job
+  stage: system
+  tags:
+    - windows
+    - amd64
  variables:
    VSCONF: Release
+  script:
+    - 'Push-Location bin/tests/system'
+    - '$ifIndex = Get-NetIPInterface -AddressFamily IPv4 -InterfaceMetric 75 | Select-Object -ExpandProperty ifIndex'
+    - '& C:/tools/cygwin/bin/sed.exe -i "s/^exit.*/netsh interface ipv4 set dnsservers $ifIndex dhcp/; s/\(name\|interface\)=Loopback/$ifIndex/;" ifconfig.bat'
+    - '& C:/tools/cygwin/bin/sed.exe -i "s/kill -f/kill -W/;" conf.sh stop.pl'
+    - '& cmd.exe /C ifconfig.bat up; ""'
+    - 'Start-Sleep 2'
+    - '$Env:Path = "C:/tools/cygwin/bin;$Env:Path"'
+    - '& sh.exe runall.sh $TEST_PARALLEL_JOBS'
+    - 'If (Test-Path C:/CrashDumps/*) { dir C:/CrashDumps; Throw }'
  dependencies:
    - msvc:windows:amd64
  needs: ["msvc:windows:amd64"]
-
-msvc-debug:windows:amd64:
-  <<: *windows_build_job
-  variables:
-    VSCONF: Debug
+  artifacts:
+    untracked: true
+    expire_in: "1 week"
+    when: on_failure
  only:
-    - schedules
    - tags
    - web
-
-system:msvc-debug:windows:amd64:
-  <<: *windows_system_test_job
-  variables:
-    VSCONF: Debug
-  dependencies:
-    - msvc-debug:windows:amd64
-  needs: ["msvc-debug:windows:amd64"]
-
-# Job producing a release tarball
-
-release:sid:amd64:
-  <<: *debian_sid_amd64_image
-  stage: release
-  script:
-    # Determine BIND version
-    - source version
-    - export BIND_DIRECTORY="bind-${MAJORVER}.${MINORVER}.${PATCHVER}${RELEASETYPE}${RELEASEVER}"
-    # Remove redundant files and system test utilities from Windows build artifacts
-    - find Build/Release/ -name "*.pdb" -print -delete
-    - find Build/Debug/ \( -name "*.bsc" -o -name "*.idb" \) -print -delete
-    - find Build/ -regextype posix-extended -regex "Build/.*/($(find bin/tests/ -type f | sed -nE "s|^bin/tests(/system)?/win32/(.*)\.vcxproj$|\2|p" | paste -d"|" -s))\..*" -print -delete
-    # Create Windows zips
-    - openssl dgst -sha256 "${BIND_DIRECTORY}.tar.${TARBALL_EXTENSION}" | tee Build/Release/SHA256 Build/Debug/SHA256
-    - ( cd Build/Release; zip "../../BIND${BIND_DIRECTORY#bind-}.x64.zip" * )
-    - ( cd Build/Debug; zip "../../BIND${BIND_DIRECTORY#bind-}.debug.x64.zip" * )
-    # Prepare release tarball contents (tarballs + zips + documentation)
-    - mkdir -p release/doc/arm
-    - pushd release
-    - mv "../${BIND_DIRECTORY}.tar.${TARBALL_EXTENSION}" ../BIND*.zip .
-    - tar --extract --file="${BIND_DIRECTORY}.tar.${TARBALL_EXTENSION}"
-    - mv "${BIND_DIRECTORY}"/{CHANGES*,COPYRIGHT,LICENSE,README,srcid} .
-    - mv "${BIND_DIRECTORY}"/doc/arm/{Bv9ARM{*.html,.pdf},man.*,notes.{html,pdf,txt}} doc/arm/
-    - rm -rf "${BIND_DIRECTORY}"
-    - cp doc/arm/notes.html "RELEASE-NOTES-${BIND_DIRECTORY}.html"
-    - cp doc/arm/notes.pdf "RELEASE-NOTES-${BIND_DIRECTORY}.pdf"
-    - cp doc/arm/notes.txt "RELEASE-NOTES-${BIND_DIRECTORY}.txt"
-    - popd
-    # Create release tarball
-    - tar --create --file="${CI_COMMIT_TAG}.tar.gz" --gzip release/
-  dependencies:
-    - tarball-create:sid:amd64
-    - msvc:windows:amd64
-    - msvc-debug:windows:amd64
-  only:
-    - tags
-  artifacts:
-    paths:
-      - "*.tar.gz"
-    expire_in: "1 week"
@@ -2,6 +2,8 @@

 **Tagging Deadline:**

+**ASN Deadline:**
+
 **Public Release:**

 ## Release Checklist
@@ -10,7 +12,6 @@

 - [ ] ***(QA)*** Check whether all issues assigned to the release milestone are resolved[^1].
 - [ ] ***(QA)*** Ensure that there are no outstanding merge requests in the private repository[^1] (Subscription Edition only).
- - [ ] ***(QA)*** Ensure all merge requests marked for backporting have been indeed backported.

 ## Before the Tagging Deadline

@@ -32,22 +33,21 @@

 ## Before the ASN Deadline (for ASN Releases) or the Public Release Date (for Regular Releases)

- - [ ] ***(QA)*** Verify GitLab CI results for the tags created and prepare a QA report for the releases to be published.
- - [ ] ***(QA)*** Request signatures for the tarballs, providing their location and checksums.
- - [ ] ***(Signers)*** Validate tarball checksums, sign tarballs, and upload signatures.
- - [ ] ***(QA)*** Verify tarball signatures and check tarball checksums again.
+ - [ ] ***(QA)*** Run the `make release` Jenkins jobs to produce the tarballs and zips.
+ - [ ] ***(QA)*** Verify the results of `make release` Jenkins jobs and prepare a QA report for the releases to be published.
+ - [ ] ***(QA)*** Request signatures for the tarballs.
+ - [ ] ***(Signers)*** Sign the tarballs.
+ - [ ] ***(QA)*** Check tarball signatures.
+ - [ ] ***(QA)*** Notify Support that the releases are ready for publication.
 - [ ] ***(Support)*** Pre-publish ASN and/or Subscription Edition tarballs so that packages can be built.
 - [ ] ***(QA)*** Build and test ASN and/or Subscription Edition packages.
- - [ ] ***(QA)*** Notify Support that the releases have been prepared.
 - [ ] ***(Support)*** Send out ASNs (if applicable).

 ## On the Day of Public Release

- - [ ] ***(Support)*** Wait for clearance from Security Officer to proceed with the public release (if applicable).
- - [ ] ***(Support)*** Place tarballs in public location on FTP site.
- - [ ] ***(Support)*** Publish links to downloads on ISC website.
- - [ ] ***(Support)*** Write release email to *bind-announce*.
- - [ ] ***(Support)*** Write email to *bind-users* (if a major release).
+ - [ ] ***(Support)*** Publish the releases according to the release schedule.
+ - [ ] ***(Support)*** Write release email to *bind9-announce*.
+ - [ ] ***(Support)*** Write email to *bind9-users* (if a major release).
 - [ ] ***(Support)*** Update tickets in case of waiting support customers.
 - [ ] ***(QA)*** Build and test any outstanding private packages.
 - [ ] ***(QA)*** Build public packages (`*.deb`, RPMs).
@@ -1,21 +1,13 @@
-5337.	[func]		'named -V' now reports maxminddb and protobuf-c
-			versions. [GL !2686]
-
-	--- 9.15.7 released ---
-
-5336.	[bug]		The TCP high-water statistic could report an
-			incorrect value on startup. [GL #1392]
-
 5335.	[func]		Make TCP listening code multithreaded. [GL !2659]

 5334.	[doc]		Update documentation with dnssec-policy clarifications.
-			Also change some defaults. [GL !2711]
+			Also change some defaults.

 5333.	[bug]		Fix duration printing on Solaris when value is not
 			an ISO 8601 duration. [GL #1460]

 5332.	[func]		Renamed "dnssec-keys" configuration statement
-			to the more descriptive "trust-anchors". [GL !2702]
+			to the more descriptive "trust-anchors".

 5331.	[func]		Use compiler-provided mechanisms for thread local
 			storage, and make the requirement for such mechanisms
@@ -34,7 +26,7 @@
 			dropped because the recursive-clients quota was
 			exceeded. [GL #1399]

-5326.	[bug]		Add Python dependency on 'distutils.core' to configure.
+5326.	[bug]		Add python dependancy on 'distutils.core' to configure.
 			'distutils.core' is required for installation.
 			[GL #1397]

@@ -1,4 +1,4 @@
-Copyright (C) 1996-2020  Internet Systems Consortium, Inc. ("ISC")
+Copyright (C) 1996-2019  Internet Systems Consortium, Inc. ("ISC")

 This Source Code Form is subject to the terms of the Mozilla Public
 License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -39,7 +39,7 @@ following systems:

  * Debian 9, 10
  * Ubuntu LTS 16.04, 18.04
-  * Fedora 31
+  * Fedora 30
  * Red Hat Enterprise Linux / CentOS 7, 8
  * FreeBSD 11.3, 12.0
  * OpenBSD 6.5
@@ -47,7 +47,7 @@ following systems:

 * Debian 9, 10
 * Ubuntu LTS 16.04, 18.04
-* Fedora 31
+* Fedora 30
 * Red Hat Enterprise Linux / CentOS 7, 8
 * FreeBSD 11.3, 12.0
 * OpenBSD 6.5
@@ -115,9 +115,9 @@ of changes from BIND 9.14 and earlier releases. New features include:
    for zones, enabling automatic key regeneration and rollover.
  * New new network manager based on libuv.
  * Support for the new GeoIP2 geolocation API
-  * Improved DNSSEC trust anchor configuration using the trust-anchors
-    statement, permitting configuration of trust anchors in DS as well as
-    DNSKEY format.
+  * Improved DNSSEC trust anchor configuration using dnssec-keys,
+    permitting configuration of trust anchors in DS as well as DNSKEY
+    format.
  * YAML output for dig, mdig, and delv.

 Building BIND
@@ -180,10 +180,9 @@ Dependencies

 Portions of BIND that are written in Python, including dnssec-keymgr,
 dnssec-coverage, dnssec-checkds, and some of the system tests, require the
-argparse, ply and distutils.core modules to be available. argparse is a
-standard module as of Python 2.7 and Python 3.2. ply is available from
-https://pypi.python.org/pypi/ply. distutils.core is required for
-installation.
+argparse and ply modules to be available. argparse is a standard module as
+of Python 2.7 and Python 3.2. ply is available from https://
+pypi.python.org/pypi/ply.

 Compile-time options

@@ -41,7 +41,6 @@
      <year>2016</year>
      <year>2018</year>
      <year>2019</year>
-      <year>2020</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -44,7 +44,6 @@
      <year>2016</year>
      <year>2018</year>
      <year>2019</year>
-      <year>2020</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -38,7 +38,6 @@
      <year>2016</year>
      <year>2018</year>
      <year>2019</year>
-      <year>2020</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -45,7 +45,6 @@
      <year>2017</year>
      <year>2018</year>
      <year>2019</year>
-      <year>2020</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -144,7 +144,7 @@ options\&.
 Note: When reading the trust anchor file,
 \fBdelv\fR
 treats
-\fBtrust\-anchors\fR\fBinitial\-key\fR
+\fBdnssec\-keys\fR\fBinitial\-key\fR
 and
 \fBstatic\-key\fR
 entries identically\&. That is, even if a key is configured with
@@ -40,7 +40,6 @@
      <year>2017</year>
      <year>2018</year>
      <year>2019</year>
-      <year>2020</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -197,7 +197,7 @@
 	  </p>
 	  <p>
 	    Note: When reading the trust anchor file,
-	    <span class="command"><strong>delv</strong></span> treats <code class="option">trust-anchors</code>
+	    <span class="command"><strong>delv</strong></span> treats <code class="option">dnssec-keys</code>
 	    <code class="option">initial-key</code> and <code class="option">static-key</code>
 	    entries identically.  That is, even if a key is configured
 	    with <span class="command"><strong>initial-key</strong></span>, indicating that it is
@@ -54,7 +54,7 @@

 dig_lookup_t *default_lookup = NULL;

-static atomic_uintptr_t batchname = ATOMIC_VAR_INIT(0);
+static char *batchname = NULL;
 static FILE *batchfp = NULL;
 static char *argv0;
 static int addresscount = 0;
@@ -1874,7 +1874,7 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 				value);
 		return (value_from_next);
 	case 'f':
-		atomic_store(&batchname, (uintptr_t)value);
+		batchname = value;
 		return (value_from_next);
 	case 'k':
 		strlcpy(keyfile, value, sizeof(keyfile));
@@ -2327,15 +2327,13 @@ parse_args(bool is_batchfile, bool config_only,
 	 * first entry, then trust the callback in dighost_shutdown
 	 * to get the rest
 	 */
-	char *filename = (char *)atomic_load(&batchname);
-	if ((filename != NULL) && !(is_batchfile)) {
-		if (strcmp(filename, "-") == 0) {
+	if ((batchname != NULL) && !(is_batchfile)) {
+		if (strcmp(batchname, "-") == 0)
 			batchfp = stdin;
-		} else {
-			batchfp = fopen(filename, "r");
-		}
+		else
+			batchfp = fopen(batchname, "r");
 		if (batchfp == NULL) {
-			perror(filename);
+			perror(batchname);
 			if (exitcode < 8)
 				exitcode = 8;
 			fatal("couldn't open specified batch file");
@@ -2390,14 +2388,14 @@ query_finished(void) {
 	int bargc;
 	char *bargv[16];

-	if (atomic_load(&batchname) == 0) {
+	if (batchname == NULL) {
 		isc_app_shutdown();
 		return;
 	}

 	fflush(stdout);
 	if (feof(batchfp)) {
-		atomic_store(&batchname, 0);
+		batchname = NULL;
 		isc_app_shutdown();
 		if (batchfp != stdin)
 			fclose(batchfp);
@@ -2411,7 +2409,7 @@ query_finished(void) {
 		parse_args(true, false, bargc, (char **)bargv);
 		start_lookup();
 	} else {
-		atomic_store(&batchname, 0);
+		batchname = NULL;
 		if (batchfp != stdin)
 			fclose(batchfp);
 		isc_app_shutdown();
@@ -2541,11 +2539,10 @@ void dig_query_start()
 void
 dig_shutdown() {
 	destroy_lookup(default_lookup);
-	if (atomic_load(&batchname) != 0) {
-		if (batchfp != stdin) {
+	if (batchname != NULL) {
+		if (batchfp != stdin)
 			fclose(batchfp);
-		}
-		atomic_store(&batchname, 0);
+		batchname = NULL;
 	}
 	cancel_all();
 	destroy_libs();
@@ -53,7 +53,6 @@
      <year>2017</year>
      <year>2018</year>
      <year>2019</year>
-      <year>2020</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -48,7 +48,6 @@
      <year>2017</year>
      <year>2018</year>
      <year>2019</year>
-      <year>2020</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -72,7 +72,6 @@
      <year>2017</year>
      <year>2018</year>
      <year>2019</year>
-      <year>2020</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -41,7 +41,6 @@
      <year>2017</year>
      <year>2018</year>
      <year>2019</year>
-      <year>2020</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -42,7 +42,6 @@
      <year>2016</year>
      <year>2018</year>
      <year>2019</year>
-      <year>2020</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -39,7 +39,6 @@
      <year>2016</year>
      <year>2018</year>
      <year>2019</year>
-      <year>2020</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -44,7 +44,6 @@
      <year>2017</year>
      <year>2018</year>
      <year>2019</year>
-      <year>2020</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -51,7 +51,6 @@
      <year>2017</year>
      <year>2018</year>
      <year>2019</year>
-      <year>2020</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -39,7 +39,6 @@
      <year>2016</year>
      <year>2018</year>
      <year>2019</year>
-      <year>2020</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -41,7 +41,6 @@
      <year>2017</year>
      <year>2018</year>
      <year>2019</year>
-      <year>2020</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -51,7 +51,6 @@
      <year>2017</year>
      <year>2018</year>
      <year>2019</year>
-      <year>2020</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -38,7 +38,6 @@
      <year>2016</year>
      <year>2018</year>
      <year>2019</year>
-      <year>2020</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -59,10 +59,6 @@
 #include <json_c_version.h>
 #endif /* HAVE_JSON_C */

-#ifdef HAVE_GEOIP2
-#include <maxminddb.h>
-#endif
-
 /*
 * Defining NAMED_MAIN provides storage declarations (rather than extern)
 * for variables in named/globals.h.
@@ -552,17 +548,6 @@ OPENSSL_VERSION_NUMBER >= 0x10100000L /* 1.1.0 or higher */
 	       ZLIB_VERSION);
 	printf("linked to zlib version: %s\n",
 	       zlibVersion());
-#endif
-#if defined(HAVE_GEOIP2)
-	/* Unfortunately, no version define on link time */
-	printf("linked to maxminddb version: %s\n",
-	       MMDB_lib_version());
-#endif
-#if defined(HAVE_DNSTAP)
-	printf("compiled with protobuf-c version: %s\n",
-	       PROTOBUF_C_VERSION);
-	printf("linked to protobuf-c version: %s\n",
-	       protobuf_c_version());
 #endif
 	printf("threads support is enabled\n\n");

@@ -97,6 +97,20 @@ dlz \fIstring\fR {
 .if n \{\
 .RE
 .\}
+.SH "DNSSEC-KEYS"
+.sp
+.if n \{\
+.RS 4
+.\}
+.nf
+dnssec\-keys { \fIstring\fR ( static\-key |
+    initial\-key | static\-ds | initial\-ds )
+    \fIinteger\fR \fIinteger\fR \fIinteger\fR
+    \fIquoted_string\fR; \&.\&.\&. };
+.fi
+.if n \{\
+.RE
+.\}
 .SH "DYNDB"
 .sp
 .if n \{\
@@ -150,7 +164,7 @@ logging {
 .\}
 .SH "MANAGED-KEYS"
 .PP
-Deprecated \- see TRUST\-ANCHORS\&.
+Deprecated \- see DNSSEC\-KEYS\&.
 .sp
 .if n \{\
 .RS 4
@@ -551,23 +565,9 @@ statistics\-channels {
 .if n \{\
 .RE
 .\}
-.SH "TRUST-ANCHORS"
-.sp
-.if n \{\
-.RS 4
-.\}
-.nf
-trust\-anchors { \fIstring\fR ( static\-key |
-    initial\-key | static\-ds | initial\-ds )
-    \fIinteger\fR \fIinteger\fR \fIinteger\fR
-    \fIquoted_string\fR; \&.\&.\&. };
-.fi
-.if n \{\
-.RE
-.\}
 .SH "TRUSTED-KEYS"
 .PP
-Deprecated \- see TRUST\-ANCHORS\&.
+Deprecated \- see DNSSEC\-KEYS\&.
 .sp
 .if n \{\
 .RS 4
@@ -655,6 +655,10 @@ view \fIstring\fR [ \fIclass\fR ] {
 	dnsrps\-options { \fIunspecified\-text\fR };
 	dnssec\-accept\-expired \fIboolean\fR;
 	dnssec\-dnskey\-kskonly \fIboolean\fR;
+	dnssec\-keys { \fIstring\fR ( static\-key |
+	    initial\-key | static\-ds | initial\-ds
+	    ) \fIinteger\fR \fIinteger\fR \fIinteger\fR
+	    \fIquoted_string\fR; \&.\&.\&. };
 	dnssec\-loadkeys\-interval \fIinteger\fR;
 	dnssec\-must\-be\-secure \fIstring\fR \fIboolean\fR;
 	dnssec\-secure\-to\-insecure \fIboolean\fR;
@@ -845,10 +849,6 @@ view \fIstring\fR [ \fIclass\fR ] {
 	transfer\-source\-v6 ( \fIipv6_address\fR | * ) [ port ( \fIinteger\fR | * )
 	    ] [ dscp \fIinteger\fR ];
 	trust\-anchor\-telemetry \fIboolean\fR; // experimental
-	trust\-anchors { \fIstring\fR ( static\-key |
-	    initial\-key | static\-ds | initial\-ds
-	    ) \fIinteger\fR \fIinteger\fR \fIinteger\fR
-	    \fIquoted_string\fR; \&.\&.\&. };
 	trusted\-keys { \fIstring\fR
 	    \fIinteger\fR \fIinteger\fR
 	    \fIinteger\fR
@@ -1074,7 +1074,7 @@ zone \fIstring\fR [ \fIclass\fR ] {
 .\}
 .nf
 dnssec\-policy \fIstring\fR {
-	dnskey\-ttl \fIduration\fR;
+	dnskey\-ttl \fIttlval\fR;
 	keys { ( csk | ksk | zsk ) key\-directory lifetime \fIduration\fR algorithm \fIinteger\fR [ \fIinteger\fR ] ; \&.\&.\&. };
 	parent\-ds\-ttl \fIduration\fR;
 	parent\-propagation\-delay \fIduration\fR;
@@ -49,7 +49,6 @@
      <year>2017</year>
      <year>2018</year>
      <year>2019</year>
-      <year>2020</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -92,7 +92,17 @@ dlz
  </div>

  <div class="refsection">
-<a name="id-1.11"></a><h2>DYNDB</h2>
+<a name="id-1.11"></a><h2>DNSSEC-KEYS</h2>
+    <div class="literallayout"><p><br>
+dnssec-keys { <em class="replaceable"><code>string</code></em> ( static-key |<br>
+    initial-key | static-ds | initial-ds )<br>
+    <em class="replaceable"><code>integer</code></em> <em class="replaceable"><code>integer</code></em> <em class="replaceable"><code>integer</code></em><br>
+    <em class="replaceable"><code>quoted_string</code></em>; ... };<br>
+</p></div>
+  </div>
+
+  <div class="refsection">
+<a name="id-1.12"></a><h2>DYNDB</h2>
    <div class="literallayout"><p><br>
 dyndb <em class="replaceable"><code>string</code></em> <em class="replaceable"><code>quoted_string</code></em> {<br>
     <em class="replaceable"><code>unspecified-text</code></em> };<br>
@@ -100,7 +110,7 @@ dyndb
  </div>

  <div class="refsection">
-<a name="id-1.12"></a><h2>KEY</h2>
+<a name="id-1.13"></a><h2>KEY</h2>
    <div class="literallayout"><p><br>
 key <em class="replaceable"><code>string</code></em> {<br>
 	algorithm <em class="replaceable"><code>string</code></em>;<br>
@@ -110,7 +120,7 @@ key
  </div>

  <div class="refsection">
-<a name="id-1.13"></a><h2>LOGGING</h2>
+<a name="id-1.14"></a><h2>LOGGING</h2>
    <div class="literallayout"><p><br>
 logging {<br>
 	category <em class="replaceable"><code>string</code></em> { <em class="replaceable"><code>string</code></em>; ... };<br>
@@ -131,8 +141,8 @@ logging
  </div>

  <div class="refsection">
-<a name="id-1.14"></a><h2>MANAGED-KEYS</h2>
-  <p>Deprecated - see TRUST-ANCHORS.</p>
+<a name="id-1.15"></a><h2>MANAGED-KEYS</h2>
+  <p>Deprecated - see DNSSEC-KEYS.</p>
    <div class="literallayout"><p><br>
 managed-keys { <em class="replaceable"><code>string</code></em> ( static-key<br>
     | initial-key | static-ds |<br>
@@ -142,7 +152,7 @@ managed-keys
  </div>

  <div class="refsection">
-<a name="id-1.15"></a><h2>MASTERS</h2>
+<a name="id-1.16"></a><h2>MASTERS</h2>
    <div class="literallayout"><p><br>
 masters <em class="replaceable"><code>string</code></em> [ port <em class="replaceable"><code>integer</code></em> ] [ dscp<br>
     <em class="replaceable"><code>integer</code></em> ] { ( <em class="replaceable"><code>masters</code></em> | <em class="replaceable"><code>ipv4_address</code></em> [<br>
@@ -152,7 +162,7 @@ masters
  </div>

  <div class="refsection">
-<a name="id-1.16"></a><h2>OPTIONS</h2>
+<a name="id-1.17"></a><h2>OPTIONS</h2>
    <div class="literallayout"><p><br>
 options {<br>
 	allow-new-zones <em class="replaceable"><code>boolean</code></em>;<br>
@@ -451,7 +461,7 @@ options
  </div>

  <div class="refsection">
-<a name="id-1.17"></a><h2>PLUGIN</h2>
+<a name="id-1.18"></a><h2>PLUGIN</h2>
    <div class="literallayout"><p><br>
 plugin ( query ) <em class="replaceable"><code>string</code></em> [ { <em class="replaceable"><code>unspecified-text</code></em><br>
     } ];<br>
@@ -459,7 +469,7 @@ plugin
  </div>

  <div class="refsection">
-<a name="id-1.18"></a><h2>SERVER</h2>
+<a name="id-1.19"></a><h2>SERVER</h2>
    <div class="literallayout"><p><br>
 server <em class="replaceable"><code>netprefix</code></em> {<br>
 	bogus <em class="replaceable"><code>boolean</code></em>;<br>
@@ -497,7 +507,7 @@ server
  </div>

  <div class="refsection">
-<a name="id-1.19"></a><h2>STATISTICS-CHANNELS</h2>
+<a name="id-1.20"></a><h2>STATISTICS-CHANNELS</h2>
    <div class="literallayout"><p><br>
 statistics-channels {<br>
 	inet ( <em class="replaceable"><code>ipv4_address</code></em> | <em class="replaceable"><code>ipv6_address</code></em> |<br>
@@ -508,19 +518,9 @@ statistics-channels
 </p></div>
  </div>

-  <div class="refsection">
-<a name="id-1.20"></a><h2>TRUST-ANCHORS</h2>
-    <div class="literallayout"><p><br>
-trust-anchors { <em class="replaceable"><code>string</code></em> ( static-key |<br>
-    initial-key | static-ds | initial-ds )<br>
-    <em class="replaceable"><code>integer</code></em> <em class="replaceable"><code>integer</code></em> <em class="replaceable"><code>integer</code></em><br>
-    <em class="replaceable"><code>quoted_string</code></em>; ... };<br>
-</p></div>
-  </div>
-
  <div class="refsection">
 <a name="id-1.21"></a><h2>TRUSTED-KEYS</h2>
-  <p>Deprecated - see TRUST-ANCHORS.</p>
+  <p>Deprecated - see DNSSEC-KEYS.</p>
    <div class="literallayout"><p><br>
 trusted-keys { <em class="replaceable"><code>string</code></em> <em class="replaceable"><code>integer</code></em><br>
     <em class="replaceable"><code>integer</code></em> <em class="replaceable"><code>integer</code></em><br>
@@ -600,6 +600,10 @@ view
 	dnsrps-options { <em class="replaceable"><code>unspecified-text</code></em> };<br>
 	dnssec-accept-expired <em class="replaceable"><code>boolean</code></em>;<br>
 	dnssec-dnskey-kskonly <em class="replaceable"><code>boolean</code></em>;<br>
+	dnssec-keys { <em class="replaceable"><code>string</code></em> ( static-key |<br>
+	    initial-key | static-ds | initial-ds<br>
+	    ) <em class="replaceable"><code>integer</code></em> <em class="replaceable"><code>integer</code></em> <em class="replaceable"><code>integer</code></em><br>
+	    <em class="replaceable"><code>quoted_string</code></em>; ... };<br>
 	dnssec-loadkeys-interval <em class="replaceable"><code>integer</code></em>;<br>
 	dnssec-must-be-secure <em class="replaceable"><code>string</code></em> <em class="replaceable"><code>boolean</code></em>;<br>
 	dnssec-secure-to-insecure <em class="replaceable"><code>boolean</code></em>;<br>
@@ -790,10 +794,6 @@ view
 	transfer-source-v6 ( <em class="replaceable"><code>ipv6_address</code></em> | * ) [ port ( <em class="replaceable"><code>integer</code></em> | * )<br>
 	    ] [ dscp <em class="replaceable"><code>integer</code></em> ];<br>
 	trust-anchor-telemetry <em class="replaceable"><code>boolean</code></em>; // experimental<br>
-	trust-anchors { <em class="replaceable"><code>string</code></em> ( static-key |<br>
-	    initial-key | static-ds | initial-ds<br>
-	    ) <em class="replaceable"><code>integer</code></em> <em class="replaceable"><code>integer</code></em> <em class="replaceable"><code>integer</code></em><br>
-	    <em class="replaceable"><code>quoted_string</code></em>; ... };<br>
 	trusted-keys { <em class="replaceable"><code>string</code></em><br>
 	    <em class="replaceable"><code>integer</code></em> <em class="replaceable"><code>integer</code></em><br>
 	    <em class="replaceable"><code>integer</code></em><br>
@@ -1012,7 +1012,7 @@ zone

    <div class="literallayout"><p><br>
 dnssec-policy <em class="replaceable"><code>string</code></em> {<br>
-	dnskey-ttl <em class="replaceable"><code>duration</code></em>;<br>
+	dnskey-ttl <em class="replaceable"><code>ttlval</code></em>;<br>
 	keys { ( csk | ksk | zsk ) key-directory lifetime <em class="replaceable"><code>duration</code></em> algorithm <em class="replaceable"><code>integer</code></em> [ <em class="replaceable"><code>integer</code></em> ] ; ... };<br>
 	parent-ds-ttl <em class="replaceable"><code>duration</code></em>;<br>
 	parent-propagation-delay <em class="replaceable"><code>duration</code></em>;<br>
@@ -49,7 +49,6 @@
      <year>2017</year>
      <year>2018</year>
      <year>2019</year>
-      <year>2020</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -50,7 +50,6 @@
      <year>2017</year>
      <year>2018</year>
      <year>2019</year>
-      <year>2020</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -124,7 +124,7 @@ main(int argc, char *argv[]) {
 	if (errflg || (id && (label != NULL))) {
 		fprintf(stderr, "Usage:\n");
 		fprintf(stderr, "\tpkcs11-destroy [-m module] [-s slot] "
-				"{-i id | -l label} [-p pin] [-w waittime]\n");
+				"[-i id | -l label] [-p pin] [-w waittime]\n");
 		exit(1);
 	}

@@ -38,7 +38,6 @@
      <year>2016</year>
      <year>2018</year>
      <year>2019</year>
-      <year>2020</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -39,7 +39,6 @@
      <year>2017</year>
      <year>2018</year>
      <year>2019</year>
-      <year>2020</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -38,7 +38,6 @@
      <year>2016</year>
      <year>2018</year>
      <year>2019</year>
-      <year>2020</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -37,7 +37,6 @@
      <year>2016</year>
      <year>2018</year>
      <year>2019</year>
-      <year>2020</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -33,7 +33,6 @@
    <copyright>
      <year>2018</year>
      <year>2019</year>
-      <year>2020</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -40,7 +40,6 @@
      <year>2017</year>
      <year>2018</year>
      <year>2019</year>
-      <year>2020</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -38,7 +38,6 @@
      <year>2016</year>
      <year>2018</year>
      <year>2019</year>
-      <year>2020</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -35,7 +35,6 @@
      <year>2017</year>
      <year>2018</year>
      <year>2019</year>
-      <year>2020</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -516,7 +516,7 @@ timer\&.
 \fBsecroots \fR\fB[\-]\fR\fB \fR\fB[\fIview \&.\&.\&.\fR]\fR
 .RS 4
 Dump the security roots (i\&.e\&., trust anchors configured via
-\fBtrust\-anchors\fR
+\fBdnssec\-keys\fR
 statements, or the managed\-keys or trusted\-keys statements (both deprecated), or via
 \fBdnssec\-validation auto\fR) and negative trust anchors for the specified views\&. If no view is specified, all views are dumped\&. Security roots will indicate whether they are configured as trusted keys, managed keys, or initializing managed keys (managed keys that have not yet been updated by a successful key refresh query)\&.
 .sp
@@ -43,7 +43,6 @@
      <year>2016</year>
      <year>2018</year>
      <year>2019</year>
-      <year>2020</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -44,7 +44,6 @@
      <year>2017</year>
      <year>2018</year>
      <year>2019</year>
-      <year>2020</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -654,7 +654,7 @@
 <dd>
 	  <p>
 	    Dump the security roots (i.e., trust anchors
-	    configured via <span class="command"><strong>trust-anchors</strong></span> statements, or the
+	    configured via <span class="command"><strong>dnssec-keys</strong></span> statements, or the
 	    managed-keys or trusted-keys statements (both deprecated), or
 	    via <span class="command"><strong>dnssec-validation auto</strong></span>) and negative trust
 	    anchors for the specified views.  If no view is specified, all
@@ -117,12 +117,8 @@ checkjitter () {
 	echo_i "checking whether all frequencies fall into <$_low;$_high> range"
 	for _num in $_expiretimes
 	do
-		if [ $_num -gt $_high ]; then
-			echo_i "error: too many RRSIG records ($_num) in expiration bucket"
-			_ret=1
-		fi
-		if [ $_num -lt $_low ]; then
-			echo_i "error: too few RRSIG records ($_num) in expiration bucket"
+		if [ $_num -gt $_high ] || [ $_num -lt $_low ]; then
+			echo_i "error: too many RRSIG records ($_num) with the same expiration time"
 			_ret=1
 		fi
 	done
@@ -1055,10 +1051,7 @@ check_if_nsec3param_exists() {
 	$DIG $DIGOPTS NSEC3PARAM jitter.nsec3.example @10.53.0.3 > dig.out.ns3.1.test$n || return 1
 	grep -q "^jitter\.nsec3\.example\..*NSEC3PARAM" dig.out.ns3.1.test$n || return 1
 }
-retry_quiet 40 check_if_nsec3param_exists || {
-	echo_i "error: NSEC3PARAM not present yet"
-	ret=1
-}
+retry_quiet 20 check_if_nsec3param_exists || ret=1
 $DIG $DIGOPTS AXFR jitter.nsec3.example @10.53.0.3 > dig.out.ns3.2.test$n || ret=1
 # Check jitter distribution.
 checkjitter dig.out.ns3.2.test$n || ret=1
@@ -38,7 +38,7 @@ _wait_for_rcode() (
 	ns="$3"
 	qname="$4"
 	file="$5"
-	shift 5
+	shift 4
 	dig_with_opts "$ns" "$qtype" "$qname" "$@" >"$file" || return 1
 	grep "status: $rcode" "$file" >/dev/null
 )
@@ -161,7 +161,7 @@ count_sent() (
 	logfile="$1"
 	start_pattern="$2"
 	pattern="$3"
-	nextpartpeek "$logfile" | tr -d '\r' | sed -n "/$start_pattern/,/^\$/p" | grep -c "$pattern"
+	nextpartpeek "$logfile" | sed -n "/$start_pattern/,/^\$/p" | grep -c "$pattern"
 )

 check_sent() (
@@ -252,19 +252,16 @@ idna_enabled_test() {
    #            is displayed as the corresponding A-label.
    #
    # The "+[no]idnout" flag has no effect in these cases.
-    saved_LC_ALL="${LC_ALL}"
-    LC_ALL="C"
    text="Checking valid A-label in C locale"
    label="xn--nxasmq6b.com"
-    if command -v idn2 >/dev/null && ! idn2 -d "$label" >/dev/null 2>/dev/null; then
-	idna_test "$text" ""                   "$label" "$label."
-	idna_test "$text" "+noidnin +noidnout" "$label" "$label."
-	idna_test "$text" "+noidnin +idnout"   "$label" "$label."
-	idna_test "$text" "+idnin +noidnout"   "$label" "$label."
-	idna_test "$text" "+idnin +idnout"     "$label" "$label."
-	idna_test "$text" "+noidnin +idnout"   "$label" "$label."
+    if command -v idn2 >/dev/null && ! LC_ALL=C idn2 -d "$label" >/dev/null 2>/dev/null; then
+	LC_ALL=C idna_test "$text" ""                   "$label" "$label."
+	LC_ALL=C idna_test "$text" "+noidnin +noidnout" "$label" "$label."
+	LC_ALL=C idna_test "$text" "+noidnin +idnout"   "$label" "$label."
+	LC_ALL=C idna_test "$text" "+idnin +noidnout"   "$label" "$label."
+	LC_ALL=C idna_test "$text" "+idnin +idnout"     "$label" "$label."
+	LC_ALL=C idna_test "$text" "+noidnin +idnout"   "$label" "$label."
    fi
-    LC_ALL="${saved_LC_ALL}"



@@ -15,12 +15,6 @@ SYSTEMTESTTOP=..
 DIGOPTS="+tcp +dnssec -p ${PORT}"
 RNDCCMD="$RNDC -c $SYSTEMTESTTOP/common/rndc.conf -p ${CONTROLPORT} -s"

-wait_for_serial() (
-    $DIG $DIGOPTS "@$1" "$2" SOA > "$4"
-    serial=$(awk '$4 == "SOA" { print $7 }' "$4")
-    [ "$3" -eq "${serial:--1}" ]
-)
-
 status=0
 n=0

@@ -1020,7 +1014,10 @@ ret=0
 $DIG $DIGOPTS nsec3. SOA @10.53.0.3 > dig.out.n3.pre.test$n
 newserial=`$PERL -e 'while (<>) { chomp; my @field = split /\s+/; printf("%u\n", $field[6] + 10) if ($field[3] eq "SOA"); }' < dig.out.n3.pre.test$n`
 $RNDCCMD 10.53.0.3 signing -serial ${newserial:-0} nsec3 > /dev/null 2>&1
-retry_quiet 5 wait_for_serial 10.53.0.3 nsec3. "${newserial:-0}" dig.out.ns3.post.test$n || ret=1
+sleep 1
+$DIG $DIGOPTS nsec3. SOA @10.53.0.3 > dig.out.ns3.post.test$n
+serial=`awk '$4 == "SOA" { print $7 }' dig.out.ns3.post.test$n`
+[ ${newserial:-0} -eq ${serial:-1} ] || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

@@ -1050,7 +1047,10 @@ newserial=`$PERL -e 'while (<>) { chomp; my @field = split /\s+/; printf("%u\n",
 $RNDCCMD 10.53.0.3 freeze nsec3 > /dev/null 2>&1
 $RNDCCMD 10.53.0.3 signing -serial ${newserial:-0} nsec3 > /dev/null 2>&1
 $RNDCCMD 10.53.0.3 thaw nsec3 > /dev/null 2>&1
-retry_quiet 5 wait_for_serial 10.53.0.3 nsec3. "${newserial:-0}" dig.out.ns3.post1.test$n || ret=1
+sleep 1
+$DIG $DIGOPTS nsec3. SOA @10.53.0.3 > dig.out.ns3.post.test$n
+serial=`awk '$4 == "SOA" { print $7 }' dig.out.ns3.post.test$n`
+[ ${newserial:-0} -eq ${serial:-1} ] || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

@@ -1060,7 +1060,10 @@ ret=0
 $DIG $DIGOPTS bits. SOA @10.53.0.2 > dig.out.ns2.pre.test$n
 newserial=`$PERL -e 'while (<>) { chomp; my @field = split /\s+/; printf("%u\n", $field[6] + 10) if ($field[3] eq "SOA"); }' < dig.out.ns2.pre.test$n`
 $RNDCCMD 10.53.0.2 signing -serial ${newserial:-0} bits > /dev/null 2>&1
-retry_quiet 5 wait_for_serial 10.53.0.2 bits. "${newserial:-0}" dig.out.ns2.post.test$n || ret=1
+sleep 1
+$DIG $DIGOPTS bits. SOA @10.53.0.2 > dig.out.ns2.post.test$n
+serial=`awk '$4 == "SOA" { print $7 }' dig.out.ns2.post.test$n`
+[ ${newserial:-0} -eq ${serial:-1} ] || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

@@ -1071,8 +1074,10 @@ $DIG $DIGOPTS bits. SOA @10.53.0.2 > dig.out.ns2.pre.test$n
 oldserial=`awk '$4 == "SOA" { print $7 }' dig.out.ns2.pre.test$n`
 newserial=`$PERL -e 'while (<>) { chomp; my @field = split /\s+/; printf("%u\n", $field[6] - 10) if ($field[3] eq "SOA"); }' < dig.out.ns2.pre.test$n`
 $RNDCCMD 10.53.0.2 signing -serial ${newserial:-0} bits > /dev/null 2>&1
-retry_quiet 5 wait_for_serial 10.53.0.2 bits. "${newserial:-1}" dig.out.ns2.post1.test$n && ret=1
-retry_quiet 5 wait_for_serial 10.53.0.2 bits. "${oldserial:-1}" dig.out.ns2.post2.test$n || ret=1
+sleep 1
+$DIG $DIGOPTS bits. SOA @10.53.0.2 > dig.out.ns2.post.test$n
+serial=`awk '$4 == "SOA" { print $7 }' dig.out.ns2.post.test$n`
+[ ${oldserial:-0} -eq ${serial:-1} ] || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

@@ -1085,8 +1090,10 @@ newserial=`$PERL -e 'while (<>) { chomp; my @field = split /\s+/; printf("%u\n",
 $RNDCCMD 10.53.0.2 freeze bits > /dev/null 2>&1
 $RNDCCMD 10.53.0.2 signing -serial ${newserial:-0} bits > /dev/null 2>&1
 $RNDCCMD 10.53.0.2 thaw bits > /dev/null 2>&1
-retry_quiet 5 wait_for_serial 10.53.0.2 bits. "${newserial:-1}" dig.out.ns2.post1.test$n && ret=1
-retry_quiet 5 wait_for_serial 10.53.0.2 bits. "${oldserial:-1}" dig.out.ns2.post2.test$n || ret=1
+sleep 1
+$DIG $DIGOPTS bits. SOA @10.53.0.2 > dig.out.ns2.post.test$n
+serial=`awk '$4 == "SOA" { print $7 }' dig.out.ns2.post.test$n`
+[ ${oldserial:-0} -eq ${serial:-1} ] || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

@@ -1332,12 +1339,18 @@ ret=0
 mv Kdelayedkeys* ns3/
 $RNDCCMD 10.53.0.3 loadkeys delayedkeys > rndc.out.ns3.pre.test$n 2>&1 || ret=1
 # Wait until the zone is signed.
-check_done_signing () (
-    $RNDCCMD 10.53.0.3 signing -list delayedkeys > signing.out.test$n 2>&1
-    num=`grep "Done signing with" signing.out.test$n | wc -l`
-    [ $num -eq 2 ]
-)
-retry_quiet 10 check_done_signing || ret=1
+ans=1
+for i in 1 2 3 4 5 6 7 8 9 10
+do
+	$RNDCCMD 10.53.0.3 signing -list delayedkeys > signing.out.test$n 2>&1
+	num=`grep "Done signing with" signing.out.test$n | wc -l`
+	if [ $num -eq 2 ]; then
+		ans=0
+		break
+	fi
+	sleep 1
+done
+if [ $ans != 0 ]; then ret=1; fi
 # Halt rather than stopping the server to prevent the master file from being
 # flushed upon shutdown since we specifically want to avoid it.
 $PERL $SYSTEMTESTTOP/stop.pl --use-rndc --halt --port ${CONTROLPORT} inline ns3
@@ -1356,7 +1369,6 @@ $PERL $SYSTEMTESTTOP/start.pl --noclean --restart --port ${PORT} inline ns3
 # unless the records contained in it were scheduled for resigning, no resigning
 # event will be scheduled at all since the secure zone master file contains no
 # DNSSEC records.
-wait_for_log 20 "all zones loaded" ns3/named.run || ret=1
 $RNDCCMD 10.53.0.3 zonestatus delayedkeys > rndc.out.ns3.post.test$n 2>&1 || ret=1
 grep "next resign node:" rndc.out.ns3.post.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
@@ -196,7 +196,7 @@ if [ $status != 0 ]; then
 else
    core_dumps="$(find $systest/ -name 'core*' -or -name '*.core' | sort | tr '\n' ' ')"
    assertion_failures=$(find $systest/ -name named.run | xargs grep "assertion failure" | wc -l)
-    sanitizer_summaries=$(find $systest/ -name 'tsan.*' | wc -l)
+    sanitizer_summaries=$(find $systest/ -type f | grep '^[-a-zA-Z0-9./_]*$' | xargs grep "SUMMARY: .*Sanitizer" | wc -l)
    if [ -n "$core_dumps" ]; then
        echoinfo "I:$systest:Test claims success despite crashes: $core_dumps"
        echofail "R:$systest:FAIL"
@@ -214,9 +214,7 @@ else
 		echoinfo "D:$systest:backtrace from $coredump end"
 	done
    elif [ $assertion_failures -ne 0 ]; then
-	SYSTESTDIR="$systest"
        echoinfo "I:$systest:Test claims success despite $assertion_failures assertion failure(s)"
-	grep "SUMMARY: " $(find $systest/ -name 'tsan.*') | sort -u | cat_d
        echofail "R:$systest:FAIL"
        # Do not clean up - we need the evidence.
    elif [ $sanitizer_summaries -ne 0 ]; then
@@ -204,7 +204,7 @@ if [ "$(id -u)" -eq 0 ] && [ -z "$CYGWIN" ]; then
    if [ "$?" -eq 0 ]; then
        copy_setports ns2/named-alt9.conf.in "${TEMP_NAMED_DIR}/named-alt9.conf"
        export SOFTHSM2_CONF="${TEMP_NAMED_DIR}/softhsm2.conf"
-        sh "$TOP/bin/tests/prepare-softhsm2.sh"
+        sh "$TOP/util/prepare-softhsm2.sh"
        chown -R nobody: "${TEMP_NAMED_DIR}"
        chmod 0700 "${TEMP_NAMED_DIR}"
        ( cd "${TEMP_NAMED_DIR}" && $NAMED -u nobody -c named-alt9.conf -d 99 -g -U 4 >> named$n.run 2>&1 & ) || ret=1
@@ -230,6 +230,9 @@ sub construct_ns_command {
 		}

 		$command .= "$NAMED -m none -M external ";
+	} elsif ($ENV{'USE_RR'}) {
+		$ENV{'_RR_TRACE_DIR'} = $testdir . "/" . $server . "/";
+		$command = "rr record -h $NAMED -n 4 ";
 	} else {
 		$command = "$NAMED ";
 	}
@@ -105,10 +105,6 @@ echo_i "TCP high-water: check initial statistics ($n)"
 ret=0
 refresh_tcp_stats
 assert_int_equal "${TCP_CUR}" 0 "current TCP clients count" || ret=1
-# We compare initial tcp-highwater value with 1 because as part of the
-# system test startup, the script start.pl executes dig to check if target
-# named is running, and that increments tcp-quota by one.
-assert_int_equal "${TCP_HIGH}" 1 "tcp-highwater count" || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))

@@ -18,58 +18,53 @@ RNDCCMD="$RNDC -c $SYSTEMTESTTOP/common/rndc.conf -p ${CONTROLPORT} -s"
 status=0
 n=0

-n=$((n+1))
-echo_i "testing basic zone transfer functionality (from primary) ($n)"
+n=`expr $n + 1`
+echo_i "testing basic zone transfer functionality"
+$DIG $DIGOPTS example. \
+	@10.53.0.2 axfr > dig.out.ns2 || status=1
+grep "^;" dig.out.ns2 | cat_i
+
+#
+# Spin to allow the zone to tranfer.
+#
+for i in 1 2 3 4 5
+do
 tmp=0
 $DIG $DIGOPTS example. \
-	@10.53.0.2 axfr > dig.out.ns2.test$n || tmp=1
-grep "^;" dig.out.ns2.test$n | cat_i
-
-digcomp dig1.good dig.out.ns2.test$n || tmp=1
-
-if test $tmp != 0 ; then echo_i "failed"; fi
-status=$((status+tmp))
-
-n=$((n+1))
-echo_i "testing basic zone transfer functionality (from secondary) ($n)"
-#
-# Spin to allow the zone to tranfer.
-#
-for i in 1 2 3 4 5
-do
-    tmp=0
-    $DIG $DIGOPTS example. \
-	@10.53.0.3 axfr > dig.out.ns3.test$n || tmp=1
-    grep "^;" dig.out.ns3.test$n > /dev/null || break
-    echo_i "plain zone re-transfer"
-    sleep 5
-done
-grep "^;" dig.out.ns3.test$n | cat_i
-digcomp dig1.good dig.out.ns3.test$n || tmp=1
-if test $tmp != 0 ; then echo_i "failed"; fi
-status=$((status+tmp))
-
-n=$((n+1))
-echo_i "testing TSIG signed zone transfers ($n)"
-$DIG $DIGOPTS tsigzone. @10.53.0.2 axfr -y tsigzone.:1234abcd8765 > dig.out.ns2.test$n || status=1
-grep "^;" dig.out.ns2.test$n | cat_i
-
-#
-# Spin to allow the zone to tranfer.
-#
-for i in 1 2 3 4 5
-do
-tmp=0
-	$DIG $DIGOPTS tsigzone. @10.53.0.3 axfr -y tsigzone.:1234abcd8765 > dig.out.ns3.test$n || tmp=1
-	grep "^;" dig.out.ns3.test$n > /dev/null
+	@10.53.0.3 axfr > dig.out.ns3 || tmp=1
+	grep "^;" dig.out.ns3 > /dev/null
 	if test $? -ne 0 ; then break; fi
 	echo_i "plain zone re-transfer"
 	sleep 5
 done
 if test $tmp -eq 1 ; then status=1; fi
-grep "^;" dig.out.ns3.test$n | cat_i
+grep "^;" dig.out.ns3 | cat_i

-digcomp dig.out.ns2.test$n dig.out.ns3.test$n || status=1
+digcomp dig1.good dig.out.ns2 || status=1
+
+digcomp dig1.good dig.out.ns3 || status=1
+
+n=`expr $n + 1`
+echo_i "testing TSIG signed zone transfers"
+$DIG $DIGOPTS tsigzone. @10.53.0.2 axfr -y tsigzone.:1234abcd8765 > dig.out.ns2 || status=1
+grep "^;" dig.out.ns2 | cat_i
+
+#
+# Spin to allow the zone to tranfer.
+#
+for i in 1 2 3 4 5
+do
+tmp=0
+	$DIG $DIGOPTS tsigzone. @10.53.0.3 axfr -y tsigzone.:1234abcd8765 > dig.out.ns3 || tmp=1
+	grep "^;" dig.out.ns3 > /dev/null
+	if test $? -ne 0 ; then break; fi
+	echo_i "plain zone re-transfer"
+	sleep 5
+done
+if test $tmp -eq 1 ; then status=1; fi
+grep "^;" dig.out.ns3 | cat_i
+
+digcomp dig.out.ns2 dig.out.ns3 || status=1

 echo_i "reload servers for in preparation for ixfr-from-differences tests"

@@ -113,29 +108,28 @@ rndc_reload ns7 10.53.0.7

 sleep 3

-n=$((n+1))
-echo_i "testing zone is dumped after successful transfer ($n)"
+echo_i "testing zone is dumped after successful transfer"
 $DIG $DIGOPTS +noall +answer +multi @10.53.0.2 \
-	slave. soa > dig.out.ns2.test$n || tmp=1
-grep "1397051952 ; serial" dig.out.ns2.test$n > /dev/null 2>&1 || tmp=1
+	slave. soa > dig.out.ns2 || tmp=1
+grep "1397051952 ; serial" dig.out.ns2 > /dev/null 2>&1 || tmp=1
 grep "1397051952 ; serial" ns2/slave.db > /dev/null 2>&1 || tmp=1
 if test $tmp != 0 ; then echo_i "failed"; fi
-status=$((status+tmp))
+status=`expr $status + $tmp`

-n=$((n+1))
-echo_i "testing ixfr-from-differences yes; ($n)"
+n=`expr $n + 1`
+echo_i "testing ixfr-from-differences yes;"
 tmp=0

 for i in 0 1 2 3 4 5 6 7 8 9
 do
 	a=0 b=0 c=0 d=0
 	echo_i "wait for reloads..."
-	$DIG $DIGOPTS @10.53.0.6 +noall +answer soa master > dig.out.soa1.ns6.test$n
-	grep "1397051953" dig.out.soa1.ns6.test$n > /dev/null && a=1
-	$DIG $DIGOPTS @10.53.0.1 +noall +answer soa slave  > dig.out.soa2.ns1.test$n
-	grep "1397051953" dig.out.soa2.ns1.test$n > /dev/null && b=1
-	$DIG $DIGOPTS @10.53.0.2 +noall +answer soa example > dig.out.soa3.ns2.test$n
-	grep "1397051953" dig.out.soa3.ns2.test$n > /dev/null && c=1
+	$DIG $DIGOPTS @10.53.0.6 +noall +answer soa master > dig.out.soa1.ns6
+	grep "1397051953" dig.out.soa1.ns6 > /dev/null && a=1
+	$DIG $DIGOPTS @10.53.0.1 +noall +answer soa slave  > dig.out.soa2.ns1
+	grep "1397051953" dig.out.soa2.ns1 > /dev/null && b=1
+	$DIG $DIGOPTS @10.53.0.2 +noall +answer soa example > dig.out.soa3.ns2
+	grep "1397051953" dig.out.soa3.ns2 > /dev/null && c=1
 	[ $a -eq 1 -a $b -eq 1 -a $c -eq 1 ] && break
 	sleep 2
 done
@@ -144,12 +138,12 @@ for i in 0 1 2 3 4 5 6 7 8 9
 do
 	a=0 b=0 c=0 d=0
 	echo_i "wait for transfers..."
-	$DIG $DIGOPTS @10.53.0.3 +noall +answer soa example > dig.out.soa1.ns3.test$n
-	grep "1397051953" dig.out.soa1.ns3.test$n > /dev/null && a=1
-	$DIG $DIGOPTS @10.53.0.3 +noall +answer soa master > dig.out.soa2.ns3.test$n
-	grep "1397051953" dig.out.soa2.ns3.test$n > /dev/null && b=1
-	$DIG $DIGOPTS @10.53.0.6 +noall +answer soa slave  > dig.out.soa3.ns6.test$n
-	grep "1397051953" dig.out.soa3.ns6.test$n > /dev/null && c=1
+	$DIG $DIGOPTS @10.53.0.3 +noall +answer soa example > dig.out.soa1.ns3
+	grep "1397051953" dig.out.soa1.ns3 > /dev/null && a=1
+	$DIG $DIGOPTS @10.53.0.3 +noall +answer soa master > dig.out.soa2.ns3
+	grep "1397051953" dig.out.soa2.ns3 > /dev/null && b=1
+	$DIG $DIGOPTS @10.53.0.6 +noall +answer soa slave  > dig.out.soa3.ns6
+	grep "1397051953" dig.out.soa3.ns6 > /dev/null && c=1
 	[ $a -eq 1 -a $b -eq 1 -a $c -eq 1 ] && break

 	# re-notify if necessary
@@ -160,62 +154,62 @@ do
 done

 $DIG $DIGOPTS example. \
-	@10.53.0.3 axfr > dig.out.ns3.test$n || tmp=1
-grep "^;" dig.out.ns3.test$n | cat_i
+	@10.53.0.3 axfr > dig.out.ns3 || tmp=1
+grep "^;" dig.out.ns3 | cat_i

-digcomp dig2.good dig.out.ns3.test$n || tmp=1
+digcomp dig2.good dig.out.ns3 || tmp=1

 # ns3 has a journal iff it received an IXFR.
 test -f ns3/example.bk || tmp=1
 test -f ns3/example.bk.jnl || tmp=1

 if test $tmp != 0 ; then echo_i "failed"; fi
-status=$((status+tmp))
+status=`expr $status + $tmp`

-n=$((n+1))
-echo_i "testing ixfr-from-differences master; (master zone) ($n)"
+n=`expr $n + 1`
+echo_i "testing ixfr-from-differences master; (master zone)"
 tmp=0

 $DIG $DIGOPTS master. \
-	@10.53.0.6 axfr > dig.out.ns6.test$n || tmp=1
-grep "^;" dig.out.ns6.test$n | cat_i
+	@10.53.0.6 axfr > dig.out.ns6 || tmp=1
+grep "^;" dig.out.ns6 | cat_i

 $DIG $DIGOPTS master. \
-	@10.53.0.3 axfr > dig.out.ns3.test$n || tmp=1
-grep "^;" dig.out.ns3.test$n > /dev/null && cat_i dig.out.ns3.test$n
+	@10.53.0.3 axfr > dig.out.ns3 || tmp=1
+grep "^;" dig.out.ns3 > /dev/null && cat_i dig.out.ns3

-digcomp dig.out.ns6.test$n dig.out.ns3.test$n || tmp=1
+digcomp dig.out.ns6 dig.out.ns3 || tmp=1

 # ns3 has a journal iff it received an IXFR.
 test -f ns3/master.bk || tmp=1
 test -f ns3/master.bk.jnl || tmp=1

 if test $tmp != 0 ; then echo_i "failed"; fi
-status=$((status+tmp))
+status=`expr $status + $tmp`

-n=$((n+1))
-echo_i "testing ixfr-from-differences master; (slave zone) ($n)"
+n=`expr $n + 1`
+echo_i "testing ixfr-from-differences master; (slave zone)"
 tmp=0

 $DIG $DIGOPTS slave. \
-	@10.53.0.6 axfr > dig.out.ns6.test$n || tmp=1
-grep "^;" dig.out.ns6.test$n | cat_i
+	@10.53.0.6 axfr > dig.out.ns6 || tmp=1
+grep "^;" dig.out.ns6 | cat_i

 $DIG $DIGOPTS slave. \
-	@10.53.0.1 axfr > dig.out.ns1.test$n || tmp=1
-grep "^;" dig.out.ns1.test$n | cat_i
+	@10.53.0.1 axfr > dig.out.ns1 || tmp=1
+grep "^;" dig.out.ns1 | cat_i

-digcomp dig.out.ns6.test$n dig.out.ns1.test$n || tmp=1
+digcomp dig.out.ns6 dig.out.ns1 || tmp=1

 # ns6 has a journal iff it received an IXFR.
 test -f ns6/slave.bk || tmp=1
 test -f ns6/slave.bk.jnl && tmp=1

 if test $tmp != 0 ; then echo_i "failed"; fi
-status=$((status+tmp))
+status=`expr $status + $tmp`

-n=$((n+1))
-echo_i "testing ixfr-from-differences slave; (master zone) ($n)"
+n=`expr $n + 1`
+echo_i "testing ixfr-from-differences slave; (master zone)"
 tmp=0

 # ns7 has a journal iff it generates an IXFR.
@@ -223,36 +217,35 @@ test -f ns7/master2.db || tmp=1
 test -f ns7/master2.db.jnl && tmp=1

 if test $tmp != 0 ; then echo_i "failed"; fi
-status=$((status+tmp))
+status=`expr $status + $tmp`

-n=$((n+1))
-echo_i "testing ixfr-from-differences slave; (slave zone) ($n)"
+n=`expr $n + 1`
+echo_i "testing ixfr-from-differences slave; (slave zone)"
 tmp=0

 $DIG $DIGOPTS slave. \
-	@10.53.0.1 axfr > dig.out.ns1.test$n || tmp=1
-grep "^;" dig.out.ns1.test$n | cat_i
+	@10.53.0.1 axfr > dig.out.ns1 || tmp=1
+grep "^;" dig.out.ns1 | cat_i

 $DIG $DIGOPTS slave. \
-	@10.53.0.7 axfr > dig.out.ns7.test$n || tmp=1
-grep "^;" dig.out.ns7.test$n | cat_i
+	@10.53.0.7 axfr > dig.out.ns7 || tmp=1
+grep "^;" dig.out.ns1 | cat_i

-digcomp dig.out.ns7.test$n dig.out.ns1.test$n || tmp=1
+digcomp dig.out.ns7 dig.out.ns1 || tmp=1

 # ns7 has a journal iff it generates an IXFR.
 test -f ns7/slave.bk || tmp=1
 test -f ns7/slave.bk.jnl || tmp=1

 if test $tmp != 0 ; then echo_i "failed"; fi
-status=$((status+tmp))
+status=`expr $status + $tmp`

-n=$((n+1))
-echo_i "check that a multi-message uncompressable zone transfers ($n)"
+echo_i "check that a multi-message uncompressable zone transfers"
 $DIG axfr . -p ${PORT} @10.53.0.4 | grep SOA > axfr.out
 if test `wc -l < axfr.out` != 2
 then
 	 echo_i "failed"
-         status=$((status+1))
+	 status=`expr $status + 1`
 fi

 # now we test transfers with assorted TSIG glitches
@@ -283,20 +276,20 @@ rndc_reload ns4 10.53.0.4

 for i in 0 1 2 3 4 5 6 7 8 9
 do
-	$DIGCMD nil. SOA > dig.out.ns4.test$n
-	grep SOA dig.out.ns4.test$n > /dev/null && break
+	$DIGCMD nil. SOA > dig.out.ns4
+	grep SOA dig.out.ns4 > /dev/null && break
 	sleep 1
 done

 sed -n "$cur,\$p" < ns4/named.run | grep "Transfer status: success" > /dev/null || {
    echo_i "failed: expected status was not logged"
-    status=$((status+1))
+    status=1
 }
 cur=`awk 'END {print NR}' ns4/named.run`

 $DIGCMD nil. TXT | grep 'initial AXFR' >/dev/null || {
    echo_i "failed"
-    status=$((status+1))
+    status=1
 }

 echo_i "unsigned transfer"
@@ -310,13 +303,13 @@ sleep 2

 sed -n "$cur,\$p" < ns4/named.run | grep "Transfer status: expected a TSIG or SIG(0)" > /dev/null || {
    echo_i "failed: expected status was not logged"
-    status=$((status+1))
+    status=1
 }
 cur=`awk 'END {print NR}' ns4/named.run`

 $DIGCMD nil. TXT | grep 'unsigned AXFR' >/dev/null && {
    echo_i "failed"
-    status=$((status+1))
+    status=1
 }

 echo_i "bad keydata"
@@ -330,13 +323,13 @@ sleep 2

 sed -n "$cur,\$p" < ns4/named.run | grep "Transfer status: tsig verify failure" > /dev/null || {
    echo_i "failed: expected status was not logged"
-    status=$((status+1))
+    status=1
 }
 cur=`awk 'END {print NR}' ns4/named.run`

 $DIGCMD nil. TXT | grep 'bad keydata AXFR' >/dev/null && {
    echo_i "failed"
-    status=$((status+1))
+    status=1
 }

 echo_i "partially-signed transfer"
@@ -350,13 +343,13 @@ sleep 2

 sed -n "$cur,\$p" < ns4/named.run | grep "Transfer status: expected a TSIG or SIG(0)" > /dev/null || {
    echo_i "failed: expected status was not logged"
-    status=$((status+1))
+    status=1
 }
 cur=`awk 'END {print NR}' ns4/named.run`

 $DIGCMD nil. TXT | grep 'partially signed AXFR' >/dev/null && {
    echo_i "failed"
-    status=$((status+1))
+    status=1
 }

 echo_i "unknown key"
@@ -370,13 +363,13 @@ sleep 2

 sed -n "$cur,\$p" < ns4/named.run | grep "tsig key 'tsig_key': key name and algorithm do not match" > /dev/null || {
    echo_i "failed: expected status was not logged"
-    status=$((status+1))
+    status=1
 }
 cur=`awk 'END {print NR}' ns4/named.run`

 $DIGCMD nil. TXT | grep 'unknown key AXFR' >/dev/null && {
    echo_i "failed"
-    status=$((status+1))
+    status=1
 }

 echo_i "incorrect key"
@@ -390,16 +383,16 @@ sleep 2

 sed -n "$cur,\$p" < ns4/named.run | grep "tsig key 'tsig_key': key name and algorithm do not match" > /dev/null || {
    echo_i "failed: expected status was not logged"
-    status=$((status+1))
+    status=1
 }
 cur=`awk 'END {print NR}' ns4/named.run`

 $DIGCMD nil. TXT | grep 'incorrect key AXFR' >/dev/null && {
    echo_i "failed"
-    status=$((status+1))
+    status=1
 }

-n=$((n+1))
+n=`expr $n + 1`
 echo_i "check that we ask for and get a EDNS EXPIRE response ($n)"
 # force a refresh query
 $RNDCCMD 10.53.0.7 refresh edns-expire 2>&1 | sed 's/^/ns7 /' | cat_i
@@ -409,59 +402,56 @@ sleep 10
 expire=`awk '/edns-expire\/IN: got EDNS EXPIRE of/ { x=$9 } END { print x }' ns7/named.run`
 test ${expire:-0} -gt 0 -a ${expire:-0} -lt 1814400 || {
    echo_i "failed (expire=${expire:-0})"
-    status=$((status+1))
+    status=1
 }

-n=$((n+1))
+n=`expr $n + 1`
 echo_i "test smaller transfer TCP message size ($n)"
 $DIG $DIGOPTS example. @10.53.0.8 axfr \
-	-y key1.:1234abcd8765 > dig.out.msgsize.test$n || status=1
+	-y key1.:1234abcd8765 > dig.out.msgsize || status=1

-$DOS2UNIX dig.out.msgsize.test$n >/dev/null 2>&1
+$DOS2UNIX dig.out.msgsize >/dev/null 2>&1

-bytes=`wc -c < dig.out.msgsize.test$n`
+bytes=`wc -c < dig.out.msgsize`
 if [ $bytes -ne 459357 ]; then
 	echo_i "failed axfr size check"
-        status=$((status+1))
+	status=1
 fi

 num_messages=`cat ns8/named.run | grep "sending TCP message of" | wc -l`
 if [ $num_messages -le 300 ]; then
 	echo_i "failed transfer message count check"
-        status=$((status+1))
+	status=1
 fi

-n=$((n+1))
+n=`expr $n + 1`
 echo_i "test mapped zone with out of zone data ($n)"
 tmp=0
-$DIG -p ${PORT} txt mapped @10.53.0.3 > dig.out.1.test$n
-grep "status: NOERROR," dig.out.1.test$n > /dev/null || tmp=1
+$DIG -p ${PORT} txt mapped @10.53.0.3 > dig.out.1.$n
+grep "status: NOERROR," dig.out.1.$n > /dev/null || tmp=1
 $PERL $SYSTEMTESTTOP/stop.pl xfer ns3
 $PERL $SYSTEMTESTTOP/start.pl --noclean --restart --port ${PORT} xfer ns3
 for try in 0 1 2 3 4 5 6 7 8 9; do
    iret=0
-    $DIG -p ${PORT} txt mapped @10.53.0.3 > dig.out.2.test$n
-    grep "status: NOERROR," dig.out.2.test$n > /dev/null || iret=1
-    if [ "$iret" -eq 0 ]
-    then
-        $DIG -p ${PORT} axfr mapped @10.53.0.3 > dig.out.3.test$n
-        digcomp knowngood.mapped dig.out.3.test$n || iret=1
-    fi
+    $DIG -p ${PORT} txt mapped @10.53.0.3 > dig.out.2.$n
+    grep "status: NOERROR," dig.out.2.$n > /dev/null || iret=1
+    $DIG -p ${PORT} axfr mapped @10.53.0.3 > dig.out.3.$n
+    digcomp knowngood.mapped dig.out.3.$n || iret=1
    [ "$iret" -eq 0 ] && break
    sleep 1
 done
 [ "$iret" -eq 0 ] || tmp=1
 [ "$tmp" -ne 0 ] && echo_i "failed"
-status=$((status+tmp))
+status=`expr $status + $tmp`

-n=$((n+1))
+n=`expr $n + 1`
 echo_i "test that a zone with too many records is rejected (AXFR) ($n)"
 tmp=0
 grep "'axfr-too-big/IN'.*: too many records" ns6/named.run >/dev/null || tmp=1
 if test $tmp != 0 ; then echo_i "failed"; fi
-status=$((status+tmp))
+status=`expr $status + $tmp`

-n=$((n+1))
+n=`expr $n + 1`
 echo_i "test that a zone with too many records is rejected (IXFR) ($n)"
 tmp=0
 grep "'ixfr-too-big./IN.*: too many records" ns6/named.run >/dev/null && tmp=1
@@ -478,18 +468,18 @@ do
 done
 grep "'ixfr-too-big/IN'.*: too many records" ns6/named.run >/dev/null || tmp=1
 if test $tmp != 0 ; then echo_i "failed"; fi
-status=$((status+tmp))
+status=`expr $status + $tmp`

-n=$((n+1))
-echo_i "checking whether dig calculates AXFR statistics correctly ($n)"
+n=`expr $n + 1`
+echo_i "checking whether dig calculates AXFR statistics correctly"
 # Loop until the secondary server manages to transfer the "xfer-stats" zone so
 # that we can both check dig output and immediately proceed with the next test.
 # Use -b so that we can discern between incoming and outgoing transfers in ns3
 # logs later on.
 tmp=1
 for i in 1 2 3 4 5 6 7 8 9 10; do
-	$DIG $DIGOPTS +noedns +stat -b 10.53.0.2 @10.53.0.3 xfer-stats. AXFR > dig.out.ns3.test$n
-	if grep "; Transfer failed" dig.out.ns3.test$n > /dev/null; then
+	$DIG $DIGOPTS +noedns +stat -b 10.53.0.2 @10.53.0.3 xfer-stats. AXFR > dig.out.ns3.$n
+	if grep "; Transfer failed" dig.out.ns3.$n > /dev/null; then
 		sleep 1
 	else
 		tmp=0
@@ -499,25 +489,25 @@ done
 if [ $tmp -ne 0 ]; then
 	echo_i "timed out waiting for zone transfer"
 else
-	get_dig_xfer_stats dig.out.ns3.test$n > stats.dig
+	get_dig_xfer_stats dig.out.ns3.$n > stats.dig
 	diff axfr-stats.good stats.dig || tmp=1
 fi
 if test $tmp != 0 ; then echo_i "failed"; fi
-status=$((status+tmp))
+status=`expr $status + $tmp`

 # Note: in the next two tests, we use ns3 logs for checking both incoming and
 # outgoing transfer statistics as ns3 is both a secondary server (for ns1) and a
 # primary server (for dig queries from the previous test) for "xfer-stats".
-n=$((n+1))
-echo_i "checking whether named calculates incoming AXFR statistics correctly ($n)"
+n=`expr $n + 1`
+echo_i "checking whether named calculates incoming AXFR statistics correctly"
 tmp=0
 get_named_xfer_stats ns3/named.run 10.53.0.1 xfer-stats "Transfer completed" > stats.incoming
 diff axfr-stats.good stats.incoming || tmp=1
 if test $tmp != 0 ; then echo_i "failed"; fi
-status=$((status+tmp))
+status=`expr $status + $tmp`

-n=$((n+1))
-echo_i "checking whether named calculates outgoing AXFR statistics correctly ($n)"
+n=`expr $n + 1`
+echo_i "checking whether named calculates outgoing AXFR statistics correctly"
 tmp=1
 for i in 0 1 2 3 4 5 6 7 8 9; do
 	get_named_xfer_stats ns3/named.run 10.53.0.2 xfer-stats "AXFR ended" > stats.outgoing
@@ -528,7 +518,7 @@ for i in 0 1 2 3 4 5 6 7 8 9; do
 	sleep 1
 done
 if test $tmp != 0 ; then echo_i "failed"; fi
-status=$((status+tmp))
+status=`expr $status + $tmp`

 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
@@ -37,7 +37,6 @@
      <year>2016</year>
      <year>2018</year>
      <year>2019</year>
-      <year>2020</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -37,7 +37,6 @@
      <year>2017</year>
      <year>2018</year>
      <year>2019</year>
-      <year>2020</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -37,7 +37,6 @@
      <year>2017</year>
      <year>2018</year>
      <year>2019</year>
-      <year>2020</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -39,7 +39,6 @@
      <year>2017</year>
      <year>2018</year>
      <year>2019</year>
-      <year>2020</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -35,7 +35,6 @@
      <year>2016</year>
      <year>2018</year>
      <year>2019</year>
-      <year>2020</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -36,7 +36,6 @@
      <year>2016</year>
      <year>2018</year>
      <year>2019</year>
-      <year>2020</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -39,7 +39,6 @@
      <year>2017</year>
      <year>2018</year>
      <year>2019</year>
-      <year>2020</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -35,7 +35,6 @@
      <year>2017</year>
      <year>2018</year>
      <year>2019</year>
-      <year>2020</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
    <!-- insert copyright end -->
@@ -614,6 +614,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.7 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.6 (Development Release)</p>
 </body>
 </html>
@@ -146,6 +146,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.7 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.6 (Development Release)</p>
 </body>
 </html>
@@ -856,6 +856,6 @@ controls {
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.7 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.6 (Development Release)</p>
 </body>
 </html>
@@ -1042,7 +1042,7 @@ allow-update { !{ !localnets; any; }; key host1-host2. ;};
          <strong class="userinput"><code>yes</code></strong>, DNSSEC validation will only occur
          if at least one trust anchor has been explicitly configured
          in <code class="filename">named.conf</code>
-          using a <span class="command"><strong>trust-anchors</strong></span> statement (or the
+          using a <span class="command"><strong>dnssec-keys</strong></span> statement (or the
          <span class="command"><strong>managed-keys</strong></span> and <span class="command"><strong>trusted-keys</strong></span>
          statements, both deprecated).
        </p>
@@ -1057,7 +1057,7 @@ allow-update { !{ !localnets; any; }; key host1-host2. ;};
        </p>

        <p>
-          The keys specified in <span class="command"><strong>trust-anchors</strong></span>
+          The keys specified in <span class="command"><strong>dnssec-keys</strong></span>
          copies of DNSKEY RRs for zones that are used to form the
          first link in the cryptographic chain of trust.  Keys configured
          with the keyword <span class="command"><strong>static-key</strong></span> or
@@ -1071,7 +1071,7 @@ allow-update { !{ !localnets; any; }; key host1-host2. ;};
        </p>

        <p>
-          <span class="command"><strong>trust-anchors</strong></span> is described in more detail
+          <span class="command"><strong>dnssec-keys</strong></span> is described in more detail
          later in this document.
        </p>

@@ -1094,7 +1094,7 @@ allow-update { !{ !localnets; any; }; key host1-host2. ;};
        </p>

 <pre class="programlisting">
-trust-anchors {
+dnssec-keys {
        /* Root Key */
        "." initial-key 257 3 3 "BNY4wrWM1nCfJ+CXd0rVXyYmobt7sEEfK3clRbGaTwS
                                 JxrGkxJWoZu6I7PzJu/E9gx4UC1zGAHlXKdE4zYIpRh
@@ -1586,10 +1586,10 @@ options {
    
    <p>To configure a validating resolver to use RFC 5011 to
    maintain a trust anchor, configure the trust anchor using a
-    <span class="command"><strong>trust-anchors</strong></span> statement and the
+    <span class="command"><strong>dnssec-keys</strong></span> statement and the
    <span class="command"><strong>initial-key</strong></span> or <span class="command"><strong>initial-ds</strong></span>
    keyword. Information about this can be found in
-    <a class="xref" href="Bv9ARM.ch05.html#trust-anchors" title="trust-anchors Statement Definition and Usage">the section called &#8220;<span class="command"><strong>trust-anchors</strong></span> Statement Definition
+    <a class="xref" href="Bv9ARM.ch05.html#dnssec-keys" title="dnssec-keys Statement Definition and Usage">the section called &#8220;<span class="command"><strong>dnssec-keys</strong></span> Statement Definition
            and Usage&#8221;</a>.</p>
  </div>
  <div class="section">
@@ -2915,6 +2915,6 @@ $ORIGIN 0.0.0.0.0.0.0.0.8.b.d.0.1.0.0.2.ip6.arpa.
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.7 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.6 (Development Release)</p>
 </body>
 </html>
@@ -67,8 +67,8 @@
 <dt><span class="section"><a href="Bv9ARM.ch05.html#statschannels"><span class="command"><strong>statistics-channels</strong></span> Statement Grammar</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch05.html#statistics_channels"><span class="command"><strong>statistics-channels</strong></span> Statement Definition and
              Usage</a></span></dt>
-<dt><span class="section"><a href="Bv9ARM.ch05.html#trust_anchors"><span class="command"><strong>trust-anchors</strong></span> Statement Grammar</a></span></dt>
-<dt><span class="section"><a href="Bv9ARM.ch05.html#trust-anchors"><span class="command"><strong>trust-anchors</strong></span> Statement Definition
+<dt><span class="section"><a href="Bv9ARM.ch05.html#dnssec_keys"><span class="command"><strong>dnssec-keys</strong></span> Statement Grammar</a></span></dt>
+<dt><span class="section"><a href="Bv9ARM.ch05.html#dnssec-keys"><span class="command"><strong>dnssec-keys</strong></span> Statement Definition
            and Usage</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch05.html#dnssec_policy_grammar"><span class="command"><strong>dnssec-policy</strong></span> Statement Grammar</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch05.html#dnssec_policy"><span class="command"><strong>dnssec-policy</strong></span> Statement Definition
@@ -899,7 +899,7 @@
 </tr>
 <tr>
 <td>
-                <p><span class="command"><strong>trust-anchors</strong></span></p>
+                <p><span class="command"><strong>dnssec-keys</strong></span></p>
              </td>
 <td>
                <p>
@@ -920,9 +920,9 @@
              </td>
 <td>
                <p>
-                  is identical to <span class="command"><strong>trust-anchors</strong></span>;
+                  is identical to <span class="command"><strong>dnssec-keys</strong></span>;
                  this option is deprecated in favor
-                  of <span class="command"><strong>trust-anchors</strong></span> with
+                  of <span class="command"><strong>dnssec-keys</strong></span> with
                  the <span class="command"><strong>initial-key</strong></span> keyword,
                  and may be removed in a future release.
                </p>
@@ -936,7 +936,7 @@
                <p>
                  defines permanent trusted DNSSEC keys;
                  this option is deprecated in favor
-                  of <span class="command"><strong>trust-anchors</strong></span> with
+                  of <span class="command"><strong>dnssec-keys</strong></span> with
                  the <span class="command"><strong>static-key</strong></span> keyword,
                  and may be removed in a future release.
                </p>
@@ -2950,9 +2950,9 @@ badresp:1,adberr:0,findfail:0,valfail:0]
                    The number of seconds to wait between attempts to
                    reopen a closed output stream. The minimum is 1 second,
                    the maximum is 600 seconds (10 minutes), and the default
-                    is 5 seconds.  For convenience, TTL-style time unit
-                    suffixes may be used to specify the value.  It also
-                    accepts ISO 8601 duration formats.
+                    is 5 seconds.
+                    For convenience, TTL-style time unit suffixes may be
+                    used to specify the value.
                  
                </li>
 </ul></div>
@@ -3087,7 +3087,7 @@ badresp:1,adberr:0,findfail:0,valfail:0]
                track managed DNSSEC keys (i.e., those configured using
                the <span class="command"><strong>initial-key</strong></span> or
                <span class="command"><strong>initial-ds</strong></span> keywords in a
-                <span class="command"><strong>trust-anchors</strong></span> statement).  By default,
+                <span class="command"><strong>dnssec-keys</strong></span> statement).  By default,
                this is the working directory.  The directory
                <span class="emphasis"><em>must</em></span> be writable by the effective
                user ID of the <span class="command"><strong>named</strong></span> process.
@@ -3455,7 +3455,7 @@ options {
                as insecure.
              </p>
              <p>
-                Configured trust anchors in <span class="command"><strong>trust-anchors</strong></span>
+                Configured trust anchors in <span class="command"><strong>dnssec-keys</strong></span>
                (or <span class="command"><strong>managed-keys</strong></span> or
                <span class="command"><strong>trusted-keys</strong></span>, both deprecated)
                that match a disabled algorithm will be ignored and treated
@@ -3487,7 +3487,7 @@ options {
                they are secure.  If <strong class="userinput"><code>no</code></strong>, then normal
                DNSSEC validation applies allowing for insecure answers to
                be accepted.  The specified domain must be defined as a
-                trust anchor, for instance in a <span class="command"><strong>trust-anchors</strong></span>
+                trust anchor, for instance in a <span class="command"><strong>dnssec-keys</strong></span>
                statement, or <span class="command"><strong>dnssec-validation auto</strong></span> must
                be active.
              </p>
@@ -3646,11 +3646,8 @@ options {
                <p>
                  For convenience, TTL-style time unit suffixes can be
                  used to specify the NTA lifetime in seconds, minutes
-                  or hours.  It also accepts ISO 8601 duration formats.
-                </p>
-                <p>
-                 <code class="option">nta-lifetime</code> defaults to one hour.  It
-                 cannot exceed one week.
+                  or hours.  <code class="option">nta-lifetime</code> defaults to
+                  one hour.  It cannot exceed one week.
                </p>
            </dd>
 <dt><span class="term"><span class="command"><strong>nta-recheck</strong></span></span></dt>
@@ -3680,13 +3677,9 @@ options {
                <p>
                  For convenience, TTL-style time unit suffixes can be
                  used to specify the NTA recheck interval in seconds,
-                  minutes or hours.  It also accepts ISO 8601 duration
-                  formats.
-                </p>
-                <p>
-                  The default is five minutes.  It cannot be longer than
-                  <code class="option">nta-lifetime</code> (which cannot be longer
-                  than a week).
+                  minutes or hours.  The default is five minutes.  It
+                  cannot be longer than <code class="option">nta-lifetime</code>
+                  (which cannot be longer than a week).
                </p>
            </dd>
 <dt><span class="term"><span class="command"><strong>max-zone-ttl</strong></span></span></dt>
@@ -3694,10 +3687,7 @@ options {
              <p>
                Specifies a maximum permissible TTL value in seconds.
                For convenience, TTL-style time unit suffixes may be
-                used to specify the maximum value. It also
-                accepts ISO 8601 duration formats.
-              </p>
-              <p>
+                used to specify the maximum value.
                When loading a zone file using a
                <code class="option">masterfile-format</code> of
                <code class="constant">text</code> or <code class="constant">raw</code>,
@@ -4510,7 +4500,7 @@ options {
                  Causes <span class="command"><strong>named</strong></span> to send specially-formed
                  queries once per day to domains for which trust anchors
                  have been configured via, e.g.,
-                  <span class="command"><strong>trust-anchors</strong></span> or
+                  <span class="command"><strong>dnssec-keys</strong></span> or
                  <span class="command"><strong>dnssec-validation auto</strong></span>.
                </p>
                <p>
@@ -4701,7 +4691,7 @@ options {
                <p>
                  If set to <strong class="userinput"><code>yes</code></strong>, DNSSEC validation is
                  enabled, but a trust anchor must be manually configured
-                  using a <span class="command"><strong>trust-anchors</strong></span> statement (or
+                  using a <span class="command"><strong>dnssec-keys</strong></span> statement (or
                  the <span class="command"><strong>managed-keys</strong></span> or the
                  <span class="command"><strong>trusted-keys</strong></span> statements, both deprecated).
                  If there is no configured trust anchor, validation will
@@ -6525,8 +6515,7 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
                  <span class="command"><strong>listen-on</strong></span> configuration), and
                  will stop listening on interfaces that have gone away.
                  For convenience, TTL-style time unit suffixes may be
-                  used to specify the value.  It also accepts ISO 8601
-                  duration formats.
+                  used to specify the value.
                </p>
              </dd>
 </dl></div>
@@ -6806,13 +6795,9 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
                  stores negative answers. <span class="command"><strong>min-ncache-ttl</strong></span> is
                  used to set a minimum retention time for these answers in the
                  server in seconds.  For convenience, TTL-style time unit
-                  suffixes may be used to specify the value.  It also
-                  accepts ISO 8601 duration formats.
-                </p>
-                <p>
-                  The default <span class="command"><strong>min-ncache-ttl</strong></span> is
-                  <code class="literal">0</code> seconds.
-                  <span class="command"><strong>min-ncache-ttl</strong></span> cannot exceed 90
+                  suffixes may be used to specify the value.  The default
+                  <span class="command"><strong>min-ncache-ttl</strong></span> is <code class="literal">0</code>
+                  seconds.  <span class="command"><strong>min-ncache-ttl</strong></span> cannot exceed 90
                  seconds and will be truncated to 90 seconds if set to a
                  greater value.
                </p>
@@ -6821,14 +6806,10 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
 <dd>
                <p>
                  Sets the minimum time for which the server will cache ordinary
-                  (positive) answers in seconds.  For convenience, TTL-style
-                  time unit suffixes may be used to specify the value.  It also
-                  accepts ISO 8601 duration formats.
-                </p>
-                <p>
-                  The default <span class="command"><strong>min-cache-ttl</strong></span> is
-                  <code class="literal">0</code> seconds.
-                  <span class="command"><strong>min-cache-ttl</strong></span> cannot exceed 90
+                  (positive) answers in seconds. For convenience, TTL-style time
+                  unit suffixes may be used to specify the value. The default
+                  <span class="command"><strong>min-cache-ttl</strong></span> is <code class="literal">0</code>
+                  seconds. <span class="command"><strong>min-cache-ttl</strong></span> cannot exceed 90
                  seconds and will be truncated to 90 seconds if set to a
                  greater value.
                </p>
@@ -6837,19 +6818,15 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
 <dd>
                <p>
                  To reduce network traffic and increase performance,
-                  the server stores negative answers.
-                  <span class="command"><strong>max-ncache-ttl</strong></span> is
+                  the server stores negative answers. <span class="command"><strong>max-ncache-ttl</strong></span> is
                  used to set a maximum retention time for these answers in
-                  the server in seconds.  For convenience, TTL-style time unit
-                  suffixes may be used to specify the value.  It also accepts
-                  ISO 8601 duration formats.
-                </p>
-                <p>
-                  The default <span class="command"><strong>max-ncache-ttl</strong></span> is
-                  <code class="literal">10800</code> seconds (3 hours).
-                  <span class="command"><strong>max-ncache-ttl</strong></span> cannot exceed 7 days and
-                  will be silently truncated to 7 days if set to a greater
-                  value.
+                  the server in seconds.
+                  For convenience, TTL-style time unit suffixes may be
+                  used to specify the value.  The default
+                  <span class="command"><strong>max-ncache-ttl</strong></span> is <code class="literal">10800</code> seconds (3 hours).
+                  <span class="command"><strong>max-ncache-ttl</strong></span> cannot exceed
+                  7 days and will
+                  be silently truncated to 7 days if set to a greater value.
                </p>
              </dd>
 <dt><span class="term"><span class="command"><strong>max-cache-ttl</strong></span></span></dt>
@@ -6858,10 +6835,7 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
                  Sets the maximum time for which the server will
                  cache ordinary (positive) answers in seconds.
                  For convenience, TTL-style time unit suffixes may be
-                  used to specify the value.  It also accepts ISO 8601
-                  duration formats.
-                </p>
-                <p>
+                  used to specify the value.
                  The default is 604800 (one week).
                  A value of zero may cause all queries to return
                  SERVFAIL, because of lost caches of intermediate
@@ -8069,9 +8043,7 @@ deny-answer-aliases { "example.net"; };
            The <span class="command"><strong>max-policy-ttl</strong></span> clause changes the
            maximum seconds from its default of 5.
            For convenience, TTL-style time unit suffixes may be
-            used to specify the value.  It also accepts ISO 8601 duration
-            formats.
-
+            used to specify the value.
          </p>

          <p>
@@ -8167,8 +8139,7 @@ example.com                 CNAME   rpz-tcp-only.
            recent update, then the changes will not be carried out until this
            interval has elapsed.  The default is <code class="literal">60</code> seconds.
            For convenience, TTL-style time unit suffixes may be
-            used to specify the value.  It also accepts ISO 8601 duration
-            formats.
+            used to specify the value.
          </p>
        </div>

@@ -8878,9 +8849,9 @@ example.com                 CNAME   rpz-tcp-only.

        <div class="section">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="trust_anchors"></a><span class="command"><strong>trust-anchors</strong></span> Statement Grammar</h3></div></div></div>
+<a name="dnssec_keys"></a><span class="command"><strong>dnssec-keys</strong></span> Statement Grammar</h3></div></div></div>
        <pre class="programlisting">
-<span class="command"><strong>trust-anchors</strong></span> { <em class="replaceable"><code>string</code></em> ( static-key |
+<span class="command"><strong>dnssec-keys</strong></span> { <em class="replaceable"><code>string</code></em> ( static-key |
    <span class="command"><strong>initial-key</strong></span> | static-ds | initial-ds )
    <em class="replaceable"><code>integer</code></em> <em class="replaceable"><code>integer</code></em> <em class="replaceable"><code>integer</code></em>
    <em class="replaceable"><code>quoted_string</code></em>; ... };
@@ -8888,11 +8859,11 @@ example.com                 CNAME   rpz-tcp-only.
        </div>
        <div class="section">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="trust-anchors"></a><span class="command"><strong>trust-anchors</strong></span> Statement Definition
+<a name="dnssec-keys"></a><span class="command"><strong>dnssec-keys</strong></span> Statement Definition
            and Usage</h3></div></div></div>

          <p>
-            The <span class="command"><strong>trust-anchors</strong></span> statement defines DNSSEC
+            The <span class="command"><strong>dnssec-keys</strong></span> statement defines DNSSEC
            trust anchors.  DNSSEC is described in <a class="xref" href="Bv9ARM.ch04.html#DNSSEC" title="DNSSEC">the section called &#8220;DNSSEC&#8221;</a>.
          </p>
          <p>
@@ -8911,21 +8882,21 @@ example.com                 CNAME   rpz-tcp-only.
            the <span class="command"><strong>validate-except</strong></span> option).
          </p>
          <p>
-            All keys listed in <span class="command"><strong>trust-anchors</strong></span>, and
+            All keys listed in <span class="command"><strong>dnssec-keys</strong></span>, and
            their corresponding zones, are deemed to exist regardless
            of what parent zones say.  Only keys configured as trust anchors
            are used to validate the DNSKEY RRset for the corresponding
            name. The parent's DS RRset will not be used.
          </p>
          <p>
-            <span class="command"><strong>trust-anchors</strong></span> may be set at the top level
+            <span class="command"><strong>dnssec-keys</strong></span> may be set at the top level
            of <code class="filename">named.conf</code> or within a view.  If it is
            set in both places, the configurations are additive: keys
            defined at the top level are inherited by all views, but keys
            defined in a view are only used within that view.
          </p>
          <p>
-            The <span class="command"><strong>trust-anchors</strong></span> statement can contain
+            The <span class="command"><strong>dnssec-keys</strong></span> statement can contain
            multiple trust anchor entries, each consisting of a
            domain name, followed by an "anchor type" keyword indicating
            the trust anchor's format, followed by the key or digest data.
@@ -8965,7 +8936,7 @@ example.com                 CNAME   rpz-tcp-only.
            <span class="command"><strong>static-ds</strong></span> would be unable to validate
            this zone any longer; it would reply with a SERVFAIL response
            code.  This would continue until the resolver operator had
-            updated the <span class="command"><strong>trust-anchors</strong></span> statement with
+            updated the <span class="command"><strong>dnssec-keys</strong></span> statement with
            the new key.
          </p>
          <p>
@@ -9001,7 +8972,7 @@ example.com                 CNAME   rpz-tcp-only.
            <span class="command"><strong>initial-key</strong></span> or <span class="command"><strong>initial-ds</strong></span>
            configured in <code class="filename">named.conf</code>, it fetches the
            DNSKEY RRset directly from the zone apex, and validates it
-            using the trust anchor specified in <span class="command"><strong>trust-anchors</strong></span>.
+            using the trust anchor specified in <span class="command"><strong>dnssec-keys</strong></span>.
            If the DNSKEY RRset is validly signed by a key matching
            the trust anchor, then it is used as the basis for a new
            managed keys database.
@@ -9010,10 +8981,10 @@ example.com                 CNAME   rpz-tcp-only.
            From that point on, whenever <span class="command"><strong>named</strong></span> runs, it
            sees the <span class="command"><strong>initial-key</strong></span> or
            <span class="command"><strong>initial-ds</strong></span> listed in
-            <span class="command"><strong>trust-anchors</strong></span>, checks to
+            <span class="command"><strong>dnssec-keys</strong></span>, checks to
            make sure RFC 5011 key maintenance has already been initialized
            for the specified domain, and if so, it simply moves on.  The
-            key specified in the <span class="command"><strong>trust-anchors</strong></span>
+            key specified in the <span class="command"><strong>dnssec-keys</strong></span>
            statement is not used to validate answers; it is
            superseded by the key or keys stored in the managed keys
            database.
@@ -9022,7 +8993,7 @@ example.com                 CNAME   rpz-tcp-only.
            The next time <span class="command"><strong>named</strong></span> runs after an
            <span class="command"><strong>initial-key</strong></span> or <span class="command"><strong>initial-ds</strong></span>
            trust anchor has been <span class="emphasis"><em>removed</em></span> from the
-            <span class="command"><strong>trust-anchors</strong></span> statement (or changed to
+            <span class="command"><strong>dnssec-keys</strong></span> statement (or changed to
            a <span class="command"><strong>static-key</strong></span> or <span class="command"><strong>static-ds</strong></span>),
            the corresponding keys will be removed from the managed keys
            database, and RFC 5011 key maintenance will no longer be used
@@ -9074,8 +9045,8 @@ example.com                 CNAME   rpz-tcp-only.
 <a name="dnssec_policy_grammar"></a><span class="command"><strong>dnssec-policy</strong></span> Statement Grammar</h3></div></div></div>
        <pre class="programlisting">
 <span class="command"><strong>dnssec-policy</strong></span> <em class="replaceable"><code>string</code></em> {
-    <span class="command"><strong>dnskey-ttl</strong></span> <em class="replaceable"><code>duration</code></em>;
-    <span class="command"><strong>keys</strong></span> { ( csk | ksk | zsk ) key-directory lifetime <em class="replaceable"><code>duration</code></em> algorithm <em class="replaceable"><code>integer</code></em> [ <em class="replaceable"><code>integer</code></em> ] ; ... };
+    <span class="command"><strong>dnskey-ttl</strong></span> <em class="replaceable"><code>ttlval</code></em>;
+    <span class="command"><strong>keys</strong></span> { ( csk | ksk | zsk ) key-directory <em class="replaceable"><code>duration</code></em> <em class="replaceable"><code>integer</code></em> [ <em class="replaceable"><code>integer</code></em> ] ; ... };
    <span class="command"><strong>parent-ds-ttl</strong></span> <em class="replaceable"><code>duration</code></em>;
    <span class="command"><strong>parent-propagation-delay</strong></span> <em class="replaceable"><code>duration</code></em>;
    <span class="command"><strong>parent-registration-delay</strong></span> <em class="replaceable"><code>duration</code></em>;
@@ -9165,8 +9136,8 @@ example.com                 CNAME   rpz-tcp-only.
                <p>
                  A margin that is added to the publish interval in key
                  timing equations to give some extra time to cover
-                  unforeseen events.  Default is <code class="constant">PT1H</code>
-                  (1 hour).
+                  unforeseen events.  Default is <code class="constant">PT5M</code>
+                  (5 minutes).
                </p>
              </dd>
 <dt><span class="term"><span class="command"><strong>retire-safety</strong></span></span></dt>
@@ -9174,8 +9145,8 @@ example.com                 CNAME   rpz-tcp-only.
                <p>
                  A margin that is added to the retire interval in key
                  timing equations to give some extra time to cover
-                  unforeseen events.  Default is <code class="constant">PT1H</code>
-                  (1 hour).
+                  unforeseen events.  Default is <code class="constant">PT5M</code>
+                  (5 minutes).
                </p>
              </dd>
 <dt><span class="term"><span class="command"><strong>signatures-refresh</strong></span></span></dt>
@@ -9249,7 +9220,7 @@ example.com                 CNAME   rpz-tcp-only.
 <dd>
                <p>
                  The TTL of the DS RRset that the parent uses.  Default is
-                  <code class="constant">P1D</code> (1 day).
+                  <code class="constant">PT1H</code> (1 hour).
                </p>
              </dd>
 <dt><span class="term"><span class="command"><strong>parent-propagation-delay</strong></span></span></dt>
@@ -9290,7 +9261,7 @@ example.com                 CNAME   rpz-tcp-only.

          <p>
            The <span class="command"><strong>managed-keys</strong></span> statement has been
-            deprecated in favor of <a class="xref" href="Bv9ARM.ch05.html#trust_anchors" title="trust-anchors Statement Grammar">the section called &#8220;<span class="command"><strong>trust-anchors</strong></span> Statement Grammar&#8221;</a>
+            deprecated in favor of <a class="xref" href="Bv9ARM.ch05.html#dnssec_keys" title="dnssec-keys Statement Grammar">the section called &#8220;<span class="command"><strong>dnssec-keys</strong></span> Statement Grammar&#8221;</a>
            with the <span class="command"><strong>initial-key</strong></span> keyword.
          </p>
        </div>
@@ -9311,7 +9282,7 @@ example.com                 CNAME   rpz-tcp-only.

          <p>
            The <span class="command"><strong>trusted-keys</strong></span> statement has been
-            deprecated in favor of <a class="xref" href="Bv9ARM.ch05.html#trust_anchors" title="trust-anchors Statement Grammar">the section called &#8220;<span class="command"><strong>trust-anchors</strong></span> Statement Grammar&#8221;</a>
+            deprecated in favor of <a class="xref" href="Bv9ARM.ch05.html#dnssec_keys" title="dnssec-keys Statement Grammar">the section called &#8220;<span class="command"><strong>dnssec-keys</strong></span> Statement Grammar&#8221;</a>
            with the <span class="command"><strong>static-key</strong></span> keyword.
          </p>
        </div>
@@ -9948,7 +9919,7 @@ view "external" {
                        (KSK) for the zone must be configured as a trust
                        anchor in <code class="filename">named.conf</code>: that
                        is, a key for the zone must be specified in
-                        <span class="command"><strong>trust-anchors</strong></span>.  In the case
+                        <span class="command"><strong>dnssec-keys</strong></span>.  In the case
                        of the root zone, you may also rely on the
                        built-in root trust anchor, which is enabled
                        when <a class="xref" href="Bv9ARM.ch05.html#dnssec_validation"><span class="command"><strong>dnssec-validation</strong></span></a> is set to the
@@ -10367,13 +10338,9 @@ view "external" {
 <dt><span class="term"><span class="command"><strong>dnssec-policy</strong></span></span></dt>
 <dd>
                  <p>
-                    The key and signing policy for this zone.  This is a string
-                    referring to a <span class="command"><strong>dnssec-policy</strong></span> statement.
-                    There are two built-in policies:
-                    <strong class="userinput"><code>"default"</code></strong> allows you to use the
-                    default policy, and <strong class="userinput"><code>"none"</code></strong> means
-                    not to use any DNSSEC policy, keeping the zone unsigned.
-                    The default is <strong class="userinput"><code>"none"</code></strong>.
+                    The key and signing policy for this zone.  Set to
+                    <strong class="userinput"><code>"default"</code></strong> if you want to make use
+                    of the default policy.
                  </p>
                </dd>
 <dt><span class="term"><span class="command"><strong>dnssec-update-mode</strong></span></span></dt>
@@ -15221,6 +15188,6 @@ HOST-127.EXAMPLE. MX 0 .
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.7 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.6 (Development Release)</p>
 </body>
 </html>
@@ -360,6 +360,6 @@ allow-query { !{ !10/8; any; }; key example; };
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.7 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.6 (Development Release)</p>
 </body>
 </html>
@@ -191,6 +191,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.7 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.6 (Development Release)</p>
 </body>
 </html>
@@ -36,13 +36,12 @@
 <div class="toc">
 <p><b>Table of Contents</b></p>
 <dl class="toc">
-<dt><span class="section"><a href="Bv9ARM.ch08.html#id-1.9.2">Release Notes for BIND Version 9.15.7</a></span></dt>
+<dt><span class="section"><a href="Bv9ARM.ch08.html#id-1.9.2">Release Notes for BIND Version 9.15.6</a></span></dt>
 <dd><dl>
 <dt><span class="section"><a href="Bv9ARM.ch08.html#relnotes_intro">Introduction</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch08.html#relnotes_versions">Note on Version Numbering</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch08.html#relnotes_platforms">Supported Platforms</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch08.html#relnotes_download">Download</a></span></dt>
-<dt><span class="section"><a href="Bv9ARM.ch08.html#relnotes-9.15.7">Notes for BIND 9.15.7</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch08.html#relnotes-9.15.6">Notes for BIND 9.15.6</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch08.html#relnotes-9.15.5">Notes for BIND 9.15.5</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch08.html#relnotes-9.15.4">Notes for BIND 9.15.4</a></span></dt>
@@ -58,7 +57,7 @@
 </div>
      <div class="section">
 <div class="titlepage"><div><div><h2 class="title" style="clear: both">
-<a name="id-1.9.2"></a>Release Notes for BIND Version 9.15.7</h2></div></div></div>
+<a name="id-1.9.2"></a>Release Notes for BIND Version 9.15.6</h2></div></div></div>
  
  <div class="section">
 <div class="titlepage"><div><div><h3 class="title">
@@ -102,12 +101,11 @@
    C compiler.
  </p>
  <p>
-    The <code class="filename">libuv</code> asynchronous I/O library and the
-    OpenSSL cryptography library must be available for the target
-    platform.  A PKCS#11 provider can be used instead of OpenSSL for
-    Public Key cryptography (i.e., DNSSEC signing and validation),
-    but OpenSSL is still required for general cryptography operations
-    such as hashing and random number generation.
+    The OpenSSL cryptography library must be available for the target
+    platform.  A PKCS#11 provider can be used instead for Public Key
+    cryptography (i.e., DNSSEC signing and validation), but OpenSSL is
+    still required for general cryptography operations such as hashing
+    and random number generation.
  </p>
  <p>
    More information can be found in the <code class="filename">PLATFORMS.md</code>
@@ -132,73 +130,10 @@

  <div class="section">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="relnotes-9.15.7"></a>Notes for BIND 9.15.7</h3></div></div></div>
-
-  <div class="section">
-<div class="titlepage"><div><div><h4 class="title">
-<a name="relnotes-9.15.7-changes"></a>Feature Changes</h4></div></div></div>
-    <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
-<li class="listitem">
-        <p>
-          The <span class="command"><strong>dnssec-keys</strong></span> configuration statement,
-          which was introduced in 9.15.1 and revised in 9.15.6, has now
-          been renamed to the more descriptive
-          <span class="command"><strong>trust-anchors</strong></span>. [GL !2702]
-        </p>
-        <p>
-          (See release notes for
-          <a class="xref" href="Bv9ARM.ch08.html#relnotes-9.15.1-new" title="New Features">BIND 9.15.1</a>
-          and
-          <a class="xref" href="Bv9ARM.ch08.html#relnotes-9.15.6-new" title="New Features">BIND 9.15.6</a>
-          for prior discussion of this feature.)
-        </p>
-      </li>
-<li class="listitem">
-        <p>
-          Added support for multithreaded listening for TCP connections
-	  in the network manager [GL !2659]
-        </p>
-      </li>
-</ul></div>
-  </div>
-
-  <div class="section">
-<div class="titlepage"><div><div><h4 class="title">
-<a name="relnotes-9.15.7-bugs"></a>Bug Fixes</h4></div></div></div>
-    <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
-<li class="listitem">
-        <p>
-          Fixed a bug that caused <span class="command"><strong>named</strong></span> to leak memory
-          on reconfiguration when any GeoIP2 database was in use. [GL #1445]
-        </p>
-      </li>
-<li class="listitem">
-        <p>
-          Fixed several possible race conditions discovered by Thread
-          Sanitizer.
-        </p>
-      </li>
-</ul></div>
-  </div>
-
-</div>
-  <div class="section">
-<div class="titlepage"><div><div><h3 class="title">
 <a name="relnotes-9.15.6"></a>Notes for BIND 9.15.6</h3></div></div></div>

  <div class="section">
 <div class="titlepage"><div><div><h4 class="title">
-<a name="relnotes-9.15.6-security"></a>Security Fixes</h4></div></div></div>
-    <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem">
-        <p>
-          Set a limit on the number of concurrently served pipelined TCP
-          queries. This flaw is disclosed in CVE-2019-6477. [GL #1264]
-        </p>
-      </li></ul></div>
-  </div>
-
-  <div class="section">
-<div class="titlepage"><div><div><h4 class="title">
 <a name="relnotes-9.15.6-new"></a>New Features</h4></div></div></div>
    <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
 <li class="listitem">
@@ -222,32 +157,25 @@
        </p>
      </li>
 <li class="listitem">
-        <p>
-          Two new keywords have been added to the
-          <span class="command"><strong>dnssec-keys</strong></span> statement:
-          <span class="command"><strong>initial-ds</strong></span> and <span class="command"><strong>static-ds</strong></span>.
-          These allow the use of trust anchors in DS format instead of
-          DNSKEY format.  DS format allows trust anchors to be configured
-          for keys that have not yet been published; this is the format
-          used by IANA when announcing future root keys.
-        </p>
-        <p>
-          As with the <span class="command"><strong>initial-key</strong></span> and
-          <span class="command"><strong>static-key</strong></span> keywords, <span class="command"><strong>initial-ds</strong></span>
-          configures a dynamic trust anchor to be maintained via RFC 5011, and
-          <span class="command"><strong>static-ds</strong></span> configures a permanent trust anchor.
-        </p>
-        <p>
-          (Note: Currently, DNSKEY-format and DS-format trust anchors
-          cannot both be used for the same domain name.) [GL #6] [GL #622]
-        </p>
-      </li>
-<li class="listitem">
-        <p>
-          Added a new statistics variable <span class="command"><strong>tcp-highwater</strong></span>
-          that reports the maximum number of simultaneous TCP clients BIND
-          has handled while running. [GL #1206]
-        </p>
+	<p>
+	  Two new keywords have been added to the
+	  <span class="command"><strong>dnssec-keys</strong></span> statement:
+	  <span class="command"><strong>initial-ds</strong></span> and <span class="command"><strong>static-ds</strong></span>.
+	  These allow the use of trust anchors in DS format instead of
+	  DNSKEY format.  DS format allows trust anchors to be configured
+	  for keys that have not yet been published; this is the format
+	  used by IANA when announcing future root keys.
+	</p>
+	<p>
+	  As with the <span class="command"><strong>initial-key</strong></span> and
+	  <span class="command"><strong>static-key</strong></span> keywords, <span class="command"><strong>initial-ds</strong></span>
+	  configures a dynamic trust anchor to be maintained via RFC 5011, and
+	  <span class="command"><strong>static-ds</strong></span> configures a permanent trust anchor.
+	</p>
+	<p>
+	  (Note: Currently, DNSKEY-format and DS-format trust anchors
+	  cannot both be used for the same domain name.) [GL #6] [GL #622]
+	</p>
      </li>
 </ul></div>
  </div>
@@ -265,14 +193,27 @@
        </p>
      </li>
 <li class="listitem">
-        <p>
-          The DNSSEC validation code has been refactored for clarity and to
-          reduce code duplication.  [GL #622]
-        </p>
+	<p>
+	  The DNSSEC validation code has been refactored for clarity and to
+	  reduce code duplication.  [GL #622]
+	</p>
      </li>
 </ul></div>
  </div>

+  <div class="section">
+<div class="titlepage"><div><div><h4 class="title">
+<a name="relnotes-9.15.6-security"></a>Security Fixes</h4></div></div></div>
+    <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem">
+	<p>
+	  Too many simultaneous pipelined TCP queries could cause
+	  resource overuse. We now prevent this by enforcing a limit
+	  on the number of simultaneous requests per active connection.
+	  This flaw`is disclosed in CVE-2019-6477. [GL #1264]
+	</p>
+      </li></ul></div>
+  </div>
+
 </div>
  <div class="section">
 <div class="titlepage"><div><div><h3 class="title">
@@ -778,6 +719,9 @@
 <a name="relnotes_thanks"></a>Thank You</h3></div></div></div>
  <p>
    Thank you to everyone who assisted us in making this release possible.
+    If you would like to contribute to ISC to assist us in continuing to
+    make quality open source software, please visit our donations page at
+    <a class="link" href="https://www.isc.org/donate/" target="_top">https://www.isc.org/donate/</a>.
  </p>
 </div>
 </div>
@@ -800,6 +744,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.7 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.6 (Development Release)</p>
 </body>
 </html>
@@ -148,6 +148,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.7 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.6 (Development Release)</p>
 </body>
 </html>
@@ -914,6 +914,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.7 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.6 (Development Release)</p>
 </body>
 </html>
@@ -538,6 +538,6 @@ $ <strong class="userinput"><code>sample-update -a sample-update -k Kxxx.+nnn+mm
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.7 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.6 (Development Release)</p>
 </body>
 </html>
@@ -210,6 +210,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.7 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.6 (Development Release)</p>
 </body>
 </html>
@@ -32,7 +32,7 @@
 <div>
 <div><h1 class="title">
 <a name="id-1"></a>BIND 9 Administrator Reference Manual</h1></div>
-<div><p class="releaseinfo">BIND Version 9.15.7</p></div>
+<div><p class="releaseinfo">BIND Version 9.15.6</p></div>
 <div><p class="copyright">Copyright © 2000-2019 Internet Systems Consortium, Inc. ("ISC")</p></div>
 </div>
 <hr>
@@ -192,8 +192,8 @@
 <dt><span class="section"><a href="Bv9ARM.ch05.html#statschannels"><span class="command"><strong>statistics-channels</strong></span> Statement Grammar</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch05.html#statistics_channels"><span class="command"><strong>statistics-channels</strong></span> Statement Definition and
              Usage</a></span></dt>
-<dt><span class="section"><a href="Bv9ARM.ch05.html#trust_anchors"><span class="command"><strong>trust-anchors</strong></span> Statement Grammar</a></span></dt>
-<dt><span class="section"><a href="Bv9ARM.ch05.html#trust-anchors"><span class="command"><strong>trust-anchors</strong></span> Statement Definition
+<dt><span class="section"><a href="Bv9ARM.ch05.html#dnssec_keys"><span class="command"><strong>dnssec-keys</strong></span> Statement Grammar</a></span></dt>
+<dt><span class="section"><a href="Bv9ARM.ch05.html#dnssec-keys"><span class="command"><strong>dnssec-keys</strong></span> Statement Definition
            and Usage</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch05.html#dnssec_policy_grammar"><span class="command"><strong>dnssec-policy</strong></span> Statement Grammar</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch05.html#dnssec_policy"><span class="command"><strong>dnssec-policy</strong></span> Statement Definition
@@ -248,13 +248,12 @@
 </dl></dd>
 <dt><span class="appendix"><a href="Bv9ARM.ch08.html">A. Release Notes</a></span></dt>
 <dd><dl>
-<dt><span class="section"><a href="Bv9ARM.ch08.html#id-1.9.2">Release Notes for BIND Version 9.15.7</a></span></dt>
+<dt><span class="section"><a href="Bv9ARM.ch08.html#id-1.9.2">Release Notes for BIND Version 9.15.6</a></span></dt>
 <dd><dl>
 <dt><span class="section"><a href="Bv9ARM.ch08.html#relnotes_intro">Introduction</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch08.html#relnotes_versions">Note on Version Numbering</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch08.html#relnotes_platforms">Supported Platforms</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch08.html#relnotes_download">Download</a></span></dt>
-<dt><span class="section"><a href="Bv9ARM.ch08.html#relnotes-9.15.7">Notes for BIND 9.15.7</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch08.html#relnotes-9.15.6">Notes for BIND 9.15.6</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch08.html#relnotes-9.15.5">Notes for BIND 9.15.5</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch08.html#relnotes-9.15.4">Notes for BIND 9.15.4</a></span></dt>
@@ -449,6 +448,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.7 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.6 (Development Release)</p>
 </body>
 </html>
@@ -54,16 +54,10 @@ notes.pdf: notes-wrapper.xml ${NOTESXML} releaseinfo.xml pkgversion.xml notevers
 	${XSLTPROC} ${top_srcdir}/doc/xsl/pre-latex.xsl notes-wrapper.xml | \
 	${DBLATEX} -c notes.conf -Pdoc.layout="mainmatter" -o notes.pdf -

-# Produce notes.txt from notes.html using w3m, with some post-processing:
-#
-#  - remove trailing spaces from every line,
-#  - remove empty lines from the end of the document,
-#  - prevent GitLab issue/MR identifiers from being split across two lines.
 notes.txt: notes.html
 	${W3M} -dump -cols 75 -O ascii -T text/html < notes.html | \
 		sed 's/  *$$//' | \
-		sed -e :a -e '/^\n*$$/{$$d;N;};/\n$$/ba' | \
-		sed '/ [!#]$$/{N;s| \([!#]\)\(\n\s*\)\([0-9][0-9]*\)|\2\1\3|;};' > notes.txt
+		sed -e :a -e '/^\n*$$/{$$d;N;};/\n$$/ba' > notes.txt

 # use xmllint to process include
 Bv9ARM.html: Bv9ARM-book.xml ${NOTESXML} releaseinfo.xml pkgversion.xml noteversion.xml
@@ -90,6 +90,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.7 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.6 (Development Release)</p>
 </body>
 </html>
@@ -220,6 +220,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.7 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.6 (Development Release)</p>
 </body>
 </html>
@@ -215,7 +215,7 @@
 	  </p>
 	  <p>
 	    Note: When reading the trust anchor file,
-	    <span class="command"><strong>delv</strong></span> treats <code class="option">trust-anchors</code>
+	    <span class="command"><strong>delv</strong></span> treats <code class="option">dnssec-keys</code>
 	    <code class="option">initial-key</code> and <code class="option">static-key</code>
 	    entries identically.  That is, even if a key is configured
 	    with <span class="command"><strong>initial-key</strong></span>, indicating that it is
@@ -621,6 +621,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.7 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.6 (Development Release)</p>
 </body>
 </html>
@@ -1188,6 +1188,6 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.7 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.6 (Development Release)</p>
 </body>
 </html>
@@ -376,6 +376,6 @@ nsupdate -l
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.7 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.6 (Development Release)</p>
 </body>
 </html>
@@ -156,6 +156,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.7 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.6 (Development Release)</p>
 </body>
 </html>
@@ -270,6 +270,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.7 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.6 (Development Release)</p>
 </body>
 </html>
@@ -341,6 +341,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.7 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.6 (Development Release)</p>
 </body>
 </html>
@@ -250,6 +250,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.7 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.6 (Development Release)</p>
 </body>
 </html>
@@ -498,6 +498,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.7 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.6 (Development Release)</p>
 </body>
 </html>
@@ -589,6 +589,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.7 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.6 (Development Release)</p>
 </body>
 </html>
@@ -405,6 +405,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.7 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.6 (Development Release)</p>
 </body>
 </html>
@@ -171,6 +171,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.7 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.6 (Development Release)</p>
 </body>
 </html>
@@ -424,6 +424,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.7 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.6 (Development Release)</p>
 </body>
 </html>
@@ -707,6 +707,6 @@ db.example.com.signed
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.7 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.6 (Development Release)</p>
 </body>
 </html>
@@ -214,6 +214,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.7 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.6 (Development Release)</p>
 </body>
 </html>
@@ -143,6 +143,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.7 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.6 (Development Release)</p>
 </body>
 </html>
@@ -168,6 +168,6 @@ plugin query "/usr/local/lib/filter-aaaa.so" {
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.7 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.6 (Development Release)</p>
 </body>
 </html>
@@ -366,6 +366,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.7 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.6 (Development Release)</p>
 </body>
 </html>
--- a/Show More
+++ b/Show More