README: A hint on "H(@)"

[nsc-5.git] / bin / genzone

diff --git a/bin/genzone b/bin/genzone
index d2749de0b61d4ffc5f064cd844988736d8e0c684..432ad43e8e8cd6503d6b6b5f37c50300141f6360 100755 (executable)
--- a/bin/genzone
+++ b/bin/genzone
@@ -1,17 +1,57 @@
-#!/bin/sh
+#!/bin/bash
+# NSC -- Zone file generator
+# (c) 1997--2019 Martin Mares <mj@ucw.cz>
+
 set -e
 . bin/shell-env
+
+if [ $# -lt 2 ] ; then
+       echo >&2 "Usage: $0 <domain> <source files>"
+       exit 1
+fi
 Z=$1
 shift
-mkdir -p $HASHDIR
+
 CURRENT_HASH=$($M4 -DHASHING m4/nsc.m4 "$@" | md5sum | cut -d " " -f1)
-PREV_HASH=$(if [ -s $HASHDIR/$Z ] ; then cat $HASHDIR/$Z ; fi)
+if [ -f khash/$Z ] ; then
+       CURRENT_HASH=$CURRENT_HASH:$(cat khash/$Z)
+       if [ -f keys/resign-stamp ] ; then
+               CURRENT_HASH=$CURRENT_HASH:$(stat -c '%Y' keys/resign-stamp)
+       fi
+fi
+
+PREV_HASH=$(if [ -s hash/$Z ] ; then cat hash/$Z ; fi)
 if [ "X$CURRENT_HASH" = "X$PREV_HASH" ] ; then
        echo "-- $Z: No changes"
-       touch $ZONEDIR/$Z $HASHDIR/$Z
+       touch zone/$Z hash/$Z
 else
-       $M4 -DVERS=$VERSDIR/$Z m4/nsc.m4 "$@" >$ZONEDIR/$Z.new
-       mv $ZONEDIR/$Z.new $ZONEDIR/$Z
-       echo "** $Z: New version $(sed -e "s/^;;; VERSION: //; t; d" $ZONEDIR/$Z)"
-       echo $CURRENT_HASH >$HASHDIR/$Z
+       $M4 -DVERS=ver/$Z m4/nsc.m4 "$@" >zone/$Z.new
+       NEWVER="$(sed -e "s/^;;; VERSION: //; t; d" zone/$Z.new)"
+       if [ -f khash/$Z ] ; then
+               ORIGIN=$(grep '\$ORIGIN' zone/$Z.new | cut -d' ' -f2)
+               if [ -z "$ORIGIN" ] ; then
+                       echo >&2 "FATAL: Cannot establish zone origin for $Z"
+                       exit 1
+               fi
+               NSEC="-3 -"
+               if [ -f bin/dnssec-hacks ] ; then
+                       # Undocumented hook for hacks
+                       . bin/dnssec-hacks
+               fi
+               if ! dnssec-signzone -a -d tmp -K keys/$Z $SIGNZONE_OPTIONS -f zone/$Z.signed -o $ORIGIN -S $NSEC zone/$Z.new &>zone/$Z.tmp ; then
+                       cat zone/$Z.tmp
+                       echo >&2 "FATAL: Cannot sign $Z"
+                       exit 1
+               fi
+               rm -f zone/$Z.tmp
+               rm -f tmp/dsset-*
+               mv zone/$Z.signed zone/$Z
+               rm -f zone/$Z.new
+               SIGNED=" (signed)"
+       else
+               mv zone/$Z.new zone/$Z
+               SIGNED=
+       fi
+       echo "** $Z: New version $NEWVER$SIGNED"
+       echo $CURRENT_HASH >hash/$Z
 fi