<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
<META NAME="Generator" CONTENT="MS Exchange Server version 6.5.7638.1">
<TITLE>RE: [Opendnssec-develop] Policy configuration checker</TITLE>
</HEAD>
<BODY>
<!-- Converted from text/plain format -->
<BR>
<P><FONT SIZE=2>Do you mean to say here that a zone with very static data never needs to be resigned, like f.e. a key rollover ?<BR>
I think a static zone needs regular resigning as well, and there are simply 3 situations:<BR>
-Zone changes occur faster than resigning, and faster than publishing<BR>
-Zone changes occur faster than resigning, but slower than publishing<BR>
-Resigning occurs faster than zone changes<BR>
<BR>
There are situations where changes to a zone are accepted, but not resigned because it's not publishing time yet.<BR>
I think that's the parameter to play with. Signing only needs to be done when it's publishing time, or when a rollover is sceduled.<BR>
<BR>
Antoin Verschuren<BR>
<BR>
Technical Advisor<BR>
Policy & Business Development<BR>
SIDN<BR>
Utrechtseweg 310<BR>
PO Box 5022<BR>
6802 EA Arnhem<BR>
The Netherlands<BR>
<BR>
T +31 26 3525510<BR>
F +31 26 3525505<BR>
M +31 6 23368970<BR>
E antoin.verschuren@sidn.nl<BR>
W <A HREF="http://www.sidn.nl/">http://www.sidn.nl/</A><BR>
<BR>
<BR>
<BR>
<BR>
-----Oorspronkelijk bericht-----<BR>
Van: opendnssec-develop-bounces@lists.opendnssec.org namens Rickard Bondesson<BR>
Verzonden: di 2009-08-11 15:33<BR>
Aan: Matthijs Mekking<BR>
CC: Opendnssec-develop@lists.opendnssec.org; Alexd@nominet.org.uk<BR>
Onderwerp: Re: [Opendnssec-develop] Policy configuration checker<BR>
<BR>
-----BEGIN PGP SIGNED MESSAGE-----<BR>
Hash: SHA256<BR>
<BR>
> But why waste resign resources if you are not going to output<BR>
> it anyway?<BR>
> In this example, you can save 23 times resigning that will be<BR>
> unnoticed.<BR>
><BR>
> Matthijs<BR>
<BR>
But the signer should not do anything if the old signed file has the same soa as the unsigned file (and you have <SOA><Serial>keep</Serial></SOA>). Thus not wasting so much cpu.<BR>
<BR>
if (soa_serial_type == keep && signed_zone_soa == unsigned_zone_soa) {<BR>
break_out_and_sleep_for_5_min();<BR>
}<BR>
do_resign();<BR>
<BR>
// Rickard<BR>
-----BEGIN PGP SIGNATURE-----<BR>
Version: 9.8.3 (Build 4028)<BR>
Charset: utf-8<BR>
<BR>
wsBVAwUBSoFzGuCjgaNTdVjaAQhRsAf+J2kZuAvfReoYjz2TpVq5t+TTFGpQCZmh<BR>
I67WkvWYvjK293i3uX6TXY/VuuJKTKeH9fjthT8LItPMw3h4aUOoNU9NDj7vLitC<BR>
IaNueOq+3GqIAIF2Uvs9JpL0QlRVo5hNcwQwTWNleLbFhy+gvVvyGr1A3/1THDnm<BR>
+a5dn9Cg2mjJbVKYIuEK0cEuFKA5qpTVnErdpdQwc3LQ7rBIkh8vjBQgKZe+PuGy<BR>
7UWA6zkVOdpgCJWLoZIDT0rccddje3ueZycOA+U9+kMxlaUePY5ESYQzo4wQ1qni<BR>
1so+V27AuL1TUCnMwSidbtBCJXQ7RhMIVyUVPiLmBdntmv8DCMwfbA==<BR>
=Kl6q<BR>
-----END PGP SIGNATURE-----<BR>
<BR>
<BR>
</FONT>
</P>
</BODY>
</HTML>