<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META content="text/html; charset=us-ascii" http-equiv=Content-Type>
<STYLE>
BLOCKQUOTE {
MARGIN-TOP: 0px; MARGIN-BOTTOM: 0px; MARGIN-LEFT: 2em
}
OL {
MARGIN-TOP: 0px; MARGIN-BOTTOM: 0px
}
UL {
MARGIN-TOP: 0px; MARGIN-BOTTOM: 0px
}
P {
MARGIN-TOP: 0px; MARGIN-BOTTOM: 0px
}
BODY {
LINE-HEIGHT: 1.5; FONT-FAMILY: 宋体; COLOR: #000000; FONT-SIZE: 10.5pt
}
</STYLE>
<META name=GENERATOR content="MSHTML 8.00.6001.18702"></HEAD>
<BODY style="MARGIN: 10px">
<DIV>
<DIV>Hi Matthijs,</DIV>
<DIV> </DIV>
<DIV>I'm using OpenDNSSEC1.3.10 for test purpose, and using
<NotifyCommand> with a script to do the afterwards work. And</DIV>
<DIV>I'm not using Audit which is not recommended.</DIV>
<DIV> </DIV>
<DIV>But I have found out that sometimes the signed and raw zone file 's RRs do
not match.</DIV>
<DIV> </DIV>
<DIV>
<DIV>The attachment called ods_call_by_opendnssec.sh is the script called by
<NotifyCommand>, you can see clearly what we </DIV>
<DIV>do after signing work ends, and when the validation failed, there seems
nothing we can do to make up for it, I have </DIV>
<DIV>tried to call 'ods-signer sign %zone' but somethings more weird occurs, it
seems the processes are there, but no output</DIV>
<DIV>generated, so I need your opinion.</DIV>
<DIV> </DIV>
<DIV>The attachment called validateZoneData.sh is the scripted used for compare
signed file with the raw one in case it</DIV>
<DIV>lacks RRs. Our raw zone file is lowercase and signed zone file is
uppercase.</DIV>
<DIV> </DIV>
<DIV>The last file is a log generated by ods_call_by_opendnssec.sh, you can see
that tld test4 's validation are failed </DIV>
<DIV>because the NS RRs does not match with the unsigned file.</DIV>
<DIV> </DIV>
<DIV>I have found the same problem in OpenDNSSEC1.4.a2 and I would like to help
if needed.</DIV>
<DIV> </DIV>
<DIV>Thanks.</DIV></DIV>
<DIV> </DIV>
<DIV> </DIV>
<DIV>Best regards,</DIV>
<DIV>Stuart</DIV><SPAN></SPAN></DIV></BODY></HTML>