Dear Maintainer,

recently a problem appeared with bind9, installed as a caching
nameserver on my laptop. Namely, every time connections change
(e.g. a wifi connection is established) or even every time the
laptop resumes from power-saving mode, bind9 begins to say that
_any_ IP is unverified (DNSSEC is enabled as per defaults).
I found that to resume working I have to restart it, but _only_
if I manually delete the /var/cache/bind/managed-keys.bind and
/var/cache/bind/managed-keys.bind.jnl files. For some unknown
(to me) reason, if the files are there, even if it has full
rights to write them (and indeed it recreates them anew if they
are not there when I start it), it tries to use the pre-existing
ones and fails with

Feb 21 09:08:29 capitanata named[2487373]: dns_rdata_fromtext: managed-keys.bind:10: near eol: unexpected end of input
Feb 21 09:08:29 capitanata named[2487373]: managed-keys-zone: loading from master file managed-keys.bind failed: unexpected end of input

followed by a number of

Feb 21 09:08:39 capitanata named[2487373]: managed-keys-zone: Unable to fetch DNSKEY set '.': timed out
Feb 21 09:08:45 capitanata named[2487373]: validating ./NS: no valid signature found
Feb 21 09:08:45 capitanata named[2487373]: no valid RRSIG resolving './NS/IN': 192.33.4.12#53
Feb 21 09:08:45 capitanata named[2487373]: validating ./NS: no valid signature found
Feb 21 09:08:45 capitanata named[2487373]: no valid RRSIG resolving './NS/IN': 202.12.27.33#53
Feb 21 09:08:45 capitanata named[2487373]: validating ./NS: no valid signature found
Feb 21 09:08:45 capitanata named[2487373]: no valid RRSIG resolving './NS/IN': 199.9.14.201#53
Feb 21 09:08:45 capitanata named[2487373]: validating ./NS: no valid signature found
Feb 21 09:08:45 capitanata named[2487373]: no valid RRSIG resolving './NS/IN': 192.36.148.17#53
Feb 21 09:08:45 capitanata named[2487373]: validating ./NS: no valid signature found
Feb 21 09:08:45 capitanata named[2487373]: no valid RRSIG resolving './NS/IN': 192.58.128.30#53
Feb 21 09:08:45 capitanata named[2487373]: validating ./NS: no valid signature found
Feb 21 09:08:45 capitanata named[2487373]: no valid RRSIG resolving './NS/IN': 199.7.83.42#53
Feb 21 09:08:45 capitanata named[2487373]: validating ./NS: no valid signature found
Feb 21 09:08:45 capitanata named[2487373]: no valid RRSIG resolving './NS/IN': 198.97.190.53#53
Feb 21 09:08:45 capitanata named[2487373]: validating ./NS: no valid signature found
Feb 21 09:08:45 capitanata named[2487373]: no valid RRSIG resolving './NS/IN': 192.5.5.241#53
Feb 21 09:08:45 capitanata named[2487373]: validating ./NS: no valid signature found
Feb 21 09:08:45 capitanata named[2487373]: no valid RRSIG resolving './NS/IN': 192.112.36.4#53
Feb 21 09:08:45 capitanata named[2487373]: validating ./NS: no valid signature found
Feb 21 09:08:45 capitanata named[2487373]: no valid RRSIG resolving './NS/IN': 193.0.14.129#53
Feb 21 09:08:46 capitanata named[2487373]: validating ./NS: no valid signature found
Feb 21 09:08:46 capitanata named[2487373]: no valid RRSIG resolving './NS/IN': 199.7.91.13#53
Feb 21 09:08:46 capitanata named[2487373]: validating ./NS: no valid signature found
Feb 21 09:08:46 capitanata named[2487373]: no valid RRSIG resolving './NS/IN': 192.203.230.10#53

and eventually

Feb 21 09:09:13 capitanata named[2487373]:   validating com/DS: no valid signature found
Feb 21 09:09:13 capitanata named[2487373]: broken trust chain resolving 'com/DNSKEY/IN': 192.41.162.30#53
Feb 21 09:09:13 capitanata named[2487373]: broken trust chain resolving 'cloudflare.com/DNSKEY/IN': 162.159.5.6#53
Feb 21 09:09:13 capitanata named[2487373]: broken trust chain resolving 'community.cloudflare.com/AAAA/IN': 162.159.4.8#53
Feb 21 09:09:13 capitanata named[2487373]: broken trust chain resolving 'community.cloudflare.com/A/IN': 162.159.4.8#53

resulting in failure to resolve anything.


If instead I remove by hand the two managed-keys* files from /var/cache/bind,
they are recreated anew by the named daemon, and the chain of trust is
correctly established and works.

I tried adding the lines

ExecCondition=/bin/rm -fv /var/cache/bind/managed-keys.bind
ExecCondition=/bin/rm -fv /var/cache/bind/managed-keys.bind.jnl

before

ExecStart=/usr/sbin/named -f $OPTIONS

and

ExecReload=/bin/rm -fv /var/cache/bind/managed-keys.bind
ExecReload=/bin/rm -fv /var/cache/bind/managed-keys.bind.jnl
ExecReload=/bin/sleep 2

before

ExecReload=/usr/sbin/rndc reload

and now bind9, when restarted, correctly establishes the chain of trust,
and recreates the two managed-keys files.
I still get

Feb 21 09:39:11 capitanata named[2500848]: managed-keys-zone: Unable to fetch
DNSKEY set '.': timed out

but this seems to be harmless, the daemon can still resolve names without
problems.

While I found a working solution, or rather a work-around, I guess this
should be solved in the package, or at least be documented, in case
someone else gets this problem.

Thanks in advance, best regards
Giacomo Mulas

P.S. To investigate the problem, I removed the lines including
resolvconf configuration, to force my daemon to do full resolution,
ignoring the configuration snippets provided by openresolv.
It turned out to have no effect.