#!/bin/sh
#
# $Cambridge: hermes/conf/bind/bin/update-trust-anchor,v 1.2 2010/07/16 14:13:15 fanf2 Exp $

PATH=/opt/bind/bin:$PATH

rm -f root-*
wget https://data.iana.org/root-anchors/root-anchors.xml

# 257 == Zone Key + Secure Entry Point
dig +noall +answer dnskey . |
grep "[ 	]DNSKEY[ 	]257[	 ]" |
while read dnskey
do
	i=$(($i+1))
	echo $dnskey >root-dnskey.$i
	dnssec-dsfromkey -f root-dnskey.$i . >root-ds.$i
	validate-trust-anchor root-anchors.xml root-dnskey.$i root-ds.$i >root-anchor.$i
done
if grep . root-anchor.* >/dev/null
then
	Cambridge='$Cambridge'
	echo "# ${Cambridge}\$"
	echo "managed-keys {"
	cat root-anchor.*
	echo "};"
fi >managed-keys
