Module dnssec 

DNSSEC observability primitives (ADR-0001, roadmap 07).

Two independent concerns live here, both pure and side-effect free:

1. Parsing rndc dnssec -status <zone> output into DnssecStatus — the source of the zone-status DNSSEC block. Per ADR-0001 this output (the supported operator interface, reflecting the running server) is parsed instead of BIND’s internal key .state files.
2. Parsing DNSKEY resource records from public key files (K<zone>.+<alg>+<tag>.key) and computing the DS record (RFC 4034 appendix B key tag, RFC 4509 SHA-256 digest) in-process, so no dnssec-dsfromkey binary is needed in the image.

Structs

DnskeyRecord

A DNSKEY resource record parsed from textual (zone file / key file) form.

DnssecKeyStatus

Per-key signing state parsed from rndc dnssec -status output.

DnssecStatus

Zone DNSSEC status parsed from rndc dnssec -status output.

DsRecord

A computed DS record ready to publish at the parent zone.

Enums

CheckdsState

DS visibility state reported to named via rndc dnssec -checkds (ADR-0001: exposed so the insecure transition can complete without host access when no parental agents are configured).

DnssecError

Errors from DNSKEY/DS parsing and computation.

Constants

DS_DIGEST_TYPE_SHA256

DS digest type 2 = SHA-256 (RFC 4509). The only digest type bindcar emits.

Functions

parse_dnskey_rr

Parses a DNSKEY resource record in presentation format: <owner> [<ttl>] [<class>] DNSKEY <flags> <protocol> <algorithm> <base64…>.

parse_dnssec_status

Parses rndc dnssec -status <zone> output.

parse_key_file

Parses a BIND public key file (K<zone>.+<alg>+<tag>.key): comment lines start with ;, the remaining non-empty line is the DNSKEY RR.