<commit_before>.TH ldns-signzone 1 "13 March 2018"
.SH NAME
ldns-signzone \- sign a zonefile with DNSSEC data
.SH SYNOPSIS
.B ldns-signzone 
[
.IR OPTIONS
]
.IR ZONEFILE 
.IR
KEY 
[KEY 
[KEY] ...
]

.SH DESCRIPTION

\fBldns-signzone\fR is used to generate a DNSSEC signed zone. When run it
will create a new zonefile that contains RRSIG and NSEC resource records, as
specified in RFC 4033, RFC 4034 and RFC 4035.

Keys must be specified by their base name (i.e. without .private). If
the DNSKEY that belongs to the key in the .private file is not present
in the zone, it will be read from the file <base name>.key. If that
file does not exist, the DNSKEY value will be generated from the
private key.

Multiple keys can be specified, Key Signing Keys are used as such when
they are either already present in the zone, or specified in a .key
file, and have the KSK bit set.

.SH OPTIONS
.TP
\fB-b\fR
Augments the zone and the RR's with extra comment texts for a more readable
layout, easier to debug. DS records will have a bubblebabble version of
the data in the comment text, NSEC3 records will have the unhashed owner names
in the comment text.

Without this option, only DNSKEY RR's will have their Key Tag annotated in
the comment text.

.TP
\fB-d\fR
Normally, if the DNSKEY RR for a key that is used to sign the zone is
not found in the zone file, it will be read from .key, or derived from
the private key (in that order). This option turns that feature off,
so that only the signatures are added to the zone.

.TP
\fB-e\fR \fIdate\fR
Set expiration date of the signatures to this date, the format can be
YYYYMMDD[hhmmss], or a timestamp.

.TP
\fB-f\fR \fIfile\fR
Use this file to store the signed zone in (default <originalfile>.signed)

.TP
\fB-i\fR \fIdate\fR
Set inception date of the signatures to this date, the format can be
YYYYMMDD[hhmmss], or a timestamp.

.TP
\fB-o\fR \fIorigin\fR
Use this as the origin of the zone

.TP
\fB-u\fR
set SOA serial to the number of seconds since 1-1-1970

.TP
\fB-v\fR
Print the version and exit

.TP
\fB-z\fR \fI[scheme:]hash\fR
Calculate the zone's digest and add those as ZONEMD RRs. The (optional)
`scheme' must be `simple` (or 1) and `hash' should be `sha384' (or 1) or
`sha512' (or 2).  This option can be given more than once.

.TP
\fB-Z\fR
Allow ZONEMDs to be added without signing

.TP
\fB-A\fR
Sign the DNSKEY record with all keys.  By default it is signed with a
minimal number of keys, to keep the response size for the DNSKEY query
small, and only the SEP keys that are passed are used.  If there are no
SEP keys, the DNSKEY RRset is signed with the non\-SEP keys.  This option
turns off the default and all keys are used to sign the DNSKEY RRset.

.TP
\fB-E\fR \fIname\fR
Use the EVP cryptographic engine with the given name for signing. This
can have some extra options; see ENGINE OPTIONS for more information.

.TP
\fB-K\fR \fIalgorithm-id,key-id\fR

Use the key `key-id' as the signing key for algorithm `algorithm-id' as
a Key Signing Key (KSK). This option is used when you use an OpenSSL engine,
see ENGINE OPTIONS for more information.

.TP
\fB-k\fR \fIalgorithm-id,key-id\fR
Use the key `key-id' as the signing key for algorithm `algorithm-id' as
a Zone Signing Key (ZSK). This option is used when you use an OpenSSL
engine, see ENGINE OPTIONS for more information.

.TP
\fB-n\fR
Use NSEC3 instead of NSEC.

.TP
If you use NSEC3, you can specify the following extra options:<commit_msg>Document -U flag to ldns-signzone<commit_after>.TH ldns-signzone 1 "13 March 2018"
.SH NAME
ldns-signzone \- sign a zonefile with DNSSEC data
.SH SYNOPSIS
.B ldns-signzone 
[
.IR OPTIONS
]
.IR ZONEFILE 
.IR
KEY 
[KEY 
[KEY] ...
]

.SH DESCRIPTION

\fBldns-signzone\fR is used to generate a DNSSEC signed zone. When run it
will create a new zonefile that contains RRSIG and NSEC resource records, as
specified in RFC 4033, RFC 4034 and RFC 4035.

Keys must be specified by their base name (i.e. without .private). If
the DNSKEY that belongs to the key in the .private file is not present
in the zone, it will be read from the file <base name>.key. If that
file does not exist, the DNSKEY value will be generated from the
private key.

Multiple keys can be specified, Key Signing Keys are used as such when
they are either already present in the zone, or specified in a .key
file, and have the KSK bit set.

.SH OPTIONS
.TP
\fB-b\fR
Augments the zone and the RR's with extra comment texts for a more readable
layout, easier to debug. DS records will have a bubblebabble version of
the data in the comment text, NSEC3 records will have the unhashed owner names
in the comment text.

Without this option, only DNSKEY RR's will have their Key Tag annotated in
the comment text.

.TP
\fB-d\fR
Normally, if the DNSKEY RR for a key that is used to sign the zone is
not found in the zone file, it will be read from .key, or derived from
the private key (in that order). This option turns that feature off,
so that only the signatures are added to the zone.

.TP
\fB-e\fR \fIdate\fR
Set expiration date of the signatures to this date, the format can be
YYYYMMDD[hhmmss], or a timestamp.

.TP
\fB-f\fR \fIfile\fR
Use this file to store the signed zone in (default <originalfile>.signed)

.TP
\fB-i\fR \fIdate\fR
Set inception date of the signatures to this date, the format can be
YYYYMMDD[hhmmss], or a timestamp.

.TP
\fB-o\fR \fIorigin\fR
Use this as the origin of the zone

.TP
\fB-u\fR
set SOA serial to the number of seconds since 1-1-1970

.TP
\fB-v\fR
Print the version and exit

.TP
\fB-z\fR \fI[scheme:]hash\fR
Calculate the zone's digest and add those as ZONEMD RRs. The (optional)
`scheme' must be `simple` (or 1) and `hash' should be `sha384' (or 1) or
`sha512' (or 2).  This option can be given more than once.

.TP
\fB-Z\fR
Allow ZONEMDs to be added without signing

.TP
\fB-A\fR
Sign the DNSKEY record with all keys.  By default it is signed with a
minimal number of keys, to keep the response size for the DNSKEY query
small, and only the SEP keys that are passed are used.  If there are no
SEP keys, the DNSKEY RRset is signed with the non\-SEP keys.  This option
turns off the default and all keys are used to sign the DNSKEY RRset.

.TP
\fB-U\fR
Sign with every unique algorithm in the provided keys.  The DNSKEY set
is signed with all the SEP keys, plus all the non\-SEP keys that have an
algorithm that was not presen in the SEP key set.

.TP
\fB-E\fR \fIname\fR
Use the EVP cryptographic engine with the given name for signing. This
can have some extra options; see ENGINE OPTIONS for more information.

.TP
\fB-K\fR \fIalgorithm-id,key-id\fR

Use the key `key-id' as the signing key for algorithm `algorithm-id' as
a Key Signing Key (KSK). This option is used when you use an OpenSSL engine,
see ENGINE OPTIONS for more information.

.TP
\fB-k\fR \fIalgorithm-id,key-id\fR
Use the key `key-id' as the signing key for algorithm `algorithm-id' as
a Zone Signing Key (ZSK). This option is used when you use an OpenSSL
engine, see ENGINE OPTIONS for more information.

.TP
\fB-n\fR
Use NSEC3 instead of NSEC.

.TP
If you use NSEC3, you can specify the following extra options:
{'fraction_non_alphanumeric': 0.0667880145617474, 'fraction_numerical': 0.010361243349201904, 'mean_word_length': 3.4868090452261304, 'pattern_counts': {'":': 0, '<': 7, '<?xml version=': 0, '>': 7, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '4004378', 'n_tokens_mistral': 2522, 'n_tokens_neox': 2318, 'n_words': 1222}