test: wait for signed.test's zone DS records to get pushed to the parent zone

It looks like the 4 second sleep might not be enough on some slower
machines (like the ARM GH Actions nodes) which can lead to the DS RRs
propagation to clash with the manual test zone edit, and the
signed.test zone then might end up not properly signed:

TEST-75-RESOLVED.sh[749]: + : '--- ZONE: signed.test (static DNSSEC) ---'
TEST-75-RESOLVED.sh[749]: + run_delv @ns1.unsigned.test signed.test
TEST-75-RESOLVED.sh[749]: + run delv -a /etc/bind.keys @ns1.unsigned.test signed.test
TEST-75-RESOLVED.sh[778]: + delv -a /etc/bind.keys @ns1.unsigned.test signed.test
TEST-75-RESOLVED.sh[779]: + tee /tmp/tmp.2KOIiyrgth
TEST-75-RESOLVED.sh[779]: ;; /etc/bind.keys:1: option 'managed-keys' is deprecated
TEST-75-RESOLVED.sh[779]: ;; validating signed.test/DS: no valid signature found
TEST-75-RESOLVED.sh[779]: ;; validating signed.test/A: no valid signature found
TEST-75-RESOLVED.sh[779]: ; unsigned answer
TEST-75-RESOLVED.sh[779]: signed.test.		86400	IN	A	10.0.0.10
TEST-75-RESOLVED.sh[779]: signed.test.		86400	IN	RRSIG	A 13 2 86400 20251028114356 20251014101356 39330 signed.test. oo3ca8WPusbBPRhzsEKw3bsBBqFtI8i4bckoMVNzt7lY+udGW6PlaSYj OjpQGgY9oglowVM9bteNtwJKHUbvtw==
TEST-75-RESOLVED.sh[749]: + grep -qF '; fully validated' /tmp/tmp.2KOIiyrgth
[FAILED] Failed to start TEST-75-RESOLVED.service - TEST-75-RESOLVED.

Let's explicitly wait for the DS records propagation to finish before we
start editing the test zone to avoid this.

I'm still not completely sure if this is the root cause, but it's the
best shot I currently have, so I'll let the CIs decide.

This commit is contained in:

Frantisek Sumsal

2025-10-16 11:51:03 +01:00

committed by

Luca Boccassi

parent b8ad88a407

commit 92631f1962

1 changed files with 2 additions and 2 deletions

									
										test/units/TEST-75-RESOLVED.sh
									
		+2
		-2
	
												View File
												
				@@ -182,8 +182,8 @@ EOF

				        chown -R knot:knot /run/knot

				    fi

				    systemctl start knot

				    # Wait a bit for the keys to propagate

				    sleep 4

				    # Wait for signed.test's zone DS records to get pushed to the parent zone

				    timeout 30s bash -xec 'until knotc zone-read test. signed.test. ds | grep -E "signed\.test\. [0-9]+ DS"; do sleep 2; done'

				    systemctl status resolved-dummy-server

				    networkctl status