GitLab

More specifically: ignore configured trusted and managed keys that
match a disabled algorithm.  The behavioral change is that
associated responses no longer SERVFAIL, but return insecure.

- work around CR issues
- use UTC for time comparisons
- use $DIFF instead of cmp

dnssec-signzone should sign a zonefile that contains a DNSKEY record
with an unsupported algorithm.

- add CHANGES note
- update copyrights and license headers
- add -j to the make commands in .gitlab-ci.yml to take
  advantage of parallelization in the gitlab CI process

                        CDS and CDNSKEY. [RT #46755]

4721.	[func]		'dnssec-signzone -x' and 'dnssec-dnskey-kskonly'
			options now apply to CDNSKEY and DS records as well
			as DNSKEY. Thanks to Tony Finch. [RT #45689]

4436.	[bug]		Fixed a regression introduced in change #4337 which
			caused signed domains with revoked KSKs to fail
			validation. [RT #42147]

                        RRSIG's inception time is in the future and regenerate
                        the RRSIG immediately. [RT #41808]

                        key as per RFC 7344, Section 4.1. [RT #37215]

                        [RT #37541]

3882.	[func]		By default, negative trust anchors will be tested
			periodically to see whether data below them can be
			validated, and if so, they will be allowed to
			expire early. The "rndc nta -force" option
			overrides this behvaior.  The default NTA lifetime
			and the recheck frequency can be configured by the
			"nta-lifetime" and "nta-recheck" options. [RT #36146]

3839.	[test]		Use only posix-compatible shell in system tests.
			[RT #35625]

3714.	[test]		System tests that need to test for cryptography
			support before running can now use a common
			"testcrypto.sh" script to do so. [RT #35213]