Merge branch 'dnssec'

The DNSSEC notes in CHANGELOG.md belong under Unreleased; git had put
them into the 0.1.0 section, which didn't exist when the branch was made.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/importer/importer_test.go

@@ -165,3 +165,43 @@ func TestImportAllowUpdateWarning(t *testing.T) {
 		}
 	}
 }
+
+func TestImportSignedZones(t *testing.T) {
+	dir := t.TempDir()
+	zone := "$TTL 300\n@ IN SOA ns1 h 1 2 3 4 5\n@ IN NS ns1\nns1 IN A 192.0.2.1\n"
+	for _, n := range []string{"a", "b", "c"} {
+		os.WriteFile(filepath.Join(dir, n+".db"), []byte(strings.ReplaceAll(zone, "ns1", "ns1."+n+".test.")), 0o644)
+	}
+	conf := `options { directory "` + dir + `"; dnssec-policy default; key-directory "/var/cache/bind/keys"; };
+view "external" {
+	zone "a.test" { type primary; file "a.db"; key-directory "/elsewhere"; };
+	zone "b.test" { type primary; file "b.db"; dnssec-policy none; };
+};
+view "internal" {
+	dnssec-policy "none";
+	zone "c.test" { type primary; file "c.db"; };
+};`
+	os.WriteFile(filepath.Join(dir, "named.conf"), []byte(conf), 0o644)
+	st, rep, err := Import(context.Background(), filepath.Join(dir, "named.conf"), Options{Alloc: seqAlloc()})
+	if err != nil {
+		t.Fatal(err)
+	}
+	policy := map[string]string{}
+	for _, z := range st.Zones {
+		policy[z.Name] = z.DNSSECPolicy
+	}
+	if policy["a.test."] != "default" || policy["b.test."] != "" || policy["c.test."] != "" {
+		t.Errorf("policies: %v", policy)
+	}
+	for _, o := range st.Options {
+		if o.Name == "dnssec-policy" || o.Scope == model.ScopeZone && o.Name == "key-directory" {
+			t.Errorf("option kept: %+v", o)
+		}
+	}
+	if !strings.Contains(strings.Join(rep.Warnings, "\n"), "zone a.test is signed (dnssec-policy default). Before 'jarld adopt', copy its key files (Ka.test.+*)") {
+		t.Errorf("warnings: %v", rep.Warnings)
+	}
+	if ps := validate.Errors(validate.State(st, validate.Options{})); len(ps) != 0 {
+		t.Errorf("imported state has errors: %v", ps)
+	}
+}