2010-12-05  David Blacka  <davidb@verisignlabs.com>

	* jdnssec-signzone: add a "verbose signing" option.  This will
	cause the pre-signed bytes and the raw signature bytes to be
	output when signing.
	* Other fixes: some minor tweaks and comment fixes.
	Unfortunately, also a lot of rewrapping and whitespace changes due
	to Eclipse.  Sigh.

2010-01-14  David Blacka  <davidb@verisignlabs.com>

	* Released version 0.9.6

2010-01-09  David Blacka  <davidb@verisignlabs.com>

	* Upgrade to DNSJava 2.0.8 (plus a few local changes).  2.0.8
	fixes a major bug in typemap wire conversion.

2009-11-02  David Blacka  <davidb@verisignlabs.com>

	* Released version 0.9.5

2009-11-01  David Blacka  <davidb@verisignlabs.com>

	* Upgrade to DNSJava 2.0.7 (plus a few local changes).
	* DnsKeyAlogorithm: change the RSASHA512 number to 10.

2009-08-23  David Blacka  <davidb@verisignlabs.com>

	* Released version 0.9.4

2009-07-15  David Blacka  <davidb@verisignlabs.com>

	* SignUtils: Fix major issue where the code that generates that
	canonical RRset given signature data wasn't obeying the "Orig TTL"
	and "Labels" fields.  This is a major issue with verification,
	although it doesn't affect signature generation.

	* VerifyZone:  Fix bug where the whole-zone security status was
	still wrong: unsigned RRsets shouldn't make the zone Bogus.

2009-06-12  David Blacka  <davidb@verisignlabs.com>

	* VerifyZone: Fix bug in verification logic so that RRsets that
	never find a valid signature (i.e., only have signatures by keys
	that aren't in the zone) are considered Bogus.  Note that
	VerifyZone still can't tell if a RRset that should be signed
	wasn't (or vice versa).

	* dnsjava: Update local copy of dnsjava library.  This version
	adds NSEC3 agorithms to DNSSECVerifier and KEYConverter, emulates
	DiG's "OPT PSEUDOSECTION" formatting in Message.toString(), and
	adds a minimal DHCIDRecord type.  Note that the DNSjava trunk has
	a different (although functional similar) version of this type.

2009-06-09  David Blacka  <davidb@verisignlabs.com>

	* VerifyZone: Improve the output.

	* SignKeyset: Add a command line tool for just signing DNSKEY RRsets.

2009-02-10  David Blacka  <davidb@verisignlabs.com>

	* Released version 0.9.0

2009-02-08  David Blacka  <davidb@verisignlabs.com>

	* KeyGen: make RSA large exponent the default.  Make it possible
	to select small exponent.

	* KeyInfoTool: add more info to the output, handle multiple files
	on the command line.

	* DnsKeyAlgorithm: use DNSjava constants, BIND 9.6 mnemonics for
	NSEC3 key aliases.

2009-02-07  David Blacka  <davidb@verisignlabs.com>

	* SignZone: add argument for setting the TTL of the NSEC3PARAM
	record.  This is so we can match current dnssec-signzone
	(9.6.0-p1) behavior of using a TTL of zero.

	* Update dnsjava to 2.0.6-vrsn-2, commons-cli to 1.1

	* SignUtils: fix bug where NSEC3 algorithm and flags were transposed.

	* SignUtils: Make sure to use the SOA minimum value for NSEC TTLs,
	instead of the ttl of the "node".

2009-02-04  David Blacka  <davidb@verisignlabs.com>

	* update to dnsjava-2.0.1-vrsn-4 (updated typecodes for
	NSEC3/NSEC3PARAM).

	* SignUtils: use JDK-native SHA-256 code instead of broken
	contributed implementation.

	* DnsKeyAlgorithm: Add RSASHA256 and RSASHA512 algorithm, guessing
	at the code points.  Note, these require Java 5 or later, or an
	alternate crypto provider.

	* ZoneUtils: add a method to find specific RRs in a list of RRs
	or RRsets.

	* SignZone: make jdnssec-signzone a bit more aggressive in finding
	keys. Now it will look for keyfiles matching keys at the zone
	apex, and, failing that, just look for keyfiles named after the
	zone.  Specifying any keys at all on the command line will
	override this behavior.

2009-02-01  David Blacka  <davidb@verisignlabs.com>

	* DnsKeyAlgorithm: add official aliases from RFC 5155.

	* JCEDnsSecSigner: refactor zone signing methods to remove
	duplicate code.

	* SignZone: move the signZone() methods to JCEDnsSecSigner

	* BINDKeyUtils: close the private key file after reading it.
	Patch by Wolfgang Nagele.

2006-12-15  David Blacka  <davidb@verisignlabs.com>

	* Release version 0.8.4

	* SignZone: updated internals (and dnsjava lib) to match wire
	format changes introduced by the nsec3-08 draft.

2006-10-10  David Blacka  <davidb@verisignlabs.com>

	* Released version 0.8.3

	* ZoneFormat: fix RRSIG ordering issue when dealing with multiple
	RRSIGs for a given RRset.

	* ZoneFormat: lowercase all names in the zone.

	* Fix packaging errors.


2006-09-12  David Blacka  <davidb@verisignlabs.com>

	* Released version 0.8.0.

2006-09-10  David Blacka  <davidb@fury.blacka.com>

	* Added the "KeyInfoTool" command line tool as the start of a tool
	for decoding DNSKEY information.  Right now, mostly just useful
	for checking the public exponenent of RSA keys.

	* Added the "-e" option to jdnssec-keygen, to instruct the key
	generator to use the (common) large exponent in RSA key
	generation.

2006-08-31  David Blacka  <davidb@fury.blacka.com>

	* Modified jdnssec-signzone to set the ttls of NSEC3 records (so
	far) to the SOA minimum value.

	* Add NSEC3PARAM support for compatibility with the -07 NSEC3
	draft.

2006-05-24  David Blacka  <davidb@verisignlabs.com>

	* Add some error checking for the NSEC3 command line parameters
	for jdnssec-signzone.

	* Update local dnsjava build to 2.0.1.  This also contains a
	change to the NSEC3 rdata format (as per the -06pre NSEC3 draft).
	The change is the addition of a "next hashed owner name" length
	octet.

	* Modified the jdnssec-* shell wrappers to also use the local
	build area version of the jdnssec-tools.jar file.  This allows the
	standard jdnssec-* wrappers to work right from the build area.

	* Add support of the SHA256 algorithm for DS records.  This uses
	the SHA256 class that I obtained from Scott Rose (thanks Scott!).

	* Change the name of the package and jar file to jdnssec-tools
	(from java-dnssec-tools) for consistency.

	* release version 0.7.0.

2006-05-23  David Blacka  <davidb@verisignlabs.com>

	* Add support for algorithm aliases.  This feature is so that the
	user can declare the DNSKEY algorithm x is the same as algorithm 5
	(e.g.).  So far, this only works with straight integer algorithm
	identifiers (no private alg support yet).

	* Fix jdnssec-signzone so that you can specify multiple KSKs on
	the command line.  Apparently, commons-cli actually does handle
	repeating command line options correctly.

2006-05-03  David Blacka  <davidb@verisignlabs.com>

	* Add preliminary implementation of jdnssec-dstool.  This is a
	simple command line tool that takes a DNSKEY record and converts
	it into a DS record (or a DLV record).  Right now, it requires
	that the key is stored in a file ending with '.key'.

	* release version 0.6.0.

2006-03-15  David Blacka  <davidb@verisignlabs.com>

	* Type map changes for NSEC3, corresponding to changes in draft
	-05pre.  Essentially: NSEC3 and RRSIG bits are not set for most
	(all) NSEC3 records any longer.

2006-03-06  David Blacka  <davidb@verisignlabs.com>

	* release version 0.5.0.

2006-02-16  David Blacka  <davidb@verisignlabs.com>

	* Make RecordComparator also compare RDATA so the removeDuplicates
	step actually works reliabled.  This was masked by the dupicate
	suppression in org.xbill.DNS.RRset.

	* Only allow one command line specified KSK since commons-cli
	doesn't seem to handle multi-arg options correctly.

	* Do not croak on the lack of the command-line keys for now.

	* New version of local dnsjava build containing NSEC3 changes
	corresponding to the -04pre draft.

2005-11-16  David Blacka  <davidb@verisignlabs.com>

	* Make jdnssec-verifyzone work with just the zone (which is
	self-signed anyway).

	* release version 0.4.2.

2005-11-09  David Blacka  <davidb@verisignlabs.com>

	* Add original ownername comments to the NSEC3 generation.

2005-11-08  David Blacka  <davidb@verisignlabs.com>

	* New zone formatter.

	* Misc bug fixes.

	* release version 0.4.1.

2005-11-07  David Blacka  <davidb@verisignlabs.com>

	* Update the local dnsjava build with a bugfix.

	* Fix ordering problem with ProtoNSEC3s.

2005-11-06  David Blacka  <davidb@verisignlabs.com>

	* Actually use the --iterations command line option of
	jdnssec-signzone.

2005-10-27  David Blacka  <davidb@verisignlabs.com>

	* Add NSEC3 support for jdnssec-signzone.

	* Remove support for plain Opt-In (until private algorithms work).

	* release version 0.4.0.

2005-08-14  David Blacka  <davidb@verisignlabs.com>

	* Move the signZone function into the SignZone class (from the
	SignUtils) class.

	* General cleanup.

	* Add local _jdnssec-* shell wrappers.  These use build/classes in
	the classpath so can be used to run the tools right out of the
	build area.

2005-08-13  David Blacka  <davidb@verisignlabs.com>

	* Update to DNSjava 2.0.0

	* Refactor command line parsing.

	* Switch to using java.util.logging for logging.