Publish the newer of the source and stored ACME serials (0.6.4)

CHANGELOG.md

@@ -5,6 +5,15 @@ versioning once its djbdns-compatible public surface stabilizes.
 
 ## [Unreleased]
 
+## [0.6.4] - 2026-09-12
+
+### Fixed
+
+- Publish the newer (RFC 1982 order) of the source data's SOA serial and the
+  stored ACME serial for ACME-managed zones. The stored serial used to replace
+  the source serial unconditionally, so an operator's edit with a higher serial
+  kept publishing the older ACME serial and secondaries never transferred it.
+
 ## [0.6.3] - 2026-08-20
 
 ### Fixed

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "rgbdns"
-version = "0.6.3"
+version = "0.6.4"
 edition = "2024"
 license = "Unlicense"
 description = "A safe, faithful Rust reimplementation of the djbdns suite"

README.md

@@ -172,7 +172,7 @@ On Debian or Ubuntu, build the package with:
 ```sh
 sudo apt install build-essential cargo debhelper rustc
 packaging/build-deb.sh
-sudo apt install ../rgbdns_0.6.3_$(dpkg --print-architecture).deb
+sudo apt install ../rgbdns_0.6.4_$(dpkg --print-architecture).deb
 ```
 
 On openSUSE Leap 16.0, build the RPM with:
@@ -182,7 +182,7 @@ sudo zypper --non-interactive install \
   git cargo rust python3 rpm-build systemd-rpm-macros
 packaging/build-rpm.sh
 sudo zypper --non-interactive --no-gpg-checks install \
-  dist/rpmbuild/RPMS/x86_64/rgbdns-0.6.3-1.x86_64.rpm
+  dist/rpmbuild/RPMS/x86_64/rgbdns-0.6.4-1.x86_64.rpm
 ```
 
 ## Book

debian/changelog

@@ -1,3 +1,10 @@
+rgbdns (0.6.4) unstable; urgency=medium
+
+  * Publish the newer of the source data serial and the stored ACME serial for
+    ACME-managed zones, so operator edits reach secondaries.
+
+ -- Alexy Khrabrov <deliverable@gmail.com>  Sat, 12 Sep 2026 08:00:00 -0700
+
 rgbdns (0.6.3) unstable; urgency=medium
 
   * Answer mixed-case negative queries with signed NSEC proofs instead of

debian/rgbdns.7

@@ -1,4 +1,4 @@
-.TH RGBDNS 7 "2026-08-18" "rgbdns 0.6.3" "System Administration"
+.TH RGBDNS 7 "2026-08-18" "rgbdns 0.6.4" "System Administration"
 .SH NAME
 rgbdns \- authoritative DNS, AXFR, recursion, and djbdns-compatible tools
 .SH SYNOPSIS

docs/DEBIAN.md

@@ -20,7 +20,7 @@ sudo apt install build-essential cargo debhelper rustc
 git clone https://github.com/querygraph/rgbdns.git
 cd rgbdns
 packaging/build-deb.sh
-sudo apt install ../rgbdns_0.6.3_$(dpkg --print-architecture).deb
+sudo apt install ../rgbdns_0.6.4_$(dpkg --print-architecture).deb
 ```
 
 `packaging/build-deb.sh` calls `dpkg-buildpackage --build=binary --no-sign`.
@@ -258,16 +258,16 @@ sudo apt install -y build-essential cargo debhelper rustc git
 git clone https://github.com/querygraph/rgbdns.git
 cd rgbdns
 packaging/build-deb.sh
-dpkg-deb --info ../rgbdns_0.6.3_amd64.deb
+dpkg-deb --info ../rgbdns_0.6.4_amd64.deb
 ```
 
 Copy the package to the EC2 host, then install it there:
 
 ```sh
-scp ../rgbdns_0.6.3_amd64.deb admin@52.10.53.234:/tmp/
+scp ../rgbdns_0.6.4_amd64.deb admin@52.10.53.234:/tmp/
 ssh admin@52.10.53.234
 sudo apt update
-sudo apt install -y /tmp/rgbdns_0.6.3_amd64.deb
+sudo apt install -y /tmp/rgbdns_0.6.4_amd64.deb
 dpkg-query -W rgbdns
 ```
 

docs/DNSSEC-DESIGN.md

@@ -1,6 +1,6 @@
 # DNSSEC design: small tools and visible state
 
-Status: implementation contract for rgbdns 0.6.3.
+Status: implementation contract for rgbdns 0.6.4.
 
 rgbdns DNSSEC follows the tinydns posture: each program does one bounded job,
 configuration is one record per line, persistent state is an ordinary file, and
@@ -152,7 +152,7 @@ they do not resolve the target independently for a signed zone.
 
 Key creation, activation, parent DS publication, rollover, revocation, and
 retirement are distinct operator actions represented by files and policy
-lines. Version 0.6.3 delivers safe single-key operation and DS derivation. A
+lines. Version 0.6.4 delivers safe single-key operation and DS derivation. A
 later feature release will add a deliberately specified multi-key rollover
 state machine; operators must not simulate rollover by silently swapping a key
 file under an unchanged policy line.

docs/DNSSEC.md

@@ -1,6 +1,6 @@
 # Optional authoritative DNSSEC
 
-rgbdns 0.6.3 adds authoritative DNSSEC as an explicit offline publication
+rgbdns 0.6.4 adds authoritative DNSSEC as an explicit offline publication
 pipeline. It is disabled by default. If `/etc/rgbdns/dnssec.env` and the
 working-directory `dnssec` policy are absent, `tinydns-data`, `tinydns`, ACME,
 ANAME, setup, and secondary synchronization follow the existing
@@ -43,7 +43,7 @@ This permits a deliberate mixed signed/unsigned CDB without making omission
 mean “unsigned.”
 
 Keep a recoverable encrypted backup of the key. Key replacement is not an
-implicit file operation: version 0.6.3 deliberately supports one active
+implicit file operation: version 0.6.4 deliberately supports one active
 combined signing key per zone and does not claim an automated multi-key
 rollover state machine.
 

docs/OPENSUSE.md

@@ -55,8 +55,8 @@ sudo zypper --non-interactive install \
 git clone https://github.com/querygraph/rgbdns.git
 cd rgbdns
 packaging/build-rpm.sh
-rpm -qip dist/rpmbuild/RPMS/x86_64/rgbdns-0.6.3-1.x86_64.rpm
-rpm -qlp dist/rpmbuild/RPMS/x86_64/rgbdns-0.6.3-1.x86_64.rpm
+rpm -qip dist/rpmbuild/RPMS/x86_64/rgbdns-0.6.4-1.x86_64.rpm
+rpm -qlp dist/rpmbuild/RPMS/x86_64/rgbdns-0.6.4-1.x86_64.rpm
 ```
 
 `build-rpm.sh` creates a clean rpmbuild tree under `dist/rpmbuild`, archives
@@ -81,9 +81,9 @@ gh run download RUN_ID \
 Inspect an artifact before installation:
 
 ```sh
-rpm -K dist/cloud-rpm/rgbdns-0.6.3-1.x86_64.rpm
-rpm -qip dist/cloud-rpm/rgbdns-0.6.3-1.x86_64.rpm
-rpm -qlp dist/cloud-rpm/rgbdns-0.6.3-1.x86_64.rpm
+rpm -K dist/cloud-rpm/rgbdns-0.6.4-1.x86_64.rpm
+rpm -qip dist/cloud-rpm/rgbdns-0.6.4-1.x86_64.rpm
+rpm -qlp dist/cloud-rpm/rgbdns-0.6.4-1.x86_64.rpm
 ```
 
 The development RPM is not repository-signed. `rpm -K` still verifies the
@@ -96,11 +96,11 @@ Copy a locally built package to the EC2 instance:
 
 ```sh
 scp -i ~/.ssh/KEY.pem \
-  dist/rpmbuild/RPMS/x86_64/rgbdns-0.6.3-1.x86_64.rpm \
+  dist/rpmbuild/RPMS/x86_64/rgbdns-0.6.4-1.x86_64.rpm \
   ec2-user@PUBLIC_ADDRESS:/tmp/
 ssh -i ~/.ssh/KEY.pem ec2-user@PUBLIC_ADDRESS
 sudo zypper --non-interactive --no-gpg-checks install \
-  /tmp/rgbdns-0.6.3-1.x86_64.rpm
+  /tmp/rgbdns-0.6.4-1.x86_64.rpm
 rpm -q rgbdns
 rpm -V rgbdns
 ```

docs/RGBDNS_SETUP.md

@@ -1,6 +1,6 @@
 # End-to-end rgbdns setup: `fieldnotes.es`
 
-This walkthrough deploys rgbdns 0.6.3 on two AWS EC2 instances and retains
+This walkthrough deploys rgbdns 0.6.4 on two AWS EC2 instances and retains
 BuddyNS as an additional secondary network. It covers installation, initial
 role configuration, authoritative data, AXFR, atomic primary and secondary
 updates, verification, upgrades, and recovery.
@@ -118,27 +118,27 @@ gh run download "$RPM_RUN" \
   -D "$HOME/rgbdns-rpm"
 ```
 
-The 0.6.3 artifacts are:
+The 0.6.4 artifacts are:
 
 ```text
-rgbdns_0.6.3_amd64.deb
-RPMS/x86_64/rgbdns-0.6.3-1.x86_64.rpm
-SRPMS/rgbdns-0.6.3-1.src.rpm
+rgbdns_0.6.4_amd64.deb
+RPMS/x86_64/rgbdns-0.6.4-1.x86_64.rpm
+SRPMS/rgbdns-0.6.4-1.src.rpm
 ```
 
 ## 4. Install the Debian package on the primary
 
 Copy the package:
 
 ```sh
-scp "$HOME/rgbdns-deb/rgbdns_0.6.3_amd64.deb" \
+scp "$HOME/rgbdns-deb/rgbdns_0.6.4_amd64.deb" \
   bitnami@52.10.53.234:/tmp/
 ```
 
 On the primary:
 
 ```sh
-sudo apt install /tmp/rgbdns_0.6.3_amd64.deb
+sudo apt install /tmp/rgbdns_0.6.4_amd64.deb
 sudo systemctl daemon-reload
 dpkg-query -W -f='${Package} ${Version}\n' rgbdns
 getent passwd rgbdns
@@ -160,15 +160,15 @@ SUSE_USER=ec2-user
 Copy the package:
 
 ```sh
-scp "$HOME/rgbdns-rpm/RPMS/x86_64/rgbdns-0.6.3-1.x86_64.rpm" \
+scp "$HOME/rgbdns-rpm/RPMS/x86_64/rgbdns-0.6.4-1.x86_64.rpm" \
   "$SUSE_USER"@52.38.177.160:/tmp/
 ```
 
 On the secondary:
 
 ```sh
 sudo zypper --non-interactive --no-gpg-checks install \
-  /tmp/rgbdns-0.6.3-1.x86_64.rpm
+  /tmp/rgbdns-0.6.4-1.x86_64.rpm
 sudo systemctl daemon-reload
 rpm -q rgbdns
 sudo rpm -V rgbdns

docs/conformance.md

@@ -52,7 +52,7 @@ normative RFC that supplies each oracle.
 
 ## Deliberate scope boundaries
 
-The following are not claimed as implemented by rgbdns 0.6.3:
+The following are not claimed as implemented by rgbdns 0.6.4:
 
 - general-purpose dynamic UPDATE, NOTIFY, IXFR, DSO, DNS Cookies, or SIG(0);
 - TSIG algorithms other than the ACME update profile's HMAC-SHA256;

man/acme-materialize.1

@@ -1,4 +1,4 @@
-.TH ACME-MATERIALIZE 1 "2026-08-18" "rgbdns 0.6.3" "User Commands"
+.TH ACME-MATERIALIZE 1 "2026-08-18" "rgbdns 0.6.4" "User Commands"
 .SH NAME
 acme-materialize \- merge durable ACME DNS-01 state into tinydns source
 .SH SYNOPSIS

man/aname-materialize.1

@@ -1,4 +1,4 @@
-.TH ANAME-MATERIALIZE 1 "2026-08-18" "rgbdns 0.6.3" "User Commands"
+.TH ANAME-MATERIALIZE 1 "2026-08-18" "rgbdns 0.6.4" "User Commands"
 .SH NAME
 aname-materialize \- replace rgbdns ANAME directives with address records
 .SH SYNOPSIS

man/axfr-get.1

@@ -1,4 +1,4 @@
-.TH AXFR-GET 1 "2026-07-23" "rgbdns 0.6.3" "User Commands"
+.TH AXFR-GET 1 "2026-07-23" "rgbdns 0.6.4" "User Commands"
 .SH NAME
 axfr-get \- retrieve a DNS zone using AXFR
 .SH SYNOPSIS

man/axfrdns-conf.1

@@ -1,4 +1,4 @@
-.TH AXFRDNS-CONF 1 "2026-07-23" "rgbdns 0.6.3" "User Commands"
+.TH AXFRDNS-CONF 1 "2026-07-23" "rgbdns 0.6.4" "User Commands"
 .SH NAME
 axfrdns-conf \- create an axfrdns service directory
 .SH SYNOPSIS

man/axfrdns.1

@@ -1,4 +1,4 @@
-.TH AXFRDNS 1 "2026-07-23" "rgbdns 0.6.3" "User Commands"
+.TH AXFRDNS 1 "2026-07-23" "rgbdns 0.6.4" "User Commands"
 .SH NAME
 axfrdns \- serve DNS zone transfers
 .SH SYNOPSIS

man/compile-zone.8

@@ -1,4 +1,4 @@
-.TH COMPILE-ZONE 8 "2026-07-23" "rgbdns 0.6.3" "System Administration"
+.TH COMPILE-ZONE 8 "2026-07-23" "rgbdns 0.6.4" "System Administration"
 .SH NAME
 compile-zone \- compile the packaged authoritative zone
 .SH SYNOPSIS

man/dnscache-conf.1

@@ -1,4 +1,4 @@
-.TH DNSCACHE-CONF 1 "2026-07-23" "rgbdns 0.6.3" "User Commands"
+.TH DNSCACHE-CONF 1 "2026-07-23" "rgbdns 0.6.4" "User Commands"
 .SH NAME
 dnscache-conf \- create a dnscache service directory
 .SH SYNOPSIS

man/dnscache.1

@@ -1,4 +1,4 @@
-.TH DNSCACHE 1 "2026-07-23" "rgbdns 0.6.3" "User Commands"
+.TH DNSCACHE 1 "2026-07-23" "rgbdns 0.6.4" "User Commands"
 .SH NAME
 dnscache \- caching recursive DNS resolver
 .SH SYNOPSIS

man/dnsfilter.1

@@ -1,4 +1,4 @@
-.TH DNSFILTER 1 "2026-07-23" "rgbdns 0.6.3" "User Commands"
+.TH DNSFILTER 1 "2026-07-23" "rgbdns 0.6.4" "User Commands"
 .SH NAME
 dnsfilter \- add reverse DNS names to input lines
 .SH SYNOPSIS

man/dnsip.1

@@ -1,4 +1,4 @@
-.TH DNSIP 1 "2026-07-23" "rgbdns 0.6.3" "User Commands"
+.TH DNSIP 1 "2026-07-23" "rgbdns 0.6.4" "User Commands"
 .SH NAME
 dnsip \- look up IPv4 addresses
 .SH SYNOPSIS

man/dnsip6.1

@@ -1,4 +1,4 @@
-.TH DNSIP6 1 "2026-07-23" "rgbdns 0.6.3" "User Commands"
+.TH DNSIP6 1 "2026-07-23" "rgbdns 0.6.4" "User Commands"
 .SH NAME
 dnsip6 \- look up IPv6 addresses
 .SH SYNOPSIS

man/dnsip6q.1

@@ -1,4 +1,4 @@
-.TH DNSIP6Q 1 "2026-07-23" "rgbdns 0.6.3" "User Commands"
+.TH DNSIP6Q 1 "2026-07-23" "rgbdns 0.6.4" "User Commands"
 .SH NAME
 dnsip6q \- look up and label IPv6 addresses
 .SH SYNOPSIS

man/dnsipq.1

@@ -1,4 +1,4 @@
-.TH DNSIPQ 1 "2026-07-23" "rgbdns 0.6.3" "User Commands"
+.TH DNSIPQ 1 "2026-07-23" "rgbdns 0.6.4" "User Commands"
 .SH NAME
 dnsipq \- look up and label IPv4 addresses
 .SH SYNOPSIS

man/dnsmx.1

@@ -1,4 +1,4 @@
-.TH DNSMX 1 "2026-07-23" "rgbdns 0.6.3" "User Commands"
+.TH DNSMX 1 "2026-07-23" "rgbdns 0.6.4" "User Commands"
 .SH NAME
 dnsmx \- look up mail exchangers
 .SH SYNOPSIS

man/dnsname.1

@@ -1,4 +1,4 @@
-.TH DNSNAME 1 "2026-07-23" "rgbdns 0.6.3" "User Commands"
+.TH DNSNAME 1 "2026-07-23" "rgbdns 0.6.4" "User Commands"
 .SH NAME
 dnsname \- look up names for IPv4 addresses
 .SH SYNOPSIS

man/dnsq.1

@@ -1,4 +1,4 @@
-.TH DNSQ 1 "2026-07-23" "rgbdns 0.6.3" "User Commands"
+.TH DNSQ 1 "2026-07-23" "rgbdns 0.6.4" "User Commands"
 .SH NAME
 dnsq \- send a non-recursive DNS query
 .SH SYNOPSIS

man/dnsqr.1

@@ -1,4 +1,4 @@
-.TH DNSQR 1 "2026-07-23" "rgbdns 0.6.3" "User Commands"
+.TH DNSQR 1 "2026-07-23" "rgbdns 0.6.4" "User Commands"
 .SH NAME
 dnsqr \- perform a recursive DNS query
 .SH SYNOPSIS

man/dnstrace.1

@@ -1,4 +1,4 @@
-.TH DNSTRACE 1 "2026-07-23" "rgbdns 0.6.3" "User Commands"
+.TH DNSTRACE 1 "2026-07-23" "rgbdns 0.6.4" "User Commands"
 .SH NAME
 dnstrace \- trace DNS delegation
 .SH SYNOPSIS

man/dnstxt.1

@@ -1,4 +1,4 @@
-.TH DNSTXT 1 "2026-07-23" "rgbdns 0.6.3" "User Commands"
+.TH DNSTXT 1 "2026-07-23" "rgbdns 0.6.4" "User Commands"
 .SH NAME
 dnstxt \- look up DNS text records
 .SH SYNOPSIS

man/multilog.1

@@ -1,4 +1,4 @@
-.TH MULTILOG 1 "2026-07-23" "rgbdns 0.6.3" "User Commands"
+.TH MULTILOG 1 "2026-07-23" "rgbdns 0.6.4" "User Commands"
 .SH NAME
 multilog \- collect and rotate service logs
 .SH SYNOPSIS

man/pickdns-conf.1

@@ -1,4 +1,4 @@
-.TH PICKDNS-CONF 1 "2026-07-23" "rgbdns 0.6.3" "User Commands"
+.TH PICKDNS-CONF 1 "2026-07-23" "rgbdns 0.6.4" "User Commands"
 .SH NAME
 pickdns-conf \- create a pickdns service directory
 .SH SYNOPSIS

man/pickdns-data.1

@@ -1,4 +1,4 @@
-.TH PICKDNS-DATA 1 "2026-07-23" "rgbdns 0.6.3" "User Commands"
+.TH PICKDNS-DATA 1 "2026-07-23" "rgbdns 0.6.4" "User Commands"
 .SH NAME
 pickdns-data \- compile a pickdns database
 .SH SYNOPSIS

man/pickdns.1

@@ -1,4 +1,4 @@
-.TH PICKDNS 1 "2026-07-23" "rgbdns 0.6.3" "User Commands"
+.TH PICKDNS 1 "2026-07-23" "rgbdns 0.6.4" "User Commands"
 .SH NAME
 pickdns \- serve location-dependent DNS data
 .SH SYNOPSIS

man/random-ip.1

@@ -1,4 +1,4 @@
-.TH RANDOM-IP 1 "2026-07-23" "rgbdns 0.6.3" "User Commands"
+.TH RANDOM-IP 1 "2026-07-23" "rgbdns 0.6.4" "User Commands"
 .SH NAME
 random-ip \- generate shuffled IPv4 addresses
 .SH SYNOPSIS

man/rbldns-conf.1

@@ -1,4 +1,4 @@
-.TH RBLDNS-CONF 1 "2026-07-23" "rgbdns 0.6.3" "User Commands"
+.TH RBLDNS-CONF 1 "2026-07-23" "rgbdns 0.6.4" "User Commands"
 .SH NAME
 rbldns-conf \- create an rbldns service directory
 .SH SYNOPSIS

man/rbldns-data.1

@@ -1,4 +1,4 @@
-.TH RBLDNS-DATA 1 "2026-07-23" "rgbdns 0.6.3" "User Commands"
+.TH RBLDNS-DATA 1 "2026-07-23" "rgbdns 0.6.4" "User Commands"
 .SH NAME
 rbldns-data \- compile an rbldns database
 .SH SYNOPSIS

man/rbldns.1

@@ -1,4 +1,4 @@
-.TH RBLDNS 1 "2026-07-23" "rgbdns 0.6.3" "User Commands"
+.TH RBLDNS 1 "2026-07-23" "rgbdns 0.6.4" "User Commands"
 .SH NAME
 rbldns \- serve a DNS block-list database
 .SH SYNOPSIS