From 43bbfbeb3c27e5e1402237ac6a90c2ade6ed2cb5 Mon Sep 17 00:00:00 2001
From: Matthijs Mekking <matthijs@isc.org>
Date: Mon, 18 May 2026 15:13:38 +0200
Subject: [PATCH] Check conf dnssec-policy inline-signing secondary

Add a variant of checking configuration where inline-signing is
enabled on the secondary, requiring the 'file' entry. This time,
inline-signing is implicitly enabled via dnssec-policy.
---
 bin/tests/system/checkconf/inline-inherit.conf | 7 +++++++
 bin/tests/system/checkconf/tests.sh            | 3 +++
 2 files changed, 10 insertions(+)
 create mode 100644 bin/tests/system/checkconf/inline-inherit.conf

diff --git a/bin/tests/system/checkconf/inline-inherit.conf b/bin/tests/system/checkconf/inline-inherit.conf
new file mode 100644
index 0000000000..8cc7da6b85
--- /dev/null
+++ b/bin/tests/system/checkconf/inline-inherit.conf
@@ -0,0 +1,7 @@
+remote-servers "stealthPrimaries" {127.0.0.1;};
+zone "example.net" {
+	type secondary;
+	dnssec-policy default;
+	primaries { stealthPrimaries; };
+};
+
diff --git a/bin/tests/system/checkconf/tests.sh b/bin/tests/system/checkconf/tests.sh
index 330da510e3..539afaf56a 100644
--- a/bin/tests/system/checkconf/tests.sh
+++ b/bin/tests/system/checkconf/tests.sh
@@ -277,6 +277,9 @@ l=$(grep "missing 'file' entry" <checkconf.out$n.2 | wc -l)
 $CHECKCONF inline-bad.conf >checkconf.out$n.3 2>&1 && ret=1
 l=$(grep "missing 'file' entry" <checkconf.out$n.3 | wc -l)
 [ $l -eq 1 ] || ret=1
+$CHECKCONF inline-inherit.conf >checkconf.out$n.3 2>&1 && ret=1
+l=$(grep "missing 'file' entry" <checkconf.out$n.3 | wc -l)
+[ $l -eq 1 ] || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status + ret))