From f98638904d4a87d45b09306b555776b0b13141a9 Mon Sep 17 00:00:00 2001
From: Matthijs Mekking <matthijs@isc.org>
Date: Mon, 18 May 2026 15:13:38 +0200
Subject: [PATCH 1/2] Check conf dnssec-policy inline-signing secondary

Add a variant of checking configuration where inline-signing is
enabled on the secondary, requiring the 'file' entry. This time,
inline-signing is implicitly enabled via dnssec-policy.

(cherry picked from commit 43bbfbeb3c27e5e1402237ac6a90c2ade6ed2cb5)
---
 bin/tests/system/checkconf/inline-inherit.conf | 8 ++++++++
 bin/tests/system/checkconf/tests.sh            | 3 +++
 2 files changed, 11 insertions(+)
 create mode 100644 bin/tests/system/checkconf/inline-inherit.conf

diff --git a/bin/tests/system/checkconf/inline-inherit.conf b/bin/tests/system/checkconf/inline-inherit.conf
new file mode 100644
index 0000000000..568696740b
--- /dev/null
+++ b/bin/tests/system/checkconf/inline-inherit.conf
@@ -0,0 +1,8 @@
+remote-servers "stealthPrimaries" {127.0.0.1;};
+zone "example.net" {
+	type secondary;
+	dnssec-policy default;
+	inline-signing yes;
+	primaries { stealthPrimaries; };
+};
+
diff --git a/bin/tests/system/checkconf/tests.sh b/bin/tests/system/checkconf/tests.sh
index 52666671a5..0e45144897 100644
--- a/bin/tests/system/checkconf/tests.sh
+++ b/bin/tests/system/checkconf/tests.sh
@@ -297,6 +297,9 @@ l=$(grep "missing 'file' entry" <checkconf.out$n.2 | wc -l)
 $CHECKCONF inline-bad.conf >checkconf.out$n.3 2>&1 && ret=1
 l=$(grep "missing 'file' entry" <checkconf.out$n.3 | wc -l)
 [ $l -eq 1 ] || ret=1
+$CHECKCONF inline-inherit.conf >checkconf.out$n.3 2>&1 && ret=1
+l=$(grep "missing 'file' entry" <checkconf.out$n.3 | wc -l)
+[ $l -eq 1 ] || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status + ret))