Description: Fix install of trust anchor when two anchors are present
Origin: upstream svn commit 4302
Forwarded: not-needed

- Fix install of trust anchor when two anchors are present, makes both
  valid.  Checks hash of DS but not signature of new key.  This fixes
  installs between sep11 and oct11 2017.

[Included as a prerequisite for the CVE-2017-15105 patch --sbeattie]

Index: b/validator/autotrust.c
===================================================================
--- a/validator/autotrust.c	(revision 4301)
+++ b/validator/autotrust.c	(revision 4302)
@@ -1571,6 +1571,11 @@
 			verbose(VERB_ALGO, "DS match attempt failed");
 			continue;
 		}
+		/* match of hash is sufficient for bootstrap of trust point */
+		(void)reason;
+		(void)ve;
+		return 1;
+		/* no need to check RRSIG, DS hash already matched with source
 		if(dnskey_verify_rrset(env, ve, dnskey_rrset, 
 			dnskey_rrset, key_idx, &reason) == sec_status_secure) {
 			return 1;
@@ -1578,6 +1583,7 @@
 			verbose(VERB_ALGO, "DS match failed because the key "
 				"does not verify the keyset: %s", reason);
 		}
+		*/
 	}
 	return 0;
 }

