Rollover zones with OpenDNSSEC

rollover.sh

#!/bin/sh

if [ -z $1 ]
then
	echo "$0 zones"
	exit 1
fi

for zone in $@
do
	echo '########################################################################'
	echo "#### $zone"
	echo '########################################################################'

	tmpfile=`mktemp -t rollover`

	# Show active key
	ods-ksmutil key export -z $zone -t KSK -e active 2>/dev/null
	# Show ready keys in DNSKEY and DS form.
	ods-ksmutil key export -z $zone -t KSK -e ready 2>/dev/null | tee $tmpfile
	echo
	ods-ksmutil key export -z $zone -d -t KSK -e ready 2>/dev/null | awk '!/^;/ && !/^$/'
	echo

	key=`awk '/IN	DNSKEY/ {print $11}' $tmpfile`

	rm -f $tmpfile

	# Get the actual DS and/or DLV records.
	echo 'DS'
	dig +trace +noall +answer ds $zone. | awk '!/^;/ && !/^$/'
	echo 'DLV'
	dig +noall +answer dlv $zone.dlv.isc.org. @dlv.ord.sns-pb.isc.org

	read -p "Finish rollover for $zone with $key ? [y/n] : " yes

	case $yes in
		[yY])
			echo

			ods-ksmutil key ds-seen -z $zone -x $key

			echo
	esac

done