dnssec: disable strict changeset application when fixing NSEC chains

src/knot/dnssec/zone-nsec.c

@@ -451,7 +451,14 @@ int knot_zone_fix_nsec_chain(zone_update_t *update,
 	}
 
 	if (ret == KNOT_EOK) {
+		// Disable strict changeset application momentarily for the NSEC chain fix.
+		// This is important for NSEC3, since some nodes are removed from contents
+		// when fixing individual NSEC3 nodes and then the NSEC3 records from these nodes
+		// are removed again when the chain is fixed, resulting in double removal,
+		// forbidden in the strict changeset application.
+		update->a_ctx->flags &= ~APPLY_STRICT;
 		ret = zone_update_apply_changeset(update, &ch);
+		update->a_ctx->flags |= APPLY_STRICT;
 	}
 
 cleanup: