reinit the tree, so we can have metadata

21 files changed, 1624 insertions, 0 deletions

diff --git a/net-dns/opendnssec/Manifest b/net-dns/opendnssec/Manifest
new file mode 100644
index 000000000000..b2f4ef27a586
--- /dev/null
+++ b/net-dns/opendnssec/Manifest
@@ -0,0 +1,27 @@
+AUX opendnssec-1.3.14-drop-privileges.patch 906 SHA256 faecb049748efab2652b890020106748039dbe7022d943393ac50b71b429b340 SHA512 cbc17153fcd617bcbc54a0b14111908635dae722f845f894d9c6769d77960433fa75c3ec0a5061af054167b4223f7f2946c3e3ba09c2bb55598f72f71d1c2106 WHIRLPOOL da7588424ce440bc302d8acacff2f702e623fe32682b1ddcd4674209f15dbcf8606ad35f59fc2d60e397d8618a7b59b1a56503b1b23a210f924e07dec51f6f16
+AUX opendnssec-1.3.14-use-system-trang.patch 706 SHA256 c704b8e232c950166131be6e70c7b48ff4f57800de7dae2a08012ef5d945f4c7 SHA512 e7d664f6ee548efeae7a015ceaf21b3fedc7654ed295ecd2440b0212015c1556b4f1bac978a2f804e7b6830181273484b428e1a363989eff067a9b3587937b7f WHIRLPOOL 92ffcd46ffaa6a7583114237a58bf634cf26445f3fe023be347f63bd88a0560371d7e89aa820e2fb7c6a6a971a4fee1bb281424baa6f6ce895c0db62d9d60146
+AUX opendnssec-1.3.18-eppclient-curl-CVE-2012-5582.patch 751 SHA256 5613a6de3b65eb1a3e0006e5e8d676d48789d23636d6b218d1ee2fbb5b69a3ae SHA512 f89fc43b96a76ed9af9ac4f28993037ee709d19e8cfeb53da2bdff2eb723c4200fe70aaac8b651998b9b6685343777316141dd0ee2ebc600f703d8dadca24d43 WHIRLPOOL e9790ebb811824f33443ca93429e59377239ac8f443c6eafe16250b68497877d4d0100ff734fd663f4dff697842fdf1b6803e80d4aab5c9cd2fb6260cae19448
+AUX opendnssec-drop-privileges-2.0.x.patch 813 SHA256 a961424707e048b62e31d0c73c516d93c537931f0d80f000a095eed1ba2e6635 SHA512 425eb123452183b4e4a3e87e9a71afa81684fe4af9c111d1bad3433ee640907cf3caa1065711f67286bb0336fd8d82e3f4bfeef94e3ff620bcbdaf960d4137b8 WHIRLPOOL 0c234dfefc3d9d26f399ed9b552a15b975c770b73f3452279cb41cbedb98ac188fcbecbb6e842c0a22f09f6bff2902fc2e0597d7b4974a8ab0a5c4ba856911bf
+AUX opendnssec-drop-privileges.patch 641 SHA256 9bc831bf45a022a9be1a2bd6ee80d9e06fa4d5cdf553ae7dfd50e3a592e5b8dd SHA512 60cb666d821ae8880ccb789f8d2b60ea218a98e1b7b9393d8dc299be55efbd93efb9334ebf5cbf55f67ef1c58df1206dce906994bd9808e3db5a5bf9644a7f06 WHIRLPOOL 90f55f6572933e4c1042076aaa42a9cd19cd7e4c0e7a0598c8ae6cb22e0c7dcc6cd18fa408e2ed80eaadccefa39b4928c59e8bf0ae3398c948092828f9342ebf
+AUX opendnssec-fix-localstatedir-2.0.x.patch 1161 SHA256 028de3256f5604472a0352fe2a9988f2eac51457cc05b4f3b794d021cc2aab8f SHA512 1d07f2108238c041041c96b4efaaec1e75740ed54fbd6390fa45f5ccf7f631c1e8d4400bb9cb95023c8909ae10abc3c93aaa137f954921af75825c06a6d94d9a WHIRLPOOL 5c5d1c035eee77af74cad6a7bec3f085300cdd446090640731430745e1cf6a0769c92de9d7e968e31dce165273ff6bb8400d07f02fc27fc90d383df3b84ea9a0
+AUX opendnssec-fix-localstatedir.patch 1693 SHA256 e9a29b3adf22ef6dd3a0ac43d2a48e2705ae09cd7550b4f3294b89dcd7814ecd SHA512 86700c97bb482f5fa6d99fe8f105c41e8798de542e6cf5fd4d6c14da11237e4fd11eccb2900de4893898d7855e31beb6572c709c2dad9774d5fe440673af2627 WHIRLPOOL 56c5e876e2e2832265474c3772a44efa288eb387438a6864d85956a990f9cedc81e60dc7922448d647702359e835c0fef7db1d6d5e643b195cd6ad26117c3f53
+AUX opendnssec-fix-run-dir-2.0.x.patch 1188 SHA256 c134ad1f6a6222ff5e52019ca5975697d68b55ab110801778ffb5053a5bb8853 SHA512 293c2ceb336623ed52028ca3144c4249eaf426dd2eb84890be9f1ed53e27d4ff5fd6a699d41426ca57d6362c2f83dd8b3556691da2815235f72e69ab4ef45165 WHIRLPOOL 293a0228a85988f4dd23ef4a16bb113fd2f23c3df35edc623996eebe09794b451a134066609b521ae5a50bccc2dca0c6ad7c7b26d970df600ee376554aa2cb30
+AUX opendnssec-fix-run-dir.patch 1204 SHA256 bc9736e424dcc739988d78b8842a44261a71a2e7073bfbd53b985db121f9f3b6 SHA512 f604ab24731bd84498f33dc3213b937335e55f805d4913e80b037b91cc5bf14f406cb2af14cc455a9a23c45a3475ef1b3901c68760188d9e4a36d314d29f8f84 WHIRLPOOL 11d5963d69022ed6e03f0ebda74fd315a8bbd59ff086a7ae8c8dfd42e02062a34d7b888c2e7929af3a1214ddfa81f98ed0ff8aacbb4949bb652ebdac1f72ae08
+AUX opendnssec-use-system-trang.patch 614 SHA256 7e8485e0f8ff1df5f9f799b908c802cf3670ecfcff6e3bf858d69429638e86b4 SHA512 9e95943d145ce7a05e32af60a944c6ee6d74fdff0fa9f0ea233070b44567bce4f5ca6bde57411effa7bab192ec58face34cddf2c349ccff3b78fc66c1f35074d WHIRLPOOL 82282bc2fc7797ff946aee5cee6e182abde0b65283865a9b084613a0dba7e53762494197c7479a6324fc3c81c8c80acf9d0d8a898a183acfe6ab62cf2a6ed1e6
+AUX opendnssec.confd 393 SHA256 cfb0c2ba683878c9f1b99618776aea152679e95ae26ecf4337b63f1a9cf0006c SHA512 17bd24efef9bd6b7a907c75126809a6012db23a6c8547169c41dbc62fc91775331f445905282bc6c2ef13357f92eccab5008d4605419d98acdb723806b63a924 WHIRLPOOL e9eb636b8fc2016bdbdedf44e7625562b1c5f6ddcf60af87cdaf1ca6e74dfb4f08886f946e788005ed3c97667417cfed9fb2fb688ad1a40ce992913a7007c142
+AUX opendnssec.confd-1.3.x 477 SHA256 9db752afc06fe3cc76bf7d4195d74853db7ccce3993b5ccd896b07b37de84909 SHA512 e45cd05e9d972dce5254f333ce21fd599ed905e8009f67de636c3a72dcd49e43fb75f702e21665dd3f19602fb9a5be5b6ff34e147ac4e29844560cc4f65f727c WHIRLPOOL 14a56cc365cdcb201f48a4c42838bc82524a2e067f4aa2f49aeada2ae2757b9c7d3f3cb375993d2f2e48364c696438404b41d64abb9a2d773f9f82e77efc5bdc
+AUX opendnssec.initd 1854 SHA256 9f200b6b2d1e2da1a161f3275992115788dd36a3eeffbaaece0d896b51cb445d SHA512 75bce27c152b55ba2ba7d0770c6f2149493ef4b145f2257328e7e4b6865ad2d644695a688c3e06be02705ac42752e031846551b80b560e19a73e595e5ad15def WHIRLPOOL 34cd2588877cd300628e5cb86e055ffc07e6682ba3ad448d83d3975e8d6802702e343437acbc187522c7a4b24672e0fff0dce4f9023908c8d9f1857e80078d3f
+AUX opendnssec.initd-1.3.x 2873 SHA256 4060ab0ecca436c08551efa693819aa2b59e84dc2cff5b36d143cde56a37dcb3 SHA512 e824206169a625b3e9cd817489870ad422793f6142abf0878049d3c075efe8c9e5895802e0ff0c4d4f36775e31aad19346c3ba0a76572dc6a0106883d9b0968d WHIRLPOOL 39f302dd5c89134689b47ff81d73a4af816bd37a6ef5f453df9c023259701f9ad264da5d7c3af1f314800ecdc23788ee57eb872d65936725c402608f245cc9a8
+DIST opendnssec-1.3.18.tar.gz 1143889 SHA256 e61d23ae0cc57b6e09d408bade6872fe5241896c61a03e8bc5ceeb65df13a676 SHA512 5df39ba778c9b1245e88b81df7aa491bca0aad2943845284c4f8b4dd729fa69014d45f07bdf99a048ccf668a1c9675a8dd99efcec1abdbd4e06e9738fec6ab6d WHIRLPOOL 7213b8f2f86651114449bc4734452d6065960e26ee289051949ca27ae3b23280cea45ff707f71942eef91c9009200272c0985ef3d3de43c9343ad2e1e54303ce
+DIST opendnssec-1.4.12.tar.gz 1036392 SHA256 4ba6cf06fcd1131c1ed913d61959ddc90726ed5e4f153c90f45ec64445528a0c SHA512 b72b76ab4aec8cc63cc9c020bef9a24b000fd00172a07cf43d57b3a33041bef9e107b71eb7271bb13c3566510599c6a1913cf986a724e169c42dc8bdac8d2e51 WHIRLPOOL f6b98b3f7522185383f1bac4b233bf725a24ba998fd09c61762de25baeb70ce3633909bc5ffe7f0ac9e83201adbe73c701e7a1892c059908ed17a75731d6335c
+DIST opendnssec-1.4.8.2.tar.gz 1043171 SHA256 7fd553ee39173e807477ed1daff6ee2f8b1c83875cd2e52a1df3315bf0015513 SHA512 7f2e10b425f60947aca40c61509b07ddc4363105cc882b518ffa816437299d6f881411cb38325f27b3a34c2005953988b39c945362866dd0f1f7c6ef973bfa06 WHIRLPOOL 38079a89d8e3d039aeab28c80b7fb1a9739014736d6076442c546fae1b13e1c89faa1858beb6f4d2f495d19a2a1187a7af10c55c0ed33563bc9b2d57945de807
+DIST opendnssec-2.0.1.tar.gz 1101523 SHA256 bf874bbb346699a5b539699f90a54e0c15fff0574df7a3c118abb30938b7b346 SHA512 aa12818f92688e087acaff8a6771d2a7da733e04d9e821967d313c7ff880a1056f470b11988eba1e7aad606418c3a4587f654163d74f68e3f61943c74d86d052 WHIRLPOOL 865fbd0d21cd015e87da5f26858e39a233464fb04e56a21683b4713d3836b925eea80973446571da78730ef765d5a1a3fc5f8ad192dd09fdf6eb7467ae417769
+DIST opendnssec-2.0.3.tar.gz 1103355 SHA256 ebeb5481d696cf83c21c5dfbecce6ab5dcc73df1a08573ef257f2f6fe10f6214 SHA512 4745a9ac317cc65d6f5b14be640687efd5fde2149541f692fb607a458378d27e903f175023c1aa16a777d17cef9cc68f1a84e7e7cdb233466d26756721b34424 WHIRLPOOL 51389851b46b62ee1829dd2af5cb41edbe28484ff23dd9b281f77ee7966dd67aa743f1c8d869052bb0a598cf42ab850ad0d2f80343b26aaf551940bb9f0d3f41
+EBUILD opendnssec-1.3.18-r1.ebuild 5693 SHA256 b4f50fe2dc4698e1f1457391f6490dbbfbf67ba01a66031a5da9819af1d1d1b1 SHA512 6322f3c01ce746605249fe7a7e748b3d59017a2cda394f750eb3ce646923335a6659cf47a240bd5c07b179ba3219f8a650a610b898d3ead4d4b68c3f150bcc34 WHIRLPOOL a622c523e2f9332e784963d10ddc52043c15cf49f048a7d1529c7cd10dee81e703f06528b421aa60d01c18f57acfa2816ab249e4f40a65b64e057012fab2299f
+EBUILD opendnssec-1.4.12-r1.ebuild 5780 SHA256 caf2d7b04e4d4a34ceb3552960c9541b5d6cd1e136fbd3c4f676e5541344db80 SHA512 3e0ac6197e86315794dd604de6adb605845c09f8a00958189f35d3432b748de2e2d8589c217035c4dd167971452026d56a6b2ca38db0af8d7eb18ad8f888237c WHIRLPOOL 9e25c65d9b5bd1751e30120e7d59f8ea26abf3e2b67749ae503a89e865f66c4f87d57dc8f0fe395a95353fb6f7ad266280244ef274c0f96537a1cdb34f4d4246
+EBUILD opendnssec-1.4.8.2.ebuild 5830 SHA256 36dfde77d4c65b0dfdac4be6a7db56f0b1eec21978e1de84efeb3f7e2564ca5e SHA512 d9cb344ca13a2a926f46e4dd041453132cb669d0ae23f4180dda38ca12fa41f6aa6187d7e9cf70ca8e36ec4266cd75569a36d928c9ab65800c68ecc11ec6da80 WHIRLPOOL 5001986e96040dae337df7d7728f4a50ee1c9e7b600f01e9d11570335073a18ec7999e4818e08fbb4c678ead18023104413b76406e48d1fa06a2216c7051ed58
+EBUILD opendnssec-2.0.1-r1.ebuild 6763 SHA256 4bff75c622d69ecc2e91b5f7672f09c77603c65a0572c799ceff744f6a84de9e SHA512 9398125ccf2e3bc05ffc8c87e9582374075cb89d079e3e01364134f6529f399fa7556afd1d489f43235a31f6e2c7e13726b6552ab59d757df761680668ad7102 WHIRLPOOL d2a85cd8266136c91407e5b8a81d8d8bac9b6dcee2357be408bb56f33c346bde0b9a1a5c035e0c02f481dd21afb5d8bf15f50d9bac280e67dbed5048321c9fe9
+EBUILD opendnssec-2.0.3.ebuild 6763 SHA256 4bff75c622d69ecc2e91b5f7672f09c77603c65a0572c799ceff744f6a84de9e SHA512 9398125ccf2e3bc05ffc8c87e9582374075cb89d079e3e01364134f6529f399fa7556afd1d489f43235a31f6e2c7e13726b6552ab59d757df761680668ad7102 WHIRLPOOL d2a85cd8266136c91407e5b8a81d8d8bac9b6dcee2357be408bb56f33c346bde0b9a1a5c035e0c02f481dd21afb5d8bf15f50d9bac280e67dbed5048321c9fe9
+MISC ChangeLog 5718 SHA256 22234d269386e8a717f4d196571001e23ccebe91b931da9b987365e63d9bbf8c SHA512 0c299644afd60dacc087e19b8530704a92cc2d65985e60689d177b39befc0fff243d2d674291c1509438d182faa71de590a364b6cc1aeeb5e4984937f8e4914a WHIRLPOOL 2eece09c7090ac503d0c7e55dce19e57caa5f00ef2ce066cabfc976f72c8f3fbba94104637e6d55be9ef506dc3e795250c81694cba5a977719a338c73afff72f
+MISC ChangeLog-2015 8837 SHA256 0bbf10d947069650e591cbb4e9785d9a729f552fd9eb7c19ee1b4e2a02d5f6ba SHA512 5d5490b6c9ae8eea841df5c30a172d688fa95e8460059b2c2205ee169baa20147dc77523d6a9802dd321665031fb99f3ec7725381bd79c6c0040869c9cb0920a WHIRLPOOL db61e6216a86b07e6c7364087a4a511237d7b6a66741338c4749edbb4ab41cf15828e18e6eb43f4d6ff4d23a7ee2f435cd8e37223660d9068c66a0d78347e149
+MISC metadata.xml 906 SHA256 f68a7488c51564b1d622ddc75e61a3a8658c1c6e94356d96cb487adba8d846fa SHA512 9cddc6b15c7a959cb885bc639c19e166ee202dd4b45db50c9bbb3b61fe9e84311f023a3d34cfc44e689cf81df092211fa4cb88427fb143c113bdfc1e7897112e WHIRLPOOL 243f9f79db1553fced401bc2443b22fbb8bfba88e3e70dfb2ede16a27cad19e22c86ee8926389e25b5fd5dfff1b162ee1d74cc7d5f15fb799aa64e3614d10261
diff --git a/net-dns/opendnssec/files/opendnssec-1.3.14-drop-privileges.patch b/net-dns/opendnssec/files/opendnssec-1.3.14-drop-privileges.patch
new file mode 100644
index 000000000000..7c9f72355d20
--- /dev/null
+++ b/net-dns/opendnssec/files/opendnssec-1.3.14-drop-privileges.patch
@@ -0,0 +1,43 @@
+Index: conf/conf.xml.in
+===================================================================
+--- conf/conf.xml.in	(revision 3022)
++++ conf/conf.xml.in	(working copy)
+@@ -38,12 +38,10 @@
+ 	</Common>
+ 
+ 	<Enforcer>
+-<!--
+ 		<Privileges>
+ 			<User>opendnssec</User>
+ 			<Group>opendnssec</Group>
+ 		</Privileges>
+--->
+ 
+ 		<Datastore><SQLite>@OPENDNSSEC_STATE_DIR@/kasp.db</SQLite></Datastore>
+ 		<Interval>PT3600S</Interval>
+@@ -56,12 +54,10 @@
+ 	</Enforcer>
+ 
+ 	<Signer>
+-<!--
+ 		<Privileges>
+ 			<User>opendnssec</User>
+ 			<Group>opendnssec</Group>
+ 		</Privileges>
+--->
+ 
+ 		<WorkingDirectory>@OPENDNSSEC_STATE_DIR@/tmp</WorkingDirectory>
+ 		<WorkerThreads>8</WorkerThreads>
+@@ -80,12 +76,10 @@
+ 	</Signer>
+ 
+ 	<Auditor>
+-<!--
+ 		<Privileges>
+ 			<User>opendnssec</User>
+ 			<Group>opendnssec</Group>
+ 		</Privileges>
+--->
+ 
+ 		<WorkingDirectory>@OPENDNSSEC_STATE_DIR@/tmp</WorkingDirectory>
+ 	</Auditor>
diff --git a/net-dns/opendnssec/files/opendnssec-1.3.14-use-system-trang.patch b/net-dns/opendnssec/files/opendnssec-1.3.14-use-system-trang.patch
new file mode 100644
index 000000000000..39678408264a
--- /dev/null
+++ b/net-dns/opendnssec/files/opendnssec-1.3.14-use-system-trang.patch
@@ -0,0 +1,21 @@
+diff -urN opendnssec-1.3.0rc3.old/conf/Makefile.am opendnssec-1.3.0rc3/conf/Makefile.am
+--- opendnssec-1.3.0rc3.old/conf/Makefile.am	2011-07-01 21:15:25.000000000 +0200
++++ opendnssec-1.3.0rc3/conf/Makefile.am	2011-07-01 21:17:00.000000000 +0200
+@@ -7,7 +7,7 @@
+ XML =	conf.xml kasp.xml zonelist.xml signconf.xml zonefetch.xml
+ XSL=	kasp2html.xsl
+ 
+-TRANG=	$(srcdir)/trang/trang.jar
++TRANG=	/usr/bin/trang
+ 
+ sysconfdir = @sysconfdir@/opendnssec
+ datadir = @datadir@/opendnssec
+@@ -25,7 +25,7 @@
+ .rnc.rng:
+ 	@test -x "${JAVA}" || \
+ 		(echo "java is required for converting RelaxNG Compact to RelaxNG"; false)
+-	${JAVA} -jar ${TRANG} $< $@
++	${TRANG} $< $@
+ 
+ regress: $(RNG)
+ 	@test -x "${XMLLINT}" || \
diff --git a/net-dns/opendnssec/files/opendnssec-1.3.18-eppclient-curl-CVE-2012-5582.patch b/net-dns/opendnssec/files/opendnssec-1.3.18-eppclient-curl-CVE-2012-5582.patch
new file mode 100644
index 000000000000..a0676dd091be
--- /dev/null
+++ b/net-dns/opendnssec/files/opendnssec-1.3.18-eppclient-curl-CVE-2012-5582.patch
@@ -0,0 +1,12 @@
+diff -urN opendnssec-1.3.18.orig/plugins/eppclient/src/epp.c opendnssec-1.3.18/plugins/eppclient/src/epp.c
+--- opendnssec-1.3.18.orig/plugins/eppclient/src/epp.c	2014-07-21 11:16:10.000000000 +0200
++++ opendnssec-1.3.18/plugins/eppclient/src/epp.c	2016-03-23 22:25:18.679354984 +0100
+@@ -390,7 +390,7 @@
+     curl_easy_setopt(curl, CURLOPT_URL, url);
+     curl_easy_setopt(curl, CURLOPT_CONNECT_ONLY, 1L);
+     curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 1L);
+-    curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 1L);
++    curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 2L);
+     curl_easy_setopt(curl, CURLOPT_USE_SSL, CURLUSESSL_ALL);
+     curl_easy_setopt(curl, CURLOPT_ERRORBUFFER, curlerr);
+     curl_easy_setopt(curl, CURLOPT_NOPROGRESS, 1L);
diff --git a/net-dns/opendnssec/files/opendnssec-drop-privileges-2.0.x.patch b/net-dns/opendnssec/files/opendnssec-drop-privileges-2.0.x.patch
new file mode 100644
index 000000000000..f3adc487dee9
--- /dev/null
+++ b/net-dns/opendnssec/files/opendnssec-drop-privileges-2.0.x.patch
@@ -0,0 +1,29 @@
+diff -ur opendnssec-2.0.1.orig/conf/conf.xml.in opendnssec-2.0.1/conf/conf.xml.in
+--- opendnssec-2.0.1.orig/conf/conf.xml.in	2016-07-21 16:15:27.000000000 +0200
++++ opendnssec-2.0.1/conf/conf.xml.in	2016-08-23 15:21:09.633384446 +0200
+@@ -36,12 +36,10 @@
+ 	</Common>
+ 
+ 	<Enforcer>
+-<!--
+ 		<Privileges>
+ 			<User>opendnssec</User>
+ 			<Group>opendnssec</Group>
+ 		</Privileges>
+--->
+ 
+ 		<Datastore><SQLite>@OPENDNSSEC_STATE_DIR@/kasp.db</SQLite></Datastore>
+ 		<!--The enforcer interval parameter is no long used in 2.0 and will be deprecated in 2.1 -->
+@@ -60,12 +58,10 @@
+ 	</Enforcer>
+ 
+ 	<Signer>
+-<!--
+ 		<Privileges>
+ 			<User>opendnssec</User>
+ 			<Group>opendnssec</Group>
+ 		</Privileges>
+--->
+ 
+ 		<WorkingDirectory>@OPENDNSSEC_STATE_DIR@/signer</WorkingDirectory>
+ 		<WorkerThreads>4</WorkerThreads>
diff --git a/net-dns/opendnssec/files/opendnssec-drop-privileges.patch b/net-dns/opendnssec/files/opendnssec-drop-privileges.patch
new file mode 100644
index 000000000000..c1972bbc3d1b
--- /dev/null
+++ b/net-dns/opendnssec/files/opendnssec-drop-privileges.patch
@@ -0,0 +1,28 @@
+--- conf/conf.xml.in.orig	2013-05-12 22:36:47.530988182 +0200
++++ conf/conf.xml.in	2013-05-12 22:37:56.459817918 +0200
+@@ -38,12 +38,10 @@
+ 	</Common>
+ 
+ 	<Enforcer>
+-<!--
+ 		<Privileges>
+ 			<User>opendnssec</User>
+ 			<Group>opendnssec</Group>
+ 		</Privileges>
+--->
+ <!-- NOTE: Enforcer worker threads are not used; this option is ignored -->
+ <!--
+ 		<WorkerThreads>4</WorkerThreads>
+@@ -60,12 +58,10 @@
+ 	</Enforcer>
+ 
+ 	<Signer>
+-<!--
+ 		<Privileges>
+ 			<User>opendnssec</User>
+ 			<Group>opendnssec</Group>
+ 		</Privileges>
+--->
+ 
+ 		<WorkingDirectory>@OPENDNSSEC_STATE_DIR@/tmp</WorkingDirectory>
+ 		<WorkerThreads>4</WorkerThreads>
diff --git a/net-dns/opendnssec/files/opendnssec-fix-localstatedir-2.0.x.patch b/net-dns/opendnssec/files/opendnssec-fix-localstatedir-2.0.x.patch
new file mode 100644
index 000000000000..5940c2f050e6
--- /dev/null
+++ b/net-dns/opendnssec/files/opendnssec-fix-localstatedir-2.0.x.patch
@@ -0,0 +1,22 @@
+diff -ur opendnssec-2.0.1.orig/Makefile.am opendnssec-2.0.1/Makefile.am
+--- opendnssec-2.0.1.orig/Makefile.am	2016-07-21 16:15:00.000000000 +0200
++++ opendnssec-2.0.1/Makefile.am	2016-08-23 14:01:50.618393034 +0200
+@@ -30,12 +30,12 @@
+ 
+ install-data-hook:
+ 	$(INSTALL) -d $(DESTDIR)$(localstatedir)
+-	$(INSTALL) -d $(DESTDIR)$(localstatedir)/opendnssec
+-	$(INSTALL) -d $(DESTDIR)$(localstatedir)/opendnssec/signer
+-	$(INSTALL) -d $(DESTDIR)$(localstatedir)/opendnssec/enforcer
+-	$(INSTALL) -d $(DESTDIR)$(localstatedir)/opendnssec/signconf
+-	$(INSTALL) -d $(DESTDIR)$(localstatedir)/opendnssec/unsigned
+-	$(INSTALL) -d $(DESTDIR)$(localstatedir)/opendnssec/signed
++	$(INSTALL) -d $(DESTDIR)$(localstatedir)/lib/opendnssec
++	$(INSTALL) -d $(DESTDIR)$(localstatedir)/lib/opendnssec/signer
++	$(INSTALL) -d $(DESTDIR)$(localstatedir)/lib/opendnssec/enforcer
++	$(INSTALL) -d $(DESTDIR)$(localstatedir)/lib/opendnssec/signconf
++	$(INSTALL) -d $(DESTDIR)$(localstatedir)/lib/opendnssec/unsigned
++	$(INSTALL) -d $(DESTDIR)$(localstatedir)/lib/opendnssec/signed
+ 	$(INSTALL) -d $(DESTDIR)$(localstatedir)/run
+ 	$(INSTALL) -d $(DESTDIR)$(localstatedir)/run/opendnssec
+ 
diff --git a/net-dns/opendnssec/files/opendnssec-fix-localstatedir.patch b/net-dns/opendnssec/files/opendnssec-fix-localstatedir.patch
new file mode 100644
index 000000000000..3958c6c70ccf
--- /dev/null
+++ b/net-dns/opendnssec/files/opendnssec-fix-localstatedir.patch
@@ -0,0 +1,32 @@
+diff -urN opendnssec-1.3.0rc2.old/Makefile.am opendnssec-1.3.0rc2/Makefile.am
+--- opendnssec-1.3.0rc2.old/Makefile.am	2011-06-02 13:48:56.000000000 +0200
++++ opendnssec-1.3.0rc2/Makefile.am	2011-06-02 13:49:19.000000000 +0200
+@@ -31,11 +31,11 @@
+ 
+ install-data-hook:
+ 	$(INSTALL) -d $(DESTDIR)$(localstatedir)
+-	$(INSTALL) -d $(DESTDIR)$(localstatedir)/opendnssec
+-	$(INSTALL) -d $(DESTDIR)$(localstatedir)/opendnssec/tmp
+-	$(INSTALL) -d $(DESTDIR)$(localstatedir)/opendnssec/signconf
+-	$(INSTALL) -d $(DESTDIR)$(localstatedir)/opendnssec/unsigned
+-	$(INSTALL) -d $(DESTDIR)$(localstatedir)/opendnssec/signed
++	$(INSTALL) -d $(DESTDIR)$(localstatedir)/lib/opendnssec
++	$(INSTALL) -d $(DESTDIR)$(localstatedir)/lib/opendnssec/tmp
++	$(INSTALL) -d $(DESTDIR)$(localstatedir)/lib/opendnssec/signconf
++	$(INSTALL) -d $(DESTDIR)$(localstatedir)/lib/opendnssec/unsigned
++	$(INSTALL) -d $(DESTDIR)$(localstatedir)/lib/opendnssec/signed
+ 	$(INSTALL) -d $(DESTDIR)$(localstatedir)/run
+ 	$(INSTALL) -d $(DESTDIR)$(localstatedir)/run/opendnssec
+ 
+diff -urN opendnssec-1.3.0rc2.old/m4/opendnssec_common.m4 opendnssec-1.3.0rc2/m4/opendnssec_common.m4
+--- opendnssec-1.3.0rc2.old/m4/opendnssec_common.m4	2011-06-02 13:48:56.000000000 +0200
++++ opendnssec-1.3.0rc2/m4/opendnssec_common.m4	2011-06-02 13:49:36.000000000 +0200
+@@ -18,7 +18,7 @@
+ OPENDNSSEC_LIBEXEC_DIR=$full_libexecdir/opendnssec
+ OPENDNSSEC_DATA_DIR=$full_datadir/opendnssec
+ OPENDNSSEC_SYSCONF_DIR=$full_sysconfdir/opendnssec
+-OPENDNSSEC_LOCALSTATE_DIR="$full_localstatedir/opendnssec"
++OPENDNSSEC_LOCALSTATE_DIR="$full_localstatedir/lib/opendnssec"
+ OPENDNSSEC_PID_DIR="$full_localstatedir/run/opendnssec"
+ 
+ AC_SUBST([OPENDNSSEC_BIN_DIR])
diff --git a/net-dns/opendnssec/files/opendnssec-fix-run-dir-2.0.x.patch b/net-dns/opendnssec/files/opendnssec-fix-run-dir-2.0.x.patch
new file mode 100644
index 000000000000..5ea9c80f2ba7
--- /dev/null
+++ b/net-dns/opendnssec/files/opendnssec-fix-run-dir-2.0.x.patch
@@ -0,0 +1,24 @@
+diff -ur opendnssec-2.0.1.orig/m4/opendnssec_common.m4 opendnssec-2.0.1/m4/opendnssec_common.m4
+--- opendnssec-2.0.1.orig/m4/opendnssec_common.m4	2016-07-21 16:15:00.000000000 +0200
++++ opendnssec-2.0.1/m4/opendnssec_common.m4	2016-08-23 14:42:35.033460972 +0200
+@@ -17,7 +17,7 @@
+ OPENDNSSEC_DATA_DIR=$full_datadir/opendnssec
+ OPENDNSSEC_SYSCONF_DIR=$full_sysconfdir/opendnssec
+ OPENDNSSEC_LOCALSTATE_DIR="$full_localstatedir/opendnssec"
+-OPENDNSSEC_PID_DIR="$full_localstatedir/run/opendnssec"
++OPENDNSSEC_PID_DIR="${destdir}/run/opendnssec"
+ 
+ AC_SUBST([OPENDNSSEC_BIN_DIR])
+ AC_SUBST([OPENDNSSEC_SBIN_DIR])
+diff -ur opendnssec-2.0.1.orig/Makefile.am opendnssec-2.0.1/Makefile.am
+--- opendnssec-2.0.1.orig/Makefile.am	2016-08-23 14:40:10.009951791 +0200
++++ opendnssec-2.0.1/Makefile.am	2016-08-23 14:43:20.377870776 +0200
+@@ -36,8 +36,6 @@
+ 	$(INSTALL) -d $(DESTDIR)$(localstatedir)/lib/opendnssec/signconf
+ 	$(INSTALL) -d $(DESTDIR)$(localstatedir)/lib/opendnssec/unsigned
+ 	$(INSTALL) -d $(DESTDIR)$(localstatedir)/lib/opendnssec/signed
+-	$(INSTALL) -d $(DESTDIR)$(localstatedir)/run
+-	$(INSTALL) -d $(DESTDIR)$(localstatedir)/run/opendnssec
+ 
+ docs:
+ 	(cd libhsm; $(MAKE) doxygen)
diff --git a/net-dns/opendnssec/files/opendnssec-fix-run-dir.patch b/net-dns/opendnssec/files/opendnssec-fix-run-dir.patch
new file mode 100644
index 000000000000..fe5b504344cf
--- /dev/null
+++ b/net-dns/opendnssec/files/opendnssec-fix-run-dir.patch
@@ -0,0 +1,26 @@
+diff -ur opendnssec-1.3.12.orig/m4/opendnssec_common.m4 opendnssec-1.3.12/m4/opendnssec_common.m4
+--- opendnssec-1.3.12.orig/m4/opendnssec_common.m4	2013-01-31 13:46:01.122201232 +0100
++++ opendnssec-1.3.12/m4/opendnssec_common.m4	2013-01-31 13:54:47.648861211 +0100
+@@ -19,7 +19,7 @@
+ OPENDNSSEC_DATA_DIR=$full_datadir/opendnssec
+ OPENDNSSEC_SYSCONF_DIR=$full_sysconfdir/opendnssec
+ OPENDNSSEC_LOCALSTATE_DIR="$full_localstatedir/lib/opendnssec"
+-OPENDNSSEC_PID_DIR="$full_localstatedir/run/opendnssec"
++OPENDNSSEC_PID_DIR="${destdir}/run/opendnssec"
+ 
+ AC_SUBST([OPENDNSSEC_BIN_DIR])
+ AC_SUBST([OPENDNSSEC_SBIN_DIR])
+diff -ur opendnssec-1.3.12.orig/Makefile.am opendnssec-1.3.12/Makefile.am
+--- opendnssec-1.3.12.orig/Makefile.am	2013-01-31 13:46:01.122201232 +0100
++++ opendnssec-1.3.12/Makefile.am	2013-01-31 13:47:08.569951675 +0100
+@@ -37,8 +37,8 @@
+ 	$(INSTALL) -d $(DESTDIR)$(localstatedir)/lib/opendnssec/signconf
+ 	$(INSTALL) -d $(DESTDIR)$(localstatedir)/lib/opendnssec/unsigned
+ 	$(INSTALL) -d $(DESTDIR)$(localstatedir)/lib/opendnssec/signed
+-	$(INSTALL) -d $(DESTDIR)$(localstatedir)/run
+-	$(INSTALL) -d $(DESTDIR)$(localstatedir)/run/opendnssec
++
++
+ 
+ docs:
+ 	(cd libhsm; $(MAKE) doxygen)
diff --git a/net-dns/opendnssec/files/opendnssec-use-system-trang.patch b/net-dns/opendnssec/files/opendnssec-use-system-trang.patch
new file mode 100644
index 000000000000..745b277e1339
--- /dev/null
+++ b/net-dns/opendnssec/files/opendnssec-use-system-trang.patch
@@ -0,0 +1,20 @@
+--- conf/Makefile.am.orig	2013-05-12 22:45:26.514768943 +0200
++++ conf/Makefile.am	2013-05-12 22:46:33.399545628 +0200
+@@ -7,7 +7,7 @@
+ XML =	addns.xml conf.xml kasp.xml zonelist.xml signconf.xml enforcerstate.xml
+ XSL=	kasp2html.xsl
+ 
+-TRANG=		$(srcdir)/trang/trang.jar
++TRANG=		/usr/bin/trang
+ TRANG_URL	"https://code.google.com/p/jing-trang/"
+ 
+ sysconfdir = @sysconfdir@/opendnssec
+@@ -31,7 +31,7 @@
+ .rnc.rng:
+ 	@test -x "${JAVA}" || \
+ 		(echo "java is required for converting RelaxNG Compact to RelaxNG"; false)
+-	${JAVA} -jar ${TRANG} $< $@
++	${TRANG} $< $@
+ 
+ regress: $(RNG)
+ 	@test -x "${XMLLINT}" || \
diff --git a/net-dns/opendnssec/files/opendnssec.confd b/net-dns/opendnssec/files/opendnssec.confd
new file mode 100644
index 000000000000..a54fc2091273
--- /dev/null
+++ b/net-dns/opendnssec/files/opendnssec.confd
@@ -0,0 +1,11 @@
+# Copyright 1999-2013 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+# Variables containing default binaries used in the opendnssec
+# initscript. You can alter them to another applications/paths
+# if required.
+
+CHECKCONFIG_BIN=/usr/bin/ods-kaspcheck
+CONTROL_BIN=/usr/sbin/ods-control
+ENFORCER_BIN=/usr/sbin/ods-enforcerd
+SIGNER_BIN=/usr/sbin/ods-signerd
diff --git a/net-dns/opendnssec/files/opendnssec.confd-1.3.x b/net-dns/opendnssec/files/opendnssec.confd-1.3.x
new file mode 100644
index 000000000000..63121af7f0ca
--- /dev/null
+++ b/net-dns/opendnssec/files/opendnssec.confd-1.3.x
@@ -0,0 +1,13 @@
+# Copyright 1999-2013 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+# Variables containing default binaries used in the opendnssec
+# initscript. You can alter them to another applications/paths
+# if required.
+
+CHECKCONFIG_BIN=/usr/bin/ods-kaspcheck
+CONTROL_BIN=/usr/sbin/ods-control
+ENFORCER_BIN=/usr/sbin/ods-enforcerd
+SIGNER_BIN=/usr/sbin/ods-signerd
+EPPCLIENT_BIN=/usr/sbin/eppclientd
+EPPCLIENT_PIDFILE=/run/opendnssec/eppclientd.pid
diff --git a/net-dns/opendnssec/files/opendnssec.initd b/net-dns/opendnssec/files/opendnssec.initd
new file mode 100644
index 000000000000..39757d142f2d
--- /dev/null
+++ b/net-dns/opendnssec/files/opendnssec.initd
@@ -0,0 +1,85 @@
+#!/sbin/openrc-run
+# Copyright 1999-2014 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+description="An open-source turn-key solution for DNSSEC"
+
+depend() {
+	use logger
+}
+
+checkconfig() {
+	if [ -x "${CHECKCONFIG_BIN}" ]; then
+		output=$(${CHECKCONFIG_BIN} 2>&1| grep -v -E "^/etc/opendnssec/(conf|kasp).xml validates")
+		if [ -n "$output" ]; then
+			echo $output
+		fi
+
+		errors=$(echo $output | grep ERROR | wc -l)
+		if [ $errors -gt 0 ]; then
+			ewarn "$errors error(s) found in OpenDNSSEC configuration."
+		fi
+		return $errors
+	fi
+	eerror "Unable to execute ${CHECKCONFIG_BIN:-config binary}"
+	# can't validate config, just die
+	return 1
+}
+
+
+start_enforcer() {
+	if [ -n "${ENFORCER_BIN}" ] && [ -x "${ENFORCER_BIN}" ]; then
+		ebegin "Starting OpenDNSSEC Enforcer"
+		${CONTROL_BIN} enforcer start > /dev/null
+		eend $?
+	else
+		if [ -n "${ENFORCER_BIN}" ]; then
+			eerror "OpenDNSSEC Enforcer binary not executable"
+			return 1
+		fi
+		einfo "OpenDNSSEC Enforcer not used."
+	fi
+}
+
+stop_enforcer() {
+	if [ -x "${ENFORCER_BIN}" ]; then
+		ebegin "Stopping OpenDNSSEC Enforcer"
+		${CONTROL_BIN} enforcer stop > /dev/null
+		eend $?
+	fi
+}
+
+start_signer() {
+	if [ -n "${SIGNER_BIN}" ] && [ -x "${SIGNER_BIN}" ]; then
+		ebegin "Starting OpenDNSSEC Signer"
+		${CONTROL_BIN} signer start > /dev/null 2>&1
+		eend $?
+	else
+		if [ -n "${SIGNER_BIN}" ]; then
+			eerror "OpenDNSSEC Signer binary not executable"
+			return 1
+		fi
+		einfo "OpenDNSSEC Signer not used."
+	fi
+}
+
+stop_signer() {
+	if [ -x "${SIGNER_BIN}" ]; then
+		ebegin "Stopping OpenDNSSEC Signer"
+		${CONTROL_BIN} signer stop > /dev/null 2>&1
+		eend $?
+	fi
+}
+
+start() {
+	checkconfig || return $?
+	checkpath -d -m 0755 -o opendnssec:opendnssec /run/opendnssec
+	start_enforcer || return $?
+	start_signer || return $?
+}
+
+stop() {
+	stop_signer
+	stop_enforcer
+	sleep 5
+}
diff --git a/net-dns/opendnssec/files/opendnssec.initd-1.3.x b/net-dns/opendnssec/files/opendnssec.initd-1.3.x
new file mode 100644
index 000000000000..9f4adbd184a9
--- /dev/null
+++ b/net-dns/opendnssec/files/opendnssec.initd-1.3.x
@@ -0,0 +1,123 @@
+#!/sbin/openrc-run
+# Copyright 1999-2014 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+description="An open-source turn-key solution for DNSSEC"
+
+depend() {
+	use logger
+}
+
+checkconfig() {
+	if [ -z "${CHECKCONFIG_BIN}" ]; then
+		# no config checker configured, skip config check
+		return 0
+	fi
+	if [ -x "${CHECKCONFIG_BIN}" ]; then
+		output=$(${CHECKCONFIG_BIN} 2>&1| grep -v -E "^/etc/opendnssec/(conf|kasp).xml validates")
+		if [ -n "$output" ]; then
+			echo $output
+		fi
+
+		errors=$(echo $output | grep ERROR | wc -l)
+		if [ $errors -gt 0 ]; then
+			ewarn "$errors error(s) found in OpenDNSSEC configuration."
+		fi
+		return $errors
+	fi
+	eerror "Unable to execute ${CHECKCONFIG_BIN:-config binary}"
+	# can't validate config, just die
+	return 1
+}
+
+start_enforcer() {
+	if [ -n "${ENFORCER_BIN}" ] && [ -x "${ENFORCER_BIN}" ]; then
+		ebegin "Starting OpenDNSSEC Enforcer"
+		${CONTROL_BIN} enforcer start > /dev/null
+		eend $?
+	else
+		if [ -n "${ENFORCER_BIN}" ]; then
+			eerror "OpenDNSSEC Enforcer binary not executable"
+			return 1
+		fi
+		einfo "OpenDNSSEC Enforcer not used."
+	fi
+}
+
+stop_enforcer() {
+	if [ -x "${ENFORCER_BIN}" ]; then
+		ebegin "Stopping OpenDNSSEC Enforcer"
+		${CONTROL_BIN} enforcer stop > /dev/null
+		eend $?
+	fi
+}
+
+start_signer() {
+	if [ -n "${SIGNER_BIN}" ] && [ -x "${SIGNER_BIN}" ]; then
+		ebegin "Starting OpenDNSSEC Signer"
+		${CONTROL_BIN} signer start > /dev/null 2>&1
+		eend $?
+	else
+		if [ -n "${SIGNER_BIN}" ]; then
+			eerror "OpenDNSSEC Signer binary not executable"
+			return 1
+		fi
+		einfo "OpenDNSSEC Signer not used."
+	fi
+}
+
+stop_signer() {
+	if [ -x "${SIGNER_BIN}" ]; then
+		ebegin "Stopping OpenDNSSEC Signer"
+		${CONTROL_BIN} signer stop > /dev/null 2>&1
+		eend $?
+	fi
+}
+
+start_eppclient() {
+	if [ -n "${EPPCLIENT_BIN}" ] && [ -x "${EPPCLIENT_BIN}" ]; then
+		ebegin "Starting OpenDNSSEC Eppclient"
+		start-stop-daemon \
+			--start \
+			--user opendnssec --group opendnssec \
+			--exec "${EPPCLIENT_BIN}" \
+			--pidfile "${EPPCLIENT_PIDFILE}" > /dev/null
+		eend $?
+	else
+		# eppclient is ofptional so if we use the default binary and it
+		# is not used we won't die
+		if [ -n "${EPPCLIENT_BIN}" ] && \
+				[ "${EPPCLIENT_BIN}" != "/usr/sbin/eppclientd" ]; then
+			eerror "OpenDNSSEC Eppclient binary not executable"
+			return 1
+		fi
+		einfo "OpenDNSSEC Eppclient not used."
+	fi
+}
+
+stop_eppclient() {
+	if [ -x "${EPPCLIENT_BIN}" ]; then
+		ebegin "Stopping OpenDNSSEC Eppclient"
+		start-stop-daemon \
+			--stop \
+			--exec "${EPPCLIENT_BIN}" \
+			--pidfile "${EPPCLIENT_PIDFILE}" > /dev/null
+		eend $?
+	fi
+}
+
+start() {
+	checkconfig || return $?
+	test -d /run/opendnssec || mkdir -p /run/opendnssec
+	chown opendnssec:opendnssec /run/opendnssec
+	start_enforcer || return $?
+	start_signer || return $?
+	start_eppclient || return $?
+}
+
+stop() {
+	stop_eppclient
+	stop_signer
+	stop_enforcer
+	sleep 5
+}
diff --git a/net-dns/opendnssec/metadata.xml b/net-dns/opendnssec/metadata.xml
new file mode 100644
index 000000000000..f81a154f2ecf
--- /dev/null
+++ b/net-dns/opendnssec/metadata.xml
@@ -0,0 +1,15 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="person">
+		<email>mschiff@gentoo.org</email>
+	</maintainer>
+	<use>
+		<flag name="auditor">Enables auditing capabilities for OpenDNSSEC</flag>
+		<flag name="eppclient">Enables support for automatic submission of DNSSEC keys to an upstream epp server</flag>
+		<flag name="signer">Enables signing capabilities for OpenDNSSEC</flag>
+		<flag name="opensc">Enables support for storing DNSSEC keys through a <pkg>dev-libs/opensc</pkg> PKCS#11 interface</flag>
+		<flag name="softhsm">Enables support for storing DNSSEC keys in a <pkg>dev-libs/softhsm</pkg> PKCS#11 object</flag>
+		<flag name="external-hsm">Enables support for storing DNSSEC keys through an arbitrary non-portage PKCS#11 interface, specified through an environment variable</flag>
+	</use>
+</pkgmetadata>
diff --git a/net-dns/opendnssec/opendnssec-1.3.18-r1.ebuild b/net-dns/opendnssec/opendnssec-1.3.18-r1.ebuild
new file mode 100644
index 000000000000..d4bfd0296b7c
--- /dev/null
+++ b/net-dns/opendnssec/opendnssec-1.3.18-r1.ebuild
@@ -0,0 +1,203 @@
+# Copyright 1999-2017 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=5
+
+MY_P="${P/_}"
+PKCS11_IUSE="+softhsm opensc external-hsm"
+inherit autotools multilib user
+
+DESCRIPTION="An open-source turn-key solution for DNSSEC"
+HOMEPAGE="http://www.opendnssec.org/"
+SRC_URI="http://www.${PN}.org/files/source/${MY_P}.tar.gz"
+
+LICENSE="BSD GPL-2"
+SLOT="0"
+KEYWORDS="~amd64 ~x86"
+IUSE="-auditor +curl debug doc eppclient mysql +signer +sqlite test ${PKCS11_IUSE}"
+
+RDEPEND="
+	dev-lang/perl
+	dev-libs/libxml2
+	dev-libs/libxslt
+	net-libs/ldns
+	curl? ( net-misc/curl )
+	mysql? (
+		virtual/mysql
+		dev-perl/DBD-mysql
+	)
+	opensc? ( dev-libs/opensc )
+	softhsm? ( dev-libs/softhsm:* )
+	sqlite? (
+		dev-db/sqlite:3
+		dev-perl/DBD-SQLite
+	)
+"
+DEPEND="${RDEPEND}
+	doc? ( app-doc/doxygen )
+	test? (
+		app-text/trang
+	)
+"
+# test? dev-util/cunit # Requires running test DB
+
+REQUIRED_USE="
+	^^ ( mysql sqlite )
+	^^ ( softhsm opensc external-hsm )
+	eppclient? ( curl )
+"
+
+PATCHES=(
+	"${FILESDIR}/${PN}-fix-localstatedir.patch"
+	"${FILESDIR}/${PN}-fix-run-dir.patch"
+	"${FILESDIR}/${PN}-1.3.14-drop-privileges.patch"
+	"${FILESDIR}/${PN}-1.3.14-use-system-trang.patch"
+	"${FILESDIR}/${PN}-1.3.18-eppclient-curl-CVE-2012-5582.patch"
+)
+
+S="${WORKDIR}/${MY_P}"
+
+DOCS=( MIGRATION NEWS )
+
+check_pkcs11_setup() {
+	# PKCS#11 HSM's are often only available with proprietary drivers not
+	# available in portage tree.
+
+	if use softhsm; then
+		PKCS11_LIB=softhsm
+		if has_version ">=dev-libs/softhsm-1.3.1"; then
+			PKCS11_PATH=/usr/$(get_libdir)/softhsm/libsofthsm.so
+		else
+			PKCS11_PATH=/usr/$(get_libdir)/libsofthsm.so
+		fi
+		elog "Building with SoftHSM PKCS#11 library support."
+	fi
+	if use opensc; then
+		PKCS11_LIB=opensc
+		PKCS11_PATH=/usr/$(get_libdir)/opensc-pkcs11.so
+		elog "Building with OpenSC PKCS#11 library support."
+	fi
+	if use external-hsm; then
+		if [[ -n ${PKCS11_SCA6000} ]]; then
+			PKCS11_LIB=sca6000
+			PKCS11_PATH=${PKCS11_SCA6000}
+		elif [[ -n ${PKCS11_ETOKEN} ]]; then
+			PKCS11_LIB=etoken
+			PKCS11_PATH=${PKCS11_ETOKEN}
+		elif [[ -n ${PKCS11_NCIPHER} ]]; then
+			PKCS11_LIB=ncipher
+			PKCS11_PATH=${PKCS11_NCIPHER}
+		elif [[ -n ${PKCS11_AEPKEYPER} ]]; then
+			PKCS11_LIB=aepkeyper
+			PKCS11_PATH=${PKCS11_AEPKEYPER}
+		else
+			ewarn "You enabled USE flag 'external-hsm' but did not specify a path to a PKCS#11"
+			ewarn "library. To set a path, set one of the following environment variables:"
+			ewarn "  for Sun Crypto Accelerator 6000, set: PKCS11_SCA6000=<path>"
+			ewarn "  for Aladdin eToken, set: PKCS11_ETOKEN=<path>"
+			ewarn "  for Thales/nCipher netHSM, set: PKCS11_NCIPHER=<path>"
+			ewarn "  for AEP Keyper, set: PKCS11_AEPKEYPER=<path>"
+			ewarn "Example:"
+			ewarn "  PKCS11_ETOKEN=\"/opt/etoken/lib/libeTPkcs11.so\" emerge -pv opendnssec"
+			ewarn "or store the variable into /etc/portage/make.conf"
+			die "USE flag 'external-hsm' set but no PKCS#11 library path specified."
+		fi
+		elog "Building with external PKCS#11 library support ($PKCS11_LIB): ${PKCS11_PATH}"
+	fi
+}
+
+pkg_pretend() {
+	local i
+
+	for i in eppclient mysql; do
+		if use ${i}; then
+			ewarn
+			ewarn "Usage of ${i} is considered experimental."
+			ewarn "Do not report bugs against this feature."
+			ewarn
+		fi
+	done
+
+	check_pkcs11_setup
+}
+
+pkg_setup() {
+	enewgroup opendnssec
+	enewuser opendnssec -1 -1 -1 opendnssec
+
+	# pretend does not preserve variables so we need to run this once more
+	check_pkcs11_setup
+}
+
+src_prepare() {
+	base_src_prepare
+	eautoreconf
+}
+
+src_configure() {
+	# $(use_with test cunit "${EPREFIX}/usr/") \
+	econf \
+		--without-cunit \
+		--localstatedir="${EPREFIX}/var/" \
+		--disable-static \
+		--with-database-backend=$(use mysql && echo "mysql")$(use sqlite && echo "sqlite3") \
+		--with-pkcs11-${PKCS11_LIB}=${PKCS11_PATH} \
+		--disable-auditor \
+		$(use_with curl) \
+		$(use_enable debug timeshift) \
+		$(use_enable eppclient) \
+		$(use_enable signer)
+}
+
+src_compile() {
+	default
+	use doc && emake docs
+}
+
+src_install() {
+	default
+
+	# remove useless .la files
+	find "${ED}" -name '*.la' -delete
+
+	# Remove subversion tags from config files to avoid useless config updates
+	sed -i \
+		-e '/<!-- \$Id:/ d' \
+		"${ED}"/etc/opendnssec/* || die
+
+	# install update scripts
+	insinto /usr/share/opendnssec
+	use sqlite && doins enforcer/utils/migrate_keyshare_sqlite3.pl
+	use mysql && doins enforcer/utils/migrate_keyshare_mysql.pl
+
+	# fix permissions
+	fowners root:opendnssec /etc/opendnssec
+	fowners root:opendnssec /etc/opendnssec/{conf,kasp,zonelist,zonefetch}.xml
+	use eppclient && fowners root:opendnssec /etc/opendnssec/eppclientd.conf
+
+	fowners opendnssec:opendnssec /var/lib/opendnssec/{,signconf,unsigned,signed,tmp}
+
+	# install conf/init script
+	newinitd "${FILESDIR}"/opendnssec.initd-1.3.x opendnssec
+	newconfd "${FILESDIR}"/opendnssec.confd-1.3.x opendnssec
+	use auditor || sed -i 's/^CHECKCONFIG_BIN=.*/CHECKCONFIG_BIN=/' "${D}"/etc/conf.d/opendnssec
+}
+
+pkg_postinst() {
+	if use softhsm; then
+		elog "Please make sure that you create your softhsm database in a location writeable"
+		elog "by the opendnssec user. You can set its location in /etc/softhsm.conf."
+		elog "Suggested configuration is:"
+		elog "    echo \"0:/var/lib/opendnssec/softhsm_slot0.db\" >> /etc/softhsm.conf"
+		elog "    softhsm --init-token --slot 0 --label OpenDNSSEC"
+		elog "    chown opendnssec:opendnssec /var/lib/opendnssec/softhsm_slot0.db"
+	fi
+	if use auditor; then
+		ewarn
+		ewarn "Please note that auditor support has been disabled in this version since it"
+		ewarn "it depends on ruby 1.8 which has been removed from the portage tree."
+		ewarn "USE=auditor is only provided for this warning but will not install the"
+		ewarn "auditor anymore."
+		ewarn
+	fi
+}
diff --git a/net-dns/opendnssec/opendnssec-1.4.12-r1.ebuild b/net-dns/opendnssec/opendnssec-1.4.12-r1.ebuild
new file mode 100644
index 000000000000..68d85cf8be58
--- /dev/null
+++ b/net-dns/opendnssec/opendnssec-1.4.12-r1.ebuild
@@ -0,0 +1,207 @@
+# Copyright 1999-2017 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=5
+
+MY_P="${P/_}"
+PKCS11_IUSE="+softhsm opensc external-hsm"
+inherit autotools eutils multilib user
+
+DESCRIPTION="An open-source turn-key solution for DNSSEC"
+HOMEPAGE="http://www.opendnssec.org/"
+SRC_URI="http://www.${PN}.org/files/source/${MY_P}.tar.gz"
+
+LICENSE="BSD GPL-2"
+SLOT="0"
+KEYWORDS="~amd64 ~x86"
+IUSE="debug doc +mysql +signer sqlite test ${PKCS11_IUSE}"
+
+RDEPEND="
+	dev-lang/perl
+	dev-libs/libxml2
+	dev-libs/libxslt
+	net-libs/ldns
+	mysql? (
+		virtual/mysql
+		dev-perl/DBD-mysql
+	)
+	opensc? ( dev-libs/opensc )
+	softhsm? ( dev-libs/softhsm:* )
+	sqlite? (
+		dev-db/sqlite:3
+		dev-perl/DBD-SQLite
+	)
+"
+DEPEND="${RDEPEND}
+	doc? ( app-doc/doxygen )
+	test? (
+		app-text/trang
+	)
+"
+
+REQUIRED_USE="
+	^^ ( mysql sqlite )
+	^^ ( softhsm opensc external-hsm )
+"
+
+PATCHES=(
+	"${FILESDIR}/${PN}-fix-localstatedir.patch"
+	"${FILESDIR}/${PN}-fix-run-dir.patch"
+	"${FILESDIR}/${PN}-drop-privileges.patch"
+	"${FILESDIR}/${PN}-use-system-trang.patch"
+)
+
+S="${WORKDIR}/${MY_P}"
+
+DOCS=( MIGRATION NEWS )
+
+check_pkcs11_setup() {
+	# PKCS#11 HSM's are often only available with proprietary drivers not
+	# available in portage tree.
+
+	if use softhsm; then
+		PKCS11_LIB=softhsm
+		if has_version ">=dev-libs/softhsm-1.3.1"; then
+			PKCS11_PATH=/usr/$(get_libdir)/softhsm/libsofthsm.so
+		else
+			PKCS11_PATH=/usr/$(get_libdir)/libsofthsm.so
+		fi
+		elog "Building with SoftHSM PKCS#11 library support."
+	fi
+	if use opensc; then
+		PKCS11_LIB=opensc
+		PKCS11_PATH=/usr/$(get_libdir)/opensc-pkcs11.so
+		elog "Building with OpenSC PKCS#11 library support."
+	fi
+	if use external-hsm; then
+		if [[ -n ${PKCS11_SCA6000} ]]; then
+			PKCS11_LIB=sca6000
+			PKCS11_PATH=${PKCS11_SCA6000}
+		elif [[ -n ${PKCS11_ETOKEN} ]]; then
+			PKCS11_LIB=etoken
+			PKCS11_PATH=${PKCS11_ETOKEN}
+		elif [[ -n ${PKCS11_NCIPHER} ]]; then
+			PKCS11_LIB=ncipher
+			PKCS11_PATH=${PKCS11_NCIPHER}
+		elif [[ -n ${PKCS11_AEPKEYPER} ]]; then
+			PKCS11_LIB=aepkeyper
+			PKCS11_PATH=${PKCS11_AEPKEYPER}
+		else
+			ewarn "You enabled USE flag 'external-hsm' but did not specify a path to a PKCS#11"
+			ewarn "library. To set a path, set one of the following environment variables:"
+			ewarn "  for Sun Crypto Accelerator 6000, set: PKCS11_SCA6000=<path>"
+			ewarn "  for Aladdin eToken, set: PKCS11_ETOKEN=<path>"
+			ewarn "  for Thales/nCipher netHSM, set: PKCS11_NCIPHER=<path>"
+			ewarn "  for AEP Keyper, set: PKCS11_AEPKEYPER=<path>"
+			ewarn "Example:"
+			ewarn "  PKCS11_ETOKEN=\"/opt/etoken/lib/libeTPkcs11.so\" emerge -pv opendnssec"
+			ewarn "or store the variable into /etc/portage/make.conf"
+			die "USE flag 'external-hsm' set but no PKCS#11 library path specified."
+		fi
+		elog "Building with external PKCS#11 library support ($PKCS11_LIB): ${PKCS11_PATH}"
+	fi
+}
+
+pkg_pretend() {
+	check_pkcs11_setup
+}
+
+pkg_setup() {
+	enewgroup opendnssec
+	enewuser opendnssec -1 -1 -1 opendnssec
+
+	# pretend does not preserve variables so we need to run this once more
+	check_pkcs11_setup
+}
+
+src_prepare() {
+	local patch
+	default
+	for patch in "${PATCHES[@]}"; do
+		epatch "$patch"
+	done
+	eautoreconf
+}
+
+src_configure() {
+	econf \
+		--without-cunit \
+		--localstatedir="${EPREFIX}/var/" \
+		--disable-static \
+		--with-database-backend=$(use mysql && echo "mysql")$(use sqlite && echo "sqlite3") \
+		--with-pkcs11-${PKCS11_LIB}=${PKCS11_PATH} \
+		$(use_enable debug timeshift) \
+		$(use_enable signer)
+}
+
+src_compile() {
+	default
+	use doc && emake docs
+}
+
+src_install() {
+	default
+
+	# remove useless .la files
+	find "${ED}" -name '*.la' -delete
+
+	# Remove subversion tags from config files to avoid useless config updates
+	sed -i \
+		-e '/<!-- \$Id:/ d' \
+		"${ED}"/etc/opendnssec/* || die
+
+	# install update scripts
+	insinto /usr/share/opendnssec
+	if use sqlite; then
+		doins enforcer/utils/migrate_*sqlite*
+	fi
+	if use mysql; then
+		doins enforcer/utils/migrate_*mysql*
+	fi
+
+	# fix permissions
+	fowners root:opendnssec /etc/opendnssec
+	fowners root:opendnssec /etc/opendnssec/{addns,conf,kasp,zonelist}.xml
+	fowners opendnssec:opendnssec /var/lib/opendnssec/{,signconf,unsigned,signed,tmp}
+
+	# install conf/init script
+	newinitd "${FILESDIR}"/opendnssec.initd opendnssec
+	newconfd "${FILESDIR}"/opendnssec.confd opendnssec
+}
+
+pkg_postinst() {
+	local v
+	if use softhsm; then
+		elog "Please make sure that you create your softhsm database in a location writeable"
+		elog "by the opendnssec user. You can set its location in /etc/softhsm.conf."
+		elog "Suggested configuration is:"
+		elog "    echo \"0:/var/lib/opendnssec/softhsm_slot0.db\" >> /etc/softhsm.conf"
+		elog "    softhsm --init-token --slot 0 --label OpenDNSSEC"
+		elog "    chown opendnssec:opendnssec /var/lib/opendnssec/softhsm_slot0.db"
+	fi
+
+	for v in $REPLACING_VERSIONS; do
+		case $v in
+			1.3.*)
+				ewarn ""
+				ewarn "You are upgrading from version 1.3."
+				ewarn ""
+				ewarn "Please be aware of the following:"
+				ewarn "  * OpenDNSSEC now supports both input and output adapters for"
+				ewarn "    AXFR and IXFR in addition to file transfer."
+				ewarn "    -> The zonefetch.xml file has been replaced by addns.xml"
+				ewarn "       to support this enhancement."
+				ewarn "    -> changes to the KASP database mean that a database"
+				ewarn "       migration is required to upgrade to 1.4 from earlier"
+				ewarn "       versions of OpenDNSSEC."
+				ewarn "  * The auditor is no longer supported."
+				ewarn ""
+				ewarn "You can find more information here:"
+				ewarn "  * /usr/share/doc/opendnssec*/MIGRATION*"
+				ewarn "  * https://wiki.opendnssec.org/display/DOCS/Migrating+zone+fetcher+to+DNS+adapters"
+				ewarn "  * https://wiki.opendnssec.org/display/DOCS/Migrating+from+earlier+versions+of+OpenDNSSEC"
+				ewarn ""
+			;;
+		esac
+	done
+}
diff --git a/net-dns/opendnssec/opendnssec-1.4.8.2.ebuild b/net-dns/opendnssec/opendnssec-1.4.8.2.ebuild
new file mode 100644
index 000000000000..c83f258bb104
--- /dev/null
+++ b/net-dns/opendnssec/opendnssec-1.4.8.2.ebuild
@@ -0,0 +1,205 @@
+# Copyright 1999-2017 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=5
+
+MY_P="${P/_}"
+PKCS11_IUSE="+softhsm opensc external-hsm"
+inherit autotools multilib user
+
+DESCRIPTION="An open-source turn-key solution for DNSSEC"
+HOMEPAGE="http://www.opendnssec.org/"
+SRC_URI="http://www.${PN}.org/files/source/${MY_P}.tar.gz"
+
+LICENSE="BSD GPL-2"
+SLOT="0"
+KEYWORDS="~amd64 ~x86"
+IUSE="debug doc +mysql +signer sqlite test ${PKCS11_IUSE}"
+
+RDEPEND="
+	dev-lang/perl
+	dev-libs/libxml2
+	dev-libs/libxslt
+	net-libs/ldns
+	mysql? (
+		virtual/mysql
+		dev-perl/DBD-mysql
+	)
+	opensc? ( dev-libs/opensc )
+	softhsm? ( dev-libs/softhsm:* )
+	sqlite? (
+		dev-db/sqlite:3
+		dev-perl/DBD-SQLite
+	)
+"
+DEPEND="${RDEPEND}
+	doc? ( app-doc/doxygen )
+	test? (
+		app-text/trang
+	)
+"
+
+REQUIRED_USE="
+	^^ ( mysql sqlite )
+	^^ ( softhsm opensc external-hsm )
+"
+
+PATCHES=(
+	"${FILESDIR}/${PN}-fix-localstatedir.patch"
+	"${FILESDIR}/${PN}-fix-run-dir.patch"
+	"${FILESDIR}/${PN}-drop-privileges.patch"
+	"${FILESDIR}/${PN}-use-system-trang.patch"
+)
+
+S="${WORKDIR}/${MY_P}"
+
+DOCS=( MIGRATION NEWS )
+
+check_pkcs11_setup() {
+	# PKCS#11 HSM's are often only available with proprietary drivers not
+	# available in portage tree.
+
+	if use softhsm; then
+		PKCS11_LIB=softhsm
+		if has_version ">=dev-libs/softhsm-1.3.1"; then
+			PKCS11_PATH=/usr/$(get_libdir)/softhsm/libsofthsm.so
+		else
+			PKCS11_PATH=/usr/$(get_libdir)/libsofthsm.so
+		fi
+		elog "Building with SoftHSM PKCS#11 library support."
+	fi
+	if use opensc; then
+		PKCS11_LIB=opensc
+		PKCS11_PATH=/usr/$(get_libdir)/opensc-pkcs11.so
+		elog "Building with OpenSC PKCS#11 library support."
+	fi
+	if use external-hsm; then
+		if [[ -n ${PKCS11_SCA6000} ]]; then
+			PKCS11_LIB=sca6000
+			PKCS11_PATH=${PKCS11_SCA6000}
+		elif [[ -n ${PKCS11_ETOKEN} ]]; then
+			PKCS11_LIB=etoken
+			PKCS11_PATH=${PKCS11_ETOKEN}
+		elif [[ -n ${PKCS11_NCIPHER} ]]; then
+			PKCS11_LIB=ncipher
+			PKCS11_PATH=${PKCS11_NCIPHER}
+		elif [[ -n ${PKCS11_AEPKEYPER} ]]; then
+			PKCS11_LIB=aepkeyper
+			PKCS11_PATH=${PKCS11_AEPKEYPER}
+		else
+			ewarn "You enabled USE flag 'external-hsm' but did not specify a path to a PKCS#11"
+			ewarn "library. To set a path, set one of the following environment variables:"
+			ewarn "  for Sun Crypto Accelerator 6000, set: PKCS11_SCA6000=<path>"
+			ewarn "  for Aladdin eToken, set: PKCS11_ETOKEN=<path>"
+			ewarn "  for Thales/nCipher netHSM, set: PKCS11_NCIPHER=<path>"
+			ewarn "  for AEP Keyper, set: PKCS11_AEPKEYPER=<path>"
+			ewarn "Example:"
+			ewarn "  PKCS11_ETOKEN=\"/opt/etoken/lib/libeTPkcs11.so\" emerge -pv opendnssec"
+			ewarn "or store the variable into /etc/portage/make.conf"
+			die "USE flag 'external-hsm' set but no PKCS#11 library path specified."
+		fi
+		elog "Building with external PKCS#11 library support ($PKCS11_LIB): ${PKCS11_PATH}"
+	fi
+}
+
+pkg_pretend() {
+	check_pkcs11_setup
+}
+
+pkg_setup() {
+	enewgroup opendnssec
+	enewuser opendnssec -1 -1 -1 opendnssec
+
+	# pretend does not preserve variables so we need to run this once more
+	check_pkcs11_setup
+}
+
+src_prepare() {
+	base_src_prepare
+	eautoreconf
+}
+
+src_configure() {
+	econf \
+		--without-cunit \
+		--localstatedir="${EPREFIX}/var/" \
+		--disable-static \
+		--with-database-backend=$(use mysql && echo "mysql")$(use sqlite && echo "sqlite3") \
+		--with-pkcs11-${PKCS11_LIB}=${PKCS11_PATH} \
+		$(use_enable debug timeshift) \
+		$(use_enable signer)
+}
+
+src_compile() {
+	default
+	use doc && emake docs
+}
+
+src_install() {
+	default
+
+	# remove useless .la files
+	find "${ED}" -name '*.la' -delete
+
+	# Remove subversion tags from config files to avoid useless config updates
+	sed -i \
+		-e '/<!-- \$Id:/ d' \
+		"${ED}"/etc/opendnssec/* || die
+
+	# install update scripts
+	insinto /usr/share/opendnssec
+	if use sqlite; then
+		doins enforcer/utils/migrate_keyshare_sqlite3.pl
+		doins enforcer/utils/migrate_adapters_1.sqlite3
+	fi
+	if use mysql; then
+		doins enforcer/utils/migrate_keyshare_mysql.pl
+		doins enforcer/utils/migrate_adapters_1.mysql
+	fi
+
+	# fix permissions
+	fowners root:opendnssec /etc/opendnssec
+	fowners root:opendnssec /etc/opendnssec/{addns,conf,kasp,zonelist}.xml
+	fowners opendnssec:opendnssec /var/lib/opendnssec/{,signconf,unsigned,signed,tmp}
+
+	# install conf/init script
+	newinitd "${FILESDIR}"/opendnssec.initd opendnssec
+	newconfd "${FILESDIR}"/opendnssec.confd opendnssec
+}
+
+pkg_postinst() {
+	local v
+	if use softhsm; then
+		elog "Please make sure that you create your softhsm database in a location writeable"
+		elog "by the opendnssec user. You can set its location in /etc/softhsm.conf."
+		elog "Suggested configuration is:"
+		elog "    echo \"0:/var/lib/opendnssec/softhsm_slot0.db\" >> /etc/softhsm.conf"
+		elog "    softhsm --init-token --slot 0 --label OpenDNSSEC"
+		elog "    chown opendnssec:opendnssec /var/lib/opendnssec/softhsm_slot0.db"
+	fi
+
+	for v in $REPLACING_VERSIONS; do
+		case $v in
+			1.3.*)
+				ewarn ""
+				ewarn "You are upgrading from version 1.3."
+				ewarn ""
+				ewarn "Please be aware of the following:"
+				ewarn "  * OpenDNSSEC now supports both input and output adapters for"
+				ewarn "    AXFR and IXFR in addition to file transfer."
+				ewarn "    -> The zonefetch.xml file has been replaced by addns.xml"
+				ewarn "       to support this enhancement."
+				ewarn "    -> changes to the KASP database mean that a database"
+				ewarn "       migration is required to upgrade to 1.4 from earlier"
+				ewarn "       versions of OpenDNSSEC."
+				ewarn "  * The auditor is no longer supported."
+				ewarn ""
+				ewarn "You can find more information here:"
+				ewarn "  * /usr/share/doc/opendnssec*/MIGRATION*"
+				ewarn "  * https://wiki.opendnssec.org/display/DOCS/Migrating+zone+fetcher+to+DNS+adapters"
+				ewarn "  * https://wiki.opendnssec.org/display/DOCS/Migrating+from+earlier+versions+of+OpenDNSSEC"
+				ewarn ""
+			;;
+		esac
+	done
+}
diff --git a/net-dns/opendnssec/opendnssec-2.0.1-r1.ebuild b/net-dns/opendnssec/opendnssec-2.0.1-r1.ebuild
new file mode 100644
index 000000000000..f4ecf0b3f3eb
--- /dev/null
+++ b/net-dns/opendnssec/opendnssec-2.0.1-r1.ebuild
@@ -0,0 +1,239 @@
+# Copyright 1999-2017 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=5
+
+MY_P="${P/_}"
+PKCS11_IUSE="+softhsm opensc external-hsm"
+inherit autotools eutils multilib user
+
+DESCRIPTION="An open-source turn-key solution for DNSSEC"
+HOMEPAGE="http://www.opendnssec.org/"
+SRC_URI="http://www.${PN}.org/files/source/${MY_P}.tar.gz"
+
+LICENSE="BSD GPL-2"
+SLOT="0"
+KEYWORDS="~amd64 ~x86"
+IUSE="debug doc +mysql readline +signer sqlite test ${PKCS11_IUSE}"
+
+RDEPEND="
+	dev-lang/perl
+	dev-libs/libxml2
+	dev-libs/libxslt
+	net-libs/ldns
+	mysql? (
+		virtual/mysql
+		dev-perl/DBD-mysql
+	)
+	opensc? ( dev-libs/opensc )
+	readline? ( sys-libs/readline:0 )
+	softhsm? ( dev-libs/softhsm:* )
+	sqlite? (
+		dev-db/sqlite:3
+		dev-perl/DBD-SQLite
+	)
+"
+DEPEND="${RDEPEND}
+	doc? ( app-doc/doxygen )
+	test? (
+		app-text/trang
+	)
+"
+
+REQUIRED_USE="
+	^^ ( mysql sqlite )
+	^^ ( softhsm opensc external-hsm )
+"
+
+PATCHES=(
+	"${FILESDIR}/${PN}-fix-localstatedir-2.0.x.patch"
+	"${FILESDIR}/${PN}-fix-run-dir-2.0.x.patch"
+	"${FILESDIR}/${PN}-drop-privileges-2.0.x.patch"
+	"${FILESDIR}/${PN}-use-system-trang.patch"
+)
+
+S="${WORKDIR}/${MY_P}"
+
+DOCS=( MIGRATION NEWS )
+
+check_pkcs11_setup() {
+	# PKCS#11 HSM's are often only available with proprietary drivers not
+	# available in portage tree.
+
+	if use softhsm; then
+		PKCS11_LIB=softhsm
+		if has_version ">=dev-libs/softhsm-1.3.1"; then
+			PKCS11_PATH=/usr/$(get_libdir)/softhsm/libsofthsm.so
+		else
+			PKCS11_PATH=/usr/$(get_libdir)/libsofthsm.so
+		fi
+		elog "Building with SoftHSM PKCS#11 library support."
+	fi
+	if use opensc; then
+		PKCS11_LIB=opensc
+		PKCS11_PATH=/usr/$(get_libdir)/opensc-pkcs11.so
+		elog "Building with OpenSC PKCS#11 library support."
+	fi
+	if use external-hsm; then
+		if [[ -n ${PKCS11_SCA6000} ]]; then
+			PKCS11_LIB=sca6000
+			PKCS11_PATH=${PKCS11_SCA6000}
+		elif [[ -n ${PKCS11_ETOKEN} ]]; then
+			PKCS11_LIB=etoken
+			PKCS11_PATH=${PKCS11_ETOKEN}
+		elif [[ -n ${PKCS11_NCIPHER} ]]; then
+			PKCS11_LIB=ncipher
+			PKCS11_PATH=${PKCS11_NCIPHER}
+		elif [[ -n ${PKCS11_AEPKEYPER} ]]; then
+			PKCS11_LIB=aepkeyper
+			PKCS11_PATH=${PKCS11_AEPKEYPER}
+		else
+			ewarn "You enabled USE flag 'external-hsm' but did not specify a path to a PKCS#11"
+			ewarn "library. To set a path, set one of the following environment variables:"
+			ewarn "  for Sun Crypto Accelerator 6000, set: PKCS11_SCA6000=<path>"
+			ewarn "  for Aladdin eToken, set: PKCS11_ETOKEN=<path>"
+			ewarn "  for Thales/nCipher netHSM, set: PKCS11_NCIPHER=<path>"
+			ewarn "  for AEP Keyper, set: PKCS11_AEPKEYPER=<path>"
+			ewarn "Example:"
+			ewarn "  PKCS11_ETOKEN=\"/opt/etoken/lib/libeTPkcs11.so\" emerge -pv opendnssec"
+			ewarn "or store the variable into /etc/portage/make.conf"
+			die "USE flag 'external-hsm' set but no PKCS#11 library path specified."
+		fi
+		elog "Building with external PKCS#11 library support ($PKCS11_LIB): ${PKCS11_PATH}"
+	fi
+}
+
+pkg_pretend() {
+	if has_version "<net-dns/opendnssec-1.4.10"; then
+		################################################################################
+		eerror "You are already using OpenDNSSEC."
+		eerror "In order to migrate to version >=2.0.0 you need to upgrade to"
+		eerror "version >=1.4.10 first:"
+		eerror ""
+		eerror "   emerge \"<net-dns/opendnssec-2\""
+		eerror ""
+		eerror "See https://github.com/opendnssec/opendnssec/blob/2.0/master/MIGRATION"
+		eerror "for details."
+		eerror ""
+		die "Please upgrade to version >=1.4.10 first for proper db migraion"
+	fi
+
+	check_pkcs11_setup
+}
+
+pkg_setup() {
+	enewgroup opendnssec
+	enewuser opendnssec -1 -1 -1 opendnssec
+
+	# pretend does not preserve variables so we need to run this once more
+	check_pkcs11_setup
+}
+
+src_prepare() {
+	local patch
+	default
+	for patch in "${PATCHES[@]}"; do
+		epatch "$patch"
+	done
+	eautoreconf
+}
+
+src_configure() {
+	econf \
+		--without-cunit \
+		--localstatedir="${EPREFIX}/var" \
+		--disable-static \
+		--with-enforcer-database=$(use mysql && echo "mysql")$(use sqlite && echo "sqlite3") \
+		--with-pkcs11-${PKCS11_LIB}=${PKCS11_PATH} \
+		$(use_with readline) \
+		$(use_enable signer)
+}
+
+src_compile() {
+	default
+	use doc && emake docs
+}
+
+src_install() {
+	default
+
+	# remove useless .la files
+	find "${ED}" -name '*.la' -delete
+
+	# Remove subversion tags from config files to avoid useless config updates
+	sed -i \
+		-e '/<!-- \$Id:/ d' \
+		"${ED}"/etc/opendnssec/* || die
+
+	# install db update/migration stuff
+	insinto /usr/share/opendnssec/db
+	if use sqlite; then
+		doins enforcer/utils/convert_mysql_to_sqlite
+	fi
+	if use mysql; then
+		doins enforcer/utils/convert_sqlite_to_mysql
+	fi
+
+	insinto /usr/share/opendnssec/db/sql
+	if use sqlite; then
+		doins enforcer/src/db/schema.sqlite
+	fi
+	if use mysql; then
+		doins enforcer/src/db/schema.mysql
+	fi
+
+	insinto /usr/share/opendnssec/db/1.4-2.0_db_convert
+	doins enforcer/utils/1.4-2.0_db_convert/find_problematic_zones.sql
+	doins enforcer/utils/1.4-2.0_db_convert/README.md
+	if use sqlite; then
+		doins enforcer/utils/1.4-2.0_db_convert/sqlite_convert.sql
+		doins enforcer/utils/1.4-2.0_db_convert/convert_sqlite
+	fi
+	if use mysql; then
+		doins enforcer/utils/1.4-2.0_db_convert/convert_mysql
+		doins enforcer/utils/1.4-2.0_db_convert/mysql_convert.sql
+	fi
+
+	# patch scripts to find schema files
+	sed -i \
+		-e 's,^SCHEMA=../src/db/,SCHEMA=/usr/share/opendnssec/db/sql/,' \
+		-e 's,^SCHEMA=../../src/db/,SCHEMA=/usr/share/opendnssec/db/sql/,' \
+		"${ED}"/usr/share/opendnssec/db/convert_* \
+		"${ED}"/usr/share/opendnssec/db/1.4-2.0_db_convert/convert_*
+
+	# fix permissions
+	fowners root:opendnssec /etc/opendnssec
+	fowners root:opendnssec /etc/opendnssec/{addns,conf,kasp,zonelist}.xml
+	fowners opendnssec:opendnssec /var/lib/opendnssec/{,enforcer,signconf,signed,signer,unsigned}
+
+	# install conf/init script
+	newinitd "${FILESDIR}"/opendnssec.initd opendnssec
+	newconfd "${FILESDIR}"/opendnssec.confd opendnssec
+}
+
+pkg_postinst() {
+	local v
+	if use softhsm; then
+		elog "Please make sure that you create your softhsm database in a location writeable"
+		elog "by the opendnssec user. You can set its location in /etc/softhsm.conf."
+		elog "Suggested configuration is:"
+		elog "    echo \"0:/var/lib/opendnssec/softhsm_slot0.db\" >> /etc/softhsm.conf"
+		elog "    softhsm --init-token --slot 0 --label OpenDNSSEC"
+		elog "    chown opendnssec:opendnssec /var/lib/opendnssec/softhsm_slot0.db"
+	fi
+	for v in $REPLACING_VERSIONS; do
+		case $v in
+			1.4.*)
+				ewarn ""
+				ewarn "You are upgrading from version 1.4."
+				ewarn ""
+				ewarn "A migration is needed from 1.4 to 2.0."
+				ewarn "For details see /usr/share/doc/${P}/MIGRATION*"
+				ewarn ""
+				ewarn "For your convenience the mentioned migration scripts and README"
+				ewarn "have been installed to /usr/share/${PN}/db/1.4-2.0_db_convert"
+				ewarn ""
+			;;
+		esac
+	done
+}
diff --git a/net-dns/opendnssec/opendnssec-2.0.3.ebuild b/net-dns/opendnssec/opendnssec-2.0.3.ebuild
new file mode 100644
index 000000000000..f4ecf0b3f3eb
--- /dev/null
+++ b/net-dns/opendnssec/opendnssec-2.0.3.ebuild
@@ -0,0 +1,239 @@
+# Copyright 1999-2017 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=5
+
+MY_P="${P/_}"
+PKCS11_IUSE="+softhsm opensc external-hsm"
+inherit autotools eutils multilib user
+
+DESCRIPTION="An open-source turn-key solution for DNSSEC"
+HOMEPAGE="http://www.opendnssec.org/"
+SRC_URI="http://www.${PN}.org/files/source/${MY_P}.tar.gz"
+
+LICENSE="BSD GPL-2"
+SLOT="0"
+KEYWORDS="~amd64 ~x86"
+IUSE="debug doc +mysql readline +signer sqlite test ${PKCS11_IUSE}"
+
+RDEPEND="
+	dev-lang/perl
+	dev-libs/libxml2
+	dev-libs/libxslt
+	net-libs/ldns
+	mysql? (
+		virtual/mysql
+		dev-perl/DBD-mysql
+	)
+	opensc? ( dev-libs/opensc )
+	readline? ( sys-libs/readline:0 )
+	softhsm? ( dev-libs/softhsm:* )
+	sqlite? (
+		dev-db/sqlite:3
+		dev-perl/DBD-SQLite
+	)
+"
+DEPEND="${RDEPEND}
+	doc? ( app-doc/doxygen )
+	test? (
+		app-text/trang
+	)
+"
+
+REQUIRED_USE="
+	^^ ( mysql sqlite )
+	^^ ( softhsm opensc external-hsm )
+"
+
+PATCHES=(
+	"${FILESDIR}/${PN}-fix-localstatedir-2.0.x.patch"
+	"${FILESDIR}/${PN}-fix-run-dir-2.0.x.patch"
+	"${FILESDIR}/${PN}-drop-privileges-2.0.x.patch"
+	"${FILESDIR}/${PN}-use-system-trang.patch"
+)
+
+S="${WORKDIR}/${MY_P}"
+
+DOCS=( MIGRATION NEWS )
+
+check_pkcs11_setup() {
+	# PKCS#11 HSM's are often only available with proprietary drivers not
+	# available in portage tree.
+
+	if use softhsm; then
+		PKCS11_LIB=softhsm
+		if has_version ">=dev-libs/softhsm-1.3.1"; then
+			PKCS11_PATH=/usr/$(get_libdir)/softhsm/libsofthsm.so
+		else
+			PKCS11_PATH=/usr/$(get_libdir)/libsofthsm.so
+		fi
+		elog "Building with SoftHSM PKCS#11 library support."
+	fi
+	if use opensc; then
+		PKCS11_LIB=opensc
+		PKCS11_PATH=/usr/$(get_libdir)/opensc-pkcs11.so
+		elog "Building with OpenSC PKCS#11 library support."
+	fi
+	if use external-hsm; then
+		if [[ -n ${PKCS11_SCA6000} ]]; then
+			PKCS11_LIB=sca6000
+			PKCS11_PATH=${PKCS11_SCA6000}
+		elif [[ -n ${PKCS11_ETOKEN} ]]; then
+			PKCS11_LIB=etoken
+			PKCS11_PATH=${PKCS11_ETOKEN}
+		elif [[ -n ${PKCS11_NCIPHER} ]]; then
+			PKCS11_LIB=ncipher
+			PKCS11_PATH=${PKCS11_NCIPHER}
+		elif [[ -n ${PKCS11_AEPKEYPER} ]]; then
+			PKCS11_LIB=aepkeyper
+			PKCS11_PATH=${PKCS11_AEPKEYPER}
+		else
+			ewarn "You enabled USE flag 'external-hsm' but did not specify a path to a PKCS#11"
+			ewarn "library. To set a path, set one of the following environment variables:"
+			ewarn "  for Sun Crypto Accelerator 6000, set: PKCS11_SCA6000=<path>"
+			ewarn "  for Aladdin eToken, set: PKCS11_ETOKEN=<path>"
+			ewarn "  for Thales/nCipher netHSM, set: PKCS11_NCIPHER=<path>"
+			ewarn "  for AEP Keyper, set: PKCS11_AEPKEYPER=<path>"
+			ewarn "Example:"
+			ewarn "  PKCS11_ETOKEN=\"/opt/etoken/lib/libeTPkcs11.so\" emerge -pv opendnssec"
+			ewarn "or store the variable into /etc/portage/make.conf"
+			die "USE flag 'external-hsm' set but no PKCS#11 library path specified."
+		fi
+		elog "Building with external PKCS#11 library support ($PKCS11_LIB): ${PKCS11_PATH}"
+	fi
+}
+
+pkg_pretend() {
+	if has_version "<net-dns/opendnssec-1.4.10"; then
+		################################################################################
+		eerror "You are already using OpenDNSSEC."
+		eerror "In order to migrate to version >=2.0.0 you need to upgrade to"
+		eerror "version >=1.4.10 first:"
+		eerror ""
+		eerror "   emerge \"<net-dns/opendnssec-2\""
+		eerror ""
+		eerror "See https://github.com/opendnssec/opendnssec/blob/2.0/master/MIGRATION"
+		eerror "for details."
+		eerror ""
+		die "Please upgrade to version >=1.4.10 first for proper db migraion"
+	fi
+
+	check_pkcs11_setup
+}
+
+pkg_setup() {
+	enewgroup opendnssec
+	enewuser opendnssec -1 -1 -1 opendnssec
+
+	# pretend does not preserve variables so we need to run this once more
+	check_pkcs11_setup
+}
+
+src_prepare() {
+	local patch
+	default
+	for patch in "${PATCHES[@]}"; do
+		epatch "$patch"
+	done
+	eautoreconf
+}
+
+src_configure() {
+	econf \
+		--without-cunit \
+		--localstatedir="${EPREFIX}/var" \
+		--disable-static \
+		--with-enforcer-database=$(use mysql && echo "mysql")$(use sqlite && echo "sqlite3") \
+		--with-pkcs11-${PKCS11_LIB}=${PKCS11_PATH} \
+		$(use_with readline) \
+		$(use_enable signer)
+}
+
+src_compile() {
+	default
+	use doc && emake docs
+}
+
+src_install() {
+	default
+
+	# remove useless .la files
+	find "${ED}" -name '*.la' -delete
+
+	# Remove subversion tags from config files to avoid useless config updates
+	sed -i \
+		-e '/<!-- \$Id:/ d' \
+		"${ED}"/etc/opendnssec/* || die
+
+	# install db update/migration stuff
+	insinto /usr/share/opendnssec/db
+	if use sqlite; then
+		doins enforcer/utils/convert_mysql_to_sqlite
+	fi
+	if use mysql; then
+		doins enforcer/utils/convert_sqlite_to_mysql
+	fi
+
+	insinto /usr/share/opendnssec/db/sql
+	if use sqlite; then
+		doins enforcer/src/db/schema.sqlite
+	fi
+	if use mysql; then
+		doins enforcer/src/db/schema.mysql
+	fi
+
+	insinto /usr/share/opendnssec/db/1.4-2.0_db_convert
+	doins enforcer/utils/1.4-2.0_db_convert/find_problematic_zones.sql
+	doins enforcer/utils/1.4-2.0_db_convert/README.md
+	if use sqlite; then
+		doins enforcer/utils/1.4-2.0_db_convert/sqlite_convert.sql
+		doins enforcer/utils/1.4-2.0_db_convert/convert_sqlite
+	fi
+	if use mysql; then
+		doins enforcer/utils/1.4-2.0_db_convert/convert_mysql
+		doins enforcer/utils/1.4-2.0_db_convert/mysql_convert.sql
+	fi
+
+	# patch scripts to find schema files
+	sed -i \
+		-e 's,^SCHEMA=../src/db/,SCHEMA=/usr/share/opendnssec/db/sql/,' \
+		-e 's,^SCHEMA=../../src/db/,SCHEMA=/usr/share/opendnssec/db/sql/,' \
+		"${ED}"/usr/share/opendnssec/db/convert_* \
+		"${ED}"/usr/share/opendnssec/db/1.4-2.0_db_convert/convert_*
+
+	# fix permissions
+	fowners root:opendnssec /etc/opendnssec
+	fowners root:opendnssec /etc/opendnssec/{addns,conf,kasp,zonelist}.xml
+	fowners opendnssec:opendnssec /var/lib/opendnssec/{,enforcer,signconf,signed,signer,unsigned}
+
+	# install conf/init script
+	newinitd "${FILESDIR}"/opendnssec.initd opendnssec
+	newconfd "${FILESDIR}"/opendnssec.confd opendnssec
+}
+
+pkg_postinst() {
+	local v
+	if use softhsm; then
+		elog "Please make sure that you create your softhsm database in a location writeable"
+		elog "by the opendnssec user. You can set its location in /etc/softhsm.conf."
+		elog "Suggested configuration is:"
+		elog "    echo \"0:/var/lib/opendnssec/softhsm_slot0.db\" >> /etc/softhsm.conf"
+		elog "    softhsm --init-token --slot 0 --label OpenDNSSEC"
+		elog "    chown opendnssec:opendnssec /var/lib/opendnssec/softhsm_slot0.db"
+	fi
+	for v in $REPLACING_VERSIONS; do
+		case $v in
+			1.4.*)
+				ewarn ""
+				ewarn "You are upgrading from version 1.4."
+				ewarn ""
+				ewarn "A migration is needed from 1.4 to 2.0."
+				ewarn "For details see /usr/share/doc/${P}/MIGRATION*"
+				ewarn ""
+				ewarn "For your convenience the mentioned migration scripts and README"
+				ewarn "have been installed to /usr/share/${PN}/db/1.4-2.0_db_convert"
+				ewarn ""
+			;;
+		esac
+	done
+}