gentoo resync : 04.07.2020

16 files changed, 626 insertions, 553 deletions

diff --git a/net-dns/Manifest.gz b/net-dns/Manifest.gz
index 45cfa5909682..72f0d950bd7d 100644
--- a/net-dns/Manifest.gz
+++ b/net-dns/Manifest.gz
diff --git a/net-dns/bind-tools/Manifest b/net-dns/bind-tools/Manifest
index 20d6da63ac83..9f6d73420d4a 100644
--- a/net-dns/bind-tools/Manifest
+++ b/net-dns/bind-tools/Manifest
@@ -1,5 +1,7 @@
 DIST bind-9.14.12.tar.gz 6318913 BLAKE2B 38cad65923666afa5d83434c43a1b5577fe9555ca637489f780996a1b439955169c859c690f6fb96b003976eca482fe57c9226797cda5b124dc2073a90ef0515 SHA512 f4e6c50cbe8fdb44cdd8e30b4560b6fe2fccd0fd5bde527a897a66e85065265da0d0aceb95af42d5568dea95d59e68574e5a486bbb7e6c5d0af275538c353ddf
 DIST bind-9.16.3.tar.xz 4573044 BLAKE2B 0630c1225984dbe301ca3e4d768d402e3293eee0ae186257d05e9f9999cdfc9538baf015155471f8abe2e725fe8bdb08c0f45bb8619a4a35b781606ee09e708c SHA512 aded208ab8b10cac275512eb4cb19f4eabd654ef3c14ab0c635f7d09194df4f6dfa84d0b5d69ce93854ceb26a93e21d7122b01ce4f3996da807249ca41d877df
-EBUILD bind-tools-9.14.12.ebuild 3123 BLAKE2B b835f6a2f94f61506b32c27d20d3971141f2f4edbd0a57aa77900375cfbbce52337aeda9fbc042daabc884117bf946b5ea8b7c2b656ef016d52faaab119eff58 SHA512 fa4804481455dd2852284ac0c9f0c50f3348b8a786ac4b45b441265c023d72c61f6a9ad6b2a5627376a4e8eaeed8c8c5d521098f6186c73a2b955aba50010d05
-EBUILD bind-tools-9.16.3.ebuild 3149 BLAKE2B 447f8836c020b27c6a11715572ba0cd1038207e2bf2cd01e34bf00a2dd9403f8108892bc1bd899376979c64d8803af280acc5ac6e35f6f4b8033f32c118ba903 SHA512 ffdce682e5cf47da43ad16e705c2282397b1d9ab0bca22d810d818b129532c68d8b8baf4de1db1bc3dc6b2fcbf987ed49938bc93eb7d88775602b2921703d85d
+DIST bind-9.16.4.tar.xz 3465172 BLAKE2B 0787920793798ecc5d3197e1e51d41c14170f25608077af8275fd60502e2a6f5365670ca9e611a94a53517b6a0bd55cbb37ac37a4f01063fc409def4e34c39a8 SHA512 b1cf0607b0d7569ea594e02848eed601b8faf31c527fc17d379cfff3cd45c0c8b849364af0312e9b65bc14875aad87de379281603c150a07bf021ec740e92860
+EBUILD bind-tools-9.14.12.ebuild 3153 BLAKE2B 1bea1fbfc9afcec51d142ec31987f0ddfa4e567dd8f826486abf5a055e3d7490beac8a994796f67025abe777dcfde1578a7ab6aa6213ca98dd3a6870e9167cb1 SHA512 6b0005e2510e5e6bbfdd8aa09b5aa220e79edc375abee84f965bad6f77d4dea4b1bc79724f593a5194c6919226484392ba7b0f381bd6e01754bb8f00821068c6
+EBUILD bind-tools-9.16.3.ebuild 3179 BLAKE2B b35de17b1a66f5e788cb683c080df412b625f903111513b877b85c88a1262c3434307ad9a40b729432665df031ebe4a71c2053575787fe2b9228d072d37646bf SHA512 9ff56fe1718b59982e9fd08d7ca0c5135118b34560ff0c48ee7230bee54e3a1e943ac9e4bea2679db8959544923776959e8d8c4f15a5a8516dc9e91c4ce7183e
+EBUILD bind-tools-9.16.4.ebuild 3650 BLAKE2B 01b8e1ad6c57c1937e2564618936864818ee29d339291cccfd1d5f22f82bdb4e55541059e43b8f193bdfab47d9c89e9702397680944e4d5f9f4d445490f905bb SHA512 2994ba796fde3c66ea1b229d9bb9f4411159f17cd82dadfa036a336ad0793fd2a2b53644500ec70e2b100f262ce2fadb694a1db76ecf42f6de53d9f9edf5d570
 MISC metadata.xml 423 BLAKE2B 6424fc07b8bba765fa045750b1de629ae57a7004ef10839a3069dab45f20e01e6b50ae755e344f77130edc639aee17c9320dcbb64ed5289fb86a9fb129967617 SHA512 1ec81bf782ad0014c890349248d8ec0302c1940fb13953754ee03f8ea907b0edae79b436e7983982e8f273d04112c8263c416b06e973eba22ac179dd9c68f649
diff --git a/net-dns/bind-tools/bind-tools-9.14.12.ebuild b/net-dns/bind-tools/bind-tools-9.14.12.ebuild
index e179fdad3264..61d9c2df8c8c 100644
--- a/net-dns/bind-tools/bind-tools-9.14.12.ebuild
+++ b/net-dns/bind-tools/bind-tools-9.14.12.ebuild
@@ -70,6 +70,7 @@ src_configure() {
 		$(use_with gssapi)
 		$(use_with readline)
 		$(use_enable caps linux-caps)
+		AR="$(type -P $(tc-getAR))"
 	)
 
 	# bug 607400
diff --git a/net-dns/bind-tools/bind-tools-9.16.3.ebuild b/net-dns/bind-tools/bind-tools-9.16.3.ebuild
index 430038762701..3150d630e4db 100644
--- a/net-dns/bind-tools/bind-tools-9.16.3.ebuild
+++ b/net-dns/bind-tools/bind-tools-9.16.3.ebuild
@@ -71,6 +71,7 @@ src_configure() {
 		$(use_with gssapi)
 		$(use_with readline)
 		$(use_enable caps linux-caps)
+		AR="$(type -P $(tc-getAR))"
 	)
 
 	# bug 607400
diff --git a/net-dns/bind-tools/bind-tools-9.16.4.ebuild b/net-dns/bind-tools/bind-tools-9.16.4.ebuild
new file mode 100644
index 000000000000..d304fa4ca626
--- /dev/null
+++ b/net-dns/bind-tools/bind-tools-9.16.4.ebuild
@@ -0,0 +1,156 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+PYTHON_COMPAT=( python3_{7,8,9} )
+
+inherit autotools flag-o-matic python-any-r1 toolchain-funcs
+
+MY_PN=${PN//-tools}
+MY_PV=${PV/_p/-P}
+MY_PV=${MY_PV/_rc/rc}
+MY_P="${MY_PN}-${MY_PV}"
+
+DESCRIPTION="bind tools: dig, nslookup, host, nsupdate, dnssec-keygen"
+HOMEPAGE="https://www.isc.org/software/bind"
+SRC_URI="https://downloads.isc.org/isc/bind9/${PV}/${MY_P}.tar.xz"
+
+LICENSE="Apache-2.0 BSD BSD-2 GPL-2 HPND ISC MPL-2.0"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+IUSE="+caps doc gssapi idn ipv6 libedit libressl readline xml"
+# no PKCS11 currently as it requires OpenSSL to be patched, also see bug 409687
+
+COMMON_DEPEND="
+	dev-libs/libuv:=
+	caps? ( sys-libs/libcap )
+	!libressl? ( dev-libs/openssl:= )
+	libressl? ( dev-libs/libressl:= )
+	xml? ( dev-libs/libxml2 )
+	idn? ( net-dns/libidn2:= )
+	gssapi? ( virtual/krb5 )
+	libedit? ( dev-libs/libedit )
+	!libedit? (
+		readline? ( sys-libs/readline:= )
+	)"
+DEPEND="${COMMON_DEPEND}"
+
+RDEPEND="${COMMON_DEPEND}"
+
+# sphinx required for man-page and html creation
+BDEPEND="${PYTHON_DEPS}
+	$(python_gen_any_dep '
+		dev-python/sphinx[${PYTHON_USEDEP}]
+	')
+	virtual/pkgconfig"
+
+S="${WORKDIR}/${MY_P}"
+
+# bug 479092, requires networking
+RESTRICT="test"
+
+python_check_deps() {
+	has_version "dev-python/sphinx[${PYTHON_USEDEP}]"
+}
+
+src_prepare() {
+	default
+
+	export LDFLAGS="${LDFLAGS} -L${EPREFIX}/usr/$(get_libdir)"
+
+	# Disable tests for now, bug 406399
+	sed -i '/^SUBDIRS/s:tests::' bin/Makefile.in lib/Makefile.in || die
+
+	# bug #220361
+	rm aclocal.m4 || die
+	rm -rf libtool.m4/ || die
+
+	eautoreconf
+}
+
+src_configure() {
+	local myeconfargs=(
+		--localstatedir="${EPREFIX}"/var
+		--without-python
+		--without-libjson
+		--without-zlib
+		--without-lmdb
+		--without-maxminddb
+		--disable-geoip
+		--with-openssl="${EPREFIX}"/usr
+		$(use_with idn libidn2)
+		$(use_with xml libxml2)
+		$(use_with gssapi)
+		$(use_with readline)
+		$(use_enable caps linux-caps)
+		AR="$(type -P $(tc-getAR))"
+	)
+
+	# bug 607400
+	if use libedit ; then
+		myeconfargs+=( --with-readline=-ledit )
+	elif use readline ; then
+		myeconfargs+=( --with-readline=-lreadline )
+	else
+		myeconfargs+=( --without-readline )
+	fi
+
+	# bug 344029
+	append-cflags "-DDIG_SIGCHASE"
+
+	# to expose CMSG_* macros from sys/sockets.h
+	[[ ${CHOST} == *-solaris* ]] && append-cflags "-D_XOPEN_SOURCE=600"
+
+	# localstatedir for nsupdate -l, bug 395785
+	tc-export BUILD_CC
+	econf "${myeconfargs[@]}"
+
+	# bug #151839
+	echo '#undef SO_BSDCOMPAT' >> config.h
+}
+
+src_compile() {
+	local AR=$(tc-getAR)
+
+	emake AR="${AR}" -C lib/
+	emake AR="${AR}" -C bin/delv/
+	emake AR="${AR}" -C bin/dig/
+	emake AR="${AR}" -C bin/nsupdate/
+	emake AR="${AR}" -C bin/dnssec/
+	emake -C doc/man/ man $(usev doc)
+}
+
+src_install() {
+	local man_dir="${S}/doc/man"
+	local html_dir="${man_dir}/_build/html"
+
+	dodoc README CHANGES
+
+	cd "${S}"/bin/delv || die
+	dobin delv
+	doman ${man_dir}/delv.1
+
+	cd "${S}"/bin/dig || die
+	dobin dig host nslookup
+	doman ${man_dir}/{dig,host,nslookup}.1
+
+	cd "${S}"/bin/nsupdate || die
+	dobin nsupdate
+	doman ${man_dir}/nsupdate.1
+	if use doc; then
+		docinto html
+		dodoc ${html_dir}/nsupdate.html
+	fi
+
+	cd "${S}"/bin/dnssec || die
+	for tool in dsfromkey importkey keyfromlabel keygen \
+		revoke settime signzone verify; do
+		dobin dnssec-"${tool}"
+		doman ${man_dir}/dnssec-"${tool}".8
+		if use doc; then
+			docinto html
+			dodoc ${html_dir}/dnssec-"${tool}".html
+		fi
+	done
+}
diff --git a/net-dns/bind/Manifest b/net-dns/bind/Manifest
index 5dbf9bf99991..25efe84735ba 100644
--- a/net-dns/bind/Manifest
+++ b/net-dns/bind/Manifest
@@ -10,7 +10,9 @@ AUX named.init-r13 6202 BLAKE2B 1968806c9580517b8443a08b90f7b425913b2dc17d950383
 AUX named.service-r1 327 BLAKE2B b0471100b425a1d4db29c1ef577dd6f14b2c3d040fd826bed03105f514bf1ea2c58c19d59557d0eafe27a96588adaf60156f31b6befdd9be96a8ca1fe8613678 SHA512 1d3dbf9d1de0c23c398a523b05c0fb266b6b699e54d232818b28205f697ca227acae9f2778d6f41309b117a6cd78eee170b745594b786b1c1571d5f66d6c3de4
 DIST bind-9.14.12.tar.gz 6318913 BLAKE2B 38cad65923666afa5d83434c43a1b5577fe9555ca637489f780996a1b439955169c859c690f6fb96b003976eca482fe57c9226797cda5b124dc2073a90ef0515 SHA512 f4e6c50cbe8fdb44cdd8e30b4560b6fe2fccd0fd5bde527a897a66e85065265da0d0aceb95af42d5568dea95d59e68574e5a486bbb7e6c5d0af275538c353ddf
 DIST bind-9.16.3.tar.xz 4573044 BLAKE2B 0630c1225984dbe301ca3e4d768d402e3293eee0ae186257d05e9f9999cdfc9538baf015155471f8abe2e725fe8bdb08c0f45bb8619a4a35b781606ee09e708c SHA512 aded208ab8b10cac275512eb4cb19f4eabd654ef3c14ab0c635f7d09194df4f6dfa84d0b5d69ce93854ceb26a93e21d7122b01ce4f3996da807249ca41d877df
+DIST bind-9.16.4.tar.xz 3465172 BLAKE2B 0787920793798ecc5d3197e1e51d41c14170f25608077af8275fd60502e2a6f5365670ca9e611a94a53517b6a0bd55cbb37ac37a4f01063fc409def4e34c39a8 SHA512 b1cf0607b0d7569ea594e02848eed601b8faf31c527fc17d379cfff3cd45c0c8b849364af0312e9b65bc14875aad87de379281603c150a07bf021ec740e92860
 DIST dyndns-samples.tbz2 22866 BLAKE2B 409890653c6536cb9c0e3ba809d2bfde0e0ae73a2a101b4f229b46c01568466bc022bbbc37712171adbd08c572733e93630feab95a0fcd1ac50a7d37da1d1108 SHA512 83b0bf99f8e9ff709e8e9336d8c5231b98a4b5f0c60c10792f34931e32cc638d261967dfa5a83151ec3740977d94ddd6e21e9ce91267b3e279b88affdbc18cac
 EBUILD bind-9.14.12.ebuild 11349 BLAKE2B d52a02a1f9f9093f256fb8ed44f7e273c9c5bfba3f16951533d0bac23ec285156484c55894520c1100060fb86fd573daba85171686634dec915c57f4c88138a0 SHA512 f4993c4747ecda256fd56637ae9a0e91904af17a25ba9dbdf868c9b7077e10cb5907b7b33dd1105da60f8246daf9e4ce19d7754f1e8f3efa3f2d6981ca7e201c
 EBUILD bind-9.16.3.ebuild 11354 BLAKE2B 74241d9d6118e43d1ddf7c0d414c4dfb66011a9bf33a905c9a7dc106282a988be25adfa40a3ed14ffd1d948909627ab210d1c749e02fa2c6a3e2823f594f6e51 SHA512 cb67132274c37d5f1746d6b18067e72c09efd9bfe1232443a92dc27e75812be783b1d8864677cc73415c1b212e035e8070201411fb0388290c5a26137d1ec6c4
+EBUILD bind-9.16.4.ebuild 10518 BLAKE2B e7b6de335262333fd40afeef93cfe65df88c080b617abe9b23f1d3bdb8cfb8920c370b37e07693c60df45a9bc092fb1c3d0444e4ce696703203fe1309389654a SHA512 fca740845b0834bcda2719a1a92448001836070f5dc3eecb28ed9ee6eb3ac9fc3f83163ee458e3831277f80954a88e6642248452dc7eb15aa784ed9ff2c9088c
 MISC metadata.xml 1043 BLAKE2B c4b1341082f3bd13a93ea378f61608a65ac7f904273932dcdbcf2a73ea8b4c7610ced855ed4a3fb61c7b02044db23bd0effda02d71b3114c7b4017c06784ac31 SHA512 879eca4059049ced098da9afe6aec250d174fabbc701e55ca6c22cfdf050b7c49289113a7e9ad99fa90685ca62c5f672201e04c7f0c766b55d780e26f8da59a2
diff --git a/net-dns/bind/bind-9.16.4.ebuild b/net-dns/bind/bind-9.16.4.ebuild
new file mode 100644
index 000000000000..b7801db811dc
--- /dev/null
+++ b/net-dns/bind/bind-9.16.4.ebuild
@@ -0,0 +1,352 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+# Re dlz/mysql and threads, needs to be verified..
+# MySQL uses thread local storage in its C api. Thus MySQL
+# requires that each thread of an application execute a MySQL
+# thread initialization to setup the thread local storage.
+# This is impossible to do safely while staying within the DLZ
+# driver API. This is a limitation caused by MySQL, and not the DLZ API.
+# Because of this BIND MUST only run with a single thread when
+# using the MySQL driver.
+
+EAPI=7
+
+PYTHON_COMPAT=( python3_7 )
+
+inherit python-r1 eutils autotools toolchain-funcs flag-o-matic multilib db-use user systemd
+
+MY_PV="${PV/_p/-P}"
+MY_PV="${MY_PV/_rc/rc}"
+MY_P="${PN}-${MY_PV}"
+
+SDB_LDAP_VER="1.1.0-fc14"
+
+RRL_PV="${MY_PV}"
+
+# SDB-LDAP: http://bind9-ldap.bayour.com/
+
+DESCRIPTION="Berkeley Internet Name Domain - Name Server"
+HOMEPAGE="https://www.isc.org/software/bind"
+SRC_URI="https://downloads.isc.org/isc/bind9/${PV}/${P}.tar.xz
+	doc? ( mirror://gentoo/dyndns-samples.tbz2 )"
+
+LICENSE="Apache-2.0 BSD BSD-2 GPL-2 HPND ISC MPL-2.0"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~mips ~ppc ~ppc64 ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+# -berkdb by default re bug 602682
+IUSE="-berkdb +caps dlz dnstap doc dnsrps fixed-rrset geoip geoip2 gssapi
+json ldap libressl lmdb mysql odbc postgres python selinux static-libs
+urandom xml +zlib"
+# sdb-ldap - patch broken
+# no PKCS11 currently as it requires OpenSSL to be patched, also see bug 409687
+
+REQUIRED_USE="
+	?? ( geoip geoip2 )
+	postgres? ( dlz )
+	berkdb? ( dlz )
+	mysql? ( dlz )
+	odbc? ( dlz )
+	ldap? ( dlz )
+	dnsrps? ( dlz )
+	python? ( ${PYTHON_REQUIRED_USE} )"
+
+DEPEND="!libressl? ( dev-libs/openssl:=[-bindist] )
+	libressl? ( dev-libs/libressl:= )
+	mysql? ( dev-db/mysql-connector-c:0= )
+	odbc? ( >=dev-db/unixODBC-2.2.6 )
+	ldap? ( net-nds/openldap )
+	postgres? ( dev-db/postgresql:= )
+	caps? ( >=sys-libs/libcap-2.1.0 )
+	xml? ( dev-libs/libxml2 )
+	geoip? ( >=dev-libs/geoip-1.4.6 )
+	geoip2? ( dev-libs/libmaxminddb )
+	gssapi? ( virtual/krb5 )
+	json? ( dev-libs/json-c:= )
+	lmdb? ( dev-db/lmdb )
+	zlib? ( sys-libs/zlib )
+	dnstap? ( dev-libs/fstrm dev-libs/protobuf-c )
+	python? (
+		${PYTHON_DEPS}
+		dev-python/ply[${PYTHON_USEDEP}]
+	)
+	dev-libs/libuv:="
+
+RDEPEND="${DEPEND}
+	selinux? ( sec-policy/selinux-bind )
+	sys-process/psmisc"
+
+S="${WORKDIR}/${MY_P}"
+
+# bug 479092, requires networking
+# bug 710840, cmocka fails LDFLAGS='-Wl,-O1'
+RESTRICT="test"
+
+pkg_setup() {
+	ebegin "Creating named group and user"
+	enewgroup named 40
+	enewuser named 40 -1 /etc/bind named
+	eend ${?}
+}
+
+src_prepare() {
+	default
+
+	export LDFLAGS="${LDFLAGS} -L${EPREFIX}/usr/$(get_libdir) -ldl"
+
+	# should be installed by bind-tools
+	sed -i -r -e "s:(nsupdate|dig|delv) ::g" bin/Makefile.in || die
+
+	# Disable tests for now, bug 406399
+	sed -i '/^SUBDIRS/s:tests::' bin/Makefile.in lib/Makefile.in || die
+
+	# bug #220361
+	rm aclocal.m4 || die
+	rm -rf libtool.m4/ || die
+	eautoreconf
+}
+
+src_configure() {
+	local myeconfargs=(
+		--prefix="${EPREFIX}"/usr
+		--sysconfdir=/etc/bind
+		--localstatedir=/var
+		--with-libtool
+		--enable-full-report
+		--without-readline
+		--with-openssl="${EPREFIX}"/usr
+		--without-cmocka
+		$(use_enable caps linux-caps)
+		$(use_enable dnsrps)
+		$(use_enable dnstap)
+		$(use_enable fixed-rrset)
+		# $(use_enable static-libs static)
+		$(use_with berkdb dlz-bdb)
+		$(use_with dlz dlopen)
+		$(use_with dlz dlz-filesystem)
+		$(use_with dlz dlz-stub)
+		$(use_with gssapi)
+		$(use_with json json-c)
+		$(use_with ldap dlz-ldap)
+		$(use_with mysql dlz-mysql)
+		$(use_with odbc dlz-odbc)
+		$(use_with postgres dlz-postgres)
+		$(use_with lmdb)
+		$(use_with python)
+		$(use_with xml libxml2)
+		$(use_with zlib)
+	)
+
+	use geoip && myeconfargs+=( --enable-geoip )
+	use geoip2 && myeconfargs+=( --with-maxminddb )
+
+	# bug #158664
+#	gcc-specs-ssp && replace-flags -O[23s] -O
+
+	# To include db.h from proper path
+	use berkdb && append-flags "-I$(db_includedir)"
+
+	export BUILD_CC=$(tc-getBUILD_CC)
+	econf "${myeconfargs[@]}"
+
+	# bug #151839
+	echo '#undef SO_BSDCOMPAT' >> config.h
+}
+
+src_install() {
+	default
+
+	dodoc CHANGES README
+
+	if use doc; then
+		dodoc doc/arm/Bv9ARM.pdf
+
+		docinto misc
+		dodoc -r doc/misc/
+
+		# might a 'html' useflag make sense?
+		docinto html
+		dodoc -r doc/arm/
+
+		docinto contrib
+		dodoc contrib/scripts/{nanny.pl,named-bootconf.sh}
+
+		# some handy-dandy dynamic dns examples
+		pushd "${ED}"/usr/share/doc/${PF} 1>/dev/null || die
+		tar xf "${DISTDIR}"/dyndns-samples.tbz2 || die
+		popd 1>/dev/null || die
+	fi
+
+	insinto /etc/bind
+	newins "${FILESDIR}"/named.conf-r8 named.conf
+
+	# ftp://ftp.rs.internic.net/domain/named.cache:
+	insinto /var/bind
+	newins "${FILESDIR}"/named.cache-r3 named.cache
+
+	insinto /var/bind/pri
+	newins "${FILESDIR}"/localhost.zone-r3 localhost.zone
+
+	newinitd "${FILESDIR}"/named.init-r13 named
+	newconfd "${FILESDIR}"/named.confd-r7 named
+
+	newenvd "${FILESDIR}"/10bind.env 10bind
+
+	# Let's get rid of those tools and their manpages since they're provided by bind-tools
+	rm -f "${ED}"/usr/share/man/man1/{dig,host,nslookup}.1* || die
+	rm -f "${ED}"/usr/share/man/man8/nsupdate.8* || die
+	rm -f "${ED}"/usr/bin/{dig,host,nslookup,nsupdate} || die
+	rm -f "${ED}"/usr/sbin/{dig,host,nslookup,nsupdate} || die
+	for tool in dsfromkey importkey keyfromlabel keygen \
+	revoke settime signzone verify; do
+		rm -f "${ED}"/usr/{,s}bin/dnssec-"${tool}" || die
+		rm -f "${ED}"/usr/share/man/man8/dnssec-"${tool}".8* || die
+	done
+
+	# bug 405251, library archives aren't properly handled by --enable/disable-static
+	if ! use static-libs; then
+		find "${ED}" -type f -name '*.a' -delete || die
+	fi
+
+	# bug 405251
+	find "${ED}" -type f -name '*.la' -delete || die
+
+	if use python; then
+		install_python_tools() {
+			dosbin bin/python/dnssec-{checkds,coverage}
+		}
+		python_foreach_impl install_python_tools
+
+		python_replicate_script "${ED}/usr/sbin/dnssec-checkds"
+		python_replicate_script "${ED}/usr/sbin/dnssec-coverage"
+	fi
+
+	# bug 450406
+	dosym named.cache /var/bind/root.cache
+
+	dosym ../../var/bind/pri /etc/bind/pri
+	dosym ../../var/bind/sec /etc/bind/sec
+	dosym ../../var/bind/dyn /etc/bind/dyn
+	keepdir /var/bind/{pri,sec,dyn}
+
+	dodir /var/log/named
+
+	fowners root:named /{etc,var}/bind /var/log/named /var/bind/{sec,pri,dyn}
+	fowners root:named /var/bind/named.cache /var/bind/pri/localhost.zone /etc/bind/{bind.keys,named.conf}
+	fperms 0640 /var/bind/named.cache /var/bind/pri/localhost.zone /etc/bind/{bind.keys,named.conf}
+	fperms 0750 /etc/bind /var/bind/pri
+	fperms 0770 /var/log/named /var/bind/{,sec,dyn}
+
+	systemd_newunit "${FILESDIR}/named.service-r1" named.service
+	systemd_dotmpfilesd "${FILESDIR}"/named.conf
+	exeinto /usr/libexec
+	doexe "${FILESDIR}/generate-rndc-key.sh"
+}
+
+pkg_postinst() {
+	if [ ! -f '/etc/bind/rndc.key' ]; then
+		if use urandom; then
+			einfo "Using /dev/urandom for generating rndc.key"
+			/usr/sbin/rndc-confgen -r /dev/urandom -a
+			echo
+		else
+			einfo "Using /dev/random for generating rndc.key"
+			/usr/sbin/rndc-confgen -a
+			echo
+		fi
+		chown root:named /etc/bind/rndc.key || die
+		chmod 0640 /etc/bind/rndc.key || die
+	fi
+
+	einfo
+	einfo "You can edit /etc/conf.d/named to customize named settings"
+	einfo
+	use mysql || use postgres || use ldap && {
+		elog "If your named depends on MySQL/PostgreSQL or LDAP,"
+		elog "uncomment the specified rc_named_* lines in your"
+		elog "/etc/conf.d/named config to ensure they'll start before bind"
+		einfo
+	}
+	einfo "If you'd like to run bind in a chroot AND this is a new"
+	einfo "install OR your bind doesn't already run in a chroot:"
+	einfo "1) Uncomment and set the CHROOT variable in /etc/conf.d/named."
+	einfo "2) Run \`emerge --config '=${CATEGORY}/${PF}'\`"
+	einfo
+
+	CHROOT=$(source /etc/conf.d/named 2>/dev/null; echo ${CHROOT})
+	if [[ -n ${CHROOT} ]]; then
+		elog "NOTE: As of net-dns/bind-9.4.3_p5-r1 the chroot part of the init-script got some major changes!"
+		elog "To enable the old behaviour (without using mount) uncomment the"
+		elog "CHROOT_NOMOUNT option in your /etc/conf.d/named config."
+		elog "If you decide to use the new/default method, ensure to make backup"
+		elog "first and merge your existing configs/zones to /etc/bind and"
+		elog "/var/bind because bind will now mount the needed directories into"
+		elog "the chroot dir."
+	fi
+}
+
+pkg_config() {
+	CHROOT=$(source /etc/conf.d/named; echo ${CHROOT})
+	CHROOT_NOMOUNT=$(source /etc/conf.d/named; echo ${CHROOT_NOMOUNT})
+	CHROOT_GEOIP=$(source /etc/conf.d/named; echo ${CHROOT_GEOIP})
+
+	if [[ -z "${CHROOT}" ]]; then
+		eerror "This config script is designed to automate setting up"
+		eerror "a chrooted bind/named. To do so, please first uncomment"
+		eerror "and set the CHROOT variable in '/etc/conf.d/named'."
+		die "Unset CHROOT"
+	fi
+	if [[ -d "${CHROOT}" ]]; then
+		ewarn "NOTE: As of net-dns/bind-9.4.3_p5-r1 the chroot part of the init-script got some major changes!"
+		ewarn "To enable the old behaviour (without using mount) uncomment the"
+		ewarn "CHROOT_NOMOUNT option in your /etc/conf.d/named config."
+		ewarn
+		ewarn "${CHROOT} already exists... some things might become overridden"
+		ewarn "press CTRL+C if you don't want to continue"
+		sleep 10
+	fi
+
+	echo; einfo "Setting up the chroot directory..."
+
+	mkdir -m 0750 -p ${CHROOT} || die
+	mkdir -m 0755 -p ${CHROOT}/{dev,etc,var/log,run} || die
+	mkdir -m 0750 -p ${CHROOT}/etc/bind || die
+	mkdir -m 0770 -p ${CHROOT}/var/{bind,log/named} ${CHROOT}/run/named/ || die
+
+	chown root:named \
+		${CHROOT} \
+		${CHROOT}/var/{bind,log/named} \
+		${CHROOT}/run/named/ \
+		${CHROOT}/etc/bind \
+		|| die
+
+	mknod ${CHROOT}/dev/null c 1 3 || die
+	chmod 0666 ${CHROOT}/dev/null || die
+
+	mknod ${CHROOT}/dev/zero c 1 5 || die
+	chmod 0666 ${CHROOT}/dev/zero || die
+
+	if use urandom; then
+		mknod ${CHROOT}/dev/urandom c 1 9 || die
+		chmod 0666 ${CHROOT}/dev/urandom || die
+	else
+		mknod ${CHROOT}/dev/random c 1 8 || die
+		chmod 0666 ${CHROOT}/dev/random || die
+	fi
+
+	if [ "${CHROOT_NOMOUNT:-0}" -ne 0 ]; then
+		cp -a /etc/bind ${CHROOT}/etc/ || die
+		cp -a /var/bind ${CHROOT}/var/ || die
+	fi
+
+	if [ "${CHROOT_GEOIP:-0}" -eq 1 ]; then
+		if use geoip; then
+			mkdir -m 0755 -p ${CHROOT}/usr/share/GeoIP || die
+		elif use geoip2; then
+			mkdir -m 0755 -p ${CHROOT}/usr/share/GeoIP2 || die
+		fi
+	fi
+
+	elog "You may need to add the following line to your syslog-ng.conf:"
+	elog "source jail { unix-stream(\"${CHROOT}/dev/log\"); };"
+}
diff --git a/net-dns/maradns/Manifest b/net-dns/maradns/Manifest
index 18b2ab0545ed..c6f0a2a84320 100644
--- a/net-dns/maradns/Manifest
+++ b/net-dns/maradns/Manifest
@@ -1,14 +1,9 @@
 AUX deadwood 475 BLAKE2B 1f5f669b22011bf38e077d21278ebfbff72ba45782b863044d868f3a46256192fa1041db8ee6fe5ff5ac15285caacceb8222d2fb1dce1c617c41baea1da7fe15 SHA512 ea01c5cd9494a9dd5c8146f0de84c6bd4df3ba2221b52b87886892cbc13aad21f273ea1d056c3dd88ae5e15c1f6f820f9fe4b1dd4c9ae7082d7f7f78b3f8813e
-AUX maradns-2.0.06-askmara-tcp.patch 7330 BLAKE2B 57afd93fb8f75ccb91a186641c288e9d6a233b9e5887712ef172dedaf0398a984541c7f0a5656e0498036196bd0963a4c1e17cda1614a165e341031c4d1468c1 SHA512 0a36bbe9fbf8d48e6e1e20cc6045656f3517f650bc055b1abecdac4e2eb2e0f4c0f41ed960913ec38590f76a16762a518ca3f20799b8ee64223530da5b2d0dee
-AUX maradns-2.0.06-duende-man.patch 3393 BLAKE2B 9afb3358d6e660fbde7c03b93c6d5fe2373ec6a216c4b93775e5c9f76f3ce3df55ed1cf84916a0d7c95d65e8209c03e0b73fc3fba171dfb1ad2e00c70eea417c SHA512 ff4996e9b377fe01d90f36bf306085e981e1b00bb6264e69e04f9bc53271d98201ec84ea773630453840b357fdf2d3aa46c48fb3af3812cb97627a66fa77bc58
-AUX maradns-2.0.09-build.patch 1549 BLAKE2B 4b74391d9ddc294a8060bc24f769ace28faa08676d69883bc5e4e7aff5b8e463a78e0b24afc7377b7528a8974065a4fdf88699d21c1c18fcc2bb980a85545d36 SHA512 6d06102cb8d6c5333521f9ffc75d775382c9113372fa1b80516677ef11513718d41a740a79d9f970420dc0fcede3c7bc2c9a41a08fb8c138e4063fbcbfb5c5f3
 AUX maradns.service.in 159 BLAKE2B 2ecd43d92a6c804fd713c0e1e22a18049ab410ccb0b92ec9ffe7621605e1dfea65c880369d0530e59cf061f6fb402cd83175f38be27b43d82b65a7175434e648 SHA512 0de3b9141b8266cb6443b8a7fcb6243782059d2ea45b89421158ded607413eb491542c279f2a9b4455e9396e6ba20e46aed8f46eba3b04e5bd428f335c4b9582
 AUX maradns2 481 BLAKE2B 486711875cc3ad29066cbe52d16fb29c6ba35473ec0ffe63fb8039e208e90009900faf8f93c9c43ae80fe0b618202b2aff5cd2302af253a4d38d7d6486c8bc05 SHA512 e893020a934c5927b772189c034469055cd0d8a8ab3e066fe063e30999be6a6679e7b95c2761dec1326cec37fe5261541fbb27e9be796681764c75252b10e90b
 AUX zoneserver2 483 BLAKE2B fcae510c7d5719df0b018976052fb0b6ccb3af1324b607ccfb93a3e5d822d1ee5460424f2b05e1f2b3f09f7d445242f58f55abbc5ba88adeb25861c3eae29e90 SHA512 dc5dd43b043417002fce4c3d6c2e5417bc68fae7a0ac4db03f7cb382d348ed6b2c7042c38ffc2db3a4c36abf734e9d34124042a4077090bd7947241aab955ab7
-DIST maradns-2.0.09.tar.bz2 1139409 BLAKE2B 8c3709241b85f9069eb4e18098f7753b19bcc87d32bbb36aef42cb8ec123dc73b8e29e79b5efe1083035b2378a484e2c00038700647d5e75f469589b37b351e2 SHA512 42bfcafaf4e465d8d566b4d9ea8383b5d0f553486b86dd807b35a07358987227e5dc8187de0e8192fba5b53098d61f91091cec112ef7cc80c5d5e73d8acff3bf
-DIST maradns-2.0.14.tar.bz2 1156272 BLAKE2B 7e96d0769dd1df70316cc1bd79fb7e902c723f78db035fe721aaab0d6902958a40c2743374824ae024759164ad9cbda9a3c6ecaec7cc6bf3c5fa7b384101c16f SHA512 57527bba2f9801904f59cc7d9e56cbd7124635841ad8c91cbd3d1b8d58e7fe38d509e19f6ea53e2790777e054b68bb8df02bfa820ba7c9dbe65262e1993a2aa4
 DIST maradns-2.0.16.tar.bz2 1127504 BLAKE2B 142166370efed2d52c0a1e659bf0056f8d13cc5eca3c1d30c0278b81047aa58ce6c6f3f8496e982841b9dcd541ffd2c24467b8062aa5a7ffb1f31ef6cf841a15 SHA512 9959a7b6724aff5561fa9303b3d7c967e298fd63d95ef7e34d80514dde8871c19887c184a6466779f2833c295233dd1d54a7c06928ac58dcbb374281deb13f17
-EBUILD maradns-2.0.09-r2.ebuild 2691 BLAKE2B 4cfc46b00741e7263f2e941fbc2028bd1587d0919061dfe07cecacfbdaa6326da404dfbeba99541c9197e089c5709146d9848b4f85f16b069a56b5c8cec6fdc9 SHA512 481512b5a855aa8751ae8d3699c2b3218cf05e5ec2808df30502ed2e20756e1d50ce8714e8acd09eba09f6b3faa8442345bc9187ca5eae53a0bd178421a92f12
-EBUILD maradns-2.0.14.ebuild 2848 BLAKE2B 62f4a9e99a249fe5084ee5d4b57513d151fd4fbb3a39d382c2d4c40d72c143d9051c8b6bbbfcf8cfa06c4f5929c171429e9eb1b42f038b8d4798becbcab353bd SHA512 bac2001e02da3ab7cd7be5009953d2cdeb73062c2ded1e58b35998001ae6d77b0c51a3166202f291733c635b751fd82cadeed6d3171bdfb1bce5032fd59cfc7b
+DIST maradns-3.5.0005.tar.xz 5351412 BLAKE2B c6b1c4fb93cb507045b3c09574d7ce30b0af92301e157216b4a5bbd2ed74ceb829ef4d11cd08048c7a685a09cdd4178cf3fc4e7b2465820d26d3a5c1b96f4a5e SHA512 2e7008ff6217929008292dde60d96eb2ec0499a170e1b5bda5fcfb27300d2ce6cecd8b3e2a2d4b09ff32b803f9f435230378e6b2e41e7b63c42653d8c931151d
 EBUILD maradns-2.0.16.ebuild 2814 BLAKE2B 5c7baba17ac15bcfe55c3e1600f4139e62564443647b53def559468c6c4a75c1dfad0212ccf7ac0ff73d4f8b7c241351629766d5b10f12c29a2c7a118e073ed6 SHA512 155e04103597ec88ad5f4e47ceb2829cc6d64e5971f7fd9f2a5198f0def046612fdfa29f14b7b45a173909585e84c0d3a6fd2f3854faf489de7f5261fa7eba49
-MISC metadata.xml 597 BLAKE2B c20996c53cdf360a0f72998c674ceb22d97fe0f07c08c0712fadd36572ac157c93fa42a7011d45f22a19e7a7f98dc2abf8159973e155b0d78bb0e5277adc26b6 SHA512 b8f775d1f780e3ecb23dc900d0c464a25a5166196b27f103151bc5100a321188b0186e2b3149d543aa139d58bd5c0ce11d80ca1be0cace16b8d392bbd2a1b762
+EBUILD maradns-3.5.0005.ebuild 2360 BLAKE2B 00865af6b60997b605ec87ea4ca19de88007faf30de57eb5dc4a42c301ab89b770b61f54aa42bc7e7112ab761bf2c2ce3e70ef7ec2f27c8f8c0a524c68fb7109 SHA512 dfb591d714004888e7719359364c56e16bc19a759af66ca6edd0f5f68f25000365acc9de115f332481a830b90e7a636521421fd556451da7aea0a77cac10c111
+MISC metadata.xml 728 BLAKE2B 07077c81b008d0ab019995c21873fcf61ff636a346eb582d966f81dabd4a9a7e3ad2a9879c6ca33708828b54b3ae2dcafb8c89716dd571c95a456add01e43863 SHA512 0b0c7db834ae6a1a94069873c72cfe2e87840d89d556ffc7a2887c426321ced9b474dc32292010f4dd8918389906cda16b2f3ae1251c7a9ab6be055763ae8330
diff --git a/net-dns/maradns/files/maradns-2.0.06-askmara-tcp.patch b/net-dns/maradns/files/maradns-2.0.06-askmara-tcp.patch
deleted file mode 100644
index 107097159c83..000000000000
--- a/net-dns/maradns/files/maradns-2.0.06-askmara-tcp.patch
+++ /dev/null
@@ -1,251 +0,0 @@
-Author: Nicholas Bamber <nicholas@periapt.co.uk>
-Subject: askmara-tcp lazily copies askmara usage and man page
-Last-Updated: 2011-09-21
-Forwarded: no
---- a/tools/askmara_labels_en.h
-+++ b/tools/askmara_labels_en.h
-@@ -1,11 +1,12 @@
- /* Placed in the public domain 2001 by Sam Trenholme */
- 
--/* All of the labels for replies used in askmara */
-+/* All of the labels for replies used in askmara(-tcp) */
- 
- #define L_NEWLINE "\n"
- #define L_HARD_ERROR "Hard Error: "
- #define L_QUERYING "Querying the server with the IP "
- #define L_USAGE "Usage: askmara [-n] [-v | -t timeout] Query [server]\n#Example: askmara Ayahoo.com."
-+#define L_USAGE_TCP "Usage: askmara-tcp [-n] [-v | -t timeout] Query [server]\n#Example: askmara-tcp Ayahoo.com."
- #define L_JS_CREATE_INDATA "js_create with indata"
- #define L_JS_CREATE_UINDATA "js_create with uindata"
- #define L_JS_CREATE_OUTDATA "js_create with outdata"
---- a/tools/askmara-tcp.c
-+++ b/tools/askmara-tcp.c
-@@ -190,7 +190,7 @@
-             nrd = 1;
-         else if(argv[0][0] == '-' && argv[0][1] == 'p') {
-             if(argc < 2) {
--                harderror(L_USAGE);
-+                harderror(L_USAGE_TCP);
-                 }
-             argc--;
-             argv++;
-@@ -201,7 +201,7 @@
-             }
-         else if(argv[0][0] == '-' && argv[0][1] == 't') {
-             if(argc < 2) {
--                harderror(L_USAGE);
-+                harderror(L_USAGE_TCP);
-                 }
-             argc--;
-             argv++;
-@@ -213,14 +213,14 @@
-         else if (argv[0][0] != '-')
-             break;
-         else
--            harderror(L_USAGE);
-+            harderror(L_USAGE_TCP);
-         argc--;
-         argv++;
-         }
- 
-     /* we expect now the query string and possibly the server */
-     if(argc<1)
--        harderror(L_USAGE);
-+        harderror(L_USAGE_TCP);
- 
-     /* Determine what IP address to connect to */
-     if(argc>1)
---- /dev/null
-+++ b/doc/en/man/askmara-tcp.1
-@@ -0,0 +1,191 @@
-+.\" Do *not* edit this file; it was automatically generated by ej2man
-+.\" Look for a name.ej file with the same name as this filename
-+.\"
-+.\" Process this file with the following
-+.\" nroff -man -Tutf8 maradns.8 | tr '\020' ' '
-+.\"
-+.\" Last updated Mon Sep 27 15:36:06 2010
-+.\"
-+.TH ASKMARA-TCP 1 "askmara-tcp" "January 2002" "askmara-tcp"
-+.\" We don't want hyphenation (it's too ugly)
-+.\" We also disable justification when using nroff
-+.\" Due to the way the -mandoc macro works, this needs to be placed
-+.\" after the .TH heading
-+.hy 0
-+.if n .na
-+.\"
-+.\" We need the following stuff so that we can have single quotes
-+.\" In both groff and other UNIX *roff processors
-+.if \n(.g .mso www.tmac
-+.ds aq \(aq
-+.if !\n(.g .if '\(aq'' .ds aq \'
-+
-+.SH "NAME"
-+.PP
-+askmara-tcp \- do simple dns queries over TCP
-+.SH "DESCRIPTION"
-+.PP
-+.B "askmara-tcp"
-+queries the user-specified dns server for records, and
-+outputs the reply in a csv2-compatible format (csv2 is the format of
-+zone
-+files that
-+.B "maradns"
-+uses). However unlike
-+.B "askmara"
-+it uses TCP rather than UDP.
-+.SH "USAGE"
-+.PP
-+.B "askmara-tcp"
-+.RB [ -n ]
-+.RB [ -v | -t
-+.IR timeout ]
-+.I query
-+.RI [ server ]
-+.SH "OPTIONS"
-+.PP
-+.TP 4
-+.BI -t
-+If this is present, the following argument is the askmara-tcp
-+.IR timeout ,
-+in seconds. Note that
-+.B "askmara-tcp"
-+can not both have a user-defined
-+timeout and verbose output.
-+.TP 4
-+.BI -v
-+If this is set,
-+.B "askmara-tcp"
-+will verbosely output the complete reply that the server sent. Note
-+that this verbose output is not csv2-compatible.
-+.TP 4
-+.BI -n
-+If this is set,
-+.BR "askmara-tcp" ","
-+when sending out a query, will not
-+request DNS recursion; in other words, askmara-tcp will request that the
-+remote DNS server not contact other DNS servers to answer the query in
-+question.
-+.TP 4
-+.I query
-+dns record to be queried. The query has two sections:
-+The type of record we desire, and the hostname we want this record for.
-+.PP
-+The type of query can have two forms: A one-letter mnemonic, or a
-+numeric rtype followed by a colon. This is immediately concatenated by
-+the full name of the host name we wish to look up.
-+.PP
-+For example, to ask for the IP of \(aqexample.com.\(aq, we can use the
-+one-letter
-+mnemonic, in the form \(aqAexample.com.\(aq, or we can use the numeric
-+RR followed
-+by a colon, giving the query \(aq1:example.com.\(aq (since A has the
-+record type
-+of one). Note that the query name needs the trailing dot at the end.
-+.PP
-+Askmara supports a handful one-letter mnemonics, as follows:
-+.PP
-+.B "A"
-+signifies a request for an A (ipv4 address) RR
-+.PP
-+.B "N"
-+signifies a NS RR
-+.PP
-+.B "C"
-+signifies that we are asking for a CNAME RR
-+.PP
-+.B "S"
-+signifies that we want a SOA RR
-+.PP
-+.B "P"
-+signifies that we want a PTR RR
-+.PP
-+.B "@"
-+signifies that we mant a MX RR
-+.PP
-+.B "T"
-+signifies that we want a TXT RR
-+.PP
-+.B "Z"
-+signifies that we want to ask for all RRs.
-+.TP 4
-+.I server
-+IP address of the dns server to be queried. If no server is given,
-+askmara-tcp will query 127.0.0.1.
-+.PP
-+.SH "EXAMPLES"
-+.PP
-+Asking the server with the ip 127.0.0.1 for the IP address of
-+example.com:
-+
-+.nf
-+askmara-tcp Aexample.com.
-+.fi
-+
-+Asking the server with the ip 198.41.0.4 for the IP address of
-+example.com:
-+
-+.nf
-+askmara-tcp Aexample.com. 198.41.0.4
-+.fi
-+
-+Asking the server with the ip address 127.0.0.1 for the IP address of
-+example.com, using the rr_number:query format:
-+
-+.nf
-+askmara-tcp 1:example.com.
-+.fi
-+
-+Asking the server with the ip address 127.0.0.1 for a SRV record. In
-+particular, we ask for the "http over tcp" service for example.net.
-+Since askmara-tcp doesn\(aqt have a mnemonic for SRV record types, we
-+use the numeric code (33 for SRV):
-+
-+.nf
-+askmara-tcp 33:_http._tcp.example.net.
-+.fi
-+
-+Asking the server with the ip address 127.0.0.1 for the AAAA (ipv6 ip)
-+record for example.net:
-+
-+.nf
-+askmara-tcp 28:example.net.
-+.fi
-+
-+Note that the output will be a raw DNS packet in both the SRV
-+and AAAA examples.
-+.SH "BUGS"
-+.PP
-+When askmara-tcp is asked for an SOA record, the output of
-+.B "askmara-tcp"
-+closely resembles the format of a csv2 file, but can not be parsed as a
-+csv2 file without modification.
-+.PP
-+askmara-tcp outputs multi-chunk ("character-string") TXT
-+records incorrectly (it only outputs the first chunk).
-+.SH "SEE ALSO"
-+.PP
-+.B maradns(8),
-+.B askmara(1)
-+
-+.br
-+http://www.maradns.org
-+.SH "LEGAL DISCLAIMER"
-+.PP
-+THIS SOFTWARE IS PROVIDED BY THE AUTHORS \(aq\(aqAS IS\(aq\(aq AND ANY
-+EXPRESS
-+OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
-+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
-+ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE
-+LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
-+CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
-+SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
-+BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
-+WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
-+OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE,
-+EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-+.SH "AUTHOR"
-+.PP
-+MaraDNS is written by Sam Trenholme. Jaakko Niemi used 5 minutes
-+to roll this manpage together, which Sam has subsequently revised.
-+
diff --git a/net-dns/maradns/files/maradns-2.0.06-duende-man.patch b/net-dns/maradns/files/maradns-2.0.06-duende-man.patch
deleted file mode 100644
index 8e9283bc0802..000000000000
--- a/net-dns/maradns/files/maradns-2.0.06-duende-man.patch
+++ /dev/null
@@ -1,109 +0,0 @@
-Author: Nicholas Bamber <nicholas@periapt.co.uk>
-Subject: Duende man page
- We have made various changes to the duende executable and these need to
- be reflected in the Debian man page.
-Forwarded: yes
-Last-Update: 2011-07-18
---- a/doc/en/man/duende.8
-+++ b/doc/en/man/duende.8
-@@ -29,11 +29,12 @@
- makes a given child process a daemon. The standard output
- and standard error
- of the child process is logged via syslog() with a priority of
--LOG_INFO.
-+LOG_ALERT.
- .SH "USAGE"
- .PP
- .B "duende"
--child_process [ all subsequent arguments passed on to child ]
-+.RB [ options ]
-+child_process [ arguments passed onto child ]
- .SH "DETAILS"
- .PP
- When
-@@ -76,48 +77,52 @@
- duende uses a setuid() call to change the user ID of the logging
- process
- to the user with ID 66.
-+.SH "OPTIONS"
-+.PP
-+Most of the above behaviour can be configured by command line arguments.
-+.TP 4
-+.BI -c | --chroot " directory"
-+The log helper process will change its directory and root to this location.
-+This defaults to
-+.B /etc/maradns/logger "."
-+.TP 4
-+.BI -i | --ident " string"
-+The log helper process will use this string to identify the process when
-+sending messages to syslog.
-+This defaults to
-+.B log-help "."
-+.TP 4
-+.BI -p | --pid " filename"
-+If this argument is present, the duende parent process will store its pid in
-+this file.
-+.TP 4
-+.BI -u | --uid " integer"
-+The log helper process will drop its user id to this. This value defaults to
-+66.
-+.TP 4
-+.BI -g | --gid " integer"
-+The log helper process will drop its group id to this. This value defaults to
-+66.
-+.TP 4
-+.BI -r | --restart_on " integer"
-+The log helper process will restart the child process if it exists with this
-+status code. This defaults to 8.
- .SH "LOGGING"
- .PP
- .B "duende"
- uses the syslog() facility to log the standard output of the
- program that it invokes. The name of the program (in other words, the
--"ident" given to openlog()) is the full path of the first argument
--given
--to
--.BR "duende" "."
-+"ident" given to openlog()) defaults to
-+.BR "log-helper"
-+but can be overridden with the
-+.RB "--ident"
-+argument.
- All messages created by the child process are sent
--to syslog() with a priority of LOG_INFO and a "facility"
--of LOG_DAEMON (daemon.info in /etc/syslog.conf); since daemon.info
--messages are not logged by default in FreeBSD, on FreeBSD systems
--messages generated by the child process are logged with a priority of
--LOG_ALERT and a "facility" of LOG_DAEMON (daemon.alert in
--/etc/syslog.conf).
-+to syslog() with a priority of LOG_ALERT and a "facility"
-+of LOG_DAEMON (daemon.info in /etc/syslog.conf).
- Should duende itself encounter an error, it will send
- messages to syslog() with a priority of LOG_ALERT.
- .PP
--For example, suppose one invokes duende thusly:
--
--.nf
--	duende /usr/local/sbin/maradns
--.fi
--
--If invoked thusly, duende will log all messages with the "ident"
--(program
--name) of "/usr/local/sbin/maradns". If this is not desired, invoke
--duende
--with something like:
--
--.nf
--	export PATH=$PATH:/usr/local/sbin
--	duende maradns
--.fi
--
--This will log messages with a (more sensible) "ident" of maradns.
--.PP
--Note: If a non-POSIX Bourne shell (such as csh, es, rc, or fish) is
--used to
--invoke MaraDNS, the above syntax needs to be changed.
--.PP
- Also, the directory /etc/maradns/logger, while used by duende, is not
- used
- to store any log messages. That is unless, for some reason, one
diff --git a/net-dns/maradns/files/maradns-2.0.09-build.patch b/net-dns/maradns/files/maradns-2.0.09-build.patch
deleted file mode 100644
index 33622b9bc876..000000000000
--- a/net-dns/maradns/files/maradns-2.0.09-build.patch
+++ /dev/null
@@ -1,43 +0,0 @@
-Index: maradns-2.0.09/build/Makefile.linux
-===================================================================
---- maradns-2.0.09.orig/build/Makefile.linux
-+++ maradns-2.0.09/build/Makefile.linux
-@@ -10,7 +10,7 @@ POBJECTS=parse/ParseMaraRc.o parse/Parse
- DOBJECTS=dns/Queries.o dns/Compress.o dns/bobbit.o
- # Secure random number generator objects
- ROBJECTS=rng/rng-api-fst.o rng/rng-alg-fst.o
--OBJECTS=$(JOBJS) $(MHOBJS) $(SOBJECTS) $(DOBJECTS) $(POBJECTS) $(DOBJECTS) $(ROBJECTS)
-+OBJECTS=$(JOBJS) $(MHOBJS) $(SOBJECTS) $(DOBJECTS) $(POBJECTS) $(DOBJECTS) $(ROBJECTS) -lrt
- EXECS=server/maradns
- 
- # Uncomment the following three lines to get this to compile on Solaris
-@@ -28,19 +28,21 @@ Q="DEFINES=-DSELECT_PROBLEM"
- 
- # Debug
- 
--FLAGS = -O2 -Wall -DSELECT_PROBLEM
-+FLAGS=$(CFLAGS) $(LDFLAGS) -Wall -DSELECT_PROBLEM
- M="CC=$(CC) $(FLAGS)"
- D="CC=$(CC) $(FLAGS) -DDEBUG -DTHREADS"
- #FLAGS = -g
- 
- all: 
--	cd libs ; make $(M) ; cd ../dns ; make $(M) ; \
--	cd ../rng ; make $(M) ; cd ../parse ; make $(M) ; \
--	cd ../qual ; make $(M) ; cd ../server ; \
--	make $(M) $(V) COMPILED=\"$(COMPILED)\" ; \
--	cd ../tools ; make $(M) ; \
--	cd ../deadwood-*/src/ ; make FLAGS=-O2 ; \
--	cd ../../tcp ; make $(M) $(V) ; cat ../00README.FIRST
-+	$(MAKE) -C libs $(M)
-+	$(MAKE) -C dns $(M)
-+	$(MAKE) -C rng $(M)
-+	$(MAKE) -C parse $(M)
-+	$(MAKE_ -C qual $(M)
-+	$(MAKE) -C server $(M) $(V) COMPILED=\"$(COMPILED)\"
-+	$(MAKE) -C tools $(M)
-+	$(MAKE) -C deadwood-*/src $(M)
-+	$(MAKE) -C tcp $(M) $(V)
- 
- debug: 
- 	cd libs ; make $(D) DEBUG="-DDEBUG -DTHREADS" ; \
diff --git a/net-dns/maradns/maradns-2.0.09-r2.ebuild b/net-dns/maradns/maradns-2.0.09-r2.ebuild
deleted file mode 100644
index 2124be1f395b..000000000000
--- a/net-dns/maradns/maradns-2.0.09-r2.ebuild
+++ /dev/null
@@ -1,101 +0,0 @@
-# Copyright 1999-2017 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=6
-
-inherit systemd toolchain-funcs user
-
-DEADWOOD_VER="3.2.05"
-
-DESCRIPTION="A security-aware DNS server"
-HOMEPAGE="http://www.maradns.org/"
-SRC_URI="http://www.maradns.org/download/${PV%.*}/${PV}/${P}.tar.bz2"
-
-# The GPL-2 covers the init script, bug 426018.
-LICENSE="BSD-2 GPL-2"
-SLOT="0"
-KEYWORDS="amd64 ~mips ppc x86"
-IUSE="authonly examples ipv6"
-
-DEPEND=""
-RDEPEND=""
-
-PATCHES=(
-	"${FILESDIR}/${PN}-2.0.06-askmara-tcp.patch"
-	"${FILESDIR}/${PN}-2.0.06-duende-man.patch"
-	"${FILESDIR}/${P}-build.patch"
-)
-
-pkg_setup() {
-	ebegin "Creating group and users"
-	enewgroup maradns 99
-	enewuser duende 66 -1 -1 maradns
-	enewuser maradns 99 -1 -1 maradns
-	eend ${?}
-}
-
-src_configure() {
-	# Use duende-ng.c.
-	cp  "${S}/tools/duende-ng.c" "${S}/tools/duende.c" \
-		|| die "failed to rename duende-ng.c"
-
-	tc-export CC
-	./configure $(use ipv6 && echo "--ipv6") || die "Failed to configure ${PN}"
-}
-
-src_install() {
-	# Install the MaraDNS binaries.
-	dosbin server/maradns
-	dosbin tcp/zoneserver
-	dobin tcp/getzone tcp/fetchzone
-	dobin tools/askmara tools/askmara-tcp tools/duende
-	dobin tools/bind2csv2.py tools/csv1tocsv2.pl
-
-	# MaraDNS docs, manpages, misc.
-	dodoc doc/en/{QuickStart,README,*.txt}
-	dodoc doc/en/text/*.txt
-	doman doc/en/man/*.[1-9]
-	dodoc maradns.gpg.key
-	dodoc doc/en/*.html
-	dodoc -r doc/en/webpage
-	dodoc -r doc/en/tutorial
-	if use examples ; then
-		docinto examples
-		dodoc doc/en/examples/example_*
-	fi
-
-	# Deadwood binary, docs, manpages, etc.
-	if ! use authonly; then
-		dosbin deadwood-${DEADWOOD_VER}/src/Deadwood
-		doman deadwood-${DEADWOOD_VER}/doc/{Deadwood,Duende}.1
-		docinto deadwood
-		dodoc deadwood-${DEADWOOD_VER}/doc/{Deadwood,Duende,FAQ}.txt
-		dodoc deadwood-${DEADWOOD_VER}/doc/{Deadwood,FAQ}.html
-		docinto deadwood/internals
-		dodoc deadwood-${DEADWOOD_VER}/doc/internals/*
-		insinto /etc/maradns
-		newins deadwood-${DEADWOOD_VER}/doc/dwood3rc-all dwood3rc_all.dist
-	fi
-
-	# Example configurations.
-	insinto /etc/maradns
-	newins doc/en/examples/example_full_mararc mararc_full.dist
-	newins doc/en/examples/example_csv2 example_csv2.dist
-	keepdir /etc/maradns/logger
-
-	# Init scripts.
-	newinitd "${FILESDIR}"/maradns2 maradns
-	newinitd "${FILESDIR}"/zoneserver2 zoneserver
-	if ! use authonly; then
-		newinitd "${FILESDIR}"/deadwood deadwood
-	fi
-
-	# systemd unit
-	# please keep paths in sync!
-	sed -e "s^@bindir@^${EPREFIX}/usr/sbin^" \
-		-e "s^@sysconfdir@^${EPREFIX}/etc/maradns^" \
-		"${FILESDIR}"/maradns.service.in > "${T}"/maradns.service \
-		|| die "failed to create the maradns.service file (sed)"
-
-	systemd_dounit "${T}"/maradns.service
-}
diff --git a/net-dns/maradns/maradns-2.0.14.ebuild b/net-dns/maradns/maradns-3.5.0005.ebuild
index 8d0ca3ee8416..049cb0ac80e3 100644
--- a/net-dns/maradns/maradns-2.0.14.ebuild
+++ b/net-dns/maradns/maradns-3.5.0005.ebuild
@@ -1,45 +1,32 @@
-# Copyright 1999-2017 Gentoo Foundation
+# Copyright 1999-2020 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
-EAPI=6
+EAPI=7
 
-PYTHON_COMPAT=( python2_7 )
+PYTHON_COMPAT=( python3_{6,7,8} )
 
-inherit python-single-r1 systemd toolchain-funcs user
-
-DEADWOOD_VER="3.2.10"
+inherit systemd toolchain-funcs python-any-r1
 
 DESCRIPTION="A security-aware DNS server"
 HOMEPAGE="http://www.maradns.org/"
-SRC_URI="http://www.maradns.org/download/${PV%.*}/${PV}/${P}.tar.bz2"
+SRC_URI="https://maradns.samiam.org/download/${PV%.*}/${PV}/${P}.tar.xz"
 
 # The GPL-2 covers the init script, bug 426018.
 LICENSE="BSD-2 GPL-2"
 SLOT="0"
 KEYWORDS="~amd64 ~mips ~ppc ~x86"
-IUSE="authonly examples ipv6"
-REQUIRED_USE="${PYTHON_REQUIRED_USE}"
+IUSE="examples ipv6"
 
 DEPEND="${PYTHON_DEPS}"
 RDEPEND="${DEPEND}
+	acct-user/maradns
+	acct-group/maradns
+	acct-user/duende
 	dev-lang/perl"
 
-pkg_setup() {
-	ebegin "Creating group and users"
-	enewgroup maradns 99
-	enewuser duende 66 -1 -1 maradns
-	enewuser maradns 99 -1 -1 maradns
-	eend ${?}
-
-	python-single-r1_pkg_setup
-}
-
 src_prepare() {
 	default
 
-	# Use duende-ng.c.
-	cp  tools/duende{,-ng}.c \
-		|| die "failed to rename duende-ng.c"
 	# replace "make" by "$(MAKE)" to avoid GNU Make warning
 	sed -i 's/\ make\ /\ \$\(MAKE\)\ /g' build/Makefile.linux \
 		|| die "can't patch build/Makefile.linux"
@@ -56,9 +43,7 @@ src_install() {
 	# Install the MaraDNS and Deadwood binaries
 	dosbin server/maradns
 	dosbin tcp/zoneserver
-	if ! use authonly; then
-		dosbin deadwood-${DEADWOOD_VER}/src/Deadwood
-	fi
+	dosbin deadwood-${PV}/src/Deadwood
 	dobin tcp/{getzone,fetchzone}
 	dobin tools/{askmara,askmara-tcp,duende,bind2csv2.py,csv1tocsv2.pl}
 
@@ -66,11 +51,9 @@ src_install() {
 	dodoc doc/en/{QuickStart,README,*.txt,*.html}
 	dodoc -r doc/en/{text,webpage,tutorial}
 	dodoc maradns.gpg.key
-	if ! use authonly; then
-		docinto deadwood
-		dodoc deadwood-${DEADWOOD_VER}/doc/{*.txt,*.html,CHANGELOG,Deadwood-HOWTO}
-		dodoc -r deadwood-${DEADWOOD_VER}/doc/internals
-	fi
+	docinto deadwood
+	dodoc deadwood-${PV}/doc/{*.txt,*.html,CHANGELOG,Deadwood-HOWTO}
+	dodoc -r deadwood-${PV}/doc/internals
 
 	# Install examples (optional)
 	if use examples ; then
@@ -80,25 +63,19 @@ src_install() {
 
 	# Install manpages
 	doman doc/en/man/*.[1-9]
-	if ! use authonly; then
-		doman deadwood-${DEADWOOD_VER}/doc/{Deadwood,Duende}.1
-	fi
+	doman deadwood-${PV}/doc/{Deadwood,Duende}.1
 
 	# Example configurations.
 	insinto /etc/maradns
 	newins doc/en/examples/example_full_mararc mararc_full.dist
 	newins doc/en/examples/example_csv2 example_csv2.dist
-	if ! use authonly; then
-		newins deadwood-${DEADWOOD_VER}/doc/dwood3rc-all dwood3rc_all.dist
-	fi
+	newins deadwood-${PV}/doc/dwood3rc-all dwood3rc_all.dist
 	keepdir /etc/maradns/logger
 
 	# Init scripts.
 	newinitd "${FILESDIR}"/maradns2 maradns
 	newinitd "${FILESDIR}"/zoneserver2 zoneserver
-	if ! use authonly; then
-		newinitd "${FILESDIR}"/deadwood deadwood
-	fi
+	newinitd "${FILESDIR}"/deadwood deadwood
 
 	# systemd unit
 	# please keep paths in sync!
diff --git a/net-dns/maradns/metadata.xml b/net-dns/maradns/metadata.xml
index 08d29c2b89ac..1989b4903ef9 100644
--- a/net-dns/maradns/metadata.xml
+++ b/net-dns/maradns/metadata.xml
@@ -2,6 +2,10 @@
 <!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
 <pkgmetadata>
     <maintainer type="person">
+        <email>slashbeast@gentoo.org</email>
+        <name>Piotr Karbowski</name>
+    </maintainer>
+    <maintainer type="person">
         <email>ktrace@yandex.ru</email>
         <name>Victor Kustov</name>
     </maintainer>
diff --git a/net-dns/pdns-recursor/Manifest b/net-dns/pdns-recursor/Manifest
index 37a8a9bafd45..f18b744e42af 100644
--- a/net-dns/pdns-recursor/Manifest
+++ b/net-dns/pdns-recursor/Manifest
@@ -2,6 +2,8 @@ AUX pdns-recursor-4.3.1-boost-1.73.0.patch 4563 BLAKE2B 81f5f33939f9937b78235c3f
 AUX pdns-recursor-4.3.1-gcc-10.patch 2592 BLAKE2B da68e0311a30ba894cfa82b1140dca85b2547cc0885d9fec6dd0721c38f531777e06d27ede7bdc92996e60bfb621351bab66c1ce19cc923f8fc3b1b44a4bde05 SHA512 16a81afc5a3a7cdac4acee52b30ff61cea97ef1c543fc0858897c2caa19fedd1e71f9787c4674122ee7f96d4130d6b5f37b0cdcc6bcd44d14765845877c02ab4
 AUX pdns-recursor-r2 1251 BLAKE2B 391f52b9c9b8ee1d01ca57b5e73106f350f474e12c5ca957cfe857a0a8f672a1347393d15c343601769ce58fc12034833fb5f012f7ae7b1d41d76d493be5ca71 SHA512 a607ac4e6edb095d7d097e255779ea574191793bbbdce1df7113e17dc777dfd8929a9332fc6cd4e98b59fe826e020efcf35a011ff4cef70433117fab4998584c
 DIST pdns-recursor-4.3.1.tar.bz2 1334817 BLAKE2B 1972259e42b1cefd9069a36d2bb235652ce234d525a2e3f19c96a93bf26f34063e6d04240146bba0560573c1d2ad042a579d6ab557fc7ac0aadee09fa15ee397 SHA512 49ae4957ef202f94ec87e6449dfa9c147689b5576ca1002e0155319099d698300c113e221571f6d41cb1cdc1649619621c2ccf8105620c25452ac30bd83e46b8
+DIST pdns-recursor-4.3.2.tar.bz2 1354549 BLAKE2B 253f9a6ec3b7bfb4d3a97953c9f65458b479bdaa20fcc28d980a1cf4c1f15f80ad35251687bb5410f14268be79de4bbcec8bc36663a0a8eb51894fa6e4242547 SHA512 d1ca566dc8785fda3764838a0ea598acc4106b6261ebdbbe43fc6a6e4a82c375f7ef3f6d23fbd9b216067eb9cf56fcae6d460bfc7957ba4c201d466ad15d75d7
 EBUILD pdns-recursor-4.3.1-r1.ebuild 1976 BLAKE2B 349a1e9ece84876f4942fbd71e2a4627e10ae2095794540ed8537314d614d9cbc3705d889493c188acb73583d144fc4afa8cdb15c71b0b557d99d0b96dd58a37 SHA512 87ec69617de53ee96947d566475753499f0997a5597e8e48ebbc84e2dcd10992e5bb920980c4567fd68c9d02aa75d855f73feaa990d68720196b828fbcadc5f8
 EBUILD pdns-recursor-4.3.1.ebuild 1871 BLAKE2B 41b5d33da55a8a0fabfd0d69666ad23a7104f10343d10bc949b269596ed8238f9c9cd3f573a2a026f876046fce42cf7787ac264cf1fe69bd8822c8605a19c544 SHA512 26fca6db80aa43334985e27161a64a893d150f0e746fe0bb834b5341096f0eed79524c432b8b95ad06bce152ef65fcc76b7befc4a2dd100729b7ffa077c0471e
+EBUILD pdns-recursor-4.3.2.ebuild 1950 BLAKE2B 3d4ca29820d37d1bd97f1d247a2384a4cbc59747eccec10d8851fc12dba7401fb4a0b2b5cb0995205d9c69e9cde11e28ac927923f82e9341c4f920c88827cf2c SHA512 b2c36166659af410264681fc2c0c55e258bf6c03bff1a95f7917f8da709f20a7606a89de2a886eb240f7be7b190036e76505c5a094ff50367e140961736e0d31
 MISC metadata.xml 1008 BLAKE2B 1c82fd9262358bcf1ff0f8503bc8dfe9b640023133ca48711bc576df00312312b5e37a36ff10aac561ef1c71e20f64c5f0a4c431c60ca029220732fba0ee1bf9 SHA512 2deab5a88c42d3416b3da5b6d9d3ed9b2db0a5dcb3d8b7fc4c7a13b2219fd7df786bfef42ff5e3d7c2b40058592e892f380d126a0254013534e66e65499e7105
diff --git a/net-dns/pdns-recursor/pdns-recursor-4.3.2.ebuild b/net-dns/pdns-recursor/pdns-recursor-4.3.2.ebuild
new file mode 100644
index 000000000000..cb9a0daba0e2
--- /dev/null
+++ b/net-dns/pdns-recursor/pdns-recursor-4.3.2.ebuild
@@ -0,0 +1,85 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+inherit flag-o-matic
+
+DESCRIPTION="The PowerDNS Recursor"
+HOMEPAGE="https://www.powerdns.com/"
+SRC_URI="https://downloads.powerdns.com/releases/${P/_/-}.tar.bz2"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~x86"
+IUSE="debug dnstap libressl luajit protobuf snmp sodium systemd"
+REQUIRED_USE="dnstap? ( protobuf )"
+
+DEPEND="!luajit? ( >=dev-lang/lua-5.1:= )
+	luajit? ( dev-lang/luajit:= )
+	protobuf? (
+		dev-libs/protobuf
+		>=dev-libs/boost-1.42:=
+	)
+	dnstap? ( dev-libs/fstrm )
+	systemd? ( sys-apps/systemd:0= )
+	snmp? ( net-analyzer/net-snmp )
+	sodium? ( dev-libs/libsodium:= )
+	libressl? ( dev-libs/libressl:= )
+	!libressl? ( dev-libs/openssl:= )
+	>=dev-libs/boost-1.35:="
+RDEPEND="${DEPEND}
+	!<net-dns/pdns-2.9.20-r1
+	acct-user/pdns
+	acct-group/pdns"
+BDEPEND="virtual/pkgconfig"
+
+S="${WORKDIR}"/${P/_/-}
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-4.3.1-boost-1.73.0.patch
+)
+
+pkg_setup() {
+	filter-flags -ftree-vectorize
+}
+
+src_configure() {
+	econf \
+		--sysconfdir=/etc/powerdns \
+		--with-lua=$(usex luajit luajit lua) \
+		$(use_enable debug verbose-logging) \
+		$(use_enable systemd) \
+		$(use_enable dnstap dnstap) \
+		$(use_with sodium libsodium) \
+		$(use_with protobuf) \
+		$(use_with snmp net-snmp)
+}
+
+src_install() {
+	default
+
+	mv "${D}"/etc/powerdns/recursor.conf{-dist,}
+
+	# set defaults: setuid=nobody, setgid=nobody
+	sed -i \
+		-e 's/^# set\([ug]\)id=$/set\1id=pdns/' \
+		-e 's/^# quiet=$/quiet=on/' \
+		-e 's/^# chroot=$/chroot=\/var\/lib\/powerdns/' \
+		"${D}"/etc/powerdns/recursor.conf
+
+	newinitd "${FILESDIR}"/pdns-recursor-r2 pdns-recursor
+}
+
+pkg_postinst() {
+	local old
+
+	for old in ${REPLACING_VERSIONS}; do
+		ver_test ${old} -lt 4.0.0-r1 || continue
+
+		ewarn "Starting with 4.0.0-r1 the init script has been renamed from precursor"
+		ewarn "to pdns-recursor, please update your runlevels accordingly."
+
+		break
+	done
+}