gentoo resync : 02.03.2018

13 files changed, 214 insertions, 13 deletions

diff --git a/net-dns/Manifest.gz b/net-dns/Manifest.gz
index 836102789f23..8b7855ee3690 100644
--- a/net-dns/Manifest.gz
+++ b/net-dns/Manifest.gz
diff --git a/net-dns/dnscrypt-proxy/Manifest b/net-dns/dnscrypt-proxy/Manifest
index 5fb3af60ed7e..972eb0bd024c 100644
--- a/net-dns/dnscrypt-proxy/Manifest
+++ b/net-dns/dnscrypt-proxy/Manifest
@@ -9,6 +9,8 @@ AUX dnscrypt-proxy.service-r2 581 BLAKE2B 1d873041005135b5ca01aa2b24f373056a4281
 AUX dnscrypt-proxy.socket-r1 152 BLAKE2B e4eb7875f749646f77675b39c7c74f57d5674d825329891b0f128e190ac3625d28f81df8004975828080c6eb9665a8c0825826b5ccf305694c03c2e196da3dd7 SHA512 920014c202344726e645f3bfa5def0f194c215cc0ce6e45750e82cee3434399497b9ad3fb5268afb1823689ced0fa8d177d6411b3153661b97fbd55984752a87
 DIST dnscrypt-proxy-1.9.5.tar.bz2 1290573 BLAKE2B 8f16fdb58012e00a8b58d36364377c3bc25158b9484a8df2bd6bc98d1c9cbf5ac758997e31f95ecaeb9da2f6b7272316c5a4a1c069a39549fbc1c1b136857da0 SHA512 84c0f7587521b3a198292cf20dd71cb592ccf8a9e003abbc62c5ca112f6c5ed27c49b1642cf91f403d52b4147e25f24af540b65cecfcf93814338329097df836
 DIST dnscrypt-proxy-2.0.0.tar.gz 725490 BLAKE2B d4c116f81d304b9b3a883ba6b414e2fef810f50ecea9a9175246d02f2755c3e11c9940fed0dfc221e419820e001abc74e4bf4478abb2222b548461ad09f3f57d SHA512 c87420c09fc45496901b0c21ae972283f05c508b07249450de504ba5e287128c2c5e0f772b181ddb2f6478cb6d66e72617e3b0679f47f3b15dde80c92d2ef7ba
+DIST dnscrypt-proxy-2.0.4.tar.gz 727969 BLAKE2B 80f29fbc150f8731dce0ab0af8f4282264b19fade73846f972bd0e762bfe4ebd1a0f014fb6fad860623377c833c099f1d50d8ab7ccd8cecb7e210a422d96ea99 SHA512 ba8f419c85b3ccd0bdd930404c3781f1cadf58dcacb30bf35c3be0933887a6dc910496424cb3847ef2630b8205794cef03d980ac82605faca38c6bfd58b213be
 EBUILD dnscrypt-proxy-1.9.5-r1.ebuild 1817 BLAKE2B bb0c48cadf271b942beeaee69c49dbb2582c41f86176b84c6e929ad5dd5b55deacfa03d15143b2180d05ab03913a93702315712afc73bbbea53b152e43ab30f8 SHA512 87a35841daf4da9b666bae888f9b73fa7205f9e7054afe5bdc47d1112525e2eb1237416fa7702c38bc63ce0878fc61d752f6851af1cc07a0f9b5a3591b8f0704
 EBUILD dnscrypt-proxy-2.0.0.ebuild 2443 BLAKE2B feac451a5a8d24cb959a2d354b5cf2176cb34bc8c4ceaf89b060aa693a541fc281f81873018fad3b87fd5a321fdaa5b59d4874ce5b338482fad05d6b925b5cb9 SHA512 9a3d7f347be49204bd2893be27a7ceb558a469b8dd941543a4891b1e70bdbf268fa504cac2e74fa17e61c092b0c1f13a40ee292a5f4c4132d2cec9dcf39baeda
+EBUILD dnscrypt-proxy-2.0.4.ebuild 2443 BLAKE2B feac451a5a8d24cb959a2d354b5cf2176cb34bc8c4ceaf89b060aa693a541fc281f81873018fad3b87fd5a321fdaa5b59d4874ce5b338482fad05d6b925b5cb9 SHA512 9a3d7f347be49204bd2893be27a7ceb558a469b8dd941543a4891b1e70bdbf268fa504cac2e74fa17e61c092b0c1f13a40ee292a5f4c4132d2cec9dcf39baeda
 MISC metadata.xml 967 BLAKE2B f423ce552f42f2f3cdcbe71a711104c34eb90b7cf75b6d60b324b1ce239cc34d13845971b9808b9ad19e3bd76c89d1bb3b2a5c3d53d33afafff7fa7009a01427 SHA512 7c2bab8a27a9bc8d8401867a2ec6e84928cf7520422604282e88db4dcba4003d675a457ce0225f67f7385baede7953b2d531b2ab68d7e6b016f1e7c5e0e5fdfd
diff --git a/net-dns/dnscrypt-proxy/dnscrypt-proxy-2.0.4.ebuild b/net-dns/dnscrypt-proxy/dnscrypt-proxy-2.0.4.ebuild
new file mode 100644
index 000000000000..5e497f135323
--- /dev/null
+++ b/net-dns/dnscrypt-proxy/dnscrypt-proxy-2.0.4.ebuild
@@ -0,0 +1,88 @@
+# Copyright 1999-2018 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=6
+
+EGO_PN="github.com/jedisct1/${PN}"
+
+inherit fcaps golang-build systemd user
+
+DESCRIPTION="A flexible DNS proxy, with support for encrypted DNS protocols"
+HOMEPAGE="https://github.com/jedisct1/dnscrypt-proxy"
+SRC_URI="https://${EGO_PN}/archive/${PV}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="ISC"
+SLOT="0"
+KEYWORDS="~amd64 ~x86"
+
+FILECAPS=( cap_net_bind_service+ep usr/bin/dnscrypt-proxy )
+PATCHES=( "${FILESDIR}"/config-full-paths-r2.patch )
+
+pkg_setup() {
+	enewgroup dnscrypt
+	enewuser dnscrypt -1 -1 /var/empty dnscrypt
+}
+
+src_compile() {
+	# Create directory structure suitable for building
+	mkdir -p "src/${EGO_PN%/*}" || die
+	mv "${PN}" "src/${EGO_PN}" || die
+	mv "vendor" "src/" || die
+	golang-build_src_compile
+}
+
+src_install() {
+	dobin dnscrypt-proxy
+
+	insinto /etc/dnscrypt-proxy
+	newins "src/${EGO_PN}"/example-dnscrypt-proxy.toml dnscrypt-proxy.toml
+	doins "src/${EGO_PN}"/example-{blacklist.txt,cloaking-rules.txt,forwarding-rules.txt}
+
+	insinto "/usr/share/dnscrypt-proxy"
+	doins -r "utils/generate-domains-blacklists/."
+
+	newinitd "${FILESDIR}"/dnscrypt-proxy.initd-r2 dnscrypt-proxy
+	newconfd "${FILESDIR}"/dnscrypt-proxy.confd-r2 dnscrypt-proxy
+	systemd_newunit "${FILESDIR}"/${PN}.service-r2 dnscrypt-proxy.service
+	systemd_dounit systemd/dnscrypt-proxy.socket
+
+	keepdir /var/log/dnscrypt-proxy
+
+	einstalldocs
+}
+
+pkg_postinst() {
+	fcaps_pkg_postinst
+
+	if ! use filecaps; then
+		ewarn "'filecaps' USE flag is disabled"
+		ewarn "${PN} will fail to listen on port 53 if started via OpenRC"
+		ewarn "please either change port to > 1024, configure to run ${PN} as root"
+		ewarn "or re-enable 'filecaps'"
+		ewarn
+	fi
+
+	local v
+	for v in ${REPLACING_VERSIONS}; do
+		if [[ ${v} == 1.* ]] ; then
+			elog "Version 2.x.x is a complete rewrite of ${PN}"
+			elog "please clean up old config/log files"
+			elog
+		fi
+	done
+
+	if systemd_is_booted || has_version sys-apps/systemd; then
+		elog "To use systemd socket activation with ${PN} you must"
+		elog "set listen_addresses setting to \"[]\" in the config file"
+		elog "Edit ${PN}.socket if you need to change port and address"
+		elog
+	fi
+
+	elog "After starting the service you will need to update your"
+	elog "/etc/resolv.conf and replace your current set of resolvers"
+	elog "with:"
+	elog
+	elog "nameserver 127.0.0.1"
+	elog
+	elog "Also see https://github.com/jedisct1/${PN}/wiki"
+}
diff --git a/net-dns/idnkit/Manifest b/net-dns/idnkit/Manifest
index 185c40c58078..f15968aa382f 100644
--- a/net-dns/idnkit/Manifest
+++ b/net-dns/idnkit/Manifest
@@ -1,4 +1,8 @@
 AUX idnkit-1.0-autotools.patch 1843 BLAKE2B 75043eeccb34f00b9faab57d7db7ec6081192090afa4438e83df7bf02dc5ae047c4597153649aa0d4b1f658a37809687d91602d2ce61bf8cc7b3e878ed21b993 SHA512 1c405d1b72d678394284936d9130450b366f7a53bdf586fb6d4331b72c2d6672a19f2322a7f284067259ed0c0dd973865d9b117ae6c15cc8a1d41c734ef0a4ce
+AUX idnkit-1.0-test-subdirs.patch 289 BLAKE2B 6c9237cd1d17785a5d0a379d610ddc6b6e7b604c14a5680e24b80f5d9188413fe4e8f5dbbc55e72fe5d4c453c94efd231110238f68ced316986abeb6134f8173 SHA512 63d76f9ad95fc83c00259d41dcfdd47442bfda6f1dfe861a824146ded113d18284c1fe6f0f5ff1eba05a9a38055e7e8fdc3579fc14a3b441d831a9bd5b75af7a
+AUX idnkit-2.3-log_h.patch 734 BLAKE2B 696ebd7daeca2c3ff3c5103c54a0bb566a62e5eaba669bc35be2891cb100fc24b532fdb6309ba90c5a2261e1b6cbd522d9e8b535c4dfa96053d151f5a938cc35 SHA512 96e61794c0dbd9b36f65d367930c326722ff362d2335e3b734a205e957031ea4d3cb8c60f0feccb9b646f9cabf045b7d340366b32bf6ea52d7a753867f71935b
 DIST idnkit-1.0-src.tar.gz 432823 BLAKE2B 4e96bed174ea704ec0eb5c6655cb65145ed808b2bf9582ec9b6dcb8606de7a006937a2f8d8fce386dbc328e074b95ca504464c1ed6d16acc7be82d9904f2c2b4 SHA512 74f2db007a1991610f62a7a060d534f724f08395a16a7d76fda0824e9017aa47ffe4e251c90d0481218b70534fcd2b32724a66223042f59c1e16c1ff39f3be19
-EBUILD idnkit-1.0-r2.ebuild 1000 BLAKE2B 350bf38bada2873a943099d1142ba5025d1d7ebacf069c1ae622c004168772afd4f20f07c5d0bd4e6fab14a073d32ce150af7ed01707a985052dfb04e22bc28b SHA512 36b1fde9ab9b026e168cb5cc1a012404b9c0e408b8fd20073620fd14dc8fa234da14bd8526eff847ca86c2029b576312cf5f23a4f16c36bf1a0cb2e7834b49fe
-MISC metadata.xml 244 BLAKE2B 9c6750147c240d7416fad33e04b53730dc89cbb615648a7f3defeed3ec058aeee6dbed55a1f81241417b42ca9f7daec177c725692166a5ba08765b5dcf5a6bc5 SHA512 1da71f4fae0251c97a8fcfa1e13b0a3f8b95a856fa919ebd30bf4f2f1b8fa900841db09ebc2a0ae9fe0d91f786ac40b63290382668412fcb05bca15b0746f1db
+DIST idnkit-2.3.tar.bz2 1473267 BLAKE2B efc2a93527c217b32bfd0e2546944b30d39c3fa046e17c11f2084721f966dc838bfa821c88378c0604cbeafb8d4970cf3c19122182448d5e48c2d392a42225c6 SHA512 a0cbc111d4b7d5f444c9b79ae76378fd2edf18097adca27d5ebf811e12091f609ec45d2c62a95b1e295bd1fa644bd8a38d79841f7f4e85dcd1f6a1cd5ca622e4
+EBUILD idnkit-1.0-r2.ebuild 1058 BLAKE2B 11b1bd1d8baa95dfa3483fe482938a37871cb347bcff34943554a7c490af71fba29a457acb8dd5f97237ec8685599c6e187a3c088db4d32d218a09d2ee2972f1 SHA512 03a7a1c838acf7c90bec72ecbdd6901bc97cbc9d8ed85c6180329f2672f7e4a0cdd941d64384fbddc6697e5976f849f3f5cd428e347df47f969431bd4db00270
+EBUILD idnkit-2.3.ebuild 677 BLAKE2B d29b3a45d31ae32c7f4a7c7c1429f9ada5c773cd6a8f25a31ca8eebd7ecb3cb74039bcfb70503f8ac66a9fd99a4082cf3f954293290097b34b4694acff76ef60 SHA512 0d5c735a42161587ccd56a2917b0647d153ca72a7eee712cd070f27c31c80ae02d8fc8722ff0a49ceedf2c24b08c7f9746b5e593b10a081bd3f799a846d3df44
+MISC metadata.xml 290 BLAKE2B 9b8f414f2eb140cd1c4c9b290bbd4f3d36e58649b68a9ed478ba55661df34bd1f8e1ea9c6d132e2edc4365bb8d4abd5f78d9b0f24e588d548354f63057da0b78 SHA512 5ae703d1a74d5fe45ac66f8f4922b754999932112931b8ba1f46d4a2e769a5d7130b4a418bf687d857a89f20e287d85e384236848c0e01747d0aa1c1ea350492
diff --git a/net-dns/idnkit/files/idnkit-1.0-test-subdirs.patch b/net-dns/idnkit/files/idnkit-1.0-test-subdirs.patch
new file mode 100644
index 000000000000..3e6dcf13b15e
--- /dev/null
+++ b/net-dns/idnkit/files/idnkit-1.0-test-subdirs.patch
@@ -0,0 +1,10 @@
+--- a/lib/Makefile.in
++++ b/lib/Makefile.in
+@@ -296,6 +296,7 @@
+ 	rm -f Makefile
+ 
+ test check: test-localdir test-subdirs
++test-subdirs: test-localdir
+ 
+ @LITEONLY_TRUE@test-localdir: $(TESTLITELIB).la $(SAMPLES)
+ @LITEONLY_FALSE@test-localdir: $(TESTLIB).la $(TESTLITELIB).la $(SAMPLES)
diff --git a/net-dns/idnkit/files/idnkit-2.3-log_h.patch b/net-dns/idnkit/files/idnkit-2.3-log_h.patch
new file mode 100644
index 000000000000..975ea0b58dbf
--- /dev/null
+++ b/net-dns/idnkit/files/idnkit-2.3-log_h.patch
@@ -0,0 +1,38 @@
+net-dns/bind-tools uses idn/log.h
+
+--- a/include/Makefile.am
++++ b/include/Makefile.am
+@@ -1,6 +1,7 @@
+ nobase_include_HEADERS = \
+ 	idn/api.h \
+ 	idn/export.h \
++	idn/log.h \
+ 	idn/res.h \
+ 	idn/resconf.h \
+ 	idn/result.h
+@@ -22,7 +23,6 @@
+ 	idn/langlocalmap.h \
+ 	idn/localconverter.h \
+ 	idn/localencoding.h \
+-	idn/log.h \
+ 	idn/logmacro.h \
+ 	idn/lowercasemap.h \
+ 	idn/maplist.h \
+--- a/include/Makefile.in
++++ b/include/Makefile.in
+@@ -226,6 +226,7 @@
+ nobase_include_HEADERS = \
+	idn/api.h \
+	idn/export.h \
++	idn/log.h \
+	idn/res.h \
+	idn/resconf.h \
+	idn/result.h
+@@ -247,7 +248,6 @@
+	idn/langlocalmap.h \
+	idn/localconverter.h \
+	idn/localencoding.h \
+-	idn/log.h \
+	idn/logmacro.h \
+	idn/lowercasemap.h \
+	idn/maplist.h \
diff --git a/net-dns/idnkit/idnkit-1.0-r2.ebuild b/net-dns/idnkit/idnkit-1.0-r2.ebuild
index b6ea6ce3499f..d49a09a1fa6f 100644
--- a/net-dns/idnkit/idnkit-1.0-r2.ebuild
+++ b/net-dns/idnkit/idnkit-1.0-r2.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2015 Gentoo Foundation
+# Copyright 1999-2018 Gentoo Foundation
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI="5"
@@ -11,7 +11,7 @@ SRC_URI="http://www.nic.ad.jp/ja/idn/idnkit/download/sources/${P}-src.tar.gz"
 
 LICENSE="JNIC"
 SLOT="0"
-KEYWORDS="alpha amd64 arm arm64 hppa ia64 m68k ~mips ppc ppc64 s390 sh sparc x86 ~x86-fbsd"
+KEYWORDS="alpha amd64 arm arm64 hppa ia64 m68k ~mips ppc ppc64 s390 sh sparc x86 ~amd64-fbsd ~x86-fbsd"
 IUSE="static-libs"
 
 DEPEND="virtual/libiconv"
@@ -21,7 +21,8 @@ S=${WORKDIR}/${P}-src
 src_prepare() {
 	# Bug 263135, old broken libtool bundled
 	rm -f aclocal.m4 || die "rm failed"
-	epatch "${FILESDIR}/${P}-autotools.patch"
+	epatch "${FILESDIR}"/${P}-autotools.patch
+	epatch "${FILESDIR}"/${P}-test-subdirs.patch
 	mv configure.{in,ac} || die
 	eautoreconf
 }
diff --git a/net-dns/idnkit/idnkit-2.3.ebuild b/net-dns/idnkit/idnkit-2.3.ebuild
new file mode 100644
index 000000000000..6935a9252545
--- /dev/null
+++ b/net-dns/idnkit/idnkit-2.3.ebuild
@@ -0,0 +1,35 @@
+# Copyright 1999-2018 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=6
+inherit ltprune
+
+DESCRIPTION="Toolkit for Internationalized Domain Names (IDN)"
+HOMEPAGE="https://jprs.co.jp/idn/"
+SRC_URI="${HOMEPAGE}${P}.tar.bz2"
+
+LICENSE="JPRS"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~amd64-fbsd ~x86-fbsd"
+IUSE="liteonly static-libs"
+DEPEND="
+	virtual/libiconv
+"
+RDEPEND="
+	${DEPEND}
+"
+PATCHES=(
+	"${FILESDIR}"/${PN}-2.3-log_h.patch
+)
+
+src_configure() {
+	econf \
+		$(use_enable static-libs static) \
+		$(use_enable liteonly)
+}
+
+src_install() {
+	default
+
+	prune_libtool_files
+}
diff --git a/net-dns/idnkit/metadata.xml b/net-dns/idnkit/metadata.xml
index f8bd6f3f34f9..568bd4ccbd6d 100644
--- a/net-dns/idnkit/metadata.xml
+++ b/net-dns/idnkit/metadata.xml
@@ -1,8 +1,10 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
 <pkgmetadata>
-	<maintainer type="person">
-		<email>jer@gentoo.org</email>
-		<name>Jeroen Roovers</name>
-	</maintainer>
+<maintainer type="person">
+<email>jer@gentoo.org</email>
+</maintainer>
+<use>
+<flag name="liteonly">Compile and install lite library only</flag>
+</use>
 </pkgmetadata>
diff --git a/net-dns/libidn2/Manifest b/net-dns/libidn2/Manifest
index 1759a383d5d1..37b4777df0ea 100644
--- a/net-dns/libidn2/Manifest
+++ b/net-dns/libidn2/Manifest
@@ -1,3 +1,3 @@
 DIST libidn2-2.0.4.tar.gz 2008524 BLAKE2B 7163e1eff498031c7433911533b34d993876b55d9b324aaef39c93db2cceee78dec4c8cfbf4d9dabd1dbbb03a8cbd65021f26a94758f57b32ef98dc869f744b6 SHA512 1e51bd4b8f8907531576291f1c2a8865d17429b4105418b4c98754eb982cd1cbb3adbeab4ec0c1c561d2dba11d876c7c09e5dc5b315c55a2c24986d7a2a3b4d2
-EBUILD libidn2-2.0.4.ebuild 1225 BLAKE2B cf892b9ec857ba33fec9429c542a9966529e407d80616853c8eeb4f16f4d455b8055606db3977f26bee3c1d46bb89c83c0631fe72bae43bb460de149519ba6ba SHA512 1d60bacd4a970e7f64400df81b24dda49fe8f1aca36cb8b8412be5c905076661ff88e198346f2933b7e71bc55049ed9275ea227067c0cc89f7ead13f1e9306f6
+EBUILD libidn2-2.0.4.ebuild 1237 BLAKE2B d0b1a78213888d195af827682340c16836fab292650cc904554e3bacba9e8b2e751b485ba2a7413b8a638bf64203849a2c49426e388d22eaaabd1db6f7c6cdca SHA512 66e24dc0ae01d8009783c0cc1722bbcbc73baf4a2a4332f35902f75c73bd7b9a3c05c752833b32e5e75ffc2b6c3b923572962b6d22777efdf21a44e66ec693fe
 MISC metadata.xml 210 BLAKE2B bb9591af5406abbf589664053ab6e5cb38933fe6ef97c11609405392b050b26cff8e94e04e85e5798124abd46283bee67b2a74923a5041616df15aaa9cff6da9 SHA512 f7cbe57a24b67a28696f91061ad8bd61d7d4cf3d59d20c3dcc6a4921e29672d00ecf3ece70a8813399d2467ebd626f8f829300e81fc722e9aaa527e213a5fb54
diff --git a/net-dns/libidn2/libidn2-2.0.4.ebuild b/net-dns/libidn2/libidn2-2.0.4.ebuild
index 465abcdfd360..419d4b44dff5 100644
--- a/net-dns/libidn2/libidn2-2.0.4.ebuild
+++ b/net-dns/libidn2/libidn2-2.0.4.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2017 Gentoo Foundation
+# Copyright 1999-2018 Gentoo Foundation
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=6
@@ -12,7 +12,7 @@ SRC_URI="
 
 LICENSE="GPL-2+ LGPL-3+"
 SLOT="0"
-KEYWORDS="alpha amd64 arm arm64 hppa ia64 m68k ~mips ppc ppc64 s390 sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="alpha amd64 arm arm64 hppa ia64 m68k ~mips ppc ppc64 s390 sh sparc x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
 IUSE="static-libs"
 
 RDEPEND="
diff --git a/net-dns/unbound/Manifest b/net-dns/unbound/Manifest
index 3c053a2fd95a..4396f2c7c7fe 100644
--- a/net-dns/unbound/Manifest
+++ b/net-dns/unbound/Manifest
@@ -20,6 +20,6 @@ EBUILD unbound-1.6.3.ebuild 3669 BLAKE2B b56cdd1dd673807593d2b8b99a96c4ae43333b6
 EBUILD unbound-1.6.4.ebuild 3669 BLAKE2B b56cdd1dd673807593d2b8b99a96c4ae43333b69cb66cf30e73dba3c51e0b21df130da9fdcd35d458afff547960a27c690d13075c43a950d986b8f16e0ea88f5 SHA512 d7d1035bab213ff950883ecac04f7c3ff972b6f83465a2c09afba1339ef1e74e560cb9cc818800d02a79462d2b857832596bc80b2088b5db9083f82a9032a5a6
 EBUILD unbound-1.6.6.ebuild 3676 BLAKE2B 3e37f5afa3fea70e86648fe5e32a5c38e89b77c5c9a0126c2fe831cda94bc8de52b2493def4bd6500c3e970827a4a3c14a63e1704cd10d7a3bdd5a808f5bc3b1 SHA512 112962ccdb8e60f8fb195061e607c449416355bcc5524a7bd6df2964d5a1508d4ddd7f5969b9f2b2e3b0acefc4fa7b6f687ef634cbcf24dc416cecfd9964dc7d
 EBUILD unbound-1.6.7.ebuild 3676 BLAKE2B 3e37f5afa3fea70e86648fe5e32a5c38e89b77c5c9a0126c2fe831cda94bc8de52b2493def4bd6500c3e970827a4a3c14a63e1704cd10d7a3bdd5a808f5bc3b1 SHA512 112962ccdb8e60f8fb195061e607c449416355bcc5524a7bd6df2964d5a1508d4ddd7f5969b9f2b2e3b0acefc4fa7b6f687ef634cbcf24dc416cecfd9964dc7d
-EBUILD unbound-1.6.8-r1.ebuild 3914 BLAKE2B 099ec6eec6d3b4bc34f92d6ac47de922d2fdb49124cf73ac5c139f81545e93ad35d75950f4bdcda8289a601d0f72ef9250ec2581a9f2e0b33cb8963c63f60619 SHA512 0c4838263ef74dffbef0d8d36c05437fcef3909e92dcded3115c9fb1e9a0542616508d6f0199fad4f72b68310bc3523658976351850592bf955bf3dd6e421a6d
+EBUILD unbound-1.6.8-r2.ebuild 4794 BLAKE2B 86d59f910c269b40e5ffaff2c5bac08e29318d883d762079dd5d02361aab2ac2d955806285e426f27a1b44001a9f7bb09a37b16a49923ca24cbc8655bd9a392c SHA512 9f0edded5e7e009f003ab99d53ecd3df92983e97b90c1d586cc44e002b1433bdb64acaddf9c849a08c7ec7eaaf52cd1e830f1fa2d0db31332a322827edad5b4c
 EBUILD unbound-1.6.8.ebuild 3676 BLAKE2B 568771ffa57f6ec9711aafe2ba7e808772d898a3476a5d11c0aaeb40538e37a5a7d3a4b091a206b5828605162a59f33dfe50b6c0b4840794f655090c1a1bb641 SHA512 403febbc597a6beccce1eb4394df04dcbbec1c65cd1b8e4c444e53ace5fd6b3cf87dfaa1cf69c11203e3cdcb7c99de7d43f36a202188e4e6c58b4f8650d109ae
 MISC metadata.xml 1008 BLAKE2B 1852e514f97f9305848144ae0f9aaf8fb49546cd9afcd873ab67dcefee0503d5047809dc8c650006ccdb236c9ba9ff02cc5ecf726d61c25e17167409f91d3fb1 SHA512 f6654d6d254a4d51a8c454c542f1fbbff16bfeaa1cb681f110b9ae99a4231cdb7c073a5d42faba71168079330f9e01781df7a5b3e1bd70d771c874a5bbe9742a
diff --git a/net-dns/unbound/unbound-1.6.8-r1.ebuild b/net-dns/unbound/unbound-1.6.8-r2.ebuild
index 07379f933b5c..8fda5205f209 100644
--- a/net-dns/unbound/unbound-1.6.8-r1.ebuild
+++ b/net-dns/unbound/unbound-1.6.8-r2.ebuild
@@ -132,4 +132,25 @@ multilib_src_install_all() {
 
 	exeinto /usr/share/${PN}
 	doexe contrib/update-anchor.sh
+
+	# create space for auto-trust-anchor-file...
+	keepdir /etc/unbound/var
+	# ... and point example config to it
+	sed -i '/# auto-trust-anchor-file:/s,/etc/dnssec/root-anchors.txt,/etc/unbound/var/root-anchors.txt,' "${ED}/etc/unbound/unbound.conf"
+}
+
+pkg_postinst() {
+	# make var/ writable by unbound
+	if [[ -d "${ROOT}/etc/unbound/var" ]]; then
+		chown --no-dereference --from=root unbound: "${ROOT}/etc/unbound/var"
+	fi
+	einfo ""
+	einfo "If you want unbound to automatically update the root-anchor file for DNSSEC validation"
+	einfo "set 'auto-trust-anchor-file: /etc/unbound/var/root-anchors.txt' in /etc/unbound/unbound.conf"
+	einfo "and run"
+	einfo ""
+	einfo "  su -s /bin/sh -c '/usr/sbin/unbound-anchor -a /etc/unbound/var/root-anchors.txt' unbound"
+	einfo ""
+	einfo "as root to create it initially before starting unbound for the first time after enabling this."
+	einfo ""
 }