gentoo auto-resync : 18:02:2024 - 11:39:02

13 files changed, 291 insertions, 1131 deletions

diff --git a/net-dns/Manifest.gz b/net-dns/Manifest.gz
index a8e29bc30288..2983d472520a 100644
--- a/net-dns/Manifest.gz
+++ b/net-dns/Manifest.gz
diff --git a/net-dns/bind-tools/Manifest b/net-dns/bind-tools/Manifest
index f7a35345da9f..ee3c8b45b4c8 100644
--- a/net-dns/bind-tools/Manifest
+++ b/net-dns/bind-tools/Manifest
@@ -1,9 +1,6 @@
-DIST bind-9.16.37.tar.xz 5109440 BLAKE2B 3b18f7c780ce04e296498e30c09628ad8eb89f38afdb032700455f193a3f8556029cd2e3d3c42861965d5fc776f56f761b8d21a74a0f95d82338e65fb519acfb SHA512 2c4b01f6cc598849688b5b2710caf48db47e1e860df785783ef2b140a25507b48357a9becf7911ba0feda285c4bca87764e21128fac5cf17efa47fd5134dc59f
-DIST bind-9.16.39.tar.xz 5120164 BLAKE2B d9fb51435dce11c8854084cc21de79df3ae6529baead76dcf27711bcff33469d1fd6fbd3366b61bc921f92850620c9b7464d4dbe08dd0c7e2f3e5e1c1100cb79 SHA512 6e2e30815222a289e94f6857fdb6b142558ca56ecf5f8291f843f8476da8e4011042f1dd2bed031e5d9924370ae0705ce5b3ea2ce10ae830f8980b669eb26328
-DIST bind-9.16.41.tar.xz 5121884 BLAKE2B 53ccc399acc98f79930f51314c1f4e1135370347f05c7a293ac416669c6125b2d56edda20b9ecd86e6ec3ccf05a95c3eb0b836c26b14cf7ee3d1869f578280e5 SHA512 93c374ef82ff36e222a790161942635d0b977813b5040f8895e1c032b4ca1925addc8ef3a06417445036dc35aeb708cc61bd589c6a9cb78980f77ab402c44bee
 DIST bind-9.16.42.tar.xz 5123476 BLAKE2B 7cda7df38beaa602fde0142b46c8bcf401cda8afdf00383724ccaa8f3e3f71d320bbd4b7f3be33bcc9c59465932caab1f8c62ca64b79a1470cbdaa01f0048b00 SHA512 cf29e72c9c979f3cf8ba0b17357fb09c37f1436a7f3a518f49ce4b4c682fb367dd3d8e71de6603c166c95a7c535a77a9f2a1393a59723294626acefebbc95fd6
-EBUILD bind-tools-9.16.37-r1.ebuild 3936 BLAKE2B 004e8038be46a12ec9a2b3b80f8e5cd9c159fe048023d254d12c483d92e3decc0af01e16a37bdfd9c357c8773169a5eeaee499b57ccc09afc2e2566616797b0d SHA512 7c0f53a7880852754bc622fe6eb25356617e6c58c2df4bf0d5d5200a372f67b36484917aa7c9ac351d858892dfc0cc13b1ff9cdf14f9ee283ca625a48965e207
-EBUILD bind-tools-9.16.39.ebuild 3943 BLAKE2B 070fdaf2905eec6061aa333cb69a77c23d00eba4d063e75791aaabf1f7d2e3477e28a86e03778422556aff8036dc50aeb2f01f15672441e97af10cfb194ba3ce SHA512 9d976832d1e9e5d91d659f0395ac70ff6cb669d834dc1a2c04dc278321217a21f96379019bbd39ec3fc8a3e2528e42ebdaf830ad041cb5bf7a3bb1343ad1c001
-EBUILD bind-tools-9.16.41.ebuild 4249 BLAKE2B ed31666c04df3d57fd78a9e0ce29e45def1add26d07e2d4b0a28b47af7ee3f20954921c75a791512b995947347e77332fd0d8d581bd005ff7ee9e339e891fb15 SHA512 7a9a27dee9ce97f96ba807090de96a081a36496e7e170a1973072e3febb421e814c1da27862435b867ed2144e71ac5e431a729b4036488e69e49ee193df0c19a
+DIST bind-9.16.48.tar.xz 5131176 BLAKE2B 4a503b45df412c435cb0f75b54ee1270140cccce7ecc159cdf3e0e3cbd3c0a0866b7472782f20aacf130f57df12d20a102ac6979498138ce00a2655806d003e7 SHA512 83829a5045e2a29dd2b491d3ab72b545f5664023fcd4aa205a44dbb7bcc5c737b4466c0d73f124b8d88fd33c56776871a07dde1ba0530d43eec8e7304a08d353
+DIST bind-9.16.48.tar.xz.asc 833 BLAKE2B 740ed58863ed3a7dee6ada4edd03cad5378ea0aa53cd6f071ca1911bb2d6b285ed292f32846790d42b97e8d9bb72588f1cd30c4e10557ac1e9f1df545923a9b1 SHA512 7bd813b5ab6f9677fc4ef21e0c3930f6319fa6c49d6869570794bc28212fe8935b72f9f217cfce692a2dec9ec29994f345d1b1145cef1ca976c5361f6ce0f75d
 EBUILD bind-tools-9.16.42.ebuild 4249 BLAKE2B ed31666c04df3d57fd78a9e0ce29e45def1add26d07e2d4b0a28b47af7ee3f20954921c75a791512b995947347e77332fd0d8d581bd005ff7ee9e339e891fb15 SHA512 7a9a27dee9ce97f96ba807090de96a081a36496e7e170a1973072e3febb421e814c1da27862435b867ed2144e71ac5e431a729b4036488e69e49ee193df0c19a
+EBUILD bind-tools-9.16.48.ebuild 4450 BLAKE2B 7e8b64cf2372a890917dc72f36e2738d6ad2a4ae733988467be5a35eb59966d41688fbc8e8ff40bf307a60d68d876db987a5ecf92e0c9d2523f5046bcd91945e SHA512 b819f38c97322cdcd0b9f52153697e8b43b135fa8ad51f51933826b926a2e83cd8b8032b522d34dd6b3366a4f204c9244b991d1cee0ec2b9bdf6d9a5ddf2c62a
 MISC metadata.xml 393 BLAKE2B 90453ff0da1ce62c68dbe5c2f8ad99747388e8476afb02fc3794705d9acebbde1fb1d0c1f282a5e3fec62211b02af74c05783ebc2353dbdee3f2f0ba51541430 SHA512 d4e6b6f90058fedc771b2ecde5fb8cb8b3aa4069bded3a7a1ffe01766ca05b08a25b2a7f6d3f9cfa796868b9b290b20d2531ad25b7548427807125a2b8ea5bad
diff --git a/net-dns/bind-tools/bind-tools-9.16.37-r1.ebuild b/net-dns/bind-tools/bind-tools-9.16.37-r1.ebuild
deleted file mode 100644
index c2b97cf39596..000000000000
--- a/net-dns/bind-tools/bind-tools-9.16.37-r1.ebuild
+++ /dev/null
@@ -1,160 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-inherit autotools flag-o-matic multiprocessing toolchain-funcs
-
-MY_PN=${PN//-tools}
-MY_PV=${PV/_p/-P}
-MY_PV=${MY_PV/_rc/rc}
-MY_P="${MY_PN}-${MY_PV}"
-
-DESCRIPTION="bind tools: dig, nslookup, host, nsupdate, dnssec-keygen"
-HOMEPAGE="https://www.isc.org/software/bind https://gitlab.isc.org/isc-projects/bind9"
-SRC_URI="https://downloads.isc.org/isc/bind9/${PV}/${MY_P}.tar.xz"
-
-LICENSE="Apache-2.0 BSD BSD-2 GPL-2 HPND ISC MPL-2.0"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x64-solaris"
-IUSE="+caps doc gssapi idn libedit readline test xml"
-# no PKCS11 currently as it requires OpenSSL to be patched, also see bug #409687
-RESTRICT="!test? ( test )"
-
-# libuv lower bound should be the highest value seen at
-# https://gitlab.isc.org/isc-projects/bind9/-/blob/v9_16/lib/isc/netmgr/netmgr.c#L244
-# to avoid issues with matching stable/testing, etc
-COMMON_DEPEND="
-	>=dev-libs/libuv-1.42.0:=
-	dev-libs/openssl:=
-	caps? ( sys-libs/libcap )
-	xml? ( dev-libs/libxml2 )
-	idn? ( net-dns/libidn2:= )
-	gssapi? ( virtual/krb5 )
-	libedit? ( dev-libs/libedit )
-	!libedit? (
-		readline? ( sys-libs/readline:= )
-	)
-"
-DEPEND="${COMMON_DEPEND}"
-RDEPEND="${COMMON_DEPEND}"
-
-# sphinx required for man-page and html creation
-BDEPEND="
-	virtual/pkgconfig
-	doc? ( dev-python/sphinx )
-	test? (
-		dev-util/cmocka
-		dev-util/kyua
-	)
-"
-
-S="${WORKDIR}/${MY_P}"
-
-src_prepare() {
-	default
-
-	append-ldflags "-L${ESYSROOT}/usr/$(get_libdir)"
-
-	# Do not disable thread local storage on Solaris, it works with our
-	# toolchain, and it breaks further configure checks
-	sed -i -e '/LDFLAGS=/s/-zrelax=transtls//' configure.ac configure || die
-
-	# bug #220361
-	rm aclocal.m4 || die
-	rm -rf libtool.m4/ || die
-
-	eautoreconf
-}
-
-src_configure() {
-	local myeconfargs=(
-		--localstatedir="${EPREFIX}"/var
-		--without-python
-		--without-libjson
-		--without-zlib
-		--without-lmdb
-		--without-maxminddb
-		--disable-geoip
-		--with-openssl="${ESYSROOT}"/usr
-		$(use_with idn libidn2 "${ESYSROOT}"/usr)
-		$(use_with xml libxml2)
-		$(use_with gssapi)
-		$(use_with readline)
-		$(use_enable caps linux-caps)
-		AR="$(type -P $(tc-getAR))"
-	)
-
-	# bug 607400
-	if use libedit ; then
-		myeconfargs+=( --with-readline=-ledit )
-	elif use readline ; then
-		myeconfargs+=( --with-readline=-lreadline )
-	else
-		myeconfargs+=( --without-readline )
-	fi
-
-	# bug #344029
-	append-cflags "-DDIG_SIGCHASE"
-
-	# to expose CMSG_* macros from sys/sockets.h
-	[[ ${CHOST} == *-solaris* ]] && append-cflags "-D_XOPEN_SOURCE=600"
-
-	# localstatedir for nsupdate -l, bug #395785
-	tc-export BUILD_CC
-	econf "${myeconfargs[@]}"
-
-	# bug #151839
-	echo '#undef SO_BSDCOMPAT' >> config.h || die
-}
-
-src_compile() {
-	local AR="$(tc-getAR)"
-
-	emake AR="${AR}" -C lib/
-	emake AR="${AR}" -C bin/delv/
-	emake AR="${AR}" -C bin/dig/
-	emake AR="${AR}" -C bin/nsupdate/
-	emake AR="${AR}" -C bin/dnssec/
-	emake -C doc/man/ man $(usev doc)
-}
-
-src_test() {
-	# system tests ('emake test') require network configuration for IPs etc
-	# so we run the unit tests instead.
-	TEST_PARALLEL_JOBS="$(makeopts_jobs)" emake unit
-}
-
-src_install() {
-	local man_dir="${S}/doc/man"
-	local html_dir="${man_dir}/_build/html"
-
-	dodoc README CHANGES
-
-	cd "${S}"/bin/delv || die
-	dobin delv
-	doman ${man_dir}/delv.1
-
-	cd "${S}"/bin/dig || die
-	dobin dig host nslookup
-	doman ${man_dir}/{dig,host,nslookup}.1
-
-	cd "${S}"/bin/nsupdate || die
-	dobin nsupdate
-	doman ${man_dir}/nsupdate.1
-	if use doc; then
-		docinto html
-		dodoc ${html_dir}/nsupdate.html
-	fi
-
-	cd "${S}"/bin/dnssec || die
-	for tool in dsfromkey importkey keyfromlabel keygen \
-		revoke settime signzone verify; do
-		dobin dnssec-"${tool}"
-		doman ${man_dir}/dnssec-"${tool}".8
-		if use doc; then
-			docinto html
-			dodoc ${html_dir}/dnssec-"${tool}".html
-		fi
-	done
-}
diff --git a/net-dns/bind-tools/bind-tools-9.16.39.ebuild b/net-dns/bind-tools/bind-tools-9.16.39.ebuild
deleted file mode 100644
index 7aaf1b1a1ceb..000000000000
--- a/net-dns/bind-tools/bind-tools-9.16.39.ebuild
+++ /dev/null
@@ -1,160 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-inherit autotools flag-o-matic multiprocessing toolchain-funcs
-
-MY_PN=${PN//-tools}
-MY_PV=${PV/_p/-P}
-MY_PV=${MY_PV/_rc/rc}
-MY_P="${MY_PN}-${MY_PV}"
-
-DESCRIPTION="bind tools: dig, nslookup, host, nsupdate, dnssec-keygen"
-HOMEPAGE="https://www.isc.org/software/bind https://gitlab.isc.org/isc-projects/bind9"
-SRC_URI="https://downloads.isc.org/isc/bind9/${PV}/${MY_P}.tar.xz"
-
-LICENSE="Apache-2.0 BSD BSD-2 GPL-2 HPND ISC MPL-2.0"
-SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x64-solaris"
-IUSE="+caps doc gssapi idn libedit readline test xml"
-# no PKCS11 currently as it requires OpenSSL to be patched, also see bug #409687
-RESTRICT="!test? ( test )"
-
-# libuv lower bound should be the highest value seen at
-# https://gitlab.isc.org/isc-projects/bind9/-/blob/v9_16/lib/isc/netmgr/netmgr.c#L244
-# to avoid issues with matching stable/testing, etc
-COMMON_DEPEND="
-	>=dev-libs/libuv-1.42.0:=
-	dev-libs/openssl:=
-	caps? ( sys-libs/libcap )
-	xml? ( dev-libs/libxml2 )
-	idn? ( net-dns/libidn2:= )
-	gssapi? ( virtual/krb5 )
-	libedit? ( dev-libs/libedit )
-	!libedit? (
-		readline? ( sys-libs/readline:= )
-	)
-"
-DEPEND="${COMMON_DEPEND}"
-RDEPEND="${COMMON_DEPEND}"
-
-# sphinx required for man-page and html creation
-BDEPEND="
-	virtual/pkgconfig
-	doc? ( dev-python/sphinx )
-	test? (
-		dev-util/cmocka
-		dev-util/kyua
-	)
-"
-
-S="${WORKDIR}/${MY_P}"
-
-src_prepare() {
-	default
-
-	append-ldflags "-L${ESYSROOT}/usr/$(get_libdir)"
-
-	# Do not disable thread local storage on Solaris, it works with our
-	# toolchain, and it breaks further configure checks
-	sed -i -e '/LDFLAGS=/s/-zrelax=transtls//' configure.ac configure || die
-
-	# bug #220361
-	rm aclocal.m4 || die
-	rm -rf libtool.m4/ || die
-
-	eautoreconf
-}
-
-src_configure() {
-	local myeconfargs=(
-		--localstatedir="${EPREFIX}"/var
-		--without-python
-		--without-libjson
-		--without-zlib
-		--without-lmdb
-		--without-maxminddb
-		--disable-geoip
-		--with-openssl="${ESYSROOT}"/usr
-		$(use_with idn libidn2 "${ESYSROOT}"/usr)
-		$(use_with xml libxml2)
-		$(use_with gssapi)
-		$(use_with readline)
-		$(use_enable caps linux-caps)
-		AR="$(type -P $(tc-getAR))"
-	)
-
-	# bug 607400
-	if use libedit ; then
-		myeconfargs+=( --with-readline=-ledit )
-	elif use readline ; then
-		myeconfargs+=( --with-readline=-lreadline )
-	else
-		myeconfargs+=( --without-readline )
-	fi
-
-	# bug #344029
-	append-cflags "-DDIG_SIGCHASE"
-
-	# to expose CMSG_* macros from sys/sockets.h
-	[[ ${CHOST} == *-solaris* ]] && append-cflags "-D_XOPEN_SOURCE=600"
-
-	# localstatedir for nsupdate -l, bug #395785
-	tc-export BUILD_CC
-	econf "${myeconfargs[@]}"
-
-	# bug #151839
-	echo '#undef SO_BSDCOMPAT' >> config.h || die
-}
-
-src_compile() {
-	local AR="$(tc-getAR)"
-
-	emake AR="${AR}" -C lib/
-	emake AR="${AR}" -C bin/delv/
-	emake AR="${AR}" -C bin/dig/
-	emake AR="${AR}" -C bin/nsupdate/
-	emake AR="${AR}" -C bin/dnssec/
-	emake -C doc/man/ man $(usev doc)
-}
-
-src_test() {
-	# system tests ('emake test') require network configuration for IPs etc
-	# so we run the unit tests instead.
-	TEST_PARALLEL_JOBS="$(makeopts_jobs)" emake unit
-}
-
-src_install() {
-	local man_dir="${S}/doc/man"
-	local html_dir="${man_dir}/_build/html"
-
-	dodoc README CHANGES
-
-	cd "${S}"/bin/delv || die
-	dobin delv
-	doman ${man_dir}/delv.1
-
-	cd "${S}"/bin/dig || die
-	dobin dig host nslookup
-	doman ${man_dir}/{dig,host,nslookup}.1
-
-	cd "${S}"/bin/nsupdate || die
-	dobin nsupdate
-	doman ${man_dir}/nsupdate.1
-	if use doc; then
-		docinto html
-		dodoc ${html_dir}/nsupdate.html
-	fi
-
-	cd "${S}"/bin/dnssec || die
-	for tool in dsfromkey importkey keyfromlabel keygen \
-		revoke settime signzone verify; do
-		dobin dnssec-"${tool}"
-		doman ${man_dir}/dnssec-"${tool}".8
-		if use doc; then
-			docinto html
-			dodoc ${html_dir}/dnssec-"${tool}".html
-		fi
-	done
-}
diff --git a/net-dns/bind-tools/bind-tools-9.16.41.ebuild b/net-dns/bind-tools/bind-tools-9.16.48.ebuild
index 1d420730c56f..53c0494bb5a5 100644
--- a/net-dns/bind-tools/bind-tools-9.16.41.ebuild
+++ b/net-dns/bind-tools/bind-tools-9.16.48.ebuild
@@ -3,7 +3,8 @@
 
 EAPI=8
 
-inherit autotools flag-o-matic multiprocessing toolchain-funcs
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/isc.asc
+inherit autotools flag-o-matic multiprocessing toolchain-funcs verify-sig
 
 MY_PN=${PN//-tools}
 MY_PV=${PV/_p/-P}
@@ -12,19 +13,23 @@ MY_P="${MY_PN}-${MY_PV}"
 
 DESCRIPTION="bind tools: dig, nslookup, host, nsupdate, dnssec-keygen"
 HOMEPAGE="https://www.isc.org/software/bind https://gitlab.isc.org/isc-projects/bind9"
-SRC_URI="https://downloads.isc.org/isc/bind9/${PV}/${MY_P}.tar.xz"
+SRC_URI="
+	https://downloads.isc.org/isc/bind9/${PV}/${MY_P}.tar.xz
+	verify-sig? ( https://downloads.isc.org/isc/bind9/${PV}/${MY_P}.tar.xz.asc )
+"
+S="${WORKDIR}/${MY_P}"
 
 LICENSE="Apache-2.0 BSD BSD-2 GPL-2 HPND ISC MPL-2.0"
 SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="+caps doc gssapi idn libedit readline test xml"
 # no PKCS11 currently as it requires OpenSSL to be patched, also see bug #409687
 RESTRICT="!test? ( test )"
 
 # libuv lower bound should be the highest value seen at
-# https://gitlab.isc.org/isc-projects/bind9/-/blob/v9_16/lib/isc/netmgr/netmgr.c#L244
+# https://gitlab.isc.org/isc-projects/bind9/-/blob/bind-9.16/lib/isc/netmgr/netmgr.c?ref_type=heads#L244
 # to avoid issues with matching stable/testing, etc
-COMMON_DEPEND="
+RDEPEND="
 	>=dev-libs/libuv-1.42.0:=
 	dev-libs/openssl:=
 	caps? ( sys-libs/libcap )
@@ -36,9 +41,7 @@ COMMON_DEPEND="
 		readline? ( sys-libs/readline:= )
 	)
 "
-DEPEND="${COMMON_DEPEND}"
-RDEPEND="${COMMON_DEPEND}"
-
+DEPEND="${RDEPEND}"
 # sphinx required for man-page and html creation
 BDEPEND="
 	virtual/pkgconfig
@@ -47,15 +50,12 @@ BDEPEND="
 		dev-util/cmocka
 		dev-util/kyua
 	)
+	verify-sig? ( sec-keys/openpgp-keys-isc )
 "
 
-S="${WORKDIR}/${MY_P}"
-
 src_prepare() {
 	default
 
-	append-ldflags "-L${ESYSROOT}/usr/$(get_libdir)"
-
 	# Do not disable thread local storage on Solaris, it works with our
 	# toolchain, and it breaks further configure checks
 	sed -i -e '/LDFLAGS=/s/-zrelax=transtls//' configure.ac configure || die
@@ -76,6 +76,7 @@ src_prepare() {
 
 src_configure() {
 	local myeconfargs=(
+		# localstatedir for nsupdate -l, bug #395785
 		--localstatedir="${EPREFIX}"/var
 		--without-python
 		--without-libjson
@@ -92,7 +93,7 @@ src_configure() {
 		AR="$(type -P $(tc-getAR))"
 	)
 
-	# bug 607400
+	# bug #607400
 	if use libedit ; then
 		myeconfargs+=( --with-readline=-ledit )
 	elif use readline ; then
@@ -104,10 +105,11 @@ src_configure() {
 	# bug #344029
 	append-cflags "-DDIG_SIGCHASE"
 
+	append-ldflags "-L${ESYSROOT}/usr/$(get_libdir)"
+
 	# to expose CMSG_* macros from sys/sockets.h
 	[[ ${CHOST} == *-solaris* ]] && append-cflags "-D_XOPEN_SOURCE=600"
 
-	# localstatedir for nsupdate -l, bug #395785
 	tc-export BUILD_CC
 	econf "${myeconfargs[@]}"
 
@@ -129,7 +131,7 @@ src_compile() {
 src_test() {
 	# system tests ('emake test') require network configuration for IPs etc
 	# so we run the unit tests instead.
-	TEST_PARALLEL_JOBS="$(makeopts_jobs)" emake unit
+	TEST_PARALLEL_JOBS="$(makeopts_jobs)" emake -Onone unit
 }
 
 src_install() {
@@ -155,6 +157,7 @@ src_install() {
 	fi
 
 	cd "${S}"/bin/dnssec || die
+	local tool
 	for tool in dsfromkey importkey keyfromlabel keygen \
 		revoke settime signzone verify; do
 		dobin dnssec-"${tool}"
diff --git a/net-dns/bind/Manifest b/net-dns/bind/Manifest
index adc3108ba12b..3b9825418e0c 100644
--- a/net-dns/bind/Manifest
+++ b/net-dns/bind/Manifest
@@ -3,18 +3,16 @@ AUX generate-rndc-key.sh 183 BLAKE2B 33f2297745ef8e5aed09107cee6d0017d3870ea9db2
 AUX ldap-library-path-on-multilib-machines.patch 431 BLAKE2B d067f241334742ec093af75e83e2b0678f04048b73e7f97e637b42fad301f48fa930b10ac4b8c24ea86c7fe011eb598e21ada7514b47b2c05a9c14feb8b1487b SHA512 9c668a117a5ae5fc8414eb545b4a69e40826982092190cdb36e67092c98f4c148ac749988da3ed6f9b32f6559e13046c50a77a7e307cd8bd6256d1f44ba44468
 AUX localhost.zone-r3 426 BLAKE2B d34cf12d484c6bb705d3bd8bfbf93514e504497a99da983f6176234239cc664131502744f3cd743d938dec0309f0d8df2c1d0c5325b5cb61023ed192d32bbedd SHA512 979d8693046033c24490dca536f0d649795bbdf57eed32017b32d07d7d3c51b35197e4edd79d8258074a1bf14b71376472ba6ae749f62ceaf74d7a6a0559fa89
 AUX named.cache-r3 3316 BLAKE2B 09a17fbb29f2122a61c7e17a8dfc8eef3b0fdaa94e8dbe17a0b188946fe8017c65599fbb84c0f88123f0e0f17faae2b9a1ffbc0ee17bcf62c1cbf34f064b9c36 SHA512 3608f29d356bf853145e14c1f81fdccf7090f63e95573234221711b7b6084fbc806817c41daa5d6072a4955a714f9e1cbd6cdcabd7cd1833c3e5f8387bc1ba20
+AUX named.cache-r4 3313 BLAKE2B 768056568cb440329234b335de5d5571901a272f70a13490f33b53d5b50e1af0c0b9115a15b81a0d93d61f23862dfb7f18ccf3362965cf401928fbb16f3cd3ae SHA512 eddbd04aa031ae6f87930107fb7a4995295f798f399d24e35ae1291188449f67291fddf2cc23624bbc09aa3993041eeac233e926770c4d4f553bdd52dd7c8592
 AUX named.conf 32 BLAKE2B 15548145717b526be3d7898a0c2144a13e29b0595a3c27d220cc45646156cc8ddae954cb3b3907ca845765fc8ce30508d8e570c0a492b965027531a0f6df43ac SHA512 c344fd4949eb80114d0c157517ece3f4b9505b94e3de00489d4b2b23beb74612f38cf3443f2f3b98fe01d98ad1842f45ff1d1826d67937e72e4629bbdf683a59
 AUX named.conf-r8 4020 BLAKE2B beb900a89be0f2acc1b08a8d29443c87b098e5ac1f1de9c63b22f6f50df2644d583d4fc504f55710f6549142bf6bfaa7c9fb3097202276135b9bbdb69af32f90 SHA512 60ab117e488604810a6e42a627eae465f6241208e726e763127f84102d05a661cceeddd00bc9d8d92c3da7d73d034ef876ace6744a0516b2bcadbaff1d9c82ad
 AUX named.confd-r7 1364 BLAKE2B cfb72f221bc6657c5a8ef8b9cd804afeaf5f642d2046880f5bae6c2313485808b99a1a46fc10431913d187ed67cc1e6bad019a9192638bc7fdf97c951e2326ce SHA512 68fa7c8963ac59349de3d05972c07aa0123b7bebbe0ba9604463ccfd1b377c2babe01eed4745cbe0f7d3831d1b47c2fa620f8092c67465fb771cae4932b0861a
 AUX named.init-r14 6167 BLAKE2B 7c3deb3492a50d2655814f9fb492706b671e08ccdc406be0fe9ef5e55de19f2e1ee3abe2c0f9fbff0a958ce751361c5faa690970d31a935aa2854a765a224c03 SHA512 65c65f261b950559487a6ac1d589cc51e6a4800aa9801c84aeb18083b7f587ff0ca6ce9e2994b1c58586d96a9181c05ca47ffef93fa210ffc53f4e9af21f4d1b
 AUX named.service-r1 327 BLAKE2B b0471100b425a1d4db29c1ef577dd6f14b2c3d040fd826bed03105f514bf1ea2c58c19d59557d0eafe27a96588adaf60156f31b6befdd9be96a8ca1fe8613678 SHA512 1d3dbf9d1de0c23c398a523b05c0fb266b6b699e54d232818b28205f697ca227acae9f2778d6f41309b117a6cd78eee170b745594b786b1c1571d5f66d6c3de4
-DIST bind-9.16.37.tar.xz 5109440 BLAKE2B 3b18f7c780ce04e296498e30c09628ad8eb89f38afdb032700455f193a3f8556029cd2e3d3c42861965d5fc776f56f761b8d21a74a0f95d82338e65fb519acfb SHA512 2c4b01f6cc598849688b5b2710caf48db47e1e860df785783ef2b140a25507b48357a9becf7911ba0feda285c4bca87764e21128fac5cf17efa47fd5134dc59f
-DIST bind-9.16.39.tar.xz 5120164 BLAKE2B d9fb51435dce11c8854084cc21de79df3ae6529baead76dcf27711bcff33469d1fd6fbd3366b61bc921f92850620c9b7464d4dbe08dd0c7e2f3e5e1c1100cb79 SHA512 6e2e30815222a289e94f6857fdb6b142558ca56ecf5f8291f843f8476da8e4011042f1dd2bed031e5d9924370ae0705ce5b3ea2ce10ae830f8980b669eb26328
-DIST bind-9.16.41.tar.xz 5121884 BLAKE2B 53ccc399acc98f79930f51314c1f4e1135370347f05c7a293ac416669c6125b2d56edda20b9ecd86e6ec3ccf05a95c3eb0b836c26b14cf7ee3d1869f578280e5 SHA512 93c374ef82ff36e222a790161942635d0b977813b5040f8895e1c032b4ca1925addc8ef3a06417445036dc35aeb708cc61bd589c6a9cb78980f77ab402c44bee
 DIST bind-9.16.42.tar.xz 5123476 BLAKE2B 7cda7df38beaa602fde0142b46c8bcf401cda8afdf00383724ccaa8f3e3f71d320bbd4b7f3be33bcc9c59465932caab1f8c62ca64b79a1470cbdaa01f0048b00 SHA512 cf29e72c9c979f3cf8ba0b17357fb09c37f1436a7f3a518f49ce4b4c682fb367dd3d8e71de6603c166c95a7c535a77a9f2a1393a59723294626acefebbc95fd6
+DIST bind-9.16.48.tar.xz 5131176 BLAKE2B 4a503b45df412c435cb0f75b54ee1270140cccce7ecc159cdf3e0e3cbd3c0a0866b7472782f20aacf130f57df12d20a102ac6979498138ce00a2655806d003e7 SHA512 83829a5045e2a29dd2b491d3ab72b545f5664023fcd4aa205a44dbb7bcc5c737b4466c0d73f124b8d88fd33c56776871a07dde1ba0530d43eec8e7304a08d353
+DIST bind-9.16.48.tar.xz.asc 833 BLAKE2B 740ed58863ed3a7dee6ada4edd03cad5378ea0aa53cd6f071ca1911bb2d6b285ed292f32846790d42b97e8d9bb72588f1cd30c4e10557ac1e9f1df545923a9b1 SHA512 7bd813b5ab6f9677fc4ef21e0c3930f6319fa6c49d6869570794bc28212fe8935b72f9f217cfce692a2dec9ec29994f345d1b1145cef1ca976c5361f6ce0f75d
 DIST dyndns-samples.tbz2 22866 BLAKE2B 409890653c6536cb9c0e3ba809d2bfde0e0ae73a2a101b4f229b46c01568466bc022bbbc37712171adbd08c572733e93630feab95a0fcd1ac50a7d37da1d1108 SHA512 83b0bf99f8e9ff709e8e9336d8c5231b98a4b5f0c60c10792f34931e32cc638d261967dfa5a83151ec3740977d94ddd6e21e9ce91267b3e279b88affdbc18cac
-EBUILD bind-9.16.37.ebuild 11173 BLAKE2B d99ad93930bf8e276f9f46b7cac571ca7994e6a165bc4b9e08eea037df175f8dc97613deed937d3f6a27a76584dd55054a948143f8497b69caf2501461dec32e SHA512 31402867a13e1fae07c8d0738cb61a2a55b6cd7a9239f77309538fe85bda7abd6170fdd3ef9b9da4524fbd61681dcc8ccb43689e6dcbf2e4ae8ee23ed191f0e2
-EBUILD bind-9.16.39.ebuild 11180 BLAKE2B e580b6821b312bd7c5f5c10f7da514c02c3148075560ea1c28888b7122f40183910d8bedc2d2055e7ac54b75e28d54f0f1bf258ebe03f17f19b4da93c83efb6e SHA512 bec24d57abc732ca61166095674fc71625d66f1df83b2f09c2bed11e1d98475aa2fba94584f6f464c683cfe8f817fd69e9d68df4f0d9066947fcf7174562a4d6
-EBUILD bind-9.16.41.ebuild 11486 BLAKE2B 47229c17499289344f54d21ec9b91e03beb77878c53b2544e3c01bd882466cae41d2f5e0894100992336b8abd998ec4693222957595539685df525b9cef604d6 SHA512 d1631d63f941281d7654d51a570fd22a0250ea12f56ba90fff63722afec61ac88320ab3e2ccd500a24844c42efb30cd2c3c27ff296882be5ec605a7947d361b3
 EBUILD bind-9.16.42.ebuild 11486 BLAKE2B 47229c17499289344f54d21ec9b91e03beb77878c53b2544e3c01bd882466cae41d2f5e0894100992336b8abd998ec4693222957595539685df525b9cef604d6 SHA512 d1631d63f941281d7654d51a570fd22a0250ea12f56ba90fff63722afec61ac88320ab3e2ccd500a24844c42efb30cd2c3c27ff296882be5ec605a7947d361b3
+EBUILD bind-9.16.48.ebuild 11657 BLAKE2B 5a68aa89941ab8bfebcf5b3aae4acca7d40b2bca83b82527d8c1d8299f0144a84beef2cb317e1de7d83eb1c7dbb2a1669a63217becca24c8d6785b4ae2552ed6 SHA512 8a7fe1f5eea1919314276c3ba733c3c3a05d6c2a1b5ce8f26975dc79f00f8db11b1a442f861944fc8aea5972e66907e0ab3812778ceedb9badd4e0ce5c20335b
 MISC metadata.xml 866 BLAKE2B 672d411e2fef8ac9003d975fff049d1c17da75984efccc30bd98812a4b3e1be74ebf408f6c650813deff5f326a9858dca3755383e9573059f3c8b5c290497fcf SHA512 fd16dda7b0f54faeec5429a8763fb9075da4eb8c358c88891e388b3e3c76e062e7f585cf0134b99648cfcbae07da7b786c3c16920aed329864ba2cf7c29d93c8
diff --git a/net-dns/bind/bind-9.16.37.ebuild b/net-dns/bind/bind-9.16.37.ebuild
deleted file mode 100644
index f27f8fe2abdf..000000000000
--- a/net-dns/bind/bind-9.16.37.ebuild
+++ /dev/null
@@ -1,382 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-# Re dlz/mysql and threads, needs to be verified..
-# MySQL uses thread local storage in its C api. Thus MySQL
-# requires that each thread of an application execute a MySQL
-# thread initialization to setup the thread local storage.
-# This is impossible to do safely while staying within the DLZ
-# driver API. This is a limitation caused by MySQL, and not the DLZ API.
-# Because of this BIND MUST only run with a single thread when
-# using the MySQL driver.
-
-EAPI=8
-
-PYTHON_COMPAT=( python3_{9..11} )
-
-inherit python-r1 autotools multiprocessing toolchain-funcs flag-o-matic db-use systemd tmpfiles
-
-MY_PV="${PV/_p/-P}"
-MY_PV="${MY_PV/_rc/rc}"
-MY_P="${PN}-${MY_PV}"
-
-SDB_LDAP_VER="1.1.0-fc14"
-
-RRL_PV="${MY_PV}"
-
-# SDB-LDAP: http://bind9-ldap.bayour.com/
-
-DESCRIPTION="Berkeley Internet Name Domain - Name Server"
-HOMEPAGE="https://www.isc.org/software/bind https://gitlab.isc.org/isc-projects/bind9"
-SRC_URI="https://downloads.isc.org/isc/bind9/${PV}/${P}.tar.xz
-	doc? ( mirror://gentoo/dyndns-samples.tbz2 )"
-
-LICENSE="Apache-2.0 BSD BSD-2 GPL-2 HPND ISC MPL-2.0"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux"
-# -berkdb by default re bug #602682
-IUSE="berkdb +caps +dlz dnstap doc dnsrps fixed-rrset geoip geoip2 gssapi
-json ldap lmdb mysql odbc postgres python selinux static-libs test xml +zlib"
-# sdb-ldap - patch broken
-# no PKCS11 currently as it requires OpenSSL to be patched, also see bug 409687
-RESTRICT="!test? ( test )"
-
-# Upstream dropped the old geoip library, but the BIND configuration for using
-# GeoIP remained the same.
-REQUIRED_USE="
-	postgres? ( dlz )
-	berkdb? ( dlz )
-	mysql? ( dlz )
-	odbc? ( dlz )
-	ldap? ( dlz )
-	dnsrps? ( dlz )
-	python? ( ${PYTHON_REQUIRED_USE} )
-"
-
-DEPEND="
-	acct-group/named
-	acct-user/named
-	berkdb? ( sys-libs/db:= )
-	dev-libs/openssl:=[-bindist(-)]
-	mysql? ( dev-db/mysql-connector-c:0= )
-	odbc? ( >=dev-db/unixODBC-2.2.6 )
-	ldap? ( net-nds/openldap:= )
-	postgres? ( dev-db/postgresql:= )
-	caps? ( >=sys-libs/libcap-2.1.0 )
-	xml? ( dev-libs/libxml2 )
-	geoip? ( dev-libs/libmaxminddb:= )
-	geoip2? ( dev-libs/libmaxminddb:= )
-	gssapi? ( virtual/krb5 )
-	json? ( dev-libs/json-c:= )
-	lmdb? ( dev-db/lmdb:= )
-	zlib? ( sys-libs/zlib )
-	dnstap? ( dev-libs/fstrm dev-libs/protobuf-c:= )
-	python? (
-		${PYTHON_DEPS}
-		dev-python/ply[${PYTHON_USEDEP}]
-	)
-	dev-libs/libuv:=
-"
-
-RDEPEND="${DEPEND}
-	selinux? ( sec-policy/selinux-bind )
-	sys-process/psmisc"
-
-BDEPEND="
-	test? (
-		dev-util/cmocka
-		dev-util/kyua
-	)
-"
-
-S="${WORKDIR}/${MY_P}"
-
-PATCHES=(
-	"${FILESDIR}/ldap-library-path-on-multilib-machines.patch"
-)
-
-src_prepare() {
-	default
-
-	# Should be installed by bind-tools
-	sed -i -r -e "s:(nsupdate|dig|delv) ::g" bin/Makefile.in || die
-
-	# bug #220361
-	rm aclocal.m4 || die
-	rm -rf libtool.m4/ || die
-	eautoreconf
-
-	use python && python_copy_sources
-}
-
-src_configure() {
-	bind_configure --without-python
-	use python && python_foreach_impl python_configure
-}
-
-bind_configure() {
-	local myeconfargs=(
-		AR="$(type -P $(tc-getAR))"
-		--prefix="${EPREFIX}"/usr
-		--sysconfdir=/etc/bind
-		--localstatedir=/var
-		--with-libtool
-		--enable-full-report
-		--without-readline
-		--with-openssl="${ESYSROOT}"/usr
-		$(use_with test cmocka)
-		# Removed in 9.17, drags in libunwind dependency too
-		--disable-backtrace
-		$(use_enable caps linux-caps)
-		$(use_enable dnsrps)
-		$(use_enable dnstap)
-		$(use_enable fixed-rrset)
-		$(use_with berkdb dlz-bdb "${ESYSROOT}"/usr)
-		$(use_with dlz dlopen)
-		$(use_with dlz dlz-filesystem)
-		$(use_with dlz dlz-stub)
-		$(use_with gssapi)
-		$(use_with json json-c)
-		$(use_with ldap dlz-ldap)
-		$(use_with mysql dlz-mysql)
-		$(use_with odbc dlz-odbc)
-		$(use_with postgres dlz-postgres)
-		$(use_with lmdb)
-		$(use_with xml libxml2)
-		$(use_with zlib)
-		"${@}"
-	)
-
-	# This is for users to start to migrate back to USE=geoip, rather than
-	# USE=geoip2
-	if use geoip ; then
-		myeconfargs+=( $(use_with geoip maxminddb) --enable-geoip )
-	elif use geoip2 ; then
-		# Added 2020/09/30
-		# Remove USE=geoip2 support after 2020/03/01
-		ewarn "USE=geoip2 is deprecated; update your USE flags!"
-		myeconfargs+=( $(use_with geoip2 maxminddb) --enable-geoip )
-	else
-		myeconfargs+=( --without-maxminddb --disable-geoip )
-	fi
-
-	# bug #158664
-	#gcc-specs-ssp && replace-flags -O[23s] -O
-
-	# To include db.h from proper path
-	use berkdb && append-flags "-I$(db_includedir)"
-
-	export BUILD_CC=$(tc-getBUILD_CC)
-	econf "${myeconfargs[@]}"
-
-	# bug #151839
-	echo '#undef SO_BSDCOMPAT' >> config.h || die
-}
-
-python_configure() {
-	pushd "${BUILD_DIR}" >/dev/null || die
-	bind_configure --with-python
-	popd >/dev/null || die
-}
-
-src_compile() {
-	default
-	use python && python_foreach_impl python_compile
-}
-
-python_compile() {
-	pushd "${BUILD_DIR}"/bin/python >/dev/null || die
-	emake
-	popd >/dev/null || die
-}
-
-src_test() {
-	# system tests ('emake test') require network configuration for IPs etc
-	# so we run the unit tests instead.
-	TEST_PARALLEL_JOBS="$(makeopts_jobs)" emake unit
-}
-
-src_install() {
-	default
-
-	dodoc CHANGES README
-
-	if use doc; then
-		docinto misc
-		dodoc -r doc/misc/
-
-		# might a 'html' useflag make sense?
-		docinto html
-		dodoc -r doc/arm/
-
-		docinto contrib
-		dodoc contrib/scripts/{nanny.pl,named-bootconf.sh}
-
-		# some handy-dandy dynamic dns examples
-		pushd "${ED}"/usr/share/doc/${PF} 1>/dev/null || die
-		tar xf "${DISTDIR}"/dyndns-samples.tbz2 || die
-		popd 1>/dev/null || die
-	fi
-
-	insinto /etc/bind
-	newins "${FILESDIR}"/named.conf-r8 named.conf
-
-	# ftp://ftp.rs.internic.net/domain/named.cache:
-	insinto /var/bind
-	newins "${FILESDIR}"/named.cache-r3 named.cache
-
-	insinto /var/bind/pri
-	newins "${FILESDIR}"/localhost.zone-r3 localhost.zone
-
-	newinitd "${FILESDIR}"/named.init-r14 named
-	newconfd "${FILESDIR}"/named.confd-r7 named
-
-	newenvd "${FILESDIR}"/10bind.env 10bind
-
-	# Let's get rid of those tools and their manpages since they're provided by bind-tools
-	rm -f "${ED}"/usr/share/man/man1/{dig,host,nslookup,delv,nsupdate}.1* || die
-	rm -f "${ED}"/usr/share/man/man8/nsupdate.8* || die
-	rm -f "${ED}"/usr/bin/{dig,host,nslookup,nsupdate} || die
-	rm -f "${ED}"/usr/sbin/{dig,host,nslookup,nsupdate} || die
-	for tool in dsfromkey importkey keyfromlabel keygen \
-	revoke settime signzone verify; do
-		rm -f "${ED}"/usr/{,s}bin/dnssec-"${tool}" || die
-		rm -f "${ED}"/usr/share/man/man8/dnssec-"${tool}".8* || die
-	done
-
-	# bug 405251, library archives aren't properly handled by --enable/disable-static
-	if ! use static-libs; then
-		find "${ED}" -type f -name '*.a' -delete || die
-	fi
-
-	# bug 405251
-	find "${ED}" -type f -name '*.la' -delete || die
-
-	use python && python_foreach_impl python_install
-
-	# bug 450406
-	dosym named.cache /var/bind/root.cache
-
-	dosym ../../var/bind/pri /etc/bind/pri
-	dosym ../../var/bind/sec /etc/bind/sec
-	dosym ../../var/bind/dyn /etc/bind/dyn
-	keepdir /var/bind/{pri,sec,dyn} /var/log/named
-
-	fowners root:named /{etc,var}/bind /var/log/named /var/bind/{sec,pri,dyn}
-	fowners root:named /var/bind/named.cache /var/bind/pri/localhost.zone /etc/bind/{bind.keys,named.conf}
-	fperms 0640 /var/bind/named.cache /var/bind/pri/localhost.zone /etc/bind/{bind.keys,named.conf}
-	fperms 0750 /etc/bind /var/bind/pri
-	fperms 0770 /var/log/named /var/bind/{,sec,dyn}
-
-	systemd_newunit "${FILESDIR}/named.service-r1" named.service
-	dotmpfiles "${FILESDIR}"/named.conf
-	exeinto /usr/libexec
-	doexe "${FILESDIR}/generate-rndc-key.sh"
-}
-
-python_install() {
-	pushd "${BUILD_DIR}"/bin/python >/dev/null || die
-	emake DESTDIR="${D}" install
-	python_scriptinto /usr/sbin
-	python_doscript dnssec-{checkds,coverage}
-	python_optimize
-	popd >/dev/null || die
-}
-
-pkg_postinst() {
-	tmpfiles_process named.conf
-
-	if [[ ! -f '/etc/bind/rndc.key' && ! -f '/etc/bind/rndc.conf' ]]; then
-		einfo "Using /dev/urandom for generating rndc.key"
-		/usr/sbin/rndc-confgen -a
-		chown root:named /etc/bind/rndc.key || die
-		chmod 0640 /etc/bind/rndc.key || die
-	fi
-
-	einfo
-	einfo "You can edit /etc/conf.d/named to customize named settings"
-	einfo
-	use mysql || use postgres || use ldap && {
-		elog "If your named depends on MySQL/PostgreSQL or LDAP,"
-		elog "uncomment the specified rc_named_* lines in your"
-		elog "/etc/conf.d/named config to ensure they'll start before bind"
-		einfo
-	}
-	einfo "If you'd like to run bind in a chroot AND this is a new"
-	einfo "install OR your bind doesn't already run in a chroot:"
-	einfo "1) Uncomment and set the CHROOT variable in /etc/conf.d/named."
-	einfo "2) Run \`emerge --config '=${CATEGORY}/${PF}'\`"
-	einfo
-
-	CHROOT=$(source /etc/conf.d/named 2>/dev/null; echo ${CHROOT})
-	if [[ -n ${CHROOT} ]]; then
-		elog "NOTE: As of net-dns/bind-9.4.3_p5-r1 the chroot part of the init-script got some major changes!"
-		elog "To enable the old behaviour (without using mount) uncomment the"
-		elog "CHROOT_NOMOUNT option in your /etc/conf.d/named config."
-		elog "If you decide to use the new/default method, ensure to make backup"
-		elog "first and merge your existing configs/zones to /etc/bind and"
-		elog "/var/bind because bind will now mount the needed directories into"
-		elog "the chroot dir."
-	fi
-}
-
-pkg_config() {
-	CHROOT=$(source /etc/conf.d/named; echo ${CHROOT})
-	CHROOT_NOMOUNT=$(source /etc/conf.d/named; echo ${CHROOT_NOMOUNT})
-	CHROOT_GEOIP=$(source /etc/conf.d/named; echo ${CHROOT_GEOIP})
-
-	if [[ -z "${CHROOT}" ]]; then
-		eerror "This config script is designed to automate setting up"
-		eerror "a chrooted bind/named. To do so, please first uncomment"
-		eerror "and set the CHROOT variable in '/etc/conf.d/named'."
-		die "Unset CHROOT"
-	fi
-	if [[ -d "${CHROOT}" ]]; then
-		ewarn "NOTE: As of net-dns/bind-9.4.3_p5-r1 the chroot part of the init-script got some major changes!"
-		ewarn "To enable the old behaviour (without using mount) uncomment the"
-		ewarn "CHROOT_NOMOUNT option in your /etc/conf.d/named config."
-		ewarn
-		ewarn "${CHROOT} already exists... some things might become overridden"
-		ewarn "press CTRL+C if you don't want to continue"
-		sleep 10
-	fi
-
-	echo; einfo "Setting up the chroot directory..."
-
-	mkdir -m 0750 -p ${CHROOT} || die
-	mkdir -m 0755 -p ${CHROOT}/{dev,etc,var/log,run} || die
-	mkdir -m 0750 -p ${CHROOT}/etc/bind || die
-	mkdir -m 0770 -p ${CHROOT}/var/{bind,log/named} ${CHROOT}/run/named/ || die
-
-	chown root:named \
-		${CHROOT} \
-		${CHROOT}/var/{bind,log/named} \
-		${CHROOT}/run/named/ \
-		${CHROOT}/etc/bind \
-		|| die
-
-	mknod ${CHROOT}/dev/null c 1 3 || die
-	chmod 0666 ${CHROOT}/dev/null || die
-
-	mknod ${CHROOT}/dev/zero c 1 5 || die
-	chmod 0666 ${CHROOT}/dev/zero || die
-
-	mknod ${CHROOT}/dev/urandom c 1 9 || die
-	chmod 0666 ${CHROOT}/dev/urandom || die
-
-	if [ "${CHROOT_NOMOUNT:-0}" -ne 0 ]; then
-		cp -a /etc/bind ${CHROOT}/etc/ || die
-		cp -a /var/bind ${CHROOT}/var/ || die
-	fi
-
-	if [ "${CHROOT_GEOIP:-0}" -eq 1 ]; then
-		if use geoip; then
-			mkdir -m 0755 -p ${CHROOT}/usr/share/GeoIP || die
-		elif use geoip2; then
-			mkdir -m 0755 -p ${CHROOT}/usr/share/GeoIP2 || die
-		fi
-	fi
-
-	elog "You may need to add the following line to your syslog-ng.conf:"
-	elog "source jail { unix-stream(\"${CHROOT}/dev/log\"); };"
-}
diff --git a/net-dns/bind/bind-9.16.39.ebuild b/net-dns/bind/bind-9.16.39.ebuild
deleted file mode 100644
index 1231d3725562..000000000000
--- a/net-dns/bind/bind-9.16.39.ebuild
+++ /dev/null
@@ -1,382 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-# Re dlz/mysql and threads, needs to be verified..
-# MySQL uses thread local storage in its C api. Thus MySQL
-# requires that each thread of an application execute a MySQL
-# thread initialization to setup the thread local storage.
-# This is impossible to do safely while staying within the DLZ
-# driver API. This is a limitation caused by MySQL, and not the DLZ API.
-# Because of this BIND MUST only run with a single thread when
-# using the MySQL driver.
-
-EAPI=8
-
-PYTHON_COMPAT=( python3_{9..11} )
-
-inherit python-r1 autotools multiprocessing toolchain-funcs flag-o-matic db-use systemd tmpfiles
-
-MY_PV="${PV/_p/-P}"
-MY_PV="${MY_PV/_rc/rc}"
-MY_P="${PN}-${MY_PV}"
-
-SDB_LDAP_VER="1.1.0-fc14"
-
-RRL_PV="${MY_PV}"
-
-# SDB-LDAP: http://bind9-ldap.bayour.com/
-
-DESCRIPTION="Berkeley Internet Name Domain - Name Server"
-HOMEPAGE="https://www.isc.org/software/bind https://gitlab.isc.org/isc-projects/bind9"
-SRC_URI="https://downloads.isc.org/isc/bind9/${PV}/${P}.tar.xz
-	doc? ( mirror://gentoo/dyndns-samples.tbz2 )"
-
-LICENSE="Apache-2.0 BSD BSD-2 GPL-2 HPND ISC MPL-2.0"
-SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux"
-# -berkdb by default re bug #602682
-IUSE="berkdb +caps +dlz dnstap doc dnsrps fixed-rrset geoip geoip2 gssapi
-json ldap lmdb mysql odbc postgres python selinux static-libs test xml +zlib"
-# sdb-ldap - patch broken
-# no PKCS11 currently as it requires OpenSSL to be patched, also see bug 409687
-RESTRICT="!test? ( test )"
-
-# Upstream dropped the old geoip library, but the BIND configuration for using
-# GeoIP remained the same.
-REQUIRED_USE="
-	postgres? ( dlz )
-	berkdb? ( dlz )
-	mysql? ( dlz )
-	odbc? ( dlz )
-	ldap? ( dlz )
-	dnsrps? ( dlz )
-	python? ( ${PYTHON_REQUIRED_USE} )
-"
-
-DEPEND="
-	acct-group/named
-	acct-user/named
-	berkdb? ( sys-libs/db:= )
-	dev-libs/openssl:=[-bindist(-)]
-	mysql? ( dev-db/mysql-connector-c:0= )
-	odbc? ( >=dev-db/unixODBC-2.2.6 )
-	ldap? ( net-nds/openldap:= )
-	postgres? ( dev-db/postgresql:= )
-	caps? ( >=sys-libs/libcap-2.1.0 )
-	xml? ( dev-libs/libxml2 )
-	geoip? ( dev-libs/libmaxminddb:= )
-	geoip2? ( dev-libs/libmaxminddb:= )
-	gssapi? ( virtual/krb5 )
-	json? ( dev-libs/json-c:= )
-	lmdb? ( dev-db/lmdb:= )
-	zlib? ( sys-libs/zlib )
-	dnstap? ( dev-libs/fstrm dev-libs/protobuf-c:= )
-	python? (
-		${PYTHON_DEPS}
-		dev-python/ply[${PYTHON_USEDEP}]
-	)
-	dev-libs/libuv:=
-"
-
-RDEPEND="${DEPEND}
-	selinux? ( sec-policy/selinux-bind )
-	sys-process/psmisc"
-
-BDEPEND="
-	test? (
-		dev-util/cmocka
-		dev-util/kyua
-	)
-"
-
-S="${WORKDIR}/${MY_P}"
-
-PATCHES=(
-	"${FILESDIR}/ldap-library-path-on-multilib-machines.patch"
-)
-
-src_prepare() {
-	default
-
-	# Should be installed by bind-tools
-	sed -i -r -e "s:(nsupdate|dig|delv) ::g" bin/Makefile.in || die
-
-	# bug #220361
-	rm aclocal.m4 || die
-	rm -rf libtool.m4/ || die
-	eautoreconf
-
-	use python && python_copy_sources
-}
-
-src_configure() {
-	bind_configure --without-python
-	use python && python_foreach_impl python_configure
-}
-
-bind_configure() {
-	local myeconfargs=(
-		AR="$(type -P $(tc-getAR))"
-		--prefix="${EPREFIX}"/usr
-		--sysconfdir=/etc/bind
-		--localstatedir=/var
-		--with-libtool
-		--enable-full-report
-		--without-readline
-		--with-openssl="${ESYSROOT}"/usr
-		$(use_with test cmocka)
-		# Removed in 9.17, drags in libunwind dependency too
-		--disable-backtrace
-		$(use_enable caps linux-caps)
-		$(use_enable dnsrps)
-		$(use_enable dnstap)
-		$(use_enable fixed-rrset)
-		$(use_with berkdb dlz-bdb "${ESYSROOT}"/usr)
-		$(use_with dlz dlopen)
-		$(use_with dlz dlz-filesystem)
-		$(use_with dlz dlz-stub)
-		$(use_with gssapi)
-		$(use_with json json-c)
-		$(use_with ldap dlz-ldap)
-		$(use_with mysql dlz-mysql)
-		$(use_with odbc dlz-odbc)
-		$(use_with postgres dlz-postgres)
-		$(use_with lmdb)
-		$(use_with xml libxml2)
-		$(use_with zlib)
-		"${@}"
-	)
-
-	# This is for users to start to migrate back to USE=geoip, rather than
-	# USE=geoip2
-	if use geoip ; then
-		myeconfargs+=( $(use_with geoip maxminddb) --enable-geoip )
-	elif use geoip2 ; then
-		# Added 2020/09/30
-		# Remove USE=geoip2 support after 2020/03/01
-		ewarn "USE=geoip2 is deprecated; update your USE flags!"
-		myeconfargs+=( $(use_with geoip2 maxminddb) --enable-geoip )
-	else
-		myeconfargs+=( --without-maxminddb --disable-geoip )
-	fi
-
-	# bug #158664
-	#gcc-specs-ssp && replace-flags -O[23s] -O
-
-	# To include db.h from proper path
-	use berkdb && append-flags "-I$(db_includedir)"
-
-	export BUILD_CC=$(tc-getBUILD_CC)
-	econf "${myeconfargs[@]}"
-
-	# bug #151839
-	echo '#undef SO_BSDCOMPAT' >> config.h || die
-}
-
-python_configure() {
-	pushd "${BUILD_DIR}" >/dev/null || die
-	bind_configure --with-python
-	popd >/dev/null || die
-}
-
-src_compile() {
-	default
-	use python && python_foreach_impl python_compile
-}
-
-python_compile() {
-	pushd "${BUILD_DIR}"/bin/python >/dev/null || die
-	emake
-	popd >/dev/null || die
-}
-
-src_test() {
-	# system tests ('emake test') require network configuration for IPs etc
-	# so we run the unit tests instead.
-	TEST_PARALLEL_JOBS="$(makeopts_jobs)" emake unit
-}
-
-src_install() {
-	default
-
-	dodoc CHANGES README
-
-	if use doc; then
-		docinto misc
-		dodoc -r doc/misc/
-
-		# might a 'html' useflag make sense?
-		docinto html
-		dodoc -r doc/arm/
-
-		docinto contrib
-		dodoc contrib/scripts/{nanny.pl,named-bootconf.sh}
-
-		# some handy-dandy dynamic dns examples
-		pushd "${ED}"/usr/share/doc/${PF} 1>/dev/null || die
-		tar xf "${DISTDIR}"/dyndns-samples.tbz2 || die
-		popd 1>/dev/null || die
-	fi
-
-	insinto /etc/bind
-	newins "${FILESDIR}"/named.conf-r8 named.conf
-
-	# ftp://ftp.rs.internic.net/domain/named.cache:
-	insinto /var/bind
-	newins "${FILESDIR}"/named.cache-r3 named.cache
-
-	insinto /var/bind/pri
-	newins "${FILESDIR}"/localhost.zone-r3 localhost.zone
-
-	newinitd "${FILESDIR}"/named.init-r14 named
-	newconfd "${FILESDIR}"/named.confd-r7 named
-
-	newenvd "${FILESDIR}"/10bind.env 10bind
-
-	# Let's get rid of those tools and their manpages since they're provided by bind-tools
-	rm -f "${ED}"/usr/share/man/man1/{dig,host,nslookup,delv,nsupdate}.1* || die
-	rm -f "${ED}"/usr/share/man/man8/nsupdate.8* || die
-	rm -f "${ED}"/usr/bin/{dig,host,nslookup,nsupdate} || die
-	rm -f "${ED}"/usr/sbin/{dig,host,nslookup,nsupdate} || die
-	for tool in dsfromkey importkey keyfromlabel keygen \
-	revoke settime signzone verify; do
-		rm -f "${ED}"/usr/{,s}bin/dnssec-"${tool}" || die
-		rm -f "${ED}"/usr/share/man/man8/dnssec-"${tool}".8* || die
-	done
-
-	# bug 405251, library archives aren't properly handled by --enable/disable-static
-	if ! use static-libs; then
-		find "${ED}" -type f -name '*.a' -delete || die
-	fi
-
-	# bug 405251
-	find "${ED}" -type f -name '*.la' -delete || die
-
-	use python && python_foreach_impl python_install
-
-	# bug 450406
-	dosym named.cache /var/bind/root.cache
-
-	dosym ../../var/bind/pri /etc/bind/pri
-	dosym ../../var/bind/sec /etc/bind/sec
-	dosym ../../var/bind/dyn /etc/bind/dyn
-	keepdir /var/bind/{pri,sec,dyn} /var/log/named
-
-	fowners root:named /{etc,var}/bind /var/log/named /var/bind/{sec,pri,dyn}
-	fowners root:named /var/bind/named.cache /var/bind/pri/localhost.zone /etc/bind/{bind.keys,named.conf}
-	fperms 0640 /var/bind/named.cache /var/bind/pri/localhost.zone /etc/bind/{bind.keys,named.conf}
-	fperms 0750 /etc/bind /var/bind/pri
-	fperms 0770 /var/log/named /var/bind/{,sec,dyn}
-
-	systemd_newunit "${FILESDIR}/named.service-r1" named.service
-	dotmpfiles "${FILESDIR}"/named.conf
-	exeinto /usr/libexec
-	doexe "${FILESDIR}/generate-rndc-key.sh"
-}
-
-python_install() {
-	pushd "${BUILD_DIR}"/bin/python >/dev/null || die
-	emake DESTDIR="${D}" install
-	python_scriptinto /usr/sbin
-	python_doscript dnssec-{checkds,coverage}
-	python_optimize
-	popd >/dev/null || die
-}
-
-pkg_postinst() {
-	tmpfiles_process named.conf
-
-	if [[ ! -f '/etc/bind/rndc.key' && ! -f '/etc/bind/rndc.conf' ]]; then
-		einfo "Using /dev/urandom for generating rndc.key"
-		/usr/sbin/rndc-confgen -a
-		chown root:named /etc/bind/rndc.key || die
-		chmod 0640 /etc/bind/rndc.key || die
-	fi
-
-	einfo
-	einfo "You can edit /etc/conf.d/named to customize named settings"
-	einfo
-	use mysql || use postgres || use ldap && {
-		elog "If your named depends on MySQL/PostgreSQL or LDAP,"
-		elog "uncomment the specified rc_named_* lines in your"
-		elog "/etc/conf.d/named config to ensure they'll start before bind"
-		einfo
-	}
-	einfo "If you'd like to run bind in a chroot AND this is a new"
-	einfo "install OR your bind doesn't already run in a chroot:"
-	einfo "1) Uncomment and set the CHROOT variable in /etc/conf.d/named."
-	einfo "2) Run \`emerge --config '=${CATEGORY}/${PF}'\`"
-	einfo
-
-	CHROOT=$(source /etc/conf.d/named 2>/dev/null; echo ${CHROOT})
-	if [[ -n ${CHROOT} ]]; then
-		elog "NOTE: As of net-dns/bind-9.4.3_p5-r1 the chroot part of the init-script got some major changes!"
-		elog "To enable the old behaviour (without using mount) uncomment the"
-		elog "CHROOT_NOMOUNT option in your /etc/conf.d/named config."
-		elog "If you decide to use the new/default method, ensure to make backup"
-		elog "first and merge your existing configs/zones to /etc/bind and"
-		elog "/var/bind because bind will now mount the needed directories into"
-		elog "the chroot dir."
-	fi
-}
-
-pkg_config() {
-	CHROOT=$(source /etc/conf.d/named; echo ${CHROOT})
-	CHROOT_NOMOUNT=$(source /etc/conf.d/named; echo ${CHROOT_NOMOUNT})
-	CHROOT_GEOIP=$(source /etc/conf.d/named; echo ${CHROOT_GEOIP})
-
-	if [[ -z "${CHROOT}" ]]; then
-		eerror "This config script is designed to automate setting up"
-		eerror "a chrooted bind/named. To do so, please first uncomment"
-		eerror "and set the CHROOT variable in '/etc/conf.d/named'."
-		die "Unset CHROOT"
-	fi
-	if [[ -d "${CHROOT}" ]]; then
-		ewarn "NOTE: As of net-dns/bind-9.4.3_p5-r1 the chroot part of the init-script got some major changes!"
-		ewarn "To enable the old behaviour (without using mount) uncomment the"
-		ewarn "CHROOT_NOMOUNT option in your /etc/conf.d/named config."
-		ewarn
-		ewarn "${CHROOT} already exists... some things might become overridden"
-		ewarn "press CTRL+C if you don't want to continue"
-		sleep 10
-	fi
-
-	echo; einfo "Setting up the chroot directory..."
-
-	mkdir -m 0750 -p ${CHROOT} || die
-	mkdir -m 0755 -p ${CHROOT}/{dev,etc,var/log,run} || die
-	mkdir -m 0750 -p ${CHROOT}/etc/bind || die
-	mkdir -m 0770 -p ${CHROOT}/var/{bind,log/named} ${CHROOT}/run/named/ || die
-
-	chown root:named \
-		${CHROOT} \
-		${CHROOT}/var/{bind,log/named} \
-		${CHROOT}/run/named/ \
-		${CHROOT}/etc/bind \
-		|| die
-
-	mknod ${CHROOT}/dev/null c 1 3 || die
-	chmod 0666 ${CHROOT}/dev/null || die
-
-	mknod ${CHROOT}/dev/zero c 1 5 || die
-	chmod 0666 ${CHROOT}/dev/zero || die
-
-	mknod ${CHROOT}/dev/urandom c 1 9 || die
-	chmod 0666 ${CHROOT}/dev/urandom || die
-
-	if [ "${CHROOT_NOMOUNT:-0}" -ne 0 ]; then
-		cp -a /etc/bind ${CHROOT}/etc/ || die
-		cp -a /var/bind ${CHROOT}/var/ || die
-	fi
-
-	if [ "${CHROOT_GEOIP:-0}" -eq 1 ]; then
-		if use geoip; then
-			mkdir -m 0755 -p ${CHROOT}/usr/share/GeoIP || die
-		elif use geoip2; then
-			mkdir -m 0755 -p ${CHROOT}/usr/share/GeoIP2 || die
-		fi
-	fi
-
-	elog "You may need to add the following line to your syslog-ng.conf:"
-	elog "source jail { unix-stream(\"${CHROOT}/dev/log\"); };"
-}
diff --git a/net-dns/bind/bind-9.16.41.ebuild b/net-dns/bind/bind-9.16.48.ebuild
index 66dc6a058d92..7950e399b264 100644
--- a/net-dns/bind/bind-9.16.41.ebuild
+++ b/net-dns/bind/bind-9.16.48.ebuild
@@ -12,9 +12,10 @@
 
 EAPI=8
 
-PYTHON_COMPAT=( python3_{9..11} )
+PYTHON_COMPAT=( python3_{10..12} )
 
-inherit python-r1 autotools multiprocessing toolchain-funcs flag-o-matic db-use systemd tmpfiles
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/isc.asc
+inherit python-r1 autotools multiprocessing toolchain-funcs flag-o-matic db-use systemd tmpfiles verify-sig
 
 MY_PV="${PV/_p/-P}"
 MY_PV="${MY_PV/_rc/rc}"
@@ -28,17 +29,21 @@ RRL_PV="${MY_PV}"
 
 DESCRIPTION="Berkeley Internet Name Domain - Name Server"
 HOMEPAGE="https://www.isc.org/software/bind https://gitlab.isc.org/isc-projects/bind9"
-SRC_URI="https://downloads.isc.org/isc/bind9/${PV}/${P}.tar.xz
-	doc? ( mirror://gentoo/dyndns-samples.tbz2 )"
+SRC_URI="
+	https://downloads.isc.org/isc/bind9/${PV}/${P}.tar.xz
+	doc? ( mirror://gentoo/dyndns-samples.tbz2 )
+	verify-sig? ( https://downloads.isc.org/isc/bind9/${PV}/${P}.tar.xz.asc )
+"
+S="${WORKDIR}/${MY_P}"
 
 LICENSE="Apache-2.0 BSD BSD-2 GPL-2 HPND ISC MPL-2.0"
 SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux"
 # -berkdb by default re bug #602682
-IUSE="berkdb +caps +dlz dnstap doc dnsrps fixed-rrset geoip geoip2 gssapi
-json ldap lmdb mysql odbc postgres python selinux static-libs test xml +zlib"
+IUSE="berkdb +caps +dlz dnstap doc dnsrps fixed-rrset geoip geoip2 gssapi"
+IUSE+=" json ldap lmdb mysql odbc postgres python selinux static-libs test xml +zlib"
 # sdb-ldap - patch broken
-# no PKCS11 currently as it requires OpenSSL to be patched, also see bug 409687
+# no PKCS11 currently as it requires OpenSSL to be patched, also see bug #409687
 RESTRICT="!test? ( test )"
 
 # Upstream dropped the old geoip library, but the BIND configuration for using
@@ -56,6 +61,7 @@ REQUIRED_USE="
 DEPEND="
 	acct-group/named
 	acct-user/named
+	dev-libs/libuv:=
 	berkdb? ( sys-libs/db:= )
 	dev-libs/openssl:=[-bindist(-)]
 	mysql? ( dev-db/mysql-connector-c:0= )
@@ -75,22 +81,20 @@ DEPEND="
 		${PYTHON_DEPS}
 		dev-python/ply[${PYTHON_USEDEP}]
 	)
-	dev-libs/libuv:=
 "
-
-RDEPEND="${DEPEND}
+RDEPEND="
+	${DEPEND}
+	sys-process/psmisc
 	selinux? ( sec-policy/selinux-bind )
-	sys-process/psmisc"
-
+"
 BDEPEND="
 	test? (
 		dev-util/cmocka
 		dev-util/kyua
 	)
+	verify-sig? ( sec-keys/openpgp-keys-isc )
 "
 
-S="${WORKDIR}/${MY_P}"
-
 PATCHES=(
 	"${FILESDIR}/ldap-library-path-on-multilib-machines.patch"
 )
@@ -192,15 +196,13 @@ src_compile() {
 }
 
 python_compile() {
-	pushd "${BUILD_DIR}"/bin/python >/dev/null || die
-	emake
-	popd >/dev/null || die
+	emake -C "${BUILD_DIR}"/bin/python
 }
 
 src_test() {
 	# system tests ('emake test') require network configuration for IPs etc
 	# so we run the unit tests instead.
-	TEST_PARALLEL_JOBS="$(makeopts_jobs)" emake unit
+	TEST_PARALLEL_JOBS="$(makeopts_jobs)" emake -Onone unit
 }
 
 src_install() {
@@ -230,7 +232,7 @@ src_install() {
 
 	# ftp://ftp.rs.internic.net/domain/named.cache:
 	insinto /var/bind
-	newins "${FILESDIR}"/named.cache-r3 named.cache
+	newins "${FILESDIR}"/named.cache-r4 named.cache
 
 	insinto /var/bind/pri
 	newins "${FILESDIR}"/localhost.zone-r3 localhost.zone
diff --git a/net-dns/bind/files/named.cache-r4 b/net-dns/bind/files/named.cache-r4
new file mode 100644
index 000000000000..860b808e119a
--- /dev/null
+++ b/net-dns/bind/files/named.cache-r4
@@ -0,0 +1,92 @@
+;       This file holds the information on root name servers needed to 
+;       initialize cache of Internet domain name servers
+;       (e.g. reference this file in the "cache  .  <file>"
+;       configuration file of BIND domain name servers). 
+; 
+;       This file is made available by InterNIC 
+;       under anonymous FTP as
+;           file                /domain/named.cache 
+;           on server           FTP.INTERNIC.NET
+;       -OR-                    RS.INTERNIC.NET
+;
+;       last update:     January 24, 2024
+;       related version of root zone:     2024012401
+; 
+; FORMERLY NS.INTERNIC.NET 
+;
+.                        3600000      NS    A.ROOT-SERVERS.NET.
+A.ROOT-SERVERS.NET.      3600000      A     198.41.0.4
+A.ROOT-SERVERS.NET.      3600000      AAAA  2001:503:ba3e::2:30
+; 
+; FORMERLY NS1.ISI.EDU 
+;
+.                        3600000      NS    B.ROOT-SERVERS.NET.
+B.ROOT-SERVERS.NET.      3600000      A     170.247.170.2
+B.ROOT-SERVERS.NET.      3600000      AAAA  2801:1b8:10::b
+; 
+; FORMERLY C.PSI.NET 
+;
+.                        3600000      NS    C.ROOT-SERVERS.NET.
+C.ROOT-SERVERS.NET.      3600000      A     192.33.4.12
+C.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:2::c
+; 
+; FORMERLY TERP.UMD.EDU 
+;
+.                        3600000      NS    D.ROOT-SERVERS.NET.
+D.ROOT-SERVERS.NET.      3600000      A     199.7.91.13
+D.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:2d::d
+; 
+; FORMERLY NS.NASA.GOV
+;
+.                        3600000      NS    E.ROOT-SERVERS.NET.
+E.ROOT-SERVERS.NET.      3600000      A     192.203.230.10
+E.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:a8::e
+; 
+; FORMERLY NS.ISC.ORG
+;
+.                        3600000      NS    F.ROOT-SERVERS.NET.
+F.ROOT-SERVERS.NET.      3600000      A     192.5.5.241
+F.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:2f::f
+; 
+; FORMERLY NS.NIC.DDN.MIL
+;
+.                        3600000      NS    G.ROOT-SERVERS.NET.
+G.ROOT-SERVERS.NET.      3600000      A     192.112.36.4
+G.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:12::d0d
+; 
+; FORMERLY AOS.ARL.ARMY.MIL
+;
+.                        3600000      NS    H.ROOT-SERVERS.NET.
+H.ROOT-SERVERS.NET.      3600000      A     198.97.190.53
+H.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:1::53
+; 
+; FORMERLY NIC.NORDU.NET
+;
+.                        3600000      NS    I.ROOT-SERVERS.NET.
+I.ROOT-SERVERS.NET.      3600000      A     192.36.148.17
+I.ROOT-SERVERS.NET.      3600000      AAAA  2001:7fe::53
+; 
+; OPERATED BY VERISIGN, INC.
+;
+.                        3600000      NS    J.ROOT-SERVERS.NET.
+J.ROOT-SERVERS.NET.      3600000      A     192.58.128.30
+J.ROOT-SERVERS.NET.      3600000      AAAA  2001:503:c27::2:30
+; 
+; OPERATED BY RIPE NCC
+;
+.                        3600000      NS    K.ROOT-SERVERS.NET.
+K.ROOT-SERVERS.NET.      3600000      A     193.0.14.129
+K.ROOT-SERVERS.NET.      3600000      AAAA  2001:7fd::1
+; 
+; OPERATED BY ICANN
+;
+.                        3600000      NS    L.ROOT-SERVERS.NET.
+L.ROOT-SERVERS.NET.      3600000      A     199.7.83.42
+L.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:9f::42
+; 
+; OPERATED BY WIDE
+;
+.                        3600000      NS    M.ROOT-SERVERS.NET.
+M.ROOT-SERVERS.NET.      3600000      A     202.12.27.33
+M.ROOT-SERVERS.NET.      3600000      AAAA  2001:dc3::35
+; End of file
\ No newline at end of file
diff --git a/net-dns/nsd/Manifest b/net-dns/nsd/Manifest
index 08a85a6675a8..d14741b883fe 100644
--- a/net-dns/nsd/Manifest
+++ b/net-dns/nsd/Manifest
@@ -1,4 +1,5 @@
 AUX nsd-4.7.0-no-bind8-stats-no-ssl.patch 724 BLAKE2B ed9b6014a37e819f89624928a50499163f41cd65e881f5d835cbb9c7d9613dd9e24a790f69ae30135d95b8e5aefa10c606f6a47750254f3d89d0259ae780921f SHA512 3823eb145aa5c6b55992c498417d07643e85255d6033ae7444c51e2432475620f46750681ee9cf758fd7f2fc5336a9f7906d57fb8c78940641d88a1dff8311f1
+AUX nsd-4.8.0-implausible-stats.patch 760 BLAKE2B ae6d75c8f2ad17fa5f6c8ba1cbaa6e812a1650c3b913b7e86aa4b479c264c8fae02d5713bb21ee3bace5c832e5b96f762772f70eb8aa24d7ce6c9fd4b04756dc SHA512 2b40047b8277e2fe18afd7aa1aef5b91244478aa38df04e094ded9ae7c1bd49f62ae940831b1c144c7cd9b4f26957c4e726001d3afdd48e51b940bd36c2ee9bf
 AUX nsd.initd-r1 1383 BLAKE2B b90de2ebef09a4f9050f6e95f5faf659c62910462aba1179daccde4e63a3972124247e6e8ce725c4dbd34a7fcd4f14b40899d7b59ba4937bdc59c493f6f7e173 SHA512 f775c78b529c5c7f1130035ea9c6cf1c1e9c1790c5df84fafd86a41294748a46c82b66c58df8385f8f4bbca8113427c665051aeec5720073bd9823607c9f8ce1
 AUX nsd.munin-conf 23 BLAKE2B 0b08804b2218d77ea925d4c9e26e73649b453b923d6d7b1e1df39ceb58b92a44c48cb21583a480e622f72d07650f410f2e0703f1d16af08152aed16982ab8da2 SHA512 c06d0b035387e7be79cfa8fedf8afb3900772146c6d4090ac39ea2ef165772d875b222ef467bd73422078ef57818bcc931ca67fa290bd99a7a9456efa5448853
 AUX nsd.service 272 BLAKE2B 66a7d4132246589f71341afd98361f6b02082be3d4e230c86ae690876a797ea0a4580b29892d91feba2785ea933a053f862e0d00f2c8a8c09ab907386c39a03c SHA512 fbca86887bfc36d61af06992cc98b3f3cb33c39274fbdc1e53d489bdcc767993911fab27a20244c3878b36bacbd1644a552364b2f7bf4d48e6eb247d0eecdf0f
@@ -6,6 +7,7 @@ AUX nsd_munin_.patch 542 BLAKE2B 13ff49c41683d5bf505e257cd17bf5f3ad06662c00032d7
 DIST nsd-4.7.0.tar.gz 1289477 BLAKE2B d3949c8b65376ea78c700efaeb988acbfac5a5ba338f9bf29035176a7da6730ee8b7a2b6bfc5573ad178db80166ca74d71d313bf3d405acc666bf87f17dac63b SHA512 387e66993517c015ea49fc7a985c1f746623ae30a82bd01f224efbdb7c58d1d2f3e5a5a3574203959047876c632ec464b6682d1644f0e0f157ec0e6fb3f0cdbb
 DIST nsd-4.8.0.tar.gz 1273228 BLAKE2B d1e6a5e8fb158bb32081bc7674d957e3f5a596ed10ee89dd6a5f6af9a79a8c130f2de7070345bee69cb7798e9f373d856a9336a9e9f65f733ff45e15e94833ff SHA512 13c9cffffe6adfcbabf744ee2effebe6ae265d83476345a1edb60dc9c6d7f838a5e239e9b18e667924e5e76b74b2caac63818fcaecf7f0fa651ff21736174a46
 EBUILD nsd-4.7.0.ebuild 3223 BLAKE2B 7493eeff0fae1bfcb965aab5437cae7dc2fa6ff2240da6afa19e9088dc65800befd23972d33442952818d40d249377fb9d56ae3c4bc98d64ad0ba5a6102d1fec SHA512 457b48d3be50fe32837e706fd44700a65dc8a0a1772adcd23446c8332486315f94b63b59aa3ff89e13dc45211a8d8ac7248bb703dd76c533e2c4115b540827ea
+EBUILD nsd-4.8.0-r1.ebuild 3206 BLAKE2B 6ec59d0cbbeafd04cc51974adf8fad089b13955e4f144e22124e6c65145ab29ed5bf4ebe4c705cb9be19499ac99f1487892e29b373c29ced640a3cf3e1215a74 SHA512 53f4ef66ba2e2e383204a17ef0d8ec21c02b8bfde6b2cea6f388b4e80e88e4d71f3d18d0c5741740f4f56e79d660eda5085dd23cac6aff09834016ea5cf1168d
 EBUILD nsd-4.8.0.ebuild 3162 BLAKE2B 41b1809b4714230e89c9633513fdce0f027b0bce3300a4167ee83fd7055741faf7aebca1b5ecbf47eae1e9b12284d9c43bd3f5ed2344549c77bac33f65ad58ed SHA512 1304030fead7260f40a7a1fe7e0b0172160f6fa407aa77e9e25eb32480cfa06bcbd40de174e1735a03df71d13a3fb0eb8781362492af14c74e9f2ac82babe6e2
 EBUILD nsd-9999.ebuild 3162 BLAKE2B 41b1809b4714230e89c9633513fdce0f027b0bce3300a4167ee83fd7055741faf7aebca1b5ecbf47eae1e9b12284d9c43bd3f5ed2344549c77bac33f65ad58ed SHA512 1304030fead7260f40a7a1fe7e0b0172160f6fa407aa77e9e25eb32480cfa06bcbd40de174e1735a03df71d13a3fb0eb8781362492af14c74e9f2ac82babe6e2
 MISC metadata.xml 970 BLAKE2B bdadf7cb1a1a444aff44b9f1ad7ea64a5b01d72888d91662f55cb321a94f8b03ea9f050e78df9cc2a81e2c538a81d463c95f998b8c7f65c192425d3a5917a25e SHA512 bc769f335f452a8f81f83d8333bf3db11620212b156eac80ddd9622312605b80b56d4fa6ebdb609b7c1999cc995672350b0181666c012ee69e21ff5b511af48d
diff --git a/net-dns/nsd/files/nsd-4.8.0-implausible-stats.patch b/net-dns/nsd/files/nsd-4.8.0-implausible-stats.patch
new file mode 100644
index 000000000000..318f2a5e2f55
--- /dev/null
+++ b/net-dns/nsd/files/nsd-4.8.0-implausible-stats.patch
@@ -0,0 +1,22 @@
+https://github.com/NLnetLabs/nsd/issues/313
+https://github.com/NLnetLabs/nsd/commit/ccc1bbc28abd3a723c25cb8dcc735731926979d0
+
+From ccc1bbc28abd3a723c25cb8dcc735731926979d0 Mon Sep 17 00:00:00 2001
+From: "W.C.A. Wijngaards" <wouter@nlnetlabs.nl>
+Date: Tue, 6 Feb 2024 11:44:24 +0100
+Subject: [PATCH] - Fix #313: nsd 4.8 stats with implausible spikes.
+
+--- a/remote.c
++++ b/remote.c
+@@ -2932,7 +2932,9 @@ process_stats(RES* ssl, xfrd_state_type* xfrd, int peek)
+ 	process_stats_manage_clear(xfrd, stats, peek);
+ 	process_stats_add_total(xfrd, &total, stats);
+ 	print_stats(ssl, xfrd, &stattime, !peek, &total, zonestats);
+-	xfrd->nsd->rc->stats_time = stattime;
++	if(!peek) {
++		xfrd->nsd->rc->stats_time = stattime;
++	}
+ 
+ 	free(stats);
+ #ifdef USE_ZONE_STATS
+
diff --git a/net-dns/nsd/nsd-4.8.0-r1.ebuild b/net-dns/nsd/nsd-4.8.0-r1.ebuild
new file mode 100644
index 000000000000..52ac334d942c
--- /dev/null
+++ b/net-dns/nsd/nsd-4.8.0-r1.ebuild
@@ -0,0 +1,128 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit autotools systemd
+
+DESCRIPTION="An authoritative only, high performance, open source name server"
+HOMEPAGE="https://www.nlnetlabs.nl/projects/nsd"
+
+if [[ ${PV} == *9999 ]] ; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/NLnetLabs/nsd.git"
+else
+	# version voodoo needed only for non-release tarballs: 4.0.0_rc1 => 4.0.0rc1
+	MY_PV="${PV/_beta/b}"
+	MY_PV="${MY_PV/_rc/rc}"
+	MY_P="${PN}-${MY_PV}"
+
+	if [[ ${PV} != *_beta* && ${PV} != *_rc* ]] ; then
+		SRC_URI="https://www.nlnetlabs.nl/downloads/${PN}/${MY_P}.tar.gz"
+		S="${WORKDIR}"/${MY_P}
+
+		KEYWORDS="~amd64 ~x86"
+	fi
+fi
+
+LICENSE="BSD"
+SLOT="0"
+IUSE="bind8-stats debug dnstap libevent minimal-responses mmap munin +nsec3 ratelimit root-server ssl systemd"
+
+RDEPEND="
+	acct-group/nsd
+	acct-user/nsd
+	dnstap? (
+		dev-libs/fstrm
+		dev-libs/protobuf-c
+	)
+	libevent? ( dev-libs/libevent )
+	munin? ( net-analyzer/munin )
+	ssl? ( dev-libs/openssl:0= )
+	systemd? ( sys-apps/systemd )
+"
+DEPEND="${RDEPEND}"
+BDEPEND="
+	app-alternatives/lex
+	app-alternatives/yacc
+	systemd? ( virtual/pkgconfig )
+"
+
+PATCHES=(
+	# Fix the paths in the munin plugin to match our install
+	"${FILESDIR}"/nsd_munin_.patch
+	"${FILESDIR}"/${P}-implausible-stats.patch
+)
+
+src_prepare() {
+	default
+
+	# Required to get correct pkg-config macros with USE="systemd"
+	# See bugs #663618 and #758050
+	eautoreconf
+}
+
+src_configure() {
+	local myeconfargs=(
+		--enable-ipv6
+		--enable-largefile
+		--enable-pie
+		--enable-relro-now
+		--enable-tcp-fastopen
+
+		--with-dbfile="${EPREFIX}"/var/db/nsd/nsd.db
+		--with-logfile="${EPREFIX}"/var/log/nsd.log
+		--with-pidfile="${EPREFIX}"/run/nsd/nsd.pid
+		--with-xfrdfile="${EPREFIX}"/var/db/nsd/xfrd.state
+		--with-xfrdir="${EPREFIX}"/var/db/nsd
+		--with-zonelistfile="${EPREFIX}"/var/db/nsd/zone.list
+		--with-zonesdir="${EPREFIX}"/var/lib/nsd
+
+		$(use_enable bind8-stats)
+		$(use_enable bind8-stats zone-stats)
+		$(use_enable debug checking)
+		$(use_enable dnstap)
+		$(use_enable minimal-responses)
+		$(use_enable mmap)
+		$(use_enable nsec3)
+		$(use_enable ratelimit)
+		$(use_enable root-server)
+		$(use_enable systemd)
+		$(use_with libevent)
+		$(use_with ssl)
+	)
+
+	econf "${myeconfargs[@]}"
+}
+
+src_install() {
+	emake DESTDIR="${D}" install
+
+	dodoc doc/{ChangeLog,CREDITS,NSD-4-features,NSD-FOR-BIND-USERS,README,RELNOTES,REQUIREMENTS}
+
+	newinitd "${FILESDIR}"/nsd.initd-r1 nsd
+
+	# Install munin plugin and config
+	if use munin ; then
+		exeinto /usr/libexec/munin/plugins
+		doexe contrib/nsd_munin_
+		insinto /etc/munin/plugin-conf.d
+		newins "${FILESDIR}"/nsd.munin-conf nsd_munin
+	fi
+
+	systemd_dounit "${FILESDIR}"/nsd.service
+
+	# Remove the /run directory that usually resides on tmpfs and is
+	# being taken care of by the nsd init script anyway (checkpath)
+	rm -r "${ED}"/run || die "Failed to remove /run"
+
+	keepdir /var/db/${PN}
+}
+
+pkg_postinst() {
+	# database directory, writable by nsd for database updates and zone transfers
+	install -d -m 750 -o nsd -g nsd "${EROOT}"/var/db/nsd
+
+	# zones directory, writable by nsd for zone file updates (nsd-control write)
+	install -d -m 750 -o nsd -g nsd "${EROOT}"/var/lib/nsd
+}