gentoo resync : 15.09.2018

11 files changed, 554 insertions, 23 deletions

diff --git a/net-dns/Manifest.gz b/net-dns/Manifest.gz
index 2401ec147e30..f7d5280c3f34 100644
--- a/net-dns/Manifest.gz
+++ b/net-dns/Manifest.gz
diff --git a/net-dns/unbound/Manifest b/net-dns/unbound/Manifest
index 8f2c442dd45b..238d3fbc0202 100644
--- a/net-dns/unbound/Manifest
+++ b/net-dns/unbound/Manifest
@@ -1,7 +1,10 @@
 AUX 0001-fix-fail-to-start-on-Linux-LTS-3.14.X-ignore.patch 2032 BLAKE2B 26feb157c94ec4429a480a02ef7f178c98f9f7296dcbbda590619390fe71e9d5b9406ed0428a766da1a189b6672a1fc9beeefc5418013136becfbfb037afa4ef SHA512 1a28fca9fa39cf4c07e2f9b75058ca1d00a176ab4f0b96130fbe4773f503f39f7f16518e82f58d289001dd468e53e54f1e208e99eec713fda0efd35517c4bcb3
 AUX unbound-1.4.12-gentoo.patch 639 BLAKE2B b1541fd917de50c131d161de92ce3db6dd4627f01a69dbd71b8954f7eeedd2bec8b47e7607e088516a877de610bd64c6ce9d1ba0910ba32be4ae137bcbddf63d SHA512 81292d898284c27e0b30a90816d283d2fffd5810afb38b5a79ff4acc94d82c91bd5414d177f11745c5ee7e56d1600a67bdc4d7395504ff6266103b4e018baf6c
-AUX unbound-1.5.7-trust-anchor-file.patch 632 BLAKE2B 104cd775d77bc790235912c9293a1d7a73e9499f293906f11674517a9c7b13ffd274a1c4dff6af5c57cb82d562a122c106865166203bd14ac469ecc8f552402a SHA512 fe9cb259a17452ab84df98eb8caaaa389e40e149e4de6f1245e78c350d1c6af42d1b094be6779ec19ce5ea11f86e102ae9767c8785d54cfa9746390c73e0f329
+AUX unbound-1.5.7-trust-anchor-file.patch 847 BLAKE2B ca8f093671264108c1da772e161ddf948cd27cdf4d3b6189023a6a9642ee308ab361befcab923ca61a21c4b151252f409177c8247ca683e63133284bd65efbba SHA512 bfbdd947cb3dda8d1dd009eb476fb2934fca80236e617f1596f308a063c575196e75c67b22bfbd739c06318d3227c9b2838fba0f381f8c73fdf5b7231cd1d746
+AUX unbound-1.6.3-pkg-config.patch 247 BLAKE2B af1a175a3944137fc7f4f4932182df5b278b7d88c4299e7ac5e520107fcfb5180d7e548c70b50794389d2c1406309f88e118acf9e065ab67cbb4c78fc0e4186f SHA512 06d8910ae6065c5a2bb2cc5a1935ae98688148b9c0af09622161b647775de00027ea4a22cb0d6b94f21d329c2d59ee56f67b073ee4042fbd4f78790d0c438ad7
 AUX unbound-anchor.service 263 BLAKE2B 098bdc6e06607e57980e0367496fd9a2fc02ef19611ac4474d703624c92df9c2e86f4dbb116622babcd7975b2e1353f6156d46bcc5639daabef648d670806364 SHA512 c0f8ff2df106d1f05786cf5d69b48cdf69ba2fd42645bf6b7fa2d34d6c3fdd1608fb470c4fb0216164386e8b22977292ae8932c784a6967774e3daae1b8aeb95
+AUX unbound-r1.confd 1553 BLAKE2B b3768275bd3f79f0076e9d80e9456c0829e42ba9bf815c70354e8386881147cc1afad6937ba7a2217845f70139cafd02f44150eaa5dd5d87f397a347f68078b0 SHA512 a6baf20b9911734b69784c393c8f38a0bf41c9621ab9332761ecb8b5fdcebf18be7f30a5a77bf3755aa45222b2f27f810a762436c43b03dd74e6806e04d5a90f
+AUX unbound-r1.initd 3901 BLAKE2B d8db1b5342781566f57d801d077aec20d7911a39d5a453f981b1a3400a18dfb8d10593889885bb9211d458a4165dded625bba2e7313c8d98fdb1beb585ed63d1 SHA512 ec3520094a679fee962244364d8093b471e7edd5fce434c6d307854952f2ad9d2f041ce5fd5f23ece93a856d59a966daaf5abc114b7d1f3519b930b2e8f14f62
 AUX unbound.confd 171 BLAKE2B 55e7b5379d50375ce0b6127cc63a09acea523a54cf1f4a8048534c9f26a87835dd809ee91ffa1ccc70e798079f75b303b7d1775666308b239ef94ec39551453c SHA512 e3e4c7f97c13d133724417a70e4f20dac6f1f4b5a4e2e573c410148059d9f722589249b3dd4668069d4e324abef60f5981f20b1797623f37db9c9422410dc13f
 AUX unbound.initd 1370 BLAKE2B 448e75551621df02899e4eb86a107da3dbed0510459931f749d0775c6c232ede14f359e47b6f072d71f0da60b54c024a7e02a283b47d432e020e3434b78f9534 SHA512 ee28d0fdc0abd10fbdeb3d2d01a6f06f4bfa83c78f0d64290cf187a76b31fee8f838c051ae962d90bf7c154678c3f866161564257f1834454e681775fd82fc49
 AUX unbound.service 247 BLAKE2B d986319f9b43600d4f6443f50e214efd39fd20be6a7067b55f98b82cb5d2c12c85b7db2a3c9ced0caf3db303f1ff0fd4eff511dbede3ab101e4b558681872351 SHA512 7904225d0e9fb3ea5b97521ed24f24fcc4db650cfff8523b896ddd9edfccbd61e817775ad0449acf30d02dba5f714d633b60cace6010d472f438df7c22381dfc
@@ -16,6 +19,8 @@ DIST unbound-1.6.7.tar.gz 5466931 BLAKE2B 57a051d5ac6d7fbc3d51613305651987670d0f
 DIST unbound-1.6.8.tar.gz 5467536 BLAKE2B 06caffbd905c339b3d0667382114bb3e5d5da90988402c8f488f789f9bf6ab87377e6a26aa083a7e9ba3d023f37d3eeba1e069adf8a8a266b23fb8361aeb6e26 SHA512 653d88d5dbc8cf25f7261e4a9869b6591843c7ff27b5d63f979a94505daafbbb61e05d46bedd2d01230355d5f08dd9fe14ed04c5c7340f3f27581b61ad6edfa3
 DIST unbound-1.7.0.tar.gz 5538228 BLAKE2B a825e2cbef74b3a78f9802056d6f0992f77e0d40d4d28889c98b9ffa224ec3281b6873eab59134dcca8dc56bdd17202b3817dd28ab30d0a0bb72d749426b7675 SHA512 49b07643da2a89d8ceedce1295f550f74a76f4f11c2df54df55e9c42f03bad1b133789c7b36fb3c4f37d6b331ac302ecfd1249e8ebaaa4333beda8fa250b61d9
 DIST unbound-1.7.1.tar.gz 5565938 BLAKE2B 423dde8a13ea3539d86eade96507e6cdb4ac816393e99f58b4e0dc74a79c31bae57c87924ef737a567cc338d02d672f6c059c86d2f28a634f06e5f9a339f4260 SHA512 99a68abf1f60f6ea80cf2973906df44da9c577d8cac969824af1ce9ca385a2e84dd684937480da87cb73c7dc41ad5c00b0013ec74103eadb8fd7dc6f98a89255
+DIST unbound-1.7.3.tar.gz 5570604 BLAKE2B 93a4e7cc0e13b3da1057ce4e4518ab2363f03bff7c820095ed30b5fccd2f4245cfade6bf68a424a090967053c7fd727f33352c9e8004bb05d907a878d69c2517 SHA512 34b2e93660e519b2eccefef26a6c7ac09fa3312384cc3bc449ff2b10743bd86bfeb36ec19d35eb913f8d0a3d91ad7923260a66fc799f28b0a2cc06741d80f27a
+DIST unbound-1.8.0.tar.gz 5609213 BLAKE2B 41e464df60e03d502f13758e75f9143658b2a496c4fad69804d9d404e23a8d4b5480cc09048197f8593e37feffdffaea33b18a06d864d0d35e986169b49f42e4 SHA512 6c46f5b86b5bd98a7b549b660173d487e59e65385cebd7bc29429b4fee69f2b490651a409c57b072b9b604fa98e289fa82eeecfea8779900038c25b28a6bd064
 EBUILD unbound-1.5.1-r2.ebuild 3427 BLAKE2B 193c35ecb00ae6303e6ab97852f79dffdf2bef64ce0b7c6e961370eb87d9506569e8aadfa6386624ce121162380b24fde713b36865b18bf228aacb3651defde8 SHA512 d3630f81fd44b40f5deb155473dc5835cc68e444be26afd0207fa734f285b566694b92dc073185cb24c9588a0ca5cb9ebf9c9268c2725c24a6c61d7ca73d1bcf
 EBUILD unbound-1.5.10.ebuild 3465 BLAKE2B 765d3f8f6a987a22195a235e515fb4fd29005a8e2b8d2eeadc9328993ba41d95655db10e1f8426b449311b08516b8dbd4abae382bf6d9b2f3608716c7f57f30c SHA512 28fb9da2c9bf08fbdd8e440c7c0f61da5ef25f7ca179b18e7c189e5c23f70dea295e1dd9b0fa289c75f5a4ee24ed9e1b3248f62fb0dc05d78068f22c00d100a7
 EBUILD unbound-1.6.3.ebuild 3689 BLAKE2B 8bdfd0f5b48ed66d7eb167e187cac4c64c3c0a044f0523662f253514717a273671fa15e6e931ec03f3ea16a6f2f727701811f41a10ecd49326a9c855f694a2d1 SHA512 15d464ec999b6c98e05d5904e52af977036c2c7ea2bf1d54cebf05f6841f8c28adda1b5d6fa9f344d12ea8417f512a1f0c0487aad62627a7761e97e71f3b018c
@@ -26,4 +31,6 @@ EBUILD unbound-1.6.8-r2.ebuild 4814 BLAKE2B 4a22ffd38aa1a4c39d603f85a2fff0adb767
 EBUILD unbound-1.6.8.ebuild 3696 BLAKE2B 2b520948c09e02bba9a1685e25a46b94280d9ef65fc69091b0a6a33b176b8538033d3347aa828e6bb66df85383d1b33f343085f52b3a1e3150e6aa1bf8808c37 SHA512 06c2a8cc24f9ef503eacfcc0a6dd19c63651163dc7b6523f75360f6902deb8f74b616d370c3f93b4633cc823a93be7dc833d8427c70c1b5530cf96a77b056ee9
 EBUILD unbound-1.7.0.ebuild 4814 BLAKE2B 4a22ffd38aa1a4c39d603f85a2fff0adb767bab5a1feea6386fb95f6f3d1dba5ed1749c99fe7f5d310fadfee95de628e077dca25c3800d1a1490ecea37341549 SHA512 8270d337d8b7241208406cd5b06320a624856aae1caa921b26d7115b77df27b93838c73ccb02ad0a5588e7bf41f82646f650c328b0c991afc9d319c77e59a303
 EBUILD unbound-1.7.1.ebuild 4814 BLAKE2B 4a22ffd38aa1a4c39d603f85a2fff0adb767bab5a1feea6386fb95f6f3d1dba5ed1749c99fe7f5d310fadfee95de628e077dca25c3800d1a1490ecea37341549 SHA512 8270d337d8b7241208406cd5b06320a624856aae1caa921b26d7115b77df27b93838c73ccb02ad0a5588e7bf41f82646f650c328b0c991afc9d319c77e59a303
-MISC metadata.xml 1008 BLAKE2B 1852e514f97f9305848144ae0f9aaf8fb49546cd9afcd873ab67dcefee0503d5047809dc8c650006ccdb236c9ba9ff02cc5ecf726d61c25e17167409f91d3fb1 SHA512 f6654d6d254a4d51a8c454c542f1fbbff16bfeaa1cb681f110b9ae99a4231cdb7c073a5d42faba71168079330f9e01781df7a5b3e1bd70d771c874a5bbe9742a
+EBUILD unbound-1.7.3-r1.ebuild 4964 BLAKE2B 29c4159dce7346ffe39c78f7cc41be8d2f5a559579eaee964fa1c3bdba44af19233b7eb3ccd3ee53e331c582d32f3df786ea417a05d294f46a9424a42010b507 SHA512 9b39243fe41302474917d775574113ba697672453f439d3d31f02aac77f70f4a4f4b6fd404ff5ddfe5f4c52786ef7fdd223fdd540b0ac695ea5e53c914d50dfc
+EBUILD unbound-1.8.0-r1.ebuild 5362 BLAKE2B 4641dd8a572599793da384249d59a4f988847ebefdec73de43fb0320c212db63d60415cbf4d0c01f192e07f1977791d7be96c1eccc4637d33794336850e661df SHA512 f2216005d1fa1e5e1c73087af818c7767f446ab72e40358b4c30c02ee400e30c0c4c1517e2430739d363f3fc78979c42394ae97538e62cae4fc1d6b15d832f45
+MISC metadata.xml 1239 BLAKE2B b23dea4347aa4eff995ff69d8e708abbc46b4d222b65d2e87734e77925d8026003df95fe503d66a96dd9dc6a73c32b69e6bb2ad9678a40c5c01b028e5247013a SHA512 6aeb057a87d2705bc9b1c42458cbe27c2b8c21f16ad338ef4421716527347c207360e154c82821ae10b32a22868d16b24601c2d115bee9e70e00a60d7fc133af
diff --git a/net-dns/unbound/files/unbound-1.5.7-trust-anchor-file.patch b/net-dns/unbound/files/unbound-1.5.7-trust-anchor-file.patch
index c4c0ffa3d6d1..85879db3cf28 100644
--- a/net-dns/unbound/files/unbound-1.5.7-trust-anchor-file.patch
+++ b/net-dns/unbound/files/unbound-1.5.7-trust-anchor-file.patch
@@ -1,3 +1,9 @@
+To avoid below error messages like
+
+  [23109:0] error: Could not open autotrust file for writing, /etc/dnssec/root-anchors.txt: Permission denied
+
+set 'trust-anchor-file' to same value in 'auto-trust-anchor-file'.
+
 diff -ur unbound-1.5.7.orig/doc/example.conf.in unbound-1.5.7/doc/example.conf.in
 --- unbound-1.5.7.orig/doc/example.conf.in	2015-12-10 08:59:18.000000000 +0100
 +++ unbound-1.5.7/doc/example.conf.in	2016-01-05 04:08:01.666760015 +0100
diff --git a/net-dns/unbound/files/unbound-1.6.3-pkg-config.patch b/net-dns/unbound/files/unbound-1.6.3-pkg-config.patch
new file mode 100644
index 000000000000..36adac8dc112
--- /dev/null
+++ b/net-dns/unbound/files/unbound-1.6.3-pkg-config.patch
@@ -0,0 +1,11 @@
+--- a/configure.ac
++++ b/configure.ac
+@@ -95,6 +95,8 @@ AC_SUBST(LIBUNBOUND_CURRENT)
+ AC_SUBST(LIBUNBOUND_REVISION)
+ AC_SUBST(LIBUNBOUND_AGE)
+ 
++PKG_PROG_PKG_CONFIG
++
+ CFLAGS="$CFLAGS"
+ AC_AIX
+ if test "$ac_cv_header_minix_config_h" = "yes"; then
diff --git a/net-dns/unbound/files/unbound-r1.confd b/net-dns/unbound/files/unbound-r1.confd
new file mode 100644
index 000000000000..c86c65c64962
--- /dev/null
+++ b/net-dns/unbound/files/unbound-r1.confd
@@ -0,0 +1,36 @@
+# /etc/conf.d/unbound
+
+# Configuration file
+#UNBOUND_CONFFILE="/etc/unbound/unbound.conf"
+
+# PID file
+# This is a fallback value which should NOT be changed. If you ever need
+# to change PID file, please change value in configuration file instead!
+#UNBOUND_PIDFILE="/run/unbound.pid"
+
+# You can use this configuration option to pass additional options to the
+# start-stop-daemon, see start-stop-daemon(8) for more details.
+# Per default we wait 1000ms after we have started the service to ensure
+# that the daemon is really up and running.
+#UNBOUND_SSDARGS="--wait 1000"
+
+# The termination timeout (start-stop-daemon parameter "retry") ensures
+# that the service will be terminated within a given time (25 + 5 seconds
+# per default) when you are stopping the service.
+#UNBOUND_TERMTIMEOUT="TERM/25/KILL/5"
+
+# Options to unbound
+# See unbound(8) for more details
+# Notes:
+# * Do not specify another CONFIGFILE but use the variable above to change the location
+#UNBOUND_OPTS=""
+
+# If you want to preserve unbound's cache, set the following variable to
+# a non-zero value. In this case unbound's cache will be dumped to disk
+# before shutdown and loaded right after start.
+# To be able to dump and load cache you have to set up keys (use `unbound-control-setup`)
+# and need to set 'control-enable: yes' in your configuration!
+# WARNING: If you don't know what you are doing you should NOT use this
+#          feature. Loading the cache with old or wrong data can result in
+#          old or wrong data being returned to clients.
+#UNBOUND_PRESERVE_CACHE=""
diff --git a/net-dns/unbound/files/unbound-r1.initd b/net-dns/unbound/files/unbound-r1.initd
new file mode 100644
index 000000000000..54886d1f47ad
--- /dev/null
+++ b/net-dns/unbound/files/unbound-r1.initd
@@ -0,0 +1,137 @@
+#!/sbin/openrc-run
+# Copyright 1999-2018 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+UNBOUND_BINARY=${UNBOUND_BINARY:-"/usr/sbin/unbound"}
+UNBOUND_CACHEFILE=${UNBOUND_CACHEFILE:-"/var/lib/unbound/${SVCNAME}.cache"}
+UNBOUND_CHECKCONF=${UNBOUND_CHECKCONF:-"/usr/sbin/unbound-checkconf"}
+UNBOUND_CONFFILE=${UNBOUND_CONFFILE:-"/etc/unbound/${SVCNAME}.conf"}
+UNBOUND_CONTROL=${UNBOUND_CONTROL:-"/usr/sbin/unbound-control"}
+UNBOUND_PIDFILE=${UNBOUND_PIDFILE:-"/run/unbound.pid"}
+UNBOUND_SSDARGS=${UNBOUND_SSDARGS:-"--wait 1000"}
+UNBOUND_TERMTIMEOUT=${UNBOUND_TERMTIMEOUT:-"TERM/25/KILL/5"}
+UNBOUND_OPTS=${UNBOUND_OPTS:-""}
+UNBOUND_LOAD_CACHE_TIMEOUT=${UNBOUND_LOAD_CACHE_TIMEOUT:-"30"}
+
+getconfig() {
+	local key="$1"
+	local value_default="$2"
+	local value=
+
+	if service_started ; then
+		value="$(service_get_value "${key}")"
+	fi
+
+	if [ -z "${value}" ] && [ -n "${UNBOUND_CONFFILE}" ] && [ -r "${UNBOUND_CONFFILE}" ] ; then
+		value=$("${UNBOUND_CHECKCONF}" -o ${key} "${UNBOUND_CONFFILE}")
+	fi
+
+	if [ -z "${value}" ] ; then
+		# Value not explicitly set in the configfile or configfile does not exist
+		# or is not readable
+		echo "${value_default}"
+	else
+		echo "${value}"
+	fi
+
+	return 0
+}
+
+command=${UNBOUND_BINARY}
+command_args="${UNBOUND_OPTS} -c \"${UNBOUND_CONFFILE}\""
+start_stop_daemon_args="${UNBOUND_SSDARGS}"
+pidfile="$(getconfig pidfile /run/unbound.pid)"
+retry="${UNBOUND_TERMTIMEOUT}"
+
+required_files="${UNBOUND_CONFFILE}"
+
+name="unbound daemon"
+extra_commands="configtest"
+extra_started_commands="reload save_cache"
+description="unbound is a Domain Name Server (DNS) that is used to resolve host names to IP address."
+description_configtest="Run syntax tests for configuration files only."
+description_reload="Kills all children and reloads the configuration."
+description_save_cache="Saves the current cache to disk."
+
+depend() {
+	use net logger
+	provide dns
+	after auth-dns
+}
+
+configtest() {
+	local _config_status=
+
+	ebegin "Checking ${SVCNAME} configuration"
+	"${UNBOUND_CHECKCONF}" "${UNBOUND_CONFFILE}" 1>/dev/null 2>&1
+	_config_status=$?
+
+	if [ ${_config_status} -ne 0 ] ; then
+		# Run command again but this time we will show the output
+		# Ugly, but ...
+		"${UNBOUND_CHECKCONF}" "${UNBOUND_CONFFILE}"
+	else
+		if [ -n "${UNBOUND_PRESERVE_CACHE}" ] ; then
+			local _is_control_enabled=$(getconfig control-enable no)
+			if [ "${_is_control_enabled}" != "yes" ] ; then
+				eerror "Cannot preserve cache: control-enable is 'no' in the config file!"
+				_config_status=2
+			fi
+		fi
+	fi
+
+	eend ${_config_status} "failed, please correct errors above"
+}
+
+save_cache() {
+	if [ "${RC_CMD}" != "restart" ] ; then
+		UNBOUND_PRESERVE_CACHE=1 configtest || return 1
+	fi
+
+	ebegin "Saving cache to '${UNBOUND_CACHEFILE}'"
+	${UNBOUND_CONTROL} -c "${UNBOUND_CONFFILE}" dump_cache > "${UNBOUND_CACHEFILE}"
+	eend $?
+}
+
+start_pre() {
+	if [ "${RC_CMD}" != "restart" ] ; then
+		configtest || return 1
+	fi
+}
+
+start_post() {
+	if [ -n "${UNBOUND_PRESERVE_CACHE}" ] ; then
+		if [ -s "${UNBOUND_CACHEFILE}" ] ; then
+			ebegin "Loading cache from '${UNBOUND_CACHEFILE}'"
+			# Loading cache can fail which would block this runscript.
+			# Using `timeout` from coreutils will be our safeguard ...
+			timeout -k 5 ${UNBOUND_LOAD_CACHE_TIMEOUT} ${UNBOUND_CONTROL} -q -c "${UNBOUND_CONFFILE}" load_cache < "${UNBOUND_CACHEFILE}"
+			eend $?
+		else
+			ewarn "Loading cache from '${UNBOUND_CACHEFILE}' skipped: File does not exists or is empty!"
+		fi
+	fi
+
+	# It is not a fatal error if preserved cache could not be loaded
+	return 0
+}
+
+stop_pre() {
+	if [ "${RC_CMD}" = "restart" ] ; then
+		configtest || return 1
+	fi
+
+	if [ -n "${UNBOUND_PRESERVE_CACHE}" ] ; then
+		save_cache
+	fi
+
+	# It is not a fatal error if cache cannot be preserved
+	return 0
+}
+
+reload() {
+	configtest || return 1
+	ebegin "Reloading ${SVCNAME}"
+	start-stop-daemon --signal HUP --pidfile "${pidfile}"
+	eend $?
+}
diff --git a/net-dns/unbound/metadata.xml b/net-dns/unbound/metadata.xml
index 12f7df40fa28..322609af4ff1 100644
--- a/net-dns/unbound/metadata.xml
+++ b/net-dns/unbound/metadata.xml
@@ -16,10 +16,15 @@
   DNSSEC (secure DNS) validation and stub-resolvers (that do not run
   as a server, but are linked into an application) are easily possible.
   </longdescription>
+  <slots>
+    <subslots>Reflect ABI of libunbound.so.</subslots>
+  </slots>
   <use>
     <flag name="dnscrypt">Enable DNSCrypt support</flag>
     <flag name="dnstap">Enable dnstap support</flag>
     <flag name="ecdsa">Enable ECDSA support</flag>
+    <flag name="ecs">Enable EDNS client subnet support</flag>
     <flag name="gost">Enable GOST support</flag>
+    <flag name="redis">Enable cache db backend which uses <pkg>dev-libs/hiredis</pkg></flag>
   </use>
 </pkgmetadata>
diff --git a/net-dns/unbound/unbound-1.7.3-r1.ebuild b/net-dns/unbound/unbound-1.7.3-r1.ebuild
new file mode 100644
index 000000000000..ee301c92356f
--- /dev/null
+++ b/net-dns/unbound/unbound-1.7.3-r1.ebuild
@@ -0,0 +1,169 @@
+# Copyright 1999-2018 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+PYTHON_COMPAT=( python2_7 )
+
+inherit autotools flag-o-matic multilib-minimal python-single-r1 systemd user
+
+MY_P=${PN}-${PV/_/}
+DESCRIPTION="A validating, recursive and caching DNS resolver"
+HOMEPAGE="https://unbound.net/ https://nlnetlabs.nl/projects/unbound/about/"
+SRC_URI="https://nlnetlabs.nl/downloads/unbound/${MY_P}.tar.gz"
+
+LICENSE="BSD GPL-2"
+SLOT="0/7" # ABI version of libunbound.so
+KEYWORDS="~alpha ~amd64 ~arm ~hppa ~mips ~ppc ~ppc64 ~x86"
+IUSE="debug dnscrypt dnstap +ecdsa gost libressl python selinux static-libs systemd test threads"
+REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} )"
+
+# Note: expat is needed by executable only but the Makefile is custom
+# and doesn't make it possible to easily install the library without
+# the executables. MULTILIB_USEDEP may be dropped once build system
+# is fixed.
+
+CDEPEND=">=dev-libs/expat-2.1.0-r3[${MULTILIB_USEDEP}]
+	>=dev-libs/libevent-2.0.21:0=[${MULTILIB_USEDEP}]
+	libressl? ( >=dev-libs/libressl-2.2.4:0[${MULTILIB_USEDEP}] )
+	!libressl? ( >=dev-libs/openssl-1.0.1h-r2:0[${MULTILIB_USEDEP}] )
+	dnscrypt? ( dev-libs/libsodium[${MULTILIB_USEDEP}] )
+	dnstap? (
+		dev-libs/fstrm[${MULTILIB_USEDEP}]
+		>=dev-libs/protobuf-c-1.0.2-r1[${MULTILIB_USEDEP}]
+	)
+	ecdsa? (
+		!libressl? ( dev-libs/openssl:0[-bindist] )
+	)
+	python? ( ${PYTHON_DEPS} )"
+
+BDEPEND="virtual/pkgconfig"
+
+DEPEND="${CDEPEND}
+	python? ( dev-lang/swig )
+	test? (
+		net-dns/ldns-utils[examples]
+		dev-util/splint
+		app-text/wdiff
+	)
+	systemd? ( sys-apps/systemd )"
+
+RDEPEND="${CDEPEND}
+	net-dns/dnssec-root
+	selinux? ( sec-policy/selinux-bind )"
+
+# bug #347415
+RDEPEND="${RDEPEND}
+	net-dns/dnssec-root"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-1.5.7-trust-anchor-file.patch
+	"${FILESDIR}"/${PN}-1.6.3-pkg-config.patch
+)
+
+S=${WORKDIR}/${MY_P}
+
+pkg_setup() {
+	enewgroup unbound
+	enewuser unbound -1 -1 /etc/unbound unbound
+	# improve security on existing installs (bug #641042)
+	# as well as new installs where unbound homedir has just been created
+	if [[ -d "${ROOT}/etc/unbound" ]]; then
+		chown --no-dereference --from=unbound root "${ROOT}/etc/unbound"
+	fi
+
+	use python && python-single-r1_pkg_setup
+}
+
+src_prepare() {
+	default
+
+	eautoreconf
+
+	# required for the python part
+	multilib_copy_sources
+}
+
+src_configure() {
+	[[ ${CHOST} == *-darwin* ]] || append-ldflags -Wl,-z,noexecstack
+	multilib-minimal_src_configure
+}
+
+multilib_src_configure() {
+	econf \
+		$(use_enable debug) \
+		$(use_enable gost) \
+		$(use_enable dnscrypt) \
+		$(use_enable dnstap) \
+		$(use_enable ecdsa) \
+		$(use_enable static-libs static) \
+		$(use_enable systemd) \
+		$(multilib_native_use_with python pythonmodule) \
+		$(multilib_native_use_with python pyunbound) \
+		$(use_with threads pthreads) \
+		--disable-flto \
+		--disable-rpath \
+		--with-libevent="${EPREFIX%/}"/usr \
+		--with-pidfile="${EPREFIX%/}"/run/unbound.pid \
+		--with-rootkey-file="${EPREFIX%/}"/etc/dnssec/root-anchors.txt \
+		--with-ssl="${EPREFIX%/}"/usr \
+		--with-libexpat="${EPREFIX%/}"/usr
+
+		# http://unbound.nlnetlabs.nl/pipermail/unbound-users/2011-April/001801.html
+		# $(use_enable debug lock-checks) \
+		# $(use_enable debug alloc-checks) \
+		# $(use_enable debug alloc-lite) \
+		# $(use_enable debug alloc-nonregional) \
+}
+
+multilib_src_install_all() {
+	use python && python_optimize
+
+	newinitd "${FILESDIR}"/unbound-r1.initd unbound
+	newconfd "${FILESDIR}"/unbound-r1.confd unbound
+
+	systemd_dounit "${FILESDIR}"/unbound.service
+	systemd_dounit "${FILESDIR}"/unbound.socket
+	systemd_newunit "${FILESDIR}"/unbound_at.service "unbound@.service"
+	systemd_dounit "${FILESDIR}"/unbound-anchor.service
+
+	dodoc doc/{README,CREDITS,TODO,Changelog,FEATURES}
+
+	# bug #315519
+	dodoc contrib/unbound_munin_
+
+	docinto selinux
+	dodoc contrib/selinux/*
+
+	exeinto /usr/share/${PN}
+	doexe contrib/update-anchor.sh
+
+	# create space for auto-trust-anchor-file...
+	keepdir /etc/unbound/var
+	# ... and point example config to it
+	sed -i \
+		-e '/# auto-trust-anchor-file:/s,/etc/dnssec/root-anchors.txt,/etc/unbound/var/root-anchors.txt,' \
+		"${ED%/}/etc/unbound/unbound.conf" || \
+		die
+
+	find "${ED}" -name '*.la' -delete || die
+	if ! use static-libs ; then
+		find "${ED}" -name "*.a" -delete || die
+	fi
+}
+
+pkg_postinst() {
+	# make var/ writable by unbound
+	if [[ -d "${EROOT%/}/etc/unbound/var" ]]; then
+		chown --no-dereference --from=root unbound: "${EROOT%/}/etc/unbound/var"
+	fi
+
+	einfo ""
+	einfo "If you want unbound to automatically update the root-anchor file for DNSSEC validation"
+	einfo "set 'auto-trust-anchor-file: ${EROOT%/}/etc/unbound/var/root-anchors.txt' in ${EROOT%/}/etc/unbound/unbound.conf"
+	einfo "and run"
+	einfo ""
+	einfo "  su -s /bin/sh -c '${EROOT%/}/usr/sbin/unbound-anchor -a ${EROOT%/}/etc/unbound/var/root-anchors.txt' unbound"
+	einfo ""
+	einfo "as root to create it initially before starting unbound for the first time after enabling this."
+	einfo ""
+}
diff --git a/net-dns/unbound/unbound-1.8.0-r1.ebuild b/net-dns/unbound/unbound-1.8.0-r1.ebuild
new file mode 100644
index 000000000000..f294360a6d44
--- /dev/null
+++ b/net-dns/unbound/unbound-1.8.0-r1.ebuild
@@ -0,0 +1,181 @@
+# Copyright 1999-2018 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+PYTHON_COMPAT=( python2_7 )
+
+inherit autotools flag-o-matic multilib-minimal python-single-r1 systemd user
+
+MY_P=${PN}-${PV/_/}
+DESCRIPTION="A validating, recursive and caching DNS resolver"
+HOMEPAGE="https://unbound.net/ https://nlnetlabs.nl/projects/unbound/about/"
+SRC_URI="https://nlnetlabs.nl/downloads/unbound/${MY_P}.tar.gz"
+
+LICENSE="BSD GPL-2"
+SLOT="0/8" # ABI version of libunbound.so
+KEYWORDS="~alpha ~amd64 ~arm ~hppa ~mips ~ppc ~ppc64 ~x86"
+IUSE="debug dnscrypt dnstap +ecdsa ecs gost libressl python redis selinux static-libs systemd test threads"
+REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} )"
+
+# Note: expat is needed by executable only but the Makefile is custom
+# and doesn't make it possible to easily install the library without
+# the executables. MULTILIB_USEDEP may be dropped once build system
+# is fixed.
+
+CDEPEND=">=dev-libs/expat-2.1.0-r3[${MULTILIB_USEDEP}]
+	>=dev-libs/libevent-2.0.21:0=[${MULTILIB_USEDEP}]
+	libressl? ( >=dev-libs/libressl-2.2.4:0[${MULTILIB_USEDEP}] )
+	!libressl? ( >=dev-libs/openssl-1.0.1h-r2:0[${MULTILIB_USEDEP}] )
+	dnscrypt? ( dev-libs/libsodium[${MULTILIB_USEDEP}] )
+	dnstap? (
+		dev-libs/fstrm[${MULTILIB_USEDEP}]
+		>=dev-libs/protobuf-c-1.0.2-r1[${MULTILIB_USEDEP}]
+	)
+	ecdsa? (
+		!libressl? ( dev-libs/openssl:0[-bindist] )
+	)
+	python? ( ${PYTHON_DEPS} )
+	redis? ( dev-libs/hiredis:= )"
+
+BDEPEND="virtual/pkgconfig"
+
+DEPEND="${CDEPEND}
+	python? ( dev-lang/swig )
+	test? (
+		net-dns/ldns-utils[examples]
+		dev-util/splint
+		app-text/wdiff
+	)
+	systemd? ( sys-apps/systemd )"
+
+RDEPEND="${CDEPEND}
+	net-dns/dnssec-root
+	selinux? ( sec-policy/selinux-bind )"
+
+# bug #347415
+RDEPEND="${RDEPEND}
+	net-dns/dnssec-root"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-1.5.7-trust-anchor-file.patch
+	"${FILESDIR}"/${PN}-1.6.3-pkg-config.patch
+)
+
+S=${WORKDIR}/${MY_P}
+
+pkg_setup() {
+	enewgroup unbound
+	enewuser unbound -1 -1 /etc/unbound unbound
+	# improve security on existing installs (bug #641042)
+	# as well as new installs where unbound homedir has just been created
+	if [[ -d "${ROOT}/etc/unbound" ]]; then
+		chown --no-dereference --from=unbound root "${ROOT}/etc/unbound"
+	fi
+
+	use python && python-single-r1_pkg_setup
+}
+
+src_prepare() {
+	default
+
+	eautoreconf
+
+	# required for the python part
+	multilib_copy_sources
+}
+
+src_configure() {
+	[[ ${CHOST} == *-darwin* ]] || append-ldflags -Wl,-z,noexecstack
+	multilib-minimal_src_configure
+}
+
+multilib_src_configure() {
+	econf \
+		$(use_enable debug) \
+		$(use_enable gost) \
+		$(use_enable dnscrypt) \
+		$(use_enable dnstap) \
+		$(use_enable ecdsa) \
+		$(use_enable ecs subnet) \
+		$(multilib_native_use_enable redis cachedb) \
+		$(use_enable static-libs static) \
+		$(use_enable systemd) \
+		$(multilib_native_use_with python pythonmodule) \
+		$(multilib_native_use_with python pyunbound) \
+		$(use_with threads pthreads) \
+		--disable-flto \
+		--disable-rpath \
+		--enable-ipsecmod \
+		--enable-tfo-client \
+		--enable-tfo-server \
+		--with-libevent="${EPREFIX%/}"/usr \
+		$(multilib_native_usex redis --with-libhiredis="${EPREFIX%/}/usr" --without-libhiredis) \
+		--with-pidfile="${EPREFIX%/}"/run/unbound.pid \
+		--with-rootkey-file="${EPREFIX%/}"/etc/dnssec/root-anchors.txt \
+		--with-ssl="${EPREFIX%/}"/usr \
+		--with-libexpat="${EPREFIX%/}"/usr
+
+		# http://unbound.nlnetlabs.nl/pipermail/unbound-users/2011-April/001801.html
+		# $(use_enable debug lock-checks) \
+		# $(use_enable debug alloc-checks) \
+		# $(use_enable debug alloc-lite) \
+		# $(use_enable debug alloc-nonregional) \
+}
+
+multilib_src_install_all() {
+	use python && python_optimize
+
+	newinitd "${FILESDIR}"/unbound-r1.initd unbound
+	newconfd "${FILESDIR}"/unbound-r1.confd unbound
+
+	systemd_dounit "${FILESDIR}"/unbound.service
+	systemd_dounit "${FILESDIR}"/unbound.socket
+	systemd_newunit "${FILESDIR}"/unbound_at.service "unbound@.service"
+	systemd_dounit "${FILESDIR}"/unbound-anchor.service
+
+	dodoc doc/{README,CREDITS,TODO,Changelog,FEATURES}
+
+	# bug #315519
+	dodoc contrib/unbound_munin_
+
+	docinto selinux
+	dodoc contrib/selinux/*
+
+	exeinto /usr/share/${PN}
+	doexe contrib/update-anchor.sh
+
+	# create space for auto-trust-anchor-file...
+	keepdir /etc/unbound/var
+	# ... and point example config to it
+	sed -i \
+		-e '/# auto-trust-anchor-file:/s,/etc/dnssec/root-anchors.txt,/etc/unbound/var/root-anchors.txt,' \
+		"${ED%/}/etc/unbound/unbound.conf" || \
+		die
+
+	# Used to store cache data
+	keepdir /var/lib/${PN}
+	fowners root:unbound /var/lib/${PN}
+	fperms 0750 /var/lib/${PN}
+
+	find "${ED}" -name '*.la' -delete || die
+	if ! use static-libs ; then
+		find "${ED}" -name "*.a" -delete || die
+	fi
+}
+
+pkg_postinst() {
+	# make var/ writable by unbound
+	if [[ -d "${EROOT%/}/etc/unbound/var" ]]; then
+		chown --no-dereference --from=root unbound: "${EROOT%/}/etc/unbound/var"
+	fi
+
+	einfo ""
+	einfo "If you want unbound to automatically update the root-anchor file for DNSSEC validation"
+	einfo "set 'auto-trust-anchor-file: ${EROOT%/}/etc/unbound/var/root-anchors.txt' in ${EROOT%/}/etc/unbound/unbound.conf"
+	einfo "and run"
+	einfo ""
+	einfo "  su -s /bin/sh -c '${EROOT%/}/usr/sbin/unbound-anchor -a ${EROOT%/}/etc/unbound/var/root-anchors.txt' unbound"
+	einfo ""
+	einfo "as root to create it initially before starting unbound for the first time after enabling this."
+	einfo ""
+}
diff --git a/net-dns/valtz/Manifest b/net-dns/valtz/Manifest
index 6596b7c4cf5d..b74a65fb689d 100644
--- a/net-dns/valtz/Manifest
+++ b/net-dns/valtz/Manifest
@@ -1,4 +1,3 @@
 DIST valtz.tgz 10638 BLAKE2B f6c8c476f523bc72531dd6537a7ed096b4fe15122db8ac8398b6ce325e8d61aecd3ef496c6102127bb8df4c8e0651201826ed4ccf79fd47616b6e083967412c4 SHA512 173e9f04399f8011b565ddfa7ad542c87af03da1b829d40b616271a993a282a1a3f54fb434db4837fb9ee4c3eb66a39f70ebf5ff5f13aff9c6fccfeabb3a3df7
 EBUILD valtz-0.7-r1.ebuild 402 BLAKE2B dfae5af8b712ca9aa0ae31a5cc150e0d6464f97e1695048c35c4fe623cbfaf3d48561d40062ac61cd8b5d28948e3eac52d309736622dbddc10f4fb11fd23bf1b SHA512 d2bd58b96a28d055a9a2be424c490c9d641d48a768c9814d34893ffab74a1030e60f792a9a8b3ad7350870fc68d05fc490f15a3bcc59032e2d01e2d08e7c3460
-EBUILD valtz-0.7.ebuild 409 BLAKE2B 57804a6c02150a4a4709e631829c384c3dafb4483623dc1dee87c67d7a7f87b92fd7ceda0f78bade9c9f9e9e7dbd4c31e188ec82a3c04fda0358f58fe631259f SHA512 f0cf57aaa02e657ca04ddf5fa8653214b8c6a5846ffd402a68bdafb34333aa835c892d66092315687acf943eef3c1d21dfaa129e89f15c3ea39828bc42679c7f
 MISC metadata.xml 341 BLAKE2B 53f669b92bd42cbfc65ed61e51ddfbcf29046003710d2ed754989a6d09a912b606c7a0b8539551b05c58325af576113fb1c5065f7d1e7ef1a7c68e2f12f263d7 SHA512 a85234c263a6f8f3a857f9b803cc19d483181060cfb37118287924bee852d95be01d898585b0417d4aad71bd565ae2fce107fecd234777dfd4384302e602c6cd
diff --git a/net-dns/valtz/valtz-0.7.ebuild b/net-dns/valtz/valtz-0.7.ebuild
deleted file mode 100644
index 6601585cf112..000000000000
--- a/net-dns/valtz/valtz-0.7.ebuild
+++ /dev/null
@@ -1,20 +0,0 @@
-# Copyright 1999-2018 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=0
-
-DESCRIPTION="Validation tool for tinydns-data zone files"
-SRC_URI="https://x42.com/software/valtz/${PN}.tgz"
-HOMEPAGE="https://x42.com/software/valtz/"
-IUSE=""
-
-SLOT="0"
-LICENSE="BSD"
-KEYWORDS="~amd64 ~x86"
-
-RDEPEND="dev-lang/perl"
-
-src_install() {
-	dobin valtz || die
-	dodoc README CHANGES
-}