gentoo resync : 06.08.2019

24 files changed, 1114 insertions, 188 deletions

diff --git a/net-dns/Manifest.gz b/net-dns/Manifest.gz
index b0bae8d85d8e..6fa6bd4a1f52 100644
--- a/net-dns/Manifest.gz
+++ b/net-dns/Manifest.gz
diff --git a/net-dns/bind-tools/Manifest b/net-dns/bind-tools/Manifest
index afe13434130c..696ee03f7c74 100644
--- a/net-dns/bind-tools/Manifest
+++ b/net-dns/bind-tools/Manifest
@@ -1,5 +1,8 @@
+AUX sparc-pause-instruction.patch 4109 BLAKE2B e0a705c5b29033f54ae5d707a0159d8814fb15be4fdc33f91834f2aa50c3c37ca2d653d17222f16bb4e45f8d2e6a983f15ef70ebcd07f579426d3d97b5d78ecf SHA512 590fa784999692700db796291236ce9436e775b16cb737f853d2b5e0b9433f2993682edad2e9f25be140d6fe00edc3768947670a404079b603f8e93651d6da84
 DIST bind-9.14.4.tar.gz 6295768 BLAKE2B c433344d2b431ebb2e9920a6d0af1dc6cf65df1e347c2a77882a7dd2ea165f9a91324edbd7171e6bab7487e13049e38d23a514323f1b4cc74a6ce1f5377f1589 SHA512 f5f4dc9b6a1d60838b59ce57ad37dc1e51fa26719aa203405a73850780f06bdc6ecea71c762efd464f946bdcce5a7c324de98caea36d2fe2781cce116fcd4932
+DIST bind-9.14.5.tar.gz 6313555 BLAKE2B 46bde0f6f78ee15357bca0129022a6dd88941f633513a8d768b53d9c3bc0f4f7af4d8dc8cc4b1d6119d148700703b2fa27b6834671dcb5df9b544e4a2025452b SHA512 1b18eda5dea639f9b34e1c41b534704b0d5f64c036b766c9cfccf9bbeb586ce4ea7f0d098a5b2747e88aa403e48ad8ae0b6e560e93348f0dc7616f914671d084
 DIST bind-9.15.2.tar.gz 6303402 BLAKE2B c8a16a80c9f690adb61284b27a619b4dbe120eadad7b38138da099a1d5a1171443da6e1c717e876e2739ee4d543cb00665c07fac460a256b178bace96510f4a3 SHA512 df7499bc3eeabf39eebfe346efe15631929cd7287e12fc6b04baea90c332a02fc4b9a8d40f043e308ebd61a82baafb5cf9e69654511dc9a2dcb7415597d5a646
-EBUILD bind-tools-9.14.4.ebuild 3044 BLAKE2B b7695a80cff665209ec6b662398e21cf9bed283e9e5cba40889fa594f9dc8084431518a35de4dfa22680fa8370abfbb66a56428a040c57561440a30cc3a5d0d8 SHA512 48e5022bb9060e7b6214f18c9aa7a1205a1f35cf04d1b7583598c62b822e53e9a9db83a73ac8d30070b670906046e0a9efacb728d4120e7a393c142c0076ea1d
-EBUILD bind-tools-9.15.2.ebuild 2834 BLAKE2B 9d0dd1053c2e177fba876d00ff65006fd0e0c35b90f5f912a0b267361cc3876c1380ad256c50731cad7dd24861fa5af84dd9272ff797796577334dca9a8522d8 SHA512 a8cd57dcd7e925e81a7d11361354410cddddcca4f0813ee5d74c8d3e7d3c721704b7b37e585ee4a8b92645b94b55d12f3338d25a1f8eee4b7d2e506f404bbbb9
+EBUILD bind-tools-9.14.4.ebuild 3195 BLAKE2B d1c2e157df3e38c512e3fddc3c6da2149b960cd4ea68e7127463e8518cc681b7a872b7500c0e6bdec9c9d9739d115c4289907a39ab4b5787504d1b43a6ca834d SHA512 180240d41e9bc9d9057ecc19d5d82886f7dd5e0f80f5841d9371b44048904322fb9a985633a20b0e1a1faef15ef74ae9fd8d0e1b34ea9b5dbc316f7c22005b62
+EBUILD bind-tools-9.14.5.ebuild 3148 BLAKE2B 5399c325ed33fc10c9aeb2bd1c2a2e5cbecbc5beee693b8fbdf4620aba7fec57764636f6ba99600599f91cbf6c9266b9701d3c0eece2590f841df38847320c59 SHA512 5d5ae428ae45da3e7af8b7d657054025858af9ce08dec4fa1098d7446f1bee09ce5bc5968937c2d1196d8a494ff78ad938b0bedb0f1ff45bae9f7ce466295f6e
+EBUILD bind-tools-9.15.2.ebuild 2930 BLAKE2B a08144a58d307eef0ad98ce59b91f8dd2f439f982132df6cab8b3c2f23c652a0333b307beba6e21966b23681ca4462a43ad7ab27da88f0b0490b07e1d14278be SHA512 a5b22961bc788d1b2b89c8ae16722675ff193ef0089cd9c7956d100f1dd38cc0888b01e32a0b85ec9fff43eeff5ffe7875b8b7ed807853f90b51170fcb06271e
 MISC metadata.xml 488 BLAKE2B 44d0112102447f6d6f8c76aa5e3018de5fc4746240a1a7f187cb7bc493e9a442812c5b0f1c4a8a0a3410af12fbd2e390f6291c981440840b42348f403a278e2c SHA512 ac2a79f4622fd4aa957f9ad0618c631d4c68497443015bbd12c1670576d4515649f26c39c555046771b2aadd5f9b53fdc4c478ba7fb07e24f06b3a4f30f071e0
diff --git a/net-dns/bind-tools/bind-tools-9.14.4.ebuild b/net-dns/bind-tools/bind-tools-9.14.4.ebuild
index 489ecbb114fe..fd6ff9184d41 100644
--- a/net-dns/bind-tools/bind-tools-9.14.4.ebuild
+++ b/net-dns/bind-tools/bind-tools-9.14.4.ebuild
@@ -17,14 +17,13 @@ SRC_URI="https://downloads.isc.org/isc/bind9/${PV}/${MY_P}.tar.gz"
 LICENSE="Apache-2.0 BSD BSD-2 GPL-2 HPND ISC MPL-2.0"
 SLOT="0"
 KEYWORDS="alpha amd64 arm arm64 hppa ia64 ~m68k ~mips ppc ppc64 ~s390 ~sh sparc x86 ~amd64-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
-IUSE="doc gssapi idn ipv6 libedit libressl readline ssl xml"
+IUSE="+caps doc gssapi idn ipv6 libedit libressl readline xml"
 # no PKCS11 currently as it requires OpenSSL to be patched, also see bug 409687
 
-CDEPEND="
-	ssl? (
-		!libressl? ( dev-libs/openssl:0= )
-		libressl? ( dev-libs/libressl:0= )
-	)
+COMMON_DEPEND="
+	caps? ( sys-libs/libcap )
+	!libressl? ( dev-libs/openssl:0= )
+	libressl? ( dev-libs/libressl:0= )
 	xml? ( dev-libs/libxml2 )
 	idn? ( net-dns/libidn2:= )
 	gssapi? ( virtual/krb5 )
@@ -32,19 +31,25 @@ CDEPEND="
 	!libedit? (
 		readline? ( sys-libs/readline:0= )
 	)"
-DEPEND="${CDEPEND}
-	virtual/pkgconfig"
-RDEPEND="${CDEPEND}
+DEPEND="${COMMON_DEPEND}"
+
+RDEPEND="${COMMON_EPEND}
 	!<net-dns/bind-9.10.2"
 
+BDEPEND="virtual/pkgconfig"
+
 S="${WORKDIR}/${MY_P}"
 
 # bug 479092, requires networking
 RESTRICT="test"
 
+PATCHES=( "${FILESDIR}"/sparc-pause-instruction.patch )
+
 src_prepare() {
 	default
 
+	export LDFLAGS="${LDFLAGS} -L${EPREFIX}/usr/$(get_libdir)"
+
 	# Disable tests for now, bug 406399
 	sed -i '/^SUBDIRS/s:tests::' bin/Makefile.in lib/Makefile.in || die
 
@@ -63,10 +68,10 @@ src_configure() {
 		--without-zlib
 		--without-lmdb
 		$(use_with idn libidn2)
-		$(use_with ssl openssl "${EPREFIX}"/usr)
 		$(use_with xml libxml2)
 		$(use_with gssapi)
 		$(use_with readline)
+		$(use_enable caps linux-caps)
 	)
 
 	# bug 607400
diff --git a/net-dns/bind-tools/bind-tools-9.14.5.ebuild b/net-dns/bind-tools/bind-tools-9.14.5.ebuild
new file mode 100644
index 000000000000..cccff23c8588
--- /dev/null
+++ b/net-dns/bind-tools/bind-tools-9.14.5.ebuild
@@ -0,0 +1,137 @@
+# Copyright 1999-2019 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+inherit autotools flag-o-matic toolchain-funcs
+
+MY_PN=${PN//-tools}
+MY_PV=${PV/_p/-P}
+MY_PV=${MY_PV/_rc/rc}
+MY_P="${MY_PN}-${MY_PV}"
+
+DESCRIPTION="bind tools: dig, nslookup, host, nsupdate, dnssec-keygen"
+HOMEPAGE="https://www.isc.org/software/bind"
+SRC_URI="https://downloads.isc.org/isc/bind9/${PV}/${MY_P}.tar.gz"
+
+LICENSE="Apache-2.0 BSD BSD-2 GPL-2 HPND ISC MPL-2.0"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~amd64-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+IUSE="+caps doc gssapi idn ipv6 libedit libressl readline xml"
+# no PKCS11 currently as it requires OpenSSL to be patched, also see bug 409687
+
+COMMON_DEPEND="
+	caps? ( sys-libs/libcap )
+	!libressl? ( dev-libs/openssl:0= )
+	libressl? ( dev-libs/libressl:0= )
+	xml? ( dev-libs/libxml2 )
+	idn? ( net-dns/libidn2:= )
+	gssapi? ( virtual/krb5 )
+	libedit? ( dev-libs/libedit )
+	!libedit? (
+		readline? ( sys-libs/readline:0= )
+	)"
+DEPEND="${COMMON_DEPEND}"
+
+RDEPEND="${COMMON_EPEND}
+	!<net-dns/bind-9.10.2"
+
+BDEPEND="virtual/pkgconfig"
+
+S="${WORKDIR}/${MY_P}"
+
+# bug 479092, requires networking
+RESTRICT="test"
+
+src_prepare() {
+	default
+
+	export LDFLAGS="${LDFLAGS} -L${EPREFIX}/usr/$(get_libdir)"
+
+	# Disable tests for now, bug 406399
+	sed -i '/^SUBDIRS/s:tests::' bin/Makefile.in lib/Makefile.in || die
+
+	# bug #220361
+	rm aclocal.m4 || die
+	rm -rf libtool.m4/ || die
+
+	eautoreconf
+}
+
+src_configure() {
+	local myeconfargs=(
+		--localstatedir="${EPREFIX}"/var
+		--without-python
+		--without-libjson
+		--without-zlib
+		--without-lmdb
+		$(use_with idn libidn2)
+		$(use_with xml libxml2)
+		$(use_with gssapi)
+		$(use_with readline)
+		$(use_enable caps linux-caps)
+	)
+
+	# bug 607400
+	if use libedit ; then
+		myeconfargs+=( --with-readline=-ledit )
+	elif use readline ; then
+		myeconfargs+=( --with-readline=-lreadline )
+	else
+		myeconfargs+=( --without-readline )
+	fi
+
+	# bug 344029
+	append-cflags "-DDIG_SIGCHASE"
+
+	# to expose CMSG_* macros from sys/sockets.h
+	[[ ${CHOST} == *-solaris* ]] && append-cflags "-D_XOPEN_SOURCE=600"
+
+	# localstatedir for nsupdate -l, bug 395785
+	tc-export BUILD_CC
+	econf "${myeconfargs[@]}"
+
+	# bug #151839
+	echo '#undef SO_BSDCOMPAT' >> config.h
+}
+
+src_compile() {
+	local AR=$(tc-getAR)
+
+	emake AR="${AR}" -C lib/
+	emake AR="${AR}" -C bin/delv/
+	emake AR="${AR}" -C bin/dig/
+	emake AR="${AR}" -C bin/nsupdate/
+	emake AR="${AR}" -C bin/dnssec/
+}
+
+src_install() {
+	dodoc README CHANGES
+
+	cd "${S}"/bin/delv || die
+	dobin delv
+	doman delv.1
+
+	cd "${S}"/bin/dig || die
+	dobin dig host nslookup
+	doman {dig,host,nslookup}.1
+
+	cd "${S}"/bin/nsupdate || die
+	dobin nsupdate
+	doman nsupdate.1
+	if use doc; then
+		docinto html
+		dodoc nsupdate.html
+	fi
+
+	cd "${S}"/bin/dnssec || die
+	for tool in dsfromkey importkey keyfromlabel keygen \
+		revoke settime signzone verify; do
+		dobin dnssec-"${tool}"
+		doman dnssec-"${tool}".8
+		if use doc; then
+			docinto html
+			dodoc dnssec-"${tool}".html
+		fi
+	done
+}
diff --git a/net-dns/bind-tools/bind-tools-9.15.2.ebuild b/net-dns/bind-tools/bind-tools-9.15.2.ebuild
index fe96db31c354..cb870329d1a3 100644
--- a/net-dns/bind-tools/bind-tools-9.15.2.ebuild
+++ b/net-dns/bind-tools/bind-tools-9.15.2.ebuild
@@ -17,14 +17,13 @@ SRC_URI="https://downloads.isc.org/isc/bind9/${PV}/${MY_P}.tar.gz"
 LICENSE="Apache-2.0 BSD BSD-2 GPL-2 HPND ISC MPL-2.0"
 SLOT="0"
 KEYWORDS=""
-IUSE="doc gssapi idn ipv6 libedit libressl readline ssl xml"
+IUSE="+caps doc gssapi idn ipv6 libedit libressl readline xml"
 # no PKCS11 currently as it requires OpenSSL to be patched, also see bug 409687
 
-CDEPEND="
-	ssl? (
-		!libressl? ( dev-libs/openssl:0= )
-		libressl? ( dev-libs/libressl:0= )
-	)
+COMMON_DEPEND="
+	caps? ( sys-libs/libcap )
+	!libressl? ( dev-libs/openssl:0= )
+	libressl? ( dev-libs/libressl:0= )
 	xml? ( dev-libs/libxml2 )
 	idn? ( net-dns/libidn2:= )
 	gssapi? ( virtual/krb5 )
@@ -32,11 +31,14 @@ CDEPEND="
 	!libedit? (
 		readline? ( sys-libs/readline:0= )
 	)"
-DEPEND="${CDEPEND}
-	virtual/pkgconfig"
-RDEPEND="${CDEPEND}
+
+DEPEND="${COMMON_DEPEND}"
+
+RDEPEND="${COMMON_DEPEND}
 	!<net-dns/bind-9.10.2"
 
+BDEPEND="virtual/pkgconfig"
+
 S="${WORKDIR}/${MY_P}"
 
 # bug 479092, requires networking
@@ -45,6 +47,8 @@ RESTRICT="test"
 src_prepare() {
 	default
 
+	export LDFLAGS="${LDFLAGS} -L${EPREFIX}/usr/$(get_libdir)"
+
 	# Disable tests for now, bug 406399
 	sed -i '/^SUBDIRS/s:tests::' bin/Makefile.in lib/Makefile.in || die
 
@@ -63,10 +67,10 @@ src_configure() {
 		--without-zlib
 		--without-lmdb
 		$(use_with idn libidn2)
-		$(use_with ssl openssl "${EPREFIX}"/usr)
 		$(use_with xml libxml2)
 		$(use_with gssapi)
 		$(use_with readline)
+		$(use_enable caps linux-caps)
 	)
 
 	# bug 607400
diff --git a/net-dns/bind-tools/files/sparc-pause-instruction.patch b/net-dns/bind-tools/files/sparc-pause-instruction.patch
new file mode 100644
index 000000000000..35ddb24da0b0
--- /dev/null
+++ b/net-dns/bind-tools/files/sparc-pause-instruction.patch
@@ -0,0 +1,135 @@
+From a5ad6b16c5c0bfd333758d707a6397be79a92914 Mon Sep 17 00:00:00 2001
+From: Sergei Trofimovich <slyfox@gentoo.org>
+Date: Thu, 8 Aug 2019 08:33:10 +0100
+Subject: [PATCH] configure.ac: autodetect 'pause' instruction presence on
+ sparc
+
+The change fixes the following build failure on sparc T3 and older CPUs:
+
+```
+sparc-unknown-linux-gnu-gcc ... -O2 -mcpu=niagara2 ... -c rwlock.c
+{standard input}: Assembler messages:
+{standard input}:398: Error: Architecture mismatch on "pause ".
+{standard input}:398: (Requires v9e|v9v|v9m|m8; requested architecture is v9b.)
+make[1]: *** [Makefile:280: rwlock.o] Error 1
+```
+
+`pause` insutruction exists only on `-mcpu=niagara4` (`T4`) and upper.
+
+The change adds `pause` configure-time autodetection and uses it if available.
+config.h.in got new `HAVE_SPARC_PAUSE` knob. Fallback is a fall-through no-op.
+
+Build-tested on:
+
+- sparc-unknown-linux-gnu-gcc (no `pause`, build succeeds)
+- sparc-unknown-linux-gnu-gcc -mcpu=niagara4 (`pause`, build succeeds)
+
+Reported-by: Rolf Eike Beer
+Bug: https://bugs.gentoo.org/691708
+Signed-off-by: Sergei Trofimovich <slyfox@gentoo.org>
+---
+ config.h.in      |  3 +++
+ configure        | 33 +++++++++++++++++++++++++++++++++
+ configure.ac     | 14 ++++++++++++++
+ lib/isc/rwlock.c |  2 +-
+ 4 files changed, 51 insertions(+), 1 deletion(-)
+
+diff --git a/config.h.in b/config.h.in
+index 91508e5d91..eeba105ec6 100644
+--- a/config.h.in
++++ b/config.h.in
+@@ -357,6 +357,9 @@
+ /* Define to 1 if you have the `setresuid' function. */
+ #undef HAVE_SETRESUID
+ 
++/* define if the SPARC pause instruction is available */
++#undef HAVE_SPARC_PAUSE
++
+ /* define if struct stat has st_mtim.tv_nsec field */
+ #undef HAVE_STAT_NSEC
+ 
+diff --git a/configure b/configure
+index d336f6aa24..757dacb06e 100755
+--- a/configure
++++ b/configure
+@@ -13872,6 +13872,39 @@ rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext ;; #(
+      ;;
+ esac
+ 
++#
++# Check for pause support on SPARC processors
++#
++case $host in #(
++  sparc*) :
++    { $as_echo "$as_me:${as_lineno-$LINENO}: checking for pause instruction support" >&5
++$as_echo_n "checking for pause instruction support... " >&6; }
++	 cat confdefs.h - <<_ACEOF >conftest.$ac_ext
++/* end confdefs.h.  */
++
++int
++main ()
++{
++__asm__ __volatile__ ("pause")
++  ;
++  return 0;
++}
++_ACEOF
++if ac_fn_c_try_compile "$LINENO"; then :
++  { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
++$as_echo "yes" >&6; }
++
++$as_echo "#define HAVE_SPARC_PAUSE 1" >>confdefs.h
++
++else
++  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
++$as_echo "no" >&6; }
++fi
++rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext ;; #(
++  *) :
++     ;;
++esac
++
+ for ac_func in sysctlbyname
+ do :
+   ac_fn_c_check_func "$LINENO" "sysctlbyname" "ac_cv_func_sysctlbyname"
+diff --git a/configure.ac b/configure.ac
+index 90aafae8d0..b04c651966 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -415,6 +415,20 @@ AS_CASE([$host],
+ 			[define if the ARM yield instruction is available])],
+ 	     [AC_MSG_RESULT([no])])])
+ 
++#
++# Check for pause support on SPARC processors
++#
++AS_CASE([$host],
++	[sparc*],
++	[AC_MSG_CHECKING([for pause instruction support])
++	 AC_COMPILE_IFELSE(
++	     [AC_LANG_PROGRAM([[]],
++			     [[__asm__ __volatile__ ("pause")]])],
++	     [AC_MSG_RESULT([yes])
++	      AC_DEFINE([HAVE_SPARC_PAUSE], [1],
++			[define if the SPARC pause instruction is available])],
++	     [AC_MSG_RESULT([no])])])
++
+ AC_CHECK_FUNCS([sysctlbyname])
+ 
+ #
+diff --git a/lib/isc/rwlock.c b/lib/isc/rwlock.c
+index a6ea35feed..e313a912e0 100644
+--- a/lib/isc/rwlock.c
++++ b/lib/isc/rwlock.c
+@@ -152,7 +152,7 @@ isc_rwlock_destroy(isc_rwlock_t *rwl) {
+ # define isc_rwlock_pause() __asm__ __volatile__ ("yield")
+ #elif defined(sun) && (defined(__sparc) || defined(__sparc__))
+ # define isc_rwlock_pause() smt_pause()
+-#elif defined(__sparc) || defined(__sparc__)
++#elif (defined(__sparc) || defined(__sparc__)) && HAVE_SPARC_PAUSE
+ # define isc_rwlock_pause() __asm__ __volatile__ ("pause")
+ #elif defined(__ppc__) || defined(_ARCH_PPC)  ||			\
+ 	defined(_ARCH_PWR) || defined(_ARCH_PWR2) || defined(_POWER)
+-- 
+2.21.0
+
diff --git a/net-dns/bind/Manifest b/net-dns/bind/Manifest
index f756aef81282..c5d06852a638 100644
--- a/net-dns/bind/Manifest
+++ b/net-dns/bind/Manifest
@@ -8,8 +8,10 @@ AUX named.confd-r7 1364 BLAKE2B cfb72f221bc6657c5a8ef8b9cd804afeaf5f642d2046880f
 AUX named.init-r13 6202 BLAKE2B 1968806c9580517b8443a08b90f7b425913b2dc17d9503834c0d7d7d56f1a987175cb413bc7fec10249002b84b6580d87cb61d2b6a1965cd34d05807abe0390c SHA512 c675adec65796989dc8524d533868975d4e2c3b2ed5f09aa3cd92ec21b8dfb161582dd5afdf08ab78174873f3e1458e90c2d50958f0b5a303078540a675ec0c9
 AUX named.service-r1 327 BLAKE2B b0471100b425a1d4db29c1ef577dd6f14b2c3d040fd826bed03105f514bf1ea2c58c19d59557d0eafe27a96588adaf60156f31b6befdd9be96a8ca1fe8613678 SHA512 1d3dbf9d1de0c23c398a523b05c0fb266b6b699e54d232818b28205f697ca227acae9f2778d6f41309b117a6cd78eee170b745594b786b1c1571d5f66d6c3de4
 DIST bind-9.14.4.tar.gz 6295768 BLAKE2B c433344d2b431ebb2e9920a6d0af1dc6cf65df1e347c2a77882a7dd2ea165f9a91324edbd7171e6bab7487e13049e38d23a514323f1b4cc74a6ce1f5377f1589 SHA512 f5f4dc9b6a1d60838b59ce57ad37dc1e51fa26719aa203405a73850780f06bdc6ecea71c762efd464f946bdcce5a7c324de98caea36d2fe2781cce116fcd4932
+DIST bind-9.14.5.tar.gz 6313555 BLAKE2B 46bde0f6f78ee15357bca0129022a6dd88941f633513a8d768b53d9c3bc0f4f7af4d8dc8cc4b1d6119d148700703b2fa27b6834671dcb5df9b544e4a2025452b SHA512 1b18eda5dea639f9b34e1c41b534704b0d5f64c036b766c9cfccf9bbeb586ce4ea7f0d098a5b2747e88aa403e48ad8ae0b6e560e93348f0dc7616f914671d084
 DIST bind-9.15.2.tar.gz 6303402 BLAKE2B c8a16a80c9f690adb61284b27a619b4dbe120eadad7b38138da099a1d5a1171443da6e1c717e876e2739ee4d543cb00665c07fac460a256b178bace96510f4a3 SHA512 df7499bc3eeabf39eebfe346efe15631929cd7287e12fc6b04baea90c332a02fc4b9a8d40f043e308ebd61a82baafb5cf9e69654511dc9a2dcb7415597d5a646
 DIST dyndns-samples.tbz2 22866 BLAKE2B 409890653c6536cb9c0e3ba809d2bfde0e0ae73a2a101b4f229b46c01568466bc022bbbc37712171adbd08c572733e93630feab95a0fcd1ac50a7d37da1d1108 SHA512 83b0bf99f8e9ff709e8e9336d8c5231b98a4b5f0c60c10792f34931e32cc638d261967dfa5a83151ec3740977d94ddd6e21e9ce91267b3e279b88affdbc18cac
-EBUILD bind-9.14.4.ebuild 11630 BLAKE2B 8552b9a50399c437b8f66582b9379b382bcf2a0348661fae0a651cc0f831e33b666bb966b0ba54ccaaf833214bda2bc3f607f1ab051bd4807b22bc30b35cee17 SHA512 db8e49ebebb3c99c8d295301df04eca01d37b5803898c79d55118e92891f76a48800bc804639d002d13a7f22bd37140fb3252975a6fdcaff8ce25965a3578f9b
-EBUILD bind-9.15.2.ebuild 11440 BLAKE2B c30e7efb317373682f1bcfebd8a4e7226f264907f93085bf711a4777e7be94cc73166159dd3ec7b15d64d94c92c8ec57f953b4d822a60e14baf6a83c1b3115c8 SHA512 4cf463d5226da0ac27e7b0c0334efdc300b79e9fc2eace784122c7106e258417a8ed9d60f0d42b4d2b23b3438cc556ce2848092da0fc5f0a44d05a673cdcfaf8
-MISC metadata.xml 1128 BLAKE2B 8d48c81803010ad0c5f3cc98da7a42b1a684c267f0422c8615fb02f9a9f59d368b923a888f3dd115ea00be7693e4ee292148bb8493f097666e9ff5bbc5e0e4a5 SHA512 80b67f58f87e6bb11ec12de7460cfbcdcca1494a0d0b9a64057dad43a5a9883ac222608dd717b49b4e56e513b2be57ccb70cfd30c987a436fdfa0f7cbe01fe97
+EBUILD bind-9.14.4.ebuild 11612 BLAKE2B ec1aed9cca707a5bf5248dbf0d7be564b68c4ca011235799dca4621827b35f19f5ede9a161b4caf3e0bf2f2790d3d2ee708b40bc96026a58fc27badd6891d5ba SHA512 acc4a3b1eea4fa388f3220f360433217a6697bd4d142d83d4bb6f05ed73edeebb14a6c0c94f112c635f2daad0421663ba931f682de6a90a0c8a0c82512296b78
+EBUILD bind-9.14.5.ebuild 11321 BLAKE2B d7dedb82cfa5ef77f53715e24e100e2c1add21ceb03607126e4a8fcc99ffcfe0b08f57b9296f7811186882c3d12a9f247accb78049d584f247d1a31a229f5c11 SHA512 5476cecbcc8198e6b57a33b8092cf02b495fb2259af9ebec0e8b79ae0e61f6323e30bbbed67b1247349bc358839785ec7a306eaca3297ccfb801c2b0de8b4bc4
+EBUILD bind-9.15.2.ebuild 11417 BLAKE2B 89c03b4ef7bb016be184503812513e270fd6608d6121525f241e60dcec1131c8206179ecc28fd152c1ec529c490ee8e13539b48b2c897cd0f9b6e219c916746a SHA512 298b38b6701f10d07d9860b6fdeafca10c46711b0a97520ca8b80d21e96dd6b9319114f86dab9a1002781b9b8344d19c676100ee0ca482540c73de408a182454
+MISC metadata.xml 1188 BLAKE2B 6da9a02bb959544829b980c3edfbe859b73e9f21485e78a23c00d9351fd933de5ba668ebffcffbec7da118116d95232ccaae7d4528de9c2dac6565cabc4f29cc SHA512 0589922970d0998c59e48e485c4475eede9a04cc5b029e1c4c2988d478e72287230613003777034b1df98042c0e7b4f79cfe22585c108b2c668d20710d43c655
diff --git a/net-dns/bind/bind-9.14.4.ebuild b/net-dns/bind/bind-9.14.4.ebuild
index 73486f000eed..56b57d6e2972 100644
--- a/net-dns/bind/bind-9.14.4.ebuild
+++ b/net-dns/bind/bind-9.14.4.ebuild
@@ -39,7 +39,7 @@ SLOT="0"
 KEYWORDS="alpha amd64 arm arm64 hppa ia64 ~mips ppc ppc64 ~s390 ~sh sparc x86 ~x86-fbsd ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
 # -berkdb by default re bug 602682
 IUSE="-berkdb +caps dlz dnstap doc dnsrps fixed-rrset geoip gost gssapi
-json ldap libressl lmdb mysql odbc postgres python selinux ssl static-libs
+json ldap libressl lmdb mysql odbc postgres python selinux static-libs
 urandom xml +zlib"
 # sdb-ldap - patch broken
 # no PKCS11 currently as it requires OpenSSL to be patched, also see bug 409687
@@ -53,11 +53,8 @@ REQUIRED_USE="
 	python? ( ${PYTHON_REQUIRED_USE} )"
 # sdb-ldap? ( dlz )
 
-DEPEND="
-	ssl? (
-		!libressl? ( dev-libs/openssl:0[-bindist] )
-		libressl? ( dev-libs/libressl )
-	)
+DEPEND="!libressl? ( dev-libs/openssl:0[-bindist] )
+	libressl? ( dev-libs/libressl )
 	mysql? ( dev-db/mysql-connector-c:0= )
 	odbc? ( >=dev-db/unixODBC-2.2.6 )
 	ldap? ( net-nds/openldap )
@@ -78,7 +75,7 @@ DEPEND="
 
 RDEPEND="${DEPEND}
 	selinux? ( sec-policy/selinux-bind )
-	|| ( sys-process/psmisc >=sys-freebsd/freebsd-ubin-9.0_rc sys-process/fuser-bsd )"
+	|| ( sys-process/psmisc >=sys-freebsd/freebsd-ubin-9.0_rc )"
 
 S="${WORKDIR}/${MY_P}"
 
@@ -95,6 +92,8 @@ pkg_setup() {
 src_prepare() {
 	default
 
+	export LDFLAGS="${LDFLAGS} -L${EPREFIX}/usr/$(get_libdir)"
+
 	# Adjusting PATHs in manpages
 	for i in bin/{named/named.8,check/named-checkconf.8,rndc/rndc.8} ; do
 		sed -i \
@@ -152,7 +151,6 @@ src_configure() {
 		$(use_with postgres dlz-postgres)
 		$(use_with lmdb)
 		$(use_with python)
-		$(use_with ssl openssl "${EPREFIX}"/usr)
 		$(use_with xml libxml2)
 		$(use_with zlib)
 	)
@@ -211,19 +209,19 @@ src_install() {
 
 	if use gost; then
 		sed -e 's/^OPENSSL_LIBGOST=${OPENSSL_LIBGOST:-0}$/OPENSSL_LIBGOST=${OPENSSL_LIBGOST:-1}/' \
-			-i "${ED%/}/etc/init.d/named" || die
+			-i "${ED}/etc/init.d/named" || die
 	else
 		sed -e 's/^OPENSSL_LIBGOST=${OPENSSL_LIBGOST:-1}$/OPENSSL_LIBGOST=${OPENSSL_LIBGOST:-0}/' \
-			-i "${ED%/}/etc/init.d/named" || die
+			-i "${ED}/etc/init.d/named" || die
 	fi
 
 	newenvd "${FILESDIR}"/10bind.env 10bind
 
 	# Let's get rid of those tools and their manpages since they're provided by bind-tools
-	rm -f "${ED%/}"/usr/share/man/man1/{dig,host,nslookup}.1* || die
-	rm -f "${ED%/}"/usr/share/man/man8/nsupdate.8* || die
-	rm -f "${ED%/}"/usr/bin/{dig,host,nslookup,nsupdate} || die
-	rm -f "${ED%/}"/usr/sbin/{dig,host,nslookup,nsupdate} || die
+	rm -f "${ED}"/usr/share/man/man1/{dig,host,nslookup}.1* || die
+	rm -f "${ED}"/usr/share/man/man8/nsupdate.8* || die
+	rm -f "${ED}"/usr/bin/{dig,host,nslookup,nsupdate} || die
+	rm -f "${ED}"/usr/sbin/{dig,host,nslookup,nsupdate} || die
 	for tool in dsfromkey importkey keyfromlabel keygen \
 	  revoke settime signzone verify; do
 		rm -f "${ED%/}"/usr/{,s}bin/dnssec-"${tool}" || die
@@ -244,16 +242,16 @@ src_install() {
 		}
 		python_foreach_impl install_python_tools
 
-		python_replicate_script "${ED%/}/usr/sbin/dnssec-checkds"
-		python_replicate_script "${ED%/}/usr/sbin/dnssec-coverage"
+		python_replicate_script "${ED}/usr/sbin/dnssec-checkds"
+		python_replicate_script "${ED}/usr/sbin/dnssec-coverage"
 	fi
 
 	# bug 450406
 	dosym named.cache /var/bind/root.cache
 
-	dosym /var/bind/pri /etc/bind/pri
-	dosym /var/bind/sec /etc/bind/sec
-	dosym /var/bind/dyn /etc/bind/dyn
+	dosym "${ED}"/var/bind/pri /etc/bind/pri
+	dosym "${ED}"/var/bind/sec /etc/bind/sec
+	dosym "${ED}"/var/bind/dyn /etc/bind/dyn
 	keepdir /var/bind/{pri,sec,dyn}
 
 	dodir /var/log/named
diff --git a/net-dns/bind/bind-9.14.5.ebuild b/net-dns/bind/bind-9.14.5.ebuild
new file mode 100644
index 000000000000..6f05b895942c
--- /dev/null
+++ b/net-dns/bind/bind-9.14.5.ebuild
@@ -0,0 +1,372 @@
+# Copyright 1999-2019 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+# Re dlz/mysql and threads, needs to be verified..
+# MySQL uses thread local storage in its C api. Thus MySQL
+# requires that each thread of an application execute a MySQL
+# thread initialization to setup the thread local storage.
+# This is impossible to do safely while staying within the DLZ
+# driver API. This is a limitation caused by MySQL, and not the DLZ API.
+# Because of this BIND MUST only run with a single thread when
+# using the MySQL driver.
+
+EAPI=7
+
+PYTHON_COMPAT=( python2_7 python3_{5,6,7} )
+
+inherit python-r1 eutils autotools toolchain-funcs flag-o-matic multilib db-use user systemd
+
+MY_PV="${PV/_p/-P}"
+MY_PV="${MY_PV/_rc/rc}"
+MY_P="${PN}-${MY_PV}"
+
+SDB_LDAP_VER="1.1.0-fc14"
+
+RRL_PV="${MY_PV}"
+
+# SDB-LDAP: http://bind9-ldap.bayour.com/
+
+DESCRIPTION="Berkeley Internet Name Domain - Name Server"
+HOMEPAGE="https://www.isc.org/software/bind"
+SRC_URI="https://downloads.isc.org/isc/bind9/${PV}/${P}.tar.gz
+	doc? ( mirror://gentoo/dyndns-samples.tbz2 )"
+#	sdb-ldap? (
+#		http://ftp.disconnected-by-peer.at/pub/bind-sdb-ldap-${SDB_LDAP_VER}.patch.bz2
+#	)"
+
+LICENSE="Apache-2.0 BSD BSD-2 GPL-2 HPND ISC MPL-2.0"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~x86-fbsd ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+# -berkdb by default re bug 602682
+IUSE="-berkdb +caps dlz dnstap doc dnsrps fixed-rrset geoip geoip2 gssapi
+json ldap libressl lmdb mysql odbc postgres python selinux static-libs
+urandom xml +zlib"
+# sdb-ldap - patch broken
+# no PKCS11 currently as it requires OpenSSL to be patched, also see bug 409687
+
+REQUIRED_USE="
+	?? ( geoip geoip2 )
+	postgres? ( dlz )
+	berkdb? ( dlz )
+	mysql? ( dlz )
+	odbc? ( dlz )
+	ldap? ( dlz )
+	python? ( ${PYTHON_REQUIRED_USE} )"
+# sdb-ldap? ( dlz )
+
+DEPEND="!libressl? ( dev-libs/openssl:0[-bindist] )
+	libressl? ( dev-libs/libressl )
+	mysql? ( dev-db/mysql-connector-c:0= )
+	odbc? ( >=dev-db/unixODBC-2.2.6 )
+	ldap? ( net-nds/openldap )
+	postgres? ( dev-db/postgresql:= )
+	caps? ( >=sys-libs/libcap-2.1.0 )
+	xml? ( dev-libs/libxml2 )
+	geoip? ( >=dev-libs/geoip-1.4.6 )
+	geoip2? ( dev-libs/libmaxminddb )
+	gssapi? ( virtual/krb5 )
+	json? ( dev-libs/json-c:= )
+	lmdb? ( dev-db/lmdb )
+	zlib? ( sys-libs/zlib )
+	dnstap? ( dev-libs/fstrm dev-libs/protobuf-c )
+	python? (
+		${PYTHON_DEPS}
+		dev-python/ply[${PYTHON_USEDEP}]
+	)"
+#	sdb-ldap? ( net-nds/openldap )
+
+RDEPEND="${DEPEND}
+	selinux? ( sec-policy/selinux-bind )
+	|| ( sys-process/psmisc >=sys-freebsd/freebsd-ubin-9.0_rc )"
+
+S="${WORKDIR}/${MY_P}"
+
+# bug 479092, requires networking
+RESTRICT="test"
+
+pkg_setup() {
+	ebegin "Creating named group and user"
+	enewgroup named 40
+	enewuser named 40 -1 /etc/bind named
+	eend ${?}
+}
+
+src_prepare() {
+	default
+
+	export LDFLAGS="${LDFLAGS} -L${EPREFIX}/usr/$(get_libdir)"
+
+	# Adjusting PATHs in manpages
+	for i in bin/{named/named.8,check/named-checkconf.8,rndc/rndc.8} ; do
+		sed -i \
+			-e 's:/etc/named.conf:/etc/bind/named.conf:g' \
+			-e 's:/etc/rndc.conf:/etc/bind/rndc.conf:g' \
+			-e 's:/etc/rndc.key:/etc/bind/rndc.key:g' \
+			"${i}" || die "sed failed, ${i} doesn't exist"
+	done
+
+#	if use dlz; then
+#		# sdb-ldap patch as per  bug #160567
+#		# Upstream URL: http://bind9-ldap.bayour.com/
+#		# New patch take from bug 302735
+#		if use sdb-ldap; then
+#			epatch "${WORKDIR}"/${PN}-sdb-ldap-${SDB_LDAP_VER}.patch
+#			cp -fp contrib/sdb/ldap/ldapdb.[ch] bin/named/
+#			cp -fp contrib/sdb/ldap/{ldap2zone.1,ldap2zone.c} bin/tools/
+#			cp -fp contrib/sdb/ldap/{zone2ldap.1,zone2ldap.c} bin/tools/
+#		fi
+#	fi
+
+	# should be installed by bind-tools
+	sed -i -r -e "s:(nsupdate|dig|delv) ::g" bin/Makefile.in || die
+
+	# Disable tests for now, bug 406399
+	sed -i '/^SUBDIRS/s:tests::' bin/Makefile.in lib/Makefile.in || die
+
+	# bug #220361
+	rm aclocal.m4 || die
+	rm -rf libtool.m4/ || die
+	eautoreconf
+}
+
+src_configure() {
+	local myeconfargs=(
+		--sysconfdir=/etc/bind
+		--localstatedir=/var
+		--with-libtool
+		--enable-full-report
+		--without-readline
+		$(use_enable caps linux-caps)
+		$(use_enable dnsrps)
+		$(use_enable dnstap)
+		$(use_enable fixed-rrset)
+		# $(use_enable static-libs static)
+		$(use_with berkdb dlz-bdb)
+		$(use_with dlz dlopen)
+		$(use_with dlz dlz-filesystem)
+		$(use_with dlz dlz-stub)
+		$(use_with gssapi)
+		$(use_with json libjson)
+		$(use_with ldap dlz-ldap)
+		$(use_with mysql dlz-mysql)
+		$(use_with odbc dlz-odbc)
+		$(use_with postgres dlz-postgres)
+		$(use_with lmdb)
+		$(use_with python)
+		$(use_with xml libxml2)
+		$(use_with zlib)
+	)
+
+	use geoip && myeconfargs+=( --with-geoip )
+	use geoip2 && myeconfargs+=( --with-geoip2 )
+
+	# bug #158664
+#	gcc-specs-ssp && replace-flags -O[23s] -O
+
+	# To include db.h from proper path
+	use berkdb && append-flags "-I$(db_includedir)"
+
+	export BUILD_CC=$(tc-getBUILD_CC)
+	econf "${myeconfargs[@]}"
+
+	# bug #151839
+	echo '#undef SO_BSDCOMPAT' >> config.h
+}
+
+src_install() {
+	default
+
+	dodoc CHANGES README
+
+	if use doc; then
+		dodoc doc/arm/Bv9ARM.pdf
+
+		docinto misc
+		dodoc -r doc/misc/
+
+		# might a 'html' useflag make sense?
+		docinto html
+		dodoc -r doc/arm/
+
+		docinto contrib
+		dodoc contrib/scripts/{nanny.pl,named-bootconf.sh}
+
+		# some handy-dandy dynamic dns examples
+		pushd "${ED%/}"/usr/share/doc/${PF} 1>/dev/null || die
+		tar xf "${DISTDIR}"/dyndns-samples.tbz2 || die
+		popd 1>/dev/null || die
+	fi
+
+	insinto /etc/bind
+	newins "${FILESDIR}"/named.conf-r8 named.conf
+
+	# ftp://ftp.rs.internic.net/domain/named.cache:
+	insinto /var/bind
+	newins "${FILESDIR}"/named.cache-r3 named.cache
+
+	insinto /var/bind/pri
+	newins "${FILESDIR}"/localhost.zone-r3 localhost.zone
+
+	newinitd "${FILESDIR}"/named.init-r13 named
+	newconfd "${FILESDIR}"/named.confd-r7 named
+
+	newenvd "${FILESDIR}"/10bind.env 10bind
+
+	# Let's get rid of those tools and their manpages since they're provided by bind-tools
+	rm -f "${ED}"/usr/share/man/man1/{dig,host,nslookup}.1* || die
+	rm -f "${ED}"/usr/share/man/man8/nsupdate.8* || die
+	rm -f "${ED}"/usr/bin/{dig,host,nslookup,nsupdate} || die
+	rm -f "${ED}"/usr/sbin/{dig,host,nslookup,nsupdate} || die
+	for tool in dsfromkey importkey keyfromlabel keygen \
+	  revoke settime signzone verify; do
+		rm -f "${ED}"/usr/{,s}bin/dnssec-"${tool}" || die
+		rm -f "${ED}"/usr/share/man/man8/dnssec-"${tool}".8* || die
+	done
+
+	# bug 405251, library archives aren't properly handled by --enable/disable-static
+	if ! use static-libs; then
+		find "${ED}" -type f -name '*.a' -delete || die
+	fi
+
+	# bug 405251
+	find "${ED}" -type f -name '*.la' -delete || die
+
+	if use python; then
+		install_python_tools() {
+			dosbin bin/python/dnssec-{checkds,coverage}
+		}
+		python_foreach_impl install_python_tools
+
+		python_replicate_script "${ED}/usr/sbin/dnssec-checkds"
+		python_replicate_script "${ED}/usr/sbin/dnssec-coverage"
+	fi
+
+	# bug 450406
+	dosym named.cache /var/bind/root.cache
+
+	dosym "${ED}"/var/bind/pri /etc/bind/pri
+	dosym "${ED}"/var/bind/sec /etc/bind/sec
+	dosym "${ED}"/var/bind/dyn /etc/bind/dyn
+	keepdir /var/bind/{pri,sec,dyn}
+
+	dodir /var/log/named
+
+	fowners root:named /{etc,var}/bind /var/log/named /var/bind/{sec,pri,dyn}
+	fowners root:named /var/bind/named.cache /var/bind/pri/localhost.zone /etc/bind/{bind.keys,named.conf}
+	fperms 0640 /var/bind/named.cache /var/bind/pri/localhost.zone /etc/bind/{bind.keys,named.conf}
+	fperms 0750 /etc/bind /var/bind/pri
+	fperms 0770 /var/log/named /var/bind/{,sec,dyn}
+
+	systemd_newunit "${FILESDIR}/named.service-r1" named.service
+	systemd_dotmpfilesd "${FILESDIR}"/named.conf
+	exeinto /usr/libexec
+	doexe "${FILESDIR}/generate-rndc-key.sh"
+}
+
+pkg_postinst() {
+	if [ ! -f '/etc/bind/rndc.key' ]; then
+		if use urandom; then
+			einfo "Using /dev/urandom for generating rndc.key"
+			/usr/sbin/rndc-confgen -r /dev/urandom -a
+			echo
+		else
+			einfo "Using /dev/random for generating rndc.key"
+			/usr/sbin/rndc-confgen -a
+			echo
+		fi
+		chown root:named /etc/bind/rndc.key || die
+		chmod 0640 /etc/bind/rndc.key || die
+	fi
+
+	einfo
+	einfo "You can edit /etc/conf.d/named to customize named settings"
+	einfo
+	use mysql || use postgres || use ldap && {
+		elog "If your named depends on MySQL/PostgreSQL or LDAP,"
+		elog "uncomment the specified rc_named_* lines in your"
+		elog "/etc/conf.d/named config to ensure they'll start before bind"
+		einfo
+	}
+	einfo "If you'd like to run bind in a chroot AND this is a new"
+	einfo "install OR your bind doesn't already run in a chroot:"
+	einfo "1) Uncomment and set the CHROOT variable in /etc/conf.d/named."
+	einfo "2) Run \`emerge --config '=${CATEGORY}/${PF}'\`"
+	einfo
+
+	CHROOT=$(source /etc/conf.d/named 2>/dev/null; echo ${CHROOT})
+	if [[ -n ${CHROOT} ]]; then
+		elog "NOTE: As of net-dns/bind-9.4.3_p5-r1 the chroot part of the init-script got some major changes!"
+		elog "To enable the old behaviour (without using mount) uncomment the"
+		elog "CHROOT_NOMOUNT option in your /etc/conf.d/named config."
+		elog "If you decide to use the new/default method, ensure to make backup"
+		elog "first and merge your existing configs/zones to /etc/bind and"
+		elog "/var/bind because bind will now mount the needed directories into"
+		elog "the chroot dir."
+	fi
+}
+
+pkg_config() {
+	CHROOT=$(source /etc/conf.d/named; echo ${CHROOT})
+	CHROOT_NOMOUNT=$(source /etc/conf.d/named; echo ${CHROOT_NOMOUNT})
+	CHROOT_GEOIP=$(source /etc/conf.d/named; echo ${CHROOT_GEOIP})
+
+	if [[ -z "${CHROOT}" ]]; then
+		eerror "This config script is designed to automate setting up"
+		eerror "a chrooted bind/named. To do so, please first uncomment"
+		eerror "and set the CHROOT variable in '/etc/conf.d/named'."
+		die "Unset CHROOT"
+	fi
+	if [[ -d "${CHROOT}" ]]; then
+		ewarn "NOTE: As of net-dns/bind-9.4.3_p5-r1 the chroot part of the init-script got some major changes!"
+		ewarn "To enable the old behaviour (without using mount) uncomment the"
+		ewarn "CHROOT_NOMOUNT option in your /etc/conf.d/named config."
+		ewarn
+		ewarn "${CHROOT} already exists... some things might become overridden"
+		ewarn "press CTRL+C if you don't want to continue"
+		sleep 10
+	fi
+
+	echo; einfo "Setting up the chroot directory..."
+
+	mkdir -m 0750 -p ${CHROOT} || die
+	mkdir -m 0755 -p ${CHROOT}/{dev,etc,var/log,run} || die
+	mkdir -m 0750 -p ${CHROOT}/etc/bind || die
+	mkdir -m 0770 -p ${CHROOT}/var/{bind,log/named} ${CHROOT}/run/named/ || die
+
+	chown root:named \
+		${CHROOT} \
+		${CHROOT}/var/{bind,log/named} \
+		${CHROOT}/run/named/ \
+		${CHROOT}/etc/bind \
+		|| die
+
+	mknod ${CHROOT}/dev/null c 1 3 || die
+	chmod 0666 ${CHROOT}/dev/null || die
+
+	mknod ${CHROOT}/dev/zero c 1 5 || die
+	chmod 0666 ${CHROOT}/dev/zero || die
+
+	if use urandom; then
+		mknod ${CHROOT}/dev/urandom c 1 9 || die
+		chmod 0666 ${CHROOT}/dev/urandom || die
+	else
+		mknod ${CHROOT}/dev/random c 1 8 || die
+		chmod 0666 ${CHROOT}/dev/random || die
+	fi
+
+	if [ "${CHROOT_NOMOUNT:-0}" -ne 0 ]; then
+		cp -a /etc/bind ${CHROOT}/etc/ || die
+		cp -a /var/bind ${CHROOT}/var/ || die
+	fi
+
+	if [ "${CHROOT_GEOIP:-0}" -eq 1 ]; then
+		if use geoip; then
+			mkdir -m 0755 -p ${CHROOT}/usr/share/GeoIP || die
+		elif use geoip2; then
+			mkdir -m 0755 -p ${CHROOT}/usr/share/GeoIP2 || die
+		fi
+	fi
+
+	elog "You may need to add the following line to your syslog-ng.conf:"
+	elog "source jail { unix-stream(\"${CHROOT}/dev/log\"); };"
+}
diff --git a/net-dns/bind/bind-9.15.2.ebuild b/net-dns/bind/bind-9.15.2.ebuild
index d1efa262a4a5..b26c1f1fbdb5 100644
--- a/net-dns/bind/bind-9.15.2.ebuild
+++ b/net-dns/bind/bind-9.15.2.ebuild
@@ -39,7 +39,7 @@ SLOT="0"
 KEYWORDS=""
 # -berkdb by default re bug 602682
 IUSE="-berkdb +caps dlz dnstap doc dnsrps fixed-rrset geoip gost gssapi
-json ldap libressl lmdb mysql odbc postgres python selinux ssl static-libs
+json ldap libressl lmdb mysql odbc postgres python selinux static-libs
 urandom xml +zlib"
 # sdb-ldap - patch broken
 # no PKCS11 currently as it requires OpenSSL to be patched, also see bug 409687
@@ -53,11 +53,8 @@ REQUIRED_USE="
 	python? ( ${PYTHON_REQUIRED_USE} )"
 # sdb-ldap? ( dlz )
 
-DEPEND="
-	ssl? (
-		!libressl? ( dev-libs/openssl:0[-bindist] )
-		libressl? ( dev-libs/libressl )
-	)
+DEPEND="!libressl? ( dev-libs/openssl:0[-bindist] )
+	libressl? ( dev-libs/libressl )
 	mysql? ( dev-db/mysql-connector-c:0= )
 	odbc? ( >=dev-db/unixODBC-2.2.6 )
 	ldap? ( net-nds/openldap )
@@ -78,7 +75,7 @@ DEPEND="
 
 RDEPEND="${DEPEND}
 	selinux? ( sec-policy/selinux-bind )
-	|| ( sys-process/psmisc >=sys-freebsd/freebsd-ubin-9.0_rc sys-process/fuser-bsd )"
+	|| ( sys-process/psmisc >=sys-freebsd/freebsd-ubin-9.0_rc )"
 
 S="${WORKDIR}/${MY_P}"
 
@@ -95,6 +92,8 @@ pkg_setup() {
 src_prepare() {
 	default
 
+	export LDFLAGS="${LDFLAGS} -L${EPREFIX}/usr/$(get_libdir)"
+
 	# Adjusting PATHs in manpages
 	for i in bin/{named/named.8,check/named-checkconf.8,rndc/rndc.8} ; do
 		sed -i \
@@ -152,7 +151,6 @@ src_configure() {
 		$(use_with postgres dlz-postgres)
 		$(use_with lmdb)
 		$(use_with python)
-		$(use_with ssl openssl "${EPREFIX}"/usr)
 		$(use_with xml libxml2)
 		$(use_with zlib)
 	)
diff --git a/net-dns/bind/metadata.xml b/net-dns/bind/metadata.xml
index 5c09dd2e7744..f9a219809fa9 100644
--- a/net-dns/bind/metadata.xml
+++ b/net-dns/bind/metadata.xml
@@ -15,6 +15,7 @@
 		<flag name="dnsrps">Enable the DNS Response Policy Service (DNSRPS) API, a mechanism to allow an external response policy provider</flag>
 		<flag name="dlz">Enables dynamic loaded zones, 3rd party extension</flag>
 		<flag name="fixed-rrset">Enables fixed rrset-order option</flag>
+		<flag name="geoip2">Enable GeoIP2 API from MaxMind</flag>
 		<flag name="gost">Enables gost OpenSSL engine support</flag>
 		<flag name="gssapi">Enable gssapi support</flag>
 		<flag name="json">Enable JSON statistics channel</flag>
diff --git a/net-dns/dnsmasq/Manifest b/net-dns/dnsmasq/Manifest
index 20f4034f9f2a..f202ce28e1a4 100644
--- a/net-dns/dnsmasq/Manifest
+++ b/net-dns/dnsmasq/Manifest
@@ -8,6 +8,6 @@ AUX dnsmasq.service-r1 278 BLAKE2B 3bfe6a01efd5f8338c3bb134a061f8ecbef850293c4a8
 DIST dnsmasq-2.79.tar.xz 493036 BLAKE2B 91152c52aef06def74151f6fbae9153d25261ba5e6a728cbab503c074967963e40dce39d93a0fbe4c5497c9313ac24d495cc8233934c00d4ab82aefe83b01ccd SHA512 2c06212696ab55e1584f6133872f5b196013509e4b1822d0457787b456e14341afdde887749e370a2e512124cb4138f012f4601b08690707be4acc7cf2f2876f
 DIST dnsmasq-2.80.tar.xz 501072 BLAKE2B 39c9808df43a22e32286105c9e001b2f817a4f68b92b84282eeb8cfeaa61404d64275bbb3f944bec6fac1b015987fba6aeab7a88201446c0cff67f02c8d88d8c SHA512 58e56beb553fc41311e5dc16d8b0eb3b6801e2bdfbcd0e7a6659703f08960b6ad10d48b0b14a4d727636faf35483e01597cff2ae49e7fe9fa9e214f437b1c068
 EBUILD dnsmasq-2.79.ebuild 4594 BLAKE2B 28cf745cd261bf067114adc98733f5e00a2f6a10a906d4eaf2175c0457d538d7d96b91fe87a87320c3df27a5c64234ed7d5bbee993070964fa421b8e5b12693c SHA512 eb8ac4fdf747657983909b22baa2e0af5f2299d2a5ab4d97933b185e528cddbb1d4cc7ca14c2efddcd8c6f4ec9861f3c37d9fc59c96b68f55c45a274acf7eff7
-EBUILD dnsmasq-2.80-r1.ebuild 4809 BLAKE2B 3e69803a3f70a3d64d2b34609407791b66546c000b601bea27369b14207a01775acdec510df88119f1b3d9329d8589896eee6ac80526e9625530ef089ebd357e SHA512 b4dbb133a052007d9a1f8111df056a883c2d5de76a7c510782a9f521448803fd1f993b89dd4360752d90e2b5b75f9fb518140317bed0fd88fd724b8ad53d3365
+EBUILD dnsmasq-2.80-r1.ebuild 4804 BLAKE2B 0cdafef75a132aca8365120e4fa54df4f48de281cd5d2a5e587864389fb86c332bdcc459c148b712e8acdf4b172bf094cb7e07133f1ad7a1d02dd0dae06b6809 SHA512 d2c342597d88de56440c0345b93ae57de6cfe1f132ff5b6c570426b7f8e08891738764b9adc772240b7f75b988668c350f421a230615dfa50a4643dcff930910
 EBUILD dnsmasq-2.80.ebuild 4742 BLAKE2B 4844bb2c2fed9d35ee6358bedf86c9fac3feacedc965628b53687bc22ac672f2a5a7eef90f112a0a1446fb99ce79c7233d2178b5bf7773e8fad23dc2a1557f2b SHA512 a278d6e216bde4d31671481eb7d9ec302789854119229c0852a1204b7b059213ca19ed48b99afe75221e39494c358f537d56a6da1e5275ef563844ff4083e49e
 MISC metadata.xml 1247 BLAKE2B cdaa193ae5c90b1f833968bafb1e725be1f67d21ee9025552fe2c153d096f2b4b7cd505aabe3713678426bea2a1059de3eeebd58a9d81793520f2690e5bf4851 SHA512 24cd4320dad43122014b0c5ddd5d65a199ef6d0bb378738180e03e4f0410cc1c21ee46b7973bdadca6e6323f3e9c6ce0073a813d4ecfe3e6bac44645dc9970dc
diff --git a/net-dns/dnsmasq/dnsmasq-2.80-r1.ebuild b/net-dns/dnsmasq/dnsmasq-2.80-r1.ebuild
index e73c42b41c10..be6a1b57d82a 100644
--- a/net-dns/dnsmasq/dnsmasq-2.80-r1.ebuild
+++ b/net-dns/dnsmasq/dnsmasq-2.80-r1.ebuild
@@ -16,10 +16,6 @@ KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~mips ~ppc ~ppc64 ~s390 ~sh ~spa
 IUSE="auth-dns conntrack dbus +dhcp dhcp-tools dnssec +dumpfile id idn libidn2"
 IUSE+=" +inotify ipv6 lua nls script selinux static tftp"
 
-PATCHES=(
-	"${FILESDIR}/${P}-nettle-3.5.patch"
-)
-
 DM_LINGUAS=(de es fi fr id it no pl pt_BR ro)
 
 BDEPEND="app-arch/xz-utils
@@ -58,6 +54,7 @@ REQUIRED_USE="dhcp-tools? ( dhcp )
 	libidn2? ( idn )"
 
 PATCHES=(
+	"${FILESDIR}/dnsmasq-2.80-nettle-3.5.patch"
 	"${FILESDIR}/dnsmasq-2.80-linux-headers-5.2.patch"
 )
 
diff --git a/net-dns/knot/Manifest b/net-dns/knot/Manifest
index 651aea6c6fb6..faa1f07f894b 100644
--- a/net-dns/knot/Manifest
+++ b/net-dns/knot/Manifest
@@ -2,7 +2,11 @@ AUX knot-1.service 337 BLAKE2B a6645b2ab92612f3c6640f4e9601cefe087a519d8a40b222e
 AUX knot.init 861 BLAKE2B 30ffe287f4f83058407ceab00b2113dade3b60b38d76c86f156cc31c33cc4f2ec8cf7f22172823755b71385ca18cc1044605b5479c9de05284f911d500b5dc40 SHA512 e5faa96cbee618e9042bdfd0628f06c4bc4d23c7295521771e16f6eae715835a240799e8425317b03b1ea162966defb5d6b6592139cb1d9d61b47a24961ec9b9
 AUX knot.service 275 BLAKE2B c39b50630a84cb20d33a02ad82c0fc0c994b098766af0cd3e11b4ac6e2f6e6ebc38d6e5b99c358d5e771022fd6ad14fb7e04e95fd77ba677d10950e1fc52e9a9 SHA512 37c4700320a2781aa93ca92bc2634c3e080c87337b7d632d0e2fa23f6e2e8fa1985d1d8e2516fed02b612da4d340472d5f8d0ae37c5b323ac17bbd61ca243a86
 DIST knot-2.7.7.tar.xz 1156996 BLAKE2B aa31233cf9af9f8060a40788529593d35912992472d5b9d892e632ba4cbf08a0f0adec6ed00d1152bf6cd443e3a659fa88050355e65a71cc2a3aac3c453bdc44 SHA512 95c341ce7c8cc2e65429d6e3bf009844fbd82ca5a0e36019f0e019ce35fc3ba8b68c159d34637380f6a3ad3dc2291ed5adc37e91515b2b6ecf61f7078ddad841
+DIST knot-2.7.8.tar.xz 1158284 BLAKE2B 513670a05d9014e990f09e525dd638cfaac00027172a09734e23302bfdc1bd8d61d145e566485410ee1277dfdc48317afeffc9064dad6e88b1938965ba862924 SHA512 e220e9d885f488119bcb8324576b981e4c45e15d710595d6acaf121fbff9442e5c1d8c723c11dcd9cbc4d26e7a5200f002d52a94c67ba8af04f5c0c82615def7
 DIST knot-2.8.2.tar.xz 1193760 BLAKE2B 0afd70740be103d596856dfcfea629b5216aa41e8e0044f050a993967c7bf53a129fd824d1d1ec6fef4d41072f25225f06a6113bf86266d755d6f944c8b5799f SHA512 d7a045cc7b1a1f43b9536283d4202d7f8f36ac2160e0b985b40f318cc0041f3c3e977ff2db6f518dd37ea62d93d0d3f617bca1ac0dff81185bf5dcb9c1eac97b
+DIST knot-2.8.3.tar.xz 1206172 BLAKE2B f306b5c788bb27c8062284167378046a4f77926b805f9c2fb84b5192f51d2079547cf740b9b156673e6bfc2a5f28d6ff6762dc7d854a56a0a98d1dcac9f39fca SHA512 a5743181807b944c9b6dfce845f009c576125c114fbac7b87592129b724628466740fb77e41cabd8aaf9f046374a9337a1c97ea74b33afae1af6e39e21f8e662
 EBUILD knot-2.7.7.ebuild 1962 BLAKE2B 37fd12290d609d8e5874f3e1cece9b600be35b90466b318e33f32c47ea422a6538c9c04cada4218d9fe91ea5b08fc23348c362ba19f8e425694a2fe1998d7c62 SHA512 8557b7aab3e1cbd7ab1bc0f1c0b510f9060c30ac1add36687340d3a6de16961394bbcf710230b70f9b1b890df1301c284993b1014bdde2cb83934d863d055fb7
+EBUILD knot-2.7.8.ebuild 1887 BLAKE2B 50877ea27c72362a6121b4c26a5fc5897ccb77ed94c95c695e6ecf7d61d6a2d13b6c8e1e582f8806a7c93e0e142776c1fb4f60813d644df25bc07b165a364e54 SHA512 c03750e0a03b492cadf77e41280ff7383bed4f38b52e82abb594edb6f86c053c875dbd06f8070e4a1348c63948a7056d81dfd684912f0143446a2ebfa5e13437
 EBUILD knot-2.8.2.ebuild 1962 BLAKE2B 37fd12290d609d8e5874f3e1cece9b600be35b90466b318e33f32c47ea422a6538c9c04cada4218d9fe91ea5b08fc23348c362ba19f8e425694a2fe1998d7c62 SHA512 8557b7aab3e1cbd7ab1bc0f1c0b510f9060c30ac1add36687340d3a6de16961394bbcf710230b70f9b1b890df1301c284993b1014bdde2cb83934d863d055fb7
+EBUILD knot-2.8.3.ebuild 1887 BLAKE2B 50877ea27c72362a6121b4c26a5fc5897ccb77ed94c95c695e6ecf7d61d6a2d13b6c8e1e582f8806a7c93e0e142776c1fb4f60813d644df25bc07b165a364e54 SHA512 c03750e0a03b492cadf77e41280ff7383bed4f38b52e82abb594edb6f86c053c875dbd06f8070e4a1348c63948a7056d81dfd684912f0143446a2ebfa5e13437
 MISC metadata.xml 1677 BLAKE2B 89c3190781cf6b6d6217c84dd45f78ebd86695e9c224c7fa7f5112b246b95b982fb025c6c30b065d59b11f3acdcabda8e92b0da001cf1a7ad3e67ee9b2207d3c SHA512 d1e480d3e5d422b94a952a8fd0a679052d24724cccdda0bf13808f1a6b47b129a1db6ad17a0a42d9a6d315e9cbe64293a1a22077b7affc36862313ff8715d9e1
diff --git a/net-dns/knot/knot-2.7.8.ebuild b/net-dns/knot/knot-2.7.8.ebuild
new file mode 100644
index 000000000000..aa3b0735e370
--- /dev/null
+++ b/net-dns/knot/knot-2.7.8.ebuild
@@ -0,0 +1,103 @@
+# Copyright 1999-2019 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+inherit systemd
+
+DESCRIPTION="High-performance authoritative-only DNS server"
+HOMEPAGE="https://www.knot-dns.cz/"
+SRC_URI="https://secure.nic.cz/files/knot-dns/${P/_/-}.tar.xz"
+
+LICENSE="GPL-3"
+SLOT="0"
+KEYWORDS="~amd64 ~x86"
+
+KNOT_MODULES=(
+	"+cookies"
+	"+dnsproxy"
+	"dnstap"
+	"geoip"
+	"+noudp"
+	"+onlinesign"
+	"+queryacl"
+	"+rrl"
+	"+stats"
+	"+synthrecord"
+	"+whoami"
+)
+IUSE="doc caps +fastparser idn +libidn2 systemd +utils ${KNOT_MODULES[@]}"
+
+RDEPEND="
+	acct-group/knot
+	acct-user/knot
+	dev-db/lmdb
+	dev-libs/libedit
+	dev-libs/userspace-rcu:=
+	dev-python/lmdb
+	net-libs/gnutls:=
+	caps? ( sys-libs/libcap-ng )
+	dnstap? (
+		dev-libs/fstrm
+		dev-libs/protobuf-c:=
+	)
+	geoip? ( dev-libs/libmaxminddb:= )
+	idn? (
+		!libidn2? ( net-dns/libidn:0= !net-dns/libidn2 )
+		libidn2? ( net-dns/libidn2:= )
+	)
+	systemd? ( sys-apps/systemd:= )
+"
+DEPEND="${RDEPEND}"
+BDEPEND="
+	virtual/pkgconfig
+	doc? ( dev-python/sphinx )
+"
+
+S="${WORKDIR}/${P/_/-}"
+
+src_configure() {
+	local u
+	local my_conf=(
+		--with-storage="${EPREFIX}/var/lib/${PN}"
+		--with-rundir="${EPREFIX}/var/run/${PN}"
+		$(use_enable fastparser)
+		$(use_enable dnstap)
+		$(use_enable doc documentation)
+		$(use_enable utils utilities)
+		--enable-systemd=$(usex systemd)
+		$(use_with idn libidn)
+	)
+
+	for u in "${KNOT_MODULES[@]#+}"; do
+		my_conf+=("$(use_with ${u} module-${u})")
+	done
+
+	econf "${my_conf[@]}"
+}
+
+src_compile() {
+	default
+
+	if use doc; then
+		emake -C doc html
+		HTML_DOCS=( doc/_build/html/{*.html,*.js,_sources,_static} )
+	fi
+}
+
+src_test() {
+	emake check
+}
+
+src_install() {
+	default
+
+	rmdir "${D}/var/run/${PN}" "${D}/var/run/" || die
+
+	newinitd "${FILESDIR}/knot.init" knot
+	if use systemd; then
+		systemd_newunit "${FILESDIR}/knot-1.service" knot.service
+	fi
+
+	find "${D}" -name '*.la' -delete || die
+}
diff --git a/net-dns/knot/knot-2.8.3.ebuild b/net-dns/knot/knot-2.8.3.ebuild
new file mode 100644
index 000000000000..aa3b0735e370
--- /dev/null
+++ b/net-dns/knot/knot-2.8.3.ebuild
@@ -0,0 +1,103 @@
+# Copyright 1999-2019 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+inherit systemd
+
+DESCRIPTION="High-performance authoritative-only DNS server"
+HOMEPAGE="https://www.knot-dns.cz/"
+SRC_URI="https://secure.nic.cz/files/knot-dns/${P/_/-}.tar.xz"
+
+LICENSE="GPL-3"
+SLOT="0"
+KEYWORDS="~amd64 ~x86"
+
+KNOT_MODULES=(
+	"+cookies"
+	"+dnsproxy"
+	"dnstap"
+	"geoip"
+	"+noudp"
+	"+onlinesign"
+	"+queryacl"
+	"+rrl"
+	"+stats"
+	"+synthrecord"
+	"+whoami"
+)
+IUSE="doc caps +fastparser idn +libidn2 systemd +utils ${KNOT_MODULES[@]}"
+
+RDEPEND="
+	acct-group/knot
+	acct-user/knot
+	dev-db/lmdb
+	dev-libs/libedit
+	dev-libs/userspace-rcu:=
+	dev-python/lmdb
+	net-libs/gnutls:=
+	caps? ( sys-libs/libcap-ng )
+	dnstap? (
+		dev-libs/fstrm
+		dev-libs/protobuf-c:=
+	)
+	geoip? ( dev-libs/libmaxminddb:= )
+	idn? (
+		!libidn2? ( net-dns/libidn:0= !net-dns/libidn2 )
+		libidn2? ( net-dns/libidn2:= )
+	)
+	systemd? ( sys-apps/systemd:= )
+"
+DEPEND="${RDEPEND}"
+BDEPEND="
+	virtual/pkgconfig
+	doc? ( dev-python/sphinx )
+"
+
+S="${WORKDIR}/${P/_/-}"
+
+src_configure() {
+	local u
+	local my_conf=(
+		--with-storage="${EPREFIX}/var/lib/${PN}"
+		--with-rundir="${EPREFIX}/var/run/${PN}"
+		$(use_enable fastparser)
+		$(use_enable dnstap)
+		$(use_enable doc documentation)
+		$(use_enable utils utilities)
+		--enable-systemd=$(usex systemd)
+		$(use_with idn libidn)
+	)
+
+	for u in "${KNOT_MODULES[@]#+}"; do
+		my_conf+=("$(use_with ${u} module-${u})")
+	done
+
+	econf "${my_conf[@]}"
+}
+
+src_compile() {
+	default
+
+	if use doc; then
+		emake -C doc html
+		HTML_DOCS=( doc/_build/html/{*.html,*.js,_sources,_static} )
+	fi
+}
+
+src_test() {
+	emake check
+}
+
+src_install() {
+	default
+
+	rmdir "${D}/var/run/${PN}" "${D}/var/run/" || die
+
+	newinitd "${FILESDIR}/knot.init" knot
+	if use systemd; then
+		systemd_newunit "${FILESDIR}/knot-1.service" knot.service
+	fi
+
+	find "${D}" -name '*.la' -delete || die
+}
diff --git a/net-dns/nsd/Manifest b/net-dns/nsd/Manifest
index 40c478e54d68..20fe38969f78 100644
--- a/net-dns/nsd/Manifest
+++ b/net-dns/nsd/Manifest
@@ -3,10 +3,9 @@ AUX nsd.munin-conf 23 BLAKE2B 0b08804b2218d77ea925d4c9e26e73649b453b923d6d7b1e1d
 AUX nsd.service 272 BLAKE2B 66a7d4132246589f71341afd98361f6b02082be3d4e230c86ae690876a797ea0a4580b29892d91feba2785ea933a053f862e0d00f2c8a8c09ab907386c39a03c SHA512 fbca86887bfc36d61af06992cc98b3f3cb33c39274fbdc1e53d489bdcc767993911fab27a20244c3878b36bacbd1644a552364b2f7bf4d48e6eb247d0eecdf0f
 AUX nsd_munin_.patch 542 BLAKE2B 13ff49c41683d5bf505e257cd17bf5f3ad06662c00032d79b36be3f96486eb89fdd62a42b5ed4816ad99835366864603568613e27504894340ebb64057e2b2c3 SHA512 6034086d6b6f6980468766c901e92291fea8a32df179561ede2add5918c37bfe3aabf122735d4ae2e28efece394fd3398f9a0cc4d8fdcc1e5da1ca709d2ba6ae
 DIST nsd-4.1.27.tar.gz 1131881 BLAKE2B 94a7f7efe23d130b04258faca0f73690712919e14268e6efabf4029bc30273d8ef3155259b072190776b6cde32050b61ade0584175f00eef0129e4621d5896a3 SHA512 9c75041f5a6213cdba7238c2e51fc73031f6f073e06587659f93992fed49418ee789642b25b5522d48642507050ac15021f385927eed81ce5ea649f974e66402
-DIST nsd-4.2.0.tar.gz 1141796 BLAKE2B 3e3df373e2ff00c170b9c104e1a4ca7038f98ad613104f045c594b7df17d4d66be1473a07e545deb9096c6a3945570530c5639c7b2f4c76234f643bce8c4fb40 SHA512 caa14fcd599ddc631cb74c3a56e571044dae1deb2fa9bd6b062f143954f9207b64b42ab5eab917360161f96bae8711df932f3e18b58be98b3f7b640071e7e807
 DIST nsd-4.2.1.tar.gz 1145713 BLAKE2B 2cb265dbe274b68e2b038b98b37cf44b4dda4eb576f0fdae1c57686a3b99b0e2cdfd7f893ce196316ea02d1d872371cb36c00a35a5ddf8f83d66a981bf5b2560 SHA512 8f40baf7cc72b72a84f3c4eb45847f03b2f91e47dd7f3dfc89270c774565a8cc692363cee3547b0a2a124e9c43b23eed8887f95ae55b2e63af96c65467b85796
+DIST nsd-4.2.2.tar.gz 1149182 BLAKE2B 1cbac527063f7d14da589bd5060117da10fdd6a9e34b04eb763dbb94fe6c9cf09dc351985de3d099aea3377a4c945622871566c06e7f78aede885aa0c2bc5937 SHA512 43e2ee980a11ed0ad521cc9d8be1e2d29fa8ab552bdda043ffa7e5bc71cf07ad49319629f71e93dcf1dabd315f93bcfb9fd8b5847f27b125cf151fb4f63779b2
 EBUILD nsd-4.1.27.ebuild 3021 BLAKE2B 5af63c683a17a2d1fd1f997acec9a6ceea18a606313e011f2f90d04efa7afb201a994172b15a58f68935048dcf1e18479cf3da7e4326f616b5d0d9a98e910e1b SHA512 ee2fded785d879af29bdc9003c2a63d3c47efb2afabc1d8c72bee82392b84d9eeb780ad731c94190402b0e85c39ed5ead8078ddf18bd7672daf3c0e1c915ab51
-EBUILD nsd-4.2.0.ebuild 3047 BLAKE2B 7fff82ccb3e76556f3448788bef1058a77e0d53f709f167bccd77ae95730e7b1ac8045ff5d435f97e748b96bff09bbdab3dc37ba8f382c7eca8750b326c2f9f6 SHA512 bdf1841c2128fb2822dd2247515adae1c144965c0e94310a5fb42716a3b1e97bd549b110b5579fc1f3719521eab06faf97dcfca27dc990ed682002fb8b1824b3
 EBUILD nsd-4.2.1-r1.ebuild 2959 BLAKE2B c5f5d8d3080ddf40fba98d24c80e2440af5b83364b84a178ee646507504ffd1036135e10b9df71bdfc20c6da64989a497bc91320d14f2f5428a410661beba280 SHA512 7b1ae3ff916fca6cde66b4ada3647b0be59a23c60340606094eb8e40c0433699d96ef0ef1f6e8523084fb9b8b92201a0ee6e06caa1a2c58212e5517557c7dafd
-EBUILD nsd-4.2.1.ebuild 3047 BLAKE2B 7fff82ccb3e76556f3448788bef1058a77e0d53f709f167bccd77ae95730e7b1ac8045ff5d435f97e748b96bff09bbdab3dc37ba8f382c7eca8750b326c2f9f6 SHA512 bdf1841c2128fb2822dd2247515adae1c144965c0e94310a5fb42716a3b1e97bd549b110b5579fc1f3719521eab06faf97dcfca27dc990ed682002fb8b1824b3
+EBUILD nsd-4.2.2.ebuild 2959 BLAKE2B c5f5d8d3080ddf40fba98d24c80e2440af5b83364b84a178ee646507504ffd1036135e10b9df71bdfc20c6da64989a497bc91320d14f2f5428a410661beba280 SHA512 7b1ae3ff916fca6cde66b4ada3647b0be59a23c60340606094eb8e40c0433699d96ef0ef1f6e8523084fb9b8b92201a0ee6e06caa1a2c58212e5517557c7dafd
 MISC metadata.xml 1082 BLAKE2B c44a5b7b9cb5ad52ebc55dd52a584cd8b0700977a19d541df1b415164250e390941ef35a0e8633a975e6cbae402719d8c5fe7d452dde5623223b01a7ec4320ac SHA512 a66e71346c6742c77ce38ca73f600dde471f3256928bab79f2015cb88c2f3237a4d69f7b9127ea90c58f584b60b8b676416b0704761ee1455479644fd2cd5a8d
diff --git a/net-dns/nsd/nsd-4.2.1.ebuild b/net-dns/nsd/nsd-4.2.1.ebuild
deleted file mode 100644
index e8a9dc238025..000000000000
--- a/net-dns/nsd/nsd-4.2.1.ebuild
+++ /dev/null
@@ -1,117 +0,0 @@
-# Copyright 1999-2019 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=7
-
-inherit autotools user systemd
-
-# version voodoo needed only for non-release tarballs: 4.0.0_rc1 => 4.0.0rc1
-MY_PV="${PV/_beta/b}"
-MY_PV="${MY_PV/_rc/rc}"
-MY_P="${PN}-${MY_PV}"
-
-DESCRIPTION="An authoritative only, high performance, open source name server"
-HOMEPAGE="http://www.nlnetlabs.nl/projects/nsd"
-SRC_URI="http://www.nlnetlabs.nl/downloads/${PN}/${MY_P}.tar.gz"
-LICENSE="BSD"
-SLOT="0"
-KEYWORDS="~amd64 ~x86"
-IUSE="bind8-stats dnstap ipv6 libevent minimal-responses mmap munin +nsec3 ratelimit root-server runtime-checks ssl systemd libressl"
-
-S="${WORKDIR}/${MY_P}"
-
-RDEPEND="
-	dnstap? (
-		dev-libs/fstrm
-		dev-libs/protobuf-c
-	)
-	libevent? ( dev-libs/libevent )
-	munin? ( net-analyzer/munin )
-	ssl? (
-		!libressl? ( dev-libs/openssl:0= )
-		libressl? ( dev-libs/libressl:= )
-	)
-	systemd? ( sys-apps/systemd )
-"
-DEPEND="${RDEPEND}"
-BDEPEND="
-	sys-devel/flex
-	virtual/yacc
-	systemd? ( virtual/pkgconfig )
-"
-
-PATCHES=(
-	# Fix the paths in the munin plugin to match our install
-	"${FILESDIR}"/nsd_munin_.patch
-)
-
-src_prepare() {
-	default
-	eautoreconf
-}
-
-src_configure() {
-	local myeconfargs=(
-		--enable-largefile
-		--enable-pie
-		--enable-relro-now
-		--enable-tcp-fastopen
-		--with-dbfile="${EPREFIX}"/var/db/nsd/nsd.db
-		--with-logfile="${EPREFIX}"/var/log/nsd.log
-		--with-pidfile="${EPREFIX}"/run/nsd/nsd.pid
-		--with-xfrdfile="${EPREFIX}"/var/db/nsd/xfrd.state
-		--with-xfrdir="${EPREFIX}"/var/db/nsd
-		--with-zonelistfile="${EPREFIX}"/var/db/nsd/zone.list
-		--with-zonesdir="${EPREFIX}"/var/lib/nsd
-		$(use_enable bind8-stats)
-		$(use_enable bind8-stats zone-stats)
-		$(use_enable dnstap)
-		$(use_enable ipv6)
-		$(use_enable minimal-responses)
-		$(use_enable mmap)
-		$(use_enable nsec3)
-		$(use_enable ratelimit)
-		$(use_enable root-server)
-		$(use_enable runtime-checks checking)
-		$(use_enable systemd)
-		$(use_with libevent)
-		$(use_with ssl)
-	)
-	econf "${myeconfargs[@]}"
-}
-
-src_install() {
-	emake DESTDIR="${D}" install
-
-	dodoc doc/{ChangeLog,CREDITS,NSD-4-features,NSD-FOR-BIND-USERS,README,RELNOTES,REQUIREMENTS}
-
-	newinitd "${FILESDIR}"/nsd.initd-r1 nsd
-
-	# install munin plugin and config
-	if use munin ; then
-		exeinto /usr/libexec/munin/plugins
-		doexe contrib/nsd_munin_
-		insinto /etc/munin/plugin-conf.d
-		newins "${FILESDIR}"/nsd.munin-conf nsd_munin
-	fi
-
-	systemd_dounit "${FILESDIR}"/nsd.service
-
-	# remove the /run directory that usually resides on tmpfs and is
-	# being taken care of by the nsd init script anyway (checkpath)
-	rm -r "${ED}"/run || die "Failed to remove /run"
-
-	keepdir /var/db/${PN}
-}
-
-pkg_postinst() {
-	# Do this in postinst to ensure the uid/gid is consistent for binpkgs
-	enewgroup nsd
-	enewuser nsd -1 -1 -1 nsd
-
-	# database directory, writable by nsd for database updates and zone transfers
-	install -d -m 750 -o nsd -g nsd "${EROOT}"/var/db/nsd
-
-	# zones directory, writable by nsd for zone file updates (nsd-control write)
-	install -d -m 750 -o nsd -g nsd "${EROOT}"/var/lib/nsd
-}
diff --git a/net-dns/nsd/nsd-4.2.0.ebuild b/net-dns/nsd/nsd-4.2.2.ebuild
index e8a9dc238025..0eba80ae8a8a 100644
--- a/net-dns/nsd/nsd-4.2.0.ebuild
+++ b/net-dns/nsd/nsd-4.2.2.ebuild
@@ -3,7 +3,7 @@
 
 EAPI=7
 
-inherit autotools user systemd
+inherit autotools systemd
 
 # version voodoo needed only for non-release tarballs: 4.0.0_rc1 => 4.0.0rc1
 MY_PV="${PV/_beta/b}"
@@ -21,6 +21,8 @@ IUSE="bind8-stats dnstap ipv6 libevent minimal-responses mmap munin +nsec3 ratel
 S="${WORKDIR}/${MY_P}"
 
 RDEPEND="
+	acct-group/nsd
+	acct-user/nsd
 	dnstap? (
 		dev-libs/fstrm
 		dev-libs/protobuf-c
@@ -105,10 +107,6 @@ src_install() {
 }
 
 pkg_postinst() {
-	# Do this in postinst to ensure the uid/gid is consistent for binpkgs
-	enewgroup nsd
-	enewuser nsd -1 -1 -1 nsd
-
 	# database directory, writable by nsd for database updates and zone transfers
 	install -d -m 750 -o nsd -g nsd "${EROOT}"/var/db/nsd
 
diff --git a/net-dns/pdns/Manifest b/net-dns/pdns/Manifest
index a84b6484f1ce..06ec1b84960c 100644
--- a/net-dns/pdns/Manifest
+++ b/net-dns/pdns/Manifest
@@ -1,7 +1,7 @@
 AUX dnsdomain2.schema 6640 BLAKE2B d3efc6bc16390f35979f1184632e7184cf403453422888e2cb44fa4fed7891241919a39c8c6f539a61de032654650a45ea548a6983777ea1bfe029e817f2c315 SHA512 ac16f8d528d6138d3c2cbf997fd8fbb467d388aa63eb6ed4e7780a3dad11ea885b91252ff0809b1d2cf7d5200814b8963aab890af84741ea86d35b2f5955a7ea
 AUX pdns-r1 2533 BLAKE2B 0d4af8f9cd4568cde40b44c72cb10a29662daa514df1a1d8174dd02f2ad4324cb7c99a05736bac7cbe80e1b9081832cac95d8c482eb4d1a8c344a6b55da623e3 SHA512 6392f59f82b82621b6cab6823f7761cd875bc6818c48db846df289057c02d8119a1024c5ecdf70a5ca8a55c00a2c3c56240d36b42cc038a25e8616ab9b966dd6
 DIST pdns-4.1.13.tar.bz2 1117990 BLAKE2B 95fa26d872fe138d1cde7e586881010dd27211c4186d0a99693d2fd90bdc3fd939da09805898d469daec6fe8c3493166346cf18b528760f3b25274fe10f45ad2 SHA512 94d80b1c6b78e93dd856631d391225c521485c3fb6b4123b28f9f58e178a7f6eb03f24189eaa261873e7e29962761b513c1fcf092101d68ad81dac73249a54d4
-DIST pdns-4.2.0-rc3.tar.bz2 1250840 BLAKE2B d9c97b318405b43545ca44a7debf442cd276226dbfcfef98de555d3aa61203fe7af0842c6d65f16677769b33dba5998c5cc64e4a5820ee5a137a9ec770ea5b28 SHA512 a60fc2eb369f56d8bdc2e78c54ad62795e27e7f55138c3a83725d8144c0d0a7b5c894cfbd3972516dd8d2d816e5b0ff73fefe8479c8ad08dfa0aa0e0f3f026d7
-EBUILD pdns-4.1.13.ebuild 4701 BLAKE2B ac742a7da5357f1d6ccf51f7f52c896f843916df802f2435ba4226742275b8f52209b0bb162a26c2ab46c1bcdbd55de57b2954de25329faaadd3a106e099c97b SHA512 4c76ca4f8fc3d50818f18d77f35af83b11bad18e6e0c5f6e0d946a86c38f6216615ac346e1492daff4cf1301c08b032d8ae40b699cf1fe1ccc31abe07f838915
-EBUILD pdns-4.2.0_rc3.ebuild 4699 BLAKE2B a14e65a1fd01a624050fecb8de08ac6c8175791fa8070d092aa86f7e65ed0aa422da1ef1535dffe4c00bb3aa49bb20ce13acf43acb44a61b376a146ba5e806bf SHA512 628c2ffa41afc748a32267a80d32818c846004fd4f10689c945050c3206bbeb7191eb01c4d472ee839211b792a866b410be8b6b1392b5c2e9ce16d12051f7980
+DIST pdns-4.2.0.tar.bz2 1249282 BLAKE2B 56b3639004abd05ab9df4541cc46f155ce76426b35a29d9a4cedd16428c5852bf9306e14b77440b8239e823cb0603b4747a8ae7729f964f415a529f17706eb1f SHA512 ee67c132458e539d522aaa5835237dc64d92ad546f51e0ef86366964f7105631f2bd1e6c5d19d85466d95e1982f6410aeb14932c265fddfd301e403e76542624
+EBUILD pdns-4.1.13.ebuild 4703 BLAKE2B 6b6d49e55745519af07c3bba4a964e4bc40536fd1189f681699075b79f6f690368f635c6f65f699875ace38065b18afff0739fae715e2c9163a9246d3e96ac86 SHA512 acaab7c3256e09e54b56f5fde789d0776bdc6320ec4489158119d00659d18d9747b87c8df2e2ad2c7ec8fca6658c916ca0b636e261c9565269b844fa527ad83e
+EBUILD pdns-4.2.0.ebuild 4698 BLAKE2B b44da7a37397340af4af678dc9a05c2e1aba2676a1058c348926483ab0fb5f69617dcc331659f70a1d308166cce40c5ec717caf8acae84d61f2a304153b84397 SHA512 a1086874a1c1b60306504274f700131be47d1022abbb2d2057cc3cb2c6f3a0cbbb9725f5561b09fe5508ca208f275c53f3f3bfbcb6cd6f68b9f7d75de51b5574
 MISC metadata.xml 1383 BLAKE2B fd622facab46aaba7d1e54529574ec0d0531254fcbed8c454bc21438212a9d7f0ce744417b24461e1dc144a3daded8d252d805011b77bc5f396bb59297cf55c4 SHA512 6301ccaa19d82478a7e338cf1ad3b586cbdc4c2b98298bb306e7913399efab4e30305756cc7dcf6df4d81520733f2095c4bf61f65ac83763e38f375c2cc0b2a7
diff --git a/net-dns/pdns/pdns-4.1.13.ebuild b/net-dns/pdns/pdns-4.1.13.ebuild
index f267a0663b84..ae6ae070db07 100644
--- a/net-dns/pdns/pdns-4.1.13.ebuild
+++ b/net-dns/pdns/pdns-4.1.13.ebuild
@@ -31,7 +31,7 @@ RDEPEND="
 		!luajit? ( dev-lang/lua:= )
 		luajit? ( dev-lang/luajit:= )
 	)
-	mysql? ( dev-db/mysql-connector-c )
+	mysql? ( dev-db/mysql-connector-c:= )
 	postgres? ( dev-db/postgresql:= )
 	ldap? ( >=net-nds/openldap-2.0.27-r4 app-crypt/mit-krb5 )
 	sqlite? ( dev-db/sqlite:3 )
diff --git a/net-dns/pdns/pdns-4.2.0_rc3.ebuild b/net-dns/pdns/pdns-4.2.0.ebuild
index d811e77d5c51..e1229b5437f0 100644
--- a/net-dns/pdns/pdns-4.2.0_rc3.ebuild
+++ b/net-dns/pdns/pdns-4.2.0.ebuild
@@ -11,7 +11,7 @@ SRC_URI="https://downloads.powerdns.com/releases/${P/_/-}.tar.bz2"
 
 LICENSE="GPL-2"
 SLOT="0"
-KEYWORDS="" # ~amd64 ~x86
+KEYWORDS="~amd64 ~x86"
 
 # other possible flags:
 # db2: we lack the dep
@@ -31,7 +31,7 @@ RDEPEND="
 		luajit? ( dev-lang/luajit:= )
 	)
 	lua-records? ( >=net-misc/curl-7.21.3 )
-	mysql? ( dev-db/mysql-connector-c )
+	mysql? ( dev-db/mysql-connector-c:= )
 	postgres? ( dev-db/postgresql:= )
 	ldap? ( >=net-nds/openldap-2.0.27-r4 app-crypt/mit-krb5 )
 	sqlite? ( dev-db/sqlite:3 )
diff --git a/net-dns/unbound/Manifest b/net-dns/unbound/Manifest
index d84b86869332..9c98fe537886 100644
--- a/net-dns/unbound/Manifest
+++ b/net-dns/unbound/Manifest
@@ -9,8 +9,10 @@ AUX unbound_at.service 304 BLAKE2B 0762200390475ff6a3ca4dc282b3eca3e55cb339528a7
 DIST unbound-1.9.0.tar.gz 5662176 BLAKE2B dff42ca4155df1c364bcfeb37c0f9516e7f167cc59bebd1fcf264db6471ad99804323c59e485662e03ab095932f1ca3fe25693a9ba840e9c0ecad69cf31b1a2d SHA512 7dfa8e078507fc24a2d0938eea590389453bacfcac023f1a41af19350ea1f7b87d0c82d7eead121a11068921292a96865e177274ff27ed8b8868445f80f7baf6
 DIST unbound-1.9.1.tar.gz 5665254 BLAKE2B 68a643cd17139b34e3651e0e72053b0faacf83ae975fff97493c78742ffa7f0d3dbc0028e96e581e125a3591467ec78ae245a718424c2fb32ea7db23ae945f44 SHA512 5dfac7ce3892f73109fdfe0f81863643b1f4c10cee2d4e2d1a28132f1b9ea4d4f89242e4e6348fdadf998f1c75d53577cbf4f719e98faa1342fc3c5de2e8903d
 DIST unbound-1.9.2.tar.gz 5676395 BLAKE2B fa42e6afaf7e7fc98dba35fb6ec4513f7f392194e9124f7a4625c9a51f4b2b58bb63ca40a083b9f3583af3636399df02f92ef7cb0ae10404b7258cddfce82adc SHA512 118f0e53ee2d5cfb53ce1f792ca680cc01b5825bf81575e36bd3b24f3bdbe14e6631401bf1bf85eb2ac2a3fa0ee2ee3eb6a28b245d06d48d9975ce4cc260f764
+DIST unbound-1.9.3.tar.gz 5686017 BLAKE2B f96636f4070e48cc5e3eadfb59e28f2ab2fc95a8c5a78af095743ea6d32149aadc486f8da62ea1b38c856f4ba9c2cf041407dceb33396a47c59a19816d67f8c6 SHA512 21e14dc1577adbe502a262d7fbe9aae0cd389cd9c0b822246beadf00f0ee875e268eeb3ce820433cbb01495d6b182c334b34b63b1bc33b08589a230810ccfe90
 EBUILD unbound-1.9.0.ebuild 5371 BLAKE2B 210ca5db8c4fedf546d8caeffda1cf94f6366e9befe55be6c07ba273209ff2b5388509341c4540ee65aeedb3f543e0caa7fbac880121ba86f1426e856167689c SHA512 2f78e2c29c5ed3998260ae8803c0a5e9216f63c9001be4f62613e88899e130258b7a53e0072a621e2d436b6491ed688006cb2e8ccdf6e6426eec34d87d358648
 EBUILD unbound-1.9.1-r1.ebuild 5406 BLAKE2B 92f267663f8174cf9ed701078773c5e56a2e44456788037ba392df6d4d3aacf7d3fab1447a93271bdf1ededc6bc4e2e010157f782389f48fa3678f2449acedd2 SHA512 761d406627a16bd9ed687c939f57e9b16e42e7aa9de84aa3b03aa11efb4efa9eb9910cbb73ab962dc34184159b46413540d8f6b1071059ac02231eda63190527
 EBUILD unbound-1.9.1.ebuild 5383 BLAKE2B 2e5777319dab657dea41e1eb2e6e325ed8dc0d5d6c9e7711ee4cd11e043bc9582cb58fcffa26d1264759fed85debfa8f23b21dde1a936730e47d7ecf1ea2eb0f SHA512 1cc7d4b7deef9d75412caee7633e487e22fea793454eb87554401bf8b1efdaf24b67c2d6a463232cddb4cf1ecd8ab90f998623df0c99e9c8434245f27b202975
 EBUILD unbound-1.9.2.ebuild 5406 BLAKE2B 92f267663f8174cf9ed701078773c5e56a2e44456788037ba392df6d4d3aacf7d3fab1447a93271bdf1ededc6bc4e2e010157f782389f48fa3678f2449acedd2 SHA512 761d406627a16bd9ed687c939f57e9b16e42e7aa9de84aa3b03aa11efb4efa9eb9910cbb73ab962dc34184159b46413540d8f6b1071059ac02231eda63190527
+EBUILD unbound-1.9.3.ebuild 5406 BLAKE2B 92f267663f8174cf9ed701078773c5e56a2e44456788037ba392df6d4d3aacf7d3fab1447a93271bdf1ededc6bc4e2e010157f782389f48fa3678f2449acedd2 SHA512 761d406627a16bd9ed687c939f57e9b16e42e7aa9de84aa3b03aa11efb4efa9eb9910cbb73ab962dc34184159b46413540d8f6b1071059ac02231eda63190527
 MISC metadata.xml 1357 BLAKE2B 3fccac00ddfac90bb692169a01f19402fd5534f05a88a8981e6e276f535800f50e4ee138f2b815db176e426422e54a2d107219f214cfaeda979ce1b03710f71a SHA512 13ffc57b5a7ddd1a2ab76a4f29d7a5dc2926ed07ae74f74444ecda949aae2a611a1e194d9b482fe145a00021f603b22c7b8a44f1b7901600da261b0bc1f51525
diff --git a/net-dns/unbound/unbound-1.9.3.ebuild b/net-dns/unbound/unbound-1.9.3.ebuild
new file mode 100644
index 000000000000..e4d1ceae7af4
--- /dev/null
+++ b/net-dns/unbound/unbound-1.9.3.ebuild
@@ -0,0 +1,182 @@
+# Copyright 1999-2019 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+PYTHON_COMPAT=( python2_7 python3_{5,6,7} )
+
+inherit autotools flag-o-matic multilib-minimal python-single-r1 systemd user
+
+MY_P=${PN}-${PV/_/}
+DESCRIPTION="A validating, recursive and caching DNS resolver"
+HOMEPAGE="https://unbound.net/ https://nlnetlabs.nl/projects/unbound/about/"
+SRC_URI="https://nlnetlabs.nl/downloads/unbound/${MY_P}.tar.gz"
+
+LICENSE="BSD GPL-2"
+SLOT="0/8" # ABI version of libunbound.so
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~mips ~ppc ~ppc64 ~x86"
+IUSE="debug dnscrypt dnstap +ecdsa ecs gost libressl python redis selinux static-libs systemd test threads"
+REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} )"
+
+# Note: expat is needed by executable only but the Makefile is custom
+# and doesn't make it possible to easily install the library without
+# the executables. MULTILIB_USEDEP may be dropped once build system
+# is fixed.
+
+CDEPEND=">=dev-libs/expat-2.1.0-r3[${MULTILIB_USEDEP}]
+	>=dev-libs/libevent-2.0.21:0=[${MULTILIB_USEDEP}]
+	libressl? ( >=dev-libs/libressl-2.2.4:0[${MULTILIB_USEDEP}] )
+	!libressl? ( >=dev-libs/openssl-1.0.1h-r2:0=[${MULTILIB_USEDEP}] )
+	dnscrypt? ( dev-libs/libsodium[${MULTILIB_USEDEP}] )
+	dnstap? (
+		dev-libs/fstrm[${MULTILIB_USEDEP}]
+		>=dev-libs/protobuf-c-1.0.2-r1[${MULTILIB_USEDEP}]
+	)
+	ecdsa? (
+		!libressl? ( dev-libs/openssl:0[-bindist] )
+	)
+	python? ( ${PYTHON_DEPS} )
+	redis? ( dev-libs/hiredis:= )"
+
+BDEPEND="virtual/pkgconfig"
+
+DEPEND="${CDEPEND}
+	python? ( dev-lang/swig )
+	test? (
+		net-dns/ldns-utils[examples]
+		dev-util/splint
+		app-text/wdiff
+	)
+	systemd? ( sys-apps/systemd )"
+
+RDEPEND="${CDEPEND}
+	net-dns/dnssec-root
+	selinux? ( sec-policy/selinux-bind )"
+
+# bug #347415
+RDEPEND="${RDEPEND}
+	net-dns/dnssec-root"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-1.5.7-trust-anchor-file.patch
+	"${FILESDIR}"/${PN}-1.6.3-pkg-config.patch
+)
+
+S=${WORKDIR}/${MY_P}
+
+pkg_setup() {
+	enewgroup unbound
+	enewuser unbound -1 -1 /etc/unbound unbound
+	# improve security on existing installs (bug #641042)
+	# as well as new installs where unbound homedir has just been created
+	if [[ -d "${ROOT}/etc/unbound" ]]; then
+		chown --no-dereference --from=unbound root "${ROOT}/etc/unbound"
+	fi
+
+	use python && python-single-r1_pkg_setup
+}
+
+src_prepare() {
+	default
+
+	eautoreconf
+
+	# required for the python part
+	multilib_copy_sources
+}
+
+src_configure() {
+	[[ ${CHOST} == *-darwin* ]] || append-ldflags -Wl,-z,noexecstack
+	multilib-minimal_src_configure
+}
+
+multilib_src_configure() {
+	econf \
+		$(use_enable debug) \
+		$(use_enable gost) \
+		$(use_enable dnscrypt) \
+		$(use_enable dnstap) \
+		$(use_enable ecdsa) \
+		$(use_enable ecs subnet) \
+		$(multilib_native_use_enable redis cachedb) \
+		$(use_enable static-libs static) \
+		$(use_enable systemd) \
+		$(multilib_native_use_with python pythonmodule) \
+		$(multilib_native_use_with python pyunbound) \
+		$(use_with threads pthreads) \
+		--disable-flto \
+		--disable-rpath \
+		--enable-event-api \
+		--enable-ipsecmod \
+		--enable-tfo-client \
+		--enable-tfo-server \
+		--with-libevent="${EPREFIX%/}"/usr \
+		$(multilib_native_usex redis --with-libhiredis="${EPREFIX%/}/usr" --without-libhiredis) \
+		--with-pidfile="${EPREFIX%/}"/run/unbound.pid \
+		--with-rootkey-file="${EPREFIX%/}"/etc/dnssec/root-anchors.txt \
+		--with-ssl="${EPREFIX%/}"/usr \
+		--with-libexpat="${EPREFIX%/}"/usr
+
+		# http://unbound.nlnetlabs.nl/pipermail/unbound-users/2011-April/001801.html
+		# $(use_enable debug lock-checks) \
+		# $(use_enable debug alloc-checks) \
+		# $(use_enable debug alloc-lite) \
+		# $(use_enable debug alloc-nonregional) \
+}
+
+multilib_src_install_all() {
+	use python && python_optimize
+
+	newinitd "${FILESDIR}"/unbound-r1.initd unbound
+	newconfd "${FILESDIR}"/unbound-r1.confd unbound
+
+	systemd_dounit "${FILESDIR}"/unbound.service
+	systemd_dounit "${FILESDIR}"/unbound.socket
+	systemd_newunit "${FILESDIR}"/unbound_at.service "unbound@.service"
+	systemd_dounit "${FILESDIR}"/unbound-anchor.service
+
+	dodoc doc/{README,CREDITS,TODO,Changelog,FEATURES}
+
+	# bug #315519
+	dodoc contrib/unbound_munin_
+
+	docinto selinux
+	dodoc contrib/selinux/*
+
+	exeinto /usr/share/${PN}
+	doexe contrib/update-anchor.sh
+
+	# create space for auto-trust-anchor-file...
+	keepdir /etc/unbound/var
+	# ... and point example config to it
+	sed -i \
+		-e '/# auto-trust-anchor-file:/s,/etc/dnssec/root-anchors.txt,/etc/unbound/var/root-anchors.txt,' \
+		"${ED%/}/etc/unbound/unbound.conf" || \
+		die
+
+	# Used to store cache data
+	keepdir /var/lib/${PN}
+	fowners root:unbound /var/lib/${PN}
+	fperms 0750 /var/lib/${PN}
+
+	find "${ED}" -name '*.la' -delete || die
+	if ! use static-libs ; then
+		find "${ED}" -name "*.a" -delete || die
+	fi
+}
+
+pkg_postinst() {
+	# make var/ writable by unbound
+	if [[ -d "${EROOT%/}/etc/unbound/var" ]]; then
+		chown --no-dereference --from=root unbound: "${EROOT%/}/etc/unbound/var"
+	fi
+
+	einfo ""
+	einfo "If you want unbound to automatically update the root-anchor file for DNSSEC validation"
+	einfo "set 'auto-trust-anchor-file: ${EROOT%/}/etc/unbound/var/root-anchors.txt' in ${EROOT%/}/etc/unbound/unbound.conf"
+	einfo "and run"
+	einfo ""
+	einfo "  su -s /bin/sh -c '${EROOT%/}/usr/sbin/unbound-anchor -a ${EROOT%/}/etc/unbound/var/root-anchors.txt' unbound"
+	einfo ""
+	einfo "as root to create it initially before starting unbound for the first time after enabling this."
+	einfo ""
+}