summaryrefslogtreecommitdiff
path: root/net-dns/opendnssec
diff options
context:
space:
mode:
Diffstat (limited to 'net-dns/opendnssec')
-rw-r--r--net-dns/opendnssec/Manifest27
-rw-r--r--net-dns/opendnssec/files/opendnssec-1.3.14-drop-privileges.patch43
-rw-r--r--net-dns/opendnssec/files/opendnssec-1.3.14-use-system-trang.patch21
-rw-r--r--net-dns/opendnssec/files/opendnssec-1.3.18-eppclient-curl-CVE-2012-5582.patch12
-rw-r--r--net-dns/opendnssec/files/opendnssec-drop-privileges-2.0.x.patch29
-rw-r--r--net-dns/opendnssec/files/opendnssec-drop-privileges.patch28
-rw-r--r--net-dns/opendnssec/files/opendnssec-fix-localstatedir-2.0.x.patch22
-rw-r--r--net-dns/opendnssec/files/opendnssec-fix-localstatedir.patch32
-rw-r--r--net-dns/opendnssec/files/opendnssec-fix-run-dir-2.0.x.patch24
-rw-r--r--net-dns/opendnssec/files/opendnssec-fix-run-dir.patch26
-rw-r--r--net-dns/opendnssec/files/opendnssec-use-system-trang.patch20
-rw-r--r--net-dns/opendnssec/files/opendnssec.confd11
-rw-r--r--net-dns/opendnssec/files/opendnssec.confd-1.3.x13
-rw-r--r--net-dns/opendnssec/files/opendnssec.initd85
-rw-r--r--net-dns/opendnssec/files/opendnssec.initd-1.3.x123
-rw-r--r--net-dns/opendnssec/metadata.xml15
-rw-r--r--net-dns/opendnssec/opendnssec-1.3.18-r1.ebuild203
-rw-r--r--net-dns/opendnssec/opendnssec-1.4.12-r1.ebuild207
-rw-r--r--net-dns/opendnssec/opendnssec-1.4.8.2.ebuild205
-rw-r--r--net-dns/opendnssec/opendnssec-2.0.1-r1.ebuild239
-rw-r--r--net-dns/opendnssec/opendnssec-2.0.3.ebuild239
21 files changed, 1624 insertions, 0 deletions
diff --git a/net-dns/opendnssec/Manifest b/net-dns/opendnssec/Manifest
new file mode 100644
index 000000000000..b2f4ef27a586
--- /dev/null
+++ b/net-dns/opendnssec/Manifest
@@ -0,0 +1,27 @@
+AUX opendnssec-1.3.14-drop-privileges.patch 906 SHA256 faecb049748efab2652b890020106748039dbe7022d943393ac50b71b429b340 SHA512 cbc17153fcd617bcbc54a0b14111908635dae722f845f894d9c6769d77960433fa75c3ec0a5061af054167b4223f7f2946c3e3ba09c2bb55598f72f71d1c2106 WHIRLPOOL da7588424ce440bc302d8acacff2f702e623fe32682b1ddcd4674209f15dbcf8606ad35f59fc2d60e397d8618a7b59b1a56503b1b23a210f924e07dec51f6f16
+AUX opendnssec-1.3.14-use-system-trang.patch 706 SHA256 c704b8e232c950166131be6e70c7b48ff4f57800de7dae2a08012ef5d945f4c7 SHA512 e7d664f6ee548efeae7a015ceaf21b3fedc7654ed295ecd2440b0212015c1556b4f1bac978a2f804e7b6830181273484b428e1a363989eff067a9b3587937b7f WHIRLPOOL 92ffcd46ffaa6a7583114237a58bf634cf26445f3fe023be347f63bd88a0560371d7e89aa820e2fb7c6a6a971a4fee1bb281424baa6f6ce895c0db62d9d60146
+AUX opendnssec-1.3.18-eppclient-curl-CVE-2012-5582.patch 751 SHA256 5613a6de3b65eb1a3e0006e5e8d676d48789d23636d6b218d1ee2fbb5b69a3ae SHA512 f89fc43b96a76ed9af9ac4f28993037ee709d19e8cfeb53da2bdff2eb723c4200fe70aaac8b651998b9b6685343777316141dd0ee2ebc600f703d8dadca24d43 WHIRLPOOL e9790ebb811824f33443ca93429e59377239ac8f443c6eafe16250b68497877d4d0100ff734fd663f4dff697842fdf1b6803e80d4aab5c9cd2fb6260cae19448
+AUX opendnssec-drop-privileges-2.0.x.patch 813 SHA256 a961424707e048b62e31d0c73c516d93c537931f0d80f000a095eed1ba2e6635 SHA512 425eb123452183b4e4a3e87e9a71afa81684fe4af9c111d1bad3433ee640907cf3caa1065711f67286bb0336fd8d82e3f4bfeef94e3ff620bcbdaf960d4137b8 WHIRLPOOL 0c234dfefc3d9d26f399ed9b552a15b975c770b73f3452279cb41cbedb98ac188fcbecbb6e842c0a22f09f6bff2902fc2e0597d7b4974a8ab0a5c4ba856911bf
+AUX opendnssec-drop-privileges.patch 641 SHA256 9bc831bf45a022a9be1a2bd6ee80d9e06fa4d5cdf553ae7dfd50e3a592e5b8dd SHA512 60cb666d821ae8880ccb789f8d2b60ea218a98e1b7b9393d8dc299be55efbd93efb9334ebf5cbf55f67ef1c58df1206dce906994bd9808e3db5a5bf9644a7f06 WHIRLPOOL 90f55f6572933e4c1042076aaa42a9cd19cd7e4c0e7a0598c8ae6cb22e0c7dcc6cd18fa408e2ed80eaadccefa39b4928c59e8bf0ae3398c948092828f9342ebf
+AUX opendnssec-fix-localstatedir-2.0.x.patch 1161 SHA256 028de3256f5604472a0352fe2a9988f2eac51457cc05b4f3b794d021cc2aab8f SHA512 1d07f2108238c041041c96b4efaaec1e75740ed54fbd6390fa45f5ccf7f631c1e8d4400bb9cb95023c8909ae10abc3c93aaa137f954921af75825c06a6d94d9a WHIRLPOOL 5c5d1c035eee77af74cad6a7bec3f085300cdd446090640731430745e1cf6a0769c92de9d7e968e31dce165273ff6bb8400d07f02fc27fc90d383df3b84ea9a0
+AUX opendnssec-fix-localstatedir.patch 1693 SHA256 e9a29b3adf22ef6dd3a0ac43d2a48e2705ae09cd7550b4f3294b89dcd7814ecd SHA512 86700c97bb482f5fa6d99fe8f105c41e8798de542e6cf5fd4d6c14da11237e4fd11eccb2900de4893898d7855e31beb6572c709c2dad9774d5fe440673af2627 WHIRLPOOL 56c5e876e2e2832265474c3772a44efa288eb387438a6864d85956a990f9cedc81e60dc7922448d647702359e835c0fef7db1d6d5e643b195cd6ad26117c3f53
+AUX opendnssec-fix-run-dir-2.0.x.patch 1188 SHA256 c134ad1f6a6222ff5e52019ca5975697d68b55ab110801778ffb5053a5bb8853 SHA512 293c2ceb336623ed52028ca3144c4249eaf426dd2eb84890be9f1ed53e27d4ff5fd6a699d41426ca57d6362c2f83dd8b3556691da2815235f72e69ab4ef45165 WHIRLPOOL 293a0228a85988f4dd23ef4a16bb113fd2f23c3df35edc623996eebe09794b451a134066609b521ae5a50bccc2dca0c6ad7c7b26d970df600ee376554aa2cb30
+AUX opendnssec-fix-run-dir.patch 1204 SHA256 bc9736e424dcc739988d78b8842a44261a71a2e7073bfbd53b985db121f9f3b6 SHA512 f604ab24731bd84498f33dc3213b937335e55f805d4913e80b037b91cc5bf14f406cb2af14cc455a9a23c45a3475ef1b3901c68760188d9e4a36d314d29f8f84 WHIRLPOOL 11d5963d69022ed6e03f0ebda74fd315a8bbd59ff086a7ae8c8dfd42e02062a34d7b888c2e7929af3a1214ddfa81f98ed0ff8aacbb4949bb652ebdac1f72ae08
+AUX opendnssec-use-system-trang.patch 614 SHA256 7e8485e0f8ff1df5f9f799b908c802cf3670ecfcff6e3bf858d69429638e86b4 SHA512 9e95943d145ce7a05e32af60a944c6ee6d74fdff0fa9f0ea233070b44567bce4f5ca6bde57411effa7bab192ec58face34cddf2c349ccff3b78fc66c1f35074d WHIRLPOOL 82282bc2fc7797ff946aee5cee6e182abde0b65283865a9b084613a0dba7e53762494197c7479a6324fc3c81c8c80acf9d0d8a898a183acfe6ab62cf2a6ed1e6
+AUX opendnssec.confd 393 SHA256 cfb0c2ba683878c9f1b99618776aea152679e95ae26ecf4337b63f1a9cf0006c SHA512 17bd24efef9bd6b7a907c75126809a6012db23a6c8547169c41dbc62fc91775331f445905282bc6c2ef13357f92eccab5008d4605419d98acdb723806b63a924 WHIRLPOOL e9eb636b8fc2016bdbdedf44e7625562b1c5f6ddcf60af87cdaf1ca6e74dfb4f08886f946e788005ed3c97667417cfed9fb2fb688ad1a40ce992913a7007c142
+AUX opendnssec.confd-1.3.x 477 SHA256 9db752afc06fe3cc76bf7d4195d74853db7ccce3993b5ccd896b07b37de84909 SHA512 e45cd05e9d972dce5254f333ce21fd599ed905e8009f67de636c3a72dcd49e43fb75f702e21665dd3f19602fb9a5be5b6ff34e147ac4e29844560cc4f65f727c WHIRLPOOL 14a56cc365cdcb201f48a4c42838bc82524a2e067f4aa2f49aeada2ae2757b9c7d3f3cb375993d2f2e48364c696438404b41d64abb9a2d773f9f82e77efc5bdc
+AUX opendnssec.initd 1854 SHA256 9f200b6b2d1e2da1a161f3275992115788dd36a3eeffbaaece0d896b51cb445d SHA512 75bce27c152b55ba2ba7d0770c6f2149493ef4b145f2257328e7e4b6865ad2d644695a688c3e06be02705ac42752e031846551b80b560e19a73e595e5ad15def WHIRLPOOL 34cd2588877cd300628e5cb86e055ffc07e6682ba3ad448d83d3975e8d6802702e343437acbc187522c7a4b24672e0fff0dce4f9023908c8d9f1857e80078d3f
+AUX opendnssec.initd-1.3.x 2873 SHA256 4060ab0ecca436c08551efa693819aa2b59e84dc2cff5b36d143cde56a37dcb3 SHA512 e824206169a625b3e9cd817489870ad422793f6142abf0878049d3c075efe8c9e5895802e0ff0c4d4f36775e31aad19346c3ba0a76572dc6a0106883d9b0968d WHIRLPOOL 39f302dd5c89134689b47ff81d73a4af816bd37a6ef5f453df9c023259701f9ad264da5d7c3af1f314800ecdc23788ee57eb872d65936725c402608f245cc9a8
+DIST opendnssec-1.3.18.tar.gz 1143889 SHA256 e61d23ae0cc57b6e09d408bade6872fe5241896c61a03e8bc5ceeb65df13a676 SHA512 5df39ba778c9b1245e88b81df7aa491bca0aad2943845284c4f8b4dd729fa69014d45f07bdf99a048ccf668a1c9675a8dd99efcec1abdbd4e06e9738fec6ab6d WHIRLPOOL 7213b8f2f86651114449bc4734452d6065960e26ee289051949ca27ae3b23280cea45ff707f71942eef91c9009200272c0985ef3d3de43c9343ad2e1e54303ce
+DIST opendnssec-1.4.12.tar.gz 1036392 SHA256 4ba6cf06fcd1131c1ed913d61959ddc90726ed5e4f153c90f45ec64445528a0c SHA512 b72b76ab4aec8cc63cc9c020bef9a24b000fd00172a07cf43d57b3a33041bef9e107b71eb7271bb13c3566510599c6a1913cf986a724e169c42dc8bdac8d2e51 WHIRLPOOL f6b98b3f7522185383f1bac4b233bf725a24ba998fd09c61762de25baeb70ce3633909bc5ffe7f0ac9e83201adbe73c701e7a1892c059908ed17a75731d6335c
+DIST opendnssec-1.4.8.2.tar.gz 1043171 SHA256 7fd553ee39173e807477ed1daff6ee2f8b1c83875cd2e52a1df3315bf0015513 SHA512 7f2e10b425f60947aca40c61509b07ddc4363105cc882b518ffa816437299d6f881411cb38325f27b3a34c2005953988b39c945362866dd0f1f7c6ef973bfa06 WHIRLPOOL 38079a89d8e3d039aeab28c80b7fb1a9739014736d6076442c546fae1b13e1c89faa1858beb6f4d2f495d19a2a1187a7af10c55c0ed33563bc9b2d57945de807
+DIST opendnssec-2.0.1.tar.gz 1101523 SHA256 bf874bbb346699a5b539699f90a54e0c15fff0574df7a3c118abb30938b7b346 SHA512 aa12818f92688e087acaff8a6771d2a7da733e04d9e821967d313c7ff880a1056f470b11988eba1e7aad606418c3a4587f654163d74f68e3f61943c74d86d052 WHIRLPOOL 865fbd0d21cd015e87da5f26858e39a233464fb04e56a21683b4713d3836b925eea80973446571da78730ef765d5a1a3fc5f8ad192dd09fdf6eb7467ae417769
+DIST opendnssec-2.0.3.tar.gz 1103355 SHA256 ebeb5481d696cf83c21c5dfbecce6ab5dcc73df1a08573ef257f2f6fe10f6214 SHA512 4745a9ac317cc65d6f5b14be640687efd5fde2149541f692fb607a458378d27e903f175023c1aa16a777d17cef9cc68f1a84e7e7cdb233466d26756721b34424 WHIRLPOOL 51389851b46b62ee1829dd2af5cb41edbe28484ff23dd9b281f77ee7966dd67aa743f1c8d869052bb0a598cf42ab850ad0d2f80343b26aaf551940bb9f0d3f41
+EBUILD opendnssec-1.3.18-r1.ebuild 5693 SHA256 b4f50fe2dc4698e1f1457391f6490dbbfbf67ba01a66031a5da9819af1d1d1b1 SHA512 6322f3c01ce746605249fe7a7e748b3d59017a2cda394f750eb3ce646923335a6659cf47a240bd5c07b179ba3219f8a650a610b898d3ead4d4b68c3f150bcc34 WHIRLPOOL a622c523e2f9332e784963d10ddc52043c15cf49f048a7d1529c7cd10dee81e703f06528b421aa60d01c18f57acfa2816ab249e4f40a65b64e057012fab2299f
+EBUILD opendnssec-1.4.12-r1.ebuild 5780 SHA256 caf2d7b04e4d4a34ceb3552960c9541b5d6cd1e136fbd3c4f676e5541344db80 SHA512 3e0ac6197e86315794dd604de6adb605845c09f8a00958189f35d3432b748de2e2d8589c217035c4dd167971452026d56a6b2ca38db0af8d7eb18ad8f888237c WHIRLPOOL 9e25c65d9b5bd1751e30120e7d59f8ea26abf3e2b67749ae503a89e865f66c4f87d57dc8f0fe395a95353fb6f7ad266280244ef274c0f96537a1cdb34f4d4246
+EBUILD opendnssec-1.4.8.2.ebuild 5830 SHA256 36dfde77d4c65b0dfdac4be6a7db56f0b1eec21978e1de84efeb3f7e2564ca5e SHA512 d9cb344ca13a2a926f46e4dd041453132cb669d0ae23f4180dda38ca12fa41f6aa6187d7e9cf70ca8e36ec4266cd75569a36d928c9ab65800c68ecc11ec6da80 WHIRLPOOL 5001986e96040dae337df7d7728f4a50ee1c9e7b600f01e9d11570335073a18ec7999e4818e08fbb4c678ead18023104413b76406e48d1fa06a2216c7051ed58
+EBUILD opendnssec-2.0.1-r1.ebuild 6763 SHA256 4bff75c622d69ecc2e91b5f7672f09c77603c65a0572c799ceff744f6a84de9e SHA512 9398125ccf2e3bc05ffc8c87e9582374075cb89d079e3e01364134f6529f399fa7556afd1d489f43235a31f6e2c7e13726b6552ab59d757df761680668ad7102 WHIRLPOOL d2a85cd8266136c91407e5b8a81d8d8bac9b6dcee2357be408bb56f33c346bde0b9a1a5c035e0c02f481dd21afb5d8bf15f50d9bac280e67dbed5048321c9fe9
+EBUILD opendnssec-2.0.3.ebuild 6763 SHA256 4bff75c622d69ecc2e91b5f7672f09c77603c65a0572c799ceff744f6a84de9e SHA512 9398125ccf2e3bc05ffc8c87e9582374075cb89d079e3e01364134f6529f399fa7556afd1d489f43235a31f6e2c7e13726b6552ab59d757df761680668ad7102 WHIRLPOOL d2a85cd8266136c91407e5b8a81d8d8bac9b6dcee2357be408bb56f33c346bde0b9a1a5c035e0c02f481dd21afb5d8bf15f50d9bac280e67dbed5048321c9fe9
+MISC ChangeLog 5718 SHA256 22234d269386e8a717f4d196571001e23ccebe91b931da9b987365e63d9bbf8c SHA512 0c299644afd60dacc087e19b8530704a92cc2d65985e60689d177b39befc0fff243d2d674291c1509438d182faa71de590a364b6cc1aeeb5e4984937f8e4914a WHIRLPOOL 2eece09c7090ac503d0c7e55dce19e57caa5f00ef2ce066cabfc976f72c8f3fbba94104637e6d55be9ef506dc3e795250c81694cba5a977719a338c73afff72f
+MISC ChangeLog-2015 8837 SHA256 0bbf10d947069650e591cbb4e9785d9a729f552fd9eb7c19ee1b4e2a02d5f6ba SHA512 5d5490b6c9ae8eea841df5c30a172d688fa95e8460059b2c2205ee169baa20147dc77523d6a9802dd321665031fb99f3ec7725381bd79c6c0040869c9cb0920a WHIRLPOOL db61e6216a86b07e6c7364087a4a511237d7b6a66741338c4749edbb4ab41cf15828e18e6eb43f4d6ff4d23a7ee2f435cd8e37223660d9068c66a0d78347e149
+MISC metadata.xml 906 SHA256 f68a7488c51564b1d622ddc75e61a3a8658c1c6e94356d96cb487adba8d846fa SHA512 9cddc6b15c7a959cb885bc639c19e166ee202dd4b45db50c9bbb3b61fe9e84311f023a3d34cfc44e689cf81df092211fa4cb88427fb143c113bdfc1e7897112e WHIRLPOOL 243f9f79db1553fced401bc2443b22fbb8bfba88e3e70dfb2ede16a27cad19e22c86ee8926389e25b5fd5dfff1b162ee1d74cc7d5f15fb799aa64e3614d10261
diff --git a/net-dns/opendnssec/files/opendnssec-1.3.14-drop-privileges.patch b/net-dns/opendnssec/files/opendnssec-1.3.14-drop-privileges.patch
new file mode 100644
index 000000000000..7c9f72355d20
--- /dev/null
+++ b/net-dns/opendnssec/files/opendnssec-1.3.14-drop-privileges.patch
@@ -0,0 +1,43 @@
+Index: conf/conf.xml.in
+===================================================================
+--- conf/conf.xml.in (revision 3022)
++++ conf/conf.xml.in (working copy)
+@@ -38,12 +38,10 @@
+ </Common>
+
+ <Enforcer>
+-<!--
+ <Privileges>
+ <User>opendnssec</User>
+ <Group>opendnssec</Group>
+ </Privileges>
+--->
+
+ <Datastore><SQLite>@OPENDNSSEC_STATE_DIR@/kasp.db</SQLite></Datastore>
+ <Interval>PT3600S</Interval>
+@@ -56,12 +54,10 @@
+ </Enforcer>
+
+ <Signer>
+-<!--
+ <Privileges>
+ <User>opendnssec</User>
+ <Group>opendnssec</Group>
+ </Privileges>
+--->
+
+ <WorkingDirectory>@OPENDNSSEC_STATE_DIR@/tmp</WorkingDirectory>
+ <WorkerThreads>8</WorkerThreads>
+@@ -80,12 +76,10 @@
+ </Signer>
+
+ <Auditor>
+-<!--
+ <Privileges>
+ <User>opendnssec</User>
+ <Group>opendnssec</Group>
+ </Privileges>
+--->
+
+ <WorkingDirectory>@OPENDNSSEC_STATE_DIR@/tmp</WorkingDirectory>
+ </Auditor>
diff --git a/net-dns/opendnssec/files/opendnssec-1.3.14-use-system-trang.patch b/net-dns/opendnssec/files/opendnssec-1.3.14-use-system-trang.patch
new file mode 100644
index 000000000000..39678408264a
--- /dev/null
+++ b/net-dns/opendnssec/files/opendnssec-1.3.14-use-system-trang.patch
@@ -0,0 +1,21 @@
+diff -urN opendnssec-1.3.0rc3.old/conf/Makefile.am opendnssec-1.3.0rc3/conf/Makefile.am
+--- opendnssec-1.3.0rc3.old/conf/Makefile.am 2011-07-01 21:15:25.000000000 +0200
++++ opendnssec-1.3.0rc3/conf/Makefile.am 2011-07-01 21:17:00.000000000 +0200
+@@ -7,7 +7,7 @@
+ XML = conf.xml kasp.xml zonelist.xml signconf.xml zonefetch.xml
+ XSL= kasp2html.xsl
+
+-TRANG= $(srcdir)/trang/trang.jar
++TRANG= /usr/bin/trang
+
+ sysconfdir = @sysconfdir@/opendnssec
+ datadir = @datadir@/opendnssec
+@@ -25,7 +25,7 @@
+ .rnc.rng:
+ @test -x "${JAVA}" || \
+ (echo "java is required for converting RelaxNG Compact to RelaxNG"; false)
+- ${JAVA} -jar ${TRANG} $< $@
++ ${TRANG} $< $@
+
+ regress: $(RNG)
+ @test -x "${XMLLINT}" || \
diff --git a/net-dns/opendnssec/files/opendnssec-1.3.18-eppclient-curl-CVE-2012-5582.patch b/net-dns/opendnssec/files/opendnssec-1.3.18-eppclient-curl-CVE-2012-5582.patch
new file mode 100644
index 000000000000..a0676dd091be
--- /dev/null
+++ b/net-dns/opendnssec/files/opendnssec-1.3.18-eppclient-curl-CVE-2012-5582.patch
@@ -0,0 +1,12 @@
+diff -urN opendnssec-1.3.18.orig/plugins/eppclient/src/epp.c opendnssec-1.3.18/plugins/eppclient/src/epp.c
+--- opendnssec-1.3.18.orig/plugins/eppclient/src/epp.c 2014-07-21 11:16:10.000000000 +0200
++++ opendnssec-1.3.18/plugins/eppclient/src/epp.c 2016-03-23 22:25:18.679354984 +0100
+@@ -390,7 +390,7 @@
+ curl_easy_setopt(curl, CURLOPT_URL, url);
+ curl_easy_setopt(curl, CURLOPT_CONNECT_ONLY, 1L);
+ curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 1L);
+- curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 1L);
++ curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 2L);
+ curl_easy_setopt(curl, CURLOPT_USE_SSL, CURLUSESSL_ALL);
+ curl_easy_setopt(curl, CURLOPT_ERRORBUFFER, curlerr);
+ curl_easy_setopt(curl, CURLOPT_NOPROGRESS, 1L);
diff --git a/net-dns/opendnssec/files/opendnssec-drop-privileges-2.0.x.patch b/net-dns/opendnssec/files/opendnssec-drop-privileges-2.0.x.patch
new file mode 100644
index 000000000000..f3adc487dee9
--- /dev/null
+++ b/net-dns/opendnssec/files/opendnssec-drop-privileges-2.0.x.patch
@@ -0,0 +1,29 @@
+diff -ur opendnssec-2.0.1.orig/conf/conf.xml.in opendnssec-2.0.1/conf/conf.xml.in
+--- opendnssec-2.0.1.orig/conf/conf.xml.in 2016-07-21 16:15:27.000000000 +0200
++++ opendnssec-2.0.1/conf/conf.xml.in 2016-08-23 15:21:09.633384446 +0200
+@@ -36,12 +36,10 @@
+ </Common>
+
+ <Enforcer>
+-<!--
+ <Privileges>
+ <User>opendnssec</User>
+ <Group>opendnssec</Group>
+ </Privileges>
+--->
+
+ <Datastore><SQLite>@OPENDNSSEC_STATE_DIR@/kasp.db</SQLite></Datastore>
+ <!--The enforcer interval parameter is no long used in 2.0 and will be deprecated in 2.1 -->
+@@ -60,12 +58,10 @@
+ </Enforcer>
+
+ <Signer>
+-<!--
+ <Privileges>
+ <User>opendnssec</User>
+ <Group>opendnssec</Group>
+ </Privileges>
+--->
+
+ <WorkingDirectory>@OPENDNSSEC_STATE_DIR@/signer</WorkingDirectory>
+ <WorkerThreads>4</WorkerThreads>
diff --git a/net-dns/opendnssec/files/opendnssec-drop-privileges.patch b/net-dns/opendnssec/files/opendnssec-drop-privileges.patch
new file mode 100644
index 000000000000..c1972bbc3d1b
--- /dev/null
+++ b/net-dns/opendnssec/files/opendnssec-drop-privileges.patch
@@ -0,0 +1,28 @@
+--- conf/conf.xml.in.orig 2013-05-12 22:36:47.530988182 +0200
++++ conf/conf.xml.in 2013-05-12 22:37:56.459817918 +0200
+@@ -38,12 +38,10 @@
+ </Common>
+
+ <Enforcer>
+-<!--
+ <Privileges>
+ <User>opendnssec</User>
+ <Group>opendnssec</Group>
+ </Privileges>
+--->
+ <!-- NOTE: Enforcer worker threads are not used; this option is ignored -->
+ <!--
+ <WorkerThreads>4</WorkerThreads>
+@@ -60,12 +58,10 @@
+ </Enforcer>
+
+ <Signer>
+-<!--
+ <Privileges>
+ <User>opendnssec</User>
+ <Group>opendnssec</Group>
+ </Privileges>
+--->
+
+ <WorkingDirectory>@OPENDNSSEC_STATE_DIR@/tmp</WorkingDirectory>
+ <WorkerThreads>4</WorkerThreads>
diff --git a/net-dns/opendnssec/files/opendnssec-fix-localstatedir-2.0.x.patch b/net-dns/opendnssec/files/opendnssec-fix-localstatedir-2.0.x.patch
new file mode 100644
index 000000000000..5940c2f050e6
--- /dev/null
+++ b/net-dns/opendnssec/files/opendnssec-fix-localstatedir-2.0.x.patch
@@ -0,0 +1,22 @@
+diff -ur opendnssec-2.0.1.orig/Makefile.am opendnssec-2.0.1/Makefile.am
+--- opendnssec-2.0.1.orig/Makefile.am 2016-07-21 16:15:00.000000000 +0200
++++ opendnssec-2.0.1/Makefile.am 2016-08-23 14:01:50.618393034 +0200
+@@ -30,12 +30,12 @@
+
+ install-data-hook:
+ $(INSTALL) -d $(DESTDIR)$(localstatedir)
+- $(INSTALL) -d $(DESTDIR)$(localstatedir)/opendnssec
+- $(INSTALL) -d $(DESTDIR)$(localstatedir)/opendnssec/signer
+- $(INSTALL) -d $(DESTDIR)$(localstatedir)/opendnssec/enforcer
+- $(INSTALL) -d $(DESTDIR)$(localstatedir)/opendnssec/signconf
+- $(INSTALL) -d $(DESTDIR)$(localstatedir)/opendnssec/unsigned
+- $(INSTALL) -d $(DESTDIR)$(localstatedir)/opendnssec/signed
++ $(INSTALL) -d $(DESTDIR)$(localstatedir)/lib/opendnssec
++ $(INSTALL) -d $(DESTDIR)$(localstatedir)/lib/opendnssec/signer
++ $(INSTALL) -d $(DESTDIR)$(localstatedir)/lib/opendnssec/enforcer
++ $(INSTALL) -d $(DESTDIR)$(localstatedir)/lib/opendnssec/signconf
++ $(INSTALL) -d $(DESTDIR)$(localstatedir)/lib/opendnssec/unsigned
++ $(INSTALL) -d $(DESTDIR)$(localstatedir)/lib/opendnssec/signed
+ $(INSTALL) -d $(DESTDIR)$(localstatedir)/run
+ $(INSTALL) -d $(DESTDIR)$(localstatedir)/run/opendnssec
+
diff --git a/net-dns/opendnssec/files/opendnssec-fix-localstatedir.patch b/net-dns/opendnssec/files/opendnssec-fix-localstatedir.patch
new file mode 100644
index 000000000000..3958c6c70ccf
--- /dev/null
+++ b/net-dns/opendnssec/files/opendnssec-fix-localstatedir.patch
@@ -0,0 +1,32 @@
+diff -urN opendnssec-1.3.0rc2.old/Makefile.am opendnssec-1.3.0rc2/Makefile.am
+--- opendnssec-1.3.0rc2.old/Makefile.am 2011-06-02 13:48:56.000000000 +0200
++++ opendnssec-1.3.0rc2/Makefile.am 2011-06-02 13:49:19.000000000 +0200
+@@ -31,11 +31,11 @@
+
+ install-data-hook:
+ $(INSTALL) -d $(DESTDIR)$(localstatedir)
+- $(INSTALL) -d $(DESTDIR)$(localstatedir)/opendnssec
+- $(INSTALL) -d $(DESTDIR)$(localstatedir)/opendnssec/tmp
+- $(INSTALL) -d $(DESTDIR)$(localstatedir)/opendnssec/signconf
+- $(INSTALL) -d $(DESTDIR)$(localstatedir)/opendnssec/unsigned
+- $(INSTALL) -d $(DESTDIR)$(localstatedir)/opendnssec/signed
++ $(INSTALL) -d $(DESTDIR)$(localstatedir)/lib/opendnssec
++ $(INSTALL) -d $(DESTDIR)$(localstatedir)/lib/opendnssec/tmp
++ $(INSTALL) -d $(DESTDIR)$(localstatedir)/lib/opendnssec/signconf
++ $(INSTALL) -d $(DESTDIR)$(localstatedir)/lib/opendnssec/unsigned
++ $(INSTALL) -d $(DESTDIR)$(localstatedir)/lib/opendnssec/signed
+ $(INSTALL) -d $(DESTDIR)$(localstatedir)/run
+ $(INSTALL) -d $(DESTDIR)$(localstatedir)/run/opendnssec
+
+diff -urN opendnssec-1.3.0rc2.old/m4/opendnssec_common.m4 opendnssec-1.3.0rc2/m4/opendnssec_common.m4
+--- opendnssec-1.3.0rc2.old/m4/opendnssec_common.m4 2011-06-02 13:48:56.000000000 +0200
++++ opendnssec-1.3.0rc2/m4/opendnssec_common.m4 2011-06-02 13:49:36.000000000 +0200
+@@ -18,7 +18,7 @@
+ OPENDNSSEC_LIBEXEC_DIR=$full_libexecdir/opendnssec
+ OPENDNSSEC_DATA_DIR=$full_datadir/opendnssec
+ OPENDNSSEC_SYSCONF_DIR=$full_sysconfdir/opendnssec
+-OPENDNSSEC_LOCALSTATE_DIR="$full_localstatedir/opendnssec"
++OPENDNSSEC_LOCALSTATE_DIR="$full_localstatedir/lib/opendnssec"
+ OPENDNSSEC_PID_DIR="$full_localstatedir/run/opendnssec"
+
+ AC_SUBST([OPENDNSSEC_BIN_DIR])
diff --git a/net-dns/opendnssec/files/opendnssec-fix-run-dir-2.0.x.patch b/net-dns/opendnssec/files/opendnssec-fix-run-dir-2.0.x.patch
new file mode 100644
index 000000000000..5ea9c80f2ba7
--- /dev/null
+++ b/net-dns/opendnssec/files/opendnssec-fix-run-dir-2.0.x.patch
@@ -0,0 +1,24 @@
+diff -ur opendnssec-2.0.1.orig/m4/opendnssec_common.m4 opendnssec-2.0.1/m4/opendnssec_common.m4
+--- opendnssec-2.0.1.orig/m4/opendnssec_common.m4 2016-07-21 16:15:00.000000000 +0200
++++ opendnssec-2.0.1/m4/opendnssec_common.m4 2016-08-23 14:42:35.033460972 +0200
+@@ -17,7 +17,7 @@
+ OPENDNSSEC_DATA_DIR=$full_datadir/opendnssec
+ OPENDNSSEC_SYSCONF_DIR=$full_sysconfdir/opendnssec
+ OPENDNSSEC_LOCALSTATE_DIR="$full_localstatedir/opendnssec"
+-OPENDNSSEC_PID_DIR="$full_localstatedir/run/opendnssec"
++OPENDNSSEC_PID_DIR="${destdir}/run/opendnssec"
+
+ AC_SUBST([OPENDNSSEC_BIN_DIR])
+ AC_SUBST([OPENDNSSEC_SBIN_DIR])
+diff -ur opendnssec-2.0.1.orig/Makefile.am opendnssec-2.0.1/Makefile.am
+--- opendnssec-2.0.1.orig/Makefile.am 2016-08-23 14:40:10.009951791 +0200
++++ opendnssec-2.0.1/Makefile.am 2016-08-23 14:43:20.377870776 +0200
+@@ -36,8 +36,6 @@
+ $(INSTALL) -d $(DESTDIR)$(localstatedir)/lib/opendnssec/signconf
+ $(INSTALL) -d $(DESTDIR)$(localstatedir)/lib/opendnssec/unsigned
+ $(INSTALL) -d $(DESTDIR)$(localstatedir)/lib/opendnssec/signed
+- $(INSTALL) -d $(DESTDIR)$(localstatedir)/run
+- $(INSTALL) -d $(DESTDIR)$(localstatedir)/run/opendnssec
+
+ docs:
+ (cd libhsm; $(MAKE) doxygen)
diff --git a/net-dns/opendnssec/files/opendnssec-fix-run-dir.patch b/net-dns/opendnssec/files/opendnssec-fix-run-dir.patch
new file mode 100644
index 000000000000..fe5b504344cf
--- /dev/null
+++ b/net-dns/opendnssec/files/opendnssec-fix-run-dir.patch
@@ -0,0 +1,26 @@
+diff -ur opendnssec-1.3.12.orig/m4/opendnssec_common.m4 opendnssec-1.3.12/m4/opendnssec_common.m4
+--- opendnssec-1.3.12.orig/m4/opendnssec_common.m4 2013-01-31 13:46:01.122201232 +0100
++++ opendnssec-1.3.12/m4/opendnssec_common.m4 2013-01-31 13:54:47.648861211 +0100
+@@ -19,7 +19,7 @@
+ OPENDNSSEC_DATA_DIR=$full_datadir/opendnssec
+ OPENDNSSEC_SYSCONF_DIR=$full_sysconfdir/opendnssec
+ OPENDNSSEC_LOCALSTATE_DIR="$full_localstatedir/lib/opendnssec"
+-OPENDNSSEC_PID_DIR="$full_localstatedir/run/opendnssec"
++OPENDNSSEC_PID_DIR="${destdir}/run/opendnssec"
+
+ AC_SUBST([OPENDNSSEC_BIN_DIR])
+ AC_SUBST([OPENDNSSEC_SBIN_DIR])
+diff -ur opendnssec-1.3.12.orig/Makefile.am opendnssec-1.3.12/Makefile.am
+--- opendnssec-1.3.12.orig/Makefile.am 2013-01-31 13:46:01.122201232 +0100
++++ opendnssec-1.3.12/Makefile.am 2013-01-31 13:47:08.569951675 +0100
+@@ -37,8 +37,8 @@
+ $(INSTALL) -d $(DESTDIR)$(localstatedir)/lib/opendnssec/signconf
+ $(INSTALL) -d $(DESTDIR)$(localstatedir)/lib/opendnssec/unsigned
+ $(INSTALL) -d $(DESTDIR)$(localstatedir)/lib/opendnssec/signed
+- $(INSTALL) -d $(DESTDIR)$(localstatedir)/run
+- $(INSTALL) -d $(DESTDIR)$(localstatedir)/run/opendnssec
++
++
+
+ docs:
+ (cd libhsm; $(MAKE) doxygen)
diff --git a/net-dns/opendnssec/files/opendnssec-use-system-trang.patch b/net-dns/opendnssec/files/opendnssec-use-system-trang.patch
new file mode 100644
index 000000000000..745b277e1339
--- /dev/null
+++ b/net-dns/opendnssec/files/opendnssec-use-system-trang.patch
@@ -0,0 +1,20 @@
+--- conf/Makefile.am.orig 2013-05-12 22:45:26.514768943 +0200
++++ conf/Makefile.am 2013-05-12 22:46:33.399545628 +0200
+@@ -7,7 +7,7 @@
+ XML = addns.xml conf.xml kasp.xml zonelist.xml signconf.xml enforcerstate.xml
+ XSL= kasp2html.xsl
+
+-TRANG= $(srcdir)/trang/trang.jar
++TRANG= /usr/bin/trang
+ TRANG_URL "https://code.google.com/p/jing-trang/"
+
+ sysconfdir = @sysconfdir@/opendnssec
+@@ -31,7 +31,7 @@
+ .rnc.rng:
+ @test -x "${JAVA}" || \
+ (echo "java is required for converting RelaxNG Compact to RelaxNG"; false)
+- ${JAVA} -jar ${TRANG} $< $@
++ ${TRANG} $< $@
+
+ regress: $(RNG)
+ @test -x "${XMLLINT}" || \
diff --git a/net-dns/opendnssec/files/opendnssec.confd b/net-dns/opendnssec/files/opendnssec.confd
new file mode 100644
index 000000000000..a54fc2091273
--- /dev/null
+++ b/net-dns/opendnssec/files/opendnssec.confd
@@ -0,0 +1,11 @@
+# Copyright 1999-2013 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+# Variables containing default binaries used in the opendnssec
+# initscript. You can alter them to another applications/paths
+# if required.
+
+CHECKCONFIG_BIN=/usr/bin/ods-kaspcheck
+CONTROL_BIN=/usr/sbin/ods-control
+ENFORCER_BIN=/usr/sbin/ods-enforcerd
+SIGNER_BIN=/usr/sbin/ods-signerd
diff --git a/net-dns/opendnssec/files/opendnssec.confd-1.3.x b/net-dns/opendnssec/files/opendnssec.confd-1.3.x
new file mode 100644
index 000000000000..63121af7f0ca
--- /dev/null
+++ b/net-dns/opendnssec/files/opendnssec.confd-1.3.x
@@ -0,0 +1,13 @@
+# Copyright 1999-2013 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+# Variables containing default binaries used in the opendnssec
+# initscript. You can alter them to another applications/paths
+# if required.
+
+CHECKCONFIG_BIN=/usr/bin/ods-kaspcheck
+CONTROL_BIN=/usr/sbin/ods-control
+ENFORCER_BIN=/usr/sbin/ods-enforcerd
+SIGNER_BIN=/usr/sbin/ods-signerd
+EPPCLIENT_BIN=/usr/sbin/eppclientd
+EPPCLIENT_PIDFILE=/run/opendnssec/eppclientd.pid
diff --git a/net-dns/opendnssec/files/opendnssec.initd b/net-dns/opendnssec/files/opendnssec.initd
new file mode 100644
index 000000000000..39757d142f2d
--- /dev/null
+++ b/net-dns/opendnssec/files/opendnssec.initd
@@ -0,0 +1,85 @@
+#!/sbin/openrc-run
+# Copyright 1999-2014 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+description="An open-source turn-key solution for DNSSEC"
+
+depend() {
+ use logger
+}
+
+checkconfig() {
+ if [ -x "${CHECKCONFIG_BIN}" ]; then
+ output=$(${CHECKCONFIG_BIN} 2>&1| grep -v -E "^/etc/opendnssec/(conf|kasp).xml validates")
+ if [ -n "$output" ]; then
+ echo $output
+ fi
+
+ errors=$(echo $output | grep ERROR | wc -l)
+ if [ $errors -gt 0 ]; then
+ ewarn "$errors error(s) found in OpenDNSSEC configuration."
+ fi
+ return $errors
+ fi
+ eerror "Unable to execute ${CHECKCONFIG_BIN:-config binary}"
+ # can't validate config, just die
+ return 1
+}
+
+
+start_enforcer() {
+ if [ -n "${ENFORCER_BIN}" ] && [ -x "${ENFORCER_BIN}" ]; then
+ ebegin "Starting OpenDNSSEC Enforcer"
+ ${CONTROL_BIN} enforcer start > /dev/null
+ eend $?
+ else
+ if [ -n "${ENFORCER_BIN}" ]; then
+ eerror "OpenDNSSEC Enforcer binary not executable"
+ return 1
+ fi
+ einfo "OpenDNSSEC Enforcer not used."
+ fi
+}
+
+stop_enforcer() {
+ if [ -x "${ENFORCER_BIN}" ]; then
+ ebegin "Stopping OpenDNSSEC Enforcer"
+ ${CONTROL_BIN} enforcer stop > /dev/null
+ eend $?
+ fi
+}
+
+start_signer() {
+ if [ -n "${SIGNER_BIN}" ] && [ -x "${SIGNER_BIN}" ]; then
+ ebegin "Starting OpenDNSSEC Signer"
+ ${CONTROL_BIN} signer start > /dev/null 2>&1
+ eend $?
+ else
+ if [ -n "${SIGNER_BIN}" ]; then
+ eerror "OpenDNSSEC Signer binary not executable"
+ return 1
+ fi
+ einfo "OpenDNSSEC Signer not used."
+ fi
+}
+
+stop_signer() {
+ if [ -x "${SIGNER_BIN}" ]; then
+ ebegin "Stopping OpenDNSSEC Signer"
+ ${CONTROL_BIN} signer stop > /dev/null 2>&1
+ eend $?
+ fi
+}
+
+start() {
+ checkconfig || return $?
+ checkpath -d -m 0755 -o opendnssec:opendnssec /run/opendnssec
+ start_enforcer || return $?
+ start_signer || return $?
+}
+
+stop() {
+ stop_signer
+ stop_enforcer
+ sleep 5
+}
diff --git a/net-dns/opendnssec/files/opendnssec.initd-1.3.x b/net-dns/opendnssec/files/opendnssec.initd-1.3.x
new file mode 100644
index 000000000000..9f4adbd184a9
--- /dev/null
+++ b/net-dns/opendnssec/files/opendnssec.initd-1.3.x
@@ -0,0 +1,123 @@
+#!/sbin/openrc-run
+# Copyright 1999-2014 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+description="An open-source turn-key solution for DNSSEC"
+
+depend() {
+ use logger
+}
+
+checkconfig() {
+ if [ -z "${CHECKCONFIG_BIN}" ]; then
+ # no config checker configured, skip config check
+ return 0
+ fi
+ if [ -x "${CHECKCONFIG_BIN}" ]; then
+ output=$(${CHECKCONFIG_BIN} 2>&1| grep -v -E "^/etc/opendnssec/(conf|kasp).xml validates")
+ if [ -n "$output" ]; then
+ echo $output
+ fi
+
+ errors=$(echo $output | grep ERROR | wc -l)
+ if [ $errors -gt 0 ]; then
+ ewarn "$errors error(s) found in OpenDNSSEC configuration."
+ fi
+ return $errors
+ fi
+ eerror "Unable to execute ${CHECKCONFIG_BIN:-config binary}"
+ # can't validate config, just die
+ return 1
+}
+
+start_enforcer() {
+ if [ -n "${ENFORCER_BIN}" ] && [ -x "${ENFORCER_BIN}" ]; then
+ ebegin "Starting OpenDNSSEC Enforcer"
+ ${CONTROL_BIN} enforcer start > /dev/null
+ eend $?
+ else
+ if [ -n "${ENFORCER_BIN}" ]; then
+ eerror "OpenDNSSEC Enforcer binary not executable"
+ return 1
+ fi
+ einfo "OpenDNSSEC Enforcer not used."
+ fi
+}
+
+stop_enforcer() {
+ if [ -x "${ENFORCER_BIN}" ]; then
+ ebegin "Stopping OpenDNSSEC Enforcer"
+ ${CONTROL_BIN} enforcer stop > /dev/null
+ eend $?
+ fi
+}
+
+start_signer() {
+ if [ -n "${SIGNER_BIN}" ] && [ -x "${SIGNER_BIN}" ]; then
+ ebegin "Starting OpenDNSSEC Signer"
+ ${CONTROL_BIN} signer start > /dev/null 2>&1
+ eend $?
+ else
+ if [ -n "${SIGNER_BIN}" ]; then
+ eerror "OpenDNSSEC Signer binary not executable"
+ return 1
+ fi
+ einfo "OpenDNSSEC Signer not used."
+ fi
+}
+
+stop_signer() {
+ if [ -x "${SIGNER_BIN}" ]; then
+ ebegin "Stopping OpenDNSSEC Signer"
+ ${CONTROL_BIN} signer stop > /dev/null 2>&1
+ eend $?
+ fi
+}
+
+start_eppclient() {
+ if [ -n "${EPPCLIENT_BIN}" ] && [ -x "${EPPCLIENT_BIN}" ]; then
+ ebegin "Starting OpenDNSSEC Eppclient"
+ start-stop-daemon \
+ --start \
+ --user opendnssec --group opendnssec \
+ --exec "${EPPCLIENT_BIN}" \
+ --pidfile "${EPPCLIENT_PIDFILE}" > /dev/null
+ eend $?
+ else
+ # eppclient is ofptional so if we use the default binary and it
+ # is not used we won't die
+ if [ -n "${EPPCLIENT_BIN}" ] && \
+ [ "${EPPCLIENT_BIN}" != "/usr/sbin/eppclientd" ]; then
+ eerror "OpenDNSSEC Eppclient binary not executable"
+ return 1
+ fi
+ einfo "OpenDNSSEC Eppclient not used."
+ fi
+}
+
+stop_eppclient() {
+ if [ -x "${EPPCLIENT_BIN}" ]; then
+ ebegin "Stopping OpenDNSSEC Eppclient"
+ start-stop-daemon \
+ --stop \
+ --exec "${EPPCLIENT_BIN}" \
+ --pidfile "${EPPCLIENT_PIDFILE}" > /dev/null
+ eend $?
+ fi
+}
+
+start() {
+ checkconfig || return $?
+ test -d /run/opendnssec || mkdir -p /run/opendnssec
+ chown opendnssec:opendnssec /run/opendnssec
+ start_enforcer || return $?
+ start_signer || return $?
+ start_eppclient || return $?
+}
+
+stop() {
+ stop_eppclient
+ stop_signer
+ stop_enforcer
+ sleep 5
+}
diff --git a/net-dns/opendnssec/metadata.xml b/net-dns/opendnssec/metadata.xml
new file mode 100644
index 000000000000..f81a154f2ecf
--- /dev/null
+++ b/net-dns/opendnssec/metadata.xml
@@ -0,0 +1,15 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+ <maintainer type="person">
+ <email>mschiff@gentoo.org</email>
+ </maintainer>
+ <use>
+ <flag name="auditor">Enables auditing capabilities for OpenDNSSEC</flag>
+ <flag name="eppclient">Enables support for automatic submission of DNSSEC keys to an upstream epp server</flag>
+ <flag name="signer">Enables signing capabilities for OpenDNSSEC</flag>
+ <flag name="opensc">Enables support for storing DNSSEC keys through a <pkg>dev-libs/opensc</pkg> PKCS#11 interface</flag>
+ <flag name="softhsm">Enables support for storing DNSSEC keys in a <pkg>dev-libs/softhsm</pkg> PKCS#11 object</flag>
+ <flag name="external-hsm">Enables support for storing DNSSEC keys through an arbitrary non-portage PKCS#11 interface, specified through an environment variable</flag>
+ </use>
+</pkgmetadata>
diff --git a/net-dns/opendnssec/opendnssec-1.3.18-r1.ebuild b/net-dns/opendnssec/opendnssec-1.3.18-r1.ebuild
new file mode 100644
index 000000000000..d4bfd0296b7c
--- /dev/null
+++ b/net-dns/opendnssec/opendnssec-1.3.18-r1.ebuild
@@ -0,0 +1,203 @@
+# Copyright 1999-2017 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=5
+
+MY_P="${P/_}"
+PKCS11_IUSE="+softhsm opensc external-hsm"
+inherit autotools multilib user
+
+DESCRIPTION="An open-source turn-key solution for DNSSEC"
+HOMEPAGE="http://www.opendnssec.org/"
+SRC_URI="http://www.${PN}.org/files/source/${MY_P}.tar.gz"
+
+LICENSE="BSD GPL-2"
+SLOT="0"
+KEYWORDS="~amd64 ~x86"
+IUSE="-auditor +curl debug doc eppclient mysql +signer +sqlite test ${PKCS11_IUSE}"
+
+RDEPEND="
+ dev-lang/perl
+ dev-libs/libxml2
+ dev-libs/libxslt
+ net-libs/ldns
+ curl? ( net-misc/curl )
+ mysql? (
+ virtual/mysql
+ dev-perl/DBD-mysql
+ )
+ opensc? ( dev-libs/opensc )
+ softhsm? ( dev-libs/softhsm:* )
+ sqlite? (
+ dev-db/sqlite:3
+ dev-perl/DBD-SQLite
+ )
+"
+DEPEND="${RDEPEND}
+ doc? ( app-doc/doxygen )
+ test? (
+ app-text/trang
+ )
+"
+# test? dev-util/cunit # Requires running test DB
+
+REQUIRED_USE="
+ ^^ ( mysql sqlite )
+ ^^ ( softhsm opensc external-hsm )
+ eppclient? ( curl )
+"
+
+PATCHES=(
+ "${FILESDIR}/${PN}-fix-localstatedir.patch"
+ "${FILESDIR}/${PN}-fix-run-dir.patch"
+ "${FILESDIR}/${PN}-1.3.14-drop-privileges.patch"
+ "${FILESDIR}/${PN}-1.3.14-use-system-trang.patch"
+ "${FILESDIR}/${PN}-1.3.18-eppclient-curl-CVE-2012-5582.patch"
+)
+
+S="${WORKDIR}/${MY_P}"
+
+DOCS=( MIGRATION NEWS )
+
+check_pkcs11_setup() {
+ # PKCS#11 HSM's are often only available with proprietary drivers not
+ # available in portage tree.
+
+ if use softhsm; then
+ PKCS11_LIB=softhsm
+ if has_version ">=dev-libs/softhsm-1.3.1"; then
+ PKCS11_PATH=/usr/$(get_libdir)/softhsm/libsofthsm.so
+ else
+ PKCS11_PATH=/usr/$(get_libdir)/libsofthsm.so
+ fi
+ elog "Building with SoftHSM PKCS#11 library support."
+ fi
+ if use opensc; then
+ PKCS11_LIB=opensc
+ PKCS11_PATH=/usr/$(get_libdir)/opensc-pkcs11.so
+ elog "Building with OpenSC PKCS#11 library support."
+ fi
+ if use external-hsm; then
+ if [[ -n ${PKCS11_SCA6000} ]]; then
+ PKCS11_LIB=sca6000
+ PKCS11_PATH=${PKCS11_SCA6000}
+ elif [[ -n ${PKCS11_ETOKEN} ]]; then
+ PKCS11_LIB=etoken
+ PKCS11_PATH=${PKCS11_ETOKEN}
+ elif [[ -n ${PKCS11_NCIPHER} ]]; then
+ PKCS11_LIB=ncipher
+ PKCS11_PATH=${PKCS11_NCIPHER}
+ elif [[ -n ${PKCS11_AEPKEYPER} ]]; then
+ PKCS11_LIB=aepkeyper
+ PKCS11_PATH=${PKCS11_AEPKEYPER}
+ else
+ ewarn "You enabled USE flag 'external-hsm' but did not specify a path to a PKCS#11"
+ ewarn "library. To set a path, set one of the following environment variables:"
+ ewarn " for Sun Crypto Accelerator 6000, set: PKCS11_SCA6000=<path>"
+ ewarn " for Aladdin eToken, set: PKCS11_ETOKEN=<path>"
+ ewarn " for Thales/nCipher netHSM, set: PKCS11_NCIPHER=<path>"
+ ewarn " for AEP Keyper, set: PKCS11_AEPKEYPER=<path>"
+ ewarn "Example:"
+ ewarn " PKCS11_ETOKEN=\"/opt/etoken/lib/libeTPkcs11.so\" emerge -pv opendnssec"
+ ewarn "or store the variable into /etc/portage/make.conf"
+ die "USE flag 'external-hsm' set but no PKCS#11 library path specified."
+ fi
+ elog "Building with external PKCS#11 library support ($PKCS11_LIB): ${PKCS11_PATH}"
+ fi
+}
+
+pkg_pretend() {
+ local i
+
+ for i in eppclient mysql; do
+ if use ${i}; then
+ ewarn
+ ewarn "Usage of ${i} is considered experimental."
+ ewarn "Do not report bugs against this feature."
+ ewarn
+ fi
+ done
+
+ check_pkcs11_setup
+}
+
+pkg_setup() {
+ enewgroup opendnssec
+ enewuser opendnssec -1 -1 -1 opendnssec
+
+ # pretend does not preserve variables so we need to run this once more
+ check_pkcs11_setup
+}
+
+src_prepare() {
+ base_src_prepare
+ eautoreconf
+}
+
+src_configure() {
+ # $(use_with test cunit "${EPREFIX}/usr/") \
+ econf \
+ --without-cunit \
+ --localstatedir="${EPREFIX}/var/" \
+ --disable-static \
+ --with-database-backend=$(use mysql && echo "mysql")$(use sqlite && echo "sqlite3") \
+ --with-pkcs11-${PKCS11_LIB}=${PKCS11_PATH} \
+ --disable-auditor \
+ $(use_with curl) \
+ $(use_enable debug timeshift) \
+ $(use_enable eppclient) \
+ $(use_enable signer)
+}
+
+src_compile() {
+ default
+ use doc && emake docs
+}
+
+src_install() {
+ default
+
+ # remove useless .la files
+ find "${ED}" -name '*.la' -delete
+
+ # Remove subversion tags from config files to avoid useless config updates
+ sed -i \
+ -e '/<!-- \$Id:/ d' \
+ "${ED}"/etc/opendnssec/* || die
+
+ # install update scripts
+ insinto /usr/share/opendnssec
+ use sqlite && doins enforcer/utils/migrate_keyshare_sqlite3.pl
+ use mysql && doins enforcer/utils/migrate_keyshare_mysql.pl
+
+ # fix permissions
+ fowners root:opendnssec /etc/opendnssec
+ fowners root:opendnssec /etc/opendnssec/{conf,kasp,zonelist,zonefetch}.xml
+ use eppclient && fowners root:opendnssec /etc/opendnssec/eppclientd.conf
+
+ fowners opendnssec:opendnssec /var/lib/opendnssec/{,signconf,unsigned,signed,tmp}
+
+ # install conf/init script
+ newinitd "${FILESDIR}"/opendnssec.initd-1.3.x opendnssec
+ newconfd "${FILESDIR}"/opendnssec.confd-1.3.x opendnssec
+ use auditor || sed -i 's/^CHECKCONFIG_BIN=.*/CHECKCONFIG_BIN=/' "${D}"/etc/conf.d/opendnssec
+}
+
+pkg_postinst() {
+ if use softhsm; then
+ elog "Please make sure that you create your softhsm database in a location writeable"
+ elog "by the opendnssec user. You can set its location in /etc/softhsm.conf."
+ elog "Suggested configuration is:"
+ elog " echo \"0:/var/lib/opendnssec/softhsm_slot0.db\" >> /etc/softhsm.conf"
+ elog " softhsm --init-token --slot 0 --label OpenDNSSEC"
+ elog " chown opendnssec:opendnssec /var/lib/opendnssec/softhsm_slot0.db"
+ fi
+ if use auditor; then
+ ewarn
+ ewarn "Please note that auditor support has been disabled in this version since it"
+ ewarn "it depends on ruby 1.8 which has been removed from the portage tree."
+ ewarn "USE=auditor is only provided for this warning but will not install the"
+ ewarn "auditor anymore."
+ ewarn
+ fi
+}
diff --git a/net-dns/opendnssec/opendnssec-1.4.12-r1.ebuild b/net-dns/opendnssec/opendnssec-1.4.12-r1.ebuild
new file mode 100644
index 000000000000..68d85cf8be58
--- /dev/null
+++ b/net-dns/opendnssec/opendnssec-1.4.12-r1.ebuild
@@ -0,0 +1,207 @@
+# Copyright 1999-2017 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=5
+
+MY_P="${P/_}"
+PKCS11_IUSE="+softhsm opensc external-hsm"
+inherit autotools eutils multilib user
+
+DESCRIPTION="An open-source turn-key solution for DNSSEC"
+HOMEPAGE="http://www.opendnssec.org/"
+SRC_URI="http://www.${PN}.org/files/source/${MY_P}.tar.gz"
+
+LICENSE="BSD GPL-2"
+SLOT="0"
+KEYWORDS="~amd64 ~x86"
+IUSE="debug doc +mysql +signer sqlite test ${PKCS11_IUSE}"
+
+RDEPEND="
+ dev-lang/perl
+ dev-libs/libxml2
+ dev-libs/libxslt
+ net-libs/ldns
+ mysql? (
+ virtual/mysql
+ dev-perl/DBD-mysql
+ )
+ opensc? ( dev-libs/opensc )
+ softhsm? ( dev-libs/softhsm:* )
+ sqlite? (
+ dev-db/sqlite:3
+ dev-perl/DBD-SQLite
+ )
+"
+DEPEND="${RDEPEND}
+ doc? ( app-doc/doxygen )
+ test? (
+ app-text/trang
+ )
+"
+
+REQUIRED_USE="
+ ^^ ( mysql sqlite )
+ ^^ ( softhsm opensc external-hsm )
+"
+
+PATCHES=(
+ "${FILESDIR}/${PN}-fix-localstatedir.patch"
+ "${FILESDIR}/${PN}-fix-run-dir.patch"
+ "${FILESDIR}/${PN}-drop-privileges.patch"
+ "${FILESDIR}/${PN}-use-system-trang.patch"
+)
+
+S="${WORKDIR}/${MY_P}"
+
+DOCS=( MIGRATION NEWS )
+
+check_pkcs11_setup() {
+ # PKCS#11 HSM's are often only available with proprietary drivers not
+ # available in portage tree.
+
+ if use softhsm; then
+ PKCS11_LIB=softhsm
+ if has_version ">=dev-libs/softhsm-1.3.1"; then
+ PKCS11_PATH=/usr/$(get_libdir)/softhsm/libsofthsm.so
+ else
+ PKCS11_PATH=/usr/$(get_libdir)/libsofthsm.so
+ fi
+ elog "Building with SoftHSM PKCS#11 library support."
+ fi
+ if use opensc; then
+ PKCS11_LIB=opensc
+ PKCS11_PATH=/usr/$(get_libdir)/opensc-pkcs11.so
+ elog "Building with OpenSC PKCS#11 library support."
+ fi
+ if use external-hsm; then
+ if [[ -n ${PKCS11_SCA6000} ]]; then
+ PKCS11_LIB=sca6000
+ PKCS11_PATH=${PKCS11_SCA6000}
+ elif [[ -n ${PKCS11_ETOKEN} ]]; then
+ PKCS11_LIB=etoken
+ PKCS11_PATH=${PKCS11_ETOKEN}
+ elif [[ -n ${PKCS11_NCIPHER} ]]; then
+ PKCS11_LIB=ncipher
+ PKCS11_PATH=${PKCS11_NCIPHER}
+ elif [[ -n ${PKCS11_AEPKEYPER} ]]; then
+ PKCS11_LIB=aepkeyper
+ PKCS11_PATH=${PKCS11_AEPKEYPER}
+ else
+ ewarn "You enabled USE flag 'external-hsm' but did not specify a path to a PKCS#11"
+ ewarn "library. To set a path, set one of the following environment variables:"
+ ewarn " for Sun Crypto Accelerator 6000, set: PKCS11_SCA6000=<path>"
+ ewarn " for Aladdin eToken, set: PKCS11_ETOKEN=<path>"
+ ewarn " for Thales/nCipher netHSM, set: PKCS11_NCIPHER=<path>"
+ ewarn " for AEP Keyper, set: PKCS11_AEPKEYPER=<path>"
+ ewarn "Example:"
+ ewarn " PKCS11_ETOKEN=\"/opt/etoken/lib/libeTPkcs11.so\" emerge -pv opendnssec"
+ ewarn "or store the variable into /etc/portage/make.conf"
+ die "USE flag 'external-hsm' set but no PKCS#11 library path specified."
+ fi
+ elog "Building with external PKCS#11 library support ($PKCS11_LIB): ${PKCS11_PATH}"
+ fi
+}
+
+pkg_pretend() {
+ check_pkcs11_setup
+}
+
+pkg_setup() {
+ enewgroup opendnssec
+ enewuser opendnssec -1 -1 -1 opendnssec
+
+ # pretend does not preserve variables so we need to run this once more
+ check_pkcs11_setup
+}
+
+src_prepare() {
+ local patch
+ default
+ for patch in "${PATCHES[@]}"; do
+ epatch "$patch"
+ done
+ eautoreconf
+}
+
+src_configure() {
+ econf \
+ --without-cunit \
+ --localstatedir="${EPREFIX}/var/" \
+ --disable-static \
+ --with-database-backend=$(use mysql && echo "mysql")$(use sqlite && echo "sqlite3") \
+ --with-pkcs11-${PKCS11_LIB}=${PKCS11_PATH} \
+ $(use_enable debug timeshift) \
+ $(use_enable signer)
+}
+
+src_compile() {
+ default
+ use doc && emake docs
+}
+
+src_install() {
+ default
+
+ # remove useless .la files
+ find "${ED}" -name '*.la' -delete
+
+ # Remove subversion tags from config files to avoid useless config updates
+ sed -i \
+ -e '/<!-- \$Id:/ d' \
+ "${ED}"/etc/opendnssec/* || die
+
+ # install update scripts
+ insinto /usr/share/opendnssec
+ if use sqlite; then
+ doins enforcer/utils/migrate_*sqlite*
+ fi
+ if use mysql; then
+ doins enforcer/utils/migrate_*mysql*
+ fi
+
+ # fix permissions
+ fowners root:opendnssec /etc/opendnssec
+ fowners root:opendnssec /etc/opendnssec/{addns,conf,kasp,zonelist}.xml
+ fowners opendnssec:opendnssec /var/lib/opendnssec/{,signconf,unsigned,signed,tmp}
+
+ # install conf/init script
+ newinitd "${FILESDIR}"/opendnssec.initd opendnssec
+ newconfd "${FILESDIR}"/opendnssec.confd opendnssec
+}
+
+pkg_postinst() {
+ local v
+ if use softhsm; then
+ elog "Please make sure that you create your softhsm database in a location writeable"
+ elog "by the opendnssec user. You can set its location in /etc/softhsm.conf."
+ elog "Suggested configuration is:"
+ elog " echo \"0:/var/lib/opendnssec/softhsm_slot0.db\" >> /etc/softhsm.conf"
+ elog " softhsm --init-token --slot 0 --label OpenDNSSEC"
+ elog " chown opendnssec:opendnssec /var/lib/opendnssec/softhsm_slot0.db"
+ fi
+
+ for v in $REPLACING_VERSIONS; do
+ case $v in
+ 1.3.*)
+ ewarn ""
+ ewarn "You are upgrading from version 1.3."
+ ewarn ""
+ ewarn "Please be aware of the following:"
+ ewarn " * OpenDNSSEC now supports both input and output adapters for"
+ ewarn " AXFR and IXFR in addition to file transfer."
+ ewarn " -> The zonefetch.xml file has been replaced by addns.xml"
+ ewarn " to support this enhancement."
+ ewarn " -> changes to the KASP database mean that a database"
+ ewarn " migration is required to upgrade to 1.4 from earlier"
+ ewarn " versions of OpenDNSSEC."
+ ewarn " * The auditor is no longer supported."
+ ewarn ""
+ ewarn "You can find more information here:"
+ ewarn " * /usr/share/doc/opendnssec*/MIGRATION*"
+ ewarn " * https://wiki.opendnssec.org/display/DOCS/Migrating+zone+fetcher+to+DNS+adapters"
+ ewarn " * https://wiki.opendnssec.org/display/DOCS/Migrating+from+earlier+versions+of+OpenDNSSEC"
+ ewarn ""
+ ;;
+ esac
+ done
+}
diff --git a/net-dns/opendnssec/opendnssec-1.4.8.2.ebuild b/net-dns/opendnssec/opendnssec-1.4.8.2.ebuild
new file mode 100644
index 000000000000..c83f258bb104
--- /dev/null
+++ b/net-dns/opendnssec/opendnssec-1.4.8.2.ebuild
@@ -0,0 +1,205 @@
+# Copyright 1999-2017 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=5
+
+MY_P="${P/_}"
+PKCS11_IUSE="+softhsm opensc external-hsm"
+inherit autotools multilib user
+
+DESCRIPTION="An open-source turn-key solution for DNSSEC"
+HOMEPAGE="http://www.opendnssec.org/"
+SRC_URI="http://www.${PN}.org/files/source/${MY_P}.tar.gz"
+
+LICENSE="BSD GPL-2"
+SLOT="0"
+KEYWORDS="~amd64 ~x86"
+IUSE="debug doc +mysql +signer sqlite test ${PKCS11_IUSE}"
+
+RDEPEND="
+ dev-lang/perl
+ dev-libs/libxml2
+ dev-libs/libxslt
+ net-libs/ldns
+ mysql? (
+ virtual/mysql
+ dev-perl/DBD-mysql
+ )
+ opensc? ( dev-libs/opensc )
+ softhsm? ( dev-libs/softhsm:* )
+ sqlite? (
+ dev-db/sqlite:3
+ dev-perl/DBD-SQLite
+ )
+"
+DEPEND="${RDEPEND}
+ doc? ( app-doc/doxygen )
+ test? (
+ app-text/trang
+ )
+"
+
+REQUIRED_USE="
+ ^^ ( mysql sqlite )
+ ^^ ( softhsm opensc external-hsm )
+"
+
+PATCHES=(
+ "${FILESDIR}/${PN}-fix-localstatedir.patch"
+ "${FILESDIR}/${PN}-fix-run-dir.patch"
+ "${FILESDIR}/${PN}-drop-privileges.patch"
+ "${FILESDIR}/${PN}-use-system-trang.patch"
+)
+
+S="${WORKDIR}/${MY_P}"
+
+DOCS=( MIGRATION NEWS )
+
+check_pkcs11_setup() {
+ # PKCS#11 HSM's are often only available with proprietary drivers not
+ # available in portage tree.
+
+ if use softhsm; then
+ PKCS11_LIB=softhsm
+ if has_version ">=dev-libs/softhsm-1.3.1"; then
+ PKCS11_PATH=/usr/$(get_libdir)/softhsm/libsofthsm.so
+ else
+ PKCS11_PATH=/usr/$(get_libdir)/libsofthsm.so
+ fi
+ elog "Building with SoftHSM PKCS#11 library support."
+ fi
+ if use opensc; then
+ PKCS11_LIB=opensc
+ PKCS11_PATH=/usr/$(get_libdir)/opensc-pkcs11.so
+ elog "Building with OpenSC PKCS#11 library support."
+ fi
+ if use external-hsm; then
+ if [[ -n ${PKCS11_SCA6000} ]]; then
+ PKCS11_LIB=sca6000
+ PKCS11_PATH=${PKCS11_SCA6000}
+ elif [[ -n ${PKCS11_ETOKEN} ]]; then
+ PKCS11_LIB=etoken
+ PKCS11_PATH=${PKCS11_ETOKEN}
+ elif [[ -n ${PKCS11_NCIPHER} ]]; then
+ PKCS11_LIB=ncipher
+ PKCS11_PATH=${PKCS11_NCIPHER}
+ elif [[ -n ${PKCS11_AEPKEYPER} ]]; then
+ PKCS11_LIB=aepkeyper
+ PKCS11_PATH=${PKCS11_AEPKEYPER}
+ else
+ ewarn "You enabled USE flag 'external-hsm' but did not specify a path to a PKCS#11"
+ ewarn "library. To set a path, set one of the following environment variables:"
+ ewarn " for Sun Crypto Accelerator 6000, set: PKCS11_SCA6000=<path>"
+ ewarn " for Aladdin eToken, set: PKCS11_ETOKEN=<path>"
+ ewarn " for Thales/nCipher netHSM, set: PKCS11_NCIPHER=<path>"
+ ewarn " for AEP Keyper, set: PKCS11_AEPKEYPER=<path>"
+ ewarn "Example:"
+ ewarn " PKCS11_ETOKEN=\"/opt/etoken/lib/libeTPkcs11.so\" emerge -pv opendnssec"
+ ewarn "or store the variable into /etc/portage/make.conf"
+ die "USE flag 'external-hsm' set but no PKCS#11 library path specified."
+ fi
+ elog "Building with external PKCS#11 library support ($PKCS11_LIB): ${PKCS11_PATH}"
+ fi
+}
+
+pkg_pretend() {
+ check_pkcs11_setup
+}
+
+pkg_setup() {
+ enewgroup opendnssec
+ enewuser opendnssec -1 -1 -1 opendnssec
+
+ # pretend does not preserve variables so we need to run this once more
+ check_pkcs11_setup
+}
+
+src_prepare() {
+ base_src_prepare
+ eautoreconf
+}
+
+src_configure() {
+ econf \
+ --without-cunit \
+ --localstatedir="${EPREFIX}/var/" \
+ --disable-static \
+ --with-database-backend=$(use mysql && echo "mysql")$(use sqlite && echo "sqlite3") \
+ --with-pkcs11-${PKCS11_LIB}=${PKCS11_PATH} \
+ $(use_enable debug timeshift) \
+ $(use_enable signer)
+}
+
+src_compile() {
+ default
+ use doc && emake docs
+}
+
+src_install() {
+ default
+
+ # remove useless .la files
+ find "${ED}" -name '*.la' -delete
+
+ # Remove subversion tags from config files to avoid useless config updates
+ sed -i \
+ -e '/<!-- \$Id:/ d' \
+ "${ED}"/etc/opendnssec/* || die
+
+ # install update scripts
+ insinto /usr/share/opendnssec
+ if use sqlite; then
+ doins enforcer/utils/migrate_keyshare_sqlite3.pl
+ doins enforcer/utils/migrate_adapters_1.sqlite3
+ fi
+ if use mysql; then
+ doins enforcer/utils/migrate_keyshare_mysql.pl
+ doins enforcer/utils/migrate_adapters_1.mysql
+ fi
+
+ # fix permissions
+ fowners root:opendnssec /etc/opendnssec
+ fowners root:opendnssec /etc/opendnssec/{addns,conf,kasp,zonelist}.xml
+ fowners opendnssec:opendnssec /var/lib/opendnssec/{,signconf,unsigned,signed,tmp}
+
+ # install conf/init script
+ newinitd "${FILESDIR}"/opendnssec.initd opendnssec
+ newconfd "${FILESDIR}"/opendnssec.confd opendnssec
+}
+
+pkg_postinst() {
+ local v
+ if use softhsm; then
+ elog "Please make sure that you create your softhsm database in a location writeable"
+ elog "by the opendnssec user. You can set its location in /etc/softhsm.conf."
+ elog "Suggested configuration is:"
+ elog " echo \"0:/var/lib/opendnssec/softhsm_slot0.db\" >> /etc/softhsm.conf"
+ elog " softhsm --init-token --slot 0 --label OpenDNSSEC"
+ elog " chown opendnssec:opendnssec /var/lib/opendnssec/softhsm_slot0.db"
+ fi
+
+ for v in $REPLACING_VERSIONS; do
+ case $v in
+ 1.3.*)
+ ewarn ""
+ ewarn "You are upgrading from version 1.3."
+ ewarn ""
+ ewarn "Please be aware of the following:"
+ ewarn " * OpenDNSSEC now supports both input and output adapters for"
+ ewarn " AXFR and IXFR in addition to file transfer."
+ ewarn " -> The zonefetch.xml file has been replaced by addns.xml"
+ ewarn " to support this enhancement."
+ ewarn " -> changes to the KASP database mean that a database"
+ ewarn " migration is required to upgrade to 1.4 from earlier"
+ ewarn " versions of OpenDNSSEC."
+ ewarn " * The auditor is no longer supported."
+ ewarn ""
+ ewarn "You can find more information here:"
+ ewarn " * /usr/share/doc/opendnssec*/MIGRATION*"
+ ewarn " * https://wiki.opendnssec.org/display/DOCS/Migrating+zone+fetcher+to+DNS+adapters"
+ ewarn " * https://wiki.opendnssec.org/display/DOCS/Migrating+from+earlier+versions+of+OpenDNSSEC"
+ ewarn ""
+ ;;
+ esac
+ done
+}
diff --git a/net-dns/opendnssec/opendnssec-2.0.1-r1.ebuild b/net-dns/opendnssec/opendnssec-2.0.1-r1.ebuild
new file mode 100644
index 000000000000..f4ecf0b3f3eb
--- /dev/null
+++ b/net-dns/opendnssec/opendnssec-2.0.1-r1.ebuild
@@ -0,0 +1,239 @@
+# Copyright 1999-2017 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=5
+
+MY_P="${P/_}"
+PKCS11_IUSE="+softhsm opensc external-hsm"
+inherit autotools eutils multilib user
+
+DESCRIPTION="An open-source turn-key solution for DNSSEC"
+HOMEPAGE="http://www.opendnssec.org/"
+SRC_URI="http://www.${PN}.org/files/source/${MY_P}.tar.gz"
+
+LICENSE="BSD GPL-2"
+SLOT="0"
+KEYWORDS="~amd64 ~x86"
+IUSE="debug doc +mysql readline +signer sqlite test ${PKCS11_IUSE}"
+
+RDEPEND="
+ dev-lang/perl
+ dev-libs/libxml2
+ dev-libs/libxslt
+ net-libs/ldns
+ mysql? (
+ virtual/mysql
+ dev-perl/DBD-mysql
+ )
+ opensc? ( dev-libs/opensc )
+ readline? ( sys-libs/readline:0 )
+ softhsm? ( dev-libs/softhsm:* )
+ sqlite? (
+ dev-db/sqlite:3
+ dev-perl/DBD-SQLite
+ )
+"
+DEPEND="${RDEPEND}
+ doc? ( app-doc/doxygen )
+ test? (
+ app-text/trang
+ )
+"
+
+REQUIRED_USE="
+ ^^ ( mysql sqlite )
+ ^^ ( softhsm opensc external-hsm )
+"
+
+PATCHES=(
+ "${FILESDIR}/${PN}-fix-localstatedir-2.0.x.patch"
+ "${FILESDIR}/${PN}-fix-run-dir-2.0.x.patch"
+ "${FILESDIR}/${PN}-drop-privileges-2.0.x.patch"
+ "${FILESDIR}/${PN}-use-system-trang.patch"
+)
+
+S="${WORKDIR}/${MY_P}"
+
+DOCS=( MIGRATION NEWS )
+
+check_pkcs11_setup() {
+ # PKCS#11 HSM's are often only available with proprietary drivers not
+ # available in portage tree.
+
+ if use softhsm; then
+ PKCS11_LIB=softhsm
+ if has_version ">=dev-libs/softhsm-1.3.1"; then
+ PKCS11_PATH=/usr/$(get_libdir)/softhsm/libsofthsm.so
+ else
+ PKCS11_PATH=/usr/$(get_libdir)/libsofthsm.so
+ fi
+ elog "Building with SoftHSM PKCS#11 library support."
+ fi
+ if use opensc; then
+ PKCS11_LIB=opensc
+ PKCS11_PATH=/usr/$(get_libdir)/opensc-pkcs11.so
+ elog "Building with OpenSC PKCS#11 library support."
+ fi
+ if use external-hsm; then
+ if [[ -n ${PKCS11_SCA6000} ]]; then
+ PKCS11_LIB=sca6000
+ PKCS11_PATH=${PKCS11_SCA6000}
+ elif [[ -n ${PKCS11_ETOKEN} ]]; then
+ PKCS11_LIB=etoken
+ PKCS11_PATH=${PKCS11_ETOKEN}
+ elif [[ -n ${PKCS11_NCIPHER} ]]; then
+ PKCS11_LIB=ncipher
+ PKCS11_PATH=${PKCS11_NCIPHER}
+ elif [[ -n ${PKCS11_AEPKEYPER} ]]; then
+ PKCS11_LIB=aepkeyper
+ PKCS11_PATH=${PKCS11_AEPKEYPER}
+ else
+ ewarn "You enabled USE flag 'external-hsm' but did not specify a path to a PKCS#11"
+ ewarn "library. To set a path, set one of the following environment variables:"
+ ewarn " for Sun Crypto Accelerator 6000, set: PKCS11_SCA6000=<path>"
+ ewarn " for Aladdin eToken, set: PKCS11_ETOKEN=<path>"
+ ewarn " for Thales/nCipher netHSM, set: PKCS11_NCIPHER=<path>"
+ ewarn " for AEP Keyper, set: PKCS11_AEPKEYPER=<path>"
+ ewarn "Example:"
+ ewarn " PKCS11_ETOKEN=\"/opt/etoken/lib/libeTPkcs11.so\" emerge -pv opendnssec"
+ ewarn "or store the variable into /etc/portage/make.conf"
+ die "USE flag 'external-hsm' set but no PKCS#11 library path specified."
+ fi
+ elog "Building with external PKCS#11 library support ($PKCS11_LIB): ${PKCS11_PATH}"
+ fi
+}
+
+pkg_pretend() {
+ if has_version "<net-dns/opendnssec-1.4.10"; then
+ ################################################################################
+ eerror "You are already using OpenDNSSEC."
+ eerror "In order to migrate to version >=2.0.0 you need to upgrade to"
+ eerror "version >=1.4.10 first:"
+ eerror ""
+ eerror " emerge \"<net-dns/opendnssec-2\""
+ eerror ""
+ eerror "See https://github.com/opendnssec/opendnssec/blob/2.0/master/MIGRATION"
+ eerror "for details."
+ eerror ""
+ die "Please upgrade to version >=1.4.10 first for proper db migraion"
+ fi
+
+ check_pkcs11_setup
+}
+
+pkg_setup() {
+ enewgroup opendnssec
+ enewuser opendnssec -1 -1 -1 opendnssec
+
+ # pretend does not preserve variables so we need to run this once more
+ check_pkcs11_setup
+}
+
+src_prepare() {
+ local patch
+ default
+ for patch in "${PATCHES[@]}"; do
+ epatch "$patch"
+ done
+ eautoreconf
+}
+
+src_configure() {
+ econf \
+ --without-cunit \
+ --localstatedir="${EPREFIX}/var" \
+ --disable-static \
+ --with-enforcer-database=$(use mysql && echo "mysql")$(use sqlite && echo "sqlite3") \
+ --with-pkcs11-${PKCS11_LIB}=${PKCS11_PATH} \
+ $(use_with readline) \
+ $(use_enable signer)
+}
+
+src_compile() {
+ default
+ use doc && emake docs
+}
+
+src_install() {
+ default
+
+ # remove useless .la files
+ find "${ED}" -name '*.la' -delete
+
+ # Remove subversion tags from config files to avoid useless config updates
+ sed -i \
+ -e '/<!-- \$Id:/ d' \
+ "${ED}"/etc/opendnssec/* || die
+
+ # install db update/migration stuff
+ insinto /usr/share/opendnssec/db
+ if use sqlite; then
+ doins enforcer/utils/convert_mysql_to_sqlite
+ fi
+ if use mysql; then
+ doins enforcer/utils/convert_sqlite_to_mysql
+ fi
+
+ insinto /usr/share/opendnssec/db/sql
+ if use sqlite; then
+ doins enforcer/src/db/schema.sqlite
+ fi
+ if use mysql; then
+ doins enforcer/src/db/schema.mysql
+ fi
+
+ insinto /usr/share/opendnssec/db/1.4-2.0_db_convert
+ doins enforcer/utils/1.4-2.0_db_convert/find_problematic_zones.sql
+ doins enforcer/utils/1.4-2.0_db_convert/README.md
+ if use sqlite; then
+ doins enforcer/utils/1.4-2.0_db_convert/sqlite_convert.sql
+ doins enforcer/utils/1.4-2.0_db_convert/convert_sqlite
+ fi
+ if use mysql; then
+ doins enforcer/utils/1.4-2.0_db_convert/convert_mysql
+ doins enforcer/utils/1.4-2.0_db_convert/mysql_convert.sql
+ fi
+
+ # patch scripts to find schema files
+ sed -i \
+ -e 's,^SCHEMA=../src/db/,SCHEMA=/usr/share/opendnssec/db/sql/,' \
+ -e 's,^SCHEMA=../../src/db/,SCHEMA=/usr/share/opendnssec/db/sql/,' \
+ "${ED}"/usr/share/opendnssec/db/convert_* \
+ "${ED}"/usr/share/opendnssec/db/1.4-2.0_db_convert/convert_*
+
+ # fix permissions
+ fowners root:opendnssec /etc/opendnssec
+ fowners root:opendnssec /etc/opendnssec/{addns,conf,kasp,zonelist}.xml
+ fowners opendnssec:opendnssec /var/lib/opendnssec/{,enforcer,signconf,signed,signer,unsigned}
+
+ # install conf/init script
+ newinitd "${FILESDIR}"/opendnssec.initd opendnssec
+ newconfd "${FILESDIR}"/opendnssec.confd opendnssec
+}
+
+pkg_postinst() {
+ local v
+ if use softhsm; then
+ elog "Please make sure that you create your softhsm database in a location writeable"
+ elog "by the opendnssec user. You can set its location in /etc/softhsm.conf."
+ elog "Suggested configuration is:"
+ elog " echo \"0:/var/lib/opendnssec/softhsm_slot0.db\" >> /etc/softhsm.conf"
+ elog " softhsm --init-token --slot 0 --label OpenDNSSEC"
+ elog " chown opendnssec:opendnssec /var/lib/opendnssec/softhsm_slot0.db"
+ fi
+ for v in $REPLACING_VERSIONS; do
+ case $v in
+ 1.4.*)
+ ewarn ""
+ ewarn "You are upgrading from version 1.4."
+ ewarn ""
+ ewarn "A migration is needed from 1.4 to 2.0."
+ ewarn "For details see /usr/share/doc/${P}/MIGRATION*"
+ ewarn ""
+ ewarn "For your convenience the mentioned migration scripts and README"
+ ewarn "have been installed to /usr/share/${PN}/db/1.4-2.0_db_convert"
+ ewarn ""
+ ;;
+ esac
+ done
+}
diff --git a/net-dns/opendnssec/opendnssec-2.0.3.ebuild b/net-dns/opendnssec/opendnssec-2.0.3.ebuild
new file mode 100644
index 000000000000..f4ecf0b3f3eb
--- /dev/null
+++ b/net-dns/opendnssec/opendnssec-2.0.3.ebuild
@@ -0,0 +1,239 @@
+# Copyright 1999-2017 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=5
+
+MY_P="${P/_}"
+PKCS11_IUSE="+softhsm opensc external-hsm"
+inherit autotools eutils multilib user
+
+DESCRIPTION="An open-source turn-key solution for DNSSEC"
+HOMEPAGE="http://www.opendnssec.org/"
+SRC_URI="http://www.${PN}.org/files/source/${MY_P}.tar.gz"
+
+LICENSE="BSD GPL-2"
+SLOT="0"
+KEYWORDS="~amd64 ~x86"
+IUSE="debug doc +mysql readline +signer sqlite test ${PKCS11_IUSE}"
+
+RDEPEND="
+ dev-lang/perl
+ dev-libs/libxml2
+ dev-libs/libxslt
+ net-libs/ldns
+ mysql? (
+ virtual/mysql
+ dev-perl/DBD-mysql
+ )
+ opensc? ( dev-libs/opensc )
+ readline? ( sys-libs/readline:0 )
+ softhsm? ( dev-libs/softhsm:* )
+ sqlite? (
+ dev-db/sqlite:3
+ dev-perl/DBD-SQLite
+ )
+"
+DEPEND="${RDEPEND}
+ doc? ( app-doc/doxygen )
+ test? (
+ app-text/trang
+ )
+"
+
+REQUIRED_USE="
+ ^^ ( mysql sqlite )
+ ^^ ( softhsm opensc external-hsm )
+"
+
+PATCHES=(
+ "${FILESDIR}/${PN}-fix-localstatedir-2.0.x.patch"
+ "${FILESDIR}/${PN}-fix-run-dir-2.0.x.patch"
+ "${FILESDIR}/${PN}-drop-privileges-2.0.x.patch"
+ "${FILESDIR}/${PN}-use-system-trang.patch"
+)
+
+S="${WORKDIR}/${MY_P}"
+
+DOCS=( MIGRATION NEWS )
+
+check_pkcs11_setup() {
+ # PKCS#11 HSM's are often only available with proprietary drivers not
+ # available in portage tree.
+
+ if use softhsm; then
+ PKCS11_LIB=softhsm
+ if has_version ">=dev-libs/softhsm-1.3.1"; then
+ PKCS11_PATH=/usr/$(get_libdir)/softhsm/libsofthsm.so
+ else
+ PKCS11_PATH=/usr/$(get_libdir)/libsofthsm.so
+ fi
+ elog "Building with SoftHSM PKCS#11 library support."
+ fi
+ if use opensc; then
+ PKCS11_LIB=opensc
+ PKCS11_PATH=/usr/$(get_libdir)/opensc-pkcs11.so
+ elog "Building with OpenSC PKCS#11 library support."
+ fi
+ if use external-hsm; then
+ if [[ -n ${PKCS11_SCA6000} ]]; then
+ PKCS11_LIB=sca6000
+ PKCS11_PATH=${PKCS11_SCA6000}
+ elif [[ -n ${PKCS11_ETOKEN} ]]; then
+ PKCS11_LIB=etoken
+ PKCS11_PATH=${PKCS11_ETOKEN}
+ elif [[ -n ${PKCS11_NCIPHER} ]]; then
+ PKCS11_LIB=ncipher
+ PKCS11_PATH=${PKCS11_NCIPHER}
+ elif [[ -n ${PKCS11_AEPKEYPER} ]]; then
+ PKCS11_LIB=aepkeyper
+ PKCS11_PATH=${PKCS11_AEPKEYPER}
+ else
+ ewarn "You enabled USE flag 'external-hsm' but did not specify a path to a PKCS#11"
+ ewarn "library. To set a path, set one of the following environment variables:"
+ ewarn " for Sun Crypto Accelerator 6000, set: PKCS11_SCA6000=<path>"
+ ewarn " for Aladdin eToken, set: PKCS11_ETOKEN=<path>"
+ ewarn " for Thales/nCipher netHSM, set: PKCS11_NCIPHER=<path>"
+ ewarn " for AEP Keyper, set: PKCS11_AEPKEYPER=<path>"
+ ewarn "Example:"
+ ewarn " PKCS11_ETOKEN=\"/opt/etoken/lib/libeTPkcs11.so\" emerge -pv opendnssec"
+ ewarn "or store the variable into /etc/portage/make.conf"
+ die "USE flag 'external-hsm' set but no PKCS#11 library path specified."
+ fi
+ elog "Building with external PKCS#11 library support ($PKCS11_LIB): ${PKCS11_PATH}"
+ fi
+}
+
+pkg_pretend() {
+ if has_version "<net-dns/opendnssec-1.4.10"; then
+ ################################################################################
+ eerror "You are already using OpenDNSSEC."
+ eerror "In order to migrate to version >=2.0.0 you need to upgrade to"
+ eerror "version >=1.4.10 first:"
+ eerror ""
+ eerror " emerge \"<net-dns/opendnssec-2\""
+ eerror ""
+ eerror "See https://github.com/opendnssec/opendnssec/blob/2.0/master/MIGRATION"
+ eerror "for details."
+ eerror ""
+ die "Please upgrade to version >=1.4.10 first for proper db migraion"
+ fi
+
+ check_pkcs11_setup
+}
+
+pkg_setup() {
+ enewgroup opendnssec
+ enewuser opendnssec -1 -1 -1 opendnssec
+
+ # pretend does not preserve variables so we need to run this once more
+ check_pkcs11_setup
+}
+
+src_prepare() {
+ local patch
+ default
+ for patch in "${PATCHES[@]}"; do
+ epatch "$patch"
+ done
+ eautoreconf
+}
+
+src_configure() {
+ econf \
+ --without-cunit \
+ --localstatedir="${EPREFIX}/var" \
+ --disable-static \
+ --with-enforcer-database=$(use mysql && echo "mysql")$(use sqlite && echo "sqlite3") \
+ --with-pkcs11-${PKCS11_LIB}=${PKCS11_PATH} \
+ $(use_with readline) \
+ $(use_enable signer)
+}
+
+src_compile() {
+ default
+ use doc && emake docs
+}
+
+src_install() {
+ default
+
+ # remove useless .la files
+ find "${ED}" -name '*.la' -delete
+
+ # Remove subversion tags from config files to avoid useless config updates
+ sed -i \
+ -e '/<!-- \$Id:/ d' \
+ "${ED}"/etc/opendnssec/* || die
+
+ # install db update/migration stuff
+ insinto /usr/share/opendnssec/db
+ if use sqlite; then
+ doins enforcer/utils/convert_mysql_to_sqlite
+ fi
+ if use mysql; then
+ doins enforcer/utils/convert_sqlite_to_mysql
+ fi
+
+ insinto /usr/share/opendnssec/db/sql
+ if use sqlite; then
+ doins enforcer/src/db/schema.sqlite
+ fi
+ if use mysql; then
+ doins enforcer/src/db/schema.mysql
+ fi
+
+ insinto /usr/share/opendnssec/db/1.4-2.0_db_convert
+ doins enforcer/utils/1.4-2.0_db_convert/find_problematic_zones.sql
+ doins enforcer/utils/1.4-2.0_db_convert/README.md
+ if use sqlite; then
+ doins enforcer/utils/1.4-2.0_db_convert/sqlite_convert.sql
+ doins enforcer/utils/1.4-2.0_db_convert/convert_sqlite
+ fi
+ if use mysql; then
+ doins enforcer/utils/1.4-2.0_db_convert/convert_mysql
+ doins enforcer/utils/1.4-2.0_db_convert/mysql_convert.sql
+ fi
+
+ # patch scripts to find schema files
+ sed -i \
+ -e 's,^SCHEMA=../src/db/,SCHEMA=/usr/share/opendnssec/db/sql/,' \
+ -e 's,^SCHEMA=../../src/db/,SCHEMA=/usr/share/opendnssec/db/sql/,' \
+ "${ED}"/usr/share/opendnssec/db/convert_* \
+ "${ED}"/usr/share/opendnssec/db/1.4-2.0_db_convert/convert_*
+
+ # fix permissions
+ fowners root:opendnssec /etc/opendnssec
+ fowners root:opendnssec /etc/opendnssec/{addns,conf,kasp,zonelist}.xml
+ fowners opendnssec:opendnssec /var/lib/opendnssec/{,enforcer,signconf,signed,signer,unsigned}
+
+ # install conf/init script
+ newinitd "${FILESDIR}"/opendnssec.initd opendnssec
+ newconfd "${FILESDIR}"/opendnssec.confd opendnssec
+}
+
+pkg_postinst() {
+ local v
+ if use softhsm; then
+ elog "Please make sure that you create your softhsm database in a location writeable"
+ elog "by the opendnssec user. You can set its location in /etc/softhsm.conf."
+ elog "Suggested configuration is:"
+ elog " echo \"0:/var/lib/opendnssec/softhsm_slot0.db\" >> /etc/softhsm.conf"
+ elog " softhsm --init-token --slot 0 --label OpenDNSSEC"
+ elog " chown opendnssec:opendnssec /var/lib/opendnssec/softhsm_slot0.db"
+ fi
+ for v in $REPLACING_VERSIONS; do
+ case $v in
+ 1.4.*)
+ ewarn ""
+ ewarn "You are upgrading from version 1.4."
+ ewarn ""
+ ewarn "A migration is needed from 1.4 to 2.0."
+ ewarn "For details see /usr/share/doc/${P}/MIGRATION*"
+ ewarn ""
+ ewarn "For your convenience the mentioned migration scripts and README"
+ ewarn "have been installed to /usr/share/${PN}/db/1.4-2.0_db_convert"
+ ewarn ""
+ ;;
+ esac
+ done
+}