diff options
Diffstat (limited to 'net-dns/opendnssec')
21 files changed, 1624 insertions, 0 deletions
diff --git a/net-dns/opendnssec/Manifest b/net-dns/opendnssec/Manifest new file mode 100644 index 000000000000..b2f4ef27a586 --- /dev/null +++ b/net-dns/opendnssec/Manifest @@ -0,0 +1,27 @@ +AUX opendnssec-1.3.14-drop-privileges.patch 906 SHA256 faecb049748efab2652b890020106748039dbe7022d943393ac50b71b429b340 SHA512 cbc17153fcd617bcbc54a0b14111908635dae722f845f894d9c6769d77960433fa75c3ec0a5061af054167b4223f7f2946c3e3ba09c2bb55598f72f71d1c2106 WHIRLPOOL da7588424ce440bc302d8acacff2f702e623fe32682b1ddcd4674209f15dbcf8606ad35f59fc2d60e397d8618a7b59b1a56503b1b23a210f924e07dec51f6f16 +AUX opendnssec-1.3.14-use-system-trang.patch 706 SHA256 c704b8e232c950166131be6e70c7b48ff4f57800de7dae2a08012ef5d945f4c7 SHA512 e7d664f6ee548efeae7a015ceaf21b3fedc7654ed295ecd2440b0212015c1556b4f1bac978a2f804e7b6830181273484b428e1a363989eff067a9b3587937b7f WHIRLPOOL 92ffcd46ffaa6a7583114237a58bf634cf26445f3fe023be347f63bd88a0560371d7e89aa820e2fb7c6a6a971a4fee1bb281424baa6f6ce895c0db62d9d60146 +AUX opendnssec-1.3.18-eppclient-curl-CVE-2012-5582.patch 751 SHA256 5613a6de3b65eb1a3e0006e5e8d676d48789d23636d6b218d1ee2fbb5b69a3ae SHA512 f89fc43b96a76ed9af9ac4f28993037ee709d19e8cfeb53da2bdff2eb723c4200fe70aaac8b651998b9b6685343777316141dd0ee2ebc600f703d8dadca24d43 WHIRLPOOL e9790ebb811824f33443ca93429e59377239ac8f443c6eafe16250b68497877d4d0100ff734fd663f4dff697842fdf1b6803e80d4aab5c9cd2fb6260cae19448 +AUX opendnssec-drop-privileges-2.0.x.patch 813 SHA256 a961424707e048b62e31d0c73c516d93c537931f0d80f000a095eed1ba2e6635 SHA512 425eb123452183b4e4a3e87e9a71afa81684fe4af9c111d1bad3433ee640907cf3caa1065711f67286bb0336fd8d82e3f4bfeef94e3ff620bcbdaf960d4137b8 WHIRLPOOL 0c234dfefc3d9d26f399ed9b552a15b975c770b73f3452279cb41cbedb98ac188fcbecbb6e842c0a22f09f6bff2902fc2e0597d7b4974a8ab0a5c4ba856911bf +AUX opendnssec-drop-privileges.patch 641 SHA256 9bc831bf45a022a9be1a2bd6ee80d9e06fa4d5cdf553ae7dfd50e3a592e5b8dd SHA512 60cb666d821ae8880ccb789f8d2b60ea218a98e1b7b9393d8dc299be55efbd93efb9334ebf5cbf55f67ef1c58df1206dce906994bd9808e3db5a5bf9644a7f06 WHIRLPOOL 90f55f6572933e4c1042076aaa42a9cd19cd7e4c0e7a0598c8ae6cb22e0c7dcc6cd18fa408e2ed80eaadccefa39b4928c59e8bf0ae3398c948092828f9342ebf +AUX opendnssec-fix-localstatedir-2.0.x.patch 1161 SHA256 028de3256f5604472a0352fe2a9988f2eac51457cc05b4f3b794d021cc2aab8f SHA512 1d07f2108238c041041c96b4efaaec1e75740ed54fbd6390fa45f5ccf7f631c1e8d4400bb9cb95023c8909ae10abc3c93aaa137f954921af75825c06a6d94d9a WHIRLPOOL 5c5d1c035eee77af74cad6a7bec3f085300cdd446090640731430745e1cf6a0769c92de9d7e968e31dce165273ff6bb8400d07f02fc27fc90d383df3b84ea9a0 +AUX opendnssec-fix-localstatedir.patch 1693 SHA256 e9a29b3adf22ef6dd3a0ac43d2a48e2705ae09cd7550b4f3294b89dcd7814ecd SHA512 86700c97bb482f5fa6d99fe8f105c41e8798de542e6cf5fd4d6c14da11237e4fd11eccb2900de4893898d7855e31beb6572c709c2dad9774d5fe440673af2627 WHIRLPOOL 56c5e876e2e2832265474c3772a44efa288eb387438a6864d85956a990f9cedc81e60dc7922448d647702359e835c0fef7db1d6d5e643b195cd6ad26117c3f53 +AUX opendnssec-fix-run-dir-2.0.x.patch 1188 SHA256 c134ad1f6a6222ff5e52019ca5975697d68b55ab110801778ffb5053a5bb8853 SHA512 293c2ceb336623ed52028ca3144c4249eaf426dd2eb84890be9f1ed53e27d4ff5fd6a699d41426ca57d6362c2f83dd8b3556691da2815235f72e69ab4ef45165 WHIRLPOOL 293a0228a85988f4dd23ef4a16bb113fd2f23c3df35edc623996eebe09794b451a134066609b521ae5a50bccc2dca0c6ad7c7b26d970df600ee376554aa2cb30 +AUX opendnssec-fix-run-dir.patch 1204 SHA256 bc9736e424dcc739988d78b8842a44261a71a2e7073bfbd53b985db121f9f3b6 SHA512 f604ab24731bd84498f33dc3213b937335e55f805d4913e80b037b91cc5bf14f406cb2af14cc455a9a23c45a3475ef1b3901c68760188d9e4a36d314d29f8f84 WHIRLPOOL 11d5963d69022ed6e03f0ebda74fd315a8bbd59ff086a7ae8c8dfd42e02062a34d7b888c2e7929af3a1214ddfa81f98ed0ff8aacbb4949bb652ebdac1f72ae08 +AUX opendnssec-use-system-trang.patch 614 SHA256 7e8485e0f8ff1df5f9f799b908c802cf3670ecfcff6e3bf858d69429638e86b4 SHA512 9e95943d145ce7a05e32af60a944c6ee6d74fdff0fa9f0ea233070b44567bce4f5ca6bde57411effa7bab192ec58face34cddf2c349ccff3b78fc66c1f35074d WHIRLPOOL 82282bc2fc7797ff946aee5cee6e182abde0b65283865a9b084613a0dba7e53762494197c7479a6324fc3c81c8c80acf9d0d8a898a183acfe6ab62cf2a6ed1e6 +AUX opendnssec.confd 393 SHA256 cfb0c2ba683878c9f1b99618776aea152679e95ae26ecf4337b63f1a9cf0006c SHA512 17bd24efef9bd6b7a907c75126809a6012db23a6c8547169c41dbc62fc91775331f445905282bc6c2ef13357f92eccab5008d4605419d98acdb723806b63a924 WHIRLPOOL e9eb636b8fc2016bdbdedf44e7625562b1c5f6ddcf60af87cdaf1ca6e74dfb4f08886f946e788005ed3c97667417cfed9fb2fb688ad1a40ce992913a7007c142 +AUX opendnssec.confd-1.3.x 477 SHA256 9db752afc06fe3cc76bf7d4195d74853db7ccce3993b5ccd896b07b37de84909 SHA512 e45cd05e9d972dce5254f333ce21fd599ed905e8009f67de636c3a72dcd49e43fb75f702e21665dd3f19602fb9a5be5b6ff34e147ac4e29844560cc4f65f727c WHIRLPOOL 14a56cc365cdcb201f48a4c42838bc82524a2e067f4aa2f49aeada2ae2757b9c7d3f3cb375993d2f2e48364c696438404b41d64abb9a2d773f9f82e77efc5bdc +AUX opendnssec.initd 1854 SHA256 9f200b6b2d1e2da1a161f3275992115788dd36a3eeffbaaece0d896b51cb445d SHA512 75bce27c152b55ba2ba7d0770c6f2149493ef4b145f2257328e7e4b6865ad2d644695a688c3e06be02705ac42752e031846551b80b560e19a73e595e5ad15def WHIRLPOOL 34cd2588877cd300628e5cb86e055ffc07e6682ba3ad448d83d3975e8d6802702e343437acbc187522c7a4b24672e0fff0dce4f9023908c8d9f1857e80078d3f +AUX opendnssec.initd-1.3.x 2873 SHA256 4060ab0ecca436c08551efa693819aa2b59e84dc2cff5b36d143cde56a37dcb3 SHA512 e824206169a625b3e9cd817489870ad422793f6142abf0878049d3c075efe8c9e5895802e0ff0c4d4f36775e31aad19346c3ba0a76572dc6a0106883d9b0968d WHIRLPOOL 39f302dd5c89134689b47ff81d73a4af816bd37a6ef5f453df9c023259701f9ad264da5d7c3af1f314800ecdc23788ee57eb872d65936725c402608f245cc9a8 +DIST opendnssec-1.3.18.tar.gz 1143889 SHA256 e61d23ae0cc57b6e09d408bade6872fe5241896c61a03e8bc5ceeb65df13a676 SHA512 5df39ba778c9b1245e88b81df7aa491bca0aad2943845284c4f8b4dd729fa69014d45f07bdf99a048ccf668a1c9675a8dd99efcec1abdbd4e06e9738fec6ab6d WHIRLPOOL 7213b8f2f86651114449bc4734452d6065960e26ee289051949ca27ae3b23280cea45ff707f71942eef91c9009200272c0985ef3d3de43c9343ad2e1e54303ce +DIST opendnssec-1.4.12.tar.gz 1036392 SHA256 4ba6cf06fcd1131c1ed913d61959ddc90726ed5e4f153c90f45ec64445528a0c SHA512 b72b76ab4aec8cc63cc9c020bef9a24b000fd00172a07cf43d57b3a33041bef9e107b71eb7271bb13c3566510599c6a1913cf986a724e169c42dc8bdac8d2e51 WHIRLPOOL f6b98b3f7522185383f1bac4b233bf725a24ba998fd09c61762de25baeb70ce3633909bc5ffe7f0ac9e83201adbe73c701e7a1892c059908ed17a75731d6335c +DIST opendnssec-1.4.8.2.tar.gz 1043171 SHA256 7fd553ee39173e807477ed1daff6ee2f8b1c83875cd2e52a1df3315bf0015513 SHA512 7f2e10b425f60947aca40c61509b07ddc4363105cc882b518ffa816437299d6f881411cb38325f27b3a34c2005953988b39c945362866dd0f1f7c6ef973bfa06 WHIRLPOOL 38079a89d8e3d039aeab28c80b7fb1a9739014736d6076442c546fae1b13e1c89faa1858beb6f4d2f495d19a2a1187a7af10c55c0ed33563bc9b2d57945de807 +DIST opendnssec-2.0.1.tar.gz 1101523 SHA256 bf874bbb346699a5b539699f90a54e0c15fff0574df7a3c118abb30938b7b346 SHA512 aa12818f92688e087acaff8a6771d2a7da733e04d9e821967d313c7ff880a1056f470b11988eba1e7aad606418c3a4587f654163d74f68e3f61943c74d86d052 WHIRLPOOL 865fbd0d21cd015e87da5f26858e39a233464fb04e56a21683b4713d3836b925eea80973446571da78730ef765d5a1a3fc5f8ad192dd09fdf6eb7467ae417769 +DIST opendnssec-2.0.3.tar.gz 1103355 SHA256 ebeb5481d696cf83c21c5dfbecce6ab5dcc73df1a08573ef257f2f6fe10f6214 SHA512 4745a9ac317cc65d6f5b14be640687efd5fde2149541f692fb607a458378d27e903f175023c1aa16a777d17cef9cc68f1a84e7e7cdb233466d26756721b34424 WHIRLPOOL 51389851b46b62ee1829dd2af5cb41edbe28484ff23dd9b281f77ee7966dd67aa743f1c8d869052bb0a598cf42ab850ad0d2f80343b26aaf551940bb9f0d3f41 +EBUILD opendnssec-1.3.18-r1.ebuild 5693 SHA256 b4f50fe2dc4698e1f1457391f6490dbbfbf67ba01a66031a5da9819af1d1d1b1 SHA512 6322f3c01ce746605249fe7a7e748b3d59017a2cda394f750eb3ce646923335a6659cf47a240bd5c07b179ba3219f8a650a610b898d3ead4d4b68c3f150bcc34 WHIRLPOOL a622c523e2f9332e784963d10ddc52043c15cf49f048a7d1529c7cd10dee81e703f06528b421aa60d01c18f57acfa2816ab249e4f40a65b64e057012fab2299f +EBUILD opendnssec-1.4.12-r1.ebuild 5780 SHA256 caf2d7b04e4d4a34ceb3552960c9541b5d6cd1e136fbd3c4f676e5541344db80 SHA512 3e0ac6197e86315794dd604de6adb605845c09f8a00958189f35d3432b748de2e2d8589c217035c4dd167971452026d56a6b2ca38db0af8d7eb18ad8f888237c WHIRLPOOL 9e25c65d9b5bd1751e30120e7d59f8ea26abf3e2b67749ae503a89e865f66c4f87d57dc8f0fe395a95353fb6f7ad266280244ef274c0f96537a1cdb34f4d4246 +EBUILD opendnssec-1.4.8.2.ebuild 5830 SHA256 36dfde77d4c65b0dfdac4be6a7db56f0b1eec21978e1de84efeb3f7e2564ca5e SHA512 d9cb344ca13a2a926f46e4dd041453132cb669d0ae23f4180dda38ca12fa41f6aa6187d7e9cf70ca8e36ec4266cd75569a36d928c9ab65800c68ecc11ec6da80 WHIRLPOOL 5001986e96040dae337df7d7728f4a50ee1c9e7b600f01e9d11570335073a18ec7999e4818e08fbb4c678ead18023104413b76406e48d1fa06a2216c7051ed58 +EBUILD opendnssec-2.0.1-r1.ebuild 6763 SHA256 4bff75c622d69ecc2e91b5f7672f09c77603c65a0572c799ceff744f6a84de9e SHA512 9398125ccf2e3bc05ffc8c87e9582374075cb89d079e3e01364134f6529f399fa7556afd1d489f43235a31f6e2c7e13726b6552ab59d757df761680668ad7102 WHIRLPOOL d2a85cd8266136c91407e5b8a81d8d8bac9b6dcee2357be408bb56f33c346bde0b9a1a5c035e0c02f481dd21afb5d8bf15f50d9bac280e67dbed5048321c9fe9 +EBUILD opendnssec-2.0.3.ebuild 6763 SHA256 4bff75c622d69ecc2e91b5f7672f09c77603c65a0572c799ceff744f6a84de9e SHA512 9398125ccf2e3bc05ffc8c87e9582374075cb89d079e3e01364134f6529f399fa7556afd1d489f43235a31f6e2c7e13726b6552ab59d757df761680668ad7102 WHIRLPOOL d2a85cd8266136c91407e5b8a81d8d8bac9b6dcee2357be408bb56f33c346bde0b9a1a5c035e0c02f481dd21afb5d8bf15f50d9bac280e67dbed5048321c9fe9 +MISC ChangeLog 5718 SHA256 22234d269386e8a717f4d196571001e23ccebe91b931da9b987365e63d9bbf8c SHA512 0c299644afd60dacc087e19b8530704a92cc2d65985e60689d177b39befc0fff243d2d674291c1509438d182faa71de590a364b6cc1aeeb5e4984937f8e4914a WHIRLPOOL 2eece09c7090ac503d0c7e55dce19e57caa5f00ef2ce066cabfc976f72c8f3fbba94104637e6d55be9ef506dc3e795250c81694cba5a977719a338c73afff72f +MISC ChangeLog-2015 8837 SHA256 0bbf10d947069650e591cbb4e9785d9a729f552fd9eb7c19ee1b4e2a02d5f6ba SHA512 5d5490b6c9ae8eea841df5c30a172d688fa95e8460059b2c2205ee169baa20147dc77523d6a9802dd321665031fb99f3ec7725381bd79c6c0040869c9cb0920a WHIRLPOOL db61e6216a86b07e6c7364087a4a511237d7b6a66741338c4749edbb4ab41cf15828e18e6eb43f4d6ff4d23a7ee2f435cd8e37223660d9068c66a0d78347e149 +MISC metadata.xml 906 SHA256 f68a7488c51564b1d622ddc75e61a3a8658c1c6e94356d96cb487adba8d846fa SHA512 9cddc6b15c7a959cb885bc639c19e166ee202dd4b45db50c9bbb3b61fe9e84311f023a3d34cfc44e689cf81df092211fa4cb88427fb143c113bdfc1e7897112e WHIRLPOOL 243f9f79db1553fced401bc2443b22fbb8bfba88e3e70dfb2ede16a27cad19e22c86ee8926389e25b5fd5dfff1b162ee1d74cc7d5f15fb799aa64e3614d10261 diff --git a/net-dns/opendnssec/files/opendnssec-1.3.14-drop-privileges.patch b/net-dns/opendnssec/files/opendnssec-1.3.14-drop-privileges.patch new file mode 100644 index 000000000000..7c9f72355d20 --- /dev/null +++ b/net-dns/opendnssec/files/opendnssec-1.3.14-drop-privileges.patch @@ -0,0 +1,43 @@ +Index: conf/conf.xml.in +=================================================================== +--- conf/conf.xml.in (revision 3022) ++++ conf/conf.xml.in (working copy) +@@ -38,12 +38,10 @@ + </Common> + + <Enforcer> +-<!-- + <Privileges> + <User>opendnssec</User> + <Group>opendnssec</Group> + </Privileges> +---> + + <Datastore><SQLite>@OPENDNSSEC_STATE_DIR@/kasp.db</SQLite></Datastore> + <Interval>PT3600S</Interval> +@@ -56,12 +54,10 @@ + </Enforcer> + + <Signer> +-<!-- + <Privileges> + <User>opendnssec</User> + <Group>opendnssec</Group> + </Privileges> +---> + + <WorkingDirectory>@OPENDNSSEC_STATE_DIR@/tmp</WorkingDirectory> + <WorkerThreads>8</WorkerThreads> +@@ -80,12 +76,10 @@ + </Signer> + + <Auditor> +-<!-- + <Privileges> + <User>opendnssec</User> + <Group>opendnssec</Group> + </Privileges> +---> + + <WorkingDirectory>@OPENDNSSEC_STATE_DIR@/tmp</WorkingDirectory> + </Auditor> diff --git a/net-dns/opendnssec/files/opendnssec-1.3.14-use-system-trang.patch b/net-dns/opendnssec/files/opendnssec-1.3.14-use-system-trang.patch new file mode 100644 index 000000000000..39678408264a --- /dev/null +++ b/net-dns/opendnssec/files/opendnssec-1.3.14-use-system-trang.patch @@ -0,0 +1,21 @@ +diff -urN opendnssec-1.3.0rc3.old/conf/Makefile.am opendnssec-1.3.0rc3/conf/Makefile.am +--- opendnssec-1.3.0rc3.old/conf/Makefile.am 2011-07-01 21:15:25.000000000 +0200 ++++ opendnssec-1.3.0rc3/conf/Makefile.am 2011-07-01 21:17:00.000000000 +0200 +@@ -7,7 +7,7 @@ + XML = conf.xml kasp.xml zonelist.xml signconf.xml zonefetch.xml + XSL= kasp2html.xsl + +-TRANG= $(srcdir)/trang/trang.jar ++TRANG= /usr/bin/trang + + sysconfdir = @sysconfdir@/opendnssec + datadir = @datadir@/opendnssec +@@ -25,7 +25,7 @@ + .rnc.rng: + @test -x "${JAVA}" || \ + (echo "java is required for converting RelaxNG Compact to RelaxNG"; false) +- ${JAVA} -jar ${TRANG} $< $@ ++ ${TRANG} $< $@ + + regress: $(RNG) + @test -x "${XMLLINT}" || \ diff --git a/net-dns/opendnssec/files/opendnssec-1.3.18-eppclient-curl-CVE-2012-5582.patch b/net-dns/opendnssec/files/opendnssec-1.3.18-eppclient-curl-CVE-2012-5582.patch new file mode 100644 index 000000000000..a0676dd091be --- /dev/null +++ b/net-dns/opendnssec/files/opendnssec-1.3.18-eppclient-curl-CVE-2012-5582.patch @@ -0,0 +1,12 @@ +diff -urN opendnssec-1.3.18.orig/plugins/eppclient/src/epp.c opendnssec-1.3.18/plugins/eppclient/src/epp.c +--- opendnssec-1.3.18.orig/plugins/eppclient/src/epp.c 2014-07-21 11:16:10.000000000 +0200 ++++ opendnssec-1.3.18/plugins/eppclient/src/epp.c 2016-03-23 22:25:18.679354984 +0100 +@@ -390,7 +390,7 @@ + curl_easy_setopt(curl, CURLOPT_URL, url); + curl_easy_setopt(curl, CURLOPT_CONNECT_ONLY, 1L); + curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 1L); +- curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 1L); ++ curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 2L); + curl_easy_setopt(curl, CURLOPT_USE_SSL, CURLUSESSL_ALL); + curl_easy_setopt(curl, CURLOPT_ERRORBUFFER, curlerr); + curl_easy_setopt(curl, CURLOPT_NOPROGRESS, 1L); diff --git a/net-dns/opendnssec/files/opendnssec-drop-privileges-2.0.x.patch b/net-dns/opendnssec/files/opendnssec-drop-privileges-2.0.x.patch new file mode 100644 index 000000000000..f3adc487dee9 --- /dev/null +++ b/net-dns/opendnssec/files/opendnssec-drop-privileges-2.0.x.patch @@ -0,0 +1,29 @@ +diff -ur opendnssec-2.0.1.orig/conf/conf.xml.in opendnssec-2.0.1/conf/conf.xml.in +--- opendnssec-2.0.1.orig/conf/conf.xml.in 2016-07-21 16:15:27.000000000 +0200 ++++ opendnssec-2.0.1/conf/conf.xml.in 2016-08-23 15:21:09.633384446 +0200 +@@ -36,12 +36,10 @@ + </Common> + + <Enforcer> +-<!-- + <Privileges> + <User>opendnssec</User> + <Group>opendnssec</Group> + </Privileges> +---> + + <Datastore><SQLite>@OPENDNSSEC_STATE_DIR@/kasp.db</SQLite></Datastore> + <!--The enforcer interval parameter is no long used in 2.0 and will be deprecated in 2.1 --> +@@ -60,12 +58,10 @@ + </Enforcer> + + <Signer> +-<!-- + <Privileges> + <User>opendnssec</User> + <Group>opendnssec</Group> + </Privileges> +---> + + <WorkingDirectory>@OPENDNSSEC_STATE_DIR@/signer</WorkingDirectory> + <WorkerThreads>4</WorkerThreads> diff --git a/net-dns/opendnssec/files/opendnssec-drop-privileges.patch b/net-dns/opendnssec/files/opendnssec-drop-privileges.patch new file mode 100644 index 000000000000..c1972bbc3d1b --- /dev/null +++ b/net-dns/opendnssec/files/opendnssec-drop-privileges.patch @@ -0,0 +1,28 @@ +--- conf/conf.xml.in.orig 2013-05-12 22:36:47.530988182 +0200 ++++ conf/conf.xml.in 2013-05-12 22:37:56.459817918 +0200 +@@ -38,12 +38,10 @@ + </Common> + + <Enforcer> +-<!-- + <Privileges> + <User>opendnssec</User> + <Group>opendnssec</Group> + </Privileges> +---> + <!-- NOTE: Enforcer worker threads are not used; this option is ignored --> + <!-- + <WorkerThreads>4</WorkerThreads> +@@ -60,12 +58,10 @@ + </Enforcer> + + <Signer> +-<!-- + <Privileges> + <User>opendnssec</User> + <Group>opendnssec</Group> + </Privileges> +---> + + <WorkingDirectory>@OPENDNSSEC_STATE_DIR@/tmp</WorkingDirectory> + <WorkerThreads>4</WorkerThreads> diff --git a/net-dns/opendnssec/files/opendnssec-fix-localstatedir-2.0.x.patch b/net-dns/opendnssec/files/opendnssec-fix-localstatedir-2.0.x.patch new file mode 100644 index 000000000000..5940c2f050e6 --- /dev/null +++ b/net-dns/opendnssec/files/opendnssec-fix-localstatedir-2.0.x.patch @@ -0,0 +1,22 @@ +diff -ur opendnssec-2.0.1.orig/Makefile.am opendnssec-2.0.1/Makefile.am +--- opendnssec-2.0.1.orig/Makefile.am 2016-07-21 16:15:00.000000000 +0200 ++++ opendnssec-2.0.1/Makefile.am 2016-08-23 14:01:50.618393034 +0200 +@@ -30,12 +30,12 @@ + + install-data-hook: + $(INSTALL) -d $(DESTDIR)$(localstatedir) +- $(INSTALL) -d $(DESTDIR)$(localstatedir)/opendnssec +- $(INSTALL) -d $(DESTDIR)$(localstatedir)/opendnssec/signer +- $(INSTALL) -d $(DESTDIR)$(localstatedir)/opendnssec/enforcer +- $(INSTALL) -d $(DESTDIR)$(localstatedir)/opendnssec/signconf +- $(INSTALL) -d $(DESTDIR)$(localstatedir)/opendnssec/unsigned +- $(INSTALL) -d $(DESTDIR)$(localstatedir)/opendnssec/signed ++ $(INSTALL) -d $(DESTDIR)$(localstatedir)/lib/opendnssec ++ $(INSTALL) -d $(DESTDIR)$(localstatedir)/lib/opendnssec/signer ++ $(INSTALL) -d $(DESTDIR)$(localstatedir)/lib/opendnssec/enforcer ++ $(INSTALL) -d $(DESTDIR)$(localstatedir)/lib/opendnssec/signconf ++ $(INSTALL) -d $(DESTDIR)$(localstatedir)/lib/opendnssec/unsigned ++ $(INSTALL) -d $(DESTDIR)$(localstatedir)/lib/opendnssec/signed + $(INSTALL) -d $(DESTDIR)$(localstatedir)/run + $(INSTALL) -d $(DESTDIR)$(localstatedir)/run/opendnssec + diff --git a/net-dns/opendnssec/files/opendnssec-fix-localstatedir.patch b/net-dns/opendnssec/files/opendnssec-fix-localstatedir.patch new file mode 100644 index 000000000000..3958c6c70ccf --- /dev/null +++ b/net-dns/opendnssec/files/opendnssec-fix-localstatedir.patch @@ -0,0 +1,32 @@ +diff -urN opendnssec-1.3.0rc2.old/Makefile.am opendnssec-1.3.0rc2/Makefile.am +--- opendnssec-1.3.0rc2.old/Makefile.am 2011-06-02 13:48:56.000000000 +0200 ++++ opendnssec-1.3.0rc2/Makefile.am 2011-06-02 13:49:19.000000000 +0200 +@@ -31,11 +31,11 @@ + + install-data-hook: + $(INSTALL) -d $(DESTDIR)$(localstatedir) +- $(INSTALL) -d $(DESTDIR)$(localstatedir)/opendnssec +- $(INSTALL) -d $(DESTDIR)$(localstatedir)/opendnssec/tmp +- $(INSTALL) -d $(DESTDIR)$(localstatedir)/opendnssec/signconf +- $(INSTALL) -d $(DESTDIR)$(localstatedir)/opendnssec/unsigned +- $(INSTALL) -d $(DESTDIR)$(localstatedir)/opendnssec/signed ++ $(INSTALL) -d $(DESTDIR)$(localstatedir)/lib/opendnssec ++ $(INSTALL) -d $(DESTDIR)$(localstatedir)/lib/opendnssec/tmp ++ $(INSTALL) -d $(DESTDIR)$(localstatedir)/lib/opendnssec/signconf ++ $(INSTALL) -d $(DESTDIR)$(localstatedir)/lib/opendnssec/unsigned ++ $(INSTALL) -d $(DESTDIR)$(localstatedir)/lib/opendnssec/signed + $(INSTALL) -d $(DESTDIR)$(localstatedir)/run + $(INSTALL) -d $(DESTDIR)$(localstatedir)/run/opendnssec + +diff -urN opendnssec-1.3.0rc2.old/m4/opendnssec_common.m4 opendnssec-1.3.0rc2/m4/opendnssec_common.m4 +--- opendnssec-1.3.0rc2.old/m4/opendnssec_common.m4 2011-06-02 13:48:56.000000000 +0200 ++++ opendnssec-1.3.0rc2/m4/opendnssec_common.m4 2011-06-02 13:49:36.000000000 +0200 +@@ -18,7 +18,7 @@ + OPENDNSSEC_LIBEXEC_DIR=$full_libexecdir/opendnssec + OPENDNSSEC_DATA_DIR=$full_datadir/opendnssec + OPENDNSSEC_SYSCONF_DIR=$full_sysconfdir/opendnssec +-OPENDNSSEC_LOCALSTATE_DIR="$full_localstatedir/opendnssec" ++OPENDNSSEC_LOCALSTATE_DIR="$full_localstatedir/lib/opendnssec" + OPENDNSSEC_PID_DIR="$full_localstatedir/run/opendnssec" + + AC_SUBST([OPENDNSSEC_BIN_DIR]) diff --git a/net-dns/opendnssec/files/opendnssec-fix-run-dir-2.0.x.patch b/net-dns/opendnssec/files/opendnssec-fix-run-dir-2.0.x.patch new file mode 100644 index 000000000000..5ea9c80f2ba7 --- /dev/null +++ b/net-dns/opendnssec/files/opendnssec-fix-run-dir-2.0.x.patch @@ -0,0 +1,24 @@ +diff -ur opendnssec-2.0.1.orig/m4/opendnssec_common.m4 opendnssec-2.0.1/m4/opendnssec_common.m4 +--- opendnssec-2.0.1.orig/m4/opendnssec_common.m4 2016-07-21 16:15:00.000000000 +0200 ++++ opendnssec-2.0.1/m4/opendnssec_common.m4 2016-08-23 14:42:35.033460972 +0200 +@@ -17,7 +17,7 @@ + OPENDNSSEC_DATA_DIR=$full_datadir/opendnssec + OPENDNSSEC_SYSCONF_DIR=$full_sysconfdir/opendnssec + OPENDNSSEC_LOCALSTATE_DIR="$full_localstatedir/opendnssec" +-OPENDNSSEC_PID_DIR="$full_localstatedir/run/opendnssec" ++OPENDNSSEC_PID_DIR="${destdir}/run/opendnssec" + + AC_SUBST([OPENDNSSEC_BIN_DIR]) + AC_SUBST([OPENDNSSEC_SBIN_DIR]) +diff -ur opendnssec-2.0.1.orig/Makefile.am opendnssec-2.0.1/Makefile.am +--- opendnssec-2.0.1.orig/Makefile.am 2016-08-23 14:40:10.009951791 +0200 ++++ opendnssec-2.0.1/Makefile.am 2016-08-23 14:43:20.377870776 +0200 +@@ -36,8 +36,6 @@ + $(INSTALL) -d $(DESTDIR)$(localstatedir)/lib/opendnssec/signconf + $(INSTALL) -d $(DESTDIR)$(localstatedir)/lib/opendnssec/unsigned + $(INSTALL) -d $(DESTDIR)$(localstatedir)/lib/opendnssec/signed +- $(INSTALL) -d $(DESTDIR)$(localstatedir)/run +- $(INSTALL) -d $(DESTDIR)$(localstatedir)/run/opendnssec + + docs: + (cd libhsm; $(MAKE) doxygen) diff --git a/net-dns/opendnssec/files/opendnssec-fix-run-dir.patch b/net-dns/opendnssec/files/opendnssec-fix-run-dir.patch new file mode 100644 index 000000000000..fe5b504344cf --- /dev/null +++ b/net-dns/opendnssec/files/opendnssec-fix-run-dir.patch @@ -0,0 +1,26 @@ +diff -ur opendnssec-1.3.12.orig/m4/opendnssec_common.m4 opendnssec-1.3.12/m4/opendnssec_common.m4 +--- opendnssec-1.3.12.orig/m4/opendnssec_common.m4 2013-01-31 13:46:01.122201232 +0100 ++++ opendnssec-1.3.12/m4/opendnssec_common.m4 2013-01-31 13:54:47.648861211 +0100 +@@ -19,7 +19,7 @@ + OPENDNSSEC_DATA_DIR=$full_datadir/opendnssec + OPENDNSSEC_SYSCONF_DIR=$full_sysconfdir/opendnssec + OPENDNSSEC_LOCALSTATE_DIR="$full_localstatedir/lib/opendnssec" +-OPENDNSSEC_PID_DIR="$full_localstatedir/run/opendnssec" ++OPENDNSSEC_PID_DIR="${destdir}/run/opendnssec" + + AC_SUBST([OPENDNSSEC_BIN_DIR]) + AC_SUBST([OPENDNSSEC_SBIN_DIR]) +diff -ur opendnssec-1.3.12.orig/Makefile.am opendnssec-1.3.12/Makefile.am +--- opendnssec-1.3.12.orig/Makefile.am 2013-01-31 13:46:01.122201232 +0100 ++++ opendnssec-1.3.12/Makefile.am 2013-01-31 13:47:08.569951675 +0100 +@@ -37,8 +37,8 @@ + $(INSTALL) -d $(DESTDIR)$(localstatedir)/lib/opendnssec/signconf + $(INSTALL) -d $(DESTDIR)$(localstatedir)/lib/opendnssec/unsigned + $(INSTALL) -d $(DESTDIR)$(localstatedir)/lib/opendnssec/signed +- $(INSTALL) -d $(DESTDIR)$(localstatedir)/run +- $(INSTALL) -d $(DESTDIR)$(localstatedir)/run/opendnssec ++ ++ + + docs: + (cd libhsm; $(MAKE) doxygen) diff --git a/net-dns/opendnssec/files/opendnssec-use-system-trang.patch b/net-dns/opendnssec/files/opendnssec-use-system-trang.patch new file mode 100644 index 000000000000..745b277e1339 --- /dev/null +++ b/net-dns/opendnssec/files/opendnssec-use-system-trang.patch @@ -0,0 +1,20 @@ +--- conf/Makefile.am.orig 2013-05-12 22:45:26.514768943 +0200 ++++ conf/Makefile.am 2013-05-12 22:46:33.399545628 +0200 +@@ -7,7 +7,7 @@ + XML = addns.xml conf.xml kasp.xml zonelist.xml signconf.xml enforcerstate.xml + XSL= kasp2html.xsl + +-TRANG= $(srcdir)/trang/trang.jar ++TRANG= /usr/bin/trang + TRANG_URL "https://code.google.com/p/jing-trang/" + + sysconfdir = @sysconfdir@/opendnssec +@@ -31,7 +31,7 @@ + .rnc.rng: + @test -x "${JAVA}" || \ + (echo "java is required for converting RelaxNG Compact to RelaxNG"; false) +- ${JAVA} -jar ${TRANG} $< $@ ++ ${TRANG} $< $@ + + regress: $(RNG) + @test -x "${XMLLINT}" || \ diff --git a/net-dns/opendnssec/files/opendnssec.confd b/net-dns/opendnssec/files/opendnssec.confd new file mode 100644 index 000000000000..a54fc2091273 --- /dev/null +++ b/net-dns/opendnssec/files/opendnssec.confd @@ -0,0 +1,11 @@ +# Copyright 1999-2013 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 + +# Variables containing default binaries used in the opendnssec +# initscript. You can alter them to another applications/paths +# if required. + +CHECKCONFIG_BIN=/usr/bin/ods-kaspcheck +CONTROL_BIN=/usr/sbin/ods-control +ENFORCER_BIN=/usr/sbin/ods-enforcerd +SIGNER_BIN=/usr/sbin/ods-signerd diff --git a/net-dns/opendnssec/files/opendnssec.confd-1.3.x b/net-dns/opendnssec/files/opendnssec.confd-1.3.x new file mode 100644 index 000000000000..63121af7f0ca --- /dev/null +++ b/net-dns/opendnssec/files/opendnssec.confd-1.3.x @@ -0,0 +1,13 @@ +# Copyright 1999-2013 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 + +# Variables containing default binaries used in the opendnssec +# initscript. You can alter them to another applications/paths +# if required. + +CHECKCONFIG_BIN=/usr/bin/ods-kaspcheck +CONTROL_BIN=/usr/sbin/ods-control +ENFORCER_BIN=/usr/sbin/ods-enforcerd +SIGNER_BIN=/usr/sbin/ods-signerd +EPPCLIENT_BIN=/usr/sbin/eppclientd +EPPCLIENT_PIDFILE=/run/opendnssec/eppclientd.pid diff --git a/net-dns/opendnssec/files/opendnssec.initd b/net-dns/opendnssec/files/opendnssec.initd new file mode 100644 index 000000000000..39757d142f2d --- /dev/null +++ b/net-dns/opendnssec/files/opendnssec.initd @@ -0,0 +1,85 @@ +#!/sbin/openrc-run +# Copyright 1999-2014 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 + +description="An open-source turn-key solution for DNSSEC" + +depend() { + use logger +} + +checkconfig() { + if [ -x "${CHECKCONFIG_BIN}" ]; then + output=$(${CHECKCONFIG_BIN} 2>&1| grep -v -E "^/etc/opendnssec/(conf|kasp).xml validates") + if [ -n "$output" ]; then + echo $output + fi + + errors=$(echo $output | grep ERROR | wc -l) + if [ $errors -gt 0 ]; then + ewarn "$errors error(s) found in OpenDNSSEC configuration." + fi + return $errors + fi + eerror "Unable to execute ${CHECKCONFIG_BIN:-config binary}" + # can't validate config, just die + return 1 +} + + +start_enforcer() { + if [ -n "${ENFORCER_BIN}" ] && [ -x "${ENFORCER_BIN}" ]; then + ebegin "Starting OpenDNSSEC Enforcer" + ${CONTROL_BIN} enforcer start > /dev/null + eend $? + else + if [ -n "${ENFORCER_BIN}" ]; then + eerror "OpenDNSSEC Enforcer binary not executable" + return 1 + fi + einfo "OpenDNSSEC Enforcer not used." + fi +} + +stop_enforcer() { + if [ -x "${ENFORCER_BIN}" ]; then + ebegin "Stopping OpenDNSSEC Enforcer" + ${CONTROL_BIN} enforcer stop > /dev/null + eend $? + fi +} + +start_signer() { + if [ -n "${SIGNER_BIN}" ] && [ -x "${SIGNER_BIN}" ]; then + ebegin "Starting OpenDNSSEC Signer" + ${CONTROL_BIN} signer start > /dev/null 2>&1 + eend $? + else + if [ -n "${SIGNER_BIN}" ]; then + eerror "OpenDNSSEC Signer binary not executable" + return 1 + fi + einfo "OpenDNSSEC Signer not used." + fi +} + +stop_signer() { + if [ -x "${SIGNER_BIN}" ]; then + ebegin "Stopping OpenDNSSEC Signer" + ${CONTROL_BIN} signer stop > /dev/null 2>&1 + eend $? + fi +} + +start() { + checkconfig || return $? + checkpath -d -m 0755 -o opendnssec:opendnssec /run/opendnssec + start_enforcer || return $? + start_signer || return $? +} + +stop() { + stop_signer + stop_enforcer + sleep 5 +} diff --git a/net-dns/opendnssec/files/opendnssec.initd-1.3.x b/net-dns/opendnssec/files/opendnssec.initd-1.3.x new file mode 100644 index 000000000000..9f4adbd184a9 --- /dev/null +++ b/net-dns/opendnssec/files/opendnssec.initd-1.3.x @@ -0,0 +1,123 @@ +#!/sbin/openrc-run +# Copyright 1999-2014 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 + +description="An open-source turn-key solution for DNSSEC" + +depend() { + use logger +} + +checkconfig() { + if [ -z "${CHECKCONFIG_BIN}" ]; then + # no config checker configured, skip config check + return 0 + fi + if [ -x "${CHECKCONFIG_BIN}" ]; then + output=$(${CHECKCONFIG_BIN} 2>&1| grep -v -E "^/etc/opendnssec/(conf|kasp).xml validates") + if [ -n "$output" ]; then + echo $output + fi + + errors=$(echo $output | grep ERROR | wc -l) + if [ $errors -gt 0 ]; then + ewarn "$errors error(s) found in OpenDNSSEC configuration." + fi + return $errors + fi + eerror "Unable to execute ${CHECKCONFIG_BIN:-config binary}" + # can't validate config, just die + return 1 +} + +start_enforcer() { + if [ -n "${ENFORCER_BIN}" ] && [ -x "${ENFORCER_BIN}" ]; then + ebegin "Starting OpenDNSSEC Enforcer" + ${CONTROL_BIN} enforcer start > /dev/null + eend $? + else + if [ -n "${ENFORCER_BIN}" ]; then + eerror "OpenDNSSEC Enforcer binary not executable" + return 1 + fi + einfo "OpenDNSSEC Enforcer not used." + fi +} + +stop_enforcer() { + if [ -x "${ENFORCER_BIN}" ]; then + ebegin "Stopping OpenDNSSEC Enforcer" + ${CONTROL_BIN} enforcer stop > /dev/null + eend $? + fi +} + +start_signer() { + if [ -n "${SIGNER_BIN}" ] && [ -x "${SIGNER_BIN}" ]; then + ebegin "Starting OpenDNSSEC Signer" + ${CONTROL_BIN} signer start > /dev/null 2>&1 + eend $? + else + if [ -n "${SIGNER_BIN}" ]; then + eerror "OpenDNSSEC Signer binary not executable" + return 1 + fi + einfo "OpenDNSSEC Signer not used." + fi +} + +stop_signer() { + if [ -x "${SIGNER_BIN}" ]; then + ebegin "Stopping OpenDNSSEC Signer" + ${CONTROL_BIN} signer stop > /dev/null 2>&1 + eend $? + fi +} + +start_eppclient() { + if [ -n "${EPPCLIENT_BIN}" ] && [ -x "${EPPCLIENT_BIN}" ]; then + ebegin "Starting OpenDNSSEC Eppclient" + start-stop-daemon \ + --start \ + --user opendnssec --group opendnssec \ + --exec "${EPPCLIENT_BIN}" \ + --pidfile "${EPPCLIENT_PIDFILE}" > /dev/null + eend $? + else + # eppclient is ofptional so if we use the default binary and it + # is not used we won't die + if [ -n "${EPPCLIENT_BIN}" ] && \ + [ "${EPPCLIENT_BIN}" != "/usr/sbin/eppclientd" ]; then + eerror "OpenDNSSEC Eppclient binary not executable" + return 1 + fi + einfo "OpenDNSSEC Eppclient not used." + fi +} + +stop_eppclient() { + if [ -x "${EPPCLIENT_BIN}" ]; then + ebegin "Stopping OpenDNSSEC Eppclient" + start-stop-daemon \ + --stop \ + --exec "${EPPCLIENT_BIN}" \ + --pidfile "${EPPCLIENT_PIDFILE}" > /dev/null + eend $? + fi +} + +start() { + checkconfig || return $? + test -d /run/opendnssec || mkdir -p /run/opendnssec + chown opendnssec:opendnssec /run/opendnssec + start_enforcer || return $? + start_signer || return $? + start_eppclient || return $? +} + +stop() { + stop_eppclient + stop_signer + stop_enforcer + sleep 5 +} diff --git a/net-dns/opendnssec/metadata.xml b/net-dns/opendnssec/metadata.xml new file mode 100644 index 000000000000..f81a154f2ecf --- /dev/null +++ b/net-dns/opendnssec/metadata.xml @@ -0,0 +1,15 @@ +<?xml version="1.0" encoding="UTF-8"?> +<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd"> +<pkgmetadata> + <maintainer type="person"> + <email>mschiff@gentoo.org</email> + </maintainer> + <use> + <flag name="auditor">Enables auditing capabilities for OpenDNSSEC</flag> + <flag name="eppclient">Enables support for automatic submission of DNSSEC keys to an upstream epp server</flag> + <flag name="signer">Enables signing capabilities for OpenDNSSEC</flag> + <flag name="opensc">Enables support for storing DNSSEC keys through a <pkg>dev-libs/opensc</pkg> PKCS#11 interface</flag> + <flag name="softhsm">Enables support for storing DNSSEC keys in a <pkg>dev-libs/softhsm</pkg> PKCS#11 object</flag> + <flag name="external-hsm">Enables support for storing DNSSEC keys through an arbitrary non-portage PKCS#11 interface, specified through an environment variable</flag> + </use> +</pkgmetadata> diff --git a/net-dns/opendnssec/opendnssec-1.3.18-r1.ebuild b/net-dns/opendnssec/opendnssec-1.3.18-r1.ebuild new file mode 100644 index 000000000000..d4bfd0296b7c --- /dev/null +++ b/net-dns/opendnssec/opendnssec-1.3.18-r1.ebuild @@ -0,0 +1,203 @@ +# Copyright 1999-2017 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 + +EAPI=5 + +MY_P="${P/_}" +PKCS11_IUSE="+softhsm opensc external-hsm" +inherit autotools multilib user + +DESCRIPTION="An open-source turn-key solution for DNSSEC" +HOMEPAGE="http://www.opendnssec.org/" +SRC_URI="http://www.${PN}.org/files/source/${MY_P}.tar.gz" + +LICENSE="BSD GPL-2" +SLOT="0" +KEYWORDS="~amd64 ~x86" +IUSE="-auditor +curl debug doc eppclient mysql +signer +sqlite test ${PKCS11_IUSE}" + +RDEPEND=" + dev-lang/perl + dev-libs/libxml2 + dev-libs/libxslt + net-libs/ldns + curl? ( net-misc/curl ) + mysql? ( + virtual/mysql + dev-perl/DBD-mysql + ) + opensc? ( dev-libs/opensc ) + softhsm? ( dev-libs/softhsm:* ) + sqlite? ( + dev-db/sqlite:3 + dev-perl/DBD-SQLite + ) +" +DEPEND="${RDEPEND} + doc? ( app-doc/doxygen ) + test? ( + app-text/trang + ) +" +# test? dev-util/cunit # Requires running test DB + +REQUIRED_USE=" + ^^ ( mysql sqlite ) + ^^ ( softhsm opensc external-hsm ) + eppclient? ( curl ) +" + +PATCHES=( + "${FILESDIR}/${PN}-fix-localstatedir.patch" + "${FILESDIR}/${PN}-fix-run-dir.patch" + "${FILESDIR}/${PN}-1.3.14-drop-privileges.patch" + "${FILESDIR}/${PN}-1.3.14-use-system-trang.patch" + "${FILESDIR}/${PN}-1.3.18-eppclient-curl-CVE-2012-5582.patch" +) + +S="${WORKDIR}/${MY_P}" + +DOCS=( MIGRATION NEWS ) + +check_pkcs11_setup() { + # PKCS#11 HSM's are often only available with proprietary drivers not + # available in portage tree. + + if use softhsm; then + PKCS11_LIB=softhsm + if has_version ">=dev-libs/softhsm-1.3.1"; then + PKCS11_PATH=/usr/$(get_libdir)/softhsm/libsofthsm.so + else + PKCS11_PATH=/usr/$(get_libdir)/libsofthsm.so + fi + elog "Building with SoftHSM PKCS#11 library support." + fi + if use opensc; then + PKCS11_LIB=opensc + PKCS11_PATH=/usr/$(get_libdir)/opensc-pkcs11.so + elog "Building with OpenSC PKCS#11 library support." + fi + if use external-hsm; then + if [[ -n ${PKCS11_SCA6000} ]]; then + PKCS11_LIB=sca6000 + PKCS11_PATH=${PKCS11_SCA6000} + elif [[ -n ${PKCS11_ETOKEN} ]]; then + PKCS11_LIB=etoken + PKCS11_PATH=${PKCS11_ETOKEN} + elif [[ -n ${PKCS11_NCIPHER} ]]; then + PKCS11_LIB=ncipher + PKCS11_PATH=${PKCS11_NCIPHER} + elif [[ -n ${PKCS11_AEPKEYPER} ]]; then + PKCS11_LIB=aepkeyper + PKCS11_PATH=${PKCS11_AEPKEYPER} + else + ewarn "You enabled USE flag 'external-hsm' but did not specify a path to a PKCS#11" + ewarn "library. To set a path, set one of the following environment variables:" + ewarn " for Sun Crypto Accelerator 6000, set: PKCS11_SCA6000=<path>" + ewarn " for Aladdin eToken, set: PKCS11_ETOKEN=<path>" + ewarn " for Thales/nCipher netHSM, set: PKCS11_NCIPHER=<path>" + ewarn " for AEP Keyper, set: PKCS11_AEPKEYPER=<path>" + ewarn "Example:" + ewarn " PKCS11_ETOKEN=\"/opt/etoken/lib/libeTPkcs11.so\" emerge -pv opendnssec" + ewarn "or store the variable into /etc/portage/make.conf" + die "USE flag 'external-hsm' set but no PKCS#11 library path specified." + fi + elog "Building with external PKCS#11 library support ($PKCS11_LIB): ${PKCS11_PATH}" + fi +} + +pkg_pretend() { + local i + + for i in eppclient mysql; do + if use ${i}; then + ewarn + ewarn "Usage of ${i} is considered experimental." + ewarn "Do not report bugs against this feature." + ewarn + fi + done + + check_pkcs11_setup +} + +pkg_setup() { + enewgroup opendnssec + enewuser opendnssec -1 -1 -1 opendnssec + + # pretend does not preserve variables so we need to run this once more + check_pkcs11_setup +} + +src_prepare() { + base_src_prepare + eautoreconf +} + +src_configure() { + # $(use_with test cunit "${EPREFIX}/usr/") \ + econf \ + --without-cunit \ + --localstatedir="${EPREFIX}/var/" \ + --disable-static \ + --with-database-backend=$(use mysql && echo "mysql")$(use sqlite && echo "sqlite3") \ + --with-pkcs11-${PKCS11_LIB}=${PKCS11_PATH} \ + --disable-auditor \ + $(use_with curl) \ + $(use_enable debug timeshift) \ + $(use_enable eppclient) \ + $(use_enable signer) +} + +src_compile() { + default + use doc && emake docs +} + +src_install() { + default + + # remove useless .la files + find "${ED}" -name '*.la' -delete + + # Remove subversion tags from config files to avoid useless config updates + sed -i \ + -e '/<!-- \$Id:/ d' \ + "${ED}"/etc/opendnssec/* || die + + # install update scripts + insinto /usr/share/opendnssec + use sqlite && doins enforcer/utils/migrate_keyshare_sqlite3.pl + use mysql && doins enforcer/utils/migrate_keyshare_mysql.pl + + # fix permissions + fowners root:opendnssec /etc/opendnssec + fowners root:opendnssec /etc/opendnssec/{conf,kasp,zonelist,zonefetch}.xml + use eppclient && fowners root:opendnssec /etc/opendnssec/eppclientd.conf + + fowners opendnssec:opendnssec /var/lib/opendnssec/{,signconf,unsigned,signed,tmp} + + # install conf/init script + newinitd "${FILESDIR}"/opendnssec.initd-1.3.x opendnssec + newconfd "${FILESDIR}"/opendnssec.confd-1.3.x opendnssec + use auditor || sed -i 's/^CHECKCONFIG_BIN=.*/CHECKCONFIG_BIN=/' "${D}"/etc/conf.d/opendnssec +} + +pkg_postinst() { + if use softhsm; then + elog "Please make sure that you create your softhsm database in a location writeable" + elog "by the opendnssec user. You can set its location in /etc/softhsm.conf." + elog "Suggested configuration is:" + elog " echo \"0:/var/lib/opendnssec/softhsm_slot0.db\" >> /etc/softhsm.conf" + elog " softhsm --init-token --slot 0 --label OpenDNSSEC" + elog " chown opendnssec:opendnssec /var/lib/opendnssec/softhsm_slot0.db" + fi + if use auditor; then + ewarn + ewarn "Please note that auditor support has been disabled in this version since it" + ewarn "it depends on ruby 1.8 which has been removed from the portage tree." + ewarn "USE=auditor is only provided for this warning but will not install the" + ewarn "auditor anymore." + ewarn + fi +} diff --git a/net-dns/opendnssec/opendnssec-1.4.12-r1.ebuild b/net-dns/opendnssec/opendnssec-1.4.12-r1.ebuild new file mode 100644 index 000000000000..68d85cf8be58 --- /dev/null +++ b/net-dns/opendnssec/opendnssec-1.4.12-r1.ebuild @@ -0,0 +1,207 @@ +# Copyright 1999-2017 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 + +EAPI=5 + +MY_P="${P/_}" +PKCS11_IUSE="+softhsm opensc external-hsm" +inherit autotools eutils multilib user + +DESCRIPTION="An open-source turn-key solution for DNSSEC" +HOMEPAGE="http://www.opendnssec.org/" +SRC_URI="http://www.${PN}.org/files/source/${MY_P}.tar.gz" + +LICENSE="BSD GPL-2" +SLOT="0" +KEYWORDS="~amd64 ~x86" +IUSE="debug doc +mysql +signer sqlite test ${PKCS11_IUSE}" + +RDEPEND=" + dev-lang/perl + dev-libs/libxml2 + dev-libs/libxslt + net-libs/ldns + mysql? ( + virtual/mysql + dev-perl/DBD-mysql + ) + opensc? ( dev-libs/opensc ) + softhsm? ( dev-libs/softhsm:* ) + sqlite? ( + dev-db/sqlite:3 + dev-perl/DBD-SQLite + ) +" +DEPEND="${RDEPEND} + doc? ( app-doc/doxygen ) + test? ( + app-text/trang + ) +" + +REQUIRED_USE=" + ^^ ( mysql sqlite ) + ^^ ( softhsm opensc external-hsm ) +" + +PATCHES=( + "${FILESDIR}/${PN}-fix-localstatedir.patch" + "${FILESDIR}/${PN}-fix-run-dir.patch" + "${FILESDIR}/${PN}-drop-privileges.patch" + "${FILESDIR}/${PN}-use-system-trang.patch" +) + +S="${WORKDIR}/${MY_P}" + +DOCS=( MIGRATION NEWS ) + +check_pkcs11_setup() { + # PKCS#11 HSM's are often only available with proprietary drivers not + # available in portage tree. + + if use softhsm; then + PKCS11_LIB=softhsm + if has_version ">=dev-libs/softhsm-1.3.1"; then + PKCS11_PATH=/usr/$(get_libdir)/softhsm/libsofthsm.so + else + PKCS11_PATH=/usr/$(get_libdir)/libsofthsm.so + fi + elog "Building with SoftHSM PKCS#11 library support." + fi + if use opensc; then + PKCS11_LIB=opensc + PKCS11_PATH=/usr/$(get_libdir)/opensc-pkcs11.so + elog "Building with OpenSC PKCS#11 library support." + fi + if use external-hsm; then + if [[ -n ${PKCS11_SCA6000} ]]; then + PKCS11_LIB=sca6000 + PKCS11_PATH=${PKCS11_SCA6000} + elif [[ -n ${PKCS11_ETOKEN} ]]; then + PKCS11_LIB=etoken + PKCS11_PATH=${PKCS11_ETOKEN} + elif [[ -n ${PKCS11_NCIPHER} ]]; then + PKCS11_LIB=ncipher + PKCS11_PATH=${PKCS11_NCIPHER} + elif [[ -n ${PKCS11_AEPKEYPER} ]]; then + PKCS11_LIB=aepkeyper + PKCS11_PATH=${PKCS11_AEPKEYPER} + else + ewarn "You enabled USE flag 'external-hsm' but did not specify a path to a PKCS#11" + ewarn "library. To set a path, set one of the following environment variables:" + ewarn " for Sun Crypto Accelerator 6000, set: PKCS11_SCA6000=<path>" + ewarn " for Aladdin eToken, set: PKCS11_ETOKEN=<path>" + ewarn " for Thales/nCipher netHSM, set: PKCS11_NCIPHER=<path>" + ewarn " for AEP Keyper, set: PKCS11_AEPKEYPER=<path>" + ewarn "Example:" + ewarn " PKCS11_ETOKEN=\"/opt/etoken/lib/libeTPkcs11.so\" emerge -pv opendnssec" + ewarn "or store the variable into /etc/portage/make.conf" + die "USE flag 'external-hsm' set but no PKCS#11 library path specified." + fi + elog "Building with external PKCS#11 library support ($PKCS11_LIB): ${PKCS11_PATH}" + fi +} + +pkg_pretend() { + check_pkcs11_setup +} + +pkg_setup() { + enewgroup opendnssec + enewuser opendnssec -1 -1 -1 opendnssec + + # pretend does not preserve variables so we need to run this once more + check_pkcs11_setup +} + +src_prepare() { + local patch + default + for patch in "${PATCHES[@]}"; do + epatch "$patch" + done + eautoreconf +} + +src_configure() { + econf \ + --without-cunit \ + --localstatedir="${EPREFIX}/var/" \ + --disable-static \ + --with-database-backend=$(use mysql && echo "mysql")$(use sqlite && echo "sqlite3") \ + --with-pkcs11-${PKCS11_LIB}=${PKCS11_PATH} \ + $(use_enable debug timeshift) \ + $(use_enable signer) +} + +src_compile() { + default + use doc && emake docs +} + +src_install() { + default + + # remove useless .la files + find "${ED}" -name '*.la' -delete + + # Remove subversion tags from config files to avoid useless config updates + sed -i \ + -e '/<!-- \$Id:/ d' \ + "${ED}"/etc/opendnssec/* || die + + # install update scripts + insinto /usr/share/opendnssec + if use sqlite; then + doins enforcer/utils/migrate_*sqlite* + fi + if use mysql; then + doins enforcer/utils/migrate_*mysql* + fi + + # fix permissions + fowners root:opendnssec /etc/opendnssec + fowners root:opendnssec /etc/opendnssec/{addns,conf,kasp,zonelist}.xml + fowners opendnssec:opendnssec /var/lib/opendnssec/{,signconf,unsigned,signed,tmp} + + # install conf/init script + newinitd "${FILESDIR}"/opendnssec.initd opendnssec + newconfd "${FILESDIR}"/opendnssec.confd opendnssec +} + +pkg_postinst() { + local v + if use softhsm; then + elog "Please make sure that you create your softhsm database in a location writeable" + elog "by the opendnssec user. You can set its location in /etc/softhsm.conf." + elog "Suggested configuration is:" + elog " echo \"0:/var/lib/opendnssec/softhsm_slot0.db\" >> /etc/softhsm.conf" + elog " softhsm --init-token --slot 0 --label OpenDNSSEC" + elog " chown opendnssec:opendnssec /var/lib/opendnssec/softhsm_slot0.db" + fi + + for v in $REPLACING_VERSIONS; do + case $v in + 1.3.*) + ewarn "" + ewarn "You are upgrading from version 1.3." + ewarn "" + ewarn "Please be aware of the following:" + ewarn " * OpenDNSSEC now supports both input and output adapters for" + ewarn " AXFR and IXFR in addition to file transfer." + ewarn " -> The zonefetch.xml file has been replaced by addns.xml" + ewarn " to support this enhancement." + ewarn " -> changes to the KASP database mean that a database" + ewarn " migration is required to upgrade to 1.4 from earlier" + ewarn " versions of OpenDNSSEC." + ewarn " * The auditor is no longer supported." + ewarn "" + ewarn "You can find more information here:" + ewarn " * /usr/share/doc/opendnssec*/MIGRATION*" + ewarn " * https://wiki.opendnssec.org/display/DOCS/Migrating+zone+fetcher+to+DNS+adapters" + ewarn " * https://wiki.opendnssec.org/display/DOCS/Migrating+from+earlier+versions+of+OpenDNSSEC" + ewarn "" + ;; + esac + done +} diff --git a/net-dns/opendnssec/opendnssec-1.4.8.2.ebuild b/net-dns/opendnssec/opendnssec-1.4.8.2.ebuild new file mode 100644 index 000000000000..c83f258bb104 --- /dev/null +++ b/net-dns/opendnssec/opendnssec-1.4.8.2.ebuild @@ -0,0 +1,205 @@ +# Copyright 1999-2017 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 + +EAPI=5 + +MY_P="${P/_}" +PKCS11_IUSE="+softhsm opensc external-hsm" +inherit autotools multilib user + +DESCRIPTION="An open-source turn-key solution for DNSSEC" +HOMEPAGE="http://www.opendnssec.org/" +SRC_URI="http://www.${PN}.org/files/source/${MY_P}.tar.gz" + +LICENSE="BSD GPL-2" +SLOT="0" +KEYWORDS="~amd64 ~x86" +IUSE="debug doc +mysql +signer sqlite test ${PKCS11_IUSE}" + +RDEPEND=" + dev-lang/perl + dev-libs/libxml2 + dev-libs/libxslt + net-libs/ldns + mysql? ( + virtual/mysql + dev-perl/DBD-mysql + ) + opensc? ( dev-libs/opensc ) + softhsm? ( dev-libs/softhsm:* ) + sqlite? ( + dev-db/sqlite:3 + dev-perl/DBD-SQLite + ) +" +DEPEND="${RDEPEND} + doc? ( app-doc/doxygen ) + test? ( + app-text/trang + ) +" + +REQUIRED_USE=" + ^^ ( mysql sqlite ) + ^^ ( softhsm opensc external-hsm ) +" + +PATCHES=( + "${FILESDIR}/${PN}-fix-localstatedir.patch" + "${FILESDIR}/${PN}-fix-run-dir.patch" + "${FILESDIR}/${PN}-drop-privileges.patch" + "${FILESDIR}/${PN}-use-system-trang.patch" +) + +S="${WORKDIR}/${MY_P}" + +DOCS=( MIGRATION NEWS ) + +check_pkcs11_setup() { + # PKCS#11 HSM's are often only available with proprietary drivers not + # available in portage tree. + + if use softhsm; then + PKCS11_LIB=softhsm + if has_version ">=dev-libs/softhsm-1.3.1"; then + PKCS11_PATH=/usr/$(get_libdir)/softhsm/libsofthsm.so + else + PKCS11_PATH=/usr/$(get_libdir)/libsofthsm.so + fi + elog "Building with SoftHSM PKCS#11 library support." + fi + if use opensc; then + PKCS11_LIB=opensc + PKCS11_PATH=/usr/$(get_libdir)/opensc-pkcs11.so + elog "Building with OpenSC PKCS#11 library support." + fi + if use external-hsm; then + if [[ -n ${PKCS11_SCA6000} ]]; then + PKCS11_LIB=sca6000 + PKCS11_PATH=${PKCS11_SCA6000} + elif [[ -n ${PKCS11_ETOKEN} ]]; then + PKCS11_LIB=etoken + PKCS11_PATH=${PKCS11_ETOKEN} + elif [[ -n ${PKCS11_NCIPHER} ]]; then + PKCS11_LIB=ncipher + PKCS11_PATH=${PKCS11_NCIPHER} + elif [[ -n ${PKCS11_AEPKEYPER} ]]; then + PKCS11_LIB=aepkeyper + PKCS11_PATH=${PKCS11_AEPKEYPER} + else + ewarn "You enabled USE flag 'external-hsm' but did not specify a path to a PKCS#11" + ewarn "library. To set a path, set one of the following environment variables:" + ewarn " for Sun Crypto Accelerator 6000, set: PKCS11_SCA6000=<path>" + ewarn " for Aladdin eToken, set: PKCS11_ETOKEN=<path>" + ewarn " for Thales/nCipher netHSM, set: PKCS11_NCIPHER=<path>" + ewarn " for AEP Keyper, set: PKCS11_AEPKEYPER=<path>" + ewarn "Example:" + ewarn " PKCS11_ETOKEN=\"/opt/etoken/lib/libeTPkcs11.so\" emerge -pv opendnssec" + ewarn "or store the variable into /etc/portage/make.conf" + die "USE flag 'external-hsm' set but no PKCS#11 library path specified." + fi + elog "Building with external PKCS#11 library support ($PKCS11_LIB): ${PKCS11_PATH}" + fi +} + +pkg_pretend() { + check_pkcs11_setup +} + +pkg_setup() { + enewgroup opendnssec + enewuser opendnssec -1 -1 -1 opendnssec + + # pretend does not preserve variables so we need to run this once more + check_pkcs11_setup +} + +src_prepare() { + base_src_prepare + eautoreconf +} + +src_configure() { + econf \ + --without-cunit \ + --localstatedir="${EPREFIX}/var/" \ + --disable-static \ + --with-database-backend=$(use mysql && echo "mysql")$(use sqlite && echo "sqlite3") \ + --with-pkcs11-${PKCS11_LIB}=${PKCS11_PATH} \ + $(use_enable debug timeshift) \ + $(use_enable signer) +} + +src_compile() { + default + use doc && emake docs +} + +src_install() { + default + + # remove useless .la files + find "${ED}" -name '*.la' -delete + + # Remove subversion tags from config files to avoid useless config updates + sed -i \ + -e '/<!-- \$Id:/ d' \ + "${ED}"/etc/opendnssec/* || die + + # install update scripts + insinto /usr/share/opendnssec + if use sqlite; then + doins enforcer/utils/migrate_keyshare_sqlite3.pl + doins enforcer/utils/migrate_adapters_1.sqlite3 + fi + if use mysql; then + doins enforcer/utils/migrate_keyshare_mysql.pl + doins enforcer/utils/migrate_adapters_1.mysql + fi + + # fix permissions + fowners root:opendnssec /etc/opendnssec + fowners root:opendnssec /etc/opendnssec/{addns,conf,kasp,zonelist}.xml + fowners opendnssec:opendnssec /var/lib/opendnssec/{,signconf,unsigned,signed,tmp} + + # install conf/init script + newinitd "${FILESDIR}"/opendnssec.initd opendnssec + newconfd "${FILESDIR}"/opendnssec.confd opendnssec +} + +pkg_postinst() { + local v + if use softhsm; then + elog "Please make sure that you create your softhsm database in a location writeable" + elog "by the opendnssec user. You can set its location in /etc/softhsm.conf." + elog "Suggested configuration is:" + elog " echo \"0:/var/lib/opendnssec/softhsm_slot0.db\" >> /etc/softhsm.conf" + elog " softhsm --init-token --slot 0 --label OpenDNSSEC" + elog " chown opendnssec:opendnssec /var/lib/opendnssec/softhsm_slot0.db" + fi + + for v in $REPLACING_VERSIONS; do + case $v in + 1.3.*) + ewarn "" + ewarn "You are upgrading from version 1.3." + ewarn "" + ewarn "Please be aware of the following:" + ewarn " * OpenDNSSEC now supports both input and output adapters for" + ewarn " AXFR and IXFR in addition to file transfer." + ewarn " -> The zonefetch.xml file has been replaced by addns.xml" + ewarn " to support this enhancement." + ewarn " -> changes to the KASP database mean that a database" + ewarn " migration is required to upgrade to 1.4 from earlier" + ewarn " versions of OpenDNSSEC." + ewarn " * The auditor is no longer supported." + ewarn "" + ewarn "You can find more information here:" + ewarn " * /usr/share/doc/opendnssec*/MIGRATION*" + ewarn " * https://wiki.opendnssec.org/display/DOCS/Migrating+zone+fetcher+to+DNS+adapters" + ewarn " * https://wiki.opendnssec.org/display/DOCS/Migrating+from+earlier+versions+of+OpenDNSSEC" + ewarn "" + ;; + esac + done +} diff --git a/net-dns/opendnssec/opendnssec-2.0.1-r1.ebuild b/net-dns/opendnssec/opendnssec-2.0.1-r1.ebuild new file mode 100644 index 000000000000..f4ecf0b3f3eb --- /dev/null +++ b/net-dns/opendnssec/opendnssec-2.0.1-r1.ebuild @@ -0,0 +1,239 @@ +# Copyright 1999-2017 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 + +EAPI=5 + +MY_P="${P/_}" +PKCS11_IUSE="+softhsm opensc external-hsm" +inherit autotools eutils multilib user + +DESCRIPTION="An open-source turn-key solution for DNSSEC" +HOMEPAGE="http://www.opendnssec.org/" +SRC_URI="http://www.${PN}.org/files/source/${MY_P}.tar.gz" + +LICENSE="BSD GPL-2" +SLOT="0" +KEYWORDS="~amd64 ~x86" +IUSE="debug doc +mysql readline +signer sqlite test ${PKCS11_IUSE}" + +RDEPEND=" + dev-lang/perl + dev-libs/libxml2 + dev-libs/libxslt + net-libs/ldns + mysql? ( + virtual/mysql + dev-perl/DBD-mysql + ) + opensc? ( dev-libs/opensc ) + readline? ( sys-libs/readline:0 ) + softhsm? ( dev-libs/softhsm:* ) + sqlite? ( + dev-db/sqlite:3 + dev-perl/DBD-SQLite + ) +" +DEPEND="${RDEPEND} + doc? ( app-doc/doxygen ) + test? ( + app-text/trang + ) +" + +REQUIRED_USE=" + ^^ ( mysql sqlite ) + ^^ ( softhsm opensc external-hsm ) +" + +PATCHES=( + "${FILESDIR}/${PN}-fix-localstatedir-2.0.x.patch" + "${FILESDIR}/${PN}-fix-run-dir-2.0.x.patch" + "${FILESDIR}/${PN}-drop-privileges-2.0.x.patch" + "${FILESDIR}/${PN}-use-system-trang.patch" +) + +S="${WORKDIR}/${MY_P}" + +DOCS=( MIGRATION NEWS ) + +check_pkcs11_setup() { + # PKCS#11 HSM's are often only available with proprietary drivers not + # available in portage tree. + + if use softhsm; then + PKCS11_LIB=softhsm + if has_version ">=dev-libs/softhsm-1.3.1"; then + PKCS11_PATH=/usr/$(get_libdir)/softhsm/libsofthsm.so + else + PKCS11_PATH=/usr/$(get_libdir)/libsofthsm.so + fi + elog "Building with SoftHSM PKCS#11 library support." + fi + if use opensc; then + PKCS11_LIB=opensc + PKCS11_PATH=/usr/$(get_libdir)/opensc-pkcs11.so + elog "Building with OpenSC PKCS#11 library support." + fi + if use external-hsm; then + if [[ -n ${PKCS11_SCA6000} ]]; then + PKCS11_LIB=sca6000 + PKCS11_PATH=${PKCS11_SCA6000} + elif [[ -n ${PKCS11_ETOKEN} ]]; then + PKCS11_LIB=etoken + PKCS11_PATH=${PKCS11_ETOKEN} + elif [[ -n ${PKCS11_NCIPHER} ]]; then + PKCS11_LIB=ncipher + PKCS11_PATH=${PKCS11_NCIPHER} + elif [[ -n ${PKCS11_AEPKEYPER} ]]; then + PKCS11_LIB=aepkeyper + PKCS11_PATH=${PKCS11_AEPKEYPER} + else + ewarn "You enabled USE flag 'external-hsm' but did not specify a path to a PKCS#11" + ewarn "library. To set a path, set one of the following environment variables:" + ewarn " for Sun Crypto Accelerator 6000, set: PKCS11_SCA6000=<path>" + ewarn " for Aladdin eToken, set: PKCS11_ETOKEN=<path>" + ewarn " for Thales/nCipher netHSM, set: PKCS11_NCIPHER=<path>" + ewarn " for AEP Keyper, set: PKCS11_AEPKEYPER=<path>" + ewarn "Example:" + ewarn " PKCS11_ETOKEN=\"/opt/etoken/lib/libeTPkcs11.so\" emerge -pv opendnssec" + ewarn "or store the variable into /etc/portage/make.conf" + die "USE flag 'external-hsm' set but no PKCS#11 library path specified." + fi + elog "Building with external PKCS#11 library support ($PKCS11_LIB): ${PKCS11_PATH}" + fi +} + +pkg_pretend() { + if has_version "<net-dns/opendnssec-1.4.10"; then + ################################################################################ + eerror "You are already using OpenDNSSEC." + eerror "In order to migrate to version >=2.0.0 you need to upgrade to" + eerror "version >=1.4.10 first:" + eerror "" + eerror " emerge \"<net-dns/opendnssec-2\"" + eerror "" + eerror "See https://github.com/opendnssec/opendnssec/blob/2.0/master/MIGRATION" + eerror "for details." + eerror "" + die "Please upgrade to version >=1.4.10 first for proper db migraion" + fi + + check_pkcs11_setup +} + +pkg_setup() { + enewgroup opendnssec + enewuser opendnssec -1 -1 -1 opendnssec + + # pretend does not preserve variables so we need to run this once more + check_pkcs11_setup +} + +src_prepare() { + local patch + default + for patch in "${PATCHES[@]}"; do + epatch "$patch" + done + eautoreconf +} + +src_configure() { + econf \ + --without-cunit \ + --localstatedir="${EPREFIX}/var" \ + --disable-static \ + --with-enforcer-database=$(use mysql && echo "mysql")$(use sqlite && echo "sqlite3") \ + --with-pkcs11-${PKCS11_LIB}=${PKCS11_PATH} \ + $(use_with readline) \ + $(use_enable signer) +} + +src_compile() { + default + use doc && emake docs +} + +src_install() { + default + + # remove useless .la files + find "${ED}" -name '*.la' -delete + + # Remove subversion tags from config files to avoid useless config updates + sed -i \ + -e '/<!-- \$Id:/ d' \ + "${ED}"/etc/opendnssec/* || die + + # install db update/migration stuff + insinto /usr/share/opendnssec/db + if use sqlite; then + doins enforcer/utils/convert_mysql_to_sqlite + fi + if use mysql; then + doins enforcer/utils/convert_sqlite_to_mysql + fi + + insinto /usr/share/opendnssec/db/sql + if use sqlite; then + doins enforcer/src/db/schema.sqlite + fi + if use mysql; then + doins enforcer/src/db/schema.mysql + fi + + insinto /usr/share/opendnssec/db/1.4-2.0_db_convert + doins enforcer/utils/1.4-2.0_db_convert/find_problematic_zones.sql + doins enforcer/utils/1.4-2.0_db_convert/README.md + if use sqlite; then + doins enforcer/utils/1.4-2.0_db_convert/sqlite_convert.sql + doins enforcer/utils/1.4-2.0_db_convert/convert_sqlite + fi + if use mysql; then + doins enforcer/utils/1.4-2.0_db_convert/convert_mysql + doins enforcer/utils/1.4-2.0_db_convert/mysql_convert.sql + fi + + # patch scripts to find schema files + sed -i \ + -e 's,^SCHEMA=../src/db/,SCHEMA=/usr/share/opendnssec/db/sql/,' \ + -e 's,^SCHEMA=../../src/db/,SCHEMA=/usr/share/opendnssec/db/sql/,' \ + "${ED}"/usr/share/opendnssec/db/convert_* \ + "${ED}"/usr/share/opendnssec/db/1.4-2.0_db_convert/convert_* + + # fix permissions + fowners root:opendnssec /etc/opendnssec + fowners root:opendnssec /etc/opendnssec/{addns,conf,kasp,zonelist}.xml + fowners opendnssec:opendnssec /var/lib/opendnssec/{,enforcer,signconf,signed,signer,unsigned} + + # install conf/init script + newinitd "${FILESDIR}"/opendnssec.initd opendnssec + newconfd "${FILESDIR}"/opendnssec.confd opendnssec +} + +pkg_postinst() { + local v + if use softhsm; then + elog "Please make sure that you create your softhsm database in a location writeable" + elog "by the opendnssec user. You can set its location in /etc/softhsm.conf." + elog "Suggested configuration is:" + elog " echo \"0:/var/lib/opendnssec/softhsm_slot0.db\" >> /etc/softhsm.conf" + elog " softhsm --init-token --slot 0 --label OpenDNSSEC" + elog " chown opendnssec:opendnssec /var/lib/opendnssec/softhsm_slot0.db" + fi + for v in $REPLACING_VERSIONS; do + case $v in + 1.4.*) + ewarn "" + ewarn "You are upgrading from version 1.4." + ewarn "" + ewarn "A migration is needed from 1.4 to 2.0." + ewarn "For details see /usr/share/doc/${P}/MIGRATION*" + ewarn "" + ewarn "For your convenience the mentioned migration scripts and README" + ewarn "have been installed to /usr/share/${PN}/db/1.4-2.0_db_convert" + ewarn "" + ;; + esac + done +} diff --git a/net-dns/opendnssec/opendnssec-2.0.3.ebuild b/net-dns/opendnssec/opendnssec-2.0.3.ebuild new file mode 100644 index 000000000000..f4ecf0b3f3eb --- /dev/null +++ b/net-dns/opendnssec/opendnssec-2.0.3.ebuild @@ -0,0 +1,239 @@ +# Copyright 1999-2017 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 + +EAPI=5 + +MY_P="${P/_}" +PKCS11_IUSE="+softhsm opensc external-hsm" +inherit autotools eutils multilib user + +DESCRIPTION="An open-source turn-key solution for DNSSEC" +HOMEPAGE="http://www.opendnssec.org/" +SRC_URI="http://www.${PN}.org/files/source/${MY_P}.tar.gz" + +LICENSE="BSD GPL-2" +SLOT="0" +KEYWORDS="~amd64 ~x86" +IUSE="debug doc +mysql readline +signer sqlite test ${PKCS11_IUSE}" + +RDEPEND=" + dev-lang/perl + dev-libs/libxml2 + dev-libs/libxslt + net-libs/ldns + mysql? ( + virtual/mysql + dev-perl/DBD-mysql + ) + opensc? ( dev-libs/opensc ) + readline? ( sys-libs/readline:0 ) + softhsm? ( dev-libs/softhsm:* ) + sqlite? ( + dev-db/sqlite:3 + dev-perl/DBD-SQLite + ) +" +DEPEND="${RDEPEND} + doc? ( app-doc/doxygen ) + test? ( + app-text/trang + ) +" + +REQUIRED_USE=" + ^^ ( mysql sqlite ) + ^^ ( softhsm opensc external-hsm ) +" + +PATCHES=( + "${FILESDIR}/${PN}-fix-localstatedir-2.0.x.patch" + "${FILESDIR}/${PN}-fix-run-dir-2.0.x.patch" + "${FILESDIR}/${PN}-drop-privileges-2.0.x.patch" + "${FILESDIR}/${PN}-use-system-trang.patch" +) + +S="${WORKDIR}/${MY_P}" + +DOCS=( MIGRATION NEWS ) + +check_pkcs11_setup() { + # PKCS#11 HSM's are often only available with proprietary drivers not + # available in portage tree. + + if use softhsm; then + PKCS11_LIB=softhsm + if has_version ">=dev-libs/softhsm-1.3.1"; then + PKCS11_PATH=/usr/$(get_libdir)/softhsm/libsofthsm.so + else + PKCS11_PATH=/usr/$(get_libdir)/libsofthsm.so + fi + elog "Building with SoftHSM PKCS#11 library support." + fi + if use opensc; then + PKCS11_LIB=opensc + PKCS11_PATH=/usr/$(get_libdir)/opensc-pkcs11.so + elog "Building with OpenSC PKCS#11 library support." + fi + if use external-hsm; then + if [[ -n ${PKCS11_SCA6000} ]]; then + PKCS11_LIB=sca6000 + PKCS11_PATH=${PKCS11_SCA6000} + elif [[ -n ${PKCS11_ETOKEN} ]]; then + PKCS11_LIB=etoken + PKCS11_PATH=${PKCS11_ETOKEN} + elif [[ -n ${PKCS11_NCIPHER} ]]; then + PKCS11_LIB=ncipher + PKCS11_PATH=${PKCS11_NCIPHER} + elif [[ -n ${PKCS11_AEPKEYPER} ]]; then + PKCS11_LIB=aepkeyper + PKCS11_PATH=${PKCS11_AEPKEYPER} + else + ewarn "You enabled USE flag 'external-hsm' but did not specify a path to a PKCS#11" + ewarn "library. To set a path, set one of the following environment variables:" + ewarn " for Sun Crypto Accelerator 6000, set: PKCS11_SCA6000=<path>" + ewarn " for Aladdin eToken, set: PKCS11_ETOKEN=<path>" + ewarn " for Thales/nCipher netHSM, set: PKCS11_NCIPHER=<path>" + ewarn " for AEP Keyper, set: PKCS11_AEPKEYPER=<path>" + ewarn "Example:" + ewarn " PKCS11_ETOKEN=\"/opt/etoken/lib/libeTPkcs11.so\" emerge -pv opendnssec" + ewarn "or store the variable into /etc/portage/make.conf" + die "USE flag 'external-hsm' set but no PKCS#11 library path specified." + fi + elog "Building with external PKCS#11 library support ($PKCS11_LIB): ${PKCS11_PATH}" + fi +} + +pkg_pretend() { + if has_version "<net-dns/opendnssec-1.4.10"; then + ################################################################################ + eerror "You are already using OpenDNSSEC." + eerror "In order to migrate to version >=2.0.0 you need to upgrade to" + eerror "version >=1.4.10 first:" + eerror "" + eerror " emerge \"<net-dns/opendnssec-2\"" + eerror "" + eerror "See https://github.com/opendnssec/opendnssec/blob/2.0/master/MIGRATION" + eerror "for details." + eerror "" + die "Please upgrade to version >=1.4.10 first for proper db migraion" + fi + + check_pkcs11_setup +} + +pkg_setup() { + enewgroup opendnssec + enewuser opendnssec -1 -1 -1 opendnssec + + # pretend does not preserve variables so we need to run this once more + check_pkcs11_setup +} + +src_prepare() { + local patch + default + for patch in "${PATCHES[@]}"; do + epatch "$patch" + done + eautoreconf +} + +src_configure() { + econf \ + --without-cunit \ + --localstatedir="${EPREFIX}/var" \ + --disable-static \ + --with-enforcer-database=$(use mysql && echo "mysql")$(use sqlite && echo "sqlite3") \ + --with-pkcs11-${PKCS11_LIB}=${PKCS11_PATH} \ + $(use_with readline) \ + $(use_enable signer) +} + +src_compile() { + default + use doc && emake docs +} + +src_install() { + default + + # remove useless .la files + find "${ED}" -name '*.la' -delete + + # Remove subversion tags from config files to avoid useless config updates + sed -i \ + -e '/<!-- \$Id:/ d' \ + "${ED}"/etc/opendnssec/* || die + + # install db update/migration stuff + insinto /usr/share/opendnssec/db + if use sqlite; then + doins enforcer/utils/convert_mysql_to_sqlite + fi + if use mysql; then + doins enforcer/utils/convert_sqlite_to_mysql + fi + + insinto /usr/share/opendnssec/db/sql + if use sqlite; then + doins enforcer/src/db/schema.sqlite + fi + if use mysql; then + doins enforcer/src/db/schema.mysql + fi + + insinto /usr/share/opendnssec/db/1.4-2.0_db_convert + doins enforcer/utils/1.4-2.0_db_convert/find_problematic_zones.sql + doins enforcer/utils/1.4-2.0_db_convert/README.md + if use sqlite; then + doins enforcer/utils/1.4-2.0_db_convert/sqlite_convert.sql + doins enforcer/utils/1.4-2.0_db_convert/convert_sqlite + fi + if use mysql; then + doins enforcer/utils/1.4-2.0_db_convert/convert_mysql + doins enforcer/utils/1.4-2.0_db_convert/mysql_convert.sql + fi + + # patch scripts to find schema files + sed -i \ + -e 's,^SCHEMA=../src/db/,SCHEMA=/usr/share/opendnssec/db/sql/,' \ + -e 's,^SCHEMA=../../src/db/,SCHEMA=/usr/share/opendnssec/db/sql/,' \ + "${ED}"/usr/share/opendnssec/db/convert_* \ + "${ED}"/usr/share/opendnssec/db/1.4-2.0_db_convert/convert_* + + # fix permissions + fowners root:opendnssec /etc/opendnssec + fowners root:opendnssec /etc/opendnssec/{addns,conf,kasp,zonelist}.xml + fowners opendnssec:opendnssec /var/lib/opendnssec/{,enforcer,signconf,signed,signer,unsigned} + + # install conf/init script + newinitd "${FILESDIR}"/opendnssec.initd opendnssec + newconfd "${FILESDIR}"/opendnssec.confd opendnssec +} + +pkg_postinst() { + local v + if use softhsm; then + elog "Please make sure that you create your softhsm database in a location writeable" + elog "by the opendnssec user. You can set its location in /etc/softhsm.conf." + elog "Suggested configuration is:" + elog " echo \"0:/var/lib/opendnssec/softhsm_slot0.db\" >> /etc/softhsm.conf" + elog " softhsm --init-token --slot 0 --label OpenDNSSEC" + elog " chown opendnssec:opendnssec /var/lib/opendnssec/softhsm_slot0.db" + fi + for v in $REPLACING_VERSIONS; do + case $v in + 1.4.*) + ewarn "" + ewarn "You are upgrading from version 1.4." + ewarn "" + ewarn "A migration is needed from 1.4 to 2.0." + ewarn "For details see /usr/share/doc/${P}/MIGRATION*" + ewarn "" + ewarn "For your convenience the mentioned migration scripts and README" + ewarn "have been installed to /usr/share/${PN}/db/1.4-2.0_db_convert" + ewarn "" + ;; + esac + done +} |