6 files changed, 226 insertions, 31 deletions
diff --git a/net-dns/Manifest.gz b/net-dns/Manifest.gz
index 23d2416ada71..ba5682afc1e0 100644
--- a/net-dns/Manifest.gz
+++ b/net-dns/Manifest.gz
diff --git a/net-dns/nsd/Manifest b/net-dns/nsd/Manifest
index 19597290e233..1c341f30a3c8 100644
--- a/net-dns/nsd/Manifest
+++ b/net-dns/nsd/Manifest
@@ -1,12 +1,11 @@
-AUX nsd-4.6.1-incompatible-ptr-types.patch 791 BLAKE2B c1c4985203f95c59c0ad761ce6692b3669140e3928e97cdd08cbc42d12bfbd57594e4812af8fd942f29d654ee7cf1e0e8045e2b65bc9a60a98c8024919ef9276 SHA512 997d56676ac083516ca4ca5416fd655fc3462a0cb20ddf476a1f44a1785d64cf072a3b932ea2f60271cf855e0ab6ad366d13cf3b22174c8682b8fb6745957ea9
 AUX nsd-4.7.0-no-bind8-stats-no-ssl.patch 724 BLAKE2B ed9b6014a37e819f89624928a50499163f41cd65e881f5d835cbb9c7d9613dd9e24a790f69ae30135d95b8e5aefa10c606f6a47750254f3d89d0259ae780921f SHA512 3823eb145aa5c6b55992c498417d07643e85255d6033ae7444c51e2432475620f46750681ee9cf758fd7f2fc5336a9f7906d57fb8c78940641d88a1dff8311f1
 AUX nsd.initd-r1 1383 BLAKE2B b90de2ebef09a4f9050f6e95f5faf659c62910462aba1179daccde4e63a3972124247e6e8ce725c4dbd34a7fcd4f14b40899d7b59ba4937bdc59c493f6f7e173 SHA512 f775c78b529c5c7f1130035ea9c6cf1c1e9c1790c5df84fafd86a41294748a46c82b66c58df8385f8f4bbca8113427c665051aeec5720073bd9823607c9f8ce1
 AUX nsd.munin-conf 23 BLAKE2B 0b08804b2218d77ea925d4c9e26e73649b453b923d6d7b1e1df39ceb58b92a44c48cb21583a480e622f72d07650f410f2e0703f1d16af08152aed16982ab8da2 SHA512 c06d0b035387e7be79cfa8fedf8afb3900772146c6d4090ac39ea2ef165772d875b222ef467bd73422078ef57818bcc931ca67fa290bd99a7a9456efa5448853
 AUX nsd.service 272 BLAKE2B 66a7d4132246589f71341afd98361f6b02082be3d4e230c86ae690876a797ea0a4580b29892d91feba2785ea933a053f862e0d00f2c8a8c09ab907386c39a03c SHA512 fbca86887bfc36d61af06992cc98b3f3cb33c39274fbdc1e53d489bdcc767993911fab27a20244c3878b36bacbd1644a552364b2f7bf4d48e6eb247d0eecdf0f
 AUX nsd_munin_.patch 542 BLAKE2B 13ff49c41683d5bf505e257cd17bf5f3ad06662c00032d79b36be3f96486eb89fdd62a42b5ed4816ad99835366864603568613e27504894340ebb64057e2b2c3 SHA512 6034086d6b6f6980468766c901e92291fea8a32df179561ede2add5918c37bfe3aabf122735d4ae2e28efece394fd3398f9a0cc4d8fdcc1e5da1ca709d2ba6ae
-DIST nsd-4.6.1.tar.gz 1281583 BLAKE2B 5eff5560ce16451a57905bb9d979c81918b6b55f72e1f1b89ab8d2e479ac36bf4f95152c77b1f1b3ce0af90bde8f25d2cad7226450c5cbc879f112adea2b3a69 SHA512 cab557a20cf8564cbf6e38405ca28b00baa6e14105527c3b16f49f57fed5e39cdb2bcd62999bad4aff2c69e0967bdba66a1eaa7b73a0d4d99d97535cc5860bfe
 DIST nsd-4.7.0.tar.gz 1289477 BLAKE2B d3949c8b65376ea78c700efaeb988acbfac5a5ba338f9bf29035176a7da6730ee8b7a2b6bfc5573ad178db80166ca74d71d313bf3d405acc666bf87f17dac63b SHA512 387e66993517c015ea49fc7a985c1f746623ae30a82bd01f224efbdb7c58d1d2f3e5a5a3574203959047876c632ec464b6682d1644f0e0f157ec0e6fb3f0cdbb
-EBUILD nsd-4.6.1-r1.ebuild 3209 BLAKE2B 389c985799ffa9042b6068090e361474ea3ed46d1e4011331db85b89260229801e7af8c6c0bbb00a086dec5598cc0b225ddf4546a7da5dc490146d54d7bde2ed SHA512 67cc70e82fa0c2b8bd236867b58eca15951c819c5446bb2d336e73458c193e4eae1f192c620b0eea6b7183fc1da012651abdc64bd363373a8cb12a8863ffb094
+DIST nsd-4.8.0.tar.gz 1273228 BLAKE2B d1e6a5e8fb158bb32081bc7674d957e3f5a596ed10ee89dd6a5f6af9a79a8c130f2de7070345bee69cb7798e9f373d856a9336a9e9f65f733ff45e15e94833ff SHA512 13c9cffffe6adfcbabf744ee2effebe6ae265d83476345a1edb60dc9c6d7f838a5e239e9b18e667924e5e76b74b2caac63818fcaecf7f0fa651ff21736174a46
 EBUILD nsd-4.7.0.ebuild 3217 BLAKE2B 6aa499c19a9d72b9b31c026cc67faabbe18ef4128684acc56e0ae5bb5cb2c909cf3e5682761cc8382d8974f654b16a120887a7483d64f88428d0ac5c827ee033 SHA512 b024a97f5208d01baaeacd5e225d2da71cb5ec56a891e879bea5d94f8a13fd996a688e8e2035fd0ea60ceefa2f36ea08d53b2cc7bab3f397cf764bfca5a1fc0e
+EBUILD nsd-4.8.0.ebuild 3156 BLAKE2B 6ed71c48f19645490d77a04d05325d235a19ee742bcbe51eb1af8d8db242b5ad5660e778b9bc052f48930a6dfde1427ef27b251a7246e039d3862509b62aa7fc SHA512 c4b82c928010a4ec5b57f736c0874f1b588dd1c3e2c9cb865e5fc94bf64888ab349b18a39819e1f60e45581397b037250cf72c1dc5efd4de6f6439c97f857182
 EBUILD nsd-9999.ebuild 3156 BLAKE2B 6ed71c48f19645490d77a04d05325d235a19ee742bcbe51eb1af8d8db242b5ad5660e778b9bc052f48930a6dfde1427ef27b251a7246e039d3862509b62aa7fc SHA512 c4b82c928010a4ec5b57f736c0874f1b588dd1c3e2c9cb865e5fc94bf64888ab349b18a39819e1f60e45581397b037250cf72c1dc5efd4de6f6439c97f857182
 MISC metadata.xml 970 BLAKE2B bdadf7cb1a1a444aff44b9f1ad7ea64a5b01d72888d91662f55cb321a94f8b03ea9f050e78df9cc2a81e2c538a81d463c95f998b8c7f65c192425d3a5917a25e SHA512 bc769f335f452a8f81f83d8333bf3db11620212b156eac80ddd9622312605b80b56d4fa6ebdb609b7c1999cc995672350b0181666c012ee69e21ff5b511af48d
diff --git a/net-dns/nsd/files/nsd-4.6.1-incompatible-ptr-types.patch b/net-dns/nsd/files/nsd-4.6.1-incompatible-ptr-types.patch
deleted file mode 100644
index 4b87be966eb0..000000000000
--- a/net-dns/nsd/files/nsd-4.6.1-incompatible-ptr-types.patch
+++ /dev/null
@@ -1,24 +0,0 @@
-https://github.com/NLnetLabs/nsd/issues/239
-https://github.com/NLnetLabs/nsd/commit/7162600301205c3c62a1695c0b29e079694b65ae
-
-From 7162600301205c3c62a1695c0b29e079694b65ae Mon Sep 17 00:00:00 2001
-From: "W.C.A. Wijngaards" <wouter@nlnetlabs.nl>
-Date: Thu, 10 Nov 2022 09:47:59 +0100
-Subject: [PATCH] - Fix #239: -Wincompatible-pointer-types warning in remote.c.
-
---- a/remote.c
-+++ b/remote.c
-@@ -1212,8 +1212,11 @@ do_stats(struct daemon_remote* rc, int peek, struct rc_state* rs)
- 	/* force a reload */
- 	xfrd_set_reload_now(xfrd);
- #else
-+	RES res;
-+	res.ssl = rs->ssl;
-+	res.fd = rs->fd;
- 	(void)rc; (void)peek;
--	(void)ssl_printf(rs->ssl, "error no stats enabled at compile time\n");
-+	(void)ssl_printf(&res, "error no stats enabled at compile time\n");
- #endif /* BIND8_STATS */
- }
- 
-
diff --git a/net-dns/nsd/nsd-4.6.1-r1.ebuild b/net-dns/nsd/nsd-4.8.0.ebuild
index df0ec4a834af..d9028ba457da 100644
--- a/net-dns/nsd/nsd-4.6.1-r1.ebuild
+++ b/net-dns/nsd/nsd-4.8.0.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2022 Gentoo Authors
+# Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
@@ -17,11 +17,11 @@ else
 	MY_PV="${MY_PV/_rc/rc}"
 	MY_P="${PN}-${MY_PV}"
 
-	if [[ ${PV} != *_beta* ]] && [[ ${PV} != *_rc* ]] ; then
+	if [[ ${PV} != *_beta* && ${PV} != *_rc* ]] ; then
 		SRC_URI="https://www.nlnetlabs.nl/downloads/${PN}/${MY_P}.tar.gz"
 		S="${WORKDIR}"/${MY_P}
 
-		KEYWORDS="amd64 x86"
+		KEYWORDS="~amd64 ~x86"
 	fi
 fi
 
@@ -51,7 +51,6 @@ BDEPEND="
 PATCHES=(
 	# Fix the paths in the munin plugin to match our install
 	"${FILESDIR}"/nsd_munin_.patch
-	"${FILESDIR}"/${P}-incompatible-ptr-types.patch
 )
 
 src_prepare() {
diff --git a/net-dns/unbound/Manifest b/net-dns/unbound/Manifest
index f840ff3639c3..520a8a60ac87 100644
--- a/net-dns/unbound/Manifest
+++ b/net-dns/unbound/Manifest
@@ -15,8 +15,11 @@ DIST unbound-1.17.1.tar.gz 6244773 BLAKE2B c2dec1608e28302da33ee72144bb8eb16cdff
 DIST unbound-1.17.1.tar.gz.asc 833 BLAKE2B d78338da7ca590ef29403b24c271edf8f2eb026ad1f74ba9646f5539e41c6770e172133e1f1dbf1f31623d8f5828f78b8cc3a86bb72f1d6591967c98a994726b SHA512 d663c2ebf9ba4420eb6cd351378d646ac4c9e88bd69913dc1c862a326e98329496a901c86b857f2c157c0401a289ff91e5ac83911477cb9894156c6d959b2b80
 DIST unbound-1.18.0.tar.gz 6315297 BLAKE2B 55f68cdb08281adaa7446f9b284d850e5e0cbbcbeda98609d9f8297d1bb298fcba51fa0a0805df5acc0a475397c65d295a33ae26144cdafbedb9686915dd174b SHA512 24ca6bfe0ed493eb6aaa5cb1b2b108076ce97c48de7470adf596d1154254351e382b83aae33fcd8d4fa64847e359613e00c979b6f3ba7671215b2d0fd2b03b14
 DIST unbound-1.18.0.tar.gz.asc 833 BLAKE2B fb6be5100b960ef6ad279458a2492cc308a120e65a8fcd71aa5a5505bd6213be0ff232c6fd81939bbe53cdddbaa9bd24b79dcc96c69b360ae391b597d9a1d9d7 SHA512 222ff184d952b9ee8ce81e1f3384d1640ff4695ca60b7d5f946dc24489d583618fc0f4e3c169514b699c684766fdb352f47ca29853223fbae70a65fd994d4fd2
+DIST unbound-1.19.0.tar.gz 6336113 BLAKE2B 66ec2b1cd32ac5930c088c73e884bc1fb4d35526a0c89bdbe209defd3e78326ce9b3c1a523fc1ab28b8fdf0e457280d5de7b300cf560c15d875f460bc361f5c7 SHA512 c7df997ab003d098f53ac97ffb4c8428ab28e24573ff21e21782cbeadca42edadeb5b0db53ce954c9ff3106a5edb36eb47109240c554a44d9aac75727b66aeb4
+DIST unbound-1.19.0.tar.gz.asc 833 BLAKE2B 5e593223a47afaebd5e595a9520288ca5d8adee720d5e9989e7d8dd28ad1cce3e1850fec29886e0e52af14dd288b5c9c68a3a05f1d835c15e11d5bf01a08ad50 SHA512 63aa94192de7840f7abe43367e2c3f5d3fd42b8d72c08a5645cf28e2c0ad2e11d54f3aa645384fff5d4dfe66bc7ee25d81bd967780a992b54956343974206580
 EBUILD unbound-1.16.3.ebuild 6469 BLAKE2B 18cc82de0656a071c1925255ceac577ad0cfe237e7226236585d712a8feb4ad00cacecc2a677dbfafb9db8401dfe2b13d72c8e8e3c20b4aa532531d3d40007dc SHA512 f073e427e88c0f88379a9d427c7ef72269051f1da321a78a606fab9b56c60b2e0da4b7a59a043e9bafe11c7a15e3c9736df1326adbb40c4acfcde0d1be06124f
 EBUILD unbound-1.17.0.ebuild 6475 BLAKE2B 2760f28a760e30319396ee3d14b64a77d3c37c662737b46250026457c86c7f8bea8e6d3c6634753ff65044f189a522b38ea94e92a53a8a1739081b69aa9ccdf8 SHA512 f2be2711f5e3dc0c3cd9a3c6ba16d8ac024e7c6f78928e36570b017a2e648b0a7d4b777d76e088d22cdbecc1d7c0b6525034957538d5a8d8d20aa7b0d906d637
 EBUILD unbound-1.17.1.ebuild 6385 BLAKE2B 740557cc5e299e7b8bd285d8aae60da1e5de7d455066ec21175674a42db5f7062a246b722311c47ec5a17358d691e31dd2c18af2c8f3f1360bc50943be4be182 SHA512 d1cbe97ad9b5d2144303bd5b8acb182c2b51036077e6982c7b7480d780944298322f7b320c4c94d1be23baa17e8ccfbe9a0ef67f5f7aafcca4c176894f8f4660
 EBUILD unbound-1.18.0.ebuild 6426 BLAKE2B cceeb53537a7ee30fb349ce8bac0c288b5513d188d04bcb3b9a810fbd2662fea6d81f9cb7783580039534e3884113cdb6b450e9bd3e4409faba12f4149ce9689 SHA512 9a1082fbf865ba72db83834a8ecc1b6106ac3ca8c5907b3938ec1649fb60971074445295fd5f9d7da1fd24924afd712af8d7078feb936c9d7831c21894d9095d
+EBUILD unbound-1.19.0.ebuild 6498 BLAKE2B a227b445df23bd170f078dc1ff479936a1b90f88b77c2484e9fc1a8f7e3779ddc472a718990a0c7a25d4dec5215b314609645eb997676510d552743d711fada1 SHA512 b1d81a7c9c41964481759ba8341fc629a9d921f7aefb1b5d4029fa49483783fb8cd30f3b4f457979697fa3245dd0e13d15de111a8a977b244640de39c7893c18
 MISC metadata.xml 1475 BLAKE2B d0e34f4ba056c090af979f2686d5dece53a554c7ea7612fee1991ce6838ce161359bd8405d6358c5e184b6721affeee5d6e1bd93095b92765cd38dba928daa5b SHA512 8fba72eba420d4c06fb3a9119c3f324c5679fe268b65fac23878ef15f3c3d784d372874c7d6428d1c7c2eb3a75380ad2e4d5fc1691e7c2d1b426b8cfa381222b
diff --git a/net-dns/unbound/unbound-1.19.0.ebuild b/net-dns/unbound/unbound-1.19.0.ebuild
new file mode 100644
index 000000000000..59c8f7fd950c
--- /dev/null
+++ b/net-dns/unbound/unbound-1.19.0.ebuild
@@ -0,0 +1,218 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PYTHON_COMPAT=( python3_{10..11} )
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/unbound.net.asc
+inherit autotools flag-o-matic multilib-minimal python-single-r1 systemd verify-sig
+
+MY_P=${PN}-${PV/_/}
+DESCRIPTION="A validating, recursive and caching DNS resolver"
+HOMEPAGE="https://unbound.net/ https://nlnetlabs.nl/projects/unbound/about/"
+SRC_URI="
+	https://nlnetlabs.nl/downloads/unbound/${MY_P}.tar.gz
+	verify-sig? ( https://nlnetlabs.nl/downloads/unbound/${MY_P}.tar.gz.asc )
+"
+S="${WORKDIR}"/${MY_P}
+
+LICENSE="BSD GPL-2"
+SLOT="0/8" # ABI version of libunbound.so
+if [[ ${PV} != *_rc* ]] ; then
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~mips ~ppc ~ppc64 ~riscv ~x86"
+fi
+IUSE="debug dnscrypt dnstap +ecdsa ecs gost +http2 python redis selinux static-libs systemd test +tfo threads"
+REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} )"
+RESTRICT="!test? ( test )"
+
+# Note: expat is needed by executable only but the Makefile is custom
+# and doesn't make it possible to easily install the library without
+# the executables. MULTILIB_USEDEP may be dropped once build system
+# is fixed.
+DEPEND="
+	acct-group/unbound
+	acct-user/unbound
+	>=dev-libs/expat-2.1.0-r3[${MULTILIB_USEDEP}]
+	>=dev-libs/libevent-2.0.21:0=[${MULTILIB_USEDEP}]
+	>=dev-libs/openssl-1.0.1h-r2:0=[${MULTILIB_USEDEP}]
+	dnscrypt? ( dev-libs/libsodium:=[${MULTILIB_USEDEP}] )
+	dnstap? (
+		dev-libs/fstrm[${MULTILIB_USEDEP}]
+		>=dev-libs/protobuf-c-1.0.2-r1:=[${MULTILIB_USEDEP}]
+	)
+	ecdsa? (
+		dev-libs/openssl:0[-bindist(-)]
+	)
+	http2? ( net-libs/nghttp2:=[${MULTILIB_USEDEP}] )
+	python? ( ${PYTHON_DEPS} )
+	redis? ( dev-libs/hiredis:= )
+	systemd? ( sys-apps/systemd )
+"
+BDEPEND="
+	virtual/pkgconfig
+	python? ( dev-lang/swig )
+	test? (
+		net-libs/ldns[examples(-)]
+		dev-util/splint
+		app-text/wdiff
+	)
+	verify-sig? ( sec-keys/openpgp-keys-unbound )
+"
+RDEPEND="
+	${DEPEND}
+	net-dns/dnssec-root
+	selinux? ( sec-policy/selinux-bind )
+"
+
+QA_CONFIG_IMPL_DECL_SKIP=(
+	ioctlsocket # not on Linux (bug #900060)
+)
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-1.5.7-trust-anchor-file.patch
+	"${FILESDIR}"/${PN}-1.6.3-pkg-config.patch
+	"${FILESDIR}"/${PN}-1.10.1-find-ar.patch
+)
+
+pkg_setup() {
+	use python && python-single-r1_pkg_setup
+}
+
+src_prepare() {
+	default
+
+	eautoreconf
+
+	# Required for the python part
+	multilib_copy_sources
+}
+
+src_configure() {
+	[[ ${CHOST} == *-darwin* ]] || append-ldflags -Wl,-z,noexecstack
+	multilib-minimal_src_configure
+}
+
+multilib_src_configure() {
+	local myeconfargs=(
+		$(multilib_native_use_enable debug)
+		$(multilib_native_use_enable gost)
+		$(multilib_native_use_enable dnscrypt)
+		$(multilib_native_use_enable dnstap)
+		$(multilib_native_use_enable ecdsa)
+		$(multilib_native_use_enable ecs subnet)
+		$(multilib_native_use_enable redis cachedb)
+		$(multilib_native_use_enable static-libs static)
+		$(multilib_native_use_enable systemd)
+		$(multilib_native_use_with python pythonmodule)
+		$(multilib_native_use_with python pyunbound)
+		$(multilib_native_use_with threads pthreads)
+		$(multilib_native_use_with http2 libnghttp2)
+		$(multilib_native_use_enable tfo tfo-client)
+		$(multilib_native_use_enable tfo tfo-server)
+
+		--disable-flto
+		--disable-rpath
+		--enable-event-api
+		--enable-ipsecmod
+
+		--with-libevent="${ESYSROOT}"/usr
+		$(multilib_native_usex redis --with-libhiredis="${ESYSROOT}/usr" --without-libhiredis)
+
+		--with-pidfile="${EPREFIX}"/run/unbound.pid
+		--with-rootkey-file="${EPREFIX}"/etc/dnssec/root-anchors.txt
+		--with-ssl="${ESYSROOT}"/usr
+		--with-libexpat="${ESYSROOT}"/usr
+
+		# http://unbound.nlnetlabs.nl/pipermail/unbound-users/2011-April/001801.html
+		# $(use_enable debug lock-checks)
+		# $(use_enable debug alloc-checks)
+		# $(use_enable debug alloc-lite)
+		# $(use_enable debug alloc-nonregional)
+	)
+
+	econf "${myeconfargs[@]}"
+}
+
+multilib_src_install() {
+	emake DESTDIR="${D}" install
+	systemd_dounit contrib/unbound.service
+	systemd_dounit contrib/unbound.socket
+}
+
+multilib_src_install_all() {
+	use python && python_optimize
+
+	newinitd "${FILESDIR}"/unbound-r1.initd unbound
+	newconfd "${FILESDIR}"/unbound-r1.confd unbound
+
+	systemd_newunit "${FILESDIR}"/unbound_at.service "unbound@.service"
+	systemd_dounit "${FILESDIR}"/unbound-anchor.service
+
+	dodoc doc/{README,CREDITS,TODO,Changelog,FEATURES}
+
+	# bug #315519
+	dodoc contrib/unbound_munin_
+
+	docinto selinux
+	dodoc contrib/selinux/*
+
+	exeinto /usr/share/${PN}
+	doexe contrib/update-anchor.sh
+
+	# Create space for auto-trust-anchor-file...
+	keepdir /etc/unbound/var
+	fowners root:unbound /etc/unbound/var
+	fperms 0770 /etc/unbound/var
+	# ... and point example config to it
+	sed -i \
+		-e '/# auto-trust-anchor-file:/s,/etc/dnssec/root-anchors.txt,/etc/unbound/var/root-anchors.txt,' \
+		"${ED}/etc/unbound/unbound.conf" \
+		|| die
+
+	# Used to store cache data
+	keepdir /var/lib/${PN}
+	fowners root:unbound /var/lib/${PN}
+	fperms 0770 /var/lib/${PN}
+
+	find "${ED}" -name '*.la' -delete || die
+	if ! use static-libs ; then
+		find "${ED}" -name "*.a" -delete || die
+	fi
+}
+
+pkg_postinst() {
+	if [[ ! -f "${EROOT}/etc/unbound/unbound_control.key" ]]; then
+		einfo "Trying to create unbound control key ..."
+		if ! unbound-control-setup &>/dev/null ; then
+			ewarn "Failed to create unbound control key!"
+		fi
+	fi
+
+	if [[ ! -f "${EROOT}/etc/unbound/var/root-anchors.txt" ]]; then
+		einfo ""
+		einfo "If you want unbound to automatically update the root-anchor file for DNSSEC validation"
+		einfo "set 'auto-trust-anchor-file: ${EROOT}/etc/unbound/var/root-anchors.txt' in ${EROOT}/etc/unbound/unbound.conf"
+		einfo "and run"
+		einfo ""
+		einfo "  su -s /bin/sh -c '${EROOT}/usr/sbin/unbound-anchor -a ${EROOT}/etc/unbound/var/root-anchors.txt' unbound"
+		einfo ""
+		einfo "as root to create it initially before starting unbound for the first time after enabling this."
+		einfo ""
+	fi
+
+	# Our user is not available on prefix
+	use prefix && return
+
+	local _perm_check_testfile=$(mktemp --dry-run "${EPREFIX}"/etc/unbound/var/.pkg_postinst-perm-check.XXXXXXXXX)
+	su -s /bin/sh -c "touch ${_perm_check_testfile}" unbound &>/dev/null
+	if [[ $? -ne 0 ]]; then
+		ewarn "WARNING: unbound user cannot write to \"${EPREFIX}/etc/unbound/var\"!"
+		ewarn "Run the following commands to restore default permission:"
+		ewarn ""
+		ewarn "    chown root:unbound ${EPREFIX}/etc/unbound/var"
+		ewarn "    chmod 0770 ${EPREFIX}/etc/unbound/var"
+	else
+		# Cleanup -- no reason to die here!
+		rm -f "${_perm_check_testfile}"
+	fi
+}