Restore and bump ebuild for (still maintained) 1.3 branch

Package-Manager: portage-2.2.0_alpha188/cvs/Linux x86_64
Manifest-Sign-Key: 0x296C6CCA35A64134

8 files changed, 415 insertions, 6 deletions

diff --git a/net-dns/opendnssec/ChangeLog b/net-dns/opendnssec/ChangeLog
index b0baca88c542..1d2e6df87642 100644
--- a/net-dns/opendnssec/ChangeLog
+++ b/net-dns/opendnssec/ChangeLog
@@ -1,6 +1,15 @@
 # ChangeLog for net-dns/opendnssec
 # Copyright 1999-2013 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/net-dns/opendnssec/ChangeLog,v 1.27 2013/07/23 20:00:56 mschiff Exp $
+# $Header: /var/cvsroot/gentoo-x86/net-dns/opendnssec/ChangeLog,v 1.28 2013/07/23 20:06:48 mschiff Exp $
+
+*opendnssec-1.3.14 (23 Jul 2013)
+
+  23 Jul 2013; Marc Schiffbauer <mschiff@gentoo.org>
+  +files/opendnssec-1.3.14-drop-privileges.patch,
+  +files/opendnssec-1.3.14-use-system-trang.patch,
+  +files/opendnssec.confd-1.3.x, +files/opendnssec.initd-1.3.x,
+  +opendnssec-1.3.14.ebuild, metadata.xml:
+  Restore and bump ebuild for (still maintained) 1.3 branch
 
 *opendnssec-1.4.1-r1 (23 Jul 2013)
 
diff --git a/net-dns/opendnssec/Manifest b/net-dns/opendnssec/Manifest
index 0f6b823ff5b2..b5ecea5a937d 100644
--- a/net-dns/opendnssec/Manifest
+++ b/net-dns/opendnssec/Manifest
@@ -1,20 +1,26 @@
 -----BEGIN PGP SIGNED MESSAGE-----
 Hash: SHA256
 
+AUX opendnssec-1.3.14-drop-privileges.patch 906 SHA256 faecb049748efab2652b890020106748039dbe7022d943393ac50b71b429b340 SHA512 cbc17153fcd617bcbc54a0b14111908635dae722f845f894d9c6769d77960433fa75c3ec0a5061af054167b4223f7f2946c3e3ba09c2bb55598f72f71d1c2106 WHIRLPOOL da7588424ce440bc302d8acacff2f702e623fe32682b1ddcd4674209f15dbcf8606ad35f59fc2d60e397d8618a7b59b1a56503b1b23a210f924e07dec51f6f16
+AUX opendnssec-1.3.14-use-system-trang.patch 706 SHA256 c704b8e232c950166131be6e70c7b48ff4f57800de7dae2a08012ef5d945f4c7 SHA512 e7d664f6ee548efeae7a015ceaf21b3fedc7654ed295ecd2440b0212015c1556b4f1bac978a2f804e7b6830181273484b428e1a363989eff067a9b3587937b7f WHIRLPOOL 92ffcd46ffaa6a7583114237a58bf634cf26445f3fe023be347f63bd88a0560371d7e89aa820e2fb7c6a6a971a4fee1bb281424baa6f6ce895c0db62d9d60146
 AUX opendnssec-drop-privileges.patch 641 SHA256 9bc831bf45a022a9be1a2bd6ee80d9e06fa4d5cdf553ae7dfd50e3a592e5b8dd SHA512 60cb666d821ae8880ccb789f8d2b60ea218a98e1b7b9393d8dc299be55efbd93efb9334ebf5cbf55f67ef1c58df1206dce906994bd9808e3db5a5bf9644a7f06 WHIRLPOOL 90f55f6572933e4c1042076aaa42a9cd19cd7e4c0e7a0598c8ae6cb22e0c7dcc6cd18fa408e2ed80eaadccefa39b4928c59e8bf0ae3398c948092828f9342ebf
 AUX opendnssec-fix-localstatedir.patch 1693 SHA256 e9a29b3adf22ef6dd3a0ac43d2a48e2705ae09cd7550b4f3294b89dcd7814ecd SHA512 86700c97bb482f5fa6d99fe8f105c41e8798de542e6cf5fd4d6c14da11237e4fd11eccb2900de4893898d7855e31beb6572c709c2dad9774d5fe440673af2627 WHIRLPOOL 56c5e876e2e2832265474c3772a44efa288eb387438a6864d85956a990f9cedc81e60dc7922448d647702359e835c0fef7db1d6d5e643b195cd6ad26117c3f53
 AUX opendnssec-fix-run-dir.patch 1272 SHA256 cb0fdf4100ba41421e61b7981bd64a1f0b7f2ed8f3d7b10d8a1647003584e26c SHA512 1745430b2c12f4888e20a86a20a87f9c61e0e5fc59e71885cb8d3b0a76380bac931311593822edd1d6b8010d8de4260c9c0e68469529bb0eefc21d2909e9e2f7 WHIRLPOOL 36cd4c1bda088ab20fddae32b5f3f6a4e48cce1dc075ecbba01baa98ad7b7b2fb40ef47e8eb1315ebe63c87ac444b74480341ed95294eb425c8a5db4bb8122eb
 AUX opendnssec-use-system-trang.patch 614 SHA256 7e8485e0f8ff1df5f9f799b908c802cf3670ecfcff6e3bf858d69429638e86b4 SHA512 9e95943d145ce7a05e32af60a944c6ee6d74fdff0fa9f0ea233070b44567bce4f5ca6bde57411effa7bab192ec58face34cddf2c349ccff3b78fc66c1f35074d WHIRLPOOL 82282bc2fc7797ff946aee5cee6e182abde0b65283865a9b084613a0dba7e53762494197c7479a6324fc3c81c8c80acf9d0d8a898a183acfe6ab62cf2a6ed1e6
 AUX opendnssec.confd 513 SHA256 faafbd15573dd0454d1d2e1a893d8e0ea216fbc2edcb60b9b57e326d1406cac5 SHA512 4cdb4787dbdd1968c77285f7af038a54017baf82bacfecce4a1df97727f896289b91e4153d5c74e0f3a588451a4495db882167dcbb7ce9d526b9c2f55b007950 WHIRLPOOL 278f1ed6b50a210e63416735197c50796685568962bb9d4e4f357e6599cb7a7a596bc4a0e230da3583c04f61df4f8c209c6e935a6f06781963ff2f13cf7493ce
+AUX opendnssec.confd-1.3.x 600 SHA256 cfb69dec3475a84ff110402a0d843a914f7b7ba08b254d33bd1ad4c7aed93f6b SHA512 1293d0e5410fb043d0685d70e944accd77db2d3a592ba30a7504aec1860f89f6bd5b6d0b10de3a5c4b960c93377f57860e9882fa203ba67528a717b1524093a0 WHIRLPOOL 4b6a8def4d7f6dfa3f52ae272ccdfcdf4c146e3de763b7d3b10c92915ab53c215419a0c597077d721dc01000661a9dc4b7e12152bc96e29ea373969828248358
 AUX opendnssec.initd 1920 SHA256 c67619a509ebfe3e395ca2a0fb78567175ccc8e8b331a9b81bad31988ed5ad26 SHA512 62bb01fbe6ee6ff9c98368f888b9efa1bde2db0ad1b1dc5547e8b0d731905f0c038fadc5d810ae70f4e4c58337748d812dd46e0329b0392c4daa4200677ff629 WHIRLPOOL 241ac8b71daa74d20086a4875c0aa9b88d67c6985dc0aa099979bf2d0c82c122fd3dee4360c7f90bdbe9818badd28654ba287979b6b57a9634b9a816c1071199
+AUX opendnssec.initd-1.3.x 2803 SHA256 01fd87fc919e06c9518bd7cc42ef4fe0723447ab4c9c11388442800ff3067991 SHA512 ec4addd226b09ceb283037e777aed63f19aa9084f71fe2e2a7f3dc0cafbe12fd41b974e857eda5ebf0d7f9a5b4602044e0dcd7addd1fa6c8320683e5d1ecf785 WHIRLPOOL aa6b74b8f2f3d3ed4c928804f10836d0d2e1c3a058cd099121ba1ddb08a22caab386170203b63fee35463cfb9fd740e58682ded4c84e6bede9b9d0fb78a0311b
+DIST opendnssec-1.3.14.tar.gz 1159293 SHA256 04016069f980191fac446ccab51f06bc7969d7544997c9e538ca1c170c2f42f5 SHA512 8f61f1eb0bb799d2e4bcd0a1ca1b8b0a111b050d38365b189363e76d7f9c105511833838cf91faa8eb32f34697cd5743f48af0c540ca85cbe6eaf5cc3305cb56 WHIRLPOOL 77d0e9cef2bb9434980bac24329fcd3a939053f5a50b5271d53333fe5ef7e04521d6bdc2e7b31185abaac8b7eb287ee7c90894566dc891a7015da4cd4b8c8cf6
 DIST opendnssec-1.4.1.tar.gz 988263 SHA256 7795ba9f98f9c8292d5f9f9d6ffbf88352a6f77986f43acc1a30141f6027cc82 SHA512 f11f52bc901eaf437ba30eaddceb8b2a4eb8b79f98c40362c22a43389203318980332dcbe05f0574f47f96185c5c9c8f7f29c2282adafa8a012f2d387f9ca90e WHIRLPOOL b1a2a3411c3b7f7ca3ef42eb73c919ca0ed7cff821aecd1f7ba76557dd905d9d3bf9f02cd24c2651859e007ea4c2ce8e5c6bd50121c48ebeff720d42e3b02ffd
+EBUILD opendnssec-1.3.14.ebuild 5421 SHA256 b61f6ccedcd63454e6abf4ff74317d90951f2c2877f0fe7af472b9d014b9fdae SHA512 36e24f3bbcb7083779640588d58157ed88a170f0eeedbba079a456f9f56f4dfb0eb474f7b566bf419432f0e751be5121fe6e98813bb1e63d189e36d33298364b WHIRLPOOL e97ab3bb975de00307163f60e5dbd44a11f9b60c88ec293c3eb9d74f819f0fb1bc8edc4f9ab6f39800bc579be5de571da8898bd611e1c132b1eef888a1a33a17
 EBUILD opendnssec-1.4.1-r1.ebuild 6000 SHA256 3229ed12f7fd8c0486f9edaa9d36d87b016e4fb75d057d3764dacb531d6de8cf SHA512 4bab5a3e5b4089fd5f8163e87e9c24c93ea2d14ec889f80bedbf01c20155e5fca9844367de81bb434478c213f25fd8f69dcdd684f1f48630da62a1ad5152358b WHIRLPOOL f5e1db5414788a1540d8c064fcf391e8266a10efe78ba222dbca0f9dd5750cf243800ecd3ba512e9a930403bf6522a06ab390f8815da58a21a865cda17aef340
-MISC ChangeLog 5910 SHA256 76159c8ffa50b22b709489bddd9a852884551f683b5fed627bced064a4a927f6 SHA512 d0c832285756891b6ec3e94344f71e7eb6fcd9458baf050cb6374c949633628096f7e17875cd4e6f49ad361373abc680d9bffe83fb93bef3e9ca81822cc20eac WHIRLPOOL 4c4d37ae4c7b4bda9ebc81dc4f45f562367d482ca142e4a5e2880843df79fb69f3476cfc45f3d7eba17d8c9d681012d87c75d5d715e30863412815b5db57633d
-MISC metadata.xml 704 SHA256 a6c48088b1c1acfc99e4f92ca344f2658fce3f898071a6450acfa5ae18faf37d SHA512 519f896fd7a19174a3185a9b19df020975e11d111299eea1475a27339a9d7bf113052182c38d9e4145f0284b1a88171efee9e6da5b3ba155088a9b80323671b3 WHIRLPOOL 86e5d71fe499f9ef1b9fa81a1060e2df8e6895922cebb048ab2344a01471aa3944fcbe32f57e7709cd71f9a2301a561dd0c122465a9965f97beb973f1ec160af
+MISC ChangeLog 6266 SHA256 9b0538234f9b18e9212266a84cc1f75ae5f97bf1468193667defd6c9d9c5ba00 SHA512 57cae945a7d4319cb27d41877c86121faa53adf9dbc09e464952f4507969c86a44e3dc31df9a260ef3bdc6226023f5b066cbfe9b72413cbaa47a3e6ebbc2d249 WHIRLPOOL e969274826a863fc9f8b87847590e953c71d8d8847e85bf954acf1b23b0a3da201950d7f3edc6bbf7421db0e49f8bf067970820f61dd8aae1f73bfd6c0da4b3f
+MISC metadata.xml 893 SHA256 755ed5e90d93b36be4e037b1fd4f7a16ec640547307add3916047b949e48a2f5 SHA512 1d38e1358749b738329056cea9dd5b6ab50e6295ba5e6b43809ff0cb8da7c3de97d3a406de1e977f28f623b6c27411185419475eaf0268f9a29452a61049525b WHIRLPOOL c659bf7b14c9f6f4db912dac69a7ff0e417f67b85a1952d58b5b653329df0d8435fad466140c34abad40eb54200a85b29e9de233f52b586852447e20a14e6a96
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2.0.20 (GNU/Linux)
 
-iD8DBQFR7uD9KWxsyjWmQTQRCHW/AJ41lEfLGIYln9ANI+dMA0kuLh+dhACcDFQo
-jZX+YfkRxavicPwHLCe4g+c=
-=Ul58
+iD8DBQFR7uJZKWxsyjWmQTQRCKBbAJ9e13XzTB+2uHeaqYIdrIiRTcCYAQCfSmFD
+7e3Jx8YDD39EaNwdJAJee+4=
+=P/wN
 -----END PGP SIGNATURE-----
diff --git a/net-dns/opendnssec/files/opendnssec-1.3.14-drop-privileges.patch b/net-dns/opendnssec/files/opendnssec-1.3.14-drop-privileges.patch
new file mode 100644
index 000000000000..7c9f72355d20
--- /dev/null
+++ b/net-dns/opendnssec/files/opendnssec-1.3.14-drop-privileges.patch
@@ -0,0 +1,43 @@
+Index: conf/conf.xml.in
+===================================================================
+--- conf/conf.xml.in	(revision 3022)
++++ conf/conf.xml.in	(working copy)
+@@ -38,12 +38,10 @@
+ 	</Common>
+ 
+ 	<Enforcer>
+-<!--
+ 		<Privileges>
+ 			<User>opendnssec</User>
+ 			<Group>opendnssec</Group>
+ 		</Privileges>
+--->
+ 
+ 		<Datastore><SQLite>@OPENDNSSEC_STATE_DIR@/kasp.db</SQLite></Datastore>
+ 		<Interval>PT3600S</Interval>
+@@ -56,12 +54,10 @@
+ 	</Enforcer>
+ 
+ 	<Signer>
+-<!--
+ 		<Privileges>
+ 			<User>opendnssec</User>
+ 			<Group>opendnssec</Group>
+ 		</Privileges>
+--->
+ 
+ 		<WorkingDirectory>@OPENDNSSEC_STATE_DIR@/tmp</WorkingDirectory>
+ 		<WorkerThreads>8</WorkerThreads>
+@@ -80,12 +76,10 @@
+ 	</Signer>
+ 
+ 	<Auditor>
+-<!--
+ 		<Privileges>
+ 			<User>opendnssec</User>
+ 			<Group>opendnssec</Group>
+ 		</Privileges>
+--->
+ 
+ 		<WorkingDirectory>@OPENDNSSEC_STATE_DIR@/tmp</WorkingDirectory>
+ 	</Auditor>
diff --git a/net-dns/opendnssec/files/opendnssec-1.3.14-use-system-trang.patch b/net-dns/opendnssec/files/opendnssec-1.3.14-use-system-trang.patch
new file mode 100644
index 000000000000..39678408264a
--- /dev/null
+++ b/net-dns/opendnssec/files/opendnssec-1.3.14-use-system-trang.patch
@@ -0,0 +1,21 @@
+diff -urN opendnssec-1.3.0rc3.old/conf/Makefile.am opendnssec-1.3.0rc3/conf/Makefile.am
+--- opendnssec-1.3.0rc3.old/conf/Makefile.am	2011-07-01 21:15:25.000000000 +0200
++++ opendnssec-1.3.0rc3/conf/Makefile.am	2011-07-01 21:17:00.000000000 +0200
+@@ -7,7 +7,7 @@
+ XML =	conf.xml kasp.xml zonelist.xml signconf.xml zonefetch.xml
+ XSL=	kasp2html.xsl
+ 
+-TRANG=	$(srcdir)/trang/trang.jar
++TRANG=	/usr/bin/trang
+ 
+ sysconfdir = @sysconfdir@/opendnssec
+ datadir = @datadir@/opendnssec
+@@ -25,7 +25,7 @@
+ .rnc.rng:
+ 	@test -x "${JAVA}" || \
+ 		(echo "java is required for converting RelaxNG Compact to RelaxNG"; false)
+-	${JAVA} -jar ${TRANG} $< $@
++	${TRANG} $< $@
+ 
+ regress: $(RNG)
+ 	@test -x "${XMLLINT}" || \
diff --git a/net-dns/opendnssec/files/opendnssec.confd-1.3.x b/net-dns/opendnssec/files/opendnssec.confd-1.3.x
new file mode 100644
index 000000000000..6cde1ba9cd54
--- /dev/null
+++ b/net-dns/opendnssec/files/opendnssec.confd-1.3.x
@@ -0,0 +1,14 @@
+# Copyright 1999-2013 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/net-dns/opendnssec/files/opendnssec.confd-1.3.x,v 1.1 2013/07/23 20:06:48 mschiff Exp $
+
+# Variables containing default binaries used in the opendnssec
+# initscript. You can alter them to another applications/paths
+# if required.
+
+CHECKCONFIG_BIN=/usr/bin/ods-kaspcheck
+CONTROL_BIN=/usr/sbin/ods-control
+ENFORCER_BIN=/usr/sbin/ods-enforcerd
+SIGNER_BIN=/usr/sbin/ods-signerd
+EPPCLIENT_BIN=/usr/sbin/eppclientd
+EPPCLIENT_PIDFILE=/run/opendnssec/eppclientd.pid
diff --git a/net-dns/opendnssec/files/opendnssec.initd-1.3.x b/net-dns/opendnssec/files/opendnssec.initd-1.3.x
new file mode 100644
index 000000000000..dd11b0f757a1
--- /dev/null
+++ b/net-dns/opendnssec/files/opendnssec.initd-1.3.x
@@ -0,0 +1,120 @@
+#!/sbin/runscript
+# Copyright 1999-2013 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/net-dns/opendnssec/files/opendnssec.initd-1.3.x,v 1.1 2013/07/23 20:06:48 mschiff Exp $
+
+description="An open-source turn-key solution for DNSSEC"
+
+depend() {
+	need net
+	use logger
+}
+
+checkconfig() {
+	if [ -x "${CHECKCONFIG_BIN}" ]; then
+		output=$(${CHECKCONFIG_BIN} 2>&1| grep -v -E "^/etc/opendnssec/(conf|kasp).xml validates")
+		if [ -n "$output" ]; then
+			echo $output
+		fi
+
+		errors=$(echo $output | grep ERROR | wc -l)
+		if [ $errors -gt 0 ]; then
+			ewarn "$errors error(s) found in OpenDNSSEC configuration."
+		fi
+		return $errors
+	fi
+	eerror "Unable to execute ${CHECKCONFIG_BIN:-config binary}"
+	# can't validate config, just die
+	return 1
+}
+
+
+start_enforcer() {
+	if [ -n "${ENFORCER_BIN}" ] && [ -x "${ENFORCER_BIN}" ]; then
+		ebegin "Starting OpenDNSSEC Enforcer"
+		${CONTROL_BIN} enforcer start > /dev/null
+		eend $?
+	else
+		if [ -n "${ENFORCER_BIN}" ]; then
+			eerror "OpenDNSSEC Enforcer binary not executable"
+			return 1
+		fi
+		einfo "OpenDNSSEC Enforcer not used."
+	fi
+}
+
+stop_enforcer() {
+	if [ -x "${ENFORCER_BIN}" ]; then
+		ebegin "Stopping OpenDNSSEC Enforcer"
+		${CONTROL_BIN} enforcer stop > /dev/null
+		eend $?
+	fi
+}
+
+start_signer() {
+	if [ -n "${SIGNER_BIN}" ] && [ -x "${SIGNER_BIN}" ]; then
+		ebegin "Starting OpenDNSSEC Signer"
+		${CONTROL_BIN} signer start > /dev/null 2>&1
+		eend $?
+	else
+		if [ -n "${SIGNER_BIN}" ]; then
+			eerror "OpenDNSSEC Signer binary not executable"
+			return 1
+		fi
+		einfo "OpenDNSSEC Signer not used."
+	fi
+}
+
+stop_signer() {
+	if [ -x "${SIGNER_BIN}" ]; then
+		ebegin "Stopping OpenDNSSEC Signer"
+		${CONTROL_BIN} signer stop > /dev/null 2>&1
+		eend $?
+	fi
+}
+
+start_eppclient() {
+	if [ -n "${EPPCLIENT_BIN}" ] && [ -x "${EPPCLIENT_BIN}" ]; then
+		ebegin "Starting OpenDNSSEC Eppclient"
+		start-stop-daemon \
+			--start \
+			--user opendnssec --group opendnssec \
+			--exec "${EPPCLIENT_BIN}" \
+			--pidfile "${EPPCLIENT_PIDFILE}" > /dev/null
+		eend $?
+	else
+		# eppclient is ofptional so if we use the default binary and it
+		# is not used we won't die
+		if [ -n "${EPPCLIENT_BIN}" ] && \
+				[ "${EPPCLIENT_BIN}" != "/usr/sbin/eppclientd" ]; then
+			eerror "OpenDNSSEC Eppclient binary not executable"
+			return 1
+		fi
+		einfo "OpenDNSSEC Eppclient not used."
+	fi
+}
+
+stop_eppclient() {
+	if [ -x "${EPPCLIENT_BIN}" ]; then
+		ebegin "Stopping OpenDNSSEC Eppclient"
+		start-stop-daemon \
+			--stop \
+			--exec "${EPPCLIENT_BIN}" \
+			--pidfile "${EPPCLIENT_PIDFILE}" > /dev/null
+		eend $?
+	fi
+}
+
+start() {
+	checkconfig || return $?
+	start_enforcer || return $?
+	start_signer || return $?
+	start_eppclient || return $?
+}
+
+stop() {
+	stop_eppclient
+	stop_signer
+	stop_enforcer
+	sleep 5
+}
diff --git a/net-dns/opendnssec/metadata.xml b/net-dns/opendnssec/metadata.xml
index b7a8529a61e3..90d860ca7097 100644
--- a/net-dns/opendnssec/metadata.xml
+++ b/net-dns/opendnssec/metadata.xml
@@ -5,6 +5,8 @@
 		<email>mschiff@gentoo.org</email>
 	</maintainer>
 	<use>
+		<flag name='auditor'>Enables auditing capabilities for OpenDNSSEC</flag>
+		<flag name='eppclient'>Enables support for automatic submission of DNSSEC keys to an upstream epp server</flag>
 		<flag name='signer'>Enables signing capabilities for OpenDNSSEC</flag>
 		<flag name='opensc'>Enables support for storing DNSSEC keys through a <pkg>dev-libs/opensc</pkg> PKCS#11 interface</flag>
 		<flag name='softhsm'>Enables support for storing DNSSEC keys in a <pkg>dev-libs/softhsm</pkg> PKCS#11 object</flag>
diff --git a/net-dns/opendnssec/opendnssec-1.3.14.ebuild b/net-dns/opendnssec/opendnssec-1.3.14.ebuild
new file mode 100644
index 000000000000..0d3ed90642ff
--- /dev/null
+++ b/net-dns/opendnssec/opendnssec-1.3.14.ebuild
@@ -0,0 +1,194 @@
+# Copyright 1999-2013 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/net-dns/opendnssec/opendnssec-1.3.14.ebuild,v 1.1 2013/07/23 20:06:48 mschiff Exp $
+
+EAPI=4
+
+MY_P="${P/_}"
+PKCS11_IUSE="+softhsm opensc external-hsm"
+inherit base autotools multilib user
+
+DESCRIPTION="An open-source turn-key solution for DNSSEC"
+HOMEPAGE="http://www.opendnssec.org/"
+SRC_URI="http://www.${PN}.org/files/source/${MY_P}.tar.gz"
+
+LICENSE="BSD GPL-2"
+SLOT="0"
+KEYWORDS="~amd64 ~x86"
+IUSE="auditor +curl debug doc eppclient mysql +signer +sqlite test ${PKCS11_IUSE}"
+
+RDEPEND="
+	dev-lang/perl
+	dev-libs/libxml2
+	dev-libs/libxslt
+	>=net-libs/ldns-1.6.12
+	auditor? ( dev-lang/ruby[ssl] dev-ruby/dnsruby )
+	curl? ( net-misc/curl )
+	mysql? (
+		virtual/mysql
+		dev-perl/DBD-mysql
+	)
+	opensc? ( dev-libs/opensc )
+	softhsm? ( dev-libs/softhsm )
+	sqlite? (
+		dev-db/sqlite:3
+		dev-perl/DBD-SQLite
+	)
+"
+DEPEND="${RDEPEND}
+	doc? ( app-doc/doxygen )
+	test? (
+		app-text/trang
+	)
+"
+# test? dev-util/cunit # Requires running test DB
+
+REQUIRED_USE="
+	^^ ( mysql sqlite )
+	^^ ( softhsm opensc external-hsm )
+	eppclient? ( curl )
+"
+
+PATCHES=(
+	"${FILESDIR}/${PN}-fix-localstatedir.patch"
+	"${FILESDIR}/${PN}-fix-run-dir.patch"
+	"${FILESDIR}/${PN}-1.3.14-drop-privileges.patch"
+	"${FILESDIR}/${PN}-1.3.14-use-system-trang.patch"
+)
+
+S="${WORKDIR}/${MY_P}"
+
+DOCS=( MIGRATION NEWS README )
+
+check_pkcs11_setup() {
+	# PKCS#11 HSM's are often only available with proprietary drivers not
+	# available in portage tree.
+
+	if use softhsm; then
+		PKCS11_LIB=softhsm
+		if has_version ">=dev-libs/softhsm-1.3.1"; then
+			PKCS11_PATH=/usr/$(get_libdir)/softhsm/libsofthsm.so
+		else
+			PKCS11_PATH=/usr/$(get_libdir)/libsofthsm.so
+		fi
+		elog "Building with SoftHSM PKCS#11 library support."
+	fi
+	if use opensc; then
+		PKCS11_LIB=opensc
+		PKCS11_PATH=/usr/$(get_libdir)/opensc-pkcs11.so
+		elog "Building with OpenSC PKCS#11 library support."
+	fi
+	if use external-hsm; then
+		if [[ -n ${PKCS11_SCA6000} ]]; then
+			PKCS11_LIB=sca6000
+			PKCS11_PATH=${PKCS11_SCA6000}
+		elif [[ -n ${PKCS11_ETOKEN} ]]; then
+			PKCS11_LIB=etoken
+			PKCS11_PATH=${PKCS11_ETOKEN}
+		elif [[ -n ${PKCS11_NCIPHER} ]]; then
+			PKCS11_LIB=ncipher
+			PKCS11_PATH=${PKCS11_NCIPHER}
+		elif [[ -n ${PKCS11_AEPKEYPER} ]]; then
+			PKCS11_LIB=aepkeyper
+			PKCS11_PATH=${PKCS11_AEPKEYPER}
+		else
+			ewarn "You enabled USE flag 'external-hsm' but did not specify a path to a PKCS#11"
+			ewarn "library. To set a path, set one of the following environment variables:"
+			ewarn "  for Sun Crypto Accelerator 6000, set: PKCS11_SCA6000=<path>"
+			ewarn "  for Aladdin eToken, set: PKCS11_ETOKEN=<path>"
+			ewarn "  for Thales/nCipher netHSM, set: PKCS11_NCIPHER=<path>"
+			ewarn "  for AEP Keyper, set: PKCS11_AEPKEYPER=<path>"
+			ewarn "Example:"
+			ewarn "  PKCS11_ETOKEN=\"/opt/etoken/lib/libeTPkcs11.so\" emerge -pv opendnssec"
+			ewarn "or store the variable into /etc/make.conf"
+			die "USE flag 'external-hsm' set but no PKCS#11 library path specified."
+		fi
+		elog "Building with external PKCS#11 library support ($PKCS11_LIB): ${PKCS11_PATH}"
+	fi
+}
+
+pkg_pretend() {
+	local i
+
+	for i in eppclient mysql; do
+		if use ${i}; then
+			ewarn "Usage of ${i} is considered experimental."
+			ewarn "Do not report bugs against this feature."
+		fi
+	done
+
+	check_pkcs11_setup
+}
+
+pkg_setup() {
+	enewgroup opendnssec
+	enewuser opendnssec -1 -1 -1 opendnssec
+
+	# pretend does not preserve variables so we need to run this once more
+	check_pkcs11_setup
+}
+
+src_prepare() {
+	base_src_prepare
+	eautoreconf
+}
+
+src_configure() {
+	# $(use_with test cunit "${EPREFIX}/usr/") \
+	econf \
+		--without-cunit \
+		--localstatedir="${EPREFIX}/var/" \
+		--disable-static \
+		--with-database-backend=$(use mysql && echo "mysql")$(use sqlite && echo "sqlite3") \
+		--with-pkcs11-${PKCS11_LIB}=${PKCS11_PATH} \
+		$(use_with curl) \
+		$(use_enable auditor) \
+		$(use_enable debug timeshift) \
+		$(use_enable eppclient) \
+		$(use_enable signer)
+}
+
+src_compile() {
+	default
+	use doc && emake docs
+}
+
+src_install() {
+	default
+
+	# remove useless .la files
+	find "${ED}" -name '*.la' -delete
+
+	# Remove subversion tags from config files to avoid useless config updates
+	sed -i \
+		-e '/<!-- \$Id:/ d' \
+		"${ED}"/etc/opendnssec/* || die
+
+	# install update scripts
+	insinto /usr/share/opendnssec
+	use sqlite && doins enforcer/utils/migrate_keyshare_sqlite3.pl
+	use mysql && doins enforcer/utils/migrate_keyshare_mysql.pl
+
+	# fix permissions
+	fowners root:opendnssec /etc/opendnssec
+	fowners root:opendnssec /etc/opendnssec/{conf,kasp,zonelist,zonefetch}.xml
+	use eppclient && fowners root:opendnssec /etc/opendnssec/eppclientd.conf
+
+	fowners opendnssec:opendnssec /var/lib/opendnssec/{,signconf,unsigned,signed,tmp}
+	fowners opendnssec:opendnssec /run/opendnssec
+
+	# install conf/init script
+	newinitd "${FILESDIR}"/opendnssec.initd opendnssec
+	newconfd "${FILESDIR}"/opendnssec.confd opendnssec
+}
+
+pkg_postinst() {
+	if use softhsm; then
+		elog "Please make sure that you create your softhsm database in a location writeable"
+		elog "by the opendnssec user. You can set its location in /etc/softhsm.conf."
+		elog "Suggested configuration is:"
+		elog "    echo \"0:/var/lib/opendnssec/softhsm_slot0.db\" >> /etc/softhsm.conf"
+		elog "    softhsm --init-token --slot 0 --label OpenDNSSEC"
+		elog "    chown opendnssec:opendnssec /var/lib/opendnssec/softhsm_slot0.db"
+	fi
+}