head 1.7; access; symbols pkgsrc-2026Q1:1.7.0.102 pkgsrc-2026Q1-base:1.7 pkgsrc-2025Q4:1.7.0.100 pkgsrc-2025Q4-base:1.7 pkgsrc-2025Q3:1.7.0.98 pkgsrc-2025Q3-base:1.7 pkgsrc-2025Q2:1.7.0.96 pkgsrc-2025Q2-base:1.7 pkgsrc-2025Q1:1.7.0.94 pkgsrc-2025Q1-base:1.7 pkgsrc-2024Q4:1.7.0.92 pkgsrc-2024Q4-base:1.7 pkgsrc-2024Q3:1.7.0.90 pkgsrc-2024Q3-base:1.7 pkgsrc-2024Q2:1.7.0.88 pkgsrc-2024Q2-base:1.7 pkgsrc-2024Q1:1.7.0.86 pkgsrc-2024Q1-base:1.7 pkgsrc-2023Q4:1.7.0.84 pkgsrc-2023Q4-base:1.7 pkgsrc-2023Q3:1.7.0.82 pkgsrc-2023Q3-base:1.7 pkgsrc-2023Q2:1.7.0.80 pkgsrc-2023Q2-base:1.7 pkgsrc-2023Q1:1.7.0.78 pkgsrc-2023Q1-base:1.7 pkgsrc-2022Q4:1.7.0.76 pkgsrc-2022Q4-base:1.7 pkgsrc-2022Q3:1.7.0.74 pkgsrc-2022Q3-base:1.7 pkgsrc-2022Q2:1.7.0.72 pkgsrc-2022Q2-base:1.7 pkgsrc-2022Q1:1.7.0.70 pkgsrc-2022Q1-base:1.7 pkgsrc-2021Q4:1.7.0.68 pkgsrc-2021Q4-base:1.7 pkgsrc-2021Q3:1.7.0.66 pkgsrc-2021Q3-base:1.7 pkgsrc-2021Q2:1.7.0.64 pkgsrc-2021Q2-base:1.7 pkgsrc-2021Q1:1.7.0.62 pkgsrc-2021Q1-base:1.7 pkgsrc-2020Q4:1.7.0.60 pkgsrc-2020Q4-base:1.7 pkgsrc-2020Q3:1.7.0.58 pkgsrc-2020Q3-base:1.7 pkgsrc-2020Q2:1.7.0.54 pkgsrc-2020Q2-base:1.7 pkgsrc-2020Q1:1.7.0.34 pkgsrc-2020Q1-base:1.7 pkgsrc-2019Q4:1.7.0.56 pkgsrc-2019Q4-base:1.7 pkgsrc-2019Q3:1.7.0.52 pkgsrc-2019Q3-base:1.7 pkgsrc-2019Q2:1.7.0.50 pkgsrc-2019Q2-base:1.7 pkgsrc-2019Q1:1.7.0.48 pkgsrc-2019Q1-base:1.7 pkgsrc-2018Q4:1.7.0.46 pkgsrc-2018Q4-base:1.7 pkgsrc-2018Q3:1.7.0.44 pkgsrc-2018Q3-base:1.7 pkgsrc-2018Q2:1.7.0.42 pkgsrc-2018Q2-base:1.7 pkgsrc-2018Q1:1.7.0.40 pkgsrc-2018Q1-base:1.7 pkgsrc-2017Q4:1.7.0.38 pkgsrc-2017Q4-base:1.7 pkgsrc-2017Q3:1.7.0.36 pkgsrc-2017Q3-base:1.7 pkgsrc-2017Q2:1.7.0.32 pkgsrc-2017Q2-base:1.7 pkgsrc-2017Q1:1.7.0.30 pkgsrc-2017Q1-base:1.7 pkgsrc-2016Q4:1.7.0.28 pkgsrc-2016Q4-base:1.7 pkgsrc-2016Q3:1.7.0.26 pkgsrc-2016Q3-base:1.7 pkgsrc-2016Q2:1.7.0.24 pkgsrc-2016Q2-base:1.7 pkgsrc-2016Q1:1.7.0.22 pkgsrc-2016Q1-base:1.7 pkgsrc-2015Q4:1.7.0.20 pkgsrc-2015Q4-base:1.7 pkgsrc-2015Q3:1.7.0.18 pkgsrc-2015Q3-base:1.7 pkgsrc-2015Q2:1.7.0.16 pkgsrc-2015Q2-base:1.7 pkgsrc-2015Q1:1.7.0.14 pkgsrc-2015Q1-base:1.7 pkgsrc-2014Q4:1.7.0.12 pkgsrc-2014Q4-base:1.7 pkgsrc-2014Q3:1.7.0.10 pkgsrc-2014Q3-base:1.7 pkgsrc-2014Q2:1.7.0.8 pkgsrc-2014Q2-base:1.7 pkgsrc-2014Q1:1.7.0.6 pkgsrc-2014Q1-base:1.7 pkgsrc-2013Q4:1.7.0.4 pkgsrc-2013Q4-base:1.7 pkgsrc-2013Q3:1.7.0.2 pkgsrc-2013Q3-base:1.7 pkgsrc-2013Q2:1.6.0.2 pkgsrc-2013Q2-base:1.6 pkgsrc-2013Q1:1.5.0.8 pkgsrc-2013Q1-base:1.5 pkgsrc-2012Q4:1.5.0.6 pkgsrc-2012Q4-base:1.5 pkgsrc-2012Q3:1.5.0.4 pkgsrc-2012Q3-base:1.5 pkgsrc-2012Q2:1.5.0.2 pkgsrc-2012Q2-base:1.5 pkgsrc-2012Q1:1.4.0.4 pkgsrc-2012Q1-base:1.4 pkgsrc-2011Q4:1.4.0.2 pkgsrc-2011Q4-base:1.4 pkgsrc-2011Q3:1.3.0.6 pkgsrc-2011Q3-base:1.3 pkgsrc-2011Q2:1.3.0.4 pkgsrc-2011Q2-base:1.3 pkgsrc-2011Q1:1.3.0.2 pkgsrc-2011Q1-base:1.3 pkgsrc-2010Q4:1.2.0.6 pkgsrc-2010Q4-base:1.2 pkgsrc-2010Q3:1.2.0.4 pkgsrc-2010Q3-base:1.2 pkgsrc-2010Q2:1.2.0.2 pkgsrc-2010Q2-base:1.2 pkgsrc-base:1.1.1.1 TNF:1.1.1; locks; strict; comment @# @; 1.7 date 2013.08.22.11.05.45; author he; state Exp; branches; next 1.6; commitid JJagEJIESQ0Pjr2x; 1.6 date 2013.06.15.16.42.48; author pettai; state Exp; branches; next 1.5; commitid eLP7ZzZwnTQBoJTw; 1.5 date 2012.05.23.10.09.21; author pettai; state Exp; branches; next 1.4; 1.4 date 2011.12.12.09.07.22; author pettai; state Exp; branches; next 1.3; 1.3 date 2011.01.24.20.30.28; author pettai; state Exp; branches; next 1.2; 1.2 date 2010.06.16.00.19.08; author pettai; state Exp; branches; next 1.1; 1.1 date 2010.05.06.12.50.17; author pettai; state Exp; branches 1.1.1.1; next ; 1.1.1.1 date 2010.05.06.12.50.17; author pettai; state Exp; branches; next ; desc @@ 1.7 log @Update OpenDNSSEC from version 1.3.14nb1 to 1.4.1. Pkgsrc changes: * Get rid of ruby dependencies, since the validator is no longer included in OpenDNSSEC * Adapt PLIST to changes in installed files * Add a patch so that the database migration scripts are installed as part of the package Upstream notable changes: * SUPPORT-58: Extend ods-signer sign with -serial so that the user can specify the SOA serial to use in the signed zone [OPENDNSSEC-401]. * OPENDNSSEC-91: Make the keytype flag required when rolling keys Bugfixes: * SUPPORT-60: Fix datecounter in case inbound serial is higher than outbound serial [OPENDNSSEC-420]. * OPENDNSSEC-247: Signer Engine: TTL on NSEC3 was not updated on SOA Minimum change. * OPENDNSSEC-421: Signer Engine: Fix assertion error in case NSEC3 hash algorithm in signconf is not SHA1. * OPENDNSSEC-421: ods-kaspcheck: Check whether NSEC3 hash algorithm in kasp is valid. * Bugfix: The time when inbound serial is acquired was reset invalidly, could cause OpenDNSSEC wanting AXFR responses while requesting IXFR (thanks Stuart Lau). * Bugfix: Fix malform in Outbound IXFR/TCP subsequent packet (thanks Stuart Lau). * OPENDNSSEC-398: The ods-ksmutil key rollover command does not work correctly when rolling all keys using the -policy option @ text @$NetBSD: patch-aa,v 1.6 2013/06/15 16:42:48 pettai Exp $ Install sample configurations in another directory. --- conf/Makefile.in.orig 2013-06-27 08:04:17.000000000 +0000 +++ conf/Makefile.in @@@@ -299,6 +299,7 @@@@ sbindir = @@sbindir@@ sharedstatedir = @@sharedstatedir@@ srcdir = @@srcdir@@ sysconfdir = @@sysconfdir@@/opendnssec +EGDIR=@@EGDIR@@ target_alias = @@target_alias@@ top_build_prefix = @@top_build_prefix@@ top_builddir = @@top_builddir@@ @@@@ -568,19 +569,20 @@@@ regress: $(RNG) (echo "kasp.xml built") install-data-hook: - test -d ${DESTDIR}${sysconfdir} || mkdir -p ${DESTDIR}${sysconfdir} - test -f ${DESTDIR}${sysconfdir}/conf.xml || \ - ${INSTALL_DATA} -m 0640 conf.xml ${DESTDIR}${sysconfdir} - ${INSTALL_DATA} -m 640 conf.xml ${DESTDIR}${sysconfdir}/conf.xml.sample - test -f ${DESTDIR}${sysconfdir}/addns.xml || \ - ${INSTALL_DATA} addns.xml ${DESTDIR}${sysconfdir} - ${INSTALL_DATA} addns.xml ${DESTDIR}${sysconfdir}/addns.xml.sample - test -f ${DESTDIR}${sysconfdir}/zonelist.xml || \ - ${INSTALL_DATA} zonelist.xml ${DESTDIR}${sysconfdir} - ${INSTALL_DATA} zonelist.xml ${DESTDIR}${sysconfdir}/zonelist.xml.sample - test -f ${DESTDIR}${sysconfdir}/kasp.xml || \ - ${INSTALL_DATA} kasp.xml ${DESTDIR}${sysconfdir} - ${INSTALL_DATA} kasp.xml ${DESTDIR}${sysconfdir}/kasp.xml.sample + test -d ${DESTDIR}${EGDIR} || mkdir -p ${DESTDIR}${EGDIR} + test -f ${DESTDIR}${EGDIR}/conf.xml || \ + ${INSTALL_DATA} -m 0640 conf.xml ${DESTDIR}${EGDIR} + ${INSTALL_DATA} -m 640 conf.xml ${DESTDIR}${EGDIR}/conf.xml.sample + test -f ${DESTDIR}${EGDIR}/addns.xml || \ + ${INSTALL_DATA} addns.xml ${DESTDIR}${EGDIR} + ${INSTALL_DATA} addns.xml ${DESTDIR}${EGDIR}/addns.xml.sample + test -f ${DESTDIR}${EGDIR}/zonelist.xml || \ + ${INSTALL_DATA} zonelist.xml ${DESTDIR}${EGDIR} + ${INSTALL_DATA} zonelist.xml ${DESTDIR}${EGDIR}/zonelist.xml.sample + test -f ${DESTDIR}${EGDIR}/kasp.xml || \ + ${INSTALL_DATA} kasp.xml ${DESTDIR}${EGDIR} + ${INSTALL_DATA} kasp.xml ${DESTDIR}${EGDIR}/kasp.xml.sample + # Tell versions [3.59,3.63) of GNU make to not export all variables. # Otherwise a system limit (for SysV at least) may be exceeded. @ 1.6 log @OpenDNSSEC 1.3.14 - 2013-05-16 * OPENDNSSEC-367: ods-ksmutil: Require user confirmation if the algorithm for a key is changed in a policy (as this rollover is not handled cleanly) * OPENDNSSEC-91: Make the keytype flag required when rolling keys * OPENDNSSEC-403: Signer Engine: new command 'ods-signer locks' that shows locking information (for debugging purposes). Bugfixes: * OPENDNSSEC-247: Signer Engine: TTL on NSEC3 was not updated on SOA Minimum change. * OPENDNSSEC-396: Use TTLs from kasp when generating DNSKEY and DS records for output. * OPENDNSSEC-398: The ods-ksmutil key rollover command does not work correctly when rolling all keys using the --policy option * SUPPORT-40: Signer Engine: Keep occluded data in signed zone files/transfers. @ text @d1 1 a1 1 $NetBSD: patch-aa,v 1.5 2012/05/23 10:09:21 pettai Exp $ d3 1 a3 1 Install the configuration examples in ${EGDIR} d5 1 a5 1 --- conf/Makefile.in.orig 2012-05-09 18:50:03.000000000 +0000 d7 2 a8 1 @@@@ -302,6 +302,7 @@@@ sharedstatedir = @@sharedstatedir@@ a9 1 subdirs = @@subdirs@@ d15 1 a15 1 @@@@ -563,19 +564,19 @@@@ regress: $(RNG) d23 3 a28 3 - test -f ${DESTDIR}${sysconfdir}/zonefetch.xml || \ - ${INSTALL_DATA} -m 0640 zonefetch.xml ${DESTDIR}${sysconfdir} - ${INSTALL_DATA} -m 640 zonefetch.xml ${DESTDIR}${sysconfdir}/zonefetch.xml.sample d36 3 a41 3 + test -f ${DESTDIR}${EGDIR}/zonefetch.xml || \ + ${INSTALL_DATA} -m 0640 zonefetch.xml ${DESTDIR}${EGDIR} + ${INSTALL_DATA} -m 640 zonefetch.xml ${DESTDIR}${EGDIR}/zonefetch.xml.sample d45 1 @ 1.5 log @OpenDNSSEC 1.3.8 * OPENDNSSEC-228: Signer Engine: Make 'ods-signer update' reload signconfs even if zonelist has not changed. * OPENDNSSEC-231: Signer Engine: Allow for Classless IN-ADDR.ARPA names (RFC 2317). * OPENDNSSEC-234: Enforcer: Add indexes for foreign keys in kasp DB. (sqlite only, MySQL already has them.) * OPENDNSSEC-246: Signer Engine: Warn if is in signer configuration, but ods-auditor is not installed * OPENDNSSEC-249: Enforcer: ods-ksmutil: If key export finds nothing to do then say so rather than display nothing which might be misinterpreted. Bugfixes: * OPENDNSSEC-247: Signer Engine: TTL on NSEC(3) was not updated on SOA Minimum change. * OPENDNSSEC-253: Enforcer: Fix "ods-ksmutil zone delete --all" @ text @d1 3 a3 1 $NetBSD$ @ 1.4 log @OpenDNSSEC 1.3.4 Bugfixes: * Signer: Use debug instead of warning for drudgers queue being full, also sleep 10 ms if it is full to not hog CPU. This increased signing speed on single core machines by a factor of 2. @ text @d1 1 a1 1 $NetBSD: patch-aa,v 1.3 2011/01/24 20:30:28 pettai Exp $ d3 1 a3 3 Install conf files in exampledir --- conf/Makefile.in.orig 2010-11-17 09:07:35.000000000 +0000 d5 1 a5 1 @@@@ -277,6 +277,7 @@@@ sharedstatedir = @@sharedstatedir@@ d13 1 a13 1 @@@@ -530,19 +531,19 @@@@ regress: $(RNG) d43 1 a45 1 .NOEXPORT: @ 1.3 log @ OpenDNSSEC 1.2.0: Bugfixes: * Enforcer: Fixed a number of build warnings. OpenDNSSEC 1.2.0rc3: * Moved migration instructions to the file MIGRATION Bugfixes: * Bugreport #199: The previous DB schema change made the zone removal broken. * Enforcer: When retiring old KSK, use TTL(ds) and not TTL(ksk). * Enforcer: Minimize the set of DS RRs sent to DelegationSignerSubmitCommand. * Enforcer: Replace tab with a space character in the DNSKEY printed to syslog. * Enforcer: Fixed pontential format string bug. * ods-ksmutil: Log to syslog when ds-seen changes a key to active/standby. * Signer Engine: Don't be smart with RRSIG TTLs, the hsm will set them for you. * Signer Engine: Set notify command for zone when receiving ods-signer update. * Signer Engine: Update TTL of NSEC(3) records if SOA Minimum has changed in KASP. * Signer Engine: Now logs to the correct facility. * Signer Engine: Also remove NSEC records when detecting changes in signconf * Signer Engine: Dropped privileges before starting Zonefetcher. OpenDNSSEC 1.2.0rc2: Bugfixes: * Signer Engine: Use the correct TTL for RRs after the $INCLUDE directive. * Signer Engine: Also create new signature if TTL of RR has changed. * Signer Engine: Drop old NSEC/NSEC3 records. * ods-ksmutil: Fixed some memory leaks. OpenDNSSEC 1.2.0rc1: * New commandline option for the signer: ods-signer running. * Allow connection to different MySQL ports in the Enforcer. * Tone down and explain warning when converting M or Y to seconds * ldns 1.6.7 is required for bugfixes * dnsruby 1.51 is required for bugfixes Bugfixes: * Bugreport #187: ods-control signer start will return non-zero if start up failed (uses ods-signer running). * Narrow glue at the zone cut is allowed, do not consider it as occluded. * Move zone fetcher output to correct input adapter file. * Enforcer shared keys on zones with ShareKeys disabled. * Make names of key states consistent. * Signer Engine file descriptor leak fix on engine.sock. * Set explicit "unlimited" repository capacity to prevent random integer being read. Requires "ods-ksmutil update conf" to be run if using an existing database. * Fix issue with key generation creating too many keys Ticket #194. * Bugreport #189: Auditor did not handle white-space-seperated substrings for base64 text * Bugreport #190: Auditor (and signer) does not handle case correctly * Signer now silence stdout-output from the notify command OpenDNSSEC 1.2.0b1: * A new signer engine, written in c. Zones are maintained in memory, instead of in files on disk. * Removed the python and python-4suite-xml dependencies. * Remove separate autoconf for libhsm/conf/enforcer. * Add option to disable building the signer. * Signer logs statistics just after outputting a new signed zone. * libhsm will skip processing (and not create) any public keys if the per repository option is set. * Keysharing improved - keys can now exist in different states on each zone that the key is in use for. * Backup prepare/commit/rollback added for 2-step backups without taking the enforcer offline. * Standby keys are now optional (default to 0) and should be considered experimental. Bugfixes: * Fix semantics of refresh value in Signer Engine. * Auditor handles chains of empty nonterminals correctly. * Recalculate salt immediately if the saltlength is changed. * libhsm connected to slot 0 if the token label was not found. An error is now returned instead of connecting to the slot. * Bugreport #102: Removed the obsoleted python-4suite-xml dependency. * Fixed Known Issue: KSK rollover requires manual timing. * Fixed Known Issue: Key rollover and reuse of signatures. * Fixed Known Issue: Issue with sharing keys and adding zones. * Fixed Known Issue: Quicksorter does not allow certain owner names (Quicksorter is removed, signer now reads and sorts the zone). @ text @d1 3 a3 1 $NetBSD: patch-aa,v 1.2 2010/06/16 00:19:08 pettai Exp $ @ 1.2 log @OpenDNSSEC 1.1.0: * Partial Auditor added * Dnsruby-1.46 required * Improved error messages when the system runs out of keys * Optimise communication of signconfs for multiple zones sharing keys. Group zones in zonelist.xml by policy to get this benefit. * Bugreport #101: Signer Engine now maintains its own pidfile. * Jitter redefined: now in the range of [-jitter, ..., +jitter] * Optimized sorter: quicksorter (sorter becomes obsolete). * Optimized zone_reader, includes nseccing/nsec3ing (nseccer and nsec3er become obsolete). * Enable database selection using --with-database-backend={sqlite3|mysql} * Enable the EPP-client using --enable-eppclient For sending DS RR to the parent zone (experimental) * Turn NSEC3 OptOut off by default * Install kasp2html XML stylesheet * Add simple kasp2html conversion script * DNSKEY records communicated to an external script if configured * The command 'ods-signer restart' is removed. * Signer Engine now also reuses signatures after a change in NSEC(3) configuration or rolling keys. * Quicksorter defaults to class IN. And a lot of bugfixes... @ text @d1 1 a1 1 $NetBSD: patch-aa,v 1.1.1.1 2010/05/06 12:50:17 pettai Exp $ d3 3 a5 4 --- conf/Makefile.in.orig 2009-12-19 21:39:52.000000000 +0100 +++ conf/Makefile.in 2009-12-19 21:43:40.000000000 +0100 @@@@ -166,6 +166,7 @@@@ sharedstatedir = @@sharedstatedir@@ d7 1 d13 1 a13 1 @@@@ -540,19 +541,19 @@@@ d19 2 a20 2 - ${INSTALL_DATA} -m 0640 ${top_builddir}/conf.xml ${DESTDIR}${sysconfdir} - ${INSTALL_DATA} -m 640 ${top_builddir}/conf.xml ${DESTDIR}${sysconfdir}/conf.xml.sample d22 2 a23 2 - ${INSTALL_DATA} ${top_builddir}/zonelist.xml ${DESTDIR}${sysconfdir} - ${INSTALL_DATA} ${top_builddir}/zonelist.xml ${DESTDIR}${sysconfdir}/zonelist.xml.sample d25 2 a26 2 - ${INSTALL_DATA} -m 0640 ${top_builddir}/zonefetch.xml ${DESTDIR}${sysconfdir} - ${INSTALL_DATA} -m 640 ${top_builddir}/zonefetch.xml ${DESTDIR}${sysconfdir}/zonefetch.xml.sample d28 2 a29 2 - ${INSTALL_DATA} ${top_builddir}/kasp.xml ${DESTDIR}${sysconfdir} - ${INSTALL_DATA} ${top_builddir}/kasp.xml ${DESTDIR}${sysconfdir}/kasp.xml.sample d32 2 a33 2 + ${INSTALL_DATA} -m 0640 ${top_builddir}/conf.xml ${DESTDIR}${EGDIR} + ${INSTALL_DATA} -m 640 ${top_builddir}/conf.xml ${DESTDIR}${EGDIR}/conf.xml.sample d35 2 a36 2 + ${INSTALL_DATA} ${top_builddir}/zonelist.xml ${DESTDIR}${EGDIR} + ${INSTALL_DATA} ${top_builddir}/zonelist.xml ${DESTDIR}${EGDIR}/zonelist.xml.sample d38 2 a39 2 + ${INSTALL_DATA} -m 0640 ${top_builddir}/zonefetch.xml ${DESTDIR}${EGDIR} + ${INSTALL_DATA} -m 640 ${top_builddir}/zonefetch.xml ${DESTDIR}${EGDIR}/zonefetch.xml.sample d41 2 a42 2 + ${INSTALL_DATA} ${top_builddir}/kasp.xml ${DESTDIR}${EGDIR} + ${INSTALL_DATA} ${top_builddir}/kasp.xml ${DESTDIR}${EGDIR}/kasp.xml.sample @ 1.1 log @Initial revision @ text @d1 1 a1 1 $NetBSD$ d13 1 a13 1 @@@@ -553,19 +554,19 @@@@ d17 2 a18 2 - test -d ${sysconfdir} || mkdir -p ${DESTDIR}${sysconfdir} - test -f ${sysconfdir}/conf.xml || \ d21 1 a21 1 - test -f ${sysconfdir}/zonelist.xml || \ d24 1 a24 1 - test -f ${sysconfdir}/zonefetch.xml || \ d27 1 a27 1 - test -f ${sysconfdir}/kasp.xml || \ a42 1 d45 1 @ 1.1.1.1 log @The OpenDNSSEC project announces the development of Open Source software that manages the security of domain names on the Internet. The project intends to drive adoption of Domain Name System Security Extensions (DNSSEC) to further enhance Internet security. @ text @@