OpenDNSSEC was created as an open-source turn-key solution for
DNSSEC. It secures zone data just before it is published in an
authoritative name server.
WWW: http://www.opendnssec.org
===> The following configuration options are available for opendnssec-1.4.14_3:
DOCS=on: Build and/or install documentation
SOFTHSM=off: SoftHSM cryptographic store for PKCS #11 interface
====> Options available for the single DB: you have to select exactly one of them
MYSQL=on: Use MYSQL backend
SQLITE=off: Use SQLite backend
===> Use 'make config' to modify these settings
Remove expired ports:
2020-10-09 sysutils/syslog-ng322: Agreed upon upstream one year deprecation
policy
2020-10-09 sysutils/syslog-ng321: Agreed upon upstream one year deprecation
policy
2020-10-09 sysutils/syslog-ng320: Agreed upon upstream one year deprecation
policy
2020-10-09 dns/opendnssec: EOLed by upstream
2020-10-09 sysutils/syslog-ng323: Agreed upon upstream one year deprecation
policy
dns/opendnssec: adding EOL message to opendnssec-1.4.14
The upstream has declared this soon to be EOL. The port is now updated
accordingly.
End-of-life announcement: https://www.opendnssec.org/2019/10/
OpenDNSSEC 2.1 was released in February 2017, and in the past
two-and-half year it has proven itself to be stable and viable
upgrade of 1.4, and has additional features and improvements.
Therefore we announce end-of-life of OpenDNSSEC 1.4. One of the steps
towards future releases with better experience and shorter cycles.
Starting today, October 8, 2019, in accordance with our policies,
we will only provide essential fixes and support until 9 October 2020,
(Only the first 15 lines of the commit message are shown above )
Bump PORTREVISION for ports depending on the canonical version of GCC
as defined in Mk/bsd.default-versions.mk which has moved from GCC 8.3
to GCC 9.1 under most circumstances now after revision 507371.
This includes ports
- with USE_GCC=yes or USE_GCC=any,
- with USES=fortran,
- using Mk/bsd.octave.mk which in turn features USES=fortran, and
- with USES=compiler specifying openmp, nestedfct, c11, c++0x, c++11-lang,
c++11-lib, c++14-lang, c++17-lang, or gcc-c++11-lib
plus, everything INDEX-11 shows with a dependency on lang/gcc9 now.
PR: 238330
dns/opendnssec: fix build with GCC-based architectures
Since the switch to MySQL 5.7, C11-aware compiler is required:
/usr/bin/ld: cannot find -latomic
Approved by: mentors (implicit approval)
dns/opendnssec: update 1.4.12 -> 1.4.14
- OPENDNSSEC-888: Fix up MySQL<->SQLite3 database conversion script.
- OPENDNSSEC-752: Incorrect calculated number of KSKs needed when
KSK and ZSK have exactly the same parameters. This would prevent
KSK rollovers.
- OPENDNSSEC-890: Bogus signatures on mismatching TTLs within the same RRset.
PR: 218994
Submitted by: Jaap Akkerhuis <jaap@NLnetLabs.nl> (maintainer)
dns/opendnssec: 1.4.9 -> 1.4.10
This release fix targets stability issues which have had a history and
have been hard to reproduce. Issues that have been reported over the
past half year have been fixed that may have even come up earlier as
rare occasions.
Stability should be improved, running OpenDNSSEC as a long term service.
Changes in TTL in the input zone that seem not to be propagated,
notifies to slaves under heavy zone activity load that where not handled
properly and could lead to assertions.
NSEC3PARAM that would appear duplicate in the resulting zone, and
crashes in the signer daemon in seldom race conditions or re-opening due
to a HSM reset.
(Only the first 15 lines of the commit message are shown above )
Move MySQL support from bsd.databases.mk to Uses/mysql.mk.
Also, USE_MYSQL can't happen after bsd.port.pre.mk because it is a USES.
PR: 208971
Submitted by: mat
Exp-run by: antoine
With hat: portmgr
Sponsored by: Absolight
Differential Revision: https://reviews.freebsd.org/D5951
Update to 1.4.9
The main motivations for this release are bug fixes related to use
cases with large number of zones (more than 50 zones) in combination
with an XFR based setup. Too much concurrent zone transfers causes new
transfers to be held back. These excess transfers however were not
properly scheduled for later.
No migration steps needed when upgrading from OpenDNSSEC 1.4.8.
Bugfixes:
* Add TCP waiting queue. Fix signer getting 'stuck' when adding many
zones at once. Thanks to Haavard Eidnes to bringing this to our attention.
* OPENDNSSEC-723: received SOA serial reported as on disk.
(Only the first 15 lines of the commit message are shown above )
Upgrade from version 1.4.7 to 1.4.8.2
NEWS:
* Support for RFC5011 style KSK rollovers. KSK section in the KASP now
accepts <RFC5011/> element.
* Enforcer: New repository option <AllowExtraction/> allows to generate
keys with CKA_EXTRACTABLE attribute set to TRUE so keys can be wrapped
and extracted from HSM.
Bugfixes:
* SUPPORT-145: EOF handling an ARM architecture caused signer to hang.
* Fixed signer hitting assertion on short reply XFR handler.
* Include revoke bit in keytag calculation.
* Increased stacksize on some systems (thanks Patrik Lundin!).
* Stop ods-signerd on SIGINT.
Fixes port problem (reported by *geoffroy desvernay*)
* Now also installs previous missing migration script convert_database.pl
PR: 203574
Submitted by: Jaap Akkerhuis <jaap@NLnetLabs.nl> (maintainer)
Sponsored by: DK Hostmaster A/S
- Display a stage-qa warning when ports use PREFIX/var instead of /var
- Add --localstatedir=/var to _LATE_CONFIGURE_ARGS (like --mandir) but not
when CONFIGURE_ARGS already sets it. (GNU configure scripts set it to
PREFIX/var when PREFIX != /usr.)
- Add --localstatedir="${PREFIX}/var" to CONFIGURE_ARGS in some ports so
they aren't affected by this change (for now at least). This commit is
meant to ensure that new ports don't make the same mistake.
- games/acm: the configure script in this port is very old; instead of
patching it more, just replace GNU_CONFIGURE with HAS_CONFIGURE.
- irc/charybdis: it already used /var but adding --localstatedir=/var
changed the behaviour of the configure script; adjust the port to this.
PR: 199506
Exp-run by: antoine
Approved by: portmgr (antoine)
- Fix location of libsofthsm.so [1]
- Fix depency on sqlite with non-default LOCALBASE [2]
- Update to 1.4.6
Updates:
Signer Engine: Print secondary server address when logging notify reply errors.
Build: Fixed various OpenBSD compatibility issues found by Patrik Lundin
<patrik.lundin.swe () gmail.com>.
OPENDNSSEC-621: conf.xml: New options: <PidFile> for both enforcer and signer,
and <SocketFile> for the signer.
New tool: ods-getconf: to retrieve a configuration value from conf.xml given an
expression.
Bugfixes:
OPENDNSSEC-469: ods-ksmutil: 'zone add' command when zonelist.xml.backup can't
be written zone is still added to database, solved it by checking the
zonelist.xml.backup is writable before adding zones, and add error message when
add zone failed.
OPENDNSSEC-617: Signer Engine: Fix DNS Input Adapter to not reject zone the
first time due to RFC 1982 serial arethmetic.
OPENDNSSEC-619: memory leak when signer failed, solved it by add
ldns_rr_free(signature) in libhsm.c
OPENDNSSEC-627: Signer Engine: Unable to update serial after restart when the
backup files has been removed.
OPENDNSSEC-628: Signer Engine: Ingored notifies log level is changed from debug
to info.
OPENDNSSEC-630: Signer Engine: Fix inbound zone transfer for root zone.
libhsm: Fixed a few other memory leaks.
simple-dnskey-mailer.sh: Fix syntax error. (by Patrik Lundin
https://github.com/eest)
PR: 191272 [1], 192021 [2], 192023 [3]
Submitted by: Andrew Fyfe <andrew@neptune-one.net> [1],
jhujhiti@adjectivism.org [2],
Jaap Akkerhuis <jaap@NLnetLabs.nl> (maintainer) [3]
Fix some outstanding issues with staging and make it work with both
pkg_install and pkgng.
PR: 189823
Submitted by: erwin
Prodded by: swills
Approved by: Jaap Akkerhuis <jaap@NLnetLabs.nl> (maintainer)
- Update to 1.4.5
Added Staging support;
Modern options handling where possible.
Bugfixes:
OPENDNSSEC-607: libhsm not using all mandatory attributes for GOST key
generation.
OPENDNSSEC-609: ods-ksmutil: 'key list' command fails with error in 1.4.4 on
MySQL. Reported by Mark Elkins <mje@posix.co.za>
Includes the update to 1.4.4:
Updates:
SUPPORT-114: libhsm: Optimize storage in HSM by deleting the public key directly
if SkipPublicKey is used [OPENDNSSEC-574].
(Only the first 15 lines of the commit message are shown above )
The FreeBSD x11@ and graphics team proudly presents
a zeising, kwm production, with help from dumbbell, bdrewery:
NEW XORG ON FREEBSD 9-STABLE AND 10-STABLE
This update switches over to use the new xorg stack by default on FreeBSD 9
and 10 stable, on osversions where vt(9) is available.
It is still possible to use the old stack by specifying WITHOUT_NEW_XORG in
/etc/make.conf .
FreeBSD 8-STABLE and released versions of FreeBSD still use
the old version.
A package repository with binary packages for new xorg will
be available soon.
This patch also contains updates of libxcb and related ports, pixman, as well
(Only the first 15 lines of the commit message are shown above )
- Update ldns to 1.6.15 [1]
- Add an entry to UPDATING about binary incompatibility in previous version of
ldns
- Fix OptionsNG
- Bump PORTREVISION for all ports dependent on dns/ldns
- Remove ABI version numbers from LIB_DEPENDS while I'm here
PR: ports/173080 [1]
Submitted by: Jaap Akkerhuis <jaap@NLnetLabs.nl> (maintainer) [1]
Approved by: portmgr (erwin)
Feature safe: yes
In the rc.d scripts, change assignments to rcvar to use the
literal name_enable wherever possible, and ${name}_enable
when it's not, to prepare for the demise of set_rcvar().
In cases where I had to hand-edit unusual instances also
modify formatting slightly to be more uniform (and in
some cases, correct). This includes adding some $FreeBSD$
tags, and most importantly moving rcvar= to right after
name= so it's clear that one is derived from the other.
OpenDNSSEC was created as an open-source turn-key solution for
DNSSEC. It secures zone data just before it is published in an
authoritative name server.
WWW: http://www.opendnssec.org
PR: ports/142103
Submitted by: Jaap Akkerhuis <jaap@NLnetLabs.nl>
