kpriv/pkgsrc-wip
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
pkgsrc-wip/opendnssec/Makefile

96 lines
2.7 KiB
Makefile
Raw Normal View History

OpenDNSSEC 1.0.0rc2 - 2009-12-16 Bugfixes: * Signer Engine: Signer processes could remain open, if they were not close correctly. * ods-ksmutil: Got a segmentation fault, when an HSM was missing in the configuration. Only applied to versions using MySQL. * Zone fetcher: Did not close files before moving them. * Zone fetcher: The serial arithmetic was not correct. * Auditor: It now ignores unrecognized RR types. * Signer Engine: Wrong handling of escaped characters in strings (fixed in ldns trunk) * Set correct permissions on the configuration files. Known issues: * Zone fetcher: When using TSIG, an incorrect MAC can be created if the length of the used secret is 'too long' (longer than the maximum digest length). This problem is in LDNS 1.6.3 and previous versions. This bug is fixed in the upcoming LDNS 1.6.4 release. * Auditor: Some good NAPTR records may fail to verify with dnsruby-1.41. This will be fixed in a future dnsruby release. * TXT RRs: Some TXT RRs with escape characters may fail to parse correctly with dnsruby-1.41 and ldns 1.6.3. This is fixed in the upcoming releases. OpenDNSSEC 1.0.0rc1 - 2009-12-04 * Auditor: dnsruby-1.41 should be used (includes fixes for zero length salt and RFC3597 unknown classes) * Signer Engine: ldns 1.6.3 should be used (includes NSEC3 bugfix and class inheritance when creating signatures) Bugfixes: * Signer Engine: 1.0.0b8 introduced a bug that no signatures where reused. Re-fixed. * Signer Engine: Fix ods-signer start (could hang on MacOSX) * Signer Engine: Mark a zone in progress if in use by one of the tools. Prevents multiple tasks being created for the same zone. * Signer Engine: Dropped records when zone content changed. * Signer Engine: Drop inherited groups and set additional groups when dropping privileges. * Zone fetcher: Clean up empty files if AXFR failed * Zone fetcher: Make syslogging RFC-compliant
2009-12-19 22:44:23 +01:00
# $NetBSD: Makefile,v 1.18 2009/12/19 21:44:23 pettai Exp $
The OpenDNSSEC project announces the development of Open Source software that manages the security of domain names on the Internet. The project intends to drive adoption of Domain Name System Security Extensions (DNSSEC) to further enhance Internet security. The Features of OpenDNSSEC - No manual management is needed (after first configuration) - Works with all different versions of the Unix operating system - Multiple zones with shared or individual policies - Each policy specifies a set of key and signature settings - Handle zone sizes ranging from a few RRs to millions of RRs - Unsigned zone file in and signed zone file out. - Supports RSA/SHA1 signatures ? ready for future algorithms (e.g.RSA/SHA2, GOST) - Denial of existence using NSEC or NSEC3 - Automatic key generation in HSMs via the PKCS#11 interface - Option support for sharing keys between zones - Automatic key rollover - Possibility of manual key rollover (emergency key rollover) - Automatic zone signing using HSMs via the PKCS#11 interface - Auditing of the signing process and result - BSD license
2009-09-27 01:46:33 +02:00
#
* kasp_check command added to check the conf.xml and kasp.xml configuration files for sanity and consistency * communicated and keygend combined to form "enforcerd" (although this name will change). * ksmutil command line changes. Most commands have changed slightly, some have changed lots. See http://svn.opendnssec.org/docs/command-tools-syntax.txt . * enforcer database now has a version number. If it differs from a #define in the code then the software will not connect to the database. * "ksmutil list keys" now displays the keytag if the -l flag is passed to it. * "Emergency Keys" renamed to "Standby Keys" as this better reflects their role as we use them. * The behaviour of SOA Serial value 'counter' changed according to Ticket #31. * changes to the KASP DB, please apply: If want to use your old database, use the following commands to upgrade: sqlite3 <PATH_TO_ENFORCER.DB> < enforcer/utils/migrate_090922_1.sqlite3 sqlite3 <PATH_TO_ENFORCER.DB> < enforcer/utils/migrate_090930_1.sqlite3 Or start fresh (with loss of information. User should remove old keys from the HSM): ksmutil setup * move xml/ to conf/ (part of repository clean) Bugfixes: * Make sure that parenthesis in zonefiles don't concatenate rdata fields. Known issues: * TCP-support for LDNS on Solaris is currently broken due to an issue with SO_RCVTIMEO. The result is that the zonefetcher doesn't work. No other parts of OpenDNSSEC is affected by this bug. There is currently no workaround.
2009-10-02 23:29:02 +02:00
DISTNAME= opendnssec-${VERSION}
Fixed small cleanups
2009-09-29 23:54:44 +02:00
CATEGORIES= net security
OpenDNSSEC 1.0.0rc2 - 2009-12-16 Bugfixes: * Signer Engine: Signer processes could remain open, if they were not close correctly. * ods-ksmutil: Got a segmentation fault, when an HSM was missing in the configuration. Only applied to versions using MySQL. * Zone fetcher: Did not close files before moving them. * Zone fetcher: The serial arithmetic was not correct. * Auditor: It now ignores unrecognized RR types. * Signer Engine: Wrong handling of escaped characters in strings (fixed in ldns trunk) * Set correct permissions on the configuration files. Known issues: * Zone fetcher: When using TSIG, an incorrect MAC can be created if the length of the used secret is 'too long' (longer than the maximum digest length). This problem is in LDNS 1.6.3 and previous versions. This bug is fixed in the upcoming LDNS 1.6.4 release. * Auditor: Some good NAPTR records may fail to verify with dnsruby-1.41. This will be fixed in a future dnsruby release. * TXT RRs: Some TXT RRs with escape characters may fail to parse correctly with dnsruby-1.41 and ldns 1.6.3. This is fixed in the upcoming releases. OpenDNSSEC 1.0.0rc1 - 2009-12-04 * Auditor: dnsruby-1.41 should be used (includes fixes for zero length salt and RFC3597 unknown classes) * Signer Engine: ldns 1.6.3 should be used (includes NSEC3 bugfix and class inheritance when creating signatures) Bugfixes: * Signer Engine: 1.0.0b8 introduced a bug that no signatures where reused. Re-fixed. * Signer Engine: Fix ods-signer start (could hang on MacOSX) * Signer Engine: Mark a zone in progress if in use by one of the tools. Prevents multiple tasks being created for the same zone. * Signer Engine: Dropped records when zone content changed. * Signer Engine: Drop inherited groups and set additional groups when dropping privileges. * Zone fetcher: Clean up empty files if AXFR failed * Zone fetcher: Make syslogging RFC-compliant
2009-12-19 22:44:23 +01:00
MASTER_SITES= http://www.opendnssec.org/files/source/
The OpenDNSSEC project announces the development of Open Source software that manages the security of domain names on the Internet. The project intends to drive adoption of Domain Name System Security Extensions (DNSSEC) to further enhance Internet security. The Features of OpenDNSSEC - No manual management is needed (after first configuration) - Works with all different versions of the Unix operating system - Multiple zones with shared or individual policies - Each policy specifies a set of key and signature settings - Handle zone sizes ranging from a few RRs to millions of RRs - Unsigned zone file in and signed zone file out. - Supports RSA/SHA1 signatures ? ready for future algorithms (e.g.RSA/SHA2, GOST) - Denial of existence using NSEC or NSEC3 - Automatic key generation in HSMs via the PKCS#11 interface - Option support for sharing keys between zones - Automatic key rollover - Possibility of manual key rollover (emergency key rollover) - Automatic zone signing using HSMs via the PKCS#11 interface - Auditing of the signing process and result - BSD license
2009-09-27 01:46:33 +02:00
MAINTAINER= pettai@nordu.net
HOMEPAGE= http://www.opendnssec.org/
COMMENT= OSS for a fast and easy DNSSEC deployment
Added license, breakout auditor + dependency to ruby
2009-09-29 10:14:37 +02:00
LICENSE= iis-license
The OpenDNSSEC project announces the development of Open Source software that manages the security of domain names on the Internet. The project intends to drive adoption of Domain Name System Security Extensions (DNSSEC) to further enhance Internet security. The Features of OpenDNSSEC - No manual management is needed (after first configuration) - Works with all different versions of the Unix operating system - Multiple zones with shared or individual policies - Each policy specifies a set of key and signature settings - Handle zone sizes ranging from a few RRs to millions of RRs - Unsigned zone file in and signed zone file out. - Supports RSA/SHA1 signatures ? ready for future algorithms (e.g.RSA/SHA2, GOST) - Denial of existence using NSEC or NSEC3 - Automatic key generation in HSMs via the PKCS#11 interface - Option support for sharing keys between zones - Automatic key rollover - Possibility of manual key rollover (emergency key rollover) - Automatic zone signing using HSMs via the PKCS#11 interface - Auditing of the signing process and result - BSD license
2009-09-27 01:46:33 +02:00
Cleaned up Makefile
2009-11-08 01:08:24 +01:00
DEPENDS+= ${PYPKGPREFIX}-4Suite-[0-9]*:../../wip/py-4Suite
BUILD_DEPENDS+= CUnit-[0-9]*:../../devel/cunit
OpenDNSSEC 1.0.0b2 - 2009-10-09 * Added experimental support for RSA/SHA256 and RSA/SHA512 to KASP enforcer and the signer engine. * SignerThreads and KeygenInterval has been deprecated (actually removed just before 1.0.0b1). * Added support for RSA/SHA256 and RSA/SHA512 to libhsm. No API changes. Bugfixes: * Bugreport #33 (#35): Output a signed zone if only the SOA record changed. * Zone fetcher did not start correctly * Create the pid / socket directory if it not yet exists, with the correct privileges. * Signer Engine now catches exception if running with incorrect permission. * TCP-support for LDNS on Solaris is fixed in LDNS trunk. Known issues: * LDNS is having problem with SRV records. The main effect is that these records are given non-valid RRSIGs. This is still under investigation.
2009-10-11 21:21:16 +02:00
Added license, breakout auditor + dependency to ruby
2009-09-29 10:14:37 +02:00
LICENSE_FILE= ${FILESDIR}/iis-license
The OpenDNSSEC project announces the development of Open Source software that manages the security of domain names on the Internet. The project intends to drive adoption of Domain Name System Security Extensions (DNSSEC) to further enhance Internet security. The Features of OpenDNSSEC - No manual management is needed (after first configuration) - Works with all different versions of the Unix operating system - Multiple zones with shared or individual policies - Each policy specifies a set of key and signature settings - Handle zone sizes ranging from a few RRs to millions of RRs - Unsigned zone file in and signed zone file out. - Supports RSA/SHA1 signatures ? ready for future algorithms (e.g.RSA/SHA2, GOST) - Denial of existence using NSEC or NSEC3 - Automatic key generation in HSMs via the PKCS#11 interface - Option support for sharing keys between zones - Automatic key rollover - Possibility of manual key rollover (emergency key rollover) - Automatic zone signing using HSMs via the PKCS#11 interface - Auditing of the signing process and result - BSD license
2009-09-27 01:46:33 +02:00
OpenDNSSEC 1.0.0rc2 - 2009-12-16 Bugfixes: * Signer Engine: Signer processes could remain open, if they were not close correctly. * ods-ksmutil: Got a segmentation fault, when an HSM was missing in the configuration. Only applied to versions using MySQL. * Zone fetcher: Did not close files before moving them. * Zone fetcher: The serial arithmetic was not correct. * Auditor: It now ignores unrecognized RR types. * Signer Engine: Wrong handling of escaped characters in strings (fixed in ldns trunk) * Set correct permissions on the configuration files. Known issues: * Zone fetcher: When using TSIG, an incorrect MAC can be created if the length of the used secret is 'too long' (longer than the maximum digest length). This problem is in LDNS 1.6.3 and previous versions. This bug is fixed in the upcoming LDNS 1.6.4 release. * Auditor: Some good NAPTR records may fail to verify with dnsruby-1.41. This will be fixed in a future dnsruby release. * TXT RRs: Some TXT RRs with escape characters may fail to parse correctly with dnsruby-1.41 and ldns 1.6.3. This is fixed in the upcoming releases. OpenDNSSEC 1.0.0rc1 - 2009-12-04 * Auditor: dnsruby-1.41 should be used (includes fixes for zero length salt and RFC3597 unknown classes) * Signer Engine: ldns 1.6.3 should be used (includes NSEC3 bugfix and class inheritance when creating signatures) Bugfixes: * Signer Engine: 1.0.0b8 introduced a bug that no signatures where reused. Re-fixed. * Signer Engine: Fix ods-signer start (could hang on MacOSX) * Signer Engine: Mark a zone in progress if in use by one of the tools. Prevents multiple tasks being created for the same zone. * Signer Engine: Dropped records when zone content changed. * Signer Engine: Drop inherited groups and set additional groups when dropping privileges. * Zone fetcher: Clean up empty files if AXFR failed * Zone fetcher: Make syslogging RFC-compliant
2009-12-19 22:44:23 +01:00
#SVN_REPOSITORIES= opendnssec
#SVN_ROOT.opendnssec= http://svn.opendnssec.org/tags/OpenDNSSEC-${VERSION}
#SVN_MODULE.opendnssec= OpenDNSSEC
#NO_CHECKSUM= yes
VERSION= 1.0.0rc2
The OpenDNSSEC project announces the development of Open Source software that manages the security of domain names on the Internet. The project intends to drive adoption of Domain Name System Security Extensions (DNSSEC) to further enhance Internet security. The Features of OpenDNSSEC - No manual management is needed (after first configuration) - Works with all different versions of the Unix operating system - Multiple zones with shared or individual policies - Each policy specifies a set of key and signature settings - Handle zone sizes ranging from a few RRs to millions of RRs - Unsigned zone file in and signed zone file out. - Supports RSA/SHA1 signatures ? ready for future algorithms (e.g.RSA/SHA2, GOST) - Denial of existence using NSEC or NSEC3 - Automatic key generation in HSMs via the PKCS#11 interface - Option support for sharing keys between zones - Automatic key rollover - Possibility of manual key rollover (emergency key rollover) - Automatic zone signing using HSMs via the PKCS#11 interface - Auditing of the signing process and result - BSD license
2009-09-27 01:46:33 +02:00
OpenDNSSEC 1.0.0rc2 - 2009-12-16 Bugfixes: * Signer Engine: Signer processes could remain open, if they were not close correctly. * ods-ksmutil: Got a segmentation fault, when an HSM was missing in the configuration. Only applied to versions using MySQL. * Zone fetcher: Did not close files before moving them. * Zone fetcher: The serial arithmetic was not correct. * Auditor: It now ignores unrecognized RR types. * Signer Engine: Wrong handling of escaped characters in strings (fixed in ldns trunk) * Set correct permissions on the configuration files. Known issues: * Zone fetcher: When using TSIG, an incorrect MAC can be created if the length of the used secret is 'too long' (longer than the maximum digest length). This problem is in LDNS 1.6.3 and previous versions. This bug is fixed in the upcoming LDNS 1.6.4 release. * Auditor: Some good NAPTR records may fail to verify with dnsruby-1.41. This will be fixed in a future dnsruby release. * TXT RRs: Some TXT RRs with escape characters may fail to parse correctly with dnsruby-1.41 and ldns 1.6.3. This is fixed in the upcoming releases. OpenDNSSEC 1.0.0rc1 - 2009-12-04 * Auditor: dnsruby-1.41 should be used (includes fixes for zero length salt and RFC3597 unknown classes) * Signer Engine: ldns 1.6.3 should be used (includes NSEC3 bugfix and class inheritance when creating signatures) Bugfixes: * Signer Engine: 1.0.0b8 introduced a bug that no signatures where reused. Re-fixed. * Signer Engine: Fix ods-signer start (could hang on MacOSX) * Signer Engine: Mark a zone in progress if in use by one of the tools. Prevents multiple tasks being created for the same zone. * Signer Engine: Dropped records when zone content changed. * Signer Engine: Drop inherited groups and set additional groups when dropping privileges. * Zone fetcher: Clean up empty files if AXFR failed * Zone fetcher: Make syslogging RFC-compliant
2009-12-19 22:44:23 +01:00
PKG_DESTDIR_SUPPORT= user-destdir
#PKG_INSTALLATION_TYPES= overwrite pkgviews
Added license, breakout auditor + dependency to ruby
2009-09-29 10:14:37 +02:00
Fixed Java dependency, VARBASE and PLIST
2009-09-29 17:10:19 +02:00
# XXX: Others might work
OpenDNSSEC 1.0.0b2 - 2009-10-09 * Added experimental support for RSA/SHA256 and RSA/SHA512 to KASP enforcer and the signer engine. * SignerThreads and KeygenInterval has been deprecated (actually removed just before 1.0.0b1). * Added support for RSA/SHA256 and RSA/SHA512 to libhsm. No API changes. Bugfixes: * Bugreport #33 (#35): Output a signed zone if only the SOA record changed. * Zone fetcher did not start correctly * Create the pid / socket directory if it not yet exists, with the correct privileges. * Signer Engine now catches exception if running with incorrect permission. * TCP-support for LDNS on Solaris is fixed in LDNS trunk. Known issues: * LDNS is having problem with SRV records. The main effect is that these records are given non-valid RRSIGs. This is still under investigation.
2009-10-11 21:21:16 +02:00
#ONLY_FOR_PLATFORM= NetBSD-*-* Darwin-*-*
Fixed Java dependency, VARBASE and PLIST
2009-09-29 17:10:19 +02:00
BUILD_DEFS+= VARBASE
OpenDNSSEC 1.0.0rc2 - 2009-12-16 Bugfixes: * Signer Engine: Signer processes could remain open, if they were not close correctly. * ods-ksmutil: Got a segmentation fault, when an HSM was missing in the configuration. Only applied to versions using MySQL. * Zone fetcher: Did not close files before moving them. * Zone fetcher: The serial arithmetic was not correct. * Auditor: It now ignores unrecognized RR types. * Signer Engine: Wrong handling of escaped characters in strings (fixed in ldns trunk) * Set correct permissions on the configuration files. Known issues: * Zone fetcher: When using TSIG, an incorrect MAC can be created if the length of the used secret is 'too long' (longer than the maximum digest length). This problem is in LDNS 1.6.3 and previous versions. This bug is fixed in the upcoming LDNS 1.6.4 release. * Auditor: Some good NAPTR records may fail to verify with dnsruby-1.41. This will be fixed in a future dnsruby release. * TXT RRs: Some TXT RRs with escape characters may fail to parse correctly with dnsruby-1.41 and ldns 1.6.3. This is fixed in the upcoming releases. OpenDNSSEC 1.0.0rc1 - 2009-12-04 * Auditor: dnsruby-1.41 should be used (includes fixes for zero length salt and RFC3597 unknown classes) * Signer Engine: ldns 1.6.3 should be used (includes NSEC3 bugfix and class inheritance when creating signatures) Bugfixes: * Signer Engine: 1.0.0b8 introduced a bug that no signatures where reused. Re-fixed. * Signer Engine: Fix ods-signer start (could hang on MacOSX) * Signer Engine: Mark a zone in progress if in use by one of the tools. Prevents multiple tasks being created for the same zone. * Signer Engine: Dropped records when zone content changed. * Signer Engine: Drop inherited groups and set additional groups when dropping privileges. * Zone fetcher: Clean up empty files if AXFR failed * Zone fetcher: Make syslogging RFC-compliant
2009-12-19 22:44:23 +01:00
#USE_TOOLS+= aclocal autoconf automake autoheader gmake gm4 perl
USE_TOOLS+= bash gmake gm4 perl
CONFIG_SHELL= ${BASH}
USE_JAVA= build
The OpenDNSSEC project announces the development of Open Source software that manages the security of domain names on the Internet. The project intends to drive adoption of Domain Name System Security Extensions (DNSSEC) to further enhance Internet security. The Features of OpenDNSSEC - No manual management is needed (after first configuration) - Works with all different versions of the Unix operating system - Multiple zones with shared or individual policies - Each policy specifies a set of key and signature settings - Handle zone sizes ranging from a few RRs to millions of RRs - Unsigned zone file in and signed zone file out. - Supports RSA/SHA1 signatures ? ready for future algorithms (e.g.RSA/SHA2, GOST) - Denial of existence using NSEC or NSEC3 - Automatic key generation in HSMs via the PKCS#11 interface - Option support for sharing keys between zones - Automatic key rollover - Possibility of manual key rollover (emergency key rollover) - Automatic zone signing using HSMs via the PKCS#11 interface - Auditing of the signing process and result - BSD license
2009-09-27 01:46:33 +02:00
USE_LANGUAGES= c c++
USE_LIBTOOL= yes
Fixed small cleanups
2009-09-29 23:54:44 +02:00
GNU_CONFIGURE= yes
The OpenDNSSEC project announces the development of Open Source software that manages the security of domain names on the Internet. The project intends to drive adoption of Domain Name System Security Extensions (DNSSEC) to further enhance Internet security. The Features of OpenDNSSEC - No manual management is needed (after first configuration) - Works with all different versions of the Unix operating system - Multiple zones with shared or individual policies - Each policy specifies a set of key and signature settings - Handle zone sizes ranging from a few RRs to millions of RRs - Unsigned zone file in and signed zone file out. - Supports RSA/SHA1 signatures ? ready for future algorithms (e.g.RSA/SHA2, GOST) - Denial of existence using NSEC or NSEC3 - Automatic key generation in HSMs via the PKCS#11 interface - Option support for sharing keys between zones - Automatic key rollover - Possibility of manual key rollover (emergency key rollover) - Automatic zone signing using HSMs via the PKCS#11 interface - Auditing of the signing process and result - BSD license
2009-09-27 01:46:33 +02:00
CONFIGURE_ARGS+= --prefix=${PREFIX:Q}
Fixed small cleanups
2009-09-29 23:54:44 +02:00
CONFIGURE_ARGS+= --localstatedir=${VARBASE}
The OpenDNSSEC project announces the development of Open Source software that manages the security of domain names on the Internet. The project intends to drive adoption of Domain Name System Security Extensions (DNSSEC) to further enhance Internet security. The Features of OpenDNSSEC - No manual management is needed (after first configuration) - Works with all different versions of the Unix operating system - Multiple zones with shared or individual policies - Each policy specifies a set of key and signature settings - Handle zone sizes ranging from a few RRs to millions of RRs - Unsigned zone file in and signed zone file out. - Supports RSA/SHA1 signatures ? ready for future algorithms (e.g.RSA/SHA2, GOST) - Denial of existence using NSEC or NSEC3 - Automatic key generation in HSMs via the PKCS#11 interface - Option support for sharing keys between zones - Automatic key rollover - Possibility of manual key rollover (emergency key rollover) - Automatic zone signing using HSMs via the PKCS#11 interface - Auditing of the signing process and result - BSD license
2009-09-27 01:46:33 +02:00
OpenDNSSEC 1.0.0rc2 - 2009-12-16 Bugfixes: * Signer Engine: Signer processes could remain open, if they were not close correctly. * ods-ksmutil: Got a segmentation fault, when an HSM was missing in the configuration. Only applied to versions using MySQL. * Zone fetcher: Did not close files before moving them. * Zone fetcher: The serial arithmetic was not correct. * Auditor: It now ignores unrecognized RR types. * Signer Engine: Wrong handling of escaped characters in strings (fixed in ldns trunk) * Set correct permissions on the configuration files. Known issues: * Zone fetcher: When using TSIG, an incorrect MAC can be created if the length of the used secret is 'too long' (longer than the maximum digest length). This problem is in LDNS 1.6.3 and previous versions. This bug is fixed in the upcoming LDNS 1.6.4 release. * Auditor: Some good NAPTR records may fail to verify with dnsruby-1.41. This will be fixed in a future dnsruby release. * TXT RRs: Some TXT RRs with escape characters may fail to parse correctly with dnsruby-1.41 and ldns 1.6.3. This is fixed in the upcoming releases. OpenDNSSEC 1.0.0rc1 - 2009-12-04 * Auditor: dnsruby-1.41 should be used (includes fixes for zero length salt and RFC3597 unknown classes) * Signer Engine: ldns 1.6.3 should be used (includes NSEC3 bugfix and class inheritance when creating signatures) Bugfixes: * Signer Engine: 1.0.0b8 introduced a bug that no signatures where reused. Re-fixed. * Signer Engine: Fix ods-signer start (could hang on MacOSX) * Signer Engine: Mark a zone in progress if in use by one of the tools. Prevents multiple tasks being created for the same zone. * Signer Engine: Dropped records when zone content changed. * Signer Engine: Drop inherited groups and set additional groups when dropping privileges. * Zone fetcher: Clean up empty files if AXFR failed * Zone fetcher: Make syslogging RFC-compliant
2009-12-19 22:44:23 +01:00
#WRKSRC= ${WRKDIR}/OpenDNSSEC
OpenDNSSEC 1.0.0b4 - 2009-10-23 * Default TTL in case of $TTL or explicit RR TTL becomes the SOA Minimum value ( was 3600). * The signer engine will check if another engine is already running before start ing. * Startup scripts for Solaris (SMF). * Auditor gives an error if key moves to "in use" without sufficient "prepublish ed" time. Bugfixes: * Trailing spaces are not part of the domain name/ include file/ ttl in directiv es. * nsec3er: Print final RRset, even if no NSEC3 was needed at that RRset. * Proper privileges dropping when creating the command socket * Signer sometimes didn't terminate if socket shutdown failed. Known issues: * The Signer Engine fails with broken pipes sometimes.
2009-10-24 22:49:36 +02:00
EGDIR= ${PREFIX}/share/examples/opendnssec
OpenDNSSEC 1.0.0rc2 - 2009-12-16 Bugfixes: * Signer Engine: Signer processes could remain open, if they were not close correctly. * ods-ksmutil: Got a segmentation fault, when an HSM was missing in the configuration. Only applied to versions using MySQL. * Zone fetcher: Did not close files before moving them. * Zone fetcher: The serial arithmetic was not correct. * Auditor: It now ignores unrecognized RR types. * Signer Engine: Wrong handling of escaped characters in strings (fixed in ldns trunk) * Set correct permissions on the configuration files. Known issues: * Zone fetcher: When using TSIG, an incorrect MAC can be created if the length of the used secret is 'too long' (longer than the maximum digest length). This problem is in LDNS 1.6.3 and previous versions. This bug is fixed in the upcoming LDNS 1.6.4 release. * Auditor: Some good NAPTR records may fail to verify with dnsruby-1.41. This will be fixed in a future dnsruby release. * TXT RRs: Some TXT RRs with escape characters may fail to parse correctly with dnsruby-1.41 and ldns 1.6.3. This is fixed in the upcoming releases. OpenDNSSEC 1.0.0rc1 - 2009-12-04 * Auditor: dnsruby-1.41 should be used (includes fixes for zero length salt and RFC3597 unknown classes) * Signer Engine: ldns 1.6.3 should be used (includes NSEC3 bugfix and class inheritance when creating signatures) Bugfixes: * Signer Engine: 1.0.0b8 introduced a bug that no signatures where reused. Re-fixed. * Signer Engine: Fix ods-signer start (could hang on MacOSX) * Signer Engine: Mark a zone in progress if in use by one of the tools. Prevents multiple tasks being created for the same zone. * Signer Engine: Dropped records when zone content changed. * Signer Engine: Drop inherited groups and set additional groups when dropping privileges. * Zone fetcher: Clean up empty files if AXFR failed * Zone fetcher: Make syslogging RFC-compliant
2009-12-19 22:44:23 +01:00
ODS_SYSCONFDIR= ${PKG_SYSCONFDIR}/opendnssec
The OpenDNSSEC project announces the development of Open Source software that manages the security of domain names on the Internet. The project intends to drive adoption of Domain Name System Security Extensions (DNSSEC) to further enhance Internet security. The Features of OpenDNSSEC - No manual management is needed (after first configuration) - Works with all different versions of the Unix operating system - Multiple zones with shared or individual policies - Each policy specifies a set of key and signature settings - Handle zone sizes ranging from a few RRs to millions of RRs - Unsigned zone file in and signed zone file out. - Supports RSA/SHA1 signatures ? ready for future algorithms (e.g.RSA/SHA2, GOST) - Denial of existence using NSEC or NSEC3 - Automatic key generation in HSMs via the PKCS#11 interface - Option support for sharing keys between zones - Automatic key rollover - Possibility of manual key rollover (emergency key rollover) - Automatic zone signing using HSMs via the PKCS#11 interface - Auditing of the signing process and result - BSD license
2009-09-27 01:46:33 +02:00
OpenDNSSEC 1.0.0rc2 - 2009-12-16 Bugfixes: * Signer Engine: Signer processes could remain open, if they were not close correctly. * ods-ksmutil: Got a segmentation fault, when an HSM was missing in the configuration. Only applied to versions using MySQL. * Zone fetcher: Did not close files before moving them. * Zone fetcher: The serial arithmetic was not correct. * Auditor: It now ignores unrecognized RR types. * Signer Engine: Wrong handling of escaped characters in strings (fixed in ldns trunk) * Set correct permissions on the configuration files. Known issues: * Zone fetcher: When using TSIG, an incorrect MAC can be created if the length of the used secret is 'too long' (longer than the maximum digest length). This problem is in LDNS 1.6.3 and previous versions. This bug is fixed in the upcoming LDNS 1.6.4 release. * Auditor: Some good NAPTR records may fail to verify with dnsruby-1.41. This will be fixed in a future dnsruby release. * TXT RRs: Some TXT RRs with escape characters may fail to parse correctly with dnsruby-1.41 and ldns 1.6.3. This is fixed in the upcoming releases. OpenDNSSEC 1.0.0rc1 - 2009-12-04 * Auditor: dnsruby-1.41 should be used (includes fixes for zero length salt and RFC3597 unknown classes) * Signer Engine: ldns 1.6.3 should be used (includes NSEC3 bugfix and class inheritance when creating signatures) Bugfixes: * Signer Engine: 1.0.0b8 introduced a bug that no signatures where reused. Re-fixed. * Signer Engine: Fix ods-signer start (could hang on MacOSX) * Signer Engine: Mark a zone in progress if in use by one of the tools. Prevents multiple tasks being created for the same zone. * Signer Engine: Dropped records when zone content changed. * Signer Engine: Drop inherited groups and set additional groups when dropping privileges. * Zone fetcher: Clean up empty files if AXFR failed * Zone fetcher: Make syslogging RFC-compliant
2009-12-19 22:44:23 +01:00
SUBST_CLASSES+= paths
SUBST_FILES.paths= ${WRKSRC}/conf/Makefile.in
SUBST_STAGE.paths= post-patch
SUBST_SED.paths= -e 's,@EGDIR@,${EGDIR},'
Fixed installation of configuration files.
2009-10-26 23:23:09 +01:00
The OpenDNSSEC project announces the development of Open Source software that manages the security of domain names on the Internet. The project intends to drive adoption of Domain Name System Security Extensions (DNSSEC) to further enhance Internet security. The Features of OpenDNSSEC - No manual management is needed (after first configuration) - Works with all different versions of the Unix operating system - Multiple zones with shared or individual policies - Each policy specifies a set of key and signature settings - Handle zone sizes ranging from a few RRs to millions of RRs - Unsigned zone file in and signed zone file out. - Supports RSA/SHA1 signatures ? ready for future algorithms (e.g.RSA/SHA2, GOST) - Denial of existence using NSEC or NSEC3 - Automatic key generation in HSMs via the PKCS#11 interface - Option support for sharing keys between zones - Automatic key rollover - Possibility of manual key rollover (emergency key rollover) - Automatic zone signing using HSMs via the PKCS#11 interface - Auditing of the signing process and result - BSD license
2009-09-27 01:46:33 +02:00
CXXFLAGS.NetBSD+= -D_NETBSD_SOURCE
OpenDNSSEC 1.0.0b4 - 2009-10-23 * Default TTL in case of $TTL or explicit RR TTL becomes the SOA Minimum value ( was 3600). * The signer engine will check if another engine is already running before start ing. * Startup scripts for Solaris (SMF). * Auditor gives an error if key moves to "in use" without sufficient "prepublish ed" time. Bugfixes: * Trailing spaces are not part of the domain name/ include file/ ttl in directiv es. * nsec3er: Print final RRset, even if no NSEC3 was needed at that RRset. * Proper privileges dropping when creating the command socket * Signer sometimes didn't terminate if socket shutdown failed. Known issues: * The Signer Engine fails with broken pipes sometimes.
2009-10-24 22:49:36 +02:00
CONF_FILES= ${EGDIR}/conf.xml.sample \
OpenDNSSEC 1.0.0rc2 - 2009-12-16 Bugfixes: * Signer Engine: Signer processes could remain open, if they were not close correctly. * ods-ksmutil: Got a segmentation fault, when an HSM was missing in the configuration. Only applied to versions using MySQL. * Zone fetcher: Did not close files before moving them. * Zone fetcher: The serial arithmetic was not correct. * Auditor: It now ignores unrecognized RR types. * Signer Engine: Wrong handling of escaped characters in strings (fixed in ldns trunk) * Set correct permissions on the configuration files. Known issues: * Zone fetcher: When using TSIG, an incorrect MAC can be created if the length of the used secret is 'too long' (longer than the maximum digest length). This problem is in LDNS 1.6.3 and previous versions. This bug is fixed in the upcoming LDNS 1.6.4 release. * Auditor: Some good NAPTR records may fail to verify with dnsruby-1.41. This will be fixed in a future dnsruby release. * TXT RRs: Some TXT RRs with escape characters may fail to parse correctly with dnsruby-1.41 and ldns 1.6.3. This is fixed in the upcoming releases. OpenDNSSEC 1.0.0rc1 - 2009-12-04 * Auditor: dnsruby-1.41 should be used (includes fixes for zero length salt and RFC3597 unknown classes) * Signer Engine: ldns 1.6.3 should be used (includes NSEC3 bugfix and class inheritance when creating signatures) Bugfixes: * Signer Engine: 1.0.0b8 introduced a bug that no signatures where reused. Re-fixed. * Signer Engine: Fix ods-signer start (could hang on MacOSX) * Signer Engine: Mark a zone in progress if in use by one of the tools. Prevents multiple tasks being created for the same zone. * Signer Engine: Dropped records when zone content changed. * Signer Engine: Drop inherited groups and set additional groups when dropping privileges. * Zone fetcher: Clean up empty files if AXFR failed * Zone fetcher: Make syslogging RFC-compliant
2009-12-19 22:44:23 +01:00
${ODS_SYSCONFDIR}/conf.xml
OpenDNSSEC 1.0.0b4 - 2009-10-23 * Default TTL in case of $TTL or explicit RR TTL becomes the SOA Minimum value ( was 3600). * The signer engine will check if another engine is already running before start ing. * Startup scripts for Solaris (SMF). * Auditor gives an error if key moves to "in use" without sufficient "prepublish ed" time. Bugfixes: * Trailing spaces are not part of the domain name/ include file/ ttl in directiv es. * nsec3er: Print final RRset, even if no NSEC3 was needed at that RRset. * Proper privileges dropping when creating the command socket * Signer sometimes didn't terminate if socket shutdown failed. Known issues: * The Signer Engine fails with broken pipes sometimes.
2009-10-24 22:49:36 +02:00
CONF_FILES+= ${EGDIR}/kasp.xml.sample \
OpenDNSSEC 1.0.0rc2 - 2009-12-16 Bugfixes: * Signer Engine: Signer processes could remain open, if they were not close correctly. * ods-ksmutil: Got a segmentation fault, when an HSM was missing in the configuration. Only applied to versions using MySQL. * Zone fetcher: Did not close files before moving them. * Zone fetcher: The serial arithmetic was not correct. * Auditor: It now ignores unrecognized RR types. * Signer Engine: Wrong handling of escaped characters in strings (fixed in ldns trunk) * Set correct permissions on the configuration files. Known issues: * Zone fetcher: When using TSIG, an incorrect MAC can be created if the length of the used secret is 'too long' (longer than the maximum digest length). This problem is in LDNS 1.6.3 and previous versions. This bug is fixed in the upcoming LDNS 1.6.4 release. * Auditor: Some good NAPTR records may fail to verify with dnsruby-1.41. This will be fixed in a future dnsruby release. * TXT RRs: Some TXT RRs with escape characters may fail to parse correctly with dnsruby-1.41 and ldns 1.6.3. This is fixed in the upcoming releases. OpenDNSSEC 1.0.0rc1 - 2009-12-04 * Auditor: dnsruby-1.41 should be used (includes fixes for zero length salt and RFC3597 unknown classes) * Signer Engine: ldns 1.6.3 should be used (includes NSEC3 bugfix and class inheritance when creating signatures) Bugfixes: * Signer Engine: 1.0.0b8 introduced a bug that no signatures where reused. Re-fixed. * Signer Engine: Fix ods-signer start (could hang on MacOSX) * Signer Engine: Mark a zone in progress if in use by one of the tools. Prevents multiple tasks being created for the same zone. * Signer Engine: Dropped records when zone content changed. * Signer Engine: Drop inherited groups and set additional groups when dropping privileges. * Zone fetcher: Clean up empty files if AXFR failed * Zone fetcher: Make syslogging RFC-compliant
2009-12-19 22:44:23 +01:00
${ODS_SYSCONFDIR}/kasp.xml
OpenDNSSEC 1.0.0b4 - 2009-10-23 * Default TTL in case of $TTL or explicit RR TTL becomes the SOA Minimum value ( was 3600). * The signer engine will check if another engine is already running before start ing. * Startup scripts for Solaris (SMF). * Auditor gives an error if key moves to "in use" without sufficient "prepublish ed" time. Bugfixes: * Trailing spaces are not part of the domain name/ include file/ ttl in directiv es. * nsec3er: Print final RRset, even if no NSEC3 was needed at that RRset. * Proper privileges dropping when creating the command socket * Signer sometimes didn't terminate if socket shutdown failed. Known issues: * The Signer Engine fails with broken pipes sometimes.
2009-10-24 22:49:36 +02:00
CONF_FILES+= ${EGDIR}/zonefetch.xml.sample \
OpenDNSSEC 1.0.0rc2 - 2009-12-16 Bugfixes: * Signer Engine: Signer processes could remain open, if they were not close correctly. * ods-ksmutil: Got a segmentation fault, when an HSM was missing in the configuration. Only applied to versions using MySQL. * Zone fetcher: Did not close files before moving them. * Zone fetcher: The serial arithmetic was not correct. * Auditor: It now ignores unrecognized RR types. * Signer Engine: Wrong handling of escaped characters in strings (fixed in ldns trunk) * Set correct permissions on the configuration files. Known issues: * Zone fetcher: When using TSIG, an incorrect MAC can be created if the length of the used secret is 'too long' (longer than the maximum digest length). This problem is in LDNS 1.6.3 and previous versions. This bug is fixed in the upcoming LDNS 1.6.4 release. * Auditor: Some good NAPTR records may fail to verify with dnsruby-1.41. This will be fixed in a future dnsruby release. * TXT RRs: Some TXT RRs with escape characters may fail to parse correctly with dnsruby-1.41 and ldns 1.6.3. This is fixed in the upcoming releases. OpenDNSSEC 1.0.0rc1 - 2009-12-04 * Auditor: dnsruby-1.41 should be used (includes fixes for zero length salt and RFC3597 unknown classes) * Signer Engine: ldns 1.6.3 should be used (includes NSEC3 bugfix and class inheritance when creating signatures) Bugfixes: * Signer Engine: 1.0.0b8 introduced a bug that no signatures where reused. Re-fixed. * Signer Engine: Fix ods-signer start (could hang on MacOSX) * Signer Engine: Mark a zone in progress if in use by one of the tools. Prevents multiple tasks being created for the same zone. * Signer Engine: Dropped records when zone content changed. * Signer Engine: Drop inherited groups and set additional groups when dropping privileges. * Zone fetcher: Clean up empty files if AXFR failed * Zone fetcher: Make syslogging RFC-compliant
2009-12-19 22:44:23 +01:00
${ODS_SYSCONFDIR}/zonefetch.xml
OpenDNSSEC 1.0.0b4 - 2009-10-23 * Default TTL in case of $TTL or explicit RR TTL becomes the SOA Minimum value ( was 3600). * The signer engine will check if another engine is already running before start ing. * Startup scripts for Solaris (SMF). * Auditor gives an error if key moves to "in use" without sufficient "prepublish ed" time. Bugfixes: * Trailing spaces are not part of the domain name/ include file/ ttl in directiv es. * nsec3er: Print final RRset, even if no NSEC3 was needed at that RRset. * Proper privileges dropping when creating the command socket * Signer sometimes didn't terminate if socket shutdown failed. Known issues: * The Signer Engine fails with broken pipes sometimes.
2009-10-24 22:49:36 +02:00
CONF_FILES+= ${EGDIR}/zonelist.xml.sample \
OpenDNSSEC 1.0.0rc2 - 2009-12-16 Bugfixes: * Signer Engine: Signer processes could remain open, if they were not close correctly. * ods-ksmutil: Got a segmentation fault, when an HSM was missing in the configuration. Only applied to versions using MySQL. * Zone fetcher: Did not close files before moving them. * Zone fetcher: The serial arithmetic was not correct. * Auditor: It now ignores unrecognized RR types. * Signer Engine: Wrong handling of escaped characters in strings (fixed in ldns trunk) * Set correct permissions on the configuration files. Known issues: * Zone fetcher: When using TSIG, an incorrect MAC can be created if the length of the used secret is 'too long' (longer than the maximum digest length). This problem is in LDNS 1.6.3 and previous versions. This bug is fixed in the upcoming LDNS 1.6.4 release. * Auditor: Some good NAPTR records may fail to verify with dnsruby-1.41. This will be fixed in a future dnsruby release. * TXT RRs: Some TXT RRs with escape characters may fail to parse correctly with dnsruby-1.41 and ldns 1.6.3. This is fixed in the upcoming releases. OpenDNSSEC 1.0.0rc1 - 2009-12-04 * Auditor: dnsruby-1.41 should be used (includes fixes for zero length salt and RFC3597 unknown classes) * Signer Engine: ldns 1.6.3 should be used (includes NSEC3 bugfix and class inheritance when creating signatures) Bugfixes: * Signer Engine: 1.0.0b8 introduced a bug that no signatures where reused. Re-fixed. * Signer Engine: Fix ods-signer start (could hang on MacOSX) * Signer Engine: Mark a zone in progress if in use by one of the tools. Prevents multiple tasks being created for the same zone. * Signer Engine: Dropped records when zone content changed. * Signer Engine: Drop inherited groups and set additional groups when dropping privileges. * Zone fetcher: Clean up empty files if AXFR failed * Zone fetcher: Make syslogging RFC-compliant
2009-12-19 22:44:23 +01:00
${ODS_SYSCONFDIR}/zonelist.xml
OpenDNSSEC 1.0.0b4 - 2009-10-23 * Default TTL in case of $TTL or explicit RR TTL becomes the SOA Minimum value ( was 3600). * The signer engine will check if another engine is already running before start ing. * Startup scripts for Solaris (SMF). * Auditor gives an error if key moves to "in use" without sufficient "prepublish ed" time. Bugfixes: * Trailing spaces are not part of the domain name/ include file/ ttl in directiv es. * nsec3er: Print final RRset, even if no NSEC3 was needed at that RRset. * Proper privileges dropping when creating the command socket * Signer sometimes didn't terminate if socket shutdown failed. Known issues: * The Signer Engine fails with broken pipes sometimes.
2009-10-24 22:49:36 +02:00
OpenDNSSEC 1.0.0rc2 - 2009-12-16 Bugfixes: * Signer Engine: Signer processes could remain open, if they were not close correctly. * ods-ksmutil: Got a segmentation fault, when an HSM was missing in the configuration. Only applied to versions using MySQL. * Zone fetcher: Did not close files before moving them. * Zone fetcher: The serial arithmetic was not correct. * Auditor: It now ignores unrecognized RR types. * Signer Engine: Wrong handling of escaped characters in strings (fixed in ldns trunk) * Set correct permissions on the configuration files. Known issues: * Zone fetcher: When using TSIG, an incorrect MAC can be created if the length of the used secret is 'too long' (longer than the maximum digest length). This problem is in LDNS 1.6.3 and previous versions. This bug is fixed in the upcoming LDNS 1.6.4 release. * Auditor: Some good NAPTR records may fail to verify with dnsruby-1.41. This will be fixed in a future dnsruby release. * TXT RRs: Some TXT RRs with escape characters may fail to parse correctly with dnsruby-1.41 and ldns 1.6.3. This is fixed in the upcoming releases. OpenDNSSEC 1.0.0rc1 - 2009-12-04 * Auditor: dnsruby-1.41 should be used (includes fixes for zero length salt and RFC3597 unknown classes) * Signer Engine: ldns 1.6.3 should be used (includes NSEC3 bugfix and class inheritance when creating signatures) Bugfixes: * Signer Engine: 1.0.0b8 introduced a bug that no signatures where reused. Re-fixed. * Signer Engine: Fix ods-signer start (could hang on MacOSX) * Signer Engine: Mark a zone in progress if in use by one of the tools. Prevents multiple tasks being created for the same zone. * Signer Engine: Dropped records when zone content changed. * Signer Engine: Drop inherited groups and set additional groups when dropping privileges. * Zone fetcher: Clean up empty files if AXFR failed * Zone fetcher: Make syslogging RFC-compliant
2009-12-19 22:44:23 +01:00
INSTALLATION_DIRS= ${EGDIR} ${ODS_SYSCONFDIR}
Cleaned up Makefile
2009-11-08 01:08:24 +01:00
INSTALLATION_DIRS+= share/opendnssec
INSTALLATION_DIRS+= lib/opendnssec
INSTALLATION_DIRS+= lib/opendnssec/signer
INSTALLATION_DIRS+= lib/opendnssec/kasp_auditor
Fixed installation of configuration files.
2009-10-26 23:23:09 +01:00
INSTALLATION_DIRS+= ${VARBASE}/opendnssec
INSTALLATION_DIRS+= ${VARBASE}/opendnssec/tmp
OpenDNSSEC 1.0.0b4 - 2009-10-23 * Default TTL in case of $TTL or explicit RR TTL becomes the SOA Minimum value ( was 3600). * The signer engine will check if another engine is already running before start ing. * Startup scripts for Solaris (SMF). * Auditor gives an error if key moves to "in use" without sufficient "prepublish ed" time. Bugfixes: * Trailing spaces are not part of the domain name/ include file/ ttl in directiv es. * nsec3er: Print final RRset, even if no NSEC3 was needed at that RRset. * Proper privileges dropping when creating the command socket * Signer sometimes didn't terminate if socket shutdown failed. Known issues: * The Signer Engine fails with broken pipes sometimes.
2009-10-24 22:49:36 +02:00
INSTALLATION_DIRS+= ${VARBASE}/opendnssec/signconf
INSTALLATION_DIRS+= ${VARBASE}/opendnssec/signed
INSTALLATION_DIRS+= ${VARBASE}/opendnssec/unsigned
OpenDNSSEC 1.0.0rc2 - 2009-12-16 Bugfixes: * Signer Engine: Signer processes could remain open, if they were not close correctly. * ods-ksmutil: Got a segmentation fault, when an HSM was missing in the configuration. Only applied to versions using MySQL. * Zone fetcher: Did not close files before moving them. * Zone fetcher: The serial arithmetic was not correct. * Auditor: It now ignores unrecognized RR types. * Signer Engine: Wrong handling of escaped characters in strings (fixed in ldns trunk) * Set correct permissions on the configuration files. Known issues: * Zone fetcher: When using TSIG, an incorrect MAC can be created if the length of the used secret is 'too long' (longer than the maximum digest length). This problem is in LDNS 1.6.3 and previous versions. This bug is fixed in the upcoming LDNS 1.6.4 release. * Auditor: Some good NAPTR records may fail to verify with dnsruby-1.41. This will be fixed in a future dnsruby release. * TXT RRs: Some TXT RRs with escape characters may fail to parse correctly with dnsruby-1.41 and ldns 1.6.3. This is fixed in the upcoming releases. OpenDNSSEC 1.0.0rc1 - 2009-12-04 * Auditor: dnsruby-1.41 should be used (includes fixes for zero length salt and RFC3597 unknown classes) * Signer Engine: ldns 1.6.3 should be used (includes NSEC3 bugfix and class inheritance when creating signatures) Bugfixes: * Signer Engine: 1.0.0b8 introduced a bug that no signatures where reused. Re-fixed. * Signer Engine: Fix ods-signer start (could hang on MacOSX) * Signer Engine: Mark a zone in progress if in use by one of the tools. Prevents multiple tasks being created for the same zone. * Signer Engine: Dropped records when zone content changed. * Signer Engine: Drop inherited groups and set additional groups when dropping privileges. * Zone fetcher: Clean up empty files if AXFR failed * Zone fetcher: Make syslogging RFC-compliant
2009-12-19 22:44:23 +01:00
.include "options.mk"
.if ${OPSYS} == "NetBSD"
#PKG_JVMS_ACCEPTED= sun-jdk6 sun-jdk15 sun-jdk14
.include "../../mk/java-vm.mk"
.endif
#pre-configure:
# ${CHMOD} u+x ${WRKSRC}/autogen.sh
# cd ${WRKSRC} && ./autogen.sh
The OpenDNSSEC project announces the development of Open Source software that manages the security of domain names on the Internet. The project intends to drive adoption of Domain Name System Security Extensions (DNSSEC) to further enhance Internet security. The Features of OpenDNSSEC - No manual management is needed (after first configuration) - Works with all different versions of the Unix operating system - Multiple zones with shared or individual policies - Each policy specifies a set of key and signature settings - Handle zone sizes ranging from a few RRs to millions of RRs - Unsigned zone file in and signed zone file out. - Supports RSA/SHA1 signatures ? ready for future algorithms (e.g.RSA/SHA2, GOST) - Denial of existence using NSEC or NSEC3 - Automatic key generation in HSMs via the PKCS#11 interface - Option support for sharing keys between zones - Automatic key rollover - Possibility of manual key rollover (emergency key rollover) - Automatic zone signing using HSMs via the PKCS#11 interface - Auditing of the signing process and result - BSD license
2009-09-27 01:46:33 +02:00
Build with softHSM default
2009-11-02 00:35:40 +01:00
pre-install:
${MKDIR} ${PKG_SYSCONFDIR}/opendnssec
Fixed dnsruby dependency (${RUBY_PKGPREFIX}) Added python dependency
2009-09-28 23:36:19 +02:00
.include "../../lang/python/application.mk"
Cleaned up Makefile
2009-11-08 01:08:24 +01:00
#.include "../../devel/cunit/buildlink3.mk"
The OpenDNSSEC project announces the development of Open Source software that manages the security of domain names on the Internet. The project intends to drive adoption of Domain Name System Security Extensions (DNSSEC) to further enhance Internet security. The Features of OpenDNSSEC - No manual management is needed (after first configuration) - Works with all different versions of the Unix operating system - Multiple zones with shared or individual policies - Each policy specifies a set of key and signature settings - Handle zone sizes ranging from a few RRs to millions of RRs - Unsigned zone file in and signed zone file out. - Supports RSA/SHA1 signatures ? ready for future algorithms (e.g.RSA/SHA2, GOST) - Denial of existence using NSEC or NSEC3 - Automatic key generation in HSMs via the PKCS#11 interface - Option support for sharing keys between zones - Automatic key rollover - Possibility of manual key rollover (emergency key rollover) - Automatic zone signing using HSMs via the PKCS#11 interface - Auditing of the signing process and result - BSD license
2009-09-27 01:46:33 +02:00
.include "../../textproc/libxml2/buildlink3.mk"
.include "../../net/ldns/buildlink3.mk"
.include "../../databases/sqlite3/buildlink3.mk"
OpenDNSSEC 1.0.0rc2 - 2009-12-16 Bugfixes: * Signer Engine: Signer processes could remain open, if they were not close correctly. * ods-ksmutil: Got a segmentation fault, when an HSM was missing in the configuration. Only applied to versions using MySQL. * Zone fetcher: Did not close files before moving them. * Zone fetcher: The serial arithmetic was not correct. * Auditor: It now ignores unrecognized RR types. * Signer Engine: Wrong handling of escaped characters in strings (fixed in ldns trunk) * Set correct permissions on the configuration files. Known issues: * Zone fetcher: When using TSIG, an incorrect MAC can be created if the length of the used secret is 'too long' (longer than the maximum digest length). This problem is in LDNS 1.6.3 and previous versions. This bug is fixed in the upcoming LDNS 1.6.4 release. * Auditor: Some good NAPTR records may fail to verify with dnsruby-1.41. This will be fixed in a future dnsruby release. * TXT RRs: Some TXT RRs with escape characters may fail to parse correctly with dnsruby-1.41 and ldns 1.6.3. This is fixed in the upcoming releases. OpenDNSSEC 1.0.0rc1 - 2009-12-04 * Auditor: dnsruby-1.41 should be used (includes fixes for zero length salt and RFC3597 unknown classes) * Signer Engine: ldns 1.6.3 should be used (includes NSEC3 bugfix and class inheritance when creating signatures) Bugfixes: * Signer Engine: 1.0.0b8 introduced a bug that no signatures where reused. Re-fixed. * Signer Engine: Fix ods-signer start (could hang on MacOSX) * Signer Engine: Mark a zone in progress if in use by one of the tools. Prevents multiple tasks being created for the same zone. * Signer Engine: Dropped records when zone content changed. * Signer Engine: Drop inherited groups and set additional groups when dropping privileges. * Zone fetcher: Clean up empty files if AXFR failed * Zone fetcher: Make syslogging RFC-compliant
2009-12-19 22:44:23 +01:00
#.include "../../databases/mysql5-client/buildlink3.mk"
#.include "../../wip/mk/svn-package.mk"
The OpenDNSSEC project announces the development of Open Source software that manages the security of domain names on the Internet. The project intends to drive adoption of Domain Name System Security Extensions (DNSSEC) to further enhance Internet security. The Features of OpenDNSSEC - No manual management is needed (after first configuration) - Works with all different versions of the Unix operating system - Multiple zones with shared or individual policies - Each policy specifies a set of key and signature settings - Handle zone sizes ranging from a few RRs to millions of RRs - Unsigned zone file in and signed zone file out. - Supports RSA/SHA1 signatures ? ready for future algorithms (e.g.RSA/SHA2, GOST) - Denial of existence using NSEC or NSEC3 - Automatic key generation in HSMs via the PKCS#11 interface - Option support for sharing keys between zones - Automatic key rollover - Possibility of manual key rollover (emergency key rollover) - Automatic zone signing using HSMs via the PKCS#11 interface - Auditing of the signing process and result - BSD license
2009-09-27 01:46:33 +02:00
.include "../../mk/bsd.pkg.mk"
Reference in a new issue Copy permalink