kpriv/pkgsrc
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
pkgsrc/security/opendnssec/Makefile

84 lines
2.3 KiB
Makefile
Raw Normal View History

Revbump after updating textproc/icu
2013-10-19 11:06:55 +02:00
# $NetBSD: Makefile,v 1.37 2013/10/19 09:07:11 adam Exp $
The OpenDNSSEC project announces the development of Open Source software that manages the security of domain names on the Internet. The project intends to drive adoption of Domain Name System Security Extensions (DNSSEC) to further enhance Internet security.
2010-05-06 14:50:17 +02:00
#
OpenDNSSEC 1.4.2 - 2013-09-11 * OPENDNSSEC-428: ods-ksmutil: Add option for 'ods-ksmutil key generate' to take number of zones as a parameter Bugfixes: * SUPPORT-66: Signer Engine: Fix file descriptor leak in case of TCP write error [OPENDNSSEC-427]. * SUPPORT-71: Signer Engine: Fix double free crash in case of HSM connection error during signing [OPENDNSSEC-444]. * OPENDNSSEC-401: 'ods-signer sign <zone> --serial <nr>' command produces seg fault when run directly on command line (i.e. not via interactive mode) * OPENDNSSEC-440: 'ods-ksmutil key generate' and the enforcer can create too many keys if there are keys already available and the KSK and ZSK use same algorithm and length * OPENDNSSEC-424: Signer Engine: Respond to SOA queries from file instead of memory. Makes response non-blocking. * OPENDNSSEC-425 Change "hsmutil list" output so that the table header goes to stdout not stderr * OPENDNSSEC-438: 'ods-ksmutil key generate' and the enforcer can create too many keys for <SharedKeys/> policies when KSK and ZSK use same algorithm and length * OPENDNSSEC-443: ods-ksmutil: Clean up of hsm connection handling * Signer Engine: Improved Inbound XFR checking. * Signer Engine: Fix double free corruption in case of adding zone with DNS Outbound Adapters and NotifyCommand enabled.
2013-09-13 23:59:51 +02:00
DISTNAME= opendnssec-1.4.2
Revbump after updating textproc/icu
2013-10-19 11:06:55 +02:00
PKGREVISION= 1
The OpenDNSSEC project announces the development of Open Source software that manages the security of domain names on the Internet. The project intends to drive adoption of Domain Name System Security Extensions (DNSSEC) to further enhance Internet security.
2010-05-06 14:50:17 +02:00
CATEGORIES= security net
MASTER_SITES= http://www.opendnssec.org/files/source/
fixed email
2010-05-06 16:56:16 +02:00
MAINTAINER= pettai@NetBSD.org
The OpenDNSSEC project announces the development of Open Source software that manages the security of domain names on the Internet. The project intends to drive adoption of Domain Name System Security Extensions (DNSSEC) to further enhance Internet security.
2010-05-06 14:50:17 +02:00
HOMEPAGE= http://www.opendnssec.org/
COMMENT= OSS for a fast and easy DNSSEC deployment
LICENSE= 2-clause-bsd
OpenDNSSEC 1.3.12 - 2012-12-03 Bugfixes: * SUPPORT-42: ./configure fails on FreeBSD (or if ldns is not installed in a directory in the default search path of the complier). * OpenDNSSEC does not compile against ldns 1.6.16 on platforms that rely on the OpenDNSSEC implementation of strlcpy/cat
2012-12-05 21:03:59 +01:00
DEPENDS+= ldns>=1.6.13:../../net/ldns
The OpenDNSSEC project announces the development of Open Source software that manages the security of domain names on the Internet. The project intends to drive adoption of Domain Name System Security Extensions (DNSSEC) to further enhance Internet security.
2010-05-06 14:50:17 +02:00
BUILD_DEPENDS+= CUnit-[0-9]*:../../devel/cunit
BUILD_DEFS+= VARBASE
OpenDNSSEC 1.1.0: * Partial Auditor added * Dnsruby-1.46 required * Improved error messages when the system runs out of keys * Optimise communication of signconfs for multiple zones sharing keys. Group zones in zonelist.xml by policy to get this benefit. * Bugreport #101: Signer Engine now maintains its own pidfile. * Jitter redefined: now in the range of [-jitter, ..., +jitter] * Optimized sorter: quicksorter (sorter becomes obsolete). * Optimized zone_reader, includes nseccing/nsec3ing (nseccer and nsec3er become obsolete). * Enable database selection using --with-database-backend={sqlite3|mysql} * Enable the EPP-client using --enable-eppclient For sending DS RR to the parent zone (experimental) * Turn NSEC3 OptOut off by default * Install kasp2html XML stylesheet * Add simple kasp2html conversion script * DNSKEY records communicated to an external script if configured * The command 'ods-signer restart' is removed. * Signer Engine now also reuses signatures after a change in NSEC(3) configuration or rolling keys. * Quicksorter defaults to class IN. And a lot of bugfixes...
2010-06-16 02:19:08 +02:00
USE_TOOLS+= bash gmake
The OpenDNSSEC project announces the development of Open Source software that manages the security of domain names on the Internet. The project intends to drive adoption of Domain Name System Security Extensions (DNSSEC) to further enhance Internet security.
2010-05-06 14:50:17 +02:00
CONFIG_SHELL= ${BASH}
USE_LANGUAGES= c c++
USE_LIBTOOL= yes
GNU_CONFIGURE= yes
CONFIGURE_ARGS+= --prefix=${PREFIX:Q}
CONFIGURE_ARGS+= --localstatedir=${VARBASE}
OpenDNSSEC 1.1.0: * Partial Auditor added * Dnsruby-1.46 required * Improved error messages when the system runs out of keys * Optimise communication of signconfs for multiple zones sharing keys. Group zones in zonelist.xml by policy to get this benefit. * Bugreport #101: Signer Engine now maintains its own pidfile. * Jitter redefined: now in the range of [-jitter, ..., +jitter] * Optimized sorter: quicksorter (sorter becomes obsolete). * Optimized zone_reader, includes nseccing/nsec3ing (nseccer and nsec3er become obsolete). * Enable database selection using --with-database-backend={sqlite3|mysql} * Enable the EPP-client using --enable-eppclient For sending DS RR to the parent zone (experimental) * Turn NSEC3 OptOut off by default * Install kasp2html XML stylesheet * Add simple kasp2html conversion script * DNSKEY records communicated to an external script if configured * The command 'ods-signer restart' is removed. * Signer Engine now also reuses signatures after a change in NSEC(3) configuration or rolling keys. * Quicksorter defaults to class IN. And a lot of bugfixes...
2010-06-16 02:19:08 +02:00
ODS_USER?= opendnssec
ODS_GROUP?= opendnssec
PKG_GROUPS= ${ODS_GROUP}
PKG_USERS= ${ODS_USER}:${ODS_GROUP}
PKG_GECOS.${ODS_USER}= OpenDNSSEC user
PKG_HOME.${ODS_USER}= ${VARBASE}/opendnssec
PKG_SHELL.${ODS_USER}= ${SH}
PKG_USERS_VARS+= ODS_USER
PKG_GROUPS_VARS+= ODS_GROUP
The OpenDNSSEC project announces the development of Open Source software that manages the security of domain names on the Internet. The project intends to drive adoption of Domain Name System Security Extensions (DNSSEC) to further enhance Internet security.
2010-05-06 14:50:17 +02:00
EGDIR= ${PREFIX}/share/examples/opendnssec
OpenDNSSEC 1.2.1: * ldns 1.6.9 is required for bugfixes. * dnsruby-1.52 required for bugfixes. Bugfixes: * Auditor: 'make check' now works when srcdir != builddir. * Auditor: Include the 'make check' files in the tarball. * Enforcer: Fix the migration script for SQLite. * Enforcer: Increase size of keypairs(id) field in MySQL to allow more than 32767 keys; see MIGRATION for details. * Enforcer: Minor change to NOT_READY_KEY error message. * libhsm: Increase the maximum number of attached HSM:s from 10 to 100. * ods-ksmutil: Send trivial MySQL messages to stdout when exporting zonelist etc. Otherwise the resulting XML needs to be edited by hand. * ods-control: Fix for Bourne shell. * Signer Engine: Prevent race condition when setting up the workers and the command handler. * Signer Engine: Check if the signature exists before recycling it. * Signer Engine: Quit when there are errors in the configuration. * Signer Engine: Enable core dump on failure. * Signer Engine: Explicitly close down log msg with null. * Signer Engine: Backup state after writing output. * Signer Engine: Allow update of serial if internal structure is not initialized.
2011-03-21 16:52:25 +01:00
DOCDIR= ${PREFIX}/share/doc/opendnssec
The OpenDNSSEC project announces the development of Open Source software that manages the security of domain names on the Internet. The project intends to drive adoption of Domain Name System Security Extensions (DNSSEC) to further enhance Internet security.
2010-05-06 14:50:17 +02:00
ODS_SYSCONFDIR= ${PKG_SYSCONFDIR}/opendnssec
SUBST_CLASSES+= paths
SUBST_FILES.paths= ${WRKSRC}/conf/Makefile.in
SUBST_STAGE.paths= post-patch
SUBST_SED.paths= -e 's,@EGDIR@,${EGDIR},'
CXXFLAGS.NetBSD+= -D_NETBSD_SOURCE
Update OpenDNSSEC from version 1.3.14nb1 to 1.4.1. Pkgsrc changes: * Get rid of ruby dependencies, since the validator is no longer included in OpenDNSSEC * Adapt PLIST to changes in installed files * Add a patch so that the database migration scripts are installed as part of the package Upstream notable changes: * SUPPORT-58: Extend ods-signer sign <zone> with -serial <nr> so that the user can specify the SOA serial to use in the signed zone [OPENDNSSEC-401]. * OPENDNSSEC-91: Make the keytype flag required when rolling keys Bugfixes: * SUPPORT-60: Fix datecounter in case inbound serial is higher than outbound serial [OPENDNSSEC-420]. * OPENDNSSEC-247: Signer Engine: TTL on NSEC3 was not updated on SOA Minimum change. * OPENDNSSEC-421: Signer Engine: Fix assertion error in case NSEC3 hash algorithm in signconf is not SHA1. * OPENDNSSEC-421: ods-kaspcheck: Check whether NSEC3 hash algorithm in kasp is valid. * Bugfix: The time when inbound serial is acquired was reset invalidly, could cause OpenDNSSEC wanting AXFR responses while requesting IXFR (thanks Stuart Lau). * Bugfix: Fix malform in Outbound IXFR/TCP subsequent packet (thanks Stuart Lau). * OPENDNSSEC-398: The ods-ksmutil key rollover command does not work correctly when rolling all keys using the -policy option
2013-08-22 13:05:45 +02:00
CONF_FILES+= ${EGDIR}/addns.xml.sample \
${ODS_SYSCONFDIR}/addns.xml
CONF_FILES+= ${EGDIR}/conf.xml.sample \
The OpenDNSSEC project announces the development of Open Source software that manages the security of domain names on the Internet. The project intends to drive adoption of Domain Name System Security Extensions (DNSSEC) to further enhance Internet security.
2010-05-06 14:50:17 +02:00
${ODS_SYSCONFDIR}/conf.xml
CONF_FILES+= ${EGDIR}/kasp.xml.sample \
${ODS_SYSCONFDIR}/kasp.xml
CONF_FILES+= ${EGDIR}/zonelist.xml.sample \
${ODS_SYSCONFDIR}/zonelist.xml
OpenDNSSEC 1.2.1: * ldns 1.6.9 is required for bugfixes. * dnsruby-1.52 required for bugfixes. Bugfixes: * Auditor: 'make check' now works when srcdir != builddir. * Auditor: Include the 'make check' files in the tarball. * Enforcer: Fix the migration script for SQLite. * Enforcer: Increase size of keypairs(id) field in MySQL to allow more than 32767 keys; see MIGRATION for details. * Enforcer: Minor change to NOT_READY_KEY error message. * libhsm: Increase the maximum number of attached HSM:s from 10 to 100. * ods-ksmutil: Send trivial MySQL messages to stdout when exporting zonelist etc. Otherwise the resulting XML needs to be edited by hand. * ods-control: Fix for Bourne shell. * Signer Engine: Prevent race condition when setting up the workers and the command handler. * Signer Engine: Check if the signature exists before recycling it. * Signer Engine: Quit when there are errors in the configuration. * Signer Engine: Enable core dump on failure. * Signer Engine: Explicitly close down log msg with null. * Signer Engine: Backup state after writing output. * Signer Engine: Allow update of serial if internal structure is not initialized.
2011-03-21 16:52:25 +01:00
INSTALLATION_DIRS= ${DOCDIR} ${EGDIR} ${ODS_SYSCONFDIR}
The OpenDNSSEC project announces the development of Open Source software that manages the security of domain names on the Internet. The project intends to drive adoption of Domain Name System Security Extensions (DNSSEC) to further enhance Internet security.
2010-05-06 14:50:17 +02:00
INSTALLATION_DIRS+= share/opendnssec
INSTALLATION_DIRS+= lib/opendnssec
INSTALLATION_DIRS+= lib/opendnssec/signer
INSTALLATION_DIRS+= lib/opendnssec/kasp_auditor
OpenDNSSEC 1.2.0: Bugfixes: * Enforcer: Fixed a number of build warnings. OpenDNSSEC 1.2.0rc3: * Moved migration instructions to the file MIGRATION Bugfixes: * Bugreport #199: The previous DB schema change made the zone removal broken. * Enforcer: When retiring old KSK, use TTL(ds) and not TTL(ksk). * Enforcer: Minimize the set of DS RRs sent to DelegationSignerSubmitCommand. * Enforcer: Replace tab with a space character in the DNSKEY printed to syslog. * Enforcer: Fixed pontential format string bug. * ods-ksmutil: Log to syslog when ds-seen changes a key to active/standby. * Signer Engine: Don't be smart with RRSIG TTLs, the hsm will set them for you. * Signer Engine: Set notify command for zone when receiving ods-signer update. * Signer Engine: Update TTL of NSEC(3) records if SOA Minimum has changed in KASP. * Signer Engine: Now logs to the correct facility. * Signer Engine: Also remove NSEC records when detecting changes in signconf <Denial> * Signer Engine: Dropped privileges before starting Zonefetcher. OpenDNSSEC 1.2.0rc2: Bugfixes: * Signer Engine: Use the correct TTL for RRs after the $INCLUDE directive. * Signer Engine: Also create new signature if TTL of RR has changed. * Signer Engine: Drop old NSEC/NSEC3 records. * ods-ksmutil: Fixed some memory leaks. OpenDNSSEC 1.2.0rc1: * New commandline option for the signer: ods-signer running. * Allow connection to different MySQL ports in the Enforcer. * Tone down and explain warning when converting M or Y to seconds * ldns 1.6.7 is required for bugfixes * dnsruby 1.51 is required for bugfixes Bugfixes: * Bugreport #187: ods-control signer start will return non-zero if start up failed (uses ods-signer running). * Narrow glue at the zone cut is allowed, do not consider it as occluded. * Move zone fetcher output to correct input adapter file. * Enforcer shared keys on zones with ShareKeys disabled. * Make names of key states consistent. * Signer Engine file descriptor leak fix on engine.sock. * Set explicit "unlimited" repository capacity to prevent random integer being read. Requires "ods-ksmutil update conf" to be run if using an existing database. * Fix issue with key generation creating too many keys Ticket #194. * Bugreport #189: Auditor did not handle white-space-seperated substrings for base64 text * Bugreport #190: Auditor (and signer) does not handle case correctly * Signer now silence stdout-output from the notify command OpenDNSSEC 1.2.0b1: * A new signer engine, written in c. Zones are maintained in memory, instead of in files on disk. * Removed the python and python-4suite-xml dependencies. * Remove separate autoconf for libhsm/conf/enforcer. * Add option to disable building the signer. * Signer logs statistics just after outputting a new signed zone. * libhsm will skip processing (and not create) any public keys if the per repository option <SkipPublicKey/> is set. * Keysharing improved - keys can now exist in different states on each zone that the key is in use for. * Backup prepare/commit/rollback added for 2-step backups without taking the enforcer offline. * Standby keys are now optional (default to 0) and should be considered experimental. Bugfixes: * Fix semantics of refresh value in Signer Engine. * Auditor handles chains of empty nonterminals correctly. * Recalculate salt immediately if the saltlength is changed. * libhsm connected to slot 0 if the token label was not found. An error is now returned instead of connecting to the slot. * Bugreport #102: Removed the obsoleted python-4suite-xml dependency. * Fixed Known Issue: KSK rollover requires manual timing. * Fixed Known Issue: Key rollover and reuse of signatures. * Fixed Known Issue: Issue with sharing keys and adding zones. * Fixed Known Issue: Quicksorter does not allow certain owner names (Quicksorter is removed, signer now reads and sorts the zone).
2011-01-24 21:30:28 +01:00
OWN_DIRS+= ${VARBASE}/opendnssec
OWN_DIRS+= ${VARBASE}/opendnssec/tmp
OWN_DIRS+= ${VARBASE}/opendnssec/signconf
OWN_DIRS+= ${VARBASE}/opendnssec/signed
OWN_DIRS+= ${VARBASE}/opendnssec/unsigned
The OpenDNSSEC project announces the development of Open Source software that manages the security of domain names on the Internet. The project intends to drive adoption of Domain Name System Security Extensions (DNSSEC) to further enhance Internet security.
2010-05-06 14:50:17 +02:00
.include "options.mk"
pre-install:
${MKDIR} ${DESTDIR}${PKG_SYSCONFDIR}/opendnssec
OpenDNSSEC 1.2.1: * ldns 1.6.9 is required for bugfixes. * dnsruby-1.52 required for bugfixes. Bugfixes: * Auditor: 'make check' now works when srcdir != builddir. * Auditor: Include the 'make check' files in the tarball. * Enforcer: Fix the migration script for SQLite. * Enforcer: Increase size of keypairs(id) field in MySQL to allow more than 32767 keys; see MIGRATION for details. * Enforcer: Minor change to NOT_READY_KEY error message. * libhsm: Increase the maximum number of attached HSM:s from 10 to 100. * ods-ksmutil: Send trivial MySQL messages to stdout when exporting zonelist etc. Otherwise the resulting XML needs to be edited by hand. * ods-control: Fix for Bourne shell. * Signer Engine: Prevent race condition when setting up the workers and the command handler. * Signer Engine: Check if the signature exists before recycling it. * Signer Engine: Quit when there are errors in the configuration. * Signer Engine: Enable core dump on failure. * Signer Engine: Explicitly close down log msg with null. * Signer Engine: Backup state after writing output. * Signer Engine: Allow update of serial if internal structure is not initialized.
2011-03-21 16:52:25 +01:00
post-install:
${INSTALL} ${WRKSRC}/KNOWN_ISSUES ${DESTDIR}${DOCDIR}
${INSTALL} ${WRKSRC}/MIGRATION ${DESTDIR}${DOCDIR}
The OpenDNSSEC project announces the development of Open Source software that manages the security of domain names on the Internet. The project intends to drive adoption of Domain Name System Security Extensions (DNSSEC) to further enhance Internet security.
2010-05-06 14:50:17 +02:00
#.include "../../devel/cunit/buildlink3.mk"
.include "../../textproc/libxml2/buildlink3.mk"
.include "../../net/ldns/buildlink3.mk"
.include "../../databases/sqlite3/buildlink3.mk"
.include "../../mk/bsd.pkg.mk"
Reference in a new issue Copy permalink