pkgsrc/security/opendnssec/Makefile

94 lines
2.6 KiB
Makefile
Raw Normal View History

# $NetBSD: Makefile,v 1.65 2017/08/07 17:56:13 jlam Exp $
#
DISTNAME= opendnssec-1.4.13
2017-04-22 23:03:07 +02:00
PKGREVISION= 1
CATEGORIES= security net
MASTER_SITES= http://www.opendnssec.org/files/source/
2010-05-06 16:56:16 +02:00
MAINTAINER= pettai@NetBSD.org
HOMEPAGE= http://www.opendnssec.org/
COMMENT= OSS for a fast and easy DNSSEC deployment
LICENSE= 2-clause-bsd
Update OpenDNSSEC to version 1.4.12. Local changes (retained from earlier versions): * Some adaptations of the build setup (conversion scripts etc.) * in signer/ixfr.c, log the zone name if the soamin assertion trigers * in signer/zone.c, if there's a bad ixfr journal file, save it, for debug Upstream changes: News: This is a bug fix release targeting a memory leak in the signer when being used in the "bump in the wire" model where the signer would send out notify messages and respond to IXFR requests for the signed zone. This typically would manifest itself with very frequent outgoing IXFRs over a longer period of time. When upgrading from 1.4.10 (the 1.4.11 release was skipped) no migration steps are needed. For upgrading from earlier releases see the migration steps in the individual releases, most notably in 1.4.8.2. This version of OpenDNSSEC does however require a slightly less older minimal version of the library ldns. Fixes: * OPENDNSSEC-808: Crash on query with empty query section (thanks Havard Eidnes). * SUPPORT-191: Regression, Must accept notify without SOA (thanks Christos Trochalakis). * OPENDNSSEC-845: memory leak occuring when responding to IXFR out when having had multiple updates. * OPENDNSSEC-805: Avoid full resign due to mismatch in backup file when upgrading from 1.4.8 or later. * OPENDNSSEC-828: parsing zone list could show data from next zone when zones iterated on single line. * OPENDNSSEC-811,OPENDNSSEC-827,e.o.: compiler warnings and other static code analysis cleanup * OPENDNSSEC-847: Broken DNS IN notifications when pkt answer section is empty. * OPENDNSSEC-838: Crash in signer after having removed a zone. * Update dependency to ldns to version 1.6.17 enabling the DNS HIP record. * Prevent responding to queries when not fully started yet.
2016-11-06 13:54:35 +01:00
DEPENDS+= ldns>=1.6.17:../../net/ldns
BUILD_DEPENDS+= CUnit-[0-9]*:../../devel/cunit
BUILD_DEFS+= VARBASE
USE_TOOLS+= bash gmake
CONFIG_SHELL= ${BASH}
USE_LANGUAGES= c99 c++
USE_LIBTOOL= yes
GNU_CONFIGURE= yes
CONFIGURE_ARGS+= --prefix=${PREFIX:Q}
CONFIGURE_ARGS+= --localstatedir=${VARBASE}
CONFIGURE_ARGS+= --with-ssl=${BUILDLINK_PREFIX.openssl}
REPLACE_PERL= enforcer/utils/convert_database.pl
REPLACE_PERL+= enforcer/utils/migrate_id_mysql.pl
REPLACE_PERL+= enforcer/utils/migrate_keyshare_mysql.pl
REPLACE_PERL+= enforcer/utils/migrate_keyshare_sqlite3.pl
REPLACE_PERL+= enforcer/utils/migrate_to_ng_mysql.pl
REPLACE_PERL+= enforcer/utils/migrate_to_ng_sqlite.pl
ODS_USER?= opendnssec
ODS_GROUP?= opendnssec
PKG_GROUPS= ${ODS_GROUP}
PKG_USERS= ${ODS_USER}:${ODS_GROUP}
PKG_GECOS.${ODS_USER}= OpenDNSSEC user
PKG_HOME.${ODS_USER}= ${VARBASE}/opendnssec
PKG_SHELL.${ODS_USER}= ${SH}
PKG_USERS_VARS+= ODS_USER
PKG_GROUPS_VARS+= ODS_GROUP
EGDIR= ${PREFIX}/share/examples/opendnssec
DOCDIR= ${PREFIX}/share/doc/opendnssec
PKG_SYSCONFSUBDIR= opendnssec
SUBST_CLASSES+= paths
SUBST_FILES.paths= ${WRKSRC}/conf/Makefile.in
SUBST_STAGE.paths= post-patch
SUBST_SED.paths= -e 's,@EGDIR@,${EGDIR},'
CXXFLAGS.NetBSD+= -D_NETBSD_SOURCE
CONF_FILES+= ${EGDIR}/addns.xml.sample \
${PKG_SYSCONFDIR}/addns.xml
CONF_FILES+= ${EGDIR}/conf.xml.sample \
${PKG_SYSCONFDIR}/conf.xml
CONF_FILES+= ${EGDIR}/kasp.xml.sample \
${PKG_SYSCONFDIR}/kasp.xml
CONF_FILES+= ${EGDIR}/zonelist.xml.sample \
${PKG_SYSCONFDIR}/zonelist.xml
INSTALLATION_DIRS= ${DOCDIR} ${EGDIR}
INSTALLATION_DIRS+= share/opendnssec
INSTALLATION_DIRS+= lib/opendnssec
INSTALLATION_DIRS+= lib/opendnssec/signer
INSTALLATION_DIRS+= lib/opendnssec/kasp_auditor
OpenDNSSEC 1.2.0: Bugfixes: * Enforcer: Fixed a number of build warnings. OpenDNSSEC 1.2.0rc3: * Moved migration instructions to the file MIGRATION Bugfixes: * Bugreport #199: The previous DB schema change made the zone removal broken. * Enforcer: When retiring old KSK, use TTL(ds) and not TTL(ksk). * Enforcer: Minimize the set of DS RRs sent to DelegationSignerSubmitCommand. * Enforcer: Replace tab with a space character in the DNSKEY printed to syslog. * Enforcer: Fixed pontential format string bug. * ods-ksmutil: Log to syslog when ds-seen changes a key to active/standby. * Signer Engine: Don't be smart with RRSIG TTLs, the hsm will set them for you. * Signer Engine: Set notify command for zone when receiving ods-signer update. * Signer Engine: Update TTL of NSEC(3) records if SOA Minimum has changed in KASP. * Signer Engine: Now logs to the correct facility. * Signer Engine: Also remove NSEC records when detecting changes in signconf <Denial> * Signer Engine: Dropped privileges before starting Zonefetcher. OpenDNSSEC 1.2.0rc2: Bugfixes: * Signer Engine: Use the correct TTL for RRs after the $INCLUDE directive. * Signer Engine: Also create new signature if TTL of RR has changed. * Signer Engine: Drop old NSEC/NSEC3 records. * ods-ksmutil: Fixed some memory leaks. OpenDNSSEC 1.2.0rc1: * New commandline option for the signer: ods-signer running. * Allow connection to different MySQL ports in the Enforcer. * Tone down and explain warning when converting M or Y to seconds * ldns 1.6.7 is required for bugfixes * dnsruby 1.51 is required for bugfixes Bugfixes: * Bugreport #187: ods-control signer start will return non-zero if start up failed (uses ods-signer running). * Narrow glue at the zone cut is allowed, do not consider it as occluded. * Move zone fetcher output to correct input adapter file. * Enforcer shared keys on zones with ShareKeys disabled. * Make names of key states consistent. * Signer Engine file descriptor leak fix on engine.sock. * Set explicit "unlimited" repository capacity to prevent random integer being read. Requires "ods-ksmutil update conf" to be run if using an existing database. * Fix issue with key generation creating too many keys Ticket #194. * Bugreport #189: Auditor did not handle white-space-seperated substrings for base64 text * Bugreport #190: Auditor (and signer) does not handle case correctly * Signer now silence stdout-output from the notify command OpenDNSSEC 1.2.0b1: * A new signer engine, written in c. Zones are maintained in memory, instead of in files on disk. * Removed the python and python-4suite-xml dependencies. * Remove separate autoconf for libhsm/conf/enforcer. * Add option to disable building the signer. * Signer logs statistics just after outputting a new signed zone. * libhsm will skip processing (and not create) any public keys if the per repository option <SkipPublicKey/> is set. * Keysharing improved - keys can now exist in different states on each zone that the key is in use for. * Backup prepare/commit/rollback added for 2-step backups without taking the enforcer offline. * Standby keys are now optional (default to 0) and should be considered experimental. Bugfixes: * Fix semantics of refresh value in Signer Engine. * Auditor handles chains of empty nonterminals correctly. * Recalculate salt immediately if the saltlength is changed. * libhsm connected to slot 0 if the token label was not found. An error is now returned instead of connecting to the slot. * Bugreport #102: Removed the obsoleted python-4suite-xml dependency. * Fixed Known Issue: KSK rollover requires manual timing. * Fixed Known Issue: Key rollover and reuse of signatures. * Fixed Known Issue: Issue with sharing keys and adding zones. * Fixed Known Issue: Quicksorter does not allow certain owner names (Quicksorter is removed, signer now reads and sorts the zone).
2011-01-24 21:30:28 +01:00
OWN_DIRS+= ${VARBASE}/opendnssec
OWN_DIRS+= ${VARBASE}/opendnssec/tmp
OWN_DIRS+= ${VARBASE}/opendnssec/signconf
OWN_DIRS+= ${VARBASE}/opendnssec/signed
OWN_DIRS+= ${VARBASE}/opendnssec/unsigned
2014-10-28 14:26:37 +01:00
RCD_SCRIPTS= opendnssec
.include "options.mk"
pre-install:
${MKDIR} ${DESTDIR}${PKG_SYSCONFDIR}
post-install:
${INSTALL} ${WRKSRC}/KNOWN_ISSUES ${DESTDIR}${DOCDIR}
${INSTALL} ${WRKSRC}/MIGRATION ${DESTDIR}${DOCDIR}
.include "../../databases/sqlite3/buildlink3.mk"
.include "../../net/ldns/buildlink3.mk"
.include "../../security/openssl/buildlink3.mk"
.include "../../textproc/libxml2/buildlink3.mk"
.include "../../mk/bsd.pkg.mk"