Merge updates from master

18 files changed, 1216 insertions, 60 deletions

diff --git a/eclass/cmake.eclass b/eclass/cmake.eclass
index ddee554d429f..62fa02715700 100644
--- a/eclass/cmake.eclass
+++ b/eclass/cmake.eclass
@@ -292,7 +292,7 @@ _cmake_modify-cmakelists() {
 	# NOTE Append some useful summary here
 	cat >> "${CMAKE_USE_DIR}"/CMakeLists.txt <<- _EOF_ || die
 
-		MESSAGE(STATUS "<<< Gentoo configuration >>>
+		message(STATUS "<<< Gentoo configuration >>>
 		Build type      \${CMAKE_BUILD_TYPE}
 		Install path    \${CMAKE_INSTALL_PREFIX}
 		Compiler flags:
@@ -392,12 +392,12 @@ cmake_src_configure() {
 	local build_rules=${BUILD_DIR}/gentoo_rules.cmake
 
 	cat > "${build_rules}" <<- _EOF_ || die
-		SET (CMAKE_ASM_COMPILE_OBJECT "<CMAKE_ASM_COMPILER> <DEFINES> <INCLUDES> ${CPPFLAGS} <FLAGS> -o <OBJECT> -c <SOURCE>" CACHE STRING "ASM compile command" FORCE)
-		SET (CMAKE_ASM-ATT_COMPILE_OBJECT "<CMAKE_ASM-ATT_COMPILER> <DEFINES> <INCLUDES> ${CPPFLAGS} <FLAGS> -o <OBJECT> -c -x assembler <SOURCE>" CACHE STRING "ASM-ATT compile command" FORCE)
-		SET (CMAKE_ASM-ATT_LINK_FLAGS "-nostdlib" CACHE STRING "ASM-ATT link flags" FORCE)
-		SET (CMAKE_C_COMPILE_OBJECT "<CMAKE_C_COMPILER> <DEFINES> <INCLUDES> ${CPPFLAGS} <FLAGS> -o <OBJECT> -c <SOURCE>" CACHE STRING "C compile command" FORCE)
-		SET (CMAKE_CXX_COMPILE_OBJECT "<CMAKE_CXX_COMPILER> <DEFINES> <INCLUDES> ${CPPFLAGS} <FLAGS> -o <OBJECT> -c <SOURCE>" CACHE STRING "C++ compile command" FORCE)
-		SET (CMAKE_Fortran_COMPILE_OBJECT "<CMAKE_Fortran_COMPILER> <DEFINES> <INCLUDES> ${FCFLAGS} <FLAGS> -o <OBJECT> -c <SOURCE>" CACHE STRING "Fortran compile command" FORCE)
+		set(CMAKE_ASM_COMPILE_OBJECT "<CMAKE_ASM_COMPILER> <DEFINES> <INCLUDES> ${CPPFLAGS} <FLAGS> -o <OBJECT> -c <SOURCE>" CACHE STRING "ASM compile command" FORCE)
+		set(CMAKE_ASM-ATT_COMPILE_OBJECT "<CMAKE_ASM-ATT_COMPILER> <DEFINES> <INCLUDES> ${CPPFLAGS} <FLAGS> -o <OBJECT> -c -x assembler <SOURCE>" CACHE STRING "ASM-ATT compile command" FORCE)
+		set(CMAKE_ASM-ATT_LINK_FLAGS "-nostdlib" CACHE STRING "ASM-ATT link flags" FORCE)
+		set(CMAKE_C_COMPILE_OBJECT "<CMAKE_C_COMPILER> <DEFINES> <INCLUDES> ${CPPFLAGS} <FLAGS> -o <OBJECT> -c <SOURCE>" CACHE STRING "C compile command" FORCE)
+		set(CMAKE_CXX_COMPILE_OBJECT "<CMAKE_CXX_COMPILER> <DEFINES> <INCLUDES> ${CPPFLAGS} <FLAGS> -o <OBJECT> -c <SOURCE>" CACHE STRING "C++ compile command" FORCE)
+		set(CMAKE_Fortran_COMPILE_OBJECT "<CMAKE_Fortran_COMPILER> <DEFINES> <INCLUDES> ${FCFLAGS} <FLAGS> -o <OBJECT> -c <SOURCE>" CACHE STRING "Fortran compile command" FORCE)
 	_EOF_
 
 	local myCC=$(tc-getCC) myCXX=$(tc-getCXX) myFC=$(tc-getFC)
@@ -409,14 +409,14 @@ cmake_src_configure() {
 	# space separated.
 	local toolchain_file=${BUILD_DIR}/gentoo_toolchain.cmake
 	cat > ${toolchain_file} <<- _EOF_ || die
-		SET (CMAKE_ASM_COMPILER "${myCC/ /;}")
-		SET (CMAKE_ASM-ATT_COMPILER "${myCC/ /;}")
-		SET (CMAKE_C_COMPILER "${myCC/ /;}")
-		SET (CMAKE_CXX_COMPILER "${myCXX/ /;}")
-		SET (CMAKE_Fortran_COMPILER "${myFC/ /;}")
-		SET (CMAKE_AR $(type -P $(tc-getAR)) CACHE FILEPATH "Archive manager" FORCE)
-		SET (CMAKE_RANLIB $(type -P $(tc-getRANLIB)) CACHE FILEPATH "Archive index generator" FORCE)
-		SET (CMAKE_SYSTEM_PROCESSOR "${CHOST%%-*}")
+		set(CMAKE_ASM_COMPILER "${myCC/ /;}")
+		set(CMAKE_ASM-ATT_COMPILER "${myCC/ /;}")
+		set(CMAKE_C_COMPILER "${myCC/ /;}")
+		set(CMAKE_CXX_COMPILER "${myCXX/ /;}")
+		set(CMAKE_Fortran_COMPILER "${myFC/ /;}")
+		set(CMAKE_AR $(type -P $(tc-getAR)) CACHE FILEPATH "Archive manager" FORCE)
+		set(CMAKE_RANLIB $(type -P $(tc-getRANLIB)) CACHE FILEPATH "Archive index generator" FORCE)
+		set(CMAKE_SYSTEM_PROCESSOR "${CHOST%%-*}")
 	_EOF_
 
 	# We are using the C compiler for assembly by default.
@@ -432,24 +432,24 @@ cmake_src_configure() {
 			Winnt)
 				sysname="Windows"
 				cat >> "${toolchain_file}" <<- _EOF_ || die
-					SET (CMAKE_RC_COMPILER $(tc-getRC))
+					set(CMAKE_RC_COMPILER $(tc-getRC))
 				_EOF_
 				;;
 			*) sysname="${KERNEL}" ;;
 		esac
 
 		cat >> "${toolchain_file}" <<- _EOF_ || die
-			SET (CMAKE_SYSTEM_NAME "${sysname}")
+			set(CMAKE_SYSTEM_NAME "${sysname}")
 		_EOF_
 
 		if [ "${SYSROOT:-/}" != "/" ] ; then
 			# When cross-compiling with a sysroot (e.g. with crossdev's emerge wrappers)
 			# we need to tell cmake to use libs/headers from the sysroot but programs from / only.
 			cat >> "${toolchain_file}" <<- _EOF_ || die
-				SET (CMAKE_FIND_ROOT_PATH "${SYSROOT}")
-				SET (CMAKE_FIND_ROOT_PATH_MODE_PROGRAM NEVER)
-				SET (CMAKE_FIND_ROOT_PATH_MODE_LIBRARY ONLY)
-				SET (CMAKE_FIND_ROOT_PATH_MODE_INCLUDE ONLY)
+				set(CMAKE_FIND_ROOT_PATH "${SYSROOT}")
+				set(CMAKE_FIND_ROOT_PATH_MODE_PROGRAM NEVER)
+				set(CMAKE_FIND_ROOT_PATH_MODE_LIBRARY ONLY)
+				set(CMAKE_FIND_ROOT_PATH_MODE_INCLUDE ONLY)
 			_EOF_
 		fi
 	fi
@@ -458,20 +458,16 @@ cmake_src_configure() {
 		cat >> "${build_rules}" <<- _EOF_ || die
 			# in Prefix we need rpath and must ensure cmake gets our default linker path
 			# right ... except for Darwin hosts
-			IF (NOT APPLE)
-			SET (CMAKE_SKIP_RPATH OFF CACHE BOOL "" FORCE)
-			SET (CMAKE_PLATFORM_REQUIRED_RUNTIME_PATH "${EPREFIX}/usr/${CHOST}/lib/gcc;${EPREFIX}/usr/${CHOST}/lib;${EPREFIX}/usr/$(get_libdir);${EPREFIX}/$(get_libdir)"
-			CACHE STRING "" FORCE)
-
-			ELSE ()
-
-			SET (CMAKE_PREFIX_PATH "${EPREFIX}/usr" CACHE STRING "" FORCE)
-			SET (CMAKE_MACOSX_RPATH ON CACHE BOOL "" FORCE)
-			SET (CMAKE_SKIP_BUILD_RPATH OFF CACHE BOOL "" FORCE)
-			SET (CMAKE_SKIP_RPATH OFF CACHE BOOL "" FORCE)
-			SET (CMAKE_INSTALL_RPATH_USE_LINK_PATH TRUE CACHE BOOL "" FORCE)
-
-			ENDIF (NOT APPLE)
+			if(NOT APPLE)
+				set(CMAKE_SKIP_RPATH OFF CACHE BOOL "" FORCE)
+				set(CMAKE_PLATFORM_REQUIRED_RUNTIME_PATH "${EPREFIX}/usr/${CHOST}/lib/gcc;${EPREFIX}/usr/${CHOST}/lib;${EPREFIX}/usr/$(get_libdir);${EPREFIX}/$(get_libdir)" CACHE STRING "" FORCE)
+			else()
+				set(CMAKE_PREFIX_PATH "${EPREFIX}/usr" CACHE STRING "" FORCE)
+				set(CMAKE_MACOSX_RPATH ON CACHE BOOL "" FORCE)
+				set(CMAKE_SKIP_BUILD_RPATH OFF CACHE BOOL "" FORCE)
+				set(CMAKE_SKIP_RPATH OFF CACHE BOOL "" FORCE)
+				set(CMAKE_INSTALL_RPATH_USE_LINK_PATH TRUE CACHE BOOL "" FORCE)
+			endif()
 		_EOF_
 	fi
 
@@ -479,41 +475,41 @@ cmake_src_configure() {
 	local common_config=${BUILD_DIR}/gentoo_common_config.cmake
 	local libdir=$(get_libdir)
 	cat > "${common_config}" <<- _EOF_ || die
-		SET (CMAKE_GENTOO_BUILD ON CACHE BOOL "Indicate Gentoo package build")
-		SET (LIB_SUFFIX ${libdir/lib} CACHE STRING "library path suffix" FORCE)
-		SET (CMAKE_INSTALL_LIBDIR ${libdir} CACHE PATH "Output directory for libraries")
-		SET (CMAKE_INSTALL_INFODIR "${EPREFIX}/usr/share/info" CACHE PATH "")
-		SET (CMAKE_INSTALL_MANDIR "${EPREFIX}/usr/share/man" CACHE PATH "")
-		SET (CMAKE_USER_MAKE_RULES_OVERRIDE "${build_rules}" CACHE FILEPATH "Gentoo override rules")
-		SET (CMAKE_INSTALL_DOCDIR "${EPREFIX}/usr/share/doc/${PF}" CACHE PATH "")
-		SET (BUILD_SHARED_LIBS ON CACHE BOOL "")
+		set(CMAKE_GENTOO_BUILD ON CACHE BOOL "Indicate Gentoo package build")
+		set(LIB_SUFFIX ${libdir/lib} CACHE STRING "library path suffix" FORCE)
+		set(CMAKE_INSTALL_LIBDIR ${libdir} CACHE PATH "Output directory for libraries")
+		set(CMAKE_INSTALL_INFODIR "${EPREFIX}/usr/share/info" CACHE PATH "")
+		set(CMAKE_INSTALL_MANDIR "${EPREFIX}/usr/share/man" CACHE PATH "")
+		set(CMAKE_USER_MAKE_RULES_OVERRIDE "${build_rules}" CACHE FILEPATH "Gentoo override rules")
+		set(CMAKE_INSTALL_DOCDIR "${EPREFIX}/usr/share/doc/${PF}" CACHE PATH "")
+		set(BUILD_SHARED_LIBS ON CACHE BOOL "")
 	_EOF_
 
 	if [[ -n ${_ECM_ECLASS} ]]; then
-		echo 'SET (ECM_DISABLE_QMLPLUGINDUMP ON CACHE BOOL "")' >> "${common_config}" || die
+		echo 'set(ECM_DISABLE_QMLPLUGINDUMP ON CACHE BOOL "")' >> "${common_config}" || die
 	fi
 
 	# See bug 689410
 	if [[ "${ARCH}" == riscv ]]; then
-		echo 'SET (CMAKE_FIND_LIBRARY_CUSTOM_LIB_SUFFIX '"${libdir#lib}"' CACHE STRING "library search suffix" FORCE)' >> "${common_config}" || die
+		echo 'set(CMAKE_FIND_LIBRARY_CUSTOM_LIB_SUFFIX '"${libdir#lib}"' CACHE STRING "library search suffix" FORCE)' >> "${common_config}" || die
 	fi
 
 	if [[ "${NOCOLOR}" = true || "${NOCOLOR}" = yes ]]; then
-		echo 'SET (CMAKE_COLOR_MAKEFILE OFF CACHE BOOL "pretty colors during make" FORCE)' >> "${common_config}" || die
+		echo 'set(CMAKE_COLOR_MAKEFILE OFF CACHE BOOL "pretty colors during make" FORCE)' >> "${common_config}" || die
 	fi
 
 	# Wipe the default optimization flags out of CMake
 	if [[ ${CMAKE_BUILD_TYPE} != Gentoo ]]; then
 		cat >> ${common_config} <<- _EOF_ || die
-			SET (CMAKE_ASM_FLAGS_${CMAKE_BUILD_TYPE^^} "" CACHE STRING "")
-			SET (CMAKE_ASM-ATT_FLAGS_${CMAKE_BUILD_TYPE^^} "" CACHE STRING "")
-			SET (CMAKE_C_FLAGS_${CMAKE_BUILD_TYPE^^} "" CACHE STRING "")
-			SET (CMAKE_CXX_FLAGS_${CMAKE_BUILD_TYPE^^} "" CACHE STRING "")
-			SET (CMAKE_Fortran_FLAGS_${CMAKE_BUILD_TYPE^^} "" CACHE STRING "")
-			SET (CMAKE_EXE_LINKER_FLAGS_${CMAKE_BUILD_TYPE^^} "" CACHE STRING "")
-			SET (CMAKE_MODULE_LINKER_FLAGS_${CMAKE_BUILD_TYPE^^} "" CACHE STRING "")
-			SET (CMAKE_SHARED_LINKER_FLAGS_${CMAKE_BUILD_TYPE^^} "" CACHE STRING "")
-			SET (CMAKE_STATIC_LINKER_FLAGS_${CMAKE_BUILD_TYPE^^} "" CACHE STRING "")
+			set(CMAKE_ASM_FLAGS_${CMAKE_BUILD_TYPE^^} "" CACHE STRING "")
+			set(CMAKE_ASM-ATT_FLAGS_${CMAKE_BUILD_TYPE^^} "" CACHE STRING "")
+			set(CMAKE_C_FLAGS_${CMAKE_BUILD_TYPE^^} "" CACHE STRING "")
+			set(CMAKE_CXX_FLAGS_${CMAKE_BUILD_TYPE^^} "" CACHE STRING "")
+			set(CMAKE_Fortran_FLAGS_${CMAKE_BUILD_TYPE^^} "" CACHE STRING "")
+			set(CMAKE_EXE_LINKER_FLAGS_${CMAKE_BUILD_TYPE^^} "" CACHE STRING "")
+			set(CMAKE_MODULE_LINKER_FLAGS_${CMAKE_BUILD_TYPE^^} "" CACHE STRING "")
+			set(CMAKE_SHARED_LINKER_FLAGS_${CMAKE_BUILD_TYPE^^} "" CACHE STRING "")
+			set(CMAKE_STATIC_LINKER_FLAGS_${CMAKE_BUILD_TYPE^^} "" CACHE STRING "")
 		_EOF_
 	fi
 
diff --git a/media-sound/elisa/elisa-20.04.3.ebuild b/media-sound/elisa/elisa-20.04.3.ebuild
index 4f1b4d807e97..08fe72fcd012 100644
--- a/media-sound/elisa/elisa-20.04.3.ebuild
+++ b/media-sound/elisa/elisa-20.04.3.ebuild
@@ -11,8 +11,7 @@ QTMIN=5.14.2
 inherit ecm kde.org
 
 DESCRIPTION="Simple music player by KDE"
-HOMEPAGE="https://kde.org/applications/multimedia/org.kde.elisa
-https://community.kde.org/Elisa"
+HOMEPAGE="https://elisa.kde.org/ https://kde.org/applications/en/elisa"
 
 LICENSE="LGPL-3+"
 SLOT="5"
diff --git a/media-sound/elisa/elisa-20.08.1.ebuild b/media-sound/elisa/elisa-20.08.1.ebuild
index a3e77d8776db..9eecd3942ffb 100644
--- a/media-sound/elisa/elisa-20.08.1.ebuild
+++ b/media-sound/elisa/elisa-20.08.1.ebuild
@@ -11,8 +11,7 @@ QTMIN=5.14.2
 inherit ecm kde.org
 
 DESCRIPTION="Simple music player by KDE"
-HOMEPAGE="https://kde.org/applications/multimedia/org.kde.elisa
-https://community.kde.org/Elisa"
+HOMEPAGE="https://elisa.kde.org/ https://kde.org/applications/en/elisa"
 
 LICENSE="LGPL-3+"
 SLOT="5"
diff --git a/media-video/subtitlecomposer/subtitlecomposer-0.7.0.ebuild b/media-video/subtitlecomposer/subtitlecomposer-0.7.0.ebuild
index f61bf8ca94d2..87743030541f 100644
--- a/media-video/subtitlecomposer/subtitlecomposer-0.7.0.ebuild
+++ b/media-video/subtitlecomposer/subtitlecomposer-0.7.0.ebuild
@@ -10,7 +10,7 @@ VIRTUALX_REQUIRED="test"
 inherit ecm
 
 DESCRIPTION="Text-based subtitles editor"
-HOMEPAGE="https://github.com/maxrd2/subtitlecomposer"
+HOMEPAGE="https://subtitlecomposer.kde.org/"
 SRC_URI="https://github.com/maxrd2/${PN}/archive/v${PV}.tar.gz -> ${P}.tar.gz"
 
 LICENSE="GPL-2"
diff --git a/net-dns/opendnssec/Manifest b/net-dns/opendnssec/Manifest
index b7655458e116..0136e5ba4f94 100644
--- a/net-dns/opendnssec/Manifest
+++ b/net-dns/opendnssec/Manifest
@@ -1 +1,5 @@
+DIST opendnssec-1.3.18.tar.gz 1143889 BLAKE2B 0443a9d29de479257c05d024a756c176a342032eb17b105c04f5808ba550f1026815f191bce6ada13c54a7b7fea0f816d7754227f3d1c9ed76bc4d602785c2cf SHA512 5df39ba778c9b1245e88b81df7aa491bca0aad2943845284c4f8b4dd729fa69014d45f07bdf99a048ccf668a1c9675a8dd99efcec1abdbd4e06e9738fec6ab6d
+DIST opendnssec-1.4.12.tar.gz 1036392 BLAKE2B 3bfbcfe91d7da7c2e4b1c5439f7d55e15612ab6ace6af25fcb9c9eb7ddb2e1055e70684c2bd6bbae57a0c2eb78098b448f7dca198e0d6f9e2e812945a1f06cc2 SHA512 b72b76ab4aec8cc63cc9c020bef9a24b000fd00172a07cf43d57b3a33041bef9e107b71eb7271bb13c3566510599c6a1913cf986a724e169c42dc8bdac8d2e51
+DIST opendnssec-1.4.8.2.tar.gz 1043171 BLAKE2B 20b1fa0d97b776223314937061cd42f4fe0a924e58a159fd0399d23058e2b0fd44d55049947de26c36aade5b5599527fc03f09eeef4e20f8c9beee40dfbcd7fb SHA512 7f2e10b425f60947aca40c61509b07ddc4363105cc882b518ffa816437299d6f881411cb38325f27b3a34c2005953988b39c945362866dd0f1f7c6ef973bfa06
+DIST opendnssec-2.0.1.tar.gz 1101523 BLAKE2B 0446efd04e73e00d204c53164c3c6aaecb9f37014a110ee85d7e7b1728d225aafcf9e6ef31a7dd29cdf2e875e7b653ab6e8178cece65c47a1c5b027facc16130 SHA512 aa12818f92688e087acaff8a6771d2a7da733e04d9e821967d313c7ff880a1056f470b11988eba1e7aad606418c3a4587f654163d74f68e3f61943c74d86d052
 DIST opendnssec-2.0.3.tar.gz 1103355 BLAKE2B b64e729003de86e4139efaad60c9feae9f4e19c16a29fdced55d66f5896c4b7d76c4b8c57a8330d55c0c03e87de1ebe6ec49ef9d1b6e215be963680d2c805579 SHA512 4745a9ac317cc65d6f5b14be640687efd5fde2149541f692fb607a458378d27e903f175023c1aa16a777d17cef9cc68f1a84e7e7cdb233466d26756721b34424
diff --git a/net-dns/opendnssec/files/opendnssec-1.3.14-drop-privileges.patch b/net-dns/opendnssec/files/opendnssec-1.3.14-drop-privileges.patch
new file mode 100644
index 000000000000..7c9f72355d20
--- /dev/null
+++ b/net-dns/opendnssec/files/opendnssec-1.3.14-drop-privileges.patch
@@ -0,0 +1,43 @@
+Index: conf/conf.xml.in
+===================================================================
+--- conf/conf.xml.in	(revision 3022)
++++ conf/conf.xml.in	(working copy)
+@@ -38,12 +38,10 @@
+ 	</Common>
+ 
+ 	<Enforcer>
+-<!--
+ 		<Privileges>
+ 			<User>opendnssec</User>
+ 			<Group>opendnssec</Group>
+ 		</Privileges>
+--->
+ 
+ 		<Datastore><SQLite>@OPENDNSSEC_STATE_DIR@/kasp.db</SQLite></Datastore>
+ 		<Interval>PT3600S</Interval>
+@@ -56,12 +54,10 @@
+ 	</Enforcer>
+ 
+ 	<Signer>
+-<!--
+ 		<Privileges>
+ 			<User>opendnssec</User>
+ 			<Group>opendnssec</Group>
+ 		</Privileges>
+--->
+ 
+ 		<WorkingDirectory>@OPENDNSSEC_STATE_DIR@/tmp</WorkingDirectory>
+ 		<WorkerThreads>8</WorkerThreads>
+@@ -80,12 +76,10 @@
+ 	</Signer>
+ 
+ 	<Auditor>
+-<!--
+ 		<Privileges>
+ 			<User>opendnssec</User>
+ 			<Group>opendnssec</Group>
+ 		</Privileges>
+--->
+ 
+ 		<WorkingDirectory>@OPENDNSSEC_STATE_DIR@/tmp</WorkingDirectory>
+ 	</Auditor>
diff --git a/net-dns/opendnssec/files/opendnssec-1.3.14-use-system-trang.patch b/net-dns/opendnssec/files/opendnssec-1.3.14-use-system-trang.patch
new file mode 100644
index 000000000000..39678408264a
--- /dev/null
+++ b/net-dns/opendnssec/files/opendnssec-1.3.14-use-system-trang.patch
@@ -0,0 +1,21 @@
+diff -urN opendnssec-1.3.0rc3.old/conf/Makefile.am opendnssec-1.3.0rc3/conf/Makefile.am
+--- opendnssec-1.3.0rc3.old/conf/Makefile.am	2011-07-01 21:15:25.000000000 +0200
++++ opendnssec-1.3.0rc3/conf/Makefile.am	2011-07-01 21:17:00.000000000 +0200
+@@ -7,7 +7,7 @@
+ XML =	conf.xml kasp.xml zonelist.xml signconf.xml zonefetch.xml
+ XSL=	kasp2html.xsl
+ 
+-TRANG=	$(srcdir)/trang/trang.jar
++TRANG=	/usr/bin/trang
+ 
+ sysconfdir = @sysconfdir@/opendnssec
+ datadir = @datadir@/opendnssec
+@@ -25,7 +25,7 @@
+ .rnc.rng:
+ 	@test -x "${JAVA}" || \
+ 		(echo "java is required for converting RelaxNG Compact to RelaxNG"; false)
+-	${JAVA} -jar ${TRANG} $< $@
++	${TRANG} $< $@
+ 
+ regress: $(RNG)
+ 	@test -x "${XMLLINT}" || \
diff --git a/net-dns/opendnssec/files/opendnssec-1.3.18-eppclient-curl-CVE-2012-5582.patch b/net-dns/opendnssec/files/opendnssec-1.3.18-eppclient-curl-CVE-2012-5582.patch
new file mode 100644
index 000000000000..a0676dd091be
--- /dev/null
+++ b/net-dns/opendnssec/files/opendnssec-1.3.18-eppclient-curl-CVE-2012-5582.patch
@@ -0,0 +1,12 @@
+diff -urN opendnssec-1.3.18.orig/plugins/eppclient/src/epp.c opendnssec-1.3.18/plugins/eppclient/src/epp.c
+--- opendnssec-1.3.18.orig/plugins/eppclient/src/epp.c	2014-07-21 11:16:10.000000000 +0200
++++ opendnssec-1.3.18/plugins/eppclient/src/epp.c	2016-03-23 22:25:18.679354984 +0100
+@@ -390,7 +390,7 @@
+     curl_easy_setopt(curl, CURLOPT_URL, url);
+     curl_easy_setopt(curl, CURLOPT_CONNECT_ONLY, 1L);
+     curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 1L);
+-    curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 1L);
++    curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 2L);
+     curl_easy_setopt(curl, CURLOPT_USE_SSL, CURLUSESSL_ALL);
+     curl_easy_setopt(curl, CURLOPT_ERRORBUFFER, curlerr);
+     curl_easy_setopt(curl, CURLOPT_NOPROGRESS, 1L);
diff --git a/net-dns/opendnssec/files/opendnssec-drop-privileges.patch b/net-dns/opendnssec/files/opendnssec-drop-privileges.patch
new file mode 100644
index 000000000000..c1972bbc3d1b
--- /dev/null
+++ b/net-dns/opendnssec/files/opendnssec-drop-privileges.patch
@@ -0,0 +1,28 @@
+--- conf/conf.xml.in.orig	2013-05-12 22:36:47.530988182 +0200
++++ conf/conf.xml.in	2013-05-12 22:37:56.459817918 +0200
+@@ -38,12 +38,10 @@
+ 	</Common>
+ 
+ 	<Enforcer>
+-<!--
+ 		<Privileges>
+ 			<User>opendnssec</User>
+ 			<Group>opendnssec</Group>
+ 		</Privileges>
+--->
+ <!-- NOTE: Enforcer worker threads are not used; this option is ignored -->
+ <!--
+ 		<WorkerThreads>4</WorkerThreads>
+@@ -60,12 +58,10 @@
+ 	</Enforcer>
+ 
+ 	<Signer>
+-<!--
+ 		<Privileges>
+ 			<User>opendnssec</User>
+ 			<Group>opendnssec</Group>
+ 		</Privileges>
+--->
+ 
+ 		<WorkingDirectory>@OPENDNSSEC_STATE_DIR@/tmp</WorkingDirectory>
+ 		<WorkerThreads>4</WorkerThreads>
diff --git a/net-dns/opendnssec/files/opendnssec-fix-localstatedir.patch b/net-dns/opendnssec/files/opendnssec-fix-localstatedir.patch
new file mode 100644
index 000000000000..3958c6c70ccf
--- /dev/null
+++ b/net-dns/opendnssec/files/opendnssec-fix-localstatedir.patch
@@ -0,0 +1,32 @@
+diff -urN opendnssec-1.3.0rc2.old/Makefile.am opendnssec-1.3.0rc2/Makefile.am
+--- opendnssec-1.3.0rc2.old/Makefile.am	2011-06-02 13:48:56.000000000 +0200
++++ opendnssec-1.3.0rc2/Makefile.am	2011-06-02 13:49:19.000000000 +0200
+@@ -31,11 +31,11 @@
+ 
+ install-data-hook:
+ 	$(INSTALL) -d $(DESTDIR)$(localstatedir)
+-	$(INSTALL) -d $(DESTDIR)$(localstatedir)/opendnssec
+-	$(INSTALL) -d $(DESTDIR)$(localstatedir)/opendnssec/tmp
+-	$(INSTALL) -d $(DESTDIR)$(localstatedir)/opendnssec/signconf
+-	$(INSTALL) -d $(DESTDIR)$(localstatedir)/opendnssec/unsigned
+-	$(INSTALL) -d $(DESTDIR)$(localstatedir)/opendnssec/signed
++	$(INSTALL) -d $(DESTDIR)$(localstatedir)/lib/opendnssec
++	$(INSTALL) -d $(DESTDIR)$(localstatedir)/lib/opendnssec/tmp
++	$(INSTALL) -d $(DESTDIR)$(localstatedir)/lib/opendnssec/signconf
++	$(INSTALL) -d $(DESTDIR)$(localstatedir)/lib/opendnssec/unsigned
++	$(INSTALL) -d $(DESTDIR)$(localstatedir)/lib/opendnssec/signed
+ 	$(INSTALL) -d $(DESTDIR)$(localstatedir)/run
+ 	$(INSTALL) -d $(DESTDIR)$(localstatedir)/run/opendnssec
+ 
+diff -urN opendnssec-1.3.0rc2.old/m4/opendnssec_common.m4 opendnssec-1.3.0rc2/m4/opendnssec_common.m4
+--- opendnssec-1.3.0rc2.old/m4/opendnssec_common.m4	2011-06-02 13:48:56.000000000 +0200
++++ opendnssec-1.3.0rc2/m4/opendnssec_common.m4	2011-06-02 13:49:36.000000000 +0200
+@@ -18,7 +18,7 @@
+ OPENDNSSEC_LIBEXEC_DIR=$full_libexecdir/opendnssec
+ OPENDNSSEC_DATA_DIR=$full_datadir/opendnssec
+ OPENDNSSEC_SYSCONF_DIR=$full_sysconfdir/opendnssec
+-OPENDNSSEC_LOCALSTATE_DIR="$full_localstatedir/opendnssec"
++OPENDNSSEC_LOCALSTATE_DIR="$full_localstatedir/lib/opendnssec"
+ OPENDNSSEC_PID_DIR="$full_localstatedir/run/opendnssec"
+ 
+ AC_SUBST([OPENDNSSEC_BIN_DIR])
diff --git a/net-dns/opendnssec/files/opendnssec-fix-run-dir.patch b/net-dns/opendnssec/files/opendnssec-fix-run-dir.patch
new file mode 100644
index 000000000000..fe5b504344cf
--- /dev/null
+++ b/net-dns/opendnssec/files/opendnssec-fix-run-dir.patch
@@ -0,0 +1,26 @@
+diff -ur opendnssec-1.3.12.orig/m4/opendnssec_common.m4 opendnssec-1.3.12/m4/opendnssec_common.m4
+--- opendnssec-1.3.12.orig/m4/opendnssec_common.m4	2013-01-31 13:46:01.122201232 +0100
++++ opendnssec-1.3.12/m4/opendnssec_common.m4	2013-01-31 13:54:47.648861211 +0100
+@@ -19,7 +19,7 @@
+ OPENDNSSEC_DATA_DIR=$full_datadir/opendnssec
+ OPENDNSSEC_SYSCONF_DIR=$full_sysconfdir/opendnssec
+ OPENDNSSEC_LOCALSTATE_DIR="$full_localstatedir/lib/opendnssec"
+-OPENDNSSEC_PID_DIR="$full_localstatedir/run/opendnssec"
++OPENDNSSEC_PID_DIR="${destdir}/run/opendnssec"
+ 
+ AC_SUBST([OPENDNSSEC_BIN_DIR])
+ AC_SUBST([OPENDNSSEC_SBIN_DIR])
+diff -ur opendnssec-1.3.12.orig/Makefile.am opendnssec-1.3.12/Makefile.am
+--- opendnssec-1.3.12.orig/Makefile.am	2013-01-31 13:46:01.122201232 +0100
++++ opendnssec-1.3.12/Makefile.am	2013-01-31 13:47:08.569951675 +0100
+@@ -37,8 +37,8 @@
+ 	$(INSTALL) -d $(DESTDIR)$(localstatedir)/lib/opendnssec/signconf
+ 	$(INSTALL) -d $(DESTDIR)$(localstatedir)/lib/opendnssec/unsigned
+ 	$(INSTALL) -d $(DESTDIR)$(localstatedir)/lib/opendnssec/signed
+-	$(INSTALL) -d $(DESTDIR)$(localstatedir)/run
+-	$(INSTALL) -d $(DESTDIR)$(localstatedir)/run/opendnssec
++
++
+ 
+ docs:
+ 	(cd libhsm; $(MAKE) doxygen)
diff --git a/net-dns/opendnssec/files/opendnssec.confd-1.3.x b/net-dns/opendnssec/files/opendnssec.confd-1.3.x
new file mode 100644
index 000000000000..63121af7f0ca
--- /dev/null
+++ b/net-dns/opendnssec/files/opendnssec.confd-1.3.x
@@ -0,0 +1,13 @@
+# Copyright 1999-2013 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+# Variables containing default binaries used in the opendnssec
+# initscript. You can alter them to another applications/paths
+# if required.
+
+CHECKCONFIG_BIN=/usr/bin/ods-kaspcheck
+CONTROL_BIN=/usr/sbin/ods-control
+ENFORCER_BIN=/usr/sbin/ods-enforcerd
+SIGNER_BIN=/usr/sbin/ods-signerd
+EPPCLIENT_BIN=/usr/sbin/eppclientd
+EPPCLIENT_PIDFILE=/run/opendnssec/eppclientd.pid
diff --git a/net-dns/opendnssec/files/opendnssec.initd-1.3.x b/net-dns/opendnssec/files/opendnssec.initd-1.3.x
new file mode 100644
index 000000000000..9f4adbd184a9
--- /dev/null
+++ b/net-dns/opendnssec/files/opendnssec.initd-1.3.x
@@ -0,0 +1,123 @@
+#!/sbin/openrc-run
+# Copyright 1999-2014 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+description="An open-source turn-key solution for DNSSEC"
+
+depend() {
+	use logger
+}
+
+checkconfig() {
+	if [ -z "${CHECKCONFIG_BIN}" ]; then
+		# no config checker configured, skip config check
+		return 0
+	fi
+	if [ -x "${CHECKCONFIG_BIN}" ]; then
+		output=$(${CHECKCONFIG_BIN} 2>&1| grep -v -E "^/etc/opendnssec/(conf|kasp).xml validates")
+		if [ -n "$output" ]; then
+			echo $output
+		fi
+
+		errors=$(echo $output | grep ERROR | wc -l)
+		if [ $errors -gt 0 ]; then
+			ewarn "$errors error(s) found in OpenDNSSEC configuration."
+		fi
+		return $errors
+	fi
+	eerror "Unable to execute ${CHECKCONFIG_BIN:-config binary}"
+	# can't validate config, just die
+	return 1
+}
+
+start_enforcer() {
+	if [ -n "${ENFORCER_BIN}" ] && [ -x "${ENFORCER_BIN}" ]; then
+		ebegin "Starting OpenDNSSEC Enforcer"
+		${CONTROL_BIN} enforcer start > /dev/null
+		eend $?
+	else
+		if [ -n "${ENFORCER_BIN}" ]; then
+			eerror "OpenDNSSEC Enforcer binary not executable"
+			return 1
+		fi
+		einfo "OpenDNSSEC Enforcer not used."
+	fi
+}
+
+stop_enforcer() {
+	if [ -x "${ENFORCER_BIN}" ]; then
+		ebegin "Stopping OpenDNSSEC Enforcer"
+		${CONTROL_BIN} enforcer stop > /dev/null
+		eend $?
+	fi
+}
+
+start_signer() {
+	if [ -n "${SIGNER_BIN}" ] && [ -x "${SIGNER_BIN}" ]; then
+		ebegin "Starting OpenDNSSEC Signer"
+		${CONTROL_BIN} signer start > /dev/null 2>&1
+		eend $?
+	else
+		if [ -n "${SIGNER_BIN}" ]; then
+			eerror "OpenDNSSEC Signer binary not executable"
+			return 1
+		fi
+		einfo "OpenDNSSEC Signer not used."
+	fi
+}
+
+stop_signer() {
+	if [ -x "${SIGNER_BIN}" ]; then
+		ebegin "Stopping OpenDNSSEC Signer"
+		${CONTROL_BIN} signer stop > /dev/null 2>&1
+		eend $?
+	fi
+}
+
+start_eppclient() {
+	if [ -n "${EPPCLIENT_BIN}" ] && [ -x "${EPPCLIENT_BIN}" ]; then
+		ebegin "Starting OpenDNSSEC Eppclient"
+		start-stop-daemon \
+			--start \
+			--user opendnssec --group opendnssec \
+			--exec "${EPPCLIENT_BIN}" \
+			--pidfile "${EPPCLIENT_PIDFILE}" > /dev/null
+		eend $?
+	else
+		# eppclient is ofptional so if we use the default binary and it
+		# is not used we won't die
+		if [ -n "${EPPCLIENT_BIN}" ] && \
+				[ "${EPPCLIENT_BIN}" != "/usr/sbin/eppclientd" ]; then
+			eerror "OpenDNSSEC Eppclient binary not executable"
+			return 1
+		fi
+		einfo "OpenDNSSEC Eppclient not used."
+	fi
+}
+
+stop_eppclient() {
+	if [ -x "${EPPCLIENT_BIN}" ]; then
+		ebegin "Stopping OpenDNSSEC Eppclient"
+		start-stop-daemon \
+			--stop \
+			--exec "${EPPCLIENT_BIN}" \
+			--pidfile "${EPPCLIENT_PIDFILE}" > /dev/null
+		eend $?
+	fi
+}
+
+start() {
+	checkconfig || return $?
+	test -d /run/opendnssec || mkdir -p /run/opendnssec
+	chown opendnssec:opendnssec /run/opendnssec
+	start_enforcer || return $?
+	start_signer || return $?
+	start_eppclient || return $?
+}
+
+stop() {
+	stop_eppclient
+	stop_signer
+	stop_enforcer
+	sleep 5
+}
diff --git a/net-dns/opendnssec/metadata.xml b/net-dns/opendnssec/metadata.xml
index 05f2788d1508..f81a154f2ecf 100644
--- a/net-dns/opendnssec/metadata.xml
+++ b/net-dns/opendnssec/metadata.xml
@@ -5,6 +5,8 @@
 		<email>mschiff@gentoo.org</email>
 	</maintainer>
 	<use>
+		<flag name="auditor">Enables auditing capabilities for OpenDNSSEC</flag>
+		<flag name="eppclient">Enables support for automatic submission of DNSSEC keys to an upstream epp server</flag>
 		<flag name="signer">Enables signing capabilities for OpenDNSSEC</flag>
 		<flag name="opensc">Enables support for storing DNSSEC keys through a <pkg>dev-libs/opensc</pkg> PKCS#11 interface</flag>
 		<flag name="softhsm">Enables support for storing DNSSEC keys in a <pkg>dev-libs/softhsm</pkg> PKCS#11 object</flag>
diff --git a/net-dns/opendnssec/opendnssec-1.3.18-r1.ebuild b/net-dns/opendnssec/opendnssec-1.3.18-r1.ebuild
new file mode 100644
index 000000000000..a37fb6fc331a
--- /dev/null
+++ b/net-dns/opendnssec/opendnssec-1.3.18-r1.ebuild
@@ -0,0 +1,204 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=5
+
+MY_P="${P/_}"
+PKCS11_IUSE="+softhsm opensc external-hsm"
+inherit autotools multilib user
+
+DESCRIPTION="An open-source turn-key solution for DNSSEC"
+HOMEPAGE="https://www.opendnssec.org/"
+SRC_URI="https://www.${PN}.org/files/source/${MY_P}.tar.gz"
+
+LICENSE="BSD GPL-2"
+SLOT="0"
+KEYWORDS="~amd64 ~x86"
+IUSE="-auditor +curl debug doc eppclient mysql +signer +sqlite test ${PKCS11_IUSE}"
+RESTRICT="!test? ( test )"
+
+RDEPEND="
+	dev-lang/perl
+	dev-libs/libxml2
+	dev-libs/libxslt
+	net-libs/ldns
+	curl? ( net-misc/curl )
+	mysql? (
+		virtual/mysql
+		dev-perl/DBD-mysql
+	)
+	opensc? ( dev-libs/opensc )
+	softhsm? ( dev-libs/softhsm:* )
+	sqlite? (
+		dev-db/sqlite:3
+		dev-perl/DBD-SQLite
+	)
+"
+DEPEND="${RDEPEND}
+	doc? ( app-doc/doxygen )
+	test? (
+		app-text/trang
+	)
+"
+# test? dev-util/cunit # Requires running test DB
+
+REQUIRED_USE="
+	^^ ( mysql sqlite )
+	^^ ( softhsm opensc external-hsm )
+	eppclient? ( curl )
+"
+
+PATCHES=(
+	"${FILESDIR}/${PN}-fix-localstatedir.patch"
+	"${FILESDIR}/${PN}-fix-run-dir.patch"
+	"${FILESDIR}/${PN}-1.3.14-drop-privileges.patch"
+	"${FILESDIR}/${PN}-1.3.14-use-system-trang.patch"
+	"${FILESDIR}/${PN}-1.3.18-eppclient-curl-CVE-2012-5582.patch"
+)
+
+S="${WORKDIR}/${MY_P}"
+
+DOCS=( MIGRATION NEWS )
+
+check_pkcs11_setup() {
+	# PKCS#11 HSM's are often only available with proprietary drivers not
+	# available in portage tree.
+
+	if use softhsm; then
+		PKCS11_LIB=softhsm
+		if has_version ">=dev-libs/softhsm-1.3.1"; then
+			PKCS11_PATH=/usr/$(get_libdir)/softhsm/libsofthsm.so
+		else
+			PKCS11_PATH=/usr/$(get_libdir)/libsofthsm.so
+		fi
+		elog "Building with SoftHSM PKCS#11 library support."
+	fi
+	if use opensc; then
+		PKCS11_LIB=opensc
+		PKCS11_PATH=/usr/$(get_libdir)/opensc-pkcs11.so
+		elog "Building with OpenSC PKCS#11 library support."
+	fi
+	if use external-hsm; then
+		if [[ -n ${PKCS11_SCA6000} ]]; then
+			PKCS11_LIB=sca6000
+			PKCS11_PATH=${PKCS11_SCA6000}
+		elif [[ -n ${PKCS11_ETOKEN} ]]; then
+			PKCS11_LIB=etoken
+			PKCS11_PATH=${PKCS11_ETOKEN}
+		elif [[ -n ${PKCS11_NCIPHER} ]]; then
+			PKCS11_LIB=ncipher
+			PKCS11_PATH=${PKCS11_NCIPHER}
+		elif [[ -n ${PKCS11_AEPKEYPER} ]]; then
+			PKCS11_LIB=aepkeyper
+			PKCS11_PATH=${PKCS11_AEPKEYPER}
+		else
+			ewarn "You enabled USE flag 'external-hsm' but did not specify a path to a PKCS#11"
+			ewarn "library. To set a path, set one of the following environment variables:"
+			ewarn "  for Sun Crypto Accelerator 6000, set: PKCS11_SCA6000=<path>"
+			ewarn "  for Aladdin eToken, set: PKCS11_ETOKEN=<path>"
+			ewarn "  for Thales/nCipher netHSM, set: PKCS11_NCIPHER=<path>"
+			ewarn "  for AEP Keyper, set: PKCS11_AEPKEYPER=<path>"
+			ewarn "Example:"
+			ewarn "  PKCS11_ETOKEN=\"/opt/etoken/lib/libeTPkcs11.so\" emerge -pv opendnssec"
+			ewarn "or store the variable into /etc/portage/make.conf"
+			die "USE flag 'external-hsm' set but no PKCS#11 library path specified."
+		fi
+		elog "Building with external PKCS#11 library support ($PKCS11_LIB): ${PKCS11_PATH}"
+	fi
+}
+
+pkg_pretend() {
+	local i
+
+	for i in eppclient mysql; do
+		if use ${i}; then
+			ewarn
+			ewarn "Usage of ${i} is considered experimental."
+			ewarn "Do not report bugs against this feature."
+			ewarn
+		fi
+	done
+
+	check_pkcs11_setup
+}
+
+pkg_setup() {
+	enewgroup opendnssec
+	enewuser opendnssec -1 -1 -1 opendnssec
+
+	# pretend does not preserve variables so we need to run this once more
+	check_pkcs11_setup
+}
+
+src_prepare() {
+	base_src_prepare
+	eautoreconf
+}
+
+src_configure() {
+	# $(use_with test cunit "${EPREFIX}/usr/") \
+	econf \
+		--without-cunit \
+		--localstatedir="${EPREFIX}/var/" \
+		--disable-static \
+		--with-database-backend=$(use mysql && echo "mysql")$(use sqlite && echo "sqlite3") \
+		--with-pkcs11-${PKCS11_LIB}=${PKCS11_PATH} \
+		--disable-auditor \
+		$(use_with curl) \
+		$(use_enable debug timeshift) \
+		$(use_enable eppclient) \
+		$(use_enable signer)
+}
+
+src_compile() {
+	default
+	use doc && emake docs
+}
+
+src_install() {
+	default
+
+	# remove useless .la files
+	find "${ED}" -name '*.la' -delete
+
+	# Remove subversion tags from config files to avoid useless config updates
+	sed -i \
+		-e '/<!-- \$Id:/ d' \
+		"${ED}"/etc/opendnssec/* || die
+
+	# install update scripts
+	insinto /usr/share/opendnssec
+	use sqlite && doins enforcer/utils/migrate_keyshare_sqlite3.pl
+	use mysql && doins enforcer/utils/migrate_keyshare_mysql.pl
+
+	# fix permissions
+	fowners root:opendnssec /etc/opendnssec
+	fowners root:opendnssec /etc/opendnssec/{conf,kasp,zonelist,zonefetch}.xml
+	use eppclient && fowners root:opendnssec /etc/opendnssec/eppclientd.conf
+
+	fowners opendnssec:opendnssec /var/lib/opendnssec/{,signconf,unsigned,signed,tmp}
+
+	# install conf/init script
+	newinitd "${FILESDIR}"/opendnssec.initd-1.3.x opendnssec
+	newconfd "${FILESDIR}"/opendnssec.confd-1.3.x opendnssec
+	use auditor || sed -i 's/^CHECKCONFIG_BIN=.*/CHECKCONFIG_BIN=/' "${D}"/etc/conf.d/opendnssec
+}
+
+pkg_postinst() {
+	if use softhsm; then
+		elog "Please make sure that you create your softhsm database in a location writeable"
+		elog "by the opendnssec user. You can set its location in /etc/softhsm.conf."
+		elog "Suggested configuration is:"
+		elog "    echo \"0:/var/lib/opendnssec/softhsm_slot0.db\" >> /etc/softhsm.conf"
+		elog "    softhsm --init-token --slot 0 --label OpenDNSSEC"
+		elog "    chown opendnssec:opendnssec /var/lib/opendnssec/softhsm_slot0.db"
+	fi
+	if use auditor; then
+		ewarn
+		ewarn "Please note that auditor support has been disabled in this version since it"
+		ewarn "it depends on ruby 1.8 which has been removed from the portage tree."
+		ewarn "USE=auditor is only provided for this warning but will not install the"
+		ewarn "auditor anymore."
+		ewarn
+	fi
+}
diff --git a/net-dns/opendnssec/opendnssec-1.4.12-r1.ebuild b/net-dns/opendnssec/opendnssec-1.4.12-r1.ebuild
new file mode 100644
index 000000000000..7204fc6a5df8
--- /dev/null
+++ b/net-dns/opendnssec/opendnssec-1.4.12-r1.ebuild
@@ -0,0 +1,208 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=5
+
+MY_P="${P/_}"
+PKCS11_IUSE="+softhsm opensc external-hsm"
+inherit autotools eutils multilib user
+
+DESCRIPTION="An open-source turn-key solution for DNSSEC"
+HOMEPAGE="https://www.opendnssec.org/"
+SRC_URI="https://www.${PN}.org/files/source/${MY_P}.tar.gz"
+
+LICENSE="BSD GPL-2"
+SLOT="0"
+KEYWORDS="~amd64 ~x86"
+IUSE="debug doc +mysql +signer sqlite test ${PKCS11_IUSE}"
+RESTRICT="!test? ( test )"
+
+RDEPEND="
+	dev-lang/perl
+	dev-libs/libxml2
+	dev-libs/libxslt
+	net-libs/ldns
+	mysql? (
+		virtual/mysql
+		dev-perl/DBD-mysql
+	)
+	opensc? ( dev-libs/opensc )
+	softhsm? ( dev-libs/softhsm:* )
+	sqlite? (
+		dev-db/sqlite:3
+		dev-perl/DBD-SQLite
+	)
+"
+DEPEND="${RDEPEND}
+	doc? ( app-doc/doxygen )
+	test? (
+		app-text/trang
+	)
+"
+
+REQUIRED_USE="
+	^^ ( mysql sqlite )
+	^^ ( softhsm opensc external-hsm )
+"
+
+PATCHES=(
+	"${FILESDIR}/${PN}-fix-localstatedir.patch"
+	"${FILESDIR}/${PN}-fix-run-dir.patch"
+	"${FILESDIR}/${PN}-drop-privileges.patch"
+	"${FILESDIR}/${PN}-use-system-trang.patch"
+)
+
+S="${WORKDIR}/${MY_P}"
+
+DOCS=( MIGRATION NEWS )
+
+check_pkcs11_setup() {
+	# PKCS#11 HSM's are often only available with proprietary drivers not
+	# available in portage tree.
+
+	if use softhsm; then
+		PKCS11_LIB=softhsm
+		if has_version ">=dev-libs/softhsm-1.3.1"; then
+			PKCS11_PATH=/usr/$(get_libdir)/softhsm/libsofthsm.so
+		else
+			PKCS11_PATH=/usr/$(get_libdir)/libsofthsm.so
+		fi
+		elog "Building with SoftHSM PKCS#11 library support."
+	fi
+	if use opensc; then
+		PKCS11_LIB=opensc
+		PKCS11_PATH=/usr/$(get_libdir)/opensc-pkcs11.so
+		elog "Building with OpenSC PKCS#11 library support."
+	fi
+	if use external-hsm; then
+		if [[ -n ${PKCS11_SCA6000} ]]; then
+			PKCS11_LIB=sca6000
+			PKCS11_PATH=${PKCS11_SCA6000}
+		elif [[ -n ${PKCS11_ETOKEN} ]]; then
+			PKCS11_LIB=etoken
+			PKCS11_PATH=${PKCS11_ETOKEN}
+		elif [[ -n ${PKCS11_NCIPHER} ]]; then
+			PKCS11_LIB=ncipher
+			PKCS11_PATH=${PKCS11_NCIPHER}
+		elif [[ -n ${PKCS11_AEPKEYPER} ]]; then
+			PKCS11_LIB=aepkeyper
+			PKCS11_PATH=${PKCS11_AEPKEYPER}
+		else
+			ewarn "You enabled USE flag 'external-hsm' but did not specify a path to a PKCS#11"
+			ewarn "library. To set a path, set one of the following environment variables:"
+			ewarn "  for Sun Crypto Accelerator 6000, set: PKCS11_SCA6000=<path>"
+			ewarn "  for Aladdin eToken, set: PKCS11_ETOKEN=<path>"
+			ewarn "  for Thales/nCipher netHSM, set: PKCS11_NCIPHER=<path>"
+			ewarn "  for AEP Keyper, set: PKCS11_AEPKEYPER=<path>"
+			ewarn "Example:"
+			ewarn "  PKCS11_ETOKEN=\"/opt/etoken/lib/libeTPkcs11.so\" emerge -pv opendnssec"
+			ewarn "or store the variable into /etc/portage/make.conf"
+			die "USE flag 'external-hsm' set but no PKCS#11 library path specified."
+		fi
+		elog "Building with external PKCS#11 library support ($PKCS11_LIB): ${PKCS11_PATH}"
+	fi
+}
+
+pkg_pretend() {
+	check_pkcs11_setup
+}
+
+pkg_setup() {
+	enewgroup opendnssec
+	enewuser opendnssec -1 -1 -1 opendnssec
+
+	# pretend does not preserve variables so we need to run this once more
+	check_pkcs11_setup
+}
+
+src_prepare() {
+	local patch
+	default
+	for patch in "${PATCHES[@]}"; do
+		epatch "$patch"
+	done
+	eautoreconf
+}
+
+src_configure() {
+	econf \
+		--without-cunit \
+		--localstatedir="${EPREFIX}/var/" \
+		--disable-static \
+		--with-database-backend=$(use mysql && echo "mysql")$(use sqlite && echo "sqlite3") \
+		--with-pkcs11-${PKCS11_LIB}=${PKCS11_PATH} \
+		$(use_enable debug timeshift) \
+		$(use_enable signer)
+}
+
+src_compile() {
+	default
+	use doc && emake docs
+}
+
+src_install() {
+	default
+
+	# remove useless .la files
+	find "${ED}" -name '*.la' -delete
+
+	# Remove subversion tags from config files to avoid useless config updates
+	sed -i \
+		-e '/<!-- \$Id:/ d' \
+		"${ED}"/etc/opendnssec/* || die
+
+	# install update scripts
+	insinto /usr/share/opendnssec
+	if use sqlite; then
+		doins enforcer/utils/migrate_*sqlite*
+	fi
+	if use mysql; then
+		doins enforcer/utils/migrate_*mysql*
+	fi
+
+	# fix permissions
+	fowners root:opendnssec /etc/opendnssec
+	fowners root:opendnssec /etc/opendnssec/{addns,conf,kasp,zonelist}.xml
+	fowners opendnssec:opendnssec /var/lib/opendnssec/{,signconf,unsigned,signed,tmp}
+
+	# install conf/init script
+	newinitd "${FILESDIR}"/opendnssec.initd opendnssec
+	newconfd "${FILESDIR}"/opendnssec.confd opendnssec
+}
+
+pkg_postinst() {
+	local v
+	if use softhsm; then
+		elog "Please make sure that you create your softhsm database in a location writeable"
+		elog "by the opendnssec user. You can set its location in /etc/softhsm.conf."
+		elog "Suggested configuration is:"
+		elog "    echo \"0:/var/lib/opendnssec/softhsm_slot0.db\" >> /etc/softhsm.conf"
+		elog "    softhsm --init-token --slot 0 --label OpenDNSSEC"
+		elog "    chown opendnssec:opendnssec /var/lib/opendnssec/softhsm_slot0.db"
+	fi
+
+	for v in $REPLACING_VERSIONS; do
+		case $v in
+			1.3.*)
+				ewarn ""
+				ewarn "You are upgrading from version 1.3."
+				ewarn ""
+				ewarn "Please be aware of the following:"
+				ewarn "  * OpenDNSSEC now supports both input and output adapters for"
+				ewarn "    AXFR and IXFR in addition to file transfer."
+				ewarn "    -> The zonefetch.xml file has been replaced by addns.xml"
+				ewarn "       to support this enhancement."
+				ewarn "    -> changes to the KASP database mean that a database"
+				ewarn "       migration is required to upgrade to 1.4 from earlier"
+				ewarn "       versions of OpenDNSSEC."
+				ewarn "  * The auditor is no longer supported."
+				ewarn ""
+				ewarn "You can find more information here:"
+				ewarn "  * /usr/share/doc/opendnssec*/MIGRATION*"
+				ewarn "  * https://wiki.opendnssec.org/display/DOCS/Migrating+zone+fetcher+to+DNS+adapters"
+				ewarn "  * https://wiki.opendnssec.org/display/DOCS/Migrating+from+earlier+versions+of+OpenDNSSEC"
+				ewarn ""
+			;;
+		esac
+	done
+}
diff --git a/net-dns/opendnssec/opendnssec-1.4.8.2.ebuild b/net-dns/opendnssec/opendnssec-1.4.8.2.ebuild
new file mode 100644
index 000000000000..fa23c0bf555a
--- /dev/null
+++ b/net-dns/opendnssec/opendnssec-1.4.8.2.ebuild
@@ -0,0 +1,206 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=5
+
+MY_P="${P/_}"
+PKCS11_IUSE="+softhsm opensc external-hsm"
+inherit autotools multilib user
+
+DESCRIPTION="An open-source turn-key solution for DNSSEC"
+HOMEPAGE="https://www.opendnssec.org/"
+SRC_URI="https://www.${PN}.org/files/source/${MY_P}.tar.gz"
+
+LICENSE="BSD GPL-2"
+SLOT="0"
+KEYWORDS="~amd64 ~x86"
+IUSE="debug doc +mysql +signer sqlite test ${PKCS11_IUSE}"
+RESTRICT="!test? ( test )"
+
+RDEPEND="
+	dev-lang/perl
+	dev-libs/libxml2
+	dev-libs/libxslt
+	net-libs/ldns
+	mysql? (
+		virtual/mysql
+		dev-perl/DBD-mysql
+	)
+	opensc? ( dev-libs/opensc )
+	softhsm? ( dev-libs/softhsm:* )
+	sqlite? (
+		dev-db/sqlite:3
+		dev-perl/DBD-SQLite
+	)
+"
+DEPEND="${RDEPEND}
+	doc? ( app-doc/doxygen )
+	test? (
+		app-text/trang
+	)
+"
+
+REQUIRED_USE="
+	^^ ( mysql sqlite )
+	^^ ( softhsm opensc external-hsm )
+"
+
+PATCHES=(
+	"${FILESDIR}/${PN}-fix-localstatedir.patch"
+	"${FILESDIR}/${PN}-fix-run-dir.patch"
+	"${FILESDIR}/${PN}-drop-privileges.patch"
+	"${FILESDIR}/${PN}-use-system-trang.patch"
+)
+
+S="${WORKDIR}/${MY_P}"
+
+DOCS=( MIGRATION NEWS )
+
+check_pkcs11_setup() {
+	# PKCS#11 HSM's are often only available with proprietary drivers not
+	# available in portage tree.
+
+	if use softhsm; then
+		PKCS11_LIB=softhsm
+		if has_version ">=dev-libs/softhsm-1.3.1"; then
+			PKCS11_PATH=/usr/$(get_libdir)/softhsm/libsofthsm.so
+		else
+			PKCS11_PATH=/usr/$(get_libdir)/libsofthsm.so
+		fi
+		elog "Building with SoftHSM PKCS#11 library support."
+	fi
+	if use opensc; then
+		PKCS11_LIB=opensc
+		PKCS11_PATH=/usr/$(get_libdir)/opensc-pkcs11.so
+		elog "Building with OpenSC PKCS#11 library support."
+	fi
+	if use external-hsm; then
+		if [[ -n ${PKCS11_SCA6000} ]]; then
+			PKCS11_LIB=sca6000
+			PKCS11_PATH=${PKCS11_SCA6000}
+		elif [[ -n ${PKCS11_ETOKEN} ]]; then
+			PKCS11_LIB=etoken
+			PKCS11_PATH=${PKCS11_ETOKEN}
+		elif [[ -n ${PKCS11_NCIPHER} ]]; then
+			PKCS11_LIB=ncipher
+			PKCS11_PATH=${PKCS11_NCIPHER}
+		elif [[ -n ${PKCS11_AEPKEYPER} ]]; then
+			PKCS11_LIB=aepkeyper
+			PKCS11_PATH=${PKCS11_AEPKEYPER}
+		else
+			ewarn "You enabled USE flag 'external-hsm' but did not specify a path to a PKCS#11"
+			ewarn "library. To set a path, set one of the following environment variables:"
+			ewarn "  for Sun Crypto Accelerator 6000, set: PKCS11_SCA6000=<path>"
+			ewarn "  for Aladdin eToken, set: PKCS11_ETOKEN=<path>"
+			ewarn "  for Thales/nCipher netHSM, set: PKCS11_NCIPHER=<path>"
+			ewarn "  for AEP Keyper, set: PKCS11_AEPKEYPER=<path>"
+			ewarn "Example:"
+			ewarn "  PKCS11_ETOKEN=\"/opt/etoken/lib/libeTPkcs11.so\" emerge -pv opendnssec"
+			ewarn "or store the variable into /etc/portage/make.conf"
+			die "USE flag 'external-hsm' set but no PKCS#11 library path specified."
+		fi
+		elog "Building with external PKCS#11 library support ($PKCS11_LIB): ${PKCS11_PATH}"
+	fi
+}
+
+pkg_pretend() {
+	check_pkcs11_setup
+}
+
+pkg_setup() {
+	enewgroup opendnssec
+	enewuser opendnssec -1 -1 -1 opendnssec
+
+	# pretend does not preserve variables so we need to run this once more
+	check_pkcs11_setup
+}
+
+src_prepare() {
+	base_src_prepare
+	eautoreconf
+}
+
+src_configure() {
+	econf \
+		--without-cunit \
+		--localstatedir="${EPREFIX}/var/" \
+		--disable-static \
+		--with-database-backend=$(use mysql && echo "mysql")$(use sqlite && echo "sqlite3") \
+		--with-pkcs11-${PKCS11_LIB}=${PKCS11_PATH} \
+		$(use_enable debug timeshift) \
+		$(use_enable signer)
+}
+
+src_compile() {
+	default
+	use doc && emake docs
+}
+
+src_install() {
+	default
+
+	# remove useless .la files
+	find "${ED}" -name '*.la' -delete
+
+	# Remove subversion tags from config files to avoid useless config updates
+	sed -i \
+		-e '/<!-- \$Id:/ d' \
+		"${ED}"/etc/opendnssec/* || die
+
+	# install update scripts
+	insinto /usr/share/opendnssec
+	if use sqlite; then
+		doins enforcer/utils/migrate_keyshare_sqlite3.pl
+		doins enforcer/utils/migrate_adapters_1.sqlite3
+	fi
+	if use mysql; then
+		doins enforcer/utils/migrate_keyshare_mysql.pl
+		doins enforcer/utils/migrate_adapters_1.mysql
+	fi
+
+	# fix permissions
+	fowners root:opendnssec /etc/opendnssec
+	fowners root:opendnssec /etc/opendnssec/{addns,conf,kasp,zonelist}.xml
+	fowners opendnssec:opendnssec /var/lib/opendnssec/{,signconf,unsigned,signed,tmp}
+
+	# install conf/init script
+	newinitd "${FILESDIR}"/opendnssec.initd opendnssec
+	newconfd "${FILESDIR}"/opendnssec.confd opendnssec
+}
+
+pkg_postinst() {
+	local v
+	if use softhsm; then
+		elog "Please make sure that you create your softhsm database in a location writeable"
+		elog "by the opendnssec user. You can set its location in /etc/softhsm.conf."
+		elog "Suggested configuration is:"
+		elog "    echo \"0:/var/lib/opendnssec/softhsm_slot0.db\" >> /etc/softhsm.conf"
+		elog "    softhsm --init-token --slot 0 --label OpenDNSSEC"
+		elog "    chown opendnssec:opendnssec /var/lib/opendnssec/softhsm_slot0.db"
+	fi
+
+	for v in $REPLACING_VERSIONS; do
+		case $v in
+			1.3.*)
+				ewarn ""
+				ewarn "You are upgrading from version 1.3."
+				ewarn ""
+				ewarn "Please be aware of the following:"
+				ewarn "  * OpenDNSSEC now supports both input and output adapters for"
+				ewarn "    AXFR and IXFR in addition to file transfer."
+				ewarn "    -> The zonefetch.xml file has been replaced by addns.xml"
+				ewarn "       to support this enhancement."
+				ewarn "    -> changes to the KASP database mean that a database"
+				ewarn "       migration is required to upgrade to 1.4 from earlier"
+				ewarn "       versions of OpenDNSSEC."
+				ewarn "  * The auditor is no longer supported."
+				ewarn ""
+				ewarn "You can find more information here:"
+				ewarn "  * /usr/share/doc/opendnssec*/MIGRATION*"
+				ewarn "  * https://wiki.opendnssec.org/display/DOCS/Migrating+zone+fetcher+to+DNS+adapters"
+				ewarn "  * https://wiki.opendnssec.org/display/DOCS/Migrating+from+earlier+versions+of+OpenDNSSEC"
+				ewarn ""
+			;;
+		esac
+	done
+}
diff --git a/net-dns/opendnssec/opendnssec-2.0.1-r1.ebuild b/net-dns/opendnssec/opendnssec-2.0.1-r1.ebuild
new file mode 100644
index 000000000000..b93dc8f5ab2b
--- /dev/null
+++ b/net-dns/opendnssec/opendnssec-2.0.1-r1.ebuild
@@ -0,0 +1,240 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=5
+
+MY_P="${P/_}"
+PKCS11_IUSE="+softhsm opensc external-hsm"
+inherit autotools eutils multilib user
+
+DESCRIPTION="An open-source turn-key solution for DNSSEC"
+HOMEPAGE="https://www.opendnssec.org/"
+SRC_URI="https://www.${PN}.org/files/source/${MY_P}.tar.gz"
+
+LICENSE="BSD GPL-2"
+SLOT="0"
+KEYWORDS="~amd64 ~x86"
+IUSE="debug doc +mysql readline +signer sqlite test ${PKCS11_IUSE}"
+RESTRICT="!test? ( test )"
+
+RDEPEND="
+	dev-lang/perl
+	dev-libs/libxml2
+	dev-libs/libxslt
+	net-libs/ldns
+	mysql? (
+		virtual/mysql
+		dev-perl/DBD-mysql
+	)
+	opensc? ( dev-libs/opensc )
+	readline? ( sys-libs/readline:0 )
+	softhsm? ( dev-libs/softhsm:* )
+	sqlite? (
+		dev-db/sqlite:3
+		dev-perl/DBD-SQLite
+	)
+"
+DEPEND="${RDEPEND}
+	doc? ( app-doc/doxygen )
+	test? (
+		app-text/trang
+	)
+"
+
+REQUIRED_USE="
+	^^ ( mysql sqlite )
+	^^ ( softhsm opensc external-hsm )
+"
+
+PATCHES=(
+	"${FILESDIR}/${PN}-fix-localstatedir-2.0.x.patch"
+	"${FILESDIR}/${PN}-fix-run-dir-2.0.x.patch"
+	"${FILESDIR}/${PN}-drop-privileges-2.0.x.patch"
+	"${FILESDIR}/${PN}-use-system-trang.patch"
+)
+
+S="${WORKDIR}/${MY_P}"
+
+DOCS=( MIGRATION NEWS )
+
+check_pkcs11_setup() {
+	# PKCS#11 HSM's are often only available with proprietary drivers not
+	# available in portage tree.
+
+	if use softhsm; then
+		PKCS11_LIB=softhsm
+		if has_version ">=dev-libs/softhsm-1.3.1"; then
+			PKCS11_PATH=/usr/$(get_libdir)/softhsm/libsofthsm.so
+		else
+			PKCS11_PATH=/usr/$(get_libdir)/libsofthsm.so
+		fi
+		elog "Building with SoftHSM PKCS#11 library support."
+	fi
+	if use opensc; then
+		PKCS11_LIB=opensc
+		PKCS11_PATH=/usr/$(get_libdir)/opensc-pkcs11.so
+		elog "Building with OpenSC PKCS#11 library support."
+	fi
+	if use external-hsm; then
+		if [[ -n ${PKCS11_SCA6000} ]]; then
+			PKCS11_LIB=sca6000
+			PKCS11_PATH=${PKCS11_SCA6000}
+		elif [[ -n ${PKCS11_ETOKEN} ]]; then
+			PKCS11_LIB=etoken
+			PKCS11_PATH=${PKCS11_ETOKEN}
+		elif [[ -n ${PKCS11_NCIPHER} ]]; then
+			PKCS11_LIB=ncipher
+			PKCS11_PATH=${PKCS11_NCIPHER}
+		elif [[ -n ${PKCS11_AEPKEYPER} ]]; then
+			PKCS11_LIB=aepkeyper
+			PKCS11_PATH=${PKCS11_AEPKEYPER}
+		else
+			ewarn "You enabled USE flag 'external-hsm' but did not specify a path to a PKCS#11"
+			ewarn "library. To set a path, set one of the following environment variables:"
+			ewarn "  for Sun Crypto Accelerator 6000, set: PKCS11_SCA6000=<path>"
+			ewarn "  for Aladdin eToken, set: PKCS11_ETOKEN=<path>"
+			ewarn "  for Thales/nCipher netHSM, set: PKCS11_NCIPHER=<path>"
+			ewarn "  for AEP Keyper, set: PKCS11_AEPKEYPER=<path>"
+			ewarn "Example:"
+			ewarn "  PKCS11_ETOKEN=\"/opt/etoken/lib/libeTPkcs11.so\" emerge -pv opendnssec"
+			ewarn "or store the variable into /etc/portage/make.conf"
+			die "USE flag 'external-hsm' set but no PKCS#11 library path specified."
+		fi
+		elog "Building with external PKCS#11 library support ($PKCS11_LIB): ${PKCS11_PATH}"
+	fi
+}
+
+pkg_pretend() {
+	if has_version "<net-dns/opendnssec-1.4.10"; then
+		################################################################################
+		eerror "You are already using OpenDNSSEC."
+		eerror "In order to migrate to version >=2.0.0 you need to upgrade to"
+		eerror "version >=1.4.10 first:"
+		eerror ""
+		eerror "   emerge \"<net-dns/opendnssec-2\""
+		eerror ""
+		eerror "See https://github.com/opendnssec/opendnssec/blob/2.0/master/MIGRATION"
+		eerror "for details."
+		eerror ""
+		die "Please upgrade to version >=1.4.10 first for proper db migraion"
+	fi
+
+	check_pkcs11_setup
+}
+
+pkg_setup() {
+	enewgroup opendnssec
+	enewuser opendnssec -1 -1 -1 opendnssec
+
+	# pretend does not preserve variables so we need to run this once more
+	check_pkcs11_setup
+}
+
+src_prepare() {
+	local patch
+	default
+	for patch in "${PATCHES[@]}"; do
+		epatch "$patch"
+	done
+	eautoreconf
+}
+
+src_configure() {
+	econf \
+		--without-cunit \
+		--localstatedir="${EPREFIX}/var" \
+		--disable-static \
+		--with-enforcer-database=$(use mysql && echo "mysql")$(use sqlite && echo "sqlite3") \
+		--with-pkcs11-${PKCS11_LIB}=${PKCS11_PATH} \
+		$(use_with readline) \
+		$(use_enable signer)
+}
+
+src_compile() {
+	default
+	use doc && emake docs
+}
+
+src_install() {
+	default
+
+	# remove useless .la files
+	find "${ED}" -name '*.la' -delete
+
+	# Remove subversion tags from config files to avoid useless config updates
+	sed -i \
+		-e '/<!-- \$Id:/ d' \
+		"${ED}"/etc/opendnssec/* || die
+
+	# install db update/migration stuff
+	insinto /usr/share/opendnssec/db
+	if use sqlite; then
+		doins enforcer/utils/convert_mysql_to_sqlite
+	fi
+	if use mysql; then
+		doins enforcer/utils/convert_sqlite_to_mysql
+	fi
+
+	insinto /usr/share/opendnssec/db/sql
+	if use sqlite; then
+		doins enforcer/src/db/schema.sqlite
+	fi
+	if use mysql; then
+		doins enforcer/src/db/schema.mysql
+	fi
+
+	insinto /usr/share/opendnssec/db/1.4-2.0_db_convert
+	doins enforcer/utils/1.4-2.0_db_convert/find_problematic_zones.sql
+	doins enforcer/utils/1.4-2.0_db_convert/README.md
+	if use sqlite; then
+		doins enforcer/utils/1.4-2.0_db_convert/sqlite_convert.sql
+		doins enforcer/utils/1.4-2.0_db_convert/convert_sqlite
+	fi
+	if use mysql; then
+		doins enforcer/utils/1.4-2.0_db_convert/convert_mysql
+		doins enforcer/utils/1.4-2.0_db_convert/mysql_convert.sql
+	fi
+
+	# patch scripts to find schema files
+	sed -i \
+		-e 's,^SCHEMA=../src/db/,SCHEMA=/usr/share/opendnssec/db/sql/,' \
+		-e 's,^SCHEMA=../../src/db/,SCHEMA=/usr/share/opendnssec/db/sql/,' \
+		"${ED}"/usr/share/opendnssec/db/convert_* \
+		"${ED}"/usr/share/opendnssec/db/1.4-2.0_db_convert/convert_*
+
+	# fix permissions
+	fowners root:opendnssec /etc/opendnssec
+	fowners root:opendnssec /etc/opendnssec/{addns,conf,kasp,zonelist}.xml
+	fowners opendnssec:opendnssec /var/lib/opendnssec/{,enforcer,signconf,signed,signer,unsigned}
+
+	# install conf/init script
+	newinitd "${FILESDIR}"/opendnssec.initd opendnssec
+	newconfd "${FILESDIR}"/opendnssec.confd opendnssec
+}
+
+pkg_postinst() {
+	local v
+	if use softhsm; then
+		elog "Please make sure that you create your softhsm database in a location writeable"
+		elog "by the opendnssec user. You can set its location in /etc/softhsm.conf."
+		elog "Suggested configuration is:"
+		elog "    echo \"0:/var/lib/opendnssec/softhsm_slot0.db\" >> /etc/softhsm.conf"
+		elog "    softhsm --init-token --slot 0 --label OpenDNSSEC"
+		elog "    chown opendnssec:opendnssec /var/lib/opendnssec/softhsm_slot0.db"
+	fi
+	for v in $REPLACING_VERSIONS; do
+		case $v in
+			1.4.*)
+				ewarn ""
+				ewarn "You are upgrading from version 1.4."
+				ewarn ""
+				ewarn "A migration is needed from 1.4 to 2.0."
+				ewarn "For details see /usr/share/doc/${P}/MIGRATION*"
+				ewarn ""
+				ewarn "For your convenience the mentioned migration scripts and README"
+				ewarn "have been installed to /usr/share/${PN}/db/1.4-2.0_db_convert"
+				ewarn ""
+			;;
+		esac
+	done
+}