The kernel provides sufficiently randomised ports.
OK sthen

less convoluted Makefile, removes useless redirections

okay tb@, florian@

a few depend:-related thingies that were still in.

okay millert@, tb@

The way we merge libunbound from unbound(8) into unwind(8) we need to make
sure that we don't accidentally enable threading by accident. A threaded
unwind(8) does not work since it's missing openssl locks.
No config.h change.
input & OK sthen

update to unbound 1.6.4, ok florian@

Back out make(obj) hack: it doesn't solve the problem entirely and may
interfere with read-only src tree setups.

Add a workaround for the fact that 'install -d' without explicit mode
defaults to 755, which is incompatible with WOBJUMASK. Make sure that
obj/util has permissions :wobj 770, as all other directories in obj/.
Issue also found by jmc, actual reason tracked down by ajacoutot.

ok ajacoutot

Rewriting USER gets in the way of the de-escalation mechanism as it
shadows the real user's identity.
ok deraadt

Don't use a pidfile in unbound by default. Retain the ability in unbound.conf
to set one if needed. ok millert@

Remove passing an override of INSTALL_PROGRAM to the
autoconf script. It doesn't seem to serve any purpose.

ok sthen@

clean up some files generated during the build.

noticed by deraadt@

Remove bsd-wrapper pieces to handle pulling unbound-host.1 from src,
no longer needed now that this file is handled the same in Unbound's build
infrastructure as the other manpages.

Install a /var/unbound/db directory, writable by the _unbound daemon,
and use it as the default location for the DNSSEC root key. Update default
config for this location.

With this, the only step required to enable DNSSEC validation is to
uncomment these default config entries and restart:

#module-config: "validator iterator"
#auto-trust-anchor-file: "/var/unbound/db/root.key"

There is no longer a requirement to run unbound-anchor manually to
update the root key. The rc.d script will take care of updates at boot,
and Unbound will manage the file itself at runtime.

Test with "dig test.dnssec-or-not.net txt @127.0.0.1" or similar.

merge conflicts, remove old libldns files

change pidfile location again; actually this is written before chroot, so
it can go straight in /var/run

use $chrootdir/run for pid file, like nsd.

Add a few missing files for 'make clean'.

When clenaing, run "make realclean" in the ldns subdirectory, not just unbound.

set --without-pythonmodule (this is the default anyway, but better to be explicit).

Add Makefile wrapper for Unbound. From Bjorn Ketelaars <bjorn.ketelaars
at hydroxide.nl>.

less convoluted Makefile, removes useless redirections

okay tb@, florian@

a few depend:-related thingies that were still in.

okay millert@, tb@

The way we merge libunbound from unbound(8) into unwind(8) we need to make
sure that we don't accidentally enable threading by accident. A threaded
unwind(8) does not work since it's missing openssl locks.
No config.h change.
input & OK sthen

update to unbound 1.6.4, ok florian@

Back out make(obj) hack: it doesn't solve the problem entirely and may
interfere with read-only src tree setups.

Add a workaround for the fact that 'install -d' without explicit mode
defaults to 755, which is incompatible with WOBJUMASK. Make sure that
obj/util has permissions :wobj 770, as all other directories in obj/.
Issue also found by jmc, actual reason tracked down by ajacoutot.

ok ajacoutot

Rewriting USER gets in the way of the de-escalation mechanism as it
shadows the real user's identity.
ok deraadt

Don't use a pidfile in unbound by default. Retain the ability in unbound.conf
to set one if needed. ok millert@

Remove passing an override of INSTALL_PROGRAM to the
autoconf script. It doesn't seem to serve any purpose.

ok sthen@

clean up some files generated during the build.

noticed by deraadt@

Remove bsd-wrapper pieces to handle pulling unbound-host.1 from src,
no longer needed now that this file is handled the same in Unbound's build
infrastructure as the other manpages.

Install a /var/unbound/db directory, writable by the _unbound daemon,
and use it as the default location for the DNSSEC root key. Update default
config for this location.

With this, the only step required to enable DNSSEC validation is to
uncomment these default config entries and restart:

#module-config: "validator iterator"
#auto-trust-anchor-file: "/var/unbound/db/root.key"

There is no longer a requirement to run unbound-anchor manually to
update the root key. The rc.d script will take care of updates at boot,
and Unbound will manage the file itself at runtime.

Test with "dig test.dnssec-or-not.net txt @127.0.0.1" or similar.

merge conflicts, remove old libldns files

change pidfile location again; actually this is written before chroot, so
it can go straight in /var/run

use $chrootdir/run for pid file, like nsd.

Add a few missing files for 'make clean'.

When clenaing, run "make realclean" in the ldns subdirectory, not just unbound.

set --without-pythonmodule (this is the default anyway, but better to be explicit).

Add Makefile wrapper for Unbound. From Bjorn Ketelaars <bjorn.ketelaars
at hydroxide.nl>.

a few depend:-related thingies that were still in.

okay millert@, tb@

The way we merge libunbound from unbound(8) into unwind(8) we need to make
sure that we don't accidentally enable threading by accident. A threaded
unwind(8) does not work since it's missing openssl locks.
No config.h change.
input & OK sthen

update to unbound 1.6.4, ok florian@

Back out make(obj) hack: it doesn't solve the problem entirely and may
interfere with read-only src tree setups.

Add a workaround for the fact that 'install -d' without explicit mode
defaults to 755, which is incompatible with WOBJUMASK. Make sure that
obj/util has permissions :wobj 770, as all other directories in obj/.
Issue also found by jmc, actual reason tracked down by ajacoutot.

ok ajacoutot

Rewriting USER gets in the way of the de-escalation mechanism as it
shadows the real user's identity.
ok deraadt

Don't use a pidfile in unbound by default. Retain the ability in unbound.conf
to set one if needed. ok millert@

Remove passing an override of INSTALL_PROGRAM to the
autoconf script. It doesn't seem to serve any purpose.

ok sthen@

clean up some files generated during the build.

noticed by deraadt@

Remove bsd-wrapper pieces to handle pulling unbound-host.1 from src,
no longer needed now that this file is handled the same in Unbound's build
infrastructure as the other manpages.

Install a /var/unbound/db directory, writable by the _unbound daemon,
and use it as the default location for the DNSSEC root key. Update default
config for this location.

With this, the only step required to enable DNSSEC validation is to
uncomment these default config entries and restart:

#module-config: "validator iterator"
#auto-trust-anchor-file: "/var/unbound/db/root.key"

There is no longer a requirement to run unbound-anchor manually to
update the root key. The rc.d script will take care of updates at boot,
and Unbound will manage the file itself at runtime.

Test with "dig test.dnssec-or-not.net txt @127.0.0.1" or similar.

merge conflicts, remove old libldns files

change pidfile location again; actually this is written before chroot, so
it can go straight in /var/run

use $chrootdir/run for pid file, like nsd.

Add a few missing files for 'make clean'.

When clenaing, run "make realclean" in the ldns subdirectory, not just unbound.

set --without-pythonmodule (this is the default anyway, but better to be explicit).

Add Makefile wrapper for Unbound. From Bjorn Ketelaars <bjorn.ketelaars
at hydroxide.nl>.

The way we merge libunbound from unbound(8) into unwind(8) we need to make
sure that we don't accidentally enable threading by accident. A threaded
unwind(8) does not work since it's missing openssl locks.
No config.h change.
input & OK sthen

update to unbound 1.6.4, ok florian@

Back out make(obj) hack: it doesn't solve the problem entirely and may
interfere with read-only src tree setups.

Add a workaround for the fact that 'install -d' without explicit mode
defaults to 755, which is incompatible with WOBJUMASK. Make sure that
obj/util has permissions :wobj 770, as all other directories in obj/.
Issue also found by jmc, actual reason tracked down by ajacoutot.

ok ajacoutot

Rewriting USER gets in the way of the de-escalation mechanism as it
shadows the real user's identity.
ok deraadt

Don't use a pidfile in unbound by default. Retain the ability in unbound.conf
to set one if needed. ok millert@

Remove passing an override of INSTALL_PROGRAM to the
autoconf script. It doesn't seem to serve any purpose.

ok sthen@

clean up some files generated during the build.

noticed by deraadt@

Remove bsd-wrapper pieces to handle pulling unbound-host.1 from src,
no longer needed now that this file is handled the same in Unbound's build
infrastructure as the other manpages.

Install a /var/unbound/db directory, writable by the _unbound daemon,
and use it as the default location for the DNSSEC root key. Update default
config for this location.

With this, the only step required to enable DNSSEC validation is to
uncomment these default config entries and restart:

#module-config: "validator iterator"
#auto-trust-anchor-file: "/var/unbound/db/root.key"

There is no longer a requirement to run unbound-anchor manually to
update the root key. The rc.d script will take care of updates at boot,
and Unbound will manage the file itself at runtime.

Test with "dig test.dnssec-or-not.net txt @127.0.0.1" or similar.

merge conflicts, remove old libldns files

change pidfile location again; actually this is written before chroot, so
it can go straight in /var/run

use $chrootdir/run for pid file, like nsd.

Add a few missing files for 'make clean'.

When clenaing, run "make realclean" in the ldns subdirectory, not just unbound.

set --without-pythonmodule (this is the default anyway, but better to be explicit).

Add Makefile wrapper for Unbound. From Bjorn Ketelaars <bjorn.ketelaars
at hydroxide.nl>.

update to unbound 1.6.4, ok florian@

Back out make(obj) hack: it doesn't solve the problem entirely and may
interfere with read-only src tree setups.

Add a workaround for the fact that 'install -d' without explicit mode
defaults to 755, which is incompatible with WOBJUMASK. Make sure that
obj/util has permissions :wobj 770, as all other directories in obj/.
Issue also found by jmc, actual reason tracked down by ajacoutot.

ok ajacoutot

Rewriting USER gets in the way of the de-escalation mechanism as it
shadows the real user's identity.
ok deraadt

Don't use a pidfile in unbound by default. Retain the ability in unbound.conf
to set one if needed. ok millert@

Remove passing an override of INSTALL_PROGRAM to the
autoconf script. It doesn't seem to serve any purpose.

ok sthen@

clean up some files generated during the build.

noticed by deraadt@

Remove bsd-wrapper pieces to handle pulling unbound-host.1 from src,
no longer needed now that this file is handled the same in Unbound's build
infrastructure as the other manpages.

Install a /var/unbound/db directory, writable by the _unbound daemon,
and use it as the default location for the DNSSEC root key. Update default
config for this location.

With this, the only step required to enable DNSSEC validation is to
uncomment these default config entries and restart:

#module-config: "validator iterator"
#auto-trust-anchor-file: "/var/unbound/db/root.key"

There is no longer a requirement to run unbound-anchor manually to
update the root key. The rc.d script will take care of updates at boot,
and Unbound will manage the file itself at runtime.

Test with "dig test.dnssec-or-not.net txt @127.0.0.1" or similar.

merge conflicts, remove old libldns files

change pidfile location again; actually this is written before chroot, so
it can go straight in /var/run

use $chrootdir/run for pid file, like nsd.

Add a few missing files for 'make clean'.

When clenaing, run "make realclean" in the ldns subdirectory, not just unbound.

set --without-pythonmodule (this is the default anyway, but better to be explicit).

Add Makefile wrapper for Unbound. From Bjorn Ketelaars <bjorn.ketelaars
at hydroxide.nl>.