OpenDNSSEC 1.2.0:

Bugfixes:
* Enforcer: Fixed a number of build warnings.

OpenDNSSEC 1.2.0rc3:

* Moved migration instructions to the file MIGRATION

Bugfixes:
* Bugreport #199: The previous DB schema change made the zone removal broken.
* Enforcer: When retiring old KSK, use TTL(ds) and not TTL(ksk).
* Enforcer: Minimize the set of DS RRs sent to DelegationSignerSubmitCommand.
* Enforcer: Replace tab with a space character in the DNSKEY printed to syslog.
* Enforcer: Fixed pontential format string bug.
* ods-ksmutil: Log to syslog when ds-seen changes a key to active/standby.
* Signer Engine: Don't be smart with RRSIG TTLs, the hsm will set them for you.
* Signer Engine: Set notify command for zone when receiving ods-signer update.
* Signer Engine: Update TTL of NSEC(3) records if SOA Minimum has changed
  in KASP.
* Signer Engine: Now logs to the correct facility.
* Signer Engine: Also remove NSEC records when detecting changes in
  signconf <Denial>
* Signer Engine: Dropped privileges before starting Zonefetcher.

OpenDNSSEC 1.2.0rc2:

Bugfixes:
* Signer Engine: Use the correct TTL for RRs after the $INCLUDE directive.
* Signer Engine: Also create new signature if TTL of RR has changed.
* Signer Engine: Drop old NSEC/NSEC3 records.
* ods-ksmutil: Fixed some memory leaks.

OpenDNSSEC 1.2.0rc1:

* New commandline option for the signer: ods-signer running.
* Allow connection to different MySQL ports in the Enforcer.
* Tone down and explain warning when converting M or Y to seconds
* ldns 1.6.7 is required for bugfixes
* dnsruby 1.51 is required for bugfixes

Bugfixes:
* Bugreport #187: ods-control signer start will return non-zero if start up
  failed (uses ods-signer running).
* Narrow glue at the zone cut is allowed, do not consider it as occluded.
* Move zone fetcher output to correct input adapter file.
* Enforcer shared keys on zones with ShareKeys disabled.
* Make names of key states consistent.
* Signer Engine file descriptor leak fix on engine.sock.
* Set explicit "unlimited" repository capacity to prevent random integer being
  read. Requires "ods-ksmutil update conf" to be run if using an existing
  database.
* Fix issue with key generation creating too many keys Ticket #194.
* Bugreport #189: Auditor did not handle white-space-seperated substrings
  for base64 text
* Bugreport #190: Auditor (and signer) does not handle case correctly
* Signer now silence stdout-output from the notify command

OpenDNSSEC 1.2.0b1:

* A new signer engine, written in c. Zones are maintained in memory, instead of
  in files on disk.
* Removed the python and python-4suite-xml dependencies.
* Remove separate autoconf for libhsm/conf/enforcer.
* Add option to disable building the signer.
* Signer logs statistics just after outputting a new signed zone.
* libhsm will skip processing (and not create) any public keys if the
  per repository option <SkipPublicKey/> is set.
* Keysharing improved - keys can now exist in different states on each zone
  that the key is in use for.
* Backup prepare/commit/rollback added for 2-step backups without taking the
  enforcer offline.
* Standby keys are now optional (default to 0) and should be considered
  experimental.

Bugfixes:
* Fix semantics of refresh value in Signer Engine.
* Auditor handles chains of empty nonterminals correctly.
* Recalculate salt immediately if the saltlength is changed.
* libhsm connected to slot 0 if the token label was not found.
  An error is now returned instead of connecting to the slot.
* Bugreport #102: Removed the obsoleted python-4suite-xml dependency.
* Fixed Known Issue: KSK rollover requires manual timing.
* Fixed Known Issue: Key rollover and reuse of signatures.
* Fixed Known Issue: Issue with sharing keys and adding zones.
* Fixed Known Issue: Quicksorter does not allow certain owner names
  (Quicksorter is removed, signer now reads and sorts the zone).

1 files changed, 4 insertions, 35 deletions

diff --git a/security/opendnssec/PLIST b/security/opendnssec/PLIST
index a89a7aa60c8..e9c7d8643f6 100644
--- a/security/opendnssec/PLIST
+++ b/security/opendnssec/PLIST
@@ -1,52 +1,21 @@
-@comment $NetBSD: PLIST,v 1.2 2010/06/16 00:19:08 pettai Exp $
+@comment $NetBSD: PLIST,v 1.3 2011/01/24 20:30:28 pettai Exp $
 bin/ods-auditor
 bin/ods-hsmspeed
 bin/ods-hsmutil
 bin/ods-kasp2html
 bin/ods-kaspcheck
 bin/ods-ksmutil
-include/hsmtest.h
-include/libhsm.h
-include/libhsmdns.h
-lib/libhsm.la
 lib/opendnssec/kasp_auditor.rb
 lib/opendnssec/kasp_auditor/auditor.rb
+lib/opendnssec/kasp_auditor/changed_config.rb
+lib/opendnssec/kasp_auditor/commands.rb
 lib/opendnssec/kasp_auditor/config.rb
 lib/opendnssec/kasp_auditor/key_tracker.rb
 lib/opendnssec/kasp_auditor/parse.rb
 lib/opendnssec/kasp_auditor/partial_auditor.rb
 lib/opendnssec/kasp_auditor/preparser.rb
 lib/opendnssec/kasp_checker.rb
-lib/opendnssec/signer/Engine.py
-lib/opendnssec/signer/Engine.pyc
-lib/opendnssec/signer/Engine.pyo
-lib/opendnssec/signer/EngineConfig.py
-lib/opendnssec/signer/EngineConfig.pyc
-lib/opendnssec/signer/EngineConfig.pyo
-lib/opendnssec/signer/Util.py
-lib/opendnssec/signer/Util.pyc
-lib/opendnssec/signer/Util.pyo
-lib/opendnssec/signer/Worker.py
-lib/opendnssec/signer/Worker.pyc
-lib/opendnssec/signer/Worker.pyo
-lib/opendnssec/signer/Zone.py
-lib/opendnssec/signer/Zone.pyc
-lib/opendnssec/signer/Zone.pyo
-lib/opendnssec/signer/ZoneConfig.py
-lib/opendnssec/signer/ZoneConfig.pyc
-lib/opendnssec/signer/ZoneConfig.pyo
-lib/opendnssec/signer/ZoneList.py
-lib/opendnssec/signer/ZoneList.pyc
-lib/opendnssec/signer/ZoneList.pyo
 lib/opendnssec/time_shift.rb
-libexec/opendnssec/create_dnskey
-libexec/opendnssec/finalizer
-libexec/opendnssec/get_class
-libexec/opendnssec/get_serial
-libexec/opendnssec/quicksorter
-libexec/opendnssec/signer
-libexec/opendnssec/zone_fetcher
-libexec/opendnssec/zone_reader
 man/man1/ods-auditor.1
 man/man1/ods-hsmspeed.1
 man/man1/ods-hsmutil.1
@@ -70,7 +39,6 @@ share/examples/opendnssec/zonefetch.xml
 share/examples/opendnssec/zonefetch.xml.sample
 share/examples/opendnssec/zonelist.xml
 share/examples/opendnssec/zonelist.xml.sample
-share/opendnssec.spec
 share/opendnssec/conf.rnc
 share/opendnssec/conf.rng
 share/opendnssec/database_create.sqlite3
@@ -83,4 +51,5 @@ share/opendnssec/zonefetch.rnc
 share/opendnssec/zonefetch.rng
 share/opendnssec/zonelist.rnc
 share/opendnssec/zonelist.rng
+@pkgdir lib/opendnssec/signer
 @pkgdir etc/opendnssec