Adding metadata

author: root <root@alpha.trunkmasters.com> 2026-06-20 14:54:46 -0500
committer: root <root@alpha.trunkmasters.com> 2026-06-20 14:54:46 -0500
commit: 1a4479b4e0368c8d5ff241ebad17b2541a7e3ba0 (patch)
tree: 18e2e784f9fb0dbc3546537acc42ad51b366d90e /net-dns
parent: 9f6a581d94412ab1cf4b35c33101f6be0ddc7777 (diff)
download: baldeagleos-repo-1a4479b4e0368c8d5ff241ebad17b2541a7e3ba0.tar.gz
baldeagleos-repo-1a4479b4e0368c8d5ff241ebad17b2541a7e3ba0.tar.xz
baldeagleos-repo-1a4479b4e0368c8d5ff241ebad17b2541a7e3ba0.zip
50 files changed, 3204 insertions, 1867 deletions
diff --git a/net-dns/bind-tools/Manifest b/net-dns/bind-tools/Manifest
deleted file mode 100644
index 53cb16206e9d..000000000000
--- a/net-dns/bind-tools/Manifest
+++ /dev/null
@@ -1,2 +0,0 @@
-DIST bind-9.20.22.tar.xz 5817248 BLAKE2B 74537646d8c08c4874548b064ab62bab3721d22e2654feed54ea0b61c087018b24f725d0cfaf8298bc71a1be280c753c86449b13e5d9ec26f84ba7e9f61b7a5a SHA512 a23b630fc755977534e3fb8605810495ab8e4817ade93448f93167a38c643b0da6e93b3c2d9e191e99989af446a8aabfa43636120cc6c2a0c653dcd36cb89d07
-DIST bind-9.20.23.tar.xz 5837532 BLAKE2B f4f5526fac2832685204ccc93087df3ce2dd3fbb267a5b68d0cf8074365a8f1d6e7b9ff130b41a023ea8dd96499a361a0396188f0a71a08630c54ec13e63c39a SHA512 fce8a69620c15223e54dd197c09c7b00c165e5e3a5b2f62b241f589be5675c581029cf750caa8ed1f1fcb0faf293df04e77c494c205bab89d6d01153395bf4cb
diff --git a/net-dns/bind-tools/bind-tools-9.18.0-r1.ebuild b/net-dns/bind-tools/bind-tools-9.18.0-r1.ebuild
new file mode 100644
index 000000000000..e60054aaba73
--- /dev/null
+++ b/net-dns/bind-tools/bind-tools-9.18.0-r1.ebuild
@@ -0,0 +1,29 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DESCRIPTION="bind tools: dig, nslookup, host, nsupdate, dnssec-keygen"
+HOMEPAGE="https://www.isc.org/bind/ https://gitlab.isc.org/isc-projects/bind9"
+
+LICENSE="Apache-2.0 BSD BSD-2 GPL-2 HPND ISC MPL-2.0"
+SLOT="0"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86"
+IUSE="+caps doc gssapi idn libedit readline xml"
+
+RDEPEND="=net-dns/bind-9.18*[caps?,doc?,gssapi?,idn?,xml?]"
+
+pkg_postinst() {
+	ewarn "net-dns/bind-tools is now merged into net-dns/bind and"
+	ewarn "net-dns/bind-tools serves as a dummy package until it is"
+	ewarn "eventually removed. The split was already a maintenance burden"
+	ewarn "because of lack of build system support for it, but this became"
+	ewarn "more severe with >=9.18.0."
+	ewarn ""
+	ewarn "Please run the following commands:"
+	ewarn "* emerge --deselect net-dns/bind-tools"
+	ewarn "* emerge --noreplace net-dns/bind instead"
+	ewarn ""
+	ewarn "For the latest maintained versions, including >=9.20,"
+	ewarn "ensure you are using net-dns/bind directly."
+}
diff --git a/net-dns/bind-tools/bind-tools-9.20.22.ebuild b/net-dns/bind-tools/bind-tools-9.20.22.ebuild
deleted file mode 100644
index 242dbf45fbb7..000000000000
--- a/net-dns/bind-tools/bind-tools-9.20.22.ebuild
+++ /dev/null
@@ -1,156 +0,0 @@
-# Copyright 2021-2026 Liguros Authors
-# Distributed under the terms of the GNU General Public License v2
-EAPI=8
-
-inherit autotools flag-o-matic toolchain-funcs
-
-MY_PN=${PN//-tools}
-MY_PV=${PV/_p/-P}
-MY_PV=${MY_PV/_rc/rc}
-MY_P="${MY_PN}-${MY_PV}"
-
-DESCRIPTION="bind tools: dig, nslookup, host, nsupdate, dnssec-keygen"
-HOMEPAGE="https://www.isc.org/software/bind"
-SRC_URI="https://downloads.isc.org/isc/bind9/${PV}/${MY_P}.tar.xz"
-
-LICENSE="Apache-2.0 BSD BSD-2 GPL-2 HPND ISC MPL-2.0"
-SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
-IUSE="+caps dnstap doc gssapi idn ipv6 libedit readline xml"
-# no PKCS11 currently as it requires OpenSSL to be patched, also see bug 409687
-
-COMMON_DEPEND="
-	=net-dns/bind-${PV}:=
-	dev-libs/libuv:=
-	dev-libs/jemalloc
-	caps? ( sys-libs/libcap )
-	dev-libs/openssl:=
-
-	xml? ( dev-libs/libxml2 )
-	idn? ( net-dns/libidn2:= )
-	gssapi? ( virtual/krb5 )
-	dnstap? (
-		dev-libs/protobuf
-		dev-libs/fstrm
-	)
-	libedit? ( dev-libs/libedit )
-	!libedit? (
-		readline? ( sys-libs/readline:= )
-	)
-"
-DEPEND="${COMMON_DEPEND}"
-RDEPEND="${COMMON_DEPEND}"
-
-# sphinx required for man-page and html creation
-BDEPEND="
-	doc? ( dev-python/sphinx )
-	virtual/pkgconfig
-"
-
-S="${WORKDIR}/${MY_P}"
-
-# bug 479092, requires networking
-RESTRICT="test"
-
-src_prepare() {
-	default
-	export LDFLAGS="${LDFLAGS} -L${EPREFIX}/usr/$(get_libdir)"
-	# Disable tests for now, bug 406399
-	sed -i '/^SUBDIRS/s:tests::' bin/Makefile.in lib/Makefile.in || die
-
-	# bug #220361
-	rm aclocal.m4 || die
-	rm -rf libtool.m4/ || die
-
-	eautoreconf
-}
-
-src_configure() {
-	local myeconfargs=(
-		--sysconfdir=/etc/bind
-		--localstatedir="${EPREFIX}"/var
-		--disable-silent-rules
-		--without-zlib
-		--without-lmdb
-		--without-maxminddb
-		--disable-geoip
-		--with-openssl="${ESYSROOT}"/usr
-		$(use_enable dnstap)
-		$(use_with idn libidn2 "${ESYSROOT}"/usr)
-		$(use_with xml libxml2)
-		$(use_with gssapi)
-		$(use_with readline)
-		$(use_enable caps linux-caps)
-		AR="$(type -P $(tc-getAR))"
-	)
-
-	# bug 607400
-	if use libedit ; then
-		myeconfargs+=( --with-readline=libedit )
-	elif use readline ; then
-		myeconfargs+=( --with-readline=readline )
-	else
-		myeconfargs+=( --without-readline )
-	fi
-
-	# bug 344029
-	append-cflags "-DDIG_SIGCHASE"
-
-	# to expose CMSG_* macros from sys/sockets.h
-	[[ ${CHOST} == *-solaris* ]] && append-cflags "-D_XOPEN_SOURCE=600"
-
-	# localstatedir for nsupdate -l, bug 395785
-	tc-export BUILD_CC
-	econf "${myeconfargs[@]}"
-
-	# bug #151839
-	echo '#undef SO_BSDCOMPAT' >> config.h
-}
-
-src_compile() {
-	local AR=$(tc-getAR)
-
-	emake AR="${AR}" bind.keys.h
-	emake AR="${AR}" -C lib/
-	emake AR="${AR}" -C bin/delv/
-	emake AR="${AR}" -C bin/dig/
-	emake AR="${AR}" -C bin/nsupdate/
-	emake AR="${AR}" -C bin/dnssec/
-	emake -C doc/man/ man $(usev doc)
-}
-
-src_install() {
-	local man_dir="${S}/doc/man"
-	local html_dir="${man_dir}/_build/html"
-
-	dodoc README.md ChangeLog
-
-	cd "${S}"/bin/delv || die
-	dobin delv
-	doman ${man_dir}/delv.1
-
-	cd "${S}"/bin/dig || die
-	dobin dig host nslookup
-	cd "${S}"/bin/dig/.libs || die
-	dobin dig host nslookup
-	dolib.a libdighost.a
-	doman ${man_dir}/{dig,host,nslookup}.1
-
-	cd "${S}"/bin/nsupdate || die
-	dobin nsupdate
-	doman ${man_dir}/nsupdate.1
-	if use doc; then
-		docinto html
-		dodoc ${html_dir}/nsupdate.html
-	fi
-
-	cd "${S}"/bin/dnssec || die
-	for tool in dsfromkey importkey keyfromlabel keygen \
-		revoke settime signzone verify; do
-		dobin dnssec-"${tool}"
-		if use doc; then
-			docinto html
-			dodoc ${html_dir}/dnssec-"${tool}".html
-		fi
-	done
-}
diff --git a/net-dns/bind-tools/bind-tools-9.20.23.ebuild b/net-dns/bind-tools/bind-tools-9.20.23.ebuild
deleted file mode 100644
index 242dbf45fbb7..000000000000
--- a/net-dns/bind-tools/bind-tools-9.20.23.ebuild
+++ /dev/null
@@ -1,156 +0,0 @@
-# Copyright 2021-2026 Liguros Authors
-# Distributed under the terms of the GNU General Public License v2
-EAPI=8
-
-inherit autotools flag-o-matic toolchain-funcs
-
-MY_PN=${PN//-tools}
-MY_PV=${PV/_p/-P}
-MY_PV=${MY_PV/_rc/rc}
-MY_P="${MY_PN}-${MY_PV}"
-
-DESCRIPTION="bind tools: dig, nslookup, host, nsupdate, dnssec-keygen"
-HOMEPAGE="https://www.isc.org/software/bind"
-SRC_URI="https://downloads.isc.org/isc/bind9/${PV}/${MY_P}.tar.xz"
-
-LICENSE="Apache-2.0 BSD BSD-2 GPL-2 HPND ISC MPL-2.0"
-SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
-IUSE="+caps dnstap doc gssapi idn ipv6 libedit readline xml"
-# no PKCS11 currently as it requires OpenSSL to be patched, also see bug 409687
-
-COMMON_DEPEND="
-	=net-dns/bind-${PV}:=
-	dev-libs/libuv:=
-	dev-libs/jemalloc
-	caps? ( sys-libs/libcap )
-	dev-libs/openssl:=
-
-	xml? ( dev-libs/libxml2 )
-	idn? ( net-dns/libidn2:= )
-	gssapi? ( virtual/krb5 )
-	dnstap? (
-		dev-libs/protobuf
-		dev-libs/fstrm
-	)
-	libedit? ( dev-libs/libedit )
-	!libedit? (
-		readline? ( sys-libs/readline:= )
-	)
-"
-DEPEND="${COMMON_DEPEND}"
-RDEPEND="${COMMON_DEPEND}"
-
-# sphinx required for man-page and html creation
-BDEPEND="
-	doc? ( dev-python/sphinx )
-	virtual/pkgconfig
-"
-
-S="${WORKDIR}/${MY_P}"
-
-# bug 479092, requires networking
-RESTRICT="test"
-
-src_prepare() {
-	default
-	export LDFLAGS="${LDFLAGS} -L${EPREFIX}/usr/$(get_libdir)"
-	# Disable tests for now, bug 406399
-	sed -i '/^SUBDIRS/s:tests::' bin/Makefile.in lib/Makefile.in || die
-
-	# bug #220361
-	rm aclocal.m4 || die
-	rm -rf libtool.m4/ || die
-
-	eautoreconf
-}
-
-src_configure() {
-	local myeconfargs=(
-		--sysconfdir=/etc/bind
-		--localstatedir="${EPREFIX}"/var
-		--disable-silent-rules
-		--without-zlib
-		--without-lmdb
-		--without-maxminddb
-		--disable-geoip
-		--with-openssl="${ESYSROOT}"/usr
-		$(use_enable dnstap)
-		$(use_with idn libidn2 "${ESYSROOT}"/usr)
-		$(use_with xml libxml2)
-		$(use_with gssapi)
-		$(use_with readline)
-		$(use_enable caps linux-caps)
-		AR="$(type -P $(tc-getAR))"
-	)
-
-	# bug 607400
-	if use libedit ; then
-		myeconfargs+=( --with-readline=libedit )
-	elif use readline ; then
-		myeconfargs+=( --with-readline=readline )
-	else
-		myeconfargs+=( --without-readline )
-	fi
-
-	# bug 344029
-	append-cflags "-DDIG_SIGCHASE"
-
-	# to expose CMSG_* macros from sys/sockets.h
-	[[ ${CHOST} == *-solaris* ]] && append-cflags "-D_XOPEN_SOURCE=600"
-
-	# localstatedir for nsupdate -l, bug 395785
-	tc-export BUILD_CC
-	econf "${myeconfargs[@]}"
-
-	# bug #151839
-	echo '#undef SO_BSDCOMPAT' >> config.h
-}
-
-src_compile() {
-	local AR=$(tc-getAR)
-
-	emake AR="${AR}" bind.keys.h
-	emake AR="${AR}" -C lib/
-	emake AR="${AR}" -C bin/delv/
-	emake AR="${AR}" -C bin/dig/
-	emake AR="${AR}" -C bin/nsupdate/
-	emake AR="${AR}" -C bin/dnssec/
-	emake -C doc/man/ man $(usev doc)
-}
-
-src_install() {
-	local man_dir="${S}/doc/man"
-	local html_dir="${man_dir}/_build/html"
-
-	dodoc README.md ChangeLog
-
-	cd "${S}"/bin/delv || die
-	dobin delv
-	doman ${man_dir}/delv.1
-
-	cd "${S}"/bin/dig || die
-	dobin dig host nslookup
-	cd "${S}"/bin/dig/.libs || die
-	dobin dig host nslookup
-	dolib.a libdighost.a
-	doman ${man_dir}/{dig,host,nslookup}.1
-
-	cd "${S}"/bin/nsupdate || die
-	dobin nsupdate
-	doman ${man_dir}/nsupdate.1
-	if use doc; then
-		docinto html
-		dodoc ${html_dir}/nsupdate.html
-	fi
-
-	cd "${S}"/bin/dnssec || die
-	for tool in dsfromkey importkey keyfromlabel keygen \
-		revoke settime signzone verify; do
-		dobin dnssec-"${tool}"
-		if use doc; then
-			docinto html
-			dodoc ${html_dir}/dnssec-"${tool}".html
-		fi
-	done
-}
diff --git a/net-dns/bind-tools/metadata.xml b/net-dns/bind-tools/metadata.xml
index 6f1109bcc04f..d1e1cb34b6ae 100644
--- a/net-dns/bind-tools/metadata.xml
+++ b/net-dns/bind-tools/metadata.xml
@@ -1,24 +1,15 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
 <pkgmetadata>
-  <maintainer type="project">
-    <email>dev@liguros.net</email>
-    <name>Development</name>
-  </maintainer>
-  <maintainer type="person">
-    <email>zlogene@gentoo.org</email>
-    <name>Mikle Kolyada</name>
-  </maintainer>
   <maintainer type="person">
     <email>chutzpah@gentoo.org</email>
     <name>Patrick McLean</name>
   </maintainer>
-  <upstream>
-    <remote-id type="cpe">cpe:/a:isc:bind</remote-id>
-  </upstream>
   <use>
     <flag name="gssapi">Enable gssapi support</flag>
-    <flag name="dnstap">Enable dnstap support</flag>
   </use>
+  <upstream>
+    <remote-id type="cpe">cpe:/a:isc:bind</remote-id>
+  </upstream>
   <origin>baldeagleos-repo</origin>
 </pkgmetadata>
diff --git a/net-dns/bind/Manifest b/net-dns/bind/Manifest
index 53cb16206e9d..cf55c3682aa7 100644
--- a/net-dns/bind/Manifest
+++ b/net-dns/bind/Manifest
@@ -1,2 +1,12 @@
+DIST bind-9.18.38.tar.xz 5362772 BLAKE2B 04a7eeba174dc0333f5f4f3a0767ac66a0f81665dc26dc5a88434ab1c1c12fdd2deaee91b62f77001a92283d40942a0487f6d314b465d9dac6c817d4f78166d4 SHA512 38710646a817dca0df6247b660cd244c79da13d0fed2898da139ae206bc8732fddd93af6fc2cbeca805c0c0d0789ec22eacf26789db288154581478ab2eaf44c
+DIST bind-9.18.39.tar.xz 5383056 BLAKE2B 5629a4973273d0ef132c94634be2787a916e6cf2dd2d4dfb12c5a27359ffc8eda26bbfc8650a03fbb5f5b98d834527289a213c74f0c5d31a68f4781053fed3bc SHA512 fd6d45c9cb9c599d8770c18801fad2f177faf3a8af82948800d186ae6dc9eb2c894b61802def0841eb722c615c93c077b55368204f0cf2737a3c50d949efca07
+DIST bind-9.18.42.tar.xz 5423412 BLAKE2B d29813a76f18eaf75908e95f18d0c82fb591a1228962ec6d209a08260b2f60327e049fc263bd772eed12bd9c2231c835f1e3f3262df0e0f6811481570e1dc169 SHA512 9133be987e2043aabf8cd7de58f62c41c632b92d9930a3644aaff80b23211e5a967a133080f6e61142408ef752f8a07d6b7c1e775ca8a495bb29ff9d167446c0
+DIST bind-9.18.47.tar.xz 5448920 BLAKE2B fea217afba2d40b8d762bee70a0f31c35cd9c6fe1df5e5a7730bd8c5c69e0f0e8df03d8eb276a40851f4105d40210f297d5d3a970ed678d620aa726ddf27b945 SHA512 8135d453c0dd99947c93b9fb8fe1a52c5657f1c675b503dbfb745dfc9bb278121dc307d590bae99b439b093e87cb2bd0bf07d0a32ffd8a39841752559a0df1e8
+DIST bind-9.18.48.tar.xz 5452356 BLAKE2B 2712af1f077284c752d7279784f9990dfec75fc0eb0715219e6ca502356f01a21b9fa1b3d7ce83252c1818adf9d1e6a58d7c15dda0aa9d7179e7a75ba57d6193 SHA512 9c93fe60e8fdfa140cfd535beaf42b368aed885aa97669f990f100c8d75d02cb2b0423f87e8b0f36315fda5bb998e18b7bf8d3d649e9ffe32a4724947a5bebe7
+DIST bind-9.18.49.tar.xz 5476288 BLAKE2B 3a8510602b63708cc3f7b47dc89e2f2f62ebf022403075e4222e4067445c99e183b8f9a94ca04134479406ee4966acc4cf6d79751cbcbfd018f6aca51d209372 SHA512 e5259db8b9fdb3940d4e1d95978514692777a3675fc85a83db30e049d80d8150d10e672d51eeb885a94c6bbd4573ff8fe49248117c24ff155197a24a26b09544
+DIST bind-9.20.21.tar.xz 5808576 BLAKE2B 20c2acac40242516da10cc8e45074de3d5d8906e4c4e216f6d69cba0585816aba4ec77adda8142294623eef5b045ec64cc8a18c721ece6af939741903558454b SHA512 f0f566a243268a579a7c97409409699aa66a08e82982d48046c83d9dfd01f8a9c337af7bb80018773667fcc98a5e6fb9f244ac28e72688ab04a494337605c616
+DIST bind-9.20.21.tar.xz.asc 833 BLAKE2B d3af3befb08ef8c3fefdd5baa61647414a026dd86d7bb3982ac12f9ae5a5199326c8421dee6eb7a2eea219b67491afb36be366509488df2128008fccbd9b2787 SHA512 21eddf0ca03874381c5135496e9b0739d1889cbdcced0dd9b68075e3e04ea24983ff8974b462d8ee0f36e1eb0c202b2791707037346e8f0aa2a13e94a1a5f7bb
 DIST bind-9.20.22.tar.xz 5817248 BLAKE2B 74537646d8c08c4874548b064ab62bab3721d22e2654feed54ea0b61c087018b24f725d0cfaf8298bc71a1be280c753c86449b13e5d9ec26f84ba7e9f61b7a5a SHA512 a23b630fc755977534e3fb8605810495ab8e4817ade93448f93167a38c643b0da6e93b3c2d9e191e99989af446a8aabfa43636120cc6c2a0c653dcd36cb89d07
+DIST bind-9.20.22.tar.xz.asc 833 BLAKE2B 1b68a0dc7ba7e3bcb9c222f13daaf113e464cfea792408bc28096ce7961e3121a85104b0bfb468bd6c7a8becdc0fb54ed744aeb96490b4d5792ed7113fb69b02 SHA512 c987629f59f919ce325c70c001e5c3093bd9f36dc589aac94ba9cdfcc4679e892da4d1980cc154801f222a9ec4dbf3112ff627e5abf539a5d3cf20629fda72b3
 DIST bind-9.20.23.tar.xz 5837532 BLAKE2B f4f5526fac2832685204ccc93087df3ce2dd3fbb267a5b68d0cf8074365a8f1d6e7b9ff130b41a023ea8dd96499a361a0396188f0a71a08630c54ec13e63c39a SHA512 fce8a69620c15223e54dd197c09c7b00c165e5e3a5b2f62b241f589be5675c581029cf750caa8ed1f1fcb0faf293df04e77c494c205bab89d6d01153395bf4cb
+DIST bind-9.20.23.tar.xz.asc 833 BLAKE2B dd8f34f1257c7fa153225b0d25780c34549ed8209e88a41ccbd66dca3186817395002989cebe92fecb39bcb5452d998c512daac5143a7fb87baacdcb6a1d5976 SHA512 41c008dd3edc1bff238dbabff74731ffb1ec7213805e354661450a28676212b3937d3be35e7ecaefd3670f609cc40fbd346ebfff77aa82511d28d46c24b88c31
diff --git a/net-dns/bind/bind-9.18.38.ebuild b/net-dns/bind/bind-9.18.38.ebuild
new file mode 100644
index 000000000000..0bc7a9f363e4
--- /dev/null
+++ b/net-dns/bind/bind-9.18.38.ebuild
@@ -0,0 +1,282 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit eapi9-ver systemd tmpfiles toolchain-funcs
+
+MY_PV="${PV/_p/-P}"
+MY_PV="${MY_PV/_rc/rc}"
+
+DESCRIPTION="Berkeley Internet Name Domain - Name Server"
+HOMEPAGE="https://www.isc.org/software/bind"
+SRC_URI="https://downloads.isc.org/isc/bind9/${PV}/${P}.tar.xz"
+S="${WORKDIR}/${PN}-${MY_PV}"
+
+LICENSE="MPL-2.0"
+SLOT="0"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~mips ppc ppc64 ~riscv ~s390 ~sparc x86"
+IUSE="+caps dnstap doc doh fixed-rrset idn jemalloc geoip gssapi lmdb selinux static-libs test xml"
+RESTRICT="!test? ( test )"
+
+DEPEND="
+	acct-group/named
+	acct-user/named
+	dev-libs/json-c:=
+	>=dev-libs/libuv-1.37.0:=
+	virtual/zlib:=
+	dev-libs/openssl:=[-bindist(-)]
+	caps? ( >=sys-libs/libcap-2.1.0 )
+	dnstap? (
+		dev-libs/fstrm
+		dev-libs/protobuf-c
+	)
+	doh? ( net-libs/nghttp2:= )
+	geoip? ( dev-libs/libmaxminddb )
+	gssapi? ( virtual/krb5 )
+	idn? ( net-dns/libidn2 )
+	jemalloc? ( dev-libs/jemalloc:= )
+	lmdb? ( dev-db/lmdb )
+	xml? ( dev-libs/libxml2:= )
+"
+RDEPEND="
+	${DEPEND}
+	selinux? ( sec-policy/selinux-bind )
+	sys-process/psmisc
+	!<net-dns/bind-tools-9.18.0
+"
+# sphinx required for man-page and html creation
+BDEPEND="
+	dev-lang/perl
+	virtual/pkgconfig
+	doc? ( dev-python/sphinx )
+	test? (
+		dev-util/cmocka
+	)
+"
+
+src_prepare() {
+	default
+
+	# Don't clobber our toolchain defaults
+	sed -i -e '/FORTIFY_SOURCE=/d' configure || die
+
+	# Test is (notoriously) slow/resource intensive
+	sed -i -e 's:ISC_TEST_MAIN:int main(void) { exit(77); }:' tests/isc/netmgr_test.c || die
+
+	# Relies on -Wl,--wrap (bug #877741)
+	if tc-is-lto ; then
+		sed -i -e 's:ISC_TEST_MAIN:int main(void) { exit(77); }:' tests/ns/query_test.c || die
+	fi
+}
+
+src_configure() {
+	# configure automagically uses sphinx even if prebuilt man pages
+	# are available. Force fallback to prebuilt ones.
+	use doc || export ac_cv_path_SPHINX_BUILD= SPHINX_BUILD=
+
+	local myeconfargs=(
+		--prefix="${EPREFIX}"/usr
+		--sysconfdir="${EPREFIX}"/etc/bind
+		--localstatedir="${EPREFIX}"/var
+		--enable-full-report
+		--without-readline
+		--with-openssl="${ESYSROOT}"/usr
+		--with-json-c
+		--with-zlib
+		$(use_enable caps linux-caps)
+		--disable-dnsrps
+		$(use_enable dnstap)
+		$(use_enable doh)
+		$(use_with doh libnghttp2)
+		$(use_enable fixed-rrset)
+		$(use_enable static-libs static)
+		$(use_enable geoip)
+		$(use_with test cmocka)
+		$(use_with geoip maxminddb)
+		$(use_with gssapi)
+		$(use_with idn libidn2)
+		$(use_with jemalloc)
+		$(use_with lmdb)
+		$(use_with xml libxml2)
+	)
+
+	econf "${myeconfargs[@]}"
+}
+
+src_test() {
+	# system tests ('emake test') require network configuration for IPs etc
+	# so we run the unit tests instead.
+	CI=1 emake unit V=1
+
+	# libtest is an internal test helper library, it has no tests,
+	# so suppress the QA warning.
+	rm tests/libtest/test-suite.log || die
+}
+
+src_install() {
+	default
+
+	if use doc; then
+		docinto misc
+		dodoc -r doc/misc/
+
+		docinto html
+		dodoc -r doc/arm/
+
+		docinto dnssec-guide
+		dodoc -r doc/dnssec-guide/
+
+		docinto contrib
+		dodoc contrib/scripts/nanny.pl
+	fi
+
+	insinto /etc/bind
+	newins "${FILESDIR}"/named.conf-r9 named.conf
+	newins "${FILESDIR}"/named.conf.auth named.conf.auth
+
+	newinitd "${FILESDIR}"/named.init-r15 named
+	newconfd "${FILESDIR}"/named.confd-r8 named
+
+	newenvd "${FILESDIR}"/10bind.env 10bind
+
+	if ! use static-libs ; then
+		find "${ED}"/usr/lib* -name '*.la' -delete || die
+	fi
+
+	#
+	# /var/bind
+	#
+	# These need to remain for now because CONFIG_PROTECT won't
+	# save them and we shipped configs for years containing references
+	# to them.
+	#
+	# ftp://ftp.rs.internic.net/domain/named.cache:
+	insinto /var/bind
+	newins "${FILESDIR}"/named.cache-r4 named.cache
+	# bug #450406
+	dosym named.cache /var/bind/root.cache
+	#
+	insinto /var/bind/pri
+	newins "${FILESDIR}"/localhost.zone-r3 localhost.zone
+
+	dosym -r /var/bind/pri /etc/bind/pri
+	dosym -r /var/bind/sec /etc/bind/sec
+	dosym -r /var/bind/dyn /etc/bind/dyn
+	keepdir /var/bind/{pri,sec,dyn} /var/log/named
+
+	fowners root:named /{etc,var}/bind /var/log/named /var/bind/{sec,pri,dyn}
+	fowners root:named /etc/bind/{bind.keys,named.conf,named.conf.auth}
+	fperms 0640 /etc/bind/{bind.keys,named.conf,named.conf.auth}
+	fperms 0750 /etc/bind /var/bind/pri
+	fperms 0770 /var/log/named /var/bind/{,sec,dyn}
+
+	systemd_newunit "${FILESDIR}/named.service-r2" named.service
+	dotmpfiles "${FILESDIR}"/named.conf
+	exeinto /usr/libexec
+	doexe "${FILESDIR}/generate-rndc-key.sh"
+}
+
+pkg_postinst() {
+	tmpfiles_process named.conf
+
+	if [[ -z ${ROOT} && ! -f ${EPREFIX}/etc/bind/rndc.key && ! -f ${EPREFIX}/etc/bind/rndc.conf ]]; then
+		einfo "Generating rndc.key"
+		"${EPREFIX}"/usr/sbin/rndc-confgen -a || die
+		chown root:named "${EPREFIX}"/etc/bind/rndc.key || die
+		chmod 0640 "${EPREFIX}"/etc/bind/rndc.key || die
+	fi
+
+	einfo
+	einfo "You can edit /etc/conf.d/named to customize named settings"
+	einfo
+
+	einfo "If you'd like to run bind in a chroot AND this is a new"
+	einfo "install OR your bind doesn't already run in a chroot:"
+	einfo "1) Uncomment and set the CHROOT variable in /etc/conf.d/named."
+	einfo "2) Run \`emerge --config '=${CATEGORY}/${PF}'\`"
+	einfo
+
+	CHROOT=$(source "${EROOT}"/etc/conf.d/named 2>/dev/null; echo ${CHROOT})
+	if [[ -n ${CHROOT} ]]; then
+		elog "NOTE: As of net-dns/bind-9.4.3_p5-r1 the chroot part of the init-script got some major changes!"
+		elog "To enable the old behaviour (without using mount) uncomment the"
+		elog "CHROOT_NOMOUNT option in your /etc/conf.d/named config."
+		elog "If you decide to use the new/default method, ensure to make backup"
+		elog "first and merge your existing configs/zones to /etc/bind and"
+		elog "/var/bind because bind will now mount the needed directories into"
+		elog "the chroot dir."
+	fi
+
+	# show only when upgrading to 9.18
+	if ver_replacing -lt 9.18; then
+		elog "As this is a major bind version upgrade, please read:"
+		elog "   https://kb.isc.org/docs/changes-to-be-aware-of-when-moving-from-bind-916-to-918"
+		elog "for differences in functionality."
+		elog ""
+		ewarn "In particular, please note that bind-9.18 does not need a root hints file anymore"
+		ewarn "and we only ship with one as a stop-gap. If your current configuration specifies a"
+		ewarn "root hints file - usually called named.cache - bind will not start as it will not be able"
+		ewarn "to find the specified file. Best practice is to delete the offending lines that"
+		ewarn "reference named.cache file from your configuration."
+	fi
+}
+
+pkg_config() {
+	CHROOT=$(source "${EROOT}"/etc/conf.d/named; echo ${CHROOT})
+	CHROOT_NOMOUNT=$(source "${EROOT}"/etc/conf.d/named; echo ${CHROOT_NOMOUNT})
+	CHROOT_GEOIP=$(source "${EROOT}"/etc/conf.d/named; echo ${CHROOT_GEOIP})
+
+	if [[ -z "${CHROOT}" ]]; then
+		eerror "This config script is designed to automate setting up"
+		eerror "a chrooted bind/named. To do so, please first uncomment"
+		eerror "and set the CHROOT variable in '/etc/conf.d/named'."
+		die "Unset CHROOT"
+	fi
+
+	if [[ -d "${CHROOT}" ]]; then
+		ewarn "NOTE: As of net-dns/bind-9.4.3_p5-r1 the chroot part of the init-script got some major changes!"
+		ewarn "To enable the old behaviour (without using mount) uncomment the"
+		ewarn "CHROOT_NOMOUNT option in your /etc/conf.d/named config."
+		ewarn
+		ewarn "${CHROOT} already exists... some things might become overridden"
+		ewarn "press CTRL+C if you don't want to continue"
+		sleep 10
+	fi
+
+	echo; einfo "Setting up the chroot directory..."
+
+	mkdir -m 0750 -p "${CHROOT}" || die
+	mkdir -m 0755 -p "${CHROOT}"/{dev,etc,var/log,run} || die
+	mkdir -m 0750 -p "${CHROOT}"/etc/bind || die
+	mkdir -m 0770 -p "${CHROOT}"/var/{bind,log/named} "${CHROOT}"/run/named/ || die
+
+	chown root:named \
+		"${CHROOT}" \
+		"${CHROOT}"/var/{bind,log/named} \
+		"${CHROOT}"/run/named/ \
+		"${CHROOT}"/etc/bind \
+		|| die
+
+	mknod "${CHROOT}"/dev/null c 1 3 || die
+	chmod 0666 "${CHROOT}"/dev/null || die
+
+	mknod "${CHROOT}"/dev/zero c 1 5 || die
+	chmod 0666 "${CHROOT}"/dev/zero || die
+
+	if [[ "${CHROOT_NOMOUNT:-0}" -ne 0 ]]; then
+		cp -a /etc/bind "${CHROOT}"/etc/ || die
+		cp -a /var/bind "${CHROOT}"/var/ || die
+	fi
+
+	if [[ "${CHROOT_GEOIP:-0}" -eq 1 ]]; then
+		if use geoip; then
+			mkdir -m 0755 -p "${CHROOT}"/usr/share/GeoIP || die
+		elif use geoip2; then
+			mkdir -m 0755 -p "${CHROOT}"/usr/share/GeoIP2 || die
+		fi
+	fi
+
+	elog "You may need to add the following line to your syslog-ng.conf:"
+	elog "source jail { unix-stream(\"${CHROOT}/dev/log\"); };"
+}
diff --git a/net-dns/bind/bind-9.18.39.ebuild b/net-dns/bind/bind-9.18.39.ebuild
new file mode 100644
index 000000000000..c2419bdebd5c
--- /dev/null
+++ b/net-dns/bind/bind-9.18.39.ebuild
@@ -0,0 +1,282 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit eapi9-ver systemd tmpfiles toolchain-funcs
+
+MY_PV="${PV/_p/-P}"
+MY_PV="${MY_PV/_rc/rc}"
+
+DESCRIPTION="Berkeley Internet Name Domain - Name Server"
+HOMEPAGE="https://www.isc.org/software/bind"
+SRC_URI="https://downloads.isc.org/isc/bind9/${PV}/${P}.tar.xz"
+S="${WORKDIR}/${PN}-${MY_PV}"
+
+LICENSE="MPL-2.0"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+IUSE="+caps dnstap doc doh fixed-rrset idn jemalloc geoip gssapi lmdb selinux static-libs test xml"
+RESTRICT="!test? ( test )"
+
+DEPEND="
+	acct-group/named
+	acct-user/named
+	dev-libs/json-c:=
+	>=dev-libs/libuv-1.37.0:=
+	virtual/zlib:=
+	dev-libs/openssl:=[-bindist(-)]
+	caps? ( >=sys-libs/libcap-2.1.0 )
+	dnstap? (
+		dev-libs/fstrm
+		dev-libs/protobuf-c
+	)
+	doh? ( net-libs/nghttp2:= )
+	geoip? ( dev-libs/libmaxminddb )
+	gssapi? ( virtual/krb5 )
+	idn? ( net-dns/libidn2 )
+	jemalloc? ( dev-libs/jemalloc:= )
+	lmdb? ( dev-db/lmdb )
+	xml? ( dev-libs/libxml2:= )
+"
+RDEPEND="
+	${DEPEND}
+	selinux? ( sec-policy/selinux-bind )
+	sys-process/psmisc
+	!<net-dns/bind-tools-9.18.0
+"
+# sphinx required for man-page and html creation
+BDEPEND="
+	dev-lang/perl
+	virtual/pkgconfig
+	doc? ( dev-python/sphinx )
+	test? (
+		dev-util/cmocka
+	)
+"
+
+src_prepare() {
+	default
+
+	# Don't clobber our toolchain defaults
+	sed -i -e '/FORTIFY_SOURCE=/d' configure || die
+
+	# Test is (notoriously) slow/resource intensive
+	sed -i -e 's:ISC_TEST_MAIN:int main(void) { exit(77); }:' tests/isc/netmgr_test.c || die
+
+	# Relies on -Wl,--wrap (bug #877741)
+	if tc-is-lto ; then
+		sed -i -e 's:ISC_TEST_MAIN:int main(void) { exit(77); }:' tests/ns/query_test.c || die
+	fi
+}
+
+src_configure() {
+	# configure automagically uses sphinx even if prebuilt man pages
+	# are available. Force fallback to prebuilt ones.
+	use doc || export ac_cv_path_SPHINX_BUILD= SPHINX_BUILD=
+
+	local myeconfargs=(
+		--prefix="${EPREFIX}"/usr
+		--sysconfdir="${EPREFIX}"/etc/bind
+		--localstatedir="${EPREFIX}"/var
+		--enable-full-report
+		--without-readline
+		--with-openssl="${ESYSROOT}"/usr
+		--with-json-c
+		--with-zlib
+		$(use_enable caps linux-caps)
+		--disable-dnsrps
+		$(use_enable dnstap)
+		$(use_enable doh)
+		$(use_with doh libnghttp2)
+		$(use_enable fixed-rrset)
+		$(use_enable static-libs static)
+		$(use_enable geoip)
+		$(use_with test cmocka)
+		$(use_with geoip maxminddb)
+		$(use_with gssapi)
+		$(use_with idn libidn2)
+		$(use_with jemalloc)
+		$(use_with lmdb)
+		$(use_with xml libxml2)
+	)
+
+	econf "${myeconfargs[@]}"
+}
+
+src_test() {
+	# system tests ('emake test') require network configuration for IPs etc
+	# so we run the unit tests instead.
+	CI=1 emake unit V=1
+
+	# libtest is an internal test helper library, it has no tests,
+	# so suppress the QA warning.
+	rm tests/libtest/test-suite.log || die
+}
+
+src_install() {
+	default
+
+	if use doc; then
+		docinto misc
+		dodoc -r doc/misc/
+
+		docinto html
+		dodoc -r doc/arm/
+
+		docinto dnssec-guide
+		dodoc -r doc/dnssec-guide/
+
+		docinto contrib
+		dodoc contrib/scripts/nanny.pl
+	fi
+
+	insinto /etc/bind
+	newins "${FILESDIR}"/named.conf-r9 named.conf
+	newins "${FILESDIR}"/named.conf.auth named.conf.auth
+
+	newinitd "${FILESDIR}"/named.init-r15 named
+	newconfd "${FILESDIR}"/named.confd-r8 named
+
+	newenvd "${FILESDIR}"/10bind.env 10bind
+
+	if ! use static-libs ; then
+		find "${ED}"/usr/lib* -name '*.la' -delete || die
+	fi
+
+	#
+	# /var/bind
+	#
+	# These need to remain for now because CONFIG_PROTECT won't
+	# save them and we shipped configs for years containing references
+	# to them.
+	#
+	# ftp://ftp.rs.internic.net/domain/named.cache:
+	insinto /var/bind
+	newins "${FILESDIR}"/named.cache-r4 named.cache
+	# bug #450406
+	dosym named.cache /var/bind/root.cache
+	#
+	insinto /var/bind/pri
+	newins "${FILESDIR}"/localhost.zone-r3 localhost.zone
+
+	dosym -r /var/bind/pri /etc/bind/pri
+	dosym -r /var/bind/sec /etc/bind/sec
+	dosym -r /var/bind/dyn /etc/bind/dyn
+	keepdir /var/bind/{pri,sec,dyn} /var/log/named
+
+	fowners root:named /{etc,var}/bind /var/log/named /var/bind/{sec,pri,dyn}
+	fowners root:named /etc/bind/{bind.keys,named.conf,named.conf.auth}
+	fperms 0640 /etc/bind/{bind.keys,named.conf,named.conf.auth}
+	fperms 0750 /etc/bind /var/bind/pri
+	fperms 0770 /var/log/named /var/bind/{,sec,dyn}
+
+	systemd_newunit "${FILESDIR}/named.service-r2" named.service
+	dotmpfiles "${FILESDIR}"/named.conf
+	exeinto /usr/libexec
+	doexe "${FILESDIR}/generate-rndc-key.sh"
+}
+
+pkg_postinst() {
+	tmpfiles_process named.conf
+
+	if [[ -z ${ROOT} && ! -f ${EPREFIX}/etc/bind/rndc.key && ! -f ${EPREFIX}/etc/bind/rndc.conf ]]; then
+		einfo "Generating rndc.key"
+		"${EPREFIX}"/usr/sbin/rndc-confgen -a || die
+		chown root:named "${EPREFIX}"/etc/bind/rndc.key || die
+		chmod 0640 "${EPREFIX}"/etc/bind/rndc.key || die
+	fi
+
+	einfo
+	einfo "You can edit /etc/conf.d/named to customize named settings"
+	einfo
+
+	einfo "If you'd like to run bind in a chroot AND this is a new"
+	einfo "install OR your bind doesn't already run in a chroot:"
+	einfo "1) Uncomment and set the CHROOT variable in /etc/conf.d/named."
+	einfo "2) Run \`emerge --config '=${CATEGORY}/${PF}'\`"
+	einfo
+
+	CHROOT=$(source "${EROOT}"/etc/conf.d/named 2>/dev/null; echo ${CHROOT})
+	if [[ -n ${CHROOT} ]]; then
+		elog "NOTE: As of net-dns/bind-9.4.3_p5-r1 the chroot part of the init-script got some major changes!"
+		elog "To enable the old behaviour (without using mount) uncomment the"
+		elog "CHROOT_NOMOUNT option in your /etc/conf.d/named config."
+		elog "If you decide to use the new/default method, ensure to make backup"
+		elog "first and merge your existing configs/zones to /etc/bind and"
+		elog "/var/bind because bind will now mount the needed directories into"
+		elog "the chroot dir."
+	fi
+
+	# show only when upgrading to 9.18
+	if ver_replacing -lt 9.18; then
+		elog "As this is a major bind version upgrade, please read:"
+		elog "   https://kb.isc.org/docs/changes-to-be-aware-of-when-moving-from-bind-916-to-918"
+		elog "for differences in functionality."
+		elog ""
+		ewarn "In particular, please note that bind-9.18 does not need a root hints file anymore"
+		ewarn "and we only ship with one as a stop-gap. If your current configuration specifies a"
+		ewarn "root hints file - usually called named.cache - bind will not start as it will not be able"
+		ewarn "to find the specified file. Best practice is to delete the offending lines that"
+		ewarn "reference named.cache file from your configuration."
+	fi
+}
+
+pkg_config() {
+	CHROOT=$(source "${EROOT}"/etc/conf.d/named; echo ${CHROOT})
+	CHROOT_NOMOUNT=$(source "${EROOT}"/etc/conf.d/named; echo ${CHROOT_NOMOUNT})
+	CHROOT_GEOIP=$(source "${EROOT}"/etc/conf.d/named; echo ${CHROOT_GEOIP})
+
+	if [[ -z "${CHROOT}" ]]; then
+		eerror "This config script is designed to automate setting up"
+		eerror "a chrooted bind/named. To do so, please first uncomment"
+		eerror "and set the CHROOT variable in '/etc/conf.d/named'."
+		die "Unset CHROOT"
+	fi
+
+	if [[ -d "${CHROOT}" ]]; then
+		ewarn "NOTE: As of net-dns/bind-9.4.3_p5-r1 the chroot part of the init-script got some major changes!"
+		ewarn "To enable the old behaviour (without using mount) uncomment the"
+		ewarn "CHROOT_NOMOUNT option in your /etc/conf.d/named config."
+		ewarn
+		ewarn "${CHROOT} already exists... some things might become overridden"
+		ewarn "press CTRL+C if you don't want to continue"
+		sleep 10
+	fi
+
+	echo; einfo "Setting up the chroot directory..."
+
+	mkdir -m 0750 -p "${CHROOT}" || die
+	mkdir -m 0755 -p "${CHROOT}"/{dev,etc,var/log,run} || die
+	mkdir -m 0750 -p "${CHROOT}"/etc/bind || die
+	mkdir -m 0770 -p "${CHROOT}"/var/{bind,log/named} "${CHROOT}"/run/named/ || die
+
+	chown root:named \
+		"${CHROOT}" \
+		"${CHROOT}"/var/{bind,log/named} \
+		"${CHROOT}"/run/named/ \
+		"${CHROOT}"/etc/bind \
+		|| die
+
+	mknod "${CHROOT}"/dev/null c 1 3 || die
+	chmod 0666 "${CHROOT}"/dev/null || die
+
+	mknod "${CHROOT}"/dev/zero c 1 5 || die
+	chmod 0666 "${CHROOT}"/dev/zero || die
+
+	if [[ "${CHROOT_NOMOUNT:-0}" -ne 0 ]]; then
+		cp -a /etc/bind "${CHROOT}"/etc/ || die
+		cp -a /var/bind "${CHROOT}"/var/ || die
+	fi
+
+	if [[ "${CHROOT_GEOIP:-0}" -eq 1 ]]; then
+		if use geoip; then
+			mkdir -m 0755 -p "${CHROOT}"/usr/share/GeoIP || die
+		elif use geoip2; then
+			mkdir -m 0755 -p "${CHROOT}"/usr/share/GeoIP2 || die
+		fi
+	fi
+
+	elog "You may need to add the following line to your syslog-ng.conf:"
+	elog "source jail { unix-stream(\"${CHROOT}/dev/log\"); };"
+}
diff --git a/net-dns/bind/bind-9.18.42.ebuild b/net-dns/bind/bind-9.18.42.ebuild
new file mode 100644
index 000000000000..47d73b450a8b
--- /dev/null
+++ b/net-dns/bind/bind-9.18.42.ebuild
@@ -0,0 +1,282 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit eapi9-ver systemd tmpfiles toolchain-funcs
+
+MY_PV="${PV/_p/-P}"
+MY_PV="${MY_PV/_rc/rc}"
+
+DESCRIPTION="Berkeley Internet Name Domain - Name Server"
+HOMEPAGE="https://www.isc.org/software/bind"
+SRC_URI="https://downloads.isc.org/isc/bind9/${PV}/${P}.tar.xz"
+S="${WORKDIR}/${PN}-${MY_PV}"
+
+LICENSE="MPL-2.0"
+SLOT="0"
+KEYWORDS="~alpha amd64 ~arm arm64 ~hppa ~loong ~mips ppc ppc64 ~riscv ~s390 ~sparc x86"
+IUSE="+caps dnstap doc doh fixed-rrset idn jemalloc geoip gssapi lmdb selinux static-libs test xml"
+RESTRICT="!test? ( test )"
+
+DEPEND="
+	acct-group/named
+	acct-user/named
+	dev-libs/json-c:=
+	>=dev-libs/libuv-1.37.0:=
+	virtual/zlib:=
+	dev-libs/openssl:=[-bindist(-)]
+	caps? ( >=sys-libs/libcap-2.1.0 )
+	dnstap? (
+		dev-libs/fstrm
+		dev-libs/protobuf-c
+	)
+	doh? ( net-libs/nghttp2:= )
+	geoip? ( dev-libs/libmaxminddb )
+	gssapi? ( virtual/krb5 )
+	idn? ( net-dns/libidn2 )
+	jemalloc? ( dev-libs/jemalloc:= )
+	lmdb? ( dev-db/lmdb )
+	xml? ( dev-libs/libxml2:= )
+"
+RDEPEND="
+	${DEPEND}
+	selinux? ( sec-policy/selinux-bind )
+	sys-process/psmisc
+	!<net-dns/bind-tools-9.18.0
+"
+# sphinx required for man-page and html creation
+BDEPEND="
+	dev-lang/perl
+	virtual/pkgconfig
+	doc? ( dev-python/sphinx )
+	test? (
+		dev-util/cmocka
+	)
+"
+
+src_prepare() {
+	default
+
+	# Don't clobber our toolchain defaults
+	sed -i -e '/FORTIFY_SOURCE=/d' configure || die
+
+	# Test is (notoriously) slow/resource intensive
+	sed -i -e 's:ISC_TEST_MAIN:int main(void) { exit(77); }:' tests/isc/netmgr_test.c || die
+
+	# Relies on -Wl,--wrap (bug #877741)
+	if tc-is-lto ; then
+		sed -i -e 's:ISC_TEST_MAIN:int main(void) { exit(77); }:' tests/ns/query_test.c || die
+	fi
+}
+
+src_configure() {
+	# configure automagically uses sphinx even if prebuilt man pages
+	# are available. Force fallback to prebuilt ones.
+	use doc || export ac_cv_path_SPHINX_BUILD= SPHINX_BUILD=
+
+	local myeconfargs=(
+		--prefix="${EPREFIX}"/usr
+		--sysconfdir="${EPREFIX}"/etc/bind
+		--localstatedir="${EPREFIX}"/var
+		--enable-full-report
+		--without-readline
+		--with-openssl="${ESYSROOT}"/usr
+		--with-json-c
+		--with-zlib
+		$(use_enable caps linux-caps)
+		--disable-dnsrps
+		$(use_enable dnstap)
+		$(use_enable doh)
+		$(use_with doh libnghttp2)
+		$(use_enable fixed-rrset)
+		$(use_enable static-libs static)
+		$(use_enable geoip)
+		$(use_with test cmocka)
+		$(use_with geoip maxminddb)
+		$(use_with gssapi)
+		$(use_with idn libidn2)
+		$(use_with jemalloc)
+		$(use_with lmdb)
+		$(use_with xml libxml2)
+	)
+
+	econf "${myeconfargs[@]}"
+}
+
+src_test() {
+	# system tests ('emake test') require network configuration for IPs etc
+	# so we run the unit tests instead.
+	CI=1 emake unit V=1
+
+	# libtest is an internal test helper library, it has no tests,
+	# so suppress the QA warning.
+	rm tests/libtest/test-suite.log || die
+}
+
+src_install() {
+	default
+
+	if use doc; then
+		docinto misc
+		dodoc -r doc/misc/
+
+		docinto html
+		dodoc -r doc/arm/
+
+		docinto dnssec-guide
+		dodoc -r doc/dnssec-guide/
+
+		docinto contrib
+		dodoc contrib/scripts/nanny.pl
+	fi
+
+	insinto /etc/bind
+	newins "${FILESDIR}"/named.conf-r9 named.conf
+	newins "${FILESDIR}"/named.conf.auth named.conf.auth
+
+	newinitd "${FILESDIR}"/named.init-r15 named
+	newconfd "${FILESDIR}"/named.confd-r8 named
+
+	newenvd "${FILESDIR}"/10bind.env 10bind
+
+	if ! use static-libs ; then
+		find "${ED}"/usr/lib* -name '*.la' -delete || die
+	fi
+
+	#
+	# /var/bind
+	#
+	# These need to remain for now because CONFIG_PROTECT won't
+	# save them and we shipped configs for years containing references
+	# to them.
+	#
+	# ftp://ftp.rs.internic.net/domain/named.cache:
+	insinto /var/bind
+	newins "${FILESDIR}"/named.cache-r4 named.cache
+	# bug #450406
+	dosym named.cache /var/bind/root.cache
+	#
+	insinto /var/bind/pri
+	newins "${FILESDIR}"/localhost.zone-r3 localhost.zone
+
+	dosym -r /var/bind/pri /etc/bind/pri
+	dosym -r /var/bind/sec /etc/bind/sec
+	dosym -r /var/bind/dyn /etc/bind/dyn
+	keepdir /var/bind/{pri,sec,dyn} /var/log/named
+
+	fowners root:named /{etc,var}/bind /var/log/named /var/bind/{sec,pri,dyn}
+	fowners root:named /etc/bind/{bind.keys,named.conf,named.conf.auth}
+	fperms 0640 /etc/bind/{bind.keys,named.conf,named.conf.auth}
+	fperms 0750 /etc/bind /var/bind/pri
+	fperms 0770 /var/log/named /var/bind/{,sec,dyn}
+
+	systemd_newunit "${FILESDIR}/named.service-r2" named.service
+	dotmpfiles "${FILESDIR}"/named.conf
+	exeinto /usr/libexec
+	doexe "${FILESDIR}/generate-rndc-key.sh"
+}
+
+pkg_postinst() {
+	tmpfiles_process named.conf
+
+	if [[ -z ${ROOT} && ! -f ${EPREFIX}/etc/bind/rndc.key && ! -f ${EPREFIX}/etc/bind/rndc.conf ]]; then
+		einfo "Generating rndc.key"
+		"${EPREFIX}"/usr/sbin/rndc-confgen -a || die
+		chown root:named "${EPREFIX}"/etc/bind/rndc.key || die
+		chmod 0640 "${EPREFIX}"/etc/bind/rndc.key || die
+	fi
+
+	einfo
+	einfo "You can edit /etc/conf.d/named to customize named settings"
+	einfo
+
+	einfo "If you'd like to run bind in a chroot AND this is a new"
+	einfo "install OR your bind doesn't already run in a chroot:"
+	einfo "1) Uncomment and set the CHROOT variable in /etc/conf.d/named."
+	einfo "2) Run \`emerge --config '=${CATEGORY}/${PF}'\`"
+	einfo
+
+	CHROOT=$(source "${EROOT}"/etc/conf.d/named 2>/dev/null; echo ${CHROOT})
+	if [[ -n ${CHROOT} ]]; then
+		elog "NOTE: As of net-dns/bind-9.4.3_p5-r1 the chroot part of the init-script got some major changes!"
+		elog "To enable the old behaviour (without using mount) uncomment the"
+		elog "CHROOT_NOMOUNT option in your /etc/conf.d/named config."
+		elog "If you decide to use the new/default method, ensure to make backup"
+		elog "first and merge your existing configs/zones to /etc/bind and"
+		elog "/var/bind because bind will now mount the needed directories into"
+		elog "the chroot dir."
+	fi
+
+	# show only when upgrading to 9.18
+	if ver_replacing -lt 9.18; then
+		elog "As this is a major bind version upgrade, please read:"
+		elog "   https://kb.isc.org/docs/changes-to-be-aware-of-when-moving-from-bind-916-to-918"
+		elog "for differences in functionality."
+		elog ""
+		ewarn "In particular, please note that bind-9.18 does not need a root hints file anymore"
+		ewarn "and we only ship with one as a stop-gap. If your current configuration specifies a"
+		ewarn "root hints file - usually called named.cache - bind will not start as it will not be able"
+		ewarn "to find the specified file. Best practice is to delete the offending lines that"
+		ewarn "reference named.cache file from your configuration."
+	fi
+}
+
+pkg_config() {
+	CHROOT=$(source "${EROOT}"/etc/conf.d/named; echo ${CHROOT})
+	CHROOT_NOMOUNT=$(source "${EROOT}"/etc/conf.d/named; echo ${CHROOT_NOMOUNT})
+	CHROOT_GEOIP=$(source "${EROOT}"/etc/conf.d/named; echo ${CHROOT_GEOIP})
+
+	if [[ -z "${CHROOT}" ]]; then
+		eerror "This config script is designed to automate setting up"
+		eerror "a chrooted bind/named. To do so, please first uncomment"
+		eerror "and set the CHROOT variable in '/etc/conf.d/named'."
+		die "Unset CHROOT"
+	fi
+
+	if [[ -d "${CHROOT}" ]]; then
+		ewarn "NOTE: As of net-dns/bind-9.4.3_p5-r1 the chroot part of the init-script got some major changes!"
+		ewarn "To enable the old behaviour (without using mount) uncomment the"
+		ewarn "CHROOT_NOMOUNT option in your /etc/conf.d/named config."
+		ewarn
+		ewarn "${CHROOT} already exists... some things might become overridden"
+		ewarn "press CTRL+C if you don't want to continue"
+		sleep 10
+	fi
+
+	echo; einfo "Setting up the chroot directory..."
+
+	mkdir -m 0750 -p "${CHROOT}" || die
+	mkdir -m 0755 -p "${CHROOT}"/{dev,etc,var/log,run} || die
+	mkdir -m 0750 -p "${CHROOT}"/etc/bind || die
+	mkdir -m 0770 -p "${CHROOT}"/var/{bind,log/named} "${CHROOT}"/run/named/ || die
+
+	chown root:named \
+		"${CHROOT}" \
+		"${CHROOT}"/var/{bind,log/named} \
+		"${CHROOT}"/run/named/ \
+		"${CHROOT}"/etc/bind \
+		|| die
+
+	mknod "${CHROOT}"/dev/null c 1 3 || die
+	chmod 0666 "${CHROOT}"/dev/null || die
+
+	mknod "${CHROOT}"/dev/zero c 1 5 || die
+	chmod 0666 "${CHROOT}"/dev/zero || die
+
+	if [[ "${CHROOT_NOMOUNT:-0}" -ne 0 ]]; then
+		cp -a /etc/bind "${CHROOT}"/etc/ || die
+		cp -a /var/bind "${CHROOT}"/var/ || die
+	fi
+
+	if [[ "${CHROOT_GEOIP:-0}" -eq 1 ]]; then
+		if use geoip; then
+			mkdir -m 0755 -p "${CHROOT}"/usr/share/GeoIP || die
+		elif use geoip2; then
+			mkdir -m 0755 -p "${CHROOT}"/usr/share/GeoIP2 || die
+		fi
+	fi
+
+	elog "You may need to add the following line to your syslog-ng.conf:"
+	elog "source jail { unix-stream(\"${CHROOT}/dev/log\"); };"
+}
diff --git a/net-dns/bind/bind-9.18.47.ebuild b/net-dns/bind/bind-9.18.47.ebuild
new file mode 100644
index 000000000000..e97d59489c5d
--- /dev/null
+++ b/net-dns/bind/bind-9.18.47.ebuild
@@ -0,0 +1,282 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit eapi9-ver systemd tmpfiles toolchain-funcs
+
+MY_PV="${PV/_p/-P}"
+MY_PV="${MY_PV/_rc/rc}"
+
+DESCRIPTION="Berkeley Internet Name Domain - Name Server"
+HOMEPAGE="https://www.isc.org/software/bind"
+SRC_URI="https://downloads.isc.org/isc/bind9/${PV}/${P}.tar.xz"
+S="${WORKDIR}/${PN}-${MY_PV}"
+
+LICENSE="MPL-2.0"
+SLOT="0"
+KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~loong ~mips ppc ppc64 ~riscv ~s390 ~sparc x86"
+IUSE="+caps dnstap doc doh fixed-rrset idn jemalloc geoip gssapi lmdb selinux static-libs test xml"
+RESTRICT="!test? ( test )"
+
+DEPEND="
+	acct-group/named
+	acct-user/named
+	dev-libs/json-c:=
+	>=dev-libs/libuv-1.37.0:=
+	virtual/zlib:=
+	dev-libs/openssl:=[-bindist(-)]
+	caps? ( >=sys-libs/libcap-2.1.0 )
+	dnstap? (
+		dev-libs/fstrm
+		dev-libs/protobuf-c
+	)
+	doh? ( net-libs/nghttp2:= )
+	geoip? ( dev-libs/libmaxminddb )
+	gssapi? ( virtual/krb5 )
+	idn? ( net-dns/libidn2 )
+	jemalloc? ( dev-libs/jemalloc:= )
+	lmdb? ( dev-db/lmdb )
+	xml? ( dev-libs/libxml2:= )
+"
+RDEPEND="
+	${DEPEND}
+	selinux? ( sec-policy/selinux-bind )
+	sys-process/psmisc
+	!<net-dns/bind-tools-9.18.0
+"
+# sphinx required for man-page and html creation
+BDEPEND="
+	dev-lang/perl
+	virtual/pkgconfig
+	doc? ( dev-python/sphinx )
+	test? (
+		dev-util/cmocka
+	)
+"
+
+src_prepare() {
+	default
+
+	# Don't clobber our toolchain defaults
+	sed -i -e '/FORTIFY_SOURCE=/d' configure || die
+
+	# Test is (notoriously) slow/resource intensive
+	sed -i -e 's:ISC_TEST_MAIN:int main(void) { exit(77); }:' tests/isc/netmgr_test.c || die
+
+	# Relies on -Wl,--wrap (bug #877741)
+	if tc-is-lto ; then
+		sed -i -e 's:ISC_TEST_MAIN:int main(void) { exit(77); }:' tests/ns/query_test.c || die
+	fi
+}
+
+src_configure() {
+	# configure automagically uses sphinx even if prebuilt man pages
+	# are available. Force fallback to prebuilt ones.
+	use doc || export ac_cv_path_SPHINX_BUILD= SPHINX_BUILD=
+
+	local myeconfargs=(
+		--prefix="${EPREFIX}"/usr
+		--sysconfdir="${EPREFIX}"/etc/bind
+		--localstatedir="${EPREFIX}"/var
+		--enable-full-report
+		--without-readline
+		--with-openssl="${ESYSROOT}"/usr
+		--with-json-c
+		--with-zlib
+		$(use_enable caps linux-caps)
+		--disable-dnsrps
+		$(use_enable dnstap)
+		$(use_enable doh)
+		$(use_with doh libnghttp2)
+		$(use_enable fixed-rrset)
+		$(use_enable static-libs static)
+		$(use_enable geoip)
+		$(use_with test cmocka)
+		$(use_with geoip maxminddb)
+		$(use_with gssapi)
+		$(use_with idn libidn2)
+		$(use_with jemalloc)
+		$(use_with lmdb)
+		$(use_with xml libxml2)
+	)
+
+	econf "${myeconfargs[@]}"
+}
+
+src_test() {
+	# system tests ('emake test') require network configuration for IPs etc
+	# so we run the unit tests instead.
+	CI=1 emake unit V=1
+
+	# libtest is an internal test helper library, it has no tests,
+	# so suppress the QA warning.
+	rm tests/libtest/test-suite.log || die
+}
+
+src_install() {
+	default
+
+	if use doc; then
+		docinto misc
+		dodoc -r doc/misc/
+
+		docinto html
+		dodoc -r doc/arm/
+
+		docinto dnssec-guide
+		dodoc -r doc/dnssec-guide/
+
+		docinto contrib
+		dodoc contrib/scripts/nanny.pl
+	fi
+
+	insinto /etc/bind
+	newins "${FILESDIR}"/named.conf-r9 named.conf
+	newins "${FILESDIR}"/named.conf.auth named.conf.auth
+
+	newinitd "${FILESDIR}"/named.init-r15 named
+	newconfd "${FILESDIR}"/named.confd-r8 named
+
+	newenvd "${FILESDIR}"/10bind.env 10bind
+
+	if ! use static-libs ; then
+		find "${ED}"/usr/lib* -name '*.la' -delete || die
+	fi
+
+	#
+	# /var/bind
+	#
+	# These need to remain for now because CONFIG_PROTECT won't
+	# save them and we shipped configs for years containing references
+	# to them.
+	#
+	# ftp://ftp.rs.internic.net/domain/named.cache:
+	insinto /var/bind
+	newins "${FILESDIR}"/named.cache-r4 named.cache
+	# bug #450406
+	dosym named.cache /var/bind/root.cache
+	#
+	insinto /var/bind/pri
+	newins "${FILESDIR}"/localhost.zone-r3 localhost.zone
+
+	dosym -r /var/bind/pri /etc/bind/pri
+	dosym -r /var/bind/sec /etc/bind/sec
+	dosym -r /var/bind/dyn /etc/bind/dyn
+	keepdir /var/bind/{pri,sec,dyn} /var/log/named
+
+	fowners root:named /{etc,var}/bind /var/log/named /var/bind/{sec,pri,dyn}
+	fowners root:named /etc/bind/{bind.keys,named.conf,named.conf.auth}
+	fperms 0640 /etc/bind/{bind.keys,named.conf,named.conf.auth}
+	fperms 0750 /etc/bind /var/bind/pri
+	fperms 0770 /var/log/named /var/bind/{,sec,dyn}
+
+	systemd_newunit "${FILESDIR}/named.service-r2" named.service
+	dotmpfiles "${FILESDIR}"/named.conf
+	exeinto /usr/libexec
+	doexe "${FILESDIR}/generate-rndc-key.sh"
+}
+
+pkg_postinst() {
+	tmpfiles_process named.conf
+
+	if [[ -z ${ROOT} && ! -f ${EPREFIX}/etc/bind/rndc.key && ! -f ${EPREFIX}/etc/bind/rndc.conf ]]; then
+		einfo "Generating rndc.key"
+		"${EPREFIX}"/usr/sbin/rndc-confgen -a || die
+		chown root:named "${EPREFIX}"/etc/bind/rndc.key || die
+		chmod 0640 "${EPREFIX}"/etc/bind/rndc.key || die
+	fi
+
+	einfo
+	einfo "You can edit /etc/conf.d/named to customize named settings"
+	einfo
+
+	einfo "If you'd like to run bind in a chroot AND this is a new"
+	einfo "install OR your bind doesn't already run in a chroot:"
+	einfo "1) Uncomment and set the CHROOT variable in /etc/conf.d/named."
+	einfo "2) Run \`emerge --config '=${CATEGORY}/${PF}'\`"
+	einfo
+
+	CHROOT=$(source "${EROOT}"/etc/conf.d/named 2>/dev/null; echo ${CHROOT})
+	if [[ -n ${CHROOT} ]]; then
+		elog "NOTE: As of net-dns/bind-9.4.3_p5-r1 the chroot part of the init-script got some major changes!"
+		elog "To enable the old behaviour (without using mount) uncomment the"
+		elog "CHROOT_NOMOUNT option in your /etc/conf.d/named config."
+		elog "If you decide to use the new/default method, ensure to make backup"
+		elog "first and merge your existing configs/zones to /etc/bind and"
+		elog "/var/bind because bind will now mount the needed directories into"
+		elog "the chroot dir."
+	fi
+
+	# show only when upgrading to 9.18
+	if ver_replacing -lt 9.18; then
+		elog "As this is a major bind version upgrade, please read:"
+		elog "   https://kb.isc.org/docs/changes-to-be-aware-of-when-moving-from-bind-916-to-918"
+		elog "for differences in functionality."
+		elog ""
+		ewarn "In particular, please note that bind-9.18 does not need a root hints file anymore"
+		ewarn "and we only ship with one as a stop-gap. If your current configuration specifies a"
+		ewarn "root hints file - usually called named.cache - bind will not start as it will not be able"
+		ewarn "to find the specified file. Best practice is to delete the offending lines that"
+		ewarn "reference named.cache file from your configuration."
+	fi
+}
+
+pkg_config() {
+	CHROOT=$(source "${EROOT}"/etc/conf.d/named; echo ${CHROOT})
+	CHROOT_NOMOUNT=$(source "${EROOT}"/etc/conf.d/named; echo ${CHROOT_NOMOUNT})
+	CHROOT_GEOIP=$(source "${EROOT}"/etc/conf.d/named; echo ${CHROOT_GEOIP})
+
+	if [[ -z "${CHROOT}" ]]; then
+		eerror "This config script is designed to automate setting up"
+		eerror "a chrooted bind/named. To do so, please first uncomment"
+		eerror "and set the CHROOT variable in '/etc/conf.d/named'."
+		die "Unset CHROOT"
+	fi
+
+	if [[ -d "${CHROOT}" ]]; then
+		ewarn "NOTE: As of net-dns/bind-9.4.3_p5-r1 the chroot part of the init-script got some major changes!"
+		ewarn "To enable the old behaviour (without using mount) uncomment the"
+		ewarn "CHROOT_NOMOUNT option in your /etc/conf.d/named config."
+		ewarn
+		ewarn "${CHROOT} already exists... some things might become overridden"
+		ewarn "press CTRL+C if you don't want to continue"
+		sleep 10
+	fi
+
+	echo; einfo "Setting up the chroot directory..."
+
+	mkdir -m 0750 -p "${CHROOT}" || die
+	mkdir -m 0755 -p "${CHROOT}"/{dev,etc,var/log,run} || die
+	mkdir -m 0750 -p "${CHROOT}"/etc/bind || die
+	mkdir -m 0770 -p "${CHROOT}"/var/{bind,log/named} "${CHROOT}"/run/named/ || die
+
+	chown root:named \
+		"${CHROOT}" \
+		"${CHROOT}"/var/{bind,log/named} \
+		"${CHROOT}"/run/named/ \
+		"${CHROOT}"/etc/bind \
+		|| die
+
+	mknod "${CHROOT}"/dev/null c 1 3 || die
+	chmod 0666 "${CHROOT}"/dev/null || die
+
+	mknod "${CHROOT}"/dev/zero c 1 5 || die
+	chmod 0666 "${CHROOT}"/dev/zero || die
+
+	if [[ "${CHROOT_NOMOUNT:-0}" -ne 0 ]]; then
+		cp -a /etc/bind "${CHROOT}"/etc/ || die
+		cp -a /var/bind "${CHROOT}"/var/ || die
+	fi
+
+	if [[ "${CHROOT_GEOIP:-0}" -eq 1 ]]; then
+		if use geoip; then
+			mkdir -m 0755 -p "${CHROOT}"/usr/share/GeoIP || die
+		elif use geoip2; then
+			mkdir -m 0755 -p "${CHROOT}"/usr/share/GeoIP2 || die
+		fi
+	fi
+
+	elog "You may need to add the following line to your syslog-ng.conf:"
+	elog "source jail { unix-stream(\"${CHROOT}/dev/log\"); };"
+}
diff --git a/net-dns/bind/bind-9.18.48.ebuild b/net-dns/bind/bind-9.18.48.ebuild
new file mode 100644
index 000000000000..3ee93c1319ee
--- /dev/null
+++ b/net-dns/bind/bind-9.18.48.ebuild
@@ -0,0 +1,282 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit eapi9-ver systemd tmpfiles toolchain-funcs
+
+MY_PV="${PV/_p/-P}"
+MY_PV="${MY_PV/_rc/rc}"
+
+DESCRIPTION="Berkeley Internet Name Domain - Name Server"
+HOMEPAGE="https://www.isc.org/software/bind"
+SRC_URI="https://downloads.isc.org/isc/bind9/${PV}/${P}.tar.xz"
+S="${WORKDIR}/${PN}-${MY_PV}"
+
+LICENSE="MPL-2.0"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+IUSE="+caps dnstap doc doh fixed-rrset idn jemalloc geoip gssapi lmdb selinux static-libs test xml"
+RESTRICT="!test? ( test )"
+
+DEPEND="
+	acct-group/named
+	acct-user/named
+	dev-libs/json-c:=
+	>=dev-libs/libuv-1.37.0:=
+	virtual/zlib:=
+	dev-libs/openssl:=[-bindist(-)]
+	caps? ( >=sys-libs/libcap-2.1.0 )
+	dnstap? (
+		dev-libs/fstrm
+		dev-libs/protobuf-c
+	)
+	doh? ( net-libs/nghttp2:= )
+	geoip? ( dev-libs/libmaxminddb )
+	gssapi? ( virtual/krb5 )
+	idn? ( net-dns/libidn2 )
+	jemalloc? ( dev-libs/jemalloc:= )
+	lmdb? ( dev-db/lmdb )
+	xml? ( dev-libs/libxml2:= )
+"
+RDEPEND="
+	${DEPEND}
+	selinux? ( sec-policy/selinux-bind )
+	sys-process/psmisc
+	!<net-dns/bind-tools-9.18.0
+"
+# sphinx required for man-page and html creation
+BDEPEND="
+	dev-lang/perl
+	virtual/pkgconfig
+	doc? ( dev-python/sphinx )
+	test? (
+		dev-util/cmocka
+	)
+"
+
+src_prepare() {
+	default
+
+	# Don't clobber our toolchain defaults
+	sed -i -e '/FORTIFY_SOURCE=/d' configure || die
+
+	# Test is (notoriously) slow/resource intensive
+	sed -i -e 's:ISC_TEST_MAIN:int main(void) { exit(77); }:' tests/isc/netmgr_test.c || die
+
+	# Relies on -Wl,--wrap (bug #877741)
+	if tc-is-lto ; then
+		sed -i -e 's:ISC_TEST_MAIN:int main(void) { exit(77); }:' tests/ns/query_test.c || die
+	fi
+}
+
+src_configure() {
+	# configure automagically uses sphinx even if prebuilt man pages
+	# are available. Force fallback to prebuilt ones.
+	use doc || export ac_cv_path_SPHINX_BUILD= SPHINX_BUILD=
+
+	local myeconfargs=(
+		--prefix="${EPREFIX}"/usr
+		--sysconfdir="${EPREFIX}"/etc/bind
+		--localstatedir="${EPREFIX}"/var
+		--enable-full-report
+		--without-readline
+		--with-openssl="${ESYSROOT}"/usr
+		--with-json-c
+		--with-zlib
+		$(use_enable caps linux-caps)
+		--disable-dnsrps
+		$(use_enable dnstap)
+		$(use_enable doh)
+		$(use_with doh libnghttp2)
+		$(use_enable fixed-rrset)
+		$(use_enable static-libs static)
+		$(use_enable geoip)
+		$(use_with test cmocka)
+		$(use_with geoip maxminddb)
+		$(use_with gssapi)
+		$(use_with idn libidn2)
+		$(use_with jemalloc)
+		$(use_with lmdb)
+		$(use_with xml libxml2)
+	)
+
+	econf "${myeconfargs[@]}"
+}
+
+src_test() {
+	# system tests ('emake test') require network configuration for IPs etc
+	# so we run the unit tests instead.
+	CI=1 emake unit V=1
+
+	# libtest is an internal test helper library, it has no tests,
+	# so suppress the QA warning.
+	rm tests/libtest/test-suite.log || die
+}
+
+src_install() {
+	default
+
+	if use doc; then
+		docinto misc
+		dodoc -r doc/misc/
+
+		docinto html
+		dodoc -r doc/arm/
+
+		docinto dnssec-guide
+		dodoc -r doc/dnssec-guide/
+
+		docinto contrib
+		dodoc contrib/scripts/nanny.pl
+	fi
+
+	insinto /etc/bind
+	newins "${FILESDIR}"/named.conf-r9 named.conf
+	newins "${FILESDIR}"/named.conf.auth named.conf.auth
+
+	newinitd "${FILESDIR}"/named.init-r15 named
+	newconfd "${FILESDIR}"/named.confd-r8 named
+
+	newenvd "${FILESDIR}"/10bind.env 10bind
+
+	if ! use static-libs ; then
+		find "${ED}"/usr/lib* -name '*.la' -delete || die
+	fi
+
+	#
+	# /var/bind
+	#
+	# These need to remain for now because CONFIG_PROTECT won't
+	# save them and we shipped configs for years containing references
+	# to them.
+	#
+	# ftp://ftp.rs.internic.net/domain/named.cache:
+	insinto /var/bind
+	newins "${FILESDIR}"/named.cache-r4 named.cache
+	# bug #450406
+	dosym named.cache /var/bind/root.cache
+	#
+	insinto /var/bind/pri
+	newins "${FILESDIR}"/localhost.zone-r3 localhost.zone
+
+	dosym -r /var/bind/pri /etc/bind/pri
+	dosym -r /var/bind/sec /etc/bind/sec
+	dosym -r /var/bind/dyn /etc/bind/dyn
+	keepdir /var/bind/{pri,sec,dyn} /var/log/named
+
+	fowners root:named /{etc,var}/bind /var/log/named /var/bind/{sec,pri,dyn}
+	fowners root:named /etc/bind/{bind.keys,named.conf,named.conf.auth}
+	fperms 0640 /etc/bind/{bind.keys,named.conf,named.conf.auth}
+	fperms 0750 /etc/bind /var/bind/pri
+	fperms 0770 /var/log/named /var/bind/{,sec,dyn}
+
+	systemd_newunit "${FILESDIR}/named.service-r2" named.service
+	dotmpfiles "${FILESDIR}"/named.conf
+	exeinto /usr/libexec
+	doexe "${FILESDIR}/generate-rndc-key.sh"
+}
+
+pkg_postinst() {
+	tmpfiles_process named.conf
+
+	if [[ -z ${ROOT} && ! -f ${EPREFIX}/etc/bind/rndc.key && ! -f ${EPREFIX}/etc/bind/rndc.conf ]]; then
+		einfo "Generating rndc.key"
+		"${EPREFIX}"/usr/sbin/rndc-confgen -a || die
+		chown root:named "${EPREFIX}"/etc/bind/rndc.key || die
+		chmod 0640 "${EPREFIX}"/etc/bind/rndc.key || die
+	fi
+
+	einfo
+	einfo "You can edit /etc/conf.d/named to customize named settings"
+	einfo
+
+	einfo "If you'd like to run bind in a chroot AND this is a new"
+	einfo "install OR your bind doesn't already run in a chroot:"
+	einfo "1) Uncomment and set the CHROOT variable in /etc/conf.d/named."
+	einfo "2) Run \`emerge --config '=${CATEGORY}/${PF}'\`"
+	einfo
+
+	CHROOT=$(source "${EROOT}"/etc/conf.d/named 2>/dev/null; echo ${CHROOT})
+	if [[ -n ${CHROOT} ]]; then
+		elog "NOTE: As of net-dns/bind-9.4.3_p5-r1 the chroot part of the init-script got some major changes!"
+		elog "To enable the old behaviour (without using mount) uncomment the"
+		elog "CHROOT_NOMOUNT option in your /etc/conf.d/named config."
+		elog "If you decide to use the new/default method, ensure to make backup"
+		elog "first and merge your existing configs/zones to /etc/bind and"
+		elog "/var/bind because bind will now mount the needed directories into"
+		elog "the chroot dir."
+	fi
+
+	# show only when upgrading to 9.18
+	if ver_replacing -lt 9.18; then
+		elog "As this is a major bind version upgrade, please read:"
+		elog "   https://kb.isc.org/docs/changes-to-be-aware-of-when-moving-from-bind-916-to-918"
+		elog "for differences in functionality."
+		elog ""
+		ewarn "In particular, please note that bind-9.18 does not need a root hints file anymore"
+		ewarn "and we only ship with one as a stop-gap. If your current configuration specifies a"
+		ewarn "root hints file - usually called named.cache - bind will not start as it will not be able"
+		ewarn "to find the specified file. Best practice is to delete the offending lines that"
+		ewarn "reference named.cache file from your configuration."
+	fi
+}
+
+pkg_config() {
+	CHROOT=$(source "${EROOT}"/etc/conf.d/named; echo ${CHROOT})
+	CHROOT_NOMOUNT=$(source "${EROOT}"/etc/conf.d/named; echo ${CHROOT_NOMOUNT})
+	CHROOT_GEOIP=$(source "${EROOT}"/etc/conf.d/named; echo ${CHROOT_GEOIP})
+
+	if [[ -z "${CHROOT}" ]]; then
+		eerror "This config script is designed to automate setting up"
+		eerror "a chrooted bind/named. To do so, please first uncomment"
+		eerror "and set the CHROOT variable in '/etc/conf.d/named'."
+		die "Unset CHROOT"
+	fi
+
+	if [[ -d "${CHROOT}" ]]; then
+		ewarn "NOTE: As of net-dns/bind-9.4.3_p5-r1 the chroot part of the init-script got some major changes!"
+		ewarn "To enable the old behaviour (without using mount) uncomment the"
+		ewarn "CHROOT_NOMOUNT option in your /etc/conf.d/named config."
+		ewarn
+		ewarn "${CHROOT} already exists... some things might become overridden"
+		ewarn "press CTRL+C if you don't want to continue"
+		sleep 10
+	fi
+
+	echo; einfo "Setting up the chroot directory..."
+
+	mkdir -m 0750 -p "${CHROOT}" || die
+	mkdir -m 0755 -p "${CHROOT}"/{dev,etc,var/log,run} || die
+	mkdir -m 0750 -p "${CHROOT}"/etc/bind || die
+	mkdir -m 0770 -p "${CHROOT}"/var/{bind,log/named} "${CHROOT}"/run/named/ || die
+
+	chown root:named \
+		"${CHROOT}" \
+		"${CHROOT}"/var/{bind,log/named} \
+		"${CHROOT}"/run/named/ \
+		"${CHROOT}"/etc/bind \
+		|| die
+
+	mknod "${CHROOT}"/dev/null c 1 3 || die
+	chmod 0666 "${CHROOT}"/dev/null || die
+
+	mknod "${CHROOT}"/dev/zero c 1 5 || die
+	chmod 0666 "${CHROOT}"/dev/zero || die
+
+	if [[ "${CHROOT_NOMOUNT:-0}" -ne 0 ]]; then
+		cp -a /etc/bind "${CHROOT}"/etc/ || die
+		cp -a /var/bind "${CHROOT}"/var/ || die
+	fi
+
+	if [[ "${CHROOT_GEOIP:-0}" -eq 1 ]]; then
+		if use geoip; then
+			mkdir -m 0755 -p "${CHROOT}"/usr/share/GeoIP || die
+		elif use geoip2; then
+			mkdir -m 0755 -p "${CHROOT}"/usr/share/GeoIP2 || die
+		fi
+	fi
+
+	elog "You may need to add the following line to your syslog-ng.conf:"
+	elog "source jail { unix-stream(\"${CHROOT}/dev/log\"); };"
+}
diff --git a/net-dns/bind/bind-9.18.49.ebuild b/net-dns/bind/bind-9.18.49.ebuild
new file mode 100644
index 000000000000..e97d59489c5d
--- /dev/null
+++ b/net-dns/bind/bind-9.18.49.ebuild
@@ -0,0 +1,282 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit eapi9-ver systemd tmpfiles toolchain-funcs
+
+MY_PV="${PV/_p/-P}"
+MY_PV="${MY_PV/_rc/rc}"
+
+DESCRIPTION="Berkeley Internet Name Domain - Name Server"
+HOMEPAGE="https://www.isc.org/software/bind"
+SRC_URI="https://downloads.isc.org/isc/bind9/${PV}/${P}.tar.xz"
+S="${WORKDIR}/${PN}-${MY_PV}"
+
+LICENSE="MPL-2.0"
+SLOT="0"
+KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~loong ~mips ppc ppc64 ~riscv ~s390 ~sparc x86"
+IUSE="+caps dnstap doc doh fixed-rrset idn jemalloc geoip gssapi lmdb selinux static-libs test xml"
+RESTRICT="!test? ( test )"
+
+DEPEND="
+	acct-group/named
+	acct-user/named
+	dev-libs/json-c:=
+	>=dev-libs/libuv-1.37.0:=
+	virtual/zlib:=
+	dev-libs/openssl:=[-bindist(-)]
+	caps? ( >=sys-libs/libcap-2.1.0 )
+	dnstap? (
+		dev-libs/fstrm
+		dev-libs/protobuf-c
+	)
+	doh? ( net-libs/nghttp2:= )
+	geoip? ( dev-libs/libmaxminddb )
+	gssapi? ( virtual/krb5 )
+	idn? ( net-dns/libidn2 )
+	jemalloc? ( dev-libs/jemalloc:= )
+	lmdb? ( dev-db/lmdb )
+	xml? ( dev-libs/libxml2:= )
+"
+RDEPEND="
+	${DEPEND}
+	selinux? ( sec-policy/selinux-bind )
+	sys-process/psmisc
+	!<net-dns/bind-tools-9.18.0
+"
+# sphinx required for man-page and html creation
+BDEPEND="
+	dev-lang/perl
+	virtual/pkgconfig
+	doc? ( dev-python/sphinx )
+	test? (
+		dev-util/cmocka
+	)
+"
+
+src_prepare() {
+	default
+
+	# Don't clobber our toolchain defaults
+	sed -i -e '/FORTIFY_SOURCE=/d' configure || die
+
+	# Test is (notoriously) slow/resource intensive
+	sed -i -e 's:ISC_TEST_MAIN:int main(void) { exit(77); }:' tests/isc/netmgr_test.c || die
+
+	# Relies on -Wl,--wrap (bug #877741)
+	if tc-is-lto ; then
+		sed -i -e 's:ISC_TEST_MAIN:int main(void) { exit(77); }:' tests/ns/query_test.c || die
+	fi
+}
+
+src_configure() {
+	# configure automagically uses sphinx even if prebuilt man pages
+	# are available. Force fallback to prebuilt ones.
+	use doc || export ac_cv_path_SPHINX_BUILD= SPHINX_BUILD=
+
+	local myeconfargs=(
+		--prefix="${EPREFIX}"/usr
+		--sysconfdir="${EPREFIX}"/etc/bind
+		--localstatedir="${EPREFIX}"/var
+		--enable-full-report
+		--without-readline
+		--with-openssl="${ESYSROOT}"/usr
+		--with-json-c
+		--with-zlib
+		$(use_enable caps linux-caps)
+		--disable-dnsrps
+		$(use_enable dnstap)
+		$(use_enable doh)
+		$(use_with doh libnghttp2)
+		$(use_enable fixed-rrset)
+		$(use_enable static-libs static)
+		$(use_enable geoip)
+		$(use_with test cmocka)
+		$(use_with geoip maxminddb)
+		$(use_with gssapi)
+		$(use_with idn libidn2)
+		$(use_with jemalloc)
+		$(use_with lmdb)
+		$(use_with xml libxml2)
+	)
+
+	econf "${myeconfargs[@]}"
+}
+
+src_test() {
+	# system tests ('emake test') require network configuration for IPs etc
+	# so we run the unit tests instead.
+	CI=1 emake unit V=1
+
+	# libtest is an internal test helper library, it has no tests,
+	# so suppress the QA warning.
+	rm tests/libtest/test-suite.log || die
+}
+
+src_install() {
+	default
+
+	if use doc; then
+		docinto misc
+		dodoc -r doc/misc/
+
+		docinto html
+		dodoc -r doc/arm/
+
+		docinto dnssec-guide
+		dodoc -r doc/dnssec-guide/
+
+		docinto contrib
+		dodoc contrib/scripts/nanny.pl
+	fi
+
+	insinto /etc/bind
+	newins "${FILESDIR}"/named.conf-r9 named.conf
+	newins "${FILESDIR}"/named.conf.auth named.conf.auth
+
+	newinitd "${FILESDIR}"/named.init-r15 named
+	newconfd "${FILESDIR}"/named.confd-r8 named
+
+	newenvd "${FILESDIR}"/10bind.env 10bind
+
+	if ! use static-libs ; then
+		find "${ED}"/usr/lib* -name '*.la' -delete || die
+	fi
+
+	#
+	# /var/bind
+	#
+	# These need to remain for now because CONFIG_PROTECT won't
+	# save them and we shipped configs for years containing references
+	# to them.
+	#
+	# ftp://ftp.rs.internic.net/domain/named.cache:
+	insinto /var/bind
+	newins "${FILESDIR}"/named.cache-r4 named.cache
+	# bug #450406
+	dosym named.cache /var/bind/root.cache
+	#
+	insinto /var/bind/pri
+	newins "${FILESDIR}"/localhost.zone-r3 localhost.zone
+
+	dosym -r /var/bind/pri /etc/bind/pri
+	dosym -r /var/bind/sec /etc/bind/sec
+	dosym -r /var/bind/dyn /etc/bind/dyn
+	keepdir /var/bind/{pri,sec,dyn} /var/log/named
+
+	fowners root:named /{etc,var}/bind /var/log/named /var/bind/{sec,pri,dyn}
+	fowners root:named /etc/bind/{bind.keys,named.conf,named.conf.auth}
+	fperms 0640 /etc/bind/{bind.keys,named.conf,named.conf.auth}
+	fperms 0750 /etc/bind /var/bind/pri
+	fperms 0770 /var/log/named /var/bind/{,sec,dyn}
+
+	systemd_newunit "${FILESDIR}/named.service-r2" named.service
+	dotmpfiles "${FILESDIR}"/named.conf
+	exeinto /usr/libexec
+	doexe "${FILESDIR}/generate-rndc-key.sh"
+}
+
+pkg_postinst() {
+	tmpfiles_process named.conf
+
+	if [[ -z ${ROOT} && ! -f ${EPREFIX}/etc/bind/rndc.key && ! -f ${EPREFIX}/etc/bind/rndc.conf ]]; then
+		einfo "Generating rndc.key"
+		"${EPREFIX}"/usr/sbin/rndc-confgen -a || die
+		chown root:named "${EPREFIX}"/etc/bind/rndc.key || die
+		chmod 0640 "${EPREFIX}"/etc/bind/rndc.key || die
+	fi
+
+	einfo
+	einfo "You can edit /etc/conf.d/named to customize named settings"
+	einfo
+
+	einfo "If you'd like to run bind in a chroot AND this is a new"
+	einfo "install OR your bind doesn't already run in a chroot:"
+	einfo "1) Uncomment and set the CHROOT variable in /etc/conf.d/named."
+	einfo "2) Run \`emerge --config '=${CATEGORY}/${PF}'\`"
+	einfo
+
+	CHROOT=$(source "${EROOT}"/etc/conf.d/named 2>/dev/null; echo ${CHROOT})
+	if [[ -n ${CHROOT} ]]; then
+		elog "NOTE: As of net-dns/bind-9.4.3_p5-r1 the chroot part of the init-script got some major changes!"
+		elog "To enable the old behaviour (without using mount) uncomment the"
+		elog "CHROOT_NOMOUNT option in your /etc/conf.d/named config."
+		elog "If you decide to use the new/default method, ensure to make backup"
+		elog "first and merge your existing configs/zones to /etc/bind and"
+		elog "/var/bind because bind will now mount the needed directories into"
+		elog "the chroot dir."
+	fi
+
+	# show only when upgrading to 9.18
+	if ver_replacing -lt 9.18; then
+		elog "As this is a major bind version upgrade, please read:"
+		elog "   https://kb.isc.org/docs/changes-to-be-aware-of-when-moving-from-bind-916-to-918"
+		elog "for differences in functionality."
+		elog ""
+		ewarn "In particular, please note that bind-9.18 does not need a root hints file anymore"
+		ewarn "and we only ship with one as a stop-gap. If your current configuration specifies a"
+		ewarn "root hints file - usually called named.cache - bind will not start as it will not be able"
+		ewarn "to find the specified file. Best practice is to delete the offending lines that"
+		ewarn "reference named.cache file from your configuration."
+	fi
+}
+
+pkg_config() {
+	CHROOT=$(source "${EROOT}"/etc/conf.d/named; echo ${CHROOT})
+	CHROOT_NOMOUNT=$(source "${EROOT}"/etc/conf.d/named; echo ${CHROOT_NOMOUNT})
+	CHROOT_GEOIP=$(source "${EROOT}"/etc/conf.d/named; echo ${CHROOT_GEOIP})
+
+	if [[ -z "${CHROOT}" ]]; then
+		eerror "This config script is designed to automate setting up"
+		eerror "a chrooted bind/named. To do so, please first uncomment"
+		eerror "and set the CHROOT variable in '/etc/conf.d/named'."
+		die "Unset CHROOT"
+	fi
+
+	if [[ -d "${CHROOT}" ]]; then
+		ewarn "NOTE: As of net-dns/bind-9.4.3_p5-r1 the chroot part of the init-script got some major changes!"
+		ewarn "To enable the old behaviour (without using mount) uncomment the"
+		ewarn "CHROOT_NOMOUNT option in your /etc/conf.d/named config."
+		ewarn
+		ewarn "${CHROOT} already exists... some things might become overridden"
+		ewarn "press CTRL+C if you don't want to continue"
+		sleep 10
+	fi
+
+	echo; einfo "Setting up the chroot directory..."
+
+	mkdir -m 0750 -p "${CHROOT}" || die
+	mkdir -m 0755 -p "${CHROOT}"/{dev,etc,var/log,run} || die
+	mkdir -m 0750 -p "${CHROOT}"/etc/bind || die
+	mkdir -m 0770 -p "${CHROOT}"/var/{bind,log/named} "${CHROOT}"/run/named/ || die
+
+	chown root:named \
+		"${CHROOT}" \
+		"${CHROOT}"/var/{bind,log/named} \
+		"${CHROOT}"/run/named/ \
+		"${CHROOT}"/etc/bind \
+		|| die
+
+	mknod "${CHROOT}"/dev/null c 1 3 || die
+	chmod 0666 "${CHROOT}"/dev/null || die
+
+	mknod "${CHROOT}"/dev/zero c 1 5 || die
+	chmod 0666 "${CHROOT}"/dev/zero || die
+
+	if [[ "${CHROOT_NOMOUNT:-0}" -ne 0 ]]; then
+		cp -a /etc/bind "${CHROOT}"/etc/ || die
+		cp -a /var/bind "${CHROOT}"/var/ || die
+	fi
+
+	if [[ "${CHROOT_GEOIP:-0}" -eq 1 ]]; then
+		if use geoip; then
+			mkdir -m 0755 -p "${CHROOT}"/usr/share/GeoIP || die
+		elif use geoip2; then
+			mkdir -m 0755 -p "${CHROOT}"/usr/share/GeoIP2 || die
+		fi
+	fi
+
+	elog "You may need to add the following line to your syslog-ng.conf:"
+	elog "source jail { unix-stream(\"${CHROOT}/dev/log\"); };"
+}
diff --git a/net-dns/bind/bind-9.20.21.ebuild b/net-dns/bind/bind-9.20.21.ebuild
new file mode 100644
index 000000000000..b6ce44a1852c
--- /dev/null
+++ b/net-dns/bind/bind-9.20.21.ebuild
@@ -0,0 +1,288 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/isc.asc
+inherit eapi9-ver systemd tmpfiles toolchain-funcs verify-sig
+
+MY_PV="${PV/_p/-P}"
+MY_PV="${MY_PV/_rc/rc}"
+
+DESCRIPTION="Berkeley Internet Name Domain - Name Server"
+HOMEPAGE="https://www.isc.org/bind/"
+SRC_URI="
+	https://downloads.isc.org/isc/bind9/${PV}/${P}.tar.xz
+	verify-sig? ( https://downloads.isc.org/isc/bind9/${PV}/${P}.tar.xz.asc )
+"
+S="${WORKDIR}/${PN}-${MY_PV}"
+
+LICENSE="MPL-2.0"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+IUSE="dnstap doc doh fixed-rrset idn jemalloc geoip gssapi lmdb selinux static-libs systemtap test xml"
+RESTRICT="!test? ( test )"
+
+DEPEND="
+	acct-group/named
+	acct-user/named
+	dev-libs/json-c:=
+	dev-libs/userspace-rcu:=
+	>=dev-libs/libuv-1.37.0:=
+	virtual/zlib:=
+	dev-libs/openssl:=[-bindist(-)]
+	>=sys-libs/libcap-2.1.0
+	dnstap? (
+		dev-libs/fstrm
+		dev-libs/protobuf-c
+	)
+	doh? ( net-libs/nghttp2:= )
+	geoip? ( dev-libs/libmaxminddb )
+	gssapi? ( virtual/krb5 )
+	idn? ( net-dns/libidn2 )
+	jemalloc? ( dev-libs/jemalloc:= )
+	lmdb? ( dev-db/lmdb )
+	xml? ( dev-libs/libxml2:= )
+"
+RDEPEND="
+	${DEPEND}
+	selinux? ( sec-policy/selinux-bind )
+	sys-process/psmisc
+	!<net-dns/bind-tools-9.18.0
+"
+# sphinx required for man-page and html creation
+BDEPEND="
+	dev-lang/perl
+	virtual/pkgconfig
+	doc? ( dev-python/sphinx )
+	test? ( dev-util/cmocka )
+	systemtap? ( dev-debug/systemtap )
+	verify-sig? ( sec-keys/openpgp-keys-isc )
+"
+
+src_prepare() {
+	default
+
+	# Don't clobber our toolchain defaults
+	sed -i -e '/FORTIFY_SOURCE=/d' configure || die
+
+	# Relies on -Wl,--wrap (bug #877741)
+	if tc-is-lto ; then
+		sed -i -e 's:ISC_TEST_MAIN:int main(void) { exit(77); }:' tests/ns/query_test.c || die
+	fi
+}
+
+src_configure() {
+	# configure automagically uses sphinx even if prebuilt man pages
+	# are available. Force fallback to prebuilt ones.
+	use doc || export ac_cv_path_SPHINX_BUILD= SPHINX_BUILD=
+
+	# Workaround for bug #938302
+	if use systemtap && has_version "dev-debug/systemtap[-dtrace-symlink(+)]" ; then
+		export DTRACE="${BROOT}"/usr/bin/stap-dtrace
+	fi
+
+	local myeconfargs=(
+		--prefix="${EPREFIX}"/usr
+		--sysconfdir="${EPREFIX}"/etc/bind
+		--localstatedir="${EPREFIX}"/var
+		--enable-full-report
+		--without-readline
+		--with-openssl="${ESYSROOT}"/usr
+		--with-json-c
+		--with-zlib
+		--disable-dnsrps
+		$(use_enable dnstap)
+		$(use_enable doh)
+		$(use_with doh libnghttp2)
+		$(use_enable static-libs static)
+		$(use_enable geoip)
+		$(use_enable systemtap tracing)
+		$(use_with test cmocka)
+		$(use_with geoip maxminddb)
+		$(use_with gssapi)
+		$(use_with idn libidn2)
+		$(use_with jemalloc)
+		$(use_with lmdb)
+		$(use_with xml libxml2)
+	)
+
+	econf "${myeconfargs[@]}"
+}
+
+src_test() {
+	# system tests ('emake test') require network configuration for IPs etc
+	# so we run the unit tests instead.
+	CI=1 emake unit V=1
+
+	# libtest is an internal test helper library, it has no tests,
+	# so suppress the QA warning.
+	rm tests/libtest/test-suite.log || die
+}
+
+src_install() {
+	default
+
+	if use doc; then
+		docinto misc
+		dodoc -r doc/misc/
+
+		docinto html
+		dodoc -r doc/arm/
+
+		docinto dnssec-guide
+		dodoc -r doc/dnssec-guide/
+
+		docinto contrib
+		dodoc contrib/scripts/nanny.pl
+	fi
+
+	insinto /etc/bind
+	newins "${FILESDIR}"/named.conf-r9 named.conf
+	newins "${FILESDIR}"/named.conf.auth named.conf.auth
+
+	newinitd "${FILESDIR}"/named.init-r15 named
+	newconfd "${FILESDIR}"/named.confd-r8 named
+
+	newenvd "${FILESDIR}"/10bind.env 10bind
+
+	if ! use static-libs ; then
+		find "${ED}"/usr/lib* -name '*.la' -delete || die
+	fi
+
+	#
+	# /var/bind
+	#
+	# These need to remain for now because CONFIG_PROTECT won't
+	# save them and we shipped configs for years containing references
+	# to them.
+	#
+	# ftp://ftp.rs.internic.net/domain/named.cache:
+	insinto /var/bind
+	newins "${FILESDIR}"/named.cache-r4 named.cache
+	# bug #450406
+	dosym named.cache /var/bind/root.cache
+	#
+	insinto /var/bind/pri
+	newins "${FILESDIR}"/localhost.zone-r3 localhost.zone
+
+	dosym -r /var/bind/pri /etc/bind/pri
+	dosym -r /var/bind/sec /etc/bind/sec
+	dosym -r /var/bind/dyn /etc/bind/dyn
+	keepdir /var/bind/{pri,sec,dyn} /var/log/named
+
+	fowners root:named /{etc,var}/bind /var/log/named /var/bind/{sec,pri,dyn}
+	fowners root:named /etc/bind/{named.conf,named.conf.auth}
+	fperms 0640 /etc/bind/{named.conf,named.conf.auth}
+	fperms 0750 /etc/bind /var/bind/pri
+	fperms 0770 /var/log/named /var/bind/{,sec,dyn}
+
+	systemd_newunit "${FILESDIR}/named.service-r2" named.service
+	dotmpfiles "${FILESDIR}"/named.conf
+	exeinto /usr/libexec
+	doexe "${FILESDIR}/generate-rndc-key.sh"
+}
+
+pkg_postinst() {
+	tmpfiles_process named.conf
+
+	if [[ -z ${ROOT} && ! -f ${EPREFIX}/etc/bind/rndc.key && ! -f ${EPREFIX}/etc/bind/rndc.conf ]]; then
+		einfo "Generating rndc.key"
+		"${EPREFIX}"/usr/sbin/rndc-confgen -a || die
+		chown root:named "${EPREFIX}"/etc/bind/rndc.key || die
+		chmod 0640 "${EPREFIX}"/etc/bind/rndc.key || die
+	fi
+
+	einfo
+	einfo "You can edit /etc/conf.d/named to customize named settings"
+	einfo
+
+	einfo "If you'd like to run bind in a chroot AND this is a new"
+	einfo "install OR your bind doesn't already run in a chroot:"
+	einfo "1) Uncomment and set the CHROOT variable in /etc/conf.d/named."
+	einfo "2) Run \`emerge --config '=${CATEGORY}/${PF}'\`"
+	einfo
+
+	CHROOT=$(source "${EROOT}"/etc/conf.d/named 2>/dev/null; echo ${CHROOT})
+	if [[ -n ${CHROOT} ]]; then
+		elog "NOTE: As of net-dns/bind-9.4.3_p5-r1 the chroot part of the init-script got some major changes!"
+		elog "To enable the old behaviour (without using mount) uncomment the"
+		elog "CHROOT_NOMOUNT option in your /etc/conf.d/named config."
+		elog "If you decide to use the new/default method, ensure to make backup"
+		elog "first and merge your existing configs/zones to /etc/bind and"
+		elog "/var/bind because bind will now mount the needed directories into"
+		elog "the chroot dir."
+	fi
+
+	# show only when upgrading to 9.18
+	if ver_replacing -lt 9.18; then
+		elog "As this is a major bind version upgrade, please read:"
+		elog "   https://kb.isc.org/docs/changes-to-be-aware-of-when-moving-from-bind-916-to-918"
+		elog "for differences in functionality."
+		elog ""
+		ewarn "In particular, please note that bind-9.18 does not need a root hints file anymore"
+		ewarn "and we only ship with one as a stop-gap. If your current configuration specifies a"
+		ewarn "root hints file - usually called named.cache - bind will not start as it will not be able"
+		ewarn "to find the specified file. Best practice is to delete the offending lines that"
+		ewarn "reference named.cache file from your configuration."
+	fi
+}
+
+pkg_config() {
+	CHROOT=$(source "${EROOT}"/etc/conf.d/named; echo ${CHROOT})
+	CHROOT_NOMOUNT=$(source "${EROOT}"/etc/conf.d/named; echo ${CHROOT_NOMOUNT})
+	CHROOT_GEOIP=$(source "${EROOT}"/etc/conf.d/named; echo ${CHROOT_GEOIP})
+
+	if [[ -z "${CHROOT}" ]]; then
+		eerror "This config script is designed to automate setting up"
+		eerror "a chrooted bind/named. To do so, please first uncomment"
+		eerror "and set the CHROOT variable in '/etc/conf.d/named'."
+		die "Unset CHROOT"
+	fi
+
+	if [[ -d "${CHROOT}" ]]; then
+		ewarn "NOTE: As of net-dns/bind-9.4.3_p5-r1 the chroot part of the init-script got some major changes!"
+		ewarn "To enable the old behaviour (without using mount) uncomment the"
+		ewarn "CHROOT_NOMOUNT option in your /etc/conf.d/named config."
+		ewarn
+		ewarn "${CHROOT} already exists... some things might become overridden"
+		ewarn "press CTRL+C if you don't want to continue"
+		sleep 10
+	fi
+
+	echo; einfo "Setting up the chroot directory..."
+
+	mkdir -m 0750 -p "${CHROOT}" || die
+	mkdir -m 0755 -p "${CHROOT}"/{dev,etc,var/log,run} || die
+	mkdir -m 0750 -p "${CHROOT}"/etc/bind || die
+	mkdir -m 0770 -p "${CHROOT}"/var/{bind,log/named,run/named} "${CHROOT}"/run/named/ || die
+
+	chown root:named \
+		"${CHROOT}" \
+		"${CHROOT}"/var/{bind,log/named,run/named} \
+		"${CHROOT}"/run/named/ \
+		"${CHROOT}"/etc/bind \
+		|| die
+
+	mknod "${CHROOT}"/dev/null c 1 3 || die
+	chmod 0666 "${CHROOT}"/dev/null || die
+
+	mknod "${CHROOT}"/dev/zero c 1 5 || die
+	chmod 0666 "${CHROOT}"/dev/zero || die
+
+	if [[ "${CHROOT_NOMOUNT:-0}" -ne 0 ]]; then
+		cp -a /etc/bind "${CHROOT}"/etc/ || die
+		cp -a /var/bind "${CHROOT}"/var/ || die
+	fi
+
+	if [[ "${CHROOT_GEOIP:-0}" -eq 1 ]]; then
+		if use geoip; then
+			mkdir -m 0755 -p "${CHROOT}"/usr/share/GeoIP || die
+		elif use geoip2; then
+			mkdir -m 0755 -p "${CHROOT}"/usr/share/GeoIP2 || die
+		fi
+	fi
+
+	elog "You may need to add the following line to your syslog-ng.conf:"
+	elog "source jail { unix-stream(\"${CHROOT}/dev/log\"); };"
+}
diff --git a/net-dns/bind/bind-9.20.22.ebuild b/net-dns/bind/bind-9.20.22.ebuild
index d3e50e08b03f..b6ce44a1852c 100644
--- a/net-dns/bind/bind-9.20.22.ebuild
+++ b/net-dns/bind/bind-9.20.22.ebuild
@@ -1,284 +1,209 @@
-# Copyright 2021-2026 Liguros Authors
+# Copyright 1999-2026 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
-# Re dlz/mysql and threads, needs to be verified..
-# MySQL uses thread local storage in its C api. Thus MySQL
-# requires that each thread of an application execute a MySQL
-# thread initialization to setup the thread local storage.
-# This is impossible to do safely while staying within the DLZ
-# driver API. This is a limitation caused by MySQL, and not the DLZ API.
-# Because of this BIND MUST only run with a single thread when
-# using the MySQL driver.
 EAPI=8
 
-PYTHON_COMPAT=( python3_{13..14} )
-
-inherit autotools python-r1 systemd tmpfiles
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/isc.asc
+inherit eapi9-ver systemd tmpfiles toolchain-funcs verify-sig
 
 MY_PV="${PV/_p/-P}"
 MY_PV="${MY_PV/_rc/rc}"
-MY_P="${PN}-${MY_PV}"
-
-SDB_LDAP_VER="1.1.0-fc14"
-RRL_PV="${MY_PV}"
 
 DESCRIPTION="Berkeley Internet Name Domain - Name Server"
-HOMEPAGE="https://www.isc.org/software/bind"
-SRC_URI="https://downloads.isc.org/isc/bind9/${PV}/${P}.tar.xz"
+HOMEPAGE="https://www.isc.org/bind/"
+SRC_URI="
+	https://downloads.isc.org/isc/bind9/${PV}/${P}.tar.xz
+	verify-sig? ( https://downloads.isc.org/isc/bind9/${PV}/${P}.tar.xz.asc )
+"
+S="${WORKDIR}/${PN}-${MY_PV}"
 
-LICENSE="Apache-2.0 BSD BSD-2 GPL-2 HPND ISC MPL-2.0"
+LICENSE="MPL-2.0"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~mips ~ppc ~ppc64 ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux"
-RESTRICT="mirror"
-# -berkdb by default re bug 602682
-IUSE="-berkdb +caps +dlz dnstap doc dnsrps fixed-rrset geoip geoip2 gssapi
-json ldap  lmdb mariadb odbc postgres python selinux static-libs
-urandom xml +zlib"
-# sdb-ldap - patch broken
-# no PKCS11 currently as it requires OpenSSL to be patched, also see bug 409687
-
-# Upstream dropped the old geoip library, but the BIND configuration for using
-# GeoIP remained the same.
-REQUIRED_USE="
-	postgres? ( dlz )
-	berkdb? ( dlz )
-	mariadb? ( dlz )
-	odbc? ( dlz )
-	ldap? ( dlz )
-	dnsrps? ( dlz )
-	python? ( ${PYTHON_REQUIRED_USE} )
-"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+IUSE="dnstap doc doh fixed-rrset idn jemalloc geoip gssapi lmdb selinux static-libs systemtap test xml"
+RESTRICT="!test? ( test )"
 
 DEPEND="
 	acct-group/named
 	acct-user/named
-	net-libs/nghttp2:=
-	dev-libs/openssl:=
-
-	mariadb? ( dev-db/mariadb-connector-c:0= )
-	odbc? ( >=dev-db/unixODBC-2.2.6 )
-	ldap? ( net-nds/openldap )
-	postgres? ( dev-db/postgresql:= )
-	caps? ( >=sys-libs/libcap-2.1.0 )
-	xml? ( dev-libs/libxml2 )
+	dev-libs/json-c:=
+	dev-libs/userspace-rcu:=
+	>=dev-libs/libuv-1.37.0:=
+	virtual/zlib:=
+	dev-libs/openssl:=[-bindist(-)]
+	>=sys-libs/libcap-2.1.0
+	dnstap? (
+		dev-libs/fstrm
+		dev-libs/protobuf-c
+	)
+	doh? ( net-libs/nghttp2:= )
 	geoip? ( dev-libs/libmaxminddb )
-	geoip2? ( dev-libs/libmaxminddb )
 	gssapi? ( virtual/krb5 )
-	json? ( dev-libs/json-c:= )
+	idn? ( net-dns/libidn2 )
+	jemalloc? ( dev-libs/jemalloc:= )
 	lmdb? ( dev-db/lmdb )
-	zlib? ( sys-libs/zlib )
-	dnstap? ( dev-libs/fstrm dev-libs/protobuf-c )
-	python? (
-		${PYTHON_DEPS}
-		dev-python/ply[${PYTHON_USEDEP}]
-	)
-	dev-libs/libuv:=
+	xml? ( dev-libs/libxml2:= )
 "
-
-RDEPEND="${DEPEND}
+RDEPEND="
+	${DEPEND}
 	selinux? ( sec-policy/selinux-bind )
 	sys-process/psmisc
+	!<net-dns/bind-tools-9.18.0
+"
+# sphinx required for man-page and html creation
+BDEPEND="
+	dev-lang/perl
+	virtual/pkgconfig
+	doc? ( dev-python/sphinx )
+	test? ( dev-util/cmocka )
+	systemtap? ( dev-debug/systemtap )
+	verify-sig? ( sec-keys/openpgp-keys-isc )
 "
-
-S="${WORKDIR}/${MY_P}"
 
 src_prepare() {
 	default
 
-	# should be installed by bind-tools
-	sed -i -r -e "s:(nsupdate|dig|delv) ::g" bin/Makefile.in || die
-
-	# Disable tests for now, bug 406399
-	sed -i '/^SUBDIRS/s:tests::' bin/Makefile.in lib/Makefile.in || die
-
-	# bug #220361
-	rm aclocal.m4 || die
-	rm -rf libtool.m4/ || die
-	eautoreconf
+	# Don't clobber our toolchain defaults
+	sed -i -e '/FORTIFY_SOURCE=/d' configure || die
 
-	use python && python_copy_sources
+	# Relies on -Wl,--wrap (bug #877741)
+	if tc-is-lto ; then
+		sed -i -e 's:ISC_TEST_MAIN:int main(void) { exit(77); }:' tests/ns/query_test.c || die
+	fi
 }
 
 src_configure() {
-	bind_configure
-	use python && python_foreach_impl python_configure
-}
+	# configure automagically uses sphinx even if prebuilt man pages
+	# are available. Force fallback to prebuilt ones.
+	use doc || export ac_cv_path_SPHINX_BUILD= SPHINX_BUILD=
+
+	# Workaround for bug #938302
+	if use systemtap && has_version "dev-debug/systemtap[-dtrace-symlink(+)]" ; then
+		export DTRACE="${BROOT}"/usr/bin/stap-dtrace
+	fi
 
-bind_configure() {
 	local myeconfargs=(
-		AR="$(type -P $(tc-getAR))"
 		--prefix="${EPREFIX}"/usr
-		--sysconfdir=/etc/bind
-		--localstatedir=/var
+		--sysconfdir="${EPREFIX}"/etc/bind
+		--localstatedir="${EPREFIX}"/var
 		--enable-full-report
 		--without-readline
-		--with-openssl="${EPREFIX}"/usr
-		--without-cmocka
-		$(use_enable caps linux-caps)
-		$(use_enable dnsrps)
+		--with-openssl="${ESYSROOT}"/usr
+		--with-json-c
+		--with-zlib
+		--disable-dnsrps
 		$(use_enable dnstap)
-		$(use_enable fixed-rrset)
-		$(use_with dlz dlopen)
-		$(use_with dlz dlz-filesystem)
-		$(use_with dlz dlz-stub)
+		$(use_enable doh)
+		$(use_with doh libnghttp2)
+		$(use_enable static-libs static)
+		$(use_enable geoip)
+		$(use_enable systemtap tracing)
+		$(use_with test cmocka)
+		$(use_with geoip maxminddb)
 		$(use_with gssapi)
-		$(use_with json json-c)
-		$(use_with ldap dlz-ldap)
-		$(use_with mariadb dlz-mysql)
-		$(use_with odbc dlz-odbc)
-		$(use_with postgres dlz-postgres)
+		$(use_with idn libidn2)
+		$(use_with jemalloc)
 		$(use_with lmdb)
 		$(use_with xml libxml2)
-		$(use_with zlib)
-		"${@}"
 	)
-	# This is for users to start to migrate back to USE=geoip, rather than
-	# USE=geoip2
-	if use geoip ; then
-		myeconfargs+=( $(use_with geoip maxminddb) --enable-geoip )
-	elif use geoip2 ; then
-		# Added 2020/09/30
-		# Remove USE=geoip2 support after 2020/03/01
-		ewarn "USE=geoip2 is deprecated; update your USE flags!"
-		myeconfargs+=( $(use_with geoip2 maxminddb) --enable-geoip )
-	else
-		myeconfargs+=( --without-maxminddb --disable-geoip )
-	fi
-
-	# To include db.h from proper path
-	use berkdb && append-flags "-I$(db_includedir)"
 
-	export BUILD_CC=$(tc-getBUILD_CC)
 	econf "${myeconfargs[@]}"
-
-	# bug #151839
-	echo '#undef SO_BSDCOMPAT' >> config.h
-}
-
-python_configure() {
-	cd "${BUILD_DIR}"
-	bind_configure --with-python
 }
 
-src_compile() {
-	default
-	emake -C doc/man/ man $(usev doc)
-	use python && python_foreach_impl python_compile
-}
+src_test() {
+	# system tests ('emake test') require network configuration for IPs etc
+	# so we run the unit tests instead.
+	CI=1 emake unit V=1
 
-python_compile() {
-	cd "${BUILD_DIR}"
-	emake
+	# libtest is an internal test helper library, it has no tests,
+	# so suppress the QA warning.
+	rm tests/libtest/test-suite.log || die
 }
 
 src_install() {
-	dodoc README.md
+	default
 
 	if use doc; then
 		docinto misc
 		dodoc -r doc/misc/
 
-		# might a 'html' useflag make sense?
 		docinto html
 		dodoc -r doc/arm/
-		docinto contrib
-		dodoc contrib/scripts/{nanny.pl,named-bootconf.sh}
 
-		# some handy-dandy dynamic dns examples
-		cd "${ED}"/usr/share/doc/${PF}
-		tar xf "${DISTDIR}"/dyndns-samples.tbz2 || die
+		docinto dnssec-guide
+		dodoc -r doc/dnssec-guide/
+
+		docinto contrib
+		dodoc contrib/scripts/nanny.pl
 	fi
 
 	insinto /etc/bind
-	newins "${FILESDIR}"/named.conf-r8 named.conf
-	insinto /var/bind
-	newins "${FILESDIR}"/named.cache-r3 named.cache
-	insinto /var/bind/pri
-	newins "${FILESDIR}"/localhost.zone-r3 localhost.zone
-	newinitd "${FILESDIR}"/named.init-r13 named
-	newconfd "${FILESDIR}"/named.confd-r7 named
-	newenvd "${FILESDIR}"/10bind.env 10bind
-	doman doc/man/*.{1,5,8}
+	newins "${FILESDIR}"/named.conf-r9 named.conf
+	newins "${FILESDIR}"/named.conf.auth named.conf.auth
 
-	# bug 405251, library archives aren't properly handled by --enable/disable-static
-	if ! use static-libs; then
-		find "${ED}" -type f -name '*.a' -delete || die
-	fi
+	newinitd "${FILESDIR}"/named.init-r15 named
+	newconfd "${FILESDIR}"/named.confd-r8 named
 
-	# bug 405251
-	find "${ED}" -type f -name '*.la' -delete || die
+	newenvd "${FILESDIR}"/10bind.env 10bind
 
-	use python && python_foreach_impl python_install
+	if ! use static-libs ; then
+		find "${ED}"/usr/lib* -name '*.la' -delete || die
+	fi
 
-	# bug 450406
+	#
+	# /var/bind
+	#
+	# These need to remain for now because CONFIG_PROTECT won't
+	# save them and we shipped configs for years containing references
+	# to them.
+	#
+	# ftp://ftp.rs.internic.net/domain/named.cache:
+	insinto /var/bind
+	newins "${FILESDIR}"/named.cache-r4 named.cache
+	# bug #450406
 	dosym named.cache /var/bind/root.cache
+	#
+	insinto /var/bind/pri
+	newins "${FILESDIR}"/localhost.zone-r3 localhost.zone
 
-	dosym ../../var/bind/pri /etc/bind/pri
-	dosym ../../var/bind/sec /etc/bind/sec
-	dosym ../../var/bind/dyn /etc/bind/dyn
+	dosym -r /var/bind/pri /etc/bind/pri
+	dosym -r /var/bind/sec /etc/bind/sec
+	dosym -r /var/bind/dyn /etc/bind/dyn
 	keepdir /var/bind/{pri,sec,dyn} /var/log/named
 
 	fowners root:named /{etc,var}/bind /var/log/named /var/bind/{sec,pri,dyn}
-	fowners root:named /var/bind/named.cache /var/bind/pri/localhost.zone /etc/bind/named.conf
-	fperms 0640 /var/bind/named.cache /var/bind/pri/localhost.zone /etc/bind/named.conf
+	fowners root:named /etc/bind/{named.conf,named.conf.auth}
+	fperms 0640 /etc/bind/{named.conf,named.conf.auth}
 	fperms 0750 /etc/bind /var/bind/pri
 	fperms 0770 /var/log/named /var/bind/{,sec,dyn}
 
-	systemd_newunit "${FILESDIR}/named.service-r1" named.service
+	systemd_newunit "${FILESDIR}/named.service-r2" named.service
 	dotmpfiles "${FILESDIR}"/named.conf
 	exeinto /usr/libexec
 	doexe "${FILESDIR}/generate-rndc-key.sh"
 }
 
-python_install() {
-	emake DESTDIR="${D}" install
-	python_scriptinto /usr/sbin
-	python_optimize
-	# unifying bind with bind-tools, they share lots
-	# Let's get rid of those tools and their manpages since they're provided by bind-tools
-	rm -f "${ED}"/usr/share/man/man1/{dig,host,nslookup,delv,nsupdate}.1* || die
-	rm -f "${ED}"/usr/share/man/man8/nsupdate.8* || die
-	rm -f "${ED}"/usr/{,s}bin/{dig,host,nslookup,nsupdate,delv} || die
-
-	for tool in dsfromkey importkey keyfromlabel keygen revoke settime signzone verify; do
-		rm -f "${ED}"/usr/{,s}bin/dnssec-"${tool}" || die
-		rm -f "${ED}"/usr/share/man/man8/dnssec-"${tool}".8* || die
-	done
-}
-
 pkg_postinst() {
-	tmpfiles_process "${FILESDIR}"/named.conf
+	tmpfiles_process named.conf
 
-	if [[ ! -f '/etc/bind/rndc.key' && ! -f '/etc/bind/rndc.conf' ]]; then
-		if use urandom; then
-			einfo "Using /dev/urandom for generating rndc.key"
-			/usr/sbin/rndc-confgen -r /dev/urandom -a
-			echo
-		else
-			einfo "Using /dev/random for generating rndc.key"
-			/usr/sbin/rndc-confgen -a
-			echo
-		fi
-		chown root:named /etc/bind/rndc.key || die
-		chmod 0640 /etc/bind/rndc.key || die
+	if [[ -z ${ROOT} && ! -f ${EPREFIX}/etc/bind/rndc.key && ! -f ${EPREFIX}/etc/bind/rndc.conf ]]; then
+		einfo "Generating rndc.key"
+		"${EPREFIX}"/usr/sbin/rndc-confgen -a || die
+		chown root:named "${EPREFIX}"/etc/bind/rndc.key || die
+		chmod 0640 "${EPREFIX}"/etc/bind/rndc.key || die
 	fi
 
 	einfo
 	einfo "You can edit /etc/conf.d/named to customize named settings"
 	einfo
-	use mariadb || use postgres || use ldap && {
-		elog "If your named depends on MySQL/PostgreSQL or LDAP,"
-		elog "uncomment the specified rc_named_* lines in your"
-		elog "/etc/conf.d/named config to ensure they'll start before bind"
-		einfo
-	}
+
 	einfo "If you'd like to run bind in a chroot AND this is a new"
 	einfo "install OR your bind doesn't already run in a chroot:"
 	einfo "1) Uncomment and set the CHROOT variable in /etc/conf.d/named."
 	einfo "2) Run \`emerge --config '=${CATEGORY}/${PF}'\`"
 	einfo
 
-	CHROOT=$(source /etc/conf.d/named 2>/dev/null; echo ${CHROOT})
+	CHROOT=$(source "${EROOT}"/etc/conf.d/named 2>/dev/null; echo ${CHROOT})
 	if [[ -n ${CHROOT} ]]; then
 		elog "NOTE: As of net-dns/bind-9.4.3_p5-r1 the chroot part of the init-script got some major changes!"
 		elog "To enable the old behaviour (without using mount) uncomment the"
@@ -288,12 +213,25 @@ pkg_postinst() {
 		elog "/var/bind because bind will now mount the needed directories into"
 		elog "the chroot dir."
 	fi
+
+	# show only when upgrading to 9.18
+	if ver_replacing -lt 9.18; then
+		elog "As this is a major bind version upgrade, please read:"
+		elog "   https://kb.isc.org/docs/changes-to-be-aware-of-when-moving-from-bind-916-to-918"
+		elog "for differences in functionality."
+		elog ""
+		ewarn "In particular, please note that bind-9.18 does not need a root hints file anymore"
+		ewarn "and we only ship with one as a stop-gap. If your current configuration specifies a"
+		ewarn "root hints file - usually called named.cache - bind will not start as it will not be able"
+		ewarn "to find the specified file. Best practice is to delete the offending lines that"
+		ewarn "reference named.cache file from your configuration."
+	fi
 }
 
 pkg_config() {
-	CHROOT=$(source /etc/conf.d/named; echo ${CHROOT})
-	CHROOT_NOMOUNT=$(source /etc/conf.d/named; echo ${CHROOT_NOMOUNT})
-	CHROOT_GEOIP=$(source /etc/conf.d/named; echo ${CHROOT_GEOIP})
+	CHROOT=$(source "${EROOT}"/etc/conf.d/named; echo ${CHROOT})
+	CHROOT_NOMOUNT=$(source "${EROOT}"/etc/conf.d/named; echo ${CHROOT_NOMOUNT})
+	CHROOT_GEOIP=$(source "${EROOT}"/etc/conf.d/named; echo ${CHROOT_GEOIP})
 
 	if [[ -z "${CHROOT}" ]]; then
 		eerror "This config script is designed to automate setting up"
@@ -301,6 +239,7 @@ pkg_config() {
 		eerror "and set the CHROOT variable in '/etc/conf.d/named'."
 		die "Unset CHROOT"
 	fi
+
 	if [[ -d "${CHROOT}" ]]; then
 		ewarn "NOTE: As of net-dns/bind-9.4.3_p5-r1 the chroot part of the init-script got some major changes!"
 		ewarn "To enable the old behaviour (without using mount) uncomment the"
@@ -313,46 +252,37 @@ pkg_config() {
 
 	echo; einfo "Setting up the chroot directory..."
 
-	mkdir -m 0750 -p ${CHROOT} || die
-	mkdir -m 0755 -p ${CHROOT}/{dev,etc,var/log,run} || die
-	mkdir -m 0750 -p ${CHROOT}/etc/bind || die
-	mkdir -m 0770 -p ${CHROOT}/var/{bind,log/named} ${CHROOT}/run/named/ || die
+	mkdir -m 0750 -p "${CHROOT}" || die
+	mkdir -m 0755 -p "${CHROOT}"/{dev,etc,var/log,run} || die
+	mkdir -m 0750 -p "${CHROOT}"/etc/bind || die
+	mkdir -m 0770 -p "${CHROOT}"/var/{bind,log/named,run/named} "${CHROOT}"/run/named/ || die
 
 	chown root:named \
-		${CHROOT} \
-		${CHROOT}/var/{bind,log/named} \
-		${CHROOT}/run/named/ \
-		${CHROOT}/etc/bind \
+		"${CHROOT}" \
+		"${CHROOT}"/var/{bind,log/named,run/named} \
+		"${CHROOT}"/run/named/ \
+		"${CHROOT}"/etc/bind \
 		|| die
 
-	mknod ${CHROOT}/dev/null c 1 3 || die
-	chmod 0666 ${CHROOT}/dev/null || die
+	mknod "${CHROOT}"/dev/null c 1 3 || die
+	chmod 0666 "${CHROOT}"/dev/null || die
 
-	mknod ${CHROOT}/dev/zero c 1 5 || die
-	chmod 0666 ${CHROOT}/dev/zero || die
+	mknod "${CHROOT}"/dev/zero c 1 5 || die
+	chmod 0666 "${CHROOT}"/dev/zero || die
 
-	if use urandom; then
-		mknod ${CHROOT}/dev/urandom c 1 9 || die
-		chmod 0666 ${CHROOT}/dev/urandom || die
-	else
-		mknod ${CHROOT}/dev/random c 1 8 || die
-		chmod 0666 ${CHROOT}/dev/random || die
+	if [[ "${CHROOT_NOMOUNT:-0}" -ne 0 ]]; then
+		cp -a /etc/bind "${CHROOT}"/etc/ || die
+		cp -a /var/bind "${CHROOT}"/var/ || die
 	fi
 
-	if [ "${CHROOT_NOMOUNT:-0}" -ne 0 ]; then
-		cp -a /etc/bind ${CHROOT}/etc/ || die
-		cp -a /var/bind ${CHROOT}/var/ || die
-	fi
-
-	if [ "${CHROOT_GEOIP:-0}" -eq 1 ]; then
+	if [[ "${CHROOT_GEOIP:-0}" -eq 1 ]]; then
 		if use geoip; then
-			mkdir -m 0755 -p ${CHROOT}/usr/share/GeoIP || die
+			mkdir -m 0755 -p "${CHROOT}"/usr/share/GeoIP || die
 		elif use geoip2; then
-			mkdir -m 0755 -p ${CHROOT}/usr/share/GeoIP2 || die
+			mkdir -m 0755 -p "${CHROOT}"/usr/share/GeoIP2 || die
 		fi
 	fi
 
 	elog "You may need to add the following line to your syslog-ng.conf:"
 	elog "source jail { unix-stream(\"${CHROOT}/dev/log\"); };"
 }
-
diff --git a/net-dns/bind/bind-9.20.23.ebuild b/net-dns/bind/bind-9.20.23.ebuild
index d3e50e08b03f..f4d8e3028bc4 100644
--- a/net-dns/bind/bind-9.20.23.ebuild
+++ b/net-dns/bind/bind-9.20.23.ebuild
@@ -1,284 +1,209 @@
-# Copyright 2021-2026 Liguros Authors
+# Copyright 1999-2026 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
-# Re dlz/mysql and threads, needs to be verified..
-# MySQL uses thread local storage in its C api. Thus MySQL
-# requires that each thread of an application execute a MySQL
-# thread initialization to setup the thread local storage.
-# This is impossible to do safely while staying within the DLZ
-# driver API. This is a limitation caused by MySQL, and not the DLZ API.
-# Because of this BIND MUST only run with a single thread when
-# using the MySQL driver.
 EAPI=8
 
-PYTHON_COMPAT=( python3_{13..14} )
-
-inherit autotools python-r1 systemd tmpfiles
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/isc.asc
+inherit eapi9-ver systemd tmpfiles toolchain-funcs verify-sig
 
 MY_PV="${PV/_p/-P}"
 MY_PV="${MY_PV/_rc/rc}"
-MY_P="${PN}-${MY_PV}"
-
-SDB_LDAP_VER="1.1.0-fc14"
-RRL_PV="${MY_PV}"
 
 DESCRIPTION="Berkeley Internet Name Domain - Name Server"
-HOMEPAGE="https://www.isc.org/software/bind"
-SRC_URI="https://downloads.isc.org/isc/bind9/${PV}/${P}.tar.xz"
+HOMEPAGE="https://www.isc.org/bind/"
+SRC_URI="
+	https://downloads.isc.org/isc/bind9/${PV}/${P}.tar.xz
+	verify-sig? ( https://downloads.isc.org/isc/bind9/${PV}/${P}.tar.xz.asc )
+"
+S="${WORKDIR}/${PN}-${MY_PV}"
 
-LICENSE="Apache-2.0 BSD BSD-2 GPL-2 HPND ISC MPL-2.0"
+LICENSE="MPL-2.0"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~mips ~ppc ~ppc64 ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux"
-RESTRICT="mirror"
-# -berkdb by default re bug 602682
-IUSE="-berkdb +caps +dlz dnstap doc dnsrps fixed-rrset geoip geoip2 gssapi
-json ldap  lmdb mariadb odbc postgres python selinux static-libs
-urandom xml +zlib"
-# sdb-ldap - patch broken
-# no PKCS11 currently as it requires OpenSSL to be patched, also see bug 409687
-
-# Upstream dropped the old geoip library, but the BIND configuration for using
-# GeoIP remained the same.
-REQUIRED_USE="
-	postgres? ( dlz )
-	berkdb? ( dlz )
-	mariadb? ( dlz )
-	odbc? ( dlz )
-	ldap? ( dlz )
-	dnsrps? ( dlz )
-	python? ( ${PYTHON_REQUIRED_USE} )
-"
+KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~loong ~mips ppc ppc64 ~riscv ~s390 ~sparc x86"
+IUSE="dnstap doc doh fixed-rrset idn jemalloc geoip gssapi lmdb selinux static-libs systemtap test xml"
+RESTRICT="!test? ( test )"
 
 DEPEND="
 	acct-group/named
 	acct-user/named
-	net-libs/nghttp2:=
-	dev-libs/openssl:=
-
-	mariadb? ( dev-db/mariadb-connector-c:0= )
-	odbc? ( >=dev-db/unixODBC-2.2.6 )
-	ldap? ( net-nds/openldap )
-	postgres? ( dev-db/postgresql:= )
-	caps? ( >=sys-libs/libcap-2.1.0 )
-	xml? ( dev-libs/libxml2 )
+	dev-libs/json-c:=
+	dev-libs/userspace-rcu:=
+	>=dev-libs/libuv-1.37.0:=
+	virtual/zlib:=
+	dev-libs/openssl:=[-bindist(-)]
+	>=sys-libs/libcap-2.1.0
+	dnstap? (
+		dev-libs/fstrm
+		dev-libs/protobuf-c
+	)
+	doh? ( net-libs/nghttp2:= )
 	geoip? ( dev-libs/libmaxminddb )
-	geoip2? ( dev-libs/libmaxminddb )
 	gssapi? ( virtual/krb5 )
-	json? ( dev-libs/json-c:= )
+	idn? ( net-dns/libidn2 )
+	jemalloc? ( dev-libs/jemalloc:= )
 	lmdb? ( dev-db/lmdb )
-	zlib? ( sys-libs/zlib )
-	dnstap? ( dev-libs/fstrm dev-libs/protobuf-c )
-	python? (
-		${PYTHON_DEPS}
-		dev-python/ply[${PYTHON_USEDEP}]
-	)
-	dev-libs/libuv:=
+	xml? ( dev-libs/libxml2:= )
 "
-
-RDEPEND="${DEPEND}
+RDEPEND="
+	${DEPEND}
 	selinux? ( sec-policy/selinux-bind )
 	sys-process/psmisc
+	!<net-dns/bind-tools-9.18.0
+"
+# sphinx required for man-page and html creation
+BDEPEND="
+	dev-lang/perl
+	virtual/pkgconfig
+	doc? ( dev-python/sphinx )
+	test? ( dev-util/cmocka )
+	systemtap? ( dev-debug/systemtap )
+	verify-sig? ( sec-keys/openpgp-keys-isc )
 "
-
-S="${WORKDIR}/${MY_P}"
 
 src_prepare() {
 	default
 
-	# should be installed by bind-tools
-	sed -i -r -e "s:(nsupdate|dig|delv) ::g" bin/Makefile.in || die
-
-	# Disable tests for now, bug 406399
-	sed -i '/^SUBDIRS/s:tests::' bin/Makefile.in lib/Makefile.in || die
-
-	# bug #220361
-	rm aclocal.m4 || die
-	rm -rf libtool.m4/ || die
-	eautoreconf
+	# Don't clobber our toolchain defaults
+	sed -i -e '/FORTIFY_SOURCE=/d' configure || die
 
-	use python && python_copy_sources
+	# Relies on -Wl,--wrap (bug #877741)
+	if tc-is-lto ; then
+		sed -i -e 's:ISC_TEST_MAIN:int main(void) { exit(77); }:' tests/ns/query_test.c || die
+	fi
 }
 
 src_configure() {
-	bind_configure
-	use python && python_foreach_impl python_configure
-}
+	# configure automagically uses sphinx even if prebuilt man pages
+	# are available. Force fallback to prebuilt ones.
+	use doc || export ac_cv_path_SPHINX_BUILD= SPHINX_BUILD=
+
+	# Workaround for bug #938302
+	if use systemtap && has_version "dev-debug/systemtap[-dtrace-symlink(+)]" ; then
+		export DTRACE="${BROOT}"/usr/bin/stap-dtrace
+	fi
 
-bind_configure() {
 	local myeconfargs=(
-		AR="$(type -P $(tc-getAR))"
 		--prefix="${EPREFIX}"/usr
-		--sysconfdir=/etc/bind
-		--localstatedir=/var
+		--sysconfdir="${EPREFIX}"/etc/bind
+		--localstatedir="${EPREFIX}"/var
 		--enable-full-report
 		--without-readline
-		--with-openssl="${EPREFIX}"/usr
-		--without-cmocka
-		$(use_enable caps linux-caps)
-		$(use_enable dnsrps)
+		--with-openssl="${ESYSROOT}"/usr
+		--with-json-c
+		--with-zlib
+		--disable-dnsrps
 		$(use_enable dnstap)
-		$(use_enable fixed-rrset)
-		$(use_with dlz dlopen)
-		$(use_with dlz dlz-filesystem)
-		$(use_with dlz dlz-stub)
+		$(use_enable doh)
+		$(use_with doh libnghttp2)
+		$(use_enable static-libs static)
+		$(use_enable geoip)
+		$(use_enable systemtap tracing)
+		$(use_with test cmocka)
+		$(use_with geoip maxminddb)
 		$(use_with gssapi)
-		$(use_with json json-c)
-		$(use_with ldap dlz-ldap)
-		$(use_with mariadb dlz-mysql)
-		$(use_with odbc dlz-odbc)
-		$(use_with postgres dlz-postgres)
+		$(use_with idn libidn2)
+		$(use_with jemalloc)
 		$(use_with lmdb)
 		$(use_with xml libxml2)
-		$(use_with zlib)
-		"${@}"
 	)
-	# This is for users to start to migrate back to USE=geoip, rather than
-	# USE=geoip2
-	if use geoip ; then
-		myeconfargs+=( $(use_with geoip maxminddb) --enable-geoip )
-	elif use geoip2 ; then
-		# Added 2020/09/30
-		# Remove USE=geoip2 support after 2020/03/01
-		ewarn "USE=geoip2 is deprecated; update your USE flags!"
-		myeconfargs+=( $(use_with geoip2 maxminddb) --enable-geoip )
-	else
-		myeconfargs+=( --without-maxminddb --disable-geoip )
-	fi
-
-	# To include db.h from proper path
-	use berkdb && append-flags "-I$(db_includedir)"
 
-	export BUILD_CC=$(tc-getBUILD_CC)
 	econf "${myeconfargs[@]}"
-
-	# bug #151839
-	echo '#undef SO_BSDCOMPAT' >> config.h
-}
-
-python_configure() {
-	cd "${BUILD_DIR}"
-	bind_configure --with-python
 }
 
-src_compile() {
-	default
-	emake -C doc/man/ man $(usev doc)
-	use python && python_foreach_impl python_compile
-}
+src_test() {
+	# system tests ('emake test') require network configuration for IPs etc
+	# so we run the unit tests instead.
+	CI=1 emake unit V=1
 
-python_compile() {
-	cd "${BUILD_DIR}"
-	emake
+	# libtest is an internal test helper library, it has no tests,
+	# so suppress the QA warning.
+	rm tests/libtest/test-suite.log || die
 }
 
 src_install() {
-	dodoc README.md
+	default
 
 	if use doc; then
 		docinto misc
 		dodoc -r doc/misc/
 
-		# might a 'html' useflag make sense?
 		docinto html
 		dodoc -r doc/arm/
-		docinto contrib
-		dodoc contrib/scripts/{nanny.pl,named-bootconf.sh}
 
-		# some handy-dandy dynamic dns examples
-		cd "${ED}"/usr/share/doc/${PF}
-		tar xf "${DISTDIR}"/dyndns-samples.tbz2 || die
+		docinto dnssec-guide
+		dodoc -r doc/dnssec-guide/
+
+		docinto contrib
+		dodoc contrib/scripts/nanny.pl
 	fi
 
 	insinto /etc/bind
-	newins "${FILESDIR}"/named.conf-r8 named.conf
-	insinto /var/bind
-	newins "${FILESDIR}"/named.cache-r3 named.cache
-	insinto /var/bind/pri
-	newins "${FILESDIR}"/localhost.zone-r3 localhost.zone
-	newinitd "${FILESDIR}"/named.init-r13 named
-	newconfd "${FILESDIR}"/named.confd-r7 named
-	newenvd "${FILESDIR}"/10bind.env 10bind
-	doman doc/man/*.{1,5,8}
+	newins "${FILESDIR}"/named.conf-r9 named.conf
+	newins "${FILESDIR}"/named.conf.auth named.conf.auth
 
-	# bug 405251, library archives aren't properly handled by --enable/disable-static
-	if ! use static-libs; then
-		find "${ED}" -type f -name '*.a' -delete || die
-	fi
+	newinitd "${FILESDIR}"/named.init-r15 named
+	newconfd "${FILESDIR}"/named.confd-r8 named
 
-	# bug 405251
-	find "${ED}" -type f -name '*.la' -delete || die
+	newenvd "${FILESDIR}"/10bind.env 10bind
 
-	use python && python_foreach_impl python_install
+	if ! use static-libs ; then
+		find "${ED}"/usr/lib* -name '*.la' -delete || die
+	fi
 
-	# bug 450406
+	#
+	# /var/bind
+	#
+	# These need to remain for now because CONFIG_PROTECT won't
+	# save them and we shipped configs for years containing references
+	# to them.
+	#
+	# ftp://ftp.rs.internic.net/domain/named.cache:
+	insinto /var/bind
+	newins "${FILESDIR}"/named.cache-r4 named.cache
+	# bug #450406
 	dosym named.cache /var/bind/root.cache
+	#
+	insinto /var/bind/pri
+	newins "${FILESDIR}"/localhost.zone-r3 localhost.zone
 
-	dosym ../../var/bind/pri /etc/bind/pri
-	dosym ../../var/bind/sec /etc/bind/sec
-	dosym ../../var/bind/dyn /etc/bind/dyn
+	dosym -r /var/bind/pri /etc/bind/pri
+	dosym -r /var/bind/sec /etc/bind/sec
+	dosym -r /var/bind/dyn /etc/bind/dyn
 	keepdir /var/bind/{pri,sec,dyn} /var/log/named
 
 	fowners root:named /{etc,var}/bind /var/log/named /var/bind/{sec,pri,dyn}
-	fowners root:named /var/bind/named.cache /var/bind/pri/localhost.zone /etc/bind/named.conf
-	fperms 0640 /var/bind/named.cache /var/bind/pri/localhost.zone /etc/bind/named.conf
+	fowners root:named /etc/bind/{named.conf,named.conf.auth}
+	fperms 0640 /etc/bind/{named.conf,named.conf.auth}
 	fperms 0750 /etc/bind /var/bind/pri
 	fperms 0770 /var/log/named /var/bind/{,sec,dyn}
 
-	systemd_newunit "${FILESDIR}/named.service-r1" named.service
+	systemd_newunit "${FILESDIR}/named.service-r2" named.service
 	dotmpfiles "${FILESDIR}"/named.conf
 	exeinto /usr/libexec
 	doexe "${FILESDIR}/generate-rndc-key.sh"
 }
 
-python_install() {
-	emake DESTDIR="${D}" install
-	python_scriptinto /usr/sbin
-	python_optimize
-	# unifying bind with bind-tools, they share lots
-	# Let's get rid of those tools and their manpages since they're provided by bind-tools
-	rm -f "${ED}"/usr/share/man/man1/{dig,host,nslookup,delv,nsupdate}.1* || die
-	rm -f "${ED}"/usr/share/man/man8/nsupdate.8* || die
-	rm -f "${ED}"/usr/{,s}bin/{dig,host,nslookup,nsupdate,delv} || die
-
-	for tool in dsfromkey importkey keyfromlabel keygen revoke settime signzone verify; do
-		rm -f "${ED}"/usr/{,s}bin/dnssec-"${tool}" || die
-		rm -f "${ED}"/usr/share/man/man8/dnssec-"${tool}".8* || die
-	done
-}
-
 pkg_postinst() {
-	tmpfiles_process "${FILESDIR}"/named.conf
+	tmpfiles_process named.conf
 
-	if [[ ! -f '/etc/bind/rndc.key' && ! -f '/etc/bind/rndc.conf' ]]; then
-		if use urandom; then
-			einfo "Using /dev/urandom for generating rndc.key"
-			/usr/sbin/rndc-confgen -r /dev/urandom -a
-			echo
-		else
-			einfo "Using /dev/random for generating rndc.key"
-			/usr/sbin/rndc-confgen -a
-			echo
-		fi
-		chown root:named /etc/bind/rndc.key || die
-		chmod 0640 /etc/bind/rndc.key || die
+	if [[ -z ${ROOT} && ! -f ${EPREFIX}/etc/bind/rndc.key && ! -f ${EPREFIX}/etc/bind/rndc.conf ]]; then
+		einfo "Generating rndc.key"
+		"${EPREFIX}"/usr/sbin/rndc-confgen -a || die
+		chown root:named "${EPREFIX}"/etc/bind/rndc.key || die
+		chmod 0640 "${EPREFIX}"/etc/bind/rndc.key || die
 	fi
 
 	einfo
 	einfo "You can edit /etc/conf.d/named to customize named settings"
 	einfo
-	use mariadb || use postgres || use ldap && {
-		elog "If your named depends on MySQL/PostgreSQL or LDAP,"
-		elog "uncomment the specified rc_named_* lines in your"
-		elog "/etc/conf.d/named config to ensure they'll start before bind"
-		einfo
-	}
+
 	einfo "If you'd like to run bind in a chroot AND this is a new"
 	einfo "install OR your bind doesn't already run in a chroot:"
 	einfo "1) Uncomment and set the CHROOT variable in /etc/conf.d/named."
 	einfo "2) Run \`emerge --config '=${CATEGORY}/${PF}'\`"
 	einfo
 
-	CHROOT=$(source /etc/conf.d/named 2>/dev/null; echo ${CHROOT})
+	CHROOT=$(source "${EROOT}"/etc/conf.d/named 2>/dev/null; echo ${CHROOT})
 	if [[ -n ${CHROOT} ]]; then
 		elog "NOTE: As of net-dns/bind-9.4.3_p5-r1 the chroot part of the init-script got some major changes!"
 		elog "To enable the old behaviour (without using mount) uncomment the"
@@ -288,12 +213,25 @@ pkg_postinst() {
 		elog "/var/bind because bind will now mount the needed directories into"
 		elog "the chroot dir."
 	fi
+
+	# show only when upgrading to 9.18
+	if ver_replacing -lt 9.18; then
+		elog "As this is a major bind version upgrade, please read:"
+		elog "   https://kb.isc.org/docs/changes-to-be-aware-of-when-moving-from-bind-916-to-918"
+		elog "for differences in functionality."
+		elog ""
+		ewarn "In particular, please note that bind-9.18 does not need a root hints file anymore"
+		ewarn "and we only ship with one as a stop-gap. If your current configuration specifies a"
+		ewarn "root hints file - usually called named.cache - bind will not start as it will not be able"
+		ewarn "to find the specified file. Best practice is to delete the offending lines that"
+		ewarn "reference named.cache file from your configuration."
+	fi
 }
 
 pkg_config() {
-	CHROOT=$(source /etc/conf.d/named; echo ${CHROOT})
-	CHROOT_NOMOUNT=$(source /etc/conf.d/named; echo ${CHROOT_NOMOUNT})
-	CHROOT_GEOIP=$(source /etc/conf.d/named; echo ${CHROOT_GEOIP})
+	CHROOT=$(source "${EROOT}"/etc/conf.d/named; echo ${CHROOT})
+	CHROOT_NOMOUNT=$(source "${EROOT}"/etc/conf.d/named; echo ${CHROOT_NOMOUNT})
+	CHROOT_GEOIP=$(source "${EROOT}"/etc/conf.d/named; echo ${CHROOT_GEOIP})
 
 	if [[ -z "${CHROOT}" ]]; then
 		eerror "This config script is designed to automate setting up"
@@ -301,6 +239,7 @@ pkg_config() {
 		eerror "and set the CHROOT variable in '/etc/conf.d/named'."
 		die "Unset CHROOT"
 	fi
+
 	if [[ -d "${CHROOT}" ]]; then
 		ewarn "NOTE: As of net-dns/bind-9.4.3_p5-r1 the chroot part of the init-script got some major changes!"
 		ewarn "To enable the old behaviour (without using mount) uncomment the"
@@ -313,46 +252,37 @@ pkg_config() {
 
 	echo; einfo "Setting up the chroot directory..."
 
-	mkdir -m 0750 -p ${CHROOT} || die
-	mkdir -m 0755 -p ${CHROOT}/{dev,etc,var/log,run} || die
-	mkdir -m 0750 -p ${CHROOT}/etc/bind || die
-	mkdir -m 0770 -p ${CHROOT}/var/{bind,log/named} ${CHROOT}/run/named/ || die
+	mkdir -m 0750 -p "${CHROOT}" || die
+	mkdir -m 0755 -p "${CHROOT}"/{dev,etc,var/log,run} || die
+	mkdir -m 0750 -p "${CHROOT}"/etc/bind || die
+	mkdir -m 0770 -p "${CHROOT}"/var/{bind,log/named,run/named} "${CHROOT}"/run/named/ || die
 
 	chown root:named \
-		${CHROOT} \
-		${CHROOT}/var/{bind,log/named} \
-		${CHROOT}/run/named/ \
-		${CHROOT}/etc/bind \
+		"${CHROOT}" \
+		"${CHROOT}"/var/{bind,log/named,run/named} \
+		"${CHROOT}"/run/named/ \
+		"${CHROOT}"/etc/bind \
 		|| die
 
-	mknod ${CHROOT}/dev/null c 1 3 || die
-	chmod 0666 ${CHROOT}/dev/null || die
+	mknod "${CHROOT}"/dev/null c 1 3 || die
+	chmod 0666 "${CHROOT}"/dev/null || die
 
-	mknod ${CHROOT}/dev/zero c 1 5 || die
-	chmod 0666 ${CHROOT}/dev/zero || die
+	mknod "${CHROOT}"/dev/zero c 1 5 || die
+	chmod 0666 "${CHROOT}"/dev/zero || die
 
-	if use urandom; then
-		mknod ${CHROOT}/dev/urandom c 1 9 || die
-		chmod 0666 ${CHROOT}/dev/urandom || die
-	else
-		mknod ${CHROOT}/dev/random c 1 8 || die
-		chmod 0666 ${CHROOT}/dev/random || die
+	if [[ "${CHROOT_NOMOUNT:-0}" -ne 0 ]]; then
+		cp -a /etc/bind "${CHROOT}"/etc/ || die
+		cp -a /var/bind "${CHROOT}"/var/ || die
 	fi
 
-	if [ "${CHROOT_NOMOUNT:-0}" -ne 0 ]; then
-		cp -a /etc/bind ${CHROOT}/etc/ || die
-		cp -a /var/bind ${CHROOT}/var/ || die
-	fi
-
-	if [ "${CHROOT_GEOIP:-0}" -eq 1 ]; then
+	if [[ "${CHROOT_GEOIP:-0}" -eq 1 ]]; then
 		if use geoip; then
-			mkdir -m 0755 -p ${CHROOT}/usr/share/GeoIP || die
+			mkdir -m 0755 -p "${CHROOT}"/usr/share/GeoIP || die
 		elif use geoip2; then
-			mkdir -m 0755 -p ${CHROOT}/usr/share/GeoIP2 || die
+			mkdir -m 0755 -p "${CHROOT}"/usr/share/GeoIP2 || die
 		fi
 	fi
 
 	elog "You may need to add the following line to your syslog-ng.conf:"
 	elog "source jail { unix-stream(\"${CHROOT}/dev/log\"); };"
 }
-
diff --git a/net-dns/bind/files/named.cache-r3 b/net-dns/bind/files/named.cache-r4
index 4fb2143df524..860b808e119a 100644
--- a/net-dns/bind/files/named.cache-r3
+++ b/net-dns/bind/files/named.cache-r4
@@ -8,9 +8,9 @@
 ;           file                /domain/named.cache 
 ;           on server           FTP.INTERNIC.NET
 ;       -OR-                    RS.INTERNIC.NET
-; 
-;       last update:     November 16, 2017 
-;       related version of root zone:     2017111601
+;
+;       last update:     January 24, 2024
+;       related version of root zone:     2024012401
 ; 
 ; FORMERLY NS.INTERNIC.NET 
 ;
@@ -21,8 +21,8 @@ A.ROOT-SERVERS.NET.      3600000      AAAA  2001:503:ba3e::2:30
 ; FORMERLY NS1.ISI.EDU 
 ;
 .                        3600000      NS    B.ROOT-SERVERS.NET.
-B.ROOT-SERVERS.NET.      3600000      A     199.9.14.201
-B.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:200::b
+B.ROOT-SERVERS.NET.      3600000      A     170.247.170.2
+B.ROOT-SERVERS.NET.      3600000      AAAA  2801:1b8:10::b
 ; 
 ; FORMERLY C.PSI.NET 
 ;
diff --git a/net-dns/bind/files/named.conf-r8 b/net-dns/bind/files/named.conf-r9
index 39f9be267f37..62b34bc6e9a3 100644
--- a/net-dns/bind/files/named.conf-r8
+++ b/net-dns/bind/files/named.conf-r9
@@ -87,7 +87,6 @@ options {
 
 */
 
-	dnssec-enable yes;
 	//dnssec-validation yes;
 
 	/*
diff --git a/net-dns/bind/files/named.conf.auth b/net-dns/bind/files/named.conf.auth
new file mode 100644
index 000000000000..373a77b96018
--- /dev/null
+++ b/net-dns/bind/files/named.conf.auth
@@ -0,0 +1,33 @@
+//http local {
+//	endpoints { "/dns-query"; };
+//};
+
+options {
+	directory "/var/cache/bind";
+	pid-file "/run/named/named.pid";
+
+	listen-on { 127.0.0.1; };
+	listen-on-v6 { ::1; };
+	// dns-over-tls
+	listen-on port 853 tls ephemeral { 127.0.0.1; };
+	listen-on-v6 port 853 tls ephemeral { ::1; };
+	// dns-over-https
+	//listen-on port 443 tls ephemeral http local { 127.0.0.1; };
+	//listen-on-v6 port 443 tls ephemeral http local { ::1; };
+
+	allow-recursion {
+		none;
+	};
+	allow-transfer {
+		none;
+	};
+	allow-update {
+		none;
+	};
+};
+
+zone "example.com." {
+	type primary;
+	file "/var/bind/pri/db.example.com";
+	notify explicit;
+};
diff --git a/net-dns/bind/files/named.confd-r7 b/net-dns/bind/files/named.confd-r8
index 477a4806151d..2d2ef4b868f6 100644
--- a/net-dns/bind/files/named.confd-r7
+++ b/net-dns/bind/files/named.confd-r8
@@ -2,6 +2,9 @@
 #
 #OPTIONS=""
 
+# config file path
+NAMED_CONF="/etc/bind/named.conf"
+
 # Set this to the number of processors you want bind to use.
 # Leave this unchanged if you want bind to automatically detect the number
 #CPU="1"
@@ -26,23 +29,9 @@
 #CHROOT_NOCHECK=1
 
 # Default pid file location
-PIDFILE="${CHROOT}/run/named/named.pid"
+# use named.conf to specify pid-file location
 
 # Scheduling priority: 19 is the lowest and -20 is the highest.
 # Default: 0
 #NAMED_NICELEVEL="0"
 
-# Uncomment rc_named_use/rc_named_after for the database you need.
-# Its necessary to ensure the database backend will be started before named.
-
-# MySQL
-#rc_named_use="mysql"
-#rc_named_after="mysql"
-
-# PostgreSQL
-#rc_named_use="pg_autovacuum postgresql"
-#rc_named_after="pg_autovacuum postgresql"
-
-# LDAP
-#rc_named_use="ldap"
-#rc_named_after="ldap"
diff --git a/net-dns/bind/files/named.init-r13 b/net-dns/bind/files/named.init-r15
index 4240a09176b8..2bd52a773200 100644
--- a/net-dns/bind/files/named.init-r13
+++ b/net-dns/bind/files/named.init-r15
@@ -1,5 +1,5 @@
 #!/sbin/openrc-run
-# Copyright 1999-2014 Gentoo Foundation
+# Copyright 1999-2022 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 extra_commands="checkconfig checkzones"
@@ -11,7 +11,7 @@ depend() {
 	provide dns
 }
 
-NAMED_CONF=${CHROOT}/etc/bind/named.conf
+NAMED_CONF=${NAMED_CONF:-${CHROOT}/etc/bind/named.conf}
 
 OPENSSL_LIBGOST=${OPENSSL_LIBGOST:-0}
 MOUNT_CHECK_TIMEOUT=${MOUNT_CHECK_TIMEOUT:-60}
@@ -65,7 +65,7 @@ _umount() {
 _get_pidfile() {
 	# as suggested in bug #107724, bug 335398#c17
 	[ -n "${PIDFILE}" ] || PIDFILE=${CHROOT}$(\
-			/usr/sbin/named-checkconf -p ${CHROOT:+-t} ${CHROOT} ${NAMED_CONF#${CHROOT}} | grep 'pid-file' | cut -d\" -f2)
+			/usr/bin/named-checkconf -p ${CHROOT:+-t} ${CHROOT} ${NAMED_CONF#${CHROOT}} | grep 'pid-file' | cut -d\" -f2)
 	[ -z "${PIDFILE}" ] && PIDFILE=${CHROOT}/run/named/named.pid
 }
 
@@ -77,7 +77,6 @@ check_chroot() {
 		[ ! -d "${CHROOT}/etc/bind" ] || [ ! -d "${CHROOT}/var/bind" ] && return 1
 		[ ! -d "${CHROOT}/var/log/named" ] && return 1
 		[ ! -c "${CHROOT}/dev/null" ] || [ ! -c "${CHROOT}/dev/zero" ] && return 1
-		[ ! -c "${CHROOT}/dev/random" ] && [ ! -c "${CHROOT}/dev/urandom" ] && return 1
 		[ "${CHROOT_GEOIP:-0}" -eq 1 ] && [ ! -d "${CHROOT}/usr/share/GeoIP" ] && return 1
 		if [ ${OPENSSL_LIBGOST:-0} -eq 1 ]; then
 			if [ -d "/usr/lib64" ]; then
@@ -99,7 +98,7 @@ checkconfig() {
 		return 1
 	fi
 
-	/usr/sbin/named-checkconf ${CHROOT:+-t} ${CHROOT} ${NAMED_CONF#${CHROOT}} || {
+	/usr/bin/named-checkconf ${CHROOT:+-t} ${CHROOT} ${NAMED_CONF#${CHROOT}} || {
 		eerror "named-checkconf failed! Please fix your config first."
 		return 1
 	}
@@ -110,7 +109,7 @@ checkconfig() {
 
 checkzones() {
 	ebegin "Checking named configuration and zones"
-	/usr/sbin/named-checkconf -z -j ${CHROOT:+-t} ${CHROOT} ${NAMED_CONF#${CHROOT}}
+	/usr/bin/named-checkconf -z -j ${CHROOT:+-t} ${CHROOT} ${NAMED_CONF#${CHROOT}}
 	eend $?
 }
 
diff --git a/net-dns/bind/files/named.service-r1 b/net-dns/bind/files/named.service-r2
index 65fbdb941ca0..4ca34544fe61 100644
--- a/net-dns/bind/files/named.service-r1
+++ b/net-dns/bind/files/named.service-r2
@@ -4,7 +4,7 @@ After=network.target
 
 [Service]
 ExecStartPre=/usr/libexec/generate-rndc-key.sh
-ExecStartPre=/usr/sbin/named-checkconf -z /etc/bind/named.conf
+ExecStartPre=/usr/bin/named-checkconf -z /etc/bind/named.conf
 ExecStart=/usr/sbin/named -f -u named
 ExecReload=/usr/sbin/rndc reload
 ExecStop=/usr/sbin/rndc stop
diff --git a/net-dns/bind/metadata.xml b/net-dns/bind/metadata.xml
index 4aa013b40d72..0037cb5a79ff 100644
--- a/net-dns/bind/metadata.xml
+++ b/net-dns/bind/metadata.xml
@@ -1,31 +1,18 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
 <pkgmetadata>
-  <maintainer type="project">
-    <email>dev@liguros.net</email>
-    <name>Development</name>
-  </maintainer>
-  <maintainer type="person">
-    <email>zlogene@gentoo.org</email>
-    <name>Mikle Kolyada</name>
-  </maintainer>
   <maintainer type="person">
     <email>chutzpah@gentoo.org</email>
     <name>Patrick McLean</name>
   </maintainer>
-  <upstream>
-    <remote-id type="cpe">cpe:/a:isc:bind</remote-id>
-  </upstream>
   <use>
     <flag name="dnstap">Enables dnstap packet logging</flag>
-    <flag name="dnsrps">Enable the DNS Response Policy Service (DNSRPS) API, a mechanism to allow an external response policy provider</flag>
-    <flag name="dlz">Enables dynamic loaded zones, 3rd party extension</flag>
+    <flag name="doh">Enables dns-over-https</flag>
     <flag name="fixed-rrset">Enables fixed rrset-order option</flag>
-    <flag name="geoip2">Enable GeoIP2 API from MaxMind</flag>
     <flag name="gssapi">Enable gssapi support</flag>
-    <flag name="json">Enable JSON statistics channel</flag>
     <flag name="lmdb">Enable LMDB support to store configuration for 'addzone' zones</flag>
-    <flag name="urandom">Use /dev/urandom instead of /dev/random</flag>
+    <flag name="systemtap">Build support for profiling and tracing using <pkg>dev-debug/systemtap</pkg>
+    </flag>
   </use>
   <origin>baldeagleos-repo</origin>
 </pkgmetadata>
diff --git a/net-dns/nsd/Manifest b/net-dns/nsd/Manifest
index 065826a04d35..5bdfa7f80588 100644
--- a/net-dns/nsd/Manifest
+++ b/net-dns/nsd/Manifest
@@ -1,2 +1,2 @@
-DIST nsd-4.14.1.tar.gz 1616372 BLAKE2B fbeabc698f47832ee78cd2be9f8ffdc63d60700722095fc8623cc5d9ef9370b590f88d4c617432e6964734712cc0c8582908acb8be326476a524c21cd1a22d04 SHA512 17e5f7c72589a6e7467d1741459b7199a0b12f8eda9022ab64ab700bd6959a009af1d7dac45c352f5209553679462805883c6f3b3f6c8a1fa4c762160b27e766
 DIST nsd-4.14.2.tar.gz 1601116 BLAKE2B 2e71805ecc22549bdb6ddb8fcccb5ffaf241d0de9fe8fbdaa8b839473af413c3d0d794f458240d97a81a6b8db640f37c1c9dc0f7a59b90800bc2519c95100920 SHA512 deb7cae8ad5096d65aebdccf60165d44c0b33f6e4568f7f731c38c3d15fa6d4ea9e6edbadf9385784be0248ef8c60c972a0478560d366c11d1c8bf25db9b8002
+DIST nsd-4.14.2.tar.gz.asc 659 BLAKE2B 6faeb85caba54eeaf531ec321d888a993d291932762b24bd7cc1fb18f8c5a7e6bec1aa2fd26b5d1dffe75046c30e2283668cd4163a5dbfe2b50a44a641ceae8b SHA512 7bdd5f69725a35b9f02b635d6696d09bb7d9e3906d664dd31f015e6caafa6fa63e5ca57b20eef929b888cdc12201028d0690224908b2a4a2114dab12f7057d46
diff --git a/net-dns/nsd/files/nsd_munin_.patch b/net-dns/nsd/files/nsd-munin-gentoo-paths.patch
index 36162f9a8fb2..36162f9a8fb2 100644
--- a/net-dns/nsd/files/nsd_munin_.patch
+++ b/net-dns/nsd/files/nsd-munin-gentoo-paths.patch
diff --git a/net-dns/nsd/files/nsd.initd-r1 b/net-dns/nsd/files/nsd.initd-r1
deleted file mode 100644
index 2a97c6dea708..000000000000
--- a/net-dns/nsd/files/nsd.initd-r1
+++ /dev/null
@@ -1,59 +0,0 @@
-#!/sbin/openrc-run
-# Copyright 1999-2019 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-description="NSD is an authoritative-only, high performance, open source name server"
-extra_commands="configtest"
-extra_started_commands="reload"
-
-# these can be overridden in /etc/conf.d/nsd if necessary
-NSD_CONFIG="${NSD_CONFIG:-/etc/nsd/nsd.conf}"
-NSD_CHECKCONF="${NSD_CHECKCONF:-/usr/sbin/nsd-checkconf}"
-command="${NSD_BINARY:-/usr/sbin/nsd}"
-command_args="-c ${NSD_CONFIG}"
-
-depend() {
-	need net
-	use logger
-}
-
-get_pidfile() {
-	printf '%s' "$("${NSD_CHECKCONF}" -o pidfile "${NSD_CONFIG}")"
-}
-
-checkconfig() {
-	if ! test -e "${NSD_CONFIG}"; then
-		eerror "You need to create an appropriate config file."
-		eerror "An example can be found in /etc/nsd/nsd.conf.sample"
-		return 1
-	elif ! "${NSD_CHECKCONF}" "${NSD_CONFIG}"; then
-		eerror "You have errors in your configfile (${NSD_CONFIG})"
-		return $?
-	fi
-	return 0
-}
-
-configtest() {
-	ebegin "Checking ${SVCNAME} configuration"
-	checkconfig
-	eend $?
-}
-
-start_pre() {
-	checkconfig || return $?
-	pidfile="$(get_pidfile)"
-	checkpath --directory --owner nsd:nsd "${pidfile%/*}" || return 1
-}
-
-stop_pre() {
-	checkconfig || return $?
-	pidfile="$(get_pidfile)"
-}
-
-reload() {
-	checkconfig || return $?
-	pidfile="$(get_pidfile)"
-	ebegin "Reloading config and zone files"
-	kill -s HUP $(cat ${pidfile})
-	eend $?
-}
diff --git a/net-dns/nsd/files/nsd.service b/net-dns/nsd/files/nsd.service
deleted file mode 100644
index 8337557faeef..000000000000
--- a/net-dns/nsd/files/nsd.service
+++ /dev/null
@@ -1,14 +0,0 @@
-[Unit]
-Description=NSD authoritative DNS server
-Wants=network.target
-After=network.target
-
-[Service]
-Type=forking
-ExecStartPre=/usr/bin/install -d -o nsd -g nsd /run/nsd
-ExecStart=/usr/sbin/nsd
-KillMode=mixed
-PIDFile=/run/nsd/nsd.pid
-
-[Install]
-WantedBy=multi-user.target
diff --git a/net-dns/nsd/metadata.xml b/net-dns/nsd/metadata.xml
index 1e8f620646cd..3d56fab6dfd8 100644
--- a/net-dns/nsd/metadata.xml
+++ b/net-dns/nsd/metadata.xml
@@ -1,27 +1,31 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
 <pkgmetadata>
-  <maintainer type="project">
-    <email>dev@liguros.net</email>
-    <name>Development</name>
+  <maintainer type="person" proxied="yes">
+    <email>bacs@librecast.net</email>
+    <name>Brett A C Sheffield</name>
   </maintainer>
-  <maintainer type="person">
-    <email>polynomial-c@gentoo.org</email>
-    <name>Lars Wendler</name>
+  <maintainer type="project" proxied="proxy">
+    <email>proxy-maint@gentoo.org</email>
+    <name>Proxy Maintainers</name>
   </maintainer>
-  <upstream>
-    <remote-id type="cpe">cpe:/a:nlnetlabs:nsd</remote-id>
-  </upstream>
   <use>
-    <flag name="bind8-stats">Enables BIND8 like NSTATS and XSTATS</flag>
+    <flag name="bind8-stats">Enables BIND8 like NSTATS and XSTATS and statistics in nsd-control</flag>
     <flag name="dnstap">Enable the structured binary log format</flag>
+    <flag name="ipv6">Enable IPv6 support</flag>
     <flag name="libevent">Use libevent or libev, useful when zone count is high</flag>
+    <flag name="memclean">Cleanup memory (at exit) for eg. valgrind, memcheck</flag>
     <flag name="minimal-responses">If minimal responses are disabled, responses are more likely to get truncated, resulting in TCP fallback</flag>
+    <flag name="mmap">Use mmap(2) instead of malloc(3); currently experimental</flag>
+    <flag name="munin">Install a plugin for <pkg>net-analyzer/munin</pkg> to graph statistical data from nsd</flag>
     <flag name="nsec3">Enable NSEC3 support</flag>
+    <flag name="radix-tree">Use a radix tree for main lookups instead of a red-black tree</flag>
     <flag name="ratelimit">Enables ratelimiting, based on query name, type and source</flag>
-    <flag name="root-server">Configure NSD as a root server</flag>
-    <flag name="runtime-checks">Enable runtime checks, this could lead to a reduced service level</flag>
-    <flag name="munin">Install a plugin for <pkg>net-analyzer/munin</pkg> to graph statistical data from nsd.</flag>
+    <flag name="recvmmsg">Enable recvmmsg and sendmmsg compilation, faster but some kernel versions may have implementation problems for IPv6</flag>
+    <flag name="simdzone">Leverage SIMD instructions in modern CPUs to improve throughput</flag>
+    <flag name="tfo">Enable TCP Fast Open</flag>
+    <flag name="xdp">Enable support for XDP through <pkg>net-libs/xdp-tools</pkg>
+    </flag>
   </use>
   <origin>baldeagleos-repo</origin>
 </pkgmetadata>
diff --git a/net-dns/nsd/nsd-4.14.1.ebuild b/net-dns/nsd/nsd-4.14.1.ebuild
deleted file mode 100644
index e5750bc11c5a..000000000000
--- a/net-dns/nsd/nsd-4.14.1.ebuild
+++ /dev/null
@@ -1,117 +0,0 @@
-# Copyright 2021-2026 Liguros Authors
-# Distributed under the terms of the GNU General Public License v2
-EAPI=8
-
-inherit autotools systemd
-
-# version voodoo needed only for non-release tarballs: 4.0.0_rc1 => 4.0.0rc1
-MY_PV="${PV/_beta/b}"
-MY_PV="${MY_PV/_rc/rc}"
-MY_P="${PN}-${MY_PV}"
-
-DESCRIPTION="An authoritative only, high performance, open source name server"
-HOMEPAGE="http://www.nlnetlabs.nl/projects/nsd"
-SRC_URI="http://www.nlnetlabs.nl/downloads/${PN}/${MY_P}.tar.gz"
-LICENSE="BSD"
-SLOT="0"
-[[ "${PV}" == *_beta* ]] || [[ "${PV}" == *_rc* ]] || \
-KEYWORDS="~amd64 ~x86"
-IUSE="bind8-stats dnstap ipv6 libevent minimal-responses mmap munin +nsec3 ratelimit root-server runtime-checks ssl systemd "
-
-S="${WORKDIR}/${MY_P}"
-
-RDEPEND="
-	acct-group/nsd
-	acct-user/nsd
-	dnstap? (
-		dev-libs/fstrm
-		dev-libs/protobuf-c
-	)
-	libevent? ( dev-libs/libevent )
-	munin? ( net-analyzer/munin )
-	ssl? (
-		dev-libs/openssl:0=
-
-	)
-	systemd? ( sys-apps/systemd )
-"
-DEPEND="${RDEPEND}"
-BDEPEND="
-	sys-devel/flex
-	app-alternatives/yacc
-	systemd? ( virtual/pkgconfig )
-"
-
-PATCHES=(
-	# Fix the paths in the munin plugin to match our install
-	"${FILESDIR}"/nsd_munin_.patch
-)
-
-src_prepare() {
-	default
-	# Required to get correct pkg-config macros with USE="systemd"
-	# see bugs #663618 and #758050
-	eautoreconf
-}
-
-src_configure() {
-	local myeconfargs=(
-		--enable-largefile
-		--enable-pie
-		--enable-relro-now
-		--enable-tcp-fastopen
-		--with-dbfile="${EPREFIX}"/var/db/nsd/nsd.db
-		--with-logfile="${EPREFIX}"/var/log/nsd.log
-		--with-pidfile="${EPREFIX}"/run/nsd/nsd.pid
-		--with-xfrdfile="${EPREFIX}"/var/db/nsd/xfrd.state
-		--with-xfrdir="${EPREFIX}"/var/db/nsd
-		--with-zonelistfile="${EPREFIX}"/var/db/nsd/zone.list
-		--with-zonesdir="${EPREFIX}"/var/lib/nsd
-		$(use_enable bind8-stats)
-		$(use_enable bind8-stats zone-stats)
-		$(use_enable dnstap)
-		$(use_enable ipv6)
-		$(use_enable minimal-responses)
-		$(use_enable mmap)
-		$(use_enable nsec3)
-		$(use_enable ratelimit)
-		$(use_enable root-server)
-		$(use_enable runtime-checks checking)
-		$(use_enable systemd)
-		$(use_with libevent)
-		$(use_with ssl)
-	)
-	econf "${myeconfargs[@]}"
-}
-
-src_install() {
-	emake DESTDIR="${D}" install
-
-	dodoc doc/{ChangeLog,CREDITS,NSD-4-features,NSD-FOR-BIND-USERS,README,RELNOTES,REQUIREMENTS}
-
-	newinitd "${FILESDIR}"/nsd.initd-r1 nsd
-
-	# install munin plugin and config
-	if use munin ; then
-		exeinto /usr/libexec/munin/plugins
-		doexe contrib/nsd_munin_
-		insinto /etc/munin/plugin-conf.d
-		newins "${FILESDIR}"/nsd.munin-conf nsd_munin
-	fi
-
-	systemd_dounit "${FILESDIR}"/nsd.service
-
-	# remove the /run directory that usually resides on tmpfs and is
-	# being taken care of by the nsd init script anyway (checkpath)
-	rm -r "${ED}"/run || die "Failed to remove /run"
-
-	keepdir /var/db/${PN}
-}
-
-pkg_postinst() {
-	# database directory, writable by nsd for database updates and zone transfers
-	install -d -m 750 -o nsd -g nsd "${EROOT}"/var/db/nsd
-
-	# zones directory, writable by nsd for zone file updates (nsd-control write)
-	install -d -m 750 -o nsd -g nsd "${EROOT}"/var/lib/nsd
-}
diff --git a/net-dns/nsd/nsd-4.14.2.ebuild b/net-dns/nsd/nsd-4.14.2.ebuild
index e5750bc11c5a..baf3daa79d1b 100644
--- a/net-dns/nsd/nsd-4.14.2.ebuild
+++ b/net-dns/nsd/nsd-4.14.2.ebuild
@@ -1,97 +1,161 @@
-# Copyright 2021-2026 Liguros Authors
+# Copyright 1999-2026 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
-EAPI=8
 
-inherit autotools systemd
+EAPI=8
 
-# version voodoo needed only for non-release tarballs: 4.0.0_rc1 => 4.0.0rc1
-MY_PV="${PV/_beta/b}"
-MY_PV="${MY_PV/_rc/rc}"
-MY_P="${PN}-${MY_PV}"
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/nlnetlabs.asc
+inherit autotools systemd tmpfiles toolchain-funcs verify-sig
 
 DESCRIPTION="An authoritative only, high performance, open source name server"
-HOMEPAGE="http://www.nlnetlabs.nl/projects/nsd"
-SRC_URI="http://www.nlnetlabs.nl/downloads/${PN}/${MY_P}.tar.gz"
+HOMEPAGE="https://www.nlnetlabs.nl/projects/nsd/about/"
+
+if [[ ${PV} == *9999 ]] ; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/NLnetLabs/nsd.git"
+else
+	# Version voodoo needed only for non-release tarballs: 4.0.0_rc1 => 4.0.0rc1
+	MY_PV="${PV/_beta/b}"
+	MY_PV="${MY_PV/_rc/rc}"
+	MY_P="${PN}-${MY_PV}"
+
+	if [[ ${PV} != *_beta* && ${PV} != *_rc* ]] ; then
+		SRC_URI="
+				https://www.nlnetlabs.nl/downloads/${PN}/${MY_P}.tar.gz
+				verify-sig? ( https://www.nlnetlabs.nl/downloads/nsd/${MY_P}.tar.gz.asc )
+		"
+		S="${WORKDIR}"/${MY_P}
+
+		KEYWORDS="amd64 arm64 x86"
+		BDEPEND="verify-sig? ( >=sec-keys/openpgp-keys-nlnetlabs-20260101 ) "
+	fi
+fi
+
 LICENSE="BSD"
 SLOT="0"
-[[ "${PV}" == *_beta* ]] || [[ "${PV}" == *_rc* ]] || \
-KEYWORDS="~amd64 ~x86"
-IUSE="bind8-stats dnstap ipv6 libevent minimal-responses mmap munin +nsec3 ratelimit root-server runtime-checks ssl systemd "
-
-S="${WORKDIR}/${MY_P}"
+IUSE="+bind8-stats debug +dnstap +ipv6 libevent memclean minimal-responses mmap munin"
+IUSE+=" +nsec3 +radix-tree +ratelimit recvmmsg selinux +simdzone ssl systemd +tfo xdp verify-sig"
 
 RDEPEND="
 	acct-group/nsd
 	acct-user/nsd
 	dnstap? (
-		dev-libs/fstrm
-		dev-libs/protobuf-c
+		>=dev-libs/fstrm-0.4
+		dev-libs/protobuf-c:=
 	)
 	libevent? ( dev-libs/libevent )
 	munin? ( net-analyzer/munin )
-	ssl? (
-		dev-libs/openssl:0=
-
-	)
+	ssl? ( dev-libs/openssl:= )
 	systemd? ( sys-apps/systemd )
+	xdp? (
+		dev-libs/libbpf:=
+		net-libs/xdp-tools
+		sys-libs/libcap
+	)
 "
 DEPEND="${RDEPEND}"
-BDEPEND="
-	sys-devel/flex
+BDEPEND+="
+	app-alternatives/lex
 	app-alternatives/yacc
 	systemd? ( virtual/pkgconfig )
+	xdp? ( llvm-core/clang:*[llvm_targets_BPF] )
 "
+RDEPEND+=" selinux? ( sec-policy/selinux-nsd )"
 
 PATCHES=(
-	# Fix the paths in the munin plugin to match our install
-	"${FILESDIR}"/nsd_munin_.patch
+	"${FILESDIR}/${PN}-munin-gentoo-paths.patch"
 )
 
+NSD_DBDIR="/var/db/nsd"		# Default dir for NSD's databases.
+NSD_ZNDIR="/var/lib/nsd"	# Default dir for NSD's zone files.
+
+QA_EXECSTACK="
+	usr/lib/nsd/xdp-*.o
+"
+
 src_prepare() {
 	default
-	# Required to get correct pkg-config macros with USE="systemd"
-	# see bugs #663618 and #758050
-	eautoreconf
+
+	if [[ ${PV} == *9999 ]] ; then
+		# When building from git, the configure script and simdzone sources are missing
+		# See README.md
+		git submodule update --init || die "Could't update submodules"
+		autoreconf -fi || die "autoreconf -fi failed"
+	else
+		# Required to get correct pkg-config macros with USE="systemd".
+		# See bugs #663618 & #758050.
+		eautoreconf
+	fi
 }
 
 src_configure() {
-	local myeconfargs=(
-		--enable-largefile
-		--enable-pie
-		--enable-relro-now
-		--enable-tcp-fastopen
-		--with-dbfile="${EPREFIX}"/var/db/nsd/nsd.db
-		--with-logfile="${EPREFIX}"/var/log/nsd.log
-		--with-pidfile="${EPREFIX}"/run/nsd/nsd.pid
-		--with-xfrdfile="${EPREFIX}"/var/db/nsd/xfrd.state
-		--with-xfrdir="${EPREFIX}"/var/db/nsd
-		--with-zonelistfile="${EPREFIX}"/var/db/nsd/zone.list
-		--with-zonesdir="${EPREFIX}"/var/lib/nsd
+	local myconf=(
+		--cache-file="${S}"/config.cache
+
 		$(use_enable bind8-stats)
 		$(use_enable bind8-stats zone-stats)
+		$(use_enable debug checking)
 		$(use_enable dnstap)
 		$(use_enable ipv6)
+		$(use_enable memclean)
 		$(use_enable minimal-responses)
 		$(use_enable mmap)
 		$(use_enable nsec3)
+		--disable-packed
+		$(use_enable radix-tree)
 		$(use_enable ratelimit)
-		$(use_enable root-server)
-		$(use_enable runtime-checks checking)
+		$(use_enable recvmmsg)
 		$(use_enable systemd)
+		$(use_enable tfo tcp-fastopen)
+		$(use_enable xdp)
 		$(use_with libevent)
 		$(use_with ssl)
+
+		--with-cookiesecretsfile="${EPREFIX}${NSD_DBDIR}/cookiesecrets.txt"
+		--with-dbfile="${EPREFIX}${NSD_DBDIR}/nsd.db"
+		--with-dbdir="${EPREFIX}${NSD_DBDIR}"
+		--with-logfile="${EPREFIX}/var/log/nsd.log"
+		--with-pidfile="${EPREFIX}/run/nsd.pid"
+		# sharedfilesdir is used for xdp (bpf) objects
+		--with-sharedfilesdir="${EPREFIX}/usr/lib/nsd"
+		--with-xfrdfile="${EPREFIX}${NSD_DBDIR}/xfrd.state"
+		--with-xfrdir="${EPREFIX}${NSD_DBDIR}"
+		--with-zonelistfile="${EPREFIX}${NSD_DBDIR}/zone.list"
+		--with-zonesdir="${EPREFIX}${NSD_ZNDIR}"
 	)
-	econf "${myeconfargs[@]}"
+
+	# NSD 4.10.x introduced a new zone parser, "simdzone", which
+	# replaces the older parser that used flex & bison:
+	#   https://github.com/NLnetLabs/simdzone
+	# It leverages SSE4.2 and/or AVX2 instruction sets for faster
+	# zone parsing on x86_64 architectures.  Other CPU archs will
+	# use a fallback implementation.
+	if use amd64; then
+		myconf+=(
+			$(use_enable simdzone haswell)
+			$(use_enable simdzone westmere)
+		)
+	fi
+
+	# If the compiler indicates that time_t is at least 64-bits wide,
+	# then enable it in the package to support timestamps greater than
+	# the year 2038 (D_TIME_BITS=64).  This configure switch only
+	# appears on glibc-based userlands.
+	if use elibc_glibc && tc-has-64bit-time_t; then
+		myconf+=( --enable-year2038 )
+	fi
+
+	econf "${myconf[@]}"
 }
 
 src_install() {
 	emake DESTDIR="${D}" install
 
 	dodoc doc/{ChangeLog,CREDITS,NSD-4-features,NSD-FOR-BIND-USERS,README,RELNOTES,REQUIREMENTS}
+	newinitd contrib/nsd.openrc nsd
+	newconfd contrib/nsd.openrc.conf nsd
+	newtmpfiles contrib/nsd-tmpfiles.conf nsd.conf
 
-	newinitd "${FILESDIR}"/nsd.initd-r1 nsd
-
-	# install munin plugin and config
+	# Install munin plugin and config, if requested.
 	if use munin ; then
 		exeinto /usr/libexec/munin/plugins
 		doexe contrib/nsd_munin_
@@ -99,19 +163,28 @@ src_install() {
 		newins "${FILESDIR}"/nsd.munin-conf nsd_munin
 	fi
 
-	systemd_dounit "${FILESDIR}"/nsd.service
+	# Use the upstream-provided systemd service file.
+	systemd_dounit contrib/nsd.service
 
-	# remove the /run directory that usually resides on tmpfs and is
-	# being taken care of by the nsd init script anyway (checkpath)
+	# Remove the /run directory that usually resides on tmpfs and is
+	# being taken care of by the nsd init script anyway (checkpath).
 	rm -r "${ED}"/run || die "Failed to remove /run"
 
-	keepdir /var/db/${PN}
+	# BPF
+	dostrip -x /usr/lib/nsd
+
+	keepdir "${NSD_DBDIR}"
 }
 
 pkg_postinst() {
-	# database directory, writable by nsd for database updates and zone transfers
-	install -d -m 750 -o nsd -g nsd "${EROOT}"/var/db/nsd
+	# See eclass/tmpfiles.eclass for info.
+	tmpfiles_process nsd.conf
+
+	# Database directory
+	# Writable by nsd:nsd for database updates and zone transfers.
+	install -d -m 750 -o nsd -g nsd "${EROOT}/${NSD_DBDIR}"
 
-	# zones directory, writable by nsd for zone file updates (nsd-control write)
-	install -d -m 750 -o nsd -g nsd "${EROOT}"/var/lib/nsd
+	# Zones directory
+	# Writable by nsd:nsd for zone file updates (via 'nsd-control write').
+	install -d -m 750 -o nsd -g nsd "${EROOT}/${NSD_ZNDIR}"
 }
diff --git a/net-dns/nsd/nsd-9999.ebuild b/net-dns/nsd/nsd-9999.ebuild
new file mode 100644
index 000000000000..baf3daa79d1b
--- /dev/null
+++ b/net-dns/nsd/nsd-9999.ebuild
@@ -0,0 +1,190 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/nlnetlabs.asc
+inherit autotools systemd tmpfiles toolchain-funcs verify-sig
+
+DESCRIPTION="An authoritative only, high performance, open source name server"
+HOMEPAGE="https://www.nlnetlabs.nl/projects/nsd/about/"
+
+if [[ ${PV} == *9999 ]] ; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/NLnetLabs/nsd.git"
+else
+	# Version voodoo needed only for non-release tarballs: 4.0.0_rc1 => 4.0.0rc1
+	MY_PV="${PV/_beta/b}"
+	MY_PV="${MY_PV/_rc/rc}"
+	MY_P="${PN}-${MY_PV}"
+
+	if [[ ${PV} != *_beta* && ${PV} != *_rc* ]] ; then
+		SRC_URI="
+				https://www.nlnetlabs.nl/downloads/${PN}/${MY_P}.tar.gz
+				verify-sig? ( https://www.nlnetlabs.nl/downloads/nsd/${MY_P}.tar.gz.asc )
+		"
+		S="${WORKDIR}"/${MY_P}
+
+		KEYWORDS="amd64 arm64 x86"
+		BDEPEND="verify-sig? ( >=sec-keys/openpgp-keys-nlnetlabs-20260101 ) "
+	fi
+fi
+
+LICENSE="BSD"
+SLOT="0"
+IUSE="+bind8-stats debug +dnstap +ipv6 libevent memclean minimal-responses mmap munin"
+IUSE+=" +nsec3 +radix-tree +ratelimit recvmmsg selinux +simdzone ssl systemd +tfo xdp verify-sig"
+
+RDEPEND="
+	acct-group/nsd
+	acct-user/nsd
+	dnstap? (
+		>=dev-libs/fstrm-0.4
+		dev-libs/protobuf-c:=
+	)
+	libevent? ( dev-libs/libevent )
+	munin? ( net-analyzer/munin )
+	ssl? ( dev-libs/openssl:= )
+	systemd? ( sys-apps/systemd )
+	xdp? (
+		dev-libs/libbpf:=
+		net-libs/xdp-tools
+		sys-libs/libcap
+	)
+"
+DEPEND="${RDEPEND}"
+BDEPEND+="
+	app-alternatives/lex
+	app-alternatives/yacc
+	systemd? ( virtual/pkgconfig )
+	xdp? ( llvm-core/clang:*[llvm_targets_BPF] )
+"
+RDEPEND+=" selinux? ( sec-policy/selinux-nsd )"
+
+PATCHES=(
+	"${FILESDIR}/${PN}-munin-gentoo-paths.patch"
+)
+
+NSD_DBDIR="/var/db/nsd"		# Default dir for NSD's databases.
+NSD_ZNDIR="/var/lib/nsd"	# Default dir for NSD's zone files.
+
+QA_EXECSTACK="
+	usr/lib/nsd/xdp-*.o
+"
+
+src_prepare() {
+	default
+
+	if [[ ${PV} == *9999 ]] ; then
+		# When building from git, the configure script and simdzone sources are missing
+		# See README.md
+		git submodule update --init || die "Could't update submodules"
+		autoreconf -fi || die "autoreconf -fi failed"
+	else
+		# Required to get correct pkg-config macros with USE="systemd".
+		# See bugs #663618 & #758050.
+		eautoreconf
+	fi
+}
+
+src_configure() {
+	local myconf=(
+		--cache-file="${S}"/config.cache
+
+		$(use_enable bind8-stats)
+		$(use_enable bind8-stats zone-stats)
+		$(use_enable debug checking)
+		$(use_enable dnstap)
+		$(use_enable ipv6)
+		$(use_enable memclean)
+		$(use_enable minimal-responses)
+		$(use_enable mmap)
+		$(use_enable nsec3)
+		--disable-packed
+		$(use_enable radix-tree)
+		$(use_enable ratelimit)
+		$(use_enable recvmmsg)
+		$(use_enable systemd)
+		$(use_enable tfo tcp-fastopen)
+		$(use_enable xdp)
+		$(use_with libevent)
+		$(use_with ssl)
+
+		--with-cookiesecretsfile="${EPREFIX}${NSD_DBDIR}/cookiesecrets.txt"
+		--with-dbfile="${EPREFIX}${NSD_DBDIR}/nsd.db"
+		--with-dbdir="${EPREFIX}${NSD_DBDIR}"
+		--with-logfile="${EPREFIX}/var/log/nsd.log"
+		--with-pidfile="${EPREFIX}/run/nsd.pid"
+		# sharedfilesdir is used for xdp (bpf) objects
+		--with-sharedfilesdir="${EPREFIX}/usr/lib/nsd"
+		--with-xfrdfile="${EPREFIX}${NSD_DBDIR}/xfrd.state"
+		--with-xfrdir="${EPREFIX}${NSD_DBDIR}"
+		--with-zonelistfile="${EPREFIX}${NSD_DBDIR}/zone.list"
+		--with-zonesdir="${EPREFIX}${NSD_ZNDIR}"
+	)
+
+	# NSD 4.10.x introduced a new zone parser, "simdzone", which
+	# replaces the older parser that used flex & bison:
+	#   https://github.com/NLnetLabs/simdzone
+	# It leverages SSE4.2 and/or AVX2 instruction sets for faster
+	# zone parsing on x86_64 architectures.  Other CPU archs will
+	# use a fallback implementation.
+	if use amd64; then
+		myconf+=(
+			$(use_enable simdzone haswell)
+			$(use_enable simdzone westmere)
+		)
+	fi
+
+	# If the compiler indicates that time_t is at least 64-bits wide,
+	# then enable it in the package to support timestamps greater than
+	# the year 2038 (D_TIME_BITS=64).  This configure switch only
+	# appears on glibc-based userlands.
+	if use elibc_glibc && tc-has-64bit-time_t; then
+		myconf+=( --enable-year2038 )
+	fi
+
+	econf "${myconf[@]}"
+}
+
+src_install() {
+	emake DESTDIR="${D}" install
+
+	dodoc doc/{ChangeLog,CREDITS,NSD-4-features,NSD-FOR-BIND-USERS,README,RELNOTES,REQUIREMENTS}
+	newinitd contrib/nsd.openrc nsd
+	newconfd contrib/nsd.openrc.conf nsd
+	newtmpfiles contrib/nsd-tmpfiles.conf nsd.conf
+
+	# Install munin plugin and config, if requested.
+	if use munin ; then
+		exeinto /usr/libexec/munin/plugins
+		doexe contrib/nsd_munin_
+		insinto /etc/munin/plugin-conf.d
+		newins "${FILESDIR}"/nsd.munin-conf nsd_munin
+	fi
+
+	# Use the upstream-provided systemd service file.
+	systemd_dounit contrib/nsd.service
+
+	# Remove the /run directory that usually resides on tmpfs and is
+	# being taken care of by the nsd init script anyway (checkpath).
+	rm -r "${ED}"/run || die "Failed to remove /run"
+
+	# BPF
+	dostrip -x /usr/lib/nsd
+
+	keepdir "${NSD_DBDIR}"
+}
+
+pkg_postinst() {
+	# See eclass/tmpfiles.eclass for info.
+	tmpfiles_process nsd.conf
+
+	# Database directory
+	# Writable by nsd:nsd for database updates and zone transfers.
+	install -d -m 750 -o nsd -g nsd "${EROOT}/${NSD_DBDIR}"
+
+	# Zones directory
+	# Writable by nsd:nsd for zone file updates (via 'nsd-control write').
+	install -d -m 750 -o nsd -g nsd "${EROOT}/${NSD_ZNDIR}"
+}
diff --git a/net-dns/pdns-recursor/Manifest b/net-dns/pdns-recursor/Manifest
index 412e8221ea07..bc9a6064c75d 100644
--- a/net-dns/pdns-recursor/Manifest
+++ b/net-dns/pdns-recursor/Manifest
@@ -1,82 +1,139 @@
+DIST addr2line-0.24.2.crate 39015 BLAKE2B 57186d6b957542cd71a0aa19f1355dfaabe6efa19b853c42f306494728b03d1e3183efdb2d2c7734a3e2347cd83a985d004f50c097e06b7520bd152310532e9b SHA512 39cbec3c920ffc0f37584afb55e1cfe4f182e4415319a4e9bfe842360f102f7b9315f6171c0cf71ba0337123903e604096cd573fe98698a26c8eebc2376d965b
+DIST adler2-2.0.0.crate 13529 BLAKE2B ec575b0bf12e321399ac3a1d59fce4ddbeabcc60cb3d7c2f362cce23eb29b4ea836451372d6d88552a4435ae29bb41d6230d55f625a4359eace680b9b771d0ad SHA512 12d12579ad617cf1a94cf95ab9d3f5db566c3b2de4bd5735eccd83c668fdad0eff134c996b73c46cbb9f932837682043878b8cc4764191625e9f93ccffcce423
+DIST anstyle-1.0.10.crate 15725 BLAKE2B 36e656bd8f9c584f11fda5cfe0c2e24e8426b9e1b602aad34ed118ae6950a55440e292d2e0ff7615f5e4f466fd06f07536be198a59506a587d40cb0c4ede4f80 SHA512 621e7a89fad13db985f07375d316cf8efba57fd44ae18628a8049a65aefbaef27949f99317872e91e0922bb089a00234055199ea3167f80ae03d00ada4f75dea
 DIST anstyle-1.0.13.crate 17651 BLAKE2B 026d4163f4bc8d1677d0830dbe46fd335d18e50420d2d809a675609c1e020f7e3c5e69b8d0a7baf5f42fa2321b6230c619a93aaf8e02ceaef638f8006dbf479b SHA512 1a92c4bf6ff7262c0f5fe72ff66eaf11f0c84e84a06746767918903c0416ba5d33ac54ff9a2c6cde37e26bb2287675d3f0a8a7efa95eb013c9be388b8139661e
 DIST atomic-waker-1.1.2.crate 12422 BLAKE2B fc6632f3c9d719b1d24a1c8e05947d94028909d1c629b80576e176e567636dd4cca699c7e91cae2df63541da574146b3ce766374e93f0ee429bb5bc89a4d3cae SHA512 e07e58db7955791259d0ec00fc4d53318aefb4506e062914819c4220c6dc75fa11a7af0289b4653aa1f9041eb975a025635190de68b4800a0e91e33cdb0ba11c
+DIST backtrace-0.3.74.crate 88516 BLAKE2B 594b537f3860560bc790d04d72a91ea25bbf5f2494b9c43377129a8021c02d9c16471a223e518889775a816c45513b14bf097c453846b62302a58b59753a5fcb SHA512 00cb2be0626f0bf6ec8b8f525bb129d3ac74c386c5e46ee0f343edb78c863222521f8132876057a5a1facacf40792dea51f2f20e986b35f3a85bca3dcf5c1520
 DIST base64-0.22.1.crate 81597 BLAKE2B 6f216a560bd36e6e6b74e908344b457594cc768d9763070e269b56a14b150cbfc4b7f599d4c2a0a5f783638170ee132f0796fefb14fcac7fd73c58db0791007a SHA512 91cf2e4e7fc8815f9b8a86a7fa722a20eee3dc1dd57111b29e420de87ce7836bcdb1db01d3cafb9a977710ef63e7cc41b7772762323e68e0e832156858aace20
 DIST bytes-1.11.1.crate 78584 BLAKE2B 4985426ff626d880a0da3d592ba48d697c88a83f48177e2b7380cb55e736a43f3cdf662d99cf0908b599aa8eccfebff2910405559e490b71adcf3f078673cd72 SHA512 7933d18c1a2c1496add2c7193e92c3aa17029c530b7031604ccb7c77c68903f53cf7d41396448b32bdd4f540fef4b37564972dac7b225e6e2ca99cd61179a6ab
+DIST cc-1.2.11.crate 102015 BLAKE2B acfcb67307f0942fdf0052a3ac081b4b0ee200774ac36ac17d3a80bca55f2e70fe43c18e55c718513be8d0853fcb7cde2568caa4e1cf42e8ca71acff044da195 SHA512 07bd3ff83343b529eaf025172a4f3218ca3f6790f7bb7868127144a8ef2430c95d039fc585f0d7e2b61360de67b9990277b8256a6488f8f3d4ef48fed22edeaa
 DIST cc-1.2.49.crate 93145 BLAKE2B 9321ab03753e16411e7da066f9cf742705ea2e815b81e790d3821c08e7eebede083a73a14f3911331c623554bc61941b5d586a3f635c2da2e7dce82f24bafeb3 SHA512 2bb2913928a5456db746a8cdb78db942392779bad0a20f0c1df1c905f984b84756c2ff9663aa2729ab5d0b83df7a7317c7b86c27917417b5ce4196d29712ffa1
+DIST cfg-if-1.0.0.crate 7934 BLAKE2B e99a5589c11d79d77a4537b34ce0a45d37b981c123b79b807cea836c89fc3926d693458893baca2882448d3d44e3f64e06141f6d916b748daa10b8cc1ae16d1b SHA512 0fb16a8882fd30e86b62c5143b1cb18ab564e84e75bd1f28fd12f24ffdc4a42e0d2e012a99abb606c12efe3c11061ff5bf8e24ab053e550ae083f7d90f6576ff
 DIST cfg-if-1.0.4.crate 9360 BLAKE2B beadbfb273ee97cbb6e3740891fbace57511399ad203459b66b397587d794677a9515cde4e9ec4320c3795518bf1551d72b9a889f8ac4b225168f493288b7c19 SHA512 176e04df7ba783b7143bb84397b777f5c5a1305c08a5c3a218d4a66830620be89ed68992ba27686165bcd3fb2f34b2daf80b2a1d4b481ecc267c988e84d28e9d
+DIST clap-4.5.27.crate 55737 BLAKE2B f78ce2e47b6aed8ae698ad00e717e3dc5f06dd2bb97a0e11fe9e9e19f9346e1a2c54135b613f3cbc27c58d3eb32888b82bf4800e291095285af16bfe14d48ab9 SHA512 e07ff5781679b1da62b0bdf25a674b3d48e1c2d2691ebb7c674562b83ec715b5fb0ece2df0867b0c0d833428d61ce1b3cca976fbeb4bb014273a007453391839
 DIST clap-4.5.53.crate 62036 BLAKE2B 1d3b1e7e4ad3b8b837be18b63ed1a59b7e29bf2d0add211d96ec23ca97e48ea79a9802f7a2e08f9737d445b82adef252a5b69f8ef8c94fcaca88627eaaf0ea3c SHA512 2e700a46bdbf2afef7e56933629f3d7fae16021e02aeccf6b862a2c1a876e1f8ef52d927ba5a599ec04eb65d4ccade485d1de6ff50547df6df14bd8ad97daf2c
+DIST clap_builder-4.5.27.crate 168024 BLAKE2B 3d9a1c38974eb6b78649c37122780e3a5960084fd52612951e5b2419535d749db37bb01067cd7acf2ae7864fbfdbbcfdeedad58814904c19105834a4b949bef9 SHA512 77b0e968361bd348b95b5b2993d5d1a3a4f3dda5fa790598bcb5edd201e7ad487a9ed87f551d40c30343e3e0a30942273c07c7becc12b4b67ddf7395488d8265
 DIST clap_builder-4.5.53.crate 170811 BLAKE2B 44147b6f5c1af4ca234f81281a8ef0c44d7096e87a2b43d5099cf401d3a5cd319b250b0902a10271b25cbacab207545225549c67e7fe67f0914e4eb461db74a7 SHA512 3151926fa631c882a6a02381f428feb9e861834469229d53c222cfb2e14be8be1ec3836b57891d960d026e98ed5fab1d9fb12c475fd9cde43db7e621143a5ba8
+DIST clap_lex-0.7.4.crate 12858 BLAKE2B a5ecd50cc503157dd69746f3b6e9c288e0fe4f6d5d82271499f657134fd401fbe076255e2be6a23ed0b69daf3941c6429dad8b288223b0ad390a2c435575cdd1 SHA512 a2566868f4619679d3b74b70592ffa6a04b13e38e3196c56bb1dae8bea0c711bddbccd778d2aba3cc0ee074c9b1cc0335222818f0d47fb3cc8109cbc35bb992e
 DIST clap_lex-0.7.6.crate 13466 BLAKE2B 723f306a9ae6c1fedd6b85fade039cc2a1dba51aa4412972025e0ff1aa8f15742e090dec61df3ac17ea9aae426e96049a673f5b944cb164b649ec1809477ab88 SHA512 d248b65234f201b2cb867562ca3d8299e79d348874547639b31883c6eac8416d3d6394e5b0047ad74f1a2c37e7721375c76bcaed1e60d13c3f1937b20ad9c54e
 DIST codespan-reporting-0.13.1.crate 57424 BLAKE2B c1406558bea10a66cf979d5469002520210316971d86e75379f57bf954b228dab4a93176cae1ba55e7b880021539d87c35b20488373b94fc44ebceb86e34795e SHA512 876f4ba5dc3d7d0b201f6ea25effb787e01ebffb74bad88810aae8e293c3ac264c8c58bc81a20b29150040ecb755920695457ce8c0bb4a5b382552b5b44e6497
 DIST cxx-1.0.191.crate 233693 BLAKE2B bca9cf7fab7abd63975aa927ddd36467b6e043baba09d1fdf355755723b86d02053bd72d8b6e2079c6b1a3753680048f0d682387ee184ee77aba1192014d4c68 SHA512 88a3201900e8810b849f65983f6d11c4453792347f75a1a0b7641dde1715389706b7434e025ebee2bf89d4449733434ee7bb0b958c60a041919895b6a7b6fac3
+DIST cxx-1.0.192.crate 233787 BLAKE2B 600b2810d1e7e8e897c91736767adb52455324521180b9d5fc6021393921c94075aac4791908421520900f27cb62e6452ba1bc1c9922b8395b6e89268fc25051 SHA512 03355ce30d9dec2071ac19b016caf65cece1e2f4e6b8cae5e88577d7e99cec0703c229032fbb3fdd0afbb268bbb763be30784c9e2e0bde42ebbeeadf90395ecd
 DIST cxx-build-1.0.191.crate 99802 BLAKE2B ab89612e051130761a7548e5a78621038e3298dd50e36d1312bf596d3022b077df71a9eae9c05cfc391ae51d3466f2690bc790c2b0fa747280af92e90494b88a SHA512 d5ae9c535701f56477b1077120855699ce9628f4ab5a9a58dc292bece46a2e11c948d906c8f77b0bddef9cb08ff9a66aa855d13eb47f6908d302ce78e890cbfc
+DIST cxx-build-1.0.192.crate 99947 BLAKE2B c1fb15b62183c93f8abc9d7b1dc29bec415263ed8e6c23ad45b94dd11a4e09f5fa97521d493f91d29bba28638efebbcc4b7f3f12deab2c37e49108486524bc7d SHA512 8a126d19ab37dc85affac9db9806ee66abff3509074e7f0054658c3105a17218812a785c360132255c17765f711e40426bddcd0bb3378441d11fc43959464244
 DIST cxxbridge-cmd-1.0.191.crate 86917 BLAKE2B b1a9d18607ab3bdc180fbebd8f8903b321842cf1609912a17de385be1f811a976bd63837c4d457eda32690017878b0b4da53946138f46c38dbe2c2dfc7842846 SHA512 068a341bcc8c8e315b3af7ee5afe1ec7faa52b41c5069227756c19b68f817960af8ff3106e60dfdaf8c7d32feffd38605f41efe0aba6d94eec812b6a16379d4f
+DIST cxxbridge-cmd-1.0.192.crate 87055 BLAKE2B 6f1756fd409257cf707a1331b4b5543993a65d313b38e69959850ac8751d62ea0065067b743bce765dcc6d0c833c2d794789d3077422e8fdc46857b6a155ea86 SHA512 3dad9c16760c58c9fd3fd13bf65bf00f162c9ffc9be3fa6582f3cef6ed71875097b3ff5b839a383eb67505b31c85f82fed47686330dafa34c02b975cc266b2d9
 DIST cxxbridge-flags-1.0.191.crate 5431 BLAKE2B bc1fe9a6e294f2da5576d954a223673895f23681ec21d6f6f5afa34b62d2d0caec8f018729b0ddc0dd051ce0c5b2c2ade2b497fb13df7d54c153b77f1015cef8 SHA512 873a9bc565a14cd58db9758606f18b1638f1ccb75d279a3184cd2ebcc9dfe24ae31131f0ca260d8cdfc9b34c3bc26391b95062047676554bb54150726366efe4
+DIST cxxbridge-flags-1.0.192.crate 5429 BLAKE2B 0d1d21422a23d5062b56036ed21a903c798b9b8fdc0523e857b24f84e66d9ee0ee9a633cd2ad8311c76ea4aac342b45cd0f400a03034f78f36b07c1e3365913a SHA512 0e2008514f3e261c9ef134684bcb65438d436df1b78c68e342f5248c47517b03f869b34a7e67d5179fce26fb9730bd1c1e65d45a1198bb4d9e5191075dd8ec7e
 DIST cxxbridge-macro-1.0.191.crate 71516 BLAKE2B 8dfe76c7e95d6d32477d6cf5a33c466b2afa67e18f2692c8b89f2882b7e08c592658e3a6b1113413afebab7ab536093880b1095a983f2db910046993a552eeaf SHA512 2f8b7c7ab7f74b44d27786440fc66b942062c10856a4d4262c531c43b92f32f77eece3fd4efd07d01ce056ef0f7818fb629641f22add488ccf930e38b9247d58
+DIST cxxbridge-macro-1.0.192.crate 71999 BLAKE2B 6148a0c73bf53f9319ea4fc86d8b54f7f208838445b1820356b1c4af02f09ab4a2edc3491fe253e2be0f171ffcf7b89794c87b5c8044916b40f7d1f2c025c9a4 SHA512 5ecf9217833ca0bf9f3f8cd9e0da27bf9c832c3023bbb4c67d1dc3fcef02c8db9d261ac449ae91f7e2eba294ed0add637f38e37f62d949b94749a4c4e04da66b
+DIST equivalent-1.0.1.crate 6615 BLAKE2B 302d78069d9df05e78b53f0488a9e4eb98fa2bc1e21893dc8a0acf2234347ba7c4df4b9d6b380ae77d8ffb1074b9c790460fe2dae47318aa1c4fe4208244540a SHA512 b2bc60e804c1b02c461dcefcfd60fc37145af710d183ebe65f9a4d63f2b2072d23193f98dc550a9213c7fdc6a2a837af23b04a89294ebbb681a4aaf5d5031140
 DIST equivalent-1.0.2.crate 7419 BLAKE2B 7ce4fb7b911961cd4ccfb48323eea4952110a069789c6bd177a63391c270df861afadd00c07db7b22768f0864f320e429e0200c433284f528336e2f81d071eff SHA512 8e0e2dc070794a85b276e93f9e4a65d3bbb8587b33fda211c34479a0b88504c913d8bef9e84d7996254aeabe1efe4ff1ef6259ff4fe3f9ccb90dd90070b3e4d4
 DIST find-msvc-tools-0.1.5.crate 30942 BLAKE2B 25f061bfb8a195752109bd444deaebfd94228e52c6eb94396fff9ba9d450876a58bc4352158684c59d1a2cb2a13a32ecfa1e96f1d80ac0c63827bfd7f46d9c80 SHA512 71021ce1a16c454bdd30abbb937c2ca67ab28ffcf88574e3ab758683943b44a96312a53cd6f5b8e76c89284a0cedbf46edb606894af720e3612c812bed189ab8
+DIST fnv-1.0.7.crate 11266 BLAKE2B 81da85889c91b6567e0f555e37dd915f1bd919719d1ca10c31a6861d7aec29a49ae9c1e8bc500791bf9d6b8dbb318c096d04872c5872a4b1f7d45fbd8e12842d SHA512 2195a4b34a78e2dd9838caf0ee556bf87cbb4a8ef5505aac663b614eb59dcfc0c40f432463ede41ecca57bfe7711f72673d39a85fe03d426f1324097d5628334
 DIST foldhash-0.2.0.crate 23329 BLAKE2B 49af83a79ca7954f05d8a52566d7d20cbe057c89c2c767ef76b4c8d83bf099196d053054c8fbaac74da7fd5eb0224fe43731102f2f0bcb18ccdbc0c8150774c3 SHA512 1495281089a8a1b7bbacf8004a5e8051bb00bf37718e9ddce9d43e4e198f529135f864b6850ee4422456b0d4731ae58647f0a1aaae0d67921c389f5d108fc163
+DIST form_urlencoded-1.2.1.crate 8969 BLAKE2B 383d3a197b73fba199220b7708e16d770591ac16725faf4efc1a8c230c569c381870d4a11b8fba623e761e68f9d318630b22101d461e67dd26c67e13a73358a1 SHA512 c65104e2dc08fad572bb31f981700fd43dd29fcff42b01c7ccdbd3d4c23dec12360aed3f1b5fc4766fee386d418a65349b2941b8735f788cb0d35d631a6a8dd1
 DIST form_urlencoded-1.2.2.crate 9347 BLAKE2B e02670f9af81a09e8df16680dbb80708632ac9e708297fda2f821af8076fb827c011ff359d4ce50d5ddb8f4403d4e19f74a4b68d11441f32eabc6fa2e38b3b09 SHA512 07d27d852504e146d586d007b090e53cbe740da140859dfb7d647c83c1b55265a83ea0a0e514587699b1dc6b6ffea2fc913319bcc83b55ebe191801a3b429c8a
 DIST futures-channel-0.3.31.crate 31971 BLAKE2B 2a59ebb73f998ec307bef01e997bf2922556d6dea10e2e6e8da9e1b4cd05a8bcfeef01bc1cc57d79c39bbd98b8a0d26871dca5c7641a9d4e9c2bacbb3feb4eeb SHA512 87e49e661cb12c1e03a07d3c94ca9bf5954344a51fa11639a118f5a49877c883387343af54639ad80e7196062a77fa7c9b9aff9804fb1e6ea3d0eb09efc53c69
 DIST futures-core-0.3.31.crate 14318 BLAKE2B 613d16e4f18547e45ed0dd56a7b908306393e479c379ff64f358844eacb1f8d37008ffbbfe6b1a4ed184e501ee9214db149d9cca31651b7d353ab4a99c8f5ee1 SHA512 d2f4c2476c4f480f724a880ee16566fcdd545579d3cacd2f16745812eed9ac4a7a88d59d4a38b163ef466c6f6b612b9cb06308a09d52256506a8a90e358db935
 DIST futures-task-0.3.31.crate 11217 BLAKE2B 8c0e0aa0aa14bfc28e668af00a3fcc2532950ca865a9f3935717a4a3770cb60477cd8f4cd080675379315b649fbdc5fee9dce49502f0f24f44db481a24c884bf SHA512 4872fd2f24b07c626efc6fd76c01b44d56efecb9697f972d0877307b38d3ccb06277ff029df38981470ba1f8ac5f93086123ab3af44d3c49bd9c10b6c9158a81
 DIST futures-util-0.3.31.crate 162124 BLAKE2B 69ca647a261fe24f90a4221d8629169a8dc7eff9dd1c4e07cc700a52a8609ce9b8aa3974b9b09e1ee64d0121d7bcb3efeee6fc15983347aaa0b0b23b068afc34 SHA512 429b1de584546b931b17d475aacbdb0c14824a57d960c44e615aa808e8c0f9c126473e313a7150b3de87ea91b7eebebb1041509f61b3493fee8a9cd2c75c4df3
+DIST getrandom-0.2.15.crate 37163 BLAKE2B 7d534e799a4711d01c6553b8c9422dbf01e384a850fb0f7cd76e444628f2b96d28d0f5e8dae042f8081a2bf9340f57c558be50a6f22ed5fa6b0301a15898fb35 SHA512 04789a53d3f4a84862e1e8b2113641af67e471b468de1222470d5e6cef0015232463a2cf3c3518dc2a533b3983b175a7c8922da00665bcf71c1e4e279b67e6fb
 DIST getrandom-0.2.16.crate 40163 BLAKE2B cf95b380a610313eaf068fa210bdb4a9e0b9211321d708f9877cd9e1901df0f6b7f57462a4937da3419c7547ef300291deb5367f4dce4ff776e7f0d9d36dcd8d SHA512 6391d5322f8ce2ea7d14062d378ae2ffad66622afd58b9f1732e5314b27d3a554c8a008f6d0d133640f11d769ac51ea4acd24e40259e14e2ffce93d5c3c1eb1e
+DIST gimli-0.31.1.crate 279515 BLAKE2B c8924ce351af5b8f96ef757a189f7a9be14533c024d496c62037cd4eda790b3f6282cd3013ba82ecc83082acab1b60ea80b83e0fd5f8eeb381fd7f9df88ce0ee SHA512 b9c8c11547dc7420fe936b9f32a4f5ccf3bb68d1d9f39dedffd40d631360f6e032e719d858668826f1099b8a262e8096aa7ae1f6d7d3d7aaf47934d832715949
 DIST hashbrown-0.16.1.crate 147785 BLAKE2B c506e64340b65fb462545c52e85a192b21e33025c91adf1d8255e799e8a5743814c60be971db56c0b9b1208dff8147ed4a28d8e37caf8f5646fd367d8d0bc9d7 SHA512 0739f1b2101488f88778e221d86738ce557b8ae12470e2a4444099eb90d876382030d00e789dd4ee44dcd7833a87a6e570fa11ba5823beb1cab3a56784ec2669
+DIST http-1.2.0.crate 105932 BLAKE2B efc9fc4ccc4a622781ed895f77c1752baf34e82d249acf97687ac8d4260aeafb333040833d9f8df5916cb105cc8217c8f27ddd021636b9248ad551ebfe4d83a6 SHA512 2c8e7234ec3aa720c9dd762c0bb06367fbc39ea89446fc9d8d2e55052a4ac461559a20a8294c877879f3e94d5db06fe41e2cdbb9664ea7ab1bc8003abb038bb5
 DIST http-1.4.0.crate 106978 BLAKE2B 2d86379f0a0724f337496699587cfed11bc87794219b69ba9d00771f6e5c4a880c0db72fe11171f4130fd3640228381de22292e0610be6b121fdd0d2e3bc4987 SHA512 f85bed2e41ae4cb97a3bbd69392ec660c66e2f8eda2dadfdff6328986e68e4563fc04c7fbabf08b811f2be3dce3ed2ba84e1ef8974fdb587b11615a288e4c897
 DIST http-body-1.0.1.crate 6125 BLAKE2B e253f2c85c0553382db955ce9ed18072f8916738962083223f2466034803553818e7f5a11649ebf5ea9118e7ce1067bd9b999379a03a335b88c810bcd312cafc SHA512 3d9a711619e5b14d2188fa42bbd43653dceeeb7e172cbd96d36fdf37846fa2c1efa0fad019395a4fa6da2e139875934aa56caf7332dc40546095b0a774ca39bd
+DIST http-body-util-0.1.2.crate 12821 BLAKE2B 43ed71d7b7247d8d11f6f204bcac1b3b81c002cf7ec89e6c381554132293c11e6ca148cdf0dae8bc213409c9e0523dd388cdfc6f636dc1bc5ec7a0f7d3796dd2 SHA512 1f3eddc475791d860848041075d9df8a3d613c9761b2248364e406c84b070b9d2e4d7e8ced61d7445d97919d5cb96d5c1424e8298ddbe6069110c6d4a5c9246e
 DIST http-body-util-0.1.3.crate 16975 BLAKE2B 0914cdba8bcc09ba191bc5a05ee9ec13d8ab75530b25121bc34cbff970ab95ff59ecbdd7ba4f49d997b523dd6465f57fa6ad79a84f84de0e75b75a9db3813e9f SHA512 3aa8f63bc489773c01ec7bd8e4012b515d4f037649c405b519051fb43acebb0fafebb4a51a38308c842244e6d869d360885ab64ca7b43e2b9f0c52542c072bcd
+DIST httparse-1.10.0.crate 44882 BLAKE2B 20a070d3e5dbb752602a80ea1c620afd1c5bfd9cde7e05eece6515168a60e9bd38f2cd10b179ee369d5408b0eb911ad95d69df2c1f1144ca3ec573b57aeaa4f2 SHA512 0ed43a15585b49064ae6b745b7c17775db1d849911115448239fa70a0b6f1d5a1fb09e654c4c04af8d533d74865966bfb215135a133aefec89eac81f136709d6
 DIST httparse-1.10.1.crate 45190 BLAKE2B ce166e68e60434c9e5659b7fd8d2b014247e798be12bdd08ed1a28bd71d9aab4047f96c6179e00fdbeff8967d27ffcc9c9ad3b76a4fbc5791c68c14ab36ac31d SHA512 b9988b4657e54931a9f8beab694d938bca7c15783c7181059770e56a7cbff801531e96eaa396615f19b0d99c37f73b39194c6ae06df1309a02097ba13e33ffd0
 DIST httpdate-1.0.3.crate 10639 BLAKE2B ce0b401c69f76252639c10f6c2e4a823574a58565d7c5cc3633c72837aa4ec3630b34b148de4378ec498db196e3b2e1413ca0e5a4d9247855380fe19a8c20f94 SHA512 0586888fe89f40b838d5ceb083084d0b8058feff1d2933faedb96896dc86eec68b541a0374a508fd11b86eeadab3c62f88568ffe2c53206fad438373a50b2e5a
+DIST hyper-1.6.0.crate 153923 BLAKE2B c69d338d00dd9be80c910dae6b3b995918d862d6ee863e9f85442f0e45584a054056f51864313b8ca0068680d7667faac61d70adfe2e7d2db2346f608b45bb32 SHA512 8c30624f51fed280e909ca526284f81a0863e3ace05f20ce8117298f180efc1567e92f807895034d9ad83026059e4b90c5a3cfe527a3e9c99674489fd17fc6a8
 DIST hyper-1.8.1.crate 157353 BLAKE2B ddaf59d791c00f20eb177c762d16b5b5be6eadeef8d4d39847647ddf82d013070d97f4aa681d6cb91e200d320dd6da91d2e8a5652e3a58febbcc643c6f87a40b SHA512 b7a9638fcd74828b447966025b172899943ac8f9286860646e7fd073a796f32b0ccfea5d656d0e5c0c55b8a15db613370c0cd0341b55bdb15abaaaaf23b4c623
+DIST hyper-rustls-0.27.5.crate 34660 BLAKE2B de261692fa4765f3ffdf8c384250532a0747b2595c41fbbc1a01c69c2c8a68a87656572f70228ecadb4aea04851ea6e7a0ab7077d6ffbe75b1a15805e64fbcbf SHA512 6a2451be2f42880978b0236385e8775fdfc3f538d9642c7fd6993ce85b16d623357f97a8c2a328e76e31c76083a8be557a4e7447f34aa52b9e990f4c9680e193
 DIST hyper-rustls-0.27.7.crate 35435 BLAKE2B b833e2b7ca66a5c21a63ec82e5324cf7c743c63fc267cd1ddff2f47a8e00089e9cf2a08a805afe642f3d18c25c8ac5b9a238de04eedfd30622901680ee6034c8 SHA512 d0f4774ff4e0fe51c448a140e76765261d66ce1293c0ce521baa9a2e97731dd0774b2e6c54e19e673f05154daab710818184a440be0a46701bd08310afe8a2c6
+DIST hyper-util-0.1.10.crate 72887 BLAKE2B 9d8ae7445ea56505e19f57ad680020b748e943a5cc3eca7292c06d93be1b58499db5769b214687aba53a0e9aa6fff3b3f63d1623157350ea826cd2decaf8d0aa SHA512 0a16c5d8857cf522bd53017dac50e530ae685c512eb55221fd6808299c7d716815f7b8192f8a9a504421b938cc0536bd497c7388d2f70ebbd91c46b644496b2a
 DIST hyper-util-0.1.19.crate 112744 BLAKE2B f01324fe17898022a2a0d5b336c852b9ed2d4ee1a79ff204bbd9fe103568ee0630b6c462ecf2ef8a6767a3335720d0180fd9932d965c9e5edab9aba81541feb5 SHA512 23d40ee9baf105025eb20939c27ebcc636498e07f776bc1bb1085647ffd52fda8d019c2967ecdb43cc4d46777941a026ffdfa4eaae37e1f5e8a42228ac6c720c
 DIST indexmap-2.12.1.crate 100184 BLAKE2B 91003f759cb250cae5ea2a72a184bbf1d4647951dfec84d760daa7e29b07f634a6577331737b3a3faa608aa0617124672ba03478ee4892b196e9c0097871f29f SHA512 218c1b0f5e117374b73492dae870b0a41a863d5f3fadd1e01adc592fc2d55229ea1f7c428893d02d1be1b768413b07497fa2600606ee6039672a1a8e45bdc5c3
 DIST ipnet-2.11.0.crate 29718 BLAKE2B 5cfd0876d2c45de886a069fa564d5bd0d4bc53a62ba445692b35c12ad4e3197d9d42b51b14e31bf79e7b8ece129e4612dbf47c90ace5e2e5a9f0e478bd6a5b1c SHA512 9d3c42b5bd93a792ac09975b9ced105e6e8b1eb83bfe012aeabcaa3fc388ee2c5a0541d5cd6dae48dfb97cf82aa970316962d231b65298873136335ac3e5ddca
+DIST itoa-1.0.14.crate 11210 BLAKE2B b2d33dc384757963eab3ae7d80bb672d828a549967986e3af8c70fe71a0ad46c4a278da2db4dfccef99e804e6cd4934067e97c0697a33ac3302cafbc46eeb416 SHA512 ea2d38df373652ddacccd11e610dfdad4e3ae7f0d476514e6ac58092733c817bd834e8cd88c3bc4178dd5a646ba628ae626195e0aa407e8534ae3c2a7b049987
 DIST itoa-1.0.15.crate 11231 BLAKE2B 17c261baf95bff2f6cf0dbc33ab78ebbab0cf5dc56aeb7f8977377af868deb5957918f1763c2fe8c080e931489ea89ebcc16b3ebd976eeeb7663ff74989a1071 SHA512 158ca5dd4b04cb12d9292a4df63c72443adaf5aab1bd9aacdb964dc58878d847a64251f84897cb25c34648d4c973b44fef5b4c175d7c04cabc2c13b4631c2e42
+DIST libc-0.2.169.crate 757901 BLAKE2B 1012cf93d8975aa20fc3f2332e253426ff66be6aed63ace5292cc8568ee419b0f1a4b5b39ddbb78d9c2dfd8d72eb0d068c98faa229ab55556da5e674429f0e97 SHA512 c4566330a7967efc211edf31a23647d1a33aa51fc25aa4e9337716748c8fd4be0ae63679220ff2cf6e892f37d03bc5264c55e8f082eb82574a6ec1fa8e5e45ce
 DIST libc-0.2.178.crate 783720 BLAKE2B 72f5fecacf0494b3962ff893d647155af88e9942b14d110e521b25e5d65d95d41dc00f83431b82632a53c6e0ae7fd537d018d7bf29df65d5e56b908a893d77d0 SHA512 968b954e2edde88d14135decd9eaadc31ca1aad80529a6696591c06c4414d615c97ce0873f77bfebe08b862faa5f3cb79a6648ab90734d462bef06e06ea43dde
 DIST link-cplusplus-1.0.12.crate 8178 BLAKE2B 4705a5241ce7079880de179d35824f8058bec06743b6fe88d282283f037dc6f9eeb05ffc5e334e2ffe6b8d3ceb91810b385ff889952f1e3128dbcdf286143a63 SHA512 ea9fadb4f47de60e7200905f568fc962cd6d2b6fad652f1144ee3f5748874a422e1a3111ba999689f295b7fcc3ef19981d6ea52034ea2759aa23bec355cda911
+DIST memchr-2.7.4.crate 96670 BLAKE2B da38114beca670467c3e1fbf4e415af6f22d52e3223715d52e181babb89b872b46511563985bcc16d7ff4e82f812c6e83ad904b0fe2501b14445119dfa8240e6 SHA512 8d0e8b9c30208897d4b1b920f1bdcccd0c2b75d92a06abe4a1b2407938768abb6487d63de56c6a80419798fe69517210643dfaf11f5f5540185f0eccf220adb2
+DIST miniz_oxide-0.8.3.crate 61827 BLAKE2B ae8626de8711a8b7c2bce52d2e226a3e973ba6919ed33904883ae6287f848fcf40642afdb9ad71bba19db181fe9ea354c85cd81c1dad889588d5df8fcc99b9f2 SHA512 b79cd67a477851b18ed87c887bfd9f40f97059eb3fedbdc3a52eac66b5fcea42cae833eea39fd62becdb057b337f91d27f2087a407d02770feeaea934c0b1e1c
+DIST mio-1.0.3.crate 103703 BLAKE2B 0d2360e4ef45f37104208a31e9aa467d6db041dfeb97403a010a36e1e1427f51d97f8408948c75c0084e6c118f058267bfe87d36e7911cb37366f2b1ac6eb693 SHA512 2142edc7e9378fc3437110c85ba2cee9c9683e87034cd44275d2c389645979db53fbbc29fec304f1d8c8f0464ae17d2a5db1aa9215d696fa0282f5069700b1e2
 DIST mio-1.1.1.crate 105630 BLAKE2B db279c3e46108375f5391a5ebc3ae07e8ccbcc9f6a71aa41996adb862c5d2b965af3cb0da25becdadb16d401ae69ccf5a07e21b0b6fb36e07294633cdf690141 SHA512 0b1c82773f5cc3f33ccb80a2cfbd58e48ffac82934afa7d9ec632b36484f8a13a079802dd8a658dbc94fc158e597e4d7a2c02a799f7b506a7de98fe74e80e684
+DIST object-0.36.7.crate 329938 BLAKE2B 0b02cf2f44e99002909b38125edada1a259feae59fd0e5ef52001755b6878cac710c87c60fbafdbe405281e039f68572ea3d8093d16128899090fd70df7f2fa8 SHA512 dd69172349ecf51fd2351d32cc4453760ca1d15e854a1cf5ed99112032901a54b4645b24163b946deed11f81d3e3035e1a5afd8bff20f335dbd05eceab073478
+DIST once_cell-1.20.2.crate 33394 BLAKE2B 79dd394fcf1637adfef28b4159ec653c8b71d2bda0e0e36a940c04e3d87698f039dc30c97f26648ecf0d9742962f1f0a117568f7c705a8a3fc167085b0ca3e80 SHA512 bc6005bdab7a154c01e2203fb553a68695727475a9a882cf906d49c054ce886ad92cb491d380b6b9fe71a81b2fd690ce91c9a6cf8dfa8508470ac9acfc8a31c8
 DIST once_cell-1.21.3.crate 34534 BLAKE2B 3578aaef305cad2fdffdc40c392775a3540bfab3f3aeafd22466d9507bf8346b9fcc200929d48525b051070c0aaa423ecbcaa12868b34dca007991effb224166 SHA512 32a87506c6f4598f3ca2c88556014ef2093d5db9a08602335e847caa537a866492fa74c894e7e1da2e4289a1d3dbffcb90a9e37a4a1453203832f434b8206990
-DIST pdns-recursor-5.4.0.tar.xz 1392752 BLAKE2B 08d50ee80432b0a213b9710fd09476638e1ff110845b5c034751e565e5b3e6880658c0fa6eb769ab0e3ee69764fcce0b66923f8bcbe6e82c0084b13594722e45 SHA512 acc53b1583270302402d8c01a9f215cffda66690c0d11021c5aa6f9821556999246aed34390bfefc01d5d43a77e904800c812acba93ed8e66f99fbf763fbf383
+DIST pdns-recursor-5.3.6.tar.xz 1369856 BLAKE2B b760eb6c8f8099f5baa6c6f8b6aff3122f8077db11230b4a12352aa4c811e0ce42fc172384b06a289028c0a796b9a75323407d6ccedbcbd27469008c7cf38154 SHA512 1f53b47c18a940fe85d3693e26e323f39b323a97372bd2fb479d89e3a54e2720536c0369a1c5315198d78ea0868dde1d1ce47b6108a09c27ca0ec2372fc64eb8
 DIST pdns-recursor-5.4.1.tar.xz 1393844 BLAKE2B 5d35a68bd85d3798fa17615ec8908736b4fea4e07f57090a3aa3c10084abe55d8d25dd091a318215bf932a8cb180d116504f8ee414ce174a27cd515f4e868836 SHA512 70896397c80985f4ee4313b06e40187c3a4fc9d7e3c9e171943128fde5b000551f486ca9e9942e5640299cac39731c552f8d9c12a5a8cd5174f9e70dbf7f7e83
+DIST percent-encoding-2.3.1.crate 10235 BLAKE2B cf8e2fd7b359a05b7bdaf731f9ae84c7fe6f468a53482eb2db7f93dfdaab64ac812b3664899db260055a93449462e6d219c695942fc5b030517b197b4df9b95f SHA512 5951ea8315e52cf3acfbaa023cb9e13a136b114c54a7da0bd44619ae24cd2159d4a96469d7572a2fdabd94e19513a033387117d7ca81d0eb409fb383e4acda44
 DIST percent-encoding-2.3.2.crate 11583 BLAKE2B 58925243b23a6a1decc3d92c4ce17d06af5206844ad283b49e69e523ac0db2c36c3f4407af4104ab92c029c2581c228bdf416a054a2531191a9e912448ba4408 SHA512 495b4aac88a7a46420811671d6bd82817e4eb2fe51d5068d11c5b50d0d927895d54c855cb07d4f4ad5a2d42b22f9419ad0183c14781dbfa240804fd49761035a
 DIST pin-project-lite-0.2.16.crate 30504 BLAKE2B efd0b426fcc6ea8852bce499fac61f9755a11c6a2999cbec514f093ba7b3f94b1f2d437ee9abb243e31f3838ac1c74491a212851d7798eb249e209b35e015332 SHA512 971adfe54cfed304647fd944c1c915e78b37eaf0de3a582fb984a5e91f1b7d4db2cf0f53a9a64b64427062d4b41c0a36baddef782411a76ae3be0f8ca45f0718
 DIST pin-utils-0.1.0.crate 7580 BLAKE2B 457e1287202f16d1873b24bf4f1de1828300128c4ba3131758e64f9784d36d47365f22d85493c3a85d854f0d8dbb4c6cef3a0f5b064014dc03943e58b7ba9178 SHA512 828422b8440cc82ac6b0743e0112fa7540d437aed457564999092b1462cd7672cd6b1f0201b67075431aeedd3d9c5127468a3dd028744109944f7f023c82fd70
 DIST proc-macro2-1.0.103.crate 60024 BLAKE2B e5ce5f77838fd063b5615b1555db02175621135132de6aa7479d67fd0a34c15e8235290112a728f3251cf913a835bf0aafaf6930880511427143b63152047259 SHA512 9a6964a2ad24dbb1108b7018882ddb48cb6e6f652d1c5eed1cac94602539fc71f011a0a276765778df161edbd6387bf03a8505d93565e0c106f09e98d7d6efce
+DIST proc-macro2-1.0.93.crate 52388 BLAKE2B dae4493215b88f68cc485bc0ae80f0a48ebad68e0260839b1c367832d1ab778197bf040647b3fe36cfe9d5f7a496e05cd71b5914f531eb129c2d458d5f0be896 SHA512 1ae650e390e4f1b18d05f42d2ffcd025cabf72568a326cd85496c722600108b0aa0ab0161b39fcc931b8b302427f678650e703f4db57aa1a60f1751db881dc6c
+DIST quote-1.0.38.crate 31252 BLAKE2B a3836efbe5c21dec70c684002b47b8fc7cef643c82ee903b537a48bc0707a28106c4b33d98e60ff81e04c7520f7404b1dc4d49446e8d91dded517e476c36e1c2 SHA512 530c47c5e6372b508bf5b2b88a138408a7afa5ef52c47280ed20eccf39f8e97dfc1e0a18c1bd5472efcdc49a7a1e69566333a0a1b4c0b4f0e11e6a7a85bfe8af
 DIST quote-1.0.42.crate 31504 BLAKE2B a8106c0fe3953bcc2aa421516dfbaad6d6cb2ea839b2ce1447a45b8732dad40a921c2008b477bc0fa029dc0e0357a339db543b1f90bb9da77a5a3681fc16bed0 SHA512 6d55047312de6bab660459750c54213e986f0a80b4458fdb706c2fb3bab83b8239cd230dd9291662076d395c818a391142af1228ae3158cfa4960d6c74d531ba
+DIST ring-0.17.13.crate 1501917 BLAKE2B c4b032496d34f03e73d5ddf4bbdde0e9198de57459ee9d3038afc6510dde718dcaf9dd06a5801ef61d2cb950564e3b705f8a4c913b6a22d0fb9c99d2c7b4973d SHA512 62c8491a7c16d5b5a1b533842f4136e88038857409d11f3512249972d9aebb7a6097e587f3c0e08e833e18ce6a095add2f0eb7fd7bc148e537f0caffeb49d73f
 DIST ring-0.17.14.crate 1502610 BLAKE2B b33efb6d21931ab94f044373f24428e87015029a0e065071bfd901f8679d30944f6b27bf0325c77fc4bea7fcd935209087a349e5c279677bea73af6205725371 SHA512 88d38205dc1a1f89bd4ae887ec5c168e68a4b749b3ac0612674092331e99d14a9b8d0f4a98d72c1a3853bcc9da420402336da3ee053bedcfd598da8de93afa14
+DIST rustc-demangle-0.1.24.crate 29047 BLAKE2B 8248b014eedb26cdc0b748544ba91b9aae9c992a6f93b4d3ac256b78f691d572f8885a3575492ea556698a241d2759743968293079ca02bb6a5f318b0ed66dd4 SHA512 eb897c35300b87766e6105917a907fca1c5b1f7691fc03c6c1aaf38075ac883a73d1eb54a245d13ba59c7b0f0333d6543e23fc1b1c542fbbd5c750a84660b9e8
+DIST rustls-0.23.22.crate 341983 BLAKE2B e52cb0ddb9fcf635a778887f67bc5692bf9a18408ebe9c07c05883246b2e98f87f8abfa029ffab1656025cc0d30919955a747df8d91fc2f57193546ea7008d8a SHA512 0eb7ba40c0752e8b9b5ccfaa74d3c6575b3c8ab095b0e661bbb1b43cff334528c35bea5068bad2c154edb342425f6791c2651104ef4b0bc718121772b44d9090
 DIST rustls-0.23.35.crate 373700 BLAKE2B a4c219adfeed33e415f5cb3ca2d9df7980ed03bb43f2b1dc6f7f3b2723a69dd5d0a9d5f561d2d26da60f90a4106b54588b243c37baec7ec201df51e2abf411cd SHA512 f59f48bded60aad7b23e7c8c0f579713405ed7de45392f7984ceddaca42bc796f86674ec23b4576958042e699dd5a7ed82fac47923ae13dce930b7f3e8c0a039
+DIST rustls-pemfile-2.2.0.crate 25849 BLAKE2B dfb94a77fe9d86b17b0c6badc6b715f247e9aaf0b312bc9698dbe8d38fff281428ceaec2ec73bef8009667dd93536dda2bc7e7c49d194b36244dca38dd86d577 SHA512 1e69f0b72c6060eb0a54ec8a1cb51809525b053771a1d417892205f8f5dbcf4ba45250fc0d6a836e0cc8fede06d934f0a90c47d475cd8e066dcb3f7504ddaf17
+DIST rustls-pki-types-1.11.0.crate 63933 BLAKE2B 487099180f45163b87614a8ba7088f189547191ef628011911f76ae6f6aa615b16e969682e26f26ce47f52463def702395f2a5dcf6a1742a87fb7c6d559a2e59 SHA512 60a6d20b66b15f077cbded6abcbfbc8524a02229209a3a73ed676a218ecffa26e375ab086247c05aec826ad63bcd9d446748a061191fe2ba5d9f35ec05b698fb
 DIST rustls-pki-types-1.13.1.crate 34901 BLAKE2B ebe0a3ef59097ec96491337df232efc1644768ac1d7d9e465e9762a05282c072d9f6dbaf9dbca935405bcad48049f0a8b91db7b3182e16d4c5aca27f1b26033b SHA512 0357a3c66e31447fdf39ed9e29576e2dfbbb012171e71efe322c2cb13856e7441115936375555fb2f700e6a7bc97565c74dc4bc18f8b8b01d335357e220a2c1b
+DIST rustls-webpki-0.102.8.crate 204327 BLAKE2B 8db832f181b46bdecc419e1433dd5550bc181cbffa1961aa90b2533f92696ebe15d71d742225bf806e2dc3a4ebb110d48bf62b0677089df1eede6d5a072c0a28 SHA512 8cdd5d07bb8d6c3f0d1d6663babc3b7ccbe8c9b1463870a3dd095c67f46addf4097a715da796c70f1891ebc1d045ae7d7c3a352400e8bfd6687e6cddfd33b1ba
 DIST rustls-webpki-0.103.8.crate 85810 BLAKE2B a6af950b130e130c0959013662b7be31d73d1bd98e00f507a20a9d980d7b133ee9bdeeeffa6313cdc75a02bbf06e24a314431a6f1a460ac4e00e37d046604412 SHA512 934f630a0c8be9bdc41d491ff8c6cdeb225f180c77b7f1b242d0c4a61390fce7c925ffa09527e5cf872993384a6197ba4685dd0b7466241b4e1811a557366336
+DIST ryu-1.0.19.crate 48770 BLAKE2B 588ca156238ff7285edc90d62c41991f6ec6b732656ef874c4bd5723350d2db19eeae844fa8998123a26b34a7feba0ad897731d73cb4daa88a24a3587b860dbd SHA512 b80d07d609237e13ce1f8cbef5b16738308c540800c7ec18387aec876fb2204029754f20f1f273a0ea07f54dfbaa4595fd0a90044d09f124c1c99e46f1005a99
 DIST ryu-1.0.20.crate 48738 BLAKE2B b126085448cb58639a7b5867fe313dcaabaf19df478f67fcb6cf15b8e881a21e641878345e0bf1fea7d24b56b921e667fd26a39cb81fca7ea02585332068263f SHA512 329c581429d9b8baa7d9edd9cf20e23fb8002f339d9fb3d50ed4c7eb68fb19c1ba966d52a9c9602265ca5f59f2bd4393ddcb3a7ac20c64aee3096e137eb2a384
+DIST scratch-1.0.7.crate 7997 BLAKE2B cb92a93751d209c68cd003792e45365d186138a115b936f190ad22b33f87c1e1aea2bcd20937188ba496cbe709539bf5fc1d73c0760020e5159121e88c82aed8 SHA512 2cdd160a89844101b62b4d6c23a56d3f9089828b8914031ca973bcbdeffba41ee7d9fb2edb0736d5f8e19d3bf2b1491e8451ae8fe2525518939b2f5cc6310d55
 DIST scratch-1.0.9.crate 8170 BLAKE2B 6721a72718e299ae2e5bdca1d6bacf38dc57b1e4fcd42bbdaadac283a815e5644fc7c512871974009108f3a3781d1f6b720c101395c9d431e651ea3ab9e49e3a SHA512 718a3bdcfa9132fc222293d22c9a1b2a867a4d556194f148da60cc8d9bcc62cde9af2dfbfe104073f1b6eaefed19623a1fdf3eaec07835715f01a7c65e9c27bb
+DIST serde-1.0.217.crate 79019 BLAKE2B a0aacff795d34583365ddd469fa14c58a6cccf8afbb248210aaff3134c7ce6e34b3d03f437326d7c01b3e78f82a5d19c37ed9fa4372970d8b2793f2889288e1c SHA512 f97b3b54b9e99c9a027390405cc054c3072f49c92803a4ed5f5f69e76a179deda9d77993b645b3581437085912d881da88d0451b9e0da423c64033a23fdd8054
 DIST serde-1.0.228.crate 83652 BLAKE2B d1909d671ea6d5c2eb4ce34ee4493ecaf665d416111b4cac754b5d33b85f916296110bae7aa961efd987a2ceb4a31ba645752ce99dd28dedb9f1eecdd4d7b1b2 SHA512 9b645d6214203533b303fc5e88ad4f7686c22df084878d18a0209a92304a340fcb62fdde88a7080cf7a7348d47b9b363885c4e1da90dba08cc99ff620f375e97
 DIST serde_core-1.0.228.crate 63111 BLAKE2B 8a64e4627ad21a3d16dd37d53fb809d11171bf337ec16bb1223075cbf81b6b85cd1c8d19abadf42460d0fbea323e2f351eeb6ef823389d519121b74e68edb215 SHA512 43897e3a7ebdc85d81d1cb30cda8f0a11610f6f551529c8a21462c24fb83110652b462846aa3e1bed5fbf8b5d7927018845a524ee9e079e2c8acf2c687efd6c4
+DIST serde_derive-1.0.217.crate 57749 BLAKE2B 63b4930122d80d64492ba2718630513012202e42bbaa74510729ee66a0e72b8a1ad123784b479697ba562db43868f4bddfdf5e94bb3d744cd68a547471ba40aa SHA512 31020f4533d04b31ae125580a3c5093fad36438d324e2d9b063923aa8c125c654102ae7fbc3b3df892bb41db6b321962a23e0a37950e080055d715d15b18af76
 DIST serde_derive-1.0.228.crate 59605 BLAKE2B 166ee2f9ff9f7a0928d0a65a72db3d9226c377bca2a1771956e8ecd9c7faf0544673c9c21be2a5553e621b55c74c7b958052592a1cf6eb6427a2d4f3e3dc6bb8 SHA512 8bfdfeee10ee7ef0670972aa963ef63b13e8eb2c8a09b9e0b717f92551aa89b3dd2a0dcbae6ccf20a1caece07e6adb18f0db56fdac020e4e0281b0d24e376003
 DIST serde_yaml-0.9.34+deprecated.crate 65290 BLAKE2B 1c1f8c7dd1a7952948596d8c727fb6fd36426c7b80ddaba2e6065db7551757e6fb170c77373ba9784f6b32de9f8aec94f90e1c85df98b9ac1f75a7cc8e5da174 SHA512 64329436d18bc3b1a0737afff7c8727f7e04c71b2bf6022f597a45f0860fa3a678eac688f61f0bf7a7846f98809f427c9907625e1d00c8691c383043c1cffaca
 DIST shlex-1.3.0.crate 18713 BLAKE2B 18800c364d3a628f1a3125097ea82fe6286550c2997235df0bf8483a3906aacabc81308cb239887d46ba2f457cc6f8acd5aca78316707eea5098cd5666aea67d SHA512 5c8cedbe666a14b8a0874defb9208146ce64579cde52ed483e4a794cac5dde6a24bf8d684404edff582f842e1fd4fa3fbeddbe074f191e4ec4aa517aa456fe8a
+DIST smallvec-1.13.2.crate 35216 BLAKE2B 31a268aad595c06cdb078577a97b089dbea156a0df307a3e6aaaf4861bd9a680c5b11921da9dbdb1bcfe17d58c0cbede1ffe6bba3aef59b384fb1b9703c62d27 SHA512 a97c758b668e40ad9eb572e65feeae4954e09200a04ab92e26a13b48894381cd3a3d2571070c4b7a5e181182e1ede9688f990650342ec69ecfe1a264d234c679
 DIST smallvec-1.15.1.crate 38116 BLAKE2B 8dd779d7726694672945e928399e0459f4973d284a6c2d664c2fc757ebb1177658f47c812d9800e982479cbd7413fd4283c64a4d248ba5cff6397f96b758676e SHA512 c26b097a063353beedfcc921129cd0fb838c1c9420218993a05b2655b47b6ec16f11e0054312018658b4abd893beee140c5d2739401a5e5aea2e64575f237047
+DIST socket2-0.5.8.crate 56309 BLAKE2B 309e5a0e46d0b9debbbd6049a138e56b82df4fc0e9d1115745ed935eb40c81b004ad748844f641934e13b5b88773db5cc4a57fc9e61dc82b5322fa0232110864 SHA512 b7d03608a3d4cf3e2d1539b5a375412effcc96279e8f57668fa8cf67b3f0a3a6b611ea5e2e72f282460582954acbb5364320611f7798a11ec9e4833e53830b60
 DIST socket2-0.6.1.crate 58486 BLAKE2B 990bc645f361576edfeda680cd4b6a0a29d6de80bda1164954369aa572bd702db5d92cfd26e68842aa0978df351d9b52f2900a4bf1f6d4aa5bb0f31d259ff48e SHA512 cafaf371870a8d85bee30d1a8341c25ec023f6031eaae96f783f0486e2c9b0ff7a6d742d40500f9c772472805d8de9f36a163405a476c57b254249992a5477de
 DIST strsim-0.11.1.crate 14266 BLAKE2B 252a9ede4241b165525486aa8855dece37af77f5b28e0e1858c4a5d2047db9fa958328db10989234aad69463ab51b2303785ec056c63ea8c95bf95e111ddabf2 SHA512 0cebe0155a92640e56db9a599ae62078cbb32e1d2da8bfa67ed0e8f410a7558dfcf7b3c2720ff5913282e291ecf076aed9fe9bf84c8d44e814a642b1bed3335c
 DIST subtle-2.6.1.crate 14562 BLAKE2B 3cf4940b7a01f04715da1057f6a92b1043a6b86ab2ee7f9fee0337b680ff781201d330409460f6f90b3f81bb5fd4b563e17c762c6e824ba3b0af99e4ae7d66bd SHA512 f5946ebd9bcb8776ee3446abcbf4afb3cca5d8bd847cadda87e864333ac7ded537a3efa773e9648adf20ce4add2c1da85172cff88c1e1a3a6cb051401b00c6bd
 DIST syn-2.0.111.crate 302117 BLAKE2B 9fe6c0bbeb432d67f4c879956c505d160f7be418cd16b48a5430c1c4c4922251007e3d85bf219daa16a7e9d8f32c15fdc2ebd94bdfc762135cb27b897590d484 SHA512 f30fc819fc6c942cde044b6bbe608f96736070717f28da71ab4ff68aa9e780416829152da11a83513fbc0de88337c2157e4fd1e4a029ebcbb64daeaa54dbf768
+DIST syn-2.0.98.crate 297807 BLAKE2B b17e2bb4f151fba26debb722bda8e8677dcc4f57f0e88bec214f8b06e9b15c48731ca3f63d1453a44f34845c9895b3519008ce6cfb69746486324d7a8e0e0c20 SHA512 792dc70249d55face151b5481b0ebabbd3d290de78cff8b5dad8bee08e5a932ee22e54ca5fc5980e0b218197d19822c3672e02eb92ca74c8ac1328081d4d2cbf
 DIST termcolor-1.4.1.crate 18773 BLAKE2B 34676efbde8e242415857d6d40a287ae3459678d8222f5144faefb8c84d635686f640e79588d98635c8f25b7628ec6663a01b16e1e462705b5cba7e8b8e61f44 SHA512 b66aad157c4fa2985f764321d157dfb1f0325fd633811870db7919b5579bf7bc19fefe99e1c706cdfa67504c37dc2ca3d283e11d1bb516edcfaf1eb7747a778a
+DIST tokio-1.43.1.crate 828219 BLAKE2B 539e7f0e7ff36cde6c23f9671ef0267a34a839186736631d290e3d9b677267f82959d897a634ebffb0f74032e1e1c0bbcaa6a9b6b421b75bbdaa4182c6ab5f79 SHA512 3359878eefbd34294afb1362ce4430f631af8a4812af59da5a99306fe84c703cf34993c0b3453d6c55fa60ceb9446c1bc89f169367822342d8e12aa2e23a8439
 DIST tokio-1.48.0.crate 843434 BLAKE2B 4a2e3221f6820f2b092275fceef9bf295e35e445d81238f9f71679033b499610696d8882da118279b9cbb3fffb2383afbbf9cdded910546933072f70e77ffcca SHA512 7e275ed26e857d42255dd27e8704bcb0a5daa8658c5a00f9798f4522265006a91e04d6a06512a87f30e0ad090a1676c03d3b02fe8d60263e4ba793940a85b98b
+DIST tokio-rustls-0.26.1.crate 31214 BLAKE2B c5829570c90b5d4dffe73c8b3a5bcba799bc48e8b742ff10030805067201848c362fad9f4ff319b003eb734b078389a35420186e90a434464f45dc1b6b3391ad SHA512 0cee6b356ebc4be05c484d459ac457280f41401093ca942cc61a6e6514dd4a48b1cc921f7dc02f9c8bc34b751d4d40d6d4768b21193d5a12c38ebd140bad4896
 DIST tokio-rustls-0.26.4.crate 35430 BLAKE2B 97dadd1b4d8aebd2f862f05bf333c0af97b37c1055f0ae9a79b78bef4c8bd4c05c034d13e395346de1d83195609bfd45ca34e70d4c0e537a1e4e8078181c00f7 SHA512 c72fdd74c4b59ab7c8fe15ed73f827aed91a40360a6d82772d6ae2dc4affc590d2c58c1b7523be7249a2be7e3bc2513a0906c0ce53ce1288d5dac50e01199c7c
 DIST tower-service-0.3.3.crate 6950 BLAKE2B 32ca66bff783eeb015af982b539acb63c9d426b931832b27aa45088382712df3894132a9e6e96fe1ed9d0f9e582b7a25b33e0ab73711acb06b4e134e69158452 SHA512 770cbca46d8500ff36fe84a9a420beb84a0e893dbeaccdd93a3970e746c893b5d32580182ef3017662f421e4b2d71f079ed2cf1727dcd5fc3443a4484f9b43fd
+DIST tracing-0.1.41.crate 82448 BLAKE2B c056d938e001654e03efaec7a11eb8ecfbdfe9af2099271fcefa43f4f4683b40c59f7111fdf7f27df4da38bcbe94f1b2ac0abb6ec3d6e6a0d165b9fbb14da3a3 SHA512 dffb8d3a1375f1b9d5418550a46cb7b1d92b2cc8ffbccb430a38f7731547960775bb42798074186711847d256eee30fb3e74078b69cb36f28c07d9f231dbf96c
 DIST tracing-0.1.43.crate 90033 BLAKE2B 46ce9395fb01a9e095cddd69ac2c68515e4535628a55bda9e7504f72ddcfbadb498db8659e9618cac1c5d36ef5edfdc13cdadb1018fba445488ac13d9ea47072 SHA512 5c4add0fff3d0275141edf67924deda84c27677f5e1ebcc23fdc52ba4091e25b5fb341fe0028f0a502e1447b621928dba281100df154e5a33b2f8f4b5dbf4a4b
+DIST tracing-core-0.1.33.crate 63434 BLAKE2B bc36332ffe5f4c95ae2d12df43944bcf589746cdb923a39098e5f4007fd1f19d7c3bb115011ddc40c13e3ae0e5cfc9a59c49861824e99fed7430fd29479abacf SHA512 1c6f0cf3b7bd6c8f6316ed9ea0b315a619308de6cbf7e50e665a193cf8c3399b5227d4f145d83b10c7e01a2f9fbc83d16e108cf09b7fd6cef413aa5c1acf89ef
 DIST tracing-core-0.1.35.crate 63837 BLAKE2B 92c0dc3d9a0843cf71293c7d40e9b4db225982ddcd6456298dca711d1104ea6f5fde28ac3a2c223fdd6aa44942d54c1b88d210565acdb5db4a3b98a29835b3ed SHA512 30afe79d6f1e9ad945245db2ac870f6fdfa1ebd1674139778700dba5c7de2891f7d3cac0644e71c5a286868adb7dd6eb3a255e6e669e1cd06c46ff3d57d22036
 DIST try-lock-0.2.5.crate 4314 BLAKE2B e75c6c0d7c975e294e3d723e2fb023067530ad6db3c7bdbe89b9558764606fd1a74f0d1ba787d85266db1912dbeda85408e85646d0f7cb24496d743b7a18c705 SHA512 433db3c52f55d78220db414ef6a7367791dd66eac935f41dcda85ec9200f0eefeab6e8342e70aabe35c300069c0e7b7c4f8d63a2334b52a081cc98416371ef08
+DIST unicode-ident-1.0.16.crate 47684 BLAKE2B 0cdfea4b56bdfcb8288941f95a31e66f7922b7e1dfa8f5e6265f1051701d31bfbe6e0cefb0fbd33456e2fdff48f8da30580351309e19fbb5d2f2573c716965cc SHA512 9484a34a4e283f94e971fa9ec42528a62f2c056e702040da37dd9d9b794e16e14a408302d1ac26a850d0eadf0d0266d8ef5b80761490f7029240244a39878ec9
 DIST unicode-ident-1.0.22.crate 47919 BLAKE2B 766f52249631092af952df717e09e1eb0d2a8e87c45e65113f0b2b88b42e8b406a87241fadd368ceb9e13339362b48cdbbc6f699f95f448ab45dbbd861615d62 SHA512 81666679aaa2eebfe1429827fa2a88ee0b52bd69723067132c24252070133b3731287bcd880ba16d16274f038c7b27bcf637e9150b6cd955fb4ff49642078125
+DIST unicode-width-0.1.14.crate 271615 BLAKE2B dd2e1504caedecb5d37c397ba05446d3d762b8b6833a8032ebbc213e324d53d89db5e96ed2f7223096e5754d800b39a54105906effc88d9437d7acb9e7beb81e SHA512 3c58a18776aa82cc13c761789a47901616cd98a30356f93d7eb05ae457314209d0a66213e2bbfa5eb8b59be6beacf62438234ce8daafa31b128dbf7d5d6fcadb
 DIST unicode-width-0.2.2.crate 282768 BLAKE2B c03a04bb159969f32447c7823f50b2686c515dff4f7778d2cac07a87cb9488d44844b0bb0b51c6996d8fa1fcb65cf4e6a8a9e697d95c1be8373535bc8d7c4215 SHA512 a0ff6ccc1d154e5a100808d3109fe30afa048c3ff402f0a0de34dbff2d58a7403903002185b33bee7b04dcb578c9dea66225a8697f3cd997205680ae3abce965
 DIST unsafe-libyaml-0.2.11.crate 62101 BLAKE2B 7ba17f2c19d96fc8999448594ba67bfc0eceaff47a39e560f856d13229ad5e69a9c8ba8794ec814e6b7c3cb7d597b7c7a366c8e880f17c0efc6a03a5677d82bf SHA512 a42c95eaed1ae2e438d3ba19ccd92337327c34f6174a43db80e1f37c507154249c7510e93f81726890c6032c89fe21b1876582afb7fbb811e3931480c4727712
 DIST untrusted-0.9.0.crate 14447 BLAKE2B 8e9c3ae09435af0885bc4a6e3c8943805b48cfc00bdae228c7c43093254e1be15d7005d1026561ff369ec37865d8458203f421a9c89ae3db077f655449621aed SHA512 5929e4079c1c2ff933ae8d8f59a2ecc7a424e71a20d1b8821f75925af68bdf82604b024c008e5464b02e25ff093e561a352b685e755b3d0b27e4c30254689416
 DIST want-0.3.1.crate 6398 BLAKE2B bcc1384bbb86db27b5e082b29a8dd4d89c37b40f6cdec4df8a86c8d205b418468b6cd42a78bd14ebaba057b28e151c00b474c098d7596f49a823ce33510c13b9 SHA512 f93f765113f035e134b967e8eb3f4511b8e03e793a47899b614d826afac02348fc02865c298a10410ecec4eb64f35f66c22bcbdbe36ed0c4c1665dca1db4d526
+DIST wasi-0.11.0+wasi-snapshot-preview1.crate 28131 BLAKE2B fe501889f25d65e2d032f885cc50c4f8bf7dd70fd5cbc438de349838370d8699e9627b0a4fc76030ea9fe6d508f41d0c9928a875fdbc47e73bfb17241cf7b155 SHA512 043500ab28cd9cb779475255da5d109ebab7fccca72b64873dc28d77bc5a157ba8d96b9e8f05223b5b36c7089bb7b4ba87657fc69bac16b78972f897294a865f
 DIST wasi-0.11.1+wasi-snapshot-preview1.crate 28477 BLAKE2B bcc773ba28cbe8d820e9e9fbb275fb4451bc7f39b3bd88bcd93850bf2bdb5300489bd8eca27489ccc5f6269b00f4e1b505ae3a33a35d708cd5a414ad307be149 SHA512 29e3c903763db2580a15f50db487c5e1d4e90763e48d90a5b3f681e468a24f9df1a01773bd1ffa0e3cd293dd8cb4d6fbabfaa63c0e13889c811a56f4554ada49
 DIST winapi-util-0.1.11.crate 13368 BLAKE2B 164f49c84952ece6e566a9a23f32ddf34e16f3930ff531f8d7527bcc18768c9a118cbee748ae6a753a172b4ce8d0f22108142382992b2918b442387ee5904545 SHA512 cc1511c004c2a81da4d7a0414973f09ab711033fbbadfd597f56df2cc6c99b3c1822f0b8de1952e78400a88462b9050acd85d2e4b36db72254049a2d6f725a01
+DIST winapi-util-0.1.9.crate 12464 BLAKE2B 7fb9dd803fc2608c4e5bc75674472992d82da364f24c22072d5624d6ae6abc44abd3e3ea3c45a7558e045331f3d87572b306b4ab5de52c07ff3706e7f13c2a38 SHA512 c46b893f67ec6e36499b00736bb6b9421e0e2611e76784afa6da01d7ebd033df82f1be7cf8d871d541125d290983f98f26f759488ba9aface49efce8edd682e9
 DIST windows-link-0.2.1.crate 6133 BLAKE2B d1ca714178e6fe12bb3b4caeed9a52a36890989e77ae2dcd6f2d18ae4a21fb8479d304cdff63bb0a5f28acf44eaf104821cff83cd66b3a0406a5f33a800e3641 SHA512 afb0c87beb8914fd9a3e52db6f2f64a840470b9751b66c83892c24cb1c46cda63fb16b1aeafcaa5a1fc7c5ba01da46be63e5227cc108dede8b0bd27785498a6b
 DIST windows-sys-0.52.0.crate 2576877 BLAKE2B 69d6b560ccfc8f679e2678663ba606060d71fa28efa82c8aef8cceaa2c63b06f2052764d60163964f939649a26bbec6361ee4b094555e941fae92070db566980 SHA512 24ee0df246c2b456a4987a9124786a28acd358768cc7d1305bccd81bc5bb8822b81a03fb18d35174a520b911c6d9b685f81a34ab319fee13da3b985273584f03
+DIST windows-sys-0.59.0.crate 2387323 BLAKE2B 3110c8cd2bc005f8c95cd038a8d574af648dc19788fe4485f977376f92e36b911b1a542d669a07ae9cd4ea72a884ab01ec78b8a2b5587456eb202452d1d8fa0d SHA512 d35e009e979633a1f3c8468cd038bd5c8c0381405165ce03497decd7d9edaaac485d704487e4a61d9aaf4e4d011b4248408912df6a0044d50e8457259867e061
 DIST windows-sys-0.60.2.crate 2518479 BLAKE2B c2e2f614066e5a9d7ec461d9d25bd441188797ad85e1e923baeb0193e82f5c138ae7fb4ad0255d483f60f7a94e3f5cd8373d01b7485c052c9498937bc40da992 SHA512 a48aa1b66479451e431032737b63dc62eac6f63c251534e258de75bbee4858829faf5e641756566f00e153b08548ba32beb437b5ea42e9531e3fcbd8eb25209d
 DIST windows-sys-0.61.2.crate 2517186 BLAKE2B f4eab0b365aa1df8a353d634da5081237bef0f7b69f02ffcaba232a688e59dfe877c47114de64c81e3cbb929c2fea1143ed6bda56ce935e66d871a993ac29106 SHA512 e6c8f61f0724dafca7821ee9b9c07237ccfee69be269be2fa7318eb48b151285ecf63e860aa1fe303639222fe11268e3773f37c2dd79f923029af58c645edb3f
 DIST windows-targets-0.52.6.crate 6403 BLAKE2B eb98d0a8daeed5fe76e7fa8edb2743e2a3e77dfb9c4ea68605a6ab10532cb7cfc43bc1cea0180869445bd940be762a40136500e26b84ca88b5e0c502004c7a4c SHA512 d6d2dbd96096c6c396dba141a9817e377c35877f3b2fe58b2553280c7cfcb1ed6ee75bd4d62c9b882662de67ddaf0c1049b91530d29c94dd709c230e08eb895f
@@ -97,4 +154,5 @@ DIST windows_x86_64_gnullvm-0.52.6.crate 435707 BLAKE2B ab77dccd06328cdb00175f41
 DIST windows_x86_64_gnullvm-0.53.1.crate 787739 BLAKE2B b5e3aaba4ecd1e5e21a0b9ce5beaad3f9ef78249f21b3dbdb69af98d5f36d01f2ce65d3188788392b866f296548075857e2f904e30cb79db33fb3134fd78e946 SHA512 30b8919ee9ad36acfac4e28a3b22378ce11ee73d35de60dd9c9217adf14e85222da5526100b0252372e039e559a5bf734ba134b10f707657d542341056947588
 DIST windows_x86_64_msvc-0.52.6.crate 832564 BLAKE2B 8e9a3044654c6de99a9153e7cacd575474e7a8a3d883c67b02132af5d3fc99d03cd5f7a4dd666a3947451d11218e6acc6eb5e2526f012481106cc13453839719 SHA512 21944cd8e3a481b514509e73ae3f62722fe7ed380d37ea0c25f8fbdeba79174dd52ff65d898838da5df4197894b74e00f45d47489418e978753b4e55c7e623e7
 DIST windows_x86_64_msvc-0.53.1.crate 837950 BLAKE2B 5775d30ce763835fa26376d85e9ae6f598b817b8d32b01147e5d197c364a5071ce7b5b09ee6f611fcf30790af79c4e4282e04ced620190629eebcbccabb8d720 SHA512 bb724f4051db90ce49b552021e746769e5dfe3792b522416539960c27f9ace14f63c47f0f240d6563257377129b5f3ba2c262c6fea9610428aa860fe035f189c
+DIST zeroize-1.8.1.crate 20029 BLAKE2B 092eba034cd35ec47290020e0c2b213177ff5dbe14ab9e7f0b4ef3cb1ecbc42fbec2b951414e26ab00bc65aaddc2c93eddd5a1963b27c6cd613ac71c65d5cc24 SHA512 dd40ebe98b98fd742608d4066b5ab66caba94b2e679428fcaff9fe547d8cd6ff2360dc85d671ee9183e32fb79cb554d00d6aef9eb8f3d8ad0ec92d0435aa4ebe
 DIST zeroize-1.8.2.crate 20907 BLAKE2B f9233758bde107e2409b56e936e02f51442ff29dfb2589c0b194edb38645421b4b8e6064208f7548a93836149c425de90c08792288e5cea1ae117911406bcdd5 SHA512 ce1fb97ac69cb0792f2f5820919aaa0a9f71c4b410bd0d0c2343d8415d39e3eec3f948cc2769eaf639c14695a3961fb6cd96ba7a77a15a77924d1a8c16497b81
diff --git a/net-dns/pdns-recursor/files/pdns-recursor-r2 b/net-dns/pdns-recursor/files/pdns-recursor-r3
index 01ce79167bbc..02f8408e275b 100644
--- a/net-dns/pdns-recursor/files/pdns-recursor-r2
+++ b/net-dns/pdns-recursor/files/pdns-recursor-r3
@@ -1,13 +1,9 @@
 #!/sbin/openrc-run
-# Copyright 1999-2020 Gentoo Authors
+# Copyright 1999-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 PDNS_CONFIGDIR="${PDNS_CONFIGDIR:-/etc/powerdns}"
-
-PDNS_CONFIG="${PDNS_CONFIGDIR}/recursor.conf"
-PDNS_CHROOTDIR="$( awk -F = '$1 == "chroot" { print $2 }' "${PDNS_CONFIG}" )"
-PDNS_SOCKETDIR="$( awk -F = '$1 == "socket-dir" { print $2 }' "${PDNS_CONFIG}" )"
-[ -z "${PDNS_SOCKETDIR}" -a -z "${PDNS_CHROOTDIR}" ] && PDNS_SOCKETDIR="/var/run/pdns-recursor"
+[ "${RC_SVCNAME}" != "pdns-recursor" ] && PDNS_INSTANCE="${RC_SVCNAME#pdns-recursor.}" || PDNS_INSTANCE=""
 
 name="PowerDNS Recursor"
 description="Recursive name server"
@@ -16,13 +12,11 @@ extra_started_commands="ping"
 description_ping="Ping the PowerDNS instance"
 
 command="/usr/sbin/pdns_recursor"
-command_args="--config-dir=${PDNS_CONFIGDIR} --write-pid=yes"
+command_args="--config-dir=${PDNS_CONFIGDIR}${PDNS_INSTANCE:+ --config-name=${PDNS_INSTANCE}} --write-pid=yes"
 command_args_foreground="--daemon=no"
 command_args_background="--daemon=yes"
 yesno ${rc_verbose} || command_args_background="${command_args_background} >/dev/null 2>&1"
 
-pidfile="${PDNS_CHROOTDIR}/${PDNS_SOCKETDIR}/pdns_recursor.pid"
-
 control_command="/usr/bin/rec_control"
 control_command_args="${command_args}"
 
@@ -30,10 +24,6 @@ depend() {
 	need net
 }
 
-start_pre() {
-	checkpath --directory --mode 750 "${PDNS_CHROOTDIR}/${PDNS_SOCKETDIR}"
-}
-
 ping() {
 	ebegin "Pinging ${name}"
 	${control_command} ${control_command_args} ping >/dev/null 2>&1
diff --git a/net-dns/pdns-recursor/metadata.xml b/net-dns/pdns-recursor/metadata.xml
index bd7456b179bc..45f5e802ec10 100644
--- a/net-dns/pdns-recursor/metadata.xml
+++ b/net-dns/pdns-recursor/metadata.xml
@@ -1,10 +1,6 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
 <pkgmetadata>
-  <maintainer type="project">
-    <email>dev@liguros.net</email>
-    <name>Development</name>
-  </maintainer>
   <maintainer type="person">
     <email>swegener@gentoo.org</email>
     <name>Sven Wegener</name>
@@ -18,12 +14,9 @@ caches server performance and timeouts, making it both network and user friendly
 It also has built-in hooks for making graphs with rrdtool, providing insight into
 nameserver performance.
 </longdescription>
-  <upstream>
-    <remote-id type="cpe">cpe:/a:powerdns:recursor</remote-id>
-  </upstream>
   <use>
+    <flag name="dns-over-tls">Enable support for DNS over TLS</flag>
     <flag name="dnstap">Enable support for dnstap</flag>
-    <flag name="protobuf">Enable support for <pkg>dev-libs/protobuf</pkg>.</flag>
     <flag name="sodium">Use <pkg>dev-libs/libsodium</pkg> for cryptography</flag>
   </use>
   <origin>baldeagleos-repo</origin>
diff --git a/net-dns/pdns-recursor/pdns-recursor-5.3.6.ebuild b/net-dns/pdns-recursor/pdns-recursor-5.3.6.ebuild
new file mode 100644
index 000000000000..334d5046283b
--- /dev/null
+++ b/net-dns/pdns-recursor/pdns-recursor-5.3.6.ebuild
@@ -0,0 +1,193 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+
+LUA_COMPAT=( lua5-{1,3,4} luajit )
+
+RUST_MIN_VER="1.82"
+CRATES="
+	addr2line@0.24.2
+	adler2@2.0.0
+	anstyle@1.0.10
+	backtrace@0.3.74
+	base64@0.22.1
+	bytes@1.11.1
+	cc@1.2.11
+	cfg-if@1.0.0
+	clap@4.5.27
+	clap_builder@4.5.27
+	clap_lex@0.7.4
+	codespan-reporting@0.13.1
+	cxx@1.0.192
+	cxx-build@1.0.192
+	cxxbridge-cmd@1.0.192
+	cxxbridge-flags@1.0.192
+	cxxbridge-macro@1.0.192
+	equivalent@1.0.1
+	fnv@1.0.7
+	foldhash@0.2.0
+	form_urlencoded@1.2.1
+	futures-channel@0.3.31
+	futures-core@0.3.31
+	futures-task@0.3.31
+	futures-util@0.3.31
+	getrandom@0.2.15
+	gimli@0.31.1
+	hashbrown@0.16.1
+	http@1.2.0
+	http-body@1.0.1
+	http-body-util@0.1.2
+	httparse@1.10.0
+	httpdate@1.0.3
+	hyper@1.6.0
+	hyper-rustls@0.27.5
+	hyper-util@0.1.10
+	indexmap@2.12.1
+	ipnet@2.11.0
+	itoa@1.0.14
+	libc@0.2.169
+	link-cplusplus@1.0.12
+	memchr@2.7.4
+	miniz_oxide@0.8.3
+	mio@1.0.3
+	object@0.36.7
+	once_cell@1.20.2
+	percent-encoding@2.3.1
+	pin-project-lite@0.2.16
+	pin-utils@0.1.0
+	proc-macro2@1.0.93
+	quote@1.0.38
+	ring@0.17.13
+	rustc-demangle@0.1.24
+	rustls@0.23.22
+	rustls-pemfile@2.2.0
+	rustls-pki-types@1.11.0
+	rustls-webpki@0.102.8
+	ryu@1.0.19
+	scratch@1.0.7
+	serde@1.0.217
+	serde_derive@1.0.217
+	serde_yaml@0.9.34+deprecated
+	shlex@1.3.0
+	smallvec@1.13.2
+	socket2@0.5.8
+	strsim@0.11.1
+	subtle@2.6.1
+	syn@2.0.98
+	termcolor@1.4.1
+	tokio@1.43.1
+	tokio-rustls@0.26.1
+	tower-service@0.3.3
+	tracing@0.1.41
+	tracing-core@0.1.33
+	try-lock@0.2.5
+	unicode-ident@1.0.16
+	unicode-width@0.1.14
+	unsafe-libyaml@0.2.11
+	untrusted@0.9.0
+	want@0.3.1
+	wasi@0.11.0+wasi-snapshot-preview1
+	winapi-util@0.1.9
+	windows-sys@0.52.0
+	windows-sys@0.59.0
+	windows-targets@0.52.6
+	windows_aarch64_gnullvm@0.52.6
+	windows_aarch64_msvc@0.52.6
+	windows_i686_gnu@0.52.6
+	windows_i686_gnullvm@0.52.6
+	windows_i686_msvc@0.52.6
+	windows_x86_64_gnu@0.52.6
+	windows_x86_64_gnullvm@0.52.6
+	windows_x86_64_msvc@0.52.6
+	zeroize@1.8.1
+"
+
+inherit cargo flag-o-matic lua-single
+
+DESCRIPTION="The PowerDNS Recursor"
+HOMEPAGE="https://www.powerdns.com/"
+SRC_URI="https://downloads.powerdns.com/releases/${P/_/-}.tar.xz ${CARGO_CRATE_URIS}"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="amd64 ~arm x86"
+IUSE="debug dns-over-tls dnstap snmp sodium systemd test valgrind"
+REQUIRED_USE="${LUA_REQUIRED_USE}"
+RESTRICT="!test? ( test )"
+
+DEPEND="${LUA_DEPS}
+	dnstap? ( dev-libs/fstrm )
+	systemd? ( sys-apps/systemd:0= )
+	snmp? ( net-analyzer/net-snmp )
+	sodium? ( dev-libs/libsodium:= )
+	elibc_glibc? (
+		arm? ( >=sys-libs/glibc-2.34 )
+		x86? ( >=sys-libs/glibc-2.34 )
+	)
+	dev-libs/openssl:=
+	>=dev-libs/boost-1.54:=[context]"
+RDEPEND="${DEPEND}
+	!<net-dns/pdns-2.9.20-r1
+	acct-user/pdns
+	acct-group/pdns"
+DEPEND="${DEPEND}
+	valgrind? ( dev-debug/valgrind )"
+BDEPEND="virtual/pkgconfig"
+
+S="${WORKDIR}"/${P/_/-}
+
+pkg_setup() {
+	lua-single_pkg_setup
+	filter-flags -ftree-vectorize
+	filter-lto
+	rust_pkg_setup
+}
+
+src_configure() {
+	econf \
+		--enable-experimental-64bit-time_t-support-on-glibc \
+		--sysconfdir=/etc/powerdns \
+		--with-nod-cache-dir=/var/lib/powerdns \
+		--with-service-user=pdns \
+		--with-service-group=pdns \
+		--with-lua="${ELUA}" \
+		$(use_enable debug verbose-logging) \
+		$(use_enable systemd) \
+		$(use_enable dns-over-tls) \
+		$(use_enable dnstap dnstap) \
+		$(use_enable test unit-tests) \
+		$(use_enable valgrind) \
+		$(use_with sodium libsodium) \
+		$(use_with snmp net-snmp)
+}
+
+src_compile() {
+	default
+}
+
+src_install() {
+	default
+
+	# rename .yml to .conf to facilitate easy upgrade and switch to .yml
+	mv "${D}"/etc/powerdns/recursor.{yml-dist,conf} || die
+
+	sed -i \
+		-e 's/^#   set\([ug]\)id: '\'\''$/    set\1id: '\''pdns'\''/' \
+		-e 's/^#   chroot: '\'\''$/    chroot: '\''\/var\/lib\/powerdns'\''/' \
+		"${D}"/etc/powerdns/recursor.conf || die
+
+	newinitd "${FILESDIR}"/pdns-recursor-r3 pdns-recursor
+
+	keepdir /var/lib/powerdns
+}
+
+src_test() {
+	default
+}
+
+pkg_postinst() {
+	einfo "Starting with 5.1.x we default to using the new yaml configuration file format."
+	einfo "The old configuration file format is still supported for now, but please update"
+	einfo "your recursor.conf to yaml using 'rec_control show-yaml'."
+}
diff --git a/net-dns/pdns-recursor/pdns-recursor-5.4.0.ebuild b/net-dns/pdns-recursor/pdns-recursor-5.4.0.ebuild
deleted file mode 100644
index c8881c068b47..000000000000
--- a/net-dns/pdns-recursor/pdns-recursor-5.4.0.ebuild
+++ /dev/null
@@ -1,207 +0,0 @@
-# Copyright 2021-2026 Liguros Authors
-# Distributed under the terms of the GNU General Public License v2
-EAPI=8
-
-LUA_COMPAT=( lua5-{1,3,4} luajit )
-RUST_MIN_VER="1.82"
-
-# Getting crates from lock file in subdirectory pdns/recursordist/rec-rust-lib/rust/
-# https://github.com/PowerDNS/pdns/blob/master/pdns/recursordist/rec-rust-lib/rust/Cargo.lock
-
-
-CRATES="
-anstyle-1.0.13
-atomic-waker-1.1.2
-base64-0.22.1
-bytes-1.11.1
-cc-1.2.49
-cfg-if-1.0.4
-clap-4.5.53
-clap_builder-4.5.53
-clap_lex-0.7.6
-codespan-reporting-0.13.1
-cxx-1.0.191
-cxx-build-1.0.191
-cxxbridge-cmd-1.0.191
-cxxbridge-flags-1.0.191
-cxxbridge-macro-1.0.191
-equivalent-1.0.2
-find-msvc-tools-0.1.5
-foldhash-0.2.0
-form_urlencoded-1.2.2
-futures-channel-0.3.31
-futures-core-0.3.31
-futures-task-0.3.31
-futures-util-0.3.31
-getrandom-0.2.16
-hashbrown-0.16.1
-http-1.4.0
-http-body-1.0.1
-http-body-util-0.1.3
-httparse-1.10.1
-httpdate-1.0.3
-hyper-1.8.1
-hyper-rustls-0.27.7
-hyper-util-0.1.19
-indexmap-2.12.1
-ipnet-2.11.0
-itoa-1.0.15
-libc-0.2.178
-link-cplusplus-1.0.12
-mio-1.1.1
-once_cell-1.21.3
-percent-encoding-2.3.2
-pin-project-lite-0.2.16
-pin-utils-0.1.0
-proc-macro2-1.0.103
-quote-1.0.42
-ring-0.17.14
-rustls-0.23.35
-rustls-pki-types-1.13.1
-rustls-webpki-0.103.8
-ryu-1.0.20
-scratch-1.0.9
-serde-1.0.228
-serde_core-1.0.228
-serde_derive-1.0.228
-serde_yaml-0.9.34+deprecated
-shlex-1.3.0
-smallvec-1.15.1
-socket2-0.6.1
-strsim-0.11.1
-subtle-2.6.1
-syn-2.0.111
-termcolor-1.4.1
-tokio-1.48.0
-tokio-rustls-0.26.4
-tower-service-0.3.3
-tracing-0.1.43
-tracing-core-0.1.35
-try-lock-0.2.5
-unicode-ident-1.0.22
-unicode-width-0.2.2
-unsafe-libyaml-0.2.11
-untrusted-0.9.0
-want-0.3.1
-wasi-0.11.1+wasi-snapshot-preview1
-winapi-util-0.1.11
-windows-link-0.2.1
-windows-sys-0.52.0
-windows-sys-0.60.2
-windows-sys-0.61.2
-windows-targets-0.52.6
-windows-targets-0.53.5
-windows_aarch64_gnullvm-0.52.6
-windows_aarch64_gnullvm-0.53.1
-windows_aarch64_msvc-0.52.6
-windows_aarch64_msvc-0.53.1
-windows_i686_gnu-0.52.6
-windows_i686_gnu-0.53.1
-windows_i686_gnullvm-0.52.6
-windows_i686_gnullvm-0.53.1
-windows_i686_msvc-0.52.6
-windows_i686_msvc-0.53.1
-windows_x86_64_gnu-0.52.6
-windows_x86_64_gnu-0.53.1
-windows_x86_64_gnullvm-0.52.6
-windows_x86_64_gnullvm-0.53.1
-windows_x86_64_msvc-0.52.6
-windows_x86_64_msvc-0.53.1
-zeroize-1.8.2
-"
-inherit cargo flag-o-matic lua-single
-
-DESCRIPTION="The PowerDNS Recursor"
-HOMEPAGE="https://www.powerdns.com/"
-SRC_URI="https://downloads.powerdns.com/releases/${P/_/-}.tar.xz ${CARGO_CRATE_URIS}"
-
-LICENSE="GPL-2"
-SLOT="0"
-KEYWORDS="~amd64 ~arm ~x86"
-IUSE="debug dns-over-tls dnstap snmp sodium systemd test valgrind"
-REQUIRED_USE="${LUA_REQUIRED_USE}"
-RESTRICT="!test? ( test )"
-
-DEPEND="${LUA_DEPS}
-	dnstap? ( dev-libs/fstrm )
-	systemd? ( sys-apps/systemd:0= )
-	snmp? ( net-analyzer/net-snmp )
-	sodium? ( dev-libs/libsodium:= )
-	elibc_glibc? (
-		arm? ( >=sys-libs/glibc-2.34 )
-		x86? ( >=sys-libs/glibc-2.34 )
-	)
-
-	dev-libs/openssl:=
-	>=dev-libs/boost-1.54:=[context]"
-RDEPEND="${DEPEND}
-	!<net-dns/pdns-2.9.20-r1
-	acct-user/pdns
-	acct-group/pdns"
-DEPEND="${DEPEND}
-	valgrind? ( dev-debug/valgrind )"
-BDEPEND="virtual/pkgconfig"
-
-S="${WORKDIR}"/${P/_/-}
-
-pkg_setup() {
-	lua-single_pkg_setup
-	filter-flags -ftree-vectorize
-	filter-lto
-	rust_pkg_setup
-}
-
-src_configure() {
-	econf \
-		--enable-experimental-64bit-time_t-support-on-glibc \
-		--sysconfdir=/etc/powerdns \
-		--with-nod-cache-dir=/var/lib/powerdns \
-		--with-service-user=pdns \
-		--with-service-group=pdns \
-		--with-lua="${ELUA}" \
-		$(use_enable debug verbose-logging) \
-		$(use_enable systemd) \
-		$(use_enable dns-over-tls) \
-		$(use_enable dnstap dnstap) \
-		$(use_enable test unit-tests) \
-		$(use_enable valgrind) \
-		$(use_with sodium libsodium) \
-		$(use_with snmp net-snmp)
-}
-
-src_compile() {
-	default
-}
-
-src_install() {
-	default
-
-	# rename .yml to .conf to facilitate easy upgrade and switch to .yml
-	mv "${D}"/etc/powerdns/recursor.{yml-dist,conf} || die
-
-	sed -i \
-		-e 's/^# set\([ug]\)id=$/set\1id=pdns/' \
-		-e 's/^# quiet=$/quiet=on/' \
-		-e 's/^# chroot=$/chroot=\/var\/lib\/powerdns/' \
-		"${D}"/etc/powerdns/recursor.conf
-
-	newinitd "${FILESDIR}"/pdns-recursor-r2 pdns-recursor
-	keepdir /var/lib/powerdns
-}
-
-src_test() {
-	default
-}
-
-pkg_postinst() {
-	local old
-
-	for old in ${REPLACING_VERSIONS}; do
-		ver_test ${old} -lt 4.0.0-r1 || continue
-
-		ewarn "Starting with 4.0.0-r1 the init script has been renamed from precursor"
-		ewarn "to pdns-recursor, please update your runlevels accordingly."
-
-		break
-	done
-}
diff --git a/net-dns/pdns-recursor/pdns-recursor-5.4.1.ebuild b/net-dns/pdns-recursor/pdns-recursor-5.4.1.ebuild
index 66f82e532164..34b504833624 100644
--- a/net-dns/pdns-recursor/pdns-recursor-5.4.1.ebuild
+++ b/net-dns/pdns-recursor/pdns-recursor-5.4.1.ebuild
@@ -1,115 +1,112 @@
-# Copyright 2021-2026 Liguros Authors
+# Copyright 1999-2026 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
-EAPI=8
-
-LUA_COMPAT=( lua5-{1,3,4} luajit )
-RUST_MIN_VER="1.82"
-
-# Getting crates from lock file in subdirectory pdns/recursordist/rec-rust-lib/rust/
-# https://github.com/PowerDNS/pdns/blob/master/pdns/recursordist/rec-rust-lib/rust/Cargo.lock
 
+EAPI="8"
 
+LUA_COMPAT=( lua5-{1,3,4} luajit )
 
+RUST_MIN_VER="1.82"
 CRATES="
-anstyle-1.0.13
-atomic-waker-1.1.2
-base64-0.22.1
-bytes-1.11.1
-cc-1.2.49
-cfg-if-1.0.4
-clap-4.5.53
-clap_builder-4.5.53
-clap_lex-0.7.6
-codespan-reporting-0.13.1
-cxx-1.0.191
-cxx-build-1.0.191
-cxxbridge-cmd-1.0.191
-cxxbridge-flags-1.0.191
-cxxbridge-macro-1.0.191
-equivalent-1.0.2
-find-msvc-tools-0.1.5
-foldhash-0.2.0
-form_urlencoded-1.2.2
-futures-channel-0.3.31
-futures-core-0.3.31
-futures-task-0.3.31
-futures-util-0.3.31
-getrandom-0.2.16
-hashbrown-0.16.1
-http-1.4.0
-http-body-1.0.1
-http-body-util-0.1.3
-httparse-1.10.1
-httpdate-1.0.3
-hyper-1.8.1
-hyper-rustls-0.27.7
-hyper-util-0.1.19
-indexmap-2.12.1
-ipnet-2.11.0
-itoa-1.0.15
-libc-0.2.178
-link-cplusplus-1.0.12
-mio-1.1.1
-once_cell-1.21.3
-percent-encoding-2.3.2
-pin-project-lite-0.2.16
-pin-utils-0.1.0
-proc-macro2-1.0.103
-quote-1.0.42
-ring-0.17.14
-rustls-0.23.35
-rustls-pki-types-1.13.1
-rustls-webpki-0.103.8
-ryu-1.0.20
-scratch-1.0.9
-serde-1.0.228
-serde_core-1.0.228
-serde_derive-1.0.228
-serde_yaml-0.9.34+deprecated
-shlex-1.3.0
-smallvec-1.15.1
-socket2-0.6.1
-strsim-0.11.1
-subtle-2.6.1
-syn-2.0.111
-termcolor-1.4.1
-tokio-1.48.0
-tokio-rustls-0.26.4
-tower-service-0.3.3
-tracing-0.1.43
-tracing-core-0.1.35
-try-lock-0.2.5
-unicode-ident-1.0.22
-unicode-width-0.2.2
-unsafe-libyaml-0.2.11
-untrusted-0.9.0
-want-0.3.1
-wasi-0.11.1+wasi-snapshot-preview1
-winapi-util-0.1.11
-windows-link-0.2.1
-windows-sys-0.52.0
-windows-sys-0.60.2
-windows-sys-0.61.2
-windows-targets-0.52.6
-windows-targets-0.53.5
-windows_aarch64_gnullvm-0.52.6
-windows_aarch64_gnullvm-0.53.1
-windows_aarch64_msvc-0.52.6
-windows_aarch64_msvc-0.53.1
-windows_i686_gnu-0.52.6
-windows_i686_gnu-0.53.1
-windows_i686_gnullvm-0.52.6
-windows_i686_gnullvm-0.53.1
-windows_i686_msvc-0.52.6
-windows_i686_msvc-0.53.1
-windows_x86_64_gnu-0.52.6
-windows_x86_64_gnu-0.53.1
-windows_x86_64_gnullvm-0.52.6
-windows_x86_64_gnullvm-0.53.1
-windows_x86_64_msvc-0.52.6
-windows_x86_64_msvc-0.53.1
-zeroize-1.8.2
+	anstyle@1.0.13
+	atomic-waker@1.1.2
+	base64@0.22.1
+	bytes@1.11.1
+	cc@1.2.49
+	cfg-if@1.0.4
+	clap@4.5.53
+	clap_builder@4.5.53
+	clap_lex@0.7.6
+	codespan-reporting@0.13.1
+	cxx@1.0.191
+	cxx-build@1.0.191
+	cxxbridge-cmd@1.0.191
+	cxxbridge-flags@1.0.191
+	cxxbridge-macro@1.0.191
+	equivalent@1.0.2
+	find-msvc-tools@0.1.5
+	foldhash@0.2.0
+	form_urlencoded@1.2.2
+	futures-channel@0.3.31
+	futures-core@0.3.31
+	futures-task@0.3.31
+	futures-util@0.3.31
+	getrandom@0.2.16
+	hashbrown@0.16.1
+	http@1.4.0
+	http-body@1.0.1
+	http-body-util@0.1.3
+	httparse@1.10.1
+	httpdate@1.0.3
+	hyper@1.8.1
+	hyper-rustls@0.27.7
+	hyper-util@0.1.19
+	indexmap@2.12.1
+	ipnet@2.11.0
+	itoa@1.0.15
+	libc@0.2.178
+	link-cplusplus@1.0.12
+	mio@1.1.1
+	once_cell@1.21.3
+	percent-encoding@2.3.2
+	pin-project-lite@0.2.16
+	pin-utils@0.1.0
+	proc-macro2@1.0.103
+	quote@1.0.42
+	ring@0.17.14
+	rustls@0.23.35
+	rustls-pki-types@1.13.1
+	rustls-webpki@0.103.8
+	ryu@1.0.20
+	scratch@1.0.9
+	serde@1.0.228
+	serde_core@1.0.228
+	serde_derive@1.0.228
+	serde_yaml@0.9.34+deprecated
+	shlex@1.3.0
+	smallvec@1.15.1
+	socket2@0.6.1
+	strsim@0.11.1
+	subtle@2.6.1
+	syn@2.0.111
+	termcolor@1.4.1
+	tokio@1.48.0
+	tokio-rustls@0.26.4
+	tower-service@0.3.3
+	tracing@0.1.43
+	tracing-core@0.1.35
+	try-lock@0.2.5
+	unicode-ident@1.0.22
+	unicode-width@0.2.2
+	unsafe-libyaml@0.2.11
+	untrusted@0.9.0
+	want@0.3.1
+	wasi@0.11.1+wasi-snapshot-preview1
+	winapi-util@0.1.11
+	windows-link@0.2.1
+	windows-sys@0.52.0
+	windows-sys@0.60.2
+	windows-sys@0.61.2
+	windows-targets@0.52.6
+	windows-targets@0.53.5
+	windows_aarch64_gnullvm@0.52.6
+	windows_aarch64_gnullvm@0.53.1
+	windows_aarch64_msvc@0.52.6
+	windows_aarch64_msvc@0.53.1
+	windows_i686_gnu@0.52.6
+	windows_i686_gnu@0.53.1
+	windows_i686_gnullvm@0.52.6
+	windows_i686_gnullvm@0.53.1
+	windows_i686_msvc@0.52.6
+	windows_i686_msvc@0.53.1
+	windows_x86_64_gnu@0.52.6
+	windows_x86_64_gnu@0.53.1
+	windows_x86_64_gnullvm@0.52.6
+	windows_x86_64_gnullvm@0.53.1
+	windows_x86_64_msvc@0.52.6
+	windows_x86_64_msvc@0.53.1
+	zeroize@1.8.2
 "
+
 inherit cargo flag-o-matic lua-single
 
 DESCRIPTION="The PowerDNS Recursor"
@@ -132,7 +129,6 @@ DEPEND="${LUA_DEPS}
 		arm? ( >=sys-libs/glibc-2.34 )
 		x86? ( >=sys-libs/glibc-2.34 )
 	)
-
 	dev-libs/openssl:=
 	>=dev-libs/boost-1.54:=[context]"
 RDEPEND="${DEPEND}
@@ -181,12 +177,12 @@ src_install() {
 	mv "${D}"/etc/powerdns/recursor.{yml-dist,conf} || die
 
 	sed -i \
-		-e 's/^# set\([ug]\)id=$/set\1id=pdns/' \
-		-e 's/^# quiet=$/quiet=on/' \
-		-e 's/^# chroot=$/chroot=\/var\/lib\/powerdns/' \
-		"${D}"/etc/powerdns/recursor.conf
+		-e 's/^#   set\([ug]\)id: '\'\''$/    set\1id: '\''pdns'\''/' \
+		-e 's/^#   chroot: '\'\''$/    chroot: '\''\/var\/lib\/powerdns'\''/' \
+		"${D}"/etc/powerdns/recursor.conf || die
+
+	newinitd "${FILESDIR}"/pdns-recursor-r3 pdns-recursor
 
-	newinitd "${FILESDIR}"/pdns-recursor-r2 pdns-recursor
 	keepdir /var/lib/powerdns
 }
 
@@ -195,14 +191,7 @@ src_test() {
 }
 
 pkg_postinst() {
-	local old
-
-	for old in ${REPLACING_VERSIONS}; do
-		ver_test ${old} -lt 4.0.0-r1 || continue
-
-		ewarn "Starting with 4.0.0-r1 the init script has been renamed from precursor"
-		ewarn "to pdns-recursor, please update your runlevels accordingly."
-
-		break
-	done
+	einfo "Starting with 5.1.x we default to using the new yaml configuration file format."
+	einfo "The old configuration file format is still supported for now, but please update"
+	einfo "your recursor.conf to yaml using 'rec_control show-yaml'."
 }
diff --git a/net-dns/pdns/Manifest b/net-dns/pdns/Manifest
index aac7746f28f6..2579be88b7ce 100644
--- a/net-dns/pdns/Manifest
+++ b/net-dns/pdns/Manifest
@@ -1,2 +1,2 @@
-DIST pdns-5.0.4.tar.bz2 1475132 BLAKE2B 5be31ca3d54c2c556c13455d38c05ef760e23b8b9f5e42bcea5cc268b215bdcbbbb551845bf96dc5709df1d4e5344641e206ad298092e662852530d2d4c7bc6e SHA512 0839a6fcbca6c807aa62c9d5e06fff2e8bceb78825b3c7b4e9ccf80a3e0848123403bc5604a2092ba313df0e711df176d93af1e0d1e26478cb6ed0d0dcab601a
 DIST pdns-5.0.5.tar.bz2 1490386 BLAKE2B 8ed6e31c50a61f74b753115f8be2689b950c7b2a53b88265a01d0f7f4d487c8b69a0abe31a4f09a10c7a30ca39d9b1f6fdbf4e70cb396cb0cea1427470625d43 SHA512 25c04c41d6148ec80cf4eaf729f73d83b950af82a908c15a826c654097ec814629f46ee7edb17e8ac2e73c46fc507bdbfb908fbf544fe8391118788d4f1311ed
+DIST pdns-5.1.1.tar.bz2 1530406 BLAKE2B 880816e07adf1527050e2518cacc78dd4bc20b8334ebbbb94f3b2f68dfa63f4458b7ed2fba80fde312c804d65165412d3169e6c3106f5349a8820bbc20b584e4 SHA512 7a88ebf69405808475f9e67b233162e76f013266196aece6c05692a433f3274486232923815d4a195c2eb40bdbe1943bfe31435a23ccab98964dc21a00638136
diff --git a/net-dns/pdns/files/pdns-r1 b/net-dns/pdns/files/pdns-r1
index 4c5241e5155f..eeff5a08f634 100644
--- a/net-dns/pdns/files/pdns-r1
+++ b/net-dns/pdns/files/pdns-r1
@@ -1,15 +1,21 @@
 #!/sbin/openrc-run
-# Copyright 1999-2020 Gentoo Authors
+# Copyright 1999-2021 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+get_config_option() {
+	awk -v option="${1}" -F = '$1 == option { print $2 }' "${PDNS_CONFIG}"
+}
+
 PDNS_CONFIGDIR="${PDNS_CONFIGDIR:-/etc/powerdns}"
 PDNS_STOP_TIMEOUT="${PDNS_STOP_TIMEOUT:-10}"
 
 [ "${RC_SVCNAME}" != "pdns" ] && PDNS_INSTANCE="${RC_SVCNAME#pdns[.-]}" || PDNS_INSTANCE=""
 
 PDNS_CONFIG="${PDNS_CONFIGDIR}/pdns${PDNS_INSTANCE:+-${PDNS_INSTANCE}}.conf"
-PDNS_CHROOTDIR="$( awk -F = '$1 == "chroot" { print $2 }' "${PDNS_CONFIG}" )"
-PDNS_SOCKETDIR="$( awk -F = '$1 == "socket-dir" { print $2 }' "${PDNS_CONFIG}" )"
+PDNS_CHROOTDIR="$( get_config_option chroot )"
+PDNS_SOCKETDIR="$( get_config_option socket-dir )"
+PDNS_SETUID="$( get_config_option setuid )"
+PDNS_SETGID="$( get_config_option setgid )"
 [ -z "${PDNS_SOCKETDIR}" -a -z "${PDNS_CHROOTDIR}" ] && PDNS_SOCKETDIR="/var/run/pdns"
 
 name="PowerDNS Authoritative Server${PDNS_INSTANCE:+ (${PDNS_INSTANCE})}"
@@ -22,7 +28,7 @@ description_ping="Ping the PowerDNS instance"
 description_monitor="Starts in foreground with logging and console enabled"
 
 command="/usr/sbin/pdns_server"
-command_args="--config-dir=${PDNS_CONFIGDIR}${PDNS_INSTANCE:+ --config-name=${PDNS_INSTANCE}}"
+command_args="--config-dir=${PDNS_CONFIGDIR}${PDNS_INSTANCE:+ --config-name=${PDNS_INSTANCE}} --write-pid=yes"
 command_args_foreground="--daemon=no"
 command_args_background="--daemon=yes"
 yesno ${rc_verbose} || command_args_background="${command_args_background} >/dev/null 2>&1"
@@ -42,6 +48,10 @@ status() {
 	_ping || return 32
 }
 
+start_pre() {
+	checkpath --directory --owner "${PDNS_SETUID:-root}:${PDNS_SETGID:-root}" --mode 750 "${PDNS_CHROOTDIR}/${PDNS_SOCKETDIR}"
+}
+
 stop() {
 	default_stop || return
 	_ping || return 0
diff --git a/net-dns/pdns/metadata.xml b/net-dns/pdns/metadata.xml
index b9062bbc1f01..ae28e4cdad8d 100644
--- a/net-dns/pdns/metadata.xml
+++ b/net-dns/pdns/metadata.xml
@@ -1,10 +1,6 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
 <pkgmetadata>
-  <maintainer type="project">
-    <email>dev@liguros.net</email>
-    <name>Development</name>
-  </maintainer>
   <maintainer type="person">
     <email>swegener@gentoo.org</email>
     <name>Sven Wegener</name>
@@ -14,13 +10,9 @@ The PowerDNS Nameserver is a modern, advanced and high performance authoritative
 only nameserver. It is written from scratch and conforms to all relevant DNS
 standards documents. Furthermore, PowerDNS interfaces with almost any database.
 </longdescription>
-  <upstream>
-    <remote-id type="cpe">cpe:/a:powerdns:pdns</remote-id>
-  </upstream>
   <use>
+    <flag name="lmdb">Use LMDB as backend.</flag>
     <flag name="lua-records">Enable LUA records.</flag>
-    <flag name="mydns">Making it possible to use a MyDNS MySQL database with PowerDNS (not recommended for new deployments).</flag>
-    <flag name="protobuf">Enable support for <pkg>dev-libs/protobuf</pkg>.</flag>
     <flag name="remote">Use a generic socket or pipe as a backend (via JSON RPC requests).</flag>
     <flag name="sodium">Use <pkg>dev-libs/libsodium</pkg> for cryptography</flag>
     <flag name="tinydns">Use a TinyDNS CDB database as backend.</flag>
diff --git a/net-dns/pdns/pdns-5.0.5.ebuild b/net-dns/pdns/pdns-5.0.5.ebuild
index ea74681523c8..93a18319bc09 100644
--- a/net-dns/pdns/pdns-5.0.5.ebuild
+++ b/net-dns/pdns/pdns-5.0.5.ebuild
@@ -1,11 +1,12 @@
-# Copyright 2021-2026 Liguros Authors
+# Copyright 1999-2026 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
+
 EAPI=8
 
 LUA_COMPAT=( lua5-{1,3,4} luajit )
 PYTHON_COMPAT=( python3_{13..14} )
 
-inherit flag-o-matic lua-single python-any-r1
+inherit lua-single python-any-r1
 
 DESCRIPTION="The PowerDNS Daemon"
 HOMEPAGE="https://www.powerdns.com/"
@@ -13,19 +14,19 @@ SRC_URI="https://downloads.powerdns.com/releases/${P/_/-}.tar.bz2"
 
 LICENSE="GPL-2"
 SLOT="0"
-KEYWORDS="~amd64 ~x86"
+KEYWORDS="amd64 x86"
 
-IUSE="debug doc geoip ldap lmdb mariadb odbc postgres remote sodium sqlite systemd tools tinydns test"
+IUSE="debug doc geoip ldap lmdb lua-records mysql odbc postgres remote sodium sqlite systemd tools tinydns test"
 RESTRICT="!test? ( test )"
 
 REQUIRED_USE="${LUA_REQUIRED_USE}"
 
 DEPEND="${LUA_DEPS}
-
 	dev-libs/openssl:=
+	dev-libs/boost:=
 	lmdb? ( >=dev-db/lmdb-0.9.29 )
-	>=net-misc/curl-7.21.3
-	mariadb? ( dev-db/mariadb-connector-c:= )
+	lua-records? ( >=net-misc/curl-7.21.3 )
+	mysql? ( dev-db/mysql-connector-c:= )
 	postgres? ( dev-db/postgresql:= )
 	ldap? ( >=net-nds/openldap-2.0.27-r4:= app-crypt/mit-krb5 )
 	odbc? ( dev-db/unixODBC )
@@ -47,18 +48,15 @@ S="${WORKDIR}"/${P/_/-}
 pkg_setup() {
 	lua-single_pkg_setup
 	python-any-r1_pkg_setup
-	append-lfs-flags
-	append-cppflags -D_TIME_BITS=64
 }
 
 src_configure() {
-	append-cxxflags -std=c++17
 	local cnf_dynmodules="bind lua2 pipe" # the default backends, always enabled
 
 	use geoip && cnf_dynmodules+=" geoip"
 	use ldap && cnf_dynmodules+=" ldap"
 	use lmdb && cnf_dynmodules+=" lmdb"
-	use mariadb && cnf_dynmodules+=" gmysql"
+	use mysql && cnf_dynmodules+=" gmysql"
 	use odbc && cnf_dynmodules+=" godbc"
 	use postgres && cnf_dynmodules+=" gpgsql"
 	use remote && cnf_dynmodules+=" remote"
@@ -66,6 +64,7 @@ src_configure() {
 	use tinydns && cnf_dynmodules+=" tinydns"
 
 	econf \
+		--enable-experimental-64bit-time_t-support-on-glibc \
 		--disable-static \
 		--sysconfdir=/etc/powerdns \
 		--libdir=/usr/$(get_libdir)/powerdns \
@@ -76,7 +75,7 @@ src_configure() {
 		--with-mysql-lib=/usr/$(get_libdir) \
 		--with-lua="${ELUA}" \
 		$(use_enable debug verbose-logging) \
-		--enable-lua-records \
+		$(use_enable lua-records) \
 		$(use_enable test unit-tests) \
 		$(use_enable tools) \
 		$(use_enable systemd) \
@@ -131,35 +130,4 @@ pkg_postinst() {
 	elog
 	elog "The name must be in the format pdns.<suffix> and PowerDNS will use the"
 	elog "/etc/powerdns/pdns-<suffix>.conf configuration file instead of the default."
-
-	local old
-	for old in ${REPLACING_VERSIONS}; do
-		ver_test ${old} -lt 3.2 || continue
-
-		echo
-		ewarn "To fix a security bug (bug #458018) had the following"
-		ewarn "files/directories the world-readable bit removed (if set):"
-		ewarn "  ${EPREFIX}/etc/powerdns"
-		ewarn "  ${EPREFIX}/etc/powerdns/pdns.conf"
-		ewarn "Check if this is correct for your setup"
-		ewarn "This is a one-time change and will not happen on subsequent updates."
-		chmod o-rwx "${EPREFIX}"/etc/powerdns/{,pdns.conf}
-
-		break
-	done
-
-	if use postgres; then
-		for old in ${REPLACING_VERSIONS}; do
-			ver_test ${old} -lt 4.1.11-r1 || continue
-
-			echo
-			ewarn "PowerDNS 4.1.11 contains a security fix for the PostgreSQL backend."
-			ewarn "This security fix needs to be applied manually to the database schema."
-			ewarn "Please refer to the official security advisory for more information:"
-			ewarn
-			ewarn "  https://doc.powerdns.com/authoritative/security-advisories/powerdns-advisory-2019-06.html"
-
-			break
-		done
-	fi
 }
diff --git a/net-dns/pdns/pdns-5.0.4.ebuild b/net-dns/pdns/pdns-5.1.1.ebuild
index ea74681523c8..10abc8d6171a 100644
--- a/net-dns/pdns/pdns-5.0.4.ebuild
+++ b/net-dns/pdns/pdns-5.1.1.ebuild
@@ -1,11 +1,12 @@
-# Copyright 2021-2026 Liguros Authors
+# Copyright 1999-2026 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
+
 EAPI=8
 
 LUA_COMPAT=( lua5-{1,3,4} luajit )
 PYTHON_COMPAT=( python3_{13..14} )
 
-inherit flag-o-matic lua-single python-any-r1
+inherit lua-single python-any-r1
 
 DESCRIPTION="The PowerDNS Daemon"
 HOMEPAGE="https://www.powerdns.com/"
@@ -15,17 +16,17 @@ LICENSE="GPL-2"
 SLOT="0"
 KEYWORDS="~amd64 ~x86"
 
-IUSE="debug doc geoip ldap lmdb mariadb odbc postgres remote sodium sqlite systemd tools tinydns test"
+IUSE="debug doc geoip ldap lmdb lua-records mysql odbc postgres remote sodium sqlite systemd tools tinydns test"
 RESTRICT="!test? ( test )"
 
 REQUIRED_USE="${LUA_REQUIRED_USE}"
 
 DEPEND="${LUA_DEPS}
-
 	dev-libs/openssl:=
+	dev-libs/boost:=
 	lmdb? ( >=dev-db/lmdb-0.9.29 )
-	>=net-misc/curl-7.21.3
-	mariadb? ( dev-db/mariadb-connector-c:= )
+	lua-records? ( >=net-misc/curl-7.21.3 )
+	mysql? ( dev-db/mysql-connector-c:= )
 	postgres? ( dev-db/postgresql:= )
 	ldap? ( >=net-nds/openldap-2.0.27-r4:= app-crypt/mit-krb5 )
 	odbc? ( dev-db/unixODBC )
@@ -47,18 +48,15 @@ S="${WORKDIR}"/${P/_/-}
 pkg_setup() {
 	lua-single_pkg_setup
 	python-any-r1_pkg_setup
-	append-lfs-flags
-	append-cppflags -D_TIME_BITS=64
 }
 
 src_configure() {
-	append-cxxflags -std=c++17
 	local cnf_dynmodules="bind lua2 pipe" # the default backends, always enabled
 
 	use geoip && cnf_dynmodules+=" geoip"
 	use ldap && cnf_dynmodules+=" ldap"
 	use lmdb && cnf_dynmodules+=" lmdb"
-	use mariadb && cnf_dynmodules+=" gmysql"
+	use mysql && cnf_dynmodules+=" gmysql"
 	use odbc && cnf_dynmodules+=" godbc"
 	use postgres && cnf_dynmodules+=" gpgsql"
 	use remote && cnf_dynmodules+=" remote"
@@ -66,6 +64,7 @@ src_configure() {
 	use tinydns && cnf_dynmodules+=" tinydns"
 
 	econf \
+		--enable-experimental-64bit-time_t-support-on-glibc \
 		--disable-static \
 		--sysconfdir=/etc/powerdns \
 		--libdir=/usr/$(get_libdir)/powerdns \
@@ -76,7 +75,7 @@ src_configure() {
 		--with-mysql-lib=/usr/$(get_libdir) \
 		--with-lua="${ELUA}" \
 		$(use_enable debug verbose-logging) \
-		--enable-lua-records \
+		$(use_enable lua-records) \
 		$(use_enable test unit-tests) \
 		$(use_enable tools) \
 		$(use_enable systemd) \
@@ -131,35 +130,4 @@ pkg_postinst() {
 	elog
 	elog "The name must be in the format pdns.<suffix> and PowerDNS will use the"
 	elog "/etc/powerdns/pdns-<suffix>.conf configuration file instead of the default."
-
-	local old
-	for old in ${REPLACING_VERSIONS}; do
-		ver_test ${old} -lt 3.2 || continue
-
-		echo
-		ewarn "To fix a security bug (bug #458018) had the following"
-		ewarn "files/directories the world-readable bit removed (if set):"
-		ewarn "  ${EPREFIX}/etc/powerdns"
-		ewarn "  ${EPREFIX}/etc/powerdns/pdns.conf"
-		ewarn "Check if this is correct for your setup"
-		ewarn "This is a one-time change and will not happen on subsequent updates."
-		chmod o-rwx "${EPREFIX}"/etc/powerdns/{,pdns.conf}
-
-		break
-	done
-
-	if use postgres; then
-		for old in ${REPLACING_VERSIONS}; do
-			ver_test ${old} -lt 4.1.11-r1 || continue
-
-			echo
-			ewarn "PowerDNS 4.1.11 contains a security fix for the PostgreSQL backend."
-			ewarn "This security fix needs to be applied manually to the database schema."
-			ewarn "Please refer to the official security advisory for more information:"
-			ewarn
-			ewarn "  https://doc.powerdns.com/authoritative/security-advisories/powerdns-advisory-2019-06.html"
-
-			break
-		done
-	fi
 }
diff --git a/net-dns/unbound/Manifest b/net-dns/unbound/Manifest
index 226da442a1f7..d6b4ebe9fe30 100644
--- a/net-dns/unbound/Manifest
+++ b/net-dns/unbound/Manifest
@@ -1,4 +1,2 @@
-DIST unbound-1.25.0.tar.gz 6818581 BLAKE2B 4c22e198c2257c251505f6845c42e67481edce2c5e8dc0c475584ef6b8e85907c322f32bd7ecfcb06243ba36fb3d91c63d8c1edd67dca66d374c6a242206e548 SHA512 5b11cb06d768461dc390da989d412e8724403a9cce36e95f7b401d0b512bc81ee5a68d4cd6504c89de9a11cce69b90f09e01ae72e2ddd05130b7c459691d4f85
-DIST unbound-1.25.0.tar.gz.asc 659 BLAKE2B e1bc87ba89383da4b0e9ea084e4ea974040488a827f3407501df11cd6245c74cbff19f81c9ad6475b3db73b8f34f1a69a6c23e9c17c807bf18eaa23621915905 SHA512 2f56b626d21a69e2d55c122f49c9e329a6a97652b7e59604dd516288a558f24b9edf86762bba98181fb4a09c43820254e3c416e499e7c2cadad00c39c43ff0a8
 DIST unbound-1.25.1.tar.gz 6832247 BLAKE2B da9818a14a540bf2d674f504a38da711cfead20af2c6f987aab74094b441ef31586f28608432d2369b2223b3287290f450218466654c71626e33df74da557f18 SHA512 a536ff1d9b637e4ffa46ab498919ddf089b4498e65c748748c4920a6da52e1f5bacfbba9ac1dc47798d168e2ea64a7ae7ea2a581464d1fcabae241a6e38c8d13
 DIST unbound-1.25.1.tar.gz.asc 659 BLAKE2B c629e2ba167e867c49c4ca420b3801e7380a0f35224d8ba5c2c8226c096b53b16f38615cc202492966865d347526f979bc7a146502e5c592d60fdd76a6dc91c4 SHA512 307ce54a35c47e19dda75154424fe8e35382605cb3541ab2c16f567e28c44cfcace5aa14ca8c18d272647b8ef70cfc75f51c27cb0587bc51bd82d074380825aa
diff --git a/net-dns/unbound/files/unbound-anchor-r1.service b/net-dns/unbound/files/unbound-anchor-r1.service
new file mode 100644
index 000000000000..562e1d43252f
--- /dev/null
+++ b/net-dns/unbound/files/unbound-anchor-r1.service
@@ -0,0 +1,15 @@
+[Unit]
+Description=Update of the root trust anchor for DNSSEC validation
+Documentation=man:unbound-anchor(8)
+After=network-online.target
+Before=unbound.service
+
+[Service]
+Type=oneshot
+User=unbound
+Group=unbound
+ExecStart=/usr/bin/unbound-anchor -a /etc/unbound/var/root-anchors.txt -c /etc/dnssec/icannbundle.pem
+SuccessExitStatus=1
+
+[Install]
+WantedBy=multi-user.target
diff --git a/net-dns/unbound/files/unbound-anchor.service b/net-dns/unbound/files/unbound-anchor.service
deleted file mode 100644
index f55cf9db5d1e..000000000000
--- a/net-dns/unbound/files/unbound-anchor.service
+++ /dev/null
@@ -1,13 +0,0 @@
-[Unit]
-Description=Update of the root trust anchor for DNSSEC validation
-After=network.target
-Before=nss-lookup.target
-Wants=nss-lookup.target
-Before=unbound.service
-
-[Service]
-Type=oneshot
-ExecStart=/usr/sbin/unbound-anchor
-
-[Install]
-WantedBy=multi-user.target
diff --git a/net-dns/unbound/files/unbound.service b/net-dns/unbound/files/unbound.service
deleted file mode 100644
index 41dd6fabd290..000000000000
--- a/net-dns/unbound/files/unbound.service
+++ /dev/null
@@ -1,12 +0,0 @@
-[Unit]
-Description=Unbound recursive Domain Name Server
-After=network.target
-Before=nss-lookup.target
-Wants=nss-lookup.target
-
-[Service]
-ExecStartPre=/usr/sbin/unbound-checkconf
-ExecStart=/usr/sbin/unbound -d
-
-[Install]
-WantedBy=multi-user.target
diff --git a/net-dns/unbound/files/unbound.socket b/net-dns/unbound/files/unbound.socket
deleted file mode 100644
index 0628064a4a5e..000000000000
--- a/net-dns/unbound/files/unbound.socket
+++ /dev/null
@@ -1,5 +0,0 @@
-[Socket]
-ListenDatagram=127.0.0.1:1153
-ListenStream=127.0.0.1:1153
-[Install]
-WantedBy=sockets.target
diff --git a/net-dns/unbound/files/unbound_at.service b/net-dns/unbound/files/unbound_at.service
deleted file mode 100644
index 84b34af45446..000000000000
--- a/net-dns/unbound/files/unbound_at.service
+++ /dev/null
@@ -1,13 +0,0 @@
-[Unit]
-Description=Unbound recursive Domain Name Server
-After=network.target
-Before=nss-lookup.target
-Wants=nss-lookup.target
-
-[Service]
-Type=simple
-ExecStartPre=/usr/sbin/unbound-checkconf /etc/unbound/%i.conf
-ExecStart=/usr/sbin/unbound -d -c /etc/unbound/%i.conf
-
-[Install]
-WantedBy=multi-user.target
diff --git a/net-dns/unbound/metadata.xml b/net-dns/unbound/metadata.xml
index 101e58b7ddf3..e444be2fbd79 100644
--- a/net-dns/unbound/metadata.xml
+++ b/net-dns/unbound/metadata.xml
@@ -1,18 +1,10 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
 <pkgmetadata>
-  <maintainer type="project">
-    <email>dev@liguros.net</email>
-    <name>Development</name>
-  </maintainer>
   <maintainer type="person">
     <email>mschiff@gentoo.org</email>
     <name>Marc Schiffbauer</name>
   </maintainer>
-  <maintainer type="person">
-    <email>whissi@gentoo.org</email>
-    <name>Thomas Deutschmann</name>
-  </maintainer>
   <longdescription lang="en">
   Unbound is a validating, recursive, and caching DNS resolver.
 
@@ -24,23 +16,20 @@
   DNSSEC (secure DNS) validation and stub-resolvers (that do not run
   as a server, but are linked into an application) are easily possible.
   </longdescription>
-  <upstream>
-    <remote-id type="cpe">cpe:/a:unbound:unbound</remote-id>
-  </upstream>
+  <slots>
+    <subslots>Reflect ABI of libunbound.so.</subslots>
+  </slots>
   <use>
     <flag name="dnscrypt">Enable DNSCrypt support</flag>
     <flag name="dnstap">Enable dnstap support</flag>
     <flag name="ecdsa">Enable ECDSA support</flag>
     <flag name="ecs">Enable EDNS client subnet support</flag>
     <flag name="gost">Enable GOST support</flag>
-    <flag name="http2">Enable HTTP/2 support for DoH<pkg>net-libs/nghttp2</pkg>
+    <flag name="http2">Enable HTTP/2 support for DoH via <pkg>net-libs/nghttp2</pkg>
     </flag>
     <flag name="redis">Enable cache db backend which uses <pkg>dev-libs/hiredis</pkg>
     </flag>
     <flag name="tfo">Enable TCP Fast Open client+server</flag>
   </use>
   <origin>baldeagleos-repo</origin>
-  <slots>
-    <subslots>Reflect ABI of libunbound.so.</subslots>
-  </slots>
 </pkgmetadata>
diff --git a/net-dns/unbound/unbound-1.25.0.ebuild b/net-dns/unbound/unbound-1.25.0.ebuild
deleted file mode 100644
index 9232c8efeff9..000000000000
--- a/net-dns/unbound/unbound-1.25.0.ebuild
+++ /dev/null
@@ -1,214 +0,0 @@
-# Copyright 2021-2026 Liguros Authors
-# Distributed under the terms of the GNU General Public License v2
-EAPI=8
-PYTHON_COMPAT=( python3_{13..14} )
-
-inherit autotools flag-o-matic multilib-minimal python-single-r1 systemd verify-sig
-
-MY_P=${PN}-${PV/_/}
-DESCRIPTION="A validating, recursive and caching DNS resolver"
-HOMEPAGE="https://unbound.net/ https://nlnetlabs.nl/projects/unbound/about/"
-SRC_URI="
-	https://nlnetlabs.nl/downloads/unbound/${MY_P}.tar.gz
-	verify-sig? ( https://nlnetlabs.nl/downloads/unbound/${MY_P}.tar.gz.asc )
-"
-VERIFY_SIG_OPENPGP_KEY_PATH=${BROOT}/usr/share/openpgp-keys/unbound.net.asc
-
-LICENSE="BSD GPL-2"
-SLOT="0/8" # ABI version of libunbound.so
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~mips ~ppc ~ppc64 ~x86"
-IUSE="debug dnscrypt dnstap +ecdsa ecs gost +http2 python redis selinux static-libs systemd test +tfo threads"
-REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} )"
-RESTRICT="!test? ( test )"
-
-# Note: expat is needed by executable only but the Makefile is custom
-# and doesn't make it possible to easily install the library without
-# the executables. MULTILIB_USEDEP may be dropped once build system
-# is fixed.
-
-CDEPEND="acct-group/unbound
-	acct-user/unbound
-	>=dev-libs/expat-2.1.0-r3[${MULTILIB_USEDEP}]
-	>=dev-libs/libevent-2.0.21:0=[${MULTILIB_USEDEP}]
-
-	>=dev-libs/openssl-1.0.1h-r2:0=[${MULTILIB_USEDEP}]
-	dnscrypt? ( dev-libs/libsodium:=[${MULTILIB_USEDEP}] )
-	dnstap? (
-		dev-libs/fstrm[${MULTILIB_USEDEP}]
-		>=dev-libs/protobuf-c-1.0.2-r1:=[${MULTILIB_USEDEP}]
-	)
-	ecdsa? (
-		dev-libs/openssl:0[-bindist(-)]
-	)
-	http2? ( net-libs/nghttp2:=[${MULTILIB_USEDEP}] )
-	python? ( ${PYTHON_DEPS} )
-	redis? ( dev-libs/hiredis:= )
-"
-
-BDEPEND="virtual/pkgconfig"
-
-DEPEND="${CDEPEND}
-	python? ( dev-lang/swig )
-	test? (
-		|| (
-			net-libs/ldns[examples(-)]
-			net-dns/ldns-utils[examples(-)]
-		)
-		dev-util/splint
-		app-text/wdiff
-	)
-	verify-sig? ( sec-keys/openpgp-keys-unbound )
-	systemd? ( sys-apps/systemd )"
-
-RDEPEND="${CDEPEND}
-	net-dns/dnssec-root
-	selinux? ( sec-policy/selinux-bind )"
-
-# bug #347415
-RDEPEND="${RDEPEND}
-	net-dns/dnssec-root"
-
-PATCHES=(
-	"${FILESDIR}"/${PN}-1.5.7-trust-anchor-file.patch
-	"${FILESDIR}"/${PN}-1.6.3-pkg-config.patch
-	"${FILESDIR}"/${PN}-1.10.1-find-ar.patch
-)
-
-S=${WORKDIR}/${MY_P}
-
-pkg_setup() {
-	use python && python-single-r1_pkg_setup
-}
-
-src_prepare() {
-	default
-
-	eautoreconf
-
-	# required for the python part
-	multilib_copy_sources
-}
-
-src_configure() {
-	[[ ${CHOST} == *-darwin* ]] || append-ldflags -Wl,-z,noexecstack
-	multilib-minimal_src_configure
-}
-
-multilib_src_configure() {
-	econf \
-		$(multilib_native_use_enable debug) \
-		$(multilib_native_use_enable gost) \
-		$(multilib_native_use_enable dnscrypt) \
-		$(multilib_native_use_enable dnstap) \
-		$(multilib_native_use_enable ecdsa) \
-		$(multilib_native_use_enable ecs subnet) \
-		$(multilib_native_use_enable redis cachedb) \
-		$(multilib_native_use_enable static-libs static) \
-		$(multilib_native_use_enable systemd) \
-		$(multilib_native_use_with python pythonmodule) \
-		$(multilib_native_use_with python pyunbound) \
-		$(multilib_native_use_with threads pthreads) \
-		$(multilib_native_use_with http2 libnghttp2) \
-		$(multilib_native_use_enable tfo tfo-client) \
-		$(multilib_native_use_enable tfo tfo-server) \
-		--disable-flto \
-		--disable-rpath \
-		--enable-event-api \
-		--enable-ipsecmod \
-		--with-libevent="${ESYSROOT}"/usr \
-		$(multilib_native_usex redis --with-libhiredis="${ESYSROOT}/usr" --without-libhiredis) \
-		--with-pidfile="${EPREFIX}"/run/unbound.pid \
-		--with-rootkey-file="${EPREFIX}"/etc/dnssec/root-anchors.txt \
-		--with-ssl="${ESYSROOT}"/usr \
-		--with-libexpat="${ESYSROOT}"/usr
-
-		# http://unbound.nlnetlabs.nl/pipermail/unbound-users/2011-April/001801.html
-		# $(use_enable debug lock-checks) \
-		# $(use_enable debug alloc-checks) \
-		# $(use_enable debug alloc-lite) \
-		# $(use_enable debug alloc-nonregional) \
-}
-
-multilib_src_install() {
-	emake DESTDIR="${D}" install
-	systemd_dounit contrib/unbound.service
-	systemd_dounit contrib/unbound.socket
-}
-
-multilib_src_install_all() {
-	use python && python_optimize
-
-	newinitd "${FILESDIR}"/unbound-r1.initd unbound
-	newconfd "${FILESDIR}"/unbound-r1.confd unbound
-
-	systemd_newunit "${FILESDIR}"/unbound_at.service "unbound@.service"
-	systemd_dounit "${FILESDIR}"/unbound-anchor.service
-
-	dodoc doc/{README,CREDITS,TODO,Changelog,FEATURES}
-
-	# bug #315519
-	dodoc contrib/unbound_munin_
-
-	docinto selinux
-	dodoc contrib/selinux/*
-
-	exeinto /usr/share/${PN}
-	doexe contrib/update-anchor.sh
-
-	# create space for auto-trust-anchor-file...
-	keepdir /etc/unbound/var
-	fowners root:unbound /etc/unbound/var
-	fperms 0770 /etc/unbound/var
-	# ... and point example config to it
-	sed -i \
-		-e '/# auto-trust-anchor-file:/s,/etc/dnssec/root-anchors.txt,/etc/unbound/var/root-anchors.txt,' \
-		"${ED}/etc/unbound/unbound.conf" \
-		|| die
-
-	# Used to store cache data
-	keepdir /var/lib/${PN}
-	fowners root:unbound /var/lib/${PN}
-	fperms 0770 /var/lib/${PN}
-
-	find "${ED}" -name '*.la' -delete || die
-	if ! use static-libs ; then
-		find "${ED}" -name "*.a" -delete || die
-	fi
-}
-
-pkg_postinst() {
-	if [[ ! -f "${EROOT}/etc/unbound/unbound_control.key" ]] ; then
-		einfo "Trying to create unbound control key ..."
-		if ! unbound-control-setup &>/dev/null ; then
-			ewarn "Failed to create unbound control key!"
-		fi
-	fi
-
-	if [[ ! -f "${EROOT}/etc/unbound/var/root-anchors.txt" ]] ; then
-		einfo ""
-		einfo "If you want unbound to automatically update the root-anchor file for DNSSEC validation"
-		einfo "set 'auto-trust-anchor-file: ${EROOT}/etc/unbound/var/root-anchors.txt' in ${EROOT}/etc/unbound/unbound.conf"
-		einfo "and run"
-		einfo ""
-		einfo "  su -s /bin/sh -c '${EROOT}/usr/sbin/unbound-anchor -a ${EROOT}/etc/unbound/var/root-anchors.txt' unbound"
-		einfo ""
-		einfo "as root to create it initially before starting unbound for the first time after enabling this."
-		einfo ""
-	fi
-
-	# Our user is not available on prefix
-	use prefix && return
-
-	local _perm_check_testfile=$(mktemp --dry-run "${EPREFIX}"/etc/unbound/var/.pkg_postinst-perm-check.XXXXXXXXX)
-	su -s /bin/sh -c "touch ${_perm_check_testfile}" unbound &>/dev/null
-	if [ $? -ne 0 ] ; then
-		ewarn "WARNING: unbound user cannot write to \"${EPREFIX}/etc/unbound/var\"!"
-		ewarn "Run the following commands to restore default permission:"
-		ewarn ""
-		ewarn "    chown root:unbound ${EPREFIX}/etc/unbound/var"
-		ewarn "    chmod 0770 ${EPREFIX}/etc/unbound/var"
-	else
-		# Cleanup -- no reason to die here!
-		rm -f "${_perm_check_testfile}"
-	fi
-}
diff --git a/net-dns/unbound/unbound-1.25.1.ebuild b/net-dns/unbound/unbound-1.25.1.ebuild
index 9232c8efeff9..df1221bc4e90 100644
--- a/net-dns/unbound/unbound-1.25.1.ebuild
+++ b/net-dns/unbound/unbound-1.25.1.ebuild
@@ -1,9 +1,11 @@
-# Copyright 2021-2026 Liguros Authors
+# Copyright 1999-2026 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
+
 EAPI=8
-PYTHON_COMPAT=( python3_{13..14} )
 
-inherit autotools flag-o-matic multilib-minimal python-single-r1 systemd verify-sig
+PYTHON_COMPAT=( python3_{13..14} )
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/nlnetlabs.asc
+inherit autotools flag-o-matic python-single-r1 systemd verify-sig multilib-minimal
 
 MY_P=${PN}-${PV/_/}
 DESCRIPTION="A validating, recursive and caching DNS resolver"
@@ -12,12 +14,14 @@ SRC_URI="
 	https://nlnetlabs.nl/downloads/unbound/${MY_P}.tar.gz
 	verify-sig? ( https://nlnetlabs.nl/downloads/unbound/${MY_P}.tar.gz.asc )
 "
-VERIFY_SIG_OPENPGP_KEY_PATH=${BROOT}/usr/share/openpgp-keys/unbound.net.asc
+S="${WORKDIR}"/${MY_P}
 
 LICENSE="BSD GPL-2"
 SLOT="0/8" # ABI version of libunbound.so
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~mips ~ppc ~ppc64 ~x86"
-IUSE="debug dnscrypt dnstap +ecdsa ecs gost +http2 python redis selinux static-libs systemd test +tfo threads"
+if [[ ${PV} != *_rc* ]] ; then
+	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~mips ppc ppc64 ~riscv ~sparc x86"
+fi
+IUSE="debug dnscrypt dnstap +ecdsa ecs gost +http2 python redis selinux static-libs systemd test +tfo"
 REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} )"
 RESTRICT="!test? ( test )"
 
@@ -25,12 +29,11 @@ RESTRICT="!test? ( test )"
 # and doesn't make it possible to easily install the library without
 # the executables. MULTILIB_USEDEP may be dropped once build system
 # is fixed.
-
-CDEPEND="acct-group/unbound
+DEPEND="
+	acct-group/unbound
 	acct-user/unbound
 	>=dev-libs/expat-2.1.0-r3[${MULTILIB_USEDEP}]
 	>=dev-libs/libevent-2.0.21:0=[${MULTILIB_USEDEP}]
-
 	>=dev-libs/openssl-1.0.1h-r2:0=[${MULTILIB_USEDEP}]
 	dnscrypt? ( dev-libs/libsodium:=[${MULTILIB_USEDEP}] )
 	dnstap? (
@@ -43,30 +46,27 @@ CDEPEND="acct-group/unbound
 	http2? ( net-libs/nghttp2:=[${MULTILIB_USEDEP}] )
 	python? ( ${PYTHON_DEPS} )
 	redis? ( dev-libs/hiredis:= )
+	systemd? ( sys-apps/systemd )
 "
-
-BDEPEND="virtual/pkgconfig"
-
-DEPEND="${CDEPEND}
+BDEPEND="
+	virtual/pkgconfig
 	python? ( dev-lang/swig )
 	test? (
-		|| (
-			net-libs/ldns[examples(-)]
-			net-dns/ldns-utils[examples(-)]
-		)
+		net-libs/ldns[examples(-)]
 		dev-util/splint
 		app-text/wdiff
 	)
-	verify-sig? ( sec-keys/openpgp-keys-unbound )
-	systemd? ( sys-apps/systemd )"
-
-RDEPEND="${CDEPEND}
+	verify-sig? ( >=sec-keys/openpgp-keys-nlnetlabs-20260101 )
+"
+RDEPEND="
+	${DEPEND}
 	net-dns/dnssec-root
-	selinux? ( sec-policy/selinux-bind )"
+	selinux? ( sec-policy/selinux-bind )
+"
 
-# bug #347415
-RDEPEND="${RDEPEND}
-	net-dns/dnssec-root"
+QA_CONFIG_IMPL_DECL_SKIP=(
+	ioctlsocket # not on Linux (bug #900060)
+)
 
 PATCHES=(
 	"${FILESDIR}"/${PN}-1.5.7-trust-anchor-file.patch
@@ -74,8 +74,6 @@ PATCHES=(
 	"${FILESDIR}"/${PN}-1.10.1-find-ar.patch
 )
 
-S=${WORKDIR}/${MY_P}
-
 pkg_setup() {
 	use python && python-single-r1_pkg_setup
 }
@@ -85,7 +83,7 @@ src_prepare() {
 
 	eautoreconf
 
-	# required for the python part
+	# Required for the python part
 	multilib_copy_sources
 }
 
@@ -95,44 +93,50 @@ src_configure() {
 }
 
 multilib_src_configure() {
-	econf \
-		$(multilib_native_use_enable debug) \
-		$(multilib_native_use_enable gost) \
-		$(multilib_native_use_enable dnscrypt) \
-		$(multilib_native_use_enable dnstap) \
-		$(multilib_native_use_enable ecdsa) \
-		$(multilib_native_use_enable ecs subnet) \
-		$(multilib_native_use_enable redis cachedb) \
-		$(multilib_native_use_enable static-libs static) \
-		$(multilib_native_use_enable systemd) \
-		$(multilib_native_use_with python pythonmodule) \
-		$(multilib_native_use_with python pyunbound) \
-		$(multilib_native_use_with threads pthreads) \
-		$(multilib_native_use_with http2 libnghttp2) \
-		$(multilib_native_use_enable tfo tfo-client) \
-		$(multilib_native_use_enable tfo tfo-server) \
-		--disable-flto \
-		--disable-rpath \
-		--enable-event-api \
-		--enable-ipsecmod \
-		--with-libevent="${ESYSROOT}"/usr \
-		$(multilib_native_usex redis --with-libhiredis="${ESYSROOT}/usr" --without-libhiredis) \
-		--with-pidfile="${EPREFIX}"/run/unbound.pid \
-		--with-rootkey-file="${EPREFIX}"/etc/dnssec/root-anchors.txt \
-		--with-ssl="${ESYSROOT}"/usr \
+	local myeconfargs=(
+		$(multilib_native_use_enable debug)
+		$(multilib_native_use_enable gost)
+		$(multilib_native_use_enable dnscrypt)
+		$(multilib_native_use_enable dnstap)
+		$(multilib_native_use_enable ecdsa)
+		$(multilib_native_use_enable ecs subnet)
+		$(multilib_native_use_enable redis cachedb)
+		$(multilib_native_use_enable static-libs static)
+		$(multilib_native_use_enable systemd)
+		$(multilib_native_use_with python pythonmodule)
+		$(multilib_native_use_with python pyunbound)
+		$(multilib_native_use_with http2 libnghttp2)
+		$(multilib_native_use_enable tfo tfo-client)
+		$(multilib_native_use_enable tfo tfo-server)
+
+		--disable-flto
+		--disable-rpath
+		--enable-event-api
+		--enable-ipsecmod
+
+		--with-libevent="${ESYSROOT}"/usr
+		$(multilib_native_usex redis --with-libhiredis="${ESYSROOT}/usr" --without-libhiredis)
+
+		--with-pidfile="${EPREFIX}"/run/unbound.pid
+		--with-rootkey-file="${EPREFIX}"/etc/dnssec/root-anchors.txt
+		--with-ssl="${ESYSROOT}"/usr
 		--with-libexpat="${ESYSROOT}"/usr
 
 		# http://unbound.nlnetlabs.nl/pipermail/unbound-users/2011-April/001801.html
-		# $(use_enable debug lock-checks) \
-		# $(use_enable debug alloc-checks) \
-		# $(use_enable debug alloc-lite) \
-		# $(use_enable debug alloc-nonregional) \
+		# $(use_enable debug lock-checks)
+		# $(use_enable debug alloc-checks)
+		# $(use_enable debug alloc-lite)
+		# $(use_enable debug alloc-nonregional)
+	)
+
+	econf "${myeconfargs[@]}"
 }
 
 multilib_src_install() {
 	emake DESTDIR="${D}" install
 	systemd_dounit contrib/unbound.service
 	systemd_dounit contrib/unbound.socket
+	systemd_dounit contrib/unbound_portable.service
 }
 
 multilib_src_install_all() {
@@ -141,29 +145,22 @@ multilib_src_install_all() {
 	newinitd "${FILESDIR}"/unbound-r1.initd unbound
 	newconfd "${FILESDIR}"/unbound-r1.confd unbound
 
-	systemd_newunit "${FILESDIR}"/unbound_at.service "unbound@.service"
-	systemd_dounit "${FILESDIR}"/unbound-anchor.service
+	systemd_newunit "${FILESDIR}"/unbound-anchor-r1.service unbound-anchor.service
 
 	dodoc doc/{README,CREDITS,TODO,Changelog,FEATURES}
-
-	# bug #315519
-	dodoc contrib/unbound_munin_
+	dodoc contrib/{unbound_munin_,metrics.awk}
 
 	docinto selinux
 	dodoc contrib/selinux/*
 
 	exeinto /usr/share/${PN}
-	doexe contrib/update-anchor.sh
+	doexe contrib/{update-anchor.sh,unbound_cache.sh}
 
-	# create space for auto-trust-anchor-file...
+	# Create space for auto-trust-anchor-file eventually
+	# downloaded by unbound-anchor
 	keepdir /etc/unbound/var
 	fowners root:unbound /etc/unbound/var
 	fperms 0770 /etc/unbound/var
-	# ... and point example config to it
-	sed -i \
-		-e '/# auto-trust-anchor-file:/s,/etc/dnssec/root-anchors.txt,/etc/unbound/var/root-anchors.txt,' \
-		"${ED}/etc/unbound/unbound.conf" \
-		|| die
 
 	# Used to store cache data
 	keepdir /var/lib/${PN}
@@ -177,14 +174,14 @@ multilib_src_install_all() {
 }
 
 pkg_postinst() {
-	if [[ ! -f "${EROOT}/etc/unbound/unbound_control.key" ]] ; then
+	if [[ ! -f "${EROOT}/etc/unbound/unbound_control.key" ]]; then
 		einfo "Trying to create unbound control key ..."
 		if ! unbound-control-setup &>/dev/null ; then
 			ewarn "Failed to create unbound control key!"
 		fi
 	fi
 
-	if [[ ! -f "${EROOT}/etc/unbound/var/root-anchors.txt" ]] ; then
+	if [[ ! -f "${EROOT}/etc/unbound/var/root-anchors.txt" ]]; then
 		einfo ""
 		einfo "If you want unbound to automatically update the root-anchor file for DNSSEC validation"
 		einfo "set 'auto-trust-anchor-file: ${EROOT}/etc/unbound/var/root-anchors.txt' in ${EROOT}/etc/unbound/unbound.conf"
@@ -194,6 +191,7 @@ pkg_postinst() {
 		einfo ""
 		einfo "as root to create it initially before starting unbound for the first time after enabling this."
 		einfo ""
+		einfo "If using systemd you may also enable the unbound-anchor.service"
 	fi
 
 	# Our user is not available on prefix
@@ -201,7 +199,7 @@ pkg_postinst() {
 
 	local _perm_check_testfile=$(mktemp --dry-run "${EPREFIX}"/etc/unbound/var/.pkg_postinst-perm-check.XXXXXXXXX)
 	su -s /bin/sh -c "touch ${_perm_check_testfile}" unbound &>/dev/null
-	if [ $? -ne 0 ] ; then
+	if [[ $? -ne 0 ]]; then
 		ewarn "WARNING: unbound user cannot write to \"${EPREFIX}/etc/unbound/var\"!"
 		ewarn "Run the following commands to restore default permission:"
 		ewarn ""
author	root <root@alpha.trunkmasters.com>	2026-06-20 14:54:46 -0500
committer	root <root@alpha.trunkmasters.com>	2026-06-20 14:54:46 -0500
commit	1a4479b4e0368c8d5ff241ebad17b2541a7e3ba0 (patch)
tree	18e2e784f9fb0dbc3546537acc42ad51b366d90e /net-dns
parent	9f6a581d94412ab1cf4b35c33101f6be0ddc7777 (diff)
download	baldeagleos-repo-1a4479b4e0368c8d5ff241ebad17b2541a7e3ba0.tar.gz baldeagleos-repo-1a4479b4e0368c8d5ff241ebad17b2541a7e3ba0.tar.xz baldeagleos-repo-1a4479b4e0368c8d5ff241ebad17b2541a7e3ba0.zip