net-dns/knot: add 3.4.2

new module: authsignal

useflag:
* dbus: useflag added to support libdbus including when systemd is installed
* +doc: useflag enabled by default because pregenerated manpages are no longer provided by upstream
* idn1: useflag removed, deprecated
* pkcs#11: useflag added

scripts:
* use upstream service for systemd
* new openrc init script (knot-1.init):
    use background to create a root-owned pid file
    add checkconfig
* use knot.tmpfile for permissions:
    /run/knot (pidfile created by knotd)
    /var/lib/knot (default database, template ...)

Bug: https://bugs.gentoo.org/927551
Closes: https://bugs.gentoo.org/920681
Signed-off-by: PPN-SD <nicolas.parlant@parhuet.fr>
Closes: https://github.com/gentoo/gentoo/pull/39066
Signed-off-by: Sam James <sam@gentoo.org>

5 files changed, 220 insertions, 0 deletions

diff --git a/net-dns/knot/Manifest b/net-dns/knot/Manifest
index 40abb4bd889c..d5b54f7bbb8c 100644
--- a/net-dns/knot/Manifest
+++ b/net-dns/knot/Manifest
@@ -1,2 +1,3 @@
 DIST knot-3.2.2.tar.xz 1632748 BLAKE2B 185567dc883f946570fe60cd7d01d96162c5f13ac84330e5551c293b5011c162401fd25ddbdb43bf9242e13c3cdc8225be107dc579619fe54c05335601cd27ae SHA512 29fadb96c1ea525c6183f9e7552f4ad370579b67d74aec1910a92d561cc2c5656fd7876015f29161d279a07c23643f6584308bf9fa0e74d351b17af54e5e9a7f
 DIST knot-3.2.9.tar.xz 1642600 BLAKE2B 2c81b2afa96c6077778c3458b2ddeeb8b47ea99607ba755a904278f9755a32171738418ea442b1e6b4afcebe0db2c86e68845d38f8e78342b8354411d1e34af8 SHA512 baf8da222e38198c85fa62e45e71b29ddac7c90433b811710ace1e0395e6e7b5d63547ce8f3a62792ee11259ec2e36d6ddd8fff999416f9171671444a95086cf
+DIST knot-3.4.2.tar.xz 1632976 BLAKE2B 0b633b27b22665db243bc4222f05028a17ee7ec6ba5960ff1cfe503d27bf3d26218f771cb15b70bbf8782898bcc7748bd5c27d55747607a1d93f784cdadddad7 SHA512 d5353fdd51224e20a8009aea7df6fe7503a726756c82041b770d8e90cae00b38ede7ecb2f31178ccb9f472a98b86f90208d4627fa4aaaf3c0383272b451e3015
diff --git a/net-dns/knot/files/knot-1.init b/net-dns/knot/files/knot-1.init
new file mode 100644
index 000000000000..989a576dcc59
--- /dev/null
+++ b/net-dns/knot/files/knot-1.init
@@ -0,0 +1,42 @@
+#!/sbin/openrc-run
+# Copyright 2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+: ${KNOT_USER:=knot}
+: ${KNOT_GROUP:=knot}
+: ${KNOT_PIDFILE:=/run/knot.pid}
+: ${KNOT_CONFIG:=/etc/knot/knot.conf}
+
+name="knot"
+description="High-performance authoritative-only DNS server"
+command="/usr/sbin/knotd"
+command_args="-c ${KNOT_CONFIG}"
+command_user="${KNOT_USER}:${KNOT_GROUP}"
+command_background=true
+pidfile="${KNOT_PIDFILE}"
+
+extra_commands="checkconfig"
+extra_started_commands="reload"
+
+checkconfig() {
+	/usr/bin/knotc conf-check 1>/dev/null || return 1
+}
+
+reload() {
+	checkconfig || return 1
+	ebegin "Reloading ${SVCNAME}"
+	start-stop-daemon --signal HUP --pidfile $pidfile
+	eend $?
+}
+
+start_pre() {
+	if [ "${RC_CMD}" != "restart" ]; then
+		checkconfig || return 1
+	fi
+}
+
+stop_pre() {
+	if [ "${RC_CMD}" != "restart" ]; then
+		checkconfig || return 1
+	fi
+}
diff --git a/net-dns/knot/files/knot.tmpfile b/net-dns/knot/files/knot.tmpfile
new file mode 100644
index 000000000000..dfc488ca0583
--- /dev/null
+++ b/net-dns/knot/files/knot.tmpfile
@@ -0,0 +1,2 @@
+d /run/knot	0750	knot	knot
+d /var/lib/knot	0750	knot	knot
diff --git a/net-dns/knot/knot-3.4.2.ebuild b/net-dns/knot/knot-3.4.2.ebuild
new file mode 100644
index 000000000000..06a4f78e8400
--- /dev/null
+++ b/net-dns/knot/knot-3.4.2.ebuild
@@ -0,0 +1,166 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit autotools flag-o-matic systemd tmpfiles
+
+# subslot: libknot major.libdnssec major.libzscanner major
+KNOT_SUBSLOT="15.9.4"
+
+DESCRIPTION="High-performance authoritative-only DNS server"
+HOMEPAGE="https://www.knot-dns.cz/ https://gitlab.nic.cz/knot/knot-dns"
+SRC_URI="https://secure.nic.cz/files/knot-dns/${P/_/-}.tar.xz"
+
+S="${WORKDIR}/${P/_/-}"
+
+LICENSE="GPL-3+"
+SLOT="0/${KNOT_SUBSLOT}"
+KEYWORDS="~amd64 ~riscv ~x86"
+
+KNOT_MODULES=(
+	"+authsignal"
+	"+cookies"
+	"+dnsproxy"
+	"dnstap"
+	"geoip"
+	"+noudp"
+	"+onlinesign"
+	"+queryacl"
+	"+rrl"
+	"+stats"
+	"+synthrecord"
+	"+whoami"
+)
+
+IUSE="caps +daemon dbus +doc doh +fastparser +idn pkcs11 quic systemd test +utils xdp ${KNOT_MODULES[@]}"
+RESTRICT="!test? ( test )"
+
+COMMON_DEPEND="
+	dev-libs/libedit
+	dnstap? (
+		dev-libs/fstrm
+		dev-libs/protobuf-c:=
+	)
+	quic? ( net-libs/ngtcp2[gnutls] )
+"
+RDEPEND="
+	dev-db/lmdb:=
+	net-libs/gnutls:=[pkcs11?]
+	daemon? (
+		${COMMON_DEPEND}
+		acct-group/knot
+		acct-user/knot
+		dev-libs/userspace-rcu:=
+		caps? ( sys-libs/libcap-ng )
+		dbus? ( sys-apps/dbus )
+		geoip? ( dev-libs/libmaxminddb:= )
+		systemd? ( sys-apps/systemd:= )
+		)
+	utils? (
+		${COMMON_DEPEND}
+		doh? ( net-libs/nghttp2:= )
+		idn? ( net-dns/libidn2:= )
+	)
+	xdp? (
+		>=dev-libs/libbpf-1.0:=
+		net-libs/xdp-tools
+		utils? ( net-libs/libmnl:= )
+	)
+"
+DEPEND="${RDEPEND}"
+BDEPEND="
+	virtual/pkgconfig
+	doc? ( dev-python/sphinx )
+	test? (
+		pkcs11? ( dev-libs/softhsm )
+	)
+"
+
+src_prepare() {
+	default
+
+	# these tests call this daemon file knot/server/dthreads.h
+	if use test && use !daemon; then
+		sed -i \
+		-e '/test_atomic/d' \
+		-e '/test_spinlock/d' \
+		tests/Makefile.am || die
+		eautoreconf
+	fi
+}
+
+src_configure() {
+	local u
+	local my_conf=(
+		--with-storage="${EPREFIX}/var/lib/${PN}"
+		--with-rundir="${EPREFIX}/var/run/${PN}"
+		$(use_enable caps cap_ng)
+		$(use_enable daemon)
+		$(use_enable fastparser)
+		$(use_enable dnstap)
+		$(use_enable doc documentation)
+		$(use_with doh libnghttp2)
+		$(use_enable geoip maxminddb)
+		$(use_with idn libidn)
+		$(use_enable quic)
+		$(use_enable systemd)
+		$(use_enable utils utilities)
+		$(use_enable xdp)
+	)
+
+	# modules (except dnstap forced by use_enable if set with utils) are only used by daemon
+	if use daemon; then
+		for u in "${KNOT_MODULES[@]#+}"; do
+			my_conf+=("$(use_with ${u} module-${u})")
+		done
+	else
+			my_conf+=("--disable-modules")
+	fi
+
+	if use !daemon; then
+		my_conf+=("--enable-dbus=no")
+	elif use dbus; then
+		my_conf+=("--enable-dbus=libdbus")
+	elif use !dbus && use !systemd; then
+		my_conf+=("--enable-dbus=no")
+	elif use !dbus && use systemd; then
+		my_conf+=("--enable-dbus=systemd")
+	fi
+
+	if use riscv; then
+		append-libs -latomic
+	fi
+
+	econf "${my_conf[@]}"
+}
+
+src_compile() {
+	default
+
+	use doc && emake -C doc html
+}
+
+src_install() {
+	use doc && local HTML_DOCS=( doc/_build/html/{*.html,*.js,_sources,_static} )
+
+	default
+
+	if use daemon; then
+		rmdir "${D}/var/run/${PN}" "${D}/var/run/" || die
+
+		newinitd "${FILESDIR}/knot-1.init" knot
+
+		newtmpfiles "${FILESDIR}"/${PN}.tmpfile ${PN}.conf
+
+		use systemd && systemd_newunit distro/common/knot.service knot.service
+	fi
+
+	find "${D}" -name '*.la' -delete || die
+
+	keepdir /var/lib/knot
+}
+
+pkg_postinst() {
+	use daemon && tmpfiles_process ${PN}.conf
+}
diff --git a/net-dns/knot/metadata.xml b/net-dns/knot/metadata.xml
index d7aafeb4ba1e..eb4839a1be64 100644
--- a/net-dns/knot/metadata.xml
+++ b/net-dns/knot/metadata.xml
@@ -10,9 +10,15 @@
 		<name>Proxy Maintainers</name>
 	</maintainer>
 	<use>
+		<flag name="authsignal">
+			Enable Automatic Authenticated DNSSEC Bootstrapping records
+		</flag>
 		<flag name="cookies">
 			Enable the DNS cookie module (RFC 7873)
 		</flag>
+		<flag name="daemon">
+			Enable Knot DNS main daemon
+		</flag>
 		<flag name="doh">
 			Enable DNS over HTTP (DoH) using libnghttp2
 		</flag>
@@ -42,6 +48,9 @@
 			Enable the module that sign zones on the fly instead of
 			pre-signing zone
 		</flag>
+		<flag name="pkcs11">
+			Add support for PKCS#11
+		</flag>
 		<flag name="queryacl">
 			Enable the module for query access control
 		</flag>