GitLab

Closes GH-9961

Fixes #10626

move python modules and dnssec-tools to separate subpackages so we avoid
install python3 by default.

py3-bind may be useful separately for python scripts so lets separate
out that as well.

- CVE-2019-6467
- CVE-2018-5743

fixes #10367

Otherwise the dev and tools subpackages install dns-root-hints (since
both depend on the libs subpackage) even though they shouldn't need it.

Discussion: Unfortunately, abuild doesn't have a depends_libs variable
thus we need to define a custom libs function to clear the dependency.
This approach is also used by other abuilds, e.g. testing/boinc.

See also: 4badc1aa

named-checkconf needs entropy to start, or else it will take
up to a minute to start at boot.

- CVE-2019-6465
- CVE-2018-5745
- CVE-2018-5744

https://kb.isc.org/docs/dnssec-key-deletion-may-create-broken-nsec-and-nsec3-chains-and-unnecessary-rrsigs

* Add "--disable-isc-spnego" to use gss-spnego instead.

fixes #9462

* Enable DLZ (Dynamically Loadable Zones) support with file system, ldap, stub backends
* Enable GSSAPI/Kerberos support
* Re-arrange configure options

bump pkgrel to avoid mismatch with caches

This reverts commit 724d3ef9.

fixes #7437

CVE-2017-3136: An error handling synthesized records could cause an assertion failure when using DNS64 with "break-dnssec yes;"
CVE-2017-3137: A response packet can cause a resolver to terminate when processing an answer containing a CNAME or DNAME
CVE-2017-3138: named exits with a REQUIRE assertion failure if it receives a null command string on its control channel

fixes #6828

We dont want copy the content of /etc/skel to /etc/bind
ref #6725

https://www.isc.org/downloads/bind/bind-9-11-new-features/
https://deepthought.isc.org/article/AA-01446/0/BIND-9.11.0-P2-Release-Notes.html
https://kb.isc.org/article/AA-00913/74/BIND-9-Security-Vulnerability-Matrix.html

Release notes mention addressing issue described in:

CVE-2016-9778: An error handling certain queries using the
               nxdomain-redirect feature could cause a REQUIRE assertion
               failure in db.c

but it's not present in 9.10.x, so it's not a security upgrade.