- added openldap to overlay to isolate shadow dependency during catalyst build (user/groupadd issue), see bug #53269

- include nfsroot_stage4-slim.spec in this commit
- remove threads from the openmpi USE flags (USE flag changed to mpi-threads)

18 files changed, 1260 insertions, 6 deletions

diff --git a/catalyst/nfsroot/2008.0/specs/amd64/nfsroot_stage4-slim.spec b/catalyst/nfsroot/2008.0/specs/amd64/nfsroot_stage4-slim.spec
index d92c515..ca63462 100644
--- a/catalyst/nfsroot/2008.0/specs/amd64/nfsroot_stage4-slim.spec
+++ b/catalyst/nfsroot/2008.0/specs/amd64/nfsroot_stage4-slim.spec
@@ -12,7 +12,7 @@ subarch: amd64
 # example:
 # version_stamp: 2006.1
 #version_stamp: nfsroot-20080629
-version_stamp: nfsroot-20080816
+version_stamp: nfsroot-slim
 
 # The target specifies what target we want catalyst to do.  For building a CD,
 # we start with stage4 as our target.
@@ -92,6 +92,7 @@ stage4/use:
 	pbs
 	-tk
 	-server
+	-authmaster
 
 # This is the set of packages that we will merge into the stage4 tarball.  They
 # will be built with the USE flags configured above.  These packages must not
@@ -111,6 +112,7 @@ stage4/packages:
 	app-shells/dash
 	sys-process/vixie-cron
 	net-dns/bind-tools
+	net-nds/openldap
 # Clustering stuff:
     sys-cluster/c3
     sys-cluster/openmpi
diff --git a/overlay/net-nds/ldap-auth/Manifest b/overlay/net-nds/ldap-auth/Manifest
index 1d4e729..9bf6130 100644
--- a/overlay/net-nds/ldap-auth/Manifest
+++ b/overlay/net-nds/ldap-auth/Manifest
@@ -1,3 +1,3 @@
-AUX cluster_ldap_skel.conf 4069 RMD160 f383130b4b41aa901ba002572575898ad8328f75 SHA1 f2c8a0aa2d3d15458e09a8dfc801eca59cc6a505 SHA256 11fda02a86821caf073345ff22857e74f280a4a48dd8072cf352dae5a336881f
+AUX cluster_ldap_skel.conf 4069 RMD160 8aa874f5b32fa254b428238f99104e25d150f6ab SHA1 652c43d1549a11d7ef0c4a9d45636f3c837cb5f5 SHA256 580a20e1ba6bf1635e308f3d84f6eae4fb3c470d5c54ff6b975f0c160d6dffc2
 EBUILD ldap-auth-0.1.ebuild 13598 RMD160 3b14c80e3ce44f49c77c80d9f02bfb27af5d61bd SHA1 4ccbeb998e35f1b5937d407e37f30ce8953c202e SHA256 5e1c16655d8b9c5ab99f64c86019a0255cc60396e8e14b75452f4d9b3739df6c
 MISC ChangeLog 96 RMD160 33378f096bd5ea216ab1105e8293de02bf385f3c SHA1 71bc3c85f819f3ac9f7a403bb7eb56a7f75bc0e3 SHA256 71b814def53b860a9afb5aee0eb35f95f6aa5302ebdb89455e2ca0ec3f7774a6
diff --git a/overlay/net-nds/openldap/Manifest b/overlay/net-nds/openldap/Manifest
new file mode 100644
index 0000000..17944df
--- /dev/null
+++ b/overlay/net-nds/openldap/Manifest
@@ -0,0 +1,10 @@
+AUX DB_CONFIG.fast.example 746 RMD160 03d179d1c58d695c442eb5e3e69c245f3c2f2358 SHA1 c76a2a9f346a733ed6617d42229b434ce723c59e SHA256 69fc9aa6e4f0b888bc02d3f75642fe1ebf9345c685257a5c1236b2e79ed56e0b
+AUX openldap-2.2.14-perlthreadsfix.patch 614 RMD160 6e868aa5a5cc4e80c0340af25d18d010b342ed15 SHA1 3bb05c7ed511e8464331619ce23064d236a5fe82 SHA256 bb719cc1fed47ff0f111c960f3295781ae6f0d9e98b4266a87751044b4bb3175
+AUX openldap-2.3.24-contrib-smbk5pwd.patch 1631 RMD160 01e394da82c2ca8493d0dc15c400675545f463bb SHA1 33781455168d2041f3ec00bbaf2da4ffbe411396 SHA256 277990c6bc9e00c29bc5123d5074e1a741a224e884f92651b301375b02edc70e
+AUX openldap-2.4-disable-bdb46.patch 10249 RMD160 d989e7298722c99d104c96eb36dbb5923a00b2c7 SHA1 8a9c8f2f7b53bfdc1c478d3d7f59227c4e24e37f SHA256 b765619b06be4a3a48f8057527818af2ee9a4628c265cf02ed72797de1d1b014
+AUX openldap-2.4-ppolicy.patch 455 RMD160 653695a9853bb7e1c9f53a779cb7ac2755edaf4e SHA1 8f419fddf0abf1fef48732b04617293c3ca1ed36 SHA256 355a8239355fcc5863ba7430d73af7ccad9e0211ae56180011d15d7418aa5b27
+AUX slapd-confd 436 RMD160 764d5e2915d9af33fd1db2489ceac6d953750984 SHA1 a16b4674b45ac1e1c8a8f9e84ad0de519c81aa11 SHA256 1ccb8a3b78b65b125b24779dd065cf8000e2d5e4da267bb0a892e730edd2055d
+AUX slapd-initd 578 RMD160 635aa3fcf59ea2d171a0f49bd7677ce35f9765ac SHA1 30770f53469ad1bd28e4710d0c727e531086b49f SHA256 6dc0aa449566e180307d95192ba809a1a17ce3e2ac813082dab86c2a91a518a8
+AUX slurpd-initd 494 RMD160 9f3a06bcab2e4ce8e66783af506d26595bbbdcd2 SHA1 8ab66a984510fa91755cbcbac29883cea1435db7 SHA256 b23e010f701620ec34c39cd215891c7c0afc773341392a1e762e84166d9863ff
+DIST openldap-2.4.10.tgz 4453204 RMD160 ce070f88eeecdf2418ec74d25526003f5a6fe404 SHA1 7363e50c7b199abc2ce09228d8533a7a16b7bbff SHA256 e460b1ef2a7a50ec8d7bd70c29d5cb3191f091fab50b96a7e10454ee8e4d0902
+EBUILD openldap-2.4.10-r1.ebuild 13903 RMD160 d8f3ce79529f3beae3d280388f56590f9830ec03 SHA1 331eaa92c4631059e064c9af7051495df74a6405 SHA256 10fe70ce79460a09dc55c6fd775223aeffff3378683c4c4159f24b476ee27651
diff --git a/overlay/net-nds/openldap/files/DB_CONFIG.fast.example b/overlay/net-nds/openldap/files/DB_CONFIG.fast.example
new file mode 100644
index 0000000..8b52062
--- /dev/null
+++ b/overlay/net-nds/openldap/files/DB_CONFIG.fast.example
@@ -0,0 +1,25 @@
+# $OpenLDAP: pkg/ldap/servers/slapd/DB_CONFIG,v 1.1 2004/06/18 02:49:08 kurt Exp $
+# Example DB_CONFIG file for use with slapd(8) BDB/HDB databases.
+#
+# See Sleepycat Berkeley DB documentation
+#   <http://www.sleepycat.com/docs/ref/env/db_config.html>
+# for detail description of DB_CONFIG syntax and semantics.
+#
+# Hints can also be found in the OpenLDAP Software FAQ
+#	<http://www.openldap.org/faq/index.cgi?file=2>
+
+# one 0.25 GB cache
+set_cachesize 0 16777216 0
+
+# Data Directory
+#set_data_dir db
+
+# Transaction Log settings
+set_lg_regionmax 262144
+set_lg_bsize 524288
+#set_lg_dir logs
+
+# When using (and only when using) slapadd(8) or slapindex(8),
+# the following flags may be useful:
+#set_flags DB_TXN_NOSYNC
+#set_flags DB_TXN_NOT_DURABLE
diff --git a/overlay/net-nds/openldap/files/openldap-2.2.14-perlthreadsfix.patch b/overlay/net-nds/openldap/files/openldap-2.2.14-perlthreadsfix.patch
new file mode 100644
index 0000000..ddb6672
--- /dev/null
+++ b/overlay/net-nds/openldap/files/openldap-2.2.14-perlthreadsfix.patch
@@ -0,0 +1,12 @@
+diff -ur openldap-2.2.14.orig/servers/slapd/back-perl/Makefile.in openldap-2.2.14/servers/slapd/back-perl/Makefile.in
+--- openldap-2.2.14.orig/servers/slapd/back-perl/Makefile.in	2004-04-12 11:20:14.000000000 -0700
++++ openldap-2.2.14/servers/slapd/back-perl/Makefile.in	2004-06-20 18:43:41.000000000 -0700
+@@ -31,7 +31,7 @@
+ 
+ shared_LDAP_LIBS = $(LDAP_LIBLDAP_R_LA) $(LDAP_LIBLBER_LA)
+ NT_LINK_LIBS = -L.. -lslapd $(@BUILD_LIBS_DYNAMIC@_LDAP_LIBS)
+-UNIX_LINK_LIBS = $(@BUILD_LIBS_DYNAMIC@_LDAP_LIBS)
++UNIX_LINK_LIBS = $(@BUILD_LIBS_DYNAMIC@_LDAP_LIBS) `perl -MExtUtils::Embed -e ldopts`
+ 
+ LIBBASE = back_perl
+ 
diff --git a/overlay/net-nds/openldap/files/openldap-2.3.24-contrib-smbk5pwd.patch b/overlay/net-nds/openldap/files/openldap-2.3.24-contrib-smbk5pwd.patch
new file mode 100644
index 0000000..091ff26
--- /dev/null
+++ b/overlay/net-nds/openldap/files/openldap-2.3.24-contrib-smbk5pwd.patch
@@ -0,0 +1,53 @@
+--- contrib/slapd-modules/smbk5pwd/Makefile.ORIG	2006-05-17 13:11:57.194660019 +0300
++++ contrib/slapd-modules/smbk5pwd/Makefile	2006-05-17 13:11:14.503082288 +0300
+@@ -9,29 +9,39 @@
+ # top-level directory of the distribution or, alternatively, at
+ # <http://www.OpenLDAP.org/license.html>.
+ 
++#libexecdir=/usr/lib/openldap
++moduledir=$(libexecdir)/openldap
+ LIBTOOL=../../../libtool
+-OPT=-g -O2
++#OPT=
+ CC=gcc
+ 
+ # Omit DO_KRB5 or DO_SAMBA if you don't want to support it.
+-DEFS=-DDO_KRB5 -DDO_SAMBA
++#DEFS=
+ 
+-HEIMDAL_INC=-I/usr/heimdal/include
++#KRB5_INC=
+ SSL_INC=
+ LDAP_INC=-I../../../include -I../../../servers/slapd
+-INCS=$(LDAP_INC) $(HEIMDAL_INC) $(SSL_INC)
++INCS=$(LDAP_INC) $(SSL_INC) $(KRB5_INC)
+ 
+-HEIMDAL_LIB=-L/usr/heimdal/lib -lkrb5 -lkadm5srv
++KRB5_LIB=-lkrb5 -lkadm5srv
+ SSL_LIB=-lcrypto
+-LDAP_LIB=-lldap_r -llber
+-LIBS=$(LDAP_LIB) $(HEIMDAL_LIB) $(SSL_LIB)
+-
++LDAP_LIB=-L../../../libraries/libldap_r -lldap_r -llber
++ifneq (DDO_KRB5,$(findstring DDO_KRB5,$(DEFS)))
++	LIBS=$(LDAP_LIB) $(SSL_LIB)
++else
++	LIBS=$(LDAP_LIB) $(KRB5_LIB) $(SSL_LIB)
++endif
++	
+ all:	smbk5pwd.la
+ 
+ 
+ smbk5pwd.lo:	smbk5pwd.c
+-	$(LIBTOOL) --mode=compile $(CC) $(OPT) $(DEFS) $(INCS) -c $?
++	$(LIBTOOL) --mode=compile $(CC) $(CFLAGS) $(DEFS) $(INCS) -c $?
+ 
+ smbk5pwd.la:	smbk5pwd.lo
+-	$(LIBTOOL) --mode=link $(CC) $(OPT) -version-info 0:0:0 \
+-	-rpath /usr/local/libexec/openldap -module -o $@ $? $(LIBS)
++	$(LIBTOOL) --mode=link $(CC) $(CFLAGS) -version-info 0:0:0 \
++	-rpath $(moduledir) -module -o $@ $? $(LIBS)
++
++install-mod:
++	$(LIBTOOL) --mode=install ../../../build/shtool install -c \
++	-m 755 smbk5pwd.la $(DESTDIR)$(moduledir)
diff --git a/overlay/net-nds/openldap/files/openldap-2.4-disable-bdb46.patch b/overlay/net-nds/openldap/files/openldap-2.4-disable-bdb46.patch
new file mode 100644
index 0000000..d508ba7
--- /dev/null
+++ b/overlay/net-nds/openldap/files/openldap-2.4-disable-bdb46.patch
@@ -0,0 +1,448 @@
+--- ./configure.orig	2007-10-17 01:58:19.000000000 +0200
++++ ./configure	2008-01-13 21:43:23.948292728 +0100
+@@ -27743,444 +27743,7 @@
+ echo "${ECHO_T}$ol_cv_bdb_minor" >&6
+ 
+ if test $ol_cv_bdb_major = 4 ; then
+-	if test $ol_cv_bdb_minor = 6 ; then
+-		if test $ol_cv_lib_db = no ; then
+-	echo "$as_me:$LINENO: checking for Berkeley DB link (-ldb-4.6)" >&5
+-echo $ECHO_N "checking for Berkeley DB link (-ldb-4.6)... $ECHO_C" >&6
+-if test "${ol_cv_db_db_4_dot_6+set}" = set; then
+-  echo $ECHO_N "(cached) $ECHO_C" >&6
+-else
+-
+-	ol_DB_LIB=-ldb-4.6
+-	ol_LIBS=$LIBS
+-	LIBS="$ol_DB_LIB $LTHREAD_LIBS $LIBS"
+-
+-	cat >conftest.$ac_ext <<_ACEOF
+-/* confdefs.h.  */
+-_ACEOF
+-cat confdefs.h >>conftest.$ac_ext
+-cat >>conftest.$ac_ext <<_ACEOF
+-/* end confdefs.h.  */
+-
+-#ifdef HAVE_DB_185_H
+-# include <db_185.h>
+-#else
+-# include <db.h>
+-#endif
+-
+-#ifndef DB_VERSION_MAJOR
+-# define DB_VERSION_MAJOR 1
+-#endif
+-
+-#ifndef NULL
+-#define NULL ((void*)0)
+-#endif
+-
+-int
+-main ()
+-{
+-
+-#if DB_VERSION_MAJOR > 1
+-	{
+-		char *version;
+-		int major, minor, patch;
+-
+-		version = db_version( &major, &minor, &patch );
+-
+-		if( major != DB_VERSION_MAJOR ||
+-			minor < DB_VERSION_MINOR )
+-		{
+-			printf("Berkeley DB version mismatch\n"
+-				"\theader: %s\n\tlibrary: %s\n",
+-				DB_VERSION_STRING, version);
+-			return 1;
+-		}
+-	}
+-#endif
+-
+-#if DB_VERSION_MAJOR > 2
+-	db_env_create( NULL, 0 );
+-#elif DB_VERSION_MAJOR > 1
+-	db_appexit( NULL );
+-#else
+-	(void) dbopen( NULL, 0, 0, 0, NULL);
+-#endif
+-
+-  ;
+-  return 0;
+-}
+-_ACEOF
+-rm -f conftest.$ac_objext conftest$ac_exeext
+-if { (eval echo "$as_me:$LINENO: \"$ac_link\"") >&5
+-  (eval $ac_link) 2>conftest.er1
+-  ac_status=$?
+-  grep -v '^ *+' conftest.er1 >conftest.err
+-  rm -f conftest.er1
+-  cat conftest.err >&5
+-  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+-  (exit $ac_status); } &&
+-	 { ac_try='test -z "$ac_c_werror_flag"
+-			 || test ! -s conftest.err'
+-  { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5
+-  (eval $ac_try) 2>&5
+-  ac_status=$?
+-  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+-  (exit $ac_status); }; } &&
+-	 { ac_try='test -s conftest$ac_exeext'
+-  { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5
+-  (eval $ac_try) 2>&5
+-  ac_status=$?
+-  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+-  (exit $ac_status); }; }; then
+-  ol_cv_db_db_4_dot_6=yes
+-else
+-  echo "$as_me: failed program was:" >&5
+-sed 's/^/| /' conftest.$ac_ext >&5
+-
+-ol_cv_db_db_4_dot_6=no
+-fi
+-rm -f conftest.err conftest.$ac_objext \
+-      conftest$ac_exeext conftest.$ac_ext
+-
+-	LIBS="$ol_LIBS"
+-
+-fi
+-echo "$as_me:$LINENO: result: $ol_cv_db_db_4_dot_6" >&5
+-echo "${ECHO_T}$ol_cv_db_db_4_dot_6" >&6
+-
+-	if test $ol_cv_db_db_4_dot_6 = yes ; then
+-		ol_cv_lib_db=-ldb-4.6
+-	fi
+-fi
+-
+-		if test $ol_cv_lib_db = no ; then
+-	echo "$as_me:$LINENO: checking for Berkeley DB link (-ldb46)" >&5
+-echo $ECHO_N "checking for Berkeley DB link (-ldb46)... $ECHO_C" >&6
+-if test "${ol_cv_db_db46+set}" = set; then
+-  echo $ECHO_N "(cached) $ECHO_C" >&6
+-else
+-
+-	ol_DB_LIB=-ldb46
+-	ol_LIBS=$LIBS
+-	LIBS="$ol_DB_LIB $LTHREAD_LIBS $LIBS"
+-
+-	cat >conftest.$ac_ext <<_ACEOF
+-/* confdefs.h.  */
+-_ACEOF
+-cat confdefs.h >>conftest.$ac_ext
+-cat >>conftest.$ac_ext <<_ACEOF
+-/* end confdefs.h.  */
+-
+-#ifdef HAVE_DB_185_H
+-# include <db_185.h>
+-#else
+-# include <db.h>
+-#endif
+-
+-#ifndef DB_VERSION_MAJOR
+-# define DB_VERSION_MAJOR 1
+-#endif
+-
+-#ifndef NULL
+-#define NULL ((void*)0)
+-#endif
+-
+-int
+-main ()
+-{
+-
+-#if DB_VERSION_MAJOR > 1
+-	{
+-		char *version;
+-		int major, minor, patch;
+-
+-		version = db_version( &major, &minor, &patch );
+-
+-		if( major != DB_VERSION_MAJOR ||
+-			minor < DB_VERSION_MINOR )
+-		{
+-			printf("Berkeley DB version mismatch\n"
+-				"\theader: %s\n\tlibrary: %s\n",
+-				DB_VERSION_STRING, version);
+-			return 1;
+-		}
+-	}
+-#endif
+-
+-#if DB_VERSION_MAJOR > 2
+-	db_env_create( NULL, 0 );
+-#elif DB_VERSION_MAJOR > 1
+-	db_appexit( NULL );
+-#else
+-	(void) dbopen( NULL, 0, 0, 0, NULL);
+-#endif
+-
+-  ;
+-  return 0;
+-}
+-_ACEOF
+-rm -f conftest.$ac_objext conftest$ac_exeext
+-if { (eval echo "$as_me:$LINENO: \"$ac_link\"") >&5
+-  (eval $ac_link) 2>conftest.er1
+-  ac_status=$?
+-  grep -v '^ *+' conftest.er1 >conftest.err
+-  rm -f conftest.er1
+-  cat conftest.err >&5
+-  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+-  (exit $ac_status); } &&
+-	 { ac_try='test -z "$ac_c_werror_flag"
+-			 || test ! -s conftest.err'
+-  { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5
+-  (eval $ac_try) 2>&5
+-  ac_status=$?
+-  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+-  (exit $ac_status); }; } &&
+-	 { ac_try='test -s conftest$ac_exeext'
+-  { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5
+-  (eval $ac_try) 2>&5
+-  ac_status=$?
+-  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+-  (exit $ac_status); }; }; then
+-  ol_cv_db_db46=yes
+-else
+-  echo "$as_me: failed program was:" >&5
+-sed 's/^/| /' conftest.$ac_ext >&5
+-
+-ol_cv_db_db46=no
+-fi
+-rm -f conftest.err conftest.$ac_objext \
+-      conftest$ac_exeext conftest.$ac_ext
+-
+-	LIBS="$ol_LIBS"
+-
+-fi
+-echo "$as_me:$LINENO: result: $ol_cv_db_db46" >&5
+-echo "${ECHO_T}$ol_cv_db_db46" >&6
+-
+-	if test $ol_cv_db_db46 = yes ; then
+-		ol_cv_lib_db=-ldb46
+-	fi
+-fi
+-
+-		if test $ol_cv_lib_db = no ; then
+-	echo "$as_me:$LINENO: checking for Berkeley DB link (-ldb-46)" >&5
+-echo $ECHO_N "checking for Berkeley DB link (-ldb-46)... $ECHO_C" >&6
+-if test "${ol_cv_db_db_46+set}" = set; then
+-  echo $ECHO_N "(cached) $ECHO_C" >&6
+-else
+-
+-	ol_DB_LIB=-ldb-46
+-	ol_LIBS=$LIBS
+-	LIBS="$ol_DB_LIB $LTHREAD_LIBS $LIBS"
+-
+-	cat >conftest.$ac_ext <<_ACEOF
+-/* confdefs.h.  */
+-_ACEOF
+-cat confdefs.h >>conftest.$ac_ext
+-cat >>conftest.$ac_ext <<_ACEOF
+-/* end confdefs.h.  */
+-
+-#ifdef HAVE_DB_185_H
+-# include <db_185.h>
+-#else
+-# include <db.h>
+-#endif
+-
+-#ifndef DB_VERSION_MAJOR
+-# define DB_VERSION_MAJOR 1
+-#endif
+-
+-#ifndef NULL
+-#define NULL ((void*)0)
+-#endif
+-
+-int
+-main ()
+-{
+-
+-#if DB_VERSION_MAJOR > 1
+-	{
+-		char *version;
+-		int major, minor, patch;
+-
+-		version = db_version( &major, &minor, &patch );
+-
+-		if( major != DB_VERSION_MAJOR ||
+-			minor < DB_VERSION_MINOR )
+-		{
+-			printf("Berkeley DB version mismatch\n"
+-				"\theader: %s\n\tlibrary: %s\n",
+-				DB_VERSION_STRING, version);
+-			return 1;
+-		}
+-	}
+-#endif
+-
+-#if DB_VERSION_MAJOR > 2
+-	db_env_create( NULL, 0 );
+-#elif DB_VERSION_MAJOR > 1
+-	db_appexit( NULL );
+-#else
+-	(void) dbopen( NULL, 0, 0, 0, NULL);
+-#endif
+-
+-  ;
+-  return 0;
+-}
+-_ACEOF
+-rm -f conftest.$ac_objext conftest$ac_exeext
+-if { (eval echo "$as_me:$LINENO: \"$ac_link\"") >&5
+-  (eval $ac_link) 2>conftest.er1
+-  ac_status=$?
+-  grep -v '^ *+' conftest.er1 >conftest.err
+-  rm -f conftest.er1
+-  cat conftest.err >&5
+-  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+-  (exit $ac_status); } &&
+-	 { ac_try='test -z "$ac_c_werror_flag"
+-			 || test ! -s conftest.err'
+-  { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5
+-  (eval $ac_try) 2>&5
+-  ac_status=$?
+-  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+-  (exit $ac_status); }; } &&
+-	 { ac_try='test -s conftest$ac_exeext'
+-  { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5
+-  (eval $ac_try) 2>&5
+-  ac_status=$?
+-  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+-  (exit $ac_status); }; }; then
+-  ol_cv_db_db_46=yes
+-else
+-  echo "$as_me: failed program was:" >&5
+-sed 's/^/| /' conftest.$ac_ext >&5
+-
+-ol_cv_db_db_46=no
+-fi
+-rm -f conftest.err conftest.$ac_objext \
+-      conftest$ac_exeext conftest.$ac_ext
+-
+-	LIBS="$ol_LIBS"
+-
+-fi
+-echo "$as_me:$LINENO: result: $ol_cv_db_db_46" >&5
+-echo "${ECHO_T}$ol_cv_db_db_46" >&6
+-
+-	if test $ol_cv_db_db_46 = yes ; then
+-		ol_cv_lib_db=-ldb-46
+-	fi
+-fi
+-
+-		if test $ol_cv_lib_db = no ; then
+-	echo "$as_me:$LINENO: checking for Berkeley DB link (-ldb-4-6)" >&5
+-echo $ECHO_N "checking for Berkeley DB link (-ldb-4-6)... $ECHO_C" >&6
+-if test "${ol_cv_db_db_4_6+set}" = set; then
+-  echo $ECHO_N "(cached) $ECHO_C" >&6
+-else
+-
+-	ol_DB_LIB=-ldb-4-6
+-	ol_LIBS=$LIBS
+-	LIBS="$ol_DB_LIB $LTHREAD_LIBS $LIBS"
+-
+-	cat >conftest.$ac_ext <<_ACEOF
+-/* confdefs.h.  */
+-_ACEOF
+-cat confdefs.h >>conftest.$ac_ext
+-cat >>conftest.$ac_ext <<_ACEOF
+-/* end confdefs.h.  */
+-
+-#ifdef HAVE_DB_185_H
+-# include <db_185.h>
+-#else
+-# include <db.h>
+-#endif
+-
+-#ifndef DB_VERSION_MAJOR
+-# define DB_VERSION_MAJOR 1
+-#endif
+-
+-#ifndef NULL
+-#define NULL ((void*)0)
+-#endif
+-
+-int
+-main ()
+-{
+-
+-#if DB_VERSION_MAJOR > 1
+-	{
+-		char *version;
+-		int major, minor, patch;
+-
+-		version = db_version( &major, &minor, &patch );
+-
+-		if( major != DB_VERSION_MAJOR ||
+-			minor < DB_VERSION_MINOR )
+-		{
+-			printf("Berkeley DB version mismatch\n"
+-				"\theader: %s\n\tlibrary: %s\n",
+-				DB_VERSION_STRING, version);
+-			return 1;
+-		}
+-	}
+-#endif
+-
+-#if DB_VERSION_MAJOR > 2
+-	db_env_create( NULL, 0 );
+-#elif DB_VERSION_MAJOR > 1
+-	db_appexit( NULL );
+-#else
+-	(void) dbopen( NULL, 0, 0, 0, NULL);
+-#endif
+-
+-  ;
+-  return 0;
+-}
+-_ACEOF
+-rm -f conftest.$ac_objext conftest$ac_exeext
+-if { (eval echo "$as_me:$LINENO: \"$ac_link\"") >&5
+-  (eval $ac_link) 2>conftest.er1
+-  ac_status=$?
+-  grep -v '^ *+' conftest.er1 >conftest.err
+-  rm -f conftest.er1
+-  cat conftest.err >&5
+-  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+-  (exit $ac_status); } &&
+-	 { ac_try='test -z "$ac_c_werror_flag"
+-			 || test ! -s conftest.err'
+-  { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5
+-  (eval $ac_try) 2>&5
+-  ac_status=$?
+-  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+-  (exit $ac_status); }; } &&
+-	 { ac_try='test -s conftest$ac_exeext'
+-  { (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5
+-  (eval $ac_try) 2>&5
+-  ac_status=$?
+-  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+-  (exit $ac_status); }; }; then
+-  ol_cv_db_db_4_6=yes
+-else
+-  echo "$as_me: failed program was:" >&5
+-sed 's/^/| /' conftest.$ac_ext >&5
+-
+-ol_cv_db_db_4_6=no
+-fi
+-rm -f conftest.err conftest.$ac_objext \
+-      conftest$ac_exeext conftest.$ac_ext
+-
+-	LIBS="$ol_LIBS"
+-
+-fi
+-echo "$as_me:$LINENO: result: $ol_cv_db_db_4_6" >&5
+-echo "${ECHO_T}$ol_cv_db_db_4_6" >&6
+-
+-	if test $ol_cv_db_db_4_6 = yes ; then
+-		ol_cv_lib_db=-ldb-4-6
+-	fi
+-fi
+-
+-	elif test $ol_cv_bdb_minor = 5 ; then
++	if test $ol_cv_bdb_minor = 5 ; then
+ 		if test $ol_cv_lib_db = no ; then
+ 	echo "$as_me:$LINENO: checking for Berkeley DB link (-ldb-4.5)" >&5
+ echo $ECHO_N "checking for Berkeley DB link (-ldb-4.5)... $ECHO_C" >&6
diff --git a/overlay/net-nds/openldap/files/openldap-2.4-ppolicy.patch b/overlay/net-nds/openldap/files/openldap-2.4-ppolicy.patch
new file mode 100644
index 0000000..c05790e
--- /dev/null
+++ b/overlay/net-nds/openldap/files/openldap-2.4-ppolicy.patch
@@ -0,0 +1,13 @@
+diff -urN ./clients.orig/tools/common.c ./clients/tools/common.c
+--- ./clients.orig/tools/common.c	2007-09-01 01:13:50.000000000 +0200
++++ ./clients/tools/common.c	2008-01-13 21:50:06.000000000 +0100
+@@ -1262,8 +1262,8 @@
+ 	int		nsctrls = 0;
+ 
+ #ifdef LDAP_CONTROL_PASSWORDPOLICYREQUEST
++	LDAPControl c;
+ 	if ( ppolicy ) {
+-		LDAPControl c;
+ 		c.ldctl_oid = LDAP_CONTROL_PASSWORDPOLICYREQUEST;
+ 		c.ldctl_value.bv_val = NULL;
+ 		c.ldctl_value.bv_len = 0;
diff --git a/overlay/net-nds/openldap/files/slapd-confd b/overlay/net-nds/openldap/files/slapd-confd
new file mode 100644
index 0000000..2240ad3
--- /dev/null
+++ b/overlay/net-nds/openldap/files/slapd-confd
@@ -0,0 +1,9 @@
+# conf.d file for openldap
+#
+# To enable both the standard unciphered server and the ssl encrypted
+# one uncomment this line or set any other server starting options
+# you may desire.
+#
+# OPTS="-h 'ldaps:// ldap:// ldapi://%2fvar%2frun%2fopenldap%2fslapd.sock'"
+# Uncomment the below to use the new slapd configuration for openldap 2.3
+#OPTS="-F /etc/openldap/slapd.d -h 'ldaps:// ldap:// ldapi://%2fvar%2frun%2fopenldap%2fslapd.sock'"
diff --git a/overlay/net-nds/openldap/files/slapd-initd b/overlay/net-nds/openldap/files/slapd-initd
new file mode 100644
index 0000000..963188a
--- /dev/null
+++ b/overlay/net-nds/openldap/files/slapd-initd
@@ -0,0 +1,20 @@
+#!/sbin/runscript
+# Copyright 1999-2004 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/net-nds/openldap/files/slapd-initd,v 1.2 2008/10/14 10:29:44 robbat2 Exp $
+
+depend() {
+	need net
+}
+
+start() {
+	ebegin "Starting ldap-server"
+	eval start-stop-daemon --start --pidfile /var/run/openldap/slapd.pid --exec /usr/lib/openldap/slapd -- -u ldap -g ldap "${OPTS}"
+	eend $?
+}
+
+stop() {
+	ebegin "Stopping ldap-server"
+	start-stop-daemon --stop --signal 2 --quiet --pidfile /var/run/openldap/slapd.pid 
+	eend $?
+}
diff --git a/overlay/net-nds/openldap/files/slurpd-initd b/overlay/net-nds/openldap/files/slurpd-initd
new file mode 100644
index 0000000..f5aa2ea
--- /dev/null
+++ b/overlay/net-nds/openldap/files/slurpd-initd
@@ -0,0 +1,22 @@
+#!/sbin/runscript
+# Copyright 1999-2004 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/net-nds/openldap/files/slurpd-initd,v 1.1 2007/01/16 23:22:02 jokey Exp $
+
+depend() {
+	need net
+}
+
+start() {
+	ebegin "Starting slurpd"
+	start-stop-daemon --start --quiet \
+	--exec /usr/lib/openldap/slurpd 
+	eend $?
+}
+
+stop() {
+	ebegin "Stopping slurpd"
+	start-stop-daemon --stop --quiet \
+	--exec /usr/lib/openldap/slurpd 
+	eend $?
+}
diff --git a/overlay/net-nds/openldap/openldap-2.4.10-r1.ebuild b/overlay/net-nds/openldap/openldap-2.4.10-r1.ebuild
new file mode 100644
index 0000000..e44f68f
--- /dev/null
+++ b/overlay/net-nds/openldap/openldap-2.4.10-r1.ebuild
@@ -0,0 +1,423 @@
+# Copyright 1999-2008 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/net-nds/openldap/openldap-2.4.10.ebuild,v 1.4 2008/08/13 17:24:27 robbat2 Exp $
+
+EAPI="1"
+inherit db-use eutils flag-o-matic multilib ssl-cert versionator toolchain-funcs
+
+DESCRIPTION="LDAP suite of application and development tools"
+HOMEPAGE="http://www.OpenLDAP.org/"
+SRC_URI="mirror://openldap/openldap-release/${P}.tgz"
+
+LICENSE="OPENLDAP"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~hppa ~ia64 ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~sparc-fbsd ~x86 ~x86-fbsd"
+
+IUSE_DAEMON="crypt samba slp tcpd experimental minimal"
+IUSE_BACKEND="+berkdb"
+IUSE_OVERLAY="overlays perl"
+IUSE_OPTIONAL="gnutls iodbc sasl ssl odbc debug ipv6 syslog selinux"
+IUSE_CONTRIB="smbkrb5passwd kerberos"
+IUSE="${IUSE_DAEMON} ${IUSE_BACKEND} ${IUSE_OVERLAY} ${IUSE_OPTIONAL} ${IUSE_CONTRIB}"
+
+# samba adding openssl is intentional --jokey
+RDEPEND="sys-libs/ncurses
+	tcpd? ( sys-apps/tcp-wrappers )
+	ssl? ( !gnutls? ( dev-libs/openssl )
+		gnutls? ( net-libs/gnutls ) )
+	sasl? ( dev-libs/cyrus-sasl )
+	!minimal? (
+		odbc? ( !iodbc? ( dev-db/unixODBC )
+			iodbc? ( dev-db/libiodbc ) )
+		slp? ( net-libs/openslp )
+		perl? ( dev-lang/perl )
+		samba? ( !gnutls? ( dev-libs/openssl )
+			gnutls? ( net-libs/gnutls ) )
+		berkdb? ( sys-libs/db:4.5 )
+		smbkrb5passwd? (
+			dev-libs/openssl
+			app-crypt/heimdal )
+	)
+	selinux? ( sec-policy/selinux-openldap )"
+DEPEND="${RDEPEND} sys-apps/shadow"
+
+# for tracking versions
+OPENLDAP_VERSIONTAG=".version-tag"
+OPENLDAP_DEFAULTDIR_VERSIONTAG="/var/lib/openldap-data"
+
+openldap_find_versiontags() {
+	# scan for all datadirs
+	openldap_datadirs=""
+	if [ -f "${ROOT}"/etc/openldap/slapd.conf ]; then
+		openldap_datadirs="$(awk '{if($1 == "directory") print $2 }' ${ROOT}/etc/openldap/slapd.conf)"
+	fi
+	openldap_datadirs="${openldap_datadirs} ${OPENLDAP_DEFAULTDIR_VERSIONTAG}"
+
+	einfo
+	einfo "Scanning datadir(s) from slapd.conf and"
+	einfo "the default installdir for Versiontags"
+	einfo "(${OPENLDAP_DEFAULTDIR_VERSIONTAG} may appear twice)"
+	einfo
+
+	# scan datadirs if we have a version tag
+	openldap_found_tag=0
+	for each in ${openldap_datadirs}; do
+		CURRENT_TAGDIR=${ROOT}`echo ${each} | sed "s:\/::"`
+		CURRENT_TAG=${CURRENT_TAGDIR}/${OPENLDAP_VERSIONTAG}
+		if [ -d ${CURRENT_TAGDIR} ] &&	[ ${openldap_found_tag} == 0 ] ; then
+			einfo "- Checking ${each}..."
+			if [ -r ${CURRENT_TAG} ] ; then
+				# yey, we have one :)
+				einfo "   Found Versiontag in ${each}"
+				source ${CURRENT_TAG}
+				if [ "${OLDPF}" == "" ] ; then
+					eerror "Invalid Versiontag found in ${CURRENT_TAGDIR}"
+					eerror "Please delete it"
+					eerror
+					die "Please kill the invalid versiontag in ${CURRENT_TAGDIR}"
+				fi
+
+				OLD_MAJOR=`get_version_component_range 2-3 ${OLDPF}`
+
+				# are we on the same branch?
+				if [ "${OLD_MAJOR}" != "${PV:0:3}" ] ; then
+					ewarn "   Versiontag doesn't match current major release!"
+					if [[ `ls -a ${CURRENT_TAGDIR} | wc -l` -gt 5 ]] ; then
+						eerror "   Versiontag says other major and you (probably) have datafiles!"
+						echo
+						openldap_upgrade_howto
+					else
+						einfo "   No real problem, seems there's no database."
+					fi
+				else
+					einfo "   Versiontag is fine here :)"
+				fi
+			else
+				einfo "   Non-tagged dir ${each}"
+				if [[ `ls -a ${each} | wc -l` > 5 ]] ; then
+					einfo "   EEK! Non-empty non-tagged datadir, counting `ls -a ${each} | wc -l` files"
+					echo
+
+					eerror
+					eerror "Your OpenLDAP Installation has a non tagged datadir that"
+					eerror "possibly contains a database at ${CURRENT_TAGDIR}"
+					eerror
+					eerror "Please export data if any entered and empty or remove"
+					eerror "the directory, installation has been stopped so you"
+					eerror "can take required action"
+					eerror
+					eerror "For a HOWTO on exporting the data, see instructions in the ebuild"
+					eerror
+					die "Please move the datadir ${CURRENT_TAGDIR} away"
+				fi
+			fi
+			einfo
+		fi
+	done
+
+	echo
+	einfo
+	einfo "All datadirs are fine, proceeding with merge now..."
+	einfo
+}
+
+openldap_upgrade_howto() {
+	eerror
+	eerror "A (possible old) installation of OpenLDAP was detected,"
+	eerror "installation will not proceed for now."
+	eerror
+	eerror "As major version upgrades can corrupt your database,"
+	eerror "you need to dump your database and re-create it afterwards."
+	eerror ""
+	d="$(date -u +%s)"
+	l="/root/ldapdump.${d}"
+	i="${l}.raw"
+	eerror " 1. /etc/init.d/slurpd stop ; /etc/init.d/slapd stop"
+	eerror " 2. slapcat -l ${i}"
+	eerror " 3. egrep -v '^entryCSN:' <${i} >${l}"
+	eerror " 4. mv /var/lib/openldap-data/ /var/lib/openldap-data-backup/"
+	eerror " 5. emerge --update \=net-nds/${PF}"
+	eerror " 6. etc-update, and ensure that you apply the changes"
+	eerror " 7. slapadd -l ${l}"
+	eerror " 8. chown ldap:ldap /var/lib/openldap-data/*"
+	eerror " 9. /etc/init.d/slapd start"
+	eerror "10. check that your data is intact."
+	eerror "11. set up the new replication system."
+	eerror
+	die "You need to upgrade your database first"
+}
+
+pkg_setup() {
+	if use minimal && has_version "net-nds/openldap" && built_with_use net-nds/openldap minimal ; then
+		einfo
+		einfo "Skipping scan for previous datadirs as requested by minimal useflag"
+		einfo
+	else
+		openldap_find_versiontags
+	fi
+
+	enewgroup ldap 439
+	enewuser ldap 439 -1 /usr/$(get_libdir)/openldap ldap
+}
+
+src_unpack() {
+	unpack ${A}
+	cd "${S}"
+
+	# ensure correct SLAPI path by default
+	sed -i -e 's,\(#define LDAPI_SOCK\).*,\1 "/var/run/openldap/slapd.sock",' \
+		"${S}"/include/ldap_defaults.h
+
+	epatch \
+		"${FILESDIR}"/${PN}-2.2.14-perlthreadsfix.patch \
+		"${FILESDIR}"/${PN}-2.4-disable-bdb46.patch \
+		"${FILESDIR}"/${PN}-2.4-ppolicy.patch \
+
+	# bug #116045
+	epatch "${FILESDIR}"/${PN}-2.3.24-contrib-smbk5pwd.patch
+
+	cd "${S}"/build
+	einfo "Making sure upstream build strip does not do stripping too early"
+	sed -i.orig \
+		-e '/^STRIP/s,-s,,g' \
+		top.mk || die "Failed to block stripping"
+}
+
+build_contrib_module() {
+	# <dir> <sources> <outputname>
+	cd "${S}/contrib/slapd-modules/$1"
+	einfo "Building contrib-module: $3"
+	$(tc-getCC) -shared \
+		-I../../../include -I../../../servers/slapd ${CFLAGS} -fPIC \
+		${LDFLAGS} -o $3.so $2 || die "building $3 failed"
+}
+
+src_compile() {
+	local myconf
+
+	#Fix for glibc-2.8 and ucred. Bug 228457.
+	append-flags -D_GNU_SOURCE
+
+	use debug && myconf="${myconf} $(use_enable debug)"
+
+	if ! use minimal ; then
+		# backends
+		myconf="${myconf} --enable-slapd"
+		if use berkdb ; then
+			einfo "Using Berkeley DB for local backend"
+			myconf="${myconf} --enable-bdb --enable-hdb"
+			# We need to include the slotted db.h dir for FreeBSD
+			append-cppflags -I$(db_includedir 4.5)
+		else
+			ewarn
+			ewarn "Note: if you disable berkdb, you can only use remote-backends!"
+			ewarn
+			ebeep 5
+			myconf="${myconf} --disable-bdb --disable-hdb"
+		fi
+		for backend in dnssrv ldap meta monitor null passwd relay shell sock; do
+			myconf="${myconf} --enable-${backend}=mod"
+		done
+
+		myconf="${myconf} $(use_enable perl perl mod)"
+
+		if use odbc ; then
+			local odbc_lib="unixodbc"
+			use iodbc && odbc_lib="iodbc"
+			myconf="${myconf} --enable-sql=mod --with-odbc=${odbc_lib}"
+		fi
+
+		# slapd options
+		myconf="${myconf} $(use_enable crypt) $(use_enable slp)"
+		myconf="${myconf} $(use_enable samba lmpasswd)"
+		if use experimental ; then
+			myconf="${myconf} --enable-dynacl"
+			myconf="${myconf} --enable-aci=mod"
+		fi
+		for option in aci cleartext modules rewrite rlookups slapi; do
+			myconf="${myconf} --enable-${option}"
+		done
+
+		# slapd overlay options
+		# Compile-in the syncprov, the others as module
+		myconf="${myconf} --enable-syncprov=yes"
+		use overlays && myconf="${myconf} --enable-overlays=mod"
+	else
+		myconf="${myconf} --disable-slapd --disable-bdb --disable-hdb"
+		myconf="${myconf} --disable-overlays"
+	fi
+
+	# basic functionality stuff
+	myconf="${myconf} $(use_enable ipv6)"
+	myconf="${myconf} $(use_with sasl cyrus-sasl) $(use_enable sasl spasswd)"
+	myconf="${myconf} $(use_enable tcpd wrappers)"
+
+	local ssl_lib="no"
+	if use ssl || ( use ! minimal && use samba ) ; then
+		ssl_lib="openssl"
+		use gnutls && ssl_lib="gnutls"
+	fi
+
+	myconf="${myconf} --with-tls=${ssl_lib}"
+
+	for basicflag in dynamic local proctitle shared static syslog; do
+		myconf="${myconf} --enable-${basicflag}"
+	done
+
+	STRIP=/bin/true \
+	econf \
+		--libexecdir=/usr/$(get_libdir)/openldap \
+		${myconf} || die "configure failed"
+
+	emake depend || die "emake depend failed"
+	emake CC=$(tc-getCC) AR=$(tc-getAR) || die "emake failed"
+
+	if ! use minimal ; then
+		if use smbkrb5passwd ; then
+			einfo "Building contrib-module: smbk5pwd"
+			cd "${S}/contrib/slapd-modules/smbk5pwd"
+
+			emake \
+				DEFS="-DDO_SAMBA -DDO_KRB5" \
+				KRB5_INC="-I/usr/include/heimdal" \
+				CC=$(tc-getCC) \
+				|| die "emake smbk5pwd failed"
+		fi
+
+		if use kerberos ; then
+			cd "${S}/contrib/slapd-modules/passwd"
+			einfo "Building contrib-module: pw-kerberos"
+			$(tc-getCC) -shared \
+				-I../../../include ${CFLAGS} -DHAVE_KRB5 -fPIC \
+				${LDFLAGS} -o pw-kerberos.so kerberos.c || die "building pw-kerberos failed"
+		fi
+		# We could build pw-radius if GNURadius would install radlib.h
+		cd "${S}/contrib/slapd-modules/passwd"
+		einfo "Building contrib-module: pw-netscape"
+		$(tc-getCC) -shared \
+			-I../../../include ${CFLAGS} -fPIC \
+			${LDFLAGS} -o pw-netscape.so netscape.c || die "building pw-netscape failed"
+
+		build_contrib_module "addpartial" "addpartial-overlay.c" "addpartial-overlay"
+		build_contrib_module "allop" "allop.c" "overlay-allop"
+		# TODO: autogroup
+		build_contrib_module "denyop" "denyop.c" "denyop-overlay"
+		build_contrib_module "dsaschema" "dsaschema.c" "dsaschema-plugin"
+		# TODO: lastmod
+		build_contrib_module "nops" "nops.c" "nops-overlay"
+		# TODO: trace
+	fi
+}
+
+src_test() {
+	cd tests ; make tests || die "make tests failed"
+}
+
+src_install() {
+	emake DESTDIR="${D}" install || die "make install failed"
+
+	dodoc ANNOUNCEMENT CHANGES COPYRIGHT README "${FILESDIR}"/DB_CONFIG.fast.example
+	docinto rfc ; dodoc doc/rfc/*.txt
+
+	# openldap modules go here
+	# TODO: write some code to populate slapd.conf with moduleload statements
+	keepdir /usr/$(get_libdir)/openldap/openldap/
+
+	# initial data storage dir
+	keepdir /var/lib/openldap-data
+	fowners ldap:ldap /var/lib/openldap-data
+	fperms 0700 /var/lib/openldap-data
+
+	echo "OLDPF='${PF}'" > "${D}${OPENLDAP_DEFAULTDIR_VERSIONTAG}/${OPENLDAP_VERSIONTAG}"
+	echo "# do NOT delete this. it is used"	>> "${D}${OPENLDAP_DEFAULTDIR_VERSIONTAG}/${OPENLDAP_VERSIONTAG}"
+	echo "# to track versions for upgrading." >> "${D}${OPENLDAP_DEFAULTDIR_VERSIONTAG}/${OPENLDAP_VERSIONTAG}"
+
+	# change slapd.pid location in configuration file
+	keepdir /var/run/openldap
+	fowners ldap:ldap /var/run/openldap
+	fperms 0755 /var/run/openldap
+
+	if ! use minimal; then
+		# use our config
+		rm "${D}"etc/openldap/slapd.conf
+		insinto /etc/openldap
+		newins "${FILESDIR}"/${PN}-2.3.34-slapd-conf slapd.conf
+		configfile="${D}"etc/openldap/slapd.conf
+
+		# populate with built backends
+		ebegin "populate config with built backends"
+		for x in "${D}"usr/$(get_libdir)/openldap/openldap/back_*.so; do
+			elog "Adding $(basename ${x})"
+			sed -e "/###INSERTDYNAMICMODULESHERE###$/a# moduleload\t$(basename ${x})" -i "${configfile}"
+		done
+		sed -e "s:###INSERTDYNAMICMODULESHERE###$:# modulepath\t/usr/$(get_libdir)/openldap/openldap:" -i "${configfile}"
+		fowners root:ldap /etc/openldap/slapd.conf
+		fperms 0640 /etc/openldap/slapd.conf
+		cp "${configfile}" "${configfile}".default
+		eend
+
+		# install our own init scripts
+		newinitd "${FILESDIR}"/slapd-initd slapd
+		newconfd "${FILESDIR}"/slapd-confd slapd
+		if [ $(get_libdir) != lib ]; then
+			sed -e "s,/usr/lib/,/usr/$(get_libdir)/," -i "${D}"etc/init.d/slapd
+		fi
+
+		if use smbkrb5passwd ; then
+			einfo "Install the smbk5pwd module"
+			cd "${S}/contrib/slapd-modules/smbk5pwd"
+			emake DESTDIR="${D}" libexecdir="/usr/$(get_libdir)/openldap" install-mod || die "emake install smbk5pwd failed"
+			newdoc README smbk5pwd-README
+		fi
+
+		einfo "Installing contrib modules"
+		cd "${S}/contrib/slapd-modules"
+		insinto /usr/$(get_libdir)/openldap/openldap
+		doins  */*.so
+		docinto contrib
+		newdoc addpartial/README addpartial-README
+		newdoc allop/README allop-README
+		doman allop/slapo-allop.5
+		newdoc denyop/denyop.c denyop-denyop.c
+		newdoc dsaschema/README dsaschema-README
+		doman lastmod/slapo-lastmod.5
+		doman nops/slapo-nops.5
+		newdoc passwd/README passwd-README
+	fi
+}
+
+pkg_preinst() {
+	# keep old libs if any
+	preserve_old_lib usr/$(get_libdir)/{liblber,libldap,libldap_r}-2.3.so.0
+}
+
+pkg_postinst() {
+	if ! use minimal ; then
+		# You cannot build SSL certificates during src_install that will make
+		# binary packages containing your SSL key, which is both a security risk
+		# and a misconfiguration if multiple machines use the same key and cert.
+		if use ssl; then
+			install_cert /etc/openldap/ssl/ldap
+			chown ldap:ldap "${ROOT}"etc/openldap/ssl/ldap.*
+			ewarn "Self-signed SSL certificates are treated harshly by OpenLDAP 2.[12]"
+			ewarn "Self-signed SSL certificates are treated harshly by OpenLDAP 2.[12]"
+			ewarn "add 'TLS_REQCERT never' if you want to use them."
+		fi
+
+		# These lines force the permissions of various content to be correct
+		chown ldap:ldap "${ROOT}"var/run/openldap
+		chmod 0755 "${ROOT}"var/run/openldap
+		chown root:ldap "${ROOT}"etc/openldap/slapd.conf{,.default}
+		chmod 0640 "${ROOT}"etc/openldap/slapd.conf{,.default}
+		chown ldap:ldap "${ROOT}"var/lib/openldap-{data,ldbm}
+	fi
+
+	elog "Getting started using OpenLDAP? There is some documentation available:"
+	elog "Gentoo Guide to OpenLDAP Authentication"
+	elog "(http://www.gentoo.org/doc/en/ldap-howto.xml)"
+	elog "---"
+	elog "An example file for tuning BDB backends with openldap is:"
+	elog "/usr/share/doc/${PF}/DB_CONFIG.fast.example.gz"
+
+	preserve_old_lib_notify usr/$(get_libdir)/{liblber,libldap,libldap_r}-2.3.so.0
+}
diff --git a/overlay/sys-apps/baselayout/Manifest b/overlay/sys-apps/baselayout/Manifest
new file mode 100644
index 0000000..fab8cf1
--- /dev/null
+++ b/overlay/sys-apps/baselayout/Manifest
@@ -0,0 +1,2 @@
+DIST baselayout-2.0.0.tar.bz2 23073 RMD160 0ce706d975635dfd3901b2065677013f35f80082 SHA1 5eb389b4ad9be5fa170df243d07b9140de1c8224 SHA256 e976ce2f37f0ee79e7c65eb77e3331d8a369ca5d74003f886c3594c206ce6ca9
+EBUILD baselayout-2.0.0-r1.ebuild 7357 RMD160 d8b2bd8f170087ee7f99e00281d10f7a36d9fb61 SHA1 c4c1c20b8f0211f9c26786ed5904787da7bd8641 SHA256 2b7e3a6add3fd55d75d93e994f4db6f8cf3e7f807fb9306f966d2f6d409ec649
diff --git a/overlay/sys-apps/baselayout/baselayout-2.0.0-r1.ebuild b/overlay/sys-apps/baselayout/baselayout-2.0.0-r1.ebuild
new file mode 100644
index 0000000..7bb2434
--- /dev/null
+++ b/overlay/sys-apps/baselayout/baselayout-2.0.0-r1.ebuild
@@ -0,0 +1,215 @@
+# Copyright 1999-2008 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/sys-apps/baselayout/baselayout-2.0.0.ebuild,v 1.7 2008/08/19 17:51:19 zmedico Exp $
+
+inherit multilib
+
+DESCRIPTION="Filesystem baselayout and init scripts"
+HOMEPAGE="http://www.gentoo.org/"
+SRC_URI="mirror://gentoo/${P}.tar.bz2
+	http://dev.gentoo.org/~vapier/dist/${P}.tar.bz2"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~sparc-fbsd ~x86 ~x86-fbsd"
+IUSE="build"
+
+PDEPEND="sys-apps/openrc"
+
+pkg_preinst() {
+	# Bug #217848 - Since the remap_dns_vars() called by pkg_preinst() of
+	# the baselayout-1.x ebuild copies all the real configs from the user's
+	# /etc/conf.d into ${D}, it makes them all appear to be the default
+	# versions. In order to protect them from being unmerged after this
+	# upgrade, modify their timestamps.
+	touch "${ROOT}"/etc/conf.d/* 2>/dev/null
+
+	# We need to install directories and maybe some dev nodes when building
+	# stages, but they cannot be in CONTENTS.
+	# Also, we cannot reference $S as binpkg will break so we do this.
+	if use build ; then
+		local libdirs="$(get_all_libdirs)" dir=
+		# Create our multilib dirs - the Makefile has no knowledge of this
+		: ${libdirs:=lib}	# it isn't that we don't trust multilib.eclass...
+		for dir in ${libdirs}; do
+			mkdir -p "${ROOT}${dir}"
+			touch "${ROOT}${dir}"/.keep
+			mkdir -p "${ROOT}usr/${dir}"
+			touch "${ROOT}usr/${dir}"/.keep
+			mkdir -p "${ROOT}usr/local/${dir}"
+			touch "${ROOT}usr/local/${dir}"/.keep
+		done
+
+		# Create symlinks for /lib, /usr/lib, and /usr/local/lib and
+		# merge contents of duplicate directories if necessary.
+		# Only do this when $ROOT != / since it should only be necessary
+		# when merging to an empty $ROOT, and it's not very safe to perform
+		# this operation when $ROOT = /.
+		if [ "${SYMLINK_LIB}" = yes ] && [ "$ROOT" != / ] ; then
+			local prefix libabi=$(get_abi_LIBDIR $DEFAULT_ABI)
+			for prefix in "$ROOT"{,usr/,usr/local/} ; do
+
+				[ ! -d "${prefix}lib" ] && rm -f "${prefix}lib" && \
+					mkdir -p "${prefix}lib"
+
+				[ ! -d "$prefix$libabi" ] && ln -sf "${prefix}lib"
+
+				[ -h "$prefix$libabi" ] && [ -d "${prefix}lib" ] && \
+					[ "$prefix$libabi" -ef "${prefix}lib" ] && continue
+
+				local destdir=$prefix$libabi/ srcdir=${prefix}lib/
+
+				[ -d "$destdir" ] || die "unable to create '$destdir'"
+				[ -d "$srcdir" ] || die "unable to create $srcdir"
+
+				mv -f "$srcdir".keep "$destdir".keep 2>/dev/null
+				if ! rmdir "$srcdir" 2>/dev/null ; then
+					ewarn "merging contents of '$srcdir' into '$destdir':"
+
+					# Move directories if the dest doesn't exist.
+					find "$srcdir" -type d -print0 | \
+					while read -d $'\0' src ; do
+
+						# If a parent directory of $src has already
+						# been merged then it will no longer exist.
+						[ -d "$src" ] || continue
+
+						dest=$destdir${src#${srcdir}}
+						if [ ! -d "$dest" ] ; then
+							if [ -e "$dest" ] ; then
+								ewarn "  not overwriting file '$dest'" \
+									"with directory '$src'"
+								continue
+							fi
+							mv -f "$src" "$dest" && \
+								ewarn "  /${src#${ROOT}} merged" || \
+								ewarn "  /${src#${ROOT}} not merged"
+						fi
+					done
+
+					# Move non-directories.
+					find "$srcdir" ! -type d -print0 | \
+					while read -d $'\0' src ; do
+						dest=$destdir${src#${srcdir}}
+						if [ -e "$dest" ] ; then
+							if [ -d "$dest" ] ; then
+								ewarn "  not overwriting directory '$dest'" \
+									"with file '$src'"
+							else
+								if [ -f "$src" -a ! -s "$src" ] && \
+									[ -f "$dest" -a ! -s "$dest" ] ; then
+									# Ignore empty files such as '.keep'.
+									true
+								else
+									ewarn "  not overwriting file '$dest'" \
+										"with file '$src'"
+								fi
+							fi
+							continue
+						fi
+
+						mv -f "$src" "$dest" && \
+							ewarn "  /${src#${ROOT}} merged" || \
+							ewarn "  /${src#${ROOT}} not merged"
+					done
+				fi
+
+				rm -rf "${prefix}lib" || \
+					die "unable to remove '${prefix}lib'"
+
+				ln -s "$libabi" "${prefix}lib" || \
+					die "unable to create '${prefix}lib' symlink"
+			done
+		fi
+
+		emake -C "${D}/usr/share/${PN}" DESTDIR="${ROOT}" layout || die "failed to layout filesystem"
+	fi
+	rm -f "${D}"/usr/share/${PN}/Makefile
+}
+
+src_unpack(){
+	unpack ${A}
+	cd "${S}"
+	if use build; then
+		sed -e's:/boot /home /mnt /root /proc /etc/profile.d:/boot /home /mnt /root /etc/profile.d:' Makefile
+	fi
+}
+
+src_install() {
+	local libdir="lib"
+	[[ ${SYMLINK_LIB} == "yes" ]] && libdir=$(get_abi_LIBDIR "${DEFAULT_ABI}")
+
+	emake \
+		OS=$(use kernel_FreeBSD && echo BSD || echo Linux) \
+		LIB=${libdir} \
+		DESTDIR="${D}" \
+		install || die
+	dodoc ChangeLog
+
+	# need the makefile in pkg_preinst
+	insinto /usr/share/${PN}
+	doins Makefile || die
+
+	# Should this belong in another ebuild? Like say binutils?
+	# List all the multilib libdirs in /etc/env/04multilib (only if they're
+	# actually different from the normal
+	if has_multilib_profile || [ $(get_libdir) != "lib" -o -n "${CONF_MULTILIBDIR}" ]; then
+		local libdirs="$(get_all_libdirs)" libdirs_env= dir=
+		: ${libdirs:=lib}	# it isn't that we don't trust multilib.eclass...
+		for dir in ${libdirs}; do
+			libdirs_env=${libdirs_env:+$libdirs_env:}/${dir}:/usr/${dir}:/usr/local/${dir}
+		done
+
+		# Special-case uglyness... For people updating from lib32 -> lib amd64
+		# profiles, keep lib32 in the search path while it's around
+		if has_multilib_profile && [ -d "${ROOT}"lib32 -o -d "${ROOT}"lib32 ] && ! hasq lib32 ${libdirs}; then
+			libdirs_env="${libdirs_env}:/lib32:/usr/lib32:/usr/local/lib32"
+		fi
+		echo "LDPATH=\"${libdirs_env}\"" > "${T}"/04multilib
+		doenvd "${T}"/04multilib
+	fi
+
+	# rc-scripts version for testing of features that *should* be present
+	echo "Gentoo Base System release ${PV}" > "${D}"/etc/gentoo-release
+}
+
+pkg_postinst() {
+	# We installed some files to /usr/share/baselayout instead of /etc to stop
+	# (1) overwriting the user's settings
+	# (2) screwing things up when attempting to merge files
+	# (3) accidentally packaging up personal files with quickpkg
+	# If they don't exist then we install them
+	for x in master.passwd passwd shadow group fstab ; do
+		[ -e "${ROOT}etc/${x}" ] && continue
+		[ -e "${ROOT}usr/share/baselayout/${x}" ] || continue
+		cp -p "${ROOT}usr/share/baselayout/${x}" "${ROOT}"etc
+	done
+
+	# This is also written in src_install (so it's in CONTENTS), but
+	# write it here so that the new version is immediately in the file
+	# (without waiting for the user to do etc-update)
+	rm -f "${ROOT}"/etc/._cfg????_gentoo-release
+	local release="${PV}"
+	[ "${PR}" != r0 ] && release="${release}-${PR}"
+	echo "Gentoo Base System release ${release}" > "${ROOT}"/etc/gentoo-release
+
+	# whine about users that lack passwords #193541
+	if [[ -e ${ROOT}/etc/shadow ]] ; then
+		local bad_users=$(sed -n '/^[^:]*::/s|^\([^:]*\)::.*|\1|p' "${ROOT}"/etc/shadow)
+		if [[ -n ${bad_users} ]] ; then
+			echo
+			ewarn "The following users lack passwords!"
+			ewarn ${bad_users}
+		fi
+	fi
+
+	# whine about users with invalid shells #215698
+	if [[ -e ${ROOT}/etc/passwd ]] ; then
+		local bad_shells=$(awk -F: 'system("test -e " $7) { print $1 " - " $7}' /etc/passwd | sort)
+		if [[ -n ${bad_shells} ]] ; then
+			echo
+			ewarn "The following users have non-existent shells!"
+			ewarn "${bad_shells}"
+		fi
+	fi
+}
diff --git a/overlay/sys-cluster/beowulf-head/Manifest b/overlay/sys-cluster/beowulf-head/Manifest
index 3de04f9..0c6e805 100644
--- a/overlay/sys-cluster/beowulf-head/Manifest
+++ b/overlay/sys-cluster/beowulf-head/Manifest
@@ -6,5 +6,5 @@ AUX node-manager 2119 RMD160 9cb7ffdd91c0bc699abf59b87bf5894157001ad1 SHA1 cd0c6
 AUX setup-pwdless-ssh 819 RMD160 418271742cb1046efebd2ad4ef2d3e99845142ba SHA1 d06002173fec53bb46f6f5ff6dd30a0ed2e74bfb SHA256 6a6ac28a8c5c9e32d5544ea0c18afe43fa96456c4a52d5f4849cd5f4527aa766
 AUX torque-add 629 RMD160 79040160b992cfefde964fc6511022e029c1b58a SHA1 324d4b0cb5071aaf3a6c62d01bb613cdf8ecf901 SHA256 5d3d4c3ab35923632b81eaf48d64d6cba1060d0a1887fbc85e8adf10b7fc52c9
 AUX torque-del 132 RMD160 bc1e0a9ccc6ce20630003f7372d62bdb705b9187 SHA1 c735f03fb6715ab601cb84f4fbc92be78ce43575 SHA256 c455764846f192930625721958532d3cee64aa75d9d83a37b67544e4c7bdee64
-EBUILD beowulf-head-0.1.ebuild 7579 RMD160 e79ba991395ae8817f1f6c669315b5511ba4f236 SHA1 264daab5b6dda5efa9e1b6a87371a6f4f85d945b SHA256 67d6cc0d23c3d5aa814b2360d207858194959bfbea719100e336ee381c13f944
+EBUILD beowulf-head-0.1.ebuild 7580 RMD160 b83055eb4e3a920ef3616f558c3e2539491527fa SHA1 8bab93c6d6b4a92f39b830416c5f4811ab535842 SHA256 697583a5b594885fbe3f6a7283905c8e7d610066371e9e60471ecc88279d60b8
 MISC ChangeLog 101 RMD160 d735719ccc09237e68e4e984eb5451000b06c382 SHA1 79098d1e8ae451f0430d363da6b717966ade6e78 SHA256 8dd010e2772026c4a6b86839842931b99c85c44a5e9f380864cc275b55587ac2
diff --git a/overlay/sys-cluster/beowulf-head/beowulf-head-0.1.ebuild b/overlay/sys-cluster/beowulf-head/beowulf-head-0.1.ebuild
index 9feedad..f1c89eb 100644
--- a/overlay/sys-cluster/beowulf-head/beowulf-head-0.1.ebuild
+++ b/overlay/sys-cluster/beowulf-head/beowulf-head-0.1.ebuild
@@ -126,7 +126,7 @@ pxe_conf()
 	#prompt 1
 	#timeout 50
 	#say Press F1 for boot profiles, default is $PROFNAME in 5 seconds...
-	F1 BootProfiles
+	#F1 BootProfiles
 	default $PROFNAME
 
 	label $PROFNAME
diff --git a/profiles/hpc-clustering/package.keywords/baselayout2 b/profiles/hpc-clustering/package.keywords/baselayout2
index 2ade82e..e0aa7ef 100644
--- a/profiles/hpc-clustering/package.keywords/baselayout2
+++ b/profiles/hpc-clustering/package.keywords/baselayout2
@@ -1,3 +1,3 @@
-=sys-apps/baselayout-2.0.0 **
+=sys-apps/baselayout-2.0.0-r1 **
 # it's not exatly 0.2.5, it's a git repo saved as 0.2.5 by running `make dist` from within the git clone
 =sys-apps/openrc-0.2.5 **
diff --git a/profiles/hpc-clustering/package.use b/profiles/hpc-clustering/package.use
index eb44b25..f7b8227 100644
--- a/profiles/hpc-clustering/package.use
+++ b/profiles/hpc-clustering/package.use
@@ -14,6 +14,6 @@ app-admin/sudo ldap
 
 # ^^^ Nope...that won't work, so commenting and trying in livecd-stage1.spec instead (net-nds/openldap added to the list)
 
-sys-cluster/openmpi smp threads fortran
+sys-cluster/openmpi smp -threads fortran
 app-editors/vim-core -minimal -livecd
 app-editors/vim -minimal -livecd