net-nds/openldap: update to latest

4 files changed, 237 insertions, 115 deletions

diff --git a/net-nds/openldap/Manifest b/net-nds/openldap/Manifest
index d0a81c6..19e8bea 100644
--- a/net-nds/openldap/Manifest
+++ b/net-nds/openldap/Manifest
@@ -1,2 +1,2 @@
-DIST openldap-2.4.45.tgz 5672845 BLAKE2B e1f97553482a2e8630b62bc0f439af2484f1a2349a1a077382a124354424fe510ab55f32c073565b142d0c9318870fe31a2652268ebabd97d3afd8c833bc7aab SHA512 1c9fc84efed8998f107ce6e1c6be3f5466388241afdca0cb3847720c9def0bc263a2dbc15bf0f9112d1b4c391fd01e8531a4fb08c5532c30fb86924c08daedab
+DIST openldap-2.4.47.tgz 5699678 BLAKE2B e172b3f0bb3c1dfdaa734fd76581758a5d51bb9abb9c038f9ae5dfa6de45ae0eaaecab443aa113b08f8c26b44b1b1ed684a85882732bffa42548029f80f4c1be SHA512 d424079e34207e3d24383a2bea70a07ded40714982a6767174d2b2cb208cd94feab5ef12157accae915b8e404e5773a7547aaef65f06b44dc3cc09c6a64d5a11
 DIST rfc2307bis.schema-20140524 12262 BLAKE2B 98031f49e9bde1e4821e637af3382364d8344ed7017649686a088070d96a632dffa6c661552352656b1b159c0fd962965580069a64c7f3d5bb6a3ed75f60fd99 SHA512 83b89a1deeefc8566b97e7e865b9b6d04541099cbdf719e24538a7d27d61b6209e87ab9003a9f140bd9afd018ec569e71721e3a24090e1902c8b6659d2ba103e
diff --git a/net-nds/openldap/files/openldap-2.4.47-libressl.patch b/net-nds/openldap/files/openldap-2.4.47-libressl.patch
new file mode 100644
index 0000000..5e5b3e3
--- /dev/null
+++ b/net-nds/openldap/files/openldap-2.4.47-libressl.patch
@@ -0,0 +1,58 @@
+diff --git a/libraries/libldap/tls_o.c b/libraries/libldap/tls_o.c
+index b0277dfe9..8a3f47a74 100644
+--- a/libraries/libldap/tls_o.c
++++ b/libraries/libldap/tls_o.c
+@@ -50,7 +50,7 @@
+ #include <ssl.h>
+ #endif
+ 
+-#if OPENSSL_VERSION_NUMBER >= 0x10100000
++#if OPENSSL_VERSION_NUMBER >= 0x10100000 && !defined(LIBRESSL_VERSION_NUMBER)
+ #define ASN1_STRING_data(x)	ASN1_STRING_get0_data(x)
+ #endif
+ 
+@@ -200,7 +200,7 @@ tlso_init( void )
+ 	(void) tlso_seed_PRNG( lo->ldo_tls_randfile );
+ #endif
+ 
+-#if OPENSSL_VERSION_NUMBER < 0x10100000
++#if OPENSSL_VERSION_NUMBER < 0x10100000 || defined(LIBRESSL_VERSION_NUMBER)
+ 	SSL_load_error_strings();
+ 	SSL_library_init();
+ 	OpenSSL_add_all_digests();
+@@ -252,7 +252,7 @@ static void
+ tlso_ctx_ref( tls_ctx *ctx )
+ {
+ 	tlso_ctx *c = (tlso_ctx *)ctx;
+-#if OPENSSL_VERSION_NUMBER < 0x10100000
++#if OPENSSL_VERSION_NUMBER < 0x10100000 || defined(LIBRESSL_VERSION_NUMBER)
+ #define	SSL_CTX_up_ref(ctx)	CRYPTO_add( &(ctx->references), 1, CRYPTO_LOCK_SSL_CTX )
+ #endif
+ 	SSL_CTX_up_ref( c );
+@@ -511,7 +511,7 @@ tlso_session_my_dn( tls_session *sess, struct berval *der_dn )
+ 	if (!x) return LDAP_INVALID_CREDENTIALS;
+ 	
+ 	xn = X509_get_subject_name(x);
+-#if OPENSSL_VERSION_NUMBER < 0x10100000
++#if OPENSSL_VERSION_NUMBER < 0x10100000 || defined(LIBRESSL_VERSION_NUMBER)
+ 	der_dn->bv_len = i2d_X509_NAME( xn, NULL );
+ 	der_dn->bv_val = xn->bytes->data;
+ #else
+@@ -547,7 +547,7 @@ tlso_session_peer_dn( tls_session *sess, struct berval *der_dn )
+ 		return LDAP_INVALID_CREDENTIALS;
+ 
+ 	xn = X509_get_subject_name(x);
+-#if OPENSSL_VERSION_NUMBER < 0x10100000
++#if OPENSSL_VERSION_NUMBER < 0x10100000 || defined(LIBRESSL_VERSION_NUMBER)
+ 	der_dn->bv_len = i2d_X509_NAME( xn, NULL );
+ 	der_dn->bv_val = xn->bytes->data;
+ #else
+@@ -768,7 +768,7 @@ struct tls_data {
+ 	Sockbuf_IO_Desc		*sbiod;
+ };
+ 
+-#if OPENSSL_VERSION_NUMBER < 0x10100000
++#if OPENSSL_VERSION_NUMBER < 0x10100000 || defined(LIBRESSL_VERSION_NUMBER)
+ #define BIO_set_init(b, x)	b->init = x
+ #define BIO_set_data(b, x)	b->ptr = x
+ #define BIO_clear_flags(b, x)	b->flags &= ~(x)
diff --git a/net-nds/openldap/files/openldap-2.4.47-warnings.patch b/net-nds/openldap/files/openldap-2.4.47-warnings.patch
new file mode 100644
index 0000000..d75bd0d
--- /dev/null
+++ b/net-nds/openldap/files/openldap-2.4.47-warnings.patch
@@ -0,0 +1,41 @@
+diff --git a/include/ldap.h b/include/ldap.h
+index c245651c2..7f14f1051 100644
+--- a/include/ldap.h
++++ b/include/ldap.h
+@@ -2041,6 +2041,10 @@ LDAP_F( int )
+ ldap_is_ldapi_url LDAP_P((
+ 	LDAP_CONST char *url ));
+ 
++LDAP_F( int )
++ldap_is_ldapc_url LDAP_P((
++	LDAP_CONST char *url ));
++
+ LDAP_F( int )
+ ldap_url_parse LDAP_P((
+ 	LDAP_CONST char *url,
+diff --git a/include/ldap_int_thread.h b/include/ldap_int_thread.h
+index e2dd8a942..bbc07c845 100644
+--- a/include/ldap_int_thread.h
++++ b/include/ldap_int_thread.h
+@@ -33,7 +33,7 @@ LDAP_END_DECL
+  * definitions for POSIX Threads  *
+  *                                *
+  **********************************/
+-
++#define __USE_UNIX98
+ #include <pthread.h>
+ #ifdef HAVE_SCHED_H
+ #include <sched.h>
+diff --git a/libraries/libldap/tls2.c b/libraries/libldap/tls2.c
+index d25c190ea..639f598e7 100644
+--- a/libraries/libldap/tls2.c
++++ b/libraries/libldap/tls2.c
+@@ -76,6 +76,8 @@ static oid_name oids[] = {
+ 
+ #ifdef HAVE_TLS
+ 
++int ldap_pvt_tls_check_hostname( LDAP *ld, void *s, const char *name_in );
++
+ void
+ ldap_pvt_tls_ctx_free ( void *c )
+ {
diff --git a/net-nds/openldap/openldap-2.4.45-r1.ebuild b/net-nds/openldap/openldap-2.4.47-r2.ebuild
index 1ea7967..b6379df 100644
--- a/net-nds/openldap/openldap-2.4.45-r1.ebuild
+++ b/net-nds/openldap/openldap-2.4.47-r2.ebuild
@@ -1,9 +1,9 @@
-# Copyright 1999-2018 Gentoo Authors
+# Copyright 1999-2019 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
-EAPI="5"
+EAPI=6
 
-inherit db-use eutils flag-o-matic multilib multilib-minimal ssl-cert versionator toolchain-funcs autotools user systemd
+inherit db-use flag-o-matic multilib multilib-minimal ssl-cert eapi7-ver toolchain-funcs autotools user systemd
 
 BIS_PN=rfc2307bis.schema
 BIS_PV=20140524
@@ -18,19 +18,21 @@ SRC_URI="ftp://ftp.openldap.org/pub/OpenLDAP/openldap-release/${P}.tgz
 
 LICENSE="OPENLDAP GPL-2"
 SLOT="0"
-KEYWORDS="alpha amd64 arm arm64 hppa ia64 ~mips ppc ppc64 s390 ~sh sparc x86 ~ppc-aix ~amd64-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~x86-solaris"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~ppc-aix ~amd64-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~x86-solaris"
 
 IUSE_DAEMON="crypt samba slp tcpd experimental minimal"
 IUSE_BACKEND="+berkdb"
 IUSE_OVERLAY="overlays perl"
-IUSE_OPTIONAL="gnutls iodbc sasl ssl odbc debug ipv6 libressl +syslog selinux static-libs"
+IUSE_OPTIONAL="gnutls iodbc sasl ssl odbc debug ipv6 libressl +syslog selinux static-libs test"
 IUSE_CONTRIB="smbkrb5passwd kerberos kinit pbkdf2 sha2"
 IUSE_CONTRIB="${IUSE_CONTRIB} -cxx"
 IUSE="${IUSE_DAEMON} ${IUSE_BACKEND} ${IUSE_OVERLAY} ${IUSE_OPTIONAL} ${IUSE_CONTRIB}"
 
 REQUIRED_USE="cxx? ( sasl )
 	?? ( gnutls libressl )
-	pbkdf2? ( ssl )"
+	pbkdf2? ( ssl )
+	test? ( berkdb )
+	?? ( test minimal )"
 
 # always list newer first
 # Do not add any AGPL-3 BDB here!
@@ -45,10 +47,13 @@ CDEPEND="
 	ssl? (
 		!gnutls? (
 			!libressl? ( >=dev-libs/openssl-1.0.1h-r2:0=[${MULTILIB_USEDEP}] )
+			libressl? ( dev-libs/libressl:0=[${MULTILIB_USEDEP}] )
 		)
-		gnutls? ( >=net-libs/gnutls-2.12.23-r6[${MULTILIB_USEDEP}]
-		libressl? ( dev-libs/libressl[${MULTILIB_USEDEP}] )
-		>=dev-libs/libgcrypt-1.5.3:0[${MULTILIB_USEDEP}] ) )
+		gnutls? (
+			>=net-libs/gnutls-2.12.23-r6[${MULTILIB_USEDEP}]
+			>=dev-libs/libgcrypt-1.5.3:0[${MULTILIB_USEDEP}]
+		)
+	)
 	sasl? ( dev-libs/cyrus-sasl:= )
 	!minimal? (
 		sys-devel/libtool
@@ -61,7 +66,7 @@ CDEPEND="
 		perl? ( dev-lang/perl:=[-build(-)] )
 		samba? (
 			!libressl? ( dev-libs/openssl:0= )
-			libressl? ( dev-libs/libressl )
+			libressl? ( dev-libs/libressl:0= )
 		)
 		berkdb? (
 			<sys-libs/db-6.0:=
@@ -69,7 +74,7 @@ CDEPEND="
 			)
 		smbkrb5passwd? (
 			!libressl? ( dev-libs/openssl:0= )
-			libressl? ( dev-libs/libressl )
+			libressl? ( dev-libs/libressl:0= )
 			kerberos? ( app-crypt/heimdal )
 			)
 		kerberos? (
@@ -77,7 +82,8 @@ CDEPEND="
 			kinit? ( !app-crypt/heimdal )
 			)
 		cxx? ( dev-libs/cyrus-sasl:= )
-	)"
+	)
+"
 DEPEND="${CDEPEND}
 	sys-apps/groff"
 RDEPEND="${CDEPEND}
@@ -125,6 +131,48 @@ MULTILIB_WRAPPED_HEADERS=(
 	/usr/include/TlsOptions.h
 )
 
+PATCHES=(
+	"${FILESDIR}"/${PN}-2.4.17-gcc44.patch
+
+	"${FILESDIR}"/${PN}-2.2.14-perlthreadsfix.patch
+	"${FILESDIR}"/${PN}-2.4.15-ppolicy.patch
+
+	# bug #116045 - still present in 2.4.28
+	"${FILESDIR}"/${PN}-2.4.35-contrib-smbk5pwd.patch
+	# bug #408077 - samba4
+	"${FILESDIR}"/${PN}-2.4.35-contrib-samba4.patch
+
+	# bug #189817
+	"${FILESDIR}"/${PN}-2.4.11-libldap_r.patch
+
+	# bug #233633
+	"${FILESDIR}"/${PN}-2.4.45-fix-lmpasswd-gnutls-symbols.patch
+
+	# bug #281495
+	"${FILESDIR}"/${PN}-2.4.28-gnutls-gcrypt.patch
+
+	# bug #294350
+	"${FILESDIR}"/${PN}-2.4.6-evolution-ntlm.patch
+
+	# unbreak /bin/sh -> dash
+	"${FILESDIR}"/${PN}-2.4.28-fix-dash.patch
+
+	# bug #420959
+	"${FILESDIR}"/${PN}-2.4.31-gcc47.patch
+
+	# unbundle lmdb
+	"${FILESDIR}"/${PN}-2.4.42-mdb-unbundle.patch
+
+	# bug #622464
+	"${FILESDIR}"/${PN}-2.4.47-libressl.patch
+
+	# fix some compiler warnings
+	"${FILESDIR}"/${PN}-2.4.47-warnings.patch
+
+	# Versioned symbols
+	"${FILESDIR}"/libldap-symbol-versions.patch
+)
+
 openldap_filecount() {
 	local dir="$1"
 	find "${dir}" -type f ! -name '.*' ! -name 'DB_CONFIG*' | wc -l
@@ -132,11 +180,11 @@ openldap_filecount() {
 
 openldap_find_versiontags() {
 	# scan for all datadirs
-	openldap_datadirs=""
-	if [ -f "${EROOT}"/etc/openldap/slapd.conf ]; then
-		openldap_datadirs="$(awk '{if($1 == "directory") print $2 }' ${EROOT}/etc/openldap/slapd.conf)"
+	local openldap_datadirs=()
+	if [[ -f "${EROOT}"/etc/openldap/slapd.conf ]]; then
+		openldap_datadirs=( $(awk '{if($1 == "directory") print $2 }' "${EROOT}"/etc/openldap/slapd.conf) )
 	fi
-	openldap_datadirs="${openldap_datadirs} ${OPENLDAP_DEFAULTDIR_VERSIONTAG}"
+	openldap_datadirs+=( ${OPENLDAP_DEFAULTDIR_VERSIONTAG} )
 
 	einfo
 	einfo "Scanning datadir(s) from slapd.conf and"
@@ -147,28 +195,28 @@ openldap_find_versiontags() {
 	# scan datadirs if we have a version tag
 	openldap_found_tag=0
 	have_files=0
-	for each in ${openldap_datadirs}; do
-		CURRENT_TAGDIR=${ROOT}`echo ${each} | sed "s:\/::"`
-		CURRENT_TAG=${CURRENT_TAGDIR}/${OPENLDAP_VERSIONTAG}
-		if [ -d ${CURRENT_TAGDIR} ] &&	[ ${openldap_found_tag} == 0 ] ; then
+	for each in ${openldap_datadirs[@]} ; do
+		CURRENT_TAGDIR="${ROOT}$(sed "s:\/::" <<< ${each})"
+		CURRENT_TAG="${CURRENT_TAGDIR}/${OPENLDAP_VERSIONTAG}"
+		if [[ -d "${CURRENT_TAGDIR}" ]] && [[ "${openldap_found_tag}" == 0 ]] ; then
 			einfo "- Checking ${each}..."
-			if [ -r ${CURRENT_TAG} ] ; then
+			if [[ -r "${CURRENT_TAG}" ]] ; then
 				# yey, we have one :)
 				einfo "   Found Versiontag in ${each}"
-				source ${CURRENT_TAG}
-				if [ "${OLDPF}" == "" ] ; then
+				source "${CURRENT_TAG}"
+				if [[ "${OLDPF}" == "" ]] ; then
 					eerror "Invalid Versiontag found in ${CURRENT_TAGDIR}"
 					eerror "Please delete it"
 					eerror
 					die "Please kill the invalid versiontag in ${CURRENT_TAGDIR}"
 				fi
 
-				OLD_MAJOR=`get_version_component_range 2-3 ${OLDPF}`
+				OLD_MAJOR=$(ver_cut 2-3 ${OLDPF})
 
-				[ $(openldap_filecount ${CURRENT_TAGDIR}) -gt 0 ] && have_files=1
+				[[ "$(openldap_filecount ${CURRENT_TAGDIR})" -gt 0 ]] && have_files=1
 
 				# are we on the same branch?
-				if [ "${OLD_MAJOR}" != "${PV:0:3}" ] ; then
+				if [[ "${OLD_MAJOR}" != "${PV:0:3}" ]] ; then
 					ewarn "   Versiontag doesn't match current major release!"
 					if [[ "${have_files}" == "1" ]] ; then
 						eerror "   Versiontag says other major and you (probably) have datafiles!"
@@ -182,7 +230,7 @@ openldap_find_versiontags() {
 				fi
 			else
 				einfo "   Non-tagged dir ${each}"
-				[ $(openldap_filecount ${each}) -gt 0 ] && have_files=1
+				[[ "$(openldap_filecount ${each})" -gt 0 ]] && have_files=1
 				if [[ "${have_files}" == "1" ]] ; then
 					einfo "   EEK! Non-empty non-tagged datadir, counting `ls -a ${each} | wc -l` files"
 					echo
@@ -204,45 +252,45 @@ openldap_find_versiontags() {
 			einfo
 		fi
 	done
-	[ "${have_files}" == "1" ] && einfo "DB files present" || einfo "No DB files present"
+	[[ "${have_files}" == "1" ]] && einfo "DB files present" || einfo "No DB files present"
 
 	# Now we must check for the major version of sys-libs/db linked against.
-	SLAPD_PATH=${EROOT}/usr/$(get_libdir)/openldap/slapd
-	if [ "${have_files}" == "1" -a -f "${SLAPD_PATH}" ]; then
+	SLAPD_PATH="${EROOT}/usr/$(get_libdir)/openldap/slapd"
+	if [[ "${have_files}" == "1" ]] && [[ -f "${SLAPD_PATH}" ]]; then
 		OLDVER="$(/usr/bin/ldd ${SLAPD_PATH} \
 			| awk '/libdb-/{gsub("^libdb-","",$1);gsub(".so$","",$1);print $1}')"
 		if use berkdb; then
 			# find which one would be used
-			for bdb_slot in $BDB_SLOTS ; do
+			for bdb_slot in ${BDB_SLOTS} ; do
 				NEWVER="$(db_findver "=sys-libs/db-${bdb_slot}*")"
-				[[ -n "$NEWVER" ]] && break
+				[[ -n "${NEWVER}" ]] && break
 			done
 		fi
 		local fail=0
-		if [ -z "${OLDVER}" -a -z "${NEWVER}" ]; then
+		if [[ -z "${OLDVER}" ]] && [[ -z "${NEWVER}" ]]; then
 			:
 			# Nothing wrong here.
-		elif [ -z "${OLDVER}" -a -n "${NEWVER}" ]; then
+		elif [[ -z "${OLDVER}" ]] && [[ -n "${NEWVER}" ]]; then
 			eerror "	Your existing version of OpenLDAP was not built against"
 			eerror "	any version of sys-libs/db, but the new one will build"
 			eerror "	against	${NEWVER} and your database may be inaccessible."
 			echo
 			fail=1
-		elif [ -n "${OLDVER}" -a -z "${NEWVER}" ]; then
+		elif [[ -n "${OLDVER}" ]]&& [[ -z "${NEWVER}" ]]; then
 			eerror "	Your existing version of OpenLDAP was built against"
 			eerror "	sys-libs/db:${OLDVER}, but the new one will not be"
 			eerror "	built against any version and your database may be"
 			eerror "	inaccessible."
 			echo
 			fail=1
-		elif [ "${OLDVER}" != "${NEWVER}" ]; then
+		elif [[ "${OLDVER}" != "${NEWVER}" ]]; then
 			eerror "	Your existing version of OpenLDAP was built against"
 			eerror "	sys-libs/db:${OLDVER}, but the new one will build against"
 			eerror "	${NEWVER} and your database would be inaccessible."
 			echo
 			fail=1
 		fi
-		[ "${fail}" == "1" ] && openldap_upgrade_howto
+		[[ "${fail}" == "1" ]] && openldap_upgrade_howto
 	fi
 
 	echo
@@ -252,6 +300,7 @@ openldap_find_versiontags() {
 }
 
 openldap_upgrade_howto() {
+	local d l i
 	eerror
 	eerror "A (possible old) installation of OpenLDAP was detected,"
 	eerror "installation will not proceed for now."
@@ -277,7 +326,7 @@ openldap_upgrade_howto() {
 	eerror "10. check that your data is intact."
 	eerror "11. set up the new replication system."
 	eerror
-	if [ "${FORCE_UPGRADE}" != "1" ]; then
+	if [[ "${FORCE_UPGRADE}" != "1" ]]; then
 		die "You need to upgrade your database first"
 	else
 		eerror "You have the magical FORCE_UPGRADE=1 in place."
@@ -308,71 +357,33 @@ pkg_setup() {
 
 src_prepare() {
 	# ensure correct SLAPI path by default
-	sed -i -e 's,\(#define LDAPI_SOCK\).*,\1 "'"${EPREFIX}"'/var/run/openldap/slapd.sock",' \
-		"${S}"/include/ldap_defaults.h
-
-	epatch "${FILESDIR}"/${PN}-2.4.17-gcc44.patch
+	sed -e 's,\(#define LDAPI_SOCK\).*,\1 "'"${EPREFIX}"'/var/run/openldap/slapd.sock",' \
+		-i include/ldap_defaults.h || die
 
-	epatch \
-		"${FILESDIR}"/${PN}-2.2.14-perlthreadsfix.patch \
-		"${FILESDIR}"/${PN}-2.4.15-ppolicy.patch
+	default
+	rm -r libraries/liblmdb || die
 
-	# bug #116045 - still present in 2.4.28
-	epatch "${FILESDIR}"/${PN}-2.4.35-contrib-smbk5pwd.patch
-	# bug #408077 - samba4
-	epatch "${FILESDIR}"/${PN}-2.4.35-contrib-samba4.patch
-
-	# bug #189817
-	epatch "${FILESDIR}"/${PN}-2.4.11-libldap_r.patch
-
-	# bug #233633
-	epatch "${FILESDIR}"/${PN}-2.4.45-fix-lmpasswd-gnutls-symbols.patch
-
-	# bug #281495
-	epatch "${FILESDIR}"/${PN}-2.4.28-gnutls-gcrypt.patch
-
-	# bug #294350
-	epatch "${FILESDIR}"/${PN}-2.4.6-evolution-ntlm.patch
-
-	# unbreak /bin/sh -> dash
-	epatch "${FILESDIR}"/${PN}-2.4.28-fix-dash.patch
-
-	# bug #420959
-	epatch "${FILESDIR}"/${PN}-2.4.31-gcc47.patch
-
-	# bug #622464
-	epatch "${FILESDIR}"/${PN}-2.4.45-libressl.patch
-
-	# unbundle lmdb
-	epatch "${FILESDIR}"/${PN}-2.4.42-mdb-unbundle.patch
-	rm -rf "${S}"/libraries/liblmdb
-
-	epatch "${FILESDIR}"/libldap-symbol-versions.patch
-
-	epatch_user
-
-	cd "${S}"/build || die
+	pushd build &>/dev/null || die "pushd build"
 	einfo "Making sure upstream build strip does not do stripping too early"
 	sed -i.orig \
 		-e '/^STRIP/s,-s,,g' \
 		top.mk || die "Failed to block stripping"
+	popd &>/dev/null || die
 
 	# wrong assumption that /bin/sh is /bin/bash
-	sed -i \
+	sed \
 		-e 's|/bin/sh|/bin/bash|g' \
-		"${S}"/tests/scripts/* || die "sed failed"
-
-	cd "${S}" || die
+		-i tests/scripts/* || die "sed failed"
 
 	AT_NOEAUTOMAKE=yes eautoreconf
 }
 
 build_contrib_module() {
 	# <dir> <sources> <outputname>
-	cd "${S}/contrib/slapd-modules/$1" || die
+	pushd "${S}/contrib/slapd-modules/$1" &>/dev/null || die "pushd contrib/slapd-modules/$1"
 	einfo "Compiling contrib-module: $3"
 	# Make sure it's uppercase
-	local define_name="$(echo "SLAPD_OVER_${1}" | LC_ALL=C tr '[:lower:]' '[:upper:]')"
+	local define_name="$(LC_ALL=C tr '[:lower:]' '[:upper:]' <<< "SLAPD_OVER_${1}")"
 	"${lt}" --mode=compile --tag=CC \
 		"${CC}" \
 		-D${define_name}=SLAPD_MOD_DYNAMIC \
@@ -386,6 +397,7 @@ build_contrib_module() {
 		${LDFLAGS} \
 		-rpath "${EPREFIX}"/usr/$(get_libdir)/openldap/openldap \
 		-o $3.la ${2%.c}.lo || die "linking $3 failed"
+	popd &>/dev/null || die
 }
 
 src_configure() {
@@ -418,8 +430,8 @@ multilib_src_configure() {
 		if use berkdb ; then
 			einfo "Using Berkeley DB for local backend"
 			myconf+=( --enable-bdb --enable-hdb )
-			DBINCLUDE=$(db_includedir $BDB_SLOTS)
-			einfo "Using $DBINCLUDE for sys-libs/db version"
+			DBINCLUDE=$(db_includedir ${BDB_SLOTS})
+			einfo "Using ${DBINCLUDE} for sys-libs/db version"
 			# We need to include the slotted db.h dir for FreeBSD
 			append-cppflags -I${DBINCLUDE}
 		else
@@ -501,7 +513,7 @@ multilib_src_configure() {
 	done
 
 	tc-export AR CC CXX
-	ECONF_SOURCE=${S} \
+	ECONF_SOURCE="${S}" \
 	STRIP=/bin/true \
 	econf \
 		--libexecdir="${EPREFIX}"/usr/$(get_libdir)/openldap \
@@ -519,7 +531,7 @@ src_configure_cxx() {
 	)
 
 	mkdir -p "${BUILD_DIR}"/contrib/ldapc++ || die
-	cd "${BUILD_DIR}/contrib/ldapc++" || die
+	pushd "${BUILD_DIR}/contrib/ldapc++" &>/dev/null || die "pushd contrib/ldapc++"
 
 	local LDFLAGS=${LDFLAGS} CPPFLAGS=${CPPFLAGS}
 	append-ldflags -L"${BUILD_DIR}"/libraries/liblber/.libs \
@@ -529,6 +541,7 @@ src_configure_cxx() {
 	econf "${myconf_ldapcpp[@]}" \
 		CC="${CC}" \
 		CXX="${CXX}"
+	popd &>/dev/null || die
 }
 
 multilib_src_compile() {
@@ -541,14 +554,14 @@ multilib_src_compile() {
 		if use cxx ; then
 			einfo "Building contrib library: ldapc++"
 			src_configure_cxx
-			cd "${BUILD_DIR}/contrib/ldapc++" || die
-			emake \
-				CC="${CC}" CXX="${CXX}"
+			pushd "${BUILD_DIR}/contrib/ldapc++" &>/dev/null || die "pushd contrib/ldapc++"
+			emake CC="${CC}" CXX="${CXX}"
+			popd &>/dev/null || die
 		fi
 
 		if use smbkrb5passwd ; then
 			einfo "Building contrib-module: smbk5pwd"
-			cd "${S}/contrib/slapd-modules/smbk5pwd" || die
+			pushd "${S}/contrib/slapd-modules/smbk5pwd" &>/dev/null || die "pushd contrib/slapd-modules/smbk5pwd"
 
 			MY_DEFS="-DDO_SHADOW"
 			if use samba ; then
@@ -565,22 +578,24 @@ multilib_src_compile() {
 				KRB5_INC="${MY_KRB5_INC}" \
 				LDAP_BUILD="${BUILD_DIR}" \
 				CC="${CC}" libexecdir="${EPREFIX}/usr/$(get_libdir)/openldap"
+			popd &>/dev/null || die
 		fi
 
 		if use overlays ; then
 			einfo "Building contrib-module: samba4"
-			cd "${S}/contrib/slapd-modules/samba4" || die
+			pushd "${S}/contrib/slapd-modules/samba4" &>/dev/null || die "pushd contrib/slapd-modules/samba4"
 
 			emake \
 				LDAP_BUILD="${BUILD_DIR}" \
 				CC="${CC}" libexecdir="/usr/$(get_libdir)/openldap"
+			popd &>/dev/null || die
 		fi
 
 		if use kerberos ; then
 			if use kinit ; then
 				build_contrib_module "kinit" "kinit.c" "kinit"
 			fi
-			cd "${S}/contrib/slapd-modules/passwd" || die
+			pushd "${S}/contrib/slapd-modules/passwd" &>/dev/null || die "pushd contrib/slapd-modules/passwd"
 			einfo "Compiling contrib-module: pw-kerberos"
 			"${lt}" --mode=compile --tag=CC \
 				"${CC}" \
@@ -599,10 +614,11 @@ multilib_src_compile() {
 				-rpath "${EPREFIX}"/usr/$(get_libdir)/openldap/openldap \
 				-o pw-kerberos.la \
 				kerberos.lo || die "linking pw-kerberos failed"
+			popd &>/dev/null || die
 		fi
 
 		if use pbkdf2; then
-			cd "${S}/contrib/slapd-modules/passwd/pbkdf2" || die
+			pushd "${S}/contrib/slapd-modules/passwd/pbkdf2" &>/dev/null || die "pushd contrib/slapd-modules/passwd/pbkdf2"
 			einfo "Compiling contrib-module: pw-pbkdf2"
 			"${lt}" --mode=compile --tag=CC \
 				"${CC}" \
@@ -619,10 +635,11 @@ multilib_src_compile() {
 				-rpath "${EPREFIX}"/usr/$(get_libdir)/openldap/openldap \
 				-o pw-pbkdf2.la \
 				pbkdf2.lo || die "linking pw-pbkdf2 failed"
+			popd &>/dev/null || die
 		fi
 
 		if use sha2 ; then
-			cd "${S}/contrib/slapd-modules/passwd/sha2" || die
+			pushd "${S}/contrib/slapd-modules/passwd/sha2" &>/dev/null || die "pushd contrib/slapd-modules/passwd/sha2"
 			einfo "Compiling contrib-module: pw-sha2"
 			"${lt}" --mode=compile --tag=CC \
 				"${CC}" \
@@ -646,10 +663,11 @@ multilib_src_compile() {
 				-rpath "${EPREFIX}"/usr/$(get_libdir)/openldap/openldap \
 				-o pw-sha2.la \
 				sha2.lo slapd-sha2.lo || die "linking pw-sha2 failed"
+			popd &>/dev/null || die
 		fi
 
 		# We could build pw-radius if GNURadius would install radlib.h
-		cd "${S}/contrib/slapd-modules/passwd" || die
+		pushd "${S}/contrib/slapd-modules/passwd" &>/dev/null || die "pushd contrib/slapd-modules/passwd"
 		einfo "Compiling contrib-module: pw-netscape"
 		"${lt}" --mode=compile --tag=CC \
 			"${CC}" \
@@ -685,8 +703,9 @@ multilib_src_compile() {
 		build_contrib_module "nops" "nops.c" "nops-overlay"
 		#build_contrib_module "nssov" "nssov.c" "nssov-overlay" RESO:LATER
 		build_contrib_module "trace" "trace.c" "trace"
+		popd &>/dev/null || die
 		# build slapi-plugins
-		cd "${S}/contrib/slapi-plugins/addrdnvalues" || die
+		pushd "${S}/contrib/slapi-plugins/addrdnvalues" &>/dev/null || die "pushd contrib/slapi-plugins/addrdnvalues"
 		einfo "Building contrib-module: addrdnvalues plugin"
 		"${CC}" -shared \
 			-I"${BUILD_DIR}"/include \
@@ -696,7 +715,7 @@ multilib_src_compile() {
 			${LDFLAGS} \
 			-o libaddrdnvalues-plugin.so \
 			addrdnvalues.c || die "Building libaddrdnvalues-plugin.so failed"
-
+		popd &>/dev/null || die
 	fi
 }
 
@@ -721,26 +740,26 @@ multilib_src_install() {
 		use prefix || fowners ldap:ldap /var/lib/openldap-data
 		fperms 0700 /var/lib/openldap-data
 
-		echo "OLDPF='${PF}'" > "${ED}${OPENLDAP_DEFAULTDIR_VERSIONTAG}/${OPENLDAP_VERSIONTAG}"
-		echo "# do NOT delete this. it is used"	>> "${ED}${OPENLDAP_DEFAULTDIR_VERSIONTAG}/${OPENLDAP_VERSIONTAG}"
-		echo "# to track versions for upgrading." >> "${ED}${OPENLDAP_DEFAULTDIR_VERSIONTAG}/${OPENLDAP_VERSIONTAG}"
+		echo "OLDPF='${PF}'" > "${ED%/}${OPENLDAP_DEFAULTDIR_VERSIONTAG}/${OPENLDAP_VERSIONTAG}"
+		echo "# do NOT delete this. it is used"	>> "${ED%/}${OPENLDAP_DEFAULTDIR_VERSIONTAG}/${OPENLDAP_VERSIONTAG}"
+		echo "# to track versions for upgrading." >> "${ED%/}${OPENLDAP_DEFAULTDIR_VERSIONTAG}/${OPENLDAP_VERSIONTAG}"
 
 		# use our config
-		rm "${ED}"etc/openldap/slapd.conf
+		rm "${ED%/}"/etc/openldap/slapd.conf
 		insinto /etc/openldap
 		newins "${FILESDIR}"/${PN}-2.4.40-slapd-conf slapd.conf
-		configfile="${ED}"etc/openldap/slapd.conf
+		configfile="${ED%/}"/etc/openldap/slapd.conf
 
 		# populate with built backends
 		ebegin "populate config with built backends"
-		for x in "${ED}"usr/$(get_libdir)/openldap/openldap/back_*.so; do
+		for x in "${ED%/}"/usr/$(get_libdir)/openldap/openldap/back_*.so; do
 			einfo "Adding $(basename ${x})"
-			sed -e "/###INSERTDYNAMICMODULESHERE###$/a# moduleload\t$(basename ${x})" -i "${configfile}"
+			sed -e "/###INSERTDYNAMICMODULESHERE###$/a# moduleload\t$(basename ${x})" -i "${configfile}" || die
 		done
 		sed -e "s:###INSERTDYNAMICMODULESHERE###$:# modulepath\t${EPREFIX}/usr/$(get_libdir)/openldap/openldap:" -i "${configfile}"
 		use prefix || fowners root:ldap /etc/openldap/slapd.conf
 		fperms 0640 /etc/openldap/slapd.conf
-		cp "${configfile}" "${configfile}".default
+		cp "${configfile}" "${configfile}".default || die
 		eend
 
 		# install our own init scripts and systemd unit files
@@ -756,10 +775,12 @@ multilib_src_install() {
 		systemd_newtmpfilesd "${FILESDIR}"/slapd.tmpfilesd slapd.conf
 
 		# If built without SLP, we don't need to be before avahi
-		use slp \
-			|| sed -i \
+		if ! use slp ; then
+			sed -i \
 				-e '/before/{s/avahi-daemon//g}' \
-				"${ED}"etc/init.d/slapd
+				"${ED%/}"/etc/init.d/slapd \
+				|| die
+		fi
 
 		if use cxx ; then
 			einfo "Install the ldapc++ library"
@@ -792,7 +813,7 @@ multilib_src_install() {
 		for l in */*.la */*/*.la; do
 			[[ -e ${l} ]] || continue
 			"${lt}" --mode=install cp ${l} \
-				"${ED}"usr/$(get_libdir)/openldap/openldap || \
+				"${ED%/}"/usr/$(get_libdir)/openldap/openldap || \
 				die "installing ${l} failed"
 		done
 
@@ -823,7 +844,9 @@ multilib_src_install() {
 		newdoc "${S}"/contrib/slapd-tools/README README.statslog
 	fi
 
-	use static-libs || prune_libtool_files --all
+	if ! use static-libs ; then
+		find "${ED}" \( -name '*.a' -o -name '*.la' \) -delete || die
+	fi
 }
 
 multilib_src_install_all() {