diff --git a/.gitignore b/.gitignore
index e69de29..b4899c8 100644
--- a/.gitignore
+++ b/.gitignore
@@ -0,0 +1,14 @@
+/opendnssec-1.4.0b1.tar.gz
+/opendnssec-1.4.0b2.tar.gz
+/opendnssec-1.4.0rc1.tar.gz
+/opendnssec-1.4.0rc2.tar.gz
+/opendnssec-1.4.0rc3.tar.gz
+/opendnssec-1.4.0.tar.gz
+/opendnssec-1.4.1.tar.gz
+/opendnssec-1.4.3.tar.gz
+/opendnssec-1.4.4.tar.gz
+/opendnssec-1.4.5.tar.gz
+/opendnssec-1.4.6.tar.gz
+/opendnssec-1.4.7.tar.gz
+/opendnssec-1.4.9.tar.gz
+/opendnssec-1.4.14.tar.gz
diff --git a/conf.xml b/conf.xml
new file mode 100644
index 0000000..577e6ba
--- /dev/null
+++ b/conf.xml
@@ -0,0 +1,88 @@
+
+
+
+
+
+
+
+ /usr/lib64/softhsm/libsofthsm.so
+ OpenDNSSEC
+ 1234
+
+
+
+
+
+
+
+
+
+ local0
+
+
+ /etc/opendnssec/kasp.xml
+ /etc/opendnssec/zonelist.xml
+
+
+
+
+
+
+ ods
+ ods
+
+
+ /var/opendnssec/kasp.db
+ PT3600S
+
+
+
+
+
+
+
+
+
+ ods
+ ods
+
+
+ /var/opendnssec/tmp
+ 4
+
+
+
+
+
+
+
+
+
diff --git a/kasp.xml b/kasp.xml
new file mode 100644
index 0000000..caacca6
--- /dev/null
+++ b/kasp.xml
@@ -0,0 +1,88 @@
+
+
+
+
+
+
+
+ A default policy that will amaze you and your friends
+
+ PT2H
+ P3D
+
+ P7D
+ P7D
+
+ PT12H
+
+ PT7200S
+
+
+
+
+
+ P100D
+
+ 1
+ 5
+
+
+
+
+
+
+
+ PT3600S
+ PT3600S
+ PT3600S
+
+ P14D
+
+
+
+ 8
+ P1Y
+ AEP
+
+
+
+
+ 8
+ P30D
+ AEP
+
+
+
+
+
+ PT43200S
+
+ PT3600S
+ PT3600S
+ unixtime
+
+
+
+
+ PT9999S
+
+ PT3600S
+
+
+ PT172800S
+ PT10800S
+
+
+
+
+
+
diff --git a/ods-enforcerd.init b/ods-enforcerd.init
new file mode 100644
index 0000000..c131e77
--- /dev/null
+++ b/ods-enforcerd.init
@@ -0,0 +1,106 @@
+#!/bin/bash
+#
+# ods-enforcerd: Starts the OpenDNSSEC Enforcer Daemon
+#
+# chkconfig: - 13 87
+# description: ods-enforcerd is the OpenDNSSEC DNSSEC policy enforcer daemon
+# processname: /usr/sbin/ods-enforcerd
+# config: /etc/opendnssec/conf.xml
+#
+### BEGIN INIT INFO
+# Provides: ods-enforcerd
+# Required-Start: $local_fs $network $syslog
+# Required-Stop: $local_fs $network $syslog
+# Default-Stop: 0 11 89
+# Short-Description: start|stop|status|restart|try-restart| OpenDNSSEC Enforcer Daemon
+# Description: control OpenDNSSEC enforcer daemon
+### END INIT INFO
+
+# Init script default settings
+ODS_ENFORCERD_CONF="/etc/opendnssec/conf.xml"
+ODS_ENFORCERD_OPT=""
+ODS_ENFORCERD_PROG="/usr/sbin/ods-enforcerd"
+ODS_ENFORCERD_PIDFILE="/var/run/opendnssec/enforcerd.pid"
+PIDDIR="/var/run/opendnssec"
+
+# Source function library.
+. /etc/rc.d/init.d/functions
+
+[ -r /etc/sysconfig/ods ] && . /etc/sysconfig/ods
+
+# Check that networking is configured.
+[ "${NETWORKING}" = "no" ] && exit 0
+
+start() {
+ # Source networking configuration.
+ [ -r /etc/sysconfig/network ] && . /etc/sysconfig/network
+
+ # Check that networking is up
+ [ "${NETWORKING}" = "no" ] && exit 1
+
+ # Sanity checks.
+ [ -f $ODS_ENFORCERD_CONF ] || exit 5
+ [ -x $ODS_ENFORCERD_PROG ] || exit 5
+ # /var/run could (and should) be tmpfs
+ [ -d $PIDDIR ] || mkdir -p $PIDDIR
+
+ echo -n $"Starting ods-enforcerd:"
+ $ODS_ENFORCERD_PROG -c $ODS_ENFORCERD_CONF $ODS_ENFORCERD_OPT
+ RETVAL=$?
+ if [ $RETVAL -eq 0 ]; then
+ touch /var/lock/subsys/ods-enforcerd;
+ success
+ echo
+ else
+ failure
+ echo
+ exit 7;
+ fi
+ return 0;
+}
+
+stop() {
+ echo -n $"Stopping ods-enforcerd: "
+ killproc -p $ODS_ENFORCERD_PIDFILE $ODS_ENFORCERD_PROG
+ retval=$?
+ if [ $retval -eq 0 ] ; then
+ rm -f $ODS_ENFORCERD_PIDFILE
+ rm -f /var/lock/subsys/ods-enforcerd
+ success
+ else
+ failure
+ fi
+ echo
+ return $retval
+}
+
+restart() {
+ stop
+ start
+}
+
+RETVAL=0
+
+# See how we were called.
+case "$1" in
+ start)
+ start
+ ;;
+ stop)
+ stop
+ ;;
+ restart)
+ restart
+ ;;
+ condrestart)
+ [ -f /var/lock/subsys/ods-enforcerd ] && restart || :
+ ;;
+ status)
+ status -p $ODS_ENFORCERD_PIDFILE $ODS_ENFORCERD_PROG
+ ;;
+ *)
+ echo $"Usage: $0 {start|stop|status|restart|condrestart}"
+ exit 1
+esac
+
+exit $?
diff --git a/ods-signerd.init b/ods-signerd.init
new file mode 100644
index 0000000..4e3289d
--- /dev/null
+++ b/ods-signerd.init
@@ -0,0 +1,112 @@
+#!/bin/bash
+#
+# ods-signerd: Starts the OpenDNSSEC Signer Daemon
+#
+# chkconfig: - 13 87
+# description: ods-signerd is the OpenDNSSEC DNSSEC zone signer daemon
+# processname: /usr/sbin/ods-signerd
+# config: /etc/opendnssec/conf.xml
+#
+### BEGIN INIT INFO
+# Provides: ods-signerd
+# Required-Start: $local_fs $network $syslog
+# Required-Stop: $local_fs $network $syslog
+# Default-Stop: 0 11 89
+# Short-Description: start|stop|status|restart|try-restart|reload|force-reload OpenDNSSEC Signer Daemon
+# Description: control OpenDNSSEC signer daemon
+### END INIT INFO
+
+# Init script default settings
+ODS_SIGNERD_CONF="/etc/opendnssec/conf.xml"
+ODS_SIGNERD_OPT=""
+ODS_SIGNERD_PROG="/usr/sbin/ods-signerd"
+ODS_SIGNER_PROG="/usr/sbin/ods-signer"
+ODS_SIGNERD_PIDFILE="/var/run/opendnssec/signerd.pid"
+PIDDIR="/var/run/opendnssec"
+
+# Source function library.
+. /etc/rc.d/init.d/functions
+
+[ -r /etc/sysconfig/ods ] && . /etc/sysconfig/ods
+
+# Check that networking is configured.
+[ "${NETWORKING}" = "no" ] && exit 0
+
+start() {
+ # Source networking configuration.
+ [ -r /etc/sysconfig/network ] && . /etc/sysconfig/network
+
+ # Check that networking is up
+ [ "${NETWORKING}" = "no" ] && exit 1
+
+ # Sanity checks.
+ [ -f $ODS_SIGNERD_CONF ] || exit 5
+ [ -x $ODS_SIGNERD_PROG ] || exit 5
+ # /var/run could (and should) be tmpfs
+ [ -d $PIDDIR ] || mkdir -p $PIDDIR
+
+ echo -n $"Starting ods-signerd:"
+# ods-signerd is lying about supporting -c conf.file option :(
+# $ODS_SIGNERD_PROG -c $ODS_SIGNERD_CONF $ODS_SIGNERD_OPT
+ $ODS_SIGNERD_PROG $ODS_SIGNERD_OPT
+ RETVAL=$?
+ if [ $RETVAL -eq 0 ]; then
+ touch /var/lock/subsys/ods-signerd;
+ success
+ echo
+ else
+ failure
+ echo
+ exit 7;
+ fi
+ return 0;
+}
+
+stop() {
+ echo -n $"Stopping ods-signerd: "
+ #$ODS_SIGNER_PROG -c $ODS_SIGNERD_CONF stop
+ # seems that this loses our settings :(
+ /usr/sbin/ods-signer stop
+ RETVAL=$?
+ [ "$RETVAL" -eq 0 ] || killproc $ODS_SIGNERD_PROG -TERM >/dev/null 2>&1
+ if [ $RETVAL -eq 0 ] ; then
+ rm -f $ODS_SIGNERD_PIDFILE
+ rm -f /var/lock/subsys/ods-signerd
+ success
+ else
+ failure
+ fi
+ echo
+ return $RETVAL
+}
+
+restart() {
+ stop
+ start
+}
+
+RETVAL=0
+
+# See how we were called.
+case "$1" in
+ start)
+ start
+ ;;
+ stop)
+ stop
+ ;;
+ restart)
+ restart
+ ;;
+ condrestart)
+ [ -f /var/lock/subsys/ods-signerd ] && restart || :
+ ;;
+ status)
+ status -p $ODS_SIGNERD_PIDFILE $ODS_SIGNERD_PROG
+ ;;
+ *)
+ echo $"Usage: $0 {start|stop|status|restart|condrestart}"
+ exit 1
+esac
+
+exit $?
diff --git a/ods.sysconfig b/ods.sysconfig
new file mode 100644
index 0000000..1cf67f2
--- /dev/null
+++ b/ods.sysconfig
@@ -0,0 +1,2 @@
+ODS_SIGNERD_OPT=""
+ODS_ENFORCERD_OPT=""
diff --git a/opendnssec-1.4.0b1-nonempty-terminals.patch b/opendnssec-1.4.0b1-nonempty-terminals.patch
new file mode 100644
index 0000000..8ad2135
--- /dev/null
+++ b/opendnssec-1.4.0b1-nonempty-terminals.patch
@@ -0,0 +1,54 @@
+diff -Naur opendnssec-1.4.0b1-orig/signer/src/signer/domain.c opendnssec-1.4.0b1/signer/src/signer/domain.c
+--- opendnssec-1.4.0b1-orig/signer/src/signer/domain.c 2012-11-23 11:17:00.752148535 -0500
++++ opendnssec-1.4.0b1/signer/src/signer/domain.c 2012-11-23 11:23:00.243158628 -0500
+@@ -399,6 +399,7 @@
+ {
+ ldns_rbnode_t* n = LDNS_RBTREE_NULL;
+ domain_type* d = NULL;
++ int unsigned_delegpt = 1;
+
+ ods_log_assert(domain);
+ if (domain->rrsets) {
+@@ -411,20 +412,15 @@
+ break;
+ }
+ if (d->rrsets) {
+- if (domain_is_delegpt(d) == LDNS_RR_TYPE_NS) {
+- /* domain has unsigned delegation */
+- return 1;
+- } else {
+- /* domain has authoritative data or signed delegation */
++ if (domain_is_delegpt(d) != LDNS_RR_TYPE_NS) {
++ /* domain has signed delegation/auth */
+ return 0;
+ }
+ }
+ /* maybe there is data at the next domain */
+ n = ldns_rbtree_next(n);
+ }
+- ods_log_warning("[%s] encountered empty terminal that is treated as "
+- "non-terminal", dname_str);
+- return 0;
++ return unsigned_delegpt;
+ }
+
+
+diff -Naur opendnssec-1.4.0b1-orig/signer/src/signer/namedb.c opendnssec-1.4.0b1/signer/src/signer/namedb.c
+--- opendnssec-1.4.0b1-orig/signer/src/signer/namedb.c 2012-08-28 09:43:15.000000000 -0400
++++ opendnssec-1.4.0b1/signer/src/signer/namedb.c 2012-11-23 11:23:39.420172841 -0500
+@@ -788,13 +788,13 @@
+ if (!db || !db->domains) {
+ return;
+ }
+- node = ldns_rbtree_first(db->domains);
++ node = ldns_rbtree_last(db->domains);
+ if (!node || node == LDNS_RBTREE_NULL) {
+ return;
+ }
+ while (node && node != LDNS_RBTREE_NULL) {
+ domain = (domain_type*) node->data;
+- node = ldns_rbtree_next(node);
++ node = ldns_rbtree_previous(node);
+ domain_diff(domain, is_ixfr);
+ domain = namedb_del_denial_trigger(db, domain, 0);
+ if (domain) {
diff --git a/opendnssec-1.4.0b1-r6816.patch b/opendnssec-1.4.0b1-r6816.patch
new file mode 100644
index 0000000..5375fe1
--- /dev/null
+++ b/opendnssec-1.4.0b1-r6816.patch
@@ -0,0 +1,62 @@
+Index: OpenDNSSEC/enforcer/enforcerd/enforcer.c
+===================================================================
+--- OpenDNSSEC/enforcer/enforcerd/enforcer.c (revision 6815)
++++ OpenDNSSEC/enforcer/enforcerd/enforcer.c (revision 6816)
+@@ -1293,7 +1293,7 @@
+ {
+ int NewDS;
+ status2 = commGenSignConf(zone_name, zone_id, current_filename, policy, &signer_flag, config->interval, config->manualKeyGeneration, config->DSSubmitCmd, config->DSSubCKA_ID, &NewDS);
+- if (status2 != 0) {
++ if (status2 == 0) {
+ /* If the DS set changed then log/do something about it */
+ if (NewDS == 1) {
+ log_msg(config, LOG_INFO, "DSChanged");
+@@ -1655,8 +1655,11 @@
+ if (system(signer_command))
+ {
+ log_msg(NULL, LOG_ERR, "Could not call signer engine to update all zones");
+- log_msg(NULL, LOG_INFO, "Will continue: call 'ods-signer update --all' to manually update all zones");
++ log_msg(NULL, LOG_INFO, "Will continue: call '%s' to manually update all zones", signer_command);
+ }
++ else {
++ log_msg(NULL, LOG_INFO, "Called signer engine: %s", signer_command);
++ }
+
+ StrFree(signer_command);
+ } else {
+@@ -1693,8 +1696,8 @@
+ round potentially different behaviour of rename over existing
+ file.) */
+ int gencnt; /* Number of keys in generate state */
++ char *signer_command; /* how we will call the signer */
+ #ifndef ENFORCER_USE_WORKERS
+- char *signer_command; /* how we will call the signer */
+ int NewDS = 0; /* Did we change the DS Set in any way? */
+ #endif
+ char* datetime = DtParseDateTimeString("now");
+@@ -1954,7 +1957,6 @@
+ return -1;
+ }
+
+-#ifndef ENFORCER_USE_WORKERS
+ if (*signer_flag == 1) {
+ /* call the signer engine to tell it that something changed */
+ /* TODO for beta version connect straight to the socket
+@@ -1970,13 +1972,15 @@
+ if (status != 0)
+ {
+ log_msg(NULL, LOG_ERR, "Could not call signer engine");
+- log_msg(NULL, LOG_INFO, "Will continue: call 'ods-signer update' to manually update zones");
++ log_msg(NULL, LOG_INFO, "Will continue: call '%s' to manually update the zone", signer_command);
+ *signer_flag = 0;
+ }
++ else {
++ log_msg(NULL, LOG_INFO, "Called signer engine: %s", signer_command);
++ }
+
+ StrFree(signer_command);
+ }
+-#endif
+ }
+ else {
+ log_msg(NULL, LOG_INFO, "No change to: %s", current_filename);
diff --git a/opendnssec-1.4.0b1-r6817.patch b/opendnssec-1.4.0b1-r6817.patch
new file mode 100644
index 0000000..6f74dea
--- /dev/null
+++ b/opendnssec-1.4.0b1-r6817.patch
@@ -0,0 +1,48 @@
+diff -Naur opendnssec-1.4.0b1-orig/signer/src/signer/rrset.c opendnssec-1.4.0b1/signer/src/signer/rrset.c
+--- opendnssec-1.4.0b1-orig/signer/src/signer/rrset.c 2012-08-28 10:00:54.000000000 -0400
++++ opendnssec-1.4.0b1/signer/src/signer/rrset.c 2012-11-10 17:16:44.250226281 -0500
+@@ -32,6 +32,7 @@
+ */
+
+ #include "config.h"
++#include "shared/file.h"
+ #include "shared/hsm.h"
+ #include "shared/log.h"
+ #include "shared/util.h"
+@@ -557,6 +558,26 @@
+
+
+ /**
++ * Is the RRset signed with this locator?
++ *
++ */
++static int
++rrset_siglocator(rrset_type* rrset, const char* locator)
++{
++ size_t i = 0;
++ if (!rrset) {
++ return 0;
++ }
++ for (i=0; i < rrset->rrsig_count; i++) {
++ if (!ods_strcmp(locator, rrset->rrsigs[i].key_locator)) {
++ return 1;
++ }
++ }
++ return 0;
++}
++
++
++/**
+ * Transmogrify the RRset to a RRlist.
+ *
+ */
+@@ -702,6 +723,9 @@
+ continue;
+ }
+ /* Additional rules for signatures */
++ if (rrset_siglocator(rrset, zone->signconf->keys->keys[i].locator)) {
++ continue;
++ }
+ if (rrset_sigalgo(rrset, zone->signconf->keys->keys[i].algorithm)) {
+ continue;
+ }
diff --git a/opendnssec-1.4.5-serial0.patch b/opendnssec-1.4.5-serial0.patch
new file mode 100644
index 0000000..b587e04
--- /dev/null
+++ b/opendnssec-1.4.5-serial0.patch
@@ -0,0 +1,13 @@
+diff -Naur opendnssec-1.4.5-orig/signer/src/adapter/addns.c opendnssec-1.4.5/signer/src/adapter/addns.c
+--- opendnssec-1.4.5-orig/signer/src/adapter/addns.c 2014-03-25 06:45:44.000000000 +0000
++++ opendnssec-1.4.5/signer/src/adapter/addns.c 2014-04-18 16:26:39.079974120 +0000
+@@ -243,7 +243,8 @@
+ tmp_serial =
+ ldns_rdf2native_int32(ldns_rr_rdf(rr, SE_SOA_RDATA_SERIAL));
+ old_serial = adapi_get_serial(zone);
+- if (!util_serial_gt(tmp_serial, old_serial)) {
++ if (!util_serial_gt(tmp_serial, old_serial)
++ && zone->db->is_initialized) {
+ ods_log_info("[%s] zone %s is already up to date, have "
+ "serial %u, got serial %u", adapter_str, zone->name,
+ old_serial, tmp_serial);
diff --git a/opendnssec-1.4.7-extract.patch b/opendnssec-1.4.7-extract.patch
new file mode 100644
index 0000000..2b96715
--- /dev/null
+++ b/opendnssec-1.4.7-extract.patch
@@ -0,0 +1,156 @@
+diff -Naur opendnssec-1.4.7-orig/conf/conf.rnc opendnssec-1.4.7/conf/conf.rnc
+--- opendnssec-1.4.7-orig/conf/conf.rnc 2014-12-04 10:17:40.000000000 -0500
++++ opendnssec-1.4.7/conf/conf.rnc 2014-12-08 22:49:16.100212010 -0500
+@@ -50,7 +50,10 @@
+ element RequireBackup { empty }?,
+
+ # Do not maintain public keys in the repository (optional)
+- element SkipPublicKey { empty }?
++ element SkipPublicKey { empty }?,
++
++ # Generate extractable keys (CKA_EXTRACTABLE = TRUE) (optional)
++ element AllowExtraction { empty }?
+ }*
+ },
+
+diff -Naur opendnssec-1.4.7-orig/conf/conf.rng opendnssec-1.4.7/conf/conf.rng
+--- opendnssec-1.4.7-orig/conf/conf.rng 2014-12-04 10:18:39.000000000 -0500
++++ opendnssec-1.4.7/conf/conf.rng 2014-12-08 22:49:16.105212137 -0500
+@@ -71,6 +71,12 @@
+
+
+
++
++
++
++
++
++
+
+
+
+diff -Naur opendnssec-1.4.7-orig/conf/conf.xml.in opendnssec-1.4.7/conf/conf.xml.in
+--- opendnssec-1.4.7-orig/conf/conf.xml.in 2014-12-04 10:17:40.000000000 -0500
++++ opendnssec-1.4.7/conf/conf.xml.in 2014-12-08 22:49:16.101212036 -0500
+@@ -9,6 +9,9 @@
+ OpenDNSSEC
+ 1234
+
++
+
+
+