Add a new security/easy-rsa package that contains the bits that got

split out of OpenVPN prior to the current 2.3.0 release, and make that
security/openvpn RUN_DEPENDS on it. Also update UPDATING record.

UPDATING

@@ -5,12 +5,14 @@ they are unavoidable.
 You should get into the habit of checking this file for changes each time
 you update your ports collection, before attempting any port upgrades.
 
-20130111:
+20130113:
   AFFECTS: users of security/openvpn*
   AUTHOR: mandree@FreeBSD.org
 
   security/openvpn has been upgraded to the IPv6-capable v2.3.0.
-  This upgrade removes easy-rsa, and changes installed file layout a bit.
+  This upgrade moves easy-rsa into a separate package in
+  security/easy-rsa that is pre-selected as default run-time dependency,
+  and changes installed file layout a bit.
 
   security/openvpn22 retains the prior OpenVPN 2.2.2 version.
   If you want to continue using this version, use one of these commands:

security/easy-rsa/Makefile

@@ -0,0 +1,18 @@
+# $FreeBSD$
+
+PORTNAME=	easy-rsa
+DISTVERSION=	2.2.0_master
+CATEGORIES=	security net-mgmt
+MASTER_SITES=	http://swupdate.openvpn.net/community/releases/ \
+		http://build.openvpn.net/downloads/releases/
+
+# Eric F. Crist <ecrist@secure-computing.net> does not require my
+# approval for changes to this package. -- mandree@FreeBSD.org
+MAINTAINER=	mandree@FreeBSD.org
+COMMENT=	A small RSA key management package based on openssl
+
+LICENSE=	GPLv2
+
+GNU_CONFIGURE=	yes
+
+.include <bsd.port.mk>

security/easy-rsa/distinfo

@@ -0,0 +1,2 @@
+SHA256 (easy-rsa-2.2.0_master.tar.gz) = d23ddc3a764b40d03ada76f387c92ae4dcf4f5266da54c2bae130325b05eebe2
+SIZE (easy-rsa-2.2.0_master.tar.gz) = 80460

security/easy-rsa/pkg-descr

@@ -0,0 +1,7 @@
+Easy-RSA is a small RSA key management package, based on the openssl
+command line tool, that can be found in the easy-rsa subdirectory of the
+OpenVPN distribution.  While this tool is primary concerned with key
+management for the SSL VPN application space, it can also be used for
+building web certificates.
+
+WWW: https://community.openvpn.net/openvpn/wiki/GettingEasyRsa

security/easy-rsa/pkg-plist

@@ -0,0 +1,25 @@
+%%DOCSDIR%%/README-2.0
+%%DOCSDIR%%/COPYRIGHT.GPL
+%%DOCSDIR%%/COPYING
+share/easy-rsa/build-ca
+share/easy-rsa/vars
+share/easy-rsa/sign-req
+share/easy-rsa/revoke-full
+share/easy-rsa/pkitool
+share/easy-rsa/openssl-1.0.0.cnf
+share/easy-rsa/openssl-0.9.8.cnf
+share/easy-rsa/openssl-0.9.6.cnf
+share/easy-rsa/list-crl
+share/easy-rsa/inherit-inter
+share/easy-rsa/clean-all
+share/easy-rsa/build-req-pass
+share/easy-rsa/build-req
+share/easy-rsa/build-key-server
+share/easy-rsa/build-key-pkcs12
+share/easy-rsa/build-key-pass
+share/easy-rsa/build-key
+share/easy-rsa/build-inter
+share/easy-rsa/build-dh
+share/easy-rsa/whichopensslcnf
+@dirrm share/easy-rsa
+@dirrm %%DOCSDIR%%

security/openvpn/Makefile

@@ -3,11 +3,10 @@
 
 PORTNAME=	openvpn
 DISTVERSION=	2.3.0
+PORTREVISION=	1
 CATEGORIES=	security net
-# MASTER_SITES points to hosts in distinct data centers,
-# so just one MASTER_SITES entry should be OK.
 MASTER_SITES=	http://swupdate.openvpn.net/community/releases/ \
-		${MASTER_SITE_LOCAL:S,$,mandree/,}
+		http://build.openvpn.net/downloads/releases/
 
 MAINTAINER=	mandree@FreeBSD.org
 COMMENT=	Secure IP/Ethernet tunnel daemon
@@ -24,9 +23,11 @@ CPPFLAGS+=	-I${LOCALBASE}/include
 LDFLAGS+=	-L${LOCALBASE}/lib
 
 # PolarSSL missing: OpenVPN does not currently compile with PolarSSL 1.2.0+
-OPTIONS_DEFINE=		PW_SAVE PKCS11
+OPTIONS_DEFINE=		PW_SAVE PKCS11 EASYRSA
+OPTIONS_DEFAULT=	EASYRSA
 PW_SAVE_DESC=	Interactive passwords may be read from a file
 PKCS11_DESC=	Use security/pkcs11-helper
+EASYRSA_DESC=	Install security/easy-rsa RSA helper package
 
 .include <bsd.port.options.mk>
 
@@ -36,6 +37,10 @@ INSTALL_TARGET=	install
 INSTALL_TARGET=	install-exec install-man
 .endif
 
+.if ${PORT_OPTIONS:MEASYRSA}
+RUN_DEPENDS+=	easy-rsa>=0:${PORTSDIR}/security/easy-rsa
+.endif
+
 INSTALL_TARGET+=	mandir=${MANPREFIX}/man
 MAN8=		openvpn.8