Mangling of keyfile_dir and allocation of keyfile_path led to rare
crashes (and Valgrind complaints).

The error was introduced in 21f3a6b9.

These shouldn't make any problems:
- the verbose messages don't print any scope, and
- reputation cache doesn't consider scope.

Now that we renamed "debug" to "verbose", the old name didn't seem very
suitable anymore; this new identifier haven't got to master yet.

Split NDEBUG to NDEBUG (asserts) and NOVERBOSELOG (verbose logging); rename all related symbols to use VERBOSE instead of DEBUG

... but don't raise any kind of error.
The lua function `verbose()` behaved reasonably already.
It doesn't warn, but docs for the function do mention `NLOGDEBUG`.

In particular, don't require to call an externally defined function to
find if in --verbose mode or not.  Now it's just an extern bool.
I'm confident the performance impact of not using -DNLOGDEBUG should be
negligible now.

This comes with a small incompatible API+ABI change, but that shouldn't
matter as we've had a couple of those already since the last release.

Consequently, there's no use for worker_reserve in the header.

The last hunk: we'd report worker failure even if we didn't
attempt to start it due to previous failures.

We called kr_crypto_init() just before forking and then _reinit() in
all children, but we never did any cryptography in-between - better
initialize after forking.

Note: the function is KR_EXPORT.  It might not be useful anymore, but
its removal would require bumping libkres soname.

We also propagate kresd's verbosity into the TLS logging level

kresd has --tls/-t by analogy with --addr/-a where the daemon opens
the socket itself.

This changeset adds equivalent functionality for inherited sockets:
--tlsfd/-T by analogy with --fd/-Sa

When run under systemd supervision, accept a control socket from the
supervisor if the name supplied is "control".

See FileDescriptorName= in systemd.socket(5) for more details.

forks are connected with IPC pipes to process
group leader and can execute expressions on its
behalf. so running commands over all workers
is easy now:

> hostname() -- single
localhost

> map 'hostname()' -- all
localhost
localhost
localhost

fixes #77

when opening an empty database, an invalidated key
value was written resulting in possible corruption
of the cache

addition to previous generic socket activation

fixes #11

daemon can accept existing fds on command line,
thus supporting process managers like circus or
upstart. a tiny supervisor script is attached

this includes default configuration, resolver
starts completely blank

the quiet mode doesn't print neither intro messages nor prompt
in the interactive mode, which makes it useful for scripted usage

this is not going to be backwards compatible change, but it will be the first tagged libknot release sufficient for resolver

* PIE,RELRO+NOW and other security features enabled
* support for both static/dynamic builds with BUILDMODE
* dynamic library is ABI-versioned, starting at 1
* pkg-config file is installed

this is needed to make sure it always compiles with PIC

if the root key file doesn’t exist, it will be populated from root DNSKEY query, which will be validated against root trust anchors retrieved over HTTPS with IANA cert verification against built-in current IANA cert CA. it requires luasocket and luasec for it to work. trust anchors XML file signature is not checked, as there’s no facility for PKCS7 checking yet.

amalgamated build concatenates all files into a single .c file to
allow compiler see all symbols and produce possibly smaller code.
for binary distributions this is what you want, as it's faster but
may consume more memory during compilation.
it however cannot do incremental builds.