Log message:
net/routinator: now appears no longer BROKEN w/newer rust.

Built OK with rust 1.82.0 on NetBSD/amd64.

Log message:
net/routinator: upgrade to version 0.14.1.

Pkgsrc changes:
 * Basically only cargo-depends and checksum changes.

Upstream changes:

Version 0.14.1 -- "Black Cats and Voodoo Dolls"
===============================================

This release fixes a crash when the file names listed in a manifest
contain illegal characters. We recommend all users to upgrade to
this version.

New
 * ASPA support is now always compiled in and available if
   enable-aspa is set. The aspa Cargo feature has been removed.
   (#990)
 * If merging mutliple ASPA objects for a single customer ASN
   results in more than 16,380 provider ASNs, the ASPA is dropped.
   (Note that ASPA objects with more than 16,380 provider ASNs
   are already rejected during parsing.) (#996)
 * New archive-stats command that shows some statistics of an RRDP
   archive. (#982)
 * Re-enabled the use of GZIP compression in HTTP request sent by
   the RRDP collector. Measures to deal with exploding data have
   been implemented in rpki-rs#319. (#997)

Bug fixes
 * Fixed an issue with checking the file names in manifests that
   let to a crash when non-ASCII characters are used. (rpki-rs#320,
   reported by Haya Schulmann and Niklas Vogel of Goethe University
   Frankfurt/ATHENE Center and assigned CVE-2025-0638)
 * The validation HTTP endpoints now accept prefixes with non-zero
   host bits. (#987)
 * Removed duplicate rtr_client_reset_queries in HTTP metrics.
   (#992 by @sleinen)
 * Improved disk space consumption of the new RRDP archives by
   re-using empty space when updating an object and padding all
   objects to a multiple of 256 bytes. (#982)

Other changes
 * The minimum supported Rust version is now 1.74. (#999)
 * Added packaging support for Ubuntu 24.04 and removed support
   for Debian Stretch 9, Ubuntu Xenial 16.04, Ubuntu Bionic 18.04,
   and Centos 7 (#980, #994)
 * Upgraded the bundled routinator-ui to release [ui-0.4.3][0.4.3].

Version 0.14.0 -- "You Must Gather Your Party Before Venturing Forth"
=====================================================================

Breaking changes
 * Keep the content of an RRDP repository in a single file rather
   than as individual files under a directory. (#886)
 * Switched to the all-new version 0.4 of the Routinator UI. This
   also changes the way we import the UI into Routinator by simply
   including the built assets which means downloads are not necessary
   during the build process any more. (#952)
 * Changed the summary output format to have all lines end in a
   semicolon. (#907)
 * Changed the options used for rsync. The options -rtO --delete
   are now always used. The options set in the rsync-args are added
   or, if that is not used, -z and --no-motd, as well as --contimeout=10
   if it is supported by the rsync command, and --max-size if the
   max-object-size option has not been set to 0. (#962)

New
 * The chain_validity value in the jsonext format now considers
   the validity of the manifest's EE certificates. A new stale
   value shows the time when any of the publication points along
   the way will become stale. (#945)
 * If a collected manifest has a lower manifest number or an older
   thisUpdate field than a stored manifest for the same CA, the
   collected manifest is ignored and the stored publication point
   is used instead. This implements a requirement added in RFC
   9286. (#946, #954)
 * The number of delta entries in a RRDP notification file is now
   limited to 500 by default. If there are more entries, the deltas
   are ignored and the snapshot is used. The limit can be changed
   through the new rrdp-max-delta-list-len configuration value.
   (#961)
 * The RRDP collector now falls back to a snapshot update if the
   hash of a delta listed in the notification file has changed from
   the previous update. This implements
   draft-ietf-sidrops-rrdp-desynchronization-00. (#951)
 * The RRDP collector now enforces that all URIs referred to or
   redirected to by an RRDP server have the same origin as the
   rpkiNotify URI in the CA certificate. (#953)
 * The config file used is now printed for some commands. This
   should help with avoiding confusion when running Routinator as
   different users. (#959)

Bug fixes
 * Fixed an issue where the refresh time was calculated as zero
   under certain conditions until the dataset was updated. (#940)
 * Add the current RRDP serial number to the RRDP server metrics
   when a Not Modified response is received so that Prometheus
   shows a constant value.

Log message:
routinator: mark as BROKEN for rust>=1.80

Log message:
net/routinator: allow network access during build.

This can reportedly be reverted once 0.14.0 is released
and packaged.

Log message:
Upgrade net/routinator to version 0.13.2.

Pkgsrc changes:
 * Version bump + checksum updates.

Upstream changes:

0.13.2 -- "Existential Funk"

Released 2024-01-26.

Bug Fixes

* Fix the RTR listener so that Routinator won't exit if an
  incoming RTR connection is closed again too quickly. ([#937],
  reported by Yohei Nishimura, Atsushi Enomoto, Ruka Miyachi;
  Internet Multifeed Co., Japan.  Assigned [CVE-2024-1622].)

[#937]: https://github.com/NLnetLabs/routinator/pull/937
[CVE-2024-1622]: https://www.nlnetlabs.nl/downloads/routinator/CVE-2024-1622.txt

Log message:
Update net/routinator to version 0.13.1.

Pkgsrc changes:
 * Bump version & re-compute cargo-depends.

Upstream changes:

New

* Added support for private keys marked as "EC PRIVATE KEY" in the
  PEM files for TLS server configuration. ([#921])
* The rsync collector now logs stderr output of the rsync command
  directly instead of collecting it and logging it in one go after
  the commend returned. ([#290])

Bug Fixes

* The `dump` command will now succeed even if certain directories
  or files in the repository cache are missing. ([#916])
* A more meaningful message is now printed when decoding RPKI
  objects fails. It will still not give much detail but at least it
  isn't confusing any more. ([#917])

Other changes

* Updated the `nlnetlabs-testbed` TAL to the current location and
  key. ([#922])

[#916]: https://github.com/NLnetLabs/routinator/pull/916
[#917]: https://github.com/NLnetLabs/routinator/pull/917
[#920]: https://github.com/NLnetLabs/routinator/pull/920
[#921]: https://github.com/NLnetLabs/routinator/pull/921
[#922]: https://github.com/NLnetLabs/routinator/pull/922

Log message:
Upgrade routinator to version 0.13.0.

Pkgsrc changes:
 * Update cargo-depends.mk, update checksums.

Upstream changes:

Release v0.13.0 -- 'Should Have Started This in a Screen'

New

* Added support for ASPA. Processing needs to be enabled via the
  new option `enable-aspa` which is only available if the `aspa`
  feature is explicitly selected during compilation. This is due to
  the specification still changing. The implementation currently
  conforms with [draft-ietf-sidrops-aspa-profile-15].  ([#847],
  [#873], [#874], [#878])
* Added support for version 2 of the RTR protocol. This primarly
  means support for the ASPA payload type. ([#847])
* Sending SIGUSR2 to Routinator will re-open a log file if logging
  to a file is enabled. ([#859])
* The HTTP server provides a new endpoint `/json-delta/notify` that
  can be used to wait for updated data similar to the RTR Notify PDU.
  ([#863])
* Added support for filtering and adding router keys via local
  exception files. ([#865])
* The `vrps` command and the HTTP payload output endpoints now
  allow excluding specific payload types for output. ([#866])
* Added a new member `payload` to the output of the `/api/v1/status`
  endpoint that gives an overall summary of the produced payload.
  ([#867])
* Added new members `generated` and `generatedTime` to the JSON
  object produced by the `/json-delta` endpoint. ([#868])

Breaking Changes

* A new field `aspa` was added to the jsonext format. See the manual
  page for more information. ([#847])
* A number of ASPA-related fields have been added to all metrics
  and status formats. ([#847])
* Renamed functions and attributes that refer to standalone end
  entity certificates to refer to router certificates so they don't
  get confused with the end entity certificates included with signed
  objects. ([#854])
* Renamed the JSON member in the HTTP status API from `validEECerts`
  to `validRouterCerts`. The old name is still available but may be
  removed in the future. ([#854])
* The regular `json` output format now includes router key and ASPA
  output. Since both are disabled by default, the format will still
  be compatible by default. ([#866])
* The minimal required Rust version has been increased to 1.70.
  ([#847], [#853], [#869], [#879])

Bug Fixes

* Fixed a bug in the RTR server where it would include router key
  PDUs even if the negotiated protocol version was 0. (via [rpki-rs
  #250])
* Restored the ability to parse ASNs in JSON input to the `validity`
  command as string or number. ([#861])
* Update bcder to at least 0.7.3 to fix various decoding issues
  that could lead to a panic when processing invalid RPKI objects.
* Check the request URI when generating a path for storing a copy
  of a RRDP response with the `rrdp-keep-responses` option to avoid
  path traversal. ([#894]. Found by Haya Shulman, Donika Mirdita and
  Niklas Vogel. Assigned CVE-2023-39916.)

Other Changes

* The log message for missing manifest now include the URI of the
  CA certificate for which the manifest is missing. ([#864])
* Binary packages are now also built for Debian _bookworm._ ([#881])

[#847]: https://github.com/NLnetLabs/routinator/pull/847
[#853]: https://github.com/NLnetLabs/routinator/pull/853
[#854]: https://github.com/NLnetLabs/routinator/pull/854
[#859]: https://github.com/NLnetLabs/routinator/pull/859
[#861]: https://github.com/NLnetLabs/routinator/pull/861
[#863]: https://github.com/NLnetLabs/routinator/pull/863
[#864]: https://github.com/NLnetLabs/routinator/pull/864
[#865]: https://github.com/NLnetLabs/routinator/pull/865
[#866]: https://github.com/NLnetLabs/routinator/pull/866
[#867]: https://github.com/NLnetLabs/routinator/pull/867
[#868]: https://github.com/NLnetLabs/routinator/pull/868
[#869]: https://github.com/NLnetLabs/routinator/pull/869
[#873]: https://github.com/NLnetLabs/routinator/pull/873
[#874]: https://github.com/NLnetLabs/routinator/pull/874
[#878]: https://github.com/NLnetLabs/routinator/pull/878
[#879]: https://github.com/NLnetLabs/routinator/pull/879
[#881]: https://github.com/NLnetLabs/routinator/pull/881
[#894]: https://github.com/NLnetLabs/routinator/pull/894
[rpki-rs #250]: https://github.com/NLnetLabs/rpki-rs/pull/250
[draft-ietf-sidrops-aspa-profile-15]: \ 
https://datatracker.ietf.org/doc/draft-ietf-sidrops-aspa-profile/15/

Log message:
Upgrade routinator to version 0.12.2.

Pkgsrc changes:
 * Update cargo-depends.mk, update checksums.

Upstream changes:

## 0.12.2 "Brutti, sporchi e cattivi"

Release 2023-09-13.

Bug Fixes

* Fixed various decoding issues that could lead to a panic when processing
  invalid RPKI objects. ([#891], via bcder release 0.7.3. Found by
  Haya Shulman, Donika Mirdita and Niklas Vogel. Assigned CVE-2023-39915)
* Check the request URI when generating a path for storing a copy of a RRDP
  response with the `rrdp-keep-responses` option to avoid path traversal.
  ([#892]. Found by Haya Shulman, Donika Mirdita and Niklas Vogel.
  Assigned CVE-2023-39916.)

[#891]: https://github.com/NLnetLabs/routinator/pull/891
[#892]: https://github.com/NLnetLabs/routinator/pull/892

## 0.12.1 "Plan uw reis in de app"

Released 2023-01-04.

There are no changes since 0.12.1-rc2.

## 0.12.1-rc2

Released 2022-12-13.

Bug Fixes

* Allow private keys prefixed both with `BEGIN PRIVATE KEY` and
  `BEGIN RSA PRIVATE KEY` in the files referred to by `http-tls-key` and
  `rtr-tls-key` configuration options. ([#831], [#832])

[#831]: https://github.com/NLnetLabs/routinator/pull/831
[#832]: https://github.com/NLnetLabs/routinator/pull/831

## 0.12.1-rc1

Released 2022-12-05.

Bug Fixes

* Actually use the `extra-tals-dir` config file option. ([#821])
* On Unix, if chroot is requested but no working directory is explicitly
  provided, set the working directory to the chroot directory. ([#823])
* Fixed the error messages printed when the `http-tls-key` or
  `http-tls-cert` options are required but missing. They now refer to HTTP
  and not, as previously, to RTR. ([#824] by [@SanderDelden])

Other Changes

* Switch the packaging workflow to use [Ploutos]. ([#816])

[#816]: https://github.com/NLnetLabs/routinator/pull/816
[#821]: https://github.com/NLnetLabs/routinator/pull/821
[#823]: https://github.com/NLnetLabs/routinator/pull/823
[#824]: https://github.com/NLnetLabs/routinator/pull/824
[@SanderDelden]: https://github.com/SanderDelden
[Ploutos]: https://github.com/NLnetLabs/ploutos/

Log message:
Upgrade routinator to version 0.12.0.

Pkgsrc changes:
 * Update cargo-depends.mk, update checksums.

Upstream changes:

## 0.12.0 "Brutalism and Gardening"

Released 2022-11-10.

Bug Fixes

* Remove a stray newline in summary output.

## 0.12.0-rc1

Released 2022-11-02.

Breaking Changes

* Restructured the TAL configuration in response to the dropped requirement
  to opt into the ARIN TAL.

  Routinator will now use the bundled RIR TALs directly unless told otherwise
  by the new `--no-rir-tals` command  line and config option. The additional
  bundled TALs can be added via the new `--tal` command line and config
  option. Additionally, the TAL directory can still be used via the
  `--extra-tals-dir` option. The `tal-dir` option has been removed but will
  still be accepted *and ignored* in the config file only.

  The `init` command has been removed. ([#796])
* Changed the default configuration option for `unsafe-vrps` to `accept`
  and removed all logging or mentioning of unsafe VRPs in this case.
  ([#761])
* Setting the `rsync-timeout` option to 0 now disables the rsync timeout.
  ([#798])
* Refactored error handling. Routinator now logs the reason why an object
  failed verification or was otherwise rejected. ([#755])
* Removed the deprecated `rrdp-disable-gzip` configuration option.
  ([#769])

New

* The new `limit-v4-len` and `limit-v6-len` command line and config file
  options allow limiting the length of IPv4 and IPv6 prefixes,
  respectively, to be included in the VRP data set. ([#810])
* The new `rrdp-fallback` command line and config file option
  allows specifying the circumstances under which a failed RRDP fetch
  should result in using rsync instead. Supported polices are `never` for
  never falling back to using rsync, `stale` for the current behavior of
  falling back when RRDP has failed for some time, and `new` to only fall
  back for repositories where RRDP has never worked before. ([#799])
* In the extended `jsonext` output format, the information for VRPs and
  router keys derived from RPKI data has gained a new member `"tal"` that
  shows the name of the TAL this object was published under. ([#765])
* The log output to files, stderr, and the `/log` HTTP endpoint now
  includes the log level of the message to make it more clear how
  important the message really is. ([#797])
* The RTR client metrics have been extended by three new values allowing
  to track the time since last cache reset and the number of reset and
  serial queries. Like all RTR client metrics, these new values are only
  available if enable explicitly via the `rtr-client-metrics` config option.
  ([#800])
* TCP keepalive is now enabled for RRDP connections. The keepalive
  duration can be configured via the new command line and config file option
  `rrdp-tcp-keepalive`. ([#801])

Bug Fixes

* Fixed an issue in error handling in the RRDP collector that causes
  Routinator to exit if it encountered malformed Base 64 in RRDP snapshot
  and delta files. (Found by Donika Mirdita and Haya Shulman. Assigned
  [CVE-2022-3029].) ([#784])
* Fixed an issue where RRDP snapshots and deltas with a status code other
  than 200 OK were accepted and processed. ([#802])
* Changed how Routinator deals with files in the store that cannot be
  parsed. These will now be ignored and the publication point stored in
  them considered not available. ([#803])
* When piping output from the `vrps` command into something else, a broken
  pipe will not lead to an error message any more. ([#807])
* Fixed various issues with the calculation of RTR metrics. ([#811])

Other Changes

* The minimal required Rust version has been increased to 1.60. ([#792])
* The default Docker image now listens on both port 8323 and 9556 for HTTP
  requests. ([#809])

[#755]: https://github.com/NLnetLabs/routinator/pull/755
[#761]: https://github.com/NLnetLabs/routinator/pull/761
[#765]: https://github.com/NLnetLabs/routinator/pull/765
[#769]: https://github.com/NLnetLabs/routinator/pull/769
[#783]: https://github.com/NLnetLabs/routinator/pull/784
[#792]: https://github.com/NLnetLabs/routinator/pull/792
[#796]: https://github.com/NLnetLabs/routinator/pull/796
[#797]: https://github.com/NLnetLabs/routinator/pull/797
[#798]: https://github.com/NLnetLabs/routinator/pull/798
[#799]: https://github.com/NLnetLabs/routinator/pull/799
[#800]: https://github.com/NLnetLabs/routinator/pull/800
[#801]: https://github.com/NLnetLabs/routinator/pull/801
[#802]: https://github.com/NLnetLabs/routinator/pull/802
[#803]: https://github.com/NLnetLabs/routinator/pull/803
[#807]: https://github.com/NLnetLabs/routinator/pull/807
[#809]: https://github.com/NLnetLabs/routinator/pull/809
[#810]: https://github.com/NLnetLabs/routinator/pull/810
[#811]: https://github.com/NLnetLabs/routinator/pull/811

Log message:
Upgrade routinator to version 0.11.3.

## 0.11.3
Released 2022-09-13.

Bug Fixes

* Fixes an issue in error handling in the RRDP collector that causes
  Routinator to exit if it encountered malformed Base 64 in RRDP snapshot
  and delta files. (Found by Donika Mirdita and Haya Shulman. Assigned
  [CVE-2022-3029].) ([#781])

[#781]: https://github.com/NLnetLabs/routinator/pull/781
[CVE-2022-3029]: https://nlnetlabs.nl/downloads/routinator/CVE-2022-3029.txt