net/routinator0.15.2_3

lang/rust: Bump revisions after 1.99.0

PR:		299016

lang/rust: Bump revisions after 1.98.1

PR:		298139

lang/rust: Bump revisions after 1.97.1

PR:		296645

net/routinator: Security update 0.15.1 => 0.15.2

Release Notes:
https://www.nlnetlabs.nl/news/2026/Jun/08/routinator-0.15.2-released/
Changelog:
https://github.com/NLnetLabs/routinator/blob/v0.15.2/Changelog.md

PR:		295979
MFH:		2026Q2
Security:	CVE-2026-49232
Security:	CVE-2026-49233
Security:	CVE-2026-49234
Security:	CVE-2026-49235
Approved by:	osa, vvd (Mentors, implicit)

lang/rust: Bump revisions after 1.96.0

PR:		295694

lang/rust: Bump revisions after 1.95.0

PR:		294615

lang/rust: Bump revisions after 1.94.0

PR:		293615

lang/rust: Bump revisions after 1.93.0

PR:		292360

lang/rust: Bump revisions after 1.92.0

PR:		291582

lang/rust: Bump revisions after 1.91.1

PR:		290816

net/routinator: update to 15.1

Release Announcement: https://nlnetlabs.nl/news/2025/Oct/07/routinator-0.15.1-released/
Changelog: https://github.com/NLnetLabs/routinator/blob/v0.15.1/Changelog.md

PR:		290107
Reported by:	Jaap Akkerhuis <jaap@NLnetLabs.nl> (maintainer)

net/routinator: update to 15.0

Release Announcement: https://nlnetlabs.nl/news/2025/Sep/30/routinator-0.15.0-released/
Changelog: https://github.com/NLnetLabs/routinator/releases/tag/v0.15.0

0.15.0 'This Ain't No Disco'

Breaking changes

[For a detailed description, see the Release notes and the Changelog]

Removed the rrdp-keep-responses feature. We suggest the use of an HTTP
proxy such as mitmproxy instead.

This once and for all fixes CVE-2023-39916 which returned again in
release 0.14.0. (#1055)

Messages about issues with repositories and publication points are now
logged separately and by default are only visible in the status HTTP
server endpoints. The new log-repository-issues option can be used to
have these messages also written to the log. ([#1054])

Changed how server mode deals with broken or missing local exception
files. Previously, Routinator would just stop updating until they are
fixed, leading to updates being stalled if the operator misses the
error messages. Now it will log a warning and keep using the previous
set of local exceptions. When starting, it will exit with an error
message if there are broken or missing local exception files. (#1060)

Changed the RRDP timeouts: introduced a new config variable
rrdp-read-timeout that provides a timeout for individual network
operations (primarily: read from the server). Its default is 10
seconds. This timeout is also used for connecting of no specific value
is given, significantly speeding up validation runs.

In addition, the RRDP timeout was increased from 300 to 600 seconds to
better deal with slow transmission of large snapshots of some
repositories. (#1061)

Removed the rrdp-keep-responses feature. We suggest the use of an HTTP
proxy such as mitmproxy instead.

This once and for all fixes CVE-2023-39916 which returned again in
release 0.14.0. (#1055)

Messages about issues with repositories and publication points are now
logged separately and by default are only visible in the status HTTP
server endpoints. The new log-repository-issues option can be used to
have these messages also written to the log. ([#1054])

Changed how server mode deals with broken or missing local exception
files. Previously, Routinator would just stop updating until they are
fixed, leading to updates being stalled if the operator misses the
error messages. Now it will log a warning and keep using the previous
set of local exceptions. When starting, it will exit with an error
message if there are broken or missing local exception files. (#1060)

Changed the RRDP timeouts: introduced a new config variable
rrdp-read-timeout that provides a timeout for individual network
operations (primarily: read from the server). Its default is 10
seconds. This timeout is also used for connecting of no specific value
is given, significantly speeding up validation runs.

In addition, the RRDP timeout was increased from 300 to 600 seconds to
better deal with slow transmission of large snapshots of some
repositories. (#1061)

PR:		289937
Reported by:	Jaap Akkerhuis <jaap@NLnetLabs.nl> (maintainer)

lang/rust: Bump revisions after 1.90.0

PR:		289709

lang/rust: Bump revisions after 1.89.0

PR:		288923

lang/rust: Bump revisions after 1.88.0

PR:		287766

lang/rust: Bump revisions after 1.87.0

PR:		286829

lang/rust: Bump revisions after 1.86.0

PR:		285840

net/routinator: Update to 0.14.2

PR:		285193
Changes:	https://www.nlnetlabs.nl/news/2025/Mar/04/routinator-0.14.2-released/

lang/rust: Bump revisions after 1.85.0

PR:		284884

net/routinator: Update to 0.14.1

ChangeLog: https://www.nlnetlabs.nl/news/2025/Jan/22/routinator-0.14.1-released/

* ASPA support is now always compiled in and available if `enable-aspa`
  is set. The `aspa` Cargo feature has been removed. ([#990])

* If merging mutliple ASPA objects for a single customer ASN results
  in more than 16,380 provider ASNs, the ASPA is dropped. (Note
  that ASPA objects with more than 16,380 provider ASNs are already
  rejected during parsing.) ([#996]) * New `archive-stats` command
  that shows some statistics of an RRDP archive. ([#982])

* Re-enabled the use of GZIP compression in HTTP request sent by
  the RRDP collector. Measures to deal with exploding data have
  been implemented in [rpki-rs#319]. ([#997])

Bug fixes

* Fixed an issue with checking the file names in manifests that let
  to a crash when non-ASCII characters are used. ([rpki-rs#320],
  reported by Haya Schulmann and Niklas Vogel of Goethe University
  Frankfurt/ATHENE Center and assigned [CVE-2025-0638])

* The validation HTTP endpoints now accept prefixes with non-zero
  host bits. ([#987])

* Removed duplicate `rtr_client_reset_queries` in HTTP metrics.
  ([#992] by [@sleinen])

* Improved disk space consumption of the new RRDP archives by
  re-using empty space when updating an object and padding all
  objects to a multiple of 256 bytes. ([#982])

Other changes

* The minimum supported Rust version is now 1.74. ([#999])

* Added packaging support for Ubuntu 24.04 and removed support for
  Debian Stretch 9, Ubuntu Xenial 16.04, Ubuntu Bionic 18.04, and
  Centos 7 ([#980], [#994])

* Upgraded the bundled routinator-ui to release [ui-0.4.3][0.4.3].
PR:		284339
Reported by:	jaap@NLnetLabs.nl (maintainer)

lang/rust: Bump revisions after 1.84.0

PR:		283962

lang/rust: Bump revisions after 1.83.0

PR:		283000

lang/rust: Bump revisions after 1.82.0

PR:		282516

lang/rust: Bump revisions after 1.81.0

PR:		281300

*/*: remove STRIP_CMD calls in rust based ports

This is not needed after bc4fedc1fec0d359365c04d43be9e32bf101a50e

PR:		246993
Differential Revision:	https://reviews.freebsd.org/D46503

lang/rust: Bump revisions after 1.80.1

PR:		280490

net/routinator: enable on i386

SSE2 is required to build.

net/routinator: enable on powerpc64le

net/routinator: enable on aarch64 and powerpc64 where it builds

net/routinator: remove i386 from ONLY_FOR_ARCHS: dependency stopped being built on i386

The dependency stopped being built on i386 systems, so this patch
disables that architecture.

PR:	280328

net/routinator: Update to 0.14.0

ChangeLog: https://nlnetlabs.nl/news/2024/Jun/20/routinator-0.14.0-released/

Breaking changes

* Keep the content of an RRDP repository in a single file rather
  than as individual files under a directory. (#886)

* Switched to the all-new version 0.4 of the Routinator UI. This
  also changes the way we import the UI into Routinator by simply
  including the built assets which means downloads are not necessary
  during the build process any more. (#952)

* Changed the summary output format to have all lines end in a
  semicolon. (#907)

* Changed the options used for rsync. The options -rtO --delete are
  now always used. The options set in the rsync-args are added or,
  if that is not used, -z and --no-motd, as well as --contimeout=10
  if it is supported by the rsync command, and --max-size if the
  max-object-size option has not been set to 0. (#962)

New

* The chain_validity value in the jsonext format now considers the
  validity of the manifest EE certificates. A new stale value shows
  the time when any of the publication points along the way will
  become stale. (#945)

* If a collected manifest has a lower manifest number or an older
  thisUpdate field than a stored manifest for the same CA, the
  collected manifest is ignored and the stored publication point
  is used instead.  This implements a requirement added in RFC 9286.
  (#946, #954)

* The number of delta entries in a RRDP notification file is now
  limited to 500 by default. If there are more entries, the deltas
  are ignored and the snapshot is used. The limit can be changed
  through the new rrdp-max-delta-list-len configuration value.
  (#961)

* The RRDP collector now falls back to a snapshot update if the
  hash of a delta listed in the notification file has changed from
  the previous update. This implements
  draft-ietf-sidrops-rrdp-desynchronization-00. (#951)

* The RRDP collector now enforces that all URIs referred to or
  redirected to by an RRDP server have the same origin as the
  rpkiNotify URI in the CA certificate. (#953)

* The config file used is now printed for some commands. This should
  help with avoiding confusion when running Routinator as different
  users.  (#959)

Bug fixes

* Fixed an issue where the refresh time was calculated as zero under
  certain conditions until the dataset was updated. (#940)

* Add the current RRDP serial number to the RRDP server metrics
  when a Not Modified response is received so that Prometheus shows
  a constant valueg

PR:		279937
Reported by:	jaap@NLnetLabs.nl (maintainer)

lang/rust: Bump revisions after 1.79.0

PR:		279707

lang/rust: Bump revisions after 1.78.0

PR:		278834

lang/rust: Bump revisions after 1.77.0

PR:		277786

net/routinator: Update to 0.13.2

Changes: 	https://nlnetlabs.nl/news/2024/Feb/26/routinator-0.13.2-released/
MFH:		2024Q1
PR:		277375

net/routinator: Moved man to share/man

Approved by:    portmgr (blanket)

lang/rust: Bump revisions after 1.76.0

PR:		276920

net/routinator: Update version 0.13.0=>0.13.1

Changelog: https://github.com/NLnetLabs/routinator/releases/tag/v0.13.1

PR:		276892
Approved by:	submitter is maintainer

lang/rust: Bump revisions after 1.75.0

PR:		276033

lang/rust: Bump revisions after 1.74.1

PR:		275243

lang/rust: Bump revisions after 1.73.0

PR:		274499

net/routinator: Update to 0.13.0

ChangeLog: https://nlnetlabs.nl/news/2023/Sep/21/routinator-0.13.0-released/

New

 * Added support for ASPA. Processing needs to be enabled via the new option
   enable-aspa which is only available if the aspa feature is explicitly
   selected during compilation. This is due to the specification still
   changing. The implementation currently conforms with
   draft-ietf-sidrops-aspa-profile-15.
 * Added support for version 2 of the RTR protocol. This primarly means support
   for the ASPA payload type.
 * Sending SIGUSR2 to Routinator will re-open a log file if logging to a file is
   enabled.
 * The HTTP server provides a new endpoint /json-delta/notify that can be used
   to wait for updated data similar to the RTR Notify PDU.
 * Added support for filtering and adding router keys via local exception files.

 * The vrps command and the HTTP payload output endpoints now allow excluding
   specific payload types for output.
 * Added a new member payload to the output of the /api/v1/status endpoint that
   gives an overall summary of the produced payload.
 * Added new members generated and generatedTime to the JSON object produced by
   the /json-delta endpoint.

Breaking Changes

 * A new field aspa was added to the jsonext format. See the manual page for
   more information.
 * A number of ASPA-related fields have been added to all metrics and status
   formats.
 * Renamed functions and attributes that refer to standalone end entity
   certificates to refer to router certificates so they don’t get confused with
   the end entity certificates included with signed objects.
 * Renamed the JSON member in the HTTP status API from validEECerts to
   validRouterCerts. The old name is still available but may be removed in the
   future.
 * The regular json output format now includes router key and ASPA output. Since
   both are disabled by default, the format will still be compatible by default.
 * The minimal required Rust version has been increased to 1.70.

Bug Fixes

 * Fixed a bug in the RTR server where it would include router key PDUs even if
   the negotiated protocol version was 0.
 * Restored the ability to parse ASNs in JSON input to the validity command as
   string or number.
 * Update bcder to at least 0.7.3 to fix various decoding issues that could lead
   to a panic when processing invalid RPKI objects.
 * Check the request URI when generating a path for storing a copy of a RRDP
   response with the rrdp-keep-responses option to avoid path traversal.
   Found by Haya Shulman, Donika Mirdita and Niklas Vogel.  Assigned
   CVE-2023-39916

Other Changes

 * The log message for missing manifest now include the URI of the CA
   certificate for which the manifest is missing. (#864)
 * Binary packages are now also built for Debian bookworm. (#881)

PR:		274105
Reported by:	jaap@NLnetLabs.nl (maintainer)
Security:	CVE-2023-39916

net/routinator: Update to 0.12.2

Routinator 0.12.2 ‘Brutti, sporchi e cattivi’

This release fixes two issues in Routinator that can be exploited
remotely by rogue RPKI CAs and repositories. We therefore advise all
users of Routinator to upgrade to this release at their earliest
convenience.

The first issue, CVE-2022-39915, can lead to Routinator crashing when
trying to decode certain illegal RPKI objects.

The second issue, CVE-2022-39916, only affects users that have the
rrdp-keep-responses option enabled which allows storing all received
RRDP responses on disk. Because the file name for these responses is
derived from the URI and the path wasn’t checked properly, a RRDP URI
could be constructed that results in the response stored outside the
directory, possibly overwriting existing files.

We would like to thank Haya Shulman, Donika Mirdita and Niklas Vogel
for discovering and reporting these issues.

Changelog: https://nlnetlabs.nl/news/2023/Sep/13/routinator-0.12.2-released/

PR:		273826
MFH:		2023Q3

lang/rust: Bump revisions after 1.72.0

PR:		273331

lang/rust: Bump revisions after 1.71.0

PR:		272449

lang/rust: Bump revisions after 1.70.0

PR:		271797

lang/rust: Bump revisions after 1.69.0

PR:		270953

lang/rust: Bump revisions after 1.68.0

PR:		270080

lang/rust: Bump revisions after 1.67.1

PR:		269336

net/routinator: Update to 0.12.1

ChangeLog: https://www.nlnetlabs.nl/news/2023/Jan/04/routinator-0.12.1-released/

Minor bugfixes.

 * Actually use the extra-tals-dir config file option.

 * Allow private keys prefixed both with BEGIN PRIVATE KEY and BEGIN RSA
 PRIVATE KEY in the files referred to by http-tls-key and rtr-tls-key
 configuration options.

 * On Unix, if chroot is requested but no working directory is explicitly
 provided, set the working directory to the chroot directory.

 * Fixed the error messages printed when the http-tls-key or http-tls-cert
 options are required but missing. They now refer to HTTP and not, as
 previously, to RTR.

PR:		268906
Reported by:	jaap@NLnetLabs.nl (maintainer)