-------------------------------------------------------------------------------- Fedora EPEL Update Notification FEDORA-EPEL-2022-0bfbcf0627 2022-12-22 00:30:35.400896 --------------------------------------------------------------------------------
Name : rpki-client Product : Fedora EPEL 9 Version : 8.2 Release : 1.el9 URL : https://www.rpki-client.org/ Summary : OpenBSD RPKI validator to support BGP Origin Validation Description : The OpenBSD rpki-client is a free, easy-to-use implementation of the Resource Public Key Infrastructure (RPKI) for Relying Parties (RP) to facilitate validation of the Route Origin of a BGP announcement. The program queries the RPKI repository system, downloads and validates Route Origin Authorisations (ROAs) and finally outputs Validated ROA Payloads (VRPs) in the configuration format of OpenBGPD, BIRD, and also as CSV or JSON objects for consumption by other routing stacks.
-------------------------------------------------------------------------------- Update Information:
# rpki-client 8.2 - Add a new `-H` command line option to create a shortlist of repositories to synchronize to. For example, when invoking `rpki-client -H rpki.ripe.net -H chloe.sobornost.net`, the utility will not connect to any other hosts other than the two specified through the `-H` option. - Add support for validating Geofeed (RFC 9092) authenticators. To see an example download https://sobornost.net/geofeed.csv and run `rpki-client -f geofeed.csv`. - Add support for validating Trust Anchor Key (TAK) objects. TAK objects can be used to produce new Trust Anchor Locators (TALs) signed by and verified against the previous Trust Anchor. See draft-ietf-sidrops-signed-tal for the full specification. - Log lines related to RRDP/HTTPS connection problems now include the IP address of the problematic endpoint (in brackets). - Improve the error message when an invalid filename is encountered in the rpkiManifest field in the Subject Access Information (SIA) extension. - Emit a warning when unexpected X.509 extensions are encountered. - Restrict the ROA ipAddrBlocks field to only allow two ROAIPAddressFamily structures (one per address family). See draft-ietf-sidrops-rfc6482bis. - Check the absence of the Path Length constraint in the Basic Constraints extension. - Restrict the SIA extension to only allow the signedObject and rpkiNotify accessMethods. - Check that the Signed Object access method is present in ROA, MFT, ASPA, TAK, and GBR End- Entity certificates. - In addition to the `rsync://` scheme, also permit other schemes (such as `https://`) in the SIA signedObject access method. - Check that the KeyUsage extension is set to nothing but digitalSignature on End-Entity certificates. - Check that the KeyUsage extension is set to nothing but keyCertSign and CRLSign on CA certificates. - Check that the ExtendedKeyUsage extension is absent on CA certificates. - Fix a bug in the handling of the port of http_proxy. - The `-r` command line option has been deprecated. - Filemode (`-f`) output is now presented as a text based table. -------------------------------------------------------------------------------- ChangeLog:
* Wed Dec 14 2022 Robert Scheck robert@fedoraproject.org 8.2-1 - Upgrade to 8.2 (#2153077) -------------------------------------------------------------------------------- References:
[ 1 ] Bug #2153077 - rpki-client-8.2 is available https://bugzilla.redhat.com/show_bug.cgi?id=2153077 --------------------------------------------------------------------------------
This update can be installed with the "yum" update programs. Use su -c 'yum update rpki-client' at the command line. For more information, refer to "YUM", available at https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7%5C /html/System_Administrators_Guide/ch-yum.html
All packages are signed with the Fedora EPEL GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys --------------------------------------------------------------------------------
epel-package-announce@lists.fedoraproject.org