[Bug 289937] net/routinator: Update to 0.15.0

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=289937

            Bug ID: 289937
           Summary: net/routinator: Update to 0.15.0
           Product: Ports & Packages
           Version: Latest
          Hardware: Any
               URL: https://nlnetlabs.nl/news/2025/Sep/30/routinator-0.15.
                    0-released/
                OS: Any
            Status: New
          Severity: Affects Some People
          Priority: ---
         Component: Individual Port(s)
          Assignee: ports-bugs@FreeBSD.org
          Reporter: jaap@NLnetLabs.nl
 Attachment #264190 maintainer-approval+
             Flags:

Created attachment 264190
  --> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=264190&action=edit
Patch to upgrade

0.15.0 ‘This Ain’t No Disco’

Breaking changes

[For a detailed description, see the Release notes and the Changelog]

Removed the rrdp-keep-responses feature. We suggest the use of an HTTP proxy
such as mitmproxy instead.

This once and for all fixes CVE-2023-39916 which returned again in release
0.14.0. (#1055)

Messages about issues with repositories and publication points are now logged
separately and by default are only visible in the status HTTP server endpoints.
The new log-repository-issues option can be used to have these messages also
written to the log. ([#1054])

Changed how server mode deals with broken or missing local exception files.
Previously, Routinator would just stop updating until they are fixed, leading
to updates being stalled if the operator misses the error messages. Now it will
log a warning and keep using the previous set of local exceptions. When
starting, it will exit with an error message if there are broken or missing
local exception files. (#1060)

Changed the RRDP timeouts: introduced a new config variable rrdp-read-timeout
that provides a timeout for individual network operations (primarily: read from
the server). Its default is 10 seconds. This timeout is also used for
connecting of no specific value is given, significantly speeding up validation
runs.

In addition, the RRDP timeout was increased from 300 to 600 seconds to better
deal with slow transmission of large snapshots of some repositories. (#1061)

Removed the rrdp-keep-responses feature. We suggest the use of an HTTP proxy
such as mitmproxy instead.

This once and for all fixes CVE-2023-39916 which returned again in release
0.14.0. (#1055)

Messages about issues with repositories and publication points are now logged
separately and by default are only visible in the status HTTP server endpoints.
The new log-repository-issues option can be used to have these messages also
written to the log. ([#1054])

Changed how server mode deals with broken or missing local exception files.
Previously, Routinator would just stop updating until they are fixed, leading
to updates being stalled if the operator misses the error messages. Now it will
log a warning and keep using the previous set of local exceptions. When
starting, it will exit with an error message if there are broken or missing
local exception files. (#1060)

Changed the RRDP timeouts: introduced a new config variable rrdp-read-timeout
that provides a timeout for individual network operations (primarily: read from
the server). Its default is 10 seconds. This timeout is also used for
connecting of no specific value is given, significantly speeding up validation
runs.

In addition, the RRDP timeout was increased from 300 to 600 seconds to better
deal with slow transmission of large snapshots of some repositories. (#1061)

-- 
You are receiving this mail because:
You are the assignee for the bug.