41 lines
2.2 KiB
Markdown
41 lines
2.2 KiB
Markdown
# Changelog
|
|
|
|
## Unreleased
|
|
|
|
- Implement RFC 9981 manifest rename handling with CA-key history in a TAL-key
|
|
namespace, strict thisUpdate progression, exact EE SIA location binding and
|
|
operator warnings. Commits recheck the latest history before publishing output.
|
|
Start with a fresh state directory; no old-database migration is provided.
|
|
- Report rejected manifests as partial validation results, including strict
|
|
completion failure when `require-complete` is enabled.
|
|
- Detect RRDP session desynchronization from persisted notification delta hashes
|
|
(RFC 9697), warn and recover using the current snapshot before applying deltas.
|
|
- Select automatic TA certificates using `draft-ietf-sidrops-rpki-ta-tiebreaker-06`:
|
|
prefer later notBefore, then earlier notAfter, then the newly fetched certificate.
|
|
A healthy preference for cache preserves a successful validation result.
|
|
|
|
## 0.1.0 — 2026-09-29
|
|
|
|
- Vendor five OpenBSD TALs and constraints with pinned provenance; enable policies
|
|
in both all5 Compose examples and add the TOML `ta-constraints-enabled` switch.
|
|
Validation summaries identify applied policies.
|
|
- Breaking CLI change: mandatory TOML via `validate|daemon --config FILE`;
|
|
remove business flags, `--` forwarding and logging environment overrides.
|
|
- Read-only configuration checking/printing and top-level version output.
|
|
- TAL-driven TA certificate refresh with validated cache fallback; TAL files
|
|
remain operator-maintained.
|
|
- Explicit success/partial/failed results, strict completion exit code 3,
|
|
atomic completion markers and success-only latest publication.
|
|
- Complete automatic-TA/text-log Compose TOML examples and stop/edit/reload guide.
|
|
|
|
|
|
- RPKI validation with multiple TAL/TA inputs and resource constraints.
|
|
- RRDP snapshot/delta synchronization and same-origin enforcement.
|
|
- Bounded transport and object worker pools.
|
|
- CSV, CCR, JSON summaries and level-controlled text/JSON logs.
|
|
- Foreground daemon with intervals, timeouts, restart and retention.
|
|
- Docker and Compose deployment, including all-five-anchor configuration.
|
|
|
|
The CLI accepts HTTPS RRDP. Operators supply TALs; matching TA certificates can be fixed or automatically refreshed.
|
|
No RTR server is included. See the standards matrix and CLI reference for scope.
|