rpki-client 8.7

• Add ability to constrain an RPKI Trust Anchor's effective signing authority to a limited set of Internet numbers. This allows Relying Parties to enjoy the potential benefits of assuming trust, but within a bounded scope. This distribution includes curated constraints files. More information: https://datatracker.ietf.org/doc/html/draft-snijders-constraining-rpki-trust-anchors
• Following a 'failed fetch' (described in RFC 9286), emit a warning and continue with a previously cached Manifest file, if present and still valid.
• Emit a warning when the same manifestNumber is re-used across multiple issuances.
• Emit a warning when the remote repository presents a Manifest with an unexpected manifestNumber. Purported new manifests are expected to have a higher manifestNumber than previously validated manifests. Otherwise fall back to the previously cached manifest, if it is still valid. This warning can be indicative of manifest replays or of out-of-order publishing.
• Require RPKI object files to be of a minimum of 100 bytes in both the RRDP and RSYNC transports.
• No longer synchronize directory modtimes in the local cache to align with remote RSYNC repository sources.
• Improved CRL extension checking.
• Experimental support for the P-256 signature algorithm.
• Various refactoring work.