mirror of
https://github.com/NLnetLabs/krill.git
synced 2026-08-17 21:25:53 +02:00
Martin HoffmannandGitHub
b2a26cd9f4
Breaking changes * Reverted the use of Roto API for the ROA analysis to downloading RISwhois route origin data and optimized the way this data is stored in memory. Removed the `bgp_api_enabled`, `bgp_api_uri`, and `bgp_api_cache_duration` fields and added `bgp_riswhois_enabled`, `bgp_riswhois_v4_uri`, `bgp_riswhois_v6_uri`, and `bgp_riswhois_refresh_duration` fields, all of which are optional. ([#1329] * Krill will now refuse to start if the config file contains unknown options. ([#1322]) New * A local `krillc` can now talk to the server via a Unix socket. In this case it will use the name of the local user for authentication purposes. By default, only the `root` user is allowed with the `admin` role, but both allowed users and what role they are mapped to can be configure. ([#1322]) * Added a `krillc parents refresh` command to allow refreshing the parents of a single CA rather than having to do a bulk refresh which can take a very long time if there are many CAs. ([#1353]) Bug fixes * Fixed an issue with the new BGP API code which false returns missing announcement info. ([#1326]) * Fixed an issue where deleting children or parents of a CA fails before a successful communication with the remote CA. ([#1331]) * Fixed an error message when trying to delete a CA which does not have any parents, children, or repositories despite actually removing the CA. ([#1331]) * Start sweeping the authenticator cache upon daemon startup. This merely reduces memory consumption of the cache. Expired authentication tokens were not used either way. ([#1337]) * Fixed a bug introduced in 0.15.0 where CAs do to not clear fulfilled certification requests causing them to re-request a certificate every time they contact their parent. ([#1345]) * Do not re-try syncing with a parent of a CA when that parent isn’t known. ([#1349]) * Fixed un-suspending child CAs: rather then re-publishing the previously revoked certificate, a new certificate is now issued. ([#1341]) Other changes * The default config files don’t serve as config documentation any more. Rather, there is now a `krill.conf.5` manual page. This manual page is also included in the Krill manual. ([#1322]) * The cryptography library used by the rustls TLS implementation has been switched to aws-lc-rs. This has some consequences for packaging: * Dropped packaging for Ubuntu 20.04 (Focal Fossa). ([#1359])
Krill
Krill is a Resource Public Key Infrastructure (RPKI) daemon, featuring a Certificate Authority (CA) and publication server, written in Rust. If you have any feedback, we would love to hear from you. Don’t hesitate to create an issue on Github or post a message on our forum.
For more information please refer to the documentation.
Public Krill Testbed Service
In case you want to try out Krill, or test new Krill releases, then you may want to use our public Krill testbed service. You can read more about this service in this blog post.