Differences

This shows you the differences between two versions of the page.

--- hints:rpki [2026/07/09 18:11] – [FORT] philip
+++ hints:rpki [2026/07/20 14:54] (current) – [RPKI-client] philip
@@ Line 32: / Line 32: @@
 ===== NLnetLabs Routinator =====
-Nothing to say here, the instructions just work, the validator installs sweetly, and just runs. As long as the instructions are followed. The current version of Routinator is 0.15.1, at time of writing.
+Nothing to say here, the instructions just work, the validator installs sweetly, and just runs. As long as the instructions are followed. The current version of Routinator is 0.15.2, at time of writing.
 If using Debian/Ubuntu as I do, then just use the supplied package and your favourite package manager. The instructions for how to install are in NLnetLabs excellent [[https://routinator.docs.nlnetlabs.nl/en/stable/installation.html| documentation]].
@@ Line 167: / Line 167: @@
 **rpki-client** is just a validator - it does not have the functionality to accept connections from a router. We'll come to that later on (we'll need to use [[rpki#stayrtr|StayRTR]], which is a fork of Cloudflare's now unmaintained GoRTR).
-**rpki-client** has now been packaged and is available across most mainstream Linux/Unix-based platforms. Including as part of the Ubuntu 22.04 and later distributions. However, the packaged version in Ubuntu is old (version 7.6 on 22.04, 9.0 on 24.04). At the time of writing, the current release of **rpki-client** is version 9.7. There is a version of **rpki-client** on the Ubuntu Snap Store, but it is unclear which version of **rpki-client** this is.
+**rpki-client** has now been packaged and is available across most mainstream Linux/Unix-based platforms. Including as part of the Ubuntu 22.04 and later distributions. However, the packaged version in Ubuntu is old (version 7.6 on 22.04, 9.0 on 24.04). At the time of writing, the current release of **rpki-client** is version 9.8. There is a current version of **rpki-client** on the Ubuntu Snap Store, but not every sysadm wishes to use yet another package manager on Ubuntu.
-So to stay up to date on Ubuntu, we have to build it ourselves. A pity that the **rpki-client** maintainers don't build their own deb package, or pre-build packages like NLnetLabs do with Routinator, given that Ubuntu maintainers seem to be unable to keep the software current. Oh well.
+My preference is to stay up to date on Ubuntu, and so we have to build it ourselves. A pity that the **rpki-client** maintainers don't build their own deb package, or pre-build packages like NLnetLabs do with Routinator, given that Ubuntu maintainers seem to be unable to keep the software current. Oh well.
@@ Line 175: / Line 175: @@
 ==== Initial Preparation ====
-Before you attempt to download and build it, the **rpki-client** instructions note that you need a few other packages in place. These include **automake**, **autoconf**, **make**, **git** itself, **libtool** and **expat**. This is all quite easy using the Ubuntu package manager.
+Before you attempt to download and build it, the **rpki-client** instructions note that you need a few other packages in place. These include **automake**, **autoconf**, **make**, **git** itself, **libtool**, **expat**, **libssl-dev**, **libtls-dev**, **rsync** and **zlib1g-dev**. This is all quite easy using the Ubuntu package manager (and some of these packages may already be installed by default).
 <code>
-sudo apt install automake autoconf make git libtool libexpat1-dev
+sudo apt install automake autoconf make git libtool libexpat1-dev libssl-dev libtls-dev zlib1g-dev
-</code>
-The other required package noted in the instructions is **tls** from LibreSSL. LibreSSL is a branch of OpenSSL and is used on OpenBSD - not found on Linux, but seems to be appearing in the latest Debian/Ubuntu beta builds. So we need to download the bits we need and install. The **rpki-client** instructions don't say anything about how to do that.
-First we go to [[https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/|https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/]] and select the latest package, which is libressl-4.3.2.tar.gz at time of writing
-<code>
-wget https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-4.3.2.tar.gz
-</code>
-We then unpack it:
-<code>
-tar zxf libressl-4.3.2.tar.gz
-</code>
-and then build it:
-<code>
-cd libressl-4.3.2
-./configure --enable-libtls-only
-make
-sudo make install
-</code>
-Note the option to only build **libtls** - we don't need the rest of LibreSSL and it could well interfere with OpenSSL which will already be on the system. Now that **libtls** is built, the **install** action will put the libraries in **/usr/local/lib** like this:
-<code>
--rw-r--r-- 1 root root 18854748 Jul 10 04:03 libtls.a
--rw-r--r-- 1 root root      923 Jul 10 04:03 libtls.la
-lrwxrwxrwx 1 root root       16 Jul 10 04:03 libtls.so -> libtls.so.33.0.2
-lrwxrwxrwx 1 root root       16 Jul 10 04:03 libtls.so.33 -> libtls.so.33.0.2
--rw-r--r-- 1 root root  8843992 Jul 10 04:03 libtls.so.33.0.2
-</code>
-Run **sudo ldconfig** so that the system knows about the new libraries.
-Next we need to get some packages that **rpki-client** needs. These are **libssl-dev**, **rsync** and **zlib1g-dev**.
-<code>
-sudo apt install libssl-dev rsync zlib1g-dev
 </code>
@@ Line 233: / Line 202: @@
 <code>
 sudo groupadd _rpki-client
-sudo useradd –g _rpki-client –s /sbin/nologin –d /nonexistent –c "rpki-client user" _rpki-client
+sudo useradd -g _rpki-client -s /sbin/nologin -d /nonexistent -c "rpki-client user" _rpki-client
 </code>
 Now we can install RPKI-client: