untrusted comment: verify with openbsd-77-base.pub
RWSbCCUoGpcxVVppIZGvIxDMr2/vOpmtWdYfN8lgStAuXp0gxMcUdehN9Dsr95R1hNbXw0TMgOS7HGPaVWgcEjTrbEdFJEcdCgA=

OpenBSD 7.7 errata 036, April 14, 2026:

A malicious RPKI Publication Server can cause an incorrect error exit.
A malicious RRDP Publication Server can cause a NULL dereference.

Apply by doing:
    signify -Vep /etc/signify/openbsd-77-base.pub -x 036_rpki.patch.sig \
        -m - | (cd /usr/src && patch -p0)

And then rebuild and install rpki-client:
    cd /usr/src/usr.sbin/rpki-client
    make obj
    make
    make install

Index: usr.sbin/rpki-client/http.c
===================================================================
RCS file: /cvs/src/usr.sbin/rpki-client/http.c,v
diff -u -p -r1.93 http.c
--- usr.sbin/rpki-client/http.c	11 Mar 2025 14:53:03 -0000	1.93
+++ usr.sbin/rpki-client/http.c	12 Apr 2026 20:16:51 -0000
@@ -1366,9 +1366,14 @@ http_parse_header(struct http_connection
 
 	cp = buf;
 	/* empty line, end of header */
-	if (*cp == '\0')
+	if (*cp == '\0') {
+		/* check consistency of header fields */
+		if (http_isredirect(conn) && conn->redir_uri == NULL) {
+			warnx("%s: redirect with no location", conn->req->uri);
+			return -1;
+		}
 		return 0;
-	else if (strncasecmp(cp, CONTENTLEN, sizeof(CONTENTLEN) - 1) == 0) {
+	} else if (strncasecmp(cp, CONTENTLEN, sizeof(CONTENTLEN) - 1) == 0) {
 		cp += sizeof(CONTENTLEN) - 1;
 		cp += strspn(cp, " \t");
 		conn->iosz = strtonum(cp, 0, MAX_CONTENTLEN, &errstr);
Index: usr.sbin/rpki-client/x509.c
===================================================================
RCS file: /cvs/src/usr.sbin/rpki-client/x509.c,v
diff -u -p -r1.105 x509.c
--- usr.sbin/rpki-client/x509.c	3 Dec 2024 14:51:09 -0000	1.105
+++ usr.sbin/rpki-client/x509.c	12 Apr 2026 20:16:51 -0000
@@ -916,8 +916,8 @@ x509_get_time(const ASN1_TIME *at, time_
 		return 0;
 	if (!ASN1_TIME_to_tm(at, &tm))
 		return 0;
-	if ((*t = timegm(&tm)) == -1)
-		errx(1, "timegm failed");
+	if ((*t = timegm(&tm)) < 0)
+		return 0;
 	return 1;
 }
 
