Merge branch 'internetstandards:main' into main

Author: apio-sys

bin/pofiles.py

@@ -269,7 +269,7 @@ def read_tar(args):
                 for potential_target_filename, target_msgids in KNOWN_PO_FILES:
                     for target_msgid in target_msgids:
                         if po_entry.msgid.startswith(target_msgid):
-                            target_filename = filename
+                            target_filename = potential_target_filename
 
                 print(f"Adding to {target_filename} locale {locale} entry: {po_entry.msgid}")
                 read_po_files[locale][target_filename].append(po_entry)

translations/en/main.po

@@ -9,7 +9,7 @@ msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
 "POT-Creation-Date: 2015-02-16 23:27+0100\n"
-"PO-Revision-Date: 2025-05-27 12:27:29.821689\n"
+"PO-Revision-Date: 2025-05-27 14:55:39.942551\n"
 "Last-Translator: \n"
 "Language-Team: \n"
 "Language: \n"
@@ -914,13 +914,13 @@ msgstr ""
 
 msgid "detail mail rpki exists exp"
 msgstr ""
-"We check if an RPKI Route Origin Authorization (ROA) has been published for all IP addresses of your mail server(s) (MX).\n"
+"We check if an RPKI Route Origin Authorisation (ROA) has been published for all IP addresses of your mail server(s) (MX).\n"
 "\n"
 "Your hoster (or its network provider) announces through the Border Gateway Protocol (BGP) for which of its IP address blocks it accepts incoming Internet traffic. Other network providers use these route announcements to determine via which route to send traffic for your server's IP addresses.\n"
 "\n"
 "However, a route announcement can be faked. In fact, another network provider may be able to connect the IP address block of your IP address to its network and thus potentially receive Internet traffic that is actually intended for your network provider. The cause may be accidental or malicious. In either case, this can result in your server becoming unreachable or in Internet traffic to your server being intercepted.\n"
 "\n"
-"Resource Public Key Infrastructure (RPKI) significantly improves protection against this. With RPKI, the rightful holder of a block of IP addresses can publish a digitally signed statement with route authorization (Route Origin Authorisation; ROA for short). Another network provider that wants to send Internet traffic to a particular IP address, can use the corresponding statement to filter out `Invalid` routes. In this way, the network provider prevents Internet traffic from its network from being sent to unauthorized provider networks."
+"Resource Public Key Infrastructure (RPKI) significantly improves protection against this. With RPKI, the rightful holder of a block of IP addresses can publish a digitally signed statement with route authorisation (Route Origin Authorisation; ROA for short). Another network provider that wants to send Internet traffic to a particular IP address, can use the corresponding statement to filter out `Invalid` routes. In this way, the network provider prevents Internet traffic from its network from being sent to unauthorized provider networks."
 
 msgid "detail mail rpki exists label"
 msgstr "Route Origin Authorisation existence"
@@ -945,13 +945,13 @@ msgstr ""
 
 msgid "detail mail rpki mx-ns-exists exp"
 msgstr ""
-"We check if an RPKI Route Origin Authorization (ROA) has been published for all IP addresses of the name servers of your mail server(s) (MX).\n"
+"We check if an RPKI Route Origin Authorisation (ROA) has been published for all IP addresses of the name servers of your mail server(s) (MX).\n"
 "\n"
 "Your hoster (or its network provider) announces through the Border Gateway Protocol (BGP) for which of its IP address blocks it accepts incoming Internet traffic. Other network providers use these route announcements to determine via which route to send traffic for your server's IP addresses.\n"
 "\n"
 "However, a route announcement can be faked. In fact, another network provider may be able to connect the IP address block of your IP address to its network and thus potentially receive Internet traffic that is actually intended for your network provider. The cause may be accidental or malicious. In either case, this can result in your server becoming unreachable or in Internet traffic to your server being intercepted.\n"
 "\n"
-"Resource Public Key Infrastructure (RPKI) significantly improves protection against this. With RPKI, the rightful holder of a block of IP addresses can publish a digitally signed statement with route authorization (Route Origin Authorisation; ROA for short). Another network provider that wants to send Internet traffic to a particular IP address, can use the corresponding statement to filter out `Invalid` routes. In this way, the network provider prevents Internet traffic from its network from being sent to unauthorized provider networks."
+"Resource Public Key Infrastructure (RPKI) significantly improves protection against this. With RPKI, the rightful holder of a block of IP addresses can publish a digitally signed statement with route authorisation (Route Origin Authorisation; ROA for short). Another network provider that wants to send Internet traffic to a particular IP address, can use the corresponding statement to filter out `Invalid` routes. In this way, the network provider prevents Internet traffic from its network from being sent to unauthorized provider networks."
 
 msgid "detail mail rpki mx-ns-exists label"
 msgstr "Route Origin Authorisation existence"
@@ -1117,10 +1117,10 @@ msgstr ""
 "The domain were the applicable CAA records are found is shown in the table with technical details below.\n"
 "\n"
 "The verdict is good if one or more CAA records were found that all have correct syntax, and at least one of these CAA records has the `issue` tag.\n"
-"In all other cases, the test will result in a fail.\n"
+"Otherwise, the test will result in a fail.\n"
 "It is not checked whether the certificate authority of the current TLS certificate matches one or more of the `issue` and `issuewild` values, i.e., whether the current certificate could be reissued at this time.\n"
 "\n"
-"If your are using the Automatic Certificate Management Environment (ACME) standard and your certificate authority supports it, we recommend you to use the parameters `validationmethods` and `accounturi` to further restrict isssuance by the authorised certificate authority. Furthermore, it is recommended to add `issuemail` and `issuevmc` with an empty `;` if you do not use certificates for S/MIME and/or BIMI respectively. Otherwise, any certificate authority is still allowed to issue these certificates for your domain, since `issue` does not cover them.\n"
+"If your are using the Automatic Certificate Management Environment (ACME) standard and your certificate authority supports it, we recommend you to use the parameters `validationmethods` and `accounturi` to further restrict isssuance by the authorised certificate authority. Furthermore, it is recommended to add `issuewild`, `issuemail` and `issuevmc` with an empty `;` if you do not use wildcard, S/MIME and/or BIMI certificates respectively. Otherwise, any certificate authority is still allowed to issue these certificates for your domain, since `issue` does not cover them.\n"
 "\n"
 "We expect URLs in `iodef` to be secure (i.e. use HTTPS scheme).\n"
 "Furthermore, to prevent suppression or spoofing of CAA records we strongly recommend you to use DNSSEC, although this CAA test does not specifically test for DNSSEC.\n"
@@ -2034,7 +2034,7 @@ msgstr ""
 
 msgid "detail tech data http-csp missing-invalid-frame-src"
 msgstr ""
-"Recommendation: 'frame-src' (or child-src' or 'default-src' as fallback) "
+"Recommendation: 'frame-src' (or 'child-src' or 'default-src' as fallback) "
 "with sufficiently secure value should be defined (#3)."
 
 msgid "detail tech data http-csp no-policy-found"
@@ -2678,13 +2678,13 @@ msgstr "All your web servers with an IPv6 address are reachable over IPv6."
 
 msgid "detail web rpki exists exp"
 msgstr ""
-"We check if an RPKI Route Origin Authorization (ROA) has been published for all IP addresses of your web server.\n"
+"We check if an RPKI Route Origin Authorisation (ROA) has been published for all IP addresses of your web server.\n"
 "\n"
 "Your hoster (or its network provider) announces through the Border Gateway Protocol (BGP) for which of its IP address blocks it accepts incoming Internet traffic. Other network providers use these route announcements to determine via which route to send traffic for your server's IP addresses.\n"
 "\n"
 "However, a route announcement can be faked. In fact, another network provider may be able to connect the IP address block of your IP address to its network and thus potentially receive Internet traffic that is actually intended for your network provider. The cause may be accidental or malicious. In either case, this can result in your server becoming unreachable or in Internet traffic to your server being intercepted.\n"
 "\n"
-"Resource Public Key Infrastructure (RPKI) significantly improves protection against this. With RPKI, the rightful holder of a block of IP addresses can publish a digitally signed statement with route authorization (Route Origin Authorisation; ROA for short). Another network provider that wants to send Internet traffic to a particular IP address, can use the corresponding statement to filter out `Invalid` routes. In this way, the network provider prevents Internet traffic from its network from being sent to unauthorized provider networks."
+"Resource Public Key Infrastructure (RPKI) significantly improves protection against this. With RPKI, the rightful holder of a block of IP addresses can publish a digitally signed statement with route authorisation (Route Origin Authorisation; ROA for short). Another network provider that wants to send Internet traffic to a particular IP address, can use the corresponding statement to filter out `Invalid` routes. In this way, the network provider prevents Internet traffic from its network from being sent to unauthorized provider networks."
 
 msgid "detail web rpki exists label"
 msgstr "Route Origin Authorisation existence"
@@ -2784,9 +2784,9 @@ msgstr ""
 "The domain were the applicable CAA records are found is shown in the table with technical details below.\n"
 "\n"
 "The verdict is good if one or more CAA records were found that all have correct syntax, and at least one of these CAA records has the `issue` tag with a valid value.\n"
-"In all other cases, the test will result in a fail. It is not checked whether the certificate authority of the current certificate matches one or more of the `issue` and `issuewild` values, i.e., whether the current certificate could be reissued at this time.\n"
+"Otherwise, the test will result in a fail. It is not checked whether the certificate authority of the current certificate matches one or more of the `issue` and `issuewild` values, i.e., whether the current certificate could be reissued at this time.\n"
 "\n"
-"If your are using the Automatic Certificate Management Environment (ACME) standard and your certificate authority supports it, we recommend you to use the parameters `validationmethods` and `accounturi` to further restrict isssuance by the authorised certificate authority. Furthermore, it is recommended to add `issuemail` and `issuevmc` with an empty `;` if you do not use certificates for S/MIME and/or BIMI respectively. Otherwise, any certificate authority is still allowed to issue these certificates for your domain, since `issue` does not cover them.\n"
+"If your are using the Automatic Certificate Management Environment (ACME) standard and your certificate authority supports it, we recommend you to use the parameters `validationmethods` and `accounturi` to further restrict isssuance by the authorised certificate authority. Furthermore, it is recommended to add `issuewild`, `issuemail` and `issuevmc` with an empty `;` if you do not use wildcard, S/MIME and/or BIMI certificates respectively. Otherwise, any certificate authority is still allowed to issue these certificates for your domain, since `issue` does not cover them.\n"
 "\n"
 "We expect URLs in `iodef` to be secure (i.e. use HTTPS scheme). \n"
 "Furthermore, to prevent suppression or spoofing of CAA records we strongly recommend you to use DNSSEC, although this CAA test does not specifically test for DNSSEC.\n"

translations/en/news.po

@@ -4,6 +4,7 @@ msgstr ""
 
 msgid "article .index"
 msgstr ""
+"release-1.10\n"
 "release-1.9\n"
 "release-1.8\n"
 "release-1.7\n"
@@ -681,6 +682,84 @@ msgstr ""
 msgid "article open-source-release title"
 msgstr "Open source release Internet.nl including 'security headers'"
 
+msgid "article release-1.10 body"
+msgstr ""
+"## What is CAA?\n"
+"Certification Authority Authorisation (CAA) allows you as a DNS domain name holder to specify one or more certification authorities authorised to issue certificates for your  domain name. A certificate authority must not issue a certificate unless the certificate authority determines that the certificate request is consistent with the applicable CAA records.\n"
+"\n"
+"## Why is CAA important?\n"
+"For the secure connection to your website or mail server, its certificate is crucial. If a malicious party is able to obtain a certificate for your domain name, it may be able to intercept sensitive data. By limiting the number of authorized certificate authorities, you reduce the risk of mis-issuance.\n"
+"\n"
+"## What does the CAA test in Internet.nl check for?\n"
+"Internet.nl checks if the name servers of your tested domain or the domains of its mail servers (MX) contain one or more CAA records, that are all have correct syntax. At least one of these CAA records must have the `issue` tag. Otherwise, the test will result in a fail. It is not checked whether the certificate authority of the current TLS certificate matches one or more of the `issue` and `issuewild` values, i.e., whether the current certificate could be reissued at this time. Note that the result of the test currently does not weigh into the score.\n"
+"\n"
+"If your are using the Automatic Certificate Management Environment (ACME) standard and your certificate authority supports it, we recommend you to use the parameters `validationmethods` and `accounturi` to further restrict isssuance by the authorised certificate authority. Furthermore, it is recommended to add `issuewild`, `issuemail` and `issuevmc` with an empty `;` if you do not use wildcard, S/MIME and/or BIMI certificates respectively. Otherwise, any certificate authority is still allowed to issue these certificates for your domain, since `issue` does not cover them.\n"
+"\n"
+"## Upcoming release: new TLS guidelines\n"
+"NCSC-NL recently published a new version of its TLS guidelines. The upcoming release of Internet.nl will use these updated guidelines as the baseline for the TLS test. We expect this new version of Internet.nl to go live around September/October 2025. \n"
+"\n"
+"## About Internet.nl\n"
+"The test tool [Internet.nl](https://internet.nl) is an initiative of the Dutch Internet Standards Platform which is a collaboration of partners from the Internet community and the Dutch government. The aim of the platform is to jointly increase the use of modern Internet standards to make the Internet more accessible, safer and more reliable for everyone. The software code of Internet.nl is available under an open source license. \n"
+"\n"
+"---\n"
+"\n"
+"## Release notes 1.10.0\n"
+"\n"
+"### Feature changes\n"
+"\n"
+"- A test for CAA records was added for web and mail tests. This checks for the presence of one or more correctly\n"
+"  formatted CAA records, of which one must have an `issue` tag. This test is not required, i.e. does not affect scoring.\n"
+"- The [sectxt](https://github.com/DigitalTrustCenter/sectxt) library, used for validating security.txt files, was updated from 0.9.4 to 0.9.7.\n"
+"  This includes:\n"
+"  - A new error if a PGP signed message ends with more than one newline, named `too_many_line_separators` ([sectxt/#78](https://github.com/DigitalTrustCenter/sectxt/issues/78)).\n"
+"  - Improved detection of repeated use of fields that must only occur once. Previously, these were not always detected ([sectxt/#83](https://github.com/DigitalTrustCenter/sectxt/issues/83)).\n"
+"  - Fixed an issue with checking signatures made with AEAD keys ([sectxt/#79](https://github.com/DigitalTrustCenter/sectxt/issues/79)).\n"
+"  - Fixed exception [for certain malformed PGP signatures](https://github.com/DigitalTrustCenter/sectxt/issues/85).\n"
+"- The test date and time are now [included in the print CSS](https://github.com/internetstandards/Internet.nl/pull/1735).\n"
+"\n"
+"### Significant internal changes\n"
+"\n"
+"- The test code no longer interfaces with libunbound, but \n"
+" [uses dnspython as a stub resolver](https://github.com/internetstandards/Internet.nl/pull/1578).\n"
+"- Periodic tests [are no longer enabled by default](https://github.com/internetstandards/Internet.nl/pull/1628).\n"
+"- UWSGI [cheaper](https://uwsgi-docs.readthedocs.io/en/latest/Cheaper.html) options are used to reduce idle processes and reduce memory consumption.\n"
+"\n"
+"### Possibly required changes to deployments\n"
+"\n"
+"- The `resolver-permissive` container was obsoleted and removed.\n"
+"- Periodic tests will only run when [specifically enabled](https://github.com/internetstandards/Internet.nl/blob/main/documentation/Docker-deployment.md#periodic-tests)\n"
+"  with the CRON_15MIN_RUN_TESTS, TEST_DOMAINS_SITE and/or TEST_DOMAINS_MAIL settings.\n"
+"- There is now support for running multiple instances per server, sharing a Routinator instance,\n"
+"  intended for acceptance testing.\n"
+"\n"
+"On upgrade from an earlier version, a\n"
+"[change in networking setup](https://github.com/internetstandards/Internet.nl/pull/1688) requires\n"
+"recreation of one of the Docker networks. Before deploy, bring down the entire environment and make sure the network is removed:\n"
+"```\n"
+"docker compose --project-name=internetnl-prod down\n"
+"docker network rm internetnl-prod_public-internet\n"
+"```\n"
+"\n"
+"### API changes\n"
+"\n"
+"- The API version was updated to version 2.5.0.\n"
+"- The fields `caa_enabled`, `caa_errors`, `caa_recommendations`, `caa_records`, and `caa_found_on_domain` have been added\n"
+"  ([OpenAPI diff](https://github.com/internetstandards/Internet.nl/commit/cdc642c97f3ef00b4ef8ec7ff6ea4c5403c80978#diff-ccabca18cd3cc1ba3dd325e532acccf5d37c7be317a2966209b6e55b968d4890)).\n"
+"- The API report URL was [updated to use HTTPS](https://github.com/internetstandards/Internet.nl/issues/1704)."
+
+msgid "article release-1.10 date"
+msgstr "June 2, 2025"
+
+msgid "article release-1.10 lead"
+msgstr ""
+"As of today, Internet.nl makes it possible to test your domains for "
+"Certification Authority Authorization (CAA). The new CAA subtest is part of "
+"both the website and the mail test. Currently the subtest does not impact "
+"score."
+
+msgid "article release-1.10 title"
+msgstr "Internet.nl adds CAA test and announces TLS test changes"
+
 msgid "article release-1.7 body"
 msgstr ""
 "## Improved CSP test\n"