# Panda RPKI

Panda RPKI is an RPKI relying party written in Rust. It synchronizes repositories
over RRDP, validates signed objects, and exports routing data as CSV and Canonical
Cache Representation (CCR). Run a single cycle or use the daemon for continuous operation.

Configuration is provided through TOML. See the [TOML configuration reference](docs/configuration.md)
for every field, default, constraint and complete example.

This build is validated on Linux x86-64. Other platforms are not yet verified.
Review the [standards and limitations](docs/conformance-matrix.md) and [security
policy](SECURITY.md) before evaluating it for routing use.

## Quick start

Requirements: Linux and Docker. This repository includes a pinned AFRINIC TAL and
its constraints under `tals/`, so no TAL download or `input/` setup is needed for
this first run. A matching DER trust-anchor certificate may be supplied in the
TOML, or Panda can refresh it from the TAL's URI. From the project root:

```bash
docker build -f docker/Dockerfile -t panda-rpki:local .
mkdir -p state output
cat > validate.toml <<'TOML'
config-version = 1
mode = "validate"
out = "/output"
rrdp-state-dir = "/state/repository"
ccr-out = "/output/result.ccr"

[[anchors]]
id = "afrinic"
tal = "/input/afrinic.tal"
constraints = "/input/afrinic.constraints"
# ta = "/input/afrinic.cer" # uncomment for fixed TA mode
TOML
docker run --rm --read-only --tmpfs /tmp \
  --user "$(id -u):$(id -g)" \
  -v "$PWD/tals:/input:ro" \
  -v "$PWD/state:/state" \
  -v "$PWD/output:/output" \
  -v "$PWD/validate.toml:/config/validate.toml:ro" \
  panda-rpki:local validate --config /config/validate.toml
```

The quick start refreshes the TA certificate automatically; TAL files themselves
remain operator-maintained. For complete single/all-five and daemon TOML files,
see [Compose examples](docker/examples/README.md). The two all-five examples
use the vendored [OpenBSD TALs and constraints](tals/README.md) with resource
constraints enabled. Edit the copied policy files or set top-level
`ta-constraints-enabled = false` to disable them.

Inspect `output/summary.json` and `output/vrps.csv`. Logs go to stderr.
Reuse the state directory to allow delta updates on subsequent runs.
For continuous operation see [Usage](docs/usage.md#continuous-operation).

## Features

- Multiple named anchors, fixed or automatically refreshed trust anchors, and
  optional per-anchor resource constraints.
- RRDP snapshot, delta, replace/withdraw and protocol fallback.
- HTTPS same-origin checks for RRDP references and redirects.
- Independent bounded repository and object worker pools.
- CA, CRL, manifest, ROA, ASPA and BGPsec router-certificate processing.
- CSV, CCR, JSON summaries and configurable text or JSON logs from TOML.
- Daemon intervals, persistent state, run retention, timeouts and graceful stop.

The CLI accepts HTTPS RRDP. Operators supply explicit TALs; automatic TA refresh
follows each TAL's HTTPS or rsync URI. No RTR server is included. See the
[standards matrix](docs/conformance-matrix.md) for profiles and limitations.

## Documentation

- [Getting started](docs/getting-started.md): dependencies, inputs and first run.
- [Five-RIR trust anchors](docs/trust-anchors.md): official TAL/TA downloads and checks.
- [Usage](docs/usage.md): multiple anchors, delta, daemon and troubleshooting.
- [Command-line reference](docs/command-line-reference.md): options and defaults.
- [Docker and Compose](docs/docker.md): single-anchor, all-five and daemon deployments.
- [Development and testing](docs/development.md).
- [Contributing](CONTRIBUTING.md) and [changelog](CHANGELOG.md).
- [Release checklist](docs/releasing.md).

## Build from source

Install Rust 1.92 or newer and the [native dependencies](docs/getting-started.md#build-from-source):

```bash
cargo build --locked --release
target/release/panda-rpki --help
```

## License

Panda RPKI uses the [BSD-3-Clause license](LICENSE).
See [third-party notices](THIRD_PARTY_NOTICES.md) for dependency attribution.