# Panda RPKI

Panda RPKI is an RPKI relying party written in Rust. It synchronizes repositories
over RRDP, validates signed objects, and exports routing data as CSV and Canonical
Cache Representation (CCR). Run a single cycle or use the daemon for continuous operation.

Version 0.1.0 is an unreleased candidate, validated on Linux x86-64. Other
platforms are not yet verified. Review the [standards and limitations](docs/conformance-matrix.md)
and [security policy](SECURITY.md) before evaluating it for routing use.

## Quick start

Requirements: Linux, Docker, and a TAL with its matching DER trust-anchor
certificate. Follow [input preparation](docs/getting-started.md#prepare-trust-anchors)
to obtain these from your chosen RIR. From the project root, after placing them
in `input/anchor.tal` and `input/anchor.cer`:

```bash
docker build -f docker/Dockerfile -t panda-rpki:v0.1.0 .
mkdir -p state output
docker run --rm --read-only --tmpfs /tmp \
  --user "$(id -u):$(id -g)" \
  -v "$PWD/input:/input:ro" \
  -v "$PWD/state:/state" \
  -v "$PWD/output:/output" \
  panda-rpki:v0.1.0 validate \
    --tal /input/anchor.tal --ta /input/anchor.cer \
    --rrdp-state-dir /state --out /output \
    --ccr-out /output/result.ccr
```

Inspect `output/summary.json` and `output/vrps.csv`. Logs go to stderr.
Reuse the state directory to allow delta updates on subsequent runs.
For continuous operation see [Usage](docs/usage.md#continuous-operation).

## Features

- Multiple TAL/TA pairs and optional per-anchor resource constraints.
- RRDP snapshot, delta, replace/withdraw and protocol fallback.
- HTTPS same-origin checks for RRDP references and redirects.
- Independent bounded repository and object worker pools.
- CA, CRL, manifest, ROA, ASPA and BGPsec router-certificate processing.
- CSV, CCR, JSON summaries and configurable text or JSON logs.
- Daemon intervals, persistent state, run retention, timeouts and graceful stop.

Version 0.1.0 accepts HTTPS RRDP through its CLI. Operators supply TALs and
matching TA certificates. No RTR server is included. See the
[standards matrix](docs/conformance-matrix.md) for profiles and limitations.

## Documentation

- [Getting started](docs/getting-started.md): dependencies, inputs and first run.
- [Five-RIR trust anchors](docs/trust-anchors.md): official TAL/TA downloads and checks.
- [Usage](docs/usage.md): multiple anchors, delta, daemon and troubleshooting.
- [Command-line reference](docs/command-line-reference.md): options and defaults.
- [Docker and Compose](docs/docker.md): single-anchor, all-five and daemon deployments.
- [Development and testing](docs/development.md).
- [Contributing](CONTRIBUTING.md) and [changelog](CHANGELOG.md).
- [Release checklist](docs/releasing.md).

## Build from source

Install Rust 1.92 or newer and the [native dependencies](docs/getting-started.md#build-from-source):

```bash
cargo build --locked --release
target/release/panda-rpki --help
```

## License

Panda RPKI uses the [BSD-3-Clause license](LICENSE).
See [third-party notices](THIRD_PARTY_NOTICES.md) for dependency attribution.