panda-rpki-oss/docs/conformance-matrix.md
yuyr 591bed90a8
Some checks failed
ci / rust (push) Has been cancelled
ci / docker (push) Has been cancelled
ci / audit (push) Has been cancelled
Harden first-release validation and dependency hygiene
2026-09-10 09:53:45 +08:00

3.5 KiB
Raw Permalink Blame History

v0.1.0 conformance matrix

Behaviour Standard reference Implementation Evidence
TAL syntax and TA public-key binding RFC 8630 §2 src/validation/from_tal.rs, src/model/ta.rs parser and synthetic integration tests
TA and issued CA profile/signature/resource checks RFC 6487 §4 src/validation/, src/model/ profile unit tests and synthetic integration tests
Manifest profile, file hashes, and freshness checks RFC 9286 §§4, 6 src/model/manifest.rs, src/validation/manifest.rs manifest profile and validation unit tests
CRL profile and freshness checks RFC 6487 §5 src/model/crl.rs, src/validation/ CRL profile and validation tests
ROA profile and payload checks RFC 9582 §§34 src/model/roa.rs, src/validation/ ROA profile tests and synthetic CSV assertions
ASPA profile and provider-list checks draft-ietf-sidrops-aspa-profile-21 §§24 src/model/aspa.rs, src/validation/ ASPA profile tests and synthetic VAP assertions
BGPsec router-certificate profile checks RFC 8209 §3 src/model/router_cert.rs, src/validation/ router-certificate profile tests
CMS signed-object profile RFC 6488 §§23; RFC 9589 §4 src/model/signed_object.rs signed-object profile tests
RRDP notification, snapshot, delta/replace/withdraw and fallback RFC 8182 §§3.43.5 src/repository/sync/rrdp.rs, src/repository/sync/repo.rs snapshot/delta state-restart unit tests and synthetic Docker tests
RRDP direct-reference and redirect origin checks RFC 9674 §3.2 src/repository/fetch/http.rs, src/repository/sync/rrdp.rs cross-origin unit tests
Repeated TAL/TA pairing and aggregate output RFC 8630 §2 for each TAL; aggregation is an implementation choice src/cli/mod.rs, src/cli/validate.rs, src/runtime/ CLI parser checks and multi-TAL integration evidence
Bounded repository and object workers (default 8 each, shared across TALs) operational support for the standard validation pipeline src/scheduler/, src/runtime/ worker-pool unit tests
Resumable RRDP protocol state RFC 8182 §3.4 src/repository/storage/, src/repository/sync/rrdp.rs atomic state index and restart delta test
CCR manifest, ROA, ASPA, trust-anchor and router-key states draft-ietf-sidrops-rpki-ccr-11 §§24 src/ccr/ encode/decode tests and integration artifacts
TA Constraints rule normalization and EE resource checks draft-ietf-sidrops-constraining-rpki-trust-anchors-01 §§34 src/ta_constraints.rs, src/validation/ parser/normalization tests; constrained validation E2E
VRP CSV output RFC 6810 data semantics src/cli/validate.rs, src/runtime/ self-contained Docker E2E CSV/summary assertions

References identify the implemented profiles, not a certification of complete RFC compliance. Draft revisions are intentionally explicit and are not claims of compatibility with later revisions. The CLI uses HTTPS RRDP, requires local TAL/TA pairs, and does not provide RTR or automatic TA-certificate refresh. CCR tests establish encoding and payload consistency, not independent revalidation of the entire trust chain by another relying party.

The worker pool and interval index are implementation mechanisms, not new wire protocols; their tests must also prove deterministic output and unchanged validation decisions. Only the table entries above are in v0.1.0 scope. Adding a new source file or protocol feature requires a new row with a document revision, section, test, and reviewer decision.