3.5 KiB
v0.1.0 conformance matrix
| Behaviour | Standard reference | Implementation | Evidence |
|---|---|---|---|
| TAL syntax and TA public-key binding | RFC 8630 §2 | src/validation/from_tal.rs, src/model/ta.rs |
parser and synthetic integration tests |
| TA and issued CA profile/signature/resource checks | RFC 6487 §4 | src/validation/, src/model/ |
profile unit tests and synthetic integration tests |
| Manifest profile, file hashes, and freshness checks | RFC 9286 §§4, 6 | src/model/manifest.rs, src/validation/manifest.rs |
manifest profile and validation unit tests |
| CRL profile and freshness checks | RFC 6487 §5 | src/model/crl.rs, src/validation/ |
CRL profile and validation tests |
| ROA profile and payload checks | RFC 9582 §§3–4 | src/model/roa.rs, src/validation/ |
ROA profile tests and synthetic CSV assertions |
| ASPA profile and provider-list checks | draft-ietf-sidrops-aspa-profile-21 §§2–4 |
src/model/aspa.rs, src/validation/ |
ASPA profile tests and synthetic VAP assertions |
| BGPsec router-certificate profile checks | RFC 8209 §3 | src/model/router_cert.rs, src/validation/ |
router-certificate profile tests |
| CMS signed-object profile | RFC 6488 §§2–3; RFC 9589 §4 | src/model/signed_object.rs |
signed-object profile tests |
| RRDP notification, snapshot, delta/replace/withdraw and fallback | RFC 8182 §§3.4–3.5 | src/repository/sync/rrdp.rs, src/repository/sync/repo.rs |
snapshot/delta state-restart unit tests and synthetic Docker tests |
| RRDP direct-reference and redirect origin checks | RFC 9674 §3.2 | src/repository/fetch/http.rs, src/repository/sync/rrdp.rs |
cross-origin unit tests |
| Repeated TAL/TA pairing and aggregate output | RFC 8630 §2 for each TAL; aggregation is an implementation choice | src/cli/mod.rs, src/cli/validate.rs, src/runtime/ |
CLI parser checks and multi-TAL integration evidence |
| Bounded repository and object workers (default 8 each, shared across TALs) | operational support for the standard validation pipeline | src/scheduler/, src/runtime/ |
worker-pool unit tests |
| Resumable RRDP protocol state | RFC 8182 §3.4 | src/repository/storage/, src/repository/sync/rrdp.rs |
atomic state index and restart delta test |
| CCR manifest, ROA, ASPA, trust-anchor and router-key states | draft-ietf-sidrops-rpki-ccr-11 §§2–4 |
src/ccr/ |
encode/decode tests and integration artifacts |
| TA Constraints rule normalization and EE resource checks | draft-ietf-sidrops-constraining-rpki-trust-anchors-01 §§3–4 |
src/ta_constraints.rs, src/validation/ |
parser/normalization tests; constrained validation E2E |
| VRP CSV output | RFC 6810 data semantics | src/cli/validate.rs, src/runtime/ |
self-contained Docker E2E CSV/summary assertions |
References identify the implemented profiles, not a certification of complete RFC compliance. Draft revisions are intentionally explicit and are not claims of compatibility with later revisions. The CLI uses HTTPS RRDP, requires local TAL/TA pairs, and does not provide RTR or automatic TA-certificate refresh. CCR tests establish encoding and payload consistency, not independent revalidation of the entire trust chain by another relying party.
The worker pool and interval index are implementation mechanisms, not new wire protocols; their tests must also prove deterministic output and unchanged validation decisions. Only the table entries above are in v0.1.0 scope. Adding a new source file or protocol feature requires a new row with a document revision, section, test, and reviewer decision.