panda-rpki-oss/docs/conformance-matrix.md
yuyr 591bed90a8
Some checks failed
ci / rust (push) Has been cancelled
ci / docker (push) Has been cancelled
ci / audit (push) Has been cancelled
Harden first-release validation and dependency hygiene
2026-09-10 09:53:45 +08:00

34 lines
3.5 KiB
Markdown
Raw Permalink Blame History

This file contains ambiguous Unicode characters

This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

# v0.1.0 conformance matrix
| Behaviour | Standard reference | Implementation | Evidence |
| --- | --- | --- | --- |
| TAL syntax and TA public-key binding | RFC 8630 §2 | `src/validation/from_tal.rs`, `src/model/ta.rs` | parser and synthetic integration tests |
| TA and issued CA profile/signature/resource checks | RFC 6487 §4 | `src/validation/`, `src/model/` | profile unit tests and synthetic integration tests |
| Manifest profile, file hashes, and freshness checks | RFC 9286 §§4, 6 | `src/model/manifest.rs`, `src/validation/manifest.rs` | manifest profile and validation unit tests |
| CRL profile and freshness checks | RFC 6487 §5 | `src/model/crl.rs`, `src/validation/` | CRL profile and validation tests |
| ROA profile and payload checks | RFC 9582 §§34 | `src/model/roa.rs`, `src/validation/` | ROA profile tests and synthetic CSV assertions |
| ASPA profile and provider-list checks | `draft-ietf-sidrops-aspa-profile-21` §§24 | `src/model/aspa.rs`, `src/validation/` | ASPA profile tests and synthetic VAP assertions |
| BGPsec router-certificate profile checks | RFC 8209 §3 | `src/model/router_cert.rs`, `src/validation/` | router-certificate profile tests |
| CMS signed-object profile | RFC 6488 §§23; RFC 9589 §4 | `src/model/signed_object.rs` | signed-object profile tests |
| RRDP notification, snapshot, delta/replace/withdraw and fallback | RFC 8182 §§3.43.5 | `src/repository/sync/rrdp.rs`, `src/repository/sync/repo.rs` | snapshot/delta state-restart unit tests and synthetic Docker tests |
| RRDP direct-reference and redirect origin checks | RFC 9674 §3.2 | `src/repository/fetch/http.rs`, `src/repository/sync/rrdp.rs` | cross-origin unit tests |
| Repeated TAL/TA pairing and aggregate output | RFC 8630 §2 for each TAL; aggregation is an implementation choice | `src/cli/mod.rs`, `src/cli/validate.rs`, `src/runtime/` | CLI parser checks and multi-TAL integration evidence |
| Bounded repository and object workers (default 8 each, shared across TALs) | operational support for the standard validation pipeline | `src/scheduler/`, `src/runtime/` | worker-pool unit tests |
| Resumable RRDP protocol state | RFC 8182 §3.4 | `src/repository/storage/`, `src/repository/sync/rrdp.rs` | atomic state index and restart delta test |
| CCR manifest, ROA, ASPA, trust-anchor and router-key states | `draft-ietf-sidrops-rpki-ccr-11` §§24 | `src/ccr/` | encode/decode tests and integration artifacts |
| TA Constraints rule normalization and EE resource checks | `draft-ietf-sidrops-constraining-rpki-trust-anchors-01` §§34 | `src/ta_constraints.rs`, `src/validation/` | parser/normalization tests; constrained validation E2E |
| VRP CSV output | RFC 6810 data semantics | `src/cli/validate.rs`, `src/runtime/` | self-contained Docker E2E CSV/summary assertions |
References identify the implemented profiles, not a certification of complete
RFC compliance. Draft revisions are intentionally explicit and are not claims
of compatibility with later revisions. The CLI uses HTTPS RRDP, requires local
TAL/TA pairs, and does not provide RTR or automatic TA-certificate refresh.
CCR tests establish encoding and payload consistency, not independent
revalidation of the entire trust chain by another relying party.
The worker pool and interval index are implementation mechanisms, not new wire
protocols; their tests must also prove deterministic output and unchanged
validation decisions. Only the table entries above are in v0.1.0 scope.
Adding a new source file or protocol feature requires a new row with a document
revision, section, test, and reviewer decision.