34 lines
3.5 KiB
Markdown
34 lines
3.5 KiB
Markdown
# v0.1.0 conformance matrix
|
||
|
||
| Behaviour | Standard reference | Implementation | Evidence |
|
||
| --- | --- | --- | --- |
|
||
| TAL syntax and TA public-key binding | RFC 8630 §2 | `src/validation/from_tal.rs`, `src/model/ta.rs` | parser and synthetic integration tests |
|
||
| TA and issued CA profile/signature/resource checks | RFC 6487 §4 | `src/validation/`, `src/model/` | profile unit tests and synthetic integration tests |
|
||
| Manifest profile, file hashes, and freshness checks | RFC 9286 §§4, 6 | `src/model/manifest.rs`, `src/validation/manifest.rs` | manifest profile and validation unit tests |
|
||
| CRL profile and freshness checks | RFC 6487 §5 | `src/model/crl.rs`, `src/validation/` | CRL profile and validation tests |
|
||
| ROA profile and payload checks | RFC 9582 §§3–4 | `src/model/roa.rs`, `src/validation/` | ROA profile tests and synthetic CSV assertions |
|
||
| ASPA profile and provider-list checks | `draft-ietf-sidrops-aspa-profile-21` §§2–4 | `src/model/aspa.rs`, `src/validation/` | ASPA profile tests and synthetic VAP assertions |
|
||
| BGPsec router-certificate profile checks | RFC 8209 §3 | `src/model/router_cert.rs`, `src/validation/` | router-certificate profile tests |
|
||
| CMS signed-object profile | RFC 6488 §§2–3; RFC 9589 §4 | `src/model/signed_object.rs` | signed-object profile tests |
|
||
| RRDP notification, snapshot, delta/replace/withdraw and fallback | RFC 8182 §§3.4–3.5 | `src/repository/sync/rrdp.rs`, `src/repository/sync/repo.rs` | snapshot/delta state-restart unit tests and synthetic Docker tests |
|
||
| RRDP direct-reference and redirect origin checks | RFC 9674 §3.2 | `src/repository/fetch/http.rs`, `src/repository/sync/rrdp.rs` | cross-origin unit tests |
|
||
| Repeated TAL/TA pairing and aggregate output | RFC 8630 §2 for each TAL; aggregation is an implementation choice | `src/cli/mod.rs`, `src/cli/validate.rs`, `src/runtime/` | CLI parser checks and multi-TAL integration evidence |
|
||
| Bounded repository and object workers (default 8 each, shared across TALs) | operational support for the standard validation pipeline | `src/scheduler/`, `src/runtime/` | worker-pool unit tests |
|
||
| Resumable RRDP protocol state | RFC 8182 §3.4 | `src/repository/storage/`, `src/repository/sync/rrdp.rs` | atomic state index and restart delta test |
|
||
| CCR manifest, ROA, ASPA, trust-anchor and router-key states | `draft-ietf-sidrops-rpki-ccr-11` §§2–4 | `src/ccr/` | encode/decode tests and integration artifacts |
|
||
| TA Constraints rule normalization and EE resource checks | `draft-ietf-sidrops-constraining-rpki-trust-anchors-01` §§3–4 | `src/ta_constraints.rs`, `src/validation/` | parser/normalization tests; constrained validation E2E |
|
||
| VRP CSV output | RFC 6810 data semantics | `src/cli/validate.rs`, `src/runtime/` | self-contained Docker E2E CSV/summary assertions |
|
||
|
||
References identify the implemented profiles, not a certification of complete
|
||
RFC compliance. Draft revisions are intentionally explicit and are not claims
|
||
of compatibility with later revisions. The CLI uses HTTPS RRDP, requires local
|
||
TAL/TA pairs, and does not provide RTR or automatic TA-certificate refresh.
|
||
CCR tests establish encoding and payload consistency, not independent
|
||
revalidation of the entire trust chain by another relying party.
|
||
|
||
The worker pool and interval index are implementation mechanisms, not new wire
|
||
protocols; their tests must also prove deterministic output and unchanged
|
||
validation decisions. Only the table entries above are in v0.1.0 scope.
|
||
Adding a new source file or protocol feature requires a new row with a document
|
||
revision, section, test, and reviewer decision.
|