2.5 KiB
Manifest failed-fetch recovery
After a publication point passes validation, Panda keeps its direct VRPs, ASPAs, router keys, child CA references, audit information and CCR contribution in the state database. If a later fetch fails, it warns and uses that previously validated result while it remains usable, following RFC 9286 section 6.6. This is automatic and independent of whether CCR output is enabled.
Results belong to a CA public key within its TAL namespace. Reuse additionally requires the same CA certificate, publication locations, effective resources, validation policy and TA resource constraints. A different certificate or policy requires a fresh successful validation before a result can be reused.
The cache ends at the earliest relevant deadline: manifest nextUpdate, CRL nextUpdate, CA/manifest EE validity, or validity of an accepted payload or child certificate. Panda uses a conservative deadline for the whole instance. At the boundary it stops reusing the result; repeated failures never extend this time. A validation time preceding the cached validation time also prevents reuse.
When an instance fails, its cached descendants use cached results only: they do not request another repository sync or validate newly downloaded objects. A missing, expired or mismatched descendant cache stops that branch. Normal tree limits still apply. Successful fresh parents can delete or revoke child CAs; those children are not restored from an earlier cache. A successful empty result supersedes the previous payloads.
The manifest anti-rollback history and result cache commit atomically. Reuse never advances that history. Cache corruption, an inconsistent history, or a storage/issuer failure cannot authorize reuse. Transport state is separate from validated results, so a mutable repository view cannot silently replace cached payloads or cached child certificates.
A cache hit preserves the fetch failure. summary.json includes
failed_fetch_cached, and the result remains partial with exit 3 when
require-complete is enabled. Publication to publish-dir/latest still requires
a complete success. Structured logs use failed_fetch_cache_reused with the
original verification time and effective deadline; publication-point audits use
failed_fetch_cached and terminal state failed_cached.
Keep the state database between invocations or daemon cycles to retain these results. This does not require serializing RRDP objects to a filesystem mirror, and does not change the current RRDP/rsync storage architecture.