panda-rpki-oss/docs/usage.md

Usage

Examples assume panda-rpki is on PATH; for a local build use target/release/panda-rpki. Prepare TAL/TA files as described in Getting started.

Snapshot and delta

Use a fresh state directory for an explicit snapshot:

panda-rpki validate --tal input/anchor.tal --ta input/anchor.cer \
  --rrdp-state-dir state/anchor --rrdp-sync-mode snapshot \
  --out output/snapshot --ccr-out output/snapshot/result.ccr
panda-rpki validate --tal input/anchor.tal --ta input/anchor.cer \
  --rrdp-state-dir state/anchor --rrdp-sync-mode delta \
  --out output/delta-01 --ccr-out output/delta-01/result.ccr

Subsequent runs reuse state and can use auto. Delta mode can include a protocol-required snapshot or noop. Check actual operation counters in the summary. Do not discard persistent state between scheduled runs.

Multiple anchors and constraints

panda-rpki validate \
  --tal input/arin.tal --ta input/arin.cer --tal-id arin \
  --tal input/ripe.tal --ta input/ripe.cer --tal-id ripe \
  --parallel-max-repo-sync-workers-global 8 \
  --parallel-phase2-object-workers 8 \
  --rrdp-state-dir state/multi --out output/multi \
  --ccr-out output/multi/result.ccr

Add further pairs in the same way. Optional resource constraints are read from the TAL-adjacent .constraints file, or specified with --ta-constraints arin=input/arin.constraints. Rules follow the WG profile listed in the standards matrix.

A constraint file contains allow/deny followed by an IPv4/IPv6 prefix, address range, ASN or ASN range. Blank lines and # comments are allowed. For a synthetic test anchor, an example is:

# Example resources only: do not apply this policy to a production RIR.
allow 192.0.2.0/24
deny 192.0.2.128/25
allow 2001:db8::/32
allow 64496 - 64511

Deny overlap rejects an EE resource; otherwise the resource must be fully covered by allow rules of its resource family. Unlisted resources are not implicitly allowed. An empty constraint file therefore differs from having no constraint file. Overlapping rules are normalized and may produce warnings.

Continuous operation

panda-rpki daemon --state-root data/daemon \
  --interval-secs 600 --retain-runs 10 -- \
  --tal input/anchor.tal --ta input/anchor.cer \
  --log-level info --log-format json

The daemon runs in the foreground. It starts with snapshot for empty state and requests delta after successful runs. The interval starts after each cycle finishes. Add --max-runs 3 before -- for a finite run. SIGTERM requests a graceful stop. Restart with the same root to continue numbering and state.

Each cycle writes to data/daemon/runs/run_000001/, then run_000002/, etc. Retention deletes the oldest completed run directories beyond the configured limit, including their artifacts. Copy anything you need to retain elsewhere. The append-only summary history is not trimmed by retention.

Outputs and diagnostics

vrps.csv contains asn,prefix,max_length. CCR contains canonical state; duplicate routing payloads can collapse into a single CCR entry. Count raw rows and normalized unique payloads separately when comparing outputs. ASPA canonicalization groups providers by customer ASN.

Use --log-level debug for diagnosis, or trace for detailed object/worker events. Logs are written to stderr and can be redirected independently from outputs. In daemon mode, inspect per-run stderr.log and the controller's daemon-status.json and run-summary.jsonl.

Symptom	Action
TAL/TA key mismatch or expired TA	Refresh the certificate from the TAL's official URI and check the selected pair.
State-layout/schema error	Preserve the directory and select a new dedicated root for a compatible run.
Snapshot refuses existing state	Use auto/delta, or choose a fresh directory for a new snapshot.
Delta refuses empty state	Establish state with auto or snapshot.
Permission denied in Docker	Pre-create writable host directories and use your UID/GID mapping.
RRDP origin rejection	Inspect the publisher's notification/references; extra TLS roots do not bypass origin policy.
Daemon root locked	Stop the other instance normally; do not delete its lock file.
Unexpected counts or partial output	Inspect warnings and per-run status; use new output paths to avoid stale files.

See the CLI reference for precise defaults, timeouts, exit codes and recovery behavior.