88 lines
3.5 KiB
Markdown
88 lines
3.5 KiB
Markdown
# Getting started
|
|
|
|
For every field, default, constraint and complete example, see the [TOML configuration reference](configuration.md)。
|
|
|
|
Panda RPKI v0.1.0 is a Linux command-line application. You can use Docker without
|
|
installing Rust, or build a native binary. It requires outbound HTTPS to RPKI
|
|
repositories, a writable state directory, and enough disk space for repository
|
|
objects and outputs. Resource use depends on the selected trust anchors.
|
|
|
|
## Prepare trust anchors
|
|
|
|
A trust anchor defines what you trust. Obtain its TAL from the responsible RIR.
|
|
Panda RPKI checks the TAL public key and either uses a configured DER certificate
|
|
or refreshes a certificate from the TAL's HTTPS/rsync URI. Automatic refresh
|
|
stores a validated last-known certificate beside the protocol state; it never
|
|
changes the TAL itself.
|
|
|
|
For example, the [RIPE NCC trust-anchor page](https://www.ripe.net/manage-ips-and-asns/resource-management/rpki/ripe-ncc-rpki-trust-anchor-structure/)
|
|
publishes the RIPE NCC TAL. From the project root:
|
|
|
|
```bash
|
|
mkdir -p input
|
|
curl --fail --location --proto '=https' --proto-redir '=https' \
|
|
--connect-timeout 15 --max-time 120 \
|
|
https://tal.rpki.ripe.net/ripe-ncc.tal -o input/anchor.tal
|
|
# Optional: download a TA certificate only for fixed mode.
|
|
curl --fail --location --proto '=https' --proto-redir '=https' \
|
|
--connect-timeout 15 --max-time 120 \
|
|
https://rpki.ripe.net/ta/ripe-ncc-ta.cer -o input/anchor.cer
|
|
```
|
|
|
|
Check the TAL's current certificate URI before downloading. The
|
|
[RIR trust-anchor directory](https://www.ripe.net/manage-ips-and-asns/resource-management/rpki/rir-trust-anchor-statistics/)
|
|
links the other regional anchors. Use their official TALs and corresponding
|
|
certificate locations when preparing a multiple-anchor deployment. Store inputs
|
|
outside version control, keep TA certificates current, and retain local policy
|
|
files alongside the appropriate TALs. For all five RIRs, use the complete
|
|
[five-RIR input guide](trust-anchors.md), including official sources, download
|
|
commands, input checks, and the filenames used by Compose.
|
|
|
|
## Docker first run
|
|
|
|
Follow the [README Quick start](../README.md#quick-start). The only application
|
|
argument is `--config`; all paths, anchors, workers and logging belong in that
|
|
TOML file. It creates `output/summary.json`, `output/vrps.csv` and
|
|
`output/result.ccr`. State is retained under `state/repository/repository-db/` and the
|
|
automatic TA cache is a sibling `state/repository.ta-cache/` directory.
|
|
|
|
## Build from source
|
|
|
|
Install Rust 1.92 or newer. On Debian/Ubuntu, native build dependencies include:
|
|
|
|
```bash
|
|
sudo apt-get update
|
|
sudo apt-get install --no-install-recommends build-essential clang libclang-dev \
|
|
pkg-config ca-certificates rsync time
|
|
cargo build --locked --release
|
|
target/release/panda-rpki --help
|
|
```
|
|
|
|
Create a configuration file (paths are relative to the file, or use absolute
|
|
container paths):
|
|
|
|
```toml
|
|
config-version = 1
|
|
mode = "validate"
|
|
out = "output/native"
|
|
rrdp-state-dir = "state"
|
|
ccr-out = "output/native/result.ccr"
|
|
|
|
[[anchors]]
|
|
id = "anchor"
|
|
tal = "input/anchor.tal"
|
|
# ta = "input/anchor.cer" # uncomment for fixed mode
|
|
```
|
|
|
|
Run with that configuration:
|
|
|
|
```bash
|
|
target/release/panda-rpki validate --config validate.toml
|
|
```
|
|
|
|
Use `validate --config validate.toml --check-config` before a run for a read-only local check, or
|
|
`validate --config validate.toml --print-config` to inspect absolute paths, defaults and field sources.
|
|
|
|
For tests, install `python3-cryptography` and `openssl`. See
|
|
[Development](development.md) and [Usage](usage.md) for next steps.
|