panda-rpki-oss/README.md

Panda RPKI

Panda RPKI is an RPKI relying party written in Rust. It synchronizes repositories over RRDP, validates signed objects, and exports routing data as CSV and Canonical Cache Representation (CCR). Run a single cycle or use the daemon for continuous operation.

Quick start

Requirements: Linux, Docker, and a TAL with its matching DER trust-anchor certificate. Follow input preparation to obtain these from your chosen RIR. From the project root, after placing them in input/anchor.tal and input/anchor.cer:

docker build -f docker/Dockerfile -t panda-rpki:v0.1.0 .
mkdir -p state output
docker run --rm --read-only --tmpfs /tmp \
  --user "$(id -u):$(id -g)" \
  -v "$PWD/input:/input:ro" \
  -v "$PWD/state:/state" \
  -v "$PWD/output:/output" \
  panda-rpki:v0.1.0 validate \
    --tal /input/anchor.tal --ta /input/anchor.cer \
    --rrdp-state-dir /state --out /output \
    --ccr-out /output/result.ccr

Inspect output/summary.json and output/vrps.csv. Logs go to stderr. Reuse the state directory to allow delta updates on subsequent runs. For continuous operation see Usage.

Features

• Multiple TAL/TA pairs and optional per-anchor resource constraints.
• RRDP snapshot, delta, replace/withdraw and protocol fallback.
• HTTPS same-origin checks for RRDP references and redirects.
• Independent bounded repository and object worker pools.
• CA, CRL, manifest, ROA, ASPA and BGPsec router-certificate processing.
• CSV, CCR, JSON summaries and configurable text or JSON logs.
• Daemon intervals, persistent state, run retention, timeouts and graceful stop.

Version 0.1.0 accepts HTTPS RRDP through its CLI. Operators supply TALs and matching TA certificates. No RTR server is included. See the standards matrix for profiles and limitations.

Documentation

• Getting started: dependencies, inputs and first run.
• Five-RIR trust anchors: official TAL/TA downloads and checks.
• Usage: multiple anchors, delta, daemon and troubleshooting.
• Command-line reference: options and defaults.
• Docker and Compose: single-anchor, all-five and daemon deployments.
• Development and testing.
• Contributing and changelog.

Build from source

Install Rust 1.92 or newer and the native dependencies:

cargo build --locked --release
target/release/panda-rpki --help

License

Panda RPKI uses the BSD-3-Clause license. See third-party notices for dependency attribution.