panda-rpki-oss/docs/getting-started.md

Getting started

For every field, default, constraint and complete example, see the TOML configuration reference。

Panda RPKI v0.1.0 is a Linux command-line application. You can use Docker without installing Rust, or build a native binary. It requires outbound HTTPS to RPKI repositories, a writable state directory, and enough disk space for repository objects and outputs. Resource use depends on the selected trust anchors.

Prepare trust anchors

A trust anchor defines what you trust. Obtain its TAL from the responsible RIR. Panda RPKI checks the TAL public key and either uses a configured DER certificate or refreshes a certificate from the TAL's HTTPS/rsync URI. Automatic refresh stores a validated last-known certificate beside the protocol state; it never changes the TAL itself.

For example, the RIPE NCC trust-anchor page publishes the RIPE NCC TAL. From the project root:

mkdir -p input
curl --fail --location --proto '=https' --proto-redir '=https' \
  --connect-timeout 15 --max-time 120 \
  https://tal.rpki.ripe.net/ripe-ncc.tal -o input/anchor.tal
# Optional: download a TA certificate only for fixed mode.
curl --fail --location --proto '=https' --proto-redir '=https' \
  --connect-timeout 15 --max-time 120 \
  https://rpki.ripe.net/ta/ripe-ncc-ta.cer -o input/anchor.cer

Check the TAL's current certificate URI before downloading. The RIR trust-anchor directory links the other regional anchors. Use their official TALs and corresponding certificate locations when preparing a multiple-anchor deployment. Store inputs outside version control, keep TA certificates current, and retain local policy files alongside the appropriate TALs. For all five RIRs, use the complete five-RIR input guide, including official sources, download commands, input checks, and the filenames used by Compose.

Docker first run

Follow the README Quick start. The only application argument is --config; all paths, anchors, workers and logging belong in that TOML file. It creates output/summary.json, output/vrps.csv and output/result.ccr. State is retained under state/repository/repository-db/ and the automatic TA cache is a sibling state/repository.ta-cache/ directory.

Build from source

Install Rust 1.92 or newer. On Debian/Ubuntu, native build dependencies include:

sudo apt-get update
sudo apt-get install --no-install-recommends build-essential clang libclang-dev \
  pkg-config ca-certificates rsync time
cargo build --locked --release
target/release/panda-rpki --help

Create a configuration file (paths are relative to the file, or use absolute container paths):

config-version = 1
mode = "validate"
out = "output/native"
rrdp-state-dir = "state"
ccr-out = "output/native/result.ccr"

[[anchors]]
id = "anchor"
tal = "input/anchor.tal"
# ta = "input/anchor.cer" # uncomment for fixed mode

Run with that configuration:

target/release/panda-rpki validate --config validate.toml

Use validate --config validate.toml --check-config before a run for a read-only local check, or validate --config validate.toml --print-config to inspect absolute paths, defaults and field sources.

For tests, install python3-cryptography and openssl. See Development and Usage for next steps.