****** RPKI utility programs ******

The distribution contains a few small utility programs. Most of these are
nominally relying party tools. Some but not all of them are installed by "make
install".

***** uri *****

uri is a utility program to extract URIs from the SIA, AIA, and CRLDP
extensions of one or more X.509v3 certificates, either specified directly or as
CMS objects containing X.509v3 certificates within the CMS wrapper. Input files
must be in DER format.

Usage:

  $ uri [-h | --help] [-s | --single-line] cert [cert...]

-h --help        show help

-s --single-line Single output line per input file

   cert          Object(s) to examine

The rp/utils directory in the source tree also includes a few experimental AWK
scripts to post-process the uri program's output in various ways.

***** hashdir *****

hashdir copies an authenticated result tree from an rcynic run into the format
expected by most OpenSSL-based programs: a collection of "PEM" format files
with names in the form that OpenSSL's -CApath lookup routines expect. This can
be useful for validating RPKI objects which are not distributed as part of the
repository system. Input files must be in DER format.

Usage:

  $ hashdir [-h | --help] [-v | --verbose] rcynic_directory output_directory

-h --help           Show help

-v --verbose        Whistle while you work

   rcynic_directory rcynic authenticated output tree

   output_directory Output directory to create

***** print_rpki_manifest *****

print_rpki_manifest pretty-prints the content of a manifest. It does NOT
attempt to verify the signature. Input files must be in DER format.

Usage:

  $ print_rpki_manifest [-h | --help] [-c | --cms] manifest [manifest...]

-h --help   Show help

-c --cms    Print text representation of entire CMS blob

   manifest Manifest(s) to print

***** print_roa *****

print_roa pretty-prints the content of a ROA. It does NOT attempt to verify the
signature. Input files must be in DER format.

Usage:

  $ print_roa [-h | --help] [-b | --brief] [-c | --cms] [-s | --signing-time]
  ROA [ROA...]

-h --help         Show help

-b --brief        Brief mode (only show ASN and prefix)

-c --cms          Print text representation of entire CMS blob

-s --signing-time Show CMS signingTime

   ROA            ROA object(s) to print

***** find_roa *****

find_roa searches the authenticated result tree from an rcynic run for ROAs
matching specified prefixes. Input files must be in DER format.

Usage:

  $ find_roa [-h | --help] [-a | --all]
             [-m | --match-maxlength ] [-f | --show-filenames]
             [-i | --show-inception]   [-e | --show-expiration]
             authtree [prefix...]

-h --help            Show help

-a --all             Show all ROAs, do no prefix matching at all

-e --show-expiration Show ROA chain expiration dates

-f --show-filenames  Show filenames instead of URIs

-i --show-inception  Show inception dates

-m -match-maxlength  Pay attention to maxLength values

   authtree          rcynic authenticated output tree

   prefix            ROA prefix(es) to on which to match

***** scan_roas *****

scan_roas searchs the authenticated result tree from an rcynic run for ROAs,
and prints out the signing time, ASN, and prefixes for each ROA, one ROA per
line.

Other programs such as the rpki-rtr client use scan_roas to extract the
validated ROA payload after an rcynic validation run.

Usage:

  $ scan_roas [-h | --help] rcynic_dir [rcynic_dir...]

-h --help     Show help

   rcynic_dir rcynic authenticated output tree

***** scan_routercerts *****

scan_routercerts searchs the authenticated result tree from an rcynic run for
BGPSEC router certificates, and prints out data of interest to the rpki-rtr
code.

Other programs such as the rpki-rtr client use scan_routercerts to extract the
validated ROA payload after an rcynic validation run.

Usage:

  $ scan_routercerts [-h | --help] rcynic_dir [rcynic_dir...]

-h --help     Show help

   rcynic_dir rcynic authenticated output tree