20260626 ARM64 Docker Compose部署与live TA首轮刷新

scripts/soak/portable-soak.env.example

@@ -19,15 +19,19 @@ RIRS=afrinic,apnic,arin,lacnic,ripe
 
 # TAL/TA 输入模式。
 # file-with-ta：使用 package 内置 fixtures/tal + fixtures/ta，完全离线固定输入。
-# file-live-ta：使用 package 内置 fixtures/tal；每轮后台 best-effort 刷新 TA 到 state/live-ta，
-#               子进程不等待刷新，直接使用当前已有的 state/live-ta，首次缺失时从 fixtures/ta 初始化。
+# file-live-ta：使用 package 内置 fixtures/tal；snapshot 轮默认先阻塞完成 live TA 获取再启动子进程，
+#               delta 轮后台 best-effort 刷新 TA 到 state/live-ta，子进程使用当前已有的 state/live-ta。
 # url：直接把 TAL URL 传给子进程，由子进程处理 TAL/TA 获取。
 TAL_INPUT_MODE=file-with-ta
 
-# file-live-ta 后台刷新 TA 的 curl 超时配置。刷新失败只写日志，不阻断本轮 run。
+# file-live-ta live TA 刷新 curl 超时配置。
 LIVE_TA_REFRESH_CONNECT_TIMEOUT_SECS=15
 LIVE_TA_REFRESH_MAX_TIME_SECS=120
 
+# file-live-ta 在 snapshot 轮是否先完成 live TA 获取再启动子进程。
+# 建议保持 1，避免 clean state 首轮 snapshot 使用旧 fixture TA。
+LIVE_TA_REFRESH_BEFORE_SNAPSHOT=1
+
 # 运行根目录。默认使用 package 根目录；如需把产物写到独立数据盘，可改成绝对路径。
 RUN_ROOT="${PACKAGE_ROOT}"
 

scripts/soak/run_soak.sh

@@ -47,6 +47,7 @@ INVALID_ROOT="$STATE_ROOT/invalid"
 LIVE_TA_REFRESH_DIR="${LIVE_TA_REFRESH_DIR:-$META_DIR/live-ta-refresh}"
 LIVE_TA_REFRESH_CONNECT_TIMEOUT_SECS="${LIVE_TA_REFRESH_CONNECT_TIMEOUT_SECS:-15}"
 LIVE_TA_REFRESH_MAX_TIME_SECS="${LIVE_TA_REFRESH_MAX_TIME_SECS:-120}"
+LIVE_TA_REFRESH_BEFORE_SNAPSHOT="${LIVE_TA_REFRESH_BEFORE_SNAPSHOT:-1}"
 
 RPKI_BIN="$BIN_DIR/rpki"
 RPKI_DAEMON_BIN="$BIN_DIR/rpki_daemon"
@@ -309,12 +310,83 @@ start_live_ta_refresh_for_rir() {
   printf '%s\n' "$pid" > "$pid_file"
 }
 
-prepare_live_ta_inputs_for_run() {
+wait_for_previous_live_ta_refresh_for_rir() {
+  local rir_name="$1"
+  local pid_file
+  local pid
+  local deadline_epoch
+  pid_file="$(live_ta_refresh_pid_file_for_rir "$rir_name")"
+  [[ -f "$pid_file" ]] || return 0
+  if reap_finished_live_ta_refresh_for_rir "$rir_name"; then
+    return 0
+  fi
+  pid="$(cat "$pid_file" 2>/dev/null || true)"
+  deadline_epoch=$(( $(date +%s) + LIVE_TA_REFRESH_MAX_TIME_SECS + 60 ))
+  echo "live-ta-refresh wait rir=$rir_name reason=previous_refresh_running pid=$pid"
+  while ! reap_finished_live_ta_refresh_for_rir "$rir_name"; do
+    if (( $(date +%s) > deadline_epoch )); then
+      die "timed out waiting for previous live TA refresh for $rir_name pid=$pid"
+    fi
+    sleep 1
+  done
+}
+
+refresh_live_ta_blocking_for_run() {
   local run_id="$1"
   local rir_name
+  local pid
+  local failed=0
+  local pids=()
+  local names=()
+  local log_path
+  local pid_file
+
+  for rir_name in "${RIR_LIST[@]}"; do
+    wait_for_previous_live_ta_refresh_for_rir "$rir_name"
+  done
+
+  for rir_name in "${RIR_LIST[@]}"; do
+    mkdir -p "$LIVE_TA_REFRESH_DIR" "$LOG_ROOT"
+    pid_file="$(live_ta_refresh_pid_file_for_rir "$rir_name")"
+    log_path="$LOG_ROOT/live-ta-refresh-$run_id-$rir_name.log"
+    refresh_live_ta_for_rir "$rir_name" "$run_id" "$log_path" &
+    pid=$!
+    printf '%s\n' "$pid" > "$pid_file"
+    pids+=("$pid")
+    names+=("$rir_name")
+  done
+
+  local index
+  for index in "${!pids[@]}"; do
+    pid="${pids[$index]}"
+    rir_name="${names[$index]}"
+    pid_file="$(live_ta_refresh_pid_file_for_rir "$rir_name")"
+    if wait "$pid"; then
+      rm -f "$pid_file"
+    else
+      failed=1
+      rm -f "$pid_file"
+      echo "live-ta-refresh failed before snapshot rir=$rir_name log=$LOG_ROOT/live-ta-refresh-$run_id-$rir_name.log" >&2
+    fi
+  done
+
+  if (( failed != 0 )); then
+    die "live TA refresh failed before snapshot run=$run_id; see $LOG_ROOT/live-ta-refresh-$run_id-*.log"
+  fi
+  echo "live-ta-refresh completed before snapshot run=$run_id rirs=${#RIR_LIST[@]}"
+}
+
+prepare_live_ta_inputs_for_run() {
+  local run_id="$1"
+  local sync_mode="$2"
+  local rir_name
   if [[ "$TAL_INPUT_MODE" != "file-live-ta" ]]; then
     return 0
   fi
+  if [[ "$sync_mode" == "snapshot" ]] && is_true "$LIVE_TA_REFRESH_BEFORE_SNAPSHOT"; then
+    refresh_live_ta_blocking_for_run "$run_id"
+    return 0
+  fi
   for rir_name in "${RIR_LIST[@]}"; do
     ensure_live_ta_for_rir "$rir_name"
   done
@@ -726,7 +798,7 @@ run_one_round() {
     "$snapshot_reason" "$previous_run_id" "$previous_success_value" "$started_at" "" \
     "$INVALID_DB_PATH" "$INVALID_STATE_PATH" "$INVALID_TMP_PATH" "" "$PACKAGE_ROOT" "$ENV_FILE"
 
-  prepare_live_ta_inputs_for_run "$run_id"
+  prepare_live_ta_inputs_for_run "$run_id" "$sync_mode"
   build_child_args
   if is_true "$RPKI_ANALYZE"; then
     CHILD_ARGS+=(--analyze --analysis-out "$run_dir/analyze")