20260715 add configurable max CA depth

src/validation/tree.rs

@@ -10,6 +10,8 @@ use crate::validation::publication_point::PublicationPointSnapshot;
 use std::borrow::Cow;
 use std::sync::{Arc, OnceLock};
 
+pub const DEFAULT_MAX_CA_DEPTH: usize = 32;
+
 #[derive(Clone, Debug, PartialEq, Eq)]
 pub struct TreeRunConfig {
     /// Max CA instance depth to process (0 = root only).
@@ -37,7 +39,7 @@ pub struct TreeRunConfig {
 impl Default for TreeRunConfig {
     fn default() -> Self {
         Self {
-            max_depth: None,
+            max_depth: Some(DEFAULT_MAX_CA_DEPTH),
             max_instances: None,
             compact_audit: false,
             persist_vcir: true,
@@ -51,6 +53,15 @@ impl Default for TreeRunConfig {
     }
 }
 
+pub(crate) fn ca_depth_is_allowed(config: &TreeRunConfig, depth: usize) -> bool {
+    config.max_depth.is_none_or(|max_depth| depth <= max_depth)
+}
+
+pub(crate) fn next_allowed_ca_depth(config: &TreeRunConfig, parent_depth: usize) -> Option<usize> {
+    let child_depth = parent_depth.checked_add(1)?;
+    ca_depth_is_allowed(config, child_depth).then_some(child_depth)
+}
+
 #[derive(Clone, Debug)]
 pub enum CaCertificateRef {
     InlineDer(Vec<u8>),
@@ -347,10 +358,8 @@ pub fn run_tree_serial_audit_multi_root(
             }
         }
 
-        if let Some(max_depth) = config.max_depth {
-            if ca.depth > max_depth {
-                continue;
-            }
+        if !ca_depth_is_allowed(config, ca.depth) {
+            continue;
         }
 
         let res = match runner.run_publication_point(ca) {
@@ -393,6 +402,9 @@ pub fn run_tree_serial_audit_multi_root(
         }
         publication_points.push(audit);
 
+        let Some(child_depth) = next_allowed_ca_depth(config, ca.depth) else {
+            continue;
+        };
         let mut children = res.discovered_children;
         children.sort_by(|a, b| {
             a.handle
@@ -413,7 +425,7 @@ pub fn run_tree_serial_audit_multi_root(
         for child in children {
             queue.push_back(QueuedCaInstance {
                 id: next_id,
-                handle: child.handle.with_depth(ca.depth + 1),
+                handle: child.handle.with_depth(child_depth),
                 parent_id: Some(node.id),
                 discovered_from: Some(child.discovered_from),
             });

src/validation/tree_parallel.rs

@@ -19,8 +19,8 @@ use crate::validation::objects::{
 };
 use crate::validation::tree::{
     CaInstanceHandle, DiscoveredChildCaInstance, PublicationPointRunResult, PublicationPointRunner,
-    TreeRunAuditOutput, TreeRunConfig, TreeRunError, TreeRunOutput,
-    run_tree_serial_audit_multi_root,
+    TreeRunAuditOutput, TreeRunConfig, TreeRunError, TreeRunOutput, ca_depth_is_allowed,
+    next_allowed_ca_depth, run_tree_serial_audit_multi_root,
 };
 use crate::validation::tree_runner::{
     FreshPublicationPointFinalizeOutput, FreshPublicationPointStage, Rpkiv1PublicationPointRunner,
@@ -659,6 +659,7 @@ pub fn run_tree_parallel_phase2_audit_multi_root(
                         &mut finished,
                         ready,
                         ready_queue_len_after_pop,
+                        config,
                         config.compact_audit,
                     );
                     ready_batch_metrics.record(metrics);
@@ -916,10 +917,8 @@ fn start_queued_ca_instances(
         if !visited_manifest_uris.insert(node.handle.manifest_rsync_uri.clone()) {
             continue;
         }
-        if let Some(max_depth) = config.max_depth {
-            if node.handle.depth > max_depth {
-                continue;
-            }
+        if !ca_depth_is_allowed(config, node.handle.depth) {
+            continue;
         }
         *instances_started += 1;
         match repo_runtime.request_publication_point_repo(&node.handle, 0) {
@@ -959,6 +958,7 @@ fn stage_ready_publication_point(
     finished: &mut Vec<FinishedPublicationPoint>,
     ready: ReadyCaInstance,
     ready_queue_len_after_pop: usize,
+    config: &TreeRunConfig,
     compact_audit: bool,
 ) -> ReadyStageMetrics {
     let publication_point_started = Instant::now();
@@ -991,6 +991,7 @@ fn stage_ready_publication_point(
             next_id,
             ca_queue,
             &ready.node,
+            config,
             result.discovered_children.clone(),
         );
         metrics.child_enqueue_ms = elapsed_ms(child_enqueue_started);
@@ -1057,6 +1058,7 @@ fn stage_ready_publication_point(
                     next_id,
                     ca_queue,
                     &ready.node,
+                    config,
                     result.discovered_children.clone(),
                 );
                 metrics.child_enqueue_ms = elapsed_ms(child_enqueue_started);
@@ -1142,6 +1144,7 @@ fn stage_ready_publication_point(
         next_id,
         ca_queue,
         &ready.node,
+        config,
         fresh_stage.discovered_children.clone(),
     );
     metrics.child_enqueue_ms = elapsed_ms(child_enqueue_started);
@@ -1412,8 +1415,13 @@ fn enqueue_discovered_children(
     next_id: &mut u64,
     ca_queue: &mut VecDeque<QueuedCaInstance>,
     parent: &QueuedCaInstance,
+    config: &TreeRunConfig,
     mut children: Vec<DiscoveredChildCaInstance>,
 ) {
+    let Some(child_depth) = next_allowed_ca_depth(config, parent.handle.depth) else {
+        return;
+    };
+
     children.sort_by(|a, b| {
         a.handle
             .manifest_rsync_uri
@@ -1428,7 +1436,7 @@ fn enqueue_discovered_children(
         let _ = runtime.prefetch_discovered_children(&children);
     }
     for child in children {
-        let mut handle = child.handle.with_depth(parent.handle.depth + 1);
+        let mut handle = child.handle.with_depth(child_depth);
         handle.parent_manifest_rsync_uri = Some(parent.handle.manifest_rsync_uri.clone());
         ca_queue.push_back(QueuedCaInstance {
             id: *next_id,