20260511 CIR V3 trust anchors self-contained

scripts/compare/run_perf_compare_quick_remote.sh

@@ -242,6 +242,30 @@ ta_file_for_rir() {
   esac
 }
 
+refresh_ta_file_for_rir() {
+  local rir="$1"
+  local uri
+  local file
+  uri="$(tal_uri_for_rir "$rir")"
+  file="$(ta_file_for_rir "$rir")"
+  python3 - <<'PY' "$uri" "$file"
+import sys
+import urllib.request
+uri, path = sys.argv[1:]
+request = urllib.request.Request(uri, headers={"User-Agent": "rpki-dev/compare-fast-path"})
+with urllib.request.urlopen(request, timeout=30) as response:
+    data = response.read()
+if not data:
+    raise SystemExit(f"empty TA certificate response: {uri}")
+with open(path, "wb") as output:
+    output.write(data)
+PY
+}
+
+for rir in "${RIRS[@]}"; do
+  refresh_ta_file_for_rir "$rir"
+done
+
 OURS_TAL_ARGS=()
 CLIENT_TAL_ARGS=()
 OURS_CIR_TAL_ARGS=()
@@ -260,6 +284,8 @@ fi
 mkdir -p state/ours/work-db state/ours/raw-store.db state/ours/repo-bytes.db state/rpki-client/cache state/rpki-client/out state/rpki-client/ta state/rpki-client/.ta
 chmod 0777 state/ours/work-db state/ours/raw-store.db state/ours/repo-bytes.db
 chmod -R 0777 state/rpki-client
+touch state/rpki-client/rpki-client-skiplist
+chmod 0644 state/rpki-client/rpki-client-skiplist
 
 START_EPOCH="$(python3 - <<'PY'
 import time
@@ -333,7 +359,7 @@ PY
   set +e
   LD_LIBRARY_PATH="$REMOTE_ROOT/lib${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH}" "$REMOTE_ROOT/bin/rpki-client" \
     -vv \
-    -S "$REMOTE_ROOT/rpki-client-skiplist" \
+    -S rpki-client-skiplist \
     "${CLIENT_TAL_ARGS[@]}" \
     -d cache out \
     > "$REMOTE_ROOT/steps/$STEP_ID/rpki-client/run.log" 2>&1

scripts/periodic/compare_ccr_cir_round.sh

@@ -114,8 +114,8 @@ else:
         diagnosis = "ccr_mismatch_cir_not_available"
     elif not cir_compared:
         diagnosis = "ccr_mismatch_cir_compare_skipped"
-    elif cir.get("tals", {}).get("match") is not True:
-        diagnosis = "tal_input_difference"
+    elif cir.get("trustAnchors", {}).get("match") is not True:
+        diagnosis = "trust_anchor_input_difference"
     elif cir.get("objects", {}).get("match") is not True:
         diagnosis = "input_object_or_manifest_accepted_set_difference"
     elif (
@@ -154,10 +154,13 @@ combined = {
         "allMatch": cir.get("allMatch") if cir else None,
         "objectsMatch": cir.get("objects", {}).get("match") if cir else None,
         "rejectsMatch": cir.get("rejects", {}).get("match") if cir else None,
-        "talsMatch": cir.get("tals", {}).get("match") if cir else None,
+        "trustAnchorsMatch": cir.get("trustAnchors", {}).get("match") if cir else None,
+        "talsMatch": cir.get("trustAnchors", {}).get("match") if cir else None,
         "rejectListSha256Match": cir.get("rejectListSha256Match") if cir else None,
         "oursObjectCount": cir.get("ours", {}).get("objectCount") if cir else None,
         "rpkiClientObjectCount": cir.get("rpkiClient", {}).get("objectCount") if cir else None,
+        "oursTrustAnchorCount": cir.get("ours", {}).get("trustAnchorCount") if cir else None,
+        "rpkiClientTrustAnchorCount": cir.get("rpkiClient", {}).get("trustAnchorCount") if cir else None,
         "oursRejectCount": cir.get("ours", {}).get("rejectCount") if cir else None,
         "rpkiClientRejectCount": cir.get("rpkiClient", {}).get("rejectCount") if cir else None,
     },
@@ -178,8 +181,8 @@ if cir:
     lines.extend([
         f"- `cirObjectsMatch`: `{str(combined['cir']['objectsMatch']).lower()}`",
         f"- `cirRejectsMatch`: `{str(combined['cir']['rejectsMatch']).lower()}`",
-        f"- `cirTalsMatch`: `{str(combined['cir']['talsMatch']).lower()}`",
-        f"- `cirCounts`: ours objects `{combined['cir']['oursObjectCount']}`, rpki-client objects `{combined['cir']['rpkiClientObjectCount']}`, ours rejects `{combined['cir']['oursRejectCount']}`, rpki-client rejects `{combined['cir']['rpkiClientRejectCount']}`",
+        f"- `cirTrustAnchorsMatch`: `{str(combined['cir']['trustAnchorsMatch']).lower()}`",
+        f"- `cirCounts`: ours objects `{combined['cir']['oursObjectCount']}`, rpki-client objects `{combined['cir']['rpkiClientObjectCount']}`, ours trustAnchors `{combined['cir']['oursTrustAnchorCount']}`, rpki-client trustAnchors `{combined['cir']['rpkiClientTrustAnchorCount']}`, ours rejects `{combined['cir']['oursRejectCount']}`, rpki-client rejects `{combined['cir']['rpkiClientRejectCount']}`",
     ])
 else:
     lines.append(f"- `cirSkippedReason`: `{'ccr matched' if ccr_match and not always_compare_cir else 'CIR inputs unavailable'}`")