20260511 CIR V3 trust anchors self-contained

src/validation/from_tal.rs

@@ -319,11 +319,30 @@ fn discover_root_ca_instance_from_tal_and_ta_der_impl(
     })
 }
 
+pub fn canonical_tal_rsync_uri_from_bytes(tal_bytes: &[u8]) -> Result<Url, FromTalError> {
+    let tal = Tal::decode_bytes(tal_bytes)?;
+    tal.ta_uris
+        .iter()
+        .find(|uri| uri.scheme() == "rsync")
+        .cloned()
+        .ok_or_else(|| {
+            FromTalError::TaFetch("TAL contains no rsync TA URI for offline TA binding".to_string())
+        })
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
     use crate::fetch::rsync::LocalDirRsyncFetcher;
 
+    struct FailingHttpFetcher;
+
+    impl Fetcher for FailingHttpFetcher {
+        fn fetch(&self, uri: &str) -> Result<Vec<u8>, String> {
+            Err(format!("blocked test HTTP fetch: {uri}"))
+        }
+    }
+
     #[test]
     fn discover_root_ca_instance_from_tal_with_fetchers_supports_rsync_ta_uri() {
         let tal_bytes = std::fs::read(
@@ -352,17 +371,18 @@ mod tests {
         std::fs::create_dir_all(&mirror_root).unwrap();
         std::fs::write(mirror_root.join("apnic-rpki-root-iana-origin.cer"), ta_der).unwrap();
 
-        let http = crate::fetch::http::BlockingHttpFetcher::new(
-            crate::fetch::http::HttpFetcherConfig::default(),
-        )
-        .unwrap();
         let rsync = LocalDirRsyncFetcher::new(
             td.path()
                 .join(rsync_uri.host_str().unwrap())
                 .join("repository"),
         );
-        let discovery = discover_root_ca_instance_from_tal_with_fetchers(&http, &rsync, tal, None)
-            .expect("discover via rsync TA");
+        let discovery = discover_root_ca_instance_from_tal_with_fetchers(
+            &FailingHttpFetcher,
+            &rsync,
+            tal,
+            None,
+        )
+        .expect("discover via rsync TA fallback");
         assert!(
             discovery
                 .trust_anchor

src/validation/run_tree_from_tal.rs

@@ -23,7 +23,8 @@ use crate::replay::fetch_http::PayloadReplayHttpFetcher;
 use crate::replay::fetch_rsync::PayloadReplayRsyncFetcher;
 use crate::sync::rrdp::Fetcher;
 use crate::validation::from_tal::{
-    DiscoveredRootCaInstance, FromTalError, discover_root_ca_instance_from_tal_and_ta_der,
+    DiscoveredRootCaInstance, FromTalError, canonical_tal_rsync_uri_from_bytes,
+    discover_root_ca_instance_from_tal_and_ta_der,
     discover_root_ca_instance_from_tal_and_ta_der_with_strict_name,
     discover_root_ca_instance_from_tal_url,
     discover_root_ca_instance_from_tal_url_with_strict_name,
@@ -251,12 +252,19 @@ fn root_discovery_from_tal_input(
             let ta_der = std::fs::read(ta_path).map_err(|e| {
                 FromTalError::TaFetch(format!("read TA file failed: {}: {e}", ta_path.display()))
             })?;
+            let resolved_ta_uri = canonical_tal_rsync_uri_from_bytes(&tal_bytes)?;
             if strict_name {
                 discover_root_ca_instance_from_tal_and_ta_der_with_strict_name(
-                    &tal_bytes, &ta_der, None,
+                    &tal_bytes,
+                    &ta_der,
+                    Some(&resolved_ta_uri),
                 )
             } else {
-                discover_root_ca_instance_from_tal_and_ta_der(&tal_bytes, &ta_der, None)
+                discover_root_ca_instance_from_tal_and_ta_der(
+                    &tal_bytes,
+                    &ta_der,
+                    Some(&resolved_ta_uri),
+                )
             }
         }
     }