20260511 CIR V3 trust anchors self-contained

src/validation/from_tal.rs

@@ -319,11 +319,30 @@ fn discover_root_ca_instance_from_tal_and_ta_der_impl(
     })
 }
 
+pub fn canonical_tal_rsync_uri_from_bytes(tal_bytes: &[u8]) -> Result<Url, FromTalError> {
+    let tal = Tal::decode_bytes(tal_bytes)?;
+    tal.ta_uris
+        .iter()
+        .find(|uri| uri.scheme() == "rsync")
+        .cloned()
+        .ok_or_else(|| {
+            FromTalError::TaFetch("TAL contains no rsync TA URI for offline TA binding".to_string())
+        })
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
     use crate::fetch::rsync::LocalDirRsyncFetcher;
 
+    struct FailingHttpFetcher;
+
+    impl Fetcher for FailingHttpFetcher {
+        fn fetch(&self, uri: &str) -> Result<Vec<u8>, String> {
+            Err(format!("blocked test HTTP fetch: {uri}"))
+        }
+    }
+
     #[test]
     fn discover_root_ca_instance_from_tal_with_fetchers_supports_rsync_ta_uri() {
         let tal_bytes = std::fs::read(
@@ -352,17 +371,18 @@ mod tests {
         std::fs::create_dir_all(&mirror_root).unwrap();
         std::fs::write(mirror_root.join("apnic-rpki-root-iana-origin.cer"), ta_der).unwrap();
 
-        let http = crate::fetch::http::BlockingHttpFetcher::new(
-            crate::fetch::http::HttpFetcherConfig::default(),
-        )
-        .unwrap();
         let rsync = LocalDirRsyncFetcher::new(
             td.path()
                 .join(rsync_uri.host_str().unwrap())
                 .join("repository"),
         );
-        let discovery = discover_root_ca_instance_from_tal_with_fetchers(&http, &rsync, tal, None)
-            .expect("discover via rsync TA");
+        let discovery = discover_root_ca_instance_from_tal_with_fetchers(
+            &FailingHttpFetcher,
+            &rsync,
+            tal,
+            None,
+        )
+        .expect("discover via rsync TA fallback");
         assert!(
             discovery
                 .trust_anchor