20260817 fe147 installer原生支持custom TAL模式：RIRS=custom+TAL_INPUT_MODE=custom-file-with-ta+CUSTOM_*全套env，compose挂载fixtures目录，start.sh支持CUSTOM_REPO_NETWORK无竞态接入

scripts/soak/run_soak.sh

@@ -36,6 +36,10 @@ DISABLE_COMPETING_RPS="${DISABLE_COMPETING_RPS:-1}"
 ENABLE_CHILD_CERTIFICATE_VALIDATION_CACHE="${ENABLE_CHILD_CERTIFICATE_VALIDATION_CACHE:-0}"
 RPKI_EXTRA_ARGS="${RPKI_EXTRA_ARGS:-}"
 RPKI_ANALYZE="${RPKI_ANALYZE:-0}"
+CUSTOM_TAL_PATH="${CUSTOM_TAL_PATH:-$PACKAGE_ROOT/custom-fixtures/tal/custom.tal}"
+CUSTOM_TA_PATH="${CUSTOM_TA_PATH:-$PACKAGE_ROOT/custom-fixtures/ta/custom-ta.cer}"
+CUSTOM_TAL_URI="${CUSTOM_TAL_URI:-}"
+HTTP_ROOT_CERT_PATHS="${HTTP_ROOT_CERT_PATHS:-}"
 
 BIN_DIR="${BIN_DIR:-$PACKAGE_ROOT/bin}"
 FIXTURE_DIR="${FIXTURE_DIR:-$PACKAGE_ROOT/fixtures}"
@@ -119,10 +123,10 @@ validate_rsync_scope() {
 
 validate_tal_input_mode() {
   case "$TAL_INPUT_MODE" in
-    file-with-ta|file-live-ta|url)
+    file-with-ta|file-live-ta|custom-file-with-ta|url)
       ;;
     *)
-      die "TAL_INPUT_MODE must be file-with-ta, file-live-ta or url: $TAL_INPUT_MODE"
+      die "TAL_INPUT_MODE must be file-with-ta, file-live-ta, custom-file-with-ta or url: $TAL_INPUT_MODE"
       ;;
   esac
 }
@@ -156,14 +160,46 @@ parse_rirs() {
       afrinic|apnic|arin|lacnic|ripe)
         RIR_LIST+=("$normalized")
         ;;
+      custom)
+        [[ "$TAL_INPUT_MODE" == "custom-file-with-ta" ]] \
+          || die "RIRS=custom requires TAL_INPUT_MODE=custom-file-with-ta"
+        RIR_LIST+=("$normalized")
+        ;;
       *)
-        die "invalid RIRS entry: $raw_token; allowed: afrinic,apnic,arin,lacnic,ripe"
+        die "invalid RIRS entry: $raw_token; allowed: afrinic,apnic,arin,lacnic,ripe,custom (custom mode only)"
         ;;
     esac
   done
   [[ "${#RIR_LIST[@]}" -gt 0 ]] || die "RIRS must contain at least one RIR"
 }
 
+validate_custom_inputs() {
+  local root_cert_path
+  local -a root_cert_paths=()
+
+  if [[ "$TAL_INPUT_MODE" == "custom-file-with-ta" ]]; then
+    [[ "${#RIR_LIST[@]}" -eq 1 && "${RIR_LIST[0]}" == "custom" ]] \
+      || die "custom-file-with-ta requires exactly RIRS=custom"
+    [[ -s "$CUSTOM_TAL_PATH" ]] \
+      || die "missing custom TAL: $CUSTOM_TAL_PATH"
+    [[ -s "$CUSTOM_TA_PATH" ]] \
+      || die "missing custom TA DER: $CUSTOM_TA_PATH"
+    [[ -n "$CUSTOM_TAL_URI" ]] \
+      || die "CUSTOM_TAL_URI is required in custom-file-with-ta mode"
+  elif [[ "$RIRS" == *custom* ]]; then
+    die "RIRS=custom requires TAL_INPUT_MODE=custom-file-with-ta"
+  fi
+
+  if [[ -n "$HTTP_ROOT_CERT_PATHS" ]]; then
+    # shellcheck disable=SC2206
+    root_cert_paths=( $HTTP_ROOT_CERT_PATHS )
+    for root_cert_path in "${root_cert_paths[@]}"; do
+      [[ -s "$root_cert_path" ]] \
+        || die "missing HTTP root certificate: $root_cert_path"
+    done
+  fi
+}
+
 tal_file_for_rir() {
   case "$1" in
     afrinic) printf '%s' "$FIXTURE_DIR/tal/afrinic.tal" ;;
@@ -171,6 +207,7 @@ tal_file_for_rir() {
     arin) printf '%s' "$FIXTURE_DIR/tal/arin.tal" ;;
     lacnic) printf '%s' "$FIXTURE_DIR/tal/lacnic.tal" ;;
     ripe) printf '%s' "$FIXTURE_DIR/tal/ripe-ncc.tal" ;;
+    custom) printf '%s' "$CUSTOM_TAL_PATH" ;;
     *) die "unknown RIR: $1" ;;
   esac
 }
@@ -182,6 +219,7 @@ ta_file_for_rir() {
     arin) printf '%s' "$FIXTURE_DIR/ta/arin-ta.cer" ;;
     lacnic) printf '%s' "$FIXTURE_DIR/ta/lacnic-ta.cer" ;;
     ripe) printf '%s' "$FIXTURE_DIR/ta/ripe-ncc-ta.cer" ;;
+    custom) printf '%s' "$CUSTOM_TA_PATH" ;;
     *) die "unknown RIR: $1" ;;
   esac
 }
@@ -193,6 +231,7 @@ tal_url_for_rir() {
     arin) printf '%s' "https://www.arin.net/resources/manage/rpki/arin.tal" ;;
     lacnic) printf '%s' "https://www.lacnic.net/innovaportal/file/4983/1/lacnic.tal" ;;
     ripe) printf '%s' "https://tal.rpki.ripe.net/ripe-ncc.tal" ;;
+    custom) printf '%s' "$CUSTOM_TAL_URI" ;;
     *) die "unknown RIR: $1" ;;
   esac
 }
@@ -1058,6 +1097,17 @@ build_child_args() {
     CHILD_ARGS+=(--rsync-mirror-root "$TMP_DIR/rsync-mirror-{run_id}")
   fi
 
+  local root_cert_path
+  local -a root_cert_paths=()
+  if [[ -n "$HTTP_ROOT_CERT_PATHS" ]]; then
+    # HTTPS trust roots for RRDP/TAL fetches (independent of the RPKI TA).
+    # shellcheck disable=SC2206
+    root_cert_paths=( $HTTP_ROOT_CERT_PATHS )
+    for root_cert_path in "${root_cert_paths[@]}"; do
+      CHILD_ARGS+=(--http-root-cert "$root_cert_path")
+    done
+  fi
+
   CHILD_ARGS+=(
     --parallel-phase2-ready-batch-size 256
     --parallel-phase2-ready-batch-wall-time-budget-ms 100
@@ -1417,6 +1467,7 @@ main() {
     validate_positive_int "DB_STATS_EXACT_EVERY" "$DB_STATS_EXACT_EVERY"
   fi
   parse_rirs
+  validate_custom_inputs
   [[ -x "$RPKI_BIN" ]] || die "missing executable: $RPKI_BIN"
   [[ -x "$RPKI_DAEMON_BIN" ]] || die "missing executable: $RPKI_DAEMON_BIN"