add OpenBSD TA constraints and localhost TLS examples

tests/cli_errors.rs

@@ -91,3 +91,50 @@ fn config_mode_and_mutually_exclusive_inspection_flags_are_rejected() {
     assert_eq!(result.status.code(), Some(2));
     assert!(String::from_utf8_lossy(&result.stderr).contains("mutually exclusive"));
 }
+
+#[test]
+fn all5_examples_load_vendored_constraints_and_disable_ignores_missing_files() {
+    let directory = tempfile::tempdir().unwrap();
+    let repo = std::path::Path::new(env!("CARGO_MANIFEST_DIR"));
+    for (mode, example) in [
+        ("validate", "validate-all5.toml"),
+        ("daemon", "daemon-all5.toml"),
+    ] {
+        let raw = std::fs::read_to_string(repo.join("docker/examples").join(example))
+            .unwrap()
+            .replace("/input", repo.join("tals").to_str().unwrap())
+            .replace("/output", directory.path().join("out").to_str().unwrap())
+            .replace("/state", directory.path().join("state").to_str().unwrap())
+            .replace("/data", directory.path().join("data").to_str().unwrap());
+        let config = directory.path().join(example);
+        for (enabled, missing, expected) in [(true, false, 0), (true, true, 2), (false, true, 0)] {
+            let mut text = raw.replace(
+                "ta-constraints-enabled = true",
+                &format!("ta-constraints-enabled = {enabled}"),
+            );
+            if missing {
+                text = text.replace(".constraints\"", ".missing\"");
+            }
+            std::fs::write(&config, text).unwrap();
+            for inspect in ["--check-config", "--print-config"] {
+                let result = command()
+                    .args([mode, "--config", config.to_str().unwrap(), inspect])
+                    .output()
+                    .unwrap();
+                assert_eq!(
+                    result.status.code(),
+                    Some(expected),
+                    "{}",
+                    String::from_utf8_lossy(&result.stderr)
+                );
+                if inspect == "--print-config" && expected == 0 {
+                    let printed: serde_json::Value =
+                        serde_json::from_slice(&result.stdout).unwrap();
+                    assert_eq!(printed["effective"]["ta-constraints-enabled"], enabled);
+                }
+            }
+        }
+        assert!(!directory.path().join("out").exists());
+        assert!(!directory.path().join("data").exists());
+    }
+}

tests/synthetic_docker_e2e.sh

@@ -47,6 +47,8 @@ fi
 run_validator() {
     local out="$1"
     local mode="$2"
+    local enabled="${3:-true}"
+    local policy="${4:-}"
     local config="$work_root/validate-$mode.toml"
     cat >"$config" <<EOF
 config-version = 1
@@ -54,6 +56,7 @@ mode = "validate"
 out = "/output"
 rrdp-state-dir = "/state"
 rrdp-sync-mode = "$mode"
+ta-constraints-enabled = $enabled
 ccr-out = "/output/result.ccr"
 http-timeout-secs = 5
 http-root-cert = ["/fixture/certs/rrdp-ca.pem"]
@@ -66,6 +69,7 @@ log-format = "json"
 id = "custom"
 tal = "/fixture/tal/custom.tal"
 ta = "/fixture/ta/custom-ta.cer"
+$policy
 EOF
     docker run --rm --network host --user "$(id -u):$(id -g)" \
         -v "$fixture:/fixture:ro" \
@@ -103,6 +107,29 @@ timing = json.loads((delta / "stage-timing.json").read_text(encoding="utf-8"))
 assert timing["analysis_counts"]["rrdp_delta_ops_applied_total"] > 0, timing
 PY
 
+# Policy changes must affect payloads even when RRDP is a noop.
+printf 'deny 0.0.0.0/0\ndeny ::/0\ndeny 0 - 4294967295\n' >"$fixture/tal/custom.constraints"
+mkdir -p "$work_root/output-denied" "$work_root/output-custom" "$work_root/output-disabled"
+run_validator "$work_root/output-denied" delta true
+printf 'allow 0.0.0.0/0\nallow ::/0\nallow 0 - 4294967295\n' >"$fixture/tal/allow.constraints"
+run_validator "$work_root/output-custom" delta true 'constraints = "/fixture/tal/allow.constraints"'
+printf 'malformed policy\n' >"$fixture/tal/custom.constraints"
+run_validator "$work_root/output-disabled" delta false 'constraints = "/fixture/tal/missing.constraints"'
+python3 - "$work_root" <<'PYTEST'
+import json, pathlib, sys
+root = pathlib.Path(sys.argv[1])
+for name, expected, enabled in [("denied", 0, True), ("custom", 2, True), ("disabled", 2, False)]:
+    out = root / f"output-{name}"
+    summary = json.loads((out / "summary.json").read_text())
+    assert summary["vrps"] == expected, summary
+    assert summary["taConstraintsEnabled"] == enabled, summary
+    assert len(summary["taConstraintsApplied"]) == int(enabled), summary
+    assert len((out / "vaps.csv").read_text().splitlines()) - 1 == (0 if name == "denied" else 1)
+    assert (out / "result-complete.json").exists()
+print("Constraints deny/custom/disabled payload checks passed with reused RRDP state")
+PYTEST
+rm "$fixture/tal/custom.constraints"
+
 echo "Synthetic Docker snapshot+delta E2E passed"
 
 # Exercise the actual public daemon in the image with a fresh protocol root.