add OpenBSD TA constraints and localhost TLS examples

tests/cli_errors.rs

@@ -91,3 +91,50 @@ fn config_mode_and_mutually_exclusive_inspection_flags_are_rejected() {
     assert_eq!(result.status.code(), Some(2));
     assert!(String::from_utf8_lossy(&result.stderr).contains("mutually exclusive"));
 }
+
+#[test]
+fn all5_examples_load_vendored_constraints_and_disable_ignores_missing_files() {
+    let directory = tempfile::tempdir().unwrap();
+    let repo = std::path::Path::new(env!("CARGO_MANIFEST_DIR"));
+    for (mode, example) in [
+        ("validate", "validate-all5.toml"),
+        ("daemon", "daemon-all5.toml"),
+    ] {
+        let raw = std::fs::read_to_string(repo.join("docker/examples").join(example))
+            .unwrap()
+            .replace("/input", repo.join("tals").to_str().unwrap())
+            .replace("/output", directory.path().join("out").to_str().unwrap())
+            .replace("/state", directory.path().join("state").to_str().unwrap())
+            .replace("/data", directory.path().join("data").to_str().unwrap());
+        let config = directory.path().join(example);
+        for (enabled, missing, expected) in [(true, false, 0), (true, true, 2), (false, true, 0)] {
+            let mut text = raw.replace(
+                "ta-constraints-enabled = true",
+                &format!("ta-constraints-enabled = {enabled}"),
+            );
+            if missing {
+                text = text.replace(".constraints\"", ".missing\"");
+            }
+            std::fs::write(&config, text).unwrap();
+            for inspect in ["--check-config", "--print-config"] {
+                let result = command()
+                    .args([mode, "--config", config.to_str().unwrap(), inspect])
+                    .output()
+                    .unwrap();
+                assert_eq!(
+                    result.status.code(),
+                    Some(expected),
+                    "{}",
+                    String::from_utf8_lossy(&result.stderr)
+                );
+                if inspect == "--print-config" && expected == 0 {
+                    let printed: serde_json::Value =
+                        serde_json::from_slice(&result.stdout).unwrap();
+                    assert_eq!(printed["effective"]["ta-constraints-enabled"], enabled);
+                }
+            }
+        }
+        assert!(!directory.path().join("out").exists());
+        assert!(!directory.path().join("data").exists());
+    }
+}