20260914 强制 TOML 配置并完善 TA 刷新与 daemon

docs/trust-anchors.md

@@ -1,9 +1,37 @@
 # Prepare all five RIR trust anchors
 
-Panda RPKI requires a TAL and a matching DER-encoded TA certificate for each
-anchor. The TAL supplies the trusted public key; the certificate supplies the
-current trust-anchor certificate. A certificate alone is not a substitute for
-an independently obtained TAL. No RIR inputs are bundled with this project.
+For every field, default, constraint and complete example, see the [TOML configuration reference](configuration.md)。
+
+Panda RPKI requires a TAL for each configured anchor. The TAL supplies the
+trusted public key and its certificate URI. You may pin a matching DER-encoded
+TA certificate in TOML, or omit `ta` and let Panda fetch, validate and cache the
+current certificate on each run. A certificate alone is not a substitute for an
+independently obtained TAL. No RIR inputs are bundled with this project.
+
+## Automatic and fixed certificate modes
+
+Automatic mode requires only an independently obtained TAL:
+
+```toml
+# Top-level setting, before any [[anchors]] table:
+ta-refresh-policy = "allow-valid-cache"
+
+[[anchors]]
+id = "ripe"
+tal = "input/ripe.tal"
+# No ta field: refresh the TA certificate at each validate run / daemon cycle.
+```
+
+Add `ta = "input/ripe.cer"` inside that anchor to select fixed mode. Anchors can
+mix modes. Fixed files are never replaced by the automatic cache. The TAL itself
+is never automatically updated: operators maintain its URIs and trusted key.
+All download candidates and cached fallback certificates must pass TA validation,
+TAL key binding and validity checks. A valid-cache fallback yields partial;
+`require-fresh` disallows it. Check-config does not test download reachability.
+
+The download/pair-check sections below are optional for fixed mode. Automatic
+mode follows the URIs actually present in the TAL; it does not invent HTTPS
+alternatives for an rsync-only TAL.
 
 ## Official sources
 
@@ -85,7 +113,7 @@ for rir in afrinic apnic arin lacnic ripe; do
 done
 ```
 
-## Download the TA certificates
+## Optional: download certificates for fixed mode
 
 After checking that the URI lines match the table, run in the same Bash shell
 (which defines `fetch_https`):
@@ -112,7 +140,7 @@ fetch_https https://rpki.apnic.net/repository/apnic-rpki-root-iana-origin.cer in
 Always verify the downloaded certificate against the independently obtained
 TAL, including when using this alternative endpoint.
 
-## Check the pairs and run
+## Optional: check fixed TAL/TA pairs
 
 The following checks DER parsing, expiration, and equality of the certificate's
 SubjectPublicKeyInfo with the TAL key. They are input sanity checks, not a full
@@ -136,13 +164,15 @@ for rir in afrinic apnic arin lacnic ripe; do
 done
 ```
 
-You now have ten files in `input/`, named exactly as expected by the
-[all-five Compose example](docker.md#all-five-regional-anchors). For the
-single-anchor README example only, copy a chosen pair to `input/anchor.tal`
-and `input/anchor.cer`, or change the CLI arguments to use its RIR filenames.
+You now have five TALs and, if using fixed mode, five matching certificates in
+`input/`. Put those paths in the named `[[anchors]]` tables shown in the
+[usage example](usage.md#multiple-anchors-and-constraints). To use automatic
+refresh, omit the corresponding `ta` line; the first run requires outbound
+HTTPS/rsync access and later runs may use the valid keyed cache when policy is
+`allow-valid-cache`.
 
-Keep inputs out of version control. Monitor certificate validity and RIR
-announcements; Panda RPKI does not refresh supplied TA files automatically.
-Stage and check updated pairs before replacing active inputs between runs.
+Keep inputs out of version control. Monitor TAL changes and RIR announcements.
+Panda RPKI never rewrites supplied TA files; automatic mode refreshes a separate
+cache. Stage and check updated pairs before replacing active inputs between runs.
 Never resolve a key mismatch by replacing the TAL key with the downloaded
 certificate's key: retrieve the current TAL from the RIR and investigate first.