20260922 对齐 OSS 验证配置并补充 public TOML E2E

docs/command-line-reference.md

@@ -89,6 +89,14 @@ path types without network access, directory creation, state writes or locks.
 `--print-config` emits `configVersion`, `mode`, `effective`, `sources` and
 `normalizations` as JSON; defaults are filled and paths are absolute.
 
+Strict validation, resource validation mode, validation time, RRDP/rsync
+preference and all rsync tuning are TOML settings, not business CLI options.
+Use `[strict]` plus the top-level `resource-validation-mode`,
+`validation-time`, `sync-preference`, `rsync-timeout-secs`, `rsync-command`,
+`rsync-mirror-root` and `rsync-scope` keys. `--print-config` exposes their
+effective values and sources; an omitted validation time is generated for the
+inspection and recaptured when an actual run starts.
+
 Validation writes `summary.json`, `vrps.csv`, `vaps.csv`, timing files and an
 optional CCR. The final `result-complete.json` is written only after all required
 artifacts are ready. `resultStatus` is `success`, `partial` or `failed`:

docs/configuration.md

@@ -1,6 +1,6 @@
 # Complete TOML configuration reference (schema v1)
 
-This reference documents all 26 top-level settings and four anchor fields. The product provides validation and a daemon
+This reference documents all top-level settings and four anchor fields. The product provides validation and a daemon
 that schedules validation cycles. SLURM, RTR, ROV, HTTP/API services, offline
 validation and additional payload JSON export are outside this configuration.
 
@@ -66,11 +66,43 @@ those choices do not change the built-in defaults.
 | `log-progress-interval-secs` | Nonnegative integer, seconds | 10 | Periodic progress interval. Zero disables periodic progress, not other stage messages. Levels off/error/warn do not start a progress thread. |
 | `require-complete` | Boolean | false | A partial run exits 0 when false, 3 when true. Does not change validation rules, turn partial into success, or permit partial publication. |
 | `run-timeout-secs` | Nonnegative integer, seconds | 0 | Whole-run budget; zero disables it. Validate includes runtime TA acquisition and output preparation. Daemon measures from child startup and enforces the budget in the controller. Check/print do not use this budget. |
+| `resource-validation-mode` | String | `validation-update-03` | Resource validation profile. Allowed values are `validation-update-03` and `rfc6487`; the selected profile is passed to object and certificate validation. |
+| `validation-time` | RFC3339 string | Omitted: current UTC at run start | Logical validation clock for certificate, CRL and object validity. The value is normalized to UTC whole seconds. Network timeouts, TA `fetchedAt` and run timing remain wall-clock time. |
+| `sync-preference` | String | `rrdp-then-rsync` | Repository transport preference. `rrdp-then-rsync` uses RRDP with rsync fallback; `rsync-only` disables RRDP. This is independent from `rrdp-sync-mode`, which controls state/snapshot/delta handling. |
+| `rsync-timeout-secs` | Positive integer, seconds | 30 | Rsync I/O timeout. Zero is rejected; it is not an unlimited value. |
+| `rsync-command` | Absolute executable path | Omitted: `rsync` from `PATH` | Replacement rsync executable. The path must name an existing executable file. Shell strings, wrappers with inline arguments and argument arrays are not accepted. |
+| `rsync-mirror-root` | Directory path | Omitted | Persistent root for rsync mirrors. Relative paths are resolved against the configuration file; the root and per-module directories are created at runtime as needed. |
+| `rsync-scope` | String | `module-root` | Rsync request scope. Allowed values are `host`, `publication-point` and `module-root`. |
+| `strict` | TOML table | All three fields false | Strict validation switches; see section 2.1. |
 
 Integers are also limited by TOML and the target platform's integer types.
 Larger worker counts do not guarantee higher throughput; consider CPU, memory
 and repository-service load.
 
+### 2.1 Strict validation table
+
+The optional `[strict]` table exposes the strict capabilities already used by
+the private RP. Omit the table, or set all fields to `false`, for compatibility
+mode. Set all fields to `true` for the complete strict profile; combinations are
+allowed.
+
+```toml
+[strict]
+name = true
+cms-der = true
+signed-attrs = false
+```
+
+`name` enables strict RPKI resource-certificate name checks, including TA
+binding checks. `cms-der` rejects CMS encodings that are BER-compatible but not
+strict DER; when it is false, the existing compatibility path may accept the
+object and emit a warning. `signed-attrs` is retained for policy compatibility,
+but it does not invent a second behavior branch: the required, duplicate and
+unknown signed-attribute profile checks remain fixed as in the private RP.
+
+`strict` is a table, not a list, and it has no separate `enabled` field. Unknown
+fields inside the table are rejected.
+
 ## 3. Validate-only settings
 
 These keys are rejected in daemon configurations, even when set to their usual
@@ -113,13 +145,14 @@ otherwise 3 if strict completion is enabled and any cycle was partial; otherwise
 | --- | --- | --- | --- |
 | `id` | String | TAL filename stem | Identifier in results, logs and constraints. An explicitly empty string also falls back to the filename stem. Resolved IDs must be nonempty and unique; explicit names are preferred. |
 | `tal` | File path | Required | TAL obtained from an independently trusted source; must exist and parse during preflight. Contains certificate URIs and the trusted public key. |
-| `ta` | File path | Omitted: automatic mode | If present, selects a fixed DER TA certificate. Preflight checks binding, certificate profile/signature and validity. Network downloads do not silently replace it. |
+| `ta` | File path | Omitted: automatic mode | If present, selects a fixed DER TA certificate. Preflight checks binding, certificate profile/signature and validity at `validation-time` (or the current UTC run clock). Network downloads do not silently replace it. |
 | `constraints` | File path | Discover same-stem `.constraints` | For ripe.tal, try ripe.constraints. Absence of that file means no additional constraints. When ta-constraints-enabled is true, an explicit path must exist and parse. Omitting this setting does not disable discovery; an empty string is not a disable switch. Set top-level `ta-constraints-enabled = false` to disable all constraints. |
 
 Automatic refresh updates the **TA certificate, never the TAL file**. Each
 validate run or daemon cycle tries the TAL's HTTPS/rsync URIs in order. There is
 no separate background refresh timer, and no invented HTTPS alternative for an
-rsync-only TAL. Candidates must pass certificate and TAL-binding validation.
+rsync-only TAL. Candidates must pass certificate and TAL-binding validation at
+the configured logical validation time.
 
 The cache is `<rrdp-state-dir>.ta-cache`, keyed by the TAL public-key SHA-256.
 Download failure permits fallback only under allow-valid-cache with a usable,
@@ -257,12 +290,43 @@ Replace existing top-level settings; do not add duplicate keys. Prepare the
 custom TLS PEM file first, or keep [] when no extra roots are needed. This does
 not change the TAL public key, relax TA validation or disable system TLS checks.
 
+### 8.4 Validation policy and rsync transport: top-level fragment
+
+```toml
+resource-validation-mode = "validation-update-03" # or "rfc6487"
+validation-time = "2026-09-22T00:00:00Z" # omit for the UTC clock at run start
+sync-preference = "rrdp-then-rsync" # or "rsync-only"
+rsync-timeout-secs = 30
+rsync-command = "/usr/bin/rsync" # omit to use rsync from PATH
+rsync-mirror-root = "state/rsync-mirror" # optional persistent mirror root
+rsync-scope = "module-root" # host, publication-point, or module-root
+
+[strict]
+name = false
+cms-der = false
+signed-attrs = false
+```
+
+`validation-time` is the logical time used for certificate, CRL and resource
+validity throughout one run. If omitted, the run captures one UTC value at
+startup; `--print-config` shows an inspection-time effective value, while the
+actual run captures its own value. `fetchedAt`, network timeout measurement and
+run duration remain wall-clock metadata.
+
+`rsync-command` is passed directly to the process launcher. It must be an
+absolute executable path, with no shell syntax or inline arguments. The mirror
+root and scope affect repository rsync synchronization; they do not turn
+`rrdp-sync-mode = "delta"` into rsync-only. Use `sync-preference = "rsync-only"`
+for that transport choice.
+
 ## 9. Preflight and troubleshooting
 
 Check first, print effective configuration, then run normally. Check does not
 use the network, take runtime locks or create run directories. It reads TOML,
-TALs, fixed TAs, constraints and extra HTTP roots. Print performs the same checks
-and emits effective settings, sources and normalizations.
+TALs, fixed TAs, constraints and extra HTTP roots, and validates rsync command
+paths without invoking them. Print performs the same checks and emits effective
+settings, sources and normalizations. An omitted `validation-time` is shown as
+a generated default and is recaptured when the actual validation run starts.
 
 For example, setting http-timeout-secs to 0 and the repository queue to 256
 produces this excerpt, not the full print output:
@@ -287,6 +351,9 @@ produces this excerpt, not the full print output:
 | Unknown anchor field log-format | Move it before the first [[anchors]] table. |
 | Out is not allowed in daemon | Remove validate-only keys; the controller owns output. |
 | Zero workers/queues/max-runs/retention | Use positive values; omit max-runs for unlimited cycles. |
+| Invalid validation-time | Use an RFC3339 timestamp such as `2026-09-22T00:00:00Z`; offsets are accepted and normalized to UTC. |
+| Invalid rsync command | Use an existing absolute executable path only; omit the field to use `rsync` from `PATH`. |
+| RRDP still used | `rrdp-sync-mode = "delta"` is not a transport preference; set `sync-preference = "rsync-only"`. |
 | File not found | Resolve paths against the config directory; check container mounts. |
 | No automatic TA cache | First use needs a successful download; fixed cer files do not seed the cache. |
 | Preflight passes, runtime fails | Check does not test network reachability, runtime locks or actual writes. |