补充 OSS 验证策略配置示例

docker/examples/README.md

@@ -9,6 +9,7 @@ startup, graceful stop and config reload.
 | validate.toml | Single run | /input/anchor.tal |
 | validate-all5.toml | Single run | Five named RIR TALs and constraints |
 | validate-localhost.toml | Single run | Generated localhost HTTPS repository and `/fixture/certs/rrdp-ca.pem` |
+| validate-policy.toml | Single run | Complete validation-policy and RRDP/rsync TOML settings |
 | daemon.toml | Continuous | /input/anchor.tal |
 | daemon-all5.toml | Continuous | Five named RIR TALs and constraints |
 
@@ -29,6 +30,10 @@ The all5 examples explicitly enable TA constraints. Copy `tals/*.tal` and
 or set top-level `ta-constraints-enabled = false` to disable all policies,
 including same-stem file discovery. See [provenance](../../tals/README.md).
 
+`validate-policy.toml` is an additive configuration showcase. The existing
+container examples intentionally omit the optional policy/transport keys and
+continue to use their documented defaults; they do not need to be changed.
+
 ## Local HTTPS test repository
 
 `validate-localhost.toml` explicitly sets `http-root-cert` to the CA generated

docker/examples/validate-policy.toml

@@ -0,0 +1,37 @@
+# Container-path configuration showcase for validation policy and rsync.
+# Copy the file outside this directory and set CONFIG_FILE to its absolute path.
+# The fixed validation time makes the example reproducible; update it or remove
+# the line when using it against a current public repository.
+config-version = 1
+mode = "validate"
+out = "/output/policy"
+rrdp-state-dir = "/state/policy"
+rrdp-sync-mode = "auto"
+ccr-out = "/output/policy/result.ccr"
+publish-dir = "/output/publish"
+
+resource-validation-mode = "validation-update-03" # or "rfc6487"
+validation-time = "2026-09-22T00:00:00Z"
+sync-preference = "rrdp-then-rsync" # or "rsync-only"
+rsync-timeout-secs = 30
+rsync-command = "/usr/bin/rsync"
+rsync-mirror-root = "/state/rsync-mirror"
+rsync-scope = "module-root" # "host" or "publication-point"
+
+run-timeout-secs = 1800
+require-complete = true
+ta-refresh-policy = "allow-valid-cache"
+log-level = "info"
+log-format = "text"
+
+[[anchors]]
+id = "anchor"
+tal = "/input/anchor.tal"
+# ta = "/input/anchor.cer" # uncomment to pin a fixed TA certificate
+
+# Keep the compatibility profile for a general public-repository example.
+# Set the first two fields to true to enable strict name/CMS DER checks.
+[strict]
+name = false
+cms-der = false
+signed-attrs = false

docs/configuration.md

@@ -227,11 +227,12 @@ copyable files:
 | --- | --- | --- |
 | validate-minimal.toml | Minimal single automatic TA | Required fields only; built-in defaults otherwise |
 | validate-full.toml | All common/validate settings and successful publication | Text logs, strict completion, 1,800-second budget |
+| validate-policy.toml | All validation-policy, validation-time and RRDP/rsync settings | Compatibility strict profile; fixed example validation time |
 | validate-fixed.toml | Fixed certificate | Both tal and ta; certificate must match and be valid |
 | daemon-all5.toml | Continuous five-TA automatic refresh | All common/daemon settings; max-runs omitted |
 | daemon-three.toml | Three five-TA cycles | max-runs=3, interval=0, independent state root |
 
-For containers, use the [four Docker configurations](../docker/examples/README.md).
+For containers, use the [Docker configurations](../docker/examples/README.md).
 Mounting a native relative-path example under /config does not automatically
 make its paths correct.
 

docs/docker.md

@@ -155,6 +155,11 @@ These templates use automatic **TA certificate** refresh, text/info logs and
 | `compose.daemon.yaml` | [daemon.toml](../docker/examples/daemon.toml) |
 | `compose.all5-daemon.yaml` | [daemon-all5.toml](../docker/examples/daemon-all5.toml) |
 
+`validate-policy.toml` is an additional configuration-only showcase for the
+validation-policy, validation-time and RRDP/rsync settings. Run it with
+`compose.yaml` after copying it outside the examples directory and setting
+`CONFIG_FILE` to the copied file.
+
 For example, from the repository root:
 
 ```bash

examples/config/README.md

@@ -9,6 +9,7 @@ also needs a valid, matching ripe.cer. No live inputs are bundled here.
 | --- | --- |
 | [validate-minimal.toml](validate-minimal.toml) | Minimal automatic TA; built-in defaults |
 | [validate-full.toml](validate-full.toml) | Common/validate settings, strict completion, successful publication |
+| [validate-policy.toml](validate-policy.toml) | All validation-policy, validation-time and RRDP/rsync transport settings |
 | [validate-fixed.toml](validate-fixed.toml) | Fixed TA certificate |
 | [validate-localhost.toml](validate-localhost.toml) | Generated localhost HTTPS repository with an explicit HTTP CA |
 | [daemon-all5.toml](daemon-all5.toml) | Five automatic TAs, continuous operation |
@@ -32,6 +33,11 @@ Full/daemon examples explicitly choose require-complete=true and
 run-timeout-secs=1800; built-in defaults are false and 0. Use the
 [Docker examples](../../docker/examples/README.md) for container paths.
 
+`validate-policy.toml` is an additive configuration showcase. The existing
+examples intentionally omit the optional policy/transport keys and therefore
+continue to use their documented built-in defaults; they do not need to be
+changed for this iteration.
+
 ## Local HTTPS test repository
 
 `validate-localhost.toml` is a runnable example for the generated repository

examples/config/validate-policy.toml

@@ -0,0 +1,47 @@
+# Configuration showcase for the validation-policy and rsync transport knobs.
+# Paths are relative to this TOML file.
+#
+# The fixed validation time makes this file reproducible. Update it or remove
+# the line when using the example against a current public repository.
+config-version = 1
+mode = "validate"
+out = "output/policy"
+rrdp-state-dir = "state/policy"
+rrdp-sync-mode = "auto"
+ccr-out = "output/policy/result.ccr"
+publish-dir = "publish/policy"
+
+resource-validation-mode = "validation-update-03" # or "rfc6487"
+validation-time = "2026-09-22T00:00:00Z"
+sync-preference = "rrdp-then-rsync" # or "rsync-only"
+rsync-timeout-secs = 30
+rsync-command = "/usr/bin/rsync" # change if rsync is installed elsewhere
+rsync-mirror-root = "state/policy-rsync-mirror"
+rsync-scope = "module-root" # "host" or "publication-point"
+
+ta-refresh-policy = "allow-valid-cache"
+max-ca-depth = 64
+http-timeout-secs = 300
+http-root-cert = []
+parallel-max-repo-sync-workers-global = 8
+parallel-phase2-object-workers = 8
+parallel-phase2-worker-queue-capacity = 256
+parallel-repo-worker-queue-capacity = 1024
+log-level = "info"
+log-format = "text"
+log-progress-interval-secs = 10
+require-complete = true
+run-timeout-secs = 1800
+
+[[anchors]]
+id = "ripe"
+tal = "input/ripe.tal"
+# ta = "input/ripe.cer" # uncomment for fixed mode
+# constraints = "input/ripe.constraints" # must exist when explicit
+
+# Keep the compatibility profile for a general public-repository example.
+# Set the first two fields to true to enable strict name/CMS DER checks.
+[strict]
+name = false
+cms-der = false
+signed-attrs = false