# RIR trust anchors and resource constraints

These five TALs and five matching constraints files are unmodified copies from
[OpenBSD src/etc/rpki](https://github.com/openbsd/src/tree/c10aa57bf0a6504676d00e24f531b5a0f3fa19de/etc/rpki).

- Upstream repository: https://github.com/openbsd/src
- Pinned commit: `c10aa57bf0a6504676d00e24f531b5a0f3fa19de`
- Retrieved: 2026-09-18 (UTC)
- Integrity: `cd tals && sha256sum --check SHA256SUMS`

Upstream comments, attribution and terms are retained in each original file.
In particular, read the ARIN disclaimer in `arin.tal`
before using it. These third-party data files are not relicensed under the
Panda RPKI source-code license. See OpenBSD's [copyright policy](https://www.openbsd.org/policy.html)
for its distribution policy; the per-file notices and referenced terms remain applicable.

The files contain trust-anchor locators and local resource policy, not TA
certificates. Automatic TA certificate refresh does not update these files.
Constraints limit resources accepted for signed objects beneath the matching
anchor; review upstream changes before adopting them.

## Use and customization

Copy the ten files into a directory you manage and set Compose `INPUT_DIR` to
that directory. Both all5 TOML examples explicitly enable constraints and use
`/input/<rir>.constraints`. Edit those files or set an anchor's `constraints`
path to another file under the input mount. To disable the policy globally,
set top-level `ta-constraints-enabled = false` before `[[anchors]]`.
See [configuration](../docs/configuration.md) and [Docker instructions](../docs/docker.md)
for validation and stop/check/recreate steps. Files are re-read for each
validation run; a running validation uses its loaded policy snapshot.

## Updating the vendored snapshot

1. Select and record a full OpenBSD commit SHA; fetch all ten files from that
   same commit's `etc/rpki/` directory (never mix floating master revisions).
2. Preserve bytes, filenames and notices; review TAL keys/URIs and every policy
   change, including per-file notices. Update this provenance and `SHA256SUMS`.
3. Run `cargo test --locked` and configuration checks for both all5 templates,
   then validate output differences before deploying.
4. Update operator-managed copies explicitly. Image upgrades must not overwrite
   a user's edited constraints; keep backups to roll back policy changes.