Upstream comments, attribution and terms are retained in each original file. In particular, read the ARIN disclaimer in arin.tal before using it. These third-party data files are not relicensed under the Panda RPKI source-code license. See OpenBSD's copyright policy for its distribution policy; the per-file notices and referenced terms remain applicable.

The files contain trust-anchor locators and local resource policy, not TA certificates. Automatic TA certificate refresh does not update these files. Constraints limit resources accepted for signed objects beneath the matching anchor; review upstream changes before adopting them.

Use and customization

Copy the ten files into a directory you manage and set Compose INPUT_DIR to that directory. Both all5 TOML examples explicitly enable constraints and use /input/<rir>.constraints. Edit those files or set an anchor's constraints path to another file under the input mount. To disable the policy globally, set top-level ta-constraints-enabled = false before [[anchors]]. See configuration and Docker instructions for validation and stop/check/recreate steps. Files are re-read for each validation run; a running validation uses its loaded policy snapshot.

Updating the vendored snapshot

Select and record a full OpenBSD commit SHA; fetch all ten files from that same commit's etc/rpki/ directory (never mix floating master revisions).
Preserve bytes, filenames and notices; review TAL keys/URIs and every policy change, including per-file notices. Update this provenance and SHA256SUMS.
Run cargo test --locked and configuration checks for both all5 templates, then validate output differences before deploying.
Update operator-managed copies explicitly. Image upgrades must not overwrite a user's edited constraints; keep backups to roll back policy changes.