43 lines
2.3 KiB
Markdown
43 lines
2.3 KiB
Markdown
# RIR trust anchors and resource constraints
|
|
|
|
These five TALs and five matching constraints files are unmodified copies from
|
|
[OpenBSD src/etc/rpki](https://github.com/openbsd/src/tree/c10aa57bf0a6504676d00e24f531b5a0f3fa19de/etc/rpki).
|
|
|
|
- Upstream repository: https://github.com/openbsd/src
|
|
- Pinned commit: `c10aa57bf0a6504676d00e24f531b5a0f3fa19de`
|
|
- Retrieved: 2026-09-18 (UTC)
|
|
- Integrity: `cd tals && sha256sum --check SHA256SUMS`
|
|
|
|
Upstream comments, attribution and terms are retained in each original file.
|
|
In particular, read the ARIN disclaimer in `arin.tal`
|
|
before using it. These third-party data files are not relicensed under the
|
|
Panda RPKI source-code license. See OpenBSD's [copyright policy](https://www.openbsd.org/policy.html)
|
|
for its distribution policy; the per-file notices and referenced terms remain applicable.
|
|
|
|
The files contain trust-anchor locators and local resource policy, not TA
|
|
certificates. Automatic TA certificate refresh does not update these files.
|
|
Constraints limit resources accepted for signed objects beneath the matching
|
|
anchor; review upstream changes before adopting them.
|
|
|
|
## Use and customization
|
|
|
|
Copy the ten files into a directory you manage and set Compose `INPUT_DIR` to
|
|
that directory. Both all5 TOML examples explicitly enable constraints and use
|
|
`/input/<rir>.constraints`. Edit those files or set an anchor's `constraints`
|
|
path to another file under the input mount. To disable the policy globally,
|
|
set top-level `ta-constraints-enabled = false` before `[[anchors]]`.
|
|
See [configuration](../docs/configuration.md) and [Docker instructions](../docs/docker.md)
|
|
for validation and stop/check/recreate steps. Files are re-read for each
|
|
validation run; a running validation uses its loaded policy snapshot.
|
|
|
|
## Updating the vendored snapshot
|
|
|
|
1. Select and record a full OpenBSD commit SHA; fetch all ten files from that
|
|
same commit's `etc/rpki/` directory (never mix floating master revisions).
|
|
2. Preserve bytes, filenames and notices; review TAL keys/URIs and every policy
|
|
change, including per-file notices. Update this provenance and `SHA256SUMS`.
|
|
3. Run `cargo test --locked` and configuration checks for both all5 templates,
|
|
then validate output differences before deploying.
|
|
4. Update operator-managed copies explicitly. Image upgrades must not overwrite
|
|
a user's edited constraints; keep backups to roll back policy changes.
|