20261015 实现RRDP失步检测与TA证书择优

tests/support/generate_repository.py

@@ -545,6 +545,29 @@ def make_https_certificates(output: Path) -> None:
     write_key(output / "certs/rrdp-server.key", server_key)
 
 
+def make_ta_variants(output: Path, name: x509.Name, key, foreign_key) -> None:
+    """Real self-signed versions of one TAL-bound key, for tiebreaker tests."""
+    variants = {
+        "older": (datetime(2025, 1, 1, tzinfo=UTC), VALID_TO),
+        "newer": (datetime(2026, 5, 1, tzinfo=UTC), VALID_TO),
+        "shorter": (VALID_FROM, datetime(2026, 12, 31, tzinfo=UTC)),
+        "longer": (VALID_FROM, datetime(2030, 1, 1, tzinfo=UTC)),
+        "equal-period": (VALID_FROM, VALID_TO),
+        "expired": (datetime(2025, 1, 1, tzinfo=UTC), datetime(2025, 12, 31, tzinfo=UTC)),
+        "future": (datetime(2027, 1, 1, tzinfo=UTC), datetime(2028, 1, 1, tzinfo=UTC)),
+        "wrong-key": (VALID_FROM, VALID_TO),
+    }
+    for serial, (variant, (start, end)) in enumerate(variants.items(), 0x14700100):
+        selected_key = foreign_key if variant == "wrong-key" else key
+        certificate = sign_cert(
+            name, name, selected_key.public_key(), selected_key, serial, True, selected_key,
+            ip_ext=ip_resources([CHILD_PREFIX]), as_ext=as_resources([TEST_ASN]),
+            ca_repository=ROOT_REPO_URI, manifest_uri=ROOT_MFT_URI, notify_uri=RRDP_URI,
+            not_before=start, not_after=end,
+        )
+        write(output / f"ta-variants/{variant}.cer", certificate.public_bytes(Encoding.DER))
+
+
 def main() -> None:
     global RRDP_HOST, FOREIGN_RRDP_HOST, RRDP_PORT, RSYNC_HOST, RSYNC_PORT
     global TAL_URI, TAL_HTTPS_URI, RRDP_URI, STRICT_NAMES
@@ -638,6 +661,7 @@ def main() -> None:
     ).encode()
     write(output / "tal/custom.tal", tal)
     write(output / "ta/custom-ta.cer", root_cert.public_bytes(Encoding.DER))
+    make_ta_variants(output, root_name, root_key, child_key)
     with tempfile.TemporaryDirectory(prefix="custom-rpki-cms-") as temp:
         work = Path(temp)
         common = output / ".common"