Harden first-release validation and dependency hygiene

tests/cli_errors.rs

@@ -0,0 +1,64 @@
+use std::process::Command;
+
+fn command() -> Command {
+    let mut cmd = Command::new(env!("CARGO_BIN_EXE_panda-rpki"));
+    cmd.env_remove("PANDA_RPKI_LOG_LEVEL")
+        .env_remove("PANDA_RPKI_LOG_FORMAT");
+    cmd
+}
+
+#[test]
+fn help_is_successful_and_goes_to_stdout() {
+    for args in [vec![], vec!["--help"], vec!["-h"]] {
+        let result = command().args(args).output().unwrap();
+        assert!(result.status.success());
+        assert!(String::from_utf8_lossy(&result.stdout).contains("panda-rpki"));
+        assert!(result.stderr.is_empty());
+    }
+}
+
+#[test]
+fn invalid_command_returns_two_without_stdout() {
+    let result = command().arg("not-a-command").output().unwrap();
+    assert_eq!(result.status.code(), Some(2));
+    assert!(result.stdout.is_empty());
+    assert!(String::from_utf8_lossy(&result.stderr).contains("unknown command"));
+}
+
+#[test]
+fn malformed_validation_arguments_do_not_create_outputs() {
+    let directory = tempfile::tempdir().unwrap();
+    for args in [
+        vec!["validate", "--out", "output"],
+        vec!["validate", "--unknown", "value"],
+        vec!["validate", "--out"],
+    ] {
+        let result = command()
+            .current_dir(directory.path())
+            .args(args)
+            .output()
+            .unwrap();
+        assert_eq!(result.status.code(), Some(2));
+        assert!(result.stdout.is_empty());
+        assert_eq!(std::fs::read_dir(directory.path()).unwrap().count(), 0);
+    }
+}
+
+#[test]
+fn missing_daemon_state_root_fails_without_creating_state() {
+    let directory = tempfile::tempdir().unwrap();
+    let result = command()
+        .current_dir(directory.path())
+        .args([
+            "daemon",
+            "--",
+            "--tal",
+            "missing.tal",
+            "--ta",
+            "missing.cer",
+        ])
+        .output()
+        .unwrap();
+    assert_eq!(result.status.code(), Some(2));
+    assert_eq!(std::fs::read_dir(directory.path()).unwrap().count(), 0);
+}

tests/synthetic_docker_e2e.sh

@@ -38,7 +38,12 @@ for _ in $(seq 1 50); do
 done
 rg -qx 'ready' "$work_root/server.log"
 
-docker build -f "$repo_root/docker/Dockerfile" -t panda-rpki:synthetic-e2e "$repo_root"
+image="${PANDA_RPKI_TEST_IMAGE:-panda-rpki:synthetic-e2e}"
+if [[ -z "${PANDA_RPKI_TEST_IMAGE:-}" ]]; then
+    docker build -f "$repo_root/docker/Dockerfile" -t "$image" "$repo_root"
+else
+    docker image inspect "$image" >/dev/null
+fi
 run_validator() {
     local out="$1"
     local mode="$2"
@@ -46,7 +51,7 @@ run_validator() {
         -v "$fixture:/fixture:ro" \
         -v "$work_root/state:/state" \
         -v "$out:/output" \
-        panda-rpki:synthetic-e2e validate \
+        "$image" validate \
         --tal /fixture/tal/custom.tal --ta /fixture/ta/custom-ta.cer \
         --http-root-cert /fixture/certs/rrdp-ca.pem \
         --http-timeout-secs 5 \
@@ -94,7 +99,7 @@ daemon_container="panda-rpki-daemon-$(basename "$work_root")"
 docker run --rm --name "$daemon_container" --network host --read-only --tmpfs /tmp \
     --user "$(id -u):$(id -g)" \
     -v "$fixture:/fixture:ro" -v "$work_root/daemon:/data" \
-    panda-rpki:synthetic-e2e daemon \
+    "$image" daemon \
     --state-root /data --max-runs 3 --interval-secs 2 --retain-runs 3 -- \
     --tal /fixture/tal/custom.tal --ta /fixture/ta/custom-ta.cer \
     --http-root-cert /fixture/certs/rrdp-ca.pem --log-format json \