# Synthetic RPKI test data

`generate_repository.py` creates a fresh RFC-shaped RPKI hierarchy with new
keys for each test process. It provides TAL/TA bootstrap files, CA/CRL,
manifest, ROA, ASPA, RRDP snapshot and delta documents, and a locally issued
HTTPS certificate. `serve_repository.py` is the deliberately minimal HTTPS
server used by the deterministic runtime and Docker tests.

No RIR production TAL, certificate, publication-point object, cache, or live
network request is included in this directory. The generator requires Python
`cryptography`, OpenSSL's `cms` command, and Python 3; CI installs those test
tools explicitly. Test output is created under a temporary directory and is
not part of a release artifact.
# Security recovery and TA selection

`cargo test --offline --test security_recovery_e2e` runs the real CLI against a
local HTTPS repository with persisted state. Across three processes it checks
initial snapshot, recovery after a delta-hash mutation at unchanged session/serial,
and a subsequent noop. Request assertions prove that no historical delta is
downloaded. A newer cached TA must survive a valid older download under
`require-fresh`, with a successful result and no cache-fallback count.

To preserve the per-step request and summary evidence:

```sh
python3 tests/support/test_security_recovery.py target/debug/panda-rpki --proof /tmp/security-recovery.json
```