28 lines
1.4 KiB
Markdown
28 lines
1.4 KiB
Markdown
# Synthetic RPKI test data
|
|
|
|
`generate_repository.py` creates a fresh RFC-shaped RPKI hierarchy with new
|
|
keys for each test process. It provides TAL/TA bootstrap files, CA/CRL,
|
|
manifest, ROA, ASPA, RRDP snapshot and delta documents, and a locally issued
|
|
HTTPS certificate. `serve_repository.py` is the deliberately minimal HTTPS
|
|
server used by the deterministic runtime and Docker tests.
|
|
|
|
No RIR production TAL, certificate, publication-point object, cache, or live
|
|
network request is included in this directory. The generator requires Python
|
|
`cryptography`, OpenSSL's `cms` command, and Python 3; CI installs those test
|
|
tools explicitly. Test output is created under a temporary directory and is
|
|
not part of a release artifact.
|
|
# Security recovery and TA selection
|
|
|
|
`cargo test --offline --test security_recovery_e2e` runs the real CLI against a
|
|
local HTTPS repository with persisted state. Across three processes it checks
|
|
initial snapshot, recovery after a delta-hash mutation at unchanged session/serial,
|
|
and a subsequent noop. Request assertions prove that no historical delta is
|
|
downloaded. A newer cached TA must survive a valid older download under
|
|
`require-fresh`, with a successful result and no cache-fallback count.
|
|
|
|
To preserve the per-step request and summary evidence:
|
|
|
|
```sh
|
|
python3 tests/support/test_security_recovery.py target/debug/panda-rpki --proof /tmp/security-recovery.json
|
|
```
|