generate_repository.py creates a fresh RFC-shaped RPKI hierarchy with new keys for each test process. It provides TAL/TA bootstrap files, CA/CRL, manifest, ROA, ASPA, RRDP snapshot and delta documents, and a locally issued HTTPS certificate. serve_repository.py is the deliberately minimal HTTPS server used by the deterministic runtime and Docker tests.

No RIR production TAL, certificate, publication-point object, cache, or live network request is included in this directory. The generator requires Python cryptography, OpenSSL's cms command, and Python 3; CI installs those test tools explicitly. Test output is created under a temporary directory and is not part of a release artifact.

Security recovery and TA selection

cargo test --offline --test security_recovery_e2e runs the real CLI against a local HTTPS repository with persisted state. Across three processes it checks initial snapshot, recovery after a delta-hash mutation at unchanged session/serial, and a subsequent noop. Request assertions prove that no historical delta is downloaded. A newer cached TA must survive a valid older download under require-fresh, with a successful result and no cache-fallback count.

To preserve the per-step request and summary evidence:

python3 tests/support/test_security_recovery.py target/debug/panda-rpki --proof /tmp/security-recovery.json