fix(test): use temp file in sr_crl_10 instead of test_data submodule

The test relied on test_data/certificates/openssl/prime256v1.crl which is
not available in all CI environments (submodule not checked out for some
jobs). Replace with a self-contained tempfile::NamedTempFile write so the
test is hermetic on every runner. Rephrase inline comment to avoid lychee
false-positive on file:// placeholder text.

Author: Manuthor

crate/server/src/core/operations/validate.rs

@@ -1136,24 +1136,38 @@ mod tests {
         );
     }
 
-    /// SR-CRL-10: file:// URIs are permitted in test builds and resolve to disk.
+    /// SR-CRL-10: `file://` URIs are permitted in test builds and resolve to disk.
     ///
-    /// Uses an existing CRL fixture from `test_data/` to verify the happy path.
+    /// Creates a self-contained temp file so this test works in all CI
+    /// environments regardless of whether the `test_data` submodule is present.
     #[actix_web::test]
     async fn sr_crl_10_file_uri_allowed_in_tests() {
-        // Use the CRL fixture checked into the repository.
-        let crl_path = concat!(
-            env!("CARGO_MANIFEST_DIR"),
-            "/../../../test_data/certificates/openssl/prime256v1.crl"
-        );
-        let uri = format!("file://{crl_path}");
+        use std::io::Write as _;
+
+        // Write sentinel bytes to a temp file — content does not need to be a
+        // valid CRL; `get_crl_bytes` only performs I/O, not parsing.
+        let mut tmp =
+            tempfile::NamedTempFile::new().expect("failed to create temp file for SR-CRL-10");
+        let sentinel: &[u8] = b"SR-CRL-10-sentinel";
+        tmp.write_all(sentinel)
+            .expect("failed to write sentinel bytes");
+        tmp.flush().expect("failed to flush temp file");
+
+        let path = tmp.path().to_str().expect("temp path is not valid UTF-8");
+        // Build the canonical file URI (three slashes: scheme + empty authority + absolute path).
+        let uri = format!("file://{path}");
+
         let result = get_crl_bytes(vec![uri.clone()], None, None)
             .await
             .expect("file:// CRL should succeed in test builds");
+
         assert!(
             result.contains_key(&uri),
             "Result map must contain the file:// URI as key"
         );
-        assert!(!result[&uri].is_empty(), "CRL bytes must not be empty");
+        assert_eq!(
+            result[&uri], sentinel,
+            "Returned bytes must match the sentinel written to the temp file"
+        );
     }
 }

documentation/docs/configuration/log-reference.md

@@ -689,6 +689,19 @@ Crate path: `crate/server`
 | `info` | `JoinSplitKey: CO ceremony auto-activated via reconstructed key` | `src/core/operations/join_split_key.rs` | - | - |
 | `info` | `PEER_REVOCATION_CLEANUP: revoked victim GET access on caller's share` | `src/core/kms/permissions.rs` | - | - |
 | `debug` | `JoinSplitKey: shares reconstructed` | `src/core/operations/join_split_key.rs` | - | - |
+| `warn` | `[{idx}] CRL distribution point unreachable for '{:?}', skipping                          revocation check: {e}` | `src/core/operations/validate.rs` | `idx`, `e` | - |
+| `warn` | `CRL signature could not be verified against chain issuers;                          issuer: {crl_issuer:?}, path: {crl_path}.                          Continuing (trusted local delivery).` | `src/core/operations/validate.rs` | `crl_issuer`, `crl_path` | - |
+| `warn` | `CRL validation failed: {crl_err}` | `src/core/operations/validate.rs` | `crl_err` | - |
+| `info` | `GET /certificates/{}/crl` | `src/routes/crl.rs` | - | - |
+| `info` | `GET /public/certificates/{}/crl (unauthenticated)` | `src/routes/crl.rs` | - | - |
+| `debug` | `Auto-injecting CRL Distribution Point: {crl_url}` | `src/core/operations/certify/build_certificate.rs` | `crl_url` | - |
+| `debug` | `CRL cache hit: {uri}` | `src/core/operations/validate.rs` | `uri` | - |
+| `debug` | `CRL fetched: uri={uri} size={}` | `src/core/operations/validate.rs` | `uri` | - |
+| `debug` | `CRL generated successfully for issuer '{}': {} entries, validity {} days` | `src/core/operations/generate_crl.rs` | - | - |
+| `debug` | `CRL response received: uri={uri} status={}` | `src/core/operations/validate.rs` | `uri` | - |
+| `debug` | `Generating CRL for issuer certificate: {}` | `src/core/operations/generate_crl.rs` | - | - |
+| `trace` | `Found {} revoked certificate(s) for issuer '{}'` | `src/core/operations/generate_crl.rs` | - | - |
+| `trace` | `Skipping certificate '{}': cannot parse DER: {e}` | `src/core/operations/generate_crl.rs` | `e` | - |
 
 ### `cosmian_kms_server_database`