Commits on Jul 5, 2023

1. Fix audit signatures for expired keys …

   The current implementation of verifySignatures and verifyAttestations
   assumes the verification keys never expire as its checking if expiry is
   in the past, this means we can never roll these keys and verify old
   signatures that where signed with a still valid signing key.
   
   Kudos to @bdehamer for spotting this bug.
   
   This changes the key selector to allow keys that where valid before the
   package was published so we can roll new keys in future.
   
   There's an accompanying change required in npm-pick-manifest to expose
   the publish time. If this is not set I opted to use a fallback date,
   this isn't pretty but seems better than ignoring packages that don't
   have created at time? Open to suggeststions here!
   
   TODO:
   - Introduce `_time` in https://github.com/npm/npm-pick-manifest
   - Add a test for very old packages that don't have `time` in packument
   
   Signed-off-by: Philip Harrison <philip@mailharrison.com>

   

   feelepxyz committed Jul 5, 2023
   Configuration menu

   • View commit details
   • Copy full SHA for 1f7a3fe
   • Browse repository at this point

   Copy the full SHA

   1f7a3fe View commit details

   Browse the repository at this point in the history