From 494d309ae0fd02c195f313964e878855eeb921ab Mon Sep 17 00:00:00 2001 From: James Rosewell Date: Sat, 29 Aug 2026 04:57:48 +0100 Subject: [PATCH] Keep the tolerance reasoning out of the package The javadoc above BOUNDARY_TOLERANCE explained what the allowance is for and what a key belonging to its own period protects against. The figure itself cannot be hidden in a public repository, so the explanation is what turned a duration into a described security parameter. The constant and its value stay, without a comment, because the name says what it is. The candidatesFor javadoc kept the sentence naming which entries are tried and lost the one spelling out that accepting any earlier entry would let one leaked period of key material sign something dated later. It now says the rule is not one to relax here because the cloud applies the same one, which stops a maintainer widening it without describing the attack to a reader. The verifySignatureDetailed javadoc is unchanged, because it names the behaviour rather than the purpose. No behaviour, no value and no test changed. Module suite 99 with 2 skipped, Java 8 signature check passing. --- .../java/fiftyone/pipeline/did/DidClient.java | 16 ++++------------ 1 file changed, 4 insertions(+), 12 deletions(-) diff --git a/pipeline.did/src/main/java/fiftyone/pipeline/did/DidClient.java b/pipeline.did/src/main/java/fiftyone/pipeline/did/DidClient.java index 7d26a577a..1372a136d 100644 --- a/pipeline.did/src/main/java/fiftyone/pipeline/did/DidClient.java +++ b/pipeline.did/src/main/java/fiftyone/pipeline/did/DidClient.java @@ -99,12 +99,6 @@ public final class DidClient { */ public static final Duration KEY_LIST_MAX_AGE = Duration.ofDays(1); - /** - * How far outside its own period a key may be used, at either end, - * matching the cloud's own verification. A key belongs to its own - * period; this allowance exists only for the small ways a creation time - * can land a moment outside the period whose key made it. - */ static final Duration BOUNDARY_TOLERANCE = Duration.ofMinutes(15); private static final String USER_AGENT = "pipeline.did/" + version(); @@ -430,12 +424,10 @@ static SigningKey inForceAt(List entries, Instant at) { /** * The entries that may have signed something created at the moment, - * best first: the entry in force, then the entry in force a tolerance - * earlier and the entry in force a tolerance later where those differ. - * Deliberately not every earlier entry, because accepting any earlier - * entry would mean one leaked period of key material could sign - * something dated in any later period, and rotating the key would then - * bound nothing. + * best first, being the entry in force and then the neighbouring entry + * either side of a nearby key boundary where those differ. + * Deliberately not every earlier entry, and not a rule to relax here, + * because the cloud applies the same one. */ static List candidatesFor( List entries, Instant at) {