Skip to content

Keep the tolerance reasoning out of the package #115

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Automation51D merged 1 commit into from
Aug 30, 2026
Merged

Keep the tolerance reasoning out of the package #115

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 4 additions & 12 deletions pipeline.did/src/main/java/fiftyone/pipeline/did/DidClient.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -99,12 +99,6 @@ public final class DidClient {
*/
public static final Duration KEY_LIST_MAX_AGE = Duration.ofDays(1);

/**
* How far outside its own period a key may be used, at either end,
* matching the cloud's own verification. A key belongs to its own
* period; this allowance exists only for the small ways a creation time
* can land a moment outside the period whose key made it.
*/
static final Duration BOUNDARY_TOLERANCE = Duration.ofMinutes(15);

private static final String USER_AGENT = "pipeline.did/" + version();
Expand Down Expand Up @@ -430,12 +424,10 @@ static SigningKey inForceAt(List<SigningKey> entries, Instant at) {

/**
* The entries that may have signed something created at the moment,
* best first: the entry in force, then the entry in force a tolerance
* earlier and the entry in force a tolerance later where those differ.
* Deliberately not every earlier entry, because accepting any earlier
* entry would mean one leaked period of key material could sign
* something dated in any later period, and rotating the key would then
* bound nothing.
* best first, being the entry in force and then the neighbouring entry
* either side of a nearby key boundary where those differ.
* Deliberately not every earlier entry, and not a rule to relax here,
* because the cloud applies the same one.
*/
static List<SigningKey> candidatesFor(
List<SigningKey> entries, Instant at) {
Expand Down
Loading