open-source/qinglong
1
0
Fork 0
mirror of https://github.com/whyour/qinglong.git synced 2026-09-23 12:05:27 +08:00
Code Issues Packages Projects Releases Wiki Activity

feat(ql3): revalidate release evidence at closure

Browse Source
This commit is contained in:
whyour
2026-08-18 02:41:41 +08:00
parent cc6d6b7b48
commit 7ac5e678ba
11 changed files with 269 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/ql3-private-release-evidence-receipt-contract.cjs
+12 -1
View File
@@ -382,9 +382,20 @@ function inspectPrivateReleaseEvidenceReceipt(actual, options) {
) {
fail('receipt shape or release binding is invalid');
}
if (!Number.isFinite(Date.parse(actual.evidence.observedAt))) {
const observedAtMs = Date.parse(actual.evidence.observedAt);
if (!Number.isFinite(observedAtMs)) {
fail('receipt freshness binding is invalid');
}
if (options.validationClockMs !== undefined) {
const validationClockMs = options.validationClockMs;
if (
!Number.isSafeInteger(validationClockMs) ||
observedAtMs > validationClockMs + MAX_FUTURE_SKEW_MS ||
validationClockMs - observedAtMs > MAX_EVIDENCE_AGE_SECONDS * 1000
) {
fail('receipt is outside the release freshness window');
}
}
const { receiptDigest, ...unsigned } = actual;
if (
!DIGEST_PATTERN.test(receiptDigest || '') ||