coulomb/railiance-clock
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Harden authority sampling and health failures; prepare operations handoff

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0e6f0-a6f6-7b93-9124-55ef584930e2
This commit is contained in:
tegwick 2026-09-28 10:08:52 +02:00
parent a6db15d202
commit c976c9c277
8 changed files with 372 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

25
tests/test_clock.py
View file

@ -112,3 +112,28 @@ def test_restart_preserves_floor(setup):
payload.update(receive_unix_ns='50000000000',send_unix_ns='50001000000')
return sign(payload,key,'test-key')
with pytest.raises(ClockError):Clock(FileTrust(path),timer=timer,transport=older).read()
def test_rotation_requires_fresh_client_and_matching_signer(setup):
path, key, timer, transport = setup
old = Clock(FileTrust(path), timer=timer, transport=transport)
old.read()
replacement = ec.generate_private_key(ec.SECP256R1())
data = json.loads(path.read_text())
data['kid'] = 'rotated-key'
data['public_key_pem'] = replacement.public_key().public_bytes(
serialization.Encoding.PEM, serialization.PublicFormat.SubjectPublicKeyInfo).decode()
path.write_text(json.dumps(data))
with pytest.raises(ClockError):
old.read()
# Loading new trust must still refuse the old signer.
with pytest.raises(ClockError):
Clock(FileTrust(path), timer=timer, transport=transport).read()
def rotated(request):
payload = verify(transport(request), key.public_key(), 'test-key')
return sign(payload, replacement, 'rotated-key')
assert Clock(FileTrust(path), timer=timer, transport=rotated).read().authority_id == 'railiance01'
data['status'] = 'revoked'
path.write_text(json.dumps(data))
with pytest.raises(ClockError):
FileTrust(path)