cmd/age-keylookup: check checkpoint freshness in monitor mode

Author: FiloSottile

cmd/age-keylookup/main.go

@@ -243,11 +243,26 @@ func monitorLog(serverURL string, policy torchwood.Policy, vrfKey *vrf.PublicKey
 	if err != nil {
 		return nil, fmt.Errorf("failed to read checkpoint: %w", err)
 	}
-	checkpoint, _, err := torchwood.VerifyCheckpoint(signedCheckpoint, policy)
+	checkpoint, n, err := torchwood.VerifyCheckpoint(signedCheckpoint, policy)
 	if err != nil {
 		return nil, fmt.Errorf("failed to parse checkpoint: %w", err)
 	}
 
+	// Check the checkpoint is fresh
+	for _, sig := range n.Sigs {
+		if sig.Name == checkpoint.Origin {
+			// The log's signature doesn't include a timestamp, for legacy reasons.
+			continue
+		}
+		t, err := torchwood.CosignatureTimestamp(sig)
+		if err != nil {
+			return nil, fmt.Errorf("failed to extract cosignature %q timestamp: %w", sig.Name, err)
+		}
+		if time.Since(time.Unix(t, 0)) > 6*time.Hour {
+			return nil, fmt.Errorf("checkpoint cosignature %q is too old", sig.Name)
+		}
+	}
+
 	// Fetch all entries up to the checkpoint size
 	var pubkeys []string
 	for i, entry := range c.AllEntries(context.Background(), checkpoint.Tree, 0) {

cmd/age-keyserver/main.go

@@ -129,7 +129,7 @@ func main() {
 	// remove integration latency for the first request. Keep a 1s checkpoint
 	// interval not to hit the witnesses too often; this will be observed only
 	// if two requests come in quick succession. Finally, only publish a
-	// checkpoint once a day if there are no new entries, making the average qps
+	// checkpoint every hour if there are no new entries, making the average qps
 	// on witnesses low. Poll for new checkpoints quickly since it should be
 	// just a read from a hot filesystem cache.
 	checkpointInterval := 1 * time.Second
@@ -140,7 +140,7 @@ func main() {
 		WithCheckpointSigner(s).
 		WithBatching(1, tessera.DefaultBatchMaxAge).
 		WithCheckpointInterval(checkpointInterval).
-		WithCheckpointRepublishInterval(24*time.Hour).
+		WithCheckpointRepublishInterval(1*time.Hour).
 		WithWitnesses(witnesses, nil))
 	if err != nil {
 		log.Fatalln("failed to create log appender:", err)

cosignature.go

@@ -180,7 +180,10 @@ func keyHash(name string, key []byte) uint32 {
 }
 
 // CosignatureTimestamp returns the timestamp of the cosignature, which is the
-// time at which the witness signed the checkpoint.
+// time at which the witness signed the checkpoint, in seconds since the Unix epoch.
+//
+// Witnesses can re-sign a checkpoint, but only if it's for the latest tree they
+// have seen. Thus, the timestamp can be used to determine if a checkpoint is fresh.
 func CosignatureTimestamp(sig note.Signature) (int64, error) {
 	sigBytes, err := base64.StdEncoding.DecodeString(sig.Base64)
 	if err != nil {