Rework disabling of expiry check

Author: yim-lee

Package.swift

@@ -724,7 +724,8 @@ if ProcessInfo.processInfo.environment["SWIFTCI_USE_LOCAL_DEPS"] == nil {
         .package(url: "https://github.com/apple/swift-crypto.git", .upToNextMinor(from: "2.4.0")),
         .package(url: "https://github.com/apple/swift-system.git", .upToNextMinor(from: "1.1.1")),
         .package(url: "https://github.com/apple/swift-collections.git", .upToNextMinor(from: "1.0.1")),
-        .package(url: "https://github.com/apple/swift-certificates.git", .upToNextMinor(from: "0.2.0")),
+//        .package(url: "https://github.com/apple/swift-certificates.git", .upToNextMinor(from: "0.2.0")),
+        .package(url: "https://github.com/apple/swift-certificates.git", branch: "main"),
     ]
 } else {
     package.dependencies += [

Sources/PackageSigning/VerifierPolicies.swift

@@ -17,7 +17,7 @@ import struct Foundation.URL
 
 import Basics
 @_implementationOnly import SwiftASN1
-@_implementationOnly import X509
+@_implementationOnly @_spi(DisableValidityCheck) import X509
 
 extension SignatureProviderProtocol {
     func buildPolicySet(configuration: VerifierConfiguration, httpClient: HTTPClient) -> PolicySet {
@@ -26,25 +26,47 @@ extension SignatureProviderProtocol {
             _ADPCertificatePolicy(),
         ]
 
-        switch configuration.certificateExpiration {
-        case .enabled(let validationTime):
-            policies.append(_RFC5280Policy(validationTime: validationTime, enableExpiryCheck: true))
-        case .disabled:
-            policies.append(_RFC5280Policy(validationTime: .none, enableExpiryCheck: false))
-        }
-
-        switch configuration.certificateRevocation {
-        case .strict(let validationTime):
-            policies.append(_OCSPVerifierPolicy(httpClient: httpClient, mode: .strict, validationTime: validationTime))
-        case .allowSoftFail(let validationTime):
+        let now = Date()
+        switch (configuration.certificateExpiration, configuration.certificateRevocation) {
+        case (.enabled(let expiryValidationTime), .strict(let revocationValidationTime)):
+            policies.append(RFC5280Policy(validationTime: expiryValidationTime ?? now))
+            policies
+                .append(_OCSPVerifierPolicy(
+                    httpClient: httpClient,
+                    mode: .strict,
+                    validationTime: revocationValidationTime ?? now
+                ))
+        case (.enabled(let expiryValidationTime), .allowSoftFail(let revocationValidationTime)):
+            policies.append(RFC5280Policy(validationTime: expiryValidationTime ?? now))
             policies
                 .append(_OCSPVerifierPolicy(
                     httpClient: httpClient,
                     mode: .allowSoftFail,
-                    validationTime: validationTime
+                    validationTime: revocationValidationTime ?? now
                 ))
-        case .disabled:
-            ()
+        case (.enabled(let expiryValidationTime), .disabled):
+            policies.append(RFC5280Policy(validationTime: expiryValidationTime ?? now))
+        case (.disabled, .strict(let revocationValidationTime)):
+            // Always do expiry check (and before) if revocation check is enabled
+            policies.append(RFC5280Policy(validationTime: revocationValidationTime ?? now))
+            policies
+                .append(_OCSPVerifierPolicy(
+                    httpClient: httpClient,
+                    mode: .strict,
+                    validationTime: revocationValidationTime ?? now
+                ))
+        case (.disabled, .allowSoftFail(let revocationValidationTime)):
+            // Always do expiry check (and before) if revocation check is enabled
+            policies.append(RFC5280Policy(validationTime: revocationValidationTime ?? now))
+            policies
+                .append(_OCSPVerifierPolicy(
+                    httpClient: httpClient,
+                    mode: .allowSoftFail,
+                    validationTime: revocationValidationTime ?? now
+                ))
+        case (.disabled, .disabled):
+            // We should still do basic certificate validations even if expiry check is disabled
+            policies.append(RFC5280Policy.withValidityCheckDisabled())
         }
 
         return PolicySet(policies: policies)
@@ -97,32 +119,6 @@ struct _ADPCertificatePolicy: VerifierPolicy {
     }
 }
 
-struct _RFC5280Policy: VerifierPolicy {
-    /// See RFC5280Policy
-    public let verifyingCriticalExtensions: [ASN1ObjectIdentifier] = [
-        .X509ExtensionID.basicConstraints,
-        .X509ExtensionID.nameConstraints,
-        .X509ExtensionID.keyUsage,
-    ]
-
-    let validationTime: Date?
-    let enableExpiryCheck: Bool
-
-    func chainMeetsPolicyRequirements(chain: UnverifiedCertificateChain) async -> PolicyEvaluationResult {
-        let policy: RFC5280Policy
-        if self.enableExpiryCheck {
-            policy = RFC5280Policy(validationTime: self.validationTime ?? Date())
-        } else {
-            // Use leaf.notValidBefore as validationTime to ensure the leaf
-            // will pass expiry check. This should work for the chain if the
-            // chain follows validity nesting, but if a parent expires before
-            // a child does then the expiry check will fail.
-            policy = RFC5280Policy(validationTime: chain.leaf.notValidBefore)
-        }
-        return policy.chainMeetsPolicyRequirements(chain: chain)
-    }
-}
-
 struct _OCSPVerifierPolicy: VerifierPolicy {
     private static let cacheTTL: DispatchTimeInterval = .seconds(5 * 60)
     private let cache = ThreadSafeKeyValueStore<
@@ -135,10 +131,10 @@ struct _OCSPVerifierPolicy: VerifierPolicy {
 
     let verifyingCriticalExtensions: [ASN1ObjectIdentifier] = []
 
-    init(httpClient: HTTPClient, mode: Mode, validationTime: Date?) {
+    init(httpClient: HTTPClient, mode: Mode, validationTime: Date) {
         self.underlying = OCSPVerifierPolicy(
             requester: _OCSPRequester(httpClient: httpClient),
-            validationTime: validationTime ?? Date()
+            validationTime: validationTime
         )
         self.mode = mode
     }