fix(EC-1993): reject past --effective-time values by default

cmd/compare/compare.go

@@ -26,15 +26,17 @@ import (
 	"github.com/spf13/cobra"
 	"sigs.k8s.io/yaml"
 
+	"github.com/conforma/cli/internal/policy"
 	"github.com/conforma/cli/internal/policy/equivalence"
 )
 
 var (
-	effectiveTime string
-	imageDigest   string
-	imageRef      string
-	imageURL      string
-	outputFormat  string
+	effectiveTime          string
+	allowPastEffectiveTime bool
+	imageDigest            string
+	imageRef               string
+	imageURL               string
+	outputFormat           string
 )
 
 var CompareCmd *cobra.Command
@@ -74,6 +76,7 @@ Examples:
 	}
 
 	compareCmd.Flags().StringVar(&effectiveTime, "effective-time", "now", "Effective time for policy evaluation (RFC3339 format, 'now')")
+	compareCmd.Flags().BoolVar(&allowPastEffectiveTime, "allow-past-effective-time", false, "Allow setting --effective-time to a date in the past")
 	compareCmd.Flags().StringVar(&imageDigest, "image-digest", "", "Image digest for volatile config matching")
 	compareCmd.Flags().StringVar(&imageRef, "image-ref", "", "Image reference for volatile config matching")
 	compareCmd.Flags().StringVar(&imageURL, "image-url", "", "Image URL for volatile config matching")
@@ -84,20 +87,12 @@ Examples:
 
 func runCompare(cmd *cobra.Command, args []string) error {
 
-	// Parse effective time
-	var effectiveTimeValue time.Time
-	switch effectiveTime {
-	case "now":
-		effectiveTimeValue = time.Now().UTC()
-	case "attestation":
-		// For now, use current time as default for attestation time
+	effectiveTimeValue, err := policy.ParseEffectiveTime(effectiveTime, allowPastEffectiveTime)
+	if err != nil {
+		return err
+	}
+	if effectiveTimeValue.IsZero() {
 		effectiveTimeValue = time.Now().UTC()
-	default:
-		var err error
-		effectiveTimeValue, err = time.Parse(time.RFC3339, effectiveTime)
-		if err != nil {
-			return fmt.Errorf("invalid effective time format: %w", err)
-		}
 	}
 
 	// Create image info if provided

cmd/validate/image.go

@@ -202,7 +202,8 @@ func validateImageCmd(validate imageValidationFunc) *cobra.Command {
 			data.policyConfiguration = policyConfiguration
 
 			policyOptions := policy.Options{
-				EffectiveTime: data.effectiveTime,
+				EffectiveTime:          data.effectiveTime,
+				AllowPastEffectiveTime: data.allowPastEffectiveTime,
 				Identity: cosign.Identity{
 					Issuer:        data.certificateOIDCIssuer,
 					IssuerRegExp:  data.certificateOIDCIssuerRegExp,
@@ -547,6 +548,11 @@ func validateImageCmd(validate imageValidationFunc) *cobra.Command {
 		a RFC3339 formatted value, e.g. 2022-11-18T00:00:00Z.
 	`))
 
+	cmd.Flags().BoolVar(&data.allowPastEffectiveTime, "allow-past-effective-time", false, hd.Doc(`
+		Allow setting --effective-time to a date in the past. By default, dates
+		more than 5 minutes in the past are rejected.
+	`))
+
 	cmd.Flags().StringSliceVar(&data.extraRuleData, "extra-rule-data", data.extraRuleData, hd.Doc(`
 		Extra data to be provided to the Rego policy evaluator. Use format 'key=value'. May be used multiple times.
 	`))
@@ -633,6 +639,7 @@ type imageData struct {
 	certificateOIDCIssuer       string
 	certificateOIDCIssuerRegExp string
 	effectiveTime               string
+	allowPastEffectiveTime      bool
 	extraRuleData               []string
 	filePath                    string
 	filterType                  string

cmd/validate/image_test.go

@@ -598,6 +598,7 @@ spec:
 				"/policy.yaml",
 				"--effective-time",
 				"1970-01-01",
+				"--allow-past-effective-time",
 			}...)
 			cmd.SetArgs(args)
 

cmd/validate/input.go

@@ -43,20 +43,21 @@ type InputValidationFunc func(context.Context, string, policy.Policy, bool) (*ou
 
 func validateInputCmd(validate InputValidationFunc) *cobra.Command {
 	data := struct {
-		effectiveTime       string
-		filePaths           []string
-		forceColor          bool
-		info                bool
-		namespaces          []string
-		noColor             bool
-		output              []string
-		policy              policy.Policy
-		policyConfiguration string
-		strict              bool
-		workers             int
-		serverMode          bool
-		serverAddress       string
-		serverPort          int
+		effectiveTime          string
+		allowPastEffectiveTime bool
+		filePaths              []string
+		forceColor             bool
+		info                   bool
+		namespaces             []string
+		noColor                bool
+		output                 []string
+		policy                 policy.Policy
+		policyConfiguration    string
+		strict                 bool
+		workers                int
+		serverMode             bool
+		serverAddress          string
+		serverPort             int
 	}{
 		strict:        true,
 		workers:       5,
@@ -168,7 +169,7 @@ func validateInputCmd(validate InputValidationFunc) *cobra.Command {
 			}
 			data.policyConfiguration = policyConfiguration
 
-			if p, err := policy.NewInputPolicy(cmd.Context(), data.policyConfiguration, data.effectiveTime); err != nil {
+			if p, err := policy.NewInputPolicy(cmd.Context(), data.policyConfiguration, data.effectiveTime, data.allowPastEffectiveTime); err != nil {
 				allErrors = errors.Join(allErrors, err)
 			} else {
 				data.policy = p
@@ -349,6 +350,10 @@ func validateInputCmd(validate InputValidationFunc) *cobra.Command {
 		effective dates in the future. The value can be "now" (default) - for
 		current time, or a RFC3339 formatted value, e.g. 2022-11-18T00:00:00Z.`))
 
+	cmd.Flags().BoolVar(&data.allowPastEffectiveTime, "allow-past-effective-time", false, hd.Doc(`
+		Allow setting --effective-time to a date in the past. By default, dates
+		more than 5 minutes in the past are rejected.`))
+
 	cmd.Flags().BoolVar(&data.info, "info", data.info, hd.Doc(`
 		Include additional information on the failures. For instance for policy
 		violations, include the title and the description of the failed policy

docs/modules/ROOT/pages/ec_compare.adoc

@@ -33,6 +33,7 @@ ec compare <policy1> <policy2> [flags]
 ----
 == Options
 
+--allow-past-effective-time:: Allow setting --effective-time to a date in the past (Default: false)
 --effective-time:: Effective time for policy evaluation (RFC3339 format, 'now') (Default: now)
 -h, --help:: help for compare (Default: false)
 --image-digest:: Image digest for volatile config matching

docs/modules/ROOT/pages/ec_validate_image.adoc

@@ -111,6 +111,9 @@ Use a regular expression to match certificate attributes.
 
 == Options
 
+--allow-past-effective-time:: Allow setting --effective-time to a date in the past. By default, dates
+more than 5 minutes in the past are rejected.
+ (Default: false)
 --attestation-format:: Attestation output format: dsse (signed envelope), predicate (raw JSON) (Default: dsse)
 --attestation-output-dir:: Directory for attestation output files. Defaults to a temp directory under /tmp. Must be under /tmp or the current working directory.
 --certificate-identity:: URL of the certificate identity for keyless verification

docs/modules/ROOT/pages/ec_validate_input.adoc

@@ -75,6 +75,8 @@ Start the server on a custom port:
 
 == Options
 
+--allow-past-effective-time:: Allow setting --effective-time to a date in the past. By default, dates
+more than 5 minutes in the past are rejected. (Default: false)
 --color:: Enable color when using text output even when the current terminal does not support it (Default: false)
 --effective-time:: Run policy checks with the provided time. Useful for testing rules with
 effective dates in the future. The value can be "now" (default) - for

docs/modules/ROOT/pages/verify-conforma-konflux-ta.adoc

@@ -57,6 +57,9 @@ paths can be provided by using the `:` separator.
 *EFFECTIVE_TIME* (`string`):: Run policy checks with the provided time.
 +
 *Default*: `now`
+*ALLOW_PAST_EFFECTIVE_TIME* (`string`):: Allow setting EFFECTIVE_TIME to a date in the past.
++
+*Default*: `false`
 *EXTRA_RULE_DATA* (`string`):: Merge additional Rego variables into the policy data. Use syntax "key=value,key2=value2..."
 *POLICY_BUNDLE_DIGEST* (`string`):: Optional OCI digest to pin the release policy bundle. When provided, the policy configuration is resolved and the reference oci::quay.io/conforma/release-policy:konflux is replaced with oci::quay.io/conforma/release-policy@<digest>. Accepts a full digest (sha256:abc123...) or just the hex hash (abc123...).
 +

docs/modules/ROOT/pages/verify-enterprise-contract.adoc

@@ -68,6 +68,9 @@ paths can be provided by using the `:` separator.
 *EFFECTIVE_TIME* (`string`):: Run policy checks with the provided time.
 +
 *Default*: `now`
+*ALLOW_PAST_EFFECTIVE_TIME* (`string`):: Allow setting EFFECTIVE_TIME to a date in the past.
++
+*Default*: `false`
 *EXTRA_RULE_DATA* (`string`):: Merge additional Rego variables into the policy data. Use syntax "key=value,key2=value2..."
 *POLICY_BUNDLE_DIGEST* (`string`):: Optional OCI digest to pin the release policy bundle. When provided, the policy configuration is resolved and the reference oci::quay.io/conforma/release-policy:konflux is replaced with oci::quay.io/conforma/release-policy@<digest>. Accepts a full digest (sha256:abc123...) or just the hex hash (abc123...).
 +

features/task_validate_image.feature

@@ -356,10 +356,11 @@ Feature: Verify Enterprise Contract Tekton Tasks
       {"publicKey": ${known_PUBLIC_KEY}}
       ```
     When version 0.1 of the task named "verify-enterprise-contract" is run with parameters:
-      | IMAGES               | {"components": [{"containerImage": "${REGISTRY}/acceptance/effective-time"}]} |
-      | POLICY_CONFIGURATION | ${NAMESPACE}/${POLICY_NAME}                                                   |
-      | IGNORE_REKOR         | true                                                                          |
-      | EFFECTIVE_TIME       | 2020-01-01T00:00:00Z                                                          |
+      | IMAGES                       | {"components": [{"containerImage": "${REGISTRY}/acceptance/effective-time"}]} |
+      | POLICY_CONFIGURATION         | ${NAMESPACE}/${POLICY_NAME}                                                   |
+      | IGNORE_REKOR                 | true                                                                          |
+      | EFFECTIVE_TIME               | 2020-01-01T00:00:00Z                                                          |
+      | ALLOW_PAST_EFFECTIVE_TIME    | true                                                                          |
     Then the task should succeed
       And the task logs for step "show-config" should contain `"effective-time": "2020-01-01T00:00:00Z"`
 

features/validate_image.feature

@@ -851,7 +851,7 @@ Feature: evaluate enterprise contract
       ]
     }
     """
-    When ec command is run with "validate image --image ${REGISTRY}/acceptance/image --policy acceptance/ec-policy --rekor-url ${REKOR} --public-key ${known_PUBLIC_KEY} --output=json --effective-time 2014-05-31 --show-successes"
+    When ec command is run with "validate image --image ${REGISTRY}/acceptance/image --policy acceptance/ec-policy --rekor-url ${REKOR} --public-key ${known_PUBLIC_KEY} --output=json --effective-time 2014-05-31 --allow-past-effective-time --show-successes"
     Then the exit status should be 0
     And the output should match the snapshot
 

internal/input/report_test.go

@@ -414,7 +414,7 @@ sources:
       exclude:
         []
 `
-	p, err := policy.NewInputPolicy(ctx, policyConfiguration, "now")
+	p, err := policy.NewInputPolicy(ctx, policyConfiguration, "now", false)
 	assert.NoError(t, err)
 	return p
 }

internal/input/validate_test.go

@@ -146,7 +146,7 @@ func Test_ValidatePipeline(t *testing.T) {
 	errFile := afero.WriteFile(appFS, validFile, []byte("data"), 0o777)
 	assert.NoError(t, errFile)
 	ctx := utils.WithFS(context.Background(), appFS)
-	policy, err := policy.NewInputPolicy(ctx, "", "2023-01-01T00:00:00.00Z")
+	policy, err := policy.NewInputPolicy(ctx, "", "2023-01-01T00:00:00.00Z", true)
 	assert.NoError(t, err)
 
 	for _, tt := range tests {

internal/policy/policy.go

@@ -167,21 +167,22 @@ func (p *policy) SigstoreOpts() (SigstoreOpts, error) {
 }
 
 type Options struct {
-	EffectiveTime     string
-	Identity          cosign.Identity
-	IgnoreRekor       bool
-	SkipImageSigCheck bool
-	SkipAttSigCheck   bool
-	PolicyRef         string
-	PublicKey         string
-	RekorURL          string
+	EffectiveTime          string
+	AllowPastEffectiveTime bool
+	Identity               cosign.Identity
+	IgnoreRekor            bool
+	SkipImageSigCheck      bool
+	SkipAttSigCheck        bool
+	PolicyRef              string
+	PublicKey              string
+	RekorURL               string
 }
 
 // NewOfflinePolicy construct and return a new instance of Policy that is used
 // in offline scenarios, i.e. without cluster or specific services access, and
 // no signature verification being performed.
 func NewOfflinePolicy(ctx context.Context, effectiveTime string) (Policy, error) {
-	if efn, err := parseEffectiveTime(effectiveTime); err == nil {
+	if efn, err := parseEffectiveTime(effectiveTime, true); err == nil {
 		return &policy{
 			effectiveTime: efn,
 			choosenTime:   effectiveTime,
@@ -219,8 +220,8 @@ func NewInertPolicy(ctx context.Context, policyRef string) (Policy, error) {
 // resource in Kubernetes using the format: [namespace/]name
 //
 // If policyRef is blank, an empty EnterpriseContractPolicySpec is used.
-func NewInputPolicy(ctx context.Context, policyRef string, effectiveTime string) (Policy, error) {
-	if efn, err := parseEffectiveTime(effectiveTime); err == nil {
+func NewInputPolicy(ctx context.Context, policyRef string, effectiveTime string, allowPastEffectiveTime bool) (Policy, error) {
+	if efn, err := parseEffectiveTime(effectiveTime, allowPastEffectiveTime); err == nil {
 		p := policy{
 			choosenTime: effectiveTime,
 			checkOpts:   &cosign.CheckOpts{},
@@ -299,7 +300,7 @@ func NewPolicy(ctx context.Context, opts Options) (Policy, error) {
 		}
 	}
 
-	if efn, err := parseEffectiveTime(opts.EffectiveTime); err != nil {
+	if efn, err := parseEffectiveTime(opts.EffectiveTime, opts.AllowPastEffectiveTime); err != nil {
 		return nil, err
 	} else {
 		p.effectiveTime = efn
@@ -421,7 +422,28 @@ func isNow(choosenTime string) bool {
 	return strings.EqualFold(choosenTime, Now)
 }
 
-func parseEffectiveTime(choosenTime string) (*time.Time, error) {
+// pastEffectiveTimeGracePeriod is the tolerance for clock skew when rejecting
+// past effective-time values. Times within this window are accepted even
+// without --allow-past-effective-time.
+const pastEffectiveTimeGracePeriod = 5 * time.Minute
+
+// ParseEffectiveTime parses the effective-time string and returns the resolved
+// time. It accepts "now", "attestation", RFC3339, or YYYY-MM-DD formats. When
+// allowPast is false, times more than 5 minutes in the past are rejected.
+// The "attestation" sentinel returns a zero time.Time — callers should handle
+// that case separately.
+func ParseEffectiveTime(choosenTime string, allowPast bool) (time.Time, error) {
+	t, err := parseEffectiveTime(choosenTime, allowPast)
+	if err != nil {
+		return time.Time{}, err
+	}
+	if t == nil {
+		return time.Time{}, nil
+	}
+	return *t, nil
+}
+
+func parseEffectiveTime(choosenTime string, allowPast bool) (*time.Time, error) {
 	switch {
 	case isNow(choosenTime):
 		now := now().UTC()
@@ -435,6 +457,9 @@ func parseEffectiveTime(choosenTime string) (*time.Time, error) {
 		if when, err := time.Parse(time.RFC3339, choosenTime); err == nil {
 			log.Debugf("Using provided effective time %s", when.Format(time.RFC3339))
 			whenUTC := when.UTC()
+			if err := rejectPastTime(whenUTC, allowPast); err != nil {
+				return nil, err
+			}
 			return &whenUTC, nil
 		}
 
@@ -444,6 +469,9 @@ func parseEffectiveTime(choosenTime string) (*time.Time, error) {
 		if when, err := time.Parse(DateFormat, choosenTime); err == nil {
 			log.Debugf("Using provided effective time %s", when.Format(time.RFC3339))
 			whenUTC := when.UTC()
+			if err := rejectPastTime(whenUTC, allowPast); err != nil {
+				return nil, err
+			}
 			return &whenUTC, nil
 		}
 		log.Debugf("Unable to parse provided effective time string `%s` using %s format", choosenTime, DateFormat)
@@ -453,6 +481,17 @@ func parseEffectiveTime(choosenTime string) (*time.Time, error) {
 	}
 }
 
+func rejectPastTime(when time.Time, allowPast bool) error {
+	if allowPast {
+		return nil
+	}
+	threshold := now().UTC().Add(-pastEffectiveTimeGracePeriod)
+	if when.Before(threshold) {
+		return fmt.Errorf("effective time %s is in the past; use --allow-past-effective-time to override", when.Format(time.RFC3339))
+	}
+	return nil
+}
+
 // checkOpts returns an instance based on attributes of the Policy.
 func checkOpts(ctx context.Context, p *policy) (*cosign.CheckOpts, error) {
 	var err error