Adjust test-sites.json churn rate

revoke-test/README.md

@@ -21,9 +21,9 @@ fuzzy: we actually just require that a majority of sites are detected as revoked
 of its revoked test website together with details of the certificate chain it
 presents.
 
-Certificate chains presented by the test websites have varying lifetimes, but these
-tests currently don't accept expired certificates.  That means the snapshot needs
-to be regularly refreshed.
+Certificate chains presented by the test websites have varying lifetimes, and as a result
+these tests currently accept expired certificates.  The tests enforce a 30-day limit on
+test data lifetime to avoid expiry becoming a significant factor.
 
 Refresh the snapshot with:
 

revoke-test/src/bin/fetch.rs

@@ -2,6 +2,7 @@ use core::str::FromStr;
 use std::borrow::Cow;
 use std::fs::File;
 use std::sync::Arc;
+use std::time::SystemTime;
 
 use eyre::{Report, Result};
 use http::Uri;
@@ -64,6 +65,10 @@ async fn main() -> Result<(), Report> {
         File::create("test-sites.json")?,
         &RevocationTestSites {
             sites: Cow::Borrowed(&sites),
+            timestamp: SystemTime::now()
+                .duration_since(SystemTime::UNIX_EPOCH)
+                .unwrap()
+                .as_secs(),
         },
     )?;
 

revoke-test/src/lib.rs

@@ -1,4 +1,6 @@
+use core::time::Duration;
 use std::borrow::Cow;
+use std::time::SystemTime;
 
 use aws_lc_rs::digest::{SHA256, digest};
 use base64::Engine;
@@ -14,6 +16,17 @@ use x509_parser::prelude::FromDer;
 #[derive(Debug, Deserialize, Serialize)]
 pub struct RevocationTestSites<'a> {
     pub sites: Cow<'a, [RevocationTestSite]>,
+    pub timestamp: u64,
+}
+
+impl RevocationTestSites<'_> {
+    pub fn expired(&self) -> bool {
+        let one_month = Duration::from_secs(60 * 60 * 24 * 30);
+        let deadline = SystemTime::UNIX_EPOCH
+            .checked_add(Duration::from_secs(self.timestamp) + one_month)
+            .unwrap();
+        SystemTime::now() > deadline
+    }
 }
 
 #[derive(Clone, Debug, Deserialize, Serialize)]