fix(core): compute created-skew in checked arithmetic (#358)

[beardthelion]

Summary

check_created computed (now - created).abs() where created is attacker-supplied i64 from the created= signature param. now - created overflows on i64::MIN (panic in debug builds, wrap in release), and the wrapped value's abs() is i64::MIN again, which is not > 300: a signature claiming to be 2^63 seconds old read as fresh.

Motivation & context

Closes #358

Kind of change

• Bug fix
• Feature
• Security fix
• Docs
• Tests / CI
• Refactor (no behavior change)
• Breaking or protocol change (issue required first)

What changed

• crates/gitlawb-core/src/http_sig.rs: skew is now now.checked_sub(created).map(i64::unsigned_abs).unwrap_or(u64::MAX), so an unrepresentable difference is the largest possible skew rather than a wrap or a panic.
• New test extreme_created_timestamps_reject_without_wrapping drives i64::MIN, i64::MAX, and now - i64::MAX through HttpSignature::parse into check_created and asserts each rejects.

How a reviewer can verify

cargo test -p gitlawb-core http_sig

The new test panics on the old expression (verified by restoring (now - self.created).abs()), which is also the debug-build behavior this removes.

Before you request review

• Scope is one logical change; no unrelated churn
• cargo test -p gitlawb-core passes locally
• New behavior is covered by tests (required for fixes)
• cargo fmt --all and cargo clippy -p gitlawb-core --all-targets -- -D warnings are clean
• Commit titles use Conventional Commits (feat(...), fix(...), docs(...))
• Docs / .env.example updated if behavior or config changed (or N/A)
• Checked existing PRs so this isn't a duplicate

Protocol & signing impact

• Touches DID / did:key, Ed25519 / RFC 9421 signatures, UCAN, ref certs, or P2P wire formats
• Discussed in an issue before implementation
• Backward-compatible with existing nodes and previously signed history

Notes: the fix only rejects inputs that were always meant to fail the 300s freshness gate. No honestly-generated signature is affected.

Notes for reviewers

http_sig.rs is shared with open #306, #261, and #334, but check_created is a self-contained method; any conflicts should be context-only.

Summary by CodeRabbit

• Bug Fixes
  • Improved HTTP signature timestamp validation.
  • Extreme or overflow-prone timestamps are now rejected safely instead of causing errors or bypassing validation.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Essentials

Run ID: b28c4148-1ae2-4c0e-9f8b-cde62c318985

📥 Commits

Reviewing files that changed from the base of the PR and between bfc44f9 and aa30de3.

📒 Files selected for processing (1)

• crates/gitlawb-core/src/http_sig.rs

Included review availability: 2 reviews are currently available. Your included PR review attempts over the past 7 days set your current allowance at 4 reviews per hour.

---

📝 Walkthrough

Walkthrough

The timestamp freshness check now handles extreme created values with checked arithmetic. Overflow becomes maximum skew, which fails the existing freshness limit. Regression tests cover boundary and overflow-prone timestamps.

Changes

Timestamp freshness validation

Layer / File(s)	Summary
Safe timestamp difference validation crates/gitlawb-core/src/http_sig.rs	check_created replaces overflowing subtraction and signed absolute value with checked arithmetic. Tests verify rejection of extreme and overflow-prone timestamps.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix · Severity of issue fixed: Low

Suggested reviewers: kevincodex1

Merge Risk: ⚪ Minimal · up to aa30d

Extreme attacker-supplied timestamps are rejected safely, with no remaining actionable merge risk identified.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the core fix: safe checked arithmetic for created timestamp skew.
Description check	✅ Passed	The description follows the repository template. It explains the vulnerability, motivation, implementation, tests, verification commands, scope, compatibility, and checklist status.
Linked Issues check	✅ Passed	The change meets the coding requirements in issue #358. HttpSignature::check_created uses checked_sub, i64::unsigned_abs, and u64::MAX when the difference is not representable. This prevents d…
Out of Scope Changes check	✅ Passed	The changes stay within issue #358. The production change fixes timestamp-skew arithmetic in check_created. The added test verifies the required extreme timestamp cases. No unrelated behavior or fil…
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 4 functions across 1 files.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Greptile Summary

This PR hardens HTTP signature freshness validation against signed integer overflow.

• Computes timestamp skew with checked subtraction and unsigned absolute values.
• Treats unrepresentable timestamp differences as maximally stale.
• Adds regression coverage for extreme past and future timestamps.

Confidence Score: 5/5

The PR appears safe to merge and correctly closes the timestamp-overflow freshness bypass.

The checked arithmetic preserves existing behavior for representable skews while converting overflow into rejection, and the new tests exercise extreme values through the production parser and freshness check.

Important Files Changed

Filename	Overview
crates/gitlawb-core/src/http_sig.rs	Safely computes attacker-controlled timestamp skew and tests rejection of extreme values.

_{Reviews (1): Last reviewed commit: "fix(core): compute created-skew in check..." | Re-trigger Greptile}