sec: refactor handlers of expired cert

[tianyuan129]

Replace the UseSignatureTime and IgnoreValidity validation flags with an application-defined OnCertExpired callback, so that we can leave more flexibility on how apps handle expired signing keys.
The callback supports synchronous and asynchronous decisions:

type CertExpiredCallback func(
    args CertExpiredCallbackArgs,
    complete func(error),
)

• complete(nil) accepts the expired certificate.
• complete(err) rejects it.
• A nil policy rejects expired certificates by default (which is also the library default).

The previous three cases (reject/ignore/timestamp-check) now become three predefined callbacks.

// RejectExpiredCert rejects an expired certificate. -- the library default unless otherwise specified
func RejectExpiredCert(args ndn.CertExpiredCallbackArgs, complete func(error)) {
	complete(fmt.Errorf("certificate is expired: %s", args.Cert.Name()))
}

// IgnoreExpiredCert accepts an expired certificate without additional checks.
func IgnoreExpiredCert(_ ndn.CertExpiredCallbackArgs, complete func(error)) {
	complete(nil)
}

// ValidateAtSignatureTime accepts an expired validation chain when each
// affected Data packet was signed during its Cert's validity period.
func ValidateAtSignatureTime(args ndn.CertExpiredCallbackArgs, complete func(error)) {
	if ValidateSigTime(args.Data, args.Cert) {
		complete(nil)
		return
	}
	complete(fmt.Errorf("data not signed during validity period: %s", args.Cert.Name()))
}

[tianyuan129]

@greetingsuniverse

[Copilot]

🟡 Changes recommended

An expired cached CertList certificate can bypass the configured expiry callback and promote a trust anchor.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Replaces certificate-validity flags with a callback-based policy supporting synchronous and asynchronous expiry decisions.

Changes:

• Adds CertExpiredCallback and predefined expiry policies.
• Propagates expiry callbacks through validation, object consumption, SVS, and repository flows.
• Updates trust validation tests for default, ignored, signature-time, and asynchronous handling.

File summaries

File	Description
std/ndn/security.go	Defines the expiry callback API.
std/ndn/client.go	Exposes expiry policies in client arguments.
std/ndn/engine.go	Removes obsolete validation flags.
std/security/certificate.go	Adds predefined expiry policies.
std/security/trust_config.go	Integrates callback-based expiry handling.
std/security/trust_config_test.go	Updates expiry validation tests.
std/object/client_trust.go	Resumes validation on the engine goroutine.
std/object/client_consume.go	Propagates policies during object discovery.
std/object/client_consume_seg.go	Propagates policies during segment validation.
std/sync/svs.go	Configures SVS expiry handling.
std/sync/svs_alo.go	Shares SVS policy with snapshot strategies.
std/sync/svs_alo_data.go	Applies policy to ALO object consumption.
std/sync/snapshot_node_latest.go	Applies policy to latest snapshots.
std/sync/snapshot_node_history.go	Applies policy to historical snapshots.
repo/config.go	Maps repository configuration to policies.
repo/repo_svs.go	Configures repository SVS validation.
repo/repo_mgmt.go	Configures management-object validation.

Review details

• Files reviewed: 17/17 changed files
• Comments generated: 1
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟡 Changes recommended

Cross-schema validation supplies callback arguments that contradict the new public certificate callback contract.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

• Files reviewed: 17/17 changed files
• Comments generated: 1
• Review effort level: Balanced