pesigchek signature validation fails for binary signed by expired certificate

[rhboot]

pesigchek signature validation fails for binary signed by expired certificate

[frozencemetery]

pesigcheck failed to validate signatures done by expired certificate.

I don't know why you'd expect anything different. Note that pesign isn't what's actually running and performing validation on the machine during boot - pesign is in userspace, for performing and checking signatures.

[iokomin]

@frozencemetery thanks for looking into it, your evaluation makes sense to me if signature validation done by expired certificate outside of the validity time frame considered as invalid.

Trying to get desired behavior taking into account test certificate in the pesign package is intentionally expired, see https://bugzilla.redhat.com/show_bug.cgi?id=1411213#c5.
Could you please take a look at the atTime calculation logic and share your thoughts on the target purpose? See snippet

pesign/src/certdb.c

Lines 369 to 391 in e0ea290

	notBefore = earlyNow;
	notAfter = lateNow;
	find_cert_times(cinfo, &notBefore, &notAfter);
	if (earlyNow < notBefore)
	earlyNow = notBefore;
	if (lateNow > notAfter)
	lateNow = notAfter;
	// atTime = determine_reasonable_time(cert);
	eTime = SEC_PKCS7GetSigningTime(cinfo);
	if (eTime != NULL) {
	if (DER_DecodeTimeChoice (&atTime, eTime) == SECSuccess) {
	if (earlyNow < atTime)
	earlyNow = atTime;
	if (lateNow > atTime)
	lateNow = atTime;
	}
	}
	if (lateNow < earlyNow)
	printf("Signature has impossible time constraint: %lld <= %lld\n",
	earlyNow / 1000000LL, lateNow / 1000000LL);
	atTime = earlyNow / 2 + lateNow / 2;

Curious about line 391 assignment for atTime variable.