metadata early warning system

[Cantor, Scott]

On 4/5/18, 11:37 AM, "dev on behalf of Tom Scavo" <dev-bounces at shibboleth.net on behalf of trscavo at gmail.com> wrote:

> If @creationInstant is allowed to be in the future, then it is a
> useless piece of metadata and that's the end of it.

There are no mandatory semantics for that attribute, it's informational. Has nothing to do with validity. It's not NotBefore.

> Suppose
> maxValidityInterval="P14D". On day #1, the issuer creates N files with identical content:

That's impossible since validUntil is an absolute time; those files would all be different. There is no validity computation that isn't based on an absolute time comparison.

If somebody signed ten different files whose validUntil was fixed, so the file was identical, time only moves forward and if the original metadata file was acceptable on day 1, it would remain acceptable on day 10 with a shorter window.
 
-- Scott