{"record":{"id":"b92d035d60894d7f","repo":"kubernetes/kops","slug":"parsing-attested-document-expiration-w","errorCode":null,"errorMessage":"parsing attested document expiration: %w","messagePattern":"parsing attested document expiration: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/azure/attest.go","lineNumber":318,"sourceCode":"\t}\n\tcreatedOn, err := time.Parse(attestedDocumentTimeFormat, data.TimeStamp.CreatedOn)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"parsing attested document creation: %w\", err)\n\t}\n\tif createdOn.After(now.Add(attestedDocumentMaxClockSkew)) {\n\t\treturn nil, fmt.Errorf(\"attested document createdOn %s is too far in the future\", data.TimeStamp.CreatedOn)\n\t}\n\toldestAllowedCreatedOn := now.Add(-(attestedDocumentMaxAge + attestedDocumentMaxClockSkew))\n\tif createdOn.Before(oldestAllowedCreatedOn) {\n\t\treturn nil, fmt.Errorf(\"attested document createdOn %s is older than allowed freshness window of %s plus %s clock skew\", data.TimeStamp.CreatedOn, attestedDocumentMaxAge, attestedDocumentMaxClockSkew)\n\t}\n\tklog.V(4).Infof(\"Attested document createdOn is fresh (createdOn=%s now=%s)\", createdOn.Format(time.RFC3339), now.Format(time.RFC3339))\n\n\t// Verify the attested document has not expired and has a coherent lifetime.\n\tif data.TimeStamp.ExpiresOn != \"\" {\n\t\texpiresOn, err := time.Parse(attestedDocumentTimeFormat, data.TimeStamp.ExpiresOn)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"parsing attested document expiration: %w\", err)\n\t\t}\n\t\tif expiresOn.Before(createdOn) {\n\t\t\treturn nil, fmt.Errorf(\"attested document expiresOn %s is before createdOn %s\", data.TimeStamp.ExpiresOn, data.TimeStamp.CreatedOn)\n\t\t}\n\t\tif expiresOn.Before(now.Add(-attestedDocumentMaxClockSkew)) {\n\t\t\treturn nil, fmt.Errorf(\"attested document expired at %s\", data.TimeStamp.ExpiresOn)\n\t\t}\n\t\tklog.V(4).Infof(\"Attested document not expired (expiresOn=%s)\", expiresOn.Format(time.RFC3339))\n\t}\n\n\treturn &data, nil\n}\n\n// intermediateCertPoolWithCaches performs a cached lookup against the supplied positive and\n// negative TTL caches, invoking fetch on a miss. Tests inject their own stores and fetchers.\nfunc intermediateCertPoolWithCaches(signer *x509.Certificate, fetch func(*x509.Certificate) (*x509.CertPool, error), positive, negative expirationcache.Store) (*x509.CertPool, error) {\n\tif signer == nil {\n\t\treturn nil, fmt.Errorf(\"signer certificate is required\")","sourceCodeStart":300,"sourceCodeEnd":336,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/azure/attest.go#L300-L336","documentation":"The expiresOn timestamp of the attested document does not conform to the expected attestedDocumentTimeFormat, so document expiry cannot be evaluated. Malformed timestamp in the signed payload.","triggerScenarios":"Thrown at upup/pkg/fi/cloudup/azure/attest.go:318 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Reject the attestation token","Update kOps if Azure changed the timestamp format"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}