Skip to content

Fix grace period mismatch: two-phase private key fetch with published… - #8

Open
Saurabhspi wants to merge 2 commits into
iSPIRT:mainfrom
Saurabhspi:saurabh/grace-period-key-range-fetch
Open

Fix grace period mismatch: two-phase private key fetch with published…#8
Saurabhspi wants to merge 2 commits into
iSPIRT:mainfrom
Saurabhspi:saurabh/grace-period-key-range-fetch

Conversation

@Saurabhspi

Copy link
Copy Markdown
Contributor

… key IDs

  • Add GetAllKeyIds() to public key fetcher interface and implementation
  • Update PrivateKeyFetcher::Refresh() to accept published public key IDs
  • Two-phase fetch: published keys by ID + latest key for forward readiness
  • Fix cache cleanup to skip currently published keys regardless of TTL
  • Add startup readiness gate in KeyFetcherManager
  • Fix Azure CreateHttpRequest to append kid when specific key requested
  • Update mocks and tests for new method signatures

… key IDs

- Add GetAllKeyIds() to public key fetcher interface and implementation
- Update PrivateKeyFetcher::Refresh() to accept published public key IDs
- Two-phase fetch: published keys by ID + latest key for forward readiness
- Fix cache cleanup to skip currently published keys regardless of TTL
- Add startup readiness gate in KeyFetcherManager
- Fix Azure CreateHttpRequest to append kid when specific key requested
- Update mocks and tests for new method signatures

Co-authored-by: Cursor <cursoragent@cursor.com>
@Saurabhspi
Saurabhspi force-pushed the saurabh/grace-period-key-range-fetch branch from b3c14fe to 861695c Compare July 23, 2026 09:18
Use the response encryption key ID for successful ListByKeyId assembly so unwrap results keyed by coordinator ID match published OHTTP request IDs.

Co-authored-by: Cursor <cursoragent@cursor.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant