- Parse and validate from snapshot JSON, reject future/missing timestamps
- Enforce snapshot age vs in cache and stale fallback (no lifetime extension on repeat S3 reads)
- OCSP: , ,
- Remove unused from signer
- Publisher heartbeats: , republish clean snapshots past interval, preserve dirty-only behavior and concurrency
- Config/env/docker/docs updates for heartbeat
Rolling upgrade: enable publisher heartbeats before deploying the age-enforcing responder so existing snapshots remain within the age window.
woggioni
aee1025015