fix(policies): bound rego policy evaluation with an execution timeout

Merged
JI
2mo ago
+123-3

Summary

Rego policy evaluation had no time bound. The ExecutionTimeout engine option was only consumed by the WASM engine, and rego.NewEngine silently dropped it, so a rego evaluation was bounded only by the context supplied by the caller. That context carries no deadline in practice (the CLI passes cobra's command context, which is context.Background()), leaving a runaway policy — a pathological comprehension, a stuck chain of http.send calls — able to hang an attestation indefinitely.

Changes

  • The rego engine now honors ExecutionTimeout, falling back to a 60s default when unset, mirroring how the WASM engine handles its own default. The bound is applied to Verify as well as to the matches_parameters / matches_evaluation path. It derives from the caller's context, so a shorter caller deadline is still respected.
  • New policies.WithExecutionTimeout option on PolicyVerifier, defaulting to policies.DefaultExecutionTimeout (60s). The verifier forwards it to whichever engine runs the policy, so the bound applies uniformly and every caller (crafter, policy groups, local policy development) inherits it.
  • ExecutionTimeout is no longer documented as a WASM-only option.

Note that WASM policies evaluated through PolicyVerifier are now bounded at 60s rather than the engine's own 5s default.

AI disclosure

This contribution was produced with the assistance of Claude Code. Commits carry the Assisted-by: Claude Code trailer.