Add test to verify that faketime actually works

It does not work with golang.

Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>

Author: jku

clients/go-tuf/go-tuf.xfails

@@ -1,2 +1,6 @@
 # RSA-PSS is not yet supported (https://github.com/theupdateframework/go-tuf/pull/625)
 test_keytype_and_scheme[rsa/rsassa-pss-sha256]
+
+# golang is not compatible with faketime (https://github.com/theupdateframework/tuf-conformance/issues/263)
+# This means faketime-using tests cannot be trusted for go-tuf
+test_faketime

tuf_conformance/test_basic.py

@@ -1,3 +1,4 @@
+from datetime import UTC, datetime, timedelta
 import json
 import os
 
@@ -414,3 +415,22 @@ def test_incorrect_metadata_type(client: ClientRunner, server: SimulatorServer)
     # Client should refuse timestamp that has incorrect type field
     assert client.refresh(init_data) == 1
     assert client.trusted_roles() == [(Root.type, 2)]
+
+
+def test_faketime(client: ClientRunner, server: SimulatorServer) -> None:
+    """Ensures that client supports the faketime setup in this test suite"""
+    init_data, repo = server.new_test(client.test_name)
+
+    assert client.init_client(init_data) == 0
+
+    # root v2 expires in 7 days
+    now = datetime.now(UTC)
+    repo.root.expires = now + timedelta(days=7)
+    repo.publish([Root.type])
+
+    # Refresh
+    assert client.refresh(init_data) == 0
+
+    # Mock time so that root has expired. If client unexpectedly succeeds here,
+    # it likely does not work with faketime
+    assert client.refresh(init_data, now + timedelta(days=8)) == 1