Summary

Change service key Expiration, in usage log shows wrong time "1/1/1970, 8:33:46 AM"

Steps to Reproduce

1. Deploy Quay 3.17 with LOGS_MODEL: splunk
2. Create a preshareable service key via Superuser > Service Keys
3. Extend the service key expiration on UI or via API:

   curl -sk -X PUT -H "Authorization: Bearer <token>" \
     -H "Content-Type: application/json" \
     -d '{"expiration": 1772236800}' \
     "https://<quay-host>/api/v1/superuser/keys/<kid>"
   

       4. Navigate to Superuser > Usage Logs

       5. Observe the service_key_extend log entry

Expected Result

The log entry should show correct dates:
"Change of expiration of service key test-splunk-key from 2/20/2026, 4:00:00 AM to 2/28/2026, 12:00:00 AM"

Actual Result

Both dates display as "1/1/1970, 8:33:46 AM":
"Change of expiration of service key test-splunk-key from 1/1/1970, 8:33:46 AM to 1/1/1970, 8:33:46 AM"

Root Cause

When using Splunk as the action log backend, datetime fields in log metadata are serialized as ISO strings (e.g. "2026-02-20 04:00:00") instead of Unix epoch integers. The UI's formatUnixTimestamp() parses these strings with parseInt(), which extracts only the year number, resulting in dates displaying as "1/1/1970, 8:33:46 AM".

Both Splunk log producers use json.dumps(log, default=str) to serialize log data. When a Python datetime object is encountered, default=str converts it to an ISO format string. The table model correctly uses _json_serialize() which converts datetime to Unix epoch via timegm(obj.utctimetuple()).

Affected Log Actions

All log_action calls that pass datetime objects in metadata are affected:

• change_tag_expiration - expiration_date field (also reported in PROJQUAY-10570)
• service_key_create - expiration_date field
• service_key_approve - expiration_date, old_expiration_date fields
• service_key_extend - expiration_date, old_expiration_date fields
• service_key_modify - expiration_date, old_expiration_date fields
• service_key_delete - expiration_date field
• service_key_rotate - expiration_date field
• repo_mirror_sync_started - sync_start_date field
• repo_mirror_sync_success - sync_start_date field
• repo_mirror_sync_failed - sync_start_date field

Related

• PROJQUAY-10570 (tag expiration wrong time - same root cause)

Environment

• Quay version: 3.17.0
• Action log backend: Splunk 
• Cluster: OCP 4.20