@ai-ecoverse/slicc-kernel 1.125.8 → 1.125.9

package/dist/node.js

@@ -7086,7 +7086,7 @@ function satisfies(version, range2) {
 }
 
 // src/version.ts
-var KERNEL_VERSION = true ? "1.125.8" : "0.0.0-dev";
+var KERNEL_VERSION = true ? "1.125.9" : "0.0.0-dev";
 var OS_RELEASE = "6.0.0-slicc";
 function procVersion() {
   return `Linux version ${OS_RELEASE} (slicc-kernel ${KERNEL_VERSION}) #1 SMP PREEMPT_DYNAMIC
@@ -17250,8 +17250,32 @@ var HASHES = {
   "2a8648ce3d040302": ["ECDSA", "SHA-256"],
   "2a8648ce3d040303": ["ECDSA", "SHA-384"],
   "2a8648ce3d040304": ["ECDSA", "SHA-512"],
-  "2b6570": ["Ed25519", ""]
+  "2b6570": ["Ed25519", ""],
+  "2a864886f70d01010a": ["RSA-PSS", "SHA-1"]
 };
+var PSS_HASHES = {
+  "2b0e03021a": "SHA-1",
+  "608648016503040201": "SHA-256",
+  "608648016503040202": "SHA-384",
+  "608648016503040203": "SHA-512"
+};
+function pssOf(der, algorithm) {
+  const params = children2(der, algorithm, 2)?.[1];
+  let hash = "SHA-1";
+  let salt = 20;
+  for (const field4 of params && der[params.start] === 48 ? children2(der, params, 3) ?? [] : []) {
+    const inner = tlv2(der, field4.body);
+    if (!inner) return void 0;
+    if (der[field4.start] === 160) {
+      const known = PSS_HASHES[oidOf(der, inner) ?? ""];
+      if (!known) return void 0;
+      hash = known;
+    } else if (der[field4.start] === 162) {
+      salt = der.subarray(inner.body, inner.end).reduce((n, b) => n * 256 + b, 0);
+    }
+  }
+  return { hash, salt };
+}
 var CURVES = {
   "2a8648ce3d030107": ["P-256", 32],
   "2b81040022": ["P-384", 48],
@@ -17286,10 +17310,13 @@ function signedOf(der) {
   const spki = parts2?.tbs[5];
   if (!tbs || !algorithm || !value2 || !spki || der[value2.start] !== 3) return void 0;
   const known = HASHES[oidOf(der, algorithm) ?? ""];
-  if (!known) return "unknown";
-  const [scheme, hash] = known;
+  if (!known) return void 0;
+  const [scheme] = known;
+  const pss = scheme === "RSA-PSS" ? pssOf(der, algorithm) : void 0;
+  if (scheme === "RSA-PSS" && !pss) return void 0;
+  const hash = pss?.hash ?? known[1];
   const curve = scheme === "ECDSA" ? curveOf(der, spki) : void 0;
-  if (scheme === "ECDSA" && !curve) return "unknown";
+  if (scheme === "ECDSA" && !curve) return void 0;
   const signature = der.subarray(value2.body + 1, value2.end);
   return {
     tbs: raw(der, tbs),
@@ -17297,7 +17324,8 @@ function signedOf(der) {
     signature,
     scheme,
     hash,
-    ...curve ? { curve } : {}
+    ...curve ? { curve } : {},
+    ...pss ? { salt: pss.salt } : {}
   };
 }
 async function verifiesItself(s) {
@@ -17308,13 +17336,12 @@ async function verifiesItself(s) {
   ]);
   const signature = s.curve ? fixedEcdsa(s.signature, s.curve[1]) : s.signature;
   if (!signature) return false;
-  const params = s.scheme === "ECDSA" ? { name: "ECDSA", hash: s.hash } : { name: s.scheme };
+  const params = s.scheme === "ECDSA" ? { name: "ECDSA", hash: s.hash } : s.salt === void 0 ? { name: s.scheme } : { name: s.scheme, saltLength: s.salt };
   return crypto.subtle.verify(params, key, new Uint8Array(signature), new Uint8Array(s.tbs));
 }
 async function selfSigned(der) {
   if (!selfIssued(der)) return false;
   const signed = signedOf(der);
-  if (signed === "unknown") return true;
   if (!signed) return false;
   return verifiesItself(signed).catch(() => false);
 }