@atproto/aws 0.1.4 → 0.1.6

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # @atproto/aws
 
+## 0.1.6
+
+### Patch Changes
+
+- Updated dependencies []:
+  - @atproto/repo@0.3.6
+
+## 0.1.5
+
+### Patch Changes
+
+- Updated dependencies [[`e1b5f253`](https://github.com/bluesky-social/atproto/commit/e1b5f2537a5ba4d8b951a741269b604856028ae5)]:
+  - @atproto/crypto@0.3.0
+  - @atproto/repo@0.3.5
+
 ## 0.1.4
 
 ### Patch Changes

package/dist/index.js

@@ -138560,11 +138560,23 @@ var verifyDidSig = async (did2, data, sig, opts) => {
   return verifySig(keyBytes, data, sig, opts);
 };
 var verifySig = async (publicKey, data, sig, opts) => {
+  const allowMalleable = opts?.allowMalleableSig ?? false;
   const msgHash = await sha256(data);
+  if (!allowMalleable && !isCompactFormat(sig)) {
+    return false;
+  }
   return p256.verify(sig, msgHash, publicKey, {
-    lowS: opts?.lowS ?? true
+    lowS: !allowMalleable
   });
 };
+var isCompactFormat = (sig) => {
+  try {
+    const parsed = p256.Signature.fromCompact(sig);
+    return equals(parsed.toCompactRawBytes(), sig);
+  } catch {
+    return false;
+  }
+};
 
 // ../crypto/src/p256/plugin.ts
 var p256Plugin = {
@@ -138583,11 +138595,23 @@ var verifyDidSig2 = async (did2, data, sig, opts) => {
   return verifySig2(keyBytes, data, sig, opts);
 };
 var verifySig2 = async (publicKey, data, sig, opts) => {
+  const allowMalleable = opts?.allowMalleableSig ?? false;
   const msgHash = await sha256(data);
+  if (!allowMalleable && !isCompactFormat2(sig)) {
+    return false;
+  }
   return secp256k1.verify(sig, msgHash, publicKey, {
-    lowS: opts?.lowS ?? true
+    lowS: !allowMalleable
   });
 };
+var isCompactFormat2 = (sig) => {
+  try {
+    const parsed = secp256k1.Signature.fromCompact(sig);
+    return equals(parsed.toCompactRawBytes(), sig);
+  } catch {
+    return false;
+  }
+};
 
 // ../crypto/src/secp256k1/plugin.ts
 var secp256k1Plugin = {