@atproto/repo 0.3.4 → 0.3.6

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # @atproto/repo
 
+## 0.3.6
+
+### Patch Changes
+
+- Updated dependencies [[`3c0ef382`](https://github.com/bluesky-social/atproto/commit/3c0ef382c12a413cc971ae47ffb341236c545f60)]:
+  - @atproto/syntax@0.1.5
+  - @atproto/lexicon@0.3.1
+
+## 0.3.5
+
+### Patch Changes
+
+- Updated dependencies [[`e1b5f253`](https://github.com/bluesky-social/atproto/commit/e1b5f2537a5ba4d8b951a741269b604856028ae5)]:
+  - @atproto/crypto@0.3.0
+  - @atproto/identity@0.3.2
+
 ## 0.3.4
 
 ### Patch Changes

package/dist/index.js

@@ -24545,11 +24545,23 @@ var verifyDidSig = async (did2, data, sig, opts) => {
   return verifySig(keyBytes, data, sig, opts);
 };
 var verifySig = async (publicKey, data, sig, opts) => {
+  const allowMalleable = opts?.allowMalleableSig ?? false;
   const msgHash = await sha2562(data);
+  if (!allowMalleable && !isCompactFormat(sig)) {
+    return false;
+  }
   return p256.verify(sig, msgHash, publicKey, {
-    lowS: opts?.lowS ?? true
+    lowS: !allowMalleable
   });
 };
+var isCompactFormat = (sig) => {
+  try {
+    const parsed = p256.Signature.fromCompact(sig);
+    return equals3(parsed.toCompactRawBytes(), sig);
+  } catch {
+    return false;
+  }
+};
 
 // ../crypto/src/p256/plugin.ts
 var p256Plugin = {
@@ -24568,11 +24580,23 @@ var verifyDidSig2 = async (did2, data, sig, opts) => {
   return verifySig2(keyBytes, data, sig, opts);
 };
 var verifySig2 = async (publicKey, data, sig, opts) => {
+  const allowMalleable = opts?.allowMalleableSig ?? false;
   const msgHash = await sha2562(data);
+  if (!allowMalleable && !isCompactFormat2(sig)) {
+    return false;
+  }
   return secp256k1.verify(sig, msgHash, publicKey, {
-    lowS: opts?.lowS ?? true
+    lowS: !allowMalleable
   });
 };
+var isCompactFormat2 = (sig) => {
+  try {
+    const parsed = secp256k1.Signature.fromCompact(sig);
+    return equals3(parsed.toCompactRawBytes(), sig);
+  } catch {
+    return false;
+  }
+};
 
 // ../crypto/src/secp256k1/plugin.ts
 var secp256k1Plugin = {