@blamejs/blamejs-shop 0.0.127 → 0.0.128

package/lib/vendor/blamejs/lib/eat.js

@@ -0,0 +1,240 @@
+"use strict";
+/**
+ * @module b.eat
+ * @nav    Crypto
+ * @title  Entity Attestation Token (EAT)
+ *
+ * @intro
+ *   RFC 9711 Entity Attestation Token — a CWT (or JWT) profile that
+ *   carries attestation claims describing the state of a device or
+ *   software entity: a freshness nonce, a Universal Entity ID, OEM /
+ *   hardware identifiers, debug status, software measurements, and
+ *   nested submodule attestations. EAT is the token a Relying Party
+ *   asks a device to produce to prove what it is and what state it is
+ *   in. This module is the EAT profile over <code>b.cwt</code> — it
+ *   maps the RFC 9711 claim names to their CWT claim-key integer
+ *   labels and adds the attestation-specific verification.
+ *
+ *   <code>b.eat.sign(claims, opts)</code> takes a friendly claims
+ *   object (<code>nonce</code>, <code>ueid</code>, <code>oemid</code>,
+ *   <code>dbgstat</code>, <code>eat_profile</code>,
+ *   <code>measurements</code>, <code>submods</code>, … plus the
+ *   standard CWT claims) and signs it as a CWT.
+ *
+ *   <code>b.eat.verify(eat, opts)</code> verifies the CWT (signature +
+ *   alg allowlist + time claims, via <code>b.cwt</code>) and then
+ *   enforces the attestation contract:
+ *
+ *   - <strong>Nonce binding</strong> — when the Relying Party supplied
+ *     a fresh <code>expectedNonce</code>, the token's
+ *     <code>eat_nonce</code> (claim 10) MUST match it (constant-time
+ *     compare). This is the freshness / anti-replay defense: without
+ *     it a captured attestation can be replayed indefinitely.
+ *   - <strong>Debug status</strong> — <code>requireDebugDisabled</code>
+ *     refuses a token whose <code>dbgstat</code> is
+ *     <code>enabled</code> (0) or absent; only the disabled states
+ *     (1–4) pass.
+ *   - <strong>Profile</strong> — <code>expectedProfile</code> pins the
+ *     <code>eat_profile</code> claim.
+ *
+ *   Signing algorithms follow <code>b.cwt</code> / <code>b.cose</code>:
+ *   ES256/384/512 + EdDSA (interoperable today) and ML-DSA-87.
+ *
+ * @card
+ *   RFC 9711 Entity Attestation Token over b.cwt — sign / verify
+ *   device + software attestation claims with verifier-nonce binding,
+ *   debug-status policy, and profile pinning.
+ */
+
+var cwt = require("./cwt");
+var bCrypto = require("./crypto");
+var validateOpts = require("./validate-opts");
+var { defineClass } = require("./framework-error");
+
+var EatError = defineClass("EatError", { alwaysPermanent: true });
+
+// RFC 9711 / IANA CWT Claims registry claim keys.
+var EAT = {                                                                            // allow:raw-byte-literal — RFC 9711 / IANA CWT claim-key labels, not byte sizes
+  nonce: 10, ueid: 256, sueids: 257, oemid: 258, hwmodel: 259, hwversion: 260,         // allow:raw-byte-literal — CWT claim keys
+  uptime: 261, oemboot: 262, dbgstat: 263, location: 264, eat_profile: 265,            // allow:raw-byte-literal — CWT claim keys
+  submods: 266, swname: 270, swversion: 271, manifests: 272, measurements: 273,        // allow:raw-byte-literal — CWT claim keys
+};
+var EAT_BY_LABEL = {};
+Object.keys(EAT).forEach(function (k) { EAT_BY_LABEL[EAT[k]] = k; });
+
+// RFC 9711 §4.3.1 debug-status enumeration.
+var DBGSTAT = {
+  "enabled": 0, "disabled": 1, "disabled-since-boot": 2,
+  "disabled-permanently": 3, "disabled-fully-and-permanently": 4,
+};
+var DBGSTAT_BY_VALUE = {};
+Object.keys(DBGSTAT).forEach(function (k) { DBGSTAT_BY_VALUE[DBGSTAT[k]] = k; });
+
+// Standard CWT claim labels → names (RFC 8392 §3.1.1) so EAT's
+// friendly output names the standard claims alongside the EAT ones.
+var STD_NAME = { 1: "iss", 2: "sub", 3: "aud", 4: "exp", 5: "nbf", 6: "iat", 7: "cti" };
+
+function _toBuf(x) {
+  if (Buffer.isBuffer(x)) return x;
+  if (x instanceof Uint8Array) return Buffer.from(x);
+  if (typeof x === "string") return Buffer.from(x, "utf8");
+  return null;
+}
+
+function _nonceMatches(claimValue, expected) {
+  var exp = _toBuf(expected);
+  if (!exp) return false;
+  // eat_nonce may be a single byte string or an array of them (one per
+  // verifier). Constant-time compare against each candidate.
+  var candidates = Array.isArray(claimValue) ? claimValue : [claimValue];
+  for (var i = 0; i < candidates.length; i++) {
+    var c = _toBuf(candidates[i]);
+    if (c && c.length === exp.length && bCrypto.timingSafeEqual(c, exp)) return true;
+  }
+  return false;
+}
+
+/**
+ * @primitive b.eat.sign
+ * @signature b.eat.sign(claims, opts)
+ * @since     0.12.35
+ * @status    stable
+ * @related   b.eat.verify, b.cwt.sign
+ *
+ * Sign EAT attestation claims into a CWT. EAT claim names map to their
+ * RFC 9711 integer labels; <code>dbgstat</code> accepts the enum name
+ * (<code>"disabled-since-boot"</code>) or its integer. Standard CWT
+ * claims (<code>iss</code> / <code>exp</code> / …) pass through to
+ * <code>b.cwt.sign</code>.
+ *
+ * @opts
+ *   {
+ *     alg:        string,   // COSE signing alg (ES256 / EdDSA / ML-DSA-87 / …)
+ *     privateKey: object,   // signing key
+ *     kid?:       string,
+ *     tagged?:    boolean,  // CWT tag 61
+ *   }
+ *
+ * @example
+ *   var eat = await b.eat.sign(
+ *     { nonce: rpNonce, ueid: deviceUeid, oemid: oem, dbgstat: "disabled-permanently",
+ *       eat_profile: "https://example.com/eat/profile-1", iat: Math.floor(Date.now()/1000) },
+ *     { alg: "ES256", privateKey: deviceKey });
+ */
+async function sign(claims, opts) {
+  if (!claims || typeof claims !== "object" || Array.isArray(claims)) {
+    throw new EatError("eat/bad-claims", "eat.sign: claims must be a plain object");
+  }
+  validateOpts.requireObject(opts, "eat.sign", EatError);
+  // Translate EAT claim names to their integer labels into a Map (so
+  // the integer keys survive — a plain object would stringify them).
+  // Standard CWT names (iss/sub/aud/exp/nbf/iat/cti) + custom keys are
+  // left for b.cwt.sign to handle.
+  var mapped = new Map();
+  var keys = Object.keys(claims);
+  for (var i = 0; i < keys.length; i++) {
+    var name = keys[i];
+    var value = claims[name];
+    if (name === "dbgstat" && typeof value === "string") {
+      if (!Object.prototype.hasOwnProperty.call(DBGSTAT, value)) {
+        throw new EatError("eat/bad-dbgstat",
+          "eat.sign: dbgstat must be one of " + Object.keys(DBGSTAT).join(" / ") + " (or an integer 0-4)");
+      }
+      value = DBGSTAT[value];
+    }
+    mapped.set(Object.prototype.hasOwnProperty.call(EAT, name) ? EAT[name] : name, value);
+  }
+  return cwt.sign(mapped, opts);
+}
+
+/**
+ * @primitive b.eat.verify
+ * @signature b.eat.verify(eat, opts)
+ * @since     0.12.35
+ * @status    stable
+ * @related   b.eat.sign, b.cwt.verify
+ *
+ * Verify an EAT and return its attestation claims. Delegates the CWT
+ * signature + algorithm-allowlist + time-claim checks to
+ * <code>b.cwt.verify</code>, then enforces the attestation contract:
+ * the <code>eat_nonce</code> must match <code>expectedNonce</code>
+ * (when supplied — the freshness/anti-replay binding),
+ * <code>requireDebugDisabled</code> refuses a non-disabled
+ * <code>dbgstat</code>, and <code>expectedProfile</code> pins
+ * <code>eat_profile</code>.
+ *
+ * @opts
+ *   {
+ *     algorithms:        string[],  // required — accepted COSE algs
+ *     publicKey?:        object,
+ *     keyResolver?:      function,
+ *     expectedNonce?:    Buffer,    // require eat_nonce to match (freshness)
+ *     requireDebugDisabled?: boolean,  // refuse dbgstat enabled / absent
+ *     expectedProfile?:  string,    // pin eat_profile
+ *     expectedIssuer?:   string,    // forwarded to b.cwt.verify
+ *     expectedAudience?: string,
+ *     clockSkewSec?:     number,
+ *     now?:              number,
+ *     externalAad?:      Buffer,
+ *   }
+ *
+ * @example
+ *   var att = await b.eat.verify(eat, { algorithms: ["ES256"], publicKey: devicePub, expectedNonce: rpNonce, requireDebugDisabled: true });
+ *   // → { claims: { nonce, ueid, dbgstat: "disabled-permanently", ... }, raw: Map, alg }
+ */
+async function verify(eat, opts) {
+  validateOpts.requireObject(opts, "eat.verify", EatError);
+  var out = await cwt.verify(eat, {
+    algorithms: opts.algorithms, publicKey: opts.publicKey, keyResolver: opts.keyResolver,
+    expectedIssuer: opts.expectedIssuer, expectedAudience: opts.expectedAudience,
+    clockSkewSec: opts.clockSkewSec, now: opts.now, externalAad: opts.externalAad,
+  });
+  var raw = out.raw;
+
+  // Nonce binding — the freshness / anti-replay defense. When the RP
+  // supplied a nonce, the token MUST carry a matching eat_nonce.
+  if (opts.expectedNonce != null) {
+    if (!raw.has(EAT.nonce)) {
+      throw new EatError("eat/nonce-missing", "eat.verify: expectedNonce supplied but token has no eat_nonce claim");
+    }
+    if (!_nonceMatches(raw.get(EAT.nonce), opts.expectedNonce)) {
+      throw new EatError("eat/nonce-mismatch", "eat.verify: eat_nonce does not match expectedNonce (stale / replayed attestation)");
+    }
+  }
+
+  // Debug status — refuse a token that can't prove debug is disabled.
+  if (opts.requireDebugDisabled === true) {
+    var ds = raw.get(EAT.dbgstat);
+    if (typeof ds !== "number" || ds < DBGSTAT.disabled) {
+      throw new EatError("eat/debug-not-disabled",
+        "eat.verify: requireDebugDisabled — dbgstat is " +
+        (ds === undefined ? "absent" : (DBGSTAT_BY_VALUE[ds] || ds)) + ", not a disabled state");
+    }
+  }
+
+  if (opts.expectedProfile != null && raw.get(EAT.eat_profile) !== opts.expectedProfile) {
+    throw new EatError("eat/profile-mismatch", "eat.verify: eat_profile does not match expectedProfile");
+  }
+
+  // Build friendly claims: EAT + standard labels → names; decode the
+  // dbgstat enum to its name.
+  var claims = {};
+  raw.forEach(function (v, k) {
+    var name = Object.prototype.hasOwnProperty.call(EAT_BY_LABEL, k) ? EAT_BY_LABEL[k]
+      : (Object.prototype.hasOwnProperty.call(STD_NAME, k) ? STD_NAME[k] : k);
+    if (name === "dbgstat" && typeof v === "number" && Object.prototype.hasOwnProperty.call(DBGSTAT_BY_VALUE, v)) {
+      v = DBGSTAT_BY_VALUE[v];
+    }
+    claims[name] = v;
+  });
+
+  return { claims: claims, raw: raw, alg: out.alg, protectedHeaders: out.protectedHeaders };
+}
+
+module.exports = {
+  sign:        sign,
+  verify:      verify,
+  CLAIM_LABELS: EAT,
+  DBGSTAT:     DBGSTAT,
+  EatError:    EatError,
+};

package/lib/vendor/blamejs/lib/scitt.js

@@ -0,0 +1,243 @@
+"use strict";
+/**
+ * @module b.scitt
+ * @nav    Crypto
+ * @title  SCITT signed statements
+ *
+ * @intro
+ *   A SCITT (Supply Chain Integrity, Transparency, and Trust) signed
+ *   statement is a <code>b.cose</code> COSE_Sign1 that makes a signed,
+ *   attributable claim <em>about an artifact</em> — a signed SBOM, a
+ *   build attestation, a release approval. The artifact (or a hash /
+ *   reference to it) is the payload; the issuer and the subject are
+ *   carried in the integrity-protected <strong>CWT_Claims</strong>
+ *   header (label 15, RFC 9597): <code>iss</code> (label 1) is who
+ *   makes the statement, <code>sub</code> (label 2) is the artifact the
+ *   statement is about. This module builds and verifies that envelope
+ *   over <code>b.cose</code> + <code>b.cbor</code>.
+ *
+ *   <code>b.scitt.signStatement(payload, opts)</code> produces the
+ *   COSE_Sign1, placing <code>iss</code> / <code>sub</code> (plus any
+ *   extra CWT claims) in the protected CWT_Claims header and declaring
+ *   the payload media type as the COSE content type.
+ *   <code>b.scitt.verifyStatement(statement, opts)</code> verifies the
+ *   signature (delegating the mandatory algorithm allowlist to
+ *   <code>b.cose.verify</code>), then enforces that a CWT_Claims header
+ *   with both <code>iss</code> and <code>sub</code> is present —
+ *   refusing a statement that omits the issuer/subject binding — and
+ *   optionally checks them against expected values.
+ *
+ *   The signing algorithms are exactly <code>b.cose</code>'s: the
+ *   classical ES256/384/512 + EdDSA (final COSE ids, interoperable
+ *   today) and ML-DSA-87 (PQC-forward, draft COSE id). Because the
+ *   identity binding lives in the protected header it is covered by the
+ *   signature and cannot be substituted without detection.
+ *
+ *   <strong>Scope.</strong> This is the <em>issuer half</em> of SCITT —
+ *   producing and verifying signed statements, which is buildable today
+ *   on finalized RFCs (RFC 9052 COSE, RFC 9597 CWT_Claims header, RFC
+ *   8392 iss/sub). The <em>transparency receipt</em> (an inclusion proof
+ *   from an append-only transparency service, COSE Receipts /
+ *   draft-ietf-cose-merkle-tree-proofs) and the transparency-service
+ *   registration protocol (draft-ietf-scitt-*) are deferred until those
+ *   drafts publish — a signed statement produced here is the input a
+ *   transparency service registers, and the receipt format is the part
+ *   still in flux. Re-open on COSE-Receipts publication.
+ *
+ * @card
+ *   SCITT signed statements (RFC 9052 COSE + RFC 9597 CWT_Claims) — a
+ *   signed, issuer/subject-bound claim about an artifact (SBOM /
+ *   attestation / approval). Composes b.cose; transparency receipts
+ *   deferred to the COSE-Receipts draft.
+ */
+
+var cose = require("./cose");
+var validateOpts = require("./validate-opts");
+var { defineClass } = require("./framework-error");
+
+var ScittError = defineClass("ScittError", { alwaysPermanent: true });
+
+// CWT_Claims header label (RFC 9597) and the two SCITT-required claim
+// labels inside it (RFC 8392 §3.1.1): iss = who states, sub = about what.
+var HDR_CWT_CLAIMS = 15;
+var CLAIM_ISS = 1;
+var CLAIM_SUB = 2;
+
+function _requireNonEmptyString(v, name) {
+  if (typeof v !== "string" || v.length === 0) {
+    throw new ScittError("scitt/bad-" + name,
+      "scitt.signStatement: opts." + name + " is required and must be a non-empty string");
+  }
+}
+
+/**
+ * @primitive b.scitt.signStatement
+ * @signature b.scitt.signStatement(payload, opts)
+ * @since     0.12.37
+ * @status    experimental
+ * @compliance soc2, cra
+ * @related   b.scitt.verifyStatement, b.cose.sign
+ *
+ * Produce a SCITT signed statement: a COSE_Sign1 over
+ * <code>payload</code> (the artifact bytes, or a hash / reference to
+ * it) whose integrity-protected CWT_Claims header (label 15) binds the
+ * issuer (<code>iss</code>) and subject (<code>sub</code>). Declare the
+ * payload media type via <code>contentType</code> so a consumer knows
+ * how to interpret it.
+ *
+ * @opts
+ *   {
+ *     alg:          string,        // b.cose alg: "ES256" | … | "ML-DSA-87"
+ *     privateKey:   object,        // matching KeyObject or PEM
+ *     issuer:       string,        // → CWT_Claims iss (label 1) — who makes the statement
+ *     subject:      string,        // → CWT_Claims sub (label 2) — the artifact the statement is about
+ *     contentType?: number|string, // payload media type (e.g. "application/spdx+json")
+ *     claims?:      object,        // extra CWT claims by integer label, merged into CWT_Claims
+ *     kid?:         string,        // → unprotected header label 4
+ *     externalAad?: Buffer,        // bound into the signature
+ *   }
+ *
+ * @example
+ *   var stmt = await b.scitt.signStatement(sbomBytes, {
+ *     alg: "ES256", privateKey: issuerKey,
+ *     issuer: "https://builder.example", subject: "pkg:npm/widget@1.2.3",
+ *     contentType: "application/spdx+json",
+ *   });
+ */
+async function signStatement(payload, opts) {
+  validateOpts.requireObject(opts, "scitt.signStatement", ScittError);
+  validateOpts(opts,
+    ["alg", "privateKey", "issuer", "subject", "contentType", "claims", "kid", "externalAad"],
+    "scitt.signStatement");
+  _requireNonEmptyString(opts.issuer, "issuer");
+  _requireNonEmptyString(opts.subject, "subject");
+
+  var cwtClaims = new Map();
+  cwtClaims.set(CLAIM_ISS, opts.issuer);
+  cwtClaims.set(CLAIM_SUB, opts.subject);
+  // Extra CWT claims (e.g. iat = 6, a registration-policy claim) keyed
+  // by their integer label. iss / sub are managed via opts.issuer /
+  // opts.subject and cannot be overridden here.
+  if (opts.claims && typeof opts.claims === "object") {
+    var ck = opts.claims instanceof Map ? Array.from(opts.claims.keys()) : Object.keys(opts.claims);
+    for (var i = 0; i < ck.length; i++) {
+      var label = Number(ck[i]);
+      if (!Number.isInteger(label)) {
+        throw new ScittError("scitt/bad-claim-label",
+          "scitt.signStatement: claims keys must be integer CWT claim labels");
+      }
+      if (label === CLAIM_ISS || label === CLAIM_SUB) {
+        throw new ScittError("scitt/reserved-claim",
+          "scitt.signStatement: set iss / sub via opts.issuer / opts.subject, not opts.claims");
+      }
+      var val = opts.claims instanceof Map ? opts.claims.get(ck[i]) : opts.claims[ck[i]];
+      cwtClaims.set(label, val);
+    }
+  }
+
+  var protectedHeaders = {};
+  protectedHeaders[HDR_CWT_CLAIMS] = cwtClaims;
+
+  return cose.sign(payload, {
+    alg:              opts.alg,
+    privateKey:       opts.privateKey,
+    kid:              opts.kid,
+    contentType:      opts.contentType,
+    externalAad:      opts.externalAad,
+    protectedHeaders: protectedHeaders,
+  });
+}
+
+/**
+ * @primitive b.scitt.verifyStatement
+ * @signature b.scitt.verifyStatement(statement, opts)
+ * @since     0.12.37
+ * @status    experimental
+ * @compliance soc2, cra
+ * @related   b.scitt.signStatement, b.cose.verify
+ *
+ * Verify a SCITT signed statement and return its payload + identity
+ * binding. The COSE signature is checked through
+ * <code>b.cose.verify</code> (the algorithm allowlist is mandatory); a
+ * statement that does not carry a CWT_Claims header with both
+ * <code>iss</code> and <code>sub</code> is refused — that binding is
+ * what makes it a SCITT statement rather than a bare COSE_Sign1.
+ * <code>expectedIssuer</code> / <code>expectedSubject</code>, when
+ * given, must match.
+ *
+ * @opts
+ *   {
+ *     algorithms:       string[],  // required — accepted alg names (allowlist)
+ *     publicKey?:       object,    // verification key (KeyObject / PEM)
+ *     keyResolver?:     function,  // (protectedHeaders, unprotectedHeaders) → key
+ *     expectedIssuer?:  string,    // require iss === this
+ *     expectedSubject?: string,    // require sub === this
+ *     externalAad?:     Buffer,    // must match what was signed
+ *     maxBytes?:        number,    // forwarded to b.cose.verify → b.cbor.decode
+ *     maxDepth?:        number,
+ *   }
+ *
+ * @example
+ *   var out = await b.scitt.verifyStatement(stmt, {
+ *     algorithms: ["ES256"], publicKey: issuerPub,
+ *     expectedSubject: "pkg:npm/widget@1.2.3",
+ *   });
+ *   // → { payload: <Buffer>, issuer, subject, cwtClaims: Map, alg, protectedHeaders, unprotectedHeaders }
+ */
+async function verifyStatement(statement, opts) {
+  validateOpts.requireObject(opts, "scitt.verifyStatement", ScittError);
+  validateOpts(opts,
+    ["algorithms", "publicKey", "keyResolver", "expectedIssuer", "expectedSubject",
+     "externalAad", "maxBytes", "maxDepth"],
+    "scitt.verifyStatement");
+
+  var out = await cose.verify(statement, {
+    algorithms:  opts.algorithms,
+    publicKey:   opts.publicKey,
+    keyResolver: opts.keyResolver,
+    externalAad: opts.externalAad,
+    maxBytes:    opts.maxBytes,
+    maxDepth:    opts.maxDepth,
+  });
+
+  var cwtClaims = out.protectedHeaders.get(HDR_CWT_CLAIMS);
+  if (!(cwtClaims instanceof Map)) {
+    throw new ScittError("scitt/missing-cwt-claims",
+      "scitt.verifyStatement: no CWT_Claims header (label 15) — not a SCITT signed statement");
+  }
+  var issuer = cwtClaims.get(CLAIM_ISS);
+  var subject = cwtClaims.get(CLAIM_SUB);
+  if (issuer === undefined || issuer === null) {
+    throw new ScittError("scitt/missing-issuer",
+      "scitt.verifyStatement: CWT_Claims has no iss (label 1)");
+  }
+  if (subject === undefined || subject === null) {
+    throw new ScittError("scitt/missing-subject",
+      "scitt.verifyStatement: CWT_Claims has no sub (label 2)");
+  }
+  if (opts.expectedIssuer !== undefined && issuer !== opts.expectedIssuer) {
+    throw new ScittError("scitt/issuer-mismatch",
+      "scitt.verifyStatement: iss does not match expectedIssuer");
+  }
+  if (opts.expectedSubject !== undefined && subject !== opts.expectedSubject) {
+    throw new ScittError("scitt/subject-mismatch",
+      "scitt.verifyStatement: sub does not match expectedSubject");
+  }
+
+  return {
+    payload:            out.payload,
+    issuer:             issuer,
+    subject:            subject,
+    cwtClaims:          cwtClaims,
+    alg:                out.alg,
+    protectedHeaders:   out.protectedHeaders,
+    unprotectedHeaders: out.unprotectedHeaders,
+  };
+}
+
+module.exports = {
+  signStatement:   signStatement,
+  verifyStatement: verifyStatement,
+  CWT_CLAIMS_LABEL: HDR_CWT_CLAIMS,
+  ScittError:      ScittError,
+};