@blamejs/pki 0.5.31 → 0.5.33

package/lib/schema-cmc.js

@@ -685,7 +685,7 @@ function _finishBody(body, where) {
  *   d.controls.length;   // 0 -- present and empty, which is legal
  */
 function parsePkiData(input) {
-  var root = asn1.decode(Buffer.isBuffer(input) ? input : Buffer.from(input));
+  var root = asn1.decode(guard.bytes.isByteSource(input) ? guard.bytes.source(input, E, "cmc/bad-input", "the CMC DER") : Buffer.from(input));
   var body = schema.walk(PKI_DATA, root, NS).result;
   body.bytes = root.bytes;
   return _finishBody(body, "pkiData");
@@ -711,7 +711,7 @@ function parsePkiData(input) {
  *   r.statuses.length;   // 0 -- no status control means success is assumed
  */
 function parsePkiResponse(input) {
-  var root = asn1.decode(Buffer.isBuffer(input) ? input : Buffer.from(input));
+  var root = asn1.decode(guard.bytes.isByteSource(input) ? guard.bytes.source(input, E, "cmc/bad-input", "the CMC DER") : Buffer.from(input));
   var body = schema.walk(PKI_RESPONSE, root, NS).result;
   body.bytes = root.bytes;
   return _finishBody(body, "pkiResponse");
@@ -752,7 +752,7 @@ function parse(input) {
   // encapContentInfo is the field this function goes on to read, so requiring it
   // is the same question the code below already asks.
   var parsedCms = (input && typeof input === "object" && !ArrayBuffer.isView(input) &&
-    !(input instanceof ArrayBuffer) && input.encapContentInfo != null)
+    !guard.bytes.isByteSource(input) && input.encapContentInfo != null)
     ? input : cms.parse(input);
   // The CARRIER is part of the identity, not just the encapsulated content type.
   // RFC 5272 sec. 3.2 / 4.2 admit a SignedData or an AuthenticatedData; other CMS

package/lib/schema-pkix.js

@@ -42,10 +42,8 @@ var _strIndexOf = intrinsic.stringIndexOf;
 var _bufToString = intrinsic.uncurry(Buffer.prototype.toString);
 var _strSlice = intrinsic.uncurry(String.prototype.slice);
 var _charAt = intrinsic.uncurry(String.prototype.charAt);
-var _strReplace = intrinsic.uncurry(String.prototype.replace);
+var _charCodeAt = intrinsic.uncurry(String.prototype.charCodeAt);
 var _split = intrinsic.uncurry(String.prototype.split);
-var _reExec = intrinsic.uncurry(RegExp.prototype.exec);
-var _reTest = intrinsic.uncurry(RegExp.prototype.test);
 var _create = intrinsic.create;
 var _isUint8Array = intrinsic.types.isUint8Array;
 var _bigIntToString = intrinsic.bigIntToString;
@@ -54,12 +52,96 @@ var _weakSet = intrinsic.weakSet;
 var _WeakMapI = intrinsic.WeakMap;
 var _arrayFrom = Array.from;
 var _getUTCFullYear = intrinsic.uncurry(Date.prototype.getUTCFullYear);
+
+// The JavaScript regex `\s` class, decided by code point, so the whitespace tests below match
+// exactly what `/\s/` and `/\S/` matched with no caller-replaceable match protocol standing in for
+// them. Set = ECMAScript WhiteSpace + LineTerminator: TAB LF VT FF CR SP, U+00A0, U+1680,
+// U+2000..U+200A, U+2028, U+2029, U+202F, U+205F, U+3000, U+FEFF.
+function _isJsWhitespace(c) {
+  return c === 0x09 || c === 0x0a || c === 0x0b || c === 0x0c || c === 0x0d || c === 0x20 ||
+         c === 0xa0 || c === 0x1680 || (c >= 0x2000 && c <= 0x200a) || c === 0x2028 || c === 0x2029 ||
+         c === 0x202f || c === 0x205f || c === 0x3000 || c === 0xfeff;
+}
+function _hasWhitespace(s) {
+  for (var i = 0; i < s.length; i++) { if (_isJsWhitespace(_charCodeAt(s, i))) return true; }
+  return false;
+}
+function _hasNonWhitespace(s) {
+  for (var i = 0; i < s.length; i++) { if (!_isJsWhitespace(_charCodeAt(s, i))) return true; }
+  return false;
+}
+// Charset validation by character scan (the shared home for the `/^[chars]+$/`-family regexes format
+// modules used to carry): `charTable` builds a code-point membership table from a string of the allowed
+// characters, and `allCharsIn` checks that a NON-EMPTY string is composed only of them (`+`, not `*`).
+// One data-table loop, not a per-charset inlined character-class chain.
+function _charTable(chars) { var t = []; for (var i = 0; i < chars.length; i++) t[_charCodeAt(chars, i)] = true; return t; }
+function _allCharsIn(s, table) {
+  if (s.length === 0) return false;
+  for (var i = 0; i < s.length; i++) { if (!table[_charCodeAt(s, i)]) return false; }
+  return true;
+}
 // ct is a leaf format module (requires only the codec / oid / constants / error
 // core, never pkix) so the SCT-list extension VALUE decoder registers here as a
 // registry row, not a switch. The one-directional edge keeps the layering acyclic.
 var ct = require("./ct");
 
-var PEM_RE = /-----BEGIN ([A-Z0-9 ]+)-----([\s\S]*?)-----END \1-----/;
+// PEM armor markers, matched literally so no regex -- with its live, replaceable match protocol and
+// the backreference the END repeats -- stands between the parser and the wire.
+var _PEM_BEGIN = "-----BEGIN ";
+var _PEM_END = "-----END ";
+var _PEM_DASHES = "-----";
+
+// The next PEM block at or after `from`: "-----BEGIN <label>-----<body>-----END <label>-----" where
+// the label is one or more of [A-Z0-9 ] (RFC 7468 label octets, spaces included) and the END label
+// repeats the BEGIN label exactly (the backreference). Returns { index, label, body, end } -- `index`
+// the BEGIN offset, `end` the offset past the closing dashes -- or null when no such block remains.
+// A "-----BEGIN " with no valid label or no matching END is skipped, mirroring the regex trying each
+// start position; the body is the shortest span to the first matching END (the lazy quantifier).
+function _findPemBlock(text, from) {
+  var searchFrom = from;
+  for (;;) {
+    var bi = _strIndexOf(text, _PEM_BEGIN, searchFrom);
+    if (bi === -1) return null;
+    var p = bi + _PEM_BEGIN.length, ls = p;
+    while (p < text.length) {
+      var c = _charCodeAt(text, p);
+      if (!((c >= 65 && c <= 90) || (c >= 48 && c <= 57) || c === 32)) break; // A-Z 0-9 space
+      p += 1;
+    }
+    if (p === ls || _strSlice(text, p, p + 5) !== _PEM_DASHES) { searchFrom = bi + 1; continue; }
+    var label = _strSlice(text, ls, p);
+    var bodyStart = p + 5;
+    var endMarker = _PEM_END + label + _PEM_DASHES;
+    var ei = _strIndexOf(text, endMarker, bodyStart);
+    if (ei === -1) { searchFrom = bi + 1; continue; }
+    return { index: bi, label: label, body: _strSlice(text, bodyStart, ei), end: ei + endMarker.length };
+  }
+}
+
+// All ASCII CR / LF / TAB / SPACE removed (the base64 body's permitted layout whitespace).
+function _stripB64Whitespace(s) {
+  var out = "", runStart = 0, i;
+  for (i = 0; i < s.length; i++) {
+    var c = _charCodeAt(s, i);
+    if (c === 13 || c === 10 || c === 9 || c === 32) {
+      if (i > runStart) out += _strSlice(s, runStart, i);
+      runStart = i + 1;
+    }
+  }
+  if (i > runStart) out += _strSlice(s, runStart, i);
+  return out;
+}
+
+// A base64 string wrapped to 64-column lines joined by LF, no trailing LF (matching (.{64})->"$1\n"
+// then a trailing-newline strip; base64 output carries no newline of its own to strip).
+function _wrap64(s) {
+  var out = "";
+  for (var i = 0; i < s.length; i += 64) {
+    if (i > 0) out += "\n";
+    out += _strSlice(s, i, i + 64);
+  }
+  return out;
+}
 
 // ---- shared parse-entry ----------------------------------------------
 // Input handling, PEM unwrapping (with the size cap), DER-decode wrapping, and
@@ -80,10 +162,10 @@ function pemDecode(text, label, PemError) {
   text = guard.text.decode(text, constants.LIMITS.PEM_MAX_BYTES, PemError, {
     charset: "latin1", tooLarge: "pem/too-large", badInput: "pem/bad-input", label: "PEM input",
   });
-  var m = _reExec(PEM_RE, text);
+  var m = _findPemBlock(text, 0);
   if (!m) throw new PemError("pem/no-block", "no PEM block found");
-  if (label && m[1] !== label) throw new PemError("pem/label-mismatch", "expected " + _stringify(label) + " block, got " + _stringify(m[1]));
-  var b64 = _strReplace(m[2], /[\r\n\t ]+/g, "");
+  if (label && m.label !== label) throw new PemError("pem/label-mismatch", "expected " + _stringify(label) + " block, got " + _stringify(m.label));
+  var b64 = _stripB64Whitespace(m.body);
   // Strict canonical base64 (RFC 4648 sec. 3.5) via the shared encoding guard.
   return guard.encoding.base64(b64, null, function (c, msg) { return new PemError(c, msg); }, "pem/bad-base64", "PEM base64 body");
 }
@@ -99,51 +181,99 @@ function pemDecodeAll(text, label, PemError) {
   text = guard.text.decode(text, constants.LIMITS.PEM_MAX_BYTES, PemError, {
     charset: "latin1", tooLarge: "pem/too-large", badInput: "pem/bad-input", label: "PEM input",
   });
-  var re = /-----BEGIN ([A-Z0-9 ]+)-----([\s\S]*?)-----END \1-----/g;
   var blocks = [];
   var lastEnd = 0, m;
-  while ((m = _reExec(re, text)) !== null) {
-    if (_reTest(/\S/, _strSlice(text, lastEnd, m.index))) throw new PemError("pem/explanatory-text", "explanatory text is not permitted around PEM blocks (RFC 8555 sec. 9.1)");
-    if (m[1] !== label) throw new PemError("pem/label-mismatch", "expected " + _stringify(label) + " block, got " + _stringify(m[1]));
-    var b64 = _strReplace(m[2], /[\r\n\t ]+/g, "");
+  while ((m = _findPemBlock(text, lastEnd)) !== null) {
+    if (_hasNonWhitespace(_strSlice(text, lastEnd, m.index))) throw new PemError("pem/explanatory-text", "explanatory text is not permitted around PEM blocks (RFC 8555 sec. 9.1)");
+    if (m.label !== label) throw new PemError("pem/label-mismatch", "expected " + _stringify(label) + " block, got " + _stringify(m.label));
+    var b64 = _stripB64Whitespace(m.body);
     _push(blocks, guard.encoding.base64(b64, null, function (c, msg) { return new PemError(c, msg); }, "pem/bad-base64", "PEM base64 body"));
-    lastEnd = re.lastIndex;
+    lastEnd = m.end;
   }
   if (blocks.length === 0) throw new PemError("pem/no-block", "no PEM block found");
-  if (_reTest(/\S/, _strSlice(text, lastEnd))) throw new PemError("pem/explanatory-text", "explanatory text is not permitted after the PEM chain (RFC 8555 sec. 9.1)");
+  if (_hasNonWhitespace(_strSlice(text, lastEnd))) throw new PemError("pem/explanatory-text", "explanatory text is not permitted after the PEM chain (RFC 8555 sec. 9.1)");
   return blocks;
 }
 
-// The label must be re-readable by this module's own PEM_RE (uppercase
+// The label must be re-readable by this module's own PEM label scan (uppercase
 // alphanumeric words separated by single spaces, a subset of the RFC 7468
 // sec. 3 label grammar). Anything else (lowercase, a leading/trailing space,
 // an embedded "-----" or newline) would emit armor pemDecode itself rejects
 // or corrupt the armor grammar: a config-time authoring fault, thrown here.
+// The armor label grammar, decided character by character (no regex protocol on the emit path):
+// one or more A-Z0-9 words joined by single spaces -- so no leading/trailing space and no doubled
+// space, and every other character in [A-Z0-9].
+function _isPemLabel(s) {
+  var n = s.length;
+  if (n === 0) return false;
+  for (var i = 0; i < n; i++) {
+    var ch = _charAt(s, i);
+    if (ch === " ") {
+      if (i === 0 || i === n - 1 || _charAt(s, i - 1) === " ") return false;
+    } else if (!((ch >= "A" && ch <= "Z") || (ch >= "0" && ch <= "9"))) {
+      return false;
+    }
+  }
+  return true;
+}
+
 function pemEncode(der, label, PemError) {
-  if (typeof label !== "string" || !_reTest(/^[A-Z0-9]+( [A-Z0-9]+)*$/, label)) {
+  if (typeof label !== "string" || !_isPemLabel(label)) {
     throw new PemError("pem/bad-label", "pemEncode requires an uppercase A-Z0-9 label with single spaces");
   }
   // Re-view through the byte guard: a string input would silently utf8-armor into
   // a bogus PEM, and a detached-backed Buffer would armor an empty body; both
   // fail closed (a Uint8Array / Buffer of real DER re-views cleanly).
   var buf = guard.bytes.view(der, PemError, "pem/bad-input", "pemEncode DER input");
-  var b64 = _strReplace(_strReplace(_bufToString(buf, "base64"), /(.{64})/g, "$1\n"), /\n$/, "");
+  var b64 = _wrap64(_bufToString(buf, "base64"));
   return "-----BEGIN " + label + "-----\n" + b64 + "\n-----END " + label + "-----\n";
 }
 
+// Only the base64 alphabet (A-Z a-z 0-9 + / =) kept, every other character dropped -- the lenient
+// filter of the historic signer-certificate path, by character scan.
+function _keepBase64(s) {
+  var out = "", runStart = 0, i;
+  for (i = 0; i < s.length; i++) {
+    var c = _charCodeAt(s, i);
+    if (!((c >= 65 && c <= 90) || (c >= 97 && c <= 122) || (c >= 48 && c <= 57) || c === 43 || c === 47 || c === 61)) {
+      if (i > runStart) out += _strSlice(s, runStart, i);
+      runStart = i + 1;
+    }
+  }
+  if (i > runStart) out += _strSlice(s, runStart, i);
+  return out;
+}
+
+// The @internal LENIENT PEM decode of a fixed-`label` block (the historic signer-certificate path,
+// distinct from the strict canonical `pemDecode` above): the body of the first
+// "-----BEGIN <label>-----...-----END <label>-----" block with any non-base64 character stripped,
+// decoded through Node's lenient base64. Returns the DER Buffer, or null when no such block exists so
+// the caller keeps its own domain error. NOT for verified input -- pemDecode is the fail-closed door.
+function pemDecodeLenient(text, label) {
+  var begin = _PEM_BEGIN + label + _PEM_DASHES;
+  var end = _PEM_END + label + _PEM_DASHES;
+  var bi = _strIndexOf(text, begin);
+  if (bi === -1) return null;
+  var bodyStart = bi + begin.length;
+  var ei = _strIndexOf(text, end, bodyStart);
+  if (ei === -1) return null;
+  return _bufferFrom(_keepBase64(_strSlice(text, bodyStart, ei)), "base64");
+}
+
 // Coerce parse input to DER bytes. A PEM string OR a PEM Buffer (a .pem file
 // read with fs.readFileSync) is unwrapped with opts.pemLabel; a DER Buffer or
 // Uint8Array is taken as bytes. opts: { pemLabel, PemError, ErrorClass, prefix }.
 function coerceToDer(input, opts) {
   if (typeof input === "string") return pemDecode(input, opts.pemLabel, opts.PemError);
-  if (_isBuffer(input) || _isUint8Array(input)) {
-    // Route the DER Buffer / Uint8Array through the shared byte guard so a
-    // detached backing store fails closed here for every format that composes
-    // this boundary (x509/crl/csr/pkcs8/cms/pkcs12), not per-format.
-    var buf = guard.bytes.view(input, opts.ErrorClass, opts.prefix + "/bad-input", "parse");
+  if (guard.bytes.isByteSource(input)) {
+    // Route any DER BufferSource (Buffer, typed array, DataView, or ArrayBuffer) through the shared byte
+    // guard so a detached backing store fails closed here for every format that composes this boundary
+    // (x509/crl/csr/pkcs8/cms/pkcs12), not per-format, and its byte view is read from the slot -- a
+    // cross-realm ArrayBuffer or an offset DataView reaches the decoder exactly as a Buffer does.
+    var buf = guard.bytes.source(input, opts.ErrorClass, opts.prefix + "/bad-input", "parse");
     return _isPemArmor(buf) ? pemDecode(buf, opts.pemLabel, opts.PemError) : buf;
   }
-  throw new opts.ErrorClass(opts.prefix + "/bad-input", "parse expects a DER Buffer or a PEM string");
+  throw new opts.ErrorClass(opts.prefix + "/bad-input", "parse expects a DER BufferSource (Buffer, typed array, DataView, or ArrayBuffer) or a PEM string");
 }
 
 // Does a Buffer carry PEM armor (a .pem read with fs.readFileSync) instead of
@@ -1671,10 +1801,24 @@ function signedEnvelope(ns, tbsSchema, opts) {
 // whitespace, no leading/trailing dot, no empty label, no underscore, LDH labels (1-63 octets, no leading /
 // trailing hyphen), <= 253 octets, an optional leftmost "*" wildcard. Returns a reason string, or null when
 // well-formed. The shared home so the linter AND an identity comparator (case-fold only a valid dNSName) agree.
+// One LDH label (RFC 1034 preferred syntax), decided character by character: every character an
+// ASCII letter/digit/hyphen, and a hyphen neither first nor last. The caller has already rejected
+// any label carrying a dot, whitespace, or underscore, so only the LDH shape remains to check.
+function _isLdhLabel(s) {
+  var n = s.length;
+  if (n === 0) return false;
+  for (var i = 0; i < n; i++) {
+    var ch = _charAt(s, i);
+    if ((ch >= "a" && ch <= "z") || (ch >= "A" && ch <= "Z") || (ch >= "0" && ch <= "9")) continue;
+    if (ch === "-") { if (i === 0 || i === n - 1) return false; } else return false;
+  }
+  return true;
+}
+
 function dnsNameProblem(s) {
   if (typeof s !== "string" || !s.length) return "empty";
   if (s.length > 253) return "exceeds 253 octets";
-  if (_reTest(/\s/, s)) return "whitespace";
+  if (_hasWhitespace(s)) return "whitespace";
   if (_charAt(s, 0) === "." || _charAt(s, s.length - 1) === ".") return "leading/trailing dot";
   if (_strIndexOf(s, "_") !== -1) return "underscore forbidden in dNSName";
   var labels = _split(s, ".");
@@ -1686,7 +1830,7 @@ function dnsNameProblem(s) {
       if (labels.length < 2) return "bare wildcard";
       continue;
     }
-    if (!_reTest(/^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/i, label)) return "invalid label syntax";
+    if (!_isLdhLabel(label)) return "invalid label syntax";
   }
   return null;
 }
@@ -1695,7 +1839,12 @@ module.exports = {
   dnsNameProblem: dnsNameProblem,
   pemDecode: pemDecode,
   pemDecodeAll: pemDecodeAll,
+  pemDecodeLenient: pemDecodeLenient,
   pemEncode: pemEncode,
+  isJsWhitespace: _isJsWhitespace,   // the shared JS regex \s code-point predicate for char-scan parsers
+  stripBase64Whitespace: _stripB64Whitespace,   // shared CR/LF/TAB/SP strip for base64 bodies (PEM, MIME)
+  charTable: _charTable,   // build a code-point membership table from a string of allowed characters
+  allCharsIn: _allCharsIn,   // is a NON-EMPTY string composed only of table members (the /^[chars]+$/ family)
   coerceToDer: coerceToDer,
   decodeRoot: decodeRoot,
   runParse: runParse,

package/lib/schema-tsp.js

@@ -177,7 +177,16 @@ var TST_INFO = schema.seq([
       // genTime is surfaced as a millisecond-precision Date; genTimeFraction is the
       // exact fractional-seconds digits (lossless for sub-millisecond precision), or
       // null when genTime carries no fraction.
-      genTimeFraction: (function () { var g = /\.(\d+)Z$/.exec(m.fields.genTime.node.content.toString("latin1")); return g ? g[1] : null; })(),
+      genTimeFraction: (function () {
+        // /\.(\d+)Z$/ : the fractional-seconds digits before a trailing "Z" (the "." and "Z" excluded), or null.
+        var s = m.fields.genTime.node.content.toString("latin1"), n = s.length;
+        if (n < 3 || s.charAt(n - 1) !== "Z") return null;
+        var dot = s.lastIndexOf(".");
+        if (dot < 0 || dot > n - 3) return null;
+        var frac = s.slice(dot + 1, n - 1);
+        for (var fi = 0; fi < frac.length; fi++) { var cc = frac.charCodeAt(fi); if (cc < 48 || cc > 57) return null; }
+        return frac;
+      })(),
       accuracy: m.fields.accuracy.present ? m.fields.accuracy.value.result : null,
       ordering: m.fields.ordering.present ? m.fields.ordering.value : false,
       nonce: m.fields.nonce.present ? m.fields.nonce.value : null,

package/lib/sign-scheme.js

@@ -242,7 +242,7 @@ function _normPkcs8(k, label, E) {
   throw E("bad-input", label + " must be a PKCS#8 DER Buffer, Uint8Array, or PEM string");
 }
 function _normCompositeKeys(key, comp, E) {
-  if (!key || typeof key !== "object" || _isBuffer(key) || _isU8(key) || key.mldsa == null || key.trad == null) {
+  if (!key || typeof key !== "object" || _isBuffer(key) || _isU8(key) || key.mldsa == null || key.trad == null) {   // allow:byte-source-narrow -- composite-key discrimination: a raw-key BufferSource (incl an ArrayBuffer, which is neither) is correctly classed non-composite and normalized by _normPkcs8
     throw E("bad-input", "a composite " + comp.name + " signer key must be { mldsa: <PKCS#8>, trad: <PKCS#8> }");
   }
   return { mldsa: _normPkcs8(key.mldsa, "the composite ML-DSA component key", E), trad: _normPkcs8(key.trad, "the composite traditional component key", E) };

package/lib/sigstore.js

@@ -31,6 +31,7 @@ var constants = require("./constants");
 var asn1 = require("./asn1-der");
 var guard = require("./guard-all");
 var x509 = require("./schema-x509");
+var pkix = require("./schema-pkix");
 var pathValidate = require("./path-validate");
 var merkle = require("./merkle");
 var oid = require("./oid");
@@ -43,9 +44,51 @@ function _err(code, message, cause) { return new SigstoreError(code, message, ca
 var JSON_MAX = C.LIMITS.JSON_MAX_BYTES;
 var SP = Buffer.from(" ", "ascii");
 var DSSEV1 = Buffer.from("DSSEv1", "ascii");
-// The checkpoint signature-line marker is EM DASH (U+2014) + space; built at
-// runtime so the source file stays pure ASCII.
-var NOTE_SIG = new RegExp("^" + String.fromCharCode(0x2014) + " (\\S+) (\\S+)$");
+// The checkpoint signature-line marker is EM DASH (U+2014) + space; built at runtime so the source
+// file stays pure ASCII. The line is parsed by character scan (no regex): "<EM DASH> <keyId> <sig>",
+// two whitespace-separated non-empty tokens, nothing after.
+var _EM_DASH = String.fromCharCode(0x2014);
+
+// The \S token scan uses the shared JS regex \s code-point predicate (pkix.isJsWhitespace) so the
+// note-line grammar stays exactly the /\S/ complement without a second copy of the code-point set.
+function _parseNoteSig(line) {
+  var prefix = _EM_DASH + " ";
+  if (line.slice(0, prefix.length) !== prefix) return null;
+  var p = prefix.length, n = line.length;
+  var t1s = p;
+  while (p < n && !pkix.isJsWhitespace(line.charCodeAt(p))) p += 1;
+  if (p === t1s) return null;                     // \S+ requires at least one character
+  var keyId = line.slice(t1s, p);
+  if (line.charAt(p) !== " ") return null;        // the literal single space between the tokens
+  p += 1;
+  var t2s = p;
+  while (p < n && !pkix.isJsWhitespace(line.charCodeAt(p))) p += 1;
+  if (p === t2s) return null;
+  var sig = line.slice(t2s, p);
+  if (p !== n) return null;                        // $ -- nothing after the second token
+  return { keyId: keyId, sig: sig };
+}
+
+// A run of trailing "=" removed (the /=+$/ base64-padding strip).
+function _stripTrailingEquals(s) {
+  var i = s.length;
+  while (i > 0 && s.charAt(i - 1) === "=") i -= 1;
+  return s.slice(0, i);
+}
+
+// The recognized bundle media types (draft: the inline ".v0.N+json" form and the
+// "+json;version=0.N" form, N in 1..3) -- an explicit set in place of the anchored alternation regex.
+var _BUNDLE_MEDIA_TYPES = {
+  "application/vnd.dev.sigstore.bundle.v0.1+json": 1,
+  "application/vnd.dev.sigstore.bundle.v0.2+json": 1,
+  "application/vnd.dev.sigstore.bundle.v0.3+json": 1,
+  "application/vnd.dev.sigstore.bundle+json;version=0.1": 1,
+  "application/vnd.dev.sigstore.bundle+json;version=0.2": 1,
+  "application/vnd.dev.sigstore.bundle+json;version=0.3": 1
+};
+function _isBundleMediaType(mt) {
+  return typeof mt === "string" && Object.prototype.hasOwnProperty.call(_BUNDLE_MEDIA_TYPES, mt);
+}
 
 // Parse untrusted JSON through the bounded, duplicate-member-rejecting guard.
 function _jsonParse(input, code, label) {
@@ -92,10 +135,10 @@ function pae(payloadType, payloadBytes) {
 // either, but reject a non-canonical re-encoding (an encoding-malleability guard).
 function _b64(s, label) {
   if (typeof s !== "string") throw _err("sigstore/bad-bundle", label + " must be a base64 string");
-  var urlSafe = /[-_]/.test(s);
+  var urlSafe = s.indexOf("-") !== -1 || s.indexOf("_") !== -1;
   var enc = urlSafe ? "base64url" : "base64";
   var buf = Buffer.from(s, enc);
-  if (buf.toString(enc).replace(/=+$/, "") !== s.replace(/=+$/, "")) {
+  if (_stripTrailingEquals(buf.toString(enc)) !== _stripTrailingEquals(s)) {
     throw _err("sigstore/bad-bundle", label + " is not canonical base64");
   }
   return buf;
@@ -137,7 +180,7 @@ function parseBundle(input) {
   // a newer version is recognized-and-deferred, never accepted by an over-broad
   // match (the inline `.v0.N+json` form and the `+json;version=0.N` form).
   var mt = obj.mediaType;
-  if (typeof mt !== "string" || !/^application\/vnd\.dev\.sigstore\.bundle(\.v0\.[123]\+json|\+json;version=0\.[123])$/.test(mt)) {
+  if (!_isBundleMediaType(mt)) {
     throw _err("sigstore/bad-bundle-version", "unsupported or unknown bundle media type: " + (mt === undefined ? "(none)" : mt));
   }
   if (!obj.verificationMaterial || typeof obj.verificationMaterial !== "object") {
@@ -265,9 +308,9 @@ function _verifyCheckpoint(envelope, ip, rekorKeys, timeMs) {
   }
   var sigBlock = buf.subarray(sep + 2).toString("utf8").split("\n");
   for (var i = 0; i < sigBlock.length; i++) {
-    var m = sigBlock[i].match(NOTE_SIG);
-    if (!m) continue;
-    var blob = _b64(m[2], "checkpoint signature");
+    var note = _parseNoteSig(sigBlock[i]);
+    if (!note) continue;
+    var blob = _b64(note.sig, "checkpoint signature");
     if (blob.length < 5) continue;
     var hint = blob.subarray(0, 4), derSig = blob.subarray(4);
     var k = _rekorKey(rekorKeys, null, hint, timeMs);

package/lib/smime.js

@@ -245,26 +245,95 @@ function _outerPrefix(list) {
 // non-ASCII protected value round-trips intact -- a latin1 string maps 1:1 to bytes, recovering the emitted UTF-8.
 function _utf8Header(s) { return Buffer.from(s, "latin1").toString("utf8"); }
 
+// ---- header parsing by character scan (no regex) ----------------------------------------------
+// ASCII lowercase of a code point (A-Z -> a-z), for the case-insensitive "content-type" literal match.
+function _asciiLower(c) { return (c >= 65 && c <= 90) ? c + 32 : c; }
+var _CONTENT_TYPE = "content-type";
+
+// RFC 5322 header unfolding: a CRLF followed by one-or-more SP/HTAB (a folded continuation) collapses
+// to a single space (matching /\r\n[ \t]+/g -> " ").
+function _unfoldHeaderFolds(s) {
+  var out = "", i = 0, n = s.length;
+  while (i < n) {
+    if (s.charCodeAt(i) === 0x0d && i + 1 < n && s.charCodeAt(i + 1) === 0x0a &&
+        i + 2 < n && (s.charCodeAt(i + 2) === 0x20 || s.charCodeAt(i + 2) === 0x09)) {
+      out += " ";
+      i += 2;
+      while (i < n && (s.charCodeAt(i) === 0x20 || s.charCodeAt(i) === 0x09)) i += 1;
+    } else {
+      out += s.charAt(i);
+      i += 1;
+    }
+  }
+  return out;
+}
+
+// If the line beginning at `start` is a Content-Type field -- ^[ \t]*content-type[ \t]*: -- return the
+// whole line up to (not including) the next CR or LF (the [^\r\n]* tail); else null. Case-insensitive
+// on the literal, matching the /i flag over the ASCII field name.
+function _contentTypeLineAt(s, start) {
+  var n = s.length, p = start;
+  while (p < n && (s.charCodeAt(p) === 0x20 || s.charCodeAt(p) === 0x09)) p += 1;
+  if (p + _CONTENT_TYPE.length > n) return null;
+  for (var k = 0; k < _CONTENT_TYPE.length; k++) {
+    if (_asciiLower(s.charCodeAt(p + k)) !== _CONTENT_TYPE.charCodeAt(k)) return null;
+  }
+  p += _CONTENT_TYPE.length;
+  while (p < n && (s.charCodeAt(p) === 0x20 || s.charCodeAt(p) === 0x09)) p += 1;
+  if (p >= n || s.charCodeAt(p) !== 0x3a) return null;   // ":"
+  p += 1;
+  while (p < n && s.charCodeAt(p) !== 0x0d && s.charCodeAt(p) !== 0x0a) p += 1;
+  return s.slice(start, p);
+}
+
+// Every Content-Type field in the header block (the /gim match, /m making ^ match each line start):
+// scan the block start and each position after an LF. Returns the matched lines, or null when none.
+function _contentTypeLines(s) {
+  var lines = [], lineStart = 0;
+  while (lineStart <= s.length) {
+    var line = _contentTypeLineAt(s, lineStart);
+    if (line !== null) lines.push(line);
+    var nl = s.indexOf("\n", lineStart);
+    if (nl === -1) break;
+    lineStart = nl + 1;
+  }
+  return lines.length ? lines : null;
+}
+
+// The ^[ \t]*content-type[ \t]*: prefix removed from a matched Content-Type line (the value remains).
+function _contentTypeValue(s) {
+  var n = s.length, p = 0;
+  while (p < n && (s.charCodeAt(p) === 0x20 || s.charCodeAt(p) === 0x09)) p += 1;
+  if (p + _CONTENT_TYPE.length > n) return s;
+  for (var k = 0; k < _CONTENT_TYPE.length; k++) {
+    if (_asciiLower(s.charCodeAt(p + k)) !== _CONTENT_TYPE.charCodeAt(k)) return s;
+  }
+  p += _CONTENT_TYPE.length;
+  while (p < n && (s.charCodeAt(p) === 0x20 || s.charCodeAt(p) === 0x09)) p += 1;
+  if (p >= n || s.charCodeAt(p) !== 0x3a) return s;
+  return s.slice(p + 1);
+}
+
 function _declaresHp(content) {
   // content is the CANONICAL entity bytes -- the caller (_hpSurface) runs mime.canonicalizeText ONCE so
   // detection here and the subsequent mime.parse see the identical normalized form (bare CR / LF -> CRLF).
   // Detecting hp on the canonical form -- the bytes the signature covers -- is what stops a fold/line-ending
   // transport rewrite from stripping the hp signal from a still-valid signed message.
   var s = content.toString("latin1");
-  var m = s.match(/\r\n\r\n/);
-  var head = (m ? s.slice(0, m.index) : s).replace(/\r\n[ \t]+/g, " ");
+  var sep = s.indexOf("\r\n\r\n");
+  var head = _unfoldHeaderFolds(sep !== -1 ? s.slice(0, sep) : s);
   // Detect hp by composing mime.paramCount, the same comment- + quoted-string-aware tokenizer the parser
   // uses -- over each Content-Type field, so the probe never diverges from mime.parse: a leading-whitespace
   // or before-colon field name is matched (the parser trims it), while an hp= inside a MIME comment or a
   // quoted value is not a parameter (so an ordinary Content-Type cannot opt a message into HP processing). A
   // real hp on ANY Content-Type line is detected; a duplicate Content-Type is rejected downstream.
-  var cts = head.match(/^[ \t]*content-type[ \t]*:[^\r\n]*/gim);
+  var cts = _contentTypeLines(head);
   if (!cts) return false;
   for (var i = 0; i < cts.length; i++) {
     // hasParam (not paramCount): a payload that names the hp attribute without a value ("...; hp") still
     // CLAIMS header protection -- detect it so _hpSurface fails closed on the malformed declaration rather
     // than silently downgrading it to unprotected.
-    if (mime.hasParam(cts[i].replace(/^[ \t]*content-type[ \t]*:/i, ""), "hp")) return true;
+    if (mime.hasParam(_contentTypeValue(cts[i]), "hp")) return true;
   }
   return false;
 }
@@ -714,8 +783,19 @@ function _micalgOf(p7Der) {
 // A fresh multipart boundary that cannot collide with the content (random, dashed, unique per call).
 function _boundary() { return "----=_pki_smime_" + nodeCrypto.randomBytes(18).toString("hex"); }
 
+// Base64 wrapped to 64-column lines joined by CRLF, no trailing CRLF (matching (.{64})->"$1\r\n"
+// then a trailing-CRLF strip; base64 output carries no CRLF of its own).
+function _wrap64Crlf(s) {
+  var out = "";
+  for (var i = 0; i < s.length; i += 64) {
+    if (i > 0) out += "\r\n";
+    out += s.slice(i, i + 64);
+  }
+  return out;
+}
+
 function _base64Body(der) {
-  return Buffer.from(der.toString("base64").replace(/(.{64})/g, "$1\r\n").replace(/\r\n$/, ""), "latin1");
+  return Buffer.from(_wrap64Crlf(der.toString("base64")), "latin1");
 }
 
 /**
@@ -1180,7 +1260,7 @@ async function decompress(message, opts) {
 function _decodeCms(ent) {
   // guard.encoding.base64 is strict (no whitespace) and rejects via a (code,msg) FACTORY -- strip the
   // MIME line-wrapping whitespace first, and pass _err (not the SmimeError class).
-  if (ent.cte === "base64") return guard.encoding.base64(ent.body.toString("latin1").replace(/[\r\n\t ]/g, ""), C.LIMITS.MIME_MAX_BYTES, _err, "smime/bad-mime", "the CMS body");
+  if (ent.cte === "base64") return guard.encoding.base64(pkix.stripBase64Whitespace(ent.body.toString("latin1")), C.LIMITS.MIME_MAX_BYTES, _err, "smime/bad-mime", "the CMS body");
   return ent.body;
 }