@blamejs/pki 0.5.39 → 0.6.1

package/lib/ct.js

@@ -154,7 +154,7 @@ function _parseSct(r, sctLen) {
  * @primitive  pki.ct.parseSctList
  * @signature  pki.ct.parseSctList(extValue) -> { scts, unknownScts, all }
  * @since      0.1.20
- * @status     experimental
+ * @status     stable
  * @spec       RFC 6962, RFC 5246, RFC 8446
  * @related    pki.ct.reconstructSignedData, pki.ct.encodeSctList, pki.schema.x509.parse
  *
@@ -252,7 +252,7 @@ function _u24Bytes(n) {
  * @primitive  pki.ct.reconstructSignedData
  * @signature  pki.ct.reconstructSignedData(entry, sct) -> Buffer
  * @since      0.1.20
- * @status     experimental
+ * @status     stable
  * @spec       RFC 6962
  * @related    pki.ct.parseSctList
  *
@@ -378,7 +378,7 @@ function _spkiAlg(spki) {
  * @primitive  pki.ct.verifySct
  * @signature  pki.ct.verifySct(entry, sct, logPublicKey) -> Promise<boolean>
  * @since      0.2.12
- * @status     experimental
+ * @status     stable
  * @spec       RFC 6962
  * @defends    sct-signature-forgery (CWE-347)
  * @related    pki.ct.parseSctList, pki.ct.reconstructSignedData
@@ -498,7 +498,7 @@ function _encodeSctBody(sct) {
  * @primitive  pki.ct.encodeSctList
  * @signature  pki.ct.encodeSctList(scts) -> Buffer
  * @since      0.2.24
- * @status     experimental
+ * @status     stable
  * @spec       RFC 6962, RFC 5246
  * @related    pki.ct.parseSctList, pki.ct.signSct
  *
@@ -573,7 +573,7 @@ function _logKeyMaterial(logKey) {
  * @primitive  pki.ct.signSct
  * @signature  pki.ct.signSct(entry, logKey, opts?) -> Promise<sct>
  * @since      0.2.24
- * @status     experimental
+ * @status     stable
  * @spec       RFC 6962
  * @related    pki.ct.verifySct, pki.ct.reconstructSignedData, pki.ct.encodeSctList
  *
@@ -723,7 +723,7 @@ function _logsAgree(a, b) {
  * @primitive  pki.ct.parseLogList
  * @signature  pki.ct.parseLogList(json, opts?) -> { logs, byLogId, version, timestamp }
  * @since      0.2.28
- * @status     experimental
+ * @status     stable
  * @spec       RFC 6962
  * @related    pki.ct.verifySctWithLogList, pki.ct.verifySct
  *
@@ -815,7 +815,7 @@ function _resolveNotAfter(entry, opts) {
  * @primitive  pki.ct.verifySctWithLogList
  * @signature  pki.ct.verifySctWithLogList(entry, sct, logList, opts?) -> Promise<boolean>
  * @since      0.2.28
- * @status     experimental
+ * @status     stable
  * @spec       RFC 6962
  * @related    pki.ct.parseLogList, pki.ct.verifySct
  *
@@ -848,37 +848,292 @@ function _resolveNotAfter(entry, opts) {
  *     state: { usable: { timestamp: "2026-01-01T00:00:00Z" } } }] }] }), "utf8"));
  *   var ok = await pki.ct.verifySctWithLogList(sctEntry, embeddedSct, logList);
  */
-async function verifySctWithLogList(entry, sct, logList, opts) {
-  opts = opts || {};
-  if (logList == null || typeof logList !== "object" || logList.byLogId == null) throw _ctErr("ct/bad-input", "logList must be a pki.ct.parseLogList result");
-  if (sct == null || typeof sct !== "object" || typeof sct.logIdHex !== "string") throw _ctErr("ct/bad-input", "the SCT is missing its logIdHex");
+// The pure, NON-THROWING log resolution + state + temporal classifier shared by verifySctWithLogList
+// (which throws the mapped code on a non-ok status) and verifySctList (which records the code into a
+// result row and continues). Returns { status, log?, code?, message? } where status is one of
+// ok | bad-input | not-found | untrusted | temporal. A mis-shaped sct.timestamp (in the retired-log
+// gate) or a malformed opts.certNotAfter (in the temporal gate, via within) still THROWS -- those are
+// caller mis-shapes, not per-SCT trust outcomes (the three-tier rule: bad input throws, a per-SCT
+// verdict is recorded). The state and temporal gate semantics are verbatim from the original
+// verifySctWithLogList body, so its shipped RED vectors are the behavior guard for this refactor.
+function _classifyLog(sct, logList, entry, opts) {
+  if (logList == null || typeof logList !== "object" || logList.byLogId == null) return { status: "bad-input", code: "ct/bad-input", message: "logList must be a pki.ct.parseLogList result" };
+  if (sct == null || typeof sct !== "object" || typeof sct.logIdHex !== "string") return { status: "bad-input", code: "ct/bad-input", message: "the SCT is missing its logIdHex" };
   var log = logList.byLogId[sct.logIdHex];
-  if (log == null) throw _ctErr("ct/log-not-found", "no trusted CT log matches the SCT's logId " + sct.logIdHex);
+  if (log == null) return { status: "not-found", code: "ct/log-not-found", message: "no trusted CT log matches the SCT's logId " + sct.logIdHex };
   // State gate (fail-closed): trusted proceed; retired only before its retirement; else untrusted.
   if (!log.state.trusted) {
-    if (!log.state.conditional) throw _ctErr("ct/log-untrusted", "the CT log state '" + log.state.name + "' is not trusted");
+    if (!log.state.conditional) return { status: "untrusted", log: log, code: "ct/log-untrusted", message: "the CT log state '" + log.state.name + "' is not trusted" };
     var ts = guard.range.uint64(sct.timestamp, _ctErr, "ct/bad-input", "sct.timestamp");
-    if (ts >= BigInt(guard.time.instantOf(log.state.since))) throw _ctErr("ct/log-untrusted", "the CT log is retired and the SCT is not timestamped before its retirement (" + log.state.since.toISOString() + ")");
+    if (ts >= BigInt(guard.time.instantOf(log.state.since))) return { status: "untrusted", log: log, code: "ct/log-untrusted", message: "the CT log is retired and the SCT is not timestamped before its retirement (" + log.state.since.toISOString() + ")" };
   }
   // Temporal gate (fail-closed): the covered cert's notAfter must be in [start_inclusive, end_exclusive).
   if (log.temporalInterval) {
     var notAfter = _resolveNotAfter(entry, opts);
-    // within() validates notAfter (and the interval bounds) fail-closed before comparing: an Invalid
-    // Date is instanceof Date yet NaN, and NaN < x / NaN >= x are both false, so an unvalidated notAfter
-    // would silently BYPASS the [startInclusive, endExclusive) containment. A malformed notAfter throws
-    // inside within (pass a valid opts.certNotAfter); an out-of-window notAfter returns false here.
+    // An unresolvable notAfter is a failure for this windowed SCT, never a silent skip. within() then
+    // validates notAfter fail-closed before comparing: an Invalid Date is instanceof Date yet NaN, and
+    // NaN < x / NaN >= x are both false, so an unvalidated notAfter would BYPASS the containment. A
+    // malformed opts.certNotAfter throws inside within (a caller mis-shape); an out-of-window one is
+    // this recorded temporal status.
+    if (notAfter == null) return { status: "temporal", log: log, code: "ct/temporal-interval", message: "the windowed CT log has no resolvable covered-certificate notAfter (pass a valid opts.certNotAfter)" };
     if (!guard.time.within(notAfter, log.temporalInterval.startInclusive, log.temporalInterval.endExclusive, _ctErr, "ct/temporal-interval", "the covered certificate notAfter (pass a valid opts.certNotAfter)")) {
-      throw _ctErr("ct/temporal-interval", "the covered certificate's notAfter is outside the CT log's temporal_interval");
+      return { status: "temporal", log: log, code: "ct/temporal-interval", message: "the covered certificate's notAfter is outside the CT log's temporal_interval" };
     }
   }
-  return verifySct(entry, sct, log.key);   // the shipped crypto verdict (re-checks the logId binding)
+  return { status: "ok", log: log };
+}
+
+async function verifySctWithLogList(entry, sct, logList, opts) {
+  opts = opts || {};
+  var c = _classifyLog(sct, logList, entry, opts);
+  if (c.status !== "ok") throw _ctErr(c.code, c.message);
+  return verifySct(entry, sct, c.log.key);   // the shipped crypto verdict (re-checks the logId binding)
+}
+
+// Options verifySctList reads. All optional; the defaults are the RFC 6962 sec. 3.3 floor (>= 1).
+var _VERIFY_SCT_LIST_OPTS = { minScts: 1, minOperators: 1, certNotAfter: 1, at: 1 };
+
+// A caller-supplied policy threshold: a positive integer, or null when omitted (defaulted by the caller).
+function _policyCount(v, name) {
+  if (v == null) return null;
+  if (typeof v !== "number" || !intrinsic.isInteger(v) || v < 1) throw _ctErr("ct/bad-input", name + " must be a positive integer");
+  return v;
+}
+
+/**
+ * @primitive  pki.ct.verifySctList
+ * @signature  pki.ct.verifySctList(entry, list, logList, opts?) -> Promise<verdict>
+ * @since      0.6.1
+ * @status     stable
+ * @spec       RFC 6962
+ * @related    pki.ct.verifySct, pki.ct.verifySctWithLogList, pki.ct.parseLogList, pki.ct.parseSctList
+ *
+ * Render a certificate-level Certificate Transparency verdict over the SET of SCTs a certificate carries
+ * (RFC 6962 sec. 3.3), rather than one SCT at a time. Each SCT is resolved to a trusted log through
+ * `logList` and verified with the shipped `verifySct`; the verdict reports how many distinct trusted
+ * logs verified an SCT (`validScts`, so a duplicated SCT cannot inflate the count), from how many
+ * distinct trusted operators, and whether that meets the caller's CT policy. The RFC floor is one valid
+ * SCT (sec. 3.3), so `minScts` and `minOperators` both default to 1; the distinct-operator axis is a
+ * browser CT policy layered on top of the RFC, so the caller sets the threshold and the verdict surfaces
+ * the counts rather than hardcoding a browser's numbers.
+ *
+ * `entry` is the shared log-entry context for every SCT (`{ entryType: 0, leafCert }` for SCTs delivered
+ * over TLS/OCSP, or `{ entryType: 1, tbsCertificate, issuerKeyHash }` for embedded SCTs; the shape
+ * `pki.ct.x509CertEntry` produces). `list` is a `parseSctList` result, its `.scts` array, or an array of
+ * decoded v1 SCTs; unknown-version entries are counted `unknownScts` and never as valid. `logList` is a
+ * `parseLogList` result. A policy shortfall is a verdict (`policyOk: false`), not a throw; a per-SCT
+ * trust or crypto failure is recorded into its result row (`valid: false`, with a `code` for a
+ * structural or trust exclusion, without one for a cryptographic mismatch) and the loop continues; only
+ * a mis-shaped `entry` / `list` / `logList` / `opts` throws a typed `CtError`.
+ *
+ * @opts
+ *   - `minScts` (int, default 1) -- required count of valid SCTs from trusted, in-window logs.
+ *   - `minOperators` (int, default 1) -- required count of distinct trusted operators among them.
+ *   - `certNotAfter` (Date) -- the covered certificate's notAfter for each windowed log's temporal gate;
+ *     auto-derived from `entry.leafCert` for entryType 0, required for a precert entry against a windowed log.
+ *   - `at` (Date) -- the validation time; when supplied, an SCT whose timestamp is later than it is
+ *     rejected and not counted (RFC 6962 sec. 5.2, a client rejects a future-dated SCT). The
+ *     pki.path.validate CT gate passes its opts.time here.
+ * @example
+ *   // requires: logListJsonBytes -- the CT log-list JSON a distributor publishes (the log_list.json browsers consume)
+ *   // requires: sctExtValue -- a certificate's SCT-list extension value (a signedCertificateTimestampList extension)
+ *   // requires: certDer -- the DER of the certificate the SCTs cover
+ *   var logList = pki.ct.parseLogList(logListJsonBytes);
+ *   var list = pki.ct.parseSctList(sctExtValue);
+ *   var verdict = await pki.ct.verifySctList({ entryType: 0, leafCert: certDer }, list, logList,
+ *     { minScts: 2, minOperators: 2 });
+ *   verdict.policyOk;        // did the certificate meet the CT policy?
+ *   verdict.operators;       // the distinct trusted operators whose logs verified an SCT
+ */
+async function verifySctList(entry, list, logList, opts) {
+  opts = guard.identifier.optionsObject(opts, _ctErr, "ct/bad-input", "pki.ct.verifySctList options");
+  guard.identifier.assertKnownKeys(opts, _VERIFY_SCT_LIST_OPTS, _ctErr, "ct/bad-input", "pki.ct.verifySctList has an unknown option: ");
+  var minScts = _policyCount(opts.minScts, "opts.minScts"); if (minScts == null) minScts = 1;
+  var minOperators = _policyCount(opts.minOperators, "opts.minOperators"); if (minOperators == null) minOperators = 1;
+  if (logList == null || typeof logList !== "object" || logList.byLogId == null) throw _ctErr("ct/bad-input", "logList must be a pki.ct.parseLogList result");
+  if (entry == null || (entry.entryType !== 0 && entry.entryType !== 1)) throw _ctErr("ct/bad-entry-type", "entryType must be x509_entry(0) or precert_entry(1) (RFC 6962 sec. 3.1)");
+  // The validation time, when supplied, arms the RFC 6962 sec. 5.2 rule that a future-dated SCT is
+  // rejected: a log cannot have issued an SCT after the moment we verify it, so its timestamp must not
+  // be later than `at`. Held as a millisecond Number and compared against the SCT's BigInt uint64
+  // timestamp (a BigInt-vs-Number relational comparison is exact).
+  var atMs = null;
+  if (opts.at != null) { guard.time.assertValid(opts.at, _ctErr, "ct/bad-input", "opts.at (the validation time)"); atMs = guard.time.instantOf(opts.at); }
+  // A present certNotAfter must be a valid Date: a non-Date is a caller mis-shape that throws, never a
+  // value silently ignored (entryType 0 would fall back to the certificate's own notAfter) or demoted to
+  // a per-SCT temporal failure (entryType 1) -- the malformed-options contract, matching opts.at.
+  if (opts.certNotAfter != null) guard.time.assertValid(opts.certNotAfter, _ctErr, "ct/bad-input", "opts.certNotAfter (the covered certificate's notAfter)");
+  // Validate the shared entry's required fields up front: a mis-shaped entry is a caller error that
+  // throws (not a per-SCT row or a verdict rendered without examining it), even when the SCT list is
+  // empty. The same fields reconstructSignedData reads for the preimage.
+  if (entry.entryType === 0) { _toBuffer(entry.leafCert, "entry.leafCert"); }
+  else {
+    if (_toBuffer(entry.issuerKeyHash, "entry.issuerKeyHash").length !== 32) throw _ctErr("ct/bad-issuer-key-hash", "entry.issuerKeyHash must be exactly 32 bytes (SHA-256 of the issuer SPKI, RFC 6962 sec. 3.2)");
+    _toBuffer(entry.tbsCertificate, "entry.tbsCertificate");
+  }
+  // Normalize the list into the known v1 SCTs plus the count of forward-compat unknown-version entries
+  // (M7 -- their body layout is undefined, so they are unverifiable, never a valid SCT, never a throw).
+  var scts, unknownScts;
+  if (list != null && intrinsic.isArray(list.scts)) { scts = list.scts; unknownScts = intrinsic.isArray(list.unknownScts) ? list.unknownScts.length : 0; }
+  else if (intrinsic.isArray(list)) { scts = list; unknownScts = 0; }
+  else throw _ctErr("ct/bad-input", "list must be a pki.ct.parseSctList result, its .scts array, or an array of decoded v1 SCTs");
+  // Bound the per-SCT verification work a caller-supplied array can demand to the same cap parseSctList
+  // enforces on wire input, so a bare oversized array cannot force an unbounded run of signature checks.
+  if (scts.length > C.LIMITS.SCT_MAX_COUNT) throw _ctErr("ct/too-many-scts", "the SCT list has " + scts.length + " entries, exceeding the SCT_MAX_COUNT cap of " + C.LIMITS.SCT_MAX_COUNT + " (RFC 6962 sec. 3.3)");
+
+  var results = [], validScts = 0, operators = [], seenOps = intrinsic.create(null), seenLogs = intrinsic.create(null);
+  for (var i = 0; i < scts.length; i++) {
+    var sct = scts[i];
+    var row = { logIdHex: (sct && typeof sct.logIdHex === "string") ? sct.logIdHex : null, valid: false,
+      operator: null, logState: null,
+      timestamp: (sct && typeof sct.timestamp === "bigint") ? sct.timestamp : null, code: undefined, reason: undefined };
+    // Classification can THROW for a malformed per-SCT field (a bad timestamp on a retired-log match):
+    // that is a recorded per-SCT outcome, never a thrown aggregate abort, so it matches the usable-log
+    // malformed-SCT path below and one bad SCT cannot sink the verdict or a valid sibling.
+    var c;
+    try { c = _classifyLog(sct, logList, entry, opts); }
+    catch (e) {
+      if (!(e && e.isPkiError)) throw e;
+      row.code = e.code; row.reason = e.message; intrinsic.push(results, row); continue;
+    }
+    if (c.log) { row.operator = c.log.operator; row.logState = c.log.state.name; }
+    if (c.status !== "ok") { row.code = c.code; row.reason = c.message; intrinsic.push(results, row); continue; }
+    // A trust exclusion is a recorded code above; the crypto check below is false-is-a-verdict. But a
+    // structurally-defective SCT from a trusted log (a malformed signature encoding, an unsupported hash
+    // or curve) makes verifySct THROW a typed CtError -- for the aggregate that is a recorded per-SCT
+    // outcome (M10, the verdict-collector tier), never a thrown call that would sink the verdict or a
+    // valid sibling. A non-PkiError (an unexpected bug) is re-thrown, never swallowed into a verdict.
+    var ok;
+    try { ok = await verifySct(entry, sct, c.log.key); }
+    catch (e) {
+      if (!(e && e.isPkiError)) throw e;
+      row.code = e.code; row.reason = e.message; intrinsic.push(results, row); continue;
+    }
+    // RFC 6962 sec. 5.2: reject a future-dated SCT even when its signature verifies -- a log cannot have
+    // issued it after the validation time, so it is recorded as a rejection and never counted. An SCT
+    // dated after the certificate's OWN notAfter is deliberately NOT rejected: RFC 6962 sec. 5.1 permits
+    // a log to accept an already-expired certificate, so such an SCT is legitimate.
+    if (ok === true && atMs != null && sct.timestamp > atMs) {
+      row.code = "ct/future-timestamp"; row.reason = "the SCT timestamp is later than the validation time (RFC 6962 sec. 5.2)";
+      intrinsic.push(results, row); continue;
+    }
+    row.valid = ok === true;
+    // Count each distinct trusted log once: a duplicated SCT, or a second SCT from the same log, is one
+    // attestation, so a repeat cannot inflate validScts past a minScts policy (the count is over the set
+    // of logs, not raw SCT copies). The duplicate row is still recorded for diagnostics.
+    if (row.valid && !seenLogs[sct.logIdHex]) {
+      seenLogs[sct.logIdHex] = true;
+      validScts++;
+      if (c.log.operator != null && !seenOps[c.log.operator]) { seenOps[c.log.operator] = true; intrinsic.push(operators, c.log.operator); }
+    }
+    intrinsic.push(results, row);
+  }
+  var operatorCount = operators.length;
+  var policyOk = validScts >= minScts && operatorCount >= minOperators;
+  return {
+    policyOk: policyOk, totalScts: scts.length + unknownScts, validScts: validScts, unknownScts: unknownScts,
+    operatorCount: operatorCount, operators: operators, required: { minScts: minScts, minOperators: minOperators },
+    results: results,
+    reason: policyOk ? null : ("CT policy not met: " + validScts + " valid SCT(s) from " + operatorCount + " distinct operator(s); require at least " + minScts + " SCT(s) from at least " + minOperators + " operator(s)"),
+  };
+}
+
+// A cert / issuer argument as a parsed x509: a DER Buffer, a PEM string, or an unmodified
+// pki.schema.x509.parse result. Routed through guard.parsed (provenance-based, getter-free) so a
+// caller object cannot spoof "already parsed" through a lying accessor; a malformed one is a typed
+// ct/bad-cert-entry, never a silently-skipped input.
+function _asParsedCert(v, field) {
+  // Inline require (circular load with schema-x509 -> schema-pkix), matching _resolveNotAfter above.
+  var x509 = require("./schema-x509.js");   // allow:inline-require -- circular load (see _resolveNotAfter)
+  return guard.parsed.acceptDerived(v, "certificate", x509.parse, _ctErr, "ct/bad-cert-entry", field);
+}
+
+/**
+ * @primitive  pki.ct.x509CertEntry
+ * @signature  pki.ct.x509CertEntry(cert, issuer) -> { entryType, tbsCertificate, issuerKeyHash }
+ * @since      0.6.1
+ * @status     stable
+ * @spec       RFC 6962
+ * @related    pki.ct.verifySctList, pki.ct.reconstructSignedData, pki.ct.verifySct
+ *
+ * Reconstruct the precertificate log entry from a FINAL certificate carrying embedded SCTs, so those
+ * SCTs can be verified end to end (RFC 6962 sec. 3.2): "reconstruct this TBSCertificate from the final
+ * certificate by extracting the TBSCertificate from it and deleting the SCT extension". Returns the
+ * `{ entryType: 1, tbsCertificate, issuerKeyHash }` entry `pki.ct.verifySctList` / `reconstructSignedData`
+ * consume, where `tbsCertificate` is the leaf TBS with ONLY the signedCertificateTimestampList extension
+ * removed and `issuerKeyHash` is `SHA-256(issuer SubjectPublicKeyInfo DER)` (32 bytes). The signed
+ * `tbs_certificate` an SCT covers is also without the CT poison extension (RFC 6962 sec. 3.2, "without
+ * the signature and the poison extension"), which sits in the same position the SCT list takes in the
+ * final certificate, so deleting the SCT-list extension IS the whole reconstruction: no poison extension
+ * is re-added. (The Precertificate Signing Certificate case, where the precert issuer differs from the
+ * final issuer, is out of scope; the common flow issues both from the one CA.)
+ *
+ * The removal is byte surgery on the CA-signed bytes, never a value re-serialization: the extensions
+ * list and the two enclosing containers are rebuilt from every OTHER element's raw DER, so the only
+ * bytes that change are the removed extension and the recomputed canonical DER length prefixes. `cert`
+ * and `issuer` each accept a DER `Buffer`, a PEM string, or a `pki.schema.x509.parse` result. A
+ * certificate with no extensions or no SCT-list extension is `ct/no-sct-extension`; an argument that is
+ * not a certificate is `ct/bad-cert-entry`, and malformed certificate bytes carry the X.509 parse fault.
+ *
+ * @example
+ *   // requires: leafCertDer -- the DER of a final certificate carrying embedded SCTs
+ *   // requires: issuerCertDer -- the DER of the certificate that issued it
+ *   // requires: sctExtValue -- the leaf's signedCertificateTimestampList extension value
+ *   // requires: logList -- a pki.ct.parseLogList result
+ *   var entry = pki.ct.x509CertEntry(leafCertDer, issuerCertDer);
+ *   var verdict = await pki.ct.verifySctList(entry, pki.ct.parseSctList(sctExtValue), logList,
+ *     { certNotAfter: pki.schema.x509.parse(leafCertDer).validity.notAfter });
+ */
+// The issuer contributes only its SubjectPublicKeyInfo (issuerKeyHash = SHA-256 of it), so it accepts
+// anything x509CertEntry's cert does PLUS a bare { subjectPublicKeyInfo: { bytes } } -- a trust anchor
+// carries its key without a full certificate, and requiring a whole cert there would refuse a leaf
+// validated directly under an anchor.
+function _issuerSpki(v, field) {
+  if (v != null && typeof v === "object" && !intrinsic.isBuffer(v) && v.subjectPublicKeyInfo != null && v.subjectPublicKeyInfo.bytes != null) {
+    // Validate the bare-form bytes as a BufferSource so a malformed value fails through the typed CT
+    // error contract, not a native TypeError from the SHA-256 update downstream.
+    return guard.bytes.view(v.subjectPublicKeyInfo.bytes, CtError, "ct/bad-cert-entry", field + " subjectPublicKeyInfo.bytes");
+  }
+  return _asParsedCert(v, field).subjectPublicKeyInfo.bytes;
+}
+
+function x509CertEntry(cert, issuer) {
+  var leaf = _asParsedCert(cert, "cert"), issSpki = _issuerSpki(issuer, "issuer");
+  var tbs = asn1.decode(leaf.tbsBytes);
+  // extensions [3] EXPLICIT is the last TBSCertificate field (context-constructed tag 3).
+  var wrapIdx = -1;
+  for (var i = 0; i < tbs.children.length; i++) {
+    if (tbs.children[i].tagClass === "context" && tbs.children[i].tagNumber === 3) { wrapIdx = i; break; }
+  }
+  if (wrapIdx < 0) throw _ctErr("ct/no-sct-extension", "the certificate has no extensions, so it carries no embedded SCT list (RFC 6962 sec. 3.2)");
+  var extsSeq = tbs.children[wrapIdx].children[0];   // the SEQUENCE OF Extension
+  var sctOid = asn1.build.oid(oid.byName("signedCertificateTimestampList"));
+  var kept = [], removed = 0;
+  for (var j = 0; j < extsSeq.children.length; j++) {
+    var ext = extsSeq.children[j];
+    // ext.children[0] is the extnID OID node; compare its exact TLV bytes to the SCT-list OID.
+    if (ext.children[0] && intrinsic.bufferEquals(ext.children[0].bytes, sctOid)) { removed++; continue; }
+    intrinsic.push(kept, ext.bytes);
+  }
+  if (removed === 0) throw _ctErr("ct/no-sct-extension", "the certificate carries no signedCertificateTimestampList extension (RFC 6962 sec. 3.2)");
+  // Rebuild the TBSCertificate SEQUENCE from raw child bytes; canonical DER lengths reproduce the
+  // original framing minus the removed extension. When the SCT-list was the ONLY extension, `kept` is
+  // empty and the extensions field is dropped ENTIRELY -- RFC 5280 Extensions is SIZE (1..MAX) and the
+  // [3] field is OPTIONAL, so an empty [3] SEQUENCE {} would be invalid and would not match the signed
+  // precert TBS, whose extensions field is likewise absent once its sole poison extension is removed.
+  var tbsChildren = [];
+  for (var k = 0; k < tbs.children.length; k++) {
+    if (k !== wrapIdx) { intrinsic.push(tbsChildren, tbs.children[k].bytes); continue; }
+    if (kept.length > 0) intrinsic.push(tbsChildren, asn1.build.explicit(3, asn1.build.sequence(kept)));
+  }
+  var issuerKeyHash = nodeCrypto.createHash("sha256").update(issSpki).digest();
+  return { entryType: 1, tbsCertificate: asn1.build.sequence(tbsChildren), issuerKeyHash: issuerKeyHash };
 }
 
 /**
  * @primitive  pki.ct.verifyLogListSignature
  * @signature  pki.ct.verifyLogListSignature(json, signature, publicKey) -> Promise<boolean>
  * @since      0.2.29
- * @status     experimental
+ * @status     stable
  * @spec       RFC 6962, RFC 8017
  * @related    pki.ct.parseLogList, pki.ct.verifySct
  *
@@ -1019,7 +1274,7 @@ function _fetchBody(transport, url, req, label) {
  * @primitive  pki.ct.fetchLogList
  * @signature  pki.ct.fetchLogList(opts) -> Promise<{ logs, byLogId, version, timestamp, raw, status, contentType, tls }>
  * @since      0.3.21
- * @status     experimental
+ * @status     stable
  * @spec       RFC 6962
  * @related    pki.ct.parseLogList, pki.ct.verifyLogListSignature, pki.ct.verifySctWithLogList
  *
@@ -1113,6 +1368,8 @@ module.exports = {
   signSct: signSct,
   parseLogList: parseLogList,
   verifySctWithLogList: verifySctWithLogList,
+  verifySctList: verifySctList,
+  x509CertEntry: x509CertEntry,
   verifyLogListSignature: verifyLogListSignature,
   fetchLogList: fetchLogList,
   HASH_ALGORITHMS: HASH_ALGORITHMS,

package/lib/est.js

@@ -162,7 +162,7 @@ function _knownOpts(opts, known, verb) {
  * @primitive  pki.est.transferDecode
  * @signature  pki.est.transferDecode(body) -> Buffer
  * @since      0.1.24
- * @status     experimental
+ * @status     stable
  * @spec       RFC 8951, RFC 4648
  * @related    pki.est.transferEncode
  *
@@ -200,7 +200,7 @@ function transferDecode(body) {
  * @primitive  pki.est.transferEncode
  * @signature  pki.est.transferEncode(der) -> string
  * @since      0.1.24
- * @status     experimental
+ * @status     stable
  * @spec       RFC 8951, RFC 4648
  * @related    pki.est.transferDecode
  *
@@ -389,7 +389,7 @@ function splitMultipartMixed(body, contentType) {
  * @primitive  pki.est.parseCertsOnly
  * @signature  pki.est.parseCertsOnly(der) -> { certificates, crls }
  * @since      0.1.24
- * @status     experimental
+ * @status     stable
  * @spec       RFC 7030, RFC 5272, RFC 5652
  * @related    pki.est.findIssuedCert, pki.schema.cms.parse
  *
@@ -695,7 +695,7 @@ var NOT_IMPLEMENTED_OPS = { fullcmc: 1 };
  * @primitive  pki.est.classifyResponse
  * @signature  pki.est.classifyResponse(status, headers, body, opts?) -> verdict
  * @since      0.1.24
- * @status     experimental
+ * @status     stable
  * @spec       RFC 7030, RFC 8951
  * @related    pki.est.paths, pki.est.parseCertsOnly
  *
@@ -796,7 +796,7 @@ function classifyResponse(status, headers, body, opts) {
  * @primitive  pki.est.paths
  * @signature  pki.est.paths(baseUrl, opts?) -> { cacerts, simpleenroll, ... }
  * @since      0.1.24
- * @status     experimental
+ * @status     stable
  * @spec       RFC 7030
  * @related    pki.est.classifyResponse
  *
@@ -1310,7 +1310,7 @@ function _certsResult(op, res, opts, csrSpki) {
  * @primitive  pki.est.fullcmc
  * @signature  pki.est.fullcmc(baseUrl, request, opts?) -> Promise<verdict | { retry, retryAfterSeconds }>
  * @since      0.4.16
- * @status     experimental
+ * @status     stable
  * @spec       RFC 7030, RFC 8951, RFC 5273, RFC 5272
  * @related    pki.cmc.build, pki.cmc.verify, pki.est.simpleenroll
  *
@@ -2024,7 +2024,7 @@ function _enroll(op, baseUrl, csrInput, opts) {
  * @primitive  pki.est.cacerts
  * @signature  pki.est.cacerts(baseUrl, opts?) -> Promise<{ certificates, crls } | { retry, retryAfterSeconds }>
  * @since      0.3.16
- * @status     experimental
+ * @status     stable
  * @spec       RFC 7030, RFC 8951
  * @related    pki.est.simpleenroll, pki.transport.https
  *
@@ -2068,7 +2068,7 @@ function cacerts(baseUrl, opts) {
  * @primitive  pki.est.simpleenroll
  * @signature  pki.est.simpleenroll(baseUrl, csr, opts?) -> Promise<{ certificate, chain, certificates } | { retry, retryAfterSeconds }>
  * @since      0.3.16
- * @status     experimental
+ * @status     stable
  * @spec       RFC 7030, RFC 5272
  * @related    pki.csr.sign, pki.est.simplereenroll, pki.est.cacerts
  *
@@ -2106,7 +2106,7 @@ function simpleenroll(baseUrl, csrInput, opts) {
  * @primitive  pki.est.simplereenroll
  * @signature  pki.est.simplereenroll(baseUrl, csr, opts?) -> Promise<{ certificate, chain, certificates } | { retry, retryAfterSeconds }>
  * @since      0.3.16
- * @status     experimental
+ * @status     stable
  * @spec       RFC 7030
  * @related    pki.est.simpleenroll, pki.est.reenrollGuard
  *
@@ -2285,7 +2285,7 @@ async function _serverkeygenResult(res, opts, derived) {
  * @primitive  pki.est.serverkeygen
  * @signature  pki.est.serverkeygen(baseUrl, csr, opts?) -> Promise<{ certificates, privateKey } | { certificates, encryptedKey } | { retry, retryAfterSeconds, retryAfterDate }>
  * @since      0.3.28
- * @status     experimental
+ * @status     stable
  * @spec       RFC 7030, RFC 8951
  * @related    pki.est.simpleenroll, pki.est.parseServerKeygenResponse
  *
@@ -2364,7 +2364,7 @@ function _csrattrsResult(res, opts) {
  * @primitive  pki.est.csrattrs
  * @signature  pki.est.csrattrs(baseUrl, opts?) -> Promise<{ available: true, attrs, plan } | { available: false, attrs: null }>
  * @since      0.3.28
- * @status     experimental
+ * @status     stable
  * @spec       RFC 7030, RFC 8951, RFC 9908
  * @related    pki.est.simpleenroll, pki.est.buildEnrollAttributes
  *

package/lib/hpke.js

@@ -455,7 +455,7 @@ var suites = {
  * @primitive pki.hpke.setupS
  * @signature pki.hpke.setupS(suiteIds, recipientPublicKey, opts?) -> { enc, context }
  * @since 0.2.2
- * @status experimental
+ * @status stable
  * @spec RFC 9180
  * @related pki.hpke.setupR, pki.hpke.seal
  *
@@ -495,7 +495,7 @@ function _setupS(ids, pkR, opts) {
  * @primitive pki.hpke.setupR
  * @signature pki.hpke.setupR(suiteIds, enc, recipientPrivateKey, opts?) -> context
  * @since 0.2.2
- * @status experimental
+ * @status stable
  * @spec RFC 9180
  * @related pki.hpke.setupS, pki.hpke.open
  *
@@ -538,7 +538,7 @@ function _setupR(ids, enc, skR, opts) {
  * @primitive pki.hpke.seal
  * @signature pki.hpke.seal(suiteIds, recipientPublicKey, opts, aad, pt) -> { enc, ct }
  * @since 0.2.2
- * @status experimental
+ * @status stable
  * @spec RFC 9180
  * @related pki.hpke.open, pki.hpke.setupS
  *
@@ -574,7 +574,7 @@ function seal(ids, pkR, opts, aad, pt) {
  * @primitive pki.hpke.open
  * @signature pki.hpke.open(suiteIds, enc, recipientPrivateKey, opts, aad, ct) -> pt
  * @since 0.2.2
- * @status experimental
+ * @status stable
  * @spec RFC 9180
  * @related pki.hpke.seal, pki.hpke.setupR
  *

package/lib/http-transport.js

@@ -245,7 +245,7 @@ function _classifyError(e, C) {
  * @primitive  pki.transport.https
  * @signature  pki.transport.https(defaults?) -> transport
  * @since      0.3.16
- * @status     experimental
+ * @status     stable
  * @spec       RFC 7030, RFC 8996
  * @defends    tls-downgrade (CWE-757), server-impersonation (CWE-297), response-flooding (CWE-770), ssrf (CWE-918)
  * @related    pki.est.cacerts, pki.est.simpleenroll

package/lib/lint.js

@@ -714,7 +714,7 @@ function _applyThreshold(report, severity) {
  * @primitive  pki.lint.certificate
  * @signature  pki.lint.certificate(input, opts?) -> LintReport
  * @since      0.2.10
- * @status     experimental
+ * @status     stable
  * @spec       RFC 5280, CA/Browser Forum TLS BR
  * @related    pki.schema.x509.parse, pki.inspect.certificate, pki.path.validate
  *
@@ -772,7 +772,7 @@ function certificate(input, opts) {
  * @primitive  pki.lint.rules
  * @signature  pki.lint.rules(profile?) -> [{id, severity, source, citation}]
  * @since      0.2.10
- * @status     experimental
+ * @status     stable
  * @spec       RFC 5280, CA/Browser Forum TLS BR
  *
  * Enumerate the rule registry (all rules, or one profile's). Each entry exposes its
@@ -790,7 +790,7 @@ function rules(profile) {
  * @primitive  pki.lint.profiles
  * @signature  pki.lint.profiles() -> [string]
  * @since      0.2.10
- * @status     experimental
+ * @status     stable
  * @spec       RFC 5280, CA/Browser Forum TLS BR
  *
  * List the known lint-profile names.

package/lib/ocsp-request-verify.js

@@ -0,0 +1,28 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+//
+// @internal -- the single signature seam for an inbound signed OCSPRequest (RFC 6960 sec. 4.1.1),
+// composed by pki.ocsp.verifyRequest. It routes the request-signature check through the same
+// certification-path signature engine (its EdDSA low-order-point and algorithm-confusion gates
+// included) that pki.ocsp.verify uses for a response and pki.crl.verify / pki.cms.verify use for
+// theirs, so no second, weaker verifier of an untrusted request can drift. The producing side runs
+// its own check over what it just signed (pki.ocsp.buildRequest's signer path); this is the
+// different question a responder asks about a request someone else produced. The slot, the wiring
+// assertion and the octet-alignment refusal are the shared seam (lib/verify-seam.js). It is not
+// wired into index.js and is reached only by require.
+
+var frameworkError = require("./framework-error");
+var seam = require("./verify-seam");
+
+var _seam = seam.makeSeam("ocsp-request-verify", frameworkError.OcspError, "ocsp/bad-input");
+
+// Verify a signed OCSPRequest's signature over its exact tbsRequest bytes under the SPKI of the
+// requestor certificate the request carries (RFC 6960 sec. 4.1.1). Unlike a CSR there is no
+// self-signature: the verifying key is the requestor's, identified to the responder by
+// requestorName and proven by the certificate embedded in (or supplied alongside) the request.
+function verifyRequestSignature(signatureAlgorithm, signature, signerSpkiBytes, tbsRequestBytes) {
+  return _seam.verify(signatureAlgorithm, signature, signerSpkiBytes, tbsRequestBytes);
+}
+
+module.exports = { setEngine: _seam.setEngine, verifyRequestSignature: verifyRequestSignature };