@blamejs/pki 0.6.12 → 0.6.13

package/CHANGELOG.md

@@ -4,13 +4,21 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## v0.6.12 — 2026-09-01
+## v0.6.13 — 2026-09-01
+
+pki.sigstore.verifyBundle now reports which transparency-log entry attested a bundle: the verdict carries `logIndex` and `logId` so a caller can locate the exact Rekor record it verified against.
+
+### Added
+
+- pki.sigstore.verifyBundle's verdict carries `logIndex` (the attested Rekor entry's global log index) and `logId` (the log's key id, hex) beside `integratedTime`, so a caller can fetch or audit the exact transparency-log record the bundle was verified against instead of re-deriving it.
+
+## v0.6.12 — 2026-08-31
 
 Three verify verbs that returned a bare boolean now return a verdict object naming the checks they had hidden, a canonical `valid` field is present on every object verify verdict so `if (res.valid)` reads the same everywhere, and revocation, digest, and provenance data omitted before is surfaced.
 
 ### Added
 
-- Every object verify verdict now carries a canonical `valid` boolean beside its existing terminal, so `if (res.valid)` reads the verdict the same way across the toolkit: pki.sigstore.verifyBundle, pki.csr.verify, pki.crmf.verifyPop (top and per message), pki.attrcert.verify, pki.webauthn.verify, pki.webauthn.verifyAssertion, pki.ocsp.verifyRequest (`valid` is `signed && signatureValid`), pki.ct.verifySctList (`valid` is `policyOk`), and pki.pkcs12.open (`valid` is `macVerified`). The existing fields (`verified`, `policyOk`, `macVerified`, and the rest) are unchanged. The multi-state string verdicts (pki.ocsp.verify `status`, pki.scep `status`) keep their terminal and do not gain a `valid` alias, since a boolean cannot carry their states.
+- Every object verify verdict now carries a canonical `valid` boolean beside its existing terminal, so `if (res.valid)` reads the verdict the same way across the toolkit: pki.sigstore.verifyBundle, pki.csr.verify, pki.crmf.verifyPop (top and per message), pki.attrcert.verify, pki.webauthn.verify, pki.webauthn.verifyAssertion, pki.ocsp.verifyRequest (`valid` is `signed && signatureValid`), pki.ct.verifySctList (`valid` is `policyOk`), and pki.pkcs12.open (`valid` is the store's verified integrity: the password MAC for a password store, or the CMS signature for a public-key store). The existing fields (`verified`, `policyOk`, `macVerified`, and the rest) are unchanged. The multi-state string verdicts (pki.ocsp.verify `status`, pki.scep `status`) keep their terminal and do not gain a `valid` alias, since a boolean cannot carry their states.
 - pki.ocsp.verify and pki.path.verifyOcspResponse surface `revocationTime` (the revocation instant) beside `revocationReason` on a revoked verdict, for long-term validation.
 - pki.cms.verify's primary signer node carries `digestAlgorithm`, the digest the countersignature node already reported, so a caller reading a signer's verdict learns it without a second parse.
 - pki.sigstore.verifyBundle carries `predicateTypeChecked`, so a caller that did not pin `opts.predicateType` learns the in-toto predicate went unverified rather than assuming it was checked.

package/lib/sigstore.js

@@ -411,7 +411,10 @@ function _verifyRekor(te, envelope, rekorKeys, leafDer) {
   if (!setOk) throw _err("sigstore/unattested-time", "the Rekor SET (the signed source of integratedTime) did not verify -- the log time is not attested and cannot date the Fulcio certificate");
   var t = Number(te.integratedTime);
   if (!Number.isFinite(t) || t < 0) throw _err("sigstore/bad-tlog-entry", "the transparency-log entry has a malformed integratedTime");
-  return t;
+  // Surface which attested Rekor log entry this is: the global log index and the log's key id (hex), so a
+  // caller can locate the exact transparency-log record for an audit rather than re-deriving it.
+  var li = Number(te.logIndex);
+  return { integratedTime: t, logIndex: Number.isFinite(li) ? li : null, logId: te.logId && te.logId.keyId ? _b64(te.logId.keyId, "logId.keyId").toString("hex") : null };
 }
 
 // ---- Fulcio chain leg (RFC 5280 path validation, as-of the log time) ----------
@@ -648,9 +651,10 @@ function _statement(payload, payloadType, expectedPredicate) {
  * the log entry bound to this exact signature; and the in-toto SLSA statement.
  * Any leg failing throws a typed `sigstore/*` error. On success returns
  * `{ valid: true, verified: true, payload, statement, subjects, predicateType, predicate,
- * identity, identityChecked, predicateTypeChecked, integratedTime }` (`valid` is the canonical
- * toolkit-wide verdict alias of `verified`, and `predicateTypeChecked` says whether a pinned
- * `opts.predicateType` was checked). `payload` is the raw verified
+ * identity, identityChecked, predicateTypeChecked, integratedTime, logIndex, logId }` (`valid` is the
+ * canonical toolkit-wide verdict alias of `verified`, `predicateTypeChecked` says whether a pinned
+ * `opts.predicateType` was checked, and `logIndex` / `logId` identify the attested Rekor log entry).
+ * `payload` is the raw verified
  * envelope bytes (never a re-serialization), and the caller confirms a
  * `subjects[].digest` matches the published artifact.
  *
@@ -708,13 +712,14 @@ async function verifyBundle(bundle, opts) {
   // verifies (and binds this signature), rejecting only if none do.
   var tlogs = Array.isArray(vm.tlogEntries) ? vm.tlogEntries : [];
   if (!tlogs.length) throw _err("sigstore/bad-bundle", "a keyless bundle requires at least one transparency-log entry");
-  var integratedTime = null, lastErr = null;
+  var rekor = null, lastErr = null;
   for (var ti = 0; ti < tlogs.length; ti++) {
     if (!tlogs[ti] || typeof tlogs[ti] !== "object") { lastErr = _err("sigstore/bad-bundle", "a transparency-log entry is not an object"); continue; }
-    try { integratedTime = _verifyRekor(tlogs[ti], env, rekorKeys, leafDer); break; }
+    try { rekor = _verifyRekor(tlogs[ti], env, rekorKeys, leafDer); break; }
     catch (e) { lastErr = e; }
   }
-  if (integratedTime === null) throw lastErr;
+  if (rekor === null) throw lastErr;
+  var integratedTime = rekor.integratedTime;
 
   // Leg 3 -- Fulcio chain, validated as of the (trusted) log time; then identity.
   // The instant comes through the time guard's intrinsic read. `getTime` is an ordinary method a
@@ -747,6 +752,10 @@ async function verifyBundle(bundle, opts) {
     // a caller that omitted the pin gets `false` and knows the SLSA predicate went unverified.
     predicateTypeChecked: opts.predicateType != null,
     integratedTime: integratedTime,
+    // The attested Rekor entry this verdict rests on: `logIndex` is its global log index and `logId` the
+    // log's key id (hex), so a caller can fetch or audit the exact transparency-log record.
+    logIndex: rekor.logIndex,
+    logId: rekor.logId,
   };
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.6.12",
+  "version": "0.6.13",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:abae2085-b406-4ed9-924e-bb379912b38a",
+  "serialNumber": "urn:uuid:7a020e1d-6d6a-4d9e-9a8b-d17c7e4fa867",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-09-01T01:44:33.946Z",
+    "timestamp": "2026-09-01T02:27:31.392Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.6.12",
+      "bom-ref": "@blamejs/pki@0.6.13",
       "type": "application",
       "name": "pki",
-      "version": "0.6.12",
+      "version": "0.6.13",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.6.12",
+      "purl": "pkg:npm/%40blamejs/pki@0.6.13",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.6.12",
+      "ref": "@blamejs/pki@0.6.13",
       "dependsOn": []
     }
   ]