@blamejs/pki 0.6.14 → 0.6.16

package/lib/mime.js

@@ -21,29 +21,23 @@ var guard = require("./guard-all.js");
 
 var CRLF = Buffer.from("\r\n");
 
-// A byte source -> a Buffer view, capped before any copy (CWE-770/400).
 function _buf(v, E, code, label) { return guard.bytes.view(v, E, code, label); }
 
-// Locate the header/body separator: the first empty line (a bare LF-LF or CRLF-CRLF, or a mix).
-// Returns { headerEnd, bodyStart } offsets, or null when there is no blank-line separator.
 function _splitPoint(bytes) {
   for (var i = 0; i < bytes.length; i++) {
-    if (bytes[i] === 0x0a) {                                   // LF
-      if (i + 1 < bytes.length && bytes[i + 1] === 0x0a) return { headerEnd: i, bodyStart: i + 2 };           // LF LF
-      if (i + 2 < bytes.length && bytes[i + 1] === 0x0d && bytes[i + 2] === 0x0a) return { headerEnd: i, bodyStart: i + 3 };  // LF CRLF
+    if (bytes[i] === 0x0a) {
+      if (i + 1 < bytes.length && bytes[i + 1] === 0x0a) return { headerEnd: i, bodyStart: i + 2 };
+      if (i + 2 < bytes.length && bytes[i + 1] === 0x0d && bytes[i + 2] === 0x0a) return { headerEnd: i, bodyStart: i + 3 };
     }
   }
   return null;
 }
 
-// Line-ending + whitespace helpers, decided character by character (no regex): _toLf collapses any
-// CRLF / bare CR / bare LF to a single LF; _toCrlf then expands every LF to CRLF; _stripLeadingHtab
-// drops a leading run of SP/HTAB. They match the /\r\n/g, /\r/g, /\n/g and /^[ \t]+/ replacements.
 function _toLf(s) {
   var out = "";
   for (var i = 0; i < s.length; i++) {
     var c = s.charAt(i);
-    if (c === "\r") { if (s.charAt(i + 1) === "\n") continue; out += "\n"; }   // CRLF -> its LF next; bare CR -> LF
+    if (c === "\r") { if (s.charAt(i + 1) === "\n") continue; out += "\n"; }
     else out += c;
   }
   return out;
@@ -59,8 +53,6 @@ function _stripLeadingHtab(s) {
   return s.slice(i);
 }
 
-// Split a header block into unfolded logical lines (RFC 5322 folding: a continuation line begins with
-// SP/HTAB and joins the previous). Returns the raw header strings (each "Name: value").
 function _unfoldHeaders(headerText) {
   var lines = _toLf(headerText).split("\n");
   var out = [];
@@ -73,15 +65,11 @@ function _unfoldHeaders(headerText) {
   return out;
 }
 
-// Parse a Content-Type / any structured header value into { value, type, params }: the media type
-// (lowercased) plus its parameters (names lowercased, quotes stripped). Tolerant of extra whitespace.
 function _parseStructured(headerValue) {
-  var parts = _splitSemicolons(headerValue);   // always >= 1 element
+  var parts = _splitSemicolons(headerValue);
   var type = _stripComments(parts[0]).trim().toLowerCase();
   var params = {};
   for (var i = 1; i < parts.length; i++) {
-    // RFC 5322 CFWS: a comment around the name/value is folding whitespace, not part of either, so strip it
-    // so "(note) hp" resolves to the "hp" parameter and a trailing comment does not leak into the value.
     var p = _stripComments(parts[i]);
     var eq = p.indexOf("=");
     if (eq < 0) continue;
@@ -93,15 +81,12 @@ function _parseStructured(headerValue) {
   return { value: headerValue.trim(), type: type, params: params };
 }
 
-// Remove RFC 5322 comments: a "(...)" span (nesting; a backslash quoted-pair escapes the next byte) outside
-// a double-quoted string. A "(" inside a quoted string is literal qtext, not a comment. Used to drop CFWS
-// from a structured-header token before the name/value is read, so a comment cannot forge or hide a parameter.
 function _stripComments(s) {
   var out = "", inQ = false, depth = 0;
   for (var i = 0; i < s.length; i++) {
     var ch = s[i];
-    if (inQ && ch === "\\" && i + 1 < s.length) { out += ch + s[i + 1]; i++; }   // quoted-pair inside a quoted string -> keep both
-    else if (depth > 0 && ch === "\\" && i + 1 < s.length) { i++; }               // quoted-pair inside a comment -> drop both
+    if (inQ && ch === "\\" && i + 1 < s.length) { out += ch + s[i + 1]; i++; }
+    else if (depth > 0 && ch === "\\" && i + 1 < s.length) { i++; }
     else if (ch === '"' && depth === 0) { inQ = !inQ; out += ch; }
     else if (ch === "(" && !inQ) { depth++; }
     else if (ch === ")" && !inQ && depth > 0) { depth--; }
@@ -110,17 +95,12 @@ function _stripComments(s) {
   return out;
 }
 
-// Split on ";" while respecting double-quoted spans (a boundary/protocol value may be quoted).
 function _splitSemicolons(s) {
   var out = [], cur = "", inQ = false, depth = 0;
   for (var i = 0; i < s.length; i++) {
     var ch = s[i];
-    // RFC 5322 quoted-pair: inside a quoted-string OR a comment a backslash escapes the next char (so an
-    // escaped `"` / `)` does not end the span, and a `;` in an escaped value does not split), so keep both bytes.
     if ((inQ || depth > 0) && ch === "\\" && i + 1 < s.length) { cur += ch + s[i + 1]; i++; }
     else if (ch === '"' && depth === 0) { inQ = !inQ; cur += ch; }
-    // RFC 5322 comment: parentheses (outside a quoted-string) delimit a nesting comment, so a `;` or `=` inside
-    // one is CFWS, not structural, so a Content-Type comment like `charset=x (note; hp=y)` cannot forge a parameter.
     else if (ch === "(" && !inQ) { depth++; cur += ch; }
     else if (ch === ")" && !inQ && depth > 0) { depth--; cur += ch; }
     else if (ch === ";" && !inQ && depth === 0) { out.push(cur); cur = ""; }
@@ -130,13 +110,8 @@ function _splitSemicolons(s) {
   return out;
 }
 
-// Parse a MIME entity (headers + body). `contentType` / `cte` are decoded; `header(name)` looks up a
-// header case-insensitively; `body` is the raw body Buffer. `headerBytes` / `bodyBytes` are the exact
-// slices (a signature over a first part must reference exact bytes, never a re-serialization).
 function parse(input, E, code) {
   var bytes = _buf(input, E, code, "the MIME entity");
-  // Coverage residual: the DoS ceiling only fires on a >16 MiB message (a real cap, exercised by no
-  // unit vector -- driving it would allocate 16 MiB).
   if (bytes.length > C.LIMITS.MIME_MAX_BYTES) throw new E(code, "MIME entity exceeds the size cap");
   var sp = _splitPoint(bytes);
   var headerBytes = sp ? bytes.subarray(0, sp.headerEnd) : bytes;
@@ -149,10 +124,6 @@ function parse(input, E, code) {
     if (colon < 0) throw new E(code, "a MIME header line has no colon: " + JSON.stringify(rawHeaders[i].slice(0, 40)));
     var nm = rawHeaders[i].slice(0, colon).trim();
     var body = rawHeaders[i].slice(colon + 1);
-    // value: the trimmed field body (structured-header parsing wants it trimmed). rawValue: the field body
-    // with only the single conventional ": " delimiter space removed. Leading/trailing whitespace inside
-    // the body is preserved, so a consumer that must reproduce the exact authenticated field body (S/MIME
-    // header protection) is not handed a lossily-trimmed value.
     headers.push({ name: nm, lname: nm.toLowerCase(), value: body.trim(), rawValue: body.charAt(0) === " " ? body.slice(1) : body });
   }
   function header(name) { var l = name.toLowerCase(); for (var j = 0; j < headers.length; j++) if (headers[j].lname === l) return headers[j].value; return null; }
@@ -166,118 +137,75 @@ function parse(input, E, code) {
   };
 }
 
-// Normalize a text body's line endings to the RFC 8551 sec. 3.1.1 canonical CRLF pair (any bare CR or
-// LF becomes CRLF; an existing CRLF is preserved).
 function canonicalizeText(bodyBytes) {
   var s = _toCrlf(bodyBytes.toString("latin1"));
   return Buffer.from(s, "latin1");
 }
 
-// The canonical MIME form of a part for signing (RFC 8551 sec. 3.1.1): line endings normalized to the
-// CRLF pair over the exact bytes, never a header re-serialization, which would diverge from the
-// signer's digest (and would break a header-less clear-signed part, as OpenSSL's `smime -sign` emits).
-// The signer and verifier both call this function, so their digests cannot diverge; a transport that mangles
-// CR/LF is repaired identically on both sides. (A binary clear-signed part must carry a base64
-// Content-Transfer-Encoding first -- line-ending canonicalization is defined for text, sec. 3.1.1.)
 function canonicalize(input, E, code) {
   return canonicalizeText(_buf(input, E, code, "the MIME part"));
 }
 
-// Split a multipart body on its boundary into the exact bytes of each part (RFC 2046 sec. 5.1.1). A
-// part runs from after the "--boundary CRLF" delimiter to just before the "CRLF--boundary" that ends
-// it; the CRLF preceding a boundary is part of the delimiter, not the part (the S/MIME signing rule).
 function splitMultipart(bodyBytes, boundary, E, code) {
   if (!boundary) throw new E(code, "a multipart entity is missing its boundary parameter");
   var delim = Buffer.from("--" + boundary);
   var body = bodyBytes;
   var idx = _findDelim(body, delim, 0);
   if (idx < 0) throw new E(code, "no boundary delimiter found in the multipart body");
-  // Advance past the opening delimiter line.
   var pos = _afterLine(body, idx + delim.length, E, code);
   var parts = [];
   while (true) {
     var next = _findDelim(body, delim, pos);
     if (next < 0) throw new E(code, "an unterminated multipart body part (no closing boundary)");
-    // The part ends at the CRLF (or LF) that immediately precedes this boundary delimiter.
     var partEnd = next;
     if (partEnd >= 2 && body[partEnd - 2] === 0x0d && body[partEnd - 1] === 0x0a) partEnd -= 2;
     else if (partEnd >= 1 && body[partEnd - 1] === 0x0a) partEnd -= 1;
     parts.push(body.subarray(pos, partEnd));
-    // A closing delimiter is "--boundary--"; otherwise advance past this delimiter line to the next part.
     var afterDelim = next + delim.length;
-    if (body[afterDelim] === 0x2d && body[afterDelim + 1] === 0x2d) break;   // "--"
+    if (body[afterDelim] === 0x2d && body[afterDelim + 1] === 0x2d) break;
     pos = _afterLine(body, afterDelim, E, code);
   }
   return parts;
 }
 
-// The next LINE-ANCHORED "--boundary" delimiter at or after `from` (RFC 2046 sec. 5.1.1): it MUST begin
-// a line (at the body start, or immediately after an LF) AND its line MUST be a complete delimiter --
-// the token, then an optional "--" (close), then only transport-padding whitespace, then CRLF / LF /
-// end-of-buffer. So a "--boundary" substring mid-content, a "--boundaryextra" (a different token), a
-// "--boundary garbage" line, or one not at a line start is not matched, so an attacker cannot inject a
-// fake delimiter inside a part's content.
 function _findDelim(body, delim, from) {
   for (var at = body.indexOf(delim, from); at >= 0; at = body.indexOf(delim, at + delim.length)) {
     if ((at === 0 || body[at - 1] === 0x0a) && _delimLineOk(body, at + delim.length)) return at;
   }
   return -1;
 }
-// The suffix after the "--boundary" token is a valid delimiter line: an optional closing "--", then
-// zero or more LWSP (space / HTAB transport padding), then CRLF / LF / end-of-buffer. Anything else
-// (non-whitespace before the line end) means this is content, not a delimiter.
 function _delimLineOk(body, i) {
   if (body[i] === 0x2d && body[i + 1] === 0x2d) i += 2;
   while (body[i] === 0x20 || body[i] === 0x09) i++;
   return i >= body.length || body[i] === 0x0d || body[i] === 0x0a;
 }
 
-// The offset just past the end of the current line (skipping to after the next LF).
 function _afterLine(buf, from, E, code) {
   for (var i = from; i < buf.length; i++) if (buf[i] === 0x0a) return i + 1;
   throw new E(code, "a multipart boundary line is not terminated");
 }
 
-// Serialize an ordered list of header fields + a body into a canonical MIME entity: each field as
-// "Name: value\r\n" (routed through the header-injection guard so a CR/LF/NUL in a value can never inject a
-// header or split the message), then the blank-line separator, then the body, all CRLF-canonicalized so
-// the bytes match a CMS signer's/verifier's digest. `fields` is [{ name, value }]; `body` is a byte source
-// (or null/empty). This is the single header/entity emitter: an inline "Content-Type: ...\r\n" string
-// concatenation is the shape this replaces, so a composer cannot re-inline an unguarded header.
 function buildEntity(fields, body, E, code) {
   var head = "";
   for (var i = 0; i < fields.length; i++) {
     var f = fields[i];
-    // Serialize the value the guard validated and returned, never a second coercion of f.value (a stateful
-    // toString() could return CRLF on the second call and inject a header past the check).
     var v = guard.header.assertField(f.name, f.value, E, code);
     head += f.name + ": " + v + "\r\n";
   }
   var bodyBuf = (body == null) ? Buffer.alloc(0) : _buf(body, E, code, "the MIME body");
-  // Buffer the head as UTF-8 (an RFC 6532 internationalized header value survives); canonicalizeText is
-  // byte-preserving except CR/LF normalization (latin1 round-trip), so those UTF-8 bytes pass through.
   return canonicalizeText(Buffer.concat([Buffer.from(head + "\r\n", "utf8"), bodyBuf]));
 }
 
-// Count how many times a parameter named `name` (case-insensitive) appears in a structured header value,
-// QUOTE-AWARE (a `name=` inside a double-quoted value is not a parameter). _parseStructured collapses a
-// duplicate parameter to its last value, so a consumer that must fail closed on a duplicate counts it here.
 function paramCount(headerValue, name) {
   var ln = name.toLowerCase(), n = 0;
   _splitSemicolons(headerValue).forEach(function (part) {
-    var p = _stripComments(part);   // CFWS around the name (e.g. "(note) hp") is not part of the parameter name
+    var p = _stripComments(part);
     var eq = p.indexOf("=");
     if (eq >= 0 && p.slice(0, eq).trim().toLowerCase() === ln) n++;
   });
   return n;
 }
 
-// Count parameters with this attribute name, with or without a value. paramCount only counts "name=value"
-// parts, so a bare/valueless attribute (e.g. "Content-Type: text/plain; hp") is invisible to it;
-// paramNameCount still sees the attribute name, so a consumer can fail closed on a malformed bare parameter,
-// or on a bare+valued duplicate ("hp; hp=x") that paramCount undercounts, instead of silently ignoring it.
-// Comment- + quoted-string-aware, like paramCount; part 0 is the media type (not a parameter), so attributes
-// start at index 1.
 function paramNameCount(headerValue, name) {
   var ln = name.toLowerCase(), n = 0;
   var parts = _splitSemicolons(headerValue);
@@ -289,7 +217,6 @@ function paramNameCount(headerValue, name) {
   return n;
 }
 
-// Does the structured header value name this parameter attribute at all (with or without a value)?
 function hasParam(headerValue, name) { return paramNameCount(headerValue, name) > 0; }
 
 module.exports = {

package/lib/ocsp-request-verify.js

@@ -1,26 +1,13 @@
 // SPDX-License-Identifier: Apache-2.0
 // Copyright (c) blamejs contributors
 "use strict";
-//
-// @internal -- the single signature seam for an inbound signed OCSPRequest (RFC 6960 sec. 4.1.1),
-// composed by pki.ocsp.verifyRequest. It routes the request-signature check through the same
-// certification-path signature engine (its EdDSA low-order-point and algorithm-confusion gates
-// included) that pki.ocsp.verify uses for a response and pki.crl.verify / pki.cms.verify use for
-// theirs, so no second, weaker verifier of an untrusted request can drift. The producing side runs
-// its own check over what it just signed (pki.ocsp.buildRequest's signer path); this is the
-// different question a responder asks about a request someone else produced. The slot, the wiring
-// assertion and the octet-alignment refusal are the shared seam (lib/verify-seam.js). It is not
-// wired into index.js and is reached only by require.
+// @internal
 
 var frameworkError = require("./framework-error");
 var seam = require("./verify-seam");
 
 var _seam = seam.makeSeam("ocsp-request-verify", frameworkError.OcspError, "ocsp/bad-input");
 
-// Verify a signed OCSPRequest's signature over its exact tbsRequest bytes under the SPKI of the
-// requestor certificate the request carries (RFC 6960 sec. 4.1.1). Unlike a CSR there is no
-// self-signature: the verifying key is the requestor's, identified to the responder by
-// requestorName and proven by the certificate embedded in (or supplied alongside) the request.
 function verifyRequestSignature(signatureAlgorithm, signature, signerSpkiBytes, tbsRequestBytes) {
   return _seam.verify(signatureAlgorithm, signature, signerSpkiBytes, tbsRequestBytes);
 }

package/lib/ocsp-verify.js

@@ -1,31 +1,7 @@
 // SPDX-License-Identifier: Apache-2.0
 // Copyright (c) blamejs contributors
 "use strict";
-//
-// @internal -- no operator-facing namespace. The documented surfaces are pki.path.ocspChecker
-// (revocation during path validation) and pki.ocsp.verify (standalone RFC 6960 sec. 3.2 client
-// acceptance), which both compose this single verify core. There is deliberately no second, weaker
-// OCSP response-verification path: a standalone verify that re-derived the responder-authorization
-// gates would be the exact fail-open the out-of-path-signer-cert-full-validation discipline exists
-// to prevent.
-//
-// The core is a factory over an INJECTED `deps` seam so it has no back-edge into path-validate:
-// the signature engine (`verifyWithSpki`) and the RFC 5280 cert-profile gates
-// (`decodeExt`/`findExt`/`unrecognizedCriticalExtension`/`validateCriticalExtensionStructure`/
-// `compositeKeyUsageCheck`/`isNullOrAbsentParams`/`spliceSpkiParameters`/`dnEqual`) are supplied by
-// the caller that owns them; everything OCSP-specific (CertID hash binding, responder
-// authorization, currency, status) lives here.
-//
-// Rule set (gap-checked verbatim against RFC 6960 sec. 3.2 / 4.1.1 / 4.2.2.2 / 4.2.2.2.1):
-//   - authorizeResponder: the issuing CA directly (responderID identifies the issuer) OR a
-//     CA-issued delegate valid at `time` bearing id-kp-OCSPSigning (anyEKU / absent EKU do not
-//     authorize), keyUsage-permits-signing, no unknown/malformed critical extension, and
-//     id-pkix-ocsp-nocheck (a transport-free verify cannot otherwise confirm the responder is
-//     unrevoked); the delegate's own issuance signature is verified under the issuer key.
-//   - certIdMatches: serial + issuerNameHash + issuerKeyHash under the CertID's own hashAlgorithm
-//     (a serial-only match is a cross-CA substitution and is rejected).
-//   - currency: thisUpdate <= time and a bounded nextUpdate > time (a nextUpdate-less response is
-//     unusable per the lightweight profile).
+// @internal
 
 var asn1 = require("./asn1-der");
 var guard = require("./guard-all");
@@ -36,22 +12,13 @@ var compositeSig = require("./composite-sig");
 var webcrypto = require("./webcrypto");
 var subtle = webcrypto.webcrypto.subtle;
 
-// CertID identity-hash algorithms (RFC 6960 sec. 4.1.1). SEPARATE from the signature HASH set
-// (which omits SHA-1, SHAttered): a CertID hash is an identity binding of an already-known issuer,
-// not a signature, so RFC 6960's default SHA-1 CertID MUST interoperate. A hash outside this set
-// cannot be reproduced -> no CertID match (fail closed).
 var OCSP_CERTID_HASHES = {};
 OCSP_CERTID_HASHES[oid.byName("sha1")] = "SHA-1";
 OCSP_CERTID_HASHES[oid.byName("sha256")] = "SHA-256";
 OCSP_CERTID_HASHES[oid.byName("sha384")] = "SHA-384";
 OCSP_CERTID_HASHES[oid.byName("sha512")] = "SHA-512";
 var OID_OCSP_SIGNING = oid.byName("ocspSigning");
-// Does this extended-key-usage list assert the given purpose? The answer IS an authorization
-// decision, so it goes through the membership guard rather than a prototype method. See guard-list.
 var _asserts = guard.list.contains;
-// Captured at load. Each of these answers a binding question -- does this response concern the
-// certificate being asked about, did this key sign it -- so a replacement made after this module
-// loaded would decide the answer while every check around it still runs.
 var _bufferFrom = intrinsic.bufferFrom;
 var _bytesEqual = intrinsic.bufferEquals;
 var OID_OCSP_NOCHECK = oid.byName("ocspNoCheck");
@@ -60,17 +27,10 @@ var OID_KEY_USAGE = oid.byName("keyUsage");
 
 function ocspDigest(alg, buf) { return subtle.digest(alg, buf).then(function (h) { return _bufferFrom(h); }); }
 
-// The subjectPublicKey BIT STRING value (past the unused-bits octet) of an SPKI DER: the exact
-// bytes an OCSP CertID issuerKeyHash / byKey KeyHash hash over (RFC 6960 sec. 4.1.1). Throws on a
-// malformed SPKI; the caller fails closed.
 function ocspKeyValue(spkiDer) {
   return asn1.read.bitString(asn1.decode(spkiDer).children[1]).bytes;
 }
 
-// makeOcspVerify(deps) -> the bound OCSP verify core. deps = { verifyWithSpki, decodeExt, findExt,
-// unrecognizedCriticalExtension, validateCriticalExtensionStructure, compositeKeyUsageCheck,
-// isNullOrAbsentParams, spliceSpkiParameters, dnEqual }, the signature engine and RFC 5280
-// cert-profile gates owned by the caller.
 function makeOcspVerify(deps) {
   var verifyWithSpki = deps.verifyWithSpki;
   var decodeExt = deps.decodeExt;
@@ -82,14 +42,10 @@ function makeOcspVerify(deps) {
   var spliceSpkiParameters = deps.spliceSpkiParameters;
   var dnEqual = deps.dnEqual;
 
-  // The delegate responder's importable SPKI, splicing the issuer's algorithm parameters in when
-  // the delegate key inherits them (an EC SPKI that omits the namedCurve, RFC 5280 sec. 4.1.2.7).
   function ocspResponderSpki(rc, issuer) {
     var keyAlg = rc.subjectPublicKeyInfo.algorithm;
     if (!isNullOrAbsentParams(keyAlg.parameters)) return rc.subjectPublicKeyInfo.bytes;
     var issuerOid, issuerParams;
-    // Coverage residual -- the catch is unreachable: this runs only after the delegate's signature
-    // verified under issuer.workingPublicKey, so that SPKI already imported and decodes cleanly.
     try {
       var alg = asn1.decode(issuer.workingPublicKey).children[0];
       issuerOid = asn1.read.oid(alg.children[0]);
@@ -101,17 +57,12 @@ function makeOcspVerify(deps) {
     return rc.subjectPublicKeyInfo.bytes;
   }
 
-  // Returns true if `extList` carries any critical extension (this code processes no OCSP
-  // response/single extension semantics, so a critical one makes the response unusable).
   function ocspHasCriticalExtension(extList) {
     if (!extList) return false;
     for (var i = 0; i < extList.length; i++) if (extList[i].critical) return true;
     return false;
   }
 
-  // A SingleResponse's CertID names the target cert if and only if serial, issuerNameHash and issuerKeyHash
-  // (under the CertID's own hashAlgorithm) match the issuer. `issuerNameCandidates` is every RFC
-  // 5280 sec. 7.1-equal byte encoding of the validated issuer DN to try.
   async function ocspCertIdMatches(certID, cert, issuerNameCandidates, issuerKeyBits) {
     if (certID.serialNumberHex !== cert.serialNumberHex) return false;
     var hashName = intrinsic.hasOwn(OCSP_CERTID_HASHES, certID.hashAlgorithm.oid) ? OCSP_CERTID_HASHES[certID.hashAlgorithm.oid] : null;
@@ -124,9 +75,6 @@ function makeOcspVerify(deps) {
     return false;
   }
 
-  // Resolve the signer of a BasicOCSPResponse to an AUTHORIZED responder SPKI DER, or null. Two
-  // models: the issuing CA directly, or a CA-delegated responder (RFC 6960 sec. 4.2.2.2). Fails
-  // closed at every branch.
   async function ocspAuthorizeResponder(basicResponse, cert, issuer, issuerKeyBits, time) {
     var rid = basicResponse.responderID;
     var matchesIssuer = false;
@@ -146,63 +94,36 @@ function makeOcspVerify(deps) {
         else if (rid.byKey) identifies = _bytesEqual(rid.byKey, await ocspDigest("SHA-1", ocspKeyValue(rc.subjectPublicKeyInfo.bytes)));
       } catch (_e) { identifies = false; }
       if (!identifies) continue;
-      // The delegate MUST be issued directly by the CA that issued the target.
       var issuedByCa;
       try { issuedByCa = dnEqual(rc.issuer.rdns, cert.issuer.rdns); }
       catch (_e) { continue; }
       if (!issuedByCa) continue;
       if (!isOctetAligned(rc.signatureValue)) continue;
       if (!(await verifyWithSpki(rc.signatureAlgorithm, rc.signatureValue.bytes, issuer.workingPublicKey, rc.tbsBytes))) continue;
-      // The delegate cert MUST itself be valid at the validation instant.
-      // Instants, never the Date objects: comparing two Dates coerces each through `valueOf`,
-      // which a caller's subclass answers, so the delegate would be checked at whatever moment
-      // the caller's `time` chose to report rather than the one it holds.
       if (guard.time.instantOf(time) < guard.time.instantOf(rc.validity.notBefore) ||
         guard.time.instantOf(time) > guard.time.instantOf(rc.validity.notAfter)) continue;
-      // The delegate MUST assert id-kp-OCSPSigning; anyEKU / an absent EKU do not.
       var eku;
       try { eku = decodeExt(rc, OID_EKU); }
       catch (_e) { continue; }
-      // The membership test IS the delegation rule, so it is decided by comparison rather than by a
-      // prototype method: dispatched live, an `Array.prototype.indexOf` replaced after load reports
-      // the purpose present on ANY certificate, and a cert an attacker put in the response's own
-      // certs bag is accepted as the authorized responder.
       if (!eku || !_asserts(eku.value, OID_OCSP_SIGNING)) continue;
-      // A delegate asserting keyUsage MUST permit digitalSignature; an absent keyUsage is
-      // unrestricted, an unreadable one is not authoritative.
       var ku;
       try { ku = decodeExt(rc, OID_KEY_USAGE); }
       catch (_e) { continue; }
       if (ku && ku.value.digitalSignature !== true) continue;
-      // An unknown critical extension (or a recognized-but-malformed one) makes the delegate
-      // unusable, the same fail-closed rule the path validator applies.
       if (unrecognizedCriticalExtension(rc, false)) continue;
       if (validateCriticalExtensionStructure(rc)) continue;
-      // The delegate MUST carry id-pkix-ocsp-nocheck (RFC 6960 sec. 4.2.2.2.1): a transport-free
-      // checker cannot otherwise confirm the responder cert is unrevoked.
       if (!findExt(rc, OID_OCSP_NOCHECK)) continue;
-      // A composite-keyed delegate gets the same composite keyUsage gate the path certs do.
       if (compositeSig.COMPOSITE_ALGS[rc.subjectPublicKeyInfo.algorithm.oid] && !compositeKeyUsageCheck(rc).ok) continue;
       return ocspResponderSpki(rc, issuer);
     }
     return null;
   }
 
-  // A BIT STRING is octet-aligned iff its unused-bits count is 0, reused from the caller's
-  // guard so a non-octet-aligned responder signature is never verified.
   function isOctetAligned(bitString) { return !!bitString && bitString.unusedBits === 0; }
 
-  // evaluateResponse(resp, cert, issuer, issuerKeyBits, issuerNameCandidates, time, historical) ->
-  // a granular per-response summary for one parsed OCSPResponse, aggregating over all of its
-  // matching SingleResponses (a revoked SingleResponse shadows a good one within the response, the
-  // same fail-closed law the multi-response aggregator applies). Never throws (fail-closed):
-  //   { applicable, responderAuthorized, signatureValid, matched, revoked:{reason,revocationReason}?,
-  //     sawGood, sawUnknownStatus, thisUpdate?, nextUpdate?, reason }
   async function evaluateResponse(resp, cert, issuer, issuerKeyBits, issuerNameCandidates, time, historical) {
     if (resp.responseStatus.code !== 0) return { applicable: false, matched: false, reason: "non-successful OCSP responseStatus (" + resp.responseStatus.code + ")" };
     var br = resp.basicResponse;
-    // Coverage residual -- unreachable for a parsed response (schema-ocsp enforces the
-    // successful<->responseBytes biconditional); backstop for a hand-built object.
     if (!br) return { applicable: false, matched: false, reason: "successful OCSP response carries no BasicOCSPResponse" };
     var signerSpki = await ocspAuthorizeResponder(br, cert, issuer, issuerKeyBits, time);
     if (!signerSpki) return { applicable: true, matched: false, responderAuthorized: false, reason: "no authorized OCSP responder signs this response (RFC 6960 sec. 4.2.2.2)" };
@@ -222,8 +143,6 @@ function makeOcspVerify(deps) {
       out.matched = true; out.thisUpdate = sr.thisUpdate; out.nextUpdate = sr.nextUpdate;
       var st = sr.certStatus;
       if (st.type === "revoked") {
-        // Present-time validation revokes regardless of a future revocationTime (skew/post-dating);
-        // only explicit historical validation defers a strictly-future revocation (reports good).
         // allow:nan-date-comparison-unguarded -- revocationTime is codec-parsed (NaN-rejected); a NaN check time makes this FAIL CLOSED (sawGood stays unset -> not treated good), and `time` is validated at the pki.ocsp.verify / path.verifyOcspResponse entry points.
         if (historical && guard.time.isDate(st.revocationTime) &&
           guard.time.instantOf(st.revocationTime) > guard.time.instantOf(time)) { out.sawGood = true; }