@blamejs/pki 0.6.55 → 0.7.0

package/lib/sigstore.js

@@ -8,19 +8,22 @@
  * @fullname   Sigstore bundles: keyless signing and provenance
  * @intro Zero-dependency verifier for a Sigstore bundle, the exact artifact
  *   `npm publish --provenance` produces and the npm registry serves at its
- *   attestations API. A bundle is a keyless (Fulcio) signature over a DSSE-wrapped
- *   in-toto SLSA provenance attestation, with a Rekor transparency-log inclusion
- *   proof. `verifyBundle` composes five fail-closed legs against caller-supplied
+ *   attestations API. A bundle is a keyless (Fulcio) signature with a Rekor
+ *   transparency-log inclusion proof, over one of two content arms: a DSSE-wrapped
+ *   in-toto attestation, which `cosign attest` and npm provenance produce, or a
+ *   message signature over an artifact's own bytes, which `cosign sign-blob`
+ *   produces. `verifyBundle` composes five fail-closed legs against caller-supplied
  *   trust material (the Fulcio CA roots + Rekor log keys, never trusted from the
- *   bundle): the DSSE signature over its PAE preimage under the Fulcio leaf key;
- *   the Fulcio certificate chain, validated as of the Rekor log time (the cert is
- *   ephemeral, ~10 minutes); the Rekor inclusion proof folded to a Rekor-signed
- *   tree root; the log entry binding to this exact signature; and the in-toto
- *   subject digest the caller confirms against the published artifact. Verify-only
- *   and offline: every input is in the bundle or a caller argument. Reuses the
- *   shipped X.509 parser, RFC 5280 path validator, RFC 9162 Merkle verifier, and
- *   native crypto engine; the net-new codecs are the DSSE PAE byte-builder and a
- *   fail-closed JSON bundle reader.
+ *   bundle): the signature under the Fulcio leaf key, over the DSSE PAE preimage or
+ *   over the artifact `opts.artifact` supplies; the Fulcio certificate chain,
+ *   validated as of the Rekor log time (the cert is ephemeral, ~10 minutes); the
+ *   Rekor inclusion proof folded to a Rekor-signed tree root; the log entry binding
+ *   to this exact signature and certificate; and the artifact binding, which is the
+ *   in-toto subject digest the caller confirms for a DSSE bundle and the entry's own
+ *   authenticated hash for a message signature. Verify-only and offline: every input
+ *   is in the bundle or a caller argument. Reuses the shipped X.509 parser, RFC 5280
+ *   path validator, RFC 9162 Merkle verifier, and native crypto engine; the net-new
+ *   codecs are the DSSE PAE byte-builder and a fail-closed JSON bundle reader.
  * @spec DSSE, Sigstore bundle v0.3, RFC 9162, SLSA provenance v1
  * @card Verify an npm --provenance Sigstore bundle offline (DSSE + Fulcio + Rekor + SLSA).
  */
@@ -48,10 +51,93 @@ function _err(code, message, cause) { return new SigstoreError(code, message, ca
  * properties only, so a polluted prototype cannot conjure an arm the bundle does not carry. */
 function _armPresent(obj, name) {
   return !!obj && typeof obj === "object" &&
-    Object.prototype.hasOwnProperty.call(obj, name) && obj[name] !== undefined && obj[name] !== null;
+    _hasOwn(obj, name) && obj[name] !== undefined && obj[name] !== null;
 }
 
+/** @internal The HashAlgorithm enum members a message signature may name its digest under, keyed by
+ * the name protojson writes. All five members that name an algorithm are here, the two SHA-3
+ * members included: they
+ * are marked deprecated, which says a producer should not choose one, not that a bundle carrying one
+ * is malformed, and this digest names its own algorithm independently of the one the log entry
+ * records. A member this table does not carry is refused rather than mapped by guessing at its name,
+ * so a member added to the enum later cannot be read as one of these.
+ * HASH_ALGORITHM_UNSPECIFIED is absent for the reason it exists: it names no algorithm. */
+var _HASH_BY_ENUM = Object.freeze(Object.assign(Object.create(null), {
+  SHA2_256: { node: "sha256", bytes: 32 },
+  SHA2_384: { node: "sha384", bytes: 48 },
+  SHA2_512: { node: "sha512", bytes: 64 },
+  SHA3_256: { node: "sha3-256", bytes: 32 },
+  SHA3_384: { node: "sha3-384", bytes: 48 },
+}));
+
+/** @internal The same members under the numbers the enum assigns them. The JSON mapping states that
+ * a parser "accept[s] both enum names and integer values", so a bundle naming its digest algorithm as
+ * 1 is one a conforming producer may write and this reads it as the name it stands for. Zero is
+ * absent for the reason the name it belongs to is: HASH_ALGORITHM_UNSPECIFIED names no algorithm. */
+var _HASH_BY_NUMBER = Object.freeze(Object.assign(Object.create(null), {
+  1: _HASH_BY_ENUM.SHA2_256,
+  2: _HASH_BY_ENUM.SHA2_384,
+  3: _HASH_BY_ENUM.SHA2_512,
+  4: _HASH_BY_ENUM.SHA3_256,
+  5: _HASH_BY_ENUM.SHA3_384,
+}));
+
+/** @internal The algorithm a HashAlgorithm field names, in either encoding, or null when it names
+ * none this build verifies under. A number that is not one of the members is refused rather than
+ * rounded or coerced into one. */
+function _hashOf(algorithm) {
+  if (typeof algorithm === "string") return _HASH_BY_ENUM[algorithm] || null;
+  if (typeof algorithm === "number" && _isSafeInt(algorithm)) {
+    return _HASH_BY_NUMBER[algorithm] || null;
+  }
+  return null;
+}
+
+/** @internal The same three algorithms keyed the way a hashedrekord names them. The entry is the
+ * authenticated statement of what was signed, so its algorithm is the one the artifact is digested
+ * under; the schema enumerates exactly these three. */
+var _HASH_BY_REKOR = Object.freeze(Object.assign(Object.create(null), {
+  sha256: { node: "sha256", bytes: 32 },
+  sha384: { node: "sha384", bytes: 48 },
+  sha512: { node: "sha512", bytes: 64 },
+}));
+
 var JSON_MAX = C.LIMITS.JSON_MAX_BYTES;
+
+/** @internal How deeply a bundle may nest, stated once and read by both routes into it. A bundle
+ * given as text and the same bundle given as an object are the same document, so a limit either one
+ * applied alone would admit it one way and refuse it the other. */
+var BUNDLE_MAX_DEPTH = 64;
+
+/** @internal The operations the bundle copy decides with, taken at load. That copy is what every
+ * later check runs on, so which function answers "what does this object own" and "what does it hold"
+ * settles what is verified; one replaced after this module loads would otherwise be asked at the
+ * moment of the call. An emptied key list alone turns a bundle into one carrying no content arm. */
+var _ownNames = Object.getOwnPropertyNames;
+var _ownDescriptor = Object.getOwnPropertyDescriptor;
+var _isArray = Array.isArray;
+var _create = Object.create;
+var _stringOf = String;
+/** @internal Whether an object OWNS a name. The oneof rules are written on this question, so a
+ * replacement answering no for one arm hides it and a bundle setting two is read as setting one. */
+var _hasOwn = Function.prototype.call.bind(Object.prototype.hasOwnProperty);
+var _isFiniteNumber = Number.isFinite;
+var _isSafeInt = Number.isSafeInteger;
+var _isBuffer = Buffer.isBuffer;
+var _bufferFrom = Buffer.from;
+/** @internal The canonical form a Rekor signed entry timestamp is verified over. A replacement
+ * writing different bytes decides what that signature is checked against. */
+var _jsonStringify = JSON.stringify;
+/** @internal Every field the copy holds is DEFINED as its own, never assigned. An assignment consults
+ * the target's prototype for a setter, and something that installs one sees each field the copy
+ * writes and can hand back a different one, so a malformed value arrives valid and the checks read
+ * what the caller never sent. Defining reaches no prototype. */
+var _defineProp = Object.defineProperty;
+var _isFiniteNum = isFinite;
+/** @internal Uncurried, so the copy reads a character's code through the operation taken at load
+ * rather than through whatever the string it is walking offers under that name. What a character
+ * costs decides whether a bundle passes the size limit. */
+var _charCodeAt = Function.prototype.call.bind(String.prototype.charCodeAt);
 var SP = Buffer.from(" ", "ascii");
 var DSSEV1 = Buffer.from("DSSEv1", "ascii");
 var _EM_DASH = String.fromCharCode(0x2014);
@@ -89,12 +175,12 @@ var _BUNDLE_MEDIA_TYPES = Object.assign(Object.create(null), {
   "application/vnd.dev.sigstore.bundle+json;version=0.3": 1
 });
 function _isBundleMediaType(mt) {
-  return typeof mt === "string" && Object.prototype.hasOwnProperty.call(_BUNDLE_MEDIA_TYPES, mt);
+  return typeof mt === "string" && _hasOwn(_BUNDLE_MEDIA_TYPES, mt);
 }
 
 function _jsonParse(input, code, label) {
   return guard.json.parse(input, _err, {
-    maxBytes: JSON_MAX, maxDepth: 64,
+    maxBytes: JSON_MAX, maxDepth: BUNDLE_MAX_DEPTH,
     badJson: code, tooDeep: code, duplicateMember: code, tooLarge: code, badInput: code, label: label,
   });
 }
@@ -121,7 +207,7 @@ function _jsonParse(input, code, label) {
 function pae(payloadType, payloadBytes) {
   if (typeof payloadType !== "string") throw new TypeError("pae: payloadType must be a string");
   var type = Buffer.from(payloadType, "utf8");
-  var body = Buffer.isBuffer(payloadBytes) ? payloadBytes : Buffer.from(payloadBytes || []);
+  var body = _isBuffer(payloadBytes) ? payloadBytes : _bufferFrom(payloadBytes || []);
   return Buffer.concat([
     DSSEV1, SP,
     Buffer.from(String(type.length), "ascii"), SP, type, SP,
@@ -154,7 +240,14 @@ function _b64(s, label) {
  * Buffer) fail-closed: a non-object, malformed JSON, an oversize input, an
  * unknown `mediaType`, or a missing required member throws a typed
  * `sigstore/bad-bundle` / `sigstore/bad-bundle-version`. Returns the validated
- * bundle object (structure only, no cryptographic verification).
+ * bundle (structure only, no cryptographic verification).
+ *
+ * An object is copied into plain data and read back before any rule runs on it,
+ * and the copy is what comes back, so a caller reads what was checked. A field
+ * reached through an accessor is refused rather than called, and so is a value
+ * JSON does not carry: a bundle is data, and a field that computes its value can
+ * remove another the walk has already counted. `pki.sigstore.verifyBundle` takes
+ * the same copy, so the two verbs cannot answer differently about one bundle.
  *
  * @example
  *   // requires: `bundle` -- a Sigstore bundle as cosign or npm provenance emits it
@@ -164,14 +257,18 @@ function _b64(s, label) {
  */
 function parseBundle(input) {
   var obj;
-  if (Buffer.isBuffer(input) || typeof input === "string") {
+  if (_isBuffer(input) || typeof input === "string") {
     obj = _jsonParse(input, "sigstore/bad-bundle", "bundle");
   } else if (input && typeof input === "object") {
-    obj = input;
+    /** @internal An object is copied and read back before a single rule runs on it, so this verb
+     * decides what the verifying one decides. Checking the caller's object in place would run its
+     * accessors, and one of those can remove a field a check has already counted: a bundle owning
+     * two content arms passes the oneof rule when reading the first deletes the second. */
+    obj = _snapshotBundle(input);
   } else {
     throw _err("sigstore/bad-bundle", "bundle must be a JSON object, string, or Buffer");
   }
-  if (!obj || typeof obj !== "object" || Array.isArray(obj)) throw _err("sigstore/bad-bundle", "bundle must be a JSON object");
+  if (!obj || typeof obj !== "object" || _isArray(obj)) throw _err("sigstore/bad-bundle", "bundle must be a JSON object");
   var mt = obj.mediaType;
   if (!_isBundleMediaType(mt)) {
     throw _err("sigstore/bad-bundle-version", "unsupported or unknown bundle media type: " + (mt === undefined ? "(none)" : guard.text.showValue(mt)));
@@ -179,37 +276,292 @@ function parseBundle(input) {
   if (!obj.verificationMaterial || typeof obj.verificationMaterial !== "object") {
     throw _err("sigstore/bad-bundle", "bundle is missing verificationMaterial");
   }
-  /** @internal The verification material's certificate is a oneof of the same kind. Both arms set
-   * draws the leaf from one and the chain from the other, so the certificate whose key is checked and
-   * the certificates it is checked through come from different statements about the same signer. */
-  var vmArms = 0;
-  if (_armPresent(obj.verificationMaterial, "certificate")) vmArms++;
-  if (_armPresent(obj.verificationMaterial, "x509CertificateChain")) vmArms++;
-  if (_armPresent(obj.verificationMaterial, "publicKey")) vmArms++;
-  if (vmArms > 1) {
-    throw _err("sigstore/bad-bundle", "verificationMaterial carries more than one of certificate, x509CertificateChain and publicKey; it is a oneof and exactly one arm may be present");
-  }
-  /** @internal The bundle's content is a protobuf oneof, so a bundle setting both arms is malformed
-   * and is refused rather than read as whichever arm this build happens to support: verifying the
-   * envelope and passing over the other arm reports a verdict that says nothing about content the
-   * bundle carries. The two refusals are separate because a caller can act on one and not the other. */
-  if (_armPresent(obj, "messageSignature") && _armPresent(obj, "dsseEnvelope")) {
-    throw _err("sigstore/bad-bundle", "bundle carries both dsse_envelope and message_signature; the bundle content is a oneof and exactly one arm may be present");
-  }
+  _assertMaterialOneOf(obj.verificationMaterial);
+  _assertContentOneOf(obj);
   if (_armPresent(obj, "messageSignature")) {
-    throw _err("sigstore/unsupported-content", "a message_signature bundle is not supported (only dsse_envelope)");
+    _parseMessageSignature(obj.messageSignature);
+    return obj;
   }
   if (!obj.dsseEnvelope || typeof obj.dsseEnvelope !== "object") {
     throw _err("sigstore/bad-bundle", "bundle is missing a dsseEnvelope");
   }
   var d = obj.dsseEnvelope;
-  if (typeof d.payload !== "string" || typeof d.payloadType !== "string" || !Array.isArray(d.signatures) || !d.signatures.length ||
+  if (typeof d.payload !== "string" || typeof d.payloadType !== "string" || !_isArray(d.signatures) || !d.signatures.length ||
       !d.signatures[0] || typeof d.signatures[0] !== "object" || typeof d.signatures[0].sig !== "string") {
     throw _err("sigstore/bad-dsse", "the DSSE envelope is missing a required field (payload / payloadType / signatures[].sig)");
   }
   return obj;
 }
 
+/** @internal The bundle's content is a protobuf oneof, so a bundle setting both arms is malformed
+ * and is refused rather than read as whichever arm this build happens to support: verifying the
+ * envelope and passing over the other arm reports a verdict that says nothing about content the
+ * bundle carries. */
+function _assertContentOneOf(obj) {
+  if (_armPresent(obj, "messageSignature") && _armPresent(obj, "dsseEnvelope")) {
+    throw _err("sigstore/bad-bundle", "bundle carries both dsse_envelope and message_signature; the bundle content is a oneof and exactly one arm may be present");
+  }
+}
+
+/** @internal The verification material's certificate is a oneof of the same kind. Both arms set draws
+ * the leaf from one and the chain it is validated through from the other, so the certificate whose
+ * key is checked and the certificates it is checked through come from different statements about the
+ * same signer. The two refusals are separate because a caller can act on one and not the other. */
+function _assertMaterialOneOf(vm) {
+  var arms = 0;
+  if (_armPresent(vm, "certificate")) arms++;
+  if (_armPresent(vm, "x509CertificateChain")) arms++;
+  if (_armPresent(vm, "publicKey")) arms++;
+  if (arms > 1) {
+    throw _err("sigstore/bad-bundle", "verificationMaterial carries more than one of certificate, x509CertificateChain and publicKey; it is a oneof and exactly one arm may be present");
+  }
+}
+
+/** @internal The bytes a string costs in the JSON a document would be written as, charged while it is
+ * scanned so a long one is refused part-way rather than measured whole. Counted as JSON writes it: an
+ * escape costs the characters it takes, a character outside ASCII costs its UTF-8 bytes, a surrogate
+ * pair costs the four its code point takes, and an unpaired surrogate costs the six a \u escape
+ * takes. Charging the string's own length instead charges UTF-16 units, which is fewer than the text
+ * form for anything escaped or non-ASCII, and would admit an object the same document as text is
+ * refused for. Scanned by character code, since a pattern here would be matched through a replaceable
+ * protocol. */
+function _chargeString(budget, s) {
+  _charge(budget, 2);
+  for (var i = 0; i < s.length; i++) {
+    var c = _charCodeAt(s, i);
+    var cost;
+    if (c === 0x22 || c === 0x5c) cost = 2;
+    else if (c === 0x08 || c === 0x09 || c === 0x0a || c === 0x0c || c === 0x0d) cost = 2;
+    else if (c < 0x20) cost = 6;
+    else if (c < 0x80) cost = 1;
+    else if (c < 0x800) cost = 2;
+    else if (c >= 0xd800 && c <= 0xdbff) {
+      var next = i + 1 < s.length ? _charCodeAt(s, i + 1) : 0;
+      if (next >= 0xdc00 && next <= 0xdfff) { cost = 4; i++; } else { cost = 6; }
+    } else if (c >= 0xdc00 && c <= 0xdfff) { cost = 6; } else { cost = 3; }
+    _charge(budget, cost);
+  }
+}
+
+/** @internal A bundle field read as a number, without asking the value to convert itself. A log entry
+ * carries its time and index as JSON numbers, and a document may write either as a string, so both
+ * are read; anything else is not a number and reads as one that is not finite, which the caller of
+ * this already refuses. Converting an arbitrary value would ask it for a primitive, and a value that
+ * has no way to give one throws where this module's contract is a typed refusal. */
+function _numOf(v) {
+  var t = typeof v;
+  if (t === "number") return v;
+  if (t === "string" || t === "boolean") return Number(v);
+  return NaN;
+}
+
+/** @internal Charge the copy's running size, refusing the moment it passes what the reader admits.
+ * What is counted is the size the same document costs as text, exactly: the punctuation JSON writes
+ * around a value, the digits a number takes, and the bytes a string takes once escaped. Counting
+ * less would admit an object the text reader refuses; counting more would refuse one it admits. */
+function _charge(budget, cost) {
+  budget.n += cost;
+  if (budget.n > JSON_MAX) {
+    throw _err("sigstore/bad-bundle", "the bundle is larger than the " + JSON_MAX + " byte limit");
+  }
+}
+
+/** @internal Bound the WALK, which is a separate question from the size. A property whose value is
+ * skipped costs the walk a step while costing the document nothing, so a structure made of them is
+ * bounded here rather than by the byte count, which would have to overstate the document to do it. */
+function _step(budget) {
+  budget.steps++;
+  if (budget.steps > JSON_MAX) {
+    throw _err("sigstore/bad-bundle", "the bundle holds more values than a bundle of the maximum size can");
+  }
+}
+
+/** @internal One property of the caller's structure, copied. Taken from the property's DESCRIPTOR,
+ * which does not run an accessor, and an accessor is refused rather than called. A bundle is data; a
+ * field that computes its value is not one. Reading through the object would run the caller's code in
+ * the middle of the walk, and that code can change the object being walked: a getter on one property
+ * deleting another leaves a key this already listed reading as absent, so an object carrying two
+ * content arms would be copied with one. Not calling anything is what makes that unreachable, rather
+ * than another rule about what a second read may say. Named properties and array elements both come
+ * through here, because an indexed accessor runs the same code a named one does.
+ * Returns `undefined` for a property that is absent or holds `undefined`, which is what a bundle
+ * without that field means. */
+function _valueOf(obj, key, depth, budget) {
+  var d = _ownDescriptor(obj, key);
+  if (d === undefined) return undefined;
+  if (typeof d.get === "function" || typeof d.set === "function") {
+    throw _err("sigstore/bad-bundle", "the bundle reaches " + guard.text.showValue(key) +
+      " through an accessor rather than holding a value; a bundle is data");
+  }
+  if (d.value === undefined) return undefined;
+  return _plainCopy(d.value, depth + 1, budget);
+}
+
+/** @internal A bundle object copied into plain data, reading each own enumerable property EXACTLY
+ * ONCE. That single read is the whole guarantee: an accessor has no second answer to give, so no two
+ * observations of the same field can disagree and no check can be shown one value while another is
+ * used. Serializing the object instead would read it a second time, which is how a field could be
+ * checked in one place and used in another.
+ * A value JSON does not carry is refused rather than skipped. Skipping is what serializing does, and
+ * a dropped value turns a bundle setting two content arms into one setting a single arm: a refusal
+ * sanitized into an accept. A bundle is JSON data, so a function, a symbol or a non-finite number
+ * anywhere in it means the object is not one. `undefined` is the exception and is skipped, since that
+ * is what a bundle absent a field means and what the presence test already reads it as. */
+function _plainCopy(v, depth, budget) {
+  /** @internal The size the copy would serialize to, charged AS IT IS BUILT so the refusal comes
+   * before the allocation rather than after it. Two shapes both need this and neither is bounded by
+   * a depth limit: one sub-object shared between two properties is copied twice, so a few hundred
+   * bytes describes hundreds of millions of values, and a modest array of long strings is a handful
+   * of values holding tens of megabytes. Each value is charged what JSON writes it as, so the object
+   * path admits and refuses exactly what the text path does. */
+  _step(budget);
+  if (depth > BUNDLE_MAX_DEPTH) {
+    throw _err("sigstore/bad-bundle", "the bundle nests deeper than " + BUNDLE_MAX_DEPTH + " levels");
+  }
+  if (v === null) { _charge(budget, 4); return null; }
+  var t = typeof v;
+  if (t === "string") { _chargeString(budget, v); return v; }
+  if (t === "boolean") { _charge(budget, v ? 4 : 5); return v; }
+  if (t === "number") {
+    if (!_isFiniteNum(v)) throw _err("sigstore/bad-bundle", "the bundle carries a number JSON cannot represent");
+    /** @internal A finite number is written by JSON exactly as the language writes it, so the digits
+     * it takes are the bytes it costs. One in exponent form is long and would otherwise be counted
+     * as a single byte. */
+    _charge(budget, _stringOf(v).length);
+    return v;
+  }
+  if (t !== "object") {
+    throw _err("sigstore/bad-bundle", "the bundle carries a " + t + " where JSON carries only objects, arrays, strings, numbers, booleans and null");
+  }
+  /** @internal The two brackets or braces this value is written between. */
+  _charge(budget, 2);
+  var out, i;
+  if (_isArray(v)) {
+    out = [];
+    for (i = 0; i < v.length; i++) {
+      if (i > 0) _charge(budget, 1);
+      /** @internal An element is a property, and is taken the same way a named one is. An indexed
+       * accessor runs the caller's code exactly as a named accessor does, and can do the same thing
+       * with it: deleting a content arm the walk has already listed. A hole is written as null, and
+       * costs what null costs. */
+      var el = _valueOf(v, _stringOf(i), depth, budget);
+      if (el === undefined) _charge(budget, 4);
+      _defineProp(out, _stringOf(out.length), { value: el, writable: true, enumerable: true, configurable: true });
+    }
+    return out;
+  }
+  /** @internal Built with no prototype, so a property named __proto__ is copied as a field of that
+   * name. Assigning it onto an ordinary object runs the inherited setter instead, which sets the
+   * copy's prototype rather than one of its fields: an object owning nothing but __proto__ would
+   * then read as whatever it holds, and the same document as JSON text is refused. The reader this
+   * module parses text with states the same rule, so both routes agree. */
+  out = _create(null);
+  /** @internal EVERY own string-keyed property, not only the enumerable ones, because that is what
+   * the presence test the oneof rules are built on reads. Enumerating a narrower set than the test
+   * does is how a second content arm gets counted where the bundle is parsed and dropped where it is
+   * copied, which is a refusal turned into an acceptance. */
+  var keys = _ownNames(v);
+  var kept = 0;
+  for (i = 0; i < keys.length; i++) {
+    /** @internal Every enumerated property costs the walk a step, whether or not its value is kept.
+     * Its SIZE is charged only if it is kept, since JSON omits a property whose value is not
+     * written and charging one would refuse a document the text reader admits. */
+    _step(budget);
+    /** @internal Taken from the property's DESCRIPTOR, which does not run an accessor, and an
+     * accessor is refused rather than called. A bundle is data; a field that computes its value is
+     * not one. Reading through the object would run the caller's code in the middle of the walk,
+     * and that code can change the object being walked: a getter on one property deleting another
+     * leaves a key this already listed reading as absent, so an object carrying two content arms
+     * would be copied with one. Not calling anything is what makes that unreachable, rather than
+     * another rule about what a second read may say. */
+    var val = _valueOf(v, keys[i], depth, budget);
+    if (val === undefined) continue;
+    /** @internal What JSON writes around a kept property: the comma before it once one has been
+     * written, its name in quotes, and the colon. */
+    if (kept > 0) _charge(budget, 1);
+    _chargeString(budget, keys[i]);
+    _charge(budget, 1);
+    kept++;
+    _defineProp(out, keys[i], { value: val, writable: true, enumerable: true, configurable: true });
+  }
+  return out;
+}
+
+/** @internal The bundle a verdict is computed from: JSON text as it came, or an object copied once
+ * into plain data and re-read through the same reader, so the caps that bound a text bundle bound an
+ * object one too. Every check below runs on that copy and none of them consults the original again,
+ * which is what makes the verdict a statement about one fixed set of bytes.
+ * The scope this cannot reach, stated so it is not mistaken for an oversight: an exotic object whose
+ * own descriptors say one thing while a direct property read says another, which a Proxy can be
+ * written to do. There is no truer answer to prefer between the two, and the verdict describes the
+ * one the copy took, so it remains a statement about what was actually verified. A caller comparing
+ * a separate parseBundle of the same object may see the other answer. */
+function _snapshotBundle(bundle) {
+  /** @internal The copy IS the snapshot. It is plain data already, and the size and depth the reader
+   * bounds a text bundle by were charged while it was built, so serializing it and reading it back
+   * would repeat work that is already done. It would also put a step between the copy and the checks
+   * that is not this module's: a serializer replaced after this module loaded is read at the moment
+   * it is called, and one that drops a field would hand the checks a bundle carrying one content arm
+   * where the copy holds two. Nothing here converts the copy to text, so there is no such step.
+   * Reading a caller's object runs the caller's own accessors, and one that throws must arrive as
+   * this module's refusal rather than as whatever it threw: a bundle this cannot read is refused with
+   * a typed error like any other it cannot read. This module's own refusals pass through unchanged,
+   * so a size or depth verdict keeps its own message. */
+  try {
+    return _plainCopy(bundle, 0, { n: 0, steps: 0 });
+  } catch (e) {
+    if (e instanceof SigstoreError) throw e;
+    throw _err("sigstore/bad-bundle", "the bundle object could not be read", e);
+  }
+}
+
+/** @internal Which content arm a parsed bundle carries. parseBundle has already refused a bundle
+ * setting both or neither, so this reads the one that is there. */
+function _contentTypeOf(obj) {
+  return _armPresent(obj, "messageSignature") ? "messageSignature" : "dsseEnvelope";
+}
+
+/** @internal The shape of a MessageSignature (sigstore_common.proto). `signature` is REQUIRED;
+ * `message_digest` is not, and the bundle format states why: a verifier is given the artifact, so the
+ * digest is a hint rather than an input. The field comment says so outright, "Clients MUST NOT attempt
+ * to use this digest to verify the associated signature; it is intended solely for identification",
+ * which is why nothing here derives a verification input from it. What it IS held to is describing
+ * itself: an algorithm this build knows, and a digest of that algorithm's own length. */
+function _parseMessageSignature(ms) {
+  if (!ms || typeof ms !== "object" || _isArray(ms)) {
+    throw _err("sigstore/bad-message-signature", "messageSignature is not an object");
+  }
+  var sig = ms.signature;
+  if (typeof sig !== "string" || sig === "") {
+    throw _err("sigstore/bad-message-signature", "messageSignature is missing its signature");
+  }
+  if (!_armPresent(ms, "messageDigest")) return { signature: sig, digestAlg: null, digest: null };
+  var md = ms.messageDigest;
+  if (typeof md !== "object" || _isArray(md)) {
+    throw _err("sigstore/bad-message-signature", "messageSignature.messageDigest is not an object");
+  }
+  /** @internal Read for being a string or an integer BEFORE it is used as a key. A value whose own
+   * conversion throws would otherwise escape as an untyped error out of a verb whose contract is that
+   * malformed input is refused with a typed one, and a bundle is caller-supplied JSON. */
+  var alg = _hashOf(md.algorithm);
+  if (!alg) {
+    throw _err("sigstore/bad-message-signature", "messageSignature.messageDigest names a hash algorithm this build does not verify under: " +
+      (md.algorithm === undefined ? "(none)" : guard.text.showValue(md.algorithm)));
+  }
+  if (typeof md.digest !== "string") {
+    throw _err("sigstore/bad-message-signature", "messageSignature.messageDigest is missing its digest");
+  }
+  var raw = _b64(md.digest, "messageSignature.messageDigest.digest");
+  if (raw.length !== alg.bytes) {
+    throw _err("sigstore/bad-message-signature", "messageSignature.messageDigest states " + md.algorithm +
+      " and carries " + raw.length + " bytes, which that algorithm does not produce");
+  }
+  /** @internal The checked values are RETURNED rather than left to be read again. A bundle is a
+   * caller-supplied object, so a second read of the same field is a second chance to answer
+   * differently; everything downstream uses what was validated here. */
+  return { signature: sig, digestAlg: alg, digest: raw };
+}
+
 
 function _certBytes(c, label) {
   if (!c || typeof c !== "object" || typeof c.rawBytes !== "string") throw _err("sigstore/bad-bundle", label + " is not a { rawBytes } certificate");
@@ -217,13 +569,13 @@ function _certBytes(c, label) {
 }
 function _leafCertDer(vm) {
   if (vm.certificate) return _certBytes(vm.certificate, "verificationMaterial.certificate");
-  if (vm.x509CertificateChain && Array.isArray(vm.x509CertificateChain.certificates) && vm.x509CertificateChain.certificates.length) {
+  if (vm.x509CertificateChain && _isArray(vm.x509CertificateChain.certificates) && vm.x509CertificateChain.certificates.length) {
     return _certBytes(vm.x509CertificateChain.certificates[0], "verificationMaterial.x509CertificateChain[0]");
   }
   throw _err("sigstore/bad-bundle", "bundle has no Fulcio certificate (public_key bundles are not supported)");
 }
 function _chainDers(vm) {
-  if (vm.x509CertificateChain && Array.isArray(vm.x509CertificateChain.certificates)) {
+  if (vm.x509CertificateChain && _isArray(vm.x509CertificateChain.certificates)) {
     return vm.x509CertificateChain.certificates.map(function (c, i) { return _certBytes(c, "x509CertificateChain[" + i + "]"); });
   }
   return [_leafCertDer(vm)];
@@ -259,7 +611,7 @@ function _sha256(buf) { return nodeCrypto.createHash("sha256").update(buf).diges
 
 function _toMs(x) {
   if (x == null) return null;
-  if (typeof x === "number") return Number.isFinite(x) ? x : null;
+  if (typeof x === "number") return _isFiniteNumber(x) ? x : null;
   if (guard.time.isDate(x)) { var d = guard.time.instantOf(x); return isNaN(d) ? null : d; }
   if (typeof x === "string") { var t = Date.parse(x); return isNaN(t) ? null : t; }
   return null;
@@ -303,29 +655,64 @@ function _verifyCheckpoint(envelope, ip, rekorKeys, timeMs) {
   return false;
 }
 
-function _verifySet(te, rekorKeys, timeMs) {
+function _verifySet(te, rekorKeys, timeMs, canonBody) {
   var promise = te.inclusionPromise;
   if (!promise || typeof promise.signedEntryTimestamp !== "string") return false;
   var keyId = te.logId && te.logId.keyId ? _b64(te.logId.keyId, "logId.keyId") : null;
   var k = _rekorKey(rekorKeys, keyId, null, timeMs);
   if (!k) return false;
-  var canonical = JSON.stringify({
-    body: te.canonicalizedBody,
-    integratedTime: Number(te.integratedTime),
+  var canonical = _jsonStringify({
+    body: canonBody,
+    integratedTime: _numOf(te.integratedTime),
     logID: keyId.toString("hex"),
-    logIndex: Number(te.logIndex),
+    logIndex: _numOf(te.logIndex),
   });
   var sig = _b64(promise.signedEntryTimestamp, "signedEntryTimestamp");
   return _rawVerify(_pubFromSpki(k.spki, "Rekor log"), Buffer.from(canonical, "utf8"), sig);
 }
 
-function _bindEntry(te, envelope, leafDer) {
-  var body = _jsonParse(_b64(te.canonicalizedBody, "canonicalizedBody"), "sigstore/bad-tlog-entry", "Rekor entry body");
-  if (!body || typeof body !== "object" || Array.isArray(body)) throw _err("sigstore/bad-tlog-entry", "the Rekor entry body is not a JSON object");
+/** @internal The entry rows this build reads, keyed on the entry's OWN kind and apiVersion together.
+ * A version is not a detail of a kind here: a hashedrekord v0.0.2 body names its fields differently
+ * (`spec.hashedRekordV002`, a raw certificate in place of a PEM), so dispatching on the kind alone
+ * would read one shape's field names out of the other and report a mismatch rather than an
+ * unsupported entry. Each row states which content arm it may accompany, because an entry describing
+ * a DSSE envelope says nothing about a message signature and the two must agree. */
+var _ENTRY_ROWS = Object.freeze(Object.assign(Object.create(null), {
+  "dsse@0.0.1": { content: "dsseEnvelope", bind: _bindDsseEntry },
+  "hashedrekord@0.0.1": { content: "messageSignature", bind: _bindHashedRekordEntry },
+}));
+
+function _entryBody(canonBytes) {
+  var body = _jsonParse(canonBytes, "sigstore/bad-tlog-entry", "Rekor entry body");
+  if (!body || typeof body !== "object" || _isArray(body)) throw _err("sigstore/bad-tlog-entry", "the Rekor entry body is not a JSON object");
+  return body;
+}
+
+/** @internal The row for an entry, refused when the body names a kind and version this build does not
+ * read or one that does not go with the arm the bundle carries. */
+function _entryRow(body, contentType) {
+  /** @internal Both halves are read for being strings before either is joined into a key, since the
+   * body is caller-supplied JSON and a value whose own conversion throws would escape untyped. */
+  if (typeof body.kind !== "string" || typeof body.apiVersion !== "string") {
+    throw _err("sigstore/unsupported-content", "the Rekor entry does not name its kind and apiVersion as strings");
+  }
+  var key = body.kind + "@" + body.apiVersion;
+  var row = _ENTRY_ROWS[key];
+  if (!row) {
+    throw _err("sigstore/unsupported-content", "unsupported Rekor entry kind and version: " + guard.text.showValue(key));
+  }
+  if (row.content !== contentType) {
+    throw _err("sigstore/unsupported-content", "the Rekor entry is a " + guard.text.showValue(key) +
+      " while the bundle carries a " + contentType + "; the entry and the content arm must describe the same signature");
+  }
+  return row;
+}
+
+function _bindDsseEntry(body, envelope, leafDer) {
   var spec = body.spec;
-  if (body.kind !== "dsse" || !spec || typeof spec !== "object" || !Array.isArray(spec.signatures) || !spec.signatures.length ||
+  if (!spec || typeof spec !== "object" || !_isArray(spec.signatures) || !spec.signatures.length ||
       !spec.signatures[0] || typeof spec.signatures[0] !== "object" || typeof spec.signatures[0].signature !== "string") {
-    throw _err("sigstore/unsupported-content", "unsupported or malformed Rekor entry: " + body.kind);
+    throw _err("sigstore/bad-tlog-entry", "the Rekor dsse entry is missing its signature");
   }
   var envSig = _b64(envelope.signatures[0].sig, "dsseEnvelope.signatures[0].sig");
   var bodySig = _b64(spec.signatures[0].signature, "Rekor entry signature");
@@ -343,20 +730,127 @@ function _bindEntry(te, envelope, leafDer) {
   if (!vDer.equals(leafDer)) throw _err("sigstore/entry-mismatch", "the Rekor entry verifier certificate does not match the bundle leaf certificate");
 }
 
+/** @internal The entry's verifier, bound to the bundle's leaf. The Rekor field is "the public key
+ * that can verify the signature; this can also be an X509 code signing certificate that contains the
+ * raw public key information", so an entry states one or the other and both are read. A certificate
+ * binds as the same certificate; a bare key binds as the same key, which is what the entry claims
+ * about it, and the certificate's own identity is settled by the chain leg rather than here. Neither
+ * form is guessed at from the bytes: the armor names which one the entry wrote. */
+function _bindVerifier(content, leafDer) {
+  var text = _b64(content, "Rekor entry verifier").toString("utf8");
+  var vDer;
+  try { vDer = x509.pemDecode(text, "CERTIFICATE"); } catch (_e) { vDer = null; } // allow:swallow-unverified the other armor is tried next and a value carrying neither is refused below
+  if (vDer !== null) {
+    if (!vDer.equals(leafDer)) {
+      throw _err("sigstore/entry-mismatch", "the Rekor entry verifier certificate does not match the bundle leaf certificate");
+    }
+    return;
+  }
+  var spki;
+  try { spki = x509.pemDecode(text, "PUBLIC KEY"); }
+  catch (e) { throw _err("sigstore/bad-tlog-entry", "the Rekor entry verifier is neither a certificate nor a public key", e); }
+  var leafSpki = _parseCert(leafDer, "Fulcio leaf certificate").subjectPublicKeyInfo.bytes;
+  if (!spki.equals(Buffer.from(leafSpki))) {
+    throw _err("sigstore/entry-mismatch", "the Rekor entry verifier public key does not match the bundle leaf certificate's key");
+  }
+}
+
+/** @internal Whether a string is a run of lowercase hexadecimal digits. The Rekor schema states the
+ * artifact hash that way, and the comparison it feeds comes from a hex encoder that emits lowercase,
+ * so an uppercase or non-hex value would compare unequal and be reported as a mismatched artifact
+ * rather than as the malformed entry it is. Scanned by character code, since a pattern here would be
+ * matched through a replaceable protocol. */
+function _isLowerHex(s) {
+  for (var i = 0; i < s.length; i++) {
+    var c = s.charCodeAt(i);
+    if (!((c >= 0x30 && c <= 0x39) || (c >= 0x61 && c <= 0x66))) return false;
+  }
+  return s.length > 0;
+}
+
+/** @internal The hashedrekord v0.0.1 sibling of the row above. It answers the same three questions
+ * the client specification states for binding an entry to the material being verified: the signature
+ * in the body is the one the bundle carries, the certificate in the body is the bundle's leaf, and
+ * the body names the artifact. The third is what makes this entry worth having, because
+ * `data.hash` sits inside the canonicalized body that the inclusion proof folds to a signed root,
+ * while the bundle's own messageDigest is covered by no signature at all. Returns that authenticated
+ * hash, which is the statement the artifact is then held to. */
+function _bindHashedRekordEntry(body, ms, leafDer) {
+  var spec = body.spec;
+  if (!spec || typeof spec !== "object" || !spec.signature || typeof spec.signature !== "object") {
+    throw _err("sigstore/bad-tlog-entry", "the Rekor hashedrekord entry has no signature object");
+  }
+  if (typeof spec.signature.content !== "string") {
+    throw _err("sigstore/bad-tlog-entry", "the Rekor hashedrekord entry is missing its signature content");
+  }
+  var bodySig = _b64(spec.signature.content, "Rekor entry signature");
+  var armSig = _b64(ms.signature, "messageSignature.signature");
+  if (!armSig.equals(bodySig)) {
+    throw _err("sigstore/entry-mismatch", "the Rekor entry signature does not match the bundle signature");
+  }
+  var pk = spec.signature.publicKey;
+  if (!pk || typeof pk !== "object" || typeof pk.content !== "string") {
+    throw _err("sigstore/bad-tlog-entry", "the Rekor hashedrekord entry is missing its verifier public key");
+  }
+  _bindVerifier(pk.content, leafDer);
+  var data = spec.data;
+  if (!data || typeof data !== "object" || !data.hash || typeof data.hash !== "object") {
+    throw _err("sigstore/bad-tlog-entry", "the Rekor hashedrekord entry has no data hash");
+  }
+  var alg = typeof data.hash.algorithm === "string" ? _HASH_BY_REKOR[data.hash.algorithm] : null;
+  if (!alg) {
+    throw _err("sigstore/bad-tlog-entry", "the Rekor entry names a hash algorithm outside the schema's own three: " +
+      (data.hash.algorithm === undefined ? "(none)" : guard.text.showValue(data.hash.algorithm)));
+  }
+  if (typeof data.hash.value !== "string" || data.hash.value.length !== alg.bytes * 2 ||
+      !_isLowerHex(data.hash.value)) {
+    throw _err("sigstore/bad-tlog-entry", "the Rekor entry's artifact hash is not a lowercase hex digest of its own algorithm");
+  }
+  return { algorithm: data.hash.algorithm, node: alg.node, value: data.hash.value };
+}
+
 function _verifyRekor(te, envelope, rekorKeys, leafDer) {
+  return _verifyRekorEntry(te, rekorKeys, leafDer, "dsseEnvelope", function (body) {
+    _bindDsseEntry(body, envelope, leafDer);
+    return null;
+  });
+}
+
+/** @internal The message-signature route through the same entry verification. Only the binding
+ * differs, so the inclusion proof, the checkpoint and the SET are checked in one place for both arms
+ * rather than in a copy per arm. */
+function _verifyRekorMessage(te, ms, rekorKeys, leafDer) {
+  return _verifyRekorEntry(te, rekorKeys, leafDer, "messageSignature", function (body) {
+    return _bindHashedRekordEntry(body, ms, leafDer);
+  });
+}
+
+function _verifyRekorEntry(te, rekorKeys, leafDer, contentType, bind) {
   var ip = te.inclusionProof;
-  if (!ip || typeof ip.rootHash !== "string" || !Array.isArray(ip.hashes)) {
+  if (!ip || typeof ip.rootHash !== "string" || !_isArray(ip.hashes)) {
     throw _err("sigstore/bad-inclusion-proof", "the transparency-log entry has no inclusion proof");
   }
-  var claimedSec = Number(te.integratedTime);
-  var claimedMs = Number.isFinite(claimedSec) ? C.TIME.seconds(claimedSec) : NaN;
-  _bindEntry(te, envelope, leafDer);
+  var claimedSec = _numOf(te.integratedTime);
+  var claimedMs = _isFiniteNumber(claimedSec) ? C.TIME.seconds(claimedSec) : NaN;
+  /** @internal The canonicalized body is read ONCE and every check below runs on that one copy: the
+   * signature and certificate it binds, the leaf hash the inclusion proof folds, and the bytes the
+   * signed entry timestamp covers. A transparency-log entry is a caller-supplied object, so reading
+   * the field again would let one body be bound while a different one is proven, and the verdict
+   * would then attest an entry that never recorded what was verified. */
+  var canonB64 = te.canonicalizedBody;
+  if (typeof canonB64 !== "string") {
+    throw _err("sigstore/bad-tlog-entry", "the transparency-log entry has no canonicalizedBody");
+  }
+  var canonBytes = _b64(canonB64, "canonicalizedBody");
+  var body = _entryBody(canonBytes);
+  _entryRow(body, contentType);
+  var artifactHash = bind(body);
   var included;
   try {
     included = merkle.verifyInclusion({
       leafIndex: BigInt(ip.logIndex),
       treeSize: BigInt(ip.treeSize),
-      leafHash: merkle.leafHash(_b64(te.canonicalizedBody, "canonicalizedBody")),
+      leafHash: merkle.leafHash(canonBytes),
       proof: ip.hashes.map(function (h, i) { return _b64(h, "inclusionProof.hashes[" + i + "]"); }),
       rootHash: _b64(ip.rootHash, "inclusionProof.rootHash"),
     });
@@ -366,12 +860,16 @@ function _verifyRekor(te, envelope, rekorKeys, leafDer) {
   if (!included) throw _err("sigstore/inclusion-proof-mismatch", "the inclusion proof does not reconstruct the tree root");
   var checkpointOk = ip.checkpoint && typeof ip.checkpoint.envelope === "string" && _verifyCheckpoint(ip.checkpoint.envelope, ip, rekorKeys, claimedMs);
   if (!checkpointOk) throw _err("sigstore/unsigned-root", "the Rekor checkpoint (the signed tree root) did not verify under the caller Rekor key -- the inclusion-proof root is not attested");
-  var setOk = _verifySet(te, rekorKeys, claimedMs);
+  var setOk = _verifySet(te, rekorKeys, claimedMs, canonB64);
   if (!setOk) throw _err("sigstore/unattested-time", "the Rekor SET (the signed source of integratedTime) did not verify -- the log time is not attested and cannot date the Fulcio certificate");
-  var t = Number(te.integratedTime);
-  if (!Number.isFinite(t) || t < 0) throw _err("sigstore/bad-tlog-entry", "the transparency-log entry has a malformed integratedTime");
-  var li = Number(te.logIndex);
-  return { integratedTime: t, logIndex: Number.isFinite(li) ? li : null, logId: te.logId && te.logId.keyId ? _b64(te.logId.keyId, "logId.keyId").toString("hex") : null };
+  var t = _numOf(te.integratedTime);
+  if (!_isFiniteNumber(t) || t < 0) throw _err("sigstore/bad-tlog-entry", "the transparency-log entry has a malformed integratedTime");
+  var li = _numOf(te.logIndex);
+  return {
+    integratedTime: t, logIndex: _isFiniteNumber(li) ? li : null,
+    logId: te.logId && te.logId.keyId ? _b64(te.logId.keyId, "logId.keyId").toString("hex") : null,
+    artifactHash: artifactHash,
+  };
 }
 
 
@@ -379,8 +877,8 @@ function _dn(cert, which) { return cert[which] && cert[which].dn; }
 
 function _normRoots(fulcioRoots) {
   return fulcioRoots.map(function (r, i) {
-    var der = Buffer.isBuffer(r) ? r : (r && (r.der || r.rawBytes));
-    if (!Buffer.isBuffer(der)) throw _err("sigstore/bad-input", "fulcioRoots[" + i + "] must be a DER Buffer or { der, validFor }");
+    var der = _isBuffer(r) ? r : (r && (r.der || r.rawBytes));
+    if (!_isBuffer(der)) throw _err("sigstore/bad-input", "fulcioRoots[" + i + "] must be a DER Buffer or { der, validFor }");
     return { cert: _parseCert(der, "Fulcio CA root [" + i + "]"), validFor: (r && r.validFor) || null };
   });
 }
@@ -420,12 +918,12 @@ var OID_SCT_LIST = oid.byName("signedCertificateTimestampList");
  * operator builds both from the one trusted-root document. An empty array is refused rather than read
  * as "no logs to check against", which would turn an opted-in check into a silent pass. */
 function _normCtLogs(ctLogs) {
-  if (!Array.isArray(ctLogs)) throw _err("sigstore/bad-input", "ctLogs must be an array of { keyId, spki, validFor? }");
+  if (!_isArray(ctLogs)) throw _err("sigstore/bad-input", "ctLogs must be an array of { keyId, spki, validFor? }");
   if (ctLogs.length === 0) throw _err("sigstore/bad-input", "ctLogs is empty; omit the option to skip the certificate-transparency check rather than supplying no logs");
   return ctLogs.map(function (l, i) {
     if (l === null || typeof l !== "object") throw _err("sigstore/bad-input", "ctLogs[" + i + "] must be { keyId, spki, validFor? }");
-    if (!Buffer.isBuffer(l.keyId)) throw _err("sigstore/bad-input", "ctLogs[" + i + "].keyId must be the log id as a Buffer");
-    if (!Buffer.isBuffer(l.spki)) throw _err("sigstore/bad-input", "ctLogs[" + i + "].spki must be the log's SubjectPublicKeyInfo DER");
+    if (!_isBuffer(l.keyId)) throw _err("sigstore/bad-input", "ctLogs[" + i + "].keyId must be the log id as a Buffer");
+    if (!_isBuffer(l.spki)) throw _err("sigstore/bad-input", "ctLogs[" + i + "].spki must be the log's SubjectPublicKeyInfo DER");
     return { keyId: l.keyId, spki: l.spki, validFor: l.validFor || null };
   });
 }
@@ -482,7 +980,7 @@ function _sctVerifies(entry, sct, spki) {
 function _sctMs(sct) { return Number(sct.timestamp || 0); }
 
 function _ctLogFor(logs, logIdBytes, timeMs) {
-  var want = Buffer.isBuffer(logIdBytes) ? logIdBytes : Buffer.from(logIdBytes || []);
+  var want = _isBuffer(logIdBytes) ? logIdBytes : Buffer.from(logIdBytes || []);
   for (var i = 0; i < logs.length; i++) {
     if (logs[i].keyId.equals(want) && _inWindow(timeMs, logs[i].validFor)) return logs[i];
   }
@@ -567,20 +1065,35 @@ function _sanValue(ext) {
   return names[0] || null;
 }
 function _fulcioExtValue(ext, leafArc) {
-  if (!Buffer.isBuffer(ext.value)) throw _err("sigstore/bad-certificate", "Fulcio extension " + ext.oid + " has no value");
+  if (!_isBuffer(ext.value)) throw _err("sigstore/bad-certificate", "Fulcio extension " + ext.oid + " has no value");
   if (leafArc >= 1 && leafArc <= 6) return ext.value.toString("utf8");
   return asn1.read.string(asn1.decode(ext.value));
 }
 
 var IDENTITY_FIELDS = ["san", "issuer", "sourceRepositoryURI"];
 var IDENTITY_KEYS = Object.assign(Object.create(null), { san: 1, issuer: 1, sourceRepositoryURI: 1 });
-var _VERIFY_BUNDLE_OPTS = Object.assign(Object.create(null), { fulcioRoots: 1, rekorKeys: 1, ctLogs: 1, identity: 1, predicateType: 1, time: 1 });
+var _VERIFY_BUNDLE_OPTS = Object.assign(Object.create(null), { fulcioRoots: 1, rekorKeys: 1, ctLogs: 1, identity: 1, predicateType: 1, time: 1, artifact: 1 });
+
+/** @internal The bytes a message signature covers, taken once. There is no shape here in which a
+ * caller hands over a precomputed digest: the arm's own field comment forbids using one as a
+ * verification input, and the client specification asks a verifier to accept the artifact and compute
+ * the digest itself so the two cannot be confused. So this takes a byte source and nothing else, and
+ * a hex string or a digest-shaped object is refused at the door rather than hashed as if it were the
+ * artifact. Snapshotted, because both the digest and the signature read these bytes and a view whose
+ * backing store changes between the two would be verified in one form and reported in the other. */
+function _artifactBytes(v) {
+  if (!guard.bytes.isByteSource(v)) {
+    throw _err("sigstore/bad-input", "opts.artifact must be the artifact's bytes (a Buffer, TypedArray, DataView or ArrayBuffer); " +
+      "a digest is not accepted in its place, since the signature covers the artifact itself");
+  }
+  return guard.bytes.snapshotSource(v, SigstoreError, "sigstore/bad-input", "opts.artifact");
+}
 
 function _checkIdentity(id, policy) {
   // allow:registry-table-inherits-object-prototype -- the identityChecked record an operator reads by field name, whose three keys are the fixed IDENTITY_FIELDS rather than anything the bundle supplies
   var ran = { san: false, issuer: false, sourceRepositoryURI: false };
   if (policy === undefined || policy === null) return ran;
-  if (typeof policy !== "object" || Array.isArray(policy)) {
+  if (typeof policy !== "object" || _isArray(policy)) {
     throw _err("sigstore/bad-input", "opts.identity must be an object naming the identity fields to pin (" + IDENTITY_FIELDS.join(", ") + ")");
   }
   guard.identifier.assertKnownKeys(policy, IDENTITY_KEYS, _err, "sigstore/bad-input", "opts.identity has an unknown key ");
@@ -608,7 +1121,7 @@ function _statement(payload, payloadType, expectedPredicate) {
   }
   var st = _jsonParse(payload, "sigstore/bad-statement", "in-toto statement");
   if (!st || typeof st !== "object" || st._type !== "https://in-toto.io/Statement/v1") throw _err("sigstore/bad-statement", "the payload is not an in-toto Statement v1");
-  if (!Array.isArray(st.subject) || !st.subject.length) throw _err("sigstore/bad-statement", "the in-toto statement has no subject");
+  if (!_isArray(st.subject) || !st.subject.length) throw _err("sigstore/bad-statement", "the in-toto statement has no subject");
   if (expectedPredicate && st.predicateType !== expectedPredicate) {
     throw _err("sigstore/predicate-mismatch", "the statement predicateType " + JSON.stringify(st.predicateType) + " does not match the expected " + JSON.stringify(expectedPredicate));
   }
@@ -664,12 +1177,28 @@ function _statement(payload, payloadType, expectedPredicate) {
  * while reading as a policy; so is an unrecognized field name, which would otherwise
  * pin nothing under a spelling the operator believes constrains the signer.
  *
+ * A bundle carrying a `message_signature` is verified against the artifact itself,
+ * which `opts.artifact` supplies as bytes and which this hashes. It is required for
+ * that arm: the `messageDigest` the bundle carries is covered by no signature, and
+ * the arm's own definition says a client must not use it to verify the signature, so
+ * there is no shape here in which a caller hands over a digest instead. The artifact
+ * is held to the hash the Rekor entry records, which the inclusion proof covers, and
+ * then the signature is checked over its bytes. `artifactDigest` reports the digest
+ * this computed and `digestAlgorithm` the algorithm the entry named;
+ * `messageDigestChecked` says whether the bundle's own digest was there to agree with.
+ * `opts.predicateType` is refused for that arm, and `opts.artifact` for a DSSE one,
+ * rather than being read and ignored.
+ *
+ * The verdict has one shape for both arms. `contentType` names the arm, and the
+ * fields the other arm has nothing to report are present and `null`.
+ *
  * @opts
  *   fulcioRoots:   Array,      // the Fulcio CA anchors: a DER Buffer or { der, validFor } each
  *   rekorKeys:     Array,      // [{ keyId, spki, validFor? }] the Rekor log public keys
  *   ctLogs:        Array,      // optional [{ keyId, spki, validFor? }] certificate-transparency logs; when given, the certificate's embedded receipt is checked
  *   identity:      object,     // optional policy: { san, issuer, sourceRepositoryURI }; at least one required when present
- *   predicateType: string,     // optional: require this in-toto predicateType (e.g. the SLSA URI)
+ *   predicateType: string,     // optional: require this in-toto predicateType (e.g. the SLSA URI); dsse_envelope bundles only
+ *   artifact:      BufferSource, // the bytes a message_signature covers; required for that arm, refused for a dsse_envelope
  *   time:          Date,       // optional check-date override (default: the Rekor integratedTime)
  *
  * @example
@@ -680,59 +1209,155 @@ function _statement(payload, payloadType, expectedPredicate) {
  *   out.subjects[0].digest;  // { sha512: "..." } -- confirm against your tarball
  */
 async function verifyBundle(bundle, opts) {
-  if (bundle === null || typeof bundle !== "object" && typeof bundle !== "string" && !Buffer.isBuffer(bundle)) {
+  if (bundle === null || typeof bundle !== "object" && typeof bundle !== "string" && !_isBuffer(bundle)) {
     throw new TypeError("verifyBundle: bundle must be an object, JSON string, or Buffer");
   }
   opts = opts || {};
   guard.identifier.assertKnownKeys(opts, _VERIFY_BUNDLE_OPTS, _err, "sigstore/bad-input", "pki.sigstore.verifyBundle has an unknown option ");
+  /** @internal parseBundle takes the copy, so every check below runs on plain data that cannot change
+   * under it, whichever field it reads and however many times. */
   var b = parseBundle(bundle);
   var vm = b.verificationMaterial;
+  var contentType = _contentTypeOf(b);
+  var isMsg = contentType === "messageSignature";
   var env = b.dsseEnvelope;
-  var rekorKeys = opts.rekorKeys || [];
-  var fulcioRoots = opts.fulcioRoots || [];
+  /** @internal Every option is read once, into a snapshot the checks and the verdict both read. An
+   * option reached through an accessor answers each read separately, so a second read is a second
+   * answer: one that passed a refusal could be reported by the verdict as a different value, and a
+   * verdict that names an option is naming the value the check ran on. */
+  var o = guard.identifier.snapshotOptions(opts, _VERIFY_BUNDLE_OPTS);
+  var rekorKeys = o.rekorKeys || [];
+  var fulcioRoots = o.fulcioRoots || [];
+
+  /** @internal Each option belongs to one arm, and one supplied for the other is refused rather than
+   * passed over. An ignored option reads as a check that ran: opts.artifact on a DSSE bundle names
+   * bytes nothing here compares, and opts.predicateType on a message signature names a statement
+   * there is none of. */
+  if (!isMsg && o.artifact != null) {
+    throw _err("sigstore/bad-input", "opts.artifact is only read for a message_signature bundle; this bundle carries a dsse_envelope, whose artifact binding is the statement's own subject digest");
+  }
+  if (isMsg && o.predicateType != null) {
+    throw _err("sigstore/bad-input", "opts.predicateType is only read for a dsse_envelope bundle; a message_signature carries no statement to pin a predicate type on");
+  }
+  var artifact = null;
+  if (isMsg) {
+    if (o.artifact == null) {
+      throw _err("sigstore/artifact-required", "verifying a message_signature bundle requires opts.artifact, the bytes the signature covers; the bundle's own messageDigest is unauthenticated and is not a substitute");
+    }
+    artifact = _artifactBytes(o.artifact);
+  }
 
   var leafDer = _leafCertDer(vm);
   var leaf = _parseCert(leafDer, "Fulcio leaf certificate");
-  var payload = _b64(env.payload, "dsseEnvelope.payload");
-  var preimage = pae(env.payloadType, payload);
-  var derSig = _b64(env.signatures[0].sig, "dsseEnvelope.signatures[0].sig");
   var leafKey = _pubFromSpki(leaf.subjectPublicKeyInfo.bytes, "Fulcio leaf");
-  if (!_rawVerify(leafKey, preimage, derSig)) throw _err("sigstore/dsse-verify-failed", "the DSSE signature does not verify under the Fulcio leaf key");
+  /** @internal Read once, validated once, used from the validated copy everywhere below. */
+  var msParsed = isMsg ? _parseMessageSignature(b.messageSignature) : null;
+  var payload = null, derSig;
+  if (isMsg) {
+    derSig = _b64(msParsed.signature, "messageSignature.signature");
+  } else {
+    payload = _b64(env.payload, "dsseEnvelope.payload");
+    derSig = _b64(env.signatures[0].sig, "dsseEnvelope.signatures[0].sig");
+    if (!_rawVerify(leafKey, pae(env.payloadType, payload), derSig)) throw _err("sigstore/dsse-verify-failed", "the DSSE signature does not verify under the Fulcio leaf key");
+  }
 
-  var tlogs = Array.isArray(vm.tlogEntries) ? vm.tlogEntries : [];
+  var tlogs = _isArray(vm.tlogEntries) ? vm.tlogEntries : [];
   if (!tlogs.length) throw _err("sigstore/bad-bundle", "a keyless bundle requires at least one transparency-log entry");
-  var rekor = null, lastErr = null;
+  /** @internal Selecting an entry means finding one that passes EVERY check deciding WHICH entry it
+   * is: that it binds to this signature and certificate, that it records this artifact, and that the
+   * certificate chain and the embedded timestamps hold at the instant it attests. Any of those
+   * failing is a reason to try the next entry rather than to refuse the bundle, because a log can
+   * hold several entries for one signature. Each check left after the loop refused a bundle whose
+   * later entry would have passed it, once for the artifact hash and again for the chain instant.
+   * Passing over an entry is not accepting a weaker one: the selected entry has passed all of them,
+   * and when none does the last failure is what the caller is told. */
+  var haveCallerTime = guard.time.isDate(o.time);
+  var callerTime = haveCallerTime ? guard.time.instantOf(o.time) : null;
+  var chainDers = _chainDers(vm);
+  /** @internal A caller-pinned instant is the same for every candidate, so the chain it decides is
+   * computed on the first candidate and reused rather than rebuilt per entry. Without one the instant
+   * comes from the entry and every candidate is its own question. The timestamps are not cached
+   * beside it: a candidate that reaches them and passes is selected immediately, so no later
+   * candidate could read the result. */
+  var pinnedChain = null;
+  var rekor = null, lastErr = null, artifactComputed = null, sctResult = null;
   for (var ti = 0; ti < tlogs.length; ti++) {
     if (!tlogs[ti] || typeof tlogs[ti] !== "object") { lastErr = _err("sigstore/bad-bundle", "a transparency-log entry is not an object"); continue; }
-    try { rekor = _verifyRekor(tlogs[ti], env, rekorKeys, leafDer); break; }
-    catch (e) { lastErr = e; }
+    try {
+      var candidate = isMsg ? _verifyRekorMessage(tlogs[ti], msParsed, rekorKeys, leafDer)
+        : _verifyRekor(tlogs[ti], env, rekorKeys, leafDer);
+      var candidateDigest = null;
+      if (isMsg) {
+        candidateDigest = nodeCrypto.createHash(candidate.artifactHash.node).update(artifact).digest();
+        if (!guard.crypto.constantTimeEqual(candidateDigest, Buffer.from(candidate.artifactHash.value, "hex"))) {
+          throw _err("sigstore/artifact-mismatch", "the artifact does not match the one the transparency-log entry records; its " +
+            candidate.artifactHash.algorithm + " digest is " + candidateDigest.toString("hex") + " and the entry names " + candidate.artifactHash.value);
+        }
+      }
+      var candidateTime = haveCallerTime ? callerTime : C.TIME.seconds(candidate.integratedTime);
+      var candidateChain = pinnedChain !== null ? pinnedChain
+        : await _verifyChain(leaf, chainDers, fulcioRoots, candidateTime);
+      if (haveCallerTime) pinnedChain = candidateChain;
+      /** @internal With no caller instant the reference is the authenticated log-entry time, whose
+       * whole second is inclusive: a certificate logged in the same second as its entry is not dated
+       * after it, and nothing beyond that second is accepted. */
+      var candidateBound = haveCallerTime ? candidateTime : C.TIME.seconds(candidate.integratedTime) + 999;
+      var candidateScts = await _verifyEmbeddedScts(leaf, leafDer, candidateChain.issuer, o.ctLogs, candidateTime, candidateBound);
+      rekor = candidate;
+      artifactComputed = candidateDigest;
+      sctResult = candidateScts;
+      break;
+    } catch (e) { lastErr = e; }
   }
   if (rekor === null) throw lastErr;
   var integratedTime = rekor.integratedTime;
 
-  var checkTime = guard.time.isDate(opts.time) ? guard.time.instantOf(opts.time) : C.TIME.seconds(integratedTime);
-  var chain = await _verifyChain(leaf, _chainDers(vm), fulcioRoots, checkTime);
-  /** @internal With no caller instant the reference is the authenticated log-entry time, whose whole
-   * second is inclusive: a certificate logged in the same second as its entry is not dated after it,
-   * and nothing beyond that second is accepted. */
-  var sctBound = guard.time.isDate(opts.time) ? checkTime : C.TIME.seconds(integratedTime) + 999;
-  var sctResult = await _verifyEmbeddedScts(leaf, leafDer, chain.issuer, opts.ctLogs, checkTime, sctBound);
+  /** @internal The order the client specification states: the entry is verified first, because it is
+   * what supplies both the time the certificate is checked at and the authenticated statement of what
+   * was signed. The artifact is held to THAT hash rather than to the digest the bundle carries, which
+   * no signature covers, and that comparison is what selected the entry above. Only after the
+   * artifact is the one the log recorded is the signature checked over its bytes. */
+  var artifactDigest = null, digestAlgorithm = null, messageDigestChecked = false;
+  if (isMsg) {
+    digestAlgorithm = rekor.artifactHash.algorithm;
+    var computed = artifactComputed;
+    artifactDigest = computed.toString("hex");
+    if (msParsed.digest !== null) {
+      var againstClaim = msParsed.digestAlg.node === rekor.artifactHash.node ? computed
+        : nodeCrypto.createHash(msParsed.digestAlg.node).update(artifact).digest();
+      if (!guard.crypto.constantTimeEqual(againstClaim, msParsed.digest)) {
+        throw _err("sigstore/artifact-mismatch", "the artifact does not match the messageDigest the bundle carries");
+      }
+      messageDigestChecked = true;
+    }
+    if (!_rawVerify(leafKey, artifact, derSig)) {
+      throw _err("sigstore/signature-verify-failed", "the message signature does not verify over the artifact under the Fulcio leaf key");
+    }
+  }
+
   var identity = _identity(leaf);
-  var identityChecked = _checkIdentity(identity, opts.identity);
+  var identityChecked = _checkIdentity(identity, o.identity);
 
-  var st = _statement(payload, env.payloadType, opts.predicateType);
+  /** @internal One verdict shape for both arms, so a caller reads the same fields whichever a bundle
+   * carries and a missing key never has to be told apart from a false one. The fields the other arm
+   * has nothing to report are present and null. */
+  var st = isMsg ? null : _statement(payload, env.payloadType, o.predicateType);
 
   return guard.verdict.of({
     valid: true,
     verified: true,
+    contentType: contentType,
     payload: payload,
     statement: st,
-    subjects: st.subject,
-    predicateType: st.predicateType,
-    predicate: st.predicate,
+    subjects: st === null ? null : st.subject,
+    predicateType: st === null ? null : st.predicateType,
+    predicate: st === null ? null : st.predicate,
+    artifactDigest: artifactDigest,
+    digestAlgorithm: digestAlgorithm,
+    messageDigestChecked: messageDigestChecked,
     identity: identity,
     identityChecked: identityChecked,
-    predicateTypeChecked: opts.predicateType != null,
+    predicateTypeChecked: o.predicateType != null,
     sctChecked: sctResult.checked,
     validScts: sctResult.validScts,
     integratedTime: integratedTime,