@blamejs/pki 0.7.10 → 0.7.11

package/CHANGELOG.md

@@ -4,6 +4,20 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.7.11 — 2026-09-10
+
+A name constraint whose base is a zero-length name is read rather than rejected.
+
+### Changed
+
+- pki.path.validate still refuses a caller-supplied subtree seed whose base is empty, through opts.initialPermittedSubtrees, opts.initialExcludedSubtrees or a trust anchor's nameConstraints. A seed that permits everything is a restriction the caller believes they applied, so that door is unchanged and is separate from decoding a certificate's own extension.
+
+### Fixed
+
+- A zero-length subtree base in a certificate's nameConstraints decodes. RFC 5280 section 4.2.1.6 states the prohibition for subjectAltName, that an extension with a dNSName of "" must not be used, and section 4.2.1.10 places no length floor on a constraint base. A zero-length dNSName in a subjectAltName is still refused, which is where the rule belongs.
+- For dNSName the empty base names the root of the namespace, the same as the bare-dot base already did: section 4.2.1.10 satisfies the constraint by adding zero or more labels to its left-hand side, and every name is that base plus labels. An excluded empty base therefore excludes every dNSName, and a permitted one permits every dNSName. A leaf naming no dNSName is untouched by either.
+- For rfc822Name and uniformResourceIdentifier the base decodes but the comparison reports path/name-constraint-unsupported and refuses. Section 4.2.1.10 gives a mail constraint a mailbox, a host or a leading-period domain, and a URI constraint a fully qualified domain name, so an empty base is none of the shapes either names and is not read as covering everything. The verdict now says the constraint could not be evaluated instead of saying the extension could not be parsed.
+
 ## v0.7.10 — 2026-09-10
 
 An OCSP response is no longer signed with a status window that runs backwards.

package/lib/schema-pkix.js

@@ -531,7 +531,13 @@ function generalName(ns, opts) {
     } else {
       if (constructed) throw ctx.E(code, "GeneralName [" + t + "] must be primitive (X.690 sec. 10.2)");
       if (GN_IA5[t]) {
-        if (n.content.length === 0) throw ctx.E(code, "GeneralName [" + t + "] must be a non-empty IA5String");
+        /** @internal RFC 5280 sec. 4.2.1.6 forbids a zero-length IA5String where a GeneralName names
+         * something: "subjectAltName extensions with a dNSName of ' ' MUST NOT be used". Sec.
+         * 4.2.1.10 places no length floor on a subtree BASE, where an empty one names every name of
+         * that form, which is how a technically-constrained sub-CA excludes a whole form. Scoped on
+         * subtreeBase the same way the iPAddress rule below it is, so the prohibition keeps holding
+         * everywhere a GeneralName is a name. */
+        if (!subtreeBase && n.content.length === 0) throw ctx.E(code, "GeneralName [" + t + "] must be a non-empty IA5String");
         guard.name.assertPrintableIa5(n.content, ctx.E, code, "GeneralName [" + t + "]");
         if (decodeValue) value = _bufToString(n.content, "latin1");
       } else if (t === 7) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.7.10",
+  "version": "0.7.11",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:34b0c9f8-e610-4b07-817f-7e260dc2355a",
+  "serialNumber": "urn:uuid:a94d16a8-ad1e-416e-8ea1-35dc679039b0",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-09-10T21:28:40.246Z",
+    "timestamp": "2026-09-10T22:54:50.067Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.7.10",
+      "bom-ref": "@blamejs/pki@0.7.11",
       "type": "application",
       "name": "pki",
-      "version": "0.7.10",
+      "version": "0.7.11",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.7.10",
+      "purl": "pkg:npm/%40blamejs/pki@0.7.11",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.7.10",
+      "ref": "@blamejs/pki@0.7.11",
       "dependsOn": []
     }
   ]