@blamejs/pki 0.7.29 → 0.7.30

package/CHANGELOG.md

@@ -4,6 +4,15 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.7.30 — 2026-09-12
+
+The Sigstore bundle verifier decides with operations bound when the module loads.
+
+### Changed
+
+- pki.sigstore.verifyBundle, parseBundle and pae read Buffer.prototype.equals, Buffer.prototype.toString, Buffer.prototype.subarray and Buffer.prototype.indexOf, Buffer.from and Buffer.concat, String.prototype.split, slice, indexOf, charAt and charCodeAt, Array.prototype.map, forEach, filter and slice, Object.assign, Object.create and Object.freeze, String, Number, BigInt, Date, Date.parse, Number.isNaN and JSON.stringify as bound at module load. Replacing Buffer.prototype.equals, String.prototype.split or indexOf, Array.prototype.filter or forEach, or Date.parse after load changes nothing this module decides: a valid bundle still verifies and a Rekor entry whose signature is not the bundle's is still refused. A replacement of Buffer.prototype.toString or subarray, Array.prototype.map, BigInt, Buffer.from or Buffer.concat still reaches the certificate parser and the chain builder's neighbors, which read those live; that residual is theirs and is stated here rather than implied covered.
+- SECURITY.md names the key import and export verbs and the Sigstore bundle verifier among the surfaces that take what they decide with at load.
+
 ## v0.7.29 — 2026-09-12
 
 Every decision pki.key makes is taken with operations bound when the module loads.

package/lib/guard-intrinsic.js

@@ -28,6 +28,7 @@ var _keyEquals = uncurry(_nodeCrypto.KeyObject.prototype.equals);
 var _isView = ArrayBuffer.isView;
 var _isInteger = Number.isInteger;
 var _isSafeInteger = Number.isSafeInteger;
+var _numberIsFinite = Number.isFinite;
 var _fromCharCode = String.fromCharCode;
 var _objectCreate = Object.create;
 var _getPrototypeOf = Object.getPrototypeOf;
@@ -85,6 +86,8 @@ var _Number = Number;
 var _Boolean = Boolean;
 var _BigInt = BigInt;
 var _Date = Date;
+var _dateParse = Date.parse;
+var _numberIsNaN = Number.isNaN;
 var _isFinite = globalThis.isFinite;
 var _ArrayBuffer = ArrayBuffer;
 var _Uint8Array = Uint8Array;
@@ -155,6 +158,7 @@ module.exports = Object.freeze({
   isView: _isView,
   isInteger: _isInteger,
   isSafeInteger: _isSafeInteger,
+  numberIsFinite: _numberIsFinite,
   fromCharCode: _fromCharCode,
   create: _objectCreate,
   getPrototypeOf: _getPrototypeOf,
@@ -202,6 +206,8 @@ module.exports = Object.freeze({
   Boolean: _Boolean,
   BigInt: _BigInt,
   Date: _Date,
+  dateParse: _dateParse,
+  numberIsNaN: _numberIsNaN,
   isFinite: _isFinite,
   ArrayBuffer: _ArrayBuffer,
   Uint8Array: _Uint8Array,

package/lib/sigstore.js

@@ -33,6 +33,7 @@ var frameworkError = require("./framework-error");
 var constants = require("./constants");
 var asn1 = require("./asn1-der");
 var guard = require("./guard-all");
+var intrinsic = require("./guard-intrinsic");
 var x509 = require("./schema-x509");
 var pkix = require("./schema-pkix");
 var pathValidate = require("./path-validate");
@@ -41,6 +42,59 @@ var oid = require("./oid");
 var ct = require("./ct");
 var edwardsPoint = require("./edwards-point");
 
+/** @internal The operations this module decides with, taken at load. The bundle copy every later
+ * check runs on settles what is verified, so which function answers "what does this object own" and
+ * "what does it hold" is fixed before any caller code runs; one replaced after this module loads
+ * would otherwise be asked at the moment of the call. An emptied key list alone turns a bundle into
+ * one carrying no content arm. */
+var _ownNames = intrinsic.getOwnPropertyNames;
+var _ownDescriptor = intrinsic.getOwnPropertyDescriptor;
+var _isArray = intrinsic.isArray;
+var _create = intrinsic.create;
+var _assign = intrinsic.assign;
+var _freeze = intrinsic.freeze;
+var _stringOf = intrinsic.String;
+var _numberOf = intrinsic.Number;
+var _bigIntOf = intrinsic.BigInt;
+var _Date = intrinsic.Date;
+var _dateParse = intrinsic.dateParse;
+var _isNaN = intrinsic.numberIsNaN;
+/** @internal Whether an object OWNS a name. The oneof rules are written on this question, so a
+ * replacement answering no for one arm hides it and a bundle setting two is read as setting one. */
+var _hasOwn = intrinsic.hasOwn;
+var _isFiniteNumber = intrinsic.numberIsFinite;
+var _isSafeInt = intrinsic.isSafeInteger;
+var _isBuffer = intrinsic.isBuffer;
+var _bufferFrom = intrinsic.bufferFrom;
+var _bufferConcat = intrinsic.bufferConcat;
+var _bufToString = intrinsic.bufToString;
+var _bufferEquals = intrinsic.bufferEquals;
+var _subarray = intrinsic.subarray;
+var _bufIndexOf = intrinsic.uncurry(Buffer.prototype.indexOf);
+/** @internal The canonical form a Rekor signed entry timestamp is verified over. A replacement
+ * writing different bytes decides what that signature is checked against. */
+var _jsonStringify = intrinsic.stringify;
+/** @internal Every field the copy holds is DEFINED as its own, never assigned. An assignment consults
+ * the target's prototype for a setter, and something that installs one sees each field the copy
+ * writes and can hand back a different one, so a malformed value arrives valid and the checks read
+ * what the caller never sent. Defining reaches no prototype. */
+var _defineProp = intrinsic.defineProperty;
+var _isFiniteNum = intrinsic.isFinite;
+/** @internal Uncurried, so the copy reads a character's code through the operation taken at load
+ * rather than through whatever the string it is walking offers under that name. What a character
+ * costs decides whether a bundle passes the size limit. */
+var _charCodeAt = intrinsic.uncurry(String.prototype.charCodeAt);
+var _charAt = intrinsic.uncurry(String.prototype.charAt);
+var _strSlice = intrinsic.uncurry(String.prototype.slice);
+var _strIndexOf = intrinsic.stringIndexOf;
+var _split = intrinsic.uncurry(String.prototype.split);
+var _join = intrinsic.join;
+var _map = intrinsic.map;
+var _forEach = intrinsic.forEach;
+var _filter = intrinsic.filter;
+var _arraySlice = intrinsic.arraySlice;
+var _fromCharCode = intrinsic.fromCharCode;
+
 var C = constants;
 var SigstoreError = frameworkError.SigstoreError;
 function _err(code, message, cause) { return new SigstoreError(code, message, cause); }
@@ -62,7 +116,7 @@ function _armPresent(obj, name) {
  * records. A member this table does not carry is refused rather than mapped by guessing at its name,
  * so a member added to the enum later cannot be read as one of these.
  * HASH_ALGORITHM_UNSPECIFIED is absent for the reason it exists: it names no algorithm. */
-var _HASH_BY_ENUM = Object.freeze(Object.assign(Object.create(null), {
+var _HASH_BY_ENUM = _freeze(_assign(_create(null), {
   SHA2_256: { node: "sha256", bytes: 32 },
   SHA2_384: { node: "sha384", bytes: 48 },
   SHA2_512: { node: "sha512", bytes: 64 },
@@ -74,7 +128,7 @@ var _HASH_BY_ENUM = Object.freeze(Object.assign(Object.create(null), {
  * a parser "accept[s] both enum names and integer values", so a bundle naming its digest algorithm as
  * 1 is one a conforming producer may write and this reads it as the name it stands for. Zero is
  * absent for the reason the name it belongs to is: HASH_ALGORITHM_UNSPECIFIED names no algorithm. */
-var _HASH_BY_NUMBER = Object.freeze(Object.assign(Object.create(null), {
+var _HASH_BY_NUMBER = _freeze(_assign(_create(null), {
   1: _HASH_BY_ENUM.SHA2_256,
   2: _HASH_BY_ENUM.SHA2_384,
   3: _HASH_BY_ENUM.SHA2_512,
@@ -96,7 +150,7 @@ function _hashOf(algorithm) {
 /** @internal The same three algorithms keyed the way a hashedrekord names them. The entry is the
  * authenticated statement of what was signed, so its algorithm is the one the artifact is digested
  * under; the schema enumerates exactly these three. */
-var _HASH_BY_REKOR = Object.freeze(Object.assign(Object.create(null), {
+var _HASH_BY_REKOR = _freeze(_assign(_create(null), {
   sha256: { node: "sha256", bytes: 32 },
   sha384: { node: "sha384", bytes: 48 },
   sha512: { node: "sha512", bytes: 64 },
@@ -109,64 +163,35 @@ var JSON_MAX = C.LIMITS.JSON_MAX_BYTES;
  * applied alone would admit it one way and refuse it the other. */
 var BUNDLE_MAX_DEPTH = 64;
 
-/** @internal The operations the bundle copy decides with, taken at load. That copy is what every
- * later check runs on, so which function answers "what does this object own" and "what does it hold"
- * settles what is verified; one replaced after this module loads would otherwise be asked at the
- * moment of the call. An emptied key list alone turns a bundle into one carrying no content arm. */
-var _ownNames = Object.getOwnPropertyNames;
-var _ownDescriptor = Object.getOwnPropertyDescriptor;
-var _isArray = Array.isArray;
-var _create = Object.create;
-var _stringOf = String;
-/** @internal Whether an object OWNS a name. The oneof rules are written on this question, so a
- * replacement answering no for one arm hides it and a bundle setting two is read as setting one. */
-var _hasOwn = Function.prototype.call.bind(Object.prototype.hasOwnProperty);
-var _isFiniteNumber = Number.isFinite;
-var _isSafeInt = Number.isSafeInteger;
-var _isBuffer = Buffer.isBuffer;
-var _bufferFrom = Buffer.from;
-/** @internal The canonical form a Rekor signed entry timestamp is verified over. A replacement
- * writing different bytes decides what that signature is checked against. */
-var _jsonStringify = JSON.stringify;
-/** @internal Every field the copy holds is DEFINED as its own, never assigned. An assignment consults
- * the target's prototype for a setter, and something that installs one sees each field the copy
- * writes and can hand back a different one, so a malformed value arrives valid and the checks read
- * what the caller never sent. Defining reaches no prototype. */
-var _defineProp = Object.defineProperty;
-var _isFiniteNum = isFinite;
-/** @internal Uncurried, so the copy reads a character's code through the operation taken at load
- * rather than through whatever the string it is walking offers under that name. What a character
- * costs decides whether a bundle passes the size limit. */
-var _charCodeAt = Function.prototype.call.bind(String.prototype.charCodeAt);
-var SP = Buffer.from(" ", "ascii");
-var DSSEV1 = Buffer.from("DSSEv1", "ascii");
-var _EM_DASH = String.fromCharCode(0x2014);
+var SP = _bufferFrom(" ", "ascii");
+var DSSEV1 = _bufferFrom("DSSEv1", "ascii");
+var _EM_DASH = _fromCharCode(0x2014);
 
 function _parseNoteSig(line) {
   var prefix = _EM_DASH + " ";
-  if (line.slice(0, prefix.length) !== prefix) return null;
+  if (_strSlice(line, 0, prefix.length) !== prefix) return null;
   var p = prefix.length, n = line.length;
   var t1s = p;
-  while (p < n && !pkix.isJsWhitespace(line.charCodeAt(p))) p += 1;
+  while (p < n && !pkix.isJsWhitespace(_charCodeAt(line, p))) p += 1;
   if (p === t1s) return null;
-  var keyId = line.slice(t1s, p);
-  if (line.charAt(p) !== " ") return null;
+  var keyId = _strSlice(line, t1s, p);
+  if (_charAt(line, p) !== " ") return null;
   p += 1;
   var t2s = p;
-  while (p < n && !pkix.isJsWhitespace(line.charCodeAt(p))) p += 1;
+  while (p < n && !pkix.isJsWhitespace(_charCodeAt(line, p))) p += 1;
   if (p === t2s) return null;
-  var sig = line.slice(t2s, p);
+  var sig = _strSlice(line, t2s, p);
   if (p !== n) return null;
   return { keyId: keyId, sig: sig };
 }
 
 function _stripTrailingEquals(s) {
   var i = s.length;
-  while (i > 0 && s.charAt(i - 1) === "=") i -= 1;
-  return s.slice(0, i);
+  while (i > 0 && _charAt(s, i - 1) === "=") i -= 1;
+  return _strSlice(s, 0, i);
 }
 
-var _BUNDLE_MEDIA_TYPES = Object.assign(Object.create(null), {
+var _BUNDLE_MEDIA_TYPES = _assign(_create(null), {
   "application/vnd.dev.sigstore.bundle.v0.1+json": 1,
   "application/vnd.dev.sigstore.bundle.v0.2+json": 1,
   "application/vnd.dev.sigstore.bundle.v0.3+json": 1,
@@ -206,22 +231,22 @@ function _jsonParse(input, code, label) {
  */
 function pae(payloadType, payloadBytes) {
   if (typeof payloadType !== "string") throw new TypeError("pae: payloadType must be a string");
-  var type = Buffer.from(payloadType, "utf8");
+  var type = _bufferFrom(payloadType, "utf8");
   var body = _isBuffer(payloadBytes) ? payloadBytes : _bufferFrom(payloadBytes || []);
-  return Buffer.concat([
+  return _bufferConcat([
     DSSEV1, SP,
-    Buffer.from(String(type.length), "ascii"), SP, type, SP,
-    Buffer.from(String(body.length), "ascii"), SP, body,
+    _bufferFrom(_stringOf(type.length), "ascii"), SP, type, SP,
+    _bufferFrom(_stringOf(body.length), "ascii"), SP, body,
   ]);
 }
 
 
 function _b64(s, label) {
   if (typeof s !== "string") throw _err("sigstore/bad-bundle", label + " must be a base64 string");
-  var urlSafe = s.indexOf("-") !== -1 || s.indexOf("_") !== -1;
+  var urlSafe = _strIndexOf(s, "-") !== -1 || _strIndexOf(s, "_") !== -1;
   var enc = urlSafe ? "base64url" : "base64";
-  var buf = Buffer.from(s, enc);
-  if (_stripTrailingEquals(buf.toString(enc)) !== _stripTrailingEquals(s)) {
+  var buf = _bufferFrom(s, enc);
+  if (_stripTrailingEquals(_bufToString(buf, enc)) !== _stripTrailingEquals(s)) {
     throw _err("sigstore/bad-bundle", label + " is not canonical base64");
   }
   return buf;
@@ -358,7 +383,7 @@ function _chargeString(budget, s) {
 function _numOf(v) {
   var t = typeof v;
   if (t === "number") return v;
-  if (t === "string" || t === "boolean") return Number(v);
+  if (t === "string" || t === "boolean") return _numberOf(v);
   return NaN;
 }
 
@@ -583,7 +608,7 @@ function _leafCertDer(vm) {
 }
 function _chainDers(vm) {
   if (vm.x509CertificateChain && _isArray(vm.x509CertificateChain.certificates)) {
-    return vm.x509CertificateChain.certificates.map(function (c, i) { return _certBytes(c, "x509CertificateChain[" + i + "]"); });
+    return _map(vm.x509CertificateChain.certificates, function (c, i) { return _certBytes(c, "x509CertificateChain[" + i + "]"); });
   }
   return [_leafCertDer(vm)];
 }
@@ -619,8 +644,8 @@ function _sha256(buf) { return nodeCrypto.createHash("sha256").update(buf).diges
 function _toMs(x) {
   if (x == null) return null;
   if (typeof x === "number") return _isFiniteNumber(x) ? x : null;
-  if (guard.time.isDate(x)) { var d = guard.time.instantOf(x); return isNaN(d) ? null : d; }
-  if (typeof x === "string") { var t = Date.parse(x); return isNaN(t) ? null : t; }
+  if (guard.time.isDate(x)) { var d = guard.time.instantOf(x); return _isNaN(d) ? null : d; }
+  if (typeof x === "string") { var t = _dateParse(x); return _isNaN(t) ? null : t; }
   return null;
 }
 function _inWindow(timeMs, vf) {
@@ -632,29 +657,29 @@ function _inWindow(timeMs, vf) {
 function _rekorKey(rekorKeys, keyIdBuf, hint, timeMs) {
   for (var i = 0; i < rekorKeys.length; i++) {
     var k = rekorKeys[i];
-    var match = (keyIdBuf && k.keyId && k.keyId.equals(keyIdBuf)) ||
-      (hint && k.keyId && k.keyId.length >= 4 && k.keyId.subarray(0, 4).equals(hint));
+    var match = (keyIdBuf && k.keyId && _bufferEquals(k.keyId, keyIdBuf)) ||
+      (hint && k.keyId && k.keyId.length >= 4 && _bufferEquals(_subarray(k.keyId, 0, 4), hint));
     if (match && _inWindow(timeMs, k.validFor)) return k;
   }
   return null;
 }
 
 function _verifyCheckpoint(envelope, ip, rekorKeys, timeMs) {
-  var buf = Buffer.from(envelope, "utf8");
-  var sep = buf.indexOf("\n\n");
+  var buf = _bufferFrom(envelope, "utf8");
+  var sep = _bufIndexOf(buf, "\n\n");
   if (sep < 0) throw _err("sigstore/bad-checkpoint", "the checkpoint has no note/signature separator");
-  var body = buf.subarray(0, sep + 1);
-  var lines = body.toString("utf8").split("\n");
-  if (_b64(lines[2], "checkpoint root").toString("hex") !== _b64(ip.rootHash, "inclusionProof.rootHash").toString("hex")) {
+  var body = _subarray(buf, 0, sep + 1);
+  var lines = _split(_bufToString(body, "utf8"), "\n");
+  if (_bufToString(_b64(lines[2], "checkpoint root"), "hex") !== _bufToString(_b64(ip.rootHash, "inclusionProof.rootHash"), "hex")) {
     throw _err("sigstore/inclusion-proof-mismatch", "the checkpoint root does not match the inclusion-proof root");
   }
-  var sigBlock = buf.subarray(sep + 2).toString("utf8").split("\n");
+  var sigBlock = _split(_bufToString(_subarray(buf, sep + 2), "utf8"), "\n");
   for (var i = 0; i < sigBlock.length; i++) {
     var note = _parseNoteSig(sigBlock[i]);
     if (!note) continue;
     var blob = _b64(note.sig, "checkpoint signature");
     if (blob.length < 5) continue;
-    var hint = blob.subarray(0, 4), derSig = blob.subarray(4);
+    var hint = _subarray(blob, 0, 4), derSig = _subarray(blob, 4);
     var k = _rekorKey(rekorKeys, null, hint, timeMs);
     if (!k) continue;
     if (_rawVerify(_pubFromSpki(k.spki, "Rekor log"), body, derSig)) return true;
@@ -671,11 +696,11 @@ function _verifySet(te, rekorKeys, timeMs, canonBody) {
   var canonical = _jsonStringify({
     body: canonBody,
     integratedTime: _numOf(te.integratedTime),
-    logID: keyId.toString("hex"),
+    logID: _bufToString(keyId, "hex"),
     logIndex: _numOf(te.logIndex),
   });
   var sig = _b64(promise.signedEntryTimestamp, "signedEntryTimestamp");
-  return _rawVerify(_pubFromSpki(k.spki, "Rekor log"), Buffer.from(canonical, "utf8"), sig);
+  return _rawVerify(_pubFromSpki(k.spki, "Rekor log"), _bufferFrom(canonical, "utf8"), sig);
 }
 
 /** @internal The entry rows this build reads, keyed on the entry's OWN kind and apiVersion together.
@@ -684,7 +709,7 @@ function _verifySet(te, rekorKeys, timeMs, canonBody) {
  * would read one shape's field names out of the other and report a mismatch rather than an
  * unsupported entry. Each row states which content arm it may accompany, because an entry describing
  * a DSSE envelope says nothing about a message signature and the two must agree. */
-var _ENTRY_ROWS = Object.freeze(Object.assign(Object.create(null), {
+var _ENTRY_ROWS = _freeze(_assign(_create(null), {
   "dsse@0.0.1": { content: "dsseEnvelope", bind: _bindDsseEntry },
   "hashedrekord@0.0.1": { content: "messageSignature", bind: _bindHashedRekordEntry },
 }));
@@ -723,18 +748,18 @@ function _bindDsseEntry(body, envelope, leafDer) {
   }
   var envSig = _b64(envelope.signatures[0].sig, "dsseEnvelope.signatures[0].sig");
   var bodySig = _b64(spec.signatures[0].signature, "Rekor entry signature");
-  if (!envSig.equals(bodySig)) throw _err("sigstore/entry-mismatch", "the Rekor entry signature does not match the bundle signature");
+  if (!_bufferEquals(envSig, bodySig)) throw _err("sigstore/entry-mismatch", "the Rekor entry signature does not match the bundle signature");
   var payload = _b64(envelope.payload, "dsseEnvelope.payload");
   if (!spec.payloadHash || typeof spec.payloadHash.value !== "string") throw _err("sigstore/bad-tlog-entry", "the Rekor dsse entry is missing its payloadHash");
-  if (spec.payloadHash.value !== _sha256(payload).toString("hex")) {
+  if (spec.payloadHash.value !== _bufToString(_sha256(payload), "hex")) {
     throw _err("sigstore/entry-mismatch", "the Rekor entry payloadHash does not match the bundle payload");
   }
   var vf = spec.signatures[0].verifier;
   if (typeof vf !== "string") throw _err("sigstore/bad-tlog-entry", "the Rekor dsse entry is missing its verifier certificate");
   var vDer;
-  try { vDer = x509.pemDecode(_b64(vf, "Rekor entry verifier").toString("utf8"), "CERTIFICATE"); }
+  try { vDer = x509.pemDecode(_bufToString(_b64(vf, "Rekor entry verifier"), "utf8"), "CERTIFICATE"); }
   catch (e) { throw _err("sigstore/bad-tlog-entry", "the Rekor entry verifier is not a valid certificate", e); }
-  if (!vDer.equals(leafDer)) throw _err("sigstore/entry-mismatch", "the Rekor entry verifier certificate does not match the bundle leaf certificate");
+  if (!_bufferEquals(vDer, leafDer)) throw _err("sigstore/entry-mismatch", "the Rekor entry verifier certificate does not match the bundle leaf certificate");
 }
 
 /** @internal The entry's verifier, bound to the bundle's leaf. The Rekor field is "the public key
@@ -744,11 +769,11 @@ function _bindDsseEntry(body, envelope, leafDer) {
  * about it, and the certificate's own identity is settled by the chain leg rather than here. Neither
  * form is guessed at from the bytes: the armor names which one the entry wrote. */
 function _bindVerifier(content, leafDer) {
-  var text = _b64(content, "Rekor entry verifier").toString("utf8");
+  var text = _bufToString(_b64(content, "Rekor entry verifier"), "utf8");
   var vDer;
   try { vDer = x509.pemDecode(text, "CERTIFICATE"); } catch (_e) { vDer = null; } // allow:swallow-unverified the other armor is tried next and a value carrying neither is refused below
   if (vDer !== null) {
-    if (!vDer.equals(leafDer)) {
+    if (!_bufferEquals(vDer, leafDer)) {
       throw _err("sigstore/entry-mismatch", "the Rekor entry verifier certificate does not match the bundle leaf certificate");
     }
     return;
@@ -757,7 +782,7 @@ function _bindVerifier(content, leafDer) {
   try { spki = x509.pemDecode(text, "PUBLIC KEY"); }
   catch (e) { throw _err("sigstore/bad-tlog-entry", "the Rekor entry verifier is neither a certificate nor a public key", e); }
   var leafSpki = _parseCert(leafDer, "Fulcio leaf certificate").subjectPublicKeyInfo.bytes;
-  if (!spki.equals(Buffer.from(leafSpki))) {
+  if (!_bufferEquals(spki, _bufferFrom(leafSpki))) {
     throw _err("sigstore/entry-mismatch", "the Rekor entry verifier public key does not match the bundle leaf certificate's key");
   }
 }
@@ -769,7 +794,7 @@ function _bindVerifier(content, leafDer) {
  * matched through a replaceable protocol. */
 function _isLowerHex(s) {
   for (var i = 0; i < s.length; i++) {
-    var c = s.charCodeAt(i);
+    var c = _charCodeAt(s, i);
     if (!((c >= 0x30 && c <= 0x39) || (c >= 0x61 && c <= 0x66))) return false;
   }
   return s.length > 0;
@@ -792,7 +817,7 @@ function _bindHashedRekordEntry(body, ms, leafDer) {
   }
   var bodySig = _b64(spec.signature.content, "Rekor entry signature");
   var armSig = _b64(ms.signature, "messageSignature.signature");
-  if (!armSig.equals(bodySig)) {
+  if (!_bufferEquals(armSig, bodySig)) {
     throw _err("sigstore/entry-mismatch", "the Rekor entry signature does not match the bundle signature");
   }
   var pk = spec.signature.publicKey;
@@ -855,10 +880,10 @@ function _verifyRekorEntry(te, rekorKeys, leafDer, contentType, bind) {
   var included;
   try {
     included = merkle.verifyInclusion({
-      leafIndex: BigInt(ip.logIndex),
-      treeSize: BigInt(ip.treeSize),
+      leafIndex: _bigIntOf(ip.logIndex),
+      treeSize: _bigIntOf(ip.treeSize),
       leafHash: merkle.leafHash(canonBytes),
-      proof: ip.hashes.map(function (h, i) { return _b64(h, "inclusionProof.hashes[" + i + "]"); }),
+      proof: _map(ip.hashes, function (h, i) { return _b64(h, "inclusionProof.hashes[" + i + "]"); }),
       rootHash: _b64(ip.rootHash, "inclusionProof.rootHash"),
     });
   } catch (e) {
@@ -874,7 +899,7 @@ function _verifyRekorEntry(te, rekorKeys, leafDer, contentType, bind) {
   var li = _numOf(te.logIndex);
   return {
     integratedTime: t, logIndex: _isFiniteNumber(li) ? li : null,
-    logId: te.logId && te.logId.keyId ? _b64(te.logId.keyId, "logId.keyId").toString("hex") : null,
+    logId: te.logId && te.logId.keyId ? _bufToString(_b64(te.logId.keyId, "logId.keyId"), "hex") : null,
     artifactHash: artifactHash,
   };
 }
@@ -883,7 +908,7 @@ function _verifyRekorEntry(te, rekorKeys, leafDer, contentType, bind) {
 function _dn(cert, which) { return cert[which] && cert[which].dn; }
 
 function _normRoots(fulcioRoots) {
-  return fulcioRoots.map(function (r, i) {
+  return _map(fulcioRoots, function (r, i) {
     var der = _isBuffer(r) ? r : (r && (r.der || r.rawBytes));
     if (!_isBuffer(der)) throw _err("sigstore/bad-input", "fulcioRoots[" + i + "] must be a DER Buffer or { der, validFor }");
     return { cert: _parseCert(der, "Fulcio CA root [" + i + "]"), validFor: (r && r.validFor) || null };
@@ -895,7 +920,7 @@ function _pathToAnchor(leaf, anchor, intBySubject) {
   /** @internal Issuers are collected leaf-first and the path is assembled once, so no element is
    * ever moved to a new index: an indexed setter has nothing to intercept and cannot replace the
    * leaf the preceding signature checks authenticated. */
-  var above = [], cur = leaf, seen = Object.create(null), guardN = 0;
+  var above = [], cur = leaf, seen = _create(null), guardN = 0;
   function assemble() {
     var path = [];
     for (var k = above.length - 1; k >= 0; k--) guard.list.append(path, above[k]);
@@ -927,7 +952,7 @@ var OID_SCT_LIST = oid.byName("signedCertificateTimestampList");
 function _normCtLogs(ctLogs) {
   if (!_isArray(ctLogs)) throw _err("sigstore/bad-input", "ctLogs must be an array of { keyId, spki, validFor? }");
   if (ctLogs.length === 0) throw _err("sigstore/bad-input", "ctLogs is empty; omit the option to skip the certificate-transparency check rather than supplying no logs");
-  return ctLogs.map(function (l, i) {
+  return _map(ctLogs, function (l, i) {
     if (l === null || typeof l !== "object") throw _err("sigstore/bad-input", "ctLogs[" + i + "] must be { keyId, spki, validFor? }");
     if (!_isBuffer(l.keyId)) throw _err("sigstore/bad-input", "ctLogs[" + i + "].keyId must be the log id as a Buffer");
     if (!_isBuffer(l.spki)) throw _err("sigstore/bad-input", "ctLogs[" + i + "].spki must be the log's SubjectPublicKeyInfo DER");
@@ -984,24 +1009,24 @@ function _sctVerifies(entry, sct, spki) {
 
 /** @internal A receipt's own instant, in milliseconds. The parser's `timestampMs` is this same value
  * wherever it is representable, and above 2^53 there is no reachable instant either way. */
-function _sctMs(sct) { return Number(sct.timestamp || 0); }
+function _sctMs(sct) { return _numberOf(sct.timestamp || 0); }
 
 function _ctLogFor(logs, logIdBytes, timeMs) {
-  var want = _isBuffer(logIdBytes) ? logIdBytes : Buffer.from(logIdBytes || []);
+  var want = _isBuffer(logIdBytes) ? logIdBytes : _bufferFrom(logIdBytes || []);
   for (var i = 0; i < logs.length; i++) {
-    if (logs[i].keyId.equals(want) && _inWindow(timeMs, logs[i].validFor)) return logs[i];
+    if (_bufferEquals(logs[i].keyId, want) && _inWindow(timeMs, logs[i].validFor)) return logs[i];
   }
   return null;
 }
 
 async function _verifyChain(leaf, chainDers, fulcioRoots, timeMs) {
   var roots = _normRoots(fulcioRoots);
-  var bundleLinks = chainDers.slice(1).map(function (d, i) { return _parseCert(d, "bundle intermediate [" + i + "]"); });
-  var intBySubject = Object.create(null);
+  var bundleLinks = _map(_arraySlice(chainDers, 1), function (d, i) { return _parseCert(d, "bundle intermediate [" + i + "]"); });
+  var intBySubject = _create(null);
   function addInt(c) { guard.list.append(intBySubject[_dn(c, "subject")] = intBySubject[_dn(c, "subject")] || [], c); }
-  roots.forEach(function (r) { addInt(r.cert); });
-  bundleLinks.forEach(addInt);
-  var candidates = roots.filter(function (r) { return _inWindow(timeMs, r.validFor); });
+  _forEach(roots, function (r) { addInt(r.cert); });
+  _forEach(bundleLinks, addInt);
+  var candidates = _filter(roots, function (r) { return _inWindow(timeMs, r.validFor); });
   var lastErr = _err("sigstore/chain-incomplete", "no caller-supplied Fulcio anchor (within its validity window) issues the chain");
   for (var i = 0; i < candidates.length; i++) {
     var anchor = candidates[i].cert;
@@ -1010,7 +1035,7 @@ async function _verifyChain(leaf, chainDers, fulcioRoots, timeMs) {
     var spki = anchor.subjectPublicKeyInfo;
     try {
       var res = await pathValidate.validate(path, {
-        time: new Date(timeMs),
+        time: new _Date(timeMs),
         historicalMode: true,
         trustAnchors: { name: anchor.subject, publicKey: spki.bytes, algorithm: spki.algorithm.oid, parameters: spki.algorithm.parameters },
         requiredEku: ["codeSigning"],
@@ -1030,14 +1055,14 @@ async function _verifyChain(leaf, chainDers, fulcioRoots, timeMs) {
 
 
 var SAN_OID = oid.byName("subjectAltName");
-var FULCIO_PREFIX = oid.byName("otherName").split(".").slice(0, -1).join(".") + ".";
+var FULCIO_PREFIX = _join(_arraySlice(_split(oid.byName("otherName"), "."), 0, -1), ".") + ".";
 function _identity(leaf) {
-  var out = { san: null, extensions: Object.create(null) };
+  var out = { san: null, extensions: _create(null) };
   try {
-    (leaf.extensions || []).forEach(function (ext) {
+    _forEach(leaf.extensions || [], function (ext) {
       if (ext.oid === SAN_OID) { out.san = _sanValue(ext); return; }
-      if (ext.oid.indexOf(FULCIO_PREFIX) === 0) {
-        out.extensions[ext.name || ext.oid] = _fulcioExtValue(ext, Number(ext.oid.slice(FULCIO_PREFIX.length)));
+      if (_strIndexOf(ext.oid, FULCIO_PREFIX) === 0) {
+        out.extensions[ext.name || ext.oid] = _fulcioExtValue(ext, _numberOf(_strSlice(ext.oid, FULCIO_PREFIX.length)));
       }
     });
   } catch (e) {
@@ -1046,7 +1071,7 @@ function _identity(leaf) {
   }
   return out;
 }
-var GN_TYPE = Object.assign(Object.create(null), { 1: "rfc822Name", 2: "dNSName", 6: "uri" });
+var GN_TYPE = _assign(_create(null), { 1: "rfc822Name", 2: "dNSName", 6: "uri" });
 function _sanValue(ext) {
   var seq = asn1.decode(ext.value);
   var names = [];
@@ -1055,7 +1080,7 @@ function _sanValue(ext) {
     if (n.tagClass !== "context") continue;
     var val = null;
     if (!n.constructed && GN_TYPE[n.tagNumber]) {
-      val = { type: GN_TYPE[n.tagNumber], value: asn1.read.octetStringImplicit(n, n.tagNumber).toString("utf8") };
+      val = { type: GN_TYPE[n.tagNumber], value: _bufToString(asn1.read.octetStringImplicit(n, n.tagNumber), "utf8") };
     } else if (n.constructed && n.tagNumber === 0 && (n.children || []).length >= 2) {
       var inner = (n.children[1].children || [])[0] || n.children[1];
       var v;
@@ -1073,13 +1098,13 @@ function _sanValue(ext) {
 }
 function _fulcioExtValue(ext, leafArc) {
   if (!_isBuffer(ext.value)) throw _err("sigstore/bad-certificate", "Fulcio extension " + ext.oid + " has no value");
-  if (leafArc >= 1 && leafArc <= 6) return ext.value.toString("utf8");
+  if (leafArc >= 1 && leafArc <= 6) return _bufToString(ext.value, "utf8");
   return asn1.read.string(asn1.decode(ext.value));
 }
 
 var IDENTITY_FIELDS = ["san", "issuer", "sourceRepositoryURI"];
-var IDENTITY_KEYS = Object.assign(Object.create(null), { san: 1, issuer: 1, sourceRepositoryURI: 1 });
-var _VERIFY_BUNDLE_OPTS = Object.assign(Object.create(null), { fulcioRoots: 1, rekorKeys: 1, ctLogs: 1, identity: 1, predicateType: 1, time: 1, artifact: 1 });
+var IDENTITY_KEYS = _assign(_create(null), { san: 1, issuer: 1, sourceRepositoryURI: 1 });
+var _VERIFY_BUNDLE_OPTS = _assign(_create(null), { fulcioRoots: 1, rekorKeys: 1, ctLogs: 1, identity: 1, predicateType: 1, time: 1, artifact: 1 });
 
 /** @internal The bytes a message signature covers, taken once. There is no shape here in which a
  * caller hands over a precomputed digest: the arm's own field comment forbids using one as a
@@ -1101,21 +1126,21 @@ function _checkIdentity(id, policy) {
   var ran = { san: false, issuer: false, sourceRepositoryURI: false };
   if (policy === undefined || policy === null) return ran;
   if (typeof policy !== "object" || _isArray(policy)) {
-    throw _err("sigstore/bad-input", "opts.identity must be an object naming the identity fields to pin (" + IDENTITY_FIELDS.join(", ") + ")");
+    throw _err("sigstore/bad-input", "opts.identity must be an object naming the identity fields to pin (" + _join(IDENTITY_FIELDS, ", ") + ")");
   }
   guard.identifier.assertKnownKeys(policy, IDENTITY_KEYS, _err, "sigstore/bad-input", "opts.identity has an unknown key ");
-  var asked = IDENTITY_FIELDS.filter(function (f) { return policy[f] !== undefined; });
+  var asked = _filter(IDENTITY_FIELDS, function (f) { return policy[f] !== undefined; });
   if (!asked.length) {
-    throw _err("sigstore/bad-input", "opts.identity constrains nothing -- name at least one of " + IDENTITY_FIELDS.join(", ") + ", or omit it to state that the signer is not being checked");
+    throw _err("sigstore/bad-input", "opts.identity constrains nothing -- name at least one of " + _join(IDENTITY_FIELDS, ", ") + ", or omit it to state that the signer is not being checked");
   }
-  asked.forEach(function (f) {
+  _forEach(asked, function (f) {
     if (typeof policy[f] !== "string" || policy[f] === "") {
       throw _err("sigstore/bad-input", "opts.identity." + f + " must be a non-empty string -- a value that cannot be compared would leave the signer unchecked under a policy that names it");
     }
     ran[f] = true;
   });
   var sanValue = id.san && id.san.value;
-  if (policy.san && sanValue !== policy.san) throw _err("sigstore/identity-mismatch", "the certificate SAN " + JSON.stringify(sanValue) + " does not match the expected identity");
+  if (policy.san && sanValue !== policy.san) throw _err("sigstore/identity-mismatch", "the certificate SAN " + _jsonStringify(sanValue) + " does not match the expected identity");
   if (policy.issuer && policy.issuer !== id.extensions.issuer && policy.issuer !== id.extensions.issuerLegacy) throw _err("sigstore/identity-mismatch", "the certificate OIDC issuer does not match the expected issuer");
   if (policy.sourceRepositoryURI && id.extensions.sourceRepositoryURI !== policy.sourceRepositoryURI) throw _err("sigstore/identity-mismatch", "the certificate source-repository URI does not match");
   return ran;
@@ -1130,7 +1155,7 @@ function _statement(payload, payloadType, expectedPredicate) {
   if (!st || typeof st !== "object" || st._type !== "https://in-toto.io/Statement/v1") throw _err("sigstore/bad-statement", "the payload is not an in-toto Statement v1");
   if (!_isArray(st.subject) || !st.subject.length) throw _err("sigstore/bad-statement", "the in-toto statement has no subject");
   if (expectedPredicate && st.predicateType !== expectedPredicate) {
-    throw _err("sigstore/predicate-mismatch", "the statement predicateType " + JSON.stringify(st.predicateType) + " does not match the expected " + JSON.stringify(expectedPredicate));
+    throw _err("sigstore/predicate-mismatch", "the statement predicateType " + _jsonStringify(st.predicateType) + " does not match the expected " + _jsonStringify(expectedPredicate));
   }
   return st;
 }
@@ -1305,9 +1330,9 @@ async function verifyBundle(bundle, opts) {
       var candidateDigest = null;
       if (isMsg) {
         candidateDigest = nodeCrypto.createHash(candidate.artifactHash.node).update(artifact).digest();
-        if (!guard.crypto.constantTimeEqual(candidateDigest, Buffer.from(candidate.artifactHash.value, "hex"))) {
+        if (!guard.crypto.constantTimeEqual(candidateDigest, _bufferFrom(candidate.artifactHash.value, "hex"))) {
           throw _err("sigstore/artifact-mismatch", "the artifact does not match the one the transparency-log entry records; its " +
-            candidate.artifactHash.algorithm + " digest is " + candidateDigest.toString("hex") + " and the entry names " + candidate.artifactHash.value);
+            candidate.artifactHash.algorithm + " digest is " + _bufToString(candidateDigest, "hex") + " and the entry names " + candidate.artifactHash.value);
         }
       }
       var candidateTime = haveCallerTime ? callerTime : C.TIME.seconds(candidate.integratedTime);
@@ -1337,7 +1362,7 @@ async function verifyBundle(bundle, opts) {
   if (isMsg) {
     digestAlgorithm = rekor.artifactHash.algorithm;
     var computed = artifactComputed;
-    artifactDigest = computed.toString("hex");
+    artifactDigest = _bufToString(computed, "hex");
     if (msParsed.digest !== null) {
       var againstClaim = msParsed.digestAlg.node === rekor.artifactHash.node ? computed
         : nodeCrypto.createHash(msParsed.digestAlg.node).update(artifact).digest();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.7.29",
+  "version": "0.7.30",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:3c9a8588-ff6f-477c-92fd-33c03ea2c98b",
+  "serialNumber": "urn:uuid:cccf2ff7-2673-4c48-b9bc-d452383b439d",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-09-12T05:32:15.338Z",
+    "timestamp": "2026-09-12T06:10:23.138Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.7.29",
+      "bom-ref": "@blamejs/pki@0.7.30",
       "type": "application",
       "name": "pki",
-      "version": "0.7.29",
+      "version": "0.7.30",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.7.29",
+      "purl": "pkg:npm/%40blamejs/pki@0.7.30",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.7.29",
+      "ref": "@blamejs/pki@0.7.30",
       "dependsOn": []
     }
   ]