@blamejs/pki 0.7.5 → 0.7.6

package/CHANGELOG.md

@@ -4,6 +4,18 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.7.6 — 2026-09-10
+
+A Sigstore bundle is held to the shape its specification states, in signature count and in entry count.
+
+### Changed
+
+- A bundle offering more than 32 transparency-log entries is refused with sigstore/bad-bundle, naming the count it offered. Each entry a bundle offers can cost a certification-path validation, since an entry is tried until one passes every check that depends on which entry it is, and the validation instant comes from the entry itself unless the caller pins opts.time. Nothing bounded the count: the 1 MiB bundle budget leaves room for roughly 155 entries, and every bundle in the Sigstore conformance suite carries exactly one. The ceiling is a local resource bound rather than a rule the specification states, and it is checked before any entry is read. It is available as pki.C.LIMITS.TLOG_MAX_COUNT.
+
+### Fixed
+
+- A DSSE envelope carrying more than one signature is refused with sigstore/bad-dsse, naming the count it carried. The Sigstore bundle specification states the rule on the producer, that an envelope in a bundle has exactly one signature, and again on the verifier, that a client rejects an envelope whose signature count is not one. Only the first signature was ever read, so an envelope with a second was accepted and returned a verdict that said nothing about it. An envelope with exactly one is unaffected, and an empty signature list keeps the refusal it already had.
+
 ## v0.7.5 — 2026-09-10
 
 Certificate linting now covers the ML-DSA and SLH-DSA certificate profiles.

package/lib/constants.js

@@ -128,6 +128,7 @@ var LIMITS = Object.assign(Object.create(null), {
   CBOR_MAX_ITEMS: 1000000,
   SCT_MAX_BYTES: BYTES.kib(64) + 1,
   SCT_MAX_COUNT: 256,
+  TLOG_MAX_COUNT: 32,
   CMS_MAX_KARI_ENCRYPTED_KEYS: 64,
   CMP_KEM_MAX_KEY_BYTES: 1024,
   CMP_KEM_MIN_KEY_BYTES: 20,

package/lib/sigstore.js

@@ -290,6 +290,13 @@ function parseBundle(input) {
       !d.signatures[0] || typeof d.signatures[0] !== "object" || typeof d.signatures[0].sig !== "string") {
     throw _err("sigstore/bad-dsse", "the DSSE envelope is missing a required field (payload / payloadType / signatures[].sig)");
   }
+  /** @internal The bundle specification states this on the producer and again on the verifier: an
+   * envelope in a bundle carries exactly one signature, and a verifier rejects one whose count is
+   * not one. Only `signatures[0]` is ever read, so admitting a second would return a verdict that
+   * says nothing about content the envelope carries. */
+  if (d.signatures.length !== 1) {
+    throw _err("sigstore/bad-dsse", "a bundle's DSSE envelope carries exactly one signature; this one carries " + d.signatures.length);
+  }
   return obj;
 }
 
@@ -1263,6 +1270,15 @@ async function verifyBundle(bundle, opts) {
 
   var tlogs = _isArray(vm.tlogEntries) ? vm.tlogEntries : [];
   if (!tlogs.length) throw _err("sigstore/bad-bundle", "a keyless bundle requires at least one transparency-log entry");
+  /** @internal An entry is tried until one passes every check that depends on which entry it is,
+   * and those checks include a certification-path validation whose instant comes from the entry
+   * itself unless the caller pins one. The count is therefore a work multiplier, and the byte
+   * budget alone leaves room for far more entries than any real bundle carries. This is a local
+   * resource bound rather than a rule the bundle specification states. */
+  if (tlogs.length > C.LIMITS.TLOG_MAX_COUNT) {
+    throw _err("sigstore/bad-bundle", "a bundle offers at most " + C.LIMITS.TLOG_MAX_COUNT
+      + " transparency-log entries; this one offers " + tlogs.length);
+  }
   /** @internal Selecting an entry means finding one that passes EVERY check deciding WHICH entry it
    * is: that it binds to this signature and certificate, that it records this artifact, and that the
    * certificate chain and the embedded timestamps hold at the instant it attests. Any of those

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.7.5",
+  "version": "0.7.6",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:b846e4fa-afc9-4ee9-9405-9ab995704bfd",
+  "serialNumber": "urn:uuid:8551b89b-6716-4eab-914a-0a3d1aafe57d",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-09-10T12:11:13.518Z",
+    "timestamp": "2026-09-10T12:38:33.413Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.7.5",
+      "bom-ref": "@blamejs/pki@0.7.6",
       "type": "application",
       "name": "pki",
-      "version": "0.7.5",
+      "version": "0.7.6",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.7.5",
+      "purl": "pkg:npm/%40blamejs/pki@0.7.6",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.7.5",
+      "ref": "@blamejs/pki@0.7.6",
       "dependsOn": []
     }
   ]