@blamejs/pki 0.7.5 → 0.7.7

package/CHANGELOG.md

@@ -4,6 +4,31 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.7.7 — 2026-09-10
+
+The two GeneralName arms that were taken on their tag alone are now read.
+
+### Changed
+
+- Every verb that walks a name is affected, since they share one reader: certification-path validation, certificate and attribute-certificate parsing, CRL and CMP name handling, certificate linting, and the name-carrying extension decoders. A certificate carrying one of these two arms malformed was accepted before and is refused now, with the typed code that verb already raises for a bad name. A conforming arm is unaffected, and no error code was added or changed.
+
+### Fixed
+
+- GeneralName ediPartyName [5] is read as the EDIPartyName it holds: an optional nameAssigner [0] before a required partyName [1], each wrapping a DirectoryString of at least one character, in that order and with nothing else alongside. It was previously accepted as any non-empty constructed value, so a [5] over a NULL, over an INTEGER, or carrying nameAssigner without partyName all decoded as names while encoding none. GeneralName is defined in the RFC 5280 Appendix A.2 implicitly tagged module, so the [5] tag replaces the EDIPartyName SEQUENCE tag and its children are the two arms directly.
+- GeneralName x400Address [3] must open with the BuiltInStandardAttributes SEQUENCE that begins an ORAddress, so an arm carrying that tag over some other value is refused. What the components hold is an X.400 structure this does not read, and every one of them is optional, so an address whose components are all empty is conforming and is not refused.
+
+## v0.7.6 — 2026-09-10
+
+A Sigstore bundle is held to the shape its specification states, in signature count and in entry count.
+
+### Changed
+
+- A bundle offering more than 32 transparency-log entries is refused with sigstore/bad-bundle, naming the count it offered. Each entry a bundle offers can cost a certification-path validation, since an entry is tried until one passes every check that depends on which entry it is, and the validation instant comes from the entry itself unless the caller pins opts.time. Nothing bounded the count: the 1 MiB bundle budget leaves room for roughly 155 entries, and every bundle in the Sigstore conformance suite carries exactly one. The ceiling is a local resource bound rather than a rule the specification states, and it is checked before any entry is read. It is available as pki.C.LIMITS.TLOG_MAX_COUNT.
+
+### Fixed
+
+- A DSSE envelope carrying more than one signature is refused with sigstore/bad-dsse, naming the count it carried. The Sigstore bundle specification states the rule on the producer, that an envelope in a bundle has exactly one signature, and again on the verifier, that a client rejects an envelope whose signature count is not one. Only the first signature was ever read, so an envelope with a second was accepted and returned a verdict that said nothing about it. An envelope with exactly one is unaffected, and an empty signature list keeps the refusal it already had.
+
 ## v0.7.5 — 2026-09-10
 
 Certificate linting now covers the ML-DSA and SLH-DSA certificate profiles.

package/lib/constants.js

@@ -128,6 +128,7 @@ var LIMITS = Object.assign(Object.create(null), {
   CBOR_MAX_ITEMS: 1000000,
   SCT_MAX_BYTES: BYTES.kib(64) + 1,
   SCT_MAX_COUNT: 256,
+  TLOG_MAX_COUNT: 32,
   CMS_MAX_KARI_ENCRYPTED_KEYS: 64,
   CMP_KEM_MAX_KEY_BYTES: 1024,
   CMP_KEM_MIN_KEY_BYTES: 20,

package/lib/crmf-sign.js

@@ -825,24 +825,16 @@ function _namesSomebody(node) {
   if (!_isUniversal(node, 16) || !node.children || node.children.length === 0) return false;
   try { schema.walk(pkix.generalNames(NS, { code: "crmf/bad-popo" }), node, NS); }
   catch (_e) { return false; } // allow:swallow-unverified a list the shared reader refuses names nobody, which the caller's refusal states
-  /** @internal The shared reader takes ediPartyName [5] as any non-empty constructed value, so a [5]
-   * holding a NULL passes it while encoding no name at all. EDIPartyName is SEQUENCE { nameAssigner
-   * [0] DirectoryString OPTIONAL, partyName [1] DirectoryString } (RFC 5280 sec. 4.2.1.6), so the
-   * arms it holds are context-tagged and a universal value is not one of them. x400Address [3] is an
-   * ORAddress, which this does not read, and is left to the shared reader: the derivation hashes
-   * these bytes rather than interpreting them, so an arm it cannot check is still an arm both sides
-   * hash alike. */
-  /** @internal Walked arm by arm, because the reader answers for most of them and not for all. It
-   * requires the IA5 arms [1] [2] [6] to carry characters, [7] to be an address of a real width and
-   * [8] to be an OBJECT IDENTIFIER, and it walks [0] and [4] into their own shapes. What it does not
-   * do is refuse the two empty forms below, and x400Address [3] it takes on its tag alone, which is
-   * left as it is: the derivation hashes these bytes rather than reading them, so an arm neither
-   * side reads is still an arm both sides hash alike. */
+  /** @internal The shared reader answers for the SHAPE of every arm, including ediPartyName [5] and
+   * the ORAddress opening of x400Address [3]. What remains here is the separate question this
+   * derivation asks, which is whether the arm names SOMEBODY rather than whether it is well formed:
+   * a Name with no RDNs and an ORAddress whose components are all empty are both conforming and
+   * neither identifies a subject. Splitting it this way keeps a naming-strength rule out of a
+   * structural reader every other consumer shares. */
   for (var i = 0; i < node.children.length; i++) {
     var arm = node.children[i];
     if (arm.tagNumber === 3 && !_isOrAddress(arm)) return false;
     if (arm.tagNumber === 4 && !_isNonEmptyName(arm)) return false;
-    if (arm.tagNumber === 5 && !_isEdiPartyName(arm)) return false;
   }
   return true;
 }
@@ -874,32 +866,6 @@ function _isNonEmptyName(node) {
   return schema.isUniversal(dn, 16) && !!dn.children && dn.children.length > 0;
 }
 
-/** @internal The universal tags a DirectoryString is written under (RFC 5280 sec. 4.1.2.4):
- * UTF8String, PrintableString, TeletexString, UniversalString and BMPString. */
-var DIRECTORY_STRING_TAGS = [12, 19, 20, 28, 30];
-
-/** @internal Whether a [5] arm holds an EDIPartyName: the optional nameAssigner [0] before the
- * required partyName [1], each carrying a DirectoryString. DirectoryString is a CHOICE, so its tag
- * is EXPLICIT however the module tags: the arm is constructed and wraps the string itself, and the
- * string has to be one, since a [1] wrapping a NULL is tagged like a name and holds none. */
-function _isEdiPartyName(node) {
-  var kids = node.children;
-  if (!kids || kids.length < 1 || kids.length > 2) return false;
-  for (var i = 0; i < kids.length; i++) {
-    var arm = kids[i];
-    if (!schema.isContextInRange(arm, 0, 1) || !arm.children || arm.children.length !== 1) return false;
-    if (!schema.isUniversalOneOf(arm.children[0], DIRECTORY_STRING_TAGS)) return false;
-    /** @internal Read as the string it is tagged as, not counted as one. DirectoryString is
-     * SIZE (1..MAX), so an empty one names nobody, and a string whose bytes are not the encoding its
-     * tag claims is not a name either. The codec's own reader answers both. */
-    var text;
-    try { text = asn1.read.string(arm.children[0]); }
-    catch (_e) { return false; } // allow:swallow-unverified a string the codec cannot read names nobody, which the caller's refusal states
-    if (text.length === 0) return false;
-  }
-  if (kids.length === 2) return kids[0].tagNumber === 0 && kids[1].tagNumber === 1;
-  return kids[0].tagNumber === 1;
-}
 
 function _nameOrAlternative(parsed, nameField, altExtension) {
   var name = parsed[nameField];

package/lib/schema-pkix.js

@@ -460,6 +460,10 @@ var CRL_REASON_NAMES = constants.NAMES.CRL_REASON;
 
 var GN_CONSTRUCTED = _assign(_create(null), { 0: 1, 3: 1, 4: 1, 5: 1 });
 var GN_IA5 = _assign(_create(null), { 1: 1, 2: 1, 6: 1 });
+/** @internal DirectoryString ::= CHOICE { teletexString, printableString, universalString,
+ * utf8String, bmpString } (RFC 5280 sec. 4.1.2.4). */
+var DIRECTORY_STRING_TAGS = [asn1.TAGS.UTF8_STRING, asn1.TAGS.PRINTABLE_STRING, asn1.TAGS.TELETEX_STRING,
+  asn1.TAGS.UNIVERSAL_STRING, asn1.TAGS.BMP_STRING];
 function generalName(ns, opts) {
   opts = opts || {};
   var code = opts.code || (ns.prefix + "/bad-general-name");
@@ -489,6 +493,40 @@ function generalName(ns, opts) {
         if (n.children.length !== 1) throw ctx.E(code, "GeneralName directoryName [4] must wrap exactly one Name");
         var dnMatch = schema.walk(NAME, n.children[0], ctx);
         if (decodeValue) value = dnMatch.result;
+      } else if (t === 3) {
+        /** @internal ORAddress opens with the BuiltInStandardAttributes SEQUENCE (X.411), so an arm
+         * carrying its tag over some other value is not an address. What the components hold is an
+         * X.400 structure this does not read, and every one of them is optional, so an address whose
+         * components are all empty is still a conforming address and is not refused here. */
+        if (!schema.isUniversal(n.children[0], asn1.TAGS.SEQUENCE)) {
+          throw ctx.E(code, "GeneralName x400Address [3] must be an ORAddress opening with the BuiltInStandardAttributes SEQUENCE (X.411)");
+        }
+      } else if (t === 5) {
+        /** @internal EDIPartyName ::= SEQUENCE { nameAssigner [0] DirectoryString OPTIONAL,
+         * partyName [1] DirectoryString } (RFC 5280 sec. 4.2.1.6). partyName is not optional, the
+         * two arms are ordered, and a DirectoryString is SIZE (1..MAX), so an empty one is not one. */
+        var ediKids = n.children;
+        if (ediKids.length > 2) throw ctx.E(code, "GeneralName ediPartyName [5] holds at most nameAssigner [0] and partyName [1] (RFC 5280 sec. 4.2.1.6)");
+        for (var ei = 0; ei < ediKids.length; ei++) {
+          var ediArm = ediKids[ei];
+          if (!schema.isContextInRange(ediArm, 0, 1) || !ediArm.children || ediArm.children.length !== 1) {
+            throw ctx.E(code, "GeneralName ediPartyName [5] arms must be [0] or [1] wrapping exactly one DirectoryString");
+          }
+          if (!schema.isUniversalOneOf(ediArm.children[0], DIRECTORY_STRING_TAGS)) {
+            throw ctx.E(code, "GeneralName ediPartyName [5] arm must hold a DirectoryString");
+          }
+          var ediText;
+          try { ediText = asn1.read.string(ediArm.children[0]); }
+          catch (e) { throw ctx.E(code, "GeneralName ediPartyName [5] arm is not the string its tag claims", e); }
+          if (ediText.length === 0) throw ctx.E(code, "GeneralName ediPartyName [5] DirectoryString must be SIZE (1..MAX)");
+        }
+        if (ediKids.length === 2) {
+          if (ediKids[0].tagNumber !== 0 || ediKids[1].tagNumber !== 1) {
+            throw ctx.E(code, "GeneralName ediPartyName [5] must order nameAssigner [0] before partyName [1]");
+          }
+        } else if (ediKids[0].tagNumber !== 1) {
+          throw ctx.E(code, "GeneralName ediPartyName [5] requires partyName [1]; nameAssigner [0] alone is not a name");
+        }
       }
     } else {
       if (constructed) throw ctx.E(code, "GeneralName [" + t + "] must be primitive (X.690 sec. 10.2)");

package/lib/sigstore.js

@@ -290,6 +290,13 @@ function parseBundle(input) {
       !d.signatures[0] || typeof d.signatures[0] !== "object" || typeof d.signatures[0].sig !== "string") {
     throw _err("sigstore/bad-dsse", "the DSSE envelope is missing a required field (payload / payloadType / signatures[].sig)");
   }
+  /** @internal The bundle specification states this on the producer and again on the verifier: an
+   * envelope in a bundle carries exactly one signature, and a verifier rejects one whose count is
+   * not one. Only `signatures[0]` is ever read, so admitting a second would return a verdict that
+   * says nothing about content the envelope carries. */
+  if (d.signatures.length !== 1) {
+    throw _err("sigstore/bad-dsse", "a bundle's DSSE envelope carries exactly one signature; this one carries " + d.signatures.length);
+  }
   return obj;
 }
 
@@ -1263,6 +1270,15 @@ async function verifyBundle(bundle, opts) {
 
   var tlogs = _isArray(vm.tlogEntries) ? vm.tlogEntries : [];
   if (!tlogs.length) throw _err("sigstore/bad-bundle", "a keyless bundle requires at least one transparency-log entry");
+  /** @internal An entry is tried until one passes every check that depends on which entry it is,
+   * and those checks include a certification-path validation whose instant comes from the entry
+   * itself unless the caller pins one. The count is therefore a work multiplier, and the byte
+   * budget alone leaves room for far more entries than any real bundle carries. This is a local
+   * resource bound rather than a rule the bundle specification states. */
+  if (tlogs.length > C.LIMITS.TLOG_MAX_COUNT) {
+    throw _err("sigstore/bad-bundle", "a bundle offers at most " + C.LIMITS.TLOG_MAX_COUNT
+      + " transparency-log entries; this one offers " + tlogs.length);
+  }
   /** @internal Selecting an entry means finding one that passes EVERY check deciding WHICH entry it
    * is: that it binds to this signature and certificate, that it records this artifact, and that the
    * certificate chain and the embedded timestamps hold at the instant it attests. Any of those

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.7.5",
+  "version": "0.7.7",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:b846e4fa-afc9-4ee9-9405-9ab995704bfd",
+  "serialNumber": "urn:uuid:210f0706-3b87-4d45-8f03-f61f7b8bfc45",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-09-10T12:11:13.518Z",
+    "timestamp": "2026-09-10T13:10:12.331Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.7.5",
+      "bom-ref": "@blamejs/pki@0.7.7",
       "type": "application",
       "name": "pki",
-      "version": "0.7.5",
+      "version": "0.7.7",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.7.5",
+      "purl": "pkg:npm/%40blamejs/pki@0.7.7",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.7.5",
+      "ref": "@blamejs/pki@0.7.7",
       "dependsOn": []
     }
   ]