@blamejs/pki 0.7.7 → 0.7.8

package/CHANGELOG.md

@@ -4,6 +4,16 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.7.8 — 2026-09-10
+
+A pre-encoded CRL extension whose value does not decode is refused instead of signed.
+
+### Fixed
+
+- A pre-encoded extension supplied to pki.crl.sign is put through the extension decoder registered for its identifier, and a value that does not decode is refused with the decoder's own typed code, the same one pki.x509.sign raises for the same bytes. An issuerAltName whose value is a NULL now raises crl/bad-extension-value and a keyUsage whose value is a NULL raises crl/bad-key-usage, where both were previously signed. Revoked-entry extensions take the same check.
+- The check runs after the per-extension profile rules this verb already applied, so a CRL whose only fault is one malformed extension keeps the code it has always raised: a pre-encoded cRLNumber that is not an INTEGER stays crl/bad-crl-number, and the criticality, delta-ordering and issuingDistributionPoint rules are unchanged. No CRL that was accepted before is refused for a different reason; the extensions newly refused are ones nothing was reading, and an extension with no registered decoder is unaffected.
+- Where a CRL carries more than one fault, the reported code can differ from earlier releases. The rules that compare extensions to each other, such as freshestCRL not appearing in a delta CRL and a delta's cRLNumber exceeding its baseCRLNumber, run once every extension has been read, so a malformed value found first is now reported first. Such a CRL was refused before and is refused now; only which of its faults is named has changed. A caller matching on a specific code for a CRL with several faults should re-check the code it expects.
+
 ## v0.7.7 — 2026-09-10
 
 The two GeneralName arms that were taken on their tag alone are now read.

package/lib/crl-sign.js

@@ -44,6 +44,9 @@ function _err(code, message, cause) { return new CrlError(code, message, cause);
 function _signE(kind, message, cause) { return new CrlError("crl/" + kind, message, cause); }
 function O(n) { return oid.byName(n); }
 
+/** @internal The builder is handed no decoder map: this module does not use the builder's
+ * extension-building path, it walks the pre-encoded array itself below and validates each value
+ * against this map there. */
 var _b = pkiBuild.makeBuilder({ ErrorClass: CrlError, prefix: "crl", O: O, NS: NS, NAME_SCHEMA: NAME_SCHEMA, SPKI_SCHEMA: SPKI_SCHEMA, EXT_DECODERS: {} });
 var _encodeName = _b.encodeName, _isEmptyName = _b.isEmptyName, _reqDer = _b.reqDer,
   _assertValidSpki = _b.assertValidSpki, _assertValidExtension = _b.assertValidExtension,
@@ -52,6 +55,23 @@ var _encodeName = _b.encodeName, _isEmptyName = _b.isEmptyName, _reqDer = _b.req
   _certLikeFromSpki = _b.certLikeFromSpki, _assertSignatureVerifies = _b.assertSignatureVerifies;
 var EXT_DECODERS = pkix.certExtensionDecoders(NS).byOid;
 
+/** @internal A pre-encoded extension is admitted on the shape of its Extension SEQUENCE, which says
+ * nothing about whether extnValue decodes as the structure its extnID names. Where a decoder is
+ * registered for that OID, the value is put through it, so a value that cannot be read is refused
+ * here rather than signed and left for a relying party to find. The decoder's own typed code is
+ * kept, since it names the field that failed. Called AFTER this module's own profile checks, so an
+ * extension it already answers for keeps the code it has always raised and this only reaches the
+ * ones nothing was checking. */
+function _assertExtensionValueDecodes(node, extnId, what) {
+  var dec = EXT_DECODERS[extnId];
+  if (!dec) return;
+  try { dec(asn1.read.octetString(node.children[node.children.length - 1])); }
+  catch (err) {
+    if (err instanceof CrlError) throw err;
+    throw _err("crl/bad-input", "pre-encoded " + what + " " + (oid.name(extnId) || extnId) + " value is malformed", err);
+  }
+}
+
 var OID_SKI = O("subjectKeyIdentifier");
 
 var CRL_REASON = constants.NAMES.CRL_REASON;
@@ -221,6 +241,7 @@ function _buildCrlExtensions(spec, ctx) {
           if (extnId === O("issuingDistributionPoint")) _validatePreEncodedIdp(inner);
         }
       }
+      _assertExtensionValueDecodes(node, extnId, "extension");
       if (extnId === O("deltaCRLIndicator")) isDelta = true;
       out.push(b.raw(der));
     });
@@ -307,6 +328,7 @@ function _buildRevoked(entryList, isDelta) {
             try { asn1.read.time(einner); } catch (e) { throw _err("crl/bad-input", "pre-encoded invalidityDate is not a well-formed GeneralizedTime (RFC 5280 sec. 5.3.2)", e); }
           }
         }
+        _assertExtensionValueDecodes(xnode, extnId, "entry extension");
         entryExts.push(b.raw(der));
       });
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.7.7",
+  "version": "0.7.8",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:210f0706-3b87-4d45-8f03-f61f7b8bfc45",
+  "serialNumber": "urn:uuid:eb6258f5-7cf4-4371-80b7-ed98047003ac",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-09-10T13:10:12.331Z",
+    "timestamp": "2026-09-10T13:51:21.922Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.7.7",
+      "bom-ref": "@blamejs/pki@0.7.8",
       "type": "application",
       "name": "pki",
-      "version": "0.7.7",
+      "version": "0.7.8",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.7.7",
+      "purl": "pkg:npm/%40blamejs/pki@0.7.8",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.7.7",
+      "ref": "@blamejs/pki@0.7.8",
       "dependsOn": []
     }
   ]