@blamejs/pki 0.7.9 → 0.7.11

package/CHANGELOG.md

@@ -4,6 +4,30 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.7.11 — 2026-09-10
+
+A name constraint whose base is a zero-length name is read rather than rejected.
+
+### Changed
+
+- pki.path.validate still refuses a caller-supplied subtree seed whose base is empty, through opts.initialPermittedSubtrees, opts.initialExcludedSubtrees or a trust anchor's nameConstraints. A seed that permits everything is a restriction the caller believes they applied, so that door is unchanged and is separate from decoding a certificate's own extension.
+
+### Fixed
+
+- A zero-length subtree base in a certificate's nameConstraints decodes. RFC 5280 section 4.2.1.6 states the prohibition for subjectAltName, that an extension with a dNSName of "" must not be used, and section 4.2.1.10 places no length floor on a constraint base. A zero-length dNSName in a subjectAltName is still refused, which is where the rule belongs.
+- For dNSName the empty base names the root of the namespace, the same as the bare-dot base already did: section 4.2.1.10 satisfies the constraint by adding zero or more labels to its left-hand side, and every name is that base plus labels. An excluded empty base therefore excludes every dNSName, and a permitted one permits every dNSName. A leaf naming no dNSName is untouched by either.
+- For rfc822Name and uniformResourceIdentifier the base decodes but the comparison reports path/name-constraint-unsupported and refuses. Section 4.2.1.10 gives a mail constraint a mailbox, a host or a leading-period domain, and a URI constraint a fully qualified domain name, so an empty base is none of the shapes either names and is not read as covering everything. The verdict now says the constraint could not be evaluated instead of saying the extension could not be parsed.
+
+## v0.7.10 — 2026-09-10
+
+An OCSP response is no longer signed with a status window that runs backwards.
+
+### Fixed
+
+- pki.ocsp.sign raises ocsp/bad-input for a response entry whose thisUpdate is after its nextUpdate, before anything is signed. RFC 6960 section 4.2.2.1 makes the pair a validity interval corresponding to the {thisUpdate, nextUpdate} interval in CRLs, and pki.crl.sign, pki.x509.sign, pki.attrcert.sign and pki.crmf.build each already refuse their own reversed window. Every entry in a batch is measured, not the first alone, and a nextUpdate that came from the default is held to the rule a supplied one is.
+- An entry whose thisUpdate equals its nextUpdate still signs, as the equivalent CRL does: a zero-length window is not forbidden. A response entry that names no certificate still reports that first. The times are compared as given, so a thisUpdate later than its nextUpdate is refused even where the two fall inside one second and would encode to the same GeneralizedTime, which is how pki.x509.sign, pki.crl.sign and pki.crmf.build read their own.
+- A pre-produced response still signs. RFC 6960 section 2.5 lets a responder sign a response ahead of the window it certifies, where producedAt is when the response was signed and thisUpdate is when the status was known correct, so a producedAt earlier than thisUpdate is conforming and is left alone.
+
 ## v0.7.9 — 2026-09-10
 
 Certificate revocation lists can now be linted against the RFC 5280 profile.

package/lib/ocsp.js

@@ -326,10 +326,33 @@ function _buildSingleResponse(r, opts) {
   if (r.certID != null) certIdP = Promise.resolve(b.raw(guard.bytes.view(r.certID, OcspError, "ocsp/bad-input", "a response entry's certID")));
   else if (r.cert != null && r.issuer != null) certIdP = _buildCertID(_certOf(r.cert, "a response certificate"), _certOf(r.issuer, "a response issuer"), r.hashAlgorithm || "sha1");
   else return Promise.reject(_err("ocsp/bad-input", "each response entry needs { certID } or { cert, issuer }"));
+  /** @internal Every per-entry refusal stays INSIDE this chain. These entries are built through a
+   * map into Promise.all, so a synchronous throw here would abort the map before Promise.all
+   * attached handlers, and an earlier entry's rejection would be orphaned: the caller catches
+   * sign()'s failure and the process still sees an unhandled rejection. */
   return certIdP.then(function (certID) {
+    var thisUpdate = _asDate(r.thisUpdate) || new Date();
+    var nextUpdate = r.nextUpdate === null ? null : (_asDate(r.nextUpdate) || _defaultNextUpdate());
+    /** @internal RFC 6960 sec. 4.2.2.1 makes thisUpdate and nextUpdate a validity interval, and says
+     * it corresponds to the {thisUpdate, nextUpdate} interval in CRLs. An interval whose end
+     * precedes its start states a status window that closed before it opened, and pki.ocsp.verify
+     * reports such a response unknown, so signing one emits what nothing can act on. pki.x509.sign,
+     * pki.crl.sign, pki.attrcert.sign and pki.crmf.build each refuse their own reversed window; this
+     * is that rule in the one place it was missing. The RESOLVED values are compared rather than the
+     * caller's, since a defaulted nextUpdate reaches a relying party the same way a supplied one
+     * does. An equal pair is left alone, as it is for a CRL: a zero-length window is not forbidden.
+     *
+     * The CALLER's instants are compared, at their full precision, which is what the four sibling
+     * verbs do. Two instants inside one second encode to the same whole-second GeneralizedTime, so
+     * comparing the encoded values instead would accept a descending pair and quietly emit the
+     * zero-length window it truncates to. A caller naming a later thisUpdate than nextUpdate has
+     * stated a reversed one whatever the seconds round to, and hears so here. */
+    if (nextUpdate !== null && guard.time.instantOf(thisUpdate) > guard.time.instantOf(nextUpdate)) {
+      throw _err("ocsp/bad-input", "thisUpdate must not be after nextUpdate (RFC 6960 sec. 4.2.2.1)");
+    }
     var statusNode = _certStatusNode(r.status, opts);
-    var srChildren = [certID, statusNode, b.generalizedTime(_asDate(r.thisUpdate) || new Date())];
-    if (r.nextUpdate !== null) srChildren.push(b.explicit(0, b.generalizedTime(_asDate(r.nextUpdate) || _defaultNextUpdate())));
+    var srChildren = [certID, statusNode, b.generalizedTime(thisUpdate)];
+    if (nextUpdate !== null) srChildren.push(b.explicit(0, b.generalizedTime(nextUpdate)));
     if (r.singleExtensions && r.singleExtensions.length) srChildren.push(b.explicit(1, b.sequence(r.singleExtensions)));
     return b.sequence(srChildren);
   });

package/lib/schema-pkix.js

@@ -531,7 +531,13 @@ function generalName(ns, opts) {
     } else {
       if (constructed) throw ctx.E(code, "GeneralName [" + t + "] must be primitive (X.690 sec. 10.2)");
       if (GN_IA5[t]) {
-        if (n.content.length === 0) throw ctx.E(code, "GeneralName [" + t + "] must be a non-empty IA5String");
+        /** @internal RFC 5280 sec. 4.2.1.6 forbids a zero-length IA5String where a GeneralName names
+         * something: "subjectAltName extensions with a dNSName of ' ' MUST NOT be used". Sec.
+         * 4.2.1.10 places no length floor on a subtree BASE, where an empty one names every name of
+         * that form, which is how a technically-constrained sub-CA excludes a whole form. Scoped on
+         * subtreeBase the same way the iPAddress rule below it is, so the prohibition keeps holding
+         * everywhere a GeneralName is a name. */
+        if (!subtreeBase && n.content.length === 0) throw ctx.E(code, "GeneralName [" + t + "] must be a non-empty IA5String");
         guard.name.assertPrintableIa5(n.content, ctx.E, code, "GeneralName [" + t + "]");
         if (decodeValue) value = _bufToString(n.content, "latin1");
       } else if (t === 7) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.7.9",
+  "version": "0.7.11",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:9032cd80-6a2c-49e5-8c6c-c9137a8ead5b",
+  "serialNumber": "urn:uuid:a94d16a8-ad1e-416e-8ea1-35dc679039b0",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-09-10T20:15:24.465Z",
+    "timestamp": "2026-09-10T22:54:50.067Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.7.9",
+      "bom-ref": "@blamejs/pki@0.7.11",
       "type": "application",
       "name": "pki",
-      "version": "0.7.9",
+      "version": "0.7.11",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.7.9",
+      "purl": "pkg:npm/%40blamejs/pki@0.7.11",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.7.9",
+      "ref": "@blamejs/pki@0.7.11",
       "dependsOn": []
     }
   ]