@blamejs/pki 0.8.18 → 0.8.20

package/CHANGELOG.md

@@ -4,6 +4,46 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.8.20 — 2026-09-24
+
+An extended validation code signing certificate is held to the subject its own section requires.
+
+### Added
+
+- The subject fields both arms share (section 7.1.4.2.2): a `commonName` is required, a `domainComponent` is prohibited, and a subject attribute carrying only the metadata characters the clause names, a full stop, a hyphen and a space, is reported. An empty value states the same absence and is read the same way.
+- The subject fields a code signing certificate must carry (sections 7.1.4.2.3 and 7.1.4.2.4): an `organizationName`, a `countryName` that is a two-letter code, and at least one of `localityName` and `stateOrProvinceName`, since each of those two is required exactly when the other is absent. Section 7.1.4.2.4 carries the address fields onto an extended validation certificate, so both arms answer for them.
+- The subject fields an extended validation certificate adds (section 7.1.4.2.4): a `businessCategory` that is one of the four strings the clause names, a `jurisdictionCountryName`, and a `serialNumber`. The clause also bounds the jurisdiction fields against the level the incorporating or registration agency operates at, and requires the state or province at the locality level only where the state or province regulates registration there. A certificate carries neither fact, and a country with a locality and no state is conformant for such an agency, so no row grades the relationship and a valid certificate is not failed for it.
+- The three reserved policy identifiers are read apart rather than together, so `2.23.140.1.3` selects the extended validation arm and `2.23.140.1.4.1` the ordinary one. The extension rules of section 7.1.2.3 ask the same question of both, and the subject rules do not.
+
+### Changed
+
+- A subject attribute is read through one reader shared by every rule that asks for one, flattened across the relative distinguished names, because a distinguished name says the same thing whether it carries one multi-valued element or several single-valued ones.
+
+### Fixed
+
+- Which rules a certificate answers for no longer depends on the order its policies sit in. A certificate asserting two reserved identifiers claims both, and the profile read only the first, so one asserting the ordinary code signing identifier ahead of the extended validation one escaped every extended validation rule while the same certificate with those two reversed did not. Section 7.1.6.4 reports more than one identifier, but only for a certificate issued on or after 15 September 2026, so nothing else caught it. A certificate claiming both kinds is now held to both, and to the tighter of the two validity ceilings.
+
+## v0.8.19 — 2026-09-24
+
+A code signing certificate is linted against the kind it declares itself to be.
+
+### Added
+
+- `pki.lint.certificate(der, { profile: "cabf-cs" })` runs the Code Signing BR v3.11.0 subscriber profile. The rows reach a certificate unprompted too, because one asserting a reserved identifier has declared itself to be one. Detection reads the decoded extension, so a certificate whose certificatePolicies does not decode declares nothing and is reported for the encoding instead. A certificate issued to a subordinate CA carries a reserved identifier as well under section 7.1.6.3, so it is not read as a subscriber; naming the profile in the call still lints it as one.
+- certificatePolicies (a): the extension is required and should not be critical, and an `id-qt-cps` qualifier must be a HTTP URL. Section 7.1.6.4 requires exactly one reserved identifier for a certificate issued on or after 15 September 2026, gated to the issuance date the certificate states.
+- cRLDistributionPoints (b): the extension is required, must not be critical, and must carry a HTTP URL for the CRL service.
+- authorityInformationAccess (c): the extension is required, must not be critical, must carry an `id-ad-caIssuers` accessMethod, and each location the clause names must be a HTTP URL. Unlike the S/MIME profile, one rule covers both accessMethods, because this clause states one.
+- basicConstraints (d) must not assert `cA`. authorityKeyIdentifier (g) is required and must not be critical.
+- keyUsage (e): the extension is required, must be critical, and must assert `digitalSignature`. `keyCertSign` and `cRLSign` are reported as errors and every other bit as a warning, because the clause states the two lists at different strengths in consecutive sentences.
+- extKeyUsage (f): a code signing certificate must carry `id-kp-codeSigning` and a timestamp certificate `id-kp-timeStamping`, and a timestamp certificate's extKeyUsage must be marked critical, which is the one place this profile requires a critical extKeyUsage. `anyExtendedKeyUsage` and `id-kp-serverAuth` are forbidden. Any other purpose is reported as a warning, leaving the three the clause names as permitted: Lifetime Signing, `id-kp-emailProtection` and Document Signing. Document Signing is read under both identifiers, the `1.3.6.1.4.1.311.10.3.12` Microsoft assigns it and the `1.3.6.1.4.1.311.3.10.3.12` the clause prints, so a certificate carrying either is passed over.
+- The section 6.3.2 ceilings: 39 months for a code signing certificate issued before 1 March 2026, 460 days for one issued on or after it, and 135 months for a timestamp certificate. A ceiling stated in months is measured in months, since how many days 39 months hold depends on which 39.
+- The section 6.1.5.2 floors: an RSA modulus of at least 3072 bits, one of NIST P-256, P-384 and P-521, or a DSA key whose parameters are a length of 2048 bits with a modulus length of 224 or 256. Each family the section names is read on its own terms, and a family it names none of is what the row reports.
+
+### Changed
+
+- The three reserved code signing policy identifiers of section 7.1.6.1 resolve through `pki.oid`, named for the kind each one declares, along with the Microsoft extended key purposes the section 7.1.2.3 (f) clause names as permitted.
+- Severities in this profile are graded against its own clauses, so a certificate can draw an error here and a warning under `cabf-smime` for the same shape: this document requires a non-critical cRLDistributionPoints, a present authorityInformationAccess and a critical keyUsage where the S/MIME one recommends them.
+
 ## v0.8.18 — 2026-09-24
 
 An S/MIME certificate is linted against the generation it declares itself to be.

package/README.md

@@ -290,7 +290,7 @@ comment blocks, is at [pkijs.com](https://pkijs.com).
 | `pki.sigstore` | Offline verifier for a Sigstore bundle, the artifact `npm publish --provenance` produces and the registry serves. `verifyBundle` composes five fail-closed legs against caller-pinned trust (Fulcio CA roots and Rekor log keys, never trusted from the bundle): the DSSE signature over its PAE preimage under the Fulcio leaf key, the ephemeral Fulcio certificate chain validated as of the Rekor log time, the RFC 9162 inclusion proof folded to a Rekor-signed tree root, the log entry bound to this exact signature, and the in-toto SLSA subject digest the caller confirms against the published artifact. It reuses the X.509 parser, the RFC 5280 path validator, and the Merkle verifier; the net-new codecs are the DSSE PAE byte-builder and a fail-closed JSON reader. `verified: true` says the artifact was signed and logged, not that a party you trust signed it — Fulcio issues to anyone who completes an OIDC flow, so who signed is decided only by `opts.identity`, and `identityChecked` reports which of its fields were compared. An identity policy naming no field, or a field name that is not one of the three, is refused rather than satisfied — either would accept every signer while reading as a policy in force. A sixth leg is opt-in: pinning the certificate-transparency logs in `opts.ctLogs` checks the receipt Fulcio embeds in the certificate it issues (RFC 6962 §3.2), verified over the certificate as it stood before the receipt was added and under the key of the log that issued it, so the verdict says the signing certificate was public when it was issued rather than handed out quietly. At least one receipt must verify against a pinned log, the verdict reports `sctChecked` and `validScts`, and an empty log set is refused rather than read as a policy that checks nothing. Both content arms are read: a DSSE-wrapped in-toto attestation, and a message signature over an artifact's own bytes, which `cosign sign-blob` produces. For that arm `opts.artifact` supplies the bytes, and they are held to the hash the Rekor `hashedrekord` entry records before the signature is checked over them; the `messageDigest` the bundle carries is covered by no signature, so it is compared against the computed digest and never used in its place. `contentType` names the arm and the verdict has one shape for both — `pae`, `parseBundle`, `verifyBundle` |
 | `pki.inspect` | Human-readable inspection, the pure-JS equivalent of `openssl x509/crl/req/cms -text`. `certificate(pem \| der \| parsed)` renders an OpenSSL-style report: version, serial, signature algorithm, issuer and subject distinguished names, validity, public-key details (curve or modulus size plus the raw point or modulus), every decoded extension with its critical flag, and the signature. `crl`, `csr`, and `cms` render the other formats the same way — a CRL like `openssl crl -text`, a CSR like `openssl req -text`, and a CMS message like `openssl cms -cmsout -print`, with a stable summary for a non-SignedData ContentInfo — and `any(input)` detects the format and routes to the right report. Built over the strict parsers and the two-way OID registry with one set of field renderers, it names extension and algorithm OIDs an OpenSSL build shows only as raw bytes. No OpenSSL dependency, and the format is stable and OpenSSL-familiar rather than pinned to one OpenSSL version. A certificate policy's user notice renders as text, both its explicit text and a notice reference with the notice numbers that identify it, rather than hex, and a malformed part falls back to a hex dump rather than throwing — `certificate`, `crl`, `csr`, `cms`, `any` |
 | `pki.webauthn` | WebAuthn and passkey verification, both halves: offline trust evaluation of a W3C WebAuthn (Level 3) registration, and signature verification of the assertion every login returns. `parseAttestationObject(bytes)` decodes the CBOR attestation object, authenticatorData, and COSE credential key over the strict `pki.cbor` codec; `parseAuthenticatorData(bytes)` reads the bare form an assertion carries through the same parser; `parseClientData(bytes, opts)` decodes the `clientDataJSON` no signature check looks inside, through the shared JSON guard since these are attacker-chosen bytes, returning the challenge decoded so a caller compares bytes rather than spellings, and checking the ceremony type, challenge, and origin when the relying party supplies what it issued. `verifyAssertion(input)` verifies an assertion signature over `authenticatorData \|\| SHA-256(clientDataJSON)` — raw bytes, no COSE_Sign1, an ES256 signature in ASN.1 DER — and applies the §7.2 step 21 counter rule when a stored `previousSignCount` is given, so a counter that fails to advance is refused as a cloned authenticator. `verify(attestationObject, clientDataHash, opts)` checks the attestation-statement signature and each format's structural bindings for packed, tpm, android-key, apple, fido-u2f, and none: the x5c leaf key, the apple nonce, the tpm `certInfo` Name and `extraData` over the `pubArea`, the android `KeyDescription`, and the fido-u2f `verificationData`. It binds the credential public key to each attestation, through the signed authenticatorData for packed and fido-u2f or a cert or `pubArea`-key equality check for android-key, apple, and tpm, and enforces each leaf's certificate requirements. The credential-key check covers the full WebAuthn COSE algorithm set — ES256/384/512, RS256/384/512, PS256/384/512, EdDSA (Ed25519), and the RFC 9864 fully-specified identifiers ESP256/384/512, Ed25519, and Ed448 — validating the public-key point on its curve, rejecting the compressed EC point form, and enforcing a minimally encoded DER ECDSA signature. The verdict field is `attestationVerified`, and `signatureVerified` for an assertion, rather than a bare `verified`, because a sound statement is a different claim from an acceptable ceremony: an attestation naming another origin's RP ID with user presence clear is perfectly sound and must not be registered. Pass `expectedRpId`, `requireUserPresence`, `requireUserVerification`, or `allowedAlgorithms` and those are checked, with `bindingChecked` reporting which ran, so a check that passed can be told from one that never happened. Pass `opts.clientDataJSON` instead of the digest and the client data is read here too: the ceremony type is checked unconditionally, since a login response replayed into a registration is what that rule stops, and the challenge, origin, and top-level origin are checked against what the relying party issued, with `clientData.checked` reporting which comparisons ran. A registration verdict also carries the `credentialId`, `credentialPublicKey`, and initial `signCount` a later login needs. A credential key declaring COSE algorithm `-65535` (RSASSA-PKCS1-v1_5 with SHA-1) is refused unless `allowedAlgorithms` names it, since every signature that credential ever makes would use SHA-1. Anchoring the trust path has two routes: `opts.metadata` resolves the roots the authenticator's own model registered, and `opts.rootCertificates` pins roots directly, which is what anchors the formats FIDO MDS does not cover, Apple's authenticators and the Google hardware-attestation roots among them. `metadata` governs when both are given, and `anchoredTo` names every route that anchored the path, joined with `+` when more than one did: `"metadata"`, `"rootCertificates"`, and `"safetyNetRoots"` for the android-safetynet chain, which anchors through the roots that format requires whether or not either other route was asked for. It is `null` only when nothing anchored the path. `verifyMetadataBlob(blob, opts)` reads a FIDO Metadata Service (MDS v3) BLOB, the signed catalogue of registered authenticator models, verifying its JWS and chaining its signer to an operator-supplied FIDO root before the payload is parsed, with sequence-number rollback and `nextUpdate` freshness checks. Passing the result as `opts.metadata` to `verify` resolves the authenticator's registered attestation roots from its identifier and requires the trust path to fully validate to one of them, refusing an unlisted or revoked model. `metadataAnchors(entry, opts)` applies the same status gate for a caller anchoring the path themselves: a model the catalogue has disqualified registers no anchors. Both of the catalogue's key spaces are covered: an aaguid, and the attestation-certificate key identifiers a U2F authenticator is listed under instead. No FIDO root is bundled, there is no trust-on-first-use, and retrieving the BLOB is out of scope. Fail-closed with typed `webauthn/*` errors — `parseAttestationObject`, `verify`, `verifyMetadataBlob`, `metadataFor`, `metadataAnchors` |
-| `pki.lint` | Certificate linting, the zlint or pkilint of JavaScript. `certificate(pem \| der \| parsed, opts)` walks a parsed certificate and emits graded advisory findings, each with a stable id, a severity (`fatal`, `error`, `warn`, `notice`), a source, a spec-clause citation, and a message, against the RFC 5280 profile, the post-quantum certificate profiles, and a representative CA/Browser Forum TLS BR subset: serial sign and size, validity ordering and the SC081v3 reducing validity schedule, keyCertSign coherence, extension criticality (basicConstraints, nameConstraints, policyConstraints and inhibitAnyPolicy must be critical, and keyUsage should be), nameConstraints CA-scope, unknown critical extensions, empty-subject SAN, SKI and AKI presence including the end-entity subjectKeyIdentifier, the six extensions a conforming CA must mark non-critical (reported by clause rather than as unrecognized) and the two it should (issuerAltName, cRLDistributionPoints), a policy mapping to or from anyPolicy, a unique identifier a conforming CA must not generate, a critical subjectAltName beside a non-empty subject, a critical extKeyUsage naming anyExtendedKeyUsage, a userNotice noticeRef, SAN required and CN-in-SAN, dNSName syntax, serverAuth EKU, weak keys, the CA/Browser Forum subscriber certificate profile of §7.1.2.7 (the extension presence and criticality table, the authorityInformationAccess accessMethod and accessLocation tables, basicConstraints cA and pathLenConstraint, certificatePolicies against anyPolicy and the exactly-one reserved identifier rule and the permitted-qualifier table, the forbidden extended key purposes, the two Key Usage tables that differ by key type, and the subjectAltName GeneralName table with its criticality rule in both directions), the CA/Browser Forum S/MIME BR subscriber profile of §7.1.2.3 (a) through (n) as `cabf-smime`, whose requirements follow the generation a certificate declares through its reserved policy identifier (the distribution-point and accessMethod URI scheme rules, the policy qualifier rules for an id-qt-cps URL and an id-qt-unotice explicitText and noticeRef, the key-usage table for the certificate's own key algorithm including a bit set past the nine named positions, the extended key purposes forbidden at every generation and the ones Strict alone forbids, the authorityKeyIdentifier field rules, a required mailbox in the subjectAltName as an rfc822Name or an id-on-SmtpUTF8Mailbox otherName, the criticality each extension must carry, the subjectDirectoryAttributes and Adobe extensions the Strict generation prohibits, the Legal Entity Identifier extensions keyed on the certificate type rather than the generation, and the Legacy generation retired on 15 July 2025), the post-quantum key-usage rules binding a certificate's keyUsage bits to its subject key type (ML-KEM under RFC 9935 §5, ML-DSA under RFC 9881 §5, and SLH-DSA under RFC 9909 §6 across both its pure and prehash identifiers) together with the ML-KEM encapsulation-key encoding and size, and the §4.2.1.4 certificate-policy user-notice rules (a VisibleString or BMPString explicitText, a notice past 200 characters, an empty notice, control characters, and a non-NFC UTF8String notice, each at the strength the clause states). Alone among these entries the data path never throws: hostile bytes return a `fatal` `lint/unparseable` finding carrying the strict parser's code, so a whole directory lints without a try/catch, and only config-time misuse throws a typed `LintError` — `certificate`, `crl` (the RFC 5280 §5 revocation-list profile: nextUpdate presence, update ordering, cRLNumber presence and its 20-octet ceiling, authorityKeyIdentifier presence, the criticality each profiled CRL and entry extension must carry, freshestCRL in a delta CRL, and unrecognized critical extensions), `ocsp` (the RFC 6960 response profile: an empty signature, each SingleResponse's update ordering and its relation to producedAt, an empty `certs` field, the extended revoked definition and the fixed shape of a revoked answer for a non-issued certificate, the list each extension belongs in, the criticality and value syntax of the CRL entry extensions a SingleResponse may carry, unrecognized critical extensions, the reasons unspecified and removeFromCRL, and two answers for one CertID; the RFC 5019 lightweight rows run on request), `csr` (the artifact a CA reads before it issues: an empty subject naming no identity, an empty subject whose subjectAltName is not critical, a request for an extension the issuer determines, a request asking for a CA certificate, a broken signing digest, and a challengePassword traveling with the request; `opts.profile: "cabf-tls"` adds the certificate profile's own commonName-in-SAN, dNSName syntax, SAN-required and key-strength rows, applied to what the request asks for, and they run only when named because a request carries no extKeyUsage. It does not check the request's signature, which is a cryptographic operation `pki.csr.verify` owns), `rules`, `profiles` |
+| `pki.lint` | Certificate linting, the zlint or pkilint of JavaScript. `certificate(pem \| der \| parsed, opts)` walks a parsed certificate and emits graded advisory findings, each with a stable id, a severity (`fatal`, `error`, `warn`, `notice`), a source, a spec-clause citation, and a message, against the RFC 5280 profile, the post-quantum certificate profiles, and a representative CA/Browser Forum TLS BR subset: serial sign and size, validity ordering and the SC081v3 reducing validity schedule, keyCertSign coherence, extension criticality (basicConstraints, nameConstraints, policyConstraints and inhibitAnyPolicy must be critical, and keyUsage should be), nameConstraints CA-scope, unknown critical extensions, empty-subject SAN, SKI and AKI presence including the end-entity subjectKeyIdentifier, the six extensions a conforming CA must mark non-critical (reported by clause rather than as unrecognized) and the two it should (issuerAltName, cRLDistributionPoints), a policy mapping to or from anyPolicy, a unique identifier a conforming CA must not generate, a critical subjectAltName beside a non-empty subject, a critical extKeyUsage naming anyExtendedKeyUsage, a userNotice noticeRef, SAN required and CN-in-SAN, dNSName syntax, serverAuth EKU, weak keys, the CA/Browser Forum subscriber certificate profile of §7.1.2.7 (the extension presence and criticality table, the authorityInformationAccess accessMethod and accessLocation tables, basicConstraints cA and pathLenConstraint, certificatePolicies against anyPolicy and the exactly-one reserved identifier rule and the permitted-qualifier table, the forbidden extended key purposes, the two Key Usage tables that differ by key type, and the subjectAltName GeneralName table with its criticality rule in both directions), the CA/Browser Forum S/MIME BR subscriber profile of §7.1.2.3 (a) through (n) as `cabf-smime`, whose requirements follow the generation a certificate declares through its reserved policy identifier (the distribution-point and accessMethod URI scheme rules, the policy qualifier rules for an id-qt-cps URL and an id-qt-unotice explicitText and noticeRef, the key-usage table for the certificate's own key algorithm including a bit set past the nine named positions, the extended key purposes forbidden at every generation and the ones Strict alone forbids, the authorityKeyIdentifier field rules, a required mailbox in the subjectAltName as an rfc822Name or an id-on-SmtpUTF8Mailbox otherName, the criticality each extension must carry, the subjectDirectoryAttributes and Adobe extensions the Strict generation prohibits, the Legal Entity Identifier extensions keyed on the certificate type rather than the generation, and the Legacy generation retired on 15 July 2025), the CA/Browser Forum Code Signing BR subscriber profile of §7.1.2.3 as `cabf-cs`, whose rows follow the kind a certificate declares through one of the three reserved identifiers of §7.1.6.1 (the extension presence and criticality rules at the strengths this document states them, a HTTP URL required in the distribution points and in each accessMethod location, a critical keyUsage asserting digitalSignature with `keyCertSign` and `cRLSign` forbidden and every other bit discouraged, the extended key purpose each kind must carry with the critical extKeyUsage a timestamp certificate needs, the §7.1.6.4 exactly-one-identifier rule gated to 15 September 2026, the §6.3.2 ceilings of 39 months, 460 days and 135 months, and the §6.1.5.2 floors of a 3072-bit RSA modulus, NIST P-256, P-384 or P-521, or DSA parameters of 2048 bits with a 224- or 256-bit modulus length, and the §7.1.4.2 subject distinguished name rows: a required commonName, a prohibited domainComponent, a subject attribute made only of the metadata characters the clause names, a required organizationName and two-letter countryName, one of localityName and stateOrProvinceName, and on an EV certificate a businessCategory from the four strings the clause names, a jurisdictionCountryName and a serialNumber), the post-quantum key-usage rules binding a certificate's keyUsage bits to its subject key type (ML-KEM under RFC 9935 §5, ML-DSA under RFC 9881 §5, and SLH-DSA under RFC 9909 §6 across both its pure and prehash identifiers) together with the ML-KEM encapsulation-key encoding and size, and the §4.2.1.4 certificate-policy user-notice rules (a VisibleString or BMPString explicitText, a notice past 200 characters, an empty notice, control characters, and a non-NFC UTF8String notice, each at the strength the clause states). Alone among these entries the data path never throws: hostile bytes return a `fatal` `lint/unparseable` finding carrying the strict parser's code, so a whole directory lints without a try/catch, and only config-time misuse throws a typed `LintError` — `certificate`, `crl` (the RFC 5280 §5 revocation-list profile: nextUpdate presence, update ordering, cRLNumber presence and its 20-octet ceiling, authorityKeyIdentifier presence, the criticality each profiled CRL and entry extension must carry, freshestCRL in a delta CRL, and unrecognized critical extensions), `ocsp` (the RFC 6960 response profile: an empty signature, each SingleResponse's update ordering and its relation to producedAt, an empty `certs` field, the extended revoked definition and the fixed shape of a revoked answer for a non-issued certificate, the list each extension belongs in, the criticality and value syntax of the CRL entry extensions a SingleResponse may carry, unrecognized critical extensions, the reasons unspecified and removeFromCRL, and two answers for one CertID; the RFC 5019 lightweight rows run on request), `csr` (the artifact a CA reads before it issues: an empty subject naming no identity, an empty subject whose subjectAltName is not critical, a request for an extension the issuer determines, a request asking for a CA certificate, a broken signing digest, and a challengePassword traveling with the request; `opts.profile: "cabf-tls"` adds the certificate profile's own commonName-in-SAN, dNSName syntax, SAN-required and key-strength rows, applied to what the request asks for, and they run only when named because a request carries no extKeyUsage. It does not check the request's signature, which is a cryptographic operation `pki.csr.verify` owns), `rules`, `profiles` |
 | `pki.C` / `pki.constants` | Version-stable constants: the functional scale helpers `C.TIME.*` and `C.BYTES.*`, the codec `LIMITS`, and `version` |
 | `pki.errors` | The `PkiError` taxonomy — `defineClass` plus `ConstantsError`, `Asn1Error`, `OidError`, `PemError`, `CertificateError`, `CrlError`, `CsrError`, `Pkcs8Error`, `CmsError`, `OcspError`, `TspError`, `AttrCertError`, `CrmfError`, `Pkcs12Error`, `CmpError`, `PathError`, `CtError`, `JoseError`, `AcmeError`, `WebauthnError`, and `LintError`, each carrying a stable `code` in `domain/reason` form |
 | `pki` CLI | `pki version`, `pki oid <dotted\|name>`, `pki parse <cert>`, `pki inspect <cert>`, `pki lint <cert\|crl\|ocsp-response>`, `pki convert <file> --to der\|pem`, `pki verify <cert>... --anchor <cert>`, `pki sign <file> --cert <c> --key <k>` |

package/lib/guard-time.js

@@ -12,6 +12,16 @@ var _Date = Date;
 
 var _dateGetTime = require("./guard-intrinsic").uncurry(Date.prototype.getTime);
 var _dateGetUTCFullYear = require("./guard-intrinsic").uncurry(Date.prototype.getUTCFullYear);
+var _dateGetUTCMonth = require("./guard-intrinsic").uncurry(Date.prototype.getUTCMonth);
+var _dateGetUTCDate = require("./guard-intrinsic").uncurry(Date.prototype.getUTCDate);
+var _dateGetUTCHours = require("./guard-intrinsic").uncurry(Date.prototype.getUTCHours);
+var _dateGetUTCMinutes = require("./guard-intrinsic").uncurry(Date.prototype.getUTCMinutes);
+var _dateGetUTCSeconds = require("./guard-intrinsic").uncurry(Date.prototype.getUTCSeconds);
+var _dateGetUTCMilliseconds = require("./guard-intrinsic").uncurry(Date.prototype.getUTCMilliseconds);
+var _dateSetUTCFullYear = require("./guard-intrinsic").uncurry(Date.prototype.setUTCFullYear);
+var _dateUTC = Date.UTC;
+var _floor = Math.floor;
+var _ceil = Math.ceil;
 /** @internal A DER GeneralizedTime carries a four-digit year and a UTCTime a narrower one, so a Date
  *  outside 0000..9999 has no PKI encoding. */
 var DER_YEAR_MIN = 0, DER_YEAR_MAX = 9999;
@@ -59,6 +69,45 @@ function isDate(value) {
   return util.types.isDate(value);
 }
 
+// @enforced-by behavioral -- reading a month and adding to it is also how a date renderer prints one, so the arithmetic has no rename-proof shape a detector can tell from `getUTCMonth() + 1`; the clamping and year-borrow vectors in guard-time.test.js are the guard
+/** @internal The instant `months` calendar months after a valid Date, clamped to the last day of
+ *  the target month where that month is shorter, so 31 January plus one month gives 28 or 29
+ *  February. A ceiling stated in months has no reading in days, since how many days 39 months hold
+ *  depends on which 39. Time of day is carried through unchanged. */
+function addMonths(value, months, E, code, label) {
+  assertValid(value, E, code, label);
+  var year = _dateGetUTCFullYear(value);
+  var month = _dateGetUTCMonth(value) + months;
+  var day = _dateGetUTCDate(value);
+  var carry = _floorDiv(month, 12);
+  var targetYear = year + carry;
+  var targetMonth = month - carry * 12;
+  var lastDay = _daysInMonth(targetYear, targetMonth);
+  /** @internal Date.UTC reads a year of 0..99 as 1900..1999, and a DER time carries 0000..9999, so
+   * the date is built at a safe year and the real one is set with the month and day together. One
+   * call sets all three, where setting the year alone would roll 29 February out of a leap year the
+   * remap had landed on. */
+  var out = new _Date(_dateUTC(2000, 0, 1,
+    _dateGetUTCHours(value), _dateGetUTCMinutes(value), _dateGetUTCSeconds(value),
+    _dateGetUTCMilliseconds(value)));
+  _dateSetUTCFullYear(out, targetYear, targetMonth, day < lastDay ? day : lastDay);
+  return out;
+}
+var _MONTH_DAYS = [31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
+/** @internal The proleptic Gregorian leap rule the Date object follows, so year 0 is a leap year
+ *  and year 1900 is not. */
+function _daysInMonth(year, month) {
+  if (month !== 1) return _MONTH_DAYS[month];
+  return ((year % 4 === 0 && year % 100 !== 0) || year % 400 === 0) ? 29 : 28;
+}
+/** @internal Integer division that rounds toward negative infinity, so a month index before
+ *  January of the starting year borrows a year rather than truncating toward zero. */
+function _floorDiv(a, b) {
+  var q = a / b;
+  var f = q < 0 ? -_ceil(-q) : _floor(q);
+  return f;
+}
+
 // @enforced-by behavioral -- a coercion-safe Date converter has no rename-proof code shape; the RED vector (a caller value with no numeric or string form, a BigInt or a throwing Symbol.toPrimitive, becomes an invalid Date the downstream isNaN check rejects, never a native TypeError out of the Date constructor) is the guard.
 function toDate(value) {
   if (util.types.isDate(value)) return value;
@@ -69,6 +118,7 @@ function toDate(value) {
 module.exports = _freeze({
   assertValid: assertValid,
   assertEncodable: assertEncodable,
+  addMonths: addMonths,
   instantOf: instantOf,
   isDate: isDate,
   toDate: toDate,

package/lib/lint.js

@@ -154,6 +154,9 @@ function _makeCtx(cert, profile) {
      * policy identifier, so unlike the TLS case the rows detect it from the certificate itself and
      * the flag only records that the caller also named it. */
     explicitSmimeProfile: profile === "cabf-smime",
+    /** @internal A code signing subscriber certificate names its kind through a reserved policy
+     * identifier the same way, so this flag only records that the caller also named the profile. */
+    explicitCsProfile: profile === "cabf-cs",
     isCaCert: isCa,
     isTlsServerCert: explicitTls || (_hasEku(cert, "serverAuth") && !isCa),
     decode: function (name) { return _decodeOrNull(cert, name); },
@@ -221,13 +224,25 @@ function _sanDnsNames(ctx) {
   if (!d || !d.value || !Array.isArray(d.value.names)) return [];
   return d.value.names.filter(function (n) { return n && n.tagNumber === 2; }).map(function (n) { return n.value; });
 }
-function _subjectCNs(cert) {
+/** @internal Every subject attribute, flattened across the RDNs, since a distinguished name says
+ *  the same thing whether it carries one multi-valued RDN or several single-valued ones. */
+function _subjectAttributes(cert) {
   var out = [];
   ((cert.subject && cert.subject.rdns) || []).forEach(function (rdn) {
-    rdn.forEach(function (a) { if (a.type === oid.byName("commonName") && typeof a.value === "string") out.push(a.value); });
+    rdn.forEach(function (a) { out.push(a); });
   });
   return out;
 }
+/** @internal The string values of one subject attribute type, named through the registry. */
+function _subjectValuesOf(cert, name) {
+  var dotted = oid.byName(name);
+  var out = [];
+  _subjectAttributes(cert).forEach(function (a) {
+    if (a.type === dotted && typeof a.value === "string") out.push(a.value);
+  });
+  return out;
+}
+function _subjectCNs(cert) { return _subjectValuesOf(cert, "commonName"); }
 
 /** @internal The criticality RFC 5280 fixes for a certificate extension, read from the shared table
  * the certificate signer refuses to write against. The profile has its own row for each extension
@@ -731,6 +746,154 @@ function _smimeKuMatchesAMode(modes, asserted) {
   return false;
 }
 
+/** @internal Code Signing BR sec. 7.1.6.1 reserves three policy identifiers, keyed here to the KIND
+ *  of certificate each declares. The EV and the non-EV code signing identifiers declare the same
+ *  kind, because sec. 7.1.2.3 (f) asks one question of both; only the timestamping identifier takes
+ *  the other arm. */
+var CS_KIND_BY_POLICY = Object.create(null);
+["code-signing", "code-signing-ev", "code-signing-timestamping"].forEach(function (name) {
+  var dotted = oid.byName(name);
+  if (dotted) CS_KIND_BY_POLICY[dotted] = name;
+});
+/** @internal "Effective September 15, 2026 a Certificate issued to a Subscriber MUST contain
+ *  exactly one of the reserved policy OIDs specified in Section 7.1.6.1" (sec. 7.1.6.4). Dated, so
+ *  a certificate issued before it is not held to a rule that did not yet apply. */
+var CS_RESERVED_POLICY_REQUIRED = new Date("2026-09-15T00:00:00Z");
+/** @internal Sec. 6.3.2 states three ceilings: 39 months for a code signing certificate issued
+ *  before this date, 460 days for one issued on or after it, and 135 months for a timestamp
+ *  certificate whichever side of it. */
+var CS_VALIDITY_DAYS_START = new Date("2026-03-01T00:00:00Z");
+/** @internal Sec. 6.1.5.2, the curves, the modulus floor and the two DSA parameter options for a
+ *  subscriber key. The TLS profile names the same three curves from its own document; these are
+ *  this one's. The section names RSA, ECDSA and DSA, so each family is read on its own terms and a
+ *  family it does not name is what the row reports. */
+var CS_EC_CURVES = ["prime256v1", "secp384r1", "secp521r1"];
+var CS_RSA_MIN_BITS = 3072;
+var CS_DSA_L = 2048;
+var CS_DSA_N = [224, 256];
+/** @internal The DSA key length L and modulus length N, read as the bit lengths of p and q in the
+ *  Dss-Parms the AlgorithmIdentifier carries. */
+function _dsaParamBits(spki) {
+  try {
+    var params = spki.algorithm && spki.algorithm.parameters;
+    if (!Buffer.isBuffer(params)) return null;
+    var seq = asn1.decode(params);
+    if (!seq.children || seq.children.length !== 3) return null;
+    var p = asn1.read.integer(seq.children[0]);
+    var q = asn1.read.integer(seq.children[1]);
+    asn1.read.integer(seq.children[2]);
+    if (p <= 0n || q <= 0n) return null;
+    return { L: p.toString(2).length, N: q.toString(2).length };
+  } catch (_e) { return null; }
+}
+/** @internal Sec. 7.1.2.3 (c) names these two accessMethods and no other. */
+var CS_AIA_METHODS = ["ocsp", "caIssuers"].map(function (n) { return oid.byName(n); });
+/** @internal Sec. 7.1.2.3 (f): forbidden at every kind, and the three the clause names as MAY
+ *  beside id-kp-codeSigning, which the discouraged-purpose row passes over. */
+var CS_FORBIDDEN_EKU = ["anyExtendedKeyUsage", "serverAuth"].map(function (n) { return oid.byName(n); });
+var CS_PERMITTED_EXTRA_EKU = ["ms-lifetime-signing", "emailProtection", "ms-document-signing",
+  "ms-document-signing-as-printed"].map(function (n) { return oid.byName(n); });
+/** @internal Sec. 7.1.2.3 (e) names these two as MUST NOT, and every other bit beside
+ *  digitalSignature as SHOULD NOT, so one sentence becomes two rows at two strengths. */
+var CS_FORBIDDEN_KU = ["keyCertSign", "cRLSign"];
+/** @internal Sec. 7.1.4.2.4 (b): the field MUST contain one of these four strings, which the clause
+ *  fixes exactly, so a differing case is a differing string. */
+var CS_BUSINESS_CATEGORIES = ["Private Organization", "Government Entity", "Business Entity",
+  "Non-Commercial Entity"];
+/** @internal Sec. 7.1.4.2.4 (c) bounds the jurisdiction fields against the LEVEL the incorporating
+ *  or registration agency operates at, which the certificate does not carry, so no row grades the
+ *  relationship between them. The clause requires the state or province at the locality level only
+ *  "where the state or province regulates the registration of the entities at the locality level",
+ *  so a country with a locality and no state is conformant for such an agency and reporting it
+ *  would fail a valid certificate. The country is required outright and has its own row. */
+
+/** @internal Whether a subject attribute value carries nothing but the metadata sec. 7.1.4.2.2 (d)
+ *  names, which is a full stop, a hyphen and a space. An empty value is the same statement that
+ *  the value is absent, so it is read the same way. The clause also covers "any other indication
+ *  that the value is absent, incomplete, or not applicable", which names no further characters, so
+ *  the row reports the ones it does name. */
+function _isMetadataOnlyValue(s) {
+  if (typeof s !== "string") return false;
+  for (var i = 0; i < s.length; i++) {
+    var c = s.charCodeAt(i);
+    if (c !== 46 && c !== 45 && c !== 32) return false;
+  }
+  return true;
+}
+/** @internal Whether a value is the two-letter form sec. 7.1.4.2.3 (f) requires of a country code.
+ *  The code's membership of ISO 3166-1 is not decided here, because the section names no list and
+ *  the toolkit carries none; the builders hold their own country inputs to the same two-letter
+ *  shape. */
+function _isTwoLetterCountry(s) {
+  if (typeof s !== "string" || s.length !== 2) return false;
+  for (var i = 0; i < 2; i++) {
+    var c = s.charCodeAt(i);
+    if (c < 65 || c > 90) return false;
+  }
+  return true;
+}
+
+/** @internal Which reserved identifiers the certificate ASSERTS, as a set. Order in the extension
+ *  carries no meaning, and a certificate asserting two of them claims both, so reading only the
+ *  first would let the DER order decide which rules it answers for. Sec. 7.1.6.4 reports more than
+ *  one, but only for a certificate issued on or after the date it states. */
+function _csAsserted(ctx) {
+  var out = Object.create(null);
+  var d = ctx.decode("certificatePolicies");
+  if (!d || !Array.isArray(d.value)) return out;
+  for (var i = 0; i < d.value.length; i++) {
+    var k = CS_KIND_BY_POLICY[d.value[i].policyIdentifier];
+    if (k) out[k] = true;
+  }
+  return out;
+}
+/** @internal Sec. 7.1.6.3 gives a subordinate CA these identifiers too, so detection asks for the
+ *  identifier AND that the certificate is not a CA, as the S/MIME profile does and for the same
+ *  reason. Naming the profile overrides, which is how a malformed subscriber is checked. */
+function _isCs(cert, ctx) {
+  if (ctx.explicitCsProfile) return true;
+  var a = _csAsserted(ctx);
+  var any = a["code-signing"] === true || a["code-signing-ev"] === true ||
+    a["code-signing-timestamping"] === true;
+  return any && !ctx.isCaCert;
+}
+/** @internal A certificate declaring no kind is read as a code signing one, which is the arm the
+ *  section states first and the only arm a caller who named the profile without a reserved
+ *  identifier can have meant. */
+function _isCsTimestamp(cert, ctx) {
+  return _isCs(cert, ctx) && _csAsserted(ctx)["code-signing-timestamping"] === true;
+}
+/** @internal A certificate asserting a code signing identifier is one, and so is a certificate
+ *  asserting none, which is the arm the section states first and the only arm a caller who named
+ *  the profile without an identifier can have meant. A certificate asserting the timestamping
+ *  identifier alone is not. */
+function _isCsCodeSigning(cert, ctx) {
+  if (!_isCs(cert, ctx)) return false;
+  var a = _csAsserted(ctx);
+  if (a["code-signing"] === true || a["code-signing-ev"] === true) return true;
+  return a["code-signing-timestamping"] !== true;
+}
+/** @internal Sec. 7.1.4.2.4 covers EV code signing certificates alone, where sec. 7.1.4.2.3 covers
+ *  non-EV ones and sec. 7.1.4.2.2 covers both. None of the three names a Timestamp Certificate, so
+ *  the subject rows are scoped by the arm rather than by the profile. */
+function _isCsEv(cert, ctx) { return _isCs(cert, ctx) && _csAsserted(ctx)["code-signing-ev"] === true; }
+/** @internal The accessLocation URIs of the two accessMethods sec. 7.1.2.3 (c) names, flat: unlike
+ *  the S/MIME clause this one states one rule for both, so they are not grouped by method. A
+ *  location that is not a uniformResourceIdentifier is kept as null, since the method is still
+ *  provided and still carries no HTTP URL. */
+function _csAiaLocations(ctx) {
+  var d = ctx.decode("authorityInfoAccess");
+  if (!d || !Array.isArray(d.value)) return [];
+  var out = [];
+  for (var i = 0; i < d.value.length; i++) {
+    var ad = d.value[i];
+    if (CS_AIA_METHODS.indexOf(ad.accessMethod) === -1) continue;
+    var loc = ad.accessLocation;
+    out.push(loc && loc.tag === 6 && typeof loc.value === "string" ? loc.value : null);
+  }
+  return out;
+}
+
 /** @internal Sec. 7.1.2.3 (c) gives a URI scheme table for each of these two accessMethods and
  *  none for any other, so a scheme is measured on these and an unrecognized accessMethod has no
  *  table to be held to. */
@@ -1439,6 +1602,455 @@ var CABF_SMIME_RULES = [
   },
 ];
 
+/** @internal The CA/Browser Forum Code Signing BR v3.11.0 subscriber profile. Every severity is
+ *  graded against the clause the row cites, never against the same-named row of another profile:
+ *  this document says MUST where the S/MIME one says SHOULD for cRLDistributionPoints criticality,
+ *  authorityInformationAccess presence and keyUsage criticality. */
+var CABF_CS_RULES = [
+  {
+    id: "lint/cabf-cs/policies-missing", severity: "error", source: "cabf-cs", citation: "CABF Code Signing BR 7.1.2.3 (a)",
+    message: "a subscriber certificate must carry a certificatePolicies extension",
+    appliesTo: _isCs,
+    check: function (cert, ctx) { return ctx.raw("certificatePolicies") ? null : true; },
+  },
+  {
+    id: "lint/cabf-cs/policies-critical", severity: "warn", source: "cabf-cs", citation: "CABF Code Signing BR 7.1.2.3 (a)",
+    message: "certificatePolicies should not be marked critical",
+    appliesTo: _isCs,
+    check: function (cert, ctx) {
+      var e = ctx.raw("certificatePolicies");
+      return (e && e.critical === true) ? true : null;
+    },
+  },
+  {
+    id: "lint/cabf-cs/policies-reserved-identifier-count", severity: "error", source: "cabf-cs", citation: "CABF Code Signing BR 7.1.6.4",
+    /** @internal "a Certificate issued to a Subscriber MUST contain exactly one of the reserved
+     * policy OIDs specified in Section 7.1.6.1", so both none and two are reported. */
+    message: "a subscriber certificate must assert exactly one reserved code signing policy identifier",
+    appliesTo: _isCs,
+    effectiveDate: CS_RESERVED_POLICY_REQUIRED,
+    check: function (cert, ctx) {
+      var d = ctx.decode("certificatePolicies");
+      if (!d || !Array.isArray(d.value)) return null;
+      var found = d.value.filter(function (pi) { return !!CS_KIND_BY_POLICY[pi.policyIdentifier]; });
+      return found.length === 1 ? null : { context: { count: found.length } };
+    },
+  },
+  {
+    id: "lint/cabf-cs/policies-cps-not-http-url", severity: "error", source: "cabf-cs", citation: "CABF Code Signing BR 7.1.2.3 (a)",
+    /** @internal "HTTP URL for the Subordinate CA's Certification Practice Statement". This clause
+     * names one scheme where the S/MIME clause for the same qualifier names two, so an HTTPS
+     * qualifier is conformant there and reported here. */
+    message: "an id-qt-cps policy qualifier must be a HTTP URL",
+    appliesTo: _isCs,
+    check: function (cert, ctx) {
+      var out = [];
+      _eachPolicyQualifier(ctx, function (qid, value, pi) {
+        if (qid !== OID_CPS) return;
+        var uri = null;
+        // allow:swallow-unverified a CPSuri that will not read as a string is not a URL either, so it falls to the report below rather than out of the rule
+        try {
+          uri = asn1.read.string(value);
+        } catch (_e) {
+          void 0;
+        }
+        if (pkiBuild.httpUrlScheme(uri) !== "http") {
+          out.push({ context: { policyIdentifier: pi.policyIdentifier, cps: uri } });
+        }
+      });
+      return out.length ? out : null;
+    },
+  },
+  {
+    id: "lint/cabf-cs/crldp-missing", severity: "error", source: "cabf-cs", citation: "CABF Code Signing BR 7.1.2.3 (b)",
+    message: "a subscriber certificate must carry a cRLDistributionPoints extension",
+    appliesTo: _isCs,
+    check: function (cert, ctx) { return ctx.raw("cRLDistributionPoints") ? null : true; },
+  },
+  {
+    id: "lint/cabf-cs/crldp-critical", severity: "error", source: "cabf-cs", citation: "CABF Code Signing BR 7.1.2.3 (b)",
+    /** @internal "It MUST NOT be marked critical", where the S/MIME clause for the same extension
+     * says SHOULD NOT, so the same certificate draws an error here and a warning there. */
+    message: "cRLDistributionPoints must not be marked critical",
+    appliesTo: _isCs,
+    check: function (cert, ctx) {
+      var e = ctx.raw("cRLDistributionPoints");
+      return (e && e.critical === true) ? true : null;
+    },
+  },
+  {
+    id: "lint/cabf-cs/crldp-no-http-uri", severity: "error", source: "cabf-cs", citation: "CABF Code Signing BR 7.1.2.3 (b)",
+    /** @internal "it MUST contain the HTTP URL of the CA's CRL service". One HTTP URL is required
+     * and the clause forbids no other scheme beside it. */
+    message: "cRLDistributionPoints must contain a HTTP URL",
+    appliesTo: function (cert, ctx) { return _isCs(cert, ctx) && !!ctx.raw("cRLDistributionPoints"); },
+    check: function (cert, ctx) {
+      var uris = _crldpUris(ctx);
+      return uris.some(_isHttpUri) ? null : { context: { uris: uris } };
+    },
+  },
+  {
+    id: "lint/cabf-cs/aia-missing", severity: "error", source: "cabf-cs", citation: "CABF Code Signing BR 7.1.2.3 (c)",
+    /** @internal "This extension MUST be present", where the S/MIME clause asks at SHOULD. */
+    message: "a subscriber certificate must carry an authorityInformationAccess extension",
+    appliesTo: _isCs,
+    check: function (cert, ctx) { return ctx.raw("authorityInfoAccess") ? null : true; },
+  },
+  {
+    id: "lint/cabf-cs/aia-critical", severity: "error", source: "cabf-cs", citation: "CABF Code Signing BR 7.1.2.3 (c)",
+    message: "authorityInformationAccess must not be marked critical",
+    appliesTo: _isCs,
+    check: function (cert, ctx) {
+      var e = ctx.raw("authorityInfoAccess");
+      return (e && e.critical === true) ? true : null;
+    },
+  },
+  {
+    id: "lint/cabf-cs/aia-ca-issuers-missing", severity: "error", source: "cabf-cs", citation: "CABF Code Signing BR 7.1.2.3 (c)",
+    /** @internal "It MUST contain the HTTP URL of the Issuing CA's certificate", so the method is
+     * required rather than recommended, unlike the S/MIME clause's SHOULD. */
+    message: "authorityInformationAccess must carry an id-ad-caIssuers accessMethod",
+    appliesTo: function (cert, ctx) { return _isCs(cert, ctx) && !!ctx.raw("authorityInfoAccess"); },
+    check: function (cert, ctx) {
+      var d = ctx.decode("authorityInfoAccess");
+      if (!d || !Array.isArray(d.value)) return null;
+      var wanted = oid.byName("caIssuers");
+      for (var i = 0; i < d.value.length; i++) {
+        if (d.value[i].accessMethod === wanted) return null;
+      }
+      return true;
+    },
+  },
+  {
+    id: "lint/cabf-cs/aia-non-http-uri", severity: "error", source: "cabf-cs", citation: "CABF Code Signing BR 7.1.2.3 (c)",
+    /** @internal The clause states one rule for both accessMethods it names, so unlike the S/MIME
+     * clause there is no table per method and every location is held to the same reading. */
+    message: "an authorityInformationAccess accessLocation must be a HTTP URL",
+    appliesTo: function (cert, ctx) { return _isCs(cert, ctx) && !!ctx.raw("authorityInfoAccess"); },
+    check: function (cert, ctx) {
+      var locs = _csAiaLocations(ctx);
+      var bad = locs.filter(function (u) { return !_isHttpUri(u); });
+      if (!bad.length) return null;
+      return { context: { uris: bad.filter(function (u) { return u !== null; }),
+        nonUriLocations: bad.filter(function (u) { return u === null; }).length } };
+    },
+  },
+  {
+    id: "lint/cabf-cs/basic-constraints-ca-true", severity: "error", source: "cabf-cs", citation: "CABF Code Signing BR 7.1.2.3 (d)",
+    message: "a subscriber certificate's basicConstraints cA field must not be true",
+    appliesTo: _isCs,
+    check: function (cert, ctx) {
+      var d = ctx.decode("basicConstraints");
+      return (d && d.value && d.value.cA === true) ? true : null;
+    },
+  },
+  {
+    id: "lint/cabf-cs/key-usage-missing", severity: "error", source: "cabf-cs", citation: "CABF Code Signing BR 7.1.2.3 (e)",
+    message: "a subscriber certificate must carry a keyUsage extension",
+    appliesTo: _isCs,
+    check: function (cert, ctx) { return ctx.raw("keyUsage") ? null : true; },
+  },
+  {
+    id: "lint/cabf-cs/key-usage-not-critical", severity: "error", source: "cabf-cs", citation: "CABF Code Signing BR 7.1.2.3 (e)",
+    /** @internal "MUST be marked critical", where the S/MIME clause says SHOULD. */
+    message: "keyUsage must be marked critical",
+    appliesTo: function (cert, ctx) { return _isCs(cert, ctx) && !!ctx.raw("keyUsage"); },
+    check: function (cert, ctx) {
+      var e = ctx.raw("keyUsage");
+      return (e && e.critical === true) ? null : true;
+    },
+  },
+  {
+    id: "lint/cabf-cs/key-usage-missing-digital-signature", severity: "error", source: "cabf-cs", citation: "CABF Code Signing BR 7.1.2.3 (e)",
+    message: "keyUsage must assert digitalSignature",
+    appliesTo: function (cert, ctx) { return _isCs(cert, ctx) && !!ctx.raw("keyUsage"); },
+    check: function (cert, ctx) {
+      var d = ctx.decode("keyUsage");
+      if (!d || !d.value) return null;
+      return d.value.digitalSignature === true ? null : true;
+    },
+  },
+  {
+    id: "lint/cabf-cs/key-usage-forbidden-bit", severity: "error", source: "cabf-cs", citation: "CABF Code Signing BR 7.1.2.3 (e)",
+    /** @internal "Bit positions for keyCertSign and cRLSign MUST NOT be set." The next sentence
+     * covers every other bit at SHOULD NOT, so the two lists are two rows at two strengths. */
+    message: "keyUsage must not assert keyCertSign or cRLSign",
+    appliesTo: _isCs,
+    check: function (cert, ctx) {
+      var d = ctx.decode("keyUsage");
+      if (!d || !d.value) return null;
+      var out = [];
+      CS_FORBIDDEN_KU.forEach(function (bit) {
+        if (d.value[bit] === true) out.push({ context: { keyUsage: bit } });
+      });
+      return out.length ? out : null;
+    },
+  },
+  {
+    id: "lint/cabf-cs/key-usage-discouraged-bit", severity: "warn", source: "cabf-cs", citation: "CABF Code Signing BR 7.1.2.3 (e)",
+    /** @internal "All other bit positions SHOULD NOT be set", which reaches every bit other than
+     * the required digitalSignature and the two the row above forbids, including one set past the
+     * nine RFC 5280 names. */
+    message: "keyUsage should not assert a bit beyond digitalSignature",
+    appliesTo: _isCs,
+    check: function (cert, ctx) {
+      var d = ctx.decode("keyUsage");
+      if (!d || !d.value) return null;
+      var out = [];
+      KU_BIT_NAMES.forEach(function (bit) {
+        if (bit === "digitalSignature" || CS_FORBIDDEN_KU.indexOf(bit) !== -1) return;
+        if (d.value[bit] === true) out.push({ context: { keyUsage: bit } });
+      });
+      if (d.value.reservedBitsSet === true) out.push({ context: { reservedBitSet: true } });
+      return out.length ? out : null;
+    },
+  },
+  {
+    id: "lint/cabf-cs/eku-missing-code-signing", severity: "error", source: "cabf-cs", citation: "CABF Code Signing BR 7.1.2.3 (f)",
+    message: "a code signing certificate must carry id-kp-codeSigning",
+    appliesTo: _isCsCodeSigning,
+    check: function (cert, ctx) {
+      var d = ctx.decode("extKeyUsage");
+      if (!d || !Array.isArray(d.value)) return true;
+      return d.value.indexOf(oid.byName("codeSigning")) === -1 ? true : null;
+    },
+  },
+  {
+    id: "lint/cabf-cs/eku-missing-time-stamping", severity: "error", source: "cabf-cs", citation: "CABF Code Signing BR 7.1.2.3 (f)",
+    message: "a timestamp certificate must carry id-kp-timeStamping",
+    appliesTo: _isCsTimestamp,
+    check: function (cert, ctx) {
+      var d = ctx.decode("extKeyUsage");
+      if (!d || !Array.isArray(d.value)) return true;
+      return d.value.indexOf(oid.byName("timeStamping")) === -1 ? true : null;
+    },
+  },
+  {
+    id: "lint/cabf-cs/eku-not-critical-timestamp", severity: "error", source: "cabf-cs", citation: "CABF Code Signing BR 7.1.2.3 (f)",
+    /** @internal "id-kp-timeStamping MUST be present and MUST be marked critical", the one place
+     * this section requires a critical extKeyUsage. */
+    message: "a timestamp certificate's extKeyUsage must be marked critical",
+    appliesTo: function (cert, ctx) { return _isCsTimestamp(cert, ctx) && !!ctx.raw("extKeyUsage"); },
+    check: function (cert, ctx) {
+      var e = ctx.raw("extKeyUsage");
+      return (e && e.critical === true) ? null : true;
+    },
+  },
+  {
+    id: "lint/cabf-cs/eku-forbidden-purpose", severity: "error", source: "cabf-cs", citation: "CABF Code Signing BR 7.1.2.3 (f)",
+    message: "extKeyUsage must not carry anyExtendedKeyUsage or id-kp-serverAuth",
+    appliesTo: _isCs,
+    check: function (cert, ctx) {
+      var d = ctx.decode("extKeyUsage");
+      if (!d || !Array.isArray(d.value)) return null;
+      var out = [];
+      CS_FORBIDDEN_EKU.forEach(function (dotted) {
+        if (d.value.indexOf(dotted) !== -1) {
+          out.push({ context: { purpose: dotted, name: oid.name(dotted) || null } });
+        }
+      });
+      return out.length ? out : null;
+    },
+  },
+  {
+    id: "lint/cabf-cs/eku-discouraged-purpose", severity: "warn", source: "cabf-cs", citation: "CABF Code Signing BR 7.1.2.3 (f)",
+    /** @internal "Other values SHOULD NOT be present." The clause continues that a CA presenting
+     * one must hold a business agreement with a platform vendor, which is a fact about the CA
+     * rather than about the certificate, so this row reports the value and says nothing about the
+     * agreement. The purpose each kind requires, the three the clause names as MAY, and the two
+     * the row above forbids are all passed over here. */
+    message: "extKeyUsage should not carry a purpose beyond the ones this profile names",
+    appliesTo: _isCs,
+    check: function (cert, ctx) {
+      var d = ctx.decode("extKeyUsage");
+      if (!d || !Array.isArray(d.value)) return null;
+      var required = [];
+      if (_isCsTimestamp(cert, ctx)) required.push(oid.byName("timeStamping"));
+      if (_isCsCodeSigning(cert, ctx)) required.push(oid.byName("codeSigning"));
+      var out = [];
+      d.value.forEach(function (dotted) {
+        if (required.indexOf(dotted) !== -1) return;
+        if (CS_PERMITTED_EXTRA_EKU.indexOf(dotted) !== -1) return;
+        if (CS_FORBIDDEN_EKU.indexOf(dotted) !== -1) return;
+        out.push({ context: { purpose: dotted, name: oid.name(dotted) || null } });
+      });
+      return out.length ? out : null;
+    },
+  },
+  {
+    id: "lint/cabf-cs/aki-missing", severity: "error", source: "cabf-cs", citation: "CABF Code Signing BR 7.1.2.3 (g)",
+    message: "a subscriber certificate must carry an authorityKeyIdentifier extension",
+    appliesTo: _isCs,
+    check: function (cert, ctx) { return ctx.raw("authorityKeyIdentifier") ? null : true; },
+  },
+  {
+    id: "lint/cabf-cs/aki-critical", severity: "error", source: "cabf-cs", citation: "CABF Code Signing BR 7.1.2.3 (g)",
+    message: "authorityKeyIdentifier must not be marked critical",
+    appliesTo: _isCs,
+    check: function (cert, ctx) {
+      var e = ctx.raw("authorityKeyIdentifier");
+      return (e && e.critical === true) ? true : null;
+    },
+  },
+  {
+    id: "lint/cabf-cs/validity-too-long", severity: "error", source: "cabf-cs", citation: "CABF Code Signing BR 6.3.2",
+    /** @internal Three ceilings, keyed on the kind and on the issuance date: 39 months for a code
+     * signing certificate issued before 1 March 2026, 460 days for one issued on or after it, and
+     * 135 months for a timestamp certificate either side of that date. A ceiling stated in months
+     * is measured in months, through guard.time.addMonths, since how many days 39 months hold
+     * depends on which 39. */
+    message: "the validity period exceeds the maximum this profile gives for the certificate's kind and issuance date",
+    appliesTo: _isCs,
+    check: function (cert, ctx) {
+      var v = cert.validity;
+      if (!guard.time.isDate(v.notBefore) || !guard.time.isDate(v.notAfter)) return null;
+      var notAfter = guard.time.instantOf(v.notAfter);
+      /** @internal A certificate claiming both kinds is held to the code signing ceiling, the
+       * tighter of the two, since it must satisfy every ceiling it claims. */
+      if (!_isCsCodeSigning(cert, ctx)) {
+        var tsCeiling = guard.time.addMonths(v.notBefore, 135, _cfg, "lint/bad-input", "notBefore");
+        return notAfter > guard.time.instantOf(tsCeiling)
+          ? { context: { maxMonths: 135 } } : null;
+      }
+      if (guard.time.instantOf(v.notBefore) < guard.time.instantOf(CS_VALIDITY_DAYS_START)) {
+        var monthCeiling = guard.time.addMonths(v.notBefore, 39, _cfg, "lint/bad-input", "notBefore");
+        return notAfter > guard.time.instantOf(monthCeiling)
+          ? { context: { maxMonths: 39 } } : null;
+      }
+      var days = (notAfter - guard.time.instantOf(v.notBefore)) / MS_PER_DAY;
+      return days > 460 ? { context: { days: Math.round(days), maxDays: 460 } } : null;
+    },
+  },
+  {
+    id: "lint/cabf-cs/weak-key", severity: "error", source: "cabf-cs", citation: "CABF Code Signing BR 6.1.5.2",
+    /** @internal The section names RSA, ECDSA and DSA and no other family, so a key outside the
+     * three is reported: a certificate the profile covers must carry one it names. */
+    message: "the subject public key is below the Code Signing BR minimum (RSA < 3072 bits, or a curve or family the section does not name)",
+    appliesTo: _isCs,
+    check: function (cert) {
+      var spki = cert.subjectPublicKeyInfo, name = spki && spki.algorithm && spki.algorithm.name;
+      if (RSA_KEY_ALGS[name]) {
+        var bits = _rsaModulusBits(spki);
+        return (bits === null || bits < CS_RSA_MIN_BITS) ? { context: { rsaBits: bits } } : null;
+      }
+      if (name === "ecPublicKey") {
+        var curve = _ecCurveName(spki);
+        return CS_EC_CURVES.indexOf(curve) === -1 ? { context: { curve: curve } } : null;
+      }
+      if (name === "dsa") {
+        var dsa = _dsaParamBits(spki);
+        if (dsa === null) return { context: { keyAlgorithm: "dsa", dsaL: null, dsaN: null } };
+        return (dsa.L === CS_DSA_L && CS_DSA_N.indexOf(dsa.N) !== -1)
+          ? null : { context: { keyAlgorithm: "dsa", dsaL: dsa.L, dsaN: dsa.N } };
+      }
+      return { context: { keyAlgorithm: name || null } };
+    },
+  },
+  {
+    id: "lint/cabf-cs/subject-common-name-missing", severity: "error", source: "cabf-cs", citation: "CABF Code Signing BR 7.1.4.2.2 (a)",
+    message: "a code signing certificate's subject must carry a commonName",
+    appliesTo: _isCsCodeSigning,
+    check: function (cert) { return _subjectValuesOf(cert, "commonName").length ? null : true; },
+  },
+  {
+    id: "lint/cabf-cs/subject-domain-component-prohibited", severity: "error", source: "cabf-cs", citation: "CABF Code Signing BR 7.1.4.2.2 (c)",
+    message: "a code signing certificate's subject must not carry a domainComponent",
+    appliesTo: _isCsCodeSigning,
+    check: function (cert) {
+      var n = _subjectValuesOf(cert, "domainComponent").length;
+      return n ? { context: { count: n } } : null;
+    },
+  },
+  {
+    id: "lint/cabf-cs/subject-attribute-metadata-only", severity: "error", source: "cabf-cs", citation: "CABF Code Signing BR 7.1.4.2.2 (d)",
+    /** @internal "Subject attributes MUST NOT contain only metadata such as '.', '-', and ' '
+     * (i.e. space) characters, and/or any other indication that the value is absent, incomplete,
+     * or not applicable." Read over every attribute, since the clause names none in particular. */
+    message: "a subject attribute carries only metadata characters",
+    appliesTo: _isCsCodeSigning,
+    check: function (cert) {
+      var out = [];
+      _subjectAttributes(cert).forEach(function (a) {
+        if (typeof a.value !== "string" || !_isMetadataOnlyValue(a.value)) return;
+        out.push({ context: { attribute: oid.name(a.type) || a.type, value: a.value } });
+      });
+      return out.length ? out : null;
+    },
+  },
+  {
+    id: "lint/cabf-cs/subject-organization-name-missing", severity: "error", source: "cabf-cs", citation: "CABF Code Signing BR 7.1.4.2.3 (a) / 7.1.4.2.4 (a)",
+    /** @internal Required by the non-EV subsection and again by the EV one, so the row covers both
+     * arms and cites each clause. */
+    message: "a code signing certificate's subject must carry an organizationName",
+    appliesTo: _isCsCodeSigning,
+    check: function (cert) { return _subjectValuesOf(cert, "organizationName").length ? null : true; },
+  },
+  {
+    id: "lint/cabf-cs/subject-locality-and-state-absent", severity: "error", source: "cabf-cs", citation: "CABF Code Signing BR 7.1.4.2.3 (c) and (d)",
+    /** @internal localityName is "Required if the stateOrProvinceName field is absent" and the
+     * state row says the same in the other direction, so one of the two must be present and
+     * either alone satisfies both. Sec. 7.1.4.2.4 (e) carries these rows onto an EV certificate. */
+    message: "a code signing certificate's subject must carry a localityName or a stateOrProvinceName",
+    appliesTo: _isCsCodeSigning,
+    check: function (cert) {
+      return (_subjectValuesOf(cert, "localityName").length ||
+        _subjectValuesOf(cert, "stateOrProvinceName").length) ? null : true;
+    },
+  },
+  {
+    id: "lint/cabf-cs/subject-country-name-missing", severity: "error", source: "cabf-cs", citation: "CABF Code Signing BR 7.1.4.2.3 (f)",
+    message: "a code signing certificate's subject must carry a countryName",
+    appliesTo: _isCsCodeSigning,
+    check: function (cert) { return _subjectValuesOf(cert, "countryName").length ? null : true; },
+  },
+  {
+    id: "lint/cabf-cs/subject-country-name-bad-syntax", severity: "error", source: "cabf-cs", citation: "CABF Code Signing BR 7.1.4.2.3 (f)",
+    /** @internal "MUST contain the two-letter ISO 3166-1 country code", with the user-assigned XX
+     * admitted by the same clause, which is itself two letters. */
+    message: "a subject countryName must be a two-letter code",
+    appliesTo: _isCsCodeSigning,
+    check: function (cert) {
+      var out = [];
+      _subjectValuesOf(cert, "countryName").forEach(function (v) {
+        if (!_isTwoLetterCountry(v)) out.push({ context: { countryName: v } });
+      });
+      return out.length ? out : null;
+    },
+  },
+  {
+    id: "lint/cabf-cs/subject-business-category-missing", severity: "error", source: "cabf-cs", citation: "CABF Code Signing BR 7.1.4.2.4 (b)",
+    message: "an EV code signing certificate's subject must carry a businessCategory",
+    appliesTo: _isCsEv,
+    check: function (cert) { return _subjectValuesOf(cert, "businessCategory").length ? null : true; },
+  },
+  {
+    id: "lint/cabf-cs/subject-business-category-invalid", severity: "error", source: "cabf-cs", citation: "CABF Code Signing BR 7.1.4.2.4 (b)",
+    message: "a subject businessCategory must be one of the four strings this clause names",
+    appliesTo: _isCsEv,
+    check: function (cert) {
+      var out = [];
+      _subjectValuesOf(cert, "businessCategory").forEach(function (v) {
+        if (CS_BUSINESS_CATEGORIES.indexOf(v) === -1) out.push({ context: { businessCategory: v } });
+      });
+      return out.length ? out : null;
+    },
+  },
+  {
+    id: "lint/cabf-cs/subject-jurisdiction-country-missing", severity: "error", source: "cabf-cs", citation: "CABF Code Signing BR 7.1.4.2.4 (c)",
+    /** @internal The clause lists the locality and the state as required only where the agency
+     * operates at that level, and the country without that qualification. */
+    message: "an EV code signing certificate's subject must carry a jurisdictionCountryName",
+    appliesTo: _isCsEv,
+    check: function (cert) { return _subjectValuesOf(cert, "jurisdictionCountryName").length ? null : true; },
+  },
+  {
+    id: "lint/cabf-cs/subject-serial-number-missing", severity: "error", source: "cabf-cs", citation: "CABF Code Signing BR 7.1.4.2.4 (d)",
+    message: "an EV code signing certificate's subject must carry a serialNumber",
+    appliesTo: _isCsEv,
+    check: function (cert) { return _subjectValuesOf(cert, "serialNumber").length ? null : true; },
+  },
+];
+
 var CABF_TLS_RULES = [
   {
     id: "lint/cabf-tls/aia-missing", severity: "error", source: "cabf-tls", citation: "CABF TLS BR 7.1.2.7.6",
@@ -3089,9 +3701,10 @@ var PROFILES = Object.assign(Object.create(null), {
   "rfc9935": RFC9935_RULES.concat(RFC5280_EXTENSION_SYNTAX_RULES),
   "cabf-tls": CABF_TLS_RULES.concat(RFC5280_EXTENSION_SYNTAX_RULES),
   "cabf-smime": CABF_SMIME_RULES.concat(RFC5280_EXTENSION_SYNTAX_RULES),
+  "cabf-cs": CABF_CS_RULES.concat(RFC5280_EXTENSION_SYNTAX_RULES),
 });
 var ALL_RULES = RFC5280_RULES.concat(RFC9881_RULES).concat(RFC9909_RULES).concat(RFC9935_RULES)
-  .concat(CABF_TLS_RULES).concat(CABF_SMIME_RULES);
+  .concat(CABF_TLS_RULES).concat(CABF_SMIME_RULES).concat(CABF_CS_RULES);
 
 var CABF_TLS_CSR_RULES = CABF_TLS_RULES.filter(function (r) {
   return CABF_TLS_CSR_RULE_IDS.indexOf(r.id) !== -1;

package/lib/oid.js

@@ -127,7 +127,8 @@ var FAMILIES = Object.assign(Object.create(null), {
     "smime-mailbox-legacy": [5, 1, 1], "smime-mailbox-multipurpose": [5, 1, 2], "smime-mailbox-strict": [5, 1, 3],
     "smime-organization-legacy": [5, 2, 1], "smime-organization-multipurpose": [5, 2, 2], "smime-organization-strict": [5, 2, 3],
     "smime-sponsor-legacy": [5, 3, 1], "smime-sponsor-multipurpose": [5, 3, 2], "smime-sponsor-strict": [5, 3, 3],
-    "smime-individual-legacy": [5, 4, 1], "smime-individual-multipurpose": [5, 4, 2], "smime-individual-strict": [5, 4, 3] } },
+    "smime-individual-legacy": [5, 4, 1], "smime-individual-multipurpose": [5, 4, 2], "smime-individual-strict": [5, 4, 3],
+    "code-signing-ev": 3, "code-signing": [4, 1], "code-signing-timestamping": [4, 2] } },
 
   idCp: { base: [1, 3, 6, 1, 5, 5, 7, 14], of: { "id-cp-ipAddr-asNumber": 2, "id-cp-ipAddr-asNumber-v2": 3 } },
 
@@ -139,6 +140,17 @@ var FAMILIES = Object.assign(Object.create(null), {
    *  generation. */
   adobe: { base: [1, 2, 840, 113583, 1, 1, 9], of: { "adobe-timestamp": 1, "adobe-archive-rev-info": 2 } },
 
+  /** @internal The extended key purposes Code Signing BR sec. 7.1.2.3 (f) names as MAY beside
+   *  id-kp-codeSigning, so a row reporting any other purpose can exclude them by name. Document
+   *  Signing is registered twice: Microsoft assigns it 1.3.6.1.4.1.311.10.3.12, the sibling of the
+   *  Lifetime Signing arc printed two lines above it in that clause, and the clause itself prints
+   *  1.3.6.1.4.1.311.3.10.3.12. Both resolve, so a certificate carrying either is read as the
+   *  purpose the clause permits. */
+  msEku: { base: [1, 3, 6, 1, 4, 1, 311], of: {
+    "ms-lifetime-signing": [10, 3, 13],
+    "ms-document-signing": [10, 3, 12],
+    "ms-document-signing-as-printed": [3, 10, 3, 12] } },
+
   gsmaRspRole: { base: [2, 23, 146, 1, 2, 1], of: {
     "id-rspRole-ci": 0, "id-rspRole-euicc-v2": 1, "id-rspRole-euicc": [0, 0, 0, 0, 0],
     "id-rspRole-eum-v2": 2, "id-rspRole-eum": [0, 0, 0],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.8.18",
+  "version": "0.8.20",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:d298e2df-b5dc-4670-a00b-3f63a3d1a174",
+  "serialNumber": "urn:uuid:8eac5f1d-fefa-406c-937a-2a4c3d5e7164",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-09-24T09:13:14.788Z",
+    "timestamp": "2026-09-24T11:09:13.708Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.8.18",
+      "bom-ref": "@blamejs/pki@0.8.20",
       "type": "application",
       "name": "pki",
-      "version": "0.8.18",
+      "version": "0.8.20",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.8.18",
+      "purl": "pkg:npm/%40blamejs/pki@0.8.20",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.8.18",
+      "ref": "@blamejs/pki@0.8.20",
       "dependsOn": []
     }
   ]