@blamejs/pki 0.8.27 → 0.8.30

package/lib/lint.js

@@ -363,6 +363,7 @@ function _criticalityRule(name, id, severity, citation, message) {
 var RFC5280_RULES = [
   {
     id: "lint/rfc5280/signature-empty", severity: "error", source: "rfc5280", citation: "RFC 5280 4.1.1.3",
+    readsSignatureValue: true,
     /** @internal The strict parser admits an empty BIT STRING, since one is well-formed DER; a
      * signatureValue that contains no signature is not the field section 4.1.1.3 defines. */
     message: "the signatureValue contains no signature",
@@ -3949,7 +3950,7 @@ var RFC9881_RULES = [
   },
   {
     id: "lint/rfc9881/mldsa-signature-length", severity: "error", source: "rfc9881",
-    citation: "RFC 9881 4 / FIPS 204",
+    citation: "RFC 9881 4 / FIPS 204", readsSignatureValue: true,
     /** @internal The signature is the FIPS 204 value carried directly in the BIT STRING, and FIPS 204
      * fixes its length per parameter set as it fixes the public key's. So a signatureValue of any other
      * length is not a signature of the algorithm the identifier names, whatever a verifier would later
@@ -4218,6 +4219,7 @@ function _criticalityRows(list, table, what) {
 var RFC5280_CRL_RULES = [
   {
     id: "lint/rfc5280-crl/signature-empty", severity: "error", source: "rfc5280-crl", citation: "RFC 5280 5.1.1.3",
+    readsSignatureValue: true,
     message: "the signatureValue contains no signature",
     check: function (crl) { return crl.signatureValue.bytes.length === 0 ? true : null; },
   },
@@ -4702,7 +4704,7 @@ function _cnsaSignatureRow(id, citation, reader) {
  *  registry passes returns the length and whether it is octet-aligned. */
 function _cnsaSignatureLengthRow(id, citation, algReader, lengthReader) {
   return {
-    id: id, severity: "error", source: "cnsa-2.0", citation: citation,
+    id: id, severity: "error", source: "cnsa-2.0", citation: citation, readsSignatureValue: true,
     message: "the signature is not the length FIPS 204 fixes for its algorithm",
     appliesTo: function (artifact, ctx) {
       var sig = algReader(artifact);
@@ -5260,6 +5262,7 @@ function _placementRow(name, placed, where) {
 var RFC6960_OCSP_RULES = [
   {
     id: "lint/rfc6960/signature-empty", severity: "error", source: "rfc6960", citation: "RFC 6960 2.2",
+    readsSignatureValue: true,
     message: "a definitive response shall be digitally signed; the signature BIT STRING is empty",
     check: function (resp) { return _ocspBasic(resp).signature.length === 0 ? true : null; },
   },
@@ -7270,6 +7273,126 @@ function profiles() {
   return out;
 }
 
+/** @internal The rules the build-time gate does not refuse on because the SPEC does not place the
+ * requirement on the issuer, keyed by the last segment of the rule id so one entry answers for every
+ * profile carrying the rule: a certificate reports lint/rfc5280/unknown-critical-extension and a
+ * revocation list reports lint/rfc5280-crl/unknown-critical-extension, and the two state one
+ * requirement. The value is the reason, read by the gate's conformance vectors rather than restated.
+ *
+ * The other reason a rule cannot apply, that it reads a signature the gate has not produced yet, is
+ * not a name here: those rules declare `readsSignatureValue` where they are defined, and
+ * SIGNATURE_VALUE_RULES below derives the set from the same registries `rules()` walks. A rule that
+ * starts reading the signature value therefore exempts itself, and a vector measures the declared set
+ * against the rules whose verdict actually moves with the signature. */
+var BUILD_GATE_EXEMPT = Object.assign(Object.create(null), {
+  "unknown-critical-extension": "RFC 5280 sec. 4.2 places this requirement on \"a certificate-using system\", so the rule reports what a relying party owes rather than what an issuer does. It covers two artifacts an issuer may conform in emitting: one carrying a critical extension the specification does not identify, which the same section permits a conforming CA to support, and one carrying an extension the specification does identify but this toolkit's own path validation does not process, such as a critical policyMappings",
+});
+
+/** @internal Every rule id whose verdict reads the signature VALUE, derived at load from the rule rows
+ * themselves rather than listed. The gate runs on an artifact carrying a placeholder signature, so one
+ * of these answers about the placeholder and not about what the caller is asking to emit. */
+var SIGNATURE_VALUE_RULES = (function () {
+  var out = Object.create(null);
+  Object.keys(BY_ARTIFACT).forEach(function (artifact) {
+    Object.keys(BY_ARTIFACT[artifact]).forEach(function (name) {
+      BY_ARTIFACT[artifact][name].forEach(function (r) {
+        if (r.readsSignatureValue === true) out[r.id] = true;
+      });
+    });
+  });
+  return out;
+})();
+
+/** @internal The profile whose rows an artifact is held to whatever the caller names. RFC 5280 states
+ * the contract a certificate and a revocation list are written to and RFC 2986 the one a request is,
+ * so these run on every authoring call and `opts.profile` names rows beside them. */
+var BUILD_GATE_ALWAYS = Object.assign(Object.create(null), {
+  certificate: "rfc5280", csr: "rfc2986", crl: "rfc5280-crl",
+});
+
+var BUILD_GATE_VERB = Object.assign(Object.create(null), {
+  certificate: certificate, csr: csr, crl: crl,
+});
+
+/** @internal The profile name that runs no rules. A toolkit that cannot emit a non-conforming artifact
+ * cannot build the corpus its own linter is tested against, and an operator reproducing a real
+ * misissuance needs the same. The escape is a name the caller writes rather than an absence, so a
+ * non-conforming artifact is one somebody asked for: the gate is closed by default and every refusal
+ * names this among the profiles it would accept. */
+var BUILD_GATE_NONE = "none";
+
+/** @internal The exemption table, copied so a caller cannot edit the gate's own line. The gate's
+ * vectors read the reasons from here, which is why it is reachable at all. */
+function buildGateExemptions() {
+  return Object.assign(Object.create(null), BUILD_GATE_EXEMPT);
+}
+
+/** @internal The rule ids that declared they read the signature value, for the vector that measures
+ * this set against the rules whose verdict actually moves when the signature does. */
+function buildGateSignatureRules() {
+  return Object.assign(Object.create(null), SIGNATURE_VALUE_RULES);
+}
+
+/** @internal The profile a build-time gate always runs for this artifact, for a vector that derives
+ * the expected rule set from the same name the gate uses. */
+function buildGateProfile(artifact) {
+  return BUILD_GATE_ALWAYS[artifact] || null;
+}
+
+function _buildGateTail(id) {
+  var cut = id.lastIndexOf("/");
+  return cut === -1 ? id : id.slice(cut + 1);
+}
+
+/**
+ * @internal Refuse a profile name an authoring verb cannot run, under the CALLER's code, so
+ * `pki.x509.sign` reports an unknown profile in its own domain as it reports every other bad option.
+ * The sentence is the one `pki.lint.rules` gives for the same name, so asking the linter where a
+ * profile lives and asking a builder to hold an artifact to it are answered alike.
+ */
+function assertKnownBuildProfile(artifact, profile, E, code) {
+  if (profile == null || profile === BUILD_GATE_NONE) return;
+  if (typeof profile !== "string") {
+    throw E(code, "profile must be the name of a lint profile (known: " +
+      Object.keys(BY_ARTIFACT[artifact]).join(", ") + ", " + BUILD_GATE_NONE + ")");
+  }
+  if (!Object.prototype.hasOwnProperty.call(BY_ARTIFACT[artifact], profile)) {
+    throw E(code, _profileRefusal(profile, artifact).message + ", or \"" + BUILD_GATE_NONE +
+      "\" to emit what the spec describes without holding it to a profile");
+  }
+}
+
+/**
+ * @internal Refuse to emit an artifact this toolkit's own linter grades `error` or worse. The caller
+ * passes the artifact it is about to sign, carrying a placeholder signature, and the gate runs the
+ * always-on profile for that artifact plus the one the caller named. A finding whose rule id is in
+ * BUILD_GATE_EXEMPT is passed over, and every other one throws under the caller's code naming the
+ * rule and its citation.
+ *
+ * Standards are the contract, so this runs before the signing key is reached: a certificate that was
+ * signed and then discarded is still one a key signed and an audit log recorded. A caller naming the
+ * profile "none" gets no rules and whatever the spec describes.
+ */
+function assertBuildClean(artifact, der, profile, E, code) {
+  if (profile === BUILD_GATE_NONE) return;
+  var verb = BUILD_GATE_VERB[artifact];
+  var reports = [verb(der, { profile: BUILD_GATE_ALWAYS[artifact] })];
+  if (profile != null && profile !== BUILD_GATE_ALWAYS[artifact]) {
+    reports.push(verb(der, { profile: profile }));
+  }
+  for (var r = 0; r < reports.length; r++) {
+    var found = reports[r].findings;
+    for (var i = 0; i < found.length; i++) {
+      var f = found[i];
+      if (f.severity !== "error" && f.severity !== "fatal") continue;
+      if (SIGNATURE_VALUE_RULES[f.id]) continue;
+      if (BUILD_GATE_EXEMPT[_buildGateTail(f.id)]) continue;
+      throw E(code, "this spec describes " + _article(ARTIFACT_NOUN[artifact]) + " " +
+        ARTIFACT_NOUN[artifact] + " that violates " + f.id + " (" + f.citation + "): " + f.message);
+    }
+  }
+}
+
 module.exports = {
   certificate: certificate,
   csr: csr,
@@ -7280,4 +7403,9 @@ module.exports = {
   attrcert: attrcert,
   rules: rules,
   profiles: profiles,
+  assertBuildClean: assertBuildClean,
+  assertKnownBuildProfile: assertKnownBuildProfile,
+  buildGateExemptions: buildGateExemptions,
+  buildGateSignatureRules: buildGateSignatureRules,
+  buildGateProfile: buildGateProfile,
 };

package/lib/ocsp.js

@@ -197,9 +197,16 @@ function _buildRequest(query, opts) {
     var issuer = _certOf(q.issuer, "the issuer certificate");
     return _buildCertID(cert, issuer, hashName).then(function (certID) {
       var reqChildren = [certID];
-      if (q.singleRequestExtensions && q.singleRequestExtensions.length) {
-        if (lightweight) throw _err("ocsp/bad-input", "the lightweight profile permits no singleRequestExtensions (RFC 5019 sec. 2.1.1)");
-        reqChildren.push(b.explicit(0, b.sequence(q.singleRequestExtensions)));
+      if (q.singleRequestExtensions != null) {
+        /** @internal Read through the same door the sibling lists in this module use, so a value that is
+         *  not an array is refused rather than passed over: read as truthy-and-has-length, an object or a
+         *  number produced a Request carrying none of the extensions the caller asked for, and nothing in
+         *  the result said so. */
+        var singles = pkiBuild.reqDenseArray(q.singleRequestExtensions, "singleRequestExtensions", _err, "ocsp/bad-input");
+        if (singles.length) {
+          if (lightweight) throw _err("ocsp/bad-input", "the lightweight profile permits no singleRequestExtensions (RFC 5019 sec. 2.1.1)");
+          reqChildren.push(b.explicit(0, b.sequence(singles)));
+        }
       }
       return b.sequence(reqChildren);
     });

package/lib/schema-crl.js

@@ -168,7 +168,8 @@ var CERTIFICATE_LIST = pkix.signedEnvelope(NS, TBS_CERTLIST, {
  *   var caCert = await pki.x509.sign({ subject: "Issuing CA", subjectPublicKey: await pki.key.export(pair.publicKey),
  *     notBefore: new Date("2026-01-01T00:00:00Z"), notAfter: new Date("2036-01-01T00:00:00Z"),
  *     extensions: { basicConstraints: { cA: true }, keyUsage: ["keyCertSign", "cRLSign"] } }, { key: key });
- *   var der = await pki.crl.sign({ thisUpdate: new Date("2026-01-01T00:00:00Z"), crlNumber: 1n,
+ *   var der = await pki.crl.sign({ thisUpdate: new Date("2026-01-01T00:00:00Z"),
+ *     nextUpdate: new Date("2026-02-01T00:00:00Z"), crlNumber: 1n,
  *     revoked: [{ serialNumber: 0x0a3fn, revocationDate: new Date("2026-01-15T00:00:00Z") }] },
  *     { cert: caCert, key: key });
  *   var crl = pki.schema.crl.parse(der);
@@ -197,8 +198,9 @@ var parse = pkix.makeRecordingParser({ pemLabel: "X509 CRL", PemError: PemError,
  *   var key = await pki.key.export(pair.privateKey);
  *   var caCert = await pki.x509.sign({ subject: "Issuing CA", subjectPublicKey: await pki.key.export(pair.publicKey),
  *     notBefore: new Date("2026-01-01T00:00:00Z"), notAfter: new Date("2036-01-01T00:00:00Z"),
- *     extensions: { basicConstraints: { cA: true }, keyUsage: ["cRLSign"] } }, { key: key });
- *   var pemText = await pki.crl.sign({ thisUpdate: new Date("2026-01-01T00:00:00Z"), crlNumber: 1n, revoked: [] },
+ *     extensions: { basicConstraints: { cA: true }, keyUsage: ["keyCertSign", "cRLSign"] } }, { key: key });
+ *   var pemText = await pki.crl.sign({ thisUpdate: new Date("2026-01-01T00:00:00Z"),
+ *     nextUpdate: new Date("2026-02-01T00:00:00Z"), crlNumber: 1n, revoked: [] },
  *     { cert: caCert, key: key }, { pem: true });
  *   var der = pki.schema.crl.pemDecode(pemText);
  */
@@ -220,8 +222,9 @@ function pemDecode(text, label) { return pkix.pemDecode(text, label || "X509 CRL
  *   var key = await pki.key.export(pair.privateKey);
  *   var caCert = await pki.x509.sign({ subject: "Issuing CA", subjectPublicKey: await pki.key.export(pair.publicKey),
  *     notBefore: new Date("2026-01-01T00:00:00Z"), notAfter: new Date("2036-01-01T00:00:00Z"),
- *     extensions: { basicConstraints: { cA: true }, keyUsage: ["cRLSign"] } }, { key: key });
- *   var der = await pki.crl.sign({ thisUpdate: new Date("2026-01-01T00:00:00Z"), crlNumber: 1n, revoked: [] },
+ *     extensions: { basicConstraints: { cA: true }, keyUsage: ["keyCertSign", "cRLSign"] } }, { key: key });
+ *   var der = await pki.crl.sign({ thisUpdate: new Date("2026-01-01T00:00:00Z"),
+ *     nextUpdate: new Date("2026-02-01T00:00:00Z"), crlNumber: 1n, revoked: [] },
  *     { cert: caCert, key: key });
  *   var pem = pki.schema.crl.pemEncode(der);
  */
@@ -329,7 +332,8 @@ var DOOR = pkix.extensionDoor({
  *   var caCert = await pki.x509.sign({ subject: "Issuing CA", subjectPublicKey: await pki.key.export(pair.publicKey),
  *     notBefore: new Date("2026-01-01T00:00:00Z"), notAfter: new Date("2036-01-01T00:00:00Z"),
  *     extensions: { basicConstraints: { cA: true }, keyUsage: ["keyCertSign", "cRLSign"] } }, { key: key });
- *   var crlDer = await pki.crl.sign({ thisUpdate: new Date("2026-01-01T00:00:00Z"), crlNumber: 7n,
+ *   var crlDer = await pki.crl.sign({ thisUpdate: new Date("2026-01-01T00:00:00Z"),
+ *     nextUpdate: new Date("2026-02-01T00:00:00Z"), crlNumber: 7n,
  *     revoked: [{ serialNumber: 0x0a3fn, revocationDate: new Date("2026-01-15T00:00:00Z"), reason: "keyCompromise" }] },
  *     { cert: caCert, key: key });
  *   var rows = pki.schema.crl.decodeExtensions(crlDer);
@@ -362,7 +366,8 @@ var decodeExtensions = DOOR.decodeExtensions;
  *   var caCert = await pki.x509.sign({ subject: "Issuing CA", subjectPublicKey: await pki.key.export(pair.publicKey),
  *     notBefore: new Date("2026-01-01T00:00:00Z"), notAfter: new Date("2036-01-01T00:00:00Z"),
  *     extensions: { basicConstraints: { cA: true }, keyUsage: ["keyCertSign", "cRLSign"] } }, { key: key });
- *   var crlDer = await pki.crl.sign({ thisUpdate: new Date("2026-01-01T00:00:00Z"), crlNumber: 7n,
+ *   var crlDer = await pki.crl.sign({ thisUpdate: new Date("2026-01-01T00:00:00Z"),
+ *     nextUpdate: new Date("2026-02-01T00:00:00Z"), crlNumber: 7n,
  *     revoked: [{ serialNumber: 0x0a3fn, revocationDate: new Date("2026-01-15T00:00:00Z"), reason: "keyCompromise" }] },
  *     { cert: caCert, key: key });
  *   var e = pki.schema.crl.parse(crlDer).revokedCertificates[0].crlEntryExtensions[0];

package/lib/x509-sign.js

@@ -31,6 +31,7 @@ var schema = require("./schema-engine");
 var pkix = require("./schema-pkix");
 var pkiBuild = require("./pki-build");
 var ct = require("./ct");
+var lint = require("./lint");
 
 var CertificateError = frameworkError.CertificateError;
 var NS = pkix.makeNS("x509", CertificateError, oid);
@@ -47,7 +48,12 @@ var KNOWN_SPEC_KEYS = intrinsic.assign(intrinsic.create(null), {
 });
 var KNOWN_ISSUER_CERT_KEYS = intrinsic.assign(intrinsic.create(null), { key: 1, cert: 1 });
 var KNOWN_ISSUER_EXPLICIT_KEYS = intrinsic.assign(intrinsic.create(null), { key: 1, name: 1, publicKey: 1 });
-var KNOWN_SIGN_OPTS = intrinsic.assign(intrinsic.create(null), { digestAlgorithm: 1, pem: 1, pss: 1 });
+var KNOWN_SIGN_OPTS = intrinsic.assign(intrinsic.create(null), { digestAlgorithm: 1, pem: 1, pss: 1, profile: 1 });
+
+/** @internal The signature the build-time gate lints against, standing in for one that does not exist
+ * until the key is used. It is non-empty so the gate is not answering a rule about its own placeholder,
+ * and the rules that read the signature VALUE are exempt in lint.js for the same reason. */
+var GATE_PLACEHOLDER_SIG = intrinsic.bufferAlloc(64, 0xff);
 
 var KNOWN_EXT_KEYS = intrinsic.assign(intrinsic.create(null), {
   subjectKeyIdentifier: 1, authorityKeyIdentifier: 1, keyUsage: 1, keyUsageCritical: 1,
@@ -493,10 +499,19 @@ function _hasCriticalSan(extSpec) {
  * marks it critical. The two name opposite ends of one exchange, so a spec naming both is refused. A
  * client recovers the signed entry from the issued certificate with `pki.ct.x509CertEntry`.
  *
+ * Before the key is used, the certificate the spec describes is linted against the RFC 5280 profile
+ * and refused with `x509/profile-violation` if any rule grades it `error`, naming the rule and its
+ * clause. Two rules are passed over: one reading the not-yet-written signature, and
+ * `lint/rfc5280/unknown-critical-extension`, whose requirement RFC 5280 sec. 4.2 places on a
+ * certificate-using system rather than on the issuer.
+ *
  * @opts
  *   - `pem` (boolean) -- return a PEM `CERTIFICATE` string instead of DER.
  *   - `pss` (boolean) -- sign an RSA key with RSASSA-PSS instead of PKCS#1 v1.5.
  *   - `digestAlgorithm` (string) -- override the message digest where the algorithm permits a choice.
+ *   - `profile` (string) -- a second lint profile to hold the certificate to beside RFC 5280, named
+ *     from `pki.lint.profiles()`. `"none"` runs no rules at all and emits what the spec describes,
+ *     which is how a deliberately non-conforming certificate is produced.
  * @example
  *   var pair = await pki.key.generate("Ed25519");
  *   var signerSpki = await pki.key.export(pair.publicKey);
@@ -530,6 +545,7 @@ function _sign(spec, issuer, opts) {
         : "explicit form; the issuer takes { key, name, publicKey }, or { key, cert } to take both from a certificate");
     });
   guard.identifier.assertKnownKeys(opts, KNOWN_SIGN_OPTS, _err, "x509/bad-input", "pki.x509.sign has an unknown option ");
+  lint.assertKnownBuildProfile("certificate", opts.profile, _err, "x509/bad-input");
   if (issuer.key == null) throw _err("x509/bad-input", "a signing key (issuer.key, a WebCrypto CryptoKey or a PKCS#8 private key DER/PEM) is required");
 
   var spki = _reqDer(spec.subjectPublicKey, "spec.subjectPublicKey (the SPKI DER of the certified key)");
@@ -596,6 +612,9 @@ function _sign(spec, issuer, opts) {
   tbsChildren.push(b.raw(spki));
   if (exts.length) tbsChildren.push(b.explicit(3, b.sequence(exts)));
   var tbsDer = b.sequence(tbsChildren);
+  lint.assertBuildClean("certificate",
+    b.sequence([tbsDer, scheme.sigAlgId, b.bitString(GATE_PLACEHOLDER_SIG, 0)]),
+    opts.profile, _err, "x509/profile-violation");
 
   return signScheme.signOverTbs(scheme, issuer.key, tbsDer, _signE).then(function (sig) {
     return Promise.resolve(_assertCertVerifies(tbsDer, sig, issuerSpki, scheme)).then(function () {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.8.27",
+  "version": "0.8.30",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:0dc52d70-7641-471f-98fe-c06068d7838f",
+  "serialNumber": "urn:uuid:b9b5ff1a-3017-4ab5-ab52-4eb332fecb31",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-09-28T19:32:41.570Z",
+    "timestamp": "2026-09-29T03:10:30.011Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.8.27",
+      "bom-ref": "@blamejs/pki@0.8.30",
       "type": "application",
       "name": "pki",
-      "version": "0.8.27",
+      "version": "0.8.30",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.8.27",
+      "purl": "pkg:npm/%40blamejs/pki@0.8.30",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.8.27",
+      "ref": "@blamejs/pki@0.8.30",
       "dependsOn": []
     }
   ]