@blamejs/pki 0.8.31 → 0.8.49

package/lib/sigstore.js

@@ -38,9 +38,20 @@ var x509 = require("./schema-x509");
 var pkix = require("./schema-pkix");
 var pathValidate = require("./path-validate");
 var merkle = require("./merkle");
+var tlog = require("./tlog");
+var tsp = require("./tsp-sign");
 var oid = require("./oid");
 var ct = require("./ct");
 var edwardsPoint = require("./edwards-point");
+/** @internal The four verdicts this verifier trusts another module for, captured at load. Each module
+ * exports an ordinary object, so a property fetched at the moment of the call is replaceable: one
+ * answering `verified: true` passes a checkpoint nothing signed, and the same holds for the timestamp,
+ * the embedded SCT and the certification path. */
+var _tlogParseNote = tlog.parseNote;
+var _tlogVerifyCheckpoint = tlog.verifyCheckpoint;
+var _tspVerify = tsp.verify;
+var _ctVerifySct = ct.verifySct;
+var _pathBuild = pathValidate.build;
 
 /** @internal The operations this module decides with, taken at load. The bundle copy every later
  * check runs on settles what is verified, so which function answers "what does this object own" and
@@ -56,6 +67,10 @@ var _freeze = intrinsic.freeze;
 var _stringOf = intrinsic.String;
 var _numberOf = intrinsic.Number;
 var _bigIntOf = intrinsic.BigInt;
+/** @internal The largest log index the verdict's `logIndex` can carry without losing precision, since
+ *  that field is a number while a tree index is a BigInt. One above it is reported as no index rather
+ *  than as a value a caller would read as exact. */
+var _MAX_SAFE_BIGINT = _bigIntOf(Number.MAX_SAFE_INTEGER);
 var _Date = intrinsic.Date;
 var _dateParse = intrinsic.dateParse;
 var _isNaN = intrinsic.numberIsNaN;
@@ -150,6 +165,79 @@ function _hashOf(algorithm) {
 /** @internal The same three algorithms keyed the way a hashedrekord names them. The entry is the
  * authenticated statement of what was signed, so its algorithm is the one the artifact is digested
  * under; the schema enumerates exactly these three. */
+/** @internal The signing-key algorithm a Rekor v0.0.2 entry's `keyDetails` names, as the OID the
+ * leaf's SubjectPublicKeyInfo would carry for it. The entry's statement about the key is held to the
+ * key rather than read in its place, since a verifier that took the declared algorithm could be told
+ * one thing while the signature was made with another. A name outside this table is refused rather
+ * than passed over, because passing over it would accept the statement unchecked. */
+/** @internal What a Rekor `keyDetails` name STATES about the signing key. The name carries more than a
+ * key family: an ECDSA one names its curve and an RSA one its modulus size, and every NIST curve shares
+ * the `ecPublicKey` OID while every RSA size shares `rsaEncryption`. So holding the entry to the family
+ * alone leaves the rest of its own statement unchecked, and an entry can claim P-384 with SHA-384 over a
+ * P-256 key that signed with SHA-256. `curve` is the named-curve OID the SubjectPublicKeyInfo parameters
+ * must carry, and `bits` the exact modulus size the name states. */
+var _KEY_DETAILS_ALG = _freeze(_assign(_create(null), {
+  PKIX_ECDSA_P256_SHA_256: { oid: "ecPublicKey", curve: "prime256v1" },
+  PKIX_ECDSA_P384_SHA_384: { oid: "ecPublicKey", curve: "secp384r1" },
+  PKIX_ECDSA_P521_SHA_512: { oid: "ecPublicKey", curve: "secp521r1" },
+  PKIX_ED25519: { oid: "Ed25519" },
+  PKIX_RSA_PKCS1V15_2048_SHA256: { oid: "rsaEncryption", bits: 2048 },
+  PKIX_RSA_PKCS1V15_3072_SHA256: { oid: "rsaEncryption", bits: 3072 },
+  PKIX_RSA_PKCS1V15_4096_SHA256: { oid: "rsaEncryption", bits: 4096 },
+}));
+
+/** @internal Names this build RECOGNIZES but cannot verify a signature under, mapped to the scheme it
+ * would otherwise have used. A `keyDetails` name states a signature scheme as well as a key, and
+ * signatures here are checked with RSA PKCS#1 v1.5 and ordinary Ed25519. So an entry declaring RSA-PSS
+ * would have had a PKCS#1 v1.5 signature accepted for it, and one declaring Ed25519ph an ordinary
+ * Ed25519 signature: the declaration would be read and then not honored, which is the one outcome a
+ * declaration must never have. They are refused instead, and refused by NAME so the message says which
+ * scheme is missing rather than reporting an unknown algorithm.
+ *
+ * Re-open condition: each becomes a row in the table above once its scheme is carried into signature
+ * verification. RSA-PSS needs the padding and salt length threaded from the entry to the verify call;
+ * Ed25519ph needs a pre-hashed Ed25519 the runtime does not currently offer. */
+var _KEY_DETAILS_UNVERIFIABLE = _freeze(_assign(_create(null), {
+  PKIX_ED25519_PH: "Ed25519ph, a pre-hashed Ed25519",
+  PKIX_RSA_PSS_2048_SHA256: "RSASSA-PSS",
+  PKIX_RSA_PSS_3072_SHA256: "RSASSA-PSS",
+  PKIX_RSA_PSS_4096_SHA256: "RSASSA-PSS",
+}));
+
+/** @internal The rest of what a `keyDetails` name states, held to the key. The family OID is compared by
+ * the caller; this is the curve an ECDSA name carries and the modulus size an RSA name carries, neither of
+ * which the OID distinguishes. An Ed25519 name states nothing further, its OID being the whole algorithm.
+ * A name whose parameters the key does not match is `entry-mismatch`, the same verdict as a family that
+ * does not match: the entry describes a key other than the one in the bundle either way. */
+function _assertKeyDetailsParameters(want, leafSpki, declared) {
+  if (want.curve !== undefined) {
+    var params = leafSpki.algorithm.parameters;
+    var named = null;
+    if (params !== null && params !== undefined) {
+      try { named = asn1.read.oid(asn1.decode(params)); }
+      catch (_e) { named = null; }   // allow:swallow-unverified -- parameters this build cannot read name no curve, and the mismatch below is then the verdict
+    }
+    if (named !== oid.byName(want.curve)) {
+      throw _err("sigstore/entry-mismatch", "the Rekor entry states the signing key is " +
+        guard.text.showValue(declared) + ", whose curve is " + want.curve +
+        ", while the bundle's leaf key is on " +
+        (named === null ? "no curve this build reads" : guard.text.showValue(oid.name(named) || named)));
+    }
+  }
+  if (want.bits !== undefined) {
+    var bits;
+    try {
+      bits = guard.crypto.publicKey({ key: leafSpki.bytes, format: "der", type: "spki" })
+        .asymmetricKeyDetails.modulusLength;
+    } catch (_e) { bits = null; }   // allow:swallow-unverified -- a key that will not import has no modulus size to match, and the mismatch below is the verdict
+    if (bits !== want.bits) {
+      throw _err("sigstore/entry-mismatch", "the Rekor entry states the signing key is " +
+        guard.text.showValue(declared) + ", which is " + want.bits + " bits, while the bundle's leaf key is " +
+        (bits === null ? "not an RSA key this build reads" : bits + " bits"));
+    }
+  }
+}
+
 var _HASH_BY_REKOR = _freeze(_assign(_create(null), {
   sha256: { node: "sha256", bytes: 32 },
   sha384: { node: "sha384", bytes: 48 },
@@ -163,28 +251,21 @@ var JSON_MAX = C.LIMITS.JSON_MAX_BYTES;
  * applied alone would admit it one way and refuse it the other. */
 var BUNDLE_MAX_DEPTH = 64;
 
+/** @internal The bundle members read as integers, and so the members whose number tokens must denote
+ *  exactly the integer they are read as. Each goes into the canonical form a signed entry timestamp
+ *  covers, so a rounding spelling verifies under the log's signature while naming another value.
+ *
+ *  Named individually because this reader also parses the in-toto statement, whose `predicate` is
+ *  arbitrary JSON by specification and may legitimately carry fractional numbers. A rule over every
+ *  number in the document would refuse a conforming attestation. */
+var EXACT_INTEGER_BUNDLE_MEMBERS = intrinsic.assign(intrinsic.create(null), {
+  logIndex: 1, integratedTime: 1, treeSize: 1,
+});
+
 var SP = _bufferFrom(" ", "ascii");
 var DSSEV1 = _bufferFrom("DSSEv1", "ascii");
 var _EM_DASH = _fromCharCode(0x2014);
 
-function _parseNoteSig(line) {
-  var prefix = _EM_DASH + " ";
-  if (_strSlice(line, 0, prefix.length) !== prefix) return null;
-  var p = prefix.length, n = line.length;
-  var t1s = p;
-  while (p < n && !pkix.isJsWhitespace(_charCodeAt(line, p))) p += 1;
-  if (p === t1s) return null;
-  var keyId = _strSlice(line, t1s, p);
-  if (_charAt(line, p) !== " ") return null;
-  p += 1;
-  var t2s = p;
-  while (p < n && !pkix.isJsWhitespace(_charCodeAt(line, p))) p += 1;
-  if (p === t2s) return null;
-  var sig = _strSlice(line, t2s, p);
-  if (p !== n) return null;
-  return { keyId: keyId, sig: sig };
-}
-
 function _stripTrailingEquals(s) {
   var i = s.length;
   while (i > 0 && _charAt(s, i - 1) === "=") i -= 1;
@@ -203,9 +284,23 @@ function _isBundleMediaType(mt) {
   return typeof mt === "string" && _hasOwn(_BUNDLE_MEDIA_TYPES, mt);
 }
 
-function _jsonParse(input, code, label) {
+/** @internal `exactIntegerMembers` is passed by the CALLER, because this helper reads two different
+ *  documents and only one of them has members whose numbers mean an integer.
+ *
+ *  The bundle's `logIndex`, `integratedTime` and `treeSize` enter the canonical form a signed entry
+ *  timestamp covers, so a spelling that rounds to a different value than it denotes verifies while the
+ *  value reported is not the one the log signed, and `1.0000000000000001` converts to the Number 1 so no
+ *  check made after conversion can tell.
+ *
+ *  The in-toto STATEMENT carries none: its `predicate` is arbitrary JSON by specification, so a predicate
+ *  is passed no policy at all. Naming members here instead would constrain a predicate field for merely
+ *  sharing a name with log metadata, and `predicate: { integratedTime: 0.5 }` is as conforming as
+ *  `predicate: { score: 0.5 }`. A document-wide rule and a name-matched one fail the same way; what the
+ *  rule has to follow is which DOCUMENT is being read. */
+function _jsonParse(input, code, label, exactMembers) {
   return guard.json.parse(input, _err, {
     maxBytes: JSON_MAX, maxDepth: BUNDLE_MAX_DEPTH,
+    exactIntegerMembers: exactMembers,
     badJson: code, tooDeep: code, duplicateMember: code, tooLarge: code, badInput: code, label: label,
   });
 }
@@ -283,7 +378,7 @@ function _b64(s, label) {
 function parseBundle(input) {
   var obj;
   if (_isBuffer(input) || typeof input === "string") {
-    obj = _jsonParse(input, "sigstore/bad-bundle", "bundle");
+    obj = _jsonParse(input, "sigstore/bad-bundle", "bundle", EXACT_INTEGER_BUNDLE_MEMBERS);
   } else if (input && typeof input === "object") {
     /** @internal An object is copied and read back before a single rule runs on it, so this verb
      * decides what the verifying one decides. Checking the caller's object in place would run its
@@ -616,16 +711,17 @@ function _chainDers(vm) {
 function _rawVerify(keyObj, data, derSig) {
   var t = keyObj.asymmetricKeyType;
   if (t === "ed25519" || t === "ed448") {
-    edwardsPoint.validateSpki(keyObj.export({ type: "spki", format: "der" }), t === "ed25519" ? 6 : 7, SigstoreError, "sigstore/bad-key");
-    return nodeCrypto.verify(null, data, keyObj, derSig);
+    var edSpki = guard.crypto.exportKey(keyObj, { type: "spki", format: "der" });
+    edwardsPoint.validateSpki(edSpki, t === "ed25519" ? 6 : 7, SigstoreError, "sigstore/bad-key");
+    return guard.crypto.verify(null, data, keyObj, derSig);
   }
   var crv = keyObj.asymmetricKeyDetails && keyObj.asymmetricKeyDetails.namedCurve;
   var hash = crv === "secp384r1" ? "sha384" : (crv === "secp521r1" ? "sha512" : "sha256");
-  return nodeCrypto.verify(hash, data, { key: keyObj, dsaEncoding: "der" }, derSig);
+  return guard.crypto.verify(hash, data, { key: keyObj, dsaEncoding: "der" }, derSig);
 }
 function _pubFromSpki(spkiDer, label) {
   var key;
-  try { key = nodeCrypto.createPublicKey({ key: spkiDer, format: "der", type: "spki" }); }
+  try { key = guard.crypto.publicKey({ key: spkiDer, format: "der", type: "spki" }); }
   catch (e) { throw _err("sigstore/bad-key", "invalid " + label + " public key", e); }
   var t = key.asymmetricKeyType;
   if (t === "ed25519" || t === "ed448") {
@@ -648,51 +744,107 @@ function _toMs(x) {
   if (typeof x === "string") { var t = _dateParse(x); return _isNaN(t) ? null : t; }
   return null;
 }
+/** @internal A pinned validity window, resolved to milliseconds ONCE and copied off the caller's object.
+ * `_inWindow` runs on both sides of an await, so a window read from the caller at each check could widen
+ * between two of them. A bound that is present but not a time becomes NaN, which no comparison satisfies,
+ * so an unreadable window keeps the key out exactly as reading it late did. A `validFor` that is not an
+ * object imposes nothing, which is what a missing one does. */
+function _normWindow(vf) {
+  if (vf == null || typeof vf !== "object") return null;
+  /** @internal Each bound is read from the caller ONCE, into a local, and the presence test, the conversion
+   *  and the stored value all read that local. A presence test plus a conversion plus an assignment is
+   *  three reads of one member, and an accessor answering the first two with a bound and the third with
+   *  null would have the window discarded after it had already been parsed. */
+  var rawStart = vf.start, rawEnd = vf.end;
+  var s = rawStart == null ? null : _toMs(rawStart);
+  var e = rawEnd == null ? null : _toMs(rawEnd);
+  var out = _create(null);
+  out.start = rawStart == null ? null : (s === null ? NaN : s);
+  out.end = rawEnd == null ? null : (e === null ? NaN : e);
+  return out;
+}
+/** @internal Copies a caller's bytes when they are bytes, and passes anything else through so the check
+ * that owns the field still reports it. */
+function _maybeSnapshot(v, label) {
+  if (v == null || !guard.bytes.isByteSource(v)) return v;
+  /** @internal Normalized to a byte view before it is copied. The test above admits what
+   *  `guard.bytes.isByteSource` admits, which includes a DataView and an ArrayBuffer, and
+   *  `guard.bytes.snapshot` takes neither, so a pinned key held as the ArrayBuffer
+   *  `Response.arrayBuffer()` returns had the bundle refused for its container rather than its content.
+   *  `snapshotSource` views and copies in one call, and the view shares the caller's store, so the copy
+   *  is still the only allocation. */
+  return guard.bytes.snapshotSource(v, _err, "sigstore/bad-input", label);
+}
 function _inWindow(timeMs, vf) {
   if (!vf) return true;
-  if (vf.start != null) { var s = _toMs(vf.start); if (s === null || !(timeMs >= s)) return false; }
-  if (vf.end != null) { var e = _toMs(vf.end); if (e === null || !(timeMs <= e)) return false; }
+  if (vf.start !== null && !(timeMs >= vf.start)) return false;
+  if (vf.end !== null && !(timeMs <= vf.end)) return false;
   return true;
 }
-function _rekorKey(rekorKeys, keyIdBuf, hint, timeMs) {
+/** @internal The signed tree head, verified through `pki.tlog` rather than re-implemented here. The
+ * one implementation is what holds the note to the shape its specification fixes: the text ends at
+ * the LAST blank line, the body is three non-empty lines, the tree size carries no leading zero, the
+ * root is 32 bytes, no ASCII control byte appears outside a newline, and the signature lines are
+ * capped.
+ *
+ * Which log signed it is the load-bearing part. The entry names its log in `logId.keyId`, and only
+ * that log's key is offered to the verify, because a valid signature from a second pinned log over
+ * the same tree root is a statement about that log's tree and not about this entry's. Resolving on
+ * the four-byte hint alone accepted one for the other. With no `logId.keyId` the entry claims no log,
+ * so there is nothing to bind and every key valid at the instant is offered.
+ *
+ * The key name comes from the note's own signature lines. The identifier derivation binds the name to
+ * the key material for the algorithms where the name is in it, so a line that renames a key no longer
+ * matches its identifier; for ECDSA the identifier is the key material alone and the binding is the
+ * pinned key itself. Returns the verified checkpoint, whose size and root the fold then uses, or
+ * `null` when no pinned key signed it. */
+async function _verifyCheckpoint(envelope, te, rekorKeys, timeMs) {
+  var claimed = te.logId && te.logId.keyId ? _b64(te.logId.keyId, "logId.keyId") : null;
+  var usable = [];
   for (var i = 0; i < rekorKeys.length; i++) {
     var k = rekorKeys[i];
-    var match = (keyIdBuf && k.keyId && _bufferEquals(k.keyId, keyIdBuf)) ||
-      (hint && k.keyId && k.keyId.length >= 4 && _bufferEquals(_subarray(k.keyId, 0, 4), hint));
-    if (match && _inWindow(timeMs, k.validFor)) return k;
-  }
-  return null;
-}
-
-function _verifyCheckpoint(envelope, ip, rekorKeys, timeMs) {
-  var buf = _bufferFrom(envelope, "utf8");
-  var sep = _bufIndexOf(buf, "\n\n");
-  if (sep < 0) throw _err("sigstore/bad-checkpoint", "the checkpoint has no note/signature separator");
-  var body = _subarray(buf, 0, sep + 1);
-  var lines = _split(_bufToString(body, "utf8"), "\n");
-  if (_bufToString(_b64(lines[2], "checkpoint root"), "hex") !== _bufToString(_b64(ip.rootHash, "inclusionProof.rootHash"), "hex")) {
-    throw _err("sigstore/inclusion-proof-mismatch", "the checkpoint root does not match the inclusion-proof root");
-  }
-  var sigBlock = _split(_bufToString(_subarray(buf, sep + 2), "utf8"), "\n");
-  for (var i = 0; i < sigBlock.length; i++) {
-    var note = _parseNoteSig(sigBlock[i]);
-    if (!note) continue;
-    var blob = _b64(note.sig, "checkpoint signature");
-    if (blob.length < 5) continue;
-    var hint = _subarray(blob, 0, 4), derSig = _subarray(blob, 4);
-    var k = _rekorKey(rekorKeys, null, hint, timeMs);
-    if (!k) continue;
-    if (_rawVerify(_pubFromSpki(k.spki, "Rekor log"), body, derSig)) return true;
-  }
-  return false;
+    if (!_inWindow(timeMs, k.validFor)) continue;
+    if (claimed !== null && !(k.keyId && _bufferEquals(k.keyId, claimed))) continue;
+    /** @internal The caller's own key is validated here, by the function that owns that error, so a
+     * pinned key that does not parse is reported as the trust-material fault it is rather than as a
+     * malformed checkpoint. */
+    _pubFromSpki(k.spki, "Rekor log");
+    guard.list.append(usable, k);
+  }
+  if (!usable.length) return null;
+  var note;
+  try { note = _tlogParseNote(envelope); }
+  catch (e) { throw _err("sigstore/bad-checkpoint", "the checkpoint is not a well-formed signed note: " + e.message, e); }
+  var seen = _create(null), names = [];
+  for (var s = 0; s < note.signatures.length; s++) {
+    var nm = note.signatures[s].keyName;
+    if (seen[nm] === undefined) { seen[nm] = 1; guard.list.append(names, nm); }
+  }
+  var keys = [];
+  for (var u = 0; u < usable.length; u++) {
+    for (var n = 0; n < names.length; n++) guard.list.append(keys, { name: names[n], publicKey: usable[u].spki });
+  }
+  /** @internal Unreachable while the two steps above hold: a parsed note carries at least one
+   * signature line, so `names` is never empty, and an empty `usable` already returned. It is kept
+   * because the two are separate steps and a change to how names are collected should not reach a
+   * verify with no candidate. */
+  if (!keys.length) return null;
+  var v;
+  try { v = await _tlogVerifyCheckpoint(envelope, keys); }
+  catch (e) {
+    /** @internal A signature from a key this caller pinned that does not verify is not a malformed
+     * checkpoint; it is an unattested root, which is the verdict the caller already handles. */
+    if (e && e.code === "tlog/bad-signature") return null;
+    throw _err("sigstore/bad-checkpoint", "the checkpoint is malformed: " + e.message, e);
+  }
+  return v.verified ? v : null;
 }
 
 function _verifySet(te, rekorKeys, timeMs, canonBody) {
   var promise = te.inclusionPromise;
   if (!promise || typeof promise.signedEntryTimestamp !== "string") return false;
   var keyId = te.logId && te.logId.keyId ? _b64(te.logId.keyId, "logId.keyId") : null;
-  var k = _rekorKey(rekorKeys, keyId, null, timeMs);
-  if (!k) return false;
+  if (keyId === null) return false;
   var canonical = _jsonStringify({
     body: canonBody,
     integratedTime: _numOf(te.integratedTime),
@@ -700,7 +852,18 @@ function _verifySet(te, rekorKeys, timeMs, canonBody) {
     logIndex: _numOf(te.logIndex),
   });
   var sig = _b64(promise.signedEntryTimestamp, "signedEntryTimestamp");
-  return _rawVerify(_pubFromSpki(k.spki, "Rekor log"), _bufferFrom(canonical, "utf8"), sig);
+  var msg = _bufferFrom(canonical, "utf8");
+  /** @internal EVERY key the entry's own identifier selects is tried, not the first. A caller may
+   * pin two keys carrying one identifier -- a rotated pair, or a stale entry beside a current one --
+   * and stopping at the first would report "not attested" for a timestamp the second key signed.
+   * That is a denial of a sound bundle rather than a security property. */
+  for (var i = 0; i < rekorKeys.length; i++) {
+    var k = rekorKeys[i];
+    if (!_inWindow(timeMs, k.validFor)) continue;
+    if (!(k.keyId && _bufferEquals(k.keyId, keyId))) continue;
+    if (_rawVerify(_pubFromSpki(k.spki, "Rekor log"), msg, sig)) return true;
+  }
+  return false;
 }
 
 /** @internal The entry rows this build reads, keyed on the entry's OWN kind and apiVersion together.
@@ -710,12 +873,25 @@ function _verifySet(te, rekorKeys, timeMs, canonBody) {
  * unsupported entry. Each row states which content arm it may accompany, because an entry describing
  * a DSSE envelope says nothing about a message signature and the two must agree. */
 var _ENTRY_ROWS = _freeze(_assign(_create(null), {
-  "dsse@0.0.1": { content: "dsseEnvelope", bind: _bindDsseEntry },
-  "hashedrekord@0.0.1": { content: "messageSignature", bind: _bindHashedRekordEntry },
+  "dsse@0.0.1": { contents: _freeze(_assign(_create(null), { dsseEnvelope: 1 })), bind: _bindDsseEntry, time: "set" },
+  "hashedrekord@0.0.1": { contents: _freeze(_assign(_create(null), { messageSignature: 1 })), bind: _bindHashedRekordEntry, time: "set" },
+  /** @internal Rekor v2 supports no DSSE entry type, so a DSSE signature is logged as a
+   * hashedrekord over the hash of its PAE preimage. One row therefore serves both arms, and the
+   * digest it binds differs by arm: the PAE hash for an envelope, the artifact hash for a message
+   * signature. The version is part of the key because a v2 body names its fields differently from a
+   * v0.0.1 one, so reading one shape's names out of the other would report a mismatch rather than an
+   * unsupported entry. `time: "rfc3161"` because Rekor v2 issues no signed entry timestamp. */
+  "hashedrekord@0.0.2": {
+    contents: _freeze(_assign(_create(null), { dsseEnvelope: 1, messageSignature: 1 })),
+    bind: _bindHashedRekordV002Entry, time: "rfc3161",
+  },
 }));
 
 function _entryBody(canonBytes) {
-  var body = _jsonParse(canonBytes, "sigstore/bad-tlog-entry", "Rekor entry body");
+  /** @internal A Rekor entry body carries `logIndex` and `integratedTime` the same way the bundle does,
+   *  and its canonical bytes are what the entry's inclusion is proven over, so the same members apply. */
+  var body = _jsonParse(canonBytes, "sigstore/bad-tlog-entry", "Rekor entry body",
+    EXACT_INTEGER_BUNDLE_MEMBERS);
   if (!body || typeof body !== "object" || _isArray(body)) throw _err("sigstore/bad-tlog-entry", "the Rekor entry body is not a JSON object");
   return body;
 }
@@ -733,7 +909,7 @@ function _entryRow(body, contentType) {
   if (!row) {
     throw _err("sigstore/unsupported-content", "unsupported Rekor entry kind and version: " + guard.text.showValue(key));
   }
-  if (row.content !== contentType) {
+  if (row.contents[contentType] !== 1) {
     throw _err("sigstore/unsupported-content", "the Rekor entry is a " + guard.text.showValue(key) +
       " while the bundle carries a " + contentType + "; the entry and the content arm must describe the same signature");
   }
@@ -841,23 +1017,124 @@ function _bindHashedRekordEntry(body, ms, leafDer) {
   return { algorithm: data.hash.algorithm, node: alg.node, value: data.hash.value };
 }
 
-function _verifyRekor(te, envelope, rekorKeys, leafDer) {
-  return _verifyRekorEntry(te, rekorKeys, leafDer, "dsseEnvelope", function (body) {
-    _bindDsseEntry(body, envelope, leafDer);
+/** @internal The Rekor v2 `hashedrekord` v0.0.2 binding. Proving inclusion of some bytes says
+ * nothing until those bytes are shown to describe THIS artifact and THIS signature, and the entry
+ * body is what the log actually wrote rather than something reconstructed here, so the whole burden
+ * falls on these comparisons. Each leg is separate because dropping any one leaves inclusion proving
+ * nothing about this bundle: the signature, the certificate that made it, and the digest it was made
+ * over.
+ *
+ * The digest differs by arm. For a DSSE envelope Rekor v2 records the hash of the PAE preimage, so it
+ * is recomputed here from the bundle's own envelope; for a message signature it records the
+ * artifact's digest, which the caller confirms against the bytes it supplies, exactly as the v0.0.1
+ * arm does. */
+function _bindHashedRekordV002Entry(body, arm, leafDer, contentType, payloadType, payload) {
+  var spec = body.spec;
+  if (!spec || typeof spec !== "object") {
+    throw _err("sigstore/bad-tlog-entry", "the Rekor hashedrekord v0.0.2 entry has no spec");
+  }
+  var hr = spec.hashedRekordV002;
+  if (!hr || typeof hr !== "object") {
+    throw _err("sigstore/bad-tlog-entry", "the Rekor hashedrekord v0.0.2 entry has no hashedRekordV002 spec");
+  }
+  var sig = hr.signature;
+  if (!sig || typeof sig !== "object" || typeof sig.content !== "string") {
+    throw _err("sigstore/bad-tlog-entry", "the Rekor hashedrekord v0.0.2 entry is missing its signature content");
+  }
+  var bodySig = _b64(sig.content, "Rekor entry signature");
+  var armSig = contentType === "dsseEnvelope"
+    ? _b64(arm.signatures[0].sig, "dsseEnvelope.signatures[0].sig")
+    : _b64(arm.signature, "messageSignature.signature");
+  if (!_bufferEquals(armSig, bodySig)) {
+    throw _err("sigstore/entry-mismatch", "the Rekor entry signature does not match the bundle signature");
+  }
+  var verifier = sig.verifier;
+  if (!verifier || typeof verifier !== "object") {
+    throw _err("sigstore/bad-tlog-entry", "the Rekor hashedrekord v0.0.2 entry is missing its signature verifier");
+  }
+  var x5 = verifier.x509Certificate;
+  if (!x5 || typeof x5 !== "object" || typeof x5.rawBytes !== "string") {
+    throw _err("sigstore/bad-tlog-entry", "the Rekor hashedrekord v0.0.2 verifier carries no x509Certificate rawBytes");
+  }
+  /** @internal A v0.0.2 verifier carries the raw certificate, where a v0.0.1 one carried PEM. */
+  if (!_bufferEquals(_b64(x5.rawBytes, "verifier.x509Certificate.rawBytes"), leafDer)) {
+    throw _err("sigstore/entry-mismatch", "the Rekor entry verifier certificate does not match the bundle leaf certificate");
+  }
+  /** @internal The entry states which algorithm the key is, and that statement is held to the key
+   * itself: a declared algorithm a caller reads instead of the key's own would let the entry name one
+   * thing while the signature was made with another. */
+  /** @internal A declaration that is PRESENT is read, whatever its type. Entering this only for a string
+   *  meant a `keyDetails` of any other type was passed over as though the entry had declared nothing, which
+   *  is the looser of the two readings of one field: an unknown STRING is refused below, so a number would
+   *  have been the way past every check here. Protobuf JSON permits an enum as its numeric value, so a
+   *  number is a shape a real producer emits; this build reads the names, and says so. An ABSENT
+   *  keyDetails is the separate case that states nothing to hold. */
+  if (verifier.keyDetails !== undefined && verifier.keyDetails !== null &&
+      typeof verifier.keyDetails !== "string") {
+    throw _err("sigstore/bad-tlog-entry", "the Rekor entry states a key algorithm as " +
+      guard.text.showValue(verifier.keyDetails) + "; this build reads the enum by NAME, so a declaration " +
+      "it cannot read is refused rather than passed over as though none had been made");
+  }
+  if (typeof verifier.keyDetails === "string") {
+    /** @internal Checked BEFORE the key comparison: a name whose scheme cannot be honored is refused
+     *  whatever key the bundle carries, because verifying it would mean checking the signature under a
+     *  scheme other than the one the entry states. */
+    var missing = _KEY_DETAILS_UNVERIFIABLE[guard.text.keyOf(verifier.keyDetails)];
+    if (missing !== undefined) {
+      throw _err("sigstore/bad-tlog-entry", "the Rekor entry states the signing key is " +
+        guard.text.showValue(verifier.keyDetails) + ", whose signature scheme is " + missing +
+        "; this build verifies RSA PKCS#1 v1.5 and ordinary Ed25519, so honoring that entry would mean " +
+        "checking the signature under a scheme the entry does not name");
+    }
+    var want = _KEY_DETAILS_ALG[verifier.keyDetails];
+    if (want === undefined) {
+      throw _err("sigstore/bad-tlog-entry", "the Rekor entry names a key algorithm this build does not read: " +
+        guard.text.showValue(verifier.keyDetails));
+    }
+    var leafSpki = _parseCert(leafDer, "Fulcio leaf certificate").subjectPublicKeyInfo;
+    if (oid.byName(want.oid) !== leafSpki.algorithm.oid) {
+      throw _err("sigstore/entry-mismatch", "the Rekor entry states the signing key is " +
+        guard.text.showValue(verifier.keyDetails) + " while the bundle's leaf key is not");
+    }
+    _assertKeyDetailsParameters(want, leafSpki, verifier.keyDetails);
+  }
+  var data = hr.data;
+  if (!data || typeof data !== "object" || typeof data.digest !== "string") {
+    throw _err("sigstore/bad-tlog-entry", "the Rekor hashedrekord v0.0.2 entry has no data digest");
+  }
+  var alg = _hashOf(data.algorithm);
+  if (!alg) {
+    throw _err("sigstore/bad-tlog-entry", "the Rekor v0.0.2 entry names a digest algorithm outside the schema: " +
+      (data.algorithm === undefined ? "(none)" : guard.text.showValue(data.algorithm)));
+  }
+  var digest = _b64(data.digest, "hashedRekordV002.data.digest");
+  if (contentType === "dsseEnvelope") {
+    var computed = nodeCrypto.createHash(alg.node).update(pae(payloadType, payload)).digest();
+    if (!guard.crypto.constantTimeEqual(computed, digest)) {
+      throw _err("sigstore/entry-mismatch", "the Rekor entry digest is not the hash of this envelope's " +
+        "signing preimage, so the entry records a different signature than the bundle carries");
+    }
     return null;
-  });
+  }
+  if (digest.length !== alg.bytes) {
+    throw _err("sigstore/bad-tlog-entry", "the Rekor v0.0.2 entry digest is " + digest.length +
+      " bytes where " + data.algorithm + " is " + alg.bytes);
+  }
+  return { algorithm: data.algorithm, node: alg.node, value: _bufToString(digest, "hex") };
+}
+
+async function _verifyRekor(te, envelope, rekorKeys, leafDer, payloadType, payload, externalMs) {
+  return _verifyRekorEntry(te, rekorKeys, leafDer, "dsseEnvelope", envelope, payloadType, payload, externalMs);
 }
 
 /** @internal The message-signature route through the same entry verification. Only the binding
- * differs, so the inclusion proof, the checkpoint and the SET are checked in one place for both arms
- * rather than in a copy per arm. */
-function _verifyRekorMessage(te, ms, rekorKeys, leafDer) {
-  return _verifyRekorEntry(te, rekorKeys, leafDer, "messageSignature", function (body) {
-    return _bindHashedRekordEntry(body, ms, leafDer);
-  });
+ * differs, so the inclusion proof, the checkpoint and the log time are checked in one place for both
+ * arms rather than in a copy per arm. */
+async function _verifyRekorMessage(te, ms, rekorKeys, leafDer, externalMs) {
+  return _verifyRekorEntry(te, rekorKeys, leafDer, "messageSignature", ms, null, null, externalMs);
 }
 
-function _verifyRekorEntry(te, rekorKeys, leafDer, contentType, bind) {
+async function _verifyRekorEntry(te, rekorKeys, leafDer, contentType, arm, payloadType, payload, externalMs) {
   var ip = te.inclusionProof;
   if (!ip || typeof ip.rootHash !== "string" || !_isArray(ip.hashes)) {
     throw _err("sigstore/bad-inclusion-proof", "the transparency-log entry has no inclusion proof");
@@ -875,75 +1152,159 @@ function _verifyRekorEntry(te, rekorKeys, leafDer, contentType, bind) {
   }
   var canonBytes = _b64(canonB64, "canonicalizedBody");
   var body = _entryBody(canonBytes);
-  _entryRow(body, contentType);
-  var artifactHash = bind(body);
+  var row = _entryRow(body, contentType);
+  var artifactHash = row.bind(body, arm, leafDer, contentType, payloadType, payload) || null;
+  /** @internal The instant a pinned Rekor key's validity window is judged at. An entry carrying a
+   * signed entry timestamp dates itself, so that is the instant. A Rekor v2 entry does not: its
+   * `integratedTime` is always zero and must be ignored, so the instant is the one established
+   * outside the log, from a timestamp token or from the caller. */
+  var atMs = row.time === "set" ? claimedMs : externalMs;
+  /** @internal The checkpoint is verified BEFORE the fold, and the fold then uses the size and the
+   * root IT carries. The `inclusionProof` fields naming a root and a tree size are covered by no
+   * signature, so folding against them and comparing afterwards decides the proof against a number
+   * the bundle chose. Verifying first means the only root in scope is an attested one. */
+  var cpResult = (ip.checkpoint && typeof ip.checkpoint.envelope === "string")
+    ? await _verifyCheckpoint(ip.checkpoint.envelope, te, rekorKeys, atMs) : null;
+  if (!cpResult) throw _err("sigstore/unsigned-root", "the Rekor checkpoint (the signed tree root) did not verify under the Rekor key this entry names -- the inclusion-proof root is not attested");
+  var checkpoint = cpResult.checkpoint;
+  /** @internal WHICH field positions the leaf depends on the log's generation. Rekor v2 states the index
+   *  once, at the top level: its client guidance says the log index "should be read from the top-level
+   *  TransparencyLogEntry.log_index", and that `inclusion_proof.log_index` is one of the fields
+   *  "repeated elsewhere and should be ignored", along with the proof's own `root_hash` and `tree_size`
+   *  that the checkpoint already supplies above. Folding against a field a conforming log need not
+   *  populate, and reporting it as the entry's index, gave a caller a number that does not find the
+   *  entry in the log. A Rekor v1 entry carries two different numbers, a global index and a
+   *  shard-relative one, and the proof folds against the shard the checkpoint covers, so there the
+   *  proof's own field is the one that positions the leaf and the entry's is what the signed entry
+   *  timestamp covers.
+   *  ONE conversion either way, bound here and used both to fold the proof and to report the result.
+   *  Converting the field twice let the two disagree: `BigInt` reads a single element array through its
+   *  string form, so `["1"]` folds as leaf 1 and verifies, while a second numeric conversion of the same
+   *  field gives NaN and the verdict then said it had no index at all. */
+  var leafIsFromProof = row.time === "set";
+  var proofLeaf;
+  try { proofLeaf = _bigIntOf(leafIsFromProof ? ip.logIndex : te.logIndex); }
+  catch (e) {
+    throw _err("sigstore/bad-inclusion-proof",
+      (leafIsFromProof ? "the inclusion proof's logIndex" : "the entry's logIndex") + " is not an integer", e);
+  }
   var included;
   try {
     included = merkle.verifyInclusion({
-      leafIndex: _bigIntOf(ip.logIndex),
-      treeSize: _bigIntOf(ip.treeSize),
+      leafIndex: proofLeaf,
+      treeSize: checkpoint.treeSize,
       leafHash: merkle.leafHash(canonBytes),
       proof: _map(ip.hashes, function (h, i) { return _b64(h, "inclusionProof.hashes[" + i + "]"); }),
-      rootHash: _b64(ip.rootHash, "inclusionProof.rootHash"),
+      rootHash: checkpoint.rootHash,
     });
   } catch (e) {
     throw _err("sigstore/bad-inclusion-proof", "the inclusion proof is malformed: " + e.message, e);
   }
-  if (!included) throw _err("sigstore/inclusion-proof-mismatch", "the inclusion proof does not reconstruct the tree root");
-  var checkpointOk = ip.checkpoint && typeof ip.checkpoint.envelope === "string" && _verifyCheckpoint(ip.checkpoint.envelope, ip, rekorKeys, claimedMs);
-  if (!checkpointOk) throw _err("sigstore/unsigned-root", "the Rekor checkpoint (the signed tree root) did not verify under the caller Rekor key -- the inclusion-proof root is not attested");
-  var setOk = _verifySet(te, rekorKeys, claimedMs, canonB64);
-  if (!setOk) throw _err("sigstore/unattested-time", "the Rekor SET (the signed source of integratedTime) did not verify -- the log time is not attested and cannot date the Fulcio certificate");
-  var t = _numOf(te.integratedTime);
-  if (!_isFiniteNumber(t) || t < 0) throw _err("sigstore/bad-tlog-entry", "the transparency-log entry has a malformed integratedTime");
-  var li = _numOf(te.logIndex);
+  if (!included) throw _err("sigstore/inclusion-proof-mismatch", "the inclusion proof does not reconstruct the tree root the checkpoint attests");
+  /** @internal Only an entry whose log issues a signed entry timestamp has one to check. Rekor v2
+   * issues none and writes `integratedTime` as zero, so reading it as a log time would date an
+   * ephemeral certificate against a value nothing signed and nobody claimed; the instant for such an
+   * entry comes from a timestamp token instead, and `integratedTime` is left null here so no caller
+   * can mistake the absence for a time. */
+  var integratedTime = null;
+  if (row.time === "set") {
+    if (!_verifySet(te, rekorKeys, claimedMs, canonB64)) {
+      throw _err("sigstore/unattested-time", "the Rekor SET (the signed source of integratedTime) did not verify -- the log time is not attested and cannot date the Fulcio certificate");
+    }
+    var t = _numOf(te.integratedTime);
+    if (!_isFiniteNumber(t) || t < 0) throw _err("sigstore/bad-tlog-entry", "the transparency-log entry has a malformed integratedTime");
+    integratedTime = t;
+  }
+  /** @internal The index reported is an ATTESTED one on either path. On v1 the signed entry timestamp
+   *  covers the entry's own `logIndex`, which is a different quantity from the shard-relative index the
+   *  proof folded at, so the two need not agree and comparing them would refuse sound bundles. On v2
+   *  there is one index and the fold above ran at it, so the number reported is the position the proof
+   *  established rather than one the bundle merely stated. */
+  var li = leafIsFromProof ? _numOf(te.logIndex)
+    : (proofLeaf <= _MAX_SAFE_BIGINT ? _numberOf(proofLeaf) : NaN);
+  var signer = cpResult.signers.length ? cpResult.signers[0] : null;
   return {
-    integratedTime: t, logIndex: _isFiniteNumber(li) ? li : null,
+    integratedTime: integratedTime, logIndex: _isFiniteNumber(li) ? li : null,
     logId: te.logId && te.logId.keyId ? _bufToString(_b64(te.logId.keyId, "logId.keyId"), "hex") : null,
     artifactHash: artifactHash,
+    logOrigin: checkpoint.origin,
+    treeSize: checkpoint.treeSize,
+    checkpointKeyId: signer ? _bufToString(signer.keyId, "hex") : null,
   };
 }
 
 
-function _dn(cert, which) { return cert[which] && cert[which].dn; }
+/** @internal The instant an RFC 3161 timestamp token establishes over the signature bytes, in
+ * milliseconds, or null when the bundle carries none or the caller pinned no timestamp-authority
+ * anchor. Rekor v2 issues no signed entry timestamp, so for such a bundle this is the only attested
+ * instant there is and a Fulcio certificate that lives about ten minutes cannot be dated without it.
+ *
+ * Every token offered is tried and every one that verifies contributes its instant, because a bundle
+ * may carry a token from more than one authority and only the ones whose anchor the caller pinned can
+ * be checked. A token that does not verify is passed over rather than refused: it is a statement from
+ * an authority this caller did not pin, which says nothing either way. With no token verifying, the
+ * caller is left with no attested instant and the verdict says so. */
+async function _timestampInstants(vm, sigBytes, tsaRoots) {
+  if (!tsaRoots) return null;
+  var anchors = _normTsaAnchors(tsaRoots);
+  if (!anchors.length) {
+    throw _err("sigstore/bad-input", "opts.tsaRoots names no anchor; omit it rather than passing an " +
+      "empty list, which would read as a timestamp policy that checks nothing");
+  }
+  var tvd = vm.timestampVerificationData;
+  if (!tvd || typeof tvd !== "object") return [];
+  var tokens = _isArray(tvd.rfc3161Timestamps) ? tvd.rfc3161Timestamps : [];
+  if (tokens.length > C.LIMITS.TLOG_MAX_COUNT) {
+    throw _err("sigstore/bad-bundle", "a bundle offers at most " + C.LIMITS.TLOG_MAX_COUNT +
+      " RFC 3161 timestamps; this one offers " + tokens.length);
+  }
+  /** @internal EVERY verified token's instant is returned, not the first. A bundle may carry a token over
+   * an archived signature alongside the one made at signing, and the later instant can fall outside the
+   * ephemeral certificate's validity while the earlier proves signing inside it. Stopping at the first
+   * refused such a bundle for `sigstore/chain-invalid`, which is a denial of a sound bundle rather than a
+   * security property; the caller tries each. Duplicates are dropped so two tokens naming one second cost
+   * one attempt. */
+  var instants = [];
+  for (var i = 0; i < tokens.length; i++) {
+    var t = tokens[i];
+    var der = t && typeof t.signedTimestamp === "string"
+      ? _b64(t.signedTimestamp, "rfc3161Timestamps[" + i + "].signedTimestamp") : null;
+    if (der === null) continue;
+    var res;
+    try { res = await _tspVerify(der, sigBytes, { trustAnchors: anchors }); }
+    catch (_e) { continue; } // allow:swallow-unverified a token this caller cannot check says nothing; the next is tried and a bundle with none verifying is refused for want of an instant
+    if (!res || res.valid !== true || res.trusted !== true) continue;
+    var ms = guard.time.instantOf(res.genTime);
+    if (!_isFiniteNumber(ms)) continue;
+    var seen = false;
+    for (var j = 0; j < instants.length; j++) if (instants[j] === ms) { seen = true; break; }
+    if (!seen) guard.list.append(instants, ms);
+  }
+  return instants;
+}
+
+/** @internal A timestamp-authority anchor from the same `{ der }` shape the other trust material
+ * takes, converted to the anchor `pki.tsp.verify` names. A caller pins one kind of thing. */
+function _normTsaAnchors(tsaRoots) {
+  var list = _isArray(tsaRoots) ? tsaRoots : [tsaRoots];
+  return _map(list, function (r, i) {
+    var der = _isBuffer(r) ? r : (r && (r.der || r.rawBytes));
+    if (!_isBuffer(der)) throw _err("sigstore/bad-input", "tsaRoots[" + i + "] must be a DER Buffer or { der }");
+    var cert = _parseCert(der, "timestamp-authority root [" + i + "]");
+    return { name: cert.subject, publicKey: cert.subjectPublicKeyInfo.bytes,
+      algorithm: cert.subjectPublicKeyInfo.algorithm.oid };
+  });
+}
+
 
 function _normRoots(fulcioRoots) {
   return _map(fulcioRoots, function (r, i) {
     var der = _isBuffer(r) ? r : (r && (r.der || r.rawBytes));
     if (!_isBuffer(der)) throw _err("sigstore/bad-input", "fulcioRoots[" + i + "] must be a DER Buffer or { der, validFor }");
-    return { cert: _parseCert(der, "Fulcio CA root [" + i + "]"), validFor: (r && r.validFor) || null };
+    return { cert: _parseCert(der, "Fulcio CA root [" + i + "]"), validFor: _normWindow(r && r.validFor) };
   });
 }
 
-function _pathToAnchor(leaf, anchor, intBySubject) {
-  var anchorSubj = _dn(anchor, "subject");
-  /** @internal Issuers are collected leaf-first and the path is assembled once, so no element is
-   * ever moved to a new index: an indexed setter has nothing to intercept and cannot replace the
-   * leaf the preceding signature checks authenticated. */
-  var above = [], cur = leaf, seen = _create(null), guardN = 0;
-  function assemble() {
-    var path = [];
-    for (var k = above.length - 1; k >= 0; k--) guard.list.append(path, above[k]);
-    guard.list.append(path, leaf);
-    return path;
-  }
-  while (guardN++ < 16) {
-    var issuerDn = _dn(cur, "issuer");
-    if (issuerDn === anchorSubj) return assemble();
-    var cands = intBySubject[issuerDn] || [];
-    var next = null;
-    for (var j = 0; j < cands.length; j++) {
-      if (cands[j] === anchor || seen[_dn(cands[j], "subject")]) continue;
-      next = cands[j]; break;
-    }
-    if (!next) return null;
-    seen[_dn(next, "subject")] = 1;
-    guard.list.append(above, next);
-    cur = next;
-  }
-  return null;
-}
-
 var OID_SCT_LIST = oid.byName("signedCertificateTimestampList");
 
 /** @internal The certificate-transparency logs a caller pins, in the shape the Rekor keys take: an
@@ -956,7 +1317,24 @@ function _normCtLogs(ctLogs) {
     if (l === null || typeof l !== "object") throw _err("sigstore/bad-input", "ctLogs[" + i + "] must be { keyId, spki, validFor? }");
     if (!_isBuffer(l.keyId)) throw _err("sigstore/bad-input", "ctLogs[" + i + "].keyId must be the log id as a Buffer");
     if (!_isBuffer(l.spki)) throw _err("sigstore/bad-input", "ctLogs[" + i + "].spki must be the log's SubjectPublicKeyInfo DER");
-    return { keyId: l.keyId, spki: l.spki, validFor: l.validFor || null };
+    return { keyId: _maybeSnapshot(l.keyId, "ctLogs[" + i + "].keyId"),
+      spki: _maybeSnapshot(l.spki, "ctLogs[" + i + "].spki"), validFor: _normWindow(l.validFor) };
+  });
+}
+
+/** @internal The pinned Rekor keys, copied record by record before the first await. `snapshotOptions`
+ * copies the array reference, so each record is still the caller's own object, and the checkpoint and the
+ * signed entry timestamp are verified on either side of an await: a caller replacing a record's `spki`
+ * between them could have the two verified under different key material filed under one identifier, and
+ * the verdict would then attest an entry no single pinned key authenticated. Every field either check
+ * reads is copied here, and the window is resolved with it. */
+function _normRekorKeys(rekorKeys) {
+  if (rekorKeys == null) return [];
+  if (!_isArray(rekorKeys)) throw _err("sigstore/bad-input", "rekorKeys must be an array of { keyId, spki, validFor? }");
+  return _map(rekorKeys, function (k, i) {
+    if (k === null || typeof k !== "object") throw _err("sigstore/bad-input", "rekorKeys[" + i + "] must be { keyId, spki, validFor? }");
+    return { keyId: _maybeSnapshot(k.keyId, "rekorKeys[" + i + "].keyId"),
+      spki: _maybeSnapshot(k.spki, "rekorKeys[" + i + "].spki"), validFor: _normWindow(k.validFor) };
   });
 }
 
@@ -965,9 +1343,10 @@ function _normCtLogs(ctLogs) {
  * `pki.ct.x509CertEntry` reconstructs exactly that entry from the final certificate, and each receipt
  * is checked against the log the caller pinned for it. At least one must verify, which is the sec. 3.3
  * floor; a receipt from a log the caller did not pin counts for nothing. */
-async function _verifyEmbeddedScts(leaf, leafDer, issuer, ctLogs, timeMs, atMs) {
-  if (ctLogs === undefined || ctLogs === null) return { checked: false, validScts: 0 };
-  var logs = _normCtLogs(ctLogs);
+async function _verifyEmbeddedScts(leaf, leafDer, issuer, logs, timeMs, atMs) {
+  /** @internal `logs` arrives ALREADY normalized, from before the first await, for the reason given at
+   *  `_verifyChain`: a list read after a yield is the caller's array as it stands then. */
+  if (logs === undefined || logs === null) return { checked: false, validScts: 0 };
   var ext = null;
   var exts = leaf.extensions || [];
   for (var i = 0; i < exts.length; i++) { if (exts[i].oid === OID_SCT_LIST) { ext = exts[i]; break; } }
@@ -1004,7 +1383,7 @@ async function _verifyEmbeddedScts(leaf, leafDer, issuer, ctLogs, timeMs, atMs)
 /** @internal A receipt the verifier refuses structurally counted as verified would be the whole leg
  * lost, so a fault is an unverified receipt and the next one is still tried. */
 function _sctVerifies(entry, sct, spki) {
-  return ct.verifySct(entry, sct, spki).then(function (ok) { return ok === true; }, function () { return false; });
+  return _ctVerifySct(entry, sct, spki).then(function (ok) { return ok === true; }, function () { return false; });
 }
 
 /** @internal A receipt's own instant, in milliseconds. The parser's `timestampMs` is this same value
@@ -1019,38 +1398,87 @@ function _ctLogFor(logs, logIdBytes, timeMs) {
   return null;
 }
 
-async function _verifyChain(leaf, chainDers, fulcioRoots, timeMs) {
-  var roots = _normRoots(fulcioRoots);
+/** @internal `roots` arrives ALREADY normalized, from before the first await in `verifyBundle`. Normalizing
+ *  here read the caller's array after a yield, so a caller could add an anchor while verification was
+ *  pending and decide which CA is trusted: an empty list that grows during the timestamp check would have
+ *  passed a chain the call was made without any anchor for. */
+async function _verifyChain(leaf, chainDers, roots, timeMs) {
   var bundleLinks = _map(_arraySlice(chainDers, 1), function (d, i) { return _parseCert(d, "bundle intermediate [" + i + "]"); });
-  var intBySubject = _create(null);
-  function addInt(c) { guard.list.append(intBySubject[_dn(c, "subject")] = intBySubject[_dn(c, "subject")] || [], c); }
-  _forEach(roots, function (r) { addInt(r.cert); });
-  _forEach(bundleLinks, addInt);
-  var candidates = _filter(roots, function (r) { return _inWindow(timeMs, r.validFor); });
-  var lastErr = _err("sigstore/chain-incomplete", "no caller-supplied Fulcio anchor (within its validity window) issues the chain");
-  for (var i = 0; i < candidates.length; i++) {
-    var anchor = candidates[i].cert;
-    var path = _pathToAnchor(leaf, anchor, intBySubject);
-    if (!path) continue;
-    var spki = anchor.subjectPublicKeyInfo;
-    try {
-      var res = await pathValidate.validate(path, {
-        time: new _Date(timeMs),
-        historicalMode: true,
-        trustAnchors: { name: anchor.subject, publicKey: spki.bytes, algorithm: spki.algorithm.oid, parameters: spki.algorithm.parameters },
-        requiredEku: ["codeSigning"],
-      });
-      /** @internal The path is anchor-proximal first and leaf last, so the certificate directly above
-       * the leaf issued it, and the anchor did when the leaf sits alone. Returning it here is what lets
-       * the certificate-transparency leg reconstruct the logged entry without resolving the issuer a
-       * second time, from a chain this leg has already validated. */
-      if (res.valid) return { issuer: path.length > 1 ? path[path.length - 2] : anchor };
-      lastErr = _err("sigstore/chain-invalid", "the Fulcio certificate chain is not valid as of the log time");
-    } catch (e) {
-      lastErr = _err("sigstore/chain-invalid", "the Fulcio certificate chain failed validation: " + e.message, e);
+  var inWindow = _filter(roots, function (r) { return _inWindow(timeMs, r.validFor); });
+  if (!inWindow.length) {
+    throw _err("sigstore/chain-incomplete", "no caller-supplied Fulcio anchor (within its validity window) issues the chain");
+  }
+  /** @internal The search is `pki.path.build`, which owns it. This module walked the pool itself, and the
+   * walk decided which candidates a bound was spent on: a rotated CA reissues under ONE subject DN, so
+   * several bundle certificates chain by name and only one of them signed the leaf. The local walk capped
+   * COLLECTED PATHS and ordered candidates by name alone, so where more than that many same-subject
+   * certificates were issued directly by the anchor the cap was spent on whichever the bundle listed
+   * first and the one that signed the leaf was never validated: a bundle holding a valid path was
+   * reported `chain-invalid`. `build` ranks candidates by the RFC 4158 sec. 3.5 heuristics, the key
+   * identifier among them, EXCLUDING none, and bounds the search by total candidate expansions rather
+   * than by how many paths it has collected, so a later candidate stays reachable and an exhausted
+   * budget is reported as `path/build-limit` rather than as a verdict about the chain. Every assembled
+   * path still flows through `pki.path.validate`, so this delegates the search and duplicates no check.
+   * The anchors go into the pool as well as the trust store, because a cross-signed root appears in a
+   * chain as an intermediate under another anchor. */
+  var anchorTuples = _map(inWindow, function (r) {
+    var spki = r.cert.subjectPublicKeyInfo;
+    return { name: r.cert.subject, publicKey: spki.bytes, algorithm: spki.algorithm.oid, parameters: spki.algorithm.parameters };
+  });
+  var pool = guard.list.snapshot(bundleLinks);
+  _forEach(inWindow, function (r) { guard.list.append(pool, r.cert); });
+  /** @internal A pool past the builder's ceiling is refused HERE, because the builder reports it as a
+   * `path/bad-input` and a bundle carrying too many certificates to search is not a bad argument from
+   * this verb nor a verdict that its chain is invalid: it is a chain this call did not establish. Read
+   * as the builder reads it, against the same ceiling, so the two cannot disagree about which pools
+   * are searchable. */
+  if (pool.length > C.LIMITS.PATH_BUILD_MAX_CANDIDATES) {
+    throw _err("sigstore/chain-incomplete", "the bundle and the supplied anchors together name " +
+      pool.length + " certificates, past the " + C.LIMITS.PATH_BUILD_MAX_CANDIDATES +
+      " the path search will consider, so no chain to an anchor was established");
+  }
+
+  var built;
+  try {
+    built = await _pathBuild(leaf, {
+      candidates: pool,
+      trustAnchors: anchorTuples,
+      time: new _Date(timeMs),
+      historicalMode: true,
+      requiredEku: ["codeSigning"],
+    });
+  } catch (e) {
+    if (e && e.code === "path/no-path") {
+      throw _err("sigstore/chain-incomplete", "no caller-supplied Fulcio anchor (within its validity window) issues the chain", e);
+    }
+    /** @internal A reached search bound is not a verdict about the chain. `build` stops looking when a
+     * bundle's candidates expand past its cap, which a fan-out of same-subject certificates reaching no
+     * anchor does, and this leg then knows no path was established rather than that one was refused. It
+     * reports the incomplete code for that, with the bound as the cause so a caller that wants to tell
+     * the two apart reads `path/build-limit` there. */
+    if (e && e.code === "path/build-limit") {
+      throw _err("sigstore/chain-incomplete", "no chain to a caller-supplied Fulcio anchor was established before the path search reached its candidate bound", e);
+    }
+    throw _err("sigstore/chain-invalid", "the Fulcio certificate chain failed validation: " + e.message, e);
+  }
+  if (!built.valid) {
+    throw _err("sigstore/chain-invalid", "the Fulcio certificate chain is not valid as of the log time");
+  }
+  /** @internal `path` is anchor-proximal first and leaf last with the anchor excluded, so the certificate
+   * directly above the leaf issued it, and the anchor did when the leaf sits alone. Returning it here is
+   * what lets the certificate-transparency leg reconstruct the logged entry without resolving the issuer a
+   * second time, from a chain this leg has already validated. The anchor is matched back to its
+   * CERTIFICATE by its public key rather than by its name, because rotation is exactly the case where two
+   * anchors carry one name and the transparency leg hashes the issuer's KEY. */
+  var path = built.path;
+  if (path.length > 1) return { issuer: path[path.length - 2] };
+  var anchorKey = built.trustAnchor && built.trustAnchor.publicKey;
+  for (var i = 0; i < inWindow.length; i++) {
+    if (_isBuffer(anchorKey) && _bufferEquals(inWindow[i].cert.subjectPublicKeyInfo.bytes, anchorKey)) {
+      return { issuer: inWindow[i].cert };
     }
   }
-  throw lastErr;
+  throw _err("sigstore/chain-invalid", "the validated chain names a trust anchor this call was not given");
 }
 
 
@@ -1118,7 +1546,7 @@ function _fulcioExtValue(ext, leafArc) {
 
 var IDENTITY_FIELDS = ["san", "issuer", "sourceRepositoryURI"];
 var IDENTITY_KEYS = _assign(_create(null), { san: 1, issuer: 1, sourceRepositoryURI: 1 });
-var _VERIFY_BUNDLE_OPTS = _assign(_create(null), { fulcioRoots: 1, rekorKeys: 1, ctLogs: 1, identity: 1, predicateType: 1, time: 1, artifact: 1 });
+var _VERIFY_BUNDLE_OPTS = _assign(_create(null), { fulcioRoots: 1, rekorKeys: 1, ctLogs: 1, identity: 1, predicateType: 1, time: 1, artifact: 1, tsaRoots: 1 });
 
 /** @internal The bytes a message signature covers, taken once. There is no shape here in which a
  * caller hands over a precomputed digest: the arm's own field comment forbids using one as a
@@ -1165,6 +1593,9 @@ function _statement(payload, payloadType, expectedPredicate) {
   if (payloadType !== "application/vnd.in-toto+json") {
     throw _err("sigstore/bad-statement", "unsupported DSSE payloadType: " + payloadType);
   }
+  /** @internal NO member policy. An in-toto `predicate` is arbitrary JSON by specification, so no member
+   *  name in a statement means an integer, and naming one would constrain a predicate field for merely
+   *  sharing a name with the bundle's log metadata. */
   var st = _jsonParse(payload, "sigstore/bad-statement", "in-toto statement");
   if (!st || typeof st !== "object" || st._type !== "https://in-toto.io/Statement/v1") throw _err("sigstore/bad-statement", "the payload is not an in-toto Statement v1");
   if (!_isArray(st.subject) || !st.subject.length) throw _err("sigstore/bad-statement", "the in-toto statement has no subject");
@@ -1238,6 +1669,20 @@ function _statement(payload, payloadType, expectedPredicate) {
  * The verdict has one shape for both arms. `contentType` names the arm, and the
  * fields the other arm has nothing to report are present and `null`.
  *
+ * A Rekor v2 entry (`hashedrekord` v0.0.2) is read on either arm. Rekor v2 supports no DSSE entry
+ * type, so a DSSE signature is logged as a `hashedrekord` over the hash of its signing preimage, and
+ * the entry is bound to the bundle by three separate comparisons: the signature it records, the
+ * certificate that made it, and that digest. Where the entry states `keyDetails`, that statement is
+ * held to the leaf key rather than read in its place.
+ *
+ * Rekor v2 issues no signed entry timestamp and writes `integratedTime` as zero, so it is ignored and
+ * the instant comes from an RFC 3161 timestamp token over the signature bytes, verified against the
+ * anchors `opts.tsaRoots` pins. With neither a token this caller can check nor `opts.time`, the
+ * verdict is `sigstore/no-attested-time`: a Fulcio certificate lives about ten minutes and cannot be
+ * validated against an unattested instant. `timestampSource` reports which of the three dated the
+ * certificate, and `logOrigin`, `treeSize` and `checkpointKeyId` report what the verified checkpoint
+ * said.
+ *
  * @opts
  *   fulcioRoots:   Array,      // the Fulcio CA anchors: a DER Buffer or { der, validFor } each
  *   rekorKeys:     Array,      // [{ keyId, spki, validFor? }] the Rekor log public keys
@@ -1245,7 +1690,8 @@ function _statement(payload, payloadType, expectedPredicate) {
  *   identity:      object,     // optional policy: { san, issuer, sourceRepositoryURI }; at least one required when present
  *   predicateType: string,     // optional: require this in-toto predicateType (e.g. the SLSA URI); dsse_envelope bundles only
  *   artifact:      BufferSource, // the bytes a message_signature covers; required for that arm, refused for a dsse_envelope
- *   time:          Date,       // optional check-date override (default: the Rekor integratedTime)
+ *   tsaRoots:      Array,      // optional timestamp-authority anchors: a DER Buffer or { der } each; required to date a Rekor v2 bundle, which carries no signed entry timestamp
+ *   time:          Date,       // optional check-date override (default: the Rekor integratedTime, or an RFC 3161 token's genTime on a v2 entry)
  *
  * @example
  *   // requires: `bundle` from cosign / npm provenance, and `sigstoreTrust` built from
@@ -1272,8 +1718,13 @@ async function verifyBundle(bundle, opts) {
    * answer: one that passed a refusal could be reported by the verdict as a different value, and a
    * verdict that names an option is naming the value the check ran on. */
   var o = guard.identifier.snapshotOptions(opts, _VERIFY_BUNDLE_OPTS);
-  var rekorKeys = o.rekorKeys || [];
-  var fulcioRoots = o.fulcioRoots || [];
+  var rekorKeys = _normRekorKeys(o.rekorKeys);
+  /** @internal Every pinned trust list is normalized HERE, before the first await, because each is read
+   *  again after one: the anchors by the chain check, the logs by the transparency check. Left to the
+   *  point of use, the list read is the caller's own array as it stands then, and material added while
+   *  verification is pending would decide a check the call was made without it. */
+  var fulcioRoots = _normRoots(o.fulcioRoots || []);
+  var ctLogs = o.ctLogs === undefined || o.ctLogs === null ? o.ctLogs : _normCtLogs(o.ctLogs);
 
   /** @internal Each option belongs to one arm, and one supplied for the other is refused rather than
    * passed over. An ignored option reads as a check that ran: opts.artifact on a DSSE bundle names
@@ -1328,6 +1779,13 @@ async function verifyBundle(bundle, opts) {
    * and when none does the last failure is what the caller is told. */
   var haveCallerTime = guard.time.isDate(o.time);
   var callerTime = haveCallerTime ? guard.time.instantOf(o.time) : null;
+  /** @internal An RFC 3161 token dates itself and chains to anchors the caller pins, so it is
+   * established BEFORE any entry is tried: it needs no log time, and a Rekor v2 entry needs an
+   * instant before its checkpoint key's validity window can be judged. The token must cover the
+   * SIGNATURE bytes, which is what dates the ephemeral certificate that made them; a token over the
+   * payload would date the thing signed rather than the signing. */
+  var tsaMsList = null;
+  if (!haveCallerTime) tsaMsList = await _timestampInstants(vm, derSig, o.tsaRoots);
   var chainDers = _chainDers(vm);
   /** @internal A caller-pinned instant is the same for every candidate, so the chain it decides is
    * computed on the first candidate and reused rather than rebuilt per entry. Without one the instant
@@ -1335,30 +1793,80 @@ async function verifyBundle(bundle, opts) {
    * beside it: a candidate that reaches them and passes is selected immediately, so no later
    * candidate could read the result. */
   var pinnedChain = null;
+  /** @internal A candidate is an ENTRY paired with the instant to date it by, because both decide which
+   * entry is selected and either can be the one that fails. A caller's own instant gives one pair per
+   * entry. Otherwise every verified timestamp gives a pair, since the token a bundle lists first may fall
+   * outside the certificate's validity while a later one proves signing inside it; trying only the first
+   * refused such a bundle. The product is bounded so a hostile bundle cannot multiply the work: the
+   * existing per-list cap is the budget for the pairs too. */
+  var instantsToTry = (haveCallerTime || tsaMsList === null || tsaMsList.length === 0) ? [null] : tsaMsList;
+  if (tlogs.length * instantsToTry.length > C.LIMITS.TLOG_MAX_COUNT) {
+    throw _err("sigstore/bad-bundle", "a bundle offering " + tlogs.length + " transparency-log entries " +
+      "and " + instantsToTry.length + " verified timestamps asks for " + (tlogs.length * instantsToTry.length) +
+      " combinations; at most " + C.LIMITS.TLOG_MAX_COUNT + " are tried");
+  }
+  var attempts = [];
+  for (var ei = 0; ei < tlogs.length; ei++) {
+    for (var xi = 0; xi < instantsToTry.length; xi++) {
+      guard.list.append(attempts, { entry: tlogs[ei], tsaMs: instantsToTry[xi] });
+    }
+  }
   var rekor = null, lastErr = null, artifactComputed = null, sctResult = null;
-  for (var ti = 0; ti < tlogs.length; ti++) {
-    if (!tlogs[ti] || typeof tlogs[ti] !== "object") { lastErr = _err("sigstore/bad-bundle", "a transparency-log entry is not an object"); continue; }
+  /** @internal The artifact's digest under one algorithm, computed once for that algorithm. The
+   *  comparison below is per ATTEMPT and the artifact is the caller's whole file, so an attempt that
+   *  failed after the comparison sent the next one over those bytes again: at the cap of 32 attempts a
+   *  100 MB artifact was hashed 32 times. The same bytes under the same algorithm are the same digest,
+   *  so each algorithm an entry names costs one pass. */
+  var artifactDigests = intrinsic.create(null);
+  function _artifactDigest(nodeName) {
+    if (!intrinsic.hasOwn(artifactDigests, nodeName)) {
+      artifactDigests[nodeName] = nodeCrypto.createHash(nodeName).update(artifact).digest();
+    }
+    return artifactDigests[nodeName];
+  }
+  for (var ti = 0; ti < attempts.length; ti++) {
+    var entry = attempts[ti].entry, tsaMs = attempts[ti].tsaMs;
+    if (!entry || typeof entry !== "object") { lastErr = _err("sigstore/bad-bundle", "a transparency-log entry is not an object"); continue; }
     try {
-      var candidate = isMsg ? _verifyRekorMessage(tlogs[ti], msParsed, rekorKeys, leafDer)
-        : _verifyRekor(tlogs[ti], env, rekorKeys, leafDer);
+      var externalMs = haveCallerTime ? callerTime : (tsaMs === null ? NaN : tsaMs);
+      var candidate = isMsg ? await _verifyRekorMessage(entry, msParsed, rekorKeys, leafDer, externalMs)
+        : await _verifyRekor(entry, env, rekorKeys, leafDer, env.payloadType, payload, externalMs);
       var candidateDigest = null;
       if (isMsg) {
-        candidateDigest = nodeCrypto.createHash(candidate.artifactHash.node).update(artifact).digest();
+        candidateDigest = _artifactDigest(candidate.artifactHash.node);
         if (!guard.crypto.constantTimeEqual(candidateDigest, _bufferFrom(candidate.artifactHash.value, "hex"))) {
           throw _err("sigstore/artifact-mismatch", "the artifact does not match the one the transparency-log entry records; its " +
             candidate.artifactHash.algorithm + " digest is " + _bufToString(candidateDigest, "hex") + " and the entry names " + candidate.artifactHash.value);
         }
       }
-      var candidateTime = haveCallerTime ? callerTime : C.TIME.seconds(candidate.integratedTime);
+      /** @internal Three sources, in the order of what they establish. The caller's own instant wins
+       * where given. Otherwise an entry carrying a signed entry timestamp dates itself. An entry that
+       * does not -- a Rekor v2 one -- is dated by the timestamp token, and with neither there is no
+       * attested instant and nothing can date the ephemeral certificate. */
+      var candidateSource, candidateTime, candidateBound;
+      if (haveCallerTime) {
+        candidateSource = "caller"; candidateTime = callerTime; candidateBound = callerTime;
+      } else if (candidate.integratedTime !== null) {
+        candidateSource = "set";
+        candidateTime = C.TIME.seconds(candidate.integratedTime);
+        /** @internal The authenticated log-entry time's whole second is inclusive: a certificate
+         * logged in the same second as its entry is not dated after it, and nothing beyond that
+         * second is accepted. */
+        candidateBound = candidateTime + 999;
+      } else if (tsaMs !== null) {
+        candidateSource = "rfc3161"; candidateTime = tsaMs; candidateBound = tsaMs;
+      } else {
+        throw _err("sigstore/no-attested-time", "the transparency-log entry carries no signed entry " +
+          "timestamp and the bundle carries no RFC 3161 timestamp this caller can check, so no " +
+          "attested instant dates the ephemeral Fulcio certificate: pin opts.tsaRoots for the " +
+          "timestamp authority, or supply opts.time");
+      }
       var candidateChain = pinnedChain !== null ? pinnedChain
         : await _verifyChain(leaf, chainDers, fulcioRoots, candidateTime);
       if (haveCallerTime) pinnedChain = candidateChain;
-      /** @internal With no caller instant the reference is the authenticated log-entry time, whose
-       * whole second is inclusive: a certificate logged in the same second as its entry is not dated
-       * after it, and nothing beyond that second is accepted. */
-      var candidateBound = haveCallerTime ? candidateTime : C.TIME.seconds(candidate.integratedTime) + 999;
-      var candidateScts = await _verifyEmbeddedScts(leaf, leafDer, candidateChain.issuer, o.ctLogs, candidateTime, candidateBound);
+      var candidateScts = await _verifyEmbeddedScts(leaf, leafDer, candidateChain.issuer, ctLogs, candidateTime, candidateBound);
       rekor = candidate;
+      rekor.timestampSource = candidateSource;
       artifactComputed = candidateDigest;
       sctResult = candidateScts;
       break;
@@ -1378,8 +1886,12 @@ async function verifyBundle(bundle, opts) {
     var computed = artifactComputed;
     artifactDigest = _bufToString(computed, "hex");
     if (msParsed.digest !== null) {
+      /** @internal Through the same memo as the attempts above, so the whole call reads the artifact
+       *  once per algorithm. Matching the selected entry's algorithm was already answered from
+       *  `computed`; a messageDigest naming a DIFFERENT algorithm went around that to hash the artifact
+       *  again, and an earlier attempt that failed under that same algorithm had already hashed it. */
       var againstClaim = msParsed.digestAlg.node === rekor.artifactHash.node ? computed
-        : nodeCrypto.createHash(msParsed.digestAlg.node).update(artifact).digest();
+        : _artifactDigest(msParsed.digestAlg.node);
       if (!guard.crypto.constantTimeEqual(againstClaim, msParsed.digest)) {
         throw _err("sigstore/artifact-mismatch", "the artifact does not match the messageDigest the bundle carries");
       }
@@ -1418,6 +1930,10 @@ async function verifyBundle(bundle, opts) {
     integratedTime: integratedTime,
     logIndex: rekor.logIndex,
     logId: rekor.logId,
+    logOrigin: rekor.logOrigin,
+    treeSize: rekor.treeSize,
+    checkpointKeyId: rekor.checkpointKeyId,
+    timestampSource: rekor.timestampSource,
   });
 }