@blamejs/pki 0.8.50 → 0.8.52

package/lib/pki-build.js

@@ -851,6 +851,39 @@ function makeBuilder(ctx) {
   }
   /** @internal InhibitAnyPolicy (RFC 5280 sec. 4.2.1.14): a bare SkipCerts INTEGER. */
   function extInhibitAnyPolicy(v) { return b.integer(skipCount(v, "inhibitAnyPolicy")); }
+  /** @internal Features (RFC 7633 sec. 4): `SEQUENCE OF INTEGER`, each a TLS ExtensionType value.
+   *  sec. 4.1 binds those values to the IANA TLS Extensions registry, so the registry names this
+   *  build knows are accepted beside the numbers, resolved through the one table `C.NAMES.TLS_FEATURE`
+   *  that `pki.inspect` prints them from rather than a second copy of it. The type states no range and
+   *  no ordering, so a value outside the registry's 16-bit width and a repeat both encode, and the
+   *  linter is what grades them: an encoder that dropped or sorted them would hide what it emitted
+   *  from the rule that reads it. An EMPTY list is refused here although the decoder accepts one on
+   *  the wire, because an empty Features advertises nothing and makes the extension inert, which is a
+   *  caller's typo rather than a document to read. */
+  function extTlsFeature(list) {
+    if (!_isArray(list) || !list.length) {
+      throw E("bad-input", "tlsFeature must name at least one TLS ExtensionType value (RFC 7633 sec. 4.1); " +
+        "an empty Features advertises nothing, so the extension it would emit is inert");
+    }
+    var dense = reqDenseArray(list, "tlsFeature");
+    return b.sequence(_mapIntrinsic(dense, function (f, i) {
+      return b.integer(tlsFeatureValue(f, "tlsFeature entry " + i));
+    }));
+  }
+  /** @internal A registry name resolved off the printing table, so the two directions cannot drift. */
+  function tlsFeatureValue(f, who) {
+    if (typeof f !== "string") {
+      return guard.range.authoredInteger(f, rawErr, ctx.prefix + "/bad-input", who);
+    }
+    var table = C.NAMES.TLS_FEATURE;
+    var keys = intrinsic.keys(table);
+    for (var i = 0; i < keys.length; i++) {
+      if (table[keys[i]] === f) return intrinsic.BigInt(keys[i]);
+    }
+    throw E("bad-input", who + " names no TLS ExtensionType this build knows: " + _stringify(f) +
+      " (accepted names: " + intrinsic.join(_mapIntrinsic(keys, function (k) { return table[k]; }), ", ") +
+      "; any other value is given as its number)");
+  }
   /** @internal PolicyMappings (RFC 5280 sec. 4.2.1.5): SEQUENCE SIZE (1..MAX) OF
    *  { issuerDomainPolicy, subjectDomainPolicy }. The clause forbids mapping either to or from
    *  anyPolicy, so neither side may name it. */
@@ -1282,6 +1315,7 @@ function makeBuilder(ctx) {
     nameConstraints: 1, authorityInfoAccess: 1, cRLDistributionPoints: 1, freshestCRL: 1,
     policyConstraints: 1, inhibitAnyPolicy: 1, policyMappings: 1, policyMappingsCritical: 1,
     issuerAltName: 1, qcStatements: 1, qcStatementsCritical: 1,
+    tlsFeature: 1, tlsFeatureCritical: 1,
     msCertificateTemplate: 1, msEnrollCertType: 1, msApplicationPolicies: 1,
     subjectInfoAccess: 1, subjectDirectoryAttributes: 1,
   };
@@ -1336,6 +1370,11 @@ function makeBuilder(ctx) {
     if (extSpec.policyMappings != null) guard.list.append(out, ext(O("policyMappings"), !!extSpec.policyMappingsCritical, extPolicyMappings(extSpec.policyMappings)));
     if (extSpec.issuerAltName != null) guard.list.append(out, ext(O("issuerAltName"), false, encodeGeneralNames(reqDenseArray(extSpec.issuerAltName, "issuerAltName"))));
     if (extSpec.qcStatements != null) guard.list.append(out, ext(O("qcStatements"), !!extSpec.qcStatementsCritical, extQcStatements(extSpec.qcStatements)));
+    /** @internal RFC 7633 sec. 4.2.1 lets a request state the features the server supports, and
+     *  sec. 4.3.2 asks a server to generate it, so a feature declaration is the requester's wish and
+     *  belongs in this table. The criticality knob is here too, because a request carries the
+     *  Extension shape whole and the CA decides what it issues. */
+    if (extSpec.tlsFeature != null) guard.list.append(out, ext(O("tlsFeature"), !!extSpec.tlsFeatureCritical, extTlsFeature(extSpec.tlsFeature)));
     if (extSpec.msCertificateTemplate != null) guard.list.append(out, ext(O("msCertificateTemplate"), false, extMsCertificateTemplate(extSpec.msCertificateTemplate)));
     if (extSpec.msEnrollCertType != null) guard.list.append(out, ext(O("msEnrollCertType"), false, extMsEnrollCertType(extSpec.msEnrollCertType)));
     if (extSpec.msApplicationPolicies != null) guard.list.append(out, ext(O("msApplicationPolicies"), false, extCertPolicies(extSpec.msApplicationPolicies)));
@@ -1395,6 +1434,7 @@ function makeBuilder(ctx) {
     extNameConstraints: extNameConstraints, extAuthorityInfoAccess: extAuthorityInfoAccess,
     extCrlDistributionPoints: extCrlDistributionPoints, extPolicyConstraints: extPolicyConstraints,
     extInhibitAnyPolicy: extInhibitAnyPolicy, extPolicyMappings: extPolicyMappings,
+    extTlsFeature: extTlsFeature,
     extQcStatements: extQcStatements,
     encodeGeneralNames: encodeGeneralNames, serialInteger: serialInteger, timeDer: timeDer,
     requestedExtensions: requestedExtensions,

package/lib/revocation-fetch.js

@@ -32,8 +32,13 @@ var OID_OCSP_NONCE = oid.byName("ocspNonce");
 
 var _append = guard.list.append;
 /** @internal The URL parser, taken at load: the host it reports is the distribution point a fetch is
- *  directed to. */
+ *  directed to. Its accessors are taken with it, since the constructor's capture does not cover the
+ *  prototype the value reads its parts off and the host read here is the one the filter applies to. */
 var _URL = intrinsic.URL;
+var _urlHref = intrinsic.urlHref;
+var _urlProtocol = intrinsic.urlProtocol;
+var _urlHostname = intrinsic.urlHostname;
+var _urlSetHash = intrinsic.urlSetHash;
 var LIMITS = constants.LIMITS;
 
 var CHECKER_OPTS = intrinsic.assign(intrinsic.create(null), {
@@ -167,16 +172,17 @@ function _acceptableUrl(value, net_) {
   var u;
   try { u = new _URL(value); }
   catch (_e) { return _no("is not one this client fetches"); }   // allow:swallow-unverified a value that is not a URL names no location
-  if (u.protocol !== "https:" && !(net_.allowHttp && u.protocol === "http:")) return _no("is not one this client fetches");
-  var host = u.hostname;
+  var scheme = _urlProtocol(u);
+  if (scheme !== "https:" && !(net_.allowHttp && scheme === "http:")) return _no("is not one this client fetches");
+  var host = _urlHostname(u);
   if (host.charAt(0) === "[" && host.charAt(host.length - 1) === "]") host = host.slice(1, -1);
   if (net.isIP(host) !== 0) {
     if (httpTransport.isBlockedIp(host)) return _no("is not one this client fetches");
   } else if (!net_.guardsAddresses) {
     return _no("names a host whose resolved address opts.transport does not declare it filters");
   }
-  u.hash = "";
-  return { url: u.href, why: null };
+  _urlSetHash(u, "");
+  return { url: _urlHref(u), why: null };
 }
 
 function _no(why) { return { url: null, why: why }; }

package/lib/scep.js

@@ -43,6 +43,15 @@ var intrinsic = require("./guard-intrinsic");
  *  handed is taken with it, since a replacement answers with a host of its own. */
 var _URL = intrinsic.URL;
 var _stringOf = intrinsic.String;
+/** @internal And the accessors its result is read through: capturing the constructor does not capture
+ *  the prototype the value reads its parts off, and the scheme here decides whether a redirect may
+ *  be followed while the origin decides whether it is a cross-origin one. */
+var _urlHref = intrinsic.urlHref;
+var _urlOrigin = intrinsic.urlOrigin;
+var _urlProtocol = intrinsic.urlProtocol;
+var _urlSearchParams = intrinsic.urlSearchParams;
+var _urlHash = intrinsic.urlHash;
+var _searchSet = intrinsic.uncurry(URLSearchParams.prototype.set);
 var oid = require("./oid");
 var asn1 = require("./asn1-der");
 var b = asn1.build;
@@ -675,21 +684,26 @@ function _tlsForRequest(opts) {
 function _redirectTarget(current, location, method, allowCrossOrigin) {
   if (location == null || _trim(String(location)) === "") throw _err("scep/bad-response", "a redirect response carried no Location header");
   var resolved;
-  try { resolved = new _URL(_stringOf(location), current.href); }
+  try { resolved = new _URL(_stringOf(location), _urlHref(current)); }
   catch (e) { throw _err("scep/bad-url", "a redirect Location did not parse: " + location, e); }
-  if (resolved.protocol !== "http:" && resolved.protocol !== "https:") throw _err("scep/bad-url", "a redirect to a non-HTTP scheme is refused: " + resolved.protocol);
-  if (current.protocol === "https:" && resolved.protocol !== "https:") throw _err("scep/insecure-redirect", "a redirect from https to " + resolved.protocol + " is refused");
+  /** @internal Each scheme read ONCE: the first test decides whether the target is HTTP at all and
+   *  the second whether it is a downgrade, and those two have to be answered about one value. */
+  var toScheme = _urlProtocol(resolved);
+  var fromScheme = _urlProtocol(current);
+  if (toScheme !== "http:" && toScheme !== "https:") throw _err("scep/bad-url", "a redirect to a non-HTTP scheme is refused: " + toScheme);
+  if (fromScheme === "https:" && toScheme !== "https:") throw _err("scep/insecure-redirect", "a redirect from https to " + toScheme + " is refused");
   var safe = method === "GET" || method === "HEAD";
-  if (resolved.origin !== current.origin && !safe && !allowCrossOrigin) throw _err("scep/cross-origin-redirect", "a cross-origin redirect on a " + method + " needs opts.allowCrossOriginRedirect");
+  if (_urlOrigin(resolved) !== _urlOrigin(current) && !safe && !allowCrossOrigin) throw _err("scep/cross-origin-redirect", "a cross-origin redirect on a " + method + " needs opts.allowCrossOriginRedirect");
   return resolved;
 }
 function _scepUrl(baseUrl, operation) {
   var url;
   try { url = new _URL(_stringOf(baseUrl)); }
   catch (e) { throw _err("scep/bad-url", "the SCEP base URL did not parse: " + _showValue(baseUrl), e); }
-  if (url.protocol !== "http:" && url.protocol !== "https:") throw _err("scep/bad-url", "the SCEP base URL must be http or https, got " + url.protocol);
-  if (url.hash) throw _err("scep/bad-url", "the SCEP base URL must not carry a fragment");
-  url.searchParams.set("operation", operation);
+  var baseScheme = _urlProtocol(url);
+  if (baseScheme !== "http:" && baseScheme !== "https:") throw _err("scep/bad-url", "the SCEP base URL must be http or https, got " + baseScheme);
+  if (_urlHash(url)) throw _err("scep/bad-url", "the SCEP base URL must not carry a fragment");
+  _searchSet(_urlSearchParams(url), "operation", operation);
   return url;
 }
 function _pkiMethod(opts) {
@@ -700,27 +714,27 @@ function _pkiMethod(opts) {
 }
 function _pkiRequest(method, opUrl, reqMsg, clientOpts) {
   if (method === "GET") {
-    var getUrl = new _URL(opUrl.href);
-    getUrl.searchParams.set("message", Buffer.from(reqMsg).toString("base64"));
+    var getUrl = new _URL(_urlHref(opUrl));
+    _searchSet(_urlSearchParams(getUrl), "message", Buffer.from(reqMsg).toString("base64"));
     return _client("GET", getUrl, null, {}, clientOpts);
   }
   return _client("POST", opUrl, reqMsg, { "content-type": CT_PKI_MESSAGE }, clientOpts);
 }
 function _drive(method, url, body, headers, opts, transport, budgets) {
-  var redirects = 0, curMethod = method, curBody = body, initialOrigin = url.origin;
+  var redirects = 0, curMethod = method, curBody = body, initialOrigin = _urlOrigin(url);
   var proxySnap = _snapshotProxy(opts.proxy);
   var tlsBase = _tlsForRequest(opts);
   var allowCrossOrigin = !!opts.allowCrossOriginRedirect;
   function _hopTls(current) {
     var t = tlsBase;
-    if (current.origin !== initialOrigin) {
+    if (_urlOrigin(current) !== initialOrigin) {
       t = Object.assign({}, t);
       t.cert = null; t.key = null; t.servername = null;
     }
     return t;
   }
   function step(current) {
-    var req = { method: curMethod, url: current.href, headers: headers, tls: _hopTls(current), timeout: budgets.timeout, maxResponseBytes: budgets.maxResponseBytes };
+    var req = { method: curMethod, url: _urlHref(current), headers: headers, tls: _hopTls(current), timeout: budgets.timeout, maxResponseBytes: budgets.maxResponseBytes };
     if (proxySnap != null) req.proxy = proxySnap;
     if (curBody != null) req.body = curBody;
     return guard.async.invoked(transport, [req], _err, "scep/bad-input", "opts.transport").then(function (res) {

package/lib/schema-all.js

@@ -379,7 +379,7 @@ module.exports = {
     pemDecode: trustanchor.pemDecode, pemEncode: trustanchor.pemEncode },
   attrcert: { parse: attrcert.parse, pemDecode: attrcert.pemDecode, pemEncode: attrcert.pemEncode,
     decodeExtensions: attrcert.decodeExtensions, decodeExtension: attrcert.decodeExtension },
-  smime: { parseSigningCertificate: smime.parseSigningCertificate, parseSigningCertificateV2: smime.parseSigningCertificateV2, parseSmimeCapabilities: smime.parseSmimeCapabilities, decodeAttribute: smime.decodeAttribute },
+  smime: { buildSigningCertificateV2: smime.buildSigningCertificateV2, parseSigningCertificate: smime.parseSigningCertificate, parseSigningCertificateV2: smime.parseSigningCertificateV2, parseSmimeCapabilities: smime.parseSmimeCapabilities, decodeAttribute: smime.decodeAttribute },
   cmc: { parse: cmc.parse, parsePkiData: cmc.parsePkiData, parsePkiResponse: cmc.parsePkiResponse },
   pem: {
     decodeBundle: function (text, opts) { return pkix.pemDecodeBundle(text, opts, PemError, _detectOrNull); },

package/lib/schema-smime.js

@@ -22,6 +22,9 @@
  *   (raw), the hash algorithm (decoded for v2, or the implied SHA-1 for v1), and
  *   the optional `issuerSerial` (issuer `GeneralNames` validated + surfaced raw,
  *   serial as a BigInt + hex)) plus the optional certificate policies.
+ *   `buildSigningCertificateV2` encodes the v2 attribute value a signer attaches:
+ *   one `ESSCertIDv2` per certificate, the SHA-256 form with the DEFAULT algorithm
+ *   omitted and SHA-384 / SHA-512 with an absent parameters field.
  *   `parseSmimeCapabilities` decodes the ordered `SMIMECapabilities` list (each a
  *   capability OID + raw parameters). `decodeAttribute` takes a CMS-shaped
  *   `{ type, values }` attribute, enforces the single-`AttributeValue` rule
@@ -46,9 +49,14 @@ var schema = require("./schema-engine");
 var pkix = require("./schema-pkix");
 var oid = require("./oid");
 var frameworkError = require("./framework-error");
+var guard = require("./guard-all");
+var intrinsic = require("./guard-intrinsic");
+var constants = require("./constants");
+var x509 = require("./schema-x509");
 
 var SmimeError = frameworkError.SmimeError;
 var PemError = frameworkError.PemError;
+var b = asn1.build;
 
 var NS = pkix.makeNS("smime", SmimeError, oid);
 var TAGS = asn1.TAGS;
@@ -61,6 +69,12 @@ var OID_SIGNING_CERTIFICATE = oid.byName("signingCertificate");
 var OID_SIGNING_CERTIFICATE_V2 = oid.byName("signingCertificateV2");
 var OID_SMIME_CAPABILITIES = oid.byName("smimeCapabilities");
 
+/** @internal The digests this module will BIND a certificate with. RFC 5035 sec. 4 leaves
+ *  `hashAlgorithm` open, and the two readers that consume the field disagree on the set they admit,
+ *  so the builder emits only what the strictest consumer accepts: SHA-1 is excluded because a
+ *  binding is an identity claim, and an identifier a verifier refuses is a token nobody can use. */
+var BIND_DIGESTS = intrinsic.assign(intrinsic.create(null), { sha256: 1, sha384: 1, sha512: 1 });
+
 var GENERAL_NAME_DIRECTORY = 4;
 var ISSUER_SERIAL = schema.seq([
   schema.field("issuer", pkix.generalNames(NS, { code: "smime/bad-general-names" })),
@@ -71,7 +85,7 @@ var ISSUER_SERIAL = schema.seq([
     return {
       issuer: m.fields.issuer.value.result,
       serialNumber: m.fields.serialNumber.value,
-      serialNumberHex: m.fields.serialNumber.node.content.toString("hex"),
+      serialNumberHex: intrinsic.bufToString(m.fields.serialNumber.node.content, "hex"),
     };
   },
 });
@@ -105,7 +119,7 @@ var POLICY_INFORMATION = schema.seq([
 });
 var POLICIES = schema.seqOf(POLICY_INFORMATION, {
   assert: "sequence", min: 0, code: "smime/bad-policies", what: "policies",
-  build: function (m) { return m.items.map(function (it) { return it.value.result; }); },
+  build: function (m) { return intrinsic.map(m.items, function (it) { return it.value.result; }); },
 });
 
 var ESS_CERT_ID = schema.seq([
@@ -155,7 +169,7 @@ function signingCertificateSchema(essCertId, code, what) {
   ], {
     assert: "sequence", code: code, what: what,
     build: function (m, ctx) {
-      var certs = m.fields.certs.value.items.map(function (it) { return it.value.result; });
+      var certs = intrinsic.map(m.fields.certs.value.items, function (it) { return it.value.result; });
       assertSignerIssuerIsDirectoryName(certs, function (msg) { throw ctx.E("smime/bad-issuer-serial", msg); });
       return {
         certs: certs,
@@ -182,7 +196,7 @@ var SMIME_CAPABILITY = schema.seq([
 });
 var SMIME_CAPABILITIES = schema.seqOf(SMIME_CAPABILITY, {
   assert: "sequence", min: 0, code: "smime/bad-capabilities", what: "SMIMECapabilities",
-  build: function (m) { return { capabilities: m.items.map(function (it) { return it.value.result; }) }; },
+  build: function (m) { return { capabilities: intrinsic.map(m.items, function (it) { return it.value.result; }) }; },
 });
 
 /**
@@ -266,6 +280,197 @@ var parseSigningCertificateV2 = pkix.makeParser({ pemLabel: null, PemError: PemE
  */
 var parseSmimeCapabilities = pkix.makeParser({ pemLabel: null, PemError: PemError, ErrorClass: SmimeError, prefix: "smime", what: "SMIMECapabilities", topSchema: SMIME_CAPABILITIES, ns: NS });
 
+function _err(code, message) { return new SmimeError(code, message); }
+
+/** @internal The digests a signing-certificate identifier may BIND a certificate with, on the
+ *  reading side. It is the set the builder emits, and it is narrower than the set the ESS decoder
+ *  will decode: an identifier is an identity claim, so admitting a digest nobody should bind with
+ *  would let the claim be satisfied by a certificate other than the one that signed. SHA-1 is not
+ *  here and is reported as weak by its own flag, because the v1 attribute has no algorithm field
+ *  and is SHA-1 by definition (RFC 2634), so a reader must be able to tell "weak" from "unknown". */
+var BIND_VERIFY_DIGESTS = intrinsic.assign(intrinsic.create(null), { sha256: 1, sha384: 1, sha512: 1 });
+var GENERAL_NAME = pkix.generalName(NS, { decodeValue: true, code: "smime/bad-general-names" });
+
+/** @internal What ONE signing-certificate attribute claims about `certDer`, as facts rather than a
+ *  verdict. Each claim is read and compared here so there is one implementation of "does this
+ *  identifier name that certificate", and the two consumers apply their own policy to the result:
+ *  `pki.tsp.verify` refuses a token, and `pki.cms.verify` reports a CAdES conformance finding.
+ *
+ *  An ESSCertID states the signer in two independent ways, and both are compared: the hash under
+ *  the identifier's own digest, and the issuer and serial where it carries them (RFC 5035 clause 5,
+ *  RFC 2634 clause 5.4). A hash that agrees beside an issuer and serial naming another certificate
+ *  is a contradiction, not a match. Identifiers after the first are not read: RFC 2634 clause 5.4
+ *  makes the first the signing certificate and leaves the rest as the chain. */
+function _bindingClaim(attr) {
+  var out = { form: attr.type === OID_SIGNING_CERTIFICATE_V2 ? "v2" : "v1", readable: false,
+    digestName: null, supported: false, weak: false, certHash: null, issuerSerial: null };
+  var decoded;
+  try { decoded = decodeAttribute(attr); }
+  catch (_e) { return out; }
+  var ess = decoded.certs && decoded.certs[0];
+  if (!ess) return out;
+  /** @internal The digest identifier is held to its own encoding before its NAME is read. A SHA-2
+   *  identifier carries absent or NULL parameters and nothing else (RFC 5754 clause 2, "MUST accept
+   *  SHA2 AlgorithmIdentifiers with absent parameters ... with NULL parameters"), and the same two
+   *  forms are what RFC 3370 clause 2.1 states for SHA-1. The ANY parameters field is carried
+   *  through the parse unvalidated, so an identifier naming a digest this build computes while
+   *  carrying arbitrary bytes beside it would otherwise be hashed as a well-formed binding. */
+  if (!guard.der.paramsAbsentOrNull(ess.hashAlgorithm == null ? null : ess.hashAlgorithm.parameters)) return out;
+  out.readable = true;
+  out.digestName = ess.hashAlgorithm == null ? "sha1" : ess.hashAlgorithm.name;
+  out.weak = intrinsic.hasOwn(constants.NAMES.WEAK_DIGESTS, out.digestName);
+  out.supported = out.weak || intrinsic.hasOwn(BIND_VERIFY_DIGESTS, out.digestName);
+  out.certHash = ess.certHash;
+  out.issuerSerial = ess.issuerSerial || null;
+  return out;
+}
+
+/** @internal One claim compared against one certificate. The claim is read ONCE, by
+ *  `certBindingClaims`, and this is what runs per certificate: a signer identifier can match many
+ *  candidates, and re-reading the attribute for each would multiply the attribute's size by the
+ *  candidate count before any signature is checked. Only the first identifier is ever compared, so
+ *  only it is kept.
+ *
+ * @internal
+ */
+function certBindingAgainst(claim, certDer) {
+  var out = { form: claim.form, readable: claim.readable, digestName: claim.digestName,
+    supported: claim.supported, weak: claim.weak, matches: null, certUnreadable: false,
+    issuerSerialPresent: claim.issuerSerial !== null, issuerSerialMatches: null };
+  if (!claim.readable || !claim.supported) return out;
+  /** @internal Through the captured digest and the constant-time comparison: this IS the binding
+   *  between a signature and the certificate its attribute names, so neither what the digest covers
+   *  nor how the result is compared is the caller's to choose. */
+  out.matches = guard.crypto.constantTimeEqual(guard.crypto.digest(claim.digestName, certDer), claim.certHash);
+  if (claim.issuerSerial === null) return out;
+  /** @internal A certificate that does not parse is its own fact, kept apart from an attribute that
+   *  does not decode: one says the identifier is malformed and the other says the thing it would be
+   *  compared against is, and a consumer orders the two itself. Folding them into one flag moved a
+   *  refusal from "this identifier names another certificate" to "this attribute is unreadable". */
+  var cert;
+  try { cert = x509.parse(certDer); }
+  catch (_e2) { out.certUnreadable = true; return out; }
+  if (claim.issuerSerial.serialNumber !== cert.serialNumber) { out.issuerSerialMatches = false; return out; }
+  var names = claim.issuerSerial.issuer.names || [];
+  var gn = null;
+  try {
+    if (names.length === 1) {
+      gn = schema.embeddedDer(GENERAL_NAME, names[0].bytes, NS,
+        { code: "smime/bad-general-names", what: "GeneralName" });
+    }
+  } catch (_e3) { gn = null; }
+  out.issuerSerialMatches = !!gn && gn.tagNumber === GENERAL_NAME_DIRECTORY && !!gn.value &&
+    guard.name.dnEqual(gn.value.rdns, cert.issuer.rdns, _err, "smime/bad-issuer-serial",
+      "the ESSCertID issuer");
+  return out;
+}
+
+/** @internal Every signing-certificate attribute in `signedAttrs`, read against `certDer`.
+ *  `chosen` is the v2 attribute where there is one, which supersedes v1 (RFC 5035); `superseded`
+ *  holds the rest, which a consumer still holds to the same claim, because one structure making two
+ *  incompatible statements about one fact is a contradiction rather than something to resolve in
+ *  favor of whichever attribute a reader prefers. EVERY attribute is collected rather than the first
+ *  of each type: `signedAttrs` is a DER SET OF, so which of two comes first is a function of their
+ *  encodings and a hostile producer picks it.
+ *
+ * @internal
+ */
+function certBindingClaims(signedAttrs) {
+  var found = [];
+  intrinsic.forEach(signedAttrs || [], function (a) {
+    if (a && (a.type === OID_SIGNING_CERTIFICATE || a.type === OID_SIGNING_CERTIFICATE_V2)) {
+      guard.list.append(found, a);
+    }
+  });
+  if (!found.length) return { present: false, chosen: null, superseded: [] };
+  var chosenAt = 0;
+  for (var i = 0; i < found.length; i++) {
+    if (found[i].type === OID_SIGNING_CERTIFICATE_V2) { chosenAt = i; break; }
+  }
+  var superseded = [];
+  for (var j = 0; j < found.length; j++) {
+    if (j !== chosenAt) guard.list.append(superseded, _bindingClaim(found[j]));
+  }
+  return { present: true, chosen: _bindingClaim(found[chosenAt]), superseded: superseded };
+}
+
+/** @internal The claims read and compared in one call, for a consumer holding a single certificate.
+ *  A consumer with several reads the claims once and calls `certBindingAgainst` per certificate.
+ *
+ * @internal
+ */
+function certBindingFacts(signedAttrs, certDer) {
+  var claims = certBindingClaims(signedAttrs);
+  if (!claims.present) return { present: false, chosen: null, superseded: [] };
+  return {
+    present: true,
+    chosen: certBindingAgainst(claims.chosen, certDer),
+    superseded: intrinsic.map(claims.superseded, function (c) { return certBindingAgainst(c, certDer); }),
+  };
+}
+
+var _BUILD_V2_OPTS = intrinsic.assign(intrinsic.create(null), { hashAlgorithm: 1 });
+
+/**
+ * @primitive  pki.schema.smime.buildSigningCertificateV2
+ * @signature  pki.schema.smime.buildSigningCertificateV2(certs, opts?) -> Buffer
+ * @since      0.8.52
+ * @status     stable
+ * @spec       RFC 5035, RFC 5754
+ * @related    pki.schema.smime.parseSigningCertificateV2, pki.cms.sign, pki.tsp.sign
+ *
+ * Encode an ESS `SigningCertificateV2` attribute value (RFC 5035 sec. 5.4.1), the signed attribute
+ * that binds a signature to the certificate that made it. `certs` is the signer's certificate DER,
+ * or a list of certificate DERs whose first entry is the signer's (RFC 5035 sec. 5.4); each entry
+ * becomes an `ESSCertIDv2` carrying that certificate's hash. The result is the single
+ * `AttributeValue` of a `signingCertificateV2` signed attribute, which is what CAdES requires a
+ * signature to carry (ETSI EN 319 122-1 clauses 5.2.2.2 and 5.2.2.3).
+ *
+ * `opts.hashAlgorithm` names the binding digest: `sha256` (the default), `sha384` or `sha512`. The
+ * SHA-256 form omits the `hashAlgorithm` field, which is the RFC 5035 sec. 4 DEFAULT and so must be
+ * absent (X.690 sec. 11.5); the other two emit an `AlgorithmIdentifier` with the parameters field
+ * absent, which RFC 5754 sec. 2 requires an implementation to generate. SHA-1 is refused
+ * `smime/unsupported-algorithm`: a binding is an identity claim, and `pki.tsp.verify` refuses a
+ * SHA-1 one as a weak binding.
+ *
+ * The OPTIONAL `issuerSerial` and `policies` fields are not emitted; CAdES has the issuer serial
+ * omitted (ETSI EN 319 122-1 clause 6.3 requirement g). A caller that needs either field builds the
+ * value with `pki.asn1.build`, and `parseSigningCertificateV2` reads both back.
+ *
+ * @example
+ *   var pair = await pki.key.generate("Ed25519");
+ *   var key = await pki.key.export(pair.privateKey);
+ *   var signerCertDer = await pki.x509.sign({ subject: "Signer", subjectPublicKey: await pki.key.export(pair.publicKey),
+ *     notBefore: new Date("2026-01-01T00:00:00Z"), notAfter: new Date("2036-01-01T00:00:00Z") }, { key: key });
+ *   var av = pki.schema.smime.buildSigningCertificateV2(signerCertDer);
+ *   var msg = await pki.cms.sign(Buffer.from("hello"), { cert: signerCertDer, key: key },
+ *     { additionalSignedAttributes: [{ type: "signingCertificateV2", values: [av] }] });
+ *   (await pki.cms.verify(msg, { certs: [signerCertDer] })).signers[0].cadesBaseline.conformant;   // true
+ */
+function buildSigningCertificateV2(certs, opts) {
+  guard.identifier.assertKnownKeys(opts, _BUILD_V2_OPTS, _err, "smime/bad-input",
+    "pki.schema.smime.buildSigningCertificateV2 has an unknown option ");
+  var settings = guard.identifier.pickSettings(opts, ["hashAlgorithm"]);
+  var hashName = settings.hashAlgorithm === undefined || settings.hashAlgorithm === null ? "sha256" : settings.hashAlgorithm;
+  if (typeof hashName !== "string" || !BIND_DIGESTS[guard.text.keyOf(hashName)]) {
+    throw _err("smime/unsupported-algorithm", "the ESSCertIDv2 binding digest must be sha256, sha384 or sha512, got " +
+      guard.text.showValue(hashName));
+  }
+  var list = guard.list.snapshot(intrinsic.isArray(certs) ? certs : [certs]);
+  if (!list.length) {
+    throw _err("smime/bad-input", "a SigningCertificateV2 needs at least one certificate, the signer's first (RFC 5035 sec. 5.4)");
+  }
+  var ids = [];
+  for (var i = 0; i < list.length; i++) {
+    var der = guard.bytes.view(list[i], SmimeError, "smime/bad-input", "the certificate at certs[" + i + "]");
+    var certHash = b.octetString(guard.crypto.digest(hashName, der));
+    guard.list.append(ids, hashName === "sha256"
+      ? b.sequence([certHash])
+      : b.sequence([b.sequence([b.oid(oid.byName(hashName))]), certHash]));
+  }
+  return b.sequence([b.sequence(ids)]);
+}
+
 /**
  * @primitive  pki.schema.smime.decodeAttribute
  * @signature  pki.schema.smime.decodeAttribute(attr) -> { kind, ... }
@@ -292,7 +497,7 @@ var parseSmimeCapabilities = pkix.makeParser({ pemLabel: null, PemError: PemErro
  *   got.kind;    // "signingCertificateV2"
  */
 function decodeAttribute(attr) {
-  if (!attr || typeof attr !== "object" || typeof attr.type !== "string" || !Array.isArray(attr.values)) {
+  if (!attr || typeof attr !== "object" || typeof attr.type !== "string" || !intrinsic.isArray(attr.values)) {
     throw new SmimeError("smime/bad-input", "decodeAttribute expects a CMS attribute { type, values }");
   }
   if (attr.type === OID_SIGNING_CERTIFICATE || attr.type === OID_SIGNING_CERTIFICATE_V2 || attr.type === OID_SMIME_CAPABILITIES) {
@@ -313,6 +518,11 @@ function decodeAttribute(attr) {
 }
 
 module.exports = {
+  buildSigningCertificateV2: buildSigningCertificateV2,
+  certBindingFacts: certBindingFacts,   // @internal
+  certBindingClaims: certBindingClaims,   // @internal
+  certBindingAgainst: certBindingAgainst,   // @internal
+
   parseSigningCertificate: parseSigningCertificate,
   parseSigningCertificateV2: parseSigningCertificateV2,
   parseSmimeCapabilities: parseSmimeCapabilities,