@blamejs/pki 0.8.9 → 0.8.10

package/CHANGELOG.md

@@ -4,6 +4,19 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.8.10 — 2026-09-23
+
+A certificate's names are read the same way wherever the toolkit reads them.
+
+### Fixed
+
+- `pki.tsp.verify` reports `tsp/bad-eku` for an empty extendedKeyUsage. RFC 5280 section 4.2.1.12 has at least one KeyPurposeId, and an empty one decodes as a SEQUENCE, so a reader checking only the tag called it well-formed and reported it as naming the wrong purpose, `tsp/eku-not-exclusive`. Every other consumer of that extension already answered with the malformed-extension code.
+- The subjectAltName a timestamp token names its TSA through is read under the same rules every other consumer reads a name under, so a name this toolkit refuses elsewhere cannot be a source of TSA identity. The match itself is still a comparison of the encoded GeneralName bytes, which is what naming a TSA means: the name in the token and the name in the certificate have to be the same name.
+
+### Security
+
+- `pki.sigstore.verifyBundle` refuses a Fulcio certificate whose subjectAltName carries more than one name, whatever forms those names take. It counted only rfc822Name, dNSName, uniformResourceIdentifier and otherName, and dropped every other form before counting, so a certificate pairing a URI with an iPAddress or a directoryName was accepted as binding one identity. A caller identity policy matched the form the verifier reported and never saw the other, which is the outcome the one-identity rule exists to prevent. The rule now counts every name the extension carries. A certificate carrying a single name in a form with no identity string still reports `identity.san` as `null`, unchanged, so a policy gates on the null rather than on a name nothing read.
+
 ## v0.8.9 — 2026-09-23
 
 The 0.8.9 tarball is the one to install for everything 0.8.8 added.

package/lib/acme.js

@@ -578,7 +578,11 @@ var OID_AKI = oid.byName("authorityKeyIdentifier");
 var OID_CN = oid.byName("commonName");
 var _extNs = pkix.makeNS("acme", AcmeError, oid);
 var _extDecoders = pkix.certExtensionDecoders(_extNs);
-var _extCtx = intrinsic.assign(intrinsic.create(null), { E: function (c, m, cause) { return new AcmeError(c, m, cause); }, oid: oid });
+/** @internal The decoders take the value and nothing else: the error class and the OID registry
+ * they raise and resolve through come from the namespace the table was built with, above. Passing
+ * a second argument here suggested a per-call context that the table has no parameter for and
+ * silently dropped; where a decode genuinely needs resources, the way to supply them is to build
+ * the table with `schema.withResources`, as `schema-attrcert.js` does. */
 
 /**
  * @primitive  pki.acme.tlsAlpn01Extension
@@ -657,7 +661,7 @@ async function verifyTlsAlpn01(certDer, token, accountJwk, identifier) {
   if (!auth.equals(expected)) throw E("acme/bad-tlsalpn", "the acmeIdentifier digest does not match the key authorization");
   var sanExt = exts.filter(function (e) { return e.oid === OID_SAN; })[0];
   if (!sanExt) throw E("acme/bad-tlsalpn", "the validation certificate is missing the SubjectAltName");
-  var san = _extDecoders.byOid[OID_SAN](sanExt.value, _extCtx);
+  var san = _extDecoders.byOid[OID_SAN](sanExt.value);
   if (!san.names || san.names.length !== 1) throw E("acme/bad-tlsalpn", "the SubjectAltName must carry EXACTLY ONE entry (RFC 8737 sec. 3)");
   var entry = san.names[0];
   if (!_isObject(identifier) || !_isString(identifier.type)) throw E("acme/bad-input", "an identifier { type, value } is required");
@@ -914,7 +918,7 @@ function _csrIdentifierSet(parsedCsr) {
     if (a.type !== oid.byName("extensionRequest") || !_isArrayI(a.extensions)) return;
     _forEach(a.extensions, function (e) {
       if (e.oid !== OID_SAN) return;
-      var dec = _extDecoders.byOid[OID_SAN](e.value, _extCtx);
+      var dec = _extDecoders.byOid[OID_SAN](e.value);
       _forEach(dec.names || [], function (n) { _addSanName(set, n, "the finalize CSR"); });
     });
   });
@@ -981,7 +985,7 @@ function _certIdentifierSet(parsedCert) {
   var set = intrinsic.create(null);
   _forEach(parsedCert.extensions || [], function (e) {
     if (e.oid !== OID_SAN) return;
-    var dec = _extDecoders.byOid[OID_SAN](e.value, _extCtx);
+    var dec = _extDecoders.byOid[OID_SAN](e.value);
     _forEach(dec.names || [], function (n) { _addSanName(set, n, "the downloaded certificate"); });
   });
   if (_objectKeys(set).length === 0) {
@@ -1249,7 +1253,7 @@ function ariCertId(certDer) {
   var cert = x509.parse(certDer);
   var akiExt = (cert.extensions || []).filter(function (e) { return e.oid === OID_AKI; })[0];
   if (!akiExt) throw E("acme/bad-certid", "the certificate has no authorityKeyIdentifier extension (RFC 9773 sec. 4.1)");
-  var aki = _extDecoders.byOid[OID_AKI](akiExt.value, _extCtx);
+  var aki = _extDecoders.byOid[OID_AKI](akiExt.value);
   if (!aki || !Buffer.isBuffer(aki.keyIdentifier)) throw E("acme/bad-certid", "the authorityKeyIdentifier has no keyIdentifier field (RFC 9773 sec. 4.1)");
   var serialBytes = Buffer.from(cert.serialNumberHex, "hex");
   return jose.base64url.encode(aki.keyIdentifier) + "." + jose.base64url.encode(serialBytes);

package/lib/sigstore.js

@@ -1055,6 +1055,13 @@ async function _verifyChain(leaf, chainDers, fulcioRoots, timeMs) {
 
 
 var SAN_OID = oid.byName("subjectAltName");
+/** @internal The shared table's entry, so the SAN this verb reads is read under the rules every
+ * other consumer of a GeneralNames reads it under. It is built on the certificate namespace rather
+ * than this module's, so a malformed name raises a CertificateError that `_identity` re-types to
+ * `sigstore/bad-certificate` with that fault as its cause. That is the code this module already
+ * reports for a certificate it cannot read, so the fix adds no new code to the public surface. */
+var _sanDecoder = pkix.certExtensionDecoders(
+  pkix.makeNS("x509", frameworkError.CertificateError, oid)).byOid[SAN_OID];
 var FULCIO_PREFIX = _join(_arraySlice(_split(oid.byName("otherName"), "."), 0, -1), ".") + ".";
 function _identity(leaf) {
   var out = { san: null, extensions: _create(null) };
@@ -1072,29 +1079,36 @@ function _identity(leaf) {
   return out;
 }
 var GN_TYPE = _assign(_create(null), { 1: "rfc822Name", 2: "dNSName", 6: "uri" });
+/** @internal The GeneralNames come from the shared extension decoder, which is where the RFC 5280
+ * sec. 4.2.1.6 rules live: at least one name, a non-empty IA5String for the text forms, and no
+ * control byte inside one (CVE-2009-2408). Reading the SEQUENCE here instead left this verb
+ * accepting a dNSName carrying a NUL or a CR and handing it on as the signer's identity.
+ *
+ * The one-identity rule counts every name the SAN carries, not the subset this verb turns into an
+ * identity string. Counting only the recognized forms let a certificate pair a URI with an
+ * iPAddress and pass as single-identity, with the second binding invisible to the caller's policy
+ * -- which is the thing the rule exists to stop. A SAN of one name this verb has no string form
+ * for still yields null, so a policy gates on the null rather than on a name nothing read. */
 function _sanValue(ext) {
-  var seq = asn1.decode(ext.value);
-  var names = [];
-  for (var i = 0; i < (seq.children || []).length; i++) {
-    var n = seq.children[i];
-    if (n.tagClass !== "context") continue;
-    var val = null;
-    if (!n.constructed && GN_TYPE[n.tagNumber]) {
-      val = { type: GN_TYPE[n.tagNumber], value: _bufToString(asn1.read.octetStringImplicit(n, n.tagNumber), "utf8") };
-    } else if (n.constructed && n.tagNumber === 0 && (n.children || []).length >= 2) {
-      var inner = (n.children[1].children || [])[0] || n.children[1];
-      var v;
-      try {
-        v = asn1.read.string(inner);
-      } catch (_e) {
-        v = null;
-      }
-      val = { type: "otherName", oid: asn1.read.oid(n.children[0]), value: v };
-    }
-    if (val) guard.list.append(names, val);
+  /** @internal The shared decoder is the gate: it applies the sec. 4.2.1.6 rules and throws on a
+   * name that breaks one. What it returns is a GeneralNames view rather than the codec nodes the
+   * mapping below reads, so the count comes from it and the one name is then taken from the raw
+   * decode, which carries the node shape `octetStringImplicit` and the otherName walk need. */
+  var validated = _sanDecoder(ext.value).names || [];
+  if (validated.length > 1) throw _err("sigstore/bad-certificate", "the Fulcio certificate carries multiple SAN identities");
+  var n = (asn1.decode(ext.value).children || [])[0];
+  if (!n || n.tagClass !== "context") return null;
+  if (!n.constructed && GN_TYPE[n.tagNumber]) {
+    return { type: GN_TYPE[n.tagNumber], value: _bufToString(asn1.read.octetStringImplicit(n, n.tagNumber), "utf8") };
+  }
+  if (n.constructed && n.tagNumber === 0 && (n.children || []).length >= 2) {
+    var inner = (n.children[1].children || [])[0] || n.children[1];
+    var v;
+    try { v = asn1.read.string(inner); }
+    catch (_e) { v = null; }      // allow:swallow-unverified an otherName body with no string form has no identity string, which the caller's policy then gates on
+    return { type: "otherName", oid: asn1.read.oid(n.children[0]), value: v };
   }
-  if (names.length > 1) throw _err("sigstore/bad-certificate", "the Fulcio certificate carries multiple SAN identities");
-  return names[0] || null;
+  return null;
 }
 function _fulcioExtValue(ext, leafArc) {
   if (!_isBuffer(ext.value)) throw _err("sigstore/bad-certificate", "Fulcio extension " + ext.oid + " has no value");

package/lib/tsp-sign.js

@@ -34,6 +34,9 @@ var pkiBuild = require("./pki-build");
 var constants = require("./constants");
 var TspError = frameworkError.TspError;
 var _NS = pkix.makeNS("tsp", TspError, oid);
+/** @internal The shared certificate-extension decoders, so an extension this module reads is read
+ * under the rules every other consumer reads it under rather than under a second set written here. */
+var _EXT_DECODERS = pkix.certExtensionDecoders(_NS).byOid;
 var b = asn1.build;
 function _err(code, message, cause) { return new TspError(code, message, cause); }
 
@@ -487,12 +490,13 @@ function _checkTsaCertUsage(tsaCertDer) {
   var exts = (cert.extensions || []).filter(function (e) { return e.oid === O("extKeyUsage"); });
   if (exts.length !== 1) return "tsp/bad-eku";
   if (!exts[0].critical) return "tsp/eku-not-critical";
-  var purposes, ekuNode;
-  try { ekuNode = asn1.decode(exts[0].value); }
-  catch (_e) { return "tsp/bad-eku"; }
-  if (ekuNode.tagClass !== "universal" || ekuNode.tagNumber !== asn1.TAGS.SEQUENCE || !ekuNode.children) return "tsp/bad-eku";
-  try { purposes = ekuNode.children.map(function (c) { return asn1.read.oid(c); }); }
-  catch (_e) { return "tsp/bad-eku"; }
+  /** @internal Read through the shared decoder, which is where the sec. 4.2.1.12 rules live: an
+   * ExtKeyUsage carries at least one KeyPurposeId. Reading the SEQUENCE here instead called an
+   * empty one well-formed and then reported it as the wrong PURPOSE, so the same class of fault
+   * answered with a different code here than at every other consumer of this extension. */
+  var purposes;
+  try { purposes = _EXT_DECODERS[O("extKeyUsage")](exts[0].value); }
+  catch (_e) { return "tsp/bad-eku"; }   // allow:swallow-unverified this verb answers with a code rather than throwing, and every malformed shape is the one code
   if (purposes.length !== 1 || purposes[0] !== O("timeStamping")) return "tsp/eku-not-exclusive";
   var ku;
   try { ku = pkix.keyUsageOf(_NS, cert, _err, "tsp/bad-key-usage", "TSA certificate"); }
@@ -508,13 +512,16 @@ function _tsaMatchesCert(tsaBytes, signerCert) {
   if (gn.tagNumber === 4 && gn.value && guard.name.dnEqual(gn.value.rdns, signerCert.subject.rdns, _err, "tsp/tsa-mismatch", "the TSA subject")) return true;
   var sanExt = (signerCert.extensions || []).filter(function (e) { return e.oid === O("subjectAltName"); })[0];
   if (sanExt) {
-    var san;
-    try { san = asn1.decode(sanExt.value); }
-    catch (_e) { return false; }
-    if (san.tagClass === "universal" && san.tagNumber === asn1.TAGS.SEQUENCE && san.children) {
-      for (var i = 0; i < san.children.length; i++) {
-        if (san.children[i].bytes.equals(tsaBytes)) return true;
-      }
+    /** @internal Gated by the shared decoder before the comparison, so a SAN this toolkit refuses
+     * everywhere else cannot be a source of identity here. The match itself stays a comparison of
+     * the encoded GeneralName bytes, which is what "the token names this TSA" means: the name in
+     * the token and the name in the certificate have to be the same name, not merely names that
+     * decode alike. */
+    var names;
+    try { names = _EXT_DECODERS[O("subjectAltName")](sanExt.value).names || []; }
+    catch (_e) { return false; }   // allow:swallow-unverified a SAN that does not decode names no TSA, which is what this verb answers
+    for (var i = 0; i < names.length; i++) {
+      if (names[i].bytes && names[i].bytes.equals(tsaBytes)) return true;
     }
   }
   return false;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.8.9",
+  "version": "0.8.10",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:1d0c3725-eae5-4743-8430-5684e3e52ec7",
+  "serialNumber": "urn:uuid:4cdebd00-c3c0-4ba6-9d9c-daacb902163c",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-09-23T19:11:33.586Z",
+    "timestamp": "2026-09-23T19:58:00.767Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.8.9",
+      "bom-ref": "@blamejs/pki@0.8.10",
       "type": "application",
       "name": "pki",
-      "version": "0.8.9",
+      "version": "0.8.10",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.8.9",
+      "purl": "pkg:npm/%40blamejs/pki@0.8.10",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.8.9",
+      "ref": "@blamejs/pki@0.8.10",
       "dependsOn": []
     }
   ]