@blamejs/pki 0.8.9 → 0.8.11

package/lib/schema-x509.js

@@ -35,6 +35,7 @@ var schema = require("./schema-engine");
 var oid = require("./oid");
 var frameworkError = require("./framework-error");
 var pkix = require("./schema-pkix");
+var intrinsic = require("./guard-intrinsic");
 
 var CertificateError = frameworkError.CertificateError;
 var PemError = frameworkError.PemError;
@@ -124,7 +125,7 @@ var CERTIFICATE = pkix.signedEnvelope(NS, CERTIFICATE_TBS, {
   build: function (e, ctx) {
     var tbs = e.tbsMatch;
 
-    if (!e.outerSignatureAlgorithmBytes.equals(tbs.fields.signature.node.bytes)) {
+    if (!intrinsic.bufferEquals(e.outerSignatureAlgorithmBytes, tbs.fields.signature.node.bytes)) {
       throw ctx.E("x509/bad-signature-algorithm", "signatureAlgorithm must match tbsCertificate.signature (RFC 5280 sec. 4.1.1.2)");
     }
 
@@ -148,7 +149,7 @@ var CERTIFICATE = pkix.signedEnvelope(NS, CERTIFICATE_TBS, {
     return {
       version:               version,
       serialNumber:          tbs.fields.serialNumber.value,
-      serialNumberHex:       serialNode.content.toString("hex"),
+      serialNumberHex:       intrinsic.bufToString(serialNode.content, "hex"),
       signatureAlgorithm:    e.signatureAlgorithm,
       tbsSignatureAlgorithm: tbs.fields.signature.value.result,
       issuer:                issuer,
@@ -213,14 +214,107 @@ function matches(root) {
   var validity = kids[i + 3];
   return schema.isUniversal(validity, TAGS.SEQUENCE) &&
     !!validity.children && validity.children.length === 2 &&
-    validity.children.every(function (t) {
+    intrinsic.every(validity.children, function (t) {
       return schema.isUniversalOneOf(t, [TAGS.UTC_TIME, TAGS.GENERALIZED_TIME]);
     });
 }
 
+/** @internal The certificate scope, as the shared door reads it: RFC 5280 sec. 4.2's extension
+ *  table and the criticality that profile fixes. One scope, so the single-extension verb takes no
+ *  `opts.scope`. */
+var CERT_SCOPES = intrinsic.assign(intrinsic.create(null), {
+  certificate: {
+    decoders: function (ctx) { return pkix.certExtensionDecoders(ctx).byOid; },
+    criticality: pkix.certFixedCriticality(oid),
+  },
+});
+var DOOR = pkix.extensionDoor({
+  ns: NS, ErrorClass: CertificateError, key: "x509", kind: "certificate", what: "the certificate",
+  parse: parse, scopes: CERT_SCOPES, defaultScope: "certificate",
+  segments: function (cert) { return [{ list: cert.extensions || [], scope: "certificate" }]; },
+});
+
+/**
+ * @primitive  pki.schema.x509.decodeExtensions
+ * @signature  pki.schema.x509.decodeExtensions(certOrBytes, opts?) -> rows
+ * @since      0.8.11
+ * @status     stable
+ * @spec       RFC 5280 sec. 4.2
+ * @related    pki.schema.x509.parse, pki.lint.certificate, pki.inspect.certificate
+ *
+ * Read a certificate's extensions as decoded records. `parse` hands back each extension's raw
+ * `extnValue` octets, because what an extension means is a question the reader asks rather than
+ * one the parse answers; this is the verb that asks it. The argument is the object `parse`
+ * returned or the bytes `parse` takes, and a parse result is read rather than re-derived.
+ *
+ * Each row is `{ oid, name, critical, value, scope, index, state, decoded, code, profile }`, with
+ * every field always present. `state` is the discriminator: `"decoded"` when the value read as the
+ * structure its identifier names, `"unrecognized"` when this toolkit registers no decoder for that
+ * OID, and `"undecodable"` when it does and the value did not read. Read `state` rather than
+ * testing `decoded`, because a valid `ocspNoCheck` decodes to `null`.
+ *
+ * `value` carries the raw octets in every arm, byte-identical to the certificate's, for a caller
+ * recomputing a hash or comparing an encoding. `code` is the typed error code in the undecodable
+ * arm and `null` elsewhere. `profile` reports the criticality the RFC fixes for that OID, as
+ * `{ criticalExpected, citation, deviates, violations }`, and is `null` for an extension whose
+ * criticality the issuer chooses.
+ *
+ * Nothing here is a verdict. An unrecognized critical extension is reported rather than refused,
+ * whatever `opts.strict` says, because RFC 5280 sec. 4.2's rule about one is the caller's to
+ * apply and refusing it would make a certificate carrying a private critical extension
+ * unreadable. The two facts that rule needs, `critical` and `state`, are on the row.
+ *
+ * @opts
+ *   - `strict` (boolean) -- throw the decoder's own typed error instead of reporting an
+ *     undecodable value. It does not turn an unrecognized OID into a throw.
+ *   - `maxBytes` / `maxDepth` / `maxItems` (integer) -- decode caps for this call. Each may only
+ *     tighten the built-in ceiling, and each bounds the decoding this call performs.
+ * @example
+ *   var pair = await pki.key.generate("Ed25519");
+ *   var certDer = await pki.x509.sign({ subject: "leaf.example", subjectPublicKey: await pki.key.export(pair.publicKey),
+ *     notBefore: new Date("2026-01-01T00:00:00Z"), notAfter: new Date("2027-01-01T00:00:00Z"),
+ *     extensions: { basicConstraints: { cA: false }, subjectAltName: [{ dNSName: "leaf.example" }] } },
+ *     { key: await pki.key.export(pair.privateKey) });
+ *   var rows = pki.schema.x509.decodeExtensions(certDer);
+ *   rows.filter(function (r) { return r.critical && r.state !== "decoded"; }).length;  // -> 0
+ *   // The filter above is the RFC 5280 sec. 4.2 rule: a relying party rejects a certificate whose
+ *   // critical extensions it cannot read.
+ */
+var decodeExtensions = DOOR.decodeExtensions;
+
+/**
+ * @primitive  pki.schema.x509.decodeExtension
+ * @signature  pki.schema.x509.decodeExtension(ext, opts?) -> row
+ * @since      0.8.11
+ * @status     stable
+ * @spec       RFC 5280 sec. 4.2
+ * @related    pki.schema.x509.decodeExtensions
+ *
+ * Read one certificate extension record as a decoded row. The argument is one element of a
+ * `pki.schema.x509.parse` result's `extensions`, as `{ oid, name, critical, value }`, and the row
+ * is the one `decodeExtensions` would have produced for it, with `index` 0.
+ *
+ * @opts
+ *   - `strict` (boolean) -- throw the decoder's own typed error instead of reporting an
+ *     undecodable value.
+ *   - `maxBytes` / `maxDepth` / `maxItems` (integer) -- decode caps for this call. Each may only
+ *     tighten the built-in ceiling.
+ * @example
+ *   var pair = await pki.key.generate("Ed25519");
+ *   var certDer = await pki.x509.sign({ subject: "leaf.example", subjectPublicKey: await pki.key.export(pair.publicKey),
+ *     notBefore: new Date("2026-01-01T00:00:00Z"), notAfter: new Date("2027-01-01T00:00:00Z"),
+ *     extensions: { basicConstraints: { cA: false } } },
+ *     { key: await pki.key.export(pair.privateKey) });
+ *   var parsed = pki.schema.x509.parse(certDer);
+ *   pki.schema.x509.decodeExtension(parsed.extensions[0]).state;  // -> "decoded"
+ */
+var decodeExtension = DOOR.decodeExtension;
+
 module.exports = {
   parse:     parse,
   pemDecode: pemDecode,
   pemEncode: pemEncode,
   matches:   matches,
+  decodeExtensions: decodeExtensions,
+  decodeExtension:  decodeExtension,
 };

package/lib/sigstore.js

@@ -1055,6 +1055,13 @@ async function _verifyChain(leaf, chainDers, fulcioRoots, timeMs) {
 
 
 var SAN_OID = oid.byName("subjectAltName");
+/** @internal The shared table's entry, so the SAN this verb reads is read under the rules every
+ * other consumer of a GeneralNames reads it under. It is built on the certificate namespace rather
+ * than this module's, so a malformed name raises a CertificateError that `_identity` re-types to
+ * `sigstore/bad-certificate` with that fault as its cause. That is the code this module already
+ * reports for a certificate it cannot read, so the fix adds no new code to the public surface. */
+var _sanDecoder = pkix.certExtensionDecoders(
+  pkix.makeNS("x509", frameworkError.CertificateError, oid)).byOid[SAN_OID];
 var FULCIO_PREFIX = _join(_arraySlice(_split(oid.byName("otherName"), "."), 0, -1), ".") + ".";
 function _identity(leaf) {
   var out = { san: null, extensions: _create(null) };
@@ -1072,29 +1079,36 @@ function _identity(leaf) {
   return out;
 }
 var GN_TYPE = _assign(_create(null), { 1: "rfc822Name", 2: "dNSName", 6: "uri" });
+/** @internal The GeneralNames come from the shared extension decoder, which is where the RFC 5280
+ * sec. 4.2.1.6 rules live: at least one name, a non-empty IA5String for the text forms, and no
+ * control byte inside one (CVE-2009-2408). Reading the SEQUENCE here instead left this verb
+ * accepting a dNSName carrying a NUL or a CR and handing it on as the signer's identity.
+ *
+ * The one-identity rule counts every name the SAN carries, not the subset this verb turns into an
+ * identity string. Counting only the recognized forms let a certificate pair a URI with an
+ * iPAddress and pass as single-identity, with the second binding invisible to the caller's policy
+ * -- which is the thing the rule exists to stop. A SAN of one name this verb has no string form
+ * for still yields null, so a policy gates on the null rather than on a name nothing read. */
 function _sanValue(ext) {
-  var seq = asn1.decode(ext.value);
-  var names = [];
-  for (var i = 0; i < (seq.children || []).length; i++) {
-    var n = seq.children[i];
-    if (n.tagClass !== "context") continue;
-    var val = null;
-    if (!n.constructed && GN_TYPE[n.tagNumber]) {
-      val = { type: GN_TYPE[n.tagNumber], value: _bufToString(asn1.read.octetStringImplicit(n, n.tagNumber), "utf8") };
-    } else if (n.constructed && n.tagNumber === 0 && (n.children || []).length >= 2) {
-      var inner = (n.children[1].children || [])[0] || n.children[1];
-      var v;
-      try {
-        v = asn1.read.string(inner);
-      } catch (_e) {
-        v = null;
-      }
-      val = { type: "otherName", oid: asn1.read.oid(n.children[0]), value: v };
-    }
-    if (val) guard.list.append(names, val);
+  /** @internal The shared decoder is the gate: it applies the sec. 4.2.1.6 rules and throws on a
+   * name that breaks one. What it returns is a GeneralNames view rather than the codec nodes the
+   * mapping below reads, so the count comes from it and the one name is then taken from the raw
+   * decode, which carries the node shape `octetStringImplicit` and the otherName walk need. */
+  var validated = _sanDecoder(ext.value).names || [];
+  if (validated.length > 1) throw _err("sigstore/bad-certificate", "the Fulcio certificate carries multiple SAN identities");
+  var n = (asn1.decode(ext.value).children || [])[0];
+  if (!n || n.tagClass !== "context") return null;
+  if (!n.constructed && GN_TYPE[n.tagNumber]) {
+    return { type: GN_TYPE[n.tagNumber], value: _bufToString(asn1.read.octetStringImplicit(n, n.tagNumber), "utf8") };
+  }
+  if (n.constructed && n.tagNumber === 0 && (n.children || []).length >= 2) {
+    var inner = (n.children[1].children || [])[0] || n.children[1];
+    var v;
+    try { v = asn1.read.string(inner); }
+    catch (_e) { v = null; }      // allow:swallow-unverified an otherName body with no string form has no identity string, which the caller's policy then gates on
+    return { type: "otherName", oid: asn1.read.oid(n.children[0]), value: v };
   }
-  if (names.length > 1) throw _err("sigstore/bad-certificate", "the Fulcio certificate carries multiple SAN identities");
-  return names[0] || null;
+  return null;
 }
 function _fulcioExtValue(ext, leafArc) {
   if (!_isBuffer(ext.value)) throw _err("sigstore/bad-certificate", "Fulcio extension " + ext.oid + " has no value");

package/lib/tsp-sign.js

@@ -34,6 +34,9 @@ var pkiBuild = require("./pki-build");
 var constants = require("./constants");
 var TspError = frameworkError.TspError;
 var _NS = pkix.makeNS("tsp", TspError, oid);
+/** @internal The shared certificate-extension decoders, so an extension this module reads is read
+ * under the rules every other consumer reads it under rather than under a second set written here. */
+var _EXT_DECODERS = pkix.certExtensionDecoders(_NS).byOid;
 var b = asn1.build;
 function _err(code, message, cause) { return new TspError(code, message, cause); }
 
@@ -487,12 +490,13 @@ function _checkTsaCertUsage(tsaCertDer) {
   var exts = (cert.extensions || []).filter(function (e) { return e.oid === O("extKeyUsage"); });
   if (exts.length !== 1) return "tsp/bad-eku";
   if (!exts[0].critical) return "tsp/eku-not-critical";
-  var purposes, ekuNode;
-  try { ekuNode = asn1.decode(exts[0].value); }
-  catch (_e) { return "tsp/bad-eku"; }
-  if (ekuNode.tagClass !== "universal" || ekuNode.tagNumber !== asn1.TAGS.SEQUENCE || !ekuNode.children) return "tsp/bad-eku";
-  try { purposes = ekuNode.children.map(function (c) { return asn1.read.oid(c); }); }
-  catch (_e) { return "tsp/bad-eku"; }
+  /** @internal Read through the shared decoder, which is where the sec. 4.2.1.12 rules live: an
+   * ExtKeyUsage carries at least one KeyPurposeId. Reading the SEQUENCE here instead called an
+   * empty one well-formed and then reported it as the wrong PURPOSE, so the same class of fault
+   * answered with a different code here than at every other consumer of this extension. */
+  var purposes;
+  try { purposes = _EXT_DECODERS[O("extKeyUsage")](exts[0].value); }
+  catch (_e) { return "tsp/bad-eku"; }   // allow:swallow-unverified this verb answers with a code rather than throwing, and every malformed shape is the one code
   if (purposes.length !== 1 || purposes[0] !== O("timeStamping")) return "tsp/eku-not-exclusive";
   var ku;
   try { ku = pkix.keyUsageOf(_NS, cert, _err, "tsp/bad-key-usage", "TSA certificate"); }
@@ -508,13 +512,16 @@ function _tsaMatchesCert(tsaBytes, signerCert) {
   if (gn.tagNumber === 4 && gn.value && guard.name.dnEqual(gn.value.rdns, signerCert.subject.rdns, _err, "tsp/tsa-mismatch", "the TSA subject")) return true;
   var sanExt = (signerCert.extensions || []).filter(function (e) { return e.oid === O("subjectAltName"); })[0];
   if (sanExt) {
-    var san;
-    try { san = asn1.decode(sanExt.value); }
-    catch (_e) { return false; }
-    if (san.tagClass === "universal" && san.tagNumber === asn1.TAGS.SEQUENCE && san.children) {
-      for (var i = 0; i < san.children.length; i++) {
-        if (san.children[i].bytes.equals(tsaBytes)) return true;
-      }
+    /** @internal Gated by the shared decoder before the comparison, so a SAN this toolkit refuses
+     * everywhere else cannot be a source of identity here. The match itself stays a comparison of
+     * the encoded GeneralName bytes, which is what "the token names this TSA" means: the name in
+     * the token and the name in the certificate have to be the same name, not merely names that
+     * decode alike. */
+    var names;
+    try { names = _EXT_DECODERS[O("subjectAltName")](sanExt.value).names || []; }
+    catch (_e) { return false; }   // allow:swallow-unverified a SAN that does not decode names no TSA, which is what this verb answers
+    for (var i = 0; i < names.length; i++) {
+      if (names[i].bytes && names[i].bytes.equals(tsaBytes)) return true;
     }
   }
   return false;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.8.9",
+  "version": "0.8.11",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:1d0c3725-eae5-4743-8430-5684e3e52ec7",
+  "serialNumber": "urn:uuid:41170205-6ef3-4f77-9577-7ba33e5632bc",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-09-23T19:11:33.586Z",
+    "timestamp": "2026-09-23T22:37:26.125Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.8.9",
+      "bom-ref": "@blamejs/pki@0.8.11",
       "type": "application",
       "name": "pki",
-      "version": "0.8.9",
+      "version": "0.8.11",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.8.9",
+      "purl": "pkg:npm/%40blamejs/pki@0.8.11",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.8.9",
+      "ref": "@blamejs/pki@0.8.11",
       "dependsOn": []
     }
   ]