@blamejs/pki 0.9.4 → 0.9.6

package/lib/pki-build.js

@@ -648,6 +648,36 @@ function makeBuilder(ctx) {
     if (bc.pathLen != null) pathLen(bc.pathLen);
     guard.identifier.assertKnownKeys(bc, BC_KEYS, E, "bad-input", "unknown basicConstraints field ");
   }
+
+  /** @internal The criticality a caller states for an extension, read as the boolean each flag
+   * documents and resolved to the default an omitted flag selects. RFC 5280 sec. 4.2 fixes
+   * keyUsage critical and leaves the other five non-critical, which is why the defaults differ.
+   * `basicConstraints` carries its own flag inside the value and is typed by `validateBcSpec`.
+   *
+   * The flags are RETURNED, so the emitters below read criticality from this record rather than
+   * from the caller's spec a second time. A flag read off the spec at the point of emission is a
+   * read of a value that was never typed: measured, `extendedKeyUsageCritical: "false"` emitted
+   * that extension critical, and an extension a relying party does not recognize as critical is
+   * one RFC 5280 sec. 6.1 requires it to reject. */
+  var CRITICALITY_FLAGS = [
+    ["keyUsageCritical", true],
+    ["extendedKeyUsageCritical", false],
+    ["certificatePoliciesCritical", false],
+    ["policyMappingsCritical", false],
+    ["qcStatementsCritical", false],
+    ["tlsFeatureCritical", false],
+  ];
+  function criticality(extSpec, label) {
+    var out = intrinsic.create(null);
+    var where = label || "extensions";
+    for (var i = 0; i < CRITICALITY_FLAGS.length; i++) {
+      var k = CRITICALITY_FLAGS[i][0];
+      out[k] = CRITICALITY_FLAGS[i][1]
+        ? guard.identifier.booleanOptionDefaultOn(extSpec[k], E, "bad-input", where + "." + k)
+        : guard.identifier.booleanOption(extSpec[k], E, "bad-input", where + "." + k);
+    }
+    return out;
+  }
   function extBasicConstraints(spec) {
     var children = [];
     if (spec.cA === true) _push(children,b.boolean(true));
@@ -1368,16 +1398,17 @@ function makeBuilder(ctx) {
     guard.identifier.assertKnownKeys(extSpec, REQ_EXT_KEYS, E, "bad-input", function (k) {
       return "unknown requested extension " + JSON.stringify(k) + "; pass a pre-encoded Extension DER via the array form for a custom extension";
     });
+    var crit = criticality(extSpec, "requested extensions");
     var out = [];
     if (extSpec.subjectKeyIdentifier != null) {
       if (extSpec.subjectKeyIdentifier === true && spki == null) throw E("bad-input", "subjectKeyIdentifier auto-derive (true) requires the public key -- supply a Buffer key id, or include the public key");
       _push(out,ext(O("subjectKeyIdentifier"), false, extSki(skiKeyId(extSpec.subjectKeyIdentifier, spki))));
     }
-    if (extSpec.keyUsage != null) _push(out,ext(O("keyUsage"), extSpec.keyUsageCritical !== false, extKeyUsage(extSpec.keyUsage)));
-    if (extSpec.extendedKeyUsage != null) _push(out,ext(O("extKeyUsage"), !!extSpec.extendedKeyUsageCritical, extExtKeyUsage(extSpec.extendedKeyUsage)));
+    if (extSpec.keyUsage != null) _push(out,ext(O("keyUsage"), crit.keyUsageCritical, extKeyUsage(extSpec.keyUsage)));
+    if (extSpec.extendedKeyUsage != null) _push(out,ext(O("extKeyUsage"), crit.extendedKeyUsageCritical, extExtKeyUsage(extSpec.extendedKeyUsage)));
     if (extSpec.basicConstraints != null) { validateBcSpec(extSpec.basicConstraints); _push(out,ext(O("basicConstraints"), extSpec.basicConstraints.critical !== false, extBasicConstraints(extSpec.basicConstraints))); }
     if (extSpec.subjectAltName != null) _push(out,ext(O("subjectAltName"), false, extSan(extSpec.subjectAltName)));
-    if (extSpec.certificatePolicies != null) _push(out,ext(O("certificatePolicies"), !!extSpec.certificatePoliciesCritical, extCertPolicies(extSpec.certificatePolicies)));
+    if (extSpec.certificatePolicies != null) _push(out,ext(O("certificatePolicies"), crit.certificatePoliciesCritical, extCertPolicies(extSpec.certificatePolicies)));
     /** @internal RFC 5280 sec. 4.2.1.10 fixes this extension critical, in a request as in the certificate. */
     if (extSpec.nameConstraints != null) guard.list.append(out, ext(O("nameConstraints"), true, extNameConstraints(extSpec.nameConstraints)));
     if (extSpec.authorityInfoAccess != null) guard.list.append(out, ext(O("authorityInfoAccess"), false, extAuthorityInfoAccess(extSpec.authorityInfoAccess)));
@@ -1385,14 +1416,14 @@ function makeBuilder(ctx) {
     if (extSpec.freshestCRL != null) guard.list.append(out, ext(O("freshestCRL"), false, extCrlDistributionPoints(extSpec.freshestCRL, "freshestCRL")));
     if (extSpec.policyConstraints != null) guard.list.append(out, ext(O("policyConstraints"), true, extPolicyConstraints(extSpec.policyConstraints)));
     if (extSpec.inhibitAnyPolicy != null) guard.list.append(out, ext(O("inhibitAnyPolicy"), true, extInhibitAnyPolicy(extSpec.inhibitAnyPolicy)));
-    if (extSpec.policyMappings != null) guard.list.append(out, ext(O("policyMappings"), !!extSpec.policyMappingsCritical, extPolicyMappings(extSpec.policyMappings)));
+    if (extSpec.policyMappings != null) guard.list.append(out, ext(O("policyMappings"), crit.policyMappingsCritical, extPolicyMappings(extSpec.policyMappings)));
     if (extSpec.issuerAltName != null) guard.list.append(out, ext(O("issuerAltName"), false, encodeGeneralNames(reqDenseArray(extSpec.issuerAltName, "issuerAltName"))));
-    if (extSpec.qcStatements != null) guard.list.append(out, ext(O("qcStatements"), !!extSpec.qcStatementsCritical, extQcStatements(extSpec.qcStatements)));
+    if (extSpec.qcStatements != null) guard.list.append(out, ext(O("qcStatements"), crit.qcStatementsCritical, extQcStatements(extSpec.qcStatements)));
     /** @internal RFC 7633 sec. 4.2.1 lets a request state the features the server supports, and
      *  sec. 4.3.2 asks a server to generate it, so a feature declaration is the requester's wish and
      *  belongs in this table. The criticality knob is here too, because a request carries the
      *  Extension shape whole and the CA decides what it issues. */
-    if (extSpec.tlsFeature != null) guard.list.append(out, ext(O("tlsFeature"), !!extSpec.tlsFeatureCritical, extTlsFeature(extSpec.tlsFeature)));
+    if (extSpec.tlsFeature != null) guard.list.append(out, ext(O("tlsFeature"), crit.tlsFeatureCritical, extTlsFeature(extSpec.tlsFeature)));
     if (extSpec.msCertificateTemplate != null) guard.list.append(out, ext(O("msCertificateTemplate"), false, extMsCertificateTemplate(extSpec.msCertificateTemplate)));
     if (extSpec.msEnrollCertType != null) guard.list.append(out, ext(O("msEnrollCertType"), false, extMsEnrollCertType(extSpec.msEnrollCertType)));
     if (extSpec.msApplicationPolicies != null) guard.list.append(out, ext(O("msApplicationPolicies"), false, extCertPolicies(extSpec.msApplicationPolicies)));
@@ -1457,6 +1488,7 @@ function makeBuilder(ctx) {
     encodeGeneralNames: encodeGeneralNames, serialInteger: serialInteger, timeDer: timeDer,
     requestedExtensions: requestedExtensions,
     extKeyUsage: extKeyUsage, extExtKeyUsage: extExtKeyUsage, validateBcSpec: validateBcSpec,
+    criticality: criticality,
     extBasicConstraints: extBasicConstraints, pathLen: pathLen, extSki: extSki, extAki: extAki, AKI_KEYS: AKI_KEYS,
     extSan: extSan, extCertPolicies: extCertPolicies, ext: ext,
     extSubjectInfoAccess: extSubjectInfoAccess, extSubjectDirectoryAttributes: extSubjectDirectoryAttributes,

package/lib/possession.js

@@ -118,7 +118,7 @@ var STATEMENT = schema.seq([
 });
 
 var KNOWN_VERIFY_OPTS = _assign(_create(null), {
-  trustAnchors: 1, time: 1, signatureCertificate: 1, intermediates: 1,
+  trustAnchors: 1, time: 1, signatureCertificate: 1, intermediates: 1, distrustedKeys: 1,
 });
 
 /** @internal Whether a certificate is the one an IssuerAndSerialNumber names. Both halves are compared,
@@ -345,6 +345,7 @@ var _isSignatureOnlyKey = pkix.signatureOnlyKeyOid(NS);
  *             that is present and is not a usable `Date` is `possession/bad-input`.
  * @opts signatureCertificate  The signature certificate, for a statement that omits it; refused when it is not the one `signer` names.
  * @opts intermediates  The rest of the signature certificate's path, when an intermediate CA issued it rather than an anchor directly. Ordered as `pki.path.validate` takes a path, from the certificate nearest an anchor down to the issuer of the signature certificate, which this verb appends. Omitted, the signature certificate is validated on its own, which succeeds only when an anchor issued it.
+ * @opts distrustedKeys  SHA-256 digests of SubjectPublicKeyInfo values (64 hex characters or 32 bytes each). A listed key on the anchor, an intermediate or the signature certificate makes `pathValidated` and `valid` false. A malformed list is `possession/bad-input`.
  *
  * @example
  *   var kem = await pki.key.generate({ name: "ML-KEM-768" });
@@ -382,6 +383,7 @@ function _verifyRequest(request, opts) {
   guard.identifier.assertKnownKeys(opts, KNOWN_VERIFY_OPTS, _err, "possession/bad-input",
     "pki.possession.verifyRequest has an unknown option: ");
   var o = guard.identifier.snapshotOptions(opts, KNOWN_VERIFY_OPTS);
+  var distrusted = guard.distrust.keys(o.distrustedKeys, _err, "possession/bad-input", "opts.distrustedKeys");
   if (o.trustAnchors == null || !_isArray(o.trustAnchors) || o.trustAnchors.length === 0) {
     throw _err("possession/bad-input",
       "opts.trustAnchors is required: RFC 9883 sec. 4 makes certification path validation of the signature certificate a MUST, and a verdict that skipped it would not answer the question asked");
@@ -522,8 +524,10 @@ function _verifyRequest(request, opts) {
       "authorize a certification request (RFC 5280 sec. 4.2.1.3)");
   }
 
+  var pathOpts = { trustAnchors: o.trustAnchors, time: at };
+  if (distrusted !== null) pathOpts.distrustedKeys = distrusted;
   return intrinsic.chain(
-    _promiseResolve(_Promise, _validatePath(chain, { trustAnchors: o.trustAnchors, time: at })),
+    _promiseResolve(_Promise, _validatePath(chain, pathOpts)),
     function (pathResult) {
       var pathValidated = pathResult.valid === true;
       if (!pathValidated) _push(reasons, "the signature certificate's certification path is not valid, and RFC 9883 sec. 4 makes that a MUST");

package/lib/related-cert.js

@@ -208,7 +208,7 @@ var KNOWN_VERIFY_OPTS = _assign(_create(null), { digestAlgorithm: 1, signatureAl
  *  an attacker's key verifies forever without it, and a verifier that cannot perform a MUST check must not
  *  answer true. `at` is the instant judged against, for a caller reading a request recorded earlier. */
 function _assertFresh(requestTime, o) {
-  if (o.maxAge === undefined) {
+  if (o.maxAge == null) {
     throw _err("relatedcert/no-freshness-policy",
       "pki.relatedCert.verifyRequest needs opts.maxAge, the seconds a requestTime may be old: RFC 9763 " +
       "sec. 3.2 requires the certification authority to check that it is sufficiently fresh and leaves " +
@@ -217,7 +217,7 @@ function _assertFresh(requestTime, o) {
   }
   var maxAge = guard.range.authoredInteger(o.maxAge, _err, "relatedcert/bad-input", "opts.maxAge");
   if (maxAge < 0n) throw _err("relatedcert/bad-input", "opts.maxAge must not be negative");
-  var at = o.at === undefined ? new intrinsic.Date() : o.at;
+  var at = o.at == null ? new intrinsic.Date() : o.at;
   if (!guard.time.isDate(at)) throw _err("relatedcert/bad-input", "opts.at must be a Date");
   guard.time.assertValid(at, _err, "relatedcert/bad-input", "opts.at");
   var atMs = guard.time.instantOf(at);

package/lib/revocation-fetch.js

@@ -398,7 +398,8 @@ async function _tryOcsp(state, cert, issuer, ctx, candidate) {
     hit = got.body;
   }
   var v = await state.verifyOcspResponse(hit, cert, issuerCert, ctx.time,
-    { historicalMode: ctx.historicalMode === true, requestNonce: state.nonce ? _requestNonce(parsedReq) : undefined });
+    { historicalMode: ctx.historicalMode === true, requestNonce: state.nonce ? _requestNonce(parsedReq) : undefined,
+      distrustedKeys: state.distrusted });
   /** @internal `valid` on that verdict means the certificate is good, not that the response was
    * acceptable, so reading it as acceptance would turn a `revoked` answer into an undetermined
    * one that `opts.softFail` could then waive. Acceptance is the three conditions the gate
@@ -670,7 +671,9 @@ function _deltaUrlsFor(parsedCrl, state) {
  *                          of the same shape. A transport that does not declare that it blocks
  *                          private addresses is refused a hostname.
  * @opts  allowPlaintextHttp  Whether an `http` URL is fetched. Default `true`.
- * @opts  useDeltas         Whether a freshestCRL delta is fetched and merged. Default `true`.
+ * @opts  useDeltas         Whether a freshestCRL delta is fetched and merged. Default `true`. A
+ *                         value other than `true`, `false`, `null` or an absent option is refused
+ *                         `path/bad-input`.
  * @opts  nonce             Whether an OCSP request carries a 32-octet nonce. `true` or `false`,
  *                          and anything else is `path/bad-input` rather than the default, since a
  *                          control read as off is one an operator asked for and did not get.
@@ -693,6 +696,21 @@ function _deltaUrlsFor(parsedCrl, state) {
  *   var checker = pki.path.fetchingChecker({ transport: pki.transport.https({}) });
  *   console.log(typeof checker.check);
  */
+/** @internal The TLS policy every fetch is sent with, copied once at the door, with its distrust list
+ *  typed there. A fetch fault becomes an undetermined verdict, so a malformed list that reached the
+ *  transport would be reported as a responder that did not answer. */
+function _tlsSnapshot(tls) {
+  if (tls == null) return tls;
+  guard.identifier.assertKnownKeys(tls, httpTransport.TLS_KEYS, E, "path/bad-input", "fetchingChecker: opts.tls has an unknown option ");
+  /** @internal Each setting the transport reads is taken by value, whether the bag holds it or
+   *  inherits it, which is how the transport itself reads the bag. */
+  var copy = guard.identifier.pickSettings(tls, intrinsic.keys(httpTransport.TLS_KEYS));
+  if (copy.distrustedKeys != null) {
+    copy.distrustedKeys = guard.distrust.keys(copy.distrustedKeys, E, "path/bad-input", "fetchingChecker: opts.tls.distrustedKeys");
+  }
+  return copy;
+}
+
 function fetchingChecker(opts) {
   opts = guard.identifier.optionsObject(opts, E, "path/bad-input", "fetchingChecker: opts");
   guard.identifier.assertKnownKeys(opts, CHECKER_OPTS, E, "path/bad-input",
@@ -701,6 +719,7 @@ function fetchingChecker(opts) {
    * accessor twice, so the transport that passed the door is the transport that gets called. */
   var transport = guard.identifier.assertCallable(opts.transport, E, "path/bad-input",
     "fetchingChecker: opts.transport", TRANSPORT_SHAPE);
+  // allow:caller-option-presence-tested-against-undefined -- absence selects the permissive default, so a null must not reach it
   var allowPlaintextHttp = opts.allowPlaintextHttp === undefined ? true : opts.allowPlaintextHttp === true;
   var cfg = {
     transport: transport,
@@ -709,9 +728,13 @@ function fetchingChecker(opts) {
      * door is the value the rule is applied on. */
     net: intrinsic.freeze({ allowHttp: allowPlaintextHttp, guardsAddresses: _declaresAddressGuard(transport) }),
     allowPlaintextHttp: allowPlaintextHttp,
-    useDeltas: !(opts.useDeltas === false),
+    /** @internal Read the way `nonce` on the next line has been read since it was written: the
+     * comparison this replaces answered for a value of any other type by fetching the deltas the
+     * caller declined. */
+    useDeltas: guard.identifier.booleanOptionDefaultOn(opts.useDeltas, E, "path/bad-input",
+      "fetchingChecker: opts.useDeltas"),
     nonce: _booleanOption(opts.nonce, "fetchingChecker: opts.nonce"),
-    tls: opts.tls,
+    tls: _tlsSnapshot(opts.tls),
     maxFetches: guard.limits.cap(opts.maxFetches, "fetchingChecker: opts.maxFetches", LIMITS.REVOCATION_MAX_FETCHES,
       { E: E, code: "path/bad-input", min: 1, max: LIMITS.REVOCATION_MAX_FETCHES }),
     maxPerCert: guard.limits.cap(opts.maxPerCert, "fetchingChecker: opts.maxPerCert", LIMITS.REVOCATION_MAX_PER_CERT,
@@ -751,10 +774,17 @@ function fetchingChecker(opts) {
 
   return {
     check: async function (cert, issuer, ctx) {
+      /** @internal Typed before any location is decoded or fetched: a malformed list is the
+       * caller's fault and is thrown, where a fetch fault below becomes an undetermined verdict. */
+      var distrusted = guard.distrust.keys(ctx == null ? undefined : ctx.distrustedKeys, E, "path/bad-input",
+        "fetchingChecker: ctx.distrustedKeys");
+      if (guard.distrust.has(distrusted, issuer.workingPublicKey)) {
+        return _unknown("the issuer's key is listed in distrustedKeys, so nothing it signs is an answer", [], []);
+      }
       var notes = [], skips = [];
       var budget = budgetFor(ctx == null ? null : ctx.run);
       var state = intrinsic.assign(intrinsic.create(null), cfg, {
-        notes: notes, cache: cache, crlCache: crlCache,
+        notes: notes, cache: cache, crlCache: crlCache, distrusted: distrusted,
         deadline: budget.deadline,
         fetches: budget.fetches,
         urls: new intrinsic.Set(),
@@ -781,7 +811,9 @@ function fetchingChecker(opts) {
        * number of retries. A responder that answers `revoked` or `good` ends it; anything else
        * falls through, because sec. 5 of RFC 6960 makes the CRL the fallback and never an
        * assumption of good standing. */
-      var lastReason = null;
+      /** @internal Each source keeps its own last failure, so an undetermined verdict names the
+       * responder's fault and the CRL's. They usually have different causes. */
+      var ocspReason = null, crlReason = null;
       for (var a = 0; a <= cfg.retries && ocspCands.length > 0; a++) {
         for (var o = 0; o < ocspCands.length; o++) {
           if (!_takeUrl(state, ocspCands[o].url)) {
@@ -791,18 +823,21 @@ function fetchingChecker(opts) {
           try {
             var got = await _tryOcsp(state, cert, issuer, ctx, ocspCands[o]);
             if (got.status === "good" || got.status === "revoked") return _verdict(got, notes, skips);
-            lastReason = got.reason + " reported " + got.status;
-          } catch (e) { lastReason = _say(e); }
+            ocspReason = got.reason + " reported " + got.status;
+          } catch (e) { ocspReason = _say(e); }
         }
       }
       if (crlCands.length > 0) {
         try {
           var viaCrl = await _tryCrl(state, cert, issuer, ctx, crlCands, certDeltas);
           if (viaCrl.status === "good" || viaCrl.status === "revoked") return _verdict(viaCrl, notes, skips);
-          lastReason = viaCrl.reason;
-        } catch (e2) { lastReason = _say(e2); }
+          crlReason = viaCrl.reason;
+        } catch (e2) { crlReason = _say(e2); }
       }
-      return _unknown(lastReason || "no revocation source answered", notes, skips);
+      var why = [];
+      if (ocspReason !== null) _append(why, "OCSP: " + ocspReason);
+      if (crlReason !== null) _append(why, "CRL: " + crlReason);
+      return _unknown(why.length ? intrinsic.join(why, "; ") : "no revocation source answered", notes, skips);
     },
   };
 }

package/lib/scep.js

@@ -28,6 +28,12 @@
  *   the message layer, transport-agnostic; a live SCEP CA is driven over
  *   pki.transport separately.
  *
+ *   Every verb that reaches a CA accepts the same transport bounds, listed on
+ *   each of them. One of those bounds is a switch: `allowCrossOriginRedirect`
+ *   opts in to following a cross-origin redirect on an unsafe method. It is a
+ *   boolean, and a value other than `true`, `false`, `null` or an absent option
+ *   is refused `scep/bad-input` before the first request goes out.
+ *
  * @card
  *   Build and read SCEP (RFC 8894) messages: a PKCSReq, RenewalReq, CertPoll,
  *   GetCert, or GetCRL request, or a CA-side CertRep response, wrapped in the
@@ -683,10 +689,25 @@ function _responseLen(body) {
   if (Buffer.isBuffer(body)) return guard.bytes.lengthOf(body);
   return guard.bytes.lengthOf(guard.bytes.source(body, ScepError, "scep/bad-response", "the response body"));
 }
-/** @internal The settings this client forwards to its transport. */
-var TLS_SETTINGS = ["anchors", "useSystemStore", "cert", "key", "minVersion", "servername", "checkServerIdentity"];
-function _tlsForRequest(opts) {
-  return guard.identifier.pickSettings(opts.tls, TLS_SETTINGS);
+/** @internal The settings this client forwards to its transport. The distrust list is typed here, and
+ *  the frozen copy is the one every hop carries. A setting not on the list is refused. */
+var TLS_SETTINGS = ["anchors", "useSystemStore", "cert", "key", "minVersion", "servername", "checkServerIdentity", "distrustedKeys"];
+var TLS_KNOWN = intrinsic.freeze(guard.identifier.pickSettings(null, TLS_SETTINGS));
+function _distrustOf(value) {
+  return guard.distrust.keys(value, _err, "scep/bad-input", "opts.tls.distrustedKeys");
+}
+function _tlsForRequest(tls) {
+  guard.identifier.assertKnownKeys(tls, TLS_KNOWN, _err, "scep/bad-input", "unknown opts.tls setting ");
+  var t = guard.identifier.pickSettings(tls, TLS_SETTINGS);
+  t.distrustedKeys = _distrustOf(t.distrustedKeys);
+  return t;
+}
+/** @internal A verb that reaches the transport only after an await copies the caller's tls at its door,
+ *  with the distrust list typed there, so a later change to the caller's array does not reach the request.
+ *  Each setting is read the way `_tlsForRequest` reads it, a prototype included. */
+function _snapshotTls(tls) {
+  if (tls == null) return tls;
+  return _tlsForRequest(tls);
 }
 function _redirectTarget(current, location, method, allowCrossOrigin) {
   if (location == null || _trim(String(location)) === "") throw _err("scep/bad-response", "a redirect response carried no Location header");
@@ -730,8 +751,12 @@ function _pkiRequest(method, opUrl, reqMsg, clientOpts) {
 function _drive(method, url, body, headers, opts, transport, budgets) {
   var redirects = 0, curMethod = method, curBody = body, initialOrigin = _urlOrigin(url);
   var proxySnap = _snapshotProxy(opts.proxy);
-  var tlsBase = _tlsForRequest(opts);
-  var allowCrossOrigin = !!opts.allowCrossOriginRedirect;
+  var tlsBase = _tlsForRequest(opts.tls);
+  /** @internal Read as the boolean it documents, on the one path every network verb here takes and
+   * before the first request. Taken by truthiness, `allowCrossOriginRedirect: "false"` ALLOWED the
+   * cross-origin redirect on an unsafe method that the check below exists to refuse. */
+  var allowCrossOrigin = guard.identifier.booleanOption(opts.allowCrossOriginRedirect, _err,
+    "scep/bad-input", "opts.allowCrossOriginRedirect");
   function _hopTls(current) {
     var t = tlsBase;
     if (_urlOrigin(current) !== initialOrigin) {
@@ -858,7 +883,7 @@ function _assertStrongProfile(caps, profile) {
  *   - `transport` -- an injected transport (defaults to `pki.transport.https`); the request is a GET with no body.
  *   - `expectSCEPStandard` -- refuse (`scep/weak-profile`) if the response does not advertise `SCEPStandard`. Takes `true`, `false`, `null` or an absent option; any other value is refused `scep/bad-input`.
  *   - `requireStrongProfile` -- refuse unless AES + SHA-256 + POSTPKIOperation are all advertised. Read the same way.
- *   - `timeout` / `maxResponseBytes` / `maxRedirects` / `tls` / `allowCrossOriginRedirect` / `proxy` -- transport bounds (`proxy` reaches the CA through a forward HTTP proxy; see pki.transport).
+ *   - `timeout` / `maxResponseBytes` / `maxRedirects` / `tls` / `allowCrossOriginRedirect` / `proxy` -- transport bounds (`proxy` reaches the CA through a forward HTTP proxy; see pki.transport). `tls.distrustedKeys` lists SHA-256 SubjectPublicKeyInfo digests (see pki.trust.spkiDigest); a server whose chain carries a listed key is refused with `scep/server-key-distrusted` on every hop, and a malformed list is `scep/bad-input`. A `tls` setting other than `anchors`, `useSystemStore`, `cert`, `key`, `minVersion`, `servername`, `checkServerIdentity` and `distrustedKeys` is refused `scep/bad-input`.
  * @example
  *   // requires: scepTransport -- an injected transport (omit to use pki.transport.https)
  *   var caps = await pki.scep.getCACaps("http://ca.example/scep", { transport: scepTransport });
@@ -942,7 +967,7 @@ function _normalizeFingerprint(fp, algName) {
  * @opts
  *   - `expectedFingerprint` -- a hex string or Buffer; a returned certificate must hash to it, or the response is refused.
  *   - `fingerprintAlgorithm` -- the hash for the fingerprint (default "sha256").
- *   - `transport` / `timeout` / `maxResponseBytes` / `maxRedirects` / `tls` / `allowCrossOriginRedirect` / `proxy` -- transport bounds (`proxy` reaches the CA through a forward HTTP proxy; see pki.transport).
+ *   - `transport` / `timeout` / `maxResponseBytes` / `maxRedirects` / `tls` / `allowCrossOriginRedirect` / `proxy` -- transport bounds (`proxy` reaches the CA through a forward HTTP proxy; see pki.transport). `tls.distrustedKeys` lists SHA-256 SubjectPublicKeyInfo digests (see pki.trust.spkiDigest); a server whose chain carries a listed key is refused with `scep/server-key-distrusted` on every hop, and a malformed list is `scep/bad-input`. A `tls` setting other than `anchors`, `useSystemStore`, `cert`, `key`, `minVersion`, `servername`, `checkServerIdentity` and `distrustedKeys` is refused `scep/bad-input`.
  * @example
  *   // requires: scepCaCertTransport -- an injected transport returning a single CA certificate
  *   var ca = await pki.scep.getCACert("http://ca.example/scep", { transport: scepCaCertTransport });
@@ -998,7 +1023,7 @@ async function getCACert(baseUrl, opts) {
  *
  * @opts
  *   - `caCertificate` -- the current SCEP CA certificate DER; the response is authenticated against its key (required).
- *   - `transport` / `timeout` / `maxResponseBytes` / `maxRedirects` / `tls` / `allowCrossOriginRedirect` / `proxy` -- transport bounds (`proxy` reaches the CA through a forward HTTP proxy; see pki.transport).
+ *   - `transport` / `timeout` / `maxResponseBytes` / `maxRedirects` / `tls` / `allowCrossOriginRedirect` / `proxy` -- transport bounds (`proxy` reaches the CA through a forward HTTP proxy; see pki.transport). `tls.distrustedKeys` lists SHA-256 SubjectPublicKeyInfo digests (see pki.trust.spkiDigest); a server whose chain carries a listed key is refused with `scep/server-key-distrusted` on every hop, and a malformed list is `scep/bad-input`. A `tls` setting other than `anchors`, `useSystemStore`, `cert`, `key`, `minVersion`, `servername`, `checkServerIdentity` and `distrustedKeys` is refused `scep/bad-input`.
  * @example
  *   // requires: caCertDer -- the current CA certificate (from getCACert), scepTransport
  *   var next = await pki.scep.getNextCACert("http://ca.example/scep", { caCertificate: caCertDer, transport: scepTransport });
@@ -1104,7 +1129,7 @@ async function _pkiOperation(messageType, baseUrl, opts, verbName) {
   var recipientKey = _captureRecipientKey(opts.recipientKey);
   var signer = { cert: guard.bytes.snapshotSource(opts.signer.cert, ScepError, "scep/bad-input", "signer.cert"), key: opts.signer.key };
   var clientOpts = {
-    tls: opts.tls != null ? guard.identifier.ownOptions(opts.tls) : opts.tls,
+    tls: _snapshotTls(opts.tls),
     maxRedirects: opts.maxRedirects,
     allowCrossOriginRedirect: opts.allowCrossOriginRedirect,
     timeout: opts.timeout,
@@ -1177,7 +1202,7 @@ async function _pkiOperation(messageType, baseUrl, opts, verbName) {
  *   - `sleep` -- an injectable sleeper `(ms) -> Promise` for the Retry-After wait (default a real timer).
  *   - `onRetryAfter` -- an optional observer `(delaySeconds) -> void` called before each poll sleep.
  *   - `httpMethod` -- `"POST"` (default) or `"GET"`. RFC 8894 sec. 4.1 sends the PKIOperation message over POST; `"GET"` carries it base64-encoded in the URL `message` query for a legacy CA that lacks POST.
- *   - `transport` / `timeout` / `maxResponseBytes` / `maxRedirects` / `tls` / `allowCrossOriginRedirect` / `proxy` -- transport bounds (`proxy` reaches the CA through a forward HTTP proxy; see pki.transport).
+ *   - `transport` / `timeout` / `maxResponseBytes` / `maxRedirects` / `tls` / `allowCrossOriginRedirect` / `proxy` -- transport bounds (`proxy` reaches the CA through a forward HTTP proxy; see pki.transport). `tls.distrustedKeys` lists SHA-256 SubjectPublicKeyInfo digests (see pki.trust.spkiDigest); a server whose chain carries a listed key is refused with `scep/server-key-distrusted` on every hop, and a malformed list is `scep/bad-input`. A `tls` setting other than `anchors`, `useSystemStore`, `cert`, `key`, `minVersion`, `servername`, `checkServerIdentity` and `distrustedKeys` is refused `scep/bad-input`.
  * @example
  *   // requires: scepCsr, caCertDer, clientCertDer, clientKeyPkcs8, scepTransport
  *   var out = await pki.scep.enroll("http://ca.example/scep", { csr: scepCsr, caCert: caCertDer,
@@ -1255,7 +1280,7 @@ async function _queryOperation(messageType, baseUrl, opts, verbName) {
   var recipientKey = _captureRecipientKey(opts.recipientKey);
   var signer = { cert: guard.bytes.snapshotSource(opts.signer.cert, ScepError, "scep/bad-input", "signer.cert"), key: opts.signer.key };
   var want = _resolveQueryTarget(opts);
-  var clientOpts = { tls: opts.tls != null ? guard.identifier.ownOptions(opts.tls) : opts.tls, maxRedirects: opts.maxRedirects, allowCrossOriginRedirect: opts.allowCrossOriginRedirect, timeout: opts.timeout, maxResponseBytes: opts.maxResponseBytes, proxy: _snapshotProxy(opts.proxy) };
+  var clientOpts = { tls: _snapshotTls(opts.tls), maxRedirects: opts.maxRedirects, allowCrossOriginRedirect: opts.allowCrossOriginRedirect, timeout: opts.timeout, maxResponseBytes: opts.maxResponseBytes, proxy: _snapshotProxy(opts.proxy) };
   if (checkedTransport !== undefined) clientOpts.transport = checkedTransport;
   var senderNonce = guard.crypto.randomBytes(16);
   var transactionId = opts.transactionId != null ? opts.transactionId : _defaultTransactionId();
@@ -1295,7 +1320,7 @@ async function _queryOperation(messageType, baseUrl, opts, verbName) {
  *   - `responderCert` -- the certificate to authenticate the CA response signature against (defaults to `caCert`).
  *   - `transactionId` -- a caller-unique PrintableString (defaults to 16 random bytes, hex-encoded).
  *   - `httpMethod` -- `"POST"` (default) or `"GET"`. RFC 8894 sec. 4.1 sends the PKIOperation message over POST; `"GET"` carries it base64-encoded in the URL `message` query for a legacy CA that lacks POST.
- *   - `transport` / `timeout` / `maxResponseBytes` / `maxRedirects` / `tls` / `allowCrossOriginRedirect` / `proxy` -- transport bounds (`proxy` reaches the CA through a forward HTTP proxy; see pki.transport).
+ *   - `transport` / `timeout` / `maxResponseBytes` / `maxRedirects` / `tls` / `allowCrossOriginRedirect` / `proxy` -- transport bounds (`proxy` reaches the CA through a forward HTTP proxy; see pki.transport). `tls.distrustedKeys` lists SHA-256 SubjectPublicKeyInfo digests (see pki.trust.spkiDigest); a server whose chain carries a listed key is refused with `scep/server-key-distrusted` on every hop, and a malformed list is `scep/bad-input`. A `tls` setting other than `anchors`, `useSystemStore`, `cert`, `key`, `minVersion`, `servername`, `checkServerIdentity` and `distrustedKeys` is refused `scep/bad-input`.
  * @example
  *   // requires: clientCertDer, caCertDer, clientKeyPkcs8, scepTransport
  *   var out = await pki.scep.getCert("http://ca.example/scep", { certificate: clientCertDer, caCert: caCertDer,
@@ -1344,7 +1369,7 @@ async function getCert(baseUrl, opts) {
  *   - `responderCert` -- the certificate to authenticate the CA response against (defaults to `caCert`).
  *   - `transactionId` -- a caller-unique PrintableString (defaults to 16 random bytes, hex-encoded).
  *   - `httpMethod` -- `"POST"` (default) or `"GET"`. RFC 8894 sec. 4.1 sends the PKIOperation message over POST; `"GET"` carries it base64-encoded in the URL `message` query for a legacy CA that lacks POST.
- *   - `transport` / `timeout` / `maxResponseBytes` / `maxRedirects` / `tls` / `allowCrossOriginRedirect` / `proxy` -- transport bounds (`proxy` reaches the CA through a forward HTTP proxy; see pki.transport).
+ *   - `transport` / `timeout` / `maxResponseBytes` / `maxRedirects` / `tls` / `allowCrossOriginRedirect` / `proxy` -- transport bounds (`proxy` reaches the CA through a forward HTTP proxy; see pki.transport). `tls.distrustedKeys` lists SHA-256 SubjectPublicKeyInfo digests (see pki.trust.spkiDigest); a server whose chain carries a listed key is refused with `scep/server-key-distrusted` on every hop, and a malformed list is `scep/bad-input`. A `tls` setting other than `anchors`, `useSystemStore`, `cert`, `key`, `minVersion`, `servername`, `checkServerIdentity` and `distrustedKeys` is refused `scep/bad-input`.
  * @example
  *   // requires: clientCertDer, caCertDer, clientKeyPkcs8, scepTransport
  *   var out = await pki.scep.getCrl("http://ca.example/scep", { certificate: clientCertDer, caCert: caCertDer,

package/lib/schema-pkix.js

@@ -1557,7 +1557,7 @@ function _extensionRow(ext, opts, index, state, decoded, code, profile) {
   row.value = ext.value;
   row.scope = opts.scope;
   row.index = index;
-  row.containerIndex = opts.containerIndex === undefined ? null : opts.containerIndex;
+  row.containerIndex = opts.containerIndex == null ? null : opts.containerIndex;
   row.state = state;
   row.decoded = decoded;
   row.code = code;
@@ -1754,7 +1754,7 @@ function extensionDoor(spec) {
   }
 
   function decodeExtension(ext, callerOpts) {
-    var read = readOpts(callerOpts, "decodeExtension", spec.defaultScope === undefined);
+    var read = readOpts(callerOpts, "decodeExtension", spec.defaultScope == null);
     var key = read.scope === undefined ? spec.defaultScope : read.scope;
     if (typeof key !== "string" || !_hasOwn(spec.scopes, key)) {
       throw E(badInput, "pki.schema." + spec.key + ".decodeExtension needs opts.scope naming which " +
@@ -2617,7 +2617,7 @@ function spki(ns, opts) {
 
 function attribute(ns, opts) {
   opts = opts || _create(null);
-  var minValues = opts.minValues === undefined ? 1 : opts.minValues;
+  var minValues = opts.minValues == null ? 1 : opts.minValues;
   return schema.seq([
     schema.field("type", schema.oidLeaf()),
     schema.field("values", schema.setOf(schema.any(), { assert: "set", min: minValues, max: constants.LIMITS.ATTRIBUTE_MAX_VALUES,

package/lib/sigstore.js

@@ -1244,7 +1244,7 @@ async function _verifyRekorEntry(te, rekorKeys, leafDer, contentType, arm, paylo
  * be checked. A token that does not verify is passed over rather than refused: it is a statement from
  * an authority this caller did not pin, which says nothing either way. With no token verifying, the
  * caller is left with no attested instant and the verdict says so. */
-async function _timestampInstants(vm, sigBytes, tsaRoots) {
+async function _timestampInstants(vm, sigBytes, tsaRoots, distrusted) {
   if (!tsaRoots) return null;
   var anchors = _normTsaAnchors(tsaRoots);
   if (!anchors.length) {
@@ -1271,7 +1271,7 @@ async function _timestampInstants(vm, sigBytes, tsaRoots) {
       ? _b64(t.signedTimestamp, "rfc3161Timestamps[" + i + "].signedTimestamp") : null;
     if (der === null) continue;
     var res;
-    try { res = await _tspVerify(der, sigBytes, { trustAnchors: anchors }); }
+    try { res = await _tspVerify(der, sigBytes, { trustAnchors: anchors, distrustedKeys: distrusted }); }
     catch (_e) { continue; } // allow:swallow-unverified a token this caller cannot check says nothing; the next is tried and a bundle with none verifying is refused for want of an instant
     if (!res || res.valid !== true || res.trusted !== true) continue;
     var ms = guard.time.instantOf(res.genTime);
@@ -1402,7 +1402,7 @@ function _ctLogFor(logs, logIdBytes, timeMs) {
  *  here read the caller's array after a yield, so a caller could add an anchor while verification was
  *  pending and decide which CA is trusted: an empty list that grows during the timestamp check would have
  *  passed a chain the call was made without any anchor for. */
-async function _verifyChain(leaf, chainDers, roots, timeMs) {
+async function _verifyChain(leaf, chainDers, roots, timeMs, distrusted) {
   var bundleLinks = _map(_arraySlice(chainDers, 1), function (d, i) { return _parseCert(d, "bundle intermediate [" + i + "]"); });
   var inWindow = _filter(roots, function (r) { return _inWindow(timeMs, r.validFor); });
   if (!inWindow.length) {
@@ -1449,6 +1449,7 @@ async function _verifyChain(leaf, chainDers, roots, timeMs) {
       time: new _Date(timeMs),
       historicalMode: true,
       requiredEku: ["codeSigning"],
+      distrustedKeys: distrusted,
     });
   } catch (e) {
     if (e && e.code === "path/no-path") {
@@ -1557,7 +1558,7 @@ function _fulcioExtValue(ext, leafArc) {
 
 var IDENTITY_FIELDS = ["san", "issuer", "sourceRepositoryURI"];
 var IDENTITY_KEYS = _assign(_create(null), { san: 1, issuer: 1, sourceRepositoryURI: 1 });
-var _VERIFY_BUNDLE_OPTS = _assign(_create(null), { fulcioRoots: 1, rekorKeys: 1, ctLogs: 1, identity: 1, predicateType: 1, time: 1, artifact: 1, tsaRoots: 1 });
+var _VERIFY_BUNDLE_OPTS = _assign(_create(null), { fulcioRoots: 1, rekorKeys: 1, ctLogs: 1, identity: 1, predicateType: 1, time: 1, artifact: 1, tsaRoots: 1, distrustedKeys: 1 });
 
 /** @internal The bytes a message signature covers, taken once. There is no shape here in which a
  * caller hands over a precomputed digest: the arm's own field comment forbids using one as a
@@ -1702,6 +1703,7 @@ function _statement(payload, payloadType, expectedPredicate) {
  *   predicateType: string,     // optional: require this in-toto predicateType (e.g. the SLSA URI); dsse_envelope bundles only
  *   artifact:      BufferSource, // the bytes a message_signature covers; required for that arm, refused for a dsse_envelope
  *   tsaRoots:      Array,      // optional timestamp-authority anchors: a DER Buffer or { der } each; required to date a Rekor v2 bundle, which carries no signed entry timestamp
+ *   distrustedKeys: Array,     // optional SHA-256 digests of SubjectPublicKeyInfo DER (64 hex characters or 32 bytes); a listed key fails the Fulcio chain, or the timestamp authority's chain so its token dates nothing
  *   time:          Date,       // optional check-date override (default: the Rekor integratedTime, or an RFC 3161 token's genTime on a v2 entry)
  *
  * @example
@@ -1736,6 +1738,9 @@ async function verifyBundle(bundle, opts) {
    *  verification is pending would decide a check the call was made without it. */
   var fulcioRoots = _normRoots(o.fulcioRoots || []);
   var ctLogs = o.ctLogs === undefined || o.ctLogs === null ? o.ctLogs : _normCtLogs(o.ctLogs);
+  /** @internal Typed here, before the timestamp leg, because that leg passes over a token whose
+   *  verification throws, and a malformed list must be reported as the caller's input fault. */
+  var distrusted = guard.distrust.keys(o.distrustedKeys, _err, "sigstore/bad-input", "opts.distrustedKeys");
 
   /** @internal Each option belongs to one arm, and one supplied for the other is refused rather than
    * passed over. An ignored option reads as a check that ran: opts.artifact on a DSSE bundle names
@@ -1796,7 +1801,7 @@ async function verifyBundle(bundle, opts) {
    * SIGNATURE bytes, which is what dates the ephemeral certificate that made them; a token over the
    * payload would date the thing signed rather than the signing. */
   var tsaMsList = null;
-  if (!haveCallerTime) tsaMsList = await _timestampInstants(vm, derSig, o.tsaRoots);
+  if (!haveCallerTime) tsaMsList = await _timestampInstants(vm, derSig, o.tsaRoots, distrusted);
   var chainDers = _chainDers(vm);
   /** @internal A caller-pinned instant is the same for every candidate, so the chain it decides is
    * computed on the first candidate and reused rather than rebuilt per entry. Without one the instant
@@ -1873,7 +1878,7 @@ async function verifyBundle(bundle, opts) {
           "timestamp authority, or supply opts.time");
       }
       var candidateChain = pinnedChain !== null ? pinnedChain
-        : await _verifyChain(leaf, chainDers, fulcioRoots, candidateTime);
+        : await _verifyChain(leaf, chainDers, fulcioRoots, candidateTime, distrusted);
       if (haveCallerTime) pinnedChain = candidateChain;
       var candidateScts = await _verifyEmbeddedScts(leaf, leafDer, candidateChain.issuer, ctLogs, candidateTime, candidateBound);
       rekor = candidate;