@blamejs/pki 0.9.5 → 0.9.6

package/lib/cms-verify.js

@@ -761,6 +761,7 @@ async function _verifyOneTimestamp(attr, targetSig, claimedSigningTime, opts) {
       trustAnchors: opts.timestampTrustAnchors,
       revocationChecker: opts.timestampRevocationChecker,
       allowWeakDigests: opts.allowWeakDigests === true,
+      distrustedKeys: opts.distrustedKeys,
     });
   } catch (e) {
     return guard.verdict.of({ valid: false, trusted: false, genTime: null,
@@ -975,6 +976,10 @@ async function _verifyOneCountersig(vDer, targetSig, parsedCerts, allowWeakDiges
  *                 trust decision from the signer: an operator may anchor one and not the other.
  * @opts  timestampRevocationChecker  A revocation checker for the TSA chain, as `pki.path.validate`
  *                 takes one. Each row reports what it established in `revocationChecked`.
+ * @opts  distrustedKeys  SHA-256 digests of SubjectPublicKeyInfo DER (64 hexadecimal characters or
+ *                 32 bytes each, see `pki.trust.spkiDigest`), applied to the signer chain and to the
+ *                 TSA chain of every timestamp row. A listed key on a chain, the anchor included,
+ *                 reports that signer or that row as not trusted.
  * @opts  requireAlgorithmProtection  Fail a signer that carries no RFC 6211
  *                 `CMSAlgorithmProtection` attribute, with `cms/missing-algorithm-protection`. Off
  *                 by default: RFC 6211 says nothing about absence and RFC 8933 sec. 4.1 makes
@@ -1026,7 +1031,7 @@ var _VERIFY_OPTS = intrinsic.assign(intrinsic.create(null), { certs: 1, content:
    *  leaving the signer unanchored, or the reverse, and one `trustAnchors` for both would make those
    *  two answers one. */
   timestampCerts: 1, timestampTrustAnchors: 1, timestampRevocationChecker: 1,
-  requireAlgorithmProtection: 1 });
+  requireAlgorithmProtection: 1, distrustedKeys: 1 });
 
 function verify(input, opts) {
   return guard.async.deferred(function () { return _verify(input, opts); });
@@ -1043,12 +1048,15 @@ async function _verify(input, opts) {
   var allowWeakDigests = opts.allowWeakDigests === true;
   var requireProtection = guard.identifier.booleanOption(opts.requireAlgorithmProtection, _err,
     "cms/bad-input", "pki.cms.verify opts.requireAlgorithmProtection");
+  /** @internal Typed here, before any signer is judged: the signer chain is built only for a signer
+   *  that verified, and every throw from a timestamp verify becomes a row. One list serves both. */
+  var distrustedKeys = guard.distrust.keys(opts.distrustedKeys, _err, "cms/bad-input", "pki.cms.verify opts.distrustedKeys");
   var parsed = guard.parsed.acceptDerived(input, "cms", function (bytes) {
     return cms.parse(_snapshotIfBytes(bytes, "pki.cms.verify"));
   }, _err, "cms/bad-input", "the SignedData");
   if (!Array.isArray(parsed.signerInfos)) throw _err("cms/bad-input", "input is not a CMS SignedData");
-  var trustCfg = _snapshotTrust(opts);
-  var tsTrustCfg = _snapshotTimestampTrust(opts, allowWeakDigests);
+  var trustCfg = _snapshotTrust(opts, distrustedKeys);
+  var tsTrustCfg = _snapshotTimestampTrust(opts, allowWeakDigests, distrustedKeys);
   var parsedCerts = [];
   (parsed.certificates || []).forEach(function (c) { _addCert(parsedCerts, c && c.bytes ? c.bytes : c); });
   (opts.certs || []).forEach(function (c) { _addCert(parsedCerts, c); });
@@ -1130,7 +1138,7 @@ function _cloneAnchorValue(v, depth) {
   }
   return out;
 }
-function _snapshotTrust(opts) {
+function _snapshotTrust(opts, distrustedKeys) {
   var raw = opts.trustAnchors;
   var anchors = null;
   if (raw != null) {
@@ -1140,9 +1148,10 @@ function _snapshotTrust(opts) {
   }
   return {
     trustAnchors: anchors,
-    time: guard.time.isDate(opts.time) ? new intrinsic.Date(guard.time.instantOf(opts.time)) : (opts.time === undefined ? new intrinsic.Date() : opts.time),
+    time: guard.time.isDate(opts.time) ? new intrinsic.Date(guard.time.instantOf(opts.time)) : (opts.time == null ? new intrinsic.Date() : opts.time),
     requiredEku: Array.isArray(opts.requiredEku) ? guard.list.snapshot(opts.requiredEku) : opts.requiredEku,
     checkPurpose: opts.checkPurpose,
+    distrustedKeys: distrustedKeys,
   };
 }
 
@@ -1153,7 +1162,7 @@ function _snapshotTrust(opts) {
  *  authorities. The certificates are copied by value, since a caller holding the array could swap an
  *  entry after the row that read it. The checker is a function and is captured as the one reference
  *  every row calls. */
-function _snapshotTimestampTrust(opts, allowWeakDigests) {
+function _snapshotTimestampTrust(opts, allowWeakDigests, distrustedKeys) {
   var certs = opts.timestampCerts;
   var anchors = opts.timestampTrustAnchors;
   return {
@@ -1167,6 +1176,7 @@ function _snapshotTimestampTrust(opts, allowWeakDigests) {
       }),
     timestampRevocationChecker: opts.timestampRevocationChecker,
     allowWeakDigests: allowWeakDigests,
+    distrustedKeys: distrustedKeys,
   };
 }
 
@@ -1200,7 +1210,7 @@ async function _applyTrust(res, parsedCerts, cfg) {
   if (!anchors.length) {
     throw _err("cms/bad-input", "opts.trustAnchors is empty -- name at least one root, or omit it to state that the signer is not being anchored");
   }
-  if (cfg.time !== undefined) guard.time.assertValid(cfg.time, _err, "cms/bad-input", "opts.time");
+  if (cfg.time != null) guard.time.assertValid(cfg.time, _err, "cms/bad-input", "opts.time");
   var purposes = _engine.resolvePurposeOpts({ requiredEku: cfg.requiredEku, checkPurpose: cfg.checkPurpose });
   intrinsic.forEach(anchors, function (a) {
     _engine.toAnchor(a);
@@ -1210,7 +1220,7 @@ async function _applyTrust(res, parsedCerts, cfg) {
     var s = res.signers[_si];
     {
       if (s.ok !== true || !s.cert) { s.trusted = false; continue; }
-      var buildOpts = { trustAnchors: anchors, intermediates: pool, validate: true, time: at };
+      var buildOpts = { trustAnchors: anchors, intermediates: pool, validate: true, time: at, distrustedKeys: cfg.distrustedKeys };
       if (cfg.requiredEku != null) buildOpts.requiredEku = cfg.requiredEku;
       if (cfg.checkPurpose != null) buildOpts.checkPurpose = cfg.checkPurpose;
       if (!_keyUsagePermitsSigning(parsedCerts, s.cert)) { s.trusted = false; continue; }

package/lib/constants.js

@@ -165,6 +165,7 @@ var LIMITS = Object.assign(Object.create(null), {
   MERKLE_MAX_PROOF_NODES: 65,
   MERKLE_MAX_LEAVES: 1048576,
   PROXY_MAX_TLS_ANCHORS: 256,
+  DISTRUSTED_KEYS_MAX: 4096,
   PATH_MAX_CERTS: 100,
   PATH_MAX_POLICY_NODES: 4096,
   PATH_BUILD_MAX_DEPTH: 20,

package/lib/crl-sign.js

@@ -770,16 +770,16 @@ function isRevoked(crl, serialNumber, opts) {
     return "pki.crl.isRevoked has an unknown option " + JSON.stringify(k) +
       "; it takes `time` and `historicalMode`";
   });
-  if (o.historicalMode !== undefined && o.time === undefined) {
+  if (o.historicalMode != null && o.time == null) {
     throw _err("crl/bad-input", "pki.crl.isRevoked opts.historicalMode says how to read an entry " +
       "against the instant asked about, so it needs opts.time as well");
   }
-  if (o.historicalMode !== undefined && typeof o.historicalMode !== "boolean") {
+  if (o.historicalMode != null && typeof o.historicalMode !== "boolean") {
     throw _err("crl/bad-input", "pki.crl.isRevoked opts.historicalMode must be a boolean");
   }
   var parsed = _coerceCrl(crl);
   var hex = _serialHexOf(serialNumber);
-  if (o.time !== undefined) {
+  if (o.time != null) {
     guard.time.assertValid(o.time, _err, "crl/bad-input", "pki.crl.isRevoked opts.time");
     var at = guard.time.instantOf(o.time);
     if (at < guard.time.instantOf(parsed.thisUpdate)) {

package/lib/csr-sign.js

@@ -114,7 +114,7 @@ function _possessionStatement(spec) {
       "privateKeyPossessionStatement needs the certificate: this verb resolves the signature algorithm from its key and checks the signature against it. Pass includeCertificate: false to leave it off the wire, which RFC 9883 sec. 3 allows");
   }
   var certDer = _b.reqDer(spec.certificate, "privateKeyPossessionStatement certificate");
-  var include = spec.includeCertificate === undefined ? true : spec.includeCertificate;
+  var include = spec.includeCertificate == null ? true : spec.includeCertificate;
   if (include !== true && include !== false) {
     throw _err("csr/bad-input", "privateKeyPossessionStatement includeCertificate is a flag, so it is true, false or omitted");
   }

package/lib/ct.js

@@ -1216,6 +1216,9 @@ function _trustValue(v, field) {
   return v;
 }
 
+/** @internal The settings `_tlsForFetch` reads. A setting not on the list is refused at the door. */
+var _TLS_KNOWN = intrinsic.freeze(guard.identifier.pickSettings(null, ["anchors", "useSystemStore", "cert", "key",
+  "minVersion", "servername", "checkServerIdentity", "distrustedKeys"]));
 function _tlsForFetch(opts) {
   /** @internal A record with NO prototype where the caller supplied no TLS at all, because the empty
    *  object a literal gives inherits from `Object.prototype` and every field below is then answerable
@@ -1232,9 +1235,12 @@ function _tlsForFetch(opts) {
   anchors = intrinsic.isArray(anchors)
     ? guard.list.copyMap(anchors, function (a, i) { return _trustValue(a, "opts.tls.anchors[" + i + "]"); })
     : _trustValue(anchors, "opts.tls.anchors");
+  /** @internal The distrust list is typed into a frozen copy. `guard.distrust.keys` reads each entry
+   *  through its descriptor and refuses an accessor, a hole and a Proxy, so no caller code runs. */
+  var distrustedKeys = guard.distrust.keys(t.distrustedKeys, _ctErr, "ct/bad-input", "opts.tls.distrustedKeys");
   return { anchors: anchors, useSystemStore: t.useSystemStore, cert: _trustValue(t.cert, "opts.tls.cert"),
     key: _trustValue(t.key, "opts.tls.key"), minVersion: t.minVersion, servername: t.servername,
-    checkServerIdentity: t.checkServerIdentity };
+    checkServerIdentity: t.checkServerIdentity, distrustedKeys: distrustedKeys };
 }
 
 function _sameOrigin(a, b) { return _urlOrigin(new _URL(a)) === _urlOrigin(new _URL(b)); }
@@ -1418,6 +1424,7 @@ function _settleDecisive(o, keyName) {
     guard.identifier.refuseAccessorFields(o.tls,
       guard.identifier.readableNames(o.tls, _ctErr, "ct/bad-input", "opts.tls"),
       _ctErr, "ct/bad-input", "opts.tls");
+    guard.identifier.assertKnownKeys(o.tls, _TLS_KNOWN, _ctErr, "ct/bad-input", "unknown opts.tls setting ");
     /** @internal And the ELEMENTS of the anchor list, which refusing accessors on `tls` itself does not
      *  reach. An accessor on `anchors[0]` runs when the list is copied, and one that overwrote
      *  `sth.rootHash` with the leaf being proven had an empty audit path verify. The refusal has to go
@@ -1652,11 +1659,17 @@ async function verifySth(sth, logKey) {
  *
  * `treeSize` and `timestamp` come back as `BigInt`, since both are uint64 on the wire.
  *
+ * `opts.tls.distrustedKeys` lists SHA-256 SubjectPublicKeyInfo digests (see pki.trust.spkiDigest). A
+ * log server whose chain carries a listed key is refused with `ct/server-key-distrusted`, and a
+ * malformed list is `ct/bad-input`. A `tls` setting other than `anchors`, `useSystemStore`, `cert`,
+ * `key`, `minVersion`, `servername`, `checkServerIdentity` and `distrustedKeys` is refused
+ * `ct/bad-input`. The other sec. 4 messages read it the same way.
+ *
  * @opts
  *   url:              string,    // the log's base URL, with or without the ct/v1/ prefix
  *   logKey:           BufferSource, // the log's SubjectPublicKeyInfo, pinned by the caller
  *   transport:        function,  // optional (request) => Promise<{ status, headers, body }>
- *   tls:              object,    // optional { anchors, useSystemStore, ... } when no transport is given
+ *   tls:              object,    // optional { anchors, useSystemStore, distrustedKeys, ... } when no transport is given
  *   headers:          object,    // optional extra request headers
  *   timeout:          number,    // optional per-request timeout in milliseconds
  *   maxResponseBytes: number,    // optional response cap
@@ -2194,7 +2207,7 @@ function _b64Array(obj, name, code, label, exactLen, maxCount) {
  * @opts signerKey REQUIRED and caller-pinned -- the distributor SubjectPublicKeyInfo as a DER Buffer; no baked-in key.
  * @opts sigUrl OPTIONAL -- the detached `log_list.sig` URL (https, must share the log-list URL's origin); default `url` with `.json` -> `.sig` (a non-.json url requires an explicit sigUrl).
  * @opts transport OPTIONAL injectable `transport(request) -> Promise<{status,headers,body}>` (default `pki.transport.https`); the test seam.
- * @opts tls OPTIONAL `{ anchors, useSystemStore, cert, key, minVersion, servername, checkServerIdentity }` threaded to the default transport (ignored when a transport is injected); `rejectUnauthorized` is always on.
+ * @opts tls OPTIONAL `{ anchors, useSystemStore, cert, key, minVersion, servername, checkServerIdentity, distrustedKeys }` threaded to the default transport (ignored when a transport is injected); `rejectUnauthorized` is always on. `distrustedKeys` lists SHA-256 SubjectPublicKeyInfo digests (see pki.trust.spkiDigest): a distributor whose chain carries a listed key is refused with `ct/server-key-distrusted`, and a malformed list is `ct/bad-input`. A setting not named in that list is refused `ct/bad-input`.
  * @opts headers OPTIONAL extra request headers (the request-framing headers are stripped; the verb owns the GET method).
  * @opts timeout OPTIONAL ms budget, default 30s (cap-validated).
  * @opts maxResponseBytes OPTIONAL per-GET size cap, default 4 MiB, tightenable DOWNWARD only.

package/lib/est.js

@@ -918,10 +918,23 @@ function _parseUrl(urlStr) {
   return url;
 }
 
-/** @internal The settings this client forwards to its transport. */
-var TLS_SETTINGS = ["anchors", "useSystemStore", "cert", "key", "minVersion", "servername", "checkServerIdentity"];
-function _tlsForRequest(opts) {
-  return guard.identifier.pickSettings(opts.tls, TLS_SETTINGS);
+/** @internal The settings this client forwards to its transport. The distrust list is typed here, once
+ *  per verb, and the frozen copy is the one every hop carries. A setting not on the list is refused. */
+var TLS_SETTINGS = ["anchors", "useSystemStore", "cert", "key", "minVersion", "servername", "checkServerIdentity", "distrustedKeys"];
+var TLS_KNOWN = intrinsic.freeze(guard.identifier.pickSettings(null, TLS_SETTINGS));
+function _tlsForRequest(tls) {
+  guard.identifier.assertKnownKeys(tls, TLS_KNOWN, E, "est/bad-input", "unknown opts.tls setting ");
+  var t = guard.identifier.pickSettings(tls, TLS_SETTINGS);
+  t.distrustedKeys = guard.distrust.keys(t.distrustedKeys, E, "est/bad-input", "opts.tls.distrustedKeys");
+  return t;
+}
+/** @internal The proxy and the tls settings, taken at the synchronous verb door. Every request and
+ *  redirect hop of the verb uses this record. */
+function _doorSnapshot(opts) {
+  var proxy, tls;
+  try { proxy = _snapProxy(opts); tls = opts.tls; }
+  catch (_pe) { throw E("est/bad-input", "the options object could not be read", _pe); }
+  return { proxy: proxy, tls: _tlsForRequest(tls) };
 }
 
 function _redirectTarget(current, location, method, opts) {
@@ -980,7 +993,7 @@ function _authScheme(opts) {
     if (sc !== "basic" && sc !== "digest") throw E("est/bad-input", "opts.auth.scheme must be \"basic\" or \"digest\"");
     return sc;
   }
-  if (opts.username !== undefined || opts.password !== undefined) return "basic";
+  if (opts.username != null || opts.password != null) return "basic";
   return null;
 }
 function _authUser(opts) { return opts.auth && opts.auth.username !== undefined ? opts.auth.username : opts.username; }
@@ -1095,7 +1108,7 @@ function _drive(method, url, body, headers, opts, transport, budgets) {
 /** @internal `checked` is the transport the verb already took at its door. Taking it again here
  * would ask the caller's options a second time, and anything read in between could change the
  * answer, so a verb that holds one passes it and this reads the option only when none was held. */
-function _client(op, method, baseUrl, body, headers, opts, proxySnap, onAttempt, checked) {
+function _client(op, method, baseUrl, body, headers, opts, snap, onAttempt, checked) {
   var base;
   try { base = new _URL(_stringOf(baseUrl)); }
   catch (e) { throw E("est/bad-url", "the EST base URL did not parse: " + guard.text.showValue(baseUrl), e); }
@@ -1103,14 +1116,14 @@ function _client(op, method, baseUrl, body, headers, opts, proxySnap, onAttempt,
   var url = _parseUrl(paths(baseUrl, { label: opts.label })[op]);
   var transport = checked !== undefined ? checked : _assertTransport(opts);
   if (!transport) {
-    var t = opts.tls != null ? opts.tls : intrinsic.create(null);
+    var t = snap.tls;
     var hasAnchors = t.anchors !== undefined && t.anchors !== null && !(Array.isArray(t.anchors) && t.anchors.length === 0);
     if (!hasAnchors && t.useSystemStore !== true) throw E("est/no-trust-anchors", "no explicit trust anchor and tls.useSystemStore not set to true -- refusing an unpinned server (RFC 7030 sec. 3.6)");
     transport = httpTransport.https({ E: E, errPrefix: "est" });
   }
   var budgets = {
-    tls: _tlsForRequest(opts),
-    proxy: proxySnap,
+    tls: snap.tls,
+    proxy: snap.proxy,
     timeout: guard.limits.cap(opts.timeout, "timeout", DEFAULT_TIMEOUT, { E: E, code: "est/bad-input", min: 1, max: MAX_TIMEOUT }),
     maxResponseBytes: guard.limits.cap(opts.maxResponseBytes, "maxResponseBytes", constants.LIMITS.HTTP_MAX_RESPONSE_BYTES, { E: E, code: "est/bad-input", min: 1, max: constants.LIMITS.HTTP_MAX_RESPONSE_BYTES }),
     maxRedirects: guard.limits.cap(opts.maxRedirects, "maxRedirects", 5, { E: E, code: "est/bad-input", min: 0, max: 32 }),
@@ -1241,18 +1254,19 @@ function fullcmc(baseUrl, request, opts) {
      * caller's nested objects, and one of those reads must not be able to change which transport
      * the request goes out on, so the value that was checked is the value carried below. */
     var carriedTransport = opts.transport;
-    var proxySnap;
-    try { proxySnap = _snapProxy(opts); } catch (_pe) { throw E("est/bad-input", "the options object could not be read", _pe); }
+    /** @internal Taken before the own-property copy below, so a tls a defaults bag carries on its
+     *  prototype is the one the request uses. */
+    var snap = _doorSnapshot(opts);
     der = _cmcRequestDer(request);
     wanted = _requestedPublicKeys(der);
     sent = _cmcSent(opts, der);
     /** @internal The copy below keeps own properties only, and a defaults bag holds its options on
      * a prototype, so the transport is put back from the value held at the door. */
     opts = _shallowCopy(opts);
-    if (carriedTransport !== undefined) opts.transport = carriedTransport;
+    if (carriedTransport != null) opts.transport = carriedTransport;
     var body = transferEncode(der);
     return _client("fullcmc", "POST", baseUrl, body,
-      { accept: "application/pkcs7-mime", "content-type": "application/pkcs7-mime; smime-type=CMC-request" }, opts, proxySnap, undefined, carriedTransport)
+      { accept: "application/pkcs7-mime", "content-type": "application/pkcs7-mime; smime-type=CMC-request" }, opts, snap, undefined, carriedTransport)
       .then(function (res) { return _fullcmcResult(res, opts, wanted, sent); });
   } catch (e) {
     return _rej(e);
@@ -1571,7 +1585,7 @@ function _causedBy(e, target) {
 
 var ENROLL_HEADERS = intrinsic.assign(intrinsic.create(null), { accept: "application/pkcs7-mime", "content-type": "application/pkcs10" });
 
-function _enrollBound(op, baseUrl, builder, opts, proxySnap) {
+function _enrollBound(op, baseUrl, builder, opts, snap) {
   /** @internal Held before anything else the caller supplied is read, and carried to the client:
    * the builder runs during the handshake, so a later read could answer with a different value. */
   var checkedTransport = opts.transport;
@@ -1601,7 +1615,7 @@ function _enrollBound(op, baseUrl, builder, opts, proxySnap) {
         .then(null, function (e) { attempt.error = e; attempt.done = true; throw e; });
     };
   }
-  return _client(op, "POST", baseUrl, hopBody, ENROLL_HEADERS, opts, proxySnap, hopBody, checkedTransport)
+  return _client(op, "POST", baseUrl, hopBody, ENROLL_HEADERS, opts, snap, hopBody, checkedTransport)
     .then(function (res) {
       if (current && current.error) throw current.error;
       if (!current || !current.done) {
@@ -1617,13 +1631,13 @@ function _enrollBound(op, baseUrl, builder, opts, proxySnap) {
     });
 }
 
-function _enroll(op, baseUrl, csrInput, opts, proxySnap) {
-  if (typeof csrInput === "function") return _enrollBound(op, baseUrl, csrInput, opts, proxySnap);
+function _enroll(op, baseUrl, csrInput, opts, snap) {
+  if (typeof csrInput === "function") return _enrollBound(op, baseUrl, csrInput, opts, snap);
   var checkedTransport = opts.transport;
   var csrDer = _csrDer(csrInput);
   var spki = csr.parse(csrDer).subjectPublicKeyInfo;
   var body = transferEncode(csrDer);
-  return _client(op, "POST", baseUrl, body, ENROLL_HEADERS, opts, proxySnap, undefined, checkedTransport)
+  return _client(op, "POST", baseUrl, body, ENROLL_HEADERS, opts, snap, undefined, checkedTransport)
     .then(function (res) { return _certsResult(op, res, opts, spki); });
 }
 
@@ -1646,7 +1660,7 @@ function _enroll(op, baseUrl, csrInput, opts, proxySnap) {
  *
  * @opts
  *   - `transport`: an injected `transport(request) -> Promise<{status, headers, body, tls}>`; default pki.transport.https. It must return a promise of the response; anything else is `est/bad-input`.
- *   - `tls` -- { anchors, useSystemStore, cert, key, minVersion, servername, checkServerIdentity }.
+ *   - `tls` -- { anchors, useSystemStore, cert, key, minVersion, servername, checkServerIdentity, distrustedKeys }. `distrustedKeys` lists SHA-256 SubjectPublicKeyInfo digests (see pki.trust.spkiDigest); a server whose chain carries a listed key is refused with `est/server-key-distrusted`, on every hop including a cross-origin redirect, and a malformed list is `est/bad-input`. A setting not named in that list is refused `est/bad-input`. The verb reads `tls` when it is called, so a change the caller makes to it afterward does not reach the request.
  *   - `label` -- an OPTIONAL CA label path segment; `timeout` / `maxResponseBytes` / `maxRedirects` -- budgets.
  *   - `proxy` -- reach the CA through a forward HTTP proxy (`{ url, auth?, tls? }`; see pki.transport).
  *   - `now` -- receipt time (epoch ms) to render a 202 Retry-After HTTP-date as seconds.
@@ -1664,10 +1678,10 @@ function _enroll(op, baseUrl, csrInput, opts, proxySnap) {
  */
 function cacerts(baseUrl, opts) {
   opts = opts || intrinsic.create(null);
-  var proxySnap; try { proxySnap = _snapProxy(opts); } catch (_pe) { return _rej(E("est/bad-input", "the options object could not be read", _pe)); }
+  var snap; try { snap = _doorSnapshot(opts); } catch (e) { return _rej(e); }
   return _promiseResolve(_Promise, undefined).then(function () {
     opts = _knownOpts(opts, CACERTS_OPTS, "cacerts");
-    return _client("cacerts", "GET", baseUrl, null, { accept: "application/pkcs7-mime" }, opts, proxySnap, undefined, opts.transport);
+    return _client("cacerts", "GET", baseUrl, null, { accept: "application/pkcs7-mime" }, opts, snap, undefined, opts.transport);
   }).then(function (res) { return _certsResult("cacerts", res, opts, null); });
 }
 
@@ -1732,10 +1746,10 @@ function cacerts(baseUrl, opts) {
  */
 function simpleenroll(baseUrl, csrInput, opts) {
   opts = opts || intrinsic.create(null);
-  var proxySnap; try { proxySnap = _snapProxy(opts); } catch (_pe) { return _rej(E("est/bad-input", "the options object could not be read", _pe)); }
+  var snap; try { snap = _doorSnapshot(opts); } catch (e) { return _rej(e); }
   return _promiseResolve(_Promise, undefined).then(function () {
     opts = _knownOpts(opts, SIMPLEENROLL_OPTS, "simpleenroll");
-    return _enroll("simpleenroll", baseUrl, csrInput, opts, proxySnap);
+    return _enroll("simpleenroll", baseUrl, csrInput, opts, snap);
   });
 }
 
@@ -1772,12 +1786,12 @@ function simpleenroll(baseUrl, csrInput, opts) {
  */
 function simplereenroll(baseUrl, csrInput, opts) {
   opts = opts || intrinsic.create(null);
-  var proxySnap; try { proxySnap = _snapProxy(opts); } catch (_pe) { return _rej(E("est/bad-input", "the options object could not be read", _pe)); }
+  var snap; try { snap = _doorSnapshot(opts); } catch (e) { return _rej(e); }
   return _promiseResolve(_Promise, undefined).then(function () {
     opts = _knownOpts(opts, SIMPLEREENROLL_OPTS, "simplereenroll");
     if (!opts.oldCert) throw E("est/bad-input", "simplereenroll requires opts.oldCert (the certificate being renewed, RFC 7030 sec. 4.2.2)");
     if (typeof csrInput !== "function") reenrollGuard(opts.oldCert, _csrDer(csrInput));
-    return _enroll("simplereenroll", baseUrl, csrInput, opts, proxySnap);
+    return _enroll("simplereenroll", baseUrl, csrInput, opts, snap);
   });
 }
 
@@ -1944,7 +1958,7 @@ async function _serverkeygenResult(res, opts, derived) {
  */
 function serverkeygen(baseUrl, csrInput, opts) {
   opts = opts || intrinsic.create(null);
-  var proxySnap; try { proxySnap = _snapProxy(opts); } catch (_pe) { return _rej(E("est/bad-input", "the options object could not be read", _pe)); }
+  var snap; try { snap = _doorSnapshot(opts); } catch (e) { return _rej(e); }
   return _promiseResolve(_Promise, undefined).then(function () {
     opts = _knownOpts(opts, SERVERKEYGEN_OPTS, "serverkeygen");
     var checkedTransport = opts.transport;
@@ -1955,6 +1969,7 @@ function serverkeygen(baseUrl, csrInput, opts) {
      * coerced to `false` and contradicted a CSR the caller never disagreed with. The value is a
      * boolean by the time it reaches here, so it is compared rather than coerced. */
     if (opts.requestedEncryption != null && opts.requestedEncryption !== derived.requestedEncryption) throw E("est/bad-input", "opts.requestedEncryption (" + opts.requestedEncryption + ") contradicts the CSR's advertised key-encryption attribute (" + derived.requestedEncryption + ") (RFC 7030 sec. 4.4.1)");
+    // allow:caller-option-presence-tested-against-undefined -- absence means the recipient is not checked against the CSR, so a null must be refused
     if (opts.expectedRecipientKeyId !== undefined) {
       if (!Buffer.isBuffer(opts.expectedRecipientKeyId)) throw E("est/bad-input", "opts.expectedRecipientKeyId must be a Buffer");
       if (derived.expectedRecipientKeyId && !opts.expectedRecipientKeyId.equals(derived.expectedRecipientKeyId)) throw E("est/bad-input", "opts.expectedRecipientKeyId contradicts the key identifier the CSR advertised (RFC 7030 sec. 4.4.1)");
@@ -1968,7 +1983,7 @@ function serverkeygen(baseUrl, csrInput, opts) {
     if ((opts.expectedRecipientKeyId !== undefined || opts.expectedRecipientIssuerSerial != null) && !derived.requestedEncryption) {
       throw E("est/bad-input", "a recipient expectation (expectedRecipientKeyId / expectedRecipientIssuerSerial) implies an encrypted key, but the CSR advertised no DecryptKeyIdentifier / AsymmetricDecryptKeyIdentifier attribute (RFC 7030 sec. 4.4.1)");
     }
-    return _client("serverkeygen", "POST", baseUrl, transferEncode(csrDer), { accept: "multipart/mixed", "content-type": "application/pkcs10" }, opts, proxySnap, undefined, checkedTransport)
+    return _client("serverkeygen", "POST", baseUrl, transferEncode(csrDer), { accept: "multipart/mixed", "content-type": "application/pkcs10" }, opts, snap, undefined, checkedTransport)
       .then(function (res) { return _serverkeygenResult(res, opts, derived); });
   });
 }
@@ -2010,10 +2025,10 @@ function _csrattrsResult(res, opts) {
  */
 function csrattrs(baseUrl, opts) {
   opts = opts || intrinsic.create(null);
-  var proxySnap; try { proxySnap = _snapProxy(opts); } catch (_pe) { return _rej(E("est/bad-input", "the options object could not be read", _pe)); }
+  var snap; try { snap = _doorSnapshot(opts); } catch (e) { return _rej(e); }
   return _promiseResolve(_Promise, undefined).then(function () {
     opts = _knownOpts(opts, CSRATTRS_OPTS, "csrattrs");
-    return _client("csrattrs", "GET", baseUrl, null, { accept: "application/csrattrs" }, opts, proxySnap, undefined, opts.transport);
+    return _client("csrattrs", "GET", baseUrl, null, { accept: "application/csrattrs" }, opts, snap, undefined, opts.transport);
   }).then(function (res) { return _csrattrsResult(res, opts); });
 }
 

package/lib/guard-all.js

@@ -22,6 +22,7 @@ var secret = require("./guard-secret");
 var parsed = require("./guard-parsed");
 var verdict = require("./guard-verdict");
 var async_ = require("./guard-async");
+var distrust = require("./guard-distrust");
 
 module.exports = _freeze({
   bytes:  bytes,
@@ -42,4 +43,5 @@ module.exports = _freeze({
   parsed: parsed,
   verdict: verdict,
   async:  async_,
+  distrust: distrust,
 });