@blamejs/pki 0.9.5 → 0.9.7

package/lib/revocation-fetch.js

@@ -398,7 +398,8 @@ async function _tryOcsp(state, cert, issuer, ctx, candidate) {
     hit = got.body;
   }
   var v = await state.verifyOcspResponse(hit, cert, issuerCert, ctx.time,
-    { historicalMode: ctx.historicalMode === true, requestNonce: state.nonce ? _requestNonce(parsedReq) : undefined });
+    { historicalMode: ctx.historicalMode === true, requestNonce: state.nonce ? _requestNonce(parsedReq) : undefined,
+      distrustedKeys: state.distrusted });
   /** @internal `valid` on that verdict means the certificate is good, not that the response was
    * acceptable, so reading it as acceptance would turn a `revoked` answer into an undetermined
    * one that `opts.softFail` could then waive. Acceptance is the three conditions the gate
@@ -695,6 +696,21 @@ function _deltaUrlsFor(parsedCrl, state) {
  *   var checker = pki.path.fetchingChecker({ transport: pki.transport.https({}) });
  *   console.log(typeof checker.check);
  */
+/** @internal The TLS policy every fetch is sent with, copied once at the door, with its distrust list
+ *  typed there. A fetch fault becomes an undetermined verdict, so a malformed list that reached the
+ *  transport would be reported as a responder that did not answer. */
+function _tlsSnapshot(tls) {
+  if (tls == null) return tls;
+  guard.identifier.assertKnownKeys(tls, httpTransport.TLS_KEYS, E, "path/bad-input", "fetchingChecker: opts.tls has an unknown option ");
+  /** @internal Each setting the transport reads is taken by value, whether the bag holds it or
+   *  inherits it, which is how the transport itself reads the bag. */
+  var copy = guard.identifier.pickSettings(tls, intrinsic.keys(httpTransport.TLS_KEYS));
+  if (copy.distrustedKeys != null) {
+    copy.distrustedKeys = guard.distrust.keys(copy.distrustedKeys, E, "path/bad-input", "fetchingChecker: opts.tls.distrustedKeys");
+  }
+  return copy;
+}
+
 function fetchingChecker(opts) {
   opts = guard.identifier.optionsObject(opts, E, "path/bad-input", "fetchingChecker: opts");
   guard.identifier.assertKnownKeys(opts, CHECKER_OPTS, E, "path/bad-input",
@@ -703,6 +719,7 @@ function fetchingChecker(opts) {
    * accessor twice, so the transport that passed the door is the transport that gets called. */
   var transport = guard.identifier.assertCallable(opts.transport, E, "path/bad-input",
     "fetchingChecker: opts.transport", TRANSPORT_SHAPE);
+  // allow:caller-option-presence-tested-against-undefined -- absence selects the permissive default, so a null must not reach it
   var allowPlaintextHttp = opts.allowPlaintextHttp === undefined ? true : opts.allowPlaintextHttp === true;
   var cfg = {
     transport: transport,
@@ -717,7 +734,7 @@ function fetchingChecker(opts) {
     useDeltas: guard.identifier.booleanOptionDefaultOn(opts.useDeltas, E, "path/bad-input",
       "fetchingChecker: opts.useDeltas"),
     nonce: _booleanOption(opts.nonce, "fetchingChecker: opts.nonce"),
-    tls: opts.tls,
+    tls: _tlsSnapshot(opts.tls),
     maxFetches: guard.limits.cap(opts.maxFetches, "fetchingChecker: opts.maxFetches", LIMITS.REVOCATION_MAX_FETCHES,
       { E: E, code: "path/bad-input", min: 1, max: LIMITS.REVOCATION_MAX_FETCHES }),
     maxPerCert: guard.limits.cap(opts.maxPerCert, "fetchingChecker: opts.maxPerCert", LIMITS.REVOCATION_MAX_PER_CERT,
@@ -757,10 +774,18 @@ function fetchingChecker(opts) {
 
   return {
     check: async function (cert, issuer, ctx) {
+      /** @internal Typed before any location is decoded or fetched: a malformed list is the
+       * caller's fault and is thrown, where a fetch fault below becomes an undetermined verdict. */
+      var distrusted = guard.distrust.keys(ctx == null ? undefined : ctx.distrustedKeys, E, "path/bad-input",
+        "fetchingChecker: ctx.distrustedKeys");
+      var issuerRefusal = guard.distrust.refusal(distrusted, issuer.workingPublicKey, "distrustedKeys");
+      if (issuerRefusal !== null) {
+        return _unknown("the issuer's key " + issuerRefusal + ", so nothing it signs is an answer", [], []);
+      }
       var notes = [], skips = [];
       var budget = budgetFor(ctx == null ? null : ctx.run);
       var state = intrinsic.assign(intrinsic.create(null), cfg, {
-        notes: notes, cache: cache, crlCache: crlCache,
+        notes: notes, cache: cache, crlCache: crlCache, distrusted: distrusted,
         deadline: budget.deadline,
         fetches: budget.fetches,
         urls: new intrinsic.Set(),
@@ -787,7 +812,9 @@ function fetchingChecker(opts) {
        * number of retries. A responder that answers `revoked` or `good` ends it; anything else
        * falls through, because sec. 5 of RFC 6960 makes the CRL the fallback and never an
        * assumption of good standing. */
-      var lastReason = null;
+      /** @internal Each source keeps its own last failure, so an undetermined verdict names the
+       * responder's fault and the CRL's. They usually have different causes. */
+      var ocspReason = null, crlReason = null;
       for (var a = 0; a <= cfg.retries && ocspCands.length > 0; a++) {
         for (var o = 0; o < ocspCands.length; o++) {
           if (!_takeUrl(state, ocspCands[o].url)) {
@@ -797,18 +824,21 @@ function fetchingChecker(opts) {
           try {
             var got = await _tryOcsp(state, cert, issuer, ctx, ocspCands[o]);
             if (got.status === "good" || got.status === "revoked") return _verdict(got, notes, skips);
-            lastReason = got.reason + " reported " + got.status;
-          } catch (e) { lastReason = _say(e); }
+            ocspReason = got.reason + " reported " + got.status;
+          } catch (e) { ocspReason = _say(e); }
         }
       }
       if (crlCands.length > 0) {
         try {
           var viaCrl = await _tryCrl(state, cert, issuer, ctx, crlCands, certDeltas);
           if (viaCrl.status === "good" || viaCrl.status === "revoked") return _verdict(viaCrl, notes, skips);
-          lastReason = viaCrl.reason;
-        } catch (e2) { lastReason = _say(e2); }
+          crlReason = viaCrl.reason;
+        } catch (e2) { crlReason = _say(e2); }
       }
-      return _unknown(lastReason || "no revocation source answered", notes, skips);
+      var why = [];
+      if (ocspReason !== null) _append(why, "OCSP: " + ocspReason);
+      if (crlReason !== null) _append(why, "CRL: " + crlReason);
+      return _unknown(why.length ? intrinsic.join(why, "; ") : "no revocation source answered", notes, skips);
     },
   };
 }

package/lib/scep.js

@@ -689,10 +689,25 @@ function _responseLen(body) {
   if (Buffer.isBuffer(body)) return guard.bytes.lengthOf(body);
   return guard.bytes.lengthOf(guard.bytes.source(body, ScepError, "scep/bad-response", "the response body"));
 }
-/** @internal The settings this client forwards to its transport. */
-var TLS_SETTINGS = ["anchors", "useSystemStore", "cert", "key", "minVersion", "servername", "checkServerIdentity"];
-function _tlsForRequest(opts) {
-  return guard.identifier.pickSettings(opts.tls, TLS_SETTINGS);
+/** @internal The settings this client forwards to its transport. The distrust list is typed here, and
+ *  the frozen copy is the one every hop carries. A setting not on the list is refused. */
+var TLS_SETTINGS = ["anchors", "useSystemStore", "cert", "key", "minVersion", "servername", "checkServerIdentity", "distrustedKeys"];
+var TLS_KNOWN = intrinsic.freeze(guard.identifier.pickSettings(null, TLS_SETTINGS));
+function _distrustOf(value) {
+  return guard.distrust.keys(value, _err, "scep/bad-input", "opts.tls.distrustedKeys");
+}
+function _tlsForRequest(tls) {
+  guard.identifier.assertKnownKeys(tls, TLS_KNOWN, _err, "scep/bad-input", "unknown opts.tls setting ");
+  var t = guard.identifier.pickSettings(tls, TLS_SETTINGS);
+  t.distrustedKeys = _distrustOf(t.distrustedKeys);
+  return t;
+}
+/** @internal A verb that reaches the transport only after an await copies the caller's tls at its door,
+ *  with the distrust list typed there, so a later change to the caller's array does not reach the request.
+ *  Each setting is read the way `_tlsForRequest` reads it, a prototype included. */
+function _snapshotTls(tls) {
+  if (tls == null) return tls;
+  return _tlsForRequest(tls);
 }
 function _redirectTarget(current, location, method, allowCrossOrigin) {
   if (location == null || _trim(String(location)) === "") throw _err("scep/bad-response", "a redirect response carried no Location header");
@@ -736,7 +751,7 @@ function _pkiRequest(method, opUrl, reqMsg, clientOpts) {
 function _drive(method, url, body, headers, opts, transport, budgets) {
   var redirects = 0, curMethod = method, curBody = body, initialOrigin = _urlOrigin(url);
   var proxySnap = _snapshotProxy(opts.proxy);
-  var tlsBase = _tlsForRequest(opts);
+  var tlsBase = _tlsForRequest(opts.tls);
   /** @internal Read as the boolean it documents, on the one path every network verb here takes and
    * before the first request. Taken by truthiness, `allowCrossOriginRedirect: "false"` ALLOWED the
    * cross-origin redirect on an unsafe method that the check below exists to refuse. */
@@ -868,7 +883,7 @@ function _assertStrongProfile(caps, profile) {
  *   - `transport` -- an injected transport (defaults to `pki.transport.https`); the request is a GET with no body.
  *   - `expectSCEPStandard` -- refuse (`scep/weak-profile`) if the response does not advertise `SCEPStandard`. Takes `true`, `false`, `null` or an absent option; any other value is refused `scep/bad-input`.
  *   - `requireStrongProfile` -- refuse unless AES + SHA-256 + POSTPKIOperation are all advertised. Read the same way.
- *   - `timeout` / `maxResponseBytes` / `maxRedirects` / `tls` / `allowCrossOriginRedirect` / `proxy` -- transport bounds (`proxy` reaches the CA through a forward HTTP proxy; see pki.transport).
+ *   - `timeout` / `maxResponseBytes` / `maxRedirects` / `tls` / `allowCrossOriginRedirect` / `proxy` -- transport bounds (`proxy` reaches the CA through a forward HTTP proxy; see pki.transport). `tls.distrustedKeys` lists SHA-256 SubjectPublicKeyInfo digests (see pki.trust.spkiDigest); a server whose chain carries a listed key is refused with `scep/server-key-distrusted` on every hop, and a malformed list is `scep/bad-input`. A `tls` setting other than `anchors`, `useSystemStore`, `cert`, `key`, `minVersion`, `servername`, `checkServerIdentity` and `distrustedKeys` is refused `scep/bad-input`.
  * @example
  *   // requires: scepTransport -- an injected transport (omit to use pki.transport.https)
  *   var caps = await pki.scep.getCACaps("http://ca.example/scep", { transport: scepTransport });
@@ -952,7 +967,7 @@ function _normalizeFingerprint(fp, algName) {
  * @opts
  *   - `expectedFingerprint` -- a hex string or Buffer; a returned certificate must hash to it, or the response is refused.
  *   - `fingerprintAlgorithm` -- the hash for the fingerprint (default "sha256").
- *   - `transport` / `timeout` / `maxResponseBytes` / `maxRedirects` / `tls` / `allowCrossOriginRedirect` / `proxy` -- transport bounds (`proxy` reaches the CA through a forward HTTP proxy; see pki.transport).
+ *   - `transport` / `timeout` / `maxResponseBytes` / `maxRedirects` / `tls` / `allowCrossOriginRedirect` / `proxy` -- transport bounds (`proxy` reaches the CA through a forward HTTP proxy; see pki.transport). `tls.distrustedKeys` lists SHA-256 SubjectPublicKeyInfo digests (see pki.trust.spkiDigest); a server whose chain carries a listed key is refused with `scep/server-key-distrusted` on every hop, and a malformed list is `scep/bad-input`. A `tls` setting other than `anchors`, `useSystemStore`, `cert`, `key`, `minVersion`, `servername`, `checkServerIdentity` and `distrustedKeys` is refused `scep/bad-input`.
  * @example
  *   // requires: scepCaCertTransport -- an injected transport returning a single CA certificate
  *   var ca = await pki.scep.getCACert("http://ca.example/scep", { transport: scepCaCertTransport });
@@ -1008,7 +1023,7 @@ async function getCACert(baseUrl, opts) {
  *
  * @opts
  *   - `caCertificate` -- the current SCEP CA certificate DER; the response is authenticated against its key (required).
- *   - `transport` / `timeout` / `maxResponseBytes` / `maxRedirects` / `tls` / `allowCrossOriginRedirect` / `proxy` -- transport bounds (`proxy` reaches the CA through a forward HTTP proxy; see pki.transport).
+ *   - `transport` / `timeout` / `maxResponseBytes` / `maxRedirects` / `tls` / `allowCrossOriginRedirect` / `proxy` -- transport bounds (`proxy` reaches the CA through a forward HTTP proxy; see pki.transport). `tls.distrustedKeys` lists SHA-256 SubjectPublicKeyInfo digests (see pki.trust.spkiDigest); a server whose chain carries a listed key is refused with `scep/server-key-distrusted` on every hop, and a malformed list is `scep/bad-input`. A `tls` setting other than `anchors`, `useSystemStore`, `cert`, `key`, `minVersion`, `servername`, `checkServerIdentity` and `distrustedKeys` is refused `scep/bad-input`.
  * @example
  *   // requires: caCertDer -- the current CA certificate (from getCACert), scepTransport
  *   var next = await pki.scep.getNextCACert("http://ca.example/scep", { caCertificate: caCertDer, transport: scepTransport });
@@ -1114,7 +1129,7 @@ async function _pkiOperation(messageType, baseUrl, opts, verbName) {
   var recipientKey = _captureRecipientKey(opts.recipientKey);
   var signer = { cert: guard.bytes.snapshotSource(opts.signer.cert, ScepError, "scep/bad-input", "signer.cert"), key: opts.signer.key };
   var clientOpts = {
-    tls: opts.tls != null ? guard.identifier.ownOptions(opts.tls) : opts.tls,
+    tls: _snapshotTls(opts.tls),
     maxRedirects: opts.maxRedirects,
     allowCrossOriginRedirect: opts.allowCrossOriginRedirect,
     timeout: opts.timeout,
@@ -1187,7 +1202,7 @@ async function _pkiOperation(messageType, baseUrl, opts, verbName) {
  *   - `sleep` -- an injectable sleeper `(ms) -> Promise` for the Retry-After wait (default a real timer).
  *   - `onRetryAfter` -- an optional observer `(delaySeconds) -> void` called before each poll sleep.
  *   - `httpMethod` -- `"POST"` (default) or `"GET"`. RFC 8894 sec. 4.1 sends the PKIOperation message over POST; `"GET"` carries it base64-encoded in the URL `message` query for a legacy CA that lacks POST.
- *   - `transport` / `timeout` / `maxResponseBytes` / `maxRedirects` / `tls` / `allowCrossOriginRedirect` / `proxy` -- transport bounds (`proxy` reaches the CA through a forward HTTP proxy; see pki.transport).
+ *   - `transport` / `timeout` / `maxResponseBytes` / `maxRedirects` / `tls` / `allowCrossOriginRedirect` / `proxy` -- transport bounds (`proxy` reaches the CA through a forward HTTP proxy; see pki.transport). `tls.distrustedKeys` lists SHA-256 SubjectPublicKeyInfo digests (see pki.trust.spkiDigest); a server whose chain carries a listed key is refused with `scep/server-key-distrusted` on every hop, and a malformed list is `scep/bad-input`. A `tls` setting other than `anchors`, `useSystemStore`, `cert`, `key`, `minVersion`, `servername`, `checkServerIdentity` and `distrustedKeys` is refused `scep/bad-input`.
  * @example
  *   // requires: scepCsr, caCertDer, clientCertDer, clientKeyPkcs8, scepTransport
  *   var out = await pki.scep.enroll("http://ca.example/scep", { csr: scepCsr, caCert: caCertDer,
@@ -1265,7 +1280,7 @@ async function _queryOperation(messageType, baseUrl, opts, verbName) {
   var recipientKey = _captureRecipientKey(opts.recipientKey);
   var signer = { cert: guard.bytes.snapshotSource(opts.signer.cert, ScepError, "scep/bad-input", "signer.cert"), key: opts.signer.key };
   var want = _resolveQueryTarget(opts);
-  var clientOpts = { tls: opts.tls != null ? guard.identifier.ownOptions(opts.tls) : opts.tls, maxRedirects: opts.maxRedirects, allowCrossOriginRedirect: opts.allowCrossOriginRedirect, timeout: opts.timeout, maxResponseBytes: opts.maxResponseBytes, proxy: _snapshotProxy(opts.proxy) };
+  var clientOpts = { tls: _snapshotTls(opts.tls), maxRedirects: opts.maxRedirects, allowCrossOriginRedirect: opts.allowCrossOriginRedirect, timeout: opts.timeout, maxResponseBytes: opts.maxResponseBytes, proxy: _snapshotProxy(opts.proxy) };
   if (checkedTransport !== undefined) clientOpts.transport = checkedTransport;
   var senderNonce = guard.crypto.randomBytes(16);
   var transactionId = opts.transactionId != null ? opts.transactionId : _defaultTransactionId();
@@ -1305,7 +1320,7 @@ async function _queryOperation(messageType, baseUrl, opts, verbName) {
  *   - `responderCert` -- the certificate to authenticate the CA response signature against (defaults to `caCert`).
  *   - `transactionId` -- a caller-unique PrintableString (defaults to 16 random bytes, hex-encoded).
  *   - `httpMethod` -- `"POST"` (default) or `"GET"`. RFC 8894 sec. 4.1 sends the PKIOperation message over POST; `"GET"` carries it base64-encoded in the URL `message` query for a legacy CA that lacks POST.
- *   - `transport` / `timeout` / `maxResponseBytes` / `maxRedirects` / `tls` / `allowCrossOriginRedirect` / `proxy` -- transport bounds (`proxy` reaches the CA through a forward HTTP proxy; see pki.transport).
+ *   - `transport` / `timeout` / `maxResponseBytes` / `maxRedirects` / `tls` / `allowCrossOriginRedirect` / `proxy` -- transport bounds (`proxy` reaches the CA through a forward HTTP proxy; see pki.transport). `tls.distrustedKeys` lists SHA-256 SubjectPublicKeyInfo digests (see pki.trust.spkiDigest); a server whose chain carries a listed key is refused with `scep/server-key-distrusted` on every hop, and a malformed list is `scep/bad-input`. A `tls` setting other than `anchors`, `useSystemStore`, `cert`, `key`, `minVersion`, `servername`, `checkServerIdentity` and `distrustedKeys` is refused `scep/bad-input`.
  * @example
  *   // requires: clientCertDer, caCertDer, clientKeyPkcs8, scepTransport
  *   var out = await pki.scep.getCert("http://ca.example/scep", { certificate: clientCertDer, caCert: caCertDer,
@@ -1354,7 +1369,7 @@ async function getCert(baseUrl, opts) {
  *   - `responderCert` -- the certificate to authenticate the CA response against (defaults to `caCert`).
  *   - `transactionId` -- a caller-unique PrintableString (defaults to 16 random bytes, hex-encoded).
  *   - `httpMethod` -- `"POST"` (default) or `"GET"`. RFC 8894 sec. 4.1 sends the PKIOperation message over POST; `"GET"` carries it base64-encoded in the URL `message` query for a legacy CA that lacks POST.
- *   - `transport` / `timeout` / `maxResponseBytes` / `maxRedirects` / `tls` / `allowCrossOriginRedirect` / `proxy` -- transport bounds (`proxy` reaches the CA through a forward HTTP proxy; see pki.transport).
+ *   - `transport` / `timeout` / `maxResponseBytes` / `maxRedirects` / `tls` / `allowCrossOriginRedirect` / `proxy` -- transport bounds (`proxy` reaches the CA through a forward HTTP proxy; see pki.transport). `tls.distrustedKeys` lists SHA-256 SubjectPublicKeyInfo digests (see pki.trust.spkiDigest); a server whose chain carries a listed key is refused with `scep/server-key-distrusted` on every hop, and a malformed list is `scep/bad-input`. A `tls` setting other than `anchors`, `useSystemStore`, `cert`, `key`, `minVersion`, `servername`, `checkServerIdentity` and `distrustedKeys` is refused `scep/bad-input`.
  * @example
  *   // requires: clientCertDer, caCertDer, clientKeyPkcs8, scepTransport
  *   var out = await pki.scep.getCrl("http://ca.example/scep", { certificate: clientCertDer, caCert: caCertDer,

package/lib/schema-pkix.js

@@ -1557,7 +1557,7 @@ function _extensionRow(ext, opts, index, state, decoded, code, profile) {
   row.value = ext.value;
   row.scope = opts.scope;
   row.index = index;
-  row.containerIndex = opts.containerIndex === undefined ? null : opts.containerIndex;
+  row.containerIndex = opts.containerIndex == null ? null : opts.containerIndex;
   row.state = state;
   row.decoded = decoded;
   row.code = code;
@@ -1754,7 +1754,7 @@ function extensionDoor(spec) {
   }
 
   function decodeExtension(ext, callerOpts) {
-    var read = readOpts(callerOpts, "decodeExtension", spec.defaultScope === undefined);
+    var read = readOpts(callerOpts, "decodeExtension", spec.defaultScope == null);
     var key = read.scope === undefined ? spec.defaultScope : read.scope;
     if (typeof key !== "string" || !_hasOwn(spec.scopes, key)) {
       throw E(badInput, "pki.schema." + spec.key + ".decodeExtension needs opts.scope naming which " +
@@ -2617,7 +2617,7 @@ function spki(ns, opts) {
 
 function attribute(ns, opts) {
   opts = opts || _create(null);
-  var minValues = opts.minValues === undefined ? 1 : opts.minValues;
+  var minValues = opts.minValues == null ? 1 : opts.minValues;
   return schema.seq([
     schema.field("type", schema.oidLeaf()),
     schema.field("values", schema.setOf(schema.any(), { assert: "set", min: minValues, max: constants.LIMITS.ATTRIBUTE_MAX_VALUES,

package/lib/sigstore.js

@@ -1244,7 +1244,7 @@ async function _verifyRekorEntry(te, rekorKeys, leafDer, contentType, arm, paylo
  * be checked. A token that does not verify is passed over rather than refused: it is a statement from
  * an authority this caller did not pin, which says nothing either way. With no token verifying, the
  * caller is left with no attested instant and the verdict says so. */
-async function _timestampInstants(vm, sigBytes, tsaRoots) {
+async function _timestampInstants(vm, sigBytes, tsaRoots, distrusted) {
   if (!tsaRoots) return null;
   var anchors = _normTsaAnchors(tsaRoots);
   if (!anchors.length) {
@@ -1271,7 +1271,7 @@ async function _timestampInstants(vm, sigBytes, tsaRoots) {
       ? _b64(t.signedTimestamp, "rfc3161Timestamps[" + i + "].signedTimestamp") : null;
     if (der === null) continue;
     var res;
-    try { res = await _tspVerify(der, sigBytes, { trustAnchors: anchors }); }
+    try { res = await _tspVerify(der, sigBytes, { trustAnchors: anchors, distrustedKeys: distrusted }); }
     catch (_e) { continue; } // allow:swallow-unverified a token this caller cannot check says nothing; the next is tried and a bundle with none verifying is refused for want of an instant
     if (!res || res.valid !== true || res.trusted !== true) continue;
     var ms = guard.time.instantOf(res.genTime);
@@ -1402,7 +1402,7 @@ function _ctLogFor(logs, logIdBytes, timeMs) {
  *  here read the caller's array after a yield, so a caller could add an anchor while verification was
  *  pending and decide which CA is trusted: an empty list that grows during the timestamp check would have
  *  passed a chain the call was made without any anchor for. */
-async function _verifyChain(leaf, chainDers, roots, timeMs) {
+async function _verifyChain(leaf, chainDers, roots, timeMs, distrusted) {
   var bundleLinks = _map(_arraySlice(chainDers, 1), function (d, i) { return _parseCert(d, "bundle intermediate [" + i + "]"); });
   var inWindow = _filter(roots, function (r) { return _inWindow(timeMs, r.validFor); });
   if (!inWindow.length) {
@@ -1449,6 +1449,7 @@ async function _verifyChain(leaf, chainDers, roots, timeMs) {
       time: new _Date(timeMs),
       historicalMode: true,
       requiredEku: ["codeSigning"],
+      distrustedKeys: distrusted,
     });
   } catch (e) {
     if (e && e.code === "path/no-path") {
@@ -1557,7 +1558,7 @@ function _fulcioExtValue(ext, leafArc) {
 
 var IDENTITY_FIELDS = ["san", "issuer", "sourceRepositoryURI"];
 var IDENTITY_KEYS = _assign(_create(null), { san: 1, issuer: 1, sourceRepositoryURI: 1 });
-var _VERIFY_BUNDLE_OPTS = _assign(_create(null), { fulcioRoots: 1, rekorKeys: 1, ctLogs: 1, identity: 1, predicateType: 1, time: 1, artifact: 1, tsaRoots: 1 });
+var _VERIFY_BUNDLE_OPTS = _assign(_create(null), { fulcioRoots: 1, rekorKeys: 1, ctLogs: 1, identity: 1, predicateType: 1, time: 1, artifact: 1, tsaRoots: 1, distrustedKeys: 1 });
 
 /** @internal The bytes a message signature covers, taken once. There is no shape here in which a
  * caller hands over a precomputed digest: the arm's own field comment forbids using one as a
@@ -1702,6 +1703,7 @@ function _statement(payload, payloadType, expectedPredicate) {
  *   predicateType: string,     // optional: require this in-toto predicateType (e.g. the SLSA URI); dsse_envelope bundles only
  *   artifact:      BufferSource, // the bytes a message_signature covers; required for that arm, refused for a dsse_envelope
  *   tsaRoots:      Array,      // optional timestamp-authority anchors: a DER Buffer or { der } each; required to date a Rekor v2 bundle, which carries no signed entry timestamp
+ *   distrustedKeys: Array,     // optional SHA-256 digests of SubjectPublicKeyInfo DER (64 hex characters or 32 bytes); a listed key fails the Fulcio chain, or the timestamp authority's chain so its token dates nothing
  *   time:          Date,       // optional check-date override (default: the Rekor integratedTime, or an RFC 3161 token's genTime on a v2 entry)
  *
  * @example
@@ -1736,6 +1738,9 @@ async function verifyBundle(bundle, opts) {
    *  verification is pending would decide a check the call was made without it. */
   var fulcioRoots = _normRoots(o.fulcioRoots || []);
   var ctLogs = o.ctLogs === undefined || o.ctLogs === null ? o.ctLogs : _normCtLogs(o.ctLogs);
+  /** @internal Typed here, before the timestamp leg, because that leg passes over a token whose
+   *  verification throws, and a malformed list must be reported as the caller's input fault. */
+  var distrusted = guard.distrust.keys(o.distrustedKeys, _err, "sigstore/bad-input", "opts.distrustedKeys");
 
   /** @internal Each option belongs to one arm, and one supplied for the other is refused rather than
    * passed over. An ignored option reads as a check that ran: opts.artifact on a DSSE bundle names
@@ -1796,7 +1801,7 @@ async function verifyBundle(bundle, opts) {
    * SIGNATURE bytes, which is what dates the ephemeral certificate that made them; a token over the
    * payload would date the thing signed rather than the signing. */
   var tsaMsList = null;
-  if (!haveCallerTime) tsaMsList = await _timestampInstants(vm, derSig, o.tsaRoots);
+  if (!haveCallerTime) tsaMsList = await _timestampInstants(vm, derSig, o.tsaRoots, distrusted);
   var chainDers = _chainDers(vm);
   /** @internal A caller-pinned instant is the same for every candidate, so the chain it decides is
    * computed on the first candidate and reused rather than rebuilt per entry. Without one the instant
@@ -1873,7 +1878,7 @@ async function verifyBundle(bundle, opts) {
           "timestamp authority, or supply opts.time");
       }
       var candidateChain = pinnedChain !== null ? pinnedChain
-        : await _verifyChain(leaf, chainDers, fulcioRoots, candidateTime);
+        : await _verifyChain(leaf, chainDers, fulcioRoots, candidateTime, distrusted);
       if (haveCallerTime) pinnedChain = candidateChain;
       var candidateScts = await _verifyEmbeddedScts(leaf, leafDer, candidateChain.issuer, ctLogs, candidateTime, candidateBound);
       rekor = candidate;

package/lib/smime.js

@@ -63,7 +63,7 @@ var SIGN_OPTS = Object.assign(Object.create(null), {
 });
 var VERIFY_OPTS = Object.assign(Object.create(null), {
   certs: 1, trustAnchors: 1, time: 1, requiredEku: 1, checkPurpose: 1, strictMicalg: 1,
-  legacyHeaderProtection: 1, expectedSender: 1, allowWeakDigests: 1,
+  legacyHeaderProtection: 1, expectedSender: 1, allowWeakDigests: 1, distrustedKeys: 1,
 });
 var ENCRYPT_OPTS = Object.assign(Object.create(null), {
   entity: 1, contentType: 1, protectHeaders: 1, headers: 1, hcp: 1,
@@ -591,9 +591,9 @@ function _hpSurface(content, outerEnt, expectedMode, authenticated, legacyEnable
 
 function _cmsSignOpts(opts, detached) {
   var o = { detached: detached };
-  if (opts.signingTime !== undefined) o.signingTime = opts.signingTime;
+  if (opts.signingTime != null) o.signingTime = opts.signingTime;
   if (opts.sid) o.sid = opts.sid;
-  if (opts.signedAttributes !== undefined) o.signedAttributes = opts.signedAttributes;
+  if (opts.signedAttributes != null) o.signedAttributes = opts.signedAttributes;
   if (opts.additionalSignedAttributes) o.additionalSignedAttributes = opts.additionalSignedAttributes;
   return o;
 }
@@ -781,6 +781,9 @@ function _capped(msg) {
  * @opts time         the instant the signer's chain is judged at (default now). Only read with `trustAnchors`.
  * @opts requiredEku  key purposes the SIGNER certificate must carry. Defaults to `["emailProtection"]`.
  * @opts checkPurpose the purpose the ANCHOR's own trust metadata must permit. Defaults to `"emailProtection"`.
+ * @opts distrustedKeys SHA-256 digests of SubjectPublicKeyInfo DER (64 hexadecimal characters or 32 bytes
+ *                    each, see `pki.trust.spkiDigest`), forwarded to `cms.verify` with `trustAnchors`. A
+ *                    listed key on the signer's chain, the anchor included, reports the signer as not trusted.
  * @opts strictMicalg reject a `multipart/signed` whose `micalg` disagrees with the SignerInfo digest.
  * @opts legacyHeaderProtection  opt in to detecting a LEGACY RFC 8551 header-protected message (RFC 9788 sec. 4.10): a Cryptographic Payload that is a bare `message/rfc822` wrap with no `hp=` parameter. When set, a precisely-identified legacy message surfaces the inner message's headers under `headerProtection.legacy = { headers, mode, fromMismatch, confidential }`, where `headers` is an ordered `[{ name, value }]` array (retaining legally-repeated fields such as `Received`) and the mode is inferred from the envelope (`clear` here). They are not placed under `protectedHeaders`, and `present` stays `false`. Consuming `headerProtection.legacy.headers` is an explicit choice: a legacy message is structurally indistinguishable from an ordinary forwarded `message/rfc822`, so this is a heuristic (RFC 9788 sec. 4.10.2: "not based on any strong end-to-end guarantees"); cross-check `legacy.fromMismatch`. Anything not precisely identified (a nested crypto layer, an `hp=` on the inner message, a non-`message/rfc822` payload, a duplicate of a singleton field, or a duplicate Content-Type) reports `legacy: null`. Off by default. The signed-and-encrypted form (RFC 9788 Appendix C.3.17) is a documented gap (`legacy: null` at `decrypt`; surfaces as `clear` only via the caller's re-`verify` step), because the non-recursive layered API exposes no single seam holding both the inner signature verdict and the outer header section.
  * @example
@@ -795,6 +798,7 @@ function _capped(msg) {
 async function verify(message, opts) {
   opts = opts || _create(null);
   opts = _knownOpts(opts, VERIFY_OPTS, "verify");
+  var distrustedKeys = guard.distrust.keys(opts.distrustedKeys, _err, "smime/bad-input", "pki.smime.verify opts.distrustedKeys");
   var ent = mime.parse(message, SmimeError, "smime/bad-mime");
   var ct = ent.contentType;
   var vOpts = {};
@@ -803,8 +807,9 @@ async function verify(message, opts) {
     vOpts.trustAnchors = opts.trustAnchors;
     vOpts.requiredEku = opts.requiredEku != null ? opts.requiredEku : ["emailProtection"];
     vOpts.checkPurpose = opts.checkPurpose != null ? opts.checkPurpose : "emailProtection";
+    if (distrustedKeys !== null) vOpts.distrustedKeys = distrustedKeys;
   }
-  if (opts.time !== undefined) vOpts.time = opts.time;
+  if (opts.time != null) vOpts.time = opts.time;
   if (opts.allowWeakDigests === true) vOpts.allowWeakDigests = true;
   if (_isPkcs7(ct.type, "mime")) {
     if (ct.params["smime-type"] && ct.params["smime-type"] !== "signed-data") throw _err("smime/unsupported-type", "unsupported smime-type " + JSON.stringify(ct.params["smime-type"]) + " (only signed-data)");
@@ -854,10 +859,10 @@ function _envelopedTypeOf(der, badParseCode) {
 
 function _cmsEncryptOpts(opts) {
   var o = {};
-  if (opts.contentEncryptionAlgorithm !== undefined) o.contentEncryptionAlgorithm = opts.contentEncryptionAlgorithm;
-  if (opts.oaepHash !== undefined) o.oaepHash = opts.oaepHash;
-  if (opts.keyIdentifier !== undefined) o.keyIdentifier = opts.keyIdentifier;
-  if (opts.ukm !== undefined) o.ukm = opts.ukm;
+  if (opts.contentEncryptionAlgorithm != null) o.contentEncryptionAlgorithm = opts.contentEncryptionAlgorithm;
+  if (opts.oaepHash != null) o.oaepHash = opts.oaepHash;
+  if (opts.keyIdentifier != null) o.keyIdentifier = opts.keyIdentifier;
+  if (opts.ukm != null) o.ukm = opts.ukm;
   return o;
 }
 
@@ -972,12 +977,12 @@ async function decrypt(message, keyMaterial, opts) {
   var smimeType = _envelopedTypeOf(der, "smime/unsupported-type");
   if (opts.strictSmimeType && st && stLower !== smimeType.toLowerCase()) throw _err("smime/smime-type-mismatch", "the header smime-type " + JSON.stringify(st) + " disagrees with the CMS body (" + smimeType + ")");
   var cmsOpts = {};
-  if (opts.recipientIndex !== undefined) cmsOpts.recipientIndex = opts.recipientIndex;
-  if (opts.maxIterations !== undefined) cmsOpts.maxIterations = opts.maxIterations;
+  if (opts.recipientIndex != null) cmsOpts.recipientIndex = opts.recipientIndex;
+  if (opts.maxIterations != null) cmsOpts.maxIterations = opts.maxIterations;
   /** @internal Forwarded rather than re-decided here: an S/MIME body is a CMS structure and the rule about
    *  RSAES-PKCS1-v1_5 over an unauthenticated content belongs to the verb that opens it. An
    *  `openssl smime -encrypt` or `openssl cms -encrypt` message is exactly that combination by default. */
-  if (opts.allowUnauthenticatedRsa15 !== undefined) cmsOpts.allowUnauthenticatedRsa15 = opts.allowUnauthenticatedRsa15;
+  if (opts.allowUnauthenticatedRsa15 != null) cmsOpts.allowUnauthenticatedRsa15 = opts.allowUnauthenticatedRsa15;
   var res = await cms.decrypt(der, keyMaterial, cmsOpts);
   return Object.assign({
     content: res.content, smimeType: smimeType, authenticated: res.authenticated,
@@ -1014,7 +1019,7 @@ async function compress(content, opts) {
   opts = _knownOpts(opts, COMPRESS_OPTS, "compress");
   var entity = _entityBytes(content, opts);
   var cOpts = {};
-  if (opts.level !== undefined) cOpts.level = opts.level;
+  if (opts.level != null) cOpts.level = opts.level;
   var der = _toBuf(await cms.compress(entity, cOpts));
   var head = _pkcs7MimeHead("compressed-data", "smime.p7z");
   return _capped(Buffer.concat([head, _base64Body(der), mime.CRLF]));
@@ -1053,7 +1058,7 @@ async function decompress(message, opts) {
   if (st && st.toLowerCase() !== "compressed-data") throw _err("smime/unsupported-type", "unsupported smime-type " + JSON.stringify(st) + " (only compressed-data)");
   var der = _decodeCms(ent);
   var dOpts = {};
-  if (opts.maxOutputBytes !== undefined) dOpts.maxOutputBytes = opts.maxOutputBytes;
+  if (opts.maxOutputBytes != null) dOpts.maxOutputBytes = opts.maxOutputBytes;
   var res = await cms.decompress(der, dOpts);
   return { content: res.content, contentType: res.contentType, contentTypeName: res.contentTypeName, compressionAlgorithm: res.compressionAlgorithm };
 }

package/lib/tls-cert-compress.js

@@ -88,7 +88,7 @@ var HEADER_BYTES = 8;
 
 function _resolveCap(opts) {
   var cap = C.LIMITS.TLS_CERT_MSG_MAX_BYTES;
-  if (opts.maxOutputBytes !== undefined) {
+  if (opts.maxOutputBytes != null) {
     var mo = opts.maxOutputBytes;
     if (typeof mo !== "number" || !isFinite(mo) || mo <= 0 || Math.floor(mo) !== mo) {
       throw _err("tls/bad-input", "opts.maxOutputBytes must be a positive integer");
@@ -99,6 +99,7 @@ function _resolveCap(opts) {
 }
 
 function _resolveAllowed(opts) {
+  // allow:caller-option-presence-tested-against-undefined -- absence accepts every codec this build supports, so a null must be refused rather than widen the allowlist
   if (opts.allowedAlgorithms === undefined) return SUPPORTED.slice();
   var list = opts.allowedAlgorithms;
   if (!Array.isArray(list)) throw _err("tls/bad-input", "opts.allowedAlgorithms must be an array of algorithm names or numbers");
@@ -263,7 +264,7 @@ function decompressCertificate(bytes, opts) {
  */
 function parseCertificateMessage(bytes, opts) {
   opts = opts || intrinsic.create(null);
-  var type = opts.certificateType === undefined ? "X509" : opts.certificateType;
+  var type = opts.certificateType == null ? "X509" : opts.certificateType;
   if (type !== "X509" && type !== "RawPublicKey") {
     throw _err("tls/bad-input", "opts.certificateType must be \"X509\" or \"RawPublicKey\"");
   }
@@ -330,7 +331,7 @@ function compressCertificate(certificateMessage, opts) {
       " bytes, over the " + C.LIMITS.TLS_CERT_MSG_MAX_BYTES + "-byte handshake framing limit");
   }
   var view = guard.bytes.snapshot(viewed, TlsError, "tls/bad-input", "the certificate message");
-  var sel = opts.algorithm === undefined ? "zlib" : opts.algorithm;
+  var sel = opts.algorithm == null ? "zlib" : opts.algorithm;
   var name = (typeof sel === "number") ? ALG_BY_NUMBER[sel] : sel;
   if (typeof name !== "string" || SUPPORTED.indexOf(name) === -1) {
     throw _err("tls/unsupported-algorithm", "opts.algorithm names an algorithm this toolkit cannot compress: " + JSON.stringify(sel));
@@ -338,12 +339,12 @@ function compressCertificate(certificateMessage, opts) {
   if (view.length < MIN_CERT_MSG_BYTES) {
     throw _err("tls/bad-input", "a Certificate message is at least " + MIN_CERT_MSG_BYTES + " bytes (RFC 8446 sec. 4.4.2)");
   }
-  if (opts.level !== undefined && (typeof opts.level !== "number" || !isFinite(opts.level) || Math.floor(opts.level) !== opts.level)) {
+  if (opts.level != null && (typeof opts.level !== "number" || !isFinite(opts.level) || Math.floor(opts.level) !== opts.level)) {
     throw _err("tls/bad-input", "opts.level must be an integer");
   }
   var stream;
   try {
-    stream = COMPRESS[name](view, opts.level !== undefined ? LEVEL_OPT[name](opts.level) : undefined);
+    stream = COMPRESS[name](view, opts.level != null ? LEVEL_OPT[name](opts.level) : undefined);
   } catch (e) {
     throw _err("tls/bad-input", "the certificate message could not be compressed (check opts.level)", e);
   }