@bounded-systems/conformance-kit 0.2.0 → 0.4.0

package/integrity/verify/package.json

@@ -0,0 +1,10 @@
+{
+  "name": "@conformance-kit/integrity-verify",
+  "version": "0.1.0",
+  "private": true,
+  "description": "Standalone, offline cryptographic verifier — checks a site serves bytes matching its keyless-signed manifest (sigstore-js, in-process bundle verify).",
+  "type": "module",
+  "bin": { "verify": "./verify.mjs" },
+  "dependencies": { "sigstore": "^2.3.1" },
+  "engines": { "node": ">=20" }
+}

package/integrity/verify/verify.mjs

@@ -22,7 +22,7 @@
 // npm-publishable (with its own Sigstore provenance) — the same core a browser
 // extension or CI policy would consume.
 import { readFile } from "node:fs/promises";
-import { createHash } from "node:crypto";
+import { createHash, X509Certificate } from "node:crypto";
 import { join } from "node:path";
 import { verify as sigstoreVerify } from "sigstore";
 
@@ -77,8 +77,13 @@ if (provenance?.builtAt) {
 
 // 1: cryptographic bundle verification, in-process, offline
 try {
-  const signer = await sigstoreVerify(bundle, manifest, { certificateIssuer: ISSUER });
-  const san = signer?.identity?.subjectAlternativeName || "";
+  // sigstore-js verify() throws on any crypto failure (signature / Fulcio chain / Rekor
+  // inclusion) and returns nothing — so the identity SAN is read from the bundle's leaf cert.
+  await sigstoreVerify(bundle, manifest, { certificateIssuer: ISSUER });
+  const certB64 = bundle.verificationMaterial?.certificate?.rawBytes
+    || bundle.verificationMaterial?.x509CertificateChain?.certificates?.[0]?.rawBytes;
+  if (!certB64) throw new Error("no signing certificate in bundle");
+  const san = (new X509Certificate(Buffer.from(certB64, "base64")).subjectAltName || "").replace(/^URI:/, "");
   if (!new RegExp(identityRe).test(san)) throw new Error(`cert identity ${san} !~ ${identityRe}`);
   log(true, `bundle verified — signature + Fulcio cert + Rekor inclusion (offline), identity ${san}`);
 } catch (e) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bounded-systems/conformance-kit",
-  "version": "0.2.0",
+  "version": "0.4.0",
   "description": "Standalone, site-agnostic web-conformance toolkit: integrity tooling + build gates + provenance generators, all parameterized so a site vendors one kit instead of duplicating scripts.",
   "type": "module",
   "license": "MIT",
@@ -9,24 +9,26 @@
     "url": "git+https://github.com/bounded-systems/conformance-kit.git"
   },
   "bin": {
-    "ck-gen-sitemanifest": "./integrity/gen-sitemanifest.mjs",
-    "ck-gen-provenance": "./integrity/gen-provenance.mjs",
-    "ck-verify-site": "./integrity/verify-site.mjs",
-    "ck-http-probe": "./integrity/http-probe.mjs",
-    "ck-structure-audit": "./integrity/structure-audit/audit.mjs",
-    "ck-gen-sbom": "./gates/sbom/gen-sbom.mjs",
-    "ck-check-sbom": "./gates/sbom/check-sbom.mjs",
-    "ck-shacl-runner": "./gates/shacl-runner.mjs",
-    "ck-seo-gate": "./gates/seo-gate.mjs",
-    "ck-axe-gate": "./gates/axe-gate.mjs",
-    "ck-vuln-gate": "./gates/vuln-gate.mjs",
-    "ck-html-validator-gate": "./gates/html-validator-gate.mjs",
-    "ck-baseline-gate": "./gates/baseline-gate.mjs",
-    "ck-readability-gate": "./gates/readability-gate.mjs",
-    "ck-commonmark-runner": "./gates/commonmark-runner.mjs",
-    "ck-gen-cid": "./generators/gen-cid.mjs",
-    "ck-gen-identity": "./generators/gen-identity.mjs",
-    "ck-gen-snapshots": "./generators/gen-snapshots.mjs"
+    "ck-gen-sitemanifest": "integrity/gen-sitemanifest.mjs",
+    "ck-gen-provenance": "integrity/gen-provenance.mjs",
+    "ck-verify-site": "integrity/verify-site.mjs",
+    "ck-http-probe": "integrity/http-probe.mjs",
+    "ck-structure-audit": "integrity/structure-audit/audit.mjs",
+    "ck-gen-sbom": "gates/sbom/gen-sbom.mjs",
+    "ck-check-sbom": "gates/sbom/check-sbom.mjs",
+    "ck-shacl-runner": "gates/shacl-runner.mjs",
+    "ck-seo-gate": "gates/seo-gate.mjs",
+    "ck-axe-gate": "gates/axe-gate.mjs",
+    "ck-vuln-gate": "gates/vuln-gate.mjs",
+    "ck-html-validator-gate": "gates/html-validator-gate.mjs",
+    "ck-baseline-gate": "gates/baseline-gate.mjs",
+    "ck-palette-gate": "gates/palette-gate.mjs",
+    "ck-jargon-gate": "gates/jargon-gate.mjs",
+    "ck-readability-gate": "gates/readability-gate.mjs",
+    "ck-commonmark-runner": "gates/commonmark-runner.mjs",
+    "ck-gen-cid": "generators/gen-cid.mjs",
+    "ck-gen-identity": "generators/gen-identity.mjs",
+    "ck-gen-snapshots": "generators/gen-snapshots.mjs"
   },
   "scripts": {
     "test": "node test/run.mjs"
@@ -57,6 +59,7 @@
   "dependencies": {
     "@mozilla/readability": "^0.5.0",
     "@zazuko/env-node": "^2.1.5",
+    "an-array-of-english-words": "^2.0.0",
     "axe-core": "^4.10.0",
     "jsonld": "^9.0.0",
     "linkedom": "^0.18.0",