@calimero-network/mero-js 19.27.1 → 20.0.0

package/dist/index.mjs

@@ -7065,17 +7065,32 @@ async function defaultNonceSource(deviceSecret) {
 
 // src/sealed/verify.ts
 var MEASUREMENT_HEX = /^[0-9a-f]{96}$/;
+var REGISTERS = ["mrtd", "rtmr0", "rtmr1", "rtmr2", "rtmr3"];
 function createQuoteVerifier(options) {
-  const allowedMrtd = measurements(options.allowedMrtd, "allowedMrtd");
-  if (allowedMrtd.length === 0) {
-    throw new Error("allowedMrtd is empty, so no quote would ever be accepted");
-  }
+  const allowedMrtd = measurements(options.allowedMrtd ?? [], "allowedMrtd");
+  const allowedImages = (options.allowedMeasurements ?? []).map((image, index) => {
+    const label = `allowedMeasurements[${index}]`;
+    return REGISTERS.map((register) => measurements([image?.[register] ?? ""], `${label}.${register}`)[0]).join();
+  });
   const allowedRtmr = [
     measurements(options.allowedRtmr0 ?? [], "allowedRtmr0"),
     measurements(options.allowedRtmr1 ?? [], "allowedRtmr1"),
     measurements(options.allowedRtmr2 ?? [], "allowedRtmr2"),
     measurements(options.allowedRtmr3 ?? [], "allowedRtmr3")
   ];
+  if (options.allowedMeasurements !== void 0 && allowedImages.length === 0) {
+    throw new Error("allowedMeasurements is empty, so no quote would ever be accepted");
+  }
+  if (allowedImages.length === 0) {
+    if (allowedMrtd.length === 0) {
+      throw new Error("No image is trusted: give allowedMeasurements, or allowedMrtd with allowedRtmr1-3");
+    }
+    if (allowedRtmr.slice(1).some((list) => list.length === 0)) {
+      throw new Error(
+        "allowedMrtd alone does not name an image: the MRTD measures the TD firmware, which images share, and the image is in RTMR1-3. Give allowedMeasurements, or allowedRtmr1-3 too"
+      );
+    }
+  }
   const allowedStatuses = options.allowedTcbStatuses ?? ["UpToDate"];
   const now = options.now ?? Date.now;
   const verifier = async ({
@@ -7101,8 +7116,14 @@ function createQuoteVerifier(options) {
       throw new Error(`The platform's TCB status is ${verified.status}, which is not accepted`);
     }
     const td = tdReport(verified.report);
-    if (!allowedMrtd.includes(hex(td.mrTd))) {
-      throw new Error(`MRTD ${hex(td.mrTd)} is not an image this verifier trusts`);
+    const measured = [td.mrTd, td.rtMr0, td.rtMr1, td.rtMr2, td.rtMr3].map((register) => hex(register));
+    if (allowedImages.length > 0 && !allowedImages.includes(measured.join())) {
+      throw new Error(
+        `The measurements (MRTD ${measured[0]}, RTMR0-3 ${measured.slice(1).join(", ")}) are not an image this verifier trusts`
+      );
+    }
+    if (allowedMrtd.length > 0 && !allowedMrtd.includes(measured[0])) {
+      throw new Error(`MRTD ${measured[0]} is not an image this verifier trusts`);
     }
     const registers = [td.rtMr0, td.rtMr1, td.rtMr2, td.rtMr3];
     registers.forEach((register, index) => {
@@ -7139,6 +7160,51 @@ function fromBase64(value) {
   for (let i = 0; i < binary.length; i += 1) bytes[i] = binary.charCodeAt(i);
   return bytes;
 }
+var TCB_STATUSES = [
+  "UpToDate",
+  "SWHardeningNeeded",
+  "ConfigurationNeeded",
+  "ConfigurationAndSWHardeningNeeded",
+  "OutOfDate",
+  "OutOfDateConfigurationNeeded"
+];
+function trustedMeasurementsFromReleases(releases, { profile }) {
+  if (releases.length === 0) {
+    throw new Error("No release given, so no image would be trusted");
+  }
+  let statuses;
+  const allowedMeasurements = releases.map((release, index) => {
+    const name = release?.tag ?? `releases[${index}]`;
+    if (release?.role !== void 0 && release.role !== "node") {
+      throw new Error(`${name} lists the measurements of a ${release.role}, not of a node image`);
+    }
+    const image = release?.profiles?.[profile];
+    if (!image) {
+      const known = Object.keys(release?.profiles ?? {}).join(", ") || "none";
+      throw new Error(`${name} has no profile ${JSON.stringify(profile)} (it has: ${known})`);
+    }
+    const accepted = (image.allowed_tcb_statuses ?? ["uptodate"]).map((status) => tcbStatus(status, name));
+    statuses = statuses === void 0 ? accepted : statuses.filter((status) => accepted.includes(status));
+    return {
+      mrtd: image.mrtd,
+      rtmr0: image.rtmr0,
+      rtmr1: image.rtmr1,
+      rtmr2: image.rtmr2,
+      rtmr3: image.rtmr3
+    };
+  });
+  if (!statuses || statuses.length === 0) {
+    throw new Error("The releases given accept no TCB status in common");
+  }
+  return { allowedMeasurements, allowedTcbStatuses: statuses };
+}
+function tcbStatus(status, release) {
+  const known = TCB_STATUSES.find((candidate) => candidate.toLowerCase() === String(status).toLowerCase());
+  if (!known) {
+    throw new Error(`${release} accepts TCB status ${JSON.stringify(status)}, which this verifier does not know`);
+  }
+  return known;
+}
 
 // src/namespace-op/namespace-op.ts
 var SIGNED_NAMESPACE_OP_SCHEMA_VERSION = 8;
@@ -7545,6 +7611,7 @@ export {
   signRoutingChallenge,
   signWarrant,
   transportKeyBinding,
+  trustedMeasurementsFromReleases,
   withCap,
   withRetry,
   withoutCap