@calimero-network/mero-js 21.3.0 → 21.4.0

package/dist/sealed/sigstore-trust-root.js

@@ -0,0 +1,76 @@
+/**
+ * The parts of the Sigstore public-good trust root that verifying a mero-tee
+ * release's cosign bundle needs: the Fulcio certificate authorities that issue
+ * the release workflow's short-lived signing certificates, and the Rekor log
+ * key that signs the bundle's signed entry timestamp. Each with the window in
+ * which the trust root says it was in use.
+ *
+ * Copied from the `trusted_root.json` that Sigstore publishes through its TUF
+ * repository (https://tuf-repo-cdn.sigstore.dev, target `trusted_root.json`),
+ * as shipped by the `sigstore` Python client 4.5.0 in
+ * `sigstore/_store/https%3A%2F%2Ftuf-repo-cdn.sigstore.dev/trusted_root.json`.
+ * Embedded rather than fetched: fetching it at run time would trust whoever
+ * serves it, the very thing this check exists to avoid.
+ *
+ * Left out, because a legacy cosign bundle never uses them: the CT logs (the
+ * certificate's SCT is not checked here, as core does not either), the
+ * timestamp authority, and the Rekor v2 log `log2025-1.rekor.sigstore.dev`,
+ * whose Ed25519 key signs checkpoints rather than signed entry timestamps. A
+ * bundle that names any log but those below is refused.
+ *
+ * To refresh it when Sigstore rotates a key or adds a CA: take the current
+ * `trusted_root.json` from a TUF client (`python -m sigstore` or `cosign
+ * initialize` both keep one, verified against the TUF root), and copy each
+ * `certificateAuthorities[].certChain.certificates[].rawBytes` with its
+ * `validFor`, and each ECDSA `tlogs[]` entry's `publicKey.rawBytes`,
+ * `publicKey.validFor` and `logId.keyId` (as hex). The tests check each log id
+ * is the SHA-256 of its key and each chain verifies.
+ */
+export const FULCIO_AUTHORITIES = [
+    {
+        uri: 'https://fulcio.sigstore.dev',
+        validFor: { start: '2021-03-07T03:20:29Z', end: '2022-12-31T23:59:59.999Z' },
+        certChain: [
+            'MIIB+DCCAX6gAwIBAgITNVkDZoCiofPDsy7dfm6geLbuhzAKBggqhkjOPQQDAzAqMRUwEwYDVQQKEwxzaWdzdG9y' +
+                'ZS5kZXYxETAPBgNVBAMTCHNpZ3N0b3JlMB4XDTIxMDMwNzAzMjAyOVoXDTMxMDIyMzAzMjAyOVowKjEVMBMGA1UE' +
+                'ChMMc2lnc3RvcmUuZGV2MREwDwYDVQQDEwhzaWdzdG9yZTB2MBAGByqGSM49AgEGBSuBBAAiA2IABLSyA7Ii5k+p' +
+                'NO8ZEWY0ylemWDowOkNa3kL+GZE5Z5GWehL9/A9bRNA3RbrsZ5i0JcastaRL7Sp5fp/jD5dxqc/UdTVnlvS16an+' +
+                '2Yfswe/QuLolRUCrcOE2+2iA5+tzd6NmMGQwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQEwHQYD' +
+                'VR0OBBYEFMjFHQBBmiQpMlEk6w2uSu1KBtPsMB8GA1UdIwQYMBaAFMjFHQBBmiQpMlEk6w2uSu1KBtPsMAoGCCqG' +
+                'SM49BAMDA2gAMGUCMH8liWJfMui6vXXBhjDgY4MwslmN/TJxVe/83WrFomwmNf056y1X48F9c4m3a3ozXAIxAKjR' +
+                'ay5/aj/jsKKGIkmQatjI8uupHr/+CxFvaJWmpYqNkLDGRU+9orzh5hI2RrcuaQ==',
+        ],
+    },
+    {
+        uri: 'https://fulcio.sigstore.dev',
+        validFor: { start: '2022-04-13T20:06:15Z' },
+        certChain: [
+            'MIICGjCCAaGgAwIBAgIUALnViVfnU0brJasmRkHrn/UnfaQwCgYIKoZIzj0EAwMwKjEVMBMGA1UEChMMc2lnc3Rv' +
+                'cmUuZGV2MREwDwYDVQQDEwhzaWdzdG9yZTAeFw0yMjA0MTMyMDA2MTVaFw0zMTEwMDUxMzU2NThaMDcxFTATBgNV' +
+                'BAoTDHNpZ3N0b3JlLmRldjEeMBwGA1UEAxMVc2lnc3RvcmUtaW50ZXJtZWRpYXRlMHYwEAYHKoZIzj0CAQYFK4EE' +
+                'ACIDYgAE8RVS/ysH+NOvuDZyPIZtilgUF9NlarYpAd9HP1vBBH1U5CV77LSS7s0ZiH4nE7Hv7ptS6LvvR/STk798' +
+                'LVgMzLlJ4HeIfF3tHSaexLcYpSASr1kS0N/RgBJz/9jWCiXno3sweTAOBgNVHQ8BAf8EBAMCAQYwEwYDVR0lBAww' +
+                'CgYIKwYBBQUHAwMwEgYDVR0TAQH/BAgwBgEB/wIBADAdBgNVHQ4EFgQU39Ppz1YkEZb5qNjpKFWixi4YZD8wHwYD' +
+                'VR0jBBgwFoAUWMAeX5FFpWapesyQoZMi0CrFxfowCgYIKoZIzj0EAwMDZwAwZAIwPCsQK4DYiZYDPIaDi5HFKnfx' +
+                'Xx6ASSVmERfsynYBiX2X6SJRnZU84/9DZdnFvvxmAjBOt6QpBlc4J/0DxvkTCqpclvziL6BCCPnjdlIB3Pu3BxsP' +
+                'mygUY7Ii2zbdCdliiow=',
+            'MIIB9zCCAXygAwIBAgIUALZNAPFdxHPwjeDloDwyYChAO/4wCgYIKoZIzj0EAwMwKjEVMBMGA1UEChMMc2lnc3Rv' +
+                'cmUuZGV2MREwDwYDVQQDEwhzaWdzdG9yZTAeFw0yMTEwMDcxMzU2NTlaFw0zMTEwMDUxMzU2NThaMCoxFTATBgNV' +
+                'BAoTDHNpZ3N0b3JlLmRldjERMA8GA1UEAxMIc2lnc3RvcmUwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAT7XeFT4rb3' +
+                'PQGwS4IajtLk3/OlnpgangaBclYpsYBr5i+4ynB07ceb3LP0OIOZdxexX69c5iVuyJRQ+Hz05yi+UF3uBWAlHpiS' +
+                '5sh0+H2GHE7SXrk1EC5m1Tr19L9gg92jYzBhMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MB0GA1Ud' +
+                'DgQWBBRYwB5fkUWlZql6zJChkyLQKsXF+jAfBgNVHSMEGDAWgBRYwB5fkUWlZql6zJChkyLQKsXF+jAKBggqhkjO' +
+                'PQQDAwNpADBmAjEAj1nHeXZp+13NWBNa+EDsDP8G1WWg1tCMWP/WHPqpaVo0jhsweNFZgSs0eE7wYI4qAjEA2WB9' +
+                'ot98sIkoF3vZYdd3/VtWB5b9TNMea7Ix/stJ5TfcLLeABLE4BNJOsQ4vnBHJ',
+        ],
+    },
+];
+export const REKOR_LOGS = [
+    {
+        baseUrl: 'https://rekor.sigstore.dev',
+        logId: 'c0d23d6ad406973f9559f3ba2d1ca01f84147d8ffc5b8445c224f98b9591801d',
+        publicKey: 'MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE2G2Y+2tabdTV5BcGiBIx0a9fAFwrkBbmLSGtks4L3qX6yYY0zufB' +
+            'nhC8Ur/iy55GhWP/9A/bY2LhC30M9+RYtw==',
+        validFor: { start: '2021-01-12T11:53:27Z' },
+    },
+];

package/dist/sealed/sigstore.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Verifying a cosign keyless signature, as `cosign verify-blob --bundle` does,
+ * with WebCrypto and the Sigstore trust root embedded in this package.
+ *
+ * mero-tee signs each release asset with cosign keyless: there is no release
+ * key, only a Fulcio certificate that lives ten minutes, issued to one GitHub
+ * Actions workflow run, and a Rekor log entry that proves the signature was
+ * made while the certificate was valid. So the checks are: the signature over
+ * the bytes verifies with the certificate's key; Rekor's signed entry
+ * timestamp verifies, and the entry it signs is this signature over these
+ * bytes by this certificate; the certificate chains to a Fulcio CA and was
+ * valid when Rekor logged it; and the certificate names the workflow expected.
+ * The same checks core runs in `crates/tee-release/src/sigstore_verify.rs`.
+ *
+ * Nothing here reads the clock. Every time is Rekor's `integratedTime`, which
+ * its signature covers, so a verification that passes once passes forever,
+ * whatever the client's clock says.
+ */
+import { type Certificate } from './x509.js';
+/** Who must have signed: the certificate's SAN URI and its OIDC issuer, each matched exactly. */
+export interface SignerIdentity {
+    identity: string;
+    issuer: string;
+}
+/**
+ * Verify a cosign keyless `bundle` over `body`, signed by `signer`. Resolves
+ * with the time Rekor logged it (seconds); rejects with the reason otherwise.
+ * `signature`, when given, is the detached `.sig` published beside the file,
+ * and must be the bundle's.
+ */
+export declare function verifyCosignBundle(body: Uint8Array, bundle: unknown, signer: SignerIdentity, signature?: string): Promise<{
+    integratedTime: number;
+}>;
+/**
+ * Check that `leaf` was issued by a Fulcio CA in the trust root, and that it,
+ * the CA's certificates and the CA itself (by the trust root's `validFor`)
+ * were all valid at `at` (milliseconds): when Rekor logged the signature, not
+ * now, since a Fulcio certificate lives ten minutes. Every signature on the
+ * way is checked, with the algorithm its certificate names.
+ */
+export declare function chainsToFulcio(leaf: Certificate, at: number): Promise<void>;

package/dist/sealed/sigstore.js

@@ -0,0 +1,207 @@
+/**
+ * Verifying a cosign keyless signature, as `cosign verify-blob --bundle` does,
+ * with WebCrypto and the Sigstore trust root embedded in this package.
+ *
+ * mero-tee signs each release asset with cosign keyless: there is no release
+ * key, only a Fulcio certificate that lives ten minutes, issued to one GitHub
+ * Actions workflow run, and a Rekor log entry that proves the signature was
+ * made while the certificate was valid. So the checks are: the signature over
+ * the bytes verifies with the certificate's key; Rekor's signed entry
+ * timestamp verifies, and the entry it signs is this signature over these
+ * bytes by this certificate; the certificate chains to a Fulcio CA and was
+ * valid when Rekor logged it; and the certificate names the workflow expected.
+ * The same checks core runs in `crates/tee-release/src/sigstore_verify.rs`.
+ *
+ * Nothing here reads the clock. Every time is Rekor's `integratedTime`, which
+ * its signature covers, so a verification that passes once passes forever,
+ * whatever the client's clock says.
+ */
+import { hex } from '../crypto/internal.js';
+import { FULCIO_AUTHORITIES, REKOR_LOGS } from './sigstore-trust-root.js';
+import { children, contents, expectTag, fromBase64, objectIdentifiers, parseCertificate, parseDer, pemCertificate, verifyEcdsa, } from './x509.js';
+const SUBJECT_ALT_NAME = '2.5.29.17';
+const EXTENDED_KEY_USAGE = '2.5.29.37';
+const CODE_SIGNING = '1.3.6.1.5.5.7.3.3';
+/** Fulcio's OIDC issuer extension, a DER UTF8String. */
+const FULCIO_ISSUER_V2 = '1.3.6.1.4.1.57264.1.8';
+/** Its deprecated predecessor, the raw issuer bytes; read only when the other is absent. */
+const FULCIO_ISSUER_V1 = '1.3.6.1.4.1.57264.1.1';
+const SAN_URI = 0x86;
+const UTF8_STRING = 0x0c;
+const SEQUENCE = 0x30;
+const utf8 = new TextEncoder();
+// Not `fatal`: not every runtime's TextDecoder takes options. A malformed byte
+// decodes to U+FFFD, which no pinned identity holds, so it can only fail a match.
+const fromUtf8 = (bytes) => new TextDecoder().decode(bytes);
+/**
+ * Verify a cosign keyless `bundle` over `body`, signed by `signer`. Resolves
+ * with the time Rekor logged it (seconds); rejects with the reason otherwise.
+ * `signature`, when given, is the detached `.sig` published beside the file,
+ * and must be the bundle's.
+ */
+export async function verifyCosignBundle(body, bundle, signer, signature) {
+    const { base64Signature, cert, rekorBundle } = cosignBundle(bundle);
+    const payload = rekorBundle.Payload;
+    if (signature !== undefined && signature.trim() !== base64Signature.trim()) {
+        throw new Error('The detached signature is not the one in the bundle');
+    }
+    const sig = fromBase64(base64Signature, 'The bundle signature');
+    const leafDer = pemCertificate(fromUtf8(fromBase64(cert, 'The bundle certificate')), 'The bundle certificate');
+    const leaf = parseCertificate(leafDer);
+    // Rekor vouches for the entry and its time: nothing below is trusted before this.
+    const log = REKOR_LOGS.find((candidate) => candidate.logId === payload.logID.toLowerCase());
+    if (!log)
+        throw new Error(`The bundle names Rekor log ${payload.logID}, which the Sigstore trust root does not know`);
+    const canonical = utf8.encode(`{"body":${JSON.stringify(payload.body)},"integratedTime":${payload.integratedTime},` +
+        `"logID":${JSON.stringify(payload.logID)},"logIndex":${payload.logIndex}}`);
+    const setVerifies = await verifyEcdsa(fromBase64(log.publicKey, 'The Rekor key'), 'P-256', 'SHA-256', fromBase64(rekorBundle.SignedEntryTimestamp, 'The signed entry timestamp'), canonical);
+    if (!setVerifies) {
+        throw new Error("Rekor's signed entry timestamp does not verify: the log entry, its time or its index was altered");
+    }
+    const at = payload.integratedTime * 1000;
+    if (!within(at, log.validFor)) {
+        throw new Error(`Rekor log ${log.baseUrl} was not in use at ${iso(at)}, when the entry says it was logged`);
+    }
+    // The entry Rekor signed is this signature, over these bytes, by this certificate.
+    const entry = hashedRekord(payload.body);
+    const digest = hex(new Uint8Array(await crypto.subtle.digest('SHA-256', body)));
+    if (entry.hash !== digest)
+        throw new Error("The file's SHA-256 is not the one Rekor logged: the file is not the one signed");
+    if (!equal(fromBase64(entry.signature, 'The logged signature'), sig)) {
+        throw new Error("The bundle's signature is not the one Rekor logged");
+    }
+    const loggedCert = pemCertificate(fromUtf8(fromBase64(entry.publicKey, 'The logged certificate')), 'The logged certificate');
+    if (!equal(loggedCert, leafDer))
+        throw new Error("The bundle's certificate is not the one Rekor logged");
+    if (leaf.curve !== 'P-256' || !(await verifyEcdsa(leaf.spki, 'P-256', 'SHA-256', sig, body))) {
+        throw new Error("The signature over the file does not verify with the bundle's certificate");
+    }
+    await chainsToFulcio(leaf, at);
+    checkSigner(leaf, signer);
+    return { integratedTime: payload.integratedTime };
+}
+/**
+ * Check that `leaf` was issued by a Fulcio CA in the trust root, and that it,
+ * the CA's certificates and the CA itself (by the trust root's `validFor`)
+ * were all valid at `at` (milliseconds): when Rekor logged the signature, not
+ * now, since a Fulcio certificate lives ten minutes. Every signature on the
+ * way is checked, with the algorithm its certificate names.
+ */
+export async function chainsToFulcio(leaf, at) {
+    if (!validAt(leaf, at)) {
+        throw new Error(`The signing certificate was valid ${iso(leaf.notBefore)} to ${iso(leaf.notAfter)}, not at ${iso(at)} when Rekor logged it`);
+    }
+    const reasons = [];
+    for (const authority of FULCIO_AUTHORITIES) {
+        const chain = authority.certChain.map((der) => parseCertificate(fromBase64(der, 'A Fulcio certificate')));
+        if (!(await issuedBy(leaf, chain[0])))
+            continue;
+        // The issuer is found; from here a failure is this CA's, so say which.
+        const reason = await authorityRefusal(chain, authority.validFor, at);
+        if (!reason)
+            return;
+        reasons.push(`${authority.uri} (valid from ${authority.validFor.start}): ${reason}`);
+    }
+    throw new Error(reasons.length > 0
+        ? `The signing certificate's CA is not trusted at ${iso(at)}: ${reasons.join('; ')}`
+        : 'The signing certificate was not issued by a Fulcio CA in the Sigstore trust root');
+}
+async function authorityRefusal(chain, validFor, at) {
+    if (!within(at, validFor))
+        return 'the trust root says it was not issuing certificates then';
+    for (const [index, certificate] of chain.entries()) {
+        if (!validAt(certificate, at))
+            return `its certificate ${index} was not valid then`;
+        const parent = chain[index + 1] ?? certificate; // the root signs itself
+        if (!(await issuedBy(certificate, parent)))
+            return `its certificate ${index} is not signed by the next`;
+    }
+    return undefined;
+}
+async function issuedBy(child, parent) {
+    if (!equal(child.issuer, parent.subject))
+        return false;
+    return verifyEcdsa(parent.spki, parent.curve, child.signatureHash, child.signature, child.tbs);
+}
+function checkSigner(leaf, signer) {
+    const san = leaf.extensions.get(SUBJECT_ALT_NAME);
+    if (!san)
+        throw new Error('The signing certificate names no identity');
+    const names = children(expectTag(parseDer(san), SEQUENCE, 'The subject alternative name'));
+    const uris = names.filter((name) => name.tag === SAN_URI).map((name) => fromUtf8(contents(name)));
+    if (uris.length !== 1 || names.length !== 1 || uris[0] !== signer.identity) {
+        throw new Error(`The release was signed by ${JSON.stringify(uris.length === 1 ? uris[0] : uris)}, not by ${signer.identity}`);
+    }
+    const v2 = leaf.extensions.get(FULCIO_ISSUER_V2);
+    const v1 = leaf.extensions.get(FULCIO_ISSUER_V1);
+    const issuer = v2
+        ? fromUtf8(contents(expectTag(parseDer(v2), UTF8_STRING, 'The OIDC issuer')))
+        : v1
+            ? fromUtf8(v1)
+            : undefined;
+    if (issuer !== signer.issuer) {
+        throw new Error(`The signing certificate's OIDC issuer is ${issuer === undefined ? 'missing' : JSON.stringify(issuer)}, not ${signer.issuer}`);
+    }
+    const usage = leaf.extensions.get(EXTENDED_KEY_USAGE);
+    if (!usage || !objectIdentifiers(usage).includes(CODE_SIGNING)) {
+        throw new Error('The signing certificate is not for code signing');
+    }
+}
+function cosignBundle(value) {
+    let bundle = value;
+    if (typeof bundle === 'string') {
+        try {
+            bundle = JSON.parse(bundle);
+        }
+        catch {
+            throw new Error('The bundle is not JSON');
+        }
+    }
+    const b = bundle;
+    const p = b?.rekorBundle?.Payload;
+    const ok = typeof b?.base64Signature === 'string' &&
+        typeof b.cert === 'string' &&
+        typeof b.rekorBundle?.SignedEntryTimestamp === 'string' &&
+        typeof p?.body === 'string' &&
+        typeof p.logID === 'string' &&
+        /^[0-9a-fA-F]{64}$/.test(p.logID) &&
+        Number.isSafeInteger(p.integratedTime) &&
+        p.integratedTime >= 0 &&
+        Number.isSafeInteger(p.logIndex) &&
+        p.logIndex >= 0;
+    if (!ok)
+        throw new Error('The bundle is not a cosign bundle with a Rekor entry');
+    return b;
+}
+/** The fields of a logged `hashedrekord` entry that are compared. */
+function hashedRekord(body) {
+    let entry;
+    try {
+        entry = JSON.parse(fromUtf8(fromBase64(body, 'The logged entry')));
+    }
+    catch {
+        throw new Error('The logged entry is not JSON');
+    }
+    const hash = entry?.spec?.data?.hash;
+    const signature = entry?.spec?.signature;
+    if (entry?.kind !== 'hashedrekord' ||
+        hash?.algorithm !== 'sha256' ||
+        typeof hash.value !== 'string' ||
+        typeof signature?.content !== 'string' ||
+        typeof signature.publicKey?.content !== 'string') {
+        throw new Error('The logged entry is not a SHA-256 hashedrekord');
+    }
+    return { hash: hash.value.toLowerCase(), signature: signature.content, publicKey: signature.publicKey.content };
+}
+function validAt(certificate, at) {
+    return certificate.notBefore <= at && at <= certificate.notAfter;
+}
+function within(at, window) {
+    return Date.parse(window.start) <= at && (window.end === undefined || at <= Date.parse(window.end));
+}
+function iso(ms) {
+    return new Date(ms).toISOString();
+}
+function equal(a, b) {
+    return a.length === b.length && a.every((byte, index) => byte === b[index]);
+}

package/dist/sealed/x509.d.ts

@@ -0,0 +1,67 @@
+/**
+ * Just enough DER and X.509 to check a Sigstore signing certificate with
+ * WebCrypto: read a certificate's signed part, validity, key and extensions,
+ * and verify the ECDSA signatures (P-256 and P-384) Sigstore uses.
+ *
+ * Written here, rather than taken from a library, so the SDK keeps no runtime
+ * dependencies and runs wherever WebCrypto does. It parses strictly and throws
+ * on anything it does not expect; it is not a general X.509 implementation.
+ */
+export type Curve = 'P-256' | 'P-384';
+export type Hash = 'SHA-256' | 'SHA-384';
+/** One DER element: its tag, and where it and its contents lie in `bytes`. */
+export interface Element {
+    tag: number;
+    bytes: Uint8Array;
+    /** Offset of the element's first (tag) byte. */
+    offset: number;
+    /** Offset of its contents. */
+    start: number;
+    /** Offset just past it. */
+    end: number;
+}
+/** Parse one complete DER element, refusing trailing bytes. */
+export declare function parseDer(bytes: Uint8Array): Element;
+export declare function children(element: Element): Element[];
+/** `element` if it has `tag`; otherwise throws naming `what`. */
+export declare function expectTag(element: Element | undefined, tag: number, what: string): Element;
+export declare function contents(element: Element): Uint8Array;
+export interface Certificate {
+    der: Uint8Array;
+    /** The signed part, exactly as the issuer signed it. */
+    tbs: Uint8Array;
+    /** The hash of the ECDSA signature the issuer made over `tbs`. */
+    signatureHash: Hash;
+    /** That signature, DER. */
+    signature: Uint8Array;
+    /** The issuer and subject names, DER, to compare byte for byte. */
+    issuer: Uint8Array;
+    subject: Uint8Array;
+    /** Validity, in milliseconds since the epoch, both ends inclusive. */
+    notBefore: number;
+    notAfter: number;
+    /** The subject's key, DER SubjectPublicKeyInfo, and its curve. */
+    spki: Uint8Array;
+    curve: Curve;
+    /** Each extension's value (the contents of its OCTET STRING), by object identifier. */
+    extensions: Map<string, Uint8Array>;
+}
+/**
+ * Parse a DER X.509 certificate with an ECDSA key, signed with ECDSA. Throws
+ * naming what is wrong.
+ */
+export declare function parseCertificate(der: Uint8Array): Certificate;
+/** The object identifiers in a DER `SEQUENCE OF OBJECT IDENTIFIER` (an extended key usage). */
+export declare function objectIdentifiers(der: Uint8Array): string[];
+/**
+ * An ECDSA signature as WebCrypto takes it (IEEE P1363: `r || s`, each the
+ * curve's size), from the DER `SEQUENCE { r INTEGER, s INTEGER }` X.509 and
+ * cosign use.
+ */
+export declare function ecdsaSignatureToP1363(der: Uint8Array, curve: Curve): Uint8Array;
+/** Verify a DER ECDSA `signature` over `data` with a DER SubjectPublicKeyInfo key. */
+export declare function verifyEcdsa(spki: Uint8Array, curve: Curve, hash: Hash, signature: Uint8Array, data: Uint8Array): Promise<boolean>;
+/** Decode base64 (standard alphabet), refusing anything else. */
+export declare function fromBase64(value: string, what: string): Uint8Array;
+/** The DER of the one `CERTIFICATE` block a PEM holds. */
+export declare function pemCertificate(pem: string, what: string): Uint8Array;

package/dist/sealed/x509.js

@@ -0,0 +1,240 @@
+/**
+ * Just enough DER and X.509 to check a Sigstore signing certificate with
+ * WebCrypto: read a certificate's signed part, validity, key and extensions,
+ * and verify the ECDSA signatures (P-256 and P-384) Sigstore uses.
+ *
+ * Written here, rather than taken from a library, so the SDK keeps no runtime
+ * dependencies and runs wherever WebCrypto does. It parses strictly and throws
+ * on anything it does not expect; it is not a general X.509 implementation.
+ */
+const SEQUENCE = 0x30;
+const OID = 0x06;
+const INTEGER = 0x02;
+const BIT_STRING = 0x03;
+const OCTET_STRING = 0x04;
+const BOOLEAN = 0x01;
+const UTC_TIME = 0x17;
+const GENERALIZED_TIME = 0x18;
+const CONTEXT_0 = 0xa0;
+const CONTEXT_3 = 0xa3;
+const EC_PUBLIC_KEY = '1.2.840.10045.2.1';
+const CURVES = {
+    '1.2.840.10045.3.1.7': 'P-256',
+    '1.3.132.0.34': 'P-384',
+};
+const CURVE_SIZE = { 'P-256': 32, 'P-384': 48 };
+/** The certificate signature algorithms accepted: ECDSA with SHA-256 or SHA-384. */
+const SIGNATURE_HASHES = {
+    '1.2.840.10045.4.3.2': 'SHA-256',
+    '1.2.840.10045.4.3.3': 'SHA-384',
+};
+function read(bytes, offset, limit) {
+    if (offset + 2 > limit)
+        throw new Error('it is truncated');
+    const tag = bytes[offset];
+    if ((tag & 0x1f) === 0x1f)
+        throw new Error('it uses a tag this parser does not read');
+    let length = bytes[offset + 1];
+    let start = offset + 2;
+    if (length & 0x80) {
+        const count = length & 0x7f;
+        if (count === 0 || count > 4 || start + count > limit)
+            throw new Error('it has a length this parser does not read');
+        length = 0;
+        for (let i = 0; i < count; i += 1)
+            length = length * 256 + bytes[start + i];
+        start += count;
+    }
+    const end = start + length;
+    if (end > limit)
+        throw new Error('it is truncated');
+    return { tag, bytes, offset, start, end };
+}
+/** Parse one complete DER element, refusing trailing bytes. */
+export function parseDer(bytes) {
+    const element = read(bytes, 0, bytes.length);
+    if (element.end !== bytes.length)
+        throw new Error('it has trailing bytes');
+    return element;
+}
+export function children(element) {
+    const out = [];
+    for (let offset = element.start; offset < element.end;) {
+        const child = read(element.bytes, offset, element.end);
+        out.push(child);
+        offset = child.end;
+    }
+    return out;
+}
+/** `element` if it has `tag`; otherwise throws naming `what`. */
+export function expectTag(element, tag, what) {
+    if (!element || element.tag !== tag)
+        throw new Error(`${what} is not where it should be`);
+    return element;
+}
+export function contents(element) {
+    return element.bytes.slice(element.start, element.end);
+}
+/** The whole element, header included. */
+function whole(element) {
+    return element.bytes.slice(element.offset, element.end);
+}
+function oid(element) {
+    const value = contents(expectTag(element, OID, 'An object identifier'));
+    if (value.length === 0 || value[value.length - 1] & 0x80)
+        throw new Error('it has a malformed object identifier');
+    const arcs = [];
+    let arc = 0;
+    for (const byte of value) {
+        arc = arc * 128 + (byte & 0x7f);
+        if (!(byte & 0x80)) {
+            arcs.push(arc);
+            arc = 0;
+        }
+    }
+    const first = arcs.shift();
+    const head = first < 80 ? [Math.floor(first / 40), first % 40] : [2, first - 80];
+    return [...head, ...arcs].join('.');
+}
+function time(element) {
+    const text = new TextDecoder().decode(contents(element));
+    const utc = element.tag === UTC_TIME ? /^(\d{2})(\d{2})(\d{2})(\d{2})(\d{2})(\d{2})Z$/.exec(text) : null;
+    const generalized = element.tag === GENERALIZED_TIME ? /^(\d{4})(\d{2})(\d{2})(\d{2})(\d{2})(\d{2})Z$/.exec(text) : null;
+    const parts = utc ?? generalized;
+    if (!parts)
+        throw new Error(`it holds the time ${JSON.stringify(text)}, which is not one a certificate may hold`);
+    let year = Number(parts[1]);
+    if (utc)
+        year += year < 50 ? 2000 : 1900;
+    const [month, day, hour, minute, second] = parts.slice(2).map(Number);
+    return Date.UTC(year, month - 1, day, hour, minute, second);
+}
+/**
+ * Parse a DER X.509 certificate with an ECDSA key, signed with ECDSA. Throws
+ * naming what is wrong.
+ */
+export function parseCertificate(der) {
+    try {
+        const [tbsElement, algorithm, signature, ...rest] = children(expectTag(parseDer(der), SEQUENCE, 'The certificate'));
+        if (rest.length > 0)
+            throw new Error('it has fields after its signature');
+        const fields = children(expectTag(tbsElement, SEQUENCE, 'The signed part'));
+        // `version` is [0] EXPLICIT; everything after it is positional.
+        const first = fields[0]?.tag === CONTEXT_0 ? 1 : 0;
+        const [serial, innerAlgorithm, issuer, validity, subject, spki, ...optional] = fields.slice(first);
+        expectTag(serial, INTEGER, 'The serial number');
+        const algorithmId = oid(children(expectTag(algorithm, SEQUENCE, 'The signature algorithm'))[0]);
+        const innerId = oid(children(expectTag(innerAlgorithm, SEQUENCE, 'The signature algorithm'))[0]);
+        if (innerId !== algorithmId)
+            throw new Error('it names two different signature algorithms');
+        const signatureHash = SIGNATURE_HASHES[algorithmId];
+        if (!signatureHash)
+            throw new Error(`it is signed with ${algorithmId}, not ECDSA with SHA-256 or SHA-384`);
+        const [notBefore, notAfter] = children(expectTag(validity, SEQUENCE, 'The validity')).map(time);
+        if (notAfter === undefined)
+            throw new Error('its validity is incomplete');
+        const [keyAlgorithm, keyBits] = children(expectTag(spki, SEQUENCE, 'The public key'));
+        expectTag(keyBits, BIT_STRING, 'The public key');
+        const [keyType, keyCurve] = children(expectTag(keyAlgorithm, SEQUENCE, 'The key algorithm'));
+        if (oid(keyType) !== EC_PUBLIC_KEY)
+            throw new Error('its key is not an elliptic-curve key');
+        const curve = CURVES[oid(keyCurve)];
+        if (!curve)
+            throw new Error('its key is on a curve other than P-256 or P-384');
+        const extensions = new Map();
+        const extensionsField = optional.find((field) => field.tag === CONTEXT_3);
+        if (extensionsField) {
+            const [list] = children(extensionsField);
+            for (const extension of children(expectTag(list, SEQUENCE, 'The extensions'))) {
+                const parts = children(expectTag(extension, SEQUENCE, 'An extension'));
+                if (parts.length === 3)
+                    expectTag(parts[1], BOOLEAN, 'An extension\'s critical flag');
+                else if (parts.length !== 2)
+                    throw new Error('it has a malformed extension');
+                const id = oid(parts[0]);
+                if (extensions.has(id))
+                    throw new Error(`it has extension ${id} twice`);
+                extensions.set(id, contents(expectTag(parts[parts.length - 1], OCTET_STRING, 'An extension value')));
+            }
+        }
+        const signatureBits = contents(expectTag(signature, BIT_STRING, 'The signature'));
+        if (signatureBits[0] !== 0)
+            throw new Error('its signature is not a whole number of bytes');
+        return {
+            der,
+            tbs: whole(tbsElement),
+            signatureHash,
+            signature: signatureBits.slice(1),
+            issuer: whole(expectTag(issuer, SEQUENCE, 'The issuer')),
+            subject: whole(expectTag(subject, SEQUENCE, 'The subject')),
+            notBefore,
+            notAfter,
+            spki: whole(spki),
+            curve,
+            extensions,
+        };
+    }
+    catch (error) {
+        throw new Error(`The certificate is malformed: ${error.message}`);
+    }
+}
+/** The object identifiers in a DER `SEQUENCE OF OBJECT IDENTIFIER` (an extended key usage). */
+export function objectIdentifiers(der) {
+    return children(expectTag(parseDer(der), SEQUENCE, 'The list')).map(oid);
+}
+/**
+ * An ECDSA signature as WebCrypto takes it (IEEE P1363: `r || s`, each the
+ * curve's size), from the DER `SEQUENCE { r INTEGER, s INTEGER }` X.509 and
+ * cosign use.
+ */
+export function ecdsaSignatureToP1363(der, curve) {
+    const size = CURVE_SIZE[curve];
+    const integers = children(expectTag(parseDer(der), SEQUENCE, 'The signature'));
+    if (integers.length !== 2)
+        throw new Error('The signature is not an ECDSA signature');
+    const out = new Uint8Array(size * 2);
+    integers.forEach((integer, index) => {
+        let value = contents(expectTag(integer, INTEGER, 'The signature'));
+        // r and s are positive: a set top bit with no leading zero is a negative number.
+        if (value.length === 0 || value[0] & 0x80)
+            throw new Error('The signature is not an ECDSA signature');
+        while (value.length > 1 && value[0] === 0)
+            value = value.subarray(1);
+        if (value.length > size)
+            throw new Error('The signature is not an ECDSA signature');
+        out.set(value, index * size + size - value.length);
+    });
+    return out;
+}
+/** Verify a DER ECDSA `signature` over `data` with a DER SubjectPublicKeyInfo key. */
+export async function verifyEcdsa(spki, curve, hash, signature, data) {
+    let p1363;
+    try {
+        p1363 = ecdsaSignatureToP1363(signature, curve);
+    }
+    catch {
+        return false;
+    }
+    const key = await crypto.subtle.importKey('spki', spki, { name: 'ECDSA', namedCurve: curve }, false, ['verify']);
+    return crypto.subtle.verify({ name: 'ECDSA', hash }, key, p1363, data);
+}
+/** Decode base64 (standard alphabet), refusing anything else. */
+export function fromBase64(value, what) {
+    const clean = value.replace(/\s+/g, '');
+    if (!/^[A-Za-z0-9+/]*={0,2}$/.test(clean) || clean.length % 4 !== 0) {
+        throw new Error(`${what} is not base64`);
+    }
+    const binary = atob(clean);
+    const bytes = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i += 1)
+        bytes[i] = binary.charCodeAt(i);
+    return bytes;
+}
+/** The DER of the one `CERTIFICATE` block a PEM holds. */
+export function pemCertificate(pem, what) {
+    const blocks = [...pem.matchAll(/-----BEGIN CERTIFICATE-----([^-]*)-----END CERTIFICATE-----/g)];
+    if (blocks.length !== 1 || pem.replace(blocks[0][0], '').trim() !== '') {
+        throw new Error(`${what} is not exactly one PEM certificate`);
+    }
+    return fromBase64(blocks[0][1], what);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@calimero-network/mero-js",
-  "version": "21.3.0",
+  "version": "21.4.0",
   "description": "Pure JavaScript SDK for Calimero",
   "type": "module",
   "exports": {