@freedomofpress/sigstore-browser 0.1.0

package/.github/workflows/conformance.yml

@@ -0,0 +1,29 @@
+# .github/workflows/conformance.yml
+name: sigstore-conformance
+
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+  workflow_dispatch:
+  workflow_call:
+
+jobs:
+  conformance:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+
+      - run: npm ci
+      - run: npm run build
+      - run: chmod +x dist/cli.js
+
+      - uses: sigstore/sigstore-conformance@v0.0.21
+        with:
+          entrypoint: dist/cli.js
+          skip-signing: true

package/.github/workflows/publish.yml

@@ -0,0 +1,45 @@
+# .github/workflows/publish.yml
+name: publish
+
+on:
+  push:
+    tags:
+      - "v*.*.*"
+
+jobs:
+  run-conformance:
+    uses: ./.github/workflows/conformance.yml
+
+  publish:
+    needs: run-conformance
+    runs-on: ubuntu-latest
+
+    if: startsWith(github.ref, 'refs/tags/v')
+
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          registry-url: "https://registry.npmjs.org"
+
+      - run: npm ci
+      - run: npm run build
+
+      - name: Dry-run publish
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+        run: npm publish --dry-run
+
+      - name: Publish to npm
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+        run: npm publish --access public
+
+

package/README.md

@@ -0,0 +1,10 @@
+# Minimal Browser-Compatible Implementation of a Sgistore verifier 
+
+[![Conformance](https://github.com/freedomofpress/sigstore-browser/actions/workflows/conformance.yml/badge.svg)](https://github.com/freedomofpress/sigstore-browser/actions/workflows/conformance.yml)
+
+A minimal TypeScript implementation of [Sigstore](https://sigstore.dev/) specification for verification, optimized for browser compatibility.
+
+This is a lightweight alternative to [sigstore-js](github.com/sigstore/sigstore-js) that focuses on verification functionality needed for secure software updates in browser environments.
+
+> [!CAUTION]  
+> This library has not received an independent security audit. Maintenance is performed by volunteers, and the project is not officially supported or endorsed by the Freedom of the Press Foundation.

package/dist/asn1/error.d.ts

@@ -0,0 +1,5 @@
+export declare class ASN1ParseError extends Error {
+}
+export declare class ASN1TypeError extends Error {
+}
+//# sourceMappingURL=error.d.ts.map

package/dist/asn1/error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"error.d.ts","sourceRoot":"","sources":["../../src/asn1/error.ts"],"names":[],"mappings":"AAeA,qBAAa,cAAe,SAAQ,KAAK;CAAG;AAE5C,qBAAa,aAAc,SAAQ,KAAK;CAAG"}

package/dist/asn1/error.js

@@ -0,0 +1,20 @@
+/*
+Copyright 2023 The Sigstore Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+export class ASN1ParseError extends Error {
+}
+export class ASN1TypeError extends Error {
+}
+//# sourceMappingURL=error.js.map

package/dist/asn1/error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"error.js","sourceRoot":"","sources":["../../src/asn1/error.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;EAcE;AACF,MAAM,OAAO,cAAe,SAAQ,KAAK;CAAG;AAE5C,MAAM,OAAO,aAAc,SAAQ,KAAK;CAAG"}

package/dist/asn1/index.d.ts

@@ -0,0 +1,2 @@
+export { ASN1Obj } from "./obj.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/asn1/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/asn1/index.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC"}

package/dist/asn1/index.js

@@ -0,0 +1,17 @@
+/*
+Copyright 2023 The Sigstore Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+export { ASN1Obj } from "./obj.js";
+//# sourceMappingURL=index.js.map

package/dist/asn1/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/asn1/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;EAcE;AACF,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC"}

package/dist/asn1/length.d.ts

@@ -0,0 +1,4 @@
+import { ByteStream } from "../stream.js";
+export declare function decodeLength(stream: ByteStream): number;
+export declare function encodeLength(len: number): Uint8Array;
+//# sourceMappingURL=length.d.ts.map

package/dist/asn1/length.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"length.d.ts","sourceRoot":"","sources":["../../src/asn1/length.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAK1C,wBAAgB,YAAY,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,CA8BvD;AAGD,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAgBpD"}

package/dist/asn1/length.js

@@ -0,0 +1,59 @@
+/*
+Copyright 2023 The Sigstore Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+import { ASN1ParseError } from "./error.js";
+// Decodes the length of a DER-encoded ANS.1 element from the supplied stream.
+// https://learn.microsoft.com/en-us/windows/win32/seccertenroll/about-encoded-length-and-value-bytes
+export function decodeLength(stream) {
+    const buf = stream.getUint8();
+    // If the most significant bit is UNSET the length is just the value of the
+    // byte.
+    if ((buf & 0x80) === 0x00) {
+        return buf;
+    }
+    // Otherwise, the lower 7 bits of the first byte indicate the number of bytes
+    // that follow to encode the length.
+    const byteCount = buf & 0x7f;
+    // Ensure the encoded length can safely fit in a JS number.
+    if (byteCount > 6) {
+        throw new ASN1ParseError("length exceeds 6 byte limit");
+    }
+    // Iterate over the bytes that encode the length.
+    let len = 0;
+    for (let i = 0; i < byteCount; i++) {
+        len = len * 256 + stream.getUint8();
+    }
+    // This is a valid ASN.1 length encoding, but we don't support it.
+    if (len === 0) {
+        throw new ASN1ParseError("indefinite length encoding not supported");
+    }
+    return len;
+}
+// Translates the supplied value to a DER-encoded length.
+export function encodeLength(len) {
+    if (len < 128) {
+        return new Uint8Array([len]);
+    }
+    // Bitwise operations on large numbers are not supported in JS, so we need to
+    // use BigInts.
+    let val = BigInt(len);
+    const bytes = [];
+    while (val > 0n) {
+        bytes.unshift(Number(val & 255n));
+        val = val >> 8n;
+    }
+    return new Uint8Array([0x80 | bytes.length, ...bytes]);
+}
+//# sourceMappingURL=length.js.map

package/dist/asn1/length.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"length.js","sourceRoot":"","sources":["../../src/asn1/length.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;EAcE;AAGF,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE5C,8EAA8E;AAC9E,qGAAqG;AACrG,MAAM,UAAU,YAAY,CAAC,MAAkB;IAC7C,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;IAE9B,2EAA2E;IAC3E,QAAQ;IACR,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;QAC1B,OAAO,GAAG,CAAC;IACb,CAAC;IAED,6EAA6E;IAC7E,oCAAoC;IACpC,MAAM,SAAS,GAAG,GAAG,GAAG,IAAI,CAAC;IAE7B,2DAA2D;IAC3D,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;QAClB,MAAM,IAAI,cAAc,CAAC,6BAA6B,CAAC,CAAC;IAC1D,CAAC;IAED,iDAAiD;IACjD,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC;QACnC,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;IACtC,CAAC;IAED,kEAAkE;IAClE,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC;QACd,MAAM,IAAI,cAAc,CAAC,0CAA0C,CAAC,CAAC;IACvE,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,IAAI,GAAG,GAAG,GAAG,EAAE,CAAC;QACd,OAAO,IAAI,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,CAAC;IAED,6EAA6E;IAC7E,eAAe;IACf,IAAI,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACtB,MAAM,KAAK,GAAG,EAAE,CAAC;IAEjB,OAAO,GAAG,GAAG,EAAE,EAAE,CAAC;QAChB,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC;QAClC,GAAG,GAAG,GAAG,IAAI,EAAE,CAAC;IAClB,CAAC;IAED,OAAO,IAAI,UAAU,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC;AACzD,CAAC"}

package/dist/asn1/obj.d.ts

@@ -0,0 +1,15 @@
+import { ASN1Tag } from "./tag.js";
+export declare class ASN1Obj {
+    readonly tag: ASN1Tag;
+    readonly subs: ASN1Obj[];
+    readonly value: Uint8Array;
+    constructor(tag: ASN1Tag, value: Uint8Array, subs: ASN1Obj[]);
+    static parseBuffer(buf: Uint8Array): ASN1Obj;
+    toDER(): Uint8Array;
+    toBoolean(): boolean;
+    toInteger(): bigint;
+    toOID(): string;
+    toDate(): Date;
+    toBitString(): number[];
+}
+//# sourceMappingURL=obj.d.ts.map

package/dist/asn1/obj.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"obj.d.ts","sourceRoot":"","sources":["../../src/asn1/obj.ts"],"names":[],"mappings":"AA0BA,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AAEnC,qBAAa,OAAO;IAClB,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;gBAEf,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE;WAO9C,WAAW,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO;IAI5C,KAAK,IAAI,UAAU;IA2BnB,SAAS,IAAI,OAAO;IAUpB,SAAS,IAAI,MAAM;IAUnB,KAAK,IAAI,MAAM;IAUf,MAAM,IAAI,IAAI;IAcd,WAAW,IAAI,MAAM,EAAE;CAO/B"}

package/dist/asn1/obj.js

@@ -0,0 +1,153 @@
+/*
+Copyright 2023 The Sigstore Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+import { toArrayBuffer } from "../encoding.js";
+import { ByteStream } from "../stream.js";
+import { ASN1ParseError, ASN1TypeError } from "./error.js";
+import { decodeLength, encodeLength } from "./length.js";
+import { parseBitString, parseBoolean, parseInteger, parseOID, parseTime, } from "./parse.js";
+import { ASN1Tag } from "./tag.js";
+export class ASN1Obj {
+    tag;
+    subs;
+    value;
+    constructor(tag, value, subs) {
+        this.tag = tag;
+        this.value = value;
+        this.subs = subs;
+    }
+    // Constructs an ASN.1 object from a Buffer of DER-encoded bytes.
+    static parseBuffer(buf) {
+        return parseStream(new ByteStream(toArrayBuffer(buf)));
+    }
+    toDER() {
+        const valueStream = new ByteStream();
+        if (this.subs.length > 0) {
+            for (const sub of this.subs) {
+                valueStream.appendView(sub.toDER());
+            }
+        }
+        else {
+            valueStream.appendView(this.value);
+        }
+        const value = valueStream.buffer;
+        // Concat tag/length/value
+        const obj = new ByteStream();
+        obj.appendChar(this.tag.toDER());
+        obj.appendView(encodeLength(value.length));
+        obj.appendView(value);
+        return obj.buffer;
+    }
+    /////////////////////////////////////////////////////////////////////////////
+    // Convenience methods for parsing ASN.1 primitives into JS types
+    // Returns the ASN.1 object's value as a boolean. Throws an error if the
+    // object is not a boolean.
+    toBoolean() {
+        if (!this.tag.isBoolean()) {
+            throw new ASN1TypeError("not a boolean");
+        }
+        return parseBoolean(this.value);
+    }
+    // Returns the ASN.1 object's value as a BigInt. Throws an error if the
+    // object is not an integer.
+    toInteger() {
+        if (!this.tag.isInteger()) {
+            throw new ASN1TypeError("not an integer");
+        }
+        return parseInteger(this.value);
+    }
+    // Returns the ASN.1 object's value as an OID string. Throws an error if the
+    // object is not an OID.
+    toOID() {
+        if (!this.tag.isOID()) {
+            throw new ASN1TypeError("not an OID");
+        }
+        return parseOID(this.value);
+    }
+    // Returns the ASN.1 object's value as a Date. Throws an error if the object
+    // is not either a UTCTime or a GeneralizedTime.
+    toDate() {
+        switch (true) {
+            case this.tag.isUTCTime():
+                return parseTime(this.value, true);
+            case this.tag.isGeneralizedTime():
+                return parseTime(this.value, false);
+            default:
+                throw new ASN1TypeError("not a date");
+        }
+    }
+    // Returns the ASN.1 object's value as a number[] where each number is the
+    // value of a bit in the bit string. Throws an error if the object is not a
+    // bit string.
+    toBitString() {
+        if (!this.tag.isBitString()) {
+            throw new ASN1TypeError("not a bit string");
+        }
+        return parseBitString(this.value);
+    }
+}
+/////////////////////////////////////////////////////////////////////////////
+// Internal stream parsing functions
+function parseStream(stream) {
+    // Parse tag, length, and value from stream
+    const tag = new ASN1Tag(stream.getUint8());
+    const len = decodeLength(stream);
+    const value = stream.slice(stream.position, len);
+    const start = stream.position;
+    let subs = [];
+    // If the object is constructed, parse its children. Sometimes, children
+    // are embedded in OCTESTRING objects, so we need to check those
+    // for children as well.
+    if (tag.constructed) {
+        subs = collectSubs(stream, len);
+    }
+    else if (tag.isOctetString()) {
+        // Attempt to parse children of OCTETSTRING objects. If anything fails,
+        // assume the object is not constructed and treat as primitive.
+        try {
+            subs = collectSubs(stream, len);
+        }
+        catch {
+            // Fail silently and treat as primitive
+        }
+    }
+    // If there are no children, move stream cursor to the end of the object
+    if (subs.length === 0) {
+        stream.seek(start + len);
+    }
+    return new ASN1Obj(tag, value, subs);
+}
+function collectSubs(stream, len) {
+    // Calculate end of object content
+    const end = stream.position + len;
+    // Make sure there are enough bytes left in the stream. This should never
+    // happen, cause it'll get caught when the stream is sliced in parseStream.
+    // Leaving as an extra check just in case.
+    /* istanbul ignore if */
+    if (end > stream.length) {
+        throw new ASN1ParseError("invalid length");
+    }
+    // Parse all children
+    const subs = [];
+    while (stream.position < end) {
+        subs.push(parseStream(stream));
+    }
+    // When we're done parsing children, we should be at the end of the object
+    if (stream.position !== end) {
+        throw new ASN1ParseError("invalid length");
+    }
+    return subs;
+}
+//# sourceMappingURL=obj.js.map

package/dist/asn1/obj.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"obj.js","sourceRoot":"","sources":["../../src/asn1/obj.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;EAcE;AACF,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EACL,cAAc,EACd,YAAY,EACZ,YAAY,EACZ,QAAQ,EACR,SAAS,GACV,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AAEnC,MAAM,OAAO,OAAO;IACT,GAAG,CAAU;IACb,IAAI,CAAY;IAChB,KAAK,CAAa;IAE3B,YAAY,GAAY,EAAE,KAAiB,EAAE,IAAe;QAC1D,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,iEAAiE;IAC1D,MAAM,CAAC,WAAW,CAAC,GAAe;QACvC,OAAO,WAAW,CAAC,IAAI,UAAU,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACzD,CAAC;IAEM,KAAK;QACV,MAAM,WAAW,GAAG,IAAI,UAAU,EAAE,CAAC;QAErC,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;gBAC5B,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;YACtC,CAAC;QACH,CAAC;aAAM,CAAC;YACN,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrC,CAAC;QAED,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC;QAEjC,0BAA0B;QAC1B,MAAM,GAAG,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;QACjC,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;QAC3C,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAEtB,OAAO,GAAG,CAAC,MAAM,CAAC;IACpB,CAAC;IAED,6EAA6E;IAC7E,iEAAiE;IAEjE,wEAAwE;IACxE,2BAA2B;IACpB,SAAS;QACd,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,CAAC;YAC1B,MAAM,IAAI,aAAa,CAAC,eAAe,CAAC,CAAC;QAC3C,CAAC;QAED,OAAO,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClC,CAAC;IAED,uEAAuE;IACvE,4BAA4B;IACrB,SAAS;QACd,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,CAAC;YAC1B,MAAM,IAAI,aAAa,CAAC,gBAAgB,CAAC,CAAC;QAC5C,CAAC;QAED,OAAO,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClC,CAAC;IAED,4EAA4E;IAC5E,wBAAwB;IACjB,KAAK;QACV,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC;YACtB,MAAM,IAAI,aAAa,CAAC,YAAY,CAAC,CAAC;QACxC,CAAC;QAED,OAAO,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC;IAED,4EAA4E;IAC5E,gDAAgD;IACzC,MAAM;QACX,QAAQ,IAAI,EAAE,CAAC;YACb,KAAK,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE;gBACvB,OAAO,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YACrC,KAAK,IAAI,CAAC,GAAG,CAAC,iBAAiB,EAAE;gBAC/B,OAAO,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YACtC;gBACE,MAAM,IAAI,aAAa,CAAC,YAAY,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,2EAA2E;IAC3E,cAAc;IACP,WAAW;QAChB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC;YAC5B,MAAM,IAAI,aAAa,CAAC,kBAAkB,CAAC,CAAC;QAC9C,CAAC;QAED,OAAO,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;CACF;AAED,6EAA6E;AAC7E,oCAAoC;AAEpC,SAAS,WAAW,CAAC,MAAkB;IACrC,2CAA2C;IAC3C,MAAM,GAAG,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC3C,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACjC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAEjD,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC;IAE9B,IAAI,IAAI,GAAc,EAAE,CAAC;IACzB,wEAAwE;IACxE,gEAAgE;IAChE,wBAAwB;IACxB,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;QACpB,IAAI,GAAG,WAAW,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAClC,CAAC;SAAM,IAAI,GAAG,CAAC,aAAa,EAAE,EAAE,CAAC;QAC/B,uEAAuE;QACvE,+DAA+D;QAC/D,IAAI,CAAC;YACH,IAAI,GAAG,WAAW,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,uCAAuC;QACzC,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,CAAC,IAAI,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC;IAC3B,CAAC;IAED,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;AACvC,CAAC;AAED,SAAS,WAAW,CAAC,MAAkB,EAAE,GAAW;IAClD,kCAAkC;IAClC,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,GAAG,GAAG,CAAC;IAElC,yEAAyE;IACzE,2EAA2E;IAC3E,0CAA0C;IAC1C,wBAAwB;IACxB,IAAI,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,IAAI,cAAc,CAAC,gBAAgB,CAAC,CAAC;IAC7C,CAAC;IAED,qBAAqB;IACrB,MAAM,IAAI,GAAc,EAAE,CAAC;IAC3B,OAAO,MAAM,CAAC,QAAQ,GAAG,GAAG,EAAE,CAAC;QAC7B,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;IACjC,CAAC;IAED,0EAA0E;IAC1E,IAAI,MAAM,CAAC,QAAQ,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,IAAI,cAAc,CAAC,gBAAgB,CAAC,CAAC;IAC7C,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/asn1/parse.d.ts

@@ -0,0 +1,7 @@
+export declare function parseInteger(buf: Uint8Array): bigint;
+export declare function parseStringASCII(buf: Uint8Array): string;
+export declare function parseTime(buf: Uint8Array, shortYear: boolean): Date;
+export declare function parseOID(buf: Uint8Array): string;
+export declare function parseBoolean(buf: Uint8Array): boolean;
+export declare function parseBitString(buf: Uint8Array): number[];
+//# sourceMappingURL=parse.d.ts.map

package/dist/asn1/parse.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse.d.ts","sourceRoot":"","sources":["../../src/asn1/parse.ts"],"names":[],"mappings":"AAyBA,wBAAgB,YAAY,CAAC,GAAG,EAAE,UAAU,GAAG,MAAM,CA2BpD;AAID,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,UAAU,GAAG,MAAM,CAExD;AAID,wBAAgB,SAAS,CAAC,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,GAAG,IAAI,CAqBnE;AAID,wBAAgB,QAAQ,CAAC,GAAG,EAAE,UAAU,GAAG,MAAM,CA0BhD;AAID,wBAAgB,YAAY,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAErD;AAID,wBAAgB,cAAc,CAAC,GAAG,EAAE,UAAU,GAAG,MAAM,EAAE,CAsBxD"}

package/dist/asn1/parse.js

@@ -0,0 +1,118 @@
+/*
+Copyright 2023 The Sigstore Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+import { Uint8ArrayToString } from "../encoding.js";
+const RE_TIME_SHORT_YEAR = /^(\d{2})(\d{2})(\d{2})(\d{2})(\d{2})(\d{2})(\.\d{3})?Z$/;
+const RE_TIME_LONG_YEAR = /^(\d{4})(\d{2})(\d{2})(\d{2})(\d{2})(\d{2})(\.\d{3})?Z$/;
+// Parse a BigInt from the DER-encoded buffer
+// https://learn.microsoft.com/en-us/windows/win32/seccertenroll/about-integer
+export function parseInteger(buf) {
+    let pos = 0;
+    const end = buf.length;
+    let val = buf[pos];
+    const neg = val > 0x7f;
+    // Consume any padding bytes
+    const pad = neg ? 0xff : 0x00;
+    while (val == pad && ++pos < end) {
+        val = buf[pos];
+    }
+    // Calculate remaining bytes to read
+    const len = end - pos;
+    if (len === 0)
+        return BigInt(neg ? -1 : 0);
+    // Handle two's complement for negative numbers
+    val = neg ? val - 256 : val;
+    // Parse remaining bytes
+    let n = BigInt(val);
+    for (let i = pos + 1; i < end; ++i) {
+        n = n * BigInt(256) + BigInt(buf[i]);
+    }
+    return n;
+}
+// Parse an ASCII string from the DER-encoded buffer
+// https://learn.microsoft.com/en-us/windows/win32/seccertenroll/about-basic-types#boolean
+export function parseStringASCII(buf) {
+    return Uint8ArrayToString(buf);
+}
+// Parse a Date from the DER-encoded buffer
+// https://www.rfc-editor.org/rfc/rfc5280#section-4.1.2.5.1
+export function parseTime(buf, shortYear) {
+    const timeStr = parseStringASCII(buf);
+    // Parse the time string into matches - captured groups start at index 1
+    const m = shortYear
+        ? RE_TIME_SHORT_YEAR.exec(timeStr)
+        : RE_TIME_LONG_YEAR.exec(timeStr);
+    if (!m) {
+        throw new Error("invalid time");
+    }
+    // Translate dates with a 2-digit year to 4 digits per the spec
+    if (shortYear) {
+        let year = Number(m[1]);
+        year += year >= 50 ? 1900 : 2000;
+        m[1] = year.toString();
+    }
+    // Translate to ISO8601 format and parse
+    return new Date(`${m[1]}-${m[2]}-${m[3]}T${m[4]}:${m[5]}:${m[6]}Z`);
+}
+// Parse an OID from the DER-encoded buffer
+// https://learn.microsoft.com/en-us/windows/win32/seccertenroll/about-object-identifier
+export function parseOID(buf) {
+    let pos = 0;
+    const end = buf.length;
+    // Consume first byte which encodes the first two OID components
+    let n = buf[pos++];
+    const first = Math.floor(n / 40);
+    const second = n % 40;
+    let oid = `${first}.${second}`;
+    // Consume remaining bytes
+    let val = 0;
+    for (; pos < end; ++pos) {
+        n = buf[pos];
+        val = (val << 7) + (n & 0x7f);
+        // If the left-most bit is NOT set, then this is the last byte in the
+        // sequence and we can add the value to the OID and reset the accumulator
+        if ((n & 0x80) === 0) {
+            oid += `.${val}`;
+            val = 0;
+        }
+    }
+    return oid;
+}
+// Parse a boolean from the DER-encoded buffer
+// https://learn.microsoft.com/en-us/windows/win32/seccertenroll/about-basic-types#boolean
+export function parseBoolean(buf) {
+    return buf[0] !== 0;
+}
+// Parse a bit string from the DER-encoded buffer
+// https://learn.microsoft.com/en-us/windows/win32/seccertenroll/about-bit-string
+export function parseBitString(buf) {
+    // First byte tell us how many unused bits are in the last byte
+    const unused = buf[0];
+    const start = 1;
+    const end = buf.length;
+    const bits = [];
+    for (let i = start; i < end; ++i) {
+        const byte = buf[i];
+        // The skip value is only used for the last byte
+        const skip = i === end - 1 ? unused : 0;
+        // Iterate over each bit in the byte (most significant first)
+        for (let j = 7; j >= skip; --j) {
+            // Read the bit and add it to the bit string
+            bits.push((byte >> j) & 0x01);
+        }
+    }
+    return bits;
+}
+//# sourceMappingURL=parse.js.map

package/dist/asn1/parse.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse.js","sourceRoot":"","sources":["../../src/asn1/parse.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;EAcE;AAEF,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEpD,MAAM,kBAAkB,GACtB,yDAAyD,CAAC;AAC5D,MAAM,iBAAiB,GACrB,yDAAyD,CAAC;AAE5D,6CAA6C;AAC7C,8EAA8E;AAC9E,MAAM,UAAU,YAAY,CAAC,GAAe;IAC1C,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC;IACvB,IAAI,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;IACnB,MAAM,GAAG,GAAG,GAAG,GAAG,IAAI,CAAC;IAEvB,4BAA4B;IAC5B,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9B,OAAO,GAAG,IAAI,GAAG,IAAI,EAAE,GAAG,GAAG,GAAG,EAAE,CAAC;QACjC,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;IACjB,CAAC;IAED,oCAAoC;IACpC,MAAM,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;IAEtB,IAAI,GAAG,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAE3C,+CAA+C;IAC/C,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IAE5B,wBAAwB;IACxB,IAAI,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACpB,KAAK,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,EAAE,CAAC,EAAE,CAAC;QACnC,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACvC,CAAC;IAED,OAAO,CAAC,CAAC;AACX,CAAC;AAED,oDAAoD;AACpD,0FAA0F;AAC1F,MAAM,UAAU,gBAAgB,CAAC,GAAe;IAC9C,OAAO,kBAAkB,CAAC,GAAG,CAAC,CAAC;AACjC,CAAC;AAED,2CAA2C;AAC3C,2DAA2D;AAC3D,MAAM,UAAU,SAAS,CAAC,GAAe,EAAE,SAAkB;IAC3D,MAAM,OAAO,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAEtC,wEAAwE;IACxE,MAAM,CAAC,GAAG,SAAS;QACjB,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC;QAClC,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAEpC,IAAI,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC;IAClC,CAAC;IAED,+DAA+D;IAC/D,IAAI,SAAS,EAAE,CAAC;QACd,IAAI,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACxB,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;QACjC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;IACzB,CAAC;IAED,wCAAwC;IACxC,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;AACtE,CAAC;AAED,2CAA2C;AAC3C,wFAAwF;AACxF,MAAM,UAAU,QAAQ,CAAC,GAAe;IACtC,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC;IAEvB,gEAAgE;IAChE,IAAI,CAAC,GAAG,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;IACnB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,CAAC,GAAG,EAAE,CAAC;IAEtB,IAAI,GAAG,GAAG,GAAG,KAAK,IAAI,MAAM,EAAE,CAAC;IAE/B,0BAA0B;IAC1B,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,OAAO,GAAG,GAAG,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC;QACxB,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;QACb,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QAE9B,qEAAqE;QACrE,yEAAyE;QACzE,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACrB,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC;YACjB,GAAG,GAAG,CAAC,CAAC;QACV,CAAC;IACH,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED,8CAA8C;AAC9C,0FAA0F;AAC1F,MAAM,UAAU,YAAY,CAAC,GAAe;IAC1C,OAAO,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;AACtB,CAAC;AAED,iDAAiD;AACjD,iFAAiF;AACjF,MAAM,UAAU,cAAc,CAAC,GAAe;IAC5C,+DAA+D;IAC/D,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;IAEtB,MAAM,KAAK,GAAG,CAAC,CAAC;IAChB,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC;IACvB,MAAM,IAAI,GAAG,EAAE,CAAC;IAEhB,KAAK,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,GAAG,EAAE,EAAE,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QAEpB,gDAAgD;QAChD,MAAM,IAAI,GAAG,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAExC,6DAA6D;QAC7D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC;YAC/B,4CAA4C;YAC5C,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/asn1/tag.d.ts

@@ -0,0 +1,17 @@
+export declare class ASN1Tag {
+    readonly number: number;
+    readonly constructed: boolean;
+    readonly class: number;
+    constructor(enc: number);
+    isUniversal(): boolean;
+    isContextSpecific(num?: number): boolean;
+    isBoolean(): boolean;
+    isInteger(): boolean;
+    isBitString(): boolean;
+    isOctetString(): boolean;
+    isOID(): boolean;
+    isUTCTime(): boolean;
+    isGeneralizedTime(): boolean;
+    toDER(): number;
+}
+//# sourceMappingURL=tag.d.ts.map

package/dist/asn1/tag.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tag.d.ts","sourceRoot":"","sources":["../../src/asn1/tag.ts"],"names":[],"mappings":"AAsCA,qBAAa,OAAO;IAClB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;gBAEX,GAAG,EAAE,MAAM;IAmBhB,WAAW,IAAI,OAAO;IAItB,iBAAiB,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO;IAKxC,SAAS,IAAI,OAAO;IAIpB,SAAS,IAAI,OAAO;IAIpB,WAAW,IAAI,OAAO;IAItB,aAAa,IAAI,OAAO;IAIxB,KAAK,IAAI,OAAO;IAMhB,SAAS,IAAI,OAAO;IAIpB,iBAAiB,IAAI,OAAO;IAI5B,KAAK,IAAI,MAAM;CAGvB"}

package/dist/asn1/tag.js

@@ -0,0 +1,86 @@
+/*
+Copyright 2023 The Sigstore Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+import { ASN1ParseError } from "./error.js";
+const UNIVERSAL_TAG = {
+    BOOLEAN: 0x01,
+    INTEGER: 0x02,
+    BIT_STRING: 0x03,
+    OCTET_STRING: 0x04,
+    OBJECT_IDENTIFIER: 0x06,
+    SEQUENCE: 0x10,
+    SET: 0x11,
+    PRINTABLE_STRING: 0x13,
+    UTC_TIME: 0x17,
+    GENERALIZED_TIME: 0x18,
+};
+const TAG_CLASS = {
+    UNIVERSAL: 0x00,
+    APPLICATION: 0x01,
+    CONTEXT_SPECIFIC: 0x02,
+    PRIVATE: 0x03,
+};
+// https://learn.microsoft.com/en-us/windows/win32/seccertenroll/about-encoded-tag-bytes
+export class ASN1Tag {
+    number;
+    constructed;
+    class;
+    constructor(enc) {
+        // Bits 0 through 4 are the tag number
+        this.number = enc & 0x1f;
+        // Bit 5 is the constructed bit
+        this.constructed = (enc & 0x20) === 0x20;
+        // Bit 6 & 7 are the class
+        this.class = enc >> 6;
+        if (this.number === 0x1f) {
+            throw new ASN1ParseError("long form tags not supported");
+        }
+        if (this.class === TAG_CLASS.UNIVERSAL && this.number === 0x00) {
+            throw new ASN1ParseError("unsupported tag 0x00");
+        }
+    }
+    isUniversal() {
+        return this.class === TAG_CLASS.UNIVERSAL;
+    }
+    isContextSpecific(num) {
+        const res = this.class === TAG_CLASS.CONTEXT_SPECIFIC;
+        return num !== undefined ? res && this.number === num : res;
+    }
+    isBoolean() {
+        return this.isUniversal() && this.number === UNIVERSAL_TAG.BOOLEAN;
+    }
+    isInteger() {
+        return this.isUniversal() && this.number === UNIVERSAL_TAG.INTEGER;
+    }
+    isBitString() {
+        return this.isUniversal() && this.number === UNIVERSAL_TAG.BIT_STRING;
+    }
+    isOctetString() {
+        return this.isUniversal() && this.number === UNIVERSAL_TAG.OCTET_STRING;
+    }
+    isOID() {
+        return (this.isUniversal() && this.number === UNIVERSAL_TAG.OBJECT_IDENTIFIER);
+    }
+    isUTCTime() {
+        return this.isUniversal() && this.number === UNIVERSAL_TAG.UTC_TIME;
+    }
+    isGeneralizedTime() {
+        return this.isUniversal() && this.number === UNIVERSAL_TAG.GENERALIZED_TIME;
+    }
+    toDER() {
+        return this.number | (this.constructed ? 0x20 : 0x00) | (this.class << 6);
+    }
+}
+//# sourceMappingURL=tag.js.map