@freedomofpress/sigstore-browser 0.1.0 → 0.1.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/cli.js +1 -1
- package/dist/cli.js.map +1 -1
- package/dist/interfaces.d.ts +1 -15
- package/dist/interfaces.d.ts.map +1 -1
- package/dist/interfaces.js +2 -18
- package/dist/interfaces.js.map +1 -1
- package/dist/rfc3161/timestamp.d.ts +1 -1
- package/dist/rfc3161/timestamp.d.ts.map +1 -1
- package/dist/rfc3161/timestamp.js +3 -5
- package/dist/rfc3161/timestamp.js.map +1 -1
- package/dist/rfc3161/tstinfo.d.ts +1 -1
- package/dist/rfc3161/tstinfo.d.ts.map +1 -1
- package/dist/rfc3161/tstinfo.js +18 -4
- package/dist/rfc3161/tstinfo.js.map +1 -1
- package/dist/sigstore.d.ts +1 -1
- package/dist/sigstore.d.ts.map +1 -1
- package/dist/sigstore.js +6 -8
- package/dist/sigstore.js.map +1 -1
- package/dist/timestamp/tsa.d.ts +1 -1
- package/dist/timestamp/tsa.d.ts.map +1 -1
- package/dist/timestamp/tsa.js +4 -5
- package/dist/timestamp/tsa.js.map +1 -1
- package/dist/tlog/body.js +1 -1
- package/dist/tlog/body.js.map +1 -1
- package/dist/tlog/checkpoint.d.ts.map +1 -1
- package/dist/tlog/checkpoint.js +6 -7
- package/dist/tlog/checkpoint.js.map +1 -1
- package/dist/tlog/dsse.js +3 -3
- package/dist/tlog/dsse.js.map +1 -1
- package/dist/tlog/hashedrekord.js +1 -1
- package/dist/tlog/hashedrekord.js.map +1 -1
- package/dist/tlog/intoto.js +2 -2
- package/dist/tlog/intoto.js.map +1 -1
- package/dist/tlog/merkle.js +4 -4
- package/dist/tlog/merkle.js.map +1 -1
- package/dist/trust/tuf.d.ts +1 -1
- package/dist/trust/tuf.d.ts.map +1 -1
- package/dist/trust/tuf.js +4 -4
- package/dist/trust/tuf.js.map +1 -1
- package/dist/x509/cert.d.ts +1 -1
- package/dist/x509/cert.d.ts.map +1 -1
- package/dist/x509/cert.js +4 -7
- package/dist/x509/cert.js.map +1 -1
- package/dist/x509/chain.d.ts.map +1 -1
- package/dist/x509/chain.js +16 -5
- package/dist/x509/chain.js.map +1 -1
- package/dist/x509/ext.d.ts +1 -1
- package/dist/x509/ext.d.ts.map +1 -1
- package/dist/x509/ext.js +17 -3
- package/dist/x509/ext.js.map +1 -1
- package/dist/x509/sct.d.ts.map +1 -1
- package/dist/x509/sct.js +2 -4
- package/dist/x509/sct.js.map +1 -1
- package/package.json +4 -3
- package/src/cli.ts +6 -1
- package/src/interfaces.ts +2 -17
- package/src/rfc3161/timestamp.ts +3 -5
- package/src/rfc3161/tstinfo.ts +3 -5
- package/src/sigstore.ts +17 -16
- package/src/timestamp/tsa.ts +5 -6
- package/src/tlog/body.ts +1 -1
- package/src/tlog/checkpoint.ts +13 -7
- package/src/tlog/dsse.ts +3 -3
- package/src/tlog/hashedrekord.ts +1 -1
- package/src/tlog/intoto.ts +2 -2
- package/src/tlog/merkle.ts +4 -4
- package/src/trust/tuf.ts +6 -6
- package/src/x509/cert.ts +11 -7
- package/src/x509/chain.ts +6 -6
- package/src/x509/ext.ts +2 -4
- package/src/x509/sct.ts +2 -4
- package/dist/asn1/error.d.ts +0 -5
- package/dist/asn1/error.d.ts.map +0 -1
- package/dist/asn1/error.js +0 -20
- package/dist/asn1/error.js.map +0 -1
- package/dist/asn1/index.d.ts +0 -2
- package/dist/asn1/index.d.ts.map +0 -1
- package/dist/asn1/index.js +0 -17
- package/dist/asn1/index.js.map +0 -1
- package/dist/asn1/length.d.ts +0 -4
- package/dist/asn1/length.d.ts.map +0 -1
- package/dist/asn1/length.js +0 -59
- package/dist/asn1/length.js.map +0 -1
- package/dist/asn1/obj.d.ts +0 -15
- package/dist/asn1/obj.d.ts.map +0 -1
- package/dist/asn1/obj.js +0 -153
- package/dist/asn1/obj.js.map +0 -1
- package/dist/asn1/parse.d.ts +0 -7
- package/dist/asn1/parse.d.ts.map +0 -1
- package/dist/asn1/parse.js +0 -118
- package/dist/asn1/parse.js.map +0 -1
- package/dist/asn1/tag.d.ts +0 -17
- package/dist/asn1/tag.d.ts.map +0 -1
- package/dist/asn1/tag.js +0 -86
- package/dist/asn1/tag.js.map +0 -1
- package/dist/canonicalize.d.ts +0 -2
- package/dist/canonicalize.d.ts.map +0 -1
- package/dist/canonicalize.js +0 -64
- package/dist/canonicalize.js.map +0 -1
- package/dist/crypto.d.ts +0 -5
- package/dist/crypto.d.ts.map +0 -1
- package/dist/crypto.js +0 -260
- package/dist/crypto.js.map +0 -1
- package/dist/encoding.d.ts +0 -17
- package/dist/encoding.d.ts.map +0 -1
- package/dist/encoding.js +0 -112
- package/dist/encoding.js.map +0 -1
- package/dist/pem.d.ts +0 -3
- package/dist/pem.d.ts.map +0 -1
- package/dist/pem.js +0 -41
- package/dist/pem.js.map +0 -1
- package/dist/stream.d.ts +0 -22
- package/dist/stream.d.ts.map +0 -1
- package/dist/stream.js +0 -114
- package/dist/stream.js.map +0 -1
- package/src/asn1/error.ts +0 -18
- package/src/asn1/index.ts +0 -16
- package/src/asn1/length.ts +0 -71
- package/src/asn1/obj.ts +0 -184
- package/src/asn1/parse.ts +0 -146
- package/src/asn1/tag.ts +0 -105
- package/src/canonicalize.ts +0 -61
- package/src/crypto.ts +0 -310
- package/src/encoding.ts +0 -141
- package/src/pem.ts +0 -48
- package/src/stream.ts +0 -141
- package/src/types/tuf-browser.d.ts +0 -13
|
@@ -9,7 +9,7 @@
|
|
|
9
9
|
* - Direct bundle field comparison instead of SignatureContent abstraction
|
|
10
10
|
* - Adds verifyHashedRekordV002Body() - new functionality (reference only supports v0.0.1)
|
|
11
11
|
*/
|
|
12
|
-
import { base64ToUint8Array, hexToUint8Array, uint8ArrayEqual } from "
|
|
12
|
+
import { base64ToUint8Array, hexToUint8Array, uint8ArrayEqual } from "@freedomofpress/crypto-browser";
|
|
13
13
|
export async function verifyHashedRekordBody(entry, bundle) {
|
|
14
14
|
const hashedRekordEntry = entry;
|
|
15
15
|
switch (hashedRekordEntry.apiVersion) {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"hashedrekord.js","sourceRoot":"","sources":["../../src/tlog/hashedrekord.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,
|
|
1
|
+
{"version":3,"file":"hashedrekord.js","sourceRoot":"","sources":["../../src/tlog/hashedrekord.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AA0CtG,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAAiB,EACjB,MAAsB;IAEtB,MAAM,iBAAiB,GAAG,KAA0B,CAAC;IAErD,QAAQ,iBAAiB,CAAC,UAAU,EAAE,CAAC;QACrC,KAAK,OAAO;YACV,OAAO,0BAA0B,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;QAC/D,KAAK,OAAO;YACV,OAAO,0BAA0B,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;QAC/D;YACE,MAAM,IAAI,KAAK,CACb,qCAAqC,iBAAiB,CAAC,UAAU,EAAE,CACpE,CAAC;IACN,CAAC;AACH,CAAC;AAED,SAAS,0BAA0B,CACjC,KAAwB,EACxB,MAAsB;IAEtB,MAAM,IAAI,GAAG,KAAK,CAAC,IAAwB,CAAC;IAC5C,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,IAAI,EAAE,CAAC;IAC7C,MAAM,YAAY,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACjD,MAAM,cAAc,GAAG,kBAAkB,CAAC,MAAM,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;IAE7E,IAAI,CAAC,eAAe,CAAC,YAAY,EAAE,cAAc,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;IAC/C,MAAM,eAAe,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IACpD,MAAM,iBAAiB,GAAG,kBAAkB,CAC1C,MAAM,CAAC,gBAAgB,CAAC,aAAa,CAAC,MAAM,CAC7C,CAAC;IAEF,IAAI,CAAC,eAAe,CAAC,eAAe,EAAE,iBAAiB,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;AACH,CAAC;AAED,uGAAuG;AACvG,SAAS,0BAA0B,CACjC,KAAwB,EACxB,MAAsB;IAEtB,MAAM,IAAI,GAAI,KAAK,CAAC,IAA6B,CAAC,gBAAgB,CAAC;IACnE,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IACnF,CAAC;IAED,gGAAgG;IAChG,2DAA2D;IAC3D,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,IAAI,EAAE,CAAC;IAC7C,MAAM,YAAY,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACjD,MAAM,cAAc,GAAG,kBAAkB,CAAC,MAAM,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;IAE7E,IAAI,CAAC,eAAe,CAAC,YAAY,EAAE,cAAc,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC/E,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;IAC1C,MAAM,eAAe,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;IACvD,MAAM,iBAAiB,GAAG,kBAAkB,CAC1C,MAAM,CAAC,gBAAgB,CAAC,aAAa,CAAC,MAAM,CAC7C,CAAC;IAEF,IAAI,CAAC,eAAe,CAAC,eAAe,EAAE,iBAAiB,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;AACH,CAAC"}
|
package/dist/tlog/intoto.js
CHANGED
|
@@ -9,7 +9,7 @@
|
|
|
9
9
|
* - Direct bundle field comparison instead of SignatureContent abstraction
|
|
10
10
|
* - Uses crypto.subtle.digest for hash computation instead of Node.js crypto
|
|
11
11
|
*/
|
|
12
|
-
import { base64Decode, base64ToUint8Array, hexToUint8Array,
|
|
12
|
+
import { base64Decode, base64ToUint8Array, hexToUint8Array, uint8ArrayEqual } from "@freedomofpress/crypto-browser";
|
|
13
13
|
import { HashAlgorithms } from "../interfaces.js";
|
|
14
14
|
export async function verifyIntotoBody(entry, bundle) {
|
|
15
15
|
const intotoEntry = entry;
|
|
@@ -41,7 +41,7 @@ export async function verifyIntotoBody(entry, bundle) {
|
|
|
41
41
|
const tlogHash = intotoEntry.spec.content.payloadHash.value;
|
|
42
42
|
const tlogHashBytes = hexToUint8Array(tlogHash);
|
|
43
43
|
const payloadBytes = base64ToUint8Array(bundle.dsseEnvelope.payload);
|
|
44
|
-
const bundleHashBytes = new Uint8Array(await crypto.subtle.digest(HashAlgorithms.SHA256,
|
|
44
|
+
const bundleHashBytes = new Uint8Array(await crypto.subtle.digest(HashAlgorithms.SHA256, payloadBytes));
|
|
45
45
|
if (!uint8ArrayEqual(tlogHashBytes, bundleHashBytes)) {
|
|
46
46
|
throw new Error("Intoto payload hash mismatch between TLog entry and bundle");
|
|
47
47
|
}
|
package/dist/tlog/intoto.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"intoto.js","sourceRoot":"","sources":["../../src/tlog/intoto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,eAAe,EAAE,
|
|
1
|
+
{"version":3,"file":"intoto.js","sourceRoot":"","sources":["../../src/tlog/intoto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACpH,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAmClD,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAAiB,EACjB,MAAsB;IAEtB,MAAM,WAAW,GAAG,KAAoB,CAAC;IAEzC,IAAI,WAAW,CAAC,UAAU,KAAK,OAAO,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CACb,+BAA+B,WAAW,CAAC,UAAU,EAAE,CACxD,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IAED,MAAM,YAAY,GAAG,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;IAEvD,IAAI,CAAC,YAAY,CAAC,UAAU,IAAI,YAAY,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IAED,mEAAmE;IACnE,qDAAqD;IACrD,sEAAsE;IACtE,0DAA0D;IAC1D,MAAM,aAAa,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACrD,MAAM,cAAc,GAAG,YAAY,CAAC,aAAa,CAAC,CAAC,CAAC,+DAA+D;IACnH,MAAM,YAAY,GAAG,kBAAkB,CAAC,cAAc,CAAC,CAAC,CAAC,4CAA4C;IAErG,IAAI,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IAED,MAAM,cAAc,GAAG,kBAAkB,CAAC,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAEjF,IAAI,CAAC,eAAe,CAAC,YAAY,EAAE,cAAc,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IAED,IAAI,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QACzC,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC;QAC5D,MAAM,aAAa,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;QAEhD,MAAM,YAAY,GAAG,kBAAkB,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QACrE,MAAM,eAAe,GAAG,IAAI,UAAU,CACpC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,YAAuC,CAAC,CAC3F,CAAC;QAEF,IAAI,CAAC,eAAe,CAAC,aAAa,EAAE,eAAe,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;AACH,CAAC"}
|
package/dist/tlog/merkle.js
CHANGED
|
@@ -6,9 +6,9 @@ Key differences:
|
|
|
6
6
|
- Uses Uint8Array instead of Buffer
|
|
7
7
|
- Uses async Web Crypto API (crypto.subtle.digest) instead of sync Node.js crypto
|
|
8
8
|
- Base64 decoding via custom base64ToUint8Array instead of Buffer.from
|
|
9
|
-
-
|
|
9
|
+
- uint8ArrayEqual from crypto-browser instead of Node.js crypto.timingSafeEqual
|
|
10
10
|
*/
|
|
11
|
-
import { base64ToUint8Array,
|
|
11
|
+
import { base64ToUint8Array, uint8ArrayEqual } from "@freedomofpress/crypto-browser";
|
|
12
12
|
import { HashAlgorithms } from "../interfaces.js";
|
|
13
13
|
const RFC6962_LEAF_HASH_PREFIX = new Uint8Array([0x00]);
|
|
14
14
|
const RFC6962_NODE_HASH_PREFIX = new Uint8Array([0x01]);
|
|
@@ -99,14 +99,14 @@ async function hashChildren(left, right) {
|
|
|
99
99
|
data.set(RFC6962_NODE_HASH_PREFIX, 0);
|
|
100
100
|
data.set(left, RFC6962_NODE_HASH_PREFIX.length);
|
|
101
101
|
data.set(right, RFC6962_NODE_HASH_PREFIX.length + left.length);
|
|
102
|
-
const hash = await crypto.subtle.digest(HashAlgorithms.SHA256,
|
|
102
|
+
const hash = await crypto.subtle.digest(HashAlgorithms.SHA256, data);
|
|
103
103
|
return new Uint8Array(hash);
|
|
104
104
|
}
|
|
105
105
|
async function hashLeaf(leaf) {
|
|
106
106
|
const data = new Uint8Array(RFC6962_LEAF_HASH_PREFIX.length + leaf.length);
|
|
107
107
|
data.set(RFC6962_LEAF_HASH_PREFIX, 0);
|
|
108
108
|
data.set(leaf, RFC6962_LEAF_HASH_PREFIX.length);
|
|
109
|
-
const hash = await crypto.subtle.digest(HashAlgorithms.SHA256,
|
|
109
|
+
const hash = await crypto.subtle.digest(HashAlgorithms.SHA256, data);
|
|
110
110
|
return new Uint8Array(hash);
|
|
111
111
|
}
|
|
112
112
|
//# sourceMappingURL=merkle.js.map
|
package/dist/tlog/merkle.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"merkle.js","sourceRoot":"","sources":["../../src/tlog/merkle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;EASE;AACF,OAAO,EAAE,kBAAkB,EAAE,
|
|
1
|
+
{"version":3,"file":"merkle.js","sourceRoot":"","sources":["../../src/tlog/merkle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;EASE;AACF,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACrF,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAGlD,MAAM,wBAAwB,GAAG,IAAI,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AACxD,MAAM,wBAAwB,GAAG,IAAI,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AAExD,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,KAAgB;IAEhB,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC7C,CAAC;IAED,MAAM,cAAc,GAAG,KAAK,CAAC,cAAc,CAAC;IAC5C,MAAM,QAAQ,GAAG,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IAEjD,IAAI,QAAQ,GAAG,EAAE,IAAI,QAAQ,IAAI,QAAQ,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,sBAAsB,QAAQ,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,wEAAwE;IACxE,QAAQ;IACR,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAE9D,IAAI,cAAc,CAAC,MAAM,CAAC,MAAM,KAAK,KAAK,GAAG,MAAM,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IAED,MAAM,WAAW,GAAG,cAAc,CAAC,MAAM;SACtC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC;SACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC;IACrC,MAAM,YAAY,GAAG,cAAc,CAAC,MAAM;SACvC,KAAK,CAAC,KAAK,CAAC;SACZ,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC;IAErC,oCAAoC;IACpC,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,kBAAkB,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAE7E,8DAA8D;IAC9D,MAAM,cAAc,GAAG,MAAM,gBAAgB,CAC3C,MAAM,UAAU,CAAC,QAAQ,EAAE,WAAW,EAAE,QAAQ,CAAC,EACjD,YAAY,CACb,CAAC;IAEF,MAAM,QAAQ,GAAG,kBAAkB,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IAE7D,oEAAoE;IACpE,IAAI,CAAC,eAAe,CAAC,cAAc,EAAE,QAAQ,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,2EAA2E;AAC3E,6EAA6E;AAC7E,SAAS;AACT,SAAS,eAAe,CACtB,KAAa,EACb,IAAY;IAEZ,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACjD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AAC3B,CAAC;AAED,0EAA0E;AAC1E,4EAA4E;AAC5E,mEAAmE;AACnE,KAAK,UAAU,UAAU,CACvB,IAAgB,EAChB,MAAoB,EACpB,KAAa;IAEb,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;YACrC,GAAG,GAAG,MAAM,YAAY,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACnC,CAAC;aAAM,CAAC;YACN,GAAG,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,mEAAmE;AACnE,KAAK,UAAU,gBAAgB,CAC7B,IAAgB,EAChB,MAAoB;IAEpB,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,GAAG,GAAG,MAAM,YAAY,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,cAAc,CAAC,KAAa,EAAE,IAAY;IACjD,OAAO,SAAS,CAAC,KAAK,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED,8EAA8E;AAC9E,+CAA+C;AAC/C,SAAS,SAAS,CAAC,GAAW;IAC5B,OAAO,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;AAC/C,CAAC;AAED,0EAA0E;AAC1E,SAAS,SAAS,CAAC,CAAS;IAC1B,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;QACb,OAAO,CAAC,CAAC;IACX,CAAC;IACD,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;AAC9B,CAAC;AAED,sCAAsC;AACtC,0DAA0D;AAC1D,KAAK,UAAU,YAAY,CACzB,IAAgB,EAChB,KAAiB;IAEjB,MAAM,IAAI,GAAG,IAAI,UAAU,CACzB,wBAAwB,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAC7D,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,wBAAwB,EAAE,CAAC,CAAC,CAAC;IACtC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,wBAAwB,CAAC,MAAM,CAAC,CAAC;IAChD,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,wBAAwB,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAE/D,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,IAA+B,CAAC,CAAC;IAChG,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;AAC9B,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAgB;IACtC,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,wBAAwB,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3E,IAAI,CAAC,GAAG,CAAC,wBAAwB,EAAE,CAAC,CAAC,CAAC;IACtC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,wBAAwB,CAAC,MAAM,CAAC,CAAC;IAEhD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,IAA+B,CAAC,CAAC;IAChG,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;AAC9B,CAAC"}
|
package/dist/trust/tuf.d.ts
CHANGED
package/dist/trust/tuf.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"tuf.d.ts","sourceRoot":"","sources":["../../src/trust/tuf.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"tuf.d.ts","sourceRoot":"","sources":["../../src/trust/tuf.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAE/C;;GAEG;AACH,MAAM,WAAW,0BAA0B;IACzC;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAE3B;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAYD;;;;;;;;;;;GAWG;AACH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,aAAa,CAAC,CAAS;IAC/B,OAAO,CAAC,WAAW,CAAC,CAAS;IAC7B,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,iBAAiB,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAS;IAEzB,OAAO,CAAC,SAAS,CAAC,CAAY;IAC9B,OAAO,CAAC,UAAU,CAAC,CAAc;IACjC,OAAO,CAAC,cAAc,CAAC,CAAS;gBAEpB,OAAO,GAAE,0BAA+B;IAUpD;;;OAGG;YACW,aAAa;IAwB3B;;;OAGG;YACW,cAAc;IAY5B;;OAEG;IACH,OAAO,CAAC,YAAY;IASpB;;;;;;OAMG;IACG,cAAc,IAAI,OAAO,CAAC,WAAW,CAAC;IAsC5C;;;;;OAKG;IACG,kBAAkB,IAAI,OAAO,CAAC,WAAW,CAAC;IAShD;;;OAGG;IACH,UAAU,IAAI,IAAI;CAInB"}
|
package/dist/trust/tuf.js
CHANGED
|
@@ -6,7 +6,7 @@
|
|
|
6
6
|
*
|
|
7
7
|
* Reference: https://github.com/freedomofpress/tuf-browser
|
|
8
8
|
*/
|
|
9
|
-
import { Uint8ArrayToString } from "
|
|
9
|
+
import { Uint8ArrayToString } from "@freedomofpress/crypto-browser";
|
|
10
10
|
/**
|
|
11
11
|
* Default configuration for Sigstore production TUF repository
|
|
12
12
|
*/
|
|
@@ -56,7 +56,7 @@ export class TrustedRootProvider {
|
|
|
56
56
|
return;
|
|
57
57
|
}
|
|
58
58
|
try {
|
|
59
|
-
const { TUFClient } = await import('tuf-browser
|
|
59
|
+
const { TUFClient } = await import('@freedomofpress/tuf-browser');
|
|
60
60
|
// Get initial root metadata
|
|
61
61
|
const rootMetadata = this.initialRoot || await this.getDefaultRoot();
|
|
62
62
|
this.tufClient = new TUFClient(this.metadataUrl, rootMetadata, this.namespace, this.targetBaseUrl);
|
|
@@ -112,9 +112,9 @@ export class TrustedRootProvider {
|
|
|
112
112
|
await this.tufClient.updateTUF();
|
|
113
113
|
// Fetch the trusted root target via TUF
|
|
114
114
|
// TUF will handle all verification (signatures, rollback protection, etc.)
|
|
115
|
-
const
|
|
115
|
+
const trustedRootBuffer = await this.tufClient.getTarget(this.trustedRootTarget);
|
|
116
116
|
// Parse the trusted root JSON
|
|
117
|
-
const trustedRootJson = Uint8ArrayToString(
|
|
117
|
+
const trustedRootJson = Uint8ArrayToString(new Uint8Array(trustedRootBuffer));
|
|
118
118
|
const trustedRoot = JSON.parse(trustedRootJson);
|
|
119
119
|
// Cache the result
|
|
120
120
|
this.cachedRoot = trustedRoot;
|
package/dist/trust/tuf.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"tuf.js","sourceRoot":"","sources":["../../src/trust/tuf.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;
|
|
1
|
+
{"version":3,"file":"tuf.js","sourceRoot":"","sources":["../../src/trust/tuf.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AA6CpE;;GAEG;AACH,MAAM,cAAc,GAAG;IACrB,WAAW,EAAE,oCAAoC;IACjD,SAAS,EAAE,kBAAkB;IAC7B,iBAAiB,EAAE,mBAAmB;IACtC,QAAQ,EAAE,OAAO,EAAE,SAAS;CAC7B,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,mBAAmB;IACtB,WAAW,CAAS;IACpB,aAAa,CAAU;IACvB,WAAW,CAAU;IACrB,SAAS,CAAS;IAClB,iBAAiB,CAAS;IAC1B,QAAQ,CAAS;IAEjB,SAAS,CAAa;IACtB,UAAU,CAAe;IACzB,cAAc,CAAU;IAEhC,YAAY,UAAsC,EAAE;QAClD,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,cAAc,CAAC,WAAW,CAAC;QACtE,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,WAAW,GAAG,CAAC;QAC/E,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,IAAI,CAAC,WAAW,CAAC;QAC/D,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACvC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,cAAc,CAAC,SAAS,CAAC;QAC/D,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,IAAI,cAAc,CAAC,iBAAiB,CAAC;QACvF,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,cAAc,CAAC,QAAQ,CAAC;IAC9D,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,aAAa;QACzB,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAC;YAElE,4BAA4B;YAC5B,MAAM,YAAY,GAAG,IAAI,CAAC,WAAW,IAAI,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;YAErE,IAAI,CAAC,SAAS,GAAG,IAAI,SAAS,CAC5B,IAAI,CAAC,WAAW,EAChB,YAAY,EACZ,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,aAAa,CACnB,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,oCAAoC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC7F,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,cAAc;QAC1B,oFAAoF;QACpF,uFAAuF;QACvF,MAAM,aAAa,GAAG,MAAM,MAAM,CAAC,iBAAiB,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QAClF,MAAM,aAAa,GAAG,aAAa,CAAC,OAAiB,CAAC;QAEtD,yDAAyD;QACzD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;QAClC,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7E,OAAO,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACnC,CAAC;IAED;;OAEG;IACK,YAAY;QAClB,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YAC7C,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC;IACrD,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,cAAc;QAClB,oCAAoC;QACpC,IAAI,IAAI,CAAC,YAAY,EAAE,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YAC3C,OAAO,IAAI,CAAC,UAAU,CAAC;QACzB,CAAC;QAED,kCAAkC;QAClC,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QAE3B,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,CAAC;QAED,IAAI,CAAC;YACH,2DAA2D;YAC3D,wEAAwE;YACxE,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC;YAEjC,wCAAwC;YACxC,2EAA2E;YAC3E,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;YAEjF,8BAA8B;YAC9B,MAAM,eAAe,GAAG,kBAAkB,CAAC,IAAI,UAAU,CAAC,iBAAiB,CAAC,CAAC,CAAC;YAC9E,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAgB,CAAC;YAE/D,mBAAmB;YACnB,IAAI,CAAC,UAAU,GAAG,WAAW,CAAC;YAC9B,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAEjC,OAAO,WAAW,CAAC;QACrB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,yCAAyC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAClG,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,kBAAkB;QACtB,cAAc;QACd,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;QAC5B,IAAI,CAAC,cAAc,GAAG,SAAS,CAAC;QAEhC,mBAAmB;QACnB,OAAO,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;IACrC,CAAC;IAED;;;OAGG;IACH,UAAU;QACR,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;QAC5B,IAAI,CAAC,cAAc,GAAG,SAAS,CAAC;IAClC,CAAC;CACF"}
|
package/dist/x509/cert.d.ts
CHANGED
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
import { ASN1Obj } from "
|
|
1
|
+
import { ASN1Obj } from "@freedomofpress/crypto-browser";
|
|
2
2
|
import { X509AuthorityKeyIDExtension, X509BasicConstraintsExtension, X509Extension, X509FulcioIssuerV1, X509FulcioIssuerV2, X509KeyUsageExtension, X509SCTExtension, X509SubjectAlternativeNameExtension, X509SubjectKeyIDExtension } from "./ext.js";
|
|
3
3
|
export declare const EXTENSION_OID_SCT = "1.3.6.1.4.1.11129.2.4.2";
|
|
4
4
|
export declare class X509Certificate {
|
package/dist/x509/cert.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"cert.d.ts","sourceRoot":"","sources":["../../src/x509/cert.ts"],"names":[],"mappings":"AAeA,OAAO,
|
|
1
|
+
{"version":3,"file":"cert.d.ts","sourceRoot":"","sources":["../../src/x509/cert.ts"],"names":[],"mappings":"AAeA,OAAO,EACL,OAAO,EAMR,MAAM,gCAAgC,CAAC;AAGxC,OAAO,EACL,2BAA2B,EAC3B,6BAA6B,EAC7B,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,qBAAqB,EACrB,gBAAgB,EAChB,mCAAmC,EACnC,yBAAyB,EAC1B,MAAM,UAAU,CAAC;AAWlB,eAAO,MAAM,iBAAiB,4BAA4B,CAAC;AAE3D,qBAAa,eAAe;IACnB,IAAI,EAAE,OAAO,CAAC;gBAET,IAAI,EAAE,OAAO;WAIX,KAAK,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,GAAG,eAAe;IAM/D,IAAI,cAAc,IAAI,OAAO,CAE5B;IAED,IAAI,OAAO,IAAI,MAAM,CAIpB;IAED,IAAI,YAAY,IAAI,UAAU,CAE7B;IAED,IAAI,SAAS,IAAI,IAAI,CAGpB;IAED,IAAI,QAAQ,IAAI,IAAI,CAGnB;IAED,IAAI,MAAM,IAAI,UAAU,CAEvB;IAED,IAAI,OAAO,IAAI,UAAU,CAExB;IAED,IAAI,SAAS,IAAI,UAAU,CAE1B;IAED;;;OAGG;IACU,eAAe,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC;IA6BlE,IAAI,YAAY,IAAI,OAAO,CAAC,SAAS,CAAC,CAErC;IAED,IAAI,kBAAkB,IAAI,MAAM,CAG/B;IAED,IAAI,cAAc,IAAI,UAAU,CAG/B;IAED,IAAI,cAAc,IAAI,MAAM,GAAG,SAAS,CAGvC;IAED,IAAI,UAAU,IAAI,OAAO,EAAE,CAK1B;IAED,IAAI,WAAW,IAAI,qBAAqB,GAAG,SAAS,CAGnD;IAED,IAAI,mBAAmB,IAAI,6BAA6B,GAAG,SAAS,CAGnE;IAED,IAAI,iBAAiB,IAAI,mCAAmC,GAAG,SAAS,CAGvE;IAED,IAAI,iBAAiB,IAAI,2BAA2B,GAAG,SAAS,CAG/D;IAED,IAAI,eAAe,IAAI,yBAAyB,GAAG,SAAS,CAK3D;IAED,IAAI,MAAM,IAAI,gBAAgB,GAAG,SAAS,CAGzC;IAED,IAAI,iBAAiB,IAAI,kBAAkB,GAAG,SAAS,CAGtD;IAED,IAAI,iBAAiB,IAAI,kBAAkB,GAAG,SAAS,CAGtD;IAED,IAAI,IAAI,IAAI,OAAO,CASlB;IAEM,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS;IAK3C,MAAM,CAAC,iBAAiB,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC;IAoBnE,YAAY,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO;IAIjC,MAAM,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO;IAKvC,KAAK,IAAI,eAAe;IAM/B,OAAO,CAAC,aAAa;IAYrB,OAAO,KAAK,iBAAiB,GAG5B;IAGD,OAAO,KAAK,qBAAqB,GAGhC;IAGD,OAAO,KAAK,iBAAiB,GAG5B;IAGD,OAAO,KAAK,UAAU,GAGrB;IAGD,OAAO,KAAK,eAAe,GAG1B;IAGD,OAAO,KAAK,SAAS,GAGpB;IAGD,OAAO,KAAK,WAAW,GAGtB;IAGD,OAAO,KAAK,UAAU,GAGrB;IAGD,OAAO,KAAK,uBAAuB,GAGlC;IAKD,OAAO,KAAK,aAAa,GAIxB;CACF"}
|
package/dist/x509/cert.js
CHANGED
|
@@ -13,12 +13,9 @@ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
|
13
13
|
See the License for the specific language governing permissions and
|
|
14
14
|
limitations under the License.
|
|
15
15
|
*/
|
|
16
|
-
import { ASN1Obj } from "
|
|
17
|
-
import { bufferEqual, importKey, verifySignature } from "../crypto.js";
|
|
18
|
-
import { Uint8ArrayToBase64 } from "../encoding.js";
|
|
16
|
+
import { ASN1Obj, importKey, toDER, Uint8ArrayToBase64, uint8ArrayEqual, verifySignature, } from "@freedomofpress/crypto-browser";
|
|
19
17
|
import { KeyTypes } from "../interfaces.js";
|
|
20
18
|
import { ECDSA_CURVE_NAMES, ECDSA_SIGNATURE_ALGOS, RSA_SIGNATURE_ALGOS } from "../oid.js";
|
|
21
|
-
import * as pem from "../pem.js";
|
|
22
19
|
import { X509AuthorityKeyIDExtension, X509BasicConstraintsExtension, X509Extension, X509FulcioIssuerV1, X509FulcioIssuerV2, X509KeyUsageExtension, X509SCTExtension, X509SubjectAlternativeNameExtension, X509SubjectKeyIDExtension, } from "./ext.js";
|
|
23
20
|
// https://github.com/sigstore/fulcio/blob/main/docs/oid-info.md
|
|
24
21
|
const EXTENSION_OID_SUBJECT_KEY_ID = "2.5.29.14";
|
|
@@ -35,7 +32,7 @@ export class X509Certificate {
|
|
|
35
32
|
this.root = asn1;
|
|
36
33
|
}
|
|
37
34
|
static parse(cert) {
|
|
38
|
-
const der = typeof cert === "string" ?
|
|
35
|
+
const der = typeof cert === "string" ? toDER(cert) : cert;
|
|
39
36
|
const asn1 = ASN1Obj.parseBuffer(der);
|
|
40
37
|
return new X509Certificate(asn1);
|
|
41
38
|
}
|
|
@@ -89,7 +86,7 @@ export class X509Certificate {
|
|
|
89
86
|
else {
|
|
90
87
|
scheme = "SHA256";
|
|
91
88
|
}
|
|
92
|
-
return importKey(
|
|
89
|
+
return importKey(KeyTypes.RSA, `RSA_PKCS1V5_${scheme}`, Uint8ArrayToBase64(publicKey));
|
|
93
90
|
}
|
|
94
91
|
else {
|
|
95
92
|
// ECDSA key - the curve OID is in the second element
|
|
@@ -184,7 +181,7 @@ export class X509Certificate {
|
|
|
184
181
|
return this.notBefore <= date && date <= this.notAfter;
|
|
185
182
|
}
|
|
186
183
|
equals(other) {
|
|
187
|
-
return
|
|
184
|
+
return uint8ArrayEqual(this.root.toDER(), other.root.toDER());
|
|
188
185
|
}
|
|
189
186
|
// Creates a copy of the certificate with a new buffer
|
|
190
187
|
clone() {
|
package/dist/x509/cert.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"cert.js","sourceRoot":"","sources":["../../src/x509/cert.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;EAcE;AACF,OAAO,
|
|
1
|
+
{"version":3,"file":"cert.js","sourceRoot":"","sources":["../../src/x509/cert.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;EAcE;AACF,OAAO,EACL,OAAO,EACP,SAAS,EACT,KAAK,EACL,kBAAkB,EAClB,eAAe,EACf,eAAe,GAChB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAC1F,OAAO,EACL,2BAA2B,EAC3B,6BAA6B,EAC7B,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,qBAAqB,EACrB,gBAAgB,EAChB,mCAAmC,EACnC,yBAAyB,GAC1B,MAAM,UAAU,CAAC;AAElB,gEAAgE;AAChE,MAAM,4BAA4B,GAAG,WAAW,CAAC;AACjD,MAAM,uBAAuB,GAAG,WAAW,CAAC;AAC5C,MAAM,8BAA8B,GAAG,WAAW,CAAC;AACnD,MAAM,+BAA+B,GAAG,WAAW,CAAC;AACpD,MAAM,8BAA8B,GAAG,WAAW,CAAC;AACnD,MAAM,8BAA8B,GAAG,uBAAuB,CAAC;AAC/D,MAAM,8BAA8B,GAAG,uBAAuB,CAAC;AAE/D,MAAM,CAAC,MAAM,iBAAiB,GAAG,yBAAyB,CAAC;AAE3D,MAAM,OAAO,eAAe;IACnB,IAAI,CAAU;IAErB,YAAY,IAAa;QACvB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAEM,MAAM,CAAC,KAAK,CAAC,IAAyB;QAC3C,MAAM,GAAG,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC1D,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACtC,OAAO,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IAED,IAAI,cAAc;QAChB,OAAO,IAAI,CAAC,iBAAiB,CAAC;IAChC,CAAC;IAED,IAAI,OAAO;QACT,0EAA0E;QAC1E,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;QAChD,OAAO,IAAI,CAAC,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;IAC5C,CAAC;IAED,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC;IACpC,CAAC;IAED,IAAI,SAAS;QACX,0DAA0D;QAC1D,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC3C,CAAC;IAED,IAAI,QAAQ;QACV,0DAA0D;QAC1D,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC3C,CAAC;IAED,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;IAC9B,CAAC;IAED,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;IAC/B,CAAC;IAED,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,uBAAuB,CAAC,KAAK,EAAE,CAAC;IAC9C,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,eAAe,CAAC,OAAgB;QAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,uBAAuB,CAAC,KAAK,EAAE,CAAC;QACvD,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QAC5C,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;QAElD,sDAAsD;QACtD,IAAI,YAAY,KAAK,sBAAsB,EAAE,CAAC;YAC5C,oDAAoD;YACpD,MAAM,IAAI,GAAG,OAAO,IAAI,QAAQ,CAAC;YACjC,IAAI,MAAc,CAAC;YACnB,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzB,MAAM,GAAG,QAAQ,CAAC;YACpB,CAAC;iBAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBAChC,MAAM,GAAG,QAAQ,CAAC;YACpB,CAAC;iBAAM,CAAC;gBACN,MAAM,GAAG,QAAQ,CAAC;YACpB,CAAC;YACD,OAAO,SAAS,CAAC,QAAQ,CAAC,GAAG,EAAE,eAAe,MAAM,EAAE,EAAE,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAC;QACzF,CAAC;aAAM,CAAC;YACN,qDAAqD;YACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;YAC/C,MAAM,KAAK,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;YAC1C,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,KAAK,CAAC,4BAA4B,QAAQ,EAAE,CAAC,CAAC;YAC1D,CAAC;YACD,OAAO,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,EAAE,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IAED,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,eAAe,EAAE,CAAC;IAChC,CAAC;IAED,IAAI,kBAAkB;QACpB,MAAM,GAAG,GAAW,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;QAC/D,OAAO,qBAAqB,CAAC,GAAG,CAAC,CAAC;IACpC,CAAC;IAED,IAAI,cAAc;QAChB,qEAAqE;QACrE,OAAO,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAClD,CAAC;IAED,IAAI,cAAc;QAChB,MAAM,GAAG,GAAG,IAAI,CAAC,iBAAiB,CAAC;QACnC,OAAO,GAAG,EAAE,GAAG,IAAI,GAAG,EAAE,UAAU,CAAC;IACrC,CAAC;IAED,IAAI,UAAU;QACZ,uEAAuE;QACvE,uBAAuB;QACvB,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3C,OAAO,MAAM,EAAE,IAAI,IAAI,0BAA0B,CAAC,EAAE,CAAC;IACvD,CAAC;IAED,IAAI,WAAW;QACb,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,uBAAuB,CAAC,CAAC;QACxD,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1D,CAAC;IAED,IAAI,mBAAmB;QACrB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,+BAA+B,CAAC,CAAC;QAChE,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,6BAA6B,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAClE,CAAC;IAED,IAAI,iBAAiB;QACnB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,8BAA8B,CAAC,CAAC;QAC/D,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,mCAAmC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACxE,CAAC;IAED,IAAI,iBAAiB;QACnB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,8BAA8B,CAAC,CAAC;QAC/D,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,2BAA2B,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAChE,CAAC;IAED,IAAI,eAAe;QACjB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,4BAA4B,CAAC,CAAC;QAC7D,OAAO,GAAG;YACR,CAAC,CAAC,IAAI,yBAAyB,CAAC,GAAG,CAAC;YACpC,CAAC,CAAC,0BAA0B,CAAC,SAAS,CAAC;IAC3C,CAAC;IAED,IAAI,MAAM;QACR,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,iBAAiB,CAAC,CAAC;QAClD,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACrD,CAAC;IAED,IAAI,iBAAiB;QACnB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,8BAA8B,CAAC,CAAC;QAC/D,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvD,CAAC;IAED,IAAI,iBAAiB;QACnB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,8BAA8B,CAAC,CAAC;QAC/D,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvD,CAAC;IAED,IAAI,IAAI;QACN,MAAM,EAAE,GAAG,IAAI,CAAC,mBAAmB,EAAE,IAAI,IAAI,KAAK,CAAC;QAEnD,gEAAgE;QAChE,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,OAAO,EAAE,IAAI,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC;QAC5C,CAAC;QAED,OAAO,EAAE,CAAC;IACZ,CAAC;IAEM,SAAS,CAAC,GAAW;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QACpC,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAClD,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,iBAAmC;QACrD,yEAAyE;QACzE,6CAA6C;QAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;QAC7D,MAAM,OAAO,GAAG,mBAAmB,CAAC,SAAS,CAAC,IAAI,qBAAqB,CAAC,SAAS,CAAC,CAAC;QAEnF,+FAA+F;QAC/F,0EAA0E;QAC1E,MAAM,YAAY,GAAG,iBAAiB;YACpC,CAAC,CAAC,MAAM,iBAAiB,CAAC,eAAe,CAAC,OAAO,CAAC;YAClD,CAAC,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QAExC,OAAO,MAAM,eAAe,CAC1B,YAAY,EACZ,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,EAC3B,IAAI,CAAC,cAAc,EACnB,IAAI,CAAC,kBAAkB,CACxB,CAAC;IACJ,CAAC;IAEM,YAAY,CAAC,IAAU;QAC5B,OAAO,IAAI,CAAC,SAAS,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC;IACzD,CAAC;IAEM,MAAM,CAAC,KAAsB;QAClC,OAAO,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IAChE,CAAC;IAED,sDAAsD;IAC/C,KAAK;QACV,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;QAClC,OAAO,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACtC,CAAC;IAEO,aAAa,CAAC,GAAW;QAC/B,0EAA0E;QAC1E,oCAAoC;QACpC,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC;IACpE,CAAC;IAED,6EAA6E;IAC7E,2EAA2E;IAC3E,uBAAuB;IACvB,qDAAqD;IAErD,yDAAyD;IACzD,IAAY,iBAAiB;QAC3B,kEAAkE;QAClE,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;IAED,yDAAyD;IACzD,IAAY,qBAAqB;QAC/B,uEAAuE;QACvE,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;IAED,yDAAyD;IACzD,IAAY,iBAAiB;QAC3B,kEAAkE;QAClE,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;IAED,yDAAyD;IACzD,IAAY,UAAU;QACpB,8DAA8D;QAC9D,OAAO,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;IAED,yDAAyD;IACzD,IAAY,eAAe;QACzB,oEAAoE;QACpE,OAAO,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;IAED,yDAAyD;IACzD,IAAY,SAAS;QACnB,8DAA8D;QAC9D,OAAO,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;IAED,yDAAyD;IACzD,IAAY,WAAW;QACrB,8DAA8D;QAC9D,OAAO,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;IAED,yDAAyD;IACzD,IAAY,UAAU;QACpB,8DAA8D;QAC9D,OAAO,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;IAED,yDAAyD;IACzD,IAAY,uBAAuB;QACjC,6EAA6E;QAC7E,OAAO,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;IAED,+EAA+E;IAC/E,sDAAsD;IACtD,yDAAyD;IACzD,IAAY,aAAa;QACvB,OAAO,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAC9C,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAChC,CAAC;IACJ,CAAC;CACF"}
|
package/dist/x509/chain.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"chain.d.ts","sourceRoot":"","sources":["../../src/x509/chain.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"chain.d.ts","sourceRoot":"","sources":["../../src/x509/chain.ts"],"names":[],"mappings":"AA6BA,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAE5C,UAAU,+BAA+B;IACvC,YAAY,EAAE,eAAe,EAAE,CAAC;IAChC,aAAa,EAAE,eAAe,CAAC;IAC/B,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,qBAAa,wBAAwB;IACnC,OAAO,CAAC,aAAa,CAAkB;IACvC,OAAO,CAAC,YAAY,CAAoB;IACxC,OAAO,CAAC,UAAU,CAAoB;IACtC,OAAO,CAAC,SAAS,CAAO;gBAEZ,IAAI,EAAE,+BAA+B;IAUpC,MAAM,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;YAkBnC,IAAI;YAoBJ,UAAU;YA4BV,UAAU;IAkDxB,OAAO,CAAC,SAAS;CA8BlB"}
|
package/dist/x509/chain.js
CHANGED
|
@@ -13,7 +13,18 @@ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
|
13
13
|
See the License for the specific language governing permissions and
|
|
14
14
|
limitations under the License.
|
|
15
15
|
*/
|
|
16
|
-
|
|
16
|
+
/*
|
|
17
|
+
* Certificate chain verification for browser environments
|
|
18
|
+
*
|
|
19
|
+
* Ported from sigstore-js:
|
|
20
|
+
* https://github.com/sigstore/sigstore-js/blob/main/packages/verify/src/key/certificate.ts
|
|
21
|
+
*
|
|
22
|
+
* Key differences from sigstore-js:
|
|
23
|
+
* - Browser-compatible: async verify() method for Web Crypto API
|
|
24
|
+
* - Uses Uint8Array instead of Buffer for binary data
|
|
25
|
+
* - Uses uint8ArrayEqual for Uint8Array comparisons
|
|
26
|
+
*/
|
|
27
|
+
import { uint8ArrayEqual } from "@freedomofpress/crypto-browser";
|
|
17
28
|
export class CertificateChainVerifier {
|
|
18
29
|
untrustedCert;
|
|
19
30
|
trustedCerts;
|
|
@@ -69,7 +80,7 @@ export class CertificateChainVerifier {
|
|
|
69
80
|
async findIssuer(certificate) {
|
|
70
81
|
let issuers = [];
|
|
71
82
|
let keyIdentifier;
|
|
72
|
-
if (
|
|
83
|
+
if (uint8ArrayEqual(certificate.subject, certificate.issuer)) {
|
|
73
84
|
if (await certificate.verify()) {
|
|
74
85
|
return [certificate];
|
|
75
86
|
}
|
|
@@ -80,13 +91,13 @@ export class CertificateChainVerifier {
|
|
|
80
91
|
this.localCerts.forEach((possibleIssuer) => {
|
|
81
92
|
if (keyIdentifier) {
|
|
82
93
|
if (possibleIssuer.extSubjectKeyID) {
|
|
83
|
-
if (
|
|
94
|
+
if (uint8ArrayEqual(possibleIssuer.extSubjectKeyID.keyIdentifier, keyIdentifier)) {
|
|
84
95
|
issuers.push(possibleIssuer);
|
|
85
96
|
}
|
|
86
97
|
return;
|
|
87
98
|
}
|
|
88
99
|
}
|
|
89
|
-
if (
|
|
100
|
+
if (uint8ArrayEqual(possibleIssuer.subject, certificate.issuer)) {
|
|
90
101
|
issuers.push(possibleIssuer);
|
|
91
102
|
}
|
|
92
103
|
});
|
|
@@ -112,7 +123,7 @@ export class CertificateChainVerifier {
|
|
|
112
123
|
throw new Error("intermediate certificate is not a CA");
|
|
113
124
|
}
|
|
114
125
|
for (let i = path.length - 2; i >= 0; i--) {
|
|
115
|
-
if (!
|
|
126
|
+
if (!uint8ArrayEqual(path[i].issuer, path[i + 1].subject)) {
|
|
116
127
|
throw new Error("incorrect certificate name chaining");
|
|
117
128
|
}
|
|
118
129
|
}
|
package/dist/x509/chain.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"chain.js","sourceRoot":"","sources":["../../src/x509/chain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;EAcE;
|
|
1
|
+
{"version":3,"file":"chain.js","sourceRoot":"","sources":["../../src/x509/chain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;EAcE;AAEF;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AASjE,MAAM,OAAO,wBAAwB;IAC3B,aAAa,CAAkB;IAC/B,YAAY,CAAoB;IAChC,UAAU,CAAoB;IAC9B,SAAS,CAAO;IAExB,YAAY,IAAqC;QAC/C,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC;QACxC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;QACtC,IAAI,CAAC,UAAU,GAAG,kBAAkB,CAAC;YACnC,GAAG,IAAI,CAAC,YAAY;YACpB,IAAI,CAAC,aAAa;SACnB,CAAC,CAAC;QACH,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IAClC,CAAC;IAEM,KAAK,CAAC,MAAM;QACjB,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAE1C,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;QAEhC,MAAM,YAAY,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAClD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAClC,CAAC;QAEF,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CACb,2DAA2D,CAC5D,CAAC;QACJ,CAAC;QAED,OAAO,eAAe,CAAC;IACzB,CAAC;IAEO,KAAK,CAAC,IAAI;QAChB,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC;QAEpC,IAAI,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAE5C,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAC5B,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CACtD,CAAC;QAEF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACvD,CAAC;QAED,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CACvC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CACxC,CAAC;QAEF,OAAO,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1C,CAAC;IAEO,KAAK,CAAC,UAAU,CACtB,WAA4B;QAE5B,MAAM,KAAK,GAAG,EAAE,CAAC;QACjB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;QAEnD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACrD,CAAC;QAED,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACxC,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;YAE1B,IAAI,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC/B,KAAK,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;gBAC1B,SAAS;YACX,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;YAE/C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACzC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACvC,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,KAAK,CAAC,UAAU,CACtB,WAA4B;QAE5B,IAAI,OAAO,GAAsB,EAAE,CAAC;QACpC,IAAI,aAAqC,CAAC;QAE1C,IAAI,eAAe,CAAC,WAAW,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;YAC7D,IAAI,MAAM,WAAW,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC/B,OAAO,CAAC,WAAW,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;QAED,IAAI,WAAW,CAAC,iBAAiB,EAAE,CAAC;YAClC,aAAa,GAAG,WAAW,CAAC,iBAAiB,CAAC,aAAa,CAAC;QAC9D,CAAC;QAED,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,cAAc,EAAE,EAAE;YACzC,IAAI,aAAa,EAAE,CAAC;gBAClB,IAAI,cAAc,CAAC,eAAe,EAAE,CAAC;oBACnC,IACE,eAAe,CACb,cAAc,CAAC,eAAe,CAAC,aAAa,EAC5C,aAAa,CACd,EACD,CAAC;wBACD,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;oBAC/B,CAAC;oBACD,OAAO;gBACT,CAAC;YACH,CAAC;YAED,IAAI,eAAe,CAAC,cAAc,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;gBAChE,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YAC/B,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,MAAM,eAAe,GAAsB,EAAE,CAAC;QAC9C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,CAAC;gBACH,IAAI,MAAM,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;oBACrC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAC/B,CAAC;YACH,CAAC;YAAC,OAAO,EAAE,EAAE,CAAC;gBACZ,+BAA+B;YACjC,CAAC;QACH,CAAC;QAED,OAAO,eAAe,CAAC;IACzB,CAAC;IAEO,SAAS,CAAC,IAAuB;QACvC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CACb,yDAAyD,CAC1D,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,CAAC;QAED,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC1C,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC1D,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;YACzD,CAAC;QACH,CAAC;QAED,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YAErB,IAAI,IAAI,CAAC,mBAAmB,EAAE,IAAI,EAAE,CAAC;gBACnC,MAAM,UAAU,GAAG,IAAI,CAAC,mBAAmB,CAAC,iBAAiB,CAAC;gBAE9D,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;oBAC3D,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;gBACrD,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;CACF;AAED,SAAS,kBAAkB,CAAC,KAAwB;IAClD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC1C,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9B,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;gBACnB,CAAC,EAAE,CAAC;YACN,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}
|
package/dist/x509/ext.d.ts
CHANGED
package/dist/x509/ext.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"ext.d.ts","sourceRoot":"","sources":["../../src/x509/ext.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,OAAO,
|
|
1
|
+
{"version":3,"file":"ext.d.ts","sourceRoot":"","sources":["../../src/x509/ext.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,OAAO,EAAkC,MAAM,gCAAgC,CAAC;AACzF,OAAO,EAAE,0BAA0B,EAAE,MAAM,UAAU,CAAC;AAGtD,qBAAa,aAAa;IACxB,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC;gBAEZ,IAAI,EAAE,OAAO;IAIzB,IAAI,GAAG,IAAI,MAAM,CAEhB;IAED,IAAI,QAAQ,IAAI,OAAO,CAItB;IAED,IAAI,KAAK,IAAI,UAAU,CAEtB;IAED,IAAI,QAAQ,IAAI,OAAO,CAEtB;IAED,SAAS,KAAK,YAAY,IAAI,OAAO,CAGpC;CACF;AAGD,qBAAa,6BAA8B,SAAQ,aAAa;IAC9D,IAAI,IAAI,IAAI,OAAO,CAElB;IAED,IAAI,iBAAiB,IAAI,MAAM,GAAG,SAAS,CAI1C;IAID,OAAO,KAAK,QAAQ,GAEnB;CACF;AAGD,qBAAa,qBAAsB,SAAQ,aAAa;IACtD,IAAI,gBAAgB,IAAI,OAAO,CAE9B;IAED,IAAI,WAAW,IAAI,OAAO,CAEzB;IAED,IAAI,OAAO,IAAI,OAAO,CAErB;IAID,OAAO,KAAK,SAAS,GAEpB;CACF;AAGD,qBAAa,mCAAoC,SAAQ,aAAa;IACpE,IAAI,UAAU,IAAI,MAAM,GAAG,SAAS,CAOnC;IAED,IAAI,GAAG,IAAI,MAAM,GAAG,SAAS,CAO5B;IAGM,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAmBjD,OAAO,CAAC,eAAe;IAKvB,OAAO,KAAK,YAAY,GAEvB;CACF;AAGD,qBAAa,2BAA4B,SAAQ,aAAa;IAC5D,IAAI,aAAa,IAAI,UAAU,GAAG,SAAS,CAE1C;IAED,OAAO,CAAC,kBAAkB;IAK1B,OAAO,KAAK,QAAQ,GAEnB;CACF;AAGD,qBAAa,yBAA0B,SAAQ,aAAa;IAC1D,IAAI,aAAa,IAAI,UAAU,CAE9B;CACF;AAID,qBAAa,kBAAmB,SAAQ,aAAa;IACnD,IAAI,MAAM,IAAI,MAAM,CAEnB;CACF;AAID,qBAAa,kBAAmB,SAAQ,aAAa;IACnD,IAAI,MAAM,IAAI,MAAM,CAEnB;CACF;AAGD,qBAAa,gBAAiB,SAAQ,aAAa;gBACrC,IAAI,EAAE,OAAO;IAIzB,IAAI,2BAA2B,IAAI,0BAA0B,EAAE,CAuB9D;CACF"}
|
package/dist/x509/ext.js
CHANGED
|
@@ -1,5 +1,19 @@
|
|
|
1
|
-
|
|
2
|
-
|
|
1
|
+
/*
|
|
2
|
+
Copyright 2023 The Sigstore Authors.
|
|
3
|
+
|
|
4
|
+
Licensed under the Apache License, Version 2.0 (the "License");
|
|
5
|
+
you may not use this file except in compliance with the License.
|
|
6
|
+
You may obtain a copy of the License at
|
|
7
|
+
|
|
8
|
+
http://www.apache.org/licenses/LICENSE-2.0
|
|
9
|
+
|
|
10
|
+
Unless required by applicable law or agreed to in writing, software
|
|
11
|
+
distributed under the License is distributed on an "AS IS" BASIS,
|
|
12
|
+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
13
|
+
See the License for the specific language governing permissions and
|
|
14
|
+
limitations under the License.
|
|
15
|
+
*/
|
|
16
|
+
import { ByteStream, Uint8ArrayToString } from "@freedomofpress/crypto-browser";
|
|
3
17
|
import { SignedCertificateTimestamp } from "./sct.js";
|
|
4
18
|
// https://www.rfc-editor.org/rfc/rfc5280#section-4.1
|
|
5
19
|
export class X509Extension {
|
|
@@ -143,7 +157,7 @@ export class X509SCTExtension extends X509Extension {
|
|
|
143
157
|
}
|
|
144
158
|
get signedCertificateTimestamps() {
|
|
145
159
|
const buf = this.extnValueObj.subs[0].value;
|
|
146
|
-
const stream = new ByteStream(
|
|
160
|
+
const stream = new ByteStream(buf);
|
|
147
161
|
// The overall list length is encoded in the first two bytes -- note this
|
|
148
162
|
// is the length of the list in bytes, NOT the number of SCTs in the list
|
|
149
163
|
const end = stream.getUint16() + 2;
|
package/dist/x509/ext.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"ext.js","sourceRoot":"","sources":["../../src/x509/ext.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"ext.js","sourceRoot":"","sources":["../../src/x509/ext.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;EAcE;AACF,OAAO,EAAW,UAAU,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AACzF,OAAO,EAAE,0BAA0B,EAAE,MAAM,UAAU,CAAC;AAEtD,qDAAqD;AACrD,MAAM,OAAO,aAAa;IACd,IAAI,CAAU;IAExB,YAAY,IAAa;QACvB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,IAAI,GAAG;QACL,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;IACnC,CAAC;IAED,IAAI,QAAQ;QACV,uEAAuE;QACvE,kEAAkE;QAClE,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;IAC7E,CAAC;IAED,IAAI,KAAK;QACP,OAAO,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC;IACjC,CAAC;IAED,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED,IAAc,YAAY;QACxB,yEAAyE;QACzE,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACnD,CAAC;CACF;AAED,yDAAyD;AACzD,MAAM,OAAO,6BAA8B,SAAQ,aAAa;IAC9D,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,KAAK,CAAC;IACrD,CAAC;IAED,IAAI,iBAAiB;QACnB,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;YAClC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE;YACnC,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IAED,uEAAuE;IACvE,qBAAqB;IACrB,IAAY,QAAQ;QAClB,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACnC,CAAC;CACF;AAED,yDAAyD;AACzD,MAAM,OAAO,qBAAsB,SAAQ,aAAa;IACtD,IAAI,gBAAgB;QAClB,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;IAED,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;IAED,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;IAED,uEAAuE;IACvE,2CAA2C;IAC3C,IAAY,SAAS;QACnB,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IACjD,CAAC;CACF;AAED,yDAAyD;AACzD,MAAM,OAAO,mCAAoC,SAAQ,aAAa;IACpE,IAAI,UAAU;QACZ,MAAM,UAAU,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC;QACrD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,SAAS,CAAC;QACnB,CAAC;aAAM,CAAC;YACN,OAAO,kBAAkB,CAAC,UAAU,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;IAED,IAAI,GAAG;QACL,MAAM,GAAG,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC;QAC9C,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,OAAO,SAAS,CAAC;QACnB,CAAC;aAAM,CAAC;YACN,OAAO,kBAAkB,CAAC,GAAG,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IAED,yDAAyD;IAClD,SAAS,CAAC,GAAW;QAC1B,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QAE7C,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,6DAA6D;QAC7D,gEAAgE;QAChE,MAAM,YAAY,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;QAC/C,IAAI,YAAY,KAAK,GAAG,EAAE,CAAC;YACzB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,gEAAgE;QAChE,MAAM,cAAc,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACzC,OAAO,kBAAkB,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC1D,CAAC;IAEO,eAAe,CAAC,GAAW;QACjC,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC;IACvE,CAAC;IAED,2DAA2D;IAC3D,IAAY,YAAY;QACtB,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACxC,CAAC;CACF;AAED,yDAAyD;AACzD,MAAM,OAAO,2BAA4B,SAAQ,aAAa;IAC5D,IAAI,aAAa;QACf,OAAO,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC;IAC9C,CAAC;IAEO,kBAAkB,CAAC,GAAW;QACpC,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC;IACxE,CAAC;IAED,4EAA4E;IAC5E,IAAY,QAAQ;QAClB,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACnC,CAAC;CACF;AAED,yDAAyD;AACzD,MAAM,OAAO,yBAA0B,SAAQ,aAAa;IAC1D,IAAI,aAAa;QACf,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACzC,CAAC;CACF;AAED,yDAAyD;AACzD,4CAA4C;AAC5C,MAAM,OAAO,kBAAmB,SAAQ,aAAa;IACnD,IAAI,MAAM;QACR,OAAO,kBAAkB,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;IACrD,CAAC;CACF;AAED,yDAAyD;AACzD,sDAAsD;AACtD,MAAM,OAAO,kBAAmB,SAAQ,aAAa;IACnD,IAAI,MAAM;QACR,OAAO,kBAAkB,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC7D,CAAC;CACF;AAED,qDAAqD;AACrD,MAAM,OAAO,gBAAiB,SAAQ,aAAa;IACjD,YAAY,IAAa;QACvB,KAAK,CAAC,IAAI,CAAC,CAAC;IACd,CAAC;IAED,IAAI,2BAA2B;QAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAC5C,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;QAEnC,yEAAyE;QACzE,yEAAyE;QACzE,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAEnC,MAAM,OAAO,GAAiC,EAAE,CAAC;QACjD,OAAO,MAAM,CAAC,QAAQ,GAAG,GAAG,EAAE,CAAC;YAC7B,kCAAkC;YAClC,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;YAErC,oDAAoD;YACpD,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;YACvC,OAAO,CAAC,IAAI,CAAC,0BAA0B,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QACtD,CAAC;QAED,IAAI,MAAM,CAAC,QAAQ,KAAK,GAAG,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAClE,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;CACF"}
|
package/dist/x509/sct.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"sct.d.ts","sourceRoot":"","sources":["../../src/x509/sct.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"sct.d.ts","sourceRoot":"","sources":["../../src/x509/sct.ts"],"names":[],"mappings":"AAiBA,UAAU,UAAU;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,UAAU,CAAC;IAClB,SAAS,EAAE,UAAU,CAAC;IACtB,UAAU,EAAE,UAAU,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,SAAS,EAAE,UAAU,CAAC;CACvB;AAED,qBAAa,0BAA0B;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;IAC/B,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;gBAEnB,OAAO,EAAE,UAAU;IAU/B,IAAI,QAAQ,IAAI,IAAI,CAEnB;IAID,IAAI,SAAS,IAAI,MAAM,CA0BtB;IAEY,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC;WA8B5D,KAAK,CAAC,GAAG,EAAE,UAAU,GAAG,0BAA0B;CAyCjE"}
|
package/dist/x509/sct.js
CHANGED
|
@@ -13,9 +13,7 @@ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
|
13
13
|
See the License for the specific language governing permissions and
|
|
14
14
|
limitations under the License.
|
|
15
15
|
*/
|
|
16
|
-
import { verifySignature } from "
|
|
17
|
-
import { readBigInt64BE, toArrayBuffer } from "../encoding.js";
|
|
18
|
-
import { ByteStream } from "../stream.js";
|
|
16
|
+
import { ByteStream, readBigInt64BE, verifySignature } from "@freedomofpress/crypto-browser";
|
|
19
17
|
export class SignedCertificateTimestamp {
|
|
20
18
|
version;
|
|
21
19
|
logID;
|
|
@@ -88,7 +86,7 @@ export class SignedCertificateTimestamp {
|
|
|
88
86
|
// https://www.rfc-editor.org/rfc/rfc6962#section-3.2
|
|
89
87
|
// https://www.rfc-editor.org/rfc/rfc5246#section-7.4.1.4.1
|
|
90
88
|
static parse(buf) {
|
|
91
|
-
const stream = new ByteStream(
|
|
89
|
+
const stream = new ByteStream(buf);
|
|
92
90
|
// Version - enum { v1(0), (255) }
|
|
93
91
|
const version = stream.getUint8();
|
|
94
92
|
// Log ID - struct { opaque key_id[32]; }
|
package/dist/x509/sct.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"sct.js","sourceRoot":"","sources":["../../src/x509/sct.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;EAcE;AACF,OAAO,EAAE,
|
|
1
|
+
{"version":3,"file":"sct.js","sourceRoot":"","sources":["../../src/x509/sct.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;EAcE;AACF,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAY7F,MAAM,OAAO,0BAA0B;IAC5B,OAAO,CAAS;IAChB,KAAK,CAAa;IAClB,SAAS,CAAa;IACtB,UAAU,CAAa;IACvB,aAAa,CAAS;IACtB,kBAAkB,CAAS;IAC3B,SAAS,CAAa;IAE/B,YAAY,OAAmB;QAC7B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC3B,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;QAC3C,IAAI,CAAC,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC;QACrD,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;IACrC,CAAC;IAED,IAAI,QAAQ;QACV,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAC1D,CAAC;IAED,mEAAmE;IACnE,2DAA2D;IAC3D,IAAI,SAAS;QACX,QAAQ,IAAI,CAAC,aAAa,EAAE,CAAC;YAC3B,0BAA0B;YAC1B,KAAK,CAAC;gBACJ,OAAO,MAAM,CAAC;YAChB,0BAA0B;YAC1B,KAAK,CAAC;gBACJ,OAAO,KAAK,CAAC;YACf,0BAA0B;YAC1B,KAAK,CAAC;gBACJ,OAAO,MAAM,CAAC;YAChB,0BAA0B;YAC1B,KAAK,CAAC;gBACJ,OAAO,QAAQ,CAAC;YAClB,KAAK,CAAC;gBACJ,OAAO,QAAQ,CAAC;YAClB,0BAA0B;YAC1B,KAAK,CAAC;gBACJ,OAAO,QAAQ,CAAC;YAClB,0BAA0B;YAC1B,KAAK,CAAC;gBACJ,OAAO,QAAQ,CAAC;YAClB,0BAA0B;YAC1B;gBACE,OAAO,SAAS,CAAC;QACrB,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,OAAmB,EAAE,GAAc;QACrD,0EAA0E;QAC1E,kBAAkB;QAClB,qDAAqD;QACrD,MAAM,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAChC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAChC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,2CAA2C;QACpE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAClC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,kCAAkC;QAC7D,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAC3B,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QAEhD,yDAAyD;QACzD,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,GAAG,CAAC,EAAE,CAAC;YACnC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACrC,CAAC;QAED,OAAO,MAAM,eAAe,CAC1B,GAAG,EACH,MAAM,CAAC,MAAM,EACb,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,SAAS,CACf,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,qEAAqE;IACrE,8CAA8C;IAC9C,qDAAqD;IACrD,2DAA2D;IACpD,MAAM,CAAC,KAAK,CAAC,GAAe;QACjC,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;QAEnC,kCAAkC;QAClC,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;QAElC,0CAA0C;QAC1C,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAElC,qBAAqB;QACrB,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAErC,6CAA6C;QAC7C,MAAM,gBAAgB,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;QAC5C,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QAErD,8CAA8C;QAC9C,MAAM,aAAa,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;QAExC,0EAA0E;QAC1E,MAAM,kBAAkB,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;QAE7C,4CAA4C;QAC5C,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;QACrC,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAE7C,uCAAuC;QACvC,IAAI,MAAM,CAAC,QAAQ,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,CAAC;QAED,OAAO,IAAI,0BAA0B,CAAC;YACpC,OAAO;YACP,KAAK;YACL,SAAS;YACT,UAAU;YACV,aAAa;YACb,kBAAkB;YAClB,SAAS;SACV,CAAC,CAAC;IACL,CAAC;CACF"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@freedomofpress/sigstore-browser",
|
|
3
|
-
"version": "0.1.
|
|
3
|
+
"version": "0.1.1",
|
|
4
4
|
"description": "A minimal browser-only Sigstore verification library.",
|
|
5
5
|
"main": "dist/index.js",
|
|
6
6
|
"type": "module",
|
|
@@ -33,7 +33,8 @@
|
|
|
33
33
|
"vitest": "^3.2.4"
|
|
34
34
|
},
|
|
35
35
|
"dependencies": {
|
|
36
|
-
"@
|
|
37
|
-
"tuf-browser": "^0.1.
|
|
36
|
+
"@freedomofpress/crypto-browser": "^0.1.4",
|
|
37
|
+
"@freedomofpress/tuf-browser": "^0.1.5",
|
|
38
|
+
"@noble/curves": "^2.0.1"
|
|
38
39
|
}
|
|
39
40
|
}
|
package/src/cli.ts
CHANGED
|
@@ -3,8 +3,13 @@ import { createHash, webcrypto } from "node:crypto";
|
|
|
3
3
|
import { access, readFile } from "node:fs/promises";
|
|
4
4
|
import path from "node:path";
|
|
5
5
|
|
|
6
|
+
import {
|
|
7
|
+
base64ToUint8Array,
|
|
8
|
+
hexToUint8Array,
|
|
9
|
+
Uint8ArrayToHex,
|
|
10
|
+
Uint8ArrayToString,
|
|
11
|
+
} from "@freedomofpress/crypto-browser";
|
|
6
12
|
import { SigstoreBundle } from "./bundle.js";
|
|
7
|
-
import { base64ToUint8Array, hexToUint8Array, Uint8ArrayToHex, Uint8ArrayToString } from "./encoding.js";
|
|
8
13
|
import { TrustedRoot } from "./interfaces.js";
|
|
9
14
|
import { SigstoreVerifier } from "./sigstore.js";
|
|
10
15
|
import { TrustedRootProvider } from "./trust/tuf.js";
|
package/src/interfaces.ts
CHANGED
|
@@ -99,20 +99,5 @@ export interface RawCA {
|
|
|
99
99
|
|
|
100
100
|
export type RawCAs = RawCA[];
|
|
101
101
|
|
|
102
|
-
export
|
|
103
|
-
|
|
104
|
-
Ed25519 = "Ed25519",
|
|
105
|
-
RSA = "RSA",
|
|
106
|
-
}
|
|
107
|
-
|
|
108
|
-
export enum EcdsaTypes {
|
|
109
|
-
P256 = "P-256",
|
|
110
|
-
P384 = "P-384",
|
|
111
|
-
P521 = "P-521",
|
|
112
|
-
}
|
|
113
|
-
|
|
114
|
-
export enum HashAlgorithms {
|
|
115
|
-
SHA256 = "SHA-256",
|
|
116
|
-
SHA384 = "SHA-384",
|
|
117
|
-
SHA512 = "SHA-512",
|
|
118
|
-
}
|
|
102
|
+
// Re-export crypto enums from crypto-browser (shared with tuf-browser)
|
|
103
|
+
export { KeyTypes, EcdsaTypes, HashAlgorithms } from "@freedomofpress/crypto-browser";
|
package/src/rfc3161/timestamp.ts
CHANGED
|
@@ -13,9 +13,7 @@ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
|
13
13
|
See the License for the specific language governing permissions and
|
|
14
14
|
limitations under the License.
|
|
15
15
|
*/
|
|
16
|
-
import { ASN1Obj } from "
|
|
17
|
-
import { bufferEqual, verifySignature } from "../crypto.js";
|
|
18
|
-
import { toArrayBuffer } from "../encoding.js";
|
|
16
|
+
import { ASN1Obj, uint8ArrayEqual, verifySignature } from "@freedomofpress/crypto-browser";
|
|
19
17
|
import { HashAlgorithms } from "../interfaces.js";
|
|
20
18
|
import { ECDSA_SIGNATURE_ALGOS, RSA_SIGNATURE_ALGOS, SHA2_HASH_ALGOS } from "../oid.js";
|
|
21
19
|
import { RFC3161TimestampVerificationError } from "./error.js";
|
|
@@ -123,11 +121,11 @@ export class RFC3161Timestamp {
|
|
|
123
121
|
|
|
124
122
|
const tstInfoDigest = await crypto.subtle.digest(
|
|
125
123
|
hashAlgName,
|
|
126
|
-
|
|
124
|
+
this.tstInfo.raw as Uint8Array<ArrayBuffer>,
|
|
127
125
|
);
|
|
128
126
|
const expectedDigest = this.messageDigestAttributeObj.subs[1].subs[0].value;
|
|
129
127
|
|
|
130
|
-
if (!
|
|
128
|
+
if (!uint8ArrayEqual(new Uint8Array(tstInfoDigest), expectedDigest)) {
|
|
131
129
|
throw new RFC3161TimestampVerificationError(
|
|
132
130
|
"signed data does not match tstInfo",
|
|
133
131
|
);
|
package/src/rfc3161/tstinfo.ts
CHANGED
|
@@ -13,9 +13,7 @@ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
|
13
13
|
See the License for the specific language governing permissions and
|
|
14
14
|
limitations under the License.
|
|
15
15
|
*/
|
|
16
|
-
import { ASN1Obj } from "
|
|
17
|
-
import { bufferEqual } from "../crypto.js";
|
|
18
|
-
import { toArrayBuffer } from "../encoding.js";
|
|
16
|
+
import { ASN1Obj, uint8ArrayEqual } from "@freedomofpress/crypto-browser";
|
|
19
17
|
import { HashAlgorithms } from "../interfaces.js";
|
|
20
18
|
import { SHA2_HASH_ALGOS } from "../oid.js";
|
|
21
19
|
import { RFC3161TimestampVerificationError } from "./error.js";
|
|
@@ -62,10 +60,10 @@ export class TSTInfo {
|
|
|
62
60
|
|
|
63
61
|
const digest = await crypto.subtle.digest(
|
|
64
62
|
hashAlgName,
|
|
65
|
-
|
|
63
|
+
data as Uint8Array<ArrayBuffer>,
|
|
66
64
|
);
|
|
67
65
|
if (
|
|
68
|
-
!
|
|
66
|
+
!uint8ArrayEqual(new Uint8Array(digest), this.messageImprintHashedMessage)
|
|
69
67
|
) {
|
|
70
68
|
throw new RFC3161TimestampVerificationError(
|
|
71
69
|
"message imprint does not match artifact",
|