@freedomofpress/sigstore-browser 0.1.0 → 0.1.1

package/src/asn1/index.ts

@@ -1,16 +0,0 @@
-/*
-Copyright 2023 The Sigstore Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-export { ASN1Obj } from "./obj.js";

package/src/asn1/length.ts

@@ -1,71 +0,0 @@
-/*
-Copyright 2023 The Sigstore Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-import { ByteStream } from "../stream.js";
-import { ASN1ParseError } from "./error.js";
-
-// Decodes the length of a DER-encoded ANS.1 element from the supplied stream.
-// https://learn.microsoft.com/en-us/windows/win32/seccertenroll/about-encoded-length-and-value-bytes
-export function decodeLength(stream: ByteStream): number {
-  const buf = stream.getUint8();
-
-  // If the most significant bit is UNSET the length is just the value of the
-  // byte.
-  if ((buf & 0x80) === 0x00) {
-    return buf;
-  }
-
-  // Otherwise, the lower 7 bits of the first byte indicate the number of bytes
-  // that follow to encode the length.
-  const byteCount = buf & 0x7f;
-
-  // Ensure the encoded length can safely fit in a JS number.
-  if (byteCount > 6) {
-    throw new ASN1ParseError("length exceeds 6 byte limit");
-  }
-
-  // Iterate over the bytes that encode the length.
-  let len = 0;
-  for (let i = 0; i < byteCount; i++) {
-    len = len * 256 + stream.getUint8();
-  }
-
-  // This is a valid ASN.1 length encoding, but we don't support it.
-  if (len === 0) {
-    throw new ASN1ParseError("indefinite length encoding not supported");
-  }
-
-  return len;
-}
-
-// Translates the supplied value to a DER-encoded length.
-export function encodeLength(len: number): Uint8Array {
-  if (len < 128) {
-    return new Uint8Array([len]);
-  }
-
-  // Bitwise operations on large numbers are not supported in JS, so we need to
-  // use BigInts.
-  let val = BigInt(len);
-  const bytes = [];
-
-  while (val > 0n) {
-    bytes.unshift(Number(val & 255n));
-    val = val >> 8n;
-  }
-
-  return new Uint8Array([0x80 | bytes.length, ...bytes]);
-}

package/src/asn1/obj.ts

@@ -1,184 +0,0 @@
-/*
-Copyright 2023 The Sigstore Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-import { toArrayBuffer } from "../encoding.js";
-import { ByteStream } from "../stream.js";
-import { ASN1ParseError, ASN1TypeError } from "./error.js";
-import { decodeLength, encodeLength } from "./length.js";
-import {
-  parseBitString,
-  parseBoolean,
-  parseInteger,
-  parseOID,
-  parseTime,
-} from "./parse.js";
-import { ASN1Tag } from "./tag.js";
-
-export class ASN1Obj {
-  readonly tag: ASN1Tag;
-  readonly subs: ASN1Obj[];
-  readonly value: Uint8Array;
-
-  constructor(tag: ASN1Tag, value: Uint8Array, subs: ASN1Obj[]) {
-    this.tag = tag;
-    this.value = value;
-    this.subs = subs;
-  }
-
-  // Constructs an ASN.1 object from a Buffer of DER-encoded bytes.
-  public static parseBuffer(buf: Uint8Array): ASN1Obj {
-    return parseStream(new ByteStream(toArrayBuffer(buf)));
-  }
-
-  public toDER(): Uint8Array {
-    const valueStream = new ByteStream();
-
-    if (this.subs.length > 0) {
-      for (const sub of this.subs) {
-        valueStream.appendView(sub.toDER());
-      }
-    } else {
-      valueStream.appendView(this.value);
-    }
-
-    const value = valueStream.buffer;
-
-    // Concat tag/length/value
-    const obj = new ByteStream();
-    obj.appendChar(this.tag.toDER());
-    obj.appendView(encodeLength(value.length));
-    obj.appendView(value);
-
-    return obj.buffer;
-  }
-
-  /////////////////////////////////////////////////////////////////////////////
-  // Convenience methods for parsing ASN.1 primitives into JS types
-
-  // Returns the ASN.1 object's value as a boolean. Throws an error if the
-  // object is not a boolean.
-  public toBoolean(): boolean {
-    if (!this.tag.isBoolean()) {
-      throw new ASN1TypeError("not a boolean");
-    }
-
-    return parseBoolean(this.value);
-  }
-
-  // Returns the ASN.1 object's value as a BigInt. Throws an error if the
-  // object is not an integer.
-  public toInteger(): bigint {
-    if (!this.tag.isInteger()) {
-      throw new ASN1TypeError("not an integer");
-    }
-
-    return parseInteger(this.value);
-  }
-
-  // Returns the ASN.1 object's value as an OID string. Throws an error if the
-  // object is not an OID.
-  public toOID(): string {
-    if (!this.tag.isOID()) {
-      throw new ASN1TypeError("not an OID");
-    }
-
-    return parseOID(this.value);
-  }
-
-  // Returns the ASN.1 object's value as a Date. Throws an error if the object
-  // is not either a UTCTime or a GeneralizedTime.
-  public toDate(): Date {
-    switch (true) {
-      case this.tag.isUTCTime():
-        return parseTime(this.value, true);
-      case this.tag.isGeneralizedTime():
-        return parseTime(this.value, false);
-      default:
-        throw new ASN1TypeError("not a date");
-    }
-  }
-
-  // Returns the ASN.1 object's value as a number[] where each number is the
-  // value of a bit in the bit string. Throws an error if the object is not a
-  // bit string.
-  public toBitString(): number[] {
-    if (!this.tag.isBitString()) {
-      throw new ASN1TypeError("not a bit string");
-    }
-
-    return parseBitString(this.value);
-  }
-}
-
-/////////////////////////////////////////////////////////////////////////////
-// Internal stream parsing functions
-
-function parseStream(stream: ByteStream): ASN1Obj {
-  // Parse tag, length, and value from stream
-  const tag = new ASN1Tag(stream.getUint8());
-  const len = decodeLength(stream);
-  const value = stream.slice(stream.position, len);
-
-  const start = stream.position;
-
-  let subs: ASN1Obj[] = [];
-  // If the object is constructed, parse its children. Sometimes, children
-  // are embedded in OCTESTRING objects, so we need to check those
-  // for children as well.
-  if (tag.constructed) {
-    subs = collectSubs(stream, len);
-  } else if (tag.isOctetString()) {
-    // Attempt to parse children of OCTETSTRING objects. If anything fails,
-    // assume the object is not constructed and treat as primitive.
-    try {
-      subs = collectSubs(stream, len);
-    } catch {
-      // Fail silently and treat as primitive
-    }
-  }
-
-  // If there are no children, move stream cursor to the end of the object
-  if (subs.length === 0) {
-    stream.seek(start + len);
-  }
-
-  return new ASN1Obj(tag, value, subs);
-}
-
-function collectSubs(stream: ByteStream, len: number): ASN1Obj[] {
-  // Calculate end of object content
-  const end = stream.position + len;
-
-  // Make sure there are enough bytes left in the stream. This should never
-  // happen, cause it'll get caught when the stream is sliced in parseStream.
-  // Leaving as an extra check just in case.
-  /* istanbul ignore if */
-  if (end > stream.length) {
-    throw new ASN1ParseError("invalid length");
-  }
-
-  // Parse all children
-  const subs: ASN1Obj[] = [];
-  while (stream.position < end) {
-    subs.push(parseStream(stream));
-  }
-
-  // When we're done parsing children, we should be at the end of the object
-  if (stream.position !== end) {
-    throw new ASN1ParseError("invalid length");
-  }
-
-  return subs;
-}

package/src/asn1/parse.ts

@@ -1,146 +0,0 @@
-/*
-Copyright 2023 The Sigstore Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-import { Uint8ArrayToString } from "../encoding.js";
-
-const RE_TIME_SHORT_YEAR =
-  /^(\d{2})(\d{2})(\d{2})(\d{2})(\d{2})(\d{2})(\.\d{3})?Z$/;
-const RE_TIME_LONG_YEAR =
-  /^(\d{4})(\d{2})(\d{2})(\d{2})(\d{2})(\d{2})(\.\d{3})?Z$/;
-
-// Parse a BigInt from the DER-encoded buffer
-// https://learn.microsoft.com/en-us/windows/win32/seccertenroll/about-integer
-export function parseInteger(buf: Uint8Array): bigint {
-  let pos = 0;
-  const end = buf.length;
-  let val = buf[pos];
-  const neg = val > 0x7f;
-
-  // Consume any padding bytes
-  const pad = neg ? 0xff : 0x00;
-  while (val == pad && ++pos < end) {
-    val = buf[pos];
-  }
-
-  // Calculate remaining bytes to read
-  const len = end - pos;
-
-  if (len === 0) return BigInt(neg ? -1 : 0);
-
-  // Handle two's complement for negative numbers
-  val = neg ? val - 256 : val;
-
-  // Parse remaining bytes
-  let n = BigInt(val);
-  for (let i = pos + 1; i < end; ++i) {
-    n = n * BigInt(256) + BigInt(buf[i]);
-  }
-
-  return n;
-}
-
-// Parse an ASCII string from the DER-encoded buffer
-// https://learn.microsoft.com/en-us/windows/win32/seccertenroll/about-basic-types#boolean
-export function parseStringASCII(buf: Uint8Array): string {
-  return Uint8ArrayToString(buf);
-}
-
-// Parse a Date from the DER-encoded buffer
-// https://www.rfc-editor.org/rfc/rfc5280#section-4.1.2.5.1
-export function parseTime(buf: Uint8Array, shortYear: boolean): Date {
-  const timeStr = parseStringASCII(buf);
-
-  // Parse the time string into matches - captured groups start at index 1
-  const m = shortYear
-    ? RE_TIME_SHORT_YEAR.exec(timeStr)
-    : RE_TIME_LONG_YEAR.exec(timeStr);
-
-  if (!m) {
-    throw new Error("invalid time");
-  }
-
-  // Translate dates with a 2-digit year to 4 digits per the spec
-  if (shortYear) {
-    let year = Number(m[1]);
-    year += year >= 50 ? 1900 : 2000;
-    m[1] = year.toString();
-  }
-
-  // Translate to ISO8601 format and parse
-  return new Date(`${m[1]}-${m[2]}-${m[3]}T${m[4]}:${m[5]}:${m[6]}Z`);
-}
-
-// Parse an OID from the DER-encoded buffer
-// https://learn.microsoft.com/en-us/windows/win32/seccertenroll/about-object-identifier
-export function parseOID(buf: Uint8Array): string {
-  let pos = 0;
-  const end = buf.length;
-
-  // Consume first byte which encodes the first two OID components
-  let n = buf[pos++];
-  const first = Math.floor(n / 40);
-  const second = n % 40;
-
-  let oid = `${first}.${second}`;
-
-  // Consume remaining bytes
-  let val = 0;
-  for (; pos < end; ++pos) {
-    n = buf[pos];
-    val = (val << 7) + (n & 0x7f);
-
-    // If the left-most bit is NOT set, then this is the last byte in the
-    // sequence and we can add the value to the OID and reset the accumulator
-    if ((n & 0x80) === 0) {
-      oid += `.${val}`;
-      val = 0;
-    }
-  }
-
-  return oid;
-}
-
-// Parse a boolean from the DER-encoded buffer
-// https://learn.microsoft.com/en-us/windows/win32/seccertenroll/about-basic-types#boolean
-export function parseBoolean(buf: Uint8Array): boolean {
-  return buf[0] !== 0;
-}
-
-// Parse a bit string from the DER-encoded buffer
-// https://learn.microsoft.com/en-us/windows/win32/seccertenroll/about-bit-string
-export function parseBitString(buf: Uint8Array): number[] {
-  // First byte tell us how many unused bits are in the last byte
-  const unused = buf[0];
-
-  const start = 1;
-  const end = buf.length;
-  const bits = [];
-
-  for (let i = start; i < end; ++i) {
-    const byte = buf[i];
-
-    // The skip value is only used for the last byte
-    const skip = i === end - 1 ? unused : 0;
-
-    // Iterate over each bit in the byte (most significant first)
-    for (let j = 7; j >= skip; --j) {
-      // Read the bit and add it to the bit string
-      bits.push((byte >> j) & 0x01);
-    }
-  }
-
-  return bits;
-}

package/src/asn1/tag.ts

@@ -1,105 +0,0 @@
-/*
-Copyright 2023 The Sigstore Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-import { ASN1ParseError } from "./error.js";
-
-const UNIVERSAL_TAG = {
-  BOOLEAN: 0x01,
-  INTEGER: 0x02,
-  BIT_STRING: 0x03,
-  OCTET_STRING: 0x04,
-  OBJECT_IDENTIFIER: 0x06,
-  SEQUENCE: 0x10,
-  SET: 0x11,
-  PRINTABLE_STRING: 0x13,
-  UTC_TIME: 0x17,
-  GENERALIZED_TIME: 0x18,
-};
-
-const TAG_CLASS = {
-  UNIVERSAL: 0x00,
-  APPLICATION: 0x01,
-  CONTEXT_SPECIFIC: 0x02,
-  PRIVATE: 0x03,
-};
-
-// https://learn.microsoft.com/en-us/windows/win32/seccertenroll/about-encoded-tag-bytes
-export class ASN1Tag {
-  readonly number: number;
-  readonly constructed: boolean;
-  readonly class: number;
-
-  constructor(enc: number) {
-    // Bits 0 through 4 are the tag number
-    this.number = enc & 0x1f;
-
-    // Bit 5 is the constructed bit
-    this.constructed = (enc & 0x20) === 0x20;
-
-    // Bit 6 & 7 are the class
-    this.class = enc >> 6;
-
-    if (this.number === 0x1f) {
-      throw new ASN1ParseError("long form tags not supported");
-    }
-
-    if (this.class === TAG_CLASS.UNIVERSAL && this.number === 0x00) {
-      throw new ASN1ParseError("unsupported tag 0x00");
-    }
-  }
-
-  public isUniversal(): boolean {
-    return this.class === TAG_CLASS.UNIVERSAL;
-  }
-
-  public isContextSpecific(num?: number): boolean {
-    const res = this.class === TAG_CLASS.CONTEXT_SPECIFIC;
-    return num !== undefined ? res && this.number === num : res;
-  }
-
-  public isBoolean(): boolean {
-    return this.isUniversal() && this.number === UNIVERSAL_TAG.BOOLEAN;
-  }
-
-  public isInteger(): boolean {
-    return this.isUniversal() && this.number === UNIVERSAL_TAG.INTEGER;
-  }
-
-  public isBitString(): boolean {
-    return this.isUniversal() && this.number === UNIVERSAL_TAG.BIT_STRING;
-  }
-
-  public isOctetString(): boolean {
-    return this.isUniversal() && this.number === UNIVERSAL_TAG.OCTET_STRING;
-  }
-
-  public isOID(): boolean {
-    return (
-      this.isUniversal() && this.number === UNIVERSAL_TAG.OBJECT_IDENTIFIER
-    );
-  }
-
-  public isUTCTime(): boolean {
-    return this.isUniversal() && this.number === UNIVERSAL_TAG.UTC_TIME;
-  }
-
-  public isGeneralizedTime(): boolean {
-    return this.isUniversal() && this.number === UNIVERSAL_TAG.GENERALIZED_TIME;
-  }
-
-  public toDER(): number {
-    return this.number | (this.constructed ? 0x20 : 0x00) | (this.class << 6);
-  }
-}

package/src/canonicalize.ts

@@ -1,61 +0,0 @@
-// From https://github.com/theupdateframework/tuf-js/blob/38d537ea883e8bb38ee6ab17b5f59ee479d0eab2/packages/canonical-json/lib/index.js
-
-const COMMA = ",";
-const COLON = ":";
-const LEFT_SQUARE_BRACKET = "[";
-const RIGHT_SQUARE_BRACKET = "]";
-const LEFT_CURLY_BRACKET = "{";
-const RIGHT_CURLY_BRACKET = "}";
-
-function canonicalizeString(string: string): string {
-  const escapedString = string.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
-  return '"' + escapedString + '"';
-}
-
-// Recursively encodes the supplied object according to the canonical JSON form
-// as specified at http://wiki.laptop.org/go/Canonical_JSON. It's a restricted
-// dialect of JSON in which keys are lexically sorted, floats are not allowed,
-// and only double quotes and backslashes are escaped.
-export function canonicalize(object: object): string {
-  const buffer: string[] = [];
-  if (typeof object === "string") {
-    buffer.push(canonicalizeString(object));
-  } else if (typeof object === "boolean") {
-    buffer.push(JSON.stringify(object));
-  } else if (Number.isInteger(object)) {
-    buffer.push(JSON.stringify(object));
-  } else if (object === null) {
-    buffer.push(JSON.stringify(object));
-  } else if (Array.isArray(object)) {
-    buffer.push(LEFT_SQUARE_BRACKET);
-    let first = true;
-    object.forEach((element) => {
-      if (!first) {
-        buffer.push(COMMA);
-      }
-      first = false;
-      buffer.push(canonicalize(element));
-    });
-    buffer.push(RIGHT_SQUARE_BRACKET);
-  } else if (typeof object === "object") {
-    buffer.push(LEFT_CURLY_BRACKET);
-    let first = true;
-    Object.keys(object)
-      .sort()
-      .forEach((property) => {
-        if (!first) {
-          buffer.push(COMMA);
-        }
-        first = false;
-        buffer.push(canonicalizeString(property));
-        buffer.push(COLON);
-        // eslint-disable-next-line
-        buffer.push(canonicalize((object as any)[property])); // 'any' as a fallback
-      });
-    buffer.push(RIGHT_CURLY_BRACKET);
-  } else {
-    throw new TypeError("cannot encode " + object);
-  }
-
-  return buffer.join("");
-}