@freedomofpress/sigstore-browser 0.1.0

package/src/stream.ts

@@ -0,0 +1,141 @@
+/*
+Copyright 2023 The Sigstore Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+class StreamError extends Error {}
+
+export class ByteStream {
+  private static BLOCK_SIZE = 1024;
+
+  private buf: ArrayBuffer;
+  private view: Uint8Array;
+  private start = 0;
+
+  constructor(buffer?: ArrayBuffer) {
+    if (buffer) {
+      this.buf = buffer;
+      this.view = new Uint8Array(buffer);
+    } else {
+      this.buf = new ArrayBuffer(0);
+      this.view = new Uint8Array(this.buf);
+    }
+  }
+
+  get buffer(): Uint8Array {
+    return this.view.subarray(0, this.start);
+  }
+
+  get length(): number {
+    return this.view.byteLength;
+  }
+
+  get position(): number {
+    return this.start;
+  }
+
+  public seek(position: number) {
+    this.start = position;
+  }
+
+  // Returns a Buffer containing the specified number of bytes starting at the
+  // given start position.
+  public slice(start: number, len: number): Uint8Array {
+    const end = start + len;
+
+    if (end > this.length) {
+      throw new StreamError("request past end of buffer");
+    }
+
+    return this.view.subarray(start, end);
+  }
+
+  public appendChar(char: number) {
+    this.ensureCapacity(1);
+    this.view[this.start] = char;
+    this.start += 1;
+  }
+
+  public appendUint16(num: number) {
+    this.ensureCapacity(2);
+
+    const value = new Uint16Array([num]);
+    const view = new Uint8Array(value.buffer);
+
+    this.view[this.start] = view[1];
+    this.view[this.start + 1] = view[0];
+    this.start += 2;
+  }
+
+  public appendUint24(num: number) {
+    this.ensureCapacity(3);
+
+    const value = new Uint32Array([num]);
+    const view = new Uint8Array(value.buffer);
+
+    this.view[this.start] = view[2];
+    this.view[this.start + 1] = view[1];
+    this.view[this.start + 2] = view[0];
+    this.start += 3;
+  }
+
+  public appendView(view: Uint8Array) {
+    this.ensureCapacity(view.length);
+    this.view.set(view, this.start);
+    this.start += view.length;
+  }
+
+  public getBlock(size: number): Uint8Array {
+    if (size <= 0) {
+      return new Uint8Array(0);
+    }
+
+    if (this.start + size > this.view.length) {
+      throw new Error("request past end of buffer");
+    }
+
+    const result = this.view.subarray(this.start, this.start + size);
+    this.start += size;
+
+    return result;
+  }
+
+  public getUint8(): number {
+    return this.getBlock(1)[0];
+  }
+
+  public getUint16(): number {
+    const block = this.getBlock(2);
+
+    return (block[0] << 8) | block[1];
+  }
+
+  private ensureCapacity(size: number) {
+    if (this.start + size > this.view.byteLength) {
+      const blockSize =
+        ByteStream.BLOCK_SIZE + (size > ByteStream.BLOCK_SIZE ? size : 0);
+      this.realloc(this.view.byteLength + blockSize);
+    }
+  }
+
+  private realloc(size: number) {
+    const newArray = new ArrayBuffer(size);
+    const newView = new Uint8Array(newArray);
+
+    // Copy the old buffer into the new one
+    newView.set(this.view);
+
+    this.buf = newArray;
+    this.view = newView;
+  }
+}

package/src/timestamp/tsa.ts

@@ -0,0 +1,205 @@
+/*
+ * TSA (Time-Stamping Authority) timestamp verification
+ *
+ * Based on sigstore-js:
+ * https://github.com/sigstore/sigstore-js/blob/main/packages/verify/src/timestamp/tsa.ts
+ *
+ * Key differences from sigstore-js:
+ * - Browser-compatible: uses Uint8Array instead of Buffer for binary data
+ * - Uses Web Crypto API for all cryptographic operations
+ * - Integrates with existing RFC3161 timestamp implementation
+ * - Uses CertificateChainVerifier for full X.509 path validation
+ * - Implements filterCertAuthorities inline (from sigstore-js/packages/verify/src/trust/filter.ts)
+ * - Adds verifyBundleTimestamp for Sigstore bundle integration (new functionality)
+ */
+
+import { RFC3161Timestamp } from "../rfc3161/index.js";
+import { X509Certificate, CertificateChainVerifier } from "../x509/index.js";
+import { bufferEqual } from "../crypto.js";
+import { base64ToUint8Array, Uint8ArrayToHex } from "../encoding.js";
+import type { RawTimestampAuthority } from "../interfaces.js";
+
+/**
+ * Verifies an RFC3161 timestamp against a set of timestamp authorities
+ *
+ * @param timestamp - The RFC3161 timestamp to verify
+ * @param data - The data that was timestamped
+ * @param timestampAuthorities - List of trusted timestamp authorities
+ * @returns The verified signing time
+ * @throws Error if timestamp cannot be verified
+ */
+export async function verifyRFC3161Timestamp(
+  timestamp: RFC3161Timestamp,
+  data: Uint8Array,
+  timestampAuthorities: RawTimestampAuthority[]
+): Promise<Date> {
+  const signingTime = timestamp.signingTime;
+
+  // Filter for CAs which were valid at the time of signing
+  let validAuthorities = filterCertAuthorities(
+    timestampAuthorities,
+    signingTime
+  );
+
+  // Filter for CAs which match serial and issuer embedded in the timestamp
+  validAuthorities = filterCAsBySerialAndIssuer(validAuthorities, {
+    serialNumber: timestamp.signerSerialNumber,
+    issuer: timestamp.signerIssuer,
+  });
+
+  // Check that we can verify the timestamp with AT LEAST ONE of the remaining CAs
+  const verificationResults = await Promise.allSettled(
+    validAuthorities.map(ca => verifyTimestampForCA(timestamp, data, ca))
+  );
+
+  const verified = verificationResults.some(
+    result => result.status === "fulfilled"
+  );
+
+  if (!verified) {
+    const errors = verificationResults
+      .filter(r => r.status === "rejected")
+      .map(r => (r as PromiseRejectedResult).reason?.message || 'Unknown error');
+    throw new Error(`Timestamp could not be verified against any trusted authority. Errors: ${errors.join(', ')}`);
+  }
+
+  return signingTime;
+}
+
+/**
+ * Filters certificate authorities to those valid at a specific time
+ *
+ * Adapted from sigstore-js/packages/verify/src/trust/filter.ts
+ */
+function filterCertAuthorities(
+  authorities: RawTimestampAuthority[],
+  validAt: Date
+): RawTimestampAuthority[] {
+  return authorities.filter(ca => {
+    if (ca.validFor) {
+      const start = ca.validFor.start ? new Date(ca.validFor.start) : null;
+      const end = ca.validFor.end ? new Date(ca.validFor.end) : null;
+
+      if (start && validAt < start) {
+        return false;
+      }
+      if (end && validAt > end) {
+        return false;
+      }
+    }
+    return true;
+  });
+}
+
+/**
+ * Filters certificate authorities by serial number and issuer
+ *
+ * Only checks the LEAF certificate (TSA signing cert), not the entire chain.
+ * This matches the sigstore-js reference implementation.
+ */
+function filterCAsBySerialAndIssuer(
+  timestampAuthorities: RawTimestampAuthority[],
+  criteria: { serialNumber: Uint8Array; issuer: Uint8Array }
+): RawTimestampAuthority[] {
+  return timestampAuthorities.filter(ca => {
+    if (!ca.certChain || ca.certChain.certificates.length === 0) {
+      return false;
+    }
+
+    const leafCert = X509Certificate.parse(
+      base64ToUint8Array(ca.certChain.certificates[0].rawBytes)
+    );
+
+    return bufferEqual(leafCert.serialNumber, criteria.serialNumber) &&
+           bufferEqual(leafCert.issuer, criteria.issuer);
+  });
+}
+
+/**
+ * Verifies a timestamp against a specific certificate authority
+ */
+async function verifyTimestampForCA(
+  timestamp: RFC3161Timestamp,
+  data: Uint8Array,
+  ca: RawTimestampAuthority
+): Promise<void> {
+  if (!ca.certChain || ca.certChain.certificates.length === 0) {
+    throw new Error("Certificate authority missing certificate chain");
+  }
+
+  const leafCert = X509Certificate.parse(
+    base64ToUint8Array(ca.certChain.certificates[0].rawBytes)
+  );
+  const signingTime = timestamp.signingTime;
+
+  const trustedCerts = ca.certChain.certificates
+    .slice(1)
+    .map(cert => X509Certificate.parse(base64ToUint8Array(cert.rawBytes)));
+
+  try {
+    const verifier = new CertificateChainVerifier({
+      untrustedCert: leafCert,
+      trustedCerts: trustedCerts,
+      timestamp: signingTime,
+    });
+    await verifier.verify();
+  } catch (e) {
+    throw new Error(`TSA certificate chain verification failed: ${e instanceof Error ? e.message : String(e)}`);
+  }
+
+  const publicKey = await leafCert.publicKeyObj;
+
+  await timestamp.verify(data, publicKey);
+}
+
+/**
+ * Extracts the verified timestamp from a bundle's timestamp verification data
+ *
+ * New functionality for Sigstore bundle integration (not in sigstore-js reference)
+ *
+ * @param timestampData - The timestamp verification data from the bundle
+ * @param signature - The signature being verified
+ * @param timestampAuthorities - List of trusted timestamp authorities
+ * @returns The verified signing time, or undefined if no timestamp
+ */
+export async function verifyBundleTimestamp(
+  timestampData: any,
+  signature: Uint8Array,
+  timestampAuthorities: RawTimestampAuthority[]
+): Promise<Date | undefined> {
+  if (!timestampData?.rfc3161Timestamps?.length) {
+    return undefined;
+  }
+
+  // Check for duplicate timestamps
+  const seenTimestamps = new Set<string>();
+  for (const tsData of timestampData.rfc3161Timestamps) {
+    if (seenTimestamps.has(tsData.signedTimestamp)) {
+      throw new Error("Duplicate TSA timestamp detected");
+    }
+    seenTimestamps.add(tsData.signedTimestamp);
+  }
+
+  // Process each RFC3161 timestamp
+  const errors: string[] = [];
+  for (const tsData of timestampData.rfc3161Timestamps) {
+    try {
+      // Decode the base64-encoded timestamp
+      const timestampBytes = base64ToUint8Array(tsData.signedTimestamp);
+      const timestamp = RFC3161Timestamp.parse(timestampBytes);
+
+      const signingTime = await verifyRFC3161Timestamp(
+        timestamp,
+        signature,
+        timestampAuthorities
+      );
+      return signingTime;
+    } catch (e) {
+      // Continue to next timestamp if this one fails
+      errors.push(e instanceof Error ? e.message : String(e));
+      continue;
+    }
+  }
+
+  throw new Error(`No valid RFC3161 timestamps found. Errors: ${errors.join(', ')}`);
+}

package/src/tlog/body.ts

@@ -0,0 +1,65 @@
+/*
+ * Transparency log body verification
+ *
+ * Based on sigstore-js:
+ * https://github.com/sigstore/sigstore-js/blob/main/packages/verify/src/tlog/index.ts
+ *
+ * Key differences from sigstore-js:
+ * - Browser-compatible: uses Uint8Array instead of Buffer for binary data
+ * - Direct bundle comparison instead of SignatureContent abstraction
+ */
+
+import { base64Decode } from "../encoding.js";
+import type { SigstoreBundle, TLogEntry } from "../bundle.js";
+import { verifyHashedRekordBody } from "./hashedrekord.js";
+import { verifyDSSEBody } from "./dsse.js";
+import { verifyIntotoBody } from "./intoto.js";
+
+export interface RekorEntry {
+  apiVersion: string;
+  kind: string;
+  spec: unknown;
+}
+
+export async function verifyTLogBody(
+  entry: TLogEntry,
+  bundle: SigstoreBundle
+): Promise<void> {
+  const rekorEntry = parseCanonicalBody(entry);
+
+  const { kind, version } = entry.kindVersion;
+
+  if (kind !== rekorEntry.kind || version !== rekorEntry.apiVersion) {
+    throw new Error(
+      `kind/version mismatch - expected: ${kind}/${version}, received: ${rekorEntry.kind}/${rekorEntry.apiVersion}`
+    );
+  }
+
+  switch (rekorEntry.kind) {
+    case "hashedrekord":
+      return verifyHashedRekordBody(rekorEntry, bundle);
+    case "dsse":
+      return verifyDSSEBody(rekorEntry, bundle);
+    case "intoto":
+      return verifyIntotoBody(rekorEntry, bundle);
+    default:
+      throw new Error(`Unsupported TLog entry kind: ${rekorEntry.kind}`);
+  }
+}
+
+function parseCanonicalBody(entry: TLogEntry): RekorEntry {
+  try {
+    const decodedBody = base64Decode(entry.canonicalizedBody);
+    const rekorEntry = JSON.parse(decodedBody) as RekorEntry;
+
+    if (!rekorEntry.apiVersion || !rekorEntry.kind || !rekorEntry.spec) {
+      throw new Error("Invalid Rekor entry structure");
+    }
+
+    return rekorEntry;
+  } catch (error) {
+    throw new Error(
+      `Failed to parse canonicalized body: ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
+}

package/src/tlog/checkpoint.ts

@@ -0,0 +1,248 @@
+/*
+Checkpoint verification for transparency log entries.
+
+Adapted from sigstore-js for browser compatibility:
+https://github.com/sigstore/sigstore-js/blob/main/packages/verify/src/timestamp/checkpoint.ts
+
+Key differences:
+- Uses Uint8Array instead of Buffer
+- Uses Web Crypto API instead of Node.js crypto module
+- Manual handling of ED25519 (raw) vs ECDSA (DER) signature formats
+- Inline key import from raw bytes
+
+Additional functionality not in reference:
+- filterTLogsByDate() - inlined from sigstore-js/packages/verify/src/trust/filter.ts
+- importTLogKey() - new browser-compatible key import with multiple format support
+- Special handling for Rekor v2 bundles without integratedTime
+
+Follows the signed note format specification:
+https://github.com/transparency-dev/formats/blob/main/log/README.md
+*/
+
+import { base64ToUint8Array, stringToUint8Array, toArrayBuffer, uint8ArrayEqual, Uint8ArrayToHex } from "../encoding.js";
+import { importKey, verifySignature } from "../crypto.js";
+import type { TLogEntry } from "../bundle.js";
+import type { RawLogs } from "../interfaces.js";
+
+// Signed note format per https://github.com/transparency-dev/formats
+// Body is separated from signatures by a blank line
+const CHECKPOINT_SEPARATOR = "\n\n";
+// Signature lines format: "— <identity> <base64(key_hint+signature)>\n"
+// \u2014 is the em-dash character (—)
+const SIGNATURE_REGEX = /\u2014 (\S+) (\S+)\n/g;
+
+export interface TLogSignature {
+  name: string;
+  keyHint: Uint8Array;
+  signature: Uint8Array;
+}
+
+// Signed checkpoint note with cryptographic signatures
+export class SignedNote {
+  readonly note: string;
+  readonly signatures: TLogSignature[];
+
+  constructor(note: string, signatures: TLogSignature[]) {
+    this.note = note;
+    this.signatures = signatures;
+  }
+
+  static fromString(envelope: string): SignedNote {
+    if (!envelope.includes(CHECKPOINT_SEPARATOR)) {
+      throw new Error("Missing checkpoint separator");
+    }
+
+    // Split body from signature lines at blank line
+    const split = envelope.indexOf(CHECKPOINT_SEPARATOR);
+    const header = envelope.slice(0, split + 1);
+    const data = envelope.slice(split + CHECKPOINT_SEPARATOR.length);
+
+    // Parse signature lines: "— <identity> <base64(key_hint+signature)>\n"
+    const matches = data.matchAll(SIGNATURE_REGEX);
+
+    const signatures: TLogSignature[] = [];
+    for (const match of matches) {
+      const [, name, signature] = match;
+      const sigBytes = base64ToUint8Array(signature);
+
+      // First 4 bytes are key hint (SHA256 hash prefix), rest is signature
+      if (sigBytes.length < 5) {
+        throw new Error("Malformed checkpoint signature");
+      }
+
+      signatures.push({
+        name,
+        keyHint: sigBytes.subarray(0, 4),
+        signature: sigBytes.subarray(4),
+      });
+    }
+
+    if (signatures.length === 0) {
+      throw new Error("No signatures found in checkpoint");
+    }
+
+    return new SignedNote(header, signatures);
+  }
+}
+
+// Parsed checkpoint containing tree state (origin, size, root hash)
+export class LogCheckpoint {
+  readonly origin: string;
+  readonly logSize: bigint;
+  readonly logHash: Uint8Array;
+  readonly rest: string[];
+
+  constructor(
+    origin: string,
+    logSize: bigint,
+    logHash: Uint8Array,
+    rest: string[]
+  ) {
+    this.origin = origin;
+    this.logSize = logSize;
+    this.logHash = logHash;
+    this.rest = rest;
+  }
+
+  static fromString(note: string): LogCheckpoint {
+    const lines = note.trimEnd().split("\n");
+
+    if (lines.length < 3) {
+      throw new Error("Too few lines in checkpoint header");
+    }
+
+    const origin = lines[0];
+    const logSize = BigInt(lines[1]);
+    const rootHash = base64ToUint8Array(lines[2]);
+    const rest = lines.slice(3);
+
+    return new LogCheckpoint(origin, logSize, rootHash, rest);
+  }
+}
+
+// Verifies checkpoint signature and ensures root hash matches inclusion proof
+export async function verifyCheckpoint(
+  entry: TLogEntry,
+  tlogs: RawLogs
+): Promise<void> {
+  if (!entry.inclusionProof?.checkpoint) {
+    throw new Error("Missing checkpoint in inclusion proof");
+  }
+
+  // Filter by log ID first (matches entry's log ID)
+  const entryLogId = base64ToUint8Array(entry.logId.keyId);
+  const matchingTLogs = tlogs.filter((tlog) => {
+    const tlogId = base64ToUint8Array(tlog.logId.keyId);
+    return uint8ArrayEqual(tlogId, entryLogId);
+  });
+
+  // Then filter by date if integratedTime is available
+  // For Rekor v2 bundles, integratedTime may be null, so we skip date filtering
+  const validTLogs = entry.integratedTime
+    ? filterTLogsByDate(matchingTLogs, new Date(Number(entry.integratedTime) * 1000))
+    : matchingTLogs;
+
+  const inclusionProof = entry.inclusionProof;
+  const signedNote = SignedNote.fromString(inclusionProof.checkpoint.envelope);
+  const checkpoint = LogCheckpoint.fromString(signedNote.note);
+
+  if (!(await verifySignedNote(signedNote, validTLogs))) {
+    throw new Error("Invalid checkpoint signature");
+  }
+
+  const rootHash = base64ToUint8Array(inclusionProof.rootHash);
+  if (!uint8ArrayEqual(checkpoint.logHash, rootHash)) {
+    throw new Error("Root hash mismatch between checkpoint and inclusion proof");
+  }
+}
+
+// Verifies checkpoint signatures using trusted TLog keys
+async function verifySignedNote(
+  signedNote: SignedNote,
+  tlogs: RawLogs
+): Promise<boolean> {
+  const data = stringToUint8Array(signedNote.note);
+
+  // We need at least one valid signature from a known TLog
+  let hasValidSignature = false;
+
+  for (const signature of signedNote.signatures) {
+    // Match signature to TLog using key hint (first 4 bytes of key ID)
+    const tlog = tlogs.find((tlog) => {
+      const logId = base64ToUint8Array(tlog.logId.keyId);
+      return uint8ArrayEqual(logId.subarray(0, 4), signature.keyHint);
+    });
+
+    if (!tlog) {
+      // Skip unknown signatures (e.g., from witnesses we don't know about)
+      continue;
+    }
+
+    const publicKey = await importTLogKey(tlog);
+
+    // Both ED25519 and ECDSA verification are now handled by verifySignature
+    // ED25519 signatures are raw (64 bytes), ECDSA signatures are DER-encoded
+    const verified = await verifySignature(
+      publicKey,
+      data,
+      signature.signature,
+      tlog.hashAlgorithm
+    );
+
+    if (verified) {
+      hasValidSignature = true;
+    }
+  }
+
+  return hasValidSignature;
+}
+
+
+// Inlined from sigstore-js/packages/verify/src/trust/filter.ts
+function filterTLogsByDate(tlogs: RawLogs, targetDate: Date): RawLogs {
+  return tlogs.filter((tlog) => {
+    const start = new Date(tlog.publicKey.validFor.start);
+    const end = tlog.publicKey.validFor.end
+      ? new Date(tlog.publicKey.validFor.end)
+      : null;
+
+    return targetDate >= start && (!end || targetDate <= end);
+  });
+}
+
+// Browser-compatible key import supporting multiple formats (not in sigstore-js reference)
+async function importTLogKey(tlog: RawLogs[0]): Promise<CryptoKey> {
+  // Parse keyDetails to extract key type and scheme
+  // Formats can be:
+  // - "PKIX_ECDSA_P256_SHA_256" (production format)
+  // - "PKIX_ED25519"
+  // - "ecdsa-sha2-nistp256" (SSH/test format)
+  const keyDetails = tlog.publicKey.keyDetails;
+  let keyType: string;
+  let scheme: string;
+
+  if (keyDetails === "ecdsa-sha2-nistp256") {
+    // SSH-style ECDSA P-256 format used in tests
+    keyType = "ecdsa";
+    scheme = "P256-SHA256";
+  } else if (keyDetails.includes("ECDSA")) {
+    keyType = "ecdsa";
+    // Extract the curve and hash, e.g., "P256_SHA_256" from "PKIX_ECDSA_P256_SHA_256"
+    scheme = keyDetails.replace("PKIX_ECDSA_", "").replaceAll("_", "-");
+  } else if (keyDetails.includes("ED25519")) {
+    keyType = "ed25519";
+    scheme = "ed25519";
+  } else if (keyDetails.includes("RSA")) {
+    keyType = "rsa";
+    // Extract RSA details, e.g., "PSS_SHA_256" from "PKIX_RSA_PSS_SHA_256"
+    scheme = keyDetails.replace("PKIX_RSA_", "").replaceAll("_", "-");
+  } else {
+    throw new Error(`Unsupported key type in keyDetails: ${keyDetails}`);
+  }
+
+  return importKey(
+    keyType,
+    scheme,
+    tlog.publicKey.rawBytes
+  );
+}