@freedomofpress/sigstore-browser 0.1.0

package/src/x509/chain.ts

@@ -0,0 +1,212 @@
+/*
+Copyright 2023 The Sigstore Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+/*
+ * Certificate chain verification for browser environments
+ *
+ * Ported from sigstore-js:
+ * https://github.com/sigstore/sigstore-js/blob/main/packages/verify/src/key/certificate.ts
+ *
+ * Key differences from sigstore-js:
+ * - Browser-compatible: async verify() method for Web Crypto API
+ * - Uses Uint8Array instead of Buffer for binary data
+ * - Uses bufferEqual for Uint8Array comparisons
+ */
+
+import { X509Certificate } from "./cert.js";
+import { bufferEqual } from "../crypto.js";
+
+interface CertificateChainVerifierOptions {
+  trustedCerts: X509Certificate[];
+  untrustedCert: X509Certificate;
+  timestamp: Date;
+}
+
+export class CertificateChainVerifier {
+  private untrustedCert: X509Certificate;
+  private trustedCerts: X509Certificate[];
+  private localCerts: X509Certificate[];
+  private timestamp: Date;
+
+  constructor(opts: CertificateChainVerifierOptions) {
+    this.untrustedCert = opts.untrustedCert;
+    this.trustedCerts = opts.trustedCerts;
+    this.localCerts = dedupeCertificates([
+      ...opts.trustedCerts,
+      opts.untrustedCert,
+    ]);
+    this.timestamp = opts.timestamp;
+  }
+
+  public async verify(): Promise<X509Certificate[]> {
+    const certificatePath = await this.sort();
+
+    this.checkPath(certificatePath);
+
+    const validForDate = certificatePath.every((cert) =>
+      cert.validForDate(this.timestamp)
+    );
+
+    if (!validForDate) {
+      throw new Error(
+        "certificate is not valid or expired at the specified date"
+      );
+    }
+
+    return certificatePath;
+  }
+
+  private async sort(): Promise<X509Certificate[]> {
+    const leafCert = this.untrustedCert;
+
+    let paths = await this.buildPaths(leafCert);
+
+    paths = paths.filter((path) =>
+      path.some((cert) => this.trustedCerts.includes(cert))
+    );
+
+    if (paths.length === 0) {
+      throw new Error("no trusted certificate path found");
+    }
+
+    const path = paths.reduce((prev, curr) =>
+      prev.length < curr.length ? prev : curr
+    );
+
+    return [leafCert, ...path].slice(0, -1);
+  }
+
+  private async buildPaths(
+    certificate: X509Certificate
+  ): Promise<X509Certificate[][]> {
+    const paths = [];
+    const issuers = await this.findIssuer(certificate);
+
+    if (issuers.length === 0) {
+      throw new Error("no valid certificate path found");
+    }
+
+    for (let i = 0; i < issuers.length; i++) {
+      const issuer = issuers[i];
+
+      if (issuer.equals(certificate)) {
+        paths.push([certificate]);
+        continue;
+      }
+
+      const subPaths = await this.buildPaths(issuer);
+
+      for (let j = 0; j < subPaths.length; j++) {
+        paths.push([issuer, ...subPaths[j]]);
+      }
+    }
+
+    return paths;
+  }
+
+  private async findIssuer(
+    certificate: X509Certificate
+  ): Promise<X509Certificate[]> {
+    let issuers: X509Certificate[] = [];
+    let keyIdentifier: Uint8Array | undefined;
+
+    if (bufferEqual(certificate.subject, certificate.issuer)) {
+      if (await certificate.verify()) {
+        return [certificate];
+      }
+    }
+
+    if (certificate.extAuthorityKeyID) {
+      keyIdentifier = certificate.extAuthorityKeyID.keyIdentifier;
+    }
+
+    this.localCerts.forEach((possibleIssuer) => {
+      if (keyIdentifier) {
+        if (possibleIssuer.extSubjectKeyID) {
+          if (
+            bufferEqual(
+              possibleIssuer.extSubjectKeyID.keyIdentifier,
+              keyIdentifier
+            )
+          ) {
+            issuers.push(possibleIssuer);
+          }
+          return;
+        }
+      }
+
+      if (bufferEqual(possibleIssuer.subject, certificate.issuer)) {
+        issuers.push(possibleIssuer);
+      }
+    });
+
+    const verifiedIssuers: X509Certificate[] = [];
+    for (const issuer of issuers) {
+      try {
+        if (await certificate.verify(issuer)) {
+          verifiedIssuers.push(issuer);
+        }
+      } catch (ex) {
+        // Ignore verification failures
+      }
+    }
+
+    return verifiedIssuers;
+  }
+
+  private checkPath(path: X509Certificate[]): void {
+    if (path.length < 1) {
+      throw new Error(
+        "certificate chain must contain at least one certificate"
+      );
+    }
+
+    const validCAs = path.slice(1).every((cert) => cert.isCA);
+    if (!validCAs) {
+      throw new Error("intermediate certificate is not a CA");
+    }
+
+    for (let i = path.length - 2; i >= 0; i--) {
+      if (!bufferEqual(path[i].issuer, path[i + 1].subject)) {
+        throw new Error("incorrect certificate name chaining");
+      }
+    }
+
+    for (let i = 0; i < path.length; i++) {
+      const cert = path[i];
+
+      if (cert.extBasicConstraints?.isCA) {
+        const pathLength = cert.extBasicConstraints.pathLenConstraint;
+
+        if (pathLength !== undefined && pathLength < BigInt(i - 1)) {
+          throw new Error("path length constraint exceeded");
+        }
+      }
+    }
+  }
+}
+
+function dedupeCertificates(certs: X509Certificate[]): X509Certificate[] {
+  for (let i = 0; i < certs.length; i++) {
+    for (let j = i + 1; j < certs.length; j++) {
+      if (certs[i].equals(certs[j])) {
+        certs.splice(j, 1);
+        j--;
+      }
+    }
+  }
+  return certs;
+}

package/src/x509/ext.ts

@@ -0,0 +1,212 @@
+/*
+Copyright 2023 The Sigstore Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+import { ASN1Obj } from "../asn1/index.js";
+import { toArrayBuffer, Uint8ArrayToString } from "../encoding.js";
+import { ByteStream } from "../stream.js";
+import { SignedCertificateTimestamp } from "./sct.js";
+
+// https://www.rfc-editor.org/rfc/rfc5280#section-4.1
+export class X509Extension {
+  protected root: ASN1Obj;
+
+  constructor(asn1: ASN1Obj) {
+    this.root = asn1;
+  }
+
+  get oid(): string {
+    return this.root.subs[0].toOID();
+  }
+
+  get critical(): boolean {
+    // The critical field is optional and will be the second element of the
+    // extension sequence if present. Default to false if not present.
+    return this.root.subs.length === 3 ? this.root.subs[1].toBoolean() : false;
+  }
+
+  get value(): Uint8Array {
+    return this.extnValueObj.value;
+  }
+
+  get valueObj(): ASN1Obj {
+    return this.extnValueObj;
+  }
+
+  protected get extnValueObj(): ASN1Obj {
+    // The extnValue field will be the last element of the extension sequence
+    return this.root.subs[this.root.subs.length - 1];
+  }
+}
+
+// https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.9
+export class X509BasicConstraintsExtension extends X509Extension {
+  get isCA(): boolean {
+    return this.sequence.subs[0]?.toBoolean() ?? false;
+  }
+
+  get pathLenConstraint(): bigint | undefined {
+    return this.sequence.subs.length > 1
+      ? this.sequence.subs[1].toInteger()
+      : undefined;
+  }
+
+  // The extnValue field contains a single sequence wrapping the isCA and
+  // pathLenConstraint.
+  private get sequence(): ASN1Obj {
+    return this.extnValueObj.subs[0];
+  }
+}
+
+// https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.3
+export class X509KeyUsageExtension extends X509Extension {
+  get digitalSignature(): boolean {
+    return this.bitString[0] === 1;
+  }
+
+  get keyCertSign(): boolean {
+    return this.bitString[5] === 1;
+  }
+
+  get crlSign(): boolean {
+    return this.bitString[6] === 1;
+  }
+
+  // The extnValue field contains a single bit string which is a bit mask
+  // indicating which key usages are enabled.
+  private get bitString(): number[] {
+    return this.extnValueObj.subs[0].toBitString();
+  }
+}
+
+// https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.6
+export class X509SubjectAlternativeNameExtension extends X509Extension {
+  get rfc822Name(): string | undefined {
+    const rfc822Name = this.findGeneralName(0x01)?.value;
+    if (rfc822Name === undefined) {
+      return undefined;
+    } else {
+      return Uint8ArrayToString(rfc822Name);
+    }
+  }
+
+  get uri(): string | undefined {
+    const uri = this.findGeneralName(0x06)?.value;
+    if (uri === undefined) {
+      return undefined;
+    } else {
+      return Uint8ArrayToString(uri);
+    }
+  }
+
+  // Retrieve the value of an otherName with the given OID.
+  public otherName(oid: string): string | undefined {
+    const otherName = this.findGeneralName(0x00);
+
+    if (otherName === undefined) {
+      return undefined;
+    }
+
+    // The otherName is a sequence containing an OID and a value.
+    // Need to check that the OID matches the one we're looking for.
+    const otherNameOID = otherName.subs[0].toOID();
+    if (otherNameOID !== oid) {
+      return undefined;
+    }
+
+    // The otherNameValue is a sequence containing the actual value.
+    const otherNameValue = otherName.subs[1];
+    return Uint8ArrayToString(otherNameValue.subs[0].value);
+  }
+
+  private findGeneralName(tag: number): ASN1Obj | undefined {
+    return this.generalNames.find((gn) => gn.tag.isContextSpecific(tag));
+  }
+
+  // The extnValue field contains a sequence of GeneralNames.
+  private get generalNames(): ASN1Obj[] {
+    return this.extnValueObj.subs[0].subs;
+  }
+}
+
+// https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.1
+export class X509AuthorityKeyIDExtension extends X509Extension {
+  get keyIdentifier(): Uint8Array | undefined {
+    return this.findSequenceMember(0x00)?.value;
+  }
+
+  private findSequenceMember(tag: number): ASN1Obj | undefined {
+    return this.sequence.subs.find((el) => el.tag.isContextSpecific(tag));
+  }
+
+  // The extnValue field contains a single sequence wrapping the keyIdentifier
+  private get sequence(): ASN1Obj {
+    return this.extnValueObj.subs[0];
+  }
+}
+
+// https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.2
+export class X509SubjectKeyIDExtension extends X509Extension {
+  get keyIdentifier(): Uint8Array {
+    return this.extnValueObj.subs[0].value;
+  }
+}
+
+// Fulcio Issuer V1 extension - OID 1.3.6.1.4.1.57264.1.1
+// Simple OCTET STRING containing the issuer
+export class X509FulcioIssuerV1 extends X509Extension {
+  get issuer(): string {
+    return Uint8ArrayToString(this.extnValueObj.value);
+  }
+}
+
+// Fulcio Issuer V2 extension - OID 1.3.6.1.4.1.57264.1.8
+// SEQUENCE containing the issuer as the first element
+export class X509FulcioIssuerV2 extends X509Extension {
+  get issuer(): string {
+    return Uint8ArrayToString(this.extnValueObj.subs[0].value);
+  }
+}
+
+// https://www.rfc-editor.org/rfc/rfc6962#section-3.3
+export class X509SCTExtension extends X509Extension {
+  constructor(asn1: ASN1Obj) {
+    super(asn1);
+  }
+
+  get signedCertificateTimestamps(): SignedCertificateTimestamp[] {
+    const buf = this.extnValueObj.subs[0].value;
+    const stream = new ByteStream(toArrayBuffer(buf));
+
+    // The overall list length is encoded in the first two bytes -- note this
+    // is the length of the list in bytes, NOT the number of SCTs in the list
+    const end = stream.getUint16() + 2;
+
+    const sctList: SignedCertificateTimestamp[] = [];
+    while (stream.position < end) {
+      // Read the length of the next SCT
+      const sctLength = stream.getUint16();
+
+      // Slice out the bytes for the next SCT and parse it
+      const sct = stream.getBlock(sctLength);
+      sctList.push(SignedCertificateTimestamp.parse(sct));
+    }
+
+    if (stream.position !== end) {
+      throw new Error("SCT list length does not match actual length");
+    }
+
+    return sctList;
+  }
+}

package/src/x509/index.ts

@@ -0,0 +1,19 @@
+/*
+Copyright 2023 The Sigstore Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+export { EXTENSION_OID_SCT, X509Certificate } from "./cert.js";
+export { X509SCTExtension } from "./ext.js";
+export { CertificateChainVerifier } from "./chain.js";

package/src/x509/sct.ts

@@ -0,0 +1,154 @@
+/*
+Copyright 2023 The Sigstore Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+import { verifySignature } from "../crypto.js";
+import { readBigInt64BE, toArrayBuffer } from "../encoding.js";
+import { ByteStream } from "../stream.js";
+
+interface SCTOptions {
+  version: number;
+  logID: Uint8Array;
+  timestamp: Uint8Array;
+  extensions: Uint8Array;
+  hashAlgorithm: number;
+  signatureAlgorithm: number;
+  signature: Uint8Array;
+}
+
+export class SignedCertificateTimestamp {
+  readonly version: number;
+  readonly logID: Uint8Array;
+  readonly timestamp: Uint8Array;
+  readonly extensions: Uint8Array;
+  readonly hashAlgorithm: number;
+  readonly signatureAlgorithm: number;
+  readonly signature: Uint8Array;
+
+  constructor(options: SCTOptions) {
+    this.version = options.version;
+    this.logID = options.logID;
+    this.timestamp = options.timestamp;
+    this.extensions = options.extensions;
+    this.hashAlgorithm = options.hashAlgorithm;
+    this.signatureAlgorithm = options.signatureAlgorithm;
+    this.signature = options.signature;
+  }
+
+  get datetime(): Date {
+    return new Date(Number(readBigInt64BE(this.timestamp)));
+  }
+
+  // Returns the hash algorithm used to generate the SCT's signature.
+  // https://www.rfc-editor.org/rfc/rfc5246#section-7.4.1.4.1
+  get algorithm(): string {
+    switch (this.hashAlgorithm) {
+      /* istanbul ignore next */
+      case 0:
+        return "none";
+      /* istanbul ignore next */
+      case 1:
+        return "md5";
+      /* istanbul ignore next */
+      case 2:
+        return "sha1";
+      /* istanbul ignore next */
+      case 3:
+        return "sha224";
+      case 4:
+        return "sha256";
+      /* istanbul ignore next */
+      case 5:
+        return "sha384";
+      /* istanbul ignore next */
+      case 6:
+        return "sha512";
+      /* istanbul ignore next */
+      default:
+        return "unknown";
+    }
+  }
+
+  public async verify(preCert: Uint8Array, key: CryptoKey): Promise<boolean> {
+    // Assemble the digitally-signed struct (the data over which the signature
+    // was generated).
+    // https://www.rfc-editor.org/rfc/rfc6962#section-3.2
+    const stream = new ByteStream();
+    stream.appendChar(this.version);
+    stream.appendChar(0x00); // SignatureType = certificate_timestamp(0)
+    stream.appendView(this.timestamp);
+    stream.appendUint16(0x01); // LogEntryType = precert_entry(1)
+    stream.appendView(preCert);
+    stream.appendUint16(this.extensions.byteLength);
+
+    /* istanbul ignore next - extensions are very uncommon */
+    if (this.extensions.byteLength > 0) {
+      stream.appendView(this.extensions);
+    }
+
+    return await verifySignature(
+      key,
+      stream.buffer,
+      this.signature,
+      this.algorithm,
+    );
+  }
+
+  // Parses a SignedCertificateTimestamp from a buffer. SCTs are encoded using
+  // TLS encoding which means the fields and lengths of most fields are
+  // specified as part of the SCT and TLS specs.
+  // https://www.rfc-editor.org/rfc/rfc6962#section-3.2
+  // https://www.rfc-editor.org/rfc/rfc5246#section-7.4.1.4.1
+  public static parse(buf: Uint8Array): SignedCertificateTimestamp {
+    const stream = new ByteStream(toArrayBuffer(buf));
+
+    // Version - enum { v1(0), (255) }
+    const version = stream.getUint8();
+
+    // Log ID  - struct { opaque key_id[32]; }
+    const logID = stream.getBlock(32);
+
+    // Timestamp - uint64
+    const timestamp = stream.getBlock(8);
+
+    // Extensions - opaque extensions<0..2^16-1>;
+    const extenstionLength = stream.getUint16();
+    const extensions = stream.getBlock(extenstionLength);
+
+    // Hash algo - enum { sha256(4), . . . (255) }
+    const hashAlgorithm = stream.getUint8();
+
+    // Signature algo - enum { anonymous(0), rsa(1), dsa(2), ecdsa(3), (255) }
+    const signatureAlgorithm = stream.getUint8();
+
+    // Signature  - opaque signature<0..2^16-1>;
+    const sigLength = stream.getUint16();
+    const signature = stream.getBlock(sigLength);
+
+    // Check that we read the entire buffer
+    if (stream.position !== buf.length) {
+      throw new Error("SCT buffer length mismatch");
+    }
+
+    return new SignedCertificateTimestamp({
+      version,
+      logID,
+      timestamp,
+      extensions,
+      hashAlgorithm,
+      signatureAlgorithm,
+      signature,
+    });
+  }
+}

package/tsconfig.json

@@ -0,0 +1,18 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "lib": ["DOM", "ES2022"],
+    "module": "ESNext",
+    "sourceMap": true,
+    "moduleResolution": "node",
+    "resolveJsonModule": true,
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "outDir": "./dist",
+    "declaration": true,
+    "declarationMap": true
+  },
+  "include": ["./src/**/*.ts"],
+  "exclude": ["node_modules", "**/*.test.ts"]
+}

package/vite.config.playwright.ts

@@ -0,0 +1,26 @@
+/// <reference types="vitest" />
+import { defineConfig } from "vite";
+
+export default defineConfig({
+  build: {
+    minify: false,
+    outDir: "dist",
+    target: "esnext",
+    lib: {
+      entry: "src/index.ts",
+      formats: ["es"],
+      fileName: "index",
+    },
+  },
+  test: {
+    globals: true,
+    browser: {
+      provider: "playwright",
+      enabled: true,
+      headless: false,
+      instances: [
+        { browser: "chromium" },
+      ],
+    },
+  },
+});

package/vite.config.ts

@@ -0,0 +1,18 @@
+/// <reference types="vitest" />
+import { defineConfig } from "vite";
+
+export default defineConfig({
+  build: {
+    outDir: "dist",
+    target: "esnext",
+    lib: {
+      entry: "src/index.ts",
+      formats: ["es"],
+      fileName: "index",
+    },
+  },
+  test: {
+    globals: true,
+    environment: "node",
+  },
+});