@freedomofpress/sigstore-browser 0.1.0

package/dist/asn1/tag.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tag.js","sourceRoot":"","sources":["../../src/asn1/tag.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;EAcE;AACF,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE5C,MAAM,aAAa,GAAG;IACpB,OAAO,EAAE,IAAI;IACb,OAAO,EAAE,IAAI;IACb,UAAU,EAAE,IAAI;IAChB,YAAY,EAAE,IAAI;IAClB,iBAAiB,EAAE,IAAI;IACvB,QAAQ,EAAE,IAAI;IACd,GAAG,EAAE,IAAI;IACT,gBAAgB,EAAE,IAAI;IACtB,QAAQ,EAAE,IAAI;IACd,gBAAgB,EAAE,IAAI;CACvB,CAAC;AAEF,MAAM,SAAS,GAAG;IAChB,SAAS,EAAE,IAAI;IACf,WAAW,EAAE,IAAI;IACjB,gBAAgB,EAAE,IAAI;IACtB,OAAO,EAAE,IAAI;CACd,CAAC;AAEF,wFAAwF;AACxF,MAAM,OAAO,OAAO;IACT,MAAM,CAAS;IACf,WAAW,CAAU;IACrB,KAAK,CAAS;IAEvB,YAAY,GAAW;QACrB,sCAAsC;QACtC,IAAI,CAAC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC;QAEzB,+BAA+B;QAC/B,IAAI,CAAC,WAAW,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC;QAEzC,0BAA0B;QAC1B,IAAI,CAAC,KAAK,GAAG,GAAG,IAAI,CAAC,CAAC;QAEtB,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;YACzB,MAAM,IAAI,cAAc,CAAC,8BAA8B,CAAC,CAAC;QAC3D,CAAC;QAED,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;YAC/D,MAAM,IAAI,cAAc,CAAC,sBAAsB,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IAEM,WAAW;QAChB,OAAO,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,SAAS,CAAC;IAC5C,CAAC;IAEM,iBAAiB,CAAC,GAAY;QACnC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,gBAAgB,CAAC;QACtD,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IAC9D,CAAC;IAEM,SAAS;QACd,OAAO,IAAI,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,MAAM,KAAK,aAAa,CAAC,OAAO,CAAC;IACrE,CAAC;IAEM,SAAS;QACd,OAAO,IAAI,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,MAAM,KAAK,aAAa,CAAC,OAAO,CAAC;IACrE,CAAC;IAEM,WAAW;QAChB,OAAO,IAAI,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,MAAM,KAAK,aAAa,CAAC,UAAU,CAAC;IACxE,CAAC;IAEM,aAAa;QAClB,OAAO,IAAI,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,MAAM,KAAK,aAAa,CAAC,YAAY,CAAC;IAC1E,CAAC;IAEM,KAAK;QACV,OAAO,CACL,IAAI,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,MAAM,KAAK,aAAa,CAAC,iBAAiB,CACtE,CAAC;IACJ,CAAC;IAEM,SAAS;QACd,OAAO,IAAI,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,MAAM,KAAK,aAAa,CAAC,QAAQ,CAAC;IACtE,CAAC;IAEM,iBAAiB;QACtB,OAAO,IAAI,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,MAAM,KAAK,aAAa,CAAC,gBAAgB,CAAC;IAC9E,CAAC;IAEM,KAAK;QACV,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC;IAC5E,CAAC;CACF"}

package/dist/bundle.d.ts

@@ -0,0 +1,87 @@
+type SigstoreBundleBase = {
+    mediaType: string;
+    verificationMaterial: VerificationMaterial;
+};
+export type SigstoreBundle = (SigstoreBundleBase & {
+    messageSignature: MessageSignature;
+    dsseEnvelope?: never;
+}) | (SigstoreBundleBase & {
+    messageSignature?: never;
+    dsseEnvelope: DSSEEnvelope;
+});
+export interface VerificationMaterial {
+    certificate?: Certificate;
+    x509CertificateChain?: X509CertificateChain;
+    tlogEntries: TLogEntry[];
+    timestampVerificationData?: TimestampVerificationData;
+}
+export interface Certificate {
+    rawBytes: string;
+}
+export interface X509CertificateChain {
+    certificates: Certificate[];
+}
+export interface TLogEntry {
+    logIndex: string;
+    logId: LogId;
+    kindVersion: KindVersion;
+    integratedTime: string | null;
+    inclusionPromise?: InclusionPromise;
+    inclusionProof?: InclusionProof;
+    canonicalizedBody: string;
+}
+export interface LogId {
+    keyId: string;
+}
+export interface KindVersion {
+    kind: string;
+    version: string;
+}
+export interface InclusionPromise {
+    signedEntryTimestamp: string;
+}
+export interface InclusionProof {
+    logIndex: string;
+    rootHash: string;
+    treeSize: string;
+    hashes: string[];
+    checkpoint: Checkpoint;
+}
+export interface Checkpoint {
+    envelope: string;
+}
+export interface MessageSignature {
+    messageDigest: MessageDigest;
+    signature: string;
+}
+export interface MessageDigest {
+    algorithm: string;
+    digest: string;
+}
+export interface DSSEEnvelope {
+    payload: string;
+    payloadType: string;
+    signatures: DSSESignature[];
+}
+export interface DSSESignature {
+    sig: string;
+    keyid?: string;
+}
+export interface TimestampVerificationData {
+    rfc3161Timestamps: RFC3161Timestamp[];
+}
+export interface RFC3161Timestamp {
+    signedTimestamp: string;
+}
+export interface InTotoStatement {
+    _type: string;
+    subject: InTotoSubject[];
+    predicateType: string;
+    predicate: Record<string, unknown>;
+}
+export interface InTotoSubject {
+    name: string;
+    digest: Record<string, string>;
+}
+export {};
+//# sourceMappingURL=bundle.d.ts.map

package/dist/bundle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundle.d.ts","sourceRoot":"","sources":["../src/bundle.ts"],"names":[],"mappings":"AAAA,KAAK,kBAAkB,GAAG;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,oBAAoB,EAAE,oBAAoB,CAAC;CAC5C,CAAC;AAEF,MAAM,MAAM,cAAc,GACtB,CAAC,kBAAkB,GAAG;IAAE,gBAAgB,EAAE,gBAAgB,CAAC;IAAC,YAAY,CAAC,EAAE,KAAK,CAAA;CAAE,CAAC,GACnF,CAAC,kBAAkB,GAAG;IAAE,gBAAgB,CAAC,EAAE,KAAK,CAAC;IAAC,YAAY,EAAE,YAAY,CAAA;CAAE,CAAC,CAAC;AAEpF,MAAM,WAAW,oBAAoB;IACnC,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IAC5C,WAAW,EAAE,SAAS,EAAE,CAAC;IACzB,yBAAyB,CAAC,EAAE,yBAAyB,CAAC;CACvD;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,oBAAoB;IACnC,YAAY,EAAE,WAAW,EAAE,CAAC;CAC7B;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,KAAK,CAAC;IACb,WAAW,EAAE,WAAW,CAAC;IACzB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,KAAK;IACpB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,gBAAgB;IAC/B,oBAAoB,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,UAAU,EAAE,UAAU,CAAC;CACxB;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB;IAC/B,aAAa,EAAE,aAAa,CAAC;IAC7B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,aAAa,EAAE,CAAC;CAC7B;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,yBAAyB;IACxC,iBAAiB,EAAE,gBAAgB,EAAE,CAAC;CACvC;AAED,MAAM,WAAW,gBAAgB;IAC/B,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,aAAa,EAAE,CAAC;IACzB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAChC"}

package/dist/bundle.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=bundle.js.map

package/dist/bundle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundle.js","sourceRoot":"","sources":["../src/bundle.ts"],"names":[],"mappings":""}

package/dist/canonicalize.d.ts

@@ -0,0 +1,2 @@
+export declare function canonicalize(object: object): string;
+//# sourceMappingURL=canonicalize.d.ts.map

package/dist/canonicalize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonicalize.d.ts","sourceRoot":"","sources":["../src/canonicalize.ts"],"names":[],"mappings":"AAkBA,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CA0CnD"}

package/dist/canonicalize.js

@@ -0,0 +1,64 @@
+// From https://github.com/theupdateframework/tuf-js/blob/38d537ea883e8bb38ee6ab17b5f59ee479d0eab2/packages/canonical-json/lib/index.js
+const COMMA = ",";
+const COLON = ":";
+const LEFT_SQUARE_BRACKET = "[";
+const RIGHT_SQUARE_BRACKET = "]";
+const LEFT_CURLY_BRACKET = "{";
+const RIGHT_CURLY_BRACKET = "}";
+function canonicalizeString(string) {
+    const escapedString = string.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
+    return '"' + escapedString + '"';
+}
+// Recursively encodes the supplied object according to the canonical JSON form
+// as specified at http://wiki.laptop.org/go/Canonical_JSON. It's a restricted
+// dialect of JSON in which keys are lexically sorted, floats are not allowed,
+// and only double quotes and backslashes are escaped.
+export function canonicalize(object) {
+    const buffer = [];
+    if (typeof object === "string") {
+        buffer.push(canonicalizeString(object));
+    }
+    else if (typeof object === "boolean") {
+        buffer.push(JSON.stringify(object));
+    }
+    else if (Number.isInteger(object)) {
+        buffer.push(JSON.stringify(object));
+    }
+    else if (object === null) {
+        buffer.push(JSON.stringify(object));
+    }
+    else if (Array.isArray(object)) {
+        buffer.push(LEFT_SQUARE_BRACKET);
+        let first = true;
+        object.forEach((element) => {
+            if (!first) {
+                buffer.push(COMMA);
+            }
+            first = false;
+            buffer.push(canonicalize(element));
+        });
+        buffer.push(RIGHT_SQUARE_BRACKET);
+    }
+    else if (typeof object === "object") {
+        buffer.push(LEFT_CURLY_BRACKET);
+        let first = true;
+        Object.keys(object)
+            .sort()
+            .forEach((property) => {
+            if (!first) {
+                buffer.push(COMMA);
+            }
+            first = false;
+            buffer.push(canonicalizeString(property));
+            buffer.push(COLON);
+            // eslint-disable-next-line
+            buffer.push(canonicalize(object[property])); // 'any' as a fallback
+        });
+        buffer.push(RIGHT_CURLY_BRACKET);
+    }
+    else {
+        throw new TypeError("cannot encode " + object);
+    }
+    return buffer.join("");
+}
+//# sourceMappingURL=canonicalize.js.map

package/dist/canonicalize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonicalize.js","sourceRoot":"","sources":["../src/canonicalize.ts"],"names":[],"mappings":"AAAA,uIAAuI;AAEvI,MAAM,KAAK,GAAG,GAAG,CAAC;AAClB,MAAM,KAAK,GAAG,GAAG,CAAC;AAClB,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAChC,MAAM,oBAAoB,GAAG,GAAG,CAAC;AACjC,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAC/B,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAEhC,SAAS,kBAAkB,CAAC,MAAc;IACxC,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACzE,OAAO,GAAG,GAAG,aAAa,GAAG,GAAG,CAAC;AACnC,CAAC;AAED,+EAA+E;AAC/E,8EAA8E;AAC9E,8EAA8E;AAC9E,sDAAsD;AACtD,MAAM,UAAU,YAAY,CAAC,MAAc;IACzC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1C,CAAC;SAAM,IAAI,OAAO,MAAM,KAAK,SAAS,EAAE,CAAC;QACvC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IACtC,CAAC;SAAM,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;QACpC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IACtC,CAAC;SAAM,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QAC3B,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IACtC,CAAC;SAAM,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACjC,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QACjC,IAAI,KAAK,GAAG,IAAI,CAAC;QACjB,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YACzB,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrB,CAAC;YACD,KAAK,GAAG,KAAK,CAAC;YACd,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;QACrC,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IACpC,CAAC;SAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QACtC,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAChC,IAAI,KAAK,GAAG,IAAI,CAAC;QACjB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;aAChB,IAAI,EAAE;aACN,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE;YACpB,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrB,CAAC;YACD,KAAK,GAAG,KAAK,CAAC;YACd,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC1C,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnB,2BAA2B;YAC3B,MAAM,CAAC,IAAI,CAAC,YAAY,CAAE,MAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,sBAAsB;QAC9E,CAAC,CAAC,CAAC;QACL,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IACnC,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,SAAS,CAAC,gBAAgB,GAAG,MAAM,CAAC,CAAC;IACjD,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACzB,CAAC"}

package/dist/cli.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":""}

package/dist/cli.js

@@ -0,0 +1,217 @@
+#!/usr/bin/env node
+import { createHash, webcrypto } from "node:crypto";
+import { access, readFile } from "node:fs/promises";
+import path from "node:path";
+import { base64ToUint8Array, hexToUint8Array, Uint8ArrayToHex, Uint8ArrayToString } from "./encoding.js";
+import { SigstoreVerifier } from "./sigstore.js";
+import { TrustedRootProvider } from "./trust/tuf.js";
+// Ensure the global Web Crypto implementation is available when running under Node.js
+if (typeof globalThis.crypto === "undefined") {
+    globalThis.crypto = webcrypto;
+}
+const USAGE = `Usage: sigstore-browser verify-bundle [--staging] --bundle FILE --certificate-identity IDENTITY --certificate-oidc-issuer URL [--trusted-root FILE] FILE_OR_DIGEST`;
+function printUsage() {
+    console.error(USAGE);
+}
+function parseArgs(argv) {
+    const options = {};
+    let command;
+    let artifactInput;
+    for (let i = 0; i < argv.length; i++) {
+        const current = argv[i];
+        if (current === "--help" || current === "-h") {
+            printUsage();
+            process.exit(0);
+        }
+        if (current.startsWith("--")) {
+            const [name, providedValue] = current.split("=", 2);
+            switch (name) {
+                case "--bundle": {
+                    const value = providedValue ?? argv[++i];
+                    if (!value) {
+                        throw new Error("Missing value for --bundle");
+                    }
+                    options.bundlePath = value;
+                    break;
+                }
+                case "--certificate-identity": {
+                    const value = providedValue ?? argv[++i];
+                    if (!value) {
+                        throw new Error("Missing value for --certificate-identity");
+                    }
+                    options.certificateIdentity = value;
+                    break;
+                }
+                case "--certificate-oidc-issuer": {
+                    const value = providedValue ?? argv[++i];
+                    if (!value) {
+                        throw new Error("Missing value for --certificate-oidc-issuer");
+                    }
+                    options.certificateOidcIssuer = value;
+                    break;
+                }
+                case "--trusted-root": {
+                    const value = providedValue ?? argv[++i];
+                    if (!value) {
+                        throw new Error("Missing value for --trusted-root");
+                    }
+                    options.trustedRootPath = value;
+                    break;
+                }
+                default:
+                    throw new Error(`Unknown option: ${name}`);
+            }
+            continue;
+        }
+        if (!command) {
+            command = current;
+            continue;
+        }
+        if (!artifactInput) {
+            artifactInput = current;
+            continue;
+        }
+        throw new Error(`Unexpected argument: ${current}`);
+    }
+    if (command !== "verify-bundle") {
+        throw new Error("No command provided. Expected 'verify-bundle'.");
+    }
+    if (!artifactInput) {
+        throw new Error("Missing FILE_OR_DIGEST argument.");
+    }
+    if (!options.bundlePath) {
+        throw new Error("Missing required option --bundle");
+    }
+    if (!options.certificateIdentity) {
+        throw new Error("Missing required option --certificate-identity");
+    }
+    if (!options.certificateOidcIssuer) {
+        throw new Error("Missing required option --certificate-oidc-issuer");
+    }
+    return {
+        bundlePath: options.bundlePath,
+        certificateIdentity: options.certificateIdentity,
+        certificateOidcIssuer: options.certificateOidcIssuer,
+        trustedRootPath: options.trustedRootPath,
+        artifactInput,
+    };
+}
+async function fileExists(filePath) {
+    try {
+        await access(filePath);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+async function resolveArtifact(input) {
+    const digestPrefix = "sha256:";
+    if (input.startsWith(digestPrefix) &&
+        input.length === digestPrefix.length + 64 &&
+        /^[0-9a-fA-F]+$/.test(input.slice(digestPrefix.length)) &&
+        !(await fileExists(input))) {
+        return {
+            type: "digest",
+            digestHex: input.slice(digestPrefix.length).toLowerCase(),
+        };
+    }
+    const resolvedPath = path.resolve(input);
+    const artifactBuffer = await readFile(resolvedPath);
+    const digestHex = createHash("sha256").update(artifactBuffer).digest("hex");
+    return {
+        type: "file",
+        path: resolvedPath,
+        data: new Uint8Array(artifactBuffer),
+        digestHex,
+    };
+}
+async function loadTrustedRoot(pathInput) {
+    if (!pathInput) {
+        // Use TUF to fetch the latest trusted root (matches sigstore-js behavior)
+        const tufProvider = new TrustedRootProvider({
+            metadataUrl: "https://tuf-repo-cdn.sigstore.dev/",
+            targetBaseUrl: "https://tuf-repo-cdn.sigstore.dev/targets/",
+        });
+        return await tufProvider.getTrustedRoot();
+    }
+    const resolvedPath = path.resolve(pathInput);
+    const raw = await readFile(resolvedPath, "utf8");
+    return JSON.parse(raw);
+}
+async function loadBundle(bundlePath) {
+    const resolved = path.resolve(bundlePath);
+    const raw = await readFile(resolved, "utf8");
+    return JSON.parse(raw);
+}
+async function verifyBundle(options) {
+    const [trustedRoot, bundle, artifact] = await Promise.all([
+        loadTrustedRoot(options.trustedRootPath),
+        loadBundle(options.bundlePath),
+        resolveArtifact(options.artifactInput),
+    ]);
+    const verifier = new SigstoreVerifier();
+    await verifier.loadSigstoreRoot(trustedRoot);
+    // Extract and verify the artifact digest from the bundle
+    let bundleDigestHex;
+    let bundleDigestBytes;
+    if (bundle.messageSignature) {
+        // Regular bundle: digest is in messageSignature
+        if (bundle.messageSignature.messageDigest.algorithm !== "SHA2_256") {
+            throw new Error(`Unsupported message digest algorithm: ${bundle.messageSignature.messageDigest.algorithm}`);
+        }
+        bundleDigestBytes = base64ToUint8Array(bundle.messageSignature.messageDigest.digest);
+        bundleDigestHex = Uint8ArrayToHex(bundleDigestBytes).toLowerCase();
+    }
+    else if (bundle.dsseEnvelope) {
+        // DSSE bundle: digest is in the in-toto statement payload
+        const payloadBytes = base64ToUint8Array(bundle.dsseEnvelope.payload);
+        const payload = JSON.parse(Uint8ArrayToString(payloadBytes));
+        if (!payload.subject || payload.subject.length === 0) {
+            throw new Error("DSSE payload has no subject");
+        }
+        // Find matching subject by comparing artifact digest with all subjects
+        let matchedSubject = null;
+        for (const subject of payload.subject) {
+            const subjectDigest = subject.digest?.["sha256"];
+            if (subjectDigest && artifact.digestHex === subjectDigest.toLowerCase()) {
+                matchedSubject = subject;
+                break;
+            }
+        }
+        if (!matchedSubject) {
+            throw new Error(`Artifact digest ${artifact.digestHex} does not match any subject in DSSE payload`);
+        }
+        bundleDigestHex = matchedSubject.digest["sha256"].toLowerCase();
+        // Convert hex digest to bytes for verification target
+        bundleDigestBytes = hexToUint8Array(bundleDigestHex);
+    }
+    else {
+        throw new Error("Bundle does not contain a message signature or DSSE envelope");
+    }
+    // For non-DSSE bundles, verify the digest matches
+    if (bundle.messageSignature && artifact.digestHex !== bundleDigestHex) {
+        throw new Error("Artifact digest does not match the digest embedded in the bundle.");
+    }
+    const verificationTarget = artifact.type === "file" ? artifact.data : bundleDigestBytes;
+    const isDigestOnly = artifact.type === "digest";
+    await verifier.verifyArtifact(options.certificateIdentity, options.certificateOidcIssuer, bundle, verificationTarget, isDigestOnly);
+}
+async function main() {
+    try {
+        const options = parseArgs(process.argv.slice(2));
+        await verifyBundle(options);
+        console.log("Bundle verification succeeded.");
+    }
+    catch (error) {
+        if (error instanceof Error) {
+            console.error(error.message);
+        }
+        else {
+            console.error(error);
+        }
+        process.exitCode = 1;
+    }
+}
+await main();
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAEzG,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAErD,sFAAsF;AACtF,IAAI,OAAO,UAAU,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;IAC7C,UAAU,CAAC,MAAM,GAAG,SAA8B,CAAC;AACrD,CAAC;AAcD,MAAM,KAAK,GAAG,oKAAoK,CAAC;AAEnL,SAAS,UAAU;IACjB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC;AAED,SAAS,SAAS,CAAC,IAAc;IAC/B,MAAM,OAAO,GAAwB,EAAE,CAAC;IACxC,IAAI,OAA2B,CAAC;IAChC,IAAI,aAAiC,CAAC;IAEtC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAExB,IAAI,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YAC7C,UAAU,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7B,MAAM,CAAC,IAAI,EAAE,aAAa,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YAEpD,QAAQ,IAAI,EAAE,CAAC;gBACb,KAAK,UAAU,CAAC,CAAC,CAAC;oBAChB,MAAM,KAAK,GAAG,aAAa,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;oBACzC,IAAI,CAAC,KAAK,EAAE,CAAC;wBACX,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;oBAChD,CAAC;oBACD,OAAO,CAAC,UAAU,GAAG,KAAK,CAAC;oBAC3B,MAAM;gBACR,CAAC;gBACD,KAAK,wBAAwB,CAAC,CAAC,CAAC;oBAC9B,MAAM,KAAK,GAAG,aAAa,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;oBACzC,IAAI,CAAC,KAAK,EAAE,CAAC;wBACX,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;oBAC9D,CAAC;oBACD,OAAO,CAAC,mBAAmB,GAAG,KAAK,CAAC;oBACpC,MAAM;gBACR,CAAC;gBACD,KAAK,2BAA2B,CAAC,CAAC,CAAC;oBACjC,MAAM,KAAK,GAAG,aAAa,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;oBACzC,IAAI,CAAC,KAAK,EAAE,CAAC;wBACX,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;oBACjE,CAAC;oBACD,OAAO,CAAC,qBAAqB,GAAG,KAAK,CAAC;oBACtC,MAAM;gBACR,CAAC;gBACD,KAAK,gBAAgB,CAAC,CAAC,CAAC;oBACtB,MAAM,KAAK,GAAG,aAAa,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;oBACzC,IAAI,CAAC,KAAK,EAAE,CAAC;wBACX,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;oBACtD,CAAC;oBACD,OAAO,CAAC,eAAe,GAAG,KAAK,CAAC;oBAChC,MAAM;gBACR,CAAC;gBACD;oBACE,MAAM,IAAI,KAAK,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC;YAC/C,CAAC;YAED,SAAS;QACX,CAAC;QAED,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,GAAG,OAAO,CAAC;YAClB,SAAS;QACX,CAAC;QAED,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,aAAa,GAAG,OAAO,CAAC;YACxB,SAAS;QACX,CAAC;QAED,MAAM,IAAI,KAAK,CAAC,wBAAwB,OAAO,EAAE,CAAC,CAAC;IACrD,CAAC;IAED,IAAI,OAAO,KAAK,eAAe,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IAED,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IAED,OAAO;QACL,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;QACpD,eAAe,EAAE,OAAO,CAAC,eAAe;QACxC,aAAa;KACd,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,QAAgB;IACxC,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,KAAa;IAC1C,MAAM,YAAY,GAAG,SAAS,CAAC;IAE/B,IACE,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC;QAC9B,KAAK,CAAC,MAAM,KAAK,YAAY,CAAC,MAAM,GAAG,EAAE;QACzC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QACvD,CAAC,CAAC,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC,EAC1B,CAAC;QACD,OAAO;YACL,IAAI,EAAE,QAAQ;YACd,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE;SAC1D,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACzC,MAAM,cAAc,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,CAAC;IACpD,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAE5E,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,YAAY;QAClB,IAAI,EAAE,IAAI,UAAU,CAAC,cAAc,CAAC;QACpC,SAAS;KACV,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,SAA6B;IAE7B,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,0EAA0E;QAC1E,MAAM,WAAW,GAAG,IAAI,mBAAmB,CAAC;YAC1C,WAAW,EAAE,oCAAoC;YACjD,aAAa,EAAE,4CAA4C;SAC5D,CAAC,CAAC;QACH,OAAO,MAAM,WAAW,CAAC,cAAc,EAAE,CAAC;IAC5C,CAAC;IACD,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IACjD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAgB,CAAC;AACxC,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,UAAkB;IAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC7C,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAmB,CAAC;AAC3C,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,OAAmB;IAC7C,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACxD,eAAe,CAAC,OAAO,CAAC,eAAe,CAAC;QACxC,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC;QAC9B,eAAe,CAAC,OAAO,CAAC,aAAa,CAAC;KACvC,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,IAAI,gBAAgB,EAAE,CAAC;IACxC,MAAM,QAAQ,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAE7C,yDAAyD;IACzD,IAAI,eAAuB,CAAC;IAC5B,IAAI,iBAA6B,CAAC;IAElC,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;QAC5B,gDAAgD;QAChD,IAAI,MAAM,CAAC,gBAAgB,CAAC,aAAa,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;YACnE,MAAM,IAAI,KAAK,CACb,yCAAyC,MAAM,CAAC,gBAAgB,CAAC,aAAa,CAAC,SAAS,EAAE,CAC3F,CAAC;QACJ,CAAC;QAED,iBAAiB,GAAG,kBAAkB,CACpC,MAAM,CAAC,gBAAgB,CAAC,aAAa,CAAC,MAAM,CAC7C,CAAC;QACF,eAAe,GAAG,eAAe,CAAC,iBAAiB,CAAC,CAAC,WAAW,EAAE,CAAC;IACrE,CAAC;SAAM,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QAC/B,0DAA0D;QAC1D,MAAM,YAAY,GAAG,kBAAkB,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QACrE,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC,CAAC;QAE7D,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACjD,CAAC;QAED,uEAAuE;QACvE,IAAI,cAAc,GAAG,IAAI,CAAC;QAC1B,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACtC,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,CAAC;YACjD,IAAI,aAAa,IAAI,QAAQ,CAAC,SAAS,KAAK,aAAa,CAAC,WAAW,EAAE,EAAE,CAAC;gBACxE,cAAc,GAAG,OAAO,CAAC;gBACzB,MAAM;YACR,CAAC;QACH,CAAC;QAED,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CACb,mBAAmB,QAAQ,CAAC,SAAS,6CAA6C,CACnF,CAAC;QACJ,CAAC;QAED,eAAe,GAAG,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;QAEhE,sDAAsD;QACtD,iBAAiB,GAAG,eAAe,CAAC,eAAe,CAAC,CAAC;IACvD,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IAED,kDAAkD;IAClD,IAAI,MAAM,CAAC,gBAAgB,IAAI,QAAQ,CAAC,SAAS,KAAK,eAAe,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CACb,mEAAmE,CACpE,CAAC;IACJ,CAAC;IAED,MAAM,kBAAkB,GACtB,QAAQ,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC;IAC/D,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC;IAEhD,MAAM,QAAQ,CAAC,cAAc,CAC3B,OAAO,CAAC,mBAAmB,EAC3B,OAAO,CAAC,qBAAqB,EAC7B,MAAM,EACN,kBAAkB,EAClB,YAAY,CACb,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACjD,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;IAChD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;YAC3B,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC;QACD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC;AAED,MAAM,IAAI,EAAE,CAAC"}

package/dist/crypto.d.ts

@@ -0,0 +1,5 @@
+export declare function importKey(keytype: string, scheme: string, key: string): Promise<CryptoKey>;
+export declare function verifySignature(key: CryptoKey, signed: Uint8Array, sig: Uint8Array, hash?: string): Promise<boolean>;
+export declare function verifySignatureOverDigest(key: CryptoKey, digest: Uint8Array, sig: Uint8Array): Promise<boolean>;
+export { uint8ArrayEqual as bufferEqual } from "./encoding.js";
+//# sourceMappingURL=crypto.d.ts.map

package/dist/crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAgFA,wBAAsB,SAAS,CAC7B,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,SAAS,CAAC,CA2EpB;AAED,wBAAsB,eAAe,CACnC,GAAG,EAAE,SAAS,EACd,MAAM,EAAE,UAAU,EAClB,GAAG,EAAE,UAAU,EACf,IAAI,GAAE,MAAiB,GACtB,OAAO,CAAC,OAAO,CAAC,CAwFlB;AAOD,wBAAsB,yBAAyB,CAC7C,GAAG,EAAE,SAAS,EACd,MAAM,EAAE,UAAU,EAClB,GAAG,EAAE,UAAU,GACd,OAAO,CAAC,OAAO,CAAC,CA0ClB;AAED,OAAO,EAAE,eAAe,IAAI,WAAW,EAAE,MAAM,eAAe,CAAC"}