@freedomofpress/sigstore-browser 0.1.0

package/dist/interfaces.d.ts

@@ -0,0 +1,104 @@
+import { X509Certificate } from "./x509/index.js";
+export declare enum SigstoreRoots {
+    certificateAuthorities = "certificateAuthorities",
+    ctlogs = "ctlogs",
+    timestampAuthorities = "timestampAuthorities",
+    tlogs = "tlogs"
+}
+export type RawTimestampAuthorities = RawTimestampAuthority[];
+export interface TrustedRoot {
+    mediaType: string;
+    tlogs: RawLogs;
+    certificateAuthorities: RawCAs;
+    ctlogs: RawLogs;
+    timestampAuthorities: RawTimestampAuthorities;
+}
+export interface RawTimestampAuthority {
+    subject: {
+        organization: string;
+        commonName: string;
+    };
+    certChain: {
+        certificates: {
+            rawBytes: string;
+        }[];
+    };
+    validFor: {
+        start: string;
+        end?: string;
+    };
+}
+export interface CTLog {
+    logID: Uint8Array;
+    publicKey: CryptoKey;
+    validFor: {
+        start: Date;
+        end: Date;
+    };
+}
+export interface RekorKeyInfo {
+    publicKey: CryptoKey;
+    logId: Uint8Array;
+}
+export interface CertAuthority {
+    certChain: X509Certificate[];
+    validFor: {
+        start: Date;
+        end: Date;
+    };
+}
+export interface Sigstore {
+    rekor: RekorKeyInfo | undefined;
+    ctlogs: CTLog[];
+    certificateAuthorities: CertAuthority[];
+    timestampAuthorities: CertAuthority[];
+}
+export interface RawLog {
+    baseUrl: string;
+    hashAlgorithm: string;
+    publicKey: {
+        rawBytes: string;
+        keyDetails: string;
+        validFor: {
+            start: string;
+            end?: string;
+        };
+    };
+    logId: {
+        keyId: string;
+    };
+}
+export type RawLogs = RawLog[];
+export interface RawCA {
+    subject: {
+        organization: string;
+        commonName: string;
+    };
+    uri: string;
+    certChain: {
+        certificates: {
+            rawBytes: string;
+        }[];
+    };
+    validFor: {
+        start: string;
+        end?: string;
+    };
+}
+export type RawCAs = RawCA[];
+export declare enum KeyTypes {
+    Ecdsa = "ECDSA",
+    Ed25519 = "Ed25519",
+    RSA = "RSA"
+}
+export declare enum EcdsaTypes {
+    P256 = "P-256",
+    P384 = "P-384",
+    P521 = "P-521"
+}
+export declare enum HashAlgorithms {
+    SHA256 = "SHA-256",
+    SHA384 = "SHA-384",
+    SHA512 = "SHA-512"
+}
+//# sourceMappingURL=interfaces.d.ts.map

package/dist/interfaces.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"interfaces.d.ts","sourceRoot":"","sources":["../src/interfaces.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAElD,oBAAY,aAAa;IACvB,sBAAsB,2BAA2B;IACjD,MAAM,WAAW;IACjB,oBAAoB,yBAAyB;IAC7C,KAAK,UAAU;CAChB;AAED,MAAM,MAAM,uBAAuB,GAAG,qBAAqB,EAAE,CAAC;AAE9D,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,OAAO,CAAC;IACf,sBAAsB,EAAE,MAAM,CAAC;IAC/B,MAAM,EAAE,OAAO,CAAC;IAChB,oBAAoB,EAAE,uBAAuB,CAAC;CAC/C;AAED,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE;QACP,YAAY,EAAE,MAAM,CAAC;QACrB,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;IACF,SAAS,EAAE;QACT,YAAY,EAAE;YACZ,QAAQ,EAAE,MAAM,CAAC;SAClB,EAAE,CAAC;KACL,CAAC;IACF,QAAQ,EAAE;QACR,KAAK,EAAE,MAAM,CAAC;QACd,GAAG,CAAC,EAAE,MAAM,CAAC;KACd,CAAC;CACH;AAED,MAAM,WAAW,KAAK;IACpB,KAAK,EAAE,UAAU,CAAC;IAClB,SAAS,EAAE,SAAS,CAAC;IACrB,QAAQ,EAAE;QACR,KAAK,EAAE,IAAI,CAAC;QACZ,GAAG,EAAE,IAAI,CAAC;KACX,CAAC;CACH;AAED,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,SAAS,CAAC;IACrB,KAAK,EAAE,UAAU,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,eAAe,EAAE,CAAC;IAC7B,QAAQ,EAAE;QACR,KAAK,EAAE,IAAI,CAAC;QACZ,GAAG,EAAE,IAAI,CAAC;KACX,CAAC;CACH;AAED,MAAM,WAAW,QAAQ;IACvB,KAAK,EAAE,YAAY,GAAG,SAAS,CAAC;IAChC,MAAM,EAAE,KAAK,EAAE,CAAC;IAChB,sBAAsB,EAAE,aAAa,EAAE,CAAC;IACxC,oBAAoB,EAAE,aAAa,EAAE,CAAC;CACvC;AAED,MAAM,WAAW,MAAM;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE;QACT,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,EAAE,MAAM,CAAC;QACnB,QAAQ,EAAE;YACR,KAAK,EAAE,MAAM,CAAC;YACd,GAAG,CAAC,EAAE,MAAM,CAAC;SACd,CAAC;KACH,CAAC;IACF,KAAK,EAAE;QACL,KAAK,EAAE,MAAM,CAAC;KACf,CAAC;CACH;AAED,MAAM,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC;AAE/B,MAAM,WAAW,KAAK;IACpB,OAAO,EAAE;QACP,YAAY,EAAE,MAAM,CAAC;QACrB,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;IACF,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE;QACT,YAAY,EAAE;YACZ,QAAQ,EAAE,MAAM,CAAC;SAClB,EAAE,CAAC;KACL,CAAC;IACF,QAAQ,EAAE;QACR,KAAK,EAAE,MAAM,CAAC;QACd,GAAG,CAAC,EAAE,MAAM,CAAC;KACd,CAAC;CACH;AAED,MAAM,MAAM,MAAM,GAAG,KAAK,EAAE,CAAC;AAE7B,oBAAY,QAAQ;IAClB,KAAK,UAAU;IACf,OAAO,YAAY;IACnB,GAAG,QAAQ;CACZ;AAED,oBAAY,UAAU;IACpB,IAAI,UAAU;IACd,IAAI,UAAU;IACd,IAAI,UAAU;CACf;AAED,oBAAY,cAAc;IACxB,MAAM,YAAY;IAClB,MAAM,YAAY;IAClB,MAAM,YAAY;CACnB"}

package/dist/interfaces.js

@@ -0,0 +1,26 @@
+export var SigstoreRoots;
+(function (SigstoreRoots) {
+    SigstoreRoots["certificateAuthorities"] = "certificateAuthorities";
+    SigstoreRoots["ctlogs"] = "ctlogs";
+    SigstoreRoots["timestampAuthorities"] = "timestampAuthorities";
+    SigstoreRoots["tlogs"] = "tlogs";
+})(SigstoreRoots || (SigstoreRoots = {}));
+export var KeyTypes;
+(function (KeyTypes) {
+    KeyTypes["Ecdsa"] = "ECDSA";
+    KeyTypes["Ed25519"] = "Ed25519";
+    KeyTypes["RSA"] = "RSA";
+})(KeyTypes || (KeyTypes = {}));
+export var EcdsaTypes;
+(function (EcdsaTypes) {
+    EcdsaTypes["P256"] = "P-256";
+    EcdsaTypes["P384"] = "P-384";
+    EcdsaTypes["P521"] = "P-521";
+})(EcdsaTypes || (EcdsaTypes = {}));
+export var HashAlgorithms;
+(function (HashAlgorithms) {
+    HashAlgorithms["SHA256"] = "SHA-256";
+    HashAlgorithms["SHA384"] = "SHA-384";
+    HashAlgorithms["SHA512"] = "SHA-512";
+})(HashAlgorithms || (HashAlgorithms = {}));
+//# sourceMappingURL=interfaces.js.map

package/dist/interfaces.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"interfaces.js","sourceRoot":"","sources":["../src/interfaces.ts"],"names":[],"mappings":"AAEA,MAAM,CAAN,IAAY,aAKX;AALD,WAAY,aAAa;IACvB,kEAAiD,CAAA;IACjD,kCAAiB,CAAA;IACjB,8DAA6C,CAAA;IAC7C,gCAAe,CAAA;AACjB,CAAC,EALW,aAAa,KAAb,aAAa,QAKxB;AA8FD,MAAM,CAAN,IAAY,QAIX;AAJD,WAAY,QAAQ;IAClB,2BAAe,CAAA;IACf,+BAAmB,CAAA;IACnB,uBAAW,CAAA;AACb,CAAC,EAJW,QAAQ,KAAR,QAAQ,QAInB;AAED,MAAM,CAAN,IAAY,UAIX;AAJD,WAAY,UAAU;IACpB,4BAAc,CAAA;IACd,4BAAc,CAAA;IACd,4BAAc,CAAA;AAChB,CAAC,EAJW,UAAU,KAAV,UAAU,QAIrB;AAED,MAAM,CAAN,IAAY,cAIX;AAJD,WAAY,cAAc;IACxB,oCAAkB,CAAA;IAClB,oCAAkB,CAAA;IAClB,oCAAkB,CAAA;AACpB,CAAC,EAJW,cAAc,KAAd,cAAc,QAIzB"}

package/dist/oid.d.ts

@@ -0,0 +1,5 @@
+export declare const ECDSA_SIGNATURE_ALGOS: Record<string, string>;
+export declare const RSA_SIGNATURE_ALGOS: Record<string, string>;
+export declare const SHA2_HASH_ALGOS: Record<string, string>;
+export declare const ECDSA_CURVE_NAMES: Record<string, string>;
+//# sourceMappingURL=oid.d.ts.map

package/dist/oid.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oid.d.ts","sourceRoot":"","sources":["../src/oid.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,qBAAqB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAKxD,CAAC;AAGF,eAAO,MAAM,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAKtD,CAAC;AAEF,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAIlD,CAAC;AAEF,eAAO,MAAM,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAIpD,CAAC"}

package/dist/oid.js

@@ -0,0 +1,25 @@
+// From https://github.com/sigstore/sigstore-js/blob/main/packages/core/src/oid.ts
+export const ECDSA_SIGNATURE_ALGOS = {
+    "1.2.840.10045.4.3.1": "sha224",
+    "1.2.840.10045.4.3.2": "sha256",
+    "1.2.840.10045.4.3.3": "sha384",
+    "1.2.840.10045.4.3.4": "sha512",
+};
+// RSA signature algorithms
+export const RSA_SIGNATURE_ALGOS = {
+    "1.2.840.113549.1.1.11": "sha256", // sha256WithRSAEncryption
+    "1.2.840.113549.1.1.12": "sha384", // sha384WithRSAEncryption
+    "1.2.840.113549.1.1.13": "sha512", // sha512WithRSAEncryption
+    "1.2.840.113549.1.1.5": "sha1", // sha1WithRSAEncryption
+};
+export const SHA2_HASH_ALGOS = {
+    "2.16.840.1.101.3.4.2.1": "sha256",
+    "2.16.840.1.101.3.4.2.2": "sha384",
+    "2.16.840.1.101.3.4.2.3": "sha512",
+};
+export const ECDSA_CURVE_NAMES = {
+    "1.2.840.10045.3.1.7": "secp256r1",
+    "1.3.132.0.34": "secp384r1",
+    "1.3.132.0.35": "secp521r1",
+};
+//# sourceMappingURL=oid.js.map

package/dist/oid.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oid.js","sourceRoot":"","sources":["../src/oid.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAElF,MAAM,CAAC,MAAM,qBAAqB,GAA2B;IAC3D,qBAAqB,EAAE,QAAQ;IAC/B,qBAAqB,EAAE,QAAQ;IAC/B,qBAAqB,EAAE,QAAQ;IAC/B,qBAAqB,EAAE,QAAQ;CAChC,CAAC;AAEF,2BAA2B;AAC3B,MAAM,CAAC,MAAM,mBAAmB,GAA2B;IACzD,uBAAuB,EAAE,QAAQ,EAAE,0BAA0B;IAC7D,uBAAuB,EAAE,QAAQ,EAAE,0BAA0B;IAC7D,uBAAuB,EAAE,QAAQ,EAAE,0BAA0B;IAC7D,sBAAsB,EAAE,MAAM,EAAK,wBAAwB;CAC5D,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAA2B;IACrD,wBAAwB,EAAE,QAAQ;IAClC,wBAAwB,EAAE,QAAQ;IAClC,wBAAwB,EAAE,QAAQ;CACnC,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAA2B;IACvD,qBAAqB,EAAE,WAAW;IAClC,cAAc,EAAE,WAAW;IAC3B,cAAc,EAAE,WAAW;CAC5B,CAAC"}

package/dist/pem.d.ts

@@ -0,0 +1,3 @@
+export declare function toDER(certificate: string): Uint8Array;
+export declare function fromDER(certificate: Uint8Array, type?: string): string;
+//# sourceMappingURL=pem.d.ts.map

package/dist/pem.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pem.d.ts","sourceRoot":"","sources":["../src/pem.ts"],"names":[],"mappings":"AAqBA,wBAAgB,KAAK,CAAC,WAAW,EAAE,MAAM,GAAG,UAAU,CAYrD;AAKD,wBAAgB,OAAO,CAAC,WAAW,EAAE,UAAU,EAAE,IAAI,SAAgB,GAAG,MAAM,CAS7E"}

package/dist/pem.js

@@ -0,0 +1,41 @@
+/*
+Copyright 2023 The Sigstore Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+import { base64ToUint8Array, Uint8ArrayToBase64 } from "./encoding.js";
+const PEM_HEADER = /-----BEGIN (.*)-----/;
+const PEM_FOOTER = /-----END (.*)-----/;
+export function toDER(certificate) {
+    let der = "";
+    certificate.split("\n").forEach((line) => {
+        if (line.match(PEM_HEADER) || line.match(PEM_FOOTER)) {
+            return;
+        }
+        der += line;
+    });
+    return base64ToUint8Array(der);
+}
+// Translates a DER-encoded buffer into a PEM-encoded string. Standard PEM
+// encoding dictates that each certificate should have a trailing newline after
+// the footer.
+export function fromDER(certificate, type = "CERTIFICATE") {
+    // Base64-encode the certificate.
+    const der = Uint8ArrayToBase64(certificate);
+    // Split the certificate into lines of 64 characters.
+    const lines = der.match(/.{1,64}/g) || "";
+    return [`-----BEGIN ${type}-----`, ...lines, `-----END ${type}-----`]
+        .join("\n")
+        .concat("\n");
+}
+//# sourceMappingURL=pem.js.map

package/dist/pem.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pem.js","sourceRoot":"","sources":["../src/pem.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;EAcE;AAEF,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAEvE,MAAM,UAAU,GAAG,sBAAsB,CAAC;AAC1C,MAAM,UAAU,GAAG,oBAAoB,CAAC;AAExC,MAAM,UAAU,KAAK,CAAC,WAAmB;IACvC,IAAI,GAAG,GAAG,EAAE,CAAC;IAEb,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;QACvC,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;YACrD,OAAO;QACT,CAAC;QAED,GAAG,IAAI,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,OAAO,kBAAkB,CAAC,GAAG,CAAC,CAAC;AACjC,CAAC;AAED,0EAA0E;AAC1E,+EAA+E;AAC/E,cAAc;AACd,MAAM,UAAU,OAAO,CAAC,WAAuB,EAAE,IAAI,GAAG,aAAa;IACnE,iCAAiC;IACjC,MAAM,GAAG,GAAG,kBAAkB,CAAC,WAAW,CAAC,CAAC;IAC5C,qDAAqD;IACrD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;IAE1C,OAAO,CAAC,cAAc,IAAI,OAAO,EAAE,GAAG,KAAK,EAAE,YAAY,IAAI,OAAO,CAAC;SAClE,IAAI,CAAC,IAAI,CAAC;SACV,MAAM,CAAC,IAAI,CAAC,CAAC;AAClB,CAAC"}

package/dist/rfc3161/error.d.ts

@@ -0,0 +1,3 @@
+export declare class RFC3161TimestampVerificationError extends Error {
+}
+//# sourceMappingURL=error.d.ts.map

package/dist/rfc3161/error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"error.d.ts","sourceRoot":"","sources":["../../src/rfc3161/error.ts"],"names":[],"mappings":"AAeA,qBAAa,iCAAkC,SAAQ,KAAK;CAAG"}

package/dist/rfc3161/error.js

@@ -0,0 +1,18 @@
+/*
+Copyright 2023 The Sigstore Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+export class RFC3161TimestampVerificationError extends Error {
+}
+//# sourceMappingURL=error.js.map

package/dist/rfc3161/error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"error.js","sourceRoot":"","sources":["../../src/rfc3161/error.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;EAcE;AACF,MAAM,OAAO,iCAAkC,SAAQ,KAAK;CAAG"}

package/dist/rfc3161/index.d.ts

@@ -0,0 +1,2 @@
+export { RFC3161Timestamp } from "./timestamp.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/rfc3161/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/rfc3161/index.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/rfc3161/index.js

@@ -0,0 +1,17 @@
+/*
+Copyright 2023 The Sigstore Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+export { RFC3161Timestamp } from "./timestamp.js";
+//# sourceMappingURL=index.js.map

package/dist/rfc3161/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/rfc3161/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;EAcE;AAEF,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/rfc3161/timestamp.d.ts

@@ -0,0 +1,36 @@
+import { ASN1Obj } from "../asn1/index.js";
+import { TSTInfo } from "./tstinfo.js";
+export declare class RFC3161Timestamp {
+    root: ASN1Obj;
+    constructor(asn1: ASN1Obj);
+    static parse(der: Uint8Array): RFC3161Timestamp;
+    get status(): bigint;
+    get contentType(): string;
+    get eContentType(): string;
+    get signingTime(): Date;
+    get signerIssuer(): Uint8Array;
+    get signerSerialNumber(): Uint8Array;
+    get signerDigestAlgorithm(): string;
+    get signatureAlgorithm(): string;
+    get signatureValue(): Uint8Array;
+    get tstInfo(): TSTInfo;
+    verify(data: Uint8Array, publicKey: CryptoKey): Promise<void>;
+    private verifyMessageDigest;
+    private verifySignature;
+    private get pkiStatusInfoObj();
+    private get timeStampTokenObj();
+    private get contentTypeObj();
+    private get signedDataObj();
+    private get encapContentInfoObj();
+    private get signerInfosObj();
+    private get signerInfoObj();
+    private get eContentTypeObj();
+    private get eContentObj();
+    private get signedAttrsObj();
+    private get messageDigestAttributeObj();
+    private get signerSidObj();
+    private get signerDigestAlgorithmObj();
+    private get signatureAlgorithmObj();
+    private get signatureValueObj();
+}
+//# sourceMappingURL=timestamp.d.ts.map

package/dist/rfc3161/timestamp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"timestamp.d.ts","sourceRoot":"","sources":["../../src/rfc3161/timestamp.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAM3C,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAMvC,qBAAa,gBAAgB;IACpB,IAAI,EAAE,OAAO,CAAC;gBAET,IAAI,EAAE,OAAO;WAIX,KAAK,CAAC,GAAG,EAAE,UAAU,GAAG,gBAAgB;IAKtD,IAAI,MAAM,IAAI,MAAM,CAEnB;IAED,IAAI,WAAW,IAAI,MAAM,CAExB;IAED,IAAI,YAAY,IAAI,MAAM,CAEzB;IAED,IAAI,WAAW,IAAI,IAAI,CAEtB;IAED,IAAI,YAAY,IAAI,UAAU,CAE7B;IAED,IAAI,kBAAkB,IAAI,UAAU,CAEnC;IAED,IAAI,qBAAqB,IAAI,MAAM,CAOlC;IAED,IAAI,kBAAkB,IAAI,MAAM,CAI/B;IAED,IAAI,cAAc,IAAI,UAAU,CAE/B;IAED,IAAI,OAAO,IAAI,OAAO,CAGrB;IAEY,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;YA2B5D,mBAAmB;YAsBnB,eAAe;IA+B7B,OAAO,KAAK,gBAAgB,GAG3B;IAGD,OAAO,KAAK,iBAAiB,GAG5B;IAGD,OAAO,KAAK,cAAc,GAEzB;IAED,OAAO,KAAK,aAAa,GAUxB;IAGD,OAAO,KAAK,mBAAmB,GAE9B;IAGD,OAAO,KAAK,cAAc,GAIzB;IAGD,OAAO,KAAK,aAAa,GAGxB;IAGD,OAAO,KAAK,eAAe,GAE1B;IAGD,OAAO,KAAK,WAAW,GAEtB;IAGD,OAAO,KAAK,cAAc,GAQzB;IAGD,OAAO,KAAK,yBAAyB,GAUpC;IAGD,OAAO,KAAK,YAAY,GAEvB;IAGD,OAAO,KAAK,wBAAwB,GAGnC;IAGD,OAAO,KAAK,qBAAqB,GAGhC;IAGD,OAAO,KAAK,iBAAiB,GAG5B;CACF"}

package/dist/rfc3161/timestamp.js

@@ -0,0 +1,203 @@
+/*
+Copyright 2023 The Sigstore Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+import { ASN1Obj } from "../asn1/index.js";
+import { bufferEqual, verifySignature } from "../crypto.js";
+import { toArrayBuffer } from "../encoding.js";
+import { HashAlgorithms } from "../interfaces.js";
+import { ECDSA_SIGNATURE_ALGOS, RSA_SIGNATURE_ALGOS, SHA2_HASH_ALGOS } from "../oid.js";
+import { RFC3161TimestampVerificationError } from "./error.js";
+import { TSTInfo } from "./tstinfo.js";
+const OID_PKCS9_CONTENT_TYPE_SIGNED_DATA = "1.2.840.113549.1.7.2";
+const OID_PKCS9_CONTENT_TYPE_TSTINFO = "1.2.840.113549.1.9.16.1.4";
+const OID_PKCS9_MESSAGE_DIGEST_KEY = "1.2.840.113549.1.9.4";
+export class RFC3161Timestamp {
+    root;
+    constructor(asn1) {
+        this.root = asn1;
+    }
+    static parse(der) {
+        const asn1 = ASN1Obj.parseBuffer(der);
+        return new RFC3161Timestamp(asn1);
+    }
+    get status() {
+        return this.pkiStatusInfoObj.subs[0].toInteger();
+    }
+    get contentType() {
+        return this.contentTypeObj.toOID();
+    }
+    get eContentType() {
+        return this.eContentTypeObj.toOID();
+    }
+    get signingTime() {
+        return this.tstInfo.genTime;
+    }
+    get signerIssuer() {
+        return this.signerSidObj.subs[0].value;
+    }
+    get signerSerialNumber() {
+        return this.signerSidObj.subs[1].value;
+    }
+    get signerDigestAlgorithm() {
+        const oid = this.signerDigestAlgorithmObj.subs[0].toOID();
+        const algo = SHA2_HASH_ALGOS[oid];
+        if (!algo) {
+            throw new Error(`Unknown digest algorithm OID: ${oid}`);
+        }
+        return algo;
+    }
+    get signatureAlgorithm() {
+        const oid = this.signatureAlgorithmObj.subs[0].toOID();
+        const algo = ECDSA_SIGNATURE_ALGOS[oid] || RSA_SIGNATURE_ALGOS[oid];
+        return algo;
+    }
+    get signatureValue() {
+        return this.signatureValueObj.value;
+    }
+    get tstInfo() {
+        // Need to unpack tstInfo from an OCTET STRING
+        return new TSTInfo(this.eContentObj.subs[0].subs[0]);
+    }
+    async verify(data, publicKey) {
+        if (!this.timeStampTokenObj) {
+            throw new RFC3161TimestampVerificationError("timeStampToken is missing");
+        }
+        // Check for expected ContentInfo content type
+        if (this.contentType !== OID_PKCS9_CONTENT_TYPE_SIGNED_DATA) {
+            throw new RFC3161TimestampVerificationError(`incorrect content type: ${this.contentType}`);
+        }
+        // Check for expected encapsulated content type
+        if (this.eContentType !== OID_PKCS9_CONTENT_TYPE_TSTINFO) {
+            throw new RFC3161TimestampVerificationError(`incorrect encapsulated content type: ${this.eContentType}`);
+        }
+        // Check that the tstInfo references the correct artifact
+        await this.tstInfo.verify(data);
+        // Check that the signed message digest matches the tstInfo
+        await this.verifyMessageDigest();
+        // Check that the signature is valid for the signed attributes
+        await this.verifySignature(publicKey);
+    }
+    async verifyMessageDigest() {
+        // Check that the tstInfo matches the signed data
+        const hashAlg = this.signerDigestAlgorithm;
+        // Convert hash algorithm name to the format expected by WebCrypto
+        const hashAlgName = hashAlg === "sha256" ? HashAlgorithms.SHA256 :
+            hashAlg === "sha384" ? HashAlgorithms.SHA384 :
+                hashAlg === "sha512" ? HashAlgorithms.SHA512 : hashAlg;
+        const tstInfoDigest = await crypto.subtle.digest(hashAlgName, toArrayBuffer(this.tstInfo.raw));
+        const expectedDigest = this.messageDigestAttributeObj.subs[1].subs[0].value;
+        if (!bufferEqual(new Uint8Array(tstInfoDigest), expectedDigest)) {
+            throw new RFC3161TimestampVerificationError("signed data does not match tstInfo");
+        }
+    }
+    async verifySignature(key) {
+        // Encode the signed attributes for verification
+        const signedAttrs = this.signedAttrsObj.toDER();
+        signedAttrs[0] = 0x31; // Change context-specific tag to SET
+        const oid = this.signatureAlgorithmObj.subs[0].toOID();
+        // Try both ECDSA and RSA signature algorithms
+        const algo = ECDSA_SIGNATURE_ALGOS[oid] || RSA_SIGNATURE_ALGOS[oid];
+        if (!algo) {
+            throw new RFC3161TimestampVerificationError(`Unsupported signature algorithm OID: ${oid}`);
+        }
+        // Check that the signature is valid for the signed attributes
+        const verified = await verifySignature(key, signedAttrs, this.signatureValue, algo);
+        if (!verified) {
+            throw new RFC3161TimestampVerificationError("signature verification failed");
+        }
+    }
+    // https://www.rfc-editor.org/rfc/rfc3161#section-2.4.2
+    get pkiStatusInfoObj() {
+        // pkiStatusInfo is the first element of the timestamp response sequence
+        return this.root.subs[0];
+    }
+    // https://www.rfc-editor.org/rfc/rfc3161#section-2.4.2
+    get timeStampTokenObj() {
+        // timeStampToken is the first element of the timestamp response sequence
+        return this.root.subs[1];
+    }
+    // https://datatracker.ietf.org/doc/html/rfc5652#section-3
+    get contentTypeObj() {
+        return this.timeStampTokenObj.subs[0];
+    }
+    // https://www.rfc-editor.org/rfc/rfc5652#section-3
+    get signedDataObj() {
+        const obj = this.timeStampTokenObj.subs.find((sub) => sub.tag.isContextSpecific(0x00));
+        if (!obj) {
+            throw new RFC3161TimestampVerificationError("Missing timeStampTokenObj sub.");
+        }
+        return obj.subs[0];
+    }
+    // https://datatracker.ietf.org/doc/html/rfc5652#section-5.1
+    get encapContentInfoObj() {
+        return this.signedDataObj.subs[2];
+    }
+    // https://datatracker.ietf.org/doc/html/rfc5652#section-5.1
+    get signerInfosObj() {
+        // SignerInfos is the last element of the signed data sequence
+        const sd = this.signedDataObj;
+        return sd.subs[sd.subs.length - 1];
+    }
+    // https://www.rfc-editor.org/rfc/rfc5652#section-5.1
+    get signerInfoObj() {
+        // Only supporting one signer
+        return this.signerInfosObj.subs[0];
+    }
+    // https://datatracker.ietf.org/doc/html/rfc5652#section-5.2
+    get eContentTypeObj() {
+        return this.encapContentInfoObj.subs[0];
+    }
+    // https://datatracker.ietf.org/doc/html/rfc5652#section-5.2
+    get eContentObj() {
+        return this.encapContentInfoObj.subs[1];
+    }
+    // https://datatracker.ietf.org/doc/html/rfc5652#section-5.3
+    get signedAttrsObj() {
+        const signedAttrs = this.signerInfoObj.subs.find((sub) => sub.tag.isContextSpecific(0x00));
+        if (!signedAttrs) {
+            throw new RFC3161TimestampVerificationError("Missing signedAttrsObj.");
+        }
+        return signedAttrs;
+    }
+    // https://datatracker.ietf.org/doc/html/rfc5652#section-5.3
+    get messageDigestAttributeObj() {
+        const messageDigest = this.signedAttrsObj.subs.find((sub) => sub.subs[0].tag.isOID() &&
+            sub.subs[0].toOID() === OID_PKCS9_MESSAGE_DIGEST_KEY);
+        if (!messageDigest) {
+            throw new RFC3161TimestampVerificationError("Missing messageDigest.");
+        }
+        return messageDigest;
+    }
+    // https://datatracker.ietf.org/doc/html/rfc5652#section-5.3
+    get signerSidObj() {
+        return this.signerInfoObj.subs[1];
+    }
+    // https://datatracker.ietf.org/doc/html/rfc5652#section-5.3
+    get signerDigestAlgorithmObj() {
+        // Signature is the 2nd element of the signerInfoObj object
+        return this.signerInfoObj.subs[2];
+    }
+    // https://datatracker.ietf.org/doc/html/rfc5652#section-5.3
+    get signatureAlgorithmObj() {
+        // Signature is the 4th element of the signerInfoObj object
+        return this.signerInfoObj.subs[4];
+    }
+    // https://datatracker.ietf.org/doc/html/rfc5652#section-5.3
+    get signatureValueObj() {
+        // Signature is the 6th element of the signerInfoObj object
+        return this.signerInfoObj.subs[5];
+    }
+}
+//# sourceMappingURL=timestamp.js.map

package/dist/rfc3161/timestamp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"timestamp.js","sourceRoot":"","sources":["../../src/rfc3161/timestamp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;EAcE;AACF,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AACxF,OAAO,EAAE,iCAAiC,EAAE,MAAM,YAAY,CAAC;AAC/D,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAEvC,MAAM,kCAAkC,GAAG,sBAAsB,CAAC;AAClE,MAAM,8BAA8B,GAAG,2BAA2B,CAAC;AACnE,MAAM,4BAA4B,GAAG,sBAAsB,CAAC;AAE5D,MAAM,OAAO,gBAAgB;IACpB,IAAI,CAAU;IAErB,YAAY,IAAa;QACvB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAEM,MAAM,CAAC,KAAK,CAAC,GAAe;QACjC,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACtC,OAAO,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;IAED,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;IACnD,CAAC;IAED,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;IACrC,CAAC;IAED,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;IACtC,CAAC;IAED,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;IAC9B,CAAC;IAED,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACzC,CAAC;IAED,IAAI,kBAAkB;QACpB,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACzC,CAAC;IAED,IAAI,qBAAqB;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;QAC1D,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,iCAAiC,GAAG,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,kBAAkB;QACpB,MAAM,GAAG,GAAG,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;QACvD,MAAM,IAAI,GAAG,qBAAqB,CAAC,GAAG,CAAC,IAAI,mBAAmB,CAAC,GAAG,CAAC,CAAC;QACpE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,cAAc;QAChB,OAAO,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC;IACtC,CAAC;IAED,IAAI,OAAO;QACT,8CAA8C;QAC9C,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACvD,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,IAAgB,EAAE,SAAoB;QACxD,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC5B,MAAM,IAAI,iCAAiC,CAAC,2BAA2B,CAAC,CAAC;QAC3E,CAAC;QAED,8CAA8C;QAC9C,IAAI,IAAI,CAAC,WAAW,KAAK,kCAAkC,EAAE,CAAC;YAC5D,MAAM,IAAI,iCAAiC,CACzC,2BAA2B,IAAI,CAAC,WAAW,EAAE,CAC9C,CAAC;QACJ,CAAC;QAED,+CAA+C;QAC/C,IAAI,IAAI,CAAC,YAAY,KAAK,8BAA8B,EAAE,CAAC;YACzD,MAAM,IAAI,iCAAiC,CACzC,wCAAwC,IAAI,CAAC,YAAY,EAAE,CAC5D,CAAC;QACJ,CAAC;QAED,yDAAyD;QACzD,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAChC,2DAA2D;QAC3D,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACjC,8DAA8D;QAC9D,MAAM,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;IACxC,CAAC;IAEO,KAAK,CAAC,mBAAmB;QAC/B,iDAAiD;QACjD,MAAM,OAAO,GAAG,IAAI,CAAC,qBAAqB,CAAC;QAE3C,kEAAkE;QAClE,MAAM,WAAW,GAAG,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;YAC/C,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;gBAC9C,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;QAE1E,MAAM,aAAa,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAC9C,WAAW,EACX,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAChC,CAAC;QACF,MAAM,cAAc,GAAG,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAE5E,IAAI,CAAC,WAAW,CAAC,IAAI,UAAU,CAAC,aAAa,CAAC,EAAE,cAAc,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,iCAAiC,CACzC,oCAAoC,CACrC,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,eAAe,CAAC,GAAc;QAC1C,gDAAgD;QAChD,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;QAChD,WAAW,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,qCAAqC;QAE5D,MAAM,GAAG,GAAG,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;QACvD,8CAA8C;QAC9C,MAAM,IAAI,GAAG,qBAAqB,CAAC,GAAG,CAAC,IAAI,mBAAmB,CAAC,GAAG,CAAC,CAAC;QAEpE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,iCAAiC,CACzC,wCAAwC,GAAG,EAAE,CAC9C,CAAC;QACJ,CAAC;QAED,8DAA8D;QAC9D,MAAM,QAAQ,GAAG,MAAM,eAAe,CACpC,GAAG,EACH,WAAW,EACX,IAAI,CAAC,cAAc,EACnB,IAAI,CACL,CAAC;QAEF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,iCAAiC,CACzC,+BAA+B,CAChC,CAAC;QACJ,CAAC;IACH,CAAC;IAED,uDAAuD;IACvD,IAAY,gBAAgB;QAC1B,wEAAwE;QACxE,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;IAED,uDAAuD;IACvD,IAAY,iBAAiB;QAC3B,yEAAyE;QACzE,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;IAED,0DAA0D;IAC1D,IAAY,cAAc;QACxB,OAAO,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;IACD,mDAAmD;IACnD,IAAY,aAAa;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CACnD,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAChC,CAAC;QACF,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,iCAAiC,CACzC,gCAAgC,CACjC,CAAC;QACJ,CAAC;QACD,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC;IAED,4DAA4D;IAC5D,IAAY,mBAAmB;QAC7B,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpC,CAAC;IAED,4DAA4D;IAC5D,IAAY,cAAc;QACxB,8DAA8D;QAC9D,MAAM,EAAE,GAAG,IAAI,CAAC,aAAa,CAAC;QAC9B,OAAO,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACrC,CAAC;IAED,qDAAqD;IACrD,IAAY,aAAa;QACvB,6BAA6B;QAC7B,OAAO,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrC,CAAC;IAED,4DAA4D;IAC5D,IAAY,eAAe;QACzB,OAAO,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1C,CAAC;IAED,4DAA4D;IAC5D,IAAY,WAAW;QACrB,OAAO,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1C,CAAC;IAED,4DAA4D;IAC5D,IAAY,cAAc;QACxB,MAAM,WAAW,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CACvD,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAChC,CAAC;QACF,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,iCAAiC,CAAC,yBAAyB,CAAC,CAAC;QACzE,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,4DAA4D;IAC5D,IAAY,yBAAyB;QACnC,MAAM,aAAa,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CACjD,CAAC,GAAG,EAAE,EAAE,CACN,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE;YACvB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,4BAA4B,CACvD,CAAC;QACF,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,iCAAiC,CAAC,wBAAwB,CAAC,CAAC;QACxE,CAAC;QACD,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,4DAA4D;IAC5D,IAAY,YAAY;QACtB,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpC,CAAC;IAED,4DAA4D;IAC5D,IAAY,wBAAwB;QAClC,2DAA2D;QAC3D,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpC,CAAC;IAED,4DAA4D;IAC5D,IAAY,qBAAqB;QAC/B,2DAA2D;QAC3D,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpC,CAAC;IAED,4DAA4D;IAC5D,IAAY,iBAAiB;QAC3B,2DAA2D;QAC3D,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpC,CAAC;CACF"}

package/dist/rfc3161/tstinfo.d.ts

@@ -0,0 +1,13 @@
+import { ASN1Obj } from "../asn1/index.js";
+export declare class TSTInfo {
+    root: ASN1Obj;
+    constructor(asn1: ASN1Obj);
+    get version(): bigint;
+    get genTime(): Date;
+    get messageImprintHashAlgorithm(): string;
+    get messageImprintHashedMessage(): Uint8Array;
+    get raw(): Uint8Array;
+    verify(data: Uint8Array): Promise<void>;
+    private get messageImprintObj();
+}
+//# sourceMappingURL=tstinfo.d.ts.map

package/dist/rfc3161/tstinfo.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tstinfo.d.ts","sourceRoot":"","sources":["../../src/rfc3161/tstinfo.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAO3C,qBAAa,OAAO;IACX,IAAI,EAAE,OAAO,CAAC;gBAET,IAAI,EAAE,OAAO;IAIzB,IAAI,OAAO,IAAI,MAAM,CAEpB;IAED,IAAI,OAAO,IAAI,IAAI,CAElB;IAED,IAAI,2BAA2B,IAAI,MAAM,CAOxC;IAED,IAAI,2BAA2B,IAAI,UAAU,CAE5C;IAED,IAAI,GAAG,IAAI,UAAU,CAEpB;IAEY,MAAM,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAsBpD,OAAO,KAAK,iBAAiB,GAE5B;CACF"}

package/dist/rfc3161/tstinfo.js

@@ -0,0 +1,47 @@
+import { bufferEqual } from "../crypto.js";
+import { toArrayBuffer } from "../encoding.js";
+import { HashAlgorithms } from "../interfaces.js";
+import { SHA2_HASH_ALGOS } from "../oid.js";
+import { RFC3161TimestampVerificationError } from "./error.js";
+export class TSTInfo {
+    root;
+    constructor(asn1) {
+        this.root = asn1;
+    }
+    get version() {
+        return this.root.subs[0].toInteger();
+    }
+    get genTime() {
+        return this.root.subs[4].toDate();
+    }
+    get messageImprintHashAlgorithm() {
+        const oid = this.messageImprintObj.subs[0].subs[0].toOID();
+        const algo = SHA2_HASH_ALGOS[oid];
+        if (!algo) {
+            throw new Error(`Unknown message imprint hash algorithm OID: ${oid}`);
+        }
+        return algo;
+    }
+    get messageImprintHashedMessage() {
+        return this.messageImprintObj.subs[1].value;
+    }
+    get raw() {
+        return this.root.toDER();
+    }
+    async verify(data) {
+        const hashAlg = this.messageImprintHashAlgorithm;
+        // Convert hash algorithm name to the format expected by WebCrypto
+        const hashAlgName = hashAlg === "sha256" ? HashAlgorithms.SHA256 :
+            hashAlg === "sha384" ? HashAlgorithms.SHA384 :
+                hashAlg === "sha512" ? HashAlgorithms.SHA512 : hashAlg;
+        const digest = await crypto.subtle.digest(hashAlgName, toArrayBuffer(data));
+        if (!bufferEqual(new Uint8Array(digest), this.messageImprintHashedMessage)) {
+            throw new RFC3161TimestampVerificationError("message imprint does not match artifact");
+        }
+    }
+    // https://www.rfc-editor.org/rfc/rfc3161#section-2.4.2
+    get messageImprintObj() {
+        return this.root.subs[2];
+    }
+}
+//# sourceMappingURL=tstinfo.js.map

package/dist/rfc3161/tstinfo.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tstinfo.js","sourceRoot":"","sources":["../../src/rfc3161/tstinfo.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,EAAE,iCAAiC,EAAE,MAAM,YAAY,CAAC;AAE/D,MAAM,OAAO,OAAO;IACX,IAAI,CAAU;IAErB,YAAY,IAAa;QACvB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;IACvC,CAAC;IAED,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACpC,CAAC;IAED,IAAI,2BAA2B;QAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;QAC3D,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,+CAA+C,GAAG,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,2BAA2B;QAC7B,OAAO,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC9C,CAAC;IAED,IAAI,GAAG;QACL,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;IAC3B,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,IAAgB;QAClC,MAAM,OAAO,GAAG,IAAI,CAAC,2BAA2B,CAAC;QAEjD,kEAAkE;QAClE,MAAM,WAAW,GAAG,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;YAC/C,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;gBAC9C,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;QAE1E,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CACvC,WAAW,EACX,aAAa,CAAC,IAAI,CAAC,CACpB,CAAC;QACF,IACE,CAAC,WAAW,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,2BAA2B,CAAC,EACtE,CAAC;YACD,MAAM,IAAI,iCAAiC,CACzC,yCAAyC,CAC1C,CAAC;QACJ,CAAC;IACH,CAAC;IAED,uDAAuD;IACvD,IAAY,iBAAiB;QAC3B,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;CACF"}