@freedomofpress/sigstore-browser 0.1.0

package/dist/stream.js

@@ -0,0 +1,114 @@
+/*
+Copyright 2023 The Sigstore Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+class StreamError extends Error {
+}
+export class ByteStream {
+    static BLOCK_SIZE = 1024;
+    buf;
+    view;
+    start = 0;
+    constructor(buffer) {
+        if (buffer) {
+            this.buf = buffer;
+            this.view = new Uint8Array(buffer);
+        }
+        else {
+            this.buf = new ArrayBuffer(0);
+            this.view = new Uint8Array(this.buf);
+        }
+    }
+    get buffer() {
+        return this.view.subarray(0, this.start);
+    }
+    get length() {
+        return this.view.byteLength;
+    }
+    get position() {
+        return this.start;
+    }
+    seek(position) {
+        this.start = position;
+    }
+    // Returns a Buffer containing the specified number of bytes starting at the
+    // given start position.
+    slice(start, len) {
+        const end = start + len;
+        if (end > this.length) {
+            throw new StreamError("request past end of buffer");
+        }
+        return this.view.subarray(start, end);
+    }
+    appendChar(char) {
+        this.ensureCapacity(1);
+        this.view[this.start] = char;
+        this.start += 1;
+    }
+    appendUint16(num) {
+        this.ensureCapacity(2);
+        const value = new Uint16Array([num]);
+        const view = new Uint8Array(value.buffer);
+        this.view[this.start] = view[1];
+        this.view[this.start + 1] = view[0];
+        this.start += 2;
+    }
+    appendUint24(num) {
+        this.ensureCapacity(3);
+        const value = new Uint32Array([num]);
+        const view = new Uint8Array(value.buffer);
+        this.view[this.start] = view[2];
+        this.view[this.start + 1] = view[1];
+        this.view[this.start + 2] = view[0];
+        this.start += 3;
+    }
+    appendView(view) {
+        this.ensureCapacity(view.length);
+        this.view.set(view, this.start);
+        this.start += view.length;
+    }
+    getBlock(size) {
+        if (size <= 0) {
+            return new Uint8Array(0);
+        }
+        if (this.start + size > this.view.length) {
+            throw new Error("request past end of buffer");
+        }
+        const result = this.view.subarray(this.start, this.start + size);
+        this.start += size;
+        return result;
+    }
+    getUint8() {
+        return this.getBlock(1)[0];
+    }
+    getUint16() {
+        const block = this.getBlock(2);
+        return (block[0] << 8) | block[1];
+    }
+    ensureCapacity(size) {
+        if (this.start + size > this.view.byteLength) {
+            const blockSize = ByteStream.BLOCK_SIZE + (size > ByteStream.BLOCK_SIZE ? size : 0);
+            this.realloc(this.view.byteLength + blockSize);
+        }
+    }
+    realloc(size) {
+        const newArray = new ArrayBuffer(size);
+        const newView = new Uint8Array(newArray);
+        // Copy the old buffer into the new one
+        newView.set(this.view);
+        this.buf = newArray;
+        this.view = newView;
+    }
+}
+//# sourceMappingURL=stream.js.map

package/dist/stream.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stream.js","sourceRoot":"","sources":["../src/stream.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;EAcE;AACF,MAAM,WAAY,SAAQ,KAAK;CAAG;AAElC,MAAM,OAAO,UAAU;IACb,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC;IAEzB,GAAG,CAAc;IACjB,IAAI,CAAa;IACjB,KAAK,GAAG,CAAC,CAAC;IAElB,YAAY,MAAoB;QAC9B,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,GAAG,GAAG,MAAM,CAAC;YAClB,IAAI,CAAC,IAAI,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;QACrC,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,GAAG,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC;YAC9B,IAAI,CAAC,IAAI,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;IAED,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC;IAED,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC;IAC9B,CAAC;IAED,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAEM,IAAI,CAAC,QAAgB;QAC1B,IAAI,CAAC,KAAK,GAAG,QAAQ,CAAC;IACxB,CAAC;IAED,4EAA4E;IAC5E,wBAAwB;IACjB,KAAK,CAAC,KAAa,EAAE,GAAW;QACrC,MAAM,GAAG,GAAG,KAAK,GAAG,GAAG,CAAC;QAExB,IAAI,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YACtB,MAAM,IAAI,WAAW,CAAC,4BAA4B,CAAC,CAAC;QACtD,CAAC;QAED,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACxC,CAAC;IAEM,UAAU,CAAC,IAAY;QAC5B,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;QAC7B,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC;IAClB,CAAC;IAEM,YAAY,CAAC,GAAW;QAC7B,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;QAEvB,MAAM,KAAK,GAAG,IAAI,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACrC,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAE1C,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAChC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC;IAClB,CAAC;IAEM,YAAY,CAAC,GAAW;QAC7B,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;QAEvB,MAAM,KAAK,GAAG,IAAI,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACrC,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAE1C,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAChC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC;IAClB,CAAC;IAEM,UAAU,CAAC,IAAgB;QAChC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC;IAC5B,CAAC;IAEM,QAAQ,CAAC,IAAY;QAC1B,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC;YACd,OAAO,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;QAC3B,CAAC;QAED,IAAI,IAAI,CAAC,KAAK,GAAG,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;QACjE,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC;QAEnB,OAAO,MAAM,CAAC;IAChB,CAAC;IAEM,QAAQ;QACb,OAAO,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7B,CAAC;IAEM,SAAS;QACd,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAE/B,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACpC,CAAC;IAEO,cAAc,CAAC,IAAY;QACjC,IAAI,IAAI,CAAC,KAAK,GAAG,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YAC7C,MAAM,SAAS,GACb,UAAU,CAAC,UAAU,GAAG,CAAC,IAAI,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACpE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IAEO,OAAO,CAAC,IAAY;QAC1B,MAAM,QAAQ,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC;QACvC,MAAM,OAAO,GAAG,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC;QAEzC,uCAAuC;QACvC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEvB,IAAI,CAAC,GAAG,GAAG,QAAQ,CAAC;QACpB,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC;IACtB,CAAC"}

package/dist/timestamp/tsa.d.ts

@@ -0,0 +1,24 @@
+import { RFC3161Timestamp } from "../rfc3161/index.js";
+import type { RawTimestampAuthority } from "../interfaces.js";
+/**
+ * Verifies an RFC3161 timestamp against a set of timestamp authorities
+ *
+ * @param timestamp - The RFC3161 timestamp to verify
+ * @param data - The data that was timestamped
+ * @param timestampAuthorities - List of trusted timestamp authorities
+ * @returns The verified signing time
+ * @throws Error if timestamp cannot be verified
+ */
+export declare function verifyRFC3161Timestamp(timestamp: RFC3161Timestamp, data: Uint8Array, timestampAuthorities: RawTimestampAuthority[]): Promise<Date>;
+/**
+ * Extracts the verified timestamp from a bundle's timestamp verification data
+ *
+ * New functionality for Sigstore bundle integration (not in sigstore-js reference)
+ *
+ * @param timestampData - The timestamp verification data from the bundle
+ * @param signature - The signature being verified
+ * @param timestampAuthorities - List of trusted timestamp authorities
+ * @returns The verified signing time, or undefined if no timestamp
+ */
+export declare function verifyBundleTimestamp(timestampData: any, signature: Uint8Array, timestampAuthorities: RawTimestampAuthority[]): Promise<Date | undefined>;
+//# sourceMappingURL=tsa.d.ts.map

package/dist/timestamp/tsa.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tsa.d.ts","sourceRoot":"","sources":["../../src/timestamp/tsa.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAIvD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAE9D;;;;;;;;GAQG;AACH,wBAAsB,sBAAsB,CAC1C,SAAS,EAAE,gBAAgB,EAC3B,IAAI,EAAE,UAAU,EAChB,oBAAoB,EAAE,qBAAqB,EAAE,GAC5C,OAAO,CAAC,IAAI,CAAC,CAgCf;AAwFD;;;;;;;;;GASG;AACH,wBAAsB,qBAAqB,CACzC,aAAa,EAAE,GAAG,EAClB,SAAS,EAAE,UAAU,EACrB,oBAAoB,EAAE,qBAAqB,EAAE,GAC5C,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAoC3B"}

package/dist/timestamp/tsa.js

@@ -0,0 +1,150 @@
+/*
+ * TSA (Time-Stamping Authority) timestamp verification
+ *
+ * Based on sigstore-js:
+ * https://github.com/sigstore/sigstore-js/blob/main/packages/verify/src/timestamp/tsa.ts
+ *
+ * Key differences from sigstore-js:
+ * - Browser-compatible: uses Uint8Array instead of Buffer for binary data
+ * - Uses Web Crypto API for all cryptographic operations
+ * - Integrates with existing RFC3161 timestamp implementation
+ * - Uses CertificateChainVerifier for full X.509 path validation
+ * - Implements filterCertAuthorities inline (from sigstore-js/packages/verify/src/trust/filter.ts)
+ * - Adds verifyBundleTimestamp for Sigstore bundle integration (new functionality)
+ */
+import { RFC3161Timestamp } from "../rfc3161/index.js";
+import { X509Certificate, CertificateChainVerifier } from "../x509/index.js";
+import { bufferEqual } from "../crypto.js";
+import { base64ToUint8Array } from "../encoding.js";
+/**
+ * Verifies an RFC3161 timestamp against a set of timestamp authorities
+ *
+ * @param timestamp - The RFC3161 timestamp to verify
+ * @param data - The data that was timestamped
+ * @param timestampAuthorities - List of trusted timestamp authorities
+ * @returns The verified signing time
+ * @throws Error if timestamp cannot be verified
+ */
+export async function verifyRFC3161Timestamp(timestamp, data, timestampAuthorities) {
+    const signingTime = timestamp.signingTime;
+    // Filter for CAs which were valid at the time of signing
+    let validAuthorities = filterCertAuthorities(timestampAuthorities, signingTime);
+    // Filter for CAs which match serial and issuer embedded in the timestamp
+    validAuthorities = filterCAsBySerialAndIssuer(validAuthorities, {
+        serialNumber: timestamp.signerSerialNumber,
+        issuer: timestamp.signerIssuer,
+    });
+    // Check that we can verify the timestamp with AT LEAST ONE of the remaining CAs
+    const verificationResults = await Promise.allSettled(validAuthorities.map(ca => verifyTimestampForCA(timestamp, data, ca)));
+    const verified = verificationResults.some(result => result.status === "fulfilled");
+    if (!verified) {
+        const errors = verificationResults
+            .filter(r => r.status === "rejected")
+            .map(r => r.reason?.message || 'Unknown error');
+        throw new Error(`Timestamp could not be verified against any trusted authority. Errors: ${errors.join(', ')}`);
+    }
+    return signingTime;
+}
+/**
+ * Filters certificate authorities to those valid at a specific time
+ *
+ * Adapted from sigstore-js/packages/verify/src/trust/filter.ts
+ */
+function filterCertAuthorities(authorities, validAt) {
+    return authorities.filter(ca => {
+        if (ca.validFor) {
+            const start = ca.validFor.start ? new Date(ca.validFor.start) : null;
+            const end = ca.validFor.end ? new Date(ca.validFor.end) : null;
+            if (start && validAt < start) {
+                return false;
+            }
+            if (end && validAt > end) {
+                return false;
+            }
+        }
+        return true;
+    });
+}
+/**
+ * Filters certificate authorities by serial number and issuer
+ *
+ * Only checks the LEAF certificate (TSA signing cert), not the entire chain.
+ * This matches the sigstore-js reference implementation.
+ */
+function filterCAsBySerialAndIssuer(timestampAuthorities, criteria) {
+    return timestampAuthorities.filter(ca => {
+        if (!ca.certChain || ca.certChain.certificates.length === 0) {
+            return false;
+        }
+        const leafCert = X509Certificate.parse(base64ToUint8Array(ca.certChain.certificates[0].rawBytes));
+        return bufferEqual(leafCert.serialNumber, criteria.serialNumber) &&
+            bufferEqual(leafCert.issuer, criteria.issuer);
+    });
+}
+/**
+ * Verifies a timestamp against a specific certificate authority
+ */
+async function verifyTimestampForCA(timestamp, data, ca) {
+    if (!ca.certChain || ca.certChain.certificates.length === 0) {
+        throw new Error("Certificate authority missing certificate chain");
+    }
+    const leafCert = X509Certificate.parse(base64ToUint8Array(ca.certChain.certificates[0].rawBytes));
+    const signingTime = timestamp.signingTime;
+    const trustedCerts = ca.certChain.certificates
+        .slice(1)
+        .map(cert => X509Certificate.parse(base64ToUint8Array(cert.rawBytes)));
+    try {
+        const verifier = new CertificateChainVerifier({
+            untrustedCert: leafCert,
+            trustedCerts: trustedCerts,
+            timestamp: signingTime,
+        });
+        await verifier.verify();
+    }
+    catch (e) {
+        throw new Error(`TSA certificate chain verification failed: ${e instanceof Error ? e.message : String(e)}`);
+    }
+    const publicKey = await leafCert.publicKeyObj;
+    await timestamp.verify(data, publicKey);
+}
+/**
+ * Extracts the verified timestamp from a bundle's timestamp verification data
+ *
+ * New functionality for Sigstore bundle integration (not in sigstore-js reference)
+ *
+ * @param timestampData - The timestamp verification data from the bundle
+ * @param signature - The signature being verified
+ * @param timestampAuthorities - List of trusted timestamp authorities
+ * @returns The verified signing time, or undefined if no timestamp
+ */
+export async function verifyBundleTimestamp(timestampData, signature, timestampAuthorities) {
+    if (!timestampData?.rfc3161Timestamps?.length) {
+        return undefined;
+    }
+    // Check for duplicate timestamps
+    const seenTimestamps = new Set();
+    for (const tsData of timestampData.rfc3161Timestamps) {
+        if (seenTimestamps.has(tsData.signedTimestamp)) {
+            throw new Error("Duplicate TSA timestamp detected");
+        }
+        seenTimestamps.add(tsData.signedTimestamp);
+    }
+    // Process each RFC3161 timestamp
+    const errors = [];
+    for (const tsData of timestampData.rfc3161Timestamps) {
+        try {
+            // Decode the base64-encoded timestamp
+            const timestampBytes = base64ToUint8Array(tsData.signedTimestamp);
+            const timestamp = RFC3161Timestamp.parse(timestampBytes);
+            const signingTime = await verifyRFC3161Timestamp(timestamp, signature, timestampAuthorities);
+            return signingTime;
+        }
+        catch (e) {
+            // Continue to next timestamp if this one fails
+            errors.push(e instanceof Error ? e.message : String(e));
+            continue;
+        }
+    }
+    throw new Error(`No valid RFC3161 timestamps found. Errors: ${errors.join(', ')}`);
+}
+//# sourceMappingURL=tsa.js.map

package/dist/timestamp/tsa.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tsa.js","sourceRoot":"","sources":["../../src/timestamp/tsa.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AAC7E,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAmB,MAAM,gBAAgB,CAAC;AAGrE;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,SAA2B,EAC3B,IAAgB,EAChB,oBAA6C;IAE7C,MAAM,WAAW,GAAG,SAAS,CAAC,WAAW,CAAC;IAE1C,yDAAyD;IACzD,IAAI,gBAAgB,GAAG,qBAAqB,CAC1C,oBAAoB,EACpB,WAAW,CACZ,CAAC;IAEF,yEAAyE;IACzE,gBAAgB,GAAG,0BAA0B,CAAC,gBAAgB,EAAE;QAC9D,YAAY,EAAE,SAAS,CAAC,kBAAkB;QAC1C,MAAM,EAAE,SAAS,CAAC,YAAY;KAC/B,CAAC,CAAC;IAEH,gFAAgF;IAChF,MAAM,mBAAmB,GAAG,MAAM,OAAO,CAAC,UAAU,CAClD,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,oBAAoB,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CACtE,CAAC;IAEF,MAAM,QAAQ,GAAG,mBAAmB,CAAC,IAAI,CACvC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,WAAW,CACxC,CAAC;IAEF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,MAAM,GAAG,mBAAmB;aAC/B,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC;aACpC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAE,CAA2B,CAAC,MAAM,EAAE,OAAO,IAAI,eAAe,CAAC,CAAC;QAC7E,MAAM,IAAI,KAAK,CAAC,0EAA0E,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjH,CAAC;IAED,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;;;GAIG;AACH,SAAS,qBAAqB,CAC5B,WAAoC,EACpC,OAAa;IAEb,OAAO,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE;QAC7B,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC;YAChB,MAAM,KAAK,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACrE,MAAM,GAAG,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAE/D,IAAI,KAAK,IAAI,OAAO,GAAG,KAAK,EAAE,CAAC;gBAC7B,OAAO,KAAK,CAAC;YACf,CAAC;YACD,IAAI,GAAG,IAAI,OAAO,GAAG,GAAG,EAAE,CAAC;gBACzB,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,SAAS,0BAA0B,CACjC,oBAA6C,EAC7C,QAA0D;IAE1D,OAAO,oBAAoB,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE;QACtC,IAAI,CAAC,EAAE,CAAC,SAAS,IAAI,EAAE,CAAC,SAAS,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5D,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,CACpC,kBAAkB,CAAC,EAAE,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAC1D,CAAC;QAEF,OAAO,WAAW,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,YAAY,CAAC;YACzD,WAAW,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,oBAAoB,CACjC,SAA2B,EAC3B,IAAgB,EAChB,EAAyB;IAEzB,IAAI,CAAC,EAAE,CAAC,SAAS,IAAI,EAAE,CAAC,SAAS,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IAED,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,CACpC,kBAAkB,CAAC,EAAE,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAC1D,CAAC;IACF,MAAM,WAAW,GAAG,SAAS,CAAC,WAAW,CAAC;IAE1C,MAAM,YAAY,GAAG,EAAE,CAAC,SAAS,CAAC,YAAY;SAC3C,KAAK,CAAC,CAAC,CAAC;SACR,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAEzE,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,wBAAwB,CAAC;YAC5C,aAAa,EAAE,QAAQ;YACvB,YAAY,EAAE,YAAY;YAC1B,SAAS,EAAE,WAAW;SACvB,CAAC,CAAC;QACH,MAAM,QAAQ,CAAC,MAAM,EAAE,CAAC;IAC1B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC9G,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC;IAE9C,MAAM,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,aAAkB,EAClB,SAAqB,EACrB,oBAA6C;IAE7C,IAAI,CAAC,aAAa,EAAE,iBAAiB,EAAE,MAAM,EAAE,CAAC;QAC9C,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,iCAAiC;IACjC,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;IACzC,KAAK,MAAM,MAAM,IAAI,aAAa,CAAC,iBAAiB,EAAE,CAAC;QACrD,IAAI,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACtD,CAAC;QACD,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IAC7C,CAAC;IAED,iCAAiC;IACjC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,MAAM,IAAI,aAAa,CAAC,iBAAiB,EAAE,CAAC;QACrD,IAAI,CAAC;YACH,sCAAsC;YACtC,MAAM,cAAc,GAAG,kBAAkB,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;YAClE,MAAM,SAAS,GAAG,gBAAgB,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;YAEzD,MAAM,WAAW,GAAG,MAAM,sBAAsB,CAC9C,SAAS,EACT,SAAS,EACT,oBAAoB,CACrB,CAAC;YACF,OAAO,WAAW,CAAC;QACrB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,+CAA+C;YAC/C,MAAM,CAAC,IAAI,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YACxD,SAAS;QACX,CAAC;IACH,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,8CAA8C,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACrF,CAAC"}

package/dist/tlog/body.d.ts

@@ -0,0 +1,8 @@
+import type { SigstoreBundle, TLogEntry } from "../bundle.js";
+export interface RekorEntry {
+    apiVersion: string;
+    kind: string;
+    spec: unknown;
+}
+export declare function verifyTLogBody(entry: TLogEntry, bundle: SigstoreBundle): Promise<void>;
+//# sourceMappingURL=body.d.ts.map

package/dist/tlog/body.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"body.d.ts","sourceRoot":"","sources":["../../src/tlog/body.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAK9D,MAAM,WAAW,UAAU;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,OAAO,CAAC;CACf;AAED,wBAAsB,cAAc,CAClC,KAAK,EAAE,SAAS,EAChB,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,IAAI,CAAC,CAqBf"}

package/dist/tlog/body.js

@@ -0,0 +1,45 @@
+/*
+ * Transparency log body verification
+ *
+ * Based on sigstore-js:
+ * https://github.com/sigstore/sigstore-js/blob/main/packages/verify/src/tlog/index.ts
+ *
+ * Key differences from sigstore-js:
+ * - Browser-compatible: uses Uint8Array instead of Buffer for binary data
+ * - Direct bundle comparison instead of SignatureContent abstraction
+ */
+import { base64Decode } from "../encoding.js";
+import { verifyHashedRekordBody } from "./hashedrekord.js";
+import { verifyDSSEBody } from "./dsse.js";
+import { verifyIntotoBody } from "./intoto.js";
+export async function verifyTLogBody(entry, bundle) {
+    const rekorEntry = parseCanonicalBody(entry);
+    const { kind, version } = entry.kindVersion;
+    if (kind !== rekorEntry.kind || version !== rekorEntry.apiVersion) {
+        throw new Error(`kind/version mismatch - expected: ${kind}/${version}, received: ${rekorEntry.kind}/${rekorEntry.apiVersion}`);
+    }
+    switch (rekorEntry.kind) {
+        case "hashedrekord":
+            return verifyHashedRekordBody(rekorEntry, bundle);
+        case "dsse":
+            return verifyDSSEBody(rekorEntry, bundle);
+        case "intoto":
+            return verifyIntotoBody(rekorEntry, bundle);
+        default:
+            throw new Error(`Unsupported TLog entry kind: ${rekorEntry.kind}`);
+    }
+}
+function parseCanonicalBody(entry) {
+    try {
+        const decodedBody = base64Decode(entry.canonicalizedBody);
+        const rekorEntry = JSON.parse(decodedBody);
+        if (!rekorEntry.apiVersion || !rekorEntry.kind || !rekorEntry.spec) {
+            throw new Error("Invalid Rekor entry structure");
+        }
+        return rekorEntry;
+    }
+    catch (error) {
+        throw new Error(`Failed to parse canonicalized body: ${error instanceof Error ? error.message : String(error)}`);
+    }
+}
+//# sourceMappingURL=body.js.map

package/dist/tlog/body.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"body.js","sourceRoot":"","sources":["../../src/tlog/body.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE9C,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAQ/C,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,KAAgB,EAChB,MAAsB;IAEtB,MAAM,UAAU,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAE7C,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC,WAAW,CAAC;IAE5C,IAAI,IAAI,KAAK,UAAU,CAAC,IAAI,IAAI,OAAO,KAAK,UAAU,CAAC,UAAU,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CACb,qCAAqC,IAAI,IAAI,OAAO,eAAe,UAAU,CAAC,IAAI,IAAI,UAAU,CAAC,UAAU,EAAE,CAC9G,CAAC;IACJ,CAAC;IAED,QAAQ,UAAU,CAAC,IAAI,EAAE,CAAC;QACxB,KAAK,cAAc;YACjB,OAAO,sBAAsB,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QACpD,KAAK,MAAM;YACT,OAAO,cAAc,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAC5C,KAAK,QAAQ;YACX,OAAO,gBAAgB,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAC9C;YACE,MAAM,IAAI,KAAK,CAAC,gCAAgC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;IACvE,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAgB;IAC1C,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,YAAY,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QAC1D,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAe,CAAC;QAEzD,IAAI,CAAC,UAAU,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;YACnE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACnD,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,uCAAuC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAChG,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/tlog/checkpoint.d.ts

@@ -0,0 +1,23 @@
+import type { TLogEntry } from "../bundle.js";
+import type { RawLogs } from "../interfaces.js";
+export interface TLogSignature {
+    name: string;
+    keyHint: Uint8Array;
+    signature: Uint8Array;
+}
+export declare class SignedNote {
+    readonly note: string;
+    readonly signatures: TLogSignature[];
+    constructor(note: string, signatures: TLogSignature[]);
+    static fromString(envelope: string): SignedNote;
+}
+export declare class LogCheckpoint {
+    readonly origin: string;
+    readonly logSize: bigint;
+    readonly logHash: Uint8Array;
+    readonly rest: string[];
+    constructor(origin: string, logSize: bigint, logHash: Uint8Array, rest: string[]);
+    static fromString(note: string): LogCheckpoint;
+}
+export declare function verifyCheckpoint(entry: TLogEntry, tlogs: RawLogs): Promise<void>;
+//# sourceMappingURL=checkpoint.d.ts.map

package/dist/tlog/checkpoint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkpoint.d.ts","sourceRoot":"","sources":["../../src/tlog/checkpoint.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAShD,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,UAAU,CAAC;IACpB,SAAS,EAAE,UAAU,CAAC;CACvB;AAGD,qBAAa,UAAU;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,aAAa,EAAE,CAAC;gBAEzB,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE;IAKrD,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,UAAU;CAoChD;AAGD,qBAAa,aAAa;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;gBAGtB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,UAAU,EACnB,IAAI,EAAE,MAAM,EAAE;IAQhB,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa;CAc/C;AAGD,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,SAAS,EAChB,KAAK,EAAE,OAAO,GACb,OAAO,CAAC,IAAI,CAAC,CA8Bf"}

package/dist/tlog/checkpoint.js

@@ -0,0 +1,187 @@
+/*
+Checkpoint verification for transparency log entries.
+
+Adapted from sigstore-js for browser compatibility:
+https://github.com/sigstore/sigstore-js/blob/main/packages/verify/src/timestamp/checkpoint.ts
+
+Key differences:
+- Uses Uint8Array instead of Buffer
+- Uses Web Crypto API instead of Node.js crypto module
+- Manual handling of ED25519 (raw) vs ECDSA (DER) signature formats
+- Inline key import from raw bytes
+
+Additional functionality not in reference:
+- filterTLogsByDate() - inlined from sigstore-js/packages/verify/src/trust/filter.ts
+- importTLogKey() - new browser-compatible key import with multiple format support
+- Special handling for Rekor v2 bundles without integratedTime
+
+Follows the signed note format specification:
+https://github.com/transparency-dev/formats/blob/main/log/README.md
+*/
+import { base64ToUint8Array, stringToUint8Array, uint8ArrayEqual } from "../encoding.js";
+import { importKey, verifySignature } from "../crypto.js";
+// Signed note format per https://github.com/transparency-dev/formats
+// Body is separated from signatures by a blank line
+const CHECKPOINT_SEPARATOR = "\n\n";
+// Signature lines format: "— <identity> <base64(key_hint+signature)>\n"
+// \u2014 is the em-dash character (—)
+const SIGNATURE_REGEX = /\u2014 (\S+) (\S+)\n/g;
+// Signed checkpoint note with cryptographic signatures
+export class SignedNote {
+    note;
+    signatures;
+    constructor(note, signatures) {
+        this.note = note;
+        this.signatures = signatures;
+    }
+    static fromString(envelope) {
+        if (!envelope.includes(CHECKPOINT_SEPARATOR)) {
+            throw new Error("Missing checkpoint separator");
+        }
+        // Split body from signature lines at blank line
+        const split = envelope.indexOf(CHECKPOINT_SEPARATOR);
+        const header = envelope.slice(0, split + 1);
+        const data = envelope.slice(split + CHECKPOINT_SEPARATOR.length);
+        // Parse signature lines: "— <identity> <base64(key_hint+signature)>\n"
+        const matches = data.matchAll(SIGNATURE_REGEX);
+        const signatures = [];
+        for (const match of matches) {
+            const [, name, signature] = match;
+            const sigBytes = base64ToUint8Array(signature);
+            // First 4 bytes are key hint (SHA256 hash prefix), rest is signature
+            if (sigBytes.length < 5) {
+                throw new Error("Malformed checkpoint signature");
+            }
+            signatures.push({
+                name,
+                keyHint: sigBytes.subarray(0, 4),
+                signature: sigBytes.subarray(4),
+            });
+        }
+        if (signatures.length === 0) {
+            throw new Error("No signatures found in checkpoint");
+        }
+        return new SignedNote(header, signatures);
+    }
+}
+// Parsed checkpoint containing tree state (origin, size, root hash)
+export class LogCheckpoint {
+    origin;
+    logSize;
+    logHash;
+    rest;
+    constructor(origin, logSize, logHash, rest) {
+        this.origin = origin;
+        this.logSize = logSize;
+        this.logHash = logHash;
+        this.rest = rest;
+    }
+    static fromString(note) {
+        const lines = note.trimEnd().split("\n");
+        if (lines.length < 3) {
+            throw new Error("Too few lines in checkpoint header");
+        }
+        const origin = lines[0];
+        const logSize = BigInt(lines[1]);
+        const rootHash = base64ToUint8Array(lines[2]);
+        const rest = lines.slice(3);
+        return new LogCheckpoint(origin, logSize, rootHash, rest);
+    }
+}
+// Verifies checkpoint signature and ensures root hash matches inclusion proof
+export async function verifyCheckpoint(entry, tlogs) {
+    if (!entry.inclusionProof?.checkpoint) {
+        throw new Error("Missing checkpoint in inclusion proof");
+    }
+    // Filter by log ID first (matches entry's log ID)
+    const entryLogId = base64ToUint8Array(entry.logId.keyId);
+    const matchingTLogs = tlogs.filter((tlog) => {
+        const tlogId = base64ToUint8Array(tlog.logId.keyId);
+        return uint8ArrayEqual(tlogId, entryLogId);
+    });
+    // Then filter by date if integratedTime is available
+    // For Rekor v2 bundles, integratedTime may be null, so we skip date filtering
+    const validTLogs = entry.integratedTime
+        ? filterTLogsByDate(matchingTLogs, new Date(Number(entry.integratedTime) * 1000))
+        : matchingTLogs;
+    const inclusionProof = entry.inclusionProof;
+    const signedNote = SignedNote.fromString(inclusionProof.checkpoint.envelope);
+    const checkpoint = LogCheckpoint.fromString(signedNote.note);
+    if (!(await verifySignedNote(signedNote, validTLogs))) {
+        throw new Error("Invalid checkpoint signature");
+    }
+    const rootHash = base64ToUint8Array(inclusionProof.rootHash);
+    if (!uint8ArrayEqual(checkpoint.logHash, rootHash)) {
+        throw new Error("Root hash mismatch between checkpoint and inclusion proof");
+    }
+}
+// Verifies checkpoint signatures using trusted TLog keys
+async function verifySignedNote(signedNote, tlogs) {
+    const data = stringToUint8Array(signedNote.note);
+    // We need at least one valid signature from a known TLog
+    let hasValidSignature = false;
+    for (const signature of signedNote.signatures) {
+        // Match signature to TLog using key hint (first 4 bytes of key ID)
+        const tlog = tlogs.find((tlog) => {
+            const logId = base64ToUint8Array(tlog.logId.keyId);
+            return uint8ArrayEqual(logId.subarray(0, 4), signature.keyHint);
+        });
+        if (!tlog) {
+            // Skip unknown signatures (e.g., from witnesses we don't know about)
+            continue;
+        }
+        const publicKey = await importTLogKey(tlog);
+        // Both ED25519 and ECDSA verification are now handled by verifySignature
+        // ED25519 signatures are raw (64 bytes), ECDSA signatures are DER-encoded
+        const verified = await verifySignature(publicKey, data, signature.signature, tlog.hashAlgorithm);
+        if (verified) {
+            hasValidSignature = true;
+        }
+    }
+    return hasValidSignature;
+}
+// Inlined from sigstore-js/packages/verify/src/trust/filter.ts
+function filterTLogsByDate(tlogs, targetDate) {
+    return tlogs.filter((tlog) => {
+        const start = new Date(tlog.publicKey.validFor.start);
+        const end = tlog.publicKey.validFor.end
+            ? new Date(tlog.publicKey.validFor.end)
+            : null;
+        return targetDate >= start && (!end || targetDate <= end);
+    });
+}
+// Browser-compatible key import supporting multiple formats (not in sigstore-js reference)
+async function importTLogKey(tlog) {
+    // Parse keyDetails to extract key type and scheme
+    // Formats can be:
+    // - "PKIX_ECDSA_P256_SHA_256" (production format)
+    // - "PKIX_ED25519"
+    // - "ecdsa-sha2-nistp256" (SSH/test format)
+    const keyDetails = tlog.publicKey.keyDetails;
+    let keyType;
+    let scheme;
+    if (keyDetails === "ecdsa-sha2-nistp256") {
+        // SSH-style ECDSA P-256 format used in tests
+        keyType = "ecdsa";
+        scheme = "P256-SHA256";
+    }
+    else if (keyDetails.includes("ECDSA")) {
+        keyType = "ecdsa";
+        // Extract the curve and hash, e.g., "P256_SHA_256" from "PKIX_ECDSA_P256_SHA_256"
+        scheme = keyDetails.replace("PKIX_ECDSA_", "").replaceAll("_", "-");
+    }
+    else if (keyDetails.includes("ED25519")) {
+        keyType = "ed25519";
+        scheme = "ed25519";
+    }
+    else if (keyDetails.includes("RSA")) {
+        keyType = "rsa";
+        // Extract RSA details, e.g., "PSS_SHA_256" from "PKIX_RSA_PSS_SHA_256"
+        scheme = keyDetails.replace("PKIX_RSA_", "").replaceAll("_", "-");
+    }
+    else {
+        throw new Error(`Unsupported key type in keyDetails: ${keyDetails}`);
+    }
+    return importKey(keyType, scheme, tlog.publicKey.rawBytes);
+}
+//# sourceMappingURL=checkpoint.js.map

package/dist/tlog/checkpoint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkpoint.js","sourceRoot":"","sources":["../../src/tlog/checkpoint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;EAmBE;AAEF,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAiB,eAAe,EAAmB,MAAM,gBAAgB,CAAC;AACzH,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAI1D,qEAAqE;AACrE,oDAAoD;AACpD,MAAM,oBAAoB,GAAG,MAAM,CAAC;AACpC,wEAAwE;AACxE,sCAAsC;AACtC,MAAM,eAAe,GAAG,uBAAuB,CAAC;AAQhD,uDAAuD;AACvD,MAAM,OAAO,UAAU;IACZ,IAAI,CAAS;IACb,UAAU,CAAkB;IAErC,YAAY,IAAY,EAAE,UAA2B;QACnD,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;IAED,MAAM,CAAC,UAAU,CAAC,QAAgB;QAChC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAClD,CAAC;QAED,gDAAgD;QAChD,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;QACrD,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;QAEjE,uEAAuE;QACvE,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;QAE/C,MAAM,UAAU,GAAoB,EAAE,CAAC;QACvC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,GAAG,KAAK,CAAC;YAClC,MAAM,QAAQ,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;YAE/C,qEAAqE;YACrE,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxB,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;YACpD,CAAC;YAED,UAAU,CAAC,IAAI,CAAC;gBACd,IAAI;gBACJ,OAAO,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC;gBAChC,SAAS,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;aAChC,CAAC,CAAC;QACL,CAAC;QAED,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACvD,CAAC;QAED,OAAO,IAAI,UAAU,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAC5C,CAAC;CACF;AAED,oEAAoE;AACpE,MAAM,OAAO,aAAa;IACf,MAAM,CAAS;IACf,OAAO,CAAS;IAChB,OAAO,CAAa;IACpB,IAAI,CAAW;IAExB,YACE,MAAc,EACd,OAAe,EACf,OAAmB,EACnB,IAAc;QAEd,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,MAAM,CAAC,UAAU,CAAC,IAAY;QAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAEzC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACxD,CAAC;QAED,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACxB,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACjC,MAAM,QAAQ,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9C,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAE5B,OAAO,IAAI,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC5D,CAAC;CACF;AAED,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAAgB,EAChB,KAAc;IAEd,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,UAAU,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IAED,kDAAkD;IAClD,MAAM,UAAU,GAAG,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACzD,MAAM,aAAa,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;QAC1C,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACpD,OAAO,eAAe,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,qDAAqD;IACrD,8EAA8E;IAC9E,MAAM,UAAU,GAAG,KAAK,CAAC,cAAc;QACrC,CAAC,CAAC,iBAAiB,CAAC,aAAa,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,GAAG,IAAI,CAAC,CAAC;QACjF,CAAC,CAAC,aAAa,CAAC;IAElB,MAAM,cAAc,GAAG,KAAK,CAAC,cAAc,CAAC;IAC5C,MAAM,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC,cAAc,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC7E,MAAM,UAAU,GAAG,aAAa,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IAE7D,IAAI,CAAC,CAAC,MAAM,gBAAgB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,QAAQ,GAAG,kBAAkB,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC7D,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC/E,CAAC;AACH,CAAC;AAED,yDAAyD;AACzD,KAAK,UAAU,gBAAgB,CAC7B,UAAsB,EACtB,KAAc;IAEd,MAAM,IAAI,GAAG,kBAAkB,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IAEjD,yDAAyD;IACzD,IAAI,iBAAiB,GAAG,KAAK,CAAC;IAE9B,KAAK,MAAM,SAAS,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;QAC9C,mEAAmE;QACnE,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;YAC/B,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACnD,OAAO,eAAe,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC;QAClE,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,qEAAqE;YACrE,SAAS;QACX,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;QAE5C,yEAAyE;QACzE,0EAA0E;QAC1E,MAAM,QAAQ,GAAG,MAAM,eAAe,CACpC,SAAS,EACT,IAAI,EACJ,SAAS,CAAC,SAAS,EACnB,IAAI,CAAC,aAAa,CACnB,CAAC;QAEF,IAAI,QAAQ,EAAE,CAAC;YACb,iBAAiB,GAAG,IAAI,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAGD,+DAA+D;AAC/D,SAAS,iBAAiB,CAAC,KAAc,EAAE,UAAgB;IACzD,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;QAC3B,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACtD,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG;YACrC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC;YACvC,CAAC,CAAC,IAAI,CAAC;QAET,OAAO,UAAU,IAAI,KAAK,IAAI,CAAC,CAAC,GAAG,IAAI,UAAU,IAAI,GAAG,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;AACL,CAAC;AAED,2FAA2F;AAC3F,KAAK,UAAU,aAAa,CAAC,IAAgB;IAC3C,kDAAkD;IAClD,kBAAkB;IAClB,kDAAkD;IAClD,mBAAmB;IACnB,4CAA4C;IAC5C,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC;IAC7C,IAAI,OAAe,CAAC;IACpB,IAAI,MAAc,CAAC;IAEnB,IAAI,UAAU,KAAK,qBAAqB,EAAE,CAAC;QACzC,6CAA6C;QAC7C,OAAO,GAAG,OAAO,CAAC;QAClB,MAAM,GAAG,aAAa,CAAC;IACzB,CAAC;SAAM,IAAI,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACxC,OAAO,GAAG,OAAO,CAAC;QAClB,kFAAkF;QAClF,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACtE,CAAC;SAAM,IAAI,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1C,OAAO,GAAG,SAAS,CAAC;QACpB,MAAM,GAAG,SAAS,CAAC;IACrB,CAAC;SAAM,IAAI,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACtC,OAAO,GAAG,KAAK,CAAC;QAChB,uEAAuE;QACvE,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACpE,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,KAAK,CAAC,uCAAuC,UAAU,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,OAAO,SAAS,CACd,OAAO,EACP,MAAM,EACN,IAAI,CAAC,SAAS,CAAC,QAAQ,CACxB,CAAC;AACJ,CAAC"}

package/dist/tlog/dsse.d.ts

@@ -0,0 +1,4 @@
+import type { SigstoreBundle } from "../bundle.js";
+import type { RekorEntry } from "./body.js";
+export declare function verifyDSSEBody(entry: RekorEntry, bundle: SigstoreBundle): Promise<void>;
+//# sourceMappingURL=dsse.d.ts.map

package/dist/tlog/dsse.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dsse.d.ts","sourceRoot":"","sources":["../../src/tlog/dsse.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAwB5C,wBAAsB,cAAc,CAClC,KAAK,EAAE,UAAU,EACjB,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,IAAI,CAAC,CAaf"}