@freedomofpress/sigstore-browser 0.1.0

package/dist/x509/cert.d.ts

@@ -0,0 +1,52 @@
+import { ASN1Obj } from "../asn1/index.js";
+import { X509AuthorityKeyIDExtension, X509BasicConstraintsExtension, X509Extension, X509FulcioIssuerV1, X509FulcioIssuerV2, X509KeyUsageExtension, X509SCTExtension, X509SubjectAlternativeNameExtension, X509SubjectKeyIDExtension } from "./ext.js";
+export declare const EXTENSION_OID_SCT = "1.3.6.1.4.1.11129.2.4.2";
+export declare class X509Certificate {
+    root: ASN1Obj;
+    constructor(asn1: ASN1Obj);
+    static parse(cert: Uint8Array | string): X509Certificate;
+    get tbsCertificate(): ASN1Obj;
+    get version(): string;
+    get serialNumber(): Uint8Array;
+    get notBefore(): Date;
+    get notAfter(): Date;
+    get issuer(): Uint8Array;
+    get subject(): Uint8Array;
+    get publicKey(): Uint8Array;
+    /**
+     * Import the public key with a specific hash algorithm for RSA keys
+     * For ECDSA keys, the hash parameter is ignored
+     */
+    getPublicKeyObj(hashAlg?: string): Promise<CryptoKey>;
+    get publicKeyObj(): Promise<CryptoKey>;
+    get signatureAlgorithm(): string;
+    get signatureValue(): Uint8Array;
+    get subjectAltName(): string | undefined;
+    get extensions(): ASN1Obj[];
+    get extKeyUsage(): X509KeyUsageExtension | undefined;
+    get extBasicConstraints(): X509BasicConstraintsExtension | undefined;
+    get extSubjectAltName(): X509SubjectAlternativeNameExtension | undefined;
+    get extAuthorityKeyID(): X509AuthorityKeyIDExtension | undefined;
+    get extSubjectKeyID(): X509SubjectKeyIDExtension | undefined;
+    get extSCT(): X509SCTExtension | undefined;
+    get extFulcioIssuerV1(): X509FulcioIssuerV1 | undefined;
+    get extFulcioIssuerV2(): X509FulcioIssuerV2 | undefined;
+    get isCA(): boolean;
+    extension(oid: string): X509Extension | undefined;
+    verify(issuerCertificate?: X509Certificate): Promise<boolean>;
+    validForDate(date: Date): boolean;
+    equals(other: X509Certificate): boolean;
+    clone(): X509Certificate;
+    private findExtension;
+    private get tbsCertificateObj();
+    private get signatureAlgorithmObj();
+    private get signatureValueObj();
+    private get versionObj();
+    private get serialNumberObj();
+    private get issuerObj();
+    private get validityObj();
+    private get subjectObj();
+    private get subjectPublicKeyInfoObj();
+    private get extensionsObj();
+}
+//# sourceMappingURL=cert.d.ts.map

package/dist/x509/cert.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cert.d.ts","sourceRoot":"","sources":["../../src/x509/cert.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAM3C,OAAO,EACL,2BAA2B,EAC3B,6BAA6B,EAC7B,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,qBAAqB,EACrB,gBAAgB,EAChB,mCAAmC,EACnC,yBAAyB,EAC1B,MAAM,UAAU,CAAC;AAWlB,eAAO,MAAM,iBAAiB,4BAA4B,CAAC;AAE3D,qBAAa,eAAe;IACnB,IAAI,EAAE,OAAO,CAAC;gBAET,IAAI,EAAE,OAAO;WAIX,KAAK,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,GAAG,eAAe;IAM/D,IAAI,cAAc,IAAI,OAAO,CAE5B;IAED,IAAI,OAAO,IAAI,MAAM,CAIpB;IAED,IAAI,YAAY,IAAI,UAAU,CAE7B;IAED,IAAI,SAAS,IAAI,IAAI,CAGpB;IAED,IAAI,QAAQ,IAAI,IAAI,CAGnB;IAED,IAAI,MAAM,IAAI,UAAU,CAEvB;IAED,IAAI,OAAO,IAAI,UAAU,CAExB;IAED,IAAI,SAAS,IAAI,UAAU,CAE1B;IAED;;;OAGG;IACU,eAAe,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC;IA6BlE,IAAI,YAAY,IAAI,OAAO,CAAC,SAAS,CAAC,CAErC;IAED,IAAI,kBAAkB,IAAI,MAAM,CAG/B;IAED,IAAI,cAAc,IAAI,UAAU,CAG/B;IAED,IAAI,cAAc,IAAI,MAAM,GAAG,SAAS,CAGvC;IAED,IAAI,UAAU,IAAI,OAAO,EAAE,CAK1B;IAED,IAAI,WAAW,IAAI,qBAAqB,GAAG,SAAS,CAGnD;IAED,IAAI,mBAAmB,IAAI,6BAA6B,GAAG,SAAS,CAGnE;IAED,IAAI,iBAAiB,IAAI,mCAAmC,GAAG,SAAS,CAGvE;IAED,IAAI,iBAAiB,IAAI,2BAA2B,GAAG,SAAS,CAG/D;IAED,IAAI,eAAe,IAAI,yBAAyB,GAAG,SAAS,CAK3D;IAED,IAAI,MAAM,IAAI,gBAAgB,GAAG,SAAS,CAGzC;IAED,IAAI,iBAAiB,IAAI,kBAAkB,GAAG,SAAS,CAGtD;IAED,IAAI,iBAAiB,IAAI,kBAAkB,GAAG,SAAS,CAGtD;IAED,IAAI,IAAI,IAAI,OAAO,CASlB;IAEM,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS;IAK3C,MAAM,CAAC,iBAAiB,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC;IAoBnE,YAAY,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO;IAIjC,MAAM,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO;IAKvC,KAAK,IAAI,eAAe;IAM/B,OAAO,CAAC,aAAa;IAYrB,OAAO,KAAK,iBAAiB,GAG5B;IAGD,OAAO,KAAK,qBAAqB,GAGhC;IAGD,OAAO,KAAK,iBAAiB,GAG5B;IAGD,OAAO,KAAK,UAAU,GAGrB;IAGD,OAAO,KAAK,eAAe,GAG1B;IAGD,OAAO,KAAK,SAAS,GAGpB;IAGD,OAAO,KAAK,WAAW,GAGtB;IAGD,OAAO,KAAK,UAAU,GAGrB;IAGD,OAAO,KAAK,uBAAuB,GAGlC;IAKD,OAAO,KAAK,aAAa,GAIxB;CACF"}

package/dist/x509/cert.js

@@ -0,0 +1,256 @@
+/*
+Copyright 2023 The Sigstore Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+import { ASN1Obj } from "../asn1/index.js";
+import { bufferEqual, importKey, verifySignature } from "../crypto.js";
+import { Uint8ArrayToBase64 } from "../encoding.js";
+import { KeyTypes } from "../interfaces.js";
+import { ECDSA_CURVE_NAMES, ECDSA_SIGNATURE_ALGOS, RSA_SIGNATURE_ALGOS } from "../oid.js";
+import * as pem from "../pem.js";
+import { X509AuthorityKeyIDExtension, X509BasicConstraintsExtension, X509Extension, X509FulcioIssuerV1, X509FulcioIssuerV2, X509KeyUsageExtension, X509SCTExtension, X509SubjectAlternativeNameExtension, X509SubjectKeyIDExtension, } from "./ext.js";
+// https://github.com/sigstore/fulcio/blob/main/docs/oid-info.md
+const EXTENSION_OID_SUBJECT_KEY_ID = "2.5.29.14";
+const EXTENSION_OID_KEY_USAGE = "2.5.29.15";
+const EXTENSION_OID_SUBJECT_ALT_NAME = "2.5.29.17";
+const EXTENSION_OID_BASIC_CONSTRAINTS = "2.5.29.19";
+const EXTENSION_OID_AUTHORITY_KEY_ID = "2.5.29.35";
+const EXTENSION_OID_FULCIO_ISSUER_V1 = "1.3.6.1.4.1.57264.1.1";
+const EXTENSION_OID_FULCIO_ISSUER_V2 = "1.3.6.1.4.1.57264.1.8";
+export const EXTENSION_OID_SCT = "1.3.6.1.4.1.11129.2.4.2";
+export class X509Certificate {
+    root;
+    constructor(asn1) {
+        this.root = asn1;
+    }
+    static parse(cert) {
+        const der = typeof cert === "string" ? pem.toDER(cert) : cert;
+        const asn1 = ASN1Obj.parseBuffer(der);
+        return new X509Certificate(asn1);
+    }
+    get tbsCertificate() {
+        return this.tbsCertificateObj;
+    }
+    get version() {
+        // version number is the first element of the version context specific tag
+        const ver = this.versionObj.subs[0].toInteger();
+        return `v${(ver + BigInt(1)).toString()}`;
+    }
+    get serialNumber() {
+        return this.serialNumberObj.value;
+    }
+    get notBefore() {
+        // notBefore is the first element of the validity sequence
+        return this.validityObj.subs[0].toDate();
+    }
+    get notAfter() {
+        // notAfter is the second element of the validity sequence
+        return this.validityObj.subs[1].toDate();
+    }
+    get issuer() {
+        return this.issuerObj.value;
+    }
+    get subject() {
+        return this.subjectObj.value;
+    }
+    get publicKey() {
+        return this.subjectPublicKeyInfoObj.toDER();
+    }
+    /**
+     * Import the public key with a specific hash algorithm for RSA keys
+     * For ECDSA keys, the hash parameter is ignored
+     */
+    async getPublicKeyObj(hashAlg) {
+        const publicKey = this.subjectPublicKeyInfoObj.toDER();
+        const spki = ASN1Obj.parseBuffer(publicKey);
+        const algorithmOID = spki.subs[0].subs[0].toOID();
+        // Check if it's an RSA key (OID 1.2.840.113549.1.1.1)
+        if (algorithmOID === "1.2.840.113549.1.1.1") {
+            // RSA key - use provided hash or default to SHA-256
+            const hash = hashAlg || "sha256";
+            let scheme;
+            if (hash.includes("384")) {
+                scheme = "SHA384";
+            }
+            else if (hash.includes("512")) {
+                scheme = "SHA512";
+            }
+            else {
+                scheme = "SHA256";
+            }
+            return importKey("RSA", `RSA_PKCS1V5_${scheme}`, Uint8ArrayToBase64(publicKey));
+        }
+        else {
+            // ECDSA key - the curve OID is in the second element
+            const curveOID = spki.subs[0].subs[1]?.toOID();
+            const curve = ECDSA_CURVE_NAMES[curveOID];
+            if (!curve) {
+                throw new Error(`Unknown ECDSA curve OID: ${curveOID}`);
+            }
+            return importKey(KeyTypes.Ecdsa, curve, Uint8ArrayToBase64(publicKey));
+        }
+    }
+    get publicKeyObj() {
+        return this.getPublicKeyObj();
+    }
+    get signatureAlgorithm() {
+        const oid = this.signatureAlgorithmObj.subs[0].toOID();
+        return ECDSA_SIGNATURE_ALGOS[oid];
+    }
+    get signatureValue() {
+        // Signature value is a bit string, so we need to skip the first byte
+        return this.signatureValueObj.value.subarray(1);
+    }
+    get subjectAltName() {
+        const ext = this.extSubjectAltName;
+        return ext?.uri || ext?.rfc822Name;
+    }
+    get extensions() {
+        // The extension list is the first (and only) element of the extensions
+        // context specific tag
+        const extSeq = this.extensionsObj?.subs[0];
+        return extSeq?.subs || /* istanbul ignore next */ [];
+    }
+    get extKeyUsage() {
+        const ext = this.findExtension(EXTENSION_OID_KEY_USAGE);
+        return ext ? new X509KeyUsageExtension(ext) : undefined;
+    }
+    get extBasicConstraints() {
+        const ext = this.findExtension(EXTENSION_OID_BASIC_CONSTRAINTS);
+        return ext ? new X509BasicConstraintsExtension(ext) : undefined;
+    }
+    get extSubjectAltName() {
+        const ext = this.findExtension(EXTENSION_OID_SUBJECT_ALT_NAME);
+        return ext ? new X509SubjectAlternativeNameExtension(ext) : undefined;
+    }
+    get extAuthorityKeyID() {
+        const ext = this.findExtension(EXTENSION_OID_AUTHORITY_KEY_ID);
+        return ext ? new X509AuthorityKeyIDExtension(ext) : undefined;
+    }
+    get extSubjectKeyID() {
+        const ext = this.findExtension(EXTENSION_OID_SUBJECT_KEY_ID);
+        return ext
+            ? new X509SubjectKeyIDExtension(ext)
+            : /* istanbul ignore next */ undefined;
+    }
+    get extSCT() {
+        const ext = this.findExtension(EXTENSION_OID_SCT);
+        return ext ? new X509SCTExtension(ext) : undefined;
+    }
+    get extFulcioIssuerV1() {
+        const ext = this.findExtension(EXTENSION_OID_FULCIO_ISSUER_V1);
+        return ext ? new X509FulcioIssuerV1(ext) : undefined;
+    }
+    get extFulcioIssuerV2() {
+        const ext = this.findExtension(EXTENSION_OID_FULCIO_ISSUER_V2);
+        return ext ? new X509FulcioIssuerV2(ext) : undefined;
+    }
+    get isCA() {
+        const ca = this.extBasicConstraints?.isCA || false;
+        // If the KeyUsage extension is present, keyCertSign must be set
+        if (this.extKeyUsage) {
+            return ca && this.extKeyUsage.keyCertSign;
+        }
+        return ca;
+    }
+    extension(oid) {
+        const ext = this.findExtension(oid);
+        return ext ? new X509Extension(ext) : undefined;
+    }
+    async verify(issuerCertificate) {
+        // Extract the hash algorithm from this certificate's signature algorithm
+        // (not the issuer's own signature algorithm)
+        const sigAlgOID = this.signatureAlgorithmObj.subs[0].toOID();
+        const hashAlg = RSA_SIGNATURE_ALGOS[sigAlgOID] || ECDSA_SIGNATURE_ALGOS[sigAlgOID];
+        // Use the issuer's public key if provided, otherwise use the subject's (for self-signed certs)
+        // Import with the correct hash algorithm for this certificate's signature
+        const publicKeyObj = issuerCertificate
+            ? await issuerCertificate.getPublicKeyObj(hashAlg)
+            : await this.getPublicKeyObj(hashAlg);
+        return await verifySignature(publicKeyObj, this.tbsCertificate.toDER(), this.signatureValue, this.signatureAlgorithm);
+    }
+    validForDate(date) {
+        return this.notBefore <= date && date <= this.notAfter;
+    }
+    equals(other) {
+        return bufferEqual(this.root.toDER(), other.root.toDER());
+    }
+    // Creates a copy of the certificate with a new buffer
+    clone() {
+        const der = this.root.toDER();
+        const clone = new Uint8Array(der);
+        return X509Certificate.parse(clone);
+    }
+    findExtension(oid) {
+        // Find the extension with the given OID. The OID will always be the first
+        // element of the extension sequence
+        return this.extensions.find((ext) => ext.subs[0].toOID() === oid);
+    }
+    /////////////////////////////////////////////////////////////////////////////
+    // The following properties use the documented x509 structure to locate the
+    // desired ASN.1 object
+    // https://www.rfc-editor.org/rfc/rfc5280#section-4.1
+    // https://www.rfc-editor.org/rfc/rfc5280#section-4.1.1.1
+    get tbsCertificateObj() {
+        // tbsCertificate is the first element of the certificate sequence
+        return this.root.subs[0];
+    }
+    // https://www.rfc-editor.org/rfc/rfc5280#section-4.1.1.2
+    get signatureAlgorithmObj() {
+        // signatureAlgorithm is the second element of the certificate sequence
+        return this.root.subs[1];
+    }
+    // https://www.rfc-editor.org/rfc/rfc5280#section-4.1.1.3
+    get signatureValueObj() {
+        // signatureValue is the third element of the certificate sequence
+        return this.root.subs[2];
+    }
+    // https://www.rfc-editor.org/rfc/rfc5280#section-4.1.2.1
+    get versionObj() {
+        // version is the first element of the tbsCertificate sequence
+        return this.tbsCertificateObj.subs[0];
+    }
+    // https://www.rfc-editor.org/rfc/rfc5280#section-4.1.2.2
+    get serialNumberObj() {
+        // serialNumber is the second element of the tbsCertificate sequence
+        return this.tbsCertificateObj.subs[1];
+    }
+    // https://www.rfc-editor.org/rfc/rfc5280#section-4.1.2.4
+    get issuerObj() {
+        // issuer is the fourth element of the tbsCertificate sequence
+        return this.tbsCertificateObj.subs[3];
+    }
+    // https://www.rfc-editor.org/rfc/rfc5280#section-4.1.2.5
+    get validityObj() {
+        // version is the fifth element of the tbsCertificate sequence
+        return this.tbsCertificateObj.subs[4];
+    }
+    // https://www.rfc-editor.org/rfc/rfc5280#section-4.1.2.6
+    get subjectObj() {
+        // subject is the sixth element of the tbsCertificate sequence
+        return this.tbsCertificateObj.subs[5];
+    }
+    // https://www.rfc-editor.org/rfc/rfc5280#section-4.1.2.7
+    get subjectPublicKeyInfoObj() {
+        // subjectPublicKeyInfo is the seventh element of the tbsCertificate sequence
+        return this.tbsCertificateObj.subs[6];
+    }
+    // Extensions can't be located by index because their position varies. Instead,
+    // we need to find the extensions context specific tag
+    // https://www.rfc-editor.org/rfc/rfc5280#section-4.1.2.9
+    get extensionsObj() {
+        return this.tbsCertificateObj.subs.find((sub) => sub.tag.isContextSpecific(0x03));
+    }
+}
+//# sourceMappingURL=cert.js.map

package/dist/x509/cert.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cert.js","sourceRoot":"","sources":["../../src/x509/cert.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;EAcE;AACF,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AACvE,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAC1F,OAAO,KAAK,GAAG,MAAM,WAAW,CAAC;AACjC,OAAO,EACL,2BAA2B,EAC3B,6BAA6B,EAC7B,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,qBAAqB,EACrB,gBAAgB,EAChB,mCAAmC,EACnC,yBAAyB,GAC1B,MAAM,UAAU,CAAC;AAElB,gEAAgE;AAChE,MAAM,4BAA4B,GAAG,WAAW,CAAC;AACjD,MAAM,uBAAuB,GAAG,WAAW,CAAC;AAC5C,MAAM,8BAA8B,GAAG,WAAW,CAAC;AACnD,MAAM,+BAA+B,GAAG,WAAW,CAAC;AACpD,MAAM,8BAA8B,GAAG,WAAW,CAAC;AACnD,MAAM,8BAA8B,GAAG,uBAAuB,CAAC;AAC/D,MAAM,8BAA8B,GAAG,uBAAuB,CAAC;AAE/D,MAAM,CAAC,MAAM,iBAAiB,GAAG,yBAAyB,CAAC;AAE3D,MAAM,OAAO,eAAe;IACnB,IAAI,CAAU;IAErB,YAAY,IAAa;QACvB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAEM,MAAM,CAAC,KAAK,CAAC,IAAyB;QAC3C,MAAM,GAAG,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9D,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACtC,OAAO,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IAED,IAAI,cAAc;QAChB,OAAO,IAAI,CAAC,iBAAiB,CAAC;IAChC,CAAC;IAED,IAAI,OAAO;QACT,0EAA0E;QAC1E,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;QAChD,OAAO,IAAI,CAAC,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;IAC5C,CAAC;IAED,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC;IACpC,CAAC;IAED,IAAI,SAAS;QACX,0DAA0D;QAC1D,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC3C,CAAC;IAED,IAAI,QAAQ;QACV,0DAA0D;QAC1D,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC3C,CAAC;IAED,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;IAC9B,CAAC;IAED,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;IAC/B,CAAC;IAED,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,uBAAuB,CAAC,KAAK,EAAE,CAAC;IAC9C,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,eAAe,CAAC,OAAgB;QAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,uBAAuB,CAAC,KAAK,EAAE,CAAC;QACvD,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QAC5C,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;QAElD,sDAAsD;QACtD,IAAI,YAAY,KAAK,sBAAsB,EAAE,CAAC;YAC5C,oDAAoD;YACpD,MAAM,IAAI,GAAG,OAAO,IAAI,QAAQ,CAAC;YACjC,IAAI,MAAc,CAAC;YACnB,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzB,MAAM,GAAG,QAAQ,CAAC;YACpB,CAAC;iBAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBAChC,MAAM,GAAG,QAAQ,CAAC;YACpB,CAAC;iBAAM,CAAC;gBACN,MAAM,GAAG,QAAQ,CAAC;YACpB,CAAC;YACD,OAAO,SAAS,CAAC,KAAK,EAAE,eAAe,MAAM,EAAE,EAAE,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAC;QAClF,CAAC;aAAM,CAAC;YACN,qDAAqD;YACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;YAC/C,MAAM,KAAK,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;YAC1C,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,KAAK,CAAC,4BAA4B,QAAQ,EAAE,CAAC,CAAC;YAC1D,CAAC;YACD,OAAO,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,EAAE,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IAED,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,eAAe,EAAE,CAAC;IAChC,CAAC;IAED,IAAI,kBAAkB;QACpB,MAAM,GAAG,GAAW,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;QAC/D,OAAO,qBAAqB,CAAC,GAAG,CAAC,CAAC;IACpC,CAAC;IAED,IAAI,cAAc;QAChB,qEAAqE;QACrE,OAAO,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAClD,CAAC;IAED,IAAI,cAAc;QAChB,MAAM,GAAG,GAAG,IAAI,CAAC,iBAAiB,CAAC;QACnC,OAAO,GAAG,EAAE,GAAG,IAAI,GAAG,EAAE,UAAU,CAAC;IACrC,CAAC;IAED,IAAI,UAAU;QACZ,uEAAuE;QACvE,uBAAuB;QACvB,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3C,OAAO,MAAM,EAAE,IAAI,IAAI,0BAA0B,CAAC,EAAE,CAAC;IACvD,CAAC;IAED,IAAI,WAAW;QACb,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,uBAAuB,CAAC,CAAC;QACxD,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1D,CAAC;IAED,IAAI,mBAAmB;QACrB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,+BAA+B,CAAC,CAAC;QAChE,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,6BAA6B,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAClE,CAAC;IAED,IAAI,iBAAiB;QACnB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,8BAA8B,CAAC,CAAC;QAC/D,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,mCAAmC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACxE,CAAC;IAED,IAAI,iBAAiB;QACnB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,8BAA8B,CAAC,CAAC;QAC/D,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,2BAA2B,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAChE,CAAC;IAED,IAAI,eAAe;QACjB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,4BAA4B,CAAC,CAAC;QAC7D,OAAO,GAAG;YACR,CAAC,CAAC,IAAI,yBAAyB,CAAC,GAAG,CAAC;YACpC,CAAC,CAAC,0BAA0B,CAAC,SAAS,CAAC;IAC3C,CAAC;IAED,IAAI,MAAM;QACR,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,iBAAiB,CAAC,CAAC;QAClD,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACrD,CAAC;IAED,IAAI,iBAAiB;QACnB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,8BAA8B,CAAC,CAAC;QAC/D,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvD,CAAC;IAED,IAAI,iBAAiB;QACnB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,8BAA8B,CAAC,CAAC;QAC/D,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvD,CAAC;IAED,IAAI,IAAI;QACN,MAAM,EAAE,GAAG,IAAI,CAAC,mBAAmB,EAAE,IAAI,IAAI,KAAK,CAAC;QAEnD,gEAAgE;QAChE,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,OAAO,EAAE,IAAI,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC;QAC5C,CAAC;QAED,OAAO,EAAE,CAAC;IACZ,CAAC;IAEM,SAAS,CAAC,GAAW;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QACpC,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAClD,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,iBAAmC;QACrD,yEAAyE;QACzE,6CAA6C;QAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;QAC7D,MAAM,OAAO,GAAG,mBAAmB,CAAC,SAAS,CAAC,IAAI,qBAAqB,CAAC,SAAS,CAAC,CAAC;QAEnF,+FAA+F;QAC/F,0EAA0E;QAC1E,MAAM,YAAY,GAAG,iBAAiB;YACpC,CAAC,CAAC,MAAM,iBAAiB,CAAC,eAAe,CAAC,OAAO,CAAC;YAClD,CAAC,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QAExC,OAAO,MAAM,eAAe,CAC1B,YAAY,EACZ,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,EAC3B,IAAI,CAAC,cAAc,EACnB,IAAI,CAAC,kBAAkB,CACxB,CAAC;IACJ,CAAC;IAEM,YAAY,CAAC,IAAU;QAC5B,OAAO,IAAI,CAAC,SAAS,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC;IACzD,CAAC;IAEM,MAAM,CAAC,KAAsB;QAClC,OAAO,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IAC5D,CAAC;IAED,sDAAsD;IAC/C,KAAK;QACV,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;QAClC,OAAO,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACtC,CAAC;IAEO,aAAa,CAAC,GAAW;QAC/B,0EAA0E;QAC1E,oCAAoC;QACpC,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC;IACpE,CAAC;IAED,6EAA6E;IAC7E,2EAA2E;IAC3E,uBAAuB;IACvB,qDAAqD;IAErD,yDAAyD;IACzD,IAAY,iBAAiB;QAC3B,kEAAkE;QAClE,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;IAED,yDAAyD;IACzD,IAAY,qBAAqB;QAC/B,uEAAuE;QACvE,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;IAED,yDAAyD;IACzD,IAAY,iBAAiB;QAC3B,kEAAkE;QAClE,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;IAED,yDAAyD;IACzD,IAAY,UAAU;QACpB,8DAA8D;QAC9D,OAAO,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;IAED,yDAAyD;IACzD,IAAY,eAAe;QACzB,oEAAoE;QACpE,OAAO,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;IAED,yDAAyD;IACzD,IAAY,SAAS;QACnB,8DAA8D;QAC9D,OAAO,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;IAED,yDAAyD;IACzD,IAAY,WAAW;QACrB,8DAA8D;QAC9D,OAAO,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;IAED,yDAAyD;IACzD,IAAY,UAAU;QACpB,8DAA8D;QAC9D,OAAO,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;IAED,yDAAyD;IACzD,IAAY,uBAAuB;QACjC,6EAA6E;QAC7E,OAAO,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;IAED,+EAA+E;IAC/E,sDAAsD;IACtD,yDAAyD;IACzD,IAAY,aAAa;QACvB,OAAO,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAC9C,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAChC,CAAC;IACJ,CAAC;CACF"}

package/dist/x509/chain.d.ts

@@ -0,0 +1,20 @@
+import { X509Certificate } from "./cert.js";
+interface CertificateChainVerifierOptions {
+    trustedCerts: X509Certificate[];
+    untrustedCert: X509Certificate;
+    timestamp: Date;
+}
+export declare class CertificateChainVerifier {
+    private untrustedCert;
+    private trustedCerts;
+    private localCerts;
+    private timestamp;
+    constructor(opts: CertificateChainVerifierOptions);
+    verify(): Promise<X509Certificate[]>;
+    private sort;
+    private buildPaths;
+    private findIssuer;
+    private checkPath;
+}
+export {};
+//# sourceMappingURL=chain.d.ts.map

package/dist/x509/chain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"chain.d.ts","sourceRoot":"","sources":["../../src/x509/chain.ts"],"names":[],"mappings":"AA4BA,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAG5C,UAAU,+BAA+B;IACvC,YAAY,EAAE,eAAe,EAAE,CAAC;IAChC,aAAa,EAAE,eAAe,CAAC;IAC/B,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,qBAAa,wBAAwB;IACnC,OAAO,CAAC,aAAa,CAAkB;IACvC,OAAO,CAAC,YAAY,CAAoB;IACxC,OAAO,CAAC,UAAU,CAAoB;IACtC,OAAO,CAAC,SAAS,CAAO;gBAEZ,IAAI,EAAE,+BAA+B;IAUpC,MAAM,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;YAkBnC,IAAI;YAoBJ,UAAU;YA4BV,UAAU;IAkDxB,OAAO,CAAC,SAAS;CA8BlB"}

package/dist/x509/chain.js

@@ -0,0 +1,141 @@
+/*
+Copyright 2023 The Sigstore Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+import { bufferEqual } from "../crypto.js";
+export class CertificateChainVerifier {
+    untrustedCert;
+    trustedCerts;
+    localCerts;
+    timestamp;
+    constructor(opts) {
+        this.untrustedCert = opts.untrustedCert;
+        this.trustedCerts = opts.trustedCerts;
+        this.localCerts = dedupeCertificates([
+            ...opts.trustedCerts,
+            opts.untrustedCert,
+        ]);
+        this.timestamp = opts.timestamp;
+    }
+    async verify() {
+        const certificatePath = await this.sort();
+        this.checkPath(certificatePath);
+        const validForDate = certificatePath.every((cert) => cert.validForDate(this.timestamp));
+        if (!validForDate) {
+            throw new Error("certificate is not valid or expired at the specified date");
+        }
+        return certificatePath;
+    }
+    async sort() {
+        const leafCert = this.untrustedCert;
+        let paths = await this.buildPaths(leafCert);
+        paths = paths.filter((path) => path.some((cert) => this.trustedCerts.includes(cert)));
+        if (paths.length === 0) {
+            throw new Error("no trusted certificate path found");
+        }
+        const path = paths.reduce((prev, curr) => prev.length < curr.length ? prev : curr);
+        return [leafCert, ...path].slice(0, -1);
+    }
+    async buildPaths(certificate) {
+        const paths = [];
+        const issuers = await this.findIssuer(certificate);
+        if (issuers.length === 0) {
+            throw new Error("no valid certificate path found");
+        }
+        for (let i = 0; i < issuers.length; i++) {
+            const issuer = issuers[i];
+            if (issuer.equals(certificate)) {
+                paths.push([certificate]);
+                continue;
+            }
+            const subPaths = await this.buildPaths(issuer);
+            for (let j = 0; j < subPaths.length; j++) {
+                paths.push([issuer, ...subPaths[j]]);
+            }
+        }
+        return paths;
+    }
+    async findIssuer(certificate) {
+        let issuers = [];
+        let keyIdentifier;
+        if (bufferEqual(certificate.subject, certificate.issuer)) {
+            if (await certificate.verify()) {
+                return [certificate];
+            }
+        }
+        if (certificate.extAuthorityKeyID) {
+            keyIdentifier = certificate.extAuthorityKeyID.keyIdentifier;
+        }
+        this.localCerts.forEach((possibleIssuer) => {
+            if (keyIdentifier) {
+                if (possibleIssuer.extSubjectKeyID) {
+                    if (bufferEqual(possibleIssuer.extSubjectKeyID.keyIdentifier, keyIdentifier)) {
+                        issuers.push(possibleIssuer);
+                    }
+                    return;
+                }
+            }
+            if (bufferEqual(possibleIssuer.subject, certificate.issuer)) {
+                issuers.push(possibleIssuer);
+            }
+        });
+        const verifiedIssuers = [];
+        for (const issuer of issuers) {
+            try {
+                if (await certificate.verify(issuer)) {
+                    verifiedIssuers.push(issuer);
+                }
+            }
+            catch (ex) {
+                // Ignore verification failures
+            }
+        }
+        return verifiedIssuers;
+    }
+    checkPath(path) {
+        if (path.length < 1) {
+            throw new Error("certificate chain must contain at least one certificate");
+        }
+        const validCAs = path.slice(1).every((cert) => cert.isCA);
+        if (!validCAs) {
+            throw new Error("intermediate certificate is not a CA");
+        }
+        for (let i = path.length - 2; i >= 0; i--) {
+            if (!bufferEqual(path[i].issuer, path[i + 1].subject)) {
+                throw new Error("incorrect certificate name chaining");
+            }
+        }
+        for (let i = 0; i < path.length; i++) {
+            const cert = path[i];
+            if (cert.extBasicConstraints?.isCA) {
+                const pathLength = cert.extBasicConstraints.pathLenConstraint;
+                if (pathLength !== undefined && pathLength < BigInt(i - 1)) {
+                    throw new Error("path length constraint exceeded");
+                }
+            }
+        }
+    }
+}
+function dedupeCertificates(certs) {
+    for (let i = 0; i < certs.length; i++) {
+        for (let j = i + 1; j < certs.length; j++) {
+            if (certs[i].equals(certs[j])) {
+                certs.splice(j, 1);
+                j--;
+            }
+        }
+    }
+    return certs;
+}
+//# sourceMappingURL=chain.js.map

package/dist/x509/chain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"chain.js","sourceRoot":"","sources":["../../src/x509/chain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;EAcE;AAeF,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAQ3C,MAAM,OAAO,wBAAwB;IAC3B,aAAa,CAAkB;IAC/B,YAAY,CAAoB;IAChC,UAAU,CAAoB;IAC9B,SAAS,CAAO;IAExB,YAAY,IAAqC;QAC/C,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC;QACxC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;QACtC,IAAI,CAAC,UAAU,GAAG,kBAAkB,CAAC;YACnC,GAAG,IAAI,CAAC,YAAY;YACpB,IAAI,CAAC,aAAa;SACnB,CAAC,CAAC;QACH,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IAClC,CAAC;IAEM,KAAK,CAAC,MAAM;QACjB,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAE1C,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;QAEhC,MAAM,YAAY,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAClD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAClC,CAAC;QAEF,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CACb,2DAA2D,CAC5D,CAAC;QACJ,CAAC;QAED,OAAO,eAAe,CAAC;IACzB,CAAC;IAEO,KAAK,CAAC,IAAI;QAChB,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC;QAEpC,IAAI,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAE5C,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAC5B,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CACtD,CAAC;QAEF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACvD,CAAC;QAED,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CACvC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CACxC,CAAC;QAEF,OAAO,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1C,CAAC;IAEO,KAAK,CAAC,UAAU,CACtB,WAA4B;QAE5B,MAAM,KAAK,GAAG,EAAE,CAAC;QACjB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;QAEnD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACrD,CAAC;QAED,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACxC,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;YAE1B,IAAI,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC/B,KAAK,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;gBAC1B,SAAS;YACX,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;YAE/C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACzC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACvC,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,KAAK,CAAC,UAAU,CACtB,WAA4B;QAE5B,IAAI,OAAO,GAAsB,EAAE,CAAC;QACpC,IAAI,aAAqC,CAAC;QAE1C,IAAI,WAAW,CAAC,WAAW,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;YACzD,IAAI,MAAM,WAAW,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC/B,OAAO,CAAC,WAAW,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;QAED,IAAI,WAAW,CAAC,iBAAiB,EAAE,CAAC;YAClC,aAAa,GAAG,WAAW,CAAC,iBAAiB,CAAC,aAAa,CAAC;QAC9D,CAAC;QAED,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,cAAc,EAAE,EAAE;YACzC,IAAI,aAAa,EAAE,CAAC;gBAClB,IAAI,cAAc,CAAC,eAAe,EAAE,CAAC;oBACnC,IACE,WAAW,CACT,cAAc,CAAC,eAAe,CAAC,aAAa,EAC5C,aAAa,CACd,EACD,CAAC;wBACD,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;oBAC/B,CAAC;oBACD,OAAO;gBACT,CAAC;YACH,CAAC;YAED,IAAI,WAAW,CAAC,cAAc,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC5D,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YAC/B,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,MAAM,eAAe,GAAsB,EAAE,CAAC;QAC9C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,CAAC;gBACH,IAAI,MAAM,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;oBACrC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAC/B,CAAC;YACH,CAAC;YAAC,OAAO,EAAE,EAAE,CAAC;gBACZ,+BAA+B;YACjC,CAAC;QACH,CAAC;QAED,OAAO,eAAe,CAAC;IACzB,CAAC;IAEO,SAAS,CAAC,IAAuB;QACvC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CACb,yDAAyD,CAC1D,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,CAAC;QAED,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC1C,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;gBACtD,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;YACzD,CAAC;QACH,CAAC;QAED,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YAErB,IAAI,IAAI,CAAC,mBAAmB,EAAE,IAAI,EAAE,CAAC;gBACnC,MAAM,UAAU,GAAG,IAAI,CAAC,mBAAmB,CAAC,iBAAiB,CAAC;gBAE9D,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;oBAC3D,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;gBACrD,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;CACF;AAED,SAAS,kBAAkB,CAAC,KAAwB;IAClD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC1C,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9B,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;gBACnB,CAAC,EAAE,CAAC;YACN,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/x509/ext.d.ts

@@ -0,0 +1,48 @@
+import { ASN1Obj } from "../asn1/index.js";
+import { SignedCertificateTimestamp } from "./sct.js";
+export declare class X509Extension {
+    protected root: ASN1Obj;
+    constructor(asn1: ASN1Obj);
+    get oid(): string;
+    get critical(): boolean;
+    get value(): Uint8Array;
+    get valueObj(): ASN1Obj;
+    protected get extnValueObj(): ASN1Obj;
+}
+export declare class X509BasicConstraintsExtension extends X509Extension {
+    get isCA(): boolean;
+    get pathLenConstraint(): bigint | undefined;
+    private get sequence();
+}
+export declare class X509KeyUsageExtension extends X509Extension {
+    get digitalSignature(): boolean;
+    get keyCertSign(): boolean;
+    get crlSign(): boolean;
+    private get bitString();
+}
+export declare class X509SubjectAlternativeNameExtension extends X509Extension {
+    get rfc822Name(): string | undefined;
+    get uri(): string | undefined;
+    otherName(oid: string): string | undefined;
+    private findGeneralName;
+    private get generalNames();
+}
+export declare class X509AuthorityKeyIDExtension extends X509Extension {
+    get keyIdentifier(): Uint8Array | undefined;
+    private findSequenceMember;
+    private get sequence();
+}
+export declare class X509SubjectKeyIDExtension extends X509Extension {
+    get keyIdentifier(): Uint8Array;
+}
+export declare class X509FulcioIssuerV1 extends X509Extension {
+    get issuer(): string;
+}
+export declare class X509FulcioIssuerV2 extends X509Extension {
+    get issuer(): string;
+}
+export declare class X509SCTExtension extends X509Extension {
+    constructor(asn1: ASN1Obj);
+    get signedCertificateTimestamps(): SignedCertificateTimestamp[];
+}
+//# sourceMappingURL=ext.d.ts.map

package/dist/x509/ext.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ext.d.ts","sourceRoot":"","sources":["../../src/x509/ext.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAG3C,OAAO,EAAE,0BAA0B,EAAE,MAAM,UAAU,CAAC;AAGtD,qBAAa,aAAa;IACxB,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC;gBAEZ,IAAI,EAAE,OAAO;IAIzB,IAAI,GAAG,IAAI,MAAM,CAEhB;IAED,IAAI,QAAQ,IAAI,OAAO,CAItB;IAED,IAAI,KAAK,IAAI,UAAU,CAEtB;IAED,IAAI,QAAQ,IAAI,OAAO,CAEtB;IAED,SAAS,KAAK,YAAY,IAAI,OAAO,CAGpC;CACF;AAGD,qBAAa,6BAA8B,SAAQ,aAAa;IAC9D,IAAI,IAAI,IAAI,OAAO,CAElB;IAED,IAAI,iBAAiB,IAAI,MAAM,GAAG,SAAS,CAI1C;IAID,OAAO,KAAK,QAAQ,GAEnB;CACF;AAGD,qBAAa,qBAAsB,SAAQ,aAAa;IACtD,IAAI,gBAAgB,IAAI,OAAO,CAE9B;IAED,IAAI,WAAW,IAAI,OAAO,CAEzB;IAED,IAAI,OAAO,IAAI,OAAO,CAErB;IAID,OAAO,KAAK,SAAS,GAEpB;CACF;AAGD,qBAAa,mCAAoC,SAAQ,aAAa;IACpE,IAAI,UAAU,IAAI,MAAM,GAAG,SAAS,CAOnC;IAED,IAAI,GAAG,IAAI,MAAM,GAAG,SAAS,CAO5B;IAGM,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAmBjD,OAAO,CAAC,eAAe;IAKvB,OAAO,KAAK,YAAY,GAEvB;CACF;AAGD,qBAAa,2BAA4B,SAAQ,aAAa;IAC5D,IAAI,aAAa,IAAI,UAAU,GAAG,SAAS,CAE1C;IAED,OAAO,CAAC,kBAAkB;IAK1B,OAAO,KAAK,QAAQ,GAEnB;CACF;AAGD,qBAAa,yBAA0B,SAAQ,aAAa;IAC1D,IAAI,aAAa,IAAI,UAAU,CAE9B;CACF;AAID,qBAAa,kBAAmB,SAAQ,aAAa;IACnD,IAAI,MAAM,IAAI,MAAM,CAEnB;CACF;AAID,qBAAa,kBAAmB,SAAQ,aAAa;IACnD,IAAI,MAAM,IAAI,MAAM,CAEnB;CACF;AAGD,qBAAa,gBAAiB,SAAQ,aAAa;gBACrC,IAAI,EAAE,OAAO;IAIzB,IAAI,2BAA2B,IAAI,0BAA0B,EAAE,CAuB9D;CACF"}