@freedomofpress/sigstore-browser 0.1.13 → 0.1.15

package/src/timestamp/tsa.ts

@@ -14,8 +14,9 @@
  */
 
 import { base64ToUint8Array, uint8ArrayEqual } from "@freedomofpress/crypto-browser";
+import { assertTimestampVerificationData } from "../bundle.js";
 import { CertificateChainVerifier, X509Certificate } from "../x509/index.js";
-import { RawTimestampAuthority } from "../interfaces.js";
+import { parseValidityPeriod, RawTimestampAuthority } from "../interfaces.js";
 import { RFC3161Timestamp } from "../rfc3161/index.js";
 
 /**
@@ -32,6 +33,20 @@ export async function verifyRFC3161Timestamp(
   data: Uint8Array,
   timestampAuthorities: RawTimestampAuthority[]
 ): Promise<Date> {
+  return (await verifyTimestamp(timestamp, data, timestampAuthorities)).signingTime;
+}
+
+export interface VerifiedTimestamp {
+  signingTime: Date;
+  // Empty means unknown, which cannot add independence to named operators.
+  operator: string;
+}
+
+async function verifyTimestamp(
+  timestamp: RFC3161Timestamp,
+  data: Uint8Array,
+  timestampAuthorities: RawTimestampAuthority[]
+): Promise<VerifiedTimestamp> {
   const signingTime = timestamp.signingTime;
 
   // Filter for CAs which were valid at the time of signing
@@ -51,18 +66,19 @@ export async function verifyRFC3161Timestamp(
     validAuthorities.map(ca => verifyTimestampForCA(timestamp, data, ca))
   );
 
-  const verified = verificationResults.some(
+  const verified = verificationResults.findIndex(
     result => result.status === "fulfilled"
   );
 
-  if (!verified) {
+  if (verified < 0) {
     const errors = verificationResults
       .filter(r => r.status === "rejected")
       .map(r => (r as PromiseRejectedResult).reason?.message || 'Unknown error');
     throw new Error(`Timestamp could not be verified against any trusted authority. Errors: ${errors.join(', ')}`);
   }
 
-  return signingTime;
+  const ca = validAuthorities[verified];
+  return { signingTime, operator: ca.operator || "" };
 }
 
 /**
@@ -75,18 +91,8 @@ function filterCertAuthorities(
   validAt: Date
 ): RawTimestampAuthority[] {
   return authorities.filter(ca => {
-    if (ca.validFor) {
-      const start = ca.validFor.start ? new Date(ca.validFor.start) : null;
-      const end = ca.validFor.end ? new Date(ca.validFor.end) : null;
-
-      if (start && validAt < start) {
-        return false;
-      }
-      if (end && validAt > end) {
-        return false;
-      }
-    }
-    return true;
+    const { start, end } = parseValidityPeriod(ca.validFor);
+    return start <= validAt && validAt <= end;
   });
 }
 
@@ -160,14 +166,15 @@ async function verifyTimestampForCA(
  * @param timestampData - The timestamp verification data from the bundle
  * @param signature - The signature being verified
  * @param timestampAuthorities - List of trusted timestamp authorities
- * @returns Array of verified signing times (empty if no timestamps present)
+ * @returns The verified signing times and their operators (empty if no timestamps present)
  * @throws Error if any timestamp fails verification or duplicates are found
  */
 export async function verifyBundleTimestamp(
   timestampData: any,
   signature: Uint8Array,
   timestampAuthorities: RawTimestampAuthority[]
-): Promise<Date[]> {
+): Promise<VerifiedTimestamp[]> {
+  assertTimestampVerificationData(timestampData);
   if (!timestampData?.rfc3161Timestamps?.length) {
     return [];
   }
@@ -175,21 +182,15 @@ export async function verifyBundleTimestamp(
   // Verify ALL timestamps - each must succeed (matches sigstore-js behavior)
   // Collect verification results for duplicate checking after verification
   // Reference: https://github.com/sigstore/sigstore-js/blob/main/packages/verify/src/verifier.ts#L86-L92
-  const verifiedResults: Array<{ signingTime: Date; signerSerialNumber: string }> = [];
+  const verifiedResults: Array<VerifiedTimestamp & { signerSerialNumber: string }> = [];
 
   for (const tsData of timestampData.rfc3161Timestamps) {
     // Decode the base64-encoded timestamp
     const timestampBytes = base64ToUint8Array(tsData.signedTimestamp);
     const timestamp = RFC3161Timestamp.parse(timestampBytes);
 
-    const signingTime = await verifyRFC3161Timestamp(
-      timestamp,
-      signature,
-      timestampAuthorities
-    );
-
     verifiedResults.push({
-      signingTime,
+      ...(await verifyTimestamp(timestamp, signature, timestampAuthorities)),
       signerSerialNumber: Array.from(timestamp.signerSerialNumber).join(','),
     });
   }
@@ -207,5 +208,5 @@ export async function verifyBundleTimestamp(
     }
   }
 
-  return verifiedResults.map(r => r.signingTime);
-}
+  return verifiedResults;
+}

package/src/tlog/body.ts

@@ -9,8 +9,9 @@
  * - Direct bundle comparison instead of SignatureContent abstraction
  */
 
-import { base64Decode } from "@freedomofpress/crypto-browser";
+import { base64Decode, base64ToUint8Array, Uint8ArrayToString } from "@freedomofpress/crypto-browser";
 import type { SigstoreBundle, TLogEntry } from "../bundle.js";
+import { X509Certificate } from "../x509/cert.js";
 import { verifyHashedRekordBody } from "./hashedrekord.js";
 import { verifyDSSEBody } from "./dsse.js";
 import { verifyIntotoBody } from "./intoto.js";
@@ -21,9 +22,11 @@ export interface RekorEntry {
   spec: unknown;
 }
 
+// Checks that the entry body matches the bundle content and was logged under the signing certificate.
 export async function verifyTLogBody(
   entry: TLogEntry,
-  bundle: SigstoreBundle
+  bundle: SigstoreBundle,
+  cert: X509Certificate,
 ): Promise<void> {
   const rekorEntry = parseCanonicalBody(entry);
 
@@ -37,16 +40,32 @@ export async function verifyTLogBody(
 
   switch (rekorEntry.kind) {
     case "hashedrekord":
-      return verifyHashedRekordBody(rekorEntry, bundle);
+      return verifyHashedRekordBody(rekorEntry, bundle, cert);
     case "dsse":
-      return verifyDSSEBody(rekorEntry, bundle);
+      return verifyDSSEBody(rekorEntry, bundle, cert);
     case "intoto":
-      return verifyIntotoBody(rekorEntry, bundle);
+      return verifyIntotoBody(rekorEntry, bundle, cert);
     default:
       throw new Error(`Unsupported TLog entry kind: ${rekorEntry.kind}`);
   }
 }
 
+// Compares the certificate recorded in the entry (base64 DER, or base64 PEM for Rekor v1) with the signing certificate.
+export function assertLoggedCertificate(
+  cert: X509Certificate,
+  encoded: unknown,
+  pem: boolean,
+): void {
+  if (typeof encoded !== "string" || encoded === "") {
+    throw new Error("TLog entry does not record the signing certificate");
+  }
+  const bytes = base64ToUint8Array(encoded);
+  const logged = X509Certificate.parse(pem ? Uint8ArrayToString(bytes) : bytes);
+  if (!cert.equals(logged)) {
+    throw new Error("Certificate in TLog entry does not match the signing certificate");
+  }
+}
+
 function parseCanonicalBody(entry: TLogEntry): RekorEntry {
   try {
     const decodedBody = base64Decode(entry.canonicalizedBody);

package/src/tlog/checkpoint.ts

@@ -7,13 +7,6 @@ https://github.com/sigstore/sigstore-js/blob/main/packages/verify/src/timestamp/
 Key differences:
 - Uses Uint8Array instead of Buffer
 - Uses Web Crypto API instead of Node.js crypto module
-- Manual handling of ED25519 (raw) vs ECDSA (DER) signature formats
-- Inline key import from raw bytes
-
-Additional functionality not in reference:
-- filterTLogsByDate() - inlined from sigstore-js/packages/verify/src/trust/filter.ts
-- importTLogKey() - new browser-compatible key import with multiple format support
-- Special handling for Rekor v2 bundles without integratedTime
 
 Follows the signed note format specification:
 https://github.com/transparency-dev/formats/blob/main/log/README.md
@@ -21,14 +14,12 @@ https://github.com/transparency-dev/formats/blob/main/log/README.md
 
 import {
   base64ToUint8Array,
-  importKey,
-  KeyTypes,
   stringToUint8Array,
   uint8ArrayEqual,
   verifySignature,
 } from "@freedomofpress/crypto-browser";
 import type { TLogEntry } from "../bundle.js";
-import type { RawLogs } from "../interfaces.js";
+import type { RekorKeyInfo } from "../interfaces.js";
 
 // Signed note format per https://github.com/transparency-dev/formats
 // Body is separated from signatures by a blank line
@@ -126,129 +117,38 @@ export class LogCheckpoint {
   }
 }
 
-// Verifies checkpoint signature and ensures root hash matches inclusion proof
+// Verifies that the checkpoint is signed by the entry's log and describes the same tree as the inclusion proof.
 export async function verifyCheckpoint(
   entry: TLogEntry,
-  tlogs: RawLogs
+  log: RekorKeyInfo
 ): Promise<void> {
-  if (!entry.inclusionProof?.checkpoint) {
+  const proof = entry.inclusionProof;
+  if (!proof?.checkpoint?.envelope) {
     throw new Error("Missing checkpoint in inclusion proof");
   }
 
-  // Filter by log ID first (matches entry's log ID)
-  const entryLogId = base64ToUint8Array(entry.logId.keyId);
-  const matchingTLogs = tlogs.filter((tlog) => {
-    const tlogId = base64ToUint8Array(tlog.logId.keyId);
-    return uint8ArrayEqual(tlogId, entryLogId);
-  });
-
-  // Then filter by date if integratedTime is available
-  // For Rekor v2 bundles, integratedTime may be null, so we skip date filtering
-  const validTLogs = entry.integratedTime
-    ? filterTLogsByDate(matchingTLogs, new Date(Number(entry.integratedTime) * 1000))
-    : matchingTLogs;
-
-  const inclusionProof = entry.inclusionProof;
-  const signedNote = SignedNote.fromString(inclusionProof.checkpoint.envelope);
+  const signedNote = SignedNote.fromString(proof.checkpoint.envelope);
   const checkpoint = LogCheckpoint.fromString(signedNote.note);
-
-  if (!(await verifySignedNote(signedNote, validTLogs))) {
-    throw new Error("Invalid checkpoint signature");
-  }
-
-  const rootHash = base64ToUint8Array(inclusionProof.rootHash);
-  if (!uint8ArrayEqual(checkpoint.logHash, rootHash)) {
-    throw new Error("Root hash mismatch between checkpoint and inclusion proof");
-  }
-}
-
-// Verifies checkpoint signatures using trusted TLog keys
-async function verifySignedNote(
-  signedNote: SignedNote,
-  tlogs: RawLogs
-): Promise<boolean> {
   const data = stringToUint8Array(signedNote.note);
 
-  // We need at least one valid signature from a known TLog
-  let hasValidSignature = false;
-
-  for (const signature of signedNote.signatures) {
-    // Match signature to TLog using key hint (first 4 bytes of key ID)
-    const tlog = tlogs.find((tlog) => {
-      const logId = base64ToUint8Array(tlog.logId.keyId);
-      return uint8ArrayEqual(logId.subarray(0, 4), signature.keyHint);
-    });
-
-    if (!tlog) {
-      // Skip unknown signatures (e.g., from witnesses we don't know about)
-      continue;
-    }
-
-    const publicKey = await importTLogKey(tlog);
-
-    // Both ED25519 and ECDSA verification are now handled by verifySignature
-    // ED25519 signatures are raw (64 bytes), ECDSA signatures are DER-encoded
-    const verified = await verifySignature(
-      publicKey,
-      data,
-      signature.signature,
-      tlog.hashAlgorithm
-    );
-
-    if (verified) {
-      hasValidSignature = true;
+  // Signatures from other parties (e.g. witnesses) are ignored; the key hint is the first 4 bytes of the log ID.
+  let valid = false;
+  for (const sig of signedNote.signatures) {
+    if (
+      uint8ArrayEqual(sig.keyHint, log.logId.subarray(0, 4)) &&
+      (await verifySignature(log.publicKey, data, sig.signature, log.hashAlgorithm))
+    ) {
+      valid = true;
     }
   }
-
-  return hasValidSignature;
-}
-
-
-// Inlined from sigstore-js/packages/verify/src/trust/filter.ts
-function filterTLogsByDate(tlogs: RawLogs, targetDate: Date): RawLogs {
-  return tlogs.filter((tlog) => {
-    const start = new Date(tlog.publicKey.validFor.start);
-    const end = tlog.publicKey.validFor.end
-      ? new Date(tlog.publicKey.validFor.end)
-      : null;
-
-    return targetDate >= start && (!end || targetDate <= end);
-  });
-}
-
-// Browser-compatible key import supporting multiple formats (not in sigstore-js reference)
-async function importTLogKey(tlog: RawLogs[0]): Promise<CryptoKey> {
-  // Parse keyDetails to extract key type and scheme
-  // Formats can be:
-  // - "PKIX_ECDSA_P256_SHA_256" (production format)
-  // - "PKIX_ED25519"
-  // - "ecdsa-sha2-nistp256" (SSH/test format)
-  const keyDetails = tlog.publicKey.keyDetails;
-  let keyType: string;
-  let scheme: string;
-
-  if (keyDetails === "ecdsa-sha2-nistp256") {
-    // SSH-style ECDSA P-256 format used in tests
-    keyType = KeyTypes.Ecdsa;
-    scheme = "P256-SHA256";
-  } else if (keyDetails.includes("ECDSA")) {
-    keyType = KeyTypes.Ecdsa;
-    // Extract the curve and hash, e.g., "P256_SHA_256" from "PKIX_ECDSA_P256_SHA_256"
-    scheme = keyDetails.replace("PKIX_ECDSA_", "").replace(/_/g, "-")
-  } else if (keyDetails.includes("ED25519")) {
-    keyType = KeyTypes.Ed25519;
-    scheme = KeyTypes.Ed25519;
-  } else if (keyDetails.includes("RSA")) {
-    keyType = KeyTypes.RSA;
-    // Extract RSA details, e.g., "PSS_SHA_256" from "PKIX_RSA_PSS_SHA_256"
-    scheme = keyDetails.replace("PKIX_RSA_", "").replace(/_/g, "-")
-  } else {
-    throw new Error(`Unsupported key type in keyDetails: ${keyDetails}`);
+  if (!valid) {
+    throw new Error("Invalid checkpoint signature");
   }
 
-  return importKey(
-    keyType,
-    scheme,
-    tlog.publicKey.rawBytes
-  );
+  if (
+    checkpoint.logSize !== BigInt(proof.treeSize) ||
+    !uint8ArrayEqual(checkpoint.logHash, base64ToUint8Array(proof.rootHash))
+  ) {
+    throw new Error("Checkpoint does not match inclusion proof");
+  }
 }

package/src/tlog/dsse.ts

@@ -14,7 +14,8 @@
 import { base64ToUint8Array, hexToUint8Array, uint8ArrayEqual } from "@freedomofpress/crypto-browser";
 import { getHashAlgorithm } from "../interfaces.js";
 import type { SigstoreBundle } from "../bundle.js";
-import type { RekorEntry } from "./body.js";
+import type { X509Certificate } from "../x509/cert.js";
+import { assertLoggedCertificate, type RekorEntry } from "./body.js";
 
 interface DSSESpec {
   signatures?: Array<{
@@ -40,15 +41,16 @@ interface DSSEEntry extends RekorEntry {
 
 export async function verifyDSSEBody(
   entry: RekorEntry,
-  bundle: SigstoreBundle
+  bundle: SigstoreBundle,
+  cert: X509Certificate,
 ): Promise<void> {
   const dsseEntry = entry as DSSEEntry;
 
   switch (dsseEntry.apiVersion) {
     case "0.0.1":
-      return verifyDSSE001Body(dsseEntry, bundle);
+      return verifyDSSE001Body(dsseEntry, bundle, cert);
     case "0.0.2":
-      return verifyDSSE002Body(dsseEntry, bundle);
+      return verifyDSSE002Body(dsseEntry, bundle, cert);
     default:
       throw new Error(
         `Unsupported dsse version: ${dsseEntry.apiVersion}`
@@ -58,7 +60,8 @@ export async function verifyDSSEBody(
 
 async function verifyDSSE001Body(
   entry: DSSEEntry,
-  bundle: SigstoreBundle
+  bundle: SigstoreBundle,
+  cert: X509Certificate,
 ): Promise<void> {
   if (!bundle.dsseEnvelope) {
     throw new Error("Bundle missing dsseEnvelope for DSSE entry");
@@ -67,6 +70,7 @@ async function verifyDSSE001Body(
   if (!entry.spec.signatures || entry.spec.signatures.length !== 1) {
     throw new Error("DSSE entry must have exactly one signature");
   }
+  assertLoggedCertificate(cert, entry.spec.signatures[0].verifier, true);
 
   const tlogSig = entry.spec.signatures[0].signature;
   const tlogSigBytes = base64ToUint8Array(tlogSig);
@@ -101,7 +105,8 @@ async function verifyDSSE001Body(
 // New functionality for DSSE v0.0.2 (not in sigstore-js reference, which only supports v0.0.1)
 async function verifyDSSE002Body(
   entry: DSSEEntry,
-  bundle: SigstoreBundle
+  bundle: SigstoreBundle,
+  cert: X509Certificate,
 ): Promise<void> {
   if (!bundle.dsseEnvelope) {
     throw new Error("Bundle missing dsseEnvelope for DSSE v0.0.2 entry");
@@ -115,6 +120,7 @@ async function verifyDSSE002Body(
   if (!spec.signatures || spec.signatures.length !== 1) {
     throw new Error("DSSE v0.0.2 entry must have exactly one signature");
   }
+  assertLoggedCertificate(cert, spec.signatures[0].verifier?.x509Certificate?.rawBytes, false);
 
   const tlogSig = spec.signatures[0].content;
   const tlogSigBytes = base64ToUint8Array(tlogSig);

package/src/tlog/hashedrekord.ts

@@ -12,7 +12,8 @@
 
 import { base64ToUint8Array, hexToUint8Array, uint8ArrayEqual } from "@freedomofpress/crypto-browser";
 import type { SigstoreBundle } from "../bundle.js";
-import type { RekorEntry } from "./body.js";
+import type { X509Certificate } from "../x509/cert.js";
+import { assertLoggedCertificate, type RekorEntry } from "./body.js";
 
 interface HashedRekordSpec {
   signature: {
@@ -39,8 +40,8 @@ interface HashedRekordV002Spec {
   hashedRekordV002: {
     signature: {
       content: string;
-      verifier: {
-        x509Certificate: {
+      verifier?: {
+        x509Certificate?: {
           rawBytes: string;
         };
       };
@@ -54,15 +55,16 @@ interface HashedRekordV002Spec {
 
 export async function verifyHashedRekordBody(
   entry: RekorEntry,
-  bundle: SigstoreBundle
+  bundle: SigstoreBundle,
+  cert: X509Certificate,
 ): Promise<void> {
   const hashedRekordEntry = entry as HashedRekordEntry;
 
   switch (hashedRekordEntry.apiVersion) {
     case "0.0.1":
-      return verifyHashedRekordV001Body(hashedRekordEntry, bundle);
+      return verifyHashedRekordV001Body(hashedRekordEntry, bundle, cert);
     case "0.0.2":
-      return verifyHashedRekordV002Body(hashedRekordEntry, bundle);
+      return verifyHashedRekordV002Body(hashedRekordEntry, bundle, cert);
     default:
       throw new Error(
         `Unsupported hashedrekord version: ${hashedRekordEntry.apiVersion}`
@@ -72,12 +74,14 @@ export async function verifyHashedRekordBody(
 
 function verifyHashedRekordV001Body(
   entry: HashedRekordEntry,
-  bundle: SigstoreBundle
+  bundle: SigstoreBundle,
+  cert: X509Certificate,
 ): void {
   const spec = entry.spec as HashedRekordSpec;
   if (!bundle.messageSignature) {
     throw new Error("Bundle missing messageSignature for hashedrekord entry");
   }
+  assertLoggedCertificate(cert, spec.signature?.publicKey?.content, true);
 
   const tlogSig = spec.signature.content || "";
   const tlogSigBytes = base64ToUint8Array(tlogSig);
@@ -101,12 +105,14 @@ function verifyHashedRekordV001Body(
 // New functionality for HashedRekord v0.0.2 (not in sigstore-js reference, which only supports v0.0.1)
 function verifyHashedRekordV002Body(
   entry: HashedRekordEntry,
-  bundle: SigstoreBundle
+  bundle: SigstoreBundle,
+  cert: X509Certificate,
 ): void {
   const spec = (entry.spec as HashedRekordV002Spec).hashedRekordV002;
   if (!bundle.messageSignature) {
     throw new Error("Bundle missing messageSignature for hashedrekord v0.0.2 entry");
   }
+  assertLoggedCertificate(cert, spec?.signature?.verifier?.x509Certificate?.rawBytes, false);
 
   // NOTE: HashedRekord v0.0.2 uses single base64 encoding (unlike intoto which is double-encoded)
   // Verified against Sigstore conformance test suite bundles

package/src/tlog/intoto.ts

@@ -13,7 +13,8 @@
 import { base64Decode, base64ToUint8Array, hexToUint8Array, uint8ArrayEqual } from "@freedomofpress/crypto-browser";
 import { getHashAlgorithm } from "../interfaces.js";
 import type { SigstoreBundle } from "../bundle.js";
-import type { RekorEntry } from "./body.js";
+import type { X509Certificate } from "../x509/cert.js";
+import { assertLoggedCertificate, type RekorEntry } from "./body.js";
 
 interface IntotoEnvelope {
   payload: string;
@@ -48,7 +49,8 @@ interface IntotoEntry extends RekorEntry {
 
 export async function verifyIntotoBody(
   entry: RekorEntry,
-  bundle: SigstoreBundle
+  bundle: SigstoreBundle,
+  cert: X509Certificate,
 ): Promise<void> {
   const intotoEntry = entry as IntotoEntry;
 
@@ -67,6 +69,7 @@ export async function verifyIntotoBody(
   if (!tlogEnvelope.signatures || tlogEnvelope.signatures.length !== 1) {
     throw new Error("Intoto entry must have exactly one signature");
   }
+  assertLoggedCertificate(cert, tlogEnvelope.signatures[0].publicKey, true);
 
   // The signature in the intoto tlog entry is double-base64-encoded:
   // 1. Raw signature bytes are base64-encoded (normal)