@freedomofpress/sigstore-browser 0.1.14 → 0.1.16

package/README.md

@@ -50,8 +50,7 @@ const verified = await verifier.verifyArtifact(
   'https://accounts.google.com',    // Expected OIDC issuer
   bundle,
   artifactData,
-  false,
-  policy // Optional VerificationPolicy
+  false
 );
 ```
 
@@ -59,27 +58,32 @@ const verified = await verifier.verifyArtifact(
 
 ```typescript
 const verifier = new SigstoreVerifier({
-  tlogThreshold: 1,   // Minimum transparency log entries required (default: 1)
-  ctlogThreshold: 1,  // Minimum SCTs required (default: 1)
-  tsaThreshold: 0,    // Minimum TSA timestamps required (default: 0)
+  tlogThreshold: 1,   // Minimum distinct log operators with a fully verified entry (default: 1)
+  ctlogThreshold: 1,  // Minimum distinct CT log operators with a verified SCT (default: 1)
+  tsaThreshold: 0,    // Minimum distinct TSA operators with a verified timestamp (default: 0)
 });
 ```
 
+Thresholds must be non-negative safe integers. Authorities without `operator` metadata can satisfy a threshold of one, but never add to the count of named operators. Thresholds above one require that many distinct, explicitly named operators.
+
+When `isDigestOnly` is `true`, supply exactly 32 bytes containing the artifact's SHA-256 digest.
+
 ## What Gets Verified
 
 The `verifyArtifact` method performs the following checks:
 
-1. **Identity Verification**: Certificate SAN matches the expected identity
-2. **Issuer Verification**: Certificate OIDC issuer matches the expected issuer
-3. **Certificate Chain**: Leaf certificate chains to a trusted Fulcio CA
-4. **SCT Verification**: Signed Certificate Timestamps from CT logs
-5. **Inclusion Promise/Proof**: Rekor transparency log inclusion
-6. **Merkle Tree Verification**: Inclusion proof validation (for v0.2+ bundles)
-7. **TLog Body Verification**: Entry body matches bundle content
-8. **TSA Timestamp Verification**: RFC 3161 timestamp verification (if configured)
-9. **Signature Verification**: Artifact signature using certificate's public key
-
-`verifyArtifact` accepts an optional `VerificationPolicy` as the last argument to enforce custom certificate claim checks.
+1. **Bundle Validation**: Structure, a 16 MiB aggregate encoded-data limit, bounded certificate chains and a supported media type
+2. **Identity Verification**: Certificate SAN matches the expected identity
+3. **Issuer Verification**: Certificate OIDC issuer matches the expected issuer
+4. **Transparency Log**: Every entry from a trusted Rekor log is verified (inclusion promise, Merkle proof, checkpoint, body and logged certificate); the threshold counts distinct log operators
+5. **TSA Timestamp Verification**: RFC 3161 timestamps (if present); the threshold counts distinct operators
+6. **Observer Timestamps**: At least one verified integrated time or TSA timestamp must anchor the signature
+7. **Certificate Chain**: Leaf certificate chains to a Fulcio CA that was trusted at every observer timestamp
+8. **SCT Verification**: Signed Certificate Timestamps from CT logs; the threshold counts distinct operators
+9. **Signature Verification**: Artifact signature using the certificate's public key
+
+Use `verifyArtifactPolicy(policy, bundle, artifactData, isDigestOnly)` to enforce a custom `VerificationPolicy`, including the required identity and issuer checks.
+Policies may be synchronous or asynchronous; asynchronous policies are awaited before verification continues.
 
 ## Development
 

package/dist/bundle.d.ts

@@ -68,7 +68,7 @@ export interface DSSESignature {
     keyid?: string;
 }
 export interface TimestampVerificationData {
-    rfc3161Timestamps: RFC3161Timestamp[];
+    rfc3161Timestamps?: RFC3161Timestamp[];
 }
 export interface RFC3161Timestamp {
     signedTimestamp: string;
@@ -83,5 +83,6 @@ export interface InTotoSubject {
     name: string;
     digest: Record<string, string>;
 }
+export declare function assertTimestampVerificationData(data: unknown): asserts data is TimestampVerificationData | undefined;
+export declare function assertBundle(b: unknown): asserts b is SigstoreBundle;
 export {};
-//# sourceMappingURL=bundle.d.ts.map

package/dist/bundle.js

@@ -1,2 +1,67 @@
-export {};
+const isStr = (v) => typeof v === "string";
+// Bound the aggregate encoded data this verifier will decode, parse, or hash.
+const MAX_BUNDLE_STRING_CHARS = 16 * 1024 * 1024;
+function boundedStrings() {
+    let total = 0;
+    return (v) => {
+        if (!isStr(v))
+            return false;
+        total += v.length;
+        return total <= MAX_BUNDLE_STRING_CHARS;
+    };
+}
+// Protobuf log indices, tree sizes and times are non-negative int64 values.
+// Bound the string before BigInt conversion to avoid unbounded arithmetic.
+const isInt64 = (v) => isStr(v) && /^\d{1,19}$/.test(v) && BigInt(v) <= 9223372036854775807n;
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+const isObj = (v) => typeof v === "object" && v !== null;
+function check(cond, what) {
+    if (!cond)
+        throw new Error(`Invalid bundle: ${what}`);
+}
+function checkTimestampVerificationData(data, isBoundedStr) {
+    if (data == null)
+        return;
+    check(isObj(data), "timestampVerificationData");
+    const ts = data.rfc3161Timestamps;
+    check(ts === undefined || (Array.isArray(ts) && ts.length <= 32 && ts.every((t) => isObj(t) && isBoundedStr(t.signedTimestamp))), "rfc3161Timestamps");
+}
+// Lives in verifyBundleTimestamp(), which every caller routes through.
+export function assertTimestampVerificationData(data) {
+    checkTimestampVerificationData(data, boundedStrings());
+}
+// Structural validation of a parsed bundle, replacing the compile-time-only type with runtime checks.
+// Entry count is capped at 32 like sigstore-go does.
+export function assertBundle(b) {
+    const isBoundedStr = boundedStrings();
+    check(isObj(b) && isBoundedStr(b.mediaType) && isObj(b.verificationMaterial), "missing mediaType or verificationMaterial");
+    const vm = b.verificationMaterial;
+    const certs = vm.certificate ? [vm.certificate] : vm.x509CertificateChain?.certificates;
+    check(Array.isArray(certs) && certs.length > 0 && certs.length <= 32 && certs.every((c) => isObj(c) && isBoundedStr(c.rawBytes)), "certificate");
+    check(Array.isArray(vm.tlogEntries) && vm.tlogEntries.length > 0 && vm.tlogEntries.length <= 32, "tlogEntries");
+    for (const e of vm.tlogEntries) {
+        check(isObj(e) && isInt64(e.logIndex) && isBoundedStr(e.logId?.keyId) && isBoundedStr(e.canonicalizedBody), "tlog entry");
+        check(isBoundedStr(e.kindVersion?.kind) && isBoundedStr(e.kindVersion?.version), "tlog entry kindVersion");
+        check(e.integratedTime == null || (isInt64(e.integratedTime) && Number.isFinite(new Date(Number(e.integratedTime) * 1000).getTime())), "tlog entry integratedTime");
+        // A SET signs the integrated time, so a promise without one is malformed.
+        // SET canonicalization uses Number, which must not round the signed log index.
+        const set = e.inclusionPromise?.signedEntryTimestamp;
+        check(e.inclusionPromise === undefined || (isBoundedStr(set) && set !== "" && isInt64(e.integratedTime) && Number.isSafeInteger(Number(e.logIndex))), "inclusion promise");
+        const p = e.inclusionProof;
+        // An int64-sized tree requires at most 63 sibling hashes.
+        check(p === undefined ||
+            (isObj(p) && isInt64(p.logIndex) && isInt64(p.treeSize) && isBoundedStr(p.rootHash) &&
+                Array.isArray(p.hashes) && p.hashes.length <= 63 && p.hashes.every(isBoundedStr) && isBoundedStr(p.checkpoint?.envelope)), "inclusion proof");
+    }
+    checkTimestampVerificationData(vm.timestampVerificationData, isBoundedStr);
+    const { messageSignature: ms, dsseEnvelope: env } = b;
+    check((ms === undefined) !== (env === undefined), "exactly one of messageSignature or dsseEnvelope");
+    if (ms !== undefined) {
+        check(isObj(ms) && isBoundedStr(ms.signature) && isBoundedStr(ms.messageDigest?.algorithm) && isBoundedStr(ms.messageDigest?.digest), "messageSignature");
+    }
+    else {
+        check(isObj(env) && isBoundedStr(env.payload) && isBoundedStr(env.payloadType), "dsseEnvelope");
+        check(Array.isArray(env.signatures) && env.signatures.length === 1 && isBoundedStr(env.signatures[0]?.sig), "dsseEnvelope must have exactly one signature");
+    }
+}
 //# sourceMappingURL=bundle.js.map

package/dist/bundle.js.map

@@ -1 +1 @@
-{"version":3,"file":"bundle.js","sourceRoot":"","sources":["../src/bundle.ts"],"names":[],"mappings":""}
+{"version":3,"file":"bundle.js","sourceRoot":"","sources":["../src/bundle.ts"],"names":[],"mappings":"AAoGA,MAAM,KAAK,GAAG,CAAC,CAAU,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;AACjE,8EAA8E;AAC9E,MAAM,uBAAuB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AACjD,SAAS,cAAc;IACrB,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,OAAO,CAAC,CAAU,EAAe,EAAE;QACjC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QAC5B,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC;QAClB,OAAO,KAAK,IAAI,uBAAuB,CAAC;IAC1C,CAAC,CAAC;AACJ,CAAC;AACD,4EAA4E;AAC5E,2EAA2E;AAC3E,MAAM,OAAO,GAAG,CAAC,CAAU,EAAe,EAAE,CAC1C,KAAK,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,IAAI,oBAAoB,CAAC;AACxE,8DAA8D;AAC9D,MAAM,KAAK,GAAG,CAAC,CAAU,EAA4B,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,CAAC;AAE5F,SAAS,KAAK,CAAC,IAAa,EAAE,IAAY;IACxC,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,8BAA8B,CACrC,IAAa,EACb,YAAyC;IAEzC,IAAI,IAAI,IAAI,IAAI;QAAE,OAAO;IACzB,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,2BAA2B,CAAC,CAAC;IAChD,MAAM,EAAE,GAAG,IAAI,CAAC,iBAAiB,CAAC;IAClC,KAAK,CACH,EAAE,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,MAAM,IAAI,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,EACnI,mBAAmB,CACpB,CAAC;AACJ,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,+BAA+B,CAAC,IAAa;IAC3D,8BAA8B,CAAC,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;AACzD,CAAC;AAED,sGAAsG;AACtG,qDAAqD;AACrD,MAAM,UAAU,YAAY,CAAC,CAAU;IACrC,MAAM,YAAY,GAAG,cAAc,EAAE,CAAC;IACtC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,oBAAoB,CAAC,EAAE,2CAA2C,CAAC,CAAC;IAC3H,MAAM,EAAE,GAAG,CAAC,CAAC,oBAAoB,CAAC;IAElC,MAAM,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,oBAAoB,EAAE,YAAY,CAAC;IACxF,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,EAAE,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC;IAE1J,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,CAAC,MAAM,IAAI,EAAE,EAAE,aAAa,CAAC,CAAC;IAChH,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC/B,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,iBAAiB,CAAC,EAAE,YAAY,CAAC,CAAC;QAC1H,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,WAAW,EAAE,OAAO,CAAC,EAAE,wBAAwB,CAAC,CAAC;QAC3G,KAAK,CACH,CAAC,CAAC,cAAc,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,EAC/H,2BAA2B,CAC5B,CAAC;QACF,0EAA0E;QAC1E,+EAA+E;QAC/E,MAAM,GAAG,GAAG,CAAC,CAAC,gBAAgB,EAAE,oBAAoB,CAAC;QACrD,KAAK,CACH,CAAC,CAAC,gBAAgB,KAAK,SAAS,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,GAAG,KAAK,EAAE,IAAI,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAC9I,mBAAmB,CACpB,CAAC;QACF,MAAM,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC;QAC3B,0DAA0D;QAC1D,KAAK,CACH,CAAC,KAAK,SAAS;YACb,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC;gBACjF,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,EAC7H,iBAAiB,CAClB,CAAC;IACJ,CAAC;IAED,8BAA8B,CAAC,EAAE,CAAC,yBAAyB,EAAE,YAAY,CAAC,CAAC;IAE3E,MAAM,EAAE,gBAAgB,EAAE,EAAE,EAAE,YAAY,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IACtD,KAAK,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,KAAK,CAAC,GAAG,KAAK,SAAS,CAAC,EAAE,iDAAiD,CAAC,CAAC;IACrG,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;QACrB,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,YAAY,CAAC,EAAE,CAAC,SAAS,CAAC,IAAI,YAAY,CAAC,EAAE,CAAC,aAAa,EAAE,SAAS,CAAC,IAAI,YAAY,CAAC,EAAE,CAAC,aAAa,EAAE,MAAM,CAAC,EAAE,kBAAkB,CAAC,CAAC;IAC5J,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,cAAc,CAAC,CAAC;QAChG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,8CAA8C,CAAC,CAAC;IAC9J,CAAC;AACH,CAAC","sourcesContent":["type SigstoreBundleBase = {\n  mediaType: string;\n  verificationMaterial: VerificationMaterial;\n};\n\nexport type SigstoreBundle =\n  | (SigstoreBundleBase & { messageSignature: MessageSignature; dsseEnvelope?: never })\n  | (SigstoreBundleBase & { messageSignature?: never; dsseEnvelope: DSSEEnvelope });\n\nexport interface VerificationMaterial {\n  certificate?: Certificate;\n  x509CertificateChain?: X509CertificateChain;\n  tlogEntries: TLogEntry[];\n  timestampVerificationData?: TimestampVerificationData;\n}\n\nexport interface Certificate {\n  rawBytes: string; // Base64-encoded certificate bytes\n}\n\nexport interface X509CertificateChain {\n  certificates: Certificate[];\n}\n\nexport interface TLogEntry {\n  logIndex: string;\n  logId: LogId;\n  kindVersion: KindVersion;\n  integratedTime: string | null; // UNIX timestamp (can be null for Rekor v2 bundles)\n  inclusionPromise?: InclusionPromise;\n  inclusionProof?: InclusionProof;\n  canonicalizedBody: string; // Base64-encoded JSON body of the log entry\n}\n\nexport interface LogId {\n  keyId: string; // Base64-encoded key ID\n}\n\nexport interface KindVersion {\n  kind: string;\n  version: string;\n}\n\nexport interface InclusionPromise {\n  signedEntryTimestamp: string; // Base64-encoded signature over the entry\n}\n\nexport interface InclusionProof {\n  logIndex: string;\n  rootHash: string; // Base64-encoded root hash of the Merkle tree\n  treeSize: string; // Number of entries in the Merkle tree\n  hashes: string[]; // Base64-encoded sibling hashes in the Merkle tree\n  checkpoint: Checkpoint;\n}\n\nexport interface Checkpoint {\n  envelope: string; // Signed envelope from the transparency log\n}\n\nexport interface MessageSignature {\n  messageDigest: MessageDigest;\n  signature: string; // Base64-encoded signature over the message digest\n}\n\nexport interface MessageDigest {\n  algorithm: string; // Hashing algorithm, e.g., \"SHA2_256\"\n  digest: string; // Base64-encoded message digest\n}\n\nexport interface DSSEEnvelope {\n  payload: string;\n  payloadType: string;\n  signatures: DSSESignature[];\n}\n\nexport interface DSSESignature {\n  sig: string;\n  keyid?: string;\n}\n\nexport interface TimestampVerificationData {\n  rfc3161Timestamps?: RFC3161Timestamp[];\n}\n\nexport interface RFC3161Timestamp {\n  signedTimestamp: string; // Base64-encoded RFC3161 SignedData\n}\n\nexport interface InTotoStatement {\n  _type: string;\n  subject: InTotoSubject[];\n  predicateType: string;\n  predicate: Record<string, unknown>;\n}\n\nexport interface InTotoSubject {\n  name: string;\n  digest: Record<string, string>;\n}\n\nconst isStr = (v: unknown): v is string => typeof v === \"string\";\n// Bound the aggregate encoded data this verifier will decode, parse, or hash.\nconst MAX_BUNDLE_STRING_CHARS = 16 * 1024 * 1024;\nfunction boundedStrings(): (v: unknown) => v is string {\n  let total = 0;\n  return (v: unknown): v is string => {\n    if (!isStr(v)) return false;\n    total += v.length;\n    return total <= MAX_BUNDLE_STRING_CHARS;\n  };\n}\n// Protobuf log indices, tree sizes and times are non-negative int64 values.\n// Bound the string before BigInt conversion to avoid unbounded arithmetic.\nconst isInt64 = (v: unknown): v is string =>\n  isStr(v) && /^\\d{1,19}$/.test(v) && BigInt(v) <= 9223372036854775807n;\n// eslint-disable-next-line @typescript-eslint/no-explicit-any\nconst isObj = (v: unknown): v is Record<string, any> => typeof v === \"object\" && v !== null;\n\nfunction check(cond: unknown, what: string): asserts cond {\n  if (!cond) throw new Error(`Invalid bundle: ${what}`);\n}\n\nfunction checkTimestampVerificationData(\n  data: unknown,\n  isBoundedStr: (v: unknown) => v is string,\n): asserts data is TimestampVerificationData | undefined {\n  if (data == null) return;\n  check(isObj(data), \"timestampVerificationData\");\n  const ts = data.rfc3161Timestamps;\n  check(\n    ts === undefined || (Array.isArray(ts) && ts.length <= 32 && ts.every((t: unknown) => isObj(t) && isBoundedStr(t.signedTimestamp))),\n    \"rfc3161Timestamps\",\n  );\n}\n\n// Lives in verifyBundleTimestamp(), which every caller routes through.\nexport function assertTimestampVerificationData(data: unknown): asserts data is TimestampVerificationData | undefined {\n  checkTimestampVerificationData(data, boundedStrings());\n}\n\n// Structural validation of a parsed bundle, replacing the compile-time-only type with runtime checks.\n// Entry count is capped at 32 like sigstore-go does.\nexport function assertBundle(b: unknown): asserts b is SigstoreBundle {\n  const isBoundedStr = boundedStrings();\n  check(isObj(b) && isBoundedStr(b.mediaType) && isObj(b.verificationMaterial), \"missing mediaType or verificationMaterial\");\n  const vm = b.verificationMaterial;\n\n  const certs = vm.certificate ? [vm.certificate] : vm.x509CertificateChain?.certificates;\n  check(Array.isArray(certs) && certs.length > 0 && certs.length <= 32 && certs.every((c: unknown) => isObj(c) && isBoundedStr(c.rawBytes)), \"certificate\");\n\n  check(Array.isArray(vm.tlogEntries) && vm.tlogEntries.length > 0 && vm.tlogEntries.length <= 32, \"tlogEntries\");\n  for (const e of vm.tlogEntries) {\n    check(isObj(e) && isInt64(e.logIndex) && isBoundedStr(e.logId?.keyId) && isBoundedStr(e.canonicalizedBody), \"tlog entry\");\n    check(isBoundedStr(e.kindVersion?.kind) && isBoundedStr(e.kindVersion?.version), \"tlog entry kindVersion\");\n    check(\n      e.integratedTime == null || (isInt64(e.integratedTime) && Number.isFinite(new Date(Number(e.integratedTime) * 1000).getTime())),\n      \"tlog entry integratedTime\",\n    );\n    // A SET signs the integrated time, so a promise without one is malformed.\n    // SET canonicalization uses Number, which must not round the signed log index.\n    const set = e.inclusionPromise?.signedEntryTimestamp;\n    check(\n      e.inclusionPromise === undefined || (isBoundedStr(set) && set !== \"\" && isInt64(e.integratedTime) && Number.isSafeInteger(Number(e.logIndex))),\n      \"inclusion promise\",\n    );\n    const p = e.inclusionProof;\n    // An int64-sized tree requires at most 63 sibling hashes.\n    check(\n      p === undefined ||\n        (isObj(p) && isInt64(p.logIndex) && isInt64(p.treeSize) && isBoundedStr(p.rootHash) &&\n          Array.isArray(p.hashes) && p.hashes.length <= 63 && p.hashes.every(isBoundedStr) && isBoundedStr(p.checkpoint?.envelope)),\n      \"inclusion proof\",\n    );\n  }\n\n  checkTimestampVerificationData(vm.timestampVerificationData, isBoundedStr);\n\n  const { messageSignature: ms, dsseEnvelope: env } = b;\n  check((ms === undefined) !== (env === undefined), \"exactly one of messageSignature or dsseEnvelope\");\n  if (ms !== undefined) {\n    check(isObj(ms) && isBoundedStr(ms.signature) && isBoundedStr(ms.messageDigest?.algorithm) && isBoundedStr(ms.messageDigest?.digest), \"messageSignature\");\n  } else {\n    check(isObj(env) && isBoundedStr(env.payload) && isBoundedStr(env.payloadType), \"dsseEnvelope\");\n    check(Array.isArray(env.signatures) && env.signatures.length === 1 && isBoundedStr(env.signatures[0]?.sig), \"dsseEnvelope must have exactly one signature\");\n  }\n}\n"]}

package/dist/cli.d.ts

@@ -1,3 +1,2 @@
 #!/usr/bin/env node
 export {};
-//# sourceMappingURL=cli.d.ts.map

package/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,eAAe,EACf,kBAAkB,GACnB,MAAM,gCAAgC,CAAC;AAGxC,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAErD,sFAAsF;AACtF,IAAI,OAAO,UAAU,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;IAC7C,UAAU,CAAC,MAAM,GAAG,SAA8B,CAAC;AACrD,CAAC;AAcD,MAAM,KAAK,GAAG,oKAAoK,CAAC;AAEnL,SAAS,UAAU;IACjB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC;AAED,SAAS,SAAS,CAAC,IAAc;IAC/B,MAAM,OAAO,GAAwB,EAAE,CAAC;IACxC,IAAI,OAA2B,CAAC;IAChC,IAAI,aAAiC,CAAC;IAEtC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAExB,IAAI,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YAC7C,UAAU,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7B,MAAM,CAAC,IAAI,EAAE,aAAa,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YAEpD,QAAQ,IAAI,EAAE,CAAC;gBACb,KAAK,UAAU,CAAC,CAAC,CAAC;oBAChB,MAAM,KAAK,GAAG,aAAa,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;oBACzC,IAAI,CAAC,KAAK,EAAE,CAAC;wBACX,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;oBAChD,CAAC;oBACD,OAAO,CAAC,UAAU,GAAG,KAAK,CAAC;oBAC3B,MAAM;gBACR,CAAC;gBACD,KAAK,wBAAwB,CAAC,CAAC,CAAC;oBAC9B,MAAM,KAAK,GAAG,aAAa,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;oBACzC,IAAI,CAAC,KAAK,EAAE,CAAC;wBACX,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;oBAC9D,CAAC;oBACD,OAAO,CAAC,mBAAmB,GAAG,KAAK,CAAC;oBACpC,MAAM;gBACR,CAAC;gBACD,KAAK,2BAA2B,CAAC,CAAC,CAAC;oBACjC,MAAM,KAAK,GAAG,aAAa,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;oBACzC,IAAI,CAAC,KAAK,EAAE,CAAC;wBACX,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;oBACjE,CAAC;oBACD,OAAO,CAAC,qBAAqB,GAAG,KAAK,CAAC;oBACtC,MAAM;gBACR,CAAC;gBACD,KAAK,gBAAgB,CAAC,CAAC,CAAC;oBACtB,MAAM,KAAK,GAAG,aAAa,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;oBACzC,IAAI,CAAC,KAAK,EAAE,CAAC;wBACX,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;oBACtD,CAAC;oBACD,OAAO,CAAC,eAAe,GAAG,KAAK,CAAC;oBAChC,MAAM;gBACR,CAAC;gBACD;oBACE,MAAM,IAAI,KAAK,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC;YAC/C,CAAC;YAED,SAAS;QACX,CAAC;QAED,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,GAAG,OAAO,CAAC;YAClB,SAAS;QACX,CAAC;QAED,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,aAAa,GAAG,OAAO,CAAC;YACxB,SAAS;QACX,CAAC;QAED,MAAM,IAAI,KAAK,CAAC,wBAAwB,OAAO,EAAE,CAAC,CAAC;IACrD,CAAC;IAED,IAAI,OAAO,KAAK,eAAe,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IAED,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IAED,OAAO;QACL,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;QACpD,eAAe,EAAE,OAAO,CAAC,eAAe;QACxC,aAAa;KACd,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,QAAgB;IACxC,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,KAAa;IAC1C,MAAM,YAAY,GAAG,SAAS,CAAC;IAE/B,IACE,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC;QAC9B,KAAK,CAAC,MAAM,KAAK,YAAY,CAAC,MAAM,GAAG,EAAE;QACzC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QACvD,CAAC,CAAC,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC,EAC1B,CAAC;QACD,OAAO;YACL,IAAI,EAAE,QAAQ;YACd,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE;SAC1D,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACzC,MAAM,cAAc,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,CAAC;IACpD,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAE5E,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,YAAY;QAClB,IAAI,EAAE,IAAI,UAAU,CAAC,cAAc,CAAC;QACpC,SAAS;KACV,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,SAA6B;IAE7B,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,0EAA0E;QAC1E,MAAM,WAAW,GAAG,IAAI,mBAAmB,CAAC;YAC1C,WAAW,EAAE,oCAAoC;YACjD,aAAa,EAAE,4CAA4C;SAC5D,CAAC,CAAC;QACH,OAAO,MAAM,WAAW,CAAC,cAAc,EAAE,CAAC;IAC5C,CAAC;IACD,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IACjD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAgB,CAAC;AACxC,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,UAAkB;IAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC7C,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAmB,CAAC;AAC3C,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,OAAmB;IAC7C,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACxD,eAAe,CAAC,OAAO,CAAC,eAAe,CAAC;QACxC,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC;QAC9B,eAAe,CAAC,OAAO,CAAC,aAAa,CAAC;KACvC,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,IAAI,gBAAgB,EAAE,CAAC;IACxC,MAAM,QAAQ,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAE7C,yDAAyD;IACzD,IAAI,eAAuB,CAAC;IAC5B,IAAI,iBAA6B,CAAC;IAElC,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;QAC5B,gDAAgD;QAChD,IAAI,MAAM,CAAC,gBAAgB,CAAC,aAAa,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;YACnE,MAAM,IAAI,KAAK,CACb,yCAAyC,MAAM,CAAC,gBAAgB,CAAC,aAAa,CAAC,SAAS,EAAE,CAC3F,CAAC;QACJ,CAAC;QAED,iBAAiB,GAAG,kBAAkB,CACpC,MAAM,CAAC,gBAAgB,CAAC,aAAa,CAAC,MAAM,CAC7C,CAAC;QACF,eAAe,GAAG,eAAe,CAAC,iBAAiB,CAAC,CAAC,WAAW,EAAE,CAAC;IACrE,CAAC;SAAM,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QAC/B,0DAA0D;QAC1D,MAAM,YAAY,GAAG,kBAAkB,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QACrE,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC,CAAC;QAE7D,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACjD,CAAC;QAED,uEAAuE;QACvE,IAAI,cAAc,GAAG,IAAI,CAAC;QAC1B,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACtC,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,CAAC;YACjD,IAAI,aAAa,IAAI,QAAQ,CAAC,SAAS,KAAK,aAAa,CAAC,WAAW,EAAE,EAAE,CAAC;gBACxE,cAAc,GAAG,OAAO,CAAC;gBACzB,MAAM;YACR,CAAC;QACH,CAAC;QAED,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CACb,mBAAmB,QAAQ,CAAC,SAAS,6CAA6C,CACnF,CAAC;QACJ,CAAC;QAED,eAAe,GAAG,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;QAEhE,sDAAsD;QACtD,iBAAiB,GAAG,eAAe,CAAC,eAAe,CAAC,CAAC;IACvD,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IAED,kDAAkD;IAClD,IAAI,MAAM,CAAC,gBAAgB,IAAI,QAAQ,CAAC,SAAS,KAAK,eAAe,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CACb,mEAAmE,CACpE,CAAC;IACJ,CAAC;IAED,MAAM,kBAAkB,GACtB,QAAQ,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC;IAC/D,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC;IAEhD,MAAM,QAAQ,CAAC,cAAc,CAC3B,OAAO,CAAC,mBAAmB,EAC3B,OAAO,CAAC,qBAAqB,EAC7B,MAAM,EACN,kBAAkB,EAClB,YAAY,CACb,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACjD,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;IAChD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;YAC3B,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC;QACD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC;AAED,MAAM,IAAI,EAAE,CAAC"}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,eAAe,EACf,kBAAkB,GACnB,MAAM,gCAAgC,CAAC;AAIxC,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAErD,sFAAsF;AACtF,IAAI,OAAO,UAAU,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;IAC7C,UAAU,CAAC,MAAM,GAAG,SAA8B,CAAC;AACrD,CAAC;AAcD,MAAM,KAAK,GAAG,oKAAoK,CAAC;AAEnL,SAAS,UAAU;IACjB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC;AAED,SAAS,SAAS,CAAC,IAAc;IAC/B,MAAM,OAAO,GAAwB,EAAE,CAAC;IACxC,IAAI,OAA2B,CAAC;IAChC,IAAI,aAAiC,CAAC;IAEtC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAExB,IAAI,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YAC7C,UAAU,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7B,MAAM,CAAC,IAAI,EAAE,aAAa,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YAEpD,QAAQ,IAAI,EAAE,CAAC;gBACb,KAAK,UAAU,CAAC,CAAC,CAAC;oBAChB,MAAM,KAAK,GAAG,aAAa,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;oBACzC,IAAI,CAAC,KAAK,EAAE,CAAC;wBACX,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;oBAChD,CAAC;oBACD,OAAO,CAAC,UAAU,GAAG,KAAK,CAAC;oBAC3B,MAAM;gBACR,CAAC;gBACD,KAAK,wBAAwB,CAAC,CAAC,CAAC;oBAC9B,MAAM,KAAK,GAAG,aAAa,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;oBACzC,IAAI,CAAC,KAAK,EAAE,CAAC;wBACX,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;oBAC9D,CAAC;oBACD,OAAO,CAAC,mBAAmB,GAAG,KAAK,CAAC;oBACpC,MAAM;gBACR,CAAC;gBACD,KAAK,2BAA2B,CAAC,CAAC,CAAC;oBACjC,MAAM,KAAK,GAAG,aAAa,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;oBACzC,IAAI,CAAC,KAAK,EAAE,CAAC;wBACX,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;oBACjE,CAAC;oBACD,OAAO,CAAC,qBAAqB,GAAG,KAAK,CAAC;oBACtC,MAAM;gBACR,CAAC;gBACD,KAAK,gBAAgB,CAAC,CAAC,CAAC;oBACtB,MAAM,KAAK,GAAG,aAAa,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;oBACzC,IAAI,CAAC,KAAK,EAAE,CAAC;wBACX,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;oBACtD,CAAC;oBACD,OAAO,CAAC,eAAe,GAAG,KAAK,CAAC;oBAChC,MAAM;gBACR,CAAC;gBACD;oBACE,MAAM,IAAI,KAAK,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC;YAC/C,CAAC;YAED,SAAS;QACX,CAAC;QAED,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,GAAG,OAAO,CAAC;YAClB,SAAS;QACX,CAAC;QAED,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,aAAa,GAAG,OAAO,CAAC;YACxB,SAAS;QACX,CAAC;QAED,MAAM,IAAI,KAAK,CAAC,wBAAwB,OAAO,EAAE,CAAC,CAAC;IACrD,CAAC;IAED,IAAI,OAAO,KAAK,eAAe,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IAED,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IAED,OAAO;QACL,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;QACpD,eAAe,EAAE,OAAO,CAAC,eAAe;QACxC,aAAa;KACd,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,QAAgB;IACxC,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,KAAa;IAC1C,MAAM,YAAY,GAAG,SAAS,CAAC;IAE/B,IACE,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC;QAC9B,KAAK,CAAC,MAAM,KAAK,YAAY,CAAC,MAAM,GAAG,EAAE;QACzC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QACvD,CAAC,CAAC,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC,EAC1B,CAAC;QACD,OAAO;YACL,IAAI,EAAE,QAAQ;YACd,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE;SAC1D,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACzC,MAAM,cAAc,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,CAAC;IACpD,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAE5E,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,YAAY;QAClB,IAAI,EAAE,IAAI,UAAU,CAAC,cAAc,CAAC;QACpC,SAAS;KACV,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,SAA6B;IAE7B,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,0EAA0E;QAC1E,MAAM,WAAW,GAAG,IAAI,mBAAmB,CAAC;YAC1C,WAAW,EAAE,oCAAoC;YACjD,aAAa,EAAE,4CAA4C;SAC5D,CAAC,CAAC;QACH,OAAO,MAAM,WAAW,CAAC,cAAc,EAAE,CAAC;IAC5C,CAAC;IACD,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IACjD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAgB,CAAC;AACxC,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,UAAkB;IAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC7C,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAmB,CAAC;AAC3C,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,OAAmB;IAC7C,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACxD,eAAe,CAAC,OAAO,CAAC,eAAe,CAAC;QACxC,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC;QAC9B,eAAe,CAAC,OAAO,CAAC,aAAa,CAAC;KACvC,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,IAAI,gBAAgB,EAAE,CAAC;IACxC,MAAM,QAAQ,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAE7C,yDAAyD;IACzD,IAAI,eAAuB,CAAC;IAC5B,IAAI,iBAA6B,CAAC;IAElC,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;QAC5B,gDAAgD;QAChD,IAAI,MAAM,CAAC,gBAAgB,CAAC,aAAa,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;YACnE,MAAM,IAAI,KAAK,CACb,yCAAyC,MAAM,CAAC,gBAAgB,CAAC,aAAa,CAAC,SAAS,EAAE,CAC3F,CAAC;QACJ,CAAC;QAED,iBAAiB,GAAG,kBAAkB,CACpC,MAAM,CAAC,gBAAgB,CAAC,aAAa,CAAC,MAAM,CAC7C,CAAC;QACF,eAAe,GAAG,eAAe,CAAC,iBAAiB,CAAC,CAAC,WAAW,EAAE,CAAC;IACrE,CAAC;SAAM,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QAC/B,0DAA0D;QAC1D,MAAM,YAAY,GAAG,kBAAkB,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QACrE,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC,CAAC;QAE7D,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACjD,CAAC;QAED,uEAAuE;QACvE,IAAI,cAAc,GAAG,IAAI,CAAC;QAC1B,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACtC,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,CAAC;YACjD,IAAI,aAAa,IAAI,QAAQ,CAAC,SAAS,KAAK,aAAa,CAAC,WAAW,EAAE,EAAE,CAAC;gBACxE,cAAc,GAAG,OAAO,CAAC;gBACzB,MAAM;YACR,CAAC;QACH,CAAC;QAED,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CACb,mBAAmB,QAAQ,CAAC,SAAS,6CAA6C,CACnF,CAAC;QACJ,CAAC;QAED,eAAe,GAAG,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;QAEhE,sDAAsD;QACtD,iBAAiB,GAAG,eAAe,CAAC,eAAe,CAAC,CAAC;IACvD,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IAED,kDAAkD;IAClD,IAAI,MAAM,CAAC,gBAAgB,IAAI,QAAQ,CAAC,SAAS,KAAK,eAAe,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CACb,mEAAmE,CACpE,CAAC;IACJ,CAAC;IAED,MAAM,kBAAkB,GACtB,QAAQ,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC;IAC/D,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC;IAEhD,MAAM,QAAQ,CAAC,cAAc,CAC3B,OAAO,CAAC,mBAAmB,EAC3B,OAAO,CAAC,qBAAqB,EAC7B,MAAM,EACN,kBAAkB,EAClB,YAAY,CACb,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACjD,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;IAChD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;YAC3B,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC;QACD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC;AAED,MAAM,IAAI,EAAE,CAAC","sourcesContent":["#!/usr/bin/env node\nimport { createHash, webcrypto } from \"node:crypto\";\nimport { access, readFile } from \"node:fs/promises\";\nimport path from \"node:path\";\n\nimport {\n  base64ToUint8Array,\n  hexToUint8Array,\n  Uint8ArrayToHex,\n  Uint8ArrayToString,\n} from \"@freedomofpress/crypto-browser\";\n\nimport { SigstoreBundle } from \"./bundle.js\";\nimport { TrustedRoot } from \"./interfaces.js\";\nimport { SigstoreVerifier } from \"./sigstore.js\";\nimport { TrustedRootProvider } from \"./trust/tuf.js\";\n\n// Ensure the global Web Crypto implementation is available when running under Node.js\nif (typeof globalThis.crypto === \"undefined\") {\n  globalThis.crypto = webcrypto as unknown as Crypto;\n}\n\ninterface CLIOptions {\n  bundlePath: string;\n  certificateIdentity: string;\n  certificateOidcIssuer: string;\n  trustedRootPath: string | undefined;\n  artifactInput: string;\n}\n\ntype ArtifactInput =\n  | { type: \"file\"; path: string; data: Uint8Array; digestHex: string }\n  | { type: \"digest\"; digestHex: string };\n\nconst USAGE = `Usage: sigstore-browser verify-bundle [--staging] --bundle FILE --certificate-identity IDENTITY --certificate-oidc-issuer URL [--trusted-root FILE] FILE_OR_DIGEST`;\n\nfunction printUsage(): void {\n  console.error(USAGE);\n}\n\nfunction parseArgs(argv: string[]): CLIOptions {\n  const options: Partial<CLIOptions> = {};\n  let command: string | undefined;\n  let artifactInput: string | undefined;\n\n  for (let i = 0; i < argv.length; i++) {\n    const current = argv[i];\n\n    if (current === \"--help\" || current === \"-h\") {\n      printUsage();\n      process.exit(0);\n    }\n\n    if (current.startsWith(\"--\")) {\n      const [name, providedValue] = current.split(\"=\", 2);\n\n      switch (name) {\n        case \"--bundle\": {\n          const value = providedValue ?? argv[++i];\n          if (!value) {\n            throw new Error(\"Missing value for --bundle\");\n          }\n          options.bundlePath = value;\n          break;\n        }\n        case \"--certificate-identity\": {\n          const value = providedValue ?? argv[++i];\n          if (!value) {\n            throw new Error(\"Missing value for --certificate-identity\");\n          }\n          options.certificateIdentity = value;\n          break;\n        }\n        case \"--certificate-oidc-issuer\": {\n          const value = providedValue ?? argv[++i];\n          if (!value) {\n            throw new Error(\"Missing value for --certificate-oidc-issuer\");\n          }\n          options.certificateOidcIssuer = value;\n          break;\n        }\n        case \"--trusted-root\": {\n          const value = providedValue ?? argv[++i];\n          if (!value) {\n            throw new Error(\"Missing value for --trusted-root\");\n          }\n          options.trustedRootPath = value;\n          break;\n        }\n        default:\n          throw new Error(`Unknown option: ${name}`);\n      }\n\n      continue;\n    }\n\n    if (!command) {\n      command = current;\n      continue;\n    }\n\n    if (!artifactInput) {\n      artifactInput = current;\n      continue;\n    }\n\n    throw new Error(`Unexpected argument: ${current}`);\n  }\n\n  if (command !== \"verify-bundle\") {\n    throw new Error(\"No command provided. Expected 'verify-bundle'.\");\n  }\n\n  if (!artifactInput) {\n    throw new Error(\"Missing FILE_OR_DIGEST argument.\");\n  }\n\n  if (!options.bundlePath) {\n    throw new Error(\"Missing required option --bundle\");\n  }\n\n  if (!options.certificateIdentity) {\n    throw new Error(\"Missing required option --certificate-identity\");\n  }\n\n  if (!options.certificateOidcIssuer) {\n    throw new Error(\"Missing required option --certificate-oidc-issuer\");\n  }\n\n  return {\n    bundlePath: options.bundlePath,\n    certificateIdentity: options.certificateIdentity,\n    certificateOidcIssuer: options.certificateOidcIssuer,\n    trustedRootPath: options.trustedRootPath,\n    artifactInput,\n  };\n}\n\nasync function fileExists(filePath: string): Promise<boolean> {\n  try {\n    await access(filePath);\n    return true;\n  } catch {\n    return false;\n  }\n}\n\nasync function resolveArtifact(input: string): Promise<ArtifactInput> {\n  const digestPrefix = \"sha256:\";\n\n  if (\n    input.startsWith(digestPrefix) &&\n    input.length === digestPrefix.length + 64 &&\n    /^[0-9a-fA-F]+$/.test(input.slice(digestPrefix.length)) &&\n    !(await fileExists(input))\n  ) {\n    return {\n      type: \"digest\",\n      digestHex: input.slice(digestPrefix.length).toLowerCase(),\n    };\n  }\n\n  const resolvedPath = path.resolve(input);\n  const artifactBuffer = await readFile(resolvedPath);\n  const digestHex = createHash(\"sha256\").update(artifactBuffer).digest(\"hex\");\n\n  return {\n    type: \"file\",\n    path: resolvedPath,\n    data: new Uint8Array(artifactBuffer),\n    digestHex,\n  };\n}\n\nasync function loadTrustedRoot(\n  pathInput: string | undefined,\n): Promise<TrustedRoot> {\n  if (!pathInput) {\n    // Use TUF to fetch the latest trusted root (matches sigstore-js behavior)\n    const tufProvider = new TrustedRootProvider({\n      metadataUrl: \"https://tuf-repo-cdn.sigstore.dev/\",\n      targetBaseUrl: \"https://tuf-repo-cdn.sigstore.dev/targets/\",\n    });\n    return await tufProvider.getTrustedRoot();\n  }\n  const resolvedPath = path.resolve(pathInput);\n  const raw = await readFile(resolvedPath, \"utf8\");\n  return JSON.parse(raw) as TrustedRoot;\n}\n\nasync function loadBundle(bundlePath: string): Promise<SigstoreBundle> {\n  const resolved = path.resolve(bundlePath);\n  const raw = await readFile(resolved, \"utf8\");\n  return JSON.parse(raw) as SigstoreBundle;\n}\n\nasync function verifyBundle(options: CLIOptions): Promise<void> {\n  const [trustedRoot, bundle, artifact] = await Promise.all([\n    loadTrustedRoot(options.trustedRootPath),\n    loadBundle(options.bundlePath),\n    resolveArtifact(options.artifactInput),\n  ]);\n\n  const verifier = new SigstoreVerifier();\n  await verifier.loadSigstoreRoot(trustedRoot);\n\n  // Extract and verify the artifact digest from the bundle\n  let bundleDigestHex: string;\n  let bundleDigestBytes: Uint8Array;\n\n  if (bundle.messageSignature) {\n    // Regular bundle: digest is in messageSignature\n    if (bundle.messageSignature.messageDigest.algorithm !== \"SHA2_256\") {\n      throw new Error(\n        `Unsupported message digest algorithm: ${bundle.messageSignature.messageDigest.algorithm}`,\n      );\n    }\n\n    bundleDigestBytes = base64ToUint8Array(\n      bundle.messageSignature.messageDigest.digest,\n    );\n    bundleDigestHex = Uint8ArrayToHex(bundleDigestBytes).toLowerCase();\n  } else if (bundle.dsseEnvelope) {\n    // DSSE bundle: digest is in the in-toto statement payload\n    const payloadBytes = base64ToUint8Array(bundle.dsseEnvelope.payload);\n    const payload = JSON.parse(Uint8ArrayToString(payloadBytes));\n\n    if (!payload.subject || payload.subject.length === 0) {\n      throw new Error(\"DSSE payload has no subject\");\n    }\n\n    // Find matching subject by comparing artifact digest with all subjects\n    let matchedSubject = null;\n    for (const subject of payload.subject) {\n      const subjectDigest = subject.digest?.[\"sha256\"];\n      if (subjectDigest && artifact.digestHex === subjectDigest.toLowerCase()) {\n        matchedSubject = subject;\n        break;\n      }\n    }\n\n    if (!matchedSubject) {\n      throw new Error(\n        `Artifact digest ${artifact.digestHex} does not match any subject in DSSE payload`\n      );\n    }\n\n    bundleDigestHex = matchedSubject.digest[\"sha256\"].toLowerCase();\n\n    // Convert hex digest to bytes for verification target\n    bundleDigestBytes = hexToUint8Array(bundleDigestHex);\n  } else {\n    throw new Error(\"Bundle does not contain a message signature or DSSE envelope\");\n  }\n\n  // For non-DSSE bundles, verify the digest matches\n  if (bundle.messageSignature && artifact.digestHex !== bundleDigestHex) {\n    throw new Error(\n      \"Artifact digest does not match the digest embedded in the bundle.\",\n    );\n  }\n\n  const verificationTarget =\n    artifact.type === \"file\" ? artifact.data : bundleDigestBytes;\n  const isDigestOnly = artifact.type === \"digest\";\n\n  await verifier.verifyArtifact(\n    options.certificateIdentity,\n    options.certificateOidcIssuer,\n    bundle,\n    verificationTarget,\n    isDigestOnly,\n  );\n}\n\nasync function main(): Promise<void> {\n  try {\n    const options = parseArgs(process.argv.slice(2));\n    await verifyBundle(options);\n    console.log(\"Bundle verification succeeded.\");\n  } catch (error) {\n    if (error instanceof Error) {\n      console.error(error.message);\n    } else {\n      console.error(error);\n    }\n    process.exitCode = 1;\n  }\n}\n\nawait main();\n"]}

package/dist/dsse.d.ts

@@ -1,2 +1 @@
 export declare function preAuthEncoding(payloadType: string, payload: Uint8Array): Uint8Array;
-//# sourceMappingURL=dsse.d.ts.map

package/dist/dsse.js.map

@@ -1 +1 @@
-{"version":3,"file":"dsse.js","sourceRoot":"","sources":["../src/dsse.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;EAcE;AACF,MAAM,UAAU,GAAG,QAAQ,CAAC;AAE5B,mCAAmC;AACnC,MAAM,UAAU,eAAe,CAC7B,WAAmB,EACnB,OAAmB;IAEnB,MAAM,MAAM,GAAG;QACb,UAAU;QACV,WAAW,CAAC,MAAM;QAClB,WAAW;QACX,OAAO,CAAC,MAAM;QACd,EAAE;KACH,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAEZ,mDAAmD;IACnD,qEAAqE;IACrE,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAE5C,0CAA0C;IAC1C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7C,IAAI,YAAY,CAAC,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,EAAE,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;IAED,iCAAiC;IACjC,MAAM,aAAa,GAAG,IAAI,UAAU,CAAC,YAAY,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAE3E,aAAa,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;IACnC,aAAa,CAAC,GAAG,CAAC,OAAO,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC;IAChD,OAAO,aAAa,CAAC;AACvB,CAAC"}
+{"version":3,"file":"dsse.js","sourceRoot":"","sources":["../src/dsse.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;EAcE;AACF,MAAM,UAAU,GAAG,QAAQ,CAAC;AAE5B,mCAAmC;AACnC,MAAM,UAAU,eAAe,CAC7B,WAAmB,EACnB,OAAmB;IAEnB,MAAM,MAAM,GAAG;QACb,UAAU;QACV,WAAW,CAAC,MAAM;QAClB,WAAW;QACX,OAAO,CAAC,MAAM;QACd,EAAE;KACH,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAEZ,mDAAmD;IACnD,qEAAqE;IACrE,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAE5C,0CAA0C;IAC1C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7C,IAAI,YAAY,CAAC,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,EAAE,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;IAED,iCAAiC;IACjC,MAAM,aAAa,GAAG,IAAI,UAAU,CAAC,YAAY,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAE3E,aAAa,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;IACnC,aAAa,CAAC,GAAG,CAAC,OAAO,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC;IAChD,OAAO,aAAa,CAAC;AACvB,CAAC","sourcesContent":["/*\nCopyright 2023 The Sigstore Authors.\n\nLicensed under the Apache License, Version 2.0 (the \"License\");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\n    http://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n*/\nconst PAE_PREFIX = \"DSSEv1\";\n\n// DSSE Pre-Authentication Encoding\nexport function preAuthEncoding(\n  payloadType: string,\n  payload: Uint8Array,\n): Uint8Array {\n  const prefix = [\n    PAE_PREFIX,\n    payloadType.length,\n    payloadType,\n    payload.length,\n    \"\",\n  ].join(\" \");\n\n  // DSSE spec requires ASCII encoding for the prefix\n  // TextEncoder will throw if the string contains non-ASCII characters\n  const encoder = new TextEncoder();\n  const prefixBuffer = encoder.encode(prefix);\n\n  // Verify all characters are ASCII (< 128)\n  for (let i = 0; i < prefixBuffer.length; i++) {\n    if (prefixBuffer[i] > 127) {\n      throw new Error(`Invalid non-ASCII character in PAE prefix at position ${i}`);\n    }\n  }\n\n  // Concatenate prefix and payload\n  const combinedArray = new Uint8Array(prefixBuffer.length + payload.length);\n\n  combinedArray.set(prefixBuffer, 0);\n  combinedArray.set(payload, prefixBuffer.length);\n  return combinedArray;\n}\n"]}

package/dist/errors.d.ts

@@ -36,4 +36,3 @@ export declare class SignatureError extends VerificationError {
 export declare class PolicyError extends VerificationError {
     constructor(message: string);
 }
-//# sourceMappingURL=errors.d.ts.map

package/dist/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;EAcE;AAEF;;;GAGG;AACH,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAC1C,YAAmB,IAAY,EAAE,OAAe;QAC9C,KAAK,CAAC,OAAO,CAAC,CAAC;QADE,SAAI,GAAJ,IAAI,CAAQ;QAE7B,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC3D,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,cAAe,SAAQ,iBAAiB;IACnD,YAAY,OAAe;QACzB,KAAK,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC;QAClC,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;QAC7B,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,cAAc,CAAC,SAAS,CAAC,CAAC;IACxD,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,gBAAiB,SAAQ,iBAAiB;IACrD,YAAY,OAAe;QACzB,KAAK,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;QAC/B,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,gBAAgB,CAAC,SAAS,CAAC,CAAC;IAC1D,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,SAAU,SAAQ,iBAAiB;IAC9C,YAAY,OAAe;QACzB,KAAK,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QAC7B,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;QACxB,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC;IACnD,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,cAAe,SAAQ,iBAAiB;IACnD,YAAY,OAAe;QACzB,KAAK,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC;QAClC,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;QAC7B,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,cAAc,CAAC,SAAS,CAAC,CAAC;IACxD,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,WAAY,SAAQ,iBAAiB;IAChD,YAAY,OAAe;QACzB,KAAK,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;QAC/B,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;QAC1B,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,WAAW,CAAC,SAAS,CAAC,CAAC;IACrD,CAAC;CACF"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;EAcE;AAEF;;;GAGG;AACH,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAC1C,YAAmB,IAAY,EAAE,OAAe;QAC9C,KAAK,CAAC,OAAO,CAAC,CAAC;QADE,SAAI,GAAJ,IAAI,CAAQ;QAE7B,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC3D,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,cAAe,SAAQ,iBAAiB;IACnD,YAAY,OAAe;QACzB,KAAK,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC;QAClC,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;QAC7B,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,cAAc,CAAC,SAAS,CAAC,CAAC;IACxD,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,gBAAiB,SAAQ,iBAAiB;IACrD,YAAY,OAAe;QACzB,KAAK,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;QAC/B,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,gBAAgB,CAAC,SAAS,CAAC,CAAC;IAC1D,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,SAAU,SAAQ,iBAAiB;IAC9C,YAAY,OAAe;QACzB,KAAK,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QAC7B,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;QACxB,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC;IACnD,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,cAAe,SAAQ,iBAAiB;IACnD,YAAY,OAAe;QACzB,KAAK,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC;QAClC,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;QAC7B,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,cAAc,CAAC,SAAS,CAAC,CAAC;IACxD,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,WAAY,SAAQ,iBAAiB;IAChD,YAAY,OAAe;QACzB,KAAK,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;QAC/B,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;QAC1B,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,WAAW,CAAC,SAAS,CAAC,CAAC;IACrD,CAAC;CACF","sourcesContent":["/*\nCopyright 2023 The Sigstore Authors.\n\nLicensed under the Apache License, Version 2.0 (the \"License\");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\n    http://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n*/\n\n/**\n * Base class for all verification errors\n * Provides structured error handling with error codes\n */\nexport class VerificationError extends Error {\n  constructor(public code: string, message: string) {\n    super(message);\n    this.name = 'VerificationError';\n    Object.setPrototypeOf(this, VerificationError.prototype);\n  }\n}\n\n/**\n * Error thrown when timestamp verification fails\n */\nexport class TimestampError extends VerificationError {\n  constructor(message: string) {\n    super('TIMESTAMP_ERROR', message);\n    this.name = 'TimestampError';\n    Object.setPrototypeOf(this, TimestampError.prototype);\n  }\n}\n\n/**\n * Error thrown when certificate verification fails\n */\nexport class CertificateError extends VerificationError {\n  constructor(message: string) {\n    super('CERTIFICATE_ERROR', message);\n    this.name = 'CertificateError';\n    Object.setPrototypeOf(this, CertificateError.prototype);\n  }\n}\n\n/**\n * Error thrown when transparency log verification fails\n */\nexport class TLogError extends VerificationError {\n  constructor(message: string) {\n    super('TLOG_ERROR', message);\n    this.name = 'TLogError';\n    Object.setPrototypeOf(this, TLogError.prototype);\n  }\n}\n\n/**\n * Error thrown when signature verification fails\n */\nexport class SignatureError extends VerificationError {\n  constructor(message: string) {\n    super('SIGNATURE_ERROR', message);\n    this.name = 'SignatureError';\n    Object.setPrototypeOf(this, SignatureError.prototype);\n  }\n}\n\n/**\n * Error thrown when policy verification fails\n */\nexport class PolicyError extends VerificationError {\n  constructor(message: string) {\n    super('POLICY_ERROR', message);\n    this.name = 'PolicyError';\n    Object.setPrototypeOf(this, PolicyError.prototype);\n  }\n}\n"]}

package/dist/index.d.ts

@@ -1,13 +1,12 @@
-export { SigstoreVerifier } from "./sigstore.js";
+export type { MessageSignature, RFC3161Timestamp, SigstoreBundle, TimestampVerificationData, TLogEntry, VerificationMaterial } from "./bundle.js";
+export { CertificateError, PolicyError, SignatureError, TimestampError, TLogError, VerificationError, } from "./errors.js";
+export type { RawTimestampAuthority, Sigstore, TrustedRoot } from "./interfaces.js";
+export type { VerificationPolicy } from "./policy.js";
+export { AllOf, AnyOf, GITHUB_OIDC_ISSUER, GitHubWorkflowName, GitHubWorkflowRef, GitHubWorkflowRepository, GitHubWorkflowSHA, GitHubWorkflowTrigger, Identity, OIDCBuildConfigDigest, OIDCBuildConfigURI, OIDCBuildSignerDigest, OIDCBuildSignerURI, OIDCBuildTrigger, OIDCIssuer, OIDCIssuerV2, OIDCRunInvocationURI, OIDCRunnerEnvironment, OIDCSourceRepositoryDigest, OIDCSourceRepositoryIdentifier, OIDCSourceRepositoryOwnerIdentifier, OIDCSourceRepositoryOwnerURI, OIDCSourceRepositoryRef, OIDCSourceRepositoryURI, OIDCSourceRepositoryVisibility, } from "./policy.js";
 export type { SigstoreVerifierOptions } from "./sigstore.js";
-export type { SigstoreBundle, TLogEntry, VerificationMaterial, MessageSignature, TimestampVerificationData, RFC3161Timestamp } from "./bundle.js";
-export type { TrustedRoot, Sigstore, RawTimestampAuthority } from "./interfaces.js";
-export { VerificationError, TimestampError, CertificateError, TLogError, SignatureError, PolicyError, } from "./errors.js";
-export { verifyRFC3161Timestamp, verifyBundleTimestamp } from "./timestamp/tsa.js";
+export { SigstoreVerifier } from "./sigstore.js";
+export { verifyBundleTimestamp, verifyRFC3161Timestamp } from "./timestamp/tsa.js";
 export { TrustedRootProvider, type TrustedRootProviderOptions } from "./trust/tuf.js";
-export { X509Certificate, EXTENSION_OID_SCT, EXTENSION_OID_FULCIO_ISSUER_V1, EXTENSION_OID_GITHUB_WORKFLOW_TRIGGER, EXTENSION_OID_GITHUB_WORKFLOW_SHA, EXTENSION_OID_GITHUB_WORKFLOW_NAME, EXTENSION_OID_GITHUB_WORKFLOW_REPOSITORY, EXTENSION_OID_GITHUB_WORKFLOW_REF, EXTENSION_OID_OTHERNAME, EXTENSION_OID_FULCIO_ISSUER_V2, EXTENSION_OID_BUILD_SIGNER_URI, EXTENSION_OID_BUILD_SIGNER_DIGEST, EXTENSION_OID_RUNNER_ENVIRONMENT, EXTENSION_OID_SOURCE_REPOSITORY_URI, EXTENSION_OID_SOURCE_REPOSITORY_DIGEST, EXTENSION_OID_SOURCE_REPOSITORY_REF, EXTENSION_OID_SOURCE_REPOSITORY_IDENTIFIER, EXTENSION_OID_SOURCE_REPOSITORY_OWNER_URI, EXTENSION_OID_SOURCE_REPOSITORY_OWNER_IDENTIFIER, EXTENSION_OID_BUILD_CONFIG_URI, EXTENSION_OID_BUILD_CONFIG_DIGEST, EXTENSION_OID_BUILD_TRIGGER, EXTENSION_OID_RUN_INVOCATION_URI, EXTENSION_OID_SOURCE_REPOSITORY_VISIBILITY, } from "./x509/cert.js";
-export { X509Extension, X509FulcioIssuerV1, X509FulcioIssuerV2, X509GitHubWorkflowTriggerExtension, X509GitHubWorkflowSHAExtension, X509GitHubWorkflowNameExtension, X509GitHubWorkflowRepositoryExtension, X509GitHubWorkflowRefExtension, X509BuildSignerURIExtension, X509BuildSignerDigestExtension, X509RunnerEnvironmentExtension, X509SourceRepositoryURIExtension, X509SourceRepositoryDigestExtension, X509SourceRepositoryRefExtension, X509SourceRepositoryIdentifierExtension, X509SourceRepositoryOwnerURIExtension, X509SourceRepositoryOwnerIdentifierExtension, X509BuildConfigURIExtension, X509BuildConfigDigestExtension, X509BuildTriggerExtension, X509RunInvocationURIExtension, X509SourceRepositoryVisibilityExtension, } from "./x509/ext.js";
+export { EXTENSION_OID_BUILD_CONFIG_DIGEST, EXTENSION_OID_BUILD_CONFIG_URI, EXTENSION_OID_BUILD_SIGNER_DIGEST, EXTENSION_OID_BUILD_SIGNER_URI, EXTENSION_OID_BUILD_TRIGGER, EXTENSION_OID_FULCIO_ISSUER_V1, EXTENSION_OID_FULCIO_ISSUER_V2, EXTENSION_OID_GITHUB_WORKFLOW_NAME, EXTENSION_OID_GITHUB_WORKFLOW_REF, EXTENSION_OID_GITHUB_WORKFLOW_REPOSITORY, EXTENSION_OID_GITHUB_WORKFLOW_SHA, EXTENSION_OID_GITHUB_WORKFLOW_TRIGGER, EXTENSION_OID_OTHERNAME, EXTENSION_OID_RUN_INVOCATION_URI, EXTENSION_OID_RUNNER_ENVIRONMENT, EXTENSION_OID_SCT, EXTENSION_OID_SOURCE_REPOSITORY_DIGEST, EXTENSION_OID_SOURCE_REPOSITORY_IDENTIFIER, EXTENSION_OID_SOURCE_REPOSITORY_OWNER_IDENTIFIER, EXTENSION_OID_SOURCE_REPOSITORY_OWNER_URI, EXTENSION_OID_SOURCE_REPOSITORY_REF, EXTENSION_OID_SOURCE_REPOSITORY_URI, EXTENSION_OID_SOURCE_REPOSITORY_VISIBILITY, X509Certificate, } from "./x509/cert.js";
 export { CertificateChainVerifier } from "./x509/chain.js";
-export { GITHUB_OIDC_ISSUER, OIDCIssuer, OIDCIssuerV2, GitHubWorkflowTrigger, GitHubWorkflowSHA, GitHubWorkflowName, GitHubWorkflowRepository, GitHubWorkflowRef, OIDCBuildSignerURI, OIDCBuildSignerDigest, OIDCRunnerEnvironment, OIDCSourceRepositoryURI, OIDCSourceRepositoryDigest, OIDCSourceRepositoryRef, OIDCSourceRepositoryIdentifier, OIDCSourceRepositoryOwnerURI, OIDCSourceRepositoryOwnerIdentifier, OIDCBuildConfigURI, OIDCBuildConfigDigest, OIDCBuildTrigger, OIDCRunInvocationURI, OIDCSourceRepositoryVisibility, AllOf, AnyOf, Identity, } from "./policy.js";
-export type { VerificationPolicy } from "./policy.js";
-//# sourceMappingURL=index.d.ts.map
+export { X509BuildConfigDigestExtension, X509BuildConfigURIExtension, X509BuildSignerDigestExtension, X509BuildSignerURIExtension, X509BuildTriggerExtension, X509Extension, X509FulcioIssuerV1, X509FulcioIssuerV2, X509GitHubWorkflowNameExtension, X509GitHubWorkflowRefExtension, X509GitHubWorkflowRepositoryExtension, X509GitHubWorkflowSHAExtension, X509GitHubWorkflowTriggerExtension, X509RunInvocationURIExtension, X509RunnerEnvironmentExtension, X509SourceRepositoryDigestExtension, X509SourceRepositoryIdentifierExtension, X509SourceRepositoryOwnerIdentifierExtension, X509SourceRepositoryOwnerURIExtension, X509SourceRepositoryRefExtension, X509SourceRepositoryURIExtension, X509SourceRepositoryVisibilityExtension, } from "./x509/ext.js";

package/dist/index.js

@@ -1,9 +1,9 @@
+export { CertificateError, PolicyError, SignatureError, TimestampError, TLogError, VerificationError, } from "./errors.js";
+export { AllOf, AnyOf, GITHUB_OIDC_ISSUER, GitHubWorkflowName, GitHubWorkflowRef, GitHubWorkflowRepository, GitHubWorkflowSHA, GitHubWorkflowTrigger, Identity, OIDCBuildConfigDigest, OIDCBuildConfigURI, OIDCBuildSignerDigest, OIDCBuildSignerURI, OIDCBuildTrigger, OIDCIssuer, OIDCIssuerV2, OIDCRunInvocationURI, OIDCRunnerEnvironment, OIDCSourceRepositoryDigest, OIDCSourceRepositoryIdentifier, OIDCSourceRepositoryOwnerIdentifier, OIDCSourceRepositoryOwnerURI, OIDCSourceRepositoryRef, OIDCSourceRepositoryURI, OIDCSourceRepositoryVisibility, } from "./policy.js";
 export { SigstoreVerifier } from "./sigstore.js";
-export { VerificationError, TimestampError, CertificateError, TLogError, SignatureError, PolicyError, } from "./errors.js";
-export { verifyRFC3161Timestamp, verifyBundleTimestamp } from "./timestamp/tsa.js";
+export { verifyBundleTimestamp, verifyRFC3161Timestamp } from "./timestamp/tsa.js";
 export { TrustedRootProvider } from "./trust/tuf.js";
-export { X509Certificate, EXTENSION_OID_SCT, EXTENSION_OID_FULCIO_ISSUER_V1, EXTENSION_OID_GITHUB_WORKFLOW_TRIGGER, EXTENSION_OID_GITHUB_WORKFLOW_SHA, EXTENSION_OID_GITHUB_WORKFLOW_NAME, EXTENSION_OID_GITHUB_WORKFLOW_REPOSITORY, EXTENSION_OID_GITHUB_WORKFLOW_REF, EXTENSION_OID_OTHERNAME, EXTENSION_OID_FULCIO_ISSUER_V2, EXTENSION_OID_BUILD_SIGNER_URI, EXTENSION_OID_BUILD_SIGNER_DIGEST, EXTENSION_OID_RUNNER_ENVIRONMENT, EXTENSION_OID_SOURCE_REPOSITORY_URI, EXTENSION_OID_SOURCE_REPOSITORY_DIGEST, EXTENSION_OID_SOURCE_REPOSITORY_REF, EXTENSION_OID_SOURCE_REPOSITORY_IDENTIFIER, EXTENSION_OID_SOURCE_REPOSITORY_OWNER_URI, EXTENSION_OID_SOURCE_REPOSITORY_OWNER_IDENTIFIER, EXTENSION_OID_BUILD_CONFIG_URI, EXTENSION_OID_BUILD_CONFIG_DIGEST, EXTENSION_OID_BUILD_TRIGGER, EXTENSION_OID_RUN_INVOCATION_URI, EXTENSION_OID_SOURCE_REPOSITORY_VISIBILITY, } from "./x509/cert.js";
-export { X509Extension, X509FulcioIssuerV1, X509FulcioIssuerV2, X509GitHubWorkflowTriggerExtension, X509GitHubWorkflowSHAExtension, X509GitHubWorkflowNameExtension, X509GitHubWorkflowRepositoryExtension, X509GitHubWorkflowRefExtension, X509BuildSignerURIExtension, X509BuildSignerDigestExtension, X509RunnerEnvironmentExtension, X509SourceRepositoryURIExtension, X509SourceRepositoryDigestExtension, X509SourceRepositoryRefExtension, X509SourceRepositoryIdentifierExtension, X509SourceRepositoryOwnerURIExtension, X509SourceRepositoryOwnerIdentifierExtension, X509BuildConfigURIExtension, X509BuildConfigDigestExtension, X509BuildTriggerExtension, X509RunInvocationURIExtension, X509SourceRepositoryVisibilityExtension, } from "./x509/ext.js";
+export { EXTENSION_OID_BUILD_CONFIG_DIGEST, EXTENSION_OID_BUILD_CONFIG_URI, EXTENSION_OID_BUILD_SIGNER_DIGEST, EXTENSION_OID_BUILD_SIGNER_URI, EXTENSION_OID_BUILD_TRIGGER, EXTENSION_OID_FULCIO_ISSUER_V1, EXTENSION_OID_FULCIO_ISSUER_V2, EXTENSION_OID_GITHUB_WORKFLOW_NAME, EXTENSION_OID_GITHUB_WORKFLOW_REF, EXTENSION_OID_GITHUB_WORKFLOW_REPOSITORY, EXTENSION_OID_GITHUB_WORKFLOW_SHA, EXTENSION_OID_GITHUB_WORKFLOW_TRIGGER, EXTENSION_OID_OTHERNAME, EXTENSION_OID_RUN_INVOCATION_URI, EXTENSION_OID_RUNNER_ENVIRONMENT, EXTENSION_OID_SCT, EXTENSION_OID_SOURCE_REPOSITORY_DIGEST, EXTENSION_OID_SOURCE_REPOSITORY_IDENTIFIER, EXTENSION_OID_SOURCE_REPOSITORY_OWNER_IDENTIFIER, EXTENSION_OID_SOURCE_REPOSITORY_OWNER_URI, EXTENSION_OID_SOURCE_REPOSITORY_REF, EXTENSION_OID_SOURCE_REPOSITORY_URI, EXTENSION_OID_SOURCE_REPOSITORY_VISIBILITY, X509Certificate, } from "./x509/cert.js";
 export { CertificateChainVerifier } from "./x509/chain.js";
-export { GITHUB_OIDC_ISSUER, OIDCIssuer, OIDCIssuerV2, GitHubWorkflowTrigger, GitHubWorkflowSHA, GitHubWorkflowName, GitHubWorkflowRepository, GitHubWorkflowRef, OIDCBuildSignerURI, OIDCBuildSignerDigest, OIDCRunnerEnvironment, OIDCSourceRepositoryURI, OIDCSourceRepositoryDigest, OIDCSourceRepositoryRef, OIDCSourceRepositoryIdentifier, OIDCSourceRepositoryOwnerURI, OIDCSourceRepositoryOwnerIdentifier, OIDCBuildConfigURI, OIDCBuildConfigDigest, OIDCBuildTrigger, OIDCRunInvocationURI, OIDCSourceRepositoryVisibility, AllOf, AnyOf, Identity, } from "./policy.js";
+export { X509BuildConfigDigestExtension, X509BuildConfigURIExtension, X509BuildSignerDigestExtension, X509BuildSignerURIExtension, X509BuildTriggerExtension, X509Extension, X509FulcioIssuerV1, X509FulcioIssuerV2, X509GitHubWorkflowNameExtension, X509GitHubWorkflowRefExtension, X509GitHubWorkflowRepositoryExtension, X509GitHubWorkflowSHAExtension, X509GitHubWorkflowTriggerExtension, X509RunInvocationURIExtension, X509RunnerEnvironmentExtension, X509SourceRepositoryDigestExtension, X509SourceRepositoryIdentifierExtension, X509SourceRepositoryOwnerIdentifierExtension, X509SourceRepositoryOwnerURIExtension, X509SourceRepositoryRefExtension, X509SourceRepositoryURIExtension, X509SourceRepositoryVisibilityExtension, } from "./x509/ext.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAIjD,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,SAAS,EACT,cAAc,EACd,WAAW,GACZ,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AACnF,OAAO,EAAE,mBAAmB,EAAmC,MAAM,gBAAgB,CAAC;AACtF,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,8BAA8B,EAC9B,qCAAqC,EACrC,iCAAiC,EACjC,kCAAkC,EAClC,wCAAwC,EACxC,iCAAiC,EACjC,uBAAuB,EACvB,8BAA8B,EAC9B,8BAA8B,EAC9B,iCAAiC,EACjC,gCAAgC,EAChC,mCAAmC,EACnC,sCAAsC,EACtC,mCAAmC,EACnC,0CAA0C,EAC1C,yCAAyC,EACzC,gDAAgD,EAChD,8BAA8B,EAC9B,iCAAiC,EACjC,2BAA2B,EAC3B,gCAAgC,EAChC,0CAA0C,GAC3C,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,kCAAkC,EAClC,8BAA8B,EAC9B,+BAA+B,EAC/B,qCAAqC,EACrC,8BAA8B,EAC9B,2BAA2B,EAC3B,8BAA8B,EAC9B,8BAA8B,EAC9B,gCAAgC,EAChC,mCAAmC,EACnC,gCAAgC,EAChC,uCAAuC,EACvC,qCAAqC,EACrC,4CAA4C,EAC5C,2BAA2B,EAC3B,8BAA8B,EAC9B,yBAAyB,EACzB,6BAA6B,EAC7B,uCAAuC,GACxC,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAC3D,OAAO,EACL,kBAAkB,EAClB,UAAU,EACV,YAAY,EACZ,qBAAqB,EACrB,iBAAiB,EACjB,kBAAkB,EAClB,wBAAwB,EACxB,iBAAiB,EACjB,kBAAkB,EAClB,qBAAqB,EACrB,qBAAqB,EACrB,uBAAuB,EACvB,0BAA0B,EAC1B,uBAAuB,EACvB,8BAA8B,EAC9B,4BAA4B,EAC5B,mCAAmC,EACnC,kBAAkB,EAClB,qBAAqB,EACrB,gBAAgB,EAChB,oBAAoB,EACpB,8BAA8B,EAC9B,KAAK,EACL,KAAK,EACL,QAAQ,GACT,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EACL,gBAAgB,EAChB,WAAW,EACX,cAAc,EACd,cAAc,EACd,SAAS,EACT,iBAAiB,GAClB,MAAM,aAAa,CAAC;AAGrB,OAAO,EACL,KAAK,EACL,KAAK,EACL,kBAAkB,EAClB,kBAAkB,EAClB,iBAAiB,EACjB,wBAAwB,EACxB,iBAAiB,EACjB,qBAAqB,EACrB,QAAQ,EACR,qBAAqB,EACrB,kBAAkB,EAClB,qBAAqB,EACrB,kBAAkB,EAClB,gBAAgB,EAChB,UAAU,EACV,YAAY,EACZ,oBAAoB,EACpB,qBAAqB,EACrB,0BAA0B,EAC1B,8BAA8B,EAC9B,mCAAmC,EACnC,4BAA4B,EAC5B,uBAAuB,EACvB,uBAAuB,EACvB,8BAA8B,GAC/B,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AACnF,OAAO,EAAE,mBAAmB,EAAmC,MAAM,gBAAgB,CAAC;AACtF,OAAO,EACL,iCAAiC,EACjC,8BAA8B,EAC9B,iCAAiC,EACjC,8BAA8B,EAC9B,2BAA2B,EAC3B,8BAA8B,EAC9B,8BAA8B,EAC9B,kCAAkC,EAClC,iCAAiC,EACjC,wCAAwC,EACxC,iCAAiC,EACjC,qCAAqC,EACrC,uBAAuB,EACvB,gCAAgC,EAChC,gCAAgC,EAChC,iBAAiB,EACjB,sCAAsC,EACtC,0CAA0C,EAC1C,gDAAgD,EAChD,yCAAyC,EACzC,mCAAmC,EACnC,mCAAmC,EACnC,0CAA0C,EAC1C,eAAe,GAChB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAC3D,OAAO,EACL,8BAA8B,EAC9B,2BAA2B,EAC3B,8BAA8B,EAC9B,2BAA2B,EAC3B,yBAAyB,EACzB,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,+BAA+B,EAC/B,8BAA8B,EAC9B,qCAAqC,EACrC,8BAA8B,EAC9B,kCAAkC,EAClC,6BAA6B,EAC7B,8BAA8B,EAC9B,mCAAmC,EACnC,uCAAuC,EACvC,4CAA4C,EAC5C,qCAAqC,EACrC,gCAAgC,EAChC,gCAAgC,EAChC,uCAAuC,GACxC,MAAM,eAAe,CAAC","sourcesContent":["export type { MessageSignature, RFC3161Timestamp, SigstoreBundle, TimestampVerificationData, TLogEntry, VerificationMaterial } from \"./bundle.js\";\nexport {\n  CertificateError,\n  PolicyError,\n  SignatureError,\n  TimestampError,\n  TLogError,\n  VerificationError,\n} from \"./errors.js\";\nexport type { RawTimestampAuthority, Sigstore, TrustedRoot } from \"./interfaces.js\";\nexport type { VerificationPolicy } from \"./policy.js\";\nexport {\n  AllOf,\n  AnyOf,\n  GITHUB_OIDC_ISSUER,\n  GitHubWorkflowName,\n  GitHubWorkflowRef,\n  GitHubWorkflowRepository,\n  GitHubWorkflowSHA,\n  GitHubWorkflowTrigger,\n  Identity,\n  OIDCBuildConfigDigest,\n  OIDCBuildConfigURI,\n  OIDCBuildSignerDigest,\n  OIDCBuildSignerURI,\n  OIDCBuildTrigger,\n  OIDCIssuer,\n  OIDCIssuerV2,\n  OIDCRunInvocationURI,\n  OIDCRunnerEnvironment,\n  OIDCSourceRepositoryDigest,\n  OIDCSourceRepositoryIdentifier,\n  OIDCSourceRepositoryOwnerIdentifier,\n  OIDCSourceRepositoryOwnerURI,\n  OIDCSourceRepositoryRef,\n  OIDCSourceRepositoryURI,\n  OIDCSourceRepositoryVisibility,\n} from \"./policy.js\";\nexport type { SigstoreVerifierOptions } from \"./sigstore.js\";\nexport { SigstoreVerifier } from \"./sigstore.js\";\nexport { verifyBundleTimestamp, verifyRFC3161Timestamp } from \"./timestamp/tsa.js\";\nexport { TrustedRootProvider, type TrustedRootProviderOptions } from \"./trust/tuf.js\";\nexport {\n  EXTENSION_OID_BUILD_CONFIG_DIGEST,\n  EXTENSION_OID_BUILD_CONFIG_URI,\n  EXTENSION_OID_BUILD_SIGNER_DIGEST,\n  EXTENSION_OID_BUILD_SIGNER_URI,\n  EXTENSION_OID_BUILD_TRIGGER,\n  EXTENSION_OID_FULCIO_ISSUER_V1,\n  EXTENSION_OID_FULCIO_ISSUER_V2,\n  EXTENSION_OID_GITHUB_WORKFLOW_NAME,\n  EXTENSION_OID_GITHUB_WORKFLOW_REF,\n  EXTENSION_OID_GITHUB_WORKFLOW_REPOSITORY,\n  EXTENSION_OID_GITHUB_WORKFLOW_SHA,\n  EXTENSION_OID_GITHUB_WORKFLOW_TRIGGER,\n  EXTENSION_OID_OTHERNAME,\n  EXTENSION_OID_RUN_INVOCATION_URI,\n  EXTENSION_OID_RUNNER_ENVIRONMENT,\n  EXTENSION_OID_SCT,\n  EXTENSION_OID_SOURCE_REPOSITORY_DIGEST,\n  EXTENSION_OID_SOURCE_REPOSITORY_IDENTIFIER,\n  EXTENSION_OID_SOURCE_REPOSITORY_OWNER_IDENTIFIER,\n  EXTENSION_OID_SOURCE_REPOSITORY_OWNER_URI,\n  EXTENSION_OID_SOURCE_REPOSITORY_REF,\n  EXTENSION_OID_SOURCE_REPOSITORY_URI,\n  EXTENSION_OID_SOURCE_REPOSITORY_VISIBILITY,\n  X509Certificate,\n} from \"./x509/cert.js\";\nexport { CertificateChainVerifier } from \"./x509/chain.js\";\nexport {\n  X509BuildConfigDigestExtension,\n  X509BuildConfigURIExtension,\n  X509BuildSignerDigestExtension,\n  X509BuildSignerURIExtension,\n  X509BuildTriggerExtension,\n  X509Extension,\n  X509FulcioIssuerV1,\n  X509FulcioIssuerV2,\n  X509GitHubWorkflowNameExtension,\n  X509GitHubWorkflowRefExtension,\n  X509GitHubWorkflowRepositoryExtension,\n  X509GitHubWorkflowSHAExtension,\n  X509GitHubWorkflowTriggerExtension,\n  X509RunInvocationURIExtension,\n  X509RunnerEnvironmentExtension,\n  X509SourceRepositoryDigestExtension,\n  X509SourceRepositoryIdentifierExtension,\n  X509SourceRepositoryOwnerIdentifierExtension,\n  X509SourceRepositoryOwnerURIExtension,\n  X509SourceRepositoryRefExtension,\n  X509SourceRepositoryURIExtension,\n  X509SourceRepositoryVisibilityExtension,\n} from \"./x509/ext.js\";\n"]}

package/dist/interfaces.d.ts

@@ -1,4 +1,11 @@
 import { X509Certificate } from "./x509/index.js";
+export declare function parseValidityPeriod(validity: {
+    start?: unknown;
+    end?: unknown;
+} | undefined): {
+    start: Date;
+    end: Date;
+};
 export declare enum SigstoreRoots {
     certificateAuthorities = "certificateAuthorities",
     ctlogs = "ctlogs",
@@ -27,10 +34,12 @@ export interface RawTimestampAuthority {
         start: string;
         end?: string;
     };
+    operator?: string;
 }
 export interface CTLog {
     logID: Uint8Array;
     publicKey: CryptoKey;
+    operator: string;
     validFor: {
         start: Date;
         end: Date;
@@ -39,6 +48,12 @@ export interface CTLog {
 export interface RekorKeyInfo {
     publicKey: CryptoKey;
     logId: Uint8Array;
+    hashAlgorithm: string;
+    operator: string;
+    validFor: {
+        start: Date;
+        end: Date;
+    };
 }
 export interface CertAuthority {
     certChain: X509Certificate[];
@@ -48,10 +63,9 @@ export interface CertAuthority {
     };
 }
 export interface Sigstore {
-    rekor: RekorKeyInfo | undefined;
+    rekor: RekorKeyInfo[];
     ctlogs: CTLog[];
     certificateAuthorities: CertAuthority[];
-    timestampAuthorities: CertAuthority[];
 }
 export interface RawLog {
     baseUrl: string;
@@ -67,6 +81,7 @@ export interface RawLog {
     logId: {
         keyId: string;
     };
+    operator?: string;
 }
 export type RawLogs = RawLog[];
 export interface RawCA {
@@ -86,6 +101,5 @@ export interface RawCA {
     };
 }
 export type RawCAs = RawCA[];
-export { KeyTypes, EcdsaTypes, HashAlgorithms } from "@freedomofpress/crypto-browser";
+export { EcdsaTypes, HashAlgorithms, KeyTypes } from "@freedomofpress/crypto-browser";
 export declare function getHashAlgorithm(algorithm: string): string;
-//# sourceMappingURL=interfaces.d.ts.map

package/dist/interfaces.js

@@ -1,3 +1,17 @@
+export function parseValidityPeriod(validity) {
+    if (typeof validity?.start !== "string" ||
+        (validity.end !== undefined && typeof validity.end !== "string")) {
+        throw new Error("Invalid authority validity period");
+    }
+    const start = new Date(validity.start);
+    const end = validity.end === undefined
+        ? new Date(8640000000000000)
+        : new Date(validity.end);
+    if (!Number.isFinite(start.getTime()) || !Number.isFinite(end.getTime()) || start > end) {
+        throw new Error("Invalid authority validity period");
+    }
+    return { start, end };
+}
 export var SigstoreRoots;
 (function (SigstoreRoots) {
     SigstoreRoots["certificateAuthorities"] = "certificateAuthorities";
@@ -6,7 +20,7 @@ export var SigstoreRoots;
     SigstoreRoots["tlogs"] = "tlogs";
 })(SigstoreRoots || (SigstoreRoots = {}));
 // Re-export crypto enums from crypto-browser (shared with tuf-browser)
-export { KeyTypes, EcdsaTypes, HashAlgorithms } from "@freedomofpress/crypto-browser";
+export { EcdsaTypes, HashAlgorithms, KeyTypes } from "@freedomofpress/crypto-browser";
 import { HashAlgorithms } from "@freedomofpress/crypto-browser";
 // Supported hash algorithms for payload hash validation
 // Rekor v1 uses lowercase (sha256), Rekor v2 uses uppercase with underscore (SHA2_256)

package/dist/interfaces.js.map

@@ -1 +1 @@
-{"version":3,"file":"interfaces.js","sourceRoot":"","sources":["../src/interfaces.ts"],"names":[],"mappings":"AAEA,MAAM,CAAN,IAAY,aAKX;AALD,WAAY,aAAa;IACvB,kEAAiD,CAAA;IACjD,kCAAiB,CAAA;IACjB,8DAA6C,CAAA;IAC7C,gCAAe,CAAA;AACjB,CAAC,EALW,aAAa,KAAb,aAAa,QAKxB;AA8FD,uEAAuE;AACvE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AACtF,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAEhE,wDAAwD;AACxD,uFAAuF;AACvF,MAAM,yBAAyB,GAA2B;IACxD,QAAQ,EAAE,cAAc,CAAC,MAAM;IAC/B,QAAQ,EAAE,cAAc,CAAC,MAAM;IAC/B,QAAQ,EAAE,cAAc,CAAC,MAAM;IAC/B,UAAU,EAAE,cAAc,CAAC,MAAM;IACjC,UAAU,EAAE,cAAc,CAAC,MAAM;IACjC,UAAU,EAAE,cAAc,CAAC,MAAM;CAClC,CAAC;AAEF,MAAM,UAAU,gBAAgB,CAAC,SAAiB;IAChD,MAAM,OAAO,GAAG,yBAAyB,CAAC,SAAS,CAAC,CAAC;IACrD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,+BAA+B,SAAS,EAAE,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}
+{"version":3,"file":"interfaces.js","sourceRoot":"","sources":["../src/interfaces.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,mBAAmB,CACjC,QAAwD;IAExD,IACE,OAAO,QAAQ,EAAE,KAAK,KAAK,QAAQ;QACnC,CAAC,QAAQ,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,QAAQ,CAAC,GAAG,KAAK,QAAQ,CAAC,EAChE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,KAAK,SAAS;QACpC,CAAC,CAAC,IAAI,IAAI,CAAC,gBAAgB,CAAC;QAC5B,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,IAAI,KAAK,GAAG,GAAG,EAAE,CAAC;QACxF,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;AACxB,CAAC;AAED,MAAM,CAAN,IAAY,aAKX;AALD,WAAY,aAAa;IACvB,kEAAiD,CAAA;IACjD,kCAAiB,CAAA;IACjB,8DAA6C,CAAA;IAC7C,gCAAe,CAAA;AACjB,CAAC,EALW,aAAa,KAAb,aAAa,QAKxB;AAsGD,uEAAuE;AACvE,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AACtF,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAEhE,wDAAwD;AACxD,uFAAuF;AACvF,MAAM,yBAAyB,GAA2B;IACxD,QAAQ,EAAE,cAAc,CAAC,MAAM;IAC/B,QAAQ,EAAE,cAAc,CAAC,MAAM;IAC/B,QAAQ,EAAE,cAAc,CAAC,MAAM;IAC/B,UAAU,EAAE,cAAc,CAAC,MAAM;IACjC,UAAU,EAAE,cAAc,CAAC,MAAM;IACjC,UAAU,EAAE,cAAc,CAAC,MAAM;CAClC,CAAC;AAEF,MAAM,UAAU,gBAAgB,CAAC,SAAiB;IAChD,MAAM,OAAO,GAAG,yBAAyB,CAAC,SAAS,CAAC,CAAC;IACrD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,+BAA+B,SAAS,EAAE,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC","sourcesContent":["import { X509Certificate } from \"./x509/index.js\";\n\nexport function parseValidityPeriod(\n  validity: { start?: unknown; end?: unknown } | undefined,\n): { start: Date; end: Date } {\n  if (\n    typeof validity?.start !== \"string\" ||\n    (validity.end !== undefined && typeof validity.end !== \"string\")\n  ) {\n    throw new Error(\"Invalid authority validity period\");\n  }\n  const start = new Date(validity.start);\n  const end = validity.end === undefined\n    ? new Date(8640000000000000)\n    : new Date(validity.end);\n  if (!Number.isFinite(start.getTime()) || !Number.isFinite(end.getTime()) || start > end) {\n    throw new Error(\"Invalid authority validity period\");\n  }\n  return { start, end };\n}\n\nexport enum SigstoreRoots {\n  certificateAuthorities = \"certificateAuthorities\",\n  ctlogs = \"ctlogs\",\n  timestampAuthorities = \"timestampAuthorities\",\n  tlogs = \"tlogs\",\n}\n\nexport type RawTimestampAuthorities = RawTimestampAuthority[];\n\nexport interface TrustedRoot {\n  mediaType: string;\n  tlogs: RawLogs;\n  certificateAuthorities: RawCAs;\n  ctlogs: RawLogs;\n  timestampAuthorities: RawTimestampAuthorities;\n}\n\nexport interface RawTimestampAuthority {\n  subject: {\n    organization: string;\n    commonName: string;\n  };\n  certChain: {\n    certificates: {\n      rawBytes: string;\n    }[];\n  };\n  validFor: {\n    start: string;\n    end?: string;\n  };\n  operator?: string;\n}\n\nexport interface CTLog {\n  logID: Uint8Array;\n  publicKey: CryptoKey;\n  operator: string;\n  validFor: {\n    start: Date;\n    end: Date;\n  };\n}\n\nexport interface RekorKeyInfo {\n  publicKey: CryptoKey;\n  logId: Uint8Array;\n  hashAlgorithm: string;\n  operator: string;\n  validFor: {\n    start: Date;\n    end: Date;\n  };\n}\n\nexport interface CertAuthority {\n  certChain: X509Certificate[];\n  validFor: {\n    start: Date;\n    end: Date;\n  };\n}\n\nexport interface Sigstore {\n  rekor: RekorKeyInfo[];\n  ctlogs: CTLog[];\n  certificateAuthorities: CertAuthority[];\n}\n\nexport interface RawLog {\n  baseUrl: string;\n  hashAlgorithm: string;\n  publicKey: {\n    rawBytes: string;\n    keyDetails: string;\n    validFor: {\n      start: string;\n      end?: string;\n    };\n  };\n  logId: {\n    keyId: string;\n  };\n  operator?: string;\n}\n\nexport type RawLogs = RawLog[];\n\nexport interface RawCA {\n  subject: {\n    organization: string;\n    commonName: string;\n  };\n  uri: string;\n  certChain: {\n    certificates: {\n      rawBytes: string;\n    }[];\n  };\n  validFor: {\n    start: string;\n    end?: string;\n  };\n}\n\nexport type RawCAs = RawCA[];\n\n// Re-export crypto enums from crypto-browser (shared with tuf-browser)\nexport { EcdsaTypes, HashAlgorithms, KeyTypes } from \"@freedomofpress/crypto-browser\";\nimport { HashAlgorithms } from \"@freedomofpress/crypto-browser\";\n\n// Supported hash algorithms for payload hash validation\n// Rekor v1 uses lowercase (sha256), Rekor v2 uses uppercase with underscore (SHA2_256)\nconst SUPPORTED_HASH_ALGORITHMS: Record<string, string> = {\n  \"sha256\": HashAlgorithms.SHA256,\n  \"sha384\": HashAlgorithms.SHA384,\n  \"sha512\": HashAlgorithms.SHA512,\n  \"SHA2_256\": HashAlgorithms.SHA256,\n  \"SHA2_384\": HashAlgorithms.SHA384,\n  \"SHA2_512\": HashAlgorithms.SHA512,\n};\n\nexport function getHashAlgorithm(algorithm: string): string {\n  const hashAlg = SUPPORTED_HASH_ALGORITHMS[algorithm];\n  if (!hashAlg) {\n    throw new Error(`Unsupported hash algorithm: ${algorithm}`);\n  }\n  return hashAlg;\n}\n"]}

package/dist/oid.d.ts

@@ -4,4 +4,3 @@ export declare const OID_RSASSA_PSS = "1.2.840.113549.1.1.10";
 export declare const SHA2_HASH_ALGOS: Record<string, string>;
 export declare const DEFAULT_HASH_ALGORITHM = "sha256";
 export declare const ECDSA_CURVE_NAMES: Record<string, string>;
-//# sourceMappingURL=oid.d.ts.map

package/dist/oid.js.map

@@ -1 +1 @@
-{"version":3,"file":"oid.js","sourceRoot":"","sources":["../src/oid.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAElF,MAAM,CAAC,MAAM,qBAAqB,GAA2B;IAC3D,qBAAqB,EAAE,QAAQ;IAC/B,qBAAqB,EAAE,QAAQ;IAC/B,qBAAqB,EAAE,QAAQ;IAC/B,qBAAqB,EAAE,QAAQ;CAChC,CAAC;AAEF,yCAAyC;AACzC,MAAM,CAAC,MAAM,mBAAmB,GAA2B;IACzD,uBAAuB,EAAE,QAAQ,EAAE,0BAA0B;IAC7D,uBAAuB,EAAE,QAAQ,EAAE,0BAA0B;IAC7D,uBAAuB,EAAE,QAAQ,EAAE,0BAA0B;IAC7D,sBAAsB,EAAE,MAAM,EAAK,wBAAwB;CAC5D,CAAC;AAEF,qFAAqF;AACrF,MAAM,CAAC,MAAM,cAAc,GAAG,uBAAuB,CAAC;AAEtD,MAAM,CAAC,MAAM,eAAe,GAA2B;IACrD,wBAAwB,EAAE,QAAQ;IAClC,wBAAwB,EAAE,QAAQ;IAClC,wBAAwB,EAAE,QAAQ;CACnC,CAAC;AAEF,iDAAiD;AACjD,MAAM,CAAC,MAAM,sBAAsB,GAAG,QAAQ,CAAC;AAE/C,MAAM,CAAC,MAAM,iBAAiB,GAA2B;IACvD,qBAAqB,EAAE,WAAW;IAClC,cAAc,EAAE,WAAW;IAC3B,cAAc,EAAE,WAAW;CAC5B,CAAC"}
+{"version":3,"file":"oid.js","sourceRoot":"","sources":["../src/oid.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAElF,MAAM,CAAC,MAAM,qBAAqB,GAA2B;IAC3D,qBAAqB,EAAE,QAAQ;IAC/B,qBAAqB,EAAE,QAAQ;IAC/B,qBAAqB,EAAE,QAAQ;IAC/B,qBAAqB,EAAE,QAAQ;CAChC,CAAC;AAEF,yCAAyC;AACzC,MAAM,CAAC,MAAM,mBAAmB,GAA2B;IACzD,uBAAuB,EAAE,QAAQ,EAAE,0BAA0B;IAC7D,uBAAuB,EAAE,QAAQ,EAAE,0BAA0B;IAC7D,uBAAuB,EAAE,QAAQ,EAAE,0BAA0B;IAC7D,sBAAsB,EAAE,MAAM,EAAK,wBAAwB;CAC5D,CAAC;AAEF,qFAAqF;AACrF,MAAM,CAAC,MAAM,cAAc,GAAG,uBAAuB,CAAC;AAEtD,MAAM,CAAC,MAAM,eAAe,GAA2B;IACrD,wBAAwB,EAAE,QAAQ;IAClC,wBAAwB,EAAE,QAAQ;IAClC,wBAAwB,EAAE,QAAQ;CACnC,CAAC;AAEF,iDAAiD;AACjD,MAAM,CAAC,MAAM,sBAAsB,GAAG,QAAQ,CAAC;AAE/C,MAAM,CAAC,MAAM,iBAAiB,GAA2B;IACvD,qBAAqB,EAAE,WAAW;IAClC,cAAc,EAAE,WAAW;IAC3B,cAAc,EAAE,WAAW;CAC5B,CAAC","sourcesContent":["// From https://github.com/sigstore/sigstore-js/blob/main/packages/core/src/oid.ts\n\nexport const ECDSA_SIGNATURE_ALGOS: Record<string, string> = {\n  \"1.2.840.10045.4.3.1\": \"sha224\",\n  \"1.2.840.10045.4.3.2\": \"sha256\",\n  \"1.2.840.10045.4.3.3\": \"sha384\",\n  \"1.2.840.10045.4.3.4\": \"sha512\",\n};\n\n// RSA signature algorithms (PKCS#1 v1.5)\nexport const RSA_SIGNATURE_ALGOS: Record<string, string> = {\n  \"1.2.840.113549.1.1.11\": \"sha256\", // sha256WithRSAEncryption\n  \"1.2.840.113549.1.1.12\": \"sha384\", // sha384WithRSAEncryption\n  \"1.2.840.113549.1.1.13\": \"sha512\", // sha512WithRSAEncryption\n  \"1.2.840.113549.1.1.5\": \"sha1\",    // sha1WithRSAEncryption\n};\n\n// RSASSA-PSS OID - hash algorithm must be parsed from signature algorithm parameters\nexport const OID_RSASSA_PSS = \"1.2.840.113549.1.1.10\";\n\nexport const SHA2_HASH_ALGOS: Record<string, string> = {\n  \"2.16.840.1.101.3.4.2.1\": \"sha256\",\n  \"2.16.840.1.101.3.4.2.2\": \"sha384\",\n  \"2.16.840.1.101.3.4.2.3\": \"sha512\",\n};\n\n// Default hash algorithm used when not specified\nexport const DEFAULT_HASH_ALGORITHM = \"sha256\";\n\nexport const ECDSA_CURVE_NAMES: Record<string, string> = {\n  \"1.2.840.10045.3.1.7\": \"secp256r1\",\n  \"1.3.132.0.34\": \"secp384r1\",\n  \"1.3.132.0.35\": \"secp521r1\",\n};\n"]}

package/dist/policy.d.ts

@@ -19,7 +19,7 @@ export declare const GITHUB_OIDC_ISSUER = "https://token.actions.githubuserconte
  * Interface that all verification policies conform to.
  */
 export interface VerificationPolicy {
-    verify(cert: X509Certificate): void;
+    verify(cert: X509Certificate): void | Promise<void>;
 }
 /**
  * Base class for V1 extension policies (raw OCTET STRING value).
@@ -234,7 +234,7 @@ export declare class OIDCSourceRepositoryVisibility extends SingleX509ExtPolicyV
 export declare class AnyOf implements VerificationPolicy {
     private children;
     constructor(children: VerificationPolicy[]);
-    verify(cert: X509Certificate): void;
+    verify(cert: X509Certificate): Promise<void>;
 }
 /**
  * The "all of" policy, corresponding to a logical AND between child policies.
@@ -243,7 +243,7 @@ export declare class AnyOf implements VerificationPolicy {
 export declare class AllOf implements VerificationPolicy {
     private children;
     constructor(children: VerificationPolicy[]);
-    verify(cert: X509Certificate): void;
+    verify(cert: X509Certificate): Promise<void>;
 }
 /**
  * Verifies the certificate's "identity", corresponding to the X.509v3 SAN.
@@ -263,4 +263,3 @@ export declare class Identity implements VerificationPolicy {
     verify(cert: X509Certificate): void;
 }
 export {};
-//# sourceMappingURL=policy.d.ts.map

package/dist/policy.js

@@ -14,7 +14,7 @@
  * - Identity: Verifies SAN with optional issuer check
  */
 import { PolicyError } from "./errors.js";
-import { EXTENSION_OID_FULCIO_ISSUER_V1, EXTENSION_OID_GITHUB_WORKFLOW_TRIGGER, EXTENSION_OID_GITHUB_WORKFLOW_SHA, EXTENSION_OID_GITHUB_WORKFLOW_NAME, EXTENSION_OID_GITHUB_WORKFLOW_REPOSITORY, EXTENSION_OID_GITHUB_WORKFLOW_REF, EXTENSION_OID_OTHERNAME, EXTENSION_OID_FULCIO_ISSUER_V2, EXTENSION_OID_BUILD_SIGNER_URI, EXTENSION_OID_BUILD_SIGNER_DIGEST, EXTENSION_OID_RUNNER_ENVIRONMENT, EXTENSION_OID_SOURCE_REPOSITORY_URI, EXTENSION_OID_SOURCE_REPOSITORY_DIGEST, EXTENSION_OID_SOURCE_REPOSITORY_REF, EXTENSION_OID_SOURCE_REPOSITORY_IDENTIFIER, EXTENSION_OID_SOURCE_REPOSITORY_OWNER_URI, EXTENSION_OID_SOURCE_REPOSITORY_OWNER_IDENTIFIER, EXTENSION_OID_BUILD_CONFIG_URI, EXTENSION_OID_BUILD_CONFIG_DIGEST, EXTENSION_OID_BUILD_TRIGGER, EXTENSION_OID_RUN_INVOCATION_URI, EXTENSION_OID_SOURCE_REPOSITORY_VISIBILITY, } from "./x509/cert.js";
+import { EXTENSION_OID_BUILD_CONFIG_DIGEST, EXTENSION_OID_BUILD_CONFIG_URI, EXTENSION_OID_BUILD_SIGNER_DIGEST, EXTENSION_OID_BUILD_SIGNER_URI, EXTENSION_OID_BUILD_TRIGGER, EXTENSION_OID_FULCIO_ISSUER_V1, EXTENSION_OID_FULCIO_ISSUER_V2, EXTENSION_OID_GITHUB_WORKFLOW_NAME, EXTENSION_OID_GITHUB_WORKFLOW_REF, EXTENSION_OID_GITHUB_WORKFLOW_REPOSITORY, EXTENSION_OID_GITHUB_WORKFLOW_SHA, EXTENSION_OID_GITHUB_WORKFLOW_TRIGGER, EXTENSION_OID_OTHERNAME, EXTENSION_OID_RUN_INVOCATION_URI, EXTENSION_OID_RUNNER_ENVIRONMENT, EXTENSION_OID_SOURCE_REPOSITORY_DIGEST, EXTENSION_OID_SOURCE_REPOSITORY_IDENTIFIER, EXTENSION_OID_SOURCE_REPOSITORY_OWNER_IDENTIFIER, EXTENSION_OID_SOURCE_REPOSITORY_OWNER_URI, EXTENSION_OID_SOURCE_REPOSITORY_REF, EXTENSION_OID_SOURCE_REPOSITORY_URI, EXTENSION_OID_SOURCE_REPOSITORY_VISIBILITY, } from "./x509/cert.js";
 // Standard GitHub Actions OIDC issuer
 // https://docs.github.com/en/actions/security-for-github-actions/security-hardening-your-deployments/about-security-hardening-with-openid-connect
 export const GITHUB_OIDC_ISSUER = "https://token.actions.githubusercontent.com";
@@ -353,10 +353,10 @@ export class AnyOf {
     constructor(children) {
         this.children = children;
     }
-    verify(cert) {
+    async verify(cert) {
         for (const child of this.children) {
             try {
-                child.verify(cert);
+                await child.verify(cert);
                 return;
             }
             catch {
@@ -374,12 +374,12 @@ export class AllOf {
     constructor(children) {
         this.children = children;
     }
-    verify(cert) {
+    async verify(cert) {
         if (this.children.length < 1) {
             throw new PolicyError("no child policies to verify");
         }
         for (const child of this.children) {
-            child.verify(cert);
+            await child.verify(cert);
         }
     }
 }