@freedomofpress/sigstore-browser 0.1.14 → 0.1.16

package/src/x509/chain.ts

@@ -1,212 +0,0 @@
-/*
-Copyright 2023 The Sigstore Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-/*
- * Certificate chain verification for browser environments
- *
- * Ported from sigstore-js:
- * https://github.com/sigstore/sigstore-js/blob/main/packages/verify/src/key/certificate.ts
- *
- * Key differences from sigstore-js:
- * - Browser-compatible: async verify() method for Web Crypto API
- * - Uses Uint8Array instead of Buffer for binary data
- * - Uses uint8ArrayEqual for Uint8Array comparisons
- */
-
-import { uint8ArrayEqual } from "@freedomofpress/crypto-browser";
-import { X509Certificate } from "./cert.js";
-
-interface CertificateChainVerifierOptions {
-  trustedCerts: X509Certificate[];
-  untrustedCert: X509Certificate;
-  timestamp: Date;
-}
-
-export class CertificateChainVerifier {
-  private untrustedCert: X509Certificate;
-  private trustedCerts: X509Certificate[];
-  private localCerts: X509Certificate[];
-  private timestamp: Date;
-
-  constructor(opts: CertificateChainVerifierOptions) {
-    this.untrustedCert = opts.untrustedCert;
-    this.trustedCerts = opts.trustedCerts;
-    this.localCerts = dedupeCertificates([
-      ...opts.trustedCerts,
-      opts.untrustedCert,
-    ]);
-    this.timestamp = opts.timestamp;
-  }
-
-  public async verify(): Promise<X509Certificate[]> {
-    const certificatePath = await this.sort();
-
-    this.checkPath(certificatePath);
-
-    const validForDate = certificatePath.every((cert) =>
-      cert.validForDate(this.timestamp)
-    );
-
-    if (!validForDate) {
-      throw new Error(
-        "certificate is not valid or expired at the specified date"
-      );
-    }
-
-    return certificatePath;
-  }
-
-  private async sort(): Promise<X509Certificate[]> {
-    const leafCert = this.untrustedCert;
-
-    let paths = await this.buildPaths(leafCert);
-
-    paths = paths.filter((path) =>
-      path.some((cert) => this.trustedCerts.includes(cert))
-    );
-
-    if (paths.length === 0) {
-      throw new Error("no trusted certificate path found");
-    }
-
-    const path = paths.reduce((prev, curr) =>
-      prev.length < curr.length ? prev : curr
-    );
-
-    return [leafCert, ...path].slice(0, -1);
-  }
-
-  private async buildPaths(
-    certificate: X509Certificate
-  ): Promise<X509Certificate[][]> {
-    const paths = [];
-    const issuers = await this.findIssuer(certificate);
-
-    if (issuers.length === 0) {
-      throw new Error("no valid certificate path found");
-    }
-
-    for (let i = 0; i < issuers.length; i++) {
-      const issuer = issuers[i];
-
-      if (issuer.equals(certificate)) {
-        paths.push([certificate]);
-        continue;
-      }
-
-      const subPaths = await this.buildPaths(issuer);
-
-      for (let j = 0; j < subPaths.length; j++) {
-        paths.push([issuer, ...subPaths[j]]);
-      }
-    }
-
-    return paths;
-  }
-
-  private async findIssuer(
-    certificate: X509Certificate
-  ): Promise<X509Certificate[]> {
-    let issuers: X509Certificate[] = [];
-    let keyIdentifier: Uint8Array | undefined;
-
-    if (uint8ArrayEqual(certificate.subject, certificate.issuer)) {
-      if (await certificate.verify()) {
-        return [certificate];
-      }
-    }
-
-    if (certificate.extAuthorityKeyID) {
-      keyIdentifier = certificate.extAuthorityKeyID.keyIdentifier;
-    }
-
-    this.localCerts.forEach((possibleIssuer) => {
-      if (keyIdentifier) {
-        if (possibleIssuer.extSubjectKeyID) {
-          if (
-            uint8ArrayEqual(
-              possibleIssuer.extSubjectKeyID.keyIdentifier,
-              keyIdentifier
-            )
-          ) {
-            issuers.push(possibleIssuer);
-          }
-          return;
-        }
-      }
-
-      if (uint8ArrayEqual(possibleIssuer.subject, certificate.issuer)) {
-        issuers.push(possibleIssuer);
-      }
-    });
-
-    const verifiedIssuers: X509Certificate[] = [];
-    for (const issuer of issuers) {
-      try {
-        if (await certificate.verify(issuer)) {
-          verifiedIssuers.push(issuer);
-        }
-      } catch (ex) {
-        // Ignore verification failures
-      }
-    }
-
-    return verifiedIssuers;
-  }
-
-  private checkPath(path: X509Certificate[]): void {
-    if (path.length < 1) {
-      throw new Error(
-        "certificate chain must contain at least one certificate"
-      );
-    }
-
-    const validCAs = path.slice(1).every((cert) => cert.isCA);
-    if (!validCAs) {
-      throw new Error("intermediate certificate is not a CA");
-    }
-
-    for (let i = path.length - 2; i >= 0; i--) {
-      if (!uint8ArrayEqual(path[i].issuer, path[i + 1].subject)) {
-        throw new Error("incorrect certificate name chaining");
-      }
-    }
-
-    for (let i = 0; i < path.length; i++) {
-      const cert = path[i];
-
-      if (cert.extBasicConstraints?.isCA) {
-        const pathLength = cert.extBasicConstraints.pathLenConstraint;
-
-        if (pathLength !== undefined && pathLength < BigInt(i - 1)) {
-          throw new Error("path length constraint exceeded");
-        }
-      }
-    }
-  }
-}
-
-function dedupeCertificates(certs: X509Certificate[]): X509Certificate[] {
-  for (let i = 0; i < certs.length; i++) {
-    for (let j = i + 1; j < certs.length; j++) {
-      if (certs[i].equals(certs[j])) {
-        certs.splice(j, 1);
-        j--;
-      }
-    }
-  }
-  return certs;
-}

package/src/x509/ext.ts

@@ -1,356 +0,0 @@
-/*
-Copyright 2023 The Sigstore Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-import { ASN1Obj, ByteStream, Uint8ArrayToString } from "@freedomofpress/crypto-browser";
-import { SignedCertificateTimestamp } from "./sct.js";
-
-// https://www.rfc-editor.org/rfc/rfc5280#section-4.1
-export class X509Extension {
-  protected root: ASN1Obj;
-
-  constructor(asn1: ASN1Obj) {
-    this.root = asn1;
-  }
-
-  get oid(): string {
-    return this.root.subs[0].toOID();
-  }
-
-  get critical(): boolean {
-    // The critical field is optional and will be the second element of the
-    // extension sequence if present. Default to false if not present.
-    return this.root.subs.length === 3 ? this.root.subs[1].toBoolean() : false;
-  }
-
-  get value(): Uint8Array {
-    return this.extnValueObj.value;
-  }
-
-  get valueObj(): ASN1Obj {
-    return this.extnValueObj;
-  }
-
-  protected get extnValueObj(): ASN1Obj {
-    // The extnValue field will be the last element of the extension sequence
-    return this.root.subs[this.root.subs.length - 1];
-  }
-}
-
-// https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.9
-export class X509BasicConstraintsExtension extends X509Extension {
-  get isCA(): boolean {
-    return this.sequence.subs[0]?.toBoolean() ?? false;
-  }
-
-  get pathLenConstraint(): bigint | undefined {
-    return this.sequence.subs.length > 1
-      ? this.sequence.subs[1].toInteger()
-      : undefined;
-  }
-
-  // The extnValue field contains a single sequence wrapping the isCA and
-  // pathLenConstraint.
-  private get sequence(): ASN1Obj {
-    return this.extnValueObj.subs[0];
-  }
-}
-
-// https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.3
-export class X509KeyUsageExtension extends X509Extension {
-  get digitalSignature(): boolean {
-    return this.bitString[0] === 1;
-  }
-
-  get keyCertSign(): boolean {
-    return this.bitString[5] === 1;
-  }
-
-  get crlSign(): boolean {
-    return this.bitString[6] === 1;
-  }
-
-  // The extnValue field contains a single bit string which is a bit mask
-  // indicating which key usages are enabled.
-  private get bitString(): number[] {
-    return this.extnValueObj.subs[0].toBitString();
-  }
-}
-
-// https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.6
-export class X509SubjectAlternativeNameExtension extends X509Extension {
-  get rfc822Name(): string | undefined {
-    const rfc822Name = this.findGeneralName(0x01)?.value;
-    if (rfc822Name === undefined) {
-      return undefined;
-    } else {
-      return Uint8ArrayToString(rfc822Name);
-    }
-  }
-
-  get uri(): string | undefined {
-    const uri = this.findGeneralName(0x06)?.value;
-    if (uri === undefined) {
-      return undefined;
-    } else {
-      return Uint8ArrayToString(uri);
-    }
-  }
-
-  // Retrieve the value of an otherName with the given OID.
-  public otherName(oid: string): string | undefined {
-    const otherName = this.findGeneralName(0x00);
-
-    if (otherName === undefined) {
-      return undefined;
-    }
-
-    // The otherName is a sequence containing an OID and a value.
-    // Need to check that the OID matches the one we're looking for.
-    const otherNameOID = otherName.subs[0].toOID();
-    if (otherNameOID !== oid) {
-      return undefined;
-    }
-
-    // The otherNameValue is a sequence containing the actual value.
-    const otherNameValue = otherName.subs[1];
-    return Uint8ArrayToString(otherNameValue.subs[0].value);
-  }
-
-  private findGeneralName(tag: number): ASN1Obj | undefined {
-    return this.generalNames.find((gn) => gn.tag.isContextSpecific(tag));
-  }
-
-  // The extnValue field contains a sequence of GeneralNames.
-  private get generalNames(): ASN1Obj[] {
-    return this.extnValueObj.subs[0].subs;
-  }
-}
-
-// https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.1
-export class X509AuthorityKeyIDExtension extends X509Extension {
-  get keyIdentifier(): Uint8Array | undefined {
-    return this.findSequenceMember(0x00)?.value;
-  }
-
-  private findSequenceMember(tag: number): ASN1Obj | undefined {
-    return this.sequence.subs.find((el) => el.tag.isContextSpecific(tag));
-  }
-
-  // The extnValue field contains a single sequence wrapping the keyIdentifier
-  private get sequence(): ASN1Obj {
-    return this.extnValueObj.subs[0];
-  }
-}
-
-// https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.2
-export class X509SubjectKeyIDExtension extends X509Extension {
-  get keyIdentifier(): Uint8Array {
-    return this.extnValueObj.subs[0].value;
-  }
-}
-
-// Base class for Fulcio extensions with V1 format (raw OCTET STRING value)
-// https://github.com/sigstore/fulcio/blob/main/docs/oid-info.md
-class X509FulcioExtensionV1 extends X509Extension {
-  get stringValue(): string {
-    return Uint8ArrayToString(this.extnValueObj.value);
-  }
-}
-
-// Base class for Fulcio extensions with V2 format (DER-encoded UTF8String)
-class X509FulcioExtensionV2 extends X509Extension {
-  get stringValue(): string {
-    return Uint8ArrayToString(this.extnValueObj.subs[0].value);
-  }
-}
-
-// OID 1.3.6.1.4.1.57264.1.1 - OIDC Issuer (V1)
-export class X509FulcioIssuerV1 extends X509FulcioExtensionV1 {
-  get issuer(): string {
-    return this.stringValue;
-  }
-}
-
-// OID 1.3.6.1.4.1.57264.1.2 - GitHub Workflow Trigger (V1)
-export class X509GitHubWorkflowTriggerExtension extends X509FulcioExtensionV1 {
-  get workflowTrigger(): string {
-    return this.stringValue;
-  }
-}
-
-// OID 1.3.6.1.4.1.57264.1.3 - GitHub Workflow SHA (V1)
-export class X509GitHubWorkflowSHAExtension extends X509FulcioExtensionV1 {
-  get workflowSHA(): string {
-    return this.stringValue;
-  }
-}
-
-// OID 1.3.6.1.4.1.57264.1.4 - GitHub Workflow Name (V1)
-export class X509GitHubWorkflowNameExtension extends X509FulcioExtensionV1 {
-  get workflowName(): string {
-    return this.stringValue;
-  }
-}
-
-// OID 1.3.6.1.4.1.57264.1.5 - GitHub Workflow Repository (V1)
-export class X509GitHubWorkflowRepositoryExtension extends X509FulcioExtensionV1 {
-  get workflowRepository(): string {
-    return this.stringValue;
-  }
-}
-
-// OID 1.3.6.1.4.1.57264.1.6 - GitHub Workflow Ref (V1)
-export class X509GitHubWorkflowRefExtension extends X509FulcioExtensionV1 {
-  get workflowRef(): string {
-    return this.stringValue;
-  }
-}
-
-// OID 1.3.6.1.4.1.57264.1.8 - OIDC Issuer (V2)
-export class X509FulcioIssuerV2 extends X509FulcioExtensionV2 {
-  get issuer(): string {
-    return this.stringValue;
-  }
-}
-
-// OID 1.3.6.1.4.1.57264.1.9 - Build Signer URI (V2)
-export class X509BuildSignerURIExtension extends X509FulcioExtensionV2 {
-  get buildSignerURI(): string {
-    return this.stringValue;
-  }
-}
-
-// OID 1.3.6.1.4.1.57264.1.10 - Build Signer Digest (V2)
-export class X509BuildSignerDigestExtension extends X509FulcioExtensionV2 {
-  get buildSignerDigest(): string {
-    return this.stringValue;
-  }
-}
-
-// OID 1.3.6.1.4.1.57264.1.11 - Runner Environment (V2)
-export class X509RunnerEnvironmentExtension extends X509FulcioExtensionV2 {
-  get runnerEnvironment(): string {
-    return this.stringValue;
-  }
-}
-
-// OID 1.3.6.1.4.1.57264.1.12 - Source Repository URI (V2)
-export class X509SourceRepositoryURIExtension extends X509FulcioExtensionV2 {
-  get sourceRepositoryURI(): string {
-    return this.stringValue;
-  }
-}
-
-// OID 1.3.6.1.4.1.57264.1.13 - Source Repository Digest (V2)
-export class X509SourceRepositoryDigestExtension extends X509FulcioExtensionV2 {
-  get sourceRepositoryDigest(): string {
-    return this.stringValue;
-  }
-}
-
-// OID 1.3.6.1.4.1.57264.1.14 - Source Repository Ref (V2)
-export class X509SourceRepositoryRefExtension extends X509FulcioExtensionV2 {
-  get sourceRepositoryRef(): string {
-    return this.stringValue;
-  }
-}
-
-// OID 1.3.6.1.4.1.57264.1.15 - Source Repository Identifier (V2)
-export class X509SourceRepositoryIdentifierExtension extends X509FulcioExtensionV2 {
-  get sourceRepositoryIdentifier(): string {
-    return this.stringValue;
-  }
-}
-
-// OID 1.3.6.1.4.1.57264.1.16 - Source Repository Owner URI (V2)
-export class X509SourceRepositoryOwnerURIExtension extends X509FulcioExtensionV2 {
-  get sourceRepositoryOwnerURI(): string {
-    return this.stringValue;
-  }
-}
-
-// OID 1.3.6.1.4.1.57264.1.17 - Source Repository Owner Identifier (V2)
-export class X509SourceRepositoryOwnerIdentifierExtension extends X509FulcioExtensionV2 {
-  get sourceRepositoryOwnerIdentifier(): string {
-    return this.stringValue;
-  }
-}
-
-// OID 1.3.6.1.4.1.57264.1.18 - Build Config URI (V2)
-export class X509BuildConfigURIExtension extends X509FulcioExtensionV2 {
-  get buildConfigURI(): string {
-    return this.stringValue;
-  }
-}
-
-// OID 1.3.6.1.4.1.57264.1.19 - Build Config Digest (V2)
-export class X509BuildConfigDigestExtension extends X509FulcioExtensionV2 {
-  get buildConfigDigest(): string {
-    return this.stringValue;
-  }
-}
-
-// OID 1.3.6.1.4.1.57264.1.20 - Build Trigger (V2)
-export class X509BuildTriggerExtension extends X509FulcioExtensionV2 {
-  get buildTrigger(): string {
-    return this.stringValue;
-  }
-}
-
-// OID 1.3.6.1.4.1.57264.1.21 - Run Invocation URI (V2)
-export class X509RunInvocationURIExtension extends X509FulcioExtensionV2 {
-  get runInvocationURI(): string {
-    return this.stringValue;
-  }
-}
-
-// OID 1.3.6.1.4.1.57264.1.22 - Source Repository Visibility (V2)
-export class X509SourceRepositoryVisibilityExtension extends X509FulcioExtensionV2 {
-  get sourceRepositoryVisibility(): string {
-    return this.stringValue;
-  }
-}
-
-// https://www.rfc-editor.org/rfc/rfc6962#section-3.3
-export class X509SCTExtension extends X509Extension {
-  constructor(asn1: ASN1Obj) {
-    super(asn1);
-  }
-
-  get signedCertificateTimestamps(): SignedCertificateTimestamp[] {
-    const buf = this.extnValueObj.subs[0].value;
-    const stream = new ByteStream(buf);
-
-    // The overall list length is encoded in the first two bytes -- note this
-    // is the length of the list in bytes, NOT the number of SCTs in the list
-    const end = stream.getUint16() + 2;
-
-    const sctList: SignedCertificateTimestamp[] = [];
-    while (stream.position < end) {
-      // Read the length of the next SCT
-      const sctLength = stream.getUint16();
-
-      // Slice out the bytes for the next SCT and parse it
-      const sct = stream.getBlock(sctLength);
-      sctList.push(SignedCertificateTimestamp.parse(sct));
-    }
-
-    if (stream.position !== end) {
-      throw new Error("SCT list length does not match actual length");
-    }
-
-    return sctList;
-  }
-}

package/src/x509/index.ts

@@ -1,19 +0,0 @@
-/*
-Copyright 2023 The Sigstore Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-export { EXTENSION_OID_SCT, X509Certificate } from "./cert.js";
-export { X509SCTExtension } from "./ext.js";
-export { CertificateChainVerifier } from "./chain.js";