@freedomofpress/sigstore-browser 0.1.14 → 0.1.16

package/dist/policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"policy.js","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAEL,8BAA8B,EAC9B,qCAAqC,EACrC,iCAAiC,EACjC,kCAAkC,EAClC,wCAAwC,EACxC,iCAAiC,EACjC,uBAAuB,EACvB,8BAA8B,EAC9B,8BAA8B,EAC9B,iCAAiC,EACjC,gCAAgC,EAChC,mCAAmC,EACnC,sCAAsC,EACtC,mCAAmC,EACnC,0CAA0C,EAC1C,yCAAyC,EACzC,gDAAgD,EAChD,8BAA8B,EAC9B,iCAAiC,EACjC,2BAA2B,EAC3B,gCAAgC,EAChC,0CAA0C,GAC3C,MAAM,gBAAgB,CAAC;AAExB,sCAAsC;AACtC,kJAAkJ;AAClJ,MAAM,CAAC,MAAM,kBAAkB,GAAG,6CAA6C,CAAC;AAShF;;GAEG;AACH,MAAe,qBAAqB;IAKlC,YAAY,KAAa;QACvB,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC;IAC7B,CAAC;IAID,MAAM,CAAC,IAAqB;QAC1B,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,IAAI,WAAW,CACnB,gCAAgC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,GAAG,aAAa,CACpE,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,KAAK,IAAI,CAAC,aAAa,EAAE,CAAC;YACpC,MAAM,IAAI,WAAW,CACnB,iBAAiB,IAAI,CAAC,IAAI,kBAAkB;gBAC5C,SAAS,QAAQ,gBAAgB,IAAI,CAAC,aAAa,IAAI,CACxD,CAAC;QACJ,CAAC;IACH,CAAC;CACF;AAED;;;GAGG;AACH,MAAe,qBAAsB,SAAQ,qBAAqB;CAAG;AAErE,+EAA+E;AAC/E,4EAA4E;AAC5E,+EAA+E;AAE/E;;;GAGG;AACH,MAAM,OAAO,UAAW,SAAQ,qBAAqB;IAArD;;QACW,QAAG,GAAG,8BAA8B,CAAC;QACrC,SAAI,GAAG,YAAY,CAAC;IAK/B,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACxC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,qBAAsB,SAAQ,qBAAqB;IAAhE;;QACW,QAAG,GAAG,qCAAqC,CAAC;QAC5C,SAAI,GAAG,uBAAuB,CAAC;IAK1C,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,wBAAwB,EAAE,eAAe,CAAC;IACxD,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,iBAAkB,SAAQ,qBAAqB;IAA5D;;QACW,QAAG,GAAG,iCAAiC,CAAC;QACxC,SAAI,GAAG,mBAAmB,CAAC;IAKtC,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,oBAAoB,EAAE,WAAW,CAAC;IAChD,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,kBAAmB,SAAQ,qBAAqB;IAA7D;;QACW,QAAG,GAAG,kCAAkC,CAAC;QACzC,SAAI,GAAG,oBAAoB,CAAC;IAKvC,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,qBAAqB,EAAE,YAAY,CAAC;IAClD,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,wBAAyB,SAAQ,qBAAqB;IAAnE;;QACW,QAAG,GAAG,wCAAwC,CAAC;QAC/C,SAAI,GAAG,0BAA0B,CAAC;IAK7C,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,2BAA2B,EAAE,kBAAkB,CAAC;IAC9D,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,iBAAkB,SAAQ,qBAAqB;IAA5D;;QACW,QAAG,GAAG,iCAAiC,CAAC;QACxC,SAAI,GAAG,mBAAmB,CAAC;IAKtC,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,oBAAoB,EAAE,WAAW,CAAC;IAChD,CAAC;CACF;AAED,+EAA+E;AAC/E,6EAA6E;AAC7E,+EAA+E;AAE/E;;;GAGG;AACH,MAAM,OAAO,YAAa,SAAQ,qBAAqB;IAAvD;;QACW,QAAG,GAAG,8BAA8B,CAAC;QACrC,SAAI,GAAG,cAAc,CAAC;IAKjC,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACxC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,kBAAmB,SAAQ,qBAAqB;IAA7D;;QACW,QAAG,GAAG,8BAA8B,CAAC;QACrC,SAAI,GAAG,oBAAoB,CAAC;IAKvC,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,iBAAiB,EAAE,cAAc,CAAC;IAChD,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,qBAAsB,SAAQ,qBAAqB;IAAhE;;QACW,QAAG,GAAG,iCAAiC,CAAC;QACxC,SAAI,GAAG,uBAAuB,CAAC;IAK1C,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,oBAAoB,EAAE,iBAAiB,CAAC;IACtD,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,qBAAsB,SAAQ,qBAAqB;IAAhE;;QACW,QAAG,GAAG,gCAAgC,CAAC;QACvC,SAAI,GAAG,uBAAuB,CAAC;IAK1C,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,oBAAoB,EAAE,iBAAiB,CAAC;IACtD,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,uBAAwB,SAAQ,qBAAqB;IAAlE;;QACW,QAAG,GAAG,mCAAmC,CAAC;QAC1C,SAAI,GAAG,yBAAyB,CAAC;IAK5C,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,sBAAsB,EAAE,mBAAmB,CAAC;IAC1D,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,0BAA2B,SAAQ,qBAAqB;IAArE;;QACW,QAAG,GAAG,sCAAsC,CAAC;QAC7C,SAAI,GAAG,4BAA4B,CAAC;IAK/C,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,yBAAyB,EAAE,sBAAsB,CAAC;IAChE,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,uBAAwB,SAAQ,qBAAqB;IAAlE;;QACW,QAAG,GAAG,mCAAmC,CAAC;QAC1C,SAAI,GAAG,yBAAyB,CAAC;IAK5C,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,sBAAsB,EAAE,mBAAmB,CAAC;IAC1D,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,8BAA+B,SAAQ,qBAAqB;IAAzE;;QACW,QAAG,GAAG,0CAA0C,CAAC;QACjD,SAAI,GAAG,gCAAgC,CAAC;IAKnD,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,6BAA6B,EAAE,0BAA0B,CAAC;IACxE,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,4BAA6B,SAAQ,qBAAqB;IAAvE;;QACW,QAAG,GAAG,yCAAyC,CAAC;QAChD,SAAI,GAAG,8BAA8B,CAAC;IAKjD,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,2BAA2B,EAAE,wBAAwB,CAAC;IACpE,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,mCAAoC,SAAQ,qBAAqB;IAA9E;;QACW,QAAG,GAAG,gDAAgD,CAAC;QACvD,SAAI,GAAG,qCAAqC,CAAC;IAKxD,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,kCAAkC,EAAE,+BAA+B,CAAC;IAClF,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,kBAAmB,SAAQ,qBAAqB;IAA7D;;QACW,QAAG,GAAG,8BAA8B,CAAC;QACrC,SAAI,GAAG,oBAAoB,CAAC;IAKvC,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,iBAAiB,EAAE,cAAc,CAAC;IAChD,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,qBAAsB,SAAQ,qBAAqB;IAAhE;;QACW,QAAG,GAAG,iCAAiC,CAAC;QACxC,SAAI,GAAG,uBAAuB,CAAC;IAK1C,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,oBAAoB,EAAE,iBAAiB,CAAC;IACtD,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,gBAAiB,SAAQ,qBAAqB;IAA3D;;QACW,QAAG,GAAG,2BAA2B,CAAC;QAClC,SAAI,GAAG,kBAAkB,CAAC;IAKrC,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,eAAe,EAAE,YAAY,CAAC;IAC5C,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,oBAAqB,SAAQ,qBAAqB;IAA/D;;QACW,QAAG,GAAG,gCAAgC,CAAC;QACvC,SAAI,GAAG,sBAAsB,CAAC;IAKzC,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,mBAAmB,EAAE,gBAAgB,CAAC;IACpD,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,8BAA+B,SAAQ,qBAAqB;IAAzE;;QACW,QAAG,GAAG,0CAA0C,CAAC;QACjD,SAAI,GAAG,gCAAgC,CAAC;IAKnD,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,6BAA6B,EAAE,0BAA0B,CAAC;IACxE,CAAC;CACF;AAED,+EAA+E;AAC/E,qBAAqB;AACrB,+EAA+E;AAE/E;;;GAGG;AACH,MAAM,OAAO,KAAK;IAGhB,YAAY,QAA8B;QACxC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;IAED,MAAM,CAAC,IAAqB;QAC1B,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClC,IAAI,CAAC;gBACH,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBACnB,OAAO;YACT,CAAC;YAAC,MAAM,CAAC;gBACP,0BAA0B;YAC5B,CAAC;QACH,CAAC;QACD,MAAM,IAAI,WAAW,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,MAAM,qBAAqB,CAAC,CAAC;IAC3E,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,KAAK;IAGhB,YAAY,QAA8B;QACxC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;IAED,MAAM,CAAC,IAAqB;QAC1B,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,WAAW,CAAC,6BAA6B,CAAC,CAAC;QACvD,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;CACF;AAED,+EAA+E;AAC/E,kBAAkB;AAClB,+EAA+E;AAE/E;;;;;;;GAOG;AACH,MAAM,OAAO,QAAQ;IAInB,YAAY,OAA8C;QACxD,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7E,CAAC;IAED,MAAM,CAAC,IAAqB;QAC1B,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACjC,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC;QACtC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,WAAW,CAAC,+DAA+D,CAAC,CAAC;QACzF,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAElC,yBAAyB;QACzB,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YACtB,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACjC,CAAC;QAED,UAAU;QACV,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;YACf,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;QAED,kCAAkC;QAClC,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAC;QAC5D,IAAI,SAAS,EAAE,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACzB,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,WAAW,CACnB,mCAAmC,IAAI,CAAC,QAAQ,kBAAkB,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACnG,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EACL,iCAAiC,EACjC,8BAA8B,EAC9B,iCAAiC,EACjC,8BAA8B,EAC9B,2BAA2B,EAC3B,8BAA8B,EAC9B,8BAA8B,EAC9B,kCAAkC,EAClC,iCAAiC,EACjC,wCAAwC,EACxC,iCAAiC,EACjC,qCAAqC,EACrC,uBAAuB,EACvB,gCAAgC,EAChC,gCAAgC,EAChC,sCAAsC,EACtC,0CAA0C,EAC1C,gDAAgD,EAChD,yCAAyC,EACzC,mCAAmC,EACnC,mCAAmC,EACnC,0CAA0C,GAE3C,MAAM,gBAAgB,CAAC;AAExB,sCAAsC;AACtC,kJAAkJ;AAClJ,MAAM,CAAC,MAAM,kBAAkB,GAAG,6CAA6C,CAAC;AAShF;;GAEG;AACH,MAAe,qBAAqB;IAKlC,YAAY,KAAa;QACvB,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC;IAC7B,CAAC;IAID,MAAM,CAAC,IAAqB;QAC1B,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,IAAI,WAAW,CACnB,gCAAgC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,GAAG,aAAa,CACpE,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,KAAK,IAAI,CAAC,aAAa,EAAE,CAAC;YACpC,MAAM,IAAI,WAAW,CACnB,iBAAiB,IAAI,CAAC,IAAI,kBAAkB;gBAC5C,SAAS,QAAQ,gBAAgB,IAAI,CAAC,aAAa,IAAI,CACxD,CAAC;QACJ,CAAC;IACH,CAAC;CACF;AAED;;;GAGG;AACH,MAAe,qBAAsB,SAAQ,qBAAqB;CAAG;AAErE,+EAA+E;AAC/E,4EAA4E;AAC5E,+EAA+E;AAE/E;;;GAGG;AACH,MAAM,OAAO,UAAW,SAAQ,qBAAqB;IAArD;;QACW,QAAG,GAAG,8BAA8B,CAAC;QACrC,SAAI,GAAG,YAAY,CAAC;IAK/B,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACxC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,qBAAsB,SAAQ,qBAAqB;IAAhE;;QACW,QAAG,GAAG,qCAAqC,CAAC;QAC5C,SAAI,GAAG,uBAAuB,CAAC;IAK1C,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,wBAAwB,EAAE,eAAe,CAAC;IACxD,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,iBAAkB,SAAQ,qBAAqB;IAA5D;;QACW,QAAG,GAAG,iCAAiC,CAAC;QACxC,SAAI,GAAG,mBAAmB,CAAC;IAKtC,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,oBAAoB,EAAE,WAAW,CAAC;IAChD,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,kBAAmB,SAAQ,qBAAqB;IAA7D;;QACW,QAAG,GAAG,kCAAkC,CAAC;QACzC,SAAI,GAAG,oBAAoB,CAAC;IAKvC,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,qBAAqB,EAAE,YAAY,CAAC;IAClD,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,wBAAyB,SAAQ,qBAAqB;IAAnE;;QACW,QAAG,GAAG,wCAAwC,CAAC;QAC/C,SAAI,GAAG,0BAA0B,CAAC;IAK7C,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,2BAA2B,EAAE,kBAAkB,CAAC;IAC9D,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,iBAAkB,SAAQ,qBAAqB;IAA5D;;QACW,QAAG,GAAG,iCAAiC,CAAC;QACxC,SAAI,GAAG,mBAAmB,CAAC;IAKtC,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,oBAAoB,EAAE,WAAW,CAAC;IAChD,CAAC;CACF;AAED,+EAA+E;AAC/E,6EAA6E;AAC7E,+EAA+E;AAE/E;;;GAGG;AACH,MAAM,OAAO,YAAa,SAAQ,qBAAqB;IAAvD;;QACW,QAAG,GAAG,8BAA8B,CAAC;QACrC,SAAI,GAAG,cAAc,CAAC;IAKjC,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACxC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,kBAAmB,SAAQ,qBAAqB;IAA7D;;QACW,QAAG,GAAG,8BAA8B,CAAC;QACrC,SAAI,GAAG,oBAAoB,CAAC;IAKvC,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,iBAAiB,EAAE,cAAc,CAAC;IAChD,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,qBAAsB,SAAQ,qBAAqB;IAAhE;;QACW,QAAG,GAAG,iCAAiC,CAAC;QACxC,SAAI,GAAG,uBAAuB,CAAC;IAK1C,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,oBAAoB,EAAE,iBAAiB,CAAC;IACtD,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,qBAAsB,SAAQ,qBAAqB;IAAhE;;QACW,QAAG,GAAG,gCAAgC,CAAC;QACvC,SAAI,GAAG,uBAAuB,CAAC;IAK1C,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,oBAAoB,EAAE,iBAAiB,CAAC;IACtD,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,uBAAwB,SAAQ,qBAAqB;IAAlE;;QACW,QAAG,GAAG,mCAAmC,CAAC;QAC1C,SAAI,GAAG,yBAAyB,CAAC;IAK5C,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,sBAAsB,EAAE,mBAAmB,CAAC;IAC1D,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,0BAA2B,SAAQ,qBAAqB;IAArE;;QACW,QAAG,GAAG,sCAAsC,CAAC;QAC7C,SAAI,GAAG,4BAA4B,CAAC;IAK/C,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,yBAAyB,EAAE,sBAAsB,CAAC;IAChE,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,uBAAwB,SAAQ,qBAAqB;IAAlE;;QACW,QAAG,GAAG,mCAAmC,CAAC;QAC1C,SAAI,GAAG,yBAAyB,CAAC;IAK5C,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,sBAAsB,EAAE,mBAAmB,CAAC;IAC1D,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,8BAA+B,SAAQ,qBAAqB;IAAzE;;QACW,QAAG,GAAG,0CAA0C,CAAC;QACjD,SAAI,GAAG,gCAAgC,CAAC;IAKnD,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,6BAA6B,EAAE,0BAA0B,CAAC;IACxE,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,4BAA6B,SAAQ,qBAAqB;IAAvE;;QACW,QAAG,GAAG,yCAAyC,CAAC;QAChD,SAAI,GAAG,8BAA8B,CAAC;IAKjD,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,2BAA2B,EAAE,wBAAwB,CAAC;IACpE,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,mCAAoC,SAAQ,qBAAqB;IAA9E;;QACW,QAAG,GAAG,gDAAgD,CAAC;QACvD,SAAI,GAAG,qCAAqC,CAAC;IAKxD,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,kCAAkC,EAAE,+BAA+B,CAAC;IAClF,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,kBAAmB,SAAQ,qBAAqB;IAA7D;;QACW,QAAG,GAAG,8BAA8B,CAAC;QACrC,SAAI,GAAG,oBAAoB,CAAC;IAKvC,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,iBAAiB,EAAE,cAAc,CAAC;IAChD,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,qBAAsB,SAAQ,qBAAqB;IAAhE;;QACW,QAAG,GAAG,iCAAiC,CAAC;QACxC,SAAI,GAAG,uBAAuB,CAAC;IAK1C,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,oBAAoB,EAAE,iBAAiB,CAAC;IACtD,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,gBAAiB,SAAQ,qBAAqB;IAA3D;;QACW,QAAG,GAAG,2BAA2B,CAAC;QAClC,SAAI,GAAG,kBAAkB,CAAC;IAKrC,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,eAAe,EAAE,YAAY,CAAC;IAC5C,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,oBAAqB,SAAQ,qBAAqB;IAA/D;;QACW,QAAG,GAAG,gCAAgC,CAAC;QACvC,SAAI,GAAG,sBAAsB,CAAC;IAKzC,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,mBAAmB,EAAE,gBAAgB,CAAC;IACpD,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,8BAA+B,SAAQ,qBAAqB;IAAzE;;QACW,QAAG,GAAG,0CAA0C,CAAC;QACjD,SAAI,GAAG,gCAAgC,CAAC;IAKnD,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,6BAA6B,EAAE,0BAA0B,CAAC;IACxE,CAAC;CACF;AAED,+EAA+E;AAC/E,qBAAqB;AACrB,+EAA+E;AAE/E;;;GAGG;AACH,MAAM,OAAO,KAAK;IAGhB,YAAY,QAA8B;QACxC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAqB;QAChC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClC,IAAI,CAAC;gBACH,MAAM,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBACzB,OAAO;YACT,CAAC;YAAC,MAAM,CAAC;gBACP,0BAA0B;YAC5B,CAAC;QACH,CAAC;QACD,MAAM,IAAI,WAAW,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,MAAM,qBAAqB,CAAC,CAAC;IAC3E,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,KAAK;IAGhB,YAAY,QAA8B;QACxC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAqB;QAChC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,WAAW,CAAC,6BAA6B,CAAC,CAAC;QACvD,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClC,MAAM,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;CACF;AAED,+EAA+E;AAC/E,kBAAkB;AAClB,+EAA+E;AAE/E;;;;;;;GAOG;AACH,MAAM,OAAO,QAAQ;IAInB,YAAY,OAA8C;QACxD,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7E,CAAC;IAED,MAAM,CAAC,IAAqB;QAC1B,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACjC,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC;QACtC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,WAAW,CAAC,+DAA+D,CAAC,CAAC;QACzF,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAElC,yBAAyB;QACzB,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YACtB,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACjC,CAAC;QAED,UAAU;QACV,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;YACf,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;QAED,kCAAkC;QAClC,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAC;QAC5D,IAAI,SAAS,EAAE,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACzB,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,WAAW,CACnB,mCAAmC,IAAI,CAAC,QAAQ,kBAAkB,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACnG,CAAC;QACJ,CAAC;IACH,CAAC;CACF","sourcesContent":["/**\n * Adapted from sigstore-python sigstore/verify/policy.py\n *\n * This module provides policy verification for checking certificate identity claims.\n * Each policy class verifies a specific X.509 extension value against an expected value.\n *\n * There are two types of extension formats:\n * - V1 extensions: Raw OCTET STRING containing the value directly\n * - V2 extensions: DER-encoded UTF8String (RFC 5280 compliant)\n *\n * Policies can be combined using:\n * - AllOf: All child policies must pass (logical AND)\n * - AnyOf: At least one child policy must pass (logical OR)\n * - Identity: Verifies SAN with optional issuer check\n */\n\nimport { PolicyError } from \"./errors.js\";\nimport {\n  EXTENSION_OID_BUILD_CONFIG_DIGEST,\n  EXTENSION_OID_BUILD_CONFIG_URI,\n  EXTENSION_OID_BUILD_SIGNER_DIGEST,\n  EXTENSION_OID_BUILD_SIGNER_URI,\n  EXTENSION_OID_BUILD_TRIGGER,\n  EXTENSION_OID_FULCIO_ISSUER_V1,\n  EXTENSION_OID_FULCIO_ISSUER_V2,\n  EXTENSION_OID_GITHUB_WORKFLOW_NAME,\n  EXTENSION_OID_GITHUB_WORKFLOW_REF,\n  EXTENSION_OID_GITHUB_WORKFLOW_REPOSITORY,\n  EXTENSION_OID_GITHUB_WORKFLOW_SHA,\n  EXTENSION_OID_GITHUB_WORKFLOW_TRIGGER,\n  EXTENSION_OID_OTHERNAME,\n  EXTENSION_OID_RUN_INVOCATION_URI,\n  EXTENSION_OID_RUNNER_ENVIRONMENT,\n  EXTENSION_OID_SOURCE_REPOSITORY_DIGEST,\n  EXTENSION_OID_SOURCE_REPOSITORY_IDENTIFIER,\n  EXTENSION_OID_SOURCE_REPOSITORY_OWNER_IDENTIFIER,\n  EXTENSION_OID_SOURCE_REPOSITORY_OWNER_URI,\n  EXTENSION_OID_SOURCE_REPOSITORY_REF,\n  EXTENSION_OID_SOURCE_REPOSITORY_URI,\n  EXTENSION_OID_SOURCE_REPOSITORY_VISIBILITY,\n  X509Certificate,\n} from \"./x509/cert.js\";\n\n// Standard GitHub Actions OIDC issuer\n// https://docs.github.com/en/actions/security-for-github-actions/security-hardening-your-deployments/about-security-hardening-with-openid-connect\nexport const GITHUB_OIDC_ISSUER = \"https://token.actions.githubusercontent.com\";\n\n/**\n * Interface that all verification policies conform to.\n */\nexport interface VerificationPolicy {\n  verify(cert: X509Certificate): void | Promise<void>;\n}\n\n/**\n * Base class for V1 extension policies (raw OCTET STRING value).\n */\nabstract class SingleX509ExtPolicyV1 implements VerificationPolicy {\n  abstract readonly oid: string;\n  abstract readonly name: string;\n  protected readonly expectedValue: string;\n\n  constructor(value: string) {\n    this.expectedValue = value;\n  }\n\n  protected abstract getExtensionValue(cert: X509Certificate): string | undefined;\n\n  verify(cert: X509Certificate): void {\n    const extValue = this.getExtensionValue(cert);\n    if (extValue === undefined) {\n      throw new PolicyError(\n        `Certificate does not contain ${this.name} (${this.oid}) extension`\n      );\n    }\n    if (extValue !== this.expectedValue) {\n      throw new PolicyError(\n        `Certificate's ${this.name} does not match ` +\n        `(got '${extValue}', expected '${this.expectedValue}')`\n      );\n    }\n  }\n}\n\n/**\n * Base class for V2 extension policies (DER-encoded UTF8String).\n * Uses the same verify logic as V1 since our extension classes handle the parsing.\n */\nabstract class SingleX509ExtPolicyV2 extends SingleX509ExtPolicyV1 {}\n\n// ============================================================================\n// V1 Extension Policies (OID 1.3.6.1.4.1.57264.1.1 - 1.3.6.1.4.1.57264.1.6)\n// ============================================================================\n\n/**\n * Verifies the certificate's OIDC issuer (V1 format).\n * OID: 1.3.6.1.4.1.57264.1.1\n */\nexport class OIDCIssuer extends SingleX509ExtPolicyV1 {\n  readonly oid = EXTENSION_OID_FULCIO_ISSUER_V1;\n  readonly name = \"OIDCIssuer\";\n\n  protected getExtensionValue(cert: X509Certificate): string | undefined {\n    return cert.extFulcioIssuerV1?.issuer;\n  }\n}\n\n/**\n * Verifies the certificate's GitHub Actions workflow trigger.\n * OID: 1.3.6.1.4.1.57264.1.2\n */\nexport class GitHubWorkflowTrigger extends SingleX509ExtPolicyV1 {\n  readonly oid = EXTENSION_OID_GITHUB_WORKFLOW_TRIGGER;\n  readonly name = \"GitHubWorkflowTrigger\";\n\n  protected getExtensionValue(cert: X509Certificate): string | undefined {\n    return cert.extGitHubWorkflowTrigger?.workflowTrigger;\n  }\n}\n\n/**\n * Verifies the certificate's GitHub Actions workflow commit SHA.\n * OID: 1.3.6.1.4.1.57264.1.3\n */\nexport class GitHubWorkflowSHA extends SingleX509ExtPolicyV1 {\n  readonly oid = EXTENSION_OID_GITHUB_WORKFLOW_SHA;\n  readonly name = \"GitHubWorkflowSHA\";\n\n  protected getExtensionValue(cert: X509Certificate): string | undefined {\n    return cert.extGitHubWorkflowSHA?.workflowSHA;\n  }\n}\n\n/**\n * Verifies the certificate's GitHub Actions workflow name.\n * OID: 1.3.6.1.4.1.57264.1.4\n */\nexport class GitHubWorkflowName extends SingleX509ExtPolicyV1 {\n  readonly oid = EXTENSION_OID_GITHUB_WORKFLOW_NAME;\n  readonly name = \"GitHubWorkflowName\";\n\n  protected getExtensionValue(cert: X509Certificate): string | undefined {\n    return cert.extGitHubWorkflowName?.workflowName;\n  }\n}\n\n/**\n * Verifies the certificate's GitHub Actions workflow repository.\n * OID: 1.3.6.1.4.1.57264.1.5\n */\nexport class GitHubWorkflowRepository extends SingleX509ExtPolicyV1 {\n  readonly oid = EXTENSION_OID_GITHUB_WORKFLOW_REPOSITORY;\n  readonly name = \"GitHubWorkflowRepository\";\n\n  protected getExtensionValue(cert: X509Certificate): string | undefined {\n    return cert.extGitHubWorkflowRepository?.workflowRepository;\n  }\n}\n\n/**\n * Verifies the certificate's GitHub Actions workflow ref.\n * OID: 1.3.6.1.4.1.57264.1.6\n */\nexport class GitHubWorkflowRef extends SingleX509ExtPolicyV1 {\n  readonly oid = EXTENSION_OID_GITHUB_WORKFLOW_REF;\n  readonly name = \"GitHubWorkflowRef\";\n\n  protected getExtensionValue(cert: X509Certificate): string | undefined {\n    return cert.extGitHubWorkflowRef?.workflowRef;\n  }\n}\n\n// ============================================================================\n// V2 Extension Policies (OID 1.3.6.1.4.1.57264.1.8 - 1.3.6.1.4.1.57264.1.22)\n// ============================================================================\n\n/**\n * Verifies the certificate's OIDC issuer (V2 format, DER-encoded).\n * OID: 1.3.6.1.4.1.57264.1.8\n */\nexport class OIDCIssuerV2 extends SingleX509ExtPolicyV2 {\n  readonly oid = EXTENSION_OID_FULCIO_ISSUER_V2;\n  readonly name = \"OIDCIssuerV2\";\n\n  protected getExtensionValue(cert: X509Certificate): string | undefined {\n    return cert.extFulcioIssuerV2?.issuer;\n  }\n}\n\n/**\n * Verifies the certificate's Build Signer URI.\n * OID: 1.3.6.1.4.1.57264.1.9\n */\nexport class OIDCBuildSignerURI extends SingleX509ExtPolicyV2 {\n  readonly oid = EXTENSION_OID_BUILD_SIGNER_URI;\n  readonly name = \"OIDCBuildSignerURI\";\n\n  protected getExtensionValue(cert: X509Certificate): string | undefined {\n    return cert.extBuildSignerURI?.buildSignerURI;\n  }\n}\n\n/**\n * Verifies the certificate's Build Signer Digest.\n * OID: 1.3.6.1.4.1.57264.1.10\n */\nexport class OIDCBuildSignerDigest extends SingleX509ExtPolicyV2 {\n  readonly oid = EXTENSION_OID_BUILD_SIGNER_DIGEST;\n  readonly name = \"OIDCBuildSignerDigest\";\n\n  protected getExtensionValue(cert: X509Certificate): string | undefined {\n    return cert.extBuildSignerDigest?.buildSignerDigest;\n  }\n}\n\n/**\n * Verifies the certificate's Runner Environment.\n * OID: 1.3.6.1.4.1.57264.1.11\n */\nexport class OIDCRunnerEnvironment extends SingleX509ExtPolicyV2 {\n  readonly oid = EXTENSION_OID_RUNNER_ENVIRONMENT;\n  readonly name = \"OIDCRunnerEnvironment\";\n\n  protected getExtensionValue(cert: X509Certificate): string | undefined {\n    return cert.extRunnerEnvironment?.runnerEnvironment;\n  }\n}\n\n/**\n * Verifies the certificate's Source Repository URI.\n * OID: 1.3.6.1.4.1.57264.1.12\n */\nexport class OIDCSourceRepositoryURI extends SingleX509ExtPolicyV2 {\n  readonly oid = EXTENSION_OID_SOURCE_REPOSITORY_URI;\n  readonly name = \"OIDCSourceRepositoryURI\";\n\n  protected getExtensionValue(cert: X509Certificate): string | undefined {\n    return cert.extSourceRepositoryURI?.sourceRepositoryURI;\n  }\n}\n\n/**\n * Verifies the certificate's Source Repository Digest.\n * OID: 1.3.6.1.4.1.57264.1.13\n */\nexport class OIDCSourceRepositoryDigest extends SingleX509ExtPolicyV2 {\n  readonly oid = EXTENSION_OID_SOURCE_REPOSITORY_DIGEST;\n  readonly name = \"OIDCSourceRepositoryDigest\";\n\n  protected getExtensionValue(cert: X509Certificate): string | undefined {\n    return cert.extSourceRepositoryDigest?.sourceRepositoryDigest;\n  }\n}\n\n/**\n * Verifies the certificate's Source Repository Ref.\n * OID: 1.3.6.1.4.1.57264.1.14\n */\nexport class OIDCSourceRepositoryRef extends SingleX509ExtPolicyV2 {\n  readonly oid = EXTENSION_OID_SOURCE_REPOSITORY_REF;\n  readonly name = \"OIDCSourceRepositoryRef\";\n\n  protected getExtensionValue(cert: X509Certificate): string | undefined {\n    return cert.extSourceRepositoryRef?.sourceRepositoryRef;\n  }\n}\n\n/**\n * Verifies the certificate's Source Repository Identifier.\n * OID: 1.3.6.1.4.1.57264.1.15\n */\nexport class OIDCSourceRepositoryIdentifier extends SingleX509ExtPolicyV2 {\n  readonly oid = EXTENSION_OID_SOURCE_REPOSITORY_IDENTIFIER;\n  readonly name = \"OIDCSourceRepositoryIdentifier\";\n\n  protected getExtensionValue(cert: X509Certificate): string | undefined {\n    return cert.extSourceRepositoryIdentifier?.sourceRepositoryIdentifier;\n  }\n}\n\n/**\n * Verifies the certificate's Source Repository Owner URI.\n * OID: 1.3.6.1.4.1.57264.1.16\n */\nexport class OIDCSourceRepositoryOwnerURI extends SingleX509ExtPolicyV2 {\n  readonly oid = EXTENSION_OID_SOURCE_REPOSITORY_OWNER_URI;\n  readonly name = \"OIDCSourceRepositoryOwnerURI\";\n\n  protected getExtensionValue(cert: X509Certificate): string | undefined {\n    return cert.extSourceRepositoryOwnerURI?.sourceRepositoryOwnerURI;\n  }\n}\n\n/**\n * Verifies the certificate's Source Repository Owner Identifier.\n * OID: 1.3.6.1.4.1.57264.1.17\n */\nexport class OIDCSourceRepositoryOwnerIdentifier extends SingleX509ExtPolicyV2 {\n  readonly oid = EXTENSION_OID_SOURCE_REPOSITORY_OWNER_IDENTIFIER;\n  readonly name = \"OIDCSourceRepositoryOwnerIdentifier\";\n\n  protected getExtensionValue(cert: X509Certificate): string | undefined {\n    return cert.extSourceRepositoryOwnerIdentifier?.sourceRepositoryOwnerIdentifier;\n  }\n}\n\n/**\n * Verifies the certificate's Build Config URI.\n * OID: 1.3.6.1.4.1.57264.1.18\n */\nexport class OIDCBuildConfigURI extends SingleX509ExtPolicyV2 {\n  readonly oid = EXTENSION_OID_BUILD_CONFIG_URI;\n  readonly name = \"OIDCBuildConfigURI\";\n\n  protected getExtensionValue(cert: X509Certificate): string | undefined {\n    return cert.extBuildConfigURI?.buildConfigURI;\n  }\n}\n\n/**\n * Verifies the certificate's Build Config Digest.\n * OID: 1.3.6.1.4.1.57264.1.19\n */\nexport class OIDCBuildConfigDigest extends SingleX509ExtPolicyV2 {\n  readonly oid = EXTENSION_OID_BUILD_CONFIG_DIGEST;\n  readonly name = \"OIDCBuildConfigDigest\";\n\n  protected getExtensionValue(cert: X509Certificate): string | undefined {\n    return cert.extBuildConfigDigest?.buildConfigDigest;\n  }\n}\n\n/**\n * Verifies the certificate's Build Trigger.\n * OID: 1.3.6.1.4.1.57264.1.20\n */\nexport class OIDCBuildTrigger extends SingleX509ExtPolicyV2 {\n  readonly oid = EXTENSION_OID_BUILD_TRIGGER;\n  readonly name = \"OIDCBuildTrigger\";\n\n  protected getExtensionValue(cert: X509Certificate): string | undefined {\n    return cert.extBuildTrigger?.buildTrigger;\n  }\n}\n\n/**\n * Verifies the certificate's Run Invocation URI.\n * OID: 1.3.6.1.4.1.57264.1.21\n */\nexport class OIDCRunInvocationURI extends SingleX509ExtPolicyV2 {\n  readonly oid = EXTENSION_OID_RUN_INVOCATION_URI;\n  readonly name = \"OIDCRunInvocationURI\";\n\n  protected getExtensionValue(cert: X509Certificate): string | undefined {\n    return cert.extRunInvocationURI?.runInvocationURI;\n  }\n}\n\n/**\n * Verifies the certificate's Source Repository Visibility at signing.\n * OID: 1.3.6.1.4.1.57264.1.22\n */\nexport class OIDCSourceRepositoryVisibility extends SingleX509ExtPolicyV2 {\n  readonly oid = EXTENSION_OID_SOURCE_REPOSITORY_VISIBILITY;\n  readonly name = \"OIDCSourceRepositoryVisibility\";\n\n  protected getExtensionValue(cert: X509Certificate): string | undefined {\n    return cert.extSourceRepositoryVisibility?.sourceRepositoryVisibility;\n  }\n}\n\n// ============================================================================\n// Policy Combinators\n// ============================================================================\n\n/**\n * The \"any of\" policy, corresponding to a logical OR between child policies.\n * An empty list of child policies is considered trivially invalid.\n */\nexport class AnyOf implements VerificationPolicy {\n  private children: VerificationPolicy[];\n\n  constructor(children: VerificationPolicy[]) {\n    this.children = children;\n  }\n\n  async verify(cert: X509Certificate): Promise<void> {\n    for (const child of this.children) {\n      try {\n        await child.verify(cert);\n        return;\n      } catch {\n        // Continue to next policy\n      }\n    }\n    throw new PolicyError(`0 of ${this.children.length} policies succeeded`);\n  }\n}\n\n/**\n * The \"all of\" policy, corresponding to a logical AND between child policies.\n * An empty list of child policies is considered trivially invalid.\n */\nexport class AllOf implements VerificationPolicy {\n  private children: VerificationPolicy[];\n\n  constructor(children: VerificationPolicy[]) {\n    this.children = children;\n  }\n\n  async verify(cert: X509Certificate): Promise<void> {\n    if (this.children.length < 1) {\n      throw new PolicyError(\"no child policies to verify\");\n    }\n    for (const child of this.children) {\n      await child.verify(cert);\n    }\n  }\n}\n\n// ============================================================================\n// Identity Policy\n// ============================================================================\n\n/**\n * Verifies the certificate's \"identity\", corresponding to the X.509v3 SAN.\n *\n * Identities can be verified modulo an OIDC issuer, to prevent an unexpected\n * issuer from offering a particular identity.\n *\n * Supported SAN types include emails, URIs, and Sigstore-specific \"other names\".\n */\nexport class Identity implements VerificationPolicy {\n  private identity: string;\n  private issuerPolicy: OIDCIssuer | null;\n\n  constructor(options: { identity: string; issuer?: string }) {\n    this.identity = options.identity;\n    this.issuerPolicy = options.issuer ? new OIDCIssuer(options.issuer) : null;\n  }\n\n  verify(cert: X509Certificate): void {\n    if (this.issuerPolicy) {\n      this.issuerPolicy.verify(cert);\n    }\n\n    const sanExt = cert.extSubjectAltName;\n    if (!sanExt) {\n      throw new PolicyError(\"Certificate does not contain SubjectAlternativeName extension\");\n    }\n\n    const allSans = new Set<string>();\n\n    // Add email (rfc822Name)\n    if (sanExt.rfc822Name) {\n      allSans.add(sanExt.rfc822Name);\n    }\n\n    // Add URI\n    if (sanExt.uri) {\n      allSans.add(sanExt.uri);\n    }\n\n    // Add Sigstore-specific otherName\n    const otherName = sanExt.otherName(EXTENSION_OID_OTHERNAME);\n    if (otherName) {\n      allSans.add(otherName);\n    }\n\n    if (!allSans.has(this.identity)) {\n      throw new PolicyError(\n        `Certificate's SANs do not match ${this.identity}; actual SANs: ${Array.from(allSans).join(\", \")}`\n      );\n    }\n  }\n}\n"]}

package/dist/rfc3161/error.d.ts

@@ -1,3 +1,2 @@
 export declare class RFC3161TimestampVerificationError extends Error {
 }
-//# sourceMappingURL=error.d.ts.map

package/dist/rfc3161/error.js.map

@@ -1 +1 @@
-{"version":3,"file":"error.js","sourceRoot":"","sources":["../../src/rfc3161/error.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;EAcE;AACF,MAAM,OAAO,iCAAkC,SAAQ,KAAK;CAAG"}
+{"version":3,"file":"error.js","sourceRoot":"","sources":["../../src/rfc3161/error.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;EAcE;AACF,MAAM,OAAO,iCAAkC,SAAQ,KAAK;CAAG","sourcesContent":["/*\nCopyright 2023 The Sigstore Authors.\n\nLicensed under the Apache License, Version 2.0 (the \"License\");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\n    http://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n*/\nexport class RFC3161TimestampVerificationError extends Error {}\n"]}

package/dist/rfc3161/index.d.ts

@@ -1,2 +1 @@
 export { RFC3161Timestamp } from "./timestamp.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/rfc3161/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/rfc3161/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;EAcE;AAEF,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/rfc3161/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;EAcE;AAEF,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC","sourcesContent":["/*\nCopyright 2023 The Sigstore Authors.\n\nLicensed under the Apache License, Version 2.0 (the \"License\");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\n    http://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n*/\n\nexport { RFC3161Timestamp } from \"./timestamp.js\";\n"]}

package/dist/rfc3161/timestamp.d.ts

@@ -33,4 +33,3 @@ export declare class RFC3161Timestamp {
     private get signatureAlgorithmObj();
     private get signatureValueObj();
 }
-//# sourceMappingURL=timestamp.d.ts.map

package/dist/rfc3161/timestamp.js.map

@@ -1 +1 @@
-{"version":3,"file":"timestamp.js","sourceRoot":"","sources":["../../src/rfc3161/timestamp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;EAcE;AACF,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAC3F,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AACxF,OAAO,EAAE,iCAAiC,EAAE,MAAM,YAAY,CAAC;AAC/D,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAEvC,MAAM,kCAAkC,GAAG,sBAAsB,CAAC;AAClE,MAAM,8BAA8B,GAAG,2BAA2B,CAAC;AACnE,MAAM,4BAA4B,GAAG,sBAAsB,CAAC;AAE5D,MAAM,OAAO,gBAAgB;IAG3B,YAAY,IAAa;QACvB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAEM,MAAM,CAAC,KAAK,CAAC,GAAe;QACjC,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACtC,OAAO,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;IAED,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;IACnD,CAAC;IAED,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;IACrC,CAAC;IAED,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;IACtC,CAAC;IAED,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;IAC9B,CAAC;IAED,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACzC,CAAC;IAED,IAAI,kBAAkB;QACpB,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACzC,CAAC;IAED,IAAI,qBAAqB;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;QAC1D,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,iCAAiC,GAAG,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,kBAAkB;QACpB,MAAM,GAAG,GAAG,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;QACvD,MAAM,IAAI,GAAG,qBAAqB,CAAC,GAAG,CAAC,IAAI,mBAAmB,CAAC,GAAG,CAAC,CAAC;QACpE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,cAAc;QAChB,OAAO,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC;IACtC,CAAC;IAED,IAAI,OAAO;QACT,8CAA8C;QAC9C,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACvD,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,IAAgB,EAAE,SAAoB;QACxD,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC5B,MAAM,IAAI,iCAAiC,CAAC,2BAA2B,CAAC,CAAC;QAC3E,CAAC;QAED,8CAA8C;QAC9C,IAAI,IAAI,CAAC,WAAW,KAAK,kCAAkC,EAAE,CAAC;YAC5D,MAAM,IAAI,iCAAiC,CACzC,2BAA2B,IAAI,CAAC,WAAW,EAAE,CAC9C,CAAC;QACJ,CAAC;QAED,+CAA+C;QAC/C,IAAI,IAAI,CAAC,YAAY,KAAK,8BAA8B,EAAE,CAAC;YACzD,MAAM,IAAI,iCAAiC,CACzC,wCAAwC,IAAI,CAAC,YAAY,EAAE,CAC5D,CAAC;QACJ,CAAC;QAED,yDAAyD;QACzD,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAChC,2DAA2D;QAC3D,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACjC,8DAA8D;QAC9D,MAAM,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;IACxC,CAAC;IAEO,KAAK,CAAC,mBAAmB;QAC/B,iDAAiD;QACjD,MAAM,OAAO,GAAG,IAAI,CAAC,qBAAqB,CAAC;QAE3C,kEAAkE;QAClE,MAAM,WAAW,GAAG,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;YAC/C,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;gBAC9C,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;QAE1E,MAAM,aAAa,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAC9C,WAAW,EACX,IAAI,CAAC,OAAO,CAAC,GAAmB,CACjC,CAAC;QACF,MAAM,cAAc,GAAG,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAE5E,IAAI,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,aAAa,CAAC,EAAE,cAAc,CAAC,EAAE,CAAC;YACpE,MAAM,IAAI,iCAAiC,CACzC,oCAAoC,CACrC,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,eAAe,CAAC,GAAc;QAC1C,gDAAgD;QAChD,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;QAChD,WAAW,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,qCAAqC;QAE5D,MAAM,GAAG,GAAG,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;QACvD,8CAA8C;QAC9C,MAAM,IAAI,GAAG,qBAAqB,CAAC,GAAG,CAAC,IAAI,mBAAmB,CAAC,GAAG,CAAC,CAAC;QAEpE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,iCAAiC,CACzC,wCAAwC,GAAG,EAAE,CAC9C,CAAC;QACJ,CAAC;QAED,8DAA8D;QAC9D,MAAM,QAAQ,GAAG,MAAM,eAAe,CACpC,GAAG,EACH,WAAW,EACX,IAAI,CAAC,cAAc,EACnB,IAAI,CACL,CAAC;QAEF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,iCAAiC,CACzC,+BAA+B,CAChC,CAAC;QACJ,CAAC;IACH,CAAC;IAED,uDAAuD;IACvD,IAAY,gBAAgB;QAC1B,wEAAwE;QACxE,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;IAED,uDAAuD;IACvD,IAAY,iBAAiB;QAC3B,yEAAyE;QACzE,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;IAED,0DAA0D;IAC1D,IAAY,cAAc;QACxB,OAAO,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;IACD,mDAAmD;IACnD,IAAY,aAAa;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CACnD,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAChC,CAAC;QACF,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,iCAAiC,CACzC,gCAAgC,CACjC,CAAC;QACJ,CAAC;QACD,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC;IAED,4DAA4D;IAC5D,IAAY,mBAAmB;QAC7B,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpC,CAAC;IAED,4DAA4D;IAC5D,IAAY,cAAc;QACxB,8DAA8D;QAC9D,MAAM,EAAE,GAAG,IAAI,CAAC,aAAa,CAAC;QAC9B,OAAO,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACrC,CAAC;IAED,qDAAqD;IACrD,IAAY,aAAa;QACvB,6BAA6B;QAC7B,OAAO,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrC,CAAC;IAED,4DAA4D;IAC5D,IAAY,eAAe;QACzB,OAAO,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1C,CAAC;IAED,4DAA4D;IAC5D,IAAY,WAAW;QACrB,OAAO,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1C,CAAC;IAED,4DAA4D;IAC5D,IAAY,cAAc;QACxB,MAAM,WAAW,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CACvD,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAChC,CAAC;QACF,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,iCAAiC,CAAC,yBAAyB,CAAC,CAAC;QACzE,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,4DAA4D;IAC5D,IAAY,yBAAyB;QACnC,MAAM,aAAa,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CACjD,CAAC,GAAG,EAAE,EAAE,CACN,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE;YACvB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,4BAA4B,CACvD,CAAC;QACF,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,iCAAiC,CAAC,wBAAwB,CAAC,CAAC;QACxE,CAAC;QACD,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,4DAA4D;IAC5D,IAAY,YAAY;QACtB,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpC,CAAC;IAED,4DAA4D;IAC5D,IAAY,wBAAwB;QAClC,2DAA2D;QAC3D,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpC,CAAC;IAED,4DAA4D;IAC5D,IAAY,qBAAqB;QAC/B,2DAA2D;QAC3D,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpC,CAAC;IAED,4DAA4D;IAC5D,IAAY,iBAAiB;QAC3B,2DAA2D;QAC3D,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpC,CAAC;CACF"}
+{"version":3,"file":"timestamp.js","sourceRoot":"","sources":["../../src/rfc3161/timestamp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;EAcE;AACF,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAE3F,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AACxF,OAAO,EAAE,iCAAiC,EAAE,MAAM,YAAY,CAAC;AAC/D,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAEvC,MAAM,kCAAkC,GAAG,sBAAsB,CAAC;AAClE,MAAM,8BAA8B,GAAG,2BAA2B,CAAC;AACnE,MAAM,4BAA4B,GAAG,sBAAsB,CAAC;AAE5D,MAAM,OAAO,gBAAgB;IAG3B,YAAY,IAAa;QACvB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAEM,MAAM,CAAC,KAAK,CAAC,GAAe;QACjC,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACtC,OAAO,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;IAED,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;IACnD,CAAC;IAED,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;IACrC,CAAC;IAED,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;IACtC,CAAC;IAED,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;IAC9B,CAAC;IAED,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACzC,CAAC;IAED,IAAI,kBAAkB;QACpB,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACzC,CAAC;IAED,IAAI,qBAAqB;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;QAC1D,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,iCAAiC,GAAG,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,kBAAkB;QACpB,MAAM,GAAG,GAAG,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;QACvD,MAAM,IAAI,GAAG,qBAAqB,CAAC,GAAG,CAAC,IAAI,mBAAmB,CAAC,GAAG,CAAC,CAAC;QACpE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,cAAc;QAChB,OAAO,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC;IACtC,CAAC;IAED,IAAI,OAAO;QACT,8CAA8C;QAC9C,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACvD,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,IAAgB,EAAE,SAAoB;QACxD,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC5B,MAAM,IAAI,iCAAiC,CAAC,2BAA2B,CAAC,CAAC;QAC3E,CAAC;QAED,8CAA8C;QAC9C,IAAI,IAAI,CAAC,WAAW,KAAK,kCAAkC,EAAE,CAAC;YAC5D,MAAM,IAAI,iCAAiC,CACzC,2BAA2B,IAAI,CAAC,WAAW,EAAE,CAC9C,CAAC;QACJ,CAAC;QAED,+CAA+C;QAC/C,IAAI,IAAI,CAAC,YAAY,KAAK,8BAA8B,EAAE,CAAC;YACzD,MAAM,IAAI,iCAAiC,CACzC,wCAAwC,IAAI,CAAC,YAAY,EAAE,CAC5D,CAAC;QACJ,CAAC;QAED,yDAAyD;QACzD,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAChC,2DAA2D;QAC3D,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACjC,8DAA8D;QAC9D,MAAM,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;IACxC,CAAC;IAEO,KAAK,CAAC,mBAAmB;QAC/B,iDAAiD;QACjD,MAAM,OAAO,GAAG,IAAI,CAAC,qBAAqB,CAAC;QAE3C,kEAAkE;QAClE,MAAM,WAAW,GAAG,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;YAC/C,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;gBAC9C,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;QAE1E,MAAM,aAAa,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAC9C,WAAW,EACX,IAAI,CAAC,OAAO,CAAC,GAAmB,CACjC,CAAC;QACF,MAAM,cAAc,GAAG,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAE5E,IAAI,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,aAAa,CAAC,EAAE,cAAc,CAAC,EAAE,CAAC;YACpE,MAAM,IAAI,iCAAiC,CACzC,oCAAoC,CACrC,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,eAAe,CAAC,GAAc;QAC1C,gDAAgD;QAChD,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;QAChD,WAAW,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,qCAAqC;QAE5D,MAAM,GAAG,GAAG,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;QACvD,8CAA8C;QAC9C,MAAM,IAAI,GAAG,qBAAqB,CAAC,GAAG,CAAC,IAAI,mBAAmB,CAAC,GAAG,CAAC,CAAC;QAEpE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,iCAAiC,CACzC,wCAAwC,GAAG,EAAE,CAC9C,CAAC;QACJ,CAAC;QAED,8DAA8D;QAC9D,MAAM,QAAQ,GAAG,MAAM,eAAe,CACpC,GAAG,EACH,WAAW,EACX,IAAI,CAAC,cAAc,EACnB,IAAI,CACL,CAAC;QAEF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,iCAAiC,CACzC,+BAA+B,CAChC,CAAC;QACJ,CAAC;IACH,CAAC;IAED,uDAAuD;IACvD,IAAY,gBAAgB;QAC1B,wEAAwE;QACxE,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;IAED,uDAAuD;IACvD,IAAY,iBAAiB;QAC3B,yEAAyE;QACzE,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;IAED,0DAA0D;IAC1D,IAAY,cAAc;QACxB,OAAO,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;IACD,mDAAmD;IACnD,IAAY,aAAa;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CACnD,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAChC,CAAC;QACF,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,iCAAiC,CACzC,gCAAgC,CACjC,CAAC;QACJ,CAAC;QACD,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC;IAED,4DAA4D;IAC5D,IAAY,mBAAmB;QAC7B,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpC,CAAC;IAED,4DAA4D;IAC5D,IAAY,cAAc;QACxB,8DAA8D;QAC9D,MAAM,EAAE,GAAG,IAAI,CAAC,aAAa,CAAC;QAC9B,OAAO,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACrC,CAAC;IAED,qDAAqD;IACrD,IAAY,aAAa;QACvB,6BAA6B;QAC7B,OAAO,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrC,CAAC;IAED,4DAA4D;IAC5D,IAAY,eAAe;QACzB,OAAO,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1C,CAAC;IAED,4DAA4D;IAC5D,IAAY,WAAW;QACrB,OAAO,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1C,CAAC;IAED,4DAA4D;IAC5D,IAAY,cAAc;QACxB,MAAM,WAAW,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CACvD,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAChC,CAAC;QACF,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,iCAAiC,CAAC,yBAAyB,CAAC,CAAC;QACzE,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,4DAA4D;IAC5D,IAAY,yBAAyB;QACnC,MAAM,aAAa,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CACjD,CAAC,GAAG,EAAE,EAAE,CACN,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE;YACvB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,4BAA4B,CACvD,CAAC;QACF,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,iCAAiC,CAAC,wBAAwB,CAAC,CAAC;QACxE,CAAC;QACD,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,4DAA4D;IAC5D,IAAY,YAAY;QACtB,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpC,CAAC;IAED,4DAA4D;IAC5D,IAAY,wBAAwB;QAClC,2DAA2D;QAC3D,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpC,CAAC;IAED,4DAA4D;IAC5D,IAAY,qBAAqB;QAC/B,2DAA2D;QAC3D,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpC,CAAC;IAED,4DAA4D;IAC5D,IAAY,iBAAiB;QAC3B,2DAA2D;QAC3D,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpC,CAAC;CACF","sourcesContent":["/*\nCopyright 2023 The Sigstore Authors.\n\nLicensed under the Apache License, Version 2.0 (the \"License\");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\n    http://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n*/\nimport { ASN1Obj, uint8ArrayEqual, verifySignature } from \"@freedomofpress/crypto-browser\";\n\nimport { HashAlgorithms } from \"../interfaces.js\";\nimport { ECDSA_SIGNATURE_ALGOS, RSA_SIGNATURE_ALGOS, SHA2_HASH_ALGOS } from \"../oid.js\";\nimport { RFC3161TimestampVerificationError } from \"./error.js\";\nimport { TSTInfo } from \"./tstinfo.js\";\n\nconst OID_PKCS9_CONTENT_TYPE_SIGNED_DATA = \"1.2.840.113549.1.7.2\";\nconst OID_PKCS9_CONTENT_TYPE_TSTINFO = \"1.2.840.113549.1.9.16.1.4\";\nconst OID_PKCS9_MESSAGE_DIGEST_KEY = \"1.2.840.113549.1.9.4\";\n\nexport class RFC3161Timestamp {\n  public root: ASN1Obj;\n\n  constructor(asn1: ASN1Obj) {\n    this.root = asn1;\n  }\n\n  public static parse(der: Uint8Array): RFC3161Timestamp {\n    const asn1 = ASN1Obj.parseBuffer(der);\n    return new RFC3161Timestamp(asn1);\n  }\n\n  get status(): bigint {\n    return this.pkiStatusInfoObj.subs[0].toInteger();\n  }\n\n  get contentType(): string {\n    return this.contentTypeObj.toOID();\n  }\n\n  get eContentType(): string {\n    return this.eContentTypeObj.toOID();\n  }\n\n  get signingTime(): Date {\n    return this.tstInfo.genTime;\n  }\n\n  get signerIssuer(): Uint8Array {\n    return this.signerSidObj.subs[0].value;\n  }\n\n  get signerSerialNumber(): Uint8Array {\n    return this.signerSidObj.subs[1].value;\n  }\n\n  get signerDigestAlgorithm(): string {\n    const oid = this.signerDigestAlgorithmObj.subs[0].toOID();\n    const algo = SHA2_HASH_ALGOS[oid];\n    if (!algo) {\n      throw new Error(`Unknown digest algorithm OID: ${oid}`);\n    }\n    return algo;\n  }\n\n  get signatureAlgorithm(): string {\n    const oid = this.signatureAlgorithmObj.subs[0].toOID();\n    const algo = ECDSA_SIGNATURE_ALGOS[oid] || RSA_SIGNATURE_ALGOS[oid];\n    return algo;\n  }\n\n  get signatureValue(): Uint8Array {\n    return this.signatureValueObj.value;\n  }\n\n  get tstInfo(): TSTInfo {\n    // Need to unpack tstInfo from an OCTET STRING\n    return new TSTInfo(this.eContentObj.subs[0].subs[0]);\n  }\n\n  public async verify(data: Uint8Array, publicKey: CryptoKey): Promise<void> {\n    if (!this.timeStampTokenObj) {\n      throw new RFC3161TimestampVerificationError(\"timeStampToken is missing\");\n    }\n\n    // Check for expected ContentInfo content type\n    if (this.contentType !== OID_PKCS9_CONTENT_TYPE_SIGNED_DATA) {\n      throw new RFC3161TimestampVerificationError(\n        `incorrect content type: ${this.contentType}`,\n      );\n    }\n\n    // Check for expected encapsulated content type\n    if (this.eContentType !== OID_PKCS9_CONTENT_TYPE_TSTINFO) {\n      throw new RFC3161TimestampVerificationError(\n        `incorrect encapsulated content type: ${this.eContentType}`,\n      );\n    }\n\n    // Check that the tstInfo references the correct artifact\n    await this.tstInfo.verify(data);\n    // Check that the signed message digest matches the tstInfo\n    await this.verifyMessageDigest();\n    // Check that the signature is valid for the signed attributes\n    await this.verifySignature(publicKey);\n  }\n\n  private async verifyMessageDigest(): Promise<void> {\n    // Check that the tstInfo matches the signed data\n    const hashAlg = this.signerDigestAlgorithm;\n\n    // Convert hash algorithm name to the format expected by WebCrypto\n    const hashAlgName = hashAlg === \"sha256\" ? HashAlgorithms.SHA256 :\n                       hashAlg === \"sha384\" ? HashAlgorithms.SHA384 :\n                       hashAlg === \"sha512\" ? HashAlgorithms.SHA512 : hashAlg;\n\n    const tstInfoDigest = await crypto.subtle.digest(\n      hashAlgName,\n      this.tstInfo.raw as BufferSource,\n    );\n    const expectedDigest = this.messageDigestAttributeObj.subs[1].subs[0].value;\n\n    if (!uint8ArrayEqual(new Uint8Array(tstInfoDigest), expectedDigest)) {\n      throw new RFC3161TimestampVerificationError(\n        \"signed data does not match tstInfo\",\n      );\n    }\n  }\n\n  private async verifySignature(key: CryptoKey): Promise<void> {\n    // Encode the signed attributes for verification\n    const signedAttrs = this.signedAttrsObj.toDER();\n    signedAttrs[0] = 0x31; // Change context-specific tag to SET\n\n    const oid = this.signatureAlgorithmObj.subs[0].toOID();\n    // Try both ECDSA and RSA signature algorithms\n    const algo = ECDSA_SIGNATURE_ALGOS[oid] || RSA_SIGNATURE_ALGOS[oid];\n\n    if (!algo) {\n      throw new RFC3161TimestampVerificationError(\n        `Unsupported signature algorithm OID: ${oid}`,\n      );\n    }\n\n    // Check that the signature is valid for the signed attributes\n    const verified = await verifySignature(\n      key,\n      signedAttrs,\n      this.signatureValue,\n      algo,\n    );\n\n    if (!verified) {\n      throw new RFC3161TimestampVerificationError(\n        \"signature verification failed\",\n      );\n    }\n  }\n\n  // https://www.rfc-editor.org/rfc/rfc3161#section-2.4.2\n  private get pkiStatusInfoObj(): ASN1Obj {\n    // pkiStatusInfo is the first element of the timestamp response sequence\n    return this.root.subs[0];\n  }\n\n  // https://www.rfc-editor.org/rfc/rfc3161#section-2.4.2\n  private get timeStampTokenObj(): ASN1Obj {\n    // timeStampToken is the first element of the timestamp response sequence\n    return this.root.subs[1];\n  }\n\n  // https://datatracker.ietf.org/doc/html/rfc5652#section-3\n  private get contentTypeObj(): ASN1Obj {\n    return this.timeStampTokenObj.subs[0];\n  }\n  // https://www.rfc-editor.org/rfc/rfc5652#section-3\n  private get signedDataObj(): ASN1Obj {\n    const obj = this.timeStampTokenObj.subs.find((sub) =>\n      sub.tag.isContextSpecific(0x00),\n    );\n    if (!obj) {\n      throw new RFC3161TimestampVerificationError(\n        \"Missing timeStampTokenObj sub.\",\n      );\n    }\n    return obj.subs[0];\n  }\n\n  // https://datatracker.ietf.org/doc/html/rfc5652#section-5.1\n  private get encapContentInfoObj(): ASN1Obj {\n    return this.signedDataObj.subs[2];\n  }\n\n  // https://datatracker.ietf.org/doc/html/rfc5652#section-5.1\n  private get signerInfosObj(): ASN1Obj {\n    // SignerInfos is the last element of the signed data sequence\n    const sd = this.signedDataObj;\n    return sd.subs[sd.subs.length - 1];\n  }\n\n  // https://www.rfc-editor.org/rfc/rfc5652#section-5.1\n  private get signerInfoObj(): ASN1Obj {\n    // Only supporting one signer\n    return this.signerInfosObj.subs[0];\n  }\n\n  // https://datatracker.ietf.org/doc/html/rfc5652#section-5.2\n  private get eContentTypeObj(): ASN1Obj {\n    return this.encapContentInfoObj.subs[0];\n  }\n\n  // https://datatracker.ietf.org/doc/html/rfc5652#section-5.2\n  private get eContentObj(): ASN1Obj {\n    return this.encapContentInfoObj.subs[1];\n  }\n\n  // https://datatracker.ietf.org/doc/html/rfc5652#section-5.3\n  private get signedAttrsObj(): ASN1Obj {\n    const signedAttrs = this.signerInfoObj.subs.find((sub) =>\n      sub.tag.isContextSpecific(0x00),\n    );\n    if (!signedAttrs) {\n      throw new RFC3161TimestampVerificationError(\"Missing signedAttrsObj.\");\n    }\n    return signedAttrs;\n  }\n\n  // https://datatracker.ietf.org/doc/html/rfc5652#section-5.3\n  private get messageDigestAttributeObj(): ASN1Obj {\n    const messageDigest = this.signedAttrsObj.subs.find(\n      (sub) =>\n        sub.subs[0].tag.isOID() &&\n        sub.subs[0].toOID() === OID_PKCS9_MESSAGE_DIGEST_KEY,\n    );\n    if (!messageDigest) {\n      throw new RFC3161TimestampVerificationError(\"Missing messageDigest.\");\n    }\n    return messageDigest;\n  }\n\n  // https://datatracker.ietf.org/doc/html/rfc5652#section-5.3\n  private get signerSidObj(): ASN1Obj {\n    return this.signerInfoObj.subs[1];\n  }\n\n  // https://datatracker.ietf.org/doc/html/rfc5652#section-5.3\n  private get signerDigestAlgorithmObj(): ASN1Obj {\n    // Signature is the 2nd element of the signerInfoObj object\n    return this.signerInfoObj.subs[2];\n  }\n\n  // https://datatracker.ietf.org/doc/html/rfc5652#section-5.3\n  private get signatureAlgorithmObj(): ASN1Obj {\n    // Signature is the 4th element of the signerInfoObj object\n    return this.signerInfoObj.subs[4];\n  }\n\n  // https://datatracker.ietf.org/doc/html/rfc5652#section-5.3\n  private get signatureValueObj(): ASN1Obj {\n    // Signature is the 6th element of the signerInfoObj object\n    return this.signerInfoObj.subs[5];\n  }\n}\n"]}

package/dist/rfc3161/tstinfo.d.ts

@@ -10,4 +10,3 @@ export declare class TSTInfo {
     verify(data: Uint8Array): Promise<void>;
     private get messageImprintObj();
 }
-//# sourceMappingURL=tstinfo.d.ts.map

package/dist/rfc3161/tstinfo.js.map

@@ -1 +1 @@
-{"version":3,"file":"tstinfo.js","sourceRoot":"","sources":["../../src/rfc3161/tstinfo.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;EAcE;AACF,OAAO,EAAW,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAC1E,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,EAAE,iCAAiC,EAAE,MAAM,YAAY,CAAC;AAE/D,MAAM,OAAO,OAAO;IAGlB,YAAY,IAAa;QACvB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;IACvC,CAAC;IAED,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACpC,CAAC;IAED,IAAI,2BAA2B;QAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;QAC3D,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,+CAA+C,GAAG,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,2BAA2B;QAC7B,OAAO,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC9C,CAAC;IAED,IAAI,GAAG;QACL,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;IAC3B,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,IAAgB;QAClC,MAAM,OAAO,GAAG,IAAI,CAAC,2BAA2B,CAAC;QAEjD,kEAAkE;QAClE,MAAM,WAAW,GAAG,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;YAC/C,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;gBAC9C,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;QAE1E,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CACvC,WAAW,EACX,IAAoB,CACrB,CAAC;QACF,IACE,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,2BAA2B,CAAC,EAC1E,CAAC;YACD,MAAM,IAAI,iCAAiC,CACzC,yCAAyC,CAC1C,CAAC;QACJ,CAAC;IACH,CAAC;IAED,uDAAuD;IACvD,IAAY,iBAAiB;QAC3B,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;CACF"}
+{"version":3,"file":"tstinfo.js","sourceRoot":"","sources":["../../src/rfc3161/tstinfo.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;EAcE;AACF,OAAO,EAAW,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAE1E,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,EAAE,iCAAiC,EAAE,MAAM,YAAY,CAAC;AAE/D,MAAM,OAAO,OAAO;IAGlB,YAAY,IAAa;QACvB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;IACvC,CAAC;IAED,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACpC,CAAC;IAED,IAAI,2BAA2B;QAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;QAC3D,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,+CAA+C,GAAG,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,2BAA2B;QAC7B,OAAO,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC9C,CAAC;IAED,IAAI,GAAG;QACL,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;IAC3B,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,IAAgB;QAClC,MAAM,OAAO,GAAG,IAAI,CAAC,2BAA2B,CAAC;QAEjD,kEAAkE;QAClE,MAAM,WAAW,GAAG,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;YAC/C,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;gBAC9C,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;QAE1E,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CACvC,WAAW,EACX,IAAoB,CACrB,CAAC;QACF,IACE,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,2BAA2B,CAAC,EAC1E,CAAC;YACD,MAAM,IAAI,iCAAiC,CACzC,yCAAyC,CAC1C,CAAC;QACJ,CAAC;IACH,CAAC;IAED,uDAAuD;IACvD,IAAY,iBAAiB;QAC3B,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;CACF","sourcesContent":["/*\nCopyright 2023 The Sigstore Authors.\n\nLicensed under the Apache License, Version 2.0 (the \"License\");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\n    http://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n*/\nimport { ASN1Obj, uint8ArrayEqual } from \"@freedomofpress/crypto-browser\";\n\nimport { HashAlgorithms } from \"../interfaces.js\";\nimport { SHA2_HASH_ALGOS } from \"../oid.js\";\nimport { RFC3161TimestampVerificationError } from \"./error.js\";\n\nexport class TSTInfo {\n  public root: ASN1Obj;\n\n  constructor(asn1: ASN1Obj) {\n    this.root = asn1;\n  }\n\n  get version(): bigint {\n    return this.root.subs[0].toInteger();\n  }\n\n  get genTime(): Date {\n    return this.root.subs[4].toDate();\n  }\n\n  get messageImprintHashAlgorithm(): string {\n    const oid = this.messageImprintObj.subs[0].subs[0].toOID();\n    const algo = SHA2_HASH_ALGOS[oid];\n    if (!algo) {\n      throw new Error(`Unknown message imprint hash algorithm OID: ${oid}`);\n    }\n    return algo;\n  }\n\n  get messageImprintHashedMessage(): Uint8Array {\n    return this.messageImprintObj.subs[1].value;\n  }\n\n  get raw(): Uint8Array {\n    return this.root.toDER();\n  }\n\n  public async verify(data: Uint8Array): Promise<void> {\n    const hashAlg = this.messageImprintHashAlgorithm;\n\n    // Convert hash algorithm name to the format expected by WebCrypto\n    const hashAlgName = hashAlg === \"sha256\" ? HashAlgorithms.SHA256 :\n                       hashAlg === \"sha384\" ? HashAlgorithms.SHA384 :\n                       hashAlg === \"sha512\" ? HashAlgorithms.SHA512 : hashAlg;\n\n    const digest = await crypto.subtle.digest(\n      hashAlgName,\n      data as BufferSource,\n    );\n    if (\n      !uint8ArrayEqual(new Uint8Array(digest), this.messageImprintHashedMessage)\n    ) {\n      throw new RFC3161TimestampVerificationError(\n        \"message imprint does not match artifact\",\n      );\n    }\n  }\n\n  // https://www.rfc-editor.org/rfc/rfc3161#section-2.4.2\n  private get messageImprintObj(): ASN1Obj {\n    return this.root.subs[2];\n  }\n}\n"]}

package/dist/sigstore.d.ts

@@ -1,17 +1,8 @@
-import { X509Certificate } from "./x509/index.js";
 import { SigstoreBundle } from "./bundle.js";
-import { CertAuthority, CTLog, RawCAs, RawLogs, RawTimestampAuthorities, RekorKeyInfo, TrustedRoot } from "./interfaces.js";
-import { TrustedRootProvider } from "./trust/tuf.js";
+import { CertAuthority, CTLog, RawCAs, RawLogs, RekorKeyInfo, TrustedRoot } from "./interfaces.js";
 import type { VerificationPolicy } from "./policy.js";
-/**
- * Rekor v2 entries omit `integratedTime` and MUST carry a signed RFC3161
- * timestamp instead. Check for actual content, not just presence: an empty
- * `timestampVerificationData: {}` is truthy, so `if (!timestampVerificationData)`
- * is bypassable and leaves the cert validity window unanchored in time.
- */
-export declare function assertRekorV2Timestamp(timestampData?: {
-    rfc3161Timestamps?: readonly unknown[];
-}): void;
+import { TrustedRootProvider } from "./trust/tuf.js";
+import { X509Certificate } from "./x509/index.js";
 export interface SigstoreVerifierOptions {
     tlogThreshold?: number;
     ctlogThreshold?: number;
@@ -22,11 +13,10 @@ export declare class SigstoreVerifier {
     private rawRoot;
     private options;
     constructor(options?: SigstoreVerifierOptions);
-    loadLog(frozenTimestamp: Date, logs: RawLogs): Promise<RekorKeyInfo | undefined>;
-    loadCTLogs(frozenTimestamp: Date, ctlogs: RawLogs): Promise<CTLog[]>;
+    loadLog(logs: RawLogs): Promise<RekorKeyInfo[]>;
+    loadCTLogs(ctlogs: RawLogs): Promise<CTLog[]>;
     verifyCertificateChain(timestamp: Date, leaf: X509Certificate, certificateAuthorities: CertAuthority[]): Promise<X509Certificate[]>;
-    loadTSA(frozenTimestamp: Date, tsas?: RawTimestampAuthorities): CertAuthority[];
-    loadCA(frozenTimestamp: Date, cas: RawCAs): CertAuthority[];
+    loadCA(cas: RawCAs): CertAuthority[];
     loadSigstoreRoot(rawRoot: TrustedRoot): Promise<void>;
     /**
      * Load Sigstore trusted root via TUF
@@ -35,9 +25,10 @@ export declare class SigstoreVerifier {
      * @param tufProvider Optional TrustedRootProvider instance. If not provided, uses default Sigstore TUF repository
      */
     loadSigstoreRootWithTUF(tufProvider?: TrustedRootProvider): Promise<void>;
-    verifySCT(cert: X509Certificate, issuer: X509Certificate, ctlogs: CTLog[]): Promise<Uint8Array[]>;
-    verifyInclusionPromise(cert: X509Certificate, bundle: SigstoreBundle, rekor: RekorKeyInfo | undefined): Promise<boolean>;
-    verifyInclusionProof(bundle: SigstoreBundle): Promise<void>;
+    verifySCT(cert: X509Certificate, issuer: X509Certificate, ctlogs: CTLog[]): Promise<Set<string>>;
+    private verifySET;
+    private verifyTlogEntries;
+    private verifyBundle;
     verifyArtifactPolicy(policy: VerificationPolicy, bundle: SigstoreBundle, data: Uint8Array, isDigestOnly?: boolean): Promise<boolean>;
     verifyArtifact(identity: string, issuer: string, bundle: SigstoreBundle, data: Uint8Array, isDigestOnly?: boolean): Promise<boolean>;
     /**
@@ -60,4 +51,3 @@ export declare class SigstoreVerifier {
         payload: Uint8Array;
     }>;
 }
-//# sourceMappingURL=sigstore.d.ts.map