@freedomofpress/sigstore-browser 0.1.14 → 0.1.16
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +20 -16
- package/dist/bundle.d.ts +3 -2
- package/dist/bundle.js +66 -1
- package/dist/bundle.js.map +1 -1
- package/dist/cli.d.ts +0 -1
- package/dist/cli.js.map +1 -1
- package/dist/dsse.d.ts +0 -1
- package/dist/dsse.js.map +1 -1
- package/dist/errors.d.ts +0 -1
- package/dist/errors.js.map +1 -1
- package/dist/index.d.ts +9 -10
- package/dist/index.js +5 -5
- package/dist/index.js.map +1 -1
- package/dist/interfaces.d.ts +18 -4
- package/dist/interfaces.js +15 -1
- package/dist/interfaces.js.map +1 -1
- package/dist/oid.d.ts +0 -1
- package/dist/oid.js.map +1 -1
- package/dist/policy.d.ts +3 -4
- package/dist/policy.js +5 -5
- package/dist/policy.js.map +1 -1
- package/dist/rfc3161/error.d.ts +0 -1
- package/dist/rfc3161/error.js.map +1 -1
- package/dist/rfc3161/index.d.ts +0 -1
- package/dist/rfc3161/index.js.map +1 -1
- package/dist/rfc3161/timestamp.d.ts +0 -1
- package/dist/rfc3161/timestamp.js.map +1 -1
- package/dist/rfc3161/tstinfo.d.ts +0 -1
- package/dist/rfc3161/tstinfo.js.map +1 -1
- package/dist/sigstore.d.ts +10 -20
- package/dist/sigstore.js +167 -400
- package/dist/sigstore.js.map +1 -1
- package/dist/timestamp/tsa.d.ts +6 -3
- package/dist/timestamp/tsa.js +16 -19
- package/dist/timestamp/tsa.js.map +1 -1
- package/dist/tlog/body.d.ts +3 -2
- package/dist/tlog/body.js +19 -6
- package/dist/tlog/body.js.map +1 -1
- package/dist/tlog/checkpoint.d.ts +2 -3
- package/dist/tlog/checkpoint.js +17 -95
- package/dist/tlog/checkpoint.js.map +1 -1
- package/dist/tlog/dsse.d.ts +3 -3
- package/dist/tlog/dsse.js +11 -5
- package/dist/tlog/dsse.js.map +1 -1
- package/dist/tlog/hashedrekord.d.ts +3 -3
- package/dist/tlog/hashedrekord.js +8 -5
- package/dist/tlog/hashedrekord.js.map +1 -1
- package/dist/tlog/intoto.d.ts +3 -3
- package/dist/tlog/intoto.js +3 -1
- package/dist/tlog/intoto.js.map +1 -1
- package/dist/tlog/merkle.d.ts +0 -1
- package/dist/tlog/merkle.js.map +1 -1
- package/dist/trust/tuf-root.d.ts +0 -1
- package/dist/trust/tuf-root.js.map +1 -1
- package/dist/trust/tuf.d.ts +0 -1
- package/dist/trust/tuf.js.map +1 -1
- package/dist/x509/cert.d.ts +0 -1
- package/dist/x509/cert.js +1 -1
- package/dist/x509/cert.js.map +1 -1
- package/dist/x509/chain.d.ts +0 -1
- package/dist/x509/chain.js +2 -2
- package/dist/x509/chain.js.map +1 -1
- package/dist/x509/ext.d.ts +0 -1
- package/dist/x509/ext.js.map +1 -1
- package/dist/x509/index.d.ts +1 -2
- package/dist/x509/index.js +1 -1
- package/dist/x509/index.js.map +1 -1
- package/dist/x509/sct.d.ts +0 -1
- package/dist/x509/sct.js.map +1 -1
- package/package.json +15 -8
- package/.github/workflows/conformance.yml +0 -29
- package/.github/workflows/publish.yml +0 -47
- package/dist/bundle.d.ts.map +0 -1
- package/dist/cli.d.ts.map +0 -1
- package/dist/dsse.d.ts.map +0 -1
- package/dist/errors.d.ts.map +0 -1
- package/dist/index.d.ts.map +0 -1
- package/dist/interfaces.d.ts.map +0 -1
- package/dist/oid.d.ts.map +0 -1
- package/dist/policy.d.ts.map +0 -1
- package/dist/rfc3161/error.d.ts.map +0 -1
- package/dist/rfc3161/index.d.ts.map +0 -1
- package/dist/rfc3161/timestamp.d.ts.map +0 -1
- package/dist/rfc3161/tstinfo.d.ts.map +0 -1
- package/dist/sigstore.d.ts.map +0 -1
- package/dist/timestamp/tsa.d.ts.map +0 -1
- package/dist/tlog/body.d.ts.map +0 -1
- package/dist/tlog/checkpoint.d.ts.map +0 -1
- package/dist/tlog/dsse.d.ts.map +0 -1
- package/dist/tlog/hashedrekord.d.ts.map +0 -1
- package/dist/tlog/intoto.d.ts.map +0 -1
- package/dist/tlog/merkle.d.ts.map +0 -1
- package/dist/trust/tuf-root.d.ts.map +0 -1
- package/dist/trust/tuf.d.ts.map +0 -1
- package/dist/x509/cert.d.ts.map +0 -1
- package/dist/x509/chain.d.ts.map +0 -1
- package/dist/x509/ext.d.ts.map +0 -1
- package/dist/x509/index.d.ts.map +0 -1
- package/dist/x509/sct.d.ts.map +0 -1
- package/eslint.config.mjs +0 -31
- package/src/bundle.ts +0 -99
- package/src/cli.ts +0 -290
- package/src/dsse.ts +0 -49
- package/src/errors.ts +0 -82
- package/src/index.browser.test.ts +0 -290
- package/src/index.ts +0 -93
- package/src/interfaces.ts +0 -123
- package/src/oid.ts +0 -34
- package/src/policy.ts +0 -476
- package/src/rfc3161/error.ts +0 -16
- package/src/rfc3161/index.ts +0 -17
- package/src/rfc3161/timestamp.ts +0 -268
- package/src/rfc3161/tstinfo.ts +0 -78
- package/src/sigstore.ts +0 -948
- package/src/timestamp/tsa.ts +0 -211
- package/src/tlog/body.ts +0 -65
- package/src/tlog/checkpoint.ts +0 -254
- package/src/tlog/dsse.ts +0 -147
- package/src/tlog/hashedrekord.ts +0 -130
- package/src/tlog/intoto.ts +0 -106
- package/src/tlog/merkle.ts +0 -152
- package/src/trust/README.md +0 -38
- package/src/trust/tuf-root.ts +0 -3
- package/src/trust/tuf.ts +0 -233
- package/src/x509/cert.ts +0 -569
- package/src/x509/chain.ts +0 -212
- package/src/x509/ext.ts +0 -356
- package/src/x509/index.ts +0 -19
- package/src/x509/sct.ts +0 -156
- package/tsconfig.json +0 -18
- package/vite.config.playwright.ts +0 -14
- package/vite.config.ts +0 -18
package/dist/tlog/dsse.js
CHANGED
|
@@ -12,24 +12,26 @@
|
|
|
12
12
|
*/
|
|
13
13
|
import { base64ToUint8Array, hexToUint8Array, uint8ArrayEqual } from "@freedomofpress/crypto-browser";
|
|
14
14
|
import { getHashAlgorithm } from "../interfaces.js";
|
|
15
|
-
|
|
15
|
+
import { assertLoggedCertificate } from "./body.js";
|
|
16
|
+
export async function verifyDSSEBody(entry, bundle, cert) {
|
|
16
17
|
const dsseEntry = entry;
|
|
17
18
|
switch (dsseEntry.apiVersion) {
|
|
18
19
|
case "0.0.1":
|
|
19
|
-
return verifyDSSE001Body(dsseEntry, bundle);
|
|
20
|
+
return verifyDSSE001Body(dsseEntry, bundle, cert);
|
|
20
21
|
case "0.0.2":
|
|
21
|
-
return verifyDSSE002Body(dsseEntry, bundle);
|
|
22
|
+
return verifyDSSE002Body(dsseEntry, bundle, cert);
|
|
22
23
|
default:
|
|
23
24
|
throw new Error(`Unsupported dsse version: ${dsseEntry.apiVersion}`);
|
|
24
25
|
}
|
|
25
26
|
}
|
|
26
|
-
async function verifyDSSE001Body(entry, bundle) {
|
|
27
|
+
async function verifyDSSE001Body(entry, bundle, cert) {
|
|
27
28
|
if (!bundle.dsseEnvelope) {
|
|
28
29
|
throw new Error("Bundle missing dsseEnvelope for DSSE entry");
|
|
29
30
|
}
|
|
30
31
|
if (!entry.spec.signatures || entry.spec.signatures.length !== 1) {
|
|
31
32
|
throw new Error("DSSE entry must have exactly one signature");
|
|
32
33
|
}
|
|
34
|
+
assertLoggedCertificate(cert, entry.spec.signatures[0].verifier, true);
|
|
33
35
|
const tlogSig = entry.spec.signatures[0].signature;
|
|
34
36
|
const tlogSigBytes = base64ToUint8Array(tlogSig);
|
|
35
37
|
if (bundle.dsseEnvelope.signatures.length === 0) {
|
|
@@ -51,7 +53,7 @@ async function verifyDSSE001Body(entry, bundle) {
|
|
|
51
53
|
}
|
|
52
54
|
}
|
|
53
55
|
// New functionality for DSSE v0.0.2 (not in sigstore-js reference, which only supports v0.0.1)
|
|
54
|
-
async function verifyDSSE002Body(entry, bundle) {
|
|
56
|
+
async function verifyDSSE002Body(entry, bundle, cert) {
|
|
55
57
|
if (!bundle.dsseEnvelope) {
|
|
56
58
|
throw new Error("Bundle missing dsseEnvelope for DSSE v0.0.2 entry");
|
|
57
59
|
}
|
|
@@ -62,7 +64,11 @@ async function verifyDSSE002Body(entry, bundle) {
|
|
|
62
64
|
if (!spec.signatures || spec.signatures.length !== 1) {
|
|
63
65
|
throw new Error("DSSE v0.0.2 entry must have exactly one signature");
|
|
64
66
|
}
|
|
67
|
+
assertLoggedCertificate(cert, spec.signatures[0].verifier?.x509Certificate?.rawBytes, false);
|
|
65
68
|
const tlogSig = spec.signatures[0].content;
|
|
69
|
+
if (typeof tlogSig !== "string") {
|
|
70
|
+
throw new Error("DSSE v0.0.2 entry signature missing content");
|
|
71
|
+
}
|
|
66
72
|
const tlogSigBytes = base64ToUint8Array(tlogSig);
|
|
67
73
|
if (bundle.dsseEnvelope.signatures.length === 0) {
|
|
68
74
|
throw new Error("Bundle DSSE envelope missing signatures");
|
package/dist/tlog/dsse.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"dsse.js","sourceRoot":"","sources":["../../src/tlog/dsse.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;
|
|
1
|
+
{"version":3,"file":"dsse.js","sourceRoot":"","sources":["../../src/tlog/dsse.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAGtG,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEpD,OAAO,EAAE,uBAAuB,EAAmB,MAAM,WAAW,CAAC;AA8BrE,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,KAAiB,EACjB,MAAsB,EACtB,IAAqB;IAErB,MAAM,SAAS,GAAG,KAAkB,CAAC;IAErC,QAAQ,SAAS,CAAC,UAAU,EAAE,CAAC;QAC7B,KAAK,OAAO;YACV,OAAO,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QACpD,KAAK,OAAO;YACV,OAAO,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QACpD;YACE,MAAM,IAAI,KAAK,CACb,6BAA6B,SAAS,CAAC,UAAU,EAAE,CACpD,CAAC;IACN,CAAC;AACH,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,KAAgB,EAChB,MAAsB,EACtB,IAAqB;IAErB,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IACD,uBAAuB,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAEvE,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACnD,MAAM,YAAY,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAEjD,IAAI,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IAED,MAAM,cAAc,GAAG,kBAAkB,CAAC,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAEjF,IAAI,CAAC,eAAe,CAAC,YAAY,EAAE,cAAc,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,CAAC;QACzE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IAED,MAAM,OAAO,GAAG,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IACnE,MAAM,aAAa,GAAG,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IAEpE,MAAM,YAAY,GAAG,kBAAkB,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;IACrE,MAAM,eAAe,GAAG,IAAI,UAAU,CACpC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,YAA4B,CAAC,CAClE,CAAC;IAEF,IAAI,CAAC,eAAe,CAAC,aAAa,EAAE,eAAe,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC;AAED,+FAA+F;AAC/F,KAAK,UAAU,iBAAiB,CAC9B,KAAgB,EAChB,MAAsB,EACtB,IAAqB;IAErB,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,IAAI,GAAI,KAAK,CAAC,IAAoC,CAAC,QAAQ,CAAC;IAClE,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,uBAAuB,CAAC,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,eAAe,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IAE7F,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IAC3C,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,YAAY,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAEjD,IAAI,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IAED,MAAM,cAAc,GAAG,kBAAkB,CAAC,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAEjF,IAAI,CAAC,eAAe,CAAC,YAAY,EAAE,cAAc,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IACpF,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IAC7D,MAAM,aAAa,GAAG,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAElE,MAAM,YAAY,GAAG,kBAAkB,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;IACrE,MAAM,eAAe,GAAG,IAAI,UAAU,CACpC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,YAA4B,CAAC,CAClE,CAAC;IAEF,IAAI,CAAC,eAAe,CAAC,aAAa,EAAE,eAAe,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IACvF,CAAC;AACH,CAAC","sourcesContent":["/*\n * DSSE transparency log entry verification\n *\n * Based on sigstore-js:\n * https://github.com/sigstore/sigstore-js/blob/main/packages/verify/src/tlog/dsse.ts\n *\n * Key differences from sigstore-js:\n * - Browser-compatible: uses Uint8Array instead of Buffer for binary data\n * - Direct bundle field comparison instead of SignatureContent abstraction\n * - Uses crypto.subtle.digest for hash computation instead of Node.js crypto\n * - Adds verifyDSSE002Body() - new functionality (reference only supports v0.0.1)\n */\n\nimport { base64ToUint8Array, hexToUint8Array, uint8ArrayEqual } from \"@freedomofpress/crypto-browser\";\n\nimport type { SigstoreBundle } from \"../bundle.js\";\nimport { getHashAlgorithm } from \"../interfaces.js\";\nimport type { X509Certificate } from \"../x509/cert.js\";\nimport { assertLoggedCertificate, type RekorEntry } from \"./body.js\";\n\n// Shape of the Rekor v2 dsse_v002 entry spec, validated field by field below.\ntype DsseV002Spec = {\n payloadHash?: { algorithm?: string; digest?: string };\n signatures?: { content?: string; verifier?: { x509Certificate?: { rawBytes?: string } } }[];\n};\n\ninterface DSSESpec {\n signatures?: Array<{\n signature: string;\n verifier?: string;\n keyid?: string;\n }>;\n payloadHash?: {\n algorithm: string;\n value: string;\n };\n envelopeHash?: {\n algorithm: string;\n value: string;\n };\n}\n\ninterface DSSEEntry extends RekorEntry {\n apiVersion: \"0.0.1\" | \"0.0.2\";\n kind: \"dsse\";\n spec: DSSESpec;\n}\n\nexport async function verifyDSSEBody(\n entry: RekorEntry,\n bundle: SigstoreBundle,\n cert: X509Certificate,\n): Promise<void> {\n const dsseEntry = entry as DSSEEntry;\n\n switch (dsseEntry.apiVersion) {\n case \"0.0.1\":\n return verifyDSSE001Body(dsseEntry, bundle, cert);\n case \"0.0.2\":\n return verifyDSSE002Body(dsseEntry, bundle, cert);\n default:\n throw new Error(\n `Unsupported dsse version: ${dsseEntry.apiVersion}`\n );\n }\n}\n\nasync function verifyDSSE001Body(\n entry: DSSEEntry,\n bundle: SigstoreBundle,\n cert: X509Certificate,\n): Promise<void> {\n if (!bundle.dsseEnvelope) {\n throw new Error(\"Bundle missing dsseEnvelope for DSSE entry\");\n }\n\n if (!entry.spec.signatures || entry.spec.signatures.length !== 1) {\n throw new Error(\"DSSE entry must have exactly one signature\");\n }\n assertLoggedCertificate(cert, entry.spec.signatures[0].verifier, true);\n\n const tlogSig = entry.spec.signatures[0].signature;\n const tlogSigBytes = base64ToUint8Array(tlogSig);\n\n if (bundle.dsseEnvelope.signatures.length === 0) {\n throw new Error(\"Bundle DSSE envelope missing signatures\");\n }\n\n const bundleSigBytes = base64ToUint8Array(bundle.dsseEnvelope.signatures[0].sig);\n\n if (!uint8ArrayEqual(tlogSigBytes, bundleSigBytes)) {\n throw new Error(\"DSSE signature mismatch between TLog entry and bundle\");\n }\n\n if (!entry.spec.payloadHash?.value || !entry.spec.payloadHash?.algorithm) {\n throw new Error(\"DSSE entry missing payloadHash or algorithm\");\n }\n\n const hashAlg = getHashAlgorithm(entry.spec.payloadHash.algorithm);\n const tlogHashBytes = hexToUint8Array(entry.spec.payloadHash.value);\n\n const payloadBytes = base64ToUint8Array(bundle.dsseEnvelope.payload);\n const bundleHashBytes = new Uint8Array(\n await crypto.subtle.digest(hashAlg, payloadBytes as BufferSource)\n );\n\n if (!uint8ArrayEqual(tlogHashBytes, bundleHashBytes)) {\n throw new Error(\"DSSE payload hash mismatch between TLog entry and bundle\");\n }\n}\n\n// New functionality for DSSE v0.0.2 (not in sigstore-js reference, which only supports v0.0.1)\nasync function verifyDSSE002Body(\n entry: DSSEEntry,\n bundle: SigstoreBundle,\n cert: X509Certificate,\n): Promise<void> {\n if (!bundle.dsseEnvelope) {\n throw new Error(\"Bundle missing dsseEnvelope for DSSE v0.0.2 entry\");\n }\n\n const spec = (entry.spec as { dsseV002?: DsseV002Spec }).dsseV002;\n if (!spec) {\n throw new Error(\"DSSE v0.0.2 entry missing dsseV002 spec\");\n }\n\n if (!spec.signatures || spec.signatures.length !== 1) {\n throw new Error(\"DSSE v0.0.2 entry must have exactly one signature\");\n }\n assertLoggedCertificate(cert, spec.signatures[0].verifier?.x509Certificate?.rawBytes, false);\n\n const tlogSig = spec.signatures[0].content;\n if (typeof tlogSig !== \"string\") {\n throw new Error(\"DSSE v0.0.2 entry signature missing content\");\n }\n const tlogSigBytes = base64ToUint8Array(tlogSig);\n\n if (bundle.dsseEnvelope.signatures.length === 0) {\n throw new Error(\"Bundle DSSE envelope missing signatures\");\n }\n\n const bundleSigBytes = base64ToUint8Array(bundle.dsseEnvelope.signatures[0].sig);\n\n if (!uint8ArrayEqual(tlogSigBytes, bundleSigBytes)) {\n throw new Error(\"DSSE signature mismatch between TLog entry and bundle (v0.0.2)\");\n }\n\n if (!spec.payloadHash?.digest || !spec.payloadHash?.algorithm) {\n throw new Error(\"DSSE v0.0.2 entry missing payloadHash or algorithm\");\n }\n\n const hashAlg = getHashAlgorithm(spec.payloadHash.algorithm);\n const tlogHashBytes = base64ToUint8Array(spec.payloadHash.digest);\n\n const payloadBytes = base64ToUint8Array(bundle.dsseEnvelope.payload);\n const bundleHashBytes = new Uint8Array(\n await crypto.subtle.digest(hashAlg, payloadBytes as BufferSource)\n );\n\n if (!uint8ArrayEqual(tlogHashBytes, bundleHashBytes)) {\n throw new Error(\"DSSE payload hash mismatch between TLog entry and bundle (v0.0.2)\");\n }\n}\n"]}
|
|
@@ -1,4 +1,4 @@
|
|
|
1
1
|
import type { SigstoreBundle } from "../bundle.js";
|
|
2
|
-
import type {
|
|
3
|
-
|
|
4
|
-
|
|
2
|
+
import type { X509Certificate } from "../x509/cert.js";
|
|
3
|
+
import { type RekorEntry } from "./body.js";
|
|
4
|
+
export declare function verifyHashedRekordBody(entry: RekorEntry, bundle: SigstoreBundle, cert: X509Certificate): Promise<void>;
|
|
@@ -10,22 +10,24 @@
|
|
|
10
10
|
* - Adds verifyHashedRekordV002Body() - new functionality (reference only supports v0.0.1)
|
|
11
11
|
*/
|
|
12
12
|
import { base64ToUint8Array, hexToUint8Array, uint8ArrayEqual } from "@freedomofpress/crypto-browser";
|
|
13
|
-
|
|
13
|
+
import { assertLoggedCertificate } from "./body.js";
|
|
14
|
+
export async function verifyHashedRekordBody(entry, bundle, cert) {
|
|
14
15
|
const hashedRekordEntry = entry;
|
|
15
16
|
switch (hashedRekordEntry.apiVersion) {
|
|
16
17
|
case "0.0.1":
|
|
17
|
-
return verifyHashedRekordV001Body(hashedRekordEntry, bundle);
|
|
18
|
+
return verifyHashedRekordV001Body(hashedRekordEntry, bundle, cert);
|
|
18
19
|
case "0.0.2":
|
|
19
|
-
return verifyHashedRekordV002Body(hashedRekordEntry, bundle);
|
|
20
|
+
return verifyHashedRekordV002Body(hashedRekordEntry, bundle, cert);
|
|
20
21
|
default:
|
|
21
22
|
throw new Error(`Unsupported hashedrekord version: ${hashedRekordEntry.apiVersion}`);
|
|
22
23
|
}
|
|
23
24
|
}
|
|
24
|
-
function verifyHashedRekordV001Body(entry, bundle) {
|
|
25
|
+
function verifyHashedRekordV001Body(entry, bundle, cert) {
|
|
25
26
|
const spec = entry.spec;
|
|
26
27
|
if (!bundle.messageSignature) {
|
|
27
28
|
throw new Error("Bundle missing messageSignature for hashedrekord entry");
|
|
28
29
|
}
|
|
30
|
+
assertLoggedCertificate(cert, spec.signature?.publicKey?.content, true);
|
|
29
31
|
const tlogSig = spec.signature.content || "";
|
|
30
32
|
const tlogSigBytes = base64ToUint8Array(tlogSig);
|
|
31
33
|
const bundleSigBytes = base64ToUint8Array(bundle.messageSignature.signature);
|
|
@@ -40,11 +42,12 @@ function verifyHashedRekordV001Body(entry, bundle) {
|
|
|
40
42
|
}
|
|
41
43
|
}
|
|
42
44
|
// New functionality for HashedRekord v0.0.2 (not in sigstore-js reference, which only supports v0.0.1)
|
|
43
|
-
function verifyHashedRekordV002Body(entry, bundle) {
|
|
45
|
+
function verifyHashedRekordV002Body(entry, bundle, cert) {
|
|
44
46
|
const spec = entry.spec.hashedRekordV002;
|
|
45
47
|
if (!bundle.messageSignature) {
|
|
46
48
|
throw new Error("Bundle missing messageSignature for hashedrekord v0.0.2 entry");
|
|
47
49
|
}
|
|
50
|
+
assertLoggedCertificate(cert, spec?.signature?.verifier?.x509Certificate?.rawBytes, false);
|
|
48
51
|
// NOTE: HashedRekord v0.0.2 uses single base64 encoding (unlike intoto which is double-encoded)
|
|
49
52
|
// Verified against Sigstore conformance test suite bundles
|
|
50
53
|
const tlogSig = spec.signature.content || "";
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"hashedrekord.js","sourceRoot":"","sources":["../../src/tlog/hashedrekord.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;
|
|
1
|
+
{"version":3,"file":"hashedrekord.js","sourceRoot":"","sources":["../../src/tlog/hashedrekord.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAItG,OAAO,EAAE,uBAAuB,EAAmB,MAAM,WAAW,CAAC;AAwCrE,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAAiB,EACjB,MAAsB,EACtB,IAAqB;IAErB,MAAM,iBAAiB,GAAG,KAA0B,CAAC;IAErD,QAAQ,iBAAiB,CAAC,UAAU,EAAE,CAAC;QACrC,KAAK,OAAO;YACV,OAAO,0BAA0B,CAAC,iBAAiB,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QACrE,KAAK,OAAO;YACV,OAAO,0BAA0B,CAAC,iBAAiB,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QACrE;YACE,MAAM,IAAI,KAAK,CACb,qCAAqC,iBAAiB,CAAC,UAAU,EAAE,CACpE,CAAC;IACN,CAAC;AACH,CAAC;AAED,SAAS,0BAA0B,CACjC,KAAwB,EACxB,MAAsB,EACtB,IAAqB;IAErB,MAAM,IAAI,GAAG,KAAK,CAAC,IAAwB,CAAC;IAC5C,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,uBAAuB,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAExE,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,IAAI,EAAE,CAAC;IAC7C,MAAM,YAAY,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACjD,MAAM,cAAc,GAAG,kBAAkB,CAAC,MAAM,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;IAE7E,IAAI,CAAC,eAAe,CAAC,YAAY,EAAE,cAAc,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;IAC/C,MAAM,eAAe,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IACpD,MAAM,iBAAiB,GAAG,kBAAkB,CAC1C,MAAM,CAAC,gBAAgB,CAAC,aAAa,CAAC,MAAM,CAC7C,CAAC;IAEF,IAAI,CAAC,eAAe,CAAC,eAAe,EAAE,iBAAiB,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;AACH,CAAC;AAED,uGAAuG;AACvG,SAAS,0BAA0B,CACjC,KAAwB,EACxB,MAAsB,EACtB,IAAqB;IAErB,MAAM,IAAI,GAAI,KAAK,CAAC,IAA6B,CAAC,gBAAgB,CAAC;IACnE,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IACnF,CAAC;IACD,uBAAuB,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,eAAe,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IAE3F,gGAAgG;IAChG,2DAA2D;IAC3D,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,IAAI,EAAE,CAAC;IAC7C,MAAM,YAAY,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACjD,MAAM,cAAc,GAAG,kBAAkB,CAAC,MAAM,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;IAE7E,IAAI,CAAC,eAAe,CAAC,YAAY,EAAE,cAAc,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC/E,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;IAC1C,MAAM,eAAe,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;IACvD,MAAM,iBAAiB,GAAG,kBAAkB,CAC1C,MAAM,CAAC,gBAAgB,CAAC,aAAa,CAAC,MAAM,CAC7C,CAAC;IAEF,IAAI,CAAC,eAAe,CAAC,eAAe,EAAE,iBAAiB,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;AACH,CAAC","sourcesContent":["/*\n * HashedRekord transparency log entry verification\n *\n * Based on sigstore-js:\n * https://github.com/sigstore/sigstore-js/blob/main/packages/verify/src/tlog/hashedrekord.ts\n *\n * Key differences from sigstore-js:\n * - Browser-compatible: uses Uint8Array instead of Buffer for binary data\n * - Direct bundle field comparison instead of SignatureContent abstraction\n * - Adds verifyHashedRekordV002Body() - new functionality (reference only supports v0.0.1)\n */\n\nimport { base64ToUint8Array, hexToUint8Array, uint8ArrayEqual } from \"@freedomofpress/crypto-browser\";\n\nimport type { SigstoreBundle } from \"../bundle.js\";\nimport type { X509Certificate } from \"../x509/cert.js\";\nimport { assertLoggedCertificate, type RekorEntry } from \"./body.js\";\n\ninterface HashedRekordSpec {\n signature: {\n content: string;\n publicKey: {\n content: string;\n };\n };\n data: {\n hash: {\n algorithm: string;\n value: string;\n };\n };\n}\n\ninterface HashedRekordEntry extends RekorEntry {\n apiVersion: \"0.0.1\" | \"0.0.2\";\n kind: \"hashedrekord\";\n spec: HashedRekordSpec | HashedRekordV002Spec;\n}\n\ninterface HashedRekordV002Spec {\n hashedRekordV002: {\n signature: {\n content: string;\n verifier?: {\n x509Certificate?: {\n rawBytes: string;\n };\n };\n };\n data: {\n algorithm: string;\n digest: string;\n };\n };\n}\n\nexport async function verifyHashedRekordBody(\n entry: RekorEntry,\n bundle: SigstoreBundle,\n cert: X509Certificate,\n): Promise<void> {\n const hashedRekordEntry = entry as HashedRekordEntry;\n\n switch (hashedRekordEntry.apiVersion) {\n case \"0.0.1\":\n return verifyHashedRekordV001Body(hashedRekordEntry, bundle, cert);\n case \"0.0.2\":\n return verifyHashedRekordV002Body(hashedRekordEntry, bundle, cert);\n default:\n throw new Error(\n `Unsupported hashedrekord version: ${hashedRekordEntry.apiVersion}`\n );\n }\n}\n\nfunction verifyHashedRekordV001Body(\n entry: HashedRekordEntry,\n bundle: SigstoreBundle,\n cert: X509Certificate,\n): void {\n const spec = entry.spec as HashedRekordSpec;\n if (!bundle.messageSignature) {\n throw new Error(\"Bundle missing messageSignature for hashedrekord entry\");\n }\n assertLoggedCertificate(cert, spec.signature?.publicKey?.content, true);\n\n const tlogSig = spec.signature.content || \"\";\n const tlogSigBytes = base64ToUint8Array(tlogSig);\n const bundleSigBytes = base64ToUint8Array(bundle.messageSignature.signature);\n\n if (!uint8ArrayEqual(tlogSigBytes, bundleSigBytes)) {\n throw new Error(\"Signature mismatch between TLog entry and bundle\");\n }\n\n const tlogDigest = spec.data.hash?.value || \"\";\n const tlogDigestBytes = hexToUint8Array(tlogDigest);\n const bundleDigestBytes = base64ToUint8Array(\n bundle.messageSignature.messageDigest.digest\n );\n\n if (!uint8ArrayEqual(tlogDigestBytes, bundleDigestBytes)) {\n throw new Error(\"Digest mismatch between TLog entry and bundle\");\n }\n}\n\n// New functionality for HashedRekord v0.0.2 (not in sigstore-js reference, which only supports v0.0.1)\nfunction verifyHashedRekordV002Body(\n entry: HashedRekordEntry,\n bundle: SigstoreBundle,\n cert: X509Certificate,\n): void {\n const spec = (entry.spec as HashedRekordV002Spec).hashedRekordV002;\n if (!bundle.messageSignature) {\n throw new Error(\"Bundle missing messageSignature for hashedrekord v0.0.2 entry\");\n }\n assertLoggedCertificate(cert, spec?.signature?.verifier?.x509Certificate?.rawBytes, false);\n\n // NOTE: HashedRekord v0.0.2 uses single base64 encoding (unlike intoto which is double-encoded)\n // Verified against Sigstore conformance test suite bundles\n const tlogSig = spec.signature.content || \"\";\n const tlogSigBytes = base64ToUint8Array(tlogSig);\n const bundleSigBytes = base64ToUint8Array(bundle.messageSignature.signature);\n\n if (!uint8ArrayEqual(tlogSigBytes, bundleSigBytes)) {\n throw new Error(\"Signature mismatch between TLog entry and bundle (v0.0.2)\");\n }\n\n const tlogDigest = spec.data.digest || \"\";\n const tlogDigestBytes = base64ToUint8Array(tlogDigest);\n const bundleDigestBytes = base64ToUint8Array(\n bundle.messageSignature.messageDigest.digest\n );\n\n if (!uint8ArrayEqual(tlogDigestBytes, bundleDigestBytes)) {\n throw new Error(\"Digest mismatch between TLog entry and bundle (v0.0.2)\");\n }\n}\n"]}
|
package/dist/tlog/intoto.d.ts
CHANGED
|
@@ -1,4 +1,4 @@
|
|
|
1
1
|
import type { SigstoreBundle } from "../bundle.js";
|
|
2
|
-
import type {
|
|
3
|
-
|
|
4
|
-
|
|
2
|
+
import type { X509Certificate } from "../x509/cert.js";
|
|
3
|
+
import { type RekorEntry } from "./body.js";
|
|
4
|
+
export declare function verifyIntotoBody(entry: RekorEntry, bundle: SigstoreBundle, cert: X509Certificate): Promise<void>;
|
package/dist/tlog/intoto.js
CHANGED
|
@@ -11,7 +11,8 @@
|
|
|
11
11
|
*/
|
|
12
12
|
import { base64Decode, base64ToUint8Array, hexToUint8Array, uint8ArrayEqual } from "@freedomofpress/crypto-browser";
|
|
13
13
|
import { getHashAlgorithm } from "../interfaces.js";
|
|
14
|
-
|
|
14
|
+
import { assertLoggedCertificate } from "./body.js";
|
|
15
|
+
export async function verifyIntotoBody(entry, bundle, cert) {
|
|
15
16
|
const intotoEntry = entry;
|
|
16
17
|
if (intotoEntry.apiVersion !== "0.0.2") {
|
|
17
18
|
throw new Error(`Unsupported intoto version: ${intotoEntry.apiVersion}`);
|
|
@@ -23,6 +24,7 @@ export async function verifyIntotoBody(entry, bundle) {
|
|
|
23
24
|
if (!tlogEnvelope.signatures || tlogEnvelope.signatures.length !== 1) {
|
|
24
25
|
throw new Error("Intoto entry must have exactly one signature");
|
|
25
26
|
}
|
|
27
|
+
assertLoggedCertificate(cert, tlogEnvelope.signatures[0].publicKey, true);
|
|
26
28
|
// The signature in the intoto tlog entry is double-base64-encoded:
|
|
27
29
|
// 1. Raw signature bytes are base64-encoded (normal)
|
|
28
30
|
// 2. That base64 string is base64-encoded again (for storage in JSON)
|
package/dist/tlog/intoto.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"intoto.js","sourceRoot":"","sources":["../../src/tlog/intoto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;
|
|
1
|
+
{"version":3,"file":"intoto.js","sourceRoot":"","sources":["../../src/tlog/intoto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAGpH,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEpD,OAAO,EAAE,uBAAuB,EAAmB,MAAM,WAAW,CAAC;AAiCrE,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAAiB,EACjB,MAAsB,EACtB,IAAqB;IAErB,MAAM,WAAW,GAAG,KAAoB,CAAC;IAEzC,IAAI,WAAW,CAAC,UAAU,KAAK,OAAO,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CACb,+BAA+B,WAAW,CAAC,UAAU,EAAE,CACxD,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IAED,MAAM,YAAY,GAAG,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;IAEvD,IAAI,CAAC,YAAY,CAAC,UAAU,IAAI,YAAY,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,uBAAuB,CAAC,IAAI,EAAE,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAE1E,mEAAmE;IACnE,qDAAqD;IACrD,sEAAsE;IACtE,0DAA0D;IAC1D,MAAM,aAAa,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACrD,MAAM,cAAc,GAAG,YAAY,CAAC,aAAa,CAAC,CAAC,CAAC,+DAA+D;IACnH,MAAM,YAAY,GAAG,kBAAkB,CAAC,cAAc,CAAC,CAAC,CAAC,4CAA4C;IAErG,IAAI,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IAED,MAAM,cAAc,GAAG,kBAAkB,CAAC,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAEjF,IAAI,CAAC,eAAe,CAAC,YAAY,EAAE,cAAc,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IAED,IAAI,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QACzC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,SAAS,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAChE,CAAC;QAED,MAAM,OAAO,GAAG,gBAAgB,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QACjF,MAAM,aAAa,GAAG,eAAe,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAElF,MAAM,YAAY,GAAG,kBAAkB,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QACrE,MAAM,eAAe,GAAG,IAAI,UAAU,CACpC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,YAA4B,CAAC,CAClE,CAAC;QAEF,IAAI,CAAC,eAAe,CAAC,aAAa,EAAE,eAAe,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;AACH,CAAC","sourcesContent":["/*\n * Intoto transparency log entry verification\n *\n * Based on sigstore-js:\n * https://github.com/sigstore/sigstore-js/blob/main/packages/verify/src/tlog/intoto.ts\n *\n * Key differences from sigstore-js:\n * - Browser-compatible: uses Uint8Array instead of Buffer for binary data\n * - Direct bundle field comparison instead of SignatureContent abstraction\n * - Uses crypto.subtle.digest for hash computation instead of Node.js crypto\n */\n\nimport { base64Decode, base64ToUint8Array, hexToUint8Array, uint8ArrayEqual } from \"@freedomofpress/crypto-browser\";\n\nimport type { SigstoreBundle } from \"../bundle.js\";\nimport { getHashAlgorithm } from \"../interfaces.js\";\nimport type { X509Certificate } from \"../x509/cert.js\";\nimport { assertLoggedCertificate, type RekorEntry } from \"./body.js\";\n\ninterface IntotoEnvelope {\n payload: string;\n payloadType: string;\n signatures: Array<{\n keyid?: string;\n sig: string;\n publicKey?: string;\n }>;\n}\n\ninterface IntotoSpec {\n content: {\n envelope: IntotoEnvelope;\n hash?: {\n algorithm: string;\n value: string;\n };\n payloadHash?: {\n algorithm: string;\n value: string;\n };\n };\n publicKey?: string;\n}\n\ninterface IntotoEntry extends RekorEntry {\n apiVersion: \"0.0.2\";\n kind: \"intoto\";\n spec: IntotoSpec;\n}\n\nexport async function verifyIntotoBody(\n entry: RekorEntry,\n bundle: SigstoreBundle,\n cert: X509Certificate,\n): Promise<void> {\n const intotoEntry = entry as IntotoEntry;\n\n if (intotoEntry.apiVersion !== \"0.0.2\") {\n throw new Error(\n `Unsupported intoto version: ${intotoEntry.apiVersion}`\n );\n }\n\n if (!bundle.dsseEnvelope) {\n throw new Error(\"Bundle missing dsseEnvelope for intoto entry\");\n }\n\n const tlogEnvelope = intotoEntry.spec.content.envelope;\n\n if (!tlogEnvelope.signatures || tlogEnvelope.signatures.length !== 1) {\n throw new Error(\"Intoto entry must have exactly one signature\");\n }\n assertLoggedCertificate(cert, tlogEnvelope.signatures[0].publicKey, true);\n\n // The signature in the intoto tlog entry is double-base64-encoded:\n // 1. Raw signature bytes are base64-encoded (normal)\n // 2. That base64 string is base64-encoded again (for storage in JSON)\n // So we decode twice: base64 -> string -> base64 -> bytes\n const tlogSigBase64 = tlogEnvelope.signatures[0].sig;\n const tlogSigDecoded = base64Decode(tlogSigBase64); // First decode: base64 -> UTF-8 string (which contains base64)\n const tlogSigBytes = base64ToUint8Array(tlogSigDecoded); // Second decode: base64 string -> raw bytes\n\n if (bundle.dsseEnvelope.signatures.length === 0) {\n throw new Error(\"Bundle DSSE envelope missing signatures\");\n }\n\n const bundleSigBytes = base64ToUint8Array(bundle.dsseEnvelope.signatures[0].sig);\n\n if (!uint8ArrayEqual(tlogSigBytes, bundleSigBytes)) {\n throw new Error(\"Intoto signature mismatch between TLog entry and bundle\");\n }\n\n if (intotoEntry.spec.content.payloadHash) {\n if (!intotoEntry.spec.content.payloadHash.algorithm) {\n throw new Error(\"Intoto entry missing payloadHash algorithm\");\n }\n\n const hashAlg = getHashAlgorithm(intotoEntry.spec.content.payloadHash.algorithm);\n const tlogHashBytes = hexToUint8Array(intotoEntry.spec.content.payloadHash.value);\n\n const payloadBytes = base64ToUint8Array(bundle.dsseEnvelope.payload);\n const bundleHashBytes = new Uint8Array(\n await crypto.subtle.digest(hashAlg, payloadBytes as BufferSource)\n );\n\n if (!uint8ArrayEqual(tlogHashBytes, bundleHashBytes)) {\n throw new Error(\"Intoto payload hash mismatch between TLog entry and bundle\");\n }\n }\n}\n"]}
|
package/dist/tlog/merkle.d.ts
CHANGED
package/dist/tlog/merkle.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"merkle.js","sourceRoot":"","sources":["../../src/tlog/merkle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;EASE;AACF,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;
|
|
1
|
+
{"version":3,"file":"merkle.js","sourceRoot":"","sources":["../../src/tlog/merkle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;EASE;AACF,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAGrF,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAElD,MAAM,wBAAwB,GAAG,IAAI,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AACxD,MAAM,wBAAwB,GAAG,IAAI,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AAExD,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,KAAgB;IAEhB,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC7C,CAAC;IAED,MAAM,cAAc,GAAG,KAAK,CAAC,cAAc,CAAC;IAC5C,MAAM,QAAQ,GAAG,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IAEjD,IAAI,QAAQ,GAAG,EAAE,IAAI,QAAQ,IAAI,QAAQ,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,sBAAsB,QAAQ,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,wEAAwE;IACxE,QAAQ;IACR,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAE9D,IAAI,cAAc,CAAC,MAAM,CAAC,MAAM,KAAK,KAAK,GAAG,MAAM,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IAED,MAAM,WAAW,GAAG,cAAc,CAAC,MAAM;SACtC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC;SACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC;IACrC,MAAM,YAAY,GAAG,cAAc,CAAC,MAAM;SACvC,KAAK,CAAC,KAAK,CAAC;SACZ,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC;IAErC,oCAAoC;IACpC,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,kBAAkB,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAE7E,8DAA8D;IAC9D,MAAM,cAAc,GAAG,MAAM,gBAAgB,CAC3C,MAAM,UAAU,CAAC,QAAQ,EAAE,WAAW,EAAE,QAAQ,CAAC,EACjD,YAAY,CACb,CAAC;IAEF,MAAM,QAAQ,GAAG,kBAAkB,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IAE7D,oEAAoE;IACpE,IAAI,CAAC,eAAe,CAAC,cAAc,EAAE,QAAQ,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,2EAA2E;AAC3E,6EAA6E;AAC7E,SAAS;AACT,SAAS,eAAe,CACtB,KAAa,EACb,IAAY;IAEZ,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACjD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AAC3B,CAAC;AAED,0EAA0E;AAC1E,4EAA4E;AAC5E,mEAAmE;AACnE,KAAK,UAAU,UAAU,CACvB,IAAgB,EAChB,MAAoB,EACpB,KAAa;IAEb,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;YACrC,GAAG,GAAG,MAAM,YAAY,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACnC,CAAC;aAAM,CAAC;YACN,GAAG,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,mEAAmE;AACnE,KAAK,UAAU,gBAAgB,CAC7B,IAAgB,EAChB,MAAoB;IAEpB,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,GAAG,GAAG,MAAM,YAAY,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,cAAc,CAAC,KAAa,EAAE,IAAY;IACjD,OAAO,SAAS,CAAC,KAAK,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED,8EAA8E;AAC9E,+CAA+C;AAC/C,SAAS,SAAS,CAAC,GAAW;IAC5B,OAAO,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;AAC/C,CAAC;AAED,0EAA0E;AAC1E,SAAS,SAAS,CAAC,CAAS;IAC1B,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;QACb,OAAO,CAAC,CAAC;IACX,CAAC;IACD,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;AAC9B,CAAC;AAED,sCAAsC;AACtC,0DAA0D;AAC1D,KAAK,UAAU,YAAY,CACzB,IAAgB,EAChB,KAAiB;IAEjB,MAAM,IAAI,GAAG,IAAI,UAAU,CACzB,wBAAwB,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAC7D,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,wBAAwB,EAAE,CAAC,CAAC,CAAC;IACtC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,wBAAwB,CAAC,MAAM,CAAC,CAAC;IAChD,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,wBAAwB,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAE/D,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,IAAoB,CAAC,CAAC;IACrF,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;AAC9B,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAgB;IACtC,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,wBAAwB,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3E,IAAI,CAAC,GAAG,CAAC,wBAAwB,EAAE,CAAC,CAAC,CAAC;IACtC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,wBAAwB,CAAC,MAAM,CAAC,CAAC;IAEhD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,IAAoB,CAAC,CAAC;IACrF,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;AAC9B,CAAC","sourcesContent":["/*\nAdapted from sigstore-js for browser compatibility:\nhttps://github.com/sigstore/sigstore-js/blob/main/packages/verify/src/timestamp/merkle.ts\n\nKey differences:\n- Uses Uint8Array instead of Buffer\n- Uses async Web Crypto API (crypto.subtle.digest) instead of sync Node.js crypto\n- Base64 decoding via custom base64ToUint8Array instead of Buffer.from\n- uint8ArrayEqual from crypto-browser instead of Node.js crypto.timingSafeEqual\n*/\nimport { base64ToUint8Array, uint8ArrayEqual } from \"@freedomofpress/crypto-browser\";\n\nimport type { TLogEntry } from \"../bundle.js\";\nimport { HashAlgorithms } from \"../interfaces.js\";\n\nconst RFC6962_LEAF_HASH_PREFIX = new Uint8Array([0x00]);\nconst RFC6962_NODE_HASH_PREFIX = new Uint8Array([0x01]);\n\nexport async function verifyMerkleInclusion(\n entry: TLogEntry\n): Promise<void> {\n if (!entry.inclusionProof) {\n throw new Error(\"Missing inclusion proof\");\n }\n\n const inclusionProof = entry.inclusionProof;\n const logIndex = BigInt(inclusionProof.logIndex);\n const treeSize = BigInt(inclusionProof.treeSize);\n\n if (logIndex < 0n || logIndex >= treeSize) {\n throw new Error(`Invalid log index: ${logIndex}`);\n }\n\n // Figure out which subset of hashes corresponds to the inner and border\n // nodes\n const { inner, border } = decompInclProof(logIndex, treeSize);\n\n if (inclusionProof.hashes.length !== inner + border) {\n throw new Error(\"Invalid hash count in inclusion proof\");\n }\n\n const innerHashes = inclusionProof.hashes\n .slice(0, inner)\n .map((h) => base64ToUint8Array(h));\n const borderHashes = inclusionProof.hashes\n .slice(inner)\n .map((h) => base64ToUint8Array(h));\n\n // The entry's hash is the leaf hash\n const leafHash = await hashLeaf(base64ToUint8Array(entry.canonicalizedBody));\n\n // Chain the hashes belonging to the inner and border portions\n const calculatedHash = await chainBorderRight(\n await chainInner(leafHash, innerHashes, logIndex),\n borderHashes\n );\n\n const rootHash = base64ToUint8Array(inclusionProof.rootHash);\n\n // Calculated hash should match the root hash in the inclusion proof\n if (!uint8ArrayEqual(calculatedHash, rootHash)) {\n throw new Error(\"Calculated root hash does not match inclusion proof\");\n }\n}\n\n// Breaks down inclusion proof for a leaf at the specified index in a tree of\n// the specified size. The split point is where paths to the index leaf and\n// the (size - 1) leaf diverge. Returns lengths of the bottom and upper proof\n// parts.\nfunction decompInclProof(\n index: bigint,\n size: bigint\n): { inner: number; border: number } {\n const inner = innerProofSize(index, size);\n const border = onesCount(index >> BigInt(inner));\n return { inner, border };\n}\n\n// Computes a subtree hash for a node on or below the tree's right border.\n// Assumes the provided proof hashes are ordered from lower to higher levels\n// and seed is the initial hash of the node specified by the index.\nasync function chainInner(\n seed: Uint8Array,\n hashes: Uint8Array[],\n index: bigint\n): Promise<Uint8Array> {\n let acc = seed;\n for (let i = 0; i < hashes.length; i++) {\n const h = hashes[i];\n if ((index >> BigInt(i)) & BigInt(1)) {\n acc = await hashChildren(h, acc);\n } else {\n acc = await hashChildren(acc, h);\n }\n }\n return acc;\n}\n\n// Computes a subtree hash for nodes along the tree's right border.\nasync function chainBorderRight(\n seed: Uint8Array,\n hashes: Uint8Array[]\n): Promise<Uint8Array> {\n let acc = seed;\n for (const h of hashes) {\n acc = await hashChildren(h, acc);\n }\n return acc;\n}\n\nfunction innerProofSize(index: bigint, size: bigint): number {\n return bitLength(index ^ (size - BigInt(1)));\n}\n\n// Counts the number of ones in the binary representation of the given number.\n// https://en.wikipedia.org/wiki/Hamming_weight\nfunction onesCount(num: bigint): number {\n return num.toString(2).split(\"1\").length - 1;\n}\n\n// Returns the number of bits necessary to represent an integer in binary.\nfunction bitLength(n: bigint): number {\n if (n === 0n) {\n return 0;\n }\n return n.toString(2).length;\n}\n\n// Hashing logic according to RFC6962.\n// https://datatracker.ietf.org/doc/html/rfc6962#section-2\nasync function hashChildren(\n left: Uint8Array,\n right: Uint8Array\n): Promise<Uint8Array> {\n const data = new Uint8Array(\n RFC6962_NODE_HASH_PREFIX.length + left.length + right.length\n );\n data.set(RFC6962_NODE_HASH_PREFIX, 0);\n data.set(left, RFC6962_NODE_HASH_PREFIX.length);\n data.set(right, RFC6962_NODE_HASH_PREFIX.length + left.length);\n\n const hash = await crypto.subtle.digest(HashAlgorithms.SHA256, data as BufferSource);\n return new Uint8Array(hash);\n}\n\nasync function hashLeaf(leaf: Uint8Array): Promise<Uint8Array> {\n const data = new Uint8Array(RFC6962_LEAF_HASH_PREFIX.length + leaf.length);\n data.set(RFC6962_LEAF_HASH_PREFIX, 0);\n data.set(leaf, RFC6962_LEAF_HASH_PREFIX.length);\n\n const hash = await crypto.subtle.digest(HashAlgorithms.SHA256, data as BufferSource);\n return new Uint8Array(hash);\n}\n"]}
|
package/dist/trust/tuf-root.d.ts
CHANGED
|
@@ -1,3 +1,2 @@
|
|
|
1
1
|
declare const _default: "ewogInNpZ25hdHVyZXMiOiBbCiAgewogICAia2V5aWQiOiAiNmYyNjAwODlkNTkyM2RhZjIwMTY2Y2E2NTdjNTQzYWY2MTgzNDZhYjk3MTg4NGE5OTk2MmIwMTk4OGJiZTBjMyIsCiAgICJzaWciOiAiIgogIH0sCiAgewogICAia2V5aWQiOiAiZTcxYTU0ZDU0MzgzNWJhODZhZGFkOTQ2MDM3OWM3NjQxZmI4NzI2ZDE2NGVhNzY2ODAxYTFjNTIyYWJhN2VhMiIsCiAgICJzaWciOiAiMzA0NTAyMjEwMGJiZGRkNDY0ZjgwNjZjZWI4OGJhNzg3Mzc1YzEyY2Q2MzMwNjgwZTA4YzI5MTA3MDNlNjUzOGM3MWNjNzlhZDIwMjIwNTE5MGIwNmU0NTM3ZmU5NjFiM2VmODFmZTY4ZWRjZDAwODljMTlmOTE5YWZlZDQyM2I5YWFmZDcwMDY0MTE1MyIKICB9LAogIHsKICAgImtleWlkIjogIjIyZjRjYWVjNmQ4ZTZmOTU1NWFmNjZiM2Q0YzNjYjA2YTNiYjIzZmRjN2UzOWM5MTZjNjFmNDYyZTZmNTJiMDYiLAogICAic2lnIjogIjMwNDQwMjIwNjkzMDZjZDUyNTdmNzMyYTc0MGMxYWZlNjBhOGU0MzNjNWRlNThlYWZlYWRiZTk5YzMzNmM5YzcxZDE5OGNmODAyMjAwZDc3Mzk1M2FlN2RiYzQ4ZDNlNWJhZDlhNmY2NGJhZmZmMTk2YjdlMmFkNGE1MmExOTUxOTM2N2Q0N2RjMDQyIgogIH0sCiAgewogICAia2V5aWQiOiAiNjE2NDM4MzgxMjViNDQwYjQwZGI2OTQyZjVjYjVhMzFjMGRjMDQzNjgzMTZlYjJhYWE1OGI5NTkwNGE1ODIyMiIsCiAgICJzaWciOiAiMzA0NDAyMjA0ZDIxYTJlYzgwZGY2NmU2MWY2ZmUyOTEyOTUxZGM0N2RmODM2MDM2ZjhjMGFiMTA4MTZkMzc1ZTcxZGJmNzllMDIyMDU0N2FkY2UxYWZkZjA0ZTY3OTRlZmEyMDNkZDUyNjRjNmY3ZTBlZjc4ZTU3ZmU5MzRiMGQyNmNiOTk0ZWVjNzYiCiAgfSwKICB7CiAgICJrZXlpZCI6ICJhNjg3ZTViZjRmYWI4MmIwZWU1OGQ0NmUwNWM5NTM1MTQ1YTJjOWFmYjQ1OGY0M2Q0MmI0NWNhMGZkY2UyYTcwIiwKICAgInNpZyI6ICIzMDQ1MDIyMDYwODI2NDk2NTU3MTQ0ZWIxNjQ5ODkzZWQ1ZjZmNGVhNTQ1MzZmZWIwY2E4MmY4Yjg5YWU2NDFiZTM5NzQzZTUwMjIxMDBhZDcxMThiNWU5ZDQ4MzczMjYyMDZlNDEyZmM2ZGEyOTk5OTI1ZDExMDMyOGE3YzE2NmIwNmM2MjQzMzZjOTNmIgogIH0sCiAgewogICAia2V5aWQiOiAiMTgzZTY0ZjM3NjcwZGMxM2NhMGQyODk5NWEzMDUzZjM3NDA5NTRkZGNlNDQzMjFhNDFlNDY1MzRjZjQ0ZTYzMiIsCiAgICJzaWciOiAiMzA0NjAyMjEwMGQ4MTc5NDM5YzJlNzNlYjBjMTczM2FiZWU3ZmFmODMyZGNhZWE3MjYzZWRjYjQ5MTk4OTFjM2EyNDdmMDU5MjMwMjIxMDBlMWE0MzdlMDc5N2U4MDNmOWI3MmRjOWQyZDkyMTU1YjBhMjI3MGMyNGVmZGQ1ZjRiM2E1ZDhmMGIwZjQzMWE3IgogIH0KIF0sCiAic2lnbmVkIjogewogICJfdHlwZSI6ICJyb290IiwKICAiY29uc2lzdGVudF9zbmFwc2hvdCI6IHRydWUsCiAgImV4cGlyZXMiOiAiMjAyNi0wMS0yMlQxMzowNTo1OVoiLAogICJrZXlzIjogewogICAiMGM4NzQzMmMzYmYwOWZkOTkxODlmZGMzMmZhNWVhZWRmNGU0YTVmYWM3YmFiNzNmYTA0YTJlMGZjNjRhZjZmNSI6IHsKICAgICJrZXlpZF9oYXNoX2FsZ29yaXRobXMiOiBbCiAgICAgInNoYTI1NiIsCiAgICAgInNoYTUxMiIKICAgIF0sCiAgICAia2V5dHlwZSI6ICJlY2RzYSIsCiAgICAia2V5dmFsIjogewogICAgICJwdWJsaWMiOiAiLS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS1cbk1Ga3dFd1lIS29aSXpqMENBUVlJS29aSXpqMERBUWNEUWdBRVdSaUdyNStqKzNKNVNzSCtadHI1bkUySDJ3TzdcbkJWK25PM3M5M2dMY2ExOHFUT3pIWTFvV3lBR0R5a01Tc0dUVUJTdDlEK0FuMEtmS3NEMm1mU000MlE9PVxuLS0tLS1FTkQgUFVCTElDIEtFWS0tLS0tXG4iCiAgICB9LAogICAgInNjaGVtZSI6ICJlY2RzYS1zaGEyLW5pc3RwMjU2IiwKICAgICJ4LXR1Zi1vbi1jaS1vbmxpbmUtdXJpIjogImdjcGttczpwcm9qZWN0cy9zaWdzdG9yZS1yb290LXNpZ25pbmcvbG9jYXRpb25zL2dsb2JhbC9rZXlSaW5ncy9yb290L2NyeXB0b0tleXMvdGltZXN0YW1wL2NyeXB0b0tleVZlcnNpb25zLzEiCiAgIH0sCiAgICIxODNlNjRmMzc2NzBkYzEzY2EwZDI4OTk1YTMwNTNmMzc0MDk1NGRkY2U0NDMyMWE0MWU0NjUzNGNmNDRlNjMyIjogewogICAgImtleXR5cGUiOiAiZWNkc2EiLAogICAgImtleXZhbCI6IHsKICAgICAicHVibGljIjogIi0tLS0tQkVHSU4gUFVCTElDIEtFWS0tLS0tXG5NRmt3RXdZSEtvWkl6ajBDQVFZSUtvWkl6ajBEQVFjRFFnQUVNeHBQT0pDSVo1b3RHNDEwNmZHSnNlRVFpM1Y5XG5wa01ZUTR1eVY5VGoxTTdXSFhJeUxHK2prZnZ1RzBnbFExSlpiUlpaQlYzZ0FSNHNvamRHSElTZW93PT1cbi0tLS0tRU5EIFBVQkxJQyBLRVktLS0tLVxuIgogICAgfSwKICAgICJzY2hlbWUiOiAiZWNkc2Etc2hhMi1uaXN0cDI1NiIsCiAgICAieC10dWYtb24tY2kta2V5b3duZXIiOiAiQGxhbmNlIgogICB9LAogICAiMjJmNGNhZWM2ZDhlNmY5NTU1YWY2NmIzZDRjM2NiMDZhM2JiMjNmZGM3ZTM5YzkxNmM2MWY0NjJlNmY1MmIwNiI6IHsKICAgICJrZXlpZF9oYXNoX2FsZ29yaXRobXMiOiBbCiAgICAgInNoYTI1NiIsCiAgICAgInNoYTUxMiIKICAgIF0sCiAgICAia2V5dHlwZSI6ICJlY2RzYSIsCiAgICAia2V5dmFsIjogewogICAgICJwdWJsaWMiOiAiLS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS1cbk1Ga3dFd1lIS29aSXpqMENBUVlJS29aSXpqMERBUWNEUWdBRXpCelZPbUhDUG9qTVZMU0kzNjRXaWlWOE5QckRcbjZJZ1J4Vmxpc2t6L3YreTNKRVI1bWNWR2NPTmxpRGNXTUM1SjJsZkhtalBOUGhiNEg3eG04THpmU0E9PVxuLS0tLS1FTkQgUFVCTElDIEtFWS0tLS0tXG4iCiAgICB9LAogICAgInNjaGVtZSI6ICJlY2RzYS1zaGEyLW5pc3RwMjU2IiwKICAgICJ4LXR1Zi1vbi1jaS1rZXlvd25lciI6ICJAc2FudGlhZ290b3JyZXMiCiAgIH0sCiAgICI2MTY0MzgzODEyNWI0NDBiNDBkYjY5NDJmNWNiNWEzMWMwZGMwNDM2ODMxNmViMmFhYTU4Yjk1OTA0YTU4MjIyIjogewogICAgImtleWlkX2hhc2hfYWxnb3JpdGhtcyI6IFsKICAgICAic2hhMjU2IiwKICAgICAic2hhNTEyIgogICAgXSwKICAgICJrZXl0eXBlIjogImVjZHNhIiwKICAgICJrZXl2YWwiOiB7CiAgICAgInB1YmxpYyI6ICItLS0tLUJFR0lOIFBVQkxJQyBLRVktLS0tLVxuTUZrd0V3WUhLb1pJemowQ0FRWUlLb1pJemowREFRY0RRZ0FFaW5pa1NzQVFtWWtOZUg1ZVlxL0NuSXpMYWFjT1xueGxTYWF3UURPd3FLeS90Q3F4cTV4eFBTSmMyMUs0V0loczlHeU9rS2Z6dWVZM0dJTHpjTUpaNGNXdz09XG4tLS0tLUVORCBQVUJMSUMgS0VZLS0tLS1cbiIKICAgIH0sCiAgICAic2NoZW1lIjogImVjZHNhLXNoYTItbmlzdHAyNTYiLAogICAgIngtdHVmLW9uLWNpLWtleW93bmVyIjogIkBib2JjYWxsYXdheSIKICAgfSwKICAgImE2ODdlNWJmNGZhYjgyYjBlZTU4ZDQ2ZTA1Yzk1MzUxNDVhMmM5YWZiNDU4ZjQzZDQyYjQ1Y2EwZmRjZTJhNzAiOiB7CiAgICAia2V5aWRfaGFzaF9hbGdvcml0aG1zIjogWwogICAgICJzaGEyNTYiLAogICAgICJzaGE1MTIiCiAgICBdLAogICAgImtleXR5cGUiOiAiZWNkc2EiLAogICAgImtleXZhbCI6IHsKICAgICAicHVibGljIjogIi0tLS0tQkVHSU4gUFVCTElDIEtFWS0tLS0tXG5NRmt3RXdZSEtvWkl6ajBDQVFZSUtvWkl6ajBEQVFjRFFnQUUwZ2hyaDkyTHcxWXIzaWRHVjVXcUN0TURCOEN4XG4rRDhoZEM0dzJaTE5JcGxWUm9WR0xza1lhM2doZU15T2ppSjhrUGkxNWFRMi8vN1Arb2o3VXZKUEd3PT1cbi0tLS0tRU5EIFBVQkxJQyBLRVktLS0tLVxuIgogICAgfSwKICAgICJzY2hlbWUiOiAiZWNkc2Etc2hhMi1uaXN0cDI1NiIsCiAgICAieC10dWYtb24tY2kta2V5b3duZXIiOiAiQGpvc2h1YWdsIgogICB9LAogICAiZTcxYTU0ZDU0MzgzNWJhODZhZGFkOTQ2MDM3OWM3NjQxZmI4NzI2ZDE2NGVhNzY2ODAxYTFjNTIyYWJhN2VhMiI6IHsKICAgICJrZXlpZF9oYXNoX2FsZ29yaXRobXMiOiBbCiAgICAgInNoYTI1NiIsCiAgICAgInNoYTUxMiIKICAgIF0sCiAgICAia2V5dHlwZSI6ICJlY2RzYSIsCiAgICAia2V5dmFsIjogewogICAgICJwdWJsaWMiOiAiLS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS1cbk1Ga3dFd1lIS29aSXpqMENBUVlJS29aSXpqMERBUWNEUWdBRUVYc3ozU1pYRmI4ak1WNDJqNnBKbHlqYmpSOEtcbk4zQndvY2V4cTZMTUliNXFzV0tPUXZMTjE2TlVlZkxjNEhzd09vdW1Sc1ZWYWFqU3BRUzZmb2JrUnc9PVxuLS0tLS1FTkQgUFVCTElDIEtFWS0tLS0tXG4iCiAgICB9LAogICAgInNjaGVtZSI6ICJlY2RzYS1zaGEyLW5pc3RwMjU2IiwKICAgICJ4LXR1Zi1vbi1jaS1rZXlvd25lciI6ICJAbW5tNjc4IgogICB9CiAgfSwKICAicm9sZXMiOiB7CiAgICJyb290IjogewogICAgImtleWlkcyI6IFsKICAgICAiZTcxYTU0ZDU0MzgzNWJhODZhZGFkOTQ2MDM3OWM3NjQxZmI4NzI2ZDE2NGVhNzY2ODAxYTFjNTIyYWJhN2VhMiIsCiAgICAgIjIyZjRjYWVjNmQ4ZTZmOTU1NWFmNjZiM2Q0YzNjYjA2YTNiYjIzZmRjN2UzOWM5MTZjNjFmNDYyZTZmNTJiMDYiLAogICAgICI2MTY0MzgzODEyNWI0NDBiNDBkYjY5NDJmNWNiNWEzMWMwZGMwNDM2ODMxNmViMmFhYTU4Yjk1OTA0YTU4MjIyIiwKICAgICAiYTY4N2U1YmY0ZmFiODJiMGVlNThkNDZlMDVjOTUzNTE0NWEyYzlhZmI0NThmNDNkNDJiNDVjYTBmZGNlMmE3MCIsCiAgICAgIjE4M2U2NGYzNzY3MGRjMTNjYTBkMjg5OTVhMzA1M2YzNzQwOTU0ZGRjZTQ0MzIxYTQxZTQ2NTM0Y2Y0NGU2MzIiCiAgICBdLAogICAgInRocmVzaG9sZCI6IDMKICAgfSwKICAgInNuYXBzaG90IjogewogICAgImtleWlkcyI6IFsKICAgICAiMGM4NzQzMmMzYmYwOWZkOTkxODlmZGMzMmZhNWVhZWRmNGU0YTVmYWM3YmFiNzNmYTA0YTJlMGZjNjRhZjZmNSIKICAgIF0sCiAgICAidGhyZXNob2xkIjogMSwKICAgICJ4LXR1Zi1vbi1jaS1leHBpcnktcGVyaW9kIjogMzY1MCwKICAgICJ4LXR1Zi1vbi1jaS1zaWduaW5nLXBlcmlvZCI6IDM2NQogICB9LAogICAidGFyZ2V0cyI6IHsKICAgICJrZXlpZHMiOiBbCiAgICAgImU3MWE1NGQ1NDM4MzViYTg2YWRhZDk0NjAzNzljNzY0MWZiODcyNmQxNjRlYTc2NjgwMWExYzUyMmFiYTdlYTIiLAogICAgICIyMmY0Y2FlYzZkOGU2Zjk1NTVhZjY2YjNkNGMzY2IwNmEzYmIyM2ZkYzdlMzljOTE2YzYxZjQ2MmU2ZjUyYjA2IiwKICAgICAiNjE2NDM4MzgxMjViNDQwYjQwZGI2OTQyZjVjYjVhMzFjMGRjMDQzNjgzMTZlYjJhYWE1OGI5NTkwNGE1ODIyMiIsCiAgICAgImE2ODdlNWJmNGZhYjgyYjBlZTU4ZDQ2ZTA1Yzk1MzUxNDVhMmM5YWZiNDU4ZjQzZDQyYjQ1Y2EwZmRjZTJhNzAiLAogICAgICIxODNlNjRmMzc2NzBkYzEzY2EwZDI4OTk1YTMwNTNmMzc0MDk1NGRkY2U0NDMyMWE0MWU0NjUzNGNmNDRlNjMyIgogICAgXSwKICAgICJ0aHJlc2hvbGQiOiAzCiAgIH0sCiAgICJ0aW1lc3RhbXAiOiB7CiAgICAia2V5aWRzIjogWwogICAgICIwYzg3NDMyYzNiZjA5ZmQ5OTE4OWZkYzMyZmE1ZWFlZGY0ZTRhNWZhYzdiYWI3M2ZhMDRhMmUwZmM2NGFmNmY1IgogICAgXSwKICAgICJ0aHJlc2hvbGQiOiAxLAogICAgIngtdHVmLW9uLWNpLWV4cGlyeS1wZXJpb2QiOiA3LAogICAgIngtdHVmLW9uLWNpLXNpZ25pbmctcGVyaW9kIjogNgogICB9CiAgfSwKICAic3BlY192ZXJzaW9uIjogIjEuMCIsCiAgInZlcnNpb24iOiAxMywKICAieC10dWYtb24tY2ktZXhwaXJ5LXBlcmlvZCI6IDE5NywKICAieC10dWYtb24tY2ktc2lnbmluZy1wZXJpb2QiOiA0NgogfQp9";
|
|
2
2
|
export default _default;
|
|
3
|
-
//# sourceMappingURL=tuf-root.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"tuf-root.js","sourceRoot":"","sources":["../../src/trust/tuf-root.ts"],"names":[],"mappings":"AAAA,0DAA0D;AAC1D,8DAA8D;AAC9D,eAAe,09OAA09O,CAAC"}
|
|
1
|
+
{"version":3,"file":"tuf-root.js","sourceRoot":"","sources":["../../src/trust/tuf-root.ts"],"names":[],"mappings":"AAAA,0DAA0D;AAC1D,8DAA8D;AAC9D,eAAe,09OAA09O,CAAC","sourcesContent":["// Embedded TUF root metadata (base64-encoded 1.root.json)\n// This is the root of trust for bootstrapping the TUF client.\nexport default \"ewogInNpZ25hdHVyZXMiOiBbCiAgewogICAia2V5aWQiOiAiNmYyNjAwODlkNTkyM2RhZjIwMTY2Y2E2NTdjNTQzYWY2MTgzNDZhYjk3MTg4NGE5OTk2MmIwMTk4OGJiZTBjMyIsCiAgICJzaWciOiAiIgogIH0sCiAgewogICAia2V5aWQiOiAiZTcxYTU0ZDU0MzgzNWJhODZhZGFkOTQ2MDM3OWM3NjQxZmI4NzI2ZDE2NGVhNzY2ODAxYTFjNTIyYWJhN2VhMiIsCiAgICJzaWciOiAiMzA0NTAyMjEwMGJiZGRkNDY0ZjgwNjZjZWI4OGJhNzg3Mzc1YzEyY2Q2MzMwNjgwZTA4YzI5MTA3MDNlNjUzOGM3MWNjNzlhZDIwMjIwNTE5MGIwNmU0NTM3ZmU5NjFiM2VmODFmZTY4ZWRjZDAwODljMTlmOTE5YWZlZDQyM2I5YWFmZDcwMDY0MTE1MyIKICB9LAogIHsKICAgImtleWlkIjogIjIyZjRjYWVjNmQ4ZTZmOTU1NWFmNjZiM2Q0YzNjYjA2YTNiYjIzZmRjN2UzOWM5MTZjNjFmNDYyZTZmNTJiMDYiLAogICAic2lnIjogIjMwNDQwMjIwNjkzMDZjZDUyNTdmNzMyYTc0MGMxYWZlNjBhOGU0MzNjNWRlNThlYWZlYWRiZTk5YzMzNmM5YzcxZDE5OGNmODAyMjAwZDc3Mzk1M2FlN2RiYzQ4ZDNlNWJhZDlhNmY2NGJhZmZmMTk2YjdlMmFkNGE1MmExOTUxOTM2N2Q0N2RjMDQyIgogIH0sCiAgewogICAia2V5aWQiOiAiNjE2NDM4MzgxMjViNDQwYjQwZGI2OTQyZjVjYjVhMzFjMGRjMDQzNjgzMTZlYjJhYWE1OGI5NTkwNGE1ODIyMiIsCiAgICJzaWciOiAiMzA0NDAyMjA0ZDIxYTJlYzgwZGY2NmU2MWY2ZmUyOTEyOTUxZGM0N2RmODM2MDM2ZjhjMGFiMTA4MTZkMzc1ZTcxZGJmNzllMDIyMDU0N2FkY2UxYWZkZjA0ZTY3OTRlZmEyMDNkZDUyNjRjNmY3ZTBlZjc4ZTU3ZmU5MzRiMGQyNmNiOTk0ZWVjNzYiCiAgfSwKICB7CiAgICJrZXlpZCI6ICJhNjg3ZTViZjRmYWI4MmIwZWU1OGQ0NmUwNWM5NTM1MTQ1YTJjOWFmYjQ1OGY0M2Q0MmI0NWNhMGZkY2UyYTcwIiwKICAgInNpZyI6ICIzMDQ1MDIyMDYwODI2NDk2NTU3MTQ0ZWIxNjQ5ODkzZWQ1ZjZmNGVhNTQ1MzZmZWIwY2E4MmY4Yjg5YWU2NDFiZTM5NzQzZTUwMjIxMDBhZDcxMThiNWU5ZDQ4MzczMjYyMDZlNDEyZmM2ZGEyOTk5OTI1ZDExMDMyOGE3YzE2NmIwNmM2MjQzMzZjOTNmIgogIH0sCiAgewogICAia2V5aWQiOiAiMTgzZTY0ZjM3NjcwZGMxM2NhMGQyODk5NWEzMDUzZjM3NDA5NTRkZGNlNDQzMjFhNDFlNDY1MzRjZjQ0ZTYzMiIsCiAgICJzaWciOiAiMzA0NjAyMjEwMGQ4MTc5NDM5YzJlNzNlYjBjMTczM2FiZWU3ZmFmODMyZGNhZWE3MjYzZWRjYjQ5MTk4OTFjM2EyNDdmMDU5MjMwMjIxMDBlMWE0MzdlMDc5N2U4MDNmOWI3MmRjOWQyZDkyMTU1YjBhMjI3MGMyNGVmZGQ1ZjRiM2E1ZDhmMGIwZjQzMWE3IgogIH0KIF0sCiAic2lnbmVkIjogewogICJfdHlwZSI6ICJyb290IiwKICAiY29uc2lzdGVudF9zbmFwc2hvdCI6IHRydWUsCiAgImV4cGlyZXMiOiAiMjAyNi0wMS0yMlQxMzowNTo1OVoiLAogICJrZXlzIjogewogICAiMGM4NzQzMmMzYmYwOWZkOTkxODlmZGMzMmZhNWVhZWRmNGU0YTVmYWM3YmFiNzNmYTA0YTJlMGZjNjRhZjZmNSI6IHsKICAgICJrZXlpZF9oYXNoX2FsZ29yaXRobXMiOiBbCiAgICAgInNoYTI1NiIsCiAgICAgInNoYTUxMiIKICAgIF0sCiAgICAia2V5dHlwZSI6ICJlY2RzYSIsCiAgICAia2V5dmFsIjogewogICAgICJwdWJsaWMiOiAiLS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS1cbk1Ga3dFd1lIS29aSXpqMENBUVlJS29aSXpqMERBUWNEUWdBRVdSaUdyNStqKzNKNVNzSCtadHI1bkUySDJ3TzdcbkJWK25PM3M5M2dMY2ExOHFUT3pIWTFvV3lBR0R5a01Tc0dUVUJTdDlEK0FuMEtmS3NEMm1mU000MlE9PVxuLS0tLS1FTkQgUFVCTElDIEtFWS0tLS0tXG4iCiAgICB9LAogICAgInNjaGVtZSI6ICJlY2RzYS1zaGEyLW5pc3RwMjU2IiwKICAgICJ4LXR1Zi1vbi1jaS1vbmxpbmUtdXJpIjogImdjcGttczpwcm9qZWN0cy9zaWdzdG9yZS1yb290LXNpZ25pbmcvbG9jYXRpb25zL2dsb2JhbC9rZXlSaW5ncy9yb290L2NyeXB0b0tleXMvdGltZXN0YW1wL2NyeXB0b0tleVZlcnNpb25zLzEiCiAgIH0sCiAgICIxODNlNjRmMzc2NzBkYzEzY2EwZDI4OTk1YTMwNTNmMzc0MDk1NGRkY2U0NDMyMWE0MWU0NjUzNGNmNDRlNjMyIjogewogICAgImtleXR5cGUiOiAiZWNkc2EiLAogICAgImtleXZhbCI6IHsKICAgICAicHVibGljIjogIi0tLS0tQkVHSU4gUFVCTElDIEtFWS0tLS0tXG5NRmt3RXdZSEtvWkl6ajBDQVFZSUtvWkl6ajBEQVFjRFFnQUVNeHBQT0pDSVo1b3RHNDEwNmZHSnNlRVFpM1Y5XG5wa01ZUTR1eVY5VGoxTTdXSFhJeUxHK2prZnZ1RzBnbFExSlpiUlpaQlYzZ0FSNHNvamRHSElTZW93PT1cbi0tLS0tRU5EIFBVQkxJQyBLRVktLS0tLVxuIgogICAgfSwKICAgICJzY2hlbWUiOiAiZWNkc2Etc2hhMi1uaXN0cDI1NiIsCiAgICAieC10dWYtb24tY2kta2V5b3duZXIiOiAiQGxhbmNlIgogICB9LAogICAiMjJmNGNhZWM2ZDhlNmY5NTU1YWY2NmIzZDRjM2NiMDZhM2JiMjNmZGM3ZTM5YzkxNmM2MWY0NjJlNmY1MmIwNiI6IHsKICAgICJrZXlpZF9oYXNoX2FsZ29yaXRobXMiOiBbCiAgICAgInNoYTI1NiIsCiAgICAgInNoYTUxMiIKICAgIF0sCiAgICAia2V5dHlwZSI6ICJlY2RzYSIsCiAgICAia2V5dmFsIjogewogICAgICJwdWJsaWMiOiAiLS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS1cbk1Ga3dFd1lIS29aSXpqMENBUVlJS29aSXpqMERBUWNEUWdBRXpCelZPbUhDUG9qTVZMU0kzNjRXaWlWOE5QckRcbjZJZ1J4Vmxpc2t6L3YreTNKRVI1bWNWR2NPTmxpRGNXTUM1SjJsZkhtalBOUGhiNEg3eG04THpmU0E9PVxuLS0tLS1FTkQgUFVCTElDIEtFWS0tLS0tXG4iCiAgICB9LAogICAgInNjaGVtZSI6ICJlY2RzYS1zaGEyLW5pc3RwMjU2IiwKICAgICJ4LXR1Zi1vbi1jaS1rZXlvd25lciI6ICJAc2FudGlhZ290b3JyZXMiCiAgIH0sCiAgICI2MTY0MzgzODEyNWI0NDBiNDBkYjY5NDJmNWNiNWEzMWMwZGMwNDM2ODMxNmViMmFhYTU4Yjk1OTA0YTU4MjIyIjogewogICAgImtleWlkX2hhc2hfYWxnb3JpdGhtcyI6IFsKICAgICAic2hhMjU2IiwKICAgICAic2hhNTEyIgogICAgXSwKICAgICJrZXl0eXBlIjogImVjZHNhIiwKICAgICJrZXl2YWwiOiB7CiAgICAgInB1YmxpYyI6ICItLS0tLUJFR0lOIFBVQkxJQyBLRVktLS0tLVxuTUZrd0V3WUhLb1pJemowQ0FRWUlLb1pJemowREFRY0RRZ0FFaW5pa1NzQVFtWWtOZUg1ZVlxL0NuSXpMYWFjT1xueGxTYWF3UURPd3FLeS90Q3F4cTV4eFBTSmMyMUs0V0loczlHeU9rS2Z6dWVZM0dJTHpjTUpaNGNXdz09XG4tLS0tLUVORCBQVUJMSUMgS0VZLS0tLS1cbiIKICAgIH0sCiAgICAic2NoZW1lIjogImVjZHNhLXNoYTItbmlzdHAyNTYiLAogICAgIngtdHVmLW9uLWNpLWtleW93bmVyIjogIkBib2JjYWxsYXdheSIKICAgfSwKICAgImE2ODdlNWJmNGZhYjgyYjBlZTU4ZDQ2ZTA1Yzk1MzUxNDVhMmM5YWZiNDU4ZjQzZDQyYjQ1Y2EwZmRjZTJhNzAiOiB7CiAgICAia2V5aWRfaGFzaF9hbGdvcml0aG1zIjogWwogICAgICJzaGEyNTYiLAogICAgICJzaGE1MTIiCiAgICBdLAogICAgImtleXR5cGUiOiAiZWNkc2EiLAogICAgImtleXZhbCI6IHsKICAgICAicHVibGljIjogIi0tLS0tQkVHSU4gUFVCTElDIEtFWS0tLS0tXG5NRmt3RXdZSEtvWkl6ajBDQVFZSUtvWkl6ajBEQVFjRFFnQUUwZ2hyaDkyTHcxWXIzaWRHVjVXcUN0TURCOEN4XG4rRDhoZEM0dzJaTE5JcGxWUm9WR0xza1lhM2doZU15T2ppSjhrUGkxNWFRMi8vN1Arb2o3VXZKUEd3PT1cbi0tLS0tRU5EIFBVQkxJQyBLRVktLS0tLVxuIgogICAgfSwKICAgICJzY2hlbWUiOiAiZWNkc2Etc2hhMi1uaXN0cDI1NiIsCiAgICAieC10dWYtb24tY2kta2V5b3duZXIiOiAiQGpvc2h1YWdsIgogICB9LAogICAiZTcxYTU0ZDU0MzgzNWJhODZhZGFkOTQ2MDM3OWM3NjQxZmI4NzI2ZDE2NGVhNzY2ODAxYTFjNTIyYWJhN2VhMiI6IHsKICAgICJrZXlpZF9oYXNoX2FsZ29yaXRobXMiOiBbCiAgICAgInNoYTI1NiIsCiAgICAgInNoYTUxMiIKICAgIF0sCiAgICAia2V5dHlwZSI6ICJlY2RzYSIsCiAgICAia2V5dmFsIjogewogICAgICJwdWJsaWMiOiAiLS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS1cbk1Ga3dFd1lIS29aSXpqMENBUVlJS29aSXpqMERBUWNEUWdBRUVYc3ozU1pYRmI4ak1WNDJqNnBKbHlqYmpSOEtcbk4zQndvY2V4cTZMTUliNXFzV0tPUXZMTjE2TlVlZkxjNEhzd09vdW1Sc1ZWYWFqU3BRUzZmb2JrUnc9PVxuLS0tLS1FTkQgUFVCTElDIEtFWS0tLS0tXG4iCiAgICB9LAogICAgInNjaGVtZSI6ICJlY2RzYS1zaGEyLW5pc3RwMjU2IiwKICAgICJ4LXR1Zi1vbi1jaS1rZXlvd25lciI6ICJAbW5tNjc4IgogICB9CiAgfSwKICAicm9sZXMiOiB7CiAgICJyb290IjogewogICAgImtleWlkcyI6IFsKICAgICAiZTcxYTU0ZDU0MzgzNWJhODZhZGFkOTQ2MDM3OWM3NjQxZmI4NzI2ZDE2NGVhNzY2ODAxYTFjNTIyYWJhN2VhMiIsCiAgICAgIjIyZjRjYWVjNmQ4ZTZmOTU1NWFmNjZiM2Q0YzNjYjA2YTNiYjIzZmRjN2UzOWM5MTZjNjFmNDYyZTZmNTJiMDYiLAogICAgICI2MTY0MzgzODEyNWI0NDBiNDBkYjY5NDJmNWNiNWEzMWMwZGMwNDM2ODMxNmViMmFhYTU4Yjk1OTA0YTU4MjIyIiwKICAgICAiYTY4N2U1YmY0ZmFiODJiMGVlNThkNDZlMDVjOTUzNTE0NWEyYzlhZmI0NThmNDNkNDJiNDVjYTBmZGNlMmE3MCIsCiAgICAgIjE4M2U2NGYzNzY3MGRjMTNjYTBkMjg5OTVhMzA1M2YzNzQwOTU0ZGRjZTQ0MzIxYTQxZTQ2NTM0Y2Y0NGU2MzIiCiAgICBdLAogICAgInRocmVzaG9sZCI6IDMKICAgfSwKICAgInNuYXBzaG90IjogewogICAgImtleWlkcyI6IFsKICAgICAiMGM4NzQzMmMzYmYwOWZkOTkxODlmZGMzMmZhNWVhZWRmNGU0YTVmYWM3YmFiNzNmYTA0YTJlMGZjNjRhZjZmNSIKICAgIF0sCiAgICAidGhyZXNob2xkIjogMSwKICAgICJ4LXR1Zi1vbi1jaS1leHBpcnktcGVyaW9kIjogMzY1MCwKICAgICJ4LXR1Zi1vbi1jaS1zaWduaW5nLXBlcmlvZCI6IDM2NQogICB9LAogICAidGFyZ2V0cyI6IHsKICAgICJrZXlpZHMiOiBbCiAgICAgImU3MWE1NGQ1NDM4MzViYTg2YWRhZDk0NjAzNzljNzY0MWZiODcyNmQxNjRlYTc2NjgwMWExYzUyMmFiYTdlYTIiLAogICAgICIyMmY0Y2FlYzZkOGU2Zjk1NTVhZjY2YjNkNGMzY2IwNmEzYmIyM2ZkYzdlMzljOTE2YzYxZjQ2MmU2ZjUyYjA2IiwKICAgICAiNjE2NDM4MzgxMjViNDQwYjQwZGI2OTQyZjVjYjVhMzFjMGRjMDQzNjgzMTZlYjJhYWE1OGI5NTkwNGE1ODIyMiIsCiAgICAgImE2ODdlNWJmNGZhYjgyYjBlZTU4ZDQ2ZTA1Yzk1MzUxNDVhMmM5YWZiNDU4ZjQzZDQyYjQ1Y2EwZmRjZTJhNzAiLAogICAgICIxODNlNjRmMzc2NzBkYzEzY2EwZDI4OTk1YTMwNTNmMzc0MDk1NGRkY2U0NDMyMWE0MWU0NjUzNGNmNDRlNjMyIgogICAgXSwKICAgICJ0aHJlc2hvbGQiOiAzCiAgIH0sCiAgICJ0aW1lc3RhbXAiOiB7CiAgICAia2V5aWRzIjogWwogICAgICIwYzg3NDMyYzNiZjA5ZmQ5OTE4OWZkYzMyZmE1ZWFlZGY0ZTRhNWZhYzdiYWI3M2ZhMDRhMmUwZmM2NGFmNmY1IgogICAgXSwKICAgICJ0aHJlc2hvbGQiOiAxLAogICAgIngtdHVmLW9uLWNpLWV4cGlyeS1wZXJpb2QiOiA3LAogICAgIngtdHVmLW9uLWNpLXNpZ25pbmctcGVyaW9kIjogNgogICB9CiAgfSwKICAic3BlY192ZXJzaW9uIjogIjEuMCIsCiAgInZlcnNpb24iOiAxMywKICAieC10dWYtb24tY2ktZXhwaXJ5LXBlcmlvZCI6IDE5NywKICAieC10dWYtb24tY2ktc2lnbmluZy1wZXJpb2QiOiA0NgogfQp9\";\n"]}
|
package/dist/trust/tuf.d.ts
CHANGED
package/dist/trust/tuf.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"tuf.js","sourceRoot":"","sources":["../../src/trust/tuf.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AAmDpE;;GAEG;AACH,MAAM,cAAc,GAAG;IACrB,WAAW,EAAE,oCAAoC;IACjD,aAAa,EAAE,4CAA4C;IAC3D,SAAS,EAAE,WAAW;IACtB,iBAAiB,EAAE,mBAAmB;IACtC,QAAQ,EAAE,OAAO,EAAE,SAAS;CAC7B,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,mBAAmB;IAa9B,YAAY,UAAsC,EAAE;QAClD,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,cAAc,CAAC,WAAW,CAAC;QACtE,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,WAAW,GAAG,CAAC;QAC/E,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,cAAc,CAAC,aAAa,CAAC;QAC5E,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,aAAa,GAAG,CAAC;QACvF,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACvC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,cAAc,CAAC,SAAS,CAAC;QAC/D,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,IAAI,cAAc,CAAC,iBAAiB,CAAC;QACvF,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,cAAc,CAAC,QAAQ,CAAC;QAC5D,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,KAAK,CAAC;IACpD,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,aAAa;QACzB,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAC;YAElE,4BAA4B;YAC5B,MAAM,YAAY,GAAG,IAAI,CAAC,WAAW,IAAI,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;YAErE,IAAI,CAAC,SAAS,GAAG,IAAI,SAAS,CAC5B,IAAI,CAAC,WAAW,EAChB,YAAY,EACZ,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,aAAa,EAClB,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CACpC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,oCAAoC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC7F,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,cAAc;QAC1B,+EAA+E;QAC/E,uFAAuF;QACvF,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;QAEjE,yDAAyD;QACzD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;QAClC,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7E,OAAO,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACnC,CAAC;IAED;;OAEG;IACK,YAAY;QAClB,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YAC7C,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC;IACrD,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,cAAc;QAClB,oCAAoC;QACpC,IAAI,IAAI,CAAC,YAAY,EAAE,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YAC3C,OAAO,IAAI,CAAC,UAAU,CAAC;QACzB,CAAC;QAED,kCAAkC;QAClC,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QAE3B,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,CAAC;QAED,IAAI,CAAC;YACH,2DAA2D;YAC3D,wEAAwE;YACxE,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC;YAEjC,wCAAwC;YACxC,2EAA2E;YAC3E,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;YAEjF,8BAA8B;YAC9B,MAAM,eAAe,GAAG,kBAAkB,CAAC,IAAI,UAAU,CAAC,iBAAiB,CAAC,CAAC,CAAC;YAC9E,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAgB,CAAC;YAE/D,mBAAmB;YACnB,IAAI,CAAC,UAAU,GAAG,WAAW,CAAC;YAC9B,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAEjC,OAAO,WAAW,CAAC;QACrB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,yCAAyC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAClG,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,kBAAkB;QACtB,cAAc;QACd,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;QAC5B,IAAI,CAAC,cAAc,GAAG,SAAS,CAAC;QAEhC,mBAAmB;QACnB,OAAO,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;IACrC,CAAC;IAED;;;OAGG;IACH,UAAU;QACR,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;QAC5B,IAAI,CAAC,cAAc,GAAG,SAAS,CAAC;IAClC,CAAC;CACF"}
|
|
1
|
+
{"version":3,"file":"tuf.js","sourceRoot":"","sources":["../../src/trust/tuf.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AAoDpE;;GAEG;AACH,MAAM,cAAc,GAAG;IACrB,WAAW,EAAE,oCAAoC;IACjD,aAAa,EAAE,4CAA4C;IAC3D,SAAS,EAAE,WAAW;IACtB,iBAAiB,EAAE,mBAAmB;IACtC,QAAQ,EAAE,OAAO,EAAE,SAAS;CAC7B,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,mBAAmB;IAa9B,YAAY,UAAsC,EAAE;QAClD,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,cAAc,CAAC,WAAW,CAAC;QACtE,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,WAAW,GAAG,CAAC;QAC/E,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,cAAc,CAAC,aAAa,CAAC;QAC5E,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,aAAa,GAAG,CAAC;QACvF,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACvC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,cAAc,CAAC,SAAS,CAAC;QAC/D,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,IAAI,cAAc,CAAC,iBAAiB,CAAC;QACvF,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,cAAc,CAAC,QAAQ,CAAC;QAC5D,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,KAAK,CAAC;IACpD,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,aAAa;QACzB,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAC;YAElE,4BAA4B;YAC5B,MAAM,YAAY,GAAG,IAAI,CAAC,WAAW,IAAI,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;YAErE,IAAI,CAAC,SAAS,GAAG,IAAI,SAAS,CAC5B,IAAI,CAAC,WAAW,EAChB,YAAY,EACZ,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,aAAa,EAClB,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CACpC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,oCAAoC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC7F,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,cAAc;QAC1B,+EAA+E;QAC/E,uFAAuF;QACvF,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;QAEjE,yDAAyD;QACzD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;QAClC,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7E,OAAO,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACnC,CAAC;IAED;;OAEG;IACK,YAAY;QAClB,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YAC7C,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC;IACrD,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,cAAc;QAClB,oCAAoC;QACpC,IAAI,IAAI,CAAC,YAAY,EAAE,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YAC3C,OAAO,IAAI,CAAC,UAAU,CAAC;QACzB,CAAC;QAED,kCAAkC;QAClC,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QAE3B,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,CAAC;QAED,IAAI,CAAC;YACH,2DAA2D;YAC3D,wEAAwE;YACxE,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC;YAEjC,wCAAwC;YACxC,2EAA2E;YAC3E,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;YAEjF,8BAA8B;YAC9B,MAAM,eAAe,GAAG,kBAAkB,CAAC,IAAI,UAAU,CAAC,iBAAiB,CAAC,CAAC,CAAC;YAC9E,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAgB,CAAC;YAE/D,mBAAmB;YACnB,IAAI,CAAC,UAAU,GAAG,WAAW,CAAC;YAC9B,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAEjC,OAAO,WAAW,CAAC;QACrB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,yCAAyC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAClG,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,kBAAkB;QACtB,cAAc;QACd,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;QAC5B,IAAI,CAAC,cAAc,GAAG,SAAS,CAAC;QAEhC,mBAAmB;QACnB,OAAO,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;IACrC,CAAC;IAED;;;OAGG;IACH,UAAU;QACR,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;QAC5B,IAAI,CAAC,cAAc,GAAG,SAAS,CAAC;IAClC,CAAC;CACF","sourcesContent":["/*\n * TUF (The Update Framework) integration for trusted root management\n *\n * Provides secure updates for Sigstore trusted root metadata using TUF.\n * Uses tuf-browser for browser-compatible TUF client functionality.\n *\n * Reference: https://github.com/freedomofpress/tuf-browser\n */\n\nimport { Uint8ArrayToString } from \"@freedomofpress/crypto-browser\";\nimport type { TUFClient } from \"@freedomofpress/tuf-browser\";\n\nimport { TrustedRoot } from \"../interfaces.js\";\n\n/**\n * Options for TrustedRootProvider configuration\n */\nexport interface TrustedRootProviderOptions {\n /**\n * TUF repository URL for metadata\n * Default: Sigstore production TUF repository\n */\n metadataUrl?: string;\n\n /**\n * Target base URL for fetching target files\n * If not specified, uses the same as metadataUrl\n */\n targetBaseUrl?: string;\n\n /**\n * Initial root metadata (1.root.json content)\n * If not provided, will use embedded default\n */\n initialRoot?: string;\n\n /**\n * Namespace for TUF cache storage\n * Default: 'tuf-cache'\n */\n namespace?: string;\n\n /**\n * Name of the trusted root target file\n * Default: 'trusted_root.json'\n */\n trustedRootTarget?: string;\n\n /**\n * Cache TTL in milliseconds\n * Default: 1 hour (3600000 ms)\n */\n cacheTTL?: number;\n\n /**\n * Disable persistent caching (use in-memory only)\n * Default: false\n */\n disableCache?: boolean;\n}\n\n/**\n * Default configuration for Sigstore production TUF repository\n */\nconst DEFAULT_CONFIG = {\n metadataUrl: 'https://tuf-repo-cdn.sigstore.dev/',\n targetBaseUrl: 'https://tuf-repo-cdn.sigstore.dev/targets/',\n namespace: 'tuf-cache',\n trustedRootTarget: 'trusted_root.json',\n cacheTTL: 3600000, // 1 hour\n};\n\n/**\n * Provides Sigstore trusted root via TUF for secure updates\n *\n * This class manages fetching and caching of Sigstore trusted root metadata\n * using The Update Framework (TUF) for secure, verified updates.\n *\n * Example usage:\n * ```typescript\n * const provider = new TrustedRootProvider();\n * const trustedRoot = await provider.getTrustedRoot();\n * ```\n */\nexport class TrustedRootProvider {\n private metadataUrl: string;\n private targetBaseUrl?: string;\n private initialRoot?: string;\n private namespace: string;\n private trustedRootTarget: string;\n private cacheTTL: number;\n private disableCache: boolean;\n\n private tufClient?: TUFClient;\n private cachedRoot?: TrustedRoot;\n private cacheTimestamp?: number;\n\n constructor(options: TrustedRootProviderOptions = {}) {\n const metadataUrl = options.metadataUrl || DEFAULT_CONFIG.metadataUrl;\n this.metadataUrl = metadataUrl.endsWith('/') ? metadataUrl : `${metadataUrl}/`;\n const targetBaseUrl = options.targetBaseUrl || DEFAULT_CONFIG.targetBaseUrl;\n this.targetBaseUrl = targetBaseUrl.endsWith('/') ? targetBaseUrl : `${targetBaseUrl}/`;\n this.initialRoot = options.initialRoot;\n this.namespace = options.namespace || DEFAULT_CONFIG.namespace;\n this.trustedRootTarget = options.trustedRootTarget || DEFAULT_CONFIG.trustedRootTarget;\n this.cacheTTL = options.cacheTTL ?? DEFAULT_CONFIG.cacheTTL;\n this.disableCache = options.disableCache ?? false;\n }\n\n /**\n * Initialize the TUF client\n * Lazy initialization to avoid loading TUF client until needed\n */\n private async initTUFClient(): Promise<void> {\n if (this.tufClient) {\n return;\n }\n\n try {\n const { TUFClient } = await import('@freedomofpress/tuf-browser');\n\n // Get initial root metadata\n const rootMetadata = this.initialRoot || await this.getDefaultRoot();\n\n this.tufClient = new TUFClient(\n this.metadataUrl,\n rootMetadata,\n this.namespace,\n this.targetBaseUrl,\n { disableCache: this.disableCache }\n );\n } catch (error) {\n throw new Error(\n `Failed to initialize TUF client: ${error instanceof Error ? error.message : String(error)}`\n );\n }\n }\n\n /**\n * Get the default embedded root metadata\n * Returns the TUF root.json that bootstraps the TUF client\n */\n private async getDefaultRoot(): Promise<string> {\n // Import the embedded TUF root metadata (base64-encoded 1.root.json as string)\n // This is the root of trust for TUF, not to be confused with the Sigstore trusted root\n const { default: tufRootBase64 } = await import('./tuf-root.js');\n\n // Decode from base64 to get the actual root.json content\n const decoder = new TextDecoder();\n const rootBytes = Uint8Array.from(atob(tufRootBase64), c => c.charCodeAt(0));\n return decoder.decode(rootBytes);\n }\n\n /**\n * Check if cached trusted root is still valid\n */\n private isCacheValid(): boolean {\n if (!this.cachedRoot || !this.cacheTimestamp) {\n return false;\n }\n\n const now = Date.now();\n return (now - this.cacheTimestamp) < this.cacheTTL;\n }\n\n /**\n * Get the Sigstore trusted root metadata\n * Uses TUF to securely fetch and verify the trusted root\n *\n * @returns Promise<TrustedRoot> The verified trusted root metadata\n * @throws Error if TUF verification fails or root cannot be fetched\n */\n async getTrustedRoot(): Promise<TrustedRoot> {\n // Return cached root if still valid\n if (this.isCacheValid() && this.cachedRoot) {\n return this.cachedRoot;\n }\n\n // Initialize TUF client if needed\n await this.initTUFClient();\n\n if (!this.tufClient) {\n throw new Error('TUF client not initialized');\n }\n\n try {\n // Update TUF metadata (root, timestamp, snapshot, targets)\n // This must be called before getTarget() to populate the metadata cache\n await this.tufClient.updateTUF();\n\n // Fetch the trusted root target via TUF\n // TUF will handle all verification (signatures, rollback protection, etc.)\n const trustedRootBuffer = await this.tufClient.getTarget(this.trustedRootTarget);\n\n // Parse the trusted root JSON\n const trustedRootJson = Uint8ArrayToString(new Uint8Array(trustedRootBuffer));\n const trustedRoot = JSON.parse(trustedRootJson) as TrustedRoot;\n\n // Cache the result\n this.cachedRoot = trustedRoot;\n this.cacheTimestamp = Date.now();\n\n return trustedRoot;\n } catch (error) {\n throw new Error(\n `Failed to fetch trusted root via TUF: ${error instanceof Error ? error.message : String(error)}`\n );\n }\n }\n\n /**\n * Manually refresh the trusted root from TUF\n * Bypasses cache and forces a fresh fetch\n *\n * @returns Promise<TrustedRoot> The updated trusted root metadata\n */\n async refreshTrustedRoot(): Promise<TrustedRoot> {\n // Clear cache\n this.cachedRoot = undefined;\n this.cacheTimestamp = undefined;\n\n // Fetch fresh root\n return await this.getTrustedRoot();\n }\n\n /**\n * Clear the cached trusted root\n * Next call to getTrustedRoot() will fetch fresh data\n */\n clearCache(): void {\n this.cachedRoot = undefined;\n this.cacheTimestamp = undefined;\n }\n}\n"]}
|
package/dist/x509/cert.d.ts
CHANGED
package/dist/x509/cert.js
CHANGED
|
@@ -13,7 +13,7 @@ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
|
13
13
|
See the License for the specific language governing permissions and
|
|
14
14
|
limitations under the License.
|
|
15
15
|
*/
|
|
16
|
-
import { ASN1Obj, importKey, toDER,
|
|
16
|
+
import { ASN1Obj, importKey, toDER, uint8ArrayEqual, Uint8ArrayToBase64, verifySignature, } from "@freedomofpress/crypto-browser";
|
|
17
17
|
import { KeyTypes } from "../interfaces.js";
|
|
18
18
|
import { DEFAULT_HASH_ALGORITHM, ECDSA_CURVE_NAMES, ECDSA_SIGNATURE_ALGOS, OID_RSASSA_PSS, RSA_SIGNATURE_ALGOS, SHA2_HASH_ALGOS } from "../oid.js";
|
|
19
19
|
import { X509AuthorityKeyIDExtension, X509BasicConstraintsExtension, X509BuildConfigDigestExtension, X509BuildConfigURIExtension, X509BuildSignerDigestExtension, X509BuildSignerURIExtension, X509BuildTriggerExtension, X509Extension, X509FulcioIssuerV1, X509FulcioIssuerV2, X509GitHubWorkflowNameExtension, X509GitHubWorkflowRefExtension, X509GitHubWorkflowRepositoryExtension, X509GitHubWorkflowSHAExtension, X509GitHubWorkflowTriggerExtension, X509KeyUsageExtension, X509RunInvocationURIExtension, X509RunnerEnvironmentExtension, X509SCTExtension, X509SourceRepositoryDigestExtension, X509SourceRepositoryIdentifierExtension, X509SourceRepositoryOwnerIdentifierExtension, X509SourceRepositoryOwnerURIExtension, X509SourceRepositoryRefExtension, X509SourceRepositoryURIExtension, X509SourceRepositoryVisibilityExtension, X509SubjectAlternativeNameExtension, X509SubjectKeyIDExtension, } from "./ext.js";
|
package/dist/x509/cert.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"cert.js","sourceRoot":"","sources":["../../src/x509/cert.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;EAcE;AACF,OAAO,EACL,OAAO,EACP,SAAS,EACT,KAAK,EACL,kBAAkB,EAClB,eAAe,EACf,eAAe,GAChB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,cAAc,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AACnJ,OAAO,EACL,2BAA2B,EAC3B,6BAA6B,EAC7B,8BAA8B,EAC9B,2BAA2B,EAC3B,8BAA8B,EAC9B,2BAA2B,EAC3B,yBAAyB,EACzB,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,+BAA+B,EAC/B,8BAA8B,EAC9B,qCAAqC,EACrC,8BAA8B,EAC9B,kCAAkC,EAClC,qBAAqB,EACrB,6BAA6B,EAC7B,8BAA8B,EAC9B,gBAAgB,EAChB,mCAAmC,EACnC,uCAAuC,EACvC,4CAA4C,EAC5C,qCAAqC,EACrC,gCAAgC,EAChC,gCAAgC,EAChC,uCAAuC,EACvC,mCAAmC,EACnC,yBAAyB,GAC1B,MAAM,UAAU,CAAC;AAElB,gCAAgC;AAChC,MAAM,4BAA4B,GAAG,WAAW,CAAC;AACjD,MAAM,uBAAuB,GAAG,WAAW,CAAC;AAC5C,MAAM,8BAA8B,GAAG,WAAW,CAAC;AACnD,MAAM,+BAA+B,GAAG,WAAW,CAAC;AACpD,MAAM,8BAA8B,GAAG,WAAW,CAAC;AAEnD,2BAA2B;AAC3B,MAAM,CAAC,MAAM,iBAAiB,GAAG,yBAAyB,CAAC;AAE3D,4CAA4C;AAC5C,MAAM,kBAAkB,GAAG,SAAS,CAAC;AACrC,MAAM,cAAc,GAAG,SAAS,CAAC;AACjC,MAAM,eAAe,GAAG,SAAS,CAAC;AAClC,MAAM,YAAY,GAAG,SAAS,CAAC;AAC/B,MAAM,mBAAmB,GAAG,UAAU,CAAC;AACvC,MAAM,0BAA0B,GAAG,UAAU,CAAC;AAE9C,MAAM,cAAc,GAA2B;IAC7C,CAAC,kBAAkB,CAAC,EAAE,IAAI;IAC1B,CAAC,cAAc,CAAC,EAAE,GAAG;IACrB,CAAC,eAAe,CAAC,EAAE,GAAG;IACtB,CAAC,YAAY,CAAC,EAAE,IAAI;IACpB,CAAC,mBAAmB,CAAC,EAAE,GAAG;IAC1B,CAAC,0BAA0B,CAAC,EAAE,IAAI;CACnC,CAAC;AAEF,wBAAwB;AACxB,gEAAgE;AAChE,MAAM,CAAC,MAAM,8BAA8B,GAAG,uBAAuB,CAAC;AACtE,MAAM,CAAC,MAAM,qCAAqC,GAAG,uBAAuB,CAAC;AAC7E,MAAM,CAAC,MAAM,iCAAiC,GAAG,uBAAuB,CAAC;AACzE,MAAM,CAAC,MAAM,kCAAkC,GAAG,uBAAuB,CAAC;AAC1E,MAAM,CAAC,MAAM,wCAAwC,GAAG,uBAAuB,CAAC;AAChF,MAAM,CAAC,MAAM,iCAAiC,GAAG,uBAAuB,CAAC;AACzE,MAAM,CAAC,MAAM,uBAAuB,GAAG,uBAAuB,CAAC;AAC/D,MAAM,CAAC,MAAM,8BAA8B,GAAG,uBAAuB,CAAC;AACtE,MAAM,CAAC,MAAM,8BAA8B,GAAG,uBAAuB,CAAC;AACtE,MAAM,CAAC,MAAM,iCAAiC,GAAG,wBAAwB,CAAC;AAC1E,MAAM,CAAC,MAAM,gCAAgC,GAAG,wBAAwB,CAAC;AACzE,MAAM,CAAC,MAAM,mCAAmC,GAAG,wBAAwB,CAAC;AAC5E,MAAM,CAAC,MAAM,sCAAsC,GAAG,wBAAwB,CAAC;AAC/E,MAAM,CAAC,MAAM,mCAAmC,GAAG,wBAAwB,CAAC;AAC5E,MAAM,CAAC,MAAM,0CAA0C,GAAG,wBAAwB,CAAC;AACnF,MAAM,CAAC,MAAM,yCAAyC,GAAG,wBAAwB,CAAC;AAClF,MAAM,CAAC,MAAM,gDAAgD,GAAG,wBAAwB,CAAC;AACzF,MAAM,CAAC,MAAM,8BAA8B,GAAG,wBAAwB,CAAC;AACvE,MAAM,CAAC,MAAM,iCAAiC,GAAG,wBAAwB,CAAC;AAC1E,MAAM,CAAC,MAAM,2BAA2B,GAAG,wBAAwB,CAAC;AACpE,MAAM,CAAC,MAAM,gCAAgC,GAAG,wBAAwB,CAAC;AACzE,MAAM,CAAC,MAAM,0CAA0C,GAAG,wBAAwB,CAAC;AAEnF,MAAM,OAAO,eAAe;IAG1B,YAAY,IAAa;QACvB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAEM,MAAM,CAAC,KAAK,CAAC,IAAyB;QAC3C,MAAM,GAAG,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC1D,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACtC,OAAO,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IAED,IAAI,cAAc;QAChB,OAAO,IAAI,CAAC,iBAAiB,CAAC;IAChC,CAAC;IAED,IAAI,OAAO;QACT,0EAA0E;QAC1E,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;QAChD,OAAO,IAAI,CAAC,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;IAC5C,CAAC;IAED,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC;IACpC,CAAC;IAED,IAAI,SAAS;QACX,0DAA0D;QAC1D,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC3C,CAAC;IAED,IAAI,QAAQ;QACV,0DAA0D;QAC1D,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC3C,CAAC;IAED,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;IAC9B,CAAC;IAED,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;IAC/B,CAAC;IAED;;;;OAIG;IACH,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACrD,CAAC;IAED;;;;OAIG;IACH,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACtD,CAAC;IAED,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,uBAAuB,CAAC,KAAK,EAAE,CAAC;IAC9C,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,eAAe,CAAC,OAAgB,EAAE,MAAgB;QAC7D,MAAM,SAAS,GAAG,IAAI,CAAC,uBAAuB,CAAC,KAAK,EAAE,CAAC;QACvD,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QAC5C,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;QAElD,gFAAgF;QAChF,MAAM,QAAQ,GAAG,YAAY,KAAK,sBAAsB,CAAC;QACzD,MAAM,WAAW,GAAG,YAAY,KAAK,cAAc,CAAC;QAEpD,IAAI,WAAW,EAAE,CAAC;YAChB,sFAAsF;YACtF,MAAM,IAAI,KAAK,CACb,0EAA0E;gBAC1E,kGAAkG,CACnG,CAAC;QACJ,CAAC;QAED,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,IAAI,GAAG,OAAO,IAAI,sBAAsB,CAAC;YAC/C,kFAAkF;YAClF,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC;YAC/C,OAAO,SAAS,CAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAC;QACxE,CAAC;aAAM,CAAC;YACN,qDAAqD;YACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;YAC/C,MAAM,KAAK,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;YAC1C,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,KAAK,CAAC,4BAA4B,QAAQ,EAAE,CAAC,CAAC;YAC1D,CAAC;YACD,OAAO,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,EAAE,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IAED,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,eAAe,EAAE,CAAC;IAChC,CAAC;IAED,IAAI,kBAAkB;QACpB,MAAM,GAAG,GAAW,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;QAC/D,OAAO,qBAAqB,CAAC,GAAG,CAAC,IAAI,mBAAmB,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,wBAAwB,EAAE,CAAC;IACnG,CAAC;IAED,IAAI,qBAAqB;QACvB,OAAO,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;IACpD,CAAC;IAED;;;OAGG;IACK,wBAAwB;QAC9B,MAAM,SAAS,GAAG,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;QAC7D,IAAI,SAAS,KAAK,cAAc,EAAE,CAAC;YACjC,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,mFAAmF;QACnF,MAAM,MAAM,GAAG,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxC,OAAO,sBAAsB,CAAC;QAChC,CAAC;QAED,8CAA8C;QAC9C,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACtC,IAAI,cAAc,IAAI,cAAc,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrD,8DAA8D;YAC9D,MAAM,UAAU,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC1C,IAAI,UAAU,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC7C,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;gBAC3C,OAAO,eAAe,CAAC,OAAO,CAAC,IAAI,sBAAsB,CAAC;YAC5D,CAAC;QACH,CAAC;QAED,OAAO,sBAAsB,CAAC;IAChC,CAAC;IAED,IAAI,cAAc;QAChB,qEAAqE;QACrE,OAAO,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAClD,CAAC;IAED,IAAI,cAAc;QAChB,MAAM,GAAG,GAAG,IAAI,CAAC,iBAAiB,CAAC;QACnC,OAAO,GAAG,EAAE,GAAG,IAAI,GAAG,EAAE,UAAU,CAAC;IACrC,CAAC;IAED,IAAI,UAAU;QACZ,uEAAuE;QACvE,uBAAuB;QACvB,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3C,OAAO,MAAM,EAAE,IAAI,IAAI,0BAA0B,CAAC,EAAE,CAAC;IACvD,CAAC;IAED,IAAI,WAAW;QACb,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,uBAAuB,CAAC,CAAC;QACxD,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1D,CAAC;IAED,IAAI,mBAAmB;QACrB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,+BAA+B,CAAC,CAAC;QAChE,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,6BAA6B,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAClE,CAAC;IAED,IAAI,iBAAiB;QACnB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,8BAA8B,CAAC,CAAC;QAC/D,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,mCAAmC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACxE,CAAC;IAED,IAAI,iBAAiB;QACnB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,8BAA8B,CAAC,CAAC;QAC/D,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,2BAA2B,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAChE,CAAC;IAED,IAAI,eAAe;QACjB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,4BAA4B,CAAC,CAAC;QAC7D,OAAO,GAAG;YACR,CAAC,CAAC,IAAI,yBAAyB,CAAC,GAAG,CAAC;YACpC,CAAC,CAAC,0BAA0B,CAAC,SAAS,CAAC;IAC3C,CAAC;IAED,IAAI,MAAM;QACR,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,iBAAiB,CAAC,CAAC;QAClD,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACrD,CAAC;IAED,IAAI,iBAAiB;QACnB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,8BAA8B,CAAC,CAAC;QAC/D,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvD,CAAC;IAED,IAAI,iBAAiB;QACnB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,8BAA8B,CAAC,CAAC;QAC/D,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvD,CAAC;IAED,IAAI,wBAAwB;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,qCAAqC,CAAC,CAAC;QACtE,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,kCAAkC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvE,CAAC;IAED,IAAI,oBAAoB;QACtB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,iCAAiC,CAAC,CAAC;QAClE,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,8BAA8B,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACnE,CAAC;IAED,IAAI,qBAAqB;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,kCAAkC,CAAC,CAAC;QACnE,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,+BAA+B,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACpE,CAAC;IAED,IAAI,2BAA2B;QAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,wCAAwC,CAAC,CAAC;QACzE,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,qCAAqC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1E,CAAC;IAED,IAAI,oBAAoB;QACtB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,iCAAiC,CAAC,CAAC;QAClE,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,8BAA8B,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACnE,CAAC;IAED,IAAI,iBAAiB;QACnB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,8BAA8B,CAAC,CAAC;QAC/D,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,2BAA2B,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAChE,CAAC;IAED,IAAI,oBAAoB;QACtB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,iCAAiC,CAAC,CAAC;QAClE,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,8BAA8B,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACnE,CAAC;IAED,IAAI,oBAAoB;QACtB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,gCAAgC,CAAC,CAAC;QACjE,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,8BAA8B,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACnE,CAAC;IAED,IAAI,sBAAsB;QACxB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,mCAAmC,CAAC,CAAC;QACpE,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,gCAAgC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACrE,CAAC;IAED,IAAI,yBAAyB;QAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,sCAAsC,CAAC,CAAC;QACvE,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,mCAAmC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACxE,CAAC;IAED,IAAI,sBAAsB;QACxB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,mCAAmC,CAAC,CAAC;QACpE,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,gCAAgC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACrE,CAAC;IAED,IAAI,6BAA6B;QAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,0CAA0C,CAAC,CAAC;QAC3E,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,uCAAuC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5E,CAAC;IAED,IAAI,2BAA2B;QAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,yCAAyC,CAAC,CAAC;QAC1E,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,qCAAqC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1E,CAAC;IAED,IAAI,kCAAkC;QACpC,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,gDAAgD,CAAC,CAAC;QACjF,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,4CAA4C,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACjF,CAAC;IAED,IAAI,iBAAiB;QACnB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,8BAA8B,CAAC,CAAC;QAC/D,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,2BAA2B,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAChE,CAAC;IAED,IAAI,oBAAoB;QACtB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,iCAAiC,CAAC,CAAC;QAClE,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,8BAA8B,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACnE,CAAC;IAED,IAAI,eAAe;QACjB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,2BAA2B,CAAC,CAAC;QAC5D,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,yBAAyB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9D,CAAC;IAED,IAAI,mBAAmB;QACrB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,gCAAgC,CAAC,CAAC;QACjE,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,6BAA6B,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAClE,CAAC;IAED,IAAI,6BAA6B;QAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,0CAA0C,CAAC,CAAC;QAC3E,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,uCAAuC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5E,CAAC;IAED,IAAI,IAAI;QACN,MAAM,EAAE,GAAG,IAAI,CAAC,mBAAmB,EAAE,IAAI,IAAI,KAAK,CAAC;QAEnD,gEAAgE;QAChE,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,OAAO,EAAE,IAAI,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC;QAC5C,CAAC;QAED,OAAO,EAAE,CAAC;IACZ,CAAC;IAEM,SAAS,CAAC,GAAW;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QACpC,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAClD,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,iBAAmC;QACrD,yEAAyE;QACzE,MAAM,SAAS,GAAG,IAAI,CAAC,qBAAqB,CAAC;QAC7C,MAAM,QAAQ,GAAG,SAAS,KAAK,cAAc,CAAC;QAE9C,sFAAsF;QACtF,MAAM,OAAO,GAAG,QAAQ;YACtB,CAAC,CAAC,IAAI,CAAC,wBAAwB,EAAE;YACjC,CAAC,CAAC,CAAC,mBAAmB,CAAC,SAAS,CAAC,IAAI,qBAAqB,CAAC,SAAS,CAAC,CAAC,CAAC;QAEzE,+FAA+F;QAC/F,uFAAuF;QACvF,MAAM,YAAY,GAAG,iBAAiB;YACpC,CAAC,CAAC,MAAM,iBAAiB,CAAC,eAAe,CAAC,OAAO,EAAE,QAAQ,CAAC;YAC5D,CAAC,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAElD,OAAO,MAAM,eAAe,CAC1B,YAAY,EACZ,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,EAC3B,IAAI,CAAC,cAAc,EACnB,IAAI,CAAC,kBAAkB,CACxB,CAAC;IACJ,CAAC;IAEM,YAAY,CAAC,IAAU;QAC5B,OAAO,IAAI,CAAC,SAAS,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC;IACzD,CAAC;IAEM,MAAM,CAAC,KAAsB;QAClC,OAAO,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IAChE,CAAC;IAED,sDAAsD;IAC/C,KAAK;QACV,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;QAClC,OAAO,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACtC,CAAC;IAEO,aAAa,CAAC,GAAW;QAC/B,0EAA0E;QAC1E,oCAAoC;QACpC,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC;IACpE,CAAC;IAED,6EAA6E;IAC7E,2EAA2E;IAC3E,uBAAuB;IACvB,qDAAqD;IAErD,yDAAyD;IACzD,IAAY,iBAAiB;QAC3B,kEAAkE;QAClE,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;IAED,yDAAyD;IACzD,IAAY,qBAAqB;QAC/B,uEAAuE;QACvE,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;IAED,yDAAyD;IACzD,IAAY,iBAAiB;QAC3B,kEAAkE;QAClE,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;IAED,yDAAyD;IACzD,IAAY,UAAU;QACpB,8DAA8D;QAC9D,OAAO,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;IAED,yDAAyD;IACzD,IAAY,eAAe;QACzB,oEAAoE;QACpE,OAAO,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;IAED,yDAAyD;IACzD,IAAY,SAAS;QACnB,8DAA8D;QAC9D,OAAO,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;IAED,yDAAyD;IACzD,IAAY,WAAW;QACrB,8DAA8D;QAC9D,OAAO,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;IAED,yDAAyD;IACzD,IAAY,UAAU;QACpB,8DAA8D;QAC9D,OAAO,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;IAED,yDAAyD;IACzD,IAAY,uBAAuB;QACjC,6EAA6E;QAC7E,OAAO,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;IAED,+EAA+E;IAC/E,sDAAsD;IACtD,yDAAyD;IACzD,IAAY,aAAa;QACvB,OAAO,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAC9C,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAChC,CAAC;IACJ,CAAC;IAED,oEAAoE;IACpE,oEAAoE;IACpE,6CAA6C;IACrC,sBAAsB,CAAC,KAAc;QAC3C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;QAEzC,gEAAgE;QAChE,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;YAC7B,iEAAiE;YACjE,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;gBAC3B,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;oBACzB,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;oBAC3B,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;oBAE7B,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC;wBACvB,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC;wBAC3B,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;wBACrC,IAAI,QAAQ,EAAE,CAAC;4BACb,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;4BACvD,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;wBAC9B,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}
|
|
1
|
+
{"version":3,"file":"cert.js","sourceRoot":"","sources":["../../src/x509/cert.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;EAcE;AACF,OAAO,EACL,OAAO,EACP,SAAS,EACT,KAAK,EACL,eAAe,EACf,kBAAkB,EAClB,eAAe,GAChB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,cAAc,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AACnJ,OAAO,EACL,2BAA2B,EAC3B,6BAA6B,EAC7B,8BAA8B,EAC9B,2BAA2B,EAC3B,8BAA8B,EAC9B,2BAA2B,EAC3B,yBAAyB,EACzB,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,+BAA+B,EAC/B,8BAA8B,EAC9B,qCAAqC,EACrC,8BAA8B,EAC9B,kCAAkC,EAClC,qBAAqB,EACrB,6BAA6B,EAC7B,8BAA8B,EAC9B,gBAAgB,EAChB,mCAAmC,EACnC,uCAAuC,EACvC,4CAA4C,EAC5C,qCAAqC,EACrC,gCAAgC,EAChC,gCAAgC,EAChC,uCAAuC,EACvC,mCAAmC,EACnC,yBAAyB,GAC1B,MAAM,UAAU,CAAC;AAElB,gCAAgC;AAChC,MAAM,4BAA4B,GAAG,WAAW,CAAC;AACjD,MAAM,uBAAuB,GAAG,WAAW,CAAC;AAC5C,MAAM,8BAA8B,GAAG,WAAW,CAAC;AACnD,MAAM,+BAA+B,GAAG,WAAW,CAAC;AACpD,MAAM,8BAA8B,GAAG,WAAW,CAAC;AAEnD,2BAA2B;AAC3B,MAAM,CAAC,MAAM,iBAAiB,GAAG,yBAAyB,CAAC;AAE3D,4CAA4C;AAC5C,MAAM,kBAAkB,GAAG,SAAS,CAAC;AACrC,MAAM,cAAc,GAAG,SAAS,CAAC;AACjC,MAAM,eAAe,GAAG,SAAS,CAAC;AAClC,MAAM,YAAY,GAAG,SAAS,CAAC;AAC/B,MAAM,mBAAmB,GAAG,UAAU,CAAC;AACvC,MAAM,0BAA0B,GAAG,UAAU,CAAC;AAE9C,MAAM,cAAc,GAA2B;IAC7C,CAAC,kBAAkB,CAAC,EAAE,IAAI;IAC1B,CAAC,cAAc,CAAC,EAAE,GAAG;IACrB,CAAC,eAAe,CAAC,EAAE,GAAG;IACtB,CAAC,YAAY,CAAC,EAAE,IAAI;IACpB,CAAC,mBAAmB,CAAC,EAAE,GAAG;IAC1B,CAAC,0BAA0B,CAAC,EAAE,IAAI;CACnC,CAAC;AAEF,wBAAwB;AACxB,gEAAgE;AAChE,MAAM,CAAC,MAAM,8BAA8B,GAAG,uBAAuB,CAAC;AACtE,MAAM,CAAC,MAAM,qCAAqC,GAAG,uBAAuB,CAAC;AAC7E,MAAM,CAAC,MAAM,iCAAiC,GAAG,uBAAuB,CAAC;AACzE,MAAM,CAAC,MAAM,kCAAkC,GAAG,uBAAuB,CAAC;AAC1E,MAAM,CAAC,MAAM,wCAAwC,GAAG,uBAAuB,CAAC;AAChF,MAAM,CAAC,MAAM,iCAAiC,GAAG,uBAAuB,CAAC;AACzE,MAAM,CAAC,MAAM,uBAAuB,GAAG,uBAAuB,CAAC;AAC/D,MAAM,CAAC,MAAM,8BAA8B,GAAG,uBAAuB,CAAC;AACtE,MAAM,CAAC,MAAM,8BAA8B,GAAG,uBAAuB,CAAC;AACtE,MAAM,CAAC,MAAM,iCAAiC,GAAG,wBAAwB,CAAC;AAC1E,MAAM,CAAC,MAAM,gCAAgC,GAAG,wBAAwB,CAAC;AACzE,MAAM,CAAC,MAAM,mCAAmC,GAAG,wBAAwB,CAAC;AAC5E,MAAM,CAAC,MAAM,sCAAsC,GAAG,wBAAwB,CAAC;AAC/E,MAAM,CAAC,MAAM,mCAAmC,GAAG,wBAAwB,CAAC;AAC5E,MAAM,CAAC,MAAM,0CAA0C,GAAG,wBAAwB,CAAC;AACnF,MAAM,CAAC,MAAM,yCAAyC,GAAG,wBAAwB,CAAC;AAClF,MAAM,CAAC,MAAM,gDAAgD,GAAG,wBAAwB,CAAC;AACzF,MAAM,CAAC,MAAM,8BAA8B,GAAG,wBAAwB,CAAC;AACvE,MAAM,CAAC,MAAM,iCAAiC,GAAG,wBAAwB,CAAC;AAC1E,MAAM,CAAC,MAAM,2BAA2B,GAAG,wBAAwB,CAAC;AACpE,MAAM,CAAC,MAAM,gCAAgC,GAAG,wBAAwB,CAAC;AACzE,MAAM,CAAC,MAAM,0CAA0C,GAAG,wBAAwB,CAAC;AAEnF,MAAM,OAAO,eAAe;IAG1B,YAAY,IAAa;QACvB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAEM,MAAM,CAAC,KAAK,CAAC,IAAyB;QAC3C,MAAM,GAAG,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC1D,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACtC,OAAO,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IAED,IAAI,cAAc;QAChB,OAAO,IAAI,CAAC,iBAAiB,CAAC;IAChC,CAAC;IAED,IAAI,OAAO;QACT,0EAA0E;QAC1E,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;QAChD,OAAO,IAAI,CAAC,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;IAC5C,CAAC;IAED,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC;IACpC,CAAC;IAED,IAAI,SAAS;QACX,0DAA0D;QAC1D,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC3C,CAAC;IAED,IAAI,QAAQ;QACV,0DAA0D;QAC1D,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC3C,CAAC;IAED,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;IAC9B,CAAC;IAED,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;IAC/B,CAAC;IAED;;;;OAIG;IACH,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACrD,CAAC;IAED;;;;OAIG;IACH,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACtD,CAAC;IAED,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,uBAAuB,CAAC,KAAK,EAAE,CAAC;IAC9C,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,eAAe,CAAC,OAAgB,EAAE,MAAgB;QAC7D,MAAM,SAAS,GAAG,IAAI,CAAC,uBAAuB,CAAC,KAAK,EAAE,CAAC;QACvD,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QAC5C,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;QAElD,gFAAgF;QAChF,MAAM,QAAQ,GAAG,YAAY,KAAK,sBAAsB,CAAC;QACzD,MAAM,WAAW,GAAG,YAAY,KAAK,cAAc,CAAC;QAEpD,IAAI,WAAW,EAAE,CAAC;YAChB,sFAAsF;YACtF,MAAM,IAAI,KAAK,CACb,0EAA0E;gBAC1E,kGAAkG,CACnG,CAAC;QACJ,CAAC;QAED,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,IAAI,GAAG,OAAO,IAAI,sBAAsB,CAAC;YAC/C,kFAAkF;YAClF,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC;YAC/C,OAAO,SAAS,CAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAC;QACxE,CAAC;aAAM,CAAC;YACN,qDAAqD;YACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;YAC/C,MAAM,KAAK,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;YAC1C,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,KAAK,CAAC,4BAA4B,QAAQ,EAAE,CAAC,CAAC;YAC1D,CAAC;YACD,OAAO,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,EAAE,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IAED,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,eAAe,EAAE,CAAC;IAChC,CAAC;IAED,IAAI,kBAAkB;QACpB,MAAM,GAAG,GAAW,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;QAC/D,OAAO,qBAAqB,CAAC,GAAG,CAAC,IAAI,mBAAmB,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,wBAAwB,EAAE,CAAC;IACnG,CAAC;IAED,IAAI,qBAAqB;QACvB,OAAO,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;IACpD,CAAC;IAED;;;OAGG;IACK,wBAAwB;QAC9B,MAAM,SAAS,GAAG,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;QAC7D,IAAI,SAAS,KAAK,cAAc,EAAE,CAAC;YACjC,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,mFAAmF;QACnF,MAAM,MAAM,GAAG,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxC,OAAO,sBAAsB,CAAC;QAChC,CAAC;QAED,8CAA8C;QAC9C,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACtC,IAAI,cAAc,IAAI,cAAc,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrD,8DAA8D;YAC9D,MAAM,UAAU,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC1C,IAAI,UAAU,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC7C,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;gBAC3C,OAAO,eAAe,CAAC,OAAO,CAAC,IAAI,sBAAsB,CAAC;YAC5D,CAAC;QACH,CAAC;QAED,OAAO,sBAAsB,CAAC;IAChC,CAAC;IAED,IAAI,cAAc;QAChB,qEAAqE;QACrE,OAAO,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAClD,CAAC;IAED,IAAI,cAAc;QAChB,MAAM,GAAG,GAAG,IAAI,CAAC,iBAAiB,CAAC;QACnC,OAAO,GAAG,EAAE,GAAG,IAAI,GAAG,EAAE,UAAU,CAAC;IACrC,CAAC;IAED,IAAI,UAAU;QACZ,uEAAuE;QACvE,uBAAuB;QACvB,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3C,OAAO,MAAM,EAAE,IAAI,IAAI,0BAA0B,CAAC,EAAE,CAAC;IACvD,CAAC;IAED,IAAI,WAAW;QACb,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,uBAAuB,CAAC,CAAC;QACxD,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1D,CAAC;IAED,IAAI,mBAAmB;QACrB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,+BAA+B,CAAC,CAAC;QAChE,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,6BAA6B,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAClE,CAAC;IAED,IAAI,iBAAiB;QACnB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,8BAA8B,CAAC,CAAC;QAC/D,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,mCAAmC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACxE,CAAC;IAED,IAAI,iBAAiB;QACnB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,8BAA8B,CAAC,CAAC;QAC/D,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,2BAA2B,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAChE,CAAC;IAED,IAAI,eAAe;QACjB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,4BAA4B,CAAC,CAAC;QAC7D,OAAO,GAAG;YACR,CAAC,CAAC,IAAI,yBAAyB,CAAC,GAAG,CAAC;YACpC,CAAC,CAAC,0BAA0B,CAAC,SAAS,CAAC;IAC3C,CAAC;IAED,IAAI,MAAM;QACR,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,iBAAiB,CAAC,CAAC;QAClD,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACrD,CAAC;IAED,IAAI,iBAAiB;QACnB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,8BAA8B,CAAC,CAAC;QAC/D,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvD,CAAC;IAED,IAAI,iBAAiB;QACnB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,8BAA8B,CAAC,CAAC;QAC/D,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvD,CAAC;IAED,IAAI,wBAAwB;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,qCAAqC,CAAC,CAAC;QACtE,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,kCAAkC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvE,CAAC;IAED,IAAI,oBAAoB;QACtB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,iCAAiC,CAAC,CAAC;QAClE,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,8BAA8B,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACnE,CAAC;IAED,IAAI,qBAAqB;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,kCAAkC,CAAC,CAAC;QACnE,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,+BAA+B,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACpE,CAAC;IAED,IAAI,2BAA2B;QAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,wCAAwC,CAAC,CAAC;QACzE,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,qCAAqC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1E,CAAC;IAED,IAAI,oBAAoB;QACtB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,iCAAiC,CAAC,CAAC;QAClE,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,8BAA8B,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACnE,CAAC;IAED,IAAI,iBAAiB;QACnB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,8BAA8B,CAAC,CAAC;QAC/D,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,2BAA2B,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAChE,CAAC;IAED,IAAI,oBAAoB;QACtB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,iCAAiC,CAAC,CAAC;QAClE,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,8BAA8B,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACnE,CAAC;IAED,IAAI,oBAAoB;QACtB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,gCAAgC,CAAC,CAAC;QACjE,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,8BAA8B,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACnE,CAAC;IAED,IAAI,sBAAsB;QACxB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,mCAAmC,CAAC,CAAC;QACpE,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,gCAAgC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACrE,CAAC;IAED,IAAI,yBAAyB;QAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,sCAAsC,CAAC,CAAC;QACvE,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,mCAAmC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACxE,CAAC;IAED,IAAI,sBAAsB;QACxB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,mCAAmC,CAAC,CAAC;QACpE,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,gCAAgC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACrE,CAAC;IAED,IAAI,6BAA6B;QAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,0CAA0C,CAAC,CAAC;QAC3E,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,uCAAuC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5E,CAAC;IAED,IAAI,2BAA2B;QAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,yCAAyC,CAAC,CAAC;QAC1E,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,qCAAqC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1E,CAAC;IAED,IAAI,kCAAkC;QACpC,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,gDAAgD,CAAC,CAAC;QACjF,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,4CAA4C,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACjF,CAAC;IAED,IAAI,iBAAiB;QACnB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,8BAA8B,CAAC,CAAC;QAC/D,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,2BAA2B,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAChE,CAAC;IAED,IAAI,oBAAoB;QACtB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,iCAAiC,CAAC,CAAC;QAClE,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,8BAA8B,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACnE,CAAC;IAED,IAAI,eAAe;QACjB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,2BAA2B,CAAC,CAAC;QAC5D,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,yBAAyB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9D,CAAC;IAED,IAAI,mBAAmB;QACrB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,gCAAgC,CAAC,CAAC;QACjE,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,6BAA6B,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAClE,CAAC;IAED,IAAI,6BAA6B;QAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,0CAA0C,CAAC,CAAC;QAC3E,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,uCAAuC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5E,CAAC;IAED,IAAI,IAAI;QACN,MAAM,EAAE,GAAG,IAAI,CAAC,mBAAmB,EAAE,IAAI,IAAI,KAAK,CAAC;QAEnD,gEAAgE;QAChE,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,OAAO,EAAE,IAAI,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC;QAC5C,CAAC;QAED,OAAO,EAAE,CAAC;IACZ,CAAC;IAEM,SAAS,CAAC,GAAW;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QACpC,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAClD,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,iBAAmC;QACrD,yEAAyE;QACzE,MAAM,SAAS,GAAG,IAAI,CAAC,qBAAqB,CAAC;QAC7C,MAAM,QAAQ,GAAG,SAAS,KAAK,cAAc,CAAC;QAE9C,sFAAsF;QACtF,MAAM,OAAO,GAAG,QAAQ;YACtB,CAAC,CAAC,IAAI,CAAC,wBAAwB,EAAE;YACjC,CAAC,CAAC,CAAC,mBAAmB,CAAC,SAAS,CAAC,IAAI,qBAAqB,CAAC,SAAS,CAAC,CAAC,CAAC;QAEzE,+FAA+F;QAC/F,uFAAuF;QACvF,MAAM,YAAY,GAAG,iBAAiB;YACpC,CAAC,CAAC,MAAM,iBAAiB,CAAC,eAAe,CAAC,OAAO,EAAE,QAAQ,CAAC;YAC5D,CAAC,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAElD,OAAO,MAAM,eAAe,CAC1B,YAAY,EACZ,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,EAC3B,IAAI,CAAC,cAAc,EACnB,IAAI,CAAC,kBAAkB,CACxB,CAAC;IACJ,CAAC;IAEM,YAAY,CAAC,IAAU;QAC5B,OAAO,IAAI,CAAC,SAAS,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC;IACzD,CAAC;IAEM,MAAM,CAAC,KAAsB;QAClC,OAAO,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IAChE,CAAC;IAED,sDAAsD;IAC/C,KAAK;QACV,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;QAClC,OAAO,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACtC,CAAC;IAEO,aAAa,CAAC,GAAW;QAC/B,0EAA0E;QAC1E,oCAAoC;QACpC,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC;IACpE,CAAC;IAED,6EAA6E;IAC7E,2EAA2E;IAC3E,uBAAuB;IACvB,qDAAqD;IAErD,yDAAyD;IACzD,IAAY,iBAAiB;QAC3B,kEAAkE;QAClE,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;IAED,yDAAyD;IACzD,IAAY,qBAAqB;QAC/B,uEAAuE;QACvE,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;IAED,yDAAyD;IACzD,IAAY,iBAAiB;QAC3B,kEAAkE;QAClE,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;IAED,yDAAyD;IACzD,IAAY,UAAU;QACpB,8DAA8D;QAC9D,OAAO,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;IAED,yDAAyD;IACzD,IAAY,eAAe;QACzB,oEAAoE;QACpE,OAAO,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;IAED,yDAAyD;IACzD,IAAY,SAAS;QACnB,8DAA8D;QAC9D,OAAO,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;IAED,yDAAyD;IACzD,IAAY,WAAW;QACrB,8DAA8D;QAC9D,OAAO,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;IAED,yDAAyD;IACzD,IAAY,UAAU;QACpB,8DAA8D;QAC9D,OAAO,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;IAED,yDAAyD;IACzD,IAAY,uBAAuB;QACjC,6EAA6E;QAC7E,OAAO,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;IAED,+EAA+E;IAC/E,sDAAsD;IACtD,yDAAyD;IACzD,IAAY,aAAa;QACvB,OAAO,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAC9C,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAChC,CAAC;IACJ,CAAC;IAED,oEAAoE;IACpE,oEAAoE;IACpE,6CAA6C;IACrC,sBAAsB,CAAC,KAAc;QAC3C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;QAEzC,gEAAgE;QAChE,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;YAC7B,iEAAiE;YACjE,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;gBAC3B,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;oBACzB,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;oBAC3B,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;oBAE7B,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC;wBACvB,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC;wBAC3B,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;wBACrC,IAAI,QAAQ,EAAE,CAAC;4BACb,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;4BACvD,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;wBAC9B,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;CACF","sourcesContent":["/*\nCopyright 2023 The Sigstore Authors.\n\nLicensed under the Apache License, Version 2.0 (the \"License\");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n*/\nimport {\n ASN1Obj,\n importKey,\n toDER,\n uint8ArrayEqual,\n Uint8ArrayToBase64,\n verifySignature,\n} from \"@freedomofpress/crypto-browser\";\n\nimport { KeyTypes } from \"../interfaces.js\";\nimport { DEFAULT_HASH_ALGORITHM, ECDSA_CURVE_NAMES, ECDSA_SIGNATURE_ALGOS, OID_RSASSA_PSS, RSA_SIGNATURE_ALGOS, SHA2_HASH_ALGOS } from \"../oid.js\";\nimport {\n X509AuthorityKeyIDExtension,\n X509BasicConstraintsExtension,\n X509BuildConfigDigestExtension,\n X509BuildConfigURIExtension,\n X509BuildSignerDigestExtension,\n X509BuildSignerURIExtension,\n X509BuildTriggerExtension,\n X509Extension,\n X509FulcioIssuerV1,\n X509FulcioIssuerV2,\n X509GitHubWorkflowNameExtension,\n X509GitHubWorkflowRefExtension,\n X509GitHubWorkflowRepositoryExtension,\n X509GitHubWorkflowSHAExtension,\n X509GitHubWorkflowTriggerExtension,\n X509KeyUsageExtension,\n X509RunInvocationURIExtension,\n X509RunnerEnvironmentExtension,\n X509SCTExtension,\n X509SourceRepositoryDigestExtension,\n X509SourceRepositoryIdentifierExtension,\n X509SourceRepositoryOwnerIdentifierExtension,\n X509SourceRepositoryOwnerURIExtension,\n X509SourceRepositoryRefExtension,\n X509SourceRepositoryURIExtension,\n X509SourceRepositoryVisibilityExtension,\n X509SubjectAlternativeNameExtension,\n X509SubjectKeyIDExtension,\n} from \"./ext.js\";\n\n// Standard X.509 extension OIDs\nconst EXTENSION_OID_SUBJECT_KEY_ID = \"2.5.29.14\";\nconst EXTENSION_OID_KEY_USAGE = \"2.5.29.15\";\nconst EXTENSION_OID_SUBJECT_ALT_NAME = \"2.5.29.17\";\nconst EXTENSION_OID_BASIC_CONSTRAINTS = \"2.5.29.19\";\nconst EXTENSION_OID_AUTHORITY_KEY_ID = \"2.5.29.35\";\n\n// CT Log SCT extension OID\nexport const EXTENSION_OID_SCT = \"1.3.6.1.4.1.11129.2.4.2\";\n\n// Distinguished Name attribute OIDs (X.500)\nconst DN_OID_COMMON_NAME = \"2.5.4.3\";\nconst DN_OID_COUNTRY = \"2.5.4.6\";\nconst DN_OID_LOCALITY = \"2.5.4.7\";\nconst DN_OID_STATE = \"2.5.4.8\";\nconst DN_OID_ORGANIZATION = \"2.5.4.10\";\nconst DN_OID_ORGANIZATIONAL_UNIT = \"2.5.4.11\";\n\nconst DN_OID_TO_NAME: Record<string, string> = {\n [DN_OID_COMMON_NAME]: \"CN\",\n [DN_OID_COUNTRY]: \"C\",\n [DN_OID_LOCALITY]: \"L\",\n [DN_OID_STATE]: \"ST\",\n [DN_OID_ORGANIZATION]: \"O\",\n [DN_OID_ORGANIZATIONAL_UNIT]: \"OU\",\n};\n\n// Fulcio extension OIDs\n// https://github.com/sigstore/fulcio/blob/main/docs/oid-info.md\nexport const EXTENSION_OID_FULCIO_ISSUER_V1 = \"1.3.6.1.4.1.57264.1.1\";\nexport const EXTENSION_OID_GITHUB_WORKFLOW_TRIGGER = \"1.3.6.1.4.1.57264.1.2\";\nexport const EXTENSION_OID_GITHUB_WORKFLOW_SHA = \"1.3.6.1.4.1.57264.1.3\";\nexport const EXTENSION_OID_GITHUB_WORKFLOW_NAME = \"1.3.6.1.4.1.57264.1.4\";\nexport const EXTENSION_OID_GITHUB_WORKFLOW_REPOSITORY = \"1.3.6.1.4.1.57264.1.5\";\nexport const EXTENSION_OID_GITHUB_WORKFLOW_REF = \"1.3.6.1.4.1.57264.1.6\";\nexport const EXTENSION_OID_OTHERNAME = \"1.3.6.1.4.1.57264.1.7\";\nexport const EXTENSION_OID_FULCIO_ISSUER_V2 = \"1.3.6.1.4.1.57264.1.8\";\nexport const EXTENSION_OID_BUILD_SIGNER_URI = \"1.3.6.1.4.1.57264.1.9\";\nexport const EXTENSION_OID_BUILD_SIGNER_DIGEST = \"1.3.6.1.4.1.57264.1.10\";\nexport const EXTENSION_OID_RUNNER_ENVIRONMENT = \"1.3.6.1.4.1.57264.1.11\";\nexport const EXTENSION_OID_SOURCE_REPOSITORY_URI = \"1.3.6.1.4.1.57264.1.12\";\nexport const EXTENSION_OID_SOURCE_REPOSITORY_DIGEST = \"1.3.6.1.4.1.57264.1.13\";\nexport const EXTENSION_OID_SOURCE_REPOSITORY_REF = \"1.3.6.1.4.1.57264.1.14\";\nexport const EXTENSION_OID_SOURCE_REPOSITORY_IDENTIFIER = \"1.3.6.1.4.1.57264.1.15\";\nexport const EXTENSION_OID_SOURCE_REPOSITORY_OWNER_URI = \"1.3.6.1.4.1.57264.1.16\";\nexport const EXTENSION_OID_SOURCE_REPOSITORY_OWNER_IDENTIFIER = \"1.3.6.1.4.1.57264.1.17\";\nexport const EXTENSION_OID_BUILD_CONFIG_URI = \"1.3.6.1.4.1.57264.1.18\";\nexport const EXTENSION_OID_BUILD_CONFIG_DIGEST = \"1.3.6.1.4.1.57264.1.19\";\nexport const EXTENSION_OID_BUILD_TRIGGER = \"1.3.6.1.4.1.57264.1.20\";\nexport const EXTENSION_OID_RUN_INVOCATION_URI = \"1.3.6.1.4.1.57264.1.21\";\nexport const EXTENSION_OID_SOURCE_REPOSITORY_VISIBILITY = \"1.3.6.1.4.1.57264.1.22\";\n\nexport class X509Certificate {\n public root: ASN1Obj;\n\n constructor(asn1: ASN1Obj) {\n this.root = asn1;\n }\n\n public static parse(cert: Uint8Array | string): X509Certificate {\n const der = typeof cert === \"string\" ? toDER(cert) : cert;\n const asn1 = ASN1Obj.parseBuffer(der);\n return new X509Certificate(asn1);\n }\n\n get tbsCertificate(): ASN1Obj {\n return this.tbsCertificateObj;\n }\n\n get version(): string {\n // version number is the first element of the version context specific tag\n const ver = this.versionObj.subs[0].toInteger();\n return `v${(ver + BigInt(1)).toString()}`;\n }\n\n get serialNumber(): Uint8Array {\n return this.serialNumberObj.value;\n }\n\n get notBefore(): Date {\n // notBefore is the first element of the validity sequence\n return this.validityObj.subs[0].toDate();\n }\n\n get notAfter(): Date {\n // notAfter is the second element of the validity sequence\n return this.validityObj.subs[1].toDate();\n }\n\n get issuer(): Uint8Array {\n return this.issuerObj.value;\n }\n\n get subject(): Uint8Array {\n return this.subjectObj.value;\n }\n\n /**\n * Returns the issuer distinguished name as a Map of attribute names to values.\n * Common attributes: CN (Common Name), O (Organization), L (Locality),\n * ST (State), C (Country), OU (Organizational Unit)\n */\n get issuerDN(): Map<string, string> {\n return this.parseDistinguishedName(this.issuerObj);\n }\n\n /**\n * Returns the subject distinguished name as a Map of attribute names to values.\n * Common attributes: CN (Common Name), O (Organization), L (Locality),\n * ST (State), C (Country), OU (Organizational Unit)\n */\n get subjectDN(): Map<string, string> {\n return this.parseDistinguishedName(this.subjectObj);\n }\n\n get publicKey(): Uint8Array {\n return this.subjectPublicKeyInfoObj.toDER();\n }\n\n /**\n * Import the public key with a specific hash algorithm and signature scheme for RSA keys.\n * For ECDSA keys, both parameters are ignored.\n * @param hashAlg - Hash algorithm (e.g., \"sha384\") for RSA keys\n * @param usePss - If true, import as RSA-PSS key; if false, import as PKCS#1 v1.5\n */\n public async getPublicKeyObj(hashAlg?: string, usePss?: boolean): Promise<CryptoKey> {\n const publicKey = this.subjectPublicKeyInfoObj.toDER();\n const spki = ASN1Obj.parseBuffer(publicKey);\n const algorithmOID = spki.subs[0].subs[0].toOID();\n\n // RSA key (OID 1.2.840.113549.1.1.1) or RSA-PSS key (OID 1.2.840.113549.1.1.10)\n const isRsaKey = algorithmOID === \"1.2.840.113549.1.1.1\";\n const isRsaPssKey = algorithmOID === OID_RSASSA_PSS;\n\n if (isRsaPssKey) {\n // WebCrypto doesn't support importing keys with id-RSASSA-PSS OID, only rsaEncryption\n throw new Error(\n \"RSA-PSS public keys (id-RSASSA-PSS OID) are not supported by WebCrypto. \" +\n \"Only certificates with standard RSA keys (rsaEncryption OID) signed using RSA-PSS are supported.\"\n );\n }\n\n if (isRsaKey) {\n const hash = hashAlg || DEFAULT_HASH_ALGORITHM;\n // crypto-browser extracts hash from scheme and uses PSS unless \"PKCS1\" is present\n const scheme = usePss ? hash : `PKCS1_${hash}`;\n return importKey(KeyTypes.RSA, scheme, Uint8ArrayToBase64(publicKey));\n } else {\n // ECDSA key - the curve OID is in the second element\n const curveOID = spki.subs[0].subs[1]?.toOID();\n const curve = ECDSA_CURVE_NAMES[curveOID];\n if (!curve) {\n throw new Error(`Unknown ECDSA curve OID: ${curveOID}`);\n }\n return importKey(KeyTypes.Ecdsa, curve, Uint8ArrayToBase64(publicKey));\n }\n }\n\n get publicKeyObj(): Promise<CryptoKey> {\n return this.getPublicKeyObj();\n }\n\n get signatureAlgorithm(): string {\n const oid: string = this.signatureAlgorithmObj.subs[0].toOID();\n return ECDSA_SIGNATURE_ALGOS[oid] || RSA_SIGNATURE_ALGOS[oid] || this.parseRsaPssHashAlgorithm();\n }\n\n get signatureAlgorithmOid(): string {\n return this.signatureAlgorithmObj.subs[0].toOID();\n }\n\n /**\n * Parse hash algorithm from RSA-PSS signature algorithm parameters.\n * RSA-PSS parameters are: SEQUENCE { hashAlgorithm, maskGenAlgorithm, saltLength, trailerField }\n */\n private parseRsaPssHashAlgorithm(): string {\n const sigAlgOid = this.signatureAlgorithmObj.subs[0].toOID();\n if (sigAlgOid !== OID_RSASSA_PSS) {\n return \"\";\n }\n\n // RSA-PSS has parameters in the second element of the signature algorithm sequence\n const params = this.signatureAlgorithmObj.subs[1];\n if (!params || params.subs.length === 0) {\n return DEFAULT_HASH_ALGORITHM;\n }\n\n // First element is hashAlgorithm [0] EXPLICIT\n const hashAlgWrapper = params.subs[0];\n if (hashAlgWrapper && hashAlgWrapper.subs.length > 0) {\n // The wrapper contains a SEQUENCE with the hash algorithm OID\n const hashAlgSeq = hashAlgWrapper.subs[0];\n if (hashAlgSeq && hashAlgSeq.subs.length > 0) {\n const hashOid = hashAlgSeq.subs[0].toOID();\n return SHA2_HASH_ALGOS[hashOid] || DEFAULT_HASH_ALGORITHM;\n }\n }\n\n return DEFAULT_HASH_ALGORITHM;\n }\n\n get signatureValue(): Uint8Array {\n // Signature value is a bit string, so we need to skip the first byte\n return this.signatureValueObj.value.subarray(1);\n }\n\n get subjectAltName(): string | undefined {\n const ext = this.extSubjectAltName;\n return ext?.uri || ext?.rfc822Name;\n }\n\n get extensions(): ASN1Obj[] {\n // The extension list is the first (and only) element of the extensions\n // context specific tag\n const extSeq = this.extensionsObj?.subs[0];\n return extSeq?.subs || /* istanbul ignore next */ [];\n }\n\n get extKeyUsage(): X509KeyUsageExtension | undefined {\n const ext = this.findExtension(EXTENSION_OID_KEY_USAGE);\n return ext ? new X509KeyUsageExtension(ext) : undefined;\n }\n\n get extBasicConstraints(): X509BasicConstraintsExtension | undefined {\n const ext = this.findExtension(EXTENSION_OID_BASIC_CONSTRAINTS);\n return ext ? new X509BasicConstraintsExtension(ext) : undefined;\n }\n\n get extSubjectAltName(): X509SubjectAlternativeNameExtension | undefined {\n const ext = this.findExtension(EXTENSION_OID_SUBJECT_ALT_NAME);\n return ext ? new X509SubjectAlternativeNameExtension(ext) : undefined;\n }\n\n get extAuthorityKeyID(): X509AuthorityKeyIDExtension | undefined {\n const ext = this.findExtension(EXTENSION_OID_AUTHORITY_KEY_ID);\n return ext ? new X509AuthorityKeyIDExtension(ext) : undefined;\n }\n\n get extSubjectKeyID(): X509SubjectKeyIDExtension | undefined {\n const ext = this.findExtension(EXTENSION_OID_SUBJECT_KEY_ID);\n return ext\n ? new X509SubjectKeyIDExtension(ext)\n : /* istanbul ignore next */ undefined;\n }\n\n get extSCT(): X509SCTExtension | undefined {\n const ext = this.findExtension(EXTENSION_OID_SCT);\n return ext ? new X509SCTExtension(ext) : undefined;\n }\n\n get extFulcioIssuerV1(): X509FulcioIssuerV1 | undefined {\n const ext = this.findExtension(EXTENSION_OID_FULCIO_ISSUER_V1);\n return ext ? new X509FulcioIssuerV1(ext) : undefined;\n }\n\n get extFulcioIssuerV2(): X509FulcioIssuerV2 | undefined {\n const ext = this.findExtension(EXTENSION_OID_FULCIO_ISSUER_V2);\n return ext ? new X509FulcioIssuerV2(ext) : undefined;\n }\n\n get extGitHubWorkflowTrigger(): X509GitHubWorkflowTriggerExtension | undefined {\n const ext = this.findExtension(EXTENSION_OID_GITHUB_WORKFLOW_TRIGGER);\n return ext ? new X509GitHubWorkflowTriggerExtension(ext) : undefined;\n }\n\n get extGitHubWorkflowSHA(): X509GitHubWorkflowSHAExtension | undefined {\n const ext = this.findExtension(EXTENSION_OID_GITHUB_WORKFLOW_SHA);\n return ext ? new X509GitHubWorkflowSHAExtension(ext) : undefined;\n }\n\n get extGitHubWorkflowName(): X509GitHubWorkflowNameExtension | undefined {\n const ext = this.findExtension(EXTENSION_OID_GITHUB_WORKFLOW_NAME);\n return ext ? new X509GitHubWorkflowNameExtension(ext) : undefined;\n }\n\n get extGitHubWorkflowRepository(): X509GitHubWorkflowRepositoryExtension | undefined {\n const ext = this.findExtension(EXTENSION_OID_GITHUB_WORKFLOW_REPOSITORY);\n return ext ? new X509GitHubWorkflowRepositoryExtension(ext) : undefined;\n }\n\n get extGitHubWorkflowRef(): X509GitHubWorkflowRefExtension | undefined {\n const ext = this.findExtension(EXTENSION_OID_GITHUB_WORKFLOW_REF);\n return ext ? new X509GitHubWorkflowRefExtension(ext) : undefined;\n }\n\n get extBuildSignerURI(): X509BuildSignerURIExtension | undefined {\n const ext = this.findExtension(EXTENSION_OID_BUILD_SIGNER_URI);\n return ext ? new X509BuildSignerURIExtension(ext) : undefined;\n }\n\n get extBuildSignerDigest(): X509BuildSignerDigestExtension | undefined {\n const ext = this.findExtension(EXTENSION_OID_BUILD_SIGNER_DIGEST);\n return ext ? new X509BuildSignerDigestExtension(ext) : undefined;\n }\n\n get extRunnerEnvironment(): X509RunnerEnvironmentExtension | undefined {\n const ext = this.findExtension(EXTENSION_OID_RUNNER_ENVIRONMENT);\n return ext ? new X509RunnerEnvironmentExtension(ext) : undefined;\n }\n\n get extSourceRepositoryURI(): X509SourceRepositoryURIExtension | undefined {\n const ext = this.findExtension(EXTENSION_OID_SOURCE_REPOSITORY_URI);\n return ext ? new X509SourceRepositoryURIExtension(ext) : undefined;\n }\n\n get extSourceRepositoryDigest(): X509SourceRepositoryDigestExtension | undefined {\n const ext = this.findExtension(EXTENSION_OID_SOURCE_REPOSITORY_DIGEST);\n return ext ? new X509SourceRepositoryDigestExtension(ext) : undefined;\n }\n\n get extSourceRepositoryRef(): X509SourceRepositoryRefExtension | undefined {\n const ext = this.findExtension(EXTENSION_OID_SOURCE_REPOSITORY_REF);\n return ext ? new X509SourceRepositoryRefExtension(ext) : undefined;\n }\n\n get extSourceRepositoryIdentifier(): X509SourceRepositoryIdentifierExtension | undefined {\n const ext = this.findExtension(EXTENSION_OID_SOURCE_REPOSITORY_IDENTIFIER);\n return ext ? new X509SourceRepositoryIdentifierExtension(ext) : undefined;\n }\n\n get extSourceRepositoryOwnerURI(): X509SourceRepositoryOwnerURIExtension | undefined {\n const ext = this.findExtension(EXTENSION_OID_SOURCE_REPOSITORY_OWNER_URI);\n return ext ? new X509SourceRepositoryOwnerURIExtension(ext) : undefined;\n }\n\n get extSourceRepositoryOwnerIdentifier(): X509SourceRepositoryOwnerIdentifierExtension | undefined {\n const ext = this.findExtension(EXTENSION_OID_SOURCE_REPOSITORY_OWNER_IDENTIFIER);\n return ext ? new X509SourceRepositoryOwnerIdentifierExtension(ext) : undefined;\n }\n\n get extBuildConfigURI(): X509BuildConfigURIExtension | undefined {\n const ext = this.findExtension(EXTENSION_OID_BUILD_CONFIG_URI);\n return ext ? new X509BuildConfigURIExtension(ext) : undefined;\n }\n\n get extBuildConfigDigest(): X509BuildConfigDigestExtension | undefined {\n const ext = this.findExtension(EXTENSION_OID_BUILD_CONFIG_DIGEST);\n return ext ? new X509BuildConfigDigestExtension(ext) : undefined;\n }\n\n get extBuildTrigger(): X509BuildTriggerExtension | undefined {\n const ext = this.findExtension(EXTENSION_OID_BUILD_TRIGGER);\n return ext ? new X509BuildTriggerExtension(ext) : undefined;\n }\n\n get extRunInvocationURI(): X509RunInvocationURIExtension | undefined {\n const ext = this.findExtension(EXTENSION_OID_RUN_INVOCATION_URI);\n return ext ? new X509RunInvocationURIExtension(ext) : undefined;\n }\n\n get extSourceRepositoryVisibility(): X509SourceRepositoryVisibilityExtension | undefined {\n const ext = this.findExtension(EXTENSION_OID_SOURCE_REPOSITORY_VISIBILITY);\n return ext ? new X509SourceRepositoryVisibilityExtension(ext) : undefined;\n }\n\n get isCA(): boolean {\n const ca = this.extBasicConstraints?.isCA || false;\n\n // If the KeyUsage extension is present, keyCertSign must be set\n if (this.extKeyUsage) {\n return ca && this.extKeyUsage.keyCertSign;\n }\n\n return ca;\n }\n\n public extension(oid: string): X509Extension | undefined {\n const ext = this.findExtension(oid);\n return ext ? new X509Extension(ext) : undefined;\n }\n\n public async verify(issuerCertificate?: X509Certificate): Promise<boolean> {\n // Extract the hash algorithm from this certificate's signature algorithm\n const sigAlgOID = this.signatureAlgorithmOid;\n const isRsaPss = sigAlgOID === OID_RSASSA_PSS;\n\n // Get hash algorithm - for RSA-PSS, parse from parameters; otherwise lookup in tables\n const hashAlg = isRsaPss\n ? this.parseRsaPssHashAlgorithm()\n : (RSA_SIGNATURE_ALGOS[sigAlgOID] || ECDSA_SIGNATURE_ALGOS[sigAlgOID]);\n\n // Use the issuer's public key if provided, otherwise use the subject's (for self-signed certs)\n // Import with the correct hash algorithm and key type for this certificate's signature\n const publicKeyObj = issuerCertificate\n ? await issuerCertificate.getPublicKeyObj(hashAlg, isRsaPss)\n : await this.getPublicKeyObj(hashAlg, isRsaPss);\n\n return await verifySignature(\n publicKeyObj,\n this.tbsCertificate.toDER(),\n this.signatureValue,\n this.signatureAlgorithm,\n );\n }\n\n public validForDate(date: Date): boolean {\n return this.notBefore <= date && date <= this.notAfter;\n }\n\n public equals(other: X509Certificate): boolean {\n return uint8ArrayEqual(this.root.toDER(), other.root.toDER());\n }\n\n // Creates a copy of the certificate with a new buffer\n public clone(): X509Certificate {\n const der = this.root.toDER();\n const clone = new Uint8Array(der);\n return X509Certificate.parse(clone);\n }\n\n private findExtension(oid: string): ASN1Obj | undefined {\n // Find the extension with the given OID. The OID will always be the first\n // element of the extension sequence\n return this.extensions.find((ext) => ext.subs[0].toOID() === oid);\n }\n\n /////////////////////////////////////////////////////////////////////////////\n // The following properties use the documented x509 structure to locate the\n // desired ASN.1 object\n // https://www.rfc-editor.org/rfc/rfc5280#section-4.1\n\n // https://www.rfc-editor.org/rfc/rfc5280#section-4.1.1.1\n private get tbsCertificateObj(): ASN1Obj {\n // tbsCertificate is the first element of the certificate sequence\n return this.root.subs[0];\n }\n\n // https://www.rfc-editor.org/rfc/rfc5280#section-4.1.1.2\n private get signatureAlgorithmObj(): ASN1Obj {\n // signatureAlgorithm is the second element of the certificate sequence\n return this.root.subs[1];\n }\n\n // https://www.rfc-editor.org/rfc/rfc5280#section-4.1.1.3\n private get signatureValueObj(): ASN1Obj {\n // signatureValue is the third element of the certificate sequence\n return this.root.subs[2];\n }\n\n // https://www.rfc-editor.org/rfc/rfc5280#section-4.1.2.1\n private get versionObj(): ASN1Obj {\n // version is the first element of the tbsCertificate sequence\n return this.tbsCertificateObj.subs[0];\n }\n\n // https://www.rfc-editor.org/rfc/rfc5280#section-4.1.2.2\n private get serialNumberObj(): ASN1Obj {\n // serialNumber is the second element of the tbsCertificate sequence\n return this.tbsCertificateObj.subs[1];\n }\n\n // https://www.rfc-editor.org/rfc/rfc5280#section-4.1.2.4\n private get issuerObj(): ASN1Obj {\n // issuer is the fourth element of the tbsCertificate sequence\n return this.tbsCertificateObj.subs[3];\n }\n\n // https://www.rfc-editor.org/rfc/rfc5280#section-4.1.2.5\n private get validityObj(): ASN1Obj {\n // version is the fifth element of the tbsCertificate sequence\n return this.tbsCertificateObj.subs[4];\n }\n\n // https://www.rfc-editor.org/rfc/rfc5280#section-4.1.2.6\n private get subjectObj(): ASN1Obj {\n // subject is the sixth element of the tbsCertificate sequence\n return this.tbsCertificateObj.subs[5];\n }\n\n // https://www.rfc-editor.org/rfc/rfc5280#section-4.1.2.7\n private get subjectPublicKeyInfoObj(): ASN1Obj {\n // subjectPublicKeyInfo is the seventh element of the tbsCertificate sequence\n return this.tbsCertificateObj.subs[6];\n }\n\n // Extensions can't be located by index because their position varies. Instead,\n // we need to find the extensions context specific tag\n // https://www.rfc-editor.org/rfc/rfc5280#section-4.1.2.9\n private get extensionsObj(): ASN1Obj | undefined {\n return this.tbsCertificateObj.subs.find((sub) =>\n sub.tag.isContextSpecific(0x03),\n );\n }\n\n // Parse a Distinguished Name (issuer or subject) ASN1Obj into a Map\n // DN structure: SEQUENCE of SET of SEQUENCE (AttributeTypeAndValue)\n // Each AttributeTypeAndValue is [OID, value]\n private parseDistinguishedName(dnObj: ASN1Obj): Map<string, string> {\n const result = new Map<string, string>();\n\n // Iterate over RDNs (RelativeDistinguishedName - each is a SET)\n for (const rdn of dnObj.subs) {\n // Each RDN contains one or more AttributeTypeAndValue (SEQUENCE)\n for (const atv of rdn.subs) {\n if (atv.subs.length >= 2) {\n const oidObj = atv.subs[0];\n const valueObj = atv.subs[1];\n\n if (oidObj.tag.isOID()) {\n const oid = oidObj.toOID();\n const attrName = DN_OID_TO_NAME[oid];\n if (attrName) {\n const value = new TextDecoder().decode(valueObj.value);\n result.set(attrName, value);\n }\n }\n }\n }\n }\n\n return result;\n }\n}\n"]}
|
package/dist/x509/chain.d.ts
CHANGED
package/dist/x509/chain.js
CHANGED
|
@@ -74,7 +74,7 @@ export class CertificateChainVerifier {
|
|
|
74
74
|
return paths;
|
|
75
75
|
}
|
|
76
76
|
async findIssuer(certificate) {
|
|
77
|
-
|
|
77
|
+
const issuers = [];
|
|
78
78
|
let keyIdentifier;
|
|
79
79
|
if (uint8ArrayEqual(certificate.subject, certificate.issuer)) {
|
|
80
80
|
if (await certificate.verify()) {
|
|
@@ -104,7 +104,7 @@ export class CertificateChainVerifier {
|
|
|
104
104
|
verifiedIssuers.push(issuer);
|
|
105
105
|
}
|
|
106
106
|
}
|
|
107
|
-
catch
|
|
107
|
+
catch {
|
|
108
108
|
// Ignore verification failures
|
|
109
109
|
}
|
|
110
110
|
}
|
package/dist/x509/chain.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"chain.js","sourceRoot":"","sources":["../../src/x509/chain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;EAcE;AAEF;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AASjE,MAAM,OAAO,wBAAwB;IAMnC,YAAY,IAAqC;QAC/C,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC;QACxC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;QACtC,IAAI,CAAC,UAAU,GAAG,kBAAkB,CAAC;YACnC,GAAG,IAAI,CAAC,YAAY;YACpB,IAAI,CAAC,aAAa;SACnB,CAAC,CAAC;QACH,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IAClC,CAAC;IAEM,KAAK,CAAC,MAAM;QACjB,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAE1C,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;QAEhC,MAAM,YAAY,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAClD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAClC,CAAC;QAEF,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CACb,2DAA2D,CAC5D,CAAC;QACJ,CAAC;QAED,OAAO,eAAe,CAAC;IACzB,CAAC;IAEO,KAAK,CAAC,IAAI;QAChB,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC;QAEpC,IAAI,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAE5C,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAC5B,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CACtD,CAAC;QAEF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACvD,CAAC;QAED,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CACvC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CACxC,CAAC;QAEF,OAAO,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1C,CAAC;IAEO,KAAK,CAAC,UAAU,CACtB,WAA4B;QAE5B,MAAM,KAAK,GAAG,EAAE,CAAC;QACjB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;QAEnD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACrD,CAAC;QAED,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACxC,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;YAE1B,IAAI,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC/B,KAAK,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;gBAC1B,SAAS;YACX,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;YAE/C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACzC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACvC,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,KAAK,CAAC,UAAU,CACtB,WAA4B;QAE5B,IAAI,OAAO,GAAsB,EAAE,CAAC;QACpC,IAAI,aAAqC,CAAC;QAE1C,IAAI,eAAe,CAAC,WAAW,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;YAC7D,IAAI,MAAM,WAAW,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC/B,OAAO,CAAC,WAAW,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;QAED,IAAI,WAAW,CAAC,iBAAiB,EAAE,CAAC;YAClC,aAAa,GAAG,WAAW,CAAC,iBAAiB,CAAC,aAAa,CAAC;QAC9D,CAAC;QAED,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,cAAc,EAAE,EAAE;YACzC,IAAI,aAAa,EAAE,CAAC;gBAClB,IAAI,cAAc,CAAC,eAAe,EAAE,CAAC;oBACnC,IACE,eAAe,CACb,cAAc,CAAC,eAAe,CAAC,aAAa,EAC5C,aAAa,CACd,EACD,CAAC;wBACD,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;oBAC/B,CAAC;oBACD,OAAO;gBACT,CAAC;YACH,CAAC;YAED,IAAI,eAAe,CAAC,cAAc,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;gBAChE,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YAC/B,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,MAAM,eAAe,GAAsB,EAAE,CAAC;QAC9C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,CAAC;gBACH,IAAI,MAAM,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;oBACrC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAC/B,CAAC;YACH,CAAC;YAAC,OAAO,EAAE,EAAE,CAAC;gBACZ,+BAA+B;YACjC,CAAC;QACH,CAAC;QAED,OAAO,eAAe,CAAC;IACzB,CAAC;IAEO,SAAS,CAAC,IAAuB;QACvC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CACb,yDAAyD,CAC1D,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,CAAC;QAED,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC1C,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC1D,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;YACzD,CAAC;QACH,CAAC;QAED,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YAErB,IAAI,IAAI,CAAC,mBAAmB,EAAE,IAAI,EAAE,CAAC;gBACnC,MAAM,UAAU,GAAG,IAAI,CAAC,mBAAmB,CAAC,iBAAiB,CAAC;gBAE9D,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;oBAC3D,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;gBACrD,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;CACF;AAED,SAAS,kBAAkB,CAAC,KAAwB;IAClD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC1C,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9B,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;gBACnB,CAAC,EAAE,CAAC;YACN,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}
|
|
1
|
+
{"version":3,"file":"chain.js","sourceRoot":"","sources":["../../src/x509/chain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;EAcE;AAEF;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAUjE,MAAM,OAAO,wBAAwB;IAMnC,YAAY,IAAqC;QAC/C,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC;QACxC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;QACtC,IAAI,CAAC,UAAU,GAAG,kBAAkB,CAAC;YACnC,GAAG,IAAI,CAAC,YAAY;YACpB,IAAI,CAAC,aAAa;SACnB,CAAC,CAAC;QACH,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IAClC,CAAC;IAEM,KAAK,CAAC,MAAM;QACjB,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAE1C,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;QAEhC,MAAM,YAAY,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAClD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAClC,CAAC;QAEF,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CACb,2DAA2D,CAC5D,CAAC;QACJ,CAAC;QAED,OAAO,eAAe,CAAC;IACzB,CAAC;IAEO,KAAK,CAAC,IAAI;QAChB,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC;QAEpC,IAAI,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAE5C,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAC5B,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CACtD,CAAC;QAEF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACvD,CAAC;QAED,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CACvC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CACxC,CAAC;QAEF,OAAO,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1C,CAAC;IAEO,KAAK,CAAC,UAAU,CACtB,WAA4B;QAE5B,MAAM,KAAK,GAAG,EAAE,CAAC;QACjB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;QAEnD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACrD,CAAC;QAED,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACxC,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;YAE1B,IAAI,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC/B,KAAK,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;gBAC1B,SAAS;YACX,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;YAE/C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACzC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACvC,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,KAAK,CAAC,UAAU,CACtB,WAA4B;QAE5B,MAAM,OAAO,GAAsB,EAAE,CAAC;QACtC,IAAI,aAAqC,CAAC;QAE1C,IAAI,eAAe,CAAC,WAAW,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;YAC7D,IAAI,MAAM,WAAW,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC/B,OAAO,CAAC,WAAW,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;QAED,IAAI,WAAW,CAAC,iBAAiB,EAAE,CAAC;YAClC,aAAa,GAAG,WAAW,CAAC,iBAAiB,CAAC,aAAa,CAAC;QAC9D,CAAC;QAED,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,cAAc,EAAE,EAAE;YACzC,IAAI,aAAa,EAAE,CAAC;gBAClB,IAAI,cAAc,CAAC,eAAe,EAAE,CAAC;oBACnC,IACE,eAAe,CACb,cAAc,CAAC,eAAe,CAAC,aAAa,EAC5C,aAAa,CACd,EACD,CAAC;wBACD,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;oBAC/B,CAAC;oBACD,OAAO;gBACT,CAAC;YACH,CAAC;YAED,IAAI,eAAe,CAAC,cAAc,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;gBAChE,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YAC/B,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,MAAM,eAAe,GAAsB,EAAE,CAAC;QAC9C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,CAAC;gBACH,IAAI,MAAM,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;oBACrC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAC/B,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,+BAA+B;YACjC,CAAC;QACH,CAAC;QAED,OAAO,eAAe,CAAC;IACzB,CAAC;IAEO,SAAS,CAAC,IAAuB;QACvC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CACb,yDAAyD,CAC1D,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,CAAC;QAED,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC1C,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC1D,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;YACzD,CAAC;QACH,CAAC;QAED,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YAErB,IAAI,IAAI,CAAC,mBAAmB,EAAE,IAAI,EAAE,CAAC;gBACnC,MAAM,UAAU,GAAG,IAAI,CAAC,mBAAmB,CAAC,iBAAiB,CAAC;gBAE9D,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;oBAC3D,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;gBACrD,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;CACF;AAED,SAAS,kBAAkB,CAAC,KAAwB;IAClD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC1C,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9B,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;gBACnB,CAAC,EAAE,CAAC;YACN,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC","sourcesContent":["/*\nCopyright 2023 The Sigstore Authors.\n\nLicensed under the Apache License, Version 2.0 (the \"License\");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n*/\n\n/*\n * Certificate chain verification for browser environments\n *\n * Ported from sigstore-js:\n * https://github.com/sigstore/sigstore-js/blob/main/packages/verify/src/key/certificate.ts\n *\n * Key differences from sigstore-js:\n * - Browser-compatible: async verify() method for Web Crypto API\n * - Uses Uint8Array instead of Buffer for binary data\n * - Uses uint8ArrayEqual for Uint8Array comparisons\n */\n\nimport { uint8ArrayEqual } from \"@freedomofpress/crypto-browser\";\n\nimport { X509Certificate } from \"./cert.js\";\n\ninterface CertificateChainVerifierOptions {\n trustedCerts: X509Certificate[];\n untrustedCert: X509Certificate;\n timestamp: Date;\n}\n\nexport class CertificateChainVerifier {\n private untrustedCert: X509Certificate;\n private trustedCerts: X509Certificate[];\n private localCerts: X509Certificate[];\n private timestamp: Date;\n\n constructor(opts: CertificateChainVerifierOptions) {\n this.untrustedCert = opts.untrustedCert;\n this.trustedCerts = opts.trustedCerts;\n this.localCerts = dedupeCertificates([\n ...opts.trustedCerts,\n opts.untrustedCert,\n ]);\n this.timestamp = opts.timestamp;\n }\n\n public async verify(): Promise<X509Certificate[]> {\n const certificatePath = await this.sort();\n\n this.checkPath(certificatePath);\n\n const validForDate = certificatePath.every((cert) =>\n cert.validForDate(this.timestamp)\n );\n\n if (!validForDate) {\n throw new Error(\n \"certificate is not valid or expired at the specified date\"\n );\n }\n\n return certificatePath;\n }\n\n private async sort(): Promise<X509Certificate[]> {\n const leafCert = this.untrustedCert;\n\n let paths = await this.buildPaths(leafCert);\n\n paths = paths.filter((path) =>\n path.some((cert) => this.trustedCerts.includes(cert))\n );\n\n if (paths.length === 0) {\n throw new Error(\"no trusted certificate path found\");\n }\n\n const path = paths.reduce((prev, curr) =>\n prev.length < curr.length ? prev : curr\n );\n\n return [leafCert, ...path].slice(0, -1);\n }\n\n private async buildPaths(\n certificate: X509Certificate\n ): Promise<X509Certificate[][]> {\n const paths = [];\n const issuers = await this.findIssuer(certificate);\n\n if (issuers.length === 0) {\n throw new Error(\"no valid certificate path found\");\n }\n\n for (let i = 0; i < issuers.length; i++) {\n const issuer = issuers[i];\n\n if (issuer.equals(certificate)) {\n paths.push([certificate]);\n continue;\n }\n\n const subPaths = await this.buildPaths(issuer);\n\n for (let j = 0; j < subPaths.length; j++) {\n paths.push([issuer, ...subPaths[j]]);\n }\n }\n\n return paths;\n }\n\n private async findIssuer(\n certificate: X509Certificate\n ): Promise<X509Certificate[]> {\n const issuers: X509Certificate[] = [];\n let keyIdentifier: Uint8Array | undefined;\n\n if (uint8ArrayEqual(certificate.subject, certificate.issuer)) {\n if (await certificate.verify()) {\n return [certificate];\n }\n }\n\n if (certificate.extAuthorityKeyID) {\n keyIdentifier = certificate.extAuthorityKeyID.keyIdentifier;\n }\n\n this.localCerts.forEach((possibleIssuer) => {\n if (keyIdentifier) {\n if (possibleIssuer.extSubjectKeyID) {\n if (\n uint8ArrayEqual(\n possibleIssuer.extSubjectKeyID.keyIdentifier,\n keyIdentifier\n )\n ) {\n issuers.push(possibleIssuer);\n }\n return;\n }\n }\n\n if (uint8ArrayEqual(possibleIssuer.subject, certificate.issuer)) {\n issuers.push(possibleIssuer);\n }\n });\n\n const verifiedIssuers: X509Certificate[] = [];\n for (const issuer of issuers) {\n try {\n if (await certificate.verify(issuer)) {\n verifiedIssuers.push(issuer);\n }\n } catch {\n // Ignore verification failures\n }\n }\n\n return verifiedIssuers;\n }\n\n private checkPath(path: X509Certificate[]): void {\n if (path.length < 1) {\n throw new Error(\n \"certificate chain must contain at least one certificate\"\n );\n }\n\n const validCAs = path.slice(1).every((cert) => cert.isCA);\n if (!validCAs) {\n throw new Error(\"intermediate certificate is not a CA\");\n }\n\n for (let i = path.length - 2; i >= 0; i--) {\n if (!uint8ArrayEqual(path[i].issuer, path[i + 1].subject)) {\n throw new Error(\"incorrect certificate name chaining\");\n }\n }\n\n for (let i = 0; i < path.length; i++) {\n const cert = path[i];\n\n if (cert.extBasicConstraints?.isCA) {\n const pathLength = cert.extBasicConstraints.pathLenConstraint;\n\n if (pathLength !== undefined && pathLength < BigInt(i - 1)) {\n throw new Error(\"path length constraint exceeded\");\n }\n }\n }\n }\n}\n\nfunction dedupeCertificates(certs: X509Certificate[]): X509Certificate[] {\n for (let i = 0; i < certs.length; i++) {\n for (let j = i + 1; j < certs.length; j++) {\n if (certs[i].equals(certs[j])) {\n certs.splice(j, 1);\n j--;\n }\n }\n }\n return certs;\n}\n"]}
|
package/dist/x509/ext.d.ts
CHANGED