@freedomofpress/sigstore-browser 0.1.14 → 0.1.16

package/src/cli.ts

@@ -1,290 +0,0 @@
-#!/usr/bin/env node
-import { createHash, webcrypto } from "node:crypto";
-import { access, readFile } from "node:fs/promises";
-import path from "node:path";
-
-import {
-  base64ToUint8Array,
-  hexToUint8Array,
-  Uint8ArrayToHex,
-  Uint8ArrayToString,
-} from "@freedomofpress/crypto-browser";
-import { SigstoreBundle } from "./bundle.js";
-import { TrustedRoot } from "./interfaces.js";
-import { SigstoreVerifier } from "./sigstore.js";
-import { TrustedRootProvider } from "./trust/tuf.js";
-
-// Ensure the global Web Crypto implementation is available when running under Node.js
-if (typeof globalThis.crypto === "undefined") {
-  globalThis.crypto = webcrypto as unknown as Crypto;
-}
-
-interface CLIOptions {
-  bundlePath: string;
-  certificateIdentity: string;
-  certificateOidcIssuer: string;
-  trustedRootPath: string | undefined;
-  artifactInput: string;
-}
-
-type ArtifactInput =
-  | { type: "file"; path: string; data: Uint8Array; digestHex: string }
-  | { type: "digest"; digestHex: string };
-
-const USAGE = `Usage: sigstore-browser verify-bundle [--staging] --bundle FILE --certificate-identity IDENTITY --certificate-oidc-issuer URL [--trusted-root FILE] FILE_OR_DIGEST`;
-
-function printUsage(): void {
-  console.error(USAGE);
-}
-
-function parseArgs(argv: string[]): CLIOptions {
-  const options: Partial<CLIOptions> = {};
-  let command: string | undefined;
-  let artifactInput: string | undefined;
-
-  for (let i = 0; i < argv.length; i++) {
-    const current = argv[i];
-
-    if (current === "--help" || current === "-h") {
-      printUsage();
-      process.exit(0);
-    }
-
-    if (current.startsWith("--")) {
-      const [name, providedValue] = current.split("=", 2);
-
-      switch (name) {
-        case "--bundle": {
-          const value = providedValue ?? argv[++i];
-          if (!value) {
-            throw new Error("Missing value for --bundle");
-          }
-          options.bundlePath = value;
-          break;
-        }
-        case "--certificate-identity": {
-          const value = providedValue ?? argv[++i];
-          if (!value) {
-            throw new Error("Missing value for --certificate-identity");
-          }
-          options.certificateIdentity = value;
-          break;
-        }
-        case "--certificate-oidc-issuer": {
-          const value = providedValue ?? argv[++i];
-          if (!value) {
-            throw new Error("Missing value for --certificate-oidc-issuer");
-          }
-          options.certificateOidcIssuer = value;
-          break;
-        }
-        case "--trusted-root": {
-          const value = providedValue ?? argv[++i];
-          if (!value) {
-            throw new Error("Missing value for --trusted-root");
-          }
-          options.trustedRootPath = value;
-          break;
-        }
-        default:
-          throw new Error(`Unknown option: ${name}`);
-      }
-
-      continue;
-    }
-
-    if (!command) {
-      command = current;
-      continue;
-    }
-
-    if (!artifactInput) {
-      artifactInput = current;
-      continue;
-    }
-
-    throw new Error(`Unexpected argument: ${current}`);
-  }
-
-  if (command !== "verify-bundle") {
-    throw new Error("No command provided. Expected 'verify-bundle'.");
-  }
-
-  if (!artifactInput) {
-    throw new Error("Missing FILE_OR_DIGEST argument.");
-  }
-
-  if (!options.bundlePath) {
-    throw new Error("Missing required option --bundle");
-  }
-
-  if (!options.certificateIdentity) {
-    throw new Error("Missing required option --certificate-identity");
-  }
-
-  if (!options.certificateOidcIssuer) {
-    throw new Error("Missing required option --certificate-oidc-issuer");
-  }
-
-  return {
-    bundlePath: options.bundlePath,
-    certificateIdentity: options.certificateIdentity,
-    certificateOidcIssuer: options.certificateOidcIssuer,
-    trustedRootPath: options.trustedRootPath,
-    artifactInput,
-  };
-}
-
-async function fileExists(filePath: string): Promise<boolean> {
-  try {
-    await access(filePath);
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-async function resolveArtifact(input: string): Promise<ArtifactInput> {
-  const digestPrefix = "sha256:";
-
-  if (
-    input.startsWith(digestPrefix) &&
-    input.length === digestPrefix.length + 64 &&
-    /^[0-9a-fA-F]+$/.test(input.slice(digestPrefix.length)) &&
-    !(await fileExists(input))
-  ) {
-    return {
-      type: "digest",
-      digestHex: input.slice(digestPrefix.length).toLowerCase(),
-    };
-  }
-
-  const resolvedPath = path.resolve(input);
-  const artifactBuffer = await readFile(resolvedPath);
-  const digestHex = createHash("sha256").update(artifactBuffer).digest("hex");
-
-  return {
-    type: "file",
-    path: resolvedPath,
-    data: new Uint8Array(artifactBuffer),
-    digestHex,
-  };
-}
-
-async function loadTrustedRoot(
-  pathInput: string | undefined,
-): Promise<TrustedRoot> {
-  if (!pathInput) {
-    // Use TUF to fetch the latest trusted root (matches sigstore-js behavior)
-    const tufProvider = new TrustedRootProvider({
-      metadataUrl: "https://tuf-repo-cdn.sigstore.dev/",
-      targetBaseUrl: "https://tuf-repo-cdn.sigstore.dev/targets/",
-    });
-    return await tufProvider.getTrustedRoot();
-  }
-  const resolvedPath = path.resolve(pathInput);
-  const raw = await readFile(resolvedPath, "utf8");
-  return JSON.parse(raw) as TrustedRoot;
-}
-
-async function loadBundle(bundlePath: string): Promise<SigstoreBundle> {
-  const resolved = path.resolve(bundlePath);
-  const raw = await readFile(resolved, "utf8");
-  return JSON.parse(raw) as SigstoreBundle;
-}
-
-async function verifyBundle(options: CLIOptions): Promise<void> {
-  const [trustedRoot, bundle, artifact] = await Promise.all([
-    loadTrustedRoot(options.trustedRootPath),
-    loadBundle(options.bundlePath),
-    resolveArtifact(options.artifactInput),
-  ]);
-
-  const verifier = new SigstoreVerifier();
-  await verifier.loadSigstoreRoot(trustedRoot);
-
-  // Extract and verify the artifact digest from the bundle
-  let bundleDigestHex: string;
-  let bundleDigestBytes: Uint8Array;
-
-  if (bundle.messageSignature) {
-    // Regular bundle: digest is in messageSignature
-    if (bundle.messageSignature.messageDigest.algorithm !== "SHA2_256") {
-      throw new Error(
-        `Unsupported message digest algorithm: ${bundle.messageSignature.messageDigest.algorithm}`,
-      );
-    }
-
-    bundleDigestBytes = base64ToUint8Array(
-      bundle.messageSignature.messageDigest.digest,
-    );
-    bundleDigestHex = Uint8ArrayToHex(bundleDigestBytes).toLowerCase();
-  } else if (bundle.dsseEnvelope) {
-    // DSSE bundle: digest is in the in-toto statement payload
-    const payloadBytes = base64ToUint8Array(bundle.dsseEnvelope.payload);
-    const payload = JSON.parse(Uint8ArrayToString(payloadBytes));
-
-    if (!payload.subject || payload.subject.length === 0) {
-      throw new Error("DSSE payload has no subject");
-    }
-
-    // Find matching subject by comparing artifact digest with all subjects
-    let matchedSubject = null;
-    for (const subject of payload.subject) {
-      const subjectDigest = subject.digest?.["sha256"];
-      if (subjectDigest && artifact.digestHex === subjectDigest.toLowerCase()) {
-        matchedSubject = subject;
-        break;
-      }
-    }
-
-    if (!matchedSubject) {
-      throw new Error(
-        `Artifact digest ${artifact.digestHex} does not match any subject in DSSE payload`
-      );
-    }
-
-    bundleDigestHex = matchedSubject.digest["sha256"].toLowerCase();
-
-    // Convert hex digest to bytes for verification target
-    bundleDigestBytes = hexToUint8Array(bundleDigestHex);
-  } else {
-    throw new Error("Bundle does not contain a message signature or DSSE envelope");
-  }
-
-  // For non-DSSE bundles, verify the digest matches
-  if (bundle.messageSignature && artifact.digestHex !== bundleDigestHex) {
-    throw new Error(
-      "Artifact digest does not match the digest embedded in the bundle.",
-    );
-  }
-
-  const verificationTarget =
-    artifact.type === "file" ? artifact.data : bundleDigestBytes;
-  const isDigestOnly = artifact.type === "digest";
-
-  await verifier.verifyArtifact(
-    options.certificateIdentity,
-    options.certificateOidcIssuer,
-    bundle,
-    verificationTarget,
-    isDigestOnly,
-  );
-}
-
-async function main(): Promise<void> {
-  try {
-    const options = parseArgs(process.argv.slice(2));
-    await verifyBundle(options);
-    console.log("Bundle verification succeeded.");
-  } catch (error) {
-    if (error instanceof Error) {
-      console.error(error.message);
-    } else {
-      console.error(error);
-    }
-    process.exitCode = 1;
-  }
-}
-
-await main();

package/src/dsse.ts

@@ -1,49 +0,0 @@
-/*
-Copyright 2023 The Sigstore Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-const PAE_PREFIX = "DSSEv1";
-
-// DSSE Pre-Authentication Encoding
-export function preAuthEncoding(
-  payloadType: string,
-  payload: Uint8Array,
-): Uint8Array {
-  const prefix = [
-    PAE_PREFIX,
-    payloadType.length,
-    payloadType,
-    payload.length,
-    "",
-  ].join(" ");
-
-  // DSSE spec requires ASCII encoding for the prefix
-  // TextEncoder will throw if the string contains non-ASCII characters
-  const encoder = new TextEncoder();
-  const prefixBuffer = encoder.encode(prefix);
-
-  // Verify all characters are ASCII (< 128)
-  for (let i = 0; i < prefixBuffer.length; i++) {
-    if (prefixBuffer[i] > 127) {
-      throw new Error(`Invalid non-ASCII character in PAE prefix at position ${i}`);
-    }
-  }
-
-  // Concatenate prefix and payload
-  const combinedArray = new Uint8Array(prefixBuffer.length + payload.length);
-
-  combinedArray.set(prefixBuffer, 0);
-  combinedArray.set(payload, prefixBuffer.length);
-  return combinedArray;
-}

package/src/errors.ts

@@ -1,82 +0,0 @@
-/*
-Copyright 2023 The Sigstore Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-/**
- * Base class for all verification errors
- * Provides structured error handling with error codes
- */
-export class VerificationError extends Error {
-  constructor(public code: string, message: string) {
-    super(message);
-    this.name = 'VerificationError';
-    Object.setPrototypeOf(this, VerificationError.prototype);
-  }
-}
-
-/**
- * Error thrown when timestamp verification fails
- */
-export class TimestampError extends VerificationError {
-  constructor(message: string) {
-    super('TIMESTAMP_ERROR', message);
-    this.name = 'TimestampError';
-    Object.setPrototypeOf(this, TimestampError.prototype);
-  }
-}
-
-/**
- * Error thrown when certificate verification fails
- */
-export class CertificateError extends VerificationError {
-  constructor(message: string) {
-    super('CERTIFICATE_ERROR', message);
-    this.name = 'CertificateError';
-    Object.setPrototypeOf(this, CertificateError.prototype);
-  }
-}
-
-/**
- * Error thrown when transparency log verification fails
- */
-export class TLogError extends VerificationError {
-  constructor(message: string) {
-    super('TLOG_ERROR', message);
-    this.name = 'TLogError';
-    Object.setPrototypeOf(this, TLogError.prototype);
-  }
-}
-
-/**
- * Error thrown when signature verification fails
- */
-export class SignatureError extends VerificationError {
-  constructor(message: string) {
-    super('SIGNATURE_ERROR', message);
-    this.name = 'SignatureError';
-    Object.setPrototypeOf(this, SignatureError.prototype);
-  }
-}
-
-/**
- * Error thrown when policy verification fails
- */
-export class PolicyError extends VerificationError {
-  constructor(message: string) {
-    super('POLICY_ERROR', message);
-    this.name = 'PolicyError';
-    Object.setPrototypeOf(this, PolicyError.prototype);
-  }
-}

package/src/index.browser.test.ts

@@ -1,290 +0,0 @@
-import { describe, it, expect } from "vitest";
-import { SigstoreVerifier, assertRekorV2Timestamp } from "./sigstore.js";
-import { X509Certificate } from "./x509/cert.js";
-
-describe("Sigstore Browser Integration Tests", () => {
-  it("should initialize SigstoreVerifier in browser", () => {
-    const verifier = new SigstoreVerifier();
-    expect(verifier).toBeDefined();
-    expect(verifier).toBeInstanceOf(SigstoreVerifier);
-  });
-
-  it("should have crypto.subtle available for ECDSA P-256 verification", async () => {
-    expect(globalThis.crypto).toBeDefined();
-    expect(globalThis.crypto.subtle).toBeDefined();
-
-    // Test ECDSA P-256 which is what Sigstore uses
-    const keyPair = await crypto.subtle.generateKey(
-      {
-        name: "ECDSA",
-        namedCurve: "P-256",
-      },
-      true,
-      ["sign", "verify"]
-    );
-
-    const data = new TextEncoder().encode("test");
-    const signature = await crypto.subtle.sign(
-      { name: "ECDSA", hash: "SHA-256" },
-      keyPair.privateKey,
-      data
-    );
-
-    const valid = await crypto.subtle.verify(
-      { name: "ECDSA", hash: "SHA-256" },
-      keyPair.publicKey,
-      signature,
-      data
-    );
-
-    expect(valid).toBe(true);
-  });
-
-  it("should have crypto.subtle available for ECDSA P-384 verification", async () => {
-    // Test ECDSA P-384 which is also used by Sigstore
-    const keyPair = await crypto.subtle.generateKey(
-      {
-        name: "ECDSA",
-        namedCurve: "P-384",
-      },
-      true,
-      ["sign", "verify"]
-    );
-
-    const data = new TextEncoder().encode("test");
-    const signature = await crypto.subtle.sign(
-      { name: "ECDSA", hash: "SHA-384" },
-      keyPair.privateKey,
-      data
-    );
-
-    const valid = await crypto.subtle.verify(
-      { name: "ECDSA", hash: "SHA-384" },
-      keyPair.publicKey,
-      signature,
-      data
-    );
-
-    expect(valid).toBe(true);
-  });
-
-  it("should support SHA-256 hashing in browser", async () => {
-    const data = new TextEncoder().encode("test data");
-    const hash = await crypto.subtle.digest("SHA-256", data);
-
-    expect(hash).toBeInstanceOf(ArrayBuffer);
-    expect(hash.byteLength).toBe(32);
-  });
-
-  it("should support SHA-384 hashing in browser", async () => {
-    const data = new TextEncoder().encode("test data");
-    const hash = await crypto.subtle.digest("SHA-384", data);
-
-    expect(hash).toBeInstanceOf(ArrayBuffer);
-    expect(hash.byteLength).toBe(48);
-  });
-
-  it("should support SHA-512 hashing in browser", async () => {
-    const data = new TextEncoder().encode("test data");
-    const hash = await crypto.subtle.digest("SHA-512", data);
-
-    expect(hash).toBeInstanceOf(ArrayBuffer);
-    expect(hash.byteLength).toBe(64);
-  });
-
-  it("should support X.509 certificate key import (SPKI format)", async () => {
-    const keyPair = await crypto.subtle.generateKey(
-      {
-        name: "ECDSA",
-        namedCurve: "P-256",
-      },
-      true,
-      ["sign", "verify"]
-    );
-
-    const exported = await crypto.subtle.exportKey("spki", keyPair.publicKey);
-    const imported = await crypto.subtle.importKey(
-      "spki",
-      exported,
-      { name: "ECDSA", namedCurve: "P-256" },
-      true,
-      ["verify"]
-    );
-
-    expect(imported).toBeDefined();
-    expect(imported.type).toBe("public");
-  });
-
-  it("should support RSA-PSS for signature verification", async () => {
-    const keyPair = await crypto.subtle.generateKey(
-      {
-        name: "RSA-PSS",
-        modulusLength: 2048,
-        publicExponent: new Uint8Array([1, 0, 1]),
-        hash: "SHA-256",
-      },
-      true,
-      ["sign", "verify"]
-    );
-
-    const data = new TextEncoder().encode("test");
-    const signature = await crypto.subtle.sign(
-      {
-        name: "RSA-PSS",
-        saltLength: 32,
-      },
-      keyPair.privateKey,
-      data
-    );
-
-    const valid = await crypto.subtle.verify(
-      {
-        name: "RSA-PSS",
-        saltLength: 32,
-      },
-      keyPair.publicKey,
-      signature,
-      data
-    );
-
-    expect(valid).toBe(true);
-  });
-
-  it("should verify RSA-PSS signed X.509 certificate", async () => {
-    // Self-signed certificate with standard RSA key but RSA-PSS signature (SHA-256, salt=32)
-    // WebCrypto requires rsaEncryption OID for the public key, not id-RSASSA-PSS
-    const rsaPssCertPem = `-----BEGIN CERTIFICATE-----
-MIIDhTCCAjmgAwIBAgIUYzfguLRx71Cbn2Ty7xCt3GH+N6AwQQYJKoZIhvcNAQEK
-MDSgDzANBglghkgBZQMEAgEFAKEcMBoGCSqGSIb3DQEBCDANBglghkgBZQMEAgEF
-AKIDAgEgMB4xHDAaBgNVBAMME1Rlc3QgUlNBLVBTUyBTaWduZWQwHhcNMjUxMTMw
-MDMwMDU2WhcNMjYxMTMwMDMwMDU2WjAeMRwwGgYDVQQDDBNUZXN0IFJTQS1QU1Mg
-U2lnbmVkMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA29B/88QFBILg
-YCWp1pF3xBj7FVhBUCv6JwyZAouYWUxgGmpFg6RLgbaWk59oDtEFQ5xRGSDXLuMW
-GL5wZVCjSnmYcBsBDROO+HfLKwDRcHw09bJY979PDHPy5EPZale/JsdxE+fepUw1
-XQDvlK5Dyp6WKl9UBjTtl6+LHKV/KTo+SiaQP2vsbZvTIt3s8MHybV/ixYXlSPQt
-Kju50REAaqSSYqxNzsq8Z2sjJbFBcatt5C1JhfoSyIHz5D0slriv8835DYhk0u4n
-bvNzXhWeF7htHTiPWCYwaTr5cgjyhEWg3SNP+Tu9dxCYVXm7/jWTHRdPqUPQqFsq
-wXqsrzSP+wIDAQABo1MwUTAdBgNVHQ4EFgQU+UcBxKusOtY4lSjqyFuxQfN5zdIw
-HwYDVR0jBBgwFoAU+UcBxKusOtY4lSjqyFuxQfN5zdIwDwYDVR0TAQH/BAUwAwEB
-/zBBBgkqhkiG9w0BAQowNKAPMA0GCWCGSAFlAwQCAQUAoRwwGgYJKoZIhvcNAQEI
-MA0GCWCGSAFlAwQCAQUAogMCASADggEBAFIn3VpfydVvpI82NwfeGxWlhZhgD2dX
-gJUhj6pcXqwnlCzpyRI4e3uNO1h9nr9UrogI0AV2IDhVdUYxz3F2/680JtxXpB1x
-J02BSAYllvXgf9efc20lFzbPDzvMzKnwx3S3proewbJ4uVPHzvKubWsx8MwEuI0X
-8xkI1qMIXgevTCt+LGhp+0C/u8WsW3or5ZI7GnZNowPJEAtZnfO+VORB7FvbzEGr
-ewS+2T7Qz4oXaQMidPOjr1Q8WKqaKO4yCtC8cz4qVWi3lNqAcAGtonQMXUiflEWV
-9kqKQx+LJYJqxKkBtDRnRLnVNn4+inotrgnV126LsCe3uLaGwJIFy1U=
------END CERTIFICATE-----`;
-
-    const cert = X509Certificate.parse(rsaPssCertPem);
-
-    // Verify it's an RSA-PSS certificate
-    expect(cert.signatureAlgorithmOid).toBe("1.2.840.113549.1.1.10");
-    expect(cert.signatureAlgorithm).toBe("sha256");
-
-    // Verify the self-signed certificate (signature verification)
-    const valid = await cert.verify();
-    expect(valid).toBe(true);
-  });
-
-  it("should support TextEncoder/TextDecoder for UTF-8", () => {
-    const encoder = new TextEncoder();
-    const decoder = new TextDecoder();
-
-    const text = "Hello Sigstore 🔐";
-    const encoded = encoder.encode(text);
-    const decoded = decoder.decode(encoded);
-
-    expect(decoded).toBe(text);
-    expect(encoded).toBeInstanceOf(Uint8Array);
-  });
-
-  it("should support base64 encoding/decoding (atob/btoa)", () => {
-    const text = "Hello Sigstore";
-    const base64 = btoa(text);
-    const decoded = atob(base64);
-
-    expect(decoded).toBe(text);
-    expect(base64).toBe("SGVsbG8gU2lnc3RvcmU=");
-  });
-
-  it("should support Uint8Array operations", () => {
-    const arr1 = new Uint8Array([1, 2, 3, 4, 5]);
-    const arr2 = new Uint8Array([6, 7, 8, 9, 10]);
-
-    const combined = new Uint8Array(arr1.length + arr2.length);
-    combined.set(arr1, 0);
-    combined.set(arr2, arr1.length);
-
-    expect(combined.length).toBe(10);
-    expect(combined[0]).toBe(1);
-    expect(combined[5]).toBe(6);
-  });
-
-  it("should support ArrayBuffer operations", () => {
-    const buffer = new ArrayBuffer(32);
-    const view = new Uint8Array(buffer);
-
-    view[0] = 255;
-    view[31] = 128;
-
-    expect(buffer.byteLength).toBe(32);
-    expect(view[0]).toBe(255);
-    expect(view[31]).toBe(128);
-  });
-
-  it("should support DataView for byte manipulation", () => {
-    const buffer = new ArrayBuffer(8);
-    const view = new DataView(buffer);
-
-    view.setUint32(0, 0x12345678, false); // big-endian
-    view.setUint32(4, 0x9abcdef0, false);
-
-    expect(view.getUint32(0, false)).toBe(0x12345678);
-    expect(view.getUint8(0)).toBe(0x12);
-    expect(view.getUint8(1)).toBe(0x34);
-  });
-
-  it("should support JSON parsing of complex structures", () => {
-    const json = '{"mediaType":"application/vnd.dev.sigstore.bundle+json;version=0.3","verificationMaterial":{"tlogEntries":[{"logIndex":"123"}]}}';
-    const parsed = JSON.parse(json);
-
-    expect(parsed.mediaType).toBeDefined();
-    expect(parsed.verificationMaterial).toBeDefined();
-    expect(parsed.verificationMaterial.tlogEntries).toBeInstanceOf(Array);
-    expect(parsed.verificationMaterial.tlogEntries[0].logIndex).toBe("123");
-  });
-});
-
-describe("Rekor v2 observer-timestamp enforcement", () => {
-  // Regression test: a Rekor-v2-shaped bundle (no integratedTime in the tlog
-  // entry) must carry a signed RFC3161 timestamp. A previous guard only checked
-  // that `timestampVerificationData` was present, which an empty object ({})
-  // satisfies in JavaScript — letting a crafted bundle pass verification with
-  // zero verified timestamps and the signing certificate's validity window left
-  // completely unanchored in time.
-
-  it("rejects a missing timestampVerificationData", () => {
-    expect(() => assertRekorV2Timestamp(undefined)).toThrow(
-      "Rekor v2 bundles require a timestamp for verification.",
-    );
-  });
-
-  it("rejects an empty timestampVerificationData object ({})", () => {
-    // This is the exact bypass the fix closes: {} is truthy.
-    expect(() => assertRekorV2Timestamp({})).toThrow(
-      "Rekor v2 bundles require a timestamp for verification.",
-    );
-  });
-
-  it("rejects timestampVerificationData with an empty rfc3161Timestamps array", () => {
-    expect(() =>
-      assertRekorV2Timestamp({ rfc3161Timestamps: [] }),
-    ).toThrow("Rekor v2 bundles require a timestamp for verification.");
-  });
-
-  it("accepts timestampVerificationData with at least one RFC3161 timestamp", () => {
-    expect(() =>
-      assertRekorV2Timestamp({ rfc3161Timestamps: [{ signedTimestamp: "…" }] }),
-    ).not.toThrow();
-  });
-});