@freedomofpress/sigstore-browser 0.1.14 → 0.1.16

package/src/index.ts

@@ -1,93 +0,0 @@
-export { SigstoreVerifier } from "./sigstore.js";
-export type { SigstoreVerifierOptions } from "./sigstore.js";
-export type { SigstoreBundle, TLogEntry, VerificationMaterial, MessageSignature, TimestampVerificationData, RFC3161Timestamp } from "./bundle.js";
-export type { TrustedRoot, Sigstore, RawTimestampAuthority } from "./interfaces.js";
-export {
-  VerificationError,
-  TimestampError,
-  CertificateError,
-  TLogError,
-  SignatureError,
-  PolicyError,
-} from "./errors.js";
-export { verifyRFC3161Timestamp, verifyBundleTimestamp } from "./timestamp/tsa.js";
-export { TrustedRootProvider, type TrustedRootProviderOptions } from "./trust/tuf.js";
-export {
-  X509Certificate,
-  EXTENSION_OID_SCT,
-  EXTENSION_OID_FULCIO_ISSUER_V1,
-  EXTENSION_OID_GITHUB_WORKFLOW_TRIGGER,
-  EXTENSION_OID_GITHUB_WORKFLOW_SHA,
-  EXTENSION_OID_GITHUB_WORKFLOW_NAME,
-  EXTENSION_OID_GITHUB_WORKFLOW_REPOSITORY,
-  EXTENSION_OID_GITHUB_WORKFLOW_REF,
-  EXTENSION_OID_OTHERNAME,
-  EXTENSION_OID_FULCIO_ISSUER_V2,
-  EXTENSION_OID_BUILD_SIGNER_URI,
-  EXTENSION_OID_BUILD_SIGNER_DIGEST,
-  EXTENSION_OID_RUNNER_ENVIRONMENT,
-  EXTENSION_OID_SOURCE_REPOSITORY_URI,
-  EXTENSION_OID_SOURCE_REPOSITORY_DIGEST,
-  EXTENSION_OID_SOURCE_REPOSITORY_REF,
-  EXTENSION_OID_SOURCE_REPOSITORY_IDENTIFIER,
-  EXTENSION_OID_SOURCE_REPOSITORY_OWNER_URI,
-  EXTENSION_OID_SOURCE_REPOSITORY_OWNER_IDENTIFIER,
-  EXTENSION_OID_BUILD_CONFIG_URI,
-  EXTENSION_OID_BUILD_CONFIG_DIGEST,
-  EXTENSION_OID_BUILD_TRIGGER,
-  EXTENSION_OID_RUN_INVOCATION_URI,
-  EXTENSION_OID_SOURCE_REPOSITORY_VISIBILITY,
-} from "./x509/cert.js";
-export {
-  X509Extension,
-  X509FulcioIssuerV1,
-  X509FulcioIssuerV2,
-  X509GitHubWorkflowTriggerExtension,
-  X509GitHubWorkflowSHAExtension,
-  X509GitHubWorkflowNameExtension,
-  X509GitHubWorkflowRepositoryExtension,
-  X509GitHubWorkflowRefExtension,
-  X509BuildSignerURIExtension,
-  X509BuildSignerDigestExtension,
-  X509RunnerEnvironmentExtension,
-  X509SourceRepositoryURIExtension,
-  X509SourceRepositoryDigestExtension,
-  X509SourceRepositoryRefExtension,
-  X509SourceRepositoryIdentifierExtension,
-  X509SourceRepositoryOwnerURIExtension,
-  X509SourceRepositoryOwnerIdentifierExtension,
-  X509BuildConfigURIExtension,
-  X509BuildConfigDigestExtension,
-  X509BuildTriggerExtension,
-  X509RunInvocationURIExtension,
-  X509SourceRepositoryVisibilityExtension,
-} from "./x509/ext.js";
-export { CertificateChainVerifier } from "./x509/chain.js";
-export {
-  GITHUB_OIDC_ISSUER,
-  OIDCIssuer,
-  OIDCIssuerV2,
-  GitHubWorkflowTrigger,
-  GitHubWorkflowSHA,
-  GitHubWorkflowName,
-  GitHubWorkflowRepository,
-  GitHubWorkflowRef,
-  OIDCBuildSignerURI,
-  OIDCBuildSignerDigest,
-  OIDCRunnerEnvironment,
-  OIDCSourceRepositoryURI,
-  OIDCSourceRepositoryDigest,
-  OIDCSourceRepositoryRef,
-  OIDCSourceRepositoryIdentifier,
-  OIDCSourceRepositoryOwnerURI,
-  OIDCSourceRepositoryOwnerIdentifier,
-  OIDCBuildConfigURI,
-  OIDCBuildConfigDigest,
-  OIDCBuildTrigger,
-  OIDCRunInvocationURI,
-  OIDCSourceRepositoryVisibility,
-  AllOf,
-  AnyOf,
-  Identity,
-} from "./policy.js";
-export type { VerificationPolicy } from "./policy.js";

package/src/interfaces.ts

@@ -1,123 +0,0 @@
-import { X509Certificate } from "./x509/index.js";
-
-export enum SigstoreRoots {
-  certificateAuthorities = "certificateAuthorities",
-  ctlogs = "ctlogs",
-  timestampAuthorities = "timestampAuthorities",
-  tlogs = "tlogs",
-}
-
-export type RawTimestampAuthorities = RawTimestampAuthority[];
-
-export interface TrustedRoot {
-  mediaType: string;
-  tlogs: RawLogs;
-  certificateAuthorities: RawCAs;
-  ctlogs: RawLogs;
-  timestampAuthorities: RawTimestampAuthorities;
-}
-
-export interface RawTimestampAuthority {
-  subject: {
-    organization: string;
-    commonName: string;
-  };
-  certChain: {
-    certificates: {
-      rawBytes: string;
-    }[];
-  };
-  validFor: {
-    start: string;
-    end?: string;
-  };
-}
-
-export interface CTLog {
-  logID: Uint8Array;
-  publicKey: CryptoKey;
-  validFor: {
-    start: Date;
-    end: Date;
-  };
-}
-
-export interface RekorKeyInfo {
-  publicKey: CryptoKey;
-  logId: Uint8Array;
-}
-
-export interface CertAuthority {
-  certChain: X509Certificate[];
-  validFor: {
-    start: Date;
-    end: Date;
-  };
-}
-
-export interface Sigstore {
-  rekor: RekorKeyInfo | undefined;
-  ctlogs: CTLog[];
-  certificateAuthorities: CertAuthority[];
-  timestampAuthorities: CertAuthority[];
-}
-
-export interface RawLog {
-  baseUrl: string;
-  hashAlgorithm: string;
-  publicKey: {
-    rawBytes: string;
-    keyDetails: string;
-    validFor: {
-      start: string;
-      end?: string;
-    };
-  };
-  logId: {
-    keyId: string;
-  };
-}
-
-export type RawLogs = RawLog[];
-
-export interface RawCA {
-  subject: {
-    organization: string;
-    commonName: string;
-  };
-  uri: string;
-  certChain: {
-    certificates: {
-      rawBytes: string;
-    }[];
-  };
-  validFor: {
-    start: string;
-    end?: string;
-  };
-}
-
-export type RawCAs = RawCA[];
-
-// Re-export crypto enums from crypto-browser (shared with tuf-browser)
-export { KeyTypes, EcdsaTypes, HashAlgorithms } from "@freedomofpress/crypto-browser";
-import { HashAlgorithms } from "@freedomofpress/crypto-browser";
-
-// Supported hash algorithms for payload hash validation
-// Rekor v1 uses lowercase (sha256), Rekor v2 uses uppercase with underscore (SHA2_256)
-const SUPPORTED_HASH_ALGORITHMS: Record<string, string> = {
-  "sha256": HashAlgorithms.SHA256,
-  "sha384": HashAlgorithms.SHA384,
-  "sha512": HashAlgorithms.SHA512,
-  "SHA2_256": HashAlgorithms.SHA256,
-  "SHA2_384": HashAlgorithms.SHA384,
-  "SHA2_512": HashAlgorithms.SHA512,
-};
-
-export function getHashAlgorithm(algorithm: string): string {
-  const hashAlg = SUPPORTED_HASH_ALGORITHMS[algorithm];
-  if (!hashAlg) {
-    throw new Error(`Unsupported hash algorithm: ${algorithm}`);
-  }
-  return hashAlg;
-}

package/src/oid.ts

@@ -1,34 +0,0 @@
-// From https://github.com/sigstore/sigstore-js/blob/main/packages/core/src/oid.ts
-
-export const ECDSA_SIGNATURE_ALGOS: Record<string, string> = {
-  "1.2.840.10045.4.3.1": "sha224",
-  "1.2.840.10045.4.3.2": "sha256",
-  "1.2.840.10045.4.3.3": "sha384",
-  "1.2.840.10045.4.3.4": "sha512",
-};
-
-// RSA signature algorithms (PKCS#1 v1.5)
-export const RSA_SIGNATURE_ALGOS: Record<string, string> = {
-  "1.2.840.113549.1.1.11": "sha256", // sha256WithRSAEncryption
-  "1.2.840.113549.1.1.12": "sha384", // sha384WithRSAEncryption
-  "1.2.840.113549.1.1.13": "sha512", // sha512WithRSAEncryption
-  "1.2.840.113549.1.1.5": "sha1",    // sha1WithRSAEncryption
-};
-
-// RSASSA-PSS OID - hash algorithm must be parsed from signature algorithm parameters
-export const OID_RSASSA_PSS = "1.2.840.113549.1.1.10";
-
-export const SHA2_HASH_ALGOS: Record<string, string> = {
-  "2.16.840.1.101.3.4.2.1": "sha256",
-  "2.16.840.1.101.3.4.2.2": "sha384",
-  "2.16.840.1.101.3.4.2.3": "sha512",
-};
-
-// Default hash algorithm used when not specified
-export const DEFAULT_HASH_ALGORITHM = "sha256";
-
-export const ECDSA_CURVE_NAMES: Record<string, string> = {
-  "1.2.840.10045.3.1.7": "secp256r1",
-  "1.3.132.0.34": "secp384r1",
-  "1.3.132.0.35": "secp521r1",
-};