@freedomofpress/sigstore-browser 0.1.15 → 0.1.17

package/dist/bundle.d.ts

@@ -68,7 +68,7 @@ export interface DSSESignature {
     keyid?: string;
 }
 export interface TimestampVerificationData {
-    rfc3161Timestamps: RFC3161Timestamp[];
+    rfc3161Timestamps?: RFC3161Timestamp[];
 }
 export interface RFC3161Timestamp {
     signedTimestamp: string;
@@ -83,7 +83,6 @@ export interface InTotoSubject {
     name: string;
     digest: Record<string, string>;
 }
-export declare function assertTimestampVerificationData(data: unknown): void;
+export declare function assertTimestampVerificationData(data: unknown): asserts data is TimestampVerificationData | undefined;
 export declare function assertBundle(b: unknown): asserts b is SigstoreBundle;
 export {};
-//# sourceMappingURL=bundle.d.ts.map

package/dist/bundle.js.map

@@ -1 +1 @@
-{"version":3,"file":"bundle.js","sourceRoot":"","sources":["../src/bundle.ts"],"names":[],"mappings":"AAoGA,MAAM,KAAK,GAAG,CAAC,CAAU,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;AACjE,8EAA8E;AAC9E,MAAM,uBAAuB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AACjD,SAAS,cAAc;IACrB,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,OAAO,CAAC,CAAU,EAAe,EAAE;QACjC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QAC5B,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC;QAClB,OAAO,KAAK,IAAI,uBAAuB,CAAC;IAC1C,CAAC,CAAC;AACJ,CAAC;AACD,4EAA4E;AAC5E,2EAA2E;AAC3E,MAAM,OAAO,GAAG,CAAC,CAAU,EAAe,EAAE,CAC1C,KAAK,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,IAAI,oBAAoB,CAAC;AACxE,8DAA8D;AAC9D,MAAM,KAAK,GAAG,CAAC,CAAU,EAA4B,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,CAAC;AAE5F,SAAS,KAAK,CAAC,IAAa,EAAE,IAAY;IACxC,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,8BAA8B,CACrC,IAAa,EACb,YAAyC;IAEzC,IAAI,IAAI,IAAI,IAAI;QAAE,OAAO;IACzB,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,2BAA2B,CAAC,CAAC;IAChD,MAAM,EAAE,GAAG,IAAI,CAAC,iBAAiB,CAAC;IAClC,KAAK,CACH,EAAE,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,MAAM,IAAI,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,EACnI,mBAAmB,CACpB,CAAC;AACJ,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,+BAA+B,CAAC,IAAa;IAC3D,8BAA8B,CAAC,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;AACzD,CAAC;AAED,sGAAsG;AACtG,qDAAqD;AACrD,MAAM,UAAU,YAAY,CAAC,CAAU;IACrC,MAAM,YAAY,GAAG,cAAc,EAAE,CAAC;IACtC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,oBAAoB,CAAC,EAAE,2CAA2C,CAAC,CAAC;IAC3H,MAAM,EAAE,GAAG,CAAC,CAAC,oBAAoB,CAAC;IAElC,MAAM,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,oBAAoB,EAAE,YAAY,CAAC;IACxF,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,EAAE,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC;IAE1J,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,CAAC,MAAM,IAAI,EAAE,EAAE,aAAa,CAAC,CAAC;IAChH,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC/B,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,iBAAiB,CAAC,EAAE,YAAY,CAAC,CAAC;QAC1H,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,WAAW,EAAE,OAAO,CAAC,EAAE,wBAAwB,CAAC,CAAC;QAC3G,KAAK,CACH,CAAC,CAAC,cAAc,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,EAC/H,2BAA2B,CAC5B,CAAC;QACF,0EAA0E;QAC1E,+EAA+E;QAC/E,MAAM,GAAG,GAAG,CAAC,CAAC,gBAAgB,EAAE,oBAAoB,CAAC;QACrD,KAAK,CACH,CAAC,CAAC,gBAAgB,KAAK,SAAS,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,GAAG,KAAK,EAAE,IAAI,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAC9I,mBAAmB,CACpB,CAAC;QACF,MAAM,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC;QAC3B,0DAA0D;QAC1D,KAAK,CACH,CAAC,KAAK,SAAS;YACb,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC;gBACjF,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,EAC7H,iBAAiB,CAClB,CAAC;IACJ,CAAC;IAED,8BAA8B,CAAC,EAAE,CAAC,yBAAyB,EAAE,YAAY,CAAC,CAAC;IAE3E,MAAM,EAAE,gBAAgB,EAAE,EAAE,EAAE,YAAY,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IACtD,KAAK,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,KAAK,CAAC,GAAG,KAAK,SAAS,CAAC,EAAE,iDAAiD,CAAC,CAAC;IACrG,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;QACrB,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,YAAY,CAAC,EAAE,CAAC,SAAS,CAAC,IAAI,YAAY,CAAC,EAAE,CAAC,aAAa,EAAE,SAAS,CAAC,IAAI,YAAY,CAAC,EAAE,CAAC,aAAa,EAAE,MAAM,CAAC,EAAE,kBAAkB,CAAC,CAAC;IAC5J,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,cAAc,CAAC,CAAC;QAChG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,8CAA8C,CAAC,CAAC;IAC9J,CAAC;AACH,CAAC"}
+{"version":3,"file":"bundle.js","sourceRoot":"","sources":["../src/bundle.ts"],"names":[],"mappings":"AAoGA,MAAM,KAAK,GAAG,CAAC,CAAU,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;AACjE,8EAA8E;AAC9E,MAAM,uBAAuB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AACjD,SAAS,cAAc;IACrB,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,OAAO,CAAC,CAAU,EAAe,EAAE;QACjC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QAC5B,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC;QAClB,OAAO,KAAK,IAAI,uBAAuB,CAAC;IAC1C,CAAC,CAAC;AACJ,CAAC;AACD,4EAA4E;AAC5E,2EAA2E;AAC3E,MAAM,OAAO,GAAG,CAAC,CAAU,EAAe,EAAE,CAC1C,KAAK,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,IAAI,oBAAoB,CAAC;AACxE,8DAA8D;AAC9D,MAAM,KAAK,GAAG,CAAC,CAAU,EAA4B,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,CAAC;AAE5F,SAAS,KAAK,CAAC,IAAa,EAAE,IAAY;IACxC,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,8BAA8B,CACrC,IAAa,EACb,YAAyC;IAEzC,IAAI,IAAI,IAAI,IAAI;QAAE,OAAO;IACzB,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,2BAA2B,CAAC,CAAC;IAChD,MAAM,EAAE,GAAG,IAAI,CAAC,iBAAiB,CAAC;IAClC,KAAK,CACH,EAAE,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,MAAM,IAAI,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,EACnI,mBAAmB,CACpB,CAAC;AACJ,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,+BAA+B,CAAC,IAAa;IAC3D,8BAA8B,CAAC,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;AACzD,CAAC;AAED,sGAAsG;AACtG,qDAAqD;AACrD,MAAM,UAAU,YAAY,CAAC,CAAU;IACrC,MAAM,YAAY,GAAG,cAAc,EAAE,CAAC;IACtC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,oBAAoB,CAAC,EAAE,2CAA2C,CAAC,CAAC;IAC3H,MAAM,EAAE,GAAG,CAAC,CAAC,oBAAoB,CAAC;IAElC,MAAM,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,oBAAoB,EAAE,YAAY,CAAC;IACxF,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,EAAE,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC;IAE1J,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,CAAC,MAAM,IAAI,EAAE,EAAE,aAAa,CAAC,CAAC;IAChH,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC/B,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,iBAAiB,CAAC,EAAE,YAAY,CAAC,CAAC;QAC1H,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,WAAW,EAAE,OAAO,CAAC,EAAE,wBAAwB,CAAC,CAAC;QAC3G,KAAK,CACH,CAAC,CAAC,cAAc,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,EAC/H,2BAA2B,CAC5B,CAAC;QACF,0EAA0E;QAC1E,+EAA+E;QAC/E,MAAM,GAAG,GAAG,CAAC,CAAC,gBAAgB,EAAE,oBAAoB,CAAC;QACrD,KAAK,CACH,CAAC,CAAC,gBAAgB,KAAK,SAAS,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,GAAG,KAAK,EAAE,IAAI,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAC9I,mBAAmB,CACpB,CAAC;QACF,MAAM,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC;QAC3B,0DAA0D;QAC1D,KAAK,CACH,CAAC,KAAK,SAAS;YACb,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC;gBACjF,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,EAC7H,iBAAiB,CAClB,CAAC;IACJ,CAAC;IAED,8BAA8B,CAAC,EAAE,CAAC,yBAAyB,EAAE,YAAY,CAAC,CAAC;IAE3E,MAAM,EAAE,gBAAgB,EAAE,EAAE,EAAE,YAAY,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IACtD,KAAK,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,KAAK,CAAC,GAAG,KAAK,SAAS,CAAC,EAAE,iDAAiD,CAAC,CAAC;IACrG,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;QACrB,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,YAAY,CAAC,EAAE,CAAC,SAAS,CAAC,IAAI,YAAY,CAAC,EAAE,CAAC,aAAa,EAAE,SAAS,CAAC,IAAI,YAAY,CAAC,EAAE,CAAC,aAAa,EAAE,MAAM,CAAC,EAAE,kBAAkB,CAAC,CAAC;IAC5J,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,cAAc,CAAC,CAAC;QAChG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,8CAA8C,CAAC,CAAC;IAC9J,CAAC;AACH,CAAC","sourcesContent":["type SigstoreBundleBase = {\n  mediaType: string;\n  verificationMaterial: VerificationMaterial;\n};\n\nexport type SigstoreBundle =\n  | (SigstoreBundleBase & { messageSignature: MessageSignature; dsseEnvelope?: never })\n  | (SigstoreBundleBase & { messageSignature?: never; dsseEnvelope: DSSEEnvelope });\n\nexport interface VerificationMaterial {\n  certificate?: Certificate;\n  x509CertificateChain?: X509CertificateChain;\n  tlogEntries: TLogEntry[];\n  timestampVerificationData?: TimestampVerificationData;\n}\n\nexport interface Certificate {\n  rawBytes: string; // Base64-encoded certificate bytes\n}\n\nexport interface X509CertificateChain {\n  certificates: Certificate[];\n}\n\nexport interface TLogEntry {\n  logIndex: string;\n  logId: LogId;\n  kindVersion: KindVersion;\n  integratedTime: string | null; // UNIX timestamp (can be null for Rekor v2 bundles)\n  inclusionPromise?: InclusionPromise;\n  inclusionProof?: InclusionProof;\n  canonicalizedBody: string; // Base64-encoded JSON body of the log entry\n}\n\nexport interface LogId {\n  keyId: string; // Base64-encoded key ID\n}\n\nexport interface KindVersion {\n  kind: string;\n  version: string;\n}\n\nexport interface InclusionPromise {\n  signedEntryTimestamp: string; // Base64-encoded signature over the entry\n}\n\nexport interface InclusionProof {\n  logIndex: string;\n  rootHash: string; // Base64-encoded root hash of the Merkle tree\n  treeSize: string; // Number of entries in the Merkle tree\n  hashes: string[]; // Base64-encoded sibling hashes in the Merkle tree\n  checkpoint: Checkpoint;\n}\n\nexport interface Checkpoint {\n  envelope: string; // Signed envelope from the transparency log\n}\n\nexport interface MessageSignature {\n  messageDigest: MessageDigest;\n  signature: string; // Base64-encoded signature over the message digest\n}\n\nexport interface MessageDigest {\n  algorithm: string; // Hashing algorithm, e.g., \"SHA2_256\"\n  digest: string; // Base64-encoded message digest\n}\n\nexport interface DSSEEnvelope {\n  payload: string;\n  payloadType: string;\n  signatures: DSSESignature[];\n}\n\nexport interface DSSESignature {\n  sig: string;\n  keyid?: string;\n}\n\nexport interface TimestampVerificationData {\n  rfc3161Timestamps?: RFC3161Timestamp[];\n}\n\nexport interface RFC3161Timestamp {\n  signedTimestamp: string; // Base64-encoded RFC3161 SignedData\n}\n\nexport interface InTotoStatement {\n  _type: string;\n  subject: InTotoSubject[];\n  predicateType: string;\n  predicate: Record<string, unknown>;\n}\n\nexport interface InTotoSubject {\n  name: string;\n  digest: Record<string, string>;\n}\n\nconst isStr = (v: unknown): v is string => typeof v === \"string\";\n// Bound the aggregate encoded data this verifier will decode, parse, or hash.\nconst MAX_BUNDLE_STRING_CHARS = 16 * 1024 * 1024;\nfunction boundedStrings(): (v: unknown) => v is string {\n  let total = 0;\n  return (v: unknown): v is string => {\n    if (!isStr(v)) return false;\n    total += v.length;\n    return total <= MAX_BUNDLE_STRING_CHARS;\n  };\n}\n// Protobuf log indices, tree sizes and times are non-negative int64 values.\n// Bound the string before BigInt conversion to avoid unbounded arithmetic.\nconst isInt64 = (v: unknown): v is string =>\n  isStr(v) && /^\\d{1,19}$/.test(v) && BigInt(v) <= 9223372036854775807n;\n// eslint-disable-next-line @typescript-eslint/no-explicit-any\nconst isObj = (v: unknown): v is Record<string, any> => typeof v === \"object\" && v !== null;\n\nfunction check(cond: unknown, what: string): asserts cond {\n  if (!cond) throw new Error(`Invalid bundle: ${what}`);\n}\n\nfunction checkTimestampVerificationData(\n  data: unknown,\n  isBoundedStr: (v: unknown) => v is string,\n): asserts data is TimestampVerificationData | undefined {\n  if (data == null) return;\n  check(isObj(data), \"timestampVerificationData\");\n  const ts = data.rfc3161Timestamps;\n  check(\n    ts === undefined || (Array.isArray(ts) && ts.length <= 32 && ts.every((t: unknown) => isObj(t) && isBoundedStr(t.signedTimestamp))),\n    \"rfc3161Timestamps\",\n  );\n}\n\n// Lives in verifyBundleTimestamp(), which every caller routes through.\nexport function assertTimestampVerificationData(data: unknown): asserts data is TimestampVerificationData | undefined {\n  checkTimestampVerificationData(data, boundedStrings());\n}\n\n// Structural validation of a parsed bundle, replacing the compile-time-only type with runtime checks.\n// Entry count is capped at 32 like sigstore-go does.\nexport function assertBundle(b: unknown): asserts b is SigstoreBundle {\n  const isBoundedStr = boundedStrings();\n  check(isObj(b) && isBoundedStr(b.mediaType) && isObj(b.verificationMaterial), \"missing mediaType or verificationMaterial\");\n  const vm = b.verificationMaterial;\n\n  const certs = vm.certificate ? [vm.certificate] : vm.x509CertificateChain?.certificates;\n  check(Array.isArray(certs) && certs.length > 0 && certs.length <= 32 && certs.every((c: unknown) => isObj(c) && isBoundedStr(c.rawBytes)), \"certificate\");\n\n  check(Array.isArray(vm.tlogEntries) && vm.tlogEntries.length > 0 && vm.tlogEntries.length <= 32, \"tlogEntries\");\n  for (const e of vm.tlogEntries) {\n    check(isObj(e) && isInt64(e.logIndex) && isBoundedStr(e.logId?.keyId) && isBoundedStr(e.canonicalizedBody), \"tlog entry\");\n    check(isBoundedStr(e.kindVersion?.kind) && isBoundedStr(e.kindVersion?.version), \"tlog entry kindVersion\");\n    check(\n      e.integratedTime == null || (isInt64(e.integratedTime) && Number.isFinite(new Date(Number(e.integratedTime) * 1000).getTime())),\n      \"tlog entry integratedTime\",\n    );\n    // A SET signs the integrated time, so a promise without one is malformed.\n    // SET canonicalization uses Number, which must not round the signed log index.\n    const set = e.inclusionPromise?.signedEntryTimestamp;\n    check(\n      e.inclusionPromise === undefined || (isBoundedStr(set) && set !== \"\" && isInt64(e.integratedTime) && Number.isSafeInteger(Number(e.logIndex))),\n      \"inclusion promise\",\n    );\n    const p = e.inclusionProof;\n    // An int64-sized tree requires at most 63 sibling hashes.\n    check(\n      p === undefined ||\n        (isObj(p) && isInt64(p.logIndex) && isInt64(p.treeSize) && isBoundedStr(p.rootHash) &&\n          Array.isArray(p.hashes) && p.hashes.length <= 63 && p.hashes.every(isBoundedStr) && isBoundedStr(p.checkpoint?.envelope)),\n      \"inclusion proof\",\n    );\n  }\n\n  checkTimestampVerificationData(vm.timestampVerificationData, isBoundedStr);\n\n  const { messageSignature: ms, dsseEnvelope: env } = b;\n  check((ms === undefined) !== (env === undefined), \"exactly one of messageSignature or dsseEnvelope\");\n  if (ms !== undefined) {\n    check(isObj(ms) && isBoundedStr(ms.signature) && isBoundedStr(ms.messageDigest?.algorithm) && isBoundedStr(ms.messageDigest?.digest), \"messageSignature\");\n  } else {\n    check(isObj(env) && isBoundedStr(env.payload) && isBoundedStr(env.payloadType), \"dsseEnvelope\");\n    check(Array.isArray(env.signatures) && env.signatures.length === 1 && isBoundedStr(env.signatures[0]?.sig), \"dsseEnvelope must have exactly one signature\");\n  }\n}\n"]}

package/dist/cli.d.ts

@@ -1,3 +1,2 @@
 #!/usr/bin/env node
 export {};
-//# sourceMappingURL=cli.d.ts.map

package/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,eAAe,EACf,kBAAkB,GACnB,MAAM,gCAAgC,CAAC;AAGxC,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAErD,sFAAsF;AACtF,IAAI,OAAO,UAAU,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;IAC7C,UAAU,CAAC,MAAM,GAAG,SAA8B,CAAC;AACrD,CAAC;AAcD,MAAM,KAAK,GAAG,oKAAoK,CAAC;AAEnL,SAAS,UAAU;IACjB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC;AAED,SAAS,SAAS,CAAC,IAAc;IAC/B,MAAM,OAAO,GAAwB,EAAE,CAAC;IACxC,IAAI,OAA2B,CAAC;IAChC,IAAI,aAAiC,CAAC;IAEtC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAExB,IAAI,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YAC7C,UAAU,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7B,MAAM,CAAC,IAAI,EAAE,aAAa,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YAEpD,QAAQ,IAAI,EAAE,CAAC;gBACb,KAAK,UAAU,CAAC,CAAC,CAAC;oBAChB,MAAM,KAAK,GAAG,aAAa,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;oBACzC,IAAI,CAAC,KAAK,EAAE,CAAC;wBACX,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;oBAChD,CAAC;oBACD,OAAO,CAAC,UAAU,GAAG,KAAK,CAAC;oBAC3B,MAAM;gBACR,CAAC;gBACD,KAAK,wBAAwB,CAAC,CAAC,CAAC;oBAC9B,MAAM,KAAK,GAAG,aAAa,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;oBACzC,IAAI,CAAC,KAAK,EAAE,CAAC;wBACX,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;oBAC9D,CAAC;oBACD,OAAO,CAAC,mBAAmB,GAAG,KAAK,CAAC;oBACpC,MAAM;gBACR,CAAC;gBACD,KAAK,2BAA2B,CAAC,CAAC,CAAC;oBACjC,MAAM,KAAK,GAAG,aAAa,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;oBACzC,IAAI,CAAC,KAAK,EAAE,CAAC;wBACX,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;oBACjE,CAAC;oBACD,OAAO,CAAC,qBAAqB,GAAG,KAAK,CAAC;oBACtC,MAAM;gBACR,CAAC;gBACD,KAAK,gBAAgB,CAAC,CAAC,CAAC;oBACtB,MAAM,KAAK,GAAG,aAAa,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;oBACzC,IAAI,CAAC,KAAK,EAAE,CAAC;wBACX,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;oBACtD,CAAC;oBACD,OAAO,CAAC,eAAe,GAAG,KAAK,CAAC;oBAChC,MAAM;gBACR,CAAC;gBACD;oBACE,MAAM,IAAI,KAAK,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC;YAC/C,CAAC;YAED,SAAS;QACX,CAAC;QAED,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,GAAG,OAAO,CAAC;YAClB,SAAS;QACX,CAAC;QAED,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,aAAa,GAAG,OAAO,CAAC;YACxB,SAAS;QACX,CAAC;QAED,MAAM,IAAI,KAAK,CAAC,wBAAwB,OAAO,EAAE,CAAC,CAAC;IACrD,CAAC;IAED,IAAI,OAAO,KAAK,eAAe,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IAED,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IAED,OAAO;QACL,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;QACpD,eAAe,EAAE,OAAO,CAAC,eAAe;QACxC,aAAa;KACd,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,QAAgB;IACxC,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,KAAa;IAC1C,MAAM,YAAY,GAAG,SAAS,CAAC;IAE/B,IACE,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC;QAC9B,KAAK,CAAC,MAAM,KAAK,YAAY,CAAC,MAAM,GAAG,EAAE;QACzC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QACvD,CAAC,CAAC,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC,EAC1B,CAAC;QACD,OAAO;YACL,IAAI,EAAE,QAAQ;YACd,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE;SAC1D,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACzC,MAAM,cAAc,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,CAAC;IACpD,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAE5E,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,YAAY;QAClB,IAAI,EAAE,IAAI,UAAU,CAAC,cAAc,CAAC;QACpC,SAAS;KACV,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,SAA6B;IAE7B,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,0EAA0E;QAC1E,MAAM,WAAW,GAAG,IAAI,mBAAmB,CAAC;YAC1C,WAAW,EAAE,oCAAoC;YACjD,aAAa,EAAE,4CAA4C;SAC5D,CAAC,CAAC;QACH,OAAO,MAAM,WAAW,CAAC,cAAc,EAAE,CAAC;IAC5C,CAAC;IACD,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IACjD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAgB,CAAC;AACxC,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,UAAkB;IAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC7C,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAmB,CAAC;AAC3C,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,OAAmB;IAC7C,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACxD,eAAe,CAAC,OAAO,CAAC,eAAe,CAAC;QACxC,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC;QAC9B,eAAe,CAAC,OAAO,CAAC,aAAa,CAAC;KACvC,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,IAAI,gBAAgB,EAAE,CAAC;IACxC,MAAM,QAAQ,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAE7C,yDAAyD;IACzD,IAAI,eAAuB,CAAC;IAC5B,IAAI,iBAA6B,CAAC;IAElC,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;QAC5B,gDAAgD;QAChD,IAAI,MAAM,CAAC,gBAAgB,CAAC,aAAa,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;YACnE,MAAM,IAAI,KAAK,CACb,yCAAyC,MAAM,CAAC,gBAAgB,CAAC,aAAa,CAAC,SAAS,EAAE,CAC3F,CAAC;QACJ,CAAC;QAED,iBAAiB,GAAG,kBAAkB,CACpC,MAAM,CAAC,gBAAgB,CAAC,aAAa,CAAC,MAAM,CAC7C,CAAC;QACF,eAAe,GAAG,eAAe,CAAC,iBAAiB,CAAC,CAAC,WAAW,EAAE,CAAC;IACrE,CAAC;SAAM,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QAC/B,0DAA0D;QAC1D,MAAM,YAAY,GAAG,kBAAkB,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QACrE,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC,CAAC;QAE7D,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACjD,CAAC;QAED,uEAAuE;QACvE,IAAI,cAAc,GAAG,IAAI,CAAC;QAC1B,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACtC,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,CAAC;YACjD,IAAI,aAAa,IAAI,QAAQ,CAAC,SAAS,KAAK,aAAa,CAAC,WAAW,EAAE,EAAE,CAAC;gBACxE,cAAc,GAAG,OAAO,CAAC;gBACzB,MAAM;YACR,CAAC;QACH,CAAC;QAED,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CACb,mBAAmB,QAAQ,CAAC,SAAS,6CAA6C,CACnF,CAAC;QACJ,CAAC;QAED,eAAe,GAAG,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;QAEhE,sDAAsD;QACtD,iBAAiB,GAAG,eAAe,CAAC,eAAe,CAAC,CAAC;IACvD,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IAED,kDAAkD;IAClD,IAAI,MAAM,CAAC,gBAAgB,IAAI,QAAQ,CAAC,SAAS,KAAK,eAAe,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CACb,mEAAmE,CACpE,CAAC;IACJ,CAAC;IAED,MAAM,kBAAkB,GACtB,QAAQ,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC;IAC/D,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC;IAEhD,MAAM,QAAQ,CAAC,cAAc,CAC3B,OAAO,CAAC,mBAAmB,EAC3B,OAAO,CAAC,qBAAqB,EAC7B,MAAM,EACN,kBAAkB,EAClB,YAAY,CACb,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACjD,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;IAChD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;YAC3B,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC;QACD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC;AAED,MAAM,IAAI,EAAE,CAAC"}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,eAAe,EACf,kBAAkB,GACnB,MAAM,gCAAgC,CAAC;AAIxC,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAErD,sFAAsF;AACtF,IAAI,OAAO,UAAU,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;IAC7C,UAAU,CAAC,MAAM,GAAG,SAA8B,CAAC;AACrD,CAAC;AAcD,MAAM,KAAK,GAAG,oKAAoK,CAAC;AAEnL,SAAS,UAAU;IACjB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC;AAED,SAAS,SAAS,CAAC,IAAc;IAC/B,MAAM,OAAO,GAAwB,EAAE,CAAC;IACxC,IAAI,OAA2B,CAAC;IAChC,IAAI,aAAiC,CAAC;IAEtC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAExB,IAAI,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YAC7C,UAAU,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7B,MAAM,CAAC,IAAI,EAAE,aAAa,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YAEpD,QAAQ,IAAI,EAAE,CAAC;gBACb,KAAK,UAAU,CAAC,CAAC,CAAC;oBAChB,MAAM,KAAK,GAAG,aAAa,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;oBACzC,IAAI,CAAC,KAAK,EAAE,CAAC;wBACX,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;oBAChD,CAAC;oBACD,OAAO,CAAC,UAAU,GAAG,KAAK,CAAC;oBAC3B,MAAM;gBACR,CAAC;gBACD,KAAK,wBAAwB,CAAC,CAAC,CAAC;oBAC9B,MAAM,KAAK,GAAG,aAAa,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;oBACzC,IAAI,CAAC,KAAK,EAAE,CAAC;wBACX,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;oBAC9D,CAAC;oBACD,OAAO,CAAC,mBAAmB,GAAG,KAAK,CAAC;oBACpC,MAAM;gBACR,CAAC;gBACD,KAAK,2BAA2B,CAAC,CAAC,CAAC;oBACjC,MAAM,KAAK,GAAG,aAAa,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;oBACzC,IAAI,CAAC,KAAK,EAAE,CAAC;wBACX,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;oBACjE,CAAC;oBACD,OAAO,CAAC,qBAAqB,GAAG,KAAK,CAAC;oBACtC,MAAM;gBACR,CAAC;gBACD,KAAK,gBAAgB,CAAC,CAAC,CAAC;oBACtB,MAAM,KAAK,GAAG,aAAa,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;oBACzC,IAAI,CAAC,KAAK,EAAE,CAAC;wBACX,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;oBACtD,CAAC;oBACD,OAAO,CAAC,eAAe,GAAG,KAAK,CAAC;oBAChC,MAAM;gBACR,CAAC;gBACD;oBACE,MAAM,IAAI,KAAK,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC;YAC/C,CAAC;YAED,SAAS;QACX,CAAC;QAED,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,GAAG,OAAO,CAAC;YAClB,SAAS;QACX,CAAC;QAED,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,aAAa,GAAG,OAAO,CAAC;YACxB,SAAS;QACX,CAAC;QAED,MAAM,IAAI,KAAK,CAAC,wBAAwB,OAAO,EAAE,CAAC,CAAC;IACrD,CAAC;IAED,IAAI,OAAO,KAAK,eAAe,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IAED,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IAED,OAAO;QACL,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;QACpD,eAAe,EAAE,OAAO,CAAC,eAAe;QACxC,aAAa;KACd,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,QAAgB;IACxC,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,KAAa;IAC1C,MAAM,YAAY,GAAG,SAAS,CAAC;IAE/B,IACE,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC;QAC9B,KAAK,CAAC,MAAM,KAAK,YAAY,CAAC,MAAM,GAAG,EAAE;QACzC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QACvD,CAAC,CAAC,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC,EAC1B,CAAC;QACD,OAAO;YACL,IAAI,EAAE,QAAQ;YACd,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE;SAC1D,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACzC,MAAM,cAAc,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,CAAC;IACpD,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAE5E,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,YAAY;QAClB,IAAI,EAAE,IAAI,UAAU,CAAC,cAAc,CAAC;QACpC,SAAS;KACV,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,SAA6B;IAE7B,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,0EAA0E;QAC1E,MAAM,WAAW,GAAG,IAAI,mBAAmB,CAAC;YAC1C,WAAW,EAAE,oCAAoC;YACjD,aAAa,EAAE,4CAA4C;SAC5D,CAAC,CAAC;QACH,OAAO,MAAM,WAAW,CAAC,cAAc,EAAE,CAAC;IAC5C,CAAC;IACD,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IACjD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAgB,CAAC;AACxC,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,UAAkB;IAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC7C,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAmB,CAAC;AAC3C,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,OAAmB;IAC7C,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACxD,eAAe,CAAC,OAAO,CAAC,eAAe,CAAC;QACxC,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC;QAC9B,eAAe,CAAC,OAAO,CAAC,aAAa,CAAC;KACvC,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,IAAI,gBAAgB,EAAE,CAAC;IACxC,MAAM,QAAQ,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAE7C,yDAAyD;IACzD,IAAI,eAAuB,CAAC;IAC5B,IAAI,iBAA6B,CAAC;IAElC,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;QAC5B,gDAAgD;QAChD,IAAI,MAAM,CAAC,gBAAgB,CAAC,aAAa,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;YACnE,MAAM,IAAI,KAAK,CACb,yCAAyC,MAAM,CAAC,gBAAgB,CAAC,aAAa,CAAC,SAAS,EAAE,CAC3F,CAAC;QACJ,CAAC;QAED,iBAAiB,GAAG,kBAAkB,CACpC,MAAM,CAAC,gBAAgB,CAAC,aAAa,CAAC,MAAM,CAC7C,CAAC;QACF,eAAe,GAAG,eAAe,CAAC,iBAAiB,CAAC,CAAC,WAAW,EAAE,CAAC;IACrE,CAAC;SAAM,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QAC/B,0DAA0D;QAC1D,MAAM,YAAY,GAAG,kBAAkB,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QACrE,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC,CAAC;QAE7D,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACjD,CAAC;QAED,uEAAuE;QACvE,IAAI,cAAc,GAAG,IAAI,CAAC;QAC1B,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACtC,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,CAAC;YACjD,IAAI,aAAa,IAAI,QAAQ,CAAC,SAAS,KAAK,aAAa,CAAC,WAAW,EAAE,EAAE,CAAC;gBACxE,cAAc,GAAG,OAAO,CAAC;gBACzB,MAAM;YACR,CAAC;QACH,CAAC;QAED,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CACb,mBAAmB,QAAQ,CAAC,SAAS,6CAA6C,CACnF,CAAC;QACJ,CAAC;QAED,eAAe,GAAG,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;QAEhE,sDAAsD;QACtD,iBAAiB,GAAG,eAAe,CAAC,eAAe,CAAC,CAAC;IACvD,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IAED,kDAAkD;IAClD,IAAI,MAAM,CAAC,gBAAgB,IAAI,QAAQ,CAAC,SAAS,KAAK,eAAe,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CACb,mEAAmE,CACpE,CAAC;IACJ,CAAC;IAED,MAAM,kBAAkB,GACtB,QAAQ,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC;IAC/D,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC;IAEhD,MAAM,QAAQ,CAAC,cAAc,CAC3B,OAAO,CAAC,mBAAmB,EAC3B,OAAO,CAAC,qBAAqB,EAC7B,MAAM,EACN,kBAAkB,EAClB,YAAY,CACb,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACjD,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;IAChD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;YAC3B,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC;QACD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC;AAED,MAAM,IAAI,EAAE,CAAC","sourcesContent":["#!/usr/bin/env node\nimport { createHash, webcrypto } from \"node:crypto\";\nimport { access, readFile } from \"node:fs/promises\";\nimport path from \"node:path\";\n\nimport {\n  base64ToUint8Array,\n  hexToUint8Array,\n  Uint8ArrayToHex,\n  Uint8ArrayToString,\n} from \"@freedomofpress/crypto-browser\";\n\nimport { SigstoreBundle } from \"./bundle.js\";\nimport { TrustedRoot } from \"./interfaces.js\";\nimport { SigstoreVerifier } from \"./sigstore.js\";\nimport { TrustedRootProvider } from \"./trust/tuf.js\";\n\n// Ensure the global Web Crypto implementation is available when running under Node.js\nif (typeof globalThis.crypto === \"undefined\") {\n  globalThis.crypto = webcrypto as unknown as Crypto;\n}\n\ninterface CLIOptions {\n  bundlePath: string;\n  certificateIdentity: string;\n  certificateOidcIssuer: string;\n  trustedRootPath: string | undefined;\n  artifactInput: string;\n}\n\ntype ArtifactInput =\n  | { type: \"file\"; path: string; data: Uint8Array; digestHex: string }\n  | { type: \"digest\"; digestHex: string };\n\nconst USAGE = `Usage: sigstore-browser verify-bundle [--staging] --bundle FILE --certificate-identity IDENTITY --certificate-oidc-issuer URL [--trusted-root FILE] FILE_OR_DIGEST`;\n\nfunction printUsage(): void {\n  console.error(USAGE);\n}\n\nfunction parseArgs(argv: string[]): CLIOptions {\n  const options: Partial<CLIOptions> = {};\n  let command: string | undefined;\n  let artifactInput: string | undefined;\n\n  for (let i = 0; i < argv.length; i++) {\n    const current = argv[i];\n\n    if (current === \"--help\" || current === \"-h\") {\n      printUsage();\n      process.exit(0);\n    }\n\n    if (current.startsWith(\"--\")) {\n      const [name, providedValue] = current.split(\"=\", 2);\n\n      switch (name) {\n        case \"--bundle\": {\n          const value = providedValue ?? argv[++i];\n          if (!value) {\n            throw new Error(\"Missing value for --bundle\");\n          }\n          options.bundlePath = value;\n          break;\n        }\n        case \"--certificate-identity\": {\n          const value = providedValue ?? argv[++i];\n          if (!value) {\n            throw new Error(\"Missing value for --certificate-identity\");\n          }\n          options.certificateIdentity = value;\n          break;\n        }\n        case \"--certificate-oidc-issuer\": {\n          const value = providedValue ?? argv[++i];\n          if (!value) {\n            throw new Error(\"Missing value for --certificate-oidc-issuer\");\n          }\n          options.certificateOidcIssuer = value;\n          break;\n        }\n        case \"--trusted-root\": {\n          const value = providedValue ?? argv[++i];\n          if (!value) {\n            throw new Error(\"Missing value for --trusted-root\");\n          }\n          options.trustedRootPath = value;\n          break;\n        }\n        default:\n          throw new Error(`Unknown option: ${name}`);\n      }\n\n      continue;\n    }\n\n    if (!command) {\n      command = current;\n      continue;\n    }\n\n    if (!artifactInput) {\n      artifactInput = current;\n      continue;\n    }\n\n    throw new Error(`Unexpected argument: ${current}`);\n  }\n\n  if (command !== \"verify-bundle\") {\n    throw new Error(\"No command provided. Expected 'verify-bundle'.\");\n  }\n\n  if (!artifactInput) {\n    throw new Error(\"Missing FILE_OR_DIGEST argument.\");\n  }\n\n  if (!options.bundlePath) {\n    throw new Error(\"Missing required option --bundle\");\n  }\n\n  if (!options.certificateIdentity) {\n    throw new Error(\"Missing required option --certificate-identity\");\n  }\n\n  if (!options.certificateOidcIssuer) {\n    throw new Error(\"Missing required option --certificate-oidc-issuer\");\n  }\n\n  return {\n    bundlePath: options.bundlePath,\n    certificateIdentity: options.certificateIdentity,\n    certificateOidcIssuer: options.certificateOidcIssuer,\n    trustedRootPath: options.trustedRootPath,\n    artifactInput,\n  };\n}\n\nasync function fileExists(filePath: string): Promise<boolean> {\n  try {\n    await access(filePath);\n    return true;\n  } catch {\n    return false;\n  }\n}\n\nasync function resolveArtifact(input: string): Promise<ArtifactInput> {\n  const digestPrefix = \"sha256:\";\n\n  if (\n    input.startsWith(digestPrefix) &&\n    input.length === digestPrefix.length + 64 &&\n    /^[0-9a-fA-F]+$/.test(input.slice(digestPrefix.length)) &&\n    !(await fileExists(input))\n  ) {\n    return {\n      type: \"digest\",\n      digestHex: input.slice(digestPrefix.length).toLowerCase(),\n    };\n  }\n\n  const resolvedPath = path.resolve(input);\n  const artifactBuffer = await readFile(resolvedPath);\n  const digestHex = createHash(\"sha256\").update(artifactBuffer).digest(\"hex\");\n\n  return {\n    type: \"file\",\n    path: resolvedPath,\n    data: new Uint8Array(artifactBuffer),\n    digestHex,\n  };\n}\n\nasync function loadTrustedRoot(\n  pathInput: string | undefined,\n): Promise<TrustedRoot> {\n  if (!pathInput) {\n    // Use TUF to fetch the latest trusted root (matches sigstore-js behavior)\n    const tufProvider = new TrustedRootProvider({\n      metadataUrl: \"https://tuf-repo-cdn.sigstore.dev/\",\n      targetBaseUrl: \"https://tuf-repo-cdn.sigstore.dev/targets/\",\n    });\n    return await tufProvider.getTrustedRoot();\n  }\n  const resolvedPath = path.resolve(pathInput);\n  const raw = await readFile(resolvedPath, \"utf8\");\n  return JSON.parse(raw) as TrustedRoot;\n}\n\nasync function loadBundle(bundlePath: string): Promise<SigstoreBundle> {\n  const resolved = path.resolve(bundlePath);\n  const raw = await readFile(resolved, \"utf8\");\n  return JSON.parse(raw) as SigstoreBundle;\n}\n\nasync function verifyBundle(options: CLIOptions): Promise<void> {\n  const [trustedRoot, bundle, artifact] = await Promise.all([\n    loadTrustedRoot(options.trustedRootPath),\n    loadBundle(options.bundlePath),\n    resolveArtifact(options.artifactInput),\n  ]);\n\n  const verifier = new SigstoreVerifier();\n  await verifier.loadSigstoreRoot(trustedRoot);\n\n  // Extract and verify the artifact digest from the bundle\n  let bundleDigestHex: string;\n  let bundleDigestBytes: Uint8Array;\n\n  if (bundle.messageSignature) {\n    // Regular bundle: digest is in messageSignature\n    if (bundle.messageSignature.messageDigest.algorithm !== \"SHA2_256\") {\n      throw new Error(\n        `Unsupported message digest algorithm: ${bundle.messageSignature.messageDigest.algorithm}`,\n      );\n    }\n\n    bundleDigestBytes = base64ToUint8Array(\n      bundle.messageSignature.messageDigest.digest,\n    );\n    bundleDigestHex = Uint8ArrayToHex(bundleDigestBytes).toLowerCase();\n  } else if (bundle.dsseEnvelope) {\n    // DSSE bundle: digest is in the in-toto statement payload\n    const payloadBytes = base64ToUint8Array(bundle.dsseEnvelope.payload);\n    const payload = JSON.parse(Uint8ArrayToString(payloadBytes));\n\n    if (!payload.subject || payload.subject.length === 0) {\n      throw new Error(\"DSSE payload has no subject\");\n    }\n\n    // Find matching subject by comparing artifact digest with all subjects\n    let matchedSubject = null;\n    for (const subject of payload.subject) {\n      const subjectDigest = subject.digest?.[\"sha256\"];\n      if (subjectDigest && artifact.digestHex === subjectDigest.toLowerCase()) {\n        matchedSubject = subject;\n        break;\n      }\n    }\n\n    if (!matchedSubject) {\n      throw new Error(\n        `Artifact digest ${artifact.digestHex} does not match any subject in DSSE payload`\n      );\n    }\n\n    bundleDigestHex = matchedSubject.digest[\"sha256\"].toLowerCase();\n\n    // Convert hex digest to bytes for verification target\n    bundleDigestBytes = hexToUint8Array(bundleDigestHex);\n  } else {\n    throw new Error(\"Bundle does not contain a message signature or DSSE envelope\");\n  }\n\n  // For non-DSSE bundles, verify the digest matches\n  if (bundle.messageSignature && artifact.digestHex !== bundleDigestHex) {\n    throw new Error(\n      \"Artifact digest does not match the digest embedded in the bundle.\",\n    );\n  }\n\n  const verificationTarget =\n    artifact.type === \"file\" ? artifact.data : bundleDigestBytes;\n  const isDigestOnly = artifact.type === \"digest\";\n\n  await verifier.verifyArtifact(\n    options.certificateIdentity,\n    options.certificateOidcIssuer,\n    bundle,\n    verificationTarget,\n    isDigestOnly,\n  );\n}\n\nasync function main(): Promise<void> {\n  try {\n    const options = parseArgs(process.argv.slice(2));\n    await verifyBundle(options);\n    console.log(\"Bundle verification succeeded.\");\n  } catch (error) {\n    if (error instanceof Error) {\n      console.error(error.message);\n    } else {\n      console.error(error);\n    }\n    process.exitCode = 1;\n  }\n}\n\nawait main();\n"]}

package/dist/dsse.d.ts

@@ -1,2 +1 @@
 export declare function preAuthEncoding(payloadType: string, payload: Uint8Array): Uint8Array;
-//# sourceMappingURL=dsse.d.ts.map

package/dist/dsse.js

@@ -1,3 +1,4 @@
+import { concatBytes, stringToUint8Array } from "@freedomofpress/crypto-browser";
 /*
 Copyright 2023 The Sigstore Authors.
 
@@ -23,20 +24,14 @@ export function preAuthEncoding(payloadType, payload) {
         payload.length,
         "",
     ].join(" ");
-    // DSSE spec requires ASCII encoding for the prefix
-    // TextEncoder will throw if the string contains non-ASCII characters
-    const encoder = new TextEncoder();
-    const prefixBuffer = encoder.encode(prefix);
+    // DSSE requires an ASCII prefix.
+    const prefixBuffer = stringToUint8Array(prefix);
     // Verify all characters are ASCII (< 128)
     for (let i = 0; i < prefixBuffer.length; i++) {
         if (prefixBuffer[i] > 127) {
             throw new Error(`Invalid non-ASCII character in PAE prefix at position ${i}`);
         }
     }
-    // Concatenate prefix and payload
-    const combinedArray = new Uint8Array(prefixBuffer.length + payload.length);
-    combinedArray.set(prefixBuffer, 0);
-    combinedArray.set(payload, prefixBuffer.length);
-    return combinedArray;
+    return concatBytes(prefixBuffer, payload);
 }
 //# sourceMappingURL=dsse.js.map

package/dist/dsse.js.map

@@ -1 +1 @@
-{"version":3,"file":"dsse.js","sourceRoot":"","sources":["../src/dsse.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;EAcE;AACF,MAAM,UAAU,GAAG,QAAQ,CAAC;AAE5B,mCAAmC;AACnC,MAAM,UAAU,eAAe,CAC7B,WAAmB,EACnB,OAAmB;IAEnB,MAAM,MAAM,GAAG;QACb,UAAU;QACV,WAAW,CAAC,MAAM;QAClB,WAAW;QACX,OAAO,CAAC,MAAM;QACd,EAAE;KACH,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAEZ,mDAAmD;IACnD,qEAAqE;IACrE,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAE5C,0CAA0C;IAC1C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7C,IAAI,YAAY,CAAC,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,EAAE,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;IAED,iCAAiC;IACjC,MAAM,aAAa,GAAG,IAAI,UAAU,CAAC,YAAY,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAE3E,aAAa,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;IACnC,aAAa,CAAC,GAAG,CAAC,OAAO,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC;IAChD,OAAO,aAAa,CAAC;AACvB,CAAC"}
+{"version":3,"file":"dsse.js","sourceRoot":"","sources":["../src/dsse.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AACjF;;;;;;;;;;;;;;EAcE;AACF,MAAM,UAAU,GAAG,QAAQ,CAAC;AAE5B,mCAAmC;AACnC,MAAM,UAAU,eAAe,CAC7B,WAAmB,EACnB,OAAmB;IAEnB,MAAM,MAAM,GAAG;QACb,UAAU;QACV,WAAW,CAAC,MAAM;QAClB,WAAW;QACX,OAAO,CAAC,MAAM;QACd,EAAE;KACH,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAEZ,iCAAiC;IACjC,MAAM,YAAY,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAEhD,0CAA0C;IAC1C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7C,IAAI,YAAY,CAAC,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,EAAE,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;IAED,OAAO,WAAW,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;AAC5C,CAAC","sourcesContent":["import { concatBytes, stringToUint8Array } from \"@freedomofpress/crypto-browser\";\n/*\nCopyright 2023 The Sigstore Authors.\n\nLicensed under the Apache License, Version 2.0 (the \"License\");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\n    http://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n*/\nconst PAE_PREFIX = \"DSSEv1\";\n\n// DSSE Pre-Authentication Encoding\nexport function preAuthEncoding(\n  payloadType: string,\n  payload: Uint8Array,\n): Uint8Array {\n  const prefix = [\n    PAE_PREFIX,\n    payloadType.length,\n    payloadType,\n    payload.length,\n    \"\",\n  ].join(\" \");\n\n  // DSSE requires an ASCII prefix.\n  const prefixBuffer = stringToUint8Array(prefix);\n\n  // Verify all characters are ASCII (< 128)\n  for (let i = 0; i < prefixBuffer.length; i++) {\n    if (prefixBuffer[i] > 127) {\n      throw new Error(`Invalid non-ASCII character in PAE prefix at position ${i}`);\n    }\n  }\n\n  return concatBytes(prefixBuffer, payload);\n}\n"]}

package/dist/errors.d.ts

@@ -36,4 +36,3 @@ export declare class SignatureError extends VerificationError {
 export declare class PolicyError extends VerificationError {
     constructor(message: string);
 }
-//# sourceMappingURL=errors.d.ts.map

package/dist/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;EAcE;AAEF;;;GAGG;AACH,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAC1C,YAAmB,IAAY,EAAE,OAAe;QAC9C,KAAK,CAAC,OAAO,CAAC,CAAC;QADE,SAAI,GAAJ,IAAI,CAAQ;QAE7B,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC3D,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,cAAe,SAAQ,iBAAiB;IACnD,YAAY,OAAe;QACzB,KAAK,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC;QAClC,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;QAC7B,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,cAAc,CAAC,SAAS,CAAC,CAAC;IACxD,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,gBAAiB,SAAQ,iBAAiB;IACrD,YAAY,OAAe;QACzB,KAAK,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;QAC/B,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,gBAAgB,CAAC,SAAS,CAAC,CAAC;IAC1D,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,SAAU,SAAQ,iBAAiB;IAC9C,YAAY,OAAe;QACzB,KAAK,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QAC7B,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;QACxB,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC;IACnD,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,cAAe,SAAQ,iBAAiB;IACnD,YAAY,OAAe;QACzB,KAAK,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC;QAClC,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;QAC7B,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,cAAc,CAAC,SAAS,CAAC,CAAC;IACxD,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,WAAY,SAAQ,iBAAiB;IAChD,YAAY,OAAe;QACzB,KAAK,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;QAC/B,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;QAC1B,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,WAAW,CAAC,SAAS,CAAC,CAAC;IACrD,CAAC;CACF"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;EAcE;AAEF;;;GAGG;AACH,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAC1C,YAAmB,IAAY,EAAE,OAAe;QAC9C,KAAK,CAAC,OAAO,CAAC,CAAC;QADE,SAAI,GAAJ,IAAI,CAAQ;QAE7B,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC3D,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,cAAe,SAAQ,iBAAiB;IACnD,YAAY,OAAe;QACzB,KAAK,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC;QAClC,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;QAC7B,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,cAAc,CAAC,SAAS,CAAC,CAAC;IACxD,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,gBAAiB,SAAQ,iBAAiB;IACrD,YAAY,OAAe;QACzB,KAAK,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;QAC/B,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,gBAAgB,CAAC,SAAS,CAAC,CAAC;IAC1D,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,SAAU,SAAQ,iBAAiB;IAC9C,YAAY,OAAe;QACzB,KAAK,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QAC7B,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;QACxB,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC;IACnD,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,cAAe,SAAQ,iBAAiB;IACnD,YAAY,OAAe;QACzB,KAAK,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC;QAClC,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;QAC7B,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,cAAc,CAAC,SAAS,CAAC,CAAC;IACxD,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,WAAY,SAAQ,iBAAiB;IAChD,YAAY,OAAe;QACzB,KAAK,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;QAC/B,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;QAC1B,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,WAAW,CAAC,SAAS,CAAC,CAAC;IACrD,CAAC;CACF","sourcesContent":["/*\nCopyright 2023 The Sigstore Authors.\n\nLicensed under the Apache License, Version 2.0 (the \"License\");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\n    http://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n*/\n\n/**\n * Base class for all verification errors\n * Provides structured error handling with error codes\n */\nexport class VerificationError extends Error {\n  constructor(public code: string, message: string) {\n    super(message);\n    this.name = 'VerificationError';\n    Object.setPrototypeOf(this, VerificationError.prototype);\n  }\n}\n\n/**\n * Error thrown when timestamp verification fails\n */\nexport class TimestampError extends VerificationError {\n  constructor(message: string) {\n    super('TIMESTAMP_ERROR', message);\n    this.name = 'TimestampError';\n    Object.setPrototypeOf(this, TimestampError.prototype);\n  }\n}\n\n/**\n * Error thrown when certificate verification fails\n */\nexport class CertificateError extends VerificationError {\n  constructor(message: string) {\n    super('CERTIFICATE_ERROR', message);\n    this.name = 'CertificateError';\n    Object.setPrototypeOf(this, CertificateError.prototype);\n  }\n}\n\n/**\n * Error thrown when transparency log verification fails\n */\nexport class TLogError extends VerificationError {\n  constructor(message: string) {\n    super('TLOG_ERROR', message);\n    this.name = 'TLogError';\n    Object.setPrototypeOf(this, TLogError.prototype);\n  }\n}\n\n/**\n * Error thrown when signature verification fails\n */\nexport class SignatureError extends VerificationError {\n  constructor(message: string) {\n    super('SIGNATURE_ERROR', message);\n    this.name = 'SignatureError';\n    Object.setPrototypeOf(this, SignatureError.prototype);\n  }\n}\n\n/**\n * Error thrown when policy verification fails\n */\nexport class PolicyError extends VerificationError {\n  constructor(message: string) {\n    super('POLICY_ERROR', message);\n    this.name = 'PolicyError';\n    Object.setPrototypeOf(this, PolicyError.prototype);\n  }\n}\n"]}

package/dist/index.d.ts

@@ -1,13 +1,12 @@
-export { SigstoreVerifier } from "./sigstore.js";
+export type { MessageSignature, RFC3161Timestamp, SigstoreBundle, TimestampVerificationData, TLogEntry, VerificationMaterial } from "./bundle.js";
+export { CertificateError, PolicyError, SignatureError, TimestampError, TLogError, VerificationError, } from "./errors.js";
+export type { RawTimestampAuthority, Sigstore, TrustedRoot } from "./interfaces.js";
+export type { VerificationPolicy } from "./policy.js";
+export { AllOf, AnyOf, GITHUB_OIDC_ISSUER, GitHubWorkflowName, GitHubWorkflowRef, GitHubWorkflowRepository, GitHubWorkflowSHA, GitHubWorkflowTrigger, Identity, OIDCBuildConfigDigest, OIDCBuildConfigURI, OIDCBuildSignerDigest, OIDCBuildSignerURI, OIDCBuildTrigger, OIDCIssuer, OIDCIssuerV2, OIDCRunInvocationURI, OIDCRunnerEnvironment, OIDCSourceRepositoryDigest, OIDCSourceRepositoryIdentifier, OIDCSourceRepositoryOwnerIdentifier, OIDCSourceRepositoryOwnerURI, OIDCSourceRepositoryRef, OIDCSourceRepositoryURI, OIDCSourceRepositoryVisibility, } from "./policy.js";
 export type { SigstoreVerifierOptions } from "./sigstore.js";
-export type { SigstoreBundle, TLogEntry, VerificationMaterial, MessageSignature, TimestampVerificationData, RFC3161Timestamp } from "./bundle.js";
-export type { TrustedRoot, Sigstore, RawTimestampAuthority } from "./interfaces.js";
-export { VerificationError, TimestampError, CertificateError, TLogError, SignatureError, PolicyError, } from "./errors.js";
-export { verifyRFC3161Timestamp, verifyBundleTimestamp } from "./timestamp/tsa.js";
+export { SigstoreVerifier } from "./sigstore.js";
+export { verifyBundleTimestamp, verifyRFC3161Timestamp } from "./timestamp/tsa.js";
 export { TrustedRootProvider, type TrustedRootProviderOptions } from "./trust/tuf.js";
-export { X509Certificate, EXTENSION_OID_SCT, EXTENSION_OID_FULCIO_ISSUER_V1, EXTENSION_OID_GITHUB_WORKFLOW_TRIGGER, EXTENSION_OID_GITHUB_WORKFLOW_SHA, EXTENSION_OID_GITHUB_WORKFLOW_NAME, EXTENSION_OID_GITHUB_WORKFLOW_REPOSITORY, EXTENSION_OID_GITHUB_WORKFLOW_REF, EXTENSION_OID_OTHERNAME, EXTENSION_OID_FULCIO_ISSUER_V2, EXTENSION_OID_BUILD_SIGNER_URI, EXTENSION_OID_BUILD_SIGNER_DIGEST, EXTENSION_OID_RUNNER_ENVIRONMENT, EXTENSION_OID_SOURCE_REPOSITORY_URI, EXTENSION_OID_SOURCE_REPOSITORY_DIGEST, EXTENSION_OID_SOURCE_REPOSITORY_REF, EXTENSION_OID_SOURCE_REPOSITORY_IDENTIFIER, EXTENSION_OID_SOURCE_REPOSITORY_OWNER_URI, EXTENSION_OID_SOURCE_REPOSITORY_OWNER_IDENTIFIER, EXTENSION_OID_BUILD_CONFIG_URI, EXTENSION_OID_BUILD_CONFIG_DIGEST, EXTENSION_OID_BUILD_TRIGGER, EXTENSION_OID_RUN_INVOCATION_URI, EXTENSION_OID_SOURCE_REPOSITORY_VISIBILITY, } from "./x509/cert.js";
-export { X509Extension, X509FulcioIssuerV1, X509FulcioIssuerV2, X509GitHubWorkflowTriggerExtension, X509GitHubWorkflowSHAExtension, X509GitHubWorkflowNameExtension, X509GitHubWorkflowRepositoryExtension, X509GitHubWorkflowRefExtension, X509BuildSignerURIExtension, X509BuildSignerDigestExtension, X509RunnerEnvironmentExtension, X509SourceRepositoryURIExtension, X509SourceRepositoryDigestExtension, X509SourceRepositoryRefExtension, X509SourceRepositoryIdentifierExtension, X509SourceRepositoryOwnerURIExtension, X509SourceRepositoryOwnerIdentifierExtension, X509BuildConfigURIExtension, X509BuildConfigDigestExtension, X509BuildTriggerExtension, X509RunInvocationURIExtension, X509SourceRepositoryVisibilityExtension, } from "./x509/ext.js";
+export { EXTENSION_OID_BUILD_CONFIG_DIGEST, EXTENSION_OID_BUILD_CONFIG_URI, EXTENSION_OID_BUILD_SIGNER_DIGEST, EXTENSION_OID_BUILD_SIGNER_URI, EXTENSION_OID_BUILD_TRIGGER, EXTENSION_OID_FULCIO_ISSUER_V1, EXTENSION_OID_FULCIO_ISSUER_V2, EXTENSION_OID_GITHUB_WORKFLOW_NAME, EXTENSION_OID_GITHUB_WORKFLOW_REF, EXTENSION_OID_GITHUB_WORKFLOW_REPOSITORY, EXTENSION_OID_GITHUB_WORKFLOW_SHA, EXTENSION_OID_GITHUB_WORKFLOW_TRIGGER, EXTENSION_OID_OTHERNAME, EXTENSION_OID_RUN_INVOCATION_URI, EXTENSION_OID_RUNNER_ENVIRONMENT, EXTENSION_OID_SCT, EXTENSION_OID_SOURCE_REPOSITORY_DIGEST, EXTENSION_OID_SOURCE_REPOSITORY_IDENTIFIER, EXTENSION_OID_SOURCE_REPOSITORY_OWNER_IDENTIFIER, EXTENSION_OID_SOURCE_REPOSITORY_OWNER_URI, EXTENSION_OID_SOURCE_REPOSITORY_REF, EXTENSION_OID_SOURCE_REPOSITORY_URI, EXTENSION_OID_SOURCE_REPOSITORY_VISIBILITY, X509Certificate, } from "./x509/cert.js";
 export { CertificateChainVerifier } from "./x509/chain.js";
-export { GITHUB_OIDC_ISSUER, OIDCIssuer, OIDCIssuerV2, GitHubWorkflowTrigger, GitHubWorkflowSHA, GitHubWorkflowName, GitHubWorkflowRepository, GitHubWorkflowRef, OIDCBuildSignerURI, OIDCBuildSignerDigest, OIDCRunnerEnvironment, OIDCSourceRepositoryURI, OIDCSourceRepositoryDigest, OIDCSourceRepositoryRef, OIDCSourceRepositoryIdentifier, OIDCSourceRepositoryOwnerURI, OIDCSourceRepositoryOwnerIdentifier, OIDCBuildConfigURI, OIDCBuildConfigDigest, OIDCBuildTrigger, OIDCRunInvocationURI, OIDCSourceRepositoryVisibility, AllOf, AnyOf, Identity, } from "./policy.js";
-export type { VerificationPolicy } from "./policy.js";
-//# sourceMappingURL=index.d.ts.map
+export { X509BuildConfigDigestExtension, X509BuildConfigURIExtension, X509BuildSignerDigestExtension, X509BuildSignerURIExtension, X509BuildTriggerExtension, X509Extension, X509FulcioIssuerV1, X509FulcioIssuerV2, X509GitHubWorkflowNameExtension, X509GitHubWorkflowRefExtension, X509GitHubWorkflowRepositoryExtension, X509GitHubWorkflowSHAExtension, X509GitHubWorkflowTriggerExtension, X509RunInvocationURIExtension, X509RunnerEnvironmentExtension, X509SourceRepositoryDigestExtension, X509SourceRepositoryIdentifierExtension, X509SourceRepositoryOwnerIdentifierExtension, X509SourceRepositoryOwnerURIExtension, X509SourceRepositoryRefExtension, X509SourceRepositoryURIExtension, X509SourceRepositoryVisibilityExtension, } from "./x509/ext.js";

package/dist/index.js

@@ -1,9 +1,9 @@
+export { CertificateError, PolicyError, SignatureError, TimestampError, TLogError, VerificationError, } from "./errors.js";
+export { AllOf, AnyOf, GITHUB_OIDC_ISSUER, GitHubWorkflowName, GitHubWorkflowRef, GitHubWorkflowRepository, GitHubWorkflowSHA, GitHubWorkflowTrigger, Identity, OIDCBuildConfigDigest, OIDCBuildConfigURI, OIDCBuildSignerDigest, OIDCBuildSignerURI, OIDCBuildTrigger, OIDCIssuer, OIDCIssuerV2, OIDCRunInvocationURI, OIDCRunnerEnvironment, OIDCSourceRepositoryDigest, OIDCSourceRepositoryIdentifier, OIDCSourceRepositoryOwnerIdentifier, OIDCSourceRepositoryOwnerURI, OIDCSourceRepositoryRef, OIDCSourceRepositoryURI, OIDCSourceRepositoryVisibility, } from "./policy.js";
 export { SigstoreVerifier } from "./sigstore.js";
-export { VerificationError, TimestampError, CertificateError, TLogError, SignatureError, PolicyError, } from "./errors.js";
-export { verifyRFC3161Timestamp, verifyBundleTimestamp } from "./timestamp/tsa.js";
+export { verifyBundleTimestamp, verifyRFC3161Timestamp } from "./timestamp/tsa.js";
 export { TrustedRootProvider } from "./trust/tuf.js";
-export { X509Certificate, EXTENSION_OID_SCT, EXTENSION_OID_FULCIO_ISSUER_V1, EXTENSION_OID_GITHUB_WORKFLOW_TRIGGER, EXTENSION_OID_GITHUB_WORKFLOW_SHA, EXTENSION_OID_GITHUB_WORKFLOW_NAME, EXTENSION_OID_GITHUB_WORKFLOW_REPOSITORY, EXTENSION_OID_GITHUB_WORKFLOW_REF, EXTENSION_OID_OTHERNAME, EXTENSION_OID_FULCIO_ISSUER_V2, EXTENSION_OID_BUILD_SIGNER_URI, EXTENSION_OID_BUILD_SIGNER_DIGEST, EXTENSION_OID_RUNNER_ENVIRONMENT, EXTENSION_OID_SOURCE_REPOSITORY_URI, EXTENSION_OID_SOURCE_REPOSITORY_DIGEST, EXTENSION_OID_SOURCE_REPOSITORY_REF, EXTENSION_OID_SOURCE_REPOSITORY_IDENTIFIER, EXTENSION_OID_SOURCE_REPOSITORY_OWNER_URI, EXTENSION_OID_SOURCE_REPOSITORY_OWNER_IDENTIFIER, EXTENSION_OID_BUILD_CONFIG_URI, EXTENSION_OID_BUILD_CONFIG_DIGEST, EXTENSION_OID_BUILD_TRIGGER, EXTENSION_OID_RUN_INVOCATION_URI, EXTENSION_OID_SOURCE_REPOSITORY_VISIBILITY, } from "./x509/cert.js";
-export { X509Extension, X509FulcioIssuerV1, X509FulcioIssuerV2, X509GitHubWorkflowTriggerExtension, X509GitHubWorkflowSHAExtension, X509GitHubWorkflowNameExtension, X509GitHubWorkflowRepositoryExtension, X509GitHubWorkflowRefExtension, X509BuildSignerURIExtension, X509BuildSignerDigestExtension, X509RunnerEnvironmentExtension, X509SourceRepositoryURIExtension, X509SourceRepositoryDigestExtension, X509SourceRepositoryRefExtension, X509SourceRepositoryIdentifierExtension, X509SourceRepositoryOwnerURIExtension, X509SourceRepositoryOwnerIdentifierExtension, X509BuildConfigURIExtension, X509BuildConfigDigestExtension, X509BuildTriggerExtension, X509RunInvocationURIExtension, X509SourceRepositoryVisibilityExtension, } from "./x509/ext.js";
+export { EXTENSION_OID_BUILD_CONFIG_DIGEST, EXTENSION_OID_BUILD_CONFIG_URI, EXTENSION_OID_BUILD_SIGNER_DIGEST, EXTENSION_OID_BUILD_SIGNER_URI, EXTENSION_OID_BUILD_TRIGGER, EXTENSION_OID_FULCIO_ISSUER_V1, EXTENSION_OID_FULCIO_ISSUER_V2, EXTENSION_OID_GITHUB_WORKFLOW_NAME, EXTENSION_OID_GITHUB_WORKFLOW_REF, EXTENSION_OID_GITHUB_WORKFLOW_REPOSITORY, EXTENSION_OID_GITHUB_WORKFLOW_SHA, EXTENSION_OID_GITHUB_WORKFLOW_TRIGGER, EXTENSION_OID_OTHERNAME, EXTENSION_OID_RUN_INVOCATION_URI, EXTENSION_OID_RUNNER_ENVIRONMENT, EXTENSION_OID_SCT, EXTENSION_OID_SOURCE_REPOSITORY_DIGEST, EXTENSION_OID_SOURCE_REPOSITORY_IDENTIFIER, EXTENSION_OID_SOURCE_REPOSITORY_OWNER_IDENTIFIER, EXTENSION_OID_SOURCE_REPOSITORY_OWNER_URI, EXTENSION_OID_SOURCE_REPOSITORY_REF, EXTENSION_OID_SOURCE_REPOSITORY_URI, EXTENSION_OID_SOURCE_REPOSITORY_VISIBILITY, X509Certificate, } from "./x509/cert.js";
 export { CertificateChainVerifier } from "./x509/chain.js";
-export { GITHUB_OIDC_ISSUER, OIDCIssuer, OIDCIssuerV2, GitHubWorkflowTrigger, GitHubWorkflowSHA, GitHubWorkflowName, GitHubWorkflowRepository, GitHubWorkflowRef, OIDCBuildSignerURI, OIDCBuildSignerDigest, OIDCRunnerEnvironment, OIDCSourceRepositoryURI, OIDCSourceRepositoryDigest, OIDCSourceRepositoryRef, OIDCSourceRepositoryIdentifier, OIDCSourceRepositoryOwnerURI, OIDCSourceRepositoryOwnerIdentifier, OIDCBuildConfigURI, OIDCBuildConfigDigest, OIDCBuildTrigger, OIDCRunInvocationURI, OIDCSourceRepositoryVisibility, AllOf, AnyOf, Identity, } from "./policy.js";
+export { X509BuildConfigDigestExtension, X509BuildConfigURIExtension, X509BuildSignerDigestExtension, X509BuildSignerURIExtension, X509BuildTriggerExtension, X509Extension, X509FulcioIssuerV1, X509FulcioIssuerV2, X509GitHubWorkflowNameExtension, X509GitHubWorkflowRefExtension, X509GitHubWorkflowRepositoryExtension, X509GitHubWorkflowSHAExtension, X509GitHubWorkflowTriggerExtension, X509RunInvocationURIExtension, X509RunnerEnvironmentExtension, X509SourceRepositoryDigestExtension, X509SourceRepositoryIdentifierExtension, X509SourceRepositoryOwnerIdentifierExtension, X509SourceRepositoryOwnerURIExtension, X509SourceRepositoryRefExtension, X509SourceRepositoryURIExtension, X509SourceRepositoryVisibilityExtension, } from "./x509/ext.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAIjD,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,SAAS,EACT,cAAc,EACd,WAAW,GACZ,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AACnF,OAAO,EAAE,mBAAmB,EAAmC,MAAM,gBAAgB,CAAC;AACtF,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,8BAA8B,EAC9B,qCAAqC,EACrC,iCAAiC,EACjC,kCAAkC,EAClC,wCAAwC,EACxC,iCAAiC,EACjC,uBAAuB,EACvB,8BAA8B,EAC9B,8BAA8B,EAC9B,iCAAiC,EACjC,gCAAgC,EAChC,mCAAmC,EACnC,sCAAsC,EACtC,mCAAmC,EACnC,0CAA0C,EAC1C,yCAAyC,EACzC,gDAAgD,EAChD,8BAA8B,EAC9B,iCAAiC,EACjC,2BAA2B,EAC3B,gCAAgC,EAChC,0CAA0C,GAC3C,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,kCAAkC,EAClC,8BAA8B,EAC9B,+BAA+B,EAC/B,qCAAqC,EACrC,8BAA8B,EAC9B,2BAA2B,EAC3B,8BAA8B,EAC9B,8BAA8B,EAC9B,gCAAgC,EAChC,mCAAmC,EACnC,gCAAgC,EAChC,uCAAuC,EACvC,qCAAqC,EACrC,4CAA4C,EAC5C,2BAA2B,EAC3B,8BAA8B,EAC9B,yBAAyB,EACzB,6BAA6B,EAC7B,uCAAuC,GACxC,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAC3D,OAAO,EACL,kBAAkB,EAClB,UAAU,EACV,YAAY,EACZ,qBAAqB,EACrB,iBAAiB,EACjB,kBAAkB,EAClB,wBAAwB,EACxB,iBAAiB,EACjB,kBAAkB,EAClB,qBAAqB,EACrB,qBAAqB,EACrB,uBAAuB,EACvB,0BAA0B,EAC1B,uBAAuB,EACvB,8BAA8B,EAC9B,4BAA4B,EAC5B,mCAAmC,EACnC,kBAAkB,EAClB,qBAAqB,EACrB,gBAAgB,EAChB,oBAAoB,EACpB,8BAA8B,EAC9B,KAAK,EACL,KAAK,EACL,QAAQ,GACT,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EACL,gBAAgB,EAChB,WAAW,EACX,cAAc,EACd,cAAc,EACd,SAAS,EACT,iBAAiB,GAClB,MAAM,aAAa,CAAC;AAGrB,OAAO,EACL,KAAK,EACL,KAAK,EACL,kBAAkB,EAClB,kBAAkB,EAClB,iBAAiB,EACjB,wBAAwB,EACxB,iBAAiB,EACjB,qBAAqB,EACrB,QAAQ,EACR,qBAAqB,EACrB,kBAAkB,EAClB,qBAAqB,EACrB,kBAAkB,EAClB,gBAAgB,EAChB,UAAU,EACV,YAAY,EACZ,oBAAoB,EACpB,qBAAqB,EACrB,0BAA0B,EAC1B,8BAA8B,EAC9B,mCAAmC,EACnC,4BAA4B,EAC5B,uBAAuB,EACvB,uBAAuB,EACvB,8BAA8B,GAC/B,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AACnF,OAAO,EAAE,mBAAmB,EAAmC,MAAM,gBAAgB,CAAC;AACtF,OAAO,EACL,iCAAiC,EACjC,8BAA8B,EAC9B,iCAAiC,EACjC,8BAA8B,EAC9B,2BAA2B,EAC3B,8BAA8B,EAC9B,8BAA8B,EAC9B,kCAAkC,EAClC,iCAAiC,EACjC,wCAAwC,EACxC,iCAAiC,EACjC,qCAAqC,EACrC,uBAAuB,EACvB,gCAAgC,EAChC,gCAAgC,EAChC,iBAAiB,EACjB,sCAAsC,EACtC,0CAA0C,EAC1C,gDAAgD,EAChD,yCAAyC,EACzC,mCAAmC,EACnC,mCAAmC,EACnC,0CAA0C,EAC1C,eAAe,GAChB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAC3D,OAAO,EACL,8BAA8B,EAC9B,2BAA2B,EAC3B,8BAA8B,EAC9B,2BAA2B,EAC3B,yBAAyB,EACzB,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,+BAA+B,EAC/B,8BAA8B,EAC9B,qCAAqC,EACrC,8BAA8B,EAC9B,kCAAkC,EAClC,6BAA6B,EAC7B,8BAA8B,EAC9B,mCAAmC,EACnC,uCAAuC,EACvC,4CAA4C,EAC5C,qCAAqC,EACrC,gCAAgC,EAChC,gCAAgC,EAChC,uCAAuC,GACxC,MAAM,eAAe,CAAC","sourcesContent":["export type { MessageSignature, RFC3161Timestamp, SigstoreBundle, TimestampVerificationData, TLogEntry, VerificationMaterial } from \"./bundle.js\";\nexport {\n  CertificateError,\n  PolicyError,\n  SignatureError,\n  TimestampError,\n  TLogError,\n  VerificationError,\n} from \"./errors.js\";\nexport type { RawTimestampAuthority, Sigstore, TrustedRoot } from \"./interfaces.js\";\nexport type { VerificationPolicy } from \"./policy.js\";\nexport {\n  AllOf,\n  AnyOf,\n  GITHUB_OIDC_ISSUER,\n  GitHubWorkflowName,\n  GitHubWorkflowRef,\n  GitHubWorkflowRepository,\n  GitHubWorkflowSHA,\n  GitHubWorkflowTrigger,\n  Identity,\n  OIDCBuildConfigDigest,\n  OIDCBuildConfigURI,\n  OIDCBuildSignerDigest,\n  OIDCBuildSignerURI,\n  OIDCBuildTrigger,\n  OIDCIssuer,\n  OIDCIssuerV2,\n  OIDCRunInvocationURI,\n  OIDCRunnerEnvironment,\n  OIDCSourceRepositoryDigest,\n  OIDCSourceRepositoryIdentifier,\n  OIDCSourceRepositoryOwnerIdentifier,\n  OIDCSourceRepositoryOwnerURI,\n  OIDCSourceRepositoryRef,\n  OIDCSourceRepositoryURI,\n  OIDCSourceRepositoryVisibility,\n} from \"./policy.js\";\nexport type { SigstoreVerifierOptions } from \"./sigstore.js\";\nexport { SigstoreVerifier } from \"./sigstore.js\";\nexport { verifyBundleTimestamp, verifyRFC3161Timestamp } from \"./timestamp/tsa.js\";\nexport { TrustedRootProvider, type TrustedRootProviderOptions } from \"./trust/tuf.js\";\nexport {\n  EXTENSION_OID_BUILD_CONFIG_DIGEST,\n  EXTENSION_OID_BUILD_CONFIG_URI,\n  EXTENSION_OID_BUILD_SIGNER_DIGEST,\n  EXTENSION_OID_BUILD_SIGNER_URI,\n  EXTENSION_OID_BUILD_TRIGGER,\n  EXTENSION_OID_FULCIO_ISSUER_V1,\n  EXTENSION_OID_FULCIO_ISSUER_V2,\n  EXTENSION_OID_GITHUB_WORKFLOW_NAME,\n  EXTENSION_OID_GITHUB_WORKFLOW_REF,\n  EXTENSION_OID_GITHUB_WORKFLOW_REPOSITORY,\n  EXTENSION_OID_GITHUB_WORKFLOW_SHA,\n  EXTENSION_OID_GITHUB_WORKFLOW_TRIGGER,\n  EXTENSION_OID_OTHERNAME,\n  EXTENSION_OID_RUN_INVOCATION_URI,\n  EXTENSION_OID_RUNNER_ENVIRONMENT,\n  EXTENSION_OID_SCT,\n  EXTENSION_OID_SOURCE_REPOSITORY_DIGEST,\n  EXTENSION_OID_SOURCE_REPOSITORY_IDENTIFIER,\n  EXTENSION_OID_SOURCE_REPOSITORY_OWNER_IDENTIFIER,\n  EXTENSION_OID_SOURCE_REPOSITORY_OWNER_URI,\n  EXTENSION_OID_SOURCE_REPOSITORY_REF,\n  EXTENSION_OID_SOURCE_REPOSITORY_URI,\n  EXTENSION_OID_SOURCE_REPOSITORY_VISIBILITY,\n  X509Certificate,\n} from \"./x509/cert.js\";\nexport { CertificateChainVerifier } from \"./x509/chain.js\";\nexport {\n  X509BuildConfigDigestExtension,\n  X509BuildConfigURIExtension,\n  X509BuildSignerDigestExtension,\n  X509BuildSignerURIExtension,\n  X509BuildTriggerExtension,\n  X509Extension,\n  X509FulcioIssuerV1,\n  X509FulcioIssuerV2,\n  X509GitHubWorkflowNameExtension,\n  X509GitHubWorkflowRefExtension,\n  X509GitHubWorkflowRepositoryExtension,\n  X509GitHubWorkflowSHAExtension,\n  X509GitHubWorkflowTriggerExtension,\n  X509RunInvocationURIExtension,\n  X509RunnerEnvironmentExtension,\n  X509SourceRepositoryDigestExtension,\n  X509SourceRepositoryIdentifierExtension,\n  X509SourceRepositoryOwnerIdentifierExtension,\n  X509SourceRepositoryOwnerURIExtension,\n  X509SourceRepositoryRefExtension,\n  X509SourceRepositoryURIExtension,\n  X509SourceRepositoryVisibilityExtension,\n} from \"./x509/ext.js\";\n"]}

package/dist/interfaces.d.ts

@@ -101,6 +101,5 @@ export interface RawCA {
     };
 }
 export type RawCAs = RawCA[];
-export { KeyTypes, EcdsaTypes, HashAlgorithms } from "@freedomofpress/crypto-browser";
+export { EcdsaTypes, HashAlgorithms, KeyTypes } from "@freedomofpress/crypto-browser";
 export declare function getHashAlgorithm(algorithm: string): string;
-//# sourceMappingURL=interfaces.d.ts.map

package/dist/interfaces.js

@@ -20,7 +20,7 @@ export var SigstoreRoots;
     SigstoreRoots["tlogs"] = "tlogs";
 })(SigstoreRoots || (SigstoreRoots = {}));
 // Re-export crypto enums from crypto-browser (shared with tuf-browser)
-export { KeyTypes, EcdsaTypes, HashAlgorithms } from "@freedomofpress/crypto-browser";
+export { EcdsaTypes, HashAlgorithms, KeyTypes } from "@freedomofpress/crypto-browser";
 import { HashAlgorithms } from "@freedomofpress/crypto-browser";
 // Supported hash algorithms for payload hash validation
 // Rekor v1 uses lowercase (sha256), Rekor v2 uses uppercase with underscore (SHA2_256)

package/dist/interfaces.js.map

@@ -1 +1 @@
-{"version":3,"file":"interfaces.js","sourceRoot":"","sources":["../src/interfaces.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,mBAAmB,CACjC,QAAwD;IAExD,IACE,OAAO,QAAQ,EAAE,KAAK,KAAK,QAAQ;QACnC,CAAC,QAAQ,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,QAAQ,CAAC,GAAG,KAAK,QAAQ,CAAC,EAChE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,KAAK,SAAS;QACpC,CAAC,CAAC,IAAI,IAAI,CAAC,gBAAgB,CAAC;QAC5B,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,IAAI,KAAK,GAAG,GAAG,EAAE,CAAC;QACxF,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;AACxB,CAAC;AAED,MAAM,CAAN,IAAY,aAKX;AALD,WAAY,aAAa;IACvB,kEAAiD,CAAA;IACjD,kCAAiB,CAAA;IACjB,8DAA6C,CAAA;IAC7C,gCAAe,CAAA;AACjB,CAAC,EALW,aAAa,KAAb,aAAa,QAKxB;AAsGD,uEAAuE;AACvE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AACtF,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAEhE,wDAAwD;AACxD,uFAAuF;AACvF,MAAM,yBAAyB,GAA2B;IACxD,QAAQ,EAAE,cAAc,CAAC,MAAM;IAC/B,QAAQ,EAAE,cAAc,CAAC,MAAM;IAC/B,QAAQ,EAAE,cAAc,CAAC,MAAM;IAC/B,UAAU,EAAE,cAAc,CAAC,MAAM;IACjC,UAAU,EAAE,cAAc,CAAC,MAAM;IACjC,UAAU,EAAE,cAAc,CAAC,MAAM;CAClC,CAAC;AAEF,MAAM,UAAU,gBAAgB,CAAC,SAAiB;IAChD,MAAM,OAAO,GAAG,yBAAyB,CAAC,SAAS,CAAC,CAAC;IACrD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,+BAA+B,SAAS,EAAE,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}
+{"version":3,"file":"interfaces.js","sourceRoot":"","sources":["../src/interfaces.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,mBAAmB,CACjC,QAAwD;IAExD,IACE,OAAO,QAAQ,EAAE,KAAK,KAAK,QAAQ;QACnC,CAAC,QAAQ,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,QAAQ,CAAC,GAAG,KAAK,QAAQ,CAAC,EAChE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,KAAK,SAAS;QACpC,CAAC,CAAC,IAAI,IAAI,CAAC,gBAAgB,CAAC;QAC5B,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,IAAI,KAAK,GAAG,GAAG,EAAE,CAAC;QACxF,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;AACxB,CAAC;AAED,MAAM,CAAN,IAAY,aAKX;AALD,WAAY,aAAa;IACvB,kEAAiD,CAAA;IACjD,kCAAiB,CAAA;IACjB,8DAA6C,CAAA;IAC7C,gCAAe,CAAA;AACjB,CAAC,EALW,aAAa,KAAb,aAAa,QAKxB;AAsGD,uEAAuE;AACvE,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AACtF,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAEhE,wDAAwD;AACxD,uFAAuF;AACvF,MAAM,yBAAyB,GAA2B;IACxD,QAAQ,EAAE,cAAc,CAAC,MAAM;IAC/B,QAAQ,EAAE,cAAc,CAAC,MAAM;IAC/B,QAAQ,EAAE,cAAc,CAAC,MAAM;IAC/B,UAAU,EAAE,cAAc,CAAC,MAAM;IACjC,UAAU,EAAE,cAAc,CAAC,MAAM;IACjC,UAAU,EAAE,cAAc,CAAC,MAAM;CAClC,CAAC;AAEF,MAAM,UAAU,gBAAgB,CAAC,SAAiB;IAChD,MAAM,OAAO,GAAG,yBAAyB,CAAC,SAAS,CAAC,CAAC;IACrD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,+BAA+B,SAAS,EAAE,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC","sourcesContent":["import { X509Certificate } from \"./x509/index.js\";\n\nexport function parseValidityPeriod(\n  validity: { start?: unknown; end?: unknown } | undefined,\n): { start: Date; end: Date } {\n  if (\n    typeof validity?.start !== \"string\" ||\n    (validity.end !== undefined && typeof validity.end !== \"string\")\n  ) {\n    throw new Error(\"Invalid authority validity period\");\n  }\n  const start = new Date(validity.start);\n  const end = validity.end === undefined\n    ? new Date(8640000000000000)\n    : new Date(validity.end);\n  if (!Number.isFinite(start.getTime()) || !Number.isFinite(end.getTime()) || start > end) {\n    throw new Error(\"Invalid authority validity period\");\n  }\n  return { start, end };\n}\n\nexport enum SigstoreRoots {\n  certificateAuthorities = \"certificateAuthorities\",\n  ctlogs = \"ctlogs\",\n  timestampAuthorities = \"timestampAuthorities\",\n  tlogs = \"tlogs\",\n}\n\nexport type RawTimestampAuthorities = RawTimestampAuthority[];\n\nexport interface TrustedRoot {\n  mediaType: string;\n  tlogs: RawLogs;\n  certificateAuthorities: RawCAs;\n  ctlogs: RawLogs;\n  timestampAuthorities: RawTimestampAuthorities;\n}\n\nexport interface RawTimestampAuthority {\n  subject: {\n    organization: string;\n    commonName: string;\n  };\n  certChain: {\n    certificates: {\n      rawBytes: string;\n    }[];\n  };\n  validFor: {\n    start: string;\n    end?: string;\n  };\n  operator?: string;\n}\n\nexport interface CTLog {\n  logID: Uint8Array;\n  publicKey: CryptoKey;\n  operator: string;\n  validFor: {\n    start: Date;\n    end: Date;\n  };\n}\n\nexport interface RekorKeyInfo {\n  publicKey: CryptoKey;\n  logId: Uint8Array;\n  hashAlgorithm: string;\n  operator: string;\n  validFor: {\n    start: Date;\n    end: Date;\n  };\n}\n\nexport interface CertAuthority {\n  certChain: X509Certificate[];\n  validFor: {\n    start: Date;\n    end: Date;\n  };\n}\n\nexport interface Sigstore {\n  rekor: RekorKeyInfo[];\n  ctlogs: CTLog[];\n  certificateAuthorities: CertAuthority[];\n}\n\nexport interface RawLog {\n  baseUrl: string;\n  hashAlgorithm: string;\n  publicKey: {\n    rawBytes: string;\n    keyDetails: string;\n    validFor: {\n      start: string;\n      end?: string;\n    };\n  };\n  logId: {\n    keyId: string;\n  };\n  operator?: string;\n}\n\nexport type RawLogs = RawLog[];\n\nexport interface RawCA {\n  subject: {\n    organization: string;\n    commonName: string;\n  };\n  uri: string;\n  certChain: {\n    certificates: {\n      rawBytes: string;\n    }[];\n  };\n  validFor: {\n    start: string;\n    end?: string;\n  };\n}\n\nexport type RawCAs = RawCA[];\n\n// Re-export crypto enums from crypto-browser (shared with tuf-browser)\nexport { EcdsaTypes, HashAlgorithms, KeyTypes } from \"@freedomofpress/crypto-browser\";\nimport { HashAlgorithms } from \"@freedomofpress/crypto-browser\";\n\n// Supported hash algorithms for payload hash validation\n// Rekor v1 uses lowercase (sha256), Rekor v2 uses uppercase with underscore (SHA2_256)\nconst SUPPORTED_HASH_ALGORITHMS: Record<string, string> = {\n  \"sha256\": HashAlgorithms.SHA256,\n  \"sha384\": HashAlgorithms.SHA384,\n  \"sha512\": HashAlgorithms.SHA512,\n  \"SHA2_256\": HashAlgorithms.SHA256,\n  \"SHA2_384\": HashAlgorithms.SHA384,\n  \"SHA2_512\": HashAlgorithms.SHA512,\n};\n\nexport function getHashAlgorithm(algorithm: string): string {\n  const hashAlg = SUPPORTED_HASH_ALGORITHMS[algorithm];\n  if (!hashAlg) {\n    throw new Error(`Unsupported hash algorithm: ${algorithm}`);\n  }\n  return hashAlg;\n}\n"]}

package/dist/oid.d.ts

@@ -4,4 +4,3 @@ export declare const OID_RSASSA_PSS = "1.2.840.113549.1.1.10";
 export declare const SHA2_HASH_ALGOS: Record<string, string>;
 export declare const DEFAULT_HASH_ALGORITHM = "sha256";
 export declare const ECDSA_CURVE_NAMES: Record<string, string>;
-//# sourceMappingURL=oid.d.ts.map

package/dist/oid.js.map

@@ -1 +1 @@
-{"version":3,"file":"oid.js","sourceRoot":"","sources":["../src/oid.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAElF,MAAM,CAAC,MAAM,qBAAqB,GAA2B;IAC3D,qBAAqB,EAAE,QAAQ;IAC/B,qBAAqB,EAAE,QAAQ;IAC/B,qBAAqB,EAAE,QAAQ;IAC/B,qBAAqB,EAAE,QAAQ;CAChC,CAAC;AAEF,yCAAyC;AACzC,MAAM,CAAC,MAAM,mBAAmB,GAA2B;IACzD,uBAAuB,EAAE,QAAQ,EAAE,0BAA0B;IAC7D,uBAAuB,EAAE,QAAQ,EAAE,0BAA0B;IAC7D,uBAAuB,EAAE,QAAQ,EAAE,0BAA0B;IAC7D,sBAAsB,EAAE,MAAM,EAAK,wBAAwB;CAC5D,CAAC;AAEF,qFAAqF;AACrF,MAAM,CAAC,MAAM,cAAc,GAAG,uBAAuB,CAAC;AAEtD,MAAM,CAAC,MAAM,eAAe,GAA2B;IACrD,wBAAwB,EAAE,QAAQ;IAClC,wBAAwB,EAAE,QAAQ;IAClC,wBAAwB,EAAE,QAAQ;CACnC,CAAC;AAEF,iDAAiD;AACjD,MAAM,CAAC,MAAM,sBAAsB,GAAG,QAAQ,CAAC;AAE/C,MAAM,CAAC,MAAM,iBAAiB,GAA2B;IACvD,qBAAqB,EAAE,WAAW;IAClC,cAAc,EAAE,WAAW;IAC3B,cAAc,EAAE,WAAW;CAC5B,CAAC"}
+{"version":3,"file":"oid.js","sourceRoot":"","sources":["../src/oid.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAElF,MAAM,CAAC,MAAM,qBAAqB,GAA2B;IAC3D,qBAAqB,EAAE,QAAQ;IAC/B,qBAAqB,EAAE,QAAQ;IAC/B,qBAAqB,EAAE,QAAQ;IAC/B,qBAAqB,EAAE,QAAQ;CAChC,CAAC;AAEF,yCAAyC;AACzC,MAAM,CAAC,MAAM,mBAAmB,GAA2B;IACzD,uBAAuB,EAAE,QAAQ,EAAE,0BAA0B;IAC7D,uBAAuB,EAAE,QAAQ,EAAE,0BAA0B;IAC7D,uBAAuB,EAAE,QAAQ,EAAE,0BAA0B;IAC7D,sBAAsB,EAAE,MAAM,EAAK,wBAAwB;CAC5D,CAAC;AAEF,qFAAqF;AACrF,MAAM,CAAC,MAAM,cAAc,GAAG,uBAAuB,CAAC;AAEtD,MAAM,CAAC,MAAM,eAAe,GAA2B;IACrD,wBAAwB,EAAE,QAAQ;IAClC,wBAAwB,EAAE,QAAQ;IAClC,wBAAwB,EAAE,QAAQ;CACnC,CAAC;AAEF,iDAAiD;AACjD,MAAM,CAAC,MAAM,sBAAsB,GAAG,QAAQ,CAAC;AAE/C,MAAM,CAAC,MAAM,iBAAiB,GAA2B;IACvD,qBAAqB,EAAE,WAAW;IAClC,cAAc,EAAE,WAAW;IAC3B,cAAc,EAAE,WAAW;CAC5B,CAAC","sourcesContent":["// From https://github.com/sigstore/sigstore-js/blob/main/packages/core/src/oid.ts\n\nexport const ECDSA_SIGNATURE_ALGOS: Record<string, string> = {\n  \"1.2.840.10045.4.3.1\": \"sha224\",\n  \"1.2.840.10045.4.3.2\": \"sha256\",\n  \"1.2.840.10045.4.3.3\": \"sha384\",\n  \"1.2.840.10045.4.3.4\": \"sha512\",\n};\n\n// RSA signature algorithms (PKCS#1 v1.5)\nexport const RSA_SIGNATURE_ALGOS: Record<string, string> = {\n  \"1.2.840.113549.1.1.11\": \"sha256\", // sha256WithRSAEncryption\n  \"1.2.840.113549.1.1.12\": \"sha384\", // sha384WithRSAEncryption\n  \"1.2.840.113549.1.1.13\": \"sha512\", // sha512WithRSAEncryption\n  \"1.2.840.113549.1.1.5\": \"sha1\",    // sha1WithRSAEncryption\n};\n\n// RSASSA-PSS OID - hash algorithm must be parsed from signature algorithm parameters\nexport const OID_RSASSA_PSS = \"1.2.840.113549.1.1.10\";\n\nexport const SHA2_HASH_ALGOS: Record<string, string> = {\n  \"2.16.840.1.101.3.4.2.1\": \"sha256\",\n  \"2.16.840.1.101.3.4.2.2\": \"sha384\",\n  \"2.16.840.1.101.3.4.2.3\": \"sha512\",\n};\n\n// Default hash algorithm used when not specified\nexport const DEFAULT_HASH_ALGORITHM = \"sha256\";\n\nexport const ECDSA_CURVE_NAMES: Record<string, string> = {\n  \"1.2.840.10045.3.1.7\": \"secp256r1\",\n  \"1.3.132.0.34\": \"secp384r1\",\n  \"1.3.132.0.35\": \"secp521r1\",\n};\n"]}

package/dist/policy.d.ts

@@ -263,4 +263,3 @@ export declare class Identity implements VerificationPolicy {
     verify(cert: X509Certificate): void;
 }
 export {};
-//# sourceMappingURL=policy.d.ts.map

package/dist/policy.js

@@ -14,7 +14,7 @@
  * - Identity: Verifies SAN with optional issuer check
  */
 import { PolicyError } from "./errors.js";
-import { EXTENSION_OID_FULCIO_ISSUER_V1, EXTENSION_OID_GITHUB_WORKFLOW_TRIGGER, EXTENSION_OID_GITHUB_WORKFLOW_SHA, EXTENSION_OID_GITHUB_WORKFLOW_NAME, EXTENSION_OID_GITHUB_WORKFLOW_REPOSITORY, EXTENSION_OID_GITHUB_WORKFLOW_REF, EXTENSION_OID_OTHERNAME, EXTENSION_OID_FULCIO_ISSUER_V2, EXTENSION_OID_BUILD_SIGNER_URI, EXTENSION_OID_BUILD_SIGNER_DIGEST, EXTENSION_OID_RUNNER_ENVIRONMENT, EXTENSION_OID_SOURCE_REPOSITORY_URI, EXTENSION_OID_SOURCE_REPOSITORY_DIGEST, EXTENSION_OID_SOURCE_REPOSITORY_REF, EXTENSION_OID_SOURCE_REPOSITORY_IDENTIFIER, EXTENSION_OID_SOURCE_REPOSITORY_OWNER_URI, EXTENSION_OID_SOURCE_REPOSITORY_OWNER_IDENTIFIER, EXTENSION_OID_BUILD_CONFIG_URI, EXTENSION_OID_BUILD_CONFIG_DIGEST, EXTENSION_OID_BUILD_TRIGGER, EXTENSION_OID_RUN_INVOCATION_URI, EXTENSION_OID_SOURCE_REPOSITORY_VISIBILITY, } from "./x509/cert.js";
+import { EXTENSION_OID_BUILD_CONFIG_DIGEST, EXTENSION_OID_BUILD_CONFIG_URI, EXTENSION_OID_BUILD_SIGNER_DIGEST, EXTENSION_OID_BUILD_SIGNER_URI, EXTENSION_OID_BUILD_TRIGGER, EXTENSION_OID_FULCIO_ISSUER_V1, EXTENSION_OID_FULCIO_ISSUER_V2, EXTENSION_OID_GITHUB_WORKFLOW_NAME, EXTENSION_OID_GITHUB_WORKFLOW_REF, EXTENSION_OID_GITHUB_WORKFLOW_REPOSITORY, EXTENSION_OID_GITHUB_WORKFLOW_SHA, EXTENSION_OID_GITHUB_WORKFLOW_TRIGGER, EXTENSION_OID_OTHERNAME, EXTENSION_OID_RUN_INVOCATION_URI, EXTENSION_OID_RUNNER_ENVIRONMENT, EXTENSION_OID_SOURCE_REPOSITORY_DIGEST, EXTENSION_OID_SOURCE_REPOSITORY_IDENTIFIER, EXTENSION_OID_SOURCE_REPOSITORY_OWNER_IDENTIFIER, EXTENSION_OID_SOURCE_REPOSITORY_OWNER_URI, EXTENSION_OID_SOURCE_REPOSITORY_REF, EXTENSION_OID_SOURCE_REPOSITORY_URI, EXTENSION_OID_SOURCE_REPOSITORY_VISIBILITY, } from "./x509/cert.js";
 // Standard GitHub Actions OIDC issuer
 // https://docs.github.com/en/actions/security-for-github-actions/security-hardening-your-deployments/about-security-hardening-with-openid-connect
 export const GITHUB_OIDC_ISSUER = "https://token.actions.githubusercontent.com";

package/dist/policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"policy.js","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAEL,8BAA8B,EAC9B,qCAAqC,EACrC,iCAAiC,EACjC,kCAAkC,EAClC,wCAAwC,EACxC,iCAAiC,EACjC,uBAAuB,EACvB,8BAA8B,EAC9B,8BAA8B,EAC9B,iCAAiC,EACjC,gCAAgC,EAChC,mCAAmC,EACnC,sCAAsC,EACtC,mCAAmC,EACnC,0CAA0C,EAC1C,yCAAyC,EACzC,gDAAgD,EAChD,8BAA8B,EAC9B,iCAAiC,EACjC,2BAA2B,EAC3B,gCAAgC,EAChC,0CAA0C,GAC3C,MAAM,gBAAgB,CAAC;AAExB,sCAAsC;AACtC,kJAAkJ;AAClJ,MAAM,CAAC,MAAM,kBAAkB,GAAG,6CAA6C,CAAC;AAShF;;GAEG;AACH,MAAe,qBAAqB;IAKlC,YAAY,KAAa;QACvB,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC;IAC7B,CAAC;IAID,MAAM,CAAC,IAAqB;QAC1B,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,IAAI,WAAW,CACnB,gCAAgC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,GAAG,aAAa,CACpE,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,KAAK,IAAI,CAAC,aAAa,EAAE,CAAC;YACpC,MAAM,IAAI,WAAW,CACnB,iBAAiB,IAAI,CAAC,IAAI,kBAAkB;gBAC5C,SAAS,QAAQ,gBAAgB,IAAI,CAAC,aAAa,IAAI,CACxD,CAAC;QACJ,CAAC;IACH,CAAC;CACF;AAED;;;GAGG;AACH,MAAe,qBAAsB,SAAQ,qBAAqB;CAAG;AAErE,+EAA+E;AAC/E,4EAA4E;AAC5E,+EAA+E;AAE/E;;;GAGG;AACH,MAAM,OAAO,UAAW,SAAQ,qBAAqB;IAArD;;QACW,QAAG,GAAG,8BAA8B,CAAC;QACrC,SAAI,GAAG,YAAY,CAAC;IAK/B,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACxC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,qBAAsB,SAAQ,qBAAqB;IAAhE;;QACW,QAAG,GAAG,qCAAqC,CAAC;QAC5C,SAAI,GAAG,uBAAuB,CAAC;IAK1C,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,wBAAwB,EAAE,eAAe,CAAC;IACxD,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,iBAAkB,SAAQ,qBAAqB;IAA5D;;QACW,QAAG,GAAG,iCAAiC,CAAC;QACxC,SAAI,GAAG,mBAAmB,CAAC;IAKtC,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,oBAAoB,EAAE,WAAW,CAAC;IAChD,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,kBAAmB,SAAQ,qBAAqB;IAA7D;;QACW,QAAG,GAAG,kCAAkC,CAAC;QACzC,SAAI,GAAG,oBAAoB,CAAC;IAKvC,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,qBAAqB,EAAE,YAAY,CAAC;IAClD,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,wBAAyB,SAAQ,qBAAqB;IAAnE;;QACW,QAAG,GAAG,wCAAwC,CAAC;QAC/C,SAAI,GAAG,0BAA0B,CAAC;IAK7C,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,2BAA2B,EAAE,kBAAkB,CAAC;IAC9D,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,iBAAkB,SAAQ,qBAAqB;IAA5D;;QACW,QAAG,GAAG,iCAAiC,CAAC;QACxC,SAAI,GAAG,mBAAmB,CAAC;IAKtC,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,oBAAoB,EAAE,WAAW,CAAC;IAChD,CAAC;CACF;AAED,+EAA+E;AAC/E,6EAA6E;AAC7E,+EAA+E;AAE/E;;;GAGG;AACH,MAAM,OAAO,YAAa,SAAQ,qBAAqB;IAAvD;;QACW,QAAG,GAAG,8BAA8B,CAAC;QACrC,SAAI,GAAG,cAAc,CAAC;IAKjC,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACxC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,kBAAmB,SAAQ,qBAAqB;IAA7D;;QACW,QAAG,GAAG,8BAA8B,CAAC;QACrC,SAAI,GAAG,oBAAoB,CAAC;IAKvC,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,iBAAiB,EAAE,cAAc,CAAC;IAChD,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,qBAAsB,SAAQ,qBAAqB;IAAhE;;QACW,QAAG,GAAG,iCAAiC,CAAC;QACxC,SAAI,GAAG,uBAAuB,CAAC;IAK1C,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,oBAAoB,EAAE,iBAAiB,CAAC;IACtD,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,qBAAsB,SAAQ,qBAAqB;IAAhE;;QACW,QAAG,GAAG,gCAAgC,CAAC;QACvC,SAAI,GAAG,uBAAuB,CAAC;IAK1C,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,oBAAoB,EAAE,iBAAiB,CAAC;IACtD,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,uBAAwB,SAAQ,qBAAqB;IAAlE;;QACW,QAAG,GAAG,mCAAmC,CAAC;QAC1C,SAAI,GAAG,yBAAyB,CAAC;IAK5C,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,sBAAsB,EAAE,mBAAmB,CAAC;IAC1D,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,0BAA2B,SAAQ,qBAAqB;IAArE;;QACW,QAAG,GAAG,sCAAsC,CAAC;QAC7C,SAAI,GAAG,4BAA4B,CAAC;IAK/C,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,yBAAyB,EAAE,sBAAsB,CAAC;IAChE,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,uBAAwB,SAAQ,qBAAqB;IAAlE;;QACW,QAAG,GAAG,mCAAmC,CAAC;QAC1C,SAAI,GAAG,yBAAyB,CAAC;IAK5C,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,sBAAsB,EAAE,mBAAmB,CAAC;IAC1D,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,8BAA+B,SAAQ,qBAAqB;IAAzE;;QACW,QAAG,GAAG,0CAA0C,CAAC;QACjD,SAAI,GAAG,gCAAgC,CAAC;IAKnD,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,6BAA6B,EAAE,0BAA0B,CAAC;IACxE,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,4BAA6B,SAAQ,qBAAqB;IAAvE;;QACW,QAAG,GAAG,yCAAyC,CAAC;QAChD,SAAI,GAAG,8BAA8B,CAAC;IAKjD,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,2BAA2B,EAAE,wBAAwB,CAAC;IACpE,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,mCAAoC,SAAQ,qBAAqB;IAA9E;;QACW,QAAG,GAAG,gDAAgD,CAAC;QACvD,SAAI,GAAG,qCAAqC,CAAC;IAKxD,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,kCAAkC,EAAE,+BAA+B,CAAC;IAClF,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,kBAAmB,SAAQ,qBAAqB;IAA7D;;QACW,QAAG,GAAG,8BAA8B,CAAC;QACrC,SAAI,GAAG,oBAAoB,CAAC;IAKvC,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,iBAAiB,EAAE,cAAc,CAAC;IAChD,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,qBAAsB,SAAQ,qBAAqB;IAAhE;;QACW,QAAG,GAAG,iCAAiC,CAAC;QACxC,SAAI,GAAG,uBAAuB,CAAC;IAK1C,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,oBAAoB,EAAE,iBAAiB,CAAC;IACtD,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,gBAAiB,SAAQ,qBAAqB;IAA3D;;QACW,QAAG,GAAG,2BAA2B,CAAC;QAClC,SAAI,GAAG,kBAAkB,CAAC;IAKrC,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,eAAe,EAAE,YAAY,CAAC;IAC5C,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,oBAAqB,SAAQ,qBAAqB;IAA/D;;QACW,QAAG,GAAG,gCAAgC,CAAC;QACvC,SAAI,GAAG,sBAAsB,CAAC;IAKzC,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,mBAAmB,EAAE,gBAAgB,CAAC;IACpD,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,8BAA+B,SAAQ,qBAAqB;IAAzE;;QACW,QAAG,GAAG,0CAA0C,CAAC;QACjD,SAAI,GAAG,gCAAgC,CAAC;IAKnD,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,6BAA6B,EAAE,0BAA0B,CAAC;IACxE,CAAC;CACF;AAED,+EAA+E;AAC/E,qBAAqB;AACrB,+EAA+E;AAE/E;;;GAGG;AACH,MAAM,OAAO,KAAK;IAGhB,YAAY,QAA8B;QACxC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAqB;QAChC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClC,IAAI,CAAC;gBACH,MAAM,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBACzB,OAAO;YACT,CAAC;YAAC,MAAM,CAAC;gBACP,0BAA0B;YAC5B,CAAC;QACH,CAAC;QACD,MAAM,IAAI,WAAW,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,MAAM,qBAAqB,CAAC,CAAC;IAC3E,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,KAAK;IAGhB,YAAY,QAA8B;QACxC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAqB;QAChC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,WAAW,CAAC,6BAA6B,CAAC,CAAC;QACvD,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClC,MAAM,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;CACF;AAED,+EAA+E;AAC/E,kBAAkB;AAClB,+EAA+E;AAE/E;;;;;;;GAOG;AACH,MAAM,OAAO,QAAQ;IAInB,YAAY,OAA8C;QACxD,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7E,CAAC;IAED,MAAM,CAAC,IAAqB;QAC1B,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACjC,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC;QACtC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,WAAW,CAAC,+DAA+D,CAAC,CAAC;QACzF,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAElC,yBAAyB;QACzB,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YACtB,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACjC,CAAC;QAED,UAAU;QACV,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;YACf,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;QAED,kCAAkC;QAClC,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAC;QAC5D,IAAI,SAAS,EAAE,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACzB,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,WAAW,CACnB,mCAAmC,IAAI,CAAC,QAAQ,kBAAkB,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACnG,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EACL,iCAAiC,EACjC,8BAA8B,EAC9B,iCAAiC,EACjC,8BAA8B,EAC9B,2BAA2B,EAC3B,8BAA8B,EAC9B,8BAA8B,EAC9B,kCAAkC,EAClC,iCAAiC,EACjC,wCAAwC,EACxC,iCAAiC,EACjC,qCAAqC,EACrC,uBAAuB,EACvB,gCAAgC,EAChC,gCAAgC,EAChC,sCAAsC,EACtC,0CAA0C,EAC1C,gDAAgD,EAChD,yCAAyC,EACzC,mCAAmC,EACnC,mCAAmC,EACnC,0CAA0C,GAE3C,MAAM,gBAAgB,CAAC;AAExB,sCAAsC;AACtC,kJAAkJ;AAClJ,MAAM,CAAC,MAAM,kBAAkB,GAAG,6CAA6C,CAAC;AAShF;;GAEG;AACH,MAAe,qBAAqB;IAKlC,YAAY,KAAa;QACvB,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC;IAC7B,CAAC;IAID,MAAM,CAAC,IAAqB;QAC1B,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,IAAI,WAAW,CACnB,gCAAgC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,GAAG,aAAa,CACpE,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,KAAK,IAAI,CAAC,aAAa,EAAE,CAAC;YACpC,MAAM,IAAI,WAAW,CACnB,iBAAiB,IAAI,CAAC,IAAI,kBAAkB;gBAC5C,SAAS,QAAQ,gBAAgB,IAAI,CAAC,aAAa,IAAI,CACxD,CAAC;QACJ,CAAC;IACH,CAAC;CACF;AAED;;;GAGG;AACH,MAAe,qBAAsB,SAAQ,qBAAqB;CAAG;AAErE,+EAA+E;AAC/E,4EAA4E;AAC5E,+EAA+E;AAE/E;;;GAGG;AACH,MAAM,OAAO,UAAW,SAAQ,qBAAqB;IAArD;;QACW,QAAG,GAAG,8BAA8B,CAAC;QACrC,SAAI,GAAG,YAAY,CAAC;IAK/B,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACxC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,qBAAsB,SAAQ,qBAAqB;IAAhE;;QACW,QAAG,GAAG,qCAAqC,CAAC;QAC5C,SAAI,GAAG,uBAAuB,CAAC;IAK1C,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,wBAAwB,EAAE,eAAe,CAAC;IACxD,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,iBAAkB,SAAQ,qBAAqB;IAA5D;;QACW,QAAG,GAAG,iCAAiC,CAAC;QACxC,SAAI,GAAG,mBAAmB,CAAC;IAKtC,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,oBAAoB,EAAE,WAAW,CAAC;IAChD,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,kBAAmB,SAAQ,qBAAqB;IAA7D;;QACW,QAAG,GAAG,kCAAkC,CAAC;QACzC,SAAI,GAAG,oBAAoB,CAAC;IAKvC,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,qBAAqB,EAAE,YAAY,CAAC;IAClD,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,wBAAyB,SAAQ,qBAAqB;IAAnE;;QACW,QAAG,GAAG,wCAAwC,CAAC;QAC/C,SAAI,GAAG,0BAA0B,CAAC;IAK7C,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,2BAA2B,EAAE,kBAAkB,CAAC;IAC9D,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,iBAAkB,SAAQ,qBAAqB;IAA5D;;QACW,QAAG,GAAG,iCAAiC,CAAC;QACxC,SAAI,GAAG,mBAAmB,CAAC;IAKtC,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,oBAAoB,EAAE,WAAW,CAAC;IAChD,CAAC;CACF;AAED,+EAA+E;AAC/E,6EAA6E;AAC7E,+EAA+E;AAE/E;;;GAGG;AACH,MAAM,OAAO,YAAa,SAAQ,qBAAqB;IAAvD;;QACW,QAAG,GAAG,8BAA8B,CAAC;QACrC,SAAI,GAAG,cAAc,CAAC;IAKjC,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACxC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,kBAAmB,SAAQ,qBAAqB;IAA7D;;QACW,QAAG,GAAG,8BAA8B,CAAC;QACrC,SAAI,GAAG,oBAAoB,CAAC;IAKvC,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,iBAAiB,EAAE,cAAc,CAAC;IAChD,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,qBAAsB,SAAQ,qBAAqB;IAAhE;;QACW,QAAG,GAAG,iCAAiC,CAAC;QACxC,SAAI,GAAG,uBAAuB,CAAC;IAK1C,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,oBAAoB,EAAE,iBAAiB,CAAC;IACtD,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,qBAAsB,SAAQ,qBAAqB;IAAhE;;QACW,QAAG,GAAG,gCAAgC,CAAC;QACvC,SAAI,GAAG,uBAAuB,CAAC;IAK1C,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,oBAAoB,EAAE,iBAAiB,CAAC;IACtD,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,uBAAwB,SAAQ,qBAAqB;IAAlE;;QACW,QAAG,GAAG,mCAAmC,CAAC;QAC1C,SAAI,GAAG,yBAAyB,CAAC;IAK5C,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,sBAAsB,EAAE,mBAAmB,CAAC;IAC1D,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,0BAA2B,SAAQ,qBAAqB;IAArE;;QACW,QAAG,GAAG,sCAAsC,CAAC;QAC7C,SAAI,GAAG,4BAA4B,CAAC;IAK/C,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,yBAAyB,EAAE,sBAAsB,CAAC;IAChE,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,uBAAwB,SAAQ,qBAAqB;IAAlE;;QACW,QAAG,GAAG,mCAAmC,CAAC;QAC1C,SAAI,GAAG,yBAAyB,CAAC;IAK5C,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,sBAAsB,EAAE,mBAAmB,CAAC;IAC1D,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,8BAA+B,SAAQ,qBAAqB;IAAzE;;QACW,QAAG,GAAG,0CAA0C,CAAC;QACjD,SAAI,GAAG,gCAAgC,CAAC;IAKnD,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,6BAA6B,EAAE,0BAA0B,CAAC;IACxE,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,4BAA6B,SAAQ,qBAAqB;IAAvE;;QACW,QAAG,GAAG,yCAAyC,CAAC;QAChD,SAAI,GAAG,8BAA8B,CAAC;IAKjD,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,2BAA2B,EAAE,wBAAwB,CAAC;IACpE,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,mCAAoC,SAAQ,qBAAqB;IAA9E;;QACW,QAAG,GAAG,gDAAgD,CAAC;QACvD,SAAI,GAAG,qCAAqC,CAAC;IAKxD,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,kCAAkC,EAAE,+BAA+B,CAAC;IAClF,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,kBAAmB,SAAQ,qBAAqB;IAA7D;;QACW,QAAG,GAAG,8BAA8B,CAAC;QACrC,SAAI,GAAG,oBAAoB,CAAC;IAKvC,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,iBAAiB,EAAE,cAAc,CAAC;IAChD,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,qBAAsB,SAAQ,qBAAqB;IAAhE;;QACW,QAAG,GAAG,iCAAiC,CAAC;QACxC,SAAI,GAAG,uBAAuB,CAAC;IAK1C,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,oBAAoB,EAAE,iBAAiB,CAAC;IACtD,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,gBAAiB,SAAQ,qBAAqB;IAA3D;;QACW,QAAG,GAAG,2BAA2B,CAAC;QAClC,SAAI,GAAG,kBAAkB,CAAC;IAKrC,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,eAAe,EAAE,YAAY,CAAC;IAC5C,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,oBAAqB,SAAQ,qBAAqB;IAA/D;;QACW,QAAG,GAAG,gCAAgC,CAAC;QACvC,SAAI,GAAG,sBAAsB,CAAC;IAKzC,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,mBAAmB,EAAE,gBAAgB,CAAC;IACpD,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,8BAA+B,SAAQ,qBAAqB;IAAzE;;QACW,QAAG,GAAG,0CAA0C,CAAC;QACjD,SAAI,GAAG,gCAAgC,CAAC;IAKnD,CAAC;IAHW,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,6BAA6B,EAAE,0BAA0B,CAAC;IACxE,CAAC;CACF;AAED,+EAA+E;AAC/E,qBAAqB;AACrB,+EAA+E;AAE/E;;;GAGG;AACH,MAAM,OAAO,KAAK;IAGhB,YAAY,QAA8B;QACxC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAqB;QAChC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClC,IAAI,CAAC;gBACH,MAAM,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBACzB,OAAO;YACT,CAAC;YAAC,MAAM,CAAC;gBACP,0BAA0B;YAC5B,CAAC;QACH,CAAC;QACD,MAAM,IAAI,WAAW,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,MAAM,qBAAqB,CAAC,CAAC;IAC3E,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,KAAK;IAGhB,YAAY,QAA8B;QACxC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAqB;QAChC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,WAAW,CAAC,6BAA6B,CAAC,CAAC;QACvD,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClC,MAAM,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;CACF;AAED,+EAA+E;AAC/E,kBAAkB;AAClB,+EAA+E;AAE/E;;;;;;;GAOG;AACH,MAAM,OAAO,QAAQ;IAInB,YAAY,OAA8C;QACxD,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7E,CAAC;IAED,MAAM,CAAC,IAAqB;QAC1B,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACjC,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC;QACtC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,WAAW,CAAC,+DAA+D,CAAC,CAAC;QACzF,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAElC,yBAAyB;QACzB,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YACtB,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACjC,CAAC;QAED,UAAU;QACV,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;YACf,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;QAED,kCAAkC;QAClC,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAC;QAC5D,IAAI,SAAS,EAAE,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACzB,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,WAAW,CACnB,mCAAmC,IAAI,CAAC,QAAQ,kBAAkB,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACnG,CAAC;QACJ,CAAC;IACH,CAAC;CACF","sourcesContent":["/**\n * Adapted from sigstore-python sigstore/verify/policy.py\n *\n * This module provides policy verification for checking certificate identity claims.\n * Each policy class verifies a specific X.509 extension value against an expected value.\n *\n * There are two types of extension formats:\n * - V1 extensions: Raw OCTET STRING containing the value directly\n * - V2 extensions: DER-encoded UTF8String (RFC 5280 compliant)\n *\n * Policies can be combined using:\n * - AllOf: All child policies must pass (logical AND)\n * - AnyOf: At least one child policy must pass (logical OR)\n * - Identity: Verifies SAN with optional issuer check\n */\n\nimport { PolicyError } from \"./errors.js\";\nimport {\n  EXTENSION_OID_BUILD_CONFIG_DIGEST,\n  EXTENSION_OID_BUILD_CONFIG_URI,\n  EXTENSION_OID_BUILD_SIGNER_DIGEST,\n  EXTENSION_OID_BUILD_SIGNER_URI,\n  EXTENSION_OID_BUILD_TRIGGER,\n  EXTENSION_OID_FULCIO_ISSUER_V1,\n  EXTENSION_OID_FULCIO_ISSUER_V2,\n  EXTENSION_OID_GITHUB_WORKFLOW_NAME,\n  EXTENSION_OID_GITHUB_WORKFLOW_REF,\n  EXTENSION_OID_GITHUB_WORKFLOW_REPOSITORY,\n  EXTENSION_OID_GITHUB_WORKFLOW_SHA,\n  EXTENSION_OID_GITHUB_WORKFLOW_TRIGGER,\n  EXTENSION_OID_OTHERNAME,\n  EXTENSION_OID_RUN_INVOCATION_URI,\n  EXTENSION_OID_RUNNER_ENVIRONMENT,\n  EXTENSION_OID_SOURCE_REPOSITORY_DIGEST,\n  EXTENSION_OID_SOURCE_REPOSITORY_IDENTIFIER,\n  EXTENSION_OID_SOURCE_REPOSITORY_OWNER_IDENTIFIER,\n  EXTENSION_OID_SOURCE_REPOSITORY_OWNER_URI,\n  EXTENSION_OID_SOURCE_REPOSITORY_REF,\n  EXTENSION_OID_SOURCE_REPOSITORY_URI,\n  EXTENSION_OID_SOURCE_REPOSITORY_VISIBILITY,\n  X509Certificate,\n} from \"./x509/cert.js\";\n\n// Standard GitHub Actions OIDC issuer\n// https://docs.github.com/en/actions/security-for-github-actions/security-hardening-your-deployments/about-security-hardening-with-openid-connect\nexport const GITHUB_OIDC_ISSUER = \"https://token.actions.githubusercontent.com\";\n\n/**\n * Interface that all verification policies conform to.\n */\nexport interface VerificationPolicy {\n  verify(cert: X509Certificate): void | Promise<void>;\n}\n\n/**\n * Base class for V1 extension policies (raw OCTET STRING value).\n */\nabstract class SingleX509ExtPolicyV1 implements VerificationPolicy {\n  abstract readonly oid: string;\n  abstract readonly name: string;\n  protected readonly expectedValue: string;\n\n  constructor(value: string) {\n    this.expectedValue = value;\n  }\n\n  protected abstract getExtensionValue(cert: X509Certificate): string | undefined;\n\n  verify(cert: X509Certificate): void {\n    const extValue = this.getExtensionValue(cert);\n    if (extValue === undefined) {\n      throw new PolicyError(\n        `Certificate does not contain ${this.name} (${this.oid}) extension`\n      );\n    }\n    if (extValue !== this.expectedValue) {\n      throw new PolicyError(\n        `Certificate's ${this.name} does not match ` +\n        `(got '${extValue}', expected '${this.expectedValue}')`\n      );\n    }\n  }\n}\n\n/**\n * Base class for V2 extension policies (DER-encoded UTF8String).\n * Uses the same verify logic as V1 since our extension classes handle the parsing.\n */\nabstract class SingleX509ExtPolicyV2 extends SingleX509ExtPolicyV1 {}\n\n// ============================================================================\n// V1 Extension Policies (OID 1.3.6.1.4.1.57264.1.1 - 1.3.6.1.4.1.57264.1.6)\n// ============================================================================\n\n/**\n * Verifies the certificate's OIDC issuer (V1 format).\n * OID: 1.3.6.1.4.1.57264.1.1\n */\nexport class OIDCIssuer extends SingleX509ExtPolicyV1 {\n  readonly oid = EXTENSION_OID_FULCIO_ISSUER_V1;\n  readonly name = \"OIDCIssuer\";\n\n  protected getExtensionValue(cert: X509Certificate): string | undefined {\n    return cert.extFulcioIssuerV1?.issuer;\n  }\n}\n\n/**\n * Verifies the certificate's GitHub Actions workflow trigger.\n * OID: 1.3.6.1.4.1.57264.1.2\n */\nexport class GitHubWorkflowTrigger extends SingleX509ExtPolicyV1 {\n  readonly oid = EXTENSION_OID_GITHUB_WORKFLOW_TRIGGER;\n  readonly name = \"GitHubWorkflowTrigger\";\n\n  protected getExtensionValue(cert: X509Certificate): string | undefined {\n    return cert.extGitHubWorkflowTrigger?.workflowTrigger;\n  }\n}\n\n/**\n * Verifies the certificate's GitHub Actions workflow commit SHA.\n * OID: 1.3.6.1.4.1.57264.1.3\n */\nexport class GitHubWorkflowSHA extends SingleX509ExtPolicyV1 {\n  readonly oid = EXTENSION_OID_GITHUB_WORKFLOW_SHA;\n  readonly name = \"GitHubWorkflowSHA\";\n\n  protected getExtensionValue(cert: X509Certificate): string | undefined {\n    return cert.extGitHubWorkflowSHA?.workflowSHA;\n  }\n}\n\n/**\n * Verifies the certificate's GitHub Actions workflow name.\n * OID: 1.3.6.1.4.1.57264.1.4\n */\nexport class GitHubWorkflowName extends SingleX509ExtPolicyV1 {\n  readonly oid = EXTENSION_OID_GITHUB_WORKFLOW_NAME;\n  readonly name = \"GitHubWorkflowName\";\n\n  protected getExtensionValue(cert: X509Certificate): string | undefined {\n    return cert.extGitHubWorkflowName?.workflowName;\n  }\n}\n\n/**\n * Verifies the certificate's GitHub Actions workflow repository.\n * OID: 1.3.6.1.4.1.57264.1.5\n */\nexport class GitHubWorkflowRepository extends SingleX509ExtPolicyV1 {\n  readonly oid = EXTENSION_OID_GITHUB_WORKFLOW_REPOSITORY;\n  readonly name = \"GitHubWorkflowRepository\";\n\n  protected getExtensionValue(cert: X509Certificate): string | undefined {\n    return cert.extGitHubWorkflowRepository?.workflowRepository;\n  }\n}\n\n/**\n * Verifies the certificate's GitHub Actions workflow ref.\n * OID: 1.3.6.1.4.1.57264.1.6\n */\nexport class GitHubWorkflowRef extends SingleX509ExtPolicyV1 {\n  readonly oid = EXTENSION_OID_GITHUB_WORKFLOW_REF;\n  readonly name = \"GitHubWorkflowRef\";\n\n  protected getExtensionValue(cert: X509Certificate): string | undefined {\n    return cert.extGitHubWorkflowRef?.workflowRef;\n  }\n}\n\n// ============================================================================\n// V2 Extension Policies (OID 1.3.6.1.4.1.57264.1.8 - 1.3.6.1.4.1.57264.1.22)\n// ============================================================================\n\n/**\n * Verifies the certificate's OIDC issuer (V2 format, DER-encoded).\n * OID: 1.3.6.1.4.1.57264.1.8\n */\nexport class OIDCIssuerV2 extends SingleX509ExtPolicyV2 {\n  readonly oid = EXTENSION_OID_FULCIO_ISSUER_V2;\n  readonly name = \"OIDCIssuerV2\";\n\n  protected getExtensionValue(cert: X509Certificate): string | undefined {\n    return cert.extFulcioIssuerV2?.issuer;\n  }\n}\n\n/**\n * Verifies the certificate's Build Signer URI.\n * OID: 1.3.6.1.4.1.57264.1.9\n */\nexport class OIDCBuildSignerURI extends SingleX509ExtPolicyV2 {\n  readonly oid = EXTENSION_OID_BUILD_SIGNER_URI;\n  readonly name = \"OIDCBuildSignerURI\";\n\n  protected getExtensionValue(cert: X509Certificate): string | undefined {\n    return cert.extBuildSignerURI?.buildSignerURI;\n  }\n}\n\n/**\n * Verifies the certificate's Build Signer Digest.\n * OID: 1.3.6.1.4.1.57264.1.10\n */\nexport class OIDCBuildSignerDigest extends SingleX509ExtPolicyV2 {\n  readonly oid = EXTENSION_OID_BUILD_SIGNER_DIGEST;\n  readonly name = \"OIDCBuildSignerDigest\";\n\n  protected getExtensionValue(cert: X509Certificate): string | undefined {\n    return cert.extBuildSignerDigest?.buildSignerDigest;\n  }\n}\n\n/**\n * Verifies the certificate's Runner Environment.\n * OID: 1.3.6.1.4.1.57264.1.11\n */\nexport class OIDCRunnerEnvironment extends SingleX509ExtPolicyV2 {\n  readonly oid = EXTENSION_OID_RUNNER_ENVIRONMENT;\n  readonly name = \"OIDCRunnerEnvironment\";\n\n  protected getExtensionValue(cert: X509Certificate): string | undefined {\n    return cert.extRunnerEnvironment?.runnerEnvironment;\n  }\n}\n\n/**\n * Verifies the certificate's Source Repository URI.\n * OID: 1.3.6.1.4.1.57264.1.12\n */\nexport class OIDCSourceRepositoryURI extends SingleX509ExtPolicyV2 {\n  readonly oid = EXTENSION_OID_SOURCE_REPOSITORY_URI;\n  readonly name = \"OIDCSourceRepositoryURI\";\n\n  protected getExtensionValue(cert: X509Certificate): string | undefined {\n    return cert.extSourceRepositoryURI?.sourceRepositoryURI;\n  }\n}\n\n/**\n * Verifies the certificate's Source Repository Digest.\n * OID: 1.3.6.1.4.1.57264.1.13\n */\nexport class OIDCSourceRepositoryDigest extends SingleX509ExtPolicyV2 {\n  readonly oid = EXTENSION_OID_SOURCE_REPOSITORY_DIGEST;\n  readonly name = \"OIDCSourceRepositoryDigest\";\n\n  protected getExtensionValue(cert: X509Certificate): string | undefined {\n    return cert.extSourceRepositoryDigest?.sourceRepositoryDigest;\n  }\n}\n\n/**\n * Verifies the certificate's Source Repository Ref.\n * OID: 1.3.6.1.4.1.57264.1.14\n */\nexport class OIDCSourceRepositoryRef extends SingleX509ExtPolicyV2 {\n  readonly oid = EXTENSION_OID_SOURCE_REPOSITORY_REF;\n  readonly name = \"OIDCSourceRepositoryRef\";\n\n  protected getExtensionValue(cert: X509Certificate): string | undefined {\n    return cert.extSourceRepositoryRef?.sourceRepositoryRef;\n  }\n}\n\n/**\n * Verifies the certificate's Source Repository Identifier.\n * OID: 1.3.6.1.4.1.57264.1.15\n */\nexport class OIDCSourceRepositoryIdentifier extends SingleX509ExtPolicyV2 {\n  readonly oid = EXTENSION_OID_SOURCE_REPOSITORY_IDENTIFIER;\n  readonly name = \"OIDCSourceRepositoryIdentifier\";\n\n  protected getExtensionValue(cert: X509Certificate): string | undefined {\n    return cert.extSourceRepositoryIdentifier?.sourceRepositoryIdentifier;\n  }\n}\n\n/**\n * Verifies the certificate's Source Repository Owner URI.\n * OID: 1.3.6.1.4.1.57264.1.16\n */\nexport class OIDCSourceRepositoryOwnerURI extends SingleX509ExtPolicyV2 {\n  readonly oid = EXTENSION_OID_SOURCE_REPOSITORY_OWNER_URI;\n  readonly name = \"OIDCSourceRepositoryOwnerURI\";\n\n  protected getExtensionValue(cert: X509Certificate): string | undefined {\n    return cert.extSourceRepositoryOwnerURI?.sourceRepositoryOwnerURI;\n  }\n}\n\n/**\n * Verifies the certificate's Source Repository Owner Identifier.\n * OID: 1.3.6.1.4.1.57264.1.17\n */\nexport class OIDCSourceRepositoryOwnerIdentifier extends SingleX509ExtPolicyV2 {\n  readonly oid = EXTENSION_OID_SOURCE_REPOSITORY_OWNER_IDENTIFIER;\n  readonly name = \"OIDCSourceRepositoryOwnerIdentifier\";\n\n  protected getExtensionValue(cert: X509Certificate): string | undefined {\n    return cert.extSourceRepositoryOwnerIdentifier?.sourceRepositoryOwnerIdentifier;\n  }\n}\n\n/**\n * Verifies the certificate's Build Config URI.\n * OID: 1.3.6.1.4.1.57264.1.18\n */\nexport class OIDCBuildConfigURI extends SingleX509ExtPolicyV2 {\n  readonly oid = EXTENSION_OID_BUILD_CONFIG_URI;\n  readonly name = \"OIDCBuildConfigURI\";\n\n  protected getExtensionValue(cert: X509Certificate): string | undefined {\n    return cert.extBuildConfigURI?.buildConfigURI;\n  }\n}\n\n/**\n * Verifies the certificate's Build Config Digest.\n * OID: 1.3.6.1.4.1.57264.1.19\n */\nexport class OIDCBuildConfigDigest extends SingleX509ExtPolicyV2 {\n  readonly oid = EXTENSION_OID_BUILD_CONFIG_DIGEST;\n  readonly name = \"OIDCBuildConfigDigest\";\n\n  protected getExtensionValue(cert: X509Certificate): string | undefined {\n    return cert.extBuildConfigDigest?.buildConfigDigest;\n  }\n}\n\n/**\n * Verifies the certificate's Build Trigger.\n * OID: 1.3.6.1.4.1.57264.1.20\n */\nexport class OIDCBuildTrigger extends SingleX509ExtPolicyV2 {\n  readonly oid = EXTENSION_OID_BUILD_TRIGGER;\n  readonly name = \"OIDCBuildTrigger\";\n\n  protected getExtensionValue(cert: X509Certificate): string | undefined {\n    return cert.extBuildTrigger?.buildTrigger;\n  }\n}\n\n/**\n * Verifies the certificate's Run Invocation URI.\n * OID: 1.3.6.1.4.1.57264.1.21\n */\nexport class OIDCRunInvocationURI extends SingleX509ExtPolicyV2 {\n  readonly oid = EXTENSION_OID_RUN_INVOCATION_URI;\n  readonly name = \"OIDCRunInvocationURI\";\n\n  protected getExtensionValue(cert: X509Certificate): string | undefined {\n    return cert.extRunInvocationURI?.runInvocationURI;\n  }\n}\n\n/**\n * Verifies the certificate's Source Repository Visibility at signing.\n * OID: 1.3.6.1.4.1.57264.1.22\n */\nexport class OIDCSourceRepositoryVisibility extends SingleX509ExtPolicyV2 {\n  readonly oid = EXTENSION_OID_SOURCE_REPOSITORY_VISIBILITY;\n  readonly name = \"OIDCSourceRepositoryVisibility\";\n\n  protected getExtensionValue(cert: X509Certificate): string | undefined {\n    return cert.extSourceRepositoryVisibility?.sourceRepositoryVisibility;\n  }\n}\n\n// ============================================================================\n// Policy Combinators\n// ============================================================================\n\n/**\n * The \"any of\" policy, corresponding to a logical OR between child policies.\n * An empty list of child policies is considered trivially invalid.\n */\nexport class AnyOf implements VerificationPolicy {\n  private children: VerificationPolicy[];\n\n  constructor(children: VerificationPolicy[]) {\n    this.children = children;\n  }\n\n  async verify(cert: X509Certificate): Promise<void> {\n    for (const child of this.children) {\n      try {\n        await child.verify(cert);\n        return;\n      } catch {\n        // Continue to next policy\n      }\n    }\n    throw new PolicyError(`0 of ${this.children.length} policies succeeded`);\n  }\n}\n\n/**\n * The \"all of\" policy, corresponding to a logical AND between child policies.\n * An empty list of child policies is considered trivially invalid.\n */\nexport class AllOf implements VerificationPolicy {\n  private children: VerificationPolicy[];\n\n  constructor(children: VerificationPolicy[]) {\n    this.children = children;\n  }\n\n  async verify(cert: X509Certificate): Promise<void> {\n    if (this.children.length < 1) {\n      throw new PolicyError(\"no child policies to verify\");\n    }\n    for (const child of this.children) {\n      await child.verify(cert);\n    }\n  }\n}\n\n// ============================================================================\n// Identity Policy\n// ============================================================================\n\n/**\n * Verifies the certificate's \"identity\", corresponding to the X.509v3 SAN.\n *\n * Identities can be verified modulo an OIDC issuer, to prevent an unexpected\n * issuer from offering a particular identity.\n *\n * Supported SAN types include emails, URIs, and Sigstore-specific \"other names\".\n */\nexport class Identity implements VerificationPolicy {\n  private identity: string;\n  private issuerPolicy: OIDCIssuer | null;\n\n  constructor(options: { identity: string; issuer?: string }) {\n    this.identity = options.identity;\n    this.issuerPolicy = options.issuer ? new OIDCIssuer(options.issuer) : null;\n  }\n\n  verify(cert: X509Certificate): void {\n    if (this.issuerPolicy) {\n      this.issuerPolicy.verify(cert);\n    }\n\n    const sanExt = cert.extSubjectAltName;\n    if (!sanExt) {\n      throw new PolicyError(\"Certificate does not contain SubjectAlternativeName extension\");\n    }\n\n    const allSans = new Set<string>();\n\n    // Add email (rfc822Name)\n    if (sanExt.rfc822Name) {\n      allSans.add(sanExt.rfc822Name);\n    }\n\n    // Add URI\n    if (sanExt.uri) {\n      allSans.add(sanExt.uri);\n    }\n\n    // Add Sigstore-specific otherName\n    const otherName = sanExt.otherName(EXTENSION_OID_OTHERNAME);\n    if (otherName) {\n      allSans.add(otherName);\n    }\n\n    if (!allSans.has(this.identity)) {\n      throw new PolicyError(\n        `Certificate's SANs do not match ${this.identity}; actual SANs: ${Array.from(allSans).join(\", \")}`\n      );\n    }\n  }\n}\n"]}

package/dist/rfc3161/error.d.ts

@@ -1,3 +1,2 @@
 export declare class RFC3161TimestampVerificationError extends Error {
 }
-//# sourceMappingURL=error.d.ts.map

package/dist/rfc3161/error.js.map

@@ -1 +1 @@
-{"version":3,"file":"error.js","sourceRoot":"","sources":["../../src/rfc3161/error.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;EAcE;AACF,MAAM,OAAO,iCAAkC,SAAQ,KAAK;CAAG"}
+{"version":3,"file":"error.js","sourceRoot":"","sources":["../../src/rfc3161/error.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;EAcE;AACF,MAAM,OAAO,iCAAkC,SAAQ,KAAK;CAAG","sourcesContent":["/*\nCopyright 2023 The Sigstore Authors.\n\nLicensed under the Apache License, Version 2.0 (the \"License\");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\n    http://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n*/\nexport class RFC3161TimestampVerificationError extends Error {}\n"]}

package/dist/rfc3161/index.d.ts

@@ -1,2 +1 @@
 export { RFC3161Timestamp } from "./timestamp.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/rfc3161/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/rfc3161/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;EAcE;AAEF,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/rfc3161/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;EAcE;AAEF,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC","sourcesContent":["/*\nCopyright 2023 The Sigstore Authors.\n\nLicensed under the Apache License, Version 2.0 (the \"License\");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\n    http://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n*/\n\nexport { RFC3161Timestamp } from \"./timestamp.js\";\n"]}

package/dist/rfc3161/timestamp.d.ts

@@ -33,4 +33,3 @@ export declare class RFC3161Timestamp {
     private get signatureAlgorithmObj();
     private get signatureValueObj();
 }
-//# sourceMappingURL=timestamp.d.ts.map

package/dist/rfc3161/timestamp.js

@@ -13,7 +13,7 @@ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
 limitations under the License.
 */
-import { ASN1Obj, uint8ArrayEqual, verifySignature } from "@freedomofpress/crypto-browser";
+import { ASN1Obj, digest, uint8ArrayEqual, verifySignature } from "@freedomofpress/crypto-browser";
 import { HashAlgorithms } from "../interfaces.js";
 import { ECDSA_SIGNATURE_ALGOS, RSA_SIGNATURE_ALGOS, SHA2_HASH_ALGOS } from "../oid.js";
 import { RFC3161TimestampVerificationError } from "./error.js";
@@ -93,9 +93,9 @@ export class RFC3161Timestamp {
         const hashAlgName = hashAlg === "sha256" ? HashAlgorithms.SHA256 :
             hashAlg === "sha384" ? HashAlgorithms.SHA384 :
                 hashAlg === "sha512" ? HashAlgorithms.SHA512 : hashAlg;
-        const tstInfoDigest = await crypto.subtle.digest(hashAlgName, this.tstInfo.raw);
+        const tstInfoDigest = await digest(hashAlgName, this.tstInfo.raw);
         const expectedDigest = this.messageDigestAttributeObj.subs[1].subs[0].value;
-        if (!uint8ArrayEqual(new Uint8Array(tstInfoDigest), expectedDigest)) {
+        if (!uint8ArrayEqual(tstInfoDigest, expectedDigest)) {
             throw new RFC3161TimestampVerificationError("signed data does not match tstInfo");
         }
     }

package/dist/rfc3161/timestamp.js.map

@@ -1 +1 @@
-{"version":3,"file":"timestamp.js","sourceRoot":"","sources":["../../src/rfc3161/timestamp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;EAcE;AACF,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAC3F,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AACxF,OAAO,EAAE,iCAAiC,EAAE,MAAM,YAAY,CAAC;AAC/D,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAEvC,MAAM,kCAAkC,GAAG,sBAAsB,CAAC;AAClE,MAAM,8BAA8B,GAAG,2BAA2B,CAAC;AACnE,MAAM,4BAA4B,GAAG,sBAAsB,CAAC;AAE5D,MAAM,OAAO,gBAAgB;IAG3B,YAAY,IAAa;QACvB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAEM,MAAM,CAAC,KAAK,CAAC,GAAe;QACjC,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACtC,OAAO,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;IAED,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;IACnD,CAAC;IAED,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;IACrC,CAAC;IAED,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;IACtC,CAAC;IAED,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;IAC9B,CAAC;IAED,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACzC,CAAC;IAED,IAAI,kBAAkB;QACpB,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACzC,CAAC;IAED,IAAI,qBAAqB;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;QAC1D,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,iCAAiC,GAAG,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,kBAAkB;QACpB,MAAM,GAAG,GAAG,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;QACvD,MAAM,IAAI,GAAG,qBAAqB,CAAC,GAAG,CAAC,IAAI,mBAAmB,CAAC,GAAG,CAAC,CAAC;QACpE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,cAAc;QAChB,OAAO,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC;IACtC,CAAC;IAED,IAAI,OAAO;QACT,8CAA8C;QAC9C,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACvD,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,IAAgB,EAAE,SAAoB;QACxD,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC5B,MAAM,IAAI,iCAAiC,CAAC,2BAA2B,CAAC,CAAC;QAC3E,CAAC;QAED,8CAA8C;QAC9C,IAAI,IAAI,CAAC,WAAW,KAAK,kCAAkC,EAAE,CAAC;YAC5D,MAAM,IAAI,iCAAiC,CACzC,2BAA2B,IAAI,CAAC,WAAW,EAAE,CAC9C,CAAC;QACJ,CAAC;QAED,+CAA+C;QAC/C,IAAI,IAAI,CAAC,YAAY,KAAK,8BAA8B,EAAE,CAAC;YACzD,MAAM,IAAI,iCAAiC,CACzC,wCAAwC,IAAI,CAAC,YAAY,EAAE,CAC5D,CAAC;QACJ,CAAC;QAED,yDAAyD;QACzD,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAChC,2DAA2D;QAC3D,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACjC,8DAA8D;QAC9D,MAAM,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;IACxC,CAAC;IAEO,KAAK,CAAC,mBAAmB;QAC/B,iDAAiD;QACjD,MAAM,OAAO,GAAG,IAAI,CAAC,qBAAqB,CAAC;QAE3C,kEAAkE;QAClE,MAAM,WAAW,GAAG,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;YAC/C,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;gBAC9C,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;QAE1E,MAAM,aAAa,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAC9C,WAAW,EACX,IAAI,CAAC,OAAO,CAAC,GAAmB,CACjC,CAAC;QACF,MAAM,cAAc,GAAG,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAE5E,IAAI,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,aAAa,CAAC,EAAE,cAAc,CAAC,EAAE,CAAC;YACpE,MAAM,IAAI,iCAAiC,CACzC,oCAAoC,CACrC,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,eAAe,CAAC,GAAc;QAC1C,gDAAgD;QAChD,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;QAChD,WAAW,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,qCAAqC;QAE5D,MAAM,GAAG,GAAG,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;QACvD,8CAA8C;QAC9C,MAAM,IAAI,GAAG,qBAAqB,CAAC,GAAG,CAAC,IAAI,mBAAmB,CAAC,GAAG,CAAC,CAAC;QAEpE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,iCAAiC,CACzC,wCAAwC,GAAG,EAAE,CAC9C,CAAC;QACJ,CAAC;QAED,8DAA8D;QAC9D,MAAM,QAAQ,GAAG,MAAM,eAAe,CACpC,GAAG,EACH,WAAW,EACX,IAAI,CAAC,cAAc,EACnB,IAAI,CACL,CAAC;QAEF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,iCAAiC,CACzC,+BAA+B,CAChC,CAAC;QACJ,CAAC;IACH,CAAC;IAED,uDAAuD;IACvD,IAAY,gBAAgB;QAC1B,wEAAwE;QACxE,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;IAED,uDAAuD;IACvD,IAAY,iBAAiB;QAC3B,yEAAyE;QACzE,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;IAED,0DAA0D;IAC1D,IAAY,cAAc;QACxB,OAAO,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;IACD,mDAAmD;IACnD,IAAY,aAAa;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CACnD,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAChC,CAAC;QACF,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,iCAAiC,CACzC,gCAAgC,CACjC,CAAC;QACJ,CAAC;QACD,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC;IAED,4DAA4D;IAC5D,IAAY,mBAAmB;QAC7B,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpC,CAAC;IAED,4DAA4D;IAC5D,IAAY,cAAc;QACxB,8DAA8D;QAC9D,MAAM,EAAE,GAAG,IAAI,CAAC,aAAa,CAAC;QAC9B,OAAO,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACrC,CAAC;IAED,qDAAqD;IACrD,IAAY,aAAa;QACvB,6BAA6B;QAC7B,OAAO,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrC,CAAC;IAED,4DAA4D;IAC5D,IAAY,eAAe;QACzB,OAAO,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1C,CAAC;IAED,4DAA4D;IAC5D,IAAY,WAAW;QACrB,OAAO,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1C,CAAC;IAED,4DAA4D;IAC5D,IAAY,cAAc;QACxB,MAAM,WAAW,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CACvD,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAChC,CAAC;QACF,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,iCAAiC,CAAC,yBAAyB,CAAC,CAAC;QACzE,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,4DAA4D;IAC5D,IAAY,yBAAyB;QACnC,MAAM,aAAa,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CACjD,CAAC,GAAG,EAAE,EAAE,CACN,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE;YACvB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,4BAA4B,CACvD,CAAC;QACF,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,iCAAiC,CAAC,wBAAwB,CAAC,CAAC;QACxE,CAAC;QACD,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,4DAA4D;IAC5D,IAAY,YAAY;QACtB,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpC,CAAC;IAED,4DAA4D;IAC5D,IAAY,wBAAwB;QAClC,2DAA2D;QAC3D,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpC,CAAC;IAED,4DAA4D;IAC5D,IAAY,qBAAqB;QAC/B,2DAA2D;QAC3D,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpC,CAAC;IAED,4DAA4D;IAC5D,IAAY,iBAAiB;QAC3B,2DAA2D;QAC3D,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpC,CAAC;CACF"}
+{"version":3,"file":"timestamp.js","sourceRoot":"","sources":["../../src/rfc3161/timestamp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;EAcE;AACF,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAEnG,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AACxF,OAAO,EAAE,iCAAiC,EAAE,MAAM,YAAY,CAAC;AAC/D,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAEvC,MAAM,kCAAkC,GAAG,sBAAsB,CAAC;AAClE,MAAM,8BAA8B,GAAG,2BAA2B,CAAC;AACnE,MAAM,4BAA4B,GAAG,sBAAsB,CAAC;AAE5D,MAAM,OAAO,gBAAgB;IAG3B,YAAY,IAAa;QACvB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAEM,MAAM,CAAC,KAAK,CAAC,GAAe;QACjC,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACtC,OAAO,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;IAED,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;IACnD,CAAC;IAED,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;IACrC,CAAC;IAED,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;IACtC,CAAC;IAED,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;IAC9B,CAAC;IAED,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACzC,CAAC;IAED,IAAI,kBAAkB;QACpB,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACzC,CAAC;IAED,IAAI,qBAAqB;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;QAC1D,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,iCAAiC,GAAG,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,kBAAkB;QACpB,MAAM,GAAG,GAAG,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;QACvD,MAAM,IAAI,GAAG,qBAAqB,CAAC,GAAG,CAAC,IAAI,mBAAmB,CAAC,GAAG,CAAC,CAAC;QACpE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,cAAc;QAChB,OAAO,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC;IACtC,CAAC;IAED,IAAI,OAAO;QACT,8CAA8C;QAC9C,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACvD,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,IAAgB,EAAE,SAAoB;QACxD,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC5B,MAAM,IAAI,iCAAiC,CAAC,2BAA2B,CAAC,CAAC;QAC3E,CAAC;QAED,8CAA8C;QAC9C,IAAI,IAAI,CAAC,WAAW,KAAK,kCAAkC,EAAE,CAAC;YAC5D,MAAM,IAAI,iCAAiC,CACzC,2BAA2B,IAAI,CAAC,WAAW,EAAE,CAC9C,CAAC;QACJ,CAAC;QAED,+CAA+C;QAC/C,IAAI,IAAI,CAAC,YAAY,KAAK,8BAA8B,EAAE,CAAC;YACzD,MAAM,IAAI,iCAAiC,CACzC,wCAAwC,IAAI,CAAC,YAAY,EAAE,CAC5D,CAAC;QACJ,CAAC;QAED,yDAAyD;QACzD,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAChC,2DAA2D;QAC3D,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACjC,8DAA8D;QAC9D,MAAM,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;IACxC,CAAC;IAEO,KAAK,CAAC,mBAAmB;QAC/B,iDAAiD;QACjD,MAAM,OAAO,GAAG,IAAI,CAAC,qBAAqB,CAAC;QAE3C,kEAAkE;QAClE,MAAM,WAAW,GAAG,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;YAC/C,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;gBAC9C,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;QAE1E,MAAM,aAAa,GAAG,MAAM,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAClE,MAAM,cAAc,GAAG,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAE5E,IAAI,CAAC,eAAe,CAAC,aAAa,EAAE,cAAc,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,iCAAiC,CACzC,oCAAoC,CACrC,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,eAAe,CAAC,GAAc;QAC1C,gDAAgD;QAChD,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;QAChD,WAAW,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,qCAAqC;QAE5D,MAAM,GAAG,GAAG,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;QACvD,8CAA8C;QAC9C,MAAM,IAAI,GAAG,qBAAqB,CAAC,GAAG,CAAC,IAAI,mBAAmB,CAAC,GAAG,CAAC,CAAC;QAEpE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,iCAAiC,CACzC,wCAAwC,GAAG,EAAE,CAC9C,CAAC;QACJ,CAAC;QAED,8DAA8D;QAC9D,MAAM,QAAQ,GAAG,MAAM,eAAe,CACpC,GAAG,EACH,WAAW,EACX,IAAI,CAAC,cAAc,EACnB,IAAI,CACL,CAAC;QAEF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,iCAAiC,CACzC,+BAA+B,CAChC,CAAC;QACJ,CAAC;IACH,CAAC;IAED,uDAAuD;IACvD,IAAY,gBAAgB;QAC1B,wEAAwE;QACxE,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;IAED,uDAAuD;IACvD,IAAY,iBAAiB;QAC3B,yEAAyE;QACzE,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;IAED,0DAA0D;IAC1D,IAAY,cAAc;QACxB,OAAO,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;IACD,mDAAmD;IACnD,IAAY,aAAa;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CACnD,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAChC,CAAC;QACF,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,iCAAiC,CACzC,gCAAgC,CACjC,CAAC;QACJ,CAAC;QACD,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC;IAED,4DAA4D;IAC5D,IAAY,mBAAmB;QAC7B,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpC,CAAC;IAED,4DAA4D;IAC5D,IAAY,cAAc;QACxB,8DAA8D;QAC9D,MAAM,EAAE,GAAG,IAAI,CAAC,aAAa,CAAC;QAC9B,OAAO,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACrC,CAAC;IAED,qDAAqD;IACrD,IAAY,aAAa;QACvB,6BAA6B;QAC7B,OAAO,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrC,CAAC;IAED,4DAA4D;IAC5D,IAAY,eAAe;QACzB,OAAO,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1C,CAAC;IAED,4DAA4D;IAC5D,IAAY,WAAW;QACrB,OAAO,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1C,CAAC;IAED,4DAA4D;IAC5D,IAAY,cAAc;QACxB,MAAM,WAAW,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CACvD,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAChC,CAAC;QACF,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,iCAAiC,CAAC,yBAAyB,CAAC,CAAC;QACzE,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,4DAA4D;IAC5D,IAAY,yBAAyB;QACnC,MAAM,aAAa,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CACjD,CAAC,GAAG,EAAE,EAAE,CACN,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE;YACvB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,4BAA4B,CACvD,CAAC;QACF,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,iCAAiC,CAAC,wBAAwB,CAAC,CAAC;QACxE,CAAC;QACD,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,4DAA4D;IAC5D,IAAY,YAAY;QACtB,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpC,CAAC;IAED,4DAA4D;IAC5D,IAAY,wBAAwB;QAClC,2DAA2D;QAC3D,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpC,CAAC;IAED,4DAA4D;IAC5D,IAAY,qBAAqB;QAC/B,2DAA2D;QAC3D,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpC,CAAC;IAED,4DAA4D;IAC5D,IAAY,iBAAiB;QAC3B,2DAA2D;QAC3D,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpC,CAAC;CACF","sourcesContent":["/*\nCopyright 2023 The Sigstore Authors.\n\nLicensed under the Apache License, Version 2.0 (the \"License\");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\n    http://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n*/\nimport { ASN1Obj, digest, uint8ArrayEqual, verifySignature } from \"@freedomofpress/crypto-browser\";\n\nimport { HashAlgorithms } from \"../interfaces.js\";\nimport { ECDSA_SIGNATURE_ALGOS, RSA_SIGNATURE_ALGOS, SHA2_HASH_ALGOS } from \"../oid.js\";\nimport { RFC3161TimestampVerificationError } from \"./error.js\";\nimport { TSTInfo } from \"./tstinfo.js\";\n\nconst OID_PKCS9_CONTENT_TYPE_SIGNED_DATA = \"1.2.840.113549.1.7.2\";\nconst OID_PKCS9_CONTENT_TYPE_TSTINFO = \"1.2.840.113549.1.9.16.1.4\";\nconst OID_PKCS9_MESSAGE_DIGEST_KEY = \"1.2.840.113549.1.9.4\";\n\nexport class RFC3161Timestamp {\n  public root: ASN1Obj;\n\n  constructor(asn1: ASN1Obj) {\n    this.root = asn1;\n  }\n\n  public static parse(der: Uint8Array): RFC3161Timestamp {\n    const asn1 = ASN1Obj.parseBuffer(der);\n    return new RFC3161Timestamp(asn1);\n  }\n\n  get status(): bigint {\n    return this.pkiStatusInfoObj.subs[0].toInteger();\n  }\n\n  get contentType(): string {\n    return this.contentTypeObj.toOID();\n  }\n\n  get eContentType(): string {\n    return this.eContentTypeObj.toOID();\n  }\n\n  get signingTime(): Date {\n    return this.tstInfo.genTime;\n  }\n\n  get signerIssuer(): Uint8Array {\n    return this.signerSidObj.subs[0].value;\n  }\n\n  get signerSerialNumber(): Uint8Array {\n    return this.signerSidObj.subs[1].value;\n  }\n\n  get signerDigestAlgorithm(): string {\n    const oid = this.signerDigestAlgorithmObj.subs[0].toOID();\n    const algo = SHA2_HASH_ALGOS[oid];\n    if (!algo) {\n      throw new Error(`Unknown digest algorithm OID: ${oid}`);\n    }\n    return algo;\n  }\n\n  get signatureAlgorithm(): string {\n    const oid = this.signatureAlgorithmObj.subs[0].toOID();\n    const algo = ECDSA_SIGNATURE_ALGOS[oid] || RSA_SIGNATURE_ALGOS[oid];\n    return algo;\n  }\n\n  get signatureValue(): Uint8Array {\n    return this.signatureValueObj.value;\n  }\n\n  get tstInfo(): TSTInfo {\n    // Need to unpack tstInfo from an OCTET STRING\n    return new TSTInfo(this.eContentObj.subs[0].subs[0]);\n  }\n\n  public async verify(data: Uint8Array, publicKey: CryptoKey): Promise<void> {\n    if (!this.timeStampTokenObj) {\n      throw new RFC3161TimestampVerificationError(\"timeStampToken is missing\");\n    }\n\n    // Check for expected ContentInfo content type\n    if (this.contentType !== OID_PKCS9_CONTENT_TYPE_SIGNED_DATA) {\n      throw new RFC3161TimestampVerificationError(\n        `incorrect content type: ${this.contentType}`,\n      );\n    }\n\n    // Check for expected encapsulated content type\n    if (this.eContentType !== OID_PKCS9_CONTENT_TYPE_TSTINFO) {\n      throw new RFC3161TimestampVerificationError(\n        `incorrect encapsulated content type: ${this.eContentType}`,\n      );\n    }\n\n    // Check that the tstInfo references the correct artifact\n    await this.tstInfo.verify(data);\n    // Check that the signed message digest matches the tstInfo\n    await this.verifyMessageDigest();\n    // Check that the signature is valid for the signed attributes\n    await this.verifySignature(publicKey);\n  }\n\n  private async verifyMessageDigest(): Promise<void> {\n    // Check that the tstInfo matches the signed data\n    const hashAlg = this.signerDigestAlgorithm;\n\n    // Convert hash algorithm name to the format expected by WebCrypto\n    const hashAlgName = hashAlg === \"sha256\" ? HashAlgorithms.SHA256 :\n                       hashAlg === \"sha384\" ? HashAlgorithms.SHA384 :\n                       hashAlg === \"sha512\" ? HashAlgorithms.SHA512 : hashAlg;\n\n    const tstInfoDigest = await digest(hashAlgName, this.tstInfo.raw);\n    const expectedDigest = this.messageDigestAttributeObj.subs[1].subs[0].value;\n\n    if (!uint8ArrayEqual(tstInfoDigest, expectedDigest)) {\n      throw new RFC3161TimestampVerificationError(\n        \"signed data does not match tstInfo\",\n      );\n    }\n  }\n\n  private async verifySignature(key: CryptoKey): Promise<void> {\n    // Encode the signed attributes for verification\n    const signedAttrs = this.signedAttrsObj.toDER();\n    signedAttrs[0] = 0x31; // Change context-specific tag to SET\n\n    const oid = this.signatureAlgorithmObj.subs[0].toOID();\n    // Try both ECDSA and RSA signature algorithms\n    const algo = ECDSA_SIGNATURE_ALGOS[oid] || RSA_SIGNATURE_ALGOS[oid];\n\n    if (!algo) {\n      throw new RFC3161TimestampVerificationError(\n        `Unsupported signature algorithm OID: ${oid}`,\n      );\n    }\n\n    // Check that the signature is valid for the signed attributes\n    const verified = await verifySignature(\n      key,\n      signedAttrs,\n      this.signatureValue,\n      algo,\n    );\n\n    if (!verified) {\n      throw new RFC3161TimestampVerificationError(\n        \"signature verification failed\",\n      );\n    }\n  }\n\n  // https://www.rfc-editor.org/rfc/rfc3161#section-2.4.2\n  private get pkiStatusInfoObj(): ASN1Obj {\n    // pkiStatusInfo is the first element of the timestamp response sequence\n    return this.root.subs[0];\n  }\n\n  // https://www.rfc-editor.org/rfc/rfc3161#section-2.4.2\n  private get timeStampTokenObj(): ASN1Obj {\n    // timeStampToken is the first element of the timestamp response sequence\n    return this.root.subs[1];\n  }\n\n  // https://datatracker.ietf.org/doc/html/rfc5652#section-3\n  private get contentTypeObj(): ASN1Obj {\n    return this.timeStampTokenObj.subs[0];\n  }\n  // https://www.rfc-editor.org/rfc/rfc5652#section-3\n  private get signedDataObj(): ASN1Obj {\n    const obj = this.timeStampTokenObj.subs.find((sub) =>\n      sub.tag.isContextSpecific(0x00),\n    );\n    if (!obj) {\n      throw new RFC3161TimestampVerificationError(\n        \"Missing timeStampTokenObj sub.\",\n      );\n    }\n    return obj.subs[0];\n  }\n\n  // https://datatracker.ietf.org/doc/html/rfc5652#section-5.1\n  private get encapContentInfoObj(): ASN1Obj {\n    return this.signedDataObj.subs[2];\n  }\n\n  // https://datatracker.ietf.org/doc/html/rfc5652#section-5.1\n  private get signerInfosObj(): ASN1Obj {\n    // SignerInfos is the last element of the signed data sequence\n    const sd = this.signedDataObj;\n    return sd.subs[sd.subs.length - 1];\n  }\n\n  // https://www.rfc-editor.org/rfc/rfc5652#section-5.1\n  private get signerInfoObj(): ASN1Obj {\n    // Only supporting one signer\n    return this.signerInfosObj.subs[0];\n  }\n\n  // https://datatracker.ietf.org/doc/html/rfc5652#section-5.2\n  private get eContentTypeObj(): ASN1Obj {\n    return this.encapContentInfoObj.subs[0];\n  }\n\n  // https://datatracker.ietf.org/doc/html/rfc5652#section-5.2\n  private get eContentObj(): ASN1Obj {\n    return this.encapContentInfoObj.subs[1];\n  }\n\n  // https://datatracker.ietf.org/doc/html/rfc5652#section-5.3\n  private get signedAttrsObj(): ASN1Obj {\n    const signedAttrs = this.signerInfoObj.subs.find((sub) =>\n      sub.tag.isContextSpecific(0x00),\n    );\n    if (!signedAttrs) {\n      throw new RFC3161TimestampVerificationError(\"Missing signedAttrsObj.\");\n    }\n    return signedAttrs;\n  }\n\n  // https://datatracker.ietf.org/doc/html/rfc5652#section-5.3\n  private get messageDigestAttributeObj(): ASN1Obj {\n    const messageDigest = this.signedAttrsObj.subs.find(\n      (sub) =>\n        sub.subs[0].tag.isOID() &&\n        sub.subs[0].toOID() === OID_PKCS9_MESSAGE_DIGEST_KEY,\n    );\n    if (!messageDigest) {\n      throw new RFC3161TimestampVerificationError(\"Missing messageDigest.\");\n    }\n    return messageDigest;\n  }\n\n  // https://datatracker.ietf.org/doc/html/rfc5652#section-5.3\n  private get signerSidObj(): ASN1Obj {\n    return this.signerInfoObj.subs[1];\n  }\n\n  // https://datatracker.ietf.org/doc/html/rfc5652#section-5.3\n  private get signerDigestAlgorithmObj(): ASN1Obj {\n    // Signature is the 2nd element of the signerInfoObj object\n    return this.signerInfoObj.subs[2];\n  }\n\n  // https://datatracker.ietf.org/doc/html/rfc5652#section-5.3\n  private get signatureAlgorithmObj(): ASN1Obj {\n    // Signature is the 4th element of the signerInfoObj object\n    return this.signerInfoObj.subs[4];\n  }\n\n  // https://datatracker.ietf.org/doc/html/rfc5652#section-5.3\n  private get signatureValueObj(): ASN1Obj {\n    // Signature is the 6th element of the signerInfoObj object\n    return this.signerInfoObj.subs[5];\n  }\n}\n"]}

package/dist/rfc3161/tstinfo.d.ts

@@ -10,4 +10,3 @@ export declare class TSTInfo {
     verify(data: Uint8Array): Promise<void>;
     private get messageImprintObj();
 }
-//# sourceMappingURL=tstinfo.d.ts.map

package/dist/rfc3161/tstinfo.js

@@ -13,7 +13,7 @@ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
 limitations under the License.
 */
-import { uint8ArrayEqual } from "@freedomofpress/crypto-browser";
+import { digest, uint8ArrayEqual } from "@freedomofpress/crypto-browser";
 import { HashAlgorithms } from "../interfaces.js";
 import { SHA2_HASH_ALGOS } from "../oid.js";
 import { RFC3161TimestampVerificationError } from "./error.js";
@@ -47,8 +47,7 @@ export class TSTInfo {
         const hashAlgName = hashAlg === "sha256" ? HashAlgorithms.SHA256 :
             hashAlg === "sha384" ? HashAlgorithms.SHA384 :
                 hashAlg === "sha512" ? HashAlgorithms.SHA512 : hashAlg;
-        const digest = await crypto.subtle.digest(hashAlgName, data);
-        if (!uint8ArrayEqual(new Uint8Array(digest), this.messageImprintHashedMessage)) {
+        if (!uint8ArrayEqual(await digest(hashAlgName, data), this.messageImprintHashedMessage)) {
             throw new RFC3161TimestampVerificationError("message imprint does not match artifact");
         }
     }

package/dist/rfc3161/tstinfo.js.map

@@ -1 +1 @@
-{"version":3,"file":"tstinfo.js","sourceRoot":"","sources":["../../src/rfc3161/tstinfo.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;EAcE;AACF,OAAO,EAAW,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAC1E,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,EAAE,iCAAiC,EAAE,MAAM,YAAY,CAAC;AAE/D,MAAM,OAAO,OAAO;IAGlB,YAAY,IAAa;QACvB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;IACvC,CAAC;IAED,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACpC,CAAC;IAED,IAAI,2BAA2B;QAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;QAC3D,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,+CAA+C,GAAG,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,2BAA2B;QAC7B,OAAO,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC9C,CAAC;IAED,IAAI,GAAG;QACL,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;IAC3B,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,IAAgB;QAClC,MAAM,OAAO,GAAG,IAAI,CAAC,2BAA2B,CAAC;QAEjD,kEAAkE;QAClE,MAAM,WAAW,GAAG,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;YAC/C,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;gBAC9C,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;QAE1E,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CACvC,WAAW,EACX,IAAoB,CACrB,CAAC;QACF,IACE,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,2BAA2B,CAAC,EAC1E,CAAC;YACD,MAAM,IAAI,iCAAiC,CACzC,yCAAyC,CAC1C,CAAC;QACJ,CAAC;IACH,CAAC;IAED,uDAAuD;IACvD,IAAY,iBAAiB;QAC3B,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;CACF"}
+{"version":3,"file":"tstinfo.js","sourceRoot":"","sources":["../../src/rfc3161/tstinfo.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;EAcE;AACF,OAAO,EAAW,MAAM,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAElF,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,EAAE,iCAAiC,EAAE,MAAM,YAAY,CAAC;AAE/D,MAAM,OAAO,OAAO;IAGlB,YAAY,IAAa;QACvB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;IACvC,CAAC;IAED,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACpC,CAAC;IAED,IAAI,2BAA2B;QAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;QAC3D,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,+CAA+C,GAAG,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,2BAA2B;QAC7B,OAAO,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC9C,CAAC;IAED,IAAI,GAAG;QACL,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;IAC3B,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,IAAgB;QAClC,MAAM,OAAO,GAAG,IAAI,CAAC,2BAA2B,CAAC;QAEjD,kEAAkE;QAClE,MAAM,WAAW,GAAG,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;YAC/C,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;gBAC9C,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;QAE1E,IAAI,CAAC,eAAe,CAAC,MAAM,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,2BAA2B,CAAC,EAAE,CAAC;YACxF,MAAM,IAAI,iCAAiC,CACzC,yCAAyC,CAC1C,CAAC;QACJ,CAAC;IACH,CAAC;IAED,uDAAuD;IACvD,IAAY,iBAAiB;QAC3B,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;CACF","sourcesContent":["/*\nCopyright 2023 The Sigstore Authors.\n\nLicensed under the Apache License, Version 2.0 (the \"License\");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\n    http://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n*/\nimport { ASN1Obj, digest, uint8ArrayEqual } from \"@freedomofpress/crypto-browser\";\n\nimport { HashAlgorithms } from \"../interfaces.js\";\nimport { SHA2_HASH_ALGOS } from \"../oid.js\";\nimport { RFC3161TimestampVerificationError } from \"./error.js\";\n\nexport class TSTInfo {\n  public root: ASN1Obj;\n\n  constructor(asn1: ASN1Obj) {\n    this.root = asn1;\n  }\n\n  get version(): bigint {\n    return this.root.subs[0].toInteger();\n  }\n\n  get genTime(): Date {\n    return this.root.subs[4].toDate();\n  }\n\n  get messageImprintHashAlgorithm(): string {\n    const oid = this.messageImprintObj.subs[0].subs[0].toOID();\n    const algo = SHA2_HASH_ALGOS[oid];\n    if (!algo) {\n      throw new Error(`Unknown message imprint hash algorithm OID: ${oid}`);\n    }\n    return algo;\n  }\n\n  get messageImprintHashedMessage(): Uint8Array {\n    return this.messageImprintObj.subs[1].value;\n  }\n\n  get raw(): Uint8Array {\n    return this.root.toDER();\n  }\n\n  public async verify(data: Uint8Array): Promise<void> {\n    const hashAlg = this.messageImprintHashAlgorithm;\n\n    // Convert hash algorithm name to the format expected by WebCrypto\n    const hashAlgName = hashAlg === \"sha256\" ? HashAlgorithms.SHA256 :\n                       hashAlg === \"sha384\" ? HashAlgorithms.SHA384 :\n                       hashAlg === \"sha512\" ? HashAlgorithms.SHA512 : hashAlg;\n\n    if (!uint8ArrayEqual(await digest(hashAlgName, data), this.messageImprintHashedMessage)) {\n      throw new RFC3161TimestampVerificationError(\n        \"message imprint does not match artifact\",\n      );\n    }\n  }\n\n  // https://www.rfc-editor.org/rfc/rfc3161#section-2.4.2\n  private get messageImprintObj(): ASN1Obj {\n    return this.root.subs[2];\n  }\n}\n"]}