@freedomofpress/sigstore-browser 0.1.15 → 0.1.17

package/src/timestamp/tsa.ts

@@ -1,212 +0,0 @@
-/*
- * TSA (Time-Stamping Authority) timestamp verification
- *
- * Based on sigstore-js:
- * https://github.com/sigstore/sigstore-js/blob/main/packages/verify/src/timestamp/tsa.ts
- *
- * Key differences from sigstore-js:
- * - Browser-compatible: uses Uint8Array instead of Buffer for binary data
- * - Uses Web Crypto API for all cryptographic operations
- * - Integrates with existing RFC3161 timestamp implementation
- * - Uses CertificateChainVerifier for full X.509 path validation
- * - Implements filterCertAuthorities inline (from sigstore-js/packages/verify/src/trust/filter.ts)
- * - Adds verifyBundleTimestamp for Sigstore bundle integration (new functionality)
- */
-
-import { base64ToUint8Array, uint8ArrayEqual } from "@freedomofpress/crypto-browser";
-import { assertTimestampVerificationData } from "../bundle.js";
-import { CertificateChainVerifier, X509Certificate } from "../x509/index.js";
-import { parseValidityPeriod, RawTimestampAuthority } from "../interfaces.js";
-import { RFC3161Timestamp } from "../rfc3161/index.js";
-
-/**
- * Verifies an RFC3161 timestamp against a set of timestamp authorities
- *
- * @param timestamp - The RFC3161 timestamp to verify
- * @param data - The data that was timestamped
- * @param timestampAuthorities - List of trusted timestamp authorities
- * @returns The verified signing time
- * @throws Error if timestamp cannot be verified
- */
-export async function verifyRFC3161Timestamp(
-  timestamp: RFC3161Timestamp,
-  data: Uint8Array,
-  timestampAuthorities: RawTimestampAuthority[]
-): Promise<Date> {
-  return (await verifyTimestamp(timestamp, data, timestampAuthorities)).signingTime;
-}
-
-export interface VerifiedTimestamp {
-  signingTime: Date;
-  // Empty means unknown, which cannot add independence to named operators.
-  operator: string;
-}
-
-async function verifyTimestamp(
-  timestamp: RFC3161Timestamp,
-  data: Uint8Array,
-  timestampAuthorities: RawTimestampAuthority[]
-): Promise<VerifiedTimestamp> {
-  const signingTime = timestamp.signingTime;
-
-  // Filter for CAs which were valid at the time of signing
-  let validAuthorities = filterCertAuthorities(
-    timestampAuthorities,
-    signingTime
-  );
-
-  // Filter for CAs which match serial and issuer embedded in the timestamp
-  validAuthorities = filterCAsBySerialAndIssuer(validAuthorities, {
-    serialNumber: timestamp.signerSerialNumber,
-    issuer: timestamp.signerIssuer,
-  });
-
-  // Check that we can verify the timestamp with AT LEAST ONE of the remaining CAs
-  const verificationResults = await Promise.allSettled(
-    validAuthorities.map(ca => verifyTimestampForCA(timestamp, data, ca))
-  );
-
-  const verified = verificationResults.findIndex(
-    result => result.status === "fulfilled"
-  );
-
-  if (verified < 0) {
-    const errors = verificationResults
-      .filter(r => r.status === "rejected")
-      .map(r => (r as PromiseRejectedResult).reason?.message || 'Unknown error');
-    throw new Error(`Timestamp could not be verified against any trusted authority. Errors: ${errors.join(', ')}`);
-  }
-
-  const ca = validAuthorities[verified];
-  return { signingTime, operator: ca.operator || "" };
-}
-
-/**
- * Filters certificate authorities to those valid at a specific time
- *
- * Adapted from sigstore-js/packages/verify/src/trust/filter.ts
- */
-function filterCertAuthorities(
-  authorities: RawTimestampAuthority[],
-  validAt: Date
-): RawTimestampAuthority[] {
-  return authorities.filter(ca => {
-    const { start, end } = parseValidityPeriod(ca.validFor);
-    return start <= validAt && validAt <= end;
-  });
-}
-
-/**
- * Filters certificate authorities by serial number and issuer
- *
- * Only checks the LEAF certificate (TSA signing cert), not the entire chain.
- * This matches the sigstore-js reference implementation.
- */
-function filterCAsBySerialAndIssuer(
-  timestampAuthorities: RawTimestampAuthority[],
-  criteria: { serialNumber: Uint8Array; issuer: Uint8Array }
-): RawTimestampAuthority[] {
-  return timestampAuthorities.filter(ca => {
-    if (!ca.certChain || ca.certChain.certificates.length === 0) {
-      return false;
-    }
-
-    const leafCert = X509Certificate.parse(
-      base64ToUint8Array(ca.certChain.certificates[0].rawBytes)
-    );
-
-    return uint8ArrayEqual(leafCert.serialNumber, criteria.serialNumber) &&
-           uint8ArrayEqual(leafCert.issuer, criteria.issuer);
-  });
-}
-
-/**
- * Verifies a timestamp against a specific certificate authority
- */
-async function verifyTimestampForCA(
-  timestamp: RFC3161Timestamp,
-  data: Uint8Array,
-  ca: RawTimestampAuthority
-): Promise<void> {
-  if (!ca.certChain || ca.certChain.certificates.length === 0) {
-    throw new Error("Certificate authority missing certificate chain");
-  }
-
-  const leafCert = X509Certificate.parse(
-    base64ToUint8Array(ca.certChain.certificates[0].rawBytes)
-  );
-  const signingTime = timestamp.signingTime;
-
-  const trustedCerts = ca.certChain.certificates
-    .slice(1)
-    .map(cert => X509Certificate.parse(base64ToUint8Array(cert.rawBytes)));
-
-  try {
-    const verifier = new CertificateChainVerifier({
-      untrustedCert: leafCert,
-      trustedCerts: trustedCerts,
-      timestamp: signingTime,
-    });
-    await verifier.verify();
-  } catch (e) {
-    throw new Error(`TSA certificate chain verification failed: ${e instanceof Error ? e.message : String(e)}`);
-  }
-
-  const publicKey = await leafCert.publicKeyObj;
-
-  await timestamp.verify(data, publicKey);
-}
-
-/**
- * Verifies all timestamps in a bundle's timestamp verification data
- *
- * Matches sigstore-js behavior: all timestamps must successfully verify.
- * Reference: https://github.com/sigstore/sigstore-js/blob/main/packages/verify/src/verifier.ts#L64-L108
- *
- * @param timestampData - The timestamp verification data from the bundle
- * @param signature - The signature being verified
- * @param timestampAuthorities - List of trusted timestamp authorities
- * @returns The verified signing times and their operators (empty if no timestamps present)
- * @throws Error if any timestamp fails verification or duplicates are found
- */
-export async function verifyBundleTimestamp(
-  timestampData: any,
-  signature: Uint8Array,
-  timestampAuthorities: RawTimestampAuthority[]
-): Promise<VerifiedTimestamp[]> {
-  assertTimestampVerificationData(timestampData);
-  if (!timestampData?.rfc3161Timestamps?.length) {
-    return [];
-  }
-
-  // Verify ALL timestamps - each must succeed (matches sigstore-js behavior)
-  // Collect verification results for duplicate checking after verification
-  // Reference: https://github.com/sigstore/sigstore-js/blob/main/packages/verify/src/verifier.ts#L86-L92
-  const verifiedResults: Array<VerifiedTimestamp & { signerSerialNumber: string }> = [];
-
-  for (const tsData of timestampData.rfc3161Timestamps) {
-    // Decode the base64-encoded timestamp
-    const timestampBytes = base64ToUint8Array(tsData.signedTimestamp);
-    const timestamp = RFC3161Timestamp.parse(timestampBytes);
-
-    verifiedResults.push({
-      ...(await verifyTimestamp(timestamp, signature, timestampAuthorities)),
-      signerSerialNumber: Array.from(timestamp.signerSerialNumber).join(','),
-    });
-  }
-
-  // Check for duplicate timestamps using deep equality on parsed values
-  // sigstore-js uses isDeepStrictEqual on {type, logID, timestamp} objects
-  for (let i = 0; i < verifiedResults.length; i++) {
-    for (let j = i + 1; j < verifiedResults.length; j++) {
-      if (
-        verifiedResults[i].signingTime.getTime() === verifiedResults[j].signingTime.getTime() &&
-        verifiedResults[i].signerSerialNumber === verifiedResults[j].signerSerialNumber
-      ) {
-        throw new Error("Duplicate TSA timestamp detected");
-      }
-    }
-  }
-
-  return verifiedResults;
-}

package/src/tlog/body.ts

@@ -1,84 +0,0 @@
-/*
- * Transparency log body verification
- *
- * Based on sigstore-js:
- * https://github.com/sigstore/sigstore-js/blob/main/packages/verify/src/tlog/index.ts
- *
- * Key differences from sigstore-js:
- * - Browser-compatible: uses Uint8Array instead of Buffer for binary data
- * - Direct bundle comparison instead of SignatureContent abstraction
- */
-
-import { base64Decode, base64ToUint8Array, Uint8ArrayToString } from "@freedomofpress/crypto-browser";
-import type { SigstoreBundle, TLogEntry } from "../bundle.js";
-import { X509Certificate } from "../x509/cert.js";
-import { verifyHashedRekordBody } from "./hashedrekord.js";
-import { verifyDSSEBody } from "./dsse.js";
-import { verifyIntotoBody } from "./intoto.js";
-
-export interface RekorEntry {
-  apiVersion: string;
-  kind: string;
-  spec: unknown;
-}
-
-// Checks that the entry body matches the bundle content and was logged under the signing certificate.
-export async function verifyTLogBody(
-  entry: TLogEntry,
-  bundle: SigstoreBundle,
-  cert: X509Certificate,
-): Promise<void> {
-  const rekorEntry = parseCanonicalBody(entry);
-
-  const { kind, version } = entry.kindVersion;
-
-  if (kind !== rekorEntry.kind || version !== rekorEntry.apiVersion) {
-    throw new Error(
-      `kind/version mismatch - expected: ${kind}/${version}, received: ${rekorEntry.kind}/${rekorEntry.apiVersion}`
-    );
-  }
-
-  switch (rekorEntry.kind) {
-    case "hashedrekord":
-      return verifyHashedRekordBody(rekorEntry, bundle, cert);
-    case "dsse":
-      return verifyDSSEBody(rekorEntry, bundle, cert);
-    case "intoto":
-      return verifyIntotoBody(rekorEntry, bundle, cert);
-    default:
-      throw new Error(`Unsupported TLog entry kind: ${rekorEntry.kind}`);
-  }
-}
-
-// Compares the certificate recorded in the entry (base64 DER, or base64 PEM for Rekor v1) with the signing certificate.
-export function assertLoggedCertificate(
-  cert: X509Certificate,
-  encoded: unknown,
-  pem: boolean,
-): void {
-  if (typeof encoded !== "string" || encoded === "") {
-    throw new Error("TLog entry does not record the signing certificate");
-  }
-  const bytes = base64ToUint8Array(encoded);
-  const logged = X509Certificate.parse(pem ? Uint8ArrayToString(bytes) : bytes);
-  if (!cert.equals(logged)) {
-    throw new Error("Certificate in TLog entry does not match the signing certificate");
-  }
-}
-
-function parseCanonicalBody(entry: TLogEntry): RekorEntry {
-  try {
-    const decodedBody = base64Decode(entry.canonicalizedBody);
-    const rekorEntry = JSON.parse(decodedBody) as RekorEntry;
-
-    if (!rekorEntry.apiVersion || !rekorEntry.kind || !rekorEntry.spec) {
-      throw new Error("Invalid Rekor entry structure");
-    }
-
-    return rekorEntry;
-  } catch (error) {
-    throw new Error(
-      `Failed to parse canonicalized body: ${error instanceof Error ? error.message : String(error)}`
-    );
-  }
-}

package/src/tlog/checkpoint.ts

@@ -1,154 +0,0 @@
-/*
-Checkpoint verification for transparency log entries.
-
-Adapted from sigstore-js for browser compatibility:
-https://github.com/sigstore/sigstore-js/blob/main/packages/verify/src/timestamp/checkpoint.ts
-
-Key differences:
-- Uses Uint8Array instead of Buffer
-- Uses Web Crypto API instead of Node.js crypto module
-
-Follows the signed note format specification:
-https://github.com/transparency-dev/formats/blob/main/log/README.md
-*/
-
-import {
-  base64ToUint8Array,
-  stringToUint8Array,
-  uint8ArrayEqual,
-  verifySignature,
-} from "@freedomofpress/crypto-browser";
-import type { TLogEntry } from "../bundle.js";
-import type { RekorKeyInfo } from "../interfaces.js";
-
-// Signed note format per https://github.com/transparency-dev/formats
-// Body is separated from signatures by a blank line
-const CHECKPOINT_SEPARATOR = "\n\n";
-// Signature lines format: "— <identity> <base64(key_hint+signature)>\n"
-// \u2014 is the em-dash character (—)
-const SIGNATURE_REGEX = /\u2014 (\S+) (\S+)\n/g;
-
-export interface TLogSignature {
-  name: string;
-  keyHint: Uint8Array;
-  signature: Uint8Array;
-}
-
-// Signed checkpoint note with cryptographic signatures
-export class SignedNote {
-  readonly note: string;
-  readonly signatures: TLogSignature[];
-
-  constructor(note: string, signatures: TLogSignature[]) {
-    this.note = note;
-    this.signatures = signatures;
-  }
-
-  static fromString(envelope: string): SignedNote {
-    if (!envelope.includes(CHECKPOINT_SEPARATOR)) {
-      throw new Error("Missing checkpoint separator");
-    }
-
-    // Split body from signature lines at blank line
-    const split = envelope.indexOf(CHECKPOINT_SEPARATOR);
-    const header = envelope.slice(0, split + 1);
-    const data = envelope.slice(split + CHECKPOINT_SEPARATOR.length);
-
-    // Parse signature lines: "— <identity> <base64(key_hint+signature)>\n"
-    const matches = data.matchAll(SIGNATURE_REGEX);
-
-    const signatures: TLogSignature[] = [];
-    for (const match of matches) {
-      const [, name, signature] = match;
-      const sigBytes = base64ToUint8Array(signature);
-
-      // First 4 bytes are key hint (SHA256 hash prefix), rest is signature
-      if (sigBytes.length < 5) {
-        throw new Error("Malformed checkpoint signature");
-      }
-
-      signatures.push({
-        name,
-        keyHint: sigBytes.subarray(0, 4),
-        signature: sigBytes.subarray(4),
-      });
-    }
-
-    if (signatures.length === 0) {
-      throw new Error("No signatures found in checkpoint");
-    }
-
-    return new SignedNote(header, signatures);
-  }
-}
-
-// Parsed checkpoint containing tree state (origin, size, root hash)
-export class LogCheckpoint {
-  readonly origin: string;
-  readonly logSize: bigint;
-  readonly logHash: Uint8Array;
-  readonly rest: string[];
-
-  constructor(
-    origin: string,
-    logSize: bigint,
-    logHash: Uint8Array,
-    rest: string[]
-  ) {
-    this.origin = origin;
-    this.logSize = logSize;
-    this.logHash = logHash;
-    this.rest = rest;
-  }
-
-  static fromString(note: string): LogCheckpoint {
-    const lines = note.trimEnd().split("\n");
-
-    if (lines.length < 3) {
-      throw new Error("Too few lines in checkpoint header");
-    }
-
-    const origin = lines[0];
-    const logSize = BigInt(lines[1]);
-    const rootHash = base64ToUint8Array(lines[2]);
-    const rest = lines.slice(3);
-
-    return new LogCheckpoint(origin, logSize, rootHash, rest);
-  }
-}
-
-// Verifies that the checkpoint is signed by the entry's log and describes the same tree as the inclusion proof.
-export async function verifyCheckpoint(
-  entry: TLogEntry,
-  log: RekorKeyInfo
-): Promise<void> {
-  const proof = entry.inclusionProof;
-  if (!proof?.checkpoint?.envelope) {
-    throw new Error("Missing checkpoint in inclusion proof");
-  }
-
-  const signedNote = SignedNote.fromString(proof.checkpoint.envelope);
-  const checkpoint = LogCheckpoint.fromString(signedNote.note);
-  const data = stringToUint8Array(signedNote.note);
-
-  // Signatures from other parties (e.g. witnesses) are ignored; the key hint is the first 4 bytes of the log ID.
-  let valid = false;
-  for (const sig of signedNote.signatures) {
-    if (
-      uint8ArrayEqual(sig.keyHint, log.logId.subarray(0, 4)) &&
-      (await verifySignature(log.publicKey, data, sig.signature, log.hashAlgorithm))
-    ) {
-      valid = true;
-    }
-  }
-  if (!valid) {
-    throw new Error("Invalid checkpoint signature");
-  }
-
-  if (
-    checkpoint.logSize !== BigInt(proof.treeSize) ||
-    !uint8ArrayEqual(checkpoint.logHash, base64ToUint8Array(proof.rootHash))
-  ) {
-    throw new Error("Checkpoint does not match inclusion proof");
-  }
-}

package/src/tlog/dsse.ts

@@ -1,153 +0,0 @@
-/*
- * DSSE transparency log entry verification
- *
- * Based on sigstore-js:
- * https://github.com/sigstore/sigstore-js/blob/main/packages/verify/src/tlog/dsse.ts
- *
- * Key differences from sigstore-js:
- * - Browser-compatible: uses Uint8Array instead of Buffer for binary data
- * - Direct bundle field comparison instead of SignatureContent abstraction
- * - Uses crypto.subtle.digest for hash computation instead of Node.js crypto
- * - Adds verifyDSSE002Body() - new functionality (reference only supports v0.0.1)
- */
-
-import { base64ToUint8Array, hexToUint8Array, uint8ArrayEqual } from "@freedomofpress/crypto-browser";
-import { getHashAlgorithm } from "../interfaces.js";
-import type { SigstoreBundle } from "../bundle.js";
-import type { X509Certificate } from "../x509/cert.js";
-import { assertLoggedCertificate, type RekorEntry } from "./body.js";
-
-interface DSSESpec {
-  signatures?: Array<{
-    signature: string;
-    verifier?: string;
-    keyid?: string;
-  }>;
-  payloadHash?: {
-    algorithm: string;
-    value: string;
-  };
-  envelopeHash?: {
-    algorithm: string;
-    value: string;
-  };
-}
-
-interface DSSEEntry extends RekorEntry {
-  apiVersion: "0.0.1" | "0.0.2";
-  kind: "dsse";
-  spec: DSSESpec;
-}
-
-export async function verifyDSSEBody(
-  entry: RekorEntry,
-  bundle: SigstoreBundle,
-  cert: X509Certificate,
-): Promise<void> {
-  const dsseEntry = entry as DSSEEntry;
-
-  switch (dsseEntry.apiVersion) {
-    case "0.0.1":
-      return verifyDSSE001Body(dsseEntry, bundle, cert);
-    case "0.0.2":
-      return verifyDSSE002Body(dsseEntry, bundle, cert);
-    default:
-      throw new Error(
-        `Unsupported dsse version: ${dsseEntry.apiVersion}`
-      );
-  }
-}
-
-async function verifyDSSE001Body(
-  entry: DSSEEntry,
-  bundle: SigstoreBundle,
-  cert: X509Certificate,
-): Promise<void> {
-  if (!bundle.dsseEnvelope) {
-    throw new Error("Bundle missing dsseEnvelope for DSSE entry");
-  }
-
-  if (!entry.spec.signatures || entry.spec.signatures.length !== 1) {
-    throw new Error("DSSE entry must have exactly one signature");
-  }
-  assertLoggedCertificate(cert, entry.spec.signatures[0].verifier, true);
-
-  const tlogSig = entry.spec.signatures[0].signature;
-  const tlogSigBytes = base64ToUint8Array(tlogSig);
-
-  if (bundle.dsseEnvelope.signatures.length === 0) {
-    throw new Error("Bundle DSSE envelope missing signatures");
-  }
-
-  const bundleSigBytes = base64ToUint8Array(bundle.dsseEnvelope.signatures[0].sig);
-
-  if (!uint8ArrayEqual(tlogSigBytes, bundleSigBytes)) {
-    throw new Error("DSSE signature mismatch between TLog entry and bundle");
-  }
-
-  if (!entry.spec.payloadHash?.value || !entry.spec.payloadHash?.algorithm) {
-    throw new Error("DSSE entry missing payloadHash or algorithm");
-  }
-
-  const hashAlg = getHashAlgorithm(entry.spec.payloadHash.algorithm);
-  const tlogHashBytes = hexToUint8Array(entry.spec.payloadHash.value);
-
-  const payloadBytes = base64ToUint8Array(bundle.dsseEnvelope.payload);
-  const bundleHashBytes = new Uint8Array(
-    await crypto.subtle.digest(hashAlg, payloadBytes as BufferSource)
-  );
-
-  if (!uint8ArrayEqual(tlogHashBytes, bundleHashBytes)) {
-    throw new Error("DSSE payload hash mismatch between TLog entry and bundle");
-  }
-}
-
-// New functionality for DSSE v0.0.2 (not in sigstore-js reference, which only supports v0.0.1)
-async function verifyDSSE002Body(
-  entry: DSSEEntry,
-  bundle: SigstoreBundle,
-  cert: X509Certificate,
-): Promise<void> {
-  if (!bundle.dsseEnvelope) {
-    throw new Error("Bundle missing dsseEnvelope for DSSE v0.0.2 entry");
-  }
-
-  const spec = (entry.spec as any).dsseV002;
-  if (!spec) {
-    throw new Error("DSSE v0.0.2 entry missing dsseV002 spec");
-  }
-
-  if (!spec.signatures || spec.signatures.length !== 1) {
-    throw new Error("DSSE v0.0.2 entry must have exactly one signature");
-  }
-  assertLoggedCertificate(cert, spec.signatures[0].verifier?.x509Certificate?.rawBytes, false);
-
-  const tlogSig = spec.signatures[0].content;
-  const tlogSigBytes = base64ToUint8Array(tlogSig);
-
-  if (bundle.dsseEnvelope.signatures.length === 0) {
-    throw new Error("Bundle DSSE envelope missing signatures");
-  }
-
-  const bundleSigBytes = base64ToUint8Array(bundle.dsseEnvelope.signatures[0].sig);
-
-  if (!uint8ArrayEqual(tlogSigBytes, bundleSigBytes)) {
-    throw new Error("DSSE signature mismatch between TLog entry and bundle (v0.0.2)");
-  }
-
-  if (!spec.payloadHash?.digest || !spec.payloadHash?.algorithm) {
-    throw new Error("DSSE v0.0.2 entry missing payloadHash or algorithm");
-  }
-
-  const hashAlg = getHashAlgorithm(spec.payloadHash.algorithm);
-  const tlogHashBytes = base64ToUint8Array(spec.payloadHash.digest);
-
-  const payloadBytes = base64ToUint8Array(bundle.dsseEnvelope.payload);
-  const bundleHashBytes = new Uint8Array(
-    await crypto.subtle.digest(hashAlg, payloadBytes as BufferSource)
-  );
-
-  if (!uint8ArrayEqual(tlogHashBytes, bundleHashBytes)) {
-    throw new Error("DSSE payload hash mismatch between TLog entry and bundle (v0.0.2)");
-  }
-}