@freedomofpress/sigstore-browser 0.1.15 → 0.1.17

package/dist/tlog/merkle.js

@@ -1,112 +1,18 @@
-/*
-Adapted from sigstore-js for browser compatibility:
-https://github.com/sigstore/sigstore-js/blob/main/packages/verify/src/timestamp/merkle.ts
-
-Key differences:
-- Uses Uint8Array instead of Buffer
-- Uses async Web Crypto API (crypto.subtle.digest) instead of sync Node.js crypto
-- Base64 decoding via custom base64ToUint8Array instead of Buffer.from
-- uint8ArrayEqual from crypto-browser instead of Node.js crypto.timingSafeEqual
-*/
-import { base64ToUint8Array, uint8ArrayEqual } from "@freedomofpress/crypto-browser";
-import { HashAlgorithms } from "../interfaces.js";
-const RFC6962_LEAF_HASH_PREFIX = new Uint8Array([0x00]);
-const RFC6962_NODE_HASH_PREFIX = new Uint8Array([0x01]);
+import { base64ToUint8Array, hashLeaf, verifyInclusionProof } from "@freedomofpress/crypto-browser";
 export async function verifyMerkleInclusion(entry) {
     if (!entry.inclusionProof) {
         throw new Error("Missing inclusion proof");
     }
-    const inclusionProof = entry.inclusionProof;
-    const logIndex = BigInt(inclusionProof.logIndex);
-    const treeSize = BigInt(inclusionProof.treeSize);
-    if (logIndex < 0n || logIndex >= treeSize) {
-        throw new Error(`Invalid log index: ${logIndex}`);
+    const proof = entry.inclusionProof;
+    const index = Number(proof.logIndex);
+    const size = Number(proof.treeSize);
+    if (!Number.isSafeInteger(index) || !Number.isSafeInteger(size) || index < 0 || index >= size) {
+        throw new Error(`Invalid log index: ${proof.logIndex}`);
     }
-    // Figure out which subset of hashes corresponds to the inner and border
-    // nodes
-    const { inner, border } = decompInclProof(logIndex, treeSize);
-    if (inclusionProof.hashes.length !== inner + border) {
-        throw new Error("Invalid hash count in inclusion proof");
-    }
-    const innerHashes = inclusionProof.hashes
-        .slice(0, inner)
-        .map((h) => base64ToUint8Array(h));
-    const borderHashes = inclusionProof.hashes
-        .slice(inner)
-        .map((h) => base64ToUint8Array(h));
-    // The entry's hash is the leaf hash
     const leafHash = await hashLeaf(base64ToUint8Array(entry.canonicalizedBody));
-    // Chain the hashes belonging to the inner and border portions
-    const calculatedHash = await chainBorderRight(await chainInner(leafHash, innerHashes, logIndex), borderHashes);
-    const rootHash = base64ToUint8Array(inclusionProof.rootHash);
-    // Calculated hash should match the root hash in the inclusion proof
-    if (!uint8ArrayEqual(calculatedHash, rootHash)) {
+    const ok = await verifyInclusionProof(leafHash, index, size, base64ToUint8Array(proof.rootHash), proof.hashes.map(base64ToUint8Array));
+    if (!ok) {
         throw new Error("Calculated root hash does not match inclusion proof");
     }
 }
-// Breaks down inclusion proof for a leaf at the specified index in a tree of
-// the specified size. The split point is where paths to the index leaf and
-// the (size - 1) leaf diverge. Returns lengths of the bottom and upper proof
-// parts.
-function decompInclProof(index, size) {
-    const inner = innerProofSize(index, size);
-    const border = onesCount(index >> BigInt(inner));
-    return { inner, border };
-}
-// Computes a subtree hash for a node on or below the tree's right border.
-// Assumes the provided proof hashes are ordered from lower to higher levels
-// and seed is the initial hash of the node specified by the index.
-async function chainInner(seed, hashes, index) {
-    let acc = seed;
-    for (let i = 0; i < hashes.length; i++) {
-        const h = hashes[i];
-        if ((index >> BigInt(i)) & BigInt(1)) {
-            acc = await hashChildren(h, acc);
-        }
-        else {
-            acc = await hashChildren(acc, h);
-        }
-    }
-    return acc;
-}
-// Computes a subtree hash for nodes along the tree's right border.
-async function chainBorderRight(seed, hashes) {
-    let acc = seed;
-    for (const h of hashes) {
-        acc = await hashChildren(h, acc);
-    }
-    return acc;
-}
-function innerProofSize(index, size) {
-    return bitLength(index ^ (size - BigInt(1)));
-}
-// Counts the number of ones in the binary representation of the given number.
-// https://en.wikipedia.org/wiki/Hamming_weight
-function onesCount(num) {
-    return num.toString(2).split("1").length - 1;
-}
-// Returns the number of bits necessary to represent an integer in binary.
-function bitLength(n) {
-    if (n === 0n) {
-        return 0;
-    }
-    return n.toString(2).length;
-}
-// Hashing logic according to RFC6962.
-// https://datatracker.ietf.org/doc/html/rfc6962#section-2
-async function hashChildren(left, right) {
-    const data = new Uint8Array(RFC6962_NODE_HASH_PREFIX.length + left.length + right.length);
-    data.set(RFC6962_NODE_HASH_PREFIX, 0);
-    data.set(left, RFC6962_NODE_HASH_PREFIX.length);
-    data.set(right, RFC6962_NODE_HASH_PREFIX.length + left.length);
-    const hash = await crypto.subtle.digest(HashAlgorithms.SHA256, data);
-    return new Uint8Array(hash);
-}
-async function hashLeaf(leaf) {
-    const data = new Uint8Array(RFC6962_LEAF_HASH_PREFIX.length + leaf.length);
-    data.set(RFC6962_LEAF_HASH_PREFIX, 0);
-    data.set(leaf, RFC6962_LEAF_HASH_PREFIX.length);
-    const hash = await crypto.subtle.digest(HashAlgorithms.SHA256, data);
-    return new Uint8Array(hash);
-}
 //# sourceMappingURL=merkle.js.map

package/dist/tlog/merkle.js.map

@@ -1 +1 @@
-{"version":3,"file":"merkle.js","sourceRoot":"","sources":["../../src/tlog/merkle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;EASE;AACF,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACrF,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAGlD,MAAM,wBAAwB,GAAG,IAAI,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AACxD,MAAM,wBAAwB,GAAG,IAAI,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AAExD,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,KAAgB;IAEhB,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC7C,CAAC;IAED,MAAM,cAAc,GAAG,KAAK,CAAC,cAAc,CAAC;IAC5C,MAAM,QAAQ,GAAG,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IAEjD,IAAI,QAAQ,GAAG,EAAE,IAAI,QAAQ,IAAI,QAAQ,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,sBAAsB,QAAQ,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,wEAAwE;IACxE,QAAQ;IACR,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAE9D,IAAI,cAAc,CAAC,MAAM,CAAC,MAAM,KAAK,KAAK,GAAG,MAAM,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IAED,MAAM,WAAW,GAAG,cAAc,CAAC,MAAM;SACtC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC;SACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC;IACrC,MAAM,YAAY,GAAG,cAAc,CAAC,MAAM;SACvC,KAAK,CAAC,KAAK,CAAC;SACZ,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC;IAErC,oCAAoC;IACpC,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,kBAAkB,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAE7E,8DAA8D;IAC9D,MAAM,cAAc,GAAG,MAAM,gBAAgB,CAC3C,MAAM,UAAU,CAAC,QAAQ,EAAE,WAAW,EAAE,QAAQ,CAAC,EACjD,YAAY,CACb,CAAC;IAEF,MAAM,QAAQ,GAAG,kBAAkB,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IAE7D,oEAAoE;IACpE,IAAI,CAAC,eAAe,CAAC,cAAc,EAAE,QAAQ,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,2EAA2E;AAC3E,6EAA6E;AAC7E,SAAS;AACT,SAAS,eAAe,CACtB,KAAa,EACb,IAAY;IAEZ,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACjD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AAC3B,CAAC;AAED,0EAA0E;AAC1E,4EAA4E;AAC5E,mEAAmE;AACnE,KAAK,UAAU,UAAU,CACvB,IAAgB,EAChB,MAAoB,EACpB,KAAa;IAEb,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;YACrC,GAAG,GAAG,MAAM,YAAY,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACnC,CAAC;aAAM,CAAC;YACN,GAAG,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,mEAAmE;AACnE,KAAK,UAAU,gBAAgB,CAC7B,IAAgB,EAChB,MAAoB;IAEpB,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,GAAG,GAAG,MAAM,YAAY,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,cAAc,CAAC,KAAa,EAAE,IAAY;IACjD,OAAO,SAAS,CAAC,KAAK,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED,8EAA8E;AAC9E,+CAA+C;AAC/C,SAAS,SAAS,CAAC,GAAW;IAC5B,OAAO,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;AAC/C,CAAC;AAED,0EAA0E;AAC1E,SAAS,SAAS,CAAC,CAAS;IAC1B,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;QACb,OAAO,CAAC,CAAC;IACX,CAAC;IACD,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;AAC9B,CAAC;AAED,sCAAsC;AACtC,0DAA0D;AAC1D,KAAK,UAAU,YAAY,CACzB,IAAgB,EAChB,KAAiB;IAEjB,MAAM,IAAI,GAAG,IAAI,UAAU,CACzB,wBAAwB,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAC7D,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,wBAAwB,EAAE,CAAC,CAAC,CAAC;IACtC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,wBAAwB,CAAC,MAAM,CAAC,CAAC;IAChD,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,wBAAwB,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAE/D,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,IAAoB,CAAC,CAAC;IACrF,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;AAC9B,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAgB;IACtC,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,wBAAwB,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3E,IAAI,CAAC,GAAG,CAAC,wBAAwB,EAAE,CAAC,CAAC,CAAC;IACtC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,wBAAwB,CAAC,MAAM,CAAC,CAAC;IAEhD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,IAAoB,CAAC,CAAC;IACrF,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;AAC9B,CAAC"}
+{"version":3,"file":"merkle.js","sourceRoot":"","sources":["../../src/tlog/merkle.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,QAAQ,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAIpG,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,KAAgB;IAC1D,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC7C,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,cAAc,CAAC;IACnC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACpC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;QAC9F,MAAM,IAAI,KAAK,CAAC,sBAAsB,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC1D,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,kBAAkB,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAC7E,MAAM,EAAE,GAAG,MAAM,oBAAoB,CACnC,QAAQ,EACR,KAAK,EACL,IAAI,EACJ,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,EAClC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,CACrC,CAAC;IACF,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;AACH,CAAC","sourcesContent":["import { base64ToUint8Array, hashLeaf, verifyInclusionProof } from \"@freedomofpress/crypto-browser\";\n\nimport type { TLogEntry } from \"../bundle.js\";\n\nexport async function verifyMerkleInclusion(entry: TLogEntry): Promise<void> {\n  if (!entry.inclusionProof) {\n    throw new Error(\"Missing inclusion proof\");\n  }\n  const proof = entry.inclusionProof;\n  const index = Number(proof.logIndex);\n  const size = Number(proof.treeSize);\n  if (!Number.isSafeInteger(index) || !Number.isSafeInteger(size) || index < 0 || index >= size) {\n    throw new Error(`Invalid log index: ${proof.logIndex}`);\n  }\n  const leafHash = await hashLeaf(base64ToUint8Array(entry.canonicalizedBody));\n  const ok = await verifyInclusionProof(\n    leafHash,\n    index,\n    size,\n    base64ToUint8Array(proof.rootHash),\n    proof.hashes.map(base64ToUint8Array),\n  );\n  if (!ok) {\n    throw new Error(\"Calculated root hash does not match inclusion proof\");\n  }\n}\n"]}

package/dist/trust/tuf-root.d.ts

@@ -1,3 +1,2 @@
 declare const _default: "ewogInNpZ25hdHVyZXMiOiBbCiAgewogICAia2V5aWQiOiAiNmYyNjAwODlkNTkyM2RhZjIwMTY2Y2E2NTdjNTQzYWY2MTgzNDZhYjk3MTg4NGE5OTk2MmIwMTk4OGJiZTBjMyIsCiAgICJzaWciOiAiIgogIH0sCiAgewogICAia2V5aWQiOiAiZTcxYTU0ZDU0MzgzNWJhODZhZGFkOTQ2MDM3OWM3NjQxZmI4NzI2ZDE2NGVhNzY2ODAxYTFjNTIyYWJhN2VhMiIsCiAgICJzaWciOiAiMzA0NTAyMjEwMGJiZGRkNDY0ZjgwNjZjZWI4OGJhNzg3Mzc1YzEyY2Q2MzMwNjgwZTA4YzI5MTA3MDNlNjUzOGM3MWNjNzlhZDIwMjIwNTE5MGIwNmU0NTM3ZmU5NjFiM2VmODFmZTY4ZWRjZDAwODljMTlmOTE5YWZlZDQyM2I5YWFmZDcwMDY0MTE1MyIKICB9LAogIHsKICAgImtleWlkIjogIjIyZjRjYWVjNmQ4ZTZmOTU1NWFmNjZiM2Q0YzNjYjA2YTNiYjIzZmRjN2UzOWM5MTZjNjFmNDYyZTZmNTJiMDYiLAogICAic2lnIjogIjMwNDQwMjIwNjkzMDZjZDUyNTdmNzMyYTc0MGMxYWZlNjBhOGU0MzNjNWRlNThlYWZlYWRiZTk5YzMzNmM5YzcxZDE5OGNmODAyMjAwZDc3Mzk1M2FlN2RiYzQ4ZDNlNWJhZDlhNmY2NGJhZmZmMTk2YjdlMmFkNGE1MmExOTUxOTM2N2Q0N2RjMDQyIgogIH0sCiAgewogICAia2V5aWQiOiAiNjE2NDM4MzgxMjViNDQwYjQwZGI2OTQyZjVjYjVhMzFjMGRjMDQzNjgzMTZlYjJhYWE1OGI5NTkwNGE1ODIyMiIsCiAgICJzaWciOiAiMzA0NDAyMjA0ZDIxYTJlYzgwZGY2NmU2MWY2ZmUyOTEyOTUxZGM0N2RmODM2MDM2ZjhjMGFiMTA4MTZkMzc1ZTcxZGJmNzllMDIyMDU0N2FkY2UxYWZkZjA0ZTY3OTRlZmEyMDNkZDUyNjRjNmY3ZTBlZjc4ZTU3ZmU5MzRiMGQyNmNiOTk0ZWVjNzYiCiAgfSwKICB7CiAgICJrZXlpZCI6ICJhNjg3ZTViZjRmYWI4MmIwZWU1OGQ0NmUwNWM5NTM1MTQ1YTJjOWFmYjQ1OGY0M2Q0MmI0NWNhMGZkY2UyYTcwIiwKICAgInNpZyI6ICIzMDQ1MDIyMDYwODI2NDk2NTU3MTQ0ZWIxNjQ5ODkzZWQ1ZjZmNGVhNTQ1MzZmZWIwY2E4MmY4Yjg5YWU2NDFiZTM5NzQzZTUwMjIxMDBhZDcxMThiNWU5ZDQ4MzczMjYyMDZlNDEyZmM2ZGEyOTk5OTI1ZDExMDMyOGE3YzE2NmIwNmM2MjQzMzZjOTNmIgogIH0sCiAgewogICAia2V5aWQiOiAiMTgzZTY0ZjM3NjcwZGMxM2NhMGQyODk5NWEzMDUzZjM3NDA5NTRkZGNlNDQzMjFhNDFlNDY1MzRjZjQ0ZTYzMiIsCiAgICJzaWciOiAiMzA0NjAyMjEwMGQ4MTc5NDM5YzJlNzNlYjBjMTczM2FiZWU3ZmFmODMyZGNhZWE3MjYzZWRjYjQ5MTk4OTFjM2EyNDdmMDU5MjMwMjIxMDBlMWE0MzdlMDc5N2U4MDNmOWI3MmRjOWQyZDkyMTU1YjBhMjI3MGMyNGVmZGQ1ZjRiM2E1ZDhmMGIwZjQzMWE3IgogIH0KIF0sCiAic2lnbmVkIjogewogICJfdHlwZSI6ICJyb290IiwKICAiY29uc2lzdGVudF9zbmFwc2hvdCI6IHRydWUsCiAgImV4cGlyZXMiOiAiMjAyNi0wMS0yMlQxMzowNTo1OVoiLAogICJrZXlzIjogewogICAiMGM4NzQzMmMzYmYwOWZkOTkxODlmZGMzMmZhNWVhZWRmNGU0YTVmYWM3YmFiNzNmYTA0YTJlMGZjNjRhZjZmNSI6IHsKICAgICJrZXlpZF9oYXNoX2FsZ29yaXRobXMiOiBbCiAgICAgInNoYTI1NiIsCiAgICAgInNoYTUxMiIKICAgIF0sCiAgICAia2V5dHlwZSI6ICJlY2RzYSIsCiAgICAia2V5dmFsIjogewogICAgICJwdWJsaWMiOiAiLS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS1cbk1Ga3dFd1lIS29aSXpqMENBUVlJS29aSXpqMERBUWNEUWdBRVdSaUdyNStqKzNKNVNzSCtadHI1bkUySDJ3TzdcbkJWK25PM3M5M2dMY2ExOHFUT3pIWTFvV3lBR0R5a01Tc0dUVUJTdDlEK0FuMEtmS3NEMm1mU000MlE9PVxuLS0tLS1FTkQgUFVCTElDIEtFWS0tLS0tXG4iCiAgICB9LAogICAgInNjaGVtZSI6ICJlY2RzYS1zaGEyLW5pc3RwMjU2IiwKICAgICJ4LXR1Zi1vbi1jaS1vbmxpbmUtdXJpIjogImdjcGttczpwcm9qZWN0cy9zaWdzdG9yZS1yb290LXNpZ25pbmcvbG9jYXRpb25zL2dsb2JhbC9rZXlSaW5ncy9yb290L2NyeXB0b0tleXMvdGltZXN0YW1wL2NyeXB0b0tleVZlcnNpb25zLzEiCiAgIH0sCiAgICIxODNlNjRmMzc2NzBkYzEzY2EwZDI4OTk1YTMwNTNmMzc0MDk1NGRkY2U0NDMyMWE0MWU0NjUzNGNmNDRlNjMyIjogewogICAgImtleXR5cGUiOiAiZWNkc2EiLAogICAgImtleXZhbCI6IHsKICAgICAicHVibGljIjogIi0tLS0tQkVHSU4gUFVCTElDIEtFWS0tLS0tXG5NRmt3RXdZSEtvWkl6ajBDQVFZSUtvWkl6ajBEQVFjRFFnQUVNeHBQT0pDSVo1b3RHNDEwNmZHSnNlRVFpM1Y5XG5wa01ZUTR1eVY5VGoxTTdXSFhJeUxHK2prZnZ1RzBnbFExSlpiUlpaQlYzZ0FSNHNvamRHSElTZW93PT1cbi0tLS0tRU5EIFBVQkxJQyBLRVktLS0tLVxuIgogICAgfSwKICAgICJzY2hlbWUiOiAiZWNkc2Etc2hhMi1uaXN0cDI1NiIsCiAgICAieC10dWYtb24tY2kta2V5b3duZXIiOiAiQGxhbmNlIgogICB9LAogICAiMjJmNGNhZWM2ZDhlNmY5NTU1YWY2NmIzZDRjM2NiMDZhM2JiMjNmZGM3ZTM5YzkxNmM2MWY0NjJlNmY1MmIwNiI6IHsKICAgICJrZXlpZF9oYXNoX2FsZ29yaXRobXMiOiBbCiAgICAgInNoYTI1NiIsCiAgICAgInNoYTUxMiIKICAgIF0sCiAgICAia2V5dHlwZSI6ICJlY2RzYSIsCiAgICAia2V5dmFsIjogewogICAgICJwdWJsaWMiOiAiLS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS1cbk1Ga3dFd1lIS29aSXpqMENBUVlJS29aSXpqMERBUWNEUWdBRXpCelZPbUhDUG9qTVZMU0kzNjRXaWlWOE5QckRcbjZJZ1J4Vmxpc2t6L3YreTNKRVI1bWNWR2NPTmxpRGNXTUM1SjJsZkhtalBOUGhiNEg3eG04THpmU0E9PVxuLS0tLS1FTkQgUFVCTElDIEtFWS0tLS0tXG4iCiAgICB9LAogICAgInNjaGVtZSI6ICJlY2RzYS1zaGEyLW5pc3RwMjU2IiwKICAgICJ4LXR1Zi1vbi1jaS1rZXlvd25lciI6ICJAc2FudGlhZ290b3JyZXMiCiAgIH0sCiAgICI2MTY0MzgzODEyNWI0NDBiNDBkYjY5NDJmNWNiNWEzMWMwZGMwNDM2ODMxNmViMmFhYTU4Yjk1OTA0YTU4MjIyIjogewogICAgImtleWlkX2hhc2hfYWxnb3JpdGhtcyI6IFsKICAgICAic2hhMjU2IiwKICAgICAic2hhNTEyIgogICAgXSwKICAgICJrZXl0eXBlIjogImVjZHNhIiwKICAgICJrZXl2YWwiOiB7CiAgICAgInB1YmxpYyI6ICItLS0tLUJFR0lOIFBVQkxJQyBLRVktLS0tLVxuTUZrd0V3WUhLb1pJemowQ0FRWUlLb1pJemowREFRY0RRZ0FFaW5pa1NzQVFtWWtOZUg1ZVlxL0NuSXpMYWFjT1xueGxTYWF3UURPd3FLeS90Q3F4cTV4eFBTSmMyMUs0V0loczlHeU9rS2Z6dWVZM0dJTHpjTUpaNGNXdz09XG4tLS0tLUVORCBQVUJMSUMgS0VZLS0tLS1cbiIKICAgIH0sCiAgICAic2NoZW1lIjogImVjZHNhLXNoYTItbmlzdHAyNTYiLAogICAgIngtdHVmLW9uLWNpLWtleW93bmVyIjogIkBib2JjYWxsYXdheSIKICAgfSwKICAgImE2ODdlNWJmNGZhYjgyYjBlZTU4ZDQ2ZTA1Yzk1MzUxNDVhMmM5YWZiNDU4ZjQzZDQyYjQ1Y2EwZmRjZTJhNzAiOiB7CiAgICAia2V5aWRfaGFzaF9hbGdvcml0aG1zIjogWwogICAgICJzaGEyNTYiLAogICAgICJzaGE1MTIiCiAgICBdLAogICAgImtleXR5cGUiOiAiZWNkc2EiLAogICAgImtleXZhbCI6IHsKICAgICAicHVibGljIjogIi0tLS0tQkVHSU4gUFVCTElDIEtFWS0tLS0tXG5NRmt3RXdZSEtvWkl6ajBDQVFZSUtvWkl6ajBEQVFjRFFnQUUwZ2hyaDkyTHcxWXIzaWRHVjVXcUN0TURCOEN4XG4rRDhoZEM0dzJaTE5JcGxWUm9WR0xza1lhM2doZU15T2ppSjhrUGkxNWFRMi8vN1Arb2o3VXZKUEd3PT1cbi0tLS0tRU5EIFBVQkxJQyBLRVktLS0tLVxuIgogICAgfSwKICAgICJzY2hlbWUiOiAiZWNkc2Etc2hhMi1uaXN0cDI1NiIsCiAgICAieC10dWYtb24tY2kta2V5b3duZXIiOiAiQGpvc2h1YWdsIgogICB9LAogICAiZTcxYTU0ZDU0MzgzNWJhODZhZGFkOTQ2MDM3OWM3NjQxZmI4NzI2ZDE2NGVhNzY2ODAxYTFjNTIyYWJhN2VhMiI6IHsKICAgICJrZXlpZF9oYXNoX2FsZ29yaXRobXMiOiBbCiAgICAgInNoYTI1NiIsCiAgICAgInNoYTUxMiIKICAgIF0sCiAgICAia2V5dHlwZSI6ICJlY2RzYSIsCiAgICAia2V5dmFsIjogewogICAgICJwdWJsaWMiOiAiLS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS1cbk1Ga3dFd1lIS29aSXpqMENBUVlJS29aSXpqMERBUWNEUWdBRUVYc3ozU1pYRmI4ak1WNDJqNnBKbHlqYmpSOEtcbk4zQndvY2V4cTZMTUliNXFzV0tPUXZMTjE2TlVlZkxjNEhzd09vdW1Sc1ZWYWFqU3BRUzZmb2JrUnc9PVxuLS0tLS1FTkQgUFVCTElDIEtFWS0tLS0tXG4iCiAgICB9LAogICAgInNjaGVtZSI6ICJlY2RzYS1zaGEyLW5pc3RwMjU2IiwKICAgICJ4LXR1Zi1vbi1jaS1rZXlvd25lciI6ICJAbW5tNjc4IgogICB9CiAgfSwKICAicm9sZXMiOiB7CiAgICJyb290IjogewogICAgImtleWlkcyI6IFsKICAgICAiZTcxYTU0ZDU0MzgzNWJhODZhZGFkOTQ2MDM3OWM3NjQxZmI4NzI2ZDE2NGVhNzY2ODAxYTFjNTIyYWJhN2VhMiIsCiAgICAgIjIyZjRjYWVjNmQ4ZTZmOTU1NWFmNjZiM2Q0YzNjYjA2YTNiYjIzZmRjN2UzOWM5MTZjNjFmNDYyZTZmNTJiMDYiLAogICAgICI2MTY0MzgzODEyNWI0NDBiNDBkYjY5NDJmNWNiNWEzMWMwZGMwNDM2ODMxNmViMmFhYTU4Yjk1OTA0YTU4MjIyIiwKICAgICAiYTY4N2U1YmY0ZmFiODJiMGVlNThkNDZlMDVjOTUzNTE0NWEyYzlhZmI0NThmNDNkNDJiNDVjYTBmZGNlMmE3MCIsCiAgICAgIjE4M2U2NGYzNzY3MGRjMTNjYTBkMjg5OTVhMzA1M2YzNzQwOTU0ZGRjZTQ0MzIxYTQxZTQ2NTM0Y2Y0NGU2MzIiCiAgICBdLAogICAgInRocmVzaG9sZCI6IDMKICAgfSwKICAgInNuYXBzaG90IjogewogICAgImtleWlkcyI6IFsKICAgICAiMGM4NzQzMmMzYmYwOWZkOTkxODlmZGMzMmZhNWVhZWRmNGU0YTVmYWM3YmFiNzNmYTA0YTJlMGZjNjRhZjZmNSIKICAgIF0sCiAgICAidGhyZXNob2xkIjogMSwKICAgICJ4LXR1Zi1vbi1jaS1leHBpcnktcGVyaW9kIjogMzY1MCwKICAgICJ4LXR1Zi1vbi1jaS1zaWduaW5nLXBlcmlvZCI6IDM2NQogICB9LAogICAidGFyZ2V0cyI6IHsKICAgICJrZXlpZHMiOiBbCiAgICAgImU3MWE1NGQ1NDM4MzViYTg2YWRhZDk0NjAzNzljNzY0MWZiODcyNmQxNjRlYTc2NjgwMWExYzUyMmFiYTdlYTIiLAogICAgICIyMmY0Y2FlYzZkOGU2Zjk1NTVhZjY2YjNkNGMzY2IwNmEzYmIyM2ZkYzdlMzljOTE2YzYxZjQ2MmU2ZjUyYjA2IiwKICAgICAiNjE2NDM4MzgxMjViNDQwYjQwZGI2OTQyZjVjYjVhMzFjMGRjMDQzNjgzMTZlYjJhYWE1OGI5NTkwNGE1ODIyMiIsCiAgICAgImE2ODdlNWJmNGZhYjgyYjBlZTU4ZDQ2ZTA1Yzk1MzUxNDVhMmM5YWZiNDU4ZjQzZDQyYjQ1Y2EwZmRjZTJhNzAiLAogICAgICIxODNlNjRmMzc2NzBkYzEzY2EwZDI4OTk1YTMwNTNmMzc0MDk1NGRkY2U0NDMyMWE0MWU0NjUzNGNmNDRlNjMyIgogICAgXSwKICAgICJ0aHJlc2hvbGQiOiAzCiAgIH0sCiAgICJ0aW1lc3RhbXAiOiB7CiAgICAia2V5aWRzIjogWwogICAgICIwYzg3NDMyYzNiZjA5ZmQ5OTE4OWZkYzMyZmE1ZWFlZGY0ZTRhNWZhYzdiYWI3M2ZhMDRhMmUwZmM2NGFmNmY1IgogICAgXSwKICAgICJ0aHJlc2hvbGQiOiAxLAogICAgIngtdHVmLW9uLWNpLWV4cGlyeS1wZXJpb2QiOiA3LAogICAgIngtdHVmLW9uLWNpLXNpZ25pbmctcGVyaW9kIjogNgogICB9CiAgfSwKICAic3BlY192ZXJzaW9uIjogIjEuMCIsCiAgInZlcnNpb24iOiAxMywKICAieC10dWYtb24tY2ktZXhwaXJ5LXBlcmlvZCI6IDE5NywKICAieC10dWYtb24tY2ktc2lnbmluZy1wZXJpb2QiOiA0NgogfQp9";
 export default _default;
-//# sourceMappingURL=tuf-root.d.ts.map

package/dist/trust/tuf-root.js.map

@@ -1 +1 @@
-{"version":3,"file":"tuf-root.js","sourceRoot":"","sources":["../../src/trust/tuf-root.ts"],"names":[],"mappings":"AAAA,0DAA0D;AAC1D,8DAA8D;AAC9D,eAAe,09OAA09O,CAAC"}
+{"version":3,"file":"tuf-root.js","sourceRoot":"","sources":["../../src/trust/tuf-root.ts"],"names":[],"mappings":"AAAA,0DAA0D;AAC1D,8DAA8D;AAC9D,eAAe,09OAA09O,CAAC","sourcesContent":["// Embedded TUF root metadata (base64-encoded 1.root.json)\n// This is the root of trust for bootstrapping the TUF client.\nexport default \"ewogInNpZ25hdHVyZXMiOiBbCiAgewogICAia2V5aWQiOiAiNmYyNjAwODlkNTkyM2RhZjIwMTY2Y2E2NTdjNTQzYWY2MTgzNDZhYjk3MTg4NGE5OTk2MmIwMTk4OGJiZTBjMyIsCiAgICJzaWciOiAiIgogIH0sCiAgewogICAia2V5aWQiOiAiZTcxYTU0ZDU0MzgzNWJhODZhZGFkOTQ2MDM3OWM3NjQxZmI4NzI2ZDE2NGVhNzY2ODAxYTFjNTIyYWJhN2VhMiIsCiAgICJzaWciOiAiMzA0NTAyMjEwMGJiZGRkNDY0ZjgwNjZjZWI4OGJhNzg3Mzc1YzEyY2Q2MzMwNjgwZTA4YzI5MTA3MDNlNjUzOGM3MWNjNzlhZDIwMjIwNTE5MGIwNmU0NTM3ZmU5NjFiM2VmODFmZTY4ZWRjZDAwODljMTlmOTE5YWZlZDQyM2I5YWFmZDcwMDY0MTE1MyIKICB9LAogIHsKICAgImtleWlkIjogIjIyZjRjYWVjNmQ4ZTZmOTU1NWFmNjZiM2Q0YzNjYjA2YTNiYjIzZmRjN2UzOWM5MTZjNjFmNDYyZTZmNTJiMDYiLAogICAic2lnIjogIjMwNDQwMjIwNjkzMDZjZDUyNTdmNzMyYTc0MGMxYWZlNjBhOGU0MzNjNWRlNThlYWZlYWRiZTk5YzMzNmM5YzcxZDE5OGNmODAyMjAwZDc3Mzk1M2FlN2RiYzQ4ZDNlNWJhZDlhNmY2NGJhZmZmMTk2YjdlMmFkNGE1MmExOTUxOTM2N2Q0N2RjMDQyIgogIH0sCiAgewogICAia2V5aWQiOiAiNjE2NDM4MzgxMjViNDQwYjQwZGI2OTQyZjVjYjVhMzFjMGRjMDQzNjgzMTZlYjJhYWE1OGI5NTkwNGE1ODIyMiIsCiAgICJzaWciOiAiMzA0NDAyMjA0ZDIxYTJlYzgwZGY2NmU2MWY2ZmUyOTEyOTUxZGM0N2RmODM2MDM2ZjhjMGFiMTA4MTZkMzc1ZTcxZGJmNzllMDIyMDU0N2FkY2UxYWZkZjA0ZTY3OTRlZmEyMDNkZDUyNjRjNmY3ZTBlZjc4ZTU3ZmU5MzRiMGQyNmNiOTk0ZWVjNzYiCiAgfSwKICB7CiAgICJrZXlpZCI6ICJhNjg3ZTViZjRmYWI4MmIwZWU1OGQ0NmUwNWM5NTM1MTQ1YTJjOWFmYjQ1OGY0M2Q0MmI0NWNhMGZkY2UyYTcwIiwKICAgInNpZyI6ICIzMDQ1MDIyMDYwODI2NDk2NTU3MTQ0ZWIxNjQ5ODkzZWQ1ZjZmNGVhNTQ1MzZmZWIwY2E4MmY4Yjg5YWU2NDFiZTM5NzQzZTUwMjIxMDBhZDcxMThiNWU5ZDQ4MzczMjYyMDZlNDEyZmM2ZGEyOTk5OTI1ZDExMDMyOGE3YzE2NmIwNmM2MjQzMzZjOTNmIgogIH0sCiAgewogICAia2V5aWQiOiAiMTgzZTY0ZjM3NjcwZGMxM2NhMGQyODk5NWEzMDUzZjM3NDA5NTRkZGNlNDQzMjFhNDFlNDY1MzRjZjQ0ZTYzMiIsCiAgICJzaWciOiAiMzA0NjAyMjEwMGQ4MTc5NDM5YzJlNzNlYjBjMTczM2FiZWU3ZmFmODMyZGNhZWE3MjYzZWRjYjQ5MTk4OTFjM2EyNDdmMDU5MjMwMjIxMDBlMWE0MzdlMDc5N2U4MDNmOWI3MmRjOWQyZDkyMTU1YjBhMjI3MGMyNGVmZGQ1ZjRiM2E1ZDhmMGIwZjQzMWE3IgogIH0KIF0sCiAic2lnbmVkIjogewogICJfdHlwZSI6ICJyb290IiwKICAiY29uc2lzdGVudF9zbmFwc2hvdCI6IHRydWUsCiAgImV4cGlyZXMiOiAiMjAyNi0wMS0yMlQxMzowNTo1OVoiLAogICJrZXlzIjogewogICAiMGM4NzQzMmMzYmYwOWZkOTkxODlmZGMzMmZhNWVhZWRmNGU0YTVmYWM3YmFiNzNmYTA0YTJlMGZjNjRhZjZmNSI6IHsKICAgICJrZXlpZF9oYXNoX2FsZ29yaXRobXMiOiBbCiAgICAgInNoYTI1NiIsCiAgICAgInNoYTUxMiIKICAgIF0sCiAgICAia2V5dHlwZSI6ICJlY2RzYSIsCiAgICAia2V5dmFsIjogewogICAgICJwdWJsaWMiOiAiLS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS1cbk1Ga3dFd1lIS29aSXpqMENBUVlJS29aSXpqMERBUWNEUWdBRVdSaUdyNStqKzNKNVNzSCtadHI1bkUySDJ3TzdcbkJWK25PM3M5M2dMY2ExOHFUT3pIWTFvV3lBR0R5a01Tc0dUVUJTdDlEK0FuMEtmS3NEMm1mU000MlE9PVxuLS0tLS1FTkQgUFVCTElDIEtFWS0tLS0tXG4iCiAgICB9LAogICAgInNjaGVtZSI6ICJlY2RzYS1zaGEyLW5pc3RwMjU2IiwKICAgICJ4LXR1Zi1vbi1jaS1vbmxpbmUtdXJpIjogImdjcGttczpwcm9qZWN0cy9zaWdzdG9yZS1yb290LXNpZ25pbmcvbG9jYXRpb25zL2dsb2JhbC9rZXlSaW5ncy9yb290L2NyeXB0b0tleXMvdGltZXN0YW1wL2NyeXB0b0tleVZlcnNpb25zLzEiCiAgIH0sCiAgICIxODNlNjRmMzc2NzBkYzEzY2EwZDI4OTk1YTMwNTNmMzc0MDk1NGRkY2U0NDMyMWE0MWU0NjUzNGNmNDRlNjMyIjogewogICAgImtleXR5cGUiOiAiZWNkc2EiLAogICAgImtleXZhbCI6IHsKICAgICAicHVibGljIjogIi0tLS0tQkVHSU4gUFVCTElDIEtFWS0tLS0tXG5NRmt3RXdZSEtvWkl6ajBDQVFZSUtvWkl6ajBEQVFjRFFnQUVNeHBQT0pDSVo1b3RHNDEwNmZHSnNlRVFpM1Y5XG5wa01ZUTR1eVY5VGoxTTdXSFhJeUxHK2prZnZ1RzBnbFExSlpiUlpaQlYzZ0FSNHNvamRHSElTZW93PT1cbi0tLS0tRU5EIFBVQkxJQyBLRVktLS0tLVxuIgogICAgfSwKICAgICJzY2hlbWUiOiAiZWNkc2Etc2hhMi1uaXN0cDI1NiIsCiAgICAieC10dWYtb24tY2kta2V5b3duZXIiOiAiQGxhbmNlIgogICB9LAogICAiMjJmNGNhZWM2ZDhlNmY5NTU1YWY2NmIzZDRjM2NiMDZhM2JiMjNmZGM3ZTM5YzkxNmM2MWY0NjJlNmY1MmIwNiI6IHsKICAgICJrZXlpZF9oYXNoX2FsZ29yaXRobXMiOiBbCiAgICAgInNoYTI1NiIsCiAgICAgInNoYTUxMiIKICAgIF0sCiAgICAia2V5dHlwZSI6ICJlY2RzYSIsCiAgICAia2V5dmFsIjogewogICAgICJwdWJsaWMiOiAiLS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS1cbk1Ga3dFd1lIS29aSXpqMENBUVlJS29aSXpqMERBUWNEUWdBRXpCelZPbUhDUG9qTVZMU0kzNjRXaWlWOE5QckRcbjZJZ1J4Vmxpc2t6L3YreTNKRVI1bWNWR2NPTmxpRGNXTUM1SjJsZkhtalBOUGhiNEg3eG04THpmU0E9PVxuLS0tLS1FTkQgUFVCTElDIEtFWS0tLS0tXG4iCiAgICB9LAogICAgInNjaGVtZSI6ICJlY2RzYS1zaGEyLW5pc3RwMjU2IiwKICAgICJ4LXR1Zi1vbi1jaS1rZXlvd25lciI6ICJAc2FudGlhZ290b3JyZXMiCiAgIH0sCiAgICI2MTY0MzgzODEyNWI0NDBiNDBkYjY5NDJmNWNiNWEzMWMwZGMwNDM2ODMxNmViMmFhYTU4Yjk1OTA0YTU4MjIyIjogewogICAgImtleWlkX2hhc2hfYWxnb3JpdGhtcyI6IFsKICAgICAic2hhMjU2IiwKICAgICAic2hhNTEyIgogICAgXSwKICAgICJrZXl0eXBlIjogImVjZHNhIiwKICAgICJrZXl2YWwiOiB7CiAgICAgInB1YmxpYyI6ICItLS0tLUJFR0lOIFBVQkxJQyBLRVktLS0tLVxuTUZrd0V3WUhLb1pJemowQ0FRWUlLb1pJemowREFRY0RRZ0FFaW5pa1NzQVFtWWtOZUg1ZVlxL0NuSXpMYWFjT1xueGxTYWF3UURPd3FLeS90Q3F4cTV4eFBTSmMyMUs0V0loczlHeU9rS2Z6dWVZM0dJTHpjTUpaNGNXdz09XG4tLS0tLUVORCBQVUJMSUMgS0VZLS0tLS1cbiIKICAgIH0sCiAgICAic2NoZW1lIjogImVjZHNhLXNoYTItbmlzdHAyNTYiLAogICAgIngtdHVmLW9uLWNpLWtleW93bmVyIjogIkBib2JjYWxsYXdheSIKICAgfSwKICAgImE2ODdlNWJmNGZhYjgyYjBlZTU4ZDQ2ZTA1Yzk1MzUxNDVhMmM5YWZiNDU4ZjQzZDQyYjQ1Y2EwZmRjZTJhNzAiOiB7CiAgICAia2V5aWRfaGFzaF9hbGdvcml0aG1zIjogWwogICAgICJzaGEyNTYiLAogICAgICJzaGE1MTIiCiAgICBdLAogICAgImtleXR5cGUiOiAiZWNkc2EiLAogICAgImtleXZhbCI6IHsKICAgICAicHVibGljIjogIi0tLS0tQkVHSU4gUFVCTElDIEtFWS0tLS0tXG5NRmt3RXdZSEtvWkl6ajBDQVFZSUtvWkl6ajBEQVFjRFFnQUUwZ2hyaDkyTHcxWXIzaWRHVjVXcUN0TURCOEN4XG4rRDhoZEM0dzJaTE5JcGxWUm9WR0xza1lhM2doZU15T2ppSjhrUGkxNWFRMi8vN1Arb2o3VXZKUEd3PT1cbi0tLS0tRU5EIFBVQkxJQyBLRVktLS0tLVxuIgogICAgfSwKICAgICJzY2hlbWUiOiAiZWNkc2Etc2hhMi1uaXN0cDI1NiIsCiAgICAieC10dWYtb24tY2kta2V5b3duZXIiOiAiQGpvc2h1YWdsIgogICB9LAogICAiZTcxYTU0ZDU0MzgzNWJhODZhZGFkOTQ2MDM3OWM3NjQxZmI4NzI2ZDE2NGVhNzY2ODAxYTFjNTIyYWJhN2VhMiI6IHsKICAgICJrZXlpZF9oYXNoX2FsZ29yaXRobXMiOiBbCiAgICAgInNoYTI1NiIsCiAgICAgInNoYTUxMiIKICAgIF0sCiAgICAia2V5dHlwZSI6ICJlY2RzYSIsCiAgICAia2V5dmFsIjogewogICAgICJwdWJsaWMiOiAiLS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS1cbk1Ga3dFd1lIS29aSXpqMENBUVlJS29aSXpqMERBUWNEUWdBRUVYc3ozU1pYRmI4ak1WNDJqNnBKbHlqYmpSOEtcbk4zQndvY2V4cTZMTUliNXFzV0tPUXZMTjE2TlVlZkxjNEhzd09vdW1Sc1ZWYWFqU3BRUzZmb2JrUnc9PVxuLS0tLS1FTkQgUFVCTElDIEtFWS0tLS0tXG4iCiAgICB9LAogICAgInNjaGVtZSI6ICJlY2RzYS1zaGEyLW5pc3RwMjU2IiwKICAgICJ4LXR1Zi1vbi1jaS1rZXlvd25lciI6ICJAbW5tNjc4IgogICB9CiAgfSwKICAicm9sZXMiOiB7CiAgICJyb290IjogewogICAgImtleWlkcyI6IFsKICAgICAiZTcxYTU0ZDU0MzgzNWJhODZhZGFkOTQ2MDM3OWM3NjQxZmI4NzI2ZDE2NGVhNzY2ODAxYTFjNTIyYWJhN2VhMiIsCiAgICAgIjIyZjRjYWVjNmQ4ZTZmOTU1NWFmNjZiM2Q0YzNjYjA2YTNiYjIzZmRjN2UzOWM5MTZjNjFmNDYyZTZmNTJiMDYiLAogICAgICI2MTY0MzgzODEyNWI0NDBiNDBkYjY5NDJmNWNiNWEzMWMwZGMwNDM2ODMxNmViMmFhYTU4Yjk1OTA0YTU4MjIyIiwKICAgICAiYTY4N2U1YmY0ZmFiODJiMGVlNThkNDZlMDVjOTUzNTE0NWEyYzlhZmI0NThmNDNkNDJiNDVjYTBmZGNlMmE3MCIsCiAgICAgIjE4M2U2NGYzNzY3MGRjMTNjYTBkMjg5OTVhMzA1M2YzNzQwOTU0ZGRjZTQ0MzIxYTQxZTQ2NTM0Y2Y0NGU2MzIiCiAgICBdLAogICAgInRocmVzaG9sZCI6IDMKICAgfSwKICAgInNuYXBzaG90IjogewogICAgImtleWlkcyI6IFsKICAgICAiMGM4NzQzMmMzYmYwOWZkOTkxODlmZGMzMmZhNWVhZWRmNGU0YTVmYWM3YmFiNzNmYTA0YTJlMGZjNjRhZjZmNSIKICAgIF0sCiAgICAidGhyZXNob2xkIjogMSwKICAgICJ4LXR1Zi1vbi1jaS1leHBpcnktcGVyaW9kIjogMzY1MCwKICAgICJ4LXR1Zi1vbi1jaS1zaWduaW5nLXBlcmlvZCI6IDM2NQogICB9LAogICAidGFyZ2V0cyI6IHsKICAgICJrZXlpZHMiOiBbCiAgICAgImU3MWE1NGQ1NDM4MzViYTg2YWRhZDk0NjAzNzljNzY0MWZiODcyNmQxNjRlYTc2NjgwMWExYzUyMmFiYTdlYTIiLAogICAgICIyMmY0Y2FlYzZkOGU2Zjk1NTVhZjY2YjNkNGMzY2IwNmEzYmIyM2ZkYzdlMzljOTE2YzYxZjQ2MmU2ZjUyYjA2IiwKICAgICAiNjE2NDM4MzgxMjViNDQwYjQwZGI2OTQyZjVjYjVhMzFjMGRjMDQzNjgzMTZlYjJhYWE1OGI5NTkwNGE1ODIyMiIsCiAgICAgImE2ODdlNWJmNGZhYjgyYjBlZTU4ZDQ2ZTA1Yzk1MzUxNDVhMmM5YWZiNDU4ZjQzZDQyYjQ1Y2EwZmRjZTJhNzAiLAogICAgICIxODNlNjRmMzc2NzBkYzEzY2EwZDI4OTk1YTMwNTNmMzc0MDk1NGRkY2U0NDMyMWE0MWU0NjUzNGNmNDRlNjMyIgogICAgXSwKICAgICJ0aHJlc2hvbGQiOiAzCiAgIH0sCiAgICJ0aW1lc3RhbXAiOiB7CiAgICAia2V5aWRzIjogWwogICAgICIwYzg3NDMyYzNiZjA5ZmQ5OTE4OWZkYzMyZmE1ZWFlZGY0ZTRhNWZhYzdiYWI3M2ZhMDRhMmUwZmM2NGFmNmY1IgogICAgXSwKICAgICJ0aHJlc2hvbGQiOiAxLAogICAgIngtdHVmLW9uLWNpLWV4cGlyeS1wZXJpb2QiOiA3LAogICAgIngtdHVmLW9uLWNpLXNpZ25pbmctcGVyaW9kIjogNgogICB9CiAgfSwKICAic3BlY192ZXJzaW9uIjogIjEuMCIsCiAgInZlcnNpb24iOiAxMywKICAieC10dWYtb24tY2ktZXhwaXJ5LXBlcmlvZCI6IDE5NywKICAieC10dWYtb24tY2ktc2lnbmluZy1wZXJpb2QiOiA0NgogfQp9\";\n"]}

package/dist/trust/tuf.d.ts

@@ -98,4 +98,3 @@ export declare class TrustedRootProvider {
      */
     clearCache(): void;
 }
-//# sourceMappingURL=tuf.d.ts.map

package/dist/trust/tuf.js

@@ -6,7 +6,7 @@
  *
  * Reference: https://github.com/freedomofpress/tuf-browser
  */
-import { Uint8ArrayToString } from "@freedomofpress/crypto-browser";
+import { base64Decode, Uint8ArrayToString } from "@freedomofpress/crypto-browser";
 /**
  * Default configuration for Sigstore production TUF repository
  */
@@ -67,10 +67,7 @@ export class TrustedRootProvider {
         // Import the embedded TUF root metadata (base64-encoded 1.root.json as string)
         // This is the root of trust for TUF, not to be confused with the Sigstore trusted root
         const { default: tufRootBase64 } = await import('./tuf-root.js');
-        // Decode from base64 to get the actual root.json content
-        const decoder = new TextDecoder();
-        const rootBytes = Uint8Array.from(atob(tufRootBase64), c => c.charCodeAt(0));
-        return decoder.decode(rootBytes);
+        return base64Decode(tufRootBase64);
     }
     /**
      * Check if cached trusted root is still valid

package/dist/trust/tuf.js.map

@@ -1 +1 @@
-{"version":3,"file":"tuf.js","sourceRoot":"","sources":["../../src/trust/tuf.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AAmDpE;;GAEG;AACH,MAAM,cAAc,GAAG;IACrB,WAAW,EAAE,oCAAoC;IACjD,aAAa,EAAE,4CAA4C;IAC3D,SAAS,EAAE,WAAW;IACtB,iBAAiB,EAAE,mBAAmB;IACtC,QAAQ,EAAE,OAAO,EAAE,SAAS;CAC7B,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,mBAAmB;IAa9B,YAAY,UAAsC,EAAE;QAClD,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,cAAc,CAAC,WAAW,CAAC;QACtE,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,WAAW,GAAG,CAAC;QAC/E,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,cAAc,CAAC,aAAa,CAAC;QAC5E,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,aAAa,GAAG,CAAC;QACvF,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACvC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,cAAc,CAAC,SAAS,CAAC;QAC/D,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,IAAI,cAAc,CAAC,iBAAiB,CAAC;QACvF,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,cAAc,CAAC,QAAQ,CAAC;QAC5D,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,KAAK,CAAC;IACpD,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,aAAa;QACzB,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAC;YAElE,4BAA4B;YAC5B,MAAM,YAAY,GAAG,IAAI,CAAC,WAAW,IAAI,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;YAErE,IAAI,CAAC,SAAS,GAAG,IAAI,SAAS,CAC5B,IAAI,CAAC,WAAW,EAChB,YAAY,EACZ,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,aAAa,EAClB,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CACpC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,oCAAoC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC7F,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,cAAc;QAC1B,+EAA+E;QAC/E,uFAAuF;QACvF,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;QAEjE,yDAAyD;QACzD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;QAClC,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7E,OAAO,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACnC,CAAC;IAED;;OAEG;IACK,YAAY;QAClB,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YAC7C,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC;IACrD,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,cAAc;QAClB,oCAAoC;QACpC,IAAI,IAAI,CAAC,YAAY,EAAE,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YAC3C,OAAO,IAAI,CAAC,UAAU,CAAC;QACzB,CAAC;QAED,kCAAkC;QAClC,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QAE3B,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,CAAC;QAED,IAAI,CAAC;YACH,2DAA2D;YAC3D,wEAAwE;YACxE,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC;YAEjC,wCAAwC;YACxC,2EAA2E;YAC3E,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;YAEjF,8BAA8B;YAC9B,MAAM,eAAe,GAAG,kBAAkB,CAAC,IAAI,UAAU,CAAC,iBAAiB,CAAC,CAAC,CAAC;YAC9E,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAgB,CAAC;YAE/D,mBAAmB;YACnB,IAAI,CAAC,UAAU,GAAG,WAAW,CAAC;YAC9B,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAEjC,OAAO,WAAW,CAAC;QACrB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,yCAAyC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAClG,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,kBAAkB;QACtB,cAAc;QACd,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;QAC5B,IAAI,CAAC,cAAc,GAAG,SAAS,CAAC;QAEhC,mBAAmB;QACnB,OAAO,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;IACrC,CAAC;IAED;;;OAGG;IACH,UAAU;QACR,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;QAC5B,IAAI,CAAC,cAAc,GAAG,SAAS,CAAC;IAClC,CAAC;CACF"}
+{"version":3,"file":"tuf.js","sourceRoot":"","sources":["../../src/trust/tuf.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AAoDlF;;GAEG;AACH,MAAM,cAAc,GAAG;IACrB,WAAW,EAAE,oCAAoC;IACjD,aAAa,EAAE,4CAA4C;IAC3D,SAAS,EAAE,WAAW;IACtB,iBAAiB,EAAE,mBAAmB;IACtC,QAAQ,EAAE,OAAO,EAAE,SAAS;CAC7B,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,mBAAmB;IAa9B,YAAY,UAAsC,EAAE;QAClD,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,cAAc,CAAC,WAAW,CAAC;QACtE,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,WAAW,GAAG,CAAC;QAC/E,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,cAAc,CAAC,aAAa,CAAC;QAC5E,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,aAAa,GAAG,CAAC;QACvF,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACvC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,cAAc,CAAC,SAAS,CAAC;QAC/D,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,IAAI,cAAc,CAAC,iBAAiB,CAAC;QACvF,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,cAAc,CAAC,QAAQ,CAAC;QAC5D,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,KAAK,CAAC;IACpD,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,aAAa;QACzB,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAC;YAElE,4BAA4B;YAC5B,MAAM,YAAY,GAAG,IAAI,CAAC,WAAW,IAAI,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;YAErE,IAAI,CAAC,SAAS,GAAG,IAAI,SAAS,CAC5B,IAAI,CAAC,WAAW,EAChB,YAAY,EACZ,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,aAAa,EAClB,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CACpC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,oCAAoC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC7F,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,cAAc;QAC1B,+EAA+E;QAC/E,uFAAuF;QACvF,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;QAEjE,OAAO,YAAY,CAAC,aAAa,CAAC,CAAC;IACrC,CAAC;IAED;;OAEG;IACK,YAAY;QAClB,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YAC7C,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC;IACrD,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,cAAc;QAClB,oCAAoC;QACpC,IAAI,IAAI,CAAC,YAAY,EAAE,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YAC3C,OAAO,IAAI,CAAC,UAAU,CAAC;QACzB,CAAC;QAED,kCAAkC;QAClC,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QAE3B,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,CAAC;QAED,IAAI,CAAC;YACH,2DAA2D;YAC3D,wEAAwE;YACxE,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC;YAEjC,wCAAwC;YACxC,2EAA2E;YAC3E,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;YAEjF,8BAA8B;YAC9B,MAAM,eAAe,GAAG,kBAAkB,CAAC,IAAI,UAAU,CAAC,iBAAiB,CAAC,CAAC,CAAC;YAC9E,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAgB,CAAC;YAE/D,mBAAmB;YACnB,IAAI,CAAC,UAAU,GAAG,WAAW,CAAC;YAC9B,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAEjC,OAAO,WAAW,CAAC;QACrB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,yCAAyC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAClG,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,kBAAkB;QACtB,cAAc;QACd,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;QAC5B,IAAI,CAAC,cAAc,GAAG,SAAS,CAAC;QAEhC,mBAAmB;QACnB,OAAO,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;IACrC,CAAC;IAED;;;OAGG;IACH,UAAU;QACR,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;QAC5B,IAAI,CAAC,cAAc,GAAG,SAAS,CAAC;IAClC,CAAC;CACF","sourcesContent":["/*\n * TUF (The Update Framework) integration for trusted root management\n *\n * Provides secure updates for Sigstore trusted root metadata using TUF.\n * Uses tuf-browser for browser-compatible TUF client functionality.\n *\n * Reference: https://github.com/freedomofpress/tuf-browser\n */\n\nimport { base64Decode, Uint8ArrayToString } from \"@freedomofpress/crypto-browser\";\nimport type { TUFClient } from \"@freedomofpress/tuf-browser\";\n\nimport { TrustedRoot } from \"../interfaces.js\";\n\n/**\n * Options for TrustedRootProvider configuration\n */\nexport interface TrustedRootProviderOptions {\n  /**\n   * TUF repository URL for metadata\n   * Default: Sigstore production TUF repository\n   */\n  metadataUrl?: string;\n\n  /**\n   * Target base URL for fetching target files\n   * If not specified, uses the same as metadataUrl\n   */\n  targetBaseUrl?: string;\n\n  /**\n   * Initial root metadata (1.root.json content)\n   * If not provided, will use embedded default\n   */\n  initialRoot?: string;\n\n  /**\n   * Namespace for TUF cache storage\n   * Default: 'tuf-cache'\n   */\n  namespace?: string;\n\n  /**\n   * Name of the trusted root target file\n   * Default: 'trusted_root.json'\n   */\n  trustedRootTarget?: string;\n\n  /**\n   * Cache TTL in milliseconds\n   * Default: 1 hour (3600000 ms)\n   */\n  cacheTTL?: number;\n\n  /**\n   * Disable persistent caching (use in-memory only)\n   * Default: false\n   */\n  disableCache?: boolean;\n}\n\n/**\n * Default configuration for Sigstore production TUF repository\n */\nconst DEFAULT_CONFIG = {\n  metadataUrl: 'https://tuf-repo-cdn.sigstore.dev/',\n  targetBaseUrl: 'https://tuf-repo-cdn.sigstore.dev/targets/',\n  namespace: 'tuf-cache',\n  trustedRootTarget: 'trusted_root.json',\n  cacheTTL: 3600000, // 1 hour\n};\n\n/**\n * Provides Sigstore trusted root via TUF for secure updates\n *\n * This class manages fetching and caching of Sigstore trusted root metadata\n * using The Update Framework (TUF) for secure, verified updates.\n *\n * Example usage:\n * ```typescript\n * const provider = new TrustedRootProvider();\n * const trustedRoot = await provider.getTrustedRoot();\n * ```\n */\nexport class TrustedRootProvider {\n  private metadataUrl: string;\n  private targetBaseUrl?: string;\n  private initialRoot?: string;\n  private namespace: string;\n  private trustedRootTarget: string;\n  private cacheTTL: number;\n  private disableCache: boolean;\n\n  private tufClient?: TUFClient;\n  private cachedRoot?: TrustedRoot;\n  private cacheTimestamp?: number;\n\n  constructor(options: TrustedRootProviderOptions = {}) {\n    const metadataUrl = options.metadataUrl || DEFAULT_CONFIG.metadataUrl;\n    this.metadataUrl = metadataUrl.endsWith('/') ? metadataUrl : `${metadataUrl}/`;\n    const targetBaseUrl = options.targetBaseUrl || DEFAULT_CONFIG.targetBaseUrl;\n    this.targetBaseUrl = targetBaseUrl.endsWith('/') ? targetBaseUrl : `${targetBaseUrl}/`;\n    this.initialRoot = options.initialRoot;\n    this.namespace = options.namespace || DEFAULT_CONFIG.namespace;\n    this.trustedRootTarget = options.trustedRootTarget || DEFAULT_CONFIG.trustedRootTarget;\n    this.cacheTTL = options.cacheTTL ?? DEFAULT_CONFIG.cacheTTL;\n    this.disableCache = options.disableCache ?? false;\n  }\n\n  /**\n   * Initialize the TUF client\n   * Lazy initialization to avoid loading TUF client until needed\n   */\n  private async initTUFClient(): Promise<void> {\n    if (this.tufClient) {\n      return;\n    }\n\n    try {\n      const { TUFClient } = await import('@freedomofpress/tuf-browser');\n\n      // Get initial root metadata\n      const rootMetadata = this.initialRoot || await this.getDefaultRoot();\n\n      this.tufClient = new TUFClient(\n        this.metadataUrl,\n        rootMetadata,\n        this.namespace,\n        this.targetBaseUrl,\n        { disableCache: this.disableCache }\n      );\n    } catch (error) {\n      throw new Error(\n        `Failed to initialize TUF client: ${error instanceof Error ? error.message : String(error)}`\n      );\n    }\n  }\n\n  /**\n   * Get the default embedded root metadata\n   * Returns the TUF root.json that bootstraps the TUF client\n   */\n  private async getDefaultRoot(): Promise<string> {\n    // Import the embedded TUF root metadata (base64-encoded 1.root.json as string)\n    // This is the root of trust for TUF, not to be confused with the Sigstore trusted root\n    const { default: tufRootBase64 } = await import('./tuf-root.js');\n\n    return base64Decode(tufRootBase64);\n  }\n\n  /**\n   * Check if cached trusted root is still valid\n   */\n  private isCacheValid(): boolean {\n    if (!this.cachedRoot || !this.cacheTimestamp) {\n      return false;\n    }\n\n    const now = Date.now();\n    return (now - this.cacheTimestamp) < this.cacheTTL;\n  }\n\n  /**\n   * Get the Sigstore trusted root metadata\n   * Uses TUF to securely fetch and verify the trusted root\n   *\n   * @returns Promise<TrustedRoot> The verified trusted root metadata\n   * @throws Error if TUF verification fails or root cannot be fetched\n   */\n  async getTrustedRoot(): Promise<TrustedRoot> {\n    // Return cached root if still valid\n    if (this.isCacheValid() && this.cachedRoot) {\n      return this.cachedRoot;\n    }\n\n    // Initialize TUF client if needed\n    await this.initTUFClient();\n\n    if (!this.tufClient) {\n      throw new Error('TUF client not initialized');\n    }\n\n    try {\n      // Update TUF metadata (root, timestamp, snapshot, targets)\n      // This must be called before getTarget() to populate the metadata cache\n      await this.tufClient.updateTUF();\n\n      // Fetch the trusted root target via TUF\n      // TUF will handle all verification (signatures, rollback protection, etc.)\n      const trustedRootBuffer = await this.tufClient.getTarget(this.trustedRootTarget);\n\n      // Parse the trusted root JSON\n      const trustedRootJson = Uint8ArrayToString(new Uint8Array(trustedRootBuffer));\n      const trustedRoot = JSON.parse(trustedRootJson) as TrustedRoot;\n\n      // Cache the result\n      this.cachedRoot = trustedRoot;\n      this.cacheTimestamp = Date.now();\n\n      return trustedRoot;\n    } catch (error) {\n      throw new Error(\n        `Failed to fetch trusted root via TUF: ${error instanceof Error ? error.message : String(error)}`\n      );\n    }\n  }\n\n  /**\n   * Manually refresh the trusted root from TUF\n   * Bypasses cache and forces a fresh fetch\n   *\n   * @returns Promise<TrustedRoot> The updated trusted root metadata\n   */\n  async refreshTrustedRoot(): Promise<TrustedRoot> {\n    // Clear cache\n    this.cachedRoot = undefined;\n    this.cacheTimestamp = undefined;\n\n    // Fetch fresh root\n    return await this.getTrustedRoot();\n  }\n\n  /**\n   * Clear the cached trusted root\n   * Next call to getTrustedRoot() will fetch fresh data\n   */\n  clearCache(): void {\n    this.cachedRoot = undefined;\n    this.cacheTimestamp = undefined;\n  }\n}\n"]}

package/dist/x509/cert.d.ts

@@ -111,4 +111,3 @@ export declare class X509Certificate {
     private get extensionsObj();
     private parseDistinguishedName;
 }
-//# sourceMappingURL=cert.d.ts.map

package/dist/x509/cert.js

@@ -13,7 +13,7 @@ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
 limitations under the License.
 */
-import { ASN1Obj, importKey, toDER, Uint8ArrayToBase64, uint8ArrayEqual, verifySignature, } from "@freedomofpress/crypto-browser";
+import { ASN1Obj, importKey, toDER, uint8ArrayEqual, Uint8ArrayToBase64, Uint8ArrayToString, verifySignature } from "@freedomofpress/crypto-browser";
 import { KeyTypes } from "../interfaces.js";
 import { DEFAULT_HASH_ALGORITHM, ECDSA_CURVE_NAMES, ECDSA_SIGNATURE_ALGOS, OID_RSASSA_PSS, RSA_SIGNATURE_ALGOS, SHA2_HASH_ALGOS } from "../oid.js";
 import { X509AuthorityKeyIDExtension, X509BasicConstraintsExtension, X509BuildConfigDigestExtension, X509BuildConfigURIExtension, X509BuildSignerDigestExtension, X509BuildSignerURIExtension, X509BuildTriggerExtension, X509Extension, X509FulcioIssuerV1, X509FulcioIssuerV2, X509GitHubWorkflowNameExtension, X509GitHubWorkflowRefExtension, X509GitHubWorkflowRepositoryExtension, X509GitHubWorkflowSHAExtension, X509GitHubWorkflowTriggerExtension, X509KeyUsageExtension, X509RunInvocationURIExtension, X509RunnerEnvironmentExtension, X509SCTExtension, X509SourceRepositoryDigestExtension, X509SourceRepositoryIdentifierExtension, X509SourceRepositoryOwnerIdentifierExtension, X509SourceRepositoryOwnerURIExtension, X509SourceRepositoryRefExtension, X509SourceRepositoryURIExtension, X509SourceRepositoryVisibilityExtension, X509SubjectAlternativeNameExtension, X509SubjectKeyIDExtension, } from "./ext.js";
@@ -426,7 +426,7 @@ export class X509Certificate {
                         const oid = oidObj.toOID();
                         const attrName = DN_OID_TO_NAME[oid];
                         if (attrName) {
-                            const value = new TextDecoder().decode(valueObj.value);
+                            const value = Uint8ArrayToString(valueObj.value);
                             result.set(attrName, value);
                         }
                     }

package/dist/x509/cert.js.map

@@ -1 +1 @@
-{"version":3,"file":"cert.js","sourceRoot":"","sources":["../../src/x509/cert.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;EAcE;AACF,OAAO,EACL,OAAO,EACP,SAAS,EACT,KAAK,EACL,kBAAkB,EAClB,eAAe,EACf,eAAe,GAChB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,cAAc,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AACnJ,OAAO,EACL,2BAA2B,EAC3B,6BAA6B,EAC7B,8BAA8B,EAC9B,2BAA2B,EAC3B,8BAA8B,EAC9B,2BAA2B,EAC3B,yBAAyB,EACzB,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,+BAA+B,EAC/B,8BAA8B,EAC9B,qCAAqC,EACrC,8BAA8B,EAC9B,kCAAkC,EAClC,qBAAqB,EACrB,6BAA6B,EAC7B,8BAA8B,EAC9B,gBAAgB,EAChB,mCAAmC,EACnC,uCAAuC,EACvC,4CAA4C,EAC5C,qCAAqC,EACrC,gCAAgC,EAChC,gCAAgC,EAChC,uCAAuC,EACvC,mCAAmC,EACnC,yBAAyB,GAC1B,MAAM,UAAU,CAAC;AAElB,gCAAgC;AAChC,MAAM,4BAA4B,GAAG,WAAW,CAAC;AACjD,MAAM,uBAAuB,GAAG,WAAW,CAAC;AAC5C,MAAM,8BAA8B,GAAG,WAAW,CAAC;AACnD,MAAM,+BAA+B,GAAG,WAAW,CAAC;AACpD,MAAM,8BAA8B,GAAG,WAAW,CAAC;AAEnD,2BAA2B;AAC3B,MAAM,CAAC,MAAM,iBAAiB,GAAG,yBAAyB,CAAC;AAE3D,4CAA4C;AAC5C,MAAM,kBAAkB,GAAG,SAAS,CAAC;AACrC,MAAM,cAAc,GAAG,SAAS,CAAC;AACjC,MAAM,eAAe,GAAG,SAAS,CAAC;AAClC,MAAM,YAAY,GAAG,SAAS,CAAC;AAC/B,MAAM,mBAAmB,GAAG,UAAU,CAAC;AACvC,MAAM,0BAA0B,GAAG,UAAU,CAAC;AAE9C,MAAM,cAAc,GAA2B;IAC7C,CAAC,kBAAkB,CAAC,EAAE,IAAI;IAC1B,CAAC,cAAc,CAAC,EAAE,GAAG;IACrB,CAAC,eAAe,CAAC,EAAE,GAAG;IACtB,CAAC,YAAY,CAAC,EAAE,IAAI;IACpB,CAAC,mBAAmB,CAAC,EAAE,GAAG;IAC1B,CAAC,0BAA0B,CAAC,EAAE,IAAI;CACnC,CAAC;AAEF,wBAAwB;AACxB,gEAAgE;AAChE,MAAM,CAAC,MAAM,8BAA8B,GAAG,uBAAuB,CAAC;AACtE,MAAM,CAAC,MAAM,qCAAqC,GAAG,uBAAuB,CAAC;AAC7E,MAAM,CAAC,MAAM,iCAAiC,GAAG,uBAAuB,CAAC;AACzE,MAAM,CAAC,MAAM,kCAAkC,GAAG,uBAAuB,CAAC;AAC1E,MAAM,CAAC,MAAM,wCAAwC,GAAG,uBAAuB,CAAC;AAChF,MAAM,CAAC,MAAM,iCAAiC,GAAG,uBAAuB,CAAC;AACzE,MAAM,CAAC,MAAM,uBAAuB,GAAG,uBAAuB,CAAC;AAC/D,MAAM,CAAC,MAAM,8BAA8B,GAAG,uBAAuB,CAAC;AACtE,MAAM,CAAC,MAAM,8BAA8B,GAAG,uBAAuB,CAAC;AACtE,MAAM,CAAC,MAAM,iCAAiC,GAAG,wBAAwB,CAAC;AAC1E,MAAM,CAAC,MAAM,gCAAgC,GAAG,wBAAwB,CAAC;AACzE,MAAM,CAAC,MAAM,mCAAmC,GAAG,wBAAwB,CAAC;AAC5E,MAAM,CAAC,MAAM,sCAAsC,GAAG,wBAAwB,CAAC;AAC/E,MAAM,CAAC,MAAM,mCAAmC,GAAG,wBAAwB,CAAC;AAC5E,MAAM,CAAC,MAAM,0CAA0C,GAAG,wBAAwB,CAAC;AACnF,MAAM,CAAC,MAAM,yCAAyC,GAAG,wBAAwB,CAAC;AAClF,MAAM,CAAC,MAAM,gDAAgD,GAAG,wBAAwB,CAAC;AACzF,MAAM,CAAC,MAAM,8BAA8B,GAAG,wBAAwB,CAAC;AACvE,MAAM,CAAC,MAAM,iCAAiC,GAAG,wBAAwB,CAAC;AAC1E,MAAM,CAAC,MAAM,2BAA2B,GAAG,wBAAwB,CAAC;AACpE,MAAM,CAAC,MAAM,gCAAgC,GAAG,wBAAwB,CAAC;AACzE,MAAM,CAAC,MAAM,0CAA0C,GAAG,wBAAwB,CAAC;AAEnF,MAAM,OAAO,eAAe;IAG1B,YAAY,IAAa;QACvB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAEM,MAAM,CAAC,KAAK,CAAC,IAAyB;QAC3C,MAAM,GAAG,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC1D,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACtC,OAAO,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IAED,IAAI,cAAc;QAChB,OAAO,IAAI,CAAC,iBAAiB,CAAC;IAChC,CAAC;IAED,IAAI,OAAO;QACT,0EAA0E;QAC1E,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;QAChD,OAAO,IAAI,CAAC,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;IAC5C,CAAC;IAED,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC;IACpC,CAAC;IAED,IAAI,SAAS;QACX,0DAA0D;QAC1D,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC3C,CAAC;IAED,IAAI,QAAQ;QACV,0DAA0D;QAC1D,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC3C,CAAC;IAED,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;IAC9B,CAAC;IAED,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;IAC/B,CAAC;IAED;;;;OAIG;IACH,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACrD,CAAC;IAED;;;;OAIG;IACH,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACtD,CAAC;IAED,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,uBAAuB,CAAC,KAAK,EAAE,CAAC;IAC9C,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,eAAe,CAAC,OAAgB,EAAE,MAAgB;QAC7D,MAAM,SAAS,GAAG,IAAI,CAAC,uBAAuB,CAAC,KAAK,EAAE,CAAC;QACvD,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QAC5C,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;QAElD,gFAAgF;QAChF,MAAM,QAAQ,GAAG,YAAY,KAAK,sBAAsB,CAAC;QACzD,MAAM,WAAW,GAAG,YAAY,KAAK,cAAc,CAAC;QAEpD,IAAI,WAAW,EAAE,CAAC;YAChB,sFAAsF;YACtF,MAAM,IAAI,KAAK,CACb,0EAA0E;gBAC1E,kGAAkG,CACnG,CAAC;QACJ,CAAC;QAED,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,IAAI,GAAG,OAAO,IAAI,sBAAsB,CAAC;YAC/C,kFAAkF;YAClF,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC;YAC/C,OAAO,SAAS,CAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAC;QACxE,CAAC;aAAM,CAAC;YACN,qDAAqD;YACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;YAC/C,MAAM,KAAK,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;YAC1C,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,KAAK,CAAC,4BAA4B,QAAQ,EAAE,CAAC,CAAC;YAC1D,CAAC;YACD,OAAO,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,EAAE,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IAED,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,eAAe,EAAE,CAAC;IAChC,CAAC;IAED,IAAI,kBAAkB;QACpB,MAAM,GAAG,GAAW,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;QAC/D,OAAO,qBAAqB,CAAC,GAAG,CAAC,IAAI,mBAAmB,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,wBAAwB,EAAE,CAAC;IACnG,CAAC;IAED,IAAI,qBAAqB;QACvB,OAAO,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;IACpD,CAAC;IAED;;;OAGG;IACK,wBAAwB;QAC9B,MAAM,SAAS,GAAG,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;QAC7D,IAAI,SAAS,KAAK,cAAc,EAAE,CAAC;YACjC,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,mFAAmF;QACnF,MAAM,MAAM,GAAG,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxC,OAAO,sBAAsB,CAAC;QAChC,CAAC;QAED,8CAA8C;QAC9C,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACtC,IAAI,cAAc,IAAI,cAAc,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrD,8DAA8D;YAC9D,MAAM,UAAU,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC1C,IAAI,UAAU,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC7C,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;gBAC3C,OAAO,eAAe,CAAC,OAAO,CAAC,IAAI,sBAAsB,CAAC;YAC5D,CAAC;QACH,CAAC;QAED,OAAO,sBAAsB,CAAC;IAChC,CAAC;IAED,IAAI,cAAc;QAChB,qEAAqE;QACrE,OAAO,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAClD,CAAC;IAED,IAAI,cAAc;QAChB,MAAM,GAAG,GAAG,IAAI,CAAC,iBAAiB,CAAC;QACnC,OAAO,GAAG,EAAE,GAAG,IAAI,GAAG,EAAE,UAAU,CAAC;IACrC,CAAC;IAED,IAAI,UAAU;QACZ,uEAAuE;QACvE,uBAAuB;QACvB,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3C,OAAO,MAAM,EAAE,IAAI,IAAI,0BAA0B,CAAC,EAAE,CAAC;IACvD,CAAC;IAED,IAAI,WAAW;QACb,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,uBAAuB,CAAC,CAAC;QACxD,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1D,CAAC;IAED,IAAI,mBAAmB;QACrB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,+BAA+B,CAAC,CAAC;QAChE,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,6BAA6B,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAClE,CAAC;IAED,IAAI,iBAAiB;QACnB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,8BAA8B,CAAC,CAAC;QAC/D,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,mCAAmC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACxE,CAAC;IAED,IAAI,iBAAiB;QACnB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,8BAA8B,CAAC,CAAC;QAC/D,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,2BAA2B,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAChE,CAAC;IAED,IAAI,eAAe;QACjB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,4BAA4B,CAAC,CAAC;QAC7D,OAAO,GAAG;YACR,CAAC,CAAC,IAAI,yBAAyB,CAAC,GAAG,CAAC;YACpC,CAAC,CAAC,0BAA0B,CAAC,SAAS,CAAC;IAC3C,CAAC;IAED,IAAI,MAAM;QACR,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,iBAAiB,CAAC,CAAC;QAClD,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACrD,CAAC;IAED,IAAI,iBAAiB;QACnB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,8BAA8B,CAAC,CAAC;QAC/D,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvD,CAAC;IAED,IAAI,iBAAiB;QACnB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,8BAA8B,CAAC,CAAC;QAC/D,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvD,CAAC;IAED,IAAI,wBAAwB;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,qCAAqC,CAAC,CAAC;QACtE,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,kCAAkC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvE,CAAC;IAED,IAAI,oBAAoB;QACtB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,iCAAiC,CAAC,CAAC;QAClE,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,8BAA8B,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACnE,CAAC;IAED,IAAI,qBAAqB;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,kCAAkC,CAAC,CAAC;QACnE,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,+BAA+B,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACpE,CAAC;IAED,IAAI,2BAA2B;QAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,wCAAwC,CAAC,CAAC;QACzE,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,qCAAqC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1E,CAAC;IAED,IAAI,oBAAoB;QACtB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,iCAAiC,CAAC,CAAC;QAClE,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,8BAA8B,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACnE,CAAC;IAED,IAAI,iBAAiB;QACnB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,8BAA8B,CAAC,CAAC;QAC/D,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,2BAA2B,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAChE,CAAC;IAED,IAAI,oBAAoB;QACtB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,iCAAiC,CAAC,CAAC;QAClE,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,8BAA8B,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACnE,CAAC;IAED,IAAI,oBAAoB;QACtB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,gCAAgC,CAAC,CAAC;QACjE,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,8BAA8B,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACnE,CAAC;IAED,IAAI,sBAAsB;QACxB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,mCAAmC,CAAC,CAAC;QACpE,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,gCAAgC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACrE,CAAC;IAED,IAAI,yBAAyB;QAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,sCAAsC,CAAC,CAAC;QACvE,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,mCAAmC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACxE,CAAC;IAED,IAAI,sBAAsB;QACxB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,mCAAmC,CAAC,CAAC;QACpE,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,gCAAgC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACrE,CAAC;IAED,IAAI,6BAA6B;QAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,0CAA0C,CAAC,CAAC;QAC3E,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,uCAAuC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5E,CAAC;IAED,IAAI,2BAA2B;QAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,yCAAyC,CAAC,CAAC;QAC1E,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,qCAAqC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1E,CAAC;IAED,IAAI,kCAAkC;QACpC,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,gDAAgD,CAAC,CAAC;QACjF,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,4CAA4C,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACjF,CAAC;IAED,IAAI,iBAAiB;QACnB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,8BAA8B,CAAC,CAAC;QAC/D,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,2BAA2B,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAChE,CAAC;IAED,IAAI,oBAAoB;QACtB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,iCAAiC,CAAC,CAAC;QAClE,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,8BAA8B,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACnE,CAAC;IAED,IAAI,eAAe;QACjB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,2BAA2B,CAAC,CAAC;QAC5D,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,yBAAyB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9D,CAAC;IAED,IAAI,mBAAmB;QACrB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,gCAAgC,CAAC,CAAC;QACjE,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,6BAA6B,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAClE,CAAC;IAED,IAAI,6BAA6B;QAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,0CAA0C,CAAC,CAAC;QAC3E,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,uCAAuC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5E,CAAC;IAED,IAAI,IAAI;QACN,MAAM,EAAE,GAAG,IAAI,CAAC,mBAAmB,EAAE,IAAI,IAAI,KAAK,CAAC;QAEnD,gEAAgE;QAChE,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,OAAO,EAAE,IAAI,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC;QAC5C,CAAC;QAED,OAAO,EAAE,CAAC;IACZ,CAAC;IAEM,SAAS,CAAC,GAAW;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QACpC,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAClD,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,iBAAmC;QACrD,yEAAyE;QACzE,MAAM,SAAS,GAAG,IAAI,CAAC,qBAAqB,CAAC;QAC7C,MAAM,QAAQ,GAAG,SAAS,KAAK,cAAc,CAAC;QAE9C,sFAAsF;QACtF,MAAM,OAAO,GAAG,QAAQ;YACtB,CAAC,CAAC,IAAI,CAAC,wBAAwB,EAAE;YACjC,CAAC,CAAC,CAAC,mBAAmB,CAAC,SAAS,CAAC,IAAI,qBAAqB,CAAC,SAAS,CAAC,CAAC,CAAC;QAEzE,+FAA+F;QAC/F,uFAAuF;QACvF,MAAM,YAAY,GAAG,iBAAiB;YACpC,CAAC,CAAC,MAAM,iBAAiB,CAAC,eAAe,CAAC,OAAO,EAAE,QAAQ,CAAC;YAC5D,CAAC,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAElD,OAAO,MAAM,eAAe,CAC1B,YAAY,EACZ,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,EAC3B,IAAI,CAAC,cAAc,EACnB,IAAI,CAAC,kBAAkB,CACxB,CAAC;IACJ,CAAC;IAEM,YAAY,CAAC,IAAU;QAC5B,OAAO,IAAI,CAAC,SAAS,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC;IACzD,CAAC;IAEM,MAAM,CAAC,KAAsB;QAClC,OAAO,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IAChE,CAAC;IAED,sDAAsD;IAC/C,KAAK;QACV,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;QAClC,OAAO,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACtC,CAAC;IAEO,aAAa,CAAC,GAAW;QAC/B,0EAA0E;QAC1E,oCAAoC;QACpC,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC;IACpE,CAAC;IAED,6EAA6E;IAC7E,2EAA2E;IAC3E,uBAAuB;IACvB,qDAAqD;IAErD,yDAAyD;IACzD,IAAY,iBAAiB;QAC3B,kEAAkE;QAClE,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;IAED,yDAAyD;IACzD,IAAY,qBAAqB;QAC/B,uEAAuE;QACvE,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;IAED,yDAAyD;IACzD,IAAY,iBAAiB;QAC3B,kEAAkE;QAClE,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;IAED,yDAAyD;IACzD,IAAY,UAAU;QACpB,8DAA8D;QAC9D,OAAO,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;IAED,yDAAyD;IACzD,IAAY,eAAe;QACzB,oEAAoE;QACpE,OAAO,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;IAED,yDAAyD;IACzD,IAAY,SAAS;QACnB,8DAA8D;QAC9D,OAAO,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;IAED,yDAAyD;IACzD,IAAY,WAAW;QACrB,8DAA8D;QAC9D,OAAO,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;IAED,yDAAyD;IACzD,IAAY,UAAU;QACpB,8DAA8D;QAC9D,OAAO,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;IAED,yDAAyD;IACzD,IAAY,uBAAuB;QACjC,6EAA6E;QAC7E,OAAO,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;IAED,+EAA+E;IAC/E,sDAAsD;IACtD,yDAAyD;IACzD,IAAY,aAAa;QACvB,OAAO,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAC9C,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAChC,CAAC;IACJ,CAAC;IAED,oEAAoE;IACpE,oEAAoE;IACpE,6CAA6C;IACrC,sBAAsB,CAAC,KAAc;QAC3C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;QAEzC,gEAAgE;QAChE,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;YAC7B,iEAAiE;YACjE,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;gBAC3B,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;oBACzB,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;oBAC3B,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;oBAE7B,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC;wBACvB,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC;wBAC3B,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;wBACrC,IAAI,QAAQ,EAAE,CAAC;4BACb,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;4BACvD,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;wBAC9B,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}
+{"version":3,"file":"cert.js","sourceRoot":"","sources":["../../src/x509/cert.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;EAcE;AACF,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,eAAe,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAErJ,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,cAAc,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AACnJ,OAAO,EACL,2BAA2B,EAC3B,6BAA6B,EAC7B,8BAA8B,EAC9B,2BAA2B,EAC3B,8BAA8B,EAC9B,2BAA2B,EAC3B,yBAAyB,EACzB,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,+BAA+B,EAC/B,8BAA8B,EAC9B,qCAAqC,EACrC,8BAA8B,EAC9B,kCAAkC,EAClC,qBAAqB,EACrB,6BAA6B,EAC7B,8BAA8B,EAC9B,gBAAgB,EAChB,mCAAmC,EACnC,uCAAuC,EACvC,4CAA4C,EAC5C,qCAAqC,EACrC,gCAAgC,EAChC,gCAAgC,EAChC,uCAAuC,EACvC,mCAAmC,EACnC,yBAAyB,GAC1B,MAAM,UAAU,CAAC;AAElB,gCAAgC;AAChC,MAAM,4BAA4B,GAAG,WAAW,CAAC;AACjD,MAAM,uBAAuB,GAAG,WAAW,CAAC;AAC5C,MAAM,8BAA8B,GAAG,WAAW,CAAC;AACnD,MAAM,+BAA+B,GAAG,WAAW,CAAC;AACpD,MAAM,8BAA8B,GAAG,WAAW,CAAC;AAEnD,2BAA2B;AAC3B,MAAM,CAAC,MAAM,iBAAiB,GAAG,yBAAyB,CAAC;AAE3D,4CAA4C;AAC5C,MAAM,kBAAkB,GAAG,SAAS,CAAC;AACrC,MAAM,cAAc,GAAG,SAAS,CAAC;AACjC,MAAM,eAAe,GAAG,SAAS,CAAC;AAClC,MAAM,YAAY,GAAG,SAAS,CAAC;AAC/B,MAAM,mBAAmB,GAAG,UAAU,CAAC;AACvC,MAAM,0BAA0B,GAAG,UAAU,CAAC;AAE9C,MAAM,cAAc,GAA2B;IAC7C,CAAC,kBAAkB,CAAC,EAAE,IAAI;IAC1B,CAAC,cAAc,CAAC,EAAE,GAAG;IACrB,CAAC,eAAe,CAAC,EAAE,GAAG;IACtB,CAAC,YAAY,CAAC,EAAE,IAAI;IACpB,CAAC,mBAAmB,CAAC,EAAE,GAAG;IAC1B,CAAC,0BAA0B,CAAC,EAAE,IAAI;CACnC,CAAC;AAEF,wBAAwB;AACxB,gEAAgE;AAChE,MAAM,CAAC,MAAM,8BAA8B,GAAG,uBAAuB,CAAC;AACtE,MAAM,CAAC,MAAM,qCAAqC,GAAG,uBAAuB,CAAC;AAC7E,MAAM,CAAC,MAAM,iCAAiC,GAAG,uBAAuB,CAAC;AACzE,MAAM,CAAC,MAAM,kCAAkC,GAAG,uBAAuB,CAAC;AAC1E,MAAM,CAAC,MAAM,wCAAwC,GAAG,uBAAuB,CAAC;AAChF,MAAM,CAAC,MAAM,iCAAiC,GAAG,uBAAuB,CAAC;AACzE,MAAM,CAAC,MAAM,uBAAuB,GAAG,uBAAuB,CAAC;AAC/D,MAAM,CAAC,MAAM,8BAA8B,GAAG,uBAAuB,CAAC;AACtE,MAAM,CAAC,MAAM,8BAA8B,GAAG,uBAAuB,CAAC;AACtE,MAAM,CAAC,MAAM,iCAAiC,GAAG,wBAAwB,CAAC;AAC1E,MAAM,CAAC,MAAM,gCAAgC,GAAG,wBAAwB,CAAC;AACzE,MAAM,CAAC,MAAM,mCAAmC,GAAG,wBAAwB,CAAC;AAC5E,MAAM,CAAC,MAAM,sCAAsC,GAAG,wBAAwB,CAAC;AAC/E,MAAM,CAAC,MAAM,mCAAmC,GAAG,wBAAwB,CAAC;AAC5E,MAAM,CAAC,MAAM,0CAA0C,GAAG,wBAAwB,CAAC;AACnF,MAAM,CAAC,MAAM,yCAAyC,GAAG,wBAAwB,CAAC;AAClF,MAAM,CAAC,MAAM,gDAAgD,GAAG,wBAAwB,CAAC;AACzF,MAAM,CAAC,MAAM,8BAA8B,GAAG,wBAAwB,CAAC;AACvE,MAAM,CAAC,MAAM,iCAAiC,GAAG,wBAAwB,CAAC;AAC1E,MAAM,CAAC,MAAM,2BAA2B,GAAG,wBAAwB,CAAC;AACpE,MAAM,CAAC,MAAM,gCAAgC,GAAG,wBAAwB,CAAC;AACzE,MAAM,CAAC,MAAM,0CAA0C,GAAG,wBAAwB,CAAC;AAEnF,MAAM,OAAO,eAAe;IAG1B,YAAY,IAAa;QACvB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAEM,MAAM,CAAC,KAAK,CAAC,IAAyB;QAC3C,MAAM,GAAG,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC1D,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACtC,OAAO,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IAED,IAAI,cAAc;QAChB,OAAO,IAAI,CAAC,iBAAiB,CAAC;IAChC,CAAC;IAED,IAAI,OAAO;QACT,0EAA0E;QAC1E,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;QAChD,OAAO,IAAI,CAAC,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;IAC5C,CAAC;IAED,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC;IACpC,CAAC;IAED,IAAI,SAAS;QACX,0DAA0D;QAC1D,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC3C,CAAC;IAED,IAAI,QAAQ;QACV,0DAA0D;QAC1D,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC3C,CAAC;IAED,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;IAC9B,CAAC;IAED,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;IAC/B,CAAC;IAED;;;;OAIG;IACH,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACrD,CAAC;IAED;;;;OAIG;IACH,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACtD,CAAC;IAED,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,uBAAuB,CAAC,KAAK,EAAE,CAAC;IAC9C,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,eAAe,CAAC,OAAgB,EAAE,MAAgB;QAC7D,MAAM,SAAS,GAAG,IAAI,CAAC,uBAAuB,CAAC,KAAK,EAAE,CAAC;QACvD,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QAC5C,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;QAElD,gFAAgF;QAChF,MAAM,QAAQ,GAAG,YAAY,KAAK,sBAAsB,CAAC;QACzD,MAAM,WAAW,GAAG,YAAY,KAAK,cAAc,CAAC;QAEpD,IAAI,WAAW,EAAE,CAAC;YAChB,sFAAsF;YACtF,MAAM,IAAI,KAAK,CACb,0EAA0E;gBAC1E,kGAAkG,CACnG,CAAC;QACJ,CAAC;QAED,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,IAAI,GAAG,OAAO,IAAI,sBAAsB,CAAC;YAC/C,kFAAkF;YAClF,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC;YAC/C,OAAO,SAAS,CAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAC;QACxE,CAAC;aAAM,CAAC;YACN,qDAAqD;YACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;YAC/C,MAAM,KAAK,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;YAC1C,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,KAAK,CAAC,4BAA4B,QAAQ,EAAE,CAAC,CAAC;YAC1D,CAAC;YACD,OAAO,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,EAAE,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IAED,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,eAAe,EAAE,CAAC;IAChC,CAAC;IAED,IAAI,kBAAkB;QACpB,MAAM,GAAG,GAAW,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;QAC/D,OAAO,qBAAqB,CAAC,GAAG,CAAC,IAAI,mBAAmB,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,wBAAwB,EAAE,CAAC;IACnG,CAAC;IAED,IAAI,qBAAqB;QACvB,OAAO,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;IACpD,CAAC;IAED;;;OAGG;IACK,wBAAwB;QAC9B,MAAM,SAAS,GAAG,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;QAC7D,IAAI,SAAS,KAAK,cAAc,EAAE,CAAC;YACjC,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,mFAAmF;QACnF,MAAM,MAAM,GAAG,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxC,OAAO,sBAAsB,CAAC;QAChC,CAAC;QAED,8CAA8C;QAC9C,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACtC,IAAI,cAAc,IAAI,cAAc,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrD,8DAA8D;YAC9D,MAAM,UAAU,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC1C,IAAI,UAAU,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC7C,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;gBAC3C,OAAO,eAAe,CAAC,OAAO,CAAC,IAAI,sBAAsB,CAAC;YAC5D,CAAC;QACH,CAAC;QAED,OAAO,sBAAsB,CAAC;IAChC,CAAC;IAED,IAAI,cAAc;QAChB,qEAAqE;QACrE,OAAO,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAClD,CAAC;IAED,IAAI,cAAc;QAChB,MAAM,GAAG,GAAG,IAAI,CAAC,iBAAiB,CAAC;QACnC,OAAO,GAAG,EAAE,GAAG,IAAI,GAAG,EAAE,UAAU,CAAC;IACrC,CAAC;IAED,IAAI,UAAU;QACZ,uEAAuE;QACvE,uBAAuB;QACvB,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3C,OAAO,MAAM,EAAE,IAAI,IAAI,0BAA0B,CAAC,EAAE,CAAC;IACvD,CAAC;IAED,IAAI,WAAW;QACb,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,uBAAuB,CAAC,CAAC;QACxD,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1D,CAAC;IAED,IAAI,mBAAmB;QACrB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,+BAA+B,CAAC,CAAC;QAChE,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,6BAA6B,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAClE,CAAC;IAED,IAAI,iBAAiB;QACnB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,8BAA8B,CAAC,CAAC;QAC/D,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,mCAAmC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACxE,CAAC;IAED,IAAI,iBAAiB;QACnB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,8BAA8B,CAAC,CAAC;QAC/D,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,2BAA2B,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAChE,CAAC;IAED,IAAI,eAAe;QACjB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,4BAA4B,CAAC,CAAC;QAC7D,OAAO,GAAG;YACR,CAAC,CAAC,IAAI,yBAAyB,CAAC,GAAG,CAAC;YACpC,CAAC,CAAC,0BAA0B,CAAC,SAAS,CAAC;IAC3C,CAAC;IAED,IAAI,MAAM;QACR,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,iBAAiB,CAAC,CAAC;QAClD,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACrD,CAAC;IAED,IAAI,iBAAiB;QACnB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,8BAA8B,CAAC,CAAC;QAC/D,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvD,CAAC;IAED,IAAI,iBAAiB;QACnB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,8BAA8B,CAAC,CAAC;QAC/D,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvD,CAAC;IAED,IAAI,wBAAwB;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,qCAAqC,CAAC,CAAC;QACtE,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,kCAAkC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvE,CAAC;IAED,IAAI,oBAAoB;QACtB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,iCAAiC,CAAC,CAAC;QAClE,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,8BAA8B,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACnE,CAAC;IAED,IAAI,qBAAqB;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,kCAAkC,CAAC,CAAC;QACnE,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,+BAA+B,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACpE,CAAC;IAED,IAAI,2BAA2B;QAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,wCAAwC,CAAC,CAAC;QACzE,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,qCAAqC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1E,CAAC;IAED,IAAI,oBAAoB;QACtB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,iCAAiC,CAAC,CAAC;QAClE,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,8BAA8B,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACnE,CAAC;IAED,IAAI,iBAAiB;QACnB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,8BAA8B,CAAC,CAAC;QAC/D,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,2BAA2B,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAChE,CAAC;IAED,IAAI,oBAAoB;QACtB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,iCAAiC,CAAC,CAAC;QAClE,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,8BAA8B,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACnE,CAAC;IAED,IAAI,oBAAoB;QACtB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,gCAAgC,CAAC,CAAC;QACjE,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,8BAA8B,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACnE,CAAC;IAED,IAAI,sBAAsB;QACxB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,mCAAmC,CAAC,CAAC;QACpE,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,gCAAgC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACrE,CAAC;IAED,IAAI,yBAAyB;QAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,sCAAsC,CAAC,CAAC;QACvE,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,mCAAmC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACxE,CAAC;IAED,IAAI,sBAAsB;QACxB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,mCAAmC,CAAC,CAAC;QACpE,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,gCAAgC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACrE,CAAC;IAED,IAAI,6BAA6B;QAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,0CAA0C,CAAC,CAAC;QAC3E,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,uCAAuC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5E,CAAC;IAED,IAAI,2BAA2B;QAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,yCAAyC,CAAC,CAAC;QAC1E,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,qCAAqC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1E,CAAC;IAED,IAAI,kCAAkC;QACpC,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,gDAAgD,CAAC,CAAC;QACjF,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,4CAA4C,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACjF,CAAC;IAED,IAAI,iBAAiB;QACnB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,8BAA8B,CAAC,CAAC;QAC/D,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,2BAA2B,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAChE,CAAC;IAED,IAAI,oBAAoB;QACtB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,iCAAiC,CAAC,CAAC;QAClE,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,8BAA8B,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACnE,CAAC;IAED,IAAI,eAAe;QACjB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,2BAA2B,CAAC,CAAC;QAC5D,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,yBAAyB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9D,CAAC;IAED,IAAI,mBAAmB;QACrB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,gCAAgC,CAAC,CAAC;QACjE,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,6BAA6B,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAClE,CAAC;IAED,IAAI,6BAA6B;QAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,0CAA0C,CAAC,CAAC;QAC3E,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,uCAAuC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5E,CAAC;IAED,IAAI,IAAI;QACN,MAAM,EAAE,GAAG,IAAI,CAAC,mBAAmB,EAAE,IAAI,IAAI,KAAK,CAAC;QAEnD,gEAAgE;QAChE,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,OAAO,EAAE,IAAI,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC;QAC5C,CAAC;QAED,OAAO,EAAE,CAAC;IACZ,CAAC;IAEM,SAAS,CAAC,GAAW;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QACpC,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAClD,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,iBAAmC;QACrD,yEAAyE;QACzE,MAAM,SAAS,GAAG,IAAI,CAAC,qBAAqB,CAAC;QAC7C,MAAM,QAAQ,GAAG,SAAS,KAAK,cAAc,CAAC;QAE9C,sFAAsF;QACtF,MAAM,OAAO,GAAG,QAAQ;YACtB,CAAC,CAAC,IAAI,CAAC,wBAAwB,EAAE;YACjC,CAAC,CAAC,CAAC,mBAAmB,CAAC,SAAS,CAAC,IAAI,qBAAqB,CAAC,SAAS,CAAC,CAAC,CAAC;QAEzE,+FAA+F;QAC/F,uFAAuF;QACvF,MAAM,YAAY,GAAG,iBAAiB;YACpC,CAAC,CAAC,MAAM,iBAAiB,CAAC,eAAe,CAAC,OAAO,EAAE,QAAQ,CAAC;YAC5D,CAAC,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAElD,OAAO,MAAM,eAAe,CAC1B,YAAY,EACZ,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,EAC3B,IAAI,CAAC,cAAc,EACnB,IAAI,CAAC,kBAAkB,CACxB,CAAC;IACJ,CAAC;IAEM,YAAY,CAAC,IAAU;QAC5B,OAAO,IAAI,CAAC,SAAS,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC;IACzD,CAAC;IAEM,MAAM,CAAC,KAAsB;QAClC,OAAO,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IAChE,CAAC;IAED,sDAAsD;IAC/C,KAAK;QACV,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;QAClC,OAAO,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACtC,CAAC;IAEO,aAAa,CAAC,GAAW;QAC/B,0EAA0E;QAC1E,oCAAoC;QACpC,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC;IACpE,CAAC;IAED,6EAA6E;IAC7E,2EAA2E;IAC3E,uBAAuB;IACvB,qDAAqD;IAErD,yDAAyD;IACzD,IAAY,iBAAiB;QAC3B,kEAAkE;QAClE,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;IAED,yDAAyD;IACzD,IAAY,qBAAqB;QAC/B,uEAAuE;QACvE,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;IAED,yDAAyD;IACzD,IAAY,iBAAiB;QAC3B,kEAAkE;QAClE,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;IAED,yDAAyD;IACzD,IAAY,UAAU;QACpB,8DAA8D;QAC9D,OAAO,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;IAED,yDAAyD;IACzD,IAAY,eAAe;QACzB,oEAAoE;QACpE,OAAO,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;IAED,yDAAyD;IACzD,IAAY,SAAS;QACnB,8DAA8D;QAC9D,OAAO,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;IAED,yDAAyD;IACzD,IAAY,WAAW;QACrB,8DAA8D;QAC9D,OAAO,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;IAED,yDAAyD;IACzD,IAAY,UAAU;QACpB,8DAA8D;QAC9D,OAAO,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;IAED,yDAAyD;IACzD,IAAY,uBAAuB;QACjC,6EAA6E;QAC7E,OAAO,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;IAED,+EAA+E;IAC/E,sDAAsD;IACtD,yDAAyD;IACzD,IAAY,aAAa;QACvB,OAAO,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAC9C,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAChC,CAAC;IACJ,CAAC;IAED,oEAAoE;IACpE,oEAAoE;IACpE,6CAA6C;IACrC,sBAAsB,CAAC,KAAc;QAC3C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;QAEzC,gEAAgE;QAChE,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;YAC7B,iEAAiE;YACjE,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;gBAC3B,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;oBACzB,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;oBAC3B,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;oBAE7B,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC;wBACvB,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC;wBAC3B,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;wBACrC,IAAI,QAAQ,EAAE,CAAC;4BACb,MAAM,KAAK,GAAG,kBAAkB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;4BACjD,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;wBAC9B,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;CACF","sourcesContent":["/*\nCopyright 2023 The Sigstore Authors.\n\nLicensed under the Apache License, Version 2.0 (the \"License\");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\n    http://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n*/\nimport { ASN1Obj, importKey, toDER, uint8ArrayEqual, Uint8ArrayToBase64, Uint8ArrayToString, verifySignature } from \"@freedomofpress/crypto-browser\";\n\nimport { KeyTypes } from \"../interfaces.js\";\nimport { DEFAULT_HASH_ALGORITHM, ECDSA_CURVE_NAMES, ECDSA_SIGNATURE_ALGOS, OID_RSASSA_PSS, RSA_SIGNATURE_ALGOS, SHA2_HASH_ALGOS } from \"../oid.js\";\nimport {\n  X509AuthorityKeyIDExtension,\n  X509BasicConstraintsExtension,\n  X509BuildConfigDigestExtension,\n  X509BuildConfigURIExtension,\n  X509BuildSignerDigestExtension,\n  X509BuildSignerURIExtension,\n  X509BuildTriggerExtension,\n  X509Extension,\n  X509FulcioIssuerV1,\n  X509FulcioIssuerV2,\n  X509GitHubWorkflowNameExtension,\n  X509GitHubWorkflowRefExtension,\n  X509GitHubWorkflowRepositoryExtension,\n  X509GitHubWorkflowSHAExtension,\n  X509GitHubWorkflowTriggerExtension,\n  X509KeyUsageExtension,\n  X509RunInvocationURIExtension,\n  X509RunnerEnvironmentExtension,\n  X509SCTExtension,\n  X509SourceRepositoryDigestExtension,\n  X509SourceRepositoryIdentifierExtension,\n  X509SourceRepositoryOwnerIdentifierExtension,\n  X509SourceRepositoryOwnerURIExtension,\n  X509SourceRepositoryRefExtension,\n  X509SourceRepositoryURIExtension,\n  X509SourceRepositoryVisibilityExtension,\n  X509SubjectAlternativeNameExtension,\n  X509SubjectKeyIDExtension,\n} from \"./ext.js\";\n\n// Standard X.509 extension OIDs\nconst EXTENSION_OID_SUBJECT_KEY_ID = \"2.5.29.14\";\nconst EXTENSION_OID_KEY_USAGE = \"2.5.29.15\";\nconst EXTENSION_OID_SUBJECT_ALT_NAME = \"2.5.29.17\";\nconst EXTENSION_OID_BASIC_CONSTRAINTS = \"2.5.29.19\";\nconst EXTENSION_OID_AUTHORITY_KEY_ID = \"2.5.29.35\";\n\n// CT Log SCT extension OID\nexport const EXTENSION_OID_SCT = \"1.3.6.1.4.1.11129.2.4.2\";\n\n// Distinguished Name attribute OIDs (X.500)\nconst DN_OID_COMMON_NAME = \"2.5.4.3\";\nconst DN_OID_COUNTRY = \"2.5.4.6\";\nconst DN_OID_LOCALITY = \"2.5.4.7\";\nconst DN_OID_STATE = \"2.5.4.8\";\nconst DN_OID_ORGANIZATION = \"2.5.4.10\";\nconst DN_OID_ORGANIZATIONAL_UNIT = \"2.5.4.11\";\n\nconst DN_OID_TO_NAME: Record<string, string> = {\n  [DN_OID_COMMON_NAME]: \"CN\",\n  [DN_OID_COUNTRY]: \"C\",\n  [DN_OID_LOCALITY]: \"L\",\n  [DN_OID_STATE]: \"ST\",\n  [DN_OID_ORGANIZATION]: \"O\",\n  [DN_OID_ORGANIZATIONAL_UNIT]: \"OU\",\n};\n\n// Fulcio extension OIDs\n// https://github.com/sigstore/fulcio/blob/main/docs/oid-info.md\nexport const EXTENSION_OID_FULCIO_ISSUER_V1 = \"1.3.6.1.4.1.57264.1.1\";\nexport const EXTENSION_OID_GITHUB_WORKFLOW_TRIGGER = \"1.3.6.1.4.1.57264.1.2\";\nexport const EXTENSION_OID_GITHUB_WORKFLOW_SHA = \"1.3.6.1.4.1.57264.1.3\";\nexport const EXTENSION_OID_GITHUB_WORKFLOW_NAME = \"1.3.6.1.4.1.57264.1.4\";\nexport const EXTENSION_OID_GITHUB_WORKFLOW_REPOSITORY = \"1.3.6.1.4.1.57264.1.5\";\nexport const EXTENSION_OID_GITHUB_WORKFLOW_REF = \"1.3.6.1.4.1.57264.1.6\";\nexport const EXTENSION_OID_OTHERNAME = \"1.3.6.1.4.1.57264.1.7\";\nexport const EXTENSION_OID_FULCIO_ISSUER_V2 = \"1.3.6.1.4.1.57264.1.8\";\nexport const EXTENSION_OID_BUILD_SIGNER_URI = \"1.3.6.1.4.1.57264.1.9\";\nexport const EXTENSION_OID_BUILD_SIGNER_DIGEST = \"1.3.6.1.4.1.57264.1.10\";\nexport const EXTENSION_OID_RUNNER_ENVIRONMENT = \"1.3.6.1.4.1.57264.1.11\";\nexport const EXTENSION_OID_SOURCE_REPOSITORY_URI = \"1.3.6.1.4.1.57264.1.12\";\nexport const EXTENSION_OID_SOURCE_REPOSITORY_DIGEST = \"1.3.6.1.4.1.57264.1.13\";\nexport const EXTENSION_OID_SOURCE_REPOSITORY_REF = \"1.3.6.1.4.1.57264.1.14\";\nexport const EXTENSION_OID_SOURCE_REPOSITORY_IDENTIFIER = \"1.3.6.1.4.1.57264.1.15\";\nexport const EXTENSION_OID_SOURCE_REPOSITORY_OWNER_URI = \"1.3.6.1.4.1.57264.1.16\";\nexport const EXTENSION_OID_SOURCE_REPOSITORY_OWNER_IDENTIFIER = \"1.3.6.1.4.1.57264.1.17\";\nexport const EXTENSION_OID_BUILD_CONFIG_URI = \"1.3.6.1.4.1.57264.1.18\";\nexport const EXTENSION_OID_BUILD_CONFIG_DIGEST = \"1.3.6.1.4.1.57264.1.19\";\nexport const EXTENSION_OID_BUILD_TRIGGER = \"1.3.6.1.4.1.57264.1.20\";\nexport const EXTENSION_OID_RUN_INVOCATION_URI = \"1.3.6.1.4.1.57264.1.21\";\nexport const EXTENSION_OID_SOURCE_REPOSITORY_VISIBILITY = \"1.3.6.1.4.1.57264.1.22\";\n\nexport class X509Certificate {\n  public root: ASN1Obj;\n\n  constructor(asn1: ASN1Obj) {\n    this.root = asn1;\n  }\n\n  public static parse(cert: Uint8Array | string): X509Certificate {\n    const der = typeof cert === \"string\" ? toDER(cert) : cert;\n    const asn1 = ASN1Obj.parseBuffer(der);\n    return new X509Certificate(asn1);\n  }\n\n  get tbsCertificate(): ASN1Obj {\n    return this.tbsCertificateObj;\n  }\n\n  get version(): string {\n    // version number is the first element of the version context specific tag\n    const ver = this.versionObj.subs[0].toInteger();\n    return `v${(ver + BigInt(1)).toString()}`;\n  }\n\n  get serialNumber(): Uint8Array {\n    return this.serialNumberObj.value;\n  }\n\n  get notBefore(): Date {\n    // notBefore is the first element of the validity sequence\n    return this.validityObj.subs[0].toDate();\n  }\n\n  get notAfter(): Date {\n    // notAfter is the second element of the validity sequence\n    return this.validityObj.subs[1].toDate();\n  }\n\n  get issuer(): Uint8Array {\n    return this.issuerObj.value;\n  }\n\n  get subject(): Uint8Array {\n    return this.subjectObj.value;\n  }\n\n  /**\n   * Returns the issuer distinguished name as a Map of attribute names to values.\n   * Common attributes: CN (Common Name), O (Organization), L (Locality),\n   * ST (State), C (Country), OU (Organizational Unit)\n   */\n  get issuerDN(): Map<string, string> {\n    return this.parseDistinguishedName(this.issuerObj);\n  }\n\n  /**\n   * Returns the subject distinguished name as a Map of attribute names to values.\n   * Common attributes: CN (Common Name), O (Organization), L (Locality),\n   * ST (State), C (Country), OU (Organizational Unit)\n   */\n  get subjectDN(): Map<string, string> {\n    return this.parseDistinguishedName(this.subjectObj);\n  }\n\n  get publicKey(): Uint8Array {\n    return this.subjectPublicKeyInfoObj.toDER();\n  }\n\n  /**\n   * Import the public key with a specific hash algorithm and signature scheme for RSA keys.\n   * For ECDSA keys, both parameters are ignored.\n   * @param hashAlg - Hash algorithm (e.g., \"sha384\") for RSA keys\n   * @param usePss - If true, import as RSA-PSS key; if false, import as PKCS#1 v1.5\n   */\n  public async getPublicKeyObj(hashAlg?: string, usePss?: boolean): Promise<CryptoKey> {\n    const publicKey = this.subjectPublicKeyInfoObj.toDER();\n    const spki = ASN1Obj.parseBuffer(publicKey);\n    const algorithmOID = spki.subs[0].subs[0].toOID();\n\n    // RSA key (OID 1.2.840.113549.1.1.1) or RSA-PSS key (OID 1.2.840.113549.1.1.10)\n    const isRsaKey = algorithmOID === \"1.2.840.113549.1.1.1\";\n    const isRsaPssKey = algorithmOID === OID_RSASSA_PSS;\n\n    if (isRsaPssKey) {\n      // WebCrypto doesn't support importing keys with id-RSASSA-PSS OID, only rsaEncryption\n      throw new Error(\n        \"RSA-PSS public keys (id-RSASSA-PSS OID) are not supported by WebCrypto. \" +\n        \"Only certificates with standard RSA keys (rsaEncryption OID) signed using RSA-PSS are supported.\"\n      );\n    }\n\n    if (isRsaKey) {\n      const hash = hashAlg || DEFAULT_HASH_ALGORITHM;\n      // crypto-browser extracts hash from scheme and uses PSS unless \"PKCS1\" is present\n      const scheme = usePss ? hash : `PKCS1_${hash}`;\n      return importKey(KeyTypes.RSA, scheme, Uint8ArrayToBase64(publicKey));\n    } else {\n      // ECDSA key - the curve OID is in the second element\n      const curveOID = spki.subs[0].subs[1]?.toOID();\n      const curve = ECDSA_CURVE_NAMES[curveOID];\n      if (!curve) {\n        throw new Error(`Unknown ECDSA curve OID: ${curveOID}`);\n      }\n      return importKey(KeyTypes.Ecdsa, curve, Uint8ArrayToBase64(publicKey));\n    }\n  }\n\n  get publicKeyObj(): Promise<CryptoKey> {\n    return this.getPublicKeyObj();\n  }\n\n  get signatureAlgorithm(): string {\n    const oid: string = this.signatureAlgorithmObj.subs[0].toOID();\n    return ECDSA_SIGNATURE_ALGOS[oid] || RSA_SIGNATURE_ALGOS[oid] || this.parseRsaPssHashAlgorithm();\n  }\n\n  get signatureAlgorithmOid(): string {\n    return this.signatureAlgorithmObj.subs[0].toOID();\n  }\n\n  /**\n   * Parse hash algorithm from RSA-PSS signature algorithm parameters.\n   * RSA-PSS parameters are: SEQUENCE { hashAlgorithm, maskGenAlgorithm, saltLength, trailerField }\n   */\n  private parseRsaPssHashAlgorithm(): string {\n    const sigAlgOid = this.signatureAlgorithmObj.subs[0].toOID();\n    if (sigAlgOid !== OID_RSASSA_PSS) {\n      return \"\";\n    }\n\n    // RSA-PSS has parameters in the second element of the signature algorithm sequence\n    const params = this.signatureAlgorithmObj.subs[1];\n    if (!params || params.subs.length === 0) {\n      return DEFAULT_HASH_ALGORITHM;\n    }\n\n    // First element is hashAlgorithm [0] EXPLICIT\n    const hashAlgWrapper = params.subs[0];\n    if (hashAlgWrapper && hashAlgWrapper.subs.length > 0) {\n      // The wrapper contains a SEQUENCE with the hash algorithm OID\n      const hashAlgSeq = hashAlgWrapper.subs[0];\n      if (hashAlgSeq && hashAlgSeq.subs.length > 0) {\n        const hashOid = hashAlgSeq.subs[0].toOID();\n        return SHA2_HASH_ALGOS[hashOid] || DEFAULT_HASH_ALGORITHM;\n      }\n    }\n\n    return DEFAULT_HASH_ALGORITHM;\n  }\n\n  get signatureValue(): Uint8Array {\n    // Signature value is a bit string, so we need to skip the first byte\n    return this.signatureValueObj.value.subarray(1);\n  }\n\n  get subjectAltName(): string | undefined {\n    const ext = this.extSubjectAltName;\n    return ext?.uri || ext?.rfc822Name;\n  }\n\n  get extensions(): ASN1Obj[] {\n    // The extension list is the first (and only) element of the extensions\n    // context specific tag\n    const extSeq = this.extensionsObj?.subs[0];\n    return extSeq?.subs || /* istanbul ignore next */ [];\n  }\n\n  get extKeyUsage(): X509KeyUsageExtension | undefined {\n    const ext = this.findExtension(EXTENSION_OID_KEY_USAGE);\n    return ext ? new X509KeyUsageExtension(ext) : undefined;\n  }\n\n  get extBasicConstraints(): X509BasicConstraintsExtension | undefined {\n    const ext = this.findExtension(EXTENSION_OID_BASIC_CONSTRAINTS);\n    return ext ? new X509BasicConstraintsExtension(ext) : undefined;\n  }\n\n  get extSubjectAltName(): X509SubjectAlternativeNameExtension | undefined {\n    const ext = this.findExtension(EXTENSION_OID_SUBJECT_ALT_NAME);\n    return ext ? new X509SubjectAlternativeNameExtension(ext) : undefined;\n  }\n\n  get extAuthorityKeyID(): X509AuthorityKeyIDExtension | undefined {\n    const ext = this.findExtension(EXTENSION_OID_AUTHORITY_KEY_ID);\n    return ext ? new X509AuthorityKeyIDExtension(ext) : undefined;\n  }\n\n  get extSubjectKeyID(): X509SubjectKeyIDExtension | undefined {\n    const ext = this.findExtension(EXTENSION_OID_SUBJECT_KEY_ID);\n    return ext\n      ? new X509SubjectKeyIDExtension(ext)\n      : /* istanbul ignore next */ undefined;\n  }\n\n  get extSCT(): X509SCTExtension | undefined {\n    const ext = this.findExtension(EXTENSION_OID_SCT);\n    return ext ? new X509SCTExtension(ext) : undefined;\n  }\n\n  get extFulcioIssuerV1(): X509FulcioIssuerV1 | undefined {\n    const ext = this.findExtension(EXTENSION_OID_FULCIO_ISSUER_V1);\n    return ext ? new X509FulcioIssuerV1(ext) : undefined;\n  }\n\n  get extFulcioIssuerV2(): X509FulcioIssuerV2 | undefined {\n    const ext = this.findExtension(EXTENSION_OID_FULCIO_ISSUER_V2);\n    return ext ? new X509FulcioIssuerV2(ext) : undefined;\n  }\n\n  get extGitHubWorkflowTrigger(): X509GitHubWorkflowTriggerExtension | undefined {\n    const ext = this.findExtension(EXTENSION_OID_GITHUB_WORKFLOW_TRIGGER);\n    return ext ? new X509GitHubWorkflowTriggerExtension(ext) : undefined;\n  }\n\n  get extGitHubWorkflowSHA(): X509GitHubWorkflowSHAExtension | undefined {\n    const ext = this.findExtension(EXTENSION_OID_GITHUB_WORKFLOW_SHA);\n    return ext ? new X509GitHubWorkflowSHAExtension(ext) : undefined;\n  }\n\n  get extGitHubWorkflowName(): X509GitHubWorkflowNameExtension | undefined {\n    const ext = this.findExtension(EXTENSION_OID_GITHUB_WORKFLOW_NAME);\n    return ext ? new X509GitHubWorkflowNameExtension(ext) : undefined;\n  }\n\n  get extGitHubWorkflowRepository(): X509GitHubWorkflowRepositoryExtension | undefined {\n    const ext = this.findExtension(EXTENSION_OID_GITHUB_WORKFLOW_REPOSITORY);\n    return ext ? new X509GitHubWorkflowRepositoryExtension(ext) : undefined;\n  }\n\n  get extGitHubWorkflowRef(): X509GitHubWorkflowRefExtension | undefined {\n    const ext = this.findExtension(EXTENSION_OID_GITHUB_WORKFLOW_REF);\n    return ext ? new X509GitHubWorkflowRefExtension(ext) : undefined;\n  }\n\n  get extBuildSignerURI(): X509BuildSignerURIExtension | undefined {\n    const ext = this.findExtension(EXTENSION_OID_BUILD_SIGNER_URI);\n    return ext ? new X509BuildSignerURIExtension(ext) : undefined;\n  }\n\n  get extBuildSignerDigest(): X509BuildSignerDigestExtension | undefined {\n    const ext = this.findExtension(EXTENSION_OID_BUILD_SIGNER_DIGEST);\n    return ext ? new X509BuildSignerDigestExtension(ext) : undefined;\n  }\n\n  get extRunnerEnvironment(): X509RunnerEnvironmentExtension | undefined {\n    const ext = this.findExtension(EXTENSION_OID_RUNNER_ENVIRONMENT);\n    return ext ? new X509RunnerEnvironmentExtension(ext) : undefined;\n  }\n\n  get extSourceRepositoryURI(): X509SourceRepositoryURIExtension | undefined {\n    const ext = this.findExtension(EXTENSION_OID_SOURCE_REPOSITORY_URI);\n    return ext ? new X509SourceRepositoryURIExtension(ext) : undefined;\n  }\n\n  get extSourceRepositoryDigest(): X509SourceRepositoryDigestExtension | undefined {\n    const ext = this.findExtension(EXTENSION_OID_SOURCE_REPOSITORY_DIGEST);\n    return ext ? new X509SourceRepositoryDigestExtension(ext) : undefined;\n  }\n\n  get extSourceRepositoryRef(): X509SourceRepositoryRefExtension | undefined {\n    const ext = this.findExtension(EXTENSION_OID_SOURCE_REPOSITORY_REF);\n    return ext ? new X509SourceRepositoryRefExtension(ext) : undefined;\n  }\n\n  get extSourceRepositoryIdentifier(): X509SourceRepositoryIdentifierExtension | undefined {\n    const ext = this.findExtension(EXTENSION_OID_SOURCE_REPOSITORY_IDENTIFIER);\n    return ext ? new X509SourceRepositoryIdentifierExtension(ext) : undefined;\n  }\n\n  get extSourceRepositoryOwnerURI(): X509SourceRepositoryOwnerURIExtension | undefined {\n    const ext = this.findExtension(EXTENSION_OID_SOURCE_REPOSITORY_OWNER_URI);\n    return ext ? new X509SourceRepositoryOwnerURIExtension(ext) : undefined;\n  }\n\n  get extSourceRepositoryOwnerIdentifier(): X509SourceRepositoryOwnerIdentifierExtension | undefined {\n    const ext = this.findExtension(EXTENSION_OID_SOURCE_REPOSITORY_OWNER_IDENTIFIER);\n    return ext ? new X509SourceRepositoryOwnerIdentifierExtension(ext) : undefined;\n  }\n\n  get extBuildConfigURI(): X509BuildConfigURIExtension | undefined {\n    const ext = this.findExtension(EXTENSION_OID_BUILD_CONFIG_URI);\n    return ext ? new X509BuildConfigURIExtension(ext) : undefined;\n  }\n\n  get extBuildConfigDigest(): X509BuildConfigDigestExtension | undefined {\n    const ext = this.findExtension(EXTENSION_OID_BUILD_CONFIG_DIGEST);\n    return ext ? new X509BuildConfigDigestExtension(ext) : undefined;\n  }\n\n  get extBuildTrigger(): X509BuildTriggerExtension | undefined {\n    const ext = this.findExtension(EXTENSION_OID_BUILD_TRIGGER);\n    return ext ? new X509BuildTriggerExtension(ext) : undefined;\n  }\n\n  get extRunInvocationURI(): X509RunInvocationURIExtension | undefined {\n    const ext = this.findExtension(EXTENSION_OID_RUN_INVOCATION_URI);\n    return ext ? new X509RunInvocationURIExtension(ext) : undefined;\n  }\n\n  get extSourceRepositoryVisibility(): X509SourceRepositoryVisibilityExtension | undefined {\n    const ext = this.findExtension(EXTENSION_OID_SOURCE_REPOSITORY_VISIBILITY);\n    return ext ? new X509SourceRepositoryVisibilityExtension(ext) : undefined;\n  }\n\n  get isCA(): boolean {\n    const ca = this.extBasicConstraints?.isCA || false;\n\n    // If the KeyUsage extension is present, keyCertSign must be set\n    if (this.extKeyUsage) {\n      return ca && this.extKeyUsage.keyCertSign;\n    }\n\n    return ca;\n  }\n\n  public extension(oid: string): X509Extension | undefined {\n    const ext = this.findExtension(oid);\n    return ext ? new X509Extension(ext) : undefined;\n  }\n\n  public async verify(issuerCertificate?: X509Certificate): Promise<boolean> {\n    // Extract the hash algorithm from this certificate's signature algorithm\n    const sigAlgOID = this.signatureAlgorithmOid;\n    const isRsaPss = sigAlgOID === OID_RSASSA_PSS;\n\n    // Get hash algorithm - for RSA-PSS, parse from parameters; otherwise lookup in tables\n    const hashAlg = isRsaPss\n      ? this.parseRsaPssHashAlgorithm()\n      : (RSA_SIGNATURE_ALGOS[sigAlgOID] || ECDSA_SIGNATURE_ALGOS[sigAlgOID]);\n\n    // Use the issuer's public key if provided, otherwise use the subject's (for self-signed certs)\n    // Import with the correct hash algorithm and key type for this certificate's signature\n    const publicKeyObj = issuerCertificate\n      ? await issuerCertificate.getPublicKeyObj(hashAlg, isRsaPss)\n      : await this.getPublicKeyObj(hashAlg, isRsaPss);\n\n    return await verifySignature(\n      publicKeyObj,\n      this.tbsCertificate.toDER(),\n      this.signatureValue,\n      this.signatureAlgorithm,\n    );\n  }\n\n  public validForDate(date: Date): boolean {\n    return this.notBefore <= date && date <= this.notAfter;\n  }\n\n  public equals(other: X509Certificate): boolean {\n    return uint8ArrayEqual(this.root.toDER(), other.root.toDER());\n  }\n\n  // Creates a copy of the certificate with a new buffer\n  public clone(): X509Certificate {\n    const der = this.root.toDER();\n    const clone = new Uint8Array(der);\n    return X509Certificate.parse(clone);\n  }\n\n  private findExtension(oid: string): ASN1Obj | undefined {\n    // Find the extension with the given OID. The OID will always be the first\n    // element of the extension sequence\n    return this.extensions.find((ext) => ext.subs[0].toOID() === oid);\n  }\n\n  /////////////////////////////////////////////////////////////////////////////\n  // The following properties use the documented x509 structure to locate the\n  // desired ASN.1 object\n  // https://www.rfc-editor.org/rfc/rfc5280#section-4.1\n\n  // https://www.rfc-editor.org/rfc/rfc5280#section-4.1.1.1\n  private get tbsCertificateObj(): ASN1Obj {\n    // tbsCertificate is the first element of the certificate sequence\n    return this.root.subs[0];\n  }\n\n  // https://www.rfc-editor.org/rfc/rfc5280#section-4.1.1.2\n  private get signatureAlgorithmObj(): ASN1Obj {\n    // signatureAlgorithm is the second element of the certificate sequence\n    return this.root.subs[1];\n  }\n\n  // https://www.rfc-editor.org/rfc/rfc5280#section-4.1.1.3\n  private get signatureValueObj(): ASN1Obj {\n    // signatureValue is the third element of the certificate sequence\n    return this.root.subs[2];\n  }\n\n  // https://www.rfc-editor.org/rfc/rfc5280#section-4.1.2.1\n  private get versionObj(): ASN1Obj {\n    // version is the first element of the tbsCertificate sequence\n    return this.tbsCertificateObj.subs[0];\n  }\n\n  // https://www.rfc-editor.org/rfc/rfc5280#section-4.1.2.2\n  private get serialNumberObj(): ASN1Obj {\n    // serialNumber is the second element of the tbsCertificate sequence\n    return this.tbsCertificateObj.subs[1];\n  }\n\n  // https://www.rfc-editor.org/rfc/rfc5280#section-4.1.2.4\n  private get issuerObj(): ASN1Obj {\n    // issuer is the fourth element of the tbsCertificate sequence\n    return this.tbsCertificateObj.subs[3];\n  }\n\n  // https://www.rfc-editor.org/rfc/rfc5280#section-4.1.2.5\n  private get validityObj(): ASN1Obj {\n    // version is the fifth element of the tbsCertificate sequence\n    return this.tbsCertificateObj.subs[4];\n  }\n\n  // https://www.rfc-editor.org/rfc/rfc5280#section-4.1.2.6\n  private get subjectObj(): ASN1Obj {\n    // subject is the sixth element of the tbsCertificate sequence\n    return this.tbsCertificateObj.subs[5];\n  }\n\n  // https://www.rfc-editor.org/rfc/rfc5280#section-4.1.2.7\n  private get subjectPublicKeyInfoObj(): ASN1Obj {\n    // subjectPublicKeyInfo is the seventh element of the tbsCertificate sequence\n    return this.tbsCertificateObj.subs[6];\n  }\n\n  // Extensions can't be located by index because their position varies. Instead,\n  // we need to find the extensions context specific tag\n  // https://www.rfc-editor.org/rfc/rfc5280#section-4.1.2.9\n  private get extensionsObj(): ASN1Obj | undefined {\n    return this.tbsCertificateObj.subs.find((sub) =>\n      sub.tag.isContextSpecific(0x03),\n    );\n  }\n\n  // Parse a Distinguished Name (issuer or subject) ASN1Obj into a Map\n  // DN structure: SEQUENCE of SET of SEQUENCE (AttributeTypeAndValue)\n  // Each AttributeTypeAndValue is [OID, value]\n  private parseDistinguishedName(dnObj: ASN1Obj): Map<string, string> {\n    const result = new Map<string, string>();\n\n    // Iterate over RDNs (RelativeDistinguishedName - each is a SET)\n    for (const rdn of dnObj.subs) {\n      // Each RDN contains one or more AttributeTypeAndValue (SEQUENCE)\n      for (const atv of rdn.subs) {\n        if (atv.subs.length >= 2) {\n          const oidObj = atv.subs[0];\n          const valueObj = atv.subs[1];\n\n          if (oidObj.tag.isOID()) {\n            const oid = oidObj.toOID();\n            const attrName = DN_OID_TO_NAME[oid];\n            if (attrName) {\n              const value = Uint8ArrayToString(valueObj.value);\n              result.set(attrName, value);\n            }\n          }\n        }\n      }\n    }\n\n    return result;\n  }\n}\n"]}

package/dist/x509/chain.d.ts

@@ -17,4 +17,3 @@ export declare class CertificateChainVerifier {
     private checkPath;
 }
 export {};
-//# sourceMappingURL=chain.d.ts.map

package/dist/x509/chain.js

@@ -74,7 +74,7 @@ export class CertificateChainVerifier {
         return paths;
     }
     async findIssuer(certificate) {
-        let issuers = [];
+        const issuers = [];
         let keyIdentifier;
         if (uint8ArrayEqual(certificate.subject, certificate.issuer)) {
             if (await certificate.verify()) {
@@ -104,7 +104,7 @@ export class CertificateChainVerifier {
                     verifiedIssuers.push(issuer);
                 }
             }
-            catch (ex) {
+            catch {
                 // Ignore verification failures
             }
         }

package/dist/x509/chain.js.map

@@ -1 +1 @@
-{"version":3,"file":"chain.js","sourceRoot":"","sources":["../../src/x509/chain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;EAcE;AAEF;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AASjE,MAAM,OAAO,wBAAwB;IAMnC,YAAY,IAAqC;QAC/C,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC;QACxC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;QACtC,IAAI,CAAC,UAAU,GAAG,kBAAkB,CAAC;YACnC,GAAG,IAAI,CAAC,YAAY;YACpB,IAAI,CAAC,aAAa;SACnB,CAAC,CAAC;QACH,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IAClC,CAAC;IAEM,KAAK,CAAC,MAAM;QACjB,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAE1C,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;QAEhC,MAAM,YAAY,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAClD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAClC,CAAC;QAEF,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CACb,2DAA2D,CAC5D,CAAC;QACJ,CAAC;QAED,OAAO,eAAe,CAAC;IACzB,CAAC;IAEO,KAAK,CAAC,IAAI;QAChB,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC;QAEpC,IAAI,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAE5C,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAC5B,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CACtD,CAAC;QAEF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACvD,CAAC;QAED,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CACvC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CACxC,CAAC;QAEF,OAAO,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1C,CAAC;IAEO,KAAK,CAAC,UAAU,CACtB,WAA4B;QAE5B,MAAM,KAAK,GAAG,EAAE,CAAC;QACjB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;QAEnD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACrD,CAAC;QAED,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACxC,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;YAE1B,IAAI,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC/B,KAAK,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;gBAC1B,SAAS;YACX,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;YAE/C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACzC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACvC,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,KAAK,CAAC,UAAU,CACtB,WAA4B;QAE5B,IAAI,OAAO,GAAsB,EAAE,CAAC;QACpC,IAAI,aAAqC,CAAC;QAE1C,IAAI,eAAe,CAAC,WAAW,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;YAC7D,IAAI,MAAM,WAAW,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC/B,OAAO,CAAC,WAAW,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;QAED,IAAI,WAAW,CAAC,iBAAiB,EAAE,CAAC;YAClC,aAAa,GAAG,WAAW,CAAC,iBAAiB,CAAC,aAAa,CAAC;QAC9D,CAAC;QAED,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,cAAc,EAAE,EAAE;YACzC,IAAI,aAAa,EAAE,CAAC;gBAClB,IAAI,cAAc,CAAC,eAAe,EAAE,CAAC;oBACnC,IACE,eAAe,CACb,cAAc,CAAC,eAAe,CAAC,aAAa,EAC5C,aAAa,CACd,EACD,CAAC;wBACD,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;oBAC/B,CAAC;oBACD,OAAO;gBACT,CAAC;YACH,CAAC;YAED,IAAI,eAAe,CAAC,cAAc,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;gBAChE,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YAC/B,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,MAAM,eAAe,GAAsB,EAAE,CAAC;QAC9C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,CAAC;gBACH,IAAI,MAAM,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;oBACrC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAC/B,CAAC;YACH,CAAC;YAAC,OAAO,EAAE,EAAE,CAAC;gBACZ,+BAA+B;YACjC,CAAC;QACH,CAAC;QAED,OAAO,eAAe,CAAC;IACzB,CAAC;IAEO,SAAS,CAAC,IAAuB;QACvC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CACb,yDAAyD,CAC1D,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,CAAC;QAED,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC1C,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC1D,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;YACzD,CAAC;QACH,CAAC;QAED,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YAErB,IAAI,IAAI,CAAC,mBAAmB,EAAE,IAAI,EAAE,CAAC;gBACnC,MAAM,UAAU,GAAG,IAAI,CAAC,mBAAmB,CAAC,iBAAiB,CAAC;gBAE9D,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;oBAC3D,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;gBACrD,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;CACF;AAED,SAAS,kBAAkB,CAAC,KAAwB;IAClD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC1C,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9B,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;gBACnB,CAAC,EAAE,CAAC;YACN,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"chain.js","sourceRoot":"","sources":["../../src/x509/chain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;EAcE;AAEF;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAUjE,MAAM,OAAO,wBAAwB;IAMnC,YAAY,IAAqC;QAC/C,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC;QACxC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;QACtC,IAAI,CAAC,UAAU,GAAG,kBAAkB,CAAC;YACnC,GAAG,IAAI,CAAC,YAAY;YACpB,IAAI,CAAC,aAAa;SACnB,CAAC,CAAC;QACH,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IAClC,CAAC;IAEM,KAAK,CAAC,MAAM;QACjB,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAE1C,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;QAEhC,MAAM,YAAY,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAClD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAClC,CAAC;QAEF,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CACb,2DAA2D,CAC5D,CAAC;QACJ,CAAC;QAED,OAAO,eAAe,CAAC;IACzB,CAAC;IAEO,KAAK,CAAC,IAAI;QAChB,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC;QAEpC,IAAI,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAE5C,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAC5B,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CACtD,CAAC;QAEF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACvD,CAAC;QAED,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CACvC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CACxC,CAAC;QAEF,OAAO,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1C,CAAC;IAEO,KAAK,CAAC,UAAU,CACtB,WAA4B;QAE5B,MAAM,KAAK,GAAG,EAAE,CAAC;QACjB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;QAEnD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACrD,CAAC;QAED,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACxC,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;YAE1B,IAAI,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC/B,KAAK,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;gBAC1B,SAAS;YACX,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;YAE/C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACzC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACvC,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,KAAK,CAAC,UAAU,CACtB,WAA4B;QAE5B,MAAM,OAAO,GAAsB,EAAE,CAAC;QACtC,IAAI,aAAqC,CAAC;QAE1C,IAAI,eAAe,CAAC,WAAW,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;YAC7D,IAAI,MAAM,WAAW,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC/B,OAAO,CAAC,WAAW,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;QAED,IAAI,WAAW,CAAC,iBAAiB,EAAE,CAAC;YAClC,aAAa,GAAG,WAAW,CAAC,iBAAiB,CAAC,aAAa,CAAC;QAC9D,CAAC;QAED,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,cAAc,EAAE,EAAE;YACzC,IAAI,aAAa,EAAE,CAAC;gBAClB,IAAI,cAAc,CAAC,eAAe,EAAE,CAAC;oBACnC,IACE,eAAe,CACb,cAAc,CAAC,eAAe,CAAC,aAAa,EAC5C,aAAa,CACd,EACD,CAAC;wBACD,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;oBAC/B,CAAC;oBACD,OAAO;gBACT,CAAC;YACH,CAAC;YAED,IAAI,eAAe,CAAC,cAAc,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;gBAChE,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YAC/B,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,MAAM,eAAe,GAAsB,EAAE,CAAC;QAC9C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,CAAC;gBACH,IAAI,MAAM,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;oBACrC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAC/B,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,+BAA+B;YACjC,CAAC;QACH,CAAC;QAED,OAAO,eAAe,CAAC;IACzB,CAAC;IAEO,SAAS,CAAC,IAAuB;QACvC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CACb,yDAAyD,CAC1D,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,CAAC;QAED,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC1C,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC1D,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;YACzD,CAAC;QACH,CAAC;QAED,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YAErB,IAAI,IAAI,CAAC,mBAAmB,EAAE,IAAI,EAAE,CAAC;gBACnC,MAAM,UAAU,GAAG,IAAI,CAAC,mBAAmB,CAAC,iBAAiB,CAAC;gBAE9D,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;oBAC3D,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;gBACrD,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;CACF;AAED,SAAS,kBAAkB,CAAC,KAAwB;IAClD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC1C,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9B,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;gBACnB,CAAC,EAAE,CAAC;YACN,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC","sourcesContent":["/*\nCopyright 2023 The Sigstore Authors.\n\nLicensed under the Apache License, Version 2.0 (the \"License\");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\n    http://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n*/\n\n/*\n * Certificate chain verification for browser environments\n *\n * Ported from sigstore-js:\n * https://github.com/sigstore/sigstore-js/blob/main/packages/verify/src/key/certificate.ts\n *\n * Key differences from sigstore-js:\n * - Browser-compatible: async verify() method for Web Crypto API\n * - Uses Uint8Array instead of Buffer for binary data\n * - Uses uint8ArrayEqual for Uint8Array comparisons\n */\n\nimport { uint8ArrayEqual } from \"@freedomofpress/crypto-browser\";\n\nimport { X509Certificate } from \"./cert.js\";\n\ninterface CertificateChainVerifierOptions {\n  trustedCerts: X509Certificate[];\n  untrustedCert: X509Certificate;\n  timestamp: Date;\n}\n\nexport class CertificateChainVerifier {\n  private untrustedCert: X509Certificate;\n  private trustedCerts: X509Certificate[];\n  private localCerts: X509Certificate[];\n  private timestamp: Date;\n\n  constructor(opts: CertificateChainVerifierOptions) {\n    this.untrustedCert = opts.untrustedCert;\n    this.trustedCerts = opts.trustedCerts;\n    this.localCerts = dedupeCertificates([\n      ...opts.trustedCerts,\n      opts.untrustedCert,\n    ]);\n    this.timestamp = opts.timestamp;\n  }\n\n  public async verify(): Promise<X509Certificate[]> {\n    const certificatePath = await this.sort();\n\n    this.checkPath(certificatePath);\n\n    const validForDate = certificatePath.every((cert) =>\n      cert.validForDate(this.timestamp)\n    );\n\n    if (!validForDate) {\n      throw new Error(\n        \"certificate is not valid or expired at the specified date\"\n      );\n    }\n\n    return certificatePath;\n  }\n\n  private async sort(): Promise<X509Certificate[]> {\n    const leafCert = this.untrustedCert;\n\n    let paths = await this.buildPaths(leafCert);\n\n    paths = paths.filter((path) =>\n      path.some((cert) => this.trustedCerts.includes(cert))\n    );\n\n    if (paths.length === 0) {\n      throw new Error(\"no trusted certificate path found\");\n    }\n\n    const path = paths.reduce((prev, curr) =>\n      prev.length < curr.length ? prev : curr\n    );\n\n    return [leafCert, ...path].slice(0, -1);\n  }\n\n  private async buildPaths(\n    certificate: X509Certificate\n  ): Promise<X509Certificate[][]> {\n    const paths = [];\n    const issuers = await this.findIssuer(certificate);\n\n    if (issuers.length === 0) {\n      throw new Error(\"no valid certificate path found\");\n    }\n\n    for (let i = 0; i < issuers.length; i++) {\n      const issuer = issuers[i];\n\n      if (issuer.equals(certificate)) {\n        paths.push([certificate]);\n        continue;\n      }\n\n      const subPaths = await this.buildPaths(issuer);\n\n      for (let j = 0; j < subPaths.length; j++) {\n        paths.push([issuer, ...subPaths[j]]);\n      }\n    }\n\n    return paths;\n  }\n\n  private async findIssuer(\n    certificate: X509Certificate\n  ): Promise<X509Certificate[]> {\n    const issuers: X509Certificate[] = [];\n    let keyIdentifier: Uint8Array | undefined;\n\n    if (uint8ArrayEqual(certificate.subject, certificate.issuer)) {\n      if (await certificate.verify()) {\n        return [certificate];\n      }\n    }\n\n    if (certificate.extAuthorityKeyID) {\n      keyIdentifier = certificate.extAuthorityKeyID.keyIdentifier;\n    }\n\n    this.localCerts.forEach((possibleIssuer) => {\n      if (keyIdentifier) {\n        if (possibleIssuer.extSubjectKeyID) {\n          if (\n            uint8ArrayEqual(\n              possibleIssuer.extSubjectKeyID.keyIdentifier,\n              keyIdentifier\n            )\n          ) {\n            issuers.push(possibleIssuer);\n          }\n          return;\n        }\n      }\n\n      if (uint8ArrayEqual(possibleIssuer.subject, certificate.issuer)) {\n        issuers.push(possibleIssuer);\n      }\n    });\n\n    const verifiedIssuers: X509Certificate[] = [];\n    for (const issuer of issuers) {\n      try {\n        if (await certificate.verify(issuer)) {\n          verifiedIssuers.push(issuer);\n        }\n      } catch {\n        // Ignore verification failures\n      }\n    }\n\n    return verifiedIssuers;\n  }\n\n  private checkPath(path: X509Certificate[]): void {\n    if (path.length < 1) {\n      throw new Error(\n        \"certificate chain must contain at least one certificate\"\n      );\n    }\n\n    const validCAs = path.slice(1).every((cert) => cert.isCA);\n    if (!validCAs) {\n      throw new Error(\"intermediate certificate is not a CA\");\n    }\n\n    for (let i = path.length - 2; i >= 0; i--) {\n      if (!uint8ArrayEqual(path[i].issuer, path[i + 1].subject)) {\n        throw new Error(\"incorrect certificate name chaining\");\n      }\n    }\n\n    for (let i = 0; i < path.length; i++) {\n      const cert = path[i];\n\n      if (cert.extBasicConstraints?.isCA) {\n        const pathLength = cert.extBasicConstraints.pathLenConstraint;\n\n        if (pathLength !== undefined && pathLength < BigInt(i - 1)) {\n          throw new Error(\"path length constraint exceeded\");\n        }\n      }\n    }\n  }\n}\n\nfunction dedupeCertificates(certs: X509Certificate[]): X509Certificate[] {\n  for (let i = 0; i < certs.length; i++) {\n    for (let j = i + 1; j < certs.length; j++) {\n      if (certs[i].equals(certs[j])) {\n        certs.splice(j, 1);\n        j--;\n      }\n    }\n  }\n  return certs;\n}\n"]}

package/dist/x509/ext.d.ts

@@ -109,4 +109,3 @@ export declare class X509SCTExtension extends X509Extension {
     get signedCertificateTimestamps(): SignedCertificateTimestamp[];
 }
 export {};
-//# sourceMappingURL=ext.d.ts.map

package/dist/x509/ext.js.map

@@ -1 +1 @@
-{"version":3,"file":"ext.js","sourceRoot":"","sources":["../../src/x509/ext.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;EAcE;AACF,OAAO,EAAW,UAAU,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AACzF,OAAO,EAAE,0BAA0B,EAAE,MAAM,UAAU,CAAC;AAEtD,qDAAqD;AACrD,MAAM,OAAO,aAAa;IAGxB,YAAY,IAAa;QACvB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,IAAI,GAAG;QACL,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;IACnC,CAAC;IAED,IAAI,QAAQ;QACV,uEAAuE;QACvE,kEAAkE;QAClE,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;IAC7E,CAAC;IAED,IAAI,KAAK;QACP,OAAO,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC;IACjC,CAAC;IAED,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED,IAAc,YAAY;QACxB,yEAAyE;QACzE,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACnD,CAAC;CACF;AAED,yDAAyD;AACzD,MAAM,OAAO,6BAA8B,SAAQ,aAAa;IAC9D,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,KAAK,CAAC;IACrD,CAAC;IAED,IAAI,iBAAiB;QACnB,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;YAClC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE;YACnC,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IAED,uEAAuE;IACvE,qBAAqB;IACrB,IAAY,QAAQ;QAClB,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACnC,CAAC;CACF;AAED,yDAAyD;AACzD,MAAM,OAAO,qBAAsB,SAAQ,aAAa;IACtD,IAAI,gBAAgB;QAClB,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;IAED,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;IAED,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;IAED,uEAAuE;IACvE,2CAA2C;IAC3C,IAAY,SAAS;QACnB,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IACjD,CAAC;CACF;AAED,yDAAyD;AACzD,MAAM,OAAO,mCAAoC,SAAQ,aAAa;IACpE,IAAI,UAAU;QACZ,MAAM,UAAU,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC;QACrD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,SAAS,CAAC;QACnB,CAAC;aAAM,CAAC;YACN,OAAO,kBAAkB,CAAC,UAAU,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;IAED,IAAI,GAAG;QACL,MAAM,GAAG,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC;QAC9C,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,OAAO,SAAS,CAAC;QACnB,CAAC;aAAM,CAAC;YACN,OAAO,kBAAkB,CAAC,GAAG,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IAED,yDAAyD;IAClD,SAAS,CAAC,GAAW;QAC1B,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QAE7C,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,6DAA6D;QAC7D,gEAAgE;QAChE,MAAM,YAAY,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;QAC/C,IAAI,YAAY,KAAK,GAAG,EAAE,CAAC;YACzB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,gEAAgE;QAChE,MAAM,cAAc,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACzC,OAAO,kBAAkB,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC1D,CAAC;IAEO,eAAe,CAAC,GAAW;QACjC,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC;IACvE,CAAC;IAED,2DAA2D;IAC3D,IAAY,YAAY;QACtB,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACxC,CAAC;CACF;AAED,yDAAyD;AACzD,MAAM,OAAO,2BAA4B,SAAQ,aAAa;IAC5D,IAAI,aAAa;QACf,OAAO,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC;IAC9C,CAAC;IAEO,kBAAkB,CAAC,GAAW;QACpC,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC;IACxE,CAAC;IAED,4EAA4E;IAC5E,IAAY,QAAQ;QAClB,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACnC,CAAC;CACF;AAED,yDAAyD;AACzD,MAAM,OAAO,yBAA0B,SAAQ,aAAa;IAC1D,IAAI,aAAa;QACf,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACzC,CAAC;CACF;AAED,2EAA2E;AAC3E,gEAAgE;AAChE,MAAM,qBAAsB,SAAQ,aAAa;IAC/C,IAAI,WAAW;QACb,OAAO,kBAAkB,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;IACrD,CAAC;CACF;AAED,2EAA2E;AAC3E,MAAM,qBAAsB,SAAQ,aAAa;IAC/C,IAAI,WAAW;QACb,OAAO,kBAAkB,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC7D,CAAC;CACF;AAED,+CAA+C;AAC/C,MAAM,OAAO,kBAAmB,SAAQ,qBAAqB;IAC3D,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;CACF;AAED,2DAA2D;AAC3D,MAAM,OAAO,kCAAmC,SAAQ,qBAAqB;IAC3E,IAAI,eAAe;QACjB,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;CACF;AAED,uDAAuD;AACvD,MAAM,OAAO,8BAA+B,SAAQ,qBAAqB;IACvE,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;CACF;AAED,wDAAwD;AACxD,MAAM,OAAO,+BAAgC,SAAQ,qBAAqB;IACxE,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;CACF;AAED,8DAA8D;AAC9D,MAAM,OAAO,qCAAsC,SAAQ,qBAAqB;IAC9E,IAAI,kBAAkB;QACpB,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;CACF;AAED,uDAAuD;AACvD,MAAM,OAAO,8BAA+B,SAAQ,qBAAqB;IACvE,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;CACF;AAED,+CAA+C;AAC/C,MAAM,OAAO,kBAAmB,SAAQ,qBAAqB;IAC3D,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;CACF;AAED,oDAAoD;AACpD,MAAM,OAAO,2BAA4B,SAAQ,qBAAqB;IACpE,IAAI,cAAc;QAChB,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;CACF;AAED,wDAAwD;AACxD,MAAM,OAAO,8BAA+B,SAAQ,qBAAqB;IACvE,IAAI,iBAAiB;QACnB,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;CACF;AAED,uDAAuD;AACvD,MAAM,OAAO,8BAA+B,SAAQ,qBAAqB;IACvE,IAAI,iBAAiB;QACnB,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;CACF;AAED,0DAA0D;AAC1D,MAAM,OAAO,gCAAiC,SAAQ,qBAAqB;IACzE,IAAI,mBAAmB;QACrB,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;CACF;AAED,6DAA6D;AAC7D,MAAM,OAAO,mCAAoC,SAAQ,qBAAqB;IAC5E,IAAI,sBAAsB;QACxB,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;CACF;AAED,0DAA0D;AAC1D,MAAM,OAAO,gCAAiC,SAAQ,qBAAqB;IACzE,IAAI,mBAAmB;QACrB,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;CACF;AAED,iEAAiE;AACjE,MAAM,OAAO,uCAAwC,SAAQ,qBAAqB;IAChF,IAAI,0BAA0B;QAC5B,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;CACF;AAED,gEAAgE;AAChE,MAAM,OAAO,qCAAsC,SAAQ,qBAAqB;IAC9E,IAAI,wBAAwB;QAC1B,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;CACF;AAED,uEAAuE;AACvE,MAAM,OAAO,4CAA6C,SAAQ,qBAAqB;IACrF,IAAI,+BAA+B;QACjC,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;CACF;AAED,qDAAqD;AACrD,MAAM,OAAO,2BAA4B,SAAQ,qBAAqB;IACpE,IAAI,cAAc;QAChB,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;CACF;AAED,wDAAwD;AACxD,MAAM,OAAO,8BAA+B,SAAQ,qBAAqB;IACvE,IAAI,iBAAiB;QACnB,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;CACF;AAED,kDAAkD;AAClD,MAAM,OAAO,yBAA0B,SAAQ,qBAAqB;IAClE,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;CACF;AAED,uDAAuD;AACvD,MAAM,OAAO,6BAA8B,SAAQ,qBAAqB;IACtE,IAAI,gBAAgB;QAClB,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;CACF;AAED,iEAAiE;AACjE,MAAM,OAAO,uCAAwC,SAAQ,qBAAqB;IAChF,IAAI,0BAA0B;QAC5B,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;CACF;AAED,qDAAqD;AACrD,MAAM,OAAO,gBAAiB,SAAQ,aAAa;IACjD,YAAY,IAAa;QACvB,KAAK,CAAC,IAAI,CAAC,CAAC;IACd,CAAC;IAED,IAAI,2BAA2B;QAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAC5C,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;QAEnC,yEAAyE;QACzE,yEAAyE;QACzE,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAEnC,MAAM,OAAO,GAAiC,EAAE,CAAC;QACjD,OAAO,MAAM,CAAC,QAAQ,GAAG,GAAG,EAAE,CAAC;YAC7B,kCAAkC;YAClC,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;YAErC,oDAAoD;YACpD,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;YACvC,OAAO,CAAC,IAAI,CAAC,0BAA0B,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QACtD,CAAC;QAED,IAAI,MAAM,CAAC,QAAQ,KAAK,GAAG,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAClE,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;CACF"}
+{"version":3,"file":"ext.js","sourceRoot":"","sources":["../../src/x509/ext.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;EAcE;AACF,OAAO,EAAW,UAAU,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AAEzF,OAAO,EAAE,0BAA0B,EAAE,MAAM,UAAU,CAAC;AAEtD,qDAAqD;AACrD,MAAM,OAAO,aAAa;IAGxB,YAAY,IAAa;QACvB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,IAAI,GAAG;QACL,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;IACnC,CAAC;IAED,IAAI,QAAQ;QACV,uEAAuE;QACvE,kEAAkE;QAClE,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;IAC7E,CAAC;IAED,IAAI,KAAK;QACP,OAAO,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC;IACjC,CAAC;IAED,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED,IAAc,YAAY;QACxB,yEAAyE;QACzE,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACnD,CAAC;CACF;AAED,yDAAyD;AACzD,MAAM,OAAO,6BAA8B,SAAQ,aAAa;IAC9D,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,KAAK,CAAC;IACrD,CAAC;IAED,IAAI,iBAAiB;QACnB,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;YAClC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE;YACnC,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IAED,uEAAuE;IACvE,qBAAqB;IACrB,IAAY,QAAQ;QAClB,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACnC,CAAC;CACF;AAED,yDAAyD;AACzD,MAAM,OAAO,qBAAsB,SAAQ,aAAa;IACtD,IAAI,gBAAgB;QAClB,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;IAED,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;IAED,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;IAED,uEAAuE;IACvE,2CAA2C;IAC3C,IAAY,SAAS;QACnB,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IACjD,CAAC;CACF;AAED,yDAAyD;AACzD,MAAM,OAAO,mCAAoC,SAAQ,aAAa;IACpE,IAAI,UAAU;QACZ,MAAM,UAAU,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC;QACrD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,SAAS,CAAC;QACnB,CAAC;aAAM,CAAC;YACN,OAAO,kBAAkB,CAAC,UAAU,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;IAED,IAAI,GAAG;QACL,MAAM,GAAG,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC;QAC9C,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,OAAO,SAAS,CAAC;QACnB,CAAC;aAAM,CAAC;YACN,OAAO,kBAAkB,CAAC,GAAG,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IAED,yDAAyD;IAClD,SAAS,CAAC,GAAW;QAC1B,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QAE7C,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,6DAA6D;QAC7D,gEAAgE;QAChE,MAAM,YAAY,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;QAC/C,IAAI,YAAY,KAAK,GAAG,EAAE,CAAC;YACzB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,gEAAgE;QAChE,MAAM,cAAc,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACzC,OAAO,kBAAkB,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC1D,CAAC;IAEO,eAAe,CAAC,GAAW;QACjC,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC;IACvE,CAAC;IAED,2DAA2D;IAC3D,IAAY,YAAY;QACtB,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACxC,CAAC;CACF;AAED,yDAAyD;AACzD,MAAM,OAAO,2BAA4B,SAAQ,aAAa;IAC5D,IAAI,aAAa;QACf,OAAO,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC;IAC9C,CAAC;IAEO,kBAAkB,CAAC,GAAW;QACpC,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC;IACxE,CAAC;IAED,4EAA4E;IAC5E,IAAY,QAAQ;QAClB,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACnC,CAAC;CACF;AAED,yDAAyD;AACzD,MAAM,OAAO,yBAA0B,SAAQ,aAAa;IAC1D,IAAI,aAAa;QACf,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACzC,CAAC;CACF;AAED,2EAA2E;AAC3E,gEAAgE;AAChE,MAAM,qBAAsB,SAAQ,aAAa;IAC/C,IAAI,WAAW;QACb,OAAO,kBAAkB,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;IACrD,CAAC;CACF;AAED,2EAA2E;AAC3E,MAAM,qBAAsB,SAAQ,aAAa;IAC/C,IAAI,WAAW;QACb,OAAO,kBAAkB,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC7D,CAAC;CACF;AAED,+CAA+C;AAC/C,MAAM,OAAO,kBAAmB,SAAQ,qBAAqB;IAC3D,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;CACF;AAED,2DAA2D;AAC3D,MAAM,OAAO,kCAAmC,SAAQ,qBAAqB;IAC3E,IAAI,eAAe;QACjB,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;CACF;AAED,uDAAuD;AACvD,MAAM,OAAO,8BAA+B,SAAQ,qBAAqB;IACvE,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;CACF;AAED,wDAAwD;AACxD,MAAM,OAAO,+BAAgC,SAAQ,qBAAqB;IACxE,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;CACF;AAED,8DAA8D;AAC9D,MAAM,OAAO,qCAAsC,SAAQ,qBAAqB;IAC9E,IAAI,kBAAkB;QACpB,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;CACF;AAED,uDAAuD;AACvD,MAAM,OAAO,8BAA+B,SAAQ,qBAAqB;IACvE,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;CACF;AAED,+CAA+C;AAC/C,MAAM,OAAO,kBAAmB,SAAQ,qBAAqB;IAC3D,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;CACF;AAED,oDAAoD;AACpD,MAAM,OAAO,2BAA4B,SAAQ,qBAAqB;IACpE,IAAI,cAAc;QAChB,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;CACF;AAED,wDAAwD;AACxD,MAAM,OAAO,8BAA+B,SAAQ,qBAAqB;IACvE,IAAI,iBAAiB;QACnB,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;CACF;AAED,uDAAuD;AACvD,MAAM,OAAO,8BAA+B,SAAQ,qBAAqB;IACvE,IAAI,iBAAiB;QACnB,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;CACF;AAED,0DAA0D;AAC1D,MAAM,OAAO,gCAAiC,SAAQ,qBAAqB;IACzE,IAAI,mBAAmB;QACrB,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;CACF;AAED,6DAA6D;AAC7D,MAAM,OAAO,mCAAoC,SAAQ,qBAAqB;IAC5E,IAAI,sBAAsB;QACxB,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;CACF;AAED,0DAA0D;AAC1D,MAAM,OAAO,gCAAiC,SAAQ,qBAAqB;IACzE,IAAI,mBAAmB;QACrB,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;CACF;AAED,iEAAiE;AACjE,MAAM,OAAO,uCAAwC,SAAQ,qBAAqB;IAChF,IAAI,0BAA0B;QAC5B,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;CACF;AAED,gEAAgE;AAChE,MAAM,OAAO,qCAAsC,SAAQ,qBAAqB;IAC9E,IAAI,wBAAwB;QAC1B,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;CACF;AAED,uEAAuE;AACvE,MAAM,OAAO,4CAA6C,SAAQ,qBAAqB;IACrF,IAAI,+BAA+B;QACjC,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;CACF;AAED,qDAAqD;AACrD,MAAM,OAAO,2BAA4B,SAAQ,qBAAqB;IACpE,IAAI,cAAc;QAChB,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;CACF;AAED,wDAAwD;AACxD,MAAM,OAAO,8BAA+B,SAAQ,qBAAqB;IACvE,IAAI,iBAAiB;QACnB,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;CACF;AAED,kDAAkD;AAClD,MAAM,OAAO,yBAA0B,SAAQ,qBAAqB;IAClE,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;CACF;AAED,uDAAuD;AACvD,MAAM,OAAO,6BAA8B,SAAQ,qBAAqB;IACtE,IAAI,gBAAgB;QAClB,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;CACF;AAED,iEAAiE;AACjE,MAAM,OAAO,uCAAwC,SAAQ,qBAAqB;IAChF,IAAI,0BAA0B;QAC5B,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;CACF;AAED,qDAAqD;AACrD,MAAM,OAAO,gBAAiB,SAAQ,aAAa;IACjD,YAAY,IAAa;QACvB,KAAK,CAAC,IAAI,CAAC,CAAC;IACd,CAAC;IAED,IAAI,2BAA2B;QAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAC5C,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;QAEnC,yEAAyE;QACzE,yEAAyE;QACzE,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAEnC,MAAM,OAAO,GAAiC,EAAE,CAAC;QACjD,OAAO,MAAM,CAAC,QAAQ,GAAG,GAAG,EAAE,CAAC;YAC7B,kCAAkC;YAClC,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;YAErC,oDAAoD;YACpD,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;YACvC,OAAO,CAAC,IAAI,CAAC,0BAA0B,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QACtD,CAAC;QAED,IAAI,MAAM,CAAC,QAAQ,KAAK,GAAG,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAClE,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;CACF","sourcesContent":["/*\nCopyright 2023 The Sigstore Authors.\n\nLicensed under the Apache License, Version 2.0 (the \"License\");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\n    http://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n*/\nimport { ASN1Obj, ByteStream, Uint8ArrayToString } from \"@freedomofpress/crypto-browser\";\n\nimport { SignedCertificateTimestamp } from \"./sct.js\";\n\n// https://www.rfc-editor.org/rfc/rfc5280#section-4.1\nexport class X509Extension {\n  protected root: ASN1Obj;\n\n  constructor(asn1: ASN1Obj) {\n    this.root = asn1;\n  }\n\n  get oid(): string {\n    return this.root.subs[0].toOID();\n  }\n\n  get critical(): boolean {\n    // The critical field is optional and will be the second element of the\n    // extension sequence if present. Default to false if not present.\n    return this.root.subs.length === 3 ? this.root.subs[1].toBoolean() : false;\n  }\n\n  get value(): Uint8Array {\n    return this.extnValueObj.value;\n  }\n\n  get valueObj(): ASN1Obj {\n    return this.extnValueObj;\n  }\n\n  protected get extnValueObj(): ASN1Obj {\n    // The extnValue field will be the last element of the extension sequence\n    return this.root.subs[this.root.subs.length - 1];\n  }\n}\n\n// https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.9\nexport class X509BasicConstraintsExtension extends X509Extension {\n  get isCA(): boolean {\n    return this.sequence.subs[0]?.toBoolean() ?? false;\n  }\n\n  get pathLenConstraint(): bigint | undefined {\n    return this.sequence.subs.length > 1\n      ? this.sequence.subs[1].toInteger()\n      : undefined;\n  }\n\n  // The extnValue field contains a single sequence wrapping the isCA and\n  // pathLenConstraint.\n  private get sequence(): ASN1Obj {\n    return this.extnValueObj.subs[0];\n  }\n}\n\n// https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.3\nexport class X509KeyUsageExtension extends X509Extension {\n  get digitalSignature(): boolean {\n    return this.bitString[0] === 1;\n  }\n\n  get keyCertSign(): boolean {\n    return this.bitString[5] === 1;\n  }\n\n  get crlSign(): boolean {\n    return this.bitString[6] === 1;\n  }\n\n  // The extnValue field contains a single bit string which is a bit mask\n  // indicating which key usages are enabled.\n  private get bitString(): number[] {\n    return this.extnValueObj.subs[0].toBitString();\n  }\n}\n\n// https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.6\nexport class X509SubjectAlternativeNameExtension extends X509Extension {\n  get rfc822Name(): string | undefined {\n    const rfc822Name = this.findGeneralName(0x01)?.value;\n    if (rfc822Name === undefined) {\n      return undefined;\n    } else {\n      return Uint8ArrayToString(rfc822Name);\n    }\n  }\n\n  get uri(): string | undefined {\n    const uri = this.findGeneralName(0x06)?.value;\n    if (uri === undefined) {\n      return undefined;\n    } else {\n      return Uint8ArrayToString(uri);\n    }\n  }\n\n  // Retrieve the value of an otherName with the given OID.\n  public otherName(oid: string): string | undefined {\n    const otherName = this.findGeneralName(0x00);\n\n    if (otherName === undefined) {\n      return undefined;\n    }\n\n    // The otherName is a sequence containing an OID and a value.\n    // Need to check that the OID matches the one we're looking for.\n    const otherNameOID = otherName.subs[0].toOID();\n    if (otherNameOID !== oid) {\n      return undefined;\n    }\n\n    // The otherNameValue is a sequence containing the actual value.\n    const otherNameValue = otherName.subs[1];\n    return Uint8ArrayToString(otherNameValue.subs[0].value);\n  }\n\n  private findGeneralName(tag: number): ASN1Obj | undefined {\n    return this.generalNames.find((gn) => gn.tag.isContextSpecific(tag));\n  }\n\n  // The extnValue field contains a sequence of GeneralNames.\n  private get generalNames(): ASN1Obj[] {\n    return this.extnValueObj.subs[0].subs;\n  }\n}\n\n// https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.1\nexport class X509AuthorityKeyIDExtension extends X509Extension {\n  get keyIdentifier(): Uint8Array | undefined {\n    return this.findSequenceMember(0x00)?.value;\n  }\n\n  private findSequenceMember(tag: number): ASN1Obj | undefined {\n    return this.sequence.subs.find((el) => el.tag.isContextSpecific(tag));\n  }\n\n  // The extnValue field contains a single sequence wrapping the keyIdentifier\n  private get sequence(): ASN1Obj {\n    return this.extnValueObj.subs[0];\n  }\n}\n\n// https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.2\nexport class X509SubjectKeyIDExtension extends X509Extension {\n  get keyIdentifier(): Uint8Array {\n    return this.extnValueObj.subs[0].value;\n  }\n}\n\n// Base class for Fulcio extensions with V1 format (raw OCTET STRING value)\n// https://github.com/sigstore/fulcio/blob/main/docs/oid-info.md\nclass X509FulcioExtensionV1 extends X509Extension {\n  get stringValue(): string {\n    return Uint8ArrayToString(this.extnValueObj.value);\n  }\n}\n\n// Base class for Fulcio extensions with V2 format (DER-encoded UTF8String)\nclass X509FulcioExtensionV2 extends X509Extension {\n  get stringValue(): string {\n    return Uint8ArrayToString(this.extnValueObj.subs[0].value);\n  }\n}\n\n// OID 1.3.6.1.4.1.57264.1.1 - OIDC Issuer (V1)\nexport class X509FulcioIssuerV1 extends X509FulcioExtensionV1 {\n  get issuer(): string {\n    return this.stringValue;\n  }\n}\n\n// OID 1.3.6.1.4.1.57264.1.2 - GitHub Workflow Trigger (V1)\nexport class X509GitHubWorkflowTriggerExtension extends X509FulcioExtensionV1 {\n  get workflowTrigger(): string {\n    return this.stringValue;\n  }\n}\n\n// OID 1.3.6.1.4.1.57264.1.3 - GitHub Workflow SHA (V1)\nexport class X509GitHubWorkflowSHAExtension extends X509FulcioExtensionV1 {\n  get workflowSHA(): string {\n    return this.stringValue;\n  }\n}\n\n// OID 1.3.6.1.4.1.57264.1.4 - GitHub Workflow Name (V1)\nexport class X509GitHubWorkflowNameExtension extends X509FulcioExtensionV1 {\n  get workflowName(): string {\n    return this.stringValue;\n  }\n}\n\n// OID 1.3.6.1.4.1.57264.1.5 - GitHub Workflow Repository (V1)\nexport class X509GitHubWorkflowRepositoryExtension extends X509FulcioExtensionV1 {\n  get workflowRepository(): string {\n    return this.stringValue;\n  }\n}\n\n// OID 1.3.6.1.4.1.57264.1.6 - GitHub Workflow Ref (V1)\nexport class X509GitHubWorkflowRefExtension extends X509FulcioExtensionV1 {\n  get workflowRef(): string {\n    return this.stringValue;\n  }\n}\n\n// OID 1.3.6.1.4.1.57264.1.8 - OIDC Issuer (V2)\nexport class X509FulcioIssuerV2 extends X509FulcioExtensionV2 {\n  get issuer(): string {\n    return this.stringValue;\n  }\n}\n\n// OID 1.3.6.1.4.1.57264.1.9 - Build Signer URI (V2)\nexport class X509BuildSignerURIExtension extends X509FulcioExtensionV2 {\n  get buildSignerURI(): string {\n    return this.stringValue;\n  }\n}\n\n// OID 1.3.6.1.4.1.57264.1.10 - Build Signer Digest (V2)\nexport class X509BuildSignerDigestExtension extends X509FulcioExtensionV2 {\n  get buildSignerDigest(): string {\n    return this.stringValue;\n  }\n}\n\n// OID 1.3.6.1.4.1.57264.1.11 - Runner Environment (V2)\nexport class X509RunnerEnvironmentExtension extends X509FulcioExtensionV2 {\n  get runnerEnvironment(): string {\n    return this.stringValue;\n  }\n}\n\n// OID 1.3.6.1.4.1.57264.1.12 - Source Repository URI (V2)\nexport class X509SourceRepositoryURIExtension extends X509FulcioExtensionV2 {\n  get sourceRepositoryURI(): string {\n    return this.stringValue;\n  }\n}\n\n// OID 1.3.6.1.4.1.57264.1.13 - Source Repository Digest (V2)\nexport class X509SourceRepositoryDigestExtension extends X509FulcioExtensionV2 {\n  get sourceRepositoryDigest(): string {\n    return this.stringValue;\n  }\n}\n\n// OID 1.3.6.1.4.1.57264.1.14 - Source Repository Ref (V2)\nexport class X509SourceRepositoryRefExtension extends X509FulcioExtensionV2 {\n  get sourceRepositoryRef(): string {\n    return this.stringValue;\n  }\n}\n\n// OID 1.3.6.1.4.1.57264.1.15 - Source Repository Identifier (V2)\nexport class X509SourceRepositoryIdentifierExtension extends X509FulcioExtensionV2 {\n  get sourceRepositoryIdentifier(): string {\n    return this.stringValue;\n  }\n}\n\n// OID 1.3.6.1.4.1.57264.1.16 - Source Repository Owner URI (V2)\nexport class X509SourceRepositoryOwnerURIExtension extends X509FulcioExtensionV2 {\n  get sourceRepositoryOwnerURI(): string {\n    return this.stringValue;\n  }\n}\n\n// OID 1.3.6.1.4.1.57264.1.17 - Source Repository Owner Identifier (V2)\nexport class X509SourceRepositoryOwnerIdentifierExtension extends X509FulcioExtensionV2 {\n  get sourceRepositoryOwnerIdentifier(): string {\n    return this.stringValue;\n  }\n}\n\n// OID 1.3.6.1.4.1.57264.1.18 - Build Config URI (V2)\nexport class X509BuildConfigURIExtension extends X509FulcioExtensionV2 {\n  get buildConfigURI(): string {\n    return this.stringValue;\n  }\n}\n\n// OID 1.3.6.1.4.1.57264.1.19 - Build Config Digest (V2)\nexport class X509BuildConfigDigestExtension extends X509FulcioExtensionV2 {\n  get buildConfigDigest(): string {\n    return this.stringValue;\n  }\n}\n\n// OID 1.3.6.1.4.1.57264.1.20 - Build Trigger (V2)\nexport class X509BuildTriggerExtension extends X509FulcioExtensionV2 {\n  get buildTrigger(): string {\n    return this.stringValue;\n  }\n}\n\n// OID 1.3.6.1.4.1.57264.1.21 - Run Invocation URI (V2)\nexport class X509RunInvocationURIExtension extends X509FulcioExtensionV2 {\n  get runInvocationURI(): string {\n    return this.stringValue;\n  }\n}\n\n// OID 1.3.6.1.4.1.57264.1.22 - Source Repository Visibility (V2)\nexport class X509SourceRepositoryVisibilityExtension extends X509FulcioExtensionV2 {\n  get sourceRepositoryVisibility(): string {\n    return this.stringValue;\n  }\n}\n\n// https://www.rfc-editor.org/rfc/rfc6962#section-3.3\nexport class X509SCTExtension extends X509Extension {\n  constructor(asn1: ASN1Obj) {\n    super(asn1);\n  }\n\n  get signedCertificateTimestamps(): SignedCertificateTimestamp[] {\n    const buf = this.extnValueObj.subs[0].value;\n    const stream = new ByteStream(buf);\n\n    // The overall list length is encoded in the first two bytes -- note this\n    // is the length of the list in bytes, NOT the number of SCTs in the list\n    const end = stream.getUint16() + 2;\n\n    const sctList: SignedCertificateTimestamp[] = [];\n    while (stream.position < end) {\n      // Read the length of the next SCT\n      const sctLength = stream.getUint16();\n\n      // Slice out the bytes for the next SCT and parse it\n      const sct = stream.getBlock(sctLength);\n      sctList.push(SignedCertificateTimestamp.parse(sct));\n    }\n\n    if (stream.position !== end) {\n      throw new Error(\"SCT list length does not match actual length\");\n    }\n\n    return sctList;\n  }\n}\n"]}

package/dist/x509/index.d.ts

@@ -1,4 +1,3 @@
 export { EXTENSION_OID_SCT, X509Certificate } from "./cert.js";
-export { X509SCTExtension } from "./ext.js";
 export { CertificateChainVerifier } from "./chain.js";
-//# sourceMappingURL=index.d.ts.map
+export { X509SCTExtension } from "./ext.js";

package/dist/x509/index.js

@@ -14,6 +14,6 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 export { EXTENSION_OID_SCT, X509Certificate } from "./cert.js";
-export { X509SCTExtension } from "./ext.js";
 export { CertificateChainVerifier } from "./chain.js";
+export { X509SCTExtension } from "./ext.js";
 //# sourceMappingURL=index.js.map

package/dist/x509/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/x509/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;EAcE;AAEF,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAC5C,OAAO,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/x509/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;EAcE;AAEF,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC/D,OAAO,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AACtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC","sourcesContent":["/*\nCopyright 2023 The Sigstore Authors.\n\nLicensed under the Apache License, Version 2.0 (the \"License\");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\n    http://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n*/\n\nexport { EXTENSION_OID_SCT, X509Certificate } from \"./cert.js\";\nexport { CertificateChainVerifier } from \"./chain.js\";\nexport { X509SCTExtension } from \"./ext.js\";\n"]}

package/dist/x509/sct.d.ts

@@ -22,4 +22,3 @@ export declare class SignedCertificateTimestamp {
     static parse(buf: Uint8Array): SignedCertificateTimestamp;
 }
 export {};
-//# sourceMappingURL=sct.d.ts.map

package/dist/x509/sct.js.map

@@ -1 +1 @@
-{"version":3,"file":"sct.js","sourceRoot":"","sources":["../../src/x509/sct.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;EAcE;AACF,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAY7F,MAAM,OAAO,0BAA0B;IASrC,YAAY,OAAmB;QAC7B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC3B,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;QAC3C,IAAI,CAAC,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC;QACrD,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;IACrC,CAAC;IAED,IAAI,QAAQ;QACV,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAC1D,CAAC;IAED,mEAAmE;IACnE,2DAA2D;IAC3D,IAAI,SAAS;QACX,QAAQ,IAAI,CAAC,aAAa,EAAE,CAAC;YAC3B,0BAA0B;YAC1B,KAAK,CAAC;gBACJ,OAAO,MAAM,CAAC;YAChB,0BAA0B;YAC1B,KAAK,CAAC;gBACJ,OAAO,KAAK,CAAC;YACf,0BAA0B;YAC1B,KAAK,CAAC;gBACJ,OAAO,MAAM,CAAC;YAChB,0BAA0B;YAC1B,KAAK,CAAC;gBACJ,OAAO,QAAQ,CAAC;YAClB,KAAK,CAAC;gBACJ,OAAO,QAAQ,CAAC;YAClB,0BAA0B;YAC1B,KAAK,CAAC;gBACJ,OAAO,QAAQ,CAAC;YAClB,0BAA0B;YAC1B,KAAK,CAAC;gBACJ,OAAO,QAAQ,CAAC;YAClB,0BAA0B;YAC1B;gBACE,OAAO,SAAS,CAAC;QACrB,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,OAAmB,EAAE,GAAc;QACrD,0EAA0E;QAC1E,kBAAkB;QAClB,qDAAqD;QACrD,MAAM,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAChC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAChC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,2CAA2C;QACpE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAClC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,kCAAkC;QAC7D,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAC3B,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QAEhD,yDAAyD;QACzD,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,GAAG,CAAC,EAAE,CAAC;YACnC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACrC,CAAC;QAED,OAAO,MAAM,eAAe,CAC1B,GAAG,EACH,MAAM,CAAC,MAAM,EACb,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,SAAS,CACf,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,qEAAqE;IACrE,8CAA8C;IAC9C,qDAAqD;IACrD,2DAA2D;IACpD,MAAM,CAAC,KAAK,CAAC,GAAe;QACjC,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;QAEnC,kCAAkC;QAClC,mDAAmD;QACnD,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;QAClC,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,4BAA4B,OAAO,sBAAsB,CAAC,CAAC;QAC7E,CAAC;QAED,0CAA0C;QAC1C,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAElC,qBAAqB;QACrB,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAErC,6CAA6C;QAC7C,MAAM,gBAAgB,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;QAC5C,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QAErD,8CAA8C;QAC9C,MAAM,aAAa,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;QAExC,0EAA0E;QAC1E,MAAM,kBAAkB,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;QAE7C,4CAA4C;QAC5C,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;QACrC,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAE7C,uCAAuC;QACvC,IAAI,MAAM,CAAC,QAAQ,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,CAAC;QAED,OAAO,IAAI,0BAA0B,CAAC;YACpC,OAAO;YACP,KAAK;YACL,SAAS;YACT,UAAU;YACV,aAAa;YACb,kBAAkB;YAClB,SAAS;SACV,CAAC,CAAC;IACL,CAAC;CACF"}
+{"version":3,"file":"sct.js","sourceRoot":"","sources":["../../src/x509/sct.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;EAcE;AACF,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAY7F,MAAM,OAAO,0BAA0B;IASrC,YAAY,OAAmB;QAC7B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC3B,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;QAC3C,IAAI,CAAC,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC;QACrD,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;IACrC,CAAC;IAED,IAAI,QAAQ;QACV,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAC1D,CAAC;IAED,mEAAmE;IACnE,2DAA2D;IAC3D,IAAI,SAAS;QACX,QAAQ,IAAI,CAAC,aAAa,EAAE,CAAC;YAC3B,0BAA0B;YAC1B,KAAK,CAAC;gBACJ,OAAO,MAAM,CAAC;YAChB,0BAA0B;YAC1B,KAAK,CAAC;gBACJ,OAAO,KAAK,CAAC;YACf,0BAA0B;YAC1B,KAAK,CAAC;gBACJ,OAAO,MAAM,CAAC;YAChB,0BAA0B;YAC1B,KAAK,CAAC;gBACJ,OAAO,QAAQ,CAAC;YAClB,KAAK,CAAC;gBACJ,OAAO,QAAQ,CAAC;YAClB,0BAA0B;YAC1B,KAAK,CAAC;gBACJ,OAAO,QAAQ,CAAC;YAClB,0BAA0B;YAC1B,KAAK,CAAC;gBACJ,OAAO,QAAQ,CAAC;YAClB,0BAA0B;YAC1B;gBACE,OAAO,SAAS,CAAC;QACrB,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,OAAmB,EAAE,GAAc;QACrD,0EAA0E;QAC1E,kBAAkB;QAClB,qDAAqD;QACrD,MAAM,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAChC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAChC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,2CAA2C;QACpE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAClC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,kCAAkC;QAC7D,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAC3B,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QAEhD,yDAAyD;QACzD,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,GAAG,CAAC,EAAE,CAAC;YACnC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACrC,CAAC;QAED,OAAO,MAAM,eAAe,CAC1B,GAAG,EACH,MAAM,CAAC,MAAM,EACb,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,SAAS,CACf,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,qEAAqE;IACrE,8CAA8C;IAC9C,qDAAqD;IACrD,2DAA2D;IACpD,MAAM,CAAC,KAAK,CAAC,GAAe;QACjC,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;QAEnC,kCAAkC;QAClC,mDAAmD;QACnD,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;QAClC,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,4BAA4B,OAAO,sBAAsB,CAAC,CAAC;QAC7E,CAAC;QAED,0CAA0C;QAC1C,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAElC,qBAAqB;QACrB,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAErC,6CAA6C;QAC7C,MAAM,gBAAgB,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;QAC5C,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QAErD,8CAA8C;QAC9C,MAAM,aAAa,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;QAExC,0EAA0E;QAC1E,MAAM,kBAAkB,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;QAE7C,4CAA4C;QAC5C,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;QACrC,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAE7C,uCAAuC;QACvC,IAAI,MAAM,CAAC,QAAQ,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,CAAC;QAED,OAAO,IAAI,0BAA0B,CAAC;YACpC,OAAO;YACP,KAAK;YACL,SAAS;YACT,UAAU;YACV,aAAa;YACb,kBAAkB;YAClB,SAAS;SACV,CAAC,CAAC;IACL,CAAC;CACF","sourcesContent":["/*\nCopyright 2023 The Sigstore Authors.\n\nLicensed under the Apache License, Version 2.0 (the \"License\");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\n    http://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n*/\nimport { ByteStream, readBigInt64BE, verifySignature } from \"@freedomofpress/crypto-browser\";\n\ninterface SCTOptions {\n  version: number;\n  logID: Uint8Array;\n  timestamp: Uint8Array;\n  extensions: Uint8Array;\n  hashAlgorithm: number;\n  signatureAlgorithm: number;\n  signature: Uint8Array;\n}\n\nexport class SignedCertificateTimestamp {\n  readonly version: number;\n  readonly logID: Uint8Array;\n  readonly timestamp: Uint8Array;\n  readonly extensions: Uint8Array;\n  readonly hashAlgorithm: number;\n  readonly signatureAlgorithm: number;\n  readonly signature: Uint8Array;\n\n  constructor(options: SCTOptions) {\n    this.version = options.version;\n    this.logID = options.logID;\n    this.timestamp = options.timestamp;\n    this.extensions = options.extensions;\n    this.hashAlgorithm = options.hashAlgorithm;\n    this.signatureAlgorithm = options.signatureAlgorithm;\n    this.signature = options.signature;\n  }\n\n  get datetime(): Date {\n    return new Date(Number(readBigInt64BE(this.timestamp)));\n  }\n\n  // Returns the hash algorithm used to generate the SCT's signature.\n  // https://www.rfc-editor.org/rfc/rfc5246#section-7.4.1.4.1\n  get algorithm(): string {\n    switch (this.hashAlgorithm) {\n      /* istanbul ignore next */\n      case 0:\n        return \"none\";\n      /* istanbul ignore next */\n      case 1:\n        return \"md5\";\n      /* istanbul ignore next */\n      case 2:\n        return \"sha1\";\n      /* istanbul ignore next */\n      case 3:\n        return \"sha224\";\n      case 4:\n        return \"sha256\";\n      /* istanbul ignore next */\n      case 5:\n        return \"sha384\";\n      /* istanbul ignore next */\n      case 6:\n        return \"sha512\";\n      /* istanbul ignore next */\n      default:\n        return \"unknown\";\n    }\n  }\n\n  public async verify(preCert: Uint8Array, key: CryptoKey): Promise<boolean> {\n    // Assemble the digitally-signed struct (the data over which the signature\n    // was generated).\n    // https://www.rfc-editor.org/rfc/rfc6962#section-3.2\n    const stream = new ByteStream();\n    stream.appendChar(this.version);\n    stream.appendChar(0x00); // SignatureType = certificate_timestamp(0)\n    stream.appendView(this.timestamp);\n    stream.appendUint16(0x01); // LogEntryType = precert_entry(1)\n    stream.appendView(preCert);\n    stream.appendUint16(this.extensions.byteLength);\n\n    /* istanbul ignore next - extensions are very uncommon */\n    if (this.extensions.byteLength > 0) {\n      stream.appendView(this.extensions);\n    }\n\n    return await verifySignature(\n      key,\n      stream.buffer,\n      this.signature,\n      this.algorithm,\n    );\n  }\n\n  // Parses a SignedCertificateTimestamp from a buffer. SCTs are encoded using\n  // TLS encoding which means the fields and lengths of most fields are\n  // specified as part of the SCT and TLS specs.\n  // https://www.rfc-editor.org/rfc/rfc6962#section-3.2\n  // https://www.rfc-editor.org/rfc/rfc5246#section-7.4.1.4.1\n  public static parse(buf: Uint8Array): SignedCertificateTimestamp {\n    const stream = new ByteStream(buf);\n\n    // Version - enum { v1(0), (255) }\n    // RFC 6962 specifies only v1(0) is valid (for now)\n    const version = stream.getUint8();\n    if (version !== 0) {\n      throw new Error(`Unsupported SCT version: ${version} (expected 0 for v1)`);\n    }\n\n    // Log ID  - struct { opaque key_id[32]; }\n    const logID = stream.getBlock(32);\n\n    // Timestamp - uint64\n    const timestamp = stream.getBlock(8);\n\n    // Extensions - opaque extensions<0..2^16-1>;\n    const extenstionLength = stream.getUint16();\n    const extensions = stream.getBlock(extenstionLength);\n\n    // Hash algo - enum { sha256(4), . . . (255) }\n    const hashAlgorithm = stream.getUint8();\n\n    // Signature algo - enum { anonymous(0), rsa(1), dsa(2), ecdsa(3), (255) }\n    const signatureAlgorithm = stream.getUint8();\n\n    // Signature  - opaque signature<0..2^16-1>;\n    const sigLength = stream.getUint16();\n    const signature = stream.getBlock(sigLength);\n\n    // Check that we read the entire buffer\n    if (stream.position !== buf.length) {\n      throw new Error(\"SCT buffer length mismatch\");\n    }\n\n    return new SignedCertificateTimestamp({\n      version,\n      logID,\n      timestamp,\n      extensions,\n      hashAlgorithm,\n      signatureAlgorithm,\n      signature,\n    });\n  }\n}\n"]}