@freedomofpress/sigstore-browser 0.1.15 → 0.1.17

package/src/index.browser.test.ts

@@ -1,301 +0,0 @@
-import { describe, expect,it } from "vitest";
-
-import { assertBundle } from "./bundle.js";
-import { SigstoreVerifier } from "./sigstore.js";
-import { X509Certificate } from "./x509/cert.js";
-
-describe("Sigstore Browser Integration Tests", () => {
-  it("should initialize SigstoreVerifier in browser", () => {
-    const verifier = new SigstoreVerifier();
-    expect(verifier).toBeDefined();
-    expect(verifier).toBeInstanceOf(SigstoreVerifier);
-  });
-
-  it("should have crypto.subtle available for ECDSA P-256 verification", async () => {
-    expect(globalThis.crypto).toBeDefined();
-    expect(globalThis.crypto.subtle).toBeDefined();
-
-    // Test ECDSA P-256 which is what Sigstore uses
-    const keyPair = await crypto.subtle.generateKey(
-      {
-        name: "ECDSA",
-        namedCurve: "P-256",
-      },
-      true,
-      ["sign", "verify"]
-    );
-
-    const data = new TextEncoder().encode("test");
-    const signature = await crypto.subtle.sign(
-      { name: "ECDSA", hash: "SHA-256" },
-      keyPair.privateKey,
-      data
-    );
-
-    const valid = await crypto.subtle.verify(
-      { name: "ECDSA", hash: "SHA-256" },
-      keyPair.publicKey,
-      signature,
-      data
-    );
-
-    expect(valid).toBe(true);
-  });
-
-  it("should have crypto.subtle available for ECDSA P-384 verification", async () => {
-    // Test ECDSA P-384 which is also used by Sigstore
-    const keyPair = await crypto.subtle.generateKey(
-      {
-        name: "ECDSA",
-        namedCurve: "P-384",
-      },
-      true,
-      ["sign", "verify"]
-    );
-
-    const data = new TextEncoder().encode("test");
-    const signature = await crypto.subtle.sign(
-      { name: "ECDSA", hash: "SHA-384" },
-      keyPair.privateKey,
-      data
-    );
-
-    const valid = await crypto.subtle.verify(
-      { name: "ECDSA", hash: "SHA-384" },
-      keyPair.publicKey,
-      signature,
-      data
-    );
-
-    expect(valid).toBe(true);
-  });
-
-  it("should support SHA-256 hashing in browser", async () => {
-    const data = new TextEncoder().encode("test data");
-    const hash = await crypto.subtle.digest("SHA-256", data);
-
-    expect(hash).toBeInstanceOf(ArrayBuffer);
-    expect(hash.byteLength).toBe(32);
-  });
-
-  it("should support SHA-384 hashing in browser", async () => {
-    const data = new TextEncoder().encode("test data");
-    const hash = await crypto.subtle.digest("SHA-384", data);
-
-    expect(hash).toBeInstanceOf(ArrayBuffer);
-    expect(hash.byteLength).toBe(48);
-  });
-
-  it("should support SHA-512 hashing in browser", async () => {
-    const data = new TextEncoder().encode("test data");
-    const hash = await crypto.subtle.digest("SHA-512", data);
-
-    expect(hash).toBeInstanceOf(ArrayBuffer);
-    expect(hash.byteLength).toBe(64);
-  });
-
-  it("should support X.509 certificate key import (SPKI format)", async () => {
-    const keyPair = await crypto.subtle.generateKey(
-      {
-        name: "ECDSA",
-        namedCurve: "P-256",
-      },
-      true,
-      ["sign", "verify"]
-    );
-
-    const exported = await crypto.subtle.exportKey("spki", keyPair.publicKey);
-    const imported = await crypto.subtle.importKey(
-      "spki",
-      exported,
-      { name: "ECDSA", namedCurve: "P-256" },
-      true,
-      ["verify"]
-    );
-
-    expect(imported).toBeDefined();
-    expect(imported.type).toBe("public");
-  });
-
-  it("should support RSA-PSS for signature verification", async () => {
-    const keyPair = await crypto.subtle.generateKey(
-      {
-        name: "RSA-PSS",
-        modulusLength: 2048,
-        publicExponent: new Uint8Array([1, 0, 1]),
-        hash: "SHA-256",
-      },
-      true,
-      ["sign", "verify"]
-    );
-
-    const data = new TextEncoder().encode("test");
-    const signature = await crypto.subtle.sign(
-      {
-        name: "RSA-PSS",
-        saltLength: 32,
-      },
-      keyPair.privateKey,
-      data
-    );
-
-    const valid = await crypto.subtle.verify(
-      {
-        name: "RSA-PSS",
-        saltLength: 32,
-      },
-      keyPair.publicKey,
-      signature,
-      data
-    );
-
-    expect(valid).toBe(true);
-  });
-
-  it("should verify RSA-PSS signed X.509 certificate", async () => {
-    // Self-signed certificate with standard RSA key but RSA-PSS signature (SHA-256, salt=32)
-    // WebCrypto requires rsaEncryption OID for the public key, not id-RSASSA-PSS
-    const rsaPssCertPem = `-----BEGIN CERTIFICATE-----
-MIIDhTCCAjmgAwIBAgIUYzfguLRx71Cbn2Ty7xCt3GH+N6AwQQYJKoZIhvcNAQEK
-MDSgDzANBglghkgBZQMEAgEFAKEcMBoGCSqGSIb3DQEBCDANBglghkgBZQMEAgEF
-AKIDAgEgMB4xHDAaBgNVBAMME1Rlc3QgUlNBLVBTUyBTaWduZWQwHhcNMjUxMTMw
-MDMwMDU2WhcNMjYxMTMwMDMwMDU2WjAeMRwwGgYDVQQDDBNUZXN0IFJTQS1QU1Mg
-U2lnbmVkMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA29B/88QFBILg
-YCWp1pF3xBj7FVhBUCv6JwyZAouYWUxgGmpFg6RLgbaWk59oDtEFQ5xRGSDXLuMW
-GL5wZVCjSnmYcBsBDROO+HfLKwDRcHw09bJY979PDHPy5EPZale/JsdxE+fepUw1
-XQDvlK5Dyp6WKl9UBjTtl6+LHKV/KTo+SiaQP2vsbZvTIt3s8MHybV/ixYXlSPQt
-Kju50REAaqSSYqxNzsq8Z2sjJbFBcatt5C1JhfoSyIHz5D0slriv8835DYhk0u4n
-bvNzXhWeF7htHTiPWCYwaTr5cgjyhEWg3SNP+Tu9dxCYVXm7/jWTHRdPqUPQqFsq
-wXqsrzSP+wIDAQABo1MwUTAdBgNVHQ4EFgQU+UcBxKusOtY4lSjqyFuxQfN5zdIw
-HwYDVR0jBBgwFoAU+UcBxKusOtY4lSjqyFuxQfN5zdIwDwYDVR0TAQH/BAUwAwEB
-/zBBBgkqhkiG9w0BAQowNKAPMA0GCWCGSAFlAwQCAQUAoRwwGgYJKoZIhvcNAQEI
-MA0GCWCGSAFlAwQCAQUAogMCASADggEBAFIn3VpfydVvpI82NwfeGxWlhZhgD2dX
-gJUhj6pcXqwnlCzpyRI4e3uNO1h9nr9UrogI0AV2IDhVdUYxz3F2/680JtxXpB1x
-J02BSAYllvXgf9efc20lFzbPDzvMzKnwx3S3proewbJ4uVPHzvKubWsx8MwEuI0X
-8xkI1qMIXgevTCt+LGhp+0C/u8WsW3or5ZI7GnZNowPJEAtZnfO+VORB7FvbzEGr
-ewS+2T7Qz4oXaQMidPOjr1Q8WKqaKO4yCtC8cz4qVWi3lNqAcAGtonQMXUiflEWV
-9kqKQx+LJYJqxKkBtDRnRLnVNn4+inotrgnV126LsCe3uLaGwJIFy1U=
------END CERTIFICATE-----`;
-
-    const cert = X509Certificate.parse(rsaPssCertPem);
-
-    // Verify it's an RSA-PSS certificate
-    expect(cert.signatureAlgorithmOid).toBe("1.2.840.113549.1.1.10");
-    expect(cert.signatureAlgorithm).toBe("sha256");
-
-    // Verify the self-signed certificate (signature verification)
-    const valid = await cert.verify();
-    expect(valid).toBe(true);
-  });
-
-  it("should support TextEncoder/TextDecoder for UTF-8", () => {
-    const encoder = new TextEncoder();
-    const decoder = new TextDecoder();
-
-    const text = "Hello Sigstore 🔐";
-    const encoded = encoder.encode(text);
-    const decoded = decoder.decode(encoded);
-
-    expect(decoded).toBe(text);
-    expect(encoded).toBeInstanceOf(Uint8Array);
-  });
-
-  it("should support base64 encoding/decoding (atob/btoa)", () => {
-    const text = "Hello Sigstore";
-    const base64 = btoa(text);
-    const decoded = atob(base64);
-
-    expect(decoded).toBe(text);
-    expect(base64).toBe("SGVsbG8gU2lnc3RvcmU=");
-  });
-
-  it("should support Uint8Array operations", () => {
-    const arr1 = new Uint8Array([1, 2, 3, 4, 5]);
-    const arr2 = new Uint8Array([6, 7, 8, 9, 10]);
-
-    const combined = new Uint8Array(arr1.length + arr2.length);
-    combined.set(arr1, 0);
-    combined.set(arr2, arr1.length);
-
-    expect(combined.length).toBe(10);
-    expect(combined[0]).toBe(1);
-    expect(combined[5]).toBe(6);
-  });
-
-  it("should support ArrayBuffer operations", () => {
-    const buffer = new ArrayBuffer(32);
-    const view = new Uint8Array(buffer);
-
-    view[0] = 255;
-    view[31] = 128;
-
-    expect(buffer.byteLength).toBe(32);
-    expect(view[0]).toBe(255);
-    expect(view[31]).toBe(128);
-  });
-
-  it("should support DataView for byte manipulation", () => {
-    const buffer = new ArrayBuffer(8);
-    const view = new DataView(buffer);
-
-    view.setUint32(0, 0x12345678, false); // big-endian
-    view.setUint32(4, 0x9abcdef0, false);
-
-    expect(view.getUint32(0, false)).toBe(0x12345678);
-    expect(view.getUint8(0)).toBe(0x12);
-    expect(view.getUint8(1)).toBe(0x34);
-  });
-
-  it("should support JSON parsing of complex structures", () => {
-    const json = '{"mediaType":"application/vnd.dev.sigstore.bundle+json;version=0.3","verificationMaterial":{"tlogEntries":[{"logIndex":"123"}]}}';
-    const parsed = JSON.parse(json);
-
-    expect(parsed.mediaType).toBeDefined();
-    expect(parsed.verificationMaterial).toBeDefined();
-    expect(parsed.verificationMaterial.tlogEntries).toBeInstanceOf(Array);
-    expect(parsed.verificationMaterial.tlogEntries[0].logIndex).toBe("123");
-  });
-});
-
-describe("Bundle structural validation", () => {
-  const entry = {
-    logIndex: "1",
-    logId: { keyId: "AA==" },
-    kindVersion: { kind: "dsse", version: "0.0.1" },
-    integratedTime: "1",
-    inclusionPromise: { signedEntryTimestamp: "AA==" },
-    canonicalizedBody: "e30=",
-  };
-  const bundle = () => structuredClone({
-    mediaType: "application/vnd.dev.sigstore.bundle.v0.3+json",
-    verificationMaterial: { certificate: { rawBytes: "AA==" }, tlogEntries: [entry] },
-    dsseEnvelope: { payload: "AA==", payloadType: "t", signatures: [{ sig: "AA==" }] },
-  });
-  const rejects = (mutate: (b: ReturnType<typeof bundle>) => void, message: string) => {
-    const b = bundle();
-    mutate(b);
-    expect(() => assertBundle(b)).toThrow(message);
-  };
-
-  it("accepts a well-formed bundle", () => {
-    expect(() => assertBundle(bundle())).not.toThrow();
-  });
-
-  it("rejects malformed fields, empty promises and missing integrated times", () => {
-    rejects((b) => { b.verificationMaterial.tlogEntries = []; }, "tlogEntries");
-    rejects((b) => { (b.verificationMaterial.tlogEntries[0] as Record<string, unknown>).logIndex = 1; }, "tlog entry");
-    rejects((b) => { (b.verificationMaterial.tlogEntries[0] as Record<string, unknown>).integratedTime = 1; }, "integratedTime");
-    rejects((b) => { b.verificationMaterial.tlogEntries[0].inclusionPromise.signedEntryTimestamp = ""; }, "inclusion promise");
-    rejects((b) => { (b.verificationMaterial.tlogEntries[0] as Record<string, unknown>).integratedTime = null; }, "inclusion promise");
-  });
-
-  it("caps entries at 32", () => {
-    rejects((b) => { b.verificationMaterial.tlogEntries = Array(33).fill(entry); }, "tlogEntries");
-  });
-
-  it("requires exactly one signature source with exactly one signature", () => {
-    rejects((b) => { (b as Record<string, unknown>).messageSignature = { messageDigest: { algorithm: "SHA2_256", digest: "AA==" }, signature: "AA==" }; }, "exactly one of");
-    rejects((b) => { delete (b as Partial<ReturnType<typeof bundle>>).dsseEnvelope; }, "exactly one of");
-    rejects((b) => { b.dsseEnvelope.signatures.push({ sig: "AA==" }); }, "exactly one signature");
-  });
-});

package/src/index.ts

@@ -1,93 +0,0 @@
-export { SigstoreVerifier } from "./sigstore.js";
-export type { SigstoreVerifierOptions } from "./sigstore.js";
-export type { SigstoreBundle, TLogEntry, VerificationMaterial, MessageSignature, TimestampVerificationData, RFC3161Timestamp } from "./bundle.js";
-export type { TrustedRoot, Sigstore, RawTimestampAuthority } from "./interfaces.js";
-export {
-  VerificationError,
-  TimestampError,
-  CertificateError,
-  TLogError,
-  SignatureError,
-  PolicyError,
-} from "./errors.js";
-export { verifyRFC3161Timestamp, verifyBundleTimestamp } from "./timestamp/tsa.js";
-export { TrustedRootProvider, type TrustedRootProviderOptions } from "./trust/tuf.js";
-export {
-  X509Certificate,
-  EXTENSION_OID_SCT,
-  EXTENSION_OID_FULCIO_ISSUER_V1,
-  EXTENSION_OID_GITHUB_WORKFLOW_TRIGGER,
-  EXTENSION_OID_GITHUB_WORKFLOW_SHA,
-  EXTENSION_OID_GITHUB_WORKFLOW_NAME,
-  EXTENSION_OID_GITHUB_WORKFLOW_REPOSITORY,
-  EXTENSION_OID_GITHUB_WORKFLOW_REF,
-  EXTENSION_OID_OTHERNAME,
-  EXTENSION_OID_FULCIO_ISSUER_V2,
-  EXTENSION_OID_BUILD_SIGNER_URI,
-  EXTENSION_OID_BUILD_SIGNER_DIGEST,
-  EXTENSION_OID_RUNNER_ENVIRONMENT,
-  EXTENSION_OID_SOURCE_REPOSITORY_URI,
-  EXTENSION_OID_SOURCE_REPOSITORY_DIGEST,
-  EXTENSION_OID_SOURCE_REPOSITORY_REF,
-  EXTENSION_OID_SOURCE_REPOSITORY_IDENTIFIER,
-  EXTENSION_OID_SOURCE_REPOSITORY_OWNER_URI,
-  EXTENSION_OID_SOURCE_REPOSITORY_OWNER_IDENTIFIER,
-  EXTENSION_OID_BUILD_CONFIG_URI,
-  EXTENSION_OID_BUILD_CONFIG_DIGEST,
-  EXTENSION_OID_BUILD_TRIGGER,
-  EXTENSION_OID_RUN_INVOCATION_URI,
-  EXTENSION_OID_SOURCE_REPOSITORY_VISIBILITY,
-} from "./x509/cert.js";
-export {
-  X509Extension,
-  X509FulcioIssuerV1,
-  X509FulcioIssuerV2,
-  X509GitHubWorkflowTriggerExtension,
-  X509GitHubWorkflowSHAExtension,
-  X509GitHubWorkflowNameExtension,
-  X509GitHubWorkflowRepositoryExtension,
-  X509GitHubWorkflowRefExtension,
-  X509BuildSignerURIExtension,
-  X509BuildSignerDigestExtension,
-  X509RunnerEnvironmentExtension,
-  X509SourceRepositoryURIExtension,
-  X509SourceRepositoryDigestExtension,
-  X509SourceRepositoryRefExtension,
-  X509SourceRepositoryIdentifierExtension,
-  X509SourceRepositoryOwnerURIExtension,
-  X509SourceRepositoryOwnerIdentifierExtension,
-  X509BuildConfigURIExtension,
-  X509BuildConfigDigestExtension,
-  X509BuildTriggerExtension,
-  X509RunInvocationURIExtension,
-  X509SourceRepositoryVisibilityExtension,
-} from "./x509/ext.js";
-export { CertificateChainVerifier } from "./x509/chain.js";
-export {
-  GITHUB_OIDC_ISSUER,
-  OIDCIssuer,
-  OIDCIssuerV2,
-  GitHubWorkflowTrigger,
-  GitHubWorkflowSHA,
-  GitHubWorkflowName,
-  GitHubWorkflowRepository,
-  GitHubWorkflowRef,
-  OIDCBuildSignerURI,
-  OIDCBuildSignerDigest,
-  OIDCRunnerEnvironment,
-  OIDCSourceRepositoryURI,
-  OIDCSourceRepositoryDigest,
-  OIDCSourceRepositoryRef,
-  OIDCSourceRepositoryIdentifier,
-  OIDCSourceRepositoryOwnerURI,
-  OIDCSourceRepositoryOwnerIdentifier,
-  OIDCBuildConfigURI,
-  OIDCBuildConfigDigest,
-  OIDCBuildTrigger,
-  OIDCRunInvocationURI,
-  OIDCSourceRepositoryVisibility,
-  AllOf,
-  AnyOf,
-  Identity,
-} from "./policy.js";
-export type { VerificationPolicy } from "./policy.js";

package/src/interfaces.ts

@@ -1,150 +0,0 @@
-import { X509Certificate } from "./x509/index.js";
-
-export function parseValidityPeriod(
-  validity: { start?: unknown; end?: unknown } | undefined,
-): { start: Date; end: Date } {
-  if (
-    typeof validity?.start !== "string" ||
-    (validity.end !== undefined && typeof validity.end !== "string")
-  ) {
-    throw new Error("Invalid authority validity period");
-  }
-  const start = new Date(validity.start);
-  const end = validity.end === undefined
-    ? new Date(8640000000000000)
-    : new Date(validity.end);
-  if (!Number.isFinite(start.getTime()) || !Number.isFinite(end.getTime()) || start > end) {
-    throw new Error("Invalid authority validity period");
-  }
-  return { start, end };
-}
-
-export enum SigstoreRoots {
-  certificateAuthorities = "certificateAuthorities",
-  ctlogs = "ctlogs",
-  timestampAuthorities = "timestampAuthorities",
-  tlogs = "tlogs",
-}
-
-export type RawTimestampAuthorities = RawTimestampAuthority[];
-
-export interface TrustedRoot {
-  mediaType: string;
-  tlogs: RawLogs;
-  certificateAuthorities: RawCAs;
-  ctlogs: RawLogs;
-  timestampAuthorities: RawTimestampAuthorities;
-}
-
-export interface RawTimestampAuthority {
-  subject: {
-    organization: string;
-    commonName: string;
-  };
-  certChain: {
-    certificates: {
-      rawBytes: string;
-    }[];
-  };
-  validFor: {
-    start: string;
-    end?: string;
-  };
-  operator?: string;
-}
-
-export interface CTLog {
-  logID: Uint8Array;
-  publicKey: CryptoKey;
-  operator: string;
-  validFor: {
-    start: Date;
-    end: Date;
-  };
-}
-
-export interface RekorKeyInfo {
-  publicKey: CryptoKey;
-  logId: Uint8Array;
-  hashAlgorithm: string;
-  operator: string;
-  validFor: {
-    start: Date;
-    end: Date;
-  };
-}
-
-export interface CertAuthority {
-  certChain: X509Certificate[];
-  validFor: {
-    start: Date;
-    end: Date;
-  };
-}
-
-export interface Sigstore {
-  rekor: RekorKeyInfo[];
-  ctlogs: CTLog[];
-  certificateAuthorities: CertAuthority[];
-}
-
-export interface RawLog {
-  baseUrl: string;
-  hashAlgorithm: string;
-  publicKey: {
-    rawBytes: string;
-    keyDetails: string;
-    validFor: {
-      start: string;
-      end?: string;
-    };
-  };
-  logId: {
-    keyId: string;
-  };
-  operator?: string;
-}
-
-export type RawLogs = RawLog[];
-
-export interface RawCA {
-  subject: {
-    organization: string;
-    commonName: string;
-  };
-  uri: string;
-  certChain: {
-    certificates: {
-      rawBytes: string;
-    }[];
-  };
-  validFor: {
-    start: string;
-    end?: string;
-  };
-}
-
-export type RawCAs = RawCA[];
-
-// Re-export crypto enums from crypto-browser (shared with tuf-browser)
-export { KeyTypes, EcdsaTypes, HashAlgorithms } from "@freedomofpress/crypto-browser";
-import { HashAlgorithms } from "@freedomofpress/crypto-browser";
-
-// Supported hash algorithms for payload hash validation
-// Rekor v1 uses lowercase (sha256), Rekor v2 uses uppercase with underscore (SHA2_256)
-const SUPPORTED_HASH_ALGORITHMS: Record<string, string> = {
-  "sha256": HashAlgorithms.SHA256,
-  "sha384": HashAlgorithms.SHA384,
-  "sha512": HashAlgorithms.SHA512,
-  "SHA2_256": HashAlgorithms.SHA256,
-  "SHA2_384": HashAlgorithms.SHA384,
-  "SHA2_512": HashAlgorithms.SHA512,
-};
-
-export function getHashAlgorithm(algorithm: string): string {
-  const hashAlg = SUPPORTED_HASH_ALGORITHMS[algorithm];
-  if (!hashAlg) {
-    throw new Error(`Unsupported hash algorithm: ${algorithm}`);
-  }
-  return hashAlg;
-}

package/src/oid.ts

@@ -1,34 +0,0 @@
-// From https://github.com/sigstore/sigstore-js/blob/main/packages/core/src/oid.ts
-
-export const ECDSA_SIGNATURE_ALGOS: Record<string, string> = {
-  "1.2.840.10045.4.3.1": "sha224",
-  "1.2.840.10045.4.3.2": "sha256",
-  "1.2.840.10045.4.3.3": "sha384",
-  "1.2.840.10045.4.3.4": "sha512",
-};
-
-// RSA signature algorithms (PKCS#1 v1.5)
-export const RSA_SIGNATURE_ALGOS: Record<string, string> = {
-  "1.2.840.113549.1.1.11": "sha256", // sha256WithRSAEncryption
-  "1.2.840.113549.1.1.12": "sha384", // sha384WithRSAEncryption
-  "1.2.840.113549.1.1.13": "sha512", // sha512WithRSAEncryption
-  "1.2.840.113549.1.1.5": "sha1",    // sha1WithRSAEncryption
-};
-
-// RSASSA-PSS OID - hash algorithm must be parsed from signature algorithm parameters
-export const OID_RSASSA_PSS = "1.2.840.113549.1.1.10";
-
-export const SHA2_HASH_ALGOS: Record<string, string> = {
-  "2.16.840.1.101.3.4.2.1": "sha256",
-  "2.16.840.1.101.3.4.2.2": "sha384",
-  "2.16.840.1.101.3.4.2.3": "sha512",
-};
-
-// Default hash algorithm used when not specified
-export const DEFAULT_HASH_ALGORITHM = "sha256";
-
-export const ECDSA_CURVE_NAMES: Record<string, string> = {
-  "1.2.840.10045.3.1.7": "secp256r1",
-  "1.3.132.0.34": "secp384r1",
-  "1.3.132.0.35": "secp521r1",
-};