@freedomofpress/sigstore-browser 0.1.15 → 0.1.17

package/src/rfc3161/timestamp.ts

@@ -1,268 +0,0 @@
-/*
-Copyright 2023 The Sigstore Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-import { ASN1Obj, uint8ArrayEqual, verifySignature } from "@freedomofpress/crypto-browser";
-import { HashAlgorithms } from "../interfaces.js";
-import { ECDSA_SIGNATURE_ALGOS, RSA_SIGNATURE_ALGOS, SHA2_HASH_ALGOS } from "../oid.js";
-import { RFC3161TimestampVerificationError } from "./error.js";
-import { TSTInfo } from "./tstinfo.js";
-
-const OID_PKCS9_CONTENT_TYPE_SIGNED_DATA = "1.2.840.113549.1.7.2";
-const OID_PKCS9_CONTENT_TYPE_TSTINFO = "1.2.840.113549.1.9.16.1.4";
-const OID_PKCS9_MESSAGE_DIGEST_KEY = "1.2.840.113549.1.9.4";
-
-export class RFC3161Timestamp {
-  public root: ASN1Obj;
-
-  constructor(asn1: ASN1Obj) {
-    this.root = asn1;
-  }
-
-  public static parse(der: Uint8Array): RFC3161Timestamp {
-    const asn1 = ASN1Obj.parseBuffer(der);
-    return new RFC3161Timestamp(asn1);
-  }
-
-  get status(): bigint {
-    return this.pkiStatusInfoObj.subs[0].toInteger();
-  }
-
-  get contentType(): string {
-    return this.contentTypeObj.toOID();
-  }
-
-  get eContentType(): string {
-    return this.eContentTypeObj.toOID();
-  }
-
-  get signingTime(): Date {
-    return this.tstInfo.genTime;
-  }
-
-  get signerIssuer(): Uint8Array {
-    return this.signerSidObj.subs[0].value;
-  }
-
-  get signerSerialNumber(): Uint8Array {
-    return this.signerSidObj.subs[1].value;
-  }
-
-  get signerDigestAlgorithm(): string {
-    const oid = this.signerDigestAlgorithmObj.subs[0].toOID();
-    const algo = SHA2_HASH_ALGOS[oid];
-    if (!algo) {
-      throw new Error(`Unknown digest algorithm OID: ${oid}`);
-    }
-    return algo;
-  }
-
-  get signatureAlgorithm(): string {
-    const oid = this.signatureAlgorithmObj.subs[0].toOID();
-    const algo = ECDSA_SIGNATURE_ALGOS[oid] || RSA_SIGNATURE_ALGOS[oid];
-    return algo;
-  }
-
-  get signatureValue(): Uint8Array {
-    return this.signatureValueObj.value;
-  }
-
-  get tstInfo(): TSTInfo {
-    // Need to unpack tstInfo from an OCTET STRING
-    return new TSTInfo(this.eContentObj.subs[0].subs[0]);
-  }
-
-  public async verify(data: Uint8Array, publicKey: CryptoKey): Promise<void> {
-    if (!this.timeStampTokenObj) {
-      throw new RFC3161TimestampVerificationError("timeStampToken is missing");
-    }
-
-    // Check for expected ContentInfo content type
-    if (this.contentType !== OID_PKCS9_CONTENT_TYPE_SIGNED_DATA) {
-      throw new RFC3161TimestampVerificationError(
-        `incorrect content type: ${this.contentType}`,
-      );
-    }
-
-    // Check for expected encapsulated content type
-    if (this.eContentType !== OID_PKCS9_CONTENT_TYPE_TSTINFO) {
-      throw new RFC3161TimestampVerificationError(
-        `incorrect encapsulated content type: ${this.eContentType}`,
-      );
-    }
-
-    // Check that the tstInfo references the correct artifact
-    await this.tstInfo.verify(data);
-    // Check that the signed message digest matches the tstInfo
-    await this.verifyMessageDigest();
-    // Check that the signature is valid for the signed attributes
-    await this.verifySignature(publicKey);
-  }
-
-  private async verifyMessageDigest(): Promise<void> {
-    // Check that the tstInfo matches the signed data
-    const hashAlg = this.signerDigestAlgorithm;
-
-    // Convert hash algorithm name to the format expected by WebCrypto
-    const hashAlgName = hashAlg === "sha256" ? HashAlgorithms.SHA256 :
-                       hashAlg === "sha384" ? HashAlgorithms.SHA384 :
-                       hashAlg === "sha512" ? HashAlgorithms.SHA512 : hashAlg;
-
-    const tstInfoDigest = await crypto.subtle.digest(
-      hashAlgName,
-      this.tstInfo.raw as BufferSource,
-    );
-    const expectedDigest = this.messageDigestAttributeObj.subs[1].subs[0].value;
-
-    if (!uint8ArrayEqual(new Uint8Array(tstInfoDigest), expectedDigest)) {
-      throw new RFC3161TimestampVerificationError(
-        "signed data does not match tstInfo",
-      );
-    }
-  }
-
-  private async verifySignature(key: CryptoKey): Promise<void> {
-    // Encode the signed attributes for verification
-    const signedAttrs = this.signedAttrsObj.toDER();
-    signedAttrs[0] = 0x31; // Change context-specific tag to SET
-
-    const oid = this.signatureAlgorithmObj.subs[0].toOID();
-    // Try both ECDSA and RSA signature algorithms
-    const algo = ECDSA_SIGNATURE_ALGOS[oid] || RSA_SIGNATURE_ALGOS[oid];
-
-    if (!algo) {
-      throw new RFC3161TimestampVerificationError(
-        `Unsupported signature algorithm OID: ${oid}`,
-      );
-    }
-
-    // Check that the signature is valid for the signed attributes
-    const verified = await verifySignature(
-      key,
-      signedAttrs,
-      this.signatureValue,
-      algo,
-    );
-
-    if (!verified) {
-      throw new RFC3161TimestampVerificationError(
-        "signature verification failed",
-      );
-    }
-  }
-
-  // https://www.rfc-editor.org/rfc/rfc3161#section-2.4.2
-  private get pkiStatusInfoObj(): ASN1Obj {
-    // pkiStatusInfo is the first element of the timestamp response sequence
-    return this.root.subs[0];
-  }
-
-  // https://www.rfc-editor.org/rfc/rfc3161#section-2.4.2
-  private get timeStampTokenObj(): ASN1Obj {
-    // timeStampToken is the first element of the timestamp response sequence
-    return this.root.subs[1];
-  }
-
-  // https://datatracker.ietf.org/doc/html/rfc5652#section-3
-  private get contentTypeObj(): ASN1Obj {
-    return this.timeStampTokenObj.subs[0];
-  }
-  // https://www.rfc-editor.org/rfc/rfc5652#section-3
-  private get signedDataObj(): ASN1Obj {
-    const obj = this.timeStampTokenObj.subs.find((sub) =>
-      sub.tag.isContextSpecific(0x00),
-    );
-    if (!obj) {
-      throw new RFC3161TimestampVerificationError(
-        "Missing timeStampTokenObj sub.",
-      );
-    }
-    return obj.subs[0];
-  }
-
-  // https://datatracker.ietf.org/doc/html/rfc5652#section-5.1
-  private get encapContentInfoObj(): ASN1Obj {
-    return this.signedDataObj.subs[2];
-  }
-
-  // https://datatracker.ietf.org/doc/html/rfc5652#section-5.1
-  private get signerInfosObj(): ASN1Obj {
-    // SignerInfos is the last element of the signed data sequence
-    const sd = this.signedDataObj;
-    return sd.subs[sd.subs.length - 1];
-  }
-
-  // https://www.rfc-editor.org/rfc/rfc5652#section-5.1
-  private get signerInfoObj(): ASN1Obj {
-    // Only supporting one signer
-    return this.signerInfosObj.subs[0];
-  }
-
-  // https://datatracker.ietf.org/doc/html/rfc5652#section-5.2
-  private get eContentTypeObj(): ASN1Obj {
-    return this.encapContentInfoObj.subs[0];
-  }
-
-  // https://datatracker.ietf.org/doc/html/rfc5652#section-5.2
-  private get eContentObj(): ASN1Obj {
-    return this.encapContentInfoObj.subs[1];
-  }
-
-  // https://datatracker.ietf.org/doc/html/rfc5652#section-5.3
-  private get signedAttrsObj(): ASN1Obj {
-    const signedAttrs = this.signerInfoObj.subs.find((sub) =>
-      sub.tag.isContextSpecific(0x00),
-    );
-    if (!signedAttrs) {
-      throw new RFC3161TimestampVerificationError("Missing signedAttrsObj.");
-    }
-    return signedAttrs;
-  }
-
-  // https://datatracker.ietf.org/doc/html/rfc5652#section-5.3
-  private get messageDigestAttributeObj(): ASN1Obj {
-    const messageDigest = this.signedAttrsObj.subs.find(
-      (sub) =>
-        sub.subs[0].tag.isOID() &&
-        sub.subs[0].toOID() === OID_PKCS9_MESSAGE_DIGEST_KEY,
-    );
-    if (!messageDigest) {
-      throw new RFC3161TimestampVerificationError("Missing messageDigest.");
-    }
-    return messageDigest;
-  }
-
-  // https://datatracker.ietf.org/doc/html/rfc5652#section-5.3
-  private get signerSidObj(): ASN1Obj {
-    return this.signerInfoObj.subs[1];
-  }
-
-  // https://datatracker.ietf.org/doc/html/rfc5652#section-5.3
-  private get signerDigestAlgorithmObj(): ASN1Obj {
-    // Signature is the 2nd element of the signerInfoObj object
-    return this.signerInfoObj.subs[2];
-  }
-
-  // https://datatracker.ietf.org/doc/html/rfc5652#section-5.3
-  private get signatureAlgorithmObj(): ASN1Obj {
-    // Signature is the 4th element of the signerInfoObj object
-    return this.signerInfoObj.subs[4];
-  }
-
-  // https://datatracker.ietf.org/doc/html/rfc5652#section-5.3
-  private get signatureValueObj(): ASN1Obj {
-    // Signature is the 6th element of the signerInfoObj object
-    return this.signerInfoObj.subs[5];
-  }
-}

package/src/rfc3161/tstinfo.ts

@@ -1,78 +0,0 @@
-/*
-Copyright 2023 The Sigstore Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-import { ASN1Obj, uint8ArrayEqual } from "@freedomofpress/crypto-browser";
-import { HashAlgorithms } from "../interfaces.js";
-import { SHA2_HASH_ALGOS } from "../oid.js";
-import { RFC3161TimestampVerificationError } from "./error.js";
-
-export class TSTInfo {
-  public root: ASN1Obj;
-
-  constructor(asn1: ASN1Obj) {
-    this.root = asn1;
-  }
-
-  get version(): bigint {
-    return this.root.subs[0].toInteger();
-  }
-
-  get genTime(): Date {
-    return this.root.subs[4].toDate();
-  }
-
-  get messageImprintHashAlgorithm(): string {
-    const oid = this.messageImprintObj.subs[0].subs[0].toOID();
-    const algo = SHA2_HASH_ALGOS[oid];
-    if (!algo) {
-      throw new Error(`Unknown message imprint hash algorithm OID: ${oid}`);
-    }
-    return algo;
-  }
-
-  get messageImprintHashedMessage(): Uint8Array {
-    return this.messageImprintObj.subs[1].value;
-  }
-
-  get raw(): Uint8Array {
-    return this.root.toDER();
-  }
-
-  public async verify(data: Uint8Array): Promise<void> {
-    const hashAlg = this.messageImprintHashAlgorithm;
-
-    // Convert hash algorithm name to the format expected by WebCrypto
-    const hashAlgName = hashAlg === "sha256" ? HashAlgorithms.SHA256 :
-                       hashAlg === "sha384" ? HashAlgorithms.SHA384 :
-                       hashAlg === "sha512" ? HashAlgorithms.SHA512 : hashAlg;
-
-    const digest = await crypto.subtle.digest(
-      hashAlgName,
-      data as BufferSource,
-    );
-    if (
-      !uint8ArrayEqual(new Uint8Array(digest), this.messageImprintHashedMessage)
-    ) {
-      throw new RFC3161TimestampVerificationError(
-        "message imprint does not match artifact",
-      );
-    }
-  }
-
-  // https://www.rfc-editor.org/rfc/rfc3161#section-2.4.2
-  private get messageImprintObj(): ASN1Obj {
-    return this.root.subs[2];
-  }
-}

package/src/security.browser.test.ts

@@ -1,249 +0,0 @@
-import { base64ToUint8Array, canonicalize, hexToUint8Array, Uint8ArrayToBase64, Uint8ArrayToHex } from "@freedomofpress/crypto-browser";
-import { ed25519 } from "@noble/curves/ed25519.js";
-import { afterEach, beforeAll, describe, expect, it, vi } from "vitest";
-
-import { bundle, digestHex, identity, issuer, trustRoot } from "../test/fixtures/sigstore.js";
-import { assertBundle, type TLogEntry } from "./bundle.js";
-import type { RawLog } from "./interfaces.js";
-import { AllOf, AnyOf } from "./policy.js";
-import { SigstoreVerifier, type SigstoreVerifierOptions } from "./sigstore.js";
-import { verifyBundleTimestamp } from "./timestamp/tsa.js";
-import { X509Certificate } from "./x509/cert.js";
-
-// Keep real timestamp verification by default; individual tests supply already-verified
-// timestamps to isolate threshold accounting from the separately tested cryptography.
-vi.mock("./timestamp/tsa.js", async (importOriginal) => {
-  const actual = await importOriginal<typeof import("./timestamp/tsa.js")>();
-  return { ...actual, verifyBundleTimestamp: vi.fn(actual.verifyBundleTimestamp) };
-});
-
-afterEach(() => {
-  vi.mocked(verifyBundleTimestamp).mockReset();
-  vi.restoreAllMocks();
-});
-
-const digest = hexToUint8Array(digestHex);
-const signingTime = new Date(Number(bundle().verificationMaterial.tlogEntries[0].integratedTime) * 1000);
-const verify = (v: SigstoreVerifier, b = bundle(), data = digest) =>
-  v.verifyArtifact(identity, issuer, b, data, true);
-
-async function verifier(options: SigstoreVerifierOptions = {}) {
-  const v = new SigstoreVerifier(options);
-  await v.loadSigstoreRoot(trustRoot());
-  return v;
-}
-
-// Real SET signatures over the fixture's body, with independent test log keys.
-async function signedLog(): Promise<{ log: RawLog; entry: TLogEntry }> {
-  const secret = ed25519.utils.randomSecretKey();
-  const spki = new Uint8Array([0x30, 0x2a, 0x30, 0x05, 0x06, 0x03, 0x2b, 0x65, 0x70, 0x03, 0x21, 0x00, ...ed25519.getPublicKey(secret)]);
-  const logID = new Uint8Array(await crypto.subtle.digest("SHA-256", spki));
-  const log: RawLog = {
-    baseUrl: "https://log.test",
-    hashAlgorithm: "SHA2_256",
-    publicKey: { rawBytes: Uint8ArrayToBase64(spki), keyDetails: "PKIX_ED25519", validFor: { start: "2025-01-01T00:00:00Z" } },
-    logId: { keyId: Uint8ArrayToBase64(logID) },
-  };
-  const entry = bundle().verificationMaterial.tlogEntries[0];
-  entry.logId = log.logId;
-  delete entry.inclusionProof;
-  const signed = new TextEncoder().encode(canonicalize({
-    body: entry.canonicalizedBody,
-    integratedTime: Number(entry.integratedTime),
-    logIndex: Number(entry.logIndex),
-    logID: Uint8ArrayToHex(logID),
-  }));
-  entry.inclusionPromise = { signedEntryTimestamp: Uint8ArrayToBase64(ed25519.sign(signed, secret)) };
-  return { log, entry };
-}
-
-const operatorCases = [
-  { name: "anonymous authorities retain threshold-one support", operators: ["", ""], threshold: 1, passes: true },
-  { name: "anonymous authorities cannot establish independence", operators: ["", ""], threshold: 2, passes: false },
-  { name: "anonymous plus named does not count twice", operators: ["", "a.test"], threshold: 2, passes: false },
-  { name: "named plus anonymous does not count twice", operators: ["a.test", ""], threshold: 2, passes: false },
-  { name: "multiple keys from one named operator count once", operators: ["a.test", "a.test"], threshold: 2, passes: false },
-  { name: "distinct named operators satisfy the threshold", operators: ["a.test", "b.test"], threshold: 2, passes: true },
-  { name: "an anonymous authority cannot add a third operator", operators: ["a.test", "", "b.test"], threshold: 3, passes: false },
-  { name: "an anonymous authority does not invalidate two named operators", operators: ["a.test", "", "b.test"], threshold: 2, passes: true },
-];
-
-describe("Operator thresholds", () => {
-  let signedLogs: Awaited<ReturnType<typeof signedLog>>[];
-  beforeAll(async () => { signedLogs = await Promise.all([signedLog(), signedLog(), signedLog()]); });
-
-  it.each(operatorCases)("Rekor: $name", async ({ operators, threshold, passes }) => {
-    const root = trustRoot();
-    root.tlogs = operators.map((operator, i) => ({ ...signedLogs[i].log, operator: operator || undefined }));
-    const b = bundle();
-    b.mediaType = "application/vnd.dev.sigstore.bundle+json;version=0.1";
-    b.verificationMaterial.tlogEntries = operators.map((_, i) => signedLogs[i].entry);
-    const v = new SigstoreVerifier({ tlogThreshold: threshold });
-    await v.loadSigstoreRoot(root);
-    const result = verify(v, b);
-    if (passes) await expect(result).resolves.toBe(true);
-    else await expect(result).rejects.toThrow("Not enough verified transparency logs");
-  });
-
-  it.each(operatorCases)("CT: $name", async ({ operators, threshold, passes }) => {
-    const v = await verifier({ ctlogThreshold: threshold });
-    // SCT verification itself is covered by the real fixture tests.
-    vi.spyOn(v, "verifySCT").mockResolvedValue(new Set(operators));
-    const result = verify(v);
-    if (passes) await expect(result).resolves.toBe(true);
-    else await expect(result).rejects.toThrow("Not enough verified CT log operators");
-  });
-
-  it.each(operatorCases)("TSA: $name", async ({ operators, threshold, passes }) => {
-    vi.mocked(verifyBundleTimestamp).mockResolvedValue(operators.map((operator) => ({ signingTime, operator })));
-    const result = verify(await verifier({ tsaThreshold: threshold }));
-    if (passes) await expect(result).resolves.toBe(true);
-    else await expect(result).rejects.toThrow("Not enough verified TSA operators");
-  });
-});
-
-describe("Small input hardening", () => {
-  it("awaits asynchronous custom policies and policy combinators", async () => {
-    const v = await verifier();
-    const rejection = {
-      verify: async () => { throw new Error("asynchronous policy rejected"); },
-    };
-
-    await expect(v.verifyArtifactPolicy(rejection, bundle(), digest, true))
-      .rejects.toThrow("asynchronous policy rejected");
-    await expect(v.verifyArtifactPolicy(new AllOf([rejection]), bundle(), digest, true))
-      .rejects.toThrow("asynchronous policy rejected");
-    await expect(v.verifyArtifactPolicy(new AnyOf([rejection]), bundle(), digest, true))
-      .rejects.toThrow("0 of 1 policies succeeded");
-  });
-
-  it("rejects malformed authority validity periods while loading the root", async () => {
-    for (let i = 0; i < 4; i++) {
-      const root = trustRoot();
-      const periods = [
-        root.tlogs[0].publicKey.validFor,
-        root.ctlogs[0].publicKey.validFor,
-        root.certificateAuthorities[0].validFor,
-        root.timestampAuthorities[0].validFor,
-      ];
-      periods[i].start = "not-a-date";
-      await expect(new SigstoreVerifier().loadSigstoreRoot(root))
-        .rejects.toThrow("Invalid authority validity period");
-    }
-
-    const root = trustRoot();
-    root.tlogs[0].publicKey.validFor = {
-      start: "2026-01-02T00:00:00Z",
-      end: "2026-01-01T00:00:00Z",
-    };
-    await expect(new SigstoreVerifier().loadSigstoreRoot(root))
-      .rejects.toThrow("Invalid authority validity period");
-  });
-
-  it("requires non-negative safe-integer thresholds", () => {
-    for (const key of ["tlogThreshold", "ctlogThreshold", "tsaThreshold"] as const) {
-      for (const value of [NaN, Infinity, -Infinity, -1, 0.5, Number.MAX_SAFE_INTEGER + 1, "2"]) {
-        expect(() => new SigstoreVerifier({ [key]: value } as SigstoreVerifierOptions)).toThrow(`${key} must be a non-negative safe integer`);
-      }
-      for (const value of [0, 1, 2]) expect(() => new SigstoreVerifier({ [key]: value })).not.toThrow();
-    }
-  });
-
-  it("rejects digest-only inputs that are not 32 bytes", async () => {
-    const v = await verifier();
-    for (const length of [0, 31, 33, 64]) {
-      await expect(verify(v, bundle(), new Uint8Array(length))).rejects.toThrow("SHA-256 digest must be exactly 32 bytes");
-    }
-  });
-
-  it("rejects oversized or unrepresentable log numbers before cryptography", () => {
-    for (const field of ["logIndex", "integratedTime"] as const) {
-      for (const value of ["9".repeat(10000), "9223372036854775808", "-1", "1.5"]) {
-        const b = bundle();
-        b.verificationMaterial.tlogEntries[0][field] = value;
-        expect(() => assertBundle(b)).toThrow("Invalid bundle");
-      }
-    }
-    const unsafe = bundle();
-    unsafe.verificationMaterial.tlogEntries[0].logIndex = "9007199254740993";
-    expect(() => assertBundle(unsafe)).toThrow("inclusion promise");
-    const invalidDate = bundle();
-    invalidDate.verificationMaterial.tlogEntries[0].integratedTime = "8640000000001";
-    expect(() => assertBundle(invalidDate)).toThrow("integratedTime");
-  });
-
-  it("bounds proof integers and sibling counts while preserving full int64 precision", () => {
-    for (const field of ["logIndex", "treeSize"] as const) {
-      const b = bundle();
-      const proof = b.verificationMaterial.tlogEntries[0].inclusionProof;
-      if (!proof) throw new Error("Fixture must contain an inclusion proof");
-      proof[field] = "9223372036854775808";
-      expect(() => assertBundle(b)).toThrow("inclusion proof");
-    }
-    const b = bundle();
-    const entry = b.verificationMaterial.tlogEntries[0];
-    const proof = entry.inclusionProof;
-    if (!proof) throw new Error("Fixture must contain an inclusion proof");
-    delete entry.inclusionPromise;
-    entry.logIndex = "9223372036854775806";
-    proof.logIndex = entry.logIndex;
-    proof.treeSize = "9223372036854775807";
-    proof.hashes = Array(63).fill(Uint8ArrayToBase64(new Uint8Array(32)));
-    expect(() => assertBundle(b)).not.toThrow();
-    proof.hashes.push(proof.hashes[0]);
-    expect(() => assertBundle(b)).toThrow("inclusion proof");
-  });
-
-  it("enforces the timestamp cap through the exported helper too", async () => {
-    await expect(verifyBundleTimestamp({ rfc3161Timestamps: Array(33).fill({ signedTimestamp: "AA==" }) }, digest, []))
-      .rejects.toThrow("Invalid bundle: rfc3161Timestamps");
-    await expect(verifyBundleTimestamp(undefined, digest, [])).resolves.toEqual([]);
-    await expect(verifyBundleTimestamp({}, digest, [])).resolves.toEqual([]);
-  });
-
-  it("bounds encoded bundle data and certificate-chain length", async () => {
-    const oversized = "A".repeat(16 * 1024 * 1024 + 1);
-    const b = bundle();
-    if (!b.dsseEnvelope) throw new Error("Fixture must contain a DSSE envelope");
-    b.dsseEnvelope.payload = oversized;
-    expect(() => assertBundle(b)).toThrow("Invalid bundle");
-    await expect(verifyBundleTimestamp(
-      { rfc3161Timestamps: [{ signedTimestamp: oversized }] },
-      digest,
-      [],
-    )).rejects.toThrow("Invalid bundle");
-
-    const chained = bundle();
-    const cert = chained.verificationMaterial.certificate;
-    if (!cert) throw new Error("Fixture must contain a certificate");
-    delete chained.verificationMaterial.certificate;
-    chained.verificationMaterial.x509CertificateChain = {
-      certificates: Array(33).fill(cert),
-    };
-    expect(() => assertBundle(chained)).toThrow("Invalid bundle: certificate");
-  });
-
-  it("rejects malformed or excessive subjects and digest maps", async () => {
-    const v = await verifier();
-    const b = bundle();
-    const cert = b.verificationMaterial.certificate;
-    const env = b.dsseEnvelope;
-    if (!cert || !env) throw new Error("Fixture must contain a certificate and DSSE envelope");
-    const signingCert = X509Certificate.parse(base64ToUint8Array(cert.rawBytes));
-    const signature = base64ToUint8Array(env.signatures[0].sig);
-    // Isolate parsing of authenticated payloads; the real bundle tests exercise all trust checks.
-    vi.spyOn(v as unknown as { verifyBundle: () => Promise<{ signingCert: X509Certificate; signature: Uint8Array }> }, "verifyBundle")
-      .mockResolvedValue({ signingCert, signature });
-    const subject = { digest: { sha256: digestHex } };
-    for (const payload of [null, {}, { subject: [] }, { subject: Array(1025).fill(subject) }]) {
-      env.payload = Uint8ArrayToBase64(new TextEncoder().encode(JSON.stringify(payload)));
-      await expect(verify(v, b)).rejects.toThrow("DSSE payload must have between 1 and 1024 subjects");
-    }
-    for (const invalid of [null, { digest: [] }, { digest: Object.fromEntries(Array.from({ length: 33 }, (_, i) => [`hash${i}`, "00"])) }]) {
-      env.payload = Uint8ArrayToBase64(new TextEncoder().encode(JSON.stringify({ subject: [invalid, subject] })));
-      await expect(verify(v, b)).rejects.toThrow("Invalid DSSE subject digest map");
-    }
-    env.payload = Uint8ArrayToBase64(new TextEncoder().encode(JSON.stringify({ subject: [{ digest: { sha256: 123 } }] })));
-    await expect(verify(v, b)).rejects.toThrow("does not match any subject");
-  });
-});