@freedomofpress/sigstore-browser 0.1.2 → 0.1.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/interfaces.d.ts +1 -0
- package/dist/interfaces.d.ts.map +1 -1
- package/dist/interfaces.js +18 -0
- package/dist/interfaces.js.map +1 -1
- package/dist/oid.d.ts +2 -0
- package/dist/oid.d.ts.map +1 -1
- package/dist/oid.js +5 -1
- package/dist/oid.js.map +1 -1
- package/dist/sigstore.d.ts.map +1 -1
- package/dist/sigstore.js +96 -55
- package/dist/sigstore.js.map +1 -1
- package/dist/timestamp/tsa.d.ts +6 -4
- package/dist/timestamp/tsa.d.ts.map +1 -1
- package/dist/timestamp/tsa.js +27 -25
- package/dist/timestamp/tsa.js.map +1 -1
- package/dist/tlog/dsse.js +11 -11
- package/dist/tlog/dsse.js.map +1 -1
- package/dist/tlog/intoto.d.ts.map +1 -1
- package/dist/tlog/intoto.js +7 -4
- package/dist/tlog/intoto.js.map +1 -1
- package/dist/x509/cert.d.ts +11 -3
- package/dist/x509/cert.d.ts.map +1 -1
- package/dist/x509/cert.js +58 -26
- package/dist/x509/cert.js.map +1 -1
- package/dist/x509/sct.d.ts.map +1 -1
- package/dist/x509/sct.js +4 -0
- package/dist/x509/sct.js.map +1 -1
- package/package.json +1 -1
- package/src/index.browser.test.ts +37 -0
- package/src/interfaces.ts +20 -0
- package/src/oid.ts +7 -1
- package/src/sigstore.ts +109 -60
- package/src/timestamp/tsa.ts +37 -30
- package/src/tlog/dsse.ts +11 -11
- package/src/tlog/intoto.ts +8 -4
- package/src/x509/cert.ts +68 -24
- package/src/x509/sct.ts +4 -0
package/dist/tlog/dsse.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"dsse.js","sourceRoot":"","sources":["../../src/tlog/dsse.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACtG,OAAO,EAAE,
|
|
1
|
+
{"version":3,"file":"dsse.js","sourceRoot":"","sources":["../../src/tlog/dsse.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACtG,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AA0BpD,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,KAAiB,EACjB,MAAsB;IAEtB,MAAM,SAAS,GAAG,KAAkB,CAAC;IAErC,QAAQ,SAAS,CAAC,UAAU,EAAE,CAAC;QAC7B,KAAK,OAAO;YACV,OAAO,iBAAiB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAC9C,KAAK,OAAO;YACV,OAAO,iBAAiB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAC9C;YACE,MAAM,IAAI,KAAK,CACb,6BAA6B,SAAS,CAAC,UAAU,EAAE,CACpD,CAAC;IACN,CAAC;AACH,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,KAAgB,EAChB,MAAsB;IAEtB,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACnD,MAAM,YAAY,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAEjD,IAAI,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IAED,MAAM,cAAc,GAAG,kBAAkB,CAAC,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAEjF,IAAI,CAAC,eAAe,CAAC,YAAY,EAAE,cAAc,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,CAAC;QACzE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IAED,MAAM,OAAO,GAAG,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IACnE,MAAM,aAAa,GAAG,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IAEpE,MAAM,YAAY,GAAG,kBAAkB,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;IACrE,MAAM,eAAe,GAAG,IAAI,UAAU,CACpC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,YAAuC,CAAC,CAC7E,CAAC;IAEF,IAAI,CAAC,eAAe,CAAC,aAAa,EAAE,eAAe,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC;AAED,+FAA+F;AAC/F,KAAK,UAAU,iBAAiB,CAC9B,KAAgB,EAChB,MAAsB;IAEtB,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,IAAI,GAAI,KAAK,CAAC,IAAY,CAAC,QAAQ,CAAC;IAC1C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IAC3C,MAAM,YAAY,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAEjD,IAAI,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IAED,MAAM,cAAc,GAAG,kBAAkB,CAAC,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAEjF,IAAI,CAAC,eAAe,CAAC,YAAY,EAAE,cAAc,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IACpF,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IAC7D,MAAM,aAAa,GAAG,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAElE,MAAM,YAAY,GAAG,kBAAkB,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;IACrE,MAAM,eAAe,GAAG,IAAI,UAAU,CACpC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,YAAuC,CAAC,CAC7E,CAAC;IAEF,IAAI,CAAC,eAAe,CAAC,aAAa,EAAE,eAAe,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IACvF,CAAC;AACH,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"intoto.d.ts","sourceRoot":"","sources":["../../src/tlog/intoto.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAiC5C,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,UAAU,EACjB,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,IAAI,CAAC,
|
|
1
|
+
{"version":3,"file":"intoto.d.ts","sourceRoot":"","sources":["../../src/tlog/intoto.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAiC5C,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,UAAU,EACjB,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,IAAI,CAAC,CAsDf"}
|
package/dist/tlog/intoto.js
CHANGED
|
@@ -10,7 +10,7 @@
|
|
|
10
10
|
* - Uses crypto.subtle.digest for hash computation instead of Node.js crypto
|
|
11
11
|
*/
|
|
12
12
|
import { base64Decode, base64ToUint8Array, hexToUint8Array, uint8ArrayEqual } from "@freedomofpress/crypto-browser";
|
|
13
|
-
import {
|
|
13
|
+
import { getHashAlgorithm } from "../interfaces.js";
|
|
14
14
|
export async function verifyIntotoBody(entry, bundle) {
|
|
15
15
|
const intotoEntry = entry;
|
|
16
16
|
if (intotoEntry.apiVersion !== "0.0.2") {
|
|
@@ -38,10 +38,13 @@ export async function verifyIntotoBody(entry, bundle) {
|
|
|
38
38
|
throw new Error("Intoto signature mismatch between TLog entry and bundle");
|
|
39
39
|
}
|
|
40
40
|
if (intotoEntry.spec.content.payloadHash) {
|
|
41
|
-
|
|
42
|
-
|
|
41
|
+
if (!intotoEntry.spec.content.payloadHash.algorithm) {
|
|
42
|
+
throw new Error("Intoto entry missing payloadHash algorithm");
|
|
43
|
+
}
|
|
44
|
+
const hashAlg = getHashAlgorithm(intotoEntry.spec.content.payloadHash.algorithm);
|
|
45
|
+
const tlogHashBytes = hexToUint8Array(intotoEntry.spec.content.payloadHash.value);
|
|
43
46
|
const payloadBytes = base64ToUint8Array(bundle.dsseEnvelope.payload);
|
|
44
|
-
const bundleHashBytes = new Uint8Array(await crypto.subtle.digest(
|
|
47
|
+
const bundleHashBytes = new Uint8Array(await crypto.subtle.digest(hashAlg, payloadBytes));
|
|
45
48
|
if (!uint8ArrayEqual(tlogHashBytes, bundleHashBytes)) {
|
|
46
49
|
throw new Error("Intoto payload hash mismatch between TLog entry and bundle");
|
|
47
50
|
}
|
package/dist/tlog/intoto.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"intoto.js","sourceRoot":"","sources":["../../src/tlog/intoto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACpH,OAAO,EAAE,
|
|
1
|
+
{"version":3,"file":"intoto.js","sourceRoot":"","sources":["../../src/tlog/intoto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACpH,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAmCpD,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAAiB,EACjB,MAAsB;IAEtB,MAAM,WAAW,GAAG,KAAoB,CAAC;IAEzC,IAAI,WAAW,CAAC,UAAU,KAAK,OAAO,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CACb,+BAA+B,WAAW,CAAC,UAAU,EAAE,CACxD,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IAED,MAAM,YAAY,GAAG,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;IAEvD,IAAI,CAAC,YAAY,CAAC,UAAU,IAAI,YAAY,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IAED,mEAAmE;IACnE,qDAAqD;IACrD,sEAAsE;IACtE,0DAA0D;IAC1D,MAAM,aAAa,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACrD,MAAM,cAAc,GAAG,YAAY,CAAC,aAAa,CAAC,CAAC,CAAC,+DAA+D;IACnH,MAAM,YAAY,GAAG,kBAAkB,CAAC,cAAc,CAAC,CAAC,CAAC,4CAA4C;IAErG,IAAI,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IAED,MAAM,cAAc,GAAG,kBAAkB,CAAC,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAEjF,IAAI,CAAC,eAAe,CAAC,YAAY,EAAE,cAAc,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IAED,IAAI,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QACzC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,SAAS,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAChE,CAAC;QAED,MAAM,OAAO,GAAG,gBAAgB,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QACjF,MAAM,aAAa,GAAG,eAAe,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAElF,MAAM,YAAY,GAAG,kBAAkB,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QACrE,MAAM,eAAe,GAAG,IAAI,UAAU,CACpC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,YAAuC,CAAC,CAC7E,CAAC;QAEF,IAAI,CAAC,eAAe,CAAC,aAAa,EAAE,eAAe,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;AACH,CAAC"}
|
package/dist/x509/cert.d.ts
CHANGED
|
@@ -14,12 +14,20 @@ export declare class X509Certificate {
|
|
|
14
14
|
get subject(): Uint8Array;
|
|
15
15
|
get publicKey(): Uint8Array;
|
|
16
16
|
/**
|
|
17
|
-
* Import the public key with a specific hash algorithm for RSA keys
|
|
18
|
-
* For ECDSA keys,
|
|
17
|
+
* Import the public key with a specific hash algorithm and signature scheme for RSA keys.
|
|
18
|
+
* For ECDSA keys, both parameters are ignored.
|
|
19
|
+
* @param hashAlg - Hash algorithm (e.g., "sha384") for RSA keys
|
|
20
|
+
* @param usePss - If true, import as RSA-PSS key; if false, import as PKCS#1 v1.5
|
|
19
21
|
*/
|
|
20
|
-
getPublicKeyObj(hashAlg?: string): Promise<CryptoKey>;
|
|
22
|
+
getPublicKeyObj(hashAlg?: string, usePss?: boolean): Promise<CryptoKey>;
|
|
21
23
|
get publicKeyObj(): Promise<CryptoKey>;
|
|
22
24
|
get signatureAlgorithm(): string;
|
|
25
|
+
get signatureAlgorithmOid(): string;
|
|
26
|
+
/**
|
|
27
|
+
* Parse hash algorithm from RSA-PSS signature algorithm parameters.
|
|
28
|
+
* RSA-PSS parameters are: SEQUENCE { hashAlgorithm, maskGenAlgorithm, saltLength, trailerField }
|
|
29
|
+
*/
|
|
30
|
+
private parseRsaPssHashAlgorithm;
|
|
23
31
|
get signatureValue(): Uint8Array;
|
|
24
32
|
get subjectAltName(): string | undefined;
|
|
25
33
|
get extensions(): ASN1Obj[];
|
package/dist/x509/cert.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"cert.d.ts","sourceRoot":"","sources":["../../src/x509/cert.ts"],"names":[],"mappings":"AAeA,OAAO,EACL,OAAO,EAMR,MAAM,gCAAgC,CAAC;AAGxC,OAAO,EACL,2BAA2B,EAC3B,6BAA6B,EAC7B,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,qBAAqB,EACrB,gBAAgB,EAChB,mCAAmC,EACnC,yBAAyB,EAC1B,MAAM,UAAU,CAAC;AAWlB,eAAO,MAAM,iBAAiB,4BAA4B,CAAC;AAE3D,qBAAa,eAAe;IACnB,IAAI,EAAE,OAAO,CAAC;gBAET,IAAI,EAAE,OAAO;WAIX,KAAK,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,GAAG,eAAe;IAM/D,IAAI,cAAc,IAAI,OAAO,CAE5B;IAED,IAAI,OAAO,IAAI,MAAM,CAIpB;IAED,IAAI,YAAY,IAAI,UAAU,CAE7B;IAED,IAAI,SAAS,IAAI,IAAI,CAGpB;IAED,IAAI,QAAQ,IAAI,IAAI,CAGnB;IAED,IAAI,MAAM,IAAI,UAAU,CAEvB;IAED,IAAI,OAAO,IAAI,UAAU,CAExB;IAED,IAAI,SAAS,IAAI,UAAU,CAE1B;IAED
|
|
1
|
+
{"version":3,"file":"cert.d.ts","sourceRoot":"","sources":["../../src/x509/cert.ts"],"names":[],"mappings":"AAeA,OAAO,EACL,OAAO,EAMR,MAAM,gCAAgC,CAAC;AAGxC,OAAO,EACL,2BAA2B,EAC3B,6BAA6B,EAC7B,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,qBAAqB,EACrB,gBAAgB,EAChB,mCAAmC,EACnC,yBAAyB,EAC1B,MAAM,UAAU,CAAC;AAWlB,eAAO,MAAM,iBAAiB,4BAA4B,CAAC;AAE3D,qBAAa,eAAe;IACnB,IAAI,EAAE,OAAO,CAAC;gBAET,IAAI,EAAE,OAAO;WAIX,KAAK,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,GAAG,eAAe;IAM/D,IAAI,cAAc,IAAI,OAAO,CAE5B;IAED,IAAI,OAAO,IAAI,MAAM,CAIpB;IAED,IAAI,YAAY,IAAI,UAAU,CAE7B;IAED,IAAI,SAAS,IAAI,IAAI,CAGpB;IAED,IAAI,QAAQ,IAAI,IAAI,CAGnB;IAED,IAAI,MAAM,IAAI,UAAU,CAEvB;IAED,IAAI,OAAO,IAAI,UAAU,CAExB;IAED,IAAI,SAAS,IAAI,UAAU,CAE1B;IAED;;;;;OAKG;IACU,eAAe,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC;IAiCpF,IAAI,YAAY,IAAI,OAAO,CAAC,SAAS,CAAC,CAErC;IAED,IAAI,kBAAkB,IAAI,MAAM,CAG/B;IAED,IAAI,qBAAqB,IAAI,MAAM,CAElC;IAED;;;OAGG;IACH,OAAO,CAAC,wBAAwB;IA0BhC,IAAI,cAAc,IAAI,UAAU,CAG/B;IAED,IAAI,cAAc,IAAI,MAAM,GAAG,SAAS,CAGvC;IAED,IAAI,UAAU,IAAI,OAAO,EAAE,CAK1B;IAED,IAAI,WAAW,IAAI,qBAAqB,GAAG,SAAS,CAGnD;IAED,IAAI,mBAAmB,IAAI,6BAA6B,GAAG,SAAS,CAGnE;IAED,IAAI,iBAAiB,IAAI,mCAAmC,GAAG,SAAS,CAGvE;IAED,IAAI,iBAAiB,IAAI,2BAA2B,GAAG,SAAS,CAG/D;IAED,IAAI,eAAe,IAAI,yBAAyB,GAAG,SAAS,CAK3D;IAED,IAAI,MAAM,IAAI,gBAAgB,GAAG,SAAS,CAGzC;IAED,IAAI,iBAAiB,IAAI,kBAAkB,GAAG,SAAS,CAGtD;IAED,IAAI,iBAAiB,IAAI,kBAAkB,GAAG,SAAS,CAGtD;IAED,IAAI,IAAI,IAAI,OAAO,CASlB;IAEM,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS;IAK3C,MAAM,CAAC,iBAAiB,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC;IAwBnE,YAAY,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO;IAIjC,MAAM,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO;IAKvC,KAAK,IAAI,eAAe;IAM/B,OAAO,CAAC,aAAa;IAYrB,OAAO,KAAK,iBAAiB,GAG5B;IAGD,OAAO,KAAK,qBAAqB,GAGhC;IAGD,OAAO,KAAK,iBAAiB,GAG5B;IAGD,OAAO,KAAK,UAAU,GAGrB;IAGD,OAAO,KAAK,eAAe,GAG1B;IAGD,OAAO,KAAK,SAAS,GAGpB;IAGD,OAAO,KAAK,WAAW,GAGtB;IAGD,OAAO,KAAK,UAAU,GAGrB;IAGD,OAAO,KAAK,uBAAuB,GAGlC;IAKD,OAAO,KAAK,aAAa,GAIxB;CACF"}
|
package/dist/x509/cert.js
CHANGED
|
@@ -15,7 +15,7 @@ limitations under the License.
|
|
|
15
15
|
*/
|
|
16
16
|
import { ASN1Obj, importKey, toDER, Uint8ArrayToBase64, uint8ArrayEqual, verifySignature, } from "@freedomofpress/crypto-browser";
|
|
17
17
|
import { KeyTypes } from "../interfaces.js";
|
|
18
|
-
import { ECDSA_CURVE_NAMES, ECDSA_SIGNATURE_ALGOS, RSA_SIGNATURE_ALGOS } from "../oid.js";
|
|
18
|
+
import { DEFAULT_HASH_ALGORITHM, ECDSA_CURVE_NAMES, ECDSA_SIGNATURE_ALGOS, OID_RSASSA_PSS, RSA_SIGNATURE_ALGOS, SHA2_HASH_ALGOS } from "../oid.js";
|
|
19
19
|
import { X509AuthorityKeyIDExtension, X509BasicConstraintsExtension, X509Extension, X509FulcioIssuerV1, X509FulcioIssuerV2, X509KeyUsageExtension, X509SCTExtension, X509SubjectAlternativeNameExtension, X509SubjectKeyIDExtension, } from "./ext.js";
|
|
20
20
|
// https://github.com/sigstore/fulcio/blob/main/docs/oid-info.md
|
|
21
21
|
const EXTENSION_OID_SUBJECT_KEY_ID = "2.5.29.14";
|
|
@@ -65,28 +65,28 @@ export class X509Certificate {
|
|
|
65
65
|
return this.subjectPublicKeyInfoObj.toDER();
|
|
66
66
|
}
|
|
67
67
|
/**
|
|
68
|
-
* Import the public key with a specific hash algorithm for RSA keys
|
|
69
|
-
* For ECDSA keys,
|
|
68
|
+
* Import the public key with a specific hash algorithm and signature scheme for RSA keys.
|
|
69
|
+
* For ECDSA keys, both parameters are ignored.
|
|
70
|
+
* @param hashAlg - Hash algorithm (e.g., "sha384") for RSA keys
|
|
71
|
+
* @param usePss - If true, import as RSA-PSS key; if false, import as PKCS#1 v1.5
|
|
70
72
|
*/
|
|
71
|
-
async getPublicKeyObj(hashAlg) {
|
|
73
|
+
async getPublicKeyObj(hashAlg, usePss) {
|
|
72
74
|
const publicKey = this.subjectPublicKeyInfoObj.toDER();
|
|
73
75
|
const spki = ASN1Obj.parseBuffer(publicKey);
|
|
74
76
|
const algorithmOID = spki.subs[0].subs[0].toOID();
|
|
75
|
-
//
|
|
76
|
-
|
|
77
|
-
|
|
78
|
-
|
|
79
|
-
|
|
80
|
-
|
|
81
|
-
|
|
82
|
-
|
|
83
|
-
|
|
84
|
-
|
|
85
|
-
|
|
86
|
-
|
|
87
|
-
|
|
88
|
-
}
|
|
89
|
-
return importKey(KeyTypes.RSA, `RSA_PKCS1V5_${scheme}`, Uint8ArrayToBase64(publicKey));
|
|
77
|
+
// RSA key (OID 1.2.840.113549.1.1.1) or RSA-PSS key (OID 1.2.840.113549.1.1.10)
|
|
78
|
+
const isRsaKey = algorithmOID === "1.2.840.113549.1.1.1";
|
|
79
|
+
const isRsaPssKey = algorithmOID === OID_RSASSA_PSS;
|
|
80
|
+
if (isRsaPssKey) {
|
|
81
|
+
// WebCrypto doesn't support importing keys with id-RSASSA-PSS OID, only rsaEncryption
|
|
82
|
+
throw new Error("RSA-PSS public keys (id-RSASSA-PSS OID) are not supported by WebCrypto. " +
|
|
83
|
+
"Only certificates with standard RSA keys (rsaEncryption OID) signed using RSA-PSS are supported.");
|
|
84
|
+
}
|
|
85
|
+
if (isRsaKey) {
|
|
86
|
+
const hash = hashAlg || DEFAULT_HASH_ALGORITHM;
|
|
87
|
+
// crypto-browser extracts hash from scheme and uses PSS unless "PKCS1" is present
|
|
88
|
+
const scheme = usePss ? hash : `PKCS1_${hash}`;
|
|
89
|
+
return importKey(KeyTypes.RSA, scheme, Uint8ArrayToBase64(publicKey));
|
|
90
90
|
}
|
|
91
91
|
else {
|
|
92
92
|
// ECDSA key - the curve OID is in the second element
|
|
@@ -103,7 +103,36 @@ export class X509Certificate {
|
|
|
103
103
|
}
|
|
104
104
|
get signatureAlgorithm() {
|
|
105
105
|
const oid = this.signatureAlgorithmObj.subs[0].toOID();
|
|
106
|
-
return ECDSA_SIGNATURE_ALGOS[oid];
|
|
106
|
+
return ECDSA_SIGNATURE_ALGOS[oid] || RSA_SIGNATURE_ALGOS[oid] || this.parseRsaPssHashAlgorithm();
|
|
107
|
+
}
|
|
108
|
+
get signatureAlgorithmOid() {
|
|
109
|
+
return this.signatureAlgorithmObj.subs[0].toOID();
|
|
110
|
+
}
|
|
111
|
+
/**
|
|
112
|
+
* Parse hash algorithm from RSA-PSS signature algorithm parameters.
|
|
113
|
+
* RSA-PSS parameters are: SEQUENCE { hashAlgorithm, maskGenAlgorithm, saltLength, trailerField }
|
|
114
|
+
*/
|
|
115
|
+
parseRsaPssHashAlgorithm() {
|
|
116
|
+
const sigAlgOid = this.signatureAlgorithmObj.subs[0].toOID();
|
|
117
|
+
if (sigAlgOid !== OID_RSASSA_PSS) {
|
|
118
|
+
return "";
|
|
119
|
+
}
|
|
120
|
+
// RSA-PSS has parameters in the second element of the signature algorithm sequence
|
|
121
|
+
const params = this.signatureAlgorithmObj.subs[1];
|
|
122
|
+
if (!params || params.subs.length === 0) {
|
|
123
|
+
return DEFAULT_HASH_ALGORITHM;
|
|
124
|
+
}
|
|
125
|
+
// First element is hashAlgorithm [0] EXPLICIT
|
|
126
|
+
const hashAlgWrapper = params.subs[0];
|
|
127
|
+
if (hashAlgWrapper && hashAlgWrapper.subs.length > 0) {
|
|
128
|
+
// The wrapper contains a SEQUENCE with the hash algorithm OID
|
|
129
|
+
const hashAlgSeq = hashAlgWrapper.subs[0];
|
|
130
|
+
if (hashAlgSeq && hashAlgSeq.subs.length > 0) {
|
|
131
|
+
const hashOid = hashAlgSeq.subs[0].toOID();
|
|
132
|
+
return SHA2_HASH_ALGOS[hashOid] || DEFAULT_HASH_ALGORITHM;
|
|
133
|
+
}
|
|
134
|
+
}
|
|
135
|
+
return DEFAULT_HASH_ALGORITHM;
|
|
107
136
|
}
|
|
108
137
|
get signatureValue() {
|
|
109
138
|
// Signature value is a bit string, so we need to skip the first byte
|
|
@@ -167,14 +196,17 @@ export class X509Certificate {
|
|
|
167
196
|
}
|
|
168
197
|
async verify(issuerCertificate) {
|
|
169
198
|
// Extract the hash algorithm from this certificate's signature algorithm
|
|
170
|
-
|
|
171
|
-
const
|
|
172
|
-
|
|
199
|
+
const sigAlgOID = this.signatureAlgorithmOid;
|
|
200
|
+
const isRsaPss = sigAlgOID === OID_RSASSA_PSS;
|
|
201
|
+
// Get hash algorithm - for RSA-PSS, parse from parameters; otherwise lookup in tables
|
|
202
|
+
const hashAlg = isRsaPss
|
|
203
|
+
? this.parseRsaPssHashAlgorithm()
|
|
204
|
+
: (RSA_SIGNATURE_ALGOS[sigAlgOID] || ECDSA_SIGNATURE_ALGOS[sigAlgOID]);
|
|
173
205
|
// Use the issuer's public key if provided, otherwise use the subject's (for self-signed certs)
|
|
174
|
-
// Import with the correct hash algorithm for this certificate's signature
|
|
206
|
+
// Import with the correct hash algorithm and key type for this certificate's signature
|
|
175
207
|
const publicKeyObj = issuerCertificate
|
|
176
|
-
? await issuerCertificate.getPublicKeyObj(hashAlg)
|
|
177
|
-
: await this.getPublicKeyObj(hashAlg);
|
|
208
|
+
? await issuerCertificate.getPublicKeyObj(hashAlg, isRsaPss)
|
|
209
|
+
: await this.getPublicKeyObj(hashAlg, isRsaPss);
|
|
178
210
|
return await verifySignature(publicKeyObj, this.tbsCertificate.toDER(), this.signatureValue, this.signatureAlgorithm);
|
|
179
211
|
}
|
|
180
212
|
validForDate(date) {
|
package/dist/x509/cert.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"cert.js","sourceRoot":"","sources":["../../src/x509/cert.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;EAcE;AACF,OAAO,EACL,OAAO,EACP,SAAS,EACT,KAAK,EACL,kBAAkB,EAClB,eAAe,EACf,eAAe,GAChB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;
|
|
1
|
+
{"version":3,"file":"cert.js","sourceRoot":"","sources":["../../src/x509/cert.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;EAcE;AACF,OAAO,EACL,OAAO,EACP,SAAS,EACT,KAAK,EACL,kBAAkB,EAClB,eAAe,EACf,eAAe,GAChB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,cAAc,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AACnJ,OAAO,EACL,2BAA2B,EAC3B,6BAA6B,EAC7B,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,qBAAqB,EACrB,gBAAgB,EAChB,mCAAmC,EACnC,yBAAyB,GAC1B,MAAM,UAAU,CAAC;AAElB,gEAAgE;AAChE,MAAM,4BAA4B,GAAG,WAAW,CAAC;AACjD,MAAM,uBAAuB,GAAG,WAAW,CAAC;AAC5C,MAAM,8BAA8B,GAAG,WAAW,CAAC;AACnD,MAAM,+BAA+B,GAAG,WAAW,CAAC;AACpD,MAAM,8BAA8B,GAAG,WAAW,CAAC;AACnD,MAAM,8BAA8B,GAAG,uBAAuB,CAAC;AAC/D,MAAM,8BAA8B,GAAG,uBAAuB,CAAC;AAE/D,MAAM,CAAC,MAAM,iBAAiB,GAAG,yBAAyB,CAAC;AAE3D,MAAM,OAAO,eAAe;IACnB,IAAI,CAAU;IAErB,YAAY,IAAa;QACvB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAEM,MAAM,CAAC,KAAK,CAAC,IAAyB;QAC3C,MAAM,GAAG,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC1D,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACtC,OAAO,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IAED,IAAI,cAAc;QAChB,OAAO,IAAI,CAAC,iBAAiB,CAAC;IAChC,CAAC;IAED,IAAI,OAAO;QACT,0EAA0E;QAC1E,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;QAChD,OAAO,IAAI,CAAC,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;IAC5C,CAAC;IAED,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC;IACpC,CAAC;IAED,IAAI,SAAS;QACX,0DAA0D;QAC1D,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC3C,CAAC;IAED,IAAI,QAAQ;QACV,0DAA0D;QAC1D,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC3C,CAAC;IAED,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;IAC9B,CAAC;IAED,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;IAC/B,CAAC;IAED,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,uBAAuB,CAAC,KAAK,EAAE,CAAC;IAC9C,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,eAAe,CAAC,OAAgB,EAAE,MAAgB;QAC7D,MAAM,SAAS,GAAG,IAAI,CAAC,uBAAuB,CAAC,KAAK,EAAE,CAAC;QACvD,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QAC5C,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;QAElD,gFAAgF;QAChF,MAAM,QAAQ,GAAG,YAAY,KAAK,sBAAsB,CAAC;QACzD,MAAM,WAAW,GAAG,YAAY,KAAK,cAAc,CAAC;QAEpD,IAAI,WAAW,EAAE,CAAC;YAChB,sFAAsF;YACtF,MAAM,IAAI,KAAK,CACb,0EAA0E;gBAC1E,kGAAkG,CACnG,CAAC;QACJ,CAAC;QAED,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,IAAI,GAAG,OAAO,IAAI,sBAAsB,CAAC;YAC/C,kFAAkF;YAClF,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC;YAC/C,OAAO,SAAS,CAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAC;QACxE,CAAC;aAAM,CAAC;YACN,qDAAqD;YACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;YAC/C,MAAM,KAAK,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;YAC1C,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,KAAK,CAAC,4BAA4B,QAAQ,EAAE,CAAC,CAAC;YAC1D,CAAC;YACD,OAAO,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,EAAE,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IAED,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,eAAe,EAAE,CAAC;IAChC,CAAC;IAED,IAAI,kBAAkB;QACpB,MAAM,GAAG,GAAW,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;QAC/D,OAAO,qBAAqB,CAAC,GAAG,CAAC,IAAI,mBAAmB,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,wBAAwB,EAAE,CAAC;IACnG,CAAC;IAED,IAAI,qBAAqB;QACvB,OAAO,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;IACpD,CAAC;IAED;;;OAGG;IACK,wBAAwB;QAC9B,MAAM,SAAS,GAAG,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;QAC7D,IAAI,SAAS,KAAK,cAAc,EAAE,CAAC;YACjC,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,mFAAmF;QACnF,MAAM,MAAM,GAAG,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxC,OAAO,sBAAsB,CAAC;QAChC,CAAC;QAED,8CAA8C;QAC9C,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACtC,IAAI,cAAc,IAAI,cAAc,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrD,8DAA8D;YAC9D,MAAM,UAAU,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC1C,IAAI,UAAU,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC7C,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;gBAC3C,OAAO,eAAe,CAAC,OAAO,CAAC,IAAI,sBAAsB,CAAC;YAC5D,CAAC;QACH,CAAC;QAED,OAAO,sBAAsB,CAAC;IAChC,CAAC;IAED,IAAI,cAAc;QAChB,qEAAqE;QACrE,OAAO,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAClD,CAAC;IAED,IAAI,cAAc;QAChB,MAAM,GAAG,GAAG,IAAI,CAAC,iBAAiB,CAAC;QACnC,OAAO,GAAG,EAAE,GAAG,IAAI,GAAG,EAAE,UAAU,CAAC;IACrC,CAAC;IAED,IAAI,UAAU;QACZ,uEAAuE;QACvE,uBAAuB;QACvB,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3C,OAAO,MAAM,EAAE,IAAI,IAAI,0BAA0B,CAAC,EAAE,CAAC;IACvD,CAAC;IAED,IAAI,WAAW;QACb,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,uBAAuB,CAAC,CAAC;QACxD,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1D,CAAC;IAED,IAAI,mBAAmB;QACrB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,+BAA+B,CAAC,CAAC;QAChE,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,6BAA6B,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAClE,CAAC;IAED,IAAI,iBAAiB;QACnB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,8BAA8B,CAAC,CAAC;QAC/D,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,mCAAmC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACxE,CAAC;IAED,IAAI,iBAAiB;QACnB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,8BAA8B,CAAC,CAAC;QAC/D,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,2BAA2B,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAChE,CAAC;IAED,IAAI,eAAe;QACjB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,4BAA4B,CAAC,CAAC;QAC7D,OAAO,GAAG;YACR,CAAC,CAAC,IAAI,yBAAyB,CAAC,GAAG,CAAC;YACpC,CAAC,CAAC,0BAA0B,CAAC,SAAS,CAAC;IAC3C,CAAC;IAED,IAAI,MAAM;QACR,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,iBAAiB,CAAC,CAAC;QAClD,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACrD,CAAC;IAED,IAAI,iBAAiB;QACnB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,8BAA8B,CAAC,CAAC;QAC/D,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvD,CAAC;IAED,IAAI,iBAAiB;QACnB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,8BAA8B,CAAC,CAAC;QAC/D,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvD,CAAC;IAED,IAAI,IAAI;QACN,MAAM,EAAE,GAAG,IAAI,CAAC,mBAAmB,EAAE,IAAI,IAAI,KAAK,CAAC;QAEnD,gEAAgE;QAChE,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,OAAO,EAAE,IAAI,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC;QAC5C,CAAC;QAED,OAAO,EAAE,CAAC;IACZ,CAAC;IAEM,SAAS,CAAC,GAAW;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QACpC,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAClD,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,iBAAmC;QACrD,yEAAyE;QACzE,MAAM,SAAS,GAAG,IAAI,CAAC,qBAAqB,CAAC;QAC7C,MAAM,QAAQ,GAAG,SAAS,KAAK,cAAc,CAAC;QAE9C,sFAAsF;QACtF,MAAM,OAAO,GAAG,QAAQ;YACtB,CAAC,CAAC,IAAI,CAAC,wBAAwB,EAAE;YACjC,CAAC,CAAC,CAAC,mBAAmB,CAAC,SAAS,CAAC,IAAI,qBAAqB,CAAC,SAAS,CAAC,CAAC,CAAC;QAEzE,+FAA+F;QAC/F,uFAAuF;QACvF,MAAM,YAAY,GAAG,iBAAiB;YACpC,CAAC,CAAC,MAAM,iBAAiB,CAAC,eAAe,CAAC,OAAO,EAAE,QAAQ,CAAC;YAC5D,CAAC,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAElD,OAAO,MAAM,eAAe,CAC1B,YAAY,EACZ,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,EAC3B,IAAI,CAAC,cAAc,EACnB,IAAI,CAAC,kBAAkB,CACxB,CAAC;IACJ,CAAC;IAEM,YAAY,CAAC,IAAU;QAC5B,OAAO,IAAI,CAAC,SAAS,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC;IACzD,CAAC;IAEM,MAAM,CAAC,KAAsB;QAClC,OAAO,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IAChE,CAAC;IAED,sDAAsD;IAC/C,KAAK;QACV,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;QAClC,OAAO,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACtC,CAAC;IAEO,aAAa,CAAC,GAAW;QAC/B,0EAA0E;QAC1E,oCAAoC;QACpC,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC;IACpE,CAAC;IAED,6EAA6E;IAC7E,2EAA2E;IAC3E,uBAAuB;IACvB,qDAAqD;IAErD,yDAAyD;IACzD,IAAY,iBAAiB;QAC3B,kEAAkE;QAClE,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;IAED,yDAAyD;IACzD,IAAY,qBAAqB;QAC/B,uEAAuE;QACvE,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;IAED,yDAAyD;IACzD,IAAY,iBAAiB;QAC3B,kEAAkE;QAClE,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;IAED,yDAAyD;IACzD,IAAY,UAAU;QACpB,8DAA8D;QAC9D,OAAO,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;IAED,yDAAyD;IACzD,IAAY,eAAe;QACzB,oEAAoE;QACpE,OAAO,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;IAED,yDAAyD;IACzD,IAAY,SAAS;QACnB,8DAA8D;QAC9D,OAAO,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;IAED,yDAAyD;IACzD,IAAY,WAAW;QACrB,8DAA8D;QAC9D,OAAO,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;IAED,yDAAyD;IACzD,IAAY,UAAU;QACpB,8DAA8D;QAC9D,OAAO,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;IAED,yDAAyD;IACzD,IAAY,uBAAuB;QACjC,6EAA6E;QAC7E,OAAO,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;IAED,+EAA+E;IAC/E,sDAAsD;IACtD,yDAAyD;IACzD,IAAY,aAAa;QACvB,OAAO,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAC9C,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAChC,CAAC;IACJ,CAAC;CACF"}
|
package/dist/x509/sct.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"sct.d.ts","sourceRoot":"","sources":["../../src/x509/sct.ts"],"names":[],"mappings":"AAiBA,UAAU,UAAU;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,UAAU,CAAC;IAClB,SAAS,EAAE,UAAU,CAAC;IACtB,UAAU,EAAE,UAAU,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,SAAS,EAAE,UAAU,CAAC;CACvB;AAED,qBAAa,0BAA0B;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;IAC/B,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;gBAEnB,OAAO,EAAE,UAAU;IAU/B,IAAI,QAAQ,IAAI,IAAI,CAEnB;IAID,IAAI,SAAS,IAAI,MAAM,CA0BtB;IAEY,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC;WA8B5D,KAAK,CAAC,GAAG,EAAE,UAAU,GAAG,0BAA0B;
|
|
1
|
+
{"version":3,"file":"sct.d.ts","sourceRoot":"","sources":["../../src/x509/sct.ts"],"names":[],"mappings":"AAiBA,UAAU,UAAU;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,UAAU,CAAC;IAClB,SAAS,EAAE,UAAU,CAAC;IACtB,UAAU,EAAE,UAAU,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,SAAS,EAAE,UAAU,CAAC;CACvB;AAED,qBAAa,0BAA0B;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;IAC/B,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;gBAEnB,OAAO,EAAE,UAAU;IAU/B,IAAI,QAAQ,IAAI,IAAI,CAEnB;IAID,IAAI,SAAS,IAAI,MAAM,CA0BtB;IAEY,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC;WA8B5D,KAAK,CAAC,GAAG,EAAE,UAAU,GAAG,0BAA0B;CA6CjE"}
|
package/dist/x509/sct.js
CHANGED
|
@@ -88,7 +88,11 @@ export class SignedCertificateTimestamp {
|
|
|
88
88
|
static parse(buf) {
|
|
89
89
|
const stream = new ByteStream(buf);
|
|
90
90
|
// Version - enum { v1(0), (255) }
|
|
91
|
+
// RFC 6962 specifies only v1(0) is valid (for now)
|
|
91
92
|
const version = stream.getUint8();
|
|
93
|
+
if (version !== 0) {
|
|
94
|
+
throw new Error(`Unsupported SCT version: ${version} (expected 0 for v1)`);
|
|
95
|
+
}
|
|
92
96
|
// Log ID - struct { opaque key_id[32]; }
|
|
93
97
|
const logID = stream.getBlock(32);
|
|
94
98
|
// Timestamp - uint64
|
package/dist/x509/sct.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"sct.js","sourceRoot":"","sources":["../../src/x509/sct.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;EAcE;AACF,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAY7F,MAAM,OAAO,0BAA0B;IAC5B,OAAO,CAAS;IAChB,KAAK,CAAa;IAClB,SAAS,CAAa;IACtB,UAAU,CAAa;IACvB,aAAa,CAAS;IACtB,kBAAkB,CAAS;IAC3B,SAAS,CAAa;IAE/B,YAAY,OAAmB;QAC7B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC3B,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;QAC3C,IAAI,CAAC,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC;QACrD,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;IACrC,CAAC;IAED,IAAI,QAAQ;QACV,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAC1D,CAAC;IAED,mEAAmE;IACnE,2DAA2D;IAC3D,IAAI,SAAS;QACX,QAAQ,IAAI,CAAC,aAAa,EAAE,CAAC;YAC3B,0BAA0B;YAC1B,KAAK,CAAC;gBACJ,OAAO,MAAM,CAAC;YAChB,0BAA0B;YAC1B,KAAK,CAAC;gBACJ,OAAO,KAAK,CAAC;YACf,0BAA0B;YAC1B,KAAK,CAAC;gBACJ,OAAO,MAAM,CAAC;YAChB,0BAA0B;YAC1B,KAAK,CAAC;gBACJ,OAAO,QAAQ,CAAC;YAClB,KAAK,CAAC;gBACJ,OAAO,QAAQ,CAAC;YAClB,0BAA0B;YAC1B,KAAK,CAAC;gBACJ,OAAO,QAAQ,CAAC;YAClB,0BAA0B;YAC1B,KAAK,CAAC;gBACJ,OAAO,QAAQ,CAAC;YAClB,0BAA0B;YAC1B;gBACE,OAAO,SAAS,CAAC;QACrB,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,OAAmB,EAAE,GAAc;QACrD,0EAA0E;QAC1E,kBAAkB;QAClB,qDAAqD;QACrD,MAAM,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAChC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAChC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,2CAA2C;QACpE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAClC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,kCAAkC;QAC7D,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAC3B,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QAEhD,yDAAyD;QACzD,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,GAAG,CAAC,EAAE,CAAC;YACnC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACrC,CAAC;QAED,OAAO,MAAM,eAAe,CAC1B,GAAG,EACH,MAAM,CAAC,MAAM,EACb,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,SAAS,CACf,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,qEAAqE;IACrE,8CAA8C;IAC9C,qDAAqD;IACrD,2DAA2D;IACpD,MAAM,CAAC,KAAK,CAAC,GAAe;QACjC,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;QAEnC,kCAAkC;QAClC,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;
|
|
1
|
+
{"version":3,"file":"sct.js","sourceRoot":"","sources":["../../src/x509/sct.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;EAcE;AACF,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAY7F,MAAM,OAAO,0BAA0B;IAC5B,OAAO,CAAS;IAChB,KAAK,CAAa;IAClB,SAAS,CAAa;IACtB,UAAU,CAAa;IACvB,aAAa,CAAS;IACtB,kBAAkB,CAAS;IAC3B,SAAS,CAAa;IAE/B,YAAY,OAAmB;QAC7B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC3B,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;QAC3C,IAAI,CAAC,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC;QACrD,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;IACrC,CAAC;IAED,IAAI,QAAQ;QACV,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAC1D,CAAC;IAED,mEAAmE;IACnE,2DAA2D;IAC3D,IAAI,SAAS;QACX,QAAQ,IAAI,CAAC,aAAa,EAAE,CAAC;YAC3B,0BAA0B;YAC1B,KAAK,CAAC;gBACJ,OAAO,MAAM,CAAC;YAChB,0BAA0B;YAC1B,KAAK,CAAC;gBACJ,OAAO,KAAK,CAAC;YACf,0BAA0B;YAC1B,KAAK,CAAC;gBACJ,OAAO,MAAM,CAAC;YAChB,0BAA0B;YAC1B,KAAK,CAAC;gBACJ,OAAO,QAAQ,CAAC;YAClB,KAAK,CAAC;gBACJ,OAAO,QAAQ,CAAC;YAClB,0BAA0B;YAC1B,KAAK,CAAC;gBACJ,OAAO,QAAQ,CAAC;YAClB,0BAA0B;YAC1B,KAAK,CAAC;gBACJ,OAAO,QAAQ,CAAC;YAClB,0BAA0B;YAC1B;gBACE,OAAO,SAAS,CAAC;QACrB,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,OAAmB,EAAE,GAAc;QACrD,0EAA0E;QAC1E,kBAAkB;QAClB,qDAAqD;QACrD,MAAM,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAChC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAChC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,2CAA2C;QACpE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAClC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,kCAAkC;QAC7D,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAC3B,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QAEhD,yDAAyD;QACzD,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,GAAG,CAAC,EAAE,CAAC;YACnC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACrC,CAAC;QAED,OAAO,MAAM,eAAe,CAC1B,GAAG,EACH,MAAM,CAAC,MAAM,EACb,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,SAAS,CACf,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,qEAAqE;IACrE,8CAA8C;IAC9C,qDAAqD;IACrD,2DAA2D;IACpD,MAAM,CAAC,KAAK,CAAC,GAAe;QACjC,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;QAEnC,kCAAkC;QAClC,mDAAmD;QACnD,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;QAClC,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,4BAA4B,OAAO,sBAAsB,CAAC,CAAC;QAC7E,CAAC;QAED,0CAA0C;QAC1C,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAElC,qBAAqB;QACrB,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAErC,6CAA6C;QAC7C,MAAM,gBAAgB,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;QAC5C,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QAErD,8CAA8C;QAC9C,MAAM,aAAa,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;QAExC,0EAA0E;QAC1E,MAAM,kBAAkB,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;QAE7C,4CAA4C;QAC5C,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;QACrC,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAE7C,uCAAuC;QACvC,IAAI,MAAM,CAAC,QAAQ,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,CAAC;QAED,OAAO,IAAI,0BAA0B,CAAC;YACpC,OAAO;YACP,KAAK;YACL,SAAS;YACT,UAAU;YACV,aAAa;YACb,kBAAkB;YAClB,SAAS;SACV,CAAC,CAAC;IACL,CAAC;CACF"}
|
package/package.json
CHANGED
|
@@ -1,5 +1,6 @@
|
|
|
1
1
|
import { describe, it, expect } from "vitest";
|
|
2
2
|
import { SigstoreVerifier } from "./sigstore.js";
|
|
3
|
+
import { X509Certificate } from "./x509/cert.js";
|
|
3
4
|
|
|
4
5
|
describe("Sigstore Browser Integration Tests", () => {
|
|
5
6
|
it("should initialize SigstoreVerifier in browser", () => {
|
|
@@ -149,6 +150,42 @@ describe("Sigstore Browser Integration Tests", () => {
|
|
|
149
150
|
expect(valid).toBe(true);
|
|
150
151
|
});
|
|
151
152
|
|
|
153
|
+
it("should verify RSA-PSS signed X.509 certificate", async () => {
|
|
154
|
+
// Self-signed certificate with standard RSA key but RSA-PSS signature (SHA-256, salt=32)
|
|
155
|
+
// WebCrypto requires rsaEncryption OID for the public key, not id-RSASSA-PSS
|
|
156
|
+
const rsaPssCertPem = `-----BEGIN CERTIFICATE-----
|
|
157
|
+
MIIDhTCCAjmgAwIBAgIUYzfguLRx71Cbn2Ty7xCt3GH+N6AwQQYJKoZIhvcNAQEK
|
|
158
|
+
MDSgDzANBglghkgBZQMEAgEFAKEcMBoGCSqGSIb3DQEBCDANBglghkgBZQMEAgEF
|
|
159
|
+
AKIDAgEgMB4xHDAaBgNVBAMME1Rlc3QgUlNBLVBTUyBTaWduZWQwHhcNMjUxMTMw
|
|
160
|
+
MDMwMDU2WhcNMjYxMTMwMDMwMDU2WjAeMRwwGgYDVQQDDBNUZXN0IFJTQS1QU1Mg
|
|
161
|
+
U2lnbmVkMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA29B/88QFBILg
|
|
162
|
+
YCWp1pF3xBj7FVhBUCv6JwyZAouYWUxgGmpFg6RLgbaWk59oDtEFQ5xRGSDXLuMW
|
|
163
|
+
GL5wZVCjSnmYcBsBDROO+HfLKwDRcHw09bJY979PDHPy5EPZale/JsdxE+fepUw1
|
|
164
|
+
XQDvlK5Dyp6WKl9UBjTtl6+LHKV/KTo+SiaQP2vsbZvTIt3s8MHybV/ixYXlSPQt
|
|
165
|
+
Kju50REAaqSSYqxNzsq8Z2sjJbFBcatt5C1JhfoSyIHz5D0slriv8835DYhk0u4n
|
|
166
|
+
bvNzXhWeF7htHTiPWCYwaTr5cgjyhEWg3SNP+Tu9dxCYVXm7/jWTHRdPqUPQqFsq
|
|
167
|
+
wXqsrzSP+wIDAQABo1MwUTAdBgNVHQ4EFgQU+UcBxKusOtY4lSjqyFuxQfN5zdIw
|
|
168
|
+
HwYDVR0jBBgwFoAU+UcBxKusOtY4lSjqyFuxQfN5zdIwDwYDVR0TAQH/BAUwAwEB
|
|
169
|
+
/zBBBgkqhkiG9w0BAQowNKAPMA0GCWCGSAFlAwQCAQUAoRwwGgYJKoZIhvcNAQEI
|
|
170
|
+
MA0GCWCGSAFlAwQCAQUAogMCASADggEBAFIn3VpfydVvpI82NwfeGxWlhZhgD2dX
|
|
171
|
+
gJUhj6pcXqwnlCzpyRI4e3uNO1h9nr9UrogI0AV2IDhVdUYxz3F2/680JtxXpB1x
|
|
172
|
+
J02BSAYllvXgf9efc20lFzbPDzvMzKnwx3S3proewbJ4uVPHzvKubWsx8MwEuI0X
|
|
173
|
+
8xkI1qMIXgevTCt+LGhp+0C/u8WsW3or5ZI7GnZNowPJEAtZnfO+VORB7FvbzEGr
|
|
174
|
+
ewS+2T7Qz4oXaQMidPOjr1Q8WKqaKO4yCtC8cz4qVWi3lNqAcAGtonQMXUiflEWV
|
|
175
|
+
9kqKQx+LJYJqxKkBtDRnRLnVNn4+inotrgnV126LsCe3uLaGwJIFy1U=
|
|
176
|
+
-----END CERTIFICATE-----`;
|
|
177
|
+
|
|
178
|
+
const cert = X509Certificate.parse(rsaPssCertPem);
|
|
179
|
+
|
|
180
|
+
// Verify it's an RSA-PSS certificate
|
|
181
|
+
expect(cert.signatureAlgorithmOid).toBe("1.2.840.113549.1.1.10");
|
|
182
|
+
expect(cert.signatureAlgorithm).toBe("sha256");
|
|
183
|
+
|
|
184
|
+
// Verify the self-signed certificate (signature verification)
|
|
185
|
+
const valid = await cert.verify();
|
|
186
|
+
expect(valid).toBe(true);
|
|
187
|
+
});
|
|
188
|
+
|
|
152
189
|
it("should support TextEncoder/TextDecoder for UTF-8", () => {
|
|
153
190
|
const encoder = new TextEncoder();
|
|
154
191
|
const decoder = new TextDecoder();
|
package/src/interfaces.ts
CHANGED
|
@@ -101,3 +101,23 @@ export type RawCAs = RawCA[];
|
|
|
101
101
|
|
|
102
102
|
// Re-export crypto enums from crypto-browser (shared with tuf-browser)
|
|
103
103
|
export { KeyTypes, EcdsaTypes, HashAlgorithms } from "@freedomofpress/crypto-browser";
|
|
104
|
+
import { HashAlgorithms } from "@freedomofpress/crypto-browser";
|
|
105
|
+
|
|
106
|
+
// Supported hash algorithms for payload hash validation
|
|
107
|
+
// Rekor v1 uses lowercase (sha256), Rekor v2 uses uppercase with underscore (SHA2_256)
|
|
108
|
+
const SUPPORTED_HASH_ALGORITHMS: Record<string, string> = {
|
|
109
|
+
"sha256": HashAlgorithms.SHA256,
|
|
110
|
+
"sha384": HashAlgorithms.SHA384,
|
|
111
|
+
"sha512": HashAlgorithms.SHA512,
|
|
112
|
+
"SHA2_256": HashAlgorithms.SHA256,
|
|
113
|
+
"SHA2_384": HashAlgorithms.SHA384,
|
|
114
|
+
"SHA2_512": HashAlgorithms.SHA512,
|
|
115
|
+
};
|
|
116
|
+
|
|
117
|
+
export function getHashAlgorithm(algorithm: string): string {
|
|
118
|
+
const hashAlg = SUPPORTED_HASH_ALGORITHMS[algorithm];
|
|
119
|
+
if (!hashAlg) {
|
|
120
|
+
throw new Error(`Unsupported hash algorithm: ${algorithm}`);
|
|
121
|
+
}
|
|
122
|
+
return hashAlg;
|
|
123
|
+
}
|
package/src/oid.ts
CHANGED
|
@@ -7,7 +7,7 @@ export const ECDSA_SIGNATURE_ALGOS: Record<string, string> = {
|
|
|
7
7
|
"1.2.840.10045.4.3.4": "sha512",
|
|
8
8
|
};
|
|
9
9
|
|
|
10
|
-
// RSA signature algorithms
|
|
10
|
+
// RSA signature algorithms (PKCS#1 v1.5)
|
|
11
11
|
export const RSA_SIGNATURE_ALGOS: Record<string, string> = {
|
|
12
12
|
"1.2.840.113549.1.1.11": "sha256", // sha256WithRSAEncryption
|
|
13
13
|
"1.2.840.113549.1.1.12": "sha384", // sha384WithRSAEncryption
|
|
@@ -15,12 +15,18 @@ export const RSA_SIGNATURE_ALGOS: Record<string, string> = {
|
|
|
15
15
|
"1.2.840.113549.1.1.5": "sha1", // sha1WithRSAEncryption
|
|
16
16
|
};
|
|
17
17
|
|
|
18
|
+
// RSASSA-PSS OID - hash algorithm must be parsed from signature algorithm parameters
|
|
19
|
+
export const OID_RSASSA_PSS = "1.2.840.113549.1.1.10";
|
|
20
|
+
|
|
18
21
|
export const SHA2_HASH_ALGOS: Record<string, string> = {
|
|
19
22
|
"2.16.840.1.101.3.4.2.1": "sha256",
|
|
20
23
|
"2.16.840.1.101.3.4.2.2": "sha384",
|
|
21
24
|
"2.16.840.1.101.3.4.2.3": "sha512",
|
|
22
25
|
};
|
|
23
26
|
|
|
27
|
+
// Default hash algorithm used when not specified
|
|
28
|
+
export const DEFAULT_HASH_ALGORITHM = "sha256";
|
|
29
|
+
|
|
24
30
|
export const ECDSA_CURVE_NAMES: Record<string, string> = {
|
|
25
31
|
"1.2.840.10045.3.1.7": "secp256r1",
|
|
26
32
|
"1.3.132.0.34": "secp384r1",
|