@freedomofpress/sigstore-browser 0.1.5 → 0.1.6

package/dist/index.d.ts

@@ -5,7 +5,9 @@ export type { TrustedRoot, Sigstore, RawTimestampAuthority } from "./interfaces.
 export { VerificationError, TimestampError, CertificateError, TLogError, SignatureError, PolicyError, } from "./errors.js";
 export { verifyRFC3161Timestamp, verifyBundleTimestamp } from "./timestamp/tsa.js";
 export { TrustedRootProvider, type TrustedRootProviderOptions } from "./trust/tuf.js";
-export { X509Certificate, EXTENSION_OID_SCT } from "./x509/cert.js";
-export { X509Extension } from "./x509/ext.js";
+export { X509Certificate, EXTENSION_OID_SCT, EXTENSION_OID_FULCIO_ISSUER_V1, EXTENSION_OID_GITHUB_WORKFLOW_TRIGGER, EXTENSION_OID_GITHUB_WORKFLOW_SHA, EXTENSION_OID_GITHUB_WORKFLOW_NAME, EXTENSION_OID_GITHUB_WORKFLOW_REPOSITORY, EXTENSION_OID_GITHUB_WORKFLOW_REF, EXTENSION_OID_OTHERNAME, EXTENSION_OID_FULCIO_ISSUER_V2, EXTENSION_OID_BUILD_SIGNER_URI, EXTENSION_OID_BUILD_SIGNER_DIGEST, EXTENSION_OID_RUNNER_ENVIRONMENT, EXTENSION_OID_SOURCE_REPOSITORY_URI, EXTENSION_OID_SOURCE_REPOSITORY_DIGEST, EXTENSION_OID_SOURCE_REPOSITORY_REF, EXTENSION_OID_SOURCE_REPOSITORY_IDENTIFIER, EXTENSION_OID_SOURCE_REPOSITORY_OWNER_URI, EXTENSION_OID_SOURCE_REPOSITORY_OWNER_IDENTIFIER, EXTENSION_OID_BUILD_CONFIG_URI, EXTENSION_OID_BUILD_CONFIG_DIGEST, EXTENSION_OID_BUILD_TRIGGER, EXTENSION_OID_RUN_INVOCATION_URI, EXTENSION_OID_SOURCE_REPOSITORY_VISIBILITY, } from "./x509/cert.js";
+export { X509Extension, X509FulcioIssuerV1, X509FulcioIssuerV2, X509GitHubWorkflowTriggerExtension, X509GitHubWorkflowSHAExtension, X509GitHubWorkflowNameExtension, X509GitHubWorkflowRepositoryExtension, X509GitHubWorkflowRefExtension, X509BuildSignerURIExtension, X509BuildSignerDigestExtension, X509RunnerEnvironmentExtension, X509SourceRepositoryURIExtension, X509SourceRepositoryDigestExtension, X509SourceRepositoryRefExtension, X509SourceRepositoryIdentifierExtension, X509SourceRepositoryOwnerURIExtension, X509SourceRepositoryOwnerIdentifierExtension, X509BuildConfigURIExtension, X509BuildConfigDigestExtension, X509BuildTriggerExtension, X509RunInvocationURIExtension, X509SourceRepositoryVisibilityExtension, } from "./x509/ext.js";
 export { CertificateChainVerifier } from "./x509/chain.js";
+export { GITHUB_OIDC_ISSUER, OIDCIssuer, OIDCIssuerV2, GitHubWorkflowTrigger, GitHubWorkflowSHA, GitHubWorkflowName, GitHubWorkflowRepository, GitHubWorkflowRef, OIDCBuildSignerURI, OIDCBuildSignerDigest, OIDCRunnerEnvironment, OIDCSourceRepositoryURI, OIDCSourceRepositoryDigest, OIDCSourceRepositoryRef, OIDCSourceRepositoryIdentifier, OIDCSourceRepositoryOwnerURI, OIDCSourceRepositoryOwnerIdentifier, OIDCBuildConfigURI, OIDCBuildConfigDigest, OIDCBuildTrigger, OIDCRunInvocationURI, OIDCSourceRepositoryVisibility, AllOf, AnyOf, Identity, } from "./policy.js";
+export type { VerificationPolicy } from "./policy.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,YAAY,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AAC7D,YAAY,EAAE,cAAc,EAAE,SAAS,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,yBAAyB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAClJ,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AACpF,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,SAAS,EACT,cAAc,EACd,WAAW,GACZ,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AACnF,OAAO,EAAE,mBAAmB,EAAE,KAAK,0BAA0B,EAAE,MAAM,gBAAgB,CAAC;AACtF,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACpE,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,YAAY,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AAC7D,YAAY,EAAE,cAAc,EAAE,SAAS,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,yBAAyB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAClJ,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AACpF,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,SAAS,EACT,cAAc,EACd,WAAW,GACZ,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AACnF,OAAO,EAAE,mBAAmB,EAAE,KAAK,0BAA0B,EAAE,MAAM,gBAAgB,CAAC;AACtF,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,8BAA8B,EAC9B,qCAAqC,EACrC,iCAAiC,EACjC,kCAAkC,EAClC,wCAAwC,EACxC,iCAAiC,EACjC,uBAAuB,EACvB,8BAA8B,EAC9B,8BAA8B,EAC9B,iCAAiC,EACjC,gCAAgC,EAChC,mCAAmC,EACnC,sCAAsC,EACtC,mCAAmC,EACnC,0CAA0C,EAC1C,yCAAyC,EACzC,gDAAgD,EAChD,8BAA8B,EAC9B,iCAAiC,EACjC,2BAA2B,EAC3B,gCAAgC,EAChC,0CAA0C,GAC3C,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,kCAAkC,EAClC,8BAA8B,EAC9B,+BAA+B,EAC/B,qCAAqC,EACrC,8BAA8B,EAC9B,2BAA2B,EAC3B,8BAA8B,EAC9B,8BAA8B,EAC9B,gCAAgC,EAChC,mCAAmC,EACnC,gCAAgC,EAChC,uCAAuC,EACvC,qCAAqC,EACrC,4CAA4C,EAC5C,2BAA2B,EAC3B,8BAA8B,EAC9B,yBAAyB,EACzB,6BAA6B,EAC7B,uCAAuC,GACxC,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAC3D,OAAO,EACL,kBAAkB,EAClB,UAAU,EACV,YAAY,EACZ,qBAAqB,EACrB,iBAAiB,EACjB,kBAAkB,EAClB,wBAAwB,EACxB,iBAAiB,EACjB,kBAAkB,EAClB,qBAAqB,EACrB,qBAAqB,EACrB,uBAAuB,EACvB,0BAA0B,EAC1B,uBAAuB,EACvB,8BAA8B,EAC9B,4BAA4B,EAC5B,mCAAmC,EACnC,kBAAkB,EAClB,qBAAqB,EACrB,gBAAgB,EAChB,oBAAoB,EACpB,8BAA8B,EAC9B,KAAK,EACL,KAAK,EACL,QAAQ,GACT,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC"}

package/dist/index.js

@@ -2,7 +2,8 @@ export { SigstoreVerifier } from "./sigstore.js";
 export { VerificationError, TimestampError, CertificateError, TLogError, SignatureError, PolicyError, } from "./errors.js";
 export { verifyRFC3161Timestamp, verifyBundleTimestamp } from "./timestamp/tsa.js";
 export { TrustedRootProvider } from "./trust/tuf.js";
-export { X509Certificate, EXTENSION_OID_SCT } from "./x509/cert.js";
-export { X509Extension } from "./x509/ext.js";
+export { X509Certificate, EXTENSION_OID_SCT, EXTENSION_OID_FULCIO_ISSUER_V1, EXTENSION_OID_GITHUB_WORKFLOW_TRIGGER, EXTENSION_OID_GITHUB_WORKFLOW_SHA, EXTENSION_OID_GITHUB_WORKFLOW_NAME, EXTENSION_OID_GITHUB_WORKFLOW_REPOSITORY, EXTENSION_OID_GITHUB_WORKFLOW_REF, EXTENSION_OID_OTHERNAME, EXTENSION_OID_FULCIO_ISSUER_V2, EXTENSION_OID_BUILD_SIGNER_URI, EXTENSION_OID_BUILD_SIGNER_DIGEST, EXTENSION_OID_RUNNER_ENVIRONMENT, EXTENSION_OID_SOURCE_REPOSITORY_URI, EXTENSION_OID_SOURCE_REPOSITORY_DIGEST, EXTENSION_OID_SOURCE_REPOSITORY_REF, EXTENSION_OID_SOURCE_REPOSITORY_IDENTIFIER, EXTENSION_OID_SOURCE_REPOSITORY_OWNER_URI, EXTENSION_OID_SOURCE_REPOSITORY_OWNER_IDENTIFIER, EXTENSION_OID_BUILD_CONFIG_URI, EXTENSION_OID_BUILD_CONFIG_DIGEST, EXTENSION_OID_BUILD_TRIGGER, EXTENSION_OID_RUN_INVOCATION_URI, EXTENSION_OID_SOURCE_REPOSITORY_VISIBILITY, } from "./x509/cert.js";
+export { X509Extension, X509FulcioIssuerV1, X509FulcioIssuerV2, X509GitHubWorkflowTriggerExtension, X509GitHubWorkflowSHAExtension, X509GitHubWorkflowNameExtension, X509GitHubWorkflowRepositoryExtension, X509GitHubWorkflowRefExtension, X509BuildSignerURIExtension, X509BuildSignerDigestExtension, X509RunnerEnvironmentExtension, X509SourceRepositoryURIExtension, X509SourceRepositoryDigestExtension, X509SourceRepositoryRefExtension, X509SourceRepositoryIdentifierExtension, X509SourceRepositoryOwnerURIExtension, X509SourceRepositoryOwnerIdentifierExtension, X509BuildConfigURIExtension, X509BuildConfigDigestExtension, X509BuildTriggerExtension, X509RunInvocationURIExtension, X509SourceRepositoryVisibilityExtension, } from "./x509/ext.js";
 export { CertificateChainVerifier } from "./x509/chain.js";
+export { GITHUB_OIDC_ISSUER, OIDCIssuer, OIDCIssuerV2, GitHubWorkflowTrigger, GitHubWorkflowSHA, GitHubWorkflowName, GitHubWorkflowRepository, GitHubWorkflowRef, OIDCBuildSignerURI, OIDCBuildSignerDigest, OIDCRunnerEnvironment, OIDCSourceRepositoryURI, OIDCSourceRepositoryDigest, OIDCSourceRepositoryRef, OIDCSourceRepositoryIdentifier, OIDCSourceRepositoryOwnerURI, OIDCSourceRepositoryOwnerIdentifier, OIDCBuildConfigURI, OIDCBuildConfigDigest, OIDCBuildTrigger, OIDCRunInvocationURI, OIDCSourceRepositoryVisibility, AllOf, AnyOf, Identity, } from "./policy.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAIjD,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,SAAS,EACT,cAAc,EACd,WAAW,GACZ,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AACnF,OAAO,EAAE,mBAAmB,EAAmC,MAAM,gBAAgB,CAAC;AACtF,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACpE,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAIjD,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,SAAS,EACT,cAAc,EACd,WAAW,GACZ,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AACnF,OAAO,EAAE,mBAAmB,EAAmC,MAAM,gBAAgB,CAAC;AACtF,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,8BAA8B,EAC9B,qCAAqC,EACrC,iCAAiC,EACjC,kCAAkC,EAClC,wCAAwC,EACxC,iCAAiC,EACjC,uBAAuB,EACvB,8BAA8B,EAC9B,8BAA8B,EAC9B,iCAAiC,EACjC,gCAAgC,EAChC,mCAAmC,EACnC,sCAAsC,EACtC,mCAAmC,EACnC,0CAA0C,EAC1C,yCAAyC,EACzC,gDAAgD,EAChD,8BAA8B,EAC9B,iCAAiC,EACjC,2BAA2B,EAC3B,gCAAgC,EAChC,0CAA0C,GAC3C,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,kCAAkC,EAClC,8BAA8B,EAC9B,+BAA+B,EAC/B,qCAAqC,EACrC,8BAA8B,EAC9B,2BAA2B,EAC3B,8BAA8B,EAC9B,8BAA8B,EAC9B,gCAAgC,EAChC,mCAAmC,EACnC,gCAAgC,EAChC,uCAAuC,EACvC,qCAAqC,EACrC,4CAA4C,EAC5C,2BAA2B,EAC3B,8BAA8B,EAC9B,yBAAyB,EACzB,6BAA6B,EAC7B,uCAAuC,GACxC,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAC3D,OAAO,EACL,kBAAkB,EAClB,UAAU,EACV,YAAY,EACZ,qBAAqB,EACrB,iBAAiB,EACjB,kBAAkB,EAClB,wBAAwB,EACxB,iBAAiB,EACjB,kBAAkB,EAClB,qBAAqB,EACrB,qBAAqB,EACrB,uBAAuB,EACvB,0BAA0B,EAC1B,uBAAuB,EACvB,8BAA8B,EAC9B,4BAA4B,EAC5B,mCAAmC,EACnC,kBAAkB,EAClB,qBAAqB,EACrB,gBAAgB,EAChB,oBAAoB,EACpB,8BAA8B,EAC9B,KAAK,EACL,KAAK,EACL,QAAQ,GACT,MAAM,aAAa,CAAC"}

package/dist/policy.d.ts

@@ -0,0 +1,266 @@
+/**
+ * Adapted from sigstore-python sigstore/verify/policy.py
+ *
+ * This module provides policy verification for checking certificate identity claims.
+ * Each policy class verifies a specific X.509 extension value against an expected value.
+ *
+ * There are two types of extension formats:
+ * - V1 extensions: Raw OCTET STRING containing the value directly
+ * - V2 extensions: DER-encoded UTF8String (RFC 5280 compliant)
+ *
+ * Policies can be combined using:
+ * - AllOf: All child policies must pass (logical AND)
+ * - AnyOf: At least one child policy must pass (logical OR)
+ * - Identity: Verifies SAN with optional issuer check
+ */
+import { X509Certificate } from "./x509/cert.js";
+export declare const GITHUB_OIDC_ISSUER = "https://token.actions.githubusercontent.com";
+/**
+ * Interface that all verification policies conform to.
+ */
+export interface VerificationPolicy {
+    verify(cert: X509Certificate): void;
+}
+/**
+ * Base class for V1 extension policies (raw OCTET STRING value).
+ */
+declare abstract class SingleX509ExtPolicyV1 implements VerificationPolicy {
+    abstract readonly oid: string;
+    abstract readonly name: string;
+    protected readonly expectedValue: string;
+    constructor(value: string);
+    protected abstract getExtensionValue(cert: X509Certificate): string | undefined;
+    verify(cert: X509Certificate): void;
+}
+/**
+ * Base class for V2 extension policies (DER-encoded UTF8String).
+ * Uses the same verify logic as V1 since our extension classes handle the parsing.
+ */
+declare abstract class SingleX509ExtPolicyV2 extends SingleX509ExtPolicyV1 {
+}
+/**
+ * Verifies the certificate's OIDC issuer (V1 format).
+ * OID: 1.3.6.1.4.1.57264.1.1
+ */
+export declare class OIDCIssuer extends SingleX509ExtPolicyV1 {
+    readonly oid = "1.3.6.1.4.1.57264.1.1";
+    readonly name = "OIDCIssuer";
+    protected getExtensionValue(cert: X509Certificate): string | undefined;
+}
+/**
+ * Verifies the certificate's GitHub Actions workflow trigger.
+ * OID: 1.3.6.1.4.1.57264.1.2
+ */
+export declare class GitHubWorkflowTrigger extends SingleX509ExtPolicyV1 {
+    readonly oid = "1.3.6.1.4.1.57264.1.2";
+    readonly name = "GitHubWorkflowTrigger";
+    protected getExtensionValue(cert: X509Certificate): string | undefined;
+}
+/**
+ * Verifies the certificate's GitHub Actions workflow commit SHA.
+ * OID: 1.3.6.1.4.1.57264.1.3
+ */
+export declare class GitHubWorkflowSHA extends SingleX509ExtPolicyV1 {
+    readonly oid = "1.3.6.1.4.1.57264.1.3";
+    readonly name = "GitHubWorkflowSHA";
+    protected getExtensionValue(cert: X509Certificate): string | undefined;
+}
+/**
+ * Verifies the certificate's GitHub Actions workflow name.
+ * OID: 1.3.6.1.4.1.57264.1.4
+ */
+export declare class GitHubWorkflowName extends SingleX509ExtPolicyV1 {
+    readonly oid = "1.3.6.1.4.1.57264.1.4";
+    readonly name = "GitHubWorkflowName";
+    protected getExtensionValue(cert: X509Certificate): string | undefined;
+}
+/**
+ * Verifies the certificate's GitHub Actions workflow repository.
+ * OID: 1.3.6.1.4.1.57264.1.5
+ */
+export declare class GitHubWorkflowRepository extends SingleX509ExtPolicyV1 {
+    readonly oid = "1.3.6.1.4.1.57264.1.5";
+    readonly name = "GitHubWorkflowRepository";
+    protected getExtensionValue(cert: X509Certificate): string | undefined;
+}
+/**
+ * Verifies the certificate's GitHub Actions workflow ref.
+ * OID: 1.3.6.1.4.1.57264.1.6
+ */
+export declare class GitHubWorkflowRef extends SingleX509ExtPolicyV1 {
+    readonly oid = "1.3.6.1.4.1.57264.1.6";
+    readonly name = "GitHubWorkflowRef";
+    protected getExtensionValue(cert: X509Certificate): string | undefined;
+}
+/**
+ * Verifies the certificate's OIDC issuer (V2 format, DER-encoded).
+ * OID: 1.3.6.1.4.1.57264.1.8
+ */
+export declare class OIDCIssuerV2 extends SingleX509ExtPolicyV2 {
+    readonly oid = "1.3.6.1.4.1.57264.1.8";
+    readonly name = "OIDCIssuerV2";
+    protected getExtensionValue(cert: X509Certificate): string | undefined;
+}
+/**
+ * Verifies the certificate's Build Signer URI.
+ * OID: 1.3.6.1.4.1.57264.1.9
+ */
+export declare class OIDCBuildSignerURI extends SingleX509ExtPolicyV2 {
+    readonly oid = "1.3.6.1.4.1.57264.1.9";
+    readonly name = "OIDCBuildSignerURI";
+    protected getExtensionValue(cert: X509Certificate): string | undefined;
+}
+/**
+ * Verifies the certificate's Build Signer Digest.
+ * OID: 1.3.6.1.4.1.57264.1.10
+ */
+export declare class OIDCBuildSignerDigest extends SingleX509ExtPolicyV2 {
+    readonly oid = "1.3.6.1.4.1.57264.1.10";
+    readonly name = "OIDCBuildSignerDigest";
+    protected getExtensionValue(cert: X509Certificate): string | undefined;
+}
+/**
+ * Verifies the certificate's Runner Environment.
+ * OID: 1.3.6.1.4.1.57264.1.11
+ */
+export declare class OIDCRunnerEnvironment extends SingleX509ExtPolicyV2 {
+    readonly oid = "1.3.6.1.4.1.57264.1.11";
+    readonly name = "OIDCRunnerEnvironment";
+    protected getExtensionValue(cert: X509Certificate): string | undefined;
+}
+/**
+ * Verifies the certificate's Source Repository URI.
+ * OID: 1.3.6.1.4.1.57264.1.12
+ */
+export declare class OIDCSourceRepositoryURI extends SingleX509ExtPolicyV2 {
+    readonly oid = "1.3.6.1.4.1.57264.1.12";
+    readonly name = "OIDCSourceRepositoryURI";
+    protected getExtensionValue(cert: X509Certificate): string | undefined;
+}
+/**
+ * Verifies the certificate's Source Repository Digest.
+ * OID: 1.3.6.1.4.1.57264.1.13
+ */
+export declare class OIDCSourceRepositoryDigest extends SingleX509ExtPolicyV2 {
+    readonly oid = "1.3.6.1.4.1.57264.1.13";
+    readonly name = "OIDCSourceRepositoryDigest";
+    protected getExtensionValue(cert: X509Certificate): string | undefined;
+}
+/**
+ * Verifies the certificate's Source Repository Ref.
+ * OID: 1.3.6.1.4.1.57264.1.14
+ */
+export declare class OIDCSourceRepositoryRef extends SingleX509ExtPolicyV2 {
+    readonly oid = "1.3.6.1.4.1.57264.1.14";
+    readonly name = "OIDCSourceRepositoryRef";
+    protected getExtensionValue(cert: X509Certificate): string | undefined;
+}
+/**
+ * Verifies the certificate's Source Repository Identifier.
+ * OID: 1.3.6.1.4.1.57264.1.15
+ */
+export declare class OIDCSourceRepositoryIdentifier extends SingleX509ExtPolicyV2 {
+    readonly oid = "1.3.6.1.4.1.57264.1.15";
+    readonly name = "OIDCSourceRepositoryIdentifier";
+    protected getExtensionValue(cert: X509Certificate): string | undefined;
+}
+/**
+ * Verifies the certificate's Source Repository Owner URI.
+ * OID: 1.3.6.1.4.1.57264.1.16
+ */
+export declare class OIDCSourceRepositoryOwnerURI extends SingleX509ExtPolicyV2 {
+    readonly oid = "1.3.6.1.4.1.57264.1.16";
+    readonly name = "OIDCSourceRepositoryOwnerURI";
+    protected getExtensionValue(cert: X509Certificate): string | undefined;
+}
+/**
+ * Verifies the certificate's Source Repository Owner Identifier.
+ * OID: 1.3.6.1.4.1.57264.1.17
+ */
+export declare class OIDCSourceRepositoryOwnerIdentifier extends SingleX509ExtPolicyV2 {
+    readonly oid = "1.3.6.1.4.1.57264.1.17";
+    readonly name = "OIDCSourceRepositoryOwnerIdentifier";
+    protected getExtensionValue(cert: X509Certificate): string | undefined;
+}
+/**
+ * Verifies the certificate's Build Config URI.
+ * OID: 1.3.6.1.4.1.57264.1.18
+ */
+export declare class OIDCBuildConfigURI extends SingleX509ExtPolicyV2 {
+    readonly oid = "1.3.6.1.4.1.57264.1.18";
+    readonly name = "OIDCBuildConfigURI";
+    protected getExtensionValue(cert: X509Certificate): string | undefined;
+}
+/**
+ * Verifies the certificate's Build Config Digest.
+ * OID: 1.3.6.1.4.1.57264.1.19
+ */
+export declare class OIDCBuildConfigDigest extends SingleX509ExtPolicyV2 {
+    readonly oid = "1.3.6.1.4.1.57264.1.19";
+    readonly name = "OIDCBuildConfigDigest";
+    protected getExtensionValue(cert: X509Certificate): string | undefined;
+}
+/**
+ * Verifies the certificate's Build Trigger.
+ * OID: 1.3.6.1.4.1.57264.1.20
+ */
+export declare class OIDCBuildTrigger extends SingleX509ExtPolicyV2 {
+    readonly oid = "1.3.6.1.4.1.57264.1.20";
+    readonly name = "OIDCBuildTrigger";
+    protected getExtensionValue(cert: X509Certificate): string | undefined;
+}
+/**
+ * Verifies the certificate's Run Invocation URI.
+ * OID: 1.3.6.1.4.1.57264.1.21
+ */
+export declare class OIDCRunInvocationURI extends SingleX509ExtPolicyV2 {
+    readonly oid = "1.3.6.1.4.1.57264.1.21";
+    readonly name = "OIDCRunInvocationURI";
+    protected getExtensionValue(cert: X509Certificate): string | undefined;
+}
+/**
+ * Verifies the certificate's Source Repository Visibility at signing.
+ * OID: 1.3.6.1.4.1.57264.1.22
+ */
+export declare class OIDCSourceRepositoryVisibility extends SingleX509ExtPolicyV2 {
+    readonly oid = "1.3.6.1.4.1.57264.1.22";
+    readonly name = "OIDCSourceRepositoryVisibility";
+    protected getExtensionValue(cert: X509Certificate): string | undefined;
+}
+/**
+ * The "any of" policy, corresponding to a logical OR between child policies.
+ * An empty list of child policies is considered trivially invalid.
+ */
+export declare class AnyOf implements VerificationPolicy {
+    private children;
+    constructor(children: VerificationPolicy[]);
+    verify(cert: X509Certificate): void;
+}
+/**
+ * The "all of" policy, corresponding to a logical AND between child policies.
+ * An empty list of child policies is considered trivially invalid.
+ */
+export declare class AllOf implements VerificationPolicy {
+    private children;
+    constructor(children: VerificationPolicy[]);
+    verify(cert: X509Certificate): void;
+}
+/**
+ * Verifies the certificate's "identity", corresponding to the X.509v3 SAN.
+ *
+ * Identities can be verified modulo an OIDC issuer, to prevent an unexpected
+ * issuer from offering a particular identity.
+ *
+ * Supported SAN types include emails, URIs, and Sigstore-specific "other names".
+ */
+export declare class Identity implements VerificationPolicy {
+    private identity;
+    private issuerPolicy;
+    constructor(options: {
+        identity: string;
+        issuer?: string;
+    });
+    verify(cert: X509Certificate): void;
+}
+export {};
+//# sourceMappingURL=policy.d.ts.map

package/dist/policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,EACL,eAAe,EAuBhB,MAAM,gBAAgB,CAAC;AAIxB,eAAO,MAAM,kBAAkB,gDAAgD,CAAC;AAEhF;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,MAAM,CAAC,IAAI,EAAE,eAAe,GAAG,IAAI,CAAC;CACrC;AAED;;GAEG;AACH,uBAAe,qBAAsB,YAAW,kBAAkB;IAChE,QAAQ,CAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAC/B,SAAS,CAAC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;gBAE7B,KAAK,EAAE,MAAM;IAIzB,SAAS,CAAC,QAAQ,CAAC,iBAAiB,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS;IAE/E,MAAM,CAAC,IAAI,EAAE,eAAe,GAAG,IAAI;CAcpC;AAED;;;GAGG;AACH,uBAAe,qBAAsB,SAAQ,qBAAqB;CAAG;AAMrE;;;GAGG;AACH,qBAAa,UAAW,SAAQ,qBAAqB;IACnD,QAAQ,CAAC,GAAG,2BAAkC;IAC9C,QAAQ,CAAC,IAAI,gBAAgB;IAE7B,SAAS,CAAC,iBAAiB,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS;CAGvE;AAED;;;GAGG;AACH,qBAAa,qBAAsB,SAAQ,qBAAqB;IAC9D,QAAQ,CAAC,GAAG,2BAAyC;IACrD,QAAQ,CAAC,IAAI,2BAA2B;IAExC,SAAS,CAAC,iBAAiB,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS;CAGvE;AAED;;;GAGG;AACH,qBAAa,iBAAkB,SAAQ,qBAAqB;IAC1D,QAAQ,CAAC,GAAG,2BAAqC;IACjD,QAAQ,CAAC,IAAI,uBAAuB;IAEpC,SAAS,CAAC,iBAAiB,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS;CAGvE;AAED;;;GAGG;AACH,qBAAa,kBAAmB,SAAQ,qBAAqB;IAC3D,QAAQ,CAAC,GAAG,2BAAsC;IAClD,QAAQ,CAAC,IAAI,wBAAwB;IAErC,SAAS,CAAC,iBAAiB,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS;CAGvE;AAED;;;GAGG;AACH,qBAAa,wBAAyB,SAAQ,qBAAqB;IACjE,QAAQ,CAAC,GAAG,2BAA4C;IACxD,QAAQ,CAAC,IAAI,8BAA8B;IAE3C,SAAS,CAAC,iBAAiB,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS;CAGvE;AAED;;;GAGG;AACH,qBAAa,iBAAkB,SAAQ,qBAAqB;IAC1D,QAAQ,CAAC,GAAG,2BAAqC;IACjD,QAAQ,CAAC,IAAI,uBAAuB;IAEpC,SAAS,CAAC,iBAAiB,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS;CAGvE;AAMD;;;GAGG;AACH,qBAAa,YAAa,SAAQ,qBAAqB;IACrD,QAAQ,CAAC,GAAG,2BAAkC;IAC9C,QAAQ,CAAC,IAAI,kBAAkB;IAE/B,SAAS,CAAC,iBAAiB,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS;CAGvE;AAED;;;GAGG;AACH,qBAAa,kBAAmB,SAAQ,qBAAqB;IAC3D,QAAQ,CAAC,GAAG,2BAAkC;IAC9C,QAAQ,CAAC,IAAI,wBAAwB;IAErC,SAAS,CAAC,iBAAiB,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS;CAGvE;AAED;;;GAGG;AACH,qBAAa,qBAAsB,SAAQ,qBAAqB;IAC9D,QAAQ,CAAC,GAAG,4BAAqC;IACjD,QAAQ,CAAC,IAAI,2BAA2B;IAExC,SAAS,CAAC,iBAAiB,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS;CAGvE;AAED;;;GAGG;AACH,qBAAa,qBAAsB,SAAQ,qBAAqB;IAC9D,QAAQ,CAAC,GAAG,4BAAoC;IAChD,QAAQ,CAAC,IAAI,2BAA2B;IAExC,SAAS,CAAC,iBAAiB,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS;CAGvE;AAED;;;GAGG;AACH,qBAAa,uBAAwB,SAAQ,qBAAqB;IAChE,QAAQ,CAAC,GAAG,4BAAuC;IACnD,QAAQ,CAAC,IAAI,6BAA6B;IAE1C,SAAS,CAAC,iBAAiB,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS;CAGvE;AAED;;;GAGG;AACH,qBAAa,0BAA2B,SAAQ,qBAAqB;IACnE,QAAQ,CAAC,GAAG,4BAA0C;IACtD,QAAQ,CAAC,IAAI,gCAAgC;IAE7C,SAAS,CAAC,iBAAiB,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS;CAGvE;AAED;;;GAGG;AACH,qBAAa,uBAAwB,SAAQ,qBAAqB;IAChE,QAAQ,CAAC,GAAG,4BAAuC;IACnD,QAAQ,CAAC,IAAI,6BAA6B;IAE1C,SAAS,CAAC,iBAAiB,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS;CAGvE;AAED;;;GAGG;AACH,qBAAa,8BAA+B,SAAQ,qBAAqB;IACvE,QAAQ,CAAC,GAAG,4BAA8C;IAC1D,QAAQ,CAAC,IAAI,oCAAoC;IAEjD,SAAS,CAAC,iBAAiB,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS;CAGvE;AAED;;;GAGG;AACH,qBAAa,4BAA6B,SAAQ,qBAAqB;IACrE,QAAQ,CAAC,GAAG,4BAA6C;IACzD,QAAQ,CAAC,IAAI,kCAAkC;IAE/C,SAAS,CAAC,iBAAiB,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS;CAGvE;AAED;;;GAGG;AACH,qBAAa,mCAAoC,SAAQ,qBAAqB;IAC5E,QAAQ,CAAC,GAAG,4BAAoD;IAChE,QAAQ,CAAC,IAAI,yCAAyC;IAEtD,SAAS,CAAC,iBAAiB,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS;CAGvE;AAED;;;GAGG;AACH,qBAAa,kBAAmB,SAAQ,qBAAqB;IAC3D,QAAQ,CAAC,GAAG,4BAAkC;IAC9C,QAAQ,CAAC,IAAI,wBAAwB;IAErC,SAAS,CAAC,iBAAiB,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS;CAGvE;AAED;;;GAGG;AACH,qBAAa,qBAAsB,SAAQ,qBAAqB;IAC9D,QAAQ,CAAC,GAAG,4BAAqC;IACjD,QAAQ,CAAC,IAAI,2BAA2B;IAExC,SAAS,CAAC,iBAAiB,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS;CAGvE;AAED;;;GAGG;AACH,qBAAa,gBAAiB,SAAQ,qBAAqB;IACzD,QAAQ,CAAC,GAAG,4BAA+B;IAC3C,QAAQ,CAAC,IAAI,sBAAsB;IAEnC,SAAS,CAAC,iBAAiB,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS;CAGvE;AAED;;;GAGG;AACH,qBAAa,oBAAqB,SAAQ,qBAAqB;IAC7D,QAAQ,CAAC,GAAG,4BAAoC;IAChD,QAAQ,CAAC,IAAI,0BAA0B;IAEvC,SAAS,CAAC,iBAAiB,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS;CAGvE;AAED;;;GAGG;AACH,qBAAa,8BAA+B,SAAQ,qBAAqB;IACvE,QAAQ,CAAC,GAAG,4BAA8C;IAC1D,QAAQ,CAAC,IAAI,oCAAoC;IAEjD,SAAS,CAAC,iBAAiB,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS;CAGvE;AAMD;;;GAGG;AACH,qBAAa,KAAM,YAAW,kBAAkB;IAC9C,OAAO,CAAC,QAAQ,CAAuB;gBAE3B,QAAQ,EAAE,kBAAkB,EAAE;IAI1C,MAAM,CAAC,IAAI,EAAE,eAAe,GAAG,IAAI;CAWpC;AAED;;;GAGG;AACH,qBAAa,KAAM,YAAW,kBAAkB;IAC9C,OAAO,CAAC,QAAQ,CAAuB;gBAE3B,QAAQ,EAAE,kBAAkB,EAAE;IAI1C,MAAM,CAAC,IAAI,EAAE,eAAe,GAAG,IAAI;CAQpC;AAMD;;;;;;;GAOG;AACH,qBAAa,QAAS,YAAW,kBAAkB;IACjD,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,YAAY,CAAoB;gBAE5B,OAAO,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;IAK1D,MAAM,CAAC,IAAI,EAAE,eAAe,GAAG,IAAI;CAkCpC"}