@freedomofpress/sigstore-browser 0.1.5 → 0.1.7

package/dist/policy.js

@@ -0,0 +1,371 @@
+/**
+ * Adapted from sigstore-python sigstore/verify/policy.py
+ *
+ * This module provides policy verification for checking certificate identity claims.
+ * Each policy class verifies a specific X.509 extension value against an expected value.
+ *
+ * There are two types of extension formats:
+ * - V1 extensions: Raw OCTET STRING containing the value directly
+ * - V2 extensions: DER-encoded UTF8String (RFC 5280 compliant)
+ *
+ * Policies can be combined using:
+ * - AllOf: All child policies must pass (logical AND)
+ * - AnyOf: At least one child policy must pass (logical OR)
+ * - Identity: Verifies SAN with optional issuer check
+ */
+import { PolicyError } from "./errors.js";
+import { EXTENSION_OID_FULCIO_ISSUER_V1, EXTENSION_OID_GITHUB_WORKFLOW_TRIGGER, EXTENSION_OID_GITHUB_WORKFLOW_SHA, EXTENSION_OID_GITHUB_WORKFLOW_NAME, EXTENSION_OID_GITHUB_WORKFLOW_REPOSITORY, EXTENSION_OID_GITHUB_WORKFLOW_REF, EXTENSION_OID_OTHERNAME, EXTENSION_OID_FULCIO_ISSUER_V2, EXTENSION_OID_BUILD_SIGNER_URI, EXTENSION_OID_BUILD_SIGNER_DIGEST, EXTENSION_OID_RUNNER_ENVIRONMENT, EXTENSION_OID_SOURCE_REPOSITORY_URI, EXTENSION_OID_SOURCE_REPOSITORY_DIGEST, EXTENSION_OID_SOURCE_REPOSITORY_REF, EXTENSION_OID_SOURCE_REPOSITORY_IDENTIFIER, EXTENSION_OID_SOURCE_REPOSITORY_OWNER_URI, EXTENSION_OID_SOURCE_REPOSITORY_OWNER_IDENTIFIER, EXTENSION_OID_BUILD_CONFIG_URI, EXTENSION_OID_BUILD_CONFIG_DIGEST, EXTENSION_OID_BUILD_TRIGGER, EXTENSION_OID_RUN_INVOCATION_URI, EXTENSION_OID_SOURCE_REPOSITORY_VISIBILITY, } from "./x509/cert.js";
+// Standard GitHub Actions OIDC issuer
+// https://docs.github.com/en/actions/security-for-github-actions/security-hardening-your-deployments/about-security-hardening-with-openid-connect
+export const GITHUB_OIDC_ISSUER = "https://token.actions.githubusercontent.com";
+/**
+ * Base class for V1 extension policies (raw OCTET STRING value).
+ */
+class SingleX509ExtPolicyV1 {
+    expectedValue;
+    constructor(value) {
+        this.expectedValue = value;
+    }
+    verify(cert) {
+        const extValue = this.getExtensionValue(cert);
+        if (extValue === undefined) {
+            throw new PolicyError(`Certificate does not contain ${this.name} (${this.oid}) extension`);
+        }
+        if (extValue !== this.expectedValue) {
+            throw new PolicyError(`Certificate's ${this.name} does not match ` +
+                `(got '${extValue}', expected '${this.expectedValue}')`);
+        }
+    }
+}
+/**
+ * Base class for V2 extension policies (DER-encoded UTF8String).
+ * Uses the same verify logic as V1 since our extension classes handle the parsing.
+ */
+class SingleX509ExtPolicyV2 extends SingleX509ExtPolicyV1 {
+}
+// ============================================================================
+// V1 Extension Policies (OID 1.3.6.1.4.1.57264.1.1 - 1.3.6.1.4.1.57264.1.6)
+// ============================================================================
+/**
+ * Verifies the certificate's OIDC issuer (V1 format).
+ * OID: 1.3.6.1.4.1.57264.1.1
+ */
+export class OIDCIssuer extends SingleX509ExtPolicyV1 {
+    oid = EXTENSION_OID_FULCIO_ISSUER_V1;
+    name = "OIDCIssuer";
+    getExtensionValue(cert) {
+        return cert.extFulcioIssuerV1?.issuer;
+    }
+}
+/**
+ * Verifies the certificate's GitHub Actions workflow trigger.
+ * OID: 1.3.6.1.4.1.57264.1.2
+ */
+export class GitHubWorkflowTrigger extends SingleX509ExtPolicyV1 {
+    oid = EXTENSION_OID_GITHUB_WORKFLOW_TRIGGER;
+    name = "GitHubWorkflowTrigger";
+    getExtensionValue(cert) {
+        return cert.extGitHubWorkflowTrigger?.workflowTrigger;
+    }
+}
+/**
+ * Verifies the certificate's GitHub Actions workflow commit SHA.
+ * OID: 1.3.6.1.4.1.57264.1.3
+ */
+export class GitHubWorkflowSHA extends SingleX509ExtPolicyV1 {
+    oid = EXTENSION_OID_GITHUB_WORKFLOW_SHA;
+    name = "GitHubWorkflowSHA";
+    getExtensionValue(cert) {
+        return cert.extGitHubWorkflowSHA?.workflowSHA;
+    }
+}
+/**
+ * Verifies the certificate's GitHub Actions workflow name.
+ * OID: 1.3.6.1.4.1.57264.1.4
+ */
+export class GitHubWorkflowName extends SingleX509ExtPolicyV1 {
+    oid = EXTENSION_OID_GITHUB_WORKFLOW_NAME;
+    name = "GitHubWorkflowName";
+    getExtensionValue(cert) {
+        return cert.extGitHubWorkflowName?.workflowName;
+    }
+}
+/**
+ * Verifies the certificate's GitHub Actions workflow repository.
+ * OID: 1.3.6.1.4.1.57264.1.5
+ */
+export class GitHubWorkflowRepository extends SingleX509ExtPolicyV1 {
+    oid = EXTENSION_OID_GITHUB_WORKFLOW_REPOSITORY;
+    name = "GitHubWorkflowRepository";
+    getExtensionValue(cert) {
+        return cert.extGitHubWorkflowRepository?.workflowRepository;
+    }
+}
+/**
+ * Verifies the certificate's GitHub Actions workflow ref.
+ * OID: 1.3.6.1.4.1.57264.1.6
+ */
+export class GitHubWorkflowRef extends SingleX509ExtPolicyV1 {
+    oid = EXTENSION_OID_GITHUB_WORKFLOW_REF;
+    name = "GitHubWorkflowRef";
+    getExtensionValue(cert) {
+        return cert.extGitHubWorkflowRef?.workflowRef;
+    }
+}
+// ============================================================================
+// V2 Extension Policies (OID 1.3.6.1.4.1.57264.1.8 - 1.3.6.1.4.1.57264.1.22)
+// ============================================================================
+/**
+ * Verifies the certificate's OIDC issuer (V2 format, DER-encoded).
+ * OID: 1.3.6.1.4.1.57264.1.8
+ */
+export class OIDCIssuerV2 extends SingleX509ExtPolicyV2 {
+    oid = EXTENSION_OID_FULCIO_ISSUER_V2;
+    name = "OIDCIssuerV2";
+    getExtensionValue(cert) {
+        return cert.extFulcioIssuerV2?.issuer;
+    }
+}
+/**
+ * Verifies the certificate's Build Signer URI.
+ * OID: 1.3.6.1.4.1.57264.1.9
+ */
+export class OIDCBuildSignerURI extends SingleX509ExtPolicyV2 {
+    oid = EXTENSION_OID_BUILD_SIGNER_URI;
+    name = "OIDCBuildSignerURI";
+    getExtensionValue(cert) {
+        return cert.extBuildSignerURI?.buildSignerURI;
+    }
+}
+/**
+ * Verifies the certificate's Build Signer Digest.
+ * OID: 1.3.6.1.4.1.57264.1.10
+ */
+export class OIDCBuildSignerDigest extends SingleX509ExtPolicyV2 {
+    oid = EXTENSION_OID_BUILD_SIGNER_DIGEST;
+    name = "OIDCBuildSignerDigest";
+    getExtensionValue(cert) {
+        return cert.extBuildSignerDigest?.buildSignerDigest;
+    }
+}
+/**
+ * Verifies the certificate's Runner Environment.
+ * OID: 1.3.6.1.4.1.57264.1.11
+ */
+export class OIDCRunnerEnvironment extends SingleX509ExtPolicyV2 {
+    oid = EXTENSION_OID_RUNNER_ENVIRONMENT;
+    name = "OIDCRunnerEnvironment";
+    getExtensionValue(cert) {
+        return cert.extRunnerEnvironment?.runnerEnvironment;
+    }
+}
+/**
+ * Verifies the certificate's Source Repository URI.
+ * OID: 1.3.6.1.4.1.57264.1.12
+ */
+export class OIDCSourceRepositoryURI extends SingleX509ExtPolicyV2 {
+    oid = EXTENSION_OID_SOURCE_REPOSITORY_URI;
+    name = "OIDCSourceRepositoryURI";
+    getExtensionValue(cert) {
+        return cert.extSourceRepositoryURI?.sourceRepositoryURI;
+    }
+}
+/**
+ * Verifies the certificate's Source Repository Digest.
+ * OID: 1.3.6.1.4.1.57264.1.13
+ */
+export class OIDCSourceRepositoryDigest extends SingleX509ExtPolicyV2 {
+    oid = EXTENSION_OID_SOURCE_REPOSITORY_DIGEST;
+    name = "OIDCSourceRepositoryDigest";
+    getExtensionValue(cert) {
+        return cert.extSourceRepositoryDigest?.sourceRepositoryDigest;
+    }
+}
+/**
+ * Verifies the certificate's Source Repository Ref.
+ * OID: 1.3.6.1.4.1.57264.1.14
+ */
+export class OIDCSourceRepositoryRef extends SingleX509ExtPolicyV2 {
+    oid = EXTENSION_OID_SOURCE_REPOSITORY_REF;
+    name = "OIDCSourceRepositoryRef";
+    getExtensionValue(cert) {
+        return cert.extSourceRepositoryRef?.sourceRepositoryRef;
+    }
+}
+/**
+ * Verifies the certificate's Source Repository Identifier.
+ * OID: 1.3.6.1.4.1.57264.1.15
+ */
+export class OIDCSourceRepositoryIdentifier extends SingleX509ExtPolicyV2 {
+    oid = EXTENSION_OID_SOURCE_REPOSITORY_IDENTIFIER;
+    name = "OIDCSourceRepositoryIdentifier";
+    getExtensionValue(cert) {
+        return cert.extSourceRepositoryIdentifier?.sourceRepositoryIdentifier;
+    }
+}
+/**
+ * Verifies the certificate's Source Repository Owner URI.
+ * OID: 1.3.6.1.4.1.57264.1.16
+ */
+export class OIDCSourceRepositoryOwnerURI extends SingleX509ExtPolicyV2 {
+    oid = EXTENSION_OID_SOURCE_REPOSITORY_OWNER_URI;
+    name = "OIDCSourceRepositoryOwnerURI";
+    getExtensionValue(cert) {
+        return cert.extSourceRepositoryOwnerURI?.sourceRepositoryOwnerURI;
+    }
+}
+/**
+ * Verifies the certificate's Source Repository Owner Identifier.
+ * OID: 1.3.6.1.4.1.57264.1.17
+ */
+export class OIDCSourceRepositoryOwnerIdentifier extends SingleX509ExtPolicyV2 {
+    oid = EXTENSION_OID_SOURCE_REPOSITORY_OWNER_IDENTIFIER;
+    name = "OIDCSourceRepositoryOwnerIdentifier";
+    getExtensionValue(cert) {
+        return cert.extSourceRepositoryOwnerIdentifier?.sourceRepositoryOwnerIdentifier;
+    }
+}
+/**
+ * Verifies the certificate's Build Config URI.
+ * OID: 1.3.6.1.4.1.57264.1.18
+ */
+export class OIDCBuildConfigURI extends SingleX509ExtPolicyV2 {
+    oid = EXTENSION_OID_BUILD_CONFIG_URI;
+    name = "OIDCBuildConfigURI";
+    getExtensionValue(cert) {
+        return cert.extBuildConfigURI?.buildConfigURI;
+    }
+}
+/**
+ * Verifies the certificate's Build Config Digest.
+ * OID: 1.3.6.1.4.1.57264.1.19
+ */
+export class OIDCBuildConfigDigest extends SingleX509ExtPolicyV2 {
+    oid = EXTENSION_OID_BUILD_CONFIG_DIGEST;
+    name = "OIDCBuildConfigDigest";
+    getExtensionValue(cert) {
+        return cert.extBuildConfigDigest?.buildConfigDigest;
+    }
+}
+/**
+ * Verifies the certificate's Build Trigger.
+ * OID: 1.3.6.1.4.1.57264.1.20
+ */
+export class OIDCBuildTrigger extends SingleX509ExtPolicyV2 {
+    oid = EXTENSION_OID_BUILD_TRIGGER;
+    name = "OIDCBuildTrigger";
+    getExtensionValue(cert) {
+        return cert.extBuildTrigger?.buildTrigger;
+    }
+}
+/**
+ * Verifies the certificate's Run Invocation URI.
+ * OID: 1.3.6.1.4.1.57264.1.21
+ */
+export class OIDCRunInvocationURI extends SingleX509ExtPolicyV2 {
+    oid = EXTENSION_OID_RUN_INVOCATION_URI;
+    name = "OIDCRunInvocationURI";
+    getExtensionValue(cert) {
+        return cert.extRunInvocationURI?.runInvocationURI;
+    }
+}
+/**
+ * Verifies the certificate's Source Repository Visibility at signing.
+ * OID: 1.3.6.1.4.1.57264.1.22
+ */
+export class OIDCSourceRepositoryVisibility extends SingleX509ExtPolicyV2 {
+    oid = EXTENSION_OID_SOURCE_REPOSITORY_VISIBILITY;
+    name = "OIDCSourceRepositoryVisibility";
+    getExtensionValue(cert) {
+        return cert.extSourceRepositoryVisibility?.sourceRepositoryVisibility;
+    }
+}
+// ============================================================================
+// Policy Combinators
+// ============================================================================
+/**
+ * The "any of" policy, corresponding to a logical OR between child policies.
+ * An empty list of child policies is considered trivially invalid.
+ */
+export class AnyOf {
+    children;
+    constructor(children) {
+        this.children = children;
+    }
+    verify(cert) {
+        for (const child of this.children) {
+            try {
+                child.verify(cert);
+                return;
+            }
+            catch {
+                // Continue to next policy
+            }
+        }
+        throw new PolicyError(`0 of ${this.children.length} policies succeeded`);
+    }
+}
+/**
+ * The "all of" policy, corresponding to a logical AND between child policies.
+ * An empty list of child policies is considered trivially invalid.
+ */
+export class AllOf {
+    children;
+    constructor(children) {
+        this.children = children;
+    }
+    verify(cert) {
+        if (this.children.length < 1) {
+            throw new PolicyError("no child policies to verify");
+        }
+        for (const child of this.children) {
+            child.verify(cert);
+        }
+    }
+}
+// ============================================================================
+// Identity Policy
+// ============================================================================
+/**
+ * Verifies the certificate's "identity", corresponding to the X.509v3 SAN.
+ *
+ * Identities can be verified modulo an OIDC issuer, to prevent an unexpected
+ * issuer from offering a particular identity.
+ *
+ * Supported SAN types include emails, URIs, and Sigstore-specific "other names".
+ */
+export class Identity {
+    identity;
+    issuerPolicy;
+    constructor(options) {
+        this.identity = options.identity;
+        this.issuerPolicy = options.issuer ? new OIDCIssuer(options.issuer) : null;
+    }
+    verify(cert) {
+        if (this.issuerPolicy) {
+            this.issuerPolicy.verify(cert);
+        }
+        const sanExt = cert.extSubjectAltName;
+        if (!sanExt) {
+            throw new PolicyError("Certificate does not contain SubjectAlternativeName extension");
+        }
+        const allSans = new Set();
+        // Add email (rfc822Name)
+        if (sanExt.rfc822Name) {
+            allSans.add(sanExt.rfc822Name);
+        }
+        // Add URI
+        if (sanExt.uri) {
+            allSans.add(sanExt.uri);
+        }
+        // Add Sigstore-specific otherName
+        const otherName = sanExt.otherName(EXTENSION_OID_OTHERNAME);
+        if (otherName) {
+            allSans.add(otherName);
+        }
+        if (!allSans.has(this.identity)) {
+            throw new PolicyError(`Certificate's SANs do not match ${this.identity}; actual SANs: ${Array.from(allSans).join(", ")}`);
+        }
+    }
+}
+//# sourceMappingURL=policy.js.map

package/dist/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAEL,8BAA8B,EAC9B,qCAAqC,EACrC,iCAAiC,EACjC,kCAAkC,EAClC,wCAAwC,EACxC,iCAAiC,EACjC,uBAAuB,EACvB,8BAA8B,EAC9B,8BAA8B,EAC9B,iCAAiC,EACjC,gCAAgC,EAChC,mCAAmC,EACnC,sCAAsC,EACtC,mCAAmC,EACnC,0CAA0C,EAC1C,yCAAyC,EACzC,gDAAgD,EAChD,8BAA8B,EAC9B,iCAAiC,EACjC,2BAA2B,EAC3B,gCAAgC,EAChC,0CAA0C,GAC3C,MAAM,gBAAgB,CAAC;AAExB,sCAAsC;AACtC,kJAAkJ;AAClJ,MAAM,CAAC,MAAM,kBAAkB,GAAG,6CAA6C,CAAC;AAShF;;GAEG;AACH,MAAe,qBAAqB;IAGf,aAAa,CAAS;IAEzC,YAAY,KAAa;QACvB,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC;IAC7B,CAAC;IAID,MAAM,CAAC,IAAqB;QAC1B,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,IAAI,WAAW,CACnB,gCAAgC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,GAAG,aAAa,CACpE,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,KAAK,IAAI,CAAC,aAAa,EAAE,CAAC;YACpC,MAAM,IAAI,WAAW,CACnB,iBAAiB,IAAI,CAAC,IAAI,kBAAkB;gBAC5C,SAAS,QAAQ,gBAAgB,IAAI,CAAC,aAAa,IAAI,CACxD,CAAC;QACJ,CAAC;IACH,CAAC;CACF;AAED;;;GAGG;AACH,MAAe,qBAAsB,SAAQ,qBAAqB;CAAG;AAErE,+EAA+E;AAC/E,4EAA4E;AAC5E,+EAA+E;AAE/E;;;GAGG;AACH,MAAM,OAAO,UAAW,SAAQ,qBAAqB;IAC1C,GAAG,GAAG,8BAA8B,CAAC;IACrC,IAAI,GAAG,YAAY,CAAC;IAEnB,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACxC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,qBAAsB,SAAQ,qBAAqB;IACrD,GAAG,GAAG,qCAAqC,CAAC;IAC5C,IAAI,GAAG,uBAAuB,CAAC;IAE9B,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,wBAAwB,EAAE,eAAe,CAAC;IACxD,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,iBAAkB,SAAQ,qBAAqB;IACjD,GAAG,GAAG,iCAAiC,CAAC;IACxC,IAAI,GAAG,mBAAmB,CAAC;IAE1B,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,oBAAoB,EAAE,WAAW,CAAC;IAChD,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,kBAAmB,SAAQ,qBAAqB;IAClD,GAAG,GAAG,kCAAkC,CAAC;IACzC,IAAI,GAAG,oBAAoB,CAAC;IAE3B,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,qBAAqB,EAAE,YAAY,CAAC;IAClD,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,wBAAyB,SAAQ,qBAAqB;IACxD,GAAG,GAAG,wCAAwC,CAAC;IAC/C,IAAI,GAAG,0BAA0B,CAAC;IAEjC,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,2BAA2B,EAAE,kBAAkB,CAAC;IAC9D,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,iBAAkB,SAAQ,qBAAqB;IACjD,GAAG,GAAG,iCAAiC,CAAC;IACxC,IAAI,GAAG,mBAAmB,CAAC;IAE1B,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,oBAAoB,EAAE,WAAW,CAAC;IAChD,CAAC;CACF;AAED,+EAA+E;AAC/E,6EAA6E;AAC7E,+EAA+E;AAE/E;;;GAGG;AACH,MAAM,OAAO,YAAa,SAAQ,qBAAqB;IAC5C,GAAG,GAAG,8BAA8B,CAAC;IACrC,IAAI,GAAG,cAAc,CAAC;IAErB,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACxC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,kBAAmB,SAAQ,qBAAqB;IAClD,GAAG,GAAG,8BAA8B,CAAC;IACrC,IAAI,GAAG,oBAAoB,CAAC;IAE3B,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,iBAAiB,EAAE,cAAc,CAAC;IAChD,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,qBAAsB,SAAQ,qBAAqB;IACrD,GAAG,GAAG,iCAAiC,CAAC;IACxC,IAAI,GAAG,uBAAuB,CAAC;IAE9B,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,oBAAoB,EAAE,iBAAiB,CAAC;IACtD,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,qBAAsB,SAAQ,qBAAqB;IACrD,GAAG,GAAG,gCAAgC,CAAC;IACvC,IAAI,GAAG,uBAAuB,CAAC;IAE9B,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,oBAAoB,EAAE,iBAAiB,CAAC;IACtD,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,uBAAwB,SAAQ,qBAAqB;IACvD,GAAG,GAAG,mCAAmC,CAAC;IAC1C,IAAI,GAAG,yBAAyB,CAAC;IAEhC,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,sBAAsB,EAAE,mBAAmB,CAAC;IAC1D,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,0BAA2B,SAAQ,qBAAqB;IAC1D,GAAG,GAAG,sCAAsC,CAAC;IAC7C,IAAI,GAAG,4BAA4B,CAAC;IAEnC,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,yBAAyB,EAAE,sBAAsB,CAAC;IAChE,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,uBAAwB,SAAQ,qBAAqB;IACvD,GAAG,GAAG,mCAAmC,CAAC;IAC1C,IAAI,GAAG,yBAAyB,CAAC;IAEhC,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,sBAAsB,EAAE,mBAAmB,CAAC;IAC1D,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,8BAA+B,SAAQ,qBAAqB;IAC9D,GAAG,GAAG,0CAA0C,CAAC;IACjD,IAAI,GAAG,gCAAgC,CAAC;IAEvC,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,6BAA6B,EAAE,0BAA0B,CAAC;IACxE,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,4BAA6B,SAAQ,qBAAqB;IAC5D,GAAG,GAAG,yCAAyC,CAAC;IAChD,IAAI,GAAG,8BAA8B,CAAC;IAErC,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,2BAA2B,EAAE,wBAAwB,CAAC;IACpE,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,mCAAoC,SAAQ,qBAAqB;IACnE,GAAG,GAAG,gDAAgD,CAAC;IACvD,IAAI,GAAG,qCAAqC,CAAC;IAE5C,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,kCAAkC,EAAE,+BAA+B,CAAC;IAClF,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,kBAAmB,SAAQ,qBAAqB;IAClD,GAAG,GAAG,8BAA8B,CAAC;IACrC,IAAI,GAAG,oBAAoB,CAAC;IAE3B,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,iBAAiB,EAAE,cAAc,CAAC;IAChD,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,qBAAsB,SAAQ,qBAAqB;IACrD,GAAG,GAAG,iCAAiC,CAAC;IACxC,IAAI,GAAG,uBAAuB,CAAC;IAE9B,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,oBAAoB,EAAE,iBAAiB,CAAC;IACtD,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,gBAAiB,SAAQ,qBAAqB;IAChD,GAAG,GAAG,2BAA2B,CAAC;IAClC,IAAI,GAAG,kBAAkB,CAAC;IAEzB,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,eAAe,EAAE,YAAY,CAAC;IAC5C,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,oBAAqB,SAAQ,qBAAqB;IACpD,GAAG,GAAG,gCAAgC,CAAC;IACvC,IAAI,GAAG,sBAAsB,CAAC;IAE7B,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,mBAAmB,EAAE,gBAAgB,CAAC;IACpD,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,8BAA+B,SAAQ,qBAAqB;IAC9D,GAAG,GAAG,0CAA0C,CAAC;IACjD,IAAI,GAAG,gCAAgC,CAAC;IAEvC,iBAAiB,CAAC,IAAqB;QAC/C,OAAO,IAAI,CAAC,6BAA6B,EAAE,0BAA0B,CAAC;IACxE,CAAC;CACF;AAED,+EAA+E;AAC/E,qBAAqB;AACrB,+EAA+E;AAE/E;;;GAGG;AACH,MAAM,OAAO,KAAK;IACR,QAAQ,CAAuB;IAEvC,YAAY,QAA8B;QACxC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;IAED,MAAM,CAAC,IAAqB;QAC1B,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClC,IAAI,CAAC;gBACH,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBACnB,OAAO;YACT,CAAC;YAAC,MAAM,CAAC;gBACP,0BAA0B;YAC5B,CAAC;QACH,CAAC;QACD,MAAM,IAAI,WAAW,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,MAAM,qBAAqB,CAAC,CAAC;IAC3E,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,KAAK;IACR,QAAQ,CAAuB;IAEvC,YAAY,QAA8B;QACxC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;IAED,MAAM,CAAC,IAAqB;QAC1B,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,WAAW,CAAC,6BAA6B,CAAC,CAAC;QACvD,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;CACF;AAED,+EAA+E;AAC/E,kBAAkB;AAClB,+EAA+E;AAE/E;;;;;;;GAOG;AACH,MAAM,OAAO,QAAQ;IACX,QAAQ,CAAS;IACjB,YAAY,CAAoB;IAExC,YAAY,OAA8C;QACxD,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7E,CAAC;IAED,MAAM,CAAC,IAAqB;QAC1B,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACjC,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC;QACtC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,WAAW,CAAC,+DAA+D,CAAC,CAAC;QACzF,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAElC,yBAAyB;QACzB,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YACtB,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACjC,CAAC;QAED,UAAU;QACV,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;YACf,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;QAED,kCAAkC;QAClC,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAC;QAC5D,IAAI,SAAS,EAAE,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACzB,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,WAAW,CACnB,mCAAmC,IAAI,CAAC,QAAQ,kBAAkB,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACnG,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}

package/dist/trust/tuf.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tuf.d.ts","sourceRoot":"","sources":["../../src/trust/tuf.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAE/C;;GAEG;AACH,MAAM,WAAW,0BAA0B;IACzC;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAE3B;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAYD;;;;;;;;;;;GAWG;AACH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,aAAa,CAAC,CAAS;IAC/B,OAAO,CAAC,WAAW,CAAC,CAAS;IAC7B,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,iBAAiB,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAS;IAEzB,OAAO,CAAC,SAAS,CAAC,CAAY;IAC9B,OAAO,CAAC,UAAU,CAAC,CAAc;IACjC,OAAO,CAAC,cAAc,CAAC,CAAS;gBAEpB,OAAO,GAAE,0BAA+B;IAUpD;;;OAGG;YACW,aAAa;IAwB3B;;;OAGG;YACW,cAAc;IAY5B;;OAEG;IACH,OAAO,CAAC,YAAY;IASpB;;;;;;OAMG;IACG,cAAc,IAAI,OAAO,CAAC,WAAW,CAAC;IAsC5C;;;;;OAKG;IACG,kBAAkB,IAAI,OAAO,CAAC,WAAW,CAAC;IAShD;;;OAGG;IACH,UAAU,IAAI,IAAI;CAInB"}
+{"version":3,"file":"tuf.d.ts","sourceRoot":"","sources":["../../src/trust/tuf.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAE/C;;GAEG;AACH,MAAM,WAAW,0BAA0B;IACzC;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAE3B;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAaD;;;;;;;;;;;GAWG;AACH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,aAAa,CAAC,CAAS;IAC/B,OAAO,CAAC,WAAW,CAAC,CAAS;IAC7B,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,iBAAiB,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAS;IAEzB,OAAO,CAAC,SAAS,CAAC,CAAY;IAC9B,OAAO,CAAC,UAAU,CAAC,CAAc;IACjC,OAAO,CAAC,cAAc,CAAC,CAAS;gBAEpB,OAAO,GAAE,0BAA+B;IAWpD;;;OAGG;YACW,aAAa;IAwB3B;;;OAGG;YACW,cAAc;IAY5B;;OAEG;IACH,OAAO,CAAC,YAAY;IASpB;;;;;;OAMG;IACG,cAAc,IAAI,OAAO,CAAC,WAAW,CAAC;IAsC5C;;;;;OAKG;IACG,kBAAkB,IAAI,OAAO,CAAC,WAAW,CAAC;IAShD;;;OAGG;IACH,UAAU,IAAI,IAAI;CAInB"}

package/dist/trust/tuf.js

@@ -12,6 +12,7 @@ import { Uint8ArrayToString } from "@freedomofpress/crypto-browser";
  */
 const DEFAULT_CONFIG = {
     metadataUrl: 'https://tuf-repo-cdn.sigstore.dev/',
+    targetBaseUrl: 'https://tuf-repo-cdn.sigstore.dev/targets/',
     namespace: 'sigstore-browser',
     trustedRootTarget: 'trusted_root.json',
     cacheTTL: 3600000, // 1 hour
@@ -41,7 +42,8 @@ export class TrustedRootProvider {
     constructor(options = {}) {
         const metadataUrl = options.metadataUrl || DEFAULT_CONFIG.metadataUrl;
         this.metadataUrl = metadataUrl.endsWith('/') ? metadataUrl : `${metadataUrl}/`;
-        this.targetBaseUrl = options.targetBaseUrl || this.metadataUrl;
+        const targetBaseUrl = options.targetBaseUrl || DEFAULT_CONFIG.targetBaseUrl;
+        this.targetBaseUrl = targetBaseUrl.endsWith('/') ? targetBaseUrl : `${targetBaseUrl}/`;
         this.initialRoot = options.initialRoot;
         this.namespace = options.namespace || DEFAULT_CONFIG.namespace;
         this.trustedRootTarget = options.trustedRootTarget || DEFAULT_CONFIG.trustedRootTarget;

package/dist/trust/tuf.js.map

@@ -1 +1 @@
-{"version":3,"file":"tuf.js","sourceRoot":"","sources":["../../src/trust/tuf.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AA6CpE;;GAEG;AACH,MAAM,cAAc,GAAG;IACrB,WAAW,EAAE,oCAAoC;IACjD,SAAS,EAAE,kBAAkB;IAC7B,iBAAiB,EAAE,mBAAmB;IACtC,QAAQ,EAAE,OAAO,EAAE,SAAS;CAC7B,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,mBAAmB;IACtB,WAAW,CAAS;IACpB,aAAa,CAAU;IACvB,WAAW,CAAU;IACrB,SAAS,CAAS;IAClB,iBAAiB,CAAS;IAC1B,QAAQ,CAAS;IAEjB,SAAS,CAAa;IACtB,UAAU,CAAe;IACzB,cAAc,CAAU;IAEhC,YAAY,UAAsC,EAAE;QAClD,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,cAAc,CAAC,WAAW,CAAC;QACtE,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,WAAW,GAAG,CAAC;QAC/E,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,IAAI,CAAC,WAAW,CAAC;QAC/D,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACvC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,cAAc,CAAC,SAAS,CAAC;QAC/D,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,IAAI,cAAc,CAAC,iBAAiB,CAAC;QACvF,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,cAAc,CAAC,QAAQ,CAAC;IAC9D,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,aAAa;QACzB,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAC;YAElE,4BAA4B;YAC5B,MAAM,YAAY,GAAG,IAAI,CAAC,WAAW,IAAI,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;YAErE,IAAI,CAAC,SAAS,GAAG,IAAI,SAAS,CAC5B,IAAI,CAAC,WAAW,EAChB,YAAY,EACZ,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,aAAa,CACnB,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,oCAAoC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC7F,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,cAAc;QAC1B,oFAAoF;QACpF,uFAAuF;QACvF,MAAM,aAAa,GAAG,MAAM,MAAM,CAAC,iBAAiB,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QAClF,MAAM,aAAa,GAAG,aAAa,CAAC,OAAiB,CAAC;QAEtD,yDAAyD;QACzD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;QAClC,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7E,OAAO,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACnC,CAAC;IAED;;OAEG;IACK,YAAY;QAClB,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YAC7C,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC;IACrD,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,cAAc;QAClB,oCAAoC;QACpC,IAAI,IAAI,CAAC,YAAY,EAAE,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YAC3C,OAAO,IAAI,CAAC,UAAU,CAAC;QACzB,CAAC;QAED,kCAAkC;QAClC,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QAE3B,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,CAAC;QAED,IAAI,CAAC;YACH,2DAA2D;YAC3D,wEAAwE;YACxE,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC;YAEjC,wCAAwC;YACxC,2EAA2E;YAC3E,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;YAEjF,8BAA8B;YAC9B,MAAM,eAAe,GAAG,kBAAkB,CAAC,IAAI,UAAU,CAAC,iBAAiB,CAAC,CAAC,CAAC;YAC9E,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAgB,CAAC;YAE/D,mBAAmB;YACnB,IAAI,CAAC,UAAU,GAAG,WAAW,CAAC;YAC9B,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAEjC,OAAO,WAAW,CAAC;QACrB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,yCAAyC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAClG,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,kBAAkB;QACtB,cAAc;QACd,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;QAC5B,IAAI,CAAC,cAAc,GAAG,SAAS,CAAC;QAEhC,mBAAmB;QACnB,OAAO,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;IACrC,CAAC;IAED;;;OAGG;IACH,UAAU;QACR,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;QAC5B,IAAI,CAAC,cAAc,GAAG,SAAS,CAAC;IAClC,CAAC;CACF"}
+{"version":3,"file":"tuf.js","sourceRoot":"","sources":["../../src/trust/tuf.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AA6CpE;;GAEG;AACH,MAAM,cAAc,GAAG;IACrB,WAAW,EAAE,oCAAoC;IACjD,aAAa,EAAE,4CAA4C;IAC3D,SAAS,EAAE,kBAAkB;IAC7B,iBAAiB,EAAE,mBAAmB;IACtC,QAAQ,EAAE,OAAO,EAAE,SAAS;CAC7B,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,mBAAmB;IACtB,WAAW,CAAS;IACpB,aAAa,CAAU;IACvB,WAAW,CAAU;IACrB,SAAS,CAAS;IAClB,iBAAiB,CAAS;IAC1B,QAAQ,CAAS;IAEjB,SAAS,CAAa;IACtB,UAAU,CAAe;IACzB,cAAc,CAAU;IAEhC,YAAY,UAAsC,EAAE;QAClD,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,cAAc,CAAC,WAAW,CAAC;QACtE,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,WAAW,GAAG,CAAC;QAC/E,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,cAAc,CAAC,aAAa,CAAC;QAC5E,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,aAAa,GAAG,CAAC;QACvF,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACvC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,cAAc,CAAC,SAAS,CAAC;QAC/D,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,IAAI,cAAc,CAAC,iBAAiB,CAAC;QACvF,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,cAAc,CAAC,QAAQ,CAAC;IAC9D,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,aAAa;QACzB,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAC;YAElE,4BAA4B;YAC5B,MAAM,YAAY,GAAG,IAAI,CAAC,WAAW,IAAI,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;YAErE,IAAI,CAAC,SAAS,GAAG,IAAI,SAAS,CAC5B,IAAI,CAAC,WAAW,EAChB,YAAY,EACZ,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,aAAa,CACnB,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,oCAAoC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC7F,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,cAAc;QAC1B,oFAAoF;QACpF,uFAAuF;QACvF,MAAM,aAAa,GAAG,MAAM,MAAM,CAAC,iBAAiB,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QAClF,MAAM,aAAa,GAAG,aAAa,CAAC,OAAiB,CAAC;QAEtD,yDAAyD;QACzD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;QAClC,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7E,OAAO,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACnC,CAAC;IAED;;OAEG;IACK,YAAY;QAClB,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YAC7C,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC;IACrD,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,cAAc;QAClB,oCAAoC;QACpC,IAAI,IAAI,CAAC,YAAY,EAAE,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YAC3C,OAAO,IAAI,CAAC,UAAU,CAAC;QACzB,CAAC;QAED,kCAAkC;QAClC,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QAE3B,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,CAAC;QAED,IAAI,CAAC;YACH,2DAA2D;YAC3D,wEAAwE;YACxE,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC;YAEjC,wCAAwC;YACxC,2EAA2E;YAC3E,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;YAEjF,8BAA8B;YAC9B,MAAM,eAAe,GAAG,kBAAkB,CAAC,IAAI,UAAU,CAAC,iBAAiB,CAAC,CAAC,CAAC;YAC9E,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAgB,CAAC;YAE/D,mBAAmB;YACnB,IAAI,CAAC,UAAU,GAAG,WAAW,CAAC;YAC9B,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAEjC,OAAO,WAAW,CAAC;QACrB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,yCAAyC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAClG,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,kBAAkB;QACtB,cAAc;QACd,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;QAC5B,IAAI,CAAC,cAAc,GAAG,SAAS,CAAC;QAEhC,mBAAmB;QACnB,OAAO,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;IACrC,CAAC;IAED;;;OAGG;IACH,UAAU;QACR,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;QAC5B,IAAI,CAAC,cAAc,GAAG,SAAS,CAAC;IAClC,CAAC;CACF"}

package/dist/x509/cert.d.ts

@@ -1,6 +1,28 @@
 import { ASN1Obj } from "@freedomofpress/crypto-browser";
-import { X509AuthorityKeyIDExtension, X509BasicConstraintsExtension, X509Extension, X509FulcioIssuerV1, X509FulcioIssuerV2, X509KeyUsageExtension, X509SCTExtension, X509SubjectAlternativeNameExtension, X509SubjectKeyIDExtension } from "./ext.js";
+import { X509AuthorityKeyIDExtension, X509BasicConstraintsExtension, X509BuildConfigDigestExtension, X509BuildConfigURIExtension, X509BuildSignerDigestExtension, X509BuildSignerURIExtension, X509BuildTriggerExtension, X509Extension, X509FulcioIssuerV1, X509FulcioIssuerV2, X509GitHubWorkflowNameExtension, X509GitHubWorkflowRefExtension, X509GitHubWorkflowRepositoryExtension, X509GitHubWorkflowSHAExtension, X509GitHubWorkflowTriggerExtension, X509KeyUsageExtension, X509RunInvocationURIExtension, X509RunnerEnvironmentExtension, X509SCTExtension, X509SourceRepositoryDigestExtension, X509SourceRepositoryIdentifierExtension, X509SourceRepositoryOwnerIdentifierExtension, X509SourceRepositoryOwnerURIExtension, X509SourceRepositoryRefExtension, X509SourceRepositoryURIExtension, X509SourceRepositoryVisibilityExtension, X509SubjectAlternativeNameExtension, X509SubjectKeyIDExtension } from "./ext.js";
 export declare const EXTENSION_OID_SCT = "1.3.6.1.4.1.11129.2.4.2";
+export declare const EXTENSION_OID_FULCIO_ISSUER_V1 = "1.3.6.1.4.1.57264.1.1";
+export declare const EXTENSION_OID_GITHUB_WORKFLOW_TRIGGER = "1.3.6.1.4.1.57264.1.2";
+export declare const EXTENSION_OID_GITHUB_WORKFLOW_SHA = "1.3.6.1.4.1.57264.1.3";
+export declare const EXTENSION_OID_GITHUB_WORKFLOW_NAME = "1.3.6.1.4.1.57264.1.4";
+export declare const EXTENSION_OID_GITHUB_WORKFLOW_REPOSITORY = "1.3.6.1.4.1.57264.1.5";
+export declare const EXTENSION_OID_GITHUB_WORKFLOW_REF = "1.3.6.1.4.1.57264.1.6";
+export declare const EXTENSION_OID_OTHERNAME = "1.3.6.1.4.1.57264.1.7";
+export declare const EXTENSION_OID_FULCIO_ISSUER_V2 = "1.3.6.1.4.1.57264.1.8";
+export declare const EXTENSION_OID_BUILD_SIGNER_URI = "1.3.6.1.4.1.57264.1.9";
+export declare const EXTENSION_OID_BUILD_SIGNER_DIGEST = "1.3.6.1.4.1.57264.1.10";
+export declare const EXTENSION_OID_RUNNER_ENVIRONMENT = "1.3.6.1.4.1.57264.1.11";
+export declare const EXTENSION_OID_SOURCE_REPOSITORY_URI = "1.3.6.1.4.1.57264.1.12";
+export declare const EXTENSION_OID_SOURCE_REPOSITORY_DIGEST = "1.3.6.1.4.1.57264.1.13";
+export declare const EXTENSION_OID_SOURCE_REPOSITORY_REF = "1.3.6.1.4.1.57264.1.14";
+export declare const EXTENSION_OID_SOURCE_REPOSITORY_IDENTIFIER = "1.3.6.1.4.1.57264.1.15";
+export declare const EXTENSION_OID_SOURCE_REPOSITORY_OWNER_URI = "1.3.6.1.4.1.57264.1.16";
+export declare const EXTENSION_OID_SOURCE_REPOSITORY_OWNER_IDENTIFIER = "1.3.6.1.4.1.57264.1.17";
+export declare const EXTENSION_OID_BUILD_CONFIG_URI = "1.3.6.1.4.1.57264.1.18";
+export declare const EXTENSION_OID_BUILD_CONFIG_DIGEST = "1.3.6.1.4.1.57264.1.19";
+export declare const EXTENSION_OID_BUILD_TRIGGER = "1.3.6.1.4.1.57264.1.20";
+export declare const EXTENSION_OID_RUN_INVOCATION_URI = "1.3.6.1.4.1.57264.1.21";
+export declare const EXTENSION_OID_SOURCE_REPOSITORY_VISIBILITY = "1.3.6.1.4.1.57264.1.22";
 export declare class X509Certificate {
     root: ASN1Obj;
     constructor(asn1: ASN1Obj);
@@ -39,6 +61,25 @@ export declare class X509Certificate {
     get extSCT(): X509SCTExtension | undefined;
     get extFulcioIssuerV1(): X509FulcioIssuerV1 | undefined;
     get extFulcioIssuerV2(): X509FulcioIssuerV2 | undefined;
+    get extGitHubWorkflowTrigger(): X509GitHubWorkflowTriggerExtension | undefined;
+    get extGitHubWorkflowSHA(): X509GitHubWorkflowSHAExtension | undefined;
+    get extGitHubWorkflowName(): X509GitHubWorkflowNameExtension | undefined;
+    get extGitHubWorkflowRepository(): X509GitHubWorkflowRepositoryExtension | undefined;
+    get extGitHubWorkflowRef(): X509GitHubWorkflowRefExtension | undefined;
+    get extBuildSignerURI(): X509BuildSignerURIExtension | undefined;
+    get extBuildSignerDigest(): X509BuildSignerDigestExtension | undefined;
+    get extRunnerEnvironment(): X509RunnerEnvironmentExtension | undefined;
+    get extSourceRepositoryURI(): X509SourceRepositoryURIExtension | undefined;
+    get extSourceRepositoryDigest(): X509SourceRepositoryDigestExtension | undefined;
+    get extSourceRepositoryRef(): X509SourceRepositoryRefExtension | undefined;
+    get extSourceRepositoryIdentifier(): X509SourceRepositoryIdentifierExtension | undefined;
+    get extSourceRepositoryOwnerURI(): X509SourceRepositoryOwnerURIExtension | undefined;
+    get extSourceRepositoryOwnerIdentifier(): X509SourceRepositoryOwnerIdentifierExtension | undefined;
+    get extBuildConfigURI(): X509BuildConfigURIExtension | undefined;
+    get extBuildConfigDigest(): X509BuildConfigDigestExtension | undefined;
+    get extBuildTrigger(): X509BuildTriggerExtension | undefined;
+    get extRunInvocationURI(): X509RunInvocationURIExtension | undefined;
+    get extSourceRepositoryVisibility(): X509SourceRepositoryVisibilityExtension | undefined;
     get isCA(): boolean;
     extension(oid: string): X509Extension | undefined;
     verify(issuerCertificate?: X509Certificate): Promise<boolean>;

package/dist/x509/cert.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cert.d.ts","sourceRoot":"","sources":["../../src/x509/cert.ts"],"names":[],"mappings":"AAeA,OAAO,EACL,OAAO,EAMR,MAAM,gCAAgC,CAAC;AAGxC,OAAO,EACL,2BAA2B,EAC3B,6BAA6B,EAC7B,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,qBAAqB,EACrB,gBAAgB,EAChB,mCAAmC,EACnC,yBAAyB,EAC1B,MAAM,UAAU,CAAC;AAWlB,eAAO,MAAM,iBAAiB,4BAA4B,CAAC;AAE3D,qBAAa,eAAe;IACnB,IAAI,EAAE,OAAO,CAAC;gBAET,IAAI,EAAE,OAAO;WAIX,KAAK,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,GAAG,eAAe;IAM/D,IAAI,cAAc,IAAI,OAAO,CAE5B;IAED,IAAI,OAAO,IAAI,MAAM,CAIpB;IAED,IAAI,YAAY,IAAI,UAAU,CAE7B;IAED,IAAI,SAAS,IAAI,IAAI,CAGpB;IAED,IAAI,QAAQ,IAAI,IAAI,CAGnB;IAED,IAAI,MAAM,IAAI,UAAU,CAEvB;IAED,IAAI,OAAO,IAAI,UAAU,CAExB;IAED,IAAI,SAAS,IAAI,UAAU,CAE1B;IAED;;;;;OAKG;IACU,eAAe,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC;IAiCpF,IAAI,YAAY,IAAI,OAAO,CAAC,SAAS,CAAC,CAErC;IAED,IAAI,kBAAkB,IAAI,MAAM,CAG/B;IAED,IAAI,qBAAqB,IAAI,MAAM,CAElC;IAED;;;OAGG;IACH,OAAO,CAAC,wBAAwB;IA0BhC,IAAI,cAAc,IAAI,UAAU,CAG/B;IAED,IAAI,cAAc,IAAI,MAAM,GAAG,SAAS,CAGvC;IAED,IAAI,UAAU,IAAI,OAAO,EAAE,CAK1B;IAED,IAAI,WAAW,IAAI,qBAAqB,GAAG,SAAS,CAGnD;IAED,IAAI,mBAAmB,IAAI,6BAA6B,GAAG,SAAS,CAGnE;IAED,IAAI,iBAAiB,IAAI,mCAAmC,GAAG,SAAS,CAGvE;IAED,IAAI,iBAAiB,IAAI,2BAA2B,GAAG,SAAS,CAG/D;IAED,IAAI,eAAe,IAAI,yBAAyB,GAAG,SAAS,CAK3D;IAED,IAAI,MAAM,IAAI,gBAAgB,GAAG,SAAS,CAGzC;IAED,IAAI,iBAAiB,IAAI,kBAAkB,GAAG,SAAS,CAGtD;IAED,IAAI,iBAAiB,IAAI,kBAAkB,GAAG,SAAS,CAGtD;IAED,IAAI,IAAI,IAAI,OAAO,CASlB;IAEM,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS;IAK3C,MAAM,CAAC,iBAAiB,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC;IAwBnE,YAAY,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO;IAIjC,MAAM,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO;IAKvC,KAAK,IAAI,eAAe;IAM/B,OAAO,CAAC,aAAa;IAYrB,OAAO,KAAK,iBAAiB,GAG5B;IAGD,OAAO,KAAK,qBAAqB,GAGhC;IAGD,OAAO,KAAK,iBAAiB,GAG5B;IAGD,OAAO,KAAK,UAAU,GAGrB;IAGD,OAAO,KAAK,eAAe,GAG1B;IAGD,OAAO,KAAK,SAAS,GAGpB;IAGD,OAAO,KAAK,WAAW,GAGtB;IAGD,OAAO,KAAK,UAAU,GAGrB;IAGD,OAAO,KAAK,uBAAuB,GAGlC;IAKD,OAAO,KAAK,aAAa,GAIxB;CACF"}
+{"version":3,"file":"cert.d.ts","sourceRoot":"","sources":["../../src/x509/cert.ts"],"names":[],"mappings":"AAeA,OAAO,EACL,OAAO,EAMR,MAAM,gCAAgC,CAAC;AAGxC,OAAO,EACL,2BAA2B,EAC3B,6BAA6B,EAC7B,8BAA8B,EAC9B,2BAA2B,EAC3B,8BAA8B,EAC9B,2BAA2B,EAC3B,yBAAyB,EACzB,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,+BAA+B,EAC/B,8BAA8B,EAC9B,qCAAqC,EACrC,8BAA8B,EAC9B,kCAAkC,EAClC,qBAAqB,EACrB,6BAA6B,EAC7B,8BAA8B,EAC9B,gBAAgB,EAChB,mCAAmC,EACnC,uCAAuC,EACvC,4CAA4C,EAC5C,qCAAqC,EACrC,gCAAgC,EAChC,gCAAgC,EAChC,uCAAuC,EACvC,mCAAmC,EACnC,yBAAyB,EAC1B,MAAM,UAAU,CAAC;AAUlB,eAAO,MAAM,iBAAiB,4BAA4B,CAAC;AAI3D,eAAO,MAAM,8BAA8B,0BAA0B,CAAC;AACtE,eAAO,MAAM,qCAAqC,0BAA0B,CAAC;AAC7E,eAAO,MAAM,iCAAiC,0BAA0B,CAAC;AACzE,eAAO,MAAM,kCAAkC,0BAA0B,CAAC;AAC1E,eAAO,MAAM,wCAAwC,0BAA0B,CAAC;AAChF,eAAO,MAAM,iCAAiC,0BAA0B,CAAC;AACzE,eAAO,MAAM,uBAAuB,0BAA0B,CAAC;AAC/D,eAAO,MAAM,8BAA8B,0BAA0B,CAAC;AACtE,eAAO,MAAM,8BAA8B,0BAA0B,CAAC;AACtE,eAAO,MAAM,iCAAiC,2BAA2B,CAAC;AAC1E,eAAO,MAAM,gCAAgC,2BAA2B,CAAC;AACzE,eAAO,MAAM,mCAAmC,2BAA2B,CAAC;AAC5E,eAAO,MAAM,sCAAsC,2BAA2B,CAAC;AAC/E,eAAO,MAAM,mCAAmC,2BAA2B,CAAC;AAC5E,eAAO,MAAM,0CAA0C,2BAA2B,CAAC;AACnF,eAAO,MAAM,yCAAyC,2BAA2B,CAAC;AAClF,eAAO,MAAM,gDAAgD,2BAA2B,CAAC;AACzF,eAAO,MAAM,8BAA8B,2BAA2B,CAAC;AACvE,eAAO,MAAM,iCAAiC,2BAA2B,CAAC;AAC1E,eAAO,MAAM,2BAA2B,2BAA2B,CAAC;AACpE,eAAO,MAAM,gCAAgC,2BAA2B,CAAC;AACzE,eAAO,MAAM,0CAA0C,2BAA2B,CAAC;AAEnF,qBAAa,eAAe;IACnB,IAAI,EAAE,OAAO,CAAC;gBAET,IAAI,EAAE,OAAO;WAIX,KAAK,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,GAAG,eAAe;IAM/D,IAAI,cAAc,IAAI,OAAO,CAE5B;IAED,IAAI,OAAO,IAAI,MAAM,CAIpB;IAED,IAAI,YAAY,IAAI,UAAU,CAE7B;IAED,IAAI,SAAS,IAAI,IAAI,CAGpB;IAED,IAAI,QAAQ,IAAI,IAAI,CAGnB;IAED,IAAI,MAAM,IAAI,UAAU,CAEvB;IAED,IAAI,OAAO,IAAI,UAAU,CAExB;IAED,IAAI,SAAS,IAAI,UAAU,CAE1B;IAED;;;;;OAKG;IACU,eAAe,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC;IAiCpF,IAAI,YAAY,IAAI,OAAO,CAAC,SAAS,CAAC,CAErC;IAED,IAAI,kBAAkB,IAAI,MAAM,CAG/B;IAED,IAAI,qBAAqB,IAAI,MAAM,CAElC;IAED;;;OAGG;IACH,OAAO,CAAC,wBAAwB;IA0BhC,IAAI,cAAc,IAAI,UAAU,CAG/B;IAED,IAAI,cAAc,IAAI,MAAM,GAAG,SAAS,CAGvC;IAED,IAAI,UAAU,IAAI,OAAO,EAAE,CAK1B;IAED,IAAI,WAAW,IAAI,qBAAqB,GAAG,SAAS,CAGnD;IAED,IAAI,mBAAmB,IAAI,6BAA6B,GAAG,SAAS,CAGnE;IAED,IAAI,iBAAiB,IAAI,mCAAmC,GAAG,SAAS,CAGvE;IAED,IAAI,iBAAiB,IAAI,2BAA2B,GAAG,SAAS,CAG/D;IAED,IAAI,eAAe,IAAI,yBAAyB,GAAG,SAAS,CAK3D;IAED,IAAI,MAAM,IAAI,gBAAgB,GAAG,SAAS,CAGzC;IAED,IAAI,iBAAiB,IAAI,kBAAkB,GAAG,SAAS,CAGtD;IAED,IAAI,iBAAiB,IAAI,kBAAkB,GAAG,SAAS,CAGtD;IAED,IAAI,wBAAwB,IAAI,kCAAkC,GAAG,SAAS,CAG7E;IAED,IAAI,oBAAoB,IAAI,8BAA8B,GAAG,SAAS,CAGrE;IAED,IAAI,qBAAqB,IAAI,+BAA+B,GAAG,SAAS,CAGvE;IAED,IAAI,2BAA2B,IAAI,qCAAqC,GAAG,SAAS,CAGnF;IAED,IAAI,oBAAoB,IAAI,8BAA8B,GAAG,SAAS,CAGrE;IAED,IAAI,iBAAiB,IAAI,2BAA2B,GAAG,SAAS,CAG/D;IAED,IAAI,oBAAoB,IAAI,8BAA8B,GAAG,SAAS,CAGrE;IAED,IAAI,oBAAoB,IAAI,8BAA8B,GAAG,SAAS,CAGrE;IAED,IAAI,sBAAsB,IAAI,gCAAgC,GAAG,SAAS,CAGzE;IAED,IAAI,yBAAyB,IAAI,mCAAmC,GAAG,SAAS,CAG/E;IAED,IAAI,sBAAsB,IAAI,gCAAgC,GAAG,SAAS,CAGzE;IAED,IAAI,6BAA6B,IAAI,uCAAuC,GAAG,SAAS,CAGvF;IAED,IAAI,2BAA2B,IAAI,qCAAqC,GAAG,SAAS,CAGnF;IAED,IAAI,kCAAkC,IAAI,4CAA4C,GAAG,SAAS,CAGjG;IAED,IAAI,iBAAiB,IAAI,2BAA2B,GAAG,SAAS,CAG/D;IAED,IAAI,oBAAoB,IAAI,8BAA8B,GAAG,SAAS,CAGrE;IAED,IAAI,eAAe,IAAI,yBAAyB,GAAG,SAAS,CAG3D;IAED,IAAI,mBAAmB,IAAI,6BAA6B,GAAG,SAAS,CAGnE;IAED,IAAI,6BAA6B,IAAI,uCAAuC,GAAG,SAAS,CAGvF;IAED,IAAI,IAAI,IAAI,OAAO,CASlB;IAEM,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS;IAK3C,MAAM,CAAC,iBAAiB,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC;IAwBnE,YAAY,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO;IAIjC,MAAM,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO;IAKvC,KAAK,IAAI,eAAe;IAM/B,OAAO,CAAC,aAAa;IAYrB,OAAO,KAAK,iBAAiB,GAG5B;IAGD,OAAO,KAAK,qBAAqB,GAGhC;IAGD,OAAO,KAAK,iBAAiB,GAG5B;IAGD,OAAO,KAAK,UAAU,GAGrB;IAGD,OAAO,KAAK,eAAe,GAG1B;IAGD,OAAO,KAAK,SAAS,GAGpB;IAGD,OAAO,KAAK,WAAW,GAGtB;IAGD,OAAO,KAAK,UAAU,GAGrB;IAGD,OAAO,KAAK,uBAAuB,GAGlC;IAKD,OAAO,KAAK,aAAa,GAIxB;CACF"}

package/dist/x509/cert.js

@@ -16,16 +16,39 @@ limitations under the License.
 import { ASN1Obj, importKey, toDER, Uint8ArrayToBase64, uint8ArrayEqual, verifySignature, } from "@freedomofpress/crypto-browser";
 import { KeyTypes } from "../interfaces.js";
 import { DEFAULT_HASH_ALGORITHM, ECDSA_CURVE_NAMES, ECDSA_SIGNATURE_ALGOS, OID_RSASSA_PSS, RSA_SIGNATURE_ALGOS, SHA2_HASH_ALGOS } from "../oid.js";
-import { X509AuthorityKeyIDExtension, X509BasicConstraintsExtension, X509Extension, X509FulcioIssuerV1, X509FulcioIssuerV2, X509KeyUsageExtension, X509SCTExtension, X509SubjectAlternativeNameExtension, X509SubjectKeyIDExtension, } from "./ext.js";
-// https://github.com/sigstore/fulcio/blob/main/docs/oid-info.md
+import { X509AuthorityKeyIDExtension, X509BasicConstraintsExtension, X509BuildConfigDigestExtension, X509BuildConfigURIExtension, X509BuildSignerDigestExtension, X509BuildSignerURIExtension, X509BuildTriggerExtension, X509Extension, X509FulcioIssuerV1, X509FulcioIssuerV2, X509GitHubWorkflowNameExtension, X509GitHubWorkflowRefExtension, X509GitHubWorkflowRepositoryExtension, X509GitHubWorkflowSHAExtension, X509GitHubWorkflowTriggerExtension, X509KeyUsageExtension, X509RunInvocationURIExtension, X509RunnerEnvironmentExtension, X509SCTExtension, X509SourceRepositoryDigestExtension, X509SourceRepositoryIdentifierExtension, X509SourceRepositoryOwnerIdentifierExtension, X509SourceRepositoryOwnerURIExtension, X509SourceRepositoryRefExtension, X509SourceRepositoryURIExtension, X509SourceRepositoryVisibilityExtension, X509SubjectAlternativeNameExtension, X509SubjectKeyIDExtension, } from "./ext.js";
+// Standard X.509 extension OIDs
 const EXTENSION_OID_SUBJECT_KEY_ID = "2.5.29.14";
 const EXTENSION_OID_KEY_USAGE = "2.5.29.15";
 const EXTENSION_OID_SUBJECT_ALT_NAME = "2.5.29.17";
 const EXTENSION_OID_BASIC_CONSTRAINTS = "2.5.29.19";
 const EXTENSION_OID_AUTHORITY_KEY_ID = "2.5.29.35";
-const EXTENSION_OID_FULCIO_ISSUER_V1 = "1.3.6.1.4.1.57264.1.1";
-const EXTENSION_OID_FULCIO_ISSUER_V2 = "1.3.6.1.4.1.57264.1.8";
+// CT Log SCT extension OID
 export const EXTENSION_OID_SCT = "1.3.6.1.4.1.11129.2.4.2";
+// Fulcio extension OIDs
+// https://github.com/sigstore/fulcio/blob/main/docs/oid-info.md
+export const EXTENSION_OID_FULCIO_ISSUER_V1 = "1.3.6.1.4.1.57264.1.1";
+export const EXTENSION_OID_GITHUB_WORKFLOW_TRIGGER = "1.3.6.1.4.1.57264.1.2";
+export const EXTENSION_OID_GITHUB_WORKFLOW_SHA = "1.3.6.1.4.1.57264.1.3";
+export const EXTENSION_OID_GITHUB_WORKFLOW_NAME = "1.3.6.1.4.1.57264.1.4";
+export const EXTENSION_OID_GITHUB_WORKFLOW_REPOSITORY = "1.3.6.1.4.1.57264.1.5";
+export const EXTENSION_OID_GITHUB_WORKFLOW_REF = "1.3.6.1.4.1.57264.1.6";
+export const EXTENSION_OID_OTHERNAME = "1.3.6.1.4.1.57264.1.7";
+export const EXTENSION_OID_FULCIO_ISSUER_V2 = "1.3.6.1.4.1.57264.1.8";
+export const EXTENSION_OID_BUILD_SIGNER_URI = "1.3.6.1.4.1.57264.1.9";
+export const EXTENSION_OID_BUILD_SIGNER_DIGEST = "1.3.6.1.4.1.57264.1.10";
+export const EXTENSION_OID_RUNNER_ENVIRONMENT = "1.3.6.1.4.1.57264.1.11";
+export const EXTENSION_OID_SOURCE_REPOSITORY_URI = "1.3.6.1.4.1.57264.1.12";
+export const EXTENSION_OID_SOURCE_REPOSITORY_DIGEST = "1.3.6.1.4.1.57264.1.13";
+export const EXTENSION_OID_SOURCE_REPOSITORY_REF = "1.3.6.1.4.1.57264.1.14";
+export const EXTENSION_OID_SOURCE_REPOSITORY_IDENTIFIER = "1.3.6.1.4.1.57264.1.15";
+export const EXTENSION_OID_SOURCE_REPOSITORY_OWNER_URI = "1.3.6.1.4.1.57264.1.16";
+export const EXTENSION_OID_SOURCE_REPOSITORY_OWNER_IDENTIFIER = "1.3.6.1.4.1.57264.1.17";
+export const EXTENSION_OID_BUILD_CONFIG_URI = "1.3.6.1.4.1.57264.1.18";
+export const EXTENSION_OID_BUILD_CONFIG_DIGEST = "1.3.6.1.4.1.57264.1.19";
+export const EXTENSION_OID_BUILD_TRIGGER = "1.3.6.1.4.1.57264.1.20";
+export const EXTENSION_OID_RUN_INVOCATION_URI = "1.3.6.1.4.1.57264.1.21";
+export const EXTENSION_OID_SOURCE_REPOSITORY_VISIBILITY = "1.3.6.1.4.1.57264.1.22";
 export class X509Certificate {
     root;
     constructor(asn1) {
@@ -182,6 +205,82 @@ export class X509Certificate {
         const ext = this.findExtension(EXTENSION_OID_FULCIO_ISSUER_V2);
         return ext ? new X509FulcioIssuerV2(ext) : undefined;
     }
+    get extGitHubWorkflowTrigger() {
+        const ext = this.findExtension(EXTENSION_OID_GITHUB_WORKFLOW_TRIGGER);
+        return ext ? new X509GitHubWorkflowTriggerExtension(ext) : undefined;
+    }
+    get extGitHubWorkflowSHA() {
+        const ext = this.findExtension(EXTENSION_OID_GITHUB_WORKFLOW_SHA);
+        return ext ? new X509GitHubWorkflowSHAExtension(ext) : undefined;
+    }
+    get extGitHubWorkflowName() {
+        const ext = this.findExtension(EXTENSION_OID_GITHUB_WORKFLOW_NAME);
+        return ext ? new X509GitHubWorkflowNameExtension(ext) : undefined;
+    }
+    get extGitHubWorkflowRepository() {
+        const ext = this.findExtension(EXTENSION_OID_GITHUB_WORKFLOW_REPOSITORY);
+        return ext ? new X509GitHubWorkflowRepositoryExtension(ext) : undefined;
+    }
+    get extGitHubWorkflowRef() {
+        const ext = this.findExtension(EXTENSION_OID_GITHUB_WORKFLOW_REF);
+        return ext ? new X509GitHubWorkflowRefExtension(ext) : undefined;
+    }
+    get extBuildSignerURI() {
+        const ext = this.findExtension(EXTENSION_OID_BUILD_SIGNER_URI);
+        return ext ? new X509BuildSignerURIExtension(ext) : undefined;
+    }
+    get extBuildSignerDigest() {
+        const ext = this.findExtension(EXTENSION_OID_BUILD_SIGNER_DIGEST);
+        return ext ? new X509BuildSignerDigestExtension(ext) : undefined;
+    }
+    get extRunnerEnvironment() {
+        const ext = this.findExtension(EXTENSION_OID_RUNNER_ENVIRONMENT);
+        return ext ? new X509RunnerEnvironmentExtension(ext) : undefined;
+    }
+    get extSourceRepositoryURI() {
+        const ext = this.findExtension(EXTENSION_OID_SOURCE_REPOSITORY_URI);
+        return ext ? new X509SourceRepositoryURIExtension(ext) : undefined;
+    }
+    get extSourceRepositoryDigest() {
+        const ext = this.findExtension(EXTENSION_OID_SOURCE_REPOSITORY_DIGEST);
+        return ext ? new X509SourceRepositoryDigestExtension(ext) : undefined;
+    }
+    get extSourceRepositoryRef() {
+        const ext = this.findExtension(EXTENSION_OID_SOURCE_REPOSITORY_REF);
+        return ext ? new X509SourceRepositoryRefExtension(ext) : undefined;
+    }
+    get extSourceRepositoryIdentifier() {
+        const ext = this.findExtension(EXTENSION_OID_SOURCE_REPOSITORY_IDENTIFIER);
+        return ext ? new X509SourceRepositoryIdentifierExtension(ext) : undefined;
+    }
+    get extSourceRepositoryOwnerURI() {
+        const ext = this.findExtension(EXTENSION_OID_SOURCE_REPOSITORY_OWNER_URI);
+        return ext ? new X509SourceRepositoryOwnerURIExtension(ext) : undefined;
+    }
+    get extSourceRepositoryOwnerIdentifier() {
+        const ext = this.findExtension(EXTENSION_OID_SOURCE_REPOSITORY_OWNER_IDENTIFIER);
+        return ext ? new X509SourceRepositoryOwnerIdentifierExtension(ext) : undefined;
+    }
+    get extBuildConfigURI() {
+        const ext = this.findExtension(EXTENSION_OID_BUILD_CONFIG_URI);
+        return ext ? new X509BuildConfigURIExtension(ext) : undefined;
+    }
+    get extBuildConfigDigest() {
+        const ext = this.findExtension(EXTENSION_OID_BUILD_CONFIG_DIGEST);
+        return ext ? new X509BuildConfigDigestExtension(ext) : undefined;
+    }
+    get extBuildTrigger() {
+        const ext = this.findExtension(EXTENSION_OID_BUILD_TRIGGER);
+        return ext ? new X509BuildTriggerExtension(ext) : undefined;
+    }
+    get extRunInvocationURI() {
+        const ext = this.findExtension(EXTENSION_OID_RUN_INVOCATION_URI);
+        return ext ? new X509RunInvocationURIExtension(ext) : undefined;
+    }
+    get extSourceRepositoryVisibility() {
+        const ext = this.findExtension(EXTENSION_OID_SOURCE_REPOSITORY_VISIBILITY);
+        return ext ? new X509SourceRepositoryVisibilityExtension(ext) : undefined;
+    }
     get isCA() {
         const ca = this.extBasicConstraints?.isCA || false;
         // If the KeyUsage extension is present, keyCertSign must be set