@freedomofpress/sigstore-browser 0.1.5 → 0.1.7

package/src/policy.ts

@@ -0,0 +1,476 @@
+/**
+ * Adapted from sigstore-python sigstore/verify/policy.py
+ *
+ * This module provides policy verification for checking certificate identity claims.
+ * Each policy class verifies a specific X.509 extension value against an expected value.
+ *
+ * There are two types of extension formats:
+ * - V1 extensions: Raw OCTET STRING containing the value directly
+ * - V2 extensions: DER-encoded UTF8String (RFC 5280 compliant)
+ *
+ * Policies can be combined using:
+ * - AllOf: All child policies must pass (logical AND)
+ * - AnyOf: At least one child policy must pass (logical OR)
+ * - Identity: Verifies SAN with optional issuer check
+ */
+
+import { PolicyError } from "./errors.js";
+import {
+  X509Certificate,
+  EXTENSION_OID_FULCIO_ISSUER_V1,
+  EXTENSION_OID_GITHUB_WORKFLOW_TRIGGER,
+  EXTENSION_OID_GITHUB_WORKFLOW_SHA,
+  EXTENSION_OID_GITHUB_WORKFLOW_NAME,
+  EXTENSION_OID_GITHUB_WORKFLOW_REPOSITORY,
+  EXTENSION_OID_GITHUB_WORKFLOW_REF,
+  EXTENSION_OID_OTHERNAME,
+  EXTENSION_OID_FULCIO_ISSUER_V2,
+  EXTENSION_OID_BUILD_SIGNER_URI,
+  EXTENSION_OID_BUILD_SIGNER_DIGEST,
+  EXTENSION_OID_RUNNER_ENVIRONMENT,
+  EXTENSION_OID_SOURCE_REPOSITORY_URI,
+  EXTENSION_OID_SOURCE_REPOSITORY_DIGEST,
+  EXTENSION_OID_SOURCE_REPOSITORY_REF,
+  EXTENSION_OID_SOURCE_REPOSITORY_IDENTIFIER,
+  EXTENSION_OID_SOURCE_REPOSITORY_OWNER_URI,
+  EXTENSION_OID_SOURCE_REPOSITORY_OWNER_IDENTIFIER,
+  EXTENSION_OID_BUILD_CONFIG_URI,
+  EXTENSION_OID_BUILD_CONFIG_DIGEST,
+  EXTENSION_OID_BUILD_TRIGGER,
+  EXTENSION_OID_RUN_INVOCATION_URI,
+  EXTENSION_OID_SOURCE_REPOSITORY_VISIBILITY,
+} from "./x509/cert.js";
+
+// Standard GitHub Actions OIDC issuer
+// https://docs.github.com/en/actions/security-for-github-actions/security-hardening-your-deployments/about-security-hardening-with-openid-connect
+export const GITHUB_OIDC_ISSUER = "https://token.actions.githubusercontent.com";
+
+/**
+ * Interface that all verification policies conform to.
+ */
+export interface VerificationPolicy {
+  verify(cert: X509Certificate): void;
+}
+
+/**
+ * Base class for V1 extension policies (raw OCTET STRING value).
+ */
+abstract class SingleX509ExtPolicyV1 implements VerificationPolicy {
+  abstract readonly oid: string;
+  abstract readonly name: string;
+  protected readonly expectedValue: string;
+
+  constructor(value: string) {
+    this.expectedValue = value;
+  }
+
+  protected abstract getExtensionValue(cert: X509Certificate): string | undefined;
+
+  verify(cert: X509Certificate): void {
+    const extValue = this.getExtensionValue(cert);
+    if (extValue === undefined) {
+      throw new PolicyError(
+        `Certificate does not contain ${this.name} (${this.oid}) extension`
+      );
+    }
+    if (extValue !== this.expectedValue) {
+      throw new PolicyError(
+        `Certificate's ${this.name} does not match ` +
+        `(got '${extValue}', expected '${this.expectedValue}')`
+      );
+    }
+  }
+}
+
+/**
+ * Base class for V2 extension policies (DER-encoded UTF8String).
+ * Uses the same verify logic as V1 since our extension classes handle the parsing.
+ */
+abstract class SingleX509ExtPolicyV2 extends SingleX509ExtPolicyV1 {}
+
+// ============================================================================
+// V1 Extension Policies (OID 1.3.6.1.4.1.57264.1.1 - 1.3.6.1.4.1.57264.1.6)
+// ============================================================================
+
+/**
+ * Verifies the certificate's OIDC issuer (V1 format).
+ * OID: 1.3.6.1.4.1.57264.1.1
+ */
+export class OIDCIssuer extends SingleX509ExtPolicyV1 {
+  readonly oid = EXTENSION_OID_FULCIO_ISSUER_V1;
+  readonly name = "OIDCIssuer";
+
+  protected getExtensionValue(cert: X509Certificate): string | undefined {
+    return cert.extFulcioIssuerV1?.issuer;
+  }
+}
+
+/**
+ * Verifies the certificate's GitHub Actions workflow trigger.
+ * OID: 1.3.6.1.4.1.57264.1.2
+ */
+export class GitHubWorkflowTrigger extends SingleX509ExtPolicyV1 {
+  readonly oid = EXTENSION_OID_GITHUB_WORKFLOW_TRIGGER;
+  readonly name = "GitHubWorkflowTrigger";
+
+  protected getExtensionValue(cert: X509Certificate): string | undefined {
+    return cert.extGitHubWorkflowTrigger?.workflowTrigger;
+  }
+}
+
+/**
+ * Verifies the certificate's GitHub Actions workflow commit SHA.
+ * OID: 1.3.6.1.4.1.57264.1.3
+ */
+export class GitHubWorkflowSHA extends SingleX509ExtPolicyV1 {
+  readonly oid = EXTENSION_OID_GITHUB_WORKFLOW_SHA;
+  readonly name = "GitHubWorkflowSHA";
+
+  protected getExtensionValue(cert: X509Certificate): string | undefined {
+    return cert.extGitHubWorkflowSHA?.workflowSHA;
+  }
+}
+
+/**
+ * Verifies the certificate's GitHub Actions workflow name.
+ * OID: 1.3.6.1.4.1.57264.1.4
+ */
+export class GitHubWorkflowName extends SingleX509ExtPolicyV1 {
+  readonly oid = EXTENSION_OID_GITHUB_WORKFLOW_NAME;
+  readonly name = "GitHubWorkflowName";
+
+  protected getExtensionValue(cert: X509Certificate): string | undefined {
+    return cert.extGitHubWorkflowName?.workflowName;
+  }
+}
+
+/**
+ * Verifies the certificate's GitHub Actions workflow repository.
+ * OID: 1.3.6.1.4.1.57264.1.5
+ */
+export class GitHubWorkflowRepository extends SingleX509ExtPolicyV1 {
+  readonly oid = EXTENSION_OID_GITHUB_WORKFLOW_REPOSITORY;
+  readonly name = "GitHubWorkflowRepository";
+
+  protected getExtensionValue(cert: X509Certificate): string | undefined {
+    return cert.extGitHubWorkflowRepository?.workflowRepository;
+  }
+}
+
+/**
+ * Verifies the certificate's GitHub Actions workflow ref.
+ * OID: 1.3.6.1.4.1.57264.1.6
+ */
+export class GitHubWorkflowRef extends SingleX509ExtPolicyV1 {
+  readonly oid = EXTENSION_OID_GITHUB_WORKFLOW_REF;
+  readonly name = "GitHubWorkflowRef";
+
+  protected getExtensionValue(cert: X509Certificate): string | undefined {
+    return cert.extGitHubWorkflowRef?.workflowRef;
+  }
+}
+
+// ============================================================================
+// V2 Extension Policies (OID 1.3.6.1.4.1.57264.1.8 - 1.3.6.1.4.1.57264.1.22)
+// ============================================================================
+
+/**
+ * Verifies the certificate's OIDC issuer (V2 format, DER-encoded).
+ * OID: 1.3.6.1.4.1.57264.1.8
+ */
+export class OIDCIssuerV2 extends SingleX509ExtPolicyV2 {
+  readonly oid = EXTENSION_OID_FULCIO_ISSUER_V2;
+  readonly name = "OIDCIssuerV2";
+
+  protected getExtensionValue(cert: X509Certificate): string | undefined {
+    return cert.extFulcioIssuerV2?.issuer;
+  }
+}
+
+/**
+ * Verifies the certificate's Build Signer URI.
+ * OID: 1.3.6.1.4.1.57264.1.9
+ */
+export class OIDCBuildSignerURI extends SingleX509ExtPolicyV2 {
+  readonly oid = EXTENSION_OID_BUILD_SIGNER_URI;
+  readonly name = "OIDCBuildSignerURI";
+
+  protected getExtensionValue(cert: X509Certificate): string | undefined {
+    return cert.extBuildSignerURI?.buildSignerURI;
+  }
+}
+
+/**
+ * Verifies the certificate's Build Signer Digest.
+ * OID: 1.3.6.1.4.1.57264.1.10
+ */
+export class OIDCBuildSignerDigest extends SingleX509ExtPolicyV2 {
+  readonly oid = EXTENSION_OID_BUILD_SIGNER_DIGEST;
+  readonly name = "OIDCBuildSignerDigest";
+
+  protected getExtensionValue(cert: X509Certificate): string | undefined {
+    return cert.extBuildSignerDigest?.buildSignerDigest;
+  }
+}
+
+/**
+ * Verifies the certificate's Runner Environment.
+ * OID: 1.3.6.1.4.1.57264.1.11
+ */
+export class OIDCRunnerEnvironment extends SingleX509ExtPolicyV2 {
+  readonly oid = EXTENSION_OID_RUNNER_ENVIRONMENT;
+  readonly name = "OIDCRunnerEnvironment";
+
+  protected getExtensionValue(cert: X509Certificate): string | undefined {
+    return cert.extRunnerEnvironment?.runnerEnvironment;
+  }
+}
+
+/**
+ * Verifies the certificate's Source Repository URI.
+ * OID: 1.3.6.1.4.1.57264.1.12
+ */
+export class OIDCSourceRepositoryURI extends SingleX509ExtPolicyV2 {
+  readonly oid = EXTENSION_OID_SOURCE_REPOSITORY_URI;
+  readonly name = "OIDCSourceRepositoryURI";
+
+  protected getExtensionValue(cert: X509Certificate): string | undefined {
+    return cert.extSourceRepositoryURI?.sourceRepositoryURI;
+  }
+}
+
+/**
+ * Verifies the certificate's Source Repository Digest.
+ * OID: 1.3.6.1.4.1.57264.1.13
+ */
+export class OIDCSourceRepositoryDigest extends SingleX509ExtPolicyV2 {
+  readonly oid = EXTENSION_OID_SOURCE_REPOSITORY_DIGEST;
+  readonly name = "OIDCSourceRepositoryDigest";
+
+  protected getExtensionValue(cert: X509Certificate): string | undefined {
+    return cert.extSourceRepositoryDigest?.sourceRepositoryDigest;
+  }
+}
+
+/**
+ * Verifies the certificate's Source Repository Ref.
+ * OID: 1.3.6.1.4.1.57264.1.14
+ */
+export class OIDCSourceRepositoryRef extends SingleX509ExtPolicyV2 {
+  readonly oid = EXTENSION_OID_SOURCE_REPOSITORY_REF;
+  readonly name = "OIDCSourceRepositoryRef";
+
+  protected getExtensionValue(cert: X509Certificate): string | undefined {
+    return cert.extSourceRepositoryRef?.sourceRepositoryRef;
+  }
+}
+
+/**
+ * Verifies the certificate's Source Repository Identifier.
+ * OID: 1.3.6.1.4.1.57264.1.15
+ */
+export class OIDCSourceRepositoryIdentifier extends SingleX509ExtPolicyV2 {
+  readonly oid = EXTENSION_OID_SOURCE_REPOSITORY_IDENTIFIER;
+  readonly name = "OIDCSourceRepositoryIdentifier";
+
+  protected getExtensionValue(cert: X509Certificate): string | undefined {
+    return cert.extSourceRepositoryIdentifier?.sourceRepositoryIdentifier;
+  }
+}
+
+/**
+ * Verifies the certificate's Source Repository Owner URI.
+ * OID: 1.3.6.1.4.1.57264.1.16
+ */
+export class OIDCSourceRepositoryOwnerURI extends SingleX509ExtPolicyV2 {
+  readonly oid = EXTENSION_OID_SOURCE_REPOSITORY_OWNER_URI;
+  readonly name = "OIDCSourceRepositoryOwnerURI";
+
+  protected getExtensionValue(cert: X509Certificate): string | undefined {
+    return cert.extSourceRepositoryOwnerURI?.sourceRepositoryOwnerURI;
+  }
+}
+
+/**
+ * Verifies the certificate's Source Repository Owner Identifier.
+ * OID: 1.3.6.1.4.1.57264.1.17
+ */
+export class OIDCSourceRepositoryOwnerIdentifier extends SingleX509ExtPolicyV2 {
+  readonly oid = EXTENSION_OID_SOURCE_REPOSITORY_OWNER_IDENTIFIER;
+  readonly name = "OIDCSourceRepositoryOwnerIdentifier";
+
+  protected getExtensionValue(cert: X509Certificate): string | undefined {
+    return cert.extSourceRepositoryOwnerIdentifier?.sourceRepositoryOwnerIdentifier;
+  }
+}
+
+/**
+ * Verifies the certificate's Build Config URI.
+ * OID: 1.3.6.1.4.1.57264.1.18
+ */
+export class OIDCBuildConfigURI extends SingleX509ExtPolicyV2 {
+  readonly oid = EXTENSION_OID_BUILD_CONFIG_URI;
+  readonly name = "OIDCBuildConfigURI";
+
+  protected getExtensionValue(cert: X509Certificate): string | undefined {
+    return cert.extBuildConfigURI?.buildConfigURI;
+  }
+}
+
+/**
+ * Verifies the certificate's Build Config Digest.
+ * OID: 1.3.6.1.4.1.57264.1.19
+ */
+export class OIDCBuildConfigDigest extends SingleX509ExtPolicyV2 {
+  readonly oid = EXTENSION_OID_BUILD_CONFIG_DIGEST;
+  readonly name = "OIDCBuildConfigDigest";
+
+  protected getExtensionValue(cert: X509Certificate): string | undefined {
+    return cert.extBuildConfigDigest?.buildConfigDigest;
+  }
+}
+
+/**
+ * Verifies the certificate's Build Trigger.
+ * OID: 1.3.6.1.4.1.57264.1.20
+ */
+export class OIDCBuildTrigger extends SingleX509ExtPolicyV2 {
+  readonly oid = EXTENSION_OID_BUILD_TRIGGER;
+  readonly name = "OIDCBuildTrigger";
+
+  protected getExtensionValue(cert: X509Certificate): string | undefined {
+    return cert.extBuildTrigger?.buildTrigger;
+  }
+}
+
+/**
+ * Verifies the certificate's Run Invocation URI.
+ * OID: 1.3.6.1.4.1.57264.1.21
+ */
+export class OIDCRunInvocationURI extends SingleX509ExtPolicyV2 {
+  readonly oid = EXTENSION_OID_RUN_INVOCATION_URI;
+  readonly name = "OIDCRunInvocationURI";
+
+  protected getExtensionValue(cert: X509Certificate): string | undefined {
+    return cert.extRunInvocationURI?.runInvocationURI;
+  }
+}
+
+/**
+ * Verifies the certificate's Source Repository Visibility at signing.
+ * OID: 1.3.6.1.4.1.57264.1.22
+ */
+export class OIDCSourceRepositoryVisibility extends SingleX509ExtPolicyV2 {
+  readonly oid = EXTENSION_OID_SOURCE_REPOSITORY_VISIBILITY;
+  readonly name = "OIDCSourceRepositoryVisibility";
+
+  protected getExtensionValue(cert: X509Certificate): string | undefined {
+    return cert.extSourceRepositoryVisibility?.sourceRepositoryVisibility;
+  }
+}
+
+// ============================================================================
+// Policy Combinators
+// ============================================================================
+
+/**
+ * The "any of" policy, corresponding to a logical OR between child policies.
+ * An empty list of child policies is considered trivially invalid.
+ */
+export class AnyOf implements VerificationPolicy {
+  private children: VerificationPolicy[];
+
+  constructor(children: VerificationPolicy[]) {
+    this.children = children;
+  }
+
+  verify(cert: X509Certificate): void {
+    for (const child of this.children) {
+      try {
+        child.verify(cert);
+        return;
+      } catch {
+        // Continue to next policy
+      }
+    }
+    throw new PolicyError(`0 of ${this.children.length} policies succeeded`);
+  }
+}
+
+/**
+ * The "all of" policy, corresponding to a logical AND between child policies.
+ * An empty list of child policies is considered trivially invalid.
+ */
+export class AllOf implements VerificationPolicy {
+  private children: VerificationPolicy[];
+
+  constructor(children: VerificationPolicy[]) {
+    this.children = children;
+  }
+
+  verify(cert: X509Certificate): void {
+    if (this.children.length < 1) {
+      throw new PolicyError("no child policies to verify");
+    }
+    for (const child of this.children) {
+      child.verify(cert);
+    }
+  }
+}
+
+// ============================================================================
+// Identity Policy
+// ============================================================================
+
+/**
+ * Verifies the certificate's "identity", corresponding to the X.509v3 SAN.
+ *
+ * Identities can be verified modulo an OIDC issuer, to prevent an unexpected
+ * issuer from offering a particular identity.
+ *
+ * Supported SAN types include emails, URIs, and Sigstore-specific "other names".
+ */
+export class Identity implements VerificationPolicy {
+  private identity: string;
+  private issuerPolicy: OIDCIssuer | null;
+
+  constructor(options: { identity: string; issuer?: string }) {
+    this.identity = options.identity;
+    this.issuerPolicy = options.issuer ? new OIDCIssuer(options.issuer) : null;
+  }
+
+  verify(cert: X509Certificate): void {
+    if (this.issuerPolicy) {
+      this.issuerPolicy.verify(cert);
+    }
+
+    const sanExt = cert.extSubjectAltName;
+    if (!sanExt) {
+      throw new PolicyError("Certificate does not contain SubjectAlternativeName extension");
+    }
+
+    const allSans = new Set<string>();
+
+    // Add email (rfc822Name)
+    if (sanExt.rfc822Name) {
+      allSans.add(sanExt.rfc822Name);
+    }
+
+    // Add URI
+    if (sanExt.uri) {
+      allSans.add(sanExt.uri);
+    }
+
+    // Add Sigstore-specific otherName
+    const otherName = sanExt.otherName(EXTENSION_OID_OTHERNAME);
+    if (otherName) {
+      allSans.add(otherName);
+    }
+
+    if (!allSans.has(this.identity)) {
+      throw new PolicyError(
+        `Certificate's SANs do not match ${this.identity}; actual SANs: ${Array.from(allSans).join(", ")}`
+      );
+    }
+  }
+}

package/src/trust/tuf.ts

@@ -57,6 +57,7 @@ export interface TrustedRootProviderOptions {
  */
 const DEFAULT_CONFIG = {
   metadataUrl: 'https://tuf-repo-cdn.sigstore.dev/',
+  targetBaseUrl: 'https://tuf-repo-cdn.sigstore.dev/targets/',
   namespace: 'sigstore-browser',
   trustedRootTarget: 'trusted_root.json',
   cacheTTL: 3600000, // 1 hour
@@ -89,7 +90,8 @@ export class TrustedRootProvider {
   constructor(options: TrustedRootProviderOptions = {}) {
     const metadataUrl = options.metadataUrl || DEFAULT_CONFIG.metadataUrl;
     this.metadataUrl = metadataUrl.endsWith('/') ? metadataUrl : `${metadataUrl}/`;
-    this.targetBaseUrl = options.targetBaseUrl || this.metadataUrl;
+    const targetBaseUrl = options.targetBaseUrl || DEFAULT_CONFIG.targetBaseUrl;
+    this.targetBaseUrl = targetBaseUrl.endsWith('/') ? targetBaseUrl : `${targetBaseUrl}/`;
     this.initialRoot = options.initialRoot;
     this.namespace = options.namespace || DEFAULT_CONFIG.namespace;
     this.trustedRootTarget = options.trustedRootTarget || DEFAULT_CONFIG.trustedRootTarget;

package/src/x509/cert.ts

@@ -26,26 +26,69 @@ import { DEFAULT_HASH_ALGORITHM, ECDSA_CURVE_NAMES, ECDSA_SIGNATURE_ALGOS, OID_R
 import {
   X509AuthorityKeyIDExtension,
   X509BasicConstraintsExtension,
+  X509BuildConfigDigestExtension,
+  X509BuildConfigURIExtension,
+  X509BuildSignerDigestExtension,
+  X509BuildSignerURIExtension,
+  X509BuildTriggerExtension,
   X509Extension,
   X509FulcioIssuerV1,
   X509FulcioIssuerV2,
+  X509GitHubWorkflowNameExtension,
+  X509GitHubWorkflowRefExtension,
+  X509GitHubWorkflowRepositoryExtension,
+  X509GitHubWorkflowSHAExtension,
+  X509GitHubWorkflowTriggerExtension,
   X509KeyUsageExtension,
+  X509RunInvocationURIExtension,
+  X509RunnerEnvironmentExtension,
   X509SCTExtension,
+  X509SourceRepositoryDigestExtension,
+  X509SourceRepositoryIdentifierExtension,
+  X509SourceRepositoryOwnerIdentifierExtension,
+  X509SourceRepositoryOwnerURIExtension,
+  X509SourceRepositoryRefExtension,
+  X509SourceRepositoryURIExtension,
+  X509SourceRepositoryVisibilityExtension,
   X509SubjectAlternativeNameExtension,
   X509SubjectKeyIDExtension,
 } from "./ext.js";
 
-// https://github.com/sigstore/fulcio/blob/main/docs/oid-info.md
+// Standard X.509 extension OIDs
 const EXTENSION_OID_SUBJECT_KEY_ID = "2.5.29.14";
 const EXTENSION_OID_KEY_USAGE = "2.5.29.15";
 const EXTENSION_OID_SUBJECT_ALT_NAME = "2.5.29.17";
 const EXTENSION_OID_BASIC_CONSTRAINTS = "2.5.29.19";
 const EXTENSION_OID_AUTHORITY_KEY_ID = "2.5.29.35";
-const EXTENSION_OID_FULCIO_ISSUER_V1 = "1.3.6.1.4.1.57264.1.1";
-const EXTENSION_OID_FULCIO_ISSUER_V2 = "1.3.6.1.4.1.57264.1.8";
 
+// CT Log SCT extension OID
 export const EXTENSION_OID_SCT = "1.3.6.1.4.1.11129.2.4.2";
 
+// Fulcio extension OIDs
+// https://github.com/sigstore/fulcio/blob/main/docs/oid-info.md
+export const EXTENSION_OID_FULCIO_ISSUER_V1 = "1.3.6.1.4.1.57264.1.1";
+export const EXTENSION_OID_GITHUB_WORKFLOW_TRIGGER = "1.3.6.1.4.1.57264.1.2";
+export const EXTENSION_OID_GITHUB_WORKFLOW_SHA = "1.3.6.1.4.1.57264.1.3";
+export const EXTENSION_OID_GITHUB_WORKFLOW_NAME = "1.3.6.1.4.1.57264.1.4";
+export const EXTENSION_OID_GITHUB_WORKFLOW_REPOSITORY = "1.3.6.1.4.1.57264.1.5";
+export const EXTENSION_OID_GITHUB_WORKFLOW_REF = "1.3.6.1.4.1.57264.1.6";
+export const EXTENSION_OID_OTHERNAME = "1.3.6.1.4.1.57264.1.7";
+export const EXTENSION_OID_FULCIO_ISSUER_V2 = "1.3.6.1.4.1.57264.1.8";
+export const EXTENSION_OID_BUILD_SIGNER_URI = "1.3.6.1.4.1.57264.1.9";
+export const EXTENSION_OID_BUILD_SIGNER_DIGEST = "1.3.6.1.4.1.57264.1.10";
+export const EXTENSION_OID_RUNNER_ENVIRONMENT = "1.3.6.1.4.1.57264.1.11";
+export const EXTENSION_OID_SOURCE_REPOSITORY_URI = "1.3.6.1.4.1.57264.1.12";
+export const EXTENSION_OID_SOURCE_REPOSITORY_DIGEST = "1.3.6.1.4.1.57264.1.13";
+export const EXTENSION_OID_SOURCE_REPOSITORY_REF = "1.3.6.1.4.1.57264.1.14";
+export const EXTENSION_OID_SOURCE_REPOSITORY_IDENTIFIER = "1.3.6.1.4.1.57264.1.15";
+export const EXTENSION_OID_SOURCE_REPOSITORY_OWNER_URI = "1.3.6.1.4.1.57264.1.16";
+export const EXTENSION_OID_SOURCE_REPOSITORY_OWNER_IDENTIFIER = "1.3.6.1.4.1.57264.1.17";
+export const EXTENSION_OID_BUILD_CONFIG_URI = "1.3.6.1.4.1.57264.1.18";
+export const EXTENSION_OID_BUILD_CONFIG_DIGEST = "1.3.6.1.4.1.57264.1.19";
+export const EXTENSION_OID_BUILD_TRIGGER = "1.3.6.1.4.1.57264.1.20";
+export const EXTENSION_OID_RUN_INVOCATION_URI = "1.3.6.1.4.1.57264.1.21";
+export const EXTENSION_OID_SOURCE_REPOSITORY_VISIBILITY = "1.3.6.1.4.1.57264.1.22";
+
 export class X509Certificate {
   public root: ASN1Obj;
 
@@ -236,6 +279,101 @@ export class X509Certificate {
     return ext ? new X509FulcioIssuerV2(ext) : undefined;
   }
 
+  get extGitHubWorkflowTrigger(): X509GitHubWorkflowTriggerExtension | undefined {
+    const ext = this.findExtension(EXTENSION_OID_GITHUB_WORKFLOW_TRIGGER);
+    return ext ? new X509GitHubWorkflowTriggerExtension(ext) : undefined;
+  }
+
+  get extGitHubWorkflowSHA(): X509GitHubWorkflowSHAExtension | undefined {
+    const ext = this.findExtension(EXTENSION_OID_GITHUB_WORKFLOW_SHA);
+    return ext ? new X509GitHubWorkflowSHAExtension(ext) : undefined;
+  }
+
+  get extGitHubWorkflowName(): X509GitHubWorkflowNameExtension | undefined {
+    const ext = this.findExtension(EXTENSION_OID_GITHUB_WORKFLOW_NAME);
+    return ext ? new X509GitHubWorkflowNameExtension(ext) : undefined;
+  }
+
+  get extGitHubWorkflowRepository(): X509GitHubWorkflowRepositoryExtension | undefined {
+    const ext = this.findExtension(EXTENSION_OID_GITHUB_WORKFLOW_REPOSITORY);
+    return ext ? new X509GitHubWorkflowRepositoryExtension(ext) : undefined;
+  }
+
+  get extGitHubWorkflowRef(): X509GitHubWorkflowRefExtension | undefined {
+    const ext = this.findExtension(EXTENSION_OID_GITHUB_WORKFLOW_REF);
+    return ext ? new X509GitHubWorkflowRefExtension(ext) : undefined;
+  }
+
+  get extBuildSignerURI(): X509BuildSignerURIExtension | undefined {
+    const ext = this.findExtension(EXTENSION_OID_BUILD_SIGNER_URI);
+    return ext ? new X509BuildSignerURIExtension(ext) : undefined;
+  }
+
+  get extBuildSignerDigest(): X509BuildSignerDigestExtension | undefined {
+    const ext = this.findExtension(EXTENSION_OID_BUILD_SIGNER_DIGEST);
+    return ext ? new X509BuildSignerDigestExtension(ext) : undefined;
+  }
+
+  get extRunnerEnvironment(): X509RunnerEnvironmentExtension | undefined {
+    const ext = this.findExtension(EXTENSION_OID_RUNNER_ENVIRONMENT);
+    return ext ? new X509RunnerEnvironmentExtension(ext) : undefined;
+  }
+
+  get extSourceRepositoryURI(): X509SourceRepositoryURIExtension | undefined {
+    const ext = this.findExtension(EXTENSION_OID_SOURCE_REPOSITORY_URI);
+    return ext ? new X509SourceRepositoryURIExtension(ext) : undefined;
+  }
+
+  get extSourceRepositoryDigest(): X509SourceRepositoryDigestExtension | undefined {
+    const ext = this.findExtension(EXTENSION_OID_SOURCE_REPOSITORY_DIGEST);
+    return ext ? new X509SourceRepositoryDigestExtension(ext) : undefined;
+  }
+
+  get extSourceRepositoryRef(): X509SourceRepositoryRefExtension | undefined {
+    const ext = this.findExtension(EXTENSION_OID_SOURCE_REPOSITORY_REF);
+    return ext ? new X509SourceRepositoryRefExtension(ext) : undefined;
+  }
+
+  get extSourceRepositoryIdentifier(): X509SourceRepositoryIdentifierExtension | undefined {
+    const ext = this.findExtension(EXTENSION_OID_SOURCE_REPOSITORY_IDENTIFIER);
+    return ext ? new X509SourceRepositoryIdentifierExtension(ext) : undefined;
+  }
+
+  get extSourceRepositoryOwnerURI(): X509SourceRepositoryOwnerURIExtension | undefined {
+    const ext = this.findExtension(EXTENSION_OID_SOURCE_REPOSITORY_OWNER_URI);
+    return ext ? new X509SourceRepositoryOwnerURIExtension(ext) : undefined;
+  }
+
+  get extSourceRepositoryOwnerIdentifier(): X509SourceRepositoryOwnerIdentifierExtension | undefined {
+    const ext = this.findExtension(EXTENSION_OID_SOURCE_REPOSITORY_OWNER_IDENTIFIER);
+    return ext ? new X509SourceRepositoryOwnerIdentifierExtension(ext) : undefined;
+  }
+
+  get extBuildConfigURI(): X509BuildConfigURIExtension | undefined {
+    const ext = this.findExtension(EXTENSION_OID_BUILD_CONFIG_URI);
+    return ext ? new X509BuildConfigURIExtension(ext) : undefined;
+  }
+
+  get extBuildConfigDigest(): X509BuildConfigDigestExtension | undefined {
+    const ext = this.findExtension(EXTENSION_OID_BUILD_CONFIG_DIGEST);
+    return ext ? new X509BuildConfigDigestExtension(ext) : undefined;
+  }
+
+  get extBuildTrigger(): X509BuildTriggerExtension | undefined {
+    const ext = this.findExtension(EXTENSION_OID_BUILD_TRIGGER);
+    return ext ? new X509BuildTriggerExtension(ext) : undefined;
+  }
+
+  get extRunInvocationURI(): X509RunInvocationURIExtension | undefined {
+    const ext = this.findExtension(EXTENSION_OID_RUN_INVOCATION_URI);
+    return ext ? new X509RunInvocationURIExtension(ext) : undefined;
+  }
+
+  get extSourceRepositoryVisibility(): X509SourceRepositoryVisibilityExtension | undefined {
+    const ext = this.findExtension(EXTENSION_OID_SOURCE_REPOSITORY_VISIBILITY);
+    return ext ? new X509SourceRepositoryVisibilityExtension(ext) : undefined;
+  }
+
   get isCA(): boolean {
     const ca = this.extBasicConstraints?.isCA || false;