@intyga/verify 0.0.0-bootstrap.0 → 1.1.0

package/dist/ledger-rfc3161.js

@@ -0,0 +1,345 @@
+import { spawn, spawnSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { isAbsolute, join, resolve } from "node:path";
+import { anchorDigest, isWellFormedAnchor } from "./ledger-anchor.js";
+const LIMIT = 1024 * 1024;
+const FAILURE = "RFC 3161 token could not be verified under the supplied TSA trust and time policy";
+// Only framing and TSTInfo time are read here. CMS, ESSCertID, signature, imprint, EKU and X.509
+// validation belong to OpenSSL; this is deliberately not a second cryptographic ASN.1 stack.
+function field(b, offset) {
+    const tag = b[offset], first = b[offset + 1];
+    if (tag === undefined || first === undefined)
+        throw new Error(FAILURE);
+    let start = offset + 2, length = first;
+    if (first >= 128) {
+        const n = first & 127;
+        if (n === 0 || n > 4 || b[start] === 0 || start + n > b.length)
+            throw new Error(FAILURE);
+        length = 0;
+        for (let i = 0; i < n; i++) {
+            const byte = b[start + i];
+            if (byte === undefined)
+                throw new Error(FAILURE);
+            length = length * 256 + byte;
+        }
+        if (length < 128)
+            throw new Error(FAILURE);
+        start += n;
+    }
+    if (start + length > b.length)
+        throw new Error(FAILURE);
+    return { tag, start, end: start + length };
+}
+function sequence(b) {
+    const f = field(b, 0);
+    if (f.tag !== 0x30 || f.end !== b.length)
+        throw new Error(FAILURE);
+    return b.subarray(f.start, f.end);
+}
+function children(b) {
+    const out = [];
+    for (let offset = 0; offset < b.length;) {
+        const f = field(b, offset);
+        if (out.length >= 8)
+            throw new Error(FAILURE);
+        out.push({ tag: f.tag, value: b.subarray(f.start, f.end) });
+        offset = f.end;
+    }
+    return out;
+}
+function cmsDigest(token) {
+    const algorithm = (b) => {
+        const a = children(b);
+        if (a[0]?.tag !== 6 || a.length > 2 || (a[1] && (a[1].tag !== 5 || a[1].value.length !== 0)))
+            throw new Error(FAILURE);
+        const oid = a[0].value.toString("hex");
+        if (!["608648016503040201", "608648016503040202", "608648016503040203"].includes(oid))
+            throw new Error(FAILURE);
+        return oid;
+    };
+    const content = children(sequence(token));
+    if (content.length !== 2 ||
+        content[0]?.tag !== 6 ||
+        content[0].value.toString("hex") !== "2a864886f70d010702" ||
+        content[1]?.tag !== 0xa0)
+        throw new Error(FAILURE);
+    const data = children(sequence(content[1].value));
+    if (data[0]?.tag !== 2 || data[1]?.tag !== 0x31 || data[2]?.tag !== 0x30)
+        throw new Error(FAILURE);
+    const declared = children(data[1].value);
+    if (declared.length !== 1 || declared[0]?.tag !== 0x30)
+        throw new Error(FAILURE);
+    const digest = algorithm(declared[0].value);
+    let i = 3;
+    if (data[i]?.tag === 0xa0)
+        i++;
+    if (data[i]?.tag === 0xa1)
+        i++;
+    const signerInfos = data[i];
+    if (data.length !== i + 1 || signerInfos?.tag !== 0x31)
+        throw new Error(FAILURE);
+    const signers = children(signerInfos.value);
+    if (signers.length !== 1 || signers[0]?.tag !== 0x30)
+        throw new Error(FAILURE);
+    const signer = children(signers[0].value);
+    if (signer[0]?.tag !== 2 ||
+        ![0x30, 0x80].includes(signer[1]?.tag ?? -1) ||
+        signer[2]?.tag !== 0x30 ||
+        algorithm(signer[2].value) !== digest)
+        throw new Error(FAILURE);
+}
+function timestamp(info, now) {
+    const b = sequence(info);
+    let offset = 0;
+    for (const tag of [2, 6, 0x30, 2]) {
+        const f = field(b, offset);
+        if (f.tag !== tag)
+            throw new Error(FAILURE);
+        if (offset === 0 && (f.end - f.start !== 1 || b[f.start] !== 1))
+            throw new Error(FAILURE);
+        offset = f.end;
+    }
+    const f = field(b, offset);
+    if (f.tag !== 0x18)
+        throw new Error(FAILURE);
+    const t = b.subarray(f.start, f.end).toString("utf8");
+    if (!/^\d{14}(?:\.\d*[1-9])?Z$/.test(t))
+        throw new Error(FAILURE);
+    const iso = `${t.slice(0, 4)}-${t.slice(4, 6)}-${t.slice(6, 8)}T${t.slice(8, 10)}:${t.slice(10, 12)}:${t.slice(12, 14)}.000Z`;
+    const d = new Date(iso), seconds = d.getTime() / 1000;
+    if (!Number.isFinite(seconds) ||
+        d.toISOString() !== iso ||
+        seconds < 0 ||
+        seconds > now ||
+        (t.includes(".") && seconds === now))
+        throw new Error(FAILURE);
+    return seconds;
+}
+function boundedText(value, required = false) {
+    return value === undefined
+        ? !required
+        : typeof value === "string" &&
+            Buffer.byteLength(value, "utf8") <= LIMIT &&
+            (!required || value.length > 0);
+}
+/** Offline RFC 3161 verification. No shell, downloads, OS trust store, or implicit TSA trust. */
+export function verifyRfc3161Anchor(anchor, trust) {
+    try {
+        if (anchor.kind !== "RFC3161" ||
+            !isWellFormedAnchor(anchor) ||
+            !["ES256", "Ed25519", "RSA-PSS"].includes(anchor.algorithm) ||
+            typeof anchor.issuer !== "string" ||
+            typeof anchor.timestamp !== "string")
+            return { ok: false, reason: FAILURE };
+        return verifyRfc3161Timestamp(anchor.evidence, anchorDigest(anchor), trust);
+    }
+    catch {
+        return { ok: false, reason: FAILURE };
+    }
+}
+function runSync(command) {
+    const r = spawnSync(command.executable, command.args, {
+        cwd: command.cwd,
+        env: command.env,
+        timeout: 5000,
+        killSignal: "SIGKILL",
+        stdio: "ignore",
+    });
+    return !r.error && r.status === 0;
+}
+function runAsync(command) {
+    return new Promise((resolveResult) => {
+        const child = spawn(command.executable, command.args, {
+            cwd: command.cwd,
+            env: command.env,
+            stdio: "ignore",
+        });
+        let failed = false;
+        const timer = setTimeout(() => {
+            failed = true;
+            child.kill("SIGKILL");
+        }, 5000);
+        child.on("error", () => {
+            failed = true;
+        });
+        // close follows error or exit and ensures the child has been reaped before temp cleanup.
+        child.on("close", (code) => {
+            clearTimeout(timer);
+            resolveResult(!failed && code === 0);
+        });
+    });
+}
+export function verifyRfc3161Timestamp(evidence, digest, trust, request) {
+    const checks = timestampChecks(evidence, digest, trust, request);
+    try {
+        let next = checks.next();
+        while (!next.done) {
+            if (!runSync(next.value))
+                return { ok: false, reason: FAILURE };
+            next = checks.next();
+        }
+        return next.value;
+    }
+    catch {
+        return { ok: false, reason: FAILURE };
+    }
+    finally {
+        checks.return({ ok: false, reason: FAILURE });
+    }
+}
+/** Asynchronous producer equivalent: identical checks without blocking the gateway event loop. */
+export async function verifyRfc3161TimestampAsync(evidence, digest, trust, request) {
+    const checks = timestampChecks(evidence, digest, trust, request);
+    try {
+        let next = checks.next();
+        while (!next.done) {
+            if (!(await runAsync(next.value)))
+                return { ok: false, reason: FAILURE };
+            next = checks.next();
+        }
+        return next.value;
+    }
+    catch {
+        return { ok: false, reason: FAILURE };
+    }
+    finally {
+        checks.return({ ok: false, reason: FAILURE });
+    }
+}
+function* timestampChecks(evidence, digest, trust, request) {
+    let dir;
+    try {
+        const now = trust?.verificationTime ?? Math.ceil(Date.now() / 1000);
+        if (!trust ||
+            !boundedText(trust.caPem, true) ||
+            !boundedText(trust.crlPem) ||
+            !boundedText(trust.untrustedPem) ||
+            !/^[0-9a-f]{64}$/.test(trust.signerCertificateSha256) ||
+            !["crl", "unchecked"].includes(trust.revocation) ||
+            (trust.revocation === "crl" && !boundedText(trust.crlPem, true)) ||
+            !Number.isSafeInteger(now) ||
+            now < 0 ||
+            now > 253402300799 ||
+            (trust.opensslPath !== undefined &&
+                (typeof trust.opensslPath !== "string" || !trust.opensslPath || trust.opensslPath.includes("\0"))) ||
+            !(digest instanceof Uint8Array) ||
+            digest.length !== 32 ||
+            (request !== undefined && (request.length === 0 || request.length > LIMIT)) ||
+            typeof evidence !== "string" ||
+            evidence.length > Math.ceil(LIMIT / 3) * 4)
+            return { ok: false, reason: FAILURE };
+        const token = Buffer.from(evidence, "base64");
+        if (token.length === 0 || token.length > LIMIT || token.toString("base64") !== evidence)
+            return { ok: false, reason: FAILURE };
+        cmsDigest(token);
+        // `dir` (outer) is what `finally` removes; `workDir` is the same path, typed as present.
+        const workDir = mkdtempSync(join(tmpdir(), "intyga-tsa-"));
+        dir = workDir;
+        const path = (name) => join(workDir, name);
+        const write = (name, value) => writeFileSync(path(name), value, { mode: 0o600 });
+        const read = (name) => {
+            if (statSync(path(name)).size > LIMIT)
+                throw new Error(FAILURE);
+            return readFileSync(path(name));
+        };
+        mkdirSync(path("empty"), { mode: 0o700 });
+        write("openssl.cnf", "");
+        write("token.der", token);
+        write("trust.pem", `${trust.caPem}\n${trust.crlPem ?? ""}`);
+        if (trust.untrustedPem)
+            write("intermediates.pem", trust.untrustedPem);
+        write("query.tsq", Buffer.concat([
+            Buffer.from("30360201013031300d060960864801650304020105000420", "hex"),
+            Buffer.from(digest),
+        ]));
+        const executable = trust.opensslPath ?? "openssl";
+        const openssl = !isAbsolute(executable) && /[\\/]/.test(executable) ? resolve(executable) : executable;
+        const command = (args) => ({
+            executable: openssl,
+            args,
+            cwd: workDir,
+            env: {
+                ...process.env,
+                OPENSSL_CONF: path("openssl.cnf"),
+                SSL_CERT_FILE: path("trust.pem"),
+                SSL_CERT_DIR: path("empty"),
+            },
+        });
+        yield command([
+            "cms",
+            "-verify",
+            "-binary",
+            "-inform",
+            "DER",
+            "-in",
+            path("token.der"),
+            "-noverify",
+            "-signer",
+            path("signer.pem"),
+            "-out",
+            path("info.der"),
+        ]);
+        const signer = read("signer.pem").toString("ascii");
+        const cert = /^-----BEGIN CERTIFICATE-----\r?\n([A-Za-z0-9+/=\r\n]+)-----END CERTIFICATE-----\s*$/.exec(signer);
+        const body = cert?.[1];
+        if (body === undefined)
+            throw new Error(FAILURE);
+        const der = Buffer.from(body.replace(/\s/g, ""), "base64");
+        if (createHash("sha256").update(der).digest("hex") !== trust.signerCertificateSha256)
+            throw new Error(FAILURE);
+        const genTime = timestamp(read("info.der"), now);
+        // `ts -verify` never loads OpenSSL's default trust locations; it trusts only what is passed. No
+        // `-CAstore`: OpenSSL 3.0 loads a store URI eagerly and fails on an empty one (3.5 is lazy), which
+        // made every valid token fail closed on Ubuntu 24.04's 3.0.13.
+        const args = [
+            "ts",
+            "-verify",
+            "-token_in",
+            "-in",
+            path("token.der"),
+            "-queryfile",
+            path("query.tsq"),
+            "-CAfile",
+            path("trust.pem"),
+            "-CApath",
+            path("empty"),
+            "-auth_level",
+            "2",
+            "-x509_strict",
+        ];
+        if (trust.untrustedPem)
+            args.push("-untrusted", path("intermediates.pem"));
+        yield command([
+            ...args,
+            "-attime",
+            String(now),
+            ...(trust.revocation === "crl" ? ["-crl_check_all"] : []),
+        ]);
+        if (request) {
+            write("original.tsq", Buffer.from(request));
+            yield command([
+                ...args.map((arg) => (arg === path("query.tsq") ? path("original.tsq") : arg)),
+                "-attime",
+                String(now),
+            ]);
+        }
+        // Historical certificate validity is checked independently of current CRL freshness.
+        yield command([...args, "-attime", String(genTime)]);
+        return { ok: true, genTime };
+    }
+    catch {
+        return { ok: false, reason: FAILURE };
+    }
+    finally {
+        if (dir) {
+            try {
+                rmSync(dir, { recursive: true, force: true });
+            }
+            catch {
+                /* Result remains fail-closed; no secrets are written. */
+            }
+        }
+    }
+}

package/dist/ledger-signature.d.ts

@@ -0,0 +1,16 @@
+import type { AuditLeaf } from "./ledger-leaf.js";
+/** Caller-owned identity/key mapping. WebAuthn keys use base64 COSE_Key; ES256 keys use SPKI. */
+export interface AuditSignaturePolicy {
+    trustedSigners: Record<string, string[]>;
+    expectedOrigin?: string;
+    expectedRpId?: string;
+}
+export interface AuditSignatureCheck {
+    status: "verified" | "invalid" | "not_checked" | "not_applicable";
+    reason: string;
+    /** True only when the signature verified under a caller-provisioned key for this signer DID. */
+    trusted: boolean;
+}
+export declare const uncheckedSignature: () => AuditSignatureCheck;
+/** Signature over the committed payload only — never a quorum, authorization or hardware verdict. */
+export declare function verifyAuditSignature(c: AuditLeaf, policy?: AuditSignaturePolicy): AuditSignatureCheck;

package/dist/ledger-signature.js

@@ -0,0 +1,61 @@
+import { verifyWebAuthnWitness } from "./index.js";
+import { verifyEmbeddedSignature } from "./ledger-bundle.js";
+export const uncheckedSignature = () => ({
+    status: "not_checked",
+    reason: "Content not verified or unavailable.",
+    trusted: false,
+});
+/** Signature over the committed payload only — never a quorum, authorization or hardware verdict. */
+export function verifyAuditSignature(c, policy) {
+    const result = (status, reason, trusted = false) => ({ status, reason, trusted });
+    if (!c.sigAlg && (c.signature || c.signedPayload || c.signerPublicKey))
+        return result("not_checked", "Signature algorithm is missing.");
+    if (!c.sigAlg || c.sigAlg === "AUTO_APPROVED")
+        return result("not_applicable", "No human signature is declared.");
+    if (c.sigAlg !== "ES256" && c.sigAlg !== "WEBAUTHN")
+        return result("not_checked", "Unsupported signature algorithm.");
+    if (!c.signature || !c.signedPayload)
+        return result("not_checked", "Signature or signed payload is missing.");
+    // Preserve the legacy ES256 mathematical check, but never mistake an embedded key for trust.
+    if (!policy && c.sigAlg === "ES256") {
+        if (!c.signerPublicKey)
+            return result("not_checked", "Signer public key is missing.");
+        return verifyEmbeddedSignature(c)
+            ? result("verified", "Signature valid under embedded key; signer identity is not established.")
+            : result("invalid", "Signature does not verify.");
+    }
+    const keys = c.signerDid && policy?.trustedSigners && Object.hasOwn(policy.trustedSigners, c.signerDid)
+        ? policy.trustedSigners[c.signerDid]
+        : undefined;
+    if (!Array.isArray(keys) || keys.length === 0 || !keys.every((k) => typeof k === "string" && k.length > 0))
+        return result("not_checked", "No caller-trusted key for this signer.");
+    if (c.sigAlg === "WEBAUTHN" && (!policy?.expectedOrigin || !policy.expectedRpId))
+        return result("not_checked", "Caller-selected WebAuthn origin and RP ID are required.");
+    const m = c.metadata && typeof c.metadata === "object" ? c.metadata : {};
+    const w = m.webauthn && typeof m.webauthn === "object" ? m.webauthn : {};
+    if (c.sigAlg === "WEBAUTHN" &&
+        (typeof w.authenticatorData !== "string" ||
+            !w.authenticatorData ||
+            typeof w.clientDataJSON !== "string" ||
+            !w.clientDataJSON))
+        return result("not_checked", "WebAuthn authenticatorData or clientDataJSON is missing.");
+    for (const key of keys) {
+        const valid = c.sigAlg === "ES256"
+            ? verifyEmbeddedSignature({ ...c, signerPublicKey: key })
+            : Buffer.from(key, "base64")[0] !== 0x30 &&
+                verifyWebAuthnWitness({
+                    signedPayload: c.signedPayload,
+                    signature: c.signature,
+                    publicKey: key,
+                    authenticatorData: w.authenticatorData,
+                    clientDataJSON: w.clientDataJSON,
+                }, {
+                    expectedOrigin: policy?.expectedOrigin ?? "",
+                    expectedRpId: policy?.expectedRpId ?? "",
+                    requireUserVerification: true,
+                }).ok;
+        if (valid)
+            return result("verified", "Signature valid under caller-trusted signer key.", true);
+    }
+    return result("invalid", "Signature or WebAuthn assertion does not verify under caller trust.");
+}

package/package.json

@@ -1,9 +1,62 @@
 {
   "name": "@intyga/verify",
-  "version": "0.0.0-bootstrap.0",
-  "description": "Placeholder that only reserves this package for the INTYGA release workflow. It contains no code. Real versions are published from the release workflow.",
+  "version": "1.1.0",
+  "description": "Independently verify INTYGA approval receipts — confirm a human cryptographically approved exactly the action about to run, with NO INTYGA secret. Zero npm runtime dependencies; optional OpenSSL 3 for timestamps.",
   "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/intyga-dev/verify.git"
+  },
   "homepage": "https://www.intyga.com",
-  "files": ["README.md"],
-  "publishConfig": { "access": "public", "tag": "bootstrap" }
+  "bugs": "https://github.com/intyga-dev/verify/issues",
+  "keywords": [
+    "verification",
+    "receipts",
+    "webauthn",
+    "es256",
+    "audit",
+    "offline",
+    "zero-dependency"
+  ],
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
+    },
+    "./approval-policy": {
+      "types": "./dist/approval-policy.d.ts",
+      "import": "./dist/approval-policy.js",
+      "default": "./dist/approval-policy.js"
+    }
+  },
+  "files": [
+    "dist",
+    "!dist/scripts",
+    "README.md",
+    "LICENSE",
+    "CHANGELOG.md"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "scripts": {
+    "build": "rm -rf dist && tsc",
+    "generate:parity-vectors": "node --import tsx src/scripts/generate-verifier-parity-vectors.ts",
+    "typecheck": "tsc --noEmit",
+    "test": "tsx --test 'src/**/*.test.ts'",
+    "test:coverage": "tsx --test --experimental-test-coverage --test-coverage-lines=94 --test-coverage-branches=80 --test-coverage-functions=98 --test-coverage-exclude='../**' --test-coverage-exclude='src/**/*.test.ts' 'src/**/*.test.ts'"
+  },
+  "devDependencies": {
+    "@types/node": "^26.4.0",
+    "ajv": "^8.20.0",
+    "tsx": "4.23.12",
+    "typescript": "^5.9.3"
+  }
 }