@macula-io/martha 0.0.0-stage → 1.0.0

package/node_modules/sigstore/README.md

@@ -0,0 +1,219 @@
+# sigstore · [![npm version](https://img.shields.io/npm/v/sigstore.svg?style=flat)](https://www.npmjs.com/package/sigstore) [![CI Status](https://github.com/sigstore/sigstore-js/workflows/CI/badge.svg)](https://github.com/sigstore/sigstore-js/actions/workflows/ci.yml) [![Smoke test](https://github.com/sigstore/sigstore-js/actions/workflows/smoke-test.yml/badge.svg)](https://github.com/sigstore/sigstore-js/actions/workflows/smoke-test.yml)
+
+A JavaScript library for generating and verifying Sigstore signatures. One of
+the intended uses is to sign and verify npm packages but it can be used to sign
+and verify any file.
+
+## Features
+
+- Support for signing using an OpenID Connect identity
+- Support for publishing signatures to a [Rekor][1] instance
+- Support for verifying Sigstore bundles
+
+## Prerequisites
+
+- Node.js version ^22.22.2 || ^24.15.0 || >=26.0.0
+
+## Installation
+
+```
+npm install sigstore
+```
+
+## Compatibility
+
+The following table documents which combinations of Sigstore bundle versions
+and Rekor types can be verified by different versions of the `sigstore`
+library. It also lists which `sigstore` versions were shipped with different
+`npm` CLI versions.
+
+<table>
+  <thead>
+    <tr>
+      <th colspan=2><code>sigstore</code></th>
+      <th>1.0</th>
+      <th>1.1</th>
+      <th>1.2</th>
+      <th>1.3</th>
+      <th>1.4</th>
+      <th>1.5</th>
+      <th>1.6</th>
+      <th>1.7</th>
+      <th>1.8</th>
+    </tr>
+    <tr>
+      <th colspan=2><code>npm</code></th>
+      <th>9.5.0</th>
+      <th>9.6.2</th>
+      <th>9.6.3</th>
+      <th>9.6.5</th>
+      <th>9.6.6</th>
+      <th>9.6.7</th>
+      <th>9.7.2</th>
+      <th>9.8.0</th>
+      <th></th>
+    </tr>
+    <tr>
+      <th>Bundle Version</th>
+      <th>Rekor Type</th>
+      <th colspan=9></th>
+    </tr>
+  </thead>
+  <tbody>
+    <tr>
+      <td rowspan=3>0.1</td>
+      <td>hashedrekord</td>
+      <td>:white_check_mark:</td>
+      <td>:white_check_mark:</td>
+      <td>:white_check_mark:</td>
+      <td>:white_check_mark:</td>
+      <td>:white_check_mark:</td>
+      <td>:white_check_mark:</td>
+      <td>:white_check_mark:</td>
+      <td>:white_check_mark:</td>
+      <td>:white_check_mark:</td>
+    </tr>
+    <tr>
+      <td>intoto</td>
+      <td>:white_check_mark:</td>
+      <td>:white_check_mark:</td>
+      <td>:white_check_mark:</td>
+      <td>:white_check_mark:</td>
+      <td>:white_check_mark:</td>
+      <td>:white_check_mark:</td>
+      <td>:white_check_mark:</td>
+      <td>:white_check_mark:</td>
+      <td>:white_check_mark:</td>
+    </tr>
+    <tr>
+      <td>dsse</td>
+      <td>:x:</td>
+      <td>:x:</td>
+      <td>:x:</td>
+      <td>:x:</td>
+      <td>:x:</td>
+      <td>:x:</td>
+      <td>:white_check_mark:</td>
+      <td>:white_check_mark:</td>
+      <td>:white_check_mark:</td>
+    </tr>
+    <tr>
+      <td rowspan=3>0.2</td>
+      <td>hashedrekord</td>
+      <td>:white_check_mark:</td>
+      <td>:white_check_mark:</td>
+      <td>:white_check_mark:</td>
+      <td>:white_check_mark:</td>
+      <td>:white_check_mark:</td>
+      <td>:white_check_mark:</td>
+      <td>:white_check_mark:</td>
+      <td>:white_check_mark:</td>
+      <td>:white_check_mark:</td>
+    </tr>
+    <tr>
+      <td>intoto</td>
+      <td>:white_check_mark:</td>
+      <td>:white_check_mark:</td>
+      <td>:white_check_mark:</td>
+      <td>:white_check_mark:</td>
+      <td>:white_check_mark:</td>
+      <td>:white_check_mark:</td>
+      <td>:white_check_mark:</td>
+      <td>:white_check_mark:</td>
+      <td>:white_check_mark:</td>
+    </tr>
+    <tr>
+      <td>dsse</td>
+      <td>:x:</td>
+      <td>:x:</td>
+      <td>:x:</td>
+      <td>:x:</td>
+      <td>:x:</td>
+      <td>:x:</td>
+      <td>:white_check_mark:</td>
+      <td>:white_check_mark:</td>
+      <td>:white_check_mark:</td>
+    </tr>
+  </tbody>
+</table>
+
+## Usage
+
+```javascript
+const { attest, verify } = require('sigstore');
+```
+
+```javascript
+import { attest, verify } from 'sigstore';
+```
+
+### sign(payload[, options])
+
+Generates a Sigstore signature for the supplied payload. Returns a
+[Sigstore bundle][2] containing the signature and the verification material
+necessary to verify the signature.
+
+- `payload` `<Buffer>`: The bytes of the artifact to be signed.
+- `options` `<Object>`
+  - `fulcioURL` `<string>`: The base URL of the Fulcio instance to use for retrieving the signing certificate. Defaults to `'https://fulcio.sigstore.dev'`.
+  - `rekorURL` `<string>`: The base URL of the Rekor instance to use when adding the signature to the transparency log. Defaults to `'https://rekor.sigstore.dev'`.
+  - `tsaServerURL` `<string>`: The base URL of the Timestamp Authority instance to use when requesting a signed timestamp. If omitted, no timestamp will be requested.
+  - `tlogUpload` `<boolean>`: Flag indicating whether or not the signature should be recorded on the Rekor transparency log. Defaults to `true`.
+  - `identityToken` `<string>`: The OIDC token identifying the signer. If no explicit token is supplied, an attempt will be made to retrieve one from the environment. This config cannot be used with `identityProvider`.
+  - `identityProvider` `<IdentityProvider>`: Object which implements `getToken: () => Promise<string>`. The supplied provider will be used to retrieve an OIDC token. If no provider is supplied, an attempt will be made to retrieve an OIDC token from the environment. This config cannot be used with `identityToken`.
+  - `legacyCompatibility` `<boolean>`: Flag indicating whether to enable legacy compatibility mode. When set to `true`, the returned bundle will use the Sigstore v0.2 bundle format. When unset or `false`, the returned bundle will be v0.3 or greater.
+
+### attest(payload, payloadType[, options])
+
+Generates a Sigstore signature for the supplied in-toto statement. Returns a
+[Sigstore bundle][2] containing the [DSSE][3]-wrapped statement and signature
+as well as the verification material necessary to verify the signature.
+
+- `payload` `<Buffer>`: The bytes of the statement to be signed.
+- `payloadType` `<string>`: MIME or content type describing the statement to be signed.
+- `options` `<Object>`
+  - `fulcioURL` `<string>`: The base URL of the Fulcio instance to use for retrieving the signing certificate. Defaults to `'https://fulcio.sigstore.dev'`.
+  - `rekorURL` `<string>`: The base URL of the Rekor instance to use when adding the signature to the transparency log. Defaults to `'https://rekor.sigstore.dev'`.
+  - `tsaServerURL` `<string>`: The base URL of the Timestamp Authority instance to use when requesting a signed timestamp. If omitted, no timestamp will be requested.
+  - `tlogUpload` `<boolean>`: Flag indicating whether or not the signed statement should be recorded on the Rekor transparency log. Defaults to `true`.
+  - `identityToken` `<string>`: The OIDC token identifying the signer. If no explicit token is supplied, an attempt will be made to retrieve one from the environment. This config cannot be used with `identityProvider`.
+  - `identityProvider` `<IdentityProvider>`: Object which implements `getToken: () => Promise<string>`. The supplied provider will be used to retrieve an OIDC token. If no provider is supplied, an attempt will be made to retrieve an OIDC token from the environment. This config cannot be used with `identityToken`.
+  - `legacyCompatibility` `<boolean>`: Flag indicating whether to enable legacy compatibility mode. When set to `true`, any record written to the Rekor transparency log will use the "intoto" record type and the returned bundle will use the Sigstore v0.2 bundle format. When unset or `false`, the "dsse" Rekor type will be used and the returned bundle will be v0.3 or greater.
+
+### verify(bundle[, payload][, options])
+
+Verifies the signature in the supplied bundle. Returns a `Signer` object containing the public key and identity information from the verification.
+
+- `bundle` `<Bundle>`: The Sigstore bundle containing the signature to be verified and the verification material necessary to verify the signature.
+- `payload` `<Buffer>`: The bytes of the artifact over which the signature was created. Only necessary when the `sign` function was used to generate the signature since the Bundle does not contain any information about the artifact which was signed. Not required when the `attest` function was used to generate the Bundle.
+- `options` `<Object>`
+  - `ctLogThreshold` `<number>`: The number of certificate transparency logs on which the signing certificate must appear. Defaults to `1`.
+  - `tlogThreshold` `<number>`: The number of transparency logs on which the signature must appear. Defaults to `1`.
+  - `certificateIssuer` `<string>`: Value that must appear in the signing certificate's issuer extension (OID 1.3.6.1.4.1.57264.1.1). Not verified if no value is supplied.
+  - `certificateIdentityEmail` `<string>`: Email address expected in the signing certificate's Subject Alternative Name (SAN) extension. The value is matched as a regular expression against the SAN; for exact matching, use an anchored pattern (e.g. `^user@example\\.com$`). Must be specified in conjunction with the `certificateIssuer` option. Takes precedence over the `certificateIdentityURI` option. Not verified if no value is supplied.
+  - `certificateIdentityURI` `<string>`: URI expected in the signing certificate's Subject Alternative Name (SAN) extension. The value is matched as a regular expression against the SAN; for exact matching, use an anchored pattern (e.g. `^https://github\\.com/owner/repo$`). Must be specified in conjunction with the `certificateIssuer` option. Ignored if the `certificateIdentityEmail` option is set. Not verified if no value is supplied.
+  - `certificateOIDs` `<Object>`: A collection of OID/value pairs which must be present in the certificate's extension list. Not verified if no value is supplied.
+  - `keySelector` `<Function>`: Callback invoked to retrieve the public key (as either `string` or `Buffer`) necessary to verify the bundle signature. Not used when the signature was generated from a Fulcio-issued signing certificate.
+    - `hint` `<String>`: The hint from the bundle used to identify the the signing key.
+
+## Credential Sources
+
+### GitHub Actions
+
+If sigstore-js detects that it is being executed on GitHub Actions, it will use `ACTIONS_ID_TOKEN_REQUEST_URL`
+and `ACTIONS_ID_TOKEN_REQUEST_TOKEN` environment variables to request an OIDC token with the correct scope.
+
+Note: the `id_token: write` permission must be granted to the GitHub Action Job.
+
+See https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect
+for more details.
+
+### Environment Variables
+
+If the `SIGSTORE_ID_TOKEN` environment variable is set, it will use this to authenticate to Fulcio.
+It is the callers responsibility to make sure that this token has the correct scopes.
+
+[1]: https://github.com/sigstore/rekor
+[2]: https://github.com/sigstore/protobuf-specs/blob/9b722b68a717778ba4f11543afa4ef93205ab502/protos/sigstore_bundle.proto#L63-L84
+[3]: https://github.com/secure-systems-lab/dsse
+[4]: https://github.com/sigstore/cosign

package/node_modules/sigstore/dist/config.d.ts

@@ -0,0 +1,38 @@
+import { DSSEBundleBuilder, IdentityProvider, MessageSignatureBundleBuilder } from '@sigstore/sign';
+import { KeyFinderFunc, VerificationPolicy } from '@sigstore/verify';
+import type { MakeFetchHappenOptions } from 'make-fetch-happen';
+type Retry = MakeFetchHappenOptions['retry'];
+type FetchOptions = {
+    retry?: Retry;
+    timeout?: number | undefined;
+};
+type KeySelector = (hint: string) => string | Buffer | undefined;
+export type SignOptions = {
+    fulcioURL?: string;
+    identityProvider?: IdentityProvider;
+    identityToken?: string;
+    rekorURL?: string;
+    tlogUpload?: boolean;
+    tsaServerURL?: string;
+    legacyCompatibility?: boolean;
+} & FetchOptions;
+export type VerifyOptions = {
+    ctLogThreshold?: number;
+    tlogThreshold?: number;
+    certificateIssuer?: string;
+    certificateIdentityEmail?: string;
+    certificateIdentityURI?: string;
+    certificateOIDs?: Record<string, string>;
+    keySelector?: KeySelector;
+    tufMirrorURL?: string;
+    tufRootPath?: string;
+    tufCachePath?: string;
+    tufForceCache?: boolean;
+} & FetchOptions;
+export declare const DEFAULT_RETRY: Retry;
+export declare const DEFAULT_TIMEOUT = 5000;
+export declare function createBundleBuilder(bundleType: 'messageSignature', options: SignOptions): MessageSignatureBundleBuilder;
+export declare function createBundleBuilder(bundleType: 'dsseEnvelope', options: SignOptions): DSSEBundleBuilder;
+export declare function createKeyFinder(keySelector: KeySelector): KeyFinderFunc;
+export declare function createVerificationPolicy(options: VerifyOptions): VerificationPolicy;
+export {};

package/node_modules/sigstore/dist/config.js

@@ -0,0 +1,126 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_TIMEOUT = exports.DEFAULT_RETRY = void 0;
+exports.createBundleBuilder = createBundleBuilder;
+exports.createKeyFinder = createKeyFinder;
+exports.createVerificationPolicy = createVerificationPolicy;
+/*
+Copyright 2023 The Sigstore Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+const core_1 = require("@sigstore/core");
+const sign_1 = require("@sigstore/sign");
+const verify_1 = require("@sigstore/verify");
+exports.DEFAULT_RETRY = { retries: 2 };
+exports.DEFAULT_TIMEOUT = 5000;
+function createBundleBuilder(bundleType, options) {
+    const bundlerOptions = {
+        signer: initSigner(options),
+        witnesses: initWitnesses(options),
+    };
+    switch (bundleType) {
+        case 'messageSignature':
+            return new sign_1.MessageSignatureBundleBuilder(bundlerOptions);
+        case 'dsseEnvelope':
+            return new sign_1.DSSEBundleBuilder({
+                ...bundlerOptions,
+                certificateChain: options.legacyCompatibility,
+            });
+    }
+}
+// Translates the public KeySelector type into the KeyFinderFunc type needed by
+// the verifier.
+function createKeyFinder(keySelector) {
+    return (hint) => {
+        const key = keySelector(hint);
+        if (!key) {
+            throw new verify_1.VerificationError({
+                code: 'PUBLIC_KEY_ERROR',
+                message: `key not found: ${hint}`,
+            });
+        }
+        return {
+            publicKey: core_1.crypto.createPublicKey(key),
+            validFor: () => true,
+        };
+    };
+}
+function createVerificationPolicy(options) {
+    const policy = {};
+    const san = options.certificateIdentityEmail || options.certificateIdentityURI;
+    if (san) {
+        policy.subjectAlternativeName = san;
+    }
+    if (options.certificateIssuer) {
+        policy.extensions = { issuer: options.certificateIssuer };
+    }
+    if (options.certificateOIDs) {
+        policy.oids = Object.entries(options.certificateOIDs).map(([oid, value]) => ({
+            oid: { id: oid.split('.').map(Number) },
+            value: Buffer.from(value),
+        }));
+    }
+    return policy;
+}
+// Instantiate the FulcioSigner based on the supplied options.
+function initSigner(options) {
+    return new sign_1.FulcioSigner({
+        fulcioBaseURL: options.fulcioURL,
+        identityProvider: options.identityProvider || initIdentityProvider(options),
+        retry: options.retry ?? exports.DEFAULT_RETRY,
+        timeout: options.timeout ?? exports.DEFAULT_TIMEOUT,
+    });
+}
+// Instantiate an identity provider based on the supplied options. If an
+// explicit identity token is provided, use that. Otherwise, use the CI
+// context provider.
+function initIdentityProvider(options) {
+    const token = options.identityToken;
+    if (token) {
+        /* istanbul ignore next */
+        return { getToken: () => Promise.resolve(token) };
+    }
+    else {
+        return new sign_1.CIContextProvider('sigstore');
+    }
+}
+// Instantiate a collection of witnesses based on the supplied options.
+function initWitnesses(options) {
+    const witnesses = [];
+    if (isRekorEnabled(options)) {
+        witnesses.push(new sign_1.RekorWitness({
+            rekorBaseURL: options.rekorURL,
+            entryType: options.legacyCompatibility ? 'intoto' : 'dsse',
+            fetchOnConflict: false,
+            retry: options.retry ?? exports.DEFAULT_RETRY,
+            timeout: options.timeout ?? exports.DEFAULT_TIMEOUT,
+        }));
+    }
+    if (isTSAEnabled(options)) {
+        witnesses.push(new sign_1.TSAWitness({
+            tsaBaseURL: options.tsaServerURL,
+            retry: options.retry ?? exports.DEFAULT_RETRY,
+            timeout: options.timeout ?? exports.DEFAULT_TIMEOUT,
+        }));
+    }
+    return witnesses;
+}
+// Type assertion to ensure that Rekor is enabled
+function isRekorEnabled(options) {
+    return options.tlogUpload !== false;
+}
+// Type assertion to ensure that TSA is enabled
+function isTSAEnabled(options) {
+    return options.tsaServerURL !== undefined;
+}

package/node_modules/sigstore/dist/index.d.ts

@@ -0,0 +1,9 @@
+export { ValidationError } from '@sigstore/bundle';
+export { DEFAULT_FULCIO_URL, DEFAULT_REKOR_URL, InternalError, } from '@sigstore/sign';
+export { TUFError } from '@sigstore/tuf';
+export { PolicyError, VerificationError } from '@sigstore/verify';
+export { attest, createVerifier, sign, verify } from './sigstore';
+export type { SerializedBundle as Bundle } from '@sigstore/bundle';
+export type { IdentityProvider } from '@sigstore/sign';
+export type { SignOptions, VerifyOptions } from './config';
+export type { BundleVerifier } from './sigstore';

package/node_modules/sigstore/dist/index.js

@@ -0,0 +1,34 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verify = exports.sign = exports.createVerifier = exports.attest = exports.VerificationError = exports.PolicyError = exports.TUFError = exports.InternalError = exports.DEFAULT_REKOR_URL = exports.DEFAULT_FULCIO_URL = exports.ValidationError = void 0;
+/*
+Copyright 2022 The Sigstore Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+var bundle_1 = require("@sigstore/bundle");
+Object.defineProperty(exports, "ValidationError", { enumerable: true, get: function () { return bundle_1.ValidationError; } });
+var sign_1 = require("@sigstore/sign");
+Object.defineProperty(exports, "DEFAULT_FULCIO_URL", { enumerable: true, get: function () { return sign_1.DEFAULT_FULCIO_URL; } });
+Object.defineProperty(exports, "DEFAULT_REKOR_URL", { enumerable: true, get: function () { return sign_1.DEFAULT_REKOR_URL; } });
+Object.defineProperty(exports, "InternalError", { enumerable: true, get: function () { return sign_1.InternalError; } });
+var tuf_1 = require("@sigstore/tuf");
+Object.defineProperty(exports, "TUFError", { enumerable: true, get: function () { return tuf_1.TUFError; } });
+var verify_1 = require("@sigstore/verify");
+Object.defineProperty(exports, "PolicyError", { enumerable: true, get: function () { return verify_1.PolicyError; } });
+Object.defineProperty(exports, "VerificationError", { enumerable: true, get: function () { return verify_1.VerificationError; } });
+var sigstore_1 = require("./sigstore");
+Object.defineProperty(exports, "attest", { enumerable: true, get: function () { return sigstore_1.attest; } });
+Object.defineProperty(exports, "createVerifier", { enumerable: true, get: function () { return sigstore_1.createVerifier; } });
+Object.defineProperty(exports, "sign", { enumerable: true, get: function () { return sigstore_1.sign; } });
+Object.defineProperty(exports, "verify", { enumerable: true, get: function () { return sigstore_1.verify; } });

package/node_modules/sigstore/dist/sigstore.d.ts

@@ -0,0 +1,11 @@
+import { SerializedBundle } from '@sigstore/bundle';
+import { Signer } from '@sigstore/verify';
+import * as config from './config';
+export declare function sign(payload: Buffer, options?: config.SignOptions): Promise<SerializedBundle>;
+export declare function attest(payload: Buffer, payloadType: string, options?: config.SignOptions): Promise<SerializedBundle>;
+export declare function verify(bundle: SerializedBundle, options?: config.VerifyOptions): Promise<Signer>;
+export declare function verify(bundle: SerializedBundle, data: Buffer, options?: config.VerifyOptions): Promise<Signer>;
+export interface BundleVerifier {
+    verify(bundle: SerializedBundle, data?: Buffer): Signer;
+}
+export declare function createVerifier(options?: config.VerifyOptions): Promise<BundleVerifier>;

package/node_modules/sigstore/dist/sigstore.js

@@ -0,0 +1,112 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sign = sign;
+exports.attest = attest;
+exports.verify = verify;
+exports.createVerifier = createVerifier;
+/*
+Copyright 2023 The Sigstore Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+const bundle_1 = require("@sigstore/bundle");
+const tuf = __importStar(require("@sigstore/tuf"));
+const verify_1 = require("@sigstore/verify");
+const config = __importStar(require("./config"));
+async function sign(payload, 
+/* istanbul ignore next */
+options = {}) {
+    const bundler = config.createBundleBuilder('messageSignature', options);
+    const bundle = await bundler.create({ data: payload });
+    return (0, bundle_1.bundleToJSON)(bundle);
+}
+async function attest(payload, payloadType, 
+/* istanbul ignore next */
+options = {}) {
+    const bundler = config.createBundleBuilder('dsseEnvelope', options);
+    const bundle = await bundler.create({ data: payload, type: payloadType });
+    return (0, bundle_1.bundleToJSON)(bundle);
+}
+async function verify(bundle, dataOrOptions, options) {
+    let data;
+    if (Buffer.isBuffer(dataOrOptions)) {
+        data = dataOrOptions;
+    }
+    else {
+        options = dataOrOptions;
+    }
+    const verifier = await createVerifier(options);
+    return verifier.verify(bundle, data);
+}
+async function createVerifier(
+/* istanbul ignore next */
+options = {}) {
+    const trustedRoot = await tuf.getTrustedRoot({
+        mirrorURL: options.tufMirrorURL,
+        rootPath: options.tufRootPath,
+        cachePath: options.tufCachePath,
+        forceCache: options.tufForceCache,
+        retry: options.retry ?? config.DEFAULT_RETRY,
+        timeout: options.timeout ?? config.DEFAULT_TIMEOUT,
+    });
+    const keyFinder = options.keySelector
+        ? config.createKeyFinder(options.keySelector)
+        : undefined;
+    const trustMaterial = (0, verify_1.toTrustMaterial)(trustedRoot, keyFinder);
+    const verifierOptions = {
+        ctlogThreshold: options.ctLogThreshold,
+        tlogThreshold: options.tlogThreshold,
+    };
+    const verifier = new verify_1.Verifier(trustMaterial, verifierOptions);
+    const policy = config.createVerificationPolicy(options);
+    return {
+        verify: (bundle, payload) => {
+            const deserializedBundle = (0, bundle_1.bundleFromJSON)(bundle);
+            const signedEntity = (0, verify_1.toSignedEntity)(deserializedBundle, payload);
+            return verifier.verify(signedEntity, policy);
+        },
+    };
+}

package/node_modules/sigstore/package.json

@@ -0,0 +1,47 @@
+{
+  "name": "sigstore",
+  "version": "5.0.0",
+  "description": "code-signing for npm packages",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "scripts": {
+    "clean": "shx rm -rf dist *.tsbuildinfo",
+    "build": "tsc --build",
+    "test": "jest"
+  },
+  "files": [
+    "dist",
+    "store"
+  ],
+  "author": "bdehamer@github.com",
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/sigstore/sigstore-js.git"
+  },
+  "bugs": {
+    "url": "https://github.com/sigstore/sigstore-js/issues"
+  },
+  "homepage": "https://github.com/sigstore/sigstore-js/tree/main/packages/client#readme",
+  "publishConfig": {
+    "provenance": true
+  },
+  "devDependencies": {
+    "@sigstore/jest": "^0.0.0",
+    "@sigstore/mock": "^0.13.0",
+    "@sigstore/rekor-types": "^5.0.0",
+    "@tufjs/repo-mock": "^5.0.0",
+    "@types/make-fetch-happen": "^10.0.4"
+  },
+  "dependencies": {
+    "@sigstore/bundle": "^5.0.0",
+    "@sigstore/core": "^4.0.0",
+    "@sigstore/protobuf-specs": "^0.5.0",
+    "@sigstore/sign": "^5.0.0",
+    "@sigstore/tuf": "^5.0.0",
+    "@sigstore/verify": "^4.0.0"
+  },
+  "engines": {
+    "node": "^22.22.2 || ^24.15.0 || >=26.0.0"
+  }
+}

package/node_modules/smart-buffer/.prettierrc.yaml

@@ -0,0 +1,5 @@
+parser: typescript
+printWidth: 120
+tabWidth: 2
+singleQuote: true
+trailingComma: none

package/node_modules/smart-buffer/.travis.yml

@@ -0,0 +1,13 @@
+language: node_js
+node_js:
+  - 6
+  - 8
+  - 10
+  - 12
+  - stable
+
+before_script:
+  - npm install -g typescript
+  - tsc -p ./
+
+script: "npm run coveralls"

package/node_modules/smart-buffer/LICENSE

@@ -0,0 +1,20 @@
+The MIT License (MIT)
+
+Copyright (c) 2013-2017 Josh Glazebrook
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of
+this software and associated documentation files (the "Software"), to deal in
+the Software without restriction, including without limitation the rights to
+use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
+the Software, and to permit persons to whom the Software is furnished to do so,
+subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
+IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.