@macula-io/martha 0.0.0-stage → 1.0.0

package/node_modules/@sigstore/sign/README.md

@@ -0,0 +1,185 @@
+# @sigstore/sign · [![npm version](https://img.shields.io/npm/v/@sigstore/sign.svg?style=flat)](https://www.npmjs.com/package/@sigstore/sign) [![CI Status](https://github.com/sigstore/sigstore-js/workflows/CI/badge.svg)](https://github.com/sigstore/sigstore-js/actions/workflows/ci.yml) [![Smoke Test Status](https://github.com/sigstore/sigstore-js/workflows/smoke-test/badge.svg)](https://github.com/sigstore/sigstore-js/actions/workflows/smoke-test.yml)
+
+A library for generating [Sigstore][1] signatures.
+
+## Features
+
+- Support for keyless signature generation with [Fulcio][2]-issued signing
+  certificates
+- Support for ambient OIDC credential detection in CI/CD environments
+- Support for recording signatures to the [Rekor][3] transparency log
+- Support for requesting timestamped countersignature from a [Timestamp
+  Authority][4]
+
+## Prerequisites
+
+- Node.js version ^22.22.2 || ^24.15.0 || >=26.0.0
+
+## Installation
+
+```
+npm install @sigstore/sign
+```
+
+## Overview
+
+This library provides the building blocks for composing custom Sigstore signing
+workflows.
+
+### BundleBuilder
+
+The top-level component is the `BundleBuilder` which has responsibility for
+taking some artifact and returning a [Sigstore bundle][5] containing the
+signature for that artifact and the various materials necessary to verify that
+signature.
+
+```typescript
+interface BundleBuilder {
+  create: (artifact: Artifact) => Promise<Bundle>;
+}
+```
+
+The artifact to be signed is simply an array of bytes and an optional mimetype.
+The type is necessary when the signature is packaged as a [DSSE][6] envelope.
+
+```typescript
+type Artifact = {
+  data: Buffer;
+  type?: string;
+};
+```
+
+There are two `BundleBuilder` implementations provided as part of this package:
+
+- [`DSSEBundleBuilder`](./src/bundler/dsse.ts) - Combines the verification material and
+  artifact signature into a [`dsse_envelope`][7] -style Sigstore bundle
+- [`MessageBundleBuilder`](./src/bundler/message.ts) - Combines the verification
+  material and artifact signature into a [`message_signature`][8]-style Sigstore
+  bundle.
+
+### Signer
+
+Every `BundleBuilder` must be instantiated with a `Signer` implementation. The
+`Signer` is responsible for taking a `Buffer` and returning an `Signature`.
+
+```typescript
+interface Signer {
+  sign: (data: Buffer) => Promise<Signature>;
+}
+```
+
+The returned `Signature` contains a signature and the public key which can be
+used to verify that signature -- the key may either take the form of a x509
+certificate or public key.
+
+```typescript
+type Signature = {
+  signature: Buffer;
+  key: KeyMaterial;
+};
+
+type KeyMaterial =
+  | {
+      $case: 'x509Certificate';
+      certificate: string;
+    }
+  | {
+      $case: 'publicKey';
+      publicKey: string;
+      hint?: string;
+    };
+```
+
+This package provides the [`FulcioSigner`](./src/signer/fulcio/index.ts)
+which implements the `Signer` interface and signs the artifact with an
+ephemeral keypair. It will also retrieve an OIDC token from the configured
+`IdentityProvider` and then request a signing certificate from Fulcio which binds
+the ephemeral key to the identity embedded in the token. This signing
+certificate is returned as part of the `Signature`.
+
+### Witness
+
+The `BundleBuilder` may also be configured with zero-or-more `Witness`
+instances. Each `Witness` receives the artifact signature and the public key
+and returns an `VerificationMaterial` which represents some sort of
+counter-signature for the artifact's signature.
+
+```typescript
+interface Witness {
+  testify: (
+    signature: SignatureBundle,
+    publicKey: string
+  ) => Promise<VerificationMaterial>;
+}
+```
+
+The returned `VerificationMaterial` may contain either Rekor transparency log
+entries or RFC3161 timestamps.
+
+```typescript
+type VerificationMaterial = {
+  tlogEntries?: TransparencyLogEntry[];
+  rfc3161Timestamps?: RFC3161SignedTimestamp[];
+};
+```
+
+The entries in the returned `VerificationMaterial` are automatically added to
+the Sigstore `Bundle` by the `BundleBuilder`.
+
+The package provides two different `Witness` implementations:
+
+- [`RekorWitness`](./src/witness/tlog/index.ts) - Adds an entry to the Rekor
+  transparency log and returns a `TransparencyLogEntry` to be included in the
+  `Bundle`
+- [`TSAWitness`](./src/witness/tsa/index.ts) - Requests an RFC3161 timestamp
+  over the artifact signature and returns an `RFC3161SignedTimestamp` to be
+  included in the `Bundle`
+
+## Usage Example
+
+```typescript
+const {
+  CIContextProvider,
+  DSSEBundleBuilder,
+  FulcioSigner,
+  RekorWitness,
+  TSAWitness,
+} = require('@sigstore/sign');
+
+// Set-up the signer
+const signer = new FulcioSigner({
+  fulcioBaseURL: 'https://fulcio.sigstore.dev',
+  identityProvider: new CIContextProvider('sigstore'),
+});
+
+// Set-up the witnesses
+const rekorWitness = new RekorWitness({
+  rekorBaseURL: 'https://rekor.sigstore.dev',
+});
+
+const tsaWitness = new TSAWitness({
+  tsaBaseURL: 'https://tsa.github.com',
+});
+
+// Instantiate a bundle builder
+const bundler = new DSSEBundleBuilder({
+  signer,
+  witnesses: [rekorWitness, tsaWitness],
+});
+
+// Sign a thing
+const artifact = {
+  type: 'text/plain',
+  data: Buffer.from('something to be signed'),
+};
+const bundle = await bundler.create(artifact);
+```
+
+[1]: https://www.sigstore.dev
+[2]: https://github.com/sigstore/fulcio
+[3]: https://github.com/sigstore/rekor
+[4]: https://github.com/sigstore/timestamp-authority
+[5]: https://github.com/sigstore/protobuf-specs/blob/main/protos/sigstore_bundle.proto
+[6]: https://github.com/secure-systems-lab/dsse
+[7]: https://github.com/sigstore/protobuf-specs/blob/5ef54068bb534152474c5685f5cd248f38549fbd/protos/sigstore_bundle.proto#L80
+[8]: https://github.com/sigstore/protobuf-specs/blob/5ef54068bb534152474c5685f5cd248f38549fbd/protos/sigstore_bundle.proto#L74

package/node_modules/@sigstore/sign/dist/bundler/base.d.ts

@@ -0,0 +1,22 @@
+import type { Bundle } from '@sigstore/bundle';
+import type { Signature, Signer } from '../signer';
+import type { Witness } from '../witness';
+export interface BundleBuilderOptions {
+    signer: Signer;
+    witnesses: Witness[];
+}
+export interface Artifact {
+    data: Buffer;
+    type?: string;
+}
+export interface BundleBuilder {
+    create: (artifact: Artifact) => Promise<Bundle>;
+}
+export declare abstract class BaseBundleBuilder<T extends Bundle> implements BundleBuilder {
+    protected signer: Signer;
+    private witnesses;
+    constructor(options: BundleBuilderOptions);
+    create(artifact: Artifact): Promise<T>;
+    protected prepare(artifact: Artifact): Promise<Buffer>;
+    protected abstract package(artifact: Artifact, signature: Signature): Promise<T>;
+}

package/node_modules/@sigstore/sign/dist/bundler/base.js

@@ -0,0 +1,52 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BaseBundleBuilder = void 0;
+// BaseBundleBuilder is a base class for BundleBuilder implementations. It
+// provides a the basic wokflow for signing and witnessing an artifact.
+// Subclasses must implement the `package` method to assemble a valid bundle
+// with the generated signature and verification material.
+class BaseBundleBuilder {
+    signer;
+    witnesses;
+    constructor(options) {
+        this.signer = options.signer;
+        this.witnesses = options.witnesses;
+    }
+    // Executes the signing/witnessing process for the given artifact.
+    async create(artifact) {
+        const signature = await this.prepare(artifact).then((blob) => this.signer.sign(blob));
+        const bundle = await this.package(artifact, signature);
+        // Invoke all of the witnesses in parallel
+        const verificationMaterials = await Promise.all(this.witnesses.map((witness) => witness.testify(bundle.content, publicKey(signature.key))));
+        // Collect the verification material from all of the witnesses
+        const tlogEntryList = [];
+        const timestampList = [];
+        verificationMaterials.forEach(({ tlogEntries, rfc3161Timestamps }) => {
+            tlogEntryList.push(...(tlogEntries ?? []));
+            timestampList.push(...(rfc3161Timestamps ?? []));
+        });
+        // Merge the collected verification material into the bundle
+        bundle.verificationMaterial.tlogEntries = tlogEntryList;
+        bundle.verificationMaterial.timestampVerificationData = {
+            rfc3161Timestamps: timestampList,
+        };
+        return bundle;
+    }
+    // Override this function to apply any pre-signing transformations to the
+    // artifact. The returned buffer will be signed by the signer. The default
+    // implementation simply returns the artifact data.
+    async prepare(artifact) {
+        return artifact.data;
+    }
+}
+exports.BaseBundleBuilder = BaseBundleBuilder;
+// Extracts the public key from a KeyMaterial. Returns either the public key
+// or the certificate, depending on the type of key material.
+function publicKey(key) {
+    switch (key.$case) {
+        case 'publicKey':
+            return key.publicKey;
+        case 'x509Certificate':
+            return key.certificate;
+    }
+}

package/node_modules/@sigstore/sign/dist/bundler/bundle.d.ts

@@ -0,0 +1,5 @@
+import * as sigstore from '@sigstore/bundle';
+import type { Signature } from '../signer';
+import type { Artifact } from './base';
+export declare function toMessageSignatureBundle(artifact: Artifact, signature: Signature): sigstore.BundleWithMessageSignature;
+export declare function toDSSEBundle(artifact: Required<Artifact>, signature: Signature, certificateChain?: boolean): sigstore.BundleWithDsseEnvelope;

package/node_modules/@sigstore/sign/dist/bundler/bundle.js

@@ -0,0 +1,81 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.toMessageSignatureBundle = toMessageSignatureBundle;
+exports.toDSSEBundle = toDSSEBundle;
+/*
+Copyright 2023 The Sigstore Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+const sigstore = __importStar(require("@sigstore/bundle"));
+const util_1 = require("../util");
+// Helper functions for assembling the parts of a Sigstore bundle
+// Message signature bundle - $case: 'messageSignature'
+function toMessageSignatureBundle(artifact, signature) {
+    const digest = util_1.crypto.digest('sha256', artifact.data);
+    return sigstore.toMessageSignatureBundle({
+        digest,
+        signature: signature.signature,
+        certificate: signature.key.$case === 'x509Certificate'
+            ? util_1.pem.toDER(signature.key.certificate)
+            : undefined,
+        keyHint: signature.key.$case === 'publicKey' ? signature.key.hint : undefined,
+        certificateChain: true,
+    });
+}
+// DSSE envelope bundle - $case: 'dsseEnvelope'
+function toDSSEBundle(artifact, signature, certificateChain) {
+    return sigstore.toDSSEBundle({
+        artifact: artifact.data,
+        artifactType: artifact.type,
+        signature: signature.signature,
+        certificate: signature.key.$case === 'x509Certificate'
+            ? util_1.pem.toDER(signature.key.certificate)
+            : undefined,
+        keyHint: signature.key.$case === 'publicKey' ? signature.key.hint : undefined,
+        certificateChain,
+    });
+}

package/node_modules/@sigstore/sign/dist/bundler/dsse.d.ts

@@ -0,0 +1,13 @@
+import { Artifact, BaseBundleBuilder, BundleBuilderOptions } from './base';
+import type { BundleWithDsseEnvelope } from '@sigstore/bundle';
+import type { Signature } from '../signer';
+type DSSEBundleBuilderOptions = BundleBuilderOptions & {
+    certificateChain?: boolean;
+};
+export declare class DSSEBundleBuilder extends BaseBundleBuilder<BundleWithDsseEnvelope> {
+    private certificateChain?;
+    constructor(options: DSSEBundleBuilderOptions);
+    protected prepare(artifact: Artifact): Promise<Buffer>;
+    protected package(artifact: Artifact, signature: Signature): Promise<BundleWithDsseEnvelope>;
+}
+export {};

package/node_modules/@sigstore/sign/dist/bundler/dsse.js

@@ -0,0 +1,47 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DSSEBundleBuilder = void 0;
+/*
+Copyright 2023 The Sigstore Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+const util_1 = require("../util");
+const base_1 = require("./base");
+const bundle_1 = require("./bundle");
+// BundleBuilder implementation for DSSE wrapped attestations
+class DSSEBundleBuilder extends base_1.BaseBundleBuilder {
+    certificateChain;
+    constructor(options) {
+        super(options);
+        this.certificateChain = options.certificateChain ?? false;
+    }
+    // DSSE requires the artifact to be pre-encoded with the payload type
+    // before the signature is generated.
+    async prepare(artifact) {
+        const a = artifactDefaults(artifact);
+        return util_1.dsse.preAuthEncoding(a.type, a.data);
+    }
+    // Packages the artifact and signature into a DSSE bundle
+    async package(artifact, signature) {
+        return (0, bundle_1.toDSSEBundle)(artifactDefaults(artifact), signature, this.certificateChain);
+    }
+}
+exports.DSSEBundleBuilder = DSSEBundleBuilder;
+// Defaults the artifact type to an empty string if not provided
+function artifactDefaults(artifact) {
+    return {
+        ...artifact,
+        type: artifact.type ?? '',
+    };
+}

package/node_modules/@sigstore/sign/dist/bundler/index.d.ts

@@ -0,0 +1,3 @@
+export type { Artifact, BundleBuilder, BundleBuilderOptions } from './base';
+export { DSSEBundleBuilder } from './dsse';
+export { MessageSignatureBundleBuilder } from './message';

package/node_modules/@sigstore/sign/dist/bundler/index.js

@@ -0,0 +1,7 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MessageSignatureBundleBuilder = exports.DSSEBundleBuilder = void 0;
+var dsse_1 = require("./dsse");
+Object.defineProperty(exports, "DSSEBundleBuilder", { enumerable: true, get: function () { return dsse_1.DSSEBundleBuilder; } });
+var message_1 = require("./message");
+Object.defineProperty(exports, "MessageSignatureBundleBuilder", { enumerable: true, get: function () { return message_1.MessageSignatureBundleBuilder; } });

package/node_modules/@sigstore/sign/dist/bundler/message.d.ts

@@ -0,0 +1,7 @@
+import { Artifact, BaseBundleBuilder, BundleBuilderOptions } from './base';
+import type { BundleWithMessageSignature } from '@sigstore/bundle';
+import type { Signature } from '../signer';
+export declare class MessageSignatureBundleBuilder extends BaseBundleBuilder<BundleWithMessageSignature> {
+    constructor(options: BundleBuilderOptions);
+    protected package(artifact: Artifact, signature: Signature): Promise<BundleWithMessageSignature>;
+}

package/node_modules/@sigstore/sign/dist/bundler/message.js

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MessageSignatureBundleBuilder = void 0;
+/*
+Copyright 2023 The Sigstore Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+const base_1 = require("./base");
+const bundle_1 = require("./bundle");
+// BundleBuilder implementation for raw message signatures
+class MessageSignatureBundleBuilder extends base_1.BaseBundleBuilder {
+    constructor(options) {
+        super(options);
+    }
+    async package(artifact, signature) {
+        return (0, bundle_1.toMessageSignatureBundle)(artifact, signature);
+    }
+}
+exports.MessageSignatureBundleBuilder = MessageSignatureBundleBuilder;

package/node_modules/@sigstore/sign/dist/config.d.ts

@@ -0,0 +1,18 @@
+import { SigningConfig } from '@sigstore/protobuf-specs';
+import { BundleBuilder } from './bundler/base';
+import { IdentityProvider } from './identity';
+import type { MakeFetchHappenOptions } from 'make-fetch-happen';
+type Retry = MakeFetchHappenOptions['retry'];
+type BundleType = 'messageSignature' | 'dsseEnvelope';
+type FetchOptions = {
+    retry?: Retry;
+    timeout?: number | undefined;
+};
+type Options = {
+    signingConfig: SigningConfig;
+    identityProvider: IdentityProvider;
+    bundleType: BundleType;
+    fetchOptions?: FetchOptions;
+};
+export declare function bundleBuilderFromSigningConfig(options: Options): BundleBuilder;
+export {};

package/node_modules/@sigstore/sign/dist/config.js

@@ -0,0 +1,143 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.bundleBuilderFromSigningConfig = bundleBuilderFromSigningConfig;
+/*
+Copyright 2025 The Sigstore Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+const protobuf_specs_1 = require("@sigstore/protobuf-specs");
+const dsse_1 = require("./bundler/dsse");
+const message_1 = require("./bundler/message");
+const signer_1 = require("./signer");
+const witness_1 = require("./witness");
+const MAX_CA_API_VERSION = 1;
+const MAX_TLOG_API_VERSION = 2;
+const MAX_TSA_API_VERSION = 1;
+const DEFAULT_TIMEOUT = 5000;
+const DEFAULT_REKORV2_TIMEOUT = 20000;
+const DEFAULT_RETRY = { retries: 2 };
+// Creates a BundleBuilder based on the provided SigningConfig
+function bundleBuilderFromSigningConfig(options) {
+    const { signingConfig, identityProvider, bundleType } = options;
+    const fetchOptions = options.fetchOptions || {
+        timeout: DEFAULT_TIMEOUT,
+        retry: DEFAULT_RETRY,
+    };
+    const signer = fulcioSignerFromConfig(signingConfig, identityProvider, fetchOptions);
+    const witnesses = witnessesFromConfig(signingConfig, fetchOptions);
+    switch (bundleType) {
+        case 'messageSignature':
+            return new message_1.MessageSignatureBundleBuilder({ signer, witnesses });
+        case 'dsseEnvelope':
+            return new dsse_1.DSSEBundleBuilder({ signer, witnesses });
+    }
+}
+function fulcioSignerFromConfig(signingConfig, identityProvider, fetchOptions) {
+    const service = certAuthorityService(signingConfig);
+    return new signer_1.FulcioSigner({
+        fulcioBaseURL: service.url,
+        identityProvider: identityProvider,
+        timeout: fetchOptions.timeout,
+        retry: fetchOptions.retry,
+    });
+}
+function witnessesFromConfig(signingConfig, fetchOptions) {
+    const witnesses = [];
+    if (signingConfig.rekorTlogConfig) {
+        if (signingConfig.rekorTlogConfig.selector !== protobuf_specs_1.ServiceSelector.ANY) {
+            throw new Error('Unsupported Rekor TLog selector in signing configuration');
+        }
+        const tlog = tlogService(signingConfig);
+        witnesses.push(new witness_1.RekorWitness({
+            rekorBaseURL: tlog.url,
+            majorApiVersion: tlog.majorApiVersion,
+            retry: fetchOptions.retry,
+            timeout: 
+            // Ensure Rekor V2 has at least a 20 second timeout
+            tlog.majorApiVersion === 1
+                ? fetchOptions.timeout
+                : Math.min(fetchOptions.timeout ||
+                    /* istanbul ignore next */ DEFAULT_TIMEOUT, DEFAULT_REKORV2_TIMEOUT),
+        }));
+    }
+    if (signingConfig.tsaConfig) {
+        if (signingConfig.tsaConfig.selector !== protobuf_specs_1.ServiceSelector.ANY) {
+            throw new Error('Unsupported TSA selector in signing configuration');
+        }
+        const tsa = tsaService(signingConfig);
+        witnesses.push(new witness_1.TSAWitness({
+            tsaBaseURL: tsa.url,
+            retry: fetchOptions.retry,
+            timeout: fetchOptions.timeout,
+        }));
+    }
+    return witnesses;
+}
+// Returns the first valid CA service from the signing configuration
+function certAuthorityService(signingConfig) {
+    const compatibleCAs = filterServicesByMaxAPIVersion(signingConfig.caUrls, MAX_CA_API_VERSION);
+    const sortedCAs = sortServicesByStartDate(compatibleCAs);
+    if (sortedCAs.length === 0) {
+        throw new Error('No valid CA services found in signing configuration');
+    }
+    return sortedCAs[0];
+}
+// Returns the first valid TLog service from the signing configuration
+function tlogService(signingConfig) {
+    const compatibleTLogs = filterServicesByMaxAPIVersion(signingConfig.rekorTlogUrls, MAX_TLOG_API_VERSION);
+    const sortedTLogs = sortServicesByStartDate(compatibleTLogs);
+    if (sortedTLogs.length === 0) {
+        throw new Error('No valid TLogs found in signing configuration');
+    }
+    return sortedTLogs[0];
+}
+// Returns the first valid TSA service from the signing configuration
+function tsaService(signingConfig) {
+    const compatibleTSAs = filterServicesByMaxAPIVersion(signingConfig.tsaUrls, MAX_TSA_API_VERSION);
+    const sortedTSAs = sortServicesByStartDate(compatibleTSAs);
+    if (sortedTSAs.length === 0) {
+        throw new Error('No valid TSAs found in signing configuration');
+    }
+    return sortedTSAs[0];
+}
+// Returns the services sorted by start date (most recent first), filtering out
+// any services that have an end date in the past
+function sortServicesByStartDate(services) {
+    const now = new Date();
+    // Filter out any services that have an end date in the past
+    const validServices = services.filter((service) => {
+        // If there's no end date, the service is still valid
+        if (!service.validFor?.end) {
+            return true;
+        }
+        // Keep services whose end date is in the future or present
+        return service.validFor.end >= now;
+    });
+    return validServices.sort((a, b) => {
+        /* istanbul ignore next */
+        const aStart = a.validFor?.start?.getTime() ?? 0;
+        /* istanbul ignore next */
+        const bStart = b.validFor?.start?.getTime() ?? 0;
+        // Sort descending (most recent first)
+        return bStart - aStart;
+    });
+}
+// Returns a filtered list of services whose major API version is less than or
+// equal to the specified version
+function filterServicesByMaxAPIVersion(services, apiVersion) {
+    // Filter out any services with a major API version greater than the specified version
+    return services.filter((service) => {
+        return service.majorApiVersion <= apiVersion;
+    });
+}

package/node_modules/@sigstore/sign/dist/error.d.ts

@@ -0,0 +1,12 @@
+type InternalErrorCode = 'TLOG_FETCH_ENTRY_ERROR' | 'TLOG_CREATE_ENTRY_ERROR' | 'CA_CREATE_SIGNING_CERTIFICATE_ERROR' | 'TSA_CREATE_TIMESTAMP_ERROR' | 'IDENTITY_TOKEN_READ_ERROR' | 'IDENTITY_TOKEN_PARSE_ERROR';
+export declare class InternalError extends Error {
+    code: InternalErrorCode;
+    cause: any | undefined;
+    constructor({ code, message, cause, }: {
+        code: InternalErrorCode;
+        message: string;
+        cause?: any;
+    });
+}
+export declare function internalError(err: unknown, code: InternalErrorCode, message: string): never;
+export {};