@macula-io/martha 0.0.0-stage → 1.0.0

package/node_modules/@sigstore/sign/dist/witness/tlog/entry.js

@@ -0,0 +1,197 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.toProposedEntry = toProposedEntry;
+exports.toCreateEntryRequest = toCreateEntryRequest;
+/*
+Copyright 2025 The Sigstore Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+const bundle_1 = require("@sigstore/bundle");
+const protobuf_specs_1 = require("@sigstore/protobuf-specs");
+const util_1 = require("../../util");
+const SHA256_ALGORITHM = 'sha256';
+function toProposedEntry(content, publicKey, 
+// TODO: Remove this parameter once have completely switched to 'dsse' entries
+entryType = 'dsse') {
+    switch (content.$case) {
+        case 'dsseEnvelope':
+            // TODO: Remove this conditional once have completely ditched "intoto" entries
+            if (entryType === 'intoto') {
+                return toProposedIntotoEntry(content.dsseEnvelope, publicKey);
+            }
+            return toProposedDSSEEntry(content.dsseEnvelope, publicKey);
+        case 'messageSignature':
+            return toProposedHashedRekordEntry(content.messageSignature, publicKey);
+    }
+}
+// Returns a properly formatted Rekor "hashedrekord" entry for the given digest
+// and signature
+function toProposedHashedRekordEntry(messageSignature, publicKey) {
+    const hexDigest = messageSignature.messageDigest.digest.toString('hex');
+    const b64Signature = messageSignature.signature.toString('base64');
+    const b64Key = util_1.encoding.base64Encode(publicKey);
+    return {
+        apiVersion: '0.0.1',
+        kind: 'hashedrekord',
+        spec: {
+            data: {
+                hash: {
+                    algorithm: SHA256_ALGORITHM,
+                    value: hexDigest,
+                },
+            },
+            signature: {
+                content: b64Signature,
+                publicKey: {
+                    content: b64Key,
+                },
+            },
+        },
+    };
+}
+// Returns a properly formatted Rekor "dsse" entry for the given DSSE envelope
+// and signature
+function toProposedDSSEEntry(envelope, publicKey) {
+    const envelopeJSON = JSON.stringify((0, bundle_1.envelopeToJSON)(envelope));
+    const encodedKey = util_1.encoding.base64Encode(publicKey);
+    return {
+        apiVersion: '0.0.1',
+        kind: 'dsse',
+        spec: {
+            proposedContent: {
+                envelope: envelopeJSON,
+                verifiers: [encodedKey],
+            },
+        },
+    };
+}
+// Returns a properly formatted Rekor "intoto" entry for the given DSSE
+// envelope and signature
+function toProposedIntotoEntry(envelope, publicKey) {
+    // Calculate the value for the payloadHash field in the Rekor entry
+    const payloadHash = util_1.crypto
+        .digest(SHA256_ALGORITHM, envelope.payload)
+        .toString('hex');
+    // Calculate the value for the hash field in the Rekor entry
+    const envelopeHash = calculateDSSEHash(envelope, publicKey);
+    // Collect values for re-creating the DSSE envelope.
+    // Double-encode payload and signature cause that's what Rekor expects
+    const payload = util_1.encoding.base64Encode(envelope.payload.toString('base64'));
+    const sig = util_1.encoding.base64Encode(envelope.signatures[0].sig.toString('base64'));
+    const keyid = envelope.signatures[0].keyid;
+    const encodedKey = util_1.encoding.base64Encode(publicKey);
+    // Create the envelope portion of the entry. Note the inclusion of the
+    // publicKey in the signature struct is not a standard part of a DSSE
+    // envelope, but is required by Rekor.
+    const dsse = {
+        payloadType: envelope.payloadType,
+        payload: payload,
+        signatures: [{ sig, publicKey: encodedKey }],
+    };
+    // If the keyid is an empty string, Rekor seems to remove it altogether. We
+    // need to do the same here so that we can properly recreate the entry for
+    // verification.
+    if (keyid.length > 0) {
+        dsse.signatures[0].keyid = keyid;
+    }
+    return {
+        apiVersion: '0.0.2',
+        kind: 'intoto',
+        spec: {
+            content: {
+                envelope: dsse,
+                hash: { algorithm: SHA256_ALGORITHM, value: envelopeHash },
+                payloadHash: { algorithm: SHA256_ALGORITHM, value: payloadHash },
+            },
+        },
+    };
+}
+// Calculates the hash of a DSSE envelope for inclusion in a Rekor entry.
+// There is no standard way to do this, so the scheme we're using as as
+// follows:
+//  * payload is base64 encoded
+//  * signature is base64 encoded (only the first signature is used)
+//  * keyid is included ONLY if it is NOT an empty string
+//  * The resulting JSON is canonicalized and hashed to a hex string
+function calculateDSSEHash(envelope, publicKey) {
+    const dsse = {
+        payloadType: envelope.payloadType,
+        payload: envelope.payload.toString('base64'),
+        signatures: [
+            { sig: envelope.signatures[0].sig.toString('base64'), publicKey },
+        ],
+    };
+    // If the keyid is an empty string, Rekor seems to remove it altogether.
+    if (envelope.signatures[0].keyid.length > 0) {
+        dsse.signatures[0].keyid = envelope.signatures[0].keyid;
+    }
+    return util_1.crypto
+        .digest(SHA256_ALGORITHM, util_1.json.canonicalize(dsse))
+        .toString('hex');
+}
+function toCreateEntryRequest(content, publicKey) {
+    switch (content.$case) {
+        case 'dsseEnvelope':
+            return toCreateEntryRequestDSSE(content.dsseEnvelope, publicKey);
+        case 'messageSignature':
+            return toCreateEntryRequestMessageSignature(content.messageSignature, publicKey);
+    }
+}
+function toCreateEntryRequestDSSE(envelope, publicKey) {
+    return {
+        spec: {
+            $case: 'dsseRequestV002',
+            dsseRequestV002: {
+                envelope: envelope,
+                verifiers: [
+                    {
+                        // TODO: We need to add support of passing the key details in the
+                        // signature bundle. For now we're hardcoding the key details here.
+                        keyDetails: protobuf_specs_1.PublicKeyDetails.PKIX_ECDSA_P256_SHA_256,
+                        verifier: {
+                            $case: 'x509Certificate',
+                            x509Certificate: {
+                                rawBytes: util_1.pem.toDER(publicKey),
+                            },
+                        },
+                    },
+                ],
+            },
+        },
+    };
+}
+function toCreateEntryRequestMessageSignature(messageSignature, publicKey) {
+    return {
+        spec: {
+            $case: 'hashedRekordRequestV002',
+            hashedRekordRequestV002: {
+                digest: messageSignature.messageDigest.digest,
+                signature: {
+                    content: messageSignature.signature,
+                    verifier: {
+                        // TODO: We need to add support of passing the key details in the
+                        // signature bundle. For now we're hardcoding the key details here.
+                        keyDetails: protobuf_specs_1.PublicKeyDetails.PKIX_ECDSA_P256_SHA_256,
+                        verifier: {
+                            $case: 'x509Certificate',
+                            x509Certificate: {
+                                rawBytes: util_1.pem.toDER(publicKey),
+                            },
+                        },
+                    },
+                },
+            },
+        },
+    };
+}

package/node_modules/@sigstore/sign/dist/witness/tlog/index.d.ts

@@ -0,0 +1,20 @@
+import { TLogClientOptions } from './client';
+import type { TransparencyLogEntry } from '@sigstore/bundle';
+import type { SignatureBundle, Witness } from '../witness';
+export declare const DEFAULT_REKOR_URL = "https://rekor.sigstore.dev";
+type TransparencyLogEntries = {
+    tlogEntries: TransparencyLogEntry[];
+};
+export type RekorWitnessOptions = Partial<TLogClientOptions> & {
+    entryType?: 'dsse' | 'intoto';
+    majorApiVersion?: number;
+};
+export declare class RekorWitness implements Witness {
+    private tlogV1;
+    private tlogV2;
+    private entryType?;
+    private majorApiVersion;
+    constructor(options: RekorWitnessOptions);
+    testify(content: SignatureBundle, publicKey: string): Promise<TransparencyLogEntries>;
+}
+export {};

package/node_modules/@sigstore/sign/dist/witness/tlog/index.js

@@ -0,0 +1,97 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RekorWitness = exports.DEFAULT_REKOR_URL = void 0;
+/*
+Copyright 2025 The Sigstore Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+const util_1 = require("../../util");
+const client_1 = require("./client");
+const entry_1 = require("./entry");
+exports.DEFAULT_REKOR_URL = 'https://rekor.sigstore.dev';
+class RekorWitness {
+    tlogV1;
+    tlogV2;
+    entryType;
+    majorApiVersion;
+    constructor(options) {
+        this.entryType = options.entryType;
+        this.majorApiVersion = options.majorApiVersion || 1;
+        this.tlogV1 = new client_1.TLogClient({
+            ...options,
+            rekorBaseURL: options.rekorBaseURL || /* istanbul ignore next */ exports.DEFAULT_REKOR_URL,
+        });
+        this.tlogV2 = new client_1.TLogV2Client({
+            ...options,
+            rekorBaseURL: options.rekorBaseURL || /* istanbul ignore next */ exports.DEFAULT_REKOR_URL,
+        });
+    }
+    async testify(content, publicKey) {
+        let tlogEntry;
+        if (this.majorApiVersion === 2) {
+            const request = (0, entry_1.toCreateEntryRequest)(content, publicKey);
+            tlogEntry = await this.tlogV2.createEntry(request);
+        }
+        else {
+            const proposedEntry = (0, entry_1.toProposedEntry)(content, publicKey, this.entryType);
+            const entry = await this.tlogV1.createEntry(proposedEntry);
+            tlogEntry = toTransparencyLogEntry(entry);
+        }
+        return { tlogEntries: [tlogEntry] };
+    }
+}
+exports.RekorWitness = RekorWitness;
+function toTransparencyLogEntry(entry) {
+    const logID = Buffer.from(entry.logID, 'hex');
+    // Parse entry body so we can extract the kind and version.
+    const bodyJSON = util_1.encoding.base64Decode(entry.body);
+    const entryBody = JSON.parse(bodyJSON);
+    const promise = entry?.verification?.signedEntryTimestamp
+        ? inclusionPromise(entry.verification.signedEntryTimestamp)
+        : undefined;
+    const proof = entry?.verification?.inclusionProof
+        ? inclusionProof(entry.verification.inclusionProof)
+        : undefined;
+    const tlogEntry = {
+        logIndex: entry.logIndex.toString(),
+        logId: {
+            keyId: logID,
+        },
+        integratedTime: entry.integratedTime.toString(),
+        kindVersion: {
+            kind: entryBody.kind,
+            version: entryBody.apiVersion,
+        },
+        inclusionPromise: promise,
+        inclusionProof: proof,
+        canonicalizedBody: Buffer.from(entry.body, 'base64'),
+    };
+    return tlogEntry;
+}
+function inclusionPromise(promise) {
+    return {
+        signedEntryTimestamp: Buffer.from(promise, 'base64'),
+    };
+}
+function inclusionProof(proof) {
+    return {
+        logIndex: proof.logIndex.toString(),
+        treeSize: proof.treeSize.toString(),
+        rootHash: Buffer.from(proof.rootHash, 'hex'),
+        hashes: proof.hashes.map((h) => Buffer.from(h, 'hex')),
+        checkpoint: {
+            envelope: proof.checkpoint,
+        },
+    };
+}

package/node_modules/@sigstore/sign/dist/witness/tsa/client.d.ts

@@ -0,0 +1,12 @@
+import type { FetchOptions } from '../../types/fetch';
+export interface TSA {
+    createTimestamp: (signature: Buffer) => Promise<Buffer>;
+}
+export type TSAClientOptions = {
+    tsaBaseURL: string;
+} & FetchOptions;
+export declare class TSAClient implements TSA {
+    private tsa;
+    constructor(options: TSAClientOptions);
+    createTimestamp(signature: Buffer): Promise<Buffer>;
+}

package/node_modules/@sigstore/sign/dist/witness/tsa/client.js

@@ -0,0 +1,47 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TSAClient = void 0;
+/*
+Copyright 2023 The Sigstore Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+const error_1 = require("../../error");
+const tsa_1 = require("../../external/tsa");
+const util_1 = require("../../util");
+const SHA256_ALGORITHM = 'sha256';
+class TSAClient {
+    tsa;
+    constructor(options) {
+        this.tsa = new tsa_1.TimestampAuthority({
+            baseURL: options.tsaBaseURL,
+            retry: options.retry,
+            timeout: options.timeout,
+        });
+    }
+    async createTimestamp(signature) {
+        const request = {
+            artifactHash: util_1.crypto
+                .digest(SHA256_ALGORITHM, signature)
+                .toString('base64'),
+            hashAlgorithm: SHA256_ALGORITHM,
+        };
+        try {
+            return await this.tsa.createTimestamp(request);
+        }
+        catch (err) {
+            (0, error_1.internalError)(err, 'TSA_CREATE_TIMESTAMP_ERROR', 'error creating timestamp');
+        }
+    }
+}
+exports.TSAClient = TSAClient;

package/node_modules/@sigstore/sign/dist/witness/tsa/index.d.ts

@@ -0,0 +1,13 @@
+import { TSAClientOptions } from './client';
+import type { RFC3161SignedTimestamp } from '@sigstore/bundle';
+import type { SignatureBundle, Witness } from '../witness';
+type RFC3161SignedTimestamps = {
+    rfc3161Timestamps: RFC3161SignedTimestamp[];
+};
+export type TSAWitnessOptions = TSAClientOptions;
+export declare class TSAWitness implements Witness {
+    private tsa;
+    constructor(options: TSAWitnessOptions);
+    testify(content: SignatureBundle): Promise<RFC3161SignedTimestamps>;
+}
+export {};

package/node_modules/@sigstore/sign/dist/witness/tsa/index.js

@@ -0,0 +1,45 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TSAWitness = void 0;
+/*
+Copyright 2023 The Sigstore Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+const client_1 = require("./client");
+class TSAWitness {
+    tsa;
+    constructor(options) {
+        this.tsa = new client_1.TSAClient({
+            tsaBaseURL: options.tsaBaseURL,
+            retry: options.retry,
+            timeout: options.timeout,
+        });
+    }
+    async testify(content) {
+        const signature = extractSignature(content);
+        const timestamp = await this.tsa.createTimestamp(signature);
+        return {
+            rfc3161Timestamps: [{ signedTimestamp: timestamp }],
+        };
+    }
+}
+exports.TSAWitness = TSAWitness;
+function extractSignature(content) {
+    switch (content.$case) {
+        case 'dsseEnvelope':
+            return content.dsseEnvelope.signatures[0].sig;
+        case 'messageSignature':
+            return content.messageSignature.signature;
+    }
+}

package/node_modules/@sigstore/sign/dist/witness/witness.d.ts

@@ -0,0 +1,9 @@
+import type { Bundle, RFC3161SignedTimestamp, TransparencyLogEntry } from '@sigstore/bundle';
+export type SignatureBundle = Bundle['content'];
+export type VerificationMaterial = {
+    tlogEntries?: TransparencyLogEntry[];
+    rfc3161Timestamps?: RFC3161SignedTimestamp[];
+};
+export interface Witness {
+    testify: (signature: SignatureBundle, publicKey: string) => Promise<VerificationMaterial>;
+}

package/node_modules/@sigstore/sign/dist/witness/witness.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/node_modules/@sigstore/sign/package.json

@@ -0,0 +1,45 @@
+{
+  "name": "@sigstore/sign",
+  "version": "5.1.0",
+  "description": "Sigstore signing library",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "scripts": {
+    "clean": "shx rm -rf dist *.tsbuildinfo",
+    "build": "tsc --build",
+    "test": "jest"
+  },
+  "files": [
+    "dist"
+  ],
+  "author": "bdehamer@github.com",
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/sigstore/sigstore-js.git"
+  },
+  "bugs": {
+    "url": "https://github.com/sigstore/sigstore-js/issues"
+  },
+  "homepage": "https://github.com/sigstore/sigstore-js/tree/main/packages/sign#readme",
+  "publishConfig": {
+    "provenance": true
+  },
+  "devDependencies": {
+    "@sigstore/jest": "^0.0.0",
+    "@sigstore/mock": "^0.13.1",
+    "@sigstore/rekor-types": "^5.0.0",
+    "@types/make-fetch-happen": "^10.0.4"
+  },
+  "dependencies": {
+    "@gar/promise-retry": "^1.0.2",
+    "@sigstore/bundle": "^5.0.1",
+    "@sigstore/core": "^4.0.0",
+    "@sigstore/protobuf-specs": "^0.5.2",
+    "make-fetch-happen": "^16.0.1",
+    "proc-log": "^7.0.0"
+  },
+  "engines": {
+    "node": "^22.22.2 || ^24.15.0 || >=26.0.0"
+  }
+}