@macula-io/martha 0.0.0-stage → 1.0.0

package/node_modules/@sigstore/verify/dist/trust/index.js

@@ -0,0 +1,90 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.filterTLogAuthorities = exports.filterCertAuthorities = void 0;
+exports.toTrustMaterial = toTrustMaterial;
+/*
+Copyright 2023 The Sigstore Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+const core_1 = require("@sigstore/core");
+const protobuf_specs_1 = require("@sigstore/protobuf-specs");
+const error_1 = require("../error");
+const BEGINNING_OF_TIME = new Date(0);
+const END_OF_TIME = new Date(8640000000000000);
+var filter_1 = require("./filter");
+Object.defineProperty(exports, "filterCertAuthorities", { enumerable: true, get: function () { return filter_1.filterCertAuthorities; } });
+Object.defineProperty(exports, "filterTLogAuthorities", { enumerable: true, get: function () { return filter_1.filterTLogAuthorities; } });
+function toTrustMaterial(root, keys) {
+    const keyFinder = typeof keys === 'function' ? keys : keyLocator(keys);
+    return {
+        certificateAuthorities: root.certificateAuthorities.map(createCertAuthority),
+        timestampAuthorities: root.timestampAuthorities.map(createCertAuthority),
+        tlogs: root.tlogs.map(createTLogAuthority),
+        ctlogs: root.ctlogs.map(createTLogAuthority),
+        publicKey: keyFinder,
+    };
+}
+function createTLogAuthority(tlogInstance) {
+    const keyDetails = tlogInstance.publicKey.keyDetails;
+    const keyType = keyDetails === protobuf_specs_1.PublicKeyDetails.PKCS1_RSA_PKCS1V5 ||
+        keyDetails === protobuf_specs_1.PublicKeyDetails.PKIX_RSA_PKCS1V5 ||
+        keyDetails === protobuf_specs_1.PublicKeyDetails.PKIX_RSA_PKCS1V15_2048_SHA256 ||
+        keyDetails === protobuf_specs_1.PublicKeyDetails.PKIX_RSA_PKCS1V15_3072_SHA256 ||
+        keyDetails === protobuf_specs_1.PublicKeyDetails.PKIX_RSA_PKCS1V15_4096_SHA256
+        ? 'pkcs1'
+        : 'spki';
+    /* istanbul ignore next */
+    return {
+        baseURL: tlogInstance.baseUrl,
+        logID: tlogInstance.checkpointKeyId
+            ? tlogInstance.checkpointKeyId.keyId
+            : tlogInstance.logId.keyId,
+        publicKey: core_1.crypto.createPublicKey(tlogInstance.publicKey.rawBytes, keyType),
+        validFor: {
+            start: tlogInstance.publicKey.validFor?.start || BEGINNING_OF_TIME,
+            end: tlogInstance.publicKey.validFor?.end || END_OF_TIME,
+        },
+    };
+}
+function createCertAuthority(ca) {
+    /* istanbul ignore next */
+    return {
+        certChain: ca.certChain.certificates.map((cert) => {
+            return core_1.X509Certificate.parse(Buffer.from(cert.rawBytes));
+        }),
+        validFor: {
+            start: ca.validFor?.start || BEGINNING_OF_TIME,
+            end: ca.validFor?.end || END_OF_TIME,
+        },
+    };
+}
+function keyLocator(keys) {
+    return (hint) => {
+        const key = (keys || {})[hint];
+        if (!key) {
+            throw new error_1.VerificationError({
+                code: 'PUBLIC_KEY_ERROR',
+                message: `key not found: ${hint}`,
+            });
+        }
+        return {
+            publicKey: core_1.crypto.createPublicKey(key.rawBytes),
+            validFor: (date) => {
+                /* istanbul ignore next */
+                return ((key.validFor?.start || BEGINNING_OF_TIME) <= date &&
+                    (key.validFor?.end || END_OF_TIME) >= date);
+            },
+        };
+    };
+}

package/node_modules/@sigstore/verify/dist/trust/trust.types.d.ts

@@ -0,0 +1,29 @@
+import type { X509Certificate, crypto } from '@sigstore/core';
+export type TLogAuthority = {
+    logID: Buffer;
+    baseURL: string;
+    publicKey: crypto.KeyObject;
+    validFor: {
+        start: Date;
+        end: Date;
+    };
+};
+export type CertAuthority = {
+    certChain: X509Certificate[];
+    validFor: {
+        start: Date;
+        end: Date;
+    };
+};
+export type TimeConstrainedKey = {
+    publicKey: crypto.KeyObject;
+    validFor(date: Date): boolean;
+};
+export type KeyFinderFunc = (hint: string) => TimeConstrainedKey;
+export type TrustMaterial = {
+    certificateAuthorities: CertAuthority[];
+    timestampAuthorities: CertAuthority[];
+    tlogs: TLogAuthority[];
+    ctlogs: TLogAuthority[];
+    publicKey: KeyFinderFunc;
+};

package/node_modules/@sigstore/verify/dist/trust/trust.types.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/node_modules/@sigstore/verify/dist/verifier.d.ts

@@ -0,0 +1,34 @@
+import type { SignedEntity, Signer, VerificationPolicy } from './shared.types';
+import type { TrustMaterial } from './trust';
+/**
+ * Configuration options for the verifier.
+ *
+ * @public
+ */
+export interface VerifierOptions {
+    /**
+     * Minimum number of transparency log entries required for verification.
+     * Identical canonicalized bodies from the same log are rejected as duplicates.
+     */
+    tlogThreshold?: number;
+    /** Minimum number of certificate transparency log entries required */
+    ctlogThreshold?: number;
+    /**
+     * Minimum number of timestamp authority timestamps required for verification
+     * @deprecated Use timestampThreshold instead
+     */
+    tsaThreshold?: number;
+    /** Minimum number of timestamps required for verification */
+    timestampThreshold?: number;
+}
+export declare class Verifier {
+    private trustMaterial;
+    private options;
+    constructor(trustMaterial: TrustMaterial, options?: VerifierOptions);
+    verify(entity: SignedEntity, policy?: VerificationPolicy): Signer;
+    private verifyTimestamps;
+    private verifySigningKey;
+    private verifyTLogs;
+    private verifySignature;
+    private verifyPolicy;
+}

package/node_modules/@sigstore/verify/dist/verifier.js

@@ -0,0 +1,172 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Verifier = void 0;
+/*
+Copyright 2023 The Sigstore Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+const util_1 = require("util");
+const error_1 = require("./error");
+const key_1 = require("./key");
+const policy_1 = require("./policy");
+const timestamp_1 = require("./timestamp");
+const tlog_1 = require("./tlog");
+class Verifier {
+    trustMaterial;
+    options;
+    constructor(trustMaterial, options = {}) {
+        this.trustMaterial = trustMaterial;
+        this.options = {
+            ctlogThreshold: options.ctlogThreshold ?? 1,
+            tlogThreshold: options.tlogThreshold ?? 1,
+            timestampThreshold: options.timestampThreshold ?? options.tsaThreshold ?? 1,
+            tsaThreshold: 0,
+        };
+    }
+    verify(entity, policy) {
+        const timestamps = this.verifyTimestamps(entity);
+        const signer = this.verifySigningKey(entity, timestamps);
+        this.verifyTLogs(entity);
+        this.verifySignature(entity, signer);
+        if (policy) {
+            this.verifyPolicy(policy, signer.identity || {});
+        }
+        return signer;
+    }
+    // Checks that all of the timestamps in the entity are valid and returns them
+    verifyTimestamps(entity) {
+        const timestamps = [];
+        for (const timestamp of entity.timestamps) {
+            switch (timestamp.$case) {
+                case 'timestamp-authority':
+                    timestamps.push((0, timestamp_1.getTSATimestamp)(timestamp.timestamp, entity.signature.signature, this.trustMaterial.timestampAuthorities));
+                    break;
+                case 'transparency-log': {
+                    const result = (0, timestamp_1.getTLogTimestamp)(timestamp.tlogEntry);
+                    if (result) {
+                        timestamps.push(result);
+                    }
+                    break;
+                }
+            }
+        }
+        // Check for duplicate timestamps
+        if (containsDupes(timestamps)) {
+            throw new error_1.VerificationError({
+                code: 'TIMESTAMP_ERROR',
+                message: 'duplicate timestamp',
+            });
+        }
+        if (timestamps.length < this.options.timestampThreshold) {
+            throw new error_1.VerificationError({
+                code: 'TIMESTAMP_ERROR',
+                message: `expected ${this.options.timestampThreshold} timestamps, got ${timestamps.length}`,
+            });
+        }
+        return timestamps.map((t) => t.timestamp);
+    }
+    // Checks that the signing key is valid for all of the the supplied timestamps
+    // and returns the signer.
+    verifySigningKey({ key }, timestamps) {
+        switch (key.$case) {
+            case 'public-key': {
+                return (0, key_1.verifyPublicKey)(key.hint, timestamps, this.trustMaterial);
+            }
+            case 'certificate': {
+                const result = (0, key_1.verifyCertificate)(key.certificate, timestamps, this.trustMaterial);
+                /* istanbul ignore next - no fixture */
+                if (containsDupes(result.scts)) {
+                    throw new error_1.VerificationError({
+                        code: 'CERTIFICATE_ERROR',
+                        message: 'duplicate SCT',
+                    });
+                }
+                if (result.scts.length < this.options.ctlogThreshold) {
+                    throw new error_1.VerificationError({
+                        code: 'CERTIFICATE_ERROR',
+                        message: `expected ${this.options.ctlogThreshold} SCTs, got ${result.scts.length}`,
+                    });
+                }
+                return result.signer;
+            }
+        }
+    }
+    // Checks that the tlog entries are valid for the supplied content
+    verifyTLogs({ signature: content, tlogEntries }) {
+        const entryIDs = [];
+        tlogEntries.forEach((entry) => {
+            (0, tlog_1.verifyTLogInclusion)(entry, this.trustMaterial.tlogs);
+            (0, tlog_1.verifyTLogBody)(entry, content);
+            entryIDs.push({
+                logID: entry.logId.keyId,
+                body: entry.canonicalizedBody,
+            });
+        });
+        // Check for duplicate entries so that repeated copies of a single entry
+        // cannot be counted more than once toward the threshold. Inclusion
+        // verification authenticates the log ID and body, but a proof does not
+        // authenticate the top-level log index.
+        if (containsDupes(entryIDs)) {
+            throw new error_1.VerificationError({
+                code: 'TLOG_ERROR',
+                message: 'duplicate tlog entry',
+            });
+        }
+        if (entryIDs.length < this.options.tlogThreshold) {
+            throw new error_1.VerificationError({
+                code: 'TLOG_ERROR',
+                message: `expected ${this.options.tlogThreshold} tlog entries, got ${entryIDs.length}`,
+            });
+        }
+    }
+    // Checks that the signature is valid for the supplied content
+    verifySignature(entity, signer) {
+        if (!entity.signature.verifySignature(signer.key)) {
+            throw new error_1.VerificationError({
+                code: 'SIGNATURE_ERROR',
+                message: 'signature verification failed',
+            });
+        }
+    }
+    verifyPolicy(policy, identity) {
+        // Check the subject alternative name of the signer matches the policy
+        /* istanbul ignore else */
+        if (policy.subjectAlternativeName) {
+            (0, policy_1.verifySubjectAlternativeName)(policy.subjectAlternativeName, identity.subjectAlternativeName);
+        }
+        // Check that the extensions of the signer match the policy
+        /* istanbul ignore else */
+        if (policy.extensions) {
+            (0, policy_1.verifyExtensions)(policy.extensions, identity.extensions);
+        }
+        // Check that the OIDs of the signer match the policy
+        /* istanbul ignore if */
+        if (policy.oids) {
+            (0, policy_1.verifyOIDs)(policy.oids, identity.oids);
+        }
+    }
+}
+exports.Verifier = Verifier;
+// Checks for duplicate items in the array. Objects are compared using
+// deep equality.
+function containsDupes(arr) {
+    for (let i = 0; i < arr.length; i++) {
+        for (let j = i + 1; j < arr.length; j++) {
+            if ((0, util_1.isDeepStrictEqual)(arr[i], arr[j])) {
+                return true;
+            }
+        }
+    }
+    return false;
+}

package/node_modules/@sigstore/verify/package.json

@@ -0,0 +1,36 @@
+{
+  "name": "@sigstore/verify",
+  "version": "4.1.3",
+  "description": "Verification of Sigstore signatures",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "scripts": {
+    "clean": "shx rm -rf dist *.tsbuildinfo",
+    "build": "tsc --build",
+    "test": "jest"
+  },
+  "files": [
+    "dist"
+  ],
+  "author": "bdehamer@github.com",
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/sigstore/sigstore-js.git"
+  },
+  "bugs": {
+    "url": "https://github.com/sigstore/sigstore-js/issues"
+  },
+  "homepage": "https://github.com/sigstore/sigstore-js/tree/main/packages/verify#readme",
+  "publishConfig": {
+    "provenance": true
+  },
+  "dependencies": {
+    "@sigstore/bundle": "^5.0.1",
+    "@sigstore/core": "^4.0.1",
+    "@sigstore/protobuf-specs": "^0.5.2"
+  },
+  "engines": {
+    "node": "^22.22.2 || ^24.15.0 || >=26.0.0"
+  }
+}

package/node_modules/@tufjs/canonical-json/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2022 GitHub and the TUF Contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/node_modules/@tufjs/canonical-json/README.md

@@ -0,0 +1,53 @@
+# @tufjs/canonical-json
+
+JSON canonicalization compliant with the [OLPC Canonical JSON specification][1].
+
+## Why
+
+If you're looking for [RFC 8785][2] compliant JSON canonicalization there are
+[any][3] [number][4] [of][5] [libraries][6] [to][7] [choose][8] [from][9].
+You should only select this library if you know that you specifically need
+support for the [OLPC][1]-style of canonicalization.
+
+One reason you might chose OLPC compliance is for interoperability with
+[The Update Framework][10] which specifically calls out OLPC as the
+canonicalization standard for computing signatures over TUF metadata.
+
+The canonicalized strings generated by this library are compatible with those
+generated by the Python-based [securesystemslib][11] library and the Go-based
+[go-securesystemslib][12] library.
+
+## Installation
+
+```console
+npm install @tufjs/canonical-json
+```
+
+## Usage
+
+```javascript
+const json = require('@tufjs/canonical-json')
+
+const obj = {
+  bool: true,
+  num: 42,
+  ary: [1, 2, 3],
+  str: "foo\\bar"
+}
+
+console.log(json.canonicalize(obj))
+// output: {"ary":[1,2,3],"bool":true,"num":42,"str":"foo\\bar"}
+```
+
+[1]: https://wiki.laptop.org/go/Canonical_JSON
+[2]: https://www.rfc-editor.org/rfc/rfc8785
+[3]: https://www.npmjs.com/package/@stratumn/canonicaljson
+[4]: https://www.npmjs.com/package/@truestamp/canonify
+[5]: https://www.npmjs.com/package/canonical-json
+[6]: https://www.npmjs.com/package/canonicalize
+[7]: https://www.npmjs.com/package/canonicalize-json
+[8]: https://www.npmjs.com/package/json-canonicalize
+[9]: https://www.npmjs.com/package/another-json
+[10]: https://theupdateframework.github.io/specification/latest/#metaformat
+[11]: https://github.com/secure-systems-lab/securesystemslib
+[12]: https://github.com/secure-systems-lab/go-securesystemslib

package/node_modules/@tufjs/canonical-json/lib/index.d.ts

@@ -0,0 +1,2 @@
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+export const canonicalize: (object: any) => string;

package/node_modules/@tufjs/canonical-json/lib/index.js

@@ -0,0 +1,64 @@
+const COMMA = ',';
+const COLON = ':';
+const LEFT_SQUARE_BRACKET = '[';
+const RIGHT_SQUARE_BRACKET = ']';
+const LEFT_CURLY_BRACKET = '{';
+const RIGHT_CURLY_BRACKET = '}';
+
+// Recursively encodes the supplied object according to the canonical JSON form
+// as specified at http://wiki.laptop.org/go/Canonical_JSON. It's a restricted
+// dialect of JSON in which keys are lexically sorted, floats are not allowed,
+// and only double quotes and backslashes are escaped.
+function canonicalize(object) {
+  const buffer = [];
+  if (typeof object === 'string') {
+    buffer.push(canonicalizeString(object));
+  } else if (typeof object === 'boolean') {
+    buffer.push(JSON.stringify(object));
+  } else if (Number.isInteger(object)) {
+    buffer.push(JSON.stringify(object));
+  } else if (object === null) {
+    buffer.push(JSON.stringify(object));
+  } else if (Array.isArray(object)) {
+    buffer.push(LEFT_SQUARE_BRACKET);
+    let first = true;
+    object.forEach((element) => {
+      if (!first) {
+        buffer.push(COMMA);
+      }
+      first = false;
+      buffer.push(canonicalize(element));
+    });
+    buffer.push(RIGHT_SQUARE_BRACKET);
+  } else if (typeof object === 'object') {
+    buffer.push(LEFT_CURLY_BRACKET);
+    let first = true;
+    Object.keys(object)
+      .sort()
+      .forEach((property) => {
+        if (!first) {
+          buffer.push(COMMA);
+        }
+        first = false;
+        buffer.push(canonicalizeString(property));
+        buffer.push(COLON);
+        buffer.push(canonicalize(object[property]));
+      });
+    buffer.push(RIGHT_CURLY_BRACKET);
+  } else {
+    throw new TypeError('cannot encode ' + object.toString());
+  }
+
+  return buffer.join('');
+}
+
+// String canonicalization consists of escaping backslash (\) and double
+// quote (") characters and wrapping the resulting string in double quotes.
+function canonicalizeString(string) {
+  const escapedString = string.replace(/\\/g, '\\\\').replace(/"/g, '\\"');
+  return '"' + escapedString + '"';
+}
+
+module.exports = {
+  canonicalize,
+};

package/node_modules/@tufjs/canonical-json/package.json

@@ -0,0 +1,35 @@
+{
+  "name": "@tufjs/canonical-json",
+  "version": "2.0.0",
+  "description": "OLPC JSON canonicalization",
+  "main": "lib/index.js",
+  "typings": "lib/index.d.ts",
+  "license": "MIT",
+  "keywords": [
+    "json",
+    "canonical",
+    "canonicalize",
+    "canonicalization",
+    "crypto",
+    "signature",
+    "olpc"
+  ],
+  "author": "bdehamer@github.com",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/theupdateframework/tuf-js.git"
+  },
+  "homepage": "https://github.com/theupdateframework/tuf-js/tree/main/packages/canonical-json#readme",
+  "bugs": {
+    "url": "https://github.com/theupdateframework/tuf-js/issues"
+  },
+  "files": [
+    "lib/"
+  ],
+  "scripts": {
+    "test": "jest"
+  },
+  "engines": {
+    "node": "^16.14.0 || >=18.0.0"
+  }
+}

package/node_modules/@tufjs/models/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2022 GitHub and the TUF Contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/node_modules/@tufjs/models/README.md

@@ -0,0 +1,3 @@
+# @tufjs/models
+
+TUF metadata model objects.

package/node_modules/@tufjs/models/dist/base.d.ts

@@ -0,0 +1,37 @@
+import { Signature } from './signature';
+import { JSONObject, JSONValue } from './utils';
+export interface Signable {
+    signatures: Record<string, Signature>;
+    signed: Signed;
+}
+export interface SignedOptions {
+    version: number;
+    specVersion: string;
+    expires: string;
+    unrecognizedFields?: Record<string, JSONValue>;
+}
+export declare enum MetadataKind {
+    Root = "root",
+    Timestamp = "timestamp",
+    Snapshot = "snapshot",
+    Targets = "targets"
+}
+export declare function isMetadataKind(value: unknown): value is MetadataKind;
+/***
+ * A base class for the signed part of TUF metadata.
+ *
+ * Objects with base class Signed are usually included in a ``Metadata`` object
+ * on the signed attribute. This class provides attributes and methods that
+ * are common for all TUF metadata types (roles).
+ */
+export declare abstract class Signed {
+    readonly specVersion: string;
+    readonly expires: string;
+    readonly version: number;
+    readonly unrecognizedFields: Record<string, JSONValue>;
+    constructor(options: SignedOptions);
+    equals(other: Signed): boolean;
+    isExpired(referenceTime?: Date): boolean;
+    static commonFieldsFromJSON(data: JSONObject): SignedOptions;
+    abstract toJSON(): JSONObject;
+}