@macula-io/martha 0.0.0 → 1.0.0

package/node_modules/@sigstore/protobuf-specs/dist/__generated__/sigstore_bundle.d.ts

@@ -0,0 +1,146 @@
+import { Envelope } from "./envelope";
+import { MessageSignature, PublicKeyIdentifier, RFC3161SignedTimestamp, X509Certificate, X509CertificateChain } from "./sigstore_common";
+import { TransparencyLogEntry } from "./sigstore_rekor";
+/**
+ * Various timestamped counter signatures over the artifacts signature.
+ * Currently only RFC3161 signatures are provided. More formats may be added
+ * in the future.
+ */
+export interface TimestampVerificationData {
+    /**
+     * A list of RFC3161 signed timestamps provided by the user.
+     * This can be used when the entry has not been stored on a
+     * transparency log, or in conjunction for a stronger trust model.
+     * Clients MUST verify the hashed message in the message imprint
+     * against the signature in the bundle.
+     */
+    rfc3161Timestamps: RFC3161SignedTimestamp[];
+}
+/**
+ * VerificationMaterial captures details on the materials used to verify
+ * signatures. This message may be embedded in a DSSE envelope as a signature
+ * extension. Specifically, the `ext` field of the extension will expect this
+ * message when the signature extension is for Sigstore. This is identified by
+ * the `kind` field in the extension, which must be set to
+ * application/vnd.dev.sigstore.verificationmaterial;version=0.1 for Sigstore.
+ * When used as a DSSE extension, if the `public_key` field is used to indicate
+ * the key identifier, it MUST match the `keyid` field of the signature the
+ * extension is attached to.
+ */
+export interface VerificationMaterial {
+    /**
+     * The key material for verification purposes.
+     *
+     * This allows key material to be conveyed in one of three forms:
+     *
+     * 1. An unspecified public key identifier, for retrieving a key
+     *    from an out-of-band mechanism (such as a keyring);
+     *
+     * 2. A sequence of one or more X.509 certificates, of which the first member
+     *    MUST be a leaf certificate conveying the signing key. Subsequent members
+     *    SHOULD be in issuing order, meaning that `n + 1` should be an issuer for `n`.
+     *
+     *    Signers MUST NOT include root CA certificates in bundles, and SHOULD NOT
+     *    include intermediate CA certificates that appear in an independent root of trust
+     *    (such as the Public Good Instance's trusted root).
+     *
+     *    Verifiers MUST validate the chain carefully to ensure that it chains up
+     *    to a CA certificate that they independently trust. Verifiers SHOULD
+     *    handle old or non-complying bundles that have superfluous intermediate and/or
+     *    root CA certificates by either ignoring them or explicitly considering them
+     *    untrusted for the purposes of chain building.
+     *
+     * 3. A single X.509 certificate, which MUST be a leaf certificate conveying
+     *    the signing key.
+     *
+     * When used with the Public Good Instance (PGI) of Sigstore for "keyless" signing
+     * via Fulcio, form (1) MUST NOT be used, regardless of bundle version. Form (1)
+     * MAY be used with the PGI for self-managed keys.
+     *
+     * When used in a `0.1` or `0.2` bundle with the PGI and "keyless" signing,
+     * form (2) MUST be used.
+     *
+     * When used in a `0.3` bundle with the PGI and "keyless" signing,
+     * form (3) MUST be used.
+     */
+    content: {
+        $case: "publicKey";
+        publicKey: PublicKeyIdentifier;
+    } | {
+        $case: "x509CertificateChain";
+        x509CertificateChain: X509CertificateChain;
+    } | {
+        $case: "certificate";
+        certificate: X509Certificate;
+    } | undefined;
+    /**
+     * An inclusion proof and an optional signed timestamp from the log.
+     * Client verification libraries MAY provide an option to support v0.1
+     * bundles for backwards compatibility, which may contain an inclusion
+     * promise and not an inclusion proof. In this case, the client MUST
+     * validate the promise.
+     * Verifiers SHOULD NOT allow v0.1 bundles if they're used in an
+     * ecosystem which never produced them.
+     */
+    tlogEntries: TransparencyLogEntry[];
+    /**
+     * Timestamp may also come from
+     * tlog_entries.inclusion_promise.signed_entry_timestamp.
+     */
+    timestampVerificationData: TimestampVerificationData | undefined;
+}
+export interface Bundle {
+    /**
+     * MUST be application/vnd.dev.sigstore.bundle.v0.3+json when
+     * when encoded as JSON.
+     * Clients must to be able to accept media type using the previously
+     * defined formats:
+     * * application/vnd.dev.sigstore.bundle+json;version=0.1
+     * * application/vnd.dev.sigstore.bundle+json;version=0.2
+     * * application/vnd.dev.sigstore.bundle+json;version=0.3
+     */
+    mediaType: string;
+    /**
+     * When a signer is identified by a X.509 certificate, a verifier MUST
+     * verify that the signature was computed at the time the certificate
+     * was valid as described in the Sigstore client spec: "Verification
+     * using a Bundle".
+     * <https://docs.google.com/document/d/1kbhK2qyPPk8SLavHzYSDM8-Ueul9_oxIMVFuWMWKz0E/edit#heading=h.x8bduppe89ln>
+     * If the verification material contains a public key identifier
+     * (key hint) and the `content` is a DSSE envelope, the key hints
+     * MUST be exactly the same in the verification material and in the
+     * DSSE envelope.
+     */
+    verificationMaterial: VerificationMaterial | undefined;
+    content: {
+        $case: "messageSignature";
+        messageSignature: MessageSignature;
+    } | //
+    /**
+     * A DSSE envelope can contain arbitrary payloads.
+     * Verifiers must verify that the payload type is a
+     * supported and expected type. This is part of the DSSE
+     * protocol which is defined here:
+     * <https://github.com/secure-systems-lab/dsse/blob/master/protocol.md>
+     * DSSE envelopes in a bundle MUST have exactly one signature.
+     * This is a limitation from the DSSE spec, as it can contain
+     * multiple signatures. There are two primary reasons:
+     * 1. It simplifies the verification logic and policy
+     * 2. The bundle (currently) can only contain a single
+     *    instance of the required verification materials
+     * During verification a client MUST reject an envelope if
+     * the number of signatures is not equal to one.
+     */
+    {
+        $case: "dsseEnvelope";
+        dsseEnvelope: Envelope;
+    } | undefined;
+}
+export declare const TimestampVerificationData: MessageFns<TimestampVerificationData>;
+export declare const VerificationMaterial: MessageFns<VerificationMaterial>;
+export declare const Bundle: MessageFns<Bundle>;
+interface MessageFns<T> {
+    fromJSON(object: any): T;
+    toJSON(message: T): unknown;
+}
+export {};

package/node_modules/@sigstore/protobuf-specs/dist/__generated__/sigstore_bundle.js

@@ -0,0 +1,103 @@
+"use strict";
+// Code generated by protoc-gen-ts_proto. DO NOT EDIT.
+// versions:
+//   protoc-gen-ts_proto  v2.12.0
+//   protoc               v7.35.1
+// source: sigstore_bundle.proto
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Bundle = exports.VerificationMaterial = exports.TimestampVerificationData = void 0;
+/* eslint-disable */
+const envelope_1 = require("./envelope");
+const sigstore_common_1 = require("./sigstore_common");
+const sigstore_rekor_1 = require("./sigstore_rekor");
+exports.TimestampVerificationData = {
+    fromJSON(object) {
+        return {
+            rfc3161Timestamps: globalThis.Array.isArray(object?.rfc3161Timestamps)
+                ? object.rfc3161Timestamps.map((e) => sigstore_common_1.RFC3161SignedTimestamp.fromJSON(e))
+                : [],
+        };
+    },
+    toJSON(message) {
+        const obj = {};
+        if (message.rfc3161Timestamps?.length) {
+            obj.rfc3161Timestamps = message.rfc3161Timestamps.map((e) => sigstore_common_1.RFC3161SignedTimestamp.toJSON(e));
+        }
+        return obj;
+    },
+};
+exports.VerificationMaterial = {
+    fromJSON(object) {
+        return {
+            content: isSet(object.publicKey)
+                ? { $case: "publicKey", publicKey: sigstore_common_1.PublicKeyIdentifier.fromJSON(object.publicKey) }
+                : isSet(object.x509CertificateChain)
+                    ? {
+                        $case: "x509CertificateChain",
+                        x509CertificateChain: sigstore_common_1.X509CertificateChain.fromJSON(object.x509CertificateChain),
+                    }
+                    : isSet(object.certificate)
+                        ? { $case: "certificate", certificate: sigstore_common_1.X509Certificate.fromJSON(object.certificate) }
+                        : undefined,
+            tlogEntries: globalThis.Array.isArray(object?.tlogEntries)
+                ? object.tlogEntries.map((e) => sigstore_rekor_1.TransparencyLogEntry.fromJSON(e))
+                : [],
+            timestampVerificationData: isSet(object.timestampVerificationData)
+                ? exports.TimestampVerificationData.fromJSON(object.timestampVerificationData)
+                : undefined,
+        };
+    },
+    toJSON(message) {
+        const obj = {};
+        if (message.content?.$case === "publicKey") {
+            obj.publicKey = sigstore_common_1.PublicKeyIdentifier.toJSON(message.content.publicKey);
+        }
+        else if (message.content?.$case === "x509CertificateChain") {
+            obj.x509CertificateChain = sigstore_common_1.X509CertificateChain.toJSON(message.content.x509CertificateChain);
+        }
+        else if (message.content?.$case === "certificate") {
+            obj.certificate = sigstore_common_1.X509Certificate.toJSON(message.content.certificate);
+        }
+        if (message.tlogEntries?.length) {
+            obj.tlogEntries = message.tlogEntries.map((e) => sigstore_rekor_1.TransparencyLogEntry.toJSON(e));
+        }
+        if (message.timestampVerificationData !== undefined) {
+            obj.timestampVerificationData = exports.TimestampVerificationData.toJSON(message.timestampVerificationData);
+        }
+        return obj;
+    },
+};
+exports.Bundle = {
+    fromJSON(object) {
+        return {
+            mediaType: isSet(object.mediaType) ? globalThis.String(object.mediaType) : "",
+            verificationMaterial: isSet(object.verificationMaterial)
+                ? exports.VerificationMaterial.fromJSON(object.verificationMaterial)
+                : undefined,
+            content: isSet(object.messageSignature)
+                ? { $case: "messageSignature", messageSignature: sigstore_common_1.MessageSignature.fromJSON(object.messageSignature) }
+                : isSet(object.dsseEnvelope)
+                    ? { $case: "dsseEnvelope", dsseEnvelope: envelope_1.Envelope.fromJSON(object.dsseEnvelope) }
+                    : undefined,
+        };
+    },
+    toJSON(message) {
+        const obj = {};
+        if (message.mediaType !== "") {
+            obj.mediaType = message.mediaType;
+        }
+        if (message.verificationMaterial !== undefined) {
+            obj.verificationMaterial = exports.VerificationMaterial.toJSON(message.verificationMaterial);
+        }
+        if (message.content?.$case === "messageSignature") {
+            obj.messageSignature = sigstore_common_1.MessageSignature.toJSON(message.content.messageSignature);
+        }
+        else if (message.content?.$case === "dsseEnvelope") {
+            obj.dsseEnvelope = envelope_1.Envelope.toJSON(message.content.dsseEnvelope);
+        }
+        return obj;
+    },
+};
+function isSet(value) {
+    return value !== null && value !== undefined;
+}

package/node_modules/@sigstore/protobuf-specs/dist/__generated__/sigstore_common.d.ts

@@ -0,0 +1,304 @@
+/**
+ * Only a subset of the secure hash standard algorithms are supported.
+ * See <https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.180-4.pdf> for more
+ * details.
+ * UNSPECIFIED SHOULD not be used, primary reason for inclusion is to force
+ * any proto JSON serialization to emit the used hash algorithm, as default
+ * option is to *omit* the default value of an enum (which is the first
+ * value, represented by '0'.
+ */
+export declare enum HashAlgorithm {
+    HASH_ALGORITHM_UNSPECIFIED = 0,
+    SHA2_256 = 1,
+    SHA2_384 = 2,
+    SHA2_512 = 3,
+    /**
+     * SHA3_256 - Used for LMS
+     *
+     * @deprecated
+     */
+    SHA3_256 = 4,
+    /**
+     * SHA3_384 - Used for LMS
+     *
+     * @deprecated
+     */
+    SHA3_384 = 5
+}
+export declare function hashAlgorithmFromJSON(object: any): HashAlgorithm;
+export declare function hashAlgorithmToJSON(object: HashAlgorithm): string;
+/**
+ * Details of a specific public key, capturing the the key encoding method,
+ * and signature algorithm.
+ *
+ * PublicKeyDetails captures the public key/hash algorithm combinations
+ * recommended in the Sigstore ecosystem.
+ *
+ * This is modelled as a linear set as we want to provide a small number of
+ * opinionated options instead of allowing every possible permutation.
+ *
+ * Any changes to this enum MUST be reflected in the algorithm registry.
+ *
+ * See: <https://github.com/sigstore/architecture-docs/blob/main/algorithm-registry.md>
+ *
+ * To avoid the possibility of contradicting formats such as PKCS1 with
+ * ED25519 the valid permutations are listed as a linear set instead of a
+ * cartesian set (i.e one combined variable instead of two, one for encoding
+ * and one for the signature algorithm).
+ */
+export declare enum PublicKeyDetails {
+    PUBLIC_KEY_DETAILS_UNSPECIFIED = 0,
+    /**
+     * PKCS1_RSA_PKCS1V5 - RSA
+     *
+     * @deprecated
+     */
+    PKCS1_RSA_PKCS1V5 = 1,
+    /**
+     * PKCS1_RSA_PSS - See RFC8017
+     *
+     * @deprecated
+     */
+    PKCS1_RSA_PSS = 2,
+    /** @deprecated */
+    PKIX_RSA_PKCS1V5 = 3,
+    /** @deprecated */
+    PKIX_RSA_PSS = 4,
+    /** PKIX_RSA_PKCS1V15_2048_SHA256 - RSA public key in PKIX format, PKCS#1v1.5 signature */
+    PKIX_RSA_PKCS1V15_2048_SHA256 = 9,
+    PKIX_RSA_PKCS1V15_3072_SHA256 = 10,
+    PKIX_RSA_PKCS1V15_4096_SHA256 = 11,
+    /** PKIX_RSA_PSS_2048_SHA256 - RSA public key in PKIX format, RSASSA-PSS signature */
+    PKIX_RSA_PSS_2048_SHA256 = 16,
+    PKIX_RSA_PSS_3072_SHA256 = 17,
+    PKIX_RSA_PSS_4096_SHA256 = 18,
+    /**
+     * PKIX_ECDSA_P256_HMAC_SHA_256 - ECDSA
+     *
+     * @deprecated
+     */
+    PKIX_ECDSA_P256_HMAC_SHA_256 = 6,
+    /** PKIX_ECDSA_P256_SHA_256 - See NIST FIPS 186-4 */
+    PKIX_ECDSA_P256_SHA_256 = 5,
+    PKIX_ECDSA_P384_SHA_384 = 12,
+    PKIX_ECDSA_P521_SHA_512 = 13,
+    /** PKIX_ED25519 - Ed 25519 */
+    PKIX_ED25519 = 7,
+    PKIX_ED25519_PH = 8,
+    /**
+     * PKIX_ECDSA_P384_SHA_256 - These algorithms are deprecated and should not be used, but they
+     * were/are being used by most Sigstore clients implementations.
+     *
+     * @deprecated
+     */
+    PKIX_ECDSA_P384_SHA_256 = 19,
+    /** @deprecated */
+    PKIX_ECDSA_P521_SHA_256 = 20,
+    /**
+     * LMS_SHA256 - LMS and LM-OTS
+     *
+     * These algorithms are deprecated and should not be used.
+     * There are no plans to support SLH-DSA at this time.
+     *
+     * USER WARNING: LMS and LM-OTS are both stateful signature schemes.
+     * Using them correctly requires discretion and careful consideration
+     * to ensure that individual secret keys are not used more than once.
+     * In addition, LM-OTS is a single-use scheme, meaning that it
+     * MUST NOT be used for more than one signature per LM-OTS key.
+     * If you cannot maintain these invariants, you MUST NOT use these
+     * schemes.
+     *
+     * @deprecated
+     */
+    LMS_SHA256 = 14,
+    /** @deprecated */
+    LMOTS_SHA256 = 15,
+    /**
+     * ML_DSA_44 - ML-DSA
+     *
+     * These ML_DSA_44, ML_DSA_65 and ML-DSA_87 algorithms are the pure variants
+     * that take data to sign rather than the prehash variants (HashML-DSA), which
+     * take digests. While considered quantum-resistant, their usage
+     * involves tradeoffs in that signatures and keys are much larger, and
+     * this makes deployments more costly.
+     *
+     * USER WARNING: ML_DSA_44, ML_DSA_65 and ML_DSA_87 are experimental algorithms.
+     * In the future they MAY be used by private Sigstore deployments, but
+     * they are not yet fully functional. This warning will be removed when
+     * these algorithms are widely supported by Sigstore clients and servers,
+     * but care should still be taken for production environments.
+     *
+     * See NIST FIPS 204, RFC 9881 for algorithm identifiers
+     */
+    ML_DSA_44 = 23,
+    ML_DSA_65 = 21,
+    ML_DSA_87 = 22
+}
+export declare function publicKeyDetailsFromJSON(object: any): PublicKeyDetails;
+export declare function publicKeyDetailsToJSON(object: PublicKeyDetails): string;
+export declare enum SubjectAlternativeNameType {
+    SUBJECT_ALTERNATIVE_NAME_TYPE_UNSPECIFIED = 0,
+    EMAIL = 1,
+    URI = 2,
+    /**
+     * OTHER_NAME - OID 1.3.6.1.4.1.57264.1.7
+     * See https://github.com/sigstore/fulcio/blob/main/docs/oid-info.md#1361415726417--othername-san
+     * for more details.
+     */
+    OTHER_NAME = 3
+}
+export declare function subjectAlternativeNameTypeFromJSON(object: any): SubjectAlternativeNameType;
+export declare function subjectAlternativeNameTypeToJSON(object: SubjectAlternativeNameType): string;
+/**
+ * HashOutput captures a digest of a 'message' (generic octet sequence)
+ * and the corresponding hash algorithm used.
+ */
+export interface HashOutput {
+    algorithm: HashAlgorithm;
+    /**
+     * This is the raw octets of the message digest as computed by
+     * the hash algorithm.
+     */
+    digest: Buffer;
+}
+/** MessageSignature stores the computed signature over a message. */
+export interface MessageSignature {
+    /**
+     * Message digest can be used to identify the artifact.
+     * Clients MUST NOT attempt to use this digest to verify the associated
+     * signature; it is intended solely for identification.
+     */
+    messageDigest: HashOutput | undefined;
+    /**
+     * The raw bytes as returned from the signature algorithm.
+     * The signature algorithm (and so the format of the signature bytes)
+     * are determined by the contents of the 'verification_material',
+     * either a key-pair or a certificate. If using a certificate, the
+     * certificate contains the required information on the signature
+     * algorithm.
+     * When using a key pair, the algorithm MUST be part of the public
+     * key, which MUST be communicated out-of-band.
+     */
+    signature: Buffer;
+}
+/** LogId captures the identity of a transparency log. */
+export interface LogId {
+    /** The unique identity of the log, represented by its public key. */
+    keyId: Buffer;
+}
+/** This message holds a RFC 3161 timestamp. */
+export interface RFC3161SignedTimestamp {
+    /**
+     * Signed timestamp is the DER encoded TimeStampResponse.
+     * See https://www.rfc-editor.org/rfc/rfc3161.html#section-2.4.2
+     */
+    signedTimestamp: Buffer;
+}
+export interface PublicKey {
+    /**
+     * DER-encoded public key, encoding method is specified by the
+     * key_details attribute.
+     */
+    rawBytes?: Buffer | undefined;
+    /** Key encoding and signature algorithm to use for this key. */
+    keyDetails: PublicKeyDetails;
+    /** Optional validity period for this key, *inclusive* of the endpoints. */
+    validFor?: TimeRange | undefined;
+}
+/**
+ * PublicKeyIdentifier can be used to identify an (out of band) delivered
+ * key, to verify a signature.
+ */
+export interface PublicKeyIdentifier {
+    /**
+     * Optional unauthenticated hint on which key to use.
+     * The format of the hint must be agreed upon out of band by the
+     * signer and the verifiers, and so is not subject to this
+     * specification.
+     * Example use-case is to specify the public key to use, from a
+     * trusted key-ring.
+     * Implementors are RECOMMENDED to derive the value from the public
+     * key as described in RFC 6962.
+     * See: <https://www.rfc-editor.org/rfc/rfc6962#section-3.2>
+     */
+    hint: string;
+}
+/** An ASN.1 OBJECT IDENTIFIER */
+export interface ObjectIdentifier {
+    id: number[];
+}
+/** An OID and the corresponding (byte) value. */
+export interface ObjectIdentifierValuePair {
+    oid: ObjectIdentifier | undefined;
+    value: Buffer;
+}
+export interface DistinguishedName {
+    organization: string;
+    commonName: string;
+}
+export interface X509Certificate {
+    /** DER-encoded X.509 certificate. */
+    rawBytes: Buffer;
+}
+export interface SubjectAlternativeName {
+    type: SubjectAlternativeNameType;
+    identity: //
+    /**
+     * A regular expression describing the expected value for
+     * the SAN.
+     */
+    {
+        $case: "regexp";
+        regexp: string;
+    } | //
+    /** The exact value to match against. */
+    {
+        $case: "value";
+        value: string;
+    } | undefined;
+}
+/**
+ * A collection of X.509 certificates.
+ *
+ * This "chain" can be used in multiple contexts, such as providing a root CA
+ * certificate within a TUF root of trust or multiple untrusted certificates for
+ * the purpose of chain building.
+ */
+export interface X509CertificateChain {
+    /**
+     * One or more DER-encoded certificates.
+     *
+     * In some contexts (such as `VerificationMaterial.x509_certificate_chain`), this sequence
+     * has an imposed order. Unless explicitly specified, there is otherwise no
+     * guaranteed order.
+     */
+    certificates: X509Certificate[];
+}
+/**
+ * The time range is closed and includes both the start and end times,
+ * (i.e., [start, end]).
+ * End is optional to be able to capture a period that has started but
+ * has no known end.
+ */
+export interface TimeRange {
+    start: Date | undefined;
+    end?: Date | undefined;
+}
+export declare const HashOutput: MessageFns<HashOutput>;
+export declare const MessageSignature: MessageFns<MessageSignature>;
+export declare const LogId: MessageFns<LogId>;
+export declare const RFC3161SignedTimestamp: MessageFns<RFC3161SignedTimestamp>;
+export declare const PublicKey: MessageFns<PublicKey>;
+export declare const PublicKeyIdentifier: MessageFns<PublicKeyIdentifier>;
+export declare const ObjectIdentifier: MessageFns<ObjectIdentifier>;
+export declare const ObjectIdentifierValuePair: MessageFns<ObjectIdentifierValuePair>;
+export declare const DistinguishedName: MessageFns<DistinguishedName>;
+export declare const X509Certificate: MessageFns<X509Certificate>;
+export declare const SubjectAlternativeName: MessageFns<SubjectAlternativeName>;
+export declare const X509CertificateChain: MessageFns<X509CertificateChain>;
+export declare const TimeRange: MessageFns<TimeRange>;
+interface MessageFns<T> {
+    fromJSON(object: any): T;
+    toJSON(message: T): unknown;
+}
+export {};