@thurinlabs/identity-kit 1.0.1 → 1.0.3

package/dist/index.js

@@ -1339,6 +1339,9 @@ function keyIdToBytes(keyId) {
 }
 
 // src/core/pgp.ts
+function pgpConfig(openpgp) {
+  return { ...openpgp.config, rejectCurves: /* @__PURE__ */ new Set() };
+}
 function algorithmName(keyOrSubkey) {
   try {
     const info = keyOrSubkey.getAlgorithmInfo();
@@ -1360,7 +1363,9 @@ function algorithmName(keyOrSubkey) {
 }
 async function parsePgpKey(armoredKey) {
   try {
-    const { readKey } = await import("openpgp");
+    const openpgp = await import("openpgp");
+    const { readKey } = openpgp;
+    const config = pgpConfig(openpgp);
     const key = await readKey({ armoredKey });
     const fingerprint = key.getFingerprint().toUpperCase();
     const algorithm = algorithmName(key);
@@ -1379,7 +1384,12 @@ async function parsePgpKey(armoredKey) {
           await cert.verify(
             key.keyPacket,
             cert.signatureType,
-            { userID: user.userID, key: key.keyPacket }
+            { userID: user.userID, key: key.keyPacket },
+            void 0,
+            // date: now
+            void 0,
+            // detached
+            config
           );
         } catch {
           continue;
@@ -1423,15 +1433,28 @@ async function verifyAttestation({
     if (!pgpPublicKey || !pgpSignature) {
       return { verified: false, reason: "Missing PGP data" };
     }
-    const { readKey, readCleartextMessage, verify } = await import("openpgp");
+    const openpgp = await import("openpgp");
+    const { readKey, readCleartextMessage, LiteralDataPacket } = openpgp;
+    const config = pgpConfig(openpgp);
     const publicKey = await readKey({ armoredKey: pgpPublicKey });
     const keyFingerprint = publicKey.getFingerprint().toUpperCase();
     if (keyFingerprint !== fingerprint.toUpperCase()) {
       return { verified: false, reason: "Key fingerprint mismatch" };
     }
     const message = await readCleartextMessage({ cleartextMessage: pgpSignature });
-    const { signatures } = await verify({ message, verificationKeys: publicKey });
-    await signatures[0].verified;
+    const msg = message;
+    const now = /* @__PURE__ */ new Date();
+    let signed = false;
+    for (const sig of msg.signature.packets) {
+      if (!publicKey.getKeys(sig.issuerKeyID).length) continue;
+      const signingKey = await publicKey.getSigningKey(sig.issuerKeyID, now, void 0, config);
+      const literal = new LiteralDataPacket();
+      literal.setText(msg.text ?? message.getText().replace(/\r?\n/g, "\r\n"));
+      await sig.verify(signingKey.keyPacket, sig.signatureType, literal, now, true, config);
+      signed = true;
+      break;
+    }
+    if (!signed) return { verified: false, reason: "Message is not signed by this key" };
     const signedText = message.getText();
     if (!signedText.toLowerCase().includes(ethAddress.toLowerCase())) {
       return { verified: false, reason: "Signed message does not contain ETH address" };