@xemahq/biome-supply-chain 0.1.3 → 0.3.0

package/README.md

@@ -22,6 +22,7 @@ import {
   ensureCosignAvailable,
   verifyCosignSignature,
   verifyCosignBlob,
+  CosignTrustAnchorKind,
   SignatureVerdict,
   CosignVerifyOutcome,
 } from '@xemahq/biome-supply-chain';
@@ -35,20 +36,41 @@ await verifyCosignSignature({
   oidcIssuer: 'https://token.actions.githubusercontent.com',
 });
 
-// Detached blob (caller owns artifact/bundle files on disk)
-const { outcome, matchedIdentity } = await verifyCosignBlob({
+// Detached blob (caller owns artifact/bundle/public-key files on disk).
+// A trust anchor is EITHER a keyless certificate-identity pattern OR a NAMED
+// public key; both kinds share one list and one result shape, and the anchors
+// are tried in order until one verifies.
+const { outcome, matchedAnchor } = await verifyCosignBlob({
   artifactPath: '/tmp/remoteEntry.js',
   bundlePath: '/tmp/remoteEntry.js.bundle',
-  trustedIdentityRegexps: ['^https://github.com/xema-dev/.*$'],
+  anchors: [
+    {
+      kind: CosignTrustAnchorKind.KeylessIdentity,
+      name: '^https://github.com/xema-dev/.*$', // the name IS the regexp
+    },
+    {
+      kind: CosignTrustAnchorKind.PublicKey,
+      name: 'release-2026',
+      publicKeyPath: '/etc/cosign/release.pub',
+    },
+  ],
+  // Optional: pin the Sigstore trusted root so KEYLESS anchors verify with
+  // `--offline --trusted-root` (air-gap capable). A missing, unreadable or
+  // digest-mismatched root THROWS `CosignTrustedRootError` before cosign is
+  // spawned — it never falls back to cosign's online default.
+  trustedRoot: { path: '/etc/sigstore/trusted-root.json', sha256: '<64 hex>' },
 });
 if (outcome === CosignVerifyOutcome.Verified) {
-  // matchedIdentity is the regexp that verified
+  // matchedAnchor is { kind, name } — WHICH anchor vouched for the bytes
 }
 ```
 
+An empty `anchors` list resolves to `Failed` without spawning cosign, and a
+failed verification is a neutral outcome rather than a throw.
+
 Artifact resolution (resolving an OCI ref, or fetching + writing a blob to a
-temp file) stays with each consumer; this package owns only the cosign exec and
-the verdict enums.
+temp file) stays with each consumer; this package owns only the cosign exec,
+the trust-anchor vocabulary and the verdict enums.
 
 ## License
 

package/dist/index.d.ts

@@ -1,3 +1,4 @@
 export * from './lib/verdicts';
+export * from './lib/trust-anchors';
 export * from './lib/cosign-exec';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,mBAAmB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC"}

package/dist/index.js

@@ -15,5 +15,6 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./lib/verdicts"), exports);
+__exportStar(require("./lib/trust-anchors"), exports);
 __exportStar(require("./lib/cosign-exec"), exports);
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,iDAA+B;AAC/B,oDAAkC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,iDAA+B;AAC/B,sDAAoC;AACpC,oDAAkC"}

package/dist/lib/cosign-exec.d.ts

@@ -1,3 +1,4 @@
+import { type CosignBlobTrustAnchor, type CosignMatchedAnchor, type CosignPinnedTrustedRoot } from './trust-anchors';
 import { CosignVerifyOutcome } from './verdicts';
 export declare function ensureCosignAvailable(bin?: string): Promise<void>;
 export interface VerifyCosignSignatureInput {
@@ -5,6 +6,7 @@ export interface VerifyCosignSignatureInput {
     readonly trustedIdentities: readonly string[];
     readonly oidcIssuer?: string | undefined;
     readonly keyPath?: string | undefined;
+    readonly trustedRoot?: CosignPinnedTrustedRoot | undefined;
     readonly bin?: string | undefined;
 }
 export declare function verifyCosignSignature(input: VerifyCosignSignatureInput): Promise<void>;
@@ -14,19 +16,21 @@ export interface VerifyCosignAttestationInput {
     readonly trustedIdentities: readonly string[];
     readonly oidcIssuer?: string | undefined;
     readonly keyPath?: string | undefined;
+    readonly trustedRoot?: CosignPinnedTrustedRoot | undefined;
     readonly bin?: string | undefined;
 }
 export declare function verifyCosignAttestation(input: VerifyCosignAttestationInput): Promise<void>;
 export interface VerifyCosignBlobInput {
     readonly artifactPath: string;
     readonly bundlePath: string;
-    readonly trustedIdentityRegexps: readonly string[];
+    readonly anchors: readonly CosignBlobTrustAnchor[];
     readonly oidcIssuer?: string | undefined;
+    readonly trustedRoot?: CosignPinnedTrustedRoot | undefined;
     readonly bin?: string | undefined;
 }
 export interface VerifyCosignBlobResult {
     readonly outcome: CosignVerifyOutcome;
-    readonly matchedIdentity?: string | undefined;
+    readonly matchedAnchor?: CosignMatchedAnchor | undefined;
 }
 export declare function verifyCosignBlob(input: VerifyCosignBlobInput): Promise<VerifyCosignBlobResult>;
 //# sourceMappingURL=cosign-exec.d.ts.map

package/dist/lib/cosign-exec.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cosign-exec.d.ts","sourceRoot":"","sources":["../../src/lib/cosign-exec.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAoCjD,wBAAsB,qBAAqB,CACzC,GAAG,GAAE,MAA2B,GAC/B,OAAO,CAAC,IAAI,CAAC,CAYf;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAEzC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC;AAOD,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,0BAA0B,GAChC,OAAO,CAAC,IAAI,CAAC,CAuBf;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC;AAMD,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,4BAA4B,GAClC,OAAO,CAAC,IAAI,CAAC,CAyBf;AAED,MAAM,WAAW,qBAAqB;IAEpC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAE9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAE5B,QAAQ,CAAC,sBAAsB,EAAE,SAAS,MAAM,EAAE,CAAC;IACnD,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;IAEtC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC/C;AASD,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,qBAAqB,GAC3B,OAAO,CAAC,sBAAsB,CAAC,CAuBjC"}
+{"version":3,"file":"cosign-exec.d.ts","sourceRoot":"","sources":["../../src/lib/cosign-exec.ts"],"names":[],"mappings":"AAEA,OAAO,EAGL,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,uBAAuB,EAC7B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAoCjD,wBAAsB,qBAAqB,CACzC,GAAG,GAAE,MAA2B,GAC/B,OAAO,CAAC,IAAI,CAAC,CAYf;AAqDD,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAEzC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAOtC,QAAQ,CAAC,WAAW,CAAC,EAAE,uBAAuB,GAAG,SAAS,CAAC;IAC3D,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC;AAOD,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,0BAA0B,GAChC,OAAO,CAAC,IAAI,CAAC,CA8Bf;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAEtC,QAAQ,CAAC,WAAW,CAAC,EAAE,uBAAuB,GAAG,SAAS,CAAC;IAC3D,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC;AAMD,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,4BAA4B,GAClC,OAAO,CAAC,IAAI,CAAC,CA6Bf;AAED,MAAM,WAAW,qBAAqB;IAEpC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAE9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAO5B,QAAQ,CAAC,OAAO,EAAE,SAAS,qBAAqB,EAAE,CAAC;IAKnD,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAWzC,QAAQ,CAAC,WAAW,CAAC,EAAE,uBAAuB,GAAG,SAAS,CAAC;IAC3D,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;IAOtC,QAAQ,CAAC,aAAa,CAAC,EAAE,mBAAmB,GAAG,SAAS,CAAC;CAC1D;AA8DD,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,qBAAqB,GAC3B,OAAO,CAAC,sBAAsB,CAAC,CAoBjC"}

package/dist/lib/cosign-exec.js

@@ -5,6 +5,7 @@ exports.verifyCosignSignature = verifyCosignSignature;
 exports.verifyCosignAttestation = verifyCosignAttestation;
 exports.verifyCosignBlob = verifyCosignBlob;
 const node_child_process_1 = require("node:child_process");
+const trust_anchors_1 = require("./trust-anchors");
 const verdicts_1 = require("./verdicts");
 const DEFAULT_COSIGN_BIN = 'cosign';
 function runCosign(bin, args) {
@@ -34,8 +35,19 @@ async function ensureCosignAvailable(bin = DEFAULT_COSIGN_BIN) {
             `(${cause instanceof Error ? cause.message : String(cause)})`);
     }
 }
+function pinnedOciFlags(trustedRoot, keyed) {
+    if (!trustedRoot) {
+        return [];
+    }
+    return keyed
+        ? ['--offline']
+        : ['--offline', '--trusted-root', trustedRoot.path];
+}
 async function verifyCosignSignature(input) {
     const bin = input.bin ?? DEFAULT_COSIGN_BIN;
+    if (input.trustedRoot) {
+        (0, trust_anchors_1.assertPinnedTrustedRoot)(input.trustedRoot);
+    }
     const args = ['verify'];
     if (input.keyPath) {
         args.push('--key', input.keyPath);
@@ -51,6 +63,7 @@ async function verifyCosignSignature(input) {
             args.push('--certificate-oidc-issuer', input.oidcIssuer);
         }
     }
+    args.push(...pinnedOciFlags(input.trustedRoot, Boolean(input.keyPath)));
     args.push(input.ociRef);
     const { code, stderr } = await runCosign(bin, args);
     if (code !== 0) {
@@ -59,6 +72,9 @@ async function verifyCosignSignature(input) {
 }
 async function verifyCosignAttestation(input) {
     const bin = input.bin ?? DEFAULT_COSIGN_BIN;
+    if (input.trustedRoot) {
+        (0, trust_anchors_1.assertPinnedTrustedRoot)(input.trustedRoot);
+    }
     const args = ['verify-attestation', '--type', input.predicateType];
     if (input.keyPath) {
         args.push('--key', input.keyPath);
@@ -74,32 +90,45 @@ async function verifyCosignAttestation(input) {
             args.push('--certificate-oidc-issuer', input.oidcIssuer);
         }
     }
+    args.push(...pinnedOciFlags(input.trustedRoot, Boolean(input.keyPath)));
     args.push(input.ociRef);
     const { code, stderr } = await runCosign(bin, args);
     if (code !== 0) {
         throw new Error(`${bin} verify-attestation failed (code=${code}): ${stderr.slice(-200)}`);
     }
 }
+function buildBlobVerifyArgs(anchor, input) {
+    const args = ['verify-blob'];
+    if (anchor.kind === trust_anchors_1.CosignTrustAnchorKind.PublicKey) {
+        args.push('--key', anchor.publicKeyPath, '--bundle', input.bundlePath, '--insecure-ignore-tlog');
+        args.push(input.artifactPath);
+        return args;
+    }
+    args.push('--bundle', input.bundlePath, '--certificate-identity-regexp', anchor.name);
+    if (input.oidcIssuer) {
+        args.push('--certificate-oidc-issuer', input.oidcIssuer);
+    }
+    if (input.trustedRoot) {
+        args.push('--offline', '--trusted-root', input.trustedRoot.path);
+    }
+    args.push(input.artifactPath);
+    return args;
+}
 async function verifyCosignBlob(input) {
     const bin = input.bin ?? DEFAULT_COSIGN_BIN;
-    if (input.trustedIdentityRegexps.length === 0) {
+    if (input.anchors.length === 0) {
         return { outcome: verdicts_1.CosignVerifyOutcome.Failed };
     }
-    for (const identity of input.trustedIdentityRegexps) {
-        const args = [
-            'verify-blob',
-            '--bundle',
-            input.bundlePath,
-            '--certificate-identity-regexp',
-            identity,
-        ];
-        if (input.oidcIssuer) {
-            args.push('--certificate-oidc-issuer', input.oidcIssuer);
-        }
-        args.push(input.artifactPath);
-        const { code } = await runCosign(bin, args);
+    if (input.trustedRoot) {
+        (0, trust_anchors_1.assertPinnedTrustedRoot)(input.trustedRoot);
+    }
+    for (const anchor of input.anchors) {
+        const { code } = await runCosign(bin, buildBlobVerifyArgs(anchor, input));
         if (code === 0) {
-            return { outcome: verdicts_1.CosignVerifyOutcome.Verified, matchedIdentity: identity };
+            return {
+                outcome: verdicts_1.CosignVerifyOutcome.Verified,
+                matchedAnchor: { kind: anchor.kind, name: anchor.name },
+            };
         }
     }
     return { outcome: verdicts_1.CosignVerifyOutcome.Failed };

package/dist/lib/cosign-exec.js.map

@@ -1 +1 @@
-{"version":3,"file":"cosign-exec.js","sourceRoot":"","sources":["../../src/lib/cosign-exec.ts"],"names":[],"mappings":";;AAsCA,sDAcC;AAiBD,sDAyBC;AAeD,0DA2BC;AA0BD,4CAyBC;AA3LD,2DAA2C;AAE3C,yCAAiD;AAGjD,MAAM,kBAAkB,GAAG,QAAQ,CAAC;AAapC,SAAS,SAAS,CAChB,GAAW,EACX,IAAuB;IAEvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,KAAK,GAAG,IAAA,0BAAK,EAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE;YAClC,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;SAClC,CAAC,CAAC;QACH,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACzC,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC7B,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1B,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACzB,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAGM,KAAK,UAAU,qBAAqB,CACzC,MAAc,kBAAkB;IAEhC,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;QAC3D,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,KAAK,GAAG,qBAAqB,IAAI,KAAK,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,8EAA8E;YAC5E,IAAI,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAChE,CAAC;IACJ,CAAC;AACH,CAAC;AAiBM,KAAK,UAAU,qBAAqB,CACzC,KAAiC;IAEjC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,kBAAkB,CAAC;IAC5C,MAAM,IAAI,GAAa,CAAC,QAAQ,CAAC,CAAC;IAClC,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACpC,CAAC;SAAM,CAAC;QACN,IAAI,KAAK,CAAC,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CACb,4EAA4E,CAC7E,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,EAAE,IAAI,KAAK,CAAC,iBAAiB,EAAE,CAAC;YACzC,IAAI,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,CAAC,CAAC;QAC1C,CAAC;QACD,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;YACrB,IAAI,CAAC,IAAI,CAAC,2BAA2B,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACxB,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACpD,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,wBAAwB,IAAI,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChF,CAAC;AACH,CAAC;AAeM,KAAK,UAAU,uBAAuB,CAC3C,KAAmC;IAEnC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,kBAAkB,CAAC;IAC5C,MAAM,IAAI,GAAa,CAAC,oBAAoB,EAAE,QAAQ,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;IAC7E,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACpC,CAAC;SAAM,CAAC;QACN,IAAI,KAAK,CAAC,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CACb,8EAA8E,CAC/E,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,EAAE,IAAI,KAAK,CAAC,iBAAiB,EAAE,CAAC;YACzC,IAAI,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,CAAC,CAAC;QAC1C,CAAC;QACD,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;YACrB,IAAI,CAAC,IAAI,CAAC,2BAA2B,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACxB,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACpD,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,GAAG,GAAG,oCAAoC,IAAI,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CACzE,CAAC;IACJ,CAAC;AACH,CAAC;AA0BM,KAAK,UAAU,gBAAgB,CACpC,KAA4B;IAE5B,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,kBAAkB,CAAC;IAC5C,IAAI,KAAK,CAAC,sBAAsB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9C,OAAO,EAAE,OAAO,EAAE,8BAAmB,CAAC,MAAM,EAAE,CAAC;IACjD,CAAC;IACD,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,sBAAsB,EAAE,CAAC;QACpD,MAAM,IAAI,GAAa;YACrB,aAAa;YACb,UAAU;YACV,KAAK,CAAC,UAAU;YAChB,+BAA+B;YAC/B,QAAQ;SACT,CAAC;QACF,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;YACrB,IAAI,CAAC,IAAI,CAAC,2BAA2B,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QAC3D,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAC9B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC5C,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;YACf,OAAO,EAAE,OAAO,EAAE,8BAAmB,CAAC,QAAQ,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC;QAC9E,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,8BAAmB,CAAC,MAAM,EAAE,CAAC;AACjD,CAAC"}
+{"version":3,"file":"cosign-exec.js","sourceRoot":"","sources":["../../src/lib/cosign-exec.ts"],"names":[],"mappings":";;AA6CA,sDAcC;AA2ED,sDAgCC;AAiBD,0DA+BC;AAwGD,4CAsBC;AApVD,2DAA2C;AAE3C,mDAMyB;AACzB,yCAAiD;AAGjD,MAAM,kBAAkB,GAAG,QAAQ,CAAC;AAapC,SAAS,SAAS,CAChB,GAAW,EACX,IAAuB;IAEvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,KAAK,GAAG,IAAA,0BAAK,EAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE;YAClC,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;SAClC,CAAC,CAAC;QACH,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACzC,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC7B,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1B,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACzB,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAGM,KAAK,UAAU,qBAAqB,CACzC,MAAc,kBAAkB;IAEhC,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;QAC3D,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,KAAK,GAAG,qBAAqB,IAAI,KAAK,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,8EAA8E;YAC5E,IAAI,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAChE,CAAC;IACJ,CAAC;AACH,CAAC;AAyCD,SAAS,cAAc,CACrB,WAAgD,EAChD,KAAc;IAEd,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,KAAK;QACV,CAAC,CAAC,CAAC,WAAW,CAAC;QACf,CAAC,CAAC,CAAC,WAAW,EAAE,gBAAgB,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC;AACxD,CAAC;AAwBM,KAAK,UAAU,qBAAqB,CACzC,KAAiC;IAEjC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,kBAAkB,CAAC;IAI5C,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACtB,IAAA,uCAAuB,EAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC7C,CAAC;IACD,MAAM,IAAI,GAAa,CAAC,QAAQ,CAAC,CAAC;IAClC,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACpC,CAAC;SAAM,CAAC;QACN,IAAI,KAAK,CAAC,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CACb,4EAA4E,CAC7E,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,EAAE,IAAI,KAAK,CAAC,iBAAiB,EAAE,CAAC;YACzC,IAAI,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,CAAC,CAAC;QAC1C,CAAC;QACD,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;YACrB,IAAI,CAAC,IAAI,CAAC,2BAA2B,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACxE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACxB,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACpD,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,wBAAwB,IAAI,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChF,CAAC;AACH,CAAC;AAiBM,KAAK,UAAU,uBAAuB,CAC3C,KAAmC;IAEnC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,kBAAkB,CAAC;IAC5C,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACtB,IAAA,uCAAuB,EAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC7C,CAAC;IACD,MAAM,IAAI,GAAa,CAAC,oBAAoB,EAAE,QAAQ,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;IAC7E,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACpC,CAAC;SAAM,CAAC;QACN,IAAI,KAAK,CAAC,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CACb,8EAA8E,CAC/E,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,EAAE,IAAI,KAAK,CAAC,iBAAiB,EAAE,CAAC;YACzC,IAAI,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,CAAC,CAAC;QAC1C,CAAC;QACD,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;YACrB,IAAI,CAAC,IAAI,CAAC,2BAA2B,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACxE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACxB,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACpD,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,GAAG,GAAG,oCAAoC,IAAI,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CACzE,CAAC;IACJ,CAAC;AACH,CAAC;AAwDD,SAAS,mBAAmB,CAC1B,MAA6B,EAC7B,KAA4B;IAE5B,MAAM,IAAI,GAAa,CAAC,aAAa,CAAC,CAAC;IACvC,IAAI,MAAM,CAAC,IAAI,KAAK,qCAAqB,CAAC,SAAS,EAAE,CAAC;QACpD,IAAI,CAAC,IAAI,CACP,OAAO,EACP,MAAM,CAAC,aAAa,EACpB,UAAU,EACV,KAAK,CAAC,UAAU,EAChB,wBAAwB,CACzB,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,IAAI,CACP,UAAU,EACV,KAAK,CAAC,UAAU,EAChB,+BAA+B,EAC/B,MAAM,CAAC,IAAI,CACZ,CAAC;IACF,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;QACrB,IAAI,CAAC,IAAI,CAAC,2BAA2B,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QAMtB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,gBAAgB,EAAE,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC9B,OAAO,IAAI,CAAC;AACd,CAAC;AAaM,KAAK,UAAU,gBAAgB,CACpC,KAA4B;IAE5B,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,kBAAkB,CAAC;IAC5C,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,EAAE,OAAO,EAAE,8BAAmB,CAAC,MAAM,EAAE,CAAC;IACjD,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QAGtB,IAAA,uCAAuB,EAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC7C,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QACnC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,mBAAmB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;QAC1E,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;YACf,OAAO;gBACL,OAAO,EAAE,8BAAmB,CAAC,QAAQ;gBACrC,aAAa,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE;aACxD,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,8BAAmB,CAAC,MAAM,EAAE,CAAC;AACjD,CAAC"}

package/dist/lib/trust-anchors.d.ts

@@ -0,0 +1,31 @@
+export declare enum CosignTrustAnchorKind {
+    KeylessIdentity = "keyless-identity",
+    PublicKey = "public-key"
+}
+export interface CosignKeylessIdentityAnchor {
+    readonly kind: CosignTrustAnchorKind.KeylessIdentity;
+    readonly name: string;
+}
+export interface CosignPublicKeyAnchor {
+    readonly kind: CosignTrustAnchorKind.PublicKey;
+    readonly name: string;
+    readonly publicKeyPath: string;
+}
+export type CosignBlobTrustAnchor = CosignKeylessIdentityAnchor | CosignPublicKeyAnchor;
+export interface CosignMatchedAnchor {
+    readonly kind: CosignTrustAnchorKind;
+    readonly name: string;
+}
+export interface CosignPinnedTrustedRoot {
+    readonly path: string;
+    readonly sha256: string;
+}
+export declare class CosignTrustedRootError extends Error {
+    constructor(message: string);
+}
+export declare function assertPinnedTrustedRoot(root: CosignPinnedTrustedRoot): void;
+export declare function parsePinnedTrustedRoot(path: string | undefined, sha256: string | undefined, varNames: {
+    readonly path: string;
+    readonly sha256: string;
+}): CosignPinnedTrustedRoot | undefined;
+//# sourceMappingURL=trust-anchors.d.ts.map

package/dist/lib/trust-anchors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trust-anchors.d.ts","sourceRoot":"","sources":["../../src/lib/trust-anchors.ts"],"names":[],"mappings":"AAiBA,oBAAY,qBAAqB;IAC/B,eAAe,qBAAqB;IACpC,SAAS,eAAe;CACzB;AAQD,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC,eAAe,CAAC;IACrD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAQD,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC,SAAS,CAAC;IAC/C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAGD,MAAM,MAAM,qBAAqB,GAC7B,2BAA2B,GAC3B,qBAAqB,CAAC;AAQ1B,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAcD,MAAM,WAAW,uBAAuB;IAEtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAUD,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,OAAO,EAAE,MAAM;CAI5B;AAuBD,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,uBAAuB,GAAG,IAAI,CA0C3E;AA8BD,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,QAAQ,EAAE;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC3D,uBAAuB,GAAG,SAAS,CAerC"}

package/dist/lib/trust-anchors.js

@@ -0,0 +1,70 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CosignTrustedRootError = exports.CosignTrustAnchorKind = void 0;
+exports.assertPinnedTrustedRoot = assertPinnedTrustedRoot;
+exports.parsePinnedTrustedRoot = parsePinnedTrustedRoot;
+const node_crypto_1 = require("node:crypto");
+const node_fs_1 = require("node:fs");
+var CosignTrustAnchorKind;
+(function (CosignTrustAnchorKind) {
+    CosignTrustAnchorKind["KeylessIdentity"] = "keyless-identity";
+    CosignTrustAnchorKind["PublicKey"] = "public-key";
+})(CosignTrustAnchorKind || (exports.CosignTrustAnchorKind = CosignTrustAnchorKind = {}));
+class CosignTrustedRootError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'CosignTrustedRootError';
+    }
+}
+exports.CosignTrustedRootError = CosignTrustedRootError;
+const SHA256_HEX = /^[a-f0-9]{64}$/u;
+const SIGSTORE_TRUSTED_ROOT_MEDIA_TYPE = 'application/vnd.dev.sigstore.trustedroot+json;version=0.1';
+const MAX_TRUSTED_ROOT_BYTES = 8 * 1024 * 1024;
+function assertPinnedTrustedRoot(root) {
+    if (!SHA256_HEX.test(root.sha256)) {
+        throw new CosignTrustedRootError(`pinned Sigstore trusted-root digest '${root.sha256}' is not a lowercase-hex sha256`);
+    }
+    let bytes;
+    try {
+        bytes = (0, node_fs_1.readFileSync)(root.path);
+    }
+    catch (cause) {
+        throw new CosignTrustedRootError(`pinned Sigstore trusted root '${root.path}' could not be read: ` +
+            `${cause instanceof Error ? cause.message : String(cause)}`);
+    }
+    if (bytes.byteLength > MAX_TRUSTED_ROOT_BYTES) {
+        throw new CosignTrustedRootError(`pinned Sigstore trusted root '${root.path}' is ${bytes.byteLength} bytes, over the ${MAX_TRUSTED_ROOT_BYTES}-byte ceiling`);
+    }
+    const actual = (0, node_crypto_1.createHash)('sha256').update(bytes).digest('hex');
+    if (actual !== root.sha256) {
+        throw new CosignTrustedRootError(`pinned Sigstore trusted-root digest mismatch for '${root.path}': expected ${root.sha256}, got ${actual}`);
+    }
+    let document;
+    try {
+        document = JSON.parse(bytes.toString('utf8'));
+    }
+    catch (cause) {
+        throw new CosignTrustedRootError(`pinned Sigstore trusted root '${root.path}' is not valid JSON: ` +
+            `${cause instanceof Error ? cause.message : String(cause)}`);
+    }
+    const mediaType = document?.mediaType;
+    if (mediaType !== SIGSTORE_TRUSTED_ROOT_MEDIA_TYPE) {
+        throw new CosignTrustedRootError(`pinned Sigstore trusted root '${root.path}' declares mediaType ` +
+            `'${String(mediaType)}' — expected '${SIGSTORE_TRUSTED_ROOT_MEDIA_TYPE}'`);
+    }
+}
+function parsePinnedTrustedRoot(path, sha256, varNames) {
+    const trimmedPath = (path ?? '').trim();
+    const trimmedSha = (sha256 ?? '').trim();
+    if (trimmedPath.length === 0 && trimmedSha.length === 0) {
+        return undefined;
+    }
+    if (trimmedPath.length === 0 || trimmedSha.length === 0) {
+        throw new CosignTrustedRootError(`${varNames.path} and ${varNames.sha256} must be set together. A path ` +
+            'without a pinned digest is not a trust anchor (it is whatever last ' +
+            'wrote that file), and a digest without a path gates nothing. Set ' +
+            'both, or neither.');
+    }
+    return { path: trimmedPath, sha256: trimmedSha };
+}
+//# sourceMappingURL=trust-anchors.js.map

package/dist/lib/trust-anchors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trust-anchors.js","sourceRoot":"","sources":["../../src/lib/trust-anchors.ts"],"names":[],"mappings":";;;AAoHA,0DA0CC;AA8BD,wDAmBC;AA/MD,6CAAyC;AACzC,qCAAuC;AAgBvC,IAAY,qBAGX;AAHD,WAAY,qBAAqB;IAC/B,6DAAoC,CAAA;IACpC,iDAAwB,CAAA;AAC1B,CAAC,EAHW,qBAAqB,qCAArB,qBAAqB,QAGhC;AAoED,MAAa,sBAAuB,SAAQ,KAAK;IAC/C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AALD,wDAKC;AAGD,MAAM,UAAU,GAAG,iBAAiB,CAAC;AAOrC,MAAM,gCAAgC,GACpC,2DAA2D,CAAC;AAG9D,MAAM,sBAAsB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAS/C,SAAgB,uBAAuB,CAAC,IAA6B;IACnE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,sBAAsB,CAC9B,wCAAwC,IAAI,CAAC,MAAM,iCAAiC,CACrF,CAAC;IACJ,CAAC;IACD,IAAI,KAAa,CAAC;IAClB,IAAI,CAAC;QACH,KAAK,GAAG,IAAA,sBAAY,EAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,sBAAsB,CAC9B,iCAAiC,IAAI,CAAC,IAAI,uBAAuB;YAC/D,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC9D,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,GAAG,sBAAsB,EAAE,CAAC;QAC9C,MAAM,IAAI,sBAAsB,CAC9B,iCAAiC,IAAI,CAAC,IAAI,QAAQ,KAAK,CAAC,UAAU,oBAAoB,sBAAsB,eAAe,CAC5H,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAChE,IAAI,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;QAC3B,MAAM,IAAI,sBAAsB,CAC9B,qDAAqD,IAAI,CAAC,IAAI,eAAe,IAAI,CAAC,MAAM,SAAS,MAAM,EAAE,CAC1G,CAAC;IACJ,CAAC;IACD,IAAI,QAAiB,CAAC;IACtB,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAChD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,sBAAsB,CAC9B,iCAAiC,IAAI,CAAC,IAAI,uBAAuB;YAC/D,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC9D,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAI,QAA2C,EAAE,SAAS,CAAC;IAC1E,IAAI,SAAS,KAAK,gCAAgC,EAAE,CAAC;QACnD,MAAM,IAAI,sBAAsB,CAC9B,iCAAiC,IAAI,CAAC,IAAI,uBAAuB;YAC/D,IAAI,MAAM,CAAC,SAAS,CAAC,iBAAiB,gCAAgC,GAAG,CAC5E,CAAC;IACJ,CAAC;AACH,CAAC;AA8BD,SAAgB,sBAAsB,CACpC,IAAwB,EACxB,MAA0B,EAC1B,QAA4D;IAE5D,MAAM,WAAW,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACxC,MAAM,UAAU,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACzC,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,sBAAsB,CAC9B,GAAG,QAAQ,CAAC,IAAI,QAAQ,QAAQ,CAAC,MAAM,gCAAgC;YACrE,qEAAqE;YACrE,mEAAmE;YACnE,mBAAmB,CACtB,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;AACnD,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xemahq/biome-supply-chain",
-  "version": "0.1.3",
+  "version": "0.3.0",
   "description": "Shared cosign supply-chain verification for Xema biomes: the single cosign CLI exec + the signature/provenance verdict enums used by biome-fetcher-api (OCI bundle verification) and xema-store-api. Node-builtins only.",
   "license": "LicenseRef-Xema-BSL-1.1",
   "author": "Neuralchowder Inc. <developer@xema.dev> (https://xema.dev)",