@xemahq/biome-supply-chain 0.2.0 → 0.4.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/lib/cosign-exec.d.ts +2 -0
- package/dist/lib/cosign-exec.d.ts.map +1 -1
- package/dist/lib/cosign-exec.js +16 -0
- package/dist/lib/cosign-exec.js.map +1 -1
- package/dist/lib/trust-anchors.d.ts +4 -0
- package/dist/lib/trust-anchors.d.ts.map +1 -1
- package/dist/lib/trust-anchors.js +15 -0
- package/dist/lib/trust-anchors.js.map +1 -1
- package/package.json +6 -1
|
@@ -6,6 +6,7 @@ export interface VerifyCosignSignatureInput {
|
|
|
6
6
|
readonly trustedIdentities: readonly string[];
|
|
7
7
|
readonly oidcIssuer?: string | undefined;
|
|
8
8
|
readonly keyPath?: string | undefined;
|
|
9
|
+
readonly trustedRoot?: CosignPinnedTrustedRoot | undefined;
|
|
9
10
|
readonly bin?: string | undefined;
|
|
10
11
|
}
|
|
11
12
|
export declare function verifyCosignSignature(input: VerifyCosignSignatureInput): Promise<void>;
|
|
@@ -15,6 +16,7 @@ export interface VerifyCosignAttestationInput {
|
|
|
15
16
|
readonly trustedIdentities: readonly string[];
|
|
16
17
|
readonly oidcIssuer?: string | undefined;
|
|
17
18
|
readonly keyPath?: string | undefined;
|
|
19
|
+
readonly trustedRoot?: CosignPinnedTrustedRoot | undefined;
|
|
18
20
|
readonly bin?: string | undefined;
|
|
19
21
|
}
|
|
20
22
|
export declare function verifyCosignAttestation(input: VerifyCosignAttestationInput): Promise<void>;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"cosign-exec.d.ts","sourceRoot":"","sources":["../../src/lib/cosign-exec.ts"],"names":[],"mappings":"AAEA,OAAO,EAGL,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,uBAAuB,EAC7B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAoCjD,wBAAsB,qBAAqB,CACzC,GAAG,GAAE,MAA2B,GAC/B,OAAO,CAAC,IAAI,CAAC,CAYf;
|
|
1
|
+
{"version":3,"file":"cosign-exec.d.ts","sourceRoot":"","sources":["../../src/lib/cosign-exec.ts"],"names":[],"mappings":"AAEA,OAAO,EAGL,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,uBAAuB,EAC7B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAoCjD,wBAAsB,qBAAqB,CACzC,GAAG,GAAE,MAA2B,GAC/B,OAAO,CAAC,IAAI,CAAC,CAYf;AAqDD,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAEzC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAOtC,QAAQ,CAAC,WAAW,CAAC,EAAE,uBAAuB,GAAG,SAAS,CAAC;IAC3D,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC;AAOD,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,0BAA0B,GAChC,OAAO,CAAC,IAAI,CAAC,CA8Bf;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAEtC,QAAQ,CAAC,WAAW,CAAC,EAAE,uBAAuB,GAAG,SAAS,CAAC;IAC3D,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC;AAMD,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,4BAA4B,GAClC,OAAO,CAAC,IAAI,CAAC,CA6Bf;AAED,MAAM,WAAW,qBAAqB;IAEpC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAE9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAO5B,QAAQ,CAAC,OAAO,EAAE,SAAS,qBAAqB,EAAE,CAAC;IAKnD,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAWzC,QAAQ,CAAC,WAAW,CAAC,EAAE,uBAAuB,GAAG,SAAS,CAAC;IAC3D,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;IAOtC,QAAQ,CAAC,aAAa,CAAC,EAAE,mBAAmB,GAAG,SAAS,CAAC;CAC1D;AA8DD,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,qBAAqB,GAC3B,OAAO,CAAC,sBAAsB,CAAC,CAoBjC"}
|
package/dist/lib/cosign-exec.js
CHANGED
|
@@ -35,8 +35,19 @@ async function ensureCosignAvailable(bin = DEFAULT_COSIGN_BIN) {
|
|
|
35
35
|
`(${cause instanceof Error ? cause.message : String(cause)})`);
|
|
36
36
|
}
|
|
37
37
|
}
|
|
38
|
+
function pinnedOciFlags(trustedRoot, keyed) {
|
|
39
|
+
if (!trustedRoot) {
|
|
40
|
+
return [];
|
|
41
|
+
}
|
|
42
|
+
return keyed
|
|
43
|
+
? ['--offline']
|
|
44
|
+
: ['--offline', '--trusted-root', trustedRoot.path];
|
|
45
|
+
}
|
|
38
46
|
async function verifyCosignSignature(input) {
|
|
39
47
|
const bin = input.bin ?? DEFAULT_COSIGN_BIN;
|
|
48
|
+
if (input.trustedRoot) {
|
|
49
|
+
(0, trust_anchors_1.assertPinnedTrustedRoot)(input.trustedRoot);
|
|
50
|
+
}
|
|
40
51
|
const args = ['verify'];
|
|
41
52
|
if (input.keyPath) {
|
|
42
53
|
args.push('--key', input.keyPath);
|
|
@@ -52,6 +63,7 @@ async function verifyCosignSignature(input) {
|
|
|
52
63
|
args.push('--certificate-oidc-issuer', input.oidcIssuer);
|
|
53
64
|
}
|
|
54
65
|
}
|
|
66
|
+
args.push(...pinnedOciFlags(input.trustedRoot, Boolean(input.keyPath)));
|
|
55
67
|
args.push(input.ociRef);
|
|
56
68
|
const { code, stderr } = await runCosign(bin, args);
|
|
57
69
|
if (code !== 0) {
|
|
@@ -60,6 +72,9 @@ async function verifyCosignSignature(input) {
|
|
|
60
72
|
}
|
|
61
73
|
async function verifyCosignAttestation(input) {
|
|
62
74
|
const bin = input.bin ?? DEFAULT_COSIGN_BIN;
|
|
75
|
+
if (input.trustedRoot) {
|
|
76
|
+
(0, trust_anchors_1.assertPinnedTrustedRoot)(input.trustedRoot);
|
|
77
|
+
}
|
|
63
78
|
const args = ['verify-attestation', '--type', input.predicateType];
|
|
64
79
|
if (input.keyPath) {
|
|
65
80
|
args.push('--key', input.keyPath);
|
|
@@ -75,6 +90,7 @@ async function verifyCosignAttestation(input) {
|
|
|
75
90
|
args.push('--certificate-oidc-issuer', input.oidcIssuer);
|
|
76
91
|
}
|
|
77
92
|
}
|
|
93
|
+
args.push(...pinnedOciFlags(input.trustedRoot, Boolean(input.keyPath)));
|
|
78
94
|
args.push(input.ociRef);
|
|
79
95
|
const { code, stderr } = await runCosign(bin, args);
|
|
80
96
|
if (code !== 0) {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"cosign-exec.js","sourceRoot":"","sources":["../../src/lib/cosign-exec.ts"],"names":[],"mappings":";;AA6CA,sDAcC;
|
|
1
|
+
{"version":3,"file":"cosign-exec.js","sourceRoot":"","sources":["../../src/lib/cosign-exec.ts"],"names":[],"mappings":";;AA6CA,sDAcC;AA2ED,sDAgCC;AAiBD,0DA+BC;AAwGD,4CAsBC;AApVD,2DAA2C;AAE3C,mDAMyB;AACzB,yCAAiD;AAGjD,MAAM,kBAAkB,GAAG,QAAQ,CAAC;AAapC,SAAS,SAAS,CAChB,GAAW,EACX,IAAuB;IAEvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,KAAK,GAAG,IAAA,0BAAK,EAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE;YAClC,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;SAClC,CAAC,CAAC;QACH,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACzC,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC7B,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1B,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACzB,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAGM,KAAK,UAAU,qBAAqB,CACzC,MAAc,kBAAkB;IAEhC,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;QAC3D,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,KAAK,GAAG,qBAAqB,IAAI,KAAK,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,8EAA8E;YAC5E,IAAI,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAChE,CAAC;IACJ,CAAC;AACH,CAAC;AAyCD,SAAS,cAAc,CACrB,WAAgD,EAChD,KAAc;IAEd,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,KAAK;QACV,CAAC,CAAC,CAAC,WAAW,CAAC;QACf,CAAC,CAAC,CAAC,WAAW,EAAE,gBAAgB,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC;AACxD,CAAC;AAwBM,KAAK,UAAU,qBAAqB,CACzC,KAAiC;IAEjC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,kBAAkB,CAAC;IAI5C,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACtB,IAAA,uCAAuB,EAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC7C,CAAC;IACD,MAAM,IAAI,GAAa,CAAC,QAAQ,CAAC,CAAC;IAClC,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACpC,CAAC;SAAM,CAAC;QACN,IAAI,KAAK,CAAC,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CACb,4EAA4E,CAC7E,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,EAAE,IAAI,KAAK,CAAC,iBAAiB,EAAE,CAAC;YACzC,IAAI,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,CAAC,CAAC;QAC1C,CAAC;QACD,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;YACrB,IAAI,CAAC,IAAI,CAAC,2BAA2B,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACxE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACxB,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACpD,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,wBAAwB,IAAI,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChF,CAAC;AACH,CAAC;AAiBM,KAAK,UAAU,uBAAuB,CAC3C,KAAmC;IAEnC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,kBAAkB,CAAC;IAC5C,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACtB,IAAA,uCAAuB,EAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC7C,CAAC;IACD,MAAM,IAAI,GAAa,CAAC,oBAAoB,EAAE,QAAQ,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;IAC7E,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACpC,CAAC;SAAM,CAAC;QACN,IAAI,KAAK,CAAC,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CACb,8EAA8E,CAC/E,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,EAAE,IAAI,KAAK,CAAC,iBAAiB,EAAE,CAAC;YACzC,IAAI,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,CAAC,CAAC;QAC1C,CAAC;QACD,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;YACrB,IAAI,CAAC,IAAI,CAAC,2BAA2B,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACxE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACxB,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACpD,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,GAAG,GAAG,oCAAoC,IAAI,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CACzE,CAAC;IACJ,CAAC;AACH,CAAC;AAwDD,SAAS,mBAAmB,CAC1B,MAA6B,EAC7B,KAA4B;IAE5B,MAAM,IAAI,GAAa,CAAC,aAAa,CAAC,CAAC;IACvC,IAAI,MAAM,CAAC,IAAI,KAAK,qCAAqB,CAAC,SAAS,EAAE,CAAC;QACpD,IAAI,CAAC,IAAI,CACP,OAAO,EACP,MAAM,CAAC,aAAa,EACpB,UAAU,EACV,KAAK,CAAC,UAAU,EAChB,wBAAwB,CACzB,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,IAAI,CACP,UAAU,EACV,KAAK,CAAC,UAAU,EAChB,+BAA+B,EAC/B,MAAM,CAAC,IAAI,CACZ,CAAC;IACF,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;QACrB,IAAI,CAAC,IAAI,CAAC,2BAA2B,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QAMtB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,gBAAgB,EAAE,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC9B,OAAO,IAAI,CAAC;AACd,CAAC;AAaM,KAAK,UAAU,gBAAgB,CACpC,KAA4B;IAE5B,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,kBAAkB,CAAC;IAC5C,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,EAAE,OAAO,EAAE,8BAAmB,CAAC,MAAM,EAAE,CAAC;IACjD,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QAGtB,IAAA,uCAAuB,EAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC7C,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QACnC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,mBAAmB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;QAC1E,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;YACf,OAAO;gBACL,OAAO,EAAE,8BAAmB,CAAC,QAAQ;gBACrC,aAAa,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE;aACxD,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,8BAAmB,CAAC,MAAM,EAAE,CAAC;AACjD,CAAC"}
|
|
@@ -24,4 +24,8 @@ export declare class CosignTrustedRootError extends Error {
|
|
|
24
24
|
constructor(message: string);
|
|
25
25
|
}
|
|
26
26
|
export declare function assertPinnedTrustedRoot(root: CosignPinnedTrustedRoot): void;
|
|
27
|
+
export declare function parsePinnedTrustedRoot(path: string | undefined, sha256: string | undefined, varNames: {
|
|
28
|
+
readonly path: string;
|
|
29
|
+
readonly sha256: string;
|
|
30
|
+
}): CosignPinnedTrustedRoot | undefined;
|
|
27
31
|
//# sourceMappingURL=trust-anchors.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"trust-anchors.d.ts","sourceRoot":"","sources":["../../src/lib/trust-anchors.ts"],"names":[],"mappings":"AAiBA,oBAAY,qBAAqB;IAC/B,eAAe,qBAAqB;IACpC,SAAS,eAAe;CACzB;AAQD,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC,eAAe,CAAC;IACrD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAQD,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC,SAAS,CAAC;IAC/C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAGD,MAAM,MAAM,qBAAqB,GAC7B,2BAA2B,GAC3B,qBAAqB,CAAC;AAQ1B,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAcD,MAAM,WAAW,uBAAuB;IAEtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAUD,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,OAAO,EAAE,MAAM;CAI5B;AAuBD,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,uBAAuB,GAAG,IAAI,CA0C3E"}
|
|
1
|
+
{"version":3,"file":"trust-anchors.d.ts","sourceRoot":"","sources":["../../src/lib/trust-anchors.ts"],"names":[],"mappings":"AAiBA,oBAAY,qBAAqB;IAC/B,eAAe,qBAAqB;IACpC,SAAS,eAAe;CACzB;AAQD,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC,eAAe,CAAC;IACrD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAQD,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC,SAAS,CAAC;IAC/C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAGD,MAAM,MAAM,qBAAqB,GAC7B,2BAA2B,GAC3B,qBAAqB,CAAC;AAQ1B,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAcD,MAAM,WAAW,uBAAuB;IAEtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAUD,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,OAAO,EAAE,MAAM;CAI5B;AAuBD,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,uBAAuB,GAAG,IAAI,CA0C3E;AA8BD,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,QAAQ,EAAE;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC3D,uBAAuB,GAAG,SAAS,CAerC"}
|
|
@@ -2,6 +2,7 @@
|
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
3
|
exports.CosignTrustedRootError = exports.CosignTrustAnchorKind = void 0;
|
|
4
4
|
exports.assertPinnedTrustedRoot = assertPinnedTrustedRoot;
|
|
5
|
+
exports.parsePinnedTrustedRoot = parsePinnedTrustedRoot;
|
|
5
6
|
const node_crypto_1 = require("node:crypto");
|
|
6
7
|
const node_fs_1 = require("node:fs");
|
|
7
8
|
var CosignTrustAnchorKind;
|
|
@@ -52,4 +53,18 @@ function assertPinnedTrustedRoot(root) {
|
|
|
52
53
|
`'${String(mediaType)}' — expected '${SIGSTORE_TRUSTED_ROOT_MEDIA_TYPE}'`);
|
|
53
54
|
}
|
|
54
55
|
}
|
|
56
|
+
function parsePinnedTrustedRoot(path, sha256, varNames) {
|
|
57
|
+
const trimmedPath = (path ?? '').trim();
|
|
58
|
+
const trimmedSha = (sha256 ?? '').trim();
|
|
59
|
+
if (trimmedPath.length === 0 && trimmedSha.length === 0) {
|
|
60
|
+
return undefined;
|
|
61
|
+
}
|
|
62
|
+
if (trimmedPath.length === 0 || trimmedSha.length === 0) {
|
|
63
|
+
throw new CosignTrustedRootError(`${varNames.path} and ${varNames.sha256} must be set together. A path ` +
|
|
64
|
+
'without a pinned digest is not a trust anchor (it is whatever last ' +
|
|
65
|
+
'wrote that file), and a digest without a path gates nothing. Set ' +
|
|
66
|
+
'both, or neither.');
|
|
67
|
+
}
|
|
68
|
+
return { path: trimmedPath, sha256: trimmedSha };
|
|
69
|
+
}
|
|
55
70
|
//# sourceMappingURL=trust-anchors.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"trust-anchors.js","sourceRoot":"","sources":["../../src/lib/trust-anchors.ts"],"names":[],"mappings":";;;AAoHA,0DA0CC;
|
|
1
|
+
{"version":3,"file":"trust-anchors.js","sourceRoot":"","sources":["../../src/lib/trust-anchors.ts"],"names":[],"mappings":";;;AAoHA,0DA0CC;AA8BD,wDAmBC;AA/MD,6CAAyC;AACzC,qCAAuC;AAgBvC,IAAY,qBAGX;AAHD,WAAY,qBAAqB;IAC/B,6DAAoC,CAAA;IACpC,iDAAwB,CAAA;AAC1B,CAAC,EAHW,qBAAqB,qCAArB,qBAAqB,QAGhC;AAoED,MAAa,sBAAuB,SAAQ,KAAK;IAC/C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AALD,wDAKC;AAGD,MAAM,UAAU,GAAG,iBAAiB,CAAC;AAOrC,MAAM,gCAAgC,GACpC,2DAA2D,CAAC;AAG9D,MAAM,sBAAsB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAS/C,SAAgB,uBAAuB,CAAC,IAA6B;IACnE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,sBAAsB,CAC9B,wCAAwC,IAAI,CAAC,MAAM,iCAAiC,CACrF,CAAC;IACJ,CAAC;IACD,IAAI,KAAa,CAAC;IAClB,IAAI,CAAC;QACH,KAAK,GAAG,IAAA,sBAAY,EAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,sBAAsB,CAC9B,iCAAiC,IAAI,CAAC,IAAI,uBAAuB;YAC/D,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC9D,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,GAAG,sBAAsB,EAAE,CAAC;QAC9C,MAAM,IAAI,sBAAsB,CAC9B,iCAAiC,IAAI,CAAC,IAAI,QAAQ,KAAK,CAAC,UAAU,oBAAoB,sBAAsB,eAAe,CAC5H,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAChE,IAAI,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;QAC3B,MAAM,IAAI,sBAAsB,CAC9B,qDAAqD,IAAI,CAAC,IAAI,eAAe,IAAI,CAAC,MAAM,SAAS,MAAM,EAAE,CAC1G,CAAC;IACJ,CAAC;IACD,IAAI,QAAiB,CAAC;IACtB,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAChD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,sBAAsB,CAC9B,iCAAiC,IAAI,CAAC,IAAI,uBAAuB;YAC/D,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC9D,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAI,QAA2C,EAAE,SAAS,CAAC;IAC1E,IAAI,SAAS,KAAK,gCAAgC,EAAE,CAAC;QACnD,MAAM,IAAI,sBAAsB,CAC9B,iCAAiC,IAAI,CAAC,IAAI,uBAAuB;YAC/D,IAAI,MAAM,CAAC,SAAS,CAAC,iBAAiB,gCAAgC,GAAG,CAC5E,CAAC;IACJ,CAAC;AACH,CAAC;AA8BD,SAAgB,sBAAsB,CACpC,IAAwB,EACxB,MAA0B,EAC1B,QAA4D;IAE5D,MAAM,WAAW,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACxC,MAAM,UAAU,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACzC,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,sBAAsB,CAC9B,GAAG,QAAQ,CAAC,IAAI,QAAQ,QAAQ,CAAC,MAAM,gCAAgC;YACrE,qEAAqE;YACrE,mEAAmE;YACnE,mBAAmB,CACtB,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;AACnD,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@xemahq/biome-supply-chain",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.4.0",
|
|
4
4
|
"description": "Shared cosign supply-chain verification for Xema biomes: the single cosign CLI exec + the signature/provenance verdict enums used by biome-fetcher-api (OCI bundle verification) and xema-store-api. Node-builtins only.",
|
|
5
5
|
"license": "LicenseRef-Xema-BSL-1.1",
|
|
6
6
|
"author": "Neuralchowder Inc. <developer@xema.dev> (https://xema.dev)",
|
|
@@ -21,6 +21,11 @@
|
|
|
21
21
|
"xema-source": "./src/index.ts",
|
|
22
22
|
"default": "./dist/index.js"
|
|
23
23
|
},
|
|
24
|
+
"./verdicts": {
|
|
25
|
+
"types": "./dist/lib/verdicts.d.ts",
|
|
26
|
+
"xema-source": "./src/lib/verdicts.ts",
|
|
27
|
+
"default": "./dist/lib/verdicts.js"
|
|
28
|
+
},
|
|
24
29
|
"./dist/lib/*": {
|
|
25
30
|
"types": "./dist/lib/*.d.ts",
|
|
26
31
|
"default": "./dist/lib/*.js"
|