@xemahq/biome-supply-chain 0.5.0 → 0.6.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +15 -49
- package/dist/index.d.ts +1 -0
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +1 -0
- package/dist/index.js.map +1 -1
- package/dist/lib/cosign-exec.d.ts +7 -5
- package/dist/lib/cosign-exec.d.ts.map +1 -1
- package/dist/lib/cosign-exec.js +61 -39
- package/dist/lib/cosign-exec.js.map +1 -1
- package/dist/lib/keyless-entry.d.ts +9 -0
- package/dist/lib/keyless-entry.d.ts.map +1 -0
- package/dist/lib/keyless-entry.js +20 -0
- package/dist/lib/keyless-entry.js.map +1 -0
- package/package.json +5 -2
package/README.md
CHANGED
|
@@ -1,79 +1,45 @@
|
|
|
1
1
|
# @xemahq/biome-supply-chain
|
|
2
2
|
|
|
3
|
-
|
|
3
|
+
Cosign signature and attestation verification for biome artifacts. It wraps the `cosign` CLI and exports the verdict and trust-anchor vocabulary. Node built-ins only, no framework.
|
|
4
4
|
|
|
5
|
-
|
|
6
|
-
things that were previously copy-pasted between `biome-fetcher-api` (OCI bundle
|
|
7
|
-
verification) and `xema-store-api`:
|
|
5
|
+
## When to use it
|
|
8
6
|
|
|
9
|
-
|
|
10
|
-
`verifyCosignSignature`, `verifyCosignAttestation`, `verifyCosignBlob`), and
|
|
11
|
-
- the signature / provenance verdict vocabulary (`SignatureVerdict`,
|
|
12
|
-
`ProvenanceVerdict`, `CosignErrorCode`, `CosignVerifyOutcome`).
|
|
7
|
+
Use it to verify a biome OCI reference or a detached blob against trusted identities or public keys. Fetching the artifact stays with the caller. Needs the `cosign` binary on the path.
|
|
13
8
|
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
9
|
+
## Installation
|
|
10
|
+
|
|
11
|
+
```bash
|
|
12
|
+
pnpm add @xemahq/biome-supply-chain
|
|
13
|
+
```
|
|
17
14
|
|
|
18
15
|
## Usage
|
|
19
16
|
|
|
20
17
|
```ts
|
|
21
18
|
import {
|
|
22
19
|
ensureCosignAvailable,
|
|
23
|
-
verifyCosignSignature,
|
|
24
20
|
verifyCosignBlob,
|
|
25
21
|
CosignTrustAnchorKind,
|
|
26
|
-
SignatureVerdict,
|
|
27
22
|
CosignVerifyOutcome,
|
|
28
23
|
} from '@xemahq/biome-supply-chain';
|
|
29
24
|
|
|
30
25
|
await ensureCosignAvailable();
|
|
31
26
|
|
|
32
|
-
// OCI ref (keyless identity allowlist)
|
|
33
|
-
await verifyCosignSignature({
|
|
34
|
-
ociRef: 'oci://registry/biome:1.2.0',
|
|
35
|
-
trustedIdentities: ['https://github.com/xema-dev/...'],
|
|
36
|
-
oidcIssuer: 'https://token.actions.githubusercontent.com',
|
|
37
|
-
});
|
|
38
|
-
|
|
39
|
-
// Detached blob (caller owns artifact/bundle/public-key files on disk).
|
|
40
|
-
// A trust anchor is EITHER a keyless certificate-identity pattern OR a NAMED
|
|
41
|
-
// public key; both kinds share one list and one result shape, and the anchors
|
|
42
|
-
// are tried in order until one verifies.
|
|
43
27
|
const { outcome, matchedAnchor } = await verifyCosignBlob({
|
|
44
|
-
artifactPath: '
|
|
45
|
-
bundlePath: '
|
|
28
|
+
artifactPath: './remoteEntry.js',
|
|
29
|
+
bundlePath: './remoteEntry.js.bundle',
|
|
46
30
|
anchors: [
|
|
47
|
-
{
|
|
48
|
-
kind: CosignTrustAnchorKind.KeylessIdentity,
|
|
49
|
-
name: '^https://github.com/xema-dev/.*$', // the name IS the regexp
|
|
50
|
-
},
|
|
51
|
-
{
|
|
52
|
-
kind: CosignTrustAnchorKind.PublicKey,
|
|
53
|
-
name: 'release-2026',
|
|
54
|
-
publicKeyPath: '/etc/cosign/release.pub',
|
|
55
|
-
},
|
|
31
|
+
{ kind: CosignTrustAnchorKind.PublicKey, name: 'release-key', publicKeyPath: './release.pub' },
|
|
56
32
|
],
|
|
57
|
-
// Optional: pin the Sigstore trusted root so KEYLESS anchors verify with
|
|
58
|
-
// `--offline --trusted-root` (air-gap capable). A missing, unreadable or
|
|
59
|
-
// digest-mismatched root THROWS `CosignTrustedRootError` before cosign is
|
|
60
|
-
// spawned — it never falls back to cosign's online default.
|
|
61
|
-
trustedRoot: { path: '/etc/sigstore/trusted-root.json', sha256: '<64 hex>' },
|
|
62
33
|
});
|
|
63
34
|
if (outcome === CosignVerifyOutcome.Verified) {
|
|
64
|
-
// matchedAnchor
|
|
35
|
+
// matchedAnchor names the anchor that vouched for the bytes
|
|
65
36
|
}
|
|
66
37
|
```
|
|
67
38
|
|
|
68
|
-
|
|
69
|
-
failed verification is a neutral outcome rather than a throw.
|
|
39
|
+
OCI verification (`verifyCosignSignature`, `verifyCosignAttestation`) takes keyless `trustedEntries` (`{ identity, issuer }`, issuer required): it runs one cosign verify per entry (cosign keeps only the last of a repeated `--certificate-identity`), resolves with the `verifiedEntry`, and the attestation check is pinned to that same entry.
|
|
70
40
|
|
|
71
|
-
|
|
72
|
-
temp file) stays with each consumer; this package owns only the cosign exec,
|
|
73
|
-
the trust-anchor vocabulary and the verdict enums.
|
|
41
|
+
Other exports: `verifyCosignSignature`, `verifyCosignAttestation`, `SignatureVerdict`, `ProvenanceVerdict`, `CosignErrorCode`. A failed verification returns an outcome; an empty `anchors` list returns `Failed`. A pinned `trustedRoot` that is missing or has the wrong digest throws `CosignTrustedRootError`.
|
|
74
42
|
|
|
75
43
|
## License
|
|
76
44
|
|
|
77
|
-
|
|
78
|
-
four years after each release. © Xema — [xema.dev](https://xema.dev). See
|
|
79
|
-
the [repository LICENSE](../../../LICENSE).
|
|
45
|
+
LicenseRef-Xema-BSL-1.1 © Xema — [xema.dev](https://xema.dev)
|
package/dist/index.d.ts
CHANGED
package/dist/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC"}
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,qBAAqB,CAAC"}
|
package/dist/index.js
CHANGED
|
@@ -18,4 +18,5 @@ __exportStar(require("./lib/verdicts"), exports);
|
|
|
18
18
|
__exportStar(require("./lib/trust-anchors"), exports);
|
|
19
19
|
__exportStar(require("./lib/registry-auth"), exports);
|
|
20
20
|
__exportStar(require("./lib/cosign-exec"), exports);
|
|
21
|
+
__exportStar(require("./lib/keyless-entry"), exports);
|
|
21
22
|
//# sourceMappingURL=index.js.map
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,iDAA+B;AAC/B,sDAAoC;AACpC,sDAAoC;AACpC,oDAAkC"}
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,iDAA+B;AAC/B,sDAAoC;AACpC,sDAAoC;AACpC,oDAAkC;AAClC,sDAAoC"}
|
|
@@ -1,5 +1,6 @@
|
|
|
1
1
|
import { type RegistryCredential } from './registry-auth';
|
|
2
2
|
import { type CosignBlobTrustAnchor, type CosignMatchedAnchor, type CosignPinnedTrustedRoot } from './trust-anchors';
|
|
3
|
+
import { type CosignKeylessEntry } from './keyless-entry';
|
|
3
4
|
import { CosignFailureKind, CosignVerifyOutcome } from './verdicts';
|
|
4
5
|
interface CosignRunResult {
|
|
5
6
|
readonly code: number;
|
|
@@ -22,19 +23,20 @@ export declare class CosignCommandError extends Error {
|
|
|
22
23
|
export declare function ensureCosignAvailable(bin?: string): Promise<void>;
|
|
23
24
|
export interface VerifyCosignSignatureInput {
|
|
24
25
|
readonly ociRef: string;
|
|
25
|
-
readonly
|
|
26
|
-
readonly oidcIssuer?: string | undefined;
|
|
26
|
+
readonly trustedEntries: readonly CosignKeylessEntry[];
|
|
27
27
|
readonly keyPath?: string | undefined;
|
|
28
28
|
readonly trustedRoot?: CosignPinnedTrustedRoot | undefined;
|
|
29
29
|
readonly registryCredential?: RegistryCredential | undefined;
|
|
30
30
|
readonly bin?: string | undefined;
|
|
31
31
|
}
|
|
32
|
-
export
|
|
32
|
+
export interface VerifyCosignSignatureResult {
|
|
33
|
+
readonly verifiedEntry?: CosignKeylessEntry | undefined;
|
|
34
|
+
}
|
|
35
|
+
export declare function verifyCosignSignature(input: VerifyCosignSignatureInput): Promise<VerifyCosignSignatureResult>;
|
|
33
36
|
export interface VerifyCosignAttestationInput {
|
|
34
37
|
readonly ociRef: string;
|
|
35
38
|
readonly predicateType: string;
|
|
36
|
-
readonly
|
|
37
|
-
readonly oidcIssuer?: string | undefined;
|
|
39
|
+
readonly entry?: CosignKeylessEntry | undefined;
|
|
38
40
|
readonly keyPath?: string | undefined;
|
|
39
41
|
readonly trustedRoot?: CosignPinnedTrustedRoot | undefined;
|
|
40
42
|
readonly registryCredential?: RegistryCredential | undefined;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"cosign-exec.d.ts","sourceRoot":"","sources":["../../src/lib/cosign-exec.ts"],"names":[],"mappings":"AAEA,OAAO,EAAoB,KAAK,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAC5E,OAAO,EAGL,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,uBAAuB,EAC7B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAKpE,UAAU,eAAe;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAgED,wBAAgB,UAAU,CACxB,MAAM,EAAE,MAAM,EACd,MAAM,GAAE;IAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAO,GACtE,MAAM,CAYR;AAiBD,eAAO,MAAM,8BAA8B,EAAE,SAAS,MAAM,EAM3D,CAAC;AAGF,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,iBAAiB,CAIvE;AAQD,qBAAa,kBAAmB,SAAQ,KAAK;aAGzB,OAAO,EAAE,MAAM;aACf,QAAQ,EAAE,MAAM;aAChB,IAAI,EAAE,iBAAiB;aACvB,UAAU,EAAE,MAAM;gBAHlB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,iBAAiB,EACvB,UAAU,EAAE,MAAM;IAMpC,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,eAAe,GAAG,kBAAkB;CAQ1E;AAGD,wBAAsB,qBAAqB,CACzC,GAAG,GAAE,MAA2B,GAC/B,OAAO,CAAC,IAAI,CAAC,CAYf;
|
|
1
|
+
{"version":3,"file":"cosign-exec.d.ts","sourceRoot":"","sources":["../../src/lib/cosign-exec.ts"],"names":[],"mappings":"AAEA,OAAO,EAAoB,KAAK,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAC5E,OAAO,EAGL,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,uBAAuB,EAC7B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAKpE,UAAU,eAAe;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAgED,wBAAgB,UAAU,CACxB,MAAM,EAAE,MAAM,EACd,MAAM,GAAE;IAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAO,GACtE,MAAM,CAYR;AAiBD,eAAO,MAAM,8BAA8B,EAAE,SAAS,MAAM,EAM3D,CAAC;AAGF,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,iBAAiB,CAIvE;AAQD,qBAAa,kBAAmB,SAAQ,KAAK;aAGzB,OAAO,EAAE,MAAM;aACf,QAAQ,EAAE,MAAM;aAChB,IAAI,EAAE,iBAAiB;aACvB,UAAU,EAAE,MAAM;gBAHlB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,iBAAiB,EACvB,UAAU,EAAE,MAAM;IAMpC,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,eAAe,GAAG,kBAAkB;CAQ1E;AAGD,wBAAsB,qBAAqB,CACzC,GAAG,GAAE,MAA2B,GAC/B,OAAO,CAAC,IAAI,CAAC,CAYf;AAuID,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAKxB,QAAQ,CAAC,cAAc,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAEvD,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAOtC,QAAQ,CAAC,WAAW,CAAC,EAAE,uBAAuB,GAAG,SAAS,CAAC;IAO3D,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,GAAG,SAAS,CAAC;IAC7D,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC;AAED,MAAM,WAAW,2BAA2B;IAM1C,QAAQ,CAAC,aAAa,CAAC,EAAE,kBAAkB,GAAG,SAAS,CAAC;CACzD;AASD,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,0BAA0B,GAChC,OAAO,CAAC,2BAA2B,CAAC,CA+BtC;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAK/B,QAAQ,CAAC,KAAK,CAAC,EAAE,kBAAkB,GAAG,SAAS,CAAC;IAChD,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAEtC,QAAQ,CAAC,WAAW,CAAC,EAAE,uBAAuB,GAAG,SAAS,CAAC;IAE3D,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,GAAG,SAAS,CAAC;IAC7D,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC;AAOD,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,4BAA4B,GAClC,OAAO,CAAC,IAAI,CAAC,CAsBf;AAED,MAAM,WAAW,qBAAqB;IAEpC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAE9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAO5B,QAAQ,CAAC,OAAO,EAAE,SAAS,qBAAqB,EAAE,CAAC;IAOnD,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAWzC,QAAQ,CAAC,WAAW,CAAC,EAAE,uBAAuB,GAAG,SAAS,CAAC;IAC3D,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;IAOtC,QAAQ,CAAC,aAAa,CAAC,EAAE,mBAAmB,GAAG,SAAS,CAAC;CAC1D;AAyDD,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,qBAAqB,GAC3B,OAAO,CAAC,sBAAsB,CAAC,CA8BjC"}
|
package/dist/lib/cosign-exec.js
CHANGED
|
@@ -10,6 +10,7 @@ exports.verifyCosignBlob = verifyCosignBlob;
|
|
|
10
10
|
const node_child_process_1 = require("node:child_process");
|
|
11
11
|
const registry_auth_1 = require("./registry-auth");
|
|
12
12
|
const trust_anchors_1 = require("./trust-anchors");
|
|
13
|
+
const keyless_entry_1 = require("./keyless-entry");
|
|
13
14
|
const verdicts_1 = require("./verdicts");
|
|
14
15
|
const DEFAULT_COSIGN_BIN = 'cosign';
|
|
15
16
|
function runCosign(bin, args, env = {}) {
|
|
@@ -96,55 +97,76 @@ function pinnedOciFlags(trustedRoot, keyed) {
|
|
|
96
97
|
? ['--offline']
|
|
97
98
|
: ['--offline', '--trusted-root', trustedRoot.path];
|
|
98
99
|
}
|
|
100
|
+
function buildKeylessArgv(leading, entry, trustedRoot, subject) {
|
|
101
|
+
return [
|
|
102
|
+
...leading,
|
|
103
|
+
'--certificate-identity',
|
|
104
|
+
entry.identity,
|
|
105
|
+
'--certificate-oidc-issuer',
|
|
106
|
+
entry.issuer,
|
|
107
|
+
...pinnedOciFlags(trustedRoot, false),
|
|
108
|
+
subject,
|
|
109
|
+
];
|
|
110
|
+
}
|
|
111
|
+
function buildKeyedOciArgv(leading, keyPath, trustedRoot, ociRef) {
|
|
112
|
+
return [
|
|
113
|
+
...leading,
|
|
114
|
+
'--key',
|
|
115
|
+
keyPath,
|
|
116
|
+
...pinnedOciFlags(trustedRoot, true),
|
|
117
|
+
ociRef,
|
|
118
|
+
];
|
|
119
|
+
}
|
|
120
|
+
async function verifyAgainstEntries(bin, command, leading, entries, trustedRoot, ociRef, credential) {
|
|
121
|
+
if (entries.length === 0) {
|
|
122
|
+
throw new Error(`${command}: keyless mode requires at least one trusted entry`);
|
|
123
|
+
}
|
|
124
|
+
entries.forEach(keyless_entry_1.assertCosignKeylessEntry);
|
|
125
|
+
const failures = [];
|
|
126
|
+
for (const entry of entries) {
|
|
127
|
+
const args = buildKeylessArgv(leading, entry, trustedRoot, ociRef);
|
|
128
|
+
const run = await runCosignAgainstRegistry(bin, args, credential);
|
|
129
|
+
if (run.code === 0) {
|
|
130
|
+
return { identity: entry.identity, issuer: entry.issuer };
|
|
131
|
+
}
|
|
132
|
+
failures.push(CosignCommandError.fromRun(`${bin} ${leading[0]}`, run));
|
|
133
|
+
}
|
|
134
|
+
throw (failures.find((f) => f.kind === verdicts_1.CosignFailureKind.RegistryUnauthenticated) ??
|
|
135
|
+
failures[0]);
|
|
136
|
+
}
|
|
99
137
|
async function verifyCosignSignature(input) {
|
|
100
138
|
const bin = input.bin ?? DEFAULT_COSIGN_BIN;
|
|
101
139
|
if (input.trustedRoot) {
|
|
102
140
|
(0, trust_anchors_1.assertPinnedTrustedRoot)(input.trustedRoot);
|
|
103
141
|
}
|
|
104
|
-
const args = ['verify'];
|
|
105
142
|
if (input.keyPath) {
|
|
106
|
-
args
|
|
107
|
-
|
|
108
|
-
|
|
109
|
-
|
|
110
|
-
throw new Error('verifyCosignSignature: keyless mode requires at least one trusted identity');
|
|
111
|
-
}
|
|
112
|
-
for (const id of input.trustedIdentities) {
|
|
113
|
-
args.push('--certificate-identity', id);
|
|
143
|
+
const args = buildKeyedOciArgv(['verify'], input.keyPath, input.trustedRoot, input.ociRef);
|
|
144
|
+
const run = await runCosignAgainstRegistry(bin, args, input.registryCredential);
|
|
145
|
+
if (run.code !== 0) {
|
|
146
|
+
throw CosignCommandError.fromRun(`${bin} verify`, run);
|
|
114
147
|
}
|
|
115
|
-
|
|
116
|
-
args.push('--certificate-oidc-issuer', input.oidcIssuer);
|
|
117
|
-
}
|
|
118
|
-
}
|
|
119
|
-
args.push(...pinnedOciFlags(input.trustedRoot, Boolean(input.keyPath)));
|
|
120
|
-
args.push(input.ociRef);
|
|
121
|
-
const run = await runCosignAgainstRegistry(bin, args, input.registryCredential);
|
|
122
|
-
if (run.code !== 0) {
|
|
123
|
-
throw CosignCommandError.fromRun(`${bin} verify`, run);
|
|
148
|
+
return {};
|
|
124
149
|
}
|
|
150
|
+
const verifiedEntry = await verifyAgainstEntries(bin, 'verifyCosignSignature', ['verify'], input.trustedEntries, input.trustedRoot, input.ociRef, input.registryCredential);
|
|
151
|
+
return { verifiedEntry };
|
|
125
152
|
}
|
|
126
153
|
async function verifyCosignAttestation(input) {
|
|
127
154
|
const bin = input.bin ?? DEFAULT_COSIGN_BIN;
|
|
128
155
|
if (input.trustedRoot) {
|
|
129
156
|
(0, trust_anchors_1.assertPinnedTrustedRoot)(input.trustedRoot);
|
|
130
157
|
}
|
|
131
|
-
const
|
|
158
|
+
const leading = ['verify-attestation', '--type', input.predicateType];
|
|
159
|
+
let args;
|
|
132
160
|
if (input.keyPath) {
|
|
133
|
-
args
|
|
161
|
+
args = buildKeyedOciArgv(leading, input.keyPath, input.trustedRoot, input.ociRef);
|
|
134
162
|
}
|
|
135
163
|
else {
|
|
136
|
-
if (input.
|
|
137
|
-
throw new Error('verifyCosignAttestation: keyless mode requires
|
|
138
|
-
}
|
|
139
|
-
for (const id of input.trustedIdentities) {
|
|
140
|
-
args.push('--certificate-identity', id);
|
|
141
|
-
}
|
|
142
|
-
if (input.oidcIssuer) {
|
|
143
|
-
args.push('--certificate-oidc-issuer', input.oidcIssuer);
|
|
164
|
+
if (!input.entry) {
|
|
165
|
+
throw new Error('verifyCosignAttestation: keyless mode requires the entry that verified the signature');
|
|
144
166
|
}
|
|
167
|
+
(0, keyless_entry_1.assertCosignKeylessEntry)(input.entry);
|
|
168
|
+
args = buildKeylessArgv(leading, input.entry, input.trustedRoot, input.ociRef);
|
|
145
169
|
}
|
|
146
|
-
args.push(...pinnedOciFlags(input.trustedRoot, Boolean(input.keyPath)));
|
|
147
|
-
args.push(input.ociRef);
|
|
148
170
|
const run = await runCosignAgainstRegistry(bin, args, input.registryCredential);
|
|
149
171
|
if (run.code !== 0) {
|
|
150
172
|
throw CosignCommandError.fromRun(`${bin} verify-attestation`, run);
|
|
@@ -157,15 +179,7 @@ function buildBlobVerifyArgs(anchor, input) {
|
|
|
157
179
|
args.push(input.artifactPath);
|
|
158
180
|
return args;
|
|
159
181
|
}
|
|
160
|
-
|
|
161
|
-
if (input.oidcIssuer) {
|
|
162
|
-
args.push('--certificate-oidc-issuer', input.oidcIssuer);
|
|
163
|
-
}
|
|
164
|
-
if (input.trustedRoot) {
|
|
165
|
-
args.push('--offline', '--trusted-root', input.trustedRoot.path);
|
|
166
|
-
}
|
|
167
|
-
args.push(input.artifactPath);
|
|
168
|
-
return args;
|
|
182
|
+
return buildKeylessArgv(['verify-blob', '--bundle', input.bundlePath], { identity: anchor.name, issuer: input.oidcIssuer ?? '' }, input.trustedRoot, input.artifactPath);
|
|
169
183
|
}
|
|
170
184
|
async function verifyCosignBlob(input) {
|
|
171
185
|
const bin = input.bin ?? DEFAULT_COSIGN_BIN;
|
|
@@ -175,6 +189,14 @@ async function verifyCosignBlob(input) {
|
|
|
175
189
|
if (input.trustedRoot) {
|
|
176
190
|
(0, trust_anchors_1.assertPinnedTrustedRoot)(input.trustedRoot);
|
|
177
191
|
}
|
|
192
|
+
for (const anchor of input.anchors) {
|
|
193
|
+
if (anchor.kind === trust_anchors_1.CosignTrustAnchorKind.KeylessIdentity) {
|
|
194
|
+
(0, keyless_entry_1.assertCosignKeylessEntry)({
|
|
195
|
+
identity: anchor.name,
|
|
196
|
+
issuer: input.oidcIssuer ?? '',
|
|
197
|
+
});
|
|
198
|
+
}
|
|
199
|
+
}
|
|
178
200
|
for (const anchor of input.anchors) {
|
|
179
201
|
const { code } = await runCosign(bin, buildBlobVerifyArgs(anchor, input));
|
|
180
202
|
if (code === 0) {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"cosign-exec.js","sourceRoot":"","sources":["../../src/lib/cosign-exec.ts"],"names":[],"mappings":";;;
|
|
1
|
+
{"version":3,"file":"cosign-exec.js","sourceRoot":"","sources":["../../src/lib/cosign-exec.ts"],"names":[],"mappings":";;;AAsFA,gCAeC;AA0BD,sDAIC;AA+BD,sDAcC;AAiLD,sDAiCC;AAuBD,0DAwBC;AAqGD,4CAgCC;AAtjBD,2DAA2C;AAE3C,mDAA4E;AAC5E,mDAMyB;AACzB,mDAGyB;AACzB,yCAAoE;AAGpE,MAAM,kBAAkB,GAAG,QAAQ,CAAC;AAkBpC,SAAS,SAAS,CAChB,GAAW,EACX,IAAuB,EACvB,MAAwC,EAAE;IAE1C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,KAAK,GAAG,IAAA,0BAAK,EAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE;YAClC,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;YACjC,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,GAAG,EAAE;SAChC,CAAC,CAAC;QACH,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACzC,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC7B,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1B,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACzB,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AASD,SAAS,wBAAwB,CAC/B,GAAW,EACX,IAAuB,EACvB,UAA0C;IAE1C,OAAO,IAAA,gCAAgB,EAAC,UAAU,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;AAC1E,CAAC;AAGD,MAAM,qBAAqB,GAAG,CAAC,CAAC;AAChC,MAAM,qBAAqB,GAAG,IAAI,CAAC;AAanC,SAAgB,UAAU,CACxB,MAAc,EACd,SAAqE,EAAE;IAEvE,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,qBAAqB,CAAC;IAC1D,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,qBAAqB,CAAC;IAC1D,MAAM,KAAK,GAAG,MAAM;SACjB,KAAK,CAAC,QAAQ,CAAC;SACf,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChD,IAAI,IAAI,CAAC,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,OAAO,IAAI,CAAC,MAAM,GAAG,QAAQ,SAAS,CAAC;AAC1E,CAAC;AAiBY,QAAA,8BAA8B,GAAsB;IAC/D,oBAAoB;IACpB,cAAc;IACd,+BAA+B;IAC/B,0BAA0B;IAC1B,yCAAyC;CAC1C,CAAC;AAGF,SAAgB,qBAAqB,CAAC,MAAc;IAClD,OAAO,sCAA8B,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC3E,CAAC,CAAC,4BAAiB,CAAC,uBAAuB;QAC3C,CAAC,CAAC,4BAAiB,CAAC,QAAQ,CAAC;AACjC,CAAC;AAQD,MAAa,kBAAmB,SAAQ,KAAK;IAGzB;IACA;IACA;IACA;IALlB,YAEkB,OAAe,EACf,QAAgB,EAChB,IAAuB,EACvB,UAAkB;QAElC,KAAK,CAAC,GAAG,OAAO,iBAAiB,QAAQ,UAAU,IAAI,MAAM,UAAU,EAAE,CAAC,CAAC;QAL3D,YAAO,GAAP,OAAO,CAAQ;QACf,aAAQ,GAAR,QAAQ,CAAQ;QAChB,SAAI,GAAJ,IAAI,CAAmB;QACvB,eAAU,GAAV,UAAU,CAAQ;QAGlC,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;IAED,MAAM,CAAC,OAAO,CAAC,OAAe,EAAE,GAAoB;QAClD,OAAO,IAAI,kBAAkB,CAC3B,OAAO,EACP,GAAG,CAAC,IAAI,EACR,qBAAqB,CAAC,GAAG,CAAC,MAAM,CAAC,EACjC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CACvB,CAAC;IACJ,CAAC;CACF;AApBD,gDAoBC;AAGM,KAAK,UAAU,qBAAqB,CACzC,MAAc,kBAAkB;IAEhC,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;QAC3D,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,KAAK,GAAG,qBAAqB,IAAI,KAAK,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,8EAA8E;YAC5E,IAAI,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAChE,CAAC;IACJ,CAAC;AACH,CAAC;AAyCD,SAAS,cAAc,CACrB,WAAgD,EAChD,KAAc;IAEd,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,KAAK;QACV,CAAC,CAAC,CAAC,WAAW,CAAC;QACf,CAAC,CAAC,CAAC,WAAW,EAAE,gBAAgB,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC;AACxD,CAAC;AAcD,SAAS,gBAAgB,CACvB,OAA0B,EAC1B,KAAyB,EACzB,WAAgD,EAChD,OAAe;IAEf,OAAO;QACL,GAAG,OAAO;QACV,wBAAwB;QACxB,KAAK,CAAC,QAAQ;QACd,2BAA2B;QAC3B,KAAK,CAAC,MAAM;QACZ,GAAG,cAAc,CAAC,WAAW,EAAE,KAAK,CAAC;QACrC,OAAO;KACR,CAAC;AACJ,CAAC;AAGD,SAAS,iBAAiB,CACxB,OAA0B,EAC1B,OAAe,EACf,WAAgD,EAChD,MAAc;IAEd,OAAO;QACL,GAAG,OAAO;QACV,OAAO;QACP,OAAO;QACP,GAAG,cAAc,CAAC,WAAW,EAAE,IAAI,CAAC;QACpC,MAAM;KACP,CAAC;AACJ,CAAC;AASD,KAAK,UAAU,oBAAoB,CACjC,GAAW,EACX,OAAe,EACf,OAA0B,EAC1B,OAAsC,EACtC,WAAgD,EAChD,MAAc,EACd,UAA0C;IAE1C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,GAAG,OAAO,oDAAoD,CAC/D,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,OAAO,CAAC,wCAAwB,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAyB,EAAE,CAAC;IAC1C,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;QACnE,MAAM,GAAG,GAAG,MAAM,wBAAwB,CAAC,GAAG,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;QAClE,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACnB,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;QAC5D,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,GAAG,GAAG,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,CACJ,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,4BAAiB,CAAC,uBAAuB,CAAC;QAC1E,QAAQ,CAAC,CAAC,CAAC,CACZ,CAAC;AACJ,CAAC;AA4CM,KAAK,UAAU,qBAAqB,CACzC,KAAiC;IAEjC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,kBAAkB,CAAC;IAI5C,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACtB,IAAA,uCAAuB,EAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC7C,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClB,MAAM,IAAI,GAAG,iBAAiB,CAC5B,CAAC,QAAQ,CAAC,EACV,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,WAAW,EACjB,KAAK,CAAC,MAAM,CACb,CAAC;QACF,MAAM,GAAG,GAAG,MAAM,wBAAwB,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,kBAAkB,CAAC,CAAC;QAChF,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACnB,MAAM,kBAAkB,CAAC,OAAO,CAAC,GAAG,GAAG,SAAS,EAAE,GAAG,CAAC,CAAC;QACzD,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,aAAa,GAAG,MAAM,oBAAoB,CAC9C,GAAG,EACH,uBAAuB,EACvB,CAAC,QAAQ,CAAC,EACV,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,WAAW,EACjB,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,kBAAkB,CACzB,CAAC;IACF,OAAO,EAAE,aAAa,EAAE,CAAC;AAC3B,CAAC;AAuBM,KAAK,UAAU,uBAAuB,CAC3C,KAAmC;IAEnC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,kBAAkB,CAAC;IAC5C,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACtB,IAAA,uCAAuB,EAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC7C,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,oBAAoB,EAAE,QAAQ,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;IACtE,IAAI,IAAc,CAAC;IACnB,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClB,IAAI,GAAG,iBAAiB,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACpF,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CACb,sFAAsF,CACvF,CAAC;QACJ,CAAC;QACD,IAAA,wCAAwB,EAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,GAAG,gBAAgB,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACjF,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,wBAAwB,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAChF,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,kBAAkB,CAAC,OAAO,CAAC,GAAG,GAAG,qBAAqB,EAAE,GAAG,CAAC,CAAC;IACrE,CAAC;AACH,CAAC;AA4DD,SAAS,mBAAmB,CAC1B,MAA6B,EAC7B,KAA4B;IAE5B,MAAM,IAAI,GAAa,CAAC,aAAa,CAAC,CAAC;IACvC,IAAI,MAAM,CAAC,IAAI,KAAK,qCAAqB,CAAC,SAAS,EAAE,CAAC;QACpD,IAAI,CAAC,IAAI,CACP,OAAO,EACP,MAAM,CAAC,aAAa,EACpB,UAAU,EACV,KAAK,CAAC,UAAU,EAChB,wBAAwB,CACzB,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;IAOD,OAAO,gBAAgB,CACrB,CAAC,aAAa,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,EAC7C,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,UAAU,IAAI,EAAE,EAAE,EACzD,KAAK,CAAC,WAAW,EACjB,KAAK,CAAC,YAAY,CACnB,CAAC;AACJ,CAAC;AAaM,KAAK,UAAU,gBAAgB,CACpC,KAA4B;IAE5B,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,kBAAkB,CAAC;IAC5C,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,EAAE,OAAO,EAAE,8BAAmB,CAAC,MAAM,EAAE,CAAC;IACjD,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QAGtB,IAAA,uCAAuB,EAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC7C,CAAC;IAGD,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QACnC,IAAI,MAAM,CAAC,IAAI,KAAK,qCAAqB,CAAC,eAAe,EAAE,CAAC;YAC1D,IAAA,wCAAwB,EAAC;gBACvB,QAAQ,EAAE,MAAM,CAAC,IAAI;gBACrB,MAAM,EAAE,KAAK,CAAC,UAAU,IAAI,EAAE;aAC/B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QACnC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,mBAAmB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;QAC1E,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;YACf,OAAO;gBACL,OAAO,EAAE,8BAAmB,CAAC,QAAQ;gBACrC,aAAa,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE;aACxD,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,8BAAmB,CAAC,MAAM,EAAE,CAAC;AACjD,CAAC"}
|
|
@@ -0,0 +1,9 @@
|
|
|
1
|
+
export interface CosignKeylessEntry {
|
|
2
|
+
readonly identity: string;
|
|
3
|
+
readonly issuer: string;
|
|
4
|
+
}
|
|
5
|
+
export declare class CosignKeylessEntryError extends Error {
|
|
6
|
+
constructor(message: string);
|
|
7
|
+
}
|
|
8
|
+
export declare function assertCosignKeylessEntry(entry: CosignKeylessEntry): void;
|
|
9
|
+
//# sourceMappingURL=keyless-entry.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"keyless-entry.d.ts","sourceRoot":"","sources":["../../src/lib/keyless-entry.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAGD,qBAAa,uBAAwB,SAAQ,KAAK;gBACpC,OAAO,EAAE,MAAM;CAI5B;AAGD,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,kBAAkB,GAAG,IAAI,CAWxE"}
|
|
@@ -0,0 +1,20 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
+
exports.CosignKeylessEntryError = void 0;
|
|
4
|
+
exports.assertCosignKeylessEntry = assertCosignKeylessEntry;
|
|
5
|
+
class CosignKeylessEntryError extends Error {
|
|
6
|
+
constructor(message) {
|
|
7
|
+
super(message);
|
|
8
|
+
this.name = 'CosignKeylessEntryError';
|
|
9
|
+
}
|
|
10
|
+
}
|
|
11
|
+
exports.CosignKeylessEntryError = CosignKeylessEntryError;
|
|
12
|
+
function assertCosignKeylessEntry(entry) {
|
|
13
|
+
if (!entry.identity || entry.identity.trim().length === 0) {
|
|
14
|
+
throw new CosignKeylessEntryError('cosign keyless entry has no certificate identity');
|
|
15
|
+
}
|
|
16
|
+
if (!entry.issuer || entry.issuer.trim().length === 0) {
|
|
17
|
+
throw new CosignKeylessEntryError(`cosign keyless entry for identity "${entry.identity}" has no OIDC issuer; the issuer is required`);
|
|
18
|
+
}
|
|
19
|
+
}
|
|
20
|
+
//# sourceMappingURL=keyless-entry.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"keyless-entry.js","sourceRoot":"","sources":["../../src/lib/keyless-entry.ts"],"names":[],"mappings":";;;AAoBA,4DAWC;AAnBD,MAAa,uBAAwB,SAAQ,KAAK;IAChD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AALD,0DAKC;AAGD,SAAgB,wBAAwB,CAAC,KAAyB;IAChE,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,uBAAuB,CAC/B,kDAAkD,CACnD,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,uBAAuB,CAC/B,sCAAsC,KAAK,CAAC,QAAQ,8CAA8C,CACnG,CAAC;IACJ,CAAC;AACH,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@xemahq/biome-supply-chain",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.6.0",
|
|
4
4
|
"description": "Shared cosign supply-chain verification for Xema biomes: the single cosign CLI exec + the signature/provenance verdict enums used by biome-fetcher-api (OCI bundle verification) and xema-store-api. Node-builtins only.",
|
|
5
5
|
"license": "LicenseRef-Xema-BSL-1.1",
|
|
6
6
|
"author": "Neuralchowder Inc. <developer@xema.dev> (https://xema.dev)",
|
|
@@ -54,5 +54,8 @@
|
|
|
54
54
|
"test": "tsc -p tsconfig.json && node --test \"dist-test/test/**/*.test.js\"",
|
|
55
55
|
"typecheck": "tsc -p tsconfig.json --noEmit",
|
|
56
56
|
"clean": "rm -rf dist dist-test"
|
|
57
|
+
},
|
|
58
|
+
"xemaRelease": {
|
|
59
|
+
"sourceDigest": "sha256:d0ed3b932ca45bc3eb5dc1f811caa375b321caed8f09efb606d6f7bfee888e57"
|
|
57
60
|
}
|
|
58
|
-
}
|
|
61
|
+
}
|