@xemahq/biome-supply-chain 0.5.1 → 0.7.0

package/README.md

@@ -36,6 +36,8 @@ if (outcome === CosignVerifyOutcome.Verified) {
 }
 ```
 
+OCI verification (`verifyCosignSignature`, `verifyCosignAttestation`) checks a subject against exactly ONE `expectedSigner`, the signer that subject's own trust row declares: `{ kind: CosignTrustAnchorKind.PublicKey, publicKeyPath }` or `{ kind: CosignTrustAnchorKind.KeylessIdentity, identity, issuer }` (exact identity, issuer required). One cosign run each; no other trusted signer is tried, and a missing signer throws `CosignExpectedSignerError` before cosign is spawned. Pass the same signer to the attestation check.
+
 Other exports: `verifyCosignSignature`, `verifyCosignAttestation`, `SignatureVerdict`, `ProvenanceVerdict`, `CosignErrorCode`. A failed verification returns an outcome; an empty `anchors` list returns `Failed`. A pinned `trustedRoot` that is missing or has the wrong digest throws `CosignTrustedRootError`.
 
 ## License

package/dist/index.d.ts

@@ -2,4 +2,6 @@ export * from './lib/verdicts';
 export * from './lib/trust-anchors';
 export * from './lib/registry-auth';
 export * from './lib/cosign-exec';
+export * from './lib/keyless-entry';
+export * from './lib/expected-signer';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,qBAAqB,CAAC;AACpC,cAAc,uBAAuB,CAAC"}

package/dist/index.js

@@ -18,4 +18,6 @@ __exportStar(require("./lib/verdicts"), exports);
 __exportStar(require("./lib/trust-anchors"), exports);
 __exportStar(require("./lib/registry-auth"), exports);
 __exportStar(require("./lib/cosign-exec"), exports);
+__exportStar(require("./lib/keyless-entry"), exports);
+__exportStar(require("./lib/expected-signer"), exports);
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,iDAA+B;AAC/B,sDAAoC;AACpC,sDAAoC;AACpC,oDAAkC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,iDAA+B;AAC/B,sDAAoC;AACpC,sDAAoC;AACpC,oDAAkC;AAClC,sDAAoC;AACpC,wDAAsC"}

package/dist/lib/cosign-exec.d.ts

@@ -1,5 +1,6 @@
 import { type RegistryCredential } from './registry-auth';
 import { type CosignBlobTrustAnchor, type CosignMatchedAnchor, type CosignPinnedTrustedRoot } from './trust-anchors';
+import { type CosignExpectedSigner } from './expected-signer';
 import { CosignFailureKind, CosignVerifyOutcome } from './verdicts';
 interface CosignRunResult {
     readonly code: number;
@@ -20,25 +21,17 @@ export declare class CosignCommandError extends Error {
     static fromRun(command: string, run: CosignRunResult): CosignCommandError;
 }
 export declare function ensureCosignAvailable(bin?: string): Promise<void>;
-export interface VerifyCosignSignatureInput {
+interface CosignOciSubjectInput {
     readonly ociRef: string;
-    readonly trustedIdentities: readonly string[];
-    readonly oidcIssuer?: string | undefined;
-    readonly keyPath?: string | undefined;
+    readonly expectedSigner: CosignExpectedSigner;
     readonly trustedRoot?: CosignPinnedTrustedRoot | undefined;
     readonly registryCredential?: RegistryCredential | undefined;
     readonly bin?: string | undefined;
 }
+export type VerifyCosignSignatureInput = CosignOciSubjectInput;
 export declare function verifyCosignSignature(input: VerifyCosignSignatureInput): Promise<void>;
-export interface VerifyCosignAttestationInput {
-    readonly ociRef: string;
+export interface VerifyCosignAttestationInput extends CosignOciSubjectInput {
     readonly predicateType: string;
-    readonly trustedIdentities: readonly string[];
-    readonly oidcIssuer?: string | undefined;
-    readonly keyPath?: string | undefined;
-    readonly trustedRoot?: CosignPinnedTrustedRoot | undefined;
-    readonly registryCredential?: RegistryCredential | undefined;
-    readonly bin?: string | undefined;
 }
 export declare function verifyCosignAttestation(input: VerifyCosignAttestationInput): Promise<void>;
 export interface VerifyCosignBlobInput {

package/dist/lib/cosign-exec.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cosign-exec.d.ts","sourceRoot":"","sources":["../../src/lib/cosign-exec.ts"],"names":[],"mappings":"AAEA,OAAO,EAAoB,KAAK,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAC5E,OAAO,EAGL,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,uBAAuB,EAC7B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAKpE,UAAU,eAAe;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAgED,wBAAgB,UAAU,CACxB,MAAM,EAAE,MAAM,EACd,MAAM,GAAE;IAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAO,GACtE,MAAM,CAYR;AAiBD,eAAO,MAAM,8BAA8B,EAAE,SAAS,MAAM,EAM3D,CAAC;AAGF,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,iBAAiB,CAIvE;AAQD,qBAAa,kBAAmB,SAAQ,KAAK;aAGzB,OAAO,EAAE,MAAM;aACf,QAAQ,EAAE,MAAM;aAChB,IAAI,EAAE,iBAAiB;aACvB,UAAU,EAAE,MAAM;gBAHlB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,iBAAiB,EACvB,UAAU,EAAE,MAAM;IAMpC,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,eAAe,GAAG,kBAAkB;CAQ1E;AAGD,wBAAsB,qBAAqB,CACzC,GAAG,GAAE,MAA2B,GAC/B,OAAO,CAAC,IAAI,CAAC,CAYf;AAqDD,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAEzC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAOtC,QAAQ,CAAC,WAAW,CAAC,EAAE,uBAAuB,GAAG,SAAS,CAAC;IAO3D,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,GAAG,SAAS,CAAC;IAC7D,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC;AAOD,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,0BAA0B,GAChC,OAAO,CAAC,IAAI,CAAC,CA8Bf;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAEtC,QAAQ,CAAC,WAAW,CAAC,EAAE,uBAAuB,GAAG,SAAS,CAAC;IAE3D,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,GAAG,SAAS,CAAC;IAC7D,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC;AAMD,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,4BAA4B,GAClC,OAAO,CAAC,IAAI,CAAC,CA2Bf;AAED,MAAM,WAAW,qBAAqB;IAEpC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAE9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAO5B,QAAQ,CAAC,OAAO,EAAE,SAAS,qBAAqB,EAAE,CAAC;IAKnD,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAWzC,QAAQ,CAAC,WAAW,CAAC,EAAE,uBAAuB,GAAG,SAAS,CAAC;IAC3D,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;IAOtC,QAAQ,CAAC,aAAa,CAAC,EAAE,mBAAmB,GAAG,SAAS,CAAC;CAC1D;AA8DD,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,qBAAqB,GAC3B,OAAO,CAAC,sBAAsB,CAAC,CAoBjC"}
+{"version":3,"file":"cosign-exec.d.ts","sourceRoot":"","sources":["../../src/lib/cosign-exec.ts"],"names":[],"mappings":"AAEA,OAAO,EAAoB,KAAK,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAC5E,OAAO,EAGL,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,uBAAuB,EAC7B,MAAM,iBAAiB,CAAC;AAKzB,OAAO,EAEL,KAAK,oBAAoB,EAC1B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAKpE,UAAU,eAAe;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAgED,wBAAgB,UAAU,CACxB,MAAM,EAAE,MAAM,EACd,MAAM,GAAE;IAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAO,GACtE,MAAM,CAYR;AAiBD,eAAO,MAAM,8BAA8B,EAAE,SAAS,MAAM,EAM3D,CAAC;AAGF,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,iBAAiB,CAIvE;AAQD,qBAAa,kBAAmB,SAAQ,KAAK;aAGzB,OAAO,EAAE,MAAM;aACf,QAAQ,EAAE,MAAM;aAChB,IAAI,EAAE,iBAAiB;aACvB,UAAU,EAAE,MAAM;gBAHlB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,iBAAiB,EACvB,UAAU,EAAE,MAAM;IAMpC,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,eAAe,GAAG,kBAAkB;CAQ1E;AAGD,wBAAsB,qBAAqB,CACzC,GAAG,GAAE,MAA2B,GAC/B,OAAO,CAAC,IAAI,CAAC,CAYf;AA6GD,UAAU,qBAAqB;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAOxB,QAAQ,CAAC,cAAc,EAAE,oBAAoB,CAAC;IAO9C,QAAQ,CAAC,WAAW,CAAC,EAAE,uBAAuB,GAAG,SAAS,CAAC;IAO3D,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,GAAG,SAAS,CAAC;IAC7D,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC;AA6BD,MAAM,MAAM,0BAA0B,GAAG,qBAAqB,CAAC;AAS/D,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,0BAA0B,GAChC,OAAO,CAAC,IAAI,CAAC,CAEf;AAED,MAAM,WAAW,4BAA6B,SAAQ,qBAAqB;IACzE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAOD,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,4BAA4B,GAClC,OAAO,CAAC,IAAI,CAAC,CAKf;AAED,MAAM,WAAW,qBAAqB;IAEpC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAE9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAO5B,QAAQ,CAAC,OAAO,EAAE,SAAS,qBAAqB,EAAE,CAAC;IAOnD,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAWzC,QAAQ,CAAC,WAAW,CAAC,EAAE,uBAAuB,GAAG,SAAS,CAAC;IAC3D,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;IAOtC,QAAQ,CAAC,aAAa,CAAC,EAAE,mBAAmB,GAAG,SAAS,CAAC;CAC1D;AAyDD,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,qBAAqB,GAC3B,OAAO,CAAC,sBAAsB,CAAC,CA8BjC"}

package/dist/lib/cosign-exec.js

@@ -10,6 +10,8 @@ exports.verifyCosignBlob = verifyCosignBlob;
 const node_child_process_1 = require("node:child_process");
 const registry_auth_1 = require("./registry-auth");
 const trust_anchors_1 = require("./trust-anchors");
+const keyless_entry_1 = require("./keyless-entry");
+const expected_signer_1 = require("./expected-signer");
 const verdicts_1 = require("./verdicts");
 const DEFAULT_COSIGN_BIN = 'cosign';
 function runCosign(bin, args, env = {}) {
@@ -96,60 +98,47 @@ function pinnedOciFlags(trustedRoot, keyed) {
         ? ['--offline']
         : ['--offline', '--trusted-root', trustedRoot.path];
 }
-async function verifyCosignSignature(input) {
-    const bin = input.bin ?? DEFAULT_COSIGN_BIN;
-    if (input.trustedRoot) {
-        (0, trust_anchors_1.assertPinnedTrustedRoot)(input.trustedRoot);
-    }
-    const args = ['verify'];
-    if (input.keyPath) {
-        args.push('--key', input.keyPath);
-    }
-    else {
-        if (input.trustedIdentities.length === 0) {
-            throw new Error('verifyCosignSignature: keyless mode requires at least one trusted identity');
-        }
-        for (const id of input.trustedIdentities) {
-            args.push('--certificate-identity', id);
-        }
-        if (input.oidcIssuer) {
-            args.push('--certificate-oidc-issuer', input.oidcIssuer);
-        }
-    }
-    args.push(...pinnedOciFlags(input.trustedRoot, Boolean(input.keyPath)));
-    args.push(input.ociRef);
-    const run = await runCosignAgainstRegistry(bin, args, input.registryCredential);
-    if (run.code !== 0) {
-        throw CosignCommandError.fromRun(`${bin} verify`, run);
-    }
+function buildKeylessArgv(leading, entry, trustedRoot, subject) {
+    return [
+        ...leading,
+        '--certificate-identity',
+        entry.identity,
+        '--certificate-oidc-issuer',
+        entry.issuer,
+        ...pinnedOciFlags(trustedRoot, false),
+        subject,
+    ];
+}
+function buildSignerOciArgv(leading, signer, trustedRoot, ociRef) {
+    if (signer.kind === trust_anchors_1.CosignTrustAnchorKind.PublicKey) {
+        return [
+            ...leading,
+            '--key',
+            signer.publicKeyPath,
+            ...pinnedOciFlags(trustedRoot, true),
+            ociRef,
+        ];
+    }
+    return buildKeylessArgv(leading, { identity: signer.identity, issuer: signer.issuer }, trustedRoot, ociRef);
 }
-async function verifyCosignAttestation(input) {
+async function verifyOciAgainstSigner(leading, input) {
     const bin = input.bin ?? DEFAULT_COSIGN_BIN;
+    (0, expected_signer_1.assertCosignExpectedSigner)(input.expectedSigner, input.ociRef);
     if (input.trustedRoot) {
         (0, trust_anchors_1.assertPinnedTrustedRoot)(input.trustedRoot);
     }
-    const args = ['verify-attestation', '--type', input.predicateType];
-    if (input.keyPath) {
-        args.push('--key', input.keyPath);
-    }
-    else {
-        if (input.trustedIdentities.length === 0) {
-            throw new Error('verifyCosignAttestation: keyless mode requires at least one trusted identity');
-        }
-        for (const id of input.trustedIdentities) {
-            args.push('--certificate-identity', id);
-        }
-        if (input.oidcIssuer) {
-            args.push('--certificate-oidc-issuer', input.oidcIssuer);
-        }
-    }
-    args.push(...pinnedOciFlags(input.trustedRoot, Boolean(input.keyPath)));
-    args.push(input.ociRef);
+    const args = buildSignerOciArgv(leading, input.expectedSigner, input.trustedRoot, input.ociRef);
     const run = await runCosignAgainstRegistry(bin, args, input.registryCredential);
     if (run.code !== 0) {
-        throw CosignCommandError.fromRun(`${bin} verify-attestation`, run);
+        throw CosignCommandError.fromRun(`${bin} ${leading[0]}`, run);
     }
 }
+function verifyCosignSignature(input) {
+    return verifyOciAgainstSigner(['verify'], input);
+}
+function verifyCosignAttestation(input) {
+    return verifyOciAgainstSigner(['verify-attestation', '--type', input.predicateType], input);
+}
 function buildBlobVerifyArgs(anchor, input) {
     const args = ['verify-blob'];
     if (anchor.kind === trust_anchors_1.CosignTrustAnchorKind.PublicKey) {
@@ -157,15 +146,7 @@ function buildBlobVerifyArgs(anchor, input) {
         args.push(input.artifactPath);
         return args;
     }
-    args.push('--bundle', input.bundlePath, '--certificate-identity-regexp', anchor.name);
-    if (input.oidcIssuer) {
-        args.push('--certificate-oidc-issuer', input.oidcIssuer);
-    }
-    if (input.trustedRoot) {
-        args.push('--offline', '--trusted-root', input.trustedRoot.path);
-    }
-    args.push(input.artifactPath);
-    return args;
+    return buildKeylessArgv(['verify-blob', '--bundle', input.bundlePath], { identity: anchor.name, issuer: input.oidcIssuer ?? '' }, input.trustedRoot, input.artifactPath);
 }
 async function verifyCosignBlob(input) {
     const bin = input.bin ?? DEFAULT_COSIGN_BIN;
@@ -175,6 +156,14 @@ async function verifyCosignBlob(input) {
     if (input.trustedRoot) {
         (0, trust_anchors_1.assertPinnedTrustedRoot)(input.trustedRoot);
     }
+    for (const anchor of input.anchors) {
+        if (anchor.kind === trust_anchors_1.CosignTrustAnchorKind.KeylessIdentity) {
+            (0, keyless_entry_1.assertCosignKeylessEntry)({
+                identity: anchor.name,
+                issuer: input.oidcIssuer ?? '',
+            });
+        }
+    }
     for (const anchor of input.anchors) {
         const { code } = await runCosign(bin, buildBlobVerifyArgs(anchor, input));
         if (code === 0) {

package/dist/lib/cosign-exec.js.map

@@ -1 +1 @@
-{"version":3,"file":"cosign-exec.js","sourceRoot":"","sources":["../../src/lib/cosign-exec.ts"],"names":[],"mappings":";;;AAkFA,gCAeC;AA0BD,sDAIC;AA+BD,sDAcC;AAkFD,sDAgCC;AAmBD,0DA6BC;AAwGD,4CAsBC;AA5cD,2DAA2C;AAE3C,mDAA4E;AAC5E,mDAMyB;AACzB,yCAAoE;AAGpE,MAAM,kBAAkB,GAAG,QAAQ,CAAC;AAkBpC,SAAS,SAAS,CAChB,GAAW,EACX,IAAuB,EACvB,MAAwC,EAAE;IAE1C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,KAAK,GAAG,IAAA,0BAAK,EAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE;YAClC,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;YACjC,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,GAAG,EAAE;SAChC,CAAC,CAAC;QACH,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACzC,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC7B,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1B,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACzB,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AASD,SAAS,wBAAwB,CAC/B,GAAW,EACX,IAAuB,EACvB,UAA0C;IAE1C,OAAO,IAAA,gCAAgB,EAAC,UAAU,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;AAC1E,CAAC;AAGD,MAAM,qBAAqB,GAAG,CAAC,CAAC;AAChC,MAAM,qBAAqB,GAAG,IAAI,CAAC;AAanC,SAAgB,UAAU,CACxB,MAAc,EACd,SAAqE,EAAE;IAEvE,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,qBAAqB,CAAC;IAC1D,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,qBAAqB,CAAC;IAC1D,MAAM,KAAK,GAAG,MAAM;SACjB,KAAK,CAAC,QAAQ,CAAC;SACf,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChD,IAAI,IAAI,CAAC,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,OAAO,IAAI,CAAC,MAAM,GAAG,QAAQ,SAAS,CAAC;AAC1E,CAAC;AAiBY,QAAA,8BAA8B,GAAsB;IAC/D,oBAAoB;IACpB,cAAc;IACd,+BAA+B;IAC/B,0BAA0B;IAC1B,yCAAyC;CAC1C,CAAC;AAGF,SAAgB,qBAAqB,CAAC,MAAc;IAClD,OAAO,sCAA8B,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC3E,CAAC,CAAC,4BAAiB,CAAC,uBAAuB;QAC3C,CAAC,CAAC,4BAAiB,CAAC,QAAQ,CAAC;AACjC,CAAC;AAQD,MAAa,kBAAmB,SAAQ,KAAK;IAGzB;IACA;IACA;IACA;IALlB,YAEkB,OAAe,EACf,QAAgB,EAChB,IAAuB,EACvB,UAAkB;QAElC,KAAK,CAAC,GAAG,OAAO,iBAAiB,QAAQ,UAAU,IAAI,MAAM,UAAU,EAAE,CAAC,CAAC;QAL3D,YAAO,GAAP,OAAO,CAAQ;QACf,aAAQ,GAAR,QAAQ,CAAQ;QAChB,SAAI,GAAJ,IAAI,CAAmB;QACvB,eAAU,GAAV,UAAU,CAAQ;QAGlC,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;IAED,MAAM,CAAC,OAAO,CAAC,OAAe,EAAE,GAAoB;QAClD,OAAO,IAAI,kBAAkB,CAC3B,OAAO,EACP,GAAG,CAAC,IAAI,EACR,qBAAqB,CAAC,GAAG,CAAC,MAAM,CAAC,EACjC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CACvB,CAAC;IACJ,CAAC;CACF;AApBD,gDAoBC;AAGM,KAAK,UAAU,qBAAqB,CACzC,MAAc,kBAAkB;IAEhC,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;QAC3D,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,KAAK,GAAG,qBAAqB,IAAI,KAAK,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,8EAA8E;YAC5E,IAAI,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAChE,CAAC;IACJ,CAAC;AACH,CAAC;AAyCD,SAAS,cAAc,CACrB,WAAgD,EAChD,KAAc;IAEd,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,KAAK;QACV,CAAC,CAAC,CAAC,WAAW,CAAC;QACf,CAAC,CAAC,CAAC,WAAW,EAAE,gBAAgB,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC;AACxD,CAAC;AA+BM,KAAK,UAAU,qBAAqB,CACzC,KAAiC;IAEjC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,kBAAkB,CAAC;IAI5C,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACtB,IAAA,uCAAuB,EAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC7C,CAAC;IACD,MAAM,IAAI,GAAa,CAAC,QAAQ,CAAC,CAAC;IAClC,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACpC,CAAC;SAAM,CAAC;QACN,IAAI,KAAK,CAAC,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CACb,4EAA4E,CAC7E,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,EAAE,IAAI,KAAK,CAAC,iBAAiB,EAAE,CAAC;YACzC,IAAI,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,CAAC,CAAC;QAC1C,CAAC;QACD,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;YACrB,IAAI,CAAC,IAAI,CAAC,2BAA2B,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACxE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACxB,MAAM,GAAG,GAAG,MAAM,wBAAwB,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAChF,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,kBAAkB,CAAC,OAAO,CAAC,GAAG,GAAG,SAAS,EAAE,GAAG,CAAC,CAAC;IACzD,CAAC;AACH,CAAC;AAmBM,KAAK,UAAU,uBAAuB,CAC3C,KAAmC;IAEnC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,kBAAkB,CAAC;IAC5C,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACtB,IAAA,uCAAuB,EAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC7C,CAAC;IACD,MAAM,IAAI,GAAa,CAAC,oBAAoB,EAAE,QAAQ,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;IAC7E,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACpC,CAAC;SAAM,CAAC;QACN,IAAI,KAAK,CAAC,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CACb,8EAA8E,CAC/E,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,EAAE,IAAI,KAAK,CAAC,iBAAiB,EAAE,CAAC;YACzC,IAAI,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,CAAC,CAAC;QAC1C,CAAC;QACD,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;YACrB,IAAI,CAAC,IAAI,CAAC,2BAA2B,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACxE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACxB,MAAM,GAAG,GAAG,MAAM,wBAAwB,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAChF,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,kBAAkB,CAAC,OAAO,CAAC,GAAG,GAAG,qBAAqB,EAAE,GAAG,CAAC,CAAC;IACrE,CAAC;AACH,CAAC;AAwDD,SAAS,mBAAmB,CAC1B,MAA6B,EAC7B,KAA4B;IAE5B,MAAM,IAAI,GAAa,CAAC,aAAa,CAAC,CAAC;IACvC,IAAI,MAAM,CAAC,IAAI,KAAK,qCAAqB,CAAC,SAAS,EAAE,CAAC;QACpD,IAAI,CAAC,IAAI,CACP,OAAO,EACP,MAAM,CAAC,aAAa,EACpB,UAAU,EACV,KAAK,CAAC,UAAU,EAChB,wBAAwB,CACzB,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,IAAI,CACP,UAAU,EACV,KAAK,CAAC,UAAU,EAChB,+BAA+B,EAC/B,MAAM,CAAC,IAAI,CACZ,CAAC;IACF,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;QACrB,IAAI,CAAC,IAAI,CAAC,2BAA2B,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QAMtB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,gBAAgB,EAAE,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC9B,OAAO,IAAI,CAAC;AACd,CAAC;AAaM,KAAK,UAAU,gBAAgB,CACpC,KAA4B;IAE5B,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,kBAAkB,CAAC;IAC5C,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,EAAE,OAAO,EAAE,8BAAmB,CAAC,MAAM,EAAE,CAAC;IACjD,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QAGtB,IAAA,uCAAuB,EAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC7C,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QACnC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,mBAAmB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;QAC1E,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;YACf,OAAO;gBACL,OAAO,EAAE,8BAAmB,CAAC,QAAQ;gBACrC,aAAa,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE;aACxD,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,8BAAmB,CAAC,MAAM,EAAE,CAAC;AACjD,CAAC"}
+{"version":3,"file":"cosign-exec.js","sourceRoot":"","sources":["../../src/lib/cosign-exec.ts"],"names":[],"mappings":";;;AA0FA,gCAeC;AA0BD,sDAIC;AA+BD,sDAcC;AA2KD,sDAIC;AAWD,0DAOC;AAqGD,4CAgCC;AA1fD,2DAA2C;AAE3C,mDAA4E;AAC5E,mDAMyB;AACzB,mDAGyB;AACzB,uDAG2B;AAC3B,yCAAoE;AAGpE,MAAM,kBAAkB,GAAG,QAAQ,CAAC;AAkBpC,SAAS,SAAS,CAChB,GAAW,EACX,IAAuB,EACvB,MAAwC,EAAE;IAE1C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,KAAK,GAAG,IAAA,0BAAK,EAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE;YAClC,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;YACjC,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,GAAG,EAAE;SAChC,CAAC,CAAC;QACH,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACzC,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC7B,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1B,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACzB,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AASD,SAAS,wBAAwB,CAC/B,GAAW,EACX,IAAuB,EACvB,UAA0C;IAE1C,OAAO,IAAA,gCAAgB,EAAC,UAAU,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;AAC1E,CAAC;AAGD,MAAM,qBAAqB,GAAG,CAAC,CAAC;AAChC,MAAM,qBAAqB,GAAG,IAAI,CAAC;AAanC,SAAgB,UAAU,CACxB,MAAc,EACd,SAAqE,EAAE;IAEvE,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,qBAAqB,CAAC;IAC1D,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,qBAAqB,CAAC;IAC1D,MAAM,KAAK,GAAG,MAAM;SACjB,KAAK,CAAC,QAAQ,CAAC;SACf,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChD,IAAI,IAAI,CAAC,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,OAAO,IAAI,CAAC,MAAM,GAAG,QAAQ,SAAS,CAAC;AAC1E,CAAC;AAiBY,QAAA,8BAA8B,GAAsB;IAC/D,oBAAoB;IACpB,cAAc;IACd,+BAA+B;IAC/B,0BAA0B;IAC1B,yCAAyC;CAC1C,CAAC;AAGF,SAAgB,qBAAqB,CAAC,MAAc;IAClD,OAAO,sCAA8B,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC3E,CAAC,CAAC,4BAAiB,CAAC,uBAAuB;QAC3C,CAAC,CAAC,4BAAiB,CAAC,QAAQ,CAAC;AACjC,CAAC;AAQD,MAAa,kBAAmB,SAAQ,KAAK;IAGzB;IACA;IACA;IACA;IALlB,YAEkB,OAAe,EACf,QAAgB,EAChB,IAAuB,EACvB,UAAkB;QAElC,KAAK,CAAC,GAAG,OAAO,iBAAiB,QAAQ,UAAU,IAAI,MAAM,UAAU,EAAE,CAAC,CAAC;QAL3D,YAAO,GAAP,OAAO,CAAQ;QACf,aAAQ,GAAR,QAAQ,CAAQ;QAChB,SAAI,GAAJ,IAAI,CAAmB;QACvB,eAAU,GAAV,UAAU,CAAQ;QAGlC,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;IAED,MAAM,CAAC,OAAO,CAAC,OAAe,EAAE,GAAoB;QAClD,OAAO,IAAI,kBAAkB,CAC3B,OAAO,EACP,GAAG,CAAC,IAAI,EACR,qBAAqB,CAAC,GAAG,CAAC,MAAM,CAAC,EACjC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CACvB,CAAC;IACJ,CAAC;CACF;AApBD,gDAoBC;AAGM,KAAK,UAAU,qBAAqB,CACzC,MAAc,kBAAkB;IAEhC,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;QAC3D,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,KAAK,GAAG,qBAAqB,IAAI,KAAK,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,8EAA8E;YAC5E,IAAI,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAChE,CAAC;IACJ,CAAC;AACH,CAAC;AAyCD,SAAS,cAAc,CACrB,WAAgD,EAChD,KAAc;IAEd,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,KAAK;QACV,CAAC,CAAC,CAAC,WAAW,CAAC;QACf,CAAC,CAAC,CAAC,WAAW,EAAE,gBAAgB,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC;AACxD,CAAC;AAYD,SAAS,gBAAgB,CACvB,OAA0B,EAC1B,KAAyB,EACzB,WAAgD,EAChD,OAAe;IAEf,OAAO;QACL,GAAG,OAAO;QACV,wBAAwB;QACxB,KAAK,CAAC,QAAQ;QACd,2BAA2B;QAC3B,KAAK,CAAC,MAAM;QACZ,GAAG,cAAc,CAAC,WAAW,EAAE,KAAK,CAAC;QACrC,OAAO;KACR,CAAC;AACJ,CAAC;AAOD,SAAS,kBAAkB,CACzB,OAA0B,EAC1B,MAA4B,EAC5B,WAAgD,EAChD,MAAc;IAEd,IAAI,MAAM,CAAC,IAAI,KAAK,qCAAqB,CAAC,SAAS,EAAE,CAAC;QACpD,OAAO;YACL,GAAG,OAAO;YACV,OAAO;YACP,MAAM,CAAC,aAAa;YACpB,GAAG,cAAc,CAAC,WAAW,EAAE,IAAI,CAAC;YACpC,MAAM;SACP,CAAC;IACJ,CAAC;IACD,OAAO,gBAAgB,CACrB,OAAO,EACP,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,EACpD,WAAW,EACX,MAAM,CACP,CAAC;AACJ,CAAC;AAmCD,KAAK,UAAU,sBAAsB,CACnC,OAA0B,EAC1B,KAA4B;IAE5B,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,kBAAkB,CAAC;IAC5C,IAAA,4CAA0B,EAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC/D,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACtB,IAAA,uCAAuB,EAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC7C,CAAC;IACD,MAAM,IAAI,GAAG,kBAAkB,CAC7B,OAAO,EACP,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,WAAW,EACjB,KAAK,CAAC,MAAM,CACb,CAAC;IACF,MAAM,GAAG,GAAG,MAAM,wBAAwB,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAChF,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,kBAAkB,CAAC,OAAO,CAAC,GAAG,GAAG,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IAChE,CAAC;AACH,CAAC;AAWD,SAAgB,qBAAqB,CACnC,KAAiC;IAEjC,OAAO,sBAAsB,CAAC,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAC,CAAC;AACnD,CAAC;AAWD,SAAgB,uBAAuB,CACrC,KAAmC;IAEnC,OAAO,sBAAsB,CAC3B,CAAC,oBAAoB,EAAE,QAAQ,EAAE,KAAK,CAAC,aAAa,CAAC,EACrD,KAAK,CACN,CAAC;AACJ,CAAC;AA4DD,SAAS,mBAAmB,CAC1B,MAA6B,EAC7B,KAA4B;IAE5B,MAAM,IAAI,GAAa,CAAC,aAAa,CAAC,CAAC;IACvC,IAAI,MAAM,CAAC,IAAI,KAAK,qCAAqB,CAAC,SAAS,EAAE,CAAC;QACpD,IAAI,CAAC,IAAI,CACP,OAAO,EACP,MAAM,CAAC,aAAa,EACpB,UAAU,EACV,KAAK,CAAC,UAAU,EAChB,wBAAwB,CACzB,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;IAOD,OAAO,gBAAgB,CACrB,CAAC,aAAa,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,EAC7C,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,UAAU,IAAI,EAAE,EAAE,EACzD,KAAK,CAAC,WAAW,EACjB,KAAK,CAAC,YAAY,CACnB,CAAC;AACJ,CAAC;AAaM,KAAK,UAAU,gBAAgB,CACpC,KAA4B;IAE5B,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,kBAAkB,CAAC;IAC5C,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,EAAE,OAAO,EAAE,8BAAmB,CAAC,MAAM,EAAE,CAAC;IACjD,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QAGtB,IAAA,uCAAuB,EAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC7C,CAAC;IAGD,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QACnC,IAAI,MAAM,CAAC,IAAI,KAAK,qCAAqB,CAAC,eAAe,EAAE,CAAC;YAC1D,IAAA,wCAAwB,EAAC;gBACvB,QAAQ,EAAE,MAAM,CAAC,IAAI;gBACrB,MAAM,EAAE,KAAK,CAAC,UAAU,IAAI,EAAE;aAC/B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QACnC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,mBAAmB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;QAC1E,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;YACf,OAAO;gBACL,OAAO,EAAE,8BAAmB,CAAC,QAAQ;gBACrC,aAAa,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE;aACxD,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,8BAAmB,CAAC,MAAM,EAAE,CAAC;AACjD,CAAC"}

package/dist/lib/expected-signer.d.ts

@@ -0,0 +1,15 @@
+import { type CosignKeylessEntry } from './keyless-entry';
+import { CosignTrustAnchorKind } from './trust-anchors';
+export interface CosignKeySigner {
+    readonly kind: CosignTrustAnchorKind.PublicKey;
+    readonly publicKeyPath: string;
+}
+export interface CosignKeylessSigner extends CosignKeylessEntry {
+    readonly kind: CosignTrustAnchorKind.KeylessIdentity;
+}
+export type CosignExpectedSigner = CosignKeySigner | CosignKeylessSigner;
+export declare class CosignExpectedSignerError extends Error {
+    constructor(message: string);
+}
+export declare function assertCosignExpectedSigner(signer: CosignExpectedSigner | undefined, subject: string): asserts signer is CosignExpectedSigner;
+//# sourceMappingURL=expected-signer.d.ts.map

package/dist/lib/expected-signer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"expected-signer.d.ts","sourceRoot":"","sources":["../../src/lib/expected-signer.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAYxD,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC,SAAS,CAAC;IAE/C,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAGD,MAAM,WAAW,mBAAoB,SAAQ,kBAAkB;IAC7D,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC,eAAe,CAAC;CACtD;AAGD,MAAM,MAAM,oBAAoB,GAAG,eAAe,GAAG,mBAAmB,CAAC;AAGzE,qBAAa,yBAA0B,SAAQ,KAAK;gBACtC,OAAO,EAAE,MAAM;CAI5B;AAQD,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,oBAAoB,GAAG,SAAS,EACxC,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,MAAM,IAAI,oBAAoB,CAsBxC"}

package/dist/lib/expected-signer.js

@@ -0,0 +1,31 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CosignExpectedSignerError = void 0;
+exports.assertCosignExpectedSigner = assertCosignExpectedSigner;
+const keyless_entry_1 = require("./keyless-entry");
+const trust_anchors_1 = require("./trust-anchors");
+class CosignExpectedSignerError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'CosignExpectedSignerError';
+    }
+}
+exports.CosignExpectedSignerError = CosignExpectedSignerError;
+function assertCosignExpectedSigner(signer, subject) {
+    if (!signer) {
+        throw new CosignExpectedSignerError(`no signer is declared for ${subject}; refusing to verify it against anything else`);
+    }
+    switch (signer.kind) {
+        case trust_anchors_1.CosignTrustAnchorKind.PublicKey:
+            if (!signer.publicKeyPath || signer.publicKeyPath.trim().length === 0) {
+                throw new CosignExpectedSignerError(`the key signer declared for ${subject} has no public key path`);
+            }
+            return;
+        case trust_anchors_1.CosignTrustAnchorKind.KeylessIdentity:
+            (0, keyless_entry_1.assertCosignKeylessEntry)(signer);
+            return;
+        default:
+            throw new CosignExpectedSignerError(`the signer declared for ${subject} has unknown kind '${String(signer.kind)}'`);
+    }
+}
+//# sourceMappingURL=expected-signer.js.map

package/dist/lib/expected-signer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"expected-signer.js","sourceRoot":"","sources":["../../src/lib/expected-signer.ts"],"names":[],"mappings":";;;AA4CA,gEAyBC;AArED,mDAGyB;AACzB,mDAAwD;AA2BxD,MAAa,yBAA0B,SAAQ,KAAK;IAClD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;CACF;AALD,8DAKC;AAQD,SAAgB,0BAA0B,CACxC,MAAwC,EACxC,OAAe;IAEf,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,yBAAyB,CACjC,6BAA6B,OAAO,+CAA+C,CACpF,CAAC;IACJ,CAAC;IACD,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,qCAAqB,CAAC,SAAS;YAClC,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACtE,MAAM,IAAI,yBAAyB,CACjC,+BAA+B,OAAO,yBAAyB,CAChE,CAAC;YACJ,CAAC;YACD,OAAO;QACT,KAAK,qCAAqB,CAAC,eAAe;YACxC,IAAA,wCAAwB,EAAC,MAAM,CAAC,CAAC;YACjC,OAAO;QACT;YACE,MAAM,IAAI,yBAAyB,CACjC,2BAA2B,OAAO,sBAAsB,MAAM,CAAE,MAA6B,CAAC,IAAI,CAAC,GAAG,CACvG,CAAC;IACN,CAAC;AACH,CAAC"}

package/dist/lib/keyless-entry.d.ts

@@ -0,0 +1,9 @@
+export interface CosignKeylessEntry {
+    readonly identity: string;
+    readonly issuer: string;
+}
+export declare class CosignKeylessEntryError extends Error {
+    constructor(message: string);
+}
+export declare function assertCosignKeylessEntry(entry: CosignKeylessEntry): void;
+//# sourceMappingURL=keyless-entry.d.ts.map

package/dist/lib/keyless-entry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keyless-entry.d.ts","sourceRoot":"","sources":["../../src/lib/keyless-entry.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAGD,qBAAa,uBAAwB,SAAQ,KAAK;gBACpC,OAAO,EAAE,MAAM;CAI5B;AAGD,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,kBAAkB,GAAG,IAAI,CAWxE"}

package/dist/lib/keyless-entry.js

@@ -0,0 +1,20 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CosignKeylessEntryError = void 0;
+exports.assertCosignKeylessEntry = assertCosignKeylessEntry;
+class CosignKeylessEntryError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'CosignKeylessEntryError';
+    }
+}
+exports.CosignKeylessEntryError = CosignKeylessEntryError;
+function assertCosignKeylessEntry(entry) {
+    if (!entry.identity || entry.identity.trim().length === 0) {
+        throw new CosignKeylessEntryError('cosign keyless entry has no certificate identity');
+    }
+    if (!entry.issuer || entry.issuer.trim().length === 0) {
+        throw new CosignKeylessEntryError(`cosign keyless entry for identity "${entry.identity}" has no OIDC issuer; the issuer is required`);
+    }
+}
+//# sourceMappingURL=keyless-entry.js.map

package/dist/lib/keyless-entry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keyless-entry.js","sourceRoot":"","sources":["../../src/lib/keyless-entry.ts"],"names":[],"mappings":";;;AAoBA,4DAWC;AAnBD,MAAa,uBAAwB,SAAQ,KAAK;IAChD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AALD,0DAKC;AAGD,SAAgB,wBAAwB,CAAC,KAAyB;IAChE,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,uBAAuB,CAC/B,kDAAkD,CACnD,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,uBAAuB,CAC/B,sCAAsC,KAAK,CAAC,QAAQ,8CAA8C,CACnG,CAAC;IACJ,CAAC;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xemahq/biome-supply-chain",
-  "version": "0.5.1",
+  "version": "0.7.0",
   "description": "Shared cosign supply-chain verification for Xema biomes: the single cosign CLI exec + the signature/provenance verdict enums used by biome-fetcher-api (OCI bundle verification) and xema-store-api. Node-builtins only.",
   "license": "LicenseRef-Xema-BSL-1.1",
   "author": "Neuralchowder Inc. <developer@xema.dev> (https://xema.dev)",
@@ -54,5 +54,8 @@
     "test": "tsc -p tsconfig.json && node --test \"dist-test/test/**/*.test.js\"",
     "typecheck": "tsc -p tsconfig.json --noEmit",
     "clean": "rm -rf dist dist-test"
+  },
+  "xemaRelease": {
+    "sourceDigest": "sha256:86a1eab069a713e28f5849cd141c7652ff66d3c132618120f2dbf0fc5ecf0673"
   }
-}
+}