fca-rqzax-remake 0.0.1-security → 8.19.2

package/.config/npm/node_global/lib/node_modules/npm/node_modules/sigstore/README.md

@@ -0,0 +1,180 @@
+# sigstore-js
+
+A JavaScript library for generating and verifying Sigstore signatures. One of
+the intended uses is to sign and verify npm packages but it can be used to sign
+and verify any file.
+
+## Features
+
+* Support for signing using an OpenID Connect identity
+* Support for publishing signatures to a [Rekor][1] instance
+* Support for verifying Sigstore bundles
+
+## Prerequisites
+
+- Node.js version >= 14.17.0
+
+## Installation
+
+```
+npm install sigstore
+```
+
+## Usage
+
+```javascript
+const { sigstore } = require('sigstore')
+```
+
+```javascript
+import { sigstore } from 'sigstore'
+```
+
+### sign(payload[, options])
+
+Generates a Sigstore signature for the supplied payload. Returns a
+[Sigstore bundle][2] containing the signature and the verification material
+necessary to verify the signature.
+
+* `payload` `<Buffer>`: The bytes of the artifact to be signed.
+* `options` `<Object>`
+  * `fulcioURL` `<string>`: The base URL of the Fulcio instance to use for retrieving the signing certificate. Defaults to `'https://fulcio.sigstore.dev'`.
+  * `rekorURL` `<string>`: The base URL of the Rekor instance to use when adding the signature to the transparency log. Defaults to `'https://rekor.sigstore.dev'`.
+  * `identityToken` `<string>`: The OIDC token identifying the signer. If no explicit token is supplied, an attempt will be made to retrieve one from the environment.
+
+### attest(payload, payloadType[, options])
+
+Generates a Sigstore signature for the supplied in-toto statement. Returns a
+[Sigstore bundle][2] containing the [DSSE][3]-wrapped statement and signature
+as well as the verification material necessary to verify the signature.
+
+* `payload` `<Buffer>`: The bytes of the statement to be signed.
+* `payloadType` `<string>`: MIME or content type describing the statement to be signed.
+* `options` `<Object>`
+  * `fulcioURL` `<string>`: The base URL of the Fulcio instance to use for retrieving the signing certificate. Defaults to `'https://fulcio.sigstore.dev'`.
+  * `rekorURL` `<string>`: The base URL of the Rekor instance to use when adding the signature to the transparency log. Defaults to `'https://rekor.sigstore.dev'`.
+  * `identityToken` `<string>`: The OIDC token identifying the signer. If no explicit token is supplied, an attempt will be made to retrieve one from the environment.
+
+
+### verify(bundle[, payload][, options])
+
+Verifies the signature in the supplied bundle.
+
+* `bundle` `<Bundle>`: The Sigstore bundle containing the signature to be verified and the verification material necessary to verify the signature.
+* `payload` `<Buffer>`: The bytes of the artifact over which the signature was created. Only necessary when the `sign` function was used to generate the signature since the Bundle does not contain any information about the artifact which was signed. Not required when the `attest` function was used to generate the Bundle.
+* `options` `<Object>`
+  * `ctLogThreshold` `<number>`: The number of certificate transparency logs on which the signing certificate must appear. Defaults to `1`.
+  * `tlogThreshold` `<number>`: The number of transparency logs on which the signature must appear. Defaults to `1`.
+  * `certificateIssuer` `<string>`: Value that must appear in the signing certificate's issuer extension (OID 1.3.6.1.4.1.57264.1.1). Not verified if no value is supplied.
+  * `certificateIdentityEmail` `<string>`: Email address which must appear in the signing certificate's Subject Alternative Name (SAN) extension. Must be specified in conjunction with the `certificateIssuer` option. Takes precedence over the `certificateIdentityURI` option. Not verified if no value is supplied.
+  * `certificateIdentityURI` `<string>`: URI which must appear in the signing certificate's Subject Alternative Name (SAN) extension. Must be specified in conjunction with the `certificateIssuer` option. Ignored if the `certificateIdentityEmail` option is set. Not verified if no value is supplied.
+  * `certificateOIDs` `<Object>`: A collection of OID/value pairs which must be present in the certificate's extension list. Not verified if no value is supplied.
+  * `keySelector` `<Function>`: Callback invoked to retrieve the public key (as either `string` or `Buffer`) necessary to verify the bundle signature. Not used when the signature was generated from a Fulcio-issued signing certificate.
+    * `hint` `<String>`: The hint from the bundle used to identify the the signing key.
+
+
+### utils
+
+The `utils` object contains a few internal utility functions. These are exposed
+to support the needs of specific `sigstore-js` consumers but should **NOT** be
+considered part of the stable public interface.
+
+## CLI
+
+The `sigstore-js` library comes packaged with a basic command line interface
+for testing and demo purposes. However, the CLI should **NOT** be considered
+part of the stable interface of the library. If you require a production-ready
+Sigstore CLI, we recommend you use [`cosign`][4].
+
+```shell
+$ npx sigstore help
+sigstore <command> <artifact>
+
+  Usage:
+
+  sigstore sign         sign an artifact
+  sigstore attest       sign an artifact using dsse (Dead Simple Signing Envelope)
+  sigstore verify       verify an artifact
+  sigstore version      print version information
+  sigstore help         print help information
+```
+
+## Development
+
+### Updating protobufs
+
+[Docker](https://docs.docker.com/engine/install/) is required to generate protobufs for the `.sigstore` bundle format.
+
+Install Docker on MacOS using [Homebrew](https://brew.sh/):
+
+```
+brew install --cask docker && open -a Docker
+```
+
+View [Docker install instructions](https://docs.docker.com/engine/install/) for other platforms.
+
+#### Updating Sigstore Protobufs
+
+Update the Git `REF` in `hack/generate-bundle-types` from the [sigstore/protobuf-specs][5] repository.
+
+Generate TypeScript protobufs (should update files in scr/types/sigstore/\_\_generated\_\_):
+
+```
+npm run codegen:bundle
+```
+
+#### Updating Rekor Types
+
+Update the git `REF` in `hack/generate-rekor-types` from the [sigstore/rekor][1] repository.
+
+Generate TypeScript types (should update files in scr/types/rekor/\_\_generated\_\_):
+
+```
+npm run codegen:rekor
+```
+
+### Release Steps
+
+1. Update the version inside `package.json` and run `npm i` to update `package-lock.json`.
+2. PR the changes above and merge to the "main" branch when approved.
+3. Use either the "[Create a new release](https://github.com/sigstore/sigstore-js/releases/new)" link or the `gh release create` CLI command to start a new release.
+4. Tag the release with a label matching the version in the `package.json` (with a `v` prefix).
+5. Add a title matching the tag.
+6. Add release notes.
+7. Mark as pre-release as appropriate.
+8. Publish release.
+
+After publishing the release, a new npm package will be built and published automatically to the npm registry.
+## Licensing
+
+`sigstore-js` is licensed under the Apache 2.0 License.
+
+## Contributing
+
+See [the contributing docs][7] for details.
+
+## Code of Conduct
+Everyone interacting with this project is expected to follow the [sigstore Code of Conduct][8].
+
+## Security
+
+Should you discover any security issues, please refer to sigstore's [security process][9].
+
+## Info
+
+`sigstore-js` is developed as part of the [`sigstore`][6] project.
+
+We also use a [slack channel][10]! Click [here][11] for the invite link.
+
+
+[1]: https://github.com/sigstore/rekor
+[2]: https://github.com/sigstore/protobuf-specs/blob/9b722b68a717778ba4f11543afa4ef93205ab502/protos/sigstore_bundle.proto#L63-L84
+[3]: https://github.com/secure-systems-lab/dsse
+[4]: https://github.com/sigstore/cosign
+[5]: https://github.com/sigstore/protobuf-specs
+[6]: https://sigstore.dev
+[7]: https://github.com/sigstore/.github/blob/main/CONTRIBUTING.md
+[8]: https://github.com/sigstore/.github/blob/main/CODE_OF_CONDUCT.md
+[9]: https://github.com/sigstore/.github/blob/main/SECURITY.md
+[10]: https://sigstore.slack.com
+[11]: https://join.slack.com/t/sigstore/shared_invite/zt-mhs55zh0-XmY3bcfWn4XEyMqUUutbUQ

package/.config/npm/node_global/lib/node_modules/npm/node_modules/sigstore/bin/sigstore.js

@@ -0,0 +1,17 @@
+#!/usr/bin/env node
+/*
+Copyright 2022 The Sigstore Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+require('../dist/cli').processArgv();

package/.config/npm/node_global/lib/node_modules/npm/node_modules/sigstore/dist/ca/format.d.ts

@@ -0,0 +1,5 @@
+/// <reference types="node" />
+/// <reference types="node" />
+import { KeyObject } from 'crypto';
+import { CertificateRequest } from '../client/fulcio';
+export declare function toCertificateRequest(publicKey: KeyObject, challenge: Buffer): CertificateRequest;

package/.config/npm/node_global/lib/node_modules/npm/node_modules/sigstore/dist/ca/format.js

@@ -0,0 +1,14 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.toCertificateRequest = void 0;
+function toCertificateRequest(publicKey, challenge) {
+    return {
+        publicKey: {
+            content: publicKey
+                .export({ type: 'spki', format: 'der' })
+                .toString('base64'),
+        },
+        signedEmailAddress: challenge.toString('base64'),
+    };
+}
+exports.toCertificateRequest = toCertificateRequest;

package/.config/npm/node_global/lib/node_modules/npm/node_modules/sigstore/dist/ca/index.d.ts

@@ -0,0 +1,14 @@
+/// <reference types="node" />
+/// <reference types="node" />
+import { KeyObject } from 'crypto';
+export interface CA {
+    createSigningCertificate: (identityToken: string, publicKey: KeyObject, challenge: Buffer) => Promise<string[]>;
+}
+export interface CAClientOptions {
+    fulcioBaseURL: string;
+}
+export declare class CAClient implements CA {
+    private fulcio;
+    constructor(options: CAClientOptions);
+    createSigningCertificate(identityToken: string, publicKey: KeyObject, challenge: Buffer): Promise<string[]>;
+}

package/.config/npm/node_global/lib/node_modules/npm/node_modules/sigstore/dist/ca/index.js

@@ -0,0 +1,23 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CAClient = void 0;
+const client_1 = require("../client");
+const error_1 = require("../error");
+const util_1 = require("../util");
+const format_1 = require("./format");
+class CAClient {
+    constructor(options) {
+        this.fulcio = new client_1.Fulcio({ baseURL: options.fulcioBaseURL });
+    }
+    async createSigningCertificate(identityToken, publicKey, challenge) {
+        const request = (0, format_1.toCertificateRequest)(publicKey, challenge);
+        try {
+            const certificate = await this.fulcio.createSigningCertificate(identityToken, request);
+            return util_1.pem.split(certificate);
+        }
+        catch (err) {
+            throw new error_1.InternalError('error creating signing certificate', err);
+        }
+    }
+}
+exports.CAClient = CAClient;

package/.config/npm/node_global/lib/node_modules/npm/node_modules/sigstore/dist/ca/verify/chain.d.ts

@@ -0,0 +1,3 @@
+import * as sigstore from '../../types/sigstore';
+import { x509Certificate } from '../../x509/cert';
+export declare function verifyChain(bundleCerts: sigstore.X509Certificate[], certificateAuthorities: sigstore.CertificateAuthority[]): x509Certificate[];

package/.config/npm/node_global/lib/node_modules/npm/node_modules/sigstore/dist/ca/verify/chain.js

@@ -0,0 +1,64 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verifyChain = void 0;
+/*
+Copyright 2022 The Sigstore Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+const error_1 = require("../../error");
+const cert_1 = require("../../x509/cert");
+const verify_1 = require("../../x509/verify");
+function verifyChain(bundleCerts, certificateAuthorities) {
+    const certs = parseCerts(bundleCerts);
+    const signingCert = certs[0];
+    // Filter the list of certificate authorities to those which are valid for the
+    // signing certificate's notBefore date.
+    const validCAs = filterCertificateAuthorities(certificateAuthorities, signingCert.notBefore);
+    if (validCAs.length === 0) {
+        throw new error_1.VerificationError('No valid certificate authorities');
+    }
+    let trustedChain = [];
+    // Loop through all valid CAs and attempt to verify the certificate chain
+    const verified = validCAs.find((ca) => {
+        const trustedCerts = parseCerts(ca.certChain?.certificates || []);
+        try {
+            trustedChain = (0, verify_1.verifyCertificateChain)({
+                trustedCerts,
+                certs,
+                validAt: signingCert.notBefore,
+            });
+            return true;
+        }
+        catch (e) {
+            return false;
+        }
+    });
+    if (!verified) {
+        throw new error_1.VerificationError('No valid certificate chain');
+    }
+    return trustedChain;
+}
+exports.verifyChain = verifyChain;
+// Filter the list of certificate authorities to those which are valid for the
+// given date.
+function filterCertificateAuthorities(certificateAuthorities, validAt) {
+    return certificateAuthorities.filter((ca) => ca.validFor &&
+        ca.validFor.start &&
+        ca.validFor.start <= validAt &&
+        (!ca.validFor.end || validAt <= ca.validFor.end));
+}
+// Parse the raw bytes of a certificate into an x509Certificate object.
+function parseCerts(certs) {
+    return certs.map((cert) => cert_1.x509Certificate.parse(cert.rawBytes));
+}

package/.config/npm/node_global/lib/node_modules/npm/node_modules/sigstore/dist/ca/verify/index.d.ts

@@ -0,0 +1,2 @@
+import * as sigstore from '../../types/sigstore';
+export declare function verifySigningCertificate(bundle: sigstore.BundleWithCertificateChain, trustedRoot: sigstore.TrustedRoot, options: sigstore.CAArtifactVerificationOptions): void;

package/.config/npm/node_global/lib/node_modules/npm/node_modules/sigstore/dist/ca/verify/index.js

@@ -0,0 +1,21 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verifySigningCertificate = void 0;
+const chain_1 = require("./chain");
+const sct_1 = require("./sct");
+const signer_1 = require("./signer");
+function verifySigningCertificate(bundle, trustedRoot, options) {
+    // Check that a trusted certificate chain can be found for the signing
+    // certificate in the bundle
+    const trustedChain = (0, chain_1.verifyChain)(bundle.verificationMaterial.content.x509CertificateChain.certificates, trustedRoot.certificateAuthorities);
+    // Unless disabled, verify the SCTs in the signing certificate
+    if (options.ctlogOptions.disable === false) {
+        (0, sct_1.verifySCTs)(trustedChain, trustedRoot.ctlogs, options.ctlogOptions);
+    }
+    // Verify the signing certificate against the provided identities
+    // if provided
+    if (options.signers) {
+        (0, signer_1.verifySignerIdentity)(trustedChain[0], options.signers.certificateIdentities);
+    }
+}
+exports.verifySigningCertificate = verifySigningCertificate;

package/.config/npm/node_global/lib/node_modules/npm/node_modules/sigstore/dist/ca/verify/sct.d.ts

@@ -0,0 +1,3 @@
+import * as sigstore from '../../types/sigstore';
+import { x509Certificate } from '../../x509/cert';
+export declare function verifySCTs(certificateChain: x509Certificate[], ctLogs: sigstore.TransparencyLogInstance[], options: sigstore.ArtifactVerificationOptions_CtlogOptions): void;

package/.config/npm/node_global/lib/node_modules/npm/node_modules/sigstore/dist/ca/verify/sct.js

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verifySCTs = void 0;
+/*
+Copyright 2022 The Sigstore Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+const error_1 = require("../../error");
+function verifySCTs(certificateChain, ctLogs, options) {
+    const signingCert = certificateChain[0];
+    const issuerCert = certificateChain[1];
+    const sctResults = signingCert.verifySCTs(issuerCert, ctLogs);
+    // Count the number of verified SCTs which were found
+    const verifiedSCTCount = sctResults.filter((sct) => sct.verified).length;
+    if (verifiedSCTCount < options.threshold) {
+        throw new error_1.VerificationError(`Not enough SCTs verified (found ${verifiedSCTCount}, need ${options.threshold})`);
+    }
+}
+exports.verifySCTs = verifySCTs;

package/.config/npm/node_global/lib/node_modules/npm/node_modules/sigstore/dist/ca/verify/signer.d.ts

@@ -0,0 +1,3 @@
+import * as sigstore from '../../types/sigstore';
+import { x509Certificate } from '../../x509/cert';
+export declare function verifySignerIdentity(signingCert: x509Certificate, identities: sigstore.CertificateIdentities): void;

package/.config/npm/node_global/lib/node_modules/npm/node_modules/sigstore/dist/ca/verify/signer.js

@@ -0,0 +1,131 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verifySignerIdentity = void 0;
+/*
+Copyright 2023 The Sigstore Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+const error_1 = require("../../error");
+const sigstore = __importStar(require("../../types/sigstore"));
+// https://github.com/sigstore/fulcio/blob/main/docs/oid-info.md#1361415726411--issuer
+const OID_FULCIO_ISSUER = '1.3.6.1.4.1.57264.1.1';
+// https://github.com/sigstore/fulcio/blob/main/docs/oid-info.md#1361415726417--othername-san
+const OID_FULCIO_USERNAME_SUBJECT = '1.3.6.1.4.1.57264.1.7';
+// Verifies the identity embedded in a Fulcio-issued signing certificate against
+// the list of trusted identities. Returns without error if at least one of the
+// identities matches the signing certificate; otherwise, throws a
+// VerificationError.
+function verifySignerIdentity(signingCert, identities) {
+    // Check that the signing certificate was issued to at least one of the
+    // specified identities
+    const signerVerified = identities.identities.some((identity) => verifyIdentity(signingCert, identity));
+    if (!signerVerified) {
+        throw new error_1.PolicyError('Certificate issued to untrusted signer');
+    }
+}
+exports.verifySignerIdentity = verifySignerIdentity;
+// Checks that the specified certificate was issued to the specified identity.
+// The certificate must match the issuer, subject alternative name, and an
+// optional list of certificate extensions. Returns true if the certificate was
+// issued to the identity; otherwise, returns false.
+function verifyIdentity(cert, identity) {
+    return (verifyIssuer(cert, identity.issuer) &&
+        verifySAN(cert, identity.san) &&
+        verifyOIDs(cert, identity.oids));
+}
+// Checks the Fulcio issuer extension against the expected issuer. Returns true
+// if the issuer matches; otherwise, returns false.
+function verifyIssuer(cert, issuer) {
+    const issuerExtension = cert.extension(OID_FULCIO_ISSUER);
+    return issuerExtension?.value.toString('ascii') === issuer;
+}
+// Checks the certificate against the expected subject alternative name. Returns
+// true if the SAN matches; otherwise, returns false.
+function verifySAN(cert, expectedSAN) {
+    // Fail if the SAN is not specified or is not a supported type
+    if (expectedSAN === undefined ||
+        expectedSAN.identity === undefined ||
+        expectedSAN.type ===
+            sigstore.SubjectAlternativeNameType
+                .SUBJECT_ALTERNATIVE_NAME_TYPE_UNSPECIFIED) {
+        return false;
+    }
+    const sanExtension = cert.extSubjectAltName;
+    // Fail if the certificate does not have a SAN extension
+    if (!sanExtension) {
+        return false;
+    }
+    let sanValue;
+    switch (expectedSAN.type) {
+        case sigstore.SubjectAlternativeNameType.EMAIL:
+            sanValue = sanExtension.rfc822Name;
+            break;
+        case sigstore.SubjectAlternativeNameType.URI:
+            sanValue = sanExtension.uri;
+            break;
+        case sigstore.SubjectAlternativeNameType.OTHER_NAME:
+            sanValue = sanExtension.otherName(OID_FULCIO_USERNAME_SUBJECT);
+            break;
+    }
+    // Missing SAN value is an automatic failure
+    if (sanValue === undefined) {
+        return false;
+    }
+    let match;
+    switch (expectedSAN.identity.$case) {
+        case 'value':
+            match = expectedSAN.identity.value;
+            break;
+        case 'regexp':
+            // TODO support regex
+            break;
+    }
+    return sanValue === match;
+}
+// Checks that the certificate contains the specified extensions. Returns true
+// if all extensions are present and match the expected values; otherwise,
+// returns false.
+function verifyOIDs(cert, oids) {
+    return oids.every((expectedExtension) => {
+        if (!expectedExtension.oid) {
+            return false;
+        }
+        const oid = expectedExtension.oid.id.join('.');
+        const extension = cert.extension(oid);
+        return extension?.value.equals(expectedExtension.value);
+    });
+}

package/.config/npm/node_global/lib/node_modules/npm/node_modules/sigstore/dist/cli/index.d.ts

@@ -0,0 +1 @@
+export declare function processArgv(): Promise<void>;

package/.config/npm/node_global/lib/node_modules/npm/node_modules/sigstore/dist/cli/index.js

@@ -0,0 +1,113 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.processArgv = void 0;
+/*
+Copyright 2022 The Sigstore Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+const fs_1 = __importDefault(require("fs"));
+const index_1 = require("../index");
+const INTOTO_PAYLOAD_TYPE = 'application/vnd.in-toto+json';
+async function cli(args) {
+    switch (args[0]) {
+        case 'sign':
+            await sign(args[1]);
+            break;
+        case 'attest':
+            await attest(args[1], args[2]);
+            break;
+        case 'verify':
+            await verify(args[1], args[2]);
+            break;
+        case 'version':
+        case '-version':
+        case '--version':
+        case '-v':
+            // eslint-disable-next-line @typescript-eslint/no-var-requires
+            console.log(require('../../package.json').version);
+            break;
+        case 'help':
+        case '--help':
+        case '-h':
+        case '-?':
+            printUsage();
+            break;
+        default:
+            throw 'Unknown command';
+    }
+}
+function printUsage() {
+    console.log(`sigstore <command> <artifact>
+
+  Usage:
+
+  sigstore sign         sign an artifact
+  sigstore attest       sign an artifact using dsse (Dead Simple Signing Envelope)
+  sigstore verify       verify an artifact
+  sigstore version      print version information
+  sigstore help         print help information
+  `);
+}
+const signOptions = {
+    oidcClientID: 'sigstore',
+    oidcIssuer: 'https://oauth2.sigstore.dev/auth',
+    rekorURL: index_1.sigstore.DEFAULT_REKOR_URL,
+};
+async function sign(artifactPath) {
+    const buffer = fs_1.default.readFileSync(artifactPath);
+    const bundle = await index_1.sigstore.sign(buffer, signOptions);
+    const url = `${signOptions.rekorURL}/api/v1/log/entries`;
+    const logIndex = bundle.verificationMaterial?.tlogEntries[0].logIndex;
+    console.error(`Created entry at index ${logIndex}, available at`);
+    console.error(`${url}?logIndex=${logIndex}`);
+    console.log(JSON.stringify(bundle));
+}
+async function attest(artifactPath, payloadType = INTOTO_PAYLOAD_TYPE) {
+    const buffer = fs_1.default.readFileSync(artifactPath);
+    const bundle = await index_1.sigstore.attest(buffer, payloadType, signOptions);
+    console.log(JSON.stringify(bundle));
+}
+async function verify(bundlePath, artifactPath) {
+    let payload = undefined;
+    if (artifactPath) {
+        payload = fs_1.default.readFileSync(artifactPath);
+    }
+    const bundleFile = fs_1.default.readFileSync(bundlePath);
+    const bundle = JSON.parse(bundleFile.toString('utf-8'));
+    try {
+        await index_1.sigstore.verify(bundle, payload, {});
+        console.error('Verified OK');
+    }
+    catch (e) {
+        console.error('Verification failed');
+        if (e instanceof Error) {
+            console.error('Error: ' + e.message);
+        }
+        process.exit(1);
+    }
+}
+async function processArgv() {
+    try {
+        await cli(process.argv.slice(2));
+        process.exit(0);
+    }
+    catch (e) {
+        console.error(e);
+        process.exit(1);
+    }
+}
+exports.processArgv = processArgv;

package/.config/npm/node_global/lib/node_modules/npm/node_modules/sigstore/dist/client/error.d.ts

@@ -0,0 +1,10 @@
+import fetch from 'make-fetch-happen';
+type Response = Awaited<ReturnType<typeof fetch>>;
+export declare class HTTPError extends Error {
+    response: Response;
+    statusCode: number;
+    location?: string;
+    constructor(response: Response);
+}
+export declare const checkStatus: (response: Response) => Response;
+export {};