usertrust 1.4.0 → 2.0.0

package/dist/audit/rekor-verify.js

@@ -0,0 +1,533 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 Usertools, Inc.
+/**
+ * Rekor Transparency-Log Receipt Verification — Zero-dependency standalone
+ *
+ * INTENTIONAL DUPLICATION: this file exists byte-for-byte in BOTH
+ * packages/verify/src/rekor-verify.ts and
+ * packages/core/src/audit/rekor-verify.ts — here even the import paths match,
+ * since the module's only sibling import is anchor-verify.js. The parity test
+ * pins the two together; any change must land in both packages.
+ *
+ * A receipt is EVIDENCE SUPPLIED BY THE PARTY UNDER AUDIT: it proves nothing on
+ * its own, and every field in it is attacker-shaped. What verification
+ * establishes, end to end, is a single chain of bindings:
+ *
+ *   our signed anchor record -> the bytes the log stored -> that entry's
+ *   position in a tree -> a checkpoint over that tree -> a log key the AUDITOR
+ *   pinned (never one the receipt names).
+ *
+ * Break any link and the receipt is worthless, so each is checked in order and
+ * the first failure is fatal (fail-closed). Rekor data deliberately lives in
+ * SEPARATE receipt files: the anchor record schema is frozen, and a
+ * transparency log must never become a field inside the thing it witnesses.
+ *
+ * Offline scope: a verified receipt proves the entry was included in the log
+ * under a pinned key. WHEN it was included is a separate, weaker claim:
+ * `integratedTime` is covered by no signature of its own, so it counts as
+ * attested only when the log's signed entry timestamp (SET) over it verifies
+ * under the same pinned keyring — otherwise the receipt proves inclusion and
+ * says nothing about time. Neither claim proves the log's current head is
+ * consistent with that checkpoint; that needs a witness/consistency query,
+ * which stays out of the zero-dependency verifier by design.
+ */
+import { createHash } from "node:crypto";
+import { anchorPayloadHash, publicKeyFromPem, verifySignatureRaw, } from "./anchor-verify.js";
+// ── Constants ──
+/**
+ * The rekor.sigstore.dev v1 log key, as served by
+ * https://rekor.sigstore.dev/api/v1/log/publicKey — ECDSA P-256, SPKI sha256
+ * c0d23d6ad406973f9559f3ba2d1ca01f84147d8ffc5b8445c224f98b9591801d (the log's
+ * published logID). This is DATA, not a dependency, and it is not a blanket
+ * trust root: it is consulted ONLY for receipts whose log URL host IS
+ * rekor.sigstore.dev. Any other log must be pinned by the operator with
+ * --rekor-pubkey.
+ */
+export const REKOR_PROD_PUBKEY_PEM = `-----BEGIN PUBLIC KEY-----
+MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE2G2Y+2tabdTV5BcGiBIx0a9fAFwr
+kBbmLSGtks4L3qX6yYY0zufBnhC8Ur/iy55GhWP/9A/bY2LhC30M9+RYtw==
+-----END PUBLIC KEY-----
+`;
+/** The one host the embedded key above is allowed to speak for. */
+const REKOR_PROD_HOST = "rekor.sigstore.dev";
+const ERR = "rekor-receipt-invalid";
+// Caps on untrusted input. A receipt is a small artifact; anything near these
+// bounds is an attempt to make the verifier do work, not to prove inclusion.
+const MAX_RECEIPT_BYTES = 256 * 1024;
+const MAX_ENTRY_BODY_BYTES = 64 * 1024;
+const MAX_CHECKPOINT_BYTES = 8 * 1024;
+const MAX_INCLUSION_PATH = 64;
+const MAX_PEM_BYTES = 16 * 1024;
+const MAX_SET_BYTES = 1024;
+/**
+ * Exclusive upper bound on integratedTime, in SECONDS: `* 1000` must stay
+ * inside the ±8.64e15 ms ECMAScript Date range, or every downstream
+ * `new Date(ms).toISOString()` throws RangeError on attacker-chosen input.
+ */
+const MAX_INTEGRATED_TIME = 8_640_000_000_000;
+const HEX64 = /^[0-9a-f]{64}$/;
+const BASE64 = /^[A-Za-z0-9+/]*={0,2}$/;
+const UINT = /^(0|[1-9][0-9]*)$/;
+// Matching control characters is the entire point here — they are what gets
+// removed from anything echoed back to a terminal.
+// biome-ignore lint/suspicious/noControlCharactersInRegex: stripping them is the intent
+const CONTROL_CHARS = /[\x00-\x1f\x7f]/g;
+const LEAF_PREFIX = Buffer.from([0x00]);
+const NODE_PREFIX = Buffer.from([0x01]);
+const RECEIPT_KEYS = new Set(["v", "vaultId", "anchorSeq", "artifactHash", "entryBody", "log"]);
+const LOG_KEYS = new Set([
+    "url",
+    "logIndex",
+    "treeSize",
+    "rootHash",
+    "hashes",
+    "checkpoint",
+    "integratedTime",
+    "signedEntryTimestamp",
+    "logID",
+]);
+// ── Small helpers ──
+/**
+ * Untrusted values are never echoed whole into an error string. Control
+ * characters are stripped BEFORE truncation, because these strings are printed
+ * to a terminal: an escape sequence or a bare CR inside a field name would let
+ * the party under audit repaint the line its own verdict is printed on, and
+ * truncating first would leave a half-consumed escape behind.
+ */
+function clip(value) {
+    const scrubbed = value.replace(CONTROL_CHARS, "");
+    return scrubbed.length <= 80 ? scrubbed : `${scrubbed.slice(0, 80)}...`;
+}
+function asObject(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value)
+        ? value
+        : null;
+}
+function isSafeIntAtLeast(value, min) {
+    return typeof value === "number" && Number.isSafeInteger(value) && value >= min;
+}
+/** Lowercased host (INCLUDING port) of an http(s) URL, or null. */
+function logHost(url) {
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return null;
+    }
+    if (parsed.protocol !== "https:" && parsed.protocol !== "http:")
+        return null;
+    return parsed.host.toLowerCase();
+}
+function nodeHash(left, right) {
+    return createHash("sha256").update(NODE_PREFIX).update(left).update(right).digest();
+}
+/**
+ * Sorted-key JSON of a FLAT object of strings and safe integers — the exact
+ * bytes a Rekor SET is computed over. Over this charset (base64, lowercase hex,
+ * integers) it is byte-identical to RFC 8785 JCS; a general JCS implementation
+ * would buy nothing here and cost the verifier its zero-dependency property.
+ */
+function sortedKeyStringify(value) {
+    const fields = Object.keys(value)
+        .sort()
+        .map((key) => `${JSON.stringify(key)}:${JSON.stringify(value[key])}`);
+    return `{${fields.join(",")}}`;
+}
+// ── Signed notes (checkpoints) ──
+/**
+ * Parse a signed note:
+ *   <origin>\n<treeSize>\n<base64 rootHash>\n\n— <keyname> <base64 sig>\n...
+ * Strictly LF-only and strictly this shape — a note is a signed artifact, so
+ * accepting variants would mean verifying a signature over bytes we did not
+ * actually parse. The signature payload is `4-byte keyhint || DER signature`;
+ * the hint identifies which key the log used and is ADVISORY only, because the
+ * auditor pins the key out-of-band. Only its 4 bytes are skipped.
+ *
+ * ONE OR MORE signature lines are accepted: a production checkpoint is signed by
+ * the log and co-signed by its witnesses, and every line must still be
+ * well-formed. Which of them (if any) speaks for the auditor is decided later,
+ * against the pinned keyring — never here.
+ */
+export function parseSignedNote(note) {
+    if (note.length === 0 || Buffer.byteLength(note, "utf8") > MAX_CHECKPOINT_BYTES)
+        return null;
+    if (note.includes("\r"))
+        return null;
+    const lines = note.split("\n");
+    if (lines.length > 5 && lines[lines.length - 1] === "")
+        lines.pop();
+    if (lines.length < 5)
+        return null;
+    const origin = lines[0];
+    const sizeLine = lines[1];
+    const rootB64 = lines[2];
+    if (origin.length === 0 || lines[3] !== "")
+        return null;
+    if (!UINT.test(sizeLine))
+        return null;
+    const treeSize = Number(sizeLine);
+    if (!Number.isSafeInteger(treeSize))
+        return null;
+    if (!BASE64.test(rootB64))
+        return null;
+    const root = Buffer.from(rootB64, "base64");
+    if (root.length !== 32)
+        return null;
+    const sigs = [];
+    for (const line of lines.slice(4)) {
+        const parts = line.split(" ");
+        if (parts.length !== 3 || parts[0] !== "—" || parts[1].length === 0)
+            return null;
+        const sigField = parts[2];
+        if (!BASE64.test(sigField))
+            return null;
+        const raw = Buffer.from(sigField, "base64");
+        if (raw.length <= 4)
+            return null;
+        sigs.push(raw.subarray(4));
+    }
+    return {
+        origin,
+        treeSize,
+        rootHashHex: root.toString("hex"),
+        body: `${origin}\n${sizeLine}\n${rootB64}\n`,
+        sigs,
+    };
+}
+/**
+ * Does a checkpoint's signed origin name the host the receipt says it came from?
+ * A production Rekor checkpoint's origin is `"<host> - <treeID>"`, while the
+ * signed-note format also permits the bare host; both identify the same log, so
+ * only the part before the first " - " is compared. The comparison stays exact
+ * on that part — a suffix rule would let evil.example.org.attacker.net pass.
+ */
+function originNamesHost(origin, host) {
+    const separator = origin.indexOf(" - ");
+    const named = separator === -1 ? origin : origin.slice(0, separator);
+    return named.toLowerCase() === host;
+}
+// ── RFC 9162 inclusion ──
+/**
+ * RFC 9162 §2.1.3.2 inclusion verification: walk the audit path from the leaf
+ * to the root, deciding sibling order from the leaf index rather than from any
+ * hint the proof supplies. `fn`/`sn` track the leaf's and the last leaf's
+ * positions within the current subtree; the right-shift after a left-sibling
+ * merge is what makes right-edge (incomplete) subtrees come out correct.
+ *
+ * Never throws: malformed hex, out-of-range indices, and over-long paths are
+ * rejections, because this runs on attacker-supplied input.
+ */
+export function verifyIndexInclusion(leafHex, index, treeSize, pathHex, rootHex) {
+    if (!Number.isSafeInteger(index) || !Number.isSafeInteger(treeSize))
+        return false;
+    if (index < 0 || treeSize < 1 || index >= treeSize)
+        return false;
+    if (!HEX64.test(leafHex) || !HEX64.test(rootHex))
+        return false;
+    if (pathHex.length > MAX_INCLUSION_PATH)
+        return false;
+    let fn = index;
+    let sn = treeSize - 1;
+    let r = Buffer.from(leafHex, "hex");
+    for (const pHex of pathHex) {
+        if (!HEX64.test(pHex))
+            return false;
+        if (sn === 0)
+            return false;
+        const p = Buffer.from(pHex, "hex");
+        if (fn % 2 === 1 || fn === sn) {
+            r = nodeHash(p, r);
+            // LSB(fn) not set (the fn === sn right-edge case): shift both equally
+            // until LSB(fn) is set or fn is 0.
+            while (fn % 2 === 0 && fn !== 0) {
+                fn = Math.floor(fn / 2);
+                sn = Math.floor(sn / 2);
+            }
+        }
+        else {
+            r = nodeHash(r, p);
+        }
+        fn = Math.floor(fn / 2);
+        sn = Math.floor(sn / 2);
+    }
+    return sn === 0 && r.toString("hex") === rootHex;
+}
+// ── Strict receipt parsing ──
+/**
+ * Strict parse of one receipt. Unknown fields, wrong types, and range
+ * violations are all rejected before any crypto runs — the same fail-closed
+ * posture as parseAnchorRecord, for the same reason: a field the verifier
+ * silently ignores is a field an attacker can use.
+ */
+export function parseRekorReceipt(raw) {
+    const bad = (message) => ({
+        receipt: null,
+        error: `${ERR}: ${message}`,
+    });
+    if (Buffer.byteLength(raw, "utf8") > MAX_RECEIPT_BYTES)
+        return bad("receipt exceeds 256 KiB");
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return bad("not valid JSON");
+    }
+    const obj = asObject(parsed);
+    if (obj === null)
+        return bad("not an object");
+    for (const key of Object.keys(obj)) {
+        if (!RECEIPT_KEYS.has(key))
+            return bad(`unknown field "${clip(key)}"`);
+    }
+    if (obj.v !== 1)
+        return bad("unsupported version");
+    if (typeof obj.vaultId !== "string" || obj.vaultId.length === 0)
+        return bad("missing vaultId");
+    if (!isSafeIntAtLeast(obj.anchorSeq, 1)) {
+        return bad("anchorSeq must be a safe integer >= 1");
+    }
+    if (typeof obj.artifactHash !== "string" || !HEX64.test(obj.artifactHash)) {
+        return bad("artifactHash must be 64 lowercase hex characters");
+    }
+    if (typeof obj.entryBody !== "string" || obj.entryBody.length === 0) {
+        return bad("missing entryBody");
+    }
+    if (!BASE64.test(obj.entryBody))
+        return bad("entryBody must be base64");
+    if (Buffer.from(obj.entryBody, "base64").length > MAX_ENTRY_BODY_BYTES) {
+        return bad("entryBody exceeds 64 KiB decoded");
+    }
+    const log = asObject(obj.log);
+    if (log === null)
+        return bad("log must be an object");
+    for (const key of Object.keys(log)) {
+        if (!LOG_KEYS.has(key))
+            return bad(`unknown log field "${clip(key)}"`);
+    }
+    if (typeof log.url !== "string" || logHost(log.url) === null) {
+        return bad("log.url must be an http(s) URL");
+    }
+    if (!isSafeIntAtLeast(log.logIndex, 0))
+        return bad("log.logIndex must be a safe integer >= 0");
+    if (!isSafeIntAtLeast(log.treeSize, 1))
+        return bad("log.treeSize must be a safe integer >= 1");
+    if (log.logIndex >= log.treeSize)
+        return bad("log.logIndex must be < log.treeSize");
+    if (typeof log.rootHash !== "string" || !HEX64.test(log.rootHash)) {
+        return bad("log.rootHash must be 64 lowercase hex characters");
+    }
+    if (!Array.isArray(log.hashes) || log.hashes.length > MAX_INCLUSION_PATH) {
+        return bad(`log.hashes must be an array of at most ${MAX_INCLUSION_PATH} hashes`);
+    }
+    for (const h of log.hashes) {
+        if (typeof h !== "string" || !HEX64.test(h)) {
+            return bad("log.hashes entries must be 64 lowercase hex characters");
+        }
+    }
+    if (typeof log.checkpoint !== "string" ||
+        log.checkpoint.length === 0 ||
+        Buffer.byteLength(log.checkpoint, "utf8") > MAX_CHECKPOINT_BYTES) {
+        return bad("log.checkpoint must be a non-empty string of at most 8 KiB");
+    }
+    // Bounded in SECONDS so `integratedTime * 1000` cannot leave the Date range
+    // and turn a printed verdict into a RangeError on attacker-chosen input.
+    if (!isSafeIntAtLeast(log.integratedTime, 1) || log.integratedTime >= MAX_INTEGRATED_TIME) {
+        return bad(`log.integratedTime must be a safe integer > 0 and < ${MAX_INTEGRATED_TIME}`);
+    }
+    if (log.logID !== undefined && (typeof log.logID !== "string" || !HEX64.test(log.logID))) {
+        return bad("log.logID must be 64 lowercase hex characters");
+    }
+    if (log.signedEntryTimestamp !== undefined) {
+        if (typeof log.signedEntryTimestamp !== "string" ||
+            log.signedEntryTimestamp.length === 0 ||
+            !BASE64.test(log.signedEntryTimestamp) ||
+            Buffer.byteLength(log.signedEntryTimestamp, "utf8") > MAX_SET_BYTES) {
+            return bad("log.signedEntryTimestamp must be base64 of at most 1 KiB");
+        }
+        // The logID is part of the payload the SET signs, so a SET without one
+        // is unverifiable by construction — and unverifiable supplied evidence
+        // is a rejection, never a receipt that quietly proves less than it looks.
+        if (log.logID === undefined) {
+            return bad("log.signedEntryTimestamp requires log.logID");
+        }
+    }
+    return { receipt: obj, error: null };
+}
+// ── Entry binding ──
+/**
+ * The logged entry must commit to OUR artifact AND OUR signature. Without the
+ * signature binding, anyone could log the (public) payload hash of someone
+ * else's anchor and present the resulting receipt as their own.
+ */
+function checkHashedRekordEntry(entryBytes, artifactHash, recordSigBase64) {
+    if (entryBytes.length === 0)
+        return "entryBody decodes to no bytes";
+    if (entryBytes.length > MAX_ENTRY_BODY_BYTES)
+        return "entryBody exceeds 64 KiB decoded";
+    let parsed;
+    try {
+        parsed = JSON.parse(entryBytes.toString("utf8"));
+    }
+    catch {
+        return "entryBody is not valid JSON";
+    }
+    const entry = asObject(parsed);
+    if (entry === null)
+        return "entryBody is not a JSON object";
+    if (entry.kind !== "hashedrekord")
+        return "entryBody kind is not hashedrekord";
+    const spec = asObject(entry.spec);
+    if (spec === null)
+        return "entryBody spec is missing";
+    const hash = asObject(asObject(spec.data)?.hash);
+    if (hash === null)
+        return "entryBody spec.data.hash is missing";
+    if (hash.algorithm !== "sha256")
+        return "entryBody spec.data.hash.algorithm is not sha256";
+    if (hash.value !== artifactHash) {
+        return "entryBody spec.data.hash.value does not match the receipt artifactHash";
+    }
+    const signature = asObject(spec.signature);
+    if (signature === null || typeof signature.content !== "string") {
+        return "entryBody spec.signature.content is missing";
+    }
+    // Compare DECODED bytes: base64 spelling is not canonical, so string
+    // equality would reject honest receipts and is not what "same signature"
+    // means.
+    const logged = Buffer.from(signature.content, "base64");
+    const ours = Buffer.from(recordSigBase64, "base64");
+    if (ours.length === 0 || !logged.equals(ours)) {
+        return "entryBody spec.signature.content is not the anchor record signature";
+    }
+    return null;
+}
+/**
+ * Which key(s) may speak for this log. Supplying no key is only meaningful for
+ * the one log whose key ships with the verifier; for anything else, an unpinned
+ * receipt would be self-certifying, so it is refused rather than trusted.
+ *
+ * A caller who supplied material that ALL got discarded (empty file, oversized
+ * blob) is not a caller who supplied nothing: silently falling back to the
+ * embedded key there would verify a rekor.sigstore.dev receipt under a key the
+ * auditor never chose, and pass a merge gate the auditor thought they had
+ * pinned. Discarded-everything is refused instead.
+ */
+function resolveLogKeyring(host, logPubkeysPem) {
+    const supplied = logPubkeysPem.filter((pem) => pem.length > 0 && Buffer.byteLength(pem, "utf8") <= MAX_PEM_BYTES);
+    if (supplied.length > 0)
+        return { keys: supplied, error: null };
+    if (logPubkeysPem.length > 0) {
+        return {
+            keys: [],
+            error: "supplied --rekor-pubkey material is empty or invalid — refusing to fall back to the embedded key",
+        };
+    }
+    if (host === REKOR_PROD_HOST)
+        return { keys: [REKOR_PROD_PUBKEY_PEM], error: null };
+    return {
+        keys: [],
+        error: `custom log requires --rekor-pubkey (no pinned key for log host ${clip(host)})`,
+    };
+}
+// ── Receipt verification ──
+/**
+ * Verify one receipt against the anchor record it claims to witness, under a
+ * caller-pinned keyring (any key in the ring may verify the checkpoint).
+ *
+ * The order below is the binding chain, and it is deliberate: cheap identity
+ * and hash checks first, then the entry decode, then the inclusion walk, and
+ * only then the signatures — so a receipt for the wrong record can never cost
+ * an ECDSA verification, and a failure always names the earliest broken link.
+ * `ok` is the INCLUSION verdict; `attestedTimeMs` is the strictly weaker time
+ * claim, and only a verifying signed entry timestamp produces it.
+ */
+export function verifyRekorReceipt(receipt, record, logPubkeysPem) {
+    const errors = [];
+    const fail = (message) => {
+        errors.push(`${ERR}: ${message}`);
+        return { ok: false, attestedTimeMs: null, errors };
+    };
+    // 1 — the receipt must name THIS record.
+    if (receipt.vaultId !== record.vaultId || receipt.anchorSeq !== record.anchorSeq) {
+        return fail(`record mismatch: receipt claims vault ${clip(receipt.vaultId)} anchorSeq ${receipt.anchorSeq}`);
+    }
+    // 2 — and must carry that record's signing-payload hash.
+    const payloadHash = anchorPayloadHash(record);
+    if (receipt.artifactHash !== payloadHash) {
+        return fail("artifactHash is not the anchor payload hash of this record");
+    }
+    // 3 — the bytes the log stored must commit to the artifact and our signature.
+    const entryBytes = Buffer.from(receipt.entryBody, "base64");
+    const entryError = checkHashedRekordEntry(entryBytes, payloadHash, record.sig);
+    if (entryError !== null)
+        return fail(entryError);
+    // 4/5 — sha256(0x00 || stored bytes) must sit at logIndex under log.rootHash.
+    const leafHex = createHash("sha256").update(LEAF_PREFIX).update(entryBytes).digest("hex");
+    if (!verifyIndexInclusion(leafHex, receipt.log.logIndex, receipt.log.treeSize, receipt.log.hashes, receipt.log.rootHash)) {
+        return fail(`inclusion proof does not reconstruct log.rootHash from logIndex ${receipt.log.logIndex} of ${receipt.log.treeSize}`);
+    }
+    // 6 — the checkpoint must be this log's, at this size, over this root.
+    const host = logHost(receipt.log.url);
+    if (host === null)
+        return fail("log.url is not an http(s) URL");
+    const note = parseSignedNote(receipt.log.checkpoint);
+    if (note === null)
+        return fail("log.checkpoint is not a parseable signed note");
+    if (!originNamesHost(note.origin, host)) {
+        return fail(`log.checkpoint origin ${clip(note.origin)} is not the log.url host ${clip(host)}`);
+    }
+    if (note.treeSize !== receipt.log.treeSize) {
+        return fail(`log.checkpoint treeSize ${note.treeSize} does not match log.treeSize ${receipt.log.treeSize}`);
+    }
+    if (note.rootHashHex !== receipt.log.rootHash) {
+        return fail("log.checkpoint root hash does not match log.rootHash");
+    }
+    // 7 — and must be signed by a key the AUDITOR pinned. A co-signed checkpoint
+    // carries one signature per witness, and the auditor pins only the parties
+    // they trust: ONE line verifying under ONE pinned key is the whole claim.
+    const keyring = resolveLogKeyring(host, logPubkeysPem);
+    if (keyring.error !== null)
+        return fail(keyring.error);
+    const sigsBase64 = note.sigs.map((sig) => sig.toString("base64"));
+    const signed = keyring.keys.some((pem) => {
+        const key = publicKeyFromPem(pem);
+        if (key === null)
+            return false;
+        return sigsBase64.some((sig) => verifySignatureRaw("ecdsa-p256", note.body, key, sig));
+    });
+    if (!signed) {
+        return fail("log.checkpoint signature does not verify under any pinned log public key");
+    }
+    // 8 — inclusion holds. TIME is a separate claim: the checkpoint signs the
+    // tree, not when this entry entered it, so integratedTime is worth exactly
+    // as much as the signed entry timestamp over it. No SET (or no logID to
+    // build its payload from) means an honest "included, time unknown" — the
+    // caller then falls back to the operator-claimed timestamp knowing it is
+    // operator-claimed. A SET that is PRESENT and does not verify is different
+    // in kind: supplied evidence that fails is a forgery attempt, not an
+    // absence, so it fails the whole receipt closed.
+    const set = receipt.log.signedEntryTimestamp;
+    const logID = receipt.log.logID;
+    if (set === undefined || logID === undefined) {
+        return { ok: true, attestedTimeMs: null, errors };
+    }
+    const setPayload = sortedKeyStringify({
+        body: receipt.entryBody,
+        integratedTime: receipt.log.integratedTime,
+        logID,
+        logIndex: receipt.log.logIndex,
+    });
+    const setSigned = keyring.keys.some((pem) => {
+        const key = publicKeyFromPem(pem);
+        if (key === null)
+            return false;
+        return verifySignatureRaw("ecdsa-p256", setPayload, key, set);
+    });
+    if (!setSigned)
+        return fail("signedEntryTimestamp does not verify");
+    // 9 — every link held AND the log signed the time, so it is witness-attested.
+    return { ok: true, attestedTimeMs: receipt.log.integratedTime * 1000, errors };
+}
+//# sourceMappingURL=rekor-verify.js.map

package/dist/audit/rekor-verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rekor-verify.js","sourceRoot":"","sources":["../../src/audit/rekor-verify.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAEN,iBAAiB,EACjB,gBAAgB,EAChB,kBAAkB,GAClB,MAAM,oBAAoB,CAAC;AA+D5B,kBAAkB;AAElB;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG;;;;CAIpC,CAAC;AAEF,mEAAmE;AACnE,MAAM,eAAe,GAAG,oBAAoB,CAAC;AAE7C,MAAM,GAAG,GAAG,uBAAuB,CAAC;AAEpC,8EAA8E;AAC9E,6EAA6E;AAC7E,MAAM,iBAAiB,GAAG,GAAG,GAAG,IAAI,CAAC;AACrC,MAAM,oBAAoB,GAAG,EAAE,GAAG,IAAI,CAAC;AACvC,MAAM,oBAAoB,GAAG,CAAC,GAAG,IAAI,CAAC;AACtC,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAC9B,MAAM,aAAa,GAAG,EAAE,GAAG,IAAI,CAAC;AAChC,MAAM,aAAa,GAAG,IAAI,CAAC;AAC3B;;;;GAIG;AACH,MAAM,mBAAmB,GAAG,iBAAiB,CAAC;AAE9C,MAAM,KAAK,GAAG,gBAAgB,CAAC;AAC/B,MAAM,MAAM,GAAG,wBAAwB,CAAC;AACxC,MAAM,IAAI,GAAG,mBAAmB,CAAC;AACjC,4EAA4E;AAC5E,mDAAmD;AACnD,wFAAwF;AACxF,MAAM,aAAa,GAAG,kBAAkB,CAAC;AAEzC,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AACxC,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AAExC,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,SAAS,EAAE,WAAW,EAAE,cAAc,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC;AAChG,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC;IACxB,KAAK;IACL,UAAU;IACV,UAAU;IACV,UAAU;IACV,QAAQ;IACR,YAAY;IACZ,gBAAgB;IAChB,sBAAsB;IACtB,OAAO;CACP,CAAC,CAAC;AAEH,sBAAsB;AAEtB;;;;;;GAMG;AACH,SAAS,IAAI,CAAC,KAAa;IAC1B,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;IAClD,OAAO,QAAQ,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC;AACzE,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAC1E,CAAC,CAAE,KAAiC;QACpC,CAAC,CAAC,IAAI,CAAC;AACT,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc,EAAE,GAAW;IACpD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,GAAG,CAAC;AACjF,CAAC;AAED,mEAAmE;AACnE,SAAS,OAAO,CAAC,GAAW;IAC3B,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACJ,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC;IACb,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAC7E,OAAO,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;AAClC,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,KAAa;IAC5C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;AACrF,CAAC;AAED;;;;;GAKG;AACH,SAAS,kBAAkB,CAAC,KAAsC;IACjE,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;SAC/B,IAAI,EAAE;SACN,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;IACvE,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;AAChC,CAAC;AAED,mCAAmC;AAEnC;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY;IAC3C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,oBAAoB;QAAE,OAAO,IAAI,CAAC;IAC7F,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE;QAAE,KAAK,CAAC,GAAG,EAAE,CAAC;IACpE,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAW,CAAC;IAClC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAW,CAAC;IACpC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAW,CAAC;IACnC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACxD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;IAClC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACjD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC5C,IAAI,IAAI,CAAC,MAAM,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,IAAK,KAAK,CAAC,CAAC,CAAY,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7F,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAW,CAAC;QACpC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QACxC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC5C,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACjC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5B,CAAC;IACD,OAAO;QACN,MAAM;QACN,QAAQ;QACR,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QACjC,IAAI,EAAE,GAAG,MAAM,KAAK,QAAQ,KAAK,OAAO,IAAI;QAC5C,IAAI;KACJ,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,MAAc,EAAE,IAAY;IACpD,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IACrE,OAAO,KAAK,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC;AACrC,CAAC;AAED,2BAA2B;AAE3B;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CACnC,OAAe,EACf,KAAa,EACb,QAAgB,EAChB,OAA0B,EAC1B,OAAe;IAEf,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAClF,IAAI,KAAK,GAAG,CAAC,IAAI,QAAQ,GAAG,CAAC,IAAI,KAAK,IAAI,QAAQ;QAAE,OAAO,KAAK,CAAC;IACjE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/D,IAAI,OAAO,CAAC,MAAM,GAAG,kBAAkB;QAAE,OAAO,KAAK,CAAC;IAEtD,IAAI,EAAE,GAAG,KAAK,CAAC;IACf,IAAI,EAAE,GAAG,QAAQ,GAAG,CAAC,CAAC;IACtB,IAAI,CAAC,GAAW,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC5C,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QACpC,IAAI,EAAE,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAC3B,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACnC,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YAC/B,CAAC,GAAG,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACnB,sEAAsE;YACtE,mCAAmC;YACnC,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;gBACjC,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;gBACxB,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;YACzB,CAAC;QACF,CAAC;aAAM,CAAC;YACP,CAAC,GAAG,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACpB,CAAC;QACD,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QACxB,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,OAAO,CAAC;AAClD,CAAC;AAED,+BAA+B;AAE/B;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAI5C,MAAM,GAAG,GAAG,CAAC,OAAe,EAAoC,EAAE,CAAC,CAAC;QACnE,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,GAAG,GAAG,KAAK,OAAO,EAAE;KAC3B,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,iBAAiB;QAAE,OAAO,GAAG,CAAC,yBAAyB,CAAC,CAAC;IAC9F,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC9B,CAAC;IACD,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC7B,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,GAAG,CAAC,eAAe,CAAC,CAAC;IAC9C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACpC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,GAAG,CAAC,kBAAkB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC;QAAE,OAAO,GAAG,CAAC,qBAAqB,CAAC,CAAC;IACnD,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAC/F,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,CAAC;QACzC,OAAO,GAAG,CAAC,uCAAuC,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;QAC3E,OAAO,GAAG,CAAC,kDAAkD,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,IAAI,GAAG,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrE,OAAO,GAAG,CAAC,mBAAmB,CAAC,CAAC;IACjC,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC;QAAE,OAAO,GAAG,CAAC,0BAA0B,CAAC,CAAC;IACxE,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,MAAM,GAAG,oBAAoB,EAAE,CAAC;QACxE,OAAO,GAAG,CAAC,kCAAkC,CAAC,CAAC;IAChD,CAAC;IAED,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,GAAG,CAAC,uBAAuB,CAAC,CAAC;IACtD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACpC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,GAAG,CAAC,sBAAsB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;QAC9D,OAAO,GAAG,CAAC,gCAAgC,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;QAAE,OAAO,GAAG,CAAC,0CAA0C,CAAC,CAAC;IAC/F,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;QAAE,OAAO,GAAG,CAAC,0CAA0C,CAAC,CAAC;IAC/F,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ;QAAE,OAAO,GAAG,CAAC,qCAAqC,CAAC,CAAC;IACpF,IAAI,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnE,OAAO,GAAG,CAAC,kDAAkD,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,kBAAkB,EAAE,CAAC;QAC1E,OAAO,GAAG,CAAC,0CAA0C,kBAAkB,SAAS,CAAC,CAAC;IACnF,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;QAC5B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7C,OAAO,GAAG,CAAC,wDAAwD,CAAC,CAAC;QACtE,CAAC;IACF,CAAC;IACD,IACC,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ;QAClC,GAAG,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;QAC3B,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,GAAG,oBAAoB,EAC/D,CAAC;QACF,OAAO,GAAG,CAAC,4DAA4D,CAAC,CAAC;IAC1E,CAAC;IACD,4EAA4E;IAC5E,yEAAyE;IACzE,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,cAAc,IAAI,mBAAmB,EAAE,CAAC;QAC3F,OAAO,GAAG,CAAC,uDAAuD,mBAAmB,EAAE,CAAC,CAAC;IAC1F,CAAC;IACD,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAC1F,OAAO,GAAG,CAAC,+CAA+C,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,GAAG,CAAC,oBAAoB,KAAK,SAAS,EAAE,CAAC;QAC5C,IACC,OAAO,GAAG,CAAC,oBAAoB,KAAK,QAAQ;YAC5C,GAAG,CAAC,oBAAoB,CAAC,MAAM,KAAK,CAAC;YACrC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,oBAAoB,CAAC;YACtC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,oBAAoB,EAAE,MAAM,CAAC,GAAG,aAAa,EAClE,CAAC;YACF,OAAO,GAAG,CAAC,0DAA0D,CAAC,CAAC;QACxE,CAAC;QACD,uEAAuE;QACvE,uEAAuE;QACvE,0EAA0E;QAC1E,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,GAAG,CAAC,6CAA6C,CAAC,CAAC;QAC3D,CAAC;IACF,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,GAA8B,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACjE,CAAC;AAED,sBAAsB;AAEtB;;;;GAIG;AACH,SAAS,sBAAsB,CAC9B,UAAkB,EAClB,YAAoB,EACpB,eAAuB;IAEvB,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,+BAA+B,CAAC;IACpE,IAAI,UAAU,CAAC,MAAM,GAAG,oBAAoB;QAAE,OAAO,kCAAkC,CAAC;IACxF,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,6BAA6B,CAAC;IACtC,CAAC;IACD,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC/B,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,gCAAgC,CAAC;IAC5D,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc;QAAE,OAAO,oCAAoC,CAAC;IAC/E,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,2BAA2B,CAAC;IACtD,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;IACjD,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,qCAAqC,CAAC;IAChE,IAAI,IAAI,CAAC,SAAS,KAAK,QAAQ;QAAE,OAAO,kDAAkD,CAAC;IAC3F,IAAI,IAAI,CAAC,KAAK,KAAK,YAAY,EAAE,CAAC;QACjC,OAAO,wEAAwE,CAAC;IACjF,CAAC;IACD,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC3C,IAAI,SAAS,KAAK,IAAI,IAAI,OAAO,SAAS,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QACjE,OAAO,6CAA6C,CAAC;IACtD,CAAC;IACD,qEAAqE;IACrE,yEAAyE;IACzE,SAAS;IACT,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACxD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;IACpD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/C,OAAO,qEAAqE,CAAC;IAC9E,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,iBAAiB,CACzB,IAAY,EACZ,aAAgC;IAEhC,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CACpC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,aAAa,CAC1E,CAAC;IACF,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAChE,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,OAAO;YACN,IAAI,EAAE,EAAE;YACR,KAAK,EACJ,kGAAkG;SACnG,CAAC;IACH,CAAC;IACD,IAAI,IAAI,KAAK,eAAe;QAAE,OAAO,EAAE,IAAI,EAAE,CAAC,qBAAqB,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACpF,OAAO;QACN,IAAI,EAAE,EAAE;QACR,KAAK,EAAE,kEAAkE,IAAI,CAAC,IAAI,CAAC,GAAG;KACtF,CAAC;AACH,CAAC;AAED,6BAA6B;AAE7B;;;;;;;;;;GAUG;AACH,MAAM,UAAU,kBAAkB,CACjC,OAAqB,EACrB,MAAoB,EACpB,aAAgC;IAEhC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,IAAI,GAAG,CAAC,OAAe,EAAqB,EAAE;QACnD,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,KAAK,OAAO,EAAE,CAAC,CAAC;QAClC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACpD,CAAC,CAAC;IAEF,yCAAyC;IACzC,IAAI,OAAO,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO,IAAI,OAAO,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;QAClF,OAAO,IAAI,CACV,yCAAyC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,OAAO,CAAC,SAAS,EAAE,CAC/F,CAAC;IACH,CAAC;IAED,yDAAyD;IACzD,MAAM,WAAW,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC9C,IAAI,OAAO,CAAC,YAAY,KAAK,WAAW,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC,4DAA4D,CAAC,CAAC;IAC3E,CAAC;IAED,8EAA8E;IAC9E,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAC5D,MAAM,UAAU,GAAG,sBAAsB,CAAC,UAAU,EAAE,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;IAC/E,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC,UAAU,CAAC,CAAC;IAEjD,8EAA8E;IAC9E,MAAM,OAAO,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1F,IACC,CAAC,oBAAoB,CACpB,OAAO,EACP,OAAO,CAAC,GAAG,CAAC,QAAQ,EACpB,OAAO,CAAC,GAAG,CAAC,QAAQ,EACpB,OAAO,CAAC,GAAG,CAAC,MAAM,EAClB,OAAO,CAAC,GAAG,CAAC,QAAQ,CACpB,EACA,CAAC;QACF,OAAO,IAAI,CACV,mEAAmE,OAAO,CAAC,GAAG,CAAC,QAAQ,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,CACpH,CAAC;IACH,CAAC;IAED,uEAAuE;IACvE,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC,+BAA+B,CAAC,CAAC;IAChE,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACrD,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC,+CAA+C,CAAC,CAAC;IAChF,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;QACzC,OAAO,IAAI,CAAC,yBAAyB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,4BAA4B,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjG,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC5C,OAAO,IAAI,CACV,2BAA2B,IAAI,CAAC,QAAQ,gCAAgC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,CAC9F,CAAC;IACH,CAAC;IACD,IAAI,IAAI,CAAC,WAAW,KAAK,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC/C,OAAO,IAAI,CAAC,sDAAsD,CAAC,CAAC;IACrE,CAAC;IAED,6EAA6E;IAC7E,2EAA2E;IAC3E,0EAA0E;IAC1E,MAAM,OAAO,GAAG,iBAAiB,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IACvD,IAAI,OAAO,CAAC,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACvD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;IAClE,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;QACxC,MAAM,GAAG,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QAC/B,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,kBAAkB,CAAC,YAAY,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IACxF,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,EAAE,CAAC;QACb,OAAO,IAAI,CAAC,0EAA0E,CAAC,CAAC;IACzF,CAAC;IAED,0EAA0E;IAC1E,2EAA2E;IAC3E,wEAAwE;IACxE,yEAAyE;IACzE,yEAAyE;IACzE,2EAA2E;IAC3E,qEAAqE;IACrE,iDAAiD;IACjD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;IAC7C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC;IAChC,IAAI,GAAG,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QAC9C,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACnD,CAAC;IACD,MAAM,UAAU,GAAG,kBAAkB,CAAC;QACrC,IAAI,EAAE,OAAO,CAAC,SAAS;QACvB,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc;QAC1C,KAAK;QACL,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ;KAC9B,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;QAC3C,MAAM,GAAG,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QAC/B,OAAO,kBAAkB,CAAC,YAAY,EAAE,UAAU,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC,sCAAsC,CAAC,CAAC;IAEpE,8EAA8E;IAC9E,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc,GAAG,IAAI,EAAE,MAAM,EAAE,CAAC;AAChF,CAAC"}

package/dist/audit/rekor.d.ts

@@ -0,0 +1,71 @@
+import { type AnchorSink } from "./anchor.js";
+import { type AnchorRecord } from "./anchor-verify.js";
+export declare const DEFAULT_REKOR_URL = "https://rekor.sigstore.dev";
+/**
+ * Injectable HTTP transport — the sinks' only impure edge. Structurally
+ * identical to anchor-doctor's, so a caller may share one transport across
+ * both without either module importing the other.
+ */
+export type HttpTransport = (opts: {
+    method: string;
+    url: string;
+    headers: Record<string, string>;
+    body: Buffer;
+}) => Promise<{
+    status: number;
+    body: string;
+    headers?: Record<string, string>;
+}>;
+export interface S3SinkConfig {
+    bucket: string;
+    region: string;
+    prefix?: string;
+    endpoint?: string;
+}
+/**
+ * Endpoint rule for BOTH sinks. Plaintext is refused off-loopback: for S3,
+ * SigV4 authenticates the request but does not encrypt it, so an http endpoint
+ * on the network would put the credential-bearing headers on the wire; for
+ * Rekor, an http log URL lets anyone on the path answer for the witness — and
+ * a sink that accepts a forged 201 files forged evidence. Loopback is allowed
+ * for dev MinIO/LocalStack and local log instances.
+ */
+export declare function parseEndpoint(endpoint: string, sinkName?: string): URL;
+/**
+ * PUT one canonical record per object, keyed by vault and anchorSeq. Immutability
+ * is the STORE's job (Object Lock retention / a deny-delete bucket policy);
+ * `usertrust anchor doctor` reports whether this identity's permissions match
+ * that intent.
+ */
+export declare function s3Sink(cfg: S3SinkConfig, transport?: HttpTransport): AnchorSink;
+/**
+ * The hashedrekord entry we PROPOSE for a record: the anchor payload hash as the
+ * artifact, the record's Ed25519 signature, and the vault's public key. The log
+ * stores its own serialization of this; the receipt carries the log's bytes, so
+ * these are the bytes we sign nothing over and merely offer.
+ */
+export declare function buildHashedRekordEntry(record: AnchorRecord, publicKeySpkiBase64: string): string;
+/**
+ * `<seq12>.<8 hex of sha256(log url)>.json` — one receipt per (anchor, LOG).
+ * Keying by anchorSeq alone made two rekor sinks silently overwrite each
+ * other's evidence: the second witness's receipt replaced the first's, and the
+ * operator ended up with fewer independent attestations than they configured.
+ * Readers glob `*.json` in this directory, so pre-existing `<seq12>.json`
+ * receipts keep being found.
+ */
+export declare function rekorReceiptPath(rootDir: string, anchorSeq: number, logUrl: string): string;
+/**
+ * Publish a record's payload hash to a Rekor transparency log and persist the
+ * inclusion receipt next to the mirror.
+ *
+ * A 409 means the log already holds an entry for this proposal, which happens
+ * on exactly one honest path: a crash between writing the receipt and clearing
+ * the outbox, so the emitter redelivers a record that IS already witnessed.
+ * That case is resolved from the receipt we already hold — never from the 409
+ * itself, which carries no evidence. A 409 with no such receipt is a duplicate
+ * we cannot account for, and fabricating one from a Location header would mean
+ * filing evidence about bytes we never saw (delta D1), so it rejects and the
+ * outbox keeps the record for a human.
+ */
+export declare function rekorSink(rootDir: string, url?: string, transport?: HttpTransport): AnchorSink;
+//# sourceMappingURL=rekor.d.ts.map

package/dist/audit/rekor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rekor.d.ts","sourceRoot":"","sources":["../../src/audit/rekor.ts"],"names":[],"mappings":"AA2CA,OAAO,EAAuB,KAAK,UAAU,EAAkC,MAAM,aAAa,CAAC;AACnG,OAAO,EAAE,KAAK,YAAY,EAAqB,MAAM,oBAAoB,CAAC;AAK1E,eAAO,MAAM,iBAAiB,+BAA+B,CAAC;AAe9D;;;;GAIG;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,IAAI,EAAE;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,EAAE,MAAM,CAAC;CACb,KAAK,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,CAAC,CAAC;AAElF,MAAM,WAAW,YAAY;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;CAClB;AAwCD;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,SAAY,GAAG,GAAG,CAczE;AAyBD;;;;;GAKG;AACH,wBAAgB,MAAM,CAAC,GAAG,EAAE,YAAY,EAAE,SAAS,GAAE,aAA6B,GAAG,UAAU,CA0C9F;AAkBD;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,GAAG,MAAM,CAchG;AA4ID;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAG3F;AA8GD;;;;;;;;;;;;GAYG;AACH,wBAAgB,SAAS,CACxB,OAAO,EAAE,MAAM,EACf,GAAG,GAAE,MAA0B,EAC/B,SAAS,GAAE,aAA6B,GACtC,UAAU,CAwEZ"}