warbeast2000 0.0.1-security → 1.0.3

package/the_app/node_modules/warbeast2000/the_app/node_modules/npm/node_modules/sigstore/dist/util/stream.js

@@ -0,0 +1,116 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ByteStream = exports.StreamError = void 0;
+/*
+Copyright 2023 The Sigstore Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+class StreamError extends Error {
+}
+exports.StreamError = StreamError;
+class ByteStream {
+    constructor(buffer) {
+        this.start = 0;
+        if (buffer) {
+            this.buf = buffer;
+            this.view = Buffer.from(buffer);
+        }
+        else {
+            this.buf = new ArrayBuffer(0);
+            this.view = Buffer.from(this.buf);
+        }
+    }
+    get buffer() {
+        return this.view.subarray(0, this.start);
+    }
+    get length() {
+        return this.view.byteLength;
+    }
+    get position() {
+        return this.start;
+    }
+    seek(position) {
+        this.start = position;
+    }
+    // Returns a Buffer containing the specified number of bytes starting at the
+    // given start position.
+    slice(start, len) {
+        const end = start + len;
+        if (end > this.length) {
+            throw new StreamError('request past end of buffer');
+        }
+        return this.view.subarray(start, end);
+    }
+    appendChar(char) {
+        this.ensureCapacity(1);
+        this.view[this.start] = char;
+        this.start += 1;
+    }
+    appendUint16(num) {
+        this.ensureCapacity(2);
+        const value = new Uint16Array([num]);
+        const view = new Uint8Array(value.buffer);
+        this.view[this.start] = view[1];
+        this.view[this.start + 1] = view[0];
+        this.start += 2;
+    }
+    appendUint24(num) {
+        this.ensureCapacity(3);
+        const value = new Uint32Array([num]);
+        const view = new Uint8Array(value.buffer);
+        this.view[this.start] = view[2];
+        this.view[this.start + 1] = view[1];
+        this.view[this.start + 2] = view[0];
+        this.start += 3;
+    }
+    appendView(view) {
+        this.ensureCapacity(view.length);
+        this.view.set(view, this.start);
+        this.start += view.length;
+    }
+    getBlock(size) {
+        if (size <= 0) {
+            return Buffer.alloc(0);
+        }
+        if (this.start + size > this.view.length) {
+            throw new Error('request past end of buffer');
+        }
+        const result = this.view.subarray(this.start, this.start + size);
+        this.start += size;
+        return result;
+    }
+    getUint8() {
+        return this.getBlock(1)[0];
+    }
+    getUint16() {
+        const block = this.getBlock(2);
+        return (block[0] << 8) | block[1];
+    }
+    ensureCapacity(size) {
+        if (this.start + size > this.view.byteLength) {
+            const blockSize = ByteStream.BLOCK_SIZE + (size > ByteStream.BLOCK_SIZE ? size : 0);
+            this.realloc(this.view.byteLength + blockSize);
+        }
+    }
+    realloc(size) {
+        const newArray = new ArrayBuffer(size);
+        const newView = Buffer.from(newArray);
+        // Copy the old buffer into the new one
+        newView.set(this.view);
+        this.buf = newArray;
+        this.view = newView;
+    }
+}
+exports.ByteStream = ByteStream;
+ByteStream.BLOCK_SIZE = 1024;

package/the_app/node_modules/warbeast2000/the_app/node_modules/npm/node_modules/sigstore/dist/verify.js

@@ -0,0 +1,160 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Verifier = void 0;
+/*
+Copyright 2023 The Sigstore Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+const bundle_1 = require("@sigstore/bundle");
+const ca = __importStar(require("./ca/verify"));
+const error_1 = require("./error");
+const tlog = __importStar(require("./tlog/verify"));
+const sigstore = __importStar(require("./types/sigstore"));
+const util_1 = require("./util");
+class Verifier {
+    constructor(trustedRoot, keySelector) {
+        this.trustedRoot = trustedRoot;
+        this.keySelector = keySelector || (() => undefined);
+    }
+    // Verifies the bundle signature, the bundle's certificate chain (if present)
+    // and the bundle's transparency log entries.
+    verify(bundle, options, data) {
+        this.verifyArtifactSignature(bundle, data);
+        if ((0, bundle_1.isBundleWithCertificateChain)(bundle)) {
+            this.verifySigningCertificate(bundle, options);
+        }
+        if (options.tlogOptions.disable === false) {
+            this.verifyTLogEntries(bundle, options);
+        }
+    }
+    // Performs bundle signature verification. Determines the type of the bundle
+    // content and delegates to the appropriate signature verification function.
+    verifyArtifactSignature(bundle, data) {
+        const publicKey = this.getPublicKey(bundle);
+        switch (bundle.content?.$case) {
+            case 'messageSignature':
+                if (!data) {
+                    throw new error_1.VerificationError('no data provided for message signature verification');
+                }
+                verifyMessageSignature(data, bundle.content.messageSignature, publicKey);
+                break;
+            case 'dsseEnvelope':
+                verifyDSSESignature(bundle.content.dsseEnvelope, publicKey);
+                break;
+        }
+    }
+    // Performs verification of the bundle's certificate chain. The bundle must
+    // contain a certificate chain and the options must contain the required
+    // options for CA verification.
+    // TODO: We've temporarily removed the requirement that the options contain
+    // the list of trusted signer identities. This will be added back in a future
+    // release.
+    verifySigningCertificate(bundle, options) {
+        if (!sigstore.isCAVerificationOptions(options)) {
+            throw new error_1.VerificationError('no trusted certificates provided for verification');
+        }
+        ca.verifySigningCertificate(bundle, this.trustedRoot, options);
+    }
+    // Performs verification of the bundle's transparency log entries. The bundle
+    // must contain a list of transparency log entries.
+    verifyTLogEntries(bundle, options) {
+        tlog.verifyTLogEntries(bundle, this.trustedRoot, options.tlogOptions);
+    }
+    // Returns the public key which will be used to verify the bundle signature.
+    // The public key is selected based on the verification material in the bundle
+    // and the options provided.
+    getPublicKey(bundle) {
+        // Select the key which will be used to verify the signature
+        switch (bundle.verificationMaterial?.content?.$case) {
+            // If the bundle contains a certificate chain, the public key is the
+            // first certificate in the chain (the signing certificate)
+            case 'x509CertificateChain':
+                return getPublicKeyFromCertificateChain(bundle.verificationMaterial.content.x509CertificateChain);
+            // If the bundle contains a public key hint, the public key is selected
+            // from the list of trusted keys in the options
+            case 'publicKey':
+                return getPublicKeyFromHint(bundle.verificationMaterial.content.publicKey, this.keySelector);
+        }
+    }
+}
+exports.Verifier = Verifier;
+// Retrieves the public key from the first certificate in the certificate chain
+function getPublicKeyFromCertificateChain(certificateChain) {
+    const cert = util_1.pem.fromDER(certificateChain.certificates[0].rawBytes);
+    return util_1.crypto.createPublicKey(cert);
+}
+// Retrieves the public key through the key selector callback, passing the
+// public key hint from the bundle
+function getPublicKeyFromHint(publicKeyID, keySelector) {
+    const key = keySelector(publicKeyID.hint);
+    if (!key) {
+        throw new error_1.VerificationError('no public key found for signature verification');
+    }
+    try {
+        return util_1.crypto.createPublicKey(key);
+    }
+    catch (e) {
+        throw new error_1.VerificationError('invalid public key');
+    }
+}
+// Performs signature verification for bundle containing a message signature.
+// Verifies that the digest and signature found in the bundle match the
+// provided data.
+function verifyMessageSignature(data, messageSignature, publicKey) {
+    // Extract signature for message
+    const { signature, messageDigest } = messageSignature;
+    const calculatedDigest = util_1.crypto.hash(data);
+    if (!calculatedDigest.equals(messageDigest.digest)) {
+        throw new error_1.VerificationError('message digest verification failed');
+    }
+    if (!util_1.crypto.verifyBlob(data, publicKey, signature)) {
+        throw new error_1.VerificationError('artifact signature verification failed');
+    }
+}
+// Performs signature verification for bundle containing a DSSE envelope.
+// Calculates the PAE for the DSSE envelope and verifies it against the
+// signature in the envelope.
+function verifyDSSESignature(envelope, publicKey) {
+    // Construct payload over which the signature was originally created
+    const { payloadType, payload } = envelope;
+    const data = util_1.dsse.preAuthEncoding(payloadType, payload);
+    // Only support a single signature in DSSE
+    const signature = envelope.signatures[0].sig;
+    if (!util_1.crypto.verifyBlob(data, publicKey, signature)) {
+        throw new error_1.VerificationError('artifact signature verification failed');
+    }
+}

package/the_app/node_modules/warbeast2000/the_app/node_modules/npm/node_modules/sigstore/dist/x509/cert.js

@@ -0,0 +1,242 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.x509Certificate = void 0;
+const util_1 = require("../util");
+const asn1_1 = require("../util/asn1");
+const stream_1 = require("../util/stream");
+const ext_1 = require("./ext");
+const EXTENSION_OID_SUBJECT_KEY_ID = '2.5.29.14';
+const EXTENSION_OID_KEY_USAGE = '2.5.29.15';
+const EXTENSION_OID_SUBJECT_ALT_NAME = '2.5.29.17';
+const EXTENSION_OID_BASIC_CONSTRAINTS = '2.5.29.19';
+const EXTENSION_OID_AUTHORITY_KEY_ID = '2.5.29.35';
+const EXTENSION_OID_SCT = '1.3.6.1.4.1.11129.2.4.2';
+// List of recognized critical extensions
+// https://www.rfc-editor.org/rfc/rfc5280#section-4.2
+const RECOGNIZED_EXTENSIONS = [
+    EXTENSION_OID_KEY_USAGE,
+    EXTENSION_OID_BASIC_CONSTRAINTS,
+    EXTENSION_OID_SUBJECT_ALT_NAME,
+];
+const ECDSA_SIGNATURE_ALGOS = {
+    '1.2.840.10045.4.3.1': 'sha224',
+    '1.2.840.10045.4.3.2': 'sha256',
+    '1.2.840.10045.4.3.3': 'sha384',
+    '1.2.840.10045.4.3.4': 'sha512',
+};
+class x509Certificate {
+    constructor(asn1) {
+        this.root = asn1;
+        if (!this.checkRecognizedExtensions()) {
+            throw new Error('Certificate contains unrecognized critical extensions');
+        }
+    }
+    static parse(cert) {
+        const der = typeof cert === 'string' ? util_1.pem.toDER(cert) : cert;
+        const asn1 = asn1_1.ASN1Obj.parseBuffer(der);
+        return new x509Certificate(asn1);
+    }
+    get tbsCertificate() {
+        return this.tbsCertificateObj;
+    }
+    get version() {
+        // version number is the first element of the version context specific tag
+        const ver = this.versionObj.subs[0].toInteger();
+        return `v${(ver + BigInt(1)).toString()}`;
+    }
+    get notBefore() {
+        // notBefore is the first element of the validity sequence
+        return this.validityObj.subs[0].toDate();
+    }
+    get notAfter() {
+        // notAfter is the second element of the validity sequence
+        return this.validityObj.subs[1].toDate();
+    }
+    get issuer() {
+        return this.issuerObj.value;
+    }
+    get subject() {
+        return this.subjectObj.value;
+    }
+    get publicKey() {
+        return this.subjectPublicKeyInfoObj.toDER();
+    }
+    get signatureAlgorithm() {
+        const oid = this.signatureAlgorithmObj.subs[0].toOID();
+        return ECDSA_SIGNATURE_ALGOS[oid];
+    }
+    get signatureValue() {
+        // Signature value is a bit string, so we need to skip the first byte
+        return this.signatureValueObj.value.subarray(1);
+    }
+    get extensions() {
+        // The extension list is the first (and only) element of the extensions
+        // context specific tag
+        const extSeq = this.extensionsObj?.subs[0];
+        return extSeq?.subs || [];
+    }
+    get extKeyUsage() {
+        const ext = this.findExtension(EXTENSION_OID_KEY_USAGE);
+        return ext ? new ext_1.x509KeyUsageExtension(ext) : undefined;
+    }
+    get extBasicConstraints() {
+        const ext = this.findExtension(EXTENSION_OID_BASIC_CONSTRAINTS);
+        return ext ? new ext_1.x509BasicConstraintsExtension(ext) : undefined;
+    }
+    get extSubjectAltName() {
+        const ext = this.findExtension(EXTENSION_OID_SUBJECT_ALT_NAME);
+        return ext ? new ext_1.x509SubjectAlternativeNameExtension(ext) : undefined;
+    }
+    get extAuthorityKeyID() {
+        const ext = this.findExtension(EXTENSION_OID_AUTHORITY_KEY_ID);
+        return ext ? new ext_1.x509AuthorityKeyIDExtension(ext) : undefined;
+    }
+    get extSubjectKeyID() {
+        const ext = this.findExtension(EXTENSION_OID_SUBJECT_KEY_ID);
+        return ext ? new ext_1.x509SubjectKeyIDExtension(ext) : undefined;
+    }
+    get extSCT() {
+        const ext = this.findExtension(EXTENSION_OID_SCT);
+        return ext ? new ext_1.x509SCTExtension(ext) : undefined;
+    }
+    get isCA() {
+        const ca = this.extBasicConstraints?.isCA || false;
+        // If the KeyUsage extension is present, keyCertSign must be set
+        if (this.extKeyUsage) {
+            ca && this.extKeyUsage.keyCertSign;
+        }
+        return ca;
+    }
+    extension(oid) {
+        const ext = this.findExtension(oid);
+        return ext ? new ext_1.x509Extension(ext) : undefined;
+    }
+    verify(issuerCertificate) {
+        // Use the issuer's public key if provided, otherwise use the subject's
+        const publicKey = issuerCertificate?.publicKey || this.publicKey;
+        const key = util_1.crypto.createPublicKey(publicKey);
+        return util_1.crypto.verifyBlob(this.tbsCertificate.toDER(), key, this.signatureValue, this.signatureAlgorithm);
+    }
+    validForDate(date) {
+        return this.notBefore <= date && date <= this.notAfter;
+    }
+    equals(other) {
+        return this.root.toDER().equals(other.root.toDER());
+    }
+    verifySCTs(issuer, logs) {
+        let extSCT;
+        // Verifying the SCT requires that we remove the SCT extension and
+        // re-encode the TBS structure to DER -- this value is part of the data
+        // over which the signature is calculated. Since this is a destructive action
+        // we create a copy of the certificate so we can remove the SCT extension
+        // without affecting the original certificate.
+        const clone = this.clone();
+        // Intentionally not using the findExtension method here because we want to
+        // remove the the SCT extension from the certificate before calculating the
+        // PreCert structure
+        for (let i = 0; i < clone.extensions.length; i++) {
+            const ext = clone.extensions[i];
+            if (ext.subs[0].toOID() === EXTENSION_OID_SCT) {
+                extSCT = new ext_1.x509SCTExtension(ext);
+                // Remove the extension from the certificate
+                clone.extensions.splice(i, 1);
+                break;
+            }
+        }
+        if (!extSCT) {
+            throw new Error('Certificate does not contain SCT extension');
+        }
+        if (extSCT?.signedCertificateTimestamps?.length === 0) {
+            throw new Error('Certificate does not contain any SCTs');
+        }
+        // Construct the PreCert structure
+        // https://www.rfc-editor.org/rfc/rfc6962#section-3.2
+        const preCert = new stream_1.ByteStream();
+        // Calculate hash of the issuer's public key
+        const issuerId = util_1.crypto.hash(issuer.publicKey);
+        preCert.appendView(issuerId);
+        // Re-encodes the certificate to DER after removing the SCT extension
+        const tbs = clone.tbsCertificate.toDER();
+        preCert.appendUint24(tbs.length);
+        preCert.appendView(tbs);
+        // Calculate and return the verification results for each SCT
+        return extSCT.signedCertificateTimestamps.map((sct) => ({
+            logID: sct.logID,
+            verified: sct.verify(preCert.buffer, logs),
+        }));
+    }
+    // Creates a copy of the certificate with a new buffer
+    clone() {
+        const der = this.root.toDER();
+        const clone = Buffer.alloc(der.length);
+        der.copy(clone);
+        return x509Certificate.parse(clone);
+    }
+    findExtension(oid) {
+        // Find the extension with the given OID. The OID will always be the first
+        // element of the extension sequence
+        return this.extensions.find((ext) => ext.subs[0].toOID() === oid);
+    }
+    // A certificate should be considered invalid if it contains critical
+    // extensions that are not recognized
+    checkRecognizedExtensions() {
+        // The extension list is the first (and only) element of the extensions
+        // context specific tag
+        const extSeq = this.extensionsObj?.subs[0];
+        const exts = extSeq?.subs.map((ext) => new ext_1.x509Extension(ext));
+        // Check for unrecognized critical extensions
+        return (!exts ||
+            exts.every((ext) => !ext.critical || RECOGNIZED_EXTENSIONS.includes(ext.oid)));
+    }
+    /////////////////////////////////////////////////////////////////////////////
+    // The following properties use the documented x509 structure to locate the
+    // desired ASN.1 object
+    // https://www.rfc-editor.org/rfc/rfc5280#section-4.1
+    // https://www.rfc-editor.org/rfc/rfc5280#section-4.1.1.1
+    get tbsCertificateObj() {
+        // tbsCertificate is the first element of the certificate sequence
+        return this.root.subs[0];
+    }
+    // https://www.rfc-editor.org/rfc/rfc5280#section-4.1.1.2
+    get signatureAlgorithmObj() {
+        // signatureAlgorithm is the second element of the certificate sequence
+        return this.root.subs[1];
+    }
+    // https://www.rfc-editor.org/rfc/rfc5280#section-4.1.1.3
+    get signatureValueObj() {
+        // signatureValue is the third element of the certificate sequence
+        return this.root.subs[2];
+    }
+    // https://www.rfc-editor.org/rfc/rfc5280#section-4.1.2.1
+    get versionObj() {
+        // version is the first element of the tbsCertificate sequence
+        return this.tbsCertificateObj.subs[0];
+    }
+    // https://www.rfc-editor.org/rfc/rfc5280#section-4.1.2.4
+    get issuerObj() {
+        // issuer is the fourth element of the tbsCertificate sequence
+        return this.tbsCertificateObj.subs[3];
+    }
+    // https://www.rfc-editor.org/rfc/rfc5280#section-4.1.2.5
+    get validityObj() {
+        // version is the fifth element of the tbsCertificate sequence
+        return this.tbsCertificateObj.subs[4];
+    }
+    // https://www.rfc-editor.org/rfc/rfc5280#section-4.1.2.6
+    get subjectObj() {
+        // subject is the sixth element of the tbsCertificate sequence
+        return this.tbsCertificateObj.subs[5];
+    }
+    // https://www.rfc-editor.org/rfc/rfc5280#section-4.1.2.7
+    get subjectPublicKeyInfoObj() {
+        // subjectPublicKeyInfo is the seventh element of the tbsCertificate sequence
+        return this.tbsCertificateObj.subs[6];
+    }
+    // Extensions can't be located by index because their position varies. Instead,
+    // we need to find the extensions context specific tag
+    // https://www.rfc-editor.org/rfc/rfc5280#section-4.1.2.9
+    get extensionsObj() {
+        return this.tbsCertificateObj.subs.find((sub) => sub.tag.isContextSpecific(0x03));
+    }
+}
+exports.x509Certificate = x509Certificate;

package/the_app/node_modules/warbeast2000/the_app/node_modules/npm/node_modules/sigstore/dist/x509/ext.js

@@ -0,0 +1,145 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.x509SCTExtension = exports.x509SubjectKeyIDExtension = exports.x509AuthorityKeyIDExtension = exports.x509SubjectAlternativeNameExtension = exports.x509KeyUsageExtension = exports.x509BasicConstraintsExtension = exports.x509Extension = void 0;
+const stream_1 = require("../util/stream");
+const sct_1 = require("./sct");
+// https://www.rfc-editor.org/rfc/rfc5280#section-4.1
+class x509Extension {
+    constructor(asn1) {
+        this.root = asn1;
+    }
+    get oid() {
+        return this.root.subs[0].toOID();
+    }
+    get critical() {
+        // The critical field is optional and will be the second element of the
+        // extension sequence if present. Default to false if not present.
+        return this.root.subs.length === 3 ? this.root.subs[1].toBoolean() : false;
+    }
+    get value() {
+        return this.extnValueObj.value;
+    }
+    get valueObj() {
+        return this.extnValueObj;
+    }
+    get extnValueObj() {
+        // The extnValue field will be the last element of the extension sequence
+        return this.root.subs[this.root.subs.length - 1];
+    }
+}
+exports.x509Extension = x509Extension;
+// https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.9
+class x509BasicConstraintsExtension extends x509Extension {
+    get isCA() {
+        return this.sequence.subs[0].toBoolean();
+    }
+    get pathLenConstraint() {
+        return this.sequence.subs.length > 1
+            ? this.sequence.subs[1].toInteger()
+            : undefined;
+    }
+    // The extnValue field contains a single sequence wrapping the isCA and
+    // pathLenConstraint.
+    get sequence() {
+        return this.extnValueObj.subs[0];
+    }
+}
+exports.x509BasicConstraintsExtension = x509BasicConstraintsExtension;
+// https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.3
+class x509KeyUsageExtension extends x509Extension {
+    get digitalSignature() {
+        return this.bitString[0] === 1;
+    }
+    get keyCertSign() {
+        return this.bitString[5] === 1;
+    }
+    get crlSign() {
+        return this.bitString[6] === 1;
+    }
+    // The extnValue field contains a single bit string which is a bit mask
+    // indicating which key usages are enabled.
+    get bitString() {
+        return this.extnValueObj.subs[0].toBitString();
+    }
+}
+exports.x509KeyUsageExtension = x509KeyUsageExtension;
+// https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.6
+class x509SubjectAlternativeNameExtension extends x509Extension {
+    get rfc822Name() {
+        return this.findGeneralName(0x01)?.value.toString('ascii');
+    }
+    get uri() {
+        return this.findGeneralName(0x06)?.value.toString('ascii');
+    }
+    // Retrieve the value of an otherName with the given OID.
+    otherName(oid) {
+        const otherName = this.findGeneralName(0x00);
+        if (otherName === undefined) {
+            return undefined;
+        }
+        // The otherName is a sequence containing an OID and a value.
+        // Need to check that the OID matches the one we're looking for.
+        const otherNameOID = otherName.subs[0].toOID();
+        if (otherNameOID !== oid) {
+            return undefined;
+        }
+        // The otherNameValue is a sequence containing the actual value.
+        const otherNameValue = otherName.subs[1];
+        return otherNameValue.subs[0].value.toString('ascii');
+    }
+    findGeneralName(tag) {
+        return this.generalNames.find((gn) => gn.tag.isContextSpecific(tag));
+    }
+    // The extnValue field contains a sequence of GeneralNames.
+    get generalNames() {
+        return this.extnValueObj.subs[0].subs;
+    }
+}
+exports.x509SubjectAlternativeNameExtension = x509SubjectAlternativeNameExtension;
+// https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.1
+class x509AuthorityKeyIDExtension extends x509Extension {
+    get keyIdentifier() {
+        return this.findSequenceMember(0x00)?.value;
+    }
+    findSequenceMember(tag) {
+        return this.sequence.subs.find((el) => el.tag.isContextSpecific(tag));
+    }
+    // The extnValue field contains a single sequence wrapping the keyIdentifier
+    get sequence() {
+        return this.extnValueObj.subs[0];
+    }
+}
+exports.x509AuthorityKeyIDExtension = x509AuthorityKeyIDExtension;
+// https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.2
+class x509SubjectKeyIDExtension extends x509Extension {
+    get keyIdentifier() {
+        return this.extnValueObj.subs[0].value;
+    }
+}
+exports.x509SubjectKeyIDExtension = x509SubjectKeyIDExtension;
+// https://www.rfc-editor.org/rfc/rfc6962#section-3.3
+class x509SCTExtension extends x509Extension {
+    constructor(asn1) {
+        super(asn1);
+    }
+    get signedCertificateTimestamps() {
+        const buf = this.extnValueObj.subs[0].value;
+        const stream = new stream_1.ByteStream(buf);
+        // The overall list length is encoded in the first two bytes -- note this
+        // is the length of the list in bytes, NOT the number of SCTs in the list
+        const end = stream.getUint16() + 2;
+        const sctList = [];
+        while (stream.position < end) {
+            // Read the length of the next SCT
+            const sctLength = stream.getUint16();
+            // Slice out the bytes for the next SCT and parse it
+            const sct = stream.getBlock(sctLength);
+            sctList.push(sct_1.SignedCertificateTimestamp.parse(sct));
+        }
+        if (stream.position !== end) {
+            throw new Error('SCT list length does not match actual length');
+        }
+        return sctList;
+    }
+}
+exports.x509SCTExtension = x509SCTExtension;