Skip to content

Commit c18a0ad

Browse files
wraithgarwraithgar
committed
1 parent fd4153b commit c18a0ad

File tree

17 files changed

+147
-68
lines changed

17 files changed

+147
-68
lines changed

‎node_modules/@sigstore/bundle/dist/build.js

+20-8
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,9 @@ const bundle_1 = require("./bundle");
2121
// Message signature bundle - $case: 'messageSignature'
2222
function toMessageSignatureBundle(options) {
2323
return {
24-
mediaType: bundle_1.BUNDLE_V02_MEDIA_TYPE,
24+
mediaType: options.singleCertificate
25+
? bundle_1.BUNDLE_V03_MEDIA_TYPE
26+
: bundle_1.BUNDLE_V02_MEDIA_TYPE,
2527
content: {
2628
$case: 'messageSignature',
2729
messageSignature: {
@@ -39,7 +41,9 @@ exports.toMessageSignatureBundle = toMessageSignatureBundle;
3941
// DSSE envelope bundle - $case: 'dsseEnvelope'
4042
function toDSSEBundle(options) {
4143
return {
42-
mediaType: bundle_1.BUNDLE_V02_MEDIA_TYPE,
44+
mediaType: options.singleCertificate
45+
? bundle_1.BUNDLE_V03_MEDIA_TYPE
46+
: bundle_1.BUNDLE_V02_MEDIA_TYPE,
4347
content: {
4448
$case: 'dsseEnvelope',
4549
dsseEnvelope: toEnvelope(options),
@@ -71,12 +75,20 @@ function toVerificationMaterial(options) {
7175
}
7276
function toKeyContent(options) {
7377
if (options.certificate) {
74-
return {
75-
$case: 'x509CertificateChain',
76-
x509CertificateChain: {
77-
certificates: [{ rawBytes: options.certificate }],
78-
},
79-
};
78+
if (options.singleCertificate) {
79+
return {
80+
$case: 'certificate',
81+
certificate: { rawBytes: options.certificate },
82+
};
83+
}
84+
else {
85+
return {
86+
$case: 'x509CertificateChain',
87+
x509CertificateChain: {
88+
certificates: [{ rawBytes: options.certificate }],
89+
},
90+
};
91+
}
8092
}
8193
else {
8294
return {

‎node_modules/@sigstore/bundle/dist/bundle.js

+3-2
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,10 @@
11
"use strict";
22
Object.defineProperty(exports, "__esModule", { value: true });
3-
exports.isBundleWithDsseEnvelope = exports.isBundleWithMessageSignature = exports.isBundleWithPublicKey = exports.isBundleWithCertificateChain = exports.BUNDLE_V03_MEDIA_TYPE = exports.BUNDLE_V02_MEDIA_TYPE = exports.BUNDLE_V01_MEDIA_TYPE = void 0;
3+
exports.isBundleWithDsseEnvelope = exports.isBundleWithMessageSignature = exports.isBundleWithPublicKey = exports.isBundleWithCertificateChain = exports.BUNDLE_V03_MEDIA_TYPE = exports.BUNDLE_V03_LEGACY_MEDIA_TYPE = exports.BUNDLE_V02_MEDIA_TYPE = exports.BUNDLE_V01_MEDIA_TYPE = void 0;
44
exports.BUNDLE_V01_MEDIA_TYPE = 'application/vnd.dev.sigstore.bundle+json;version=0.1';
55
exports.BUNDLE_V02_MEDIA_TYPE = 'application/vnd.dev.sigstore.bundle+json;version=0.2';
6-
exports.BUNDLE_V03_MEDIA_TYPE = 'application/vnd.dev.sigstore.bundle+json;version=0.3';
6+
exports.BUNDLE_V03_LEGACY_MEDIA_TYPE = 'application/vnd.dev.sigstore.bundle+json;version=0.3';
7+
exports.BUNDLE_V03_MEDIA_TYPE = 'application/vnd.dev.sigstore.bundle.v0.3+json';
78
// Type guards for bundle variants.
89
function isBundleWithCertificateChain(b) {
910
return b.verificationMaterial.content.$case === 'x509CertificateChain';

‎node_modules/@sigstore/bundle/dist/index.js

+2-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
"use strict";
22
Object.defineProperty(exports, "__esModule", { value: true });
3-
exports.isBundleV01 = exports.assertBundleV02 = exports.assertBundleV01 = exports.assertBundleLatest = exports.assertBundle = exports.envelopeToJSON = exports.envelopeFromJSON = exports.bundleToJSON = exports.bundleFromJSON = exports.ValidationError = exports.isBundleWithPublicKey = exports.isBundleWithMessageSignature = exports.isBundleWithDsseEnvelope = exports.isBundleWithCertificateChain = exports.BUNDLE_V03_MEDIA_TYPE = exports.BUNDLE_V02_MEDIA_TYPE = exports.BUNDLE_V01_MEDIA_TYPE = exports.toMessageSignatureBundle = exports.toDSSEBundle = void 0;
3+
exports.isBundleV01 = exports.assertBundleV02 = exports.assertBundleV01 = exports.assertBundleLatest = exports.assertBundle = exports.envelopeToJSON = exports.envelopeFromJSON = exports.bundleToJSON = exports.bundleFromJSON = exports.ValidationError = exports.isBundleWithPublicKey = exports.isBundleWithMessageSignature = exports.isBundleWithDsseEnvelope = exports.isBundleWithCertificateChain = exports.BUNDLE_V03_MEDIA_TYPE = exports.BUNDLE_V03_LEGACY_MEDIA_TYPE = exports.BUNDLE_V02_MEDIA_TYPE = exports.BUNDLE_V01_MEDIA_TYPE = exports.toMessageSignatureBundle = exports.toDSSEBundle = void 0;
44
/*
55
Copyright 2023 The Sigstore Authors.
66
@@ -22,6 +22,7 @@ Object.defineProperty(exports, "toMessageSignatureBundle", { enumerable: true, g
2222
var bundle_1 = require("./bundle");
2323
Object.defineProperty(exports, "BUNDLE_V01_MEDIA_TYPE", { enumerable: true, get: function () { return bundle_1.BUNDLE_V01_MEDIA_TYPE; } });
2424
Object.defineProperty(exports, "BUNDLE_V02_MEDIA_TYPE", { enumerable: true, get: function () { return bundle_1.BUNDLE_V02_MEDIA_TYPE; } });
25+
Object.defineProperty(exports, "BUNDLE_V03_LEGACY_MEDIA_TYPE", { enumerable: true, get: function () { return bundle_1.BUNDLE_V03_LEGACY_MEDIA_TYPE; } });
2526
Object.defineProperty(exports, "BUNDLE_V03_MEDIA_TYPE", { enumerable: true, get: function () { return bundle_1.BUNDLE_V03_MEDIA_TYPE; } });
2627
Object.defineProperty(exports, "isBundleWithCertificateChain", { enumerable: true, get: function () { return bundle_1.isBundleWithCertificateChain; } });
2728
Object.defineProperty(exports, "isBundleWithDsseEnvelope", { enumerable: true, get: function () { return bundle_1.isBundleWithDsseEnvelope; } });

‎node_modules/@sigstore/bundle/dist/validate.js

+2-1
Original file line numberDiff line numberDiff line change
@@ -74,7 +74,8 @@ function validateBundleBase(b) {
7474
const invalidValues = [];
7575
// Media type validation
7676
if (b.mediaType === undefined ||
77-
!b.mediaType.startsWith('application/vnd.dev.sigstore.bundle+json;version=')) {
77+
(!b.mediaType.match(/^application\/vnd\.dev\.sigstore\.bundle\+json;version=\d\.\d/) &&
78+
!b.mediaType.match(/^application\/vnd\.dev\.sigstore\.bundle\.v\d\.\d\+json/))) {
7879
invalidValues.push('mediaType');
7980
}
8081
// Content-related validation

‎node_modules/@sigstore/bundle/package.json

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name": "@sigstore/bundle",
3-
"version": "2.2.0",
3+
"version": "2.3.1",
44
"description": "Sigstore bundle type",
55
"main": "dist/index.js",
66
"types": "dist/index.d.ts",
@@ -27,7 +27,7 @@
2727
"provenance": true
2828
},
2929
"dependencies": {
30-
"@sigstore/protobuf-specs": "^0.3.0"
30+
"@sigstore/protobuf-specs": "^0.3.1"
3131
},
3232
"engines": {
3333
"node": "^16.14.0 || >=18.0.0"

‎node_modules/@sigstore/core/dist/crypto.js

+2-2
Original file line numberDiff line numberDiff line change
@@ -21,12 +21,12 @@ limitations under the License.
2121
*/
2222
const crypto_1 = __importDefault(require("crypto"));
2323
const SHA256_ALGORITHM = 'sha256';
24-
function createPublicKey(key) {
24+
function createPublicKey(key, type = 'spki') {
2525
if (typeof key === 'string') {
2626
return crypto_1.default.createPublicKey(key);
2727
}
2828
else {
29-
return crypto_1.default.createPublicKey({ key, format: 'der', type: 'spki' });
29+
return crypto_1.default.createPublicKey({ key, format: 'der', type: type });
3030
}
3131
}
3232
exports.createPublicKey = createPublicKey;

‎node_modules/@sigstore/core/package.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name": "@sigstore/core",
3-
"version": "1.0.0",
3+
"version": "1.1.0",
44
"description": "Base library for Sigstore",
55
"main": "dist/index.js",
66
"types": "dist/index.d.ts",

‎node_modules/@sigstore/protobuf-specs/dist/__generated__/sigstore_trustroot.js

+53-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
"use strict";
22
Object.defineProperty(exports, "__esModule", { value: true });
3-
exports.TrustedRoot = exports.CertificateAuthority = exports.TransparencyLogInstance = void 0;
3+
exports.ClientTrustConfig = exports.SigningConfig = exports.TrustedRoot = exports.CertificateAuthority = exports.TransparencyLogInstance = void 0;
44
/* eslint-disable */
55
const sigstore_common_1 = require("./sigstore_common");
66
function createBaseTransparencyLogInstance() {
@@ -98,6 +98,58 @@ exports.TrustedRoot = {
9898
return obj;
9999
},
100100
};
101+
function createBaseSigningConfig() {
102+
return { caUrl: "", oidcUrl: "", tlogUrls: [], tsaUrls: [] };
103+
}
104+
exports.SigningConfig = {
105+
fromJSON(object) {
106+
return {
107+
caUrl: isSet(object.caUrl) ? String(object.caUrl) : "",
108+
oidcUrl: isSet(object.oidcUrl) ? String(object.oidcUrl) : "",
109+
tlogUrls: Array.isArray(object?.tlogUrls) ? object.tlogUrls.map((e) => String(e)) : [],
110+
tsaUrls: Array.isArray(object?.tsaUrls) ? object.tsaUrls.map((e) => String(e)) : [],
111+
};
112+
},
113+
toJSON(message) {
114+
const obj = {};
115+
message.caUrl !== undefined && (obj.caUrl = message.caUrl);
116+
message.oidcUrl !== undefined && (obj.oidcUrl = message.oidcUrl);
117+
if (message.tlogUrls) {
118+
obj.tlogUrls = message.tlogUrls.map((e) => e);
119+
}
120+
else {
121+
obj.tlogUrls = [];
122+
}
123+
if (message.tsaUrls) {
124+
obj.tsaUrls = message.tsaUrls.map((e) => e);
125+
}
126+
else {
127+
obj.tsaUrls = [];
128+
}
129+
return obj;
130+
},
131+
};
132+
function createBaseClientTrustConfig() {
133+
return { mediaType: "", trustedRoot: undefined, signingConfig: undefined };
134+
}
135+
exports.ClientTrustConfig = {
136+
fromJSON(object) {
137+
return {
138+
mediaType: isSet(object.mediaType) ? String(object.mediaType) : "",
139+
trustedRoot: isSet(object.trustedRoot) ? exports.TrustedRoot.fromJSON(object.trustedRoot) : undefined,
140+
signingConfig: isSet(object.signingConfig) ? exports.SigningConfig.fromJSON(object.signingConfig) : undefined,
141+
};
142+
},
143+
toJSON(message) {
144+
const obj = {};
145+
message.mediaType !== undefined && (obj.mediaType = message.mediaType);
146+
message.trustedRoot !== undefined &&
147+
(obj.trustedRoot = message.trustedRoot ? exports.TrustedRoot.toJSON(message.trustedRoot) : undefined);
148+
message.signingConfig !== undefined &&
149+
(obj.signingConfig = message.signingConfig ? exports.SigningConfig.toJSON(message.signingConfig) : undefined);
150+
return obj;
151+
},
152+
};
101153
function isSet(value) {
102154
return value !== null && value !== undefined;
103155
}

‎node_modules/@sigstore/protobuf-specs/package.json

+3-3
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name": "@sigstore/protobuf-specs",
3-
"version": "0.3.0",
3+
"version": "0.3.1",
44
"description": "code-signing for npm packages",
55
"main": "dist/index.js",
66
"types": "dist/index.d.ts",
@@ -21,11 +21,11 @@
2121
},
2222
"homepage": "https://github.com/sigstore/protobuf-specs#readme",
2323
"devDependencies": {
24-
"@tsconfig/node14": "^1.0.3",
24+
"@tsconfig/node16": "^16.1.1",
2525
"@types/node": "^18.14.0",
2626
"typescript": "^4.9.5"
2727
},
2828
"engines": {
29-
"node": "^14.17.0 || ^16.13.0 || >=18.0.0"
29+
"node": "^16.14.0 || >=18.0.0"
3030
}
3131
}

‎node_modules/@sigstore/sign/dist/bundler/bundle.js

+2-1
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,7 @@ function toMessageSignatureBundle(artifact, signature) {
5656
}
5757
exports.toMessageSignatureBundle = toMessageSignatureBundle;
5858
// DSSE envelope bundle - $case: 'dsseEnvelope'
59-
function toDSSEBundle(artifact, signature) {
59+
function toDSSEBundle(artifact, signature, singleCertificate) {
6060
return sigstore.toDSSEBundle({
6161
artifact: artifact.data,
6262
artifactType: artifact.type,
@@ -65,6 +65,7 @@ function toDSSEBundle(artifact, signature) {
6565
? util_1.pem.toDER(signature.key.certificate)
6666
: undefined,
6767
keyHint: signature.key.$case === 'publicKey' ? signature.key.hint : undefined,
68+
singleCertificate,
6869
});
6970
}
7071
exports.toDSSEBundle = toDSSEBundle;

‎node_modules/@sigstore/sign/dist/bundler/dsse.js

+2-1
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@ const bundle_1 = require("./bundle");
2323
class DSSEBundleBuilder extends base_1.BaseBundleBuilder {
2424
constructor(options) {
2525
super(options);
26+
this.singleCertificate = options.singleCertificate ?? false;
2627
}
2728
// DSSE requires the artifact to be pre-encoded with the payload type
2829
// before the signature is generated.
@@ -32,7 +33,7 @@ class DSSEBundleBuilder extends base_1.BaseBundleBuilder {
3233
}
3334
// Packages the artifact and signature into a DSSE bundle
3435
async package(artifact, signature) {
35-
return (0, bundle_1.toDSSEBundle)(artifactDefaults(artifact), signature);
36+
return (0, bundle_1.toDSSEBundle)(artifactDefaults(artifact), signature, this.singleCertificate);
3637
}
3738
}
3839
exports.DSSEBundleBuilder = DSSEBundleBuilder;

‎node_modules/@sigstore/sign/package.json

+4-4
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name": "@sigstore/sign",
3-
"version": "2.2.3",
3+
"version": "2.3.0",
44
"description": "Sigstore signing library",
55
"main": "dist/index.js",
66
"types": "dist/index.d.ts",
@@ -27,14 +27,14 @@
2727
},
2828
"devDependencies": {
2929
"@sigstore/jest": "^0.0.0",
30-
"@sigstore/mock": "^0.6.5",
30+
"@sigstore/mock": "^0.7.0",
3131
"@sigstore/rekor-types": "^2.0.0",
3232
"@types/make-fetch-happen": "^10.0.4"
3333
},
3434
"dependencies": {
35-
"@sigstore/bundle": "^2.2.0",
35+
"@sigstore/bundle": "^2.3.0",
3636
"@sigstore/core": "^1.0.0",
37-
"@sigstore/protobuf-specs": "^0.3.0",
37+
"@sigstore/protobuf-specs": "^0.3.1",
3838
"make-fetch-happen": "^13.0.0"
3939
},
4040
"engines": {

‎node_modules/@sigstore/verify/dist/tlog/intoto.js

+2-1
Original file line numberDiff line numberDiff line change
@@ -42,11 +42,12 @@ function verifyIntoto002TLogBody(tlogEntry, content) {
4242
// Signature is double-base64-encoded in the tlog entry
4343
const tlogSig = base64Decode(tlogEntry.spec.content.envelope.signatures[0].sig);
4444
// Ensure that the signature in the bundle's DSSE matches tlog entry
45-
if (!content.compareSignature(Buffer.from(tlogSig, 'base64')))
45+
if (!content.compareSignature(Buffer.from(tlogSig, 'base64'))) {
4646
throw new error_1.VerificationError({
4747
code: 'TLOG_BODY_ERROR',
4848
message: 'tlog entry signature mismatch',
4949
});
50+
}
5051
// Ensure the digest of the bundle's DSSE payload matches the digest in the
5152
// tlog entry
5253
const tlogHash = tlogEntry.spec.content.payloadHash?.value || '';

‎node_modules/@sigstore/verify/dist/trust/index.js

+10-1
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ See the License for the specific language governing permissions and
1717
limitations under the License.
1818
*/
1919
const core_1 = require("@sigstore/core");
20+
const protobuf_specs_1 = require("@sigstore/protobuf-specs");
2021
const error_1 = require("../error");
2122
const BEGINNING_OF_TIME = new Date(0);
2223
const END_OF_TIME = new Date(8640000000000000);
@@ -35,9 +36,17 @@ function toTrustMaterial(root, keys) {
3536
}
3637
exports.toTrustMaterial = toTrustMaterial;
3738
function createTLogAuthority(tlogInstance) {
39+
const keyDetails = tlogInstance.publicKey.keyDetails;
40+
const keyType = keyDetails === protobuf_specs_1.PublicKeyDetails.PKCS1_RSA_PKCS1V5 ||
41+
keyDetails === protobuf_specs_1.PublicKeyDetails.PKIX_RSA_PKCS1V5 ||
42+
keyDetails === protobuf_specs_1.PublicKeyDetails.PKIX_RSA_PKCS1V15_2048_SHA256 ||
43+
keyDetails === protobuf_specs_1.PublicKeyDetails.PKIX_RSA_PKCS1V15_3072_SHA256 ||
44+
keyDetails === protobuf_specs_1.PublicKeyDetails.PKIX_RSA_PKCS1V15_4096_SHA256
45+
? 'pkcs1'
46+
: 'spki';
3847
return {
3948
logID: tlogInstance.logId.keyId,
40-
publicKey: core_1.crypto.createPublicKey(tlogInstance.publicKey.rawBytes),
49+
publicKey: core_1.crypto.createPublicKey(tlogInstance.publicKey.rawBytes, keyType),
4150
validFor: {
4251
start: tlogInstance.publicKey.validFor?.start || BEGINNING_OF_TIME,
4352
end: tlogInstance.publicKey.validFor?.end || END_OF_TIME,

‎node_modules/@sigstore/verify/package.json

+4-4
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name": "@sigstore/verify",
3-
"version": "1.1.0",
3+
"version": "1.2.0",
44
"description": "Verification of Sigstore signatures",
55
"main": "dist/index.js",
66
"types": "dist/index.d.ts",
@@ -26,9 +26,9 @@
2626
"provenance": true
2727
},
2828
"dependencies": {
29-
"@sigstore/protobuf-specs": "^0.3.0",
30-
"@sigstore/bundle": "^2.2.0",
31-
"@sigstore/core": "^1.0.0"
29+
"@sigstore/protobuf-specs": "^0.3.1",
30+
"@sigstore/bundle": "^2.3.1",
31+
"@sigstore/core": "^1.1.0"
3232
},
3333
"engines": {
3434
"node": "^16.14.0 || >=18.0.0"

‎node_modules/sigstore/package.json

+6-6
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name": "sigstore",
3-
"version": "2.2.2",
3+
"version": "2.3.0",
44
"description": "code-signing for npm packages",
55
"main": "dist/index.js",
66
"types": "dist/index.d.ts",
@@ -29,17 +29,17 @@
2929
"devDependencies": {
3030
"@sigstore/rekor-types": "^2.0.0",
3131
"@sigstore/jest": "^0.0.0",
32-
"@sigstore/mock": "^0.6.5",
32+
"@sigstore/mock": "^0.7.0",
3333
"@tufjs/repo-mock": "^2.0.0",
3434
"@types/make-fetch-happen": "^10.0.4"
3535
},
3636
"dependencies": {
37-
"@sigstore/bundle": "^2.2.0",
37+
"@sigstore/bundle": "^2.3.1",
3838
"@sigstore/core": "^1.0.0",
39-
"@sigstore/protobuf-specs": "^0.3.0",
40-
"@sigstore/sign": "^2.2.3",
39+
"@sigstore/protobuf-specs": "^0.3.1",
40+
"@sigstore/sign": "^2.3.0",
4141
"@sigstore/tuf": "^2.3.1",
42-
"@sigstore/verify": "^1.1.0"
42+
"@sigstore/verify": "^1.2.0"
4343
},
4444
"engines": {
4545
"node": "^16.14.0 || >=18.0.0"

0 commit comments

Comments
 (0)