uawdijnntqw1x1x1
IP : 216.73.216.110
Hostname : 6.87.74.97.host.secureserver.net
Kernel : Linux 6.87.74.97.host.secureserver.net 4.18.0-553.83.1.el8_10.x86_64 #1 SMP Mon Nov 10 04:22:44 EST 2025 x86_64
Disable Function : None :)
OS : Linux
PATH:
/
home
/
emeraadmin
/
www
/
node_modules
/
.bin
/
..
/
object.defaults
/
..
/
debug
/
..
/
..
/
src
/
..
/
4d695
/
@sigstore.tar
/
/
protobuf-specs/package.json000064400000002020151701425750012006 0ustar00{ "_id": "@sigstore/protobuf-specs@0.3.2", "_inBundle": true, "_location": "/npm/@sigstore/protobuf-specs", "_phantomChildren": {}, "_requiredBy": [ "/npm/@sigstore/bundle", "/npm/@sigstore/sign", "/npm/@sigstore/tuf", "/npm/@sigstore/verify", "/npm/sigstore" ], "author": { "name": "bdehamer@github.com" }, "bugs": { "url": "https://github.com/sigstore/protobuf-specs/issues" }, "description": "code-signing for npm packages", "devDependencies": { "@tsconfig/node16": "^16.1.1", "@types/node": "^18.14.0", "typescript": "^4.9.5" }, "engines": { "node": "^16.14.0 || >=18.0.0" }, "files": [ "dist" ], "homepage": "https://github.com/sigstore/protobuf-specs#readme", "license": "Apache-2.0", "main": "dist/index.js", "name": "@sigstore/protobuf-specs", "repository": { "type": "git", "url": "git+https://github.com/sigstore/protobuf-specs.git" }, "scripts": { "build": "tsc" }, "types": "dist/index.d.ts", "version": "0.3.2" } protobuf-specs/LICENSE000064400000026127151701425750010543 0ustar00 Apache License Version 2.0, January 2004 http://www.apache.org/licenses/ TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION 1. Definitions. "License" shall mean the terms and conditions for use, reproduction, and distribution as defined by Sections 1 through 9 of this document. "Licensor" shall mean the copyright owner or entity authorized by the copyright owner that is granting the License. "Legal Entity" shall mean the union of the acting entity and all other entities that control, are controlled by, or are under common control with that entity. For the purposes of this definition, "control" means (i) the power, direct or indirect, to cause the direction or management of such entity, whether by contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the outstanding shares, or (iii) beneficial ownership of such entity. "You" (or "Your") shall mean an individual or Legal Entity exercising permissions granted by this License. "Source" form shall mean the preferred form for making modifications, including but not limited to software source code, documentation source, and configuration files. "Object" form shall mean any form resulting from mechanical transformation or translation of a Source form, including but not limited to compiled object code, generated documentation, and conversions to other media types. "Work" shall mean the work of authorship, whether in Source or Object form, made available under the License, as indicated by a copyright notice that is included in or attached to the work (an example is provided in the Appendix below). "Derivative Works" shall mean any work, whether in Source or Object form, that is based on (or derived from) the Work and for which the editorial revisions, annotations, elaborations, or other modifications represent, as a whole, an original work of authorship. For the purposes of this License, Derivative Works shall not include works that remain separable from, or merely link (or bind by name) to the interfaces of, the Work and Derivative Works thereof. "Contribution" shall mean any work of authorship, including the original version of the Work and any modifications or additions to that Work or Derivative Works thereof, that is intentionally submitted to Licensor for inclusion in the Work by the copyright owner or by an individual or Legal Entity authorized to submit on behalf of the copyright owner. For the purposes of this definition, "submitted" means any form of electronic, verbal, or written communication sent to the Licensor or its representatives, including but not limited to communication on electronic mailing lists, source code control systems, and issue tracking systems that are managed by, or on behalf of, the Licensor for the purpose of discussing and improving the Work, but excluding communication that is conspicuously marked or otherwise designated in writing by the copyright owner as "Not a Contribution." "Contributor" shall mean Licensor and any individual or Legal Entity on behalf of whom a Contribution has been received by Licensor and subsequently incorporated within the Work. 2. Grant of Copyright License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare Derivative Works of, publicly display, publicly perform, sublicense, and distribute the Work and such Derivative Works in Source or Object form. 3. Grant of Patent License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable (except as stated in this section) patent license to make, have made, use, offer to sell, sell, import, and otherwise transfer the Work, where such license applies only to those patent claims licensable by such Contributor that are necessarily infringed by their Contribution(s) alone or by combination of their Contribution(s) with the Work to which such Contribution(s) was submitted. If You institute patent litigation against any entity (including a cross-claim or counterclaim in a lawsuit) alleging that the Work or a Contribution incorporated within the Work constitutes direct or contributory patent infringement, then any patent licenses granted to You under this License for that Work shall terminate as of the date such litigation is filed. 4. Redistribution. You may reproduce and distribute copies of the Work or Derivative Works thereof in any medium, with or without modifications, and in Source or Object form, provided that You meet the following conditions: (a) You must give any other recipients of the Work or Derivative Works a copy of this License; and (b) You must cause any modified files to carry prominent notices stating that You changed the files; and (c) You must retain, in the Source form of any Derivative Works that You distribute, all copyright, patent, trademark, and attribution notices from the Source form of the Work, excluding those notices that do not pertain to any part of the Derivative Works; and (d) If the Work includes a "NOTICE" text file as part of its distribution, then any Derivative Works that You distribute must include a readable copy of the attribution notices contained within such NOTICE file, excluding those notices that do not pertain to any part of the Derivative Works, in at least one of the following places: within a NOTICE text file distributed as part of the Derivative Works; within the Source form or documentation, if provided along with the Derivative Works; or, within a display generated by the Derivative Works, if and wherever such third-party notices normally appear. The contents of the NOTICE file are for informational purposes only and do not modify the License. You may add Your own attribution notices within Derivative Works that You distribute, alongside or as an addendum to the NOTICE text from the Work, provided that such additional attribution notices cannot be construed as modifying the License. You may add Your own copyright statement to Your modifications and may provide additional or different license terms and conditions for use, reproduction, or distribution of Your modifications, or for any such Derivative Works as a whole, provided Your use, reproduction, and distribution of the Work otherwise complies with the conditions stated in this License. 5. Submission of Contributions. Unless You explicitly state otherwise, any Contribution intentionally submitted for inclusion in the Work by You to the Licensor shall be under the terms and conditions of this License, without any additional terms or conditions. Notwithstanding the above, nothing herein shall supersede or modify the terms of any separate license agreement you may have executed with Licensor regarding such Contributions. 6. Trademarks. This License does not grant permission to use the trade names, trademarks, service marks, or product names of the Licensor, except as required for reasonable and customary use in describing the origin of the Work and reproducing the content of the NOTICE file. 7. Disclaimer of Warranty. Unless required by applicable law or agreed to in writing, Licensor provides the Work (and each Contributor provides its Contributions) on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. You are solely responsible for determining the appropriateness of using or redistributing the Work and assume any risks associated with Your exercise of permissions under this License. 8. Limitation of Liability. In no event and under no legal theory, whether in tort (including negligence), contract, or otherwise, unless required by applicable law (such as deliberate and grossly negligent acts) or agreed to in writing, shall any Contributor be liable to You for damages, including any direct, indirect, special, incidental, or consequential damages of any character arising as a result of this License or out of the use or inability to use the Work (including but not limited to damages for loss of goodwill, work stoppage, computer failure or malfunction, or any and all other commercial damages or losses), even if such Contributor has been advised of the possibility of such damages. 9. Accepting Warranty or Additional Liability. While redistributing the Work or Derivative Works thereof, You may choose to offer, and charge a fee for, acceptance of support, warranty, indemnity, or other liability obligations and/or rights consistent with this License. However, in accepting such obligations, You may act only on Your own behalf and on Your sole responsibility, not on behalf of any other Contributor, and only if You agree to indemnify, defend, and hold each Contributor harmless for any liability incurred by, or claims asserted against, such Contributor by reason of your accepting any such warranty or additional liability. END OF TERMS AND CONDITIONS APPENDIX: How to apply the Apache License to your work. To apply the Apache License to your work, attach the following boilerplate notice, with the fields enclosed by brackets "[]" replaced with your own identifying information. (Don't include the brackets!) The text should be enclosed in the appropriate comment syntax for the file format. We also recommend that a file or class name and description of purpose be included on the same "printed page" as the copyright notice for easier identification within third-party archives. Copyright 2023 The Sigstore Authors Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. protobuf-specs/dist/__generated__/events.js000064400000016450151701425750015073 0ustar00"use strict"; Object.defineProperty(exports, "__esModule", { value: true }); exports.CloudEventBatch = exports.CloudEvent_CloudEventAttributeValue = exports.CloudEvent_AttributesEntry = exports.CloudEvent = void 0; /* eslint-disable */ const any_1 = require("./google/protobuf/any"); const timestamp_1 = require("./google/protobuf/timestamp"); function createBaseCloudEvent() { return { id: "", source: "", specVersion: "", type: "", attributes: {}, data: undefined }; } exports.CloudEvent = { fromJSON(object) { return { id: isSet(object.id) ? String(object.id) : "", source: isSet(object.source) ? String(object.source) : "", specVersion: isSet(object.specVersion) ? String(object.specVersion) : "", type: isSet(object.type) ? String(object.type) : "", attributes: isObject(object.attributes) ? Object.entries(object.attributes).reduce((acc, [key, value]) => { acc[key] = exports.CloudEvent_CloudEventAttributeValue.fromJSON(value); return acc; }, {}) : {}, data: isSet(object.binaryData) ? { $case: "binaryData", binaryData: Buffer.from(bytesFromBase64(object.binaryData)) } : isSet(object.textData) ? { $case: "textData", textData: String(object.textData) } : isSet(object.protoData) ? { $case: "protoData", protoData: any_1.Any.fromJSON(object.protoData) } : undefined, }; }, toJSON(message) { const obj = {}; message.id !== undefined && (obj.id = message.id); message.source !== undefined && (obj.source = message.source); message.specVersion !== undefined && (obj.specVersion = message.specVersion); message.type !== undefined && (obj.type = message.type); obj.attributes = {}; if (message.attributes) { Object.entries(message.attributes).forEach(([k, v]) => { obj.attributes[k] = exports.CloudEvent_CloudEventAttributeValue.toJSON(v); }); } message.data?.$case === "binaryData" && (obj.binaryData = message.data?.binaryData !== undefined ? base64FromBytes(message.data?.binaryData) : undefined); message.data?.$case === "textData" && (obj.textData = message.data?.textData); message.data?.$case === "protoData" && (obj.protoData = message.data?.protoData ? any_1.Any.toJSON(message.data?.protoData) : undefined); return obj; }, }; function createBaseCloudEvent_AttributesEntry() { return { key: "", value: undefined }; } exports.CloudEvent_AttributesEntry = { fromJSON(object) { return { key: isSet(object.key) ? String(object.key) : "", value: isSet(object.value) ? exports.CloudEvent_CloudEventAttributeValue.fromJSON(object.value) : undefined, }; }, toJSON(message) { const obj = {}; message.key !== undefined && (obj.key = message.key); message.value !== undefined && (obj.value = message.value ? exports.CloudEvent_CloudEventAttributeValue.toJSON(message.value) : undefined); return obj; }, }; function createBaseCloudEvent_CloudEventAttributeValue() { return { attr: undefined }; } exports.CloudEvent_CloudEventAttributeValue = { fromJSON(object) { return { attr: isSet(object.ceBoolean) ? { $case: "ceBoolean", ceBoolean: Boolean(object.ceBoolean) } : isSet(object.ceInteger) ? { $case: "ceInteger", ceInteger: Number(object.ceInteger) } : isSet(object.ceString) ? { $case: "ceString", ceString: String(object.ceString) } : isSet(object.ceBytes) ? { $case: "ceBytes", ceBytes: Buffer.from(bytesFromBase64(object.ceBytes)) } : isSet(object.ceUri) ? { $case: "ceUri", ceUri: String(object.ceUri) } : isSet(object.ceUriRef) ? { $case: "ceUriRef", ceUriRef: String(object.ceUriRef) } : isSet(object.ceTimestamp) ? { $case: "ceTimestamp", ceTimestamp: fromJsonTimestamp(object.ceTimestamp) } : undefined, }; }, toJSON(message) { const obj = {}; message.attr?.$case === "ceBoolean" && (obj.ceBoolean = message.attr?.ceBoolean); message.attr?.$case === "ceInteger" && (obj.ceInteger = Math.round(message.attr?.ceInteger)); message.attr?.$case === "ceString" && (obj.ceString = message.attr?.ceString); message.attr?.$case === "ceBytes" && (obj.ceBytes = message.attr?.ceBytes !== undefined ? base64FromBytes(message.attr?.ceBytes) : undefined); message.attr?.$case === "ceUri" && (obj.ceUri = message.attr?.ceUri); message.attr?.$case === "ceUriRef" && (obj.ceUriRef = message.attr?.ceUriRef); message.attr?.$case === "ceTimestamp" && (obj.ceTimestamp = message.attr?.ceTimestamp.toISOString()); return obj; }, }; function createBaseCloudEventBatch() { return { events: [] }; } exports.CloudEventBatch = { fromJSON(object) { return { events: Array.isArray(object?.events) ? object.events.map((e) => exports.CloudEvent.fromJSON(e)) : [] }; }, toJSON(message) { const obj = {}; if (message.events) { obj.events = message.events.map((e) => e ? exports.CloudEvent.toJSON(e) : undefined); } else { obj.events = []; } return obj; }, }; var tsProtoGlobalThis = (() => { if (typeof globalThis !== "undefined") { return globalThis; } if (typeof self !== "undefined") { return self; } if (typeof window !== "undefined") { return window; } if (typeof global !== "undefined") { return global; } throw "Unable to locate global object"; })(); function bytesFromBase64(b64) { if (tsProtoGlobalThis.Buffer) { return Uint8Array.from(tsProtoGlobalThis.Buffer.from(b64, "base64")); } else { const bin = tsProtoGlobalThis.atob(b64); const arr = new Uint8Array(bin.length); for (let i = 0; i < bin.length; ++i) { arr[i] = bin.charCodeAt(i); } return arr; } } function base64FromBytes(arr) { if (tsProtoGlobalThis.Buffer) { return tsProtoGlobalThis.Buffer.from(arr).toString("base64"); } else { const bin = []; arr.forEach((byte) => { bin.push(String.fromCharCode(byte)); }); return tsProtoGlobalThis.btoa(bin.join("")); } } function fromTimestamp(t) { let millis = Number(t.seconds) * 1000; millis += t.nanos / 1000000; return new Date(millis); } function fromJsonTimestamp(o) { if (o instanceof Date) { return o; } else if (typeof o === "string") { return new Date(o); } else { return fromTimestamp(timestamp_1.Timestamp.fromJSON(o)); } } function isObject(value) { return typeof value === "object" && value !== null; } function isSet(value) { return value !== null && value !== undefined; } protobuf-specs/dist/__generated__/sigstore_bundle.js000064400000012263151701425750016755 0ustar00"use strict"; Object.defineProperty(exports, "__esModule", { value: true }); exports.Bundle = exports.VerificationMaterial = exports.TimestampVerificationData = void 0; /* eslint-disable */ const envelope_1 = require("./envelope"); const sigstore_common_1 = require("./sigstore_common"); const sigstore_rekor_1 = require("./sigstore_rekor"); function createBaseTimestampVerificationData() { return { rfc3161Timestamps: [] }; } exports.TimestampVerificationData = { fromJSON(object) { return { rfc3161Timestamps: Array.isArray(object?.rfc3161Timestamps) ? object.rfc3161Timestamps.map((e) => sigstore_common_1.RFC3161SignedTimestamp.fromJSON(e)) : [], }; }, toJSON(message) { const obj = {}; if (message.rfc3161Timestamps) { obj.rfc3161Timestamps = message.rfc3161Timestamps.map((e) => e ? sigstore_common_1.RFC3161SignedTimestamp.toJSON(e) : undefined); } else { obj.rfc3161Timestamps = []; } return obj; }, }; function createBaseVerificationMaterial() { return { content: undefined, tlogEntries: [], timestampVerificationData: undefined }; } exports.VerificationMaterial = { fromJSON(object) { return { content: isSet(object.publicKey) ? { $case: "publicKey", publicKey: sigstore_common_1.PublicKeyIdentifier.fromJSON(object.publicKey) } : isSet(object.x509CertificateChain) ? { $case: "x509CertificateChain", x509CertificateChain: sigstore_common_1.X509CertificateChain.fromJSON(object.x509CertificateChain), } : isSet(object.certificate) ? { $case: "certificate", certificate: sigstore_common_1.X509Certificate.fromJSON(object.certificate) } : undefined, tlogEntries: Array.isArray(object?.tlogEntries) ? object.tlogEntries.map((e) => sigstore_rekor_1.TransparencyLogEntry.fromJSON(e)) : [], timestampVerificationData: isSet(object.timestampVerificationData) ? exports.TimestampVerificationData.fromJSON(object.timestampVerificationData) : undefined, }; }, toJSON(message) { const obj = {}; message.content?.$case === "publicKey" && (obj.publicKey = message.content?.publicKey ? sigstore_common_1.PublicKeyIdentifier.toJSON(message.content?.publicKey) : undefined); message.content?.$case === "x509CertificateChain" && (obj.x509CertificateChain = message.content?.x509CertificateChain ? sigstore_common_1.X509CertificateChain.toJSON(message.content?.x509CertificateChain) : undefined); message.content?.$case === "certificate" && (obj.certificate = message.content?.certificate ? sigstore_common_1.X509Certificate.toJSON(message.content?.certificate) : undefined); if (message.tlogEntries) { obj.tlogEntries = message.tlogEntries.map((e) => e ? sigstore_rekor_1.TransparencyLogEntry.toJSON(e) : undefined); } else { obj.tlogEntries = []; } message.timestampVerificationData !== undefined && (obj.timestampVerificationData = message.timestampVerificationData ? exports.TimestampVerificationData.toJSON(message.timestampVerificationData) : undefined); return obj; }, }; function createBaseBundle() { return { mediaType: "", verificationMaterial: undefined, content: undefined }; } exports.Bundle = { fromJSON(object) { return { mediaType: isSet(object.mediaType) ? String(object.mediaType) : "", verificationMaterial: isSet(object.verificationMaterial) ? exports.VerificationMaterial.fromJSON(object.verificationMaterial) : undefined, content: isSet(object.messageSignature) ? { $case: "messageSignature", messageSignature: sigstore_common_1.MessageSignature.fromJSON(object.messageSignature) } : isSet(object.dsseEnvelope) ? { $case: "dsseEnvelope", dsseEnvelope: envelope_1.Envelope.fromJSON(object.dsseEnvelope) } : undefined, }; }, toJSON(message) { const obj = {}; message.mediaType !== undefined && (obj.mediaType = message.mediaType); message.verificationMaterial !== undefined && (obj.verificationMaterial = message.verificationMaterial ? exports.VerificationMaterial.toJSON(message.verificationMaterial) : undefined); message.content?.$case === "messageSignature" && (obj.messageSignature = message.content?.messageSignature ? sigstore_common_1.MessageSignature.toJSON(message.content?.messageSignature) : undefined); message.content?.$case === "dsseEnvelope" && (obj.dsseEnvelope = message.content?.dsseEnvelope ? envelope_1.Envelope.toJSON(message.content?.dsseEnvelope) : undefined); return obj; }, }; function isSet(value) { return value !== null && value !== undefined; } protobuf-specs/dist/__generated__/sigstore_trustroot.js000064400000016304151701425750017571 0ustar00"use strict"; Object.defineProperty(exports, "__esModule", { value: true }); exports.ClientTrustConfig = exports.SigningConfig = exports.TrustedRoot = exports.CertificateAuthority = exports.TransparencyLogInstance = void 0; /* eslint-disable */ const sigstore_common_1 = require("./sigstore_common"); function createBaseTransparencyLogInstance() { return { baseUrl: "", hashAlgorithm: 0, publicKey: undefined, logId: undefined, checkpointKeyId: undefined }; } exports.TransparencyLogInstance = { fromJSON(object) { return { baseUrl: isSet(object.baseUrl) ? String(object.baseUrl) : "", hashAlgorithm: isSet(object.hashAlgorithm) ? (0, sigstore_common_1.hashAlgorithmFromJSON)(object.hashAlgorithm) : 0, publicKey: isSet(object.publicKey) ? sigstore_common_1.PublicKey.fromJSON(object.publicKey) : undefined, logId: isSet(object.logId) ? sigstore_common_1.LogId.fromJSON(object.logId) : undefined, checkpointKeyId: isSet(object.checkpointKeyId) ? sigstore_common_1.LogId.fromJSON(object.checkpointKeyId) : undefined, }; }, toJSON(message) { const obj = {}; message.baseUrl !== undefined && (obj.baseUrl = message.baseUrl); message.hashAlgorithm !== undefined && (obj.hashAlgorithm = (0, sigstore_common_1.hashAlgorithmToJSON)(message.hashAlgorithm)); message.publicKey !== undefined && (obj.publicKey = message.publicKey ? sigstore_common_1.PublicKey.toJSON(message.publicKey) : undefined); message.logId !== undefined && (obj.logId = message.logId ? sigstore_common_1.LogId.toJSON(message.logId) : undefined); message.checkpointKeyId !== undefined && (obj.checkpointKeyId = message.checkpointKeyId ? sigstore_common_1.LogId.toJSON(message.checkpointKeyId) : undefined); return obj; }, }; function createBaseCertificateAuthority() { return { subject: undefined, uri: "", certChain: undefined, validFor: undefined }; } exports.CertificateAuthority = { fromJSON(object) { return { subject: isSet(object.subject) ? sigstore_common_1.DistinguishedName.fromJSON(object.subject) : undefined, uri: isSet(object.uri) ? String(object.uri) : "", certChain: isSet(object.certChain) ? sigstore_common_1.X509CertificateChain.fromJSON(object.certChain) : undefined, validFor: isSet(object.validFor) ? sigstore_common_1.TimeRange.fromJSON(object.validFor) : undefined, }; }, toJSON(message) { const obj = {}; message.subject !== undefined && (obj.subject = message.subject ? sigstore_common_1.DistinguishedName.toJSON(message.subject) : undefined); message.uri !== undefined && (obj.uri = message.uri); message.certChain !== undefined && (obj.certChain = message.certChain ? sigstore_common_1.X509CertificateChain.toJSON(message.certChain) : undefined); message.validFor !== undefined && (obj.validFor = message.validFor ? sigstore_common_1.TimeRange.toJSON(message.validFor) : undefined); return obj; }, }; function createBaseTrustedRoot() { return { mediaType: "", tlogs: [], certificateAuthorities: [], ctlogs: [], timestampAuthorities: [] }; } exports.TrustedRoot = { fromJSON(object) { return { mediaType: isSet(object.mediaType) ? String(object.mediaType) : "", tlogs: Array.isArray(object?.tlogs) ? object.tlogs.map((e) => exports.TransparencyLogInstance.fromJSON(e)) : [], certificateAuthorities: Array.isArray(object?.certificateAuthorities) ? object.certificateAuthorities.map((e) => exports.CertificateAuthority.fromJSON(e)) : [], ctlogs: Array.isArray(object?.ctlogs) ? object.ctlogs.map((e) => exports.TransparencyLogInstance.fromJSON(e)) : [], timestampAuthorities: Array.isArray(object?.timestampAuthorities) ? object.timestampAuthorities.map((e) => exports.CertificateAuthority.fromJSON(e)) : [], }; }, toJSON(message) { const obj = {}; message.mediaType !== undefined && (obj.mediaType = message.mediaType); if (message.tlogs) { obj.tlogs = message.tlogs.map((e) => e ? exports.TransparencyLogInstance.toJSON(e) : undefined); } else { obj.tlogs = []; } if (message.certificateAuthorities) { obj.certificateAuthorities = message.certificateAuthorities.map((e) => e ? exports.CertificateAuthority.toJSON(e) : undefined); } else { obj.certificateAuthorities = []; } if (message.ctlogs) { obj.ctlogs = message.ctlogs.map((e) => e ? exports.TransparencyLogInstance.toJSON(e) : undefined); } else { obj.ctlogs = []; } if (message.timestampAuthorities) { obj.timestampAuthorities = message.timestampAuthorities.map((e) => e ? exports.CertificateAuthority.toJSON(e) : undefined); } else { obj.timestampAuthorities = []; } return obj; }, }; function createBaseSigningConfig() { return { caUrl: "", oidcUrl: "", tlogUrls: [], tsaUrls: [] }; } exports.SigningConfig = { fromJSON(object) { return { caUrl: isSet(object.caUrl) ? String(object.caUrl) : "", oidcUrl: isSet(object.oidcUrl) ? String(object.oidcUrl) : "", tlogUrls: Array.isArray(object?.tlogUrls) ? object.tlogUrls.map((e) => String(e)) : [], tsaUrls: Array.isArray(object?.tsaUrls) ? object.tsaUrls.map((e) => String(e)) : [], }; }, toJSON(message) { const obj = {}; message.caUrl !== undefined && (obj.caUrl = message.caUrl); message.oidcUrl !== undefined && (obj.oidcUrl = message.oidcUrl); if (message.tlogUrls) { obj.tlogUrls = message.tlogUrls.map((e) => e); } else { obj.tlogUrls = []; } if (message.tsaUrls) { obj.tsaUrls = message.tsaUrls.map((e) => e); } else { obj.tsaUrls = []; } return obj; }, }; function createBaseClientTrustConfig() { return { mediaType: "", trustedRoot: undefined, signingConfig: undefined }; } exports.ClientTrustConfig = { fromJSON(object) { return { mediaType: isSet(object.mediaType) ? String(object.mediaType) : "", trustedRoot: isSet(object.trustedRoot) ? exports.TrustedRoot.fromJSON(object.trustedRoot) : undefined, signingConfig: isSet(object.signingConfig) ? exports.SigningConfig.fromJSON(object.signingConfig) : undefined, }; }, toJSON(message) { const obj = {}; message.mediaType !== undefined && (obj.mediaType = message.mediaType); message.trustedRoot !== undefined && (obj.trustedRoot = message.trustedRoot ? exports.TrustedRoot.toJSON(message.trustedRoot) : undefined); message.signingConfig !== undefined && (obj.signingConfig = message.signingConfig ? exports.SigningConfig.toJSON(message.signingConfig) : undefined); return obj; }, }; function isSet(value) { return value !== null && value !== undefined; } protobuf-specs/dist/__generated__/sigstore_common.js000064400000056235151701425750017003 0ustar00"use strict"; Object.defineProperty(exports, "__esModule", { value: true }); exports.TimeRange = exports.X509CertificateChain = exports.SubjectAlternativeName = exports.X509Certificate = exports.DistinguishedName = exports.ObjectIdentifierValuePair = exports.ObjectIdentifier = exports.PublicKeyIdentifier = exports.PublicKey = exports.RFC3161SignedTimestamp = exports.LogId = exports.MessageSignature = exports.HashOutput = exports.subjectAlternativeNameTypeToJSON = exports.subjectAlternativeNameTypeFromJSON = exports.SubjectAlternativeNameType = exports.publicKeyDetailsToJSON = exports.publicKeyDetailsFromJSON = exports.PublicKeyDetails = exports.hashAlgorithmToJSON = exports.hashAlgorithmFromJSON = exports.HashAlgorithm = void 0; /* eslint-disable */ const timestamp_1 = require("./google/protobuf/timestamp"); /** * Only a subset of the secure hash standard algorithms are supported. * See <https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.180-4.pdf> for more * details. * UNSPECIFIED SHOULD not be used, primary reason for inclusion is to force * any proto JSON serialization to emit the used hash algorithm, as default * option is to *omit* the default value of an enum (which is the first * value, represented by '0'. */ var HashAlgorithm; (function (HashAlgorithm) { HashAlgorithm[HashAlgorithm["HASH_ALGORITHM_UNSPECIFIED"] = 0] = "HASH_ALGORITHM_UNSPECIFIED"; HashAlgorithm[HashAlgorithm["SHA2_256"] = 1] = "SHA2_256"; HashAlgorithm[HashAlgorithm["SHA2_384"] = 2] = "SHA2_384"; HashAlgorithm[HashAlgorithm["SHA2_512"] = 3] = "SHA2_512"; HashAlgorithm[HashAlgorithm["SHA3_256"] = 4] = "SHA3_256"; HashAlgorithm[HashAlgorithm["SHA3_384"] = 5] = "SHA3_384"; })(HashAlgorithm = exports.HashAlgorithm || (exports.HashAlgorithm = {})); function hashAlgorithmFromJSON(object) { switch (object) { case 0: case "HASH_ALGORITHM_UNSPECIFIED": return HashAlgorithm.HASH_ALGORITHM_UNSPECIFIED; case 1: case "SHA2_256": return HashAlgorithm.SHA2_256; case 2: case "SHA2_384": return HashAlgorithm.SHA2_384; case 3: case "SHA2_512": return HashAlgorithm.SHA2_512; case 4: case "SHA3_256": return HashAlgorithm.SHA3_256; case 5: case "SHA3_384": return HashAlgorithm.SHA3_384; default: throw new tsProtoGlobalThis.Error("Unrecognized enum value " + object + " for enum HashAlgorithm"); } } exports.hashAlgorithmFromJSON = hashAlgorithmFromJSON; function hashAlgorithmToJSON(object) { switch (object) { case HashAlgorithm.HASH_ALGORITHM_UNSPECIFIED: return "HASH_ALGORITHM_UNSPECIFIED"; case HashAlgorithm.SHA2_256: return "SHA2_256"; case HashAlgorithm.SHA2_384: return "SHA2_384"; case HashAlgorithm.SHA2_512: return "SHA2_512"; case HashAlgorithm.SHA3_256: return "SHA3_256"; case HashAlgorithm.SHA3_384: return "SHA3_384"; default: throw new tsProtoGlobalThis.Error("Unrecognized enum value " + object + " for enum HashAlgorithm"); } } exports.hashAlgorithmToJSON = hashAlgorithmToJSON; /** * Details of a specific public key, capturing the the key encoding method, * and signature algorithm. * * PublicKeyDetails captures the public key/hash algorithm combinations * recommended in the Sigstore ecosystem. * * This is modelled as a linear set as we want to provide a small number of * opinionated options instead of allowing every possible permutation. * * Any changes to this enum MUST be reflected in the algorithm registry. * See: docs/algorithm-registry.md * * To avoid the possibility of contradicting formats such as PKCS1 with * ED25519 the valid permutations are listed as a linear set instead of a * cartesian set (i.e one combined variable instead of two, one for encoding * and one for the signature algorithm). */ var PublicKeyDetails; (function (PublicKeyDetails) { PublicKeyDetails[PublicKeyDetails["PUBLIC_KEY_DETAILS_UNSPECIFIED"] = 0] = "PUBLIC_KEY_DETAILS_UNSPECIFIED"; /** * PKCS1_RSA_PKCS1V5 - RSA * * @deprecated */ PublicKeyDetails[PublicKeyDetails["PKCS1_RSA_PKCS1V5"] = 1] = "PKCS1_RSA_PKCS1V5"; /** * PKCS1_RSA_PSS - See RFC8017 * * @deprecated */ PublicKeyDetails[PublicKeyDetails["PKCS1_RSA_PSS"] = 2] = "PKCS1_RSA_PSS"; /** @deprecated */ PublicKeyDetails[PublicKeyDetails["PKIX_RSA_PKCS1V5"] = 3] = "PKIX_RSA_PKCS1V5"; /** @deprecated */ PublicKeyDetails[PublicKeyDetails["PKIX_RSA_PSS"] = 4] = "PKIX_RSA_PSS"; /** PKIX_RSA_PKCS1V15_2048_SHA256 - RSA public key in PKIX format, PKCS#1v1.5 signature */ PublicKeyDetails[PublicKeyDetails["PKIX_RSA_PKCS1V15_2048_SHA256"] = 9] = "PKIX_RSA_PKCS1V15_2048_SHA256"; PublicKeyDetails[PublicKeyDetails["PKIX_RSA_PKCS1V15_3072_SHA256"] = 10] = "PKIX_RSA_PKCS1V15_3072_SHA256"; PublicKeyDetails[PublicKeyDetails["PKIX_RSA_PKCS1V15_4096_SHA256"] = 11] = "PKIX_RSA_PKCS1V15_4096_SHA256"; /** PKIX_RSA_PSS_2048_SHA256 - RSA public key in PKIX format, RSASSA-PSS signature */ PublicKeyDetails[PublicKeyDetails["PKIX_RSA_PSS_2048_SHA256"] = 16] = "PKIX_RSA_PSS_2048_SHA256"; PublicKeyDetails[PublicKeyDetails["PKIX_RSA_PSS_3072_SHA256"] = 17] = "PKIX_RSA_PSS_3072_SHA256"; PublicKeyDetails[PublicKeyDetails["PKIX_RSA_PSS_4096_SHA256"] = 18] = "PKIX_RSA_PSS_4096_SHA256"; /** * PKIX_ECDSA_P256_HMAC_SHA_256 - ECDSA * * @deprecated */ PublicKeyDetails[PublicKeyDetails["PKIX_ECDSA_P256_HMAC_SHA_256"] = 6] = "PKIX_ECDSA_P256_HMAC_SHA_256"; /** PKIX_ECDSA_P256_SHA_256 - See NIST FIPS 186-4 */ PublicKeyDetails[PublicKeyDetails["PKIX_ECDSA_P256_SHA_256"] = 5] = "PKIX_ECDSA_P256_SHA_256"; PublicKeyDetails[PublicKeyDetails["PKIX_ECDSA_P384_SHA_384"] = 12] = "PKIX_ECDSA_P384_SHA_384"; PublicKeyDetails[PublicKeyDetails["PKIX_ECDSA_P521_SHA_512"] = 13] = "PKIX_ECDSA_P521_SHA_512"; /** PKIX_ED25519 - Ed 25519 */ PublicKeyDetails[PublicKeyDetails["PKIX_ED25519"] = 7] = "PKIX_ED25519"; PublicKeyDetails[PublicKeyDetails["PKIX_ED25519_PH"] = 8] = "PKIX_ED25519_PH"; /** * LMS_SHA256 - LMS and LM-OTS * * These keys and signatures may be used by private Sigstore * deployments, but are not currently supported by the public * good instance. * * USER WARNING: LMS and LM-OTS are both stateful signature schemes. * Using them correctly requires discretion and careful consideration * to ensure that individual secret keys are not used more than once. * In addition, LM-OTS is a single-use scheme, meaning that it * MUST NOT be used for more than one signature per LM-OTS key. * If you cannot maintain these invariants, you MUST NOT use these * schemes. */ PublicKeyDetails[PublicKeyDetails["LMS_SHA256"] = 14] = "LMS_SHA256"; PublicKeyDetails[PublicKeyDetails["LMOTS_SHA256"] = 15] = "LMOTS_SHA256"; })(PublicKeyDetails = exports.PublicKeyDetails || (exports.PublicKeyDetails = {})); function publicKeyDetailsFromJSON(object) { switch (object) { case 0: case "PUBLIC_KEY_DETAILS_UNSPECIFIED": return PublicKeyDetails.PUBLIC_KEY_DETAILS_UNSPECIFIED; case 1: case "PKCS1_RSA_PKCS1V5": return PublicKeyDetails.PKCS1_RSA_PKCS1V5; case 2: case "PKCS1_RSA_PSS": return PublicKeyDetails.PKCS1_RSA_PSS; case 3: case "PKIX_RSA_PKCS1V5": return PublicKeyDetails.PKIX_RSA_PKCS1V5; case 4: case "PKIX_RSA_PSS": return PublicKeyDetails.PKIX_RSA_PSS; case 9: case "PKIX_RSA_PKCS1V15_2048_SHA256": return PublicKeyDetails.PKIX_RSA_PKCS1V15_2048_SHA256; case 10: case "PKIX_RSA_PKCS1V15_3072_SHA256": return PublicKeyDetails.PKIX_RSA_PKCS1V15_3072_SHA256; case 11: case "PKIX_RSA_PKCS1V15_4096_SHA256": return PublicKeyDetails.PKIX_RSA_PKCS1V15_4096_SHA256; case 16: case "PKIX_RSA_PSS_2048_SHA256": return PublicKeyDetails.PKIX_RSA_PSS_2048_SHA256; case 17: case "PKIX_RSA_PSS_3072_SHA256": return PublicKeyDetails.PKIX_RSA_PSS_3072_SHA256; case 18: case "PKIX_RSA_PSS_4096_SHA256": return PublicKeyDetails.PKIX_RSA_PSS_4096_SHA256; case 6: case "PKIX_ECDSA_P256_HMAC_SHA_256": return PublicKeyDetails.PKIX_ECDSA_P256_HMAC_SHA_256; case 5: case "PKIX_ECDSA_P256_SHA_256": return PublicKeyDetails.PKIX_ECDSA_P256_SHA_256; case 12: case "PKIX_ECDSA_P384_SHA_384": return PublicKeyDetails.PKIX_ECDSA_P384_SHA_384; case 13: case "PKIX_ECDSA_P521_SHA_512": return PublicKeyDetails.PKIX_ECDSA_P521_SHA_512; case 7: case "PKIX_ED25519": return PublicKeyDetails.PKIX_ED25519; case 8: case "PKIX_ED25519_PH": return PublicKeyDetails.PKIX_ED25519_PH; case 14: case "LMS_SHA256": return PublicKeyDetails.LMS_SHA256; case 15: case "LMOTS_SHA256": return PublicKeyDetails.LMOTS_SHA256; default: throw new tsProtoGlobalThis.Error("Unrecognized enum value " + object + " for enum PublicKeyDetails"); } } exports.publicKeyDetailsFromJSON = publicKeyDetailsFromJSON; function publicKeyDetailsToJSON(object) { switch (object) { case PublicKeyDetails.PUBLIC_KEY_DETAILS_UNSPECIFIED: return "PUBLIC_KEY_DETAILS_UNSPECIFIED"; case PublicKeyDetails.PKCS1_RSA_PKCS1V5: return "PKCS1_RSA_PKCS1V5"; case PublicKeyDetails.PKCS1_RSA_PSS: return "PKCS1_RSA_PSS"; case PublicKeyDetails.PKIX_RSA_PKCS1V5: return "PKIX_RSA_PKCS1V5"; case PublicKeyDetails.PKIX_RSA_PSS: return "PKIX_RSA_PSS"; case PublicKeyDetails.PKIX_RSA_PKCS1V15_2048_SHA256: return "PKIX_RSA_PKCS1V15_2048_SHA256"; case PublicKeyDetails.PKIX_RSA_PKCS1V15_3072_SHA256: return "PKIX_RSA_PKCS1V15_3072_SHA256"; case PublicKeyDetails.PKIX_RSA_PKCS1V15_4096_SHA256: return "PKIX_RSA_PKCS1V15_4096_SHA256"; case PublicKeyDetails.PKIX_RSA_PSS_2048_SHA256: return "PKIX_RSA_PSS_2048_SHA256"; case PublicKeyDetails.PKIX_RSA_PSS_3072_SHA256: return "PKIX_RSA_PSS_3072_SHA256"; case PublicKeyDetails.PKIX_RSA_PSS_4096_SHA256: return "PKIX_RSA_PSS_4096_SHA256"; case PublicKeyDetails.PKIX_ECDSA_P256_HMAC_SHA_256: return "PKIX_ECDSA_P256_HMAC_SHA_256"; case PublicKeyDetails.PKIX_ECDSA_P256_SHA_256: return "PKIX_ECDSA_P256_SHA_256"; case PublicKeyDetails.PKIX_ECDSA_P384_SHA_384: return "PKIX_ECDSA_P384_SHA_384"; case PublicKeyDetails.PKIX_ECDSA_P521_SHA_512: return "PKIX_ECDSA_P521_SHA_512"; case PublicKeyDetails.PKIX_ED25519: return "PKIX_ED25519"; case PublicKeyDetails.PKIX_ED25519_PH: return "PKIX_ED25519_PH"; case PublicKeyDetails.LMS_SHA256: return "LMS_SHA256"; case PublicKeyDetails.LMOTS_SHA256: return "LMOTS_SHA256"; default: throw new tsProtoGlobalThis.Error("Unrecognized enum value " + object + " for enum PublicKeyDetails"); } } exports.publicKeyDetailsToJSON = publicKeyDetailsToJSON; var SubjectAlternativeNameType; (function (SubjectAlternativeNameType) { SubjectAlternativeNameType[SubjectAlternativeNameType["SUBJECT_ALTERNATIVE_NAME_TYPE_UNSPECIFIED"] = 0] = "SUBJECT_ALTERNATIVE_NAME_TYPE_UNSPECIFIED"; SubjectAlternativeNameType[SubjectAlternativeNameType["EMAIL"] = 1] = "EMAIL"; SubjectAlternativeNameType[SubjectAlternativeNameType["URI"] = 2] = "URI"; /** * OTHER_NAME - OID 1.3.6.1.4.1.57264.1.7 * See https://github.com/sigstore/fulcio/blob/main/docs/oid-info.md#1361415726417--othername-san * for more details. */ SubjectAlternativeNameType[SubjectAlternativeNameType["OTHER_NAME"] = 3] = "OTHER_NAME"; })(SubjectAlternativeNameType = exports.SubjectAlternativeNameType || (exports.SubjectAlternativeNameType = {})); function subjectAlternativeNameTypeFromJSON(object) { switch (object) { case 0: case "SUBJECT_ALTERNATIVE_NAME_TYPE_UNSPECIFIED": return SubjectAlternativeNameType.SUBJECT_ALTERNATIVE_NAME_TYPE_UNSPECIFIED; case 1: case "EMAIL": return SubjectAlternativeNameType.EMAIL; case 2: case "URI": return SubjectAlternativeNameType.URI; case 3: case "OTHER_NAME": return SubjectAlternativeNameType.OTHER_NAME; default: throw new tsProtoGlobalThis.Error("Unrecognized enum value " + object + " for enum SubjectAlternativeNameType"); } } exports.subjectAlternativeNameTypeFromJSON = subjectAlternativeNameTypeFromJSON; function subjectAlternativeNameTypeToJSON(object) { switch (object) { case SubjectAlternativeNameType.SUBJECT_ALTERNATIVE_NAME_TYPE_UNSPECIFIED: return "SUBJECT_ALTERNATIVE_NAME_TYPE_UNSPECIFIED"; case SubjectAlternativeNameType.EMAIL: return "EMAIL"; case SubjectAlternativeNameType.URI: return "URI"; case SubjectAlternativeNameType.OTHER_NAME: return "OTHER_NAME"; default: throw new tsProtoGlobalThis.Error("Unrecognized enum value " + object + " for enum SubjectAlternativeNameType"); } } exports.subjectAlternativeNameTypeToJSON = subjectAlternativeNameTypeToJSON; function createBaseHashOutput() { return { algorithm: 0, digest: Buffer.alloc(0) }; } exports.HashOutput = { fromJSON(object) { return { algorithm: isSet(object.algorithm) ? hashAlgorithmFromJSON(object.algorithm) : 0, digest: isSet(object.digest) ? Buffer.from(bytesFromBase64(object.digest)) : Buffer.alloc(0), }; }, toJSON(message) { const obj = {}; message.algorithm !== undefined && (obj.algorithm = hashAlgorithmToJSON(message.algorithm)); message.digest !== undefined && (obj.digest = base64FromBytes(message.digest !== undefined ? message.digest : Buffer.alloc(0))); return obj; }, }; function createBaseMessageSignature() { return { messageDigest: undefined, signature: Buffer.alloc(0) }; } exports.MessageSignature = { fromJSON(object) { return { messageDigest: isSet(object.messageDigest) ? exports.HashOutput.fromJSON(object.messageDigest) : undefined, signature: isSet(object.signature) ? Buffer.from(bytesFromBase64(object.signature)) : Buffer.alloc(0), }; }, toJSON(message) { const obj = {}; message.messageDigest !== undefined && (obj.messageDigest = message.messageDigest ? exports.HashOutput.toJSON(message.messageDigest) : undefined); message.signature !== undefined && (obj.signature = base64FromBytes(message.signature !== undefined ? message.signature : Buffer.alloc(0))); return obj; }, }; function createBaseLogId() { return { keyId: Buffer.alloc(0) }; } exports.LogId = { fromJSON(object) { return { keyId: isSet(object.keyId) ? Buffer.from(bytesFromBase64(object.keyId)) : Buffer.alloc(0) }; }, toJSON(message) { const obj = {}; message.keyId !== undefined && (obj.keyId = base64FromBytes(message.keyId !== undefined ? message.keyId : Buffer.alloc(0))); return obj; }, }; function createBaseRFC3161SignedTimestamp() { return { signedTimestamp: Buffer.alloc(0) }; } exports.RFC3161SignedTimestamp = { fromJSON(object) { return { signedTimestamp: isSet(object.signedTimestamp) ? Buffer.from(bytesFromBase64(object.signedTimestamp)) : Buffer.alloc(0), }; }, toJSON(message) { const obj = {}; message.signedTimestamp !== undefined && (obj.signedTimestamp = base64FromBytes(message.signedTimestamp !== undefined ? message.signedTimestamp : Buffer.alloc(0))); return obj; }, }; function createBasePublicKey() { return { rawBytes: undefined, keyDetails: 0, validFor: undefined }; } exports.PublicKey = { fromJSON(object) { return { rawBytes: isSet(object.rawBytes) ? Buffer.from(bytesFromBase64(object.rawBytes)) : undefined, keyDetails: isSet(object.keyDetails) ? publicKeyDetailsFromJSON(object.keyDetails) : 0, validFor: isSet(object.validFor) ? exports.TimeRange.fromJSON(object.validFor) : undefined, }; }, toJSON(message) { const obj = {}; message.rawBytes !== undefined && (obj.rawBytes = message.rawBytes !== undefined ? base64FromBytes(message.rawBytes) : undefined); message.keyDetails !== undefined && (obj.keyDetails = publicKeyDetailsToJSON(message.keyDetails)); message.validFor !== undefined && (obj.validFor = message.validFor ? exports.TimeRange.toJSON(message.validFor) : undefined); return obj; }, }; function createBasePublicKeyIdentifier() { return { hint: "" }; } exports.PublicKeyIdentifier = { fromJSON(object) { return { hint: isSet(object.hint) ? String(object.hint) : "" }; }, toJSON(message) { const obj = {}; message.hint !== undefined && (obj.hint = message.hint); return obj; }, }; function createBaseObjectIdentifier() { return { id: [] }; } exports.ObjectIdentifier = { fromJSON(object) { return { id: Array.isArray(object?.id) ? object.id.map((e) => Number(e)) : [] }; }, toJSON(message) { const obj = {}; if (message.id) { obj.id = message.id.map((e) => Math.round(e)); } else { obj.id = []; } return obj; }, }; function createBaseObjectIdentifierValuePair() { return { oid: undefined, value: Buffer.alloc(0) }; } exports.ObjectIdentifierValuePair = { fromJSON(object) { return { oid: isSet(object.oid) ? exports.ObjectIdentifier.fromJSON(object.oid) : undefined, value: isSet(object.value) ? Buffer.from(bytesFromBase64(object.value)) : Buffer.alloc(0), }; }, toJSON(message) { const obj = {}; message.oid !== undefined && (obj.oid = message.oid ? exports.ObjectIdentifier.toJSON(message.oid) : undefined); message.value !== undefined && (obj.value = base64FromBytes(message.value !== undefined ? message.value : Buffer.alloc(0))); return obj; }, }; function createBaseDistinguishedName() { return { organization: "", commonName: "" }; } exports.DistinguishedName = { fromJSON(object) { return { organization: isSet(object.organization) ? String(object.organization) : "", commonName: isSet(object.commonName) ? String(object.commonName) : "", }; }, toJSON(message) { const obj = {}; message.organization !== undefined && (obj.organization = message.organization); message.commonName !== undefined && (obj.commonName = message.commonName); return obj; }, }; function createBaseX509Certificate() { return { rawBytes: Buffer.alloc(0) }; } exports.X509Certificate = { fromJSON(object) { return { rawBytes: isSet(object.rawBytes) ? Buffer.from(bytesFromBase64(object.rawBytes)) : Buffer.alloc(0) }; }, toJSON(message) { const obj = {}; message.rawBytes !== undefined && (obj.rawBytes = base64FromBytes(message.rawBytes !== undefined ? message.rawBytes : Buffer.alloc(0))); return obj; }, }; function createBaseSubjectAlternativeName() { return { type: 0, identity: undefined }; } exports.SubjectAlternativeName = { fromJSON(object) { return { type: isSet(object.type) ? subjectAlternativeNameTypeFromJSON(object.type) : 0, identity: isSet(object.regexp) ? { $case: "regexp", regexp: String(object.regexp) } : isSet(object.value) ? { $case: "value", value: String(object.value) } : undefined, }; }, toJSON(message) { const obj = {}; message.type !== undefined && (obj.type = subjectAlternativeNameTypeToJSON(message.type)); message.identity?.$case === "regexp" && (obj.regexp = message.identity?.regexp); message.identity?.$case === "value" && (obj.value = message.identity?.value); return obj; }, }; function createBaseX509CertificateChain() { return { certificates: [] }; } exports.X509CertificateChain = { fromJSON(object) { return { certificates: Array.isArray(object?.certificates) ? object.certificates.map((e) => exports.X509Certificate.fromJSON(e)) : [], }; }, toJSON(message) { const obj = {}; if (message.certificates) { obj.certificates = message.certificates.map((e) => e ? exports.X509Certificate.toJSON(e) : undefined); } else { obj.certificates = []; } return obj; }, }; function createBaseTimeRange() { return { start: undefined, end: undefined }; } exports.TimeRange = { fromJSON(object) { return { start: isSet(object.start) ? fromJsonTimestamp(object.start) : undefined, end: isSet(object.end) ? fromJsonTimestamp(object.end) : undefined, }; }, toJSON(message) { const obj = {}; message.start !== undefined && (obj.start = message.start.toISOString()); message.end !== undefined && (obj.end = message.end.toISOString()); return obj; }, }; var tsProtoGlobalThis = (() => { if (typeof globalThis !== "undefined") { return globalThis; } if (typeof self !== "undefined") { return self; } if (typeof window !== "undefined") { return window; } if (typeof global !== "undefined") { return global; } throw "Unable to locate global object"; })(); function bytesFromBase64(b64) { if (tsProtoGlobalThis.Buffer) { return Uint8Array.from(tsProtoGlobalThis.Buffer.from(b64, "base64")); } else { const bin = tsProtoGlobalThis.atob(b64); const arr = new Uint8Array(bin.length); for (let i = 0; i < bin.length; ++i) { arr[i] = bin.charCodeAt(i); } return arr; } } function base64FromBytes(arr) { if (tsProtoGlobalThis.Buffer) { return tsProtoGlobalThis.Buffer.from(arr).toString("base64"); } else { const bin = []; arr.forEach((byte) => { bin.push(String.fromCharCode(byte)); }); return tsProtoGlobalThis.btoa(bin.join("")); } } function fromTimestamp(t) { let millis = Number(t.seconds) * 1000; millis += t.nanos / 1000000; return new Date(millis); } function fromJsonTimestamp(o) { if (o instanceof Date) { return o; } else if (typeof o === "string") { return new Date(o); } else { return fromTimestamp(timestamp_1.Timestamp.fromJSON(o)); } } function isSet(value) { return value !== null && value !== undefined; } protobuf-specs/dist/__generated__/sigstore_rekor.js000064400000015105151701425750016624 0ustar00"use strict"; Object.defineProperty(exports, "__esModule", { value: true }); exports.TransparencyLogEntry = exports.InclusionPromise = exports.InclusionProof = exports.Checkpoint = exports.KindVersion = void 0; /* eslint-disable */ const sigstore_common_1 = require("./sigstore_common"); function createBaseKindVersion() { return { kind: "", version: "" }; } exports.KindVersion = { fromJSON(object) { return { kind: isSet(object.kind) ? String(object.kind) : "", version: isSet(object.version) ? String(object.version) : "", }; }, toJSON(message) { const obj = {}; message.kind !== undefined && (obj.kind = message.kind); message.version !== undefined && (obj.version = message.version); return obj; }, }; function createBaseCheckpoint() { return { envelope: "" }; } exports.Checkpoint = { fromJSON(object) { return { envelope: isSet(object.envelope) ? String(object.envelope) : "" }; }, toJSON(message) { const obj = {}; message.envelope !== undefined && (obj.envelope = message.envelope); return obj; }, }; function createBaseInclusionProof() { return { logIndex: "0", rootHash: Buffer.alloc(0), treeSize: "0", hashes: [], checkpoint: undefined }; } exports.InclusionProof = { fromJSON(object) { return { logIndex: isSet(object.logIndex) ? String(object.logIndex) : "0", rootHash: isSet(object.rootHash) ? Buffer.from(bytesFromBase64(object.rootHash)) : Buffer.alloc(0), treeSize: isSet(object.treeSize) ? String(object.treeSize) : "0", hashes: Array.isArray(object?.hashes) ? object.hashes.map((e) => Buffer.from(bytesFromBase64(e))) : [], checkpoint: isSet(object.checkpoint) ? exports.Checkpoint.fromJSON(object.checkpoint) : undefined, }; }, toJSON(message) { const obj = {}; message.logIndex !== undefined && (obj.logIndex = message.logIndex); message.rootHash !== undefined && (obj.rootHash = base64FromBytes(message.rootHash !== undefined ? message.rootHash : Buffer.alloc(0))); message.treeSize !== undefined && (obj.treeSize = message.treeSize); if (message.hashes) { obj.hashes = message.hashes.map((e) => base64FromBytes(e !== undefined ? e : Buffer.alloc(0))); } else { obj.hashes = []; } message.checkpoint !== undefined && (obj.checkpoint = message.checkpoint ? exports.Checkpoint.toJSON(message.checkpoint) : undefined); return obj; }, }; function createBaseInclusionPromise() { return { signedEntryTimestamp: Buffer.alloc(0) }; } exports.InclusionPromise = { fromJSON(object) { return { signedEntryTimestamp: isSet(object.signedEntryTimestamp) ? Buffer.from(bytesFromBase64(object.signedEntryTimestamp)) : Buffer.alloc(0), }; }, toJSON(message) { const obj = {}; message.signedEntryTimestamp !== undefined && (obj.signedEntryTimestamp = base64FromBytes(message.signedEntryTimestamp !== undefined ? message.signedEntryTimestamp : Buffer.alloc(0))); return obj; }, }; function createBaseTransparencyLogEntry() { return { logIndex: "0", logId: undefined, kindVersion: undefined, integratedTime: "0", inclusionPromise: undefined, inclusionProof: undefined, canonicalizedBody: Buffer.alloc(0), }; } exports.TransparencyLogEntry = { fromJSON(object) { return { logIndex: isSet(object.logIndex) ? String(object.logIndex) : "0", logId: isSet(object.logId) ? sigstore_common_1.LogId.fromJSON(object.logId) : undefined, kindVersion: isSet(object.kindVersion) ? exports.KindVersion.fromJSON(object.kindVersion) : undefined, integratedTime: isSet(object.integratedTime) ? String(object.integratedTime) : "0", inclusionPromise: isSet(object.inclusionPromise) ? exports.InclusionPromise.fromJSON(object.inclusionPromise) : undefined, inclusionProof: isSet(object.inclusionProof) ? exports.InclusionProof.fromJSON(object.inclusionProof) : undefined, canonicalizedBody: isSet(object.canonicalizedBody) ? Buffer.from(bytesFromBase64(object.canonicalizedBody)) : Buffer.alloc(0), }; }, toJSON(message) { const obj = {}; message.logIndex !== undefined && (obj.logIndex = message.logIndex); message.logId !== undefined && (obj.logId = message.logId ? sigstore_common_1.LogId.toJSON(message.logId) : undefined); message.kindVersion !== undefined && (obj.kindVersion = message.kindVersion ? exports.KindVersion.toJSON(message.kindVersion) : undefined); message.integratedTime !== undefined && (obj.integratedTime = message.integratedTime); message.inclusionPromise !== undefined && (obj.inclusionPromise = message.inclusionPromise ? exports.InclusionPromise.toJSON(message.inclusionPromise) : undefined); message.inclusionProof !== undefined && (obj.inclusionProof = message.inclusionProof ? exports.InclusionProof.toJSON(message.inclusionProof) : undefined); message.canonicalizedBody !== undefined && (obj.canonicalizedBody = base64FromBytes(message.canonicalizedBody !== undefined ? message.canonicalizedBody : Buffer.alloc(0))); return obj; }, }; var tsProtoGlobalThis = (() => { if (typeof globalThis !== "undefined") { return globalThis; } if (typeof self !== "undefined") { return self; } if (typeof window !== "undefined") { return window; } if (typeof global !== "undefined") { return global; } throw "Unable to locate global object"; })(); function bytesFromBase64(b64) { if (tsProtoGlobalThis.Buffer) { return Uint8Array.from(tsProtoGlobalThis.Buffer.from(b64, "base64")); } else { const bin = tsProtoGlobalThis.atob(b64); const arr = new Uint8Array(bin.length); for (let i = 0; i < bin.length; ++i) { arr[i] = bin.charCodeAt(i); } return arr; } } function base64FromBytes(arr) { if (tsProtoGlobalThis.Buffer) { return tsProtoGlobalThis.Buffer.from(arr).toString("base64"); } else { const bin = []; arr.forEach((byte) => { bin.push(String.fromCharCode(byte)); }); return tsProtoGlobalThis.btoa(bin.join("")); } } function isSet(value) { return value !== null && value !== undefined; } protobuf-specs/dist/__generated__/sigstore_verification.js000064400000032301151701425750020161 0ustar00"use strict"; Object.defineProperty(exports, "__esModule", { value: true }); exports.Input = exports.Artifact = exports.ArtifactVerificationOptions_ObserverTimestampOptions = exports.ArtifactVerificationOptions_TlogIntegratedTimestampOptions = exports.ArtifactVerificationOptions_TimestampAuthorityOptions = exports.ArtifactVerificationOptions_CtlogOptions = exports.ArtifactVerificationOptions_TlogOptions = exports.ArtifactVerificationOptions = exports.PublicKeyIdentities = exports.CertificateIdentities = exports.CertificateIdentity = void 0; /* eslint-disable */ const sigstore_bundle_1 = require("./sigstore_bundle"); const sigstore_common_1 = require("./sigstore_common"); const sigstore_trustroot_1 = require("./sigstore_trustroot"); function createBaseCertificateIdentity() { return { issuer: "", san: undefined, oids: [] }; } exports.CertificateIdentity = { fromJSON(object) { return { issuer: isSet(object.issuer) ? String(object.issuer) : "", san: isSet(object.san) ? sigstore_common_1.SubjectAlternativeName.fromJSON(object.san) : undefined, oids: Array.isArray(object?.oids) ? object.oids.map((e) => sigstore_common_1.ObjectIdentifierValuePair.fromJSON(e)) : [], }; }, toJSON(message) { const obj = {}; message.issuer !== undefined && (obj.issuer = message.issuer); message.san !== undefined && (obj.san = message.san ? sigstore_common_1.SubjectAlternativeName.toJSON(message.san) : undefined); if (message.oids) { obj.oids = message.oids.map((e) => e ? sigstore_common_1.ObjectIdentifierValuePair.toJSON(e) : undefined); } else { obj.oids = []; } return obj; }, }; function createBaseCertificateIdentities() { return { identities: [] }; } exports.CertificateIdentities = { fromJSON(object) { return { identities: Array.isArray(object?.identities) ? object.identities.map((e) => exports.CertificateIdentity.fromJSON(e)) : [], }; }, toJSON(message) { const obj = {}; if (message.identities) { obj.identities = message.identities.map((e) => e ? exports.CertificateIdentity.toJSON(e) : undefined); } else { obj.identities = []; } return obj; }, }; function createBasePublicKeyIdentities() { return { publicKeys: [] }; } exports.PublicKeyIdentities = { fromJSON(object) { return { publicKeys: Array.isArray(object?.publicKeys) ? object.publicKeys.map((e) => sigstore_common_1.PublicKey.fromJSON(e)) : [], }; }, toJSON(message) { const obj = {}; if (message.publicKeys) { obj.publicKeys = message.publicKeys.map((e) => e ? sigstore_common_1.PublicKey.toJSON(e) : undefined); } else { obj.publicKeys = []; } return obj; }, }; function createBaseArtifactVerificationOptions() { return { signers: undefined, tlogOptions: undefined, ctlogOptions: undefined, tsaOptions: undefined, integratedTsOptions: undefined, observerOptions: undefined, }; } exports.ArtifactVerificationOptions = { fromJSON(object) { return { signers: isSet(object.certificateIdentities) ? { $case: "certificateIdentities", certificateIdentities: exports.CertificateIdentities.fromJSON(object.certificateIdentities), } : isSet(object.publicKeys) ? { $case: "publicKeys", publicKeys: exports.PublicKeyIdentities.fromJSON(object.publicKeys) } : undefined, tlogOptions: isSet(object.tlogOptions) ? exports.ArtifactVerificationOptions_TlogOptions.fromJSON(object.tlogOptions) : undefined, ctlogOptions: isSet(object.ctlogOptions) ? exports.ArtifactVerificationOptions_CtlogOptions.fromJSON(object.ctlogOptions) : undefined, tsaOptions: isSet(object.tsaOptions) ? exports.ArtifactVerificationOptions_TimestampAuthorityOptions.fromJSON(object.tsaOptions) : undefined, integratedTsOptions: isSet(object.integratedTsOptions) ? exports.ArtifactVerificationOptions_TlogIntegratedTimestampOptions.fromJSON(object.integratedTsOptions) : undefined, observerOptions: isSet(object.observerOptions) ? exports.ArtifactVerificationOptions_ObserverTimestampOptions.fromJSON(object.observerOptions) : undefined, }; }, toJSON(message) { const obj = {}; message.signers?.$case === "certificateIdentities" && (obj.certificateIdentities = message.signers?.certificateIdentities ? exports.CertificateIdentities.toJSON(message.signers?.certificateIdentities) : undefined); message.signers?.$case === "publicKeys" && (obj.publicKeys = message.signers?.publicKeys ? exports.PublicKeyIdentities.toJSON(message.signers?.publicKeys) : undefined); message.tlogOptions !== undefined && (obj.tlogOptions = message.tlogOptions ? exports.ArtifactVerificationOptions_TlogOptions.toJSON(message.tlogOptions) : undefined); message.ctlogOptions !== undefined && (obj.ctlogOptions = message.ctlogOptions ? exports.ArtifactVerificationOptions_CtlogOptions.toJSON(message.ctlogOptions) : undefined); message.tsaOptions !== undefined && (obj.tsaOptions = message.tsaOptions ? exports.ArtifactVerificationOptions_TimestampAuthorityOptions.toJSON(message.tsaOptions) : undefined); message.integratedTsOptions !== undefined && (obj.integratedTsOptions = message.integratedTsOptions ? exports.ArtifactVerificationOptions_TlogIntegratedTimestampOptions.toJSON(message.integratedTsOptions) : undefined); message.observerOptions !== undefined && (obj.observerOptions = message.observerOptions ? exports.ArtifactVerificationOptions_ObserverTimestampOptions.toJSON(message.observerOptions) : undefined); return obj; }, }; function createBaseArtifactVerificationOptions_TlogOptions() { return { threshold: 0, performOnlineVerification: false, disable: false }; } exports.ArtifactVerificationOptions_TlogOptions = { fromJSON(object) { return { threshold: isSet(object.threshold) ? Number(object.threshold) : 0, performOnlineVerification: isSet(object.performOnlineVerification) ? Boolean(object.performOnlineVerification) : false, disable: isSet(object.disable) ? Boolean(object.disable) : false, }; }, toJSON(message) { const obj = {}; message.threshold !== undefined && (obj.threshold = Math.round(message.threshold)); message.performOnlineVerification !== undefined && (obj.performOnlineVerification = message.performOnlineVerification); message.disable !== undefined && (obj.disable = message.disable); return obj; }, }; function createBaseArtifactVerificationOptions_CtlogOptions() { return { threshold: 0, disable: false }; } exports.ArtifactVerificationOptions_CtlogOptions = { fromJSON(object) { return { threshold: isSet(object.threshold) ? Number(object.threshold) : 0, disable: isSet(object.disable) ? Boolean(object.disable) : false, }; }, toJSON(message) { const obj = {}; message.threshold !== undefined && (obj.threshold = Math.round(message.threshold)); message.disable !== undefined && (obj.disable = message.disable); return obj; }, }; function createBaseArtifactVerificationOptions_TimestampAuthorityOptions() { return { threshold: 0, disable: false }; } exports.ArtifactVerificationOptions_TimestampAuthorityOptions = { fromJSON(object) { return { threshold: isSet(object.threshold) ? Number(object.threshold) : 0, disable: isSet(object.disable) ? Boolean(object.disable) : false, }; }, toJSON(message) { const obj = {}; message.threshold !== undefined && (obj.threshold = Math.round(message.threshold)); message.disable !== undefined && (obj.disable = message.disable); return obj; }, }; function createBaseArtifactVerificationOptions_TlogIntegratedTimestampOptions() { return { threshold: 0, disable: false }; } exports.ArtifactVerificationOptions_TlogIntegratedTimestampOptions = { fromJSON(object) { return { threshold: isSet(object.threshold) ? Number(object.threshold) : 0, disable: isSet(object.disable) ? Boolean(object.disable) : false, }; }, toJSON(message) { const obj = {}; message.threshold !== undefined && (obj.threshold = Math.round(message.threshold)); message.disable !== undefined && (obj.disable = message.disable); return obj; }, }; function createBaseArtifactVerificationOptions_ObserverTimestampOptions() { return { threshold: 0, disable: false }; } exports.ArtifactVerificationOptions_ObserverTimestampOptions = { fromJSON(object) { return { threshold: isSet(object.threshold) ? Number(object.threshold) : 0, disable: isSet(object.disable) ? Boolean(object.disable) : false, }; }, toJSON(message) { const obj = {}; message.threshold !== undefined && (obj.threshold = Math.round(message.threshold)); message.disable !== undefined && (obj.disable = message.disable); return obj; }, }; function createBaseArtifact() { return { data: undefined }; } exports.Artifact = { fromJSON(object) { return { data: isSet(object.artifactUri) ? { $case: "artifactUri", artifactUri: String(object.artifactUri) } : isSet(object.artifact) ? { $case: "artifact", artifact: Buffer.from(bytesFromBase64(object.artifact)) } : undefined, }; }, toJSON(message) { const obj = {}; message.data?.$case === "artifactUri" && (obj.artifactUri = message.data?.artifactUri); message.data?.$case === "artifact" && (obj.artifact = message.data?.artifact !== undefined ? base64FromBytes(message.data?.artifact) : undefined); return obj; }, }; function createBaseInput() { return { artifactTrustRoot: undefined, artifactVerificationOptions: undefined, bundle: undefined, artifact: undefined, }; } exports.Input = { fromJSON(object) { return { artifactTrustRoot: isSet(object.artifactTrustRoot) ? sigstore_trustroot_1.TrustedRoot.fromJSON(object.artifactTrustRoot) : undefined, artifactVerificationOptions: isSet(object.artifactVerificationOptions) ? exports.ArtifactVerificationOptions.fromJSON(object.artifactVerificationOptions) : undefined, bundle: isSet(object.bundle) ? sigstore_bundle_1.Bundle.fromJSON(object.bundle) : undefined, artifact: isSet(object.artifact) ? exports.Artifact.fromJSON(object.artifact) : undefined, }; }, toJSON(message) { const obj = {}; message.artifactTrustRoot !== undefined && (obj.artifactTrustRoot = message.artifactTrustRoot ? sigstore_trustroot_1.TrustedRoot.toJSON(message.artifactTrustRoot) : undefined); message.artifactVerificationOptions !== undefined && (obj.artifactVerificationOptions = message.artifactVerificationOptions ? exports.ArtifactVerificationOptions.toJSON(message.artifactVerificationOptions) : undefined); message.bundle !== undefined && (obj.bundle = message.bundle ? sigstore_bundle_1.Bundle.toJSON(message.bundle) : undefined); message.artifact !== undefined && (obj.artifact = message.artifact ? exports.Artifact.toJSON(message.artifact) : undefined); return obj; }, }; var tsProtoGlobalThis = (() => { if (typeof globalThis !== "undefined") { return globalThis; } if (typeof self !== "undefined") { return self; } if (typeof window !== "undefined") { return window; } if (typeof global !== "undefined") { return global; } throw "Unable to locate global object"; })(); function bytesFromBase64(b64) { if (tsProtoGlobalThis.Buffer) { return Uint8Array.from(tsProtoGlobalThis.Buffer.from(b64, "base64")); } else { const bin = tsProtoGlobalThis.atob(b64); const arr = new Uint8Array(bin.length); for (let i = 0; i < bin.length; ++i) { arr[i] = bin.charCodeAt(i); } return arr; } } function base64FromBytes(arr) { if (tsProtoGlobalThis.Buffer) { return tsProtoGlobalThis.Buffer.from(arr).toString("base64"); } else { const bin = []; arr.forEach((byte) => { bin.push(String.fromCharCode(byte)); }); return tsProtoGlobalThis.btoa(bin.join("")); } } function isSet(value) { return value !== null && value !== undefined; } protobuf-specs/dist/__generated__/google/api/field_behavior.js000064400000011203151701425750020545 0ustar00"use strict"; /* eslint-disable */ Object.defineProperty(exports, "__esModule", { value: true }); exports.fieldBehaviorToJSON = exports.fieldBehaviorFromJSON = exports.FieldBehavior = void 0; /** * An indicator of the behavior of a given field (for example, that a field * is required in requests, or given as output but ignored as input). * This **does not** change the behavior in protocol buffers itself; it only * denotes the behavior and may affect how API tooling handles the field. * * Note: This enum **may** receive new values in the future. */ var FieldBehavior; (function (FieldBehavior) { /** FIELD_BEHAVIOR_UNSPECIFIED - Conventional default for enums. Do not use this. */ FieldBehavior[FieldBehavior["FIELD_BEHAVIOR_UNSPECIFIED"] = 0] = "FIELD_BEHAVIOR_UNSPECIFIED"; /** * OPTIONAL - Specifically denotes a field as optional. * While all fields in protocol buffers are optional, this may be specified * for emphasis if appropriate. */ FieldBehavior[FieldBehavior["OPTIONAL"] = 1] = "OPTIONAL"; /** * REQUIRED - Denotes a field as required. * This indicates that the field **must** be provided as part of the request, * and failure to do so will cause an error (usually `INVALID_ARGUMENT`). */ FieldBehavior[FieldBehavior["REQUIRED"] = 2] = "REQUIRED"; /** * OUTPUT_ONLY - Denotes a field as output only. * This indicates that the field is provided in responses, but including the * field in a request does nothing (the server *must* ignore it and * *must not* throw an error as a result of the field's presence). */ FieldBehavior[FieldBehavior["OUTPUT_ONLY"] = 3] = "OUTPUT_ONLY"; /** * INPUT_ONLY - Denotes a field as input only. * This indicates that the field is provided in requests, and the * corresponding field is not included in output. */ FieldBehavior[FieldBehavior["INPUT_ONLY"] = 4] = "INPUT_ONLY"; /** * IMMUTABLE - Denotes a field as immutable. * This indicates that the field may be set once in a request to create a * resource, but may not be changed thereafter. */ FieldBehavior[FieldBehavior["IMMUTABLE"] = 5] = "IMMUTABLE"; /** * UNORDERED_LIST - Denotes that a (repeated) field is an unordered list. * This indicates that the service may provide the elements of the list * in any arbitrary order, rather than the order the user originally * provided. Additionally, the list's order may or may not be stable. */ FieldBehavior[FieldBehavior["UNORDERED_LIST"] = 6] = "UNORDERED_LIST"; })(FieldBehavior = exports.FieldBehavior || (exports.FieldBehavior = {})); function fieldBehaviorFromJSON(object) { switch (object) { case 0: case "FIELD_BEHAVIOR_UNSPECIFIED": return FieldBehavior.FIELD_BEHAVIOR_UNSPECIFIED; case 1: case "OPTIONAL": return FieldBehavior.OPTIONAL; case 2: case "REQUIRED": return FieldBehavior.REQUIRED; case 3: case "OUTPUT_ONLY": return FieldBehavior.OUTPUT_ONLY; case 4: case "INPUT_ONLY": return FieldBehavior.INPUT_ONLY; case 5: case "IMMUTABLE": return FieldBehavior.IMMUTABLE; case 6: case "UNORDERED_LIST": return FieldBehavior.UNORDERED_LIST; default: throw new tsProtoGlobalThis.Error("Unrecognized enum value " + object + " for enum FieldBehavior"); } } exports.fieldBehaviorFromJSON = fieldBehaviorFromJSON; function fieldBehaviorToJSON(object) { switch (object) { case FieldBehavior.FIELD_BEHAVIOR_UNSPECIFIED: return "FIELD_BEHAVIOR_UNSPECIFIED"; case FieldBehavior.OPTIONAL: return "OPTIONAL"; case FieldBehavior.REQUIRED: return "REQUIRED"; case FieldBehavior.OUTPUT_ONLY: return "OUTPUT_ONLY"; case FieldBehavior.INPUT_ONLY: return "INPUT_ONLY"; case FieldBehavior.IMMUTABLE: return "IMMUTABLE"; case FieldBehavior.UNORDERED_LIST: return "UNORDERED_LIST"; default: throw new tsProtoGlobalThis.Error("Unrecognized enum value " + object + " for enum FieldBehavior"); } } exports.fieldBehaviorToJSON = fieldBehaviorToJSON; var tsProtoGlobalThis = (() => { if (typeof globalThis !== "undefined") { return globalThis; } if (typeof self !== "undefined") { return self; } if (typeof window !== "undefined") { return window; } if (typeof global !== "undefined") { return global; } throw "Unable to locate global object"; })(); protobuf-specs/dist/__generated__/google/protobuf/timestamp.js000064400000001330151701425750020675 0ustar00"use strict"; /* eslint-disable */ Object.defineProperty(exports, "__esModule", { value: true }); exports.Timestamp = void 0; function createBaseTimestamp() { return { seconds: "0", nanos: 0 }; } exports.Timestamp = { fromJSON(object) { return { seconds: isSet(object.seconds) ? String(object.seconds) : "0", nanos: isSet(object.nanos) ? Number(object.nanos) : 0, }; }, toJSON(message) { const obj = {}; message.seconds !== undefined && (obj.seconds = message.seconds); message.nanos !== undefined && (obj.nanos = Math.round(message.nanos)); return obj; }, }; function isSet(value) { return value !== null && value !== undefined; } protobuf-specs/dist/__generated__/google/protobuf/any.js000064400000003564151701425750017474 0ustar00"use strict"; /* eslint-disable */ Object.defineProperty(exports, "__esModule", { value: true }); exports.Any = void 0; function createBaseAny() { return { typeUrl: "", value: Buffer.alloc(0) }; } exports.Any = { fromJSON(object) { return { typeUrl: isSet(object.typeUrl) ? String(object.typeUrl) : "", value: isSet(object.value) ? Buffer.from(bytesFromBase64(object.value)) : Buffer.alloc(0), }; }, toJSON(message) { const obj = {}; message.typeUrl !== undefined && (obj.typeUrl = message.typeUrl); message.value !== undefined && (obj.value = base64FromBytes(message.value !== undefined ? message.value : Buffer.alloc(0))); return obj; }, }; var tsProtoGlobalThis = (() => { if (typeof globalThis !== "undefined") { return globalThis; } if (typeof self !== "undefined") { return self; } if (typeof window !== "undefined") { return window; } if (typeof global !== "undefined") { return global; } throw "Unable to locate global object"; })(); function bytesFromBase64(b64) { if (tsProtoGlobalThis.Buffer) { return Uint8Array.from(tsProtoGlobalThis.Buffer.from(b64, "base64")); } else { const bin = tsProtoGlobalThis.atob(b64); const arr = new Uint8Array(bin.length); for (let i = 0; i < bin.length; ++i) { arr[i] = bin.charCodeAt(i); } return arr; } } function base64FromBytes(arr) { if (tsProtoGlobalThis.Buffer) { return tsProtoGlobalThis.Buffer.from(arr).toString("base64"); } else { const bin = []; arr.forEach((byte) => { bin.push(String.fromCharCode(byte)); }); return tsProtoGlobalThis.btoa(bin.join("")); } } function isSet(value) { return value !== null && value !== undefined; } protobuf-specs/dist/__generated__/google/protobuf/descriptor.js000064400000157734151701425750021074 0ustar00"use strict"; /* eslint-disable */ Object.defineProperty(exports, "__esModule", { value: true }); exports.GeneratedCodeInfo_Annotation = exports.GeneratedCodeInfo = exports.SourceCodeInfo_Location = exports.SourceCodeInfo = exports.UninterpretedOption_NamePart = exports.UninterpretedOption = exports.MethodOptions = exports.ServiceOptions = exports.EnumValueOptions = exports.EnumOptions = exports.OneofOptions = exports.FieldOptions = exports.MessageOptions = exports.FileOptions = exports.MethodDescriptorProto = exports.ServiceDescriptorProto = exports.EnumValueDescriptorProto = exports.EnumDescriptorProto_EnumReservedRange = exports.EnumDescriptorProto = exports.OneofDescriptorProto = exports.FieldDescriptorProto = exports.ExtensionRangeOptions = exports.DescriptorProto_ReservedRange = exports.DescriptorProto_ExtensionRange = exports.DescriptorProto = exports.FileDescriptorProto = exports.FileDescriptorSet = exports.methodOptions_IdempotencyLevelToJSON = exports.methodOptions_IdempotencyLevelFromJSON = exports.MethodOptions_IdempotencyLevel = exports.fieldOptions_JSTypeToJSON = exports.fieldOptions_JSTypeFromJSON = exports.FieldOptions_JSType = exports.fieldOptions_CTypeToJSON = exports.fieldOptions_CTypeFromJSON = exports.FieldOptions_CType = exports.fileOptions_OptimizeModeToJSON = exports.fileOptions_OptimizeModeFromJSON = exports.FileOptions_OptimizeMode = exports.fieldDescriptorProto_LabelToJSON = exports.fieldDescriptorProto_LabelFromJSON = exports.FieldDescriptorProto_Label = exports.fieldDescriptorProto_TypeToJSON = exports.fieldDescriptorProto_TypeFromJSON = exports.FieldDescriptorProto_Type = void 0; var FieldDescriptorProto_Type; (function (FieldDescriptorProto_Type) { /** * TYPE_DOUBLE - 0 is reserved for errors. * Order is weird for historical reasons. */ FieldDescriptorProto_Type[FieldDescriptorProto_Type["TYPE_DOUBLE"] = 1] = "TYPE_DOUBLE"; FieldDescriptorProto_Type[FieldDescriptorProto_Type["TYPE_FLOAT"] = 2] = "TYPE_FLOAT"; /** * TYPE_INT64 - Not ZigZag encoded. Negative numbers take 10 bytes. Use TYPE_SINT64 if * negative values are likely. */ FieldDescriptorProto_Type[FieldDescriptorProto_Type["TYPE_INT64"] = 3] = "TYPE_INT64"; FieldDescriptorProto_Type[FieldDescriptorProto_Type["TYPE_UINT64"] = 4] = "TYPE_UINT64"; /** * TYPE_INT32 - Not ZigZag encoded. Negative numbers take 10 bytes. Use TYPE_SINT32 if * negative values are likely. */ FieldDescriptorProto_Type[FieldDescriptorProto_Type["TYPE_INT32"] = 5] = "TYPE_INT32"; FieldDescriptorProto_Type[FieldDescriptorProto_Type["TYPE_FIXED64"] = 6] = "TYPE_FIXED64"; FieldDescriptorProto_Type[FieldDescriptorProto_Type["TYPE_FIXED32"] = 7] = "TYPE_FIXED32"; FieldDescriptorProto_Type[FieldDescriptorProto_Type["TYPE_BOOL"] = 8] = "TYPE_BOOL"; FieldDescriptorProto_Type[FieldDescriptorProto_Type["TYPE_STRING"] = 9] = "TYPE_STRING"; /** * TYPE_GROUP - Tag-delimited aggregate. * Group type is deprecated and not supported in proto3. However, Proto3 * implementations should still be able to parse the group wire format and * treat group fields as unknown fields. */ FieldDescriptorProto_Type[FieldDescriptorProto_Type["TYPE_GROUP"] = 10] = "TYPE_GROUP"; /** TYPE_MESSAGE - Length-delimited aggregate. */ FieldDescriptorProto_Type[FieldDescriptorProto_Type["TYPE_MESSAGE"] = 11] = "TYPE_MESSAGE"; /** TYPE_BYTES - New in version 2. */ FieldDescriptorProto_Type[FieldDescriptorProto_Type["TYPE_BYTES"] = 12] = "TYPE_BYTES"; FieldDescriptorProto_Type[FieldDescriptorProto_Type["TYPE_UINT32"] = 13] = "TYPE_UINT32"; FieldDescriptorProto_Type[FieldDescriptorProto_Type["TYPE_ENUM"] = 14] = "TYPE_ENUM"; FieldDescriptorProto_Type[FieldDescriptorProto_Type["TYPE_SFIXED32"] = 15] = "TYPE_SFIXED32"; FieldDescriptorProto_Type[FieldDescriptorProto_Type["TYPE_SFIXED64"] = 16] = "TYPE_SFIXED64"; /** TYPE_SINT32 - Uses ZigZag encoding. */ FieldDescriptorProto_Type[FieldDescriptorProto_Type["TYPE_SINT32"] = 17] = "TYPE_SINT32"; /** TYPE_SINT64 - Uses ZigZag encoding. */ FieldDescriptorProto_Type[FieldDescriptorProto_Type["TYPE_SINT64"] = 18] = "TYPE_SINT64"; })(FieldDescriptorProto_Type = exports.FieldDescriptorProto_Type || (exports.FieldDescriptorProto_Type = {})); function fieldDescriptorProto_TypeFromJSON(object) { switch (object) { case 1: case "TYPE_DOUBLE": return FieldDescriptorProto_Type.TYPE_DOUBLE; case 2: case "TYPE_FLOAT": return FieldDescriptorProto_Type.TYPE_FLOAT; case 3: case "TYPE_INT64": return FieldDescriptorProto_Type.TYPE_INT64; case 4: case "TYPE_UINT64": return FieldDescriptorProto_Type.TYPE_UINT64; case 5: case "TYPE_INT32": return FieldDescriptorProto_Type.TYPE_INT32; case 6: case "TYPE_FIXED64": return FieldDescriptorProto_Type.TYPE_FIXED64; case 7: case "TYPE_FIXED32": return FieldDescriptorProto_Type.TYPE_FIXED32; case 8: case "TYPE_BOOL": return FieldDescriptorProto_Type.TYPE_BOOL; case 9: case "TYPE_STRING": return FieldDescriptorProto_Type.TYPE_STRING; case 10: case "TYPE_GROUP": return FieldDescriptorProto_Type.TYPE_GROUP; case 11: case "TYPE_MESSAGE": return FieldDescriptorProto_Type.TYPE_MESSAGE; case 12: case "TYPE_BYTES": return FieldDescriptorProto_Type.TYPE_BYTES; case 13: case "TYPE_UINT32": return FieldDescriptorProto_Type.TYPE_UINT32; case 14: case "TYPE_ENUM": return FieldDescriptorProto_Type.TYPE_ENUM; case 15: case "TYPE_SFIXED32": return FieldDescriptorProto_Type.TYPE_SFIXED32; case 16: case "TYPE_SFIXED64": return FieldDescriptorProto_Type.TYPE_SFIXED64; case 17: case "TYPE_SINT32": return FieldDescriptorProto_Type.TYPE_SINT32; case 18: case "TYPE_SINT64": return FieldDescriptorProto_Type.TYPE_SINT64; default: throw new tsProtoGlobalThis.Error("Unrecognized enum value " + object + " for enum FieldDescriptorProto_Type"); } } exports.fieldDescriptorProto_TypeFromJSON = fieldDescriptorProto_TypeFromJSON; function fieldDescriptorProto_TypeToJSON(object) { switch (object) { case FieldDescriptorProto_Type.TYPE_DOUBLE: return "TYPE_DOUBLE"; case FieldDescriptorProto_Type.TYPE_FLOAT: return "TYPE_FLOAT"; case FieldDescriptorProto_Type.TYPE_INT64: return "TYPE_INT64"; case FieldDescriptorProto_Type.TYPE_UINT64: return "TYPE_UINT64"; case FieldDescriptorProto_Type.TYPE_INT32: return "TYPE_INT32"; case FieldDescriptorProto_Type.TYPE_FIXED64: return "TYPE_FIXED64"; case FieldDescriptorProto_Type.TYPE_FIXED32: return "TYPE_FIXED32"; case FieldDescriptorProto_Type.TYPE_BOOL: return "TYPE_BOOL"; case FieldDescriptorProto_Type.TYPE_STRING: return "TYPE_STRING"; case FieldDescriptorProto_Type.TYPE_GROUP: return "TYPE_GROUP"; case FieldDescriptorProto_Type.TYPE_MESSAGE: return "TYPE_MESSAGE"; case FieldDescriptorProto_Type.TYPE_BYTES: return "TYPE_BYTES"; case FieldDescriptorProto_Type.TYPE_UINT32: return "TYPE_UINT32"; case FieldDescriptorProto_Type.TYPE_ENUM: return "TYPE_ENUM"; case FieldDescriptorProto_Type.TYPE_SFIXED32: return "TYPE_SFIXED32"; case FieldDescriptorProto_Type.TYPE_SFIXED64: return "TYPE_SFIXED64"; case FieldDescriptorProto_Type.TYPE_SINT32: return "TYPE_SINT32"; case FieldDescriptorProto_Type.TYPE_SINT64: return "TYPE_SINT64"; default: throw new tsProtoGlobalThis.Error("Unrecognized enum value " + object + " for enum FieldDescriptorProto_Type"); } } exports.fieldDescriptorProto_TypeToJSON = fieldDescriptorProto_TypeToJSON; var FieldDescriptorProto_Label; (function (FieldDescriptorProto_Label) { /** LABEL_OPTIONAL - 0 is reserved for errors */ FieldDescriptorProto_Label[FieldDescriptorProto_Label["LABEL_OPTIONAL"] = 1] = "LABEL_OPTIONAL"; FieldDescriptorProto_Label[FieldDescriptorProto_Label["LABEL_REQUIRED"] = 2] = "LABEL_REQUIRED"; FieldDescriptorProto_Label[FieldDescriptorProto_Label["LABEL_REPEATED"] = 3] = "LABEL_REPEATED"; })(FieldDescriptorProto_Label = exports.FieldDescriptorProto_Label || (exports.FieldDescriptorProto_Label = {})); function fieldDescriptorProto_LabelFromJSON(object) { switch (object) { case 1: case "LABEL_OPTIONAL": return FieldDescriptorProto_Label.LABEL_OPTIONAL; case 2: case "LABEL_REQUIRED": return FieldDescriptorProto_Label.LABEL_REQUIRED; case 3: case "LABEL_REPEATED": return FieldDescriptorProto_Label.LABEL_REPEATED; default: throw new tsProtoGlobalThis.Error("Unrecognized enum value " + object + " for enum FieldDescriptorProto_Label"); } } exports.fieldDescriptorProto_LabelFromJSON = fieldDescriptorProto_LabelFromJSON; function fieldDescriptorProto_LabelToJSON(object) { switch (object) { case FieldDescriptorProto_Label.LABEL_OPTIONAL: return "LABEL_OPTIONAL"; case FieldDescriptorProto_Label.LABEL_REQUIRED: return "LABEL_REQUIRED"; case FieldDescriptorProto_Label.LABEL_REPEATED: return "LABEL_REPEATED"; default: throw new tsProtoGlobalThis.Error("Unrecognized enum value " + object + " for enum FieldDescriptorProto_Label"); } } exports.fieldDescriptorProto_LabelToJSON = fieldDescriptorProto_LabelToJSON; /** Generated classes can be optimized for speed or code size. */ var FileOptions_OptimizeMode; (function (FileOptions_OptimizeMode) { /** SPEED - Generate complete code for parsing, serialization, */ FileOptions_OptimizeMode[FileOptions_OptimizeMode["SPEED"] = 1] = "SPEED"; /** CODE_SIZE - etc. */ FileOptions_OptimizeMode[FileOptions_OptimizeMode["CODE_SIZE"] = 2] = "CODE_SIZE"; /** LITE_RUNTIME - Generate code using MessageLite and the lite runtime. */ FileOptions_OptimizeMode[FileOptions_OptimizeMode["LITE_RUNTIME"] = 3] = "LITE_RUNTIME"; })(FileOptions_OptimizeMode = exports.FileOptions_OptimizeMode || (exports.FileOptions_OptimizeMode = {})); function fileOptions_OptimizeModeFromJSON(object) { switch (object) { case 1: case "SPEED": return FileOptions_OptimizeMode.SPEED; case 2: case "CODE_SIZE": return FileOptions_OptimizeMode.CODE_SIZE; case 3: case "LITE_RUNTIME": return FileOptions_OptimizeMode.LITE_RUNTIME; default: throw new tsProtoGlobalThis.Error("Unrecognized enum value " + object + " for enum FileOptions_OptimizeMode"); } } exports.fileOptions_OptimizeModeFromJSON = fileOptions_OptimizeModeFromJSON; function fileOptions_OptimizeModeToJSON(object) { switch (object) { case FileOptions_OptimizeMode.SPEED: return "SPEED"; case FileOptions_OptimizeMode.CODE_SIZE: return "CODE_SIZE"; case FileOptions_OptimizeMode.LITE_RUNTIME: return "LITE_RUNTIME"; default: throw new tsProtoGlobalThis.Error("Unrecognized enum value " + object + " for enum FileOptions_OptimizeMode"); } } exports.fileOptions_OptimizeModeToJSON = fileOptions_OptimizeModeToJSON; var FieldOptions_CType; (function (FieldOptions_CType) { /** STRING - Default mode. */ FieldOptions_CType[FieldOptions_CType["STRING"] = 0] = "STRING"; FieldOptions_CType[FieldOptions_CType["CORD"] = 1] = "CORD"; FieldOptions_CType[FieldOptions_CType["STRING_PIECE"] = 2] = "STRING_PIECE"; })(FieldOptions_CType = exports.FieldOptions_CType || (exports.FieldOptions_CType = {})); function fieldOptions_CTypeFromJSON(object) { switch (object) { case 0: case "STRING": return FieldOptions_CType.STRING; case 1: case "CORD": return FieldOptions_CType.CORD; case 2: case "STRING_PIECE": return FieldOptions_CType.STRING_PIECE; default: throw new tsProtoGlobalThis.Error("Unrecognized enum value " + object + " for enum FieldOptions_CType"); } } exports.fieldOptions_CTypeFromJSON = fieldOptions_CTypeFromJSON; function fieldOptions_CTypeToJSON(object) { switch (object) { case FieldOptions_CType.STRING: return "STRING"; case FieldOptions_CType.CORD: return "CORD"; case FieldOptions_CType.STRING_PIECE: return "STRING_PIECE"; default: throw new tsProtoGlobalThis.Error("Unrecognized enum value " + object + " for enum FieldOptions_CType"); } } exports.fieldOptions_CTypeToJSON = fieldOptions_CTypeToJSON; var FieldOptions_JSType; (function (FieldOptions_JSType) { /** JS_NORMAL - Use the default type. */ FieldOptions_JSType[FieldOptions_JSType["JS_NORMAL"] = 0] = "JS_NORMAL"; /** JS_STRING - Use JavaScript strings. */ FieldOptions_JSType[FieldOptions_JSType["JS_STRING"] = 1] = "JS_STRING"; /** JS_NUMBER - Use JavaScript numbers. */ FieldOptions_JSType[FieldOptions_JSType["JS_NUMBER"] = 2] = "JS_NUMBER"; })(FieldOptions_JSType = exports.FieldOptions_JSType || (exports.FieldOptions_JSType = {})); function fieldOptions_JSTypeFromJSON(object) { switch (object) { case 0: case "JS_NORMAL": return FieldOptions_JSType.JS_NORMAL; case 1: case "JS_STRING": return FieldOptions_JSType.JS_STRING; case 2: case "JS_NUMBER": return FieldOptions_JSType.JS_NUMBER; default: throw new tsProtoGlobalThis.Error("Unrecognized enum value " + object + " for enum FieldOptions_JSType"); } } exports.fieldOptions_JSTypeFromJSON = fieldOptions_JSTypeFromJSON; function fieldOptions_JSTypeToJSON(object) { switch (object) { case FieldOptions_JSType.JS_NORMAL: return "JS_NORMAL"; case FieldOptions_JSType.JS_STRING: return "JS_STRING"; case FieldOptions_JSType.JS_NUMBER: return "JS_NUMBER"; default: throw new tsProtoGlobalThis.Error("Unrecognized enum value " + object + " for enum FieldOptions_JSType"); } } exports.fieldOptions_JSTypeToJSON = fieldOptions_JSTypeToJSON; /** * Is this method side-effect-free (or safe in HTTP parlance), or idempotent, * or neither? HTTP based RPC implementation may choose GET verb for safe * methods, and PUT verb for idempotent methods instead of the default POST. */ var MethodOptions_IdempotencyLevel; (function (MethodOptions_IdempotencyLevel) { MethodOptions_IdempotencyLevel[MethodOptions_IdempotencyLevel["IDEMPOTENCY_UNKNOWN"] = 0] = "IDEMPOTENCY_UNKNOWN"; /** NO_SIDE_EFFECTS - implies idempotent */ MethodOptions_IdempotencyLevel[MethodOptions_IdempotencyLevel["NO_SIDE_EFFECTS"] = 1] = "NO_SIDE_EFFECTS"; /** IDEMPOTENT - idempotent, but may have side effects */ MethodOptions_IdempotencyLevel[MethodOptions_IdempotencyLevel["IDEMPOTENT"] = 2] = "IDEMPOTENT"; })(MethodOptions_IdempotencyLevel = exports.MethodOptions_IdempotencyLevel || (exports.MethodOptions_IdempotencyLevel = {})); function methodOptions_IdempotencyLevelFromJSON(object) { switch (object) { case 0: case "IDEMPOTENCY_UNKNOWN": return MethodOptions_IdempotencyLevel.IDEMPOTENCY_UNKNOWN; case 1: case "NO_SIDE_EFFECTS": return MethodOptions_IdempotencyLevel.NO_SIDE_EFFECTS; case 2: case "IDEMPOTENT": return MethodOptions_IdempotencyLevel.IDEMPOTENT; default: throw new tsProtoGlobalThis.Error("Unrecognized enum value " + object + " for enum MethodOptions_IdempotencyLevel"); } } exports.methodOptions_IdempotencyLevelFromJSON = methodOptions_IdempotencyLevelFromJSON; function methodOptions_IdempotencyLevelToJSON(object) { switch (object) { case MethodOptions_IdempotencyLevel.IDEMPOTENCY_UNKNOWN: return "IDEMPOTENCY_UNKNOWN"; case MethodOptions_IdempotencyLevel.NO_SIDE_EFFECTS: return "NO_SIDE_EFFECTS"; case MethodOptions_IdempotencyLevel.IDEMPOTENT: return "IDEMPOTENT"; default: throw new tsProtoGlobalThis.Error("Unrecognized enum value " + object + " for enum MethodOptions_IdempotencyLevel"); } } exports.methodOptions_IdempotencyLevelToJSON = methodOptions_IdempotencyLevelToJSON; function createBaseFileDescriptorSet() { return { file: [] }; } exports.FileDescriptorSet = { fromJSON(object) { return { file: Array.isArray(object?.file) ? object.file.map((e) => exports.FileDescriptorProto.fromJSON(e)) : [] }; }, toJSON(message) { const obj = {}; if (message.file) { obj.file = message.file.map((e) => e ? exports.FileDescriptorProto.toJSON(e) : undefined); } else { obj.file = []; } return obj; }, }; function createBaseFileDescriptorProto() { return { name: "", package: "", dependency: [], publicDependency: [], weakDependency: [], messageType: [], enumType: [], service: [], extension: [], options: undefined, sourceCodeInfo: undefined, syntax: "", }; } exports.FileDescriptorProto = { fromJSON(object) { return { name: isSet(object.name) ? String(object.name) : "", package: isSet(object.package) ? String(object.package) : "", dependency: Array.isArray(object?.dependency) ? object.dependency.map((e) => String(e)) : [], publicDependency: Array.isArray(object?.publicDependency) ? object.publicDependency.map((e) => Number(e)) : [], weakDependency: Array.isArray(object?.weakDependency) ? object.weakDependency.map((e) => Number(e)) : [], messageType: Array.isArray(object?.messageType) ? object.messageType.map((e) => exports.DescriptorProto.fromJSON(e)) : [], enumType: Array.isArray(object?.enumType) ? object.enumType.map((e) => exports.EnumDescriptorProto.fromJSON(e)) : [], service: Array.isArray(object?.service) ? object.service.map((e) => exports.ServiceDescriptorProto.fromJSON(e)) : [], extension: Array.isArray(object?.extension) ? object.extension.map((e) => exports.FieldDescriptorProto.fromJSON(e)) : [], options: isSet(object.options) ? exports.FileOptions.fromJSON(object.options) : undefined, sourceCodeInfo: isSet(object.sourceCodeInfo) ? exports.SourceCodeInfo.fromJSON(object.sourceCodeInfo) : undefined, syntax: isSet(object.syntax) ? String(object.syntax) : "", }; }, toJSON(message) { const obj = {}; message.name !== undefined && (obj.name = message.name); message.package !== undefined && (obj.package = message.package); if (message.dependency) { obj.dependency = message.dependency.map((e) => e); } else { obj.dependency = []; } if (message.publicDependency) { obj.publicDependency = message.publicDependency.map((e) => Math.round(e)); } else { obj.publicDependency = []; } if (message.weakDependency) { obj.weakDependency = message.weakDependency.map((e) => Math.round(e)); } else { obj.weakDependency = []; } if (message.messageType) { obj.messageType = message.messageType.map((e) => e ? exports.DescriptorProto.toJSON(e) : undefined); } else { obj.messageType = []; } if (message.enumType) { obj.enumType = message.enumType.map((e) => e ? exports.EnumDescriptorProto.toJSON(e) : undefined); } else { obj.enumType = []; } if (message.service) { obj.service = message.service.map((e) => e ? exports.ServiceDescriptorProto.toJSON(e) : undefined); } else { obj.service = []; } if (message.extension) { obj.extension = message.extension.map((e) => e ? exports.FieldDescriptorProto.toJSON(e) : undefined); } else { obj.extension = []; } message.options !== undefined && (obj.options = message.options ? exports.FileOptions.toJSON(message.options) : undefined); message.sourceCodeInfo !== undefined && (obj.sourceCodeInfo = message.sourceCodeInfo ? exports.SourceCodeInfo.toJSON(message.sourceCodeInfo) : undefined); message.syntax !== undefined && (obj.syntax = message.syntax); return obj; }, }; function createBaseDescriptorProto() { return { name: "", field: [], extension: [], nestedType: [], enumType: [], extensionRange: [], oneofDecl: [], options: undefined, reservedRange: [], reservedName: [], }; } exports.DescriptorProto = { fromJSON(object) { return { name: isSet(object.name) ? String(object.name) : "", field: Array.isArray(object?.field) ? object.field.map((e) => exports.FieldDescriptorProto.fromJSON(e)) : [], extension: Array.isArray(object?.extension) ? object.extension.map((e) => exports.FieldDescriptorProto.fromJSON(e)) : [], nestedType: Array.isArray(object?.nestedType) ? object.nestedType.map((e) => exports.DescriptorProto.fromJSON(e)) : [], enumType: Array.isArray(object?.enumType) ? object.enumType.map((e) => exports.EnumDescriptorProto.fromJSON(e)) : [], extensionRange: Array.isArray(object?.extensionRange) ? object.extensionRange.map((e) => exports.DescriptorProto_ExtensionRange.fromJSON(e)) : [], oneofDecl: Array.isArray(object?.oneofDecl) ? object.oneofDecl.map((e) => exports.OneofDescriptorProto.fromJSON(e)) : [], options: isSet(object.options) ? exports.MessageOptions.fromJSON(object.options) : undefined, reservedRange: Array.isArray(object?.reservedRange) ? object.reservedRange.map((e) => exports.DescriptorProto_ReservedRange.fromJSON(e)) : [], reservedName: Array.isArray(object?.reservedName) ? object.reservedName.map((e) => String(e)) : [], }; }, toJSON(message) { const obj = {}; message.name !== undefined && (obj.name = message.name); if (message.field) { obj.field = message.field.map((e) => e ? exports.FieldDescriptorProto.toJSON(e) : undefined); } else { obj.field = []; } if (message.extension) { obj.extension = message.extension.map((e) => e ? exports.FieldDescriptorProto.toJSON(e) : undefined); } else { obj.extension = []; } if (message.nestedType) { obj.nestedType = message.nestedType.map((e) => e ? exports.DescriptorProto.toJSON(e) : undefined); } else { obj.nestedType = []; } if (message.enumType) { obj.enumType = message.enumType.map((e) => e ? exports.EnumDescriptorProto.toJSON(e) : undefined); } else { obj.enumType = []; } if (message.extensionRange) { obj.extensionRange = message.extensionRange.map((e) => e ? exports.DescriptorProto_ExtensionRange.toJSON(e) : undefined); } else { obj.extensionRange = []; } if (message.oneofDecl) { obj.oneofDecl = message.oneofDecl.map((e) => e ? exports.OneofDescriptorProto.toJSON(e) : undefined); } else { obj.oneofDecl = []; } message.options !== undefined && (obj.options = message.options ? exports.MessageOptions.toJSON(message.options) : undefined); if (message.reservedRange) { obj.reservedRange = message.reservedRange.map((e) => e ? exports.DescriptorProto_ReservedRange.toJSON(e) : undefined); } else { obj.reservedRange = []; } if (message.reservedName) { obj.reservedName = message.reservedName.map((e) => e); } else { obj.reservedName = []; } return obj; }, }; function createBaseDescriptorProto_ExtensionRange() { return { start: 0, end: 0, options: undefined }; } exports.DescriptorProto_ExtensionRange = { fromJSON(object) { return { start: isSet(object.start) ? Number(object.start) : 0, end: isSet(object.end) ? Number(object.end) : 0, options: isSet(object.options) ? exports.ExtensionRangeOptions.fromJSON(object.options) : undefined, }; }, toJSON(message) { const obj = {}; message.start !== undefined && (obj.start = Math.round(message.start)); message.end !== undefined && (obj.end = Math.round(message.end)); message.options !== undefined && (obj.options = message.options ? exports.ExtensionRangeOptions.toJSON(message.options) : undefined); return obj; }, }; function createBaseDescriptorProto_ReservedRange() { return { start: 0, end: 0 }; } exports.DescriptorProto_ReservedRange = { fromJSON(object) { return { start: isSet(object.start) ? Number(object.start) : 0, end: isSet(object.end) ? Number(object.end) : 0 }; }, toJSON(message) { const obj = {}; message.start !== undefined && (obj.start = Math.round(message.start)); message.end !== undefined && (obj.end = Math.round(message.end)); return obj; }, }; function createBaseExtensionRangeOptions() { return { uninterpretedOption: [] }; } exports.ExtensionRangeOptions = { fromJSON(object) { return { uninterpretedOption: Array.isArray(object?.uninterpretedOption) ? object.uninterpretedOption.map((e) => exports.UninterpretedOption.fromJSON(e)) : [], }; }, toJSON(message) { const obj = {}; if (message.uninterpretedOption) { obj.uninterpretedOption = message.uninterpretedOption.map((e) => e ? exports.UninterpretedOption.toJSON(e) : undefined); } else { obj.uninterpretedOption = []; } return obj; }, }; function createBaseFieldDescriptorProto() { return { name: "", number: 0, label: 1, type: 1, typeName: "", extendee: "", defaultValue: "", oneofIndex: 0, jsonName: "", options: undefined, proto3Optional: false, }; } exports.FieldDescriptorProto = { fromJSON(object) { return { name: isSet(object.name) ? String(object.name) : "", number: isSet(object.number) ? Number(object.number) : 0, label: isSet(object.label) ? fieldDescriptorProto_LabelFromJSON(object.label) : 1, type: isSet(object.type) ? fieldDescriptorProto_TypeFromJSON(object.type) : 1, typeName: isSet(object.typeName) ? String(object.typeName) : "", extendee: isSet(object.extendee) ? String(object.extendee) : "", defaultValue: isSet(object.defaultValue) ? String(object.defaultValue) : "", oneofIndex: isSet(object.oneofIndex) ? Number(object.oneofIndex) : 0, jsonName: isSet(object.jsonName) ? String(object.jsonName) : "", options: isSet(object.options) ? exports.FieldOptions.fromJSON(object.options) : undefined, proto3Optional: isSet(object.proto3Optional) ? Boolean(object.proto3Optional) : false, }; }, toJSON(message) { const obj = {}; message.name !== undefined && (obj.name = message.name); message.number !== undefined && (obj.number = Math.round(message.number)); message.label !== undefined && (obj.label = fieldDescriptorProto_LabelToJSON(message.label)); message.type !== undefined && (obj.type = fieldDescriptorProto_TypeToJSON(message.type)); message.typeName !== undefined && (obj.typeName = message.typeName); message.extendee !== undefined && (obj.extendee = message.extendee); message.defaultValue !== undefined && (obj.defaultValue = message.defaultValue); message.oneofIndex !== undefined && (obj.oneofIndex = Math.round(message.oneofIndex)); message.jsonName !== undefined && (obj.jsonName = message.jsonName); message.options !== undefined && (obj.options = message.options ? exports.FieldOptions.toJSON(message.options) : undefined); message.proto3Optional !== undefined && (obj.proto3Optional = message.proto3Optional); return obj; }, }; function createBaseOneofDescriptorProto() { return { name: "", options: undefined }; } exports.OneofDescriptorProto = { fromJSON(object) { return { name: isSet(object.name) ? String(object.name) : "", options: isSet(object.options) ? exports.OneofOptions.fromJSON(object.options) : undefined, }; }, toJSON(message) { const obj = {}; message.name !== undefined && (obj.name = message.name); message.options !== undefined && (obj.options = message.options ? exports.OneofOptions.toJSON(message.options) : undefined); return obj; }, }; function createBaseEnumDescriptorProto() { return { name: "", value: [], options: undefined, reservedRange: [], reservedName: [] }; } exports.EnumDescriptorProto = { fromJSON(object) { return { name: isSet(object.name) ? String(object.name) : "", value: Array.isArray(object?.value) ? object.value.map((e) => exports.EnumValueDescriptorProto.fromJSON(e)) : [], options: isSet(object.options) ? exports.EnumOptions.fromJSON(object.options) : undefined, reservedRange: Array.isArray(object?.reservedRange) ? object.reservedRange.map((e) => exports.EnumDescriptorProto_EnumReservedRange.fromJSON(e)) : [], reservedName: Array.isArray(object?.reservedName) ? object.reservedName.map((e) => String(e)) : [], }; }, toJSON(message) { const obj = {}; message.name !== undefined && (obj.name = message.name); if (message.value) { obj.value = message.value.map((e) => e ? exports.EnumValueDescriptorProto.toJSON(e) : undefined); } else { obj.value = []; } message.options !== undefined && (obj.options = message.options ? exports.EnumOptions.toJSON(message.options) : undefined); if (message.reservedRange) { obj.reservedRange = message.reservedRange.map((e) => e ? exports.EnumDescriptorProto_EnumReservedRange.toJSON(e) : undefined); } else { obj.reservedRange = []; } if (message.reservedName) { obj.reservedName = message.reservedName.map((e) => e); } else { obj.reservedName = []; } return obj; }, }; function createBaseEnumDescriptorProto_EnumReservedRange() { return { start: 0, end: 0 }; } exports.EnumDescriptorProto_EnumReservedRange = { fromJSON(object) { return { start: isSet(object.start) ? Number(object.start) : 0, end: isSet(object.end) ? Number(object.end) : 0 }; }, toJSON(message) { const obj = {}; message.start !== undefined && (obj.start = Math.round(message.start)); message.end !== undefined && (obj.end = Math.round(message.end)); return obj; }, }; function createBaseEnumValueDescriptorProto() { return { name: "", number: 0, options: undefined }; } exports.EnumValueDescriptorProto = { fromJSON(object) { return { name: isSet(object.name) ? String(object.name) : "", number: isSet(object.number) ? Number(object.number) : 0, options: isSet(object.options) ? exports.EnumValueOptions.fromJSON(object.options) : undefined, }; }, toJSON(message) { const obj = {}; message.name !== undefined && (obj.name = message.name); message.number !== undefined && (obj.number = Math.round(message.number)); message.options !== undefined && (obj.options = message.options ? exports.EnumValueOptions.toJSON(message.options) : undefined); return obj; }, }; function createBaseServiceDescriptorProto() { return { name: "", method: [], options: undefined }; } exports.ServiceDescriptorProto = { fromJSON(object) { return { name: isSet(object.name) ? String(object.name) : "", method: Array.isArray(object?.method) ? object.method.map((e) => exports.MethodDescriptorProto.fromJSON(e)) : [], options: isSet(object.options) ? exports.ServiceOptions.fromJSON(object.options) : undefined, }; }, toJSON(message) { const obj = {}; message.name !== undefined && (obj.name = message.name); if (message.method) { obj.method = message.method.map((e) => e ? exports.MethodDescriptorProto.toJSON(e) : undefined); } else { obj.method = []; } message.options !== undefined && (obj.options = message.options ? exports.ServiceOptions.toJSON(message.options) : undefined); return obj; }, }; function createBaseMethodDescriptorProto() { return { name: "", inputType: "", outputType: "", options: undefined, clientStreaming: false, serverStreaming: false, }; } exports.MethodDescriptorProto = { fromJSON(object) { return { name: isSet(object.name) ? String(object.name) : "", inputType: isSet(object.inputType) ? String(object.inputType) : "", outputType: isSet(object.outputType) ? String(object.outputType) : "", options: isSet(object.options) ? exports.MethodOptions.fromJSON(object.options) : undefined, clientStreaming: isSet(object.clientStreaming) ? Boolean(object.clientStreaming) : false, serverStreaming: isSet(object.serverStreaming) ? Boolean(object.serverStreaming) : false, }; }, toJSON(message) { const obj = {}; message.name !== undefined && (obj.name = message.name); message.inputType !== undefined && (obj.inputType = message.inputType); message.outputType !== undefined && (obj.outputType = message.outputType); message.options !== undefined && (obj.options = message.options ? exports.MethodOptions.toJSON(message.options) : undefined); message.clientStreaming !== undefined && (obj.clientStreaming = message.clientStreaming); message.serverStreaming !== undefined && (obj.serverStreaming = message.serverStreaming); return obj; }, }; function createBaseFileOptions() { return { javaPackage: "", javaOuterClassname: "", javaMultipleFiles: false, javaGenerateEqualsAndHash: false, javaStringCheckUtf8: false, optimizeFor: 1, goPackage: "", ccGenericServices: false, javaGenericServices: false, pyGenericServices: false, phpGenericServices: false, deprecated: false, ccEnableArenas: false, objcClassPrefix: "", csharpNamespace: "", swiftPrefix: "", phpClassPrefix: "", phpNamespace: "", phpMetadataNamespace: "", rubyPackage: "", uninterpretedOption: [], }; } exports.FileOptions = { fromJSON(object) { return { javaPackage: isSet(object.javaPackage) ? String(object.javaPackage) : "", javaOuterClassname: isSet(object.javaOuterClassname) ? String(object.javaOuterClassname) : "", javaMultipleFiles: isSet(object.javaMultipleFiles) ? Boolean(object.javaMultipleFiles) : false, javaGenerateEqualsAndHash: isSet(object.javaGenerateEqualsAndHash) ? Boolean(object.javaGenerateEqualsAndHash) : false, javaStringCheckUtf8: isSet(object.javaStringCheckUtf8) ? Boolean(object.javaStringCheckUtf8) : false, optimizeFor: isSet(object.optimizeFor) ? fileOptions_OptimizeModeFromJSON(object.optimizeFor) : 1, goPackage: isSet(object.goPackage) ? String(object.goPackage) : "", ccGenericServices: isSet(object.ccGenericServices) ? Boolean(object.ccGenericServices) : false, javaGenericServices: isSet(object.javaGenericServices) ? Boolean(object.javaGenericServices) : false, pyGenericServices: isSet(object.pyGenericServices) ? Boolean(object.pyGenericServices) : false, phpGenericServices: isSet(object.phpGenericServices) ? Boolean(object.phpGenericServices) : false, deprecated: isSet(object.deprecated) ? Boolean(object.deprecated) : false, ccEnableArenas: isSet(object.ccEnableArenas) ? Boolean(object.ccEnableArenas) : false, objcClassPrefix: isSet(object.objcClassPrefix) ? String(object.objcClassPrefix) : "", csharpNamespace: isSet(object.csharpNamespace) ? String(object.csharpNamespace) : "", swiftPrefix: isSet(object.swiftPrefix) ? String(object.swiftPrefix) : "", phpClassPrefix: isSet(object.phpClassPrefix) ? String(object.phpClassPrefix) : "", phpNamespace: isSet(object.phpNamespace) ? String(object.phpNamespace) : "", phpMetadataNamespace: isSet(object.phpMetadataNamespace) ? String(object.phpMetadataNamespace) : "", rubyPackage: isSet(object.rubyPackage) ? String(object.rubyPackage) : "", uninterpretedOption: Array.isArray(object?.uninterpretedOption) ? object.uninterpretedOption.map((e) => exports.UninterpretedOption.fromJSON(e)) : [], }; }, toJSON(message) { const obj = {}; message.javaPackage !== undefined && (obj.javaPackage = message.javaPackage); message.javaOuterClassname !== undefined && (obj.javaOuterClassname = message.javaOuterClassname); message.javaMultipleFiles !== undefined && (obj.javaMultipleFiles = message.javaMultipleFiles); message.javaGenerateEqualsAndHash !== undefined && (obj.javaGenerateEqualsAndHash = message.javaGenerateEqualsAndHash); message.javaStringCheckUtf8 !== undefined && (obj.javaStringCheckUtf8 = message.javaStringCheckUtf8); message.optimizeFor !== undefined && (obj.optimizeFor = fileOptions_OptimizeModeToJSON(message.optimizeFor)); message.goPackage !== undefined && (obj.goPackage = message.goPackage); message.ccGenericServices !== undefined && (obj.ccGenericServices = message.ccGenericServices); message.javaGenericServices !== undefined && (obj.javaGenericServices = message.javaGenericServices); message.pyGenericServices !== undefined && (obj.pyGenericServices = message.pyGenericServices); message.phpGenericServices !== undefined && (obj.phpGenericServices = message.phpGenericServices); message.deprecated !== undefined && (obj.deprecated = message.deprecated); message.ccEnableArenas !== undefined && (obj.ccEnableArenas = message.ccEnableArenas); message.objcClassPrefix !== undefined && (obj.objcClassPrefix = message.objcClassPrefix); message.csharpNamespace !== undefined && (obj.csharpNamespace = message.csharpNamespace); message.swiftPrefix !== undefined && (obj.swiftPrefix = message.swiftPrefix); message.phpClassPrefix !== undefined && (obj.phpClassPrefix = message.phpClassPrefix); message.phpNamespace !== undefined && (obj.phpNamespace = message.phpNamespace); message.phpMetadataNamespace !== undefined && (obj.phpMetadataNamespace = message.phpMetadataNamespace); message.rubyPackage !== undefined && (obj.rubyPackage = message.rubyPackage); if (message.uninterpretedOption) { obj.uninterpretedOption = message.uninterpretedOption.map((e) => e ? exports.UninterpretedOption.toJSON(e) : undefined); } else { obj.uninterpretedOption = []; } return obj; }, }; function createBaseMessageOptions() { return { messageSetWireFormat: false, noStandardDescriptorAccessor: false, deprecated: false, mapEntry: false, uninterpretedOption: [], }; } exports.MessageOptions = { fromJSON(object) { return { messageSetWireFormat: isSet(object.messageSetWireFormat) ? Boolean(object.messageSetWireFormat) : false, noStandardDescriptorAccessor: isSet(object.noStandardDescriptorAccessor) ? Boolean(object.noStandardDescriptorAccessor) : false, deprecated: isSet(object.deprecated) ? Boolean(object.deprecated) : false, mapEntry: isSet(object.mapEntry) ? Boolean(object.mapEntry) : false, uninterpretedOption: Array.isArray(object?.uninterpretedOption) ? object.uninterpretedOption.map((e) => exports.UninterpretedOption.fromJSON(e)) : [], }; }, toJSON(message) { const obj = {}; message.messageSetWireFormat !== undefined && (obj.messageSetWireFormat = message.messageSetWireFormat); message.noStandardDescriptorAccessor !== undefined && (obj.noStandardDescriptorAccessor = message.noStandardDescriptorAccessor); message.deprecated !== undefined && (obj.deprecated = message.deprecated); message.mapEntry !== undefined && (obj.mapEntry = message.mapEntry); if (message.uninterpretedOption) { obj.uninterpretedOption = message.uninterpretedOption.map((e) => e ? exports.UninterpretedOption.toJSON(e) : undefined); } else { obj.uninterpretedOption = []; } return obj; }, }; function createBaseFieldOptions() { return { ctype: 0, packed: false, jstype: 0, lazy: false, unverifiedLazy: false, deprecated: false, weak: false, uninterpretedOption: [], }; } exports.FieldOptions = { fromJSON(object) { return { ctype: isSet(object.ctype) ? fieldOptions_CTypeFromJSON(object.ctype) : 0, packed: isSet(object.packed) ? Boolean(object.packed) : false, jstype: isSet(object.jstype) ? fieldOptions_JSTypeFromJSON(object.jstype) : 0, lazy: isSet(object.lazy) ? Boolean(object.lazy) : false, unverifiedLazy: isSet(object.unverifiedLazy) ? Boolean(object.unverifiedLazy) : false, deprecated: isSet(object.deprecated) ? Boolean(object.deprecated) : false, weak: isSet(object.weak) ? Boolean(object.weak) : false, uninterpretedOption: Array.isArray(object?.uninterpretedOption) ? object.uninterpretedOption.map((e) => exports.UninterpretedOption.fromJSON(e)) : [], }; }, toJSON(message) { const obj = {}; message.ctype !== undefined && (obj.ctype = fieldOptions_CTypeToJSON(message.ctype)); message.packed !== undefined && (obj.packed = message.packed); message.jstype !== undefined && (obj.jstype = fieldOptions_JSTypeToJSON(message.jstype)); message.lazy !== undefined && (obj.lazy = message.lazy); message.unverifiedLazy !== undefined && (obj.unverifiedLazy = message.unverifiedLazy); message.deprecated !== undefined && (obj.deprecated = message.deprecated); message.weak !== undefined && (obj.weak = message.weak); if (message.uninterpretedOption) { obj.uninterpretedOption = message.uninterpretedOption.map((e) => e ? exports.UninterpretedOption.toJSON(e) : undefined); } else { obj.uninterpretedOption = []; } return obj; }, }; function createBaseOneofOptions() { return { uninterpretedOption: [] }; } exports.OneofOptions = { fromJSON(object) { return { uninterpretedOption: Array.isArray(object?.uninterpretedOption) ? object.uninterpretedOption.map((e) => exports.UninterpretedOption.fromJSON(e)) : [], }; }, toJSON(message) { const obj = {}; if (message.uninterpretedOption) { obj.uninterpretedOption = message.uninterpretedOption.map((e) => e ? exports.UninterpretedOption.toJSON(e) : undefined); } else { obj.uninterpretedOption = []; } return obj; }, }; function createBaseEnumOptions() { return { allowAlias: false, deprecated: false, uninterpretedOption: [] }; } exports.EnumOptions = { fromJSON(object) { return { allowAlias: isSet(object.allowAlias) ? Boolean(object.allowAlias) : false, deprecated: isSet(object.deprecated) ? Boolean(object.deprecated) : false, uninterpretedOption: Array.isArray(object?.uninterpretedOption) ? object.uninterpretedOption.map((e) => exports.UninterpretedOption.fromJSON(e)) : [], }; }, toJSON(message) { const obj = {}; message.allowAlias !== undefined && (obj.allowAlias = message.allowAlias); message.deprecated !== undefined && (obj.deprecated = message.deprecated); if (message.uninterpretedOption) { obj.uninterpretedOption = message.uninterpretedOption.map((e) => e ? exports.UninterpretedOption.toJSON(e) : undefined); } else { obj.uninterpretedOption = []; } return obj; }, }; function createBaseEnumValueOptions() { return { deprecated: false, uninterpretedOption: [] }; } exports.EnumValueOptions = { fromJSON(object) { return { deprecated: isSet(object.deprecated) ? Boolean(object.deprecated) : false, uninterpretedOption: Array.isArray(object?.uninterpretedOption) ? object.uninterpretedOption.map((e) => exports.UninterpretedOption.fromJSON(e)) : [], }; }, toJSON(message) { const obj = {}; message.deprecated !== undefined && (obj.deprecated = message.deprecated); if (message.uninterpretedOption) { obj.uninterpretedOption = message.uninterpretedOption.map((e) => e ? exports.UninterpretedOption.toJSON(e) : undefined); } else { obj.uninterpretedOption = []; } return obj; }, }; function createBaseServiceOptions() { return { deprecated: false, uninterpretedOption: [] }; } exports.ServiceOptions = { fromJSON(object) { return { deprecated: isSet(object.deprecated) ? Boolean(object.deprecated) : false, uninterpretedOption: Array.isArray(object?.uninterpretedOption) ? object.uninterpretedOption.map((e) => exports.UninterpretedOption.fromJSON(e)) : [], }; }, toJSON(message) { const obj = {}; message.deprecated !== undefined && (obj.deprecated = message.deprecated); if (message.uninterpretedOption) { obj.uninterpretedOption = message.uninterpretedOption.map((e) => e ? exports.UninterpretedOption.toJSON(e) : undefined); } else { obj.uninterpretedOption = []; } return obj; }, }; function createBaseMethodOptions() { return { deprecated: false, idempotencyLevel: 0, uninterpretedOption: [] }; } exports.MethodOptions = { fromJSON(object) { return { deprecated: isSet(object.deprecated) ? Boolean(object.deprecated) : false, idempotencyLevel: isSet(object.idempotencyLevel) ? methodOptions_IdempotencyLevelFromJSON(object.idempotencyLevel) : 0, uninterpretedOption: Array.isArray(object?.uninterpretedOption) ? object.uninterpretedOption.map((e) => exports.UninterpretedOption.fromJSON(e)) : [], }; }, toJSON(message) { const obj = {}; message.deprecated !== undefined && (obj.deprecated = message.deprecated); message.idempotencyLevel !== undefined && (obj.idempotencyLevel = methodOptions_IdempotencyLevelToJSON(message.idempotencyLevel)); if (message.uninterpretedOption) { obj.uninterpretedOption = message.uninterpretedOption.map((e) => e ? exports.UninterpretedOption.toJSON(e) : undefined); } else { obj.uninterpretedOption = []; } return obj; }, }; function createBaseUninterpretedOption() { return { name: [], identifierValue: "", positiveIntValue: "0", negativeIntValue: "0", doubleValue: 0, stringValue: Buffer.alloc(0), aggregateValue: "", }; } exports.UninterpretedOption = { fromJSON(object) { return { name: Array.isArray(object?.name) ? object.name.map((e) => exports.UninterpretedOption_NamePart.fromJSON(e)) : [], identifierValue: isSet(object.identifierValue) ? String(object.identifierValue) : "", positiveIntValue: isSet(object.positiveIntValue) ? String(object.positiveIntValue) : "0", negativeIntValue: isSet(object.negativeIntValue) ? String(object.negativeIntValue) : "0", doubleValue: isSet(object.doubleValue) ? Number(object.doubleValue) : 0, stringValue: isSet(object.stringValue) ? Buffer.from(bytesFromBase64(object.stringValue)) : Buffer.alloc(0), aggregateValue: isSet(object.aggregateValue) ? String(object.aggregateValue) : "", }; }, toJSON(message) { const obj = {}; if (message.name) { obj.name = message.name.map((e) => e ? exports.UninterpretedOption_NamePart.toJSON(e) : undefined); } else { obj.name = []; } message.identifierValue !== undefined && (obj.identifierValue = message.identifierValue); message.positiveIntValue !== undefined && (obj.positiveIntValue = message.positiveIntValue); message.negativeIntValue !== undefined && (obj.negativeIntValue = message.negativeIntValue); message.doubleValue !== undefined && (obj.doubleValue = message.doubleValue); message.stringValue !== undefined && (obj.stringValue = base64FromBytes(message.stringValue !== undefined ? message.stringValue : Buffer.alloc(0))); message.aggregateValue !== undefined && (obj.aggregateValue = message.aggregateValue); return obj; }, }; function createBaseUninterpretedOption_NamePart() { return { namePart: "", isExtension: false }; } exports.UninterpretedOption_NamePart = { fromJSON(object) { return { namePart: isSet(object.namePart) ? String(object.namePart) : "", isExtension: isSet(object.isExtension) ? Boolean(object.isExtension) : false, }; }, toJSON(message) { const obj = {}; message.namePart !== undefined && (obj.namePart = message.namePart); message.isExtension !== undefined && (obj.isExtension = message.isExtension); return obj; }, }; function createBaseSourceCodeInfo() { return { location: [] }; } exports.SourceCodeInfo = { fromJSON(object) { return { location: Array.isArray(object?.location) ? object.location.map((e) => exports.SourceCodeInfo_Location.fromJSON(e)) : [], }; }, toJSON(message) { const obj = {}; if (message.location) { obj.location = message.location.map((e) => e ? exports.SourceCodeInfo_Location.toJSON(e) : undefined); } else { obj.location = []; } return obj; }, }; function createBaseSourceCodeInfo_Location() { return { path: [], span: [], leadingComments: "", trailingComments: "", leadingDetachedComments: [] }; } exports.SourceCodeInfo_Location = { fromJSON(object) { return { path: Array.isArray(object?.path) ? object.path.map((e) => Number(e)) : [], span: Array.isArray(object?.span) ? object.span.map((e) => Number(e)) : [], leadingComments: isSet(object.leadingComments) ? String(object.leadingComments) : "", trailingComments: isSet(object.trailingComments) ? String(object.trailingComments) : "", leadingDetachedComments: Array.isArray(object?.leadingDetachedComments) ? object.leadingDetachedComments.map((e) => String(e)) : [], }; }, toJSON(message) { const obj = {}; if (message.path) { obj.path = message.path.map((e) => Math.round(e)); } else { obj.path = []; } if (message.span) { obj.span = message.span.map((e) => Math.round(e)); } else { obj.span = []; } message.leadingComments !== undefined && (obj.leadingComments = message.leadingComments); message.trailingComments !== undefined && (obj.trailingComments = message.trailingComments); if (message.leadingDetachedComments) { obj.leadingDetachedComments = message.leadingDetachedComments.map((e) => e); } else { obj.leadingDetachedComments = []; } return obj; }, }; function createBaseGeneratedCodeInfo() { return { annotation: [] }; } exports.GeneratedCodeInfo = { fromJSON(object) { return { annotation: Array.isArray(object?.annotation) ? object.annotation.map((e) => exports.GeneratedCodeInfo_Annotation.fromJSON(e)) : [], }; }, toJSON(message) { const obj = {}; if (message.annotation) { obj.annotation = message.annotation.map((e) => e ? exports.GeneratedCodeInfo_Annotation.toJSON(e) : undefined); } else { obj.annotation = []; } return obj; }, }; function createBaseGeneratedCodeInfo_Annotation() { return { path: [], sourceFile: "", begin: 0, end: 0 }; } exports.GeneratedCodeInfo_Annotation = { fromJSON(object) { return { path: Array.isArray(object?.path) ? object.path.map((e) => Number(e)) : [], sourceFile: isSet(object.sourceFile) ? String(object.sourceFile) : "", begin: isSet(object.begin) ? Number(object.begin) : 0, end: isSet(object.end) ? Number(object.end) : 0, }; }, toJSON(message) { const obj = {}; if (message.path) { obj.path = message.path.map((e) => Math.round(e)); } else { obj.path = []; } message.sourceFile !== undefined && (obj.sourceFile = message.sourceFile); message.begin !== undefined && (obj.begin = Math.round(message.begin)); message.end !== undefined && (obj.end = Math.round(message.end)); return obj; }, }; var tsProtoGlobalThis = (() => { if (typeof globalThis !== "undefined") { return globalThis; } if (typeof self !== "undefined") { return self; } if (typeof window !== "undefined") { return window; } if (typeof global !== "undefined") { return global; } throw "Unable to locate global object"; })(); function bytesFromBase64(b64) { if (tsProtoGlobalThis.Buffer) { return Uint8Array.from(tsProtoGlobalThis.Buffer.from(b64, "base64")); } else { const bin = tsProtoGlobalThis.atob(b64); const arr = new Uint8Array(bin.length); for (let i = 0; i < bin.length; ++i) { arr[i] = bin.charCodeAt(i); } return arr; } } function base64FromBytes(arr) { if (tsProtoGlobalThis.Buffer) { return tsProtoGlobalThis.Buffer.from(arr).toString("base64"); } else { const bin = []; arr.forEach((byte) => { bin.push(String.fromCharCode(byte)); }); return tsProtoGlobalThis.btoa(bin.join("")); } } function isSet(value) { return value !== null && value !== undefined; } protobuf-specs/dist/__generated__/envelope.js000064400000005565151701425750015411 0ustar00"use strict"; /* eslint-disable */ Object.defineProperty(exports, "__esModule", { value: true }); exports.Signature = exports.Envelope = void 0; function createBaseEnvelope() { return { payload: Buffer.alloc(0), payloadType: "", signatures: [] }; } exports.Envelope = { fromJSON(object) { return { payload: isSet(object.payload) ? Buffer.from(bytesFromBase64(object.payload)) : Buffer.alloc(0), payloadType: isSet(object.payloadType) ? String(object.payloadType) : "", signatures: Array.isArray(object?.signatures) ? object.signatures.map((e) => exports.Signature.fromJSON(e)) : [], }; }, toJSON(message) { const obj = {}; message.payload !== undefined && (obj.payload = base64FromBytes(message.payload !== undefined ? message.payload : Buffer.alloc(0))); message.payloadType !== undefined && (obj.payloadType = message.payloadType); if (message.signatures) { obj.signatures = message.signatures.map((e) => e ? exports.Signature.toJSON(e) : undefined); } else { obj.signatures = []; } return obj; }, }; function createBaseSignature() { return { sig: Buffer.alloc(0), keyid: "" }; } exports.Signature = { fromJSON(object) { return { sig: isSet(object.sig) ? Buffer.from(bytesFromBase64(object.sig)) : Buffer.alloc(0), keyid: isSet(object.keyid) ? String(object.keyid) : "", }; }, toJSON(message) { const obj = {}; message.sig !== undefined && (obj.sig = base64FromBytes(message.sig !== undefined ? message.sig : Buffer.alloc(0))); message.keyid !== undefined && (obj.keyid = message.keyid); return obj; }, }; var tsProtoGlobalThis = (() => { if (typeof globalThis !== "undefined") { return globalThis; } if (typeof self !== "undefined") { return self; } if (typeof window !== "undefined") { return window; } if (typeof global !== "undefined") { return global; } throw "Unable to locate global object"; })(); function bytesFromBase64(b64) { if (tsProtoGlobalThis.Buffer) { return Uint8Array.from(tsProtoGlobalThis.Buffer.from(b64, "base64")); } else { const bin = tsProtoGlobalThis.atob(b64); const arr = new Uint8Array(bin.length); for (let i = 0; i < bin.length; ++i) { arr[i] = bin.charCodeAt(i); } return arr; } } function base64FromBytes(arr) { if (tsProtoGlobalThis.Buffer) { return tsProtoGlobalThis.Buffer.from(arr).toString("base64"); } else { const bin = []; arr.forEach((byte) => { bin.push(String.fromCharCode(byte)); }); return tsProtoGlobalThis.btoa(bin.join("")); } } function isSet(value) { return value !== null && value !== undefined; } protobuf-specs/dist/index.js000064400000003300151701425750012132 0ustar00"use strict"; var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) { if (k2 === undefined) k2 = k; var desc = Object.getOwnPropertyDescriptor(m, k); if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) { desc = { enumerable: true, get: function() { return m[k]; } }; } Object.defineProperty(o, k2, desc); }) : (function(o, m, k, k2) { if (k2 === undefined) k2 = k; o[k2] = m[k]; })); var __exportStar = (this && this.__exportStar) || function(m, exports) { for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p); }; Object.defineProperty(exports, "__esModule", { value: true }); /* Copyright 2023 The Sigstore Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. */ __exportStar(require("./__generated__/envelope"), exports); __exportStar(require("./__generated__/sigstore_bundle"), exports); __exportStar(require("./__generated__/sigstore_common"), exports); __exportStar(require("./__generated__/sigstore_rekor"), exports); __exportStar(require("./__generated__/sigstore_trustroot"), exports); __exportStar(require("./__generated__/sigstore_verification"), exports); sign/package.json000064400000002503151701425750010001 0ustar00{ "_id": "@sigstore/sign@2.3.2", "_inBundle": true, "_location": "/npm/@sigstore/sign", "_phantomChildren": {}, "_requiredBy": [ "/npm/sigstore" ], "author": { "name": "bdehamer@github.com" }, "bugs": { "url": "https://github.com/sigstore/sigstore-js/issues" }, "dependencies": { "@sigstore/bundle": "^2.3.2", "@sigstore/core": "^1.0.0", "@sigstore/protobuf-specs": "^0.3.2", "make-fetch-happen": "^13.0.1", "proc-log": "^4.2.0", "promise-retry": "^2.0.1" }, "description": "Sigstore signing library", "devDependencies": { "@sigstore/jest": "^0.0.0", "@sigstore/mock": "^0.7.4", "@sigstore/rekor-types": "^2.0.0", "@types/make-fetch-happen": "^10.0.4", "@types/promise-retry": "^1.1.6" }, "engines": { "node": "^16.14.0 || >=18.0.0" }, "files": [ "dist" ], "homepage": "https://github.com/sigstore/sigstore-js/tree/main/packages/sign#readme", "license": "Apache-2.0", "main": "dist/index.js", "name": "@sigstore/sign", "publishConfig": { "provenance": true }, "repository": { "type": "git", "url": "git+https://github.com/sigstore/sigstore-js.git" }, "scripts": { "build": "tsc --build", "clean": "shx rm -rf dist *.tsbuildinfo", "test": "jest" }, "types": "dist/index.d.ts", "version": "2.3.2" } sign/LICENSE000064400000026127151701425750006530 0ustar00 Apache License Version 2.0, January 2004 http://www.apache.org/licenses/ TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION 1. Definitions. "License" shall mean the terms and conditions for use, reproduction, and distribution as defined by Sections 1 through 9 of this document. "Licensor" shall mean the copyright owner or entity authorized by the copyright owner that is granting the License. "Legal Entity" shall mean the union of the acting entity and all other entities that control, are controlled by, or are under common control with that entity. For the purposes of this definition, "control" means (i) the power, direct or indirect, to cause the direction or management of such entity, whether by contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the outstanding shares, or (iii) beneficial ownership of such entity. "You" (or "Your") shall mean an individual or Legal Entity exercising permissions granted by this License. "Source" form shall mean the preferred form for making modifications, including but not limited to software source code, documentation source, and configuration files. "Object" form shall mean any form resulting from mechanical transformation or translation of a Source form, including but not limited to compiled object code, generated documentation, and conversions to other media types. "Work" shall mean the work of authorship, whether in Source or Object form, made available under the License, as indicated by a copyright notice that is included in or attached to the work (an example is provided in the Appendix below). "Derivative Works" shall mean any work, whether in Source or Object form, that is based on (or derived from) the Work and for which the editorial revisions, annotations, elaborations, or other modifications represent, as a whole, an original work of authorship. For the purposes of this License, Derivative Works shall not include works that remain separable from, or merely link (or bind by name) to the interfaces of, the Work and Derivative Works thereof. "Contribution" shall mean any work of authorship, including the original version of the Work and any modifications or additions to that Work or Derivative Works thereof, that is intentionally submitted to Licensor for inclusion in the Work by the copyright owner or by an individual or Legal Entity authorized to submit on behalf of the copyright owner. For the purposes of this definition, "submitted" means any form of electronic, verbal, or written communication sent to the Licensor or its representatives, including but not limited to communication on electronic mailing lists, source code control systems, and issue tracking systems that are managed by, or on behalf of, the Licensor for the purpose of discussing and improving the Work, but excluding communication that is conspicuously marked or otherwise designated in writing by the copyright owner as "Not a Contribution." "Contributor" shall mean Licensor and any individual or Legal Entity on behalf of whom a Contribution has been received by Licensor and subsequently incorporated within the Work. 2. Grant of Copyright License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare Derivative Works of, publicly display, publicly perform, sublicense, and distribute the Work and such Derivative Works in Source or Object form. 3. Grant of Patent License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable (except as stated in this section) patent license to make, have made, use, offer to sell, sell, import, and otherwise transfer the Work, where such license applies only to those patent claims licensable by such Contributor that are necessarily infringed by their Contribution(s) alone or by combination of their Contribution(s) with the Work to which such Contribution(s) was submitted. If You institute patent litigation against any entity (including a cross-claim or counterclaim in a lawsuit) alleging that the Work or a Contribution incorporated within the Work constitutes direct or contributory patent infringement, then any patent licenses granted to You under this License for that Work shall terminate as of the date such litigation is filed. 4. Redistribution. You may reproduce and distribute copies of the Work or Derivative Works thereof in any medium, with or without modifications, and in Source or Object form, provided that You meet the following conditions: (a) You must give any other recipients of the Work or Derivative Works a copy of this License; and (b) You must cause any modified files to carry prominent notices stating that You changed the files; and (c) You must retain, in the Source form of any Derivative Works that You distribute, all copyright, patent, trademark, and attribution notices from the Source form of the Work, excluding those notices that do not pertain to any part of the Derivative Works; and (d) If the Work includes a "NOTICE" text file as part of its distribution, then any Derivative Works that You distribute must include a readable copy of the attribution notices contained within such NOTICE file, excluding those notices that do not pertain to any part of the Derivative Works, in at least one of the following places: within a NOTICE text file distributed as part of the Derivative Works; within the Source form or documentation, if provided along with the Derivative Works; or, within a display generated by the Derivative Works, if and wherever such third-party notices normally appear. The contents of the NOTICE file are for informational purposes only and do not modify the License. You may add Your own attribution notices within Derivative Works that You distribute, alongside or as an addendum to the NOTICE text from the Work, provided that such additional attribution notices cannot be construed as modifying the License. You may add Your own copyright statement to Your modifications and may provide additional or different license terms and conditions for use, reproduction, or distribution of Your modifications, or for any such Derivative Works as a whole, provided Your use, reproduction, and distribution of the Work otherwise complies with the conditions stated in this License. 5. Submission of Contributions. Unless You explicitly state otherwise, any Contribution intentionally submitted for inclusion in the Work by You to the Licensor shall be under the terms and conditions of this License, without any additional terms or conditions. Notwithstanding the above, nothing herein shall supersede or modify the terms of any separate license agreement you may have executed with Licensor regarding such Contributions. 6. Trademarks. This License does not grant permission to use the trade names, trademarks, service marks, or product names of the Licensor, except as required for reasonable and customary use in describing the origin of the Work and reproducing the content of the NOTICE file. 7. Disclaimer of Warranty. Unless required by applicable law or agreed to in writing, Licensor provides the Work (and each Contributor provides its Contributions) on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. You are solely responsible for determining the appropriateness of using or redistributing the Work and assume any risks associated with Your exercise of permissions under this License. 8. Limitation of Liability. In no event and under no legal theory, whether in tort (including negligence), contract, or otherwise, unless required by applicable law (such as deliberate and grossly negligent acts) or agreed to in writing, shall any Contributor be liable to You for damages, including any direct, indirect, special, incidental, or consequential damages of any character arising as a result of this License or out of the use or inability to use the Work (including but not limited to damages for loss of goodwill, work stoppage, computer failure or malfunction, or any and all other commercial damages or losses), even if such Contributor has been advised of the possibility of such damages. 9. Accepting Warranty or Additional Liability. While redistributing the Work or Derivative Works thereof, You may choose to offer, and charge a fee for, acceptance of support, warranty, indemnity, or other liability obligations and/or rights consistent with this License. However, in accepting such obligations, You may act only on Your own behalf and on Your sole responsibility, not on behalf of any other Contributor, and only if You agree to indemnify, defend, and hold each Contributor harmless for any liability incurred by, or claims asserted against, such Contributor by reason of your accepting any such warranty or additional liability. END OF TERMS AND CONDITIONS APPENDIX: How to apply the Apache License to your work. To apply the Apache License to your work, attach the following boilerplate notice, with the fields enclosed by brackets "[]" replaced with your own identifying information. (Don't include the brackets!) The text should be enclosed in the appropriate comment syntax for the file format. We also recommend that a file or class name and description of purpose be included on the same "printed page" as the copyright notice for easier identification within third-party archives. Copyright 2023 The Sigstore Authors Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. sign/dist/external/fetch.js000064400000007563151701425750011742 0ustar00"use strict"; var __importDefault = (this && this.__importDefault) || function (mod) { return (mod && mod.__esModule) ? mod : { "default": mod }; }; Object.defineProperty(exports, "__esModule", { value: true }); exports.fetchWithRetry = void 0; /* Copyright 2023 The Sigstore Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. */ const http2_1 = require("http2"); const make_fetch_happen_1 = __importDefault(require("make-fetch-happen")); const proc_log_1 = require("proc-log"); const promise_retry_1 = __importDefault(require("promise-retry")); const util_1 = require("../util"); const error_1 = require("./error"); const { HTTP2_HEADER_LOCATION, HTTP2_HEADER_CONTENT_TYPE, HTTP2_HEADER_USER_AGENT, HTTP_STATUS_INTERNAL_SERVER_ERROR, HTTP_STATUS_TOO_MANY_REQUESTS, HTTP_STATUS_REQUEST_TIMEOUT, } = http2_1.constants; async function fetchWithRetry(url, options) { return (0, promise_retry_1.default)(async (retry, attemptNum) => { const method = options.method || 'POST'; const headers = { [HTTP2_HEADER_USER_AGENT]: util_1.ua.getUserAgent(), ...options.headers, }; const response = await (0, make_fetch_happen_1.default)(url, { method, headers, body: options.body, timeout: options.timeout, retry: false, // We're handling retries ourselves }).catch((reason) => { proc_log_1.log.http('fetch', `${method} ${url} attempt ${attemptNum} failed with ${reason}`); return retry(reason); }); if (response.ok) { return response; } else { const error = await errorFromResponse(response); proc_log_1.log.http('fetch', `${method} ${url} attempt ${attemptNum} failed with ${response.status}`); if (retryable(response.status)) { return retry(error); } else { throw error; } } }, retryOpts(options.retry)); } exports.fetchWithRetry = fetchWithRetry; // Translate a Response into an HTTPError instance. This will attempt to parse // the response body for a message, but will default to the statusText if none // is found. const errorFromResponse = async (response) => { let message = response.statusText; const location = response.headers?.get(HTTP2_HEADER_LOCATION) || undefined; const contentType = response.headers?.get(HTTP2_HEADER_CONTENT_TYPE); // If response type is JSON, try to parse the body for a message if (contentType?.includes('application/json')) { try { const body = await response.json(); message = body.message || message; } catch (e) { // ignore } } return new error_1.HTTPError({ status: response.status, message: message, location: location, }); }; // Determine if a status code is retryable. This includes 5xx errors, 408, and // 429. const retryable = (status) => [HTTP_STATUS_REQUEST_TIMEOUT, HTTP_STATUS_TOO_MANY_REQUESTS].includes(status) || status >= HTTP_STATUS_INTERNAL_SERVER_ERROR; // Normalize the retry options to the format expected by promise-retry const retryOpts = (retry) => { if (typeof retry === 'boolean') { return { retries: retry ? 1 : 0 }; } else if (typeof retry === 'number') { return { retries: retry }; } else { return { retries: 0, ...retry }; } }; sign/dist/external/fulcio.js000064400000002411151701425750012115 0ustar00"use strict"; Object.defineProperty(exports, "__esModule", { value: true }); exports.Fulcio = void 0; /* Copyright 2023 The Sigstore Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. */ const fetch_1 = require("./fetch"); /** * Fulcio API client. */ class Fulcio { constructor(options) { this.options = options; } async createSigningCertificate(request) { const { baseURL, retry, timeout } = this.options; const url = `${baseURL}/api/v2/signingCert`; const response = await (0, fetch_1.fetchWithRetry)(url, { headers: { 'Content-Type': 'application/json', }, body: JSON.stringify(request), timeout, retry, }); return response.json(); } } exports.Fulcio = Fulcio; sign/dist/external/rekor.js000064400000005041151701425750011760 0ustar00"use strict"; Object.defineProperty(exports, "__esModule", { value: true }); exports.Rekor = void 0; /* Copyright 2023 The Sigstore Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. */ const fetch_1 = require("./fetch"); /** * Rekor API client. */ class Rekor { constructor(options) { this.options = options; } /** * Create a new entry in the Rekor log. * @param propsedEntry {ProposedEntry} Data to create a new entry * @returns {Promise<Entry>} The created entry */ async createEntry(propsedEntry) { const { baseURL, timeout, retry } = this.options; const url = `${baseURL}/api/v1/log/entries`; const response = await (0, fetch_1.fetchWithRetry)(url, { headers: { 'Content-Type': 'application/json', Accept: 'application/json', }, body: JSON.stringify(propsedEntry), timeout, retry, }); const data = await response.json(); return entryFromResponse(data); } /** * Get an entry from the Rekor log. * @param uuid {string} The UUID of the entry to retrieve * @returns {Promise<Entry>} The retrieved entry */ async getEntry(uuid) { const { baseURL, timeout, retry } = this.options; const url = `${baseURL}/api/v1/log/entries/${uuid}`; const response = await (0, fetch_1.fetchWithRetry)(url, { method: 'GET', headers: { Accept: 'application/json', }, timeout, retry, }); const data = await response.json(); return entryFromResponse(data); } } exports.Rekor = Rekor; // Unpack the response from the Rekor API into a more convenient format. function entryFromResponse(data) { const entries = Object.entries(data); if (entries.length != 1) { throw new Error('Received multiple entries in Rekor response'); } // Grab UUID and entry data from the response const [uuid, entry] = entries[0]; return { ...entry, uuid, }; } sign/dist/external/error.js000064400000001607151701425750011773 0ustar00"use strict"; /* Copyright 2023 The Sigstore Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. */ Object.defineProperty(exports, "__esModule", { value: true }); exports.HTTPError = void 0; class HTTPError extends Error { constructor({ status, message, location, }) { super(`(${status}) ${message}`); this.statusCode = status; this.location = location; } } exports.HTTPError = HTTPError; sign/dist/external/tsa.js000064400000002422151701425750011425 0ustar00"use strict"; Object.defineProperty(exports, "__esModule", { value: true }); exports.TimestampAuthority = void 0; /* Copyright 2023 The Sigstore Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. */ const fetch_1 = require("./fetch"); class TimestampAuthority { constructor(options) { this.options = options; } async createTimestamp(request) { const { baseURL, timeout, retry } = this.options; const url = `${baseURL}/api/v1/timestamp`; const response = await (0, fetch_1.fetchWithRetry)(url, { headers: { 'Content-Type': 'application/json', }, body: JSON.stringify(request), timeout, retry, }); return response.buffer(); } } exports.TimestampAuthority = TimestampAuthority; sign/dist/index.js000064400000003235151701425750010126 0ustar00"use strict"; Object.defineProperty(exports, "__esModule", { value: true }); exports.TSAWitness = exports.RekorWitness = exports.DEFAULT_REKOR_URL = exports.FulcioSigner = exports.DEFAULT_FULCIO_URL = exports.CIContextProvider = exports.InternalError = exports.MessageSignatureBundleBuilder = exports.DSSEBundleBuilder = void 0; var bundler_1 = require("./bundler"); Object.defineProperty(exports, "DSSEBundleBuilder", { enumerable: true, get: function () { return bundler_1.DSSEBundleBuilder; } }); Object.defineProperty(exports, "MessageSignatureBundleBuilder", { enumerable: true, get: function () { return bundler_1.MessageSignatureBundleBuilder; } }); var error_1 = require("./error"); Object.defineProperty(exports, "InternalError", { enumerable: true, get: function () { return error_1.InternalError; } }); var identity_1 = require("./identity"); Object.defineProperty(exports, "CIContextProvider", { enumerable: true, get: function () { return identity_1.CIContextProvider; } }); var signer_1 = require("./signer"); Object.defineProperty(exports, "DEFAULT_FULCIO_URL", { enumerable: true, get: function () { return signer_1.DEFAULT_FULCIO_URL; } }); Object.defineProperty(exports, "FulcioSigner", { enumerable: true, get: function () { return signer_1.FulcioSigner; } }); var witness_1 = require("./witness"); Object.defineProperty(exports, "DEFAULT_REKOR_URL", { enumerable: true, get: function () { return witness_1.DEFAULT_REKOR_URL; } }); Object.defineProperty(exports, "RekorWitness", { enumerable: true, get: function () { return witness_1.RekorWitness; } }); Object.defineProperty(exports, "TSAWitness", { enumerable: true, get: function () { return witness_1.TSAWitness; } }); sign/dist/identity/index.js000064400000001505151701425750011755 0ustar00"use strict"; Object.defineProperty(exports, "__esModule", { value: true }); exports.CIContextProvider = void 0; /* Copyright 2023 The Sigstore Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. */ var ci_1 = require("./ci"); Object.defineProperty(exports, "CIContextProvider", { enumerable: true, get: function () { return ci_1.CIContextProvider; } }); sign/dist/identity/provider.js000064400000000115151701425750012474 0ustar00"use strict"; Object.defineProperty(exports, "__esModule", { value: true }); sign/dist/identity/ci.js000064400000005414151701425750011244 0ustar00"use strict"; var __importDefault = (this && this.__importDefault) || function (mod) { return (mod && mod.__esModule) ? mod : { "default": mod }; }; Object.defineProperty(exports, "__esModule", { value: true }); exports.CIContextProvider = void 0; /* Copyright 2023 The Sigstore Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. */ const make_fetch_happen_1 = __importDefault(require("make-fetch-happen")); // Collection of all the CI-specific providers we have implemented const providers = [getGHAToken, getEnv]; /** * CIContextProvider is a composite identity provider which will iterate * over all of the CI-specific providers and return the token from the first * one that resolves. */ class CIContextProvider { /* istanbul ignore next */ constructor(audience = 'sigstore') { this.audience = audience; } // Invoke all registered ProviderFuncs and return the value of whichever one // resolves first. async getToken() { return Promise.any(providers.map((getToken) => getToken(this.audience))).catch(() => Promise.reject('CI: no tokens available')); } } exports.CIContextProvider = CIContextProvider; /** * getGHAToken can retrieve an OIDC token when running in a GitHub Actions * workflow */ async function getGHAToken(audience) { // Check to see if we're running in GitHub Actions if (!process.env.ACTIONS_ID_TOKEN_REQUEST_URL || !process.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN) { return Promise.reject('no token available'); } // Construct URL to request token w/ appropriate audience const url = new URL(process.env.ACTIONS_ID_TOKEN_REQUEST_URL); url.searchParams.append('audience', audience); const response = await (0, make_fetch_happen_1.default)(url.href, { retry: 2, headers: { Accept: 'application/json', Authorization: `Bearer ${process.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN}`, }, }); return response.json().then((data) => data.value); } /** * getEnv can retrieve an OIDC token from an environment variable. * This matches the behavior of https://github.com/sigstore/cosign/tree/main/pkg/providers/envvar */ async function getEnv() { if (!process.env.SIGSTORE_ID_TOKEN) { return Promise.reject('no token available'); } return process.env.SIGSTORE_ID_TOKEN; } sign/dist/types/fetch.js000064400000000115151701425750011246 0ustar00"use strict"; Object.defineProperty(exports, "__esModule", { value: true }); sign/dist/signer/fulcio/index.js000064400000006635151701425750012705 0ustar00"use strict"; Object.defineProperty(exports, "__esModule", { value: true }); exports.FulcioSigner = exports.DEFAULT_FULCIO_URL = void 0; /* Copyright 2023 The Sigstore Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. */ const error_1 = require("../../error"); const util_1 = require("../../util"); const ca_1 = require("./ca"); const ephemeral_1 = require("./ephemeral"); exports.DEFAULT_FULCIO_URL = 'https://fulcio.sigstore.dev'; // Signer implementation which can be used to decorate another signer // with a Fulcio-issued signing certificate for the signer's public key. // Must be instantiated with an identity provider which can provide a JWT // which represents the identity to be bound to the signing certificate. class FulcioSigner { constructor(options) { this.ca = new ca_1.CAClient({ ...options, fulcioBaseURL: options.fulcioBaseURL || /* istanbul ignore next */ exports.DEFAULT_FULCIO_URL, }); this.identityProvider = options.identityProvider; this.keyHolder = options.keyHolder || new ephemeral_1.EphemeralSigner(); } async sign(data) { // Retrieve identity token from the supplied identity provider const identityToken = await this.getIdentityToken(); // Extract challenge claim from OIDC token let subject; try { subject = util_1.oidc.extractJWTSubject(identityToken); } catch (err) { throw new error_1.InternalError({ code: 'IDENTITY_TOKEN_PARSE_ERROR', message: `invalid identity token: ${identityToken}`, cause: err, }); } // Construct challenge value by signing the subject claim const challenge = await this.keyHolder.sign(Buffer.from(subject)); if (challenge.key.$case !== 'publicKey') { throw new error_1.InternalError({ code: 'CA_CREATE_SIGNING_CERTIFICATE_ERROR', message: 'unexpected format for signing key', }); } // Create signing certificate const certificates = await this.ca.createSigningCertificate(identityToken, challenge.key.publicKey, challenge.signature); // Generate artifact signature const signature = await this.keyHolder.sign(data); // Specifically returning only the first certificate in the chain // as the key. return { signature: signature.signature, key: { $case: 'x509Certificate', certificate: certificates[0], }, }; } async getIdentityToken() { try { return await this.identityProvider.getToken(); } catch (err) { throw new error_1.InternalError({ code: 'IDENTITY_TOKEN_READ_ERROR', message: 'error retrieving identity token', cause: err, }); } } } exports.FulcioSigner = FulcioSigner; sign/dist/signer/fulcio/ca.js000064400000004325151701425750012153 0ustar00"use strict"; Object.defineProperty(exports, "__esModule", { value: true }); exports.CAClient = void 0; /* Copyright 2023 The Sigstore Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. */ const error_1 = require("../../error"); const fulcio_1 = require("../../external/fulcio"); class CAClient { constructor(options) { this.fulcio = new fulcio_1.Fulcio({ baseURL: options.fulcioBaseURL, retry: options.retry, timeout: options.timeout, }); } async createSigningCertificate(identityToken, publicKey, challenge) { const request = toCertificateRequest(identityToken, publicKey, challenge); try { const resp = await this.fulcio.createSigningCertificate(request); // Account for the fact that the response may contain either a // signedCertificateEmbeddedSct or a signedCertificateDetachedSct. const cert = resp.signedCertificateEmbeddedSct ? resp.signedCertificateEmbeddedSct : resp.signedCertificateDetachedSct; // eslint-disable-next-line @typescript-eslint/no-non-null-assertion return cert.chain.certificates; } catch (err) { (0, error_1.internalError)(err, 'CA_CREATE_SIGNING_CERTIFICATE_ERROR', 'error creating signing certificate'); } } } exports.CAClient = CAClient; function toCertificateRequest(identityToken, publicKey, challenge) { return { credentials: { oidcIdentityToken: identityToken, }, publicKeyRequest: { publicKey: { algorithm: 'ECDSA', content: publicKey, }, proofOfPossession: challenge.toString('base64'), }, }; } sign/dist/signer/fulcio/ephemeral.js000064400000003236151701425750013532 0ustar00"use strict"; var __importDefault = (this && this.__importDefault) || function (mod) { return (mod && mod.__esModule) ? mod : { "default": mod }; }; Object.defineProperty(exports, "__esModule", { value: true }); exports.EphemeralSigner = void 0; /* Copyright 2023 The Sigstore Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. */ const crypto_1 = __importDefault(require("crypto")); const EC_KEYPAIR_TYPE = 'ec'; const P256_CURVE = 'P-256'; // Signer implementation which uses an ephemeral keypair to sign artifacts. // The private key lives only in memory and is tied to the lifetime of the // EphemeralSigner instance. class EphemeralSigner { constructor() { this.keypair = crypto_1.default.generateKeyPairSync(EC_KEYPAIR_TYPE, { namedCurve: P256_CURVE, }); } async sign(data) { const signature = crypto_1.default.sign(null, data, this.keypair.privateKey); const publicKey = this.keypair.publicKey .export({ format: 'pem', type: 'spki' }) .toString('ascii'); return { signature: signature, key: { $case: 'publicKey', publicKey }, }; } } exports.EphemeralSigner = EphemeralSigner; sign/dist/signer/index.js000064400000002000151701425750011402 0ustar00"use strict"; /* istanbul ignore file */ Object.defineProperty(exports, "__esModule", { value: true }); exports.FulcioSigner = exports.DEFAULT_FULCIO_URL = void 0; /* Copyright 2023 The Sigstore Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. */ var fulcio_1 = require("./fulcio"); Object.defineProperty(exports, "DEFAULT_FULCIO_URL", { enumerable: true, get: function () { return fulcio_1.DEFAULT_FULCIO_URL; } }); Object.defineProperty(exports, "FulcioSigner", { enumerable: true, get: function () { return fulcio_1.FulcioSigner; } }); sign/dist/signer/signer.js000064400000001205151701425750011570 0ustar00"use strict"; /* Copyright 2023 The Sigstore Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. */ Object.defineProperty(exports, "__esModule", { value: true }); sign/dist/bundler/base.js000064400000004355151701425750011370 0ustar00"use strict"; Object.defineProperty(exports, "__esModule", { value: true }); exports.BaseBundleBuilder = void 0; // BaseBundleBuilder is a base class for BundleBuilder implementations. It // provides a the basic wokflow for signing and witnessing an artifact. // Subclasses must implement the `package` method to assemble a valid bundle // with the generated signature and verification material. class BaseBundleBuilder { constructor(options) { this.signer = options.signer; this.witnesses = options.witnesses; } // Executes the signing/witnessing process for the given artifact. async create(artifact) { const signature = await this.prepare(artifact).then((blob) => this.signer.sign(blob)); const bundle = await this.package(artifact, signature); // Invoke all of the witnesses in parallel const verificationMaterials = await Promise.all(this.witnesses.map((witness) => witness.testify(bundle.content, publicKey(signature.key)))); // Collect the verification material from all of the witnesses const tlogEntryList = []; const timestampList = []; verificationMaterials.forEach(({ tlogEntries, rfc3161Timestamps }) => { tlogEntryList.push(...(tlogEntries ?? [])); timestampList.push(...(rfc3161Timestamps ?? [])); }); // Merge the collected verification material into the bundle bundle.verificationMaterial.tlogEntries = tlogEntryList; bundle.verificationMaterial.timestampVerificationData = { rfc3161Timestamps: timestampList, }; return bundle; } // Override this function to apply any pre-signing transformations to the // artifact. The returned buffer will be signed by the signer. The default // implementation simply returns the artifact data. async prepare(artifact) { return artifact.data; } } exports.BaseBundleBuilder = BaseBundleBuilder; // Extracts the public key from a KeyMaterial. Returns either the public key // or the certificate, depending on the type of key material. function publicKey(key) { switch (key.$case) { case 'publicKey': return key.publicKey; case 'x509Certificate': return key.certificate; } } sign/dist/bundler/message.js000064400000002174151701425750012077 0ustar00"use strict"; Object.defineProperty(exports, "__esModule", { value: true }); exports.MessageSignatureBundleBuilder = void 0; /* Copyright 2023 The Sigstore Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. */ const base_1 = require("./base"); const bundle_1 = require("./bundle"); // BundleBuilder implementation for raw message signatures class MessageSignatureBundleBuilder extends base_1.BaseBundleBuilder { constructor(options) { super(options); } async package(artifact, signature) { return (0, bundle_1.toMessageSignatureBundle)(artifact, signature); } } exports.MessageSignatureBundleBuilder = MessageSignatureBundleBuilder; sign/dist/bundler/index.js000064400000000776151701425750011570 0ustar00"use strict"; Object.defineProperty(exports, "__esModule", { value: true }); exports.MessageSignatureBundleBuilder = exports.DSSEBundleBuilder = void 0; var dsse_1 = require("./dsse"); Object.defineProperty(exports, "DSSEBundleBuilder", { enumerable: true, get: function () { return dsse_1.DSSEBundleBuilder; } }); var message_1 = require("./message"); Object.defineProperty(exports, "MessageSignatureBundleBuilder", { enumerable: true, get: function () { return message_1.MessageSignatureBundleBuilder; } }); sign/dist/bundler/dsse.js000064400000003312151701425750011404 0ustar00"use strict"; Object.defineProperty(exports, "__esModule", { value: true }); exports.DSSEBundleBuilder = void 0; /* Copyright 2023 The Sigstore Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. */ const util_1 = require("../util"); const base_1 = require("./base"); const bundle_1 = require("./bundle"); // BundleBuilder implementation for DSSE wrapped attestations class DSSEBundleBuilder extends base_1.BaseBundleBuilder { constructor(options) { super(options); this.singleCertificate = options.singleCertificate ?? false; } // DSSE requires the artifact to be pre-encoded with the payload type // before the signature is generated. async prepare(artifact) { const a = artifactDefaults(artifact); return util_1.dsse.preAuthEncoding(a.type, a.data); } // Packages the artifact and signature into a DSSE bundle async package(artifact, signature) { return (0, bundle_1.toDSSEBundle)(artifactDefaults(artifact), signature, this.singleCertificate); } } exports.DSSEBundleBuilder = DSSEBundleBuilder; // Defaults the artifact type to an empty string if not provided function artifactDefaults(artifact) { return { ...artifact, type: artifact.type ?? '', }; } sign/dist/bundler/bundle.js000064400000005735151701425750011732 0ustar00"use strict"; var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) { if (k2 === undefined) k2 = k; var desc = Object.getOwnPropertyDescriptor(m, k); if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) { desc = { enumerable: true, get: function() { return m[k]; } }; } Object.defineProperty(o, k2, desc); }) : (function(o, m, k, k2) { if (k2 === undefined) k2 = k; o[k2] = m[k]; })); var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) { Object.defineProperty(o, "default", { enumerable: true, value: v }); }) : function(o, v) { o["default"] = v; }); var __importStar = (this && this.__importStar) || function (mod) { if (mod && mod.__esModule) return mod; var result = {}; if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k); __setModuleDefault(result, mod); return result; }; Object.defineProperty(exports, "__esModule", { value: true }); exports.toDSSEBundle = exports.toMessageSignatureBundle = void 0; /* Copyright 2023 The Sigstore Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. */ const sigstore = __importStar(require("@sigstore/bundle")); const util_1 = require("../util"); // Helper functions for assembling the parts of a Sigstore bundle // Message signature bundle - $case: 'messageSignature' function toMessageSignatureBundle(artifact, signature) { const digest = util_1.crypto.hash(artifact.data); return sigstore.toMessageSignatureBundle({ digest, signature: signature.signature, certificate: signature.key.$case === 'x509Certificate' ? util_1.pem.toDER(signature.key.certificate) : undefined, keyHint: signature.key.$case === 'publicKey' ? signature.key.hint : undefined, }); } exports.toMessageSignatureBundle = toMessageSignatureBundle; // DSSE envelope bundle - $case: 'dsseEnvelope' function toDSSEBundle(artifact, signature, singleCertificate) { return sigstore.toDSSEBundle({ artifact: artifact.data, artifactType: artifact.type, signature: signature.signature, certificate: signature.key.$case === 'x509Certificate' ? util_1.pem.toDER(signature.key.certificate) : undefined, keyHint: signature.key.$case === 'publicKey' ? signature.key.hint : undefined, singleCertificate, }); } exports.toDSSEBundle = toDSSEBundle; sign/dist/error.js000064400000002373151701425750010152 0ustar00"use strict"; /* Copyright 2023 The Sigstore Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. */ Object.defineProperty(exports, "__esModule", { value: true }); exports.internalError = exports.InternalError = void 0; const error_1 = require("./external/error"); class InternalError extends Error { constructor({ code, message, cause, }) { super(message); this.name = this.constructor.name; this.cause = cause; this.code = code; } } exports.InternalError = InternalError; function internalError(err, code, message) { if (err instanceof error_1.HTTPError) { message += ` - ${err.message}`; } throw new InternalError({ code: code, message: message, cause: err, }); } exports.internalError = internalError; sign/dist/util/index.js000064400000004622151701425750011104 0ustar00"use strict"; var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) { if (k2 === undefined) k2 = k; var desc = Object.getOwnPropertyDescriptor(m, k); if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) { desc = { enumerable: true, get: function() { return m[k]; } }; } Object.defineProperty(o, k2, desc); }) : (function(o, m, k, k2) { if (k2 === undefined) k2 = k; o[k2] = m[k]; })); var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) { Object.defineProperty(o, "default", { enumerable: true, value: v }); }) : function(o, v) { o["default"] = v; }); var __importStar = (this && this.__importStar) || function (mod) { if (mod && mod.__esModule) return mod; var result = {}; if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k); __setModuleDefault(result, mod); return result; }; Object.defineProperty(exports, "__esModule", { value: true }); exports.ua = exports.oidc = exports.pem = exports.json = exports.encoding = exports.dsse = exports.crypto = void 0; /* Copyright 2023 The Sigstore Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. */ var core_1 = require("@sigstore/core"); Object.defineProperty(exports, "crypto", { enumerable: true, get: function () { return core_1.crypto; } }); Object.defineProperty(exports, "dsse", { enumerable: true, get: function () { return core_1.dsse; } }); Object.defineProperty(exports, "encoding", { enumerable: true, get: function () { return core_1.encoding; } }); Object.defineProperty(exports, "json", { enumerable: true, get: function () { return core_1.json; } }); Object.defineProperty(exports, "pem", { enumerable: true, get: function () { return core_1.pem; } }); exports.oidc = __importStar(require("./oidc")); exports.ua = __importStar(require("./ua")); sign/dist/util/oidc.js000064400000002144151701425750010710 0ustar00"use strict"; Object.defineProperty(exports, "__esModule", { value: true }); exports.extractJWTSubject = void 0; /* Copyright 2023 The Sigstore Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. */ const core_1 = require("@sigstore/core"); function extractJWTSubject(jwt) { const parts = jwt.split('.', 3); const payload = JSON.parse(core_1.encoding.base64Decode(parts[1])); switch (payload.iss) { case 'https://accounts.google.com': case 'https://oauth2.sigstore.dev/auth': return payload.email; default: return payload.sub; } } exports.extractJWTSubject = extractJWTSubject; sign/dist/util/ua.js000064400000002634151701425750010403 0ustar00"use strict"; var __importDefault = (this && this.__importDefault) || function (mod) { return (mod && mod.__esModule) ? mod : { "default": mod }; }; Object.defineProperty(exports, "__esModule", { value: true }); exports.getUserAgent = void 0; /* Copyright 2023 The Sigstore Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. */ const os_1 = __importDefault(require("os")); // Format User-Agent: <product> / <product-version> (<platform>) // source: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/User-Agent const getUserAgent = () => { // eslint-disable-next-line @typescript-eslint/no-var-requires const packageVersion = require('../../package.json').version; const nodeVersion = process.version; const platformName = os_1.default.platform(); const archName = os_1.default.arch(); return `sigstore-js/${packageVersion} (Node ${nodeVersion}) (${platformName}/${archName})`; }; exports.getUserAgent = getUserAgent; sign/dist/witness/index.js000064400000002233151701425750011617 0ustar00"use strict"; /* istanbul ignore file */ Object.defineProperty(exports, "__esModule", { value: true }); exports.TSAWitness = exports.RekorWitness = exports.DEFAULT_REKOR_URL = void 0; /* Copyright 2023 The Sigstore Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. */ var tlog_1 = require("./tlog"); Object.defineProperty(exports, "DEFAULT_REKOR_URL", { enumerable: true, get: function () { return tlog_1.DEFAULT_REKOR_URL; } }); Object.defineProperty(exports, "RekorWitness", { enumerable: true, get: function () { return tlog_1.RekorWitness; } }); var tsa_1 = require("./tsa"); Object.defineProperty(exports, "TSAWitness", { enumerable: true, get: function () { return tsa_1.TSAWitness; } }); sign/dist/witness/witness.js000064400000000115151701425750012201 0ustar00"use strict"; Object.defineProperty(exports, "__esModule", { value: true }); sign/dist/witness/tlog/entry.js000064400000012547151701425750012627 0ustar00"use strict"; Object.defineProperty(exports, "__esModule", { value: true }); exports.toProposedEntry = void 0; /* Copyright 2023 The Sigstore Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. */ const bundle_1 = require("@sigstore/bundle"); const util_1 = require("../../util"); function toProposedEntry(content, publicKey, // TODO: Remove this parameter once have completely switched to 'dsse' entries entryType = 'intoto') { switch (content.$case) { case 'dsseEnvelope': // TODO: Remove this conditional once have completely switched to 'dsse' entries if (entryType === 'dsse') { return toProposedDSSEEntry(content.dsseEnvelope, publicKey); } return toProposedIntotoEntry(content.dsseEnvelope, publicKey); case 'messageSignature': return toProposedHashedRekordEntry(content.messageSignature, publicKey); } } exports.toProposedEntry = toProposedEntry; // Returns a properly formatted Rekor "hashedrekord" entry for the given digest // and signature function toProposedHashedRekordEntry(messageSignature, publicKey) { const hexDigest = messageSignature.messageDigest.digest.toString('hex'); const b64Signature = messageSignature.signature.toString('base64'); const b64Key = util_1.encoding.base64Encode(publicKey); return { apiVersion: '0.0.1', kind: 'hashedrekord', spec: { data: { hash: { algorithm: 'sha256', value: hexDigest, }, }, signature: { content: b64Signature, publicKey: { content: b64Key, }, }, }, }; } // Returns a properly formatted Rekor "dsse" entry for the given DSSE envelope // and signature function toProposedDSSEEntry(envelope, publicKey) { const envelopeJSON = JSON.stringify((0, bundle_1.envelopeToJSON)(envelope)); const encodedKey = util_1.encoding.base64Encode(publicKey); return { apiVersion: '0.0.1', kind: 'dsse', spec: { proposedContent: { envelope: envelopeJSON, verifiers: [encodedKey], }, }, }; } // Returns a properly formatted Rekor "intoto" entry for the given DSSE // envelope and signature function toProposedIntotoEntry(envelope, publicKey) { // Calculate the value for the payloadHash field in the Rekor entry const payloadHash = util_1.crypto.hash(envelope.payload).toString('hex'); // Calculate the value for the hash field in the Rekor entry const envelopeHash = calculateDSSEHash(envelope, publicKey); // Collect values for re-creating the DSSE envelope. // Double-encode payload and signature cause that's what Rekor expects const payload = util_1.encoding.base64Encode(envelope.payload.toString('base64')); const sig = util_1.encoding.base64Encode(envelope.signatures[0].sig.toString('base64')); const keyid = envelope.signatures[0].keyid; const encodedKey = util_1.encoding.base64Encode(publicKey); // Create the envelope portion of the entry. Note the inclusion of the // publicKey in the signature struct is not a standard part of a DSSE // envelope, but is required by Rekor. const dsse = { payloadType: envelope.payloadType, payload: payload, signatures: [{ sig, publicKey: encodedKey }], }; // If the keyid is an empty string, Rekor seems to remove it altogether. We // need to do the same here so that we can properly recreate the entry for // verification. if (keyid.length > 0) { dsse.signatures[0].keyid = keyid; } return { apiVersion: '0.0.2', kind: 'intoto', spec: { content: { envelope: dsse, hash: { algorithm: 'sha256', value: envelopeHash }, payloadHash: { algorithm: 'sha256', value: payloadHash }, }, }, }; } // Calculates the hash of a DSSE envelope for inclusion in a Rekor entry. // There is no standard way to do this, so the scheme we're using as as // follows: // * payload is base64 encoded // * signature is base64 encoded (only the first signature is used) // * keyid is included ONLY if it is NOT an empty string // * The resulting JSON is canonicalized and hashed to a hex string function calculateDSSEHash(envelope, publicKey) { const dsse = { payloadType: envelope.payloadType, payload: envelope.payload.toString('base64'), signatures: [ { sig: envelope.signatures[0].sig.toString('base64'), publicKey }, ], }; // If the keyid is an empty string, Rekor seems to remove it altogether. if (envelope.signatures[0].keyid.length > 0) { dsse.signatures[0].keyid = envelope.signatures[0].keyid; } return util_1.crypto.hash(util_1.json.canonicalize(dsse)).toString('hex'); } sign/dist/witness/tlog/index.js000064400000005573151701425750012576 0ustar00"use strict"; Object.defineProperty(exports, "__esModule", { value: true }); exports.RekorWitness = exports.DEFAULT_REKOR_URL = void 0; /* Copyright 2023 The Sigstore Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. */ const util_1 = require("../../util"); const client_1 = require("./client"); const entry_1 = require("./entry"); exports.DEFAULT_REKOR_URL = 'https://rekor.sigstore.dev'; class RekorWitness { constructor(options) { this.entryType = options.entryType; this.tlog = new client_1.TLogClient({ ...options, rekorBaseURL: options.rekorBaseURL || /* istanbul ignore next */ exports.DEFAULT_REKOR_URL, }); } async testify(content, publicKey) { const proposedEntry = (0, entry_1.toProposedEntry)(content, publicKey, this.entryType); const entry = await this.tlog.createEntry(proposedEntry); return toTransparencyLogEntry(entry); } } exports.RekorWitness = RekorWitness; function toTransparencyLogEntry(entry) { const logID = Buffer.from(entry.logID, 'hex'); // Parse entry body so we can extract the kind and version. const bodyJSON = util_1.encoding.base64Decode(entry.body); const entryBody = JSON.parse(bodyJSON); const promise = entry?.verification?.signedEntryTimestamp ? inclusionPromise(entry.verification.signedEntryTimestamp) : undefined; const proof = entry?.verification?.inclusionProof ? inclusionProof(entry.verification.inclusionProof) : undefined; const tlogEntry = { logIndex: entry.logIndex.toString(), logId: { keyId: logID, }, integratedTime: entry.integratedTime.toString(), kindVersion: { kind: entryBody.kind, version: entryBody.apiVersion, }, inclusionPromise: promise, inclusionProof: proof, canonicalizedBody: Buffer.from(entry.body, 'base64'), }; return { tlogEntries: [tlogEntry], }; } function inclusionPromise(promise) { return { signedEntryTimestamp: Buffer.from(promise, 'base64'), }; } function inclusionProof(proof) { return { logIndex: proof.logIndex.toString(), treeSize: proof.treeSize.toString(), rootHash: Buffer.from(proof.rootHash, 'hex'), hashes: proof.hashes.map((h) => Buffer.from(h, 'hex')), checkpoint: { envelope: proof.checkpoint, }, }; } sign/dist/witness/tlog/client.js000064400000004266151701425750012743 0ustar00"use strict"; Object.defineProperty(exports, "__esModule", { value: true }); exports.TLogClient = void 0; /* Copyright 2023 The Sigstore Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. */ const error_1 = require("../../error"); const error_2 = require("../../external/error"); const rekor_1 = require("../../external/rekor"); class TLogClient { constructor(options) { this.fetchOnConflict = options.fetchOnConflict ?? false; this.rekor = new rekor_1.Rekor({ baseURL: options.rekorBaseURL, retry: options.retry, timeout: options.timeout, }); } async createEntry(proposedEntry) { let entry; try { entry = await this.rekor.createEntry(proposedEntry); } catch (err) { // If the entry already exists, fetch it (if enabled) if (entryExistsError(err) && this.fetchOnConflict) { // Grab the UUID of the existing entry from the location header /* istanbul ignore next */ const uuid = err.location.split('/').pop() || ''; try { entry = await this.rekor.getEntry(uuid); } catch (err) { (0, error_1.internalError)(err, 'TLOG_FETCH_ENTRY_ERROR', 'error fetching tlog entry'); } } else { (0, error_1.internalError)(err, 'TLOG_CREATE_ENTRY_ERROR', 'error creating tlog entry'); } } return entry; } } exports.TLogClient = TLogClient; function entryExistsError(value) { return (value instanceof error_2.HTTPError && value.statusCode === 409 && value.location !== undefined); } sign/dist/witness/tsa/index.js000064400000002677151701425750012422 0ustar00"use strict"; Object.defineProperty(exports, "__esModule", { value: true }); exports.TSAWitness = void 0; /* Copyright 2023 The Sigstore Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. */ const client_1 = require("./client"); class TSAWitness { constructor(options) { this.tsa = new client_1.TSAClient({ tsaBaseURL: options.tsaBaseURL, retry: options.retry, timeout: options.timeout, }); } async testify(content) { const signature = extractSignature(content); const timestamp = await this.tsa.createTimestamp(signature); return { rfc3161Timestamps: [{ signedTimestamp: timestamp }], }; } } exports.TSAWitness = TSAWitness; function extractSignature(content) { switch (content.$case) { case 'dsseEnvelope': return content.dsseEnvelope.signatures[0].sig; case 'messageSignature': return content.messageSignature.signature; } } sign/dist/witness/tsa/client.js000064400000002675151701425750012567 0ustar00"use strict"; Object.defineProperty(exports, "__esModule", { value: true }); exports.TSAClient = void 0; /* Copyright 2023 The Sigstore Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. */ const error_1 = require("../../error"); const tsa_1 = require("../../external/tsa"); const util_1 = require("../../util"); class TSAClient { constructor(options) { this.tsa = new tsa_1.TimestampAuthority({ baseURL: options.tsaBaseURL, retry: options.retry, timeout: options.timeout, }); } async createTimestamp(signature) { const request = { artifactHash: util_1.crypto.hash(signature).toString('base64'), hashAlgorithm: 'sha256', }; try { return await this.tsa.createTimestamp(request); } catch (err) { (0, error_1.internalError)(err, 'TSA_CREATE_TIMESTAMP_ERROR', 'error creating timestamp'); } } } exports.TSAClient = TSAClient; core/package.json000064400000001710151701425750007770 0ustar00{ "_id": "@sigstore/core@1.1.0", "_inBundle": true, "_location": "/npm/@sigstore/core", "_phantomChildren": {}, "_requiredBy": [ "/npm/@sigstore/sign", "/npm/@sigstore/verify", "/npm/sigstore" ], "author": { "name": "bdehamer@github.com" }, "bugs": { "url": "https://github.com/sigstore/sigstore-js/issues" }, "description": "Base library for Sigstore", "engines": { "node": "^16.14.0 || >=18.0.0" }, "files": [ "dist" ], "homepage": "https://github.com/sigstore/sigstore-js/tree/main/packages/core#readme", "license": "Apache-2.0", "main": "dist/index.js", "name": "@sigstore/core", "publishConfig": { "provenance": true }, "repository": { "type": "git", "url": "git+https://github.com/sigstore/sigstore-js.git" }, "scripts": { "build": "tsc --build", "clean": "shx rm -rf dist *.tsbuildinfo", "test": "jest" }, "types": "dist/index.d.ts", "version": "1.1.0" } core/LICENSE000064400000026127151701425750006520 0ustar00 Apache License Version 2.0, January 2004 http://www.apache.org/licenses/ TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION 1. Definitions. "License" shall mean the terms and conditions for use, reproduction, and distribution as defined by Sections 1 through 9 of this document. "Licensor" shall mean the copyright owner or entity authorized by the copyright owner that is granting the License. "Legal Entity" shall mean the union of the acting entity and all other entities that control, are controlled by, or are under common control with that entity. For the purposes of this definition, "control" means (i) the power, direct or indirect, to cause the direction or management of such entity, whether by contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the outstanding shares, or (iii) beneficial ownership of such entity. "You" (or "Your") shall mean an individual or Legal Entity exercising permissions granted by this License. "Source" form shall mean the preferred form for making modifications, including but not limited to software source code, documentation source, and configuration files. "Object" form shall mean any form resulting from mechanical transformation or translation of a Source form, including but not limited to compiled object code, generated documentation, and conversions to other media types. "Work" shall mean the work of authorship, whether in Source or Object form, made available under the License, as indicated by a copyright notice that is included in or attached to the work (an example is provided in the Appendix below). "Derivative Works" shall mean any work, whether in Source or Object form, that is based on (or derived from) the Work and for which the editorial revisions, annotations, elaborations, or other modifications represent, as a whole, an original work of authorship. For the purposes of this License, Derivative Works shall not include works that remain separable from, or merely link (or bind by name) to the interfaces of, the Work and Derivative Works thereof. "Contribution" shall mean any work of authorship, including the original version of the Work and any modifications or additions to that Work or Derivative Works thereof, that is intentionally submitted to Licensor for inclusion in the Work by the copyright owner or by an individual or Legal Entity authorized to submit on behalf of the copyright owner. For the purposes of this definition, "submitted" means any form of electronic, verbal, or written communication sent to the Licensor or its representatives, including but not limited to communication on electronic mailing lists, source code control systems, and issue tracking systems that are managed by, or on behalf of, the Licensor for the purpose of discussing and improving the Work, but excluding communication that is conspicuously marked or otherwise designated in writing by the copyright owner as "Not a Contribution." "Contributor" shall mean Licensor and any individual or Legal Entity on behalf of whom a Contribution has been received by Licensor and subsequently incorporated within the Work. 2. Grant of Copyright License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare Derivative Works of, publicly display, publicly perform, sublicense, and distribute the Work and such Derivative Works in Source or Object form. 3. Grant of Patent License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable (except as stated in this section) patent license to make, have made, use, offer to sell, sell, import, and otherwise transfer the Work, where such license applies only to those patent claims licensable by such Contributor that are necessarily infringed by their Contribution(s) alone or by combination of their Contribution(s) with the Work to which such Contribution(s) was submitted. If You institute patent litigation against any entity (including a cross-claim or counterclaim in a lawsuit) alleging that the Work or a Contribution incorporated within the Work constitutes direct or contributory patent infringement, then any patent licenses granted to You under this License for that Work shall terminate as of the date such litigation is filed. 4. Redistribution. You may reproduce and distribute copies of the Work or Derivative Works thereof in any medium, with or without modifications, and in Source or Object form, provided that You meet the following conditions: (a) You must give any other recipients of the Work or Derivative Works a copy of this License; and (b) You must cause any modified files to carry prominent notices stating that You changed the files; and (c) You must retain, in the Source form of any Derivative Works that You distribute, all copyright, patent, trademark, and attribution notices from the Source form of the Work, excluding those notices that do not pertain to any part of the Derivative Works; and (d) If the Work includes a "NOTICE" text file as part of its distribution, then any Derivative Works that You distribute must include a readable copy of the attribution notices contained within such NOTICE file, excluding those notices that do not pertain to any part of the Derivative Works, in at least one of the following places: within a NOTICE text file distributed as part of the Derivative Works; within the Source form or documentation, if provided along with the Derivative Works; or, within a display generated by the Derivative Works, if and wherever such third-party notices normally appear. The contents of the NOTICE file are for informational purposes only and do not modify the License. You may add Your own attribution notices within Derivative Works that You distribute, alongside or as an addendum to the NOTICE text from the Work, provided that such additional attribution notices cannot be construed as modifying the License. You may add Your own copyright statement to Your modifications and may provide additional or different license terms and conditions for use, reproduction, or distribution of Your modifications, or for any such Derivative Works as a whole, provided Your use, reproduction, and distribution of the Work otherwise complies with the conditions stated in this License. 5. Submission of Contributions. Unless You explicitly state otherwise, any Contribution intentionally submitted for inclusion in the Work by You to the Licensor shall be under the terms and conditions of this License, without any additional terms or conditions. Notwithstanding the above, nothing herein shall supersede or modify the terms of any separate license agreement you may have executed with Licensor regarding such Contributions. 6. Trademarks. This License does not grant permission to use the trade names, trademarks, service marks, or product names of the Licensor, except as required for reasonable and customary use in describing the origin of the Work and reproducing the content of the NOTICE file. 7. Disclaimer of Warranty. Unless required by applicable law or agreed to in writing, Licensor provides the Work (and each Contributor provides its Contributions) on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. You are solely responsible for determining the appropriateness of using or redistributing the Work and assume any risks associated with Your exercise of permissions under this License. 8. Limitation of Liability. In no event and under no legal theory, whether in tort (including negligence), contract, or otherwise, unless required by applicable law (such as deliberate and grossly negligent acts) or agreed to in writing, shall any Contributor be liable to You for damages, including any direct, indirect, special, incidental, or consequential damages of any character arising as a result of this License or out of the use or inability to use the Work (including but not limited to damages for loss of goodwill, work stoppage, computer failure or malfunction, or any and all other commercial damages or losses), even if such Contributor has been advised of the possibility of such damages. 9. Accepting Warranty or Additional Liability. While redistributing the Work or Derivative Works thereof, You may choose to offer, and charge a fee for, acceptance of support, warranty, indemnity, or other liability obligations and/or rights consistent with this License. However, in accepting such obligations, You may act only on Your own behalf and on Your sole responsibility, not on behalf of any other Contributor, and only if You agree to indemnify, defend, and hold each Contributor harmless for any liability incurred by, or claims asserted against, such Contributor by reason of your accepting any such warranty or additional liability. END OF TERMS AND CONDITIONS APPENDIX: How to apply the Apache License to your work. To apply the Apache License to your work, attach the following boilerplate notice, with the fields enclosed by brackets "[]" replaced with your own identifying information. (Don't include the brackets!) The text should be enclosed in the appropriate comment syntax for the file format. We also recommend that a file or class name and description of purpose be included on the same "printed page" as the copyright notice for easier identification within third-party archives. Copyright 2023 The Sigstore Authors Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. core/dist/rfc3161/timestamp.js000064400000020124151701425750012073 0ustar00"use strict"; var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) { if (k2 === undefined) k2 = k; var desc = Object.getOwnPropertyDescriptor(m, k); if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) { desc = { enumerable: true, get: function() { return m[k]; } }; } Object.defineProperty(o, k2, desc); }) : (function(o, m, k, k2) { if (k2 === undefined) k2 = k; o[k2] = m[k]; })); var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) { Object.defineProperty(o, "default", { enumerable: true, value: v }); }) : function(o, v) { o["default"] = v; }); var __importStar = (this && this.__importStar) || function (mod) { if (mod && mod.__esModule) return mod; var result = {}; if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k); __setModuleDefault(result, mod); return result; }; Object.defineProperty(exports, "__esModule", { value: true }); exports.RFC3161Timestamp = void 0; /* Copyright 2023 The Sigstore Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. */ const asn1_1 = require("../asn1"); const crypto = __importStar(require("../crypto")); const oid_1 = require("../oid"); const error_1 = require("./error"); const tstinfo_1 = require("./tstinfo"); const OID_PKCS9_CONTENT_TYPE_SIGNED_DATA = '1.2.840.113549.1.7.2'; const OID_PKCS9_CONTENT_TYPE_TSTINFO = '1.2.840.113549.1.9.16.1.4'; const OID_PKCS9_MESSAGE_DIGEST_KEY = '1.2.840.113549.1.9.4'; class RFC3161Timestamp { constructor(asn1) { this.root = asn1; } static parse(der) { const asn1 = asn1_1.ASN1Obj.parseBuffer(der); return new RFC3161Timestamp(asn1); } get status() { return this.pkiStatusInfoObj.subs[0].toInteger(); } get contentType() { return this.contentTypeObj.toOID(); } get eContentType() { return this.eContentTypeObj.toOID(); } get signingTime() { return this.tstInfo.genTime; } get signerIssuer() { return this.signerSidObj.subs[0].value; } get signerSerialNumber() { return this.signerSidObj.subs[1].value; } get signerDigestAlgorithm() { const oid = this.signerDigestAlgorithmObj.subs[0].toOID(); return oid_1.SHA2_HASH_ALGOS[oid]; } get signatureAlgorithm() { const oid = this.signatureAlgorithmObj.subs[0].toOID(); return oid_1.ECDSA_SIGNATURE_ALGOS[oid]; } get signatureValue() { return this.signatureValueObj.value; } get tstInfo() { // Need to unpack tstInfo from an OCTET STRING return new tstinfo_1.TSTInfo(this.eContentObj.subs[0].subs[0]); } verify(data, publicKey) { if (!this.timeStampTokenObj) { throw new error_1.RFC3161TimestampVerificationError('timeStampToken is missing'); } // Check for expected ContentInfo content type if (this.contentType !== OID_PKCS9_CONTENT_TYPE_SIGNED_DATA) { throw new error_1.RFC3161TimestampVerificationError(`incorrect content type: ${this.contentType}`); } // Check for expected encapsulated content type if (this.eContentType !== OID_PKCS9_CONTENT_TYPE_TSTINFO) { throw new error_1.RFC3161TimestampVerificationError(`incorrect encapsulated content type: ${this.eContentType}`); } // Check that the tstInfo references the correct artifact this.tstInfo.verify(data); // Check that the signed message digest matches the tstInfo this.verifyMessageDigest(); // Check that the signature is valid for the signed attributes this.verifySignature(publicKey); } verifyMessageDigest() { // Check that the tstInfo matches the signed data const tstInfoDigest = crypto.digest(this.signerDigestAlgorithm, this.tstInfo.raw); const expectedDigest = this.messageDigestAttributeObj.subs[1].subs[0].value; if (!crypto.bufferEqual(tstInfoDigest, expectedDigest)) { throw new error_1.RFC3161TimestampVerificationError('signed data does not match tstInfo'); } } verifySignature(key) { // Encode the signed attributes for verification const signedAttrs = this.signedAttrsObj.toDER(); signedAttrs[0] = 0x31; // Change context-specific tag to SET // Check that the signature is valid for the signed attributes const verified = crypto.verify(signedAttrs, key, this.signatureValue, this.signatureAlgorithm); if (!verified) { throw new error_1.RFC3161TimestampVerificationError('signature verification failed'); } } // https://www.rfc-editor.org/rfc/rfc3161#section-2.4.2 get pkiStatusInfoObj() { // pkiStatusInfo is the first element of the timestamp response sequence return this.root.subs[0]; } // https://www.rfc-editor.org/rfc/rfc3161#section-2.4.2 get timeStampTokenObj() { // timeStampToken is the first element of the timestamp response sequence return this.root.subs[1]; } // https://datatracker.ietf.org/doc/html/rfc5652#section-3 get contentTypeObj() { return this.timeStampTokenObj.subs[0]; } // https://www.rfc-editor.org/rfc/rfc5652#section-3 get signedDataObj() { const obj = this.timeStampTokenObj.subs.find((sub) => sub.tag.isContextSpecific(0x00)); return obj.subs[0]; } // https://datatracker.ietf.org/doc/html/rfc5652#section-5.1 get encapContentInfoObj() { return this.signedDataObj.subs[2]; } // https://datatracker.ietf.org/doc/html/rfc5652#section-5.1 get signerInfosObj() { // SignerInfos is the last element of the signed data sequence const sd = this.signedDataObj; return sd.subs[sd.subs.length - 1]; } // https://www.rfc-editor.org/rfc/rfc5652#section-5.1 get signerInfoObj() { // Only supporting one signer return this.signerInfosObj.subs[0]; } // https://datatracker.ietf.org/doc/html/rfc5652#section-5.2 get eContentTypeObj() { return this.encapContentInfoObj.subs[0]; } // https://datatracker.ietf.org/doc/html/rfc5652#section-5.2 get eContentObj() { return this.encapContentInfoObj.subs[1]; } // https://datatracker.ietf.org/doc/html/rfc5652#section-5.3 get signedAttrsObj() { const signedAttrs = this.signerInfoObj.subs.find((sub) => sub.tag.isContextSpecific(0x00)); return signedAttrs; } // https://datatracker.ietf.org/doc/html/rfc5652#section-5.3 get messageDigestAttributeObj() { const messageDigest = this.signedAttrsObj.subs.find((sub) => sub.subs[0].tag.isOID() && sub.subs[0].toOID() === OID_PKCS9_MESSAGE_DIGEST_KEY); return messageDigest; } // https://datatracker.ietf.org/doc/html/rfc5652#section-5.3 get signerSidObj() { return this.signerInfoObj.subs[1]; } // https://datatracker.ietf.org/doc/html/rfc5652#section-5.3 get signerDigestAlgorithmObj() { // Signature is the 2nd element of the signerInfoObj object return this.signerInfoObj.subs[2]; } // https://datatracker.ietf.org/doc/html/rfc5652#section-5.3 get signatureAlgorithmObj() { // Signature is the 4th element of the signerInfoObj object return this.signerInfoObj.subs[4]; } // https://datatracker.ietf.org/doc/html/rfc5652#section-5.3 get signatureValueObj() { // Signature is the 6th element of the signerInfoObj object return this.signerInfoObj.subs[5]; } } exports.RFC3161Timestamp = RFC3161Timestamp; core/dist/rfc3161/index.js000064400000001527151701425750011205 0ustar00"use strict"; /* Copyright 2023 The Sigstore Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. */ Object.defineProperty(exports, "__esModule", { value: true }); exports.RFC3161Timestamp = void 0; var timestamp_1 = require("./timestamp"); Object.defineProperty(exports, "RFC3161Timestamp", { enumerable: true, get: function () { return timestamp_1.RFC3161Timestamp; } }); core/dist/rfc3161/tstinfo.js000064400000004270151701425750011562 0ustar00"use strict"; var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) { if (k2 === undefined) k2 = k; var desc = Object.getOwnPropertyDescriptor(m, k); if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) { desc = { enumerable: true, get: function() { return m[k]; } }; } Object.defineProperty(o, k2, desc); }) : (function(o, m, k, k2) { if (k2 === undefined) k2 = k; o[k2] = m[k]; })); var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) { Object.defineProperty(o, "default", { enumerable: true, value: v }); }) : function(o, v) { o["default"] = v; }); var __importStar = (this && this.__importStar) || function (mod) { if (mod && mod.__esModule) return mod; var result = {}; if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k); __setModuleDefault(result, mod); return result; }; Object.defineProperty(exports, "__esModule", { value: true }); exports.TSTInfo = void 0; const crypto = __importStar(require("../crypto")); const oid_1 = require("../oid"); const error_1 = require("./error"); class TSTInfo { constructor(asn1) { this.root = asn1; } get version() { return this.root.subs[0].toInteger(); } get genTime() { return this.root.subs[4].toDate(); } get messageImprintHashAlgorithm() { const oid = this.messageImprintObj.subs[0].subs[0].toOID(); return oid_1.SHA2_HASH_ALGOS[oid]; } get messageImprintHashedMessage() { return this.messageImprintObj.subs[1].value; } get raw() { return this.root.toDER(); } verify(data) { const digest = crypto.digest(this.messageImprintHashAlgorithm, data); if (!crypto.bufferEqual(digest, this.messageImprintHashedMessage)) { throw new error_1.RFC3161TimestampVerificationError('message imprint does not match artifact'); } } // https://www.rfc-editor.org/rfc/rfc3161#section-2.4.2 get messageImprintObj() { return this.root.subs[2]; } } exports.TSTInfo = TSTInfo; core/dist/rfc3161/error.js000064400000001502151701425750011220 0ustar00"use strict"; Object.defineProperty(exports, "__esModule", { value: true }); exports.RFC3161TimestampVerificationError = void 0; /* Copyright 2023 The Sigstore Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. */ class RFC3161TimestampVerificationError extends Error { } exports.RFC3161TimestampVerificationError = RFC3161TimestampVerificationError; core/dist/pem.js000064400000003117151701425750007567 0ustar00"use strict"; Object.defineProperty(exports, "__esModule", { value: true }); exports.fromDER = exports.toDER = void 0; /* Copyright 2023 The Sigstore Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. */ const PEM_HEADER = /-----BEGIN (.*)-----/; const PEM_FOOTER = /-----END (.*)-----/; function toDER(certificate) { let der = ''; certificate.split('\n').forEach((line) => { if (line.match(PEM_HEADER) || line.match(PEM_FOOTER)) { return; } der += line; }); return Buffer.from(der, 'base64'); } exports.toDER = toDER; // Translates a DER-encoded buffer into a PEM-encoded string. Standard PEM // encoding dictates that each certificate should have a trailing newline after // the footer. function fromDER(certificate, type = 'CERTIFICATE') { // Base64-encode the certificate. const der = certificate.toString('base64'); // Split the certificate into lines of 64 characters. const lines = der.match(/.{1,64}/g) || ''; return [`-----BEGIN ${type}-----`, ...lines, `-----END ${type}-----`] .join('\n') .concat('\n'); } exports.fromDER = fromDER; core/dist/crypto.js000064400000004413151701425750010326 0ustar00"use strict"; var __importDefault = (this && this.__importDefault) || function (mod) { return (mod && mod.__esModule) ? mod : { "default": mod }; }; Object.defineProperty(exports, "__esModule", { value: true }); exports.bufferEqual = exports.verify = exports.hash = exports.digest = exports.createPublicKey = void 0; /* Copyright 2023 The Sigstore Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. */ const crypto_1 = __importDefault(require("crypto")); const SHA256_ALGORITHM = 'sha256'; function createPublicKey(key, type = 'spki') { if (typeof key === 'string') { return crypto_1.default.createPublicKey(key); } else { return crypto_1.default.createPublicKey({ key, format: 'der', type: type }); } } exports.createPublicKey = createPublicKey; function digest(algorithm, ...data) { const hash = crypto_1.default.createHash(algorithm); for (const d of data) { hash.update(d); } return hash.digest(); } exports.digest = digest; // TODO: deprecate this in favor of digest() function hash(...data) { const hash = crypto_1.default.createHash(SHA256_ALGORITHM); for (const d of data) { hash.update(d); } return hash.digest(); } exports.hash = hash; function verify(data, key, signature, algorithm) { // The try/catch is to work around an issue in Node 14.x where verify throws // an error in some scenarios if the signature is invalid. try { return crypto_1.default.verify(algorithm, data, key, signature); } catch (e) { /* istanbul ignore next */ return false; } } exports.verify = verify; function bufferEqual(a, b) { try { return crypto_1.default.timingSafeEqual(a, b); } catch { /* istanbul ignore next */ return false; } } exports.bufferEqual = bufferEqual; core/dist/index.js000064400000005736151701425750010126 0ustar00"use strict"; var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) { if (k2 === undefined) k2 = k; var desc = Object.getOwnPropertyDescriptor(m, k); if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) { desc = { enumerable: true, get: function() { return m[k]; } }; } Object.defineProperty(o, k2, desc); }) : (function(o, m, k, k2) { if (k2 === undefined) k2 = k; o[k2] = m[k]; })); var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) { Object.defineProperty(o, "default", { enumerable: true, value: v }); }) : function(o, v) { o["default"] = v; }); var __importStar = (this && this.__importStar) || function (mod) { if (mod && mod.__esModule) return mod; var result = {}; if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k); __setModuleDefault(result, mod); return result; }; Object.defineProperty(exports, "__esModule", { value: true }); exports.X509SCTExtension = exports.X509Certificate = exports.EXTENSION_OID_SCT = exports.ByteStream = exports.RFC3161Timestamp = exports.pem = exports.json = exports.encoding = exports.dsse = exports.crypto = exports.ASN1Obj = void 0; /* Copyright 2023 The Sigstore Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. */ var asn1_1 = require("./asn1"); Object.defineProperty(exports, "ASN1Obj", { enumerable: true, get: function () { return asn1_1.ASN1Obj; } }); exports.crypto = __importStar(require("./crypto")); exports.dsse = __importStar(require("./dsse")); exports.encoding = __importStar(require("./encoding")); exports.json = __importStar(require("./json")); exports.pem = __importStar(require("./pem")); var rfc3161_1 = require("./rfc3161"); Object.defineProperty(exports, "RFC3161Timestamp", { enumerable: true, get: function () { return rfc3161_1.RFC3161Timestamp; } }); var stream_1 = require("./stream"); Object.defineProperty(exports, "ByteStream", { enumerable: true, get: function () { return stream_1.ByteStream; } }); var x509_1 = require("./x509"); Object.defineProperty(exports, "EXTENSION_OID_SCT", { enumerable: true, get: function () { return x509_1.EXTENSION_OID_SCT; } }); Object.defineProperty(exports, "X509Certificate", { enumerable: true, get: function () { return x509_1.X509Certificate; } }); Object.defineProperty(exports, "X509SCTExtension", { enumerable: true, get: function () { return x509_1.X509SCTExtension; } }); core/dist/dsse.js000064400000002030151701425750007735 0ustar00"use strict"; Object.defineProperty(exports, "__esModule", { value: true }); exports.preAuthEncoding = void 0; /* Copyright 2023 The Sigstore Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. */ const PAE_PREFIX = 'DSSEv1'; // DSSE Pre-Authentication Encoding function preAuthEncoding(payloadType, payload) { const prefix = [ PAE_PREFIX, payloadType.length, payloadType, payload.length, '', ].join(' '); return Buffer.concat([Buffer.from(prefix, 'ascii'), payload]); } exports.preAuthEncoding = preAuthEncoding; core/dist/x509/cert.js000064400000021667151701425750010462 0ustar00"use strict"; var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) { if (k2 === undefined) k2 = k; var desc = Object.getOwnPropertyDescriptor(m, k); if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) { desc = { enumerable: true, get: function() { return m[k]; } }; } Object.defineProperty(o, k2, desc); }) : (function(o, m, k, k2) { if (k2 === undefined) k2 = k; o[k2] = m[k]; })); var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) { Object.defineProperty(o, "default", { enumerable: true, value: v }); }) : function(o, v) { o["default"] = v; }); var __importStar = (this && this.__importStar) || function (mod) { if (mod && mod.__esModule) return mod; var result = {}; if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k); __setModuleDefault(result, mod); return result; }; Object.defineProperty(exports, "__esModule", { value: true }); exports.X509Certificate = exports.EXTENSION_OID_SCT = void 0; /* Copyright 2023 The Sigstore Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. */ const asn1_1 = require("../asn1"); const crypto = __importStar(require("../crypto")); const oid_1 = require("../oid"); const pem = __importStar(require("../pem")); const ext_1 = require("./ext"); const EXTENSION_OID_SUBJECT_KEY_ID = '2.5.29.14'; const EXTENSION_OID_KEY_USAGE = '2.5.29.15'; const EXTENSION_OID_SUBJECT_ALT_NAME = '2.5.29.17'; const EXTENSION_OID_BASIC_CONSTRAINTS = '2.5.29.19'; const EXTENSION_OID_AUTHORITY_KEY_ID = '2.5.29.35'; exports.EXTENSION_OID_SCT = '1.3.6.1.4.1.11129.2.4.2'; class X509Certificate { constructor(asn1) { this.root = asn1; } static parse(cert) { const der = typeof cert === 'string' ? pem.toDER(cert) : cert; const asn1 = asn1_1.ASN1Obj.parseBuffer(der); return new X509Certificate(asn1); } get tbsCertificate() { return this.tbsCertificateObj; } get version() { // version number is the first element of the version context specific tag const ver = this.versionObj.subs[0].toInteger(); return `v${(ver + BigInt(1)).toString()}`; } get serialNumber() { return this.serialNumberObj.value; } get notBefore() { // notBefore is the first element of the validity sequence return this.validityObj.subs[0].toDate(); } get notAfter() { // notAfter is the second element of the validity sequence return this.validityObj.subs[1].toDate(); } get issuer() { return this.issuerObj.value; } get subject() { return this.subjectObj.value; } get publicKey() { return this.subjectPublicKeyInfoObj.toDER(); } get signatureAlgorithm() { const oid = this.signatureAlgorithmObj.subs[0].toOID(); return oid_1.ECDSA_SIGNATURE_ALGOS[oid]; } get signatureValue() { // Signature value is a bit string, so we need to skip the first byte return this.signatureValueObj.value.subarray(1); } get subjectAltName() { const ext = this.extSubjectAltName; return ext?.uri || ext?.rfc822Name; } get extensions() { // The extension list is the first (and only) element of the extensions // context specific tag const extSeq = this.extensionsObj?.subs[0]; return extSeq?.subs || /* istanbul ignore next */ []; } get extKeyUsage() { const ext = this.findExtension(EXTENSION_OID_KEY_USAGE); return ext ? new ext_1.X509KeyUsageExtension(ext) : undefined; } get extBasicConstraints() { const ext = this.findExtension(EXTENSION_OID_BASIC_CONSTRAINTS); return ext ? new ext_1.X509BasicConstraintsExtension(ext) : undefined; } get extSubjectAltName() { const ext = this.findExtension(EXTENSION_OID_SUBJECT_ALT_NAME); return ext ? new ext_1.X509SubjectAlternativeNameExtension(ext) : undefined; } get extAuthorityKeyID() { const ext = this.findExtension(EXTENSION_OID_AUTHORITY_KEY_ID); return ext ? new ext_1.X509AuthorityKeyIDExtension(ext) : undefined; } get extSubjectKeyID() { const ext = this.findExtension(EXTENSION_OID_SUBJECT_KEY_ID); return ext ? new ext_1.X509SubjectKeyIDExtension(ext) : /* istanbul ignore next */ undefined; } get extSCT() { const ext = this.findExtension(exports.EXTENSION_OID_SCT); return ext ? new ext_1.X509SCTExtension(ext) : undefined; } get isCA() { const ca = this.extBasicConstraints?.isCA || false; // If the KeyUsage extension is present, keyCertSign must be set if (this.extKeyUsage) { ca && this.extKeyUsage.keyCertSign; } return ca; } extension(oid) { const ext = this.findExtension(oid); return ext ? new ext_1.X509Extension(ext) : undefined; } verify(issuerCertificate) { // Use the issuer's public key if provided, otherwise use the subject's const publicKey = issuerCertificate?.publicKey || this.publicKey; const key = crypto.createPublicKey(publicKey); return crypto.verify(this.tbsCertificate.toDER(), key, this.signatureValue, this.signatureAlgorithm); } validForDate(date) { return this.notBefore <= date && date <= this.notAfter; } equals(other) { return this.root.toDER().equals(other.root.toDER()); } // Creates a copy of the certificate with a new buffer clone() { const der = this.root.toDER(); const clone = Buffer.alloc(der.length); der.copy(clone); return X509Certificate.parse(clone); } findExtension(oid) { // Find the extension with the given OID. The OID will always be the first // element of the extension sequence return this.extensions.find((ext) => ext.subs[0].toOID() === oid); } ///////////////////////////////////////////////////////////////////////////// // The following properties use the documented x509 structure to locate the // desired ASN.1 object // https://www.rfc-editor.org/rfc/rfc5280#section-4.1 // https://www.rfc-editor.org/rfc/rfc5280#section-4.1.1.1 get tbsCertificateObj() { // tbsCertificate is the first element of the certificate sequence return this.root.subs[0]; } // https://www.rfc-editor.org/rfc/rfc5280#section-4.1.1.2 get signatureAlgorithmObj() { // signatureAlgorithm is the second element of the certificate sequence return this.root.subs[1]; } // https://www.rfc-editor.org/rfc/rfc5280#section-4.1.1.3 get signatureValueObj() { // signatureValue is the third element of the certificate sequence return this.root.subs[2]; } // https://www.rfc-editor.org/rfc/rfc5280#section-4.1.2.1 get versionObj() { // version is the first element of the tbsCertificate sequence return this.tbsCertificateObj.subs[0]; } // https://www.rfc-editor.org/rfc/rfc5280#section-4.1.2.2 get serialNumberObj() { // serialNumber is the second element of the tbsCertificate sequence return this.tbsCertificateObj.subs[1]; } // https://www.rfc-editor.org/rfc/rfc5280#section-4.1.2.4 get issuerObj() { // issuer is the fourth element of the tbsCertificate sequence return this.tbsCertificateObj.subs[3]; } // https://www.rfc-editor.org/rfc/rfc5280#section-4.1.2.5 get validityObj() { // version is the fifth element of the tbsCertificate sequence return this.tbsCertificateObj.subs[4]; } // https://www.rfc-editor.org/rfc/rfc5280#section-4.1.2.6 get subjectObj() { // subject is the sixth element of the tbsCertificate sequence return this.tbsCertificateObj.subs[5]; } // https://www.rfc-editor.org/rfc/rfc5280#section-4.1.2.7 get subjectPublicKeyInfoObj() { // subjectPublicKeyInfo is the seventh element of the tbsCertificate sequence return this.tbsCertificateObj.subs[6]; } // Extensions can't be located by index because their position varies. Instead, // we need to find the extensions context specific tag // https://www.rfc-editor.org/rfc/rfc5280#section-4.1.2.9 get extensionsObj() { return this.tbsCertificateObj.subs.find((sub) => sub.tag.isContextSpecific(0x03)); } } exports.X509Certificate = X509Certificate; core/dist/x509/index.js000064400000002233151701425750010620 0ustar00"use strict"; /* Copyright 2023 The Sigstore Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. */ Object.defineProperty(exports, "__esModule", { value: true }); exports.X509SCTExtension = exports.X509Certificate = exports.EXTENSION_OID_SCT = void 0; var cert_1 = require("./cert"); Object.defineProperty(exports, "EXTENSION_OID_SCT", { enumerable: true, get: function () { return cert_1.EXTENSION_OID_SCT; } }); Object.defineProperty(exports, "X509Certificate", { enumerable: true, get: function () { return cert_1.X509Certificate; } }); var ext_1 = require("./ext"); Object.defineProperty(exports, "X509SCTExtension", { enumerable: true, get: function () { return ext_1.X509SCTExtension; } }); core/dist/x509/ext.js000064400000012715151701425750010317 0ustar00"use strict"; Object.defineProperty(exports, "__esModule", { value: true }); exports.X509SCTExtension = exports.X509SubjectKeyIDExtension = exports.X509AuthorityKeyIDExtension = exports.X509SubjectAlternativeNameExtension = exports.X509KeyUsageExtension = exports.X509BasicConstraintsExtension = exports.X509Extension = void 0; const stream_1 = require("../stream"); const sct_1 = require("./sct"); // https://www.rfc-editor.org/rfc/rfc5280#section-4.1 class X509Extension { constructor(asn1) { this.root = asn1; } get oid() { return this.root.subs[0].toOID(); } get critical() { // The critical field is optional and will be the second element of the // extension sequence if present. Default to false if not present. return this.root.subs.length === 3 ? this.root.subs[1].toBoolean() : false; } get value() { return this.extnValueObj.value; } get valueObj() { return this.extnValueObj; } get extnValueObj() { // The extnValue field will be the last element of the extension sequence return this.root.subs[this.root.subs.length - 1]; } } exports.X509Extension = X509Extension; // https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.9 class X509BasicConstraintsExtension extends X509Extension { get isCA() { return this.sequence.subs[0]?.toBoolean() ?? false; } get pathLenConstraint() { return this.sequence.subs.length > 1 ? this.sequence.subs[1].toInteger() : undefined; } // The extnValue field contains a single sequence wrapping the isCA and // pathLenConstraint. get sequence() { return this.extnValueObj.subs[0]; } } exports.X509BasicConstraintsExtension = X509BasicConstraintsExtension; // https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.3 class X509KeyUsageExtension extends X509Extension { get digitalSignature() { return this.bitString[0] === 1; } get keyCertSign() { return this.bitString[5] === 1; } get crlSign() { return this.bitString[6] === 1; } // The extnValue field contains a single bit string which is a bit mask // indicating which key usages are enabled. get bitString() { return this.extnValueObj.subs[0].toBitString(); } } exports.X509KeyUsageExtension = X509KeyUsageExtension; // https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.6 class X509SubjectAlternativeNameExtension extends X509Extension { get rfc822Name() { return this.findGeneralName(0x01)?.value.toString('ascii'); } get uri() { return this.findGeneralName(0x06)?.value.toString('ascii'); } // Retrieve the value of an otherName with the given OID. otherName(oid) { const otherName = this.findGeneralName(0x00); if (otherName === undefined) { return undefined; } // The otherName is a sequence containing an OID and a value. // Need to check that the OID matches the one we're looking for. const otherNameOID = otherName.subs[0].toOID(); if (otherNameOID !== oid) { return undefined; } // The otherNameValue is a sequence containing the actual value. const otherNameValue = otherName.subs[1]; return otherNameValue.subs[0].value.toString('ascii'); } findGeneralName(tag) { return this.generalNames.find((gn) => gn.tag.isContextSpecific(tag)); } // The extnValue field contains a sequence of GeneralNames. get generalNames() { return this.extnValueObj.subs[0].subs; } } exports.X509SubjectAlternativeNameExtension = X509SubjectAlternativeNameExtension; // https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.1 class X509AuthorityKeyIDExtension extends X509Extension { get keyIdentifier() { return this.findSequenceMember(0x00)?.value; } findSequenceMember(tag) { return this.sequence.subs.find((el) => el.tag.isContextSpecific(tag)); } // The extnValue field contains a single sequence wrapping the keyIdentifier get sequence() { return this.extnValueObj.subs[0]; } } exports.X509AuthorityKeyIDExtension = X509AuthorityKeyIDExtension; // https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.2 class X509SubjectKeyIDExtension extends X509Extension { get keyIdentifier() { return this.extnValueObj.subs[0].value; } } exports.X509SubjectKeyIDExtension = X509SubjectKeyIDExtension; // https://www.rfc-editor.org/rfc/rfc6962#section-3.3 class X509SCTExtension extends X509Extension { constructor(asn1) { super(asn1); } get signedCertificateTimestamps() { const buf = this.extnValueObj.subs[0].value; const stream = new stream_1.ByteStream(buf); // The overall list length is encoded in the first two bytes -- note this // is the length of the list in bytes, NOT the number of SCTs in the list const end = stream.getUint16() + 2; const sctList = []; while (stream.position < end) { // Read the length of the next SCT const sctLength = stream.getUint16(); // Slice out the bytes for the next SCT and parse it const sct = stream.getBlock(sctLength); sctList.push(sct_1.SignedCertificateTimestamp.parse(sct)); } if (stream.position !== end) { throw new Error('SCT list length does not match actual length'); } return sctList; } } exports.X509SCTExtension = X509SCTExtension; core/dist/x509/sct.js000064400000013124151701425750010303 0ustar00"use strict"; var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) { if (k2 === undefined) k2 = k; var desc = Object.getOwnPropertyDescriptor(m, k); if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) { desc = { enumerable: true, get: function() { return m[k]; } }; } Object.defineProperty(o, k2, desc); }) : (function(o, m, k, k2) { if (k2 === undefined) k2 = k; o[k2] = m[k]; })); var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) { Object.defineProperty(o, "default", { enumerable: true, value: v }); }) : function(o, v) { o["default"] = v; }); var __importStar = (this && this.__importStar) || function (mod) { if (mod && mod.__esModule) return mod; var result = {}; if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k); __setModuleDefault(result, mod); return result; }; Object.defineProperty(exports, "__esModule", { value: true }); exports.SignedCertificateTimestamp = void 0; /* Copyright 2023 The Sigstore Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. */ const crypto = __importStar(require("../crypto")); const stream_1 = require("../stream"); class SignedCertificateTimestamp { constructor(options) { this.version = options.version; this.logID = options.logID; this.timestamp = options.timestamp; this.extensions = options.extensions; this.hashAlgorithm = options.hashAlgorithm; this.signatureAlgorithm = options.signatureAlgorithm; this.signature = options.signature; } get datetime() { return new Date(Number(this.timestamp.readBigInt64BE())); } // Returns the hash algorithm used to generate the SCT's signature. // https://www.rfc-editor.org/rfc/rfc5246#section-7.4.1.4.1 get algorithm() { switch (this.hashAlgorithm) { /* istanbul ignore next */ case 0: return 'none'; /* istanbul ignore next */ case 1: return 'md5'; /* istanbul ignore next */ case 2: return 'sha1'; /* istanbul ignore next */ case 3: return 'sha224'; case 4: return 'sha256'; /* istanbul ignore next */ case 5: return 'sha384'; /* istanbul ignore next */ case 6: return 'sha512'; /* istanbul ignore next */ default: return 'unknown'; } } verify(preCert, key) { // Assemble the digitally-signed struct (the data over which the signature // was generated). // https://www.rfc-editor.org/rfc/rfc6962#section-3.2 const stream = new stream_1.ByteStream(); stream.appendChar(this.version); stream.appendChar(0x00); // SignatureType = certificate_timestamp(0) stream.appendView(this.timestamp); stream.appendUint16(0x01); // LogEntryType = precert_entry(1) stream.appendView(preCert); stream.appendUint16(this.extensions.byteLength); /* istanbul ignore next - extensions are very uncommon */ if (this.extensions.byteLength > 0) { stream.appendView(this.extensions); } return crypto.verify(stream.buffer, key, this.signature, this.algorithm); } // Parses a SignedCertificateTimestamp from a buffer. SCTs are encoded using // TLS encoding which means the fields and lengths of most fields are // specified as part of the SCT and TLS specs. // https://www.rfc-editor.org/rfc/rfc6962#section-3.2 // https://www.rfc-editor.org/rfc/rfc5246#section-7.4.1.4.1 static parse(buf) { const stream = new stream_1.ByteStream(buf); // Version - enum { v1(0), (255) } const version = stream.getUint8(); // Log ID - struct { opaque key_id[32]; } const logID = stream.getBlock(32); // Timestamp - uint64 const timestamp = stream.getBlock(8); // Extensions - opaque extensions<0..2^16-1>; const extenstionLength = stream.getUint16(); const extensions = stream.getBlock(extenstionLength); // Hash algo - enum { sha256(4), . . . (255) } const hashAlgorithm = stream.getUint8(); // Signature algo - enum { anonymous(0), rsa(1), dsa(2), ecdsa(3), (255) } const signatureAlgorithm = stream.getUint8(); // Signature - opaque signature<0..2^16-1>; const sigLength = stream.getUint16(); const signature = stream.getBlock(sigLength); // Check that we read the entire buffer if (stream.position !== buf.length) { throw new Error('SCT buffer length mismatch'); } return new SignedCertificateTimestamp({ version, logID, timestamp, extensions, hashAlgorithm, signatureAlgorithm, signature, }); } } exports.SignedCertificateTimestamp = SignedCertificateTimestamp; core/dist/encoding.js000064400000002020151701425750010564 0ustar00"use strict"; Object.defineProperty(exports, "__esModule", { value: true }); exports.base64Decode = exports.base64Encode = void 0; /* Copyright 2023 The Sigstore Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. */ const BASE64_ENCODING = 'base64'; const UTF8_ENCODING = 'utf-8'; function base64Encode(str) { return Buffer.from(str, UTF8_ENCODING).toString(BASE64_ENCODING); } exports.base64Encode = base64Encode; function base64Decode(str) { return Buffer.from(str, BASE64_ENCODING).toString(UTF8_ENCODING); } exports.base64Decode = base64Decode; core/dist/stream.js000064400000006713151701425750010306 0ustar00"use strict"; Object.defineProperty(exports, "__esModule", { value: true }); exports.ByteStream = void 0; /* Copyright 2023 The Sigstore Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. */ class StreamError extends Error { } class ByteStream { constructor(buffer) { this.start = 0; if (buffer) { this.buf = buffer; this.view = Buffer.from(buffer); } else { this.buf = new ArrayBuffer(0); this.view = Buffer.from(this.buf); } } get buffer() { return this.view.subarray(0, this.start); } get length() { return this.view.byteLength; } get position() { return this.start; } seek(position) { this.start = position; } // Returns a Buffer containing the specified number of bytes starting at the // given start position. slice(start, len) { const end = start + len; if (end > this.length) { throw new StreamError('request past end of buffer'); } return this.view.subarray(start, end); } appendChar(char) { this.ensureCapacity(1); this.view[this.start] = char; this.start += 1; } appendUint16(num) { this.ensureCapacity(2); const value = new Uint16Array([num]); const view = new Uint8Array(value.buffer); this.view[this.start] = view[1]; this.view[this.start + 1] = view[0]; this.start += 2; } appendUint24(num) { this.ensureCapacity(3); const value = new Uint32Array([num]); const view = new Uint8Array(value.buffer); this.view[this.start] = view[2]; this.view[this.start + 1] = view[1]; this.view[this.start + 2] = view[0]; this.start += 3; } appendView(view) { this.ensureCapacity(view.length); this.view.set(view, this.start); this.start += view.length; } getBlock(size) { if (size <= 0) { return Buffer.alloc(0); } if (this.start + size > this.view.length) { throw new Error('request past end of buffer'); } const result = this.view.subarray(this.start, this.start + size); this.start += size; return result; } getUint8() { return this.getBlock(1)[0]; } getUint16() { const block = this.getBlock(2); return (block[0] << 8) | block[1]; } ensureCapacity(size) { if (this.start + size > this.view.byteLength) { const blockSize = ByteStream.BLOCK_SIZE + (size > ByteStream.BLOCK_SIZE ? size : 0); this.realloc(this.view.byteLength + blockSize); } } realloc(size) { const newArray = new ArrayBuffer(size); const newView = Buffer.from(newArray); // Copy the old buffer into the new one newView.set(this.view); this.buf = newArray; this.view = newView; } } exports.ByteStream = ByteStream; ByteStream.BLOCK_SIZE = 1024; core/dist/asn1/index.js000064400000001452151701425750010757 0ustar00"use strict"; Object.defineProperty(exports, "__esModule", { value: true }); exports.ASN1Obj = void 0; /* Copyright 2023 The Sigstore Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. */ var obj_1 = require("./obj"); Object.defineProperty(exports, "ASN1Obj", { enumerable: true, get: function () { return obj_1.ASN1Obj; } }); core/dist/asn1/parse.js000064400000011074151701425750010763 0ustar00"use strict"; Object.defineProperty(exports, "__esModule", { value: true }); exports.parseBitString = exports.parseBoolean = exports.parseOID = exports.parseTime = exports.parseStringASCII = exports.parseInteger = void 0; /* Copyright 2023 The Sigstore Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. */ const RE_TIME_SHORT_YEAR = /^(\d{2})(\d{2})(\d{2})(\d{2})(\d{2})(\d{2})(\.\d{3})?Z$/; const RE_TIME_LONG_YEAR = /^(\d{4})(\d{2})(\d{2})(\d{2})(\d{2})(\d{2})(\.\d{3})?Z$/; // Parse a BigInt from the DER-encoded buffer // https://learn.microsoft.com/en-us/windows/win32/seccertenroll/about-integer function parseInteger(buf) { let pos = 0; const end = buf.length; let val = buf[pos]; const neg = val > 0x7f; // Consume any padding bytes const pad = neg ? 0xff : 0x00; while (val == pad && ++pos < end) { val = buf[pos]; } // Calculate remaining bytes to read const len = end - pos; if (len === 0) return BigInt(neg ? -1 : 0); // Handle two's complement for negative numbers val = neg ? val - 256 : val; // Parse remaining bytes let n = BigInt(val); for (let i = pos + 1; i < end; ++i) { n = n * BigInt(256) + BigInt(buf[i]); } return n; } exports.parseInteger = parseInteger; // Parse an ASCII string from the DER-encoded buffer // https://learn.microsoft.com/en-us/windows/win32/seccertenroll/about-basic-types#boolean function parseStringASCII(buf) { return buf.toString('ascii'); } exports.parseStringASCII = parseStringASCII; // Parse a Date from the DER-encoded buffer // https://www.rfc-editor.org/rfc/rfc5280#section-4.1.2.5.1 function parseTime(buf, shortYear) { const timeStr = parseStringASCII(buf); // Parse the time string into matches - captured groups start at index 1 const m = shortYear ? RE_TIME_SHORT_YEAR.exec(timeStr) : RE_TIME_LONG_YEAR.exec(timeStr); if (!m) { throw new Error('invalid time'); } // Translate dates with a 2-digit year to 4 digits per the spec if (shortYear) { let year = Number(m[1]); year += year >= 50 ? 1900 : 2000; m[1] = year.toString(); } // Translate to ISO8601 format and parse return new Date(`${m[1]}-${m[2]}-${m[3]}T${m[4]}:${m[5]}:${m[6]}Z`); } exports.parseTime = parseTime; // Parse an OID from the DER-encoded buffer // https://learn.microsoft.com/en-us/windows/win32/seccertenroll/about-object-identifier function parseOID(buf) { let pos = 0; const end = buf.length; // Consume first byte which encodes the first two OID components let n = buf[pos++]; const first = Math.floor(n / 40); const second = n % 40; let oid = `${first}.${second}`; // Consume remaining bytes let val = 0; for (; pos < end; ++pos) { n = buf[pos]; val = (val << 7) + (n & 0x7f); // If the left-most bit is NOT set, then this is the last byte in the // sequence and we can add the value to the OID and reset the accumulator if ((n & 0x80) === 0) { oid += `.${val}`; val = 0; } } return oid; } exports.parseOID = parseOID; // Parse a boolean from the DER-encoded buffer // https://learn.microsoft.com/en-us/windows/win32/seccertenroll/about-basic-types#boolean function parseBoolean(buf) { return buf[0] !== 0; } exports.parseBoolean = parseBoolean; // Parse a bit string from the DER-encoded buffer // https://learn.microsoft.com/en-us/windows/win32/seccertenroll/about-bit-string function parseBitString(buf) { // First byte tell us how many unused bits are in the last byte const unused = buf[0]; const start = 1; const end = buf.length; const bits = []; for (let i = start; i < end; ++i) { const byte = buf[i]; // The skip value is only used for the last byte const skip = i === end - 1 ? unused : 0; // Iterate over each bit in the byte (most significant first) for (let j = 7; j >= skip; --j) { // Read the bit and add it to the bit string bits.push((byte >> j) & 0x01); } } return bits; } exports.parseBitString = parseBitString; core/dist/asn1/obj.js000064400000012777151701425750010436 0ustar00"use strict"; Object.defineProperty(exports, "__esModule", { value: true }); exports.ASN1Obj = void 0; /* Copyright 2023 The Sigstore Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. */ const stream_1 = require("../stream"); const error_1 = require("./error"); const length_1 = require("./length"); const parse_1 = require("./parse"); const tag_1 = require("./tag"); class ASN1Obj { constructor(tag, value, subs) { this.tag = tag; this.value = value; this.subs = subs; } // Constructs an ASN.1 object from a Buffer of DER-encoded bytes. static parseBuffer(buf) { return parseStream(new stream_1.ByteStream(buf)); } toDER() { const valueStream = new stream_1.ByteStream(); if (this.subs.length > 0) { for (const sub of this.subs) { valueStream.appendView(sub.toDER()); } } else { valueStream.appendView(this.value); } const value = valueStream.buffer; // Concat tag/length/value const obj = new stream_1.ByteStream(); obj.appendChar(this.tag.toDER()); obj.appendView((0, length_1.encodeLength)(value.length)); obj.appendView(value); return obj.buffer; } ///////////////////////////////////////////////////////////////////////////// // Convenience methods for parsing ASN.1 primitives into JS types // Returns the ASN.1 object's value as a boolean. Throws an error if the // object is not a boolean. toBoolean() { if (!this.tag.isBoolean()) { throw new error_1.ASN1TypeError('not a boolean'); } return (0, parse_1.parseBoolean)(this.value); } // Returns the ASN.1 object's value as a BigInt. Throws an error if the // object is not an integer. toInteger() { if (!this.tag.isInteger()) { throw new error_1.ASN1TypeError('not an integer'); } return (0, parse_1.parseInteger)(this.value); } // Returns the ASN.1 object's value as an OID string. Throws an error if the // object is not an OID. toOID() { if (!this.tag.isOID()) { throw new error_1.ASN1TypeError('not an OID'); } return (0, parse_1.parseOID)(this.value); } // Returns the ASN.1 object's value as a Date. Throws an error if the object // is not either a UTCTime or a GeneralizedTime. toDate() { switch (true) { case this.tag.isUTCTime(): return (0, parse_1.parseTime)(this.value, true); case this.tag.isGeneralizedTime(): return (0, parse_1.parseTime)(this.value, false); default: throw new error_1.ASN1TypeError('not a date'); } } // Returns the ASN.1 object's value as a number[] where each number is the // value of a bit in the bit string. Throws an error if the object is not a // bit string. toBitString() { if (!this.tag.isBitString()) { throw new error_1.ASN1TypeError('not a bit string'); } return (0, parse_1.parseBitString)(this.value); } } exports.ASN1Obj = ASN1Obj; ///////////////////////////////////////////////////////////////////////////// // Internal stream parsing functions function parseStream(stream) { // Parse tag, length, and value from stream const tag = new tag_1.ASN1Tag(stream.getUint8()); const len = (0, length_1.decodeLength)(stream); const value = stream.slice(stream.position, len); const start = stream.position; let subs = []; // If the object is constructed, parse its children. Sometimes, children // are embedded in OCTESTRING objects, so we need to check those // for children as well. if (tag.constructed) { subs = collectSubs(stream, len); } else if (tag.isOctetString()) { // Attempt to parse children of OCTETSTRING objects. If anything fails, // assume the object is not constructed and treat as primitive. try { subs = collectSubs(stream, len); } catch (e) { // Fail silently and treat as primitive } } // If there are no children, move stream cursor to the end of the object if (subs.length === 0) { stream.seek(start + len); } return new ASN1Obj(tag, value, subs); } function collectSubs(stream, len) { // Calculate end of object content const end = stream.position + len; // Make sure there are enough bytes left in the stream. This should never // happen, cause it'll get caught when the stream is sliced in parseStream. // Leaving as an extra check just in case. /* istanbul ignore if */ if (end > stream.length) { throw new error_1.ASN1ParseError('invalid length'); } // Parse all children const subs = []; while (stream.position < end) { subs.push(parseStream(stream)); } // When we're done parsing children, we should be at the end of the object if (stream.position !== end) { throw new error_1.ASN1ParseError('invalid length'); } return subs; } core/dist/asn1/length.js000064400000004464151701425750011137 0ustar00"use strict"; /* Copyright 2023 The Sigstore Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. */ Object.defineProperty(exports, "__esModule", { value: true }); exports.encodeLength = exports.decodeLength = void 0; const error_1 = require("./error"); // Decodes the length of a DER-encoded ANS.1 element from the supplied stream. // https://learn.microsoft.com/en-us/windows/win32/seccertenroll/about-encoded-length-and-value-bytes function decodeLength(stream) { const buf = stream.getUint8(); // If the most significant bit is UNSET the length is just the value of the // byte. if ((buf & 0x80) === 0x00) { return buf; } // Otherwise, the lower 7 bits of the first byte indicate the number of bytes // that follow to encode the length. const byteCount = buf & 0x7f; // Ensure the encoded length can safely fit in a JS number. if (byteCount > 6) { throw new error_1.ASN1ParseError('length exceeds 6 byte limit'); } // Iterate over the bytes that encode the length. let len = 0; for (let i = 0; i < byteCount; i++) { len = len * 256 + stream.getUint8(); } // This is a valid ASN.1 length encoding, but we don't support it. if (len === 0) { throw new error_1.ASN1ParseError('indefinite length encoding not supported'); } return len; } exports.decodeLength = decodeLength; // Translates the supplied value to a DER-encoded length. function encodeLength(len) { if (len < 128) { return Buffer.from([len]); } // Bitwise operations on large numbers are not supported in JS, so we need to // use BigInts. let val = BigInt(len); const bytes = []; while (val > 0n) { bytes.unshift(Number(val & 255n)); val = val >> 8n; } return Buffer.from([0x80 | bytes.length, ...bytes]); } exports.encodeLength = encodeLength; core/dist/asn1/tag.js000064400000005425151701425750010427 0ustar00"use strict"; Object.defineProperty(exports, "__esModule", { value: true }); exports.ASN1Tag = void 0; /* Copyright 2023 The Sigstore Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. */ const error_1 = require("./error"); const UNIVERSAL_TAG = { BOOLEAN: 0x01, INTEGER: 0x02, BIT_STRING: 0x03, OCTET_STRING: 0x04, OBJECT_IDENTIFIER: 0x06, SEQUENCE: 0x10, SET: 0x11, PRINTABLE_STRING: 0x13, UTC_TIME: 0x17, GENERALIZED_TIME: 0x18, }; const TAG_CLASS = { UNIVERSAL: 0x00, APPLICATION: 0x01, CONTEXT_SPECIFIC: 0x02, PRIVATE: 0x03, }; // https://learn.microsoft.com/en-us/windows/win32/seccertenroll/about-encoded-tag-bytes class ASN1Tag { constructor(enc) { // Bits 0 through 4 are the tag number this.number = enc & 0x1f; // Bit 5 is the constructed bit this.constructed = (enc & 0x20) === 0x20; // Bit 6 & 7 are the class this.class = enc >> 6; if (this.number === 0x1f) { throw new error_1.ASN1ParseError('long form tags not supported'); } if (this.class === TAG_CLASS.UNIVERSAL && this.number === 0x00) { throw new error_1.ASN1ParseError('unsupported tag 0x00'); } } isUniversal() { return this.class === TAG_CLASS.UNIVERSAL; } isContextSpecific(num) { const res = this.class === TAG_CLASS.CONTEXT_SPECIFIC; return num !== undefined ? res && this.number === num : res; } isBoolean() { return this.isUniversal() && this.number === UNIVERSAL_TAG.BOOLEAN; } isInteger() { return this.isUniversal() && this.number === UNIVERSAL_TAG.INTEGER; } isBitString() { return this.isUniversal() && this.number === UNIVERSAL_TAG.BIT_STRING; } isOctetString() { return this.isUniversal() && this.number === UNIVERSAL_TAG.OCTET_STRING; } isOID() { return (this.isUniversal() && this.number === UNIVERSAL_TAG.OBJECT_IDENTIFIER); } isUTCTime() { return this.isUniversal() && this.number === UNIVERSAL_TAG.UTC_TIME; } isGeneralizedTime() { return this.isUniversal() && this.number === UNIVERSAL_TAG.GENERALIZED_TIME; } toDER() { return this.number | (this.constructed ? 0x20 : 0x00) | (this.class << 6); } } exports.ASN1Tag = ASN1Tag; core/dist/asn1/error.js000064400000001533151701425750011001 0ustar00"use strict"; Object.defineProperty(exports, "__esModule", { value: true }); exports.ASN1TypeError = exports.ASN1ParseError = void 0; /* Copyright 2023 The Sigstore Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. */ class ASN1ParseError extends Error { } exports.ASN1ParseError = ASN1ParseError; class ASN1TypeError extends Error { } exports.ASN1TypeError = ASN1TypeError; core/dist/oid.js000064400000000737151701425750007566 0ustar00"use strict"; Object.defineProperty(exports, "__esModule", { value: true }); exports.SHA2_HASH_ALGOS = exports.ECDSA_SIGNATURE_ALGOS = void 0; exports.ECDSA_SIGNATURE_ALGOS = { '1.2.840.10045.4.3.1': 'sha224', '1.2.840.10045.4.3.2': 'sha256', '1.2.840.10045.4.3.3': 'sha384', '1.2.840.10045.4.3.4': 'sha512', }; exports.SHA2_HASH_ALGOS = { '2.16.840.1.101.3.4.2.1': 'sha256', '2.16.840.1.101.3.4.2.2': 'sha384', '2.16.840.1.101.3.4.2.3': 'sha512', }; core/dist/json.js000064400000003700151701425750007755 0ustar00"use strict"; /* Copyright 2023 The Sigstore Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. */ Object.defineProperty(exports, "__esModule", { value: true }); exports.canonicalize = void 0; // JSON canonicalization per https://github.com/cyberphone/json-canonicalization // eslint-disable-next-line @typescript-eslint/no-explicit-any function canonicalize(object) { let buffer = ''; if (object === null || typeof object !== 'object' || object.toJSON != null) { // Primitives or toJSONable objects buffer += JSON.stringify(object); } else if (Array.isArray(object)) { // Array - maintain element order buffer += '['; let first = true; object.forEach((element) => { if (!first) { buffer += ','; } first = false; // recursive call buffer += canonicalize(element); }); buffer += ']'; } else { // Object - Sort properties before serializing buffer += '{'; let first = true; Object.keys(object) .sort() .forEach((property) => { if (!first) { buffer += ','; } first = false; buffer += JSON.stringify(property); buffer += ':'; // recursive call buffer += canonicalize(object[property]); }); buffer += '}'; } return buffer; } exports.canonicalize = canonicalize; bundle/package.json000064400000002032151701425750010307 0ustar00{ "_id": "@sigstore/bundle@2.3.2", "_inBundle": true, "_location": "/npm/@sigstore/bundle", "_phantomChildren": {}, "_requiredBy": [ "/npm/@sigstore/sign", "/npm/@sigstore/verify", "/npm/sigstore" ], "author": { "name": "bdehamer@github.com" }, "bugs": { "url": "https://github.com/sigstore/sigstore-js/issues" }, "dependencies": { "@sigstore/protobuf-specs": "^0.3.2" }, "description": "Sigstore bundle type", "engines": { "node": "^16.14.0 || >=18.0.0" }, "files": [ "dist", "store" ], "homepage": "https://github.com/sigstore/sigstore-js/tree/main/packages/bundle#readme", "license": "Apache-2.0", "main": "dist/index.js", "name": "@sigstore/bundle", "publishConfig": { "provenance": true }, "repository": { "type": "git", "url": "git+https://github.com/sigstore/sigstore-js.git" }, "scripts": { "build": "tsc --build", "clean": "shx rm -rf dist *.tsbuildinfo", "test": "jest" }, "types": "dist/index.d.ts", "version": "2.3.2" } bundle/LICENSE000064400000026127151701425750007041 0ustar00 Apache License Version 2.0, January 2004 http://www.apache.org/licenses/ TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION 1. Definitions. "License" shall mean the terms and conditions for use, reproduction, and distribution as defined by Sections 1 through 9 of this document. "Licensor" shall mean the copyright owner or entity authorized by the copyright owner that is granting the License. "Legal Entity" shall mean the union of the acting entity and all other entities that control, are controlled by, or are under common control with that entity. For the purposes of this definition, "control" means (i) the power, direct or indirect, to cause the direction or management of such entity, whether by contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the outstanding shares, or (iii) beneficial ownership of such entity. "You" (or "Your") shall mean an individual or Legal Entity exercising permissions granted by this License. "Source" form shall mean the preferred form for making modifications, including but not limited to software source code, documentation source, and configuration files. "Object" form shall mean any form resulting from mechanical transformation or translation of a Source form, including but not limited to compiled object code, generated documentation, and conversions to other media types. "Work" shall mean the work of authorship, whether in Source or Object form, made available under the License, as indicated by a copyright notice that is included in or attached to the work (an example is provided in the Appendix below). "Derivative Works" shall mean any work, whether in Source or Object form, that is based on (or derived from) the Work and for which the editorial revisions, annotations, elaborations, or other modifications represent, as a whole, an original work of authorship. For the purposes of this License, Derivative Works shall not include works that remain separable from, or merely link (or bind by name) to the interfaces of, the Work and Derivative Works thereof. "Contribution" shall mean any work of authorship, including the original version of the Work and any modifications or additions to that Work or Derivative Works thereof, that is intentionally submitted to Licensor for inclusion in the Work by the copyright owner or by an individual or Legal Entity authorized to submit on behalf of the copyright owner. For the purposes of this definition, "submitted" means any form of electronic, verbal, or written communication sent to the Licensor or its representatives, including but not limited to communication on electronic mailing lists, source code control systems, and issue tracking systems that are managed by, or on behalf of, the Licensor for the purpose of discussing and improving the Work, but excluding communication that is conspicuously marked or otherwise designated in writing by the copyright owner as "Not a Contribution." "Contributor" shall mean Licensor and any individual or Legal Entity on behalf of whom a Contribution has been received by Licensor and subsequently incorporated within the Work. 2. Grant of Copyright License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare Derivative Works of, publicly display, publicly perform, sublicense, and distribute the Work and such Derivative Works in Source or Object form. 3. Grant of Patent License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable (except as stated in this section) patent license to make, have made, use, offer to sell, sell, import, and otherwise transfer the Work, where such license applies only to those patent claims licensable by such Contributor that are necessarily infringed by their Contribution(s) alone or by combination of their Contribution(s) with the Work to which such Contribution(s) was submitted. If You institute patent litigation against any entity (including a cross-claim or counterclaim in a lawsuit) alleging that the Work or a Contribution incorporated within the Work constitutes direct or contributory patent infringement, then any patent licenses granted to You under this License for that Work shall terminate as of the date such litigation is filed. 4. Redistribution. You may reproduce and distribute copies of the Work or Derivative Works thereof in any medium, with or without modifications, and in Source or Object form, provided that You meet the following conditions: (a) You must give any other recipients of the Work or Derivative Works a copy of this License; and (b) You must cause any modified files to carry prominent notices stating that You changed the files; and (c) You must retain, in the Source form of any Derivative Works that You distribute, all copyright, patent, trademark, and attribution notices from the Source form of the Work, excluding those notices that do not pertain to any part of the Derivative Works; and (d) If the Work includes a "NOTICE" text file as part of its distribution, then any Derivative Works that You distribute must include a readable copy of the attribution notices contained within such NOTICE file, excluding those notices that do not pertain to any part of the Derivative Works, in at least one of the following places: within a NOTICE text file distributed as part of the Derivative Works; within the Source form or documentation, if provided along with the Derivative Works; or, within a display generated by the Derivative Works, if and wherever such third-party notices normally appear. The contents of the NOTICE file are for informational purposes only and do not modify the License. You may add Your own attribution notices within Derivative Works that You distribute, alongside or as an addendum to the NOTICE text from the Work, provided that such additional attribution notices cannot be construed as modifying the License. You may add Your own copyright statement to Your modifications and may provide additional or different license terms and conditions for use, reproduction, or distribution of Your modifications, or for any such Derivative Works as a whole, provided Your use, reproduction, and distribution of the Work otherwise complies with the conditions stated in this License. 5. Submission of Contributions. Unless You explicitly state otherwise, any Contribution intentionally submitted for inclusion in the Work by You to the Licensor shall be under the terms and conditions of this License, without any additional terms or conditions. Notwithstanding the above, nothing herein shall supersede or modify the terms of any separate license agreement you may have executed with Licensor regarding such Contributions. 6. Trademarks. This License does not grant permission to use the trade names, trademarks, service marks, or product names of the Licensor, except as required for reasonable and customary use in describing the origin of the Work and reproducing the content of the NOTICE file. 7. Disclaimer of Warranty. Unless required by applicable law or agreed to in writing, Licensor provides the Work (and each Contributor provides its Contributions) on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. You are solely responsible for determining the appropriateness of using or redistributing the Work and assume any risks associated with Your exercise of permissions under this License. 8. Limitation of Liability. In no event and under no legal theory, whether in tort (including negligence), contract, or otherwise, unless required by applicable law (such as deliberate and grossly negligent acts) or agreed to in writing, shall any Contributor be liable to You for damages, including any direct, indirect, special, incidental, or consequential damages of any character arising as a result of this License or out of the use or inability to use the Work (including but not limited to damages for loss of goodwill, work stoppage, computer failure or malfunction, or any and all other commercial damages or losses), even if such Contributor has been advised of the possibility of such damages. 9. Accepting Warranty or Additional Liability. While redistributing the Work or Derivative Works thereof, You may choose to offer, and charge a fee for, acceptance of support, warranty, indemnity, or other liability obligations and/or rights consistent with this License. However, in accepting such obligations, You may act only on Your own behalf and on Your sole responsibility, not on behalf of any other Contributor, and only if You agree to indemnify, defend, and hold each Contributor harmless for any liability incurred by, or claims asserted against, such Contributor by reason of your accepting any such warranty or additional liability. END OF TERMS AND CONDITIONS APPENDIX: How to apply the Apache License to your work. To apply the Apache License to your work, attach the following boilerplate notice, with the fields enclosed by brackets "[]" replaced with your own identifying information. (Don't include the brackets!) The text should be enclosed in the appropriate comment syntax for the file format. We also recommend that a file or class name and description of purpose be included on the same "printed page" as the copyright notice for easier identification within third-party archives. Copyright 2023 The Sigstore Authors Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. bundle/dist/utility.js000064400000000115151701425750011025 0ustar00"use strict"; Object.defineProperty(exports, "__esModule", { value: true }); bundle/dist/index.js000064400000010072151701425750010434 0ustar00"use strict"; Object.defineProperty(exports, "__esModule", { value: true }); exports.isBundleV01 = exports.assertBundleV02 = exports.assertBundleV01 = exports.assertBundleLatest = exports.assertBundle = exports.envelopeToJSON = exports.envelopeFromJSON = exports.bundleToJSON = exports.bundleFromJSON = exports.ValidationError = exports.isBundleWithPublicKey = exports.isBundleWithMessageSignature = exports.isBundleWithDsseEnvelope = exports.isBundleWithCertificateChain = exports.BUNDLE_V03_MEDIA_TYPE = exports.BUNDLE_V03_LEGACY_MEDIA_TYPE = exports.BUNDLE_V02_MEDIA_TYPE = exports.BUNDLE_V01_MEDIA_TYPE = exports.toMessageSignatureBundle = exports.toDSSEBundle = void 0; /* Copyright 2023 The Sigstore Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. */ var build_1 = require("./build"); Object.defineProperty(exports, "toDSSEBundle", { enumerable: true, get: function () { return build_1.toDSSEBundle; } }); Object.defineProperty(exports, "toMessageSignatureBundle", { enumerable: true, get: function () { return build_1.toMessageSignatureBundle; } }); var bundle_1 = require("./bundle"); Object.defineProperty(exports, "BUNDLE_V01_MEDIA_TYPE", { enumerable: true, get: function () { return bundle_1.BUNDLE_V01_MEDIA_TYPE; } }); Object.defineProperty(exports, "BUNDLE_V02_MEDIA_TYPE", { enumerable: true, get: function () { return bundle_1.BUNDLE_V02_MEDIA_TYPE; } }); Object.defineProperty(exports, "BUNDLE_V03_LEGACY_MEDIA_TYPE", { enumerable: true, get: function () { return bundle_1.BUNDLE_V03_LEGACY_MEDIA_TYPE; } }); Object.defineProperty(exports, "BUNDLE_V03_MEDIA_TYPE", { enumerable: true, get: function () { return bundle_1.BUNDLE_V03_MEDIA_TYPE; } }); Object.defineProperty(exports, "isBundleWithCertificateChain", { enumerable: true, get: function () { return bundle_1.isBundleWithCertificateChain; } }); Object.defineProperty(exports, "isBundleWithDsseEnvelope", { enumerable: true, get: function () { return bundle_1.isBundleWithDsseEnvelope; } }); Object.defineProperty(exports, "isBundleWithMessageSignature", { enumerable: true, get: function () { return bundle_1.isBundleWithMessageSignature; } }); Object.defineProperty(exports, "isBundleWithPublicKey", { enumerable: true, get: function () { return bundle_1.isBundleWithPublicKey; } }); var error_1 = require("./error"); Object.defineProperty(exports, "ValidationError", { enumerable: true, get: function () { return error_1.ValidationError; } }); var serialized_1 = require("./serialized"); Object.defineProperty(exports, "bundleFromJSON", { enumerable: true, get: function () { return serialized_1.bundleFromJSON; } }); Object.defineProperty(exports, "bundleToJSON", { enumerable: true, get: function () { return serialized_1.bundleToJSON; } }); Object.defineProperty(exports, "envelopeFromJSON", { enumerable: true, get: function () { return serialized_1.envelopeFromJSON; } }); Object.defineProperty(exports, "envelopeToJSON", { enumerable: true, get: function () { return serialized_1.envelopeToJSON; } }); var validate_1 = require("./validate"); Object.defineProperty(exports, "assertBundle", { enumerable: true, get: function () { return validate_1.assertBundle; } }); Object.defineProperty(exports, "assertBundleLatest", { enumerable: true, get: function () { return validate_1.assertBundleLatest; } }); Object.defineProperty(exports, "assertBundleV01", { enumerable: true, get: function () { return validate_1.assertBundleV01; } }); Object.defineProperty(exports, "assertBundleV02", { enumerable: true, get: function () { return validate_1.assertBundleV02; } }); Object.defineProperty(exports, "isBundleV01", { enumerable: true, get: function () { return validate_1.isBundleV01; } }); bundle/dist/bundle.js000064400000002607151701425750010603 0ustar00"use strict"; Object.defineProperty(exports, "__esModule", { value: true }); exports.isBundleWithDsseEnvelope = exports.isBundleWithMessageSignature = exports.isBundleWithPublicKey = exports.isBundleWithCertificateChain = exports.BUNDLE_V03_MEDIA_TYPE = exports.BUNDLE_V03_LEGACY_MEDIA_TYPE = exports.BUNDLE_V02_MEDIA_TYPE = exports.BUNDLE_V01_MEDIA_TYPE = void 0; exports.BUNDLE_V01_MEDIA_TYPE = 'application/vnd.dev.sigstore.bundle+json;version=0.1'; exports.BUNDLE_V02_MEDIA_TYPE = 'application/vnd.dev.sigstore.bundle+json;version=0.2'; exports.BUNDLE_V03_LEGACY_MEDIA_TYPE = 'application/vnd.dev.sigstore.bundle+json;version=0.3'; exports.BUNDLE_V03_MEDIA_TYPE = 'application/vnd.dev.sigstore.bundle.v0.3+json'; // Type guards for bundle variants. function isBundleWithCertificateChain(b) { return b.verificationMaterial.content.$case === 'x509CertificateChain'; } exports.isBundleWithCertificateChain = isBundleWithCertificateChain; function isBundleWithPublicKey(b) { return b.verificationMaterial.content.$case === 'publicKey'; } exports.isBundleWithPublicKey = isBundleWithPublicKey; function isBundleWithMessageSignature(b) { return b.content.$case === 'messageSignature'; } exports.isBundleWithMessageSignature = isBundleWithMessageSignature; function isBundleWithDsseEnvelope(b) { return b.content.$case === 'dsseEnvelope'; } exports.isBundleWithDsseEnvelope = isBundleWithDsseEnvelope; bundle/dist/build.js000064400000006120151701425750010423 0ustar00"use strict"; Object.defineProperty(exports, "__esModule", { value: true }); exports.toDSSEBundle = exports.toMessageSignatureBundle = void 0; /* Copyright 2023 The Sigstore Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. */ const protobuf_specs_1 = require("@sigstore/protobuf-specs"); const bundle_1 = require("./bundle"); // Message signature bundle - $case: 'messageSignature' function toMessageSignatureBundle(options) { return { mediaType: options.singleCertificate ? bundle_1.BUNDLE_V03_MEDIA_TYPE : bundle_1.BUNDLE_V02_MEDIA_TYPE, content: { $case: 'messageSignature', messageSignature: { messageDigest: { algorithm: protobuf_specs_1.HashAlgorithm.SHA2_256, digest: options.digest, }, signature: options.signature, }, }, verificationMaterial: toVerificationMaterial(options), }; } exports.toMessageSignatureBundle = toMessageSignatureBundle; // DSSE envelope bundle - $case: 'dsseEnvelope' function toDSSEBundle(options) { return { mediaType: options.singleCertificate ? bundle_1.BUNDLE_V03_MEDIA_TYPE : bundle_1.BUNDLE_V02_MEDIA_TYPE, content: { $case: 'dsseEnvelope', dsseEnvelope: toEnvelope(options), }, verificationMaterial: toVerificationMaterial(options), }; } exports.toDSSEBundle = toDSSEBundle; function toEnvelope(options) { return { payloadType: options.artifactType, payload: options.artifact, signatures: [toSignature(options)], }; } function toSignature(options) { return { keyid: options.keyHint || '', sig: options.signature, }; } // Verification material function toVerificationMaterial(options) { return { content: toKeyContent(options), tlogEntries: [], timestampVerificationData: { rfc3161Timestamps: [] }, }; } function toKeyContent(options) { if (options.certificate) { if (options.singleCertificate) { return { $case: 'certificate', certificate: { rawBytes: options.certificate }, }; } else { return { $case: 'x509CertificateChain', x509CertificateChain: { certificates: [{ rawBytes: options.certificate }], }, }; } } else { return { $case: 'publicKey', publicKey: { hint: options.keyHint || '', }, }; } } bundle/dist/error.js000064400000001531151701425750010456 0ustar00"use strict"; Object.defineProperty(exports, "__esModule", { value: true }); exports.ValidationError = void 0; /* Copyright 2023 The Sigstore Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. */ class ValidationError extends Error { constructor(message, fields) { super(message); this.fields = fields; } } exports.ValidationError = ValidationError; bundle/dist/serialized.js000064400000003426151701425750011465 0ustar00"use strict"; Object.defineProperty(exports, "__esModule", { value: true }); exports.envelopeToJSON = exports.envelopeFromJSON = exports.bundleToJSON = exports.bundleFromJSON = void 0; /* Copyright 2023 The Sigstore Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. */ const protobuf_specs_1 = require("@sigstore/protobuf-specs"); const bundle_1 = require("./bundle"); const validate_1 = require("./validate"); const bundleFromJSON = (obj) => { const bundle = protobuf_specs_1.Bundle.fromJSON(obj); switch (bundle.mediaType) { case bundle_1.BUNDLE_V01_MEDIA_TYPE: (0, validate_1.assertBundleV01)(bundle); break; case bundle_1.BUNDLE_V02_MEDIA_TYPE: (0, validate_1.assertBundleV02)(bundle); break; default: (0, validate_1.assertBundleLatest)(bundle); break; } return bundle; }; exports.bundleFromJSON = bundleFromJSON; const bundleToJSON = (bundle) => { return protobuf_specs_1.Bundle.toJSON(bundle); }; exports.bundleToJSON = bundleToJSON; const envelopeFromJSON = (obj) => { return protobuf_specs_1.Envelope.fromJSON(obj); }; exports.envelopeFromJSON = envelopeFromJSON; const envelopeToJSON = (envelope) => { return protobuf_specs_1.Envelope.toJSON(envelope); }; exports.envelopeToJSON = envelopeToJSON; bundle/dist/validate.js000064400000017702151701425750011125 0ustar00"use strict"; Object.defineProperty(exports, "__esModule", { value: true }); exports.assertBundleLatest = exports.assertBundleV02 = exports.isBundleV01 = exports.assertBundleV01 = exports.assertBundle = void 0; /* Copyright 2023 The Sigstore Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. */ const error_1 = require("./error"); // Performs basic validation of a Sigstore bundle to ensure that all required // fields are populated. This is not a complete validation of the bundle, but // rather a check that the bundle is in a valid state to be processed by the // rest of the code. function assertBundle(b) { const invalidValues = validateBundleBase(b); if (invalidValues.length > 0) { throw new error_1.ValidationError('invalid bundle', invalidValues); } } exports.assertBundle = assertBundle; // Asserts that the given bundle conforms to the v0.1 bundle format. function assertBundleV01(b) { const invalidValues = []; invalidValues.push(...validateBundleBase(b)); invalidValues.push(...validateInclusionPromise(b)); if (invalidValues.length > 0) { throw new error_1.ValidationError('invalid v0.1 bundle', invalidValues); } } exports.assertBundleV01 = assertBundleV01; // Type guard to determine if Bundle is a v0.1 bundle. function isBundleV01(b) { try { assertBundleV01(b); return true; } catch (e) { return false; } } exports.isBundleV01 = isBundleV01; // Asserts that the given bundle conforms to the v0.2 bundle format. function assertBundleV02(b) { const invalidValues = []; invalidValues.push(...validateBundleBase(b)); invalidValues.push(...validateInclusionProof(b)); if (invalidValues.length > 0) { throw new error_1.ValidationError('invalid v0.2 bundle', invalidValues); } } exports.assertBundleV02 = assertBundleV02; // Asserts that the given bundle conforms to the newest (0.3) bundle format. function assertBundleLatest(b) { const invalidValues = []; invalidValues.push(...validateBundleBase(b)); invalidValues.push(...validateInclusionProof(b)); invalidValues.push(...validateNoCertificateChain(b)); if (invalidValues.length > 0) { throw new error_1.ValidationError('invalid bundle', invalidValues); } } exports.assertBundleLatest = assertBundleLatest; function validateBundleBase(b) { const invalidValues = []; // Media type validation if (b.mediaType === undefined || (!b.mediaType.match(/^application\/vnd\.dev\.sigstore\.bundle\+json;version=\d\.\d/) && !b.mediaType.match(/^application\/vnd\.dev\.sigstore\.bundle\.v\d\.\d\+json/))) { invalidValues.push('mediaType'); } // Content-related validation if (b.content === undefined) { invalidValues.push('content'); } else { switch (b.content.$case) { case 'messageSignature': if (b.content.messageSignature.messageDigest === undefined) { invalidValues.push('content.messageSignature.messageDigest'); } else { if (b.content.messageSignature.messageDigest.digest.length === 0) { invalidValues.push('content.messageSignature.messageDigest.digest'); } } if (b.content.messageSignature.signature.length === 0) { invalidValues.push('content.messageSignature.signature'); } break; case 'dsseEnvelope': if (b.content.dsseEnvelope.payload.length === 0) { invalidValues.push('content.dsseEnvelope.payload'); } if (b.content.dsseEnvelope.signatures.length !== 1) { invalidValues.push('content.dsseEnvelope.signatures'); } else { if (b.content.dsseEnvelope.signatures[0].sig.length === 0) { invalidValues.push('content.dsseEnvelope.signatures[0].sig'); } } break; } } // Verification material-related validation if (b.verificationMaterial === undefined) { invalidValues.push('verificationMaterial'); } else { if (b.verificationMaterial.content === undefined) { invalidValues.push('verificationMaterial.content'); } else { switch (b.verificationMaterial.content.$case) { case 'x509CertificateChain': if (b.verificationMaterial.content.x509CertificateChain.certificates .length === 0) { invalidValues.push('verificationMaterial.content.x509CertificateChain.certificates'); } b.verificationMaterial.content.x509CertificateChain.certificates.forEach((cert, i) => { if (cert.rawBytes.length === 0) { invalidValues.push(`verificationMaterial.content.x509CertificateChain.certificates[${i}].rawBytes`); } }); break; case 'certificate': if (b.verificationMaterial.content.certificate.rawBytes.length === 0) { invalidValues.push('verificationMaterial.content.certificate.rawBytes'); } break; } } if (b.verificationMaterial.tlogEntries === undefined) { invalidValues.push('verificationMaterial.tlogEntries'); } else { if (b.verificationMaterial.tlogEntries.length > 0) { b.verificationMaterial.tlogEntries.forEach((entry, i) => { if (entry.logId === undefined) { invalidValues.push(`verificationMaterial.tlogEntries[${i}].logId`); } if (entry.kindVersion === undefined) { invalidValues.push(`verificationMaterial.tlogEntries[${i}].kindVersion`); } }); } } } return invalidValues; } // Necessary for V01 bundles function validateInclusionPromise(b) { const invalidValues = []; if (b.verificationMaterial && b.verificationMaterial.tlogEntries?.length > 0) { b.verificationMaterial.tlogEntries.forEach((entry, i) => { if (entry.inclusionPromise === undefined) { invalidValues.push(`verificationMaterial.tlogEntries[${i}].inclusionPromise`); } }); } return invalidValues; } // Necessary for V02 and later bundles function validateInclusionProof(b) { const invalidValues = []; if (b.verificationMaterial && b.verificationMaterial.tlogEntries?.length > 0) { b.verificationMaterial.tlogEntries.forEach((entry, i) => { if (entry.inclusionProof === undefined) { invalidValues.push(`verificationMaterial.tlogEntries[${i}].inclusionProof`); } else { if (entry.inclusionProof.checkpoint === undefined) { invalidValues.push(`verificationMaterial.tlogEntries[${i}].inclusionProof.checkpoint`); } } }); } return invalidValues; } // Necessary for V03 and later bundles function validateNoCertificateChain(b) { const invalidValues = []; if (b.verificationMaterial?.content?.$case === 'x509CertificateChain') { invalidValues.push('verificationMaterial.content.$case'); } return invalidValues; } tuf/package.json000064400000002231151701425750007635 0ustar00{ "_id": "@sigstore/tuf@2.3.4", "_inBundle": true, "_location": "/npm/@sigstore/tuf", "_phantomChildren": {}, "_requiredBy": [ "/npm", "/npm/sigstore" ], "author": { "name": "bdehamer@github.com" }, "bugs": { "url": "https://github.com/sigstore/sigstore-js/issues" }, "dependencies": { "@sigstore/protobuf-specs": "^0.3.2", "tuf-js": "^2.2.1" }, "description": "Client for the Sigstore TUF repository", "devDependencies": { "@sigstore/jest": "^0.0.0", "@tufjs/repo-mock": "^2.0.1", "@types/make-fetch-happen": "^10.0.4" }, "engines": { "node": "^16.14.0 || >=18.0.0" }, "files": [ "dist", "seeds.json" ], "homepage": "https://github.com/sigstore/sigstore-js/tree/main/packages/tuf#readme", "license": "Apache-2.0", "main": "dist/index.js", "name": "@sigstore/tuf", "publishConfig": { "provenance": true }, "repository": { "type": "git", "url": "git+https://github.com/sigstore/sigstore-js.git" }, "scripts": { "build": "tsc --build", "clean": "shx rm -rf dist *.tsbuildinfo", "test": "jest" }, "types": "dist/index.d.ts", "version": "2.3.4" } tuf/LICENSE000064400000026127151701425750006366 0ustar00 Apache License Version 2.0, January 2004 http://www.apache.org/licenses/ TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION 1. Definitions. "License" shall mean the terms and conditions for use, reproduction, and distribution as defined by Sections 1 through 9 of this document. "Licensor" shall mean the copyright owner or entity authorized by the copyright owner that is granting the License. "Legal Entity" shall mean the union of the acting entity and all other entities that control, are controlled by, or are under common control with that entity. For the purposes of this definition, "control" means (i) the power, direct or indirect, to cause the direction or management of such entity, whether by contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the outstanding shares, or (iii) beneficial ownership of such entity. "You" (or "Your") shall mean an individual or Legal Entity exercising permissions granted by this License. "Source" form shall mean the preferred form for making modifications, including but not limited to software source code, documentation source, and configuration files. "Object" form shall mean any form resulting from mechanical transformation or translation of a Source form, including but not limited to compiled object code, generated documentation, and conversions to other media types. "Work" shall mean the work of authorship, whether in Source or Object form, made available under the License, as indicated by a copyright notice that is included in or attached to the work (an example is provided in the Appendix below). "Derivative Works" shall mean any work, whether in Source or Object form, that is based on (or derived from) the Work and for which the editorial revisions, annotations, elaborations, or other modifications represent, as a whole, an original work of authorship. For the purposes of this License, Derivative Works shall not include works that remain separable from, or merely link (or bind by name) to the interfaces of, the Work and Derivative Works thereof. "Contribution" shall mean any work of authorship, including the original version of the Work and any modifications or additions to that Work or Derivative Works thereof, that is intentionally submitted to Licensor for inclusion in the Work by the copyright owner or by an individual or Legal Entity authorized to submit on behalf of the copyright owner. For the purposes of this definition, "submitted" means any form of electronic, verbal, or written communication sent to the Licensor or its representatives, including but not limited to communication on electronic mailing lists, source code control systems, and issue tracking systems that are managed by, or on behalf of, the Licensor for the purpose of discussing and improving the Work, but excluding communication that is conspicuously marked or otherwise designated in writing by the copyright owner as "Not a Contribution." "Contributor" shall mean Licensor and any individual or Legal Entity on behalf of whom a Contribution has been received by Licensor and subsequently incorporated within the Work. 2. Grant of Copyright License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare Derivative Works of, publicly display, publicly perform, sublicense, and distribute the Work and such Derivative Works in Source or Object form. 3. Grant of Patent License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable (except as stated in this section) patent license to make, have made, use, offer to sell, sell, import, and otherwise transfer the Work, where such license applies only to those patent claims licensable by such Contributor that are necessarily infringed by their Contribution(s) alone or by combination of their Contribution(s) with the Work to which such Contribution(s) was submitted. If You institute patent litigation against any entity (including a cross-claim or counterclaim in a lawsuit) alleging that the Work or a Contribution incorporated within the Work constitutes direct or contributory patent infringement, then any patent licenses granted to You under this License for that Work shall terminate as of the date such litigation is filed. 4. Redistribution. You may reproduce and distribute copies of the Work or Derivative Works thereof in any medium, with or without modifications, and in Source or Object form, provided that You meet the following conditions: (a) You must give any other recipients of the Work or Derivative Works a copy of this License; and (b) You must cause any modified files to carry prominent notices stating that You changed the files; and (c) You must retain, in the Source form of any Derivative Works that You distribute, all copyright, patent, trademark, and attribution notices from the Source form of the Work, excluding those notices that do not pertain to any part of the Derivative Works; and (d) If the Work includes a "NOTICE" text file as part of its distribution, then any Derivative Works that You distribute must include a readable copy of the attribution notices contained within such NOTICE file, excluding those notices that do not pertain to any part of the Derivative Works, in at least one of the following places: within a NOTICE text file distributed as part of the Derivative Works; within the Source form or documentation, if provided along with the Derivative Works; or, within a display generated by the Derivative Works, if and wherever such third-party notices normally appear. The contents of the NOTICE file are for informational purposes only and do not modify the License. You may add Your own attribution notices within Derivative Works that You distribute, alongside or as an addendum to the NOTICE text from the Work, provided that such additional attribution notices cannot be construed as modifying the License. You may add Your own copyright statement to Your modifications and may provide additional or different license terms and conditions for use, reproduction, or distribution of Your modifications, or for any such Derivative Works as a whole, provided Your use, reproduction, and distribution of the Work otherwise complies with the conditions stated in this License. 5. Submission of Contributions. Unless You explicitly state otherwise, any Contribution intentionally submitted for inclusion in the Work by You to the Licensor shall be under the terms and conditions of this License, without any additional terms or conditions. Notwithstanding the above, nothing herein shall supersede or modify the terms of any separate license agreement you may have executed with Licensor regarding such Contributions. 6. Trademarks. This License does not grant permission to use the trade names, trademarks, service marks, or product names of the Licensor, except as required for reasonable and customary use in describing the origin of the Work and reproducing the content of the NOTICE file. 7. Disclaimer of Warranty. Unless required by applicable law or agreed to in writing, Licensor provides the Work (and each Contributor provides its Contributions) on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. You are solely responsible for determining the appropriateness of using or redistributing the Work and assume any risks associated with Your exercise of permissions under this License. 8. Limitation of Liability. In no event and under no legal theory, whether in tort (including negligence), contract, or otherwise, unless required by applicable law (such as deliberate and grossly negligent acts) or agreed to in writing, shall any Contributor be liable to You for damages, including any direct, indirect, special, incidental, or consequential damages of any character arising as a result of this License or out of the use or inability to use the Work (including but not limited to damages for loss of goodwill, work stoppage, computer failure or malfunction, or any and all other commercial damages or losses), even if such Contributor has been advised of the possibility of such damages. 9. Accepting Warranty or Additional Liability. While redistributing the Work or Derivative Works thereof, You may choose to offer, and charge a fee for, acceptance of support, warranty, indemnity, or other liability obligations and/or rights consistent with this License. However, in accepting such obligations, You may act only on Your own behalf and on Your sole responsibility, not on behalf of any other Contributor, and only if You agree to indemnify, defend, and hold each Contributor harmless for any liability incurred by, or claims asserted against, such Contributor by reason of your accepting any such warranty or additional liability. END OF TERMS AND CONDITIONS APPENDIX: How to apply the Apache License to your work. To apply the Apache License to your work, attach the following boilerplate notice, with the fields enclosed by brackets "[]" replaced with your own identifying information. (Don't include the brackets!) The text should be enclosed in the appropriate comment syntax for the file format. We also recommend that a file or class name and description of purpose be included on the same "printed page" as the copyright notice for easier identification within third-party archives. Copyright 2023 The Sigstore Authors Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. tuf/dist/target.js000064400000005316151701425750010145 0ustar00"use strict"; var __importDefault = (this && this.__importDefault) || function (mod) { return (mod && mod.__esModule) ? mod : { "default": mod }; }; Object.defineProperty(exports, "__esModule", { value: true }); exports.readTarget = void 0; /* Copyright 2023 The Sigstore Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. */ const fs_1 = __importDefault(require("fs")); const error_1 = require("./error"); // Downloads and returns the specified target from the provided TUF Updater. async function readTarget(tuf, targetPath) { const path = await getTargetPath(tuf, targetPath); return new Promise((resolve, reject) => { fs_1.default.readFile(path, 'utf-8', (err, data) => { if (err) { reject(new error_1.TUFError({ code: 'TUF_READ_TARGET_ERROR', message: `error reading target ${path}`, cause: err, })); } else { resolve(data); } }); }); } exports.readTarget = readTarget; // Returns the local path to the specified target. If the target is not yet // cached locally, the provided TUF Updater will be used to download and // cache the target. async function getTargetPath(tuf, target) { let targetInfo; try { targetInfo = await tuf.getTargetInfo(target); } catch (err) { throw new error_1.TUFError({ code: 'TUF_REFRESH_METADATA_ERROR', message: 'error refreshing TUF metadata', cause: err, }); } if (!targetInfo) { throw new error_1.TUFError({ code: 'TUF_FIND_TARGET_ERROR', message: `target ${target} not found`, }); } let path = await tuf.findCachedTarget(targetInfo); // An empty path here means the target has not been cached locally, or is // out of date. In either case, we need to download it. if (!path) { try { path = await tuf.downloadTarget(targetInfo); } catch (err) { throw new error_1.TUFError({ code: 'TUF_DOWNLOAD_TARGET_ERROR', message: `error downloading target ${path}`, cause: err, }); } } return path; } tuf/dist/appdata.js000064400000003334151701425750010267 0ustar00"use strict"; var __importDefault = (this && this.__importDefault) || function (mod) { return (mod && mod.__esModule) ? mod : { "default": mod }; }; Object.defineProperty(exports, "__esModule", { value: true }); exports.appDataPath = void 0; /* Copyright 2023 The Sigstore Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. */ const os_1 = __importDefault(require("os")); const path_1 = __importDefault(require("path")); function appDataPath(name) { const homedir = os_1.default.homedir(); switch (process.platform) { /* istanbul ignore next */ case 'darwin': { const appSupport = path_1.default.join(homedir, 'Library', 'Application Support'); return path_1.default.join(appSupport, name); } /* istanbul ignore next */ case 'win32': { const localAppData = process.env.LOCALAPPDATA || path_1.default.join(homedir, 'AppData', 'Local'); return path_1.default.join(localAppData, name, 'Data'); } /* istanbul ignore next */ default: { const localData = process.env.XDG_DATA_HOME || path_1.default.join(homedir, '.local', 'share'); return path_1.default.join(localData, name); } } } exports.appDataPath = appDataPath; tuf/dist/index.js000064400000004376151701425750007773 0ustar00"use strict"; Object.defineProperty(exports, "__esModule", { value: true }); exports.TUFError = exports.initTUF = exports.getTrustedRoot = exports.DEFAULT_MIRROR_URL = void 0; /* Copyright 2023 The Sigstore Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. */ const protobuf_specs_1 = require("@sigstore/protobuf-specs"); const appdata_1 = require("./appdata"); const client_1 = require("./client"); exports.DEFAULT_MIRROR_URL = 'https://tuf-repo-cdn.sigstore.dev'; const DEFAULT_CACHE_DIR = 'sigstore-js'; const DEFAULT_RETRY = { retries: 2 }; const DEFAULT_TIMEOUT = 5000; const TRUSTED_ROOT_TARGET = 'trusted_root.json'; async function getTrustedRoot( /* istanbul ignore next */ options = {}) { const client = createClient(options); const trustedRoot = await client.getTarget(TRUSTED_ROOT_TARGET); return protobuf_specs_1.TrustedRoot.fromJSON(JSON.parse(trustedRoot)); } exports.getTrustedRoot = getTrustedRoot; async function initTUF( /* istanbul ignore next */ options = {}) { const client = createClient(options); return client.refresh().then(() => client); } exports.initTUF = initTUF; // Create a TUF client with default options function createClient(options) { /* istanbul ignore next */ return new client_1.TUFClient({ cachePath: options.cachePath || (0, appdata_1.appDataPath)(DEFAULT_CACHE_DIR), rootPath: options.rootPath, mirrorURL: options.mirrorURL || exports.DEFAULT_MIRROR_URL, retry: options.retry ?? DEFAULT_RETRY, timeout: options.timeout ?? DEFAULT_TIMEOUT, forceCache: options.forceCache ?? false, forceInit: options.forceInit ?? options.force ?? false, }); } var error_1 = require("./error"); Object.defineProperty(exports, "TUFError", { enumerable: true, get: function () { return error_1.TUFError; } }); tuf/dist/error.js000064400000000522151701425750010002 0ustar00"use strict"; Object.defineProperty(exports, "__esModule", { value: true }); exports.TUFError = void 0; class TUFError extends Error { constructor({ code, message, cause, }) { super(message); this.code = code; this.cause = cause; this.name = this.constructor.name; } } exports.TUFError = TUFError; tuf/dist/client.js000064400000010675151701425750010141 0ustar00"use strict"; var __importDefault = (this && this.__importDefault) || function (mod) { return (mod && mod.__esModule) ? mod : { "default": mod }; }; Object.defineProperty(exports, "__esModule", { value: true }); exports.TUFClient = void 0; /* Copyright 2023 The Sigstore Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. */ const fs_1 = __importDefault(require("fs")); const path_1 = __importDefault(require("path")); const tuf_js_1 = require("tuf-js"); const _1 = require("."); const target_1 = require("./target"); const TARGETS_DIR_NAME = 'targets'; class TUFClient { constructor(options) { const url = new URL(options.mirrorURL); const repoName = encodeURIComponent(url.host + url.pathname.replace(/\/$/, '')); const cachePath = path_1.default.join(options.cachePath, repoName); initTufCache(cachePath); seedCache({ cachePath, mirrorURL: options.mirrorURL, tufRootPath: options.rootPath, forceInit: options.forceInit, }); this.updater = initClient({ mirrorURL: options.mirrorURL, cachePath, forceCache: options.forceCache, retry: options.retry, timeout: options.timeout, }); } async refresh() { return this.updater.refresh(); } getTarget(targetName) { return (0, target_1.readTarget)(this.updater, targetName); } } exports.TUFClient = TUFClient; // Initializes the TUF cache directory structure including the initial // root.json file. If the cache directory does not exist, it will be // created. If the targets directory does not exist, it will be created. // If the root.json file does not exist, it will be copied from the // rootPath argument. function initTufCache(cachePath) { const targetsPath = path_1.default.join(cachePath, TARGETS_DIR_NAME); if (!fs_1.default.existsSync(cachePath)) { fs_1.default.mkdirSync(cachePath, { recursive: true }); } if (!fs_1.default.existsSync(targetsPath)) { fs_1.default.mkdirSync(targetsPath); } } // Populates the TUF cache with the initial root.json file. If the root.json // file does not exist (or we're forcing re-initialization), copy it from either // the rootPath argument or from one of the repo seeds. function seedCache({ cachePath, mirrorURL, tufRootPath, forceInit, }) { const cachedRootPath = path_1.default.join(cachePath, 'root.json'); // If the root.json file does not exist (or we're forcing re-initialization), // populate it either from the supplied rootPath or from one of the repo seeds. if (!fs_1.default.existsSync(cachedRootPath) || forceInit) { if (tufRootPath) { fs_1.default.copyFileSync(tufRootPath, cachedRootPath); } else { /* eslint-disable @typescript-eslint/no-var-requires */ const seeds = require('../seeds.json'); const repoSeed = seeds[mirrorURL]; if (!repoSeed) { throw new _1.TUFError({ code: 'TUF_INIT_CACHE_ERROR', message: `No root.json found for mirror: ${mirrorURL}`, }); } fs_1.default.writeFileSync(cachedRootPath, Buffer.from(repoSeed['root.json'], 'base64')); // Copy any seed targets into the cache Object.entries(repoSeed.targets).forEach(([targetName, target]) => { fs_1.default.writeFileSync(path_1.default.join(cachePath, TARGETS_DIR_NAME, targetName), Buffer.from(target, 'base64')); }); } } } function initClient(options) { const config = { fetchTimeout: options.timeout, fetchRetry: options.retry, }; return new tuf_js_1.Updater({ metadataBaseUrl: options.mirrorURL, targetBaseUrl: `${options.mirrorURL}/targets`, metadataDir: options.cachePath, targetDir: path_1.default.join(options.cachePath, TARGETS_DIR_NAME), forceCache: options.forceCache, config, }); } tuf/seeds.json000064400000046622151701425750007361 0ustar00{"https://tuf-repo-cdn.sigstore.dev":{"root.json":"ewoJInNpZ25lZCI6IHsKCQkiX3R5cGUiOiAicm9vdCIsCgkJInNwZWNfdmVyc2lvbiI6ICIxLjAiLAoJCSJ2ZXJzaW9uIjogOSwKCQkiZXhwaXJlcyI6ICIyMDI0LTA5LTEyVDA2OjUzOjEwWiIsCgkJImtleXMiOiB7CgkJCSIxZTFkNjVjZTk4YjEwYWRkYWQ0NzY0ZmViZjdkZGEyZDA0MzZiM2QzYTM4OTM1NzljMGRkZGFlYTIwZTU0ODQ5IjogewoJCQkJImtleXR5cGUiOiAiZWNkc2EiLAoJCQkJInNjaGVtZSI6ICJlY2RzYS1zaGEyLW5pc3RwMjU2IiwKCQkJCSJrZXlpZF9oYXNoX2FsZ29yaXRobXMiOiBbCgkJCQkJInNoYTI1NiIsCgkJCQkJInNoYTUxMiIKCQkJCV0sCgkJCQkia2V5dmFsIjogewoJCQkJCSJwdWJsaWMiOiAiLS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS1cbk1Ga3dFd1lIS29aSXpqMENBUVlJS29aSXpqMERBUWNEUWdBRXpCelZPbUhDUG9qTVZMU0kzNjRXaWlWOE5QckRcbjZJZ1J4Vmxpc2t6L3YreTNKRVI1bWNWR2NPTmxpRGNXTUM1SjJsZkhtalBOUGhiNEg3eG04THpmU0E9PVxuLS0tLS1FTkQgUFVCTElDIEtFWS0tLS0tXG4iCgkJCQl9CgkJCX0sCgkJCSIyMzBlMjEyNjE2Mjc0YTQxOTVjZGMyOGU5ZmNlNzgyYzIwZTZjNzIwZjFhODExYjQwZjk4MjI4Mzc2YmRkM2FjIjogewoJCQkJImtleXR5cGUiOiAiZWNkc2EiLAoJCQkJInNjaGVtZSI6ICJlY2RzYS1zaGEyLW5pc3RwMjU2IiwKCQkJCSJrZXlpZF9oYXNoX2FsZ29yaXRobXMiOiBbCgkJCQkJInNoYTI1NiIsCgkJCQkJInNoYTUxMiIKCQkJCV0sCgkJCQkia2V5dmFsIjogewoJCQkJCSJwdWJsaWMiOiAiLS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS1cbk1Ga3dFd1lIS29aSXpqMENBUVlJS29aSXpqMERBUWNEUWdBRUxyV3ZOdDk0djRSMDg1RUxlZUNNeEhwN1BsZEZcbjAvVDFHeHVrVWgyT0R1Z2dMR0pFMHBjMWU4Q1NCZjZDUzkxRndvOUZVT3VSc2pCVWxkK1ZxU3lDZFE9PVxuLS0tLS1FTkQgUFVCTElDIEtFWS0tLS0tXG4iCgkJCQl9CgkJCX0sCgkJCSIzYzM0NGFhMDY4ZmQ0Y2M0ZTg3ZGM1MGI2MTJjMDI0MzFmYmM3NzFlOTUwMDM5OTM2ODNhMmIwYmYyNjBjZjBlIjogewoJCQkJImtleXR5cGUiOiAiZWNkc2EiLAoJCQkJInNjaGVtZSI6ICJlY2RzYS1zaGEyLW5pc3RwMjU2IiwKCQkJCSJrZXlpZF9oYXNoX2FsZ29yaXRobXMiOiBbCgkJCQkJInNoYTI1NiIsCgkJCQkJInNoYTUxMiIKCQkJCV0sCgkJCQkia2V5dmFsIjogewoJCQkJCSJwdWJsaWMiOiAiLS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS1cbk1Ga3dFd1lIS29aSXpqMENBUVlJS29aSXpqMERBUWNEUWdBRXk4WEtzbWhCWURJOEpjMEd3ekJ4ZUtheDBjbTVcblNUS0VVNjVIUEZ1blVuNDFzVDhwaTBGak00SWtIei9ZVW13bUxVTzBXdDdseGhqNkJrTElLNHFZQXc9PVxuLS0tLS1FTkQgUFVCTElDIEtFWS0tLS0tXG4iCgkJCQl9CgkJCX0sCgkJCSI5MjNiYjM5ZTYwZGQ2ZmEyYzMxZTZlYTU1NDczYWE5M2I2NGRkNGU1M2UxNmZiZTQyZjZhMjA3ZDNmOTdkZTJkIjogewoJCQkJImtleXR5cGUiOiAiZWNkc2EiLAoJCQkJInNjaGVtZSI6ICJlY2RzYS1zaGEyLW5pc3RwMjU2IiwKCQkJCSJrZXlpZF9oYXNoX2FsZ29yaXRobXMiOiBbCgkJCQkJInNoYTI1NiIsCgkJCQkJInNoYTUxMiIKCQkJCV0sCgkJCQkia2V5dmFsIjogewoJCQkJCSJwdWJsaWMiOiAiLS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS1cbk1Ga3dFd1lIS29aSXpqMENBUVlJS29aSXpqMERBUWNEUWdBRVdSaUdyNStqKzNKNVNzSCtadHI1bkUySDJ3TzdcbkJWK25PM3M5M2dMY2ExOHFUT3pIWTFvV3lBR0R5a01Tc0dUVUJTdDlEK0FuMEtmS3NEMm1mU000MlE9PVxuLS0tLS1FTkQgUFVCTElDIEtFWS0tLS0tXG4iCgkJCQl9CgkJCX0sCgkJCSJlMmY1OWFjYjk0ODg1MTk0MDdlMThjYmZjOTMyOTUxMGJlMDNjMDRhY2E5OTI5ZDJmMDMwMTM0M2ZlYzg1NTIzIjogewoJCQkJImtleXR5cGUiOiAiZWNkc2EiLAoJCQkJInNjaGVtZSI6ICJlY2RzYS1zaGEyLW5pc3RwMjU2IiwKCQkJCSJrZXlpZF9oYXNoX2FsZ29yaXRobXMiOiBbCgkJCQkJInNoYTI1NiIsCgkJCQkJInNoYTUxMiIKCQkJCV0sCgkJCQkia2V5dmFsIjogewoJCQkJCSJwdWJsaWMiOiAiLS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS1cbk1Ga3dFd1lIS29aSXpqMENBUVlJS29aSXpqMERBUWNEUWdBRWluaWtTc0FRbVlrTmVINWVZcS9Dbkl6TGFhY09cbnhsU2Fhd1FET3dxS3kvdENxeHE1eHhQU0pjMjFLNFdJaHM5R3lPa0tmenVlWTNHSUx6Y01KWjRjV3c9PVxuLS0tLS1FTkQgUFVCTElDIEtFWS0tLS0tXG4iCgkJCQl9CgkJCX0sCgkJCSJlYzgxNjY5NzM0ZTAxNzk5NmM1Yjg1ZjNkMDJjM2RlMWRkNDYzN2ExNTIwMTlmZTFhZjEyNWQyZjkzNjhiOTVlIjogewoJCQkJImtleXR5cGUiOiAiZWNkc2EiLAoJCQkJInNjaGVtZSI6ICJlY2RzYS1zaGEyLW5pc3RwMjU2IiwKCQkJCSJrZXlpZF9oYXNoX2FsZ29yaXRobXMiOiBbCgkJCQkJInNoYTI1NiIsCgkJCQkJInNoYTUxMiIKCQkJCV0sCgkJCQkia2V5dmFsIjogewoJCQkJCSJwdWJsaWMiOiAiLS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS1cbk1Ga3dFd1lIS29aSXpqMENBUVlJS29aSXpqMERBUWNEUWdBRUVYc3ozU1pYRmI4ak1WNDJqNnBKbHlqYmpSOEtcbk4zQndvY2V4cTZMTUliNXFzV0tPUXZMTjE2TlVlZkxjNEhzd09vdW1Sc1ZWYWFqU3BRUzZmb2JrUnc9PVxuLS0tLS1FTkQgUFVCTElDIEtFWS0tLS0tXG4iCgkJCQl9CgkJCX0sCgkJCSJmZGZhODNhMDdiNWE4MzU4OWI4N2RlZDQxZjc3ZjM5ZDIzMmFkOTFmN2NjZTUyODY4ZGFjZDA2YmEwODk4NDlmIjogewoJCQkJImtleXR5cGUiOiAiZWNkc2EiLAoJCQkJInNjaGVtZSI6ICJlY2RzYS1zaGEyLW5pc3RwMjU2IiwKCQkJCSJrZXlpZF9oYXNoX2FsZ29yaXRobXMiOiBbCgkJCQkJInNoYTI1NiIsCgkJCQkJInNoYTUxMiIKCQkJCV0sCgkJCQkia2V5dmFsIjogewoJCQkJCSJwdWJsaWMiOiAiLS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS1cbk1Ga3dFd1lIS29aSXpqMENBUVlJS29aSXpqMERBUWNEUWdBRTBnaHJoOTJMdzFZcjNpZEdWNVdxQ3RNREI4Q3hcbitEOGhkQzR3MlpMTklwbFZSb1ZHTHNrWWEzZ2hlTXlPamlKOGtQaTE1YVEyLy83UCtvajdVdkpQR3c9PVxuLS0tLS1FTkQgUFVCTElDIEtFWS0tLS0tXG4iCgkJCQl9CgkJCX0KCQl9LAoJCSJyb2xlcyI6IHsKCQkJInJvb3QiOiB7CgkJCQkia2V5aWRzIjogWwoJCQkJCSIzYzM0NGFhMDY4ZmQ0Y2M0ZTg3ZGM1MGI2MTJjMDI0MzFmYmM3NzFlOTUwMDM5OTM2ODNhMmIwYmYyNjBjZjBlIiwKCQkJCQkiZWM4MTY2OTczNGUwMTc5OTZjNWI4NWYzZDAyYzNkZTFkZDQ2MzdhMTUyMDE5ZmUxYWYxMjVkMmY5MzY4Yjk1ZSIsCgkJCQkJIjFlMWQ2NWNlOThiMTBhZGRhZDQ3NjRmZWJmN2RkYTJkMDQzNmIzZDNhMzg5MzU3OWMwZGRkYWVhMjBlNTQ4NDkiLAoJCQkJCSJlMmY1OWFjYjk0ODg1MTk0MDdlMThjYmZjOTMyOTUxMGJlMDNjMDRhY2E5OTI5ZDJmMDMwMTM0M2ZlYzg1NTIzIiwKCQkJCQkiZmRmYTgzYTA3YjVhODM1ODliODdkZWQ0MWY3N2YzOWQyMzJhZDkxZjdjY2U1Mjg2OGRhY2QwNmJhMDg5ODQ5ZiIKCQkJCV0sCgkJCQkidGhyZXNob2xkIjogMwoJCQl9LAoJCQkic25hcHNob3QiOiB7CgkJCQkia2V5aWRzIjogWwoJCQkJCSIyMzBlMjEyNjE2Mjc0YTQxOTVjZGMyOGU5ZmNlNzgyYzIwZTZjNzIwZjFhODExYjQwZjk4MjI4Mzc2YmRkM2FjIgoJCQkJXSwKCQkJCSJ0aHJlc2hvbGQiOiAxCgkJCX0sCgkJCSJ0YXJnZXRzIjogewoJCQkJImtleWlkcyI6IFsKCQkJCQkiM2MzNDRhYTA2OGZkNGNjNGU4N2RjNTBiNjEyYzAyNDMxZmJjNzcxZTk1MDAzOTkzNjgzYTJiMGJmMjYwY2YwZSIsCgkJCQkJImVjODE2Njk3MzRlMDE3OTk2YzViODVmM2QwMmMzZGUxZGQ0NjM3YTE1MjAxOWZlMWFmMTI1ZDJmOTM2OGI5NWUiLAoJCQkJCSIxZTFkNjVjZTk4YjEwYWRkYWQ0NzY0ZmViZjdkZGEyZDA0MzZiM2QzYTM4OTM1NzljMGRkZGFlYTIwZTU0ODQ5IiwKCQkJCQkiZTJmNTlhY2I5NDg4NTE5NDA3ZTE4Y2JmYzkzMjk1MTBiZTAzYzA0YWNhOTkyOWQyZjAzMDEzNDNmZWM4NTUyMyIsCgkJCQkJImZkZmE4M2EwN2I1YTgzNTg5Yjg3ZGVkNDFmNzdmMzlkMjMyYWQ5MWY3Y2NlNTI4NjhkYWNkMDZiYTA4OTg0OWYiCgkJCQldLAoJCQkJInRocmVzaG9sZCI6IDMKCQkJfSwKCQkJInRpbWVzdGFtcCI6IHsKCQkJCSJrZXlpZHMiOiBbCgkJCQkJIjkyM2JiMzllNjBkZDZmYTJjMzFlNmVhNTU0NzNhYTkzYjY0ZGQ0ZTUzZTE2ZmJlNDJmNmEyMDdkM2Y5N2RlMmQiCgkJCQldLAoJCQkJInRocmVzaG9sZCI6IDEKCQkJfQoJCX0sCgkJImNvbnNpc3RlbnRfc25hcHNob3QiOiB0cnVlCgl9LAoJInNpZ25hdHVyZXMiOiBbCgkJewoJCQkia2V5aWQiOiAiZmY1MWUxN2ZjZjI1MzExOWI3MDMzZjZmNTc1MTI2MzFkYTRhMDk2OTQ0MmFmY2Y5ZmM4YjE0MWM3ZjJiZTk5YyIsCgkJCSJzaWciOiAiMzA0NTAyMjEwMDhiNzhmODk0YzNjZmVkM2JkNDg2Mzc5YzRlMGUwZGZiM2U3ZGQ4Y2JjNGQ1NTk4ZDI4MThlZWExYmEzYzc1NTAwMjIwMjlkM2QwNmU4OWQwNGQzNzg0OTk4NWRjNDZjMGUxMGRjNWIxZmM2OGRjNzBhZjFlYzk5MTAzMDNhMWYzZWUyZiIKCQl9LAoJCXsKCQkJImtleWlkIjogIjI1YTBlYjQ1MGZkM2VlMmJkNzkyMThjOTYzZGNlM2YxY2M2MTE4YmFkZjI1MWJmMTQ5ZjBiZDA3ZDVjYWJlOTkiLAoJCQkic2lnIjogIjMwNDUwMjIxMDA5ZTZiOTBiOTM1ZTA5YjgzN2E5MGQ0NDAyZWFhMjdkNWVhMjZlYjc4OTE5NDhiYTBlZDcwOTA4NDEyNDhmNDM2MDIyMDAzZGMyMjUxYzRkNGE3OTk5YjkxZTlhZDA4Njg3NjVhZTA5YWM3MjY5Mjc5ZjJhNzg5OWJhZmVmN2EyZDkyNjAiCgkJfSwKCQl7CgkJCSJrZXlpZCI6ICJmNTMxMmY1NDJjMjEyNzNkOTQ4NWE0OTM5NDM4NmM0NTc1ODA0NzcwNjY3ZjJkZGI1OWIzYmYwNjY5ZmRkZDJmIiwKCQkJInNpZyI6ICIzMDQ0MDIyMDA5OWU5MDdkY2Y5MGI3YjZlMTA5ZmQxZDZlNDQyMDA2ZmNjYmI0ODg5NGFhYWZmNDdhYjgyNGIwM2ZiMzVkMGQwMjIwMmFhMGEwNmMyMWE0MjMzZjM3OTAwYTQ4YmM4Nzc3ZDNiNDdmNTllM2EzODYxNmNlNjMxYTA0ZGY1N2Y5NjczNiIKCQl9LAoJCXsKCQkJImtleWlkIjogIjNjMzQ0YWEwNjhmZDRjYzRlODdkYzUwYjYxMmMwMjQzMWZiYzc3MWU5NTAwMzk5MzY4M2EyYjBiZjI2MGNmMGUiLAoJCQkic2lnIjogIjMwNDUwMjIxMDA4Yjc4Zjg5NGMzY2ZlZDNiZDQ4NjM3OWM0ZTBlMGRmYjNlN2RkOGNiYzRkNTU5OGQyODE4ZWVhMWJhM2M3NTUwMDIyMDI5ZDNkMDZlODlkMDRkMzc4NDk5ODVkYzQ2YzBlMTBkYzViMWZjNjhkYzcwYWYxZWM5OTEwMzAzYTFmM2VlMmYiCgkJfSwKCQl7CgkJCSJrZXlpZCI6ICJlYzgxNjY5NzM0ZTAxNzk5NmM1Yjg1ZjNkMDJjM2RlMWRkNDYzN2ExNTIwMTlmZTFhZjEyNWQyZjkzNjhiOTVlIiwKCQkJInNpZyI6ICIzMDQ1MDIyMTAwOWU2YjkwYjkzNWUwOWI4MzdhOTBkNDQwMmVhYTI3ZDVlYTI2ZWI3ODkxOTQ4YmEwZWQ3MDkwODQxMjQ4ZjQzNjAyMjAwM2RjMjI1MWM0ZDRhNzk5OWI5MWU5YWQwODY4NzY1YWUwOWFjNzI2OTI3OWYyYTc4OTliYWZlZjdhMmQ5MjYwIgoJCX0sCgkJewoJCQkia2V5aWQiOiAiZTJmNTlhY2I5NDg4NTE5NDA3ZTE4Y2JmYzkzMjk1MTBiZTAzYzA0YWNhOTkyOWQyZjAzMDEzNDNmZWM4NTUyMyIsCgkJCSJzaWciOiAiMzA0NTAyMjAwZTU2MTNiOTAxZTBmM2UwOGVjZWFiZGRjNzNmOThiNTBkZGY4OTJlOTk4ZDBiMzY5YzZlM2Q0NTFhYzQ4ODc1MDIyMTAwOTQwY2Y5MmQxZjQzZWUyZTVjZGJiMjI1NzJiYjUyOTI1ZWQzODYzYTY4OGY3ZmZkZDRiZDJlMmU1NmYwMjhiMyIKCQl9LAoJCXsKCQkJImtleWlkIjogIjJlNjFjZDBjYmY0YThmNDU4MDliZGE5ZjdmNzhjMGQzM2FkMTE4NDJmZjk0YWUzNDA4NzNlMjY2NGRjODQzZGUiLAoJCQkic2lnIjogIjMwNDUwMjIwMmNmZjQ0ZjIyMTVkN2E0N2IyOGI4ZjVmNTgwYzJjZmJiZDFiZmNmY2JiZTc4ZGUzMjMwNDViMmMwYmFkYzVlOTAyMjEwMGM3NDM5NDllYjNmNGVhNWE0YjlhZTI3YWM2ZWRkZWExZjBmZjliZmQwMDRmOGE5YTlkMThjNmU0MTQyYjZlNzUiCgkJfSwKCQl7CgkJCSJrZXlpZCI6ICIxZTFkNjVjZTk4YjEwYWRkYWQ0NzY0ZmViZjdkZGEyZDA0MzZiM2QzYTM4OTM1NzljMGRkZGFlYTIwZTU0ODQ5IiwKCQkJInNpZyI6ICIzMDQ0MDIyMDA5OWU5MDdkY2Y5MGI3YjZlMTA5ZmQxZDZlNDQyMDA2ZmNjYmI0ODg5NGFhYWZmNDdhYjgyNGIwM2ZiMzVkMGQwMjIwMmFhMGEwNmMyMWE0MjMzZjM3OTAwYTQ4YmM4Nzc3ZDNiNDdmNTllM2EzODYxNmNlNjMxYTA0ZGY1N2Y5NjczNiIKCQl9LAoJCXsKCQkJImtleWlkIjogImZkZmE4M2EwN2I1YTgzNTg5Yjg3ZGVkNDFmNzdmMzlkMjMyYWQ5MWY3Y2NlNTI4NjhkYWNkMDZiYTA4OTg0OWYiLAoJCQkic2lnIjogIjMwNDUwMjIwMmNmZjQ0ZjIyMTVkN2E0N2IyOGI4ZjVmNTgwYzJjZmJiZDFiZmNmY2JiZTc4ZGUzMjMwNDViMmMwYmFkYzVlOTAyMjEwMGM3NDM5NDllYjNmNGVhNWE0YjlhZTI3YWM2ZWRkZWExZjBmZjliZmQwMDRmOGE5YTlkMThjNmU0MTQyYjZlNzUiCgkJfSwKCQl7CgkJCSJrZXlpZCI6ICI3Zjc1MTNiMjU0MjlhNjQ0NzNlMTBjZTNhZDJmM2RhMzcyYmJkZDE0YjY1ZDA3YmJhZjU0N2U3YzhiYmJlNjJiIiwKCQkJInNpZyI6ICIzMDQ1MDIyMDBlNTYxM2I5MDFlMGYzZTA4ZWNlYWJkZGM3M2Y5OGI1MGRkZjg5MmU5OThkMGIzNjljNmUzZDQ1MWFjNDg4NzUwMjIxMDA5NDBjZjkyZDFmNDNlZTJlNWNkYmIyMjU3MmJiNTI5MjVlZDM4NjNhNjg4ZjdmZmRkNGJkMmUyZTU2ZjAyOGIzIgoJCX0KCV0KfQ==","targets":{"trusted_root.json":"ewogICJtZWRpYVR5cGUiOiAiYXBwbGljYXRpb24vdm5kLmRldi5zaWdzdG9yZS50cnVzdGVkcm9vdCtqc29uO3ZlcnNpb249MC4xIiwKICAidGxvZ3MiOiBbCiAgICB7CiAgICAgICJiYXNlVXJsIjogImh0dHBzOi8vcmVrb3Iuc2lnc3RvcmUuZGV2IiwKICAgICAgImhhc2hBbGdvcml0aG0iOiAiU0hBMl8yNTYiLAogICAgICAicHVibGljS2V5IjogewogICAgICAgICJyYXdCeXRlcyI6ICJNRmt3RXdZSEtvWkl6ajBDQVFZSUtvWkl6ajBEQVFjRFFnQUUyRzJZKzJ0YWJkVFY1QmNHaUJJeDBhOWZBRndya0JibUxTR3RrczRMM3FYNnlZWTB6dWZCbmhDOFVyL2l5NTVHaFdQLzlBL2JZMkxoQzMwTTkrUll0dz09IiwKICAgICAgICAia2V5RGV0YWlscyI6ICJQS0lYX0VDRFNBX1AyNTZfU0hBXzI1NiIsCiAgICAgICAgInZhbGlkRm9yIjogewogICAgICAgICAgInN0YXJ0IjogIjIwMjEtMDEtMTJUMTE6NTM6MjcuMDAwWiIKICAgICAgICB9CiAgICAgIH0sCiAgICAgICJsb2dJZCI6IHsKICAgICAgICAia2V5SWQiOiAid05JOWF0UUdseitWV2ZPNkxSeWdINFFVZlkvOFc0UkZ3aVQ1aTVXUmdCMD0iCiAgICAgIH0KICAgIH0KICBdLAogICJjZXJ0aWZpY2F0ZUF1dGhvcml0aWVzIjogWwogICAgewogICAgICAic3ViamVjdCI6IHsKICAgICAgICAib3JnYW5pemF0aW9uIjogInNpZ3N0b3JlLmRldiIsCiAgICAgICAgImNvbW1vbk5hbWUiOiAic2lnc3RvcmUiCiAgICAgIH0sCiAgICAgICJ1cmkiOiAiaHR0cHM6Ly9mdWxjaW8uc2lnc3RvcmUuZGV2IiwKICAgICAgImNlcnRDaGFpbiI6IHsKICAgICAgICAiY2VydGlmaWNhdGVzIjogWwogICAgICAgICAgewogICAgICAgICAgICAicmF3Qnl0ZXMiOiAiTUlJQitEQ0NBWDZnQXdJQkFnSVROVmtEWm9DaW9mUERzeTdkZm02Z2VMYnVoekFLQmdncWhrak9QUVFEQXpBcU1SVXdFd1lEVlFRS0V3eHphV2R6ZEc5eVpTNWtaWFl4RVRBUEJnTlZCQU1UQ0hOcFozTjBiM0psTUI0WERUSXhNRE13TnpBek1qQXlPVm9YRFRNeE1ESXlNekF6TWpBeU9Wb3dLakVWTUJNR0ExVUVDaE1NYzJsbmMzUnZjbVV1WkdWMk1SRXdEd1lEVlFRREV3aHphV2R6ZEc5eVpUQjJNQkFHQnlxR1NNNDlBZ0VHQlN1QkJBQWlBMklBQkxTeUE3SWk1aytwTk84WkVXWTB5bGVtV0Rvd09rTmEza0wrR1pFNVo1R1dlaEw5L0E5YlJOQTNSYnJzWjVpMEpjYXN0YVJMN1NwNWZwL2pENWR4cWMvVWRUVm5sdlMxNmFuKzJZZnN3ZS9RdUxvbFJVQ3JjT0UyKzJpQTUrdHpkNk5tTUdRd0RnWURWUjBQQVFIL0JBUURBZ0VHTUJJR0ExVWRFd0VCL3dRSU1BWUJBZjhDQVFFd0hRWURWUjBPQkJZRUZNakZIUUJCbWlRcE1sRWs2dzJ1U3UxS0J0UHNNQjhHQTFVZEl3UVlNQmFBRk1qRkhRQkJtaVFwTWxFazZ3MnVTdTFLQnRQc01Bb0dDQ3FHU000OUJBTURBMmdBTUdVQ01IOGxpV0pmTXVpNnZYWEJoakRnWTRNd3NsbU4vVEp4VmUvODNXckZvbXdtTmYwNTZ5MVg0OEY5YzRtM2Ezb3pYQUl4QUtqUmF5NS9hai9qc0tLR0lrbVFhdGpJOHV1cEhyLytDeEZ2YUpXbXBZcU5rTERHUlUrOW9yemg1aEkyUnJjdWFRPT0iCiAgICAgICAgICB9CiAgICAgICAgXQogICAgICB9LAogICAgICAidmFsaWRGb3IiOiB7CiAgICAgICAgInN0YXJ0IjogIjIwMjEtMDMtMDdUMDM6MjA6MjkuMDAwWiIsCiAgICAgICAgImVuZCI6ICIyMDIyLTEyLTMxVDIzOjU5OjU5Ljk5OVoiCiAgICAgIH0KICAgIH0sCiAgICB7CiAgICAgICJzdWJqZWN0IjogewogICAgICAgICJvcmdhbml6YXRpb24iOiAic2lnc3RvcmUuZGV2IiwKICAgICAgICAiY29tbW9uTmFtZSI6ICJzaWdzdG9yZSIKICAgICAgfSwKICAgICAgInVyaSI6ICJodHRwczovL2Z1bGNpby5zaWdzdG9yZS5kZXYiLAogICAgICAiY2VydENoYWluIjogewogICAgICAgICJjZXJ0aWZpY2F0ZXMiOiBbCiAgICAgICAgICB7CiAgICAgICAgICAgICJyYXdCeXRlcyI6ICJNSUlDR2pDQ0FhR2dBd0lCQWdJVUFMblZpVmZuVTBickphc21Sa0hybi9VbmZhUXdDZ1lJS29aSXpqMEVBd013S2pFVk1CTUdBMVVFQ2hNTWMybG5jM1J2Y21VdVpHVjJNUkV3RHdZRFZRUURFd2h6YVdkemRHOXlaVEFlRncweU1qQTBNVE15TURBMk1UVmFGdzB6TVRFd01EVXhNelUyTlRoYU1EY3hGVEFUQmdOVkJBb1RESE5wWjNOMGIzSmxMbVJsZGpFZU1Cd0dBMVVFQXhNVmMybG5jM1J2Y21VdGFXNTBaWEp0WldScFlYUmxNSFl3RUFZSEtvWkl6ajBDQVFZRks0RUVBQ0lEWWdBRThSVlMveXNIK05PdnVEWnlQSVp0aWxnVUY5TmxhcllwQWQ5SFAxdkJCSDFVNUNWNzdMU1M3czBaaUg0bkU3SHY3cHRTNkx2dlIvU1RrNzk4TFZnTXpMbEo0SGVJZkYzdEhTYWV4TGNZcFNBU3Ixa1MwTi9SZ0JKei85aldDaVhubzNzd2VUQU9CZ05WSFE4QkFmOEVCQU1DQVFZd0V3WURWUjBsQkF3d0NnWUlLd1lCQlFVSEF3TXdFZ1lEVlIwVEFRSC9CQWd3QmdFQi93SUJBREFkQmdOVkhRNEVGZ1FVMzlQcHoxWWtFWmI1cU5qcEtGV2l4aTRZWkQ4d0h3WURWUjBqQkJnd0ZvQVVXTUFlWDVGRnBXYXBlc3lRb1pNaTBDckZ4Zm93Q2dZSUtvWkl6ajBFQXdNRFp3QXdaQUl3UENzUUs0RFlpWllEUElhRGk1SEZLbmZ4WHg2QVNTVm1FUmZzeW5ZQmlYMlg2U0pSblpVODQvOURaZG5GdnZ4bUFqQk90NlFwQmxjNEovMER4dmtUQ3FwY2x2emlMNkJDQ1BuamRsSUIzUHUzQnhzUG15Z1VZN0lpMnpiZENkbGlpb3c9IgogICAgICAgICAgfSwKICAgICAgICAgIHsKICAgICAgICAgICAgInJhd0J5dGVzIjogIk1JSUI5ekNDQVh5Z0F3SUJBZ0lVQUxaTkFQRmR4SFB3amVEbG9Ed3lZQ2hBTy80d0NnWUlLb1pJemowRUF3TXdLakVWTUJNR0ExVUVDaE1NYzJsbmMzUnZjbVV1WkdWMk1SRXdEd1lEVlFRREV3aHphV2R6ZEc5eVpUQWVGdzB5TVRFd01EY3hNelUyTlRsYUZ3MHpNVEV3TURVeE16VTJOVGhhTUNveEZUQVRCZ05WQkFvVERITnBaM04wYjNKbExtUmxkakVSTUE4R0ExVUVBeE1JYzJsbmMzUnZjbVV3ZGpBUUJnY3Foa2pPUFFJQkJnVXJnUVFBSWdOaUFBVDdYZUZUNHJiM1BRR3dTNElhanRMazMvT2xucGdhbmdhQmNsWXBzWUJyNWkrNHluQjA3Y2ViM0xQME9JT1pkeGV4WDY5YzVpVnV5SlJRK0h6MDV5aStVRjN1QldBbEhwaVM1c2gwK0gyR0hFN1NYcmsxRUM1bTFUcjE5TDlnZzkyall6QmhNQTRHQTFVZER3RUIvd1FFQXdJQkJqQVBCZ05WSFJNQkFmOEVCVEFEQVFIL01CMEdBMVVkRGdRV0JCUll3QjVma1VXbFpxbDZ6SkNoa3lMUUtzWEYrakFmQmdOVkhTTUVHREFXZ0JSWXdCNWZrVVdsWnFsNnpKQ2hreUxRS3NYRitqQUtCZ2dxaGtqT1BRUURBd05wQURCbUFqRUFqMW5IZVhacCsxM05XQk5hK0VEc0RQOEcxV1dnMXRDTVdQL1dIUHFwYVZvMGpoc3dlTkZaZ1NzMGVFN3dZSTRxQWpFQTJXQjlvdDk4c0lrb0YzdlpZZGQzL1Z0V0I1YjlUTk1lYTdJeC9zdEo1VGZjTExlQUJMRTRCTkpPc1E0dm5CSEoiCiAgICAgICAgICB9CiAgICAgICAgXQogICAgICB9LAogICAgICAidmFsaWRGb3IiOiB7CiAgICAgICAgInN0YXJ0IjogIjIwMjItMDQtMTNUMjA6MDY6MTUuMDAwWiIKICAgICAgfQogICAgfQogIF0sCiAgImN0bG9ncyI6IFsKICAgIHsKICAgICAgImJhc2VVcmwiOiAiaHR0cHM6Ly9jdGZlLnNpZ3N0b3JlLmRldi90ZXN0IiwKICAgICAgImhhc2hBbGdvcml0aG0iOiAiU0hBMl8yNTYiLAogICAgICAicHVibGljS2V5IjogewogICAgICAgICJyYXdCeXRlcyI6ICJNRmt3RXdZSEtvWkl6ajBDQVFZSUtvWkl6ajBEQVFjRFFnQUViZndSK1JKdWRYc2NnUkJScEtYMVhGRHkzUHl1ZER4ei9TZm5SaTFmVDhla3BmQmQyTzF1b3o3anIzWjhuS3p4QTY5RVVRK2VGQ0ZJM3pldWJQV1U3dz09IiwKICAgICAgICAia2V5RGV0YWlscyI6ICJQS0lYX0VDRFNBX1AyNTZfU0hBXzI1NiIsCiAgICAgICAgInZhbGlkRm9yIjogewogICAgICAgICAgInN0YXJ0IjogIjIwMjEtMDMtMTRUMDA6MDA6MDAuMDAwWiIsCiAgICAgICAgICAiZW5kIjogIjIwMjItMTAtMzFUMjM6NTk6NTkuOTk5WiIKICAgICAgICB9CiAgICAgIH0sCiAgICAgICJsb2dJZCI6IHsKICAgICAgICAia2V5SWQiOiAiQ0dDUzhDaFMvMmhGMGRGcko0U2NSV2NZckJZOXd6alNiZWE4SWdZMmIzST0iCiAgICAgIH0KICAgIH0sCiAgICB7CiAgICAgICJiYXNlVXJsIjogImh0dHBzOi8vY3RmZS5zaWdzdG9yZS5kZXYvMjAyMiIsCiAgICAgICJoYXNoQWxnb3JpdGhtIjogIlNIQTJfMjU2IiwKICAgICAgInB1YmxpY0tleSI6IHsKICAgICAgICAicmF3Qnl0ZXMiOiAiTUZrd0V3WUhLb1pJemowQ0FRWUlLb1pJemowREFRY0RRZ0FFaVBTbEZpMENtRlRmRWpDVXFGOUh1Q0VjWVhOS0FhWWFsSUptQlo4eXllelBqVHFoeHJLQnBNbmFvY1Z0TEpCSTFlTTN1WG5RelFHQUpkSjRnczlGeXc9PSIsCiAgICAgICAgImtleURldGFpbHMiOiAiUEtJWF9FQ0RTQV9QMjU2X1NIQV8yNTYiLAogICAgICAgICJ2YWxpZEZvciI6IHsKICAgICAgICAgICJzdGFydCI6ICIyMDIyLTEwLTIwVDAwOjAwOjAwLjAwMFoiCiAgICAgICAgfQogICAgICB9LAogICAgICAibG9nSWQiOiB7CiAgICAgICAgImtleUlkIjogIjNUMHdhc2JIRVRKakdSNGNtV2MzQXFKS1hyamVQSzMvaDRweWdDOHA3bzQ9IgogICAgICB9CiAgICB9CiAgXSwKICAidGltZXN0YW1wQXV0aG9yaXRpZXMiOiBbCiAgICB7CiAgICAgICJzdWJqZWN0IjogewogICAgICAgICJvcmdhbml6YXRpb24iOiAiR2l0SHViLCBJbmMuIiwKICAgICAgICAiY29tbW9uTmFtZSI6ICJJbnRlcm5hbCBTZXJ2aWNlcyBSb290IgogICAgICB9LAogICAgICAiY2VydENoYWluIjogewogICAgICAgICJjZXJ0aWZpY2F0ZXMiOiBbCiAgICAgICAgICB7CiAgICAgICAgICAgICJyYXdCeXRlcyI6ICJNSUlCM0RDQ0FXS2dBd0lCQWdJVWNoa05zSDM2WGEwNGIxTHFJYytxcjlEVmVjTXdDZ1lJS29aSXpqMEVBd013TWpFVk1CTUdBMVVFQ2hNTVIybDBTSFZpTENCSmJtTXVNUmt3RndZRFZRUURFeEJVVTBFZ2FXNTBaWEp0WldScFlYUmxNQjRYRFRJek1EUXhOREF3TURBd01Gb1hEVEkwTURReE16QXdNREF3TUZvd01qRVZNQk1HQTFVRUNoTU1SMmwwU0hWaUxDQkpibU11TVJrd0Z3WURWUVFERXhCVVUwRWdWR2x0WlhOMFlXMXdhVzVuTUZrd0V3WUhLb1pJemowQ0FRWUlLb1pJemowREFRY0RRZ0FFVUQ1Wk5iU3FZTWQ2cjhxcE9PRVg5aWJHblpUOUdzdVhPaHIvZjhVOUZKdWdCR0V4S1lwNDBPVUxTMGVyalpXN3hWOXhWNTJObkpmNU9lRHE0ZTVaS3FOV01GUXdEZ1lEVlIwUEFRSC9CQVFEQWdlQU1CTUdBMVVkSlFRTU1Bb0dDQ3NHQVFVRkJ3TUlNQXdHQTFVZEV3RUIvd1FDTUFBd0h3WURWUjBqQkJnd0ZvQVVhVzFSdWRPZ1Z0MGxlcVkwV0tZYnVQcjQ3d0F3Q2dZSUtvWkl6ajBFQXdNRGFBQXdaUUl3YlVIOUh2RDRlakNaSk9XUW5xQWxrcVVSbGx2dTlNOCtWcUxiaVJLK3pTZlpDWndzaWxqUm44TVFRUlNrWEVFNUFqRUFnK1Z4cXRvamZWZnU4RGh6emhDeDlHS0VUYkpIYjE5aVY3Mm1NS1ViREFGbXpaNmJROGI1NFpiOHRpZHk1YVdlIgogICAgICAgICAgfSwKICAgICAgICAgIHsKICAgICAgICAgICAgInJhd0J5dGVzIjogIk1JSUNFRENDQVpXZ0F3SUJBZ0lVWDhaTzVRWFA3dk40ZE1RNWU5c1UzbnViOE9nd0NnWUlLb1pJemowRUF3TXdPREVWTUJNR0ExVUVDaE1NUjJsMFNIVmlMQ0JKYm1NdU1SOHdIUVlEVlFRREV4WkpiblJsY201aGJDQlRaWEoyYVdObGN5QlNiMjkwTUI0WERUSXpNRFF4TkRBd01EQXdNRm9YRFRJNE1EUXhNakF3TURBd01Gb3dNakVWTUJNR0ExVUVDaE1NUjJsMFNIVmlMQ0JKYm1NdU1Sa3dGd1lEVlFRREV4QlVVMEVnYVc1MFpYSnRaV1JwWVhSbE1IWXdFQVlIS29aSXpqMENBUVlGSzRFRUFDSURZZ0FFdk1MWS9kVFZidklKWUFOQXVzekV3Sm5RRTFsbGZ0eW55TUtJTWhoNDhIbXFiVnI1eWd5YnpzTFJMVktiQldPZFoyMWFlSnorZ1ppeXRaZXRxY3lGOVdsRVI1TkVNZjZKVjdaTm9qUXB4SHE0UkhHb0dTY2VRdi9xdlRpWnhFREtvMll3WkRBT0JnTlZIUThCQWY4RUJBTUNBUVl3RWdZRFZSMFRBUUgvQkFnd0JnRUIvd0lCQURBZEJnTlZIUTRFRmdRVWFXMVJ1ZE9nVnQwbGVxWTBXS1lidVByNDd3QXdId1lEVlIwakJCZ3dGb0FVOU5ZWWxvYm5BRzRjMC9xanh5SC9scS93eitRd0NnWUlLb1pJemowRUF3TURhUUF3WmdJeEFLMUIxODV5Z0NySVlGbElzM0dqc3dqbndTTUc2TFk4d29MVmRha0tEWnhWYThmOGNxTXMxRGhjeEowKzA5dzk1UUl4QU8rdEJ6Wms3dmpVSjlpSmdENFI2WldUeFFXS3FObTc0ak85OW8rbzlzdjRGSS9TWlRaVEZ5TW4wSUpFSGRObXlBPT0iCiAgICAgICAgICB9LAogICAgICAgICAgewogICAgICAgICAgICAicmF3Qnl0ZXMiOiAiTUlJQjlEQ0NBWHFnQXdJQkFnSVVhL0pBa2RVaks0SlV3c3F0YWlSSkdXaHFMU293Q2dZSUtvWkl6ajBFQXdNd09ERVZNQk1HQTFVRUNoTU1SMmwwU0hWaUxDQkpibU11TVI4d0hRWURWUVFERXhaSmJuUmxjbTVoYkNCVFpYSjJhV05sY3lCU2IyOTBNQjRYRFRJek1EUXhOREF3TURBd01Gb1hEVE16TURReE1UQXdNREF3TUZvd09ERVZNQk1HQTFVRUNoTU1SMmwwU0hWaUxDQkpibU11TVI4d0hRWURWUVFERXhaSmJuUmxjbTVoYkNCVFpYSjJhV05sY3lCU2IyOTBNSFl3RUFZSEtvWkl6ajBDQVFZRks0RUVBQ0lEWWdBRWY5akZBWHh6NGt4NjhBSFJNT2tGQmhmbERjTVR2emFYejR4L0ZDY1hqSi8xcUVLb24vcVBJR25hVVJza0R0eU5iTkRPcGVKVERERnF0NDhpTVBybnpweDZJWndxZW1mVUpONHhCRVpmemErcFl0L2l5b2QrOXRacjIwUlJXU3YvbzBVd1F6QU9CZ05WSFE4QkFmOEVCQU1DQVFZd0VnWURWUjBUQVFIL0JBZ3dCZ0VCL3dJQkFqQWRCZ05WSFE0RUZnUVU5TllZbG9ibkFHNGMwL3FqeHlIL2xxL3d6K1F3Q2dZSUtvWkl6ajBFQXdNRGFBQXdaUUl4QUxaTFo4QmdSWHpLeExNTU45VklsTytlNGhyQm5OQmdGN3R6N0hucm93djJOZXRaRXJJQUNLRnltQmx2V0R2dE1BSXdaTytraTZzc1ExYnNabzk4TzhtRUFmMk5aN2lpQ2dERFUwVndqZWNvNnp5ZWgwekJUczkvN2dWNkFITlE1M3hEIgogICAgICAgICAgfQogICAgICAgIF0KICAgICAgfSwKICAgICAgInZhbGlkRm9yIjogewogICAgICAgICJzdGFydCI6ICIyMDIzLTA0LTE0VDAwOjAwOjAwLjAwMFoiCiAgICAgIH0KICAgIH0KICBdCn0K","registry.npmjs.org%2Fkeys.json":"ewogICAgImtleXMiOiBbCiAgICAgICAgewogICAgICAgICAgICAia2V5SWQiOiAiU0hBMjU2OmpsM2J3c3d1ODBQampva0NnaDBvMnc1YzJVNExoUUFFNTdnajljejFrekEiLAogICAgICAgICAgICAia2V5VXNhZ2UiOiAibnBtOnNpZ25hdHVyZXMiLAogICAgICAgICAgICAicHVibGljS2V5IjogewogICAgICAgICAgICAgICAgInJhd0J5dGVzIjogIk1Ga3dFd1lIS29aSXpqMENBUVlJS29aSXpqMERBUWNEUWdBRTFPbGIzek1BRkZ4WEtIaUlrUU81Y0ozWWhsNWk2VVBwK0lodXRlQkpidUhjQTVVb2dLbzBFV3RsV3dXNktTYUtvVE5FWUw3SmxDUWlWbmtoQmt0VWdnPT0iLAogICAgICAgICAgICAgICAgImtleURldGFpbHMiOiAiUEtJWF9FQ0RTQV9QMjU2X1NIQV8yNTYiLAogICAgICAgICAgICAgICAgInZhbGlkRm9yIjogewogICAgICAgICAgICAgICAgICAgICJzdGFydCI6ICIxOTk5LTAxLTAxVDAwOjAwOjAwLjAwMFoiCiAgICAgICAgICAgICAgICB9CiAgICAgICAgICAgIH0KICAgICAgICB9LAogICAgICAgIHsKICAgICAgICAgICAgImtleUlkIjogIlNIQTI1NjpqbDNid3N3dTgwUGpqb2tDZ2gwbzJ3NWMyVTRMaFFBRTU3Z2o5Y3oxa3pBIiwKICAgICAgICAgICAgImtleVVzYWdlIjogIm5wbTphdHRlc3RhdGlvbnMiLAogICAgICAgICAgICAicHVibGljS2V5IjogewogICAgICAgICAgICAgICAgInJhd0J5dGVzIjogIk1Ga3dFd1lIS29aSXpqMENBUVlJS29aSXpqMERBUWNEUWdBRTFPbGIzek1BRkZ4WEtIaUlrUU81Y0ozWWhsNWk2VVBwK0lodXRlQkpidUhjQTVVb2dLbzBFV3RsV3dXNktTYUtvVE5FWUw3SmxDUWlWbmtoQmt0VWdnPT0iLAogICAgICAgICAgICAgICAgImtleURldGFpbHMiOiAiUEtJWF9FQ0RTQV9QMjU2X1NIQV8yNTYiLAogICAgICAgICAgICAgICAgInZhbGlkRm9yIjogewogICAgICAgICAgICAgICAgICAgICJzdGFydCI6ICIyMDIyLTEyLTAxVDAwOjAwOjAwLjAwMFoiCiAgICAgICAgICAgICAgICB9CiAgICAgICAgICAgIH0KICAgICAgICB9CiAgICBdCn0K"}}} verify/package.json000064400000002046151701425750010347 0ustar00{ "_id": "@sigstore/verify@1.2.1", "_inBundle": true, "_location": "/npm/@sigstore/verify", "_phantomChildren": {}, "_requiredBy": [ "/npm/sigstore" ], "author": { "name": "bdehamer@github.com" }, "bugs": { "url": "https://github.com/sigstore/sigstore-js/issues" }, "dependencies": { "@sigstore/bundle": "^2.3.2", "@sigstore/core": "^1.1.0", "@sigstore/protobuf-specs": "^0.3.2" }, "description": "Verification of Sigstore signatures", "engines": { "node": "^16.14.0 || >=18.0.0" }, "files": [ "dist" ], "homepage": "https://github.com/sigstore/sigstore-js/tree/main/packages/verify#readme", "license": "Apache-2.0", "main": "dist/index.js", "name": "@sigstore/verify", "publishConfig": { "provenance": true }, "repository": { "type": "git", "url": "git+https://github.com/sigstore/sigstore-js.git" }, "scripts": { "build": "tsc --build", "clean": "shx rm -rf dist *.tsbuildinfo", "test": "jest" }, "types": "dist/index.d.ts", "version": "1.2.1" } verify/dist/key/index.js000064400000005346151701425750011267 0ustar00"use strict"; Object.defineProperty(exports, "__esModule", { value: true }); exports.verifyCertificate = exports.verifyPublicKey = void 0; /* Copyright 2023 The Sigstore Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. */ const core_1 = require("@sigstore/core"); const error_1 = require("../error"); const certificate_1 = require("./certificate"); const sct_1 = require("./sct"); const OID_FULCIO_ISSUER_V1 = '1.3.6.1.4.1.57264.1.1'; const OID_FULCIO_ISSUER_V2 = '1.3.6.1.4.1.57264.1.8'; function verifyPublicKey(hint, timestamps, trustMaterial) { const key = trustMaterial.publicKey(hint); timestamps.forEach((timestamp) => { if (!key.validFor(timestamp)) { throw new error_1.VerificationError({ code: 'PUBLIC_KEY_ERROR', message: `Public key is not valid for timestamp: ${timestamp.toISOString()}`, }); } }); return { key: key.publicKey }; } exports.verifyPublicKey = verifyPublicKey; function verifyCertificate(leaf, timestamps, trustMaterial) { // Check that leaf certificate chains to a trusted CA const path = (0, certificate_1.verifyCertificateChain)(leaf, trustMaterial.certificateAuthorities); // Check that ALL certificates are valid for ALL of the timestamps const validForDate = timestamps.every((timestamp) => path.every((cert) => cert.validForDate(timestamp))); if (!validForDate) { throw new error_1.VerificationError({ code: 'CERTIFICATE_ERROR', message: 'certificate is not valid or expired at the specified date', }); } return { scts: (0, sct_1.verifySCTs)(path[0], path[1], trustMaterial.ctlogs), signer: getSigner(path[0]), }; } exports.verifyCertificate = verifyCertificate; function getSigner(cert) { let issuer; const issuerExtension = cert.extension(OID_FULCIO_ISSUER_V2); if (issuerExtension) { issuer = issuerExtension.valueObj.subs?.[0]?.value.toString('ascii'); } else { issuer = cert.extension(OID_FULCIO_ISSUER_V1)?.value.toString('ascii'); } const identity = { extensions: { issuer }, subjectAlternativeName: cert.subjectAltName, }; return { key: core_1.crypto.createPublicKey(cert.publicKey), identity, }; } verify/dist/key/certificate.js000064400000020065151701425750012435 0ustar00"use strict"; Object.defineProperty(exports, "__esModule", { value: true }); exports.CertificateChainVerifier = exports.verifyCertificateChain = void 0; const error_1 = require("../error"); const trust_1 = require("../trust"); function verifyCertificateChain(leaf, certificateAuthorities) { // Filter list of trusted CAs to those which are valid for the given // leaf certificate. const cas = (0, trust_1.filterCertAuthorities)(certificateAuthorities, { start: leaf.notBefore, end: leaf.notAfter, }); /* eslint-disable-next-line @typescript-eslint/no-explicit-any */ let error; for (const ca of cas) { try { const verifier = new CertificateChainVerifier({ trustedCerts: ca.certChain, untrustedCert: leaf, }); return verifier.verify(); } catch (err) { error = err; } } // If we failed to verify the certificate chain for all of the trusted // CAs, throw the last error we encountered. throw new error_1.VerificationError({ code: 'CERTIFICATE_ERROR', message: 'Failed to verify certificate chain', cause: error, }); } exports.verifyCertificateChain = verifyCertificateChain; class CertificateChainVerifier { constructor(opts) { this.untrustedCert = opts.untrustedCert; this.trustedCerts = opts.trustedCerts; this.localCerts = dedupeCertificates([ ...opts.trustedCerts, opts.untrustedCert, ]); } verify() { // Construct certificate path from leaf to root const certificatePath = this.sort(); // Perform validation checks on each certificate in the path this.checkPath(certificatePath); // Return verified certificate path return certificatePath; } sort() { const leafCert = this.untrustedCert; // Construct all possible paths from the leaf let paths = this.buildPaths(leafCert); // Filter for paths which contain a trusted certificate paths = paths.filter((path) => path.some((cert) => this.trustedCerts.includes(cert))); if (paths.length === 0) { throw new error_1.VerificationError({ code: 'CERTIFICATE_ERROR', message: 'no trusted certificate path found', }); } // Find the shortest of possible paths /* istanbul ignore next */ const path = paths.reduce((prev, curr) => prev.length < curr.length ? prev : curr); // Construct chain from shortest path // Removes the last certificate in the path, which will be a second copy // of the root certificate given that the root is self-signed. return [leafCert, ...path].slice(0, -1); } // Recursively build all possible paths from the leaf to the root buildPaths(certificate) { const paths = []; const issuers = this.findIssuer(certificate); if (issuers.length === 0) { throw new error_1.VerificationError({ code: 'CERTIFICATE_ERROR', message: 'no valid certificate path found', }); } for (let i = 0; i < issuers.length; i++) { const issuer = issuers[i]; // Base case - issuer is self if (issuer.equals(certificate)) { paths.push([certificate]); continue; } // Recursively build path for the issuer const subPaths = this.buildPaths(issuer); // Construct paths by appending the issuer to each subpath for (let j = 0; j < subPaths.length; j++) { paths.push([issuer, ...subPaths[j]]); } } return paths; } // Return all possible issuers for the given certificate findIssuer(certificate) { let issuers = []; let keyIdentifier; // Exit early if the certificate is self-signed if (certificate.subject.equals(certificate.issuer)) { if (certificate.verify()) { return [certificate]; } } // If the certificate has an authority key identifier, use that // to find the issuer if (certificate.extAuthorityKeyID) { keyIdentifier = certificate.extAuthorityKeyID.keyIdentifier; // TODO: Add support for authorityCertIssuer/authorityCertSerialNumber // though Fulcio doesn't appear to use these } // Find possible issuers by comparing the authorityKeyID/subjectKeyID // or issuer/subject. Potential issuers are added to the result array. this.localCerts.forEach((possibleIssuer) => { if (keyIdentifier) { if (possibleIssuer.extSubjectKeyID) { if (possibleIssuer.extSubjectKeyID.keyIdentifier.equals(keyIdentifier)) { issuers.push(possibleIssuer); } return; } } // Fallback to comparing certificate issuer and subject if // subjectKey/authorityKey extensions are not present if (possibleIssuer.subject.equals(certificate.issuer)) { issuers.push(possibleIssuer); } }); // Remove any issuers which fail to verify the certificate issuers = issuers.filter((issuer) => { try { return certificate.verify(issuer); } catch (ex) { /* istanbul ignore next - should never error */ return false; } }); return issuers; } checkPath(path) { /* istanbul ignore if */ if (path.length < 1) { throw new error_1.VerificationError({ code: 'CERTIFICATE_ERROR', message: 'certificate chain must contain at least one certificate', }); } // Ensure that all certificates beyond the leaf are CAs const validCAs = path.slice(1).every((cert) => cert.isCA); if (!validCAs) { throw new error_1.VerificationError({ code: 'CERTIFICATE_ERROR', message: 'intermediate certificate is not a CA', }); } // Certificate's issuer must match the subject of the next certificate // in the chain for (let i = path.length - 2; i >= 0; i--) { /* istanbul ignore if */ if (!path[i].issuer.equals(path[i + 1].subject)) { throw new error_1.VerificationError({ code: 'CERTIFICATE_ERROR', message: 'incorrect certificate name chaining', }); } } // Check pathlength constraints for (let i = 0; i < path.length; i++) { const cert = path[i]; // If the certificate is a CA, check the path length if (cert.extBasicConstraints?.isCA) { const pathLength = cert.extBasicConstraints.pathLenConstraint; // The path length, if set, indicates how many intermediate // certificates (NOT including the leaf) are allowed to follow. The // pathLength constraint of any intermediate CA certificate MUST be // greater than or equal to it's own depth in the chain (with an // adjustment for the leaf certificate) if (pathLength !== undefined && pathLength < i - 1) { throw new error_1.VerificationError({ code: 'CERTIFICATE_ERROR', message: 'path length constraint exceeded', }); } } } } } exports.CertificateChainVerifier = CertificateChainVerifier; // Remove duplicate certificates from the array function dedupeCertificates(certs) { for (let i = 0; i < certs.length; i++) { for (let j = i + 1; j < certs.length; j++) { if (certs[i].equals(certs[j])) { certs.splice(j, 1); j--; } } } return certs; } verify/dist/key/sct.js000064400000006357151701425750010754 0ustar00"use strict"; Object.defineProperty(exports, "__esModule", { value: true }); exports.verifySCTs = void 0; /* Copyright 2023 The Sigstore Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. */ const core_1 = require("@sigstore/core"); const error_1 = require("../error"); const trust_1 = require("../trust"); function verifySCTs(cert, issuer, ctlogs) { let extSCT; // Verifying the SCT requires that we remove the SCT extension and // re-encode the TBS structure to DER -- this value is part of the data // over which the signature is calculated. Since this is a destructive action // we create a copy of the certificate so we can remove the SCT extension // without affecting the original certificate. const clone = cert.clone(); // Intentionally not using the findExtension method here because we want to // remove the the SCT extension from the certificate before calculating the // PreCert structure for (let i = 0; i < clone.extensions.length; i++) { const ext = clone.extensions[i]; if (ext.subs[0].toOID() === core_1.EXTENSION_OID_SCT) { extSCT = new core_1.X509SCTExtension(ext); // Remove the extension from the certificate clone.extensions.splice(i, 1); break; } } // No SCT extension found to verify if (!extSCT) { return []; } // Found an SCT extension but it has no SCTs /* istanbul ignore if -- too difficult to fabricate test case for this */ if (extSCT.signedCertificateTimestamps.length === 0) { return []; } // Construct the PreCert structure // https://www.rfc-editor.org/rfc/rfc6962#section-3.2 const preCert = new core_1.ByteStream(); // Calculate hash of the issuer's public key const issuerId = core_1.crypto.hash(issuer.publicKey); preCert.appendView(issuerId); // Re-encodes the certificate to DER after removing the SCT extension const tbs = clone.tbsCertificate.toDER(); preCert.appendUint24(tbs.length); preCert.appendView(tbs); // Calculate and return the verification results for each SCT return extSCT.signedCertificateTimestamps.map((sct) => { // Find the ctlog instance that corresponds to the SCT's logID const validCTLogs = (0, trust_1.filterTLogAuthorities)(ctlogs, { logID: sct.logID, targetDate: sct.datetime, }); // See if the SCT is valid for any of the CT logs const verified = validCTLogs.some((log) => sct.verify(preCert.buffer, log.publicKey)); if (!verified) { throw new error_1.VerificationError({ code: 'CERTIFICATE_ERROR', message: 'SCT verification failed', }); } return sct.logID; }); } exports.verifySCTs = verifySCTs; verify/dist/timestamp/merkle.js000064400000010304151701425750012640 0ustar00"use strict"; Object.defineProperty(exports, "__esModule", { value: true }); exports.verifyMerkleInclusion = void 0; /* Copyright 2023 The Sigstore Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. */ const core_1 = require("@sigstore/core"); const error_1 = require("../error"); const RFC6962_LEAF_HASH_PREFIX = Buffer.from([0x00]); const RFC6962_NODE_HASH_PREFIX = Buffer.from([0x01]); function verifyMerkleInclusion(entry) { const inclusionProof = entry.inclusionProof; const logIndex = BigInt(inclusionProof.logIndex); const treeSize = BigInt(inclusionProof.treeSize); if (logIndex < 0n || logIndex >= treeSize) { throw new error_1.VerificationError({ code: 'TLOG_INCLUSION_PROOF_ERROR', message: `invalid index: ${logIndex}`, }); } // Figure out which subset of hashes corresponds to the inner and border // nodes const { inner, border } = decompInclProof(logIndex, treeSize); if (inclusionProof.hashes.length !== inner + border) { throw new error_1.VerificationError({ code: 'TLOG_INCLUSION_PROOF_ERROR', message: 'invalid hash count', }); } const innerHashes = inclusionProof.hashes.slice(0, inner); const borderHashes = inclusionProof.hashes.slice(inner); // The entry's hash is the leaf hash const leafHash = hashLeaf(entry.canonicalizedBody); // Chain the hashes belonging to the inner and border portions const calculatedHash = chainBorderRight(chainInner(leafHash, innerHashes, logIndex), borderHashes); // Calculated hash should match the root hash in the inclusion proof if (!core_1.crypto.bufferEqual(calculatedHash, inclusionProof.rootHash)) { throw new error_1.VerificationError({ code: 'TLOG_INCLUSION_PROOF_ERROR', message: 'calculated root hash does not match inclusion proof', }); } } exports.verifyMerkleInclusion = verifyMerkleInclusion; // Breaks down inclusion proof for a leaf at the specified index in a tree of // the specified size. The split point is where paths to the index leaf and // the (size - 1) leaf diverge. Returns lengths of the bottom and upper proof // parts. function decompInclProof(index, size) { const inner = innerProofSize(index, size); const border = onesCount(index >> BigInt(inner)); return { inner, border }; } // Computes a subtree hash for a node on or below the tree's right border. // Assumes the provided proof hashes are ordered from lower to higher levels // and seed is the initial hash of the node specified by the index. function chainInner(seed, hashes, index) { return hashes.reduce((acc, h, i) => { if ((index >> BigInt(i)) & BigInt(1)) { return hashChildren(h, acc); } else { return hashChildren(acc, h); } }, seed); } // Computes a subtree hash for nodes along the tree's right border. function chainBorderRight(seed, hashes) { return hashes.reduce((acc, h) => hashChildren(h, acc), seed); } function innerProofSize(index, size) { return bitLength(index ^ (size - BigInt(1))); } // Counts the number of ones in the binary representation of the given number. // https://en.wikipedia.org/wiki/Hamming_weight function onesCount(num) { return num.toString(2).split('1').length - 1; } // Returns the number of bits necessary to represent an integer in binary. function bitLength(n) { if (n === 0n) { return 0; } return n.toString(2).length; } // Hashing logic according to RFC6962. // https://datatracker.ietf.org/doc/html/rfc6962#section-2 function hashChildren(left, right) { return core_1.crypto.hash(RFC6962_NODE_HASH_PREFIX, left, right); } function hashLeaf(leaf) { return core_1.crypto.hash(RFC6962_LEAF_HASH_PREFIX, leaf); } verify/dist/timestamp/set.js000064400000005065151701425750012164 0ustar00"use strict"; Object.defineProperty(exports, "__esModule", { value: true }); exports.verifyTLogSET = void 0; /* Copyright 2023 The Sigstore Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. */ const core_1 = require("@sigstore/core"); const error_1 = require("../error"); const trust_1 = require("../trust"); // Verifies the SET for the given entry against the list of trusted // transparency logs. Returns true if the SET can be verified against at least // one of the trusted logs; otherwise, returns false. function verifyTLogSET(entry, tlogs) { // Filter the list of tlog instances to only those which might be able to // verify the SET const validTLogs = (0, trust_1.filterTLogAuthorities)(tlogs, { logID: entry.logId.keyId, targetDate: new Date(Number(entry.integratedTime) * 1000), }); // Check to see if we can verify the SET against any of the valid tlogs const verified = validTLogs.some((tlog) => { // Re-create the original Rekor verification payload const payload = toVerificationPayload(entry); // Canonicalize the payload and turn into a buffer for verification const data = Buffer.from(core_1.json.canonicalize(payload), 'utf8'); // Extract the SET from the tlog entry const signature = entry.inclusionPromise.signedEntryTimestamp; return core_1.crypto.verify(data, tlog.publicKey, signature); }); if (!verified) { throw new error_1.VerificationError({ code: 'TLOG_INCLUSION_PROMISE_ERROR', message: 'inclusion promise could not be verified', }); } } exports.verifyTLogSET = verifyTLogSET; // Returns a properly formatted "VerificationPayload" for one of the // transaction log entires in the given bundle which can be used for SET // verification. function toVerificationPayload(entry) { const { integratedTime, logIndex, logId, canonicalizedBody } = entry; return { body: canonicalizedBody.toString('base64'), integratedTime: Number(integratedTime), logIndex: Number(logIndex), logID: logId.keyId.toString('hex'), }; } verify/dist/timestamp/index.js000064400000003272151701425750012476 0ustar00"use strict"; Object.defineProperty(exports, "__esModule", { value: true }); exports.verifyTLogTimestamp = exports.verifyTSATimestamp = void 0; const error_1 = require("../error"); const checkpoint_1 = require("./checkpoint"); const merkle_1 = require("./merkle"); const set_1 = require("./set"); const tsa_1 = require("./tsa"); function verifyTSATimestamp(timestamp, data, timestampAuthorities) { (0, tsa_1.verifyRFC3161Timestamp)(timestamp, data, timestampAuthorities); return { type: 'timestamp-authority', logID: timestamp.signerSerialNumber, timestamp: timestamp.signingTime, }; } exports.verifyTSATimestamp = verifyTSATimestamp; function verifyTLogTimestamp(entry, tlogAuthorities) { let inclusionVerified = false; if (isTLogEntryWithInclusionPromise(entry)) { (0, set_1.verifyTLogSET)(entry, tlogAuthorities); inclusionVerified = true; } if (isTLogEntryWithInclusionProof(entry)) { (0, merkle_1.verifyMerkleInclusion)(entry); (0, checkpoint_1.verifyCheckpoint)(entry, tlogAuthorities); inclusionVerified = true; } if (!inclusionVerified) { throw new error_1.VerificationError({ code: 'TLOG_MISSING_INCLUSION_ERROR', message: 'inclusion could not be verified', }); } return { type: 'transparency-log', logID: entry.logId.keyId, timestamp: new Date(Number(entry.integratedTime) * 1000), }; } exports.verifyTLogTimestamp = verifyTLogTimestamp; function isTLogEntryWithInclusionPromise(entry) { return entry.inclusionPromise !== undefined; } function isTLogEntryWithInclusionProof(entry) { return entry.inclusionProof !== undefined; } verify/dist/timestamp/checkpoint.js000064400000015520151701425750013515 0ustar00"use strict"; Object.defineProperty(exports, "__esModule", { value: true }); exports.verifyCheckpoint = void 0; /* Copyright 2023 The Sigstore Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. */ const core_1 = require("@sigstore/core"); const error_1 = require("../error"); const trust_1 = require("../trust"); // Separator between the note and the signatures in a checkpoint const CHECKPOINT_SEPARATOR = '\n\n'; // Checkpoint signatures are of the following form: // "– <identity> <key_hint+signature_bytes>\n" // where: // - the prefix is an emdash (U+2014). // - <identity> gives a human-readable representation of the signing ID. // - <key_hint+signature_bytes> is the first 4 bytes of the SHA256 hash of the // associated public key followed by the signature bytes. const SIGNATURE_REGEX = /\u2014 (\S+) (\S+)\n/g; // Verifies the checkpoint value in the given tlog entry. There are two steps // to the verification: // 1. Verify that all signatures in the checkpoint can be verified against a // trusted public key // 2. Verify that the root hash in the checkpoint matches the root hash in the // inclusion proof // See: https://github.com/transparency-dev/formats/blob/main/log/README.md function verifyCheckpoint(entry, tlogs) { // Filter tlog instances to just those which were valid at the time of the // entry const validTLogs = (0, trust_1.filterTLogAuthorities)(tlogs, { targetDate: new Date(Number(entry.integratedTime) * 1000), }); const inclusionProof = entry.inclusionProof; const signedNote = SignedNote.fromString(inclusionProof.checkpoint.envelope); const checkpoint = LogCheckpoint.fromString(signedNote.note); // Verify that the signatures in the checkpoint are all valid if (!verifySignedNote(signedNote, validTLogs)) { throw new error_1.VerificationError({ code: 'TLOG_INCLUSION_PROOF_ERROR', message: 'invalid checkpoint signature', }); } // Verify that the root hash from the checkpoint matches the root hash in the // inclusion proof if (!core_1.crypto.bufferEqual(checkpoint.logHash, inclusionProof.rootHash)) { throw new error_1.VerificationError({ code: 'TLOG_INCLUSION_PROOF_ERROR', message: 'root hash mismatch', }); } } exports.verifyCheckpoint = verifyCheckpoint; // Verifies the signatures in the SignedNote. For each signature, the // corresponding transparency log is looked up by the key hint and the // signature is verified against the public key in the transparency log. // Throws an error if any of the signatures are invalid. function verifySignedNote(signedNote, tlogs) { const data = Buffer.from(signedNote.note, 'utf-8'); return signedNote.signatures.every((signature) => { // Find the transparency log instance with the matching key hint const tlog = tlogs.find((tlog) => core_1.crypto.bufferEqual(tlog.logID.subarray(0, 4), signature.keyHint)); if (!tlog) { return false; } return core_1.crypto.verify(data, tlog.publicKey, signature.signature); }); } // SignedNote represents a signed note from a transparency log checkpoint. Consists // of a body (or note) and one more signatures calculated over the body. See // https://github.com/transparency-dev/formats/blob/main/log/README.md#signed-envelope class SignedNote { constructor(note, signatures) { this.note = note; this.signatures = signatures; } // Deserialize a SignedNote from a string static fromString(envelope) { if (!envelope.includes(CHECKPOINT_SEPARATOR)) { throw new error_1.VerificationError({ code: 'TLOG_INCLUSION_PROOF_ERROR', message: 'missing checkpoint separator', }); } // Split the note into the header and the data portions at the separator const split = envelope.indexOf(CHECKPOINT_SEPARATOR); const header = envelope.slice(0, split + 1); const data = envelope.slice(split + CHECKPOINT_SEPARATOR.length); // Find all the signature lines in the data portion const matches = data.matchAll(SIGNATURE_REGEX); // Parse each of the matched signature lines into the name and signature. // The first four bytes of the signature are the key hint (should match the // first four bytes of the log ID), and the rest is the signature itself. const signatures = Array.from(matches, (match) => { const [, name, signature] = match; const sigBytes = Buffer.from(signature, 'base64'); if (sigBytes.length < 5) { throw new error_1.VerificationError({ code: 'TLOG_INCLUSION_PROOF_ERROR', message: 'malformed checkpoint signature', }); } return { name, keyHint: sigBytes.subarray(0, 4), signature: sigBytes.subarray(4), }; }); if (signatures.length === 0) { throw new error_1.VerificationError({ code: 'TLOG_INCLUSION_PROOF_ERROR', message: 'no signatures found in checkpoint', }); } return new SignedNote(header, signatures); } } // LogCheckpoint represents a transparency log checkpoint. Consists of the // following: // - origin: the name of the transparency log // - logSize: the size of the log at the time of the checkpoint // - logHash: the root hash of the log at the time of the checkpoint // - rest: the rest of the checkpoint body, which is a list of log entries // See: // https://github.com/transparency-dev/formats/blob/main/log/README.md#checkpoint-body class LogCheckpoint { constructor(origin, logSize, logHash, rest) { this.origin = origin; this.logSize = logSize; this.logHash = logHash; this.rest = rest; } static fromString(note) { const lines = note.trimEnd().split('\n'); if (lines.length < 3) { throw new error_1.VerificationError({ code: 'TLOG_INCLUSION_PROOF_ERROR', message: 'too few lines in checkpoint header', }); } const origin = lines[0]; const logSize = BigInt(lines[1]); const rootHash = Buffer.from(lines[2], 'base64'); const rest = lines.slice(3); return new LogCheckpoint(origin, logSize, rootHash, rest); } } verify/dist/timestamp/tsa.js000064400000005631151701425750012157 0ustar00"use strict"; Object.defineProperty(exports, "__esModule", { value: true }); exports.verifyRFC3161Timestamp = void 0; const core_1 = require("@sigstore/core"); const error_1 = require("../error"); const certificate_1 = require("../key/certificate"); const trust_1 = require("../trust"); function verifyRFC3161Timestamp(timestamp, data, timestampAuthorities) { const signingTime = timestamp.signingTime; // Filter for CAs which were valid at the time of signing timestampAuthorities = (0, trust_1.filterCertAuthorities)(timestampAuthorities, { start: signingTime, end: signingTime, }); // Filter for CAs which match serial and issuer embedded in the timestamp timestampAuthorities = filterCAsBySerialAndIssuer(timestampAuthorities, { serialNumber: timestamp.signerSerialNumber, issuer: timestamp.signerIssuer, }); // Check that we can verify the timestamp with AT LEAST ONE of the remaining // CAs const verified = timestampAuthorities.some((ca) => { try { verifyTimestampForCA(timestamp, data, ca); return true; } catch (e) { return false; } }); if (!verified) { throw new error_1.VerificationError({ code: 'TIMESTAMP_ERROR', message: 'timestamp could not be verified', }); } } exports.verifyRFC3161Timestamp = verifyRFC3161Timestamp; function verifyTimestampForCA(timestamp, data, ca) { const [leaf, ...cas] = ca.certChain; const signingKey = core_1.crypto.createPublicKey(leaf.publicKey); const signingTime = timestamp.signingTime; // Verify the certificate chain for the provided CA try { new certificate_1.CertificateChainVerifier({ untrustedCert: leaf, trustedCerts: cas, }).verify(); } catch (e) { throw new error_1.VerificationError({ code: 'TIMESTAMP_ERROR', message: 'invalid certificate chain', }); } // Check that all of the CA certs were valid at the time of signing const validAtSigningTime = ca.certChain.every((cert) => cert.validForDate(signingTime)); if (!validAtSigningTime) { throw new error_1.VerificationError({ code: 'TIMESTAMP_ERROR', message: 'timestamp was signed with an expired certificate', }); } // Check that the signing certificate's key can be used to verify the // timestamp signature. timestamp.verify(data, signingKey); } // Filters the list of CAs to those which have a leaf signing certificate which // matches the given serial number and issuer. function filterCAsBySerialAndIssuer(timestampAuthorities, criteria) { return timestampAuthorities.filter((ca) => ca.certChain.length > 0 && core_1.crypto.bufferEqual(ca.certChain[0].serialNumber, criteria.serialNumber) && core_1.crypto.bufferEqual(ca.certChain[0].issuer, criteria.issuer)); } verify/dist/shared.types.js000064400000000115151701425750011766 0ustar00"use strict"; Object.defineProperty(exports, "__esModule", { value: true }); verify/dist/index.js000064400000003033151701425750010466 0ustar00"use strict"; Object.defineProperty(exports, "__esModule", { value: true }); exports.Verifier = exports.toTrustMaterial = exports.VerificationError = exports.PolicyError = exports.toSignedEntity = void 0; /* istanbul ignore file */ /* Copyright 2023 The Sigstore Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. */ var bundle_1 = require("./bundle"); Object.defineProperty(exports, "toSignedEntity", { enumerable: true, get: function () { return bundle_1.toSignedEntity; } }); var error_1 = require("./error"); Object.defineProperty(exports, "PolicyError", { enumerable: true, get: function () { return error_1.PolicyError; } }); Object.defineProperty(exports, "VerificationError", { enumerable: true, get: function () { return error_1.VerificationError; } }); var trust_1 = require("./trust"); Object.defineProperty(exports, "toTrustMaterial", { enumerable: true, get: function () { return trust_1.toTrustMaterial; } }); var verifier_1 = require("./verifier"); Object.defineProperty(exports, "Verifier", { enumerable: true, get: function () { return verifier_1.Verifier; } }); verify/dist/bundle/message.js000064400000002504151701425750012256 0ustar00"use strict"; Object.defineProperty(exports, "__esModule", { value: true }); exports.MessageSignatureContent = void 0; /* Copyright 2023 The Sigstore Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. */ const core_1 = require("@sigstore/core"); class MessageSignatureContent { constructor(messageSignature, artifact) { this.signature = messageSignature.signature; this.messageDigest = messageSignature.messageDigest.digest; this.artifact = artifact; } compareSignature(signature) { return core_1.crypto.bufferEqual(signature, this.signature); } compareDigest(digest) { return core_1.crypto.bufferEqual(digest, this.messageDigest); } verifySignature(key) { return core_1.crypto.verify(this.artifact, key, this.signature); } } exports.MessageSignatureContent = MessageSignatureContent; verify/dist/bundle/index.js000064400000004101151701425750011734 0ustar00"use strict"; Object.defineProperty(exports, "__esModule", { value: true }); exports.signatureContent = exports.toSignedEntity = void 0; const core_1 = require("@sigstore/core"); const dsse_1 = require("./dsse"); const message_1 = require("./message"); function toSignedEntity(bundle, artifact) { const { tlogEntries, timestampVerificationData } = bundle.verificationMaterial; const timestamps = []; for (const entry of tlogEntries) { timestamps.push({ $case: 'transparency-log', tlogEntry: entry, }); } for (const ts of timestampVerificationData?.rfc3161Timestamps ?? []) { timestamps.push({ $case: 'timestamp-authority', timestamp: core_1.RFC3161Timestamp.parse(ts.signedTimestamp), }); } return { signature: signatureContent(bundle, artifact), key: key(bundle), tlogEntries, timestamps, }; } exports.toSignedEntity = toSignedEntity; function signatureContent(bundle, artifact) { switch (bundle.content.$case) { case 'dsseEnvelope': return new dsse_1.DSSESignatureContent(bundle.content.dsseEnvelope); case 'messageSignature': return new message_1.MessageSignatureContent(bundle.content.messageSignature, artifact); } } exports.signatureContent = signatureContent; function key(bundle) { switch (bundle.verificationMaterial.content.$case) { case 'publicKey': return { $case: 'public-key', hint: bundle.verificationMaterial.content.publicKey.hint, }; case 'x509CertificateChain': return { $case: 'certificate', certificate: core_1.X509Certificate.parse(bundle.verificationMaterial.content.x509CertificateChain .certificates[0].rawBytes), }; case 'certificate': return { $case: 'certificate', certificate: core_1.X509Certificate.parse(bundle.verificationMaterial.content.certificate.rawBytes), }; } } verify/dist/bundle/dsse.js000064400000002747151701425750011601 0ustar00"use strict"; Object.defineProperty(exports, "__esModule", { value: true }); exports.DSSESignatureContent = void 0; /* Copyright 2023 The Sigstore Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. */ const core_1 = require("@sigstore/core"); class DSSESignatureContent { constructor(env) { this.env = env; } compareDigest(digest) { return core_1.crypto.bufferEqual(digest, core_1.crypto.hash(this.env.payload)); } compareSignature(signature) { return core_1.crypto.bufferEqual(signature, this.signature); } verifySignature(key) { return core_1.crypto.verify(this.preAuthEncoding, key, this.signature); } get signature() { return this.env.signatures.length > 0 ? this.env.signatures[0].sig : Buffer.from(''); } // DSSE Pre-Authentication Encoding get preAuthEncoding() { return core_1.dsse.preAuthEncoding(this.env.payloadType, this.env.payload); } } exports.DSSESignatureContent = DSSESignatureContent; verify/dist/tlog/index.js000064400000003635151701425750011443 0ustar00"use strict"; Object.defineProperty(exports, "__esModule", { value: true }); exports.verifyTLogBody = void 0; /* Copyright 2023 The Sigstore Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. */ const error_1 = require("../error"); const dsse_1 = require("./dsse"); const hashedrekord_1 = require("./hashedrekord"); const intoto_1 = require("./intoto"); // Verifies that the given tlog entry matches the supplied signature content. function verifyTLogBody(entry, sigContent) { const { kind, version } = entry.kindVersion; const body = JSON.parse(entry.canonicalizedBody.toString('utf8')); if (kind !== body.kind || version !== body.apiVersion) { throw new error_1.VerificationError({ code: 'TLOG_BODY_ERROR', message: `kind/version mismatch - expected: ${kind}/${version}, received: ${body.kind}/${body.apiVersion}`, }); } switch (body.kind) { case 'dsse': return (0, dsse_1.verifyDSSETLogBody)(body, sigContent); case 'intoto': return (0, intoto_1.verifyIntotoTLogBody)(body, sigContent); case 'hashedrekord': return (0, hashedrekord_1.verifyHashedRekordTLogBody)(body, sigContent); /* istanbul ignore next */ default: throw new error_1.VerificationError({ code: 'TLOG_BODY_ERROR', message: `unsupported kind: ${kind}`, }); } } exports.verifyTLogBody = verifyTLogBody; verify/dist/tlog/dsse.js000064400000004425151701425750011270 0ustar00"use strict"; Object.defineProperty(exports, "__esModule", { value: true }); exports.verifyDSSETLogBody = void 0; /* Copyright 2023 The Sigstore Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. */ const error_1 = require("../error"); // Compare the given intoto tlog entry to the given bundle function verifyDSSETLogBody(tlogEntry, content) { switch (tlogEntry.apiVersion) { case '0.0.1': return verifyDSSE001TLogBody(tlogEntry, content); default: throw new error_1.VerificationError({ code: 'TLOG_BODY_ERROR', message: `unsupported dsse version: ${tlogEntry.apiVersion}`, }); } } exports.verifyDSSETLogBody = verifyDSSETLogBody; // Compare the given dsse v0.0.1 tlog entry to the given DSSE envelope. function verifyDSSE001TLogBody(tlogEntry, content) { // Ensure the bundle's DSSE only contains a single signature if (tlogEntry.spec.signatures?.length !== 1) { throw new error_1.VerificationError({ code: 'TLOG_BODY_ERROR', message: 'signature count mismatch', }); } const tlogSig = tlogEntry.spec.signatures[0].signature; // Ensure that the signature in the bundle's DSSE matches tlog entry if (!content.compareSignature(Buffer.from(tlogSig, 'base64'))) throw new error_1.VerificationError({ code: 'TLOG_BODY_ERROR', message: 'tlog entry signature mismatch', }); // Ensure the digest of the bundle's DSSE payload matches the digest in the // tlog entry const tlogHash = tlogEntry.spec.payloadHash?.value || ''; if (!content.compareDigest(Buffer.from(tlogHash, 'hex'))) { throw new error_1.VerificationError({ code: 'TLOG_BODY_ERROR', message: 'DSSE payload hash mismatch', }); } } verify/dist/tlog/intoto.js000064400000004756151701425750011655 0ustar00"use strict"; Object.defineProperty(exports, "__esModule", { value: true }); exports.verifyIntotoTLogBody = void 0; /* Copyright 2023 The Sigstore Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. */ const error_1 = require("../error"); // Compare the given intoto tlog entry to the given bundle function verifyIntotoTLogBody(tlogEntry, content) { switch (tlogEntry.apiVersion) { case '0.0.2': return verifyIntoto002TLogBody(tlogEntry, content); default: throw new error_1.VerificationError({ code: 'TLOG_BODY_ERROR', message: `unsupported intoto version: ${tlogEntry.apiVersion}`, }); } } exports.verifyIntotoTLogBody = verifyIntotoTLogBody; // Compare the given intoto v0.0.2 tlog entry to the given DSSE envelope. function verifyIntoto002TLogBody(tlogEntry, content) { // Ensure the bundle's DSSE contains a single signature if (tlogEntry.spec.content.envelope.signatures?.length !== 1) { throw new error_1.VerificationError({ code: 'TLOG_BODY_ERROR', message: 'signature count mismatch', }); } // Signature is double-base64-encoded in the tlog entry const tlogSig = base64Decode(tlogEntry.spec.content.envelope.signatures[0].sig); // Ensure that the signature in the bundle's DSSE matches tlog entry if (!content.compareSignature(Buffer.from(tlogSig, 'base64'))) { throw new error_1.VerificationError({ code: 'TLOG_BODY_ERROR', message: 'tlog entry signature mismatch', }); } // Ensure the digest of the bundle's DSSE payload matches the digest in the // tlog entry const tlogHash = tlogEntry.spec.content.payloadHash?.value || ''; if (!content.compareDigest(Buffer.from(tlogHash, 'hex'))) { throw new error_1.VerificationError({ code: 'TLOG_BODY_ERROR', message: 'DSSE payload hash mismatch', }); } } function base64Decode(str) { return Buffer.from(str, 'base64').toString('utf-8'); } verify/dist/tlog/hashedrekord.js000064400000004056151701425750012775 0ustar00"use strict"; Object.defineProperty(exports, "__esModule", { value: true }); exports.verifyHashedRekordTLogBody = void 0; /* Copyright 2023 The Sigstore Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. */ const error_1 = require("../error"); // Compare the given hashedrekord tlog entry to the given bundle function verifyHashedRekordTLogBody(tlogEntry, content) { switch (tlogEntry.apiVersion) { case '0.0.1': return verifyHashedrekord001TLogBody(tlogEntry, content); default: throw new error_1.VerificationError({ code: 'TLOG_BODY_ERROR', message: `unsupported hashedrekord version: ${tlogEntry.apiVersion}`, }); } } exports.verifyHashedRekordTLogBody = verifyHashedRekordTLogBody; // Compare the given hashedrekord v0.0.1 tlog entry to the given message // signature function verifyHashedrekord001TLogBody(tlogEntry, content) { // Ensure that the bundles message signature matches the tlog entry const tlogSig = tlogEntry.spec.signature.content || ''; if (!content.compareSignature(Buffer.from(tlogSig, 'base64'))) { throw new error_1.VerificationError({ code: 'TLOG_BODY_ERROR', message: 'signature mismatch', }); } // Ensure that the bundle's message digest matches the tlog entry const tlogDigest = tlogEntry.spec.data.hash?.value || ''; if (!content.compareDigest(Buffer.from(tlogDigest, 'hex'))) { throw new error_1.VerificationError({ code: 'TLOG_BODY_ERROR', message: 'digest mismatch', }); } } verify/dist/verifier.js000064400000013150151701425750011173 0ustar00"use strict"; Object.defineProperty(exports, "__esModule", { value: true }); exports.Verifier = void 0; /* Copyright 2023 The Sigstore Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. */ const util_1 = require("util"); const error_1 = require("./error"); const key_1 = require("./key"); const policy_1 = require("./policy"); const timestamp_1 = require("./timestamp"); const tlog_1 = require("./tlog"); class Verifier { constructor(trustMaterial, options = {}) { this.trustMaterial = trustMaterial; this.options = { ctlogThreshold: options.ctlogThreshold ?? 1, tlogThreshold: options.tlogThreshold ?? 1, tsaThreshold: options.tsaThreshold ?? 0, }; } verify(entity, policy) { const timestamps = this.verifyTimestamps(entity); const signer = this.verifySigningKey(entity, timestamps); this.verifyTLogs(entity); this.verifySignature(entity, signer); if (policy) { this.verifyPolicy(policy, signer.identity || {}); } return signer; } // Checks that all of the timestamps in the entity are valid and returns them verifyTimestamps(entity) { let tlogCount = 0; let tsaCount = 0; const timestamps = entity.timestamps.map((timestamp) => { switch (timestamp.$case) { case 'timestamp-authority': tsaCount++; return (0, timestamp_1.verifyTSATimestamp)(timestamp.timestamp, entity.signature.signature, this.trustMaterial.timestampAuthorities); case 'transparency-log': tlogCount++; return (0, timestamp_1.verifyTLogTimestamp)(timestamp.tlogEntry, this.trustMaterial.tlogs); } }); // Check for duplicate timestamps if (containsDupes(timestamps)) { throw new error_1.VerificationError({ code: 'TIMESTAMP_ERROR', message: 'duplicate timestamp', }); } if (tlogCount < this.options.tlogThreshold) { throw new error_1.VerificationError({ code: 'TIMESTAMP_ERROR', message: `expected ${this.options.tlogThreshold} tlog timestamps, got ${tlogCount}`, }); } if (tsaCount < this.options.tsaThreshold) { throw new error_1.VerificationError({ code: 'TIMESTAMP_ERROR', message: `expected ${this.options.tsaThreshold} tsa timestamps, got ${tsaCount}`, }); } return timestamps.map((t) => t.timestamp); } // Checks that the signing key is valid for all of the the supplied timestamps // and returns the signer. verifySigningKey({ key }, timestamps) { switch (key.$case) { case 'public-key': { return (0, key_1.verifyPublicKey)(key.hint, timestamps, this.trustMaterial); } case 'certificate': { const result = (0, key_1.verifyCertificate)(key.certificate, timestamps, this.trustMaterial); /* istanbul ignore next - no fixture */ if (containsDupes(result.scts)) { throw new error_1.VerificationError({ code: 'CERTIFICATE_ERROR', message: 'duplicate SCT', }); } if (result.scts.length < this.options.ctlogThreshold) { throw new error_1.VerificationError({ code: 'CERTIFICATE_ERROR', message: `expected ${this.options.ctlogThreshold} SCTs, got ${result.scts.length}`, }); } return result.signer; } } } // Checks that the tlog entries are valid for the supplied content verifyTLogs({ signature: content, tlogEntries }) { tlogEntries.forEach((entry) => (0, tlog_1.verifyTLogBody)(entry, content)); } // Checks that the signature is valid for the supplied content verifySignature(entity, signer) { if (!entity.signature.verifySignature(signer.key)) { throw new error_1.VerificationError({ code: 'SIGNATURE_ERROR', message: 'signature verification failed', }); } } verifyPolicy(policy, identity) { // Check the subject alternative name of the signer matches the policy if (policy.subjectAlternativeName) { (0, policy_1.verifySubjectAlternativeName)(policy.subjectAlternativeName, identity.subjectAlternativeName); } // Check that the extensions of the signer match the policy if (policy.extensions) { (0, policy_1.verifyExtensions)(policy.extensions, identity.extensions); } } } exports.Verifier = Verifier; // Checks for duplicate items in the array. Objects are compared using // deep equality. function containsDupes(arr) { for (let i = 0; i < arr.length; i++) { for (let j = i + 1; j < arr.length; j++) { if ((0, util_1.isDeepStrictEqual)(arr[i], arr[j])) { return true; } } } return false; } verify/dist/policy.js000064400000002122151701425750010654 0ustar00"use strict"; Object.defineProperty(exports, "__esModule", { value: true }); exports.verifyExtensions = exports.verifySubjectAlternativeName = void 0; const error_1 = require("./error"); function verifySubjectAlternativeName(policyIdentity, signerIdentity) { if (signerIdentity === undefined || !signerIdentity.match(policyIdentity)) { throw new error_1.PolicyError({ code: 'UNTRUSTED_SIGNER_ERROR', message: `certificate identity error - expected ${policyIdentity}, got ${signerIdentity}`, }); } } exports.verifySubjectAlternativeName = verifySubjectAlternativeName; function verifyExtensions(policyExtensions, signerExtensions = {}) { let key; for (key in policyExtensions) { if (signerExtensions[key] !== policyExtensions[key]) { throw new error_1.PolicyError({ code: 'UNTRUSTED_SIGNER_ERROR', message: `invalid certificate extension - expected ${key}=${policyExtensions[key]}, got ${key}=${signerExtensions[key]}`, }); } } } exports.verifyExtensions = verifyExtensions; verify/dist/trust/filter.js000064400000002144151701425750012027 0ustar00"use strict"; Object.defineProperty(exports, "__esModule", { value: true }); exports.filterTLogAuthorities = exports.filterCertAuthorities = void 0; function filterCertAuthorities(certAuthorities, criteria) { return certAuthorities.filter((ca) => { return (ca.validFor.start <= criteria.start && ca.validFor.end >= criteria.end); }); } exports.filterCertAuthorities = filterCertAuthorities; // Filter the list of tlog instances to only those which match the given log // ID and have public keys which are valid for the given integrated time. function filterTLogAuthorities(tlogAuthorities, criteria) { return tlogAuthorities.filter((tlog) => { // If we're filtering by log ID and the log IDs don't match, we can't use // this tlog if (criteria.logID && !tlog.logID.equals(criteria.logID)) { return false; } // Check that the integrated time is within the validFor range return (tlog.validFor.start <= criteria.targetDate && criteria.targetDate <= tlog.validFor.end); }); } exports.filterTLogAuthorities = filterTLogAuthorities; verify/dist/trust/index.js000064400000007010151701425750011646 0ustar00"use strict"; Object.defineProperty(exports, "__esModule", { value: true }); exports.toTrustMaterial = exports.filterTLogAuthorities = exports.filterCertAuthorities = void 0; /* Copyright 2023 The Sigstore Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. */ const core_1 = require("@sigstore/core"); const protobuf_specs_1 = require("@sigstore/protobuf-specs"); const error_1 = require("../error"); const BEGINNING_OF_TIME = new Date(0); const END_OF_TIME = new Date(8640000000000000); var filter_1 = require("./filter"); Object.defineProperty(exports, "filterCertAuthorities", { enumerable: true, get: function () { return filter_1.filterCertAuthorities; } }); Object.defineProperty(exports, "filterTLogAuthorities", { enumerable: true, get: function () { return filter_1.filterTLogAuthorities; } }); function toTrustMaterial(root, keys) { const keyFinder = typeof keys === 'function' ? keys : keyLocator(keys); return { certificateAuthorities: root.certificateAuthorities.map(createCertAuthority), timestampAuthorities: root.timestampAuthorities.map(createCertAuthority), tlogs: root.tlogs.map(createTLogAuthority), ctlogs: root.ctlogs.map(createTLogAuthority), publicKey: keyFinder, }; } exports.toTrustMaterial = toTrustMaterial; function createTLogAuthority(tlogInstance) { const keyDetails = tlogInstance.publicKey.keyDetails; const keyType = keyDetails === protobuf_specs_1.PublicKeyDetails.PKCS1_RSA_PKCS1V5 || keyDetails === protobuf_specs_1.PublicKeyDetails.PKIX_RSA_PKCS1V5 || keyDetails === protobuf_specs_1.PublicKeyDetails.PKIX_RSA_PKCS1V15_2048_SHA256 || keyDetails === protobuf_specs_1.PublicKeyDetails.PKIX_RSA_PKCS1V15_3072_SHA256 || keyDetails === protobuf_specs_1.PublicKeyDetails.PKIX_RSA_PKCS1V15_4096_SHA256 ? 'pkcs1' : 'spki'; return { logID: tlogInstance.logId.keyId, publicKey: core_1.crypto.createPublicKey(tlogInstance.publicKey.rawBytes, keyType), validFor: { start: tlogInstance.publicKey.validFor?.start || BEGINNING_OF_TIME, end: tlogInstance.publicKey.validFor?.end || END_OF_TIME, }, }; } function createCertAuthority(ca) { return { certChain: ca.certChain.certificates.map((cert) => { return core_1.X509Certificate.parse(cert.rawBytes); }), validFor: { start: ca.validFor?.start || BEGINNING_OF_TIME, end: ca.validFor?.end || END_OF_TIME, }, }; } function keyLocator(keys) { return (hint) => { const key = (keys || {})[hint]; if (!key) { throw new error_1.VerificationError({ code: 'PUBLIC_KEY_ERROR', message: `key not found: ${hint}`, }); } return { publicKey: core_1.crypto.createPublicKey(key.rawBytes), validFor: (date) => { return ((key.validFor?.start || BEGINNING_OF_TIME) <= date && (key.validFor?.end || END_OF_TIME) >= date); }, }; }; } verify/dist/trust/trust.types.js000064400000000115151701425750013062 0ustar00"use strict"; Object.defineProperty(exports, "__esModule", { value: true }); verify/dist/error.js000064400000002065151701425750010514 0ustar00"use strict"; Object.defineProperty(exports, "__esModule", { value: true }); exports.PolicyError = exports.VerificationError = void 0; /* Copyright 2023 The Sigstore Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. */ class BaseError extends Error { constructor({ code, message, cause, }) { super(message); this.code = code; this.cause = cause; this.name = this.constructor.name; } } class VerificationError extends BaseError { } exports.VerificationError = VerificationError; class PolicyError extends BaseError { } exports.PolicyError = PolicyError;
/home/emeraadmin/www/node_modules/.bin/../object.defaults/../debug/../../src/../4d695/@sigstore.tar