Skip to content

Commit f53e6ff

Browse files
wraithgarwraithgar
committed
deps: sigstore@1.5.2
1 parent 94d6ee7 commit f53e6ff

22 files changed

+342
-258
lines changed

‎node_modules/sigstore/dist/ca/index.js

+16-3
Original file line numberDiff line numberDiff line change
@@ -6,13 +6,26 @@ const external_1 = require("../external");
66
const format_1 = require("./format");
77
class CAClient {
88
constructor(options) {
9-
this.fulcio = new external_1.Fulcio({ baseURL: options.fulcioBaseURL });
9+
this.fulcio = new external_1.Fulcio({
10+
baseURL: options.fulcioBaseURL,
11+
retry: options.retry,
12+
timeout: options.timeout,
13+
});
1014
}
1115
async createSigningCertificate(identityToken, publicKey, challenge) {
1216
const request = (0, format_1.toCertificateRequest)(identityToken, publicKey, challenge);
1317
try {
14-
const certificate = await this.fulcio.createSigningCertificate(request);
15-
return certificate.signedCertificateEmbeddedSct.chain.certificates;
18+
const resp = await this.fulcio.createSigningCertificate(request);
19+
// Account for the fact that the response may contain either a
20+
// signedCertificateEmbeddedSct or a signedCertificateDetachedSct.
21+
const cert = resp.signedCertificateEmbeddedSct
22+
? resp.signedCertificateEmbeddedSct
23+
: resp.signedCertificateDetachedSct;
24+
// Return the first certificate in the chain, which is the signing
25+
// certificate. Specifically not returning the rest of the chain to
26+
// mitigate the risk of errors when verifying the certificate chain.
27+
// eslint-disable-next-line @typescript-eslint/no-non-null-assertion
28+
return cert.chain.certificates.slice(0, 1);
1629
}
1730
catch (err) {
1831
throw new error_1.InternalError({

‎node_modules/sigstore/dist/ca/verify/chain.js

+5-6
Original file line numberDiff line numberDiff line change
@@ -19,12 +19,11 @@ limitations under the License.
1919
const error_1 = require("../../error");
2020
const cert_1 = require("../../x509/cert");
2121
const verify_1 = require("../../x509/verify");
22-
function verifyChain(bundleCerts, certificateAuthorities) {
23-
const certs = parseCerts(bundleCerts);
24-
const signingCert = certs[0];
22+
function verifyChain(certificate, certificateAuthorities) {
23+
const untrustedCert = cert_1.x509Certificate.parse(certificate.rawBytes);
2524
// Filter the list of certificate authorities to those which are valid for the
2625
// signing certificate's notBefore date.
27-
const validCAs = filterCertificateAuthorities(certificateAuthorities, signingCert.notBefore);
26+
const validCAs = filterCertificateAuthorities(certificateAuthorities, untrustedCert.notBefore);
2827
if (validCAs.length === 0) {
2928
throw new error_1.VerificationError('No valid certificate authorities');
3029
}
@@ -34,9 +33,9 @@ function verifyChain(bundleCerts, certificateAuthorities) {
3433
const trustedCerts = parseCerts(ca.certChain?.certificates || []);
3534
try {
3635
trustedChain = (0, verify_1.verifyCertificateChain)({
36+
untrustedCert,
3737
trustedCerts,
38-
certs,
39-
validAt: signingCert.notBefore,
38+
validAt: untrustedCert.notBefore,
4039
});
4140
return true;
4241
}

‎node_modules/sigstore/dist/ca/verify/index.js

+3-2
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,9 @@ const sct_1 = require("./sct");
66
const signer_1 = require("./signer");
77
function verifySigningCertificate(bundle, trustedRoot, options) {
88
// Check that a trusted certificate chain can be found for the signing
9-
// certificate in the bundle
10-
const trustedChain = (0, chain_1.verifyChain)(bundle.verificationMaterial.content.x509CertificateChain.certificates, trustedRoot.certificateAuthorities);
9+
// certificate in the bundle. Only the first certificate in the bundle's
10+
// chain is used -- everything else must come from the trusted root.
11+
const trustedChain = (0, chain_1.verifyChain)(bundle.verificationMaterial.content.x509CertificateChain.certificates[0], trustedRoot.certificateAuthorities);
1112
// Unless disabled, verify the SCTs in the signing certificate
1213
if (options.ctlogOptions.disable === false) {
1314
(0, sct_1.verifySCTs)(trustedChain, trustedRoot.ctlogs, options.ctlogOptions);

‎node_modules/sigstore/dist/config.js

+18-1
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
2626
return (mod && mod.__esModule) ? mod : { "default": mod };
2727
};
2828
Object.defineProperty(exports, "__esModule", { value: true });
29-
exports.identityProviders = exports.artifactVerificationOptions = exports.createTLogClient = exports.createCAClient = exports.DEFAULT_REKOR_URL = exports.DEFAULT_FULCIO_URL = void 0;
29+
exports.identityProviders = exports.artifactVerificationOptions = exports.createTSAClient = exports.createTLogClient = exports.createCAClient = exports.DEFAULT_TIMEOUT = exports.DEFAULT_RETRY = exports.DEFAULT_REKOR_URL = exports.DEFAULT_FULCIO_URL = void 0;
3030
/*
3131
Copyright 2023 The Sigstore Authors.
3232
@@ -45,21 +45,38 @@ limitations under the License.
4545
const ca_1 = require("./ca");
4646
const identity_1 = __importDefault(require("./identity"));
4747
const tlog_1 = require("./tlog");
48+
const tsa_1 = require("./tsa");
4849
const sigstore = __importStar(require("./types/sigstore"));
4950
exports.DEFAULT_FULCIO_URL = 'https://fulcio.sigstore.dev';
5051
exports.DEFAULT_REKOR_URL = 'https://rekor.sigstore.dev';
52+
exports.DEFAULT_RETRY = { retries: 2 };
53+
exports.DEFAULT_TIMEOUT = 5000;
5154
function createCAClient(options) {
5255
return new ca_1.CAClient({
5356
fulcioBaseURL: options.fulcioURL || exports.DEFAULT_FULCIO_URL,
57+
retry: options.retry ?? exports.DEFAULT_RETRY,
58+
timeout: options.timeout ?? exports.DEFAULT_TIMEOUT,
5459
});
5560
}
5661
exports.createCAClient = createCAClient;
5762
function createTLogClient(options) {
5863
return new tlog_1.TLogClient({
5964
rekorBaseURL: options.rekorURL || exports.DEFAULT_REKOR_URL,
65+
retry: options.retry ?? exports.DEFAULT_RETRY,
66+
timeout: options.timeout ?? exports.DEFAULT_TIMEOUT,
6067
});
6168
}
6269
exports.createTLogClient = createTLogClient;
70+
function createTSAClient(options) {
71+
return options.tsaServerURL
72+
? new tsa_1.TSAClient({
73+
tsaBaseURL: options.tsaServerURL,
74+
retry: options.retry ?? exports.DEFAULT_RETRY,
75+
timeout: options.timeout ?? exports.DEFAULT_TIMEOUT,
76+
})
77+
: undefined;
78+
}
79+
exports.createTSAClient = createTSAClient;
6380
// Assembles the AtifactVerificationOptions from the supplied VerifyOptions.
6481
function artifactVerificationOptions(options) {
6582
// The trusted signers are only used if the options contain a certificate

‎node_modules/sigstore/dist/external/fulcio.js

+2-2
Original file line numberDiff line numberDiff line change
@@ -28,8 +28,8 @@ const error_1 = require("./error");
2828
class Fulcio {
2929
constructor(options) {
3030
this.fetch = make_fetch_happen_1.default.defaults({
31-
retry: { retries: 2 },
32-
timeout: 5000,
31+
retry: options.retry,
32+
timeout: options.timeout,
3333
headers: {
3434
'Content-Type': 'application/json',
3535
'User-Agent': util_1.ua.getUserAgent(),

‎node_modules/sigstore/dist/external/index.js

+3-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
"use strict";
22
Object.defineProperty(exports, "__esModule", { value: true });
3-
exports.Rekor = exports.Fulcio = exports.HTTPError = void 0;
3+
exports.TimestampAuthority = exports.Rekor = exports.Fulcio = exports.HTTPError = void 0;
44
/*
55
Copyright 2022 The Sigstore Authors.
66
@@ -22,3 +22,5 @@ var fulcio_1 = require("./fulcio");
2222
Object.defineProperty(exports, "Fulcio", { enumerable: true, get: function () { return fulcio_1.Fulcio; } });
2323
var rekor_1 = require("./rekor");
2424
Object.defineProperty(exports, "Rekor", { enumerable: true, get: function () { return rekor_1.Rekor; } });
25+
var tsa_1 = require("./tsa");
26+
Object.defineProperty(exports, "TimestampAuthority", { enumerable: true, get: function () { return tsa_1.TimestampAuthority; } });

‎node_modules/sigstore/dist/external/rekor.js

+2-2
Original file line numberDiff line numberDiff line change
@@ -28,8 +28,8 @@ const error_1 = require("./error");
2828
class Rekor {
2929
constructor(options) {
3030
this.fetch = make_fetch_happen_1.default.defaults({
31-
retry: { retries: 2 },
32-
timeout: 5000,
31+
retry: options.retry,
32+
timeout: options.timeout,
3333
headers: {
3434
Accept: 'application/json',
3535
'User-Agent': util_1.ua.getUserAgent(),

‎node_modules/sigstore/dist/external/tsa.js

+47
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
"use strict";
2+
var __importDefault = (this && this.__importDefault) || function (mod) {
3+
return (mod && mod.__esModule) ? mod : { "default": mod };
4+
};
5+
Object.defineProperty(exports, "__esModule", { value: true });
6+
exports.TimestampAuthority = void 0;
7+
/*
8+
Copyright 2023 The Sigstore Authors.
9+
10+
Licensed under the Apache License, Version 2.0 (the "License");
11+
you may not use this file except in compliance with the License.
12+
You may obtain a copy of the License at
13+
14+
http://www.apache.org/licenses/LICENSE-2.0
15+
16+
Unless required by applicable law or agreed to in writing, software
17+
distributed under the License is distributed on an "AS IS" BASIS,
18+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
19+
See the License for the specific language governing permissions and
20+
limitations under the License.
21+
*/
22+
const make_fetch_happen_1 = __importDefault(require("make-fetch-happen"));
23+
const util_1 = require("../util");
24+
const error_1 = require("./error");
25+
class TimestampAuthority {
26+
constructor(options) {
27+
this.fetch = make_fetch_happen_1.default.defaults({
28+
retry: options.retry,
29+
timeout: options.timeout,
30+
headers: {
31+
'Content-Type': 'application/json',
32+
'User-Agent': util_1.ua.getUserAgent(),
33+
},
34+
});
35+
this.baseUrl = options.baseURL;
36+
}
37+
async createTimestamp(request) {
38+
const url = `${this.baseUrl}/api/v1/timestamp`;
39+
const response = await this.fetch(url, {
40+
method: 'POST',
41+
body: JSON.stringify(request),
42+
});
43+
(0, error_1.checkStatus)(response);
44+
return response.buffer();
45+
}
46+
}
47+
exports.TimestampAuthority = TimestampAuthority;

‎node_modules/sigstore/dist/sign.js

+50-3
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,58 @@
11
"use strict";
2+
var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
3+
if (k2 === undefined) k2 = k;
4+
var desc = Object.getOwnPropertyDescriptor(m, k);
5+
if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
6+
desc = { enumerable: true, get: function() { return m[k]; } };
7+
}
8+
Object.defineProperty(o, k2, desc);
9+
}) : (function(o, m, k, k2) {
10+
if (k2 === undefined) k2 = k;
11+
o[k2] = m[k];
12+
}));
13+
var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
14+
Object.defineProperty(o, "default", { enumerable: true, value: v });
15+
}) : function(o, v) {
16+
o["default"] = v;
17+
});
18+
var __importStar = (this && this.__importStar) || function (mod) {
19+
if (mod && mod.__esModule) return mod;
20+
var result = {};
21+
if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
22+
__setModuleDefault(result, mod);
23+
return result;
24+
};
225
Object.defineProperty(exports, "__esModule", { value: true });
326
exports.Signer = void 0;
27+
const sigstore = __importStar(require("./types/sigstore"));
428
const util_1 = require("./util");
529
class Signer {
630
constructor(options) {
731
this.identityProviders = [];
832
this.ca = options.ca;
933
this.tlog = options.tlog;
34+
this.tsa = options.tsa;
1035
this.identityProviders = options.identityProviders;
36+
this.tlogUpload = options.tlogUpload ?? true;
1137
this.signer = options.signer || this.signWithEphemeralKey.bind(this);
1238
}
1339
async signBlob(payload) {
1440
// Get signature and verification material for payload
1541
const sigMaterial = await this.signer(payload);
1642
// Calculate artifact digest
1743
const digest = util_1.crypto.hash(payload);
18-
// Create Rekor entry
19-
return this.tlog.createMessageSignatureEntry(digest, sigMaterial);
44+
// Create a Rekor entry (if tlogUpload is enabled)
45+
const entry = this.tlogUpload
46+
? await this.tlog.createMessageSignatureEntry(digest, sigMaterial)
47+
: undefined;
48+
return sigstore.toMessageSignatureBundle({
49+
digest,
50+
signature: sigMaterial,
51+
tlogEntry: entry,
52+
timestamp: this.tsa
53+
? await this.tsa.createTimestamp(sigMaterial.signature)
54+
: undefined,
55+
});
2056
}
2157
async signAttestation(payload, payloadType) {
2258
// Pre-authentication encoding to be signed
@@ -33,7 +69,18 @@ class Signer {
3369
},
3470
],
3571
};
36-
return this.tlog.createDSSEEntry(envelope, sigMaterial);
72+
// Create a Rekor entry (if tlogUpload is enabled)
73+
const entry = this.tlogUpload
74+
? await this.tlog.createDSSEEntry(envelope, sigMaterial)
75+
: undefined;
76+
return sigstore.toDSSEBundle({
77+
envelope,
78+
signature: sigMaterial,
79+
tlogEntry: entry,
80+
timestamp: this.tsa
81+
? await this.tsa.createTimestamp(sigMaterial.signature)
82+
: undefined,
83+
});
3784
}
3885
async signWithEphemeralKey(payload) {
3986
// Create emphemeral key pair

‎node_modules/sigstore/dist/sigstore-utils.js

+6-1
Original file line numberDiff line numberDiff line change
@@ -67,9 +67,14 @@ async function createRekorEntry(dsseEnvelope, publicKey, options = {}) {
6767
const envelope = sigstore.Envelope.fromJSON(dsseEnvelope);
6868
const tlog = (0, config_1.createTLogClient)(options);
6969
const sigMaterial = (0, signature_1.extractSignatureMaterial)(envelope, publicKey);
70-
const bundle = await tlog.createDSSEEntry(envelope, sigMaterial, {
70+
const entry = await tlog.createDSSEEntry(envelope, sigMaterial, {
7171
fetchOnConflict: true,
7272
});
73+
const bundle = sigstore.toDSSEBundle({
74+
envelope,
75+
signature: sigMaterial,
76+
tlogEntry: entry,
77+
});
7378
return sigstore.Bundle.toJSON(bundle);
7479
}
7580
exports.createRekorEntry = createRekorEntry;

‎node_modules/sigstore/dist/sigstore.js

+17-2
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,7 @@ async function sign(payload, options = {}) {
5252
ca,
5353
tlog,
5454
identityProviders: idps,
55+
tlogUpload: options.tlogUpload,
5556
});
5657
const bundle = await signer.signBlob(payload);
5758
return sigstore.Bundle.toJSON(bundle);
@@ -60,11 +61,14 @@ exports.sign = sign;
6061
async function attest(payload, payloadType, options = {}) {
6162
const ca = config.createCAClient(options);
6263
const tlog = config.createTLogClient(options);
64+
const tsa = config.createTSAClient(options);
6365
const idps = config.identityProviders(options);
6466
const signer = new sign_1.Signer({
6567
ca,
6668
tlog,
69+
tsa,
6770
identityProviders: idps,
71+
tlogUpload: options.tlogUpload,
6872
});
6973
const bundle = await signer.signAttestation(payload, payloadType);
7074
return sigstore.Bundle.toJSON(bundle);
@@ -75,6 +79,8 @@ async function verify(bundle, payload, options = {}) {
7579
mirrorURL: options.tufMirrorURL,
7680
rootPath: options.tufRootPath,
7781
cachePath: options.tufCachePath,
82+
retry: options.retry ?? config.DEFAULT_RETRY,
83+
timeout: options.timeout ?? config.DEFAULT_TIMEOUT,
7884
});
7985
const verifier = new verify_1.Verifier(trustedRoot, options.keySelector);
8086
const deserializedBundle = sigstore.bundleFromJSON(bundle);
@@ -83,12 +89,21 @@ async function verify(bundle, payload, options = {}) {
8389
}
8490
exports.verify = verify;
8591
const tufUtils = {
86-
getTarget: (path, options = {}) => {
87-
return tuf.getTarget(path, {
92+
client: (options = {}) => {
93+
const t = new tuf.TUFClient({
8894
mirrorURL: options.tufMirrorURL,
8995
rootPath: options.tufRootPath,
9096
cachePath: options.tufCachePath,
97+
retry: options.retry ?? config.DEFAULT_RETRY,
98+
timeout: options.timeout ?? config.DEFAULT_TIMEOUT,
9199
});
100+
return t.refresh().then(() => t);
101+
},
102+
/*
103+
* @deprecated Use tufUtils.client instead.
104+
*/
105+
getTarget: (path, options = {}) => {
106+
return tufUtils.client(options).then((t) => t.getTarget(path));
92107
},
93108
};
94109
exports.tuf = tufUtils;

‎node_modules/sigstore/dist/tlog/index.js

+7-6
Original file line numberDiff line numberDiff line change
@@ -18,21 +18,22 @@ limitations under the License.
1818
*/
1919
const error_1 = require("../error");
2020
const external_1 = require("../external");
21-
const sigstore_1 = require("../types/sigstore");
2221
const format_1 = require("./format");
2322
class TLogClient {
2423
constructor(options) {
25-
this.rekor = new external_1.Rekor({ baseURL: options.rekorBaseURL });
24+
this.rekor = new external_1.Rekor({
25+
baseURL: options.rekorBaseURL,
26+
retry: options.retry,
27+
timeout: options.timeout,
28+
});
2629
}
2730
async createMessageSignatureEntry(digest, sigMaterial, options = {}) {
2831
const proposedEntry = (0, format_1.toProposedHashedRekordEntry)(digest, sigMaterial);
29-
const entry = await this.createEntry(proposedEntry, options.fetchOnConflict);
30-
return sigstore_1.bundle.toMessageSignatureBundle(digest, sigMaterial, entry);
32+
return this.createEntry(proposedEntry, options.fetchOnConflict);
3133
}
3234
async createDSSEEntry(envelope, sigMaterial, options = {}) {
3335
const proposedEntry = (0, format_1.toProposedIntotoEntry)(envelope, sigMaterial);
34-
const entry = await this.createEntry(proposedEntry, options.fetchOnConflict);
35-
return sigstore_1.bundle.toDSSEBundle(envelope, sigMaterial, entry);
36+
return this.createEntry(proposedEntry, options.fetchOnConflict);
3637
}
3738
async createEntry(proposedEntry, fetchOnConflict = false) {
3839
let entry;

0 commit comments

Comments
 (0)