@sigstore/verify - npm Package Compare versions

Comparing version 2.1.0 to 2.1.1

dist/key/certificate.d.ts

 import { X509Certificate } from '@sigstore/core';
 import { CertAuthority } from '../trust';
-export declare function verifyCertificateChain(leaf: X509Certificate, certificateAuthorities: CertAuthority[]): X509Certificate[];
+export declare function verifyCertificateChain(timestamp: Date, leaf: X509Certificate, certificateAuthorities: CertAuthority[]): X509Certificate[];
 interface CertificateChainVerifierOptions {
     trustedCerts: X509Certificate[];
     untrustedCert: X509Certificate;
+    timestamp: Date;
 }
@@ -12,2 +13,3 @@ export declare class CertificateChainVerifier {
     private localCerts;
+    private timestamp;
     constructor(opts: CertificateChainVerifierOptions);
@@ -14,0 +16,0 @@ verify(): X509Certificate[];

dist/key/certificate.js

@@ -7,9 +7,6 @@ "use strict";
 const trust_1 = require("../trust");
-function verifyCertificateChain(leaf, certificateAuthorities) {
+function verifyCertificateChain(timestamp, leaf, certificateAuthorities) {
     // Filter list of trusted CAs to those which are valid for the given
-    // leaf certificate.
-    const cas = (0, trust_1.filterCertAuthorities)(certificateAuthorities, {
-        start: leaf.notBefore,
-        end: leaf.notAfter,
-    });
+    // timestamp
+    const cas = (0, trust_1.filterCertAuthorities)(certificateAuthorities, timestamp);
     /* eslint-disable-next-line @typescript-eslint/no-explicit-any */
@@ -22,2 +19,3 @@ let error;
                 untrustedCert: leaf,
+                timestamp,
             });
@@ -46,2 +44,3 @@ return verifier.verify();
         ]);
+        this.timestamp = opts.timestamp;
     }
@@ -53,2 +52,9 @@ verify() {
         this.checkPath(certificatePath);
+        const validForDate = certificatePath.every((cert) => cert.validForDate(this.timestamp));
+        if (!validForDate) {
+            throw new error_1.VerificationError({
+                code: 'CERTIFICATE_ERROR',
+                message: 'certificate is not valid or expired at the specified date',
+            });
+        }
         // Return verified certificate path
@@ -55,0 +61,0 @@ return certificatePath;

dist/key/index.js

@@ -40,11 +40,6 @@ "use strict";
     // Check that leaf certificate chains to a trusted CA
-    const path = (0, certificate_1.verifyCertificateChain)(leaf, trustMaterial.certificateAuthorities);
-    // Check that ALL certificates are valid for ALL of the timestamps
-    const validForDate = timestamps.every((timestamp) => path.every((cert) => cert.validForDate(timestamp)));
-    if (!validForDate) {
-        throw new error_1.VerificationError({
-            code: 'CERTIFICATE_ERROR',
-            message: 'certificate is not valid or expired at the specified date',
-        });
-    }
+    let path = [];
+    timestamps.forEach((timestamp) => {
+        path = (0, certificate_1.verifyCertificateChain)(timestamp, leaf, trustMaterial.certificateAuthorities);
+    });
     return {
@@ -51,0 +46,0 @@ scts: (0, sct_1.verifySCTs)(path[0], path[1], trustMaterial.ctlogs),

dist/timestamp/tsa.js

@@ -11,6 +11,3 @@ "use strict";
     // Filter for CAs which were valid at the time of signing
-    timestampAuthorities = (0, trust_1.filterCertAuthorities)(timestampAuthorities, {
-        start: signingTime,
-        end: signingTime,
-    });
+    timestampAuthorities = (0, trust_1.filterCertAuthorities)(timestampAuthorities, signingTime);
     // Filter for CAs which match serial and issuer embedded in the timestamp
@@ -48,2 +45,3 @@ timestampAuthorities = filterCAsBySerialAndIssuer(timestampAuthorities, {
             trustedCerts: cas,
+            timestamp: signingTime,
         }).verify();
@@ -57,10 +55,2 @@ }
     }
-    // Check that all of the CA certs were valid at the time of signing
-    const validAtSigningTime = ca.certChain.every((cert) => cert.validForDate(signingTime));
-    if (!validAtSigningTime) {
-        throw new error_1.VerificationError({
-            code: 'TIMESTAMP_ERROR',
-            message: 'timestamp was signed with an expired certificate',
-        });
-    }
     // Check that the signing certificate's key can be used to verify the
@@ -67,0 +57,0 @@ // timestamp signature.

dist/trust/filter.d.ts

 import type { CertAuthority, TLogAuthority } from './trust.types';
-type CertAuthorityFilterCriteria = {
-    start: Date;
-    end: Date;
-};
-export declare function filterCertAuthorities(certAuthorities: CertAuthority[], criteria: CertAuthorityFilterCriteria): CertAuthority[];
+export declare function filterCertAuthorities(certAuthorities: CertAuthority[], timestamp: Date): CertAuthority[];
 type TLogAuthorityFilterCriteria = {
@@ -8,0 +4,0 @@ targetDate: Date;

dist/trust/filter.js

@@ -5,5 +5,5 @@ "use strict";
 exports.filterTLogAuthorities = filterTLogAuthorities;
-function filterCertAuthorities(certAuthorities, criteria) {
+function filterCertAuthorities(certAuthorities, timestamp) {
     return certAuthorities.filter((ca) => {
-        return (ca.validFor.start <= criteria.start && ca.validFor.end >= criteria.end);
+        return ca.validFor.start <= timestamp && ca.validFor.end >= timestamp;
     });
@@ -10,0 +10,0 @@ }

package.json

 {
   "name": "@sigstore/verify",
-  "version": "2.1.0",
+  "version": "2.1.1",
   "description": "Verification of Sigstore signatures",
@@ -29,3 +29,3 @@ "main": "dist/index.js",
   "dependencies": {
-    "@sigstore/protobuf-specs": "^0.4.0",
+    "@sigstore/protobuf-specs": "^0.4.1",
     "@sigstore/bundle": "^3.1.0",
@@ -32,0 +32,0 @@ "@sigstore/core": "^2.0.0"

No alert changes

Worsened metrics

Total package byte prevSize

71913

-0.55%

Lines of code

1660

-0.66%

Dependency changes

• Updated

  @sigstore/protobuf-specs@^0.4.1