@sigstore/verify - npm Package Compare versions

Comparing version 4.0.0 to 4.1.0

dist/bundle/dsse.d.ts

@@ -8,2 +8,3 @@ import { crypto } from '@sigstore/core';
     compareDigest(digest: Buffer): boolean;
+    compareSignedDigest(digest: Buffer): boolean;
     compareSignature(signature: Buffer): boolean;
@@ -10,0 +11,0 @@ verifySignature(key: crypto.KeyObject): boolean;

dist/bundle/dsse.js

@@ -28,2 +28,8 @@ "use strict";
     }
+    // For a DSSE envelope the signature is computed over the pre-authentication
+    // encoding (PAE), so the digest of the signed bytes is the digest of the PAE.
+    // This is what a Rekor v2 hashedrekord entry records for a DSSE envelope.
+    compareSignedDigest(digest) {
+        return core_1.crypto.bufferEqual(digest, core_1.crypto.digest('sha256', this.preAuthEncoding));
+    }
     compareSignature(signature) {
@@ -30,0 +36,0 @@ return core_1.crypto.bufferEqual(signature, this.signature);

dist/bundle/message.d.ts

@@ -12,3 +12,4 @@ import { crypto } from '@sigstore/core';
     compareDigest(digest: Buffer): boolean;
+    compareSignedDigest(digest: Buffer): boolean;
     verifySignature(key: crypto.KeyObject): boolean;
 }

dist/bundle/message.js

@@ -50,2 +50,7 @@ "use strict";
     }
+    // For a message signature the signature is computed over the artifact, so the
+    // digest of the signed bytes is the artifact's message digest.
+    compareSignedDigest(digest) {
+        return this.compareDigest(digest);
+    }
     verifySignature(key) {
@@ -52,0 +57,0 @@ return core_1.crypto.verify(this.artifact, key, this.signature, this.hashAlgorithm);

dist/policy.js

@@ -35,3 +35,2 @@ "use strict";
         if (!match) {
-            /* istanbul ignore next */
             const oid = policyOID.oid?.id.join('.') ?? '<unknown>';
@@ -46,3 +45,2 @@ throw new error_1.PolicyError({
 function oidEquals(a, b) {
-    /* istanbul ignore if */
     if (a === undefined || b === undefined) {
@@ -49,0 +47,0 @@ return false;

dist/shared.types.d.ts

@@ -36,2 +36,3 @@ import type { TransparencyLogEntry } from '@sigstore/bundle';
     compareDigest(digest: Buffer): boolean;
+    compareSignedDigest(digest: Buffer): boolean;
     verifySignature(key: crypto.KeyObject): boolean;
@@ -38,0 +39,0 @@ };

dist/tlog/hashedrekord.js

@@ -66,5 +66,5 @@ "use strict";
     }
-    // Ensure that the bundle's message digest matches the tlog entry
+    // Ensure that the bundle's signed digest matches the tlog entry
     const tlogDigest = tlogEntry.spec.data.hash?.value || '';
-    if (!content.compareDigest(Buffer.from(tlogDigest, 'hex'))) {
+    if (!content.compareSignedDigest(Buffer.from(tlogDigest, 'hex'))) {
         throw new error_1.VerificationError({
@@ -87,5 +87,5 @@ code: 'TLOG_BODY_ERROR',
     }
-    // Ensure that the bundle's message digest matches the tlog entry
+    // Ensure that the bundle's signed digest matches the tlog entry
     const tlogHash = spec.data?.digest || Buffer.from('');
-    if (!content.compareDigest(tlogHash)) {
+    if (!content.compareSignedDigest(tlogHash)) {
         throw new error_1.VerificationError({
@@ -92,0 +92,0 @@ code: 'TLOG_BODY_ERROR',

dist/verifier.js

@@ -57,3 +57,2 @@ "use strict";
                     const result = (0, timestamp_1.getTLogTimestamp)(timestamp.tlogEntry);
-                    /* istanbul ignore else */
                     if (result) {
@@ -60,0 +59,0 @@ timestamps.push(result);

package.json

 {
   "name": "@sigstore/verify",
-  "version": "4.0.0",
+  "version": "4.1.0",
   "description": "Verification of Sigstore signatures",
@@ -30,3 +30,3 @@ "main": "dist/index.js",
     "@sigstore/bundle": "^5.0.0",
-    "@sigstore/core": "^4.0.0",
+    "@sigstore/core": "^4.0.1",
     "@sigstore/protobuf-specs": "^0.5.0"
@@ -33,0 +33,0 @@ },

No alert changes

Improved metrics

Total package byte prevSize

82029

0.82%

Lines of code

1905

0.58%

Dependency changes

• Updated

  @sigstore/core@^4.0.1