avancement planning

node_modules/@sigstore/verify/dist/bundle/dsse.js

@@ -18,6 +18,7 @@ limitations under the License.
 */
 const core_1 = require("@sigstore/core");
 class DSSESignatureContent {
+    env;
     constructor(env) {
         this.env = env;
     }

node_modules/@sigstore/verify/dist/bundle/index.js

@@ -9,15 +9,17 @@ function toSignedEntity(bundle, artifact) {
     const { tlogEntries, timestampVerificationData } = bundle.verificationMaterial;
     const timestamps = [];
     for (const entry of tlogEntries) {
-        timestamps.push({
-            $case: 'transparency-log',
-            tlogEntry: entry,
-        });
+        if (entry.integratedTime && entry.integratedTime !== '0') {
+            timestamps.push({
+                $case: 'transparency-log',
+                tlogEntry: entry,
+            });
+        }
     }
     for (const ts of timestampVerificationData?.rfc3161Timestamps ?? []) {
         timestamps.push({
             $case: 'timestamp-authority',
-            timestamp: core_1.RFC3161Timestamp.parse(ts.signedTimestamp),
+            timestamp: core_1.RFC3161Timestamp.parse(Buffer.from(ts.signedTimestamp)),
         });
     }
     return {
@@ -45,13 +47,13 @@ function key(bundle) {
         case 'x509CertificateChain':
             return {
                 $case: 'certificate',
-                certificate: core_1.X509Certificate.parse(bundle.verificationMaterial.content.x509CertificateChain
-                    .certificates[0].rawBytes),
+                certificate: core_1.X509Certificate.parse(Buffer.from(bundle.verificationMaterial.content.x509CertificateChain
+                    .certificates[0].rawBytes)),
             };
         case 'certificate':
             return {
                 $case: 'certificate',
-                certificate: core_1.X509Certificate.parse(bundle.verificationMaterial.content.certificate.rawBytes),
+                certificate: core_1.X509Certificate.parse(Buffer.from(bundle.verificationMaterial.content.certificate.rawBytes)),
             };
     }
 }

node_modules/@sigstore/verify/dist/bundle/message.d.ts

@@ -5,6 +5,7 @@ export declare class MessageSignatureContent implements SignatureContent {
     readonly signature: Buffer;
     private readonly messageDigest;
     private readonly artifact;
+    private readonly hashAlgorithm;
     constructor(messageSignature: MessageSignature, artifact: Buffer);
     compareSignature(signature: Buffer): boolean;
     compareDigest(digest: Buffer): boolean;

node_modules/@sigstore/verify/dist/bundle/message.js

@@ -17,11 +17,29 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 const core_1 = require("@sigstore/core");
+const protobuf_specs_1 = require("@sigstore/protobuf-specs");
+// Map from the Sigstore protobuf HashAlgorithm enum to
+// the string values used by the Node.js crypto module.
+const HASH_ALGORITHM_MAP = {
+    [protobuf_specs_1.HashAlgorithm.HASH_ALGORITHM_UNSPECIFIED]: 'sha256',
+    [protobuf_specs_1.HashAlgorithm.SHA2_256]: 'sha256',
+    [protobuf_specs_1.HashAlgorithm.SHA2_384]: 'sha384',
+    [protobuf_specs_1.HashAlgorithm.SHA2_512]: 'sha512',
+    [protobuf_specs_1.HashAlgorithm.SHA3_256]: 'sha3-256',
+    [protobuf_specs_1.HashAlgorithm.SHA3_384]: 'sha3-384',
+};
 class MessageSignatureContent {
+    signature;
+    messageDigest;
+    artifact;
+    hashAlgorithm;
     constructor(messageSignature, artifact) {
         this.signature = messageSignature.signature;
         this.messageDigest = messageSignature.messageDigest.digest;
         this.artifact = artifact;
+        this.hashAlgorithm =
+            HASH_ALGORITHM_MAP[messageSignature.messageDigest.algorithm] ??
+                /* istanbul ignore next */ 'sha256';
     }
     compareSignature(signature) {
         return core_1.crypto.bufferEqual(signature, this.signature);
@@ -30,7 +48,7 @@ class MessageSignatureContent {
         return core_1.crypto.bufferEqual(digest, this.messageDigest);
     }
     verifySignature(key) {
-        return core_1.crypto.verify(this.artifact, key, this.signature);
+        return core_1.crypto.verify(this.artifact, key, this.signature, this.hashAlgorithm);
     }
 }
 exports.MessageSignatureContent = MessageSignatureContent;