codekingpro/portable-devtools

1"use strict";
2Object.defineProperty(exports, "__esModule", { value: true });
3exports.Verifier = void 0;
4/*
5Copyright 2023 The Sigstore Authors.
6
7Licensed under the Apache License, Version 2.0 (the "License");
8you may not use this file except in compliance with the License.
9You may obtain a copy of the License at
10
11    http://www.apache.org/licenses/LICENSE-2.0
12
13Unless required by applicable law or agreed to in writing, software
14distributed under the License is distributed on an "AS IS" BASIS,
15WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16See the License for the specific language governing permissions and
17limitations under the License.
18*/
19const util_1 = require("util");
20const error_1 = require("./error");
21const key_1 = require("./key");
22const policy_1 = require("./policy");
23const timestamp_1 = require("./timestamp");
24const tlog_1 = require("./tlog");
25class Verifier {
26    trustMaterial;
27    options;
28    constructor(trustMaterial, options = {}) {
29        this.trustMaterial = trustMaterial;
30        this.options = {
31            ctlogThreshold: options.ctlogThreshold ?? 1,
32            tlogThreshold: options.tlogThreshold ?? 1,
33            timestampThreshold: options.timestampThreshold ?? options.tsaThreshold ?? 1,
34            tsaThreshold: 0,
35        };
36    }
37    verify(entity, policy) {
38        const timestamps = this.verifyTimestamps(entity);
39        const signer = this.verifySigningKey(entity, timestamps);
40        this.verifyTLogs(entity);
41        this.verifySignature(entity, signer);
42        if (policy) {
43            this.verifyPolicy(policy, signer.identity || {});
44        }
45        return signer;
46    }
47    // Checks that all of the timestamps in the entity are valid and returns them
48    verifyTimestamps(entity) {
49        let timestampCount = 0;
50        const timestamps = entity.timestamps.map((timestamp) => {
51            switch (timestamp.$case) {
52                case 'timestamp-authority':
53                    timestampCount++;
54                    return (0, timestamp_1.getTSATimestamp)(timestamp.timestamp, entity.signature.signature, this.trustMaterial.timestampAuthorities);
55                case 'transparency-log':
56                    timestampCount++;
57                    return (0, timestamp_1.getTLogTimestamp)(timestamp.tlogEntry);
58            }
59        });
60        // Check for duplicate timestamps
61        if (containsDupes(timestamps)) {
62            throw new error_1.VerificationError({
63                code: 'TIMESTAMP_ERROR',
64                message: 'duplicate timestamp',
65            });
66        }
67        if (timestampCount < this.options.timestampThreshold) {
68            throw new error_1.VerificationError({
69                code: 'TIMESTAMP_ERROR',
70                message: `expected ${this.options.timestampThreshold} timestamps, got ${timestampCount}`,
71            });
72        }
73        return timestamps.map((t) => t.timestamp);
74    }
75    // Checks that the signing key is valid for all of the the supplied timestamps
76    // and returns the signer.
77    verifySigningKey({ key }, timestamps) {
78        switch (key.$case) {
79            case 'public-key': {
80                return (0, key_1.verifyPublicKey)(key.hint, timestamps, this.trustMaterial);
81            }
82            case 'certificate': {
83                const result = (0, key_1.verifyCertificate)(key.certificate, timestamps, this.trustMaterial);
84                /* istanbul ignore next - no fixture */
85                if (containsDupes(result.scts)) {
86                    throw new error_1.VerificationError({
87                        code: 'CERTIFICATE_ERROR',
88                        message: 'duplicate SCT',
89                    });
90                }
91                if (result.scts.length < this.options.ctlogThreshold) {
92                    throw new error_1.VerificationError({
93                        code: 'CERTIFICATE_ERROR',
94                        message: `expected ${this.options.ctlogThreshold} SCTs, got ${result.scts.length}`,
95                    });
96                }
97                return result.signer;
98            }
99        }
100    }
101    // Checks that the tlog entries are valid for the supplied content
102    verifyTLogs({ signature: content, tlogEntries }) {
103        let tlogCount = 0;
104        tlogEntries.forEach((entry) => {
105            tlogCount++;
106            (0, tlog_1.verifyTLogInclusion)(entry, this.trustMaterial.tlogs);
107            (0, tlog_1.verifyTLogBody)(entry, content);
108        });
109        if (tlogCount < this.options.tlogThreshold) {
110            throw new error_1.VerificationError({
111                code: 'TLOG_ERROR',
112                message: `expected ${this.options.tlogThreshold} tlog entries, got ${tlogCount}`,
113            });
114        }
115    }
116    // Checks that the signature is valid for the supplied content
117    verifySignature(entity, signer) {
118        if (!entity.signature.verifySignature(signer.key)) {
119            throw new error_1.VerificationError({
120                code: 'SIGNATURE_ERROR',
121                message: 'signature verification failed',
122            });
123        }
124    }
125    verifyPolicy(policy, identity) {
126        // Check the subject alternative name of the signer matches the policy
127        /* istanbul ignore else */
128        if (policy.subjectAlternativeName) {
129            (0, policy_1.verifySubjectAlternativeName)(policy.subjectAlternativeName, identity.subjectAlternativeName);
130        }
131        // Check that the extensions of the signer match the policy
132        /* istanbul ignore else */
133        if (policy.extensions) {
134            (0, policy_1.verifyExtensions)(policy.extensions, identity.extensions);
135        }
136    }
137}
138exports.Verifier = Verifier;
139// Checks for duplicate items in the array. Objects are compared using
140// deep equality.
141function containsDupes(arr) {
142    for (let i = 0; i < arr.length; i++) {
143        for (let j = i + 1; j < arr.length; j++) {
144            if ((0, util_1.isDeepStrictEqual)(arr[i], arr[j])) {
145                return true;
146            }
147        }
148    }
149    return false;
150}
151