Skip to content

Commit 01986d1

Browse files
wraithgarwraithgar
authoredMar 30, 2023
deps: sigstore@1.2.0 (#6307)
·
v11.2.0arborist-v6.2.6
1 parent 829503b commit 01986d1

File tree

13 files changed

+70
-84
lines changed

13 files changed

+70
-84
lines changed
 

‎node_modules/sigstore/dist/ca/format.js

+12-6
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,20 @@
11
"use strict";
22
Object.defineProperty(exports, "__esModule", { value: true });
33
exports.toCertificateRequest = void 0;
4-
function toCertificateRequest(publicKey, challenge) {
4+
function toCertificateRequest(identityToken, publicKey, challenge) {
55
return {
6-
publicKey: {
7-
content: publicKey
8-
.export({ type: 'spki', format: 'der' })
9-
.toString('base64'),
6+
credentials: {
7+
oidcIdentityToken: identityToken,
8+
},
9+
publicKeyRequest: {
10+
publicKey: {
11+
algorithm: 'ECDSA',
12+
content: publicKey
13+
.export({ format: 'pem', type: 'spki' })
14+
.toString('ascii'),
15+
},
16+
proofOfPossession: challenge.toString('base64'),
1017
},
11-
signedEmailAddress: challenge.toString('base64'),
1218
};
1319
}
1420
exports.toCertificateRequest = toCertificateRequest;

‎node_modules/sigstore/dist/ca/index.js

+3-4
Original file line numberDiff line numberDiff line change
@@ -3,17 +3,16 @@ Object.defineProperty(exports, "__esModule", { value: true });
33
exports.CAClient = void 0;
44
const client_1 = require("../client");
55
const error_1 = require("../error");
6-
const util_1 = require("../util");
76
const format_1 = require("./format");
87
class CAClient {
98
constructor(options) {
109
this.fulcio = new client_1.Fulcio({ baseURL: options.fulcioBaseURL });
1110
}
1211
async createSigningCertificate(identityToken, publicKey, challenge) {
13-
const request = (0, format_1.toCertificateRequest)(publicKey, challenge);
12+
const request = (0, format_1.toCertificateRequest)(identityToken, publicKey, challenge);
1413
try {
15-
const certificate = await this.fulcio.createSigningCertificate(identityToken, request);
16-
return util_1.pem.split(certificate);
14+
const certificate = await this.fulcio.createSigningCertificate(request);
15+
return certificate.signedCertificateEmbeddedSct.chain.certificates;
1716
}
1817
catch (err) {
1918
throw new error_1.InternalError('error creating signing certificate', err);

‎node_modules/sigstore/dist/cli/index.js

+1
Original file line numberDiff line numberDiff line change
@@ -65,6 +65,7 @@ function printUsage() {
6565
const signOptions = {
6666
oidcClientID: 'sigstore',
6767
oidcIssuer: 'https://oauth2.sigstore.dev/auth',
68+
oidcRedirectURL: process.env.OIDC_REDIRECT_URL,
6869
rekorURL: index_1.sigstore.DEFAULT_REKOR_URL,
6970
};
7071
async function sign(artifactPath) {

‎node_modules/sigstore/dist/client/fulcio.js

+3-5
Original file line numberDiff line numberDiff line change
@@ -31,22 +31,20 @@ class Fulcio {
3131
retry: { retries: 2 },
3232
timeout: 5000,
3333
headers: {
34-
Accept: 'application/pem-certificate-chain',
3534
'Content-Type': 'application/json',
3635
'User-Agent': util_1.ua.getUserAgent(),
3736
},
3837
});
3938
this.baseUrl = options.baseURL;
4039
}
41-
async createSigningCertificate(idToken, request) {
42-
const url = `${this.baseUrl}/api/v1/signingCert`;
40+
async createSigningCertificate(request) {
41+
const url = `${this.baseUrl}/api/v2/signingCert`;
4342
const response = await this.fetch(url, {
4443
method: 'POST',
45-
headers: { Authorization: `Bearer ${idToken}` },
4644
body: JSON.stringify(request),
4745
});
4846
(0, error_1.checkStatus)(response);
49-
const data = await response.text();
47+
const data = await response.json();
5048
return data;
5149
}
5250
}

‎node_modules/sigstore/dist/identity/index.js

+7-2
Original file line numberDiff line numberDiff line change
@@ -27,8 +27,13 @@ const oauth_1 = require("./oauth");
2727
* @param clientSecret Client secret for the issuer (optional)
2828
* @returns {Provider}
2929
*/
30-
function oauthProvider(issuer, clientID, clientSecret) {
31-
return new oauth_1.OAuthProvider(new issuer_1.Issuer(issuer), clientID, clientSecret);
30+
function oauthProvider(options) {
31+
return new oauth_1.OAuthProvider({
32+
issuer: new issuer_1.Issuer(options.issuer),
33+
clientID: options.clientID,
34+
clientSecret: options.clientSecret,
35+
redirectURL: options.redirectURL,
36+
});
3237
}
3338
/**
3439
* ciContextProvider returns a new Provider instance which attempts to retrieve

‎node_modules/sigstore/dist/identity/oauth.js

+18-9
Original file line numberDiff line numberDiff line change
@@ -26,10 +26,11 @@ const make_fetch_happen_1 = __importDefault(require("make-fetch-happen"));
2626
const url_1 = require("url");
2727
const util_1 = require("../util");
2828
class OAuthProvider {
29-
constructor(issuer, clientID, clientSecret) {
30-
this.clientID = clientID;
31-
this.clientSecret = clientSecret || '';
32-
this.issuer = issuer;
29+
constructor(options) {
30+
this.clientID = options.clientID;
31+
this.clientSecret = options.clientSecret || '';
32+
this.issuer = options.issuer;
33+
this.redirectURI = options.redirectURL;
3334
this.codeVerifier = generateRandomString(32);
3435
this.state = generateRandomString(16);
3536
}
@@ -43,9 +44,20 @@ class OAuthProvider {
4344
async initiateAuthRequest() {
4445
const server = http_1.default.createServer();
4546
const sockets = new Set();
46-
// Start server and wait till it is listening
47+
// Start server and wait till it is listening. If a redirect URL was
48+
// provided, use that. Otherwise, use a random port and construct the
49+
// redirect URL.
4750
await new Promise((resolve) => {
48-
server.listen(0, resolve);
51+
if (this.redirectURI) {
52+
const url = new url_1.URL(this.redirectURI);
53+
server.listen(Number(url.port), url.hostname, resolve);
54+
}
55+
else {
56+
server.listen(0, resolve);
57+
// Get port the server is listening on and construct the server URL
58+
const port = server.address().port;
59+
this.redirectURI = `http://localhost:${port}`;
60+
}
4961
});
5062
// Keep track of connections to the server so we can force a shutdown
5163
server.on('connection', (socket) => {
@@ -54,9 +66,6 @@ class OAuthProvider {
5466
sockets.delete(socket);
5567
});
5668
});
57-
// Get port the server is listening on and construct the server URL
58-
const port = server.address().port;
59-
this.redirectURI = `http://localhost:${port}`;
6069
const result = new Promise((resolve, reject) => {
6170
// Set-up handler for post-auth redirect
6271
server.on('request', (req, res) => {

‎node_modules/sigstore/dist/sigstore.js

+6-1
Original file line numberDiff line numberDiff line change
@@ -115,7 +115,12 @@ function configureIdentityProviders(options) {
115115
else {
116116
idps.push(identity_1.default.ciContextProvider());
117117
if (options.oidcIssuer && options.oidcClientID) {
118-
idps.push(identity_1.default.oauthProvider(options.oidcIssuer, options.oidcClientID, options.oidcClientSecret));
118+
idps.push(identity_1.default.oauthProvider({
119+
issuer: options.oidcIssuer,
120+
clientID: options.oidcClientID,
121+
clientSecret: options.oidcClientSecret,
122+
redirectURL: options.oidcRedirectURL,
123+
}));
119124
}
120125
}
121126
return idps;

‎node_modules/sigstore/dist/util/pem.js

+1-22
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
"use strict";
22
Object.defineProperty(exports, "__esModule", { value: true });
3-
exports.fromDER = exports.toDER = exports.split = void 0;
3+
exports.fromDER = exports.toDER = void 0;
44
/*
55
Copyright 2022 The Sigstore Authors.
66
@@ -18,27 +18,6 @@ limitations under the License.
1818
*/
1919
const PEM_HEADER = /-----BEGIN (.*)-----/;
2020
const PEM_FOOTER = /-----END (.*)-----/;
21-
// Given a set of PEM-encoded certificates bundled in a single string, returns
22-
// an array of certificates. Standard PEM encoding dictates that each certificate
23-
// should have a trailing newline after the footer.
24-
function split(certificate) {
25-
const certs = [];
26-
let cert = [];
27-
certificate.split('\n').forEach((line) => {
28-
line.includes;
29-
if (line.match(PEM_HEADER)) {
30-
cert = [];
31-
}
32-
if (line.length > 0) {
33-
cert.push(line);
34-
}
35-
if (line.match(PEM_FOOTER)) {
36-
certs.push(cert.join('\n').concat('\n'));
37-
}
38-
});
39-
return certs;
40-
}
41-
exports.split = split;
4221
function toDER(certificate) {
4322
let der = '';
4423
certificate.split('\n').forEach((line) => {

‎node_modules/sigstore/dist/util/stream.js

+1-1
Original file line numberDiff line numberDiff line change
@@ -112,5 +112,5 @@ class ByteStream {
112112
this.view = newView;
113113
}
114114
}
115-
exports.ByteStream = ByteStream;
116115
ByteStream.BLOCK_SIZE = 1024;
116+
exports.ByteStream = ByteStream;

‎node_modules/sigstore/dist/x509/asn1/obj.js

+7-24
Original file line numberDiff line numberDiff line change
@@ -22,28 +22,15 @@ const length_1 = require("./length");
2222
const parse_1 = require("./parse");
2323
const tag_1 = require("./tag");
2424
class ASN1Obj {
25-
constructor(tag, headerLength, buf, subs) {
25+
constructor(tag, value, subs) {
2626
this.tag = tag;
27-
this.headerLength = headerLength;
28-
this.buf = buf;
27+
this.value = value;
2928
this.subs = subs;
3029
}
3130
// Constructs an ASN.1 object from a Buffer of DER-encoded bytes.
3231
static parseBuffer(buf) {
3332
return parseStream(new stream_1.ByteStream(buf));
3433
}
35-
// Returns the raw bytes of the ASN.1 object's value. For constructed objects,
36-
// this is the concatenation of the raw bytes of the values of its children.
37-
// For primitive objects, this is the raw bytes of the object's value.
38-
// Use the various to* methods to parse the value into a specific type.
39-
get value() {
40-
return this.buf.subarray(this.headerLength);
41-
}
42-
// Returns the raw bytes of the entire ASN.1 object (including tag, length,
43-
// and value)
44-
get raw() {
45-
return this.buf;
46-
}
4734
toDER() {
4835
const valueStream = new stream_1.ByteStream();
4936
if (this.subs.length > 0) {
@@ -114,13 +101,11 @@ exports.ASN1Obj = ASN1Obj;
114101
/////////////////////////////////////////////////////////////////////////////
115102
// Internal stream parsing functions
116103
function parseStream(stream) {
117-
// Capture current stream position so we know where this object starts
118-
const startPos = stream.position;
119-
// Parse tag and length from stream
104+
// Parse tag, length, and value from stream
120105
const tag = new tag_1.ASN1Tag(stream.getUint8());
121106
const len = (0, length_1.decodeLength)(stream);
122-
// Calculate length of header (tag + length)
123-
const header = stream.position - startPos;
107+
const value = stream.slice(stream.position, len);
108+
const start = stream.position;
124109
let subs = [];
125110
// If the object is constructed, parse its children. Sometimes, children
126111
// are embedded in OCTESTRING objects, so we need to check those
@@ -140,11 +125,9 @@ function parseStream(stream) {
140125
}
141126
// If there are no children, move stream cursor to the end of the object
142127
if (subs.length === 0) {
143-
stream.seek(startPos + header + len);
128+
stream.seek(start + len);
144129
}
145-
// Capture the raw bytes of the object (including tag, length, and value)
146-
const buf = stream.slice(startPos, header + len);
147-
return new ASN1Obj(tag, header, buf, subs);
130+
return new ASN1Obj(tag, value, subs);
148131
}
149132
function collectSubs(stream, len) {
150133
// Calculate end of object content

‎node_modules/sigstore/dist/x509/cert.js

+6-5
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,7 @@ class x509Certificate {
5959
return this.subjectObj.value;
6060
}
6161
get publicKey() {
62-
return this.subjectPublicKeyInfoObj.raw;
62+
return this.subjectPublicKeyInfoObj.toDER();
6363
}
6464
get signatureAlgorithm() {
6565
const oid = this.signatureAlgorithmObj.subs[0].toOID();
@@ -115,13 +115,13 @@ class x509Certificate {
115115
// Use the issuer's public key if provided, otherwise use the subject's
116116
const publicKey = issuerCertificate?.publicKey || this.publicKey;
117117
const key = util_1.crypto.createPublicKey(publicKey);
118-
return util_1.crypto.verifyBlob(this.tbsCertificate.raw, key, this.signatureValue, this.signatureAlgorithm);
118+
return util_1.crypto.verifyBlob(this.tbsCertificate.toDER(), key, this.signatureValue, this.signatureAlgorithm);
119119
}
120120
validForDate(date) {
121121
return this.notBefore <= date && date <= this.notAfter;
122122
}
123123
equals(other) {
124-
return this.root.raw.equals(other.root.raw);
124+
return this.root.toDER().equals(other.root.toDER());
125125
}
126126
verifySCTs(issuer, logs) {
127127
let extSCT;
@@ -167,8 +167,9 @@ class x509Certificate {
167167
}
168168
// Creates a copy of the certificate with a new buffer
169169
clone() {
170-
const clone = Buffer.alloc(this.root.raw.length);
171-
this.root.raw.copy(clone);
170+
const der = this.root.toDER();
171+
const clone = Buffer.alloc(der.length);
172+
der.copy(clone);
172173
return x509Certificate.parse(clone);
173174
}
174175
findExtension(oid) {

‎node_modules/sigstore/package.json

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name": "sigstore",
3-
"version": "1.1.1",
3+
"version": "1.2.0",
44
"description": "code-signing for npm packages",
55
"main": "dist/index.js",
66
"types": "dist/index.d.ts",
@@ -51,7 +51,7 @@
5151
"nock": "^13.2.4",
5252
"prettier": "^2.6.2",
5353
"ts-jest": "^29.0.5",
54-
"typescript": "^4.7.2"
54+
"typescript": "^5.0.2"
5555
},
5656
"dependencies": {
5757
"@sigstore/protobuf-specs": "^0.1.0",

‎package-lock.json

+3-3
Original file line numberDiff line numberDiff line change
@@ -11174,9 +11174,9 @@
1117411174
"inBundle": true
1117511175
},
1117611176
"node_modules/sigstore": {
11177-
"version": "1.1.1",
11178-
"resolved": "https://registry.npmjs.org/sigstore/-/sigstore-1.1.1.tgz",
11179-
"integrity": "sha512-4hR3tPP1y59YWlaoAgAWFVZ7srTjNWOrrpkQXWu05qP0BvwFYyt3K3l848+IHo+mKhkOzGcNDf7ktASXLEPC+A==",
11177+
"version": "1.2.0",
11178+
"resolved": "https://registry.npmjs.org/sigstore/-/sigstore-1.2.0.tgz",
11179+
"integrity": "sha512-Fr9+W1nkBSIZCkJQR7jDn/zI0UXNsVpp+7mDQkCnZOIxG9p6yNXBx9xntHsfUyYHE55XDkkVV3+rYbrkzAeesA==",
1118011180
"inBundle": true,
1118111181
"dependencies": {
1118211182
"@sigstore/protobuf-specs": "^0.1.0",

0 commit comments

Comments
 (0)
Please sign in to comment.