11"use strict" ;
22Object . defineProperty ( exports , "__esModule" , { value : true } ) ;
3- exports . assertBundleLatest = exports . isBundleV01 = exports . assertBundleV01 = exports . assertBundle = void 0 ;
3+ exports . assertBundleLatest = exports . assertBundleV02 = exports . isBundleV01 = exports . assertBundleV01 = exports . assertBundle = void 0 ;
44/*
55Copyright 2023 The Sigstore Authors.
66
@@ -16,13 +16,61 @@ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
1616See the License for the specific language governing permissions and
1717limitations under the License.
1818*/
19- const bundle_1 = require ( "./bundle" ) ;
2019const error_1 = require ( "./error" ) ;
2120// Performs basic validation of a Sigstore bundle to ensure that all required
2221// fields are populated. This is not a complete validation of the bundle, but
2322// rather a check that the bundle is in a valid state to be processed by the
2423// rest of the code.
2524function assertBundle ( b ) {
25+ const invalidValues = validateBundleBase ( b ) ;
26+ if ( invalidValues . length > 0 ) {
27+ throw new error_1 . ValidationError ( 'invalid bundle' , invalidValues ) ;
28+ }
29+ }
30+ exports . assertBundle = assertBundle ;
31+ // Asserts that the given bundle conforms to the v0.1 bundle format.
32+ function assertBundleV01 ( b ) {
33+ const invalidValues = [ ] ;
34+ invalidValues . push ( ...validateBundleBase ( b ) ) ;
35+ invalidValues . push ( ...validateInclusionPromise ( b ) ) ;
36+ if ( invalidValues . length > 0 ) {
37+ throw new error_1 . ValidationError ( 'invalid v0.1 bundle' , invalidValues ) ;
38+ }
39+ }
40+ exports . assertBundleV01 = assertBundleV01 ;
41+ // Type guard to determine if Bundle is a v0.1 bundle.
42+ function isBundleV01 ( b ) {
43+ try {
44+ assertBundleV01 ( b ) ;
45+ return true ;
46+ }
47+ catch ( e ) {
48+ return false ;
49+ }
50+ }
51+ exports . isBundleV01 = isBundleV01 ;
52+ // Asserts that the given bundle conforms to the v0.2 bundle format.
53+ function assertBundleV02 ( b ) {
54+ const invalidValues = [ ] ;
55+ invalidValues . push ( ...validateBundleBase ( b ) ) ;
56+ invalidValues . push ( ...validateInclusionProof ( b ) ) ;
57+ if ( invalidValues . length > 0 ) {
58+ throw new error_1 . ValidationError ( 'invalid v0.2 bundle' , invalidValues ) ;
59+ }
60+ }
61+ exports . assertBundleV02 = assertBundleV02 ;
62+ // Asserts that the given bundle conforms to the newest (0.3) bundle format.
63+ function assertBundleLatest ( b ) {
64+ const invalidValues = [ ] ;
65+ invalidValues . push ( ...validateBundleBase ( b ) ) ;
66+ invalidValues . push ( ...validateInclusionProof ( b ) ) ;
67+ invalidValues . push ( ...validateNoCertificateChain ( b ) ) ;
68+ if ( invalidValues . length > 0 ) {
69+ throw new error_1 . ValidationError ( 'invalid bundle' , invalidValues ) ;
70+ }
71+ }
72+ exports . assertBundleLatest = assertBundleLatest ;
73+ function validateBundleBase ( b ) {
2674 const invalidValues = [ ] ;
2775 // Media type validation
2876 if ( b . mediaType === undefined ||
@@ -84,6 +132,11 @@ function assertBundle(b) {
84132 }
85133 } ) ;
86134 break ;
135+ case 'certificate' :
136+ if ( b . verificationMaterial . content . certificate . rawBytes . length === 0 ) {
137+ invalidValues . push ( 'verificationMaterial.content.certificate.rawBytes' ) ;
138+ }
139+ break ;
87140 }
88141 }
89142 if ( b . verificationMaterial . tlogEntries === undefined ) {
@@ -102,17 +155,11 @@ function assertBundle(b) {
102155 }
103156 }
104157 }
105- if ( invalidValues . length > 0 ) {
106- throw new error_1 . ValidationError ( 'invalid bundle' , invalidValues ) ;
107- }
158+ return invalidValues ;
108159}
109- exports . assertBundle = assertBundle ;
110- // Asserts that the given bundle conforms to the v0.1 bundle format.
111- function assertBundleV01 ( b ) {
160+ // Necessary for V01 bundles
161+ function validateInclusionPromise ( b ) {
112162 const invalidValues = [ ] ;
113- if ( b . mediaType && b . mediaType !== bundle_1 . BUNDLE_V01_MEDIA_TYPE ) {
114- invalidValues . push ( 'mediaType' ) ;
115- }
116163 if ( b . verificationMaterial &&
117164 b . verificationMaterial . tlogEntries ?. length > 0 ) {
118165 b . verificationMaterial . tlogEntries . forEach ( ( entry , i ) => {
@@ -121,24 +168,10 @@ function assertBundleV01(b) {
121168 }
122169 } ) ;
123170 }
124- if ( invalidValues . length > 0 ) {
125- throw new error_1 . ValidationError ( 'invalid v0.1 bundle' , invalidValues ) ;
126- }
171+ return invalidValues ;
127172}
128- exports . assertBundleV01 = assertBundleV01 ;
129- // Type guard to determine if Bundle is a v0.1 bundle.
130- function isBundleV01 ( b ) {
131- try {
132- assertBundleV01 ( b ) ;
133- return true ;
134- }
135- catch ( e ) {
136- return false ;
137- }
138- }
139- exports . isBundleV01 = isBundleV01 ;
140- // Asserts that the given bundle conforms to the newest (0.2) bundle format.
141- function assertBundleLatest ( b ) {
173+ // Necessary for V02 and later bundles
174+ function validateInclusionProof ( b ) {
142175 const invalidValues = [ ] ;
143176 if ( b . verificationMaterial &&
144177 b . verificationMaterial . tlogEntries ?. length > 0 ) {
@@ -153,8 +186,13 @@ function assertBundleLatest(b) {
153186 }
154187 } ) ;
155188 }
156- if ( invalidValues . length > 0 ) {
157- throw new error_1 . ValidationError ( 'invalid v0.2 bundle' , invalidValues ) ;
189+ return invalidValues ;
190+ }
191+ // Necessary for V03 and later bundles
192+ function validateNoCertificateChain ( b ) {
193+ const invalidValues = [ ] ;
194+ if ( b . verificationMaterial ?. content ?. $case === 'x509CertificateChain' ) {
195+ invalidValues . push ( 'verificationMaterial.content.$case' ) ;
158196 }
197+ return invalidValues ;
159198}
160- exports . assertBundleLatest = assertBundleLatest ;
0 commit comments