File Explorer

/proc/self/task/7/root/var/lang/lib/node_modules/npm/node_modules/@sigstore/verify/dist

This explorer reads the filesystem of the server it runs on, so /workspace/user isn't present here. Browsing and the terminal still work against this server's own disk from /.

policy.js2.1 KB · 51 lines
"use strict";Object.defineProperty(exports, "__esModule", { value: true });exports.verifySubjectAlternativeName = verifySubjectAlternativeName;exports.verifyExtensions = verifyExtensions;exports.verifyOIDs = verifyOIDs;const error_1 = require("./error");// Verifies that the signer's SAN matches the policy identity. The// policyIdentity is treated as a JavaScript regular expression pattern and// tested against the full signerIdentity string. For exact matching, use// anchored patterns (e.g. '^user@example\\.com$').function verifySubjectAlternativeName(policyIdentity, signerIdentity) {    if (signerIdentity === undefined || !signerIdentity.match(policyIdentity)) {        throw new error_1.PolicyError({            code: 'UNTRUSTED_SIGNER_ERROR',            message: `certificate identity error - expected ${policyIdentity}, got ${signerIdentity}`,        });    }}function verifyExtensions(policyExtensions, signerExtensions = {}) {    let key;    for (key in policyExtensions) {        if (signerExtensions[key] !== policyExtensions[key]) {            throw new error_1.PolicyError({                code: 'UNTRUSTED_SIGNER_ERROR',                message: `invalid certificate extension - expected ${key}=${policyExtensions[key]}, got ${key}=${signerExtensions[key]}`,            });        }    }}function verifyOIDs(policyOIDs, signerOIDs = []) {    for (const policyOID of policyOIDs) {        const match = signerOIDs.find((signerOID) => oidEquals(policyOID.oid?.id, signerOID.oid?.id) &&            policyOID.value.equals(signerOID.value));        if (!match) {            /* istanbul ignore next */            const oid = policyOID.oid?.id.join('.') ?? '<unknown>';            throw new error_1.PolicyError({                code: 'UNTRUSTED_SIGNER_ERROR',                message: `invalid certificate extension - missing OID ${oid}`,            });        }    }}function oidEquals(a, b) {    /* istanbul ignore if */    if (a === undefined || b === undefined) {        return false;    }    return a.length === b.length && a.every((v, i) => v === b[i]);}