Fix Bun compatability: base64 DER key parsing and default to sha256 for verify#1561
Fix Bun compatability: base64 DER key parsing and default to sha256 for verify#1561PowerSpy wants to merge 2 commits intosigstore:mainfrom
Conversation
…or verify
Added patches to ensure Bun/BoringSSL compatibility in sigstore-js:
1. Base64 DER public key parsing:
- Ensures createPublicKey handles base64 encoded DER keys correctly.
2. Default to SHA256 when verifying:
- verify() defaults to 'sha256' if no algorithm is provided.
Changes allow for better Bun compatibility for creating keys and verifying.
|
Two bugs found and fixed in verifyNpmProvenance: - InTotoStatement digest was typed as sha256-only; npm SLSA attestations actually use sha512 — updated hash check to handle both - sigstore.verify() always failed in Bun: @tufjs/models called crypto.verify(undefined, ...) which BoringSSL rejects with NO_DEFAULT_DIGEST. Patched via bun patch to derive the algorithm from the key's named curve (ECDSA P-256 → sha256, etc.) Upstream: sigstore/sigstore-js#1561 Adds trust.integration.test.ts (SKILLTAP_IT=1 for network tests): - Full end-to-end Sigstore+TUF provenance verification for sigstore@4.1.0 - Validates DSSE payload structure, sha512 tarball hash, Rekor log entry - Graceful-null for packages with no attestations - Tap install → curated trust tier (3 variants, always run)
|
@PowerSpy can you give me some more context for:
There are definitely places in the code where we depend on Sigstore is currently using an Ed25519 key for the transparency log. To verify these signatures with Node's |
|
@bdehamer Thanks for the information, I was not aware of that Ed25519 behavior with the |
2 participants
Added patches to ensure Bun/BoringSSL compatibility in sigstore-js:
Base64 DER public key parsing:
Default to SHA256 when verifying:
Changes allow for better Bun compatibility for creating keys and verifying.
Summary
This PR adds patches to ensure sigstore-js works correctly in Bun/BoringSSL environments.
Specifically:
Release Note
Fix: Improved Bun/BoringSSL compatibility.
Documentation
No documentation changes required; this improves Bun compatibility.