Updated the project.

my-app/node_modules/@sigstore/protobuf-specs/dist/__generated__/sigstore_bundle.d.ts

@@ -1,5 +1,5 @@
 import { Envelope } from "./envelope";
-import { MessageSignature, PublicKeyIdentifier, RFC3161SignedTimestamp, X509CertificateChain } from "./sigstore_common";
+import { MessageSignature, PublicKeyIdentifier, RFC3161SignedTimestamp, X509Certificate, X509CertificateChain } from "./sigstore_common";
 import { TransparencyLogEntry } from "./sigstore_rekor";
 /**
  * Various timestamped counter signatures over the artifacts signature.
@@ -18,7 +18,14 @@ export interface TimestampVerificationData {
 }
 /**
  * VerificationMaterial captures details on the materials used to verify
- * signatures.
+ * signatures. This message may be embedded in a DSSE envelope as a signature
+ * extension. Specifically, the `ext` field of the extension will expect this
+ * message when the signature extension is for Sigstore. This is identified by
+ * the `kind` field in the extension, which must be set to
+ * application/vnd.dev.sigstore.verificationmaterial;version=0.1 for Sigstore.
+ * When used as a DSSE extension, if the `public_key` field is used to indicate
+ * the key identifier, it MUST match the `keyid` field of the signature the
+ * extension is attached to.
  */
 export interface VerificationMaterial {
     content?: {
@@ -27,6 +34,9 @@ export interface VerificationMaterial {
     } | {
         $case: "x509CertificateChain";
         x509CertificateChain: X509CertificateChain;
+    } | {
+        $case: "certificate";
+        certificate: X509Certificate;
     };
     /**
      * An inclusion proof and an optional signed timestamp from the log.
@@ -46,9 +56,13 @@ export interface VerificationMaterial {
 }
 export interface Bundle {
     /**
-     * MUST be application/vnd.dev.sigstore.bundle+json;version=0.1
-     * or application/vnd.dev.sigstore.bundle+json;version=0.2
+     * MUST be application/vnd.dev.sigstore.bundle.v0.3+json when
      * when encoded as JSON.
+     * Clients must to be able to accept media type using the previously
+     * defined formats:
+     * * application/vnd.dev.sigstore.bundle+json;version=0.1
+     * * application/vnd.dev.sigstore.bundle+json;version=0.2
+     * * application/vnd.dev.sigstore.bundle+json;version=0.3
      */
     mediaType: string;
     /**
@@ -57,6 +71,10 @@ export interface Bundle {
      * was valid as described in the Sigstore client spec: "Verification
      * using a Bundle".
      * <https://docs.google.com/document/d/1kbhK2qyPPk8SLavHzYSDM8-Ueul9_oxIMVFuWMWKz0E/edit#heading=h.x8bduppe89ln>
+     * If the verification material contains a public key identifier
+     * (key hint) and the `content` is a DSSE envelope, the key hints
+     * MUST be exactly the same in the verification material and in the
+     * DSSE envelope.
      */
     verificationMaterial: VerificationMaterial | undefined;
     content?: {

my-app/node_modules/@sigstore/protobuf-specs/dist/__generated__/sigstore_bundle.js

@@ -40,7 +40,9 @@ exports.VerificationMaterial = {
                         $case: "x509CertificateChain",
                         x509CertificateChain: sigstore_common_1.X509CertificateChain.fromJSON(object.x509CertificateChain),
                     }
-                    : undefined,
+                    : isSet(object.certificate)
+                        ? { $case: "certificate", certificate: sigstore_common_1.X509Certificate.fromJSON(object.certificate) }
+                        : undefined,
             tlogEntries: Array.isArray(object?.tlogEntries)
                 ? object.tlogEntries.map((e) => sigstore_rekor_1.TransparencyLogEntry.fromJSON(e))
                 : [],
@@ -57,6 +59,10 @@ exports.VerificationMaterial = {
             (obj.x509CertificateChain = message.content?.x509CertificateChain
                 ? sigstore_common_1.X509CertificateChain.toJSON(message.content?.x509CertificateChain)
                 : undefined);
+        message.content?.$case === "certificate" &&
+            (obj.certificate = message.content?.certificate
+                ? sigstore_common_1.X509Certificate.toJSON(message.content?.certificate)
+                : undefined);
         if (message.tlogEntries) {
             obj.tlogEntries = message.tlogEntries.map((e) => e ? sigstore_rekor_1.TransparencyLogEntry.toJSON(e) : undefined);
         }

my-app/node_modules/@sigstore/protobuf-specs/dist/__generated__/sigstore_common.d.ts

@@ -10,13 +10,27 @@
  */
 export declare enum HashAlgorithm {
     HASH_ALGORITHM_UNSPECIFIED = 0,
-    SHA2_256 = 1
+    SHA2_256 = 1,
+    SHA2_384 = 2,
+    SHA2_512 = 3,
+    SHA3_256 = 4,
+    SHA3_384 = 5
 }
 export declare function hashAlgorithmFromJSON(object: any): HashAlgorithm;
 export declare function hashAlgorithmToJSON(object: HashAlgorithm): string;
 /**
  * Details of a specific public key, capturing the the key encoding method,
  * and signature algorithm.
+ *
+ * PublicKeyDetails captures the public key/hash algorithm combinations
+ * recommended in the Sigstore ecosystem.
+ *
+ * This is modelled as a linear set as we want to provide a small number of
+ * opinionated options instead of allowing every possible permutation.
+ *
+ * Any changes to this enum MUST be reflected in the algorithm registry.
+ * See: docs/algorithm-registry.md
+ *
  * To avoid the possibility of contradicting formats such as PKCS1 with
  * ED25519 the valid permutations are listed as a linear set instead of a
  * cartesian set (i.e one combined variable instead of two, one for encoding
@@ -24,18 +38,60 @@ export declare function hashAlgorithmToJSON(object: HashAlgorithm): string;
  */
 export declare enum PublicKeyDetails {
     PUBLIC_KEY_DETAILS_UNSPECIFIED = 0,
-    /** PKCS1_RSA_PKCS1V5 - RSA */
+    /**
+     * PKCS1_RSA_PKCS1V5 - RSA
+     *
+     * @deprecated
+     */
     PKCS1_RSA_PKCS1V5 = 1,
-    /** PKCS1_RSA_PSS - See RFC8017 */
+    /**
+     * PKCS1_RSA_PSS - See RFC8017
+     *
+     * @deprecated
+     */
     PKCS1_RSA_PSS = 2,
+    /** @deprecated */
     PKIX_RSA_PKCS1V5 = 3,
+    /** @deprecated */
     PKIX_RSA_PSS = 4,
-    /** PKIX_ECDSA_P256_SHA_256 - ECDSA */
-    PKIX_ECDSA_P256_SHA_256 = 5,
-    /** PKIX_ECDSA_P256_HMAC_SHA_256 - See RFC6979 */
+    /** PKIX_RSA_PKCS1V15_2048_SHA256 - RSA public key in PKIX format, PKCS#1v1.5 signature */
+    PKIX_RSA_PKCS1V15_2048_SHA256 = 9,
+    PKIX_RSA_PKCS1V15_3072_SHA256 = 10,
+    PKIX_RSA_PKCS1V15_4096_SHA256 = 11,
+    /** PKIX_RSA_PSS_2048_SHA256 - RSA public key in PKIX format, RSASSA-PSS signature */
+    PKIX_RSA_PSS_2048_SHA256 = 16,
+    PKIX_RSA_PSS_3072_SHA256 = 17,
+    PKIX_RSA_PSS_4096_SHA256 = 18,
+    /**
+     * PKIX_ECDSA_P256_HMAC_SHA_256 - ECDSA
+     *
+     * @deprecated
+     */
     PKIX_ECDSA_P256_HMAC_SHA_256 = 6,
+    /** PKIX_ECDSA_P256_SHA_256 - See NIST FIPS 186-4 */
+    PKIX_ECDSA_P256_SHA_256 = 5,
+    PKIX_ECDSA_P384_SHA_384 = 12,
+    PKIX_ECDSA_P521_SHA_512 = 13,
     /** PKIX_ED25519 - Ed 25519 */
-    PKIX_ED25519 = 7
+    PKIX_ED25519 = 7,
+    PKIX_ED25519_PH = 8,
+    /**
+     * LMS_SHA256 - LMS and LM-OTS
+     *
+     * These keys and signatures may be used by private Sigstore
+     * deployments, but are not currently supported by the public
+     * good instance.
+     *
+     * USER WARNING: LMS and LM-OTS are both stateful signature schemes.
+     * Using them correctly requires discretion and careful consideration
+     * to ensure that individual secret keys are not used more than once.
+     * In addition, LM-OTS is a single-use scheme, meaning that it
+     * MUST NOT be used for more than one signature per LM-OTS key.
+     * If you cannot maintain these invariants, you MUST NOT use these
+     * schemes.
+     */
+    LMS_SHA256 = 14,
+    LMOTS_SHA256 = 15
 }
 export declare function publicKeyDetailsFromJSON(object: any): PublicKeyDetails;
 export declare function publicKeyDetailsToJSON(object: PublicKeyDetails): string;
@@ -86,12 +142,7 @@ export interface MessageSignature {
 }
 /** LogId captures the identity of a transparency log. */
 export interface LogId {
-    /**
-     * The unique id of the log, represented as the SHA-256 hash
-     * of the log's public key, calculated over the DER encoding
-     * of the key represented as SubjectPublicKeyInfo.
-     * See https://www.rfc-editor.org/rfc/rfc6962#section-3.2
-     */
+    /** The unique identity of the log, represented by its public key. */
     keyId: Buffer;
 }
 /** This message holds a RFC 3161 timestamp. */
@@ -158,26 +209,20 @@ export interface SubjectAlternativeName {
         value: string;
     };
 }
-/** A chain of X.509 certificates. */
+/**
+ * A collection of X.509 certificates.
+ *
+ * This "chain" can be used in multiple contexts, such as providing a root CA
+ * certificate within a TUF root of trust or multiple untrusted certificates for
+ * the purpose of chain building.
+ */
 export interface X509CertificateChain {
     /**
-     * The chain of certificates, with indices 0 to n.
-     * The first certificate in the array must be the leaf
-     * certificate used for signing.
+     * One or more DER-encoded certificates.
      *
-     * Signers MUST NOT include their root CA certificates in their embedded
-     * certificate chains, and SHOULD NOT include intermediate CA
-     * certificates that appear in independent roots of trust.
-     *
-     * Verifiers MUST validate the chain carefully to ensure that it chains
-     * up to a root CA certificate that they trust, regardless of whether
-     * the chain includes additional intermediate/root CA certificates.
-     * Verifiers MAY enforce additional constraints, such as requiring that
-     * all intermediate CA certificates appear in an independent root of
-     * trust.
-     *
-     * Verifiers SHOULD handle old or non-complying bundles that have
-     * additional intermediate/root CA certificates.
+     * In some contexts (such as `VerificationMaterial.x509_certificate_chain`), this sequence
+     * has an imposed order. Unless explicitly specified, there is otherwise no
+     * guaranteed order.
      */
     certificates: X509Certificate[];
 }

my-app/node_modules/@sigstore/protobuf-specs/dist/__generated__/sigstore_common.js

@@ -16,6 +16,10 @@ var HashAlgorithm;
 (function (HashAlgorithm) {
     HashAlgorithm[HashAlgorithm["HASH_ALGORITHM_UNSPECIFIED"] = 0] = "HASH_ALGORITHM_UNSPECIFIED";
     HashAlgorithm[HashAlgorithm["SHA2_256"] = 1] = "SHA2_256";
+    HashAlgorithm[HashAlgorithm["SHA2_384"] = 2] = "SHA2_384";
+    HashAlgorithm[HashAlgorithm["SHA2_512"] = 3] = "SHA2_512";
+    HashAlgorithm[HashAlgorithm["SHA3_256"] = 4] = "SHA3_256";
+    HashAlgorithm[HashAlgorithm["SHA3_384"] = 5] = "SHA3_384";
 })(HashAlgorithm = exports.HashAlgorithm || (exports.HashAlgorithm = {}));
 function hashAlgorithmFromJSON(object) {
     switch (object) {
@@ -25,6 +29,18 @@ function hashAlgorithmFromJSON(object) {
         case 1:
         case "SHA2_256":
             return HashAlgorithm.SHA2_256;
+        case 2:
+        case "SHA2_384":
+            return HashAlgorithm.SHA2_384;
+        case 3:
+        case "SHA2_512":
+            return HashAlgorithm.SHA2_512;
+        case 4:
+        case "SHA3_256":
+            return HashAlgorithm.SHA3_256;
+        case 5:
+        case "SHA3_384":
+            return HashAlgorithm.SHA3_384;
         default:
             throw new tsProtoGlobalThis.Error("Unrecognized enum value " + object + " for enum HashAlgorithm");
     }
@@ -36,6 +52,14 @@ function hashAlgorithmToJSON(object) {
             return "HASH_ALGORITHM_UNSPECIFIED";
         case HashAlgorithm.SHA2_256:
             return "SHA2_256";
+        case HashAlgorithm.SHA2_384:
+            return "SHA2_384";
+        case HashAlgorithm.SHA2_512:
+            return "SHA2_512";
+        case HashAlgorithm.SHA3_256:
+            return "SHA3_256";
+        case HashAlgorithm.SHA3_384:
+            return "SHA3_384";
         default:
             throw new tsProtoGlobalThis.Error("Unrecognized enum value " + object + " for enum HashAlgorithm");
     }
@@ -44,6 +68,16 @@ exports.hashAlgorithmToJSON = hashAlgorithmToJSON;
 /**
  * Details of a specific public key, capturing the the key encoding method,
  * and signature algorithm.
+ *
+ * PublicKeyDetails captures the public key/hash algorithm combinations
+ * recommended in the Sigstore ecosystem.
+ *
+ * This is modelled as a linear set as we want to provide a small number of
+ * opinionated options instead of allowing every possible permutation.
+ *
+ * Any changes to this enum MUST be reflected in the algorithm registry.
+ * See: docs/algorithm-registry.md
+ *
  * To avoid the possibility of contradicting formats such as PKCS1 with
  * ED25519 the valid permutations are listed as a linear set instead of a
  * cartesian set (i.e one combined variable instead of two, one for encoding
@@ -52,18 +86,60 @@ exports.hashAlgorithmToJSON = hashAlgorithmToJSON;
 var PublicKeyDetails;
 (function (PublicKeyDetails) {
     PublicKeyDetails[PublicKeyDetails["PUBLIC_KEY_DETAILS_UNSPECIFIED"] = 0] = "PUBLIC_KEY_DETAILS_UNSPECIFIED";
-    /** PKCS1_RSA_PKCS1V5 - RSA */
+    /**
+     * PKCS1_RSA_PKCS1V5 - RSA
+     *
+     * @deprecated
+     */
     PublicKeyDetails[PublicKeyDetails["PKCS1_RSA_PKCS1V5"] = 1] = "PKCS1_RSA_PKCS1V5";
-    /** PKCS1_RSA_PSS - See RFC8017 */
+    /**
+     * PKCS1_RSA_PSS - See RFC8017
+     *
+     * @deprecated
+     */
     PublicKeyDetails[PublicKeyDetails["PKCS1_RSA_PSS"] = 2] = "PKCS1_RSA_PSS";
+    /** @deprecated */
     PublicKeyDetails[PublicKeyDetails["PKIX_RSA_PKCS1V5"] = 3] = "PKIX_RSA_PKCS1V5";
+    /** @deprecated */
     PublicKeyDetails[PublicKeyDetails["PKIX_RSA_PSS"] = 4] = "PKIX_RSA_PSS";
-    /** PKIX_ECDSA_P256_SHA_256 - ECDSA */
-    PublicKeyDetails[PublicKeyDetails["PKIX_ECDSA_P256_SHA_256"] = 5] = "PKIX_ECDSA_P256_SHA_256";
-    /** PKIX_ECDSA_P256_HMAC_SHA_256 - See RFC6979 */
+    /** PKIX_RSA_PKCS1V15_2048_SHA256 - RSA public key in PKIX format, PKCS#1v1.5 signature */
+    PublicKeyDetails[PublicKeyDetails["PKIX_RSA_PKCS1V15_2048_SHA256"] = 9] = "PKIX_RSA_PKCS1V15_2048_SHA256";
+    PublicKeyDetails[PublicKeyDetails["PKIX_RSA_PKCS1V15_3072_SHA256"] = 10] = "PKIX_RSA_PKCS1V15_3072_SHA256";
+    PublicKeyDetails[PublicKeyDetails["PKIX_RSA_PKCS1V15_4096_SHA256"] = 11] = "PKIX_RSA_PKCS1V15_4096_SHA256";
+    /** PKIX_RSA_PSS_2048_SHA256 - RSA public key in PKIX format, RSASSA-PSS signature */
+    PublicKeyDetails[PublicKeyDetails["PKIX_RSA_PSS_2048_SHA256"] = 16] = "PKIX_RSA_PSS_2048_SHA256";
+    PublicKeyDetails[PublicKeyDetails["PKIX_RSA_PSS_3072_SHA256"] = 17] = "PKIX_RSA_PSS_3072_SHA256";
+    PublicKeyDetails[PublicKeyDetails["PKIX_RSA_PSS_4096_SHA256"] = 18] = "PKIX_RSA_PSS_4096_SHA256";
+    /**
+     * PKIX_ECDSA_P256_HMAC_SHA_256 - ECDSA
+     *
+     * @deprecated
+     */
     PublicKeyDetails[PublicKeyDetails["PKIX_ECDSA_P256_HMAC_SHA_256"] = 6] = "PKIX_ECDSA_P256_HMAC_SHA_256";
+    /** PKIX_ECDSA_P256_SHA_256 - See NIST FIPS 186-4 */
+    PublicKeyDetails[PublicKeyDetails["PKIX_ECDSA_P256_SHA_256"] = 5] = "PKIX_ECDSA_P256_SHA_256";
+    PublicKeyDetails[PublicKeyDetails["PKIX_ECDSA_P384_SHA_384"] = 12] = "PKIX_ECDSA_P384_SHA_384";
+    PublicKeyDetails[PublicKeyDetails["PKIX_ECDSA_P521_SHA_512"] = 13] = "PKIX_ECDSA_P521_SHA_512";
     /** PKIX_ED25519 - Ed 25519 */
     PublicKeyDetails[PublicKeyDetails["PKIX_ED25519"] = 7] = "PKIX_ED25519";
+    PublicKeyDetails[PublicKeyDetails["PKIX_ED25519_PH"] = 8] = "PKIX_ED25519_PH";
+    /**
+     * LMS_SHA256 - LMS and LM-OTS
+     *
+     * These keys and signatures may be used by private Sigstore
+     * deployments, but are not currently supported by the public
+     * good instance.
+     *
+     * USER WARNING: LMS and LM-OTS are both stateful signature schemes.
+     * Using them correctly requires discretion and careful consideration
+     * to ensure that individual secret keys are not used more than once.
+     * In addition, LM-OTS is a single-use scheme, meaning that it
+     * MUST NOT be used for more than one signature per LM-OTS key.
+     * If you cannot maintain these invariants, you MUST NOT use these
+     * schemes.
+     */
+    PublicKeyDetails[PublicKeyDetails["LMS_SHA256"] = 14] = "LMS_SHA256";
+    PublicKeyDetails[PublicKeyDetails["LMOTS_SHA256"] = 15] = "LMOTS_SHA256";
 })(PublicKeyDetails = exports.PublicKeyDetails || (exports.PublicKeyDetails = {}));
 function publicKeyDetailsFromJSON(object) {
     switch (object) {
@@ -82,15 +158,48 @@ function publicKeyDetailsFromJSON(object) {
         case 4:
         case "PKIX_RSA_PSS":
             return PublicKeyDetails.PKIX_RSA_PSS;
-        case 5:
-        case "PKIX_ECDSA_P256_SHA_256":
-            return PublicKeyDetails.PKIX_ECDSA_P256_SHA_256;
+        case 9:
+        case "PKIX_RSA_PKCS1V15_2048_SHA256":
+            return PublicKeyDetails.PKIX_RSA_PKCS1V15_2048_SHA256;
+        case 10:
+        case "PKIX_RSA_PKCS1V15_3072_SHA256":
+            return PublicKeyDetails.PKIX_RSA_PKCS1V15_3072_SHA256;
+        case 11:
+        case "PKIX_RSA_PKCS1V15_4096_SHA256":
+            return PublicKeyDetails.PKIX_RSA_PKCS1V15_4096_SHA256;
+        case 16:
+        case "PKIX_RSA_PSS_2048_SHA256":
+            return PublicKeyDetails.PKIX_RSA_PSS_2048_SHA256;
+        case 17:
+        case "PKIX_RSA_PSS_3072_SHA256":
+            return PublicKeyDetails.PKIX_RSA_PSS_3072_SHA256;
+        case 18:
+        case "PKIX_RSA_PSS_4096_SHA256":
+            return PublicKeyDetails.PKIX_RSA_PSS_4096_SHA256;
         case 6:
         case "PKIX_ECDSA_P256_HMAC_SHA_256":
             return PublicKeyDetails.PKIX_ECDSA_P256_HMAC_SHA_256;
+        case 5:
+        case "PKIX_ECDSA_P256_SHA_256":
+            return PublicKeyDetails.PKIX_ECDSA_P256_SHA_256;
+        case 12:
+        case "PKIX_ECDSA_P384_SHA_384":
+            return PublicKeyDetails.PKIX_ECDSA_P384_SHA_384;
+        case 13:
+        case "PKIX_ECDSA_P521_SHA_512":
+            return PublicKeyDetails.PKIX_ECDSA_P521_SHA_512;
         case 7:
         case "PKIX_ED25519":
             return PublicKeyDetails.PKIX_ED25519;
+        case 8:
+        case "PKIX_ED25519_PH":
+            return PublicKeyDetails.PKIX_ED25519_PH;
+        case 14:
+        case "LMS_SHA256":
+            return PublicKeyDetails.LMS_SHA256;
+        case 15:
+        case "LMOTS_SHA256":
+            return PublicKeyDetails.LMOTS_SHA256;
         default:
             throw new tsProtoGlobalThis.Error("Unrecognized enum value " + object + " for enum PublicKeyDetails");
     }
@@ -108,12 +217,34 @@ function publicKeyDetailsToJSON(object) {
             return "PKIX_RSA_PKCS1V5";
         case PublicKeyDetails.PKIX_RSA_PSS:
             return "PKIX_RSA_PSS";
-        case PublicKeyDetails.PKIX_ECDSA_P256_SHA_256:
-            return "PKIX_ECDSA_P256_SHA_256";
+        case PublicKeyDetails.PKIX_RSA_PKCS1V15_2048_SHA256:
+            return "PKIX_RSA_PKCS1V15_2048_SHA256";
+        case PublicKeyDetails.PKIX_RSA_PKCS1V15_3072_SHA256:
+            return "PKIX_RSA_PKCS1V15_3072_SHA256";
+        case PublicKeyDetails.PKIX_RSA_PKCS1V15_4096_SHA256:
+            return "PKIX_RSA_PKCS1V15_4096_SHA256";
+        case PublicKeyDetails.PKIX_RSA_PSS_2048_SHA256:
+            return "PKIX_RSA_PSS_2048_SHA256";
+        case PublicKeyDetails.PKIX_RSA_PSS_3072_SHA256:
+            return "PKIX_RSA_PSS_3072_SHA256";
+        case PublicKeyDetails.PKIX_RSA_PSS_4096_SHA256:
+            return "PKIX_RSA_PSS_4096_SHA256";
         case PublicKeyDetails.PKIX_ECDSA_P256_HMAC_SHA_256:
             return "PKIX_ECDSA_P256_HMAC_SHA_256";
+        case PublicKeyDetails.PKIX_ECDSA_P256_SHA_256:
+            return "PKIX_ECDSA_P256_SHA_256";
+        case PublicKeyDetails.PKIX_ECDSA_P384_SHA_384:
+            return "PKIX_ECDSA_P384_SHA_384";
+        case PublicKeyDetails.PKIX_ECDSA_P521_SHA_512:
+            return "PKIX_ECDSA_P521_SHA_512";
         case PublicKeyDetails.PKIX_ED25519:
             return "PKIX_ED25519";
+        case PublicKeyDetails.PKIX_ED25519_PH:
+            return "PKIX_ED25519_PH";
+        case PublicKeyDetails.LMS_SHA256:
+            return "LMS_SHA256";
+        case PublicKeyDetails.LMOTS_SHA256:
+            return "LMOTS_SHA256";
         default:
             throw new tsProtoGlobalThis.Error("Unrecognized enum value " + object + " for enum PublicKeyDetails");
     }

my-app/node_modules/@sigstore/protobuf-specs/dist/__generated__/sigstore_rekor.d.ts

@@ -11,14 +11,16 @@ export interface KindVersion {
     version: string;
 }
 /**
- * The checkpoint contains a signature of the tree head (root hash),
- * size of the tree, the transparency log's unique identifier (log ID),
- * hostname and the current time.
- * The result is a string, the format is described here
+ * The checkpoint MUST contain an origin string as a unique log identifier,
+ * the tree size, and the root hash. It MAY also be followed by optional data,
+ * and clients MUST NOT assume optional data. The checkpoint MUST also contain
+ * a signature over the root hash (tree head). The checkpoint MAY contain additional
+ * signatures, but the first SHOULD be the signature from the log. Checkpoint contents
+ * are concatenated with newlines into a single string.
+ * The checkpoint format is described in
  * https://github.com/transparency-dev/formats/blob/main/log/README.md
- * The details are here https://github.com/sigstore/rekor/blob/a6e58f72b6b18cc06cefe61808efd562b9726330/pkg/util/signed_note.go#L114
- * The signature has the same format as
- * InclusionPromise.signed_entry_timestamp. See below for more details.
+ * and https://github.com/C2SP/C2SP/blob/main/tlog-checkpoint.md.
+ * An example implementation can be found in https://github.com/sigstore/rekor/blob/main/pkg/util/signed_note.go
  */
 export interface Checkpoint {
     envelope: string;

my-app/node_modules/@sigstore/protobuf-specs/dist/__generated__/sigstore_trustroot.d.ts

@@ -17,8 +17,32 @@ export interface TransparencyLogInstance {
      * This attribute contains the signature algorithm used by the log.
      */
     publicKey: PublicKey | undefined;
-    /** The unique identifier for this transparency log. */
+    /**
+     * The unique identifier for this transparency log.
+     * Represented as the SHA-256 hash of the log's public key,
+     * calculated over the DER encoding of the key represented as
+     * SubjectPublicKeyInfo.
+     * See https://www.rfc-editor.org/rfc/rfc6962#section-3.2
+     */
     logId: LogId | undefined;
+    /**
+     * The checkpoint key identifier for the log used in a checkpoint.
+     * Optional, not provided for logs that do not generate checkpoints.
+     * For logs that do generate checkpoints, if not set, assume
+     * log_id equals checkpoint_key_id.
+     * Follows the specification described here
+     * for ECDSA and Ed25519 signatures:
+     * https://github.com/C2SP/C2SP/blob/main/signed-note.md#signatures
+     * For RSA signatures, the key ID will match the ECDSA format, the
+     * hashed DER-encoded SPKI public key. Publicly witnessed logs MUST NOT
+     * use RSA-signed checkpoints, since witnesses do not support
+     * RSA signatures.
+     * This is provided for convenience. Clients can also calculate the
+     * checkpoint key ID given the log's public key.
+     * SHOULD be set for logs generating Ed25519 signatures.
+     * SHOULD be 4 bytes long, as a truncated hash.
+     */
+    checkpointKeyId: LogId | undefined;
 }
 /**
  * CertificateAuthority enlists the information required to identify which
@@ -30,9 +54,20 @@ export interface CertificateAuthority {
      * issuer are the same.
      */
     subject: DistinguishedName | undefined;
-    /** The URI at which the CA can be accessed. */
+    /**
+     * The URI identifies the certificate authority.
+     *
+     * It is RECOMMENDED that the URI is the base URL for the certificate
+     * authority, that can be provided to any SDK/client provided
+     * by the certificate authority to interact with the certificate
+     * authority.
+     */
     uri: string;
-    /** The certificate chain for this CA. */
+    /**
+     * The certificate chain for this CA. The last certificate in the chain
+     * MUST be the trust anchor. The trust anchor MAY be a self-signed root
+     * CA certificate or MAY be an intermediate CA certificate.
+     */
     certChain: X509CertificateChain | undefined;
     /**
      * The time the *entire* chain was valid. This is at max the
@@ -61,13 +96,30 @@ export interface CertificateAuthority {
  * The embedded transparency logs, CT logs, CAs and TSAs MUST include any
  * previously used instance -- otherwise signatures made in the past cannot
  * be verified.
- * The currently used instances MUST NOT have their 'end' timestamp set in
- * their 'valid_for' attribute for easy identification.
+ *
  * All the listed instances SHOULD be sorted by the 'valid_for' in ascending
- * order, that is, the oldest instance first and the current instance last.
+ * order, that is, the oldest instance first. Only the last instance is
+ * allowed to have their 'end' timestamp unset. All previous instances MUST
+ * have a closed interval of validity. The last instance MAY have a closed
+ * interval. Clients MUST accept instances that overlaps in time, if not
+ * clients may experience problems during rotations of verification
+ * materials.
+ *
+ * To be able to manage planned rotations of either transparency logs or
+ * certificate authorities, clienst MUST accept lists of instances where
+ * the last instance have a 'valid_for' that belongs to the future.
+ * This should not be a problem as clients SHOULD first seek the trust root
+ * for a suitable instance before creating a per artifact trust root (that
+ * is, a sub-set of the complete trust root) that is used for verification.
  */
 export interface TrustedRoot {
-    /** MUST be application/vnd.dev.sigstore.trustedroot+json;version=0.1 */
+    /**
+     * MUST be application/vnd.dev.sigstore.trustedroot.v0.1+json
+     * when encoded as JSON.
+     * Clients MUST be able to process and parse content with the media
+     * type defined in the old format:
+     * application/vnd.dev.sigstore.trustedroot+json;version=0.1
+     */
     mediaType: string;
     /** A set of trusted Rekor servers. */
     tlogs: TransparencyLogInstance[];
@@ -87,6 +139,60 @@ export interface TrustedRoot {
     /** A set of trusted timestamping authorities. */
     timestampAuthorities: CertificateAuthority[];
 }
+/**
+ * SigningConfig represents the trusted entities/state needed by Sigstore
+ * signing. In particular, it primarily contains service URLs that a Sigstore
+ * signer may need to connect to for the online aspects of signing.
+ */
+export interface SigningConfig {
+    /**
+     * A URL to a Fulcio-compatible CA, capable of receiving
+     * Certificate Signing Requests (CSRs) and responding with
+     * issued certificates.
+     *
+     * This URL **MUST** be the "base" URL for the CA, which clients
+     * should construct an appropriate CSR endpoint on top of.
+     * For example, if `ca_url` is `https://example.com/ca`, then
+     * the client **MAY** construct the CSR endpoint as
+     * `https://example.com/ca/api/v2/signingCert`.
+     */
+    caUrl: string;
+    /**
+     * A URL to an OpenID Connect identity provider.
+     *
+     * This URL **MUST** be the "base" URL for the OIDC IdP, which clients
+     * should perform well-known OpenID Connect discovery against.
+     */
+    oidcUrl: string;
+    /**
+     * One or more URLs to Rekor-compatible transparency log.
+     *
+     * Each URL **MUST** be the "base" URL for the transparency log,
+     * which clients should construct appropriate API endpoints on top of.
+     */
+    tlogUrls: string[];
+    /**
+     * One ore more URLs to RFC 3161 Time Stamping Authority (TSA).
+     *
+     * Each URL **MUST** be the **full** URL for the TSA, meaning that it
+     * should be suitable for submitting Time Stamp Requests (TSRs) to
+     * via HTTP, per RFC 3161.
+     */
+    tsaUrls: string[];
+}
+/**
+ * ClientTrustConfig describes the complete state needed by a client
+ * to perform both signing and verification operations against a particular
+ * instance of Sigstore.
+ */
+export interface ClientTrustConfig {
+    /** MUST be application/vnd.dev.sigstore.clienttrustconfig.v0.1+json */
+    mediaType: string;
+    /** The root of trust, which MUST be present. */
+    trustedRoot: TrustedRoot | undefined;
+    /** Configuration for signing clients, which MUST be present. */
+    signingConfig: SigningConfig | undefined;
+}
 export declare const TransparencyLogInstance: {
     fromJSON(object: any): TransparencyLogInstance;
     toJSON(message: TransparencyLogInstance): unknown;
@@ -99,3 +205,11 @@ export declare const TrustedRoot: {
     fromJSON(object: any): TrustedRoot;
     toJSON(message: TrustedRoot): unknown;
 };
+export declare const SigningConfig: {
+    fromJSON(object: any): SigningConfig;
+    toJSON(message: SigningConfig): unknown;
+};
+export declare const ClientTrustConfig: {
+    fromJSON(object: any): ClientTrustConfig;
+    toJSON(message: ClientTrustConfig): unknown;
+};

my-app/node_modules/@sigstore/protobuf-specs/dist/__generated__/sigstore_trustroot.js

@@ -1,10 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.TrustedRoot = exports.CertificateAuthority = exports.TransparencyLogInstance = void 0;
+exports.ClientTrustConfig = exports.SigningConfig = exports.TrustedRoot = exports.CertificateAuthority = exports.TransparencyLogInstance = void 0;
 /* eslint-disable */
 const sigstore_common_1 = require("./sigstore_common");
 function createBaseTransparencyLogInstance() {
-    return { baseUrl: "", hashAlgorithm: 0, publicKey: undefined, logId: undefined };
+    return { baseUrl: "", hashAlgorithm: 0, publicKey: undefined, logId: undefined, checkpointKeyId: undefined };
 }
 exports.TransparencyLogInstance = {
     fromJSON(object) {
@@ -13,6 +13,7 @@ exports.TransparencyLogInstance = {
             hashAlgorithm: isSet(object.hashAlgorithm) ? (0, sigstore_common_1.hashAlgorithmFromJSON)(object.hashAlgorithm) : 0,
             publicKey: isSet(object.publicKey) ? sigstore_common_1.PublicKey.fromJSON(object.publicKey) : undefined,
             logId: isSet(object.logId) ? sigstore_common_1.LogId.fromJSON(object.logId) : undefined,
+            checkpointKeyId: isSet(object.checkpointKeyId) ? sigstore_common_1.LogId.fromJSON(object.checkpointKeyId) : undefined,
         };
     },
     toJSON(message) {
@@ -22,6 +23,8 @@ exports.TransparencyLogInstance = {
         message.publicKey !== undefined &&
             (obj.publicKey = message.publicKey ? sigstore_common_1.PublicKey.toJSON(message.publicKey) : undefined);
         message.logId !== undefined && (obj.logId = message.logId ? sigstore_common_1.LogId.toJSON(message.logId) : undefined);
+        message.checkpointKeyId !== undefined &&
+            (obj.checkpointKeyId = message.checkpointKeyId ? sigstore_common_1.LogId.toJSON(message.checkpointKeyId) : undefined);
         return obj;
     },
 };
@@ -98,6 +101,58 @@ exports.TrustedRoot = {
         return obj;
     },
 };
+function createBaseSigningConfig() {
+    return { caUrl: "", oidcUrl: "", tlogUrls: [], tsaUrls: [] };
+}
+exports.SigningConfig = {
+    fromJSON(object) {
+        return {
+            caUrl: isSet(object.caUrl) ? String(object.caUrl) : "",
+            oidcUrl: isSet(object.oidcUrl) ? String(object.oidcUrl) : "",
+            tlogUrls: Array.isArray(object?.tlogUrls) ? object.tlogUrls.map((e) => String(e)) : [],
+            tsaUrls: Array.isArray(object?.tsaUrls) ? object.tsaUrls.map((e) => String(e)) : [],
+        };
+    },
+    toJSON(message) {
+        const obj = {};
+        message.caUrl !== undefined && (obj.caUrl = message.caUrl);
+        message.oidcUrl !== undefined && (obj.oidcUrl = message.oidcUrl);
+        if (message.tlogUrls) {
+            obj.tlogUrls = message.tlogUrls.map((e) => e);
+        }
+        else {
+            obj.tlogUrls = [];
+        }
+        if (message.tsaUrls) {
+            obj.tsaUrls = message.tsaUrls.map((e) => e);
+        }
+        else {
+            obj.tsaUrls = [];
+        }
+        return obj;
+    },
+};
+function createBaseClientTrustConfig() {
+    return { mediaType: "", trustedRoot: undefined, signingConfig: undefined };
+}
+exports.ClientTrustConfig = {
+    fromJSON(object) {
+        return {
+            mediaType: isSet(object.mediaType) ? String(object.mediaType) : "",
+            trustedRoot: isSet(object.trustedRoot) ? exports.TrustedRoot.fromJSON(object.trustedRoot) : undefined,
+            signingConfig: isSet(object.signingConfig) ? exports.SigningConfig.fromJSON(object.signingConfig) : undefined,
+        };
+    },
+    toJSON(message) {
+        const obj = {};
+        message.mediaType !== undefined && (obj.mediaType = message.mediaType);
+        message.trustedRoot !== undefined &&
+            (obj.trustedRoot = message.trustedRoot ? exports.TrustedRoot.toJSON(message.trustedRoot) : undefined);
+        message.signingConfig !== undefined &&
+            (obj.signingConfig = message.signingConfig ? exports.SigningConfig.toJSON(message.signingConfig) : undefined);
+        return obj;
+    },
+};
 function isSet(value) {
     return value !== null && value !== undefined;
 }

my-app/node_modules/@sigstore/protobuf-specs/dist/__generated__/sigstore_verification.d.ts

@@ -44,17 +44,30 @@ export interface ArtifactVerificationOptions {
      * Optional options for certificate transparency log verification.
      * If none is provided, the default verification options are:
      * Threshold: 1
-     * Detached SCT: false
      * Disable: false
      */
     ctlogOptions?: ArtifactVerificationOptions_CtlogOptions | undefined;
     /**
      * Optional options for certificate signed timestamp verification.
      * If none is provided, the default verification options are:
-     * Threshold: 1
-     * Disable: false
+     * Threshold: 0
+     * Disable: true
      */
     tsaOptions?: ArtifactVerificationOptions_TimestampAuthorityOptions | undefined;
+    /**
+     * Optional options for integrated timestamp verification.
+     * If none is provided, the default verification options are:
+     * Threshold: 0
+     * Disable: true
+     */
+    integratedTsOptions?: ArtifactVerificationOptions_TlogIntegratedTimestampOptions | undefined;
+    /**
+     * Optional options for observed timestamp verification.
+     * If none is provided, the default verification options are:
+     * Threshold 1
+     * Disable: false
+     */
+    observerOptions?: ArtifactVerificationOptions_ObserverTimestampOptions | undefined;
 }
 export interface ArtifactVerificationOptions_TlogOptions {
     /** Number of transparency logs the entry must appear on. */
@@ -70,12 +83,6 @@ export interface ArtifactVerificationOptions_CtlogOptions {
      * appear on.
      */
     threshold: number;
-    /**
-     * Expect detached SCTs.
-     * This is not supported right now as we can't capture an
-     * detached SCT in the bundle.
-     */
-    detachedSct: boolean;
     /** Disable ct transparency log verification */
     disable: boolean;
 }
@@ -85,6 +92,24 @@ export interface ArtifactVerificationOptions_TimestampAuthorityOptions {
     /** Disable signed timestamp verification. */
     disable: boolean;
 }
+export interface ArtifactVerificationOptions_TlogIntegratedTimestampOptions {
+    /** The number of integrated timestamps that are expected. */
+    threshold: number;
+    /** Disable integrated timestamp verification. */
+    disable: boolean;
+}
+export interface ArtifactVerificationOptions_ObserverTimestampOptions {
+    /**
+     * The number of external observers of the timestamp.
+     * This is a union of RFC3161 signed timestamps, and
+     * integrated timestamps from a transparency log, that
+     * could include additional timestamp sources in the
+     * future.
+     */
+    threshold: number;
+    /** Disable observer timestamp verification. */
+    disable: boolean;
+}
 export interface Artifact {
     data?: {
         $case: "artifactUri";
@@ -146,6 +171,14 @@ export declare const ArtifactVerificationOptions_TimestampAuthorityOptions: {
     fromJSON(object: any): ArtifactVerificationOptions_TimestampAuthorityOptions;
     toJSON(message: ArtifactVerificationOptions_TimestampAuthorityOptions): unknown;
 };
+export declare const ArtifactVerificationOptions_TlogIntegratedTimestampOptions: {
+    fromJSON(object: any): ArtifactVerificationOptions_TlogIntegratedTimestampOptions;
+    toJSON(message: ArtifactVerificationOptions_TlogIntegratedTimestampOptions): unknown;
+};
+export declare const ArtifactVerificationOptions_ObserverTimestampOptions: {
+    fromJSON(object: any): ArtifactVerificationOptions_ObserverTimestampOptions;
+    toJSON(message: ArtifactVerificationOptions_ObserverTimestampOptions): unknown;
+};
 export declare const Artifact: {
     fromJSON(object: any): Artifact;
     toJSON(message: Artifact): unknown;

my-app/node_modules/@sigstore/protobuf-specs/dist/__generated__/sigstore_verification.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.Input = exports.Artifact = exports.ArtifactVerificationOptions_TimestampAuthorityOptions = exports.ArtifactVerificationOptions_CtlogOptions = exports.ArtifactVerificationOptions_TlogOptions = exports.ArtifactVerificationOptions = exports.PublicKeyIdentities = exports.CertificateIdentities = exports.CertificateIdentity = void 0;
+exports.Input = exports.Artifact = exports.ArtifactVerificationOptions_ObserverTimestampOptions = exports.ArtifactVerificationOptions_TlogIntegratedTimestampOptions = exports.ArtifactVerificationOptions_TimestampAuthorityOptions = exports.ArtifactVerificationOptions_CtlogOptions = exports.ArtifactVerificationOptions_TlogOptions = exports.ArtifactVerificationOptions = exports.PublicKeyIdentities = exports.CertificateIdentities = exports.CertificateIdentity = void 0;
 /* eslint-disable */
 const sigstore_bundle_1 = require("./sigstore_bundle");
 const sigstore_common_1 = require("./sigstore_common");
@@ -72,7 +72,14 @@ exports.PublicKeyIdentities = {
     },
 };
 function createBaseArtifactVerificationOptions() {
-    return { signers: undefined, tlogOptions: undefined, ctlogOptions: undefined, tsaOptions: undefined };
+    return {
+        signers: undefined,
+        tlogOptions: undefined,
+        ctlogOptions: undefined,
+        tsaOptions: undefined,
+        integratedTsOptions: undefined,
+        observerOptions: undefined,
+    };
 }
 exports.ArtifactVerificationOptions = {
     fromJSON(object) {
@@ -94,6 +101,12 @@ exports.ArtifactVerificationOptions = {
             tsaOptions: isSet(object.tsaOptions)
                 ? exports.ArtifactVerificationOptions_TimestampAuthorityOptions.fromJSON(object.tsaOptions)
                 : undefined,
+            integratedTsOptions: isSet(object.integratedTsOptions)
+                ? exports.ArtifactVerificationOptions_TlogIntegratedTimestampOptions.fromJSON(object.integratedTsOptions)
+                : undefined,
+            observerOptions: isSet(object.observerOptions)
+                ? exports.ArtifactVerificationOptions_ObserverTimestampOptions.fromJSON(object.observerOptions)
+                : undefined,
         };
     },
     toJSON(message) {
@@ -114,6 +127,12 @@ exports.ArtifactVerificationOptions = {
         message.tsaOptions !== undefined && (obj.tsaOptions = message.tsaOptions
             ? exports.ArtifactVerificationOptions_TimestampAuthorityOptions.toJSON(message.tsaOptions)
             : undefined);
+        message.integratedTsOptions !== undefined && (obj.integratedTsOptions = message.integratedTsOptions
+            ? exports.ArtifactVerificationOptions_TlogIntegratedTimestampOptions.toJSON(message.integratedTsOptions)
+            : undefined);
+        message.observerOptions !== undefined && (obj.observerOptions = message.observerOptions
+            ? exports.ArtifactVerificationOptions_ObserverTimestampOptions.toJSON(message.observerOptions)
+            : undefined);
         return obj;
     },
 };
@@ -140,20 +159,18 @@ exports.ArtifactVerificationOptions_TlogOptions = {
     },
 };
 function createBaseArtifactVerificationOptions_CtlogOptions() {
-    return { threshold: 0, detachedSct: false, disable: false };
+    return { threshold: 0, disable: false };
 }
 exports.ArtifactVerificationOptions_CtlogOptions = {
     fromJSON(object) {
         return {
             threshold: isSet(object.threshold) ? Number(object.threshold) : 0,
-            detachedSct: isSet(object.detachedSct) ? Boolean(object.detachedSct) : false,
             disable: isSet(object.disable) ? Boolean(object.disable) : false,
         };
     },
     toJSON(message) {
         const obj = {};
         message.threshold !== undefined && (obj.threshold = Math.round(message.threshold));
-        message.detachedSct !== undefined && (obj.detachedSct = message.detachedSct);
         message.disable !== undefined && (obj.disable = message.disable);
         return obj;
     },
@@ -175,6 +192,40 @@ exports.ArtifactVerificationOptions_TimestampAuthorityOptions = {
         return obj;
     },
 };
+function createBaseArtifactVerificationOptions_TlogIntegratedTimestampOptions() {
+    return { threshold: 0, disable: false };
+}
+exports.ArtifactVerificationOptions_TlogIntegratedTimestampOptions = {
+    fromJSON(object) {
+        return {
+            threshold: isSet(object.threshold) ? Number(object.threshold) : 0,
+            disable: isSet(object.disable) ? Boolean(object.disable) : false,
+        };
+    },
+    toJSON(message) {
+        const obj = {};
+        message.threshold !== undefined && (obj.threshold = Math.round(message.threshold));
+        message.disable !== undefined && (obj.disable = message.disable);
+        return obj;
+    },
+};
+function createBaseArtifactVerificationOptions_ObserverTimestampOptions() {
+    return { threshold: 0, disable: false };
+}
+exports.ArtifactVerificationOptions_ObserverTimestampOptions = {
+    fromJSON(object) {
+        return {
+            threshold: isSet(object.threshold) ? Number(object.threshold) : 0,
+            disable: isSet(object.disable) ? Boolean(object.disable) : false,
+        };
+    },
+    toJSON(message) {
+        const obj = {};
+        message.threshold !== undefined && (obj.threshold = Math.round(message.threshold));
+        message.disable !== undefined && (obj.disable = message.disable);
+        return obj;
+    },
+};
 function createBaseArtifact() {
     return { data: undefined };
 }

my-app/node_modules/@sigstore/protobuf-specs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sigstore/protobuf-specs",
-  "version": "0.2.1",
+  "version": "0.3.2",
   "description": "code-signing for npm packages",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -21,11 +21,11 @@
   },
   "homepage": "https://github.com/sigstore/protobuf-specs#readme",
   "devDependencies": {
-    "@tsconfig/node14": "^1.0.3",
+    "@tsconfig/node16": "^16.1.1",
     "@types/node": "^18.14.0",
     "typescript": "^4.9.5"
   },
   "engines": {
-    "node": "^14.17.0 || ^16.13.0 || >=18.0.0"
+    "node": "^16.14.0 || >=18.0.0"
   }
 }