Updated the project.

my-app/node_modules/@sigstore/verify/dist/bundle/index.js

@@ -49,5 +49,10 @@ function key(bundle) {
                 certificate: core_1.X509Certificate.parse(bundle.verificationMaterial.content.x509CertificateChain
                     .certificates[0].rawBytes),
             };
+        case 'certificate':
+            return {
+                $case: 'certificate',
+                certificate: core_1.X509Certificate.parse(bundle.verificationMaterial.content.certificate.rawBytes),
+            };
     }
 }

my-app/node_modules/@sigstore/verify/dist/tlog/intoto.js

@@ -42,11 +42,12 @@ function verifyIntoto002TLogBody(tlogEntry, content) {
     // Signature is double-base64-encoded in the tlog entry
     const tlogSig = base64Decode(tlogEntry.spec.content.envelope.signatures[0].sig);
     // Ensure that the signature in the bundle's DSSE matches tlog entry
-    if (!content.compareSignature(Buffer.from(tlogSig, 'base64')))
+    if (!content.compareSignature(Buffer.from(tlogSig, 'base64'))) {
         throw new error_1.VerificationError({
             code: 'TLOG_BODY_ERROR',
             message: 'tlog entry signature mismatch',
         });
+    }
     // Ensure the digest of the bundle's DSSE payload matches the digest in the
     // tlog entry
     const tlogHash = tlogEntry.spec.content.payloadHash?.value || '';

my-app/node_modules/@sigstore/verify/dist/trust/index.d.ts

@@ -1,4 +1,4 @@
-import type { PublicKey, TrustedRoot } from '@sigstore/protobuf-specs';
+import { type PublicKey, type TrustedRoot } from '@sigstore/protobuf-specs';
 import type { KeyFinderFunc, TrustMaterial } from './trust.types';
 export { filterCertAuthorities, filterTLogAuthorities } from './filter';
 export type { CertAuthority, KeyFinderFunc, TLogAuthority, TrustMaterial, } from './trust.types';

my-app/node_modules/@sigstore/verify/dist/trust/index.js

@@ -17,6 +17,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 const core_1 = require("@sigstore/core");
+const protobuf_specs_1 = require("@sigstore/protobuf-specs");
 const error_1 = require("../error");
 const BEGINNING_OF_TIME = new Date(0);
 const END_OF_TIME = new Date(8640000000000000);
@@ -35,9 +36,17 @@ function toTrustMaterial(root, keys) {
 }
 exports.toTrustMaterial = toTrustMaterial;
 function createTLogAuthority(tlogInstance) {
+    const keyDetails = tlogInstance.publicKey.keyDetails;
+    const keyType = keyDetails === protobuf_specs_1.PublicKeyDetails.PKCS1_RSA_PKCS1V5 ||
+        keyDetails === protobuf_specs_1.PublicKeyDetails.PKIX_RSA_PKCS1V5 ||
+        keyDetails === protobuf_specs_1.PublicKeyDetails.PKIX_RSA_PKCS1V15_2048_SHA256 ||
+        keyDetails === protobuf_specs_1.PublicKeyDetails.PKIX_RSA_PKCS1V15_3072_SHA256 ||
+        keyDetails === protobuf_specs_1.PublicKeyDetails.PKIX_RSA_PKCS1V15_4096_SHA256
+        ? 'pkcs1'
+        : 'spki';
     return {
         logID: tlogInstance.logId.keyId,
-        publicKey: core_1.crypto.createPublicKey(tlogInstance.publicKey.rawBytes),
+        publicKey: core_1.crypto.createPublicKey(tlogInstance.publicKey.rawBytes, keyType),
         validFor: {
             start: tlogInstance.publicKey.validFor?.start || BEGINNING_OF_TIME,
             end: tlogInstance.publicKey.validFor?.end || END_OF_TIME,

my-app/node_modules/@sigstore/verify/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sigstore/verify",
-  "version": "1.0.0",
+  "version": "1.2.1",
   "description": "Verification of Sigstore signatures",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -26,9 +26,9 @@
     "provenance": true
   },
   "dependencies": {
-    "@sigstore/protobuf-specs": "^0.2.1",
-    "@sigstore/bundle": "^2.1.1",
-    "@sigstore/core": "^1.0.0"
+    "@sigstore/protobuf-specs": "^0.3.2",
+    "@sigstore/bundle": "^2.3.2",
+    "@sigstore/core": "^1.1.0"
   },
   "engines": {
     "node": "^16.14.0 || >=18.0.0"