Enforce observer timestamp in verifyDsse() (#26)

The observer-timestamp guard added in #25 lives only in verify(); callers
that verify via verifyDsse() had no such check. A bundle with no
integratedTime, no inclusion promise, and an empty timestampVerificationData
({}) therefore passed verifyDsse() with zero verified timestamps, leaving
the signing certificate's validity window unanchored in time.

Mirror the verify() guard in verifyDsse(): each tlog entry must be anchored
by either integratedTime (the cert must be valid then) or a signed RFC3161
timestamp. This brings verifyDsse() in line with the observer-timestamp
enforcement in the upstream sigstore-js and sigstore-go clients.

Bump to 0.1.14 (0.1.13 was published before #25).

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: lsd-cat

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@freedomofpress/sigstore-browser",
-  "version": "0.1.12",
+  "version": "0.1.14",
   "description": "A minimal browser-only Sigstore verification library.",
   "repository": {
     "type": "git",

src/sigstore.ts

@@ -896,6 +896,30 @@ public async verifyArtifact(
       }
     }
 
+    // Every tlog entry must be anchored in time by at least one observer
+    // timestamp, matching the observer-timestamp enforcement in the upstream
+    // sigstore-js and sigstore-go clients. A v1 entry carries integratedTime
+    // (the signing certificate must be valid at that instant); a v2 entry omits
+    // it and must instead carry a signed RFC3161 timestamp. Without either, the
+    // certificate's validity window is never anchored — a crafted bundle that
+    // strips integratedTime + the inclusion promise and supplies an empty
+    // timestampVerificationData ({}) would otherwise pass. This mirrors the
+    // guard in verify(), which callers verifying via verifyDsse() would miss.
+    for (const entry of bundle.verificationMaterial.tlogEntries) {
+      if (entry.integratedTime) {
+        const integratedDate = new Date(Number(entry.integratedTime) * 1000);
+        if (!signingCert.validForDate(integratedDate)) {
+          throw new Error(
+            "Artifact signing was logged outside of the certificate validity.",
+          );
+        }
+      } else {
+        assertRekorV2Timestamp(
+          bundle.verificationMaterial.timestampVerificationData,
+        );
+      }
+    }
+
     // (7) Verify the DSSE envelope signature
     const payloadBytes = base64ToUint8Array(bundle.dsseEnvelope.payload);
     const pae = preAuthEncoding(bundle.dsseEnvelope.payloadType, payloadBytes);