Fix issue where in rekorv2 timestamps would not be properly checked (#25)

Author: lsd-cat

src/index.browser.test.ts

@@ -1,5 +1,5 @@
 import { describe, it, expect } from "vitest";
-import { SigstoreVerifier } from "./sigstore.js";
+import { SigstoreVerifier, assertRekorV2Timestamp } from "./sigstore.js";
 import { X509Certificate } from "./x509/cert.js";
 
 describe("Sigstore Browser Integration Tests", () => {
@@ -254,3 +254,37 @@ ewS+2T7Qz4oXaQMidPOjr1Q8WKqaKO4yCtC8cz4qVWi3lNqAcAGtonQMXUiflEWV
     expect(parsed.verificationMaterial.tlogEntries[0].logIndex).toBe("123");
   });
 });
+
+describe("Rekor v2 observer-timestamp enforcement", () => {
+  // Regression test: a Rekor-v2-shaped bundle (no integratedTime in the tlog
+  // entry) must carry a signed RFC3161 timestamp. A previous guard only checked
+  // that `timestampVerificationData` was present, which an empty object ({})
+  // satisfies in JavaScript — letting a crafted bundle pass verification with
+  // zero verified timestamps and the signing certificate's validity window left
+  // completely unanchored in time.
+
+  it("rejects a missing timestampVerificationData", () => {
+    expect(() => assertRekorV2Timestamp(undefined)).toThrow(
+      "Rekor v2 bundles require a timestamp for verification.",
+    );
+  });
+
+  it("rejects an empty timestampVerificationData object ({})", () => {
+    // This is the exact bypass the fix closes: {} is truthy.
+    expect(() => assertRekorV2Timestamp({})).toThrow(
+      "Rekor v2 bundles require a timestamp for verification.",
+    );
+  });
+
+  it("rejects timestampVerificationData with an empty rfc3161Timestamps array", () => {
+    expect(() =>
+      assertRekorV2Timestamp({ rfc3161Timestamps: [] }),
+    ).toThrow("Rekor v2 bundles require a timestamp for verification.");
+  });
+
+  it("accepts timestampVerificationData with at least one RFC3161 timestamp", () => {
+    expect(() =>
+      assertRekorV2Timestamp({ rfc3161Timestamps: [{ signedTimestamp: "…" }] }),
+    ).not.toThrow();
+  });
+});

src/sigstore.ts

@@ -69,6 +69,20 @@ function getBundleVersion(mediaType: string): string {
   return "0.1";
 }
 
+/**
+ * Rekor v2 entries omit `integratedTime` and MUST carry a signed RFC3161
+ * timestamp instead. Check for actual content, not just presence: an empty
+ * `timestampVerificationData: {}` is truthy, so `if (!timestampVerificationData)`
+ * is bypassable and leaves the cert validity window unanchored in time.
+ */
+export function assertRekorV2Timestamp(
+  timestampData?: { rfc3161Timestamps?: readonly unknown[] },
+): void {
+  if (!timestampData?.rfc3161Timestamps?.length) {
+    throw new Error("Rekor v2 bundles require a timestamp for verification.");
+  }
+}
+
 export interface SigstoreVerifierOptions {
   tlogThreshold?: number;
   ctlogThreshold?: number;
@@ -496,12 +510,11 @@ export class SigstoreVerifier {
         );
       }
     } else {
-      // Rekor v2 bundles (no integratedTime) require a timestamp for verification
-      if (!bundle.verificationMaterial.timestampVerificationData) {
-        throw new Error(
-          "Rekor v2 bundles require a timestamp for verification.",
-        );
-      }
+      // Rekor v2 bundles (no integratedTime) require a signed RFC3161 timestamp.
+      // An empty timestampVerificationData object ({}) must NOT satisfy this.
+      assertRekorV2Timestamp(
+        bundle.verificationMaterial.timestampVerificationData,
+      );
     }
 
     // Verify that the certificate in the log matches the signing certificate