@sigstore/bundle 3.1.0: assertBundle, assertBundleLatest, bundleFromJSON

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify pkg:npm/%40sigstore/bundle@3.1.0
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:npm/%40sigstore/bundle@3.1.0

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:3caae8b0be7695138727bd783e65c8b2104d90306ffaf203302771d73db7f948","contract":["toMessageSignatureBundle builds a v0.3 message signature bundle with publicKey verificationMaterial when no certificate is passed, and bundleToJSON/bundleFromJSON round-trips the signature bytes via base64.","toDSSEBundle with certificate and certificateChain: true builds a v0.2 DSSE envelope bundle whose x509CertificateChain passes assertBundle but throws ValidationError on assertBundleLatest."],"goal":"verify pkg:npm/%40sigstore/bundle@3.1.0","kind":"HOW","packages":["pkg:npm/%40sigstore/bundle@3.1.0"],"schemaVersion":1,"symbols":["assertBundle","assertBundleLatest","bundleFromJSON","bundleToJSON","toDSSEBundle","toMessageSignatureBundle"]},"contractCommand":["node","test/contract.mjs"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"npm","executionContext":"node","libc":"glibc","libcVersion":"2.39","moduleSystem":"esm","os":"linux","osVersionBucket":"24","packageManager":"npm","runtime":"node","schemaVersion":1},"license":"MIT-0","packages":["pkg:npm/%40sigstore/bundle@3.1.0"],"schemaVersion":1,"subject":"pkg:npm/%40sigstore/bundle@3.1.0","symbols":["assertBundle","assertBundleLatest","bundleFromJSON","bundleToJSON","toDSSEBundle","toMessageSignatureBundle"],"verifierAdapter":"node-typescript@1"}

import {
  BUNDLE_V02_MEDIA_TYPE,
  BUNDLE_V03_MEDIA_TYPE,
  ValidationError,
  assertBundle,
  assertBundleLatest,
  bundleFromJSON,
  bundleToJSON,
  isBundleWithCertificateChain,
  isBundleWithDsseEnvelope,
  isBundleWithMessageSignature,
  isBundleWithPublicKey,
  toDSSEBundle,
  toMessageSignatureBundle,
} from '@sigstore/bundle';

export function createAndRoundtripMessageBundle(digest, signature, keyHint) {
  const bundle = toMessageSignatureBundle({
    digest,
    signature,
    keyHint,
  });
  assertBundle(bundle);
  assertBundleLatest(bundle);
  const serialized = bundleToJSON(bundle);
  const restored = bundleFromJSON(serialized);
  return { bundle, serialized, restored };
}

export function createAndRoundtripDSSEBundle(artifact, artifactType, signature, certificate, certificateChain) {
  const bundle = toDSSEBundle({
    artifact,
    artifactType,
    signature,
    certificate,
    certificateChain,
  });
  assertBundle(bundle);
  const serialized = bundleToJSON(bundle);
  const restored = bundleFromJSON(serialized);
  return { bundle, serialized, restored };
}

export {
  BUNDLE_V02_MEDIA_TYPE,
  BUNDLE_V03_MEDIA_TYPE,
  ValidationError,
  assertBundle,
  assertBundleLatest,
  isBundleWithCertificateChain,
  isBundleWithDsseEnvelope,
  isBundleWithMessageSignature,
  isBundleWithPublicKey,
};

{
  "name": "sigstore-bundle-sample",
  "version": "1.0.0",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "sigstore-bundle-sample",
      "version": "1.0.0",
      "dependencies": {
        "@sigstore/bundle": "3.1.0"
      }
    },
    "node_modules/@sigstore/bundle": {
      "version": "3.1.0",
      "resolved": "https://registry.npmjs.org/@sigstore/bundle/-/bundle-3.1.0.tgz",
      "integrity": "sha512-Mm1E3/CmDDCz3nDhFKTuYdB47EdRFRQMOE/EAbiG1MJW77/w1b3P7Qx7JSrVJs8PfwOLOVcKQCHErIwCTyPbag==",
      "license": "Apache-2.0",
      "dependencies": {
        "@sigstore/protobuf-specs": "^0.4.0"
      },
      "engines": {
        "node": "^18.17.0 || >=20.5.0"
      }
    },
    "node_modules/@sigstore/protobuf-specs": {
      "version": "0.4.3",
      "resolved": "https://registry.npmjs.org/@sigstore/protobuf-specs/-/protobuf-specs-0.4.3.tgz",
      "integrity": "sha512-fk2zjD9117RL9BjqEwF7fwv7Q/P9yGsMV4MUJZ/DocaQJ6+3pKr+syBq1owU5Q5qGw5CUbXzm+4yJ2JVRDQeSA==",
      "license": "Apache-2.0",
      "engines": {
        "node": "^18.17.0 || >=20.5.0"
      }
    }
  }
}

{
  "name": "sigstore-bundle-sample",
  "version": "1.0.0",
  "private": true,
  "type": "module",
  "scripts": {
    "test": "node test/contract.mjs"
  },
  "dependencies": {
    "@sigstore/bundle": "3.1.0"
  }
}

{
  "schemaVersion": 1,
  "goal": "verify pkg:npm/%40sigstore/bundle@3.1.0",
  "kind": "HOW",
  "packages": [
    "pkg:npm/%40sigstore/bundle@3.1.0"
  ]
}

import assert from 'node:assert/strict';
import {
  BUNDLE_V02_MEDIA_TYPE,
  BUNDLE_V03_MEDIA_TYPE,
  ValidationError,
  assertBundle,
  assertBundleLatest,
  createAndRoundtripDSSEBundle,
  createAndRoundtripMessageBundle,
  isBundleWithCertificateChain,
  isBundleWithDsseEnvelope,
  isBundleWithMessageSignature,
  isBundleWithPublicKey,
} from '../index.mjs';

const digest = Buffer.alloc(32, 0x11);
const signature = Buffer.from('sample-signature-bytes', 'utf8');

const msgResult = createAndRoundtripMessageBundle(digest, signature, 'key-hint-1');

assert.equal(msgResult.bundle.mediaType, BUNDLE_V03_MEDIA_TYPE);
assert.equal(isBundleWithMessageSignature(msgResult.bundle), true);
assert.equal(isBundleWithDsseEnvelope(msgResult.bundle), false);
assert.equal(isBundleWithPublicKey(msgResult.bundle), true);
assert.equal(isBundleWithCertificateChain(msgResult.bundle), false);

assert.equal(
  msgResult.serialized.messageSignature.signature,
  signature.toString('base64')
);
assert.deepEqual(
  Buffer.from(msgResult.restored.content.messageSignature.signature),
  signature
);

const artifact = Buffer.from('{"subject":"artifact"}', 'utf8');
const certBytes = Buffer.from('der-cert-bytes', 'utf8');
const dsseResult = createAndRoundtripDSSEBundle(
  artifact,
  'application/vnd.in-toto+json',
  signature,
  certBytes,
  true
);

assert.equal(dsseResult.bundle.mediaType, BUNDLE_V02_MEDIA_TYPE);
assert.equal(isBundleWithDsseEnvelope(dsseResult.bundle), true);
assert.equal(isBundleWithMessageSignature(dsseResult.bundle), false);
assert.equal(isBundleWithCertificateChain(dsseResult.bundle), true);
assert.equal(isBundleWithPublicKey(dsseResult.bundle), false);
assert.deepEqual(
  Buffer.from(dsseResult.restored.content.dsseEnvelope.payload),
  artifact
);

assert.throws(
  () => assertBundleLatest(dsseResult.bundle),
  (err) => err instanceof ValidationError
);

assert.throws(
  () => assertBundle({ mediaType: 'invalid', content: undefined, verificationMaterial: undefined }),
  (err) => err instanceof ValidationError
);