@sigstore/bundle 3.1.0: BUNDLE_V02_MEDIA_TYPE

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify @sigstore/bundle.BUNDLE_V02_MEDIA_TYPE in pkg:npm/%40sigstore/bundle@3.1.0
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:npm/%40sigstore/bundle@3.1.0
Demonstrate these symbols/APIs:
  - @sigstore/bundle.BUNDLE_V02_MEDIA_TYPE

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:f7c6a3809dc921705e682d3e8aa394372d5183fce715f2303bc7e6415a36ec5d","contract":["BUNDLE_V02_MEDIA_TYPE equals 'application/vnd.dev.sigstore.bundle+json;version=0.2'","a v0.2 bundle with mediaType BUNDLE_V02_MEDIA_TYPE, x509CertificateChain, and inclusionProof.checkpoint passes assertBundleV02 and round-trips through bundleToJSON and bundleFromJSON","bundleFromJSON throws ValidationError when a bundle with mediaType BUNDLE_V02_MEDIA_TYPE is missing inclusionProof on a tlogEntry"],"goal":"verify @sigstore/bundle.BUNDLE_V02_MEDIA_TYPE in pkg:npm/%40sigstore/bundle@3.1.0","kind":"HOW","packages":["pkg:npm/%40sigstore/bundle@3.1.0"],"schemaVersion":1,"symbols":["@sigstore/bundle.BUNDLE_V02_MEDIA_TYPE"]},"contractCommand":["node","test/contract.mjs"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"npm","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"npm","schemaVersion":1},"license":"MIT-0","packages":["pkg:npm/%40sigstore/bundle@3.1.0"],"schemaVersion":1,"subject":"pkg:npm/%40sigstore/bundle@3.1.0","symbols":["@sigstore/bundle.BUNDLE_V02_MEDIA_TYPE"],"verifierAdapter":"node-typescript@1"}

{
  "name": "sigstore-bundle-v02-media-type-sample",
  "version": "1.0.0",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "sigstore-bundle-v02-media-type-sample",
      "version": "1.0.0",
      "dependencies": {
        "@sigstore/bundle": "3.1.0"
      }
    },
    "node_modules/@sigstore/bundle": {
      "version": "3.1.0",
      "resolved": "https://registry.npmjs.org/@sigstore/bundle/-/bundle-3.1.0.tgz",
      "integrity": "sha512-Mm1E3/CmDDCz3nDhFKTuYdB47EdRFRQMOE/EAbiG1MJW77/w1b3P7Qx7JSrVJs8PfwOLOVcKQCHErIwCTyPbag==",
      "license": "Apache-2.0",
      "dependencies": {
        "@sigstore/protobuf-specs": "^0.4.0"
      },
      "engines": {
        "node": "^18.17.0 || >=20.5.0"
      }
    },
    "node_modules/@sigstore/protobuf-specs": {
      "version": "0.4.3",
      "resolved": "https://registry.npmjs.org/@sigstore/protobuf-specs/-/protobuf-specs-0.4.3.tgz",
      "integrity": "sha512-fk2zjD9117RL9BjqEwF7fwv7Q/P9yGsMV4MUJZ/DocaQJ6+3pKr+syBq1owU5Q5qGw5CUbXzm+4yJ2JVRDQeSA==",
      "license": "Apache-2.0",
      "engines": {
        "node": "^18.17.0 || >=20.5.0"
      }
    }
  }
}

{
  "name": "sigstore-bundle-v02-media-type-sample",
  "version": "1.0.0",
  "private": true,
  "type": "module",
  "dependencies": {
    "@sigstore/bundle": "3.1.0"
  }
}

{
  "schemaVersion": 1,
  "goal": "verify @sigstore/bundle.BUNDLE_V02_MEDIA_TYPE in pkg:npm/%40sigstore/bundle@3.1.0",
  "kind": "HOW",
  "packages": [
    "pkg:npm/%40sigstore/bundle@3.1.0"
  ],
  "symbols": [
    "@sigstore/bundle.BUNDLE_V02_MEDIA_TYPE"
  ]
}

import assert from 'node:assert/strict';
import {
  BUNDLE_V02_MEDIA_TYPE,
  assertBundleV02,
  bundleFromJSON,
  bundleToJSON,
  ValidationError,
} from '@sigstore/bundle';

// 1. Verify BUNDLE_V02_MEDIA_TYPE constant value
assert.equal(
  BUNDLE_V02_MEDIA_TYPE,
  'application/vnd.dev.sigstore.bundle+json;version=0.2'
);

// 2. Verify a valid v0.2 bundle using BUNDLE_V02_MEDIA_TYPE passes assertBundleV02
// and round-trips via bundleToJSON / bundleFromJSON (which dispatches on BUNDLE_V02_MEDIA_TYPE)
const validV02Bundle = {
  mediaType: BUNDLE_V02_MEDIA_TYPE,
  verificationMaterial: {
    content: {
      $case: 'x509CertificateChain',
      x509CertificateChain: {
        certificates: [
          {
            rawBytes: Buffer.from('cert-bytes'),
          },
        ],
      },
    },
    tlogEntries: [
      {
        logIndex: '1',
        logId: {
          keyId: Buffer.from('log-id'),
        },
        kindVersion: {
          kind: 'hashedrekord',
          version: '0.0.1',
        },
        integratedTime: '1700000000',
        inclusionPromise: undefined,
        inclusionProof: {
          logIndex: '1',
          rootHash: Buffer.from('root-hash'),
          treeSize: '1',
          hashes: [],
          checkpoint: {
            envelope: 'checkpoint-envelope',
          },
        },
        canonicalizedBody: Buffer.from('body'),
      },
    ],
    timestampVerificationData: undefined,
  },
  content: {
    $case: 'messageSignature',
    messageSignature: {
      messageDigest: {
        algorithm: 1,
        digest: Buffer.from('digest-bytes'),
      },
      signature: Buffer.from('sig-bytes'),
    },
  },
};

assertBundleV02(validV02Bundle);

const serialized = bundleToJSON(validV02Bundle);
assert.equal(serialized.mediaType, BUNDLE_V02_MEDIA_TYPE);

const parsed = bundleFromJSON(serialized);
assert.equal(parsed.mediaType, BUNDLE_V02_MEDIA_TYPE);
assert.equal(parsed.verificationMaterial.content.$case, 'x509CertificateChain');

// 3. Verify that missing inclusionProof on a BUNDLE_V02_MEDIA_TYPE bundle fails v0.2 validation
const invalidV02Json = {
  ...serialized,
  verificationMaterial: {
    ...serialized.verificationMaterial,
    tlogEntries: [
      {
        ...serialized.verificationMaterial.tlogEntries[0],
        inclusionProof: undefined,
      },
    ],
  },
};

assert.throws(
  () => bundleFromJSON(invalidV02Json),
  (err) => err instanceof ValidationError && err.message.includes('invalid v0.2 bundle')
);