@sigstore/core 2.0.0

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify pkg:npm/%40sigstore/core@2.0.0
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:npm/%40sigstore/core@2.0.0

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:efd9132b0fb7cd06a5e31abbe60c925193280a9bbe0d87829d75555e6cf40d17","contract":["json.canonicalize serializes object keys in RFC 8785 lexicographical order","dsse.preAuthEncoding formats the DSSEv1 pre-authentication encoding buffer","crypto.digest and crypto.bufferEqual compute and compare SHA-256 digests","pem.toDER, pem.fromDER, crypto.createPublicKey, and crypto.verify roundtrip SPKI PEM keys and verify ECDSA signatures","encoding.base64Encode, encoding.base64Decode, and ByteStream perform base64 roundtrips and binary stream reads/writes"],"goal":"verify pkg:npm/%40sigstore/core@2.0.0","kind":"HOW","packages":["pkg:npm/%40sigstore/core@2.0.0"],"schemaVersion":1},"contractCommand":["node","test/contract.mjs"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"npm","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"npm","schemaVersion":1},"license":"MIT-0","packages":["pkg:npm/%40sigstore/core@2.0.0"],"schemaVersion":1,"subject":"pkg:npm/%40sigstore/core@2.0.0","verifierAdapter":"node-typescript@1"}

{
  "name": "sigstore-core-sample",
  "version": "1.0.0",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "sigstore-core-sample",
      "version": "1.0.0",
      "dependencies": {
        "@sigstore/core": "2.0.0"
      }
    },
    "node_modules/@sigstore/core": {
      "version": "2.0.0",
      "resolved": "https://registry.npmjs.org/@sigstore/core/-/core-2.0.0.tgz",
      "integrity": "sha512-nYxaSb/MtlSI+JWcwTHQxyNmWeWrUXJJ/G4liLrGG7+tS4vAz6LF3xRXqLH6wPIVUoZQel2Fs4ddLx4NCpiIYg==",
      "license": "Apache-2.0",
      "engines": {
        "node": "^18.17.0 || >=20.5.0"
      }
    }
  }
}

{
  "name": "sigstore-core-sample",
  "version": "1.0.0",
  "private": true,
  "type": "module",
  "dependencies": {
    "@sigstore/core": "2.0.0"
  }
}

{
  "schemaVersion": 1,
  "goal": "verify pkg:npm/%40sigstore/core@2.0.0",
  "kind": "HOW",
  "packages": [
    "pkg:npm/%40sigstore/core@2.0.0"
  ]
}

import assert from 'node:assert/strict';
import nodeCrypto from 'node:crypto';
import * as sigstoreCore from '@sigstore/core';

const { crypto, dsse, encoding, json, pem, ByteStream } = sigstoreCore;

// 1. JSON canonicalization (RFC 8785)
const canonical = json.canonicalize({ b: 2, a: 'hello' });
assert.equal(canonical, '{"a":"hello","b":2}');

// 2. DSSE Pre-Authentication Encoding (PAE)
const payload = Buffer.from(canonical, 'utf8');
const pae = dsse.preAuthEncoding('application/vnd.in-toto+json', payload);
assert.equal(
  pae.toString('utf8'),
  'DSSEv1 28 application/vnd.in-toto+json 19 {"a":"hello","b":2}'
);

// 3. Crypto digest & bufferEqual
const digestA = crypto.digest('sha256', pae);
const digestB = crypto.digest('sha256', pae);
assert.equal(digestA.length, 32);
assert.equal(crypto.bufferEqual(digestA, digestB), true);

// 4. PEM <-> DER roundtrip and signature verification
const { publicKey, privateKey } = nodeCrypto.generateKeyPairSync('ec', {
  namedCurve: 'P-256',
});
const spkiPem = publicKey.export({ type: 'spki', format: 'pem' });
const spkiDer = pem.toDER(spkiPem);
const restoredPem = pem.fromDER(spkiDer, 'PUBLIC KEY');
const parsedKey = crypto.createPublicKey(restoredPem);

const signature = nodeCrypto.sign('sha256', pae, privateKey);
assert.equal(crypto.verify(pae, parsedKey, signature, 'sha256'), true);

// 5. Base64 encoding and ByteStream operations
const encoded = encoding.base64Encode('sigstore');
assert.equal(encoding.base64Decode(encoded), 'sigstore');

const stream = new ByteStream();
stream.appendUint16(0x0102);
stream.seek(0);
assert.equal(stream.getUint16(), 0x0102);