@sigstore/verify 2.1.1: VerificationError

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify @sigstore/verify.VerificationError in pkg:npm/%40sigstore/verify@2.1.1
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:npm/%40sigstore/verify@2.1.1
Demonstrate these symbols/APIs:
  - @sigstore/verify.VerificationError

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:accf68edb686c1994c55a34f67206b21b5bb366a7a4b651743eba4271a84b8ab","contract":["assert new VerificationError({ code, message, cause }) creates an Error and VerificationError instance with name 'VerificationError', code, message, and cause","assert new VerificationError({ code, message }) without cause sets cause to undefined across all supported VerificationErrorCode values","assert Verifier.prototype.verify throws VerificationError with code 'TIMESTAMP_ERROR' when transparency log timestamps are below tlogThreshold","assert Verifier.prototype.verify throws VerificationError with code 'SIGNATURE_ERROR' when signature verification fails"],"goal":"verify @sigstore/verify.VerificationError in pkg:npm/%40sigstore/verify@2.1.1","kind":"HOW","packages":["pkg:npm/%40sigstore/verify@2.1.1"],"schemaVersion":1,"symbols":["@sigstore/verify.VerificationError"]},"contractCommand":["node","test/contract.mjs"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"npm","executionContext":"node","language":"javascript","libc":"glibc","libcVersion":"2.39","moduleSystem":"cjs","os":"linux","osVersionBucket":"24","packageManager":"npm","packageManagerVersion":"10.9.8","runtime":"node","runtimeVersion":"22.23.2","schemaVersion":1},"license":"MIT-0","packages":["pkg:npm/%40sigstore/verify@2.1.1"],"schemaVersion":1,"subject":"pkg:npm/%40sigstore/verify@2.1.1","symbols":["@sigstore/verify.VerificationError"],"verifierAdapter":"node-typescript@1"}

const { VerificationError, Verifier } = require('@sigstore/verify');

function createVerificationError({ code, message, cause }) {
  return new VerificationError({ code, message, cause });
}

function isVerificationError(err, expectedCode) {
  if (!(err instanceof VerificationError)) {
    return false;
  }
  if (expectedCode !== undefined && err.code !== expectedCode) {
    return false;
  }
  return true;
}

module.exports = {
  VerificationError,
  Verifier,
  createVerificationError,
  isVerificationError,
};

{
  "name": "sample-sigstore-verify-verification-error",
  "version": "1.0.0",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "sample-sigstore-verify-verification-error",
      "version": "1.0.0",
      "license": "MIT-0",
      "dependencies": {
        "@sigstore/verify": "2.1.1"
      }
    },
    "node_modules/@sigstore/bundle": {
      "version": "3.1.0",
      "resolved": "https://registry.npmjs.org/@sigstore/bundle/-/bundle-3.1.0.tgz",
      "integrity": "sha512-Mm1E3/CmDDCz3nDhFKTuYdB47EdRFRQMOE/EAbiG1MJW77/w1b3P7Qx7JSrVJs8PfwOLOVcKQCHErIwCTyPbag==",
      "license": "Apache-2.0",
      "dependencies": {
        "@sigstore/protobuf-specs": "^0.4.0"
      },
      "engines": {
        "node": "^18.17.0 || >=20.5.0"
      }
    },
    "node_modules/@sigstore/core": {
      "version": "2.0.0",
      "resolved": "https://registry.npmjs.org/@sigstore/core/-/core-2.0.0.tgz",
      "integrity": "sha512-nYxaSb/MtlSI+JWcwTHQxyNmWeWrUXJJ/G4liLrGG7+tS4vAz6LF3xRXqLH6wPIVUoZQel2Fs4ddLx4NCpiIYg==",
      "license": "Apache-2.0",
      "engines": {
        "node": "^18.17.0 || >=20.5.0"
      }
    },
    "node_modules/@sigstore/protobuf-specs": {
      "version": "0.4.3",
      "resolved": "https://registry.npmjs.org/@sigstore/protobuf-specs/-/protobuf-specs-0.4.3.tgz",
      "integrity": "sha512-fk2zjD9117RL9BjqEwF7fwv7Q/P9yGsMV4MUJZ/DocaQJ6+3pKr+syBq1owU5Q5qGw5CUbXzm+4yJ2JVRDQeSA==",
      "license": "Apache-2.0",
      "engines": {
        "node": "^18.17.0 || >=20.5.0"
      }
    },
    "node_modules/@sigstore/verify": {
      "version": "2.1.1",
      "resolved": "https://registry.npmjs.org/@sigstore/verify/-/verify-2.1.1.tgz",
      "integrity": "sha512-hVJD77oT67aowHxwT4+M6PGOp+E2LtLdTK3+FC0lBO9T7sYwItDMXZ7Z07IDCvR1M717a4axbIWckrW67KMP/w==",
      "license": "Apache-2.0",
      "dependencies": {
        "@sigstore/bundle": "^3.1.0",
        "@sigstore/core": "^2.0.0",
        "@sigstore/protobuf-specs": "^0.4.1"
      },
      "engines": {
        "node": "^18.17.0 || >=20.5.0"
      }
    }
  }
}

{
  "name": "sample-sigstore-verify-verification-error",
  "version": "1.0.0",
  "description": "Clean-room sample verifying @sigstore/verify.VerificationError",
  "main": "index.js",
  "license": "MIT-0",
  "scripts": {
    "test": "node test/contract.mjs"
  },
  "dependencies": {
    "@sigstore/verify": "2.1.1"
  }
}

{
  "schemaVersion": 1,
  "goal": "verify @sigstore/verify.VerificationError in pkg:npm/%40sigstore/verify@2.1.1",
  "kind": "HOW",
  "packages": [
    "pkg:npm/%40sigstore/verify@2.1.1"
  ],
  "symbols": [
    "@sigstore/verify.VerificationError"
  ]
}

import assert from 'node:assert';
import crypto from 'node:crypto';
import {
  VerificationError,
  Verifier,
  createVerificationError,
  isVerificationError,
} from '../index.js';

// 1. Construct VerificationError with code, message, and cause
const rootCause = new Error('underlying failure');
const errWithCause = createVerificationError({
  code: 'SIGNATURE_ERROR',
  message: 'signature verification failed',
  cause: rootCause,
});

assert(errWithCause instanceof Error, 'VerificationError must be an instance of Error');
assert(
  errWithCause instanceof VerificationError,
  'VerificationError must be an instance of VerificationError'
);
assert.strictEqual(errWithCause.name, 'VerificationError');
assert.strictEqual(errWithCause.code, 'SIGNATURE_ERROR');
assert.strictEqual(errWithCause.message, 'signature verification failed');
assert.strictEqual(errWithCause.cause, rootCause);
assert.strictEqual(isVerificationError(errWithCause, 'SIGNATURE_ERROR'), true);
assert.strictEqual(isVerificationError(errWithCause, 'TIMESTAMP_ERROR'), false);

// 2. Construct VerificationError without cause across supported error codes
const codes = [
  'NOT_IMPLEMENTED_ERROR',
  'TLOG_INCLUSION_PROOF_ERROR',
  'TLOG_INCLUSION_PROMISE_ERROR',
  'TLOG_MISSING_INCLUSION_ERROR',
  'TLOG_BODY_ERROR',
  'CERTIFICATE_ERROR',
  'PUBLIC_KEY_ERROR',
  'SIGNATURE_ERROR',
  'TIMESTAMP_ERROR',
];

for (const code of codes) {
  const err = new VerificationError({
    code,
    message: `error for ${code}`,
  });
  assert.strictEqual(err.name, 'VerificationError');
  assert.strictEqual(err.code, code);
  assert.strictEqual(err.message, `error for ${code}`);
  assert.strictEqual(err.cause, undefined);
}

// 3. Verifier throws VerificationError with TIMESTAMP_ERROR when tlog count is below threshold
const { publicKey } = crypto.generateKeyPairSync('ec', { namedCurve: 'P-256' });
const trustMaterial = {
  certificateAuthorities: [],
  tlogs: [],
  ctlogs: [],
  timestampAuthorities: [],
  publicKey: () => ({
    key: publicKey,
    validFor: () => true,
  }),
};

const verifierDefault = new Verifier(trustMaterial, { tlogThreshold: 1 });
const entityWithoutTimestamps = {
  timestamps: [],
  key: { $case: 'public-key', hint: 'key-1' },
  tlogEntries: [],
  signature: {
    signature: Buffer.from('sig'),
    verifySignature: () => true,
  },
};

assert.throws(
  () => verifierDefault.verify(entityWithoutTimestamps),
  (err) => {
    assert(err instanceof VerificationError);
    assert.strictEqual(err.name, 'VerificationError');
    assert.strictEqual(err.code, 'TIMESTAMP_ERROR');
    assert.strictEqual(err.message, 'expected 1 tlog timestamps, got 0');
    return true;
  }
);

// 4. Verifier throws VerificationError with SIGNATURE_ERROR when signature verification fails
const verifierNoThresholds = new Verifier(trustMaterial, {
  tlogThreshold: 0,
  ctlogThreshold: 0,
  tsaThreshold: 0,
});
const entityBadSignature = {
  timestamps: [],
  key: { $case: 'public-key', hint: 'key-1' },
  tlogEntries: [],
  signature: {
    signature: Buffer.from('invalid-sig'),
    verifySignature: () => false,
  },
};

assert.throws(
  () => verifierNoThresholds.verify(entityBadSignature),
  (err) => {
    assert(err instanceof VerificationError);
    assert.strictEqual(err.name, 'VerificationError');
    assert.strictEqual(err.code, 'SIGNATURE_ERROR');
    assert.strictEqual(err.message, 'signature verification failed');
    return true;
  }
);

console.log('All contract assertions passed.');