fix bundle validation

.changeset/lemon-eggs-admire.md

@@ -0,0 +1,5 @@
+---
+'@sigstore/bundle': patch
+---
+
+Update `bundleFromJSON` to perform full bundle validation

packages/bundle/src/__tests__/serialized.test.ts

@@ -369,42 +369,90 @@ describe('bundleToJSON', () => {
 });
 
 describe('bundleFromJSON', () => {
-  const bundle: Bundle = {
-    mediaType: 'application/vnd.dev.sigstore.bundle+json;version=0.1',
-    verificationMaterial: {
+  describe('when the bundle is a v0.1 bundle', () => {
+    const bundle: Bundle = {
+      mediaType: 'application/vnd.dev.sigstore.bundle+json;version=0.1',
+      verificationMaterial: {
+        content: {
+          $case: 'x509CertificateChain',
+          x509CertificateChain: {
+            certificates: [{ rawBytes: Buffer.from('FOO') }],
+          },
+        },
+        tlogEntries: [
+          {
+            logIndex: '123',
+            logId: { keyId: Buffer.from('123') },
+            kindVersion: { kind: 'intoto', version: '0.1.0' },
+            canonicalizedBody: Buffer.from(''),
+            integratedTime: '0',
+            inclusionPromise: { signedEntryTimestamp: Buffer.from('') },
+            inclusionProof: undefined,
+          },
+        ],
+        timestampVerificationData: undefined,
+      },
       content: {
-        $case: 'x509CertificateChain',
-        x509CertificateChain: {
-          certificates: [{ rawBytes: Buffer.from('FOO') }],
+        $case: 'dsseEnvelope',
+        dsseEnvelope: {
+          payload: Buffer.from('ABC'),
+          payloadType: 'application/json',
+          signatures: [{ sig: Buffer.from('BAR'), keyid: '' }],
         },
       },
-      tlogEntries: [
-        {
-          logIndex: '123',
-          logId: { keyId: Buffer.from('123') },
-          kindVersion: { kind: 'intoto', version: '0.1.0' },
-          canonicalizedBody: Buffer.from(''),
-          integratedTime: '0',
-          inclusionPromise: { signedEntryTimestamp: Buffer.from('') },
-          inclusionProof: undefined,
+    };
+
+    it('matches the deserialized form of the Bundle', () => {
+      const json = bundleToJSON(bundle);
+      const deserializedBundle = bundleFromJSON(json);
+      expect(deserializedBundle).toEqual(bundle);
+    });
+  });
+
+  describe('when the bundle is a v0.2 bundle', () => {
+    const bundle: Bundle = {
+      mediaType: 'application/vnd.dev.sigstore.bundle+json;version=0.2',
+      verificationMaterial: {
+        content: {
+          $case: 'x509CertificateChain',
+          x509CertificateChain: {
+            certificates: [{ rawBytes: Buffer.from('FOO') }],
+          },
         },
-      ],
-      timestampVerificationData: undefined,
-    },
-    content: {
-      $case: 'dsseEnvelope',
-      dsseEnvelope: {
-        payload: Buffer.from('ABC'),
-        payloadType: 'application/json',
-        signatures: [{ sig: Buffer.from('BAR'), keyid: '' }],
+        tlogEntries: [
+          {
+            logIndex: '123',
+            logId: { keyId: Buffer.from('123') },
+            kindVersion: { kind: 'intoto', version: '0.1.0' },
+            canonicalizedBody: Buffer.from(''),
+            integratedTime: '0',
+            inclusionPromise: undefined,
+            inclusionProof: {
+              checkpoint: { envelope: '' },
+              hashes: [],
+              logIndex: '',
+              rootHash: Buffer.from(''),
+              treeSize: '',
+            },
+          },
+        ],
+        timestampVerificationData: undefined,
       },
-    },
-  };
+      content: {
+        $case: 'dsseEnvelope',
+        dsseEnvelope: {
+          payload: Buffer.from('ABC'),
+          payloadType: 'application/json',
+          signatures: [{ sig: Buffer.from('BAR'), keyid: '' }],
+        },
+      },
+    };
 
-  it('matches the deserialized form of the Bundle', () => {
-    const json = bundleToJSON(bundle);
-    const deserializedBundle = bundleFromJSON(json);
-    expect(deserializedBundle).toEqual(bundle);
+    it('matches the deserialized form of the Bundle', () => {
+      const json = bundleToJSON(bundle);
+      const deserializedBundle = bundleFromJSON(json);
+      expect(deserializedBundle).toEqual(bundle);
+    });
   });
 });
 

packages/bundle/src/serialized.ts

@@ -14,14 +14,21 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 import { Envelope, Bundle as ProtoBundle } from '@sigstore/protobuf-specs';
-import { assertBundle } from './validate';
+import { BUNDLE_V01_MEDIA_TYPE, Bundle } from './bundle';
+import { assertBundle, assertBundleLatest, assertBundleV01 } from './validate';
 
-import type { Bundle } from './bundle';
 import type { OneOf } from './utility';
 
 export const bundleFromJSON = (obj: unknown): Bundle => {
   const bundle = ProtoBundle.fromJSON(obj);
   assertBundle(bundle);
+
+  if (bundle.mediaType === BUNDLE_V01_MEDIA_TYPE) {
+    assertBundleV01(bundle);
+  } else {
+    assertBundleLatest(bundle);
+  }
+
   return bundle;
 };