fix type errors

bdehamer · bdehamer · commit 0ddf320cb3d2 · 2025-12-02T16:41:57.000-08:00
Signed-off-by: Brian DeHamer &lt;bdehamer@github.com&gt;
diff --git a/packages/bundle/src/__tests__/__snapshots__/build.test.ts.snap b/packages/bundle/src/__tests__/__snapshots__/build.test.ts.snap
@@ -1,4 +1,4 @@
-// Jest Snapshot v1, https://goo.gl/fbAQLP
+// Jest Snapshot v1, https://jestjs.io/docs/snapshot-testing
 
 exports[`toDSSEBundle when the certificateChain option is true when a certificate chain provided returns a valid DSSE bundle 1`] = `
 {
diff --git a/packages/bundle/src/__tests__/__snapshots__/serialized.test.ts.snap b/packages/bundle/src/__tests__/__snapshots__/serialized.test.ts.snap
@@ -1,4 +1,4 @@
-// Jest Snapshot v1, https://goo.gl/fbAQLP
+// Jest Snapshot v1, https://jestjs.io/docs/snapshot-testing
 
 exports[`bundleToJSON SerializedDSSEBundle (v0.3) matches the snapshot 1`] = `
 {
diff --git a/packages/core/src/asn1/obj.ts b/packages/core/src/asn1/obj.ts
@@ -28,16 +28,16 @@ import { ASN1Tag } from './tag';
 export class ASN1Obj {
   readonly tag: ASN1Tag;
   readonly subs: ASN1Obj[];
-  readonly value: Buffer;
+  readonly value: Buffer<ArrayBufferLike>;
 
-  constructor(tag: ASN1Tag, value: Buffer, subs: ASN1Obj[]) {
+  constructor(tag: ASN1Tag, value: Buffer<ArrayBufferLike>, subs: ASN1Obj[]) {
     this.tag = tag;
     this.value = value;
     this.subs = subs;
   }
 
   // Constructs an ASN.1 object from a Buffer of DER-encoded bytes.
-  public static parseBuffer(buf: Buffer): ASN1Obj {
+  public static parseBuffer(buf: Buffer<ArrayBuffer>): ASN1Obj {
     return parseStream(new ByteStream(buf));
   }
 
diff --git a/packages/core/src/pem.ts b/packages/core/src/pem.ts
@@ -16,7 +16,7 @@ limitations under the License.
 const PEM_HEADER = /-----BEGIN (.*)-----/;
 const PEM_FOOTER = /-----END (.*)-----/;
 
-export function toDER(certificate: string): Buffer {
+export function toDER(certificate: string): Buffer<ArrayBuffer> {
   let der = '';
 
   certificate.split('\n').forEach((line) => {
diff --git a/packages/core/src/rfc3161/timestamp.ts b/packages/core/src/rfc3161/timestamp.ts
@@ -30,7 +30,7 @@ export class RFC3161Timestamp {
     this.root = asn1;
   }
 
-  public static parse(der: Buffer): RFC3161Timestamp {
+  public static parse(der: Buffer<ArrayBuffer>): RFC3161Timestamp {
     const asn1 = ASN1Obj.parseBuffer(der);
     return new RFC3161Timestamp(asn1);
   }
diff --git a/packages/core/src/stream.ts b/packages/core/src/stream.ts
@@ -18,16 +18,16 @@ class StreamError extends Error {}
 export class ByteStream {
   private static BLOCK_SIZE = 1024;
 
-  private buf: ArrayBuffer;
+  private buf: Buffer<ArrayBufferLike>;
   private view: Buffer;
   private start = 0;
 
-  constructor(buffer?: ArrayBuffer) {
+  constructor(buffer?: Buffer<ArrayBufferLike>) {
     if (buffer) {
       this.buf = buffer;
       this.view = Buffer.from(buffer);
     } else {
-      this.buf = new ArrayBuffer(0);
+      this.buf = Buffer.alloc(0);
       this.view = Buffer.from(this.buf);
     }
   }
@@ -129,7 +129,7 @@ export class ByteStream {
   }
 
   private realloc(size: number) {
-    const newArray = new ArrayBuffer(size);
+    const newArray = Buffer.alloc(size);
     const newView = Buffer.from(newArray);
 
     // Copy the old buffer into the new one
diff --git a/packages/core/src/x509/cert.ts b/packages/core/src/x509/cert.ts
@@ -41,7 +41,7 @@ export class X509Certificate {
     this.root = asn1;
   }
 
-  public static parse(cert: Buffer | string): X509Certificate {
+  public static parse(cert: Buffer<ArrayBuffer> | string): X509Certificate {
     const der = typeof cert === 'string' ? pem.toDER(cert) : cert;
     const asn1 = ASN1Obj.parseBuffer(der);
     return new X509Certificate(asn1);
diff --git a/packages/core/src/x509/ext.ts b/packages/core/src/x509/ext.ts
@@ -35,7 +35,7 @@ export class X509Extension {
     return this.root.subs.length === 3 ? this.root.subs[1].toBoolean() : false;
   }
 
-  get value(): Buffer {
+  get value(): Buffer<ArrayBufferLike> {
     return this.extnValueObj.value;
   }
 
diff --git a/packages/mock-server/src/index.ts b/packages/mock-server/src/index.ts
@@ -104,7 +104,9 @@ export default class Server extends Command {
     tufEndpoints.forEach(({ path, fn }) => {
       app.get(
         path,
-        adapt(() => Promise.resolve(fn()))
+        // TODO: fix types in tuf-mock
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        adapt(() => Promise.resolve((fn as any)()))
       );
     });
 
@@ -143,7 +145,7 @@ function assembleTrustedRoot({
 }
 
 function certificateAuthority(
-  certificates: Buffer[],
+  certificates: ArrayBufferView<ArrayBuffer>[],
   url: string
 ): CertificateAuthority {
   return {
@@ -154,7 +156,7 @@ function certificateAuthority(
     uri: url,
     certChain: {
       certificates: certificates.map((certificate) => ({
-        rawBytes: certificate,
+        rawBytes: Buffer.from(certificate.buffer),
       })),
     },
     validFor: { start: new Date() },
diff --git a/packages/mock/src/fulcio/__snapshots__/handler.test.ts.snap b/packages/mock/src/fulcio/__snapshots__/handler.test.ts.snap
@@ -1,4 +1,4 @@
-// Jest Snapshot v1, https://goo.gl/fbAQLP
+// Jest Snapshot v1, https://jestjs.io/docs/snapshot-testing
 
 exports[`fulcioHandler #fn when invoked w/ a CSR returns a certificate chain 1`] = `
 Extensions [
diff --git a/packages/mock/src/fulcio/ca.test.ts b/packages/mock/src/fulcio/ca.test.ts
@@ -207,7 +207,7 @@ describe('CA', () => {
         const root = ca.rootCertificate;
         const ctLogList = [
           {
-            log_id: ctLog.logID.toString('base64'),
+            log_id: Buffer.from(ctLog.logID.buffer).toString('base64'),
             key: ctLog.publicKey.toString('base64'),
           },
         ];
diff --git a/packages/mock/src/fulcio/ca.ts b/packages/mock/src/fulcio/ca.ts
@@ -34,12 +34,14 @@ const OID_SIGNED_CERTIFICATE_TIMESTAMP_LIST = '1.3.6.1.4.1.11129.2.4.2';
 const MS_PER_MINUTE = 1000 * 60;
 
 export interface CA {
-  rootCertificate: Buffer;
-  issueCertificate: (options: CertificateRequestOptions) => Promise<Buffer>;
+  rootCertificate: ArrayBufferView<ArrayBuffer>;
+  issueCertificate: (
+    options: CertificateRequestOptions
+  ) => Promise<ArrayBufferView<ArrayBuffer>>;
 }
 
 export interface CertificateRequestOptions {
-  publicKey: Buffer;
+  publicKey: ArrayBufferView<ArrayBuffer>;
   subjectAltName: string;
   extensions?: ExtensionValue[];
 }
@@ -99,13 +101,13 @@ class CAImpl implements CA {
     this.crypto = new Crypto();
   }
 
-  public get rootCertificate(): Buffer {
+  public get rootCertificate(): ArrayBufferView<ArrayBuffer> {
     return Buffer.from(this.root.rawData);
   }
 
   public async issueCertificate(
     opts: CertificateRequestOptions
-  ): Promise<Buffer> {
+  ): Promise<ArrayBufferView<ArrayBuffer>> {
     // convert key to CryptoKey
     const key = await this.crypto.subtle.importKey(
       'spki',
diff --git a/packages/mock/src/fulcio/ctlog.test.ts b/packages/mock/src/fulcio/ctlog.test.ts
@@ -38,13 +38,15 @@ describe('CTLog', () => {
   describe('#logID', () => {
     it('returns the log ID', async () => {
       const ctLog: CTLog = await initializeCTLog(keyPair, clock);
-      expect(ctLog.logID.toString('hex')).toMatch(/^[0-9a-f]{64}$/);
+      expect(Buffer.from(ctLog.logID.buffer).toString('hex')).toMatch(
+        /^[0-9a-f]{64}$/
+      );
     });
 
     it('returns the log ID matching the public key', async () => {
       const ctLog: CTLog = await initializeCTLog(keyPair, clock);
 
-      const logID = ctLog.logID.toString('hex');
+      const logID = Buffer.from(ctLog.logID.buffer).toString('hex');
       const keyDigest = crypto
         .createHash('sha256')
         .update(ctLog.publicKey)
diff --git a/packages/mock/src/fulcio/ctlog.ts b/packages/mock/src/fulcio/ctlog.ts
@@ -25,7 +25,7 @@ import { keyObjectToCryptoKey } from '../util/key';
 
 export interface CTLog {
   publicKey: Buffer;
-  logID: Buffer;
+  logID: ArrayBufferView<ArrayBuffer>;
   log: (
     certificate: ArrayBuffer,
     issuerID: ArrayBuffer
@@ -61,15 +61,15 @@ export async function initializeCTLog(
 
 interface CTLogOptions {
   publicKey: Buffer;
-  logID: Buffer;
+  logID: ArrayBufferView<ArrayBuffer>;
   privateKey: CryptoKey;
   clock?: Date;
   crypto: Crypto;
 }
 
 class CTLogImpl implements CTLog {
   public readonly publicKey: Buffer;
-  public readonly logID: Buffer;
+  public readonly logID: ArrayBufferView<ArrayBuffer>;
   private privateKey: CryptoKey;
   private getCurrentTime: () => Date;
   private crypto: Crypto;
@@ -88,7 +88,6 @@ class CTLogImpl implements CTLog {
   ): Promise<ArrayBuffer> {
     const version = 0;
     const timestamp = this.getCurrentTime();
-    const logID = this.logID;
 
     // A bit of a hack to get the TBS bytes
     const tbs = pkijs.Certificate.fromBER(certificate).encodeTBS().toBER();
@@ -109,7 +108,7 @@ class CTLogImpl implements CTLog {
 
     return new pkijs.SignedCertificateTimestamp({
       version,
-      logID,
+      logID: this.logID.buffer,
       timestamp,
       signature: asn1js.fromBER(sig).result,
       hashAlgorithm: 'sha256',
diff --git a/packages/mock/src/fulcio/handler.ts b/packages/mock/src/fulcio/handler.ts
@@ -132,7 +132,10 @@ function stubBody(): {
   };
 }
 
-function buildResponse(leaf: Buffer, root: Buffer): string {
+function buildResponse(
+  leaf: ArrayBufferView<ArrayBuffer>,
+  root: ArrayBufferView<ArrayBuffer>
+): string {
   const body = {
     signedCertificateEmbeddedSct: {
       chain: {
@@ -275,18 +278,18 @@ function extractCSRKey(pem: string): string {
 }
 
 // PEM string to DER-encoded byte buffer conversion
-function fromPEM(pem: string): Buffer {
+function fromPEM(pem: string): ArrayBufferView<ArrayBuffer> {
   return Buffer.from(
     pem.replace(/-{5}(BEGIN|END) .*-{5}/gm, '').replace(/\s/gm, ''),
     'base64'
   );
 }
 
 // DER-encoded byte buffer to PEM string conversion
-function toPEM(der: Buffer): string {
+function toPEM(der: ArrayBufferView<ArrayBuffer>): string {
   return [
     '-----BEGIN CERTIFICATE-----',
-    der.toString('base64'),
+    Buffer.from(der.buffer).toString('base64'),
     '-----END CERTIFICATE-----',
     '',
   ].join('\n');
diff --git a/packages/mock/src/shared.types.ts b/packages/mock/src/shared.types.ts
@@ -16,7 +16,7 @@ limitations under the License.
 
 export type HandlerFnResult = {
   statusCode: number;
-  response: string | Buffer;
+  response: string | ArrayBufferView<ArrayBuffer>;
   contentType?: string;
 };
 export type HandlerFn = (request: string) => Promise<HandlerFnResult>;
diff --git a/packages/mock/src/timestamp/tsa.ts b/packages/mock/src/timestamp/tsa.ts
@@ -40,9 +40,9 @@ const OKD_PKCS9_MESSAGE_DIGEST_KEY = '1.2.840.113549.1.9.4';
 const OID_PKCS9_SIGNING_CERTIFICATE_V2_KEY = '1.2.840.113549.1.9.16.2.47';
 
 export interface TSA {
-  rootCertificate: Buffer;
-  intCertificate: Buffer;
-  timestamp: (req: TimestampRequest) => Promise<Buffer>;
+  rootCertificate: ArrayBufferView<ArrayBuffer>;
+  intCertificate: ArrayBufferView<ArrayBuffer>;
+  timestamp: (req: TimestampRequest) => Promise<ArrayBufferView<ArrayBuffer>>;
 }
 
 export interface TimestampRequest {
@@ -106,17 +106,19 @@ class TSAImpl implements TSA {
     }) as pkijs.ICryptoEngine;
   }
 
-  public get rootCertificate(): Buffer {
+  public get rootCertificate(): ArrayBufferView<ArrayBuffer> {
     return Buffer.from(this.rootCert.toSchema().toBER(false));
   }
 
-  public get intCertificate(): Buffer {
+  public get intCertificate(): ArrayBufferView<ArrayBuffer> {
     return Buffer.from(this.intCert.toSchema().toBER(false));
   }
 
   // Create a timestamp according to
   // https://www.rfc-editor.org/rfc/rfc3161.html
-  public async timestamp(req: TimestampRequest): Promise<Buffer> {
+  public async timestamp(
+    req: TimestampRequest
+  ): Promise<ArrayBufferView<ArrayBuffer>> {
     const includeCerts = req.certReq ?? false;
 
     // Create the TSTInfo structure and sign it
diff --git a/packages/mock/src/trust-root.ts b/packages/mock/src/trust-root.ts
@@ -35,7 +35,7 @@ function trustCA(ca: CA): CertificateAuthority {
     certChain: {
       certificates: [
         {
-          rawBytes: ca.rootCertificate,
+          rawBytes: Buffer.from(ca.rootCertificate.buffer),
         },
       ],
     },
@@ -70,7 +70,7 @@ function trustTLog(tlog: TLog): TransparencyLogInstance {
 function trustCTLog(ctlog: CTLog): TransparencyLogInstance {
   return {
     baseUrl: 'https://ctfe.sigstore.dev',
-    logId: { keyId: ctlog.logID },
+    logId: { keyId: Buffer.from(ctlog.logID.buffer) },
     hashAlgorithm: HashAlgorithm.SHA2_256,
     publicKey: {
       rawBytes: ctlog.publicKey,
diff --git a/packages/verify/src/bundle/index.ts b/packages/verify/src/bundle/index.ts
@@ -43,7 +43,7 @@ export function toSignedEntity(
   for (const ts of timestampVerificationData?.rfc3161Timestamps ?? []) {
     timestamps.push({
       $case: 'timestamp-authority',
-      timestamp: RFC3161Timestamp.parse(ts.signedTimestamp),
+      timestamp: RFC3161Timestamp.parse(Buffer.from(ts.signedTimestamp)),
     });
   }
 
@@ -81,15 +81,17 @@ function key(bundle: Bundle): VerificationKey {
       return {
         $case: 'certificate',
         certificate: X509Certificate.parse(
-          bundle.verificationMaterial.content.x509CertificateChain
-            .certificates[0].rawBytes
+          Buffer.from(
+            bundle.verificationMaterial.content.x509CertificateChain
+              .certificates[0].rawBytes
+          )
         ),
       };
     case 'certificate':
       return {
         $case: 'certificate',
         certificate: X509Certificate.parse(
-          bundle.verificationMaterial.content.certificate.rawBytes
+          Buffer.from(bundle.verificationMaterial.content.certificate.rawBytes)
         ),
       };
   }
diff --git a/packages/verify/src/trust/index.ts b/packages/verify/src/trust/index.ts
@@ -86,7 +86,7 @@ function createCertAuthority(ca: CertificateAuthority): CertAuthority {
   /* istanbul ignore next */
   return {
     certChain: ca.certChain!.certificates.map((cert) => {
-      return X509Certificate.parse(cert.rawBytes);
+      return X509Certificate.parse(Buffer.from(cert.rawBytes));
     }),
     validFor: {
       start: ca.validFor?.start || BEGINNING_OF_TIME,

Original file line number	Diff line number	Diff line change
`@@ -1,4 +1,4 @@`
`1`		`-// Jest Snapshot v1, https://goo.gl/fbAQLP`
	`1`	`+// Jest Snapshot v1, https://jestjs.io/docs/snapshot-testing`
`2`	`2`
`3`	`3`	exports[`toDSSEBundle when the certificateChain option is true when a certificate chain provided returns a valid DSSE bundle 1`] = `
`4`	`4`	`{`
Original file line number	Diff line number	Diff line change
`@@ -30,7 +30,7 @@ export class RFC3161Timestamp {`
`30`	`30`	`this.root = asn1;`
`31`	`31`	`}`
`32`	`32`
`33`		`- public static parse(der: Buffer): RFC3161Timestamp {`
	`33`	`+ public static parse(der: Buffer<ArrayBuffer>): RFC3161Timestamp {`
`34`	`34`	`const asn1 = ASN1Obj.parseBuffer(der);`
`35`	`35`	`return new RFC3161Timestamp(asn1);`
`36`	`36`	`}`
Original file line number	Diff line number	Diff line change
`@@ -41,7 +41,7 @@ export class X509Certificate {`
`41`	`41`	`this.root = asn1;`
`42`	`42`	`}`
`43`	`43`
`44`		`- public static parse(cert: Buffer \| string): X509Certificate {`
	`44`	`+ public static parse(cert: Buffer<ArrayBuffer> \| string): X509Certificate {`
`45`	`45`	`const der = typeof cert === 'string' ? pem.toDER(cert) : cert;`
`46`	`46`	`const asn1 = ASN1Obj.parseBuffer(der);`
`47`	`47`	`return new X509Certificate(asn1);`
Original file line number	Diff line number	Diff line change
`@@ -35,7 +35,7 @@ export class X509Extension {`
`35`	`35`	`return this.root.subs.length === 3 ? this.root.subs[1].toBoolean() : false;`
`36`	`36`	`}`
`37`	`37`
`38`		`- get value(): Buffer {`
	`38`	`+ get value(): Buffer<ArrayBufferLike> {`
`39`	`39`	`return this.extnValueObj.value;`
`40`	`40`	`}`
`41`	`41`