proper utf-8 encoding in DSSE PAE (#1657)

Signed-off-by: Brian DeHamer <bdehamer@github.com>

Author: bdehamer

.changeset/dirty-games-juggle.md

@@ -0,0 +1,5 @@
+---
+'@sigstore/core': patch
+---
+
+Apply UTF-8 encoding to payload type during PAE calculation

packages/core/src/__tests__/dsse.test.ts

@@ -23,4 +23,30 @@ describe('preAuthEncoding', () => {
     const pae = preAuthEncoding(payloadType, payload);
     expect(pae).toEqual(Buffer.from('DSSEv1 10 text/plain 13 Hello, World!'));
   });
+
+  it('should use utf-8 byte length for non-ASCII payloadType', () => {
+    // U+00E9 (é) is 2 bytes in UTF-8
+    const nonAsciiType = 'application/typ\u00e9';
+    const pae = preAuthEncoding(nonAsciiType, payload);
+
+    const typeBytes = Buffer.from(nonAsciiType, 'utf-8');
+    expect(typeBytes.length).toBe(17); // 16 ASCII chars + 2 byte é = 17
+
+    const expected = Buffer.concat([
+      Buffer.from(`DSSEv1 ${typeBytes.length} `, 'ascii'),
+      typeBytes,
+      Buffer.from(` ${payload.length} `, 'ascii'),
+      payload,
+    ]);
+    expect(pae).toEqual(expected);
+  });
+
+  it('should produce distinct PAE for Unicode payloadType variants', () => {
+    // U+0174 has same low byte as 't' (0x74) — the old ascii
+    // encoding would have mapped both to the same byte
+    const original = preAuthEncoding('text/plain', payload);
+    const mutant = preAuthEncoding('\u0174ext/plain', payload);
+
+    expect(original).not.toEqual(mutant);
+  });
 });

packages/core/src/dsse.ts

@@ -17,13 +17,12 @@ const PAE_PREFIX = 'DSSEv1';
 
 // DSSE Pre-Authentication Encoding
 export function preAuthEncoding(payloadType: string, payload: Buffer): Buffer {
-  const prefix = [
-    PAE_PREFIX,
-    payloadType.length,
-    payloadType,
-    payload.length,
-    '',
-  ].join(' ');
+  const typeBytes = Buffer.from(payloadType, 'utf-8');
 
-  return Buffer.concat([Buffer.from(prefix, 'ascii'), payload]);
+  return Buffer.concat([
+    Buffer.from(`${PAE_PREFIX} ${typeBytes.length} `, 'ascii'),
+    typeBytes,
+    Buffer.from(` ${payload.length} `, 'ascii'),
+    payload,
+  ]);
 }