web-eid · mrts · Jun 11, 2026 · May 27, 2026
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: Estonian Information System Authority
+# SPDX-License-Identifier: MIT
+
 name: Build extension
 
 on: [push, pull_request]
@@ -7,7 +10,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
       with:
         submodules: recursive
 
@@ -16,7 +19,7 @@ jobs:
         node-version: '20.x'
 
     - name: Cache Node.js modules
-      uses: actions/cache@v4
+      uses: actions/cache@v5
       with:
         # npm cache files are stored in `~/.npm` on Linux/macOS
         path: ~/.npm
@@ -34,8 +37,38 @@ jobs:
         export TOKEN_SIGNING_BACKWARDS_COMPATIBILITY=true
         npm run test clean build package
 
+    - name: Generate SBOM
+      run: |
+        WEBEXT_VERSION=$(node -p "require('./package.json').version")
+        WEBEID_JS_VERSION=$(node -p "require('./lib/web-eid.js/package.json').version")
+        SBOM=web-eid-webextension-${WEBEXT_VERSION}.spdx
+        npm sbom --sbom-format spdx --package-lock-only > ${SBOM}
+        jq --arg version "${WEBEID_JS_VERSION}" '
+          .packages += [{
+            "SPDXID": "SPDXRef-Package-web-eid.js",
+            "name": "web-eid.js",
+            "versionInfo": $version,
+            "downloadLocation": "https://github.com/web-eid/web-eid.js",
+            "filesAnalyzed": false,
+            "licenseConcluded": "MIT",
+            "licenseDeclared": "MIT",
+            "copyrightText": "NOASSERTION"
+          }] |
+          .relationships += [{
+            "spdxElementId": "SPDXRef-DOCUMENT",
+            "relationshipType": "DESCRIBES",
+            "relatedSpdxElement": "SPDXRef-Package-web-eid.js"
+          }]
+        ' ${SBOM} > ${SBOM}.tmp && mv ${SBOM}.tmp ${SBOM}
+
     - name: Upload artifacts
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@v7
       with:
         name: web-eid-webextension-${{github.run_number}}
         path: dist/
+
+    - name: Upload SBOM artifacts
+      uses: actions/upload-artifact@v7
+      with:
+        name: web-eid-webextension-sbom-${{github.run_number}}
+        path: "*.spdx"
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: Estonian Information System Authority
+# SPDX-License-Identifier: MIT
+
 name: "CodeQL"
 
 on:

diff --git a/.github/workflows/coverity.yml b/.github/workflows/coverity.yml
@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: Estonian Information System Authority
+# SPDX-License-Identifier: MIT
+
 name: "Coverity"
 
 on:
@@ -21,7 +24,7 @@ jobs:
       with:
         node-version: '20.x'
     - name: Cache Node.js modules
-      uses: actions/cache@v4
+      uses: actions/cache@v5
       with:
         # npm cache files are stored in `~/.npm` on Linux/macOS
         path: ~/.npm

diff --git a/eslint.config.mjs b/eslint.config.mjs
@@ -1,3 +1,6 @@
+// SPDX-FileCopyrightText: Estonian Information System Authority
+// SPDX-License-Identifier: MIT
+
 // @ts-check
 import globals from "globals";
 import eslint from "@eslint/js";

diff --git a/jest.config.js b/jest.config.js
@@ -1,3 +1,6 @@
+// SPDX-FileCopyrightText: Estonian Information System Authority
+// SPDX-License-Identifier: MIT
+
 const { pathsToModuleNameMapper } = require("ts-jest");
 const { compilerOptions } = require("./tsconfig");
 

diff --git a/lib/web-eid.js b/lib/web-eid.js
diff --git a/rollup.config.mjs b/rollup.config.mjs
@@ -1,3 +1,6 @@
+// SPDX-FileCopyrightText: Estonian Information System Authority
+// SPDX-License-Identifier: MIT
+
 import path from "path";
 import { fileURLToPath } from "url";
 

diff --git a/scripts/build-utils.mjs b/scripts/build-utils.mjs
@@ -1,3 +1,6 @@
+// SPDX-FileCopyrightText: Estonian Information System Authority
+// SPDX-License-Identifier: MIT
+
 import { spawn } from "child_process";
 import path from "path";
 

diff --git a/scripts/build.mjs b/scripts/build.mjs
@@ -1,3 +1,6 @@
+// SPDX-FileCopyrightText: Estonian Information System Authority
+// SPDX-License-Identifier: MIT
+
 import {
   cp,
   rm,

diff --git a/src/background-safari/services/NativeAppService.ts b/src/background-safari/services/NativeAppService.ts
@@ -1,24 +1,5 @@
-/*
- * Copyright (c) 2020-2024 Estonian Information System Authority
- *
- * Permission is hereby granted, free of charge, to any person obtaining a copy
- * of this software and associated documentation files (the "Software"), to deal
- * in the Software without restriction, including without limitation the rights
- * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
- * copies of the Software, and to permit persons to whom the Software is
- * furnished to do so, subject to the following conditions:
- *
- * The above copyright notice and this permission notice shall be included in all
- * copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
- * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
- * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
- * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
- * SOFTWARE.
- */
+// SPDX-FileCopyrightText: Estonian Information System Authority
+// SPDX-License-Identifier: MIT
 
 import { NativeRequest } from "@web-eid.js/models/message/NativeRequest";
 import NativeUnavailableError from "@web-eid.js/errors/NativeUnavailableError";

diff --git a/src/background/actions/TokenSigning/errorToResponse.ts b/src/background/actions/TokenSigning/errorToResponse.ts
@@ -1,24 +1,5 @@
-/*
- * Copyright (c) 2020-2024 Estonian Information System Authority
- *
- * Permission is hereby granted, free of charge, to any person obtaining a copy
- * of this software and associated documentation files (the "Software"), to deal
- * in the Software without restriction, including without limitation the rights
- * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
- * copies of the Software, and to permit persons to whom the Software is
- * furnished to do so, subject to the following conditions:
- *
- * The above copyright notice and this permission notice shall be included in all
- * copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
- * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
- * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
- * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
- * SOFTWARE.
- */
+// SPDX-FileCopyrightText: Estonian Information System Authority
+// SPDX-License-Identifier: MIT
 
 import ErrorCode from "@web-eid.js/errors/ErrorCode";
 import { serializeError } from "@web-eid.js/utils/errorSerializer";

diff --git a/src/background/actions/TokenSigning/getCertificate.ts b/src/background/actions/TokenSigning/getCertificate.ts
@@ -1,24 +1,5 @@
-/*
- * Copyright (c) 2020-2024 Estonian Information System Authority
- *
- * Permission is hereby granted, free of charge, to any person obtaining a copy
- * of this software and associated documentation files (the "Software"), to deal
- * in the Software without restriction, including without limitation the rights
- * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
- * copies of the Software, and to permit persons to whom the Software is
- * furnished to do so, subject to the following conditions:
- *
- * The above copyright notice and this permission notice shall be included in all
- * copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
- * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
- * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
- * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
- * SOFTWARE.
- */
+// SPDX-FileCopyrightText: Estonian Information System Authority
+// SPDX-License-Identifier: MIT
 
 import { NativeGetSigningCertificateRequest } from "@web-eid.js/models/message/NativeRequest";
 import { NativeGetSigningCertificateResponse } from "@web-eid.js/models/message/NativeResponse";

diff --git a/src/background/actions/TokenSigning/index.ts b/src/background/actions/TokenSigning/index.ts
@@ -1,24 +1,5 @@
-/*
- * Copyright (c) 2020-2024 Estonian Information System Authority
- *
- * Permission is hereby granted, free of charge, to any person obtaining a copy
- * of this software and associated documentation files (the "Software"), to deal
- * in the Software without restriction, including without limitation the rights
- * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
- * copies of the Software, and to permit persons to whom the Software is
- * furnished to do so, subject to the following conditions:
- *
- * The above copyright notice and this permission notice shall be included in all
- * copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
- * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
- * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
- * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
- * SOFTWARE.
- */
+// SPDX-FileCopyrightText: Estonian Information System Authority
+// SPDX-License-Identifier: MIT
 
 import getCertificate from "./getCertificate";
 import sign from "./sign";

diff --git a/src/background/actions/TokenSigning/sign.ts b/src/background/actions/TokenSigning/sign.ts
@@ -1,24 +1,5 @@
-/*
- * Copyright (c) 2020-2024 Estonian Information System Authority
- *
- * Permission is hereby granted, free of charge, to any person obtaining a copy
- * of this software and associated documentation files (the "Software"), to deal
- * in the Software without restriction, including without limitation the rights
- * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
- * copies of the Software, and to permit persons to whom the Software is
- * furnished to do so, subject to the following conditions:
- *
- * The above copyright notice and this permission notice shall be included in all
- * copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
- * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
- * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
- * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
- * SOFTWARE.
- */
+// SPDX-FileCopyrightText: Estonian Information System Authority
+// SPDX-License-Identifier: MIT
 
 import { NativeSignRequest } from "@web-eid.js/models/message/NativeRequest";
 import { NativeSignResponse } from "@web-eid.js/models/message/NativeResponse";

diff --git a/src/background/actions/TokenSigning/status.ts b/src/background/actions/TokenSigning/status.ts
@@ -1,24 +1,5 @@
-/*
- * Copyright (c) 2020-2024 Estonian Information System Authority
- *
- * Permission is hereby granted, free of charge, to any person obtaining a copy
- * of this software and associated documentation files (the "Software"), to deal
- * in the Software without restriction, including without limitation the rights
- * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
- * copies of the Software, and to permit persons to whom the Software is
- * furnished to do so, subject to the following conditions:
- *
- * The above copyright notice and this permission notice shall be included in all
- * copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
- * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
- * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
- * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
- * SOFTWARE.
- */
+// SPDX-FileCopyrightText: Estonian Information System Authority
+// SPDX-License-Identifier: MIT
 
 import UnknownError from "@web-eid.js/errors/UnknownError";
 

diff --git a/src/background/actions/TokenSigning/threeLetterLanguageCodes.ts b/src/background/actions/TokenSigning/threeLetterLanguageCodes.ts
@@ -1,24 +1,5 @@
-/*
- * Copyright (c) 2022-2024 Estonian Information System Authority
- *
- * Permission is hereby granted, free of charge, to any person obtaining a copy
- * of this software and associated documentation files (the "Software"), to deal
- * in the Software without restriction, including without limitation the rights
- * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
- * copies of the Software, and to permit persons to whom the Software is
- * furnished to do so, subject to the following conditions:
- *
- * The above copyright notice and this permission notice shall be included in all
- * copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
- * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
- * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
- * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
- * SOFTWARE.
- */
+// SPDX-FileCopyrightText: Estonian Information System Authority
+// SPDX-License-Identifier: MIT
 
 /**
  * Map of ISO 639-2 three-letter language codes to ISO 639-1 two-letter language codes.

diff --git a/src/background/actions/authenticate.ts b/src/background/actions/authenticate.ts
@@ -1,24 +1,5 @@
-/*
- * Copyright (c) 2020-2024 Estonian Information System Authority
- *
- * Permission is hereby granted, free of charge, to any person obtaining a copy
- * of this software and associated documentation files (the "Software"), to deal
- * in the Software without restriction, including without limitation the rights
- * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
- * copies of the Software, and to permit persons to whom the Software is
- * furnished to do so, subject to the following conditions:
- *
- * The above copyright notice and this permission notice shall be included in all
- * copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
- * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
- * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
- * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
- * SOFTWARE.
- */
+// SPDX-FileCopyrightText: Estonian Information System Authority
+// SPDX-License-Identifier: MIT
 
 import Action from "@web-eid.js/models/Action";
 import { NativeAuthenticateRequest } from "@web-eid.js/models/message/NativeRequest";

diff --git a/src/background/actions/getSigningCertificate.ts b/src/background/actions/getSigningCertificate.ts
@@ -1,24 +1,5 @@
-/*
- * Copyright (c) 2020-2024 Estonian Information System Authority
- *
- * Permission is hereby granted, free of charge, to any person obtaining a copy
- * of this software and associated documentation files (the "Software"), to deal
- * in the Software without restriction, including without limitation the rights
- * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
- * copies of the Software, and to permit persons to whom the Software is
- * furnished to do so, subject to the following conditions:
- *
- * The above copyright notice and this permission notice shall be included in all
- * copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
- * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
- * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
- * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
- * SOFTWARE.
- */
+// SPDX-FileCopyrightText: Estonian Information System Authority
+// SPDX-License-Identifier: MIT
 
 import Action from "@web-eid.js/models/Action";
 import { NativeGetSigningCertificateRequest } from "@web-eid.js/models/message/NativeRequest";

diff --git a/src/background/actions/sign.ts b/src/background/actions/sign.ts
@@ -1,24 +1,5 @@
-/*
- * Copyright (c) 2020-2024 Estonian Information System Authority
- *
- * Permission is hereby granted, free of charge, to any person obtaining a copy
- * of this software and associated documentation files (the "Software"), to deal
- * in the Software without restriction, including without limitation the rights
- * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
- * copies of the Software, and to permit persons to whom the Software is
- * furnished to do so, subject to the following conditions:
- *
- * The above copyright notice and this permission notice shall be included in all
- * copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
- * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
- * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
- * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
- * SOFTWARE.
- */
+// SPDX-FileCopyrightText: Estonian Information System Authority
+// SPDX-License-Identifier: MIT
 
 import {
   ExtensionFailureResponse,
+13 −3		.github/workflows/build.yml
+7 −4		.github/workflows/codeql.yml
+5 −2		.github/workflows/coverity.yml
+3 −0		eslint.config.mjs
+3 −0		jest.config.mjs
+3 −0		rollup.config.mjs
+2 −21		src/__tests__/web-eid-test.ts
+2 −21		src/config.ts
+2 −21		src/errors/ActionPendingError.ts
+2 −21		src/errors/ActionTimeoutError.ts
+2 −21		src/errors/ContextInsecureError.ts
+2 −21		src/errors/DeveloperError.ts
+2 −21		src/errors/ErrorCode.ts
+2 −21		src/errors/ExtensionUnavailableError.ts
+2 −21		src/errors/KnownErrorConstructors.ts
+2 −21		src/errors/MissingParameterError.ts
+2 −21		src/errors/NativeFatalError.ts
+2 −21		src/errors/NativeInvalidArgumentError.ts
+2 −21		src/errors/NativeUnavailableError.ts
+2 −21		src/errors/SerializedError.ts
+2 −21		src/errors/UnknownError.ts
+2 −21		src/errors/UserCancelledError.ts
+2 −21		src/errors/UserTimeoutError.ts
+2 −21		src/errors/VersionInvalidError.ts
+2 −21		src/errors/VersionMismatchError.ts
+2 −21		src/models/Action.ts
+2 −21		src/models/ActionOptions.ts
+2 −21		src/models/PendingMessage.ts
+2 −21		src/models/RequiresUpdate.ts
+2 −21		src/models/SignatureAlgorithm.ts
+2 −21		src/models/Versions.ts
+2 −21		src/models/message/ExtensionRequest.ts
+2 −21		src/models/message/ExtensionResponse.ts
+2 −21		src/models/message/LibraryResponse.ts
+2 −21		src/models/message/NativeRequest.ts
+2 −21		src/models/message/NativeResponse.ts
+2 −21		src/services/WebExtensionService.ts
+2 −21		src/services/__tests__/WebExtensionService-test.ts
+2 −21		src/utils/__tests__/errorSerializer-test.ts
+2 −21		src/utils/errorSerializer.ts
+2 −21		src/utils/sleep.ts
+2 −21		src/web-eid.ts