Use cbor-x instead of cbor-js for CBOR encoding/decoding

package.json

@@ -33,7 +33,6 @@
   "devDependencies": {
     "@eslint/js": "^9.7.0",
     "@ianvs/prettier-plugin-sort-imports": "^4.3.1",
-    "@types/cbor-js": "^0.1.1",
     "@types/eslint__js": "^8.42.3",
     "@types/mocha": "^10.0.7",
     "@types/node": "^20.14.11",
@@ -53,7 +52,7 @@
   },
   "dependencies": {
     "@peculiar/x509": "^1.11.0",
-    "cbor-js": "^0.1.0",
+    "cbor-x": "^1.5.9",
     "crc-32": "^1.2.2",
     "pkijs": "^3.2.1"
   },

src/cose/SigStructure.ts

@@ -1,4 +1,4 @@
-import cbor from 'cbor-js';
+import * as cbor from 'cbor-x';
 
 export class SigStructure {
     public readonly externalAAD: Uint8Array = new Uint8Array(0);
@@ -10,6 +10,11 @@ export class SigStructure {
     ) {}
 
     public encode(): Uint8Array {
-        return new Uint8Array(cbor.encode([this.context, this.protectedBucket, this.externalAAD, this.payload]));
+        return new cbor.Encoder({ tagUint8Array: false }).encode([
+            this.context,
+            this.protectedBucket,
+            this.externalAAD,
+            this.payload,
+        ]);
     }
 }

src/cose/Signature.ts

@@ -11,7 +11,7 @@ import {
     SubjectKeyIdentifierExtension,
     X509Certificate,
 } from '@peculiar/x509';
-import cbor from 'cbor-js';
+import * as cbor from 'cbor-x';
 import { PKIStatus, SignedData, TimeStampResp, TSTInfo } from 'pkijs';
 import { Crypto, ECDSANamedCurve, HashAlgorithm, SigningAlgorithm } from '../crypto';
 import * as JUMBF from '../jumbf';
@@ -35,7 +35,7 @@ export class Signature {
 
         let protectedBucket: ProtectedBucket | undefined;
         try {
-            protectedBucket = cbor.decode(BinaryHelper.toArrayBuffer(rawContent[0])) as ProtectedBucket;
+            protectedBucket = cbor.decode(rawContent[0]) as ProtectedBucket;
         } catch {
             /* empty */
         }

src/jumbf/CBORBox.ts

@@ -1,5 +1,4 @@
-import cbor from 'cbor-js';
-import { BinaryHelper } from '../util';
+import * as cbor from 'cbor-x';
 import { Box } from './Box';
 
 export class CBORBox extends Box {
@@ -14,7 +13,12 @@ export class CBORBox extends Box {
     public parse(buf: Uint8Array) {
         this.rawContent = buf;
         try {
-            this.content = cbor.decode(BinaryHelper.toArrayBuffer(buf));
+            this.content = cbor.decode(buf);
+
+            // Ignore unknown CBOR tags
+            if (this.content instanceof cbor.Tag) {
+                this.content = this.content.value;
+            }
         } catch {
             // TODO This needs to be properly reported as a validation error
             throw new Error('CBORBox: Invalid CBOR data');