jpegtrust

type ActionType string

type AuthenticityAssertion struct {
	// Type identifies the assertion type (e.g., "c2pa.created", "c2pa.edited").
	Type string

	// Label is a human-readable label for the assertion.
	Label string

	// Value contains the assertion value (type depends on assertion type).
	Value interface{}

	// WhenAsserted is the timestamp when this assertion was made.
	WhenAsserted int64

	// AssertedBy identifies who made this assertion.
	AssertedBy string

	// IsAIGenerated indicates if the content was generated by AI.
	IsAIGenerated bool

	// AIModel specifies the AI model used, if IsAIGenerated is true.
	AIModel string

	// IsHumanCreated indicates if the content was created by a human.
	IsHumanCreated bool

	// IsEdited indicates if the content has been edited.
	IsEdited bool

	// EditActions lists the types of edits performed.
	EditActions []string

	// Metadata contains any additional key-value metadata.
	Metadata map[string]string
}

type ByteRange struct {
	Start int64
	End   int64
}

type ChainBuilder struct {
	// contains filtered or unexported fields
}

type ChainError struct {
	// RecordIndex is the index of the record where the error occurred.
	RecordIndex int

	// Message describes the error.
	Message string

	// Cause is the underlying error.
	Cause error
}

type ContentOrigin int

type IntegrityHash struct {
	// Algorithm specifies the hash algorithm (e.g., "SHA-256", "SHA-384", "SHA-512").
	Algorithm string

	// Value is the hash value bytes.
	Value []byte

	// Scope indicates what the hash covers (e.g., "full", "content", "metadata").
	Scope string

	// ComputedAt is the timestamp when the hash was computed.
	ComputedAt int64

	// ExcludedRanges lists byte ranges excluded from the hash calculation.
	// Used for self-referential hashes where the hash itself must be excluded.
	ExcludedRanges []ByteRange
}

type ParseError struct {
	// Offset is the byte position where the error occurred.
	Offset int64

	// Field describes which field was being parsed.
	Field string

	// Message describes the error.
	Message string

	// Cause is the underlying error.
	Cause error
}

type Parser struct {
	// contains filtered or unexported fields
}

type ProvenanceCheckerImpl struct {
	// contains filtered or unexported fields
}

type ProvenanceCheckerInterface interface {
	// GetProvenance extracts the provenance chain from image data.
	GetProvenance(data []byte) ([]ProvenanceRecord, error)

	// HasProvenance checks if provenance data exists.
	HasProvenance(data []byte) bool
}

type ProvenanceRecord struct {
	// Action describes what was done (e.g., "created", "edited", "exported", "signed").
	Action string

	// Actor identifies who performed the action (person, organization, or software).
	Actor string

	// Timestamp is the Unix timestamp when the action occurred.
	Timestamp int64

	// Software identifies the application or tool used.
	Software string

	// SoftwareVersion is the version of the software used.
	SoftwareVersion string

	// Description provides a human-readable description of the action.
	Description string

	// Hash is the integrity hash after this action was performed.
	Hash []byte

	// HashAlgorithm specifies the algorithm used for the hash (e.g., "SHA-256").
	HashAlgorithm string

	// ParentHash links to the previous record in the chain.
	ParentHash []byte

	// Metadata contains any additional key-value metadata for the action.
	Metadata map[string]string
}

type SignatureVerification struct {
	// IsValid indicates if the signature is valid.
	IsValid bool

	// VerifiedAt is the timestamp when verification was performed.
	VerifiedAt int64

	// SignerIdentity is the identity extracted from the certificate.
	SignerIdentity string

	// CertificateChain contains the certificate chain used for verification.
	CertificateChain [][]byte

	// CertificateExpiry is when the signing certificate expires.
	CertificateExpiry int64

	// IsCertificateExpired indicates if the certificate has expired.
	IsCertificateExpired bool

	// IsCertificateRevoked indicates if the certificate was revoked.
	IsCertificateRevoked bool

	// TrustAnchor identifies the root of trust for the certificate.
	TrustAnchor string

	// Error contains any error that occurred during verification.
	Error error
}

type SignatureVerifier interface {
	// Verify verifies a digital signature.
	// data is the signed data, signature is the signature bytes,
	// and certificate is the signer's certificate.
	Verify(data, signature, certificate []byte) (*SignatureVerification, error)
}

type TrustChain struct {
	// Records contains all provenance records in chronological order.
	Records []ProvenanceRecord

	// IsComplete indicates if the chain is complete from origin.
	IsComplete bool

	// BrokenAt indicates the index where the chain is broken (-1 if complete).
	BrokenAt int

	// BreakReason describes why the chain is broken, if applicable.
	BreakReason string

	// OriginRecord is the first record in the chain (creation).
	OriginRecord *ProvenanceRecord

	// LatestRecord is the most recent record in the chain.
	LatestRecord *ProvenanceRecord
}

type TrustManifest struct {
	// Version is the manifest format version (e.g., "1.0", "2.0").
	Version string

	// Issuer identifies the entity that created this manifest.
	Issuer string

	// IssuerURL is the URL for the issuer's public information.
	IssuerURL string

	// Title is an optional human-readable title for the manifest.
	Title string

	// CreatedAt is the timestamp when the manifest was created.
	CreatedAt int64

	// ProvenanceRecords contains the provenance chain.
	ProvenanceRecords []ProvenanceRecord

	// Assertions contains authenticity assertions.
	Assertions []AuthenticityAssertion

	// ContentHash is the primary integrity hash for the image content.
	ContentHash *IntegrityHash

	// MetadataHash is the integrity hash for the metadata portion.
	MetadataHash *IntegrityHash

	// Signature is the digital signature over the manifest (if present).
	Signature []byte

	// SignatureAlgorithm identifies the signature algorithm used.
	SignatureAlgorithm string

	// SignerCertificate is the X.509 certificate of the signer (if present).
	SignerCertificate []byte

	// IsAIContent indicates if any assertion marks this as AI-generated content.
	IsAIContent bool

	// ClaimGeneratorInfo describes the software that generated the claims.
	ClaimGeneratorInfo string
}

type TrustValidationResult struct {
	// Manifest is the parsed trust manifest.
	Manifest *TrustManifest

	// Chain is the verified provenance chain.
	Chain *TrustChain

	// SignatureVerification contains signature verification results.
	SignatureVerification *SignatureVerification

	// HashVerification indicates if the content hash was verified.
	HashVerification bool

	// Warnings contains any non-fatal issues found during validation.
	Warnings []string

	// IsFullyVerified indicates if all checks passed.
	IsFullyVerified bool
}

type TrustValidatorInterface interface {
	// ValidateTrust validates the trust metadata in image data.
	// Returns the manifest and any validation errors.
	ValidateTrust(data []byte) (*TrustManifest, error)
}

type ValidationError struct {
	// Step describes which validation step failed.
	Step string

	// Expected describes what was expected.
	Expected string

	// Actual describes what was found.
	Actual string

	// Message describes the error.
	Message string

	// Cause is the underlying error.
	Cause error
}

type Validator struct {
	// contains filtered or unexported fields
}

type ValidatorConfig struct {
	// VerifySignatures enables signature verification.
	// Requires a SignatureVerifier to be configured.
	VerifySignatures bool

	// VerifyHashes enables content hash verification.
	VerifyHashes bool

	// RequireProvenance requires at least one provenance record.
	RequireProvenance bool

	// RequireAssertions requires at least one authenticity assertion.
	RequireAssertions bool

	// MaxProvenanceRecords limits the number of provenance records.
	MaxProvenanceRecords int

	// MaxAssertions limits the number of assertions.
	MaxAssertions int

	// AllowExpiredCertificates allows validation with expired certificates.
	AllowExpiredCertificates bool
}