attestation

type AttestSubject struct {
	// Name is the artifact name (e.g., "checksums.txt").
	Name string

	// Digest maps algorithm to hex-encoded digest (e.g., {"sha256": "abc123..."}).
	Digest map[string]string

	// ResolvedDependencies records build inputs in SLSA resolvedDependencies format.
	ResolvedDependencies []Dependency

	// Metadata provides build context for the SLSA predicate.
	Metadata StatementMetadata
}

type Attester interface {
	// Attest creates a DSSE-signed in-toto SLSA provenance statement for the
	// given subject, returning a serialized Sigstore bundle (.sigstore.json).
	// Returns nil bytes when attestation is not performed (e.g., NoOpAttester).
	Attest(ctx context.Context, subject AttestSubject) ([]byte, error)

	// Identity returns the attester's identity as it appears in the signing
	// certificate or key reference (e.g., OIDC email, KMS key URI).
	// Returns empty string when no identity is available.
	Identity() string

	// HasRekorEntry reports whether produced attestations include a Rekor
	// transparency log inclusion proof.
	HasRekorEntry() bool
}

type Dependency struct {
	// URI identifies the dependency (e.g., GitHub release URL or file:// URI).
	URI string

	// Digest maps algorithm to hex-encoded digest.
	Digest map[string]string
}

type KeylessAttester struct {
	// contains filtered or unexported fields
}

type NoOpAttester struct{}

type StatementMetadata struct {
	// Recipe name that produced this bundle.
	Recipe string

	// RecipeSource indicates where the recipe came from ("embedded" or "external").
	RecipeSource string

	// Components lists the component names in the bundle.
	Components []string

	// OutputDir is the bundle output directory.
	OutputDir string

	// BuilderID identifies who created this bundle (e.g., OIDC email or workflow URI).
	BuilderID string

	// ToolVersion is the aicr version that produced this bundle (e.g., "v1.0.0").
	ToolVersion string
}