verifier

type Policy struct {
	// MinTrustLevel is the minimum required trust level ("max" resolves to
	// the highest achievable level for the bundle).
	MinTrustLevel string

	// RequireCreator requires the bundle attestation creator to match.
	RequireCreator string

	// VersionConstraint is a version constraint expression for the CLI version.
	// Supports operators: >=, >, <=, <, ==, !=.
	// A bare version (e.g. "0.8.0") is treated as ">= 0.8.0".
	VersionConstraint string
}

type TrustLevel string

type VerifyOptions struct {
	// CertificateIdentityRegexp overrides the default identity pinning pattern
	// for binary attestation verification. Must BEGIN with
	// "https://github.com/NVIDIA/aicr/" (a leading "^" is allowed) and must
	// not use top-level alternation; see ValidateIdentityPattern.
	// Defaults to TrustedRepositoryPattern if empty.
	CertificateIdentityRegexp string

	// Key selects public-key verification of the bundle attestation instead of
	// keyless certificate-identity verification. A KMS key URI
	// (awskms:// | gcpkms:// | azurekms:// | hashivault://) or a local PEM public-key file.
	// Independent of CertificateIdentityRegexp, which pins the (separate) binary
	// attestation; the two coexist (see #1152).
	Key string

	// TrustRoot is a path to a sigstore-go trusted_root.json for verifying the
	// bundle attestation against a private Fulcio/Rekor. ADDITIVE: unioned with
	// AICR's public-good root, so NVIDIA-signed and privately-signed bundles
	// both verify. Counterpart to `bundle --fulcio-url`/`--rekor-url`.
	// Composable with Key. Does NOT affect the binary attestation, which is
	// always NVIDIA-public-CI-signed and stays pinned to the public-good root.
	TrustRoot string

	// IgnoreTLog enables offline/air-gapped verification of the key-signed
	// bundle attestation: it skips the transparency-log (and observer-timestamp)
	// requirement so a bundle produced by `bundle --signing-key ... --tlog-upload=false`
	// (#409) verifies with no transparency-log network calls. Full offline
	// operation additionally requires a local PEM Key: a KMS Key URI still makes a
	// live GetPublicKey call via NewKeyVerificationIdentity to resolve the key.
	// ONLY valid with Key set (the air-gapped path is key-based, not keyless);
	// Verify rejects it otherwise. INSECURE relative to the default: without a
	// tlog/timestamp there is no trusted proof of when the signature was made.
	// Does NOT affect the keyless or binary-attestation paths, which always
	// require a transparency log.
	IgnoreTLog bool
}

type VerifyResult struct {
	// TrustLevel is the computed trust level for the bundle.
	TrustLevel TrustLevel `json:"trustLevel"`

	// ChecksumsPassed indicates whether all content files match checksums.txt.
	ChecksumsPassed bool `json:"checksumsPassed"`

	// ChecksumFiles is the number of files verified by checksum.
	ChecksumFiles int `json:"checksumFiles"`

	// BundleAttested indicates whether the bundle attestation was verified.
	BundleAttested bool `json:"bundleAttested"`

	// BinaryAttested indicates whether the binary attestation was verified.
	BinaryAttested bool `json:"binaryAttested"`

	// IdentityPinned indicates whether the binary attestation identity was pinned to NVIDIA CI.
	IdentityPinned bool `json:"identityPinned"`

	// BundleCreator is the OIDC identity from the bundle attestation signing certificate.
	BundleCreator string `json:"bundleCreator,omitempty"`

	// BinaryBuilder is the certificate subject from the binary attestation.
	BinaryBuilder string `json:"binaryBuilder,omitempty"`

	// ToolVersion is the aicr version extracted from the attestation predicate.
	ToolVersion string `json:"toolVersion,omitempty"`

	// HasExternalData indicates the bundle contains external data files (data/ directory).
	HasExternalData bool `json:"hasExternalData"`

	// TrustReason explains why the trust level was set to its current value.
	TrustReason string `json:"trustReason,omitempty"`

	// Errors contains verification failure messages.
	Errors []string `json:"errors,omitempty"`
}