ociplugins

type ContentStorage struct {
	// contains filtered or unexported fields
}

type ErrCacheCorrupted struct {
	Path   string
	Reason string
}

type ErrIncompatibleArchitecture struct {
	PluginArch  string
	RuntimeArch string
}

type ErrInvalidOCIReference struct {
	Reference string
	Reason    string
}

type ErrNetworkTimeout struct {
	Operation string
	Registry  string
}

type ErrPluginNotFound struct {
	Reference string
}

type ErrRegistryNotAllowed struct {
	Registry          string
	AllowedRegistries []string
}

type ErrSignatureVerificationFailed struct {
	Reference string
	Reason    string
}

type LocalPlugin struct {
	Reference      *OCIReference    `json:"reference"`
	Params         *OCIPluginParams `json:"params"`
	ExecutablePath string           `json:"executable_path"` // Path to executable binary
	ConfigPath     string           `json:"config_path"`     // Optional config JSON path
	CacheDir       string           `json:"cache_dir"`       // Storage location
	Verified       bool             `json:"verified"`        // Cosign verification status
	FetchTime      time.Time        `json:"fetch_time"`      // When downloaded
	Config         *PluginConfig    `json:"config"`          // Parsed from OCI config layer
}

type OCIConfig struct {
	// Cache settings
	CacheDir     string `yaml:"cache_dir" json:"cache_dir"`
	MaxCacheSize int64  `yaml:"max_cache_size" json:"max_cache_size"`

	// MaxPluginSize bounds a single plugin binary. Layer sizes come from
	// registry-supplied descriptors, so the binary is streamed against this
	// limit rather than trusting the descriptor.
	MaxPluginSize int64 `yaml:"max_plugin_size" json:"max_plugin_size"`

	// Default security settings
	DefaultPublicKeys []string `yaml:"default_public_keys" json:"default_public_keys"`
	AllowedRegistries []string `yaml:"allowed_registries" json:"allowed_registries"`

	// Authentication
	RegistryAuth map[string]RegistryAuth `yaml:"registry_auth" json:"registry_auth"`

	// Network settings
	Timeout       time.Duration `yaml:"timeout" json:"timeout"`
	RetryAttempts int           `yaml:"retry_attempts" json:"retry_attempts"`

	// Security settings
	RequireSignature bool `yaml:"require_signature" json:"require_signature"`

	// Registry connection settings
	InsecureRegistries []string `yaml:"insecure_registries" json:"insecure_registries"`

	// Garbage collection
	GCInterval   time.Duration `yaml:"gc_interval" json:"gc_interval"`
	KeepVersions int           `yaml:"keep_versions" json:"keep_versions"`
}

type OCIPluginClient struct {
	// contains filtered or unexported fields
}

type OCIPluginParams struct {
	Architecture string `json:"architecture"` // linux/amd64, linux/arm64
	PublicKey    string `json:"public_key"`   // Key identifier or path
	AuthConfig   string `json:"auth_config"`  // Auth configuration name
}

type OCIReference struct {
	Registry   string            `json:"registry"`   // nexus.example.com
	Repository string            `json:"repository"` // plugins/ner
	Digest     string            `json:"digest"`     // sha256:...
	Tag        string            `json:"tag"`        // optional, mainly for development
	Params     map[string]string `json:"params"`     // Query parameters
}

type ORASFetcher struct {
	// contains filtered or unexported fields
}

type PluginConfig struct {
	Name           string   `json:"name"`
	Version        string   `json:"version"`
	PluginAPI      string   `json:"plugin_api"`
	OS             string   `json:"os"`
	Arch           string   `json:"arch"`
	LibC           string   `json:"libc,omitempty"`
	HostMinVersion string   `json:"host_min_version,omitempty"`
	Capabilities   []string `json:"capabilities,omitempty"`
	Notes          string   `json:"notes,omitempty"`
}

type PluginMetadata struct {
	Reference    *OCIReference    `json:"reference"`
	Params       *OCIPluginParams `json:"params"`
	FetchTime    time.Time        `json:"fetch_time"`
	Config       *PluginConfig    `json:"config"`
	Verified     bool             `json:"verified"`
	Size         int64            `json:"size"`
	LastAccessed time.Time        `json:"last_accessed"`
	Version      string           `json:"version"` // From plugin config
}

type RegistryAuth struct {
	Username            string `yaml:"username" json:"username"`
	PasswordEnv         string `yaml:"password_env" json:"password_env"`                 // Environment variable name
	Token               string `yaml:"token" json:"token"`                               // Direct token (less secure)
	TokenEnv            string `yaml:"token_env" json:"token_env"`                       // Token from environment
	Entitlement         string `yaml:"entitlement" json:"entitlement"`                   // Direct entitlement/bearer token
	EntitlementEnv      string `yaml:"entitlement_env" json:"entitlement_env"`           // Entitlement token from environment
	EntitlementUsername string `yaml:"entitlement_username" json:"entitlement_username"` // Username for entitlement auth (default: "token")
}

type SecurityService interface {
	VerifySignature(ctx context.Context, ref *OCIReference, pubKeyID string) error
	VerifyBundle(ctx context.Context, ref *OCIReference, issuer, subject string) error
	VerifyWithPolicy(ctx context.Context, ref *OCIReference, policyPath string) error
}

type SignatureVerifier struct {
	// contains filtered or unexported fields
}