github

type Attester func(
	ctx context.Context,
	bundleJSON []byte,
	artifactDigest string,
	policy attestation.Policy,
) (attestation.Result, error)

type ChannelStatus struct {
	// Changed reports whether the channel document moved since the last
	// verified read.
	Changed bool

	// ETag is the validator the reply carried.
	ETag string

	// Budget reports the request budget and the request count of the check.
	Budget RateLimitBudget
}

type Config struct {
	// Repository is `CATALOG_SOURCE_REPOSITORY`, in `owner/name` form.
	Repository string

	// Channel is `CATALOG_SOURCE_CHANNEL`, the branch that carries the
	// channel document. The source reads that document from the repository
	// contents endpoint at this ref.
	Channel string

	// SignerWorkflow is `CATALOG_SOURCE_SIGNER_WORKFLOW`.
	SignerWorkflow string

	// Token is `CATALOG_SOURCE_TOKEN`. It is optional, because every public
	// catalog release is readable without one.
	Token string

	// APIBaseURL is `CATALOG_SOURCE_URL`, the REST API root.
	APIBaseURL string

	// StateDirectory holds the durable ETag, sequence, and rollback target.
	// The caller owns the directory and supplies it.
	StateDirectory string

	// TrustedRootJSON overrides the compiled Sigstore trusted root. A
	// connected caller refreshes the root through TUF and passes it here.
	TrustedRootJSON []byte

	// TransferPolicy bounds every request and every body read.
	TransferPolicy remote.TransferPolicy

	// Progress receives transfer progress. It may be nil.
	Progress remote.ProgressFunc

	// HTTPClient overrides the transfer client. It may be nil.
	HTTPClient *http.Client

	// Attester verifies one Sigstore bundle. It defaults to the hermetic
	// engine in internal/attestation.
	Attester Attester

	// Now reads the clock. It defaults to time.Now.
	Now func() time.Time
}

type Option func(*Config)

type RateLimitBudget struct {
	// Observed reports whether the reply carried a usable budget.
	Observed bool

	// Limit is the number of requests that the window allows.
	Limit int

	// Used is the number of requests already spent in the window.
	Used int

	// Remaining is the number of requests left in the window.
	Remaining int

	// ResetAt is the time the window restarts.
	ResetAt time.Time

	// Requests is the number of requests this refresh cycle sent.
	Requests int
}

type RefusalError struct {
	// Status is the refused HTTP status code.
	Status int

	// Resource is the safe operation label.
	Resource string

	// NotBefore is the earliest time the caller may retry. It is zero when
	// the reply declared no boundary.
	NotBefore time.Time

	// Budget is the request budget the refusal reported.
	Budget RateLimitBudget

	// Err is the underlying typed API error.
	Err error
}

type Release struct {
	// Tag is the immutable release tag.
	Tag string

	// GenerationID is the catalog generation the release carries.
	GenerationID string

	// CatalogDigest is the facts-only semantic digest of the catalog the
	// release carries. The publisher keys the release tag and the channel
	// document by this digest, not by the exact payload checksum that the
	// generation manifest records.
	CatalogDigest string

	// PublishedAt is the publication time the channel recorded. It is zero
	// for a release that a caller read by tag.
	PublishedAt time.Time

	// Sequence is the channel sequence that selected the release. It is zero
	// for a release that a caller read by tag.
	Sequence uint64

	// Generation is the verified immutable catalog generation.
	Generation catalogs.Generation

	// Provenance is the verified build provenance of the archive.
	Provenance attestation.Result

	// Budget reports the request budget and the request count of the cycle.
	Budget RateLimitBudget
}

type ReleaseRef struct {
	Tag           string    `json:"tag"`
	GenerationID  string    `json:"generation_id"`
	CatalogDigest string    `json:"catalog_digest"`
	VerifiedAt    time.Time `json:"verified_at"`
}

type Source struct {
	// contains filtered or unexported fields
}

type State struct {
	SchemaVersion uint64     `json:"schema_version"`
	Repository    string     `json:"repository"`
	Channel       string     `json:"channel"`
	ChannelETag   string     `json:"channel_etag"`
	Sequence      uint64     `json:"sequence"`
	Verified      ReleaseRef `json:"verified"`
	UpdatedAt     time.Time  `json:"updated_at"`
}