attestation

type Policy struct {
	// Repository is the owner and name of the signing repository, such as
	// "agentstation/starmap".
	Repository string

	// Workflow is the repository-relative path of the signing workflow, such
	// as ".github/workflows/catalog-generation.yaml".
	Workflow string

	// Issuer is the expected OIDC issuer. Use GitHubOIDCIssuer.
	Issuer string

	// PredicateType is the expected in-toto predicate type. Use
	// BuildProvenancePredicateType.
	PredicateType string

	// TrustedRootJSON is a Sigstore trusted-root document. The caller reads
	// and refreshes it.
	TrustedRootJSON []byte

	// DenySelfHostedRunners rejects an attestation that a self-hosted runner
	// produced.
	DenySelfHostedRunners bool
}

type Result struct {
	// PredicateType is the verified in-toto predicate type.
	PredicateType string

	// SignerIdentity is the verified certificate subject alternative name.
	SignerIdentity string

	// SourceRepositoryURI is the verified source repository.
	SourceRepositoryURI string

	// SourceRepositoryDigest is the verified commit that built the artifact.
	SourceRepositoryDigest string

	// RunnerEnvironment is the verified runner environment.
	RunnerEnvironment string

	// ObservedAt is the earliest verified observer timestamp.
	ObservedAt time.Time
}

type TrustError struct {
	// Stage names the policy check that failed.
	Stage string

	// Expected is the value the policy requires, when the stage compares one.
	Expected string

	// Actual is the value the attestation carried, when the stage compares one.
	Actual string

	// Message describes the failure.
	Message string

	// Err is the underlying engine error, when one exists.
	Err error
}