v1

type PublicKey struct {

	// PEM-encoded public key string.
	Key string `protobuf:"bytes,1,opt,name=key,proto3" json:"key,omitempty"`
	// contains filtered or unexported fields
}

type SignRequest struct {

	// Record reference to be signed
	RecordRef *v1.RecordRef `protobuf:"bytes,1,opt,name=record_ref,json=recordRef,proto3" json:"record_ref,omitempty"`
	// Signing provider to use
	Provider *SignRequestProvider `protobuf:"bytes,2,opt,name=provider,proto3" json:"provider,omitempty"`
	// contains filtered or unexported fields
}

type SignRequestProvider struct {

	// Types that are valid to be assigned to Request:
	//
	//	*SignRequestProvider_Oidc
	//	*SignRequestProvider_Key
	Request isSignRequestProvider_Request `protobuf_oneof:"request"`
	// contains filtered or unexported fields
}

type SignRequestProvider_Key struct {
	// Sign with PEM-encoded public key
	Key *SignWithKey `protobuf:"bytes,2,opt,name=key,proto3,oneof"`
}

type SignRequestProvider_Oidc struct {
	// Sign with OIDC provider
	Oidc *SignWithOIDC `protobuf:"bytes,1,opt,name=oidc,proto3,oneof"`
}

type SignResponse struct {

	// Cryptographic signature of the record
	Signature *Signature `protobuf:"bytes,1,opt,name=signature,proto3" json:"signature,omitempty"`
	// contains filtered or unexported fields
}

type SignServiceClient interface {
	// Sign record using keyless OIDC based provider or using PEM-encoded private key with an optional passphrase
	Sign(ctx context.Context, in *SignRequest, opts ...grpc.CallOption) (*SignResponse, error)
	// Verify signed record using keyless OIDC based provider or using PEM-encoded formatted PEM public key encrypted
	Verify(ctx context.Context, in *VerifyRequest, opts ...grpc.CallOption) (*VerifyResponse, error)
}

type SignServiceServer interface {
	// Sign record using keyless OIDC based provider or using PEM-encoded private key with an optional passphrase
	Sign(context.Context, *SignRequest) (*SignResponse, error)
	// Verify signed record using keyless OIDC based provider or using PEM-encoded formatted PEM public key encrypted
	Verify(context.Context, *VerifyRequest) (*VerifyResponse, error)
}

type SignWithKey struct {

	// Private key used for signing
	PrivateKey []byte `protobuf:"bytes,1,opt,name=private_key,json=privateKey,proto3" json:"private_key,omitempty"`
	// Password to unlock the private key
	Password []byte `protobuf:"bytes,2,opt,name=password,proto3,oneof" json:"password,omitempty"`
	// contains filtered or unexported fields
}

type SignWithOIDC struct {

	// Token for OIDC provider
	IdToken string `protobuf:"bytes,1,opt,name=id_token,json=idToken,proto3" json:"id_token,omitempty"`
	// Signing options for OIDC
	Options *SignWithOIDC_SignOpts `protobuf:"bytes,2,opt,name=options,proto3" json:"options,omitempty"`
	// contains filtered or unexported fields
}

type SignWithOIDC_SignOpts struct {

	// Fulcio authority access URL (default value: https://fulcio.sigstage.dev)
	FulcioUrl *string `protobuf:"bytes,1,opt,name=fulcio_url,json=fulcioUrl,proto3,oneof" json:"fulcio_url,omitempty"`
	// Rekor validator access URL (default value: https://rekor.sigstage.dev)
	RekorUrl *string `protobuf:"bytes,2,opt,name=rekor_url,json=rekorUrl,proto3,oneof" json:"rekor_url,omitempty"`
	// Timestamp authority access URL (default value: https://timestamp.sigstage.dev/api/v1/timestamp)
	TimestampUrl *string `protobuf:"bytes,3,opt,name=timestamp_url,json=timestampUrl,proto3,oneof" json:"timestamp_url,omitempty"`
	// OIDC provider access URL (default value: https://oauth2.sigstage.dev/auth)
	OidcProviderUrl *string `protobuf:"bytes,4,opt,name=oidc_provider_url,json=oidcProviderUrl,proto3,oneof" json:"oidc_provider_url,omitempty"`
	// contains filtered or unexported fields
}

type Signature struct {

	// Metadata associated with the signature.
	Annotations map[string]string `` /* 149-byte string literal not displayed */
	// Signing timestamp of the record in the RFC3339 format.
	// Specs: https://www.rfc-editor.org/rfc/rfc3339.html
	SignedAt string `protobuf:"bytes,2,opt,name=signed_at,json=signedAt,proto3" json:"signed_at,omitempty"`
	// The signature algorithm used (e.g., "ECDSA_P256_SHA256").
	Algorithm string `protobuf:"bytes,3,opt,name=algorithm,proto3" json:"algorithm,omitempty"`
	// Base64-encoded signature.
	Signature string `protobuf:"bytes,4,opt,name=signature,proto3" json:"signature,omitempty"`
	// Base64-encoded signing certificate.
	Certificate string `protobuf:"bytes,5,opt,name=certificate,proto3" json:"certificate,omitempty"`
	// Type of the signature content bundle.
	ContentType string `protobuf:"bytes,6,opt,name=content_type,json=contentType,proto3" json:"content_type,omitempty"`
	// Base64-encoded signature bundle produced by the signer.
	// It is up to the client to interpret the content of the bundle.
	ContentBundle string `protobuf:"bytes,7,opt,name=content_bundle,json=contentBundle,proto3" json:"content_bundle,omitempty"`
	// contains filtered or unexported fields
}

type UnimplementedSignServiceServer struct{}

type UnsafeSignServiceServer interface {
	// contains filtered or unexported methods
}

type VerifyRequest struct {

	// Record reference to be verified
	RecordRef *v1.RecordRef `protobuf:"bytes,1,opt,name=record_ref,json=recordRef,proto3" json:"record_ref,omitempty"`
	// contains filtered or unexported fields
}

type VerifyResponse struct {

	// The verify process result
	Success bool `protobuf:"varint,1,opt,name=success,proto3" json:"success,omitempty"`
	// Optional error message if verification failed
	ErrorMessage *string `protobuf:"bytes,2,opt,name=error_message,json=errorMessage,proto3,oneof" json:"error_message,omitempty"`
	// contains filtered or unexported fields
}