v1

type PublicKey struct {

	// PEM-encoded public key string.
	Key string `protobuf:"bytes,1,opt,name=key,proto3" json:"key,omitempty"`
	// contains filtered or unexported fields
}

type SignOptionsOIDC struct {

	// Fulcio authority access URL.
	// Default: https://fulcio.sigstore.dev
	FulcioUrl string `protobuf:"bytes,1,opt,name=fulcio_url,json=fulcioUrl,proto3" json:"fulcio_url,omitempty"`
	// Rekor transparency log access URL.
	// Default: https://rekor.sigstore.dev
	RekorUrl string `protobuf:"bytes,2,opt,name=rekor_url,json=rekorUrl,proto3" json:"rekor_url,omitempty"`
	// Timestamp authority access URL.
	// Default: https://timestamp.sigstore.dev/api/v1/timestamp
	TimestampUrl string `protobuf:"bytes,3,opt,name=timestamp_url,json=timestampUrl,proto3" json:"timestamp_url,omitempty"`
	// OIDC provider access URL.
	// Default: https://oauth2.sigstore.dev/auth
	OidcProviderUrl string `protobuf:"bytes,4,opt,name=oidc_provider_url,json=oidcProviderUrl,proto3" json:"oidc_provider_url,omitempty"`
	// OIDC client ID.
	// Default: sigstore
	OidcClientId string `protobuf:"bytes,5,opt,name=oidc_client_id,json=oidcClientId,proto3" json:"oidc_client_id,omitempty"`
	// OIDC client secret.
	// Required for confidential OIDC clients that require client authentication.
	// Default: empty
	OidcClientSecret string `protobuf:"bytes,6,opt,name=oidc_client_secret,json=oidcClientSecret,proto3" json:"oidc_client_secret,omitempty"`
	// Skip uploading signature to transparency log (Rekor).
	// Set to true for private signing where transparency log upload is not desired.
	// Note: Signatures created with this option cannot be verified against Rekor.
	// Default: false
	SkipTlog bool `protobuf:"varint,7,opt,name=skip_tlog,json=skipTlog,proto3" json:"skip_tlog,omitempty"`
	// contains filtered or unexported fields
}

type SignRequest struct {

	// Record reference to be signed
	RecordRef *v1.RecordRef `protobuf:"bytes,1,opt,name=record_ref,json=recordRef,proto3" json:"record_ref,omitempty"`
	// Signing provider to use
	Provider *SignRequestProvider `protobuf:"bytes,2,opt,name=provider,proto3" json:"provider,omitempty"`
	// contains filtered or unexported fields
}

type SignRequestProvider struct {

	// Types that are valid to be assigned to Request:
	//
	//	*SignRequestProvider_Key
	//	*SignRequestProvider_Oidc
	Request isSignRequestProvider_Request `protobuf_oneof:"request"`
	// contains filtered or unexported fields
}

type SignRequestProvider_Key struct {
	// Sign with PEM-encoded public key
	Key *SignWithKey `protobuf:"bytes,1,opt,name=key,proto3,oneof"`
}

type SignRequestProvider_Oidc struct {
	// Sign with OIDC provider
	Oidc *SignWithOIDC `protobuf:"bytes,2,opt,name=oidc,proto3,oneof"`
}

type SignResponse struct {

	// Cryptographic signature of the record
	Signature *Signature `protobuf:"bytes,1,opt,name=signature,proto3" json:"signature,omitempty"`
	// contains filtered or unexported fields
}

type SignServiceClient interface {
	// Sign record using keyless OIDC based provider or
	// using PEM-encoded private key with an optional passphrase.
	Sign(ctx context.Context, in *SignRequest, opts ...grpc.CallOption) (*SignResponse, error)
	// Verify signed record using keyless OIDC based provider or
	// using PEM-encoded public key.
	Verify(ctx context.Context, in *VerifyRequest, opts ...grpc.CallOption) (*VerifyResponse, error)
}

type SignServiceServer interface {
	// Sign record using keyless OIDC based provider or
	// using PEM-encoded private key with an optional passphrase.
	Sign(context.Context, *SignRequest) (*SignResponse, error)
	// Verify signed record using keyless OIDC based provider or
	// using PEM-encoded public key.
	Verify(context.Context, *VerifyRequest) (*VerifyResponse, error)
}

type SignWithKey struct {

	// Private key for signing.
	// Accepts either:
	// - PEM-encoded private key content (inline)
	// - Reference to a private key:
	//   - File path: "/path/to/cosign.key" or "./cosign.key"
	//   - HTTP(S) URL: "https://example.com/cosign.key"
	//   - Environment variable: "env://COSIGN_PRIVATE_KEY"
	//   - AWS KMS: "awskms://[ENDPOINT]/[ID/ALIAS/ARN]"
	//   - GCP KMS: "gcpkms://projects/[PROJECT]/locations/[LOC]/keyRings/[RING]/cryptoKeys/[KEY]"
	//   - Azure Key Vault: "azurekms://[VAULT_NAME][VAULT_URI]/[KEY]"
	//   - Hashicorp Vault: "hashivault://[KEY]"
	//   - Kubernetes secret: "k8s://[NAMESPACE]/[SECRET_NAME]"
	//   - PKCS11 token: "pkcs11:token=...;slot-id=...;object=..."
	//   - GitLab: "gitlab://[PROJECT]"
	PrivateKey string `protobuf:"bytes,1,opt,name=private_key,json=privateKey,proto3" json:"private_key,omitempty"`
	// Password to unlock the private key (if encrypted).
	Password []byte `protobuf:"bytes,2,opt,name=password,proto3,oneof" json:"password,omitempty"`
	// contains filtered or unexported fields
}

type SignWithOIDC struct {

	// Token for OIDC provider
	IdToken string `protobuf:"bytes,1,opt,name=id_token,json=idToken,proto3" json:"id_token,omitempty"`
	// Signing options for OIDC
	Options *SignOptionsOIDC `protobuf:"bytes,2,opt,name=options,proto3,oneof" json:"options,omitempty"`
	// contains filtered or unexported fields
}

type Signature struct {

	// Metadata associated with the signature.
	Annotations map[string]string `` /* 149-byte string literal not displayed */
	// Signing timestamp of the record in the RFC3339 format.
	// Specs: https://www.rfc-editor.org/rfc/rfc3339.html
	SignedAt string `protobuf:"bytes,2,opt,name=signed_at,json=signedAt,proto3" json:"signed_at,omitempty"`
	// The signature algorithm used (e.g., "ECDSA_P256_SHA256").
	Algorithm string `protobuf:"bytes,3,opt,name=algorithm,proto3" json:"algorithm,omitempty"`
	// Base64-encoded signature.
	Signature string `protobuf:"bytes,4,opt,name=signature,proto3" json:"signature,omitempty"`
	// Base64-encoded signing certificate.
	Certificate string `protobuf:"bytes,5,opt,name=certificate,proto3" json:"certificate,omitempty"`
	// Type of the signature content bundle.
	ContentType string `protobuf:"bytes,6,opt,name=content_type,json=contentType,proto3" json:"content_type,omitempty"`
	// Base64-encoded signature bundle produced by the signer.
	// It is up to the client to interpret the content of the bundle.
	ContentBundle string `protobuf:"bytes,7,opt,name=content_bundle,json=contentBundle,proto3" json:"content_bundle,omitempty"`
	// contains filtered or unexported fields
}

type SignerInfo struct {

	// Types that are valid to be assigned to Type:
	//
	//	*SignerInfo_Key
	//	*SignerInfo_Oidc
	Type isSignerInfo_Type `protobuf_oneof:"type"`
	// contains filtered or unexported fields
}

type SignerInfoKey struct {

	// Public key used for verification (PEM-encoded)
	PublicKey string `protobuf:"bytes,1,opt,name=public_key,json=publicKey,proto3" json:"public_key,omitempty"`
	// Key algorithm (e.g., "ECDSA-P256", "Ed25519", "RSA")
	Algorithm string `protobuf:"bytes,2,opt,name=algorithm,proto3" json:"algorithm,omitempty"`
	// contains filtered or unexported fields
}

type SignerInfoOIDC struct {

	// OIDC issuer URL (e.g., "https://github.com/login/oauth")
	Issuer string `protobuf:"bytes,1,opt,name=issuer,proto3" json:"issuer,omitempty"`
	// OIDC subject/identity (e.g., "user@example.com")
	Subject string `protobuf:"bytes,2,opt,name=subject,proto3" json:"subject,omitempty"`
	// X.509 certificate issuer (e.g., "CN=sigstore-intermediate,O=sigstore.dev")
	CertificateIssuer string `protobuf:"bytes,3,opt,name=certificate_issuer,json=certificateIssuer,proto3" json:"certificate_issuer,omitempty"`
	// contains filtered or unexported fields
}

type SignerInfo_Key struct {
	// Key-based signer information
	Key *SignerInfoKey `protobuf:"bytes,1,opt,name=key,proto3,oneof"`
}

type SignerInfo_Oidc struct {
	// OIDC-based signer information
	Oidc *SignerInfoOIDC `protobuf:"bytes,2,opt,name=oidc,proto3,oneof"`
}

type UnimplementedSignServiceServer struct{}

type UnsafeSignServiceServer interface {
	// contains filtered or unexported methods
}

type VerifyOptionsOIDC struct {

	// TUF repository mirror URL.
	// Used to fetch trusted root material (certificates, keys) for verification.
	// Default: https://tuf-repo-cdn.sigstore.dev (public good instance)
	TufMirrorUrl string `protobuf:"bytes,1,opt,name=tuf_mirror_url,json=tufMirrorUrl,proto3" json:"tuf_mirror_url,omitempty"`
	// Path to a Sigstore TrustedRoot JSON file.
	// When provided, verification uses this file instead of fetching from TUF.
	// Required for fully offline/air-gapped verification.
	// The file contains Fulcio CAs, Rekor keys, TSA certs, and CT log keys.
	// Default: empty (uses TUF to fetch trusted root)
	TrustedRootPath string `protobuf:"bytes,2,opt,name=trusted_root_path,json=trustedRootPath,proto3" json:"trusted_root_path,omitempty"`
	// Skip transparency log (Rekor) verification.
	// Set to true for private infrastructure without Rekor,
	// or when signatures weren't uploaded to the transparency log.
	// Default: false
	IgnoreTlog bool `protobuf:"varint,3,opt,name=ignore_tlog,json=ignoreTlog,proto3" json:"ignore_tlog,omitempty"`
	// Skip timestamp authority (TSA) verification.
	// Set to true when timestamps aren't required or TSA wasn't used during signing.
	// Default: false
	IgnoreTsa bool `protobuf:"varint,4,opt,name=ignore_tsa,json=ignoreTsa,proto3" json:"ignore_tsa,omitempty"`
	// Skip Signed Certificate Timestamp (SCT) verification.
	// Set to true for private PKI where Certificate Transparency logs aren't used.
	// Default: false
	IgnoreSct bool `protobuf:"varint,5,opt,name=ignore_sct,json=ignoreSct,proto3" json:"ignore_sct,omitempty"`
	// contains filtered or unexported fields
}

type VerifyRequest struct {

	// Record reference to be verified
	RecordRef *v1.RecordRef `protobuf:"bytes,1,opt,name=record_ref,json=recordRef,proto3" json:"record_ref,omitempty"`
	// Verification provider to use
	Provider *VerifyRequestProvider `protobuf:"bytes,2,opt,name=provider,proto3" json:"provider,omitempty"`
	// When true, use cached verification result from server.
	// When false, verification is performed locally.
	FromServer bool `protobuf:"varint,3,opt,name=from_server,json=fromServer,proto3" json:"from_server,omitempty"`
	// contains filtered or unexported fields
}

type VerifyRequestProvider struct {

	// Types that are valid to be assigned to Request:
	//
	//	*VerifyRequestProvider_Key
	//	*VerifyRequestProvider_Oidc
	//	*VerifyRequestProvider_Any
	Request isVerifyRequestProvider_Request `protobuf_oneof:"request"`
	// contains filtered or unexported fields
}

type VerifyRequestProvider_Any struct {
	// Verify implicitly without providing any key or OIDC information.
	// This will attempt to verify any signature found on the record.
	// This is useful for verifying records that have been signed and have signatures attached,
	// without needing to verify against a specific key or OIDC identity.
	Any *VerifyWithAny `protobuf:"bytes,3,opt,name=any,proto3,oneof"`
}

type VerifyRequestProvider_Key struct {
	// Verify with PEM-encoded public key
	Key *VerifyWithKey `protobuf:"bytes,1,opt,name=key,proto3,oneof"`
}

type VerifyRequestProvider_Oidc struct {
	// Verify with OIDC provider
	Oidc *VerifyWithOIDC `protobuf:"bytes,2,opt,name=oidc,proto3,oneof"`
}

type VerifyResponse struct {

	// The verify process result
	Success bool `protobuf:"varint,1,opt,name=success,proto3" json:"success,omitempty"`
	// List of all signers that signed the record.
	// Each entry represents one valid signature on the record.
	Signers []*SignerInfo `protobuf:"bytes,2,rep,name=signers,proto3" json:"signers,omitempty"`
	// Optional error message if verification failed
	ErrorMessage *string `protobuf:"bytes,3,opt,name=error_message,json=errorMessage,proto3,oneof" json:"error_message,omitempty"`
	// contains filtered or unexported fields
}

type VerifyWithAny struct {

	// Verification options for OIDC.
	// This is used to verify only OIDC signatures on the record.
	// For key-based signatures, this field is ignored.
	OidcOptions *VerifyOptionsOIDC `protobuf:"bytes,1,opt,name=oidc_options,json=oidcOptions,proto3,oneof" json:"oidc_options,omitempty"`
	// contains filtered or unexported fields
}

type VerifyWithKey struct {

	// Public key to verify against.
	// Accepts either:
	// - PEM-encoded public key content (inline)
	// - Reference to a public key:
	//   - File path: "/path/to/cosign.pub" or "./cosign.pub"
	//   - HTTP(S) URL: "https://example.com/cosign.pub"
	//   - Environment variable: "env://COSIGN_PUBLIC_KEY"
	//   - AWS KMS: "awskms://[ENDPOINT]/[ID/ALIAS/ARN]"
	//   - GCP KMS: "gcpkms://projects/[PROJECT]/locations/[LOC]/keyRings/[RING]/cryptoKeys/[KEY]"
	//   - Azure Key Vault: "azurekms://[VAULT_NAME][VAULT_URI]/[KEY]"
	//   - Hashicorp Vault: "hashivault://[KEY]"
	//   - Kubernetes secret: "k8s://[NAMESPACE]/[SECRET_NAME]"
	//   - PKCS11 token: "pkcs11:token=...;slot-id=...;object=..."
	//   - GitLab: "gitlab://[PROJECT]"
	PublicKey string `protobuf:"bytes,1,opt,name=public_key,json=publicKey,proto3" json:"public_key,omitempty"`
	// contains filtered or unexported fields
}

type VerifyWithOIDC struct {

	// OIDC issuer URL.
	// Accepts exact match or regular expression (e.g., "https://github.com/login/oauth")
	Issuer string `protobuf:"bytes,1,opt,name=issuer,proto3" json:"issuer,omitempty"`
	// OIDC subject/identity.
	// Accepts exact match or regular expression (e.g., "user@example.com")
	Subject string `protobuf:"bytes,2,opt,name=subject,proto3" json:"subject,omitempty"`
	// Verification options for OIDC
	Options *VerifyOptionsOIDC `protobuf:"bytes,3,opt,name=options,proto3,oneof" json:"options,omitempty"`
	// contains filtered or unexported fields
}