verifier

type Ampel struct {
	Collector *collector.Agent
	// contains filtered or unexported fields
}

type AmpelStatusChecker interface {
	GatherResults(context.Context, *StatusOptions, attestation.Subject) ([]attestation.Envelope, error)
	ParseAttestedResults(context.Context, *StatusOptions, []attestation.Envelope) ([]attestation.Predicate, error)
	CheckIdentities(*StatusOptions, []attestation.Envelope) (bool, error)
	ComputeComplianceStatus(*oscal.Catalog, []attestation.Predicate) (*Status, error)
}

type AmpelVerifier interface {
	// CheckPolicy verifies the policy is sound to evaluate before running it
	CheckPolicy(context.Context, *VerificationOptions, *papi.Policy) error
	CheckPolicySet(context.Context, *VerificationOptions, *papi.PolicySet) error
	GatherAttestations(context.Context, *VerificationOptions, *collector.Agent, *papi.Policy, attestation.Subject, []attestation.Envelope) ([]attestation.Envelope, error)
	ParseAttestations(context.Context, *VerificationOptions, attestation.Subject) ([]attestation.Envelope, error)
	BuildEvaluators(*VerificationOptions, *papi.Policy) (map[class.Class]evaluator.Evaluator, error)
	BuildTransformers(*VerificationOptions, *papi.Policy) (map[transformer.Class]transformer.Transformer, error)
	Transform(*VerificationOptions, map[transformer.Class]transformer.Transformer, *papi.Policy, attestation.Subject, []attestation.Predicate) (attestation.Subject, []attestation.Predicate, error)

	// CheckIdentities verifies that attestations are signed by the policy identities
	CheckIdentities(context.Context, *VerificationOptions, []*papi.Identity, []attestation.Envelope) (bool, [][]*papi.Identity, []error, error)

	FilterAttestations(*VerificationOptions, attestation.Subject, []attestation.Envelope, [][]*papi.Identity) ([]attestation.Predicate, error)
	AssertResult(*papi.Policy, *papi.Result) error
	AttestResults(context.Context, *VerificationOptions, papi.Results) error

	// AttestResultToWriter takes an evaluation result and writes an attestation to the supplied io.Writer
	AttestResultToWriter(io.Writer, *papi.Result) error

	// AttestResultSetToWriter takes an policy resultset and writes an attestation to the supplied io.Writer
	AttestResultSetToWriter(io.Writer, *papi.ResultSet) error

	// VerifySubject runs the verification process.
	VerifySubject(context.Context, *VerificationOptions, map[class.Class]evaluator.Evaluator, *papi.Policy, map[string]any, attestation.Subject, []attestation.Predicate) (*papi.Result, error)

	// ProcessChainedSubjects proceses the chain of attestations to find the ultimate
	// subject a policy is supposed to operate on
	ProcessChainedSubjects(context.Context, *VerificationOptions, map[class.Class]evaluator.Evaluator, *collector.Agent, *papi.Policy, map[string]any, attestation.Subject, []attestation.Envelope) (attestation.Subject, []*papi.ChainedSubject, bool, error)

	// ProcessPolicySetChainedSubjects executesd a PolicySet's ChainLink and returns
	// the resulting list of subjects from the evaluator.
	ProcessPolicySetChainedSubjects(context.Context, *VerificationOptions, map[class.Class]evaluator.Evaluator, *collector.Agent, *papi.PolicySet, map[string]any, attestation.Subject, []attestation.Envelope) ([]attestation.Subject, []*papi.ChainedSubject, bool, error)

	// AssembleEvalContextValues builds the policy context values by mixing defaults and defined values
	AssembleEvalContextValues(context.Context, *VerificationOptions, map[string]*papi.ContextVal) (map[string]any, error)
}

type PolicyError struct {
	Guidance string
	// contains filtered or unexported fields
}

type Status struct{}

type StatusOptions struct {
	ResultFiles []string
}

type VerificationOptions struct {
	// Embed the evaluator options
	options.EvaluatorOptions

	// Collectors is a collection of configured attestation fetchers
	Collectors []attestation.Fetcher

	// ContextProviders has a list of providers to read contextual data
	ContextProviders []context.Provider

	// AttestationFiles are additional attestations passed manually
	AttestationFiles []string

	// Attestations are preparsed attestations the policy evaluator receives
	// when called, usually preparsed by the PolicySet evaluator.
	Attestations []attestation.Envelope

	// DefaultEvaluator is the default evaluator we use when a policy does
	// not define one.
	DefaultEvaluator class.Class

	// AttestResults will generate an attestation of the evaluation results
	AttestResults bool

	// AttestFormat specifies the format used when AttestResults is true
	AttestFormat string

	// ResultsAttestationPath stores the path to write the results attestation
	ResultsAttestationPath string

	// SetExitCode sets a non-zero exit code on artifact verification
	SetExitCode bool

	// Policies to evaluate from a PolicySet. Default is to evaluate all.
	Policies []string

	// GitCommitShaHack enables a hack to duplicate gitCommit subjects of read
	// attestations as sha1 when reading attestations
	GitCommitShaHack bool

	// IdentityStrings feeds the signature identities to add to the policy
	// definitions when verifying signatures.
	IdentityStrings []string

	// Keys is a list of public key providers that will be used to verify signed
	// items. These keys will be supplied to verifiers when checking signatures of
	// signed stuff (ie DSSE envelopes). It is up to the policy to recognize any
	// of the matched keys as valid identities.
	//
	// Note that each signature will be verified against all keys loaded, so clients
	// are advised to load only those keys required for each policy evaluation.
	Keys []key.PublicKeyProvider

	// EnforceExpiration forces evaluations to fail when the policy or policy set
	// expiration date has passed. If no expiration date is set, this setting is ignored.
	EnforceExpiration bool

	// AllowEmptySetChains prevents the policy from failing if the chain selectors
	// don't return any mutated subjects.
	AllowEmptySetChains bool
}