bnd

type BundleSigner interface {
	VerifyContent(*SignerOptions, []byte) error
	WrapStatement([]byte) *sign.DSSEData
	GetKeyPair(*SignerOptions) (*sign.EphemeralKeypair, error)
	GetAmbienTokens(*SignerOptions) error
	GetOidcToken(*SignerOptions) error
	BuildSigstoreSignerOptions(*SignerOptions) (*sign.BundleOptions, error)
	SignBundle(content sign.Content, keypair sign.Keypair, opts *sign.BundleOptions) (*v1.Bundle, error)
}

type BundleVerifier interface {
	OpenBundle(string) (*bundle.Bundle, error)
	BuildSigstoreVerifier(*VerificationOptions) (VerifyCapable, error)
	RunVerification(*VerificationOptions, VerifyCapable, *bundle.Bundle) (*verify.VerificationResult, error)
}

type Signer struct {
	Options SignerOptions
	// contains filtered or unexported fields
}

type SignerOptions struct {
	TufOptions
	Token         *oauthflow.OIDCIDToken
	Timestamp     bool
	AppendToRekor bool
	DisableSTS    bool

	// OidcRedirectURL defines the URL that the browser will redirect to.
	// if the port is set to 0, bind will randomize it to a high number
	// port before starting the OIDC flow.
	OidcRedirectURL  string
	OidcIssuer       string
	OidcClientID     string
	OidcClientSecret string
}

type TufOptions struct {
	Fetcher     fetcher.Fetcher
	TufRootPath string
	TufRootURL  string
}

type VerificationOptions struct {
	TufOptions
	ArtifactDigest      string
	ArtifactDigestAlgo  string
	ExpectedIssuer      string
	ExpectedIssuerRegex string
	ExpectedSan         string
	ExpectedSanRegex    string
	SkipIdentityCheck   bool
	RequireCTlog        bool
	RequireTimestamp    bool
	RequireTlog         bool
}

type Verifier struct {
	Options VerificationOptions
	// contains filtered or unexported fields
}

type VerifyCapable interface {
	Verify(verify.SignedEntity, verify.PolicyBuilder) (*verify.VerificationResult, error)
}