bundle

type BundleOptsFunc func(*DefaultVerifier) error

type CredentialProvider interface {
	// Prepare acquires credentials, keys, and certificates. Called once
	// before the first sign; implementations are expected to be idempotent.
	Prepare(ctx context.Context) error

	// Keypair returns the signing keypair used by sign.Bundle.
	Keypair() sign.Keypair

	// CertificateProvider returns the provider sign.Bundle will call to
	// populate VerificationMaterial, together with any provider-specific
	// options (e.g. an OIDC ID token for Fulcio).
	CertificateProvider() (sign.CertificateProvider, *sign.CertificateProviderOptions)

	// Intermediates returns the certificates between the leaf and the trust
	// anchor, in order from leaf-adjacent to root-adjacent. The root itself
	// must NOT be included — verifiers supply it out-of-band.
	//
	// Returns nil when there are no intermediates to embed (the sigstore
	// case, where the chain is reconstructed from TUF at verify time). When
	// the return value is non-empty, the outer Signer rewrites the bundle's
	// VerificationMaterial to carry [leaf, ...intermediates] so the verifier
	// can build a path to its pinned trust anchor.
	Intermediates() []*x509.Certificate
}

type DefaultSigner struct{}

type DefaultVerifier struct {
	Verifiers []VerifyCapable

	// SPIFFE, when set, handles bundles whose leaf certificate carries a
	// spiffe:// URI SAN. Constructed outside this package (typically in
	// signer.NewVerifier) to avoid a bundle -> spiffe import dependency.
	SPIFFE SpiffeVerifier
}

type Signer interface {
	VerifyAttestationContent(*options.Signer, []byte) error
	WrapData(payloadType string, data []byte) *sign.DSSEData
	BuildMessage(data []byte) *sign.PlainData
	BuildBundleOptions(*options.Signer, CredentialProvider) (*sign.BundleOptions, error)
	SignBundle(content sign.Content, keypair sign.Keypair, opts *sign.BundleOptions) (*protobundle.Bundle, error)
}

type SpiffeVerifier interface {
	Verify(*options.Verification, *bundle.Bundle) (*verify.VerificationResult, error)
}

type Verifier interface {
	Verify(*options.Verification, *bundle.Bundle) (*verify.VerificationResult, error)
	OpenBundle(string) (*bundle.Bundle, error)
	BuildSigstoreVerifier(*sigstore.InstanceConfig) (VerifyCapable, error)
	RunVerification(*options.SigstoreVerification, VerifyCapable, *bundle.Bundle) (*verify.VerificationResult, error)
}

type VerifyCapable interface {
	Verify(verify.SignedEntity, verify.PolicyBuilder) (*verify.VerificationResult, error)
}