options

type Sign struct {
	// PayloadType is the payload type to be declared in DSSE envelopes
	PayloadType string

	// PrivateKeys for DSSE envelope signing. These will be honored later
	// to reuse in bundle signing
	Keys []key.PrivateKeyProvider
}

type SignOptFn = func(*Sign) error

type Signer struct {
	tuf.TufOptions
	Token         *oauthflow.OIDCIDToken
	Timestamp     bool
	AppendToRekor bool
	DisableSTS    bool

	// OidcRedirectURL defines the URL that the browser will redirect to.
	// if the port is set to 0, bind will randomize it to a high number
	// port before starting the OIDC flow.
	OidcRedirectURL  string
	OidcIssuer       string
	OidcClientID     string
	OidcClientSecret string
}

type Verifier struct {
	tuf.TufOptions
	// Artifact digest to check when verifier in addition to the signature
	ArtifactDigestAlgo string
	ArtifactDigest     string

	// ExpectedIssuer and ExpectedSan define the issuer and SAN to look for in
	// the fulcio cert. For a broader matching behavior, choose the *Regex
	// alternatives.
	// Verification will fail if thse are not set. To skip the identity check
	// set SkipIdentityCheck to true.
	ExpectedIssuer      string
	ExpectedIssuerRegex string
	ExpectedSan         string
	ExpectedSanRegex    string

	// SkipIdentityCheck makes the verifier skip the identity check. This
	// will ignore any setting in ExpectedIssuer ExpectedIssuerRegex
	// ExpectedSan or ExpectedSanRegex
	SkipIdentityCheck bool

	RequireCTlog     bool
	RequireTimestamp bool
	RequireTlog      bool

	// Public keys to verify DSSE envelopes
	PubKeys []crypto.PublicKey
}

type VerifierOptFunc func(*Verifier) error