sigstore

type CaCertMatcher func()

type Instance struct {
	// Embed the tuf options struct
	tuf.TufOptions

	Timestamp bool

	// AppendToRekor controls if the signing operation is recorded into the
	// transparency log.
	AppendToRekor bool `json:"rekor-append"`
	DisableSTS    bool

	// FulcioURL url of the Fulcio CA (defaults to the public good instance)
	FulcioURL string `json:"fulcio-url"`

	// RekorURL url of the Rekor transparency log (defaults to the public good instance)
	RekorURL string `json:"rekor-url"`

	// Hide the OIDC options in the CLI --help
	HideOIDCOptions bool
	// FlagPrefix adds a prefix to the CLI strings, these help grouping them
	FlagPrefix string

	// OidcRedirectURL defines the URL that the browser will redirect to.
	// if the port is set to 0, bind will randomize it to a high number
	// port before starting the OIDC flow.
	OidcRedirectURL string `json:"oidc-redirect-url"`

	// OIDC token issuer endpoint
	OidcIssuer string `json:"oidc-issuer"`

	// Client ID to stamp on the tokens
	OidcClientID string `json:"oidc-client-id"`

	// Client secret to pass in OIDC calls
	OidcClientSecret string `json:"oidc-client-secret"`

	// Look for a signed timestamp in the cert and verify with the CTLog Auth
	RequireCTlog bool `json:"require-ct-log"`
	// Verify the cert validity in the transparency log
	RequireTlog bool `json:"require-tlog"`
	// Verify the certificate validity time with a signed timestamp
	RequireSignedTimestamps bool `json:"require-signed-timestamps"`
	// Allow no timestamp, for keys instead of certs
	RequireObserverTimestamp bool `json:"require-observer-timestamp"`
}

type InstanceConfig struct {
	ID        string `json:"id"`
	IssuerOrg string `json:"issuer-org"`
	Instance
}

type SigstoreRoots struct {
	Roots []InstanceConfig `json:"roots"`
}