options

type BundleVerifier struct {
	// RootsFile path to roots file
	RootsFile string
}

type KeyVerification struct {
	PubKeys []crypto.PublicKey
}

type Sign struct {
	// PayloadType is the payload type to be declared in DSSE envelopes
	PayloadType string

	// PrivateKeys for DSSE envelope signing. These will be honored later
	// to reuse in bundle signing
	Keys []key.PrivateKeyProvider
}

type SignOptFn = func(*Sign) error

type Signer struct {
	Sigstore
	Token             *oauthflow.OIDCIDToken
	SigstoreRootsData []byte
	// contains filtered or unexported fields
}

type Sigstore struct {
	sigstore.Instance
}

type SigstoreVerification struct {
	// ExpectedIssuer and ExpectedSan define the issuer and SAN to look for in
	// the fulcio cert. For a broader matching behavior, choose the *Regex
	// alternatives.
	//
	// Verification will fail if thse are not set. To skip the identity check
	// set SkipIdentityCheck to true.
	ExpectedIssuer      string
	ExpectedIssuerRegex string
	ExpectedSan         string
	ExpectedSanRegex    string

	// SkipIdentityCheck makes the verifier skip the identity check. This
	// will ignore any setting in ExpectedIssuer ExpectedIssuerRegex
	// ExpectedSan or ExpectedSanRegex
	SkipIdentityCheck bool

	// Artifact digest to check when verifier in addition to the signature
	ArtifactDigestAlgo string
	ArtifactDigest     string
}

type Verification struct {
	SigstoreVerification
	KeyVerification
}

type VerificationOptFunc func(*Verification) error

type Verifier struct {
	// The verifier options embed a set of verification options. These are
	// treated as defaults when calling the sigstore/dsse verifiers
	Verification

	// SigstoreRootsPath is the path to a sigstore roots file
	SigstoreRootsPath string

	// SigstoreRootsData holds raw json with data about the configured roots
	SigstoreRootsData []byte
}

type VerifierOptFunc func(*Verifier)