sigstore

type CaCertMatcher func()

type CredentialProvider struct {
	// Instance holds the sigstore configuration (TUF options, signing config,
	// OIDC client config, verifier config).
	Instance *Instance

	// DisableSTS skips the ambient credential providers.
	DisableSTS bool

	// Token is an optional pre-provided OIDC ID token. When set, Prepare skips
	// the ambient STS providers; the token still flows through OIDConnect so
	// that it is parsed/validated the same way as a freshly issued one.
	Token *oauthflow.OIDCIDToken
	// contains filtered or unexported fields
}

type Instance struct {
	// Embed the tuf options struct
	tuf.TufOptions

	// SigningConfig holds the official sigstore signing configuration
	// (application/vnd.dev.sigstore.signingconfig.v0.2+json).
	SigningConfig *root.SigningConfig `json:"-"`

	Timestamp bool

	// AppendToRekor controls if the signing operation is recorded into the
	// transparency log.
	AppendToRekor bool `json:"rekor-append"`
	DisableSTS    bool

	// Hide the OIDC options in the CLI --help
	HideOIDCOptions bool
	// FlagPrefix adds a prefix to the CLI strings, these help grouping them
	FlagPrefix string

	// OIDCConfig holds the client-side OIDC configuration.
	OIDCConfig OIDCConfig `json:"oidc-config"`

	// VerifierConfig holds the verification policy options.
	VerifierConfig VerifierConfig `json:"verifier-config"`
}

type InstanceConfig struct {
	ID               string          `json:"id"`
	IssuerOrg        string          `json:"issuer-org"`
	SigningConfigRaw json.RawMessage `json:"signing-config"`
	Instance
}

type OIDCConfig struct {
	// RedirectURL defines the URL that the browser will redirect to.
	// If the port is set to 0, it will be randomized to a high number
	// port before starting the OIDC flow.
	RedirectURL string `json:"redirect-url"`

	// ClientID is the OIDC client ID to stamp on the tokens.
	ClientID string `json:"client-id"`

	// ClientSecret is the OIDC client secret.
	ClientSecret string `json:"client-secret"`
}

type SigstoreRoots struct {
	Roots []InstanceConfig `json:"roots"`
}

type VerifierConfig struct {
	// Look for a signed timestamp in the cert and verify with the CTLog Auth
	RequireCTlog bool `json:"require-ct-log"`
	// Verify the cert validity in the transparency log
	RequireTlog bool `json:"require-tlog"`
	// Verify the certificate validity time with a signed timestamp
	RequireSignedTimestamps bool `json:"require-signed-timestamps"`
	// Require an observer timestamp for verification
	RequireObserverTimestamp bool `json:"require-observer-timestamp"`
}