vsa

type AttestationUploader func(ctx context.Context, att oci.Signature, location string) (string, error)

type Attestor struct {
	PredicatePath string  // path to the raw VSA (predicate) JSON
	PredicateType string  // e.g. "https://enterprisecontract.dev/attestations/vsa/v1" // TODO: make this configurable
	Digest        string  // sha256:abcd…  (as returned by `skopeo inspect --format {{.Digest}}`)
	Repo          string  // "quay.io/acme/widget" (hostname/namespace/repo)
	Signer        *Signer // Signer is the signer used to sign the VSA
}

type DualEntryPair struct {
	PayloadHash string
	IntotoEntry *models.LogEntryAnon
	DSSEEntry   *models.LogEntryAnon
}

type FilteredReport struct {
	Snapshot      string                           `json:"snapshot"`
	Components    []applicationsnapshot.Component  `json:"components"`
	Key           string                           `json:"key"`
	Policy        ecc.EnterpriseContractPolicySpec `json:"policy"`
	EcVersion     string                           `json:"ec-version"`
	EffectiveTime time.Time                        `json:"effective-time"`
}

type Generator struct {
	Report    applicationsnapshot.Report
	Component applicationsnapshot.Component
}

type LocalBackend struct {
	// contains filtered or unexported fields
}

type PairedVSAWithSignatures struct {
	PayloadHash   string                   `json:"payloadHash"`
	VSAStatement  []byte                   `json:"vsaStatement"`
	Signatures    []map[string]interface{} `json:"signatures"`
	IntotoEntry   *models.LogEntryAnon     `json:"intotoEntry"`
	DSSEEntry     *models.LogEntryAnon     `json:"dsseEntry"`
	PredicateType string                   `json:"predicateType"`
}

type Predicate struct {
	ImageRef     string                 `json:"imageRef"`
	Timestamp    string                 `json:"timestamp"`
	Verifier     string                 `json:"verifier"`
	PolicySource string                 `json:"policySource"`
	Component    map[string]interface{} `json:"component"`
	Results      *FilteredReport        `json:"results,omitempty"` // Filtered report containing the target and its children if it's a manifest
}

type PredicateAttestor interface {
	AttestPredicate(ctx context.Context) ([]byte, error)
	WriteEnvelope(data []byte) (string, error)
	TargetDigest() string
}

type PredicateGenerator[T any] interface {
	GeneratePredicate(ctx context.Context) (T, error)
}

type PredicateWriter[T any] interface {
	WritePredicate(pred T) (string, error)
}

type RekorBackend struct {
	// contains filtered or unexported fields
}

type RekorClient interface {
	SearchIndex(ctx context.Context, query *models.SearchIndex) ([]models.LogEntryAnon, error)
	SearchLogQuery(ctx context.Context, query *models.SearchLogQuery) ([]models.LogEntryAnon, error)
	GetLogEntryByIndex(ctx context.Context, index int64) (*models.LogEntryAnon, error)
	GetLogEntryByUUID(ctx context.Context, uuid string) (*models.LogEntryAnon, error)
}

type RekorVSARetriever struct {
	// contains filtered or unexported fields
}

type RetrievalOptions struct {
	URL     string
	Timeout time.Duration
}

type Service struct {
	// contains filtered or unexported fields
}

type Signer struct {
	KeyPath        string
	FS             afero.Fs
	WrapSigner     signature.Signer
	SignerVerifier signature.SignerVerifier // Store the original signer for public key access
}

type SignerAwareUploader interface {
	StorageBackend
	UploadWithSigner(ctx context.Context, envelopeContent []byte, signer *Signer) (string, error)
}

type StorageBackend interface {
	Name() string
	Upload(ctx context.Context, envelopeContent []byte) error
}

type StorageConfig struct {
	Backend    string            // rekor, local (maybe others in future)
	BaseURL    string            // Primary URL
	Parameters map[string]string // Additional parameters
}

type VSAProcessingResult struct {
	ComponentEnvelopes map[string]string // imageRef -> envelopePath
	SnapshotEnvelope   string
}

type VSARecord struct {
	LogIndex       int64                            `json:"logIndex"`
	LogID          string                           `json:"logID"`
	IntegratedTime int64                            `json:"integratedTime"`
	UUID           string                           `json:"uuid"`
	Body           string                           `json:"body"`
	Attestation    *models.LogEntryAnonAttestation  `json:"attestation,omitempty"`
	Verification   *models.LogEntryAnonVerification `json:"verification,omitempty"`
}

type VSARetriever interface {
	// RetrieveVSA retrieves VSA records for a given image digest
	RetrieveVSA(ctx context.Context, imageDigest string) ([]VSARecord, error)
	// FindByPayloadHash retrieves dual entries by payload hash
	FindByPayloadHash(ctx context.Context, payloadHashHex string) (*DualEntryPair, error)
	// GetPairedVSAWithSignatures retrieves a VSA with its corresponding signatures by payloadHash
	// This ensures the signatures actually correspond to the VSA Statement being evaluated
	GetPairedVSAWithSignatures(ctx context.Context, payloadHashHex string) (*PairedVSAWithSignatures, error)
	// FindLatestMatchingPair finds the latest pair where intoto has attestation and DSSE matches
	FindLatestMatchingPair(ctx context.Context, entries []models.LogEntryAnon) *DualEntryPair
}

type Writer struct {
	FS            afero.Fs    // defaults to the package-level FS or afero.NewOsFs()
	TempDirPrefix string      // defaults to "vsa-"
	FilePerm      os.FileMode // defaults to 0600
}