vsa

type Attestor struct {
	PredicatePath string  // path to the raw VSA (predicate) JSON
	PredicateType string  // e.g. "https://enterprisecontract.dev/attestations/vsa/v1" // TODO: make this configurable
	Digest        string  // sha256:abcd…  (as returned by `skopeo inspect --format {{.Digest}}`)
	Repo          string  // "quay.io/acme/widget" (hostname/namespace/repo)
	Signer        *Signer // Signer is the signer used to sign the VSA
}

type ComponentDetail struct {
	Name       string `json:"Name"`
	ImageRef   string `json:"ImageRef"`
	Violations int    `json:"Violations"`
	Warnings   int    `json:"Warnings"`
	Successes  int    `json:"Successes"`
}

type ComponentResult struct {
	ComponentName string
	ImageRef      string
	Result        *ValidationResult
	Error         error
}

type ComponentSummary struct {
	Name           string      `json:"name"`
	ContainerImage string      `json:"containerImage"`
	Source         interface{} `json:"source"`
}

type FileVSARetriever struct {
	// contains filtered or unexported fields
}

type FileVSARetrieverOptions struct {
	BasePath string
	FS       afero.Fs
}

type Generator struct {
	Report       applicationsnapshot.Report
	Component    applicationsnapshot.Component
	PolicySource string
	Policy       PublicKeyProvider
}

type IdentifierType int

type InTotoStatement struct {
	Type          string    `json:"_type"`
	PredicateType string    `json:"predicateType"`
	Subject       []Subject `json:"subject"`
	Predicate     Predicate `json:"predicate"`
}

type LocalBackend struct {
	// contains filtered or unexported fields
}

type Predicate struct {
	Policy       ecapi.EnterpriseContractPolicySpec `json:"policy"`
	PolicySource string                             `json:"policySource"`
	ImageRefs    []string                           `json:"imageRefs"`
	Timestamp    string                             `json:"timestamp"`
	Status       string                             `json:"status"`
	Verifier     string                             `json:"verifier"`
	Summary      VSASummary                         `json:"summary"`
	PublicKey    string                             `json:"publicKey"`
}

type PredicateAttestor interface {
	AttestPredicate(ctx context.Context) ([]byte, error)
	WriteEnvelope(data []byte) (string, error)
	TargetDigest() string
}

type PredicateGenerator[T any] interface {
	GeneratePredicate(ctx context.Context) (T, error)
}

type PredicateWriter[T any] interface {
	WritePredicate(pred T) (string, error)
}

type PublicKeyProvider interface {
	PublicKeyPEM() ([]byte, error)
}

type RekorBackend struct {
	// contains filtered or unexported fields
}

type RekorClient interface {
	SearchIndex(ctx context.Context, query *models.SearchIndex) ([]models.LogEntryAnon, error)
	SearchLogQuery(ctx context.Context, query *models.SearchLogQuery) ([]models.LogEntryAnon, error)
	GetLogEntryByIndex(ctx context.Context, index int64) (*models.LogEntryAnon, error)
	GetLogEntryByUUID(ctx context.Context, uuid string) (*models.LogEntryAnon, error)
}

type RekorVSARetriever struct {
	// contains filtered or unexported fields
}

type RetrievalOptions struct {
	URL     string
	Timeout time.Duration
}

type Service struct {
	// contains filtered or unexported fields
}

type Signer struct {
	KeyPath        string
	FS             afero.Fs
	WrapSigner     signature.Signer
	SignerVerifier signature.SignerVerifier // Store the original signer for public key access
}

type SignerAwareUploader interface {
	StorageBackend
	UploadWithSigner(ctx context.Context, envelopeContent []byte, signer *Signer) (string, error)
}

type StorageBackend interface {
	Name() string
	Upload(ctx context.Context, envelopeContent []byte) error
}

type StorageConfig struct {
	Backend    string            // rekor, local (maybe others in future)
	BaseURL    string            // Primary URL
	Parameters map[string]string // Additional parameters
}

type Subject struct {
	Name   string            `json:"name"`
	Digest map[string]string `json:"digest"`
}

type VSAChecker struct {
	// contains filtered or unexported fields
}

type VSALookupResult struct {
	Found             bool
	Expired           bool
	VSA               *Predicate
	Timestamp         time.Time
	Envelope          *ssldsse.Envelope // Store the envelope for signature verification
	SignatureVerified bool              // Whether signature verification was performed and succeeded
}

type VSAProcessingResult struct {
	ComponentEnvelopes map[string]string // imageRef -> envelopePath
	SnapshotEnvelope   string
}

type VSARetriever interface {
	// RetrieveVSA retrieves VSA data as a DSSE envelope for a given identifier
	// The identifier can be a digest, image reference, file path, or any other string
	// that the specific retriever implementation understands
	RetrieveVSA(ctx context.Context, identifier string) (*ssldsse.Envelope, error)
}

type VSASummary struct {
	Violations int               `json:"violations"`
	Warnings   int               `json:"warnings"`
	Successes  int               `json:"successes"`
	Components []ComponentDetail `json:"Components"`
	Component  ComponentSummary  `json:"component"`
}

type ValidationData struct {
	Retriever                   VSARetriever
	VSAExpiration               time.Duration
	IgnoreSignatureVerification bool
	PublicKeyPath               string
	PolicySpec                  ecapi.EnterpriseContractPolicySpec
	EffectiveTime               string
}

type ValidationResult struct {
	Passed            bool   `json:"passed"`
	Message           string `json:"message,omitempty"`
	SignatureVerified bool   `json:"signature_verified,omitempty"`
}

type Writer struct {
	FS            afero.Fs    // defaults to the package-level FS or afero.NewOsFs()
	TempDirPrefix string      // defaults to "vsa-"
	FilePerm      os.FileMode // defaults to 0600
}