vsa

type Attestor struct {
	PredicatePath string  // path to the raw VSA (predicate) JSON
	PredicateType string  // e.g. "https://enterprisecontract.dev/attestations/vsa/v1" // TODO: make this configurable
	Digest        string  // sha256:abcd…  (as returned by `skopeo inspect --format {{.Digest}}`)
	Repo          string  // "quay.io/acme/widget" (hostname/namespace/repo)
	Signer        *Signer // Signer is the signer used to sign the VSA
}

type Cause struct {
	Type      string  `json:"type"` // "vsa", "fallback", "network", "policy", etc.
	Message   string  `json:"message"`
	Details   string  `json:"details,omitempty"`
	SubCauses []Cause `json:"sub_causes,omitempty"`
	Timestamp string  `json:"timestamp,omitempty"`
	Severity  string  `json:"severity,omitempty"` // "error", "warning", "info"
}

type ComponentDetail struct {
	Name       string `json:"Name"`
	ImageRef   string `json:"ImageRef"`
	Violations int    `json:"Violations"`
	Warnings   int    `json:"Warnings"`
	Successes  int    `json:"Successes"`
}

type ComponentResult struct {
	ComponentName  string
	ImageRef       string
	Result         *ValidationResult // VSA validation result
	Error          error
	FallbackResult *validate_utils.Result // Image validation result when fallback was used
}

type ComponentSummary struct {
	Name           string      `json:"name"`
	ContainerImage string      `json:"containerImage"`
	Source         interface{} `json:"source"`
}

type FallbackConfig struct {
	FallbackToImageValidation bool
	FallbackPublicKey         string
	PolicyConfig              string
	EffectiveTime             string
	Info                      interface{}
}

type FallbackResult struct {
	FallbackOutput *output.Output
	VSAResult      *ValidationResult
	Error          error
}

type FallbackValidationContext struct {
	PolicyConfiguration string
	FallbackPolicy      policy.Policy
}

type FileVSARetriever struct {
	// contains filtered or unexported fields
}

type FileVSARetrieverOptions struct {
	BasePath string
	FS       afero.Fs
}

type Generator struct {
	Report       applicationsnapshot.Report
	Component    applicationsnapshot.Component
	PolicySource string
	Policy       PublicKeyProvider
}

type IdentifierType int

type ImageValidationResult struct {
	Passed     bool                    `json:"passed"`
	Violations []evaluator.Result      `json:"violations,omitempty"`
	Warnings   []evaluator.Result      `json:"warnings,omitempty"`
	Successes  []evaluator.Result      `json:"successes,omitempty"`
	Summary    *ImageValidationSummary `json:"summary,omitempty"`
}

type ImageValidationSummary struct {
	TotalViolations int `json:"total_violations"`
	TotalWarnings   int `json:"total_warnings"`
	TotalSuccesses  int `json:"total_successes"`
}

type InTotoStatement struct {
	Type          string    `json:"_type"`
	PredicateType string    `json:"predicateType"`
	Subject       []Subject `json:"subject"`
	Predicate     Predicate `json:"predicate"`
}

type LocalBackend struct {
	// contains filtered or unexported fields
}

type PolicyDiff struct {
	Added   int `json:"added"`
	Removed int `json:"removed"`
	Changed int `json:"changed"`
}

type Predicate struct {
	Policy       ecapi.EnterpriseContractPolicySpec `json:"policy"`
	PolicySource string                             `json:"policySource"`
	ImageRefs    []string                           `json:"imageRefs"`
	Timestamp    string                             `json:"timestamp"`
	Status       string                             `json:"status"`
	Verifier     string                             `json:"verifier"`
	Summary      VSASummary                         `json:"summary"`
	PublicKey    string                             `json:"publicKey"`
}

type PredicateAttestor interface {
	AttestPredicate(ctx context.Context) ([]byte, error)
	WriteEnvelope(data []byte) (string, error)
	TargetDigest() string
}

type PredicateGenerator[T any] interface {
	GeneratePredicate(ctx context.Context) (T, error)
}

type PredicateWriter[T any] interface {
	WritePredicate(pred T) (string, error)
}

type PublicKeyProvider interface {
	PublicKeyPEM() ([]byte, error)
}

type RekorBackend struct {
	// contains filtered or unexported fields
}

type RekorClient interface {
	SearchIndex(ctx context.Context, query *models.SearchIndex) ([]models.LogEntryAnon, error)
	SearchLogQuery(ctx context.Context, query *models.SearchLogQuery) ([]models.LogEntryAnon, error)
	GetLogEntryByIndex(ctx context.Context, index int64) (*models.LogEntryAnon, error)
	GetLogEntryByUUID(ctx context.Context, uuid string) (*models.LogEntryAnon, error)
}

type RekorVSARetriever struct {
	// contains filtered or unexported fields
}

type ResultSummary struct {
	TotalViolations int `json:"total_violations"`
	TotalWarnings   int `json:"total_warnings"`
	TotalSuccesses  int `json:"total_successes"`
}

type RetrievalOptions struct {
	URL     string
	Timeout time.Duration
}

type Service struct {
	// contains filtered or unexported fields
}

type Signer struct {
	KeyPath        string
	FS             afero.Fs
	WrapSigner     signature.Signer
	SignerVerifier signature.SignerVerifier // Store the original signer for public key access
}

type SignerAwareUploader interface {
	StorageBackend
	UploadWithSigner(ctx context.Context, envelopeContent []byte, signer *Signer) (string, error)
}

type StorageBackend interface {
	Name() string
	Upload(ctx context.Context, envelopeContent []byte) error
}

type StorageConfig struct {
	Backend    string            // rekor, local (maybe others in future)
	BaseURL    string            // Primary URL
	Parameters map[string]string // Additional parameters
}

type Subject struct {
	Name   string            `json:"name"`
	Digest map[string]string `json:"digest"`
}

type VSAChecker struct {
	// contains filtered or unexported fields
}

type VSALookupResult struct {
	Found             bool
	Expired           bool
	VSA               *Predicate
	Timestamp         time.Time
	Envelope          *ssldsse.Envelope // Store the envelope for signature verification
	SignatureVerified bool              // Whether signature verification was performed and succeeded
}

type VSAPhaseResult struct {
	Passed           bool   `json:"passed"`
	Message          string `json:"message,omitempty"`
	Failed           string `json:"failed,omitempty"`
	Reason           string `json:"reason,omitempty"`            // Human-readable reason
	PredicateOutcome string `json:"predicate_outcome,omitempty"` // Outcome from VSA predicate
}

type VSAProcessingResult struct {
	ComponentEnvelopes map[string]string // imageRef -> envelopePath
	SnapshotEnvelope   string
}

type VSARetriever interface {
	// RetrieveVSA retrieves VSA data as a DSSE envelope for a given identifier
	// The identifier can be a digest, image reference, file path, or any other string
	// that the specific retriever implementation understands
	RetrieveVSA(ctx context.Context, identifier string) (*ssldsse.Envelope, error)
}

type VSASummary struct {
	Violations int               `json:"violations"`
	Warnings   int               `json:"warnings"`
	Successes  int               `json:"successes"`
	Components []ComponentDetail `json:"Components"`
	Component  ComponentSummary  `json:"component"`
}

type VSAValidationConfig struct {
	Retriever                   VSARetriever
	VSAExpiration               time.Duration
	IgnoreSignatureVerification bool
	PublicKeyPath               string
	PolicySpec                  ecapi.EnterpriseContractPolicySpec
	EffectiveTime               string
}

type VSAValidationResult struct {
	// VSA-specific results
	VSAPhaseResult *VSAPhaseResult `json:"vsa_phase_result,omitempty"`

	// Image validation results
	ImageValidationResult *ImageValidationResult `json:"image_validation_result,omitempty"`

	// Overall status
	OverallSuccess bool   `json:"overall_success"`
	UsedFallback   bool   `json:"used_fallback"`
	ImageRef       string `json:"image_ref"`

	// Summary
	Summary *ResultSummary `json:"summary,omitempty"`

	// Structured error information
	Error *ValidationError `json:"error,omitempty"`
}

type ValidationError struct {
	Message string  `json:"message"`
	Causes  []Cause `json:"causes"`
}

type ValidationResult struct {
	Passed            bool   `json:"passed"`
	Message           string `json:"message,omitempty"`
	SignatureVerified bool   `json:"signature_verified,omitempty"`
	PredicateOutcome  string `json:"predicate_outcome,omitempty"` // Outcome from VSA predicate

	// Structured fields for reliable extraction (prefer over message parsing)
	ReasonCode string      `json:"reason_code,omitempty"` // Structured reason code: "policy_mismatch", "predicate_failed", "no_vsa", "expired", "retrieval_failed"
	PolicyDiff *PolicyDiff `json:"policy_diff,omitempty"` // Policy difference counts (only set when ReasonCode is "policy_mismatch")
}

type WorkerFallbackContext struct {
	Evaluators []evaluator.Evaluator
}

type Writer struct {
	FS            afero.Fs    // defaults to the package-level FS or afero.NewOsFs()
	TempDirPrefix string      // defaults to "vsa-"
	FilePerm      os.FileMode // defaults to 0600
}