cosign

type Bundle struct {
	Signature   string `json:"base64Signature"`
	Certificate string `json:"cert"`
	RekorBundle Rekor  `json:"rekorBundle"`
}

type Payload struct {
	Body           string `json:"body"`
	IntegratedTime int64  `json:"integratedTime"`
	LogIndex       int64  `json:"logIndex"`
	LogID          string `json:"logID"`
}

type Rekor struct {
	SignedEntryTimestamp string  `json:"SignedEntryTimestamp"`
	Payload              Payload `json:"Payload"`
}

type SigstoreBundle struct {
	MediaType            string                       `json:"mediaType"`
	VerificationMaterial SigstoreVerificationMaterial `json:"verificationMaterial"`
	MessageSignature     *SigstoreMessageSignature    `json:"messageSignature,omitempty"`
}

type SigstoreMessageDigest struct {
	Algorithm string `json:"algorithm"`
	Digest    string `json:"digest"`
}

type SigstoreMessageSignature struct {
	MessageDigest *SigstoreMessageDigest `json:"messageDigest,omitempty"`
	Signature     string                 `json:"signature"`
}

type SigstorePublicKeyIdentifier struct {
	Hint string `json:"hint"`
}

type SigstoreVerificationMaterial struct {
	// Certificate is the leaf signing certificate (raw DER, base64 encoded in JSON).
	Certificate *SigstoreX509Certificate `json:"certificate,omitempty"`
	// PublicKey references a public key by hint (used for keyed signing).
	PublicKey *SigstorePublicKeyIdentifier `json:"publicKey,omitempty"`
	// X509CertificateChain is the legacy v0.1 location for the signing cert
	// (kept for compatibility with bundles emitted by older tooling).
	X509CertificateChain *SigstoreX509CertificateChain `json:"x509CertificateChain,omitempty"`
}

type SigstoreX509Certificate struct {
	RawBytes string `json:"rawBytes"`
}

type SigstoreX509CertificateChain struct {
	Certificates []SigstoreX509Certificate `json:"certificates,omitempty"`
}