lock

type Asset struct {
	Name             string
	Version          string
	PURL             string
	Type             string
	Format           string
	Path             string
	Out              string
	URL              string
	Integrity        string
	Size             int64
	PackageIntegrity string
	License          string
	// Repository is the package's *declared* repository URL. NOT to
	// be conflated with Attestation.SourceRepository (the repo the
	// attestation says the build came from); the
	// publisher-matches-repository check compares the two.
	Repository  string
	Attestation *Attestation
}

type AssetType string

type Attestation struct {
	PredicateType    string
	BuilderID        string
	SourceRepository string
	SourceRevision   string
	SignerIdentity   string
	BundleURL        string
}

type Changes struct {
	Added     []Asset
	Updated   []Asset
	Removed   []Asset
	Unchanged []Asset
}

type Lock struct {
	LockfileVersion int
	GeneratedBy     string
	OutDir          string
	Assets          []Asset
}