verifier

type AttestClients struct {
	GCA Client
	ITA Client
}

type Challenge struct {
	// Used as audience for GCP credential tokens.
	Name string
	// Used to generate attestation.
	Nonce     []byte
	ConnID    string
	Val       []byte
	Iat       []byte
	Signature []byte
}

type Client interface {
	CreateChallenge(ctx context.Context) (*Challenge, error)
	VerifyAttestation(ctx context.Context, request VerifyAttestationRequest) (*VerifyAttestationResponse, error)
	VerifyConfidentialSpace(ctx context.Context, request VerifyAttestationRequest) (*VerifyAttestationResponse, error)
}

type ContainerSignature struct {
	Payload   []byte
	Signature []byte
}

type ITAConfig struct {
	ITARegion string
	ITAKey    string
}

type TDCCELAttestation struct {
	CcelAcpiTable     []byte
	CcelData          []byte
	CanonicalEventLog []byte
	TdQuote           []byte
	// still needs following two for GCE info
	AkCert            []byte
	IntermediateCerts [][]byte
	NvidiaAttestation *csattestpb.NvidiaAttestationReport
}

type VerifyAttestationRequest struct {
	Challenge      *Challenge
	GcpCredentials [][]byte
	// Attestation is for TPM attestation
	Attestation              *attestpb.Attestation
	ContainerImageSignatures []*ContainerSignature
	TokenOptions             *models.TokenOptions
	// TDCCELAttestation is for TDX CCEL RTMR attestation
	TDCCELAttestation *TDCCELAttestation
}

type VerifyAttestationResponse struct {
	ClaimsToken []byte
	PartialErrs []*status.Status
}