offline

type AttestationResult struct {
	Type             string   `json:"type"`
	Subject          *Subject `json:"subject,omitempty"`
	Verified         bool     `json:"verified"`
	SignatureValid   bool     `json:"signatureValid"`
	CertificateValid bool     `json:"certificateValid"`
	TLogVerified     bool     `json:"tlogVerified"`
	Error            string   `json:"error,omitempty"`
	Warnings         []string `json:"warnings,omitempty"`
}

type CertificateIdentity struct {
	SubjectAlternativeName string `json:"subjectAlternativeName"`
	Issuer                 string `json:"issuer"`
}

type OfflineVerifier struct {
	// contains filtered or unexported fields
}

type Subject struct {
	Name   string            `json:"name"`
	Digest map[string]string `json:"digest"`
}

type VerificationResult struct {
	Verified            bool                `json:"verified"`
	Attestations        []AttestationResult `json:"attestations"`
	CertificateIdentity interface{}         `json:"certificateIdentity,omitempty"`
	PolicyCompliance    map[string]bool     `json:"policyCompliance,omitempty"`
	Errors              []string            `json:"errors,omitempty"`
	Warnings            []string            `json:"warnings,omitempty"`
}

type VerifyOptions struct {
	CertIdentity       string   // expected certificate identity (workflow URL)
	CertOIDCIssuer     string   // expected OIDC issuer
	SkipTLogVerify     bool     // force-skip transparency-log verification even when a bundle carries an entry (programmatic only; no CLI flag)
	Quiet              bool     // suppress output messages
	SourceRef          string   // expected source repository ref (e.g., refs/heads/main)
	TrustedRootSource  string   // trusted root source: github, public, or auto
	AcceptedIdentities []string // resolved signer allowlist (union of --cert-identity and the list); each attestation must match at least one (OR semantics)
}