notation

type Descriptor struct {
	// The media type of the targeted content.
	MediaType string `json:"mediaType"`

	// The digest of the targeted content.
	Digest digest.Digest `json:"digest"`

	// Specifies the size in bytes of the blob.
	Size int64 `json:"size"`

	// Contains optional user defined attributes.
	Annotations map[string]string `json:"annotations,omitempty"`
}

type HashAlgorithm string

type JWSEnvelope struct {
	// JWSPayload Base64URL-encoded.
	Payload string `json:"payload"`

	// JWSProtectedHeader Base64URL-encoded.
	Protected string `json:"protected"`

	// Signature metadata that is not integrity protected
	Header JWSUnprotectedHeader `json:"header"`

	// Base64URL-encoded signature.
	Signature string `json:"signature"`
}

type JWSPayload struct {
	// Private claim.
	Subject Descriptor `json:"subject"`

	// Identifies the number of seconds since Epoch at which the signature was issued.
	IssuedAt int64 `json:"iat"`

	// Identifies the number of seconds since Epoch at which the signature must not be considered valid.
	ExpiresAt int64 `json:"exp,omitempty"`
}

type JWSProtectedHeader struct {
	// Defines which algorithm was used to generate the signature.
	Algorithm string `json:"alg"`

	// Media type of the secured content (the payload).
	ContentType string `json:"cty"`
}

type JWSUnprotectedHeader struct {
	// RFC3161 time stamp token Base64-encoded.
	TimeStampToken []byte `json:"timestamp,omitempty"`

	// List of X.509 Base64-DER-encoded certificates
	// as defined at https://datatracker.ietf.org/doc/html/rfc7515#section-4.1.6.
	CertChain [][]byte `json:"x5c"`
}

type KeySpec string

type Service interface {
	Signer
	Verifier
}

type SignOptions struct {
	// Expiry identifies the expiration time of the resulted signature.
	Expiry time.Time

	// TSA is the TimeStamp Authority to timestamp the resulted signature if present.
	TSA timestamp.Timestamper

	// TSAVerifyOptions is the verify option to verify the fetched timestamp signature.
	// The `Intermediates` in the verify options will be ignored and re-contrusted using
	// the certificates in the fetched timestamp signature.
	// An empty list of `KeyUsages` in the verify options implies ExtKeyUsageTimeStamping.
	TSAVerifyOptions x509.VerifyOptions

	// Sets or overrides the plugin configuration.
	PluginConfig map[string]string
}

type SignatureAlgorithm string

type Signer interface {
	// Sign signs the artifact described by its descriptor,
	// and returns the signature.
	Sign(ctx context.Context, desc Descriptor, opts SignOptions) ([]byte, error)
}

type Verifier interface {
	// Verify verifies the signature and returns the verified descriptor and
	// metadata of the signed artifact.
	Verify(ctx context.Context, signature []byte, opts VerifyOptions) (Descriptor, error)
}

type VerifyOptions struct{}