validation

type ClairScanner struct {
	// contains filtered or unexported fields
}

type ComplianceCheck struct {
	ID          string   `json:"id"`
	Name        string   `json:"name"`
	Description string   `json:"description"`
	Status      string   `json:"status"` // "pass", "fail", "skip"
	Severity    Severity `json:"severity"`
	Details     string   `json:"details,omitempty"`
}

type CompositeVerifier struct {
	// contains filtered or unexported fields
}

type CosignVerifier struct {
	// contains filtered or unexported fields
}

type DefaultImageValidator struct {
	// contains filtered or unexported fields
}

type GrypeScanner struct {
	// contains filtered or unexported fields
}

type ImageInfo struct {
	Registry      string `json:"registry"`
	Namespace     string `json:"namespace"`
	Repository    string `json:"repository"`
	Tag           string `json:"tag"`
	Digest        string `json:"digest"`
	FullReference string `json:"full_reference"`
	IsOfficial    bool   `json:"is_official"`
	HasDigest     bool   `json:"has_digest"`
	HasTag        bool   `json:"has_tag"`
}

type ImageValidator interface {
	// ValidateImage performs comprehensive validation on an image reference
	ValidateImage(ctx context.Context, image string) error

	// ScanImage performs security scanning on an image
	ScanImage(ctx context.Context, image string) (*ScanResult, error)

	// CheckPolicy validates an image against a specific policy
	CheckPolicy(ctx context.Context, image string, policy Policy) error
}

type Layer struct {
	Digest    string `json:"digest"`
	Size      int64  `json:"size"`
	MediaType string `json:"media_type"`
	CreatedBy string `json:"created_by,omitempty"`
}

type NotaryVerifier struct {
	// contains filtered or unexported fields
}

type OrchestratorIntegration struct {
	// contains filtered or unexported fields
}

type Policy struct {
	Name        string `json:"name"`
	Description string `json:"description"`
	Enabled     bool   `json:"enabled"`

	// Registry rules
	AllowedRegistries []string `json:"allowed_registries,omitempty"`
	BlockedRegistries []string `json:"blocked_registries,omitempty"`

	// Tag rules
	AllowLatestTag      bool     `json:"allow_latest_tag"`
	RequireDigest       bool     `json:"require_digest"`
	TagPatternWhitelist []string `json:"tag_pattern_whitelist,omitempty"`
	TagPatternBlacklist []string `json:"tag_pattern_blacklist,omitempty"`

	// Security thresholds
	MaxCriticalCVEs int `json:"max_critical_cves"`
	MaxHighCVEs     int `json:"max_high_cves"`
	MaxMediumCVEs   int `json:"max_medium_cves"`
	MaxLowCVEs      int `json:"max_low_cves"`

	// Image requirements
	MaxImageAge      time.Duration     `json:"max_image_age,omitempty"`
	RequireSignature bool              `json:"require_signature"`
	RequiredLabels   map[string]string `json:"required_labels,omitempty"`

	// Enforcement
	EnforcementMode string   `json:"enforcement_mode"`     // "block", "warn", "audit"
	Exceptions      []string `json:"exceptions,omitempty"` // Image patterns to exempt
}

type ScanResult struct {
	ImageReference string    `json:"image_reference"`
	ImageID        string    `json:"image_id"`
	ImageDigest    string    `json:"image_digest"`
	ScanTimestamp  time.Time `json:"scan_timestamp"`
	Scanner        string    `json:"scanner"`
	ScannerVersion string    `json:"scanner_version"`

	// Vulnerability summary
	CriticalCount int `json:"critical_count"`
	HighCount     int `json:"high_count"`
	MediumCount   int `json:"medium_count"`
	LowCount      int `json:"low_count"`
	UnknownCount  int `json:"unknown_count"`
	TotalCount    int `json:"total_count"`

	// Detailed findings
	Vulnerabilities []Vulnerability `json:"vulnerabilities"`

	// Image metadata
	OS           string    `json:"os"`
	Architecture string    `json:"architecture"`
	CreatedAt    time.Time `json:"created_at"`
	Size         int64     `json:"size"`
	Layers       []Layer   `json:"layers"`

	// Compliance
	ComplianceStatus string            `json:"compliance_status"` // "pass", "fail", "warn"
	ComplianceChecks []ComplianceCheck `json:"compliance_checks"`

	// Additional metadata
	Metadata map[string]interface{} `json:"metadata,omitempty"`
}

type SecurityReport struct {
	Image            string      `json:"image"`
	Timestamp        time.Time   `json:"timestamp"`
	Status           string      `json:"status"` // "approved", "warning", "rejected", "failed"
	RiskScore        float64     `json:"risk_score"`
	ScanResult       *ScanResult `json:"scan_result,omitempty"`
	ValidationErrors []string    `json:"validation_errors,omitempty"`
	ScanErrors       []string    `json:"scan_errors,omitempty"`
	Recommendation   string      `json:"recommendation"`
	PolicyViolations []string    `json:"policy_violations,omitempty"`
}

type Severity string

type SignatureVerifier interface {
	VerifySignature(ctx context.Context, image string, trustAnchors []string) error
}

type TrivyMetadata struct {
	OS          TrivyOS     `json:"OS"`
	ImageID     string      `json:"ImageID"`
	DiffIDs     []string    `json:"DiffIDs"`
	RepoTags    []string    `json:"RepoTags"`
	RepoDigests []string    `json:"RepoDigests"`
	ImageConfig interface{} `json:"ImageConfig"`
}

type TrivyOS struct {
	Family  string `json:"Family"`
	Name    string `json:"Name"`
	Version string `json:"Version"`
}

type TrivyOutput struct {
	SchemaVersion int           `json:"SchemaVersion"`
	ArtifactName  string        `json:"ArtifactName"`
	ArtifactType  string        `json:"ArtifactType"`
	Metadata      TrivyMetadata `json:"Metadata"`
	Results       []TrivyResult `json:"Results"`
}

type TrivyResult struct {
	Target          string               `json:"Target"`
	Class           string               `json:"Class"`
	Type            string               `json:"Type"`
	Vulnerabilities []TrivyVulnerability `json:"Vulnerabilities"`
}

type TrivyScanner struct {
	// contains filtered or unexported fields
}

type TrivyVulnerability struct {
	VulnerabilityID  string                 `json:"VulnerabilityID"`
	PkgName          string                 `json:"PkgName"`
	InstalledVersion string                 `json:"InstalledVersion"`
	FixedVersion     string                 `json:"FixedVersion"`
	Title            string                 `json:"Title"`
	Description      string                 `json:"Description"`
	Severity         string                 `json:"Severity"`
	CVSS             map[string]interface{} `json:"CVSS"`
	References       []string               `json:"References"`
	PublishedDate    *time.Time             `json:"PublishedDate"`
	LastModifiedDate *time.Time             `json:"LastModifiedDate"`
}

type ValidationConfig struct {
	// Registry validation
	AllowedRegistries []string // Allowed registries (empty = all allowed)
	BlockedRegistries []string // Blocked registries
	RequireHTTPS      bool     // Require HTTPS for registry connections

	// Tag validation
	AllowLatestTag     bool     // Allow "latest" tag
	AllowedTagPatterns []string // Regex patterns for allowed tags
	BlockedTagPatterns []string // Regex patterns for blocked tags
	RequireDigest      bool     // Require digest in image reference

	// Security scanning
	EnableScanning    bool          // Enable vulnerability scanning
	MaxCriticalCVEs   int           // Max critical vulnerabilities (-1 = unlimited, 0 = none allowed)
	MaxHighCVEs       int           // Max high vulnerabilities (-1 = unlimited, 0 = none allowed)
	MaxMediumCVEs     int           // Max medium vulnerabilities (-1 = unlimited, 0 = none allowed)
	MaxLowCVEs        int           // Max low vulnerabilities (-1 = unlimited, 0 = none allowed)
	ScanCacheDuration time.Duration // How long to cache scan results

	// Image age validation
	MaxImageAge        time.Duration // Max age for images (0 = no limit)
	RequireRecentBuild bool          // Require images built within MaxImageAge

	// Signature verification
	RequireSignature bool     // Require signed images
	TrustAnchors     []string // Public keys or certificates for verification
	SignatureType    string   // "cosign", "notary", etc.

	// Performance
	ConcurrentScans int           // Max concurrent vulnerability scans
	ScanTimeout     time.Duration // Timeout for individual scans

	// Logging
	LogLevel string // "debug", "info", "warn", "error"
	AuditLog bool   // Enable audit logging
}

type Vulnerability struct {
	ID          string   `json:"id"`
	Title       string   `json:"title"`
	Description string   `json:"description"`
	Severity    Severity `json:"severity"`
	CVSS        float64  `json:"cvss"`
	CVSSVector  string   `json:"cvss_vector"`
	CWE         []string `json:"cwe,omitempty"`

	// Affected components
	Package      string `json:"package"`
	Version      string `json:"version"`
	FixedVersion string `json:"fixed_version,omitempty"`

	// References
	References    []string  `json:"references"`
	PublishedDate time.Time `json:"published_date"`
	LastModified  time.Time `json:"last_modified"`

	// Exploitation
	Exploitable      bool   `json:"exploitable"`
	ExploitAvailable bool   `json:"exploit_available"`
	ExploitMaturity  string `json:"exploit_maturity,omitempty"`
}

type VulnerabilityScanner interface {
	Scan(ctx context.Context, image string) (*ScanResult, error)
}