trust

type Bundle struct {
	MediaType            string               `json:"mediaType"`
	VerificationMaterial VerificationMaterial `json:"verificationMaterial"`
	MessageSignature     MessageSignature     `json:"messageSignature"`
}

type CosignSigner struct {
	// KeyRef is the signing key reference: a file path (e.g. "cosign.key"),
	// a KMS URI (e.g. "gcpkms://..."), or empty for keyless (OIDC) signing.
	KeyRef string
}

type CosignVerifier struct {
	// KeyRef is the verification key reference: a file path, a KMS URI,
	// or empty for keyless (OIDC) verification.
	KeyRef string

	// CertIdentity is required for keyless verification — the expected
	// certificate subject (OIDC identity of the signer).
	CertIdentity string

	// CertOIDCIssuer is required for keyless verification — the expected
	// OIDC issuer URL.
	CertOIDCIssuer string
}

type FakeRekorClient struct {
	// LoggedBundles records every bundle passed to Log.
	LoggedBundles []*Bundle
	// contains filtered or unexported fields
}

type FakeSigner struct {
	// NextLogIndex is incremented for each Sign call.
	NextLogIndex int64
}

type FakeVerifier struct{}

type InclusionPromise struct {
	SignedEntryTimestamp []byte `json:"signedEntryTimestamp"`
}

type KindVersion struct {
	Kind    string `json:"kind"`
	Version string `json:"version"`
}

type LogID struct {
	KeyID string `json:"keyId"`
}

type MessageDigest struct {
	// Algorithm is the hash algorithm, e.g. "SHA2_256".
	Algorithm string `json:"algorithm"`
	// Digest is the raw hash bytes.
	Digest []byte `json:"digest"`
}

type MessageSignature struct {
	MessageDigest MessageDigest `json:"messageDigest"`
	// Signature is the raw signature bytes over MessageDigest.Digest.
	Signature []byte `json:"signature"`
}

type RFC3161Timestamp struct {
	SignedTimestamp []byte `json:"signedTimestamp"`
}

type RawMaterial struct {
	RawBytes []byte `json:"rawBytes,omitempty"`
	// Hint is the base64-encoded public key hint used by cosign v3 key-based bundles.
	Hint string `json:"hint,omitempty"`
}

type RekorClient interface {
	// Log submits bundle to the Rekor transparency log and returns the
	// log index. The returned index is stored in LayerManifest.RekorEntry.
	Log(ctx context.Context, bundle *Bundle) (logIndex int64, err error)

	// VerifyEntry confirms that the entry in the Rekor log at logIndex attests
	// bundle — the same artifact digest and the same signature, not merely that
	// an entry exists there. Returns nil iff the entry matches the bundle.
	//
	// bundle is required. An implementation given none cannot distinguish this
	// artifact's entry from a stranger's and must report that rather than return
	// success; RekorHTTPClient returns ErrNoBundle.
	VerifyEntry(ctx context.Context, logIndex int64, bundle *Bundle) error
}

type RekorHTTPClient struct {
	// BaseURL is the Rekor server base URL. Defaults to https://rekor.sigstore.dev.
	BaseURL string
}

type Signer interface {
	// Sign signs artifactPath and returns a Bundle containing the signature,
	// key material, and Rekor transparency log entry.
	// annotations are additional key/value pairs included in the Rekor entry,
	// e.g. {"strata.layer.name": "python", "strata.layer.version": "3.11.9"}.
	Sign(ctx context.Context, artifactPath string, annotations map[string]string) (*Bundle, error)
}

type TimestampVerificationData struct {
	RFC3161Timestamps []RFC3161Timestamp `json:"rfc3161Timestamps,omitempty"`
}

type TlogEntry struct {
	// LogIndex is the entry's position in the Rekor log. Used as the
	// stable reference stored in LayerManifest.RekorEntry.
	LogIndex string `json:"logIndex"`

	// LogID identifies the Rekor instance. In cosign v3 this is an object
	// {"keyId": "<base64>"}, not a plain string.
	LogID LogID `json:"logId"`

	// KindVersion identifies the Rekor entry type (e.g. hashedrekord 0.0.1).
	KindVersion *KindVersion `json:"kindVersion,omitempty"`

	// IntegratedTime is the Unix timestamp (seconds) when Rekor accepted
	// this entry.
	IntegratedTime string `json:"integratedTime"`

	// CanonicalizedBody is the base64-encoded canonical form of the entry
	// body as stored in Rekor.
	CanonicalizedBody string `json:"canonicalizedBody"`

	// InclusionPromise is the Rekor server's signed promise that this
	// entry will be included in the log.
	InclusionPromise *InclusionPromise `json:"inclusionPromise,omitempty"`

	// InclusionProof is the Merkle inclusion proof (cosign v3+).
	InclusionProof json.RawMessage `json:"inclusionProof,omitempty"`
}

type VerificationMaterial struct {
	// Certificate holds the short-lived certificate for keyless (OIDC) signatures.
	// Exactly one of Certificate or PublicKey will be set.
	Certificate *RawMaterial `json:"certificate,omitempty"`

	// PublicKey holds the raw public key for keyed signatures.
	PublicKey *RawMaterial `json:"publicKey,omitempty"`

	// TlogEntries are the Rekor transparency log entries for this bundle.
	// Strata requires at least one entry (Rekor logging is mandatory).
	TlogEntries []TlogEntry `json:"tlogEntries,omitempty"`

	// TimestampVerificationData holds RFC3161 timestamps (cosign v3+).
	TimestampVerificationData *TimestampVerificationData `json:"timestampVerificationData,omitempty"`
}

type Verifier interface {
	// Verify checks that artifactPath matches bundle's signature and that
	// the bundle's Rekor entry is valid and current.
	// Returns nil iff both checks pass. Any failure returns a non-nil error.
	Verify(ctx context.Context, artifactPath string, bundle *Bundle) error
}