signing

type CertificateInfo struct {
	Issuer   string
	Subject  string
	Identity string
}

type Config struct {
	Enabled    bool
	Required   bool
	Keyless    bool
	PrivateKey string
	PublicKey  string
	// Password is the cosign private key passphrase.
	// json:"-" prevents accidental serialization if this struct is ever marshaled
	// as part of a larger config object (e.g., debug logging, cache key hashing).
	// It is always populated programmatically from CLI flags or env vars, never loaded from JSON.
	Password string `json:"-" yaml:"-"`
	Timeout  string

	// OIDCToken is the OIDC identity token for keyless signing/attestation.
	// Set at runtime from CI environment (ACTIONS_ID_TOKEN_REQUEST_*).
	// Used by SBOM attacher and provenance attacher for cosign attestations.
	OIDCToken string `json:"-" yaml:"-"`

	// Verification settings
	OIDCIssuer     string
	IdentityRegexp string
	// VerifyEnv is appended to the environment of the cosign verify process.
	VerifyEnv []string
}

type ConfirmProbe struct {
	Args []string
	What string
}

type KeyBasedSigner struct {
	PrivateKey string // Path to private key file or key content
	Password   string // Optional password for encrypted keys
	Timeout    time.Duration
	// contains filtered or unexported fields
}

type KeylessSigner struct {
	OIDCToken string
	Timeout   time.Duration

	// IdentityRegexp and OIDCIssuer name the certificate identity this signer
	// produces. Both are needed to confirm a Rekor conflict against the image;
	// with either missing the signer keeps the plain retry-then-report path
	// rather than accepting a signature it cannot attribute. Config.CreateSigner
	// populates them.
	IdentityRegexp string
	OIDCIssuer     string
	// contains filtered or unexported fields
}

type PolicyChecker interface {
	Check(result *VerifyResult) error
}

type SignResult struct {
	ImageDigest string
	Signature   string
	Bundle      string
	RekorEntry  string // URL to Rekor transparency log entry
	SignedAt    string

	// Confirmed reports that the signature was not produced by this run: the
	// transparency log already held an identical entry and a verification probe
	// confirmed the signature is on the image. Nothing fresh was emitted, so
	// RekorEntry is empty even though the operation succeeded.
	Confirmed bool
}

type Signer interface {
	// Sign signs a container image and returns the result
	Sign(ctx context.Context, imageRef string) (*SignResult, error)
}

type SignerConfig struct {
	// Required indicates whether signing is required (fail-closed) or optional (fail-open)
	Required bool
	// Timeout for signing operation
	Timeout string
}

type Verifier struct {
	// For keyless verification
	OIDCIssuer     string
	IdentityRegexp string

	// For key-based verification
	PublicKey string // Path to public key file

	// ExtraEnv is appended to cosign's environment. A caller that verifies an
	// image before the deploy has written registry credentials to the shared
	// docker config needs it: without DOCKER_CONFIG pointing at credentials of
	// its own, cosign pulls anonymously and a private registry answers DENIED,
	// which is not a statement about the signature.
	ExtraEnv []string

	Timeout time.Duration
}

type VerifyResult struct {
	Verified        bool
	ImageDigest     string
	CertificateInfo *CertificateInfo
	VerifiedAt      string
}