signing

type CertificateInfo struct {
	Issuer   string
	Subject  string
	Identity string
}

type Config struct {
	Enabled    bool
	Required   bool
	Keyless    bool
	PrivateKey string
	PublicKey  string
	// Password is the cosign private key passphrase.
	// json:"-" prevents accidental serialization if this struct is ever marshaled
	// as part of a larger config object (e.g., debug logging, cache key hashing).
	// It is always populated programmatically from CLI flags or env vars, never loaded from JSON.
	Password string `json:"-" yaml:"-"`
	Timeout  string

	// OIDCToken is the OIDC identity token for keyless signing/attestation.
	// Set at runtime from CI environment (ACTIONS_ID_TOKEN_REQUEST_*).
	// Used by SBOM attacher and provenance attacher for cosign attestations.
	OIDCToken string `json:"-" yaml:"-"`

	// Verification settings
	OIDCIssuer     string
	IdentityRegexp string
}

type KeyBasedSigner struct {
	PrivateKey string // Path to private key file or key content
	Password   string // Optional password for encrypted keys
	Timeout    time.Duration
}

type KeylessSigner struct {
	OIDCToken string
	Timeout   time.Duration
}

type PolicyChecker interface {
	Check(result *VerifyResult) error
}

type SignResult struct {
	ImageDigest string
	Signature   string
	Bundle      string
	RekorEntry  string // URL to Rekor transparency log entry
	SignedAt    string
}

type Signer interface {
	// Sign signs a container image and returns the result
	Sign(ctx context.Context, imageRef string) (*SignResult, error)
}

type SignerConfig struct {
	// Required indicates whether signing is required (fail-closed) or optional (fail-open)
	Required bool
	// Timeout for signing operation
	Timeout string
}

type Verifier struct {
	// For keyless verification
	OIDCIssuer     string
	IdentityRegexp string

	// For key-based verification
	PublicKey string // Path to public key file

	Timeout time.Duration
}

type VerifyResult struct {
	Verified        bool
	ImageDigest     string
	CertificateInfo *CertificateInfo
	VerifiedAt      string
}