attest

type AttestationVersion string

type AttestationWriter interface {
	PredicateType() string
	Statement(subjects []*intoto.ResourceDescriptor) (*intoto.Statement, error)
}

type Completeness struct {
	Parameters  bool
	Environment bool
	Materials   bool
}

type OptFn func(*Options) error

type Options struct {
	// Writer is where the serialized attestation is written (default os.Stdout).
	Writer io.Writer
	// HashAlgorithms are the digest algorithms used to hash subjects (default sha256).
	HashAlgorithms []string
	// Subjects are pre-built subject descriptors added to the statement after
	// the hashed subject files, for artifacts only known by their digest.
	Subjects []*intoto.ResourceDescriptor
	// Predicate is an optional base predicate the content options are merged
	// onto. It must match the target version's concrete predicate type.
	Predicate proto.Message
	// Signer, when set, signs the serialized statement and the signed artifact
	// (sigstore bundle or DSSE envelope) is emitted instead of the bare
	// statement. When nil the statement is emitted unsigned.
	Signer Signer

	// --- Build provenance content (canonical / modern names) ---
	BuildType            string
	BuilderID            string
	ExternalParameters   *structpb.Struct             // v0.2: invocation.parameters
	InternalParameters   *structpb.Struct             // v1 only
	ResolvedDependencies []*intoto.ResourceDescriptor // v0.2: materials
	BuilderVersion       map[string]string            // v1 only
	BuilderDependencies  []*intoto.ResourceDescriptor // v1 only
	Byproducts           []*intoto.ResourceDescriptor // v1 only
	InvocationID         string                       // v0.2: metadata.buildInvocationId
	StartedOn            *timestamppb.Timestamp       // v0.2: metadata.buildStartedOn
	FinishedOn           *timestamppb.Timestamp       // v0.2: metadata.buildFinishedOn

	// --- Build provenance content with no v1 equivalent (v0.2 only) ---
	ConfigSourceURI        string
	ConfigSourceDigest     map[string]string
	ConfigSourceEntryPoint string
	Environment            *structpb.Struct
	BuildConfig            *structpb.Struct
	Reproducible           *bool
	Completeness           *Completeness

	// --- Verification summary attestation content ---
	VerifierID         string
	TimeVerified       *timestamppb.Timestamp
	ResourceURI        string
	PolicyURI          string
	PolicyDigest       map[string]string
	InputAttestations  []*intoto.ResourceDescriptor
	VerificationResult string
	VerifiedLevels     []string
	DependencyLevels   map[string]uint64
	SlsaVersion        string
}

type Signer interface {
	SignStatement(data []byte, funcs ...signeroptions.SignOptFn) (signer.SignedArtifact, error)
}

type Writer struct {
	// contains filtered or unexported fields
}