builders

type Builder struct {
	// ID is the builder id as provenance records it in builder.id, without
	// the @ref the GitHub builders append.
	ID string `yaml:"id"`
	// IDMatch is how ID is compared with builder.id; exact by default.
	IDMatch IDMatch `yaml:"idMatch,omitempty"`
	// Title names the builder for people.
	Title string `yaml:"title,omitempty"`
	// Description explains what the builder is and how it is bound.
	Description string `yaml:"description,omitempty"`
	// Issuer is the OIDC issuer of the builder's signing certificate. With
	// Signer unset, the signer identity is derived from it and ID: a
	// sigstore identity from Issuer whose subject starts with ID (the
	// builder's ref follows it after an @).
	Issuer string `yaml:"issuer,omitempty"`
	// Signer is the identity spec (see sapi.NewIdentityFromSpec) the
	// provenance must be signed by, when it cannot be derived from
	// Issuer and ID.
	Signer string `yaml:"signer,omitempty"`
	// Ref constrains the ref carried by the signer identity; any by
	// default.
	Ref RefPolicy `yaml:"ref,omitempty"`
	// Delegated marks a builder that runs other builders: its certificate
	// proves the delegator ran, while builder.id names the delegated
	// builder, which is not expected to equal the signer identity.
	Delegated bool `yaml:"delegated,omitempty"`
	// Observer marks a watcher that attests runs it observed: its
	// certificate proves the observer ran, and builder.id must name the
	// workflow the certificate's build config URI says the observer ran
	// for, which proves that workflow really ran.
	Observer bool `yaml:"observer,omitempty"`
	// SourceRepositoryBound asserts the signing certificate's source
	// repository is the repository the artifact was built from, so it
	// can be compared with the expected source.
	SourceRepositoryBound bool `yaml:"sourceRepositoryBound,omitempty"`
	// contains filtered or unexported fields
}

type IDMatch string

type RefPolicy string

type Registry struct {
	// contains filtered or unexported fields
}