signing

type Bundle struct {
	// Content is the raw content that was signed.
	Content []byte
	// Signature is the content signature.
	Signature []byte
	// Cert is an optional PEM encoded x509 certificate, if one was used for signing.
	Cert []byte
	// Chain is an optional PEM encoded x509 certificate chain, if one was used for signing.
	Chain []byte
	// RekorBundle is an optional Rekor transparency log bundle, populated when transparency is enabled.
	RekorBundle *bundle.RekorBundle
	// RekorEntry is the raw Rekor transparency log entry, populated when transparency is enabled.
	// Storage backends that build a Sigstore protobuf bundle (e.g. OCI sigstore-bundle mode) need
	// the raw entry to embed tlog data inline; the converted RekorBundle alone is insufficient.
	RekorEntry *models.LogEntryAnon
	// PublicKey is the public key from the signer.
	// Available for storage backends that need direct access to the key material
	// (e.g. to create a cosign protobuf bundle without a certificate).
	PublicKey crypto.PublicKey
}

type Signer interface {
	signature.SignerVerifier
	Type() string
	Cert() string
	Chain() string
}