artifact

type Capabilities struct {
	// ReferrersAPI reports whether the OCI referrers API is available.
	// Where it is not, evidence discovery falls back to a tag scheme, which
	// has weaker concurrency guarantees.
	ReferrersAPI bool
}

type CapabilityReporter interface {
	Capabilities(ctx context.Context, ref Reference) (Capabilities, error)
}

type Credential struct {
	Username string
	Password string
	// Token is a bearer or identity token, used when Username and Password
	// are empty.
	Token string
}

type CredentialFunc func(ctx context.Context, registry string) (Credential, error)

type CredentialProvider interface {
	Credential(ctx context.Context, registry string) (Credential, error)
}

type Descriptor struct {
	MediaType string `json:"mediaType"`
	Digest    string `json:"digest"`
	Size      int64  `json:"size"`
}

type EvidenceStorage string

type Manifest struct {
	SchemaVersion int          `json:"schemaVersion"`
	MediaType     string       `json:"mediaType"`
	ArtifactType  string       `json:"artifactType"`
	Config        Descriptor   `json:"config"`
	Layers        []Descriptor `json:"layers"`
}

type Reference struct {
	// Scheme is SchemeRegistry or SchemeLayout.
	Scheme string

	// Registry is the host, for a registry reference.
	Registry string
	// Repository is the repository path, for a registry reference.
	Repository string
	// Path is the layout directory, for a layout reference.
	Path string

	// Tag is the mutable name, if one was given.
	Tag string
	// Digest is the immutable identity, if one was given.
	Digest string
}

type ReferrerManifest struct {
	SchemaVersion int               `json:"schemaVersion"`
	MediaType     string            `json:"mediaType"`
	ArtifactType  string            `json:"artifactType"`
	Config        Descriptor        `json:"config"`
	Layers        []Descriptor      `json:"layers"`
	Subject       *Descriptor       `json:"subject"`
	Annotations   map[string]string `json:"annotations,omitempty"`
}

type ReferrerTransport interface {
	Transport

	// Referrers lists evidence attached to a subject, filtered by artifact
	// type. The reported storage mode tells a caller whether the answer is a
	// set or a single replaceable slot.
	Referrers(ctx context.Context, ref Reference, subject Descriptor, artifactType string) ([]Descriptor, EvidenceStorage, error)

	// Attach stores an evidence blob and the referrer manifest naming it.
	//
	// Attach must never modify the subject. That is the guarantee that lets
	// evidence be added, renewed, or copied without changing what it
	// describes (DP-003).
	Attach(ctx context.Context, ref Reference, subject Descriptor, blob Descriptor, content io.Reader, artifactType string) (Descriptor, EvidenceStorage, error)
}

type Transport interface {
	// Scheme is the reference scheme this transport handles.
	Scheme() string

	// Resolve freezes a reference to one descriptor.
	//
	// This is where a tag stops being a tag. Everything afterwards works
	// from the returned descriptor, so a tag that moves mid-operation cannot
	// change what was fetched or verified (DP-007).
	Resolve(ctx context.Context, ref Reference) (Descriptor, error)

	// Fetch returns the content a descriptor names.
	//
	// The caller verifies the bytes against the descriptor. A transport that
	// verified internally would still have to be checked by the caller,
	// because the caller cannot know whether it did.
	Fetch(ctx context.Context, ref Reference, target Descriptor) (io.ReadCloser, error)

	// Push stores content under its descriptor.
	//
	// Push is idempotent: content that is already present is not an error.
	// Storage is content-addressed, so a second push of the same descriptor
	// can only be the same bytes.
	Push(ctx context.Context, ref Reference, target Descriptor, content io.Reader) error

	// Tag assigns a mutable name to an already-stored manifest.
	//
	// A transport may assume the manifest is present; the SDK does not call
	// this until it has read the manifest back and compared its descriptor.
	Tag(ctx context.Context, ref Reference, target Descriptor, tag string) error

	// Close releases connections and handles.
	Close() error
}