cryptoutil

type BlobVerifyResult struct {
	Verified bool
	KeyHint  string
}

type DSSEEnvelope struct {
	Payload     string          `json:"payload"`     // base64-encoded in-toto statement
	PayloadType string          `json:"payloadType"` // "application/vnd.in-toto+json"
	Signatures  []DSSESignature `json:"signatures"`
}

type DSSESignature struct {
	Sig string `json:"sig"` // base64-encoded signature over PAE
}

type DSSEVerifyResult struct {
	KeyHint       string // from bundle verification material
	SubjectName   string // from in-toto statement
	SubjectDigest string // sha256 from subject
	PredicateType string // "phxi.net/attestations/release/v1"
}

type InTotoStatement struct {
	Type          string          `json:"_type"`
	PredicateType string          `json:"predicateType"`
	Subject       []InTotoSubject `json:"subject"`
	Predicate     json.RawMessage `json:"predicate"`
}

type InTotoSubject struct {
	Name   string            `json:"name"`
	Digest map[string]string `json:"digest"`
}

type KMSVerifier struct {

	// AllowPKCS1v15 controls whether RSA PKCS1v15 is accepted as a fallback
	// when PSS verification fails. Default false (PSS-only). Set true to
	// preserve backward compatibility with existing PKCS1v15 signatures.
	AllowPKCS1v15 bool
	// contains filtered or unexported fields
}

type MessageDigest struct {
	Algorithm string `json:"algorithm"`
	Digest    string `json:"digest"` // base64 of the raw hash bytes
}

type MessageSignature struct {
	MessageDigest MessageDigest `json:"messageDigest"`
	Signature     string        `json:"signature"` // base64
}

type PublicKeyRef struct {
	Hint string `json:"hint"`
}

type SigstoreBundle struct {
	MediaType            string               `json:"mediaType"`
	VerificationMaterial VerificationMaterial `json:"verificationMaterial"`
	DSSEEnvelope         *DSSEEnvelope        `json:"dsseEnvelope,omitempty"`
	MessageSignature     *MessageSignature    `json:"messageSignature,omitempty"`
}

type VerificationMaterial struct {
	PublicKey PublicKeyRef `json:"publicKey"`
}