verifier

type Bundle struct {
	MediaType            string                `json:"mediaType"`
	VerificationMaterial *VerificationMaterial `json:"verificationMaterial,omitempty"`
	DSSEEnvelope         *DSSEEnvelope         `json:"dsseEnvelope,omitempty"`
}

type Certificate struct {
	RawBytes string `json:"rawBytes"` // base64 encoded DER
}

type CertificateInfo struct {
	Subject     string
	Issuer      string
	NotBefore   time.Time
	NotAfter    time.Time
	Extensions  map[string]string
	Fingerprint string
}

type DSSEEnvelope struct {
	Payload     string      `json:"payload"` // base64 encoded
	PayloadType string      `json:"payloadType"`
	Signatures  []Signature `json:"signatures"`
}

type InclusionPromise struct {
	SignedEntryTimestamp string `json:"signedEntryTimestamp"`
}

type InclusionProof struct {
	LogIndex   int64
	RootHash   string
	TreeSize   int64
	Hashes     []string
	Checkpoint string
}

type IssuerInfo struct {
	Type        string // "github", "google", "email", "oidc"
	Identity    string // Full identity string
	Subject     string // Certificate subject CN
	OIDCIssuer  string // OIDC issuer URL
	Repository  string // Source repository URI
	WorkflowRef string // GitHub workflow reference
	RunID       string // GitHub Actions run ID
	Digest      string // Source repository digest
}

type KindVersion struct {
	Kind    string `json:"kind"`
	Version string `json:"version"`
}

type LogID struct {
	KeyID string `json:"keyId"`
}

type Options struct {
	// SkipRekor skips Rekor transparency log verification (for offline mode).
	SkipRekor bool

	// SkipSCT skips SCT verification.
	SkipSCT bool

	// AllowExpiredCerts allows expired signing certificates.
	AllowExpiredCerts bool

	// CustomTrustedRoots overrides the default Sigstore TUF roots.
	CustomTrustedRoots *TrustedRoots
}

type RekorEntryInfo struct {
	LogIndex       int64
	LogID          string
	IntegratedTime time.Time
	InclusionProof *InclusionProof
}

type Signature struct {
	Sig   string `json:"sig"` // base64 encoded
	KeyID string `json:"keyid,omitempty"`
}

type TlogEntry struct {
	LogIndex          *int64              `json:"logIndex,omitempty"`
	LogID             *LogID              `json:"logId,omitempty"`
	IntegratedTime    string              `json:"integratedTime,omitempty"`
	KindVersion       *KindVersion        `json:"kindVersion,omitempty"`
	InclusionPromise  *InclusionPromise   `json:"inclusionPromise,omitempty"`
	InclusionProof    *TlogInclusionProof `json:"inclusionProof,omitempty"`
	CanonicalizedBody string              `json:"canonicalizedBody,omitempty"`
}

type TlogInclusionProof struct {
	LogIndex   int64    `json:"logIndex"`
	RootHash   string   `json:"rootHash"`
	TreeSize   int64    `json:"treeSize"`
	Hashes     []string `json:"hashes"`
	Checkpoint string   `json:"checkpoint"`
}

type TrustedRoots struct {
	// FulcioCerts are the Fulcio root and intermediate CA certificates.
	FulcioCerts []*x509.Certificate

	// RekorPublicKeys are the Rekor log public keys.
	RekorPublicKeys map[string]crypto.PublicKey

	// CTLogPublicKeys are the CT log public keys for SCT verification.
	CTLogPublicKeys map[string]crypto.PublicKey
}

type VerificationMaterial struct {
	Certificate *Certificate `json:"certificate,omitempty"`
	TlogEntries []TlogEntry  `json:"tlogEntries,omitempty"`
}

type VerificationResult struct {
	// Verified is true if all verification checks passed.
	Verified bool

	// Issuer contains the extracted identity information.
	Issuer *IssuerInfo

	// CertificateInfo contains parsed certificate details.
	CertificateInfo *CertificateInfo

	// RekorEntry contains transparency log entry details.
	RekorEntry *RekorEntryInfo

	// Errors contains any verification errors.
	Errors []string

	// Warnings contains non-fatal issues.
	Warnings []string
}

type Verifier struct {
	// contains filtered or unexported fields
}