manifest

type BatchSigningPublicKey struct {
	// PublicKey is the PEM armored base64 encoding of the ASN.1 encoding of the
	// PKIX SubjectPublicKeyInfo structure. It must be an ECDSA P256 key.
	PublicKey string `json:"public-key"`
	// Expiration is the ISO 8601 encoded UTC date at which this key expires.
	Expiration string `json:"expiration"`
}

type BatchSigningPublicKeys map[string]BatchSigningPublicKey

type DataShareProcessorSpecificManifest struct {
	// Format is the version of the manifest.
	Format int64 `json:"format"`
	// IngestionIdentity is the identity of the ingestion and is only necessary
	// when an aws s3 ingestion server is used
	IngestionIdentity string `json:"ingestion-identity,omitempty"`
	// IngestionBucket is the region+name of the bucket that the data share
	// processor which owns the manifest reads ingestion batches from.
	IngestionBucket string `json:"ingestion-bucket"`
	// PeerValidationIdentity is the identity is the identity that should be
	// assumed by peers to write to the PeerValidationBucket
	PeerValidationIdentity string `json:"peer-validation-identity,omitempty"`
	// PeerValidationBucket is the region+name of the bucket that the data share
	// processor which owns the manifest reads peer validation batches from.
	PeerValidationBucket string `json:"peer-validation-bucket"`
	// BatchSigningPublicKeys maps key identifiers to batch signing public keys.
	// These are the keys that peers reading batches emitted by this data share
	// processor use to verify signatures.
	BatchSigningPublicKeys BatchSigningPublicKeys `json:"batch-signing-public-keys"`
	// PacketEncryptionKeyCSRs maps key identifiers to packet encryption CSRs.
	// The values are PEM encoded PKCS#10 self signed certificate signing
	// request, which contain the public key corresponding to the ECDSA P256
	// private key that the data share processor which owns the manifest uses to
	// decrypt ingestion share packets.
	PacketEncryptionKeyCSRs PacketEncryptionKeyCSRs `json:"packet-encryption-keys"`
}

type IngestorGlobalManifest struct {
	// Format is the version of the manifest.
	Format int64 `json:"format"`
	// ServerIdentity represents the server identity for the advertising party
	// of the manifest.
	ServerIdentity ServerIdentity `json:"server-identity"`
	// BatchSigningPublicKeys maps key identifiers to batch signing public keys.
	// These are the keys that will be used by the ingestion server advertising
	// this manifest to sign ingestion batches.
	BatchSigningPublicKeys BatchSigningPublicKeys `json:"batch-signing-public-keys"`
}

type PacketEncryptionCertificate struct {
	// CertificateSigningRequest is the PEM armored PKCS#10 CSR
	CertificateSigningRequest string `json:"certificate-signing-request"`
}

type PacketEncryptionKeyCSRs map[string]PacketEncryptionCertificate

type ServerIdentity struct {
	// AWSIamEntity is ARN of user or role - apple only
	AWSIamEntity string `json:"aws-iam-entity"`
	// GCPServiceAccountID is the numeric unique service account ID
	GCPServiceAccountID string `json:"gcp-service-account-id"`
	// GCPServiceAccountEmail is the email address of the gcp service account
	GCPServiceAccountEmail string `json:"gcp-service-account-email"`
}

type UpdateKeysConfig struct {
	BatchSigningKey         key.Key // the key used for batch signing operations
	BatchSigningKeyIDPrefix string  // the key ID prefix to use for batch signing keys

	PacketEncryptionKey         key.Key // the key used for packet encryption operations
	PacketEncryptionKeyIDPrefix string  // the key ID prefix to use for packet encryption keys
	PacketEncryptionKeyCSRFQDN  string  // the FQDN to specify for packet encryption key CSRs

	SkipPreUpdateValidations  bool // if set, do not perform pre-update validation checks
	SkipPostUpdateValidations bool // if set, do not perform post-update validation checks
}