protobuf

type CAClient interface {
	// *
	// Returns an X.509 certificate created by the Fulcio certificate authority for the given request parameters
	CreateSigningCertificate(ctx context.Context, in *CreateSigningCertificateRequest, opts ...grpc.CallOption) (*SigningCertificate, error)
	// *
	// Returns the bundle of certificates that can be used to validate code signing certificates issued by this Fulcio instance
	GetTrustBundle(ctx context.Context, in *GetTrustBundleRequest, opts ...grpc.CallOption) (*TrustBundle, error)
	// *
	// Returns the configuration of supported OIDC issuers, including the required challenge for each issuer.
	GetConfiguration(ctx context.Context, in *GetConfigurationRequest, opts ...grpc.CallOption) (*Configuration, error)
}

type CAServer interface {
	// *
	// Returns an X.509 certificate created by the Fulcio certificate authority for the given request parameters
	CreateSigningCertificate(context.Context, *CreateSigningCertificateRequest) (*SigningCertificate, error)
	// *
	// Returns the bundle of certificates that can be used to validate code signing certificates issued by this Fulcio instance
	GetTrustBundle(context.Context, *GetTrustBundleRequest) (*TrustBundle, error)
	// *
	// Returns the configuration of supported OIDC issuers, including the required challenge for each issuer.
	GetConfiguration(context.Context, *GetConfigurationRequest) (*Configuration, error)
	// contains filtered or unexported methods
}

type CertificateChain struct {

	// The PEM-encoded certificate chain, ordered from leaf to intermediate to root as applicable.
	Certificates []string `protobuf:"bytes,1,rep,name=certificates,proto3" json:"certificates,omitempty"`
	// contains filtered or unexported fields
}

type Configuration struct {

	// The OIDC issuers supported by this Fulcio instance.
	Issuers []*OIDCIssuer `protobuf:"bytes,1,rep,name=issuers,proto3" json:"issuers,omitempty"`
	// contains filtered or unexported fields
}

type CreateSigningCertificateRequest struct {

	// Identity information about who possesses the private / public key pair presented
	Credentials *Credentials `protobuf:"bytes,1,opt,name=credentials,proto3" json:"credentials,omitempty"`
	// Types that are assignable to Key:
	//
	//	*CreateSigningCertificateRequest_PublicKeyRequest
	//	*CreateSigningCertificateRequest_CertificateSigningRequest
	Key isCreateSigningCertificateRequest_Key `protobuf_oneof:"key"`
	// contains filtered or unexported fields
}

type CreateSigningCertificateRequest_CertificateSigningRequest struct {
	// PKCS#10 PEM-encoded certificate signing request
	//
	// Contains the public key to be stored in the requested certificate. All other CSR fields
	// are ignored. Since the CSR is self-signed, it also acts as a proof of possession of
	// the private key.
	//
	// In particular, the CSR's subject name is not verified, or tested for
	// compatibility with its specified X.509 name type (e.g. email address).
	CertificateSigningRequest []byte `protobuf:"bytes,3,opt,name=certificate_signing_request,json=certificateSigningRequest,proto3,oneof"`
}

type CreateSigningCertificateRequest_PublicKeyRequest struct {
	// The public key to be stored in the requested certificate along with a signed
	// challenge as proof of possession of the private key.
	PublicKeyRequest *PublicKeyRequest `protobuf:"bytes,2,opt,name=public_key_request,json=publicKeyRequest,proto3,oneof"`
}

type Credentials struct {

	// Types that are assignable to Credentials:
	//
	//	*Credentials_OidcIdentityToken
	Credentials isCredentials_Credentials `protobuf_oneof:"credentials"`
	// contains filtered or unexported fields
}

type Credentials_OidcIdentityToken struct {
	// The OIDC token that identifies the caller
	OidcIdentityToken string `protobuf:"bytes,1,opt,name=oidc_identity_token,json=oidcIdentityToken,proto3,oneof"`
}

type GetConfigurationRequest struct {
	// contains filtered or unexported fields
}

type GetTrustBundleRequest struct {
	// contains filtered or unexported fields
}

type OIDCIssuer struct {

	// Types that are assignable to Issuer:
	//
	//	*OIDCIssuer_IssuerUrl
	//	*OIDCIssuer_WildcardIssuerUrl
	Issuer isOIDCIssuer_Issuer `protobuf_oneof:"issuer"`
	// The expected audience of the OIDC token for the issuer.
	Audience string `protobuf:"bytes,3,opt,name=audience,proto3" json:"audience,omitempty"`
	// The OIDC claim that must be signed for a proof of possession challenge.
	ChallengeClaim string `protobuf:"bytes,4,opt,name=challenge_claim,json=challengeClaim,proto3" json:"challenge_claim,omitempty"`
	// The expected SPIFFE trust domain. Only present when the OIDC issuer issues tokens for SPIFFE identities.
	SpiffeTrustDomain string `protobuf:"bytes,5,opt,name=spiffe_trust_domain,json=spiffeTrustDomain,proto3" json:"spiffe_trust_domain,omitempty"`
	// contains filtered or unexported fields
}

type OIDCIssuer_IssuerUrl struct {
	// The URL of the OIDC issuer.
	IssuerUrl string `protobuf:"bytes,1,opt,name=issuer_url,json=issuerUrl,proto3,oneof"`
}

type OIDCIssuer_WildcardIssuerUrl struct {
	// The URL of wildcard OIDC issuer, e.g. "https://oidc.eks.*.amazonaws.com/id/*".
	// When comparing the issuer, the wildcards will be replaced by "[-_a-zA-Z0-9]+".
	WildcardIssuerUrl string `protobuf:"bytes,2,opt,name=wildcard_issuer_url,json=wildcardIssuerUrl,proto3,oneof"`
}

type PublicKey struct {

	// The cryptographic algorithm to use with the key material
	Algorithm PublicKeyAlgorithm `protobuf:"varint,1,opt,name=algorithm,proto3,enum=dev.sigstore.fulcio.v2.PublicKeyAlgorithm" json:"algorithm,omitempty"`
	// PKIX, ASN.1 DER or PEM-encoded public key. PEM is typically
	// of type PUBLIC KEY.
	Content string `protobuf:"bytes,2,opt,name=content,proto3" json:"content,omitempty"`
	// contains filtered or unexported fields
}

type PublicKeyAlgorithm int32

type PublicKeyRequest struct {

	// The public key to be stored in the requested certificate
	PublicKey *PublicKey `protobuf:"bytes,1,opt,name=public_key,json=publicKey,proto3" json:"public_key,omitempty"`
	// Proof that the client possesses the private key; must be verifiable by provided public key
	//
	// This is a currently a signature over the `sub` claim from the OIDC identity token
	ProofOfPossession []byte `protobuf:"bytes,2,opt,name=proof_of_possession,json=proofOfPossession,proto3" json:"proof_of_possession,omitempty"`
	// contains filtered or unexported fields
}

type SigningCertificate struct {

	// Types that are assignable to Certificate:
	//
	//	*SigningCertificate_SignedCertificateDetachedSct
	//	*SigningCertificate_SignedCertificateEmbeddedSct
	Certificate isSigningCertificate_Certificate `protobuf_oneof:"certificate"`
	// contains filtered or unexported fields
}

type SigningCertificateDetachedSCT struct {

	// The certificate chain serialized with the leaf certificate first, followed
	// by all intermediate certificates (if present), finishing with the root certificate.
	//
	// All values are PEM-encoded certificates.
	Chain *CertificateChain `protobuf:"bytes,1,opt,name=chain,proto3" json:"chain,omitempty"`
	// The Signed Certificate Timestamp (SCT) is a promise for including the certificate in
	// a certificate transparency log. It can be "stapled" to verify the inclusion of
	// a certificate in the log in an offline fashion.
	//
	// The SCT format is an AddChainResponse struct, defined in
	// https://github.com/google/certificate-transparency-go
	SignedCertificateTimestamp []byte `` /* 141-byte string literal not displayed */
	// contains filtered or unexported fields
}

type SigningCertificateEmbeddedSCT struct {

	// The certificate chain serialized with the leaf certificate first, followed
	// by all intermediate certificates (if present), finishing with the root certificate.
	//
	// All values are PEM-encoded certificates.
	//
	// The leaf certificate contains an embedded Signed Certificate Timestamp (SCT) to
	// verify inclusion of the certificate in a log. The SCT format is a SignedCertificateTimestampList,
	// as defined in https://datatracker.ietf.org/doc/html/rfc6962#section-3.3
	Chain *CertificateChain `protobuf:"bytes,1,opt,name=chain,proto3" json:"chain,omitempty"`
	// contains filtered or unexported fields
}

type SigningCertificate_SignedCertificateDetachedSct struct {
	SignedCertificateDetachedSct *SigningCertificateDetachedSCT `protobuf:"bytes,1,opt,name=signed_certificate_detached_sct,json=signedCertificateDetachedSct,proto3,oneof"`
}

type SigningCertificate_SignedCertificateEmbeddedSct struct {
	SignedCertificateEmbeddedSct *SigningCertificateEmbeddedSCT `protobuf:"bytes,2,opt,name=signed_certificate_embedded_sct,json=signedCertificateEmbeddedSct,proto3,oneof"`
}

type TrustBundle struct {

	// The set of PEM-encoded certificate chains for this Fulcio instance; each chain will start with any
	// intermediate certificates (if present), finishing with the root certificate.
	Chains []*CertificateChain `protobuf:"bytes,1,rep,name=chains,proto3" json:"chains,omitempty"`
	// contains filtered or unexported fields
}

type UnimplementedCAServer struct {
}

type UnsafeCAServer interface {
	// contains filtered or unexported methods
}