attestation

type Attestation struct {

	// Required. The signature, generally over the `resource_url`, that verifies
	// this attestation. The semantics of the signature veracity are ultimately
	// determined by the verification engine.
	//
	// Types that are assignable to Signature:
	//	*Attestation_PgpSignedAttestation
	//	*Attestation_GenericSignedAttestation
	Signature isAttestation_Signature `protobuf_oneof:"signature"`
	// contains filtered or unexported fields
}

type Attestation_GenericSignedAttestation struct {
	GenericSignedAttestation *GenericSignedAttestation `protobuf:"bytes,2,opt,name=generic_signed_attestation,json=genericSignedAttestation,proto3,oneof"`
}

type Attestation_PgpSignedAttestation struct {
	// A PGP signed attestation.
	PgpSignedAttestation *PgpSignedAttestation `protobuf:"bytes,1,opt,name=pgp_signed_attestation,json=pgpSignedAttestation,proto3,oneof"`
}

type Authority struct {

	// Hint hints at the purpose of the attestation authority.
	Hint *Authority_Hint `protobuf:"bytes,1,opt,name=hint,proto3" json:"hint,omitempty"`
	// contains filtered or unexported fields
}

type Authority_Hint struct {

	// Required. The human readable name of this attestation authority, for
	// example "qa".
	HumanReadableName string `protobuf:"bytes,1,opt,name=human_readable_name,json=humanReadableName,proto3" json:"human_readable_name,omitempty"`
	// contains filtered or unexported fields
}

type Details struct {

	// Required. Attestation for the resource.
	Attestation *Attestation `protobuf:"bytes,1,opt,name=attestation,proto3" json:"attestation,omitempty"`
	// contains filtered or unexported fields
}

type GenericSignedAttestation struct {

	// Type (for example schema) of the attestation payload that was signed.
	// The verifier must ensure that the provided type is one that the verifier
	// supports, and that the attestation payload is a valid instantiation of that
	// type (for example by validating a JSON schema).
	ContentType GenericSignedAttestation_ContentType `` /* 165-byte string literal not displayed */
	// The serialized payload that is verified by one or more `signatures`.
	// The encoding and semantic meaning of this payload must match what is set in
	// `content_type`.
	SerializedPayload []byte `protobuf:"bytes,2,opt,name=serialized_payload,json=serializedPayload,proto3" json:"serialized_payload,omitempty"`
	// One or more signatures over `serialized_payload`.  Verifier implementations
	// should consider this attestation message verified if at least one
	// `signature` verifies `serialized_payload`.  See `Signature` in common.proto
	// for more details on signature structure and verification.
	Signatures []*common.Signature `protobuf:"bytes,3,rep,name=signatures,proto3" json:"signatures,omitempty"`
	// contains filtered or unexported fields
}

type GenericSignedAttestation_ContentType int32

type PgpSignedAttestation struct {

	// Required. The raw content of the signature, as output by GNU Privacy Guard
	// (GPG) or equivalent. Since this message only supports attached signatures,
	// the payload that was signed must be attached. While the signature format
	// supported is dependent on the verification implementation, currently only
	// ASCII-armored (`--armor` to gpg), non-clearsigned (`--sign` rather than
	// `--clearsign` to gpg) are supported. Concretely, `gpg --sign --armor
	// --output=signature.gpg payload.json` will create the signature content
	// expected in this field in `signature.gpg` for the `payload.json`
	// attestation payload.
	Signature string `protobuf:"bytes,1,opt,name=signature,proto3" json:"signature,omitempty"`
	// Type (for example schema) of the attestation payload that was signed.
	// The verifier must ensure that the provided type is one that the verifier
	// supports, and that the attestation payload is a valid instantiation of that
	// type (for example by validating a JSON schema).
	ContentType PgpSignedAttestation_ContentType `` /* 161-byte string literal not displayed */
	// This field is used by verifiers to select the public key used to validate
	// the signature. Note that the policy of the verifier ultimately determines
	// which public keys verify a signature based on the context of the
	// verification. There is no guarantee validation will succeed if the
	// verifier has no key matching this ID, even if it has a key under a
	// different ID that would verify the signature. Note that this ID should also
	// be present in the signature content above, but that is not expected to be
	// used by the verifier.
	//
	// Types that are assignable to KeyId:
	//	*PgpSignedAttestation_PgpKeyId
	KeyId isPgpSignedAttestation_KeyId `protobuf_oneof:"key_id"`
	// contains filtered or unexported fields
}

type PgpSignedAttestation_ContentType int32

type PgpSignedAttestation_PgpKeyId struct {
	// The cryptographic fingerprint of the key used to generate the signature,
	// as output by, e.g. `gpg --list-keys`. This should be the version 4, full
	// 160-bit fingerprint, expressed as a 40 character hexidecimal string. See
	// https://tools.ietf.org/html/rfc4880#section-12.2 for details.
	// Implementations may choose to acknowledge "LONG", "SHORT", or other
	// abbreviated key IDs, but only the full fingerprint is guaranteed to work.
	// In gpg, the full fingerprint can be retrieved from the `fpr` field
	// returned when calling --list-keys with --with-colons.  For example:
	// “`
	// gpg --with-colons --with-fingerprint --force-v4-certs \
	//     --list-keys attester@example.com
	// tru::1:1513631572:0:3:1:5
	// pub:...<SNIP>...
	// fpr:::::::::24FF6481B76AC91E66A00AC657A93A81EF3AE6FB:
	// “`
	// Above, the fingerprint is `24FF6481B76AC91E66A00AC657A93A81EF3AE6FB`.
	PgpKeyId string `protobuf:"bytes,2,opt,name=pgp_key_id,json=pgpKeyId,proto3,oneof"`
}