1import enum
2import typing as t
3
4from sigstore_models._core import Base
5from sigstore_models.common.v1 import (
6 DistinguishedName,
7 HashAlgorithm,
8 LogId,
9 PublicKey,
10 TimeRange,
11 X509CertificateChain,
12)
13
14
15class TransparencyLogInstance(Base):
16 base_url: str
17 hash_algorithm: HashAlgorithm
18 public_key: PublicKey
19 log_id: LogId
20 checkpoint_key_id: t.Optional[LogId] = None
21 operator: t.Optional[str] = None
22
23
24class CertificateAuthority(Base):
25 subject: DistinguishedName
26 uri: t.Optional[str] = None
27 cert_chain: X509CertificateChain
28 valid_for: TimeRange
29 operator: t.Optional[str] = None
30
31
32TRUSTED_ROOT_MEDIA_TYPES = t.Literal[
33 "application/vnd.dev.sigstore.trustedroot+json;version=0.1",
34 "application/vnd.dev.sigstore.trustedroot.v0.2+json",
35]
36
37
38class TrustedRoot(Base):
39 media_type: TRUSTED_ROOT_MEDIA_TYPES
40 tlogs: list[TransparencyLogInstance]
41 certificate_authorities: list[CertificateAuthority]
42 ctlogs: list[TransparencyLogInstance]
43 timestamp_authorities: list[CertificateAuthority] = []
44
45
46SIGNING_CONFIG_MEDIA_TYPES = t.Literal[
47 "application/vnd.dev.sigstore.signingconfig.v0.1+json",
48 "application/vnd.dev.sigstore.signingconfig.v0.2+json",
49]
50
51
52class SigningConfig(Base):
53 media_type: SIGNING_CONFIG_MEDIA_TYPES
54 ca_urls: list["Service"] = []
55 oidc_urls: list["Service"] = []
56 rekor_tlog_urls: list["Service"] = []
57 rekor_tlog_config: t.Optional["ServiceConfiguration"] = None
58 tsa_urls: list["Service"] = []
59 tsa_config: t.Optional["ServiceConfiguration"] = None
60
61
62class Service(Base):
63 url: str
64 major_api_version: int
65 valid_for: t.Optional[TimeRange] = None
66 operator: str
67
68
69class ServiceSelector(str, enum.Enum):
70 ALL = "ALL"
71 ANY = "ANY"
72 EXACT = "EXACT"
73
74
75class ServiceConfiguration(Base):
76 selector: ServiceSelector
77 count: t.Optional[int] = None
78
79
80class ClientTrustConfig(Base):
81 media_type: t.Literal["application/vnd.dev.sigstore.clienttrustconfig.v0.1+json"]
82
83 trusted_root: TrustedRoot
84 signing_config: SigningConfig