CertificateRequest.java

/*
 * Copyright 2022 The Sigstore Authors.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
package dev.sigstore.fulcio.client;

import dev.sigstore.AlgorithmRegistry;
import dev.sigstore.UnsupportedAlgorithmException;
import dev.sigstore.fulcio.v2.PublicKeyAlgorithm;
import dev.sigstore.proto.ProtoMutators;
import java.security.PublicKey;
import org.immutables.value.Value;

@Value.Immutable
public interface CertificateRequest {
  PublicKey getPublicKey();

  PublicKeyAlgorithm getPublicKeyAlgorithm();

  byte[] getProofOfPossession();

  String getIdToken();

  /**
   * Create a certificate request
   *
   * @param publicKey A public key to verify {@code proofOfPossession}
   * @param idToken An oidc token obtained from an oauth provider
   * @param proofOfPossession The subject or email address from {@code idToken}, signed by the
   *     private key counterpart of {@code publicKey} in asn1 notation
   * @throws UnsupportedAlgorithmException if key type is not in {@link AlgorithmRegistry}
   */
  static CertificateRequest newCertificateRequest(
      PublicKey publicKey, String idToken, byte[] proofOfPossession)
      throws UnsupportedAlgorithmException {
    var signingAlgorithm = AlgorithmRegistry.getSigningAlgorithm(publicKey);
    return ImmutableCertificateRequest.builder()
        .publicKey(publicKey)
        .publicKeyAlgorithm(ProtoMutators.toPublicKeyAlgorithm(signingAlgorithm))
        .idToken(idToken)
        .proofOfPossession(proofOfPossession)
        .build();
  }
}