// Copyright 2025 The Sigstore Authors
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

syntax = "proto3";
package dev.sigstore.rekor.v2;

import "sigstore_common.proto";
import "google/api/field_behavior.proto";

option go_package = "github.com/sigstore/rekor-tiles/v2/pkg/generated/protobuf";

option java_package = "dev.sigstore.proto.rekor.v2";
option java_multiple_files = true;
option java_outer_classname = "RekorV2Verifier";
option ruby_package = "Sigstore::Rekor::V2";

// PublicKey contains an encoded public key
message PublicKey {
    // DER-encoded public key
    bytes raw_bytes = 1 [(google.api.field_behavior) = REQUIRED];
}

// Either a public key or a X.509 cerificiate with an embedded public key
message Verifier {
    oneof verifier {
        // DER-encoded public key. Encoding method is specified by the key_details attribute
        PublicKey public_key = 1 [(google.api.field_behavior) = REQUIRED];
        // DER-encoded certificate
        dev.sigstore.common.v1.X509Certificate x509_certificate = 2 [(google.api.field_behavior) = REQUIRED];
    }
    // Key encoding and signature algorithm to use for this key
    dev.sigstore.common.v1.PublicKeyDetails key_details = 3 [(google.api.field_behavior) = REQUIRED];
}

// A signature and an associated verifier
message Signature {
    bytes content = 1 [(google.api.field_behavior) = REQUIRED];
    Verifier verifier = 2 [(google.api.field_behavior) = REQUIRED];
}
