// Copyright 2022 The Sigstore Authors.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

// Code generated by protoc-gen-go. DO NOT EDIT.
// versions:
// 	protoc-gen-go v1.36.10
// 	protoc        v7.34.1
// source: sigstore_bundle.proto

package v1

import (
	v1 "github.com/sigstore/protobuf-specs/gen/pb-go/common/v1"
	dsse "github.com/sigstore/protobuf-specs/gen/pb-go/dsse"
	v11 "github.com/sigstore/protobuf-specs/gen/pb-go/rekor/v1"
	_ "google.golang.org/genproto/googleapis/api/annotations"
	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
	reflect "reflect"
	sync "sync"
	unsafe "unsafe"
)

const (
	// Verify that this generated code is sufficiently up-to-date.
	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
	// Verify that runtime/protoimpl is sufficiently up-to-date.
	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
)

// Various timestamped counter signatures over the artifacts signature.
// Currently only RFC3161 signatures are provided. More formats may be added
// in the future.
type TimestampVerificationData struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// A list of RFC3161 signed timestamps provided by the user.
	// This can be used when the entry has not been stored on a
	// transparency log, or in conjunction for a stronger trust model.
	// Clients MUST verify the hashed message in the message imprint
	// against the signature in the bundle.
	Rfc3161Timestamps []*v1.RFC3161SignedTimestamp `protobuf:"bytes,1,rep,name=rfc3161_timestamps,json=rfc3161Timestamps,proto3" json:"rfc3161_timestamps,omitempty"`
	unknownFields     protoimpl.UnknownFields
	sizeCache         protoimpl.SizeCache
}

func (x *TimestampVerificationData) Reset() {
	*x = TimestampVerificationData{}
	mi := &file_sigstore_bundle_proto_msgTypes[0]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *TimestampVerificationData) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*TimestampVerificationData) ProtoMessage() {}

func (x *TimestampVerificationData) ProtoReflect() protoreflect.Message {
	mi := &file_sigstore_bundle_proto_msgTypes[0]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use TimestampVerificationData.ProtoReflect.Descriptor instead.
func (*TimestampVerificationData) Descriptor() ([]byte, []int) {
	return file_sigstore_bundle_proto_rawDescGZIP(), []int{0}
}

func (x *TimestampVerificationData) GetRfc3161Timestamps() []*v1.RFC3161SignedTimestamp {
	if x != nil {
		return x.Rfc3161Timestamps
	}
	return nil
}

// VerificationMaterial captures details on the materials used to verify
// signatures. This message may be embedded in a DSSE envelope as a signature
// extension. Specifically, the `ext` field of the extension will expect this
// message when the signature extension is for Sigstore. This is identified by
// the `kind` field in the extension, which must be set to
// application/vnd.dev.sigstore.verificationmaterial;version=0.1 for Sigstore.
// When used as a DSSE extension, if the `public_key` field is used to indicate
// the key identifier, it MUST match the `keyid` field of the signature the
// extension is attached to.
type VerificationMaterial struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// The key material for verification purposes.
	//
	// This allows key material to be conveyed in one of three forms:
	//
	//  1. An unspecified public key identifier, for retrieving a key
	//     from an out-of-band mechanism (such as a keyring);
	//
	//  2. A sequence of one or more X.509 certificates, of which the first member
	//     MUST be a leaf certificate conveying the signing key. Subsequent members
	//     SHOULD be in issuing order, meaning that `n + 1` should be an issuer for `n`.
	//
	//     Signers MUST NOT include root CA certificates in bundles, and SHOULD NOT
	//     include intermediate CA certificates that appear in an independent root of trust
	//     (such as the Public Good Instance's trusted root).
	//
	//     Verifiers MUST validate the chain carefully to ensure that it chains up
	//     to a CA certificate that they independently trust. Verifiers SHOULD
	//     handle old or non-complying bundles that have superfluous intermediate and/or
	//     root CA certificates by either ignoring them or explicitly considering them
	//     untrusted for the purposes of chain building.
	//
	//  3. A single X.509 certificate, which MUST be a leaf certificate conveying
	//     the signing key.
	//
	// When used with the Public Good Instance (PGI) of Sigstore for "keyless" signing
	// via Fulcio, form (1) MUST NOT be used, regardless of bundle version. Form (1)
	// MAY be used with the PGI for self-managed keys.
	//
	// When used in a `0.1` or `0.2` bundle with the PGI and "keyless" signing,
	// form (2) MUST be used.
	//
	// When used in a `0.3` bundle with the PGI and "keyless" signing,
	// form (3) MUST be used.
	//
	// Types that are valid to be assigned to Content:
	//
	//	*VerificationMaterial_PublicKey
	//	*VerificationMaterial_X509CertificateChain
	//	*VerificationMaterial_Certificate
	Content isVerificationMaterial_Content `protobuf_oneof:"content"`
	// An inclusion proof and an optional signed timestamp from the log.
	// Client verification libraries MAY provide an option to support v0.1
	// bundles for backwards compatibility, which may contain an inclusion
	// promise and not an inclusion proof. In this case, the client MUST
	// validate the promise.
	// Verifiers SHOULD NOT allow v0.1 bundles if they're used in an
	// ecosystem which never produced them.
	TlogEntries []*v11.TransparencyLogEntry `protobuf:"bytes,3,rep,name=tlog_entries,json=tlogEntries,proto3" json:"tlog_entries,omitempty"`
	// Timestamp may also come from
	// tlog_entries.inclusion_promise.signed_entry_timestamp.
	TimestampVerificationData *TimestampVerificationData `protobuf:"bytes,4,opt,name=timestamp_verification_data,json=timestampVerificationData,proto3" json:"timestamp_verification_data,omitempty"`
	unknownFields             protoimpl.UnknownFields
	sizeCache                 protoimpl.SizeCache
}

func (x *VerificationMaterial) Reset() {
	*x = VerificationMaterial{}
	mi := &file_sigstore_bundle_proto_msgTypes[1]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *VerificationMaterial) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*VerificationMaterial) ProtoMessage() {}

func (x *VerificationMaterial) ProtoReflect() protoreflect.Message {
	mi := &file_sigstore_bundle_proto_msgTypes[1]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use VerificationMaterial.ProtoReflect.Descriptor instead.
func (*VerificationMaterial) Descriptor() ([]byte, []int) {
	return file_sigstore_bundle_proto_rawDescGZIP(), []int{1}
}

func (x *VerificationMaterial) GetContent() isVerificationMaterial_Content {
	if x != nil {
		return x.Content
	}
	return nil
}

func (x *VerificationMaterial) GetPublicKey() *v1.PublicKeyIdentifier {
	if x != nil {
		if x, ok := x.Content.(*VerificationMaterial_PublicKey); ok {
			return x.PublicKey
		}
	}
	return nil
}

func (x *VerificationMaterial) GetX509CertificateChain() *v1.X509CertificateChain {
	if x != nil {
		if x, ok := x.Content.(*VerificationMaterial_X509CertificateChain); ok {
			return x.X509CertificateChain
		}
	}
	return nil
}

func (x *VerificationMaterial) GetCertificate() *v1.X509Certificate {
	if x != nil {
		if x, ok := x.Content.(*VerificationMaterial_Certificate); ok {
			return x.Certificate
		}
	}
	return nil
}

func (x *VerificationMaterial) GetTlogEntries() []*v11.TransparencyLogEntry {
	if x != nil {
		return x.TlogEntries
	}
	return nil
}

func (x *VerificationMaterial) GetTimestampVerificationData() *TimestampVerificationData {
	if x != nil {
		return x.TimestampVerificationData
	}
	return nil
}

type isVerificationMaterial_Content interface {
	isVerificationMaterial_Content()
}

type VerificationMaterial_PublicKey struct {
	PublicKey *v1.PublicKeyIdentifier `protobuf:"bytes,1,opt,name=public_key,json=publicKey,proto3,oneof"`
}

type VerificationMaterial_X509CertificateChain struct {
	X509CertificateChain *v1.X509CertificateChain `protobuf:"bytes,2,opt,name=x509_certificate_chain,json=x509CertificateChain,proto3,oneof"`
}

type VerificationMaterial_Certificate struct {
	Certificate *v1.X509Certificate `protobuf:"bytes,5,opt,name=certificate,proto3,oneof"`
}

func (*VerificationMaterial_PublicKey) isVerificationMaterial_Content() {}

func (*VerificationMaterial_X509CertificateChain) isVerificationMaterial_Content() {}

func (*VerificationMaterial_Certificate) isVerificationMaterial_Content() {}

type Bundle struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// MUST be application/vnd.dev.sigstore.bundle.v0.3+json when
	// when encoded as JSON.
	// Clients must to be able to accept media type using the previously
	// defined formats:
	// * application/vnd.dev.sigstore.bundle+json;version=0.1
	// * application/vnd.dev.sigstore.bundle+json;version=0.2
	// * application/vnd.dev.sigstore.bundle+json;version=0.3
	MediaType string `protobuf:"bytes,1,opt,name=media_type,json=mediaType,proto3" json:"media_type,omitempty"`
	// When a signer is identified by a X.509 certificate, a verifier MUST
	// verify that the signature was computed at the time the certificate
	// was valid as described in the Sigstore client spec: "Verification
	// using a Bundle".
	// <https://docs.google.com/document/d/1kbhK2qyPPk8SLavHzYSDM8-Ueul9_oxIMVFuWMWKz0E/edit#heading=h.x8bduppe89ln>
	// If the verification material contains a public key identifier
	// (key hint) and the `content` is a DSSE envelope, the key hints
	// MUST be exactly the same in the verification material and in the
	// DSSE envelope.
	VerificationMaterial *VerificationMaterial `protobuf:"bytes,2,opt,name=verification_material,json=verificationMaterial,proto3" json:"verification_material,omitempty"`
	// Types that are valid to be assigned to Content:
	//
	//	*Bundle_MessageSignature
	//	*Bundle_DsseEnvelope
	Content       isBundle_Content `protobuf_oneof:"content"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *Bundle) Reset() {
	*x = Bundle{}
	mi := &file_sigstore_bundle_proto_msgTypes[2]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *Bundle) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*Bundle) ProtoMessage() {}

func (x *Bundle) ProtoReflect() protoreflect.Message {
	mi := &file_sigstore_bundle_proto_msgTypes[2]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use Bundle.ProtoReflect.Descriptor instead.
func (*Bundle) Descriptor() ([]byte, []int) {
	return file_sigstore_bundle_proto_rawDescGZIP(), []int{2}
}

func (x *Bundle) GetMediaType() string {
	if x != nil {
		return x.MediaType
	}
	return ""
}

func (x *Bundle) GetVerificationMaterial() *VerificationMaterial {
	if x != nil {
		return x.VerificationMaterial
	}
	return nil
}

func (x *Bundle) GetContent() isBundle_Content {
	if x != nil {
		return x.Content
	}
	return nil
}

func (x *Bundle) GetMessageSignature() *v1.MessageSignature {
	if x != nil {
		if x, ok := x.Content.(*Bundle_MessageSignature); ok {
			return x.MessageSignature
		}
	}
	return nil
}

func (x *Bundle) GetDsseEnvelope() *dsse.Envelope {
	if x != nil {
		if x, ok := x.Content.(*Bundle_DsseEnvelope); ok {
			return x.DsseEnvelope
		}
	}
	return nil
}

type isBundle_Content interface {
	isBundle_Content()
}

type Bundle_MessageSignature struct {
	MessageSignature *v1.MessageSignature `protobuf:"bytes,3,opt,name=message_signature,json=messageSignature,proto3,oneof"`
}

type Bundle_DsseEnvelope struct {
	// A DSSE envelope can contain arbitrary payloads.
	// Verifiers must verify that the payload type is a
	// supported and expected type. This is part of the DSSE
	// protocol which is defined here:
	// <https://github.com/secure-systems-lab/dsse/blob/master/protocol.md>
	// DSSE envelopes in a bundle MUST have exactly one signature.
	// This is a limitation from the DSSE spec, as it can contain
	// multiple signatures. There are two primary reasons:
	//  1. It simplifies the verification logic and policy
	//  2. The bundle (currently) can only contain a single
	//     instance of the required verification materials
	//
	// During verification a client MUST reject an envelope if
	// the number of signatures is not equal to one.
	DsseEnvelope *dsse.Envelope `protobuf:"bytes,4,opt,name=dsse_envelope,json=dsseEnvelope,proto3,oneof"`
}

func (*Bundle_MessageSignature) isBundle_Content() {}

func (*Bundle_DsseEnvelope) isBundle_Content() {}

var File_sigstore_bundle_proto protoreflect.FileDescriptor

const file_sigstore_bundle_proto_rawDesc = "" +
	"\n" +
	"\x15sigstore_bundle.proto\x12\x16dev.sigstore.bundle.v1\x1a\x1fgoogle/api/field_behavior.proto\x1a\x0eenvelope.proto\x1a\x15sigstore_common.proto\x1a\x14sigstore_rekor.proto\"z\n" +
	"\x19TimestampVerificationData\x12]\n" +
	"\x12rfc3161_timestamps\x18\x01 \x03(\v2..dev.sigstore.common.v1.RFC3161SignedTimestampR\x11rfc3161Timestamps\"\xf4\x03\n" +
	"\x14VerificationMaterial\x12Q\n" +
	"\n" +
	"public_key\x18\x01 \x01(\v2+.dev.sigstore.common.v1.PublicKeyIdentifierB\x03\xe0A\x02H\x00R\tpublicKey\x12i\n" +
	"\x16x509_certificate_chain\x18\x02 \x01(\v2,.dev.sigstore.common.v1.X509CertificateChainB\x03\xe0A\x02H\x00R\x14x509CertificateChain\x12P\n" +
	"\vcertificate\x18\x05 \x01(\v2'.dev.sigstore.common.v1.X509CertificateB\x03\xe0A\x02H\x00R\vcertificate\x12N\n" +
	"\ftlog_entries\x18\x03 \x03(\v2+.dev.sigstore.rekor.v1.TransparencyLogEntryR\vtlogEntries\x12q\n" +
	"\x1btimestamp_verification_data\x18\x04 \x01(\v21.dev.sigstore.bundle.v1.TimestampVerificationDataR\x19timestampVerificationDataB\t\n" +
	"\acontent\"\xbf\x02\n" +
	"\x06Bundle\x12\x1d\n" +
	"\n" +
	"media_type\x18\x01 \x01(\tR\tmediaType\x12f\n" +
	"\x15verification_material\x18\x02 \x01(\v2,.dev.sigstore.bundle.v1.VerificationMaterialB\x03\xe0A\x02R\x14verificationMaterial\x12\\\n" +
	"\x11message_signature\x18\x03 \x01(\v2(.dev.sigstore.common.v1.MessageSignatureB\x03\xe0A\x02H\x00R\x10messageSignature\x12?\n" +
	"\rdsse_envelope\x18\x04 \x01(\v2\x13.io.intoto.EnvelopeB\x03\xe0A\x02H\x00R\fdsseEnvelopeB\t\n" +
	"\acontentJ\x04\b\x05\x103B|\n" +
	"\x1cdev.sigstore.proto.bundle.v1B\vBundleProtoP\x01Z6github.com/sigstore/protobuf-specs/gen/pb-go/bundle/v1\xea\x02\x14Sigstore::Bundle::V1b\x06proto3"

var (
	file_sigstore_bundle_proto_rawDescOnce sync.Once
	file_sigstore_bundle_proto_rawDescData []byte
)

func file_sigstore_bundle_proto_rawDescGZIP() []byte {
	file_sigstore_bundle_proto_rawDescOnce.Do(func() {
		file_sigstore_bundle_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_sigstore_bundle_proto_rawDesc), len(file_sigstore_bundle_proto_rawDesc)))
	})
	return file_sigstore_bundle_proto_rawDescData
}

var file_sigstore_bundle_proto_msgTypes = make([]protoimpl.MessageInfo, 3)
var file_sigstore_bundle_proto_goTypes = []any{
	(*TimestampVerificationData)(nil), // 0: dev.sigstore.bundle.v1.TimestampVerificationData
	(*VerificationMaterial)(nil),      // 1: dev.sigstore.bundle.v1.VerificationMaterial
	(*Bundle)(nil),                    // 2: dev.sigstore.bundle.v1.Bundle
	(*v1.RFC3161SignedTimestamp)(nil), // 3: dev.sigstore.common.v1.RFC3161SignedTimestamp
	(*v1.PublicKeyIdentifier)(nil),    // 4: dev.sigstore.common.v1.PublicKeyIdentifier
	(*v1.X509CertificateChain)(nil),   // 5: dev.sigstore.common.v1.X509CertificateChain
	(*v1.X509Certificate)(nil),        // 6: dev.sigstore.common.v1.X509Certificate
	(*v11.TransparencyLogEntry)(nil),  // 7: dev.sigstore.rekor.v1.TransparencyLogEntry
	(*v1.MessageSignature)(nil),       // 8: dev.sigstore.common.v1.MessageSignature
	(*dsse.Envelope)(nil),             // 9: io.intoto.Envelope
}
var file_sigstore_bundle_proto_depIdxs = []int32{
	3, // 0: dev.sigstore.bundle.v1.TimestampVerificationData.rfc3161_timestamps:type_name -> dev.sigstore.common.v1.RFC3161SignedTimestamp
	4, // 1: dev.sigstore.bundle.v1.VerificationMaterial.public_key:type_name -> dev.sigstore.common.v1.PublicKeyIdentifier
	5, // 2: dev.sigstore.bundle.v1.VerificationMaterial.x509_certificate_chain:type_name -> dev.sigstore.common.v1.X509CertificateChain
	6, // 3: dev.sigstore.bundle.v1.VerificationMaterial.certificate:type_name -> dev.sigstore.common.v1.X509Certificate
	7, // 4: dev.sigstore.bundle.v1.VerificationMaterial.tlog_entries:type_name -> dev.sigstore.rekor.v1.TransparencyLogEntry
	0, // 5: dev.sigstore.bundle.v1.VerificationMaterial.timestamp_verification_data:type_name -> dev.sigstore.bundle.v1.TimestampVerificationData
	1, // 6: dev.sigstore.bundle.v1.Bundle.verification_material:type_name -> dev.sigstore.bundle.v1.VerificationMaterial
	8, // 7: dev.sigstore.bundle.v1.Bundle.message_signature:type_name -> dev.sigstore.common.v1.MessageSignature
	9, // 8: dev.sigstore.bundle.v1.Bundle.dsse_envelope:type_name -> io.intoto.Envelope
	9, // [9:9] is the sub-list for method output_type
	9, // [9:9] is the sub-list for method input_type
	9, // [9:9] is the sub-list for extension type_name
	9, // [9:9] is the sub-list for extension extendee
	0, // [0:9] is the sub-list for field type_name
}

func init() { file_sigstore_bundle_proto_init() }
func file_sigstore_bundle_proto_init() {
	if File_sigstore_bundle_proto != nil {
		return
	}
	file_sigstore_bundle_proto_msgTypes[1].OneofWrappers = []any{
		(*VerificationMaterial_PublicKey)(nil),
		(*VerificationMaterial_X509CertificateChain)(nil),
		(*VerificationMaterial_Certificate)(nil),
	}
	file_sigstore_bundle_proto_msgTypes[2].OneofWrappers = []any{
		(*Bundle_MessageSignature)(nil),
		(*Bundle_DsseEnvelope)(nil),
	}
	type x struct{}
	out := protoimpl.TypeBuilder{
		File: protoimpl.DescBuilder{
			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
			RawDescriptor: unsafe.Slice(unsafe.StringData(file_sigstore_bundle_proto_rawDesc), len(file_sigstore_bundle_proto_rawDesc)),
			NumEnums:      0,
			NumMessages:   3,
			NumExtensions: 0,
			NumServices:   0,
		},
		GoTypes:           file_sigstore_bundle_proto_goTypes,
		DependencyIndexes: file_sigstore_bundle_proto_depIdxs,
		MessageInfos:      file_sigstore_bundle_proto_msgTypes,
	}.Build()
	File_sigstore_bundle_proto = out.File
	file_sigstore_bundle_proto_goTypes = nil
	file_sigstore_bundle_proto_depIdxs = nil
}
