syntax = "proto3";

package talos.resource.definitions.security;

option go_package = "github.com/siderolabs/talos/pkg/machinery/api/resource/definitions/security";
option java_package = "dev.talos.api.resource.definitions.security";

import "google/protobuf/timestamp.proto";

// ImageKeylessVerifierSpec represents a signature verification provider.
message ImageKeylessVerifierSpec {
  string issuer = 1;
  string subject = 2;
  string subject_regex = 3;
}

// ImagePublicKeyVerifierSpec represents a signature verification provider with static public key.
message ImagePublicKeyVerifierSpec {
  string certificate = 1;
}

// ImageVerificationRuleSpec represents a verification rule.
message ImageVerificationRuleSpec {
  string image_pattern = 2;
  bool skip = 3;
  bool deny = 4;
  ImageKeylessVerifierSpec keyless_verifier = 5;
  ImagePublicKeyVerifierSpec public_key_verifier = 6;
}

// TUFTrustedRootSpec represents a sigstore's TUF trusted root information.
message TUFTrustedRootSpec {
  google.protobuf.Timestamp last_refresh_time = 1;
  string json_data = 2;
}

