diff --git a/gen/jsonschema/schemas/ClientTrustConfig.schema.json b/gen/jsonschema/schemas/ClientTrustConfig.schema.json new file mode 100644 index 00000000..1135cbf1 --- /dev/null +++ b/gen/jsonschema/schemas/ClientTrustConfig.schema.json @@ -0,0 +1,299 @@ +{ + "$schema": "http://json-schema.org/draft-04/schema#", + "$ref": "#/definitions/ClientTrustConfig", + "definitions": { + "ClientTrustConfig": { + "properties": { + "mediaType": { + "type": "string", + "description": "MUST be application/vnd.dev.sigstore.clienttrustconfig.v0.1+json" + }, + "trustedRoot": { + "$ref": "#/definitions/dev.sigstore.trustroot.v1.TrustedRoot", + "additionalProperties": false, + "description": "The root of trust, which MUST be present." + }, + "signingConfig": { + "$ref": "#/definitions/dev.sigstore.trustroot.v1.SigningConfig", + "additionalProperties": false, + "description": "Configuration for signing clients, which MUST be present." + } + }, + "additionalProperties": false, + "type": "object", + "title": "Client Trust Config", + "description": "ClientTrustConfig describes the complete state needed by a client to perform both signing and verification operations against a particular instance of Sigstore." + }, + "dev.sigstore.common.v1.DistinguishedName": { + "properties": { + "organization": { + "type": "string" + }, + "commonName": { + "type": "string" + } + }, + "additionalProperties": false, + "type": "object", + "title": "Distinguished Name" + }, + "dev.sigstore.common.v1.LogId": { + "properties": { + "keyId": { + "type": "string", + "description": "The unique id of the log, represented as the SHA-256 hash of the log's public key, calculated over the DER encoding of the key represented as SubjectPublicKeyInfo. See https://www.rfc-editor.org/rfc/rfc6962#section-3.2", + "format": "binary", + "binaryEncoding": "base64" + } + }, + "additionalProperties": false, + "type": "object", + "title": "Log Id", + "description": "LogId captures the identity of a transparency log." + }, + "dev.sigstore.common.v1.PublicKey": { + "properties": { + "rawBytes": { + "type": "string", + "description": "DER-encoded public key, encoding method is specified by the key_details attribute.", + "format": "binary", + "binaryEncoding": "base64" + }, + "keyDetails": { + "enum": [ + "PUBLIC_KEY_DETAILS_UNSPECIFIED", + "PKCS1_RSA_PKCS1V5", + "PKCS1_RSA_PSS", + "PKIX_RSA_PKCS1V5", + "PKIX_RSA_PSS", + "PKIX_RSA_PKCS1V15_2048_SHA256", + "PKIX_RSA_PKCS1V15_3072_SHA256", + "PKIX_RSA_PKCS1V15_4096_SHA256", + "PKIX_RSA_PSS_2048_SHA256", + "PKIX_RSA_PSS_3072_SHA256", + "PKIX_RSA_PSS_4096_SHA256", + "PKIX_ECDSA_P256_HMAC_SHA_256", + "PKIX_ECDSA_P256_SHA_256", + "PKIX_ECDSA_P384_SHA_384", + "PKIX_ECDSA_P521_SHA_512", + "PKIX_ED25519", + "PKIX_ED25519_PH", + "LMS_SHA256", + "LMOTS_SHA256" + ], + "type": "string", + "title": "Public Key Details", + "description": "Details of a specific public key, capturing the the key encoding method, and signature algorithm. PublicKeyDetails captures the public key/hash algorithm combinations recommended in the Sigstore ecosystem. This is modelled as a linear set as we want to provide a small number of opinionated options instead of allowing every possible permutation. Any changes to this enum MUST be reflected in the algorithm registry. See: docs/algorithm-registry.md To avoid the possibility of contradicting formats such as PKCS1 with ED25519 the valid permutations are listed as a linear set instead of a cartesian set (i.e one combined variable instead of two, one for encoding and one for the signature algorithm)." + }, + "validFor": { + "$ref": "#/definitions/dev.sigstore.common.v1.TimeRange", + "additionalProperties": false, + "description": "Optional validity period for this key, *inclusive* of the endpoints." + } + }, + "additionalProperties": false, + "type": "object", + "oneOf": [ + { + "required": [ + "raw_bytes" + ] + }, + { + "required": [ + "valid_for" + ] + } + ], + "title": "Public Key" + }, + "dev.sigstore.common.v1.TimeRange": { + "properties": { + "start": { + "type": "string", + "format": "date-time" + }, + "end": { + "type": "string", + "format": "date-time" + } + }, + "additionalProperties": false, + "type": "object", + "oneOf": [ + { + "required": [ + "end" + ] + } + ], + "title": "Time Range", + "description": "The time range is closed and includes both the start and end times, (i.e., [start, end]). End is optional to be able to capture a period that has started but has no known end." + }, + "dev.sigstore.common.v1.X509Certificate": { + "properties": { + "rawBytes": { + "type": "string", + "description": "DER-encoded X.509 certificate.", + "format": "binary", + "binaryEncoding": "base64" + } + }, + "additionalProperties": false, + "type": "object", + "title": "X 509 Certificate" + }, + "dev.sigstore.common.v1.X509CertificateChain": { + "properties": { + "certificates": { + "items": { + "$ref": "#/definitions/dev.sigstore.common.v1.X509Certificate" + }, + "additionalProperties": false, + "type": "array", + "description": "One or more DER-encoded certificates. In some contexts (such as `VerificationMaterial.x509_certificate_chain`), this sequence has an imposed order. Unless explicitly specified, there is otherwise no guaranteed order." + } + }, + "additionalProperties": false, + "type": "object", + "title": "X 509 Certificate Chain", + "description": "A collection of X.509 certificates. This \"chain\" can be used in multiple contexts, such as providing a root CA certificate within a TUF root of trust or multiple untrusted certificates for the purpose of chain building." + }, + "dev.sigstore.trustroot.v1.CertificateAuthority": { + "properties": { + "subject": { + "$ref": "#/definitions/dev.sigstore.common.v1.DistinguishedName", + "additionalProperties": false, + "description": "The root certificate MUST be self-signed, and so the subject and issuer are the same." + }, + "uri": { + "type": "string", + "description": "The URI identifies the certificate authority. It is RECOMMENDED that the URI is the base URL for the certificate authority, that can be provided to any SDK/client provided by the certificate authority to interact with the certificate authority." + }, + "certChain": { + "$ref": "#/definitions/dev.sigstore.common.v1.X509CertificateChain", + "additionalProperties": false, + "description": "The certificate chain for this CA. The last certificate in the chain MUST be the trust anchor. The trust anchor MAY be a self-signed root CA certificate or MAY be an intermediate CA certificate." + }, + "validFor": { + "$ref": "#/definitions/dev.sigstore.common.v1.TimeRange", + "additionalProperties": false, + "description": "The time the *entire* chain was valid. This is at max the longest interval when *all* certificates in the chain were valid, but it MAY be shorter. Clients MUST check timestamps against *both* the `valid_for` time range *and* the entire certificate chain. The TimeRange should be considered valid *inclusive* of the endpoints." + } + }, + "additionalProperties": false, + "type": "object", + "title": "Certificate Authority", + "description": "CertificateAuthority enlists the information required to identify which CA to use and perform signature verification." + }, + "dev.sigstore.trustroot.v1.SigningConfig": { + "properties": { + "caUrl": { + "type": "string", + "description": "A URL to a Fulcio-compatible CA, capable of receiving Certificate Signing Requests (CSRs) and responding with issued certificates. This URL **MUST** be the \"base\" URL for the CA, which clients should construct an appropriate CSR endpoint on top of. For example, if `ca_url` is `https://example.com/ca`, then the client **MAY** construct the CSR endpoint as `https://example.com/ca/api/v2/signingCert`." + }, + "oidcUrl": { + "type": "string", + "description": "A URL to an OpenID Connect identity provider. This URL **MUST** be the \"base\" URL for the OIDC IdP, which clients should perform well-known OpenID Connect discovery against." + }, + "tlogUrls": { + "items": { + "type": "string" + }, + "type": "array", + "description": "One or more URLs to Rekor-compatible transparency log. Each URL **MUST** be the \"base\" URL for the transparency log, which clients should construct appropriate API endpoints on top of." + }, + "tsaUrls": { + "items": { + "type": "string" + }, + "type": "array", + "description": "One ore more URLs to RFC 3161 Time Stamping Authority (TSA). Each URL **MUST** be the **full** URL for the TSA, meaning that it should be suitable for submitting Time Stamp Requests (TSRs) to via HTTP, per RFC 3161." + } + }, + "additionalProperties": false, + "type": "object", + "title": "Signing Config", + "description": "SigningConfig represents the trusted entities/state needed by Sigstore signing. In particular, it primarily contains service URLs that a Sigstore signer may need to connect to for the online aspects of signing." + }, + "dev.sigstore.trustroot.v1.TransparencyLogInstance": { + "properties": { + "baseUrl": { + "type": "string", + "description": "The base URL at which can be used to URLs for the client." + }, + "hashAlgorithm": { + "enum": [ + "HASH_ALGORITHM_UNSPECIFIED", + "SHA2_256", + "SHA2_384", + "SHA2_512", + "SHA3_256", + "SHA3_384" + ], + "type": "string", + "title": "This package defines commonly used message types within the Sigstore\n community.", + "description": "This package defines commonly used message types within the Sigstore community. Only a subset of the secure hash standard algorithms are supported. See \u003chttps://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.180-4.pdf\u003e for more details. UNSPECIFIED SHOULD not be used, primary reason for inclusion is to force any proto JSON serialization to emit the used hash algorithm, as default option is to *omit* the default value of an enum (which is the first value, represented by '0'." + }, + "publicKey": { + "$ref": "#/definitions/dev.sigstore.common.v1.PublicKey", + "additionalProperties": false, + "description": "The public key used to verify signatures generated by the log. This attribute contains the signature algorithm used by the log." + }, + "logId": { + "$ref": "#/definitions/dev.sigstore.common.v1.LogId", + "additionalProperties": false, + "description": "The unique identifier for this transparency log." + } + }, + "additionalProperties": false, + "type": "object", + "title": "Transparency Log Instance", + "description": "TransparencyLogInstance describes the immutable parameters from a transparency log. See https://www.rfc-editor.org/rfc/rfc9162.html#name-log-parameters for more details. The included parameters are the minimal set required to identify a log, and verify an inclusion proof/promise." + }, + "dev.sigstore.trustroot.v1.TrustedRoot": { + "properties": { + "mediaType": { + "type": "string", + "description": "MUST be application/vnd.dev.sigstore.trustedroot.v0.1+json when encoded as JSON. Clients MUST be able to process and parse content with the media type defined in the old format: application/vnd.dev.sigstore.trustedroot+json;version=0.1" + }, + "tlogs": { + "items": { + "$ref": "#/definitions/dev.sigstore.trustroot.v1.TransparencyLogInstance" + }, + "additionalProperties": false, + "type": "array", + "description": "A set of trusted Rekor servers." + }, + "certificateAuthorities": { + "items": { + "$ref": "#/definitions/dev.sigstore.trustroot.v1.CertificateAuthority" + }, + "additionalProperties": false, + "type": "array", + "description": "A set of trusted certificate authorities (e.g Fulcio), and any intermediate certificates they provide. If a CA is issuing multiple intermediate certificate, each combination shall be represented as separate chain. I.e, a single root cert may appear in multiple chains but with different intermediate and/or leaf certificates. The certificates are intended to be used for verifying artifact signatures." + }, + "ctlogs": { + "items": { + "$ref": "#/definitions/dev.sigstore.trustroot.v1.TransparencyLogInstance" + }, + "additionalProperties": false, + "type": "array", + "description": "A set of trusted certificate transparency logs." + }, + "timestampAuthorities": { + "items": { + "$ref": "#/definitions/dev.sigstore.trustroot.v1.CertificateAuthority" + }, + "additionalProperties": false, + "type": "array", + "description": "A set of trusted timestamping authorities." + } + }, + "additionalProperties": false, + "type": "object", + "title": "Trusted Root", + "description": "TrustedRoot describes the client's complete set of trusted entities. How the TrustedRoot is populated is not specified, but can be a combination of many sources such as TUF repositories, files on disk etc. The TrustedRoot is not meant to be used for any artifact verification, only to capture the complete/global set of trusted verification materials. When verifying an artifact, based on the artifact and policies, a selection of keys/authorities are expected to be extracted and provided to the verification function. This way the set of keys/authorities can be kept to a minimal set by the policy to gain better control over what signatures that are allowed. The embedded transparency logs, CT logs, CAs and TSAs MUST include any previously used instance -- otherwise signatures made in the past cannot be verified. All the listed instances SHOULD be sorted by the 'valid_for' in ascending order, that is, the oldest instance first. Only the last instance is allowed to have their 'end' timestamp unset. All previous instances MUST have a closed interval of validity. The last instance MAY have a closed interval. Clients MUST accept instances that overlaps in time, if not clients may experience problems during rotations of verification materials. To be able to manage planned rotations of either transparency logs or certificate authorities, clienst MUST accept lists of instances where the last instance have a 'valid_for' that belongs to the future. This should not be a problem as clients SHOULD first seek the trust root for a suitable instance before creating a per artifact trust root (that is, a sub-set of the complete trust root) that is used for verification." + } + } +} \ No newline at end of file diff --git a/gen/jsonschema/schemas/SigningConfig.schema.json b/gen/jsonschema/schemas/SigningConfig.schema.json new file mode 100644 index 00000000..71d7723b --- /dev/null +++ b/gen/jsonschema/schemas/SigningConfig.schema.json @@ -0,0 +1,36 @@ +{ + "$schema": "http://json-schema.org/draft-04/schema#", + "$ref": "#/definitions/SigningConfig", + "definitions": { + "SigningConfig": { + "properties": { + "caUrl": { + "type": "string", + "description": "A URL to a Fulcio-compatible CA, capable of receiving Certificate Signing Requests (CSRs) and responding with issued certificates. This URL **MUST** be the \"base\" URL for the CA, which clients should construct an appropriate CSR endpoint on top of. For example, if `ca_url` is `https://example.com/ca`, then the client **MAY** construct the CSR endpoint as `https://example.com/ca/api/v2/signingCert`." + }, + "oidcUrl": { + "type": "string", + "description": "A URL to an OpenID Connect identity provider. This URL **MUST** be the \"base\" URL for the OIDC IdP, which clients should perform well-known OpenID Connect discovery against." + }, + "tlogUrls": { + "items": { + "type": "string" + }, + "type": "array", + "description": "One or more URLs to Rekor-compatible transparency log. Each URL **MUST** be the \"base\" URL for the transparency log, which clients should construct appropriate API endpoints on top of." + }, + "tsaUrls": { + "items": { + "type": "string" + }, + "type": "array", + "description": "One ore more URLs to RFC 3161 Time Stamping Authority (TSA). Each URL **MUST** be the **full** URL for the TSA, meaning that it should be suitable for submitting Time Stamp Requests (TSRs) to via HTTP, per RFC 3161." + } + }, + "additionalProperties": false, + "type": "object", + "title": "Signing Config", + "description": "SigningConfig represents the trusted entities/state needed by Sigstore signing. In particular, it primarily contains service URLs that a Sigstore signer may need to connect to for the online aspects of signing." + } + } +} \ No newline at end of file diff --git a/gen/pb-go/trustroot/v1/sigstore_trustroot.pb.go b/gen/pb-go/trustroot/v1/sigstore_trustroot.pb.go index 31b193dd..55e80eb5 100644 --- a/gen/pb-go/trustroot/v1/sigstore_trustroot.pb.go +++ b/gen/pb-go/trustroot/v1/sigstore_trustroot.pb.go @@ -22,6 +22,7 @@ package v1 import ( v1 "github.com/sigstore/protobuf-specs/gen/pb-go/common/v1" + _ "google.golang.org/genproto/googleapis/api/annotations" protoreflect "google.golang.org/protobuf/reflect/protoreflect" protoimpl "google.golang.org/protobuf/runtime/protoimpl" reflect "reflect" @@ -333,80 +334,269 @@ func (x *TrustedRoot) GetTimestampAuthorities() []*CertificateAuthority { return nil } +// SigningConfig represents the trusted entities/state needed by Sigstore +// signing. In particular, it primarily contains service URLs that a Sigstore +// signer may need to connect to for the online aspects of signing. +type SigningConfig struct { + state protoimpl.MessageState + sizeCache protoimpl.SizeCache + unknownFields protoimpl.UnknownFields + + // A URL to a Fulcio-compatible CA, capable of receiving + // Certificate Signing Requests (CSRs) and responding with + // issued certificates. + // + // This URL **MUST** be the "base" URL for the CA, which clients + // should construct an appropriate CSR endpoint on top of. + // For example, if `ca_url` is `https://example.com/ca`, then + // the client **MAY** construct the CSR endpoint as + // `https://example.com/ca/api/v2/signingCert`. + CaUrl string `protobuf:"bytes,1,opt,name=ca_url,json=caUrl,proto3" json:"ca_url,omitempty"` + // A URL to an OpenID Connect identity provider. + // + // This URL **MUST** be the "base" URL for the OIDC IdP, which clients + // should perform well-known OpenID Connect discovery against. + OidcUrl string `protobuf:"bytes,2,opt,name=oidc_url,json=oidcUrl,proto3" json:"oidc_url,omitempty"` + // One or more URLs to Rekor-compatible transparency log. + // + // Each URL **MUST** be the "base" URL for the transparency log, + // which clients should construct appropriate API endpoints on top of. + TlogUrls []string `protobuf:"bytes,3,rep,name=tlog_urls,json=tlogUrls,proto3" json:"tlog_urls,omitempty"` + // One ore more URLs to RFC 3161 Time Stamping Authority (TSA). + // + // Each URL **MUST** be the **full** URL for the TSA, meaning that it + // should be suitable for submitting Time Stamp Requests (TSRs) to + // via HTTP, per RFC 3161. + TsaUrls []string `protobuf:"bytes,4,rep,name=tsa_urls,json=tsaUrls,proto3" json:"tsa_urls,omitempty"` +} + +func (x *SigningConfig) Reset() { + *x = SigningConfig{} + if protoimpl.UnsafeEnabled { + mi := &file_sigstore_trustroot_proto_msgTypes[3] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) + } +} + +func (x *SigningConfig) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*SigningConfig) ProtoMessage() {} + +func (x *SigningConfig) ProtoReflect() protoreflect.Message { + mi := &file_sigstore_trustroot_proto_msgTypes[3] + if protoimpl.UnsafeEnabled && x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use SigningConfig.ProtoReflect.Descriptor instead. +func (*SigningConfig) Descriptor() ([]byte, []int) { + return file_sigstore_trustroot_proto_rawDescGZIP(), []int{3} +} + +func (x *SigningConfig) GetCaUrl() string { + if x != nil { + return x.CaUrl + } + return "" +} + +func (x *SigningConfig) GetOidcUrl() string { + if x != nil { + return x.OidcUrl + } + return "" +} + +func (x *SigningConfig) GetTlogUrls() []string { + if x != nil { + return x.TlogUrls + } + return nil +} + +func (x *SigningConfig) GetTsaUrls() []string { + if x != nil { + return x.TsaUrls + } + return nil +} + +// ClientTrustConfig describes the complete state needed by a client +// to perform both signing and verification operations against a particular +// instance of Sigstore. +type ClientTrustConfig struct { + state protoimpl.MessageState + sizeCache protoimpl.SizeCache + unknownFields protoimpl.UnknownFields + + // MUST be application/vnd.dev.sigstore.clienttrustconfig.v0.1+json + MediaType string `protobuf:"bytes,1,opt,name=media_type,json=mediaType,proto3" json:"media_type,omitempty"` + // The root of trust, which MUST be present. + TrustedRoot *TrustedRoot `protobuf:"bytes,2,opt,name=trusted_root,json=trustedRoot,proto3" json:"trusted_root,omitempty"` + // Configuration for signing clients, which MUST be present. + SigningConfig *SigningConfig `protobuf:"bytes,3,opt,name=signing_config,json=signingConfig,proto3" json:"signing_config,omitempty"` +} + +func (x *ClientTrustConfig) Reset() { + *x = ClientTrustConfig{} + if protoimpl.UnsafeEnabled { + mi := &file_sigstore_trustroot_proto_msgTypes[4] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) + } +} + +func (x *ClientTrustConfig) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*ClientTrustConfig) ProtoMessage() {} + +func (x *ClientTrustConfig) ProtoReflect() protoreflect.Message { + mi := &file_sigstore_trustroot_proto_msgTypes[4] + if protoimpl.UnsafeEnabled && x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use ClientTrustConfig.ProtoReflect.Descriptor instead. +func (*ClientTrustConfig) Descriptor() ([]byte, []int) { + return file_sigstore_trustroot_proto_rawDescGZIP(), []int{4} +} + +func (x *ClientTrustConfig) GetMediaType() string { + if x != nil { + return x.MediaType + } + return "" +} + +func (x *ClientTrustConfig) GetTrustedRoot() *TrustedRoot { + if x != nil { + return x.TrustedRoot + } + return nil +} + +func (x *ClientTrustConfig) GetSigningConfig() *SigningConfig { + if x != nil { + return x.SigningConfig + } + return nil +} + var File_sigstore_trustroot_proto protoreflect.FileDescriptor var file_sigstore_trustroot_proto_rawDesc = []byte{ 0x0a, 0x18, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x5f, 0x74, 0x72, 0x75, 0x73, 0x74, 0x72, 0x6f, 0x6f, 0x74, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x19, 0x64, 0x65, 0x76, 0x2e, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x74, 0x72, 0x75, 0x73, 0x74, 0x72, 0x6f, - 0x6f, 0x74, 0x2e, 0x76, 0x31, 0x1a, 0x15, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x5f, - 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0xfa, 0x01, 0x0a, - 0x17, 0x54, 0x72, 0x61, 0x6e, 0x73, 0x70, 0x61, 0x72, 0x65, 0x6e, 0x63, 0x79, 0x4c, 0x6f, 0x67, - 0x49, 0x6e, 0x73, 0x74, 0x61, 0x6e, 0x63, 0x65, 0x12, 0x19, 0x0a, 0x08, 0x62, 0x61, 0x73, 0x65, - 0x5f, 0x75, 0x72, 0x6c, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x62, 0x61, 0x73, 0x65, - 0x55, 0x72, 0x6c, 0x12, 0x4c, 0x0a, 0x0e, 0x68, 0x61, 0x73, 0x68, 0x5f, 0x61, 0x6c, 0x67, 0x6f, - 0x72, 0x69, 0x74, 0x68, 0x6d, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x25, 0x2e, 0x64, 0x65, - 0x76, 0x2e, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, - 0x6e, 0x2e, 0x76, 0x31, 0x2e, 0x48, 0x61, 0x73, 0x68, 0x41, 0x6c, 0x67, 0x6f, 0x72, 0x69, 0x74, - 0x68, 0x6d, 0x52, 0x0d, 0x68, 0x61, 0x73, 0x68, 0x41, 0x6c, 0x67, 0x6f, 0x72, 0x69, 0x74, 0x68, - 0x6d, 0x12, 0x40, 0x0a, 0x0a, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x5f, 0x6b, 0x65, 0x79, 0x18, - 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x21, 0x2e, 0x64, 0x65, 0x76, 0x2e, 0x73, 0x69, 0x67, 0x73, - 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x76, 0x31, 0x2e, 0x50, - 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x52, 0x09, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, - 0x4b, 0x65, 0x79, 0x12, 0x34, 0x0a, 0x06, 0x6c, 0x6f, 0x67, 0x5f, 0x69, 0x64, 0x18, 0x04, 0x20, - 0x01, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x64, 0x65, 0x76, 0x2e, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f, - 0x72, 0x65, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x76, 0x31, 0x2e, 0x4c, 0x6f, 0x67, - 0x49, 0x64, 0x52, 0x05, 0x6c, 0x6f, 0x67, 0x49, 0x64, 0x22, 0xfa, 0x01, 0x0a, 0x14, 0x43, 0x65, + 0x6f, 0x74, 0x2e, 0x76, 0x31, 0x1a, 0x1f, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x61, 0x70, + 0x69, 0x2f, 0x66, 0x69, 0x65, 0x6c, 0x64, 0x5f, 0x62, 0x65, 0x68, 0x61, 0x76, 0x69, 0x6f, 0x72, + 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x15, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, + 0x5f, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0xfa, 0x01, + 0x0a, 0x17, 0x54, 0x72, 0x61, 0x6e, 0x73, 0x70, 0x61, 0x72, 0x65, 0x6e, 0x63, 0x79, 0x4c, 0x6f, + 0x67, 0x49, 0x6e, 0x73, 0x74, 0x61, 0x6e, 0x63, 0x65, 0x12, 0x19, 0x0a, 0x08, 0x62, 0x61, 0x73, + 0x65, 0x5f, 0x75, 0x72, 0x6c, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x62, 0x61, 0x73, + 0x65, 0x55, 0x72, 0x6c, 0x12, 0x4c, 0x0a, 0x0e, 0x68, 0x61, 0x73, 0x68, 0x5f, 0x61, 0x6c, 0x67, + 0x6f, 0x72, 0x69, 0x74, 0x68, 0x6d, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x25, 0x2e, 0x64, + 0x65, 0x76, 0x2e, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, + 0x6f, 0x6e, 0x2e, 0x76, 0x31, 0x2e, 0x48, 0x61, 0x73, 0x68, 0x41, 0x6c, 0x67, 0x6f, 0x72, 0x69, + 0x74, 0x68, 0x6d, 0x52, 0x0d, 0x68, 0x61, 0x73, 0x68, 0x41, 0x6c, 0x67, 0x6f, 0x72, 0x69, 0x74, + 0x68, 0x6d, 0x12, 0x40, 0x0a, 0x0a, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x5f, 0x6b, 0x65, 0x79, + 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x21, 0x2e, 0x64, 0x65, 0x76, 0x2e, 0x73, 0x69, 0x67, + 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x76, 0x31, 0x2e, + 0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x52, 0x09, 0x70, 0x75, 0x62, 0x6c, 0x69, + 0x63, 0x4b, 0x65, 0x79, 0x12, 0x34, 0x0a, 0x06, 0x6c, 0x6f, 0x67, 0x5f, 0x69, 0x64, 0x18, 0x04, + 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x64, 0x65, 0x76, 0x2e, 0x73, 0x69, 0x67, 0x73, 0x74, + 0x6f, 0x72, 0x65, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x76, 0x31, 0x2e, 0x4c, 0x6f, + 0x67, 0x49, 0x64, 0x52, 0x05, 0x6c, 0x6f, 0x67, 0x49, 0x64, 0x22, 0xfa, 0x01, 0x0a, 0x14, 0x43, + 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, + 0x69, 0x74, 0x79, 0x12, 0x43, 0x0a, 0x07, 0x73, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x18, 0x01, + 0x20, 0x01, 0x28, 0x0b, 0x32, 0x29, 0x2e, 0x64, 0x65, 0x76, 0x2e, 0x73, 0x69, 0x67, 0x73, 0x74, + 0x6f, 0x72, 0x65, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x69, + 0x73, 0x74, 0x69, 0x6e, 0x67, 0x75, 0x69, 0x73, 0x68, 0x65, 0x64, 0x4e, 0x61, 0x6d, 0x65, 0x52, + 0x07, 0x73, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x12, 0x10, 0x0a, 0x03, 0x75, 0x72, 0x69, 0x18, + 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x75, 0x72, 0x69, 0x12, 0x4b, 0x0a, 0x0a, 0x63, 0x65, + 0x72, 0x74, 0x5f, 0x63, 0x68, 0x61, 0x69, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2c, + 0x2e, 0x64, 0x65, 0x76, 0x2e, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x63, 0x6f, + 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x76, 0x31, 0x2e, 0x58, 0x35, 0x30, 0x39, 0x43, 0x65, 0x72, 0x74, + 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x43, 0x68, 0x61, 0x69, 0x6e, 0x52, 0x09, 0x63, 0x65, + 0x72, 0x74, 0x43, 0x68, 0x61, 0x69, 0x6e, 0x12, 0x3e, 0x0a, 0x09, 0x76, 0x61, 0x6c, 0x69, 0x64, + 0x5f, 0x66, 0x6f, 0x72, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x21, 0x2e, 0x64, 0x65, 0x76, + 0x2e, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, + 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x52, 0x61, 0x6e, 0x67, 0x65, 0x52, 0x08, 0x76, + 0x61, 0x6c, 0x69, 0x64, 0x46, 0x6f, 0x72, 0x22, 0x92, 0x03, 0x0a, 0x0b, 0x54, 0x72, 0x75, 0x73, + 0x74, 0x65, 0x64, 0x52, 0x6f, 0x6f, 0x74, 0x12, 0x1d, 0x0a, 0x0a, 0x6d, 0x65, 0x64, 0x69, 0x61, + 0x5f, 0x74, 0x79, 0x70, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x6d, 0x65, 0x64, + 0x69, 0x61, 0x54, 0x79, 0x70, 0x65, 0x12, 0x48, 0x0a, 0x05, 0x74, 0x6c, 0x6f, 0x67, 0x73, 0x18, + 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x32, 0x2e, 0x64, 0x65, 0x76, 0x2e, 0x73, 0x69, 0x67, 0x73, + 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x74, 0x72, 0x75, 0x73, 0x74, 0x72, 0x6f, 0x6f, 0x74, 0x2e, 0x76, + 0x31, 0x2e, 0x54, 0x72, 0x61, 0x6e, 0x73, 0x70, 0x61, 0x72, 0x65, 0x6e, 0x63, 0x79, 0x4c, 0x6f, + 0x67, 0x49, 0x6e, 0x73, 0x74, 0x61, 0x6e, 0x63, 0x65, 0x52, 0x05, 0x74, 0x6c, 0x6f, 0x67, 0x73, + 0x12, 0x68, 0x0a, 0x17, 0x63, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x5f, + 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x69, 0x65, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, + 0x0b, 0x32, 0x2f, 0x2e, 0x64, 0x65, 0x76, 0x2e, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, + 0x2e, 0x74, 0x72, 0x75, 0x73, 0x74, 0x72, 0x6f, 0x6f, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, - 0x74, 0x79, 0x12, 0x43, 0x0a, 0x07, 0x73, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x18, 0x01, 0x20, - 0x01, 0x28, 0x0b, 0x32, 0x29, 0x2e, 0x64, 0x65, 0x76, 0x2e, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f, - 0x72, 0x65, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x69, 0x73, - 0x74, 0x69, 0x6e, 0x67, 0x75, 0x69, 0x73, 0x68, 0x65, 0x64, 0x4e, 0x61, 0x6d, 0x65, 0x52, 0x07, - 0x73, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x12, 0x10, 0x0a, 0x03, 0x75, 0x72, 0x69, 0x18, 0x02, - 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x75, 0x72, 0x69, 0x12, 0x4b, 0x0a, 0x0a, 0x63, 0x65, 0x72, - 0x74, 0x5f, 0x63, 0x68, 0x61, 0x69, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2c, 0x2e, - 0x64, 0x65, 0x76, 0x2e, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x63, 0x6f, 0x6d, - 0x6d, 0x6f, 0x6e, 0x2e, 0x76, 0x31, 0x2e, 0x58, 0x35, 0x30, 0x39, 0x43, 0x65, 0x72, 0x74, 0x69, - 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x43, 0x68, 0x61, 0x69, 0x6e, 0x52, 0x09, 0x63, 0x65, 0x72, - 0x74, 0x43, 0x68, 0x61, 0x69, 0x6e, 0x12, 0x3e, 0x0a, 0x09, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x5f, - 0x66, 0x6f, 0x72, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x21, 0x2e, 0x64, 0x65, 0x76, 0x2e, - 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, - 0x76, 0x31, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x52, 0x61, 0x6e, 0x67, 0x65, 0x52, 0x08, 0x76, 0x61, - 0x6c, 0x69, 0x64, 0x46, 0x6f, 0x72, 0x22, 0x92, 0x03, 0x0a, 0x0b, 0x54, 0x72, 0x75, 0x73, 0x74, - 0x65, 0x64, 0x52, 0x6f, 0x6f, 0x74, 0x12, 0x1d, 0x0a, 0x0a, 0x6d, 0x65, 0x64, 0x69, 0x61, 0x5f, - 0x74, 0x79, 0x70, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x6d, 0x65, 0x64, 0x69, - 0x61, 0x54, 0x79, 0x70, 0x65, 0x12, 0x48, 0x0a, 0x05, 0x74, 0x6c, 0x6f, 0x67, 0x73, 0x18, 0x02, - 0x20, 0x03, 0x28, 0x0b, 0x32, 0x32, 0x2e, 0x64, 0x65, 0x76, 0x2e, 0x73, 0x69, 0x67, 0x73, 0x74, + 0x74, 0x79, 0x52, 0x16, 0x63, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x41, + 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x69, 0x65, 0x73, 0x12, 0x4a, 0x0a, 0x06, 0x63, 0x74, + 0x6c, 0x6f, 0x67, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x32, 0x2e, 0x64, 0x65, 0x76, + 0x2e, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x74, 0x72, 0x75, 0x73, 0x74, 0x72, + 0x6f, 0x6f, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x72, 0x61, 0x6e, 0x73, 0x70, 0x61, 0x72, 0x65, + 0x6e, 0x63, 0x79, 0x4c, 0x6f, 0x67, 0x49, 0x6e, 0x73, 0x74, 0x61, 0x6e, 0x63, 0x65, 0x52, 0x06, + 0x63, 0x74, 0x6c, 0x6f, 0x67, 0x73, 0x12, 0x64, 0x0a, 0x15, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, + 0x61, 0x6d, 0x70, 0x5f, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x69, 0x65, 0x73, 0x18, + 0x05, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x2f, 0x2e, 0x64, 0x65, 0x76, 0x2e, 0x73, 0x69, 0x67, 0x73, + 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x74, 0x72, 0x75, 0x73, 0x74, 0x72, 0x6f, 0x6f, 0x74, 0x2e, 0x76, + 0x31, 0x2e, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x41, 0x75, 0x74, + 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x52, 0x14, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, + 0x70, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x69, 0x65, 0x73, 0x22, 0x79, 0x0a, 0x0d, + 0x53, 0x69, 0x67, 0x6e, 0x69, 0x6e, 0x67, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x15, 0x0a, + 0x06, 0x63, 0x61, 0x5f, 0x75, 0x72, 0x6c, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x63, + 0x61, 0x55, 0x72, 0x6c, 0x12, 0x19, 0x0a, 0x08, 0x6f, 0x69, 0x64, 0x63, 0x5f, 0x75, 0x72, 0x6c, + 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x6f, 0x69, 0x64, 0x63, 0x55, 0x72, 0x6c, 0x12, + 0x1b, 0x0a, 0x09, 0x74, 0x6c, 0x6f, 0x67, 0x5f, 0x75, 0x72, 0x6c, 0x73, 0x18, 0x03, 0x20, 0x03, + 0x28, 0x09, 0x52, 0x08, 0x74, 0x6c, 0x6f, 0x67, 0x55, 0x72, 0x6c, 0x73, 0x12, 0x19, 0x0a, 0x08, + 0x74, 0x73, 0x61, 0x5f, 0x75, 0x72, 0x6c, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x09, 0x52, 0x07, + 0x74, 0x73, 0x61, 0x55, 0x72, 0x6c, 0x73, 0x22, 0xd8, 0x01, 0x0a, 0x11, 0x43, 0x6c, 0x69, 0x65, + 0x6e, 0x74, 0x54, 0x72, 0x75, 0x73, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x1d, 0x0a, + 0x0a, 0x6d, 0x65, 0x64, 0x69, 0x61, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, + 0x09, 0x52, 0x09, 0x6d, 0x65, 0x64, 0x69, 0x61, 0x54, 0x79, 0x70, 0x65, 0x12, 0x4e, 0x0a, 0x0c, + 0x74, 0x72, 0x75, 0x73, 0x74, 0x65, 0x64, 0x5f, 0x72, 0x6f, 0x6f, 0x74, 0x18, 0x02, 0x20, 0x01, + 0x28, 0x0b, 0x32, 0x26, 0x2e, 0x64, 0x65, 0x76, 0x2e, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, + 0x65, 0x2e, 0x74, 0x72, 0x75, 0x73, 0x74, 0x72, 0x6f, 0x6f, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x54, + 0x72, 0x75, 0x73, 0x74, 0x65, 0x64, 0x52, 0x6f, 0x6f, 0x74, 0x42, 0x03, 0xe0, 0x41, 0x02, 0x52, + 0x0b, 0x74, 0x72, 0x75, 0x73, 0x74, 0x65, 0x64, 0x52, 0x6f, 0x6f, 0x74, 0x12, 0x54, 0x0a, 0x0e, + 0x73, 0x69, 0x67, 0x6e, 0x69, 0x6e, 0x67, 0x5f, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x03, + 0x20, 0x01, 0x28, 0x0b, 0x32, 0x28, 0x2e, 0x64, 0x65, 0x76, 0x2e, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x74, 0x72, 0x75, 0x73, 0x74, 0x72, 0x6f, 0x6f, 0x74, 0x2e, 0x76, 0x31, - 0x2e, 0x54, 0x72, 0x61, 0x6e, 0x73, 0x70, 0x61, 0x72, 0x65, 0x6e, 0x63, 0x79, 0x4c, 0x6f, 0x67, - 0x49, 0x6e, 0x73, 0x74, 0x61, 0x6e, 0x63, 0x65, 0x52, 0x05, 0x74, 0x6c, 0x6f, 0x67, 0x73, 0x12, - 0x68, 0x0a, 0x17, 0x63, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x5f, 0x61, - 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x69, 0x65, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, - 0x32, 0x2f, 0x2e, 0x64, 0x65, 0x76, 0x2e, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, - 0x74, 0x72, 0x75, 0x73, 0x74, 0x72, 0x6f, 0x6f, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x65, 0x72, - 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, - 0x79, 0x52, 0x16, 0x63, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x41, 0x75, - 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x69, 0x65, 0x73, 0x12, 0x4a, 0x0a, 0x06, 0x63, 0x74, 0x6c, - 0x6f, 0x67, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x32, 0x2e, 0x64, 0x65, 0x76, 0x2e, - 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x74, 0x72, 0x75, 0x73, 0x74, 0x72, 0x6f, - 0x6f, 0x74, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x72, 0x61, 0x6e, 0x73, 0x70, 0x61, 0x72, 0x65, 0x6e, - 0x63, 0x79, 0x4c, 0x6f, 0x67, 0x49, 0x6e, 0x73, 0x74, 0x61, 0x6e, 0x63, 0x65, 0x52, 0x06, 0x63, - 0x74, 0x6c, 0x6f, 0x67, 0x73, 0x12, 0x64, 0x0a, 0x15, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, - 0x6d, 0x70, 0x5f, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x69, 0x65, 0x73, 0x18, 0x05, - 0x20, 0x03, 0x28, 0x0b, 0x32, 0x2f, 0x2e, 0x64, 0x65, 0x76, 0x2e, 0x73, 0x69, 0x67, 0x73, 0x74, - 0x6f, 0x72, 0x65, 0x2e, 0x74, 0x72, 0x75, 0x73, 0x74, 0x72, 0x6f, 0x6f, 0x74, 0x2e, 0x76, 0x31, - 0x2e, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x41, 0x75, 0x74, 0x68, - 0x6f, 0x72, 0x69, 0x74, 0x79, 0x52, 0x14, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, - 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x69, 0x65, 0x73, 0x42, 0x88, 0x01, 0x0a, 0x1f, - 0x64, 0x65, 0x76, 0x2e, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x70, 0x72, 0x6f, - 0x74, 0x6f, 0x2e, 0x74, 0x72, 0x75, 0x73, 0x74, 0x72, 0x6f, 0x6f, 0x74, 0x2e, 0x76, 0x31, 0x42, - 0x0e, 0x54, 0x72, 0x75, 0x73, 0x74, 0x52, 0x6f, 0x6f, 0x74, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50, - 0x01, 0x5a, 0x39, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x73, 0x69, - 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2d, - 0x73, 0x70, 0x65, 0x63, 0x73, 0x2f, 0x67, 0x65, 0x6e, 0x2f, 0x70, 0x62, 0x2d, 0x67, 0x6f, 0x2f, - 0x74, 0x72, 0x75, 0x73, 0x74, 0x72, 0x6f, 0x6f, 0x74, 0x2f, 0x76, 0x31, 0xea, 0x02, 0x17, 0x53, - 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x3a, 0x3a, 0x54, 0x72, 0x75, 0x73, 0x74, 0x52, 0x6f, - 0x6f, 0x74, 0x3a, 0x3a, 0x56, 0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33, + 0x2e, 0x53, 0x69, 0x67, 0x6e, 0x69, 0x6e, 0x67, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x42, 0x03, + 0xe0, 0x41, 0x02, 0x52, 0x0d, 0x73, 0x69, 0x67, 0x6e, 0x69, 0x6e, 0x67, 0x43, 0x6f, 0x6e, 0x66, + 0x69, 0x67, 0x42, 0x88, 0x01, 0x0a, 0x1f, 0x64, 0x65, 0x76, 0x2e, 0x73, 0x69, 0x67, 0x73, 0x74, + 0x6f, 0x72, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x74, 0x72, 0x75, 0x73, 0x74, 0x72, + 0x6f, 0x6f, 0x74, 0x2e, 0x76, 0x31, 0x42, 0x0e, 0x54, 0x72, 0x75, 0x73, 0x74, 0x52, 0x6f, 0x6f, + 0x74, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01, 0x5a, 0x39, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, + 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x73, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2f, 0x70, 0x72, + 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2d, 0x73, 0x70, 0x65, 0x63, 0x73, 0x2f, 0x67, 0x65, 0x6e, + 0x2f, 0x70, 0x62, 0x2d, 0x67, 0x6f, 0x2f, 0x74, 0x72, 0x75, 0x73, 0x74, 0x72, 0x6f, 0x6f, 0x74, + 0x2f, 0x76, 0x31, 0xea, 0x02, 0x17, 0x53, 0x69, 0x67, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x3a, 0x3a, + 0x54, 0x72, 0x75, 0x73, 0x74, 0x52, 0x6f, 0x6f, 0x74, 0x3a, 0x3a, 0x56, 0x31, 0x62, 0x06, 0x70, + 0x72, 0x6f, 0x74, 0x6f, 0x33, } var ( @@ -421,34 +611,38 @@ func file_sigstore_trustroot_proto_rawDescGZIP() []byte { return file_sigstore_trustroot_proto_rawDescData } -var file_sigstore_trustroot_proto_msgTypes = make([]protoimpl.MessageInfo, 3) +var file_sigstore_trustroot_proto_msgTypes = make([]protoimpl.MessageInfo, 5) var file_sigstore_trustroot_proto_goTypes = []interface{}{ (*TransparencyLogInstance)(nil), // 0: dev.sigstore.trustroot.v1.TransparencyLogInstance (*CertificateAuthority)(nil), // 1: dev.sigstore.trustroot.v1.CertificateAuthority (*TrustedRoot)(nil), // 2: dev.sigstore.trustroot.v1.TrustedRoot - (v1.HashAlgorithm)(0), // 3: dev.sigstore.common.v1.HashAlgorithm - (*v1.PublicKey)(nil), // 4: dev.sigstore.common.v1.PublicKey - (*v1.LogId)(nil), // 5: dev.sigstore.common.v1.LogId - (*v1.DistinguishedName)(nil), // 6: dev.sigstore.common.v1.DistinguishedName - (*v1.X509CertificateChain)(nil), // 7: dev.sigstore.common.v1.X509CertificateChain - (*v1.TimeRange)(nil), // 8: dev.sigstore.common.v1.TimeRange + (*SigningConfig)(nil), // 3: dev.sigstore.trustroot.v1.SigningConfig + (*ClientTrustConfig)(nil), // 4: dev.sigstore.trustroot.v1.ClientTrustConfig + (v1.HashAlgorithm)(0), // 5: dev.sigstore.common.v1.HashAlgorithm + (*v1.PublicKey)(nil), // 6: dev.sigstore.common.v1.PublicKey + (*v1.LogId)(nil), // 7: dev.sigstore.common.v1.LogId + (*v1.DistinguishedName)(nil), // 8: dev.sigstore.common.v1.DistinguishedName + (*v1.X509CertificateChain)(nil), // 9: dev.sigstore.common.v1.X509CertificateChain + (*v1.TimeRange)(nil), // 10: dev.sigstore.common.v1.TimeRange } var file_sigstore_trustroot_proto_depIdxs = []int32{ - 3, // 0: dev.sigstore.trustroot.v1.TransparencyLogInstance.hash_algorithm:type_name -> dev.sigstore.common.v1.HashAlgorithm - 4, // 1: dev.sigstore.trustroot.v1.TransparencyLogInstance.public_key:type_name -> dev.sigstore.common.v1.PublicKey - 5, // 2: dev.sigstore.trustroot.v1.TransparencyLogInstance.log_id:type_name -> dev.sigstore.common.v1.LogId - 6, // 3: dev.sigstore.trustroot.v1.CertificateAuthority.subject:type_name -> dev.sigstore.common.v1.DistinguishedName - 7, // 4: dev.sigstore.trustroot.v1.CertificateAuthority.cert_chain:type_name -> dev.sigstore.common.v1.X509CertificateChain - 8, // 5: dev.sigstore.trustroot.v1.CertificateAuthority.valid_for:type_name -> dev.sigstore.common.v1.TimeRange + 5, // 0: dev.sigstore.trustroot.v1.TransparencyLogInstance.hash_algorithm:type_name -> dev.sigstore.common.v1.HashAlgorithm + 6, // 1: dev.sigstore.trustroot.v1.TransparencyLogInstance.public_key:type_name -> dev.sigstore.common.v1.PublicKey + 7, // 2: dev.sigstore.trustroot.v1.TransparencyLogInstance.log_id:type_name -> dev.sigstore.common.v1.LogId + 8, // 3: dev.sigstore.trustroot.v1.CertificateAuthority.subject:type_name -> dev.sigstore.common.v1.DistinguishedName + 9, // 4: dev.sigstore.trustroot.v1.CertificateAuthority.cert_chain:type_name -> dev.sigstore.common.v1.X509CertificateChain + 10, // 5: dev.sigstore.trustroot.v1.CertificateAuthority.valid_for:type_name -> dev.sigstore.common.v1.TimeRange 0, // 6: dev.sigstore.trustroot.v1.TrustedRoot.tlogs:type_name -> dev.sigstore.trustroot.v1.TransparencyLogInstance 1, // 7: dev.sigstore.trustroot.v1.TrustedRoot.certificate_authorities:type_name -> dev.sigstore.trustroot.v1.CertificateAuthority 0, // 8: dev.sigstore.trustroot.v1.TrustedRoot.ctlogs:type_name -> dev.sigstore.trustroot.v1.TransparencyLogInstance 1, // 9: dev.sigstore.trustroot.v1.TrustedRoot.timestamp_authorities:type_name -> dev.sigstore.trustroot.v1.CertificateAuthority - 10, // [10:10] is the sub-list for method output_type - 10, // [10:10] is the sub-list for method input_type - 10, // [10:10] is the sub-list for extension type_name - 10, // [10:10] is the sub-list for extension extendee - 0, // [0:10] is the sub-list for field type_name + 2, // 10: dev.sigstore.trustroot.v1.ClientTrustConfig.trusted_root:type_name -> dev.sigstore.trustroot.v1.TrustedRoot + 3, // 11: dev.sigstore.trustroot.v1.ClientTrustConfig.signing_config:type_name -> dev.sigstore.trustroot.v1.SigningConfig + 12, // [12:12] is the sub-list for method output_type + 12, // [12:12] is the sub-list for method input_type + 12, // [12:12] is the sub-list for extension type_name + 12, // [12:12] is the sub-list for extension extendee + 0, // [0:12] is the sub-list for field type_name } func init() { file_sigstore_trustroot_proto_init() } @@ -493,6 +687,30 @@ func file_sigstore_trustroot_proto_init() { return nil } } + file_sigstore_trustroot_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} { + switch v := v.(*SigningConfig); i { + case 0: + return &v.state + case 1: + return &v.sizeCache + case 2: + return &v.unknownFields + default: + return nil + } + } + file_sigstore_trustroot_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} { + switch v := v.(*ClientTrustConfig); i { + case 0: + return &v.state + case 1: + return &v.sizeCache + case 2: + return &v.unknownFields + default: + return nil + } + } } type x struct{} out := protoimpl.TypeBuilder{ @@ -500,7 +718,7 @@ func file_sigstore_trustroot_proto_init() { GoPackagePath: reflect.TypeOf(x{}).PkgPath(), RawDescriptor: file_sigstore_trustroot_proto_rawDesc, NumEnums: 0, - NumMessages: 3, + NumMessages: 5, NumExtensions: 0, NumServices: 0, }, diff --git a/gen/pb-python/sigstore_protobuf_specs/dev/sigstore/trustroot/v1/__init__.py b/gen/pb-python/sigstore_protobuf_specs/dev/sigstore/trustroot/v1/__init__.py index 656980d3..6a9cd168 100644 --- a/gen/pb-python/sigstore_protobuf_specs/dev/sigstore/trustroot/v1/__init__.py +++ b/gen/pb-python/sigstore_protobuf_specs/dev/sigstore/trustroot/v1/__init__.py @@ -129,3 +129,62 @@ class TrustedRoot(betterproto.Message): timestamp_authorities: List["CertificateAuthority"] = betterproto.message_field(5) """A set of trusted timestamping authorities.""" + + +@dataclass(eq=False, repr=False) +class SigningConfig(betterproto.Message): + """ + SigningConfig represents the trusted entities/state needed by Sigstore + signing. In particular, it primarily contains service URLs that a Sigstore + signer may need to connect to for the online aspects of signing. + """ + + ca_url: str = betterproto.string_field(1) + """ + A URL to a Fulcio-compatible CA, capable of receiving Certificate Signing + Requests (CSRs) and responding with issued certificates. This URL **MUST** + be the "base" URL for the CA, which clients should construct an appropriate + CSR endpoint on top of. For example, if `ca_url` is + `https://example.com/ca`, then the client **MAY** construct the CSR + endpoint as `https://example.com/ca/api/v2/signingCert`. + """ + + oidc_url: str = betterproto.string_field(2) + """ + A URL to an OpenID Connect identity provider. This URL **MUST** be the + "base" URL for the OIDC IdP, which clients should perform well-known OpenID + Connect discovery against. + """ + + tlog_urls: List[str] = betterproto.string_field(3) + """ + One or more URLs to Rekor-compatible transparency log. Each URL **MUST** be + the "base" URL for the transparency log, which clients should construct + appropriate API endpoints on top of. + """ + + tsa_urls: List[str] = betterproto.string_field(4) + """ + One ore more URLs to RFC 3161 Time Stamping Authority (TSA). Each URL + **MUST** be the **full** URL for the TSA, meaning that it should be + suitable for submitting Time Stamp Requests (TSRs) to via HTTP, per RFC + 3161. + """ + + +@dataclass(eq=False, repr=False) +class ClientTrustConfig(betterproto.Message): + """ + ClientTrustConfig describes the complete state needed by a client to + perform both signing and verification operations against a particular + instance of Sigstore. + """ + + media_type: str = betterproto.string_field(1) + """MUST be application/vnd.dev.sigstore.clienttrustconfig.v0.1+json""" + + trusted_root: "TrustedRoot" = betterproto.message_field(2) + """The root of trust, which MUST be present.""" + + signing_config: "SigningConfig" = betterproto.message_field(3) + """Configuration for signing clients, which MUST be present.""" diff --git a/gen/pb-ruby/lib/sigstore_trustroot_pb.rb b/gen/pb-ruby/lib/sigstore_trustroot_pb.rb index b13cf360..d31a17fc 100644 --- a/gen/pb-ruby/lib/sigstore_trustroot_pb.rb +++ b/gen/pb-ruby/lib/sigstore_trustroot_pb.rb @@ -3,6 +3,7 @@ require 'google/protobuf' +require 'google/api/field_behavior_pb' require 'sigstore_common_pb' Google::Protobuf::DescriptorPool.generated_pool.build do @@ -26,6 +27,17 @@ repeated :ctlogs, :message, 4, "dev.sigstore.trustroot.v1.TransparencyLogInstance" repeated :timestamp_authorities, :message, 5, "dev.sigstore.trustroot.v1.CertificateAuthority" end + add_message "dev.sigstore.trustroot.v1.SigningConfig" do + optional :ca_url, :string, 1 + optional :oidc_url, :string, 2 + repeated :tlog_urls, :string, 3 + repeated :tsa_urls, :string, 4 + end + add_message "dev.sigstore.trustroot.v1.ClientTrustConfig" do + optional :media_type, :string, 1 + optional :trusted_root, :message, 2, "dev.sigstore.trustroot.v1.TrustedRoot" + optional :signing_config, :message, 3, "dev.sigstore.trustroot.v1.SigningConfig" + end end end @@ -35,6 +47,8 @@ module V1 TransparencyLogInstance = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("dev.sigstore.trustroot.v1.TransparencyLogInstance").msgclass CertificateAuthority = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("dev.sigstore.trustroot.v1.CertificateAuthority").msgclass TrustedRoot = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("dev.sigstore.trustroot.v1.TrustedRoot").msgclass + SigningConfig = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("dev.sigstore.trustroot.v1.SigningConfig").msgclass + ClientTrustConfig = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("dev.sigstore.trustroot.v1.ClientTrustConfig").msgclass end end end diff --git a/gen/pb-rust/sigstore-protobuf-specs/src/generated/dev.sigstore.trustroot.v1.rs b/gen/pb-rust/sigstore-protobuf-specs/src/generated/dev.sigstore.trustroot.v1.rs index 5fc8d291..ec3c66fe 100644 --- a/gen/pb-rust/sigstore-protobuf-specs/src/generated/dev.sigstore.trustroot.v1.rs +++ b/gen/pb-rust/sigstore-protobuf-specs/src/generated/dev.sigstore.trustroot.v1.rs @@ -136,3 +136,70 @@ pub struct TrustedRoot { #[prost(message, repeated, tag = "5")] pub timestamp_authorities: ::prost::alloc::vec::Vec, } +/// SigningConfig represents the trusted entities/state needed by Sigstore +/// signing. In particular, it primarily contains service URLs that a Sigstore +/// signer may need to connect to for the online aspects of signing. +#[derive( + sigstore_protobuf_specs_derive::Deserialize_proto, + sigstore_protobuf_specs_derive::Serialize_proto +)] +#[derive(::prost_reflect::ReflectMessage)] +#[prost_reflect(message_name = "dev.sigstore.trustroot.v1.SigningConfig")] +#[prost_reflect(file_descriptor_set_bytes = "crate::FILE_DESCRIPTOR_SET_BYTES")] +#[allow(clippy::derive_partial_eq_without_eq)] +#[derive(Clone, PartialEq, ::prost::Message)] +pub struct SigningConfig { + /// A URL to a Fulcio-compatible CA, capable of receiving + /// Certificate Signing Requests (CSRs) and responding with + /// issued certificates. + /// + /// This URL **MUST** be the "base" URL for the CA, which clients + /// should construct an appropriate CSR endpoint on top of. + /// For example, if `ca_url` is ` then + /// the client **MAY** construct the CSR endpoint as + /// ` + #[prost(string, tag = "1")] + pub ca_url: ::prost::alloc::string::String, + /// A URL to an OpenID Connect identity provider. + /// + /// This URL **MUST** be the "base" URL for the OIDC IdP, which clients + /// should perform well-known OpenID Connect discovery against. + #[prost(string, tag = "2")] + pub oidc_url: ::prost::alloc::string::String, + /// One or more URLs to Rekor-compatible transparency log. + /// + /// Each URL **MUST** be the "base" URL for the transparency log, + /// which clients should construct appropriate API endpoints on top of. + #[prost(string, repeated, tag = "3")] + pub tlog_urls: ::prost::alloc::vec::Vec<::prost::alloc::string::String>, + /// One ore more URLs to RFC 3161 Time Stamping Authority (TSA). + /// + /// Each URL **MUST** be the **full** URL for the TSA, meaning that it + /// should be suitable for submitting Time Stamp Requests (TSRs) to + /// via HTTP, per RFC 3161. + #[prost(string, repeated, tag = "4")] + pub tsa_urls: ::prost::alloc::vec::Vec<::prost::alloc::string::String>, +} +/// ClientTrustConfig describes the complete state needed by a client +/// to perform both signing and verification operations against a particular +/// instance of Sigstore. +#[derive( + sigstore_protobuf_specs_derive::Deserialize_proto, + sigstore_protobuf_specs_derive::Serialize_proto +)] +#[derive(::prost_reflect::ReflectMessage)] +#[prost_reflect(message_name = "dev.sigstore.trustroot.v1.ClientTrustConfig")] +#[prost_reflect(file_descriptor_set_bytes = "crate::FILE_DESCRIPTOR_SET_BYTES")] +#[allow(clippy::derive_partial_eq_without_eq)] +#[derive(Clone, PartialEq, ::prost::Message)] +pub struct ClientTrustConfig { + /// MUST be application/vnd.dev.sigstore.clienttrustconfig.v0.1+json + #[prost(string, tag = "1")] + pub media_type: ::prost::alloc::string::String, + /// The root of trust, which MUST be present. + #[prost(message, optional, tag = "2")] + pub trusted_root: ::core::option::Option, + /// Configuration for signing clients, which MUST be present. + #[prost(message, optional, tag = "3")] + pub signing_config: ::core::option::Option, +} diff --git a/gen/pb-rust/sigstore-protobuf-specs/src/generated/file_descriptor_set.bin b/gen/pb-rust/sigstore-protobuf-specs/src/generated/file_descriptor_set.bin index e767640e..ed9dbd16 100644 Binary files a/gen/pb-rust/sigstore-protobuf-specs/src/generated/file_descriptor_set.bin and b/gen/pb-rust/sigstore-protobuf-specs/src/generated/file_descriptor_set.bin differ diff --git a/gen/pb-typescript/src/__generated__/sigstore_trustroot.ts b/gen/pb-typescript/src/__generated__/sigstore_trustroot.ts index f0ca5182..5fb262d4 100644 --- a/gen/pb-typescript/src/__generated__/sigstore_trustroot.ts +++ b/gen/pb-typescript/src/__generated__/sigstore_trustroot.ts @@ -135,6 +135,64 @@ export interface TrustedRoot { timestampAuthorities: CertificateAuthority[]; } +/** + * SigningConfig represents the trusted entities/state needed by Sigstore + * signing. In particular, it primarily contains service URLs that a Sigstore + * signer may need to connect to for the online aspects of signing. + */ +export interface SigningConfig { + /** + * A URL to a Fulcio-compatible CA, capable of receiving + * Certificate Signing Requests (CSRs) and responding with + * issued certificates. + * + * This URL **MUST** be the "base" URL for the CA, which clients + * should construct an appropriate CSR endpoint on top of. + * For example, if `ca_url` is `https://example.com/ca`, then + * the client **MAY** construct the CSR endpoint as + * `https://example.com/ca/api/v2/signingCert`. + */ + caUrl: string; + /** + * A URL to an OpenID Connect identity provider. + * + * This URL **MUST** be the "base" URL for the OIDC IdP, which clients + * should perform well-known OpenID Connect discovery against. + */ + oidcUrl: string; + /** + * One or more URLs to Rekor-compatible transparency log. + * + * Each URL **MUST** be the "base" URL for the transparency log, + * which clients should construct appropriate API endpoints on top of. + */ + tlogUrls: string[]; + /** + * One ore more URLs to RFC 3161 Time Stamping Authority (TSA). + * + * Each URL **MUST** be the **full** URL for the TSA, meaning that it + * should be suitable for submitting Time Stamp Requests (TSRs) to + * via HTTP, per RFC 3161. + */ + tsaUrls: string[]; +} + +/** + * ClientTrustConfig describes the complete state needed by a client + * to perform both signing and verification operations against a particular + * instance of Sigstore. + */ +export interface ClientTrustConfig { + /** MUST be application/vnd.dev.sigstore.clienttrustconfig.v0.1+json */ + mediaType: string; + /** The root of trust, which MUST be present. */ + trustedRoot: + | TrustedRoot + | undefined; + /** Configuration for signing clients, which MUST be present. */ + signingConfig: SigningConfig | undefined; +} + function createBaseTransparencyLogInstance(): TransparencyLogInstance { return { baseUrl: "", hashAlgorithm: 0, publicKey: undefined, logId: undefined }; } @@ -239,6 +297,62 @@ export const TrustedRoot = { }, }; +function createBaseSigningConfig(): SigningConfig { + return { caUrl: "", oidcUrl: "", tlogUrls: [], tsaUrls: [] }; +} + +export const SigningConfig = { + fromJSON(object: any): SigningConfig { + return { + caUrl: isSet(object.caUrl) ? String(object.caUrl) : "", + oidcUrl: isSet(object.oidcUrl) ? String(object.oidcUrl) : "", + tlogUrls: Array.isArray(object?.tlogUrls) ? object.tlogUrls.map((e: any) => String(e)) : [], + tsaUrls: Array.isArray(object?.tsaUrls) ? object.tsaUrls.map((e: any) => String(e)) : [], + }; + }, + + toJSON(message: SigningConfig): unknown { + const obj: any = {}; + message.caUrl !== undefined && (obj.caUrl = message.caUrl); + message.oidcUrl !== undefined && (obj.oidcUrl = message.oidcUrl); + if (message.tlogUrls) { + obj.tlogUrls = message.tlogUrls.map((e) => e); + } else { + obj.tlogUrls = []; + } + if (message.tsaUrls) { + obj.tsaUrls = message.tsaUrls.map((e) => e); + } else { + obj.tsaUrls = []; + } + return obj; + }, +}; + +function createBaseClientTrustConfig(): ClientTrustConfig { + return { mediaType: "", trustedRoot: undefined, signingConfig: undefined }; +} + +export const ClientTrustConfig = { + fromJSON(object: any): ClientTrustConfig { + return { + mediaType: isSet(object.mediaType) ? String(object.mediaType) : "", + trustedRoot: isSet(object.trustedRoot) ? TrustedRoot.fromJSON(object.trustedRoot) : undefined, + signingConfig: isSet(object.signingConfig) ? SigningConfig.fromJSON(object.signingConfig) : undefined, + }; + }, + + toJSON(message: ClientTrustConfig): unknown { + const obj: any = {}; + message.mediaType !== undefined && (obj.mediaType = message.mediaType); + message.trustedRoot !== undefined && + (obj.trustedRoot = message.trustedRoot ? TrustedRoot.toJSON(message.trustedRoot) : undefined); + message.signingConfig !== undefined && + (obj.signingConfig = message.signingConfig ? SigningConfig.toJSON(message.signingConfig) : undefined); + return obj; + }, +}; + function isSet(value: any): boolean { return value !== null && value !== undefined; } diff --git a/protos/sigstore_trustroot.proto b/protos/sigstore_trustroot.proto index 946a5f92..755da4b8 100644 --- a/protos/sigstore_trustroot.proto +++ b/protos/sigstore_trustroot.proto @@ -15,6 +15,7 @@ syntax = "proto3"; package dev.sigstore.trustroot.v1; +import "google/api/field_behavior.proto"; import "sigstore_common.proto"; option go_package = "github.com/sigstore/protobuf-specs/gen/pb-go/trustroot/v1"; @@ -121,3 +122,53 @@ message TrustedRoot { // A set of trusted timestamping authorities. repeated CertificateAuthority timestamp_authorities = 5; } + + +// SigningConfig represents the trusted entities/state needed by Sigstore +// signing. In particular, it primarily contains service URLs that a Sigstore +// signer may need to connect to for the online aspects of signing. +message SigningConfig { + // A URL to a Fulcio-compatible CA, capable of receiving + // Certificate Signing Requests (CSRs) and responding with + // issued certificates. + // + // This URL **MUST** be the "base" URL for the CA, which clients + // should construct an appropriate CSR endpoint on top of. + // For example, if `ca_url` is `https://example.com/ca`, then + // the client **MAY** construct the CSR endpoint as + // `https://example.com/ca/api/v2/signingCert`. + string ca_url = 1; + + // A URL to an OpenID Connect identity provider. + // + // This URL **MUST** be the "base" URL for the OIDC IdP, which clients + // should perform well-known OpenID Connect discovery against. + string oidc_url = 2; + + // One or more URLs to Rekor-compatible transparency log. + // + // Each URL **MUST** be the "base" URL for the transparency log, + // which clients should construct appropriate API endpoints on top of. + repeated string tlog_urls = 3; + + // One ore more URLs to RFC 3161 Time Stamping Authority (TSA). + // + // Each URL **MUST** be the **full** URL for the TSA, meaning that it + // should be suitable for submitting Time Stamp Requests (TSRs) to + // via HTTP, per RFC 3161. + repeated string tsa_urls = 4; +} + +// ClientTrustConfig describes the complete state needed by a client +// to perform both signing and verification operations against a particular +// instance of Sigstore. +message ClientTrustConfig { + // MUST be application/vnd.dev.sigstore.clienttrustconfig.v0.1+json + string media_type = 1; + + // The root of trust, which MUST be present. + TrustedRoot trusted_root = 2 [(google.api.field_behavior) = REQUIRED]; + + // Configuration for signing clients, which MUST be present. + SigningConfig signing_config = 3 [(google.api.field_behavior) = REQUIRED]; +}