// Copyright 2022 The Sigstore Authors.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

// Code generated by protoc-gen-go. DO NOT EDIT.
// versions:
// 	protoc-gen-go v1.36.10
// 	protoc        v7.34.1
// source: sigstore_trustroot.proto

package v1

import (
	v1 "github.com/sigstore/protobuf-specs/gen/pb-go/common/v1"
	_ "google.golang.org/genproto/googleapis/api/annotations"
	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
	reflect "reflect"
	sync "sync"
	unsafe "unsafe"
)

const (
	// Verify that this generated code is sufficiently up-to-date.
	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
	// Verify that runtime/protoimpl is sufficiently up-to-date.
	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
)

// ServiceSelector specifies how a client SHOULD select a set of
// Services to connect to. A client SHOULD throw an error if
// the value is SERVICE_SELECTOR_UNDEFINED.
type ServiceSelector int32

const (
	ServiceSelector_SERVICE_SELECTOR_UNDEFINED ServiceSelector = 0
	// Clients SHOULD select all Services based on supported API version
	// and validity window.
	ServiceSelector_ALL ServiceSelector = 1
	// Clients SHOULD select one Service based on supported API version
	// and validity window. It is up to the client implementation to
	// decide how to select the Service, e.g. random or round-robin.
	ServiceSelector_ANY ServiceSelector = 2
	// Clients SHOULD select a specific number of Services based on
	// supported API version and validity window, using the provided
	// `count`. It is up to the client implementation to decide how to
	// select the Service, e.g. random or round-robin.
	ServiceSelector_EXACT ServiceSelector = 3
)

// Enum value maps for ServiceSelector.
var (
	ServiceSelector_name = map[int32]string{
		0: "SERVICE_SELECTOR_UNDEFINED",
		1: "ALL",
		2: "ANY",
		3: "EXACT",
	}
	ServiceSelector_value = map[string]int32{
		"SERVICE_SELECTOR_UNDEFINED": 0,
		"ALL":                        1,
		"ANY":                        2,
		"EXACT":                      3,
	}
)

func (x ServiceSelector) Enum() *ServiceSelector {
	p := new(ServiceSelector)
	*p = x
	return p
}

func (x ServiceSelector) String() string {
	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
}

func (ServiceSelector) Descriptor() protoreflect.EnumDescriptor {
	return file_sigstore_trustroot_proto_enumTypes[0].Descriptor()
}

func (ServiceSelector) Type() protoreflect.EnumType {
	return &file_sigstore_trustroot_proto_enumTypes[0]
}

func (x ServiceSelector) Number() protoreflect.EnumNumber {
	return protoreflect.EnumNumber(x)
}

// Deprecated: Use ServiceSelector.Descriptor instead.
func (ServiceSelector) EnumDescriptor() ([]byte, []int) {
	return file_sigstore_trustroot_proto_rawDescGZIP(), []int{0}
}

// TransparencyLogInstance describes the immutable parameters from a
// transparency log.
// See https://www.rfc-editor.org/rfc/rfc9162.html#name-log-parameters
// for more details.
// The included parameters are the minimal set required to identify a log,
// and verify an inclusion proof/promise.
type TransparencyLogInstance struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// The base URL at which can be used to URLs for the client.
	// SHOULD match the origin on the log checkpoint:
	// https://github.com/C2SP/C2SP/blob/main/tlog-checkpoint.md#note-text.
	BaseUrl string `protobuf:"bytes,1,opt,name=base_url,json=baseUrl,proto3" json:"base_url,omitempty"`
	// The hash algorithm used for the Merkle Tree.
	HashAlgorithm v1.HashAlgorithm `protobuf:"varint,2,opt,name=hash_algorithm,json=hashAlgorithm,proto3,enum=dev.sigstore.common.v1.HashAlgorithm" json:"hash_algorithm,omitempty"`
	// The public key used to verify signatures generated by the log.
	// This attribute contains the signature algorithm used by the log.
	PublicKey *v1.PublicKey `protobuf:"bytes,3,opt,name=public_key,json=publicKey,proto3" json:"public_key,omitempty"`
	// The identifier for this transparency log.
	// Represented as the SHA-256 hash of the log's public key,
	// calculated over the DER encoding of the key represented as
	// SubjectPublicKeyInfo.
	// See https://www.rfc-editor.org/rfc/rfc6962#section-3.2
	// For Rekor v2 instances, log_id and checkpoint_key_id will be set
	// to the same value.
	// It is recommended to use checkpoint_key_id instead, since log_id is not
	// guaranteed to be unique across multiple deployments. Clients
	// must use the key name and key ID, as defined by the signed-note spec
	// linked below, from a checkpoint to determine the correct
	// TransparencyLogInstance to verify a proof.
	// log_id will eventually be deprecated in favor of checkpoint_id.
	LogId *v1.LogId `protobuf:"bytes,4,opt,name=log_id,json=logId,proto3" json:"log_id,omitempty"`
	// The unique identifier for the log, used in the checkpoint.
	// Only supported for TrustedRoot media types matching or greater than
	// application/vnd.dev.sigstore.trustedroot.v0.2+json
	// Its calculation is described in
	// https://github.com/C2SP/C2SP/blob/main/signed-note.md#signatures
	// SHOULD be set for all logs. When not set, clients MUST use log_id.
	//
	// For Ed25519 signatures, the key ID is computed per the C2SP spec:
	// key ID = SHA-256(key name || 0x0A || 0x01 || 32-byte Ed25519 public key)[:4]
	// For ECDSA signatures, the key ID is computed per the C2SP spec:
	// key ID = SHA-256(PKIX ASN.1 DER-encoded public key, in SubjectPublicKeyInfo format)[:4]
	// For RSA signatures, the signature type will be 0xff with an appended identifier for the format,
	// "PKIX-RSA-PKCS#1v1.5":
	// key ID = SHA-256(key name || 0x0A || 0xff || PKIX-RSA-PKCS#1v1.5 || PKIX ASN.1 DER-encoded public key)[:4]
	//
	// This is provided for convenience. Clients can also calculate the
	// checkpoint key ID given the log's public key.
	// SHOULD be 4 bytes long, as a truncated hash.
	//
	// To find a matching TransparencyLogInstance in the TrustedRoot,
	// clients will parse the checkpoint, and for each signature line,
	// use the key name (i.e. log origin, base_url from TrustedRoot)
	// and checkpoint key ID (i.e. checkpoint_key_id from TrustedRoot)
	// which can then be compared against the TrustedRoot log instances.
	CheckpointKeyId *v1.LogId `protobuf:"bytes,5,opt,name=checkpoint_key_id,json=checkpointKeyId,proto3" json:"checkpoint_key_id,omitempty"`
	// The name of the operator of this log deployment. Operator MUST be
	// formatted as a scheme-less URI, e.g. sigstore.dev
	// Only supported for TrustedRoot media types matching or greater than
	// application/vnd.dev.sigstore.trustedroot.v0.2+json
	// This MUST be used when there are multiple transparency log instances
	// to determine if log proof verification meets a specified threshold,
	// e.g. two proofs from log deployments operated by the same operator
	// should count as only one valid proof.
	Operator      string `protobuf:"bytes,6,opt,name=operator,proto3" json:"operator,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *TransparencyLogInstance) Reset() {
	*x = TransparencyLogInstance{}
	mi := &file_sigstore_trustroot_proto_msgTypes[0]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *TransparencyLogInstance) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*TransparencyLogInstance) ProtoMessage() {}

func (x *TransparencyLogInstance) ProtoReflect() protoreflect.Message {
	mi := &file_sigstore_trustroot_proto_msgTypes[0]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use TransparencyLogInstance.ProtoReflect.Descriptor instead.
func (*TransparencyLogInstance) Descriptor() ([]byte, []int) {
	return file_sigstore_trustroot_proto_rawDescGZIP(), []int{0}
}

func (x *TransparencyLogInstance) GetBaseUrl() string {
	if x != nil {
		return x.BaseUrl
	}
	return ""
}

func (x *TransparencyLogInstance) GetHashAlgorithm() v1.HashAlgorithm {
	if x != nil {
		return x.HashAlgorithm
	}
	return v1.HashAlgorithm(0)
}

func (x *TransparencyLogInstance) GetPublicKey() *v1.PublicKey {
	if x != nil {
		return x.PublicKey
	}
	return nil
}

func (x *TransparencyLogInstance) GetLogId() *v1.LogId {
	if x != nil {
		return x.LogId
	}
	return nil
}

func (x *TransparencyLogInstance) GetCheckpointKeyId() *v1.LogId {
	if x != nil {
		return x.CheckpointKeyId
	}
	return nil
}

func (x *TransparencyLogInstance) GetOperator() string {
	if x != nil {
		return x.Operator
	}
	return ""
}

// CertificateAuthority enlists the information required to identify which
// CA to use and perform signature verification.
type CertificateAuthority struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// The root certificate MUST be self-signed, and so the subject and
	// issuer are the same.
	Subject *v1.DistinguishedName `protobuf:"bytes,1,opt,name=subject,proto3" json:"subject,omitempty"`
	// The URI identifies the certificate authority.
	//
	// It is RECOMMENDED that the URI is the base URL for the certificate
	// authority, that can be provided to any SDK/client provided
	// by the certificate authority to interact with the certificate
	// authority.
	Uri string `protobuf:"bytes,2,opt,name=uri,proto3" json:"uri,omitempty"`
	// The certificate chain for this CA. The last certificate in the chain
	// MUST be the trust anchor. The trust anchor MAY be a self-signed root
	// CA certificate or MAY be an intermediate CA certificate.
	CertChain *v1.X509CertificateChain `protobuf:"bytes,3,opt,name=cert_chain,json=certChain,proto3" json:"cert_chain,omitempty"`
	// The time the *entire* chain was valid. This is at max the
	// longest interval when *all* certificates in the chain were valid,
	// but it MAY be shorter. Clients MUST check timestamps against *both*
	// the `valid_for` time range *and* the entire certificate chain.
	//
	// The TimeRange should be considered valid *inclusive* of the
	// endpoints.
	ValidFor *v1.TimeRange `protobuf:"bytes,4,opt,name=valid_for,json=validFor,proto3" json:"valid_for,omitempty"`
	// The name of the operator of this certificate or timestamp authority.
	// Operator MUST be formatted as a scheme-less URI, e.g. sigstore.dev
	// This MUST be used when there are multiple timestamp authorities to
	// determine if the signed timestamp verification meets a specified
	// threshold, e.g. two signed timestamps from timestamp authorities
	// operated by the same operator should count as only one valid
	// timestamp.
	Operator      string `protobuf:"bytes,5,opt,name=operator,proto3" json:"operator,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *CertificateAuthority) Reset() {
	*x = CertificateAuthority{}
	mi := &file_sigstore_trustroot_proto_msgTypes[1]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *CertificateAuthority) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*CertificateAuthority) ProtoMessage() {}

func (x *CertificateAuthority) ProtoReflect() protoreflect.Message {
	mi := &file_sigstore_trustroot_proto_msgTypes[1]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use CertificateAuthority.ProtoReflect.Descriptor instead.
func (*CertificateAuthority) Descriptor() ([]byte, []int) {
	return file_sigstore_trustroot_proto_rawDescGZIP(), []int{1}
}

func (x *CertificateAuthority) GetSubject() *v1.DistinguishedName {
	if x != nil {
		return x.Subject
	}
	return nil
}

func (x *CertificateAuthority) GetUri() string {
	if x != nil {
		return x.Uri
	}
	return ""
}

func (x *CertificateAuthority) GetCertChain() *v1.X509CertificateChain {
	if x != nil {
		return x.CertChain
	}
	return nil
}

func (x *CertificateAuthority) GetValidFor() *v1.TimeRange {
	if x != nil {
		return x.ValidFor
	}
	return nil
}

func (x *CertificateAuthority) GetOperator() string {
	if x != nil {
		return x.Operator
	}
	return ""
}

// TrustedRoot describes the client's complete set of trusted entities.
// How the TrustedRoot is populated is not specified, but can be a
// combination of many sources such as TUF repositories, files on disk etc.
//
// The TrustedRoot is not meant to be used for any artifact verification, only
// to capture the complete/global set of trusted verification materials.
// When verifying an artifact, based on the artifact and policies, a selection
// of keys/authorities are expected to be extracted and provided to the
// verification function. This way the set of keys/authorities can be kept to
// a minimal set by the policy to gain better control over what signatures
// that are allowed.
//
// The embedded transparency logs, CT logs, CAs and TSAs MUST include any
// previously used instance -- otherwise signatures made in the past cannot
// be verified.
//
// All the listed instances SHOULD be sorted by the 'valid_for.start'
// in ascending order, that is, the oldest instance first. Clients
// MUST accept instances that overlaps in time, if not clients may
// experience problems during rotations of verification materials.
//
// To be able to manage planned rotations of either transparency logs or
// certificate authorities, clienst MUST accept lists of instances where
// the last instance have a 'valid_for' that belongs to the future.
// This should not be a problem as clients SHOULD first seek the trust root
// for a suitable instance before creating a per artifact trust root (that
// is, a sub-set of the complete trust root) that is used for verification.
type TrustedRoot struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// MUST be application/vnd.dev.sigstore.trustedroot.v0.2+json
	// when encoded as JSON.
	// Clients MAY choose to also support
	// application/vnd.dev.sigstore.trustedroot.v0.1+json
	// Clients MAY process and parse content with the media type defined
	// in the old format:
	// application/vnd.dev.sigstore.trustedroot+json;version=0.1
	MediaType string `protobuf:"bytes,1,opt,name=media_type,json=mediaType,proto3" json:"media_type,omitempty"`
	// A set of trusted Rekor servers.
	Tlogs []*TransparencyLogInstance `protobuf:"bytes,2,rep,name=tlogs,proto3" json:"tlogs,omitempty"`
	// A set of trusted certificate authorities (e.g Fulcio), and any
	// intermediate certificates they provide.
	// If a CA is issuing multiple intermediate certificate, each
	// combination shall be represented as separate chain. I.e, a single
	// root cert may appear in multiple chains but with different
	// intermediate and/or leaf certificates.
	// The certificates are intended to be used for verifying artifact
	// signatures.
	CertificateAuthorities []*CertificateAuthority `protobuf:"bytes,3,rep,name=certificate_authorities,json=certificateAuthorities,proto3" json:"certificate_authorities,omitempty"`
	// A set of trusted certificate transparency logs.
	Ctlogs []*TransparencyLogInstance `protobuf:"bytes,4,rep,name=ctlogs,proto3" json:"ctlogs,omitempty"`
	// A set of trusted timestamping authorities.
	TimestampAuthorities []*CertificateAuthority `protobuf:"bytes,5,rep,name=timestamp_authorities,json=timestampAuthorities,proto3" json:"timestamp_authorities,omitempty"`
	unknownFields        protoimpl.UnknownFields
	sizeCache            protoimpl.SizeCache
}

func (x *TrustedRoot) Reset() {
	*x = TrustedRoot{}
	mi := &file_sigstore_trustroot_proto_msgTypes[2]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *TrustedRoot) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*TrustedRoot) ProtoMessage() {}

func (x *TrustedRoot) ProtoReflect() protoreflect.Message {
	mi := &file_sigstore_trustroot_proto_msgTypes[2]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use TrustedRoot.ProtoReflect.Descriptor instead.
func (*TrustedRoot) Descriptor() ([]byte, []int) {
	return file_sigstore_trustroot_proto_rawDescGZIP(), []int{2}
}

func (x *TrustedRoot) GetMediaType() string {
	if x != nil {
		return x.MediaType
	}
	return ""
}

func (x *TrustedRoot) GetTlogs() []*TransparencyLogInstance {
	if x != nil {
		return x.Tlogs
	}
	return nil
}

func (x *TrustedRoot) GetCertificateAuthorities() []*CertificateAuthority {
	if x != nil {
		return x.CertificateAuthorities
	}
	return nil
}

func (x *TrustedRoot) GetCtlogs() []*TransparencyLogInstance {
	if x != nil {
		return x.Ctlogs
	}
	return nil
}

func (x *TrustedRoot) GetTimestampAuthorities() []*CertificateAuthority {
	if x != nil {
		return x.TimestampAuthorities
	}
	return nil
}

// SigningConfig represents the trusted entities/state needed by Sigstore
// signing. In particular, it primarily contains service URLs that a Sigstore
// signer may need to connect to for the online aspects of signing.
type SigningConfig struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// MUST be application/vnd.dev.sigstore.signingconfig.v0.2+json
	// Clients MAY choose to also support
	// application/vnd.dev.sigstore.signingconfig.v0.1+json
	MediaType string `protobuf:"bytes,5,opt,name=media_type,json=mediaType,proto3" json:"media_type,omitempty"`
	// URLs to Fulcio-compatible CAs, capable of receiving
	// Certificate Signing Requests (CSRs) and responding with
	// issued certificates.
	//
	// These URLs MUST be the "base" URL for the CAs, which clients
	// should construct an appropriate CSR endpoint on top of.
	// For example, if a CA URL is `https://example.com/ca`, then
	// the client MAY construct the CSR endpoint as
	// `https://example.com/ca/api/v2/signingCert`.
	//
	// Clients MUST select only one Service with the highest API version
	// that the client is compatible with, that is within its
	// validity period, and has the newest validity start date.
	// Client SHOULD select the first Service that meets this requirement.
	// All listed Services SHOULD be sorted by the `valid_for` window in
	// descending order, with the newest instance first.
	CaUrls []*Service `protobuf:"bytes,6,rep,name=ca_urls,json=caUrls,proto3" json:"ca_urls,omitempty"`
	// URLs to OpenID Connect identity providers.
	//
	// These URLs MUST be the "base" URLs for the OIDC IdPs, which clients
	// should perform well-known OpenID Connect discovery against.
	//
	// Clients MUST select only one Service with the highest API version
	// that the client is compatible with, that is within its
	// validity period, and has the newest validity start date.
	// Client SHOULD select the first Service that meets this requirement.
	// All listed Services SHOULD be sorted by the `valid_for` window in
	// descending order, with the newest instance first.
	OidcUrls []*Service `protobuf:"bytes,7,rep,name=oidc_urls,json=oidcUrls,proto3" json:"oidc_urls,omitempty"`
	// URLs to Rekor transparency logs.
	//
	// These URL MUST be the "base" URLs for the transparency logs,
	// which clients should construct appropriate API endpoints on top of.
	//
	// Clients MUST group Services by `operator` and select at most one
	// Service from each operator. Clients MUST select Services with the
	// highest API version that the client is compatible with, that are
	// within its validity period, and have the newest validity start dates.
	// All listed Services SHOULD be sorted by the `valid_for` window in
	// descending order, with the newest instance first.
	//
	// Clients MUST select Services based on the selector value of
	// `rekor_tlog_config`.
	RekorTlogUrls []*Service `protobuf:"bytes,8,rep,name=rekor_tlog_urls,json=rekorTlogUrls,proto3" json:"rekor_tlog_urls,omitempty"`
	// Specifies how a client should select the set of Rekor transparency
	// logs to write to.
	RekorTlogConfig *ServiceConfiguration `protobuf:"bytes,9,opt,name=rekor_tlog_config,json=rekorTlogConfig,proto3" json:"rekor_tlog_config,omitempty"`
	// URLs to RFC 3161 Time Stamping Authorities (TSA).
	//
	// These URLs MUST be the *full* URL for the TSA, meaning that it
	// should be suitable for submitting Time Stamp Requests (TSRs) to
	// via HTTP, per RFC 3161.
	//
	// Clients MUST group Services by `operator` and select at most one
	// Service from each operator. Clients MUST select Services with the
	// highest API version that the client is compatible with, that are
	// within its validity period, and have the newest validity start dates.
	// All listed Services SHOULD be sorted by the `valid_for` window in
	// descending order, with the newest instance first.
	//
	// Clients MUST select Services based on the selector value of
	// `tsa_config`.
	TsaUrls []*Service `protobuf:"bytes,10,rep,name=tsa_urls,json=tsaUrls,proto3" json:"tsa_urls,omitempty"`
	// Specifies how a client should select the set of TSAs to request
	// signed timestamps from.
	TsaConfig     *ServiceConfiguration `protobuf:"bytes,11,opt,name=tsa_config,json=tsaConfig,proto3" json:"tsa_config,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *SigningConfig) Reset() {
	*x = SigningConfig{}
	mi := &file_sigstore_trustroot_proto_msgTypes[3]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *SigningConfig) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*SigningConfig) ProtoMessage() {}

func (x *SigningConfig) ProtoReflect() protoreflect.Message {
	mi := &file_sigstore_trustroot_proto_msgTypes[3]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use SigningConfig.ProtoReflect.Descriptor instead.
func (*SigningConfig) Descriptor() ([]byte, []int) {
	return file_sigstore_trustroot_proto_rawDescGZIP(), []int{3}
}

func (x *SigningConfig) GetMediaType() string {
	if x != nil {
		return x.MediaType
	}
	return ""
}

func (x *SigningConfig) GetCaUrls() []*Service {
	if x != nil {
		return x.CaUrls
	}
	return nil
}

func (x *SigningConfig) GetOidcUrls() []*Service {
	if x != nil {
		return x.OidcUrls
	}
	return nil
}

func (x *SigningConfig) GetRekorTlogUrls() []*Service {
	if x != nil {
		return x.RekorTlogUrls
	}
	return nil
}

func (x *SigningConfig) GetRekorTlogConfig() *ServiceConfiguration {
	if x != nil {
		return x.RekorTlogConfig
	}
	return nil
}

func (x *SigningConfig) GetTsaUrls() []*Service {
	if x != nil {
		return x.TsaUrls
	}
	return nil
}

func (x *SigningConfig) GetTsaConfig() *ServiceConfiguration {
	if x != nil {
		return x.TsaConfig
	}
	return nil
}

// Service represents an instance of a service that is a part of Sigstore infrastructure.
// When selecting one or multiple services from a list of services, clients MUST:
//   - Use the API version hint to determine the service with the highest API version
//     that the client is compatible with.
//   - Only select services within the specified validity period and that have the
//     newest validity start date.
//
// When selecting multiple services, clients MUST:
//   - Use the ServiceConfiguration to determine how many services MUST be selected.
//     Clients MUST return an error if there are not enough services that meet the
//     selection criteria.
//   - Group services by `operator` and select at most one service from an operator.
//     During verification, clients MUST treat valid verification metadata from the
//     operator as valid only once towards a threshold.
//   - Select services from only the highest supported API version.
type Service struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// URL of the service. MUST include scheme and authority. MAY include path.
	Url string `protobuf:"bytes,1,opt,name=url,proto3" json:"url,omitempty"`
	// Specifies the major API version. A value of 0 represents a service that
	// has not yet been released.
	MajorApiVersion uint32 `protobuf:"varint,2,opt,name=major_api_version,json=majorApiVersion,proto3" json:"major_api_version,omitempty"`
	// Validity period of a service. A service that has only a start date
	// SHOULD be considered the most recent instance of that service, but
	// the client MUST NOT assume there is only one valid instance.
	// The TimeRange MUST be considered valid *inclusive* of the
	// endpoints.
	ValidFor *v1.TimeRange `protobuf:"bytes,3,opt,name=valid_for,json=validFor,proto3" json:"valid_for,omitempty"`
	// Specifies the name of the service operator. When selecting multiple
	// services, clients MUST use the operator to select services from
	// distinct operators. Operator MUST be formatted as a scheme-less
	// URI, e.g. sigstore.dev
	Operator      string `protobuf:"bytes,4,opt,name=operator,proto3" json:"operator,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *Service) Reset() {
	*x = Service{}
	mi := &file_sigstore_trustroot_proto_msgTypes[4]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *Service) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*Service) ProtoMessage() {}

func (x *Service) ProtoReflect() protoreflect.Message {
	mi := &file_sigstore_trustroot_proto_msgTypes[4]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use Service.ProtoReflect.Descriptor instead.
func (*Service) Descriptor() ([]byte, []int) {
	return file_sigstore_trustroot_proto_rawDescGZIP(), []int{4}
}

func (x *Service) GetUrl() string {
	if x != nil {
		return x.Url
	}
	return ""
}

func (x *Service) GetMajorApiVersion() uint32 {
	if x != nil {
		return x.MajorApiVersion
	}
	return 0
}

func (x *Service) GetValidFor() *v1.TimeRange {
	if x != nil {
		return x.ValidFor
	}
	return nil
}

func (x *Service) GetOperator() string {
	if x != nil {
		return x.Operator
	}
	return ""
}

// ServiceConfiguration specifies how a client should select a set of
// Services to connect to, along with a count when a specific number
// of Services is requested.
type ServiceConfiguration struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// How a client should select a set of Services to connect to.
	// Clients SHOULD NOT select services from multiple API versions.
	Selector ServiceSelector `protobuf:"varint,1,opt,name=selector,proto3,enum=dev.sigstore.trustroot.v1.ServiceSelector" json:"selector,omitempty"`
	// count specifies the number of Services the client should use.
	// Only used when selector is set to EXACT, and count MUST be greater
	// than 0. count MUST be less than or equal to the number of Services.
	// Clients MUST return an error is there are not enough services
	// that meet selection criteria.
	Count         uint32 `protobuf:"varint,2,opt,name=count,proto3" json:"count,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ServiceConfiguration) Reset() {
	*x = ServiceConfiguration{}
	mi := &file_sigstore_trustroot_proto_msgTypes[5]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ServiceConfiguration) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ServiceConfiguration) ProtoMessage() {}

func (x *ServiceConfiguration) ProtoReflect() protoreflect.Message {
	mi := &file_sigstore_trustroot_proto_msgTypes[5]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ServiceConfiguration.ProtoReflect.Descriptor instead.
func (*ServiceConfiguration) Descriptor() ([]byte, []int) {
	return file_sigstore_trustroot_proto_rawDescGZIP(), []int{5}
}

func (x *ServiceConfiguration) GetSelector() ServiceSelector {
	if x != nil {
		return x.Selector
	}
	return ServiceSelector_SERVICE_SELECTOR_UNDEFINED
}

func (x *ServiceConfiguration) GetCount() uint32 {
	if x != nil {
		return x.Count
	}
	return 0
}

// ClientTrustConfig describes the complete state needed by a client
// to perform both signing and verification operations against a particular
// instance of Sigstore.
type ClientTrustConfig struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// MUST be application/vnd.dev.sigstore.clienttrustconfig.v0.1+json
	MediaType string `protobuf:"bytes,1,opt,name=media_type,json=mediaType,proto3" json:"media_type,omitempty"`
	// The root of trust, which MUST be present.
	TrustedRoot *TrustedRoot `protobuf:"bytes,2,opt,name=trusted_root,json=trustedRoot,proto3" json:"trusted_root,omitempty"`
	// Configuration for signing clients, which MUST be present.
	SigningConfig *SigningConfig `protobuf:"bytes,3,opt,name=signing_config,json=signingConfig,proto3" json:"signing_config,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ClientTrustConfig) Reset() {
	*x = ClientTrustConfig{}
	mi := &file_sigstore_trustroot_proto_msgTypes[6]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ClientTrustConfig) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ClientTrustConfig) ProtoMessage() {}

func (x *ClientTrustConfig) ProtoReflect() protoreflect.Message {
	mi := &file_sigstore_trustroot_proto_msgTypes[6]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ClientTrustConfig.ProtoReflect.Descriptor instead.
func (*ClientTrustConfig) Descriptor() ([]byte, []int) {
	return file_sigstore_trustroot_proto_rawDescGZIP(), []int{6}
}

func (x *ClientTrustConfig) GetMediaType() string {
	if x != nil {
		return x.MediaType
	}
	return ""
}

func (x *ClientTrustConfig) GetTrustedRoot() *TrustedRoot {
	if x != nil {
		return x.TrustedRoot
	}
	return nil
}

func (x *ClientTrustConfig) GetSigningConfig() *SigningConfig {
	if x != nil {
		return x.SigningConfig
	}
	return nil
}

var File_sigstore_trustroot_proto protoreflect.FileDescriptor

const file_sigstore_trustroot_proto_rawDesc = "" +
	"\n" +
	"\x18sigstore_trustroot.proto\x12\x19dev.sigstore.trustroot.v1\x1a\x1fgoogle/api/field_behavior.proto\x1a\x15sigstore_common.proto\"\xe1\x02\n" +
	"\x17TransparencyLogInstance\x12\x19\n" +
	"\bbase_url\x18\x01 \x01(\tR\abaseUrl\x12L\n" +
	"\x0ehash_algorithm\x18\x02 \x01(\x0e2%.dev.sigstore.common.v1.HashAlgorithmR\rhashAlgorithm\x12@\n" +
	"\n" +
	"public_key\x18\x03 \x01(\v2!.dev.sigstore.common.v1.PublicKeyR\tpublicKey\x124\n" +
	"\x06log_id\x18\x04 \x01(\v2\x1d.dev.sigstore.common.v1.LogIdR\x05logId\x12I\n" +
	"\x11checkpoint_key_id\x18\x05 \x01(\v2\x1d.dev.sigstore.common.v1.LogIdR\x0fcheckpointKeyId\x12\x1a\n" +
	"\boperator\x18\x06 \x01(\tR\boperator\"\x96\x02\n" +
	"\x14CertificateAuthority\x12C\n" +
	"\asubject\x18\x01 \x01(\v2).dev.sigstore.common.v1.DistinguishedNameR\asubject\x12\x10\n" +
	"\x03uri\x18\x02 \x01(\tR\x03uri\x12K\n" +
	"\n" +
	"cert_chain\x18\x03 \x01(\v2,.dev.sigstore.common.v1.X509CertificateChainR\tcertChain\x12>\n" +
	"\tvalid_for\x18\x04 \x01(\v2!.dev.sigstore.common.v1.TimeRangeR\bvalidFor\x12\x1a\n" +
	"\boperator\x18\x05 \x01(\tR\boperator\"\x92\x03\n" +
	"\vTrustedRoot\x12\x1d\n" +
	"\n" +
	"media_type\x18\x01 \x01(\tR\tmediaType\x12H\n" +
	"\x05tlogs\x18\x02 \x03(\v22.dev.sigstore.trustroot.v1.TransparencyLogInstanceR\x05tlogs\x12h\n" +
	"\x17certificate_authorities\x18\x03 \x03(\v2/.dev.sigstore.trustroot.v1.CertificateAuthorityR\x16certificateAuthorities\x12J\n" +
	"\x06ctlogs\x18\x04 \x03(\v22.dev.sigstore.trustroot.v1.TransparencyLogInstanceR\x06ctlogs\x12d\n" +
	"\x15timestamp_authorities\x18\x05 \x03(\v2/.dev.sigstore.trustroot.v1.CertificateAuthorityR\x14timestampAuthorities\"\xea\x03\n" +
	"\rSigningConfig\x12\x1d\n" +
	"\n" +
	"media_type\x18\x05 \x01(\tR\tmediaType\x12;\n" +
	"\aca_urls\x18\x06 \x03(\v2\".dev.sigstore.trustroot.v1.ServiceR\x06caUrls\x12?\n" +
	"\toidc_urls\x18\a \x03(\v2\".dev.sigstore.trustroot.v1.ServiceR\boidcUrls\x12J\n" +
	"\x0frekor_tlog_urls\x18\b \x03(\v2\".dev.sigstore.trustroot.v1.ServiceR\rrekorTlogUrls\x12[\n" +
	"\x11rekor_tlog_config\x18\t \x01(\v2/.dev.sigstore.trustroot.v1.ServiceConfigurationR\x0frekorTlogConfig\x12=\n" +
	"\btsa_urls\x18\n" +
	" \x03(\v2\".dev.sigstore.trustroot.v1.ServiceR\atsaUrls\x12N\n" +
	"\n" +
	"tsa_config\x18\v \x01(\v2/.dev.sigstore.trustroot.v1.ServiceConfigurationR\ttsaConfigJ\x04\b\x01\x10\x05\"\xb7\x01\n" +
	"\aService\x12\x15\n" +
	"\x03url\x18\x01 \x01(\tB\x03\xe0A\x02R\x03url\x12/\n" +
	"\x11major_api_version\x18\x02 \x01(\rB\x03\xe0A\x02R\x0fmajorApiVersion\x12C\n" +
	"\tvalid_for\x18\x03 \x01(\v2!.dev.sigstore.common.v1.TimeRangeB\x03\xe0A\x02R\bvalidFor\x12\x1f\n" +
	"\boperator\x18\x04 \x01(\tB\x03\xe0A\x02R\boperator\"y\n" +
	"\x14ServiceConfiguration\x12K\n" +
	"\bselector\x18\x01 \x01(\x0e2*.dev.sigstore.trustroot.v1.ServiceSelectorB\x03\xe0A\x02R\bselector\x12\x14\n" +
	"\x05count\x18\x02 \x01(\rR\x05count\"\xd8\x01\n" +
	"\x11ClientTrustConfig\x12\x1d\n" +
	"\n" +
	"media_type\x18\x01 \x01(\tR\tmediaType\x12N\n" +
	"\ftrusted_root\x18\x02 \x01(\v2&.dev.sigstore.trustroot.v1.TrustedRootB\x03\xe0A\x02R\vtrustedRoot\x12T\n" +
	"\x0esigning_config\x18\x03 \x01(\v2(.dev.sigstore.trustroot.v1.SigningConfigB\x03\xe0A\x02R\rsigningConfig*N\n" +
	"\x0fServiceSelector\x12\x1e\n" +
	"\x1aSERVICE_SELECTOR_UNDEFINED\x10\x00\x12\a\n" +
	"\x03ALL\x10\x01\x12\a\n" +
	"\x03ANY\x10\x02\x12\t\n" +
	"\x05EXACT\x10\x03B\x88\x01\n" +
	"\x1fdev.sigstore.proto.trustroot.v1B\x0eTrustRootProtoP\x01Z9github.com/sigstore/protobuf-specs/gen/pb-go/trustroot/v1\xea\x02\x17Sigstore::TrustRoot::V1b\x06proto3"

var (
	file_sigstore_trustroot_proto_rawDescOnce sync.Once
	file_sigstore_trustroot_proto_rawDescData []byte
)

func file_sigstore_trustroot_proto_rawDescGZIP() []byte {
	file_sigstore_trustroot_proto_rawDescOnce.Do(func() {
		file_sigstore_trustroot_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_sigstore_trustroot_proto_rawDesc), len(file_sigstore_trustroot_proto_rawDesc)))
	})
	return file_sigstore_trustroot_proto_rawDescData
}

var file_sigstore_trustroot_proto_enumTypes = make([]protoimpl.EnumInfo, 1)
var file_sigstore_trustroot_proto_msgTypes = make([]protoimpl.MessageInfo, 7)
var file_sigstore_trustroot_proto_goTypes = []any{
	(ServiceSelector)(0),            // 0: dev.sigstore.trustroot.v1.ServiceSelector
	(*TransparencyLogInstance)(nil), // 1: dev.sigstore.trustroot.v1.TransparencyLogInstance
	(*CertificateAuthority)(nil),    // 2: dev.sigstore.trustroot.v1.CertificateAuthority
	(*TrustedRoot)(nil),             // 3: dev.sigstore.trustroot.v1.TrustedRoot
	(*SigningConfig)(nil),           // 4: dev.sigstore.trustroot.v1.SigningConfig
	(*Service)(nil),                 // 5: dev.sigstore.trustroot.v1.Service
	(*ServiceConfiguration)(nil),    // 6: dev.sigstore.trustroot.v1.ServiceConfiguration
	(*ClientTrustConfig)(nil),       // 7: dev.sigstore.trustroot.v1.ClientTrustConfig
	(v1.HashAlgorithm)(0),           // 8: dev.sigstore.common.v1.HashAlgorithm
	(*v1.PublicKey)(nil),            // 9: dev.sigstore.common.v1.PublicKey
	(*v1.LogId)(nil),                // 10: dev.sigstore.common.v1.LogId
	(*v1.DistinguishedName)(nil),    // 11: dev.sigstore.common.v1.DistinguishedName
	(*v1.X509CertificateChain)(nil), // 12: dev.sigstore.common.v1.X509CertificateChain
	(*v1.TimeRange)(nil),            // 13: dev.sigstore.common.v1.TimeRange
}
var file_sigstore_trustroot_proto_depIdxs = []int32{
	8,  // 0: dev.sigstore.trustroot.v1.TransparencyLogInstance.hash_algorithm:type_name -> dev.sigstore.common.v1.HashAlgorithm
	9,  // 1: dev.sigstore.trustroot.v1.TransparencyLogInstance.public_key:type_name -> dev.sigstore.common.v1.PublicKey
	10, // 2: dev.sigstore.trustroot.v1.TransparencyLogInstance.log_id:type_name -> dev.sigstore.common.v1.LogId
	10, // 3: dev.sigstore.trustroot.v1.TransparencyLogInstance.checkpoint_key_id:type_name -> dev.sigstore.common.v1.LogId
	11, // 4: dev.sigstore.trustroot.v1.CertificateAuthority.subject:type_name -> dev.sigstore.common.v1.DistinguishedName
	12, // 5: dev.sigstore.trustroot.v1.CertificateAuthority.cert_chain:type_name -> dev.sigstore.common.v1.X509CertificateChain
	13, // 6: dev.sigstore.trustroot.v1.CertificateAuthority.valid_for:type_name -> dev.sigstore.common.v1.TimeRange
	1,  // 7: dev.sigstore.trustroot.v1.TrustedRoot.tlogs:type_name -> dev.sigstore.trustroot.v1.TransparencyLogInstance
	2,  // 8: dev.sigstore.trustroot.v1.TrustedRoot.certificate_authorities:type_name -> dev.sigstore.trustroot.v1.CertificateAuthority
	1,  // 9: dev.sigstore.trustroot.v1.TrustedRoot.ctlogs:type_name -> dev.sigstore.trustroot.v1.TransparencyLogInstance
	2,  // 10: dev.sigstore.trustroot.v1.TrustedRoot.timestamp_authorities:type_name -> dev.sigstore.trustroot.v1.CertificateAuthority
	5,  // 11: dev.sigstore.trustroot.v1.SigningConfig.ca_urls:type_name -> dev.sigstore.trustroot.v1.Service
	5,  // 12: dev.sigstore.trustroot.v1.SigningConfig.oidc_urls:type_name -> dev.sigstore.trustroot.v1.Service
	5,  // 13: dev.sigstore.trustroot.v1.SigningConfig.rekor_tlog_urls:type_name -> dev.sigstore.trustroot.v1.Service
	6,  // 14: dev.sigstore.trustroot.v1.SigningConfig.rekor_tlog_config:type_name -> dev.sigstore.trustroot.v1.ServiceConfiguration
	5,  // 15: dev.sigstore.trustroot.v1.SigningConfig.tsa_urls:type_name -> dev.sigstore.trustroot.v1.Service
	6,  // 16: dev.sigstore.trustroot.v1.SigningConfig.tsa_config:type_name -> dev.sigstore.trustroot.v1.ServiceConfiguration
	13, // 17: dev.sigstore.trustroot.v1.Service.valid_for:type_name -> dev.sigstore.common.v1.TimeRange
	0,  // 18: dev.sigstore.trustroot.v1.ServiceConfiguration.selector:type_name -> dev.sigstore.trustroot.v1.ServiceSelector
	3,  // 19: dev.sigstore.trustroot.v1.ClientTrustConfig.trusted_root:type_name -> dev.sigstore.trustroot.v1.TrustedRoot
	4,  // 20: dev.sigstore.trustroot.v1.ClientTrustConfig.signing_config:type_name -> dev.sigstore.trustroot.v1.SigningConfig
	21, // [21:21] is the sub-list for method output_type
	21, // [21:21] is the sub-list for method input_type
	21, // [21:21] is the sub-list for extension type_name
	21, // [21:21] is the sub-list for extension extendee
	0,  // [0:21] is the sub-list for field type_name
}

func init() { file_sigstore_trustroot_proto_init() }
func file_sigstore_trustroot_proto_init() {
	if File_sigstore_trustroot_proto != nil {
		return
	}
	type x struct{}
	out := protoimpl.TypeBuilder{
		File: protoimpl.DescBuilder{
			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
			RawDescriptor: unsafe.Slice(unsafe.StringData(file_sigstore_trustroot_proto_rawDesc), len(file_sigstore_trustroot_proto_rawDesc)),
			NumEnums:      1,
			NumMessages:   7,
			NumExtensions: 0,
			NumServices:   0,
		},
		GoTypes:           file_sigstore_trustroot_proto_goTypes,
		DependencyIndexes: file_sigstore_trustroot_proto_depIdxs,
		EnumInfos:         file_sigstore_trustroot_proto_enumTypes,
		MessageInfos:      file_sigstore_trustroot_proto_msgTypes,
	}.Build()
	File_sigstore_trustroot_proto = out.File
	file_sigstore_trustroot_proto_goTypes = nil
	file_sigstore_trustroot_proto_depIdxs = nil
}
