/**
 * Sigstore Signing
 *
 * Signs artifacts using Sigstore (Fulcio + Rekor) for
 * supply chain security and provenance verification.
 *
 * Uses the official @sigstore/sign library for real cryptographic signing.
 *
 * @module sbom/signing
 */
import type { SignedArtifact, SigningOptions } from "./types.js";
/**
 * Calculate SHA-256 digest
 */
export declare function sha256(content: string): string;
/**
 * Calculate SHA-256 digest as base64
 */
export declare function sha256Base64(content: string): string;
/**
 * Check if Sigstore signing is available
 *
 * Sigstore keyless signing requires:
 * 1. An OIDC identity token (from GitHub Actions, GitLab CI, Google Cloud, etc.)
 * 2. Network access to Fulcio and Rekor
 *
 * In GitHub Actions, set `permissions: id-token: write` to enable OIDC.
 */
export declare function isSigningAvailable(options?: SigningOptions): boolean;
/**
 * Sign content using Sigstore
 *
 * This implementation uses the official @sigstore/sign library with
 * Sigstore public-good instances:
 * - Fulcio: Certificate Authority that issues short-lived certificates
 * - Rekor: Transparency log that records signing events
 *
 * The signing process:
 * 1. Get OIDC token from CI/CD environment
 * 2. Request certificate from Fulcio using the OIDC token
 * 3. Sign the content with the ephemeral key
 * 4. Record the signing event in Rekor transparency log
 * 5. Return the bundle containing signature and certificate
 *
 * Requirements:
 * - In GitHub Actions: `permissions: id-token: write`
 * - Network access to fulcio.sigstore.dev and rekor.sigstore.dev
 */
export declare function signContent(content: string, options?: SigningOptions): Promise<SignedArtifact>;
/**
 * Create an unsigned artifact (for offline/testing)
 */
export declare function createUnsignedArtifact(content: string): SignedArtifact;
/** The identity a Sigstore certificate was issued to. */
export interface SignerIdentity {
    /** Subject Alternative Name — the workload identity (e.g. a CI workflow URI). */
    subject?: string;
    /** Certificate issuer (the Fulcio intermediate). */
    issuer?: string;
}
/** Optional policy to pin the expected signer during verification. */
export interface VerifyIdentityPolicy {
    /** Require the certificate SAN email to match. */
    certificateIdentityEmail?: string;
    /** Require the certificate SAN URI to match (CI workflow identity). */
    certificateIdentityURI?: string;
    /** Require the OIDC issuer to match (e.g. https://token.actions.githubusercontent.com). */
    certificateOIDCIssuer?: string;
}
export interface VerificationResult {
    valid: boolean;
    errors: string[];
    /**
     * True only when full cryptographic verification ran and passed: DSSE
     * signature valid, Fulcio certificate chains to the Sigstore root, and the
     * Rekor transparency-log inclusion proof checks out.
     */
    cryptographicallyVerified: boolean;
    /** Rekor transparency-log index, when present. */
    rekorLogIndex?: string;
    /** The identity that produced the signature, extracted from the certificate. */
    signerIdentity?: SignerIdentity;
}
/**
 * Verify a signed artifact — real cryptographic verification via Sigstore.
 *
 * Unlike a structural check, this actually proves the signature: it runs the
 * bundle through the `sigstore` verifier against the public-good trust root
 * (fetched via TUF), which checks that
 *   1. the DSSE signature is valid over the signed payload,
 *   2. the Fulcio certificate chains to the Sigstore root,
 *   3. the Rekor transparency-log inclusion proof is valid, and
 *   4. the certificate was valid at signing time.
 * It additionally binds the bundle to *this* content (digest + signed-payload
 * match) so a valid bundle can't be paired with different content.
 *
 * Pass a {@link VerifyIdentityPolicy} to also pin *who* signed. Requires network
 * access to the Sigstore trust root; if that can't be reached, verification is
 * reported as incomplete (valid=false) rather than silently passing.
 */
export declare function verifySignedArtifact(artifact: SignedArtifact, policy?: VerifyIdentityPolicy): Promise<VerificationResult>;
/**
 * Legacy **synchronous, structural-only** check — kept for backwards
 * compatibility. It confirms the artifact is signed, the digest matches, and a
 * transparency-log entry is present, but it does **not** cryptographically
 * verify the signature, certificate chain, or Rekor inclusion proof (that
 * requires network access and is async). For real verification use
 * {@link verifySignedArtifact}.
 */
export declare function verifySignature(artifact: SignedArtifact): {
    valid: boolean;
    errors: string[];
};
/**
 * Generate signing summary
 */
export declare function generateSigningSummary(artifact: SignedArtifact): string;
/**
 * Check if we're running in a CI environment with OIDC support
 */
export declare function detectCIEnvironment(): {
    detected: boolean;
    provider: string | null;
    hasOIDC: boolean;
    setupInstructions: string | null;
};
//# sourceMappingURL=signing.d.ts.map