fulcio_legacy.proto

//
// Copyright 2022 The Sigstore Authors.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

syntax = "proto3";
package dev.sigstore.fulcio.v1beta;

import "google/api/annotations.proto";
import "google/api/field_behavior.proto";
import "google/api/httpbody.proto";
import "google/protobuf/empty.proto";
import "protoc-gen-openapiv2/options/annotations.proto";

option go_package = "github.com/sigstore/fulcio/pkg/generated/protobuf/legacy";
option java_package = "dev.sigstore.fulcio.v1beta";
option java_multiple_files = true;
option java_outer_classname = "FulcioProto";

option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_swagger) = {
  info: {
    title: "Fulcio Legacy";
    version: "1.0.0";
    contact: {
      name: "sigstore Fulcio project";
      url: "https://github.com/sigstore/fulcio";
      email: "sigstore-dev@googlegroups.com";
    };
    license: {
      name: "Apache License 2.0";
      url: "https://github.com/sigstore/fulcio/blob/main/LICENSE";
    };
  };

  host: "fulcio.sigstore.dev";
  external_docs: {
    url: "https://github.com/sigstore/fulcio";
    description: "More about Fulcio";
  };
  schemes: HTTP;
  consumes: "application/json";
  produces: "application/json";
};



/*
 * This implements the pre-GA HTTP-based Fulcio API.
 * This interface is deprecated and will only receive backports of security-related features - clients should prefer the GA GRPC interface!
 */
service CA {
    /*
     * Returns an X509 certificate created by the Fulcio certificate authority for the given request parameters
     */
    rpc CreateSigningCertificate(CreateSigningCertificateRequest) returns (google.api.HttpBody){
        option deprecated = true;
        option (google.api.http) = {
          post: "/api/v1/signingCert"
          body: "*"
        };
    }
    /*
     * Returns the public key that can be used to validate the signed tree head
     */
    rpc GetRootCertificate(google.protobuf.Empty) returns (google.api.HttpBody){
        option deprecated = true;
        option (google.api.http) = {
          get: "/api/v1/rootCert"
        };
    }
}

message CreateSigningCertificateRequest {
    /*
     * The public key to be stored in the requested certificate
     */
    PublicKey publicKey       = 1 [
        deprecated=true,
        (google.api.field_behavior) = OPTIONAL
    ];
    /*
     * Proof that the client possesses the private key
     */
    bytes signedEmailAddress  = 2 [
        deprecated=true,
        (google.api.field_behavior) = OPTIONAL
    ];
    /*
     * Optional: PKCS#10 PEM-encoded certificate signing request
     * Contains the public key to be stored in the requested
     * certificate. All other CSR fields are ignored. Since
     * the CSR is self-signed, it also acts as a proof of
     * possession of the private key.
     *
     * In particular, the CSR's subject name is not verified, or tested for
     * compatibility with its specified X.509 name type (e.g. email address).
     */
    bytes certificateSigningRequest  = 3 [
        deprecated=true,
        (google.api.field_behavior) = OPTIONAL
     ];
}

message PublicKey {
    /*
     * The cryptographic algorithm to use with the key material
     */
    string algorithm = 1 [ deprecated=true ];
    /*
     * PKIX, ASN.1 DER or PEM-encoded public key. PEM is typically
     * of type PUBLIC KEY.
     */
    bytes content    = 2 [
        deprecated=true,
        (google.api.field_behavior) = REQUIRED
    ];
}