ctlog

type Backend interface {
	// Upload writes the value for a key. Upload is expected to retry transient
	// errors, and only return an error for unrecoverable errors. When Upload
	// returns, the object must be fully persisted. opts may be nil.
	Upload(ctx context.Context, key string, data []byte, opts *UploadOptions) error

	// Fetch returns the value for a key.
	Fetch(ctx context.Context, key string) ([]byte, error)

	// Discard suggests to the backend that the key can be deleted.
	Discard(ctx context.Context, key string) error

	// Metrics returns the metrics to register for this log. The metrics should
	// not be shared by any other logs.
	Metrics() []prometheus.Collector
}

type Config struct {
	Name       string
	Key        *ecdsa.PrivateKey
	WitnessKey *mldsa.PrivateKey
	PoolSize   int
	Cache      string

	Backend Backend
	Lock    LockBackend
	Log     *slog.Logger

	NotAfterStart time.Time
	NotAfterLimit time.Time

	// MarkCertificates requires submitted certificates to have the Verified
	// Mark Certificate EKU, instead of the serverAuth EKU.
	MarkCertificates bool
}

type DynamoDBBackend struct {
	// contains filtered or unexported fields
}

type ETagBackend struct {
	// contains filtered or unexported fields
}

type LocalBackend struct {
	// contains filtered or unexported fields
}

type LockBackend interface {
	// Fetch obtains the current checkpoint for a given log, as well as the data
	// necessary to perform a compare-and-swap operation.
	//
	// It must return [ErrLogNotFound] if the log doesn't exist.
	Fetch(ctx context.Context, logID [sha256.Size]byte) (LockedCheckpoint, error)

	// Replace uploads a new checkpoint, atomically checking that the old
	// checkpoint is the provided one, and returning the new one. Replace is
	// expected to retry transient errors, and only return an error for
	// unrecoverable errors (such as a conflict).
	Replace(ctx context.Context, old LockedCheckpoint, new []byte) (LockedCheckpoint, error)

	// Create uploads a new checkpoint, atomically checking that none exist for
	// the log yet.
	Create(ctx context.Context, logID [sha256.Size]byte, new []byte) error
}

type LockedCheckpoint interface {
	Bytes() []byte
}

type Log struct {
	// contains filtered or unexported fields
}

type PendingLogEntry struct {
	Certificate    []byte
	IsPrecert      bool
	IssuerKeyHash  [32]byte
	Issuers        [][]byte
	PreCertificate []byte
}

type S3Backend struct {
	// contains filtered or unexported fields
}

type SQLiteBackend struct {
	// contains filtered or unexported fields
}

type SunsetLogError struct {
	FinalTree      tlog.Tree
	FinalTimestamp int64
}

type UploadOptions struct {
	// ContentType is the MIME type of the data. If empty, defaults to
	// "application/octet-stream".
	ContentType string

	// Compressed is true if the data is compressed with gzip.
	Compressed bool

	// Immutable is true if the data is never changed after being uploaded.
	// Note that the same value may still be re-uploaded, and must succeed.
	// [Backend.Discard] can still be used on immutable entries.
	Immutable bool
}