Azure.Security.CodeTransparency Namespace

Context class which will be filled in by the System.ClientModel.SourceGeneration. For more information https://github.com/Azure/azure-sdk-for-net/blob/main/sdk/core/System.ClientModel/src/docs/ModelReaderWriterContext.md

Utility methods for reading simple string values from CBOR-encoded maps used within Signing Transparency receipts and responses. Methods are defensive: on invalid input, key absence, or unexpected CBOR shapes they return an empty string instead of throwing, allowing callers to decide whether absence is an error condition.

CcfReceipt class which enables encoding, decoding and verification of receipts issued from the Signing Transparency Service. This class encapsulates the representation and the available operations of CBOR encoded CCF SCITT receipts. This is a reference implementation for a proposed draft IETF specification: https://datatracker.ietf.org/doc/draft-birkholz-scitt-receipts/03/ .

CcfReceiptVerifier contains the methods to verify a CCF SCITT receipt's integrity and its inclusion in the Signing Transparency Service. Verification requires the receipt, the COSE_Sign1 signed statement that was submitted to the service, and the service's public receipt-verification key. The receipt can also be embedded in the COSE_Sign1 envelope.

The client to fetch the service certificate for the use in TLS connection. Very similar to the one used in Azure.Security.ConfidentialLedger. Certificate responses get cached for a configured time.

The CodeTransparencyClient.

Extension methods to add CodeTransparencyClient to an IHostApplicationBuilder.

These options are used in both the certificate client and the regular client.

Represents the settings used to configure a CodeTransparencyClient that can be loaded from an IConfigurationSection.

Model factory for models.

A case-insensitive dictionary mapping ledger domains to their JWKS documents for offline verification.

A store of receipt-verification keys, keyed by issuer domain, for offline verification.

The store can be populated from either the JSON JWK Set (/jwks) or the CBOR COSE_Key_Set (/.well-known/scitt-keys) representation because both are normalized to CodeTransparencyVerificationKeySet before being added.

ToBinaryData() serializes to an SDK-owned, versioned JSON format that persists only public key parameters. Private key material is never stored.

A single public receipt-verification key exposed by a Code Transparency service. The key stores only public asymmetric key material and is decoupled from the JSON Web Key (JWK) and CBOR COSE_Key wire encodings used by the service.

An immutable set of public receipt-verification keys. Key IDs are treated as case-sensitive and must be unique within the set.

Options controlling VerifyTransparentStatement(Byte[], CodeTransparencyVerificationOptions, CodeTransparencyClientOptions).

rfc7517 JSON Web Key representation adapted from a shared swagger definition in the common types.

A JWKS like document.

Response from the identity service containing the TLS cert.

Specifies how receipts whose issuer domains ARE in the authorized list should be enforced.

The version of the service to use.

Controls how VerifyTransparentStatement(Byte[], CodeTransparencyVerificationOptions, CodeTransparencyClientOptions) resolves the receipt-verification keys for an issuer.

Represents the status of an operation in CTS.

Specifies behaviors for the use of offline keys contained in OfflineKeys.

Specifies behaviors for receipts whose issuer domains are not contained in AuthorizedDomains.