SUMMARY = "Container signing, verification and storage in an OCI registry"
HOMEPAGE = "https://github.com/sigstore/cosign"
LICENSE = "Apache-2.0"
LIC_FILES_CHKSUM = "file://${S}/src/${GO_IMPORT}/COPYRIGHT.txt;md5=3830a9ca4f9dc30be01bfa2e4042dd46 \
                    file://${S}/src/${GO_IMPORT}/LICENSE;md5=86d3f3a95c324c9479bd8986968f4327 \
                    "

GO_IMPORT = "github.com/sigstore/cosign"

SRC_URI = "git://github.com/sigstore/cosign.git;branch=main;name=cosign;protocol=https;destsuffix=${GO_SRCURI_DESTSUFFIX}"
PV = "3.0.6+git"
SRCREV_cosign = "55f4d9e2085a6f3c72f2809076655b4745dfab7e"

SRCREV_FORMAT = "cosign"

# go-mod-discovery configuration
GO_MOD_DISCOVERY_SRCDIR = "${S}/src/${GO_IMPORT}"
GO_MOD_DISCOVERY_BUILD_TARGET = "./cmd/cosign"
GO_MOD_DISCOVERY_GIT_REPO = "https://github.com/sigstore/cosign.git"
GO_MOD_DISCOVERY_GIT_REF = "${SRCREV_cosign}"

# Modules that can't be fetched via git (no repo metadata or unreachable commits)
# - buf.build/gen/go: generated protobuf module, no git repository
# - software.sslmate.com/src/go-pkcs12: commit not reachable via shallow fetch
SRC_URI += "gomod://buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go;version=v1.36.11-20260415201107-50325440f8f2.1;sha256sum=${COSIGN_BUF_BUILD_SHA}"
SRC_URI += "gomod://software.sslmate.com/src/go-pkcs12;version=v0.4.0;sha256sum=${COSIGN_PKCS12_SHA}"
GO_MOD_VCS_EXCLUDE = "buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go software.sslmate.com/src/go-pkcs12"

# Checksums — run bitbake cosign -c fetch to get correct values on first use
COSIGN_BUF_BUILD_SHA ?= "d07eb34c7a90d2a86ab3cca1040e4ef23a8ef419416ce90cc7b736ceb33bb366"
COSIGN_PKCS12_SHA ?= "55019a391e5302a51ba62e98909e006224b81207866da90beaf582ec0dee036f"

# GO_MOD_FETCH_MODE: "vcs" (all git://) or "hybrid" (gomod:// + git://)
GO_MOD_FETCH_MODE ?= "hybrid"

# VCS mode: all modules via git://
include ${@ "go-mod-git.inc" if d.getVar("GO_MOD_FETCH_MODE") == "vcs" else ""}
include ${@ "go-mod-cache.inc" if d.getVar("GO_MOD_FETCH_MODE") == "vcs" else ""}

# Hybrid mode: gomod:// for most, git:// for selected
include ${@ "go-mod-hybrid-gomod.inc" if d.getVar("GO_MOD_FETCH_MODE") == "hybrid" else ""}
include ${@ "go-mod-hybrid-git.inc" if d.getVar("GO_MOD_FETCH_MODE") == "hybrid" else ""}
include ${@ "go-mod-hybrid-cache.inc" if d.getVar("GO_MOD_FETCH_MODE") == "hybrid" else ""}

# Dependency license tracking (generated by oe-go-mod-fetcher --scan-licenses)
require go-mod-licenses.inc

inherit go goarch
inherit go-mod-discovery

BBCLASSEXTEND = "native nativesdk"
