/**
 * Sigstore Signing
 *
 * Signs artifacts using Sigstore (Fulcio + Rekor) for
 * supply chain security and provenance verification.
 *
 * Uses the official @sigstore/sign library for real cryptographic signing.
 *
 * @module sbom/signing
 */
import type { SignedArtifact, SigningOptions } from "./types.js";
/**
 * Calculate SHA-256 digest
 */
export declare function sha256(content: string): string;
/**
 * Calculate SHA-256 digest as base64
 */
export declare function sha256Base64(content: string): string;
/**
 * Check if Sigstore signing is available
 *
 * Sigstore keyless signing requires:
 * 1. An OIDC identity token (from GitHub Actions, GitLab CI, Google Cloud, etc.)
 * 2. Network access to Fulcio and Rekor
 *
 * In GitHub Actions, set `permissions: id-token: write` to enable OIDC.
 */
export declare function isSigningAvailable(options?: SigningOptions): boolean;
/**
 * Sign content using Sigstore
 *
 * This implementation uses the official @sigstore/sign library with
 * Sigstore public-good instances:
 * - Fulcio: Certificate Authority that issues short-lived certificates
 * - Rekor: Transparency log that records signing events
 *
 * The signing process:
 * 1. Get OIDC token from CI/CD environment
 * 2. Request certificate from Fulcio using the OIDC token
 * 3. Sign the content with the ephemeral key
 * 4. Record the signing event in Rekor transparency log
 * 5. Return the bundle containing signature and certificate
 *
 * Requirements:
 * - In GitHub Actions: `permissions: id-token: write`
 * - Network access to fulcio.sigstore.dev and rekor.sigstore.dev
 */
export declare function signContent(content: string, options?: SigningOptions): Promise<SignedArtifact>;
/**
 * Create an unsigned artifact (for offline/testing)
 */
export declare function createUnsignedArtifact(content: string): SignedArtifact;
/**
 * Verify a signed artifact using @sigstore/verify
 *
 * Verification checks:
 * 1. Signature is valid for the content
 * 2. Certificate was issued by Fulcio
 * 3. Entry exists in Rekor transparency log
 * 4. Certificate was valid at signing time
 */
export declare function verifySignedArtifact(artifact: SignedArtifact): Promise<{
    valid: boolean;
    errors: string[];
}>;
/**
 * Legacy sync verify function for backwards compatibility
 */
export declare function verifySignature(artifact: SignedArtifact): {
    valid: boolean;
    errors: string[];
};
/**
 * Generate signing summary
 */
export declare function generateSigningSummary(artifact: SignedArtifact): string;
/**
 * Check if we're running in a CI environment with OIDC support
 */
export declare function detectCIEnvironment(): {
    detected: boolean;
    provider: string | null;
    hasOIDC: boolean;
    setupInstructions: string | null;
};
//# sourceMappingURL=signing.d.ts.map