// This file is @generated by prost-build.
/// A Challenge from the server used to guarantee freshness of attestations
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct Challenge {
    /// Output only. The resource name for this Challenge in the format
    /// `projects/*/locations/*/challenges/*`
    #[prost(string, tag = "1")]
    pub name: ::prost::alloc::string::String,
    /// Output only. The time at which this Challenge was created
    #[prost(message, optional, tag = "2")]
    pub create_time: ::core::option::Option<::prost_types::Timestamp>,
    /// Output only. The time at which this Challenge will no longer be usable. It
    /// is also the expiration time for any tokens generated from this Challenge.
    #[prost(message, optional, tag = "3")]
    pub expire_time: ::core::option::Option<::prost_types::Timestamp>,
    /// Output only. Indicates if this challenge has been used to generate a token.
    #[prost(bool, tag = "4")]
    pub used: bool,
    /// Output only. Identical to nonce, but as a string.
    #[prost(string, tag = "6")]
    pub tpm_nonce: ::prost::alloc::string::String,
}
/// Message for creating a Challenge
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct CreateChallengeRequest {
    /// Required. The resource name of the location where the Challenge will be
    /// used, in the format `projects/*/locations/*`.
    #[prost(string, tag = "1")]
    pub parent: ::prost::alloc::string::String,
    /// Required. The Challenge to be created. Currently this field can be empty as
    /// all the Challenge fields are set by the server.
    #[prost(message, optional, tag = "2")]
    pub challenge: ::core::option::Option<Challenge>,
}
/// A request for an attestation token, providing all the necessary information
/// needed for this service to verify the platform state of the requestor.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct VerifyAttestationRequest {
    /// Required. The name of the Challenge whose nonce was used to generate the
    /// attestation, in the format `projects/*/locations/*/challenges/*`. The
    /// provided Challenge will be consumed, and cannot be used again.
    #[prost(string, tag = "1")]
    pub challenge: ::prost::alloc::string::String,
    /// Optional. Credentials used to populate the "emails" claim in the
    /// claims_token.
    #[prost(message, optional, tag = "2")]
    pub gcp_credentials: ::core::option::Option<GcpCredentials>,
    /// Required. The TPM-specific data provided by the attesting platform, used to
    /// populate any of the claims regarding platform state.
    #[prost(message, optional, tag = "3")]
    pub tpm_attestation: ::core::option::Option<TpmAttestation>,
    /// Optional. Optional information related to the Confidential Space TEE.
    #[prost(message, optional, tag = "4")]
    pub confidential_space_info: ::core::option::Option<ConfidentialSpaceInfo>,
    /// Optional. A collection of optional, workload-specified claims that modify
    /// the token output.
    #[prost(message, optional, tag = "5")]
    pub token_options: ::core::option::Option<TokenOptions>,
    /// Optional. An optional indicator of the attester, only applies to certain
    /// products.
    #[prost(string, tag = "8")]
    pub attester: ::prost::alloc::string::String,
    /// An optional tee attestation report, used to populate hardware rooted
    /// claims.
    #[prost(oneof = "verify_attestation_request::TeeAttestation", tags = "6, 7")]
    pub tee_attestation: ::core::option::Option<
        verify_attestation_request::TeeAttestation,
    >,
    /// An optional device attestation report.
    #[prost(oneof = "verify_attestation_request::DeviceAttestation", tags = "9")]
    pub device_attestation: ::core::option::Option<
        verify_attestation_request::DeviceAttestation,
    >,
}
/// Nested message and enum types in `VerifyAttestationRequest`.
pub mod verify_attestation_request {
    /// An optional tee attestation report, used to populate hardware rooted
    /// claims.
    #[derive(Clone, PartialEq, Eq, Hash, ::prost::Oneof)]
    pub enum TeeAttestation {
        /// Optional. A TDX with CCEL and RTMR Attestation Quote.
        #[prost(message, tag = "6")]
        TdCcel(super::TdxCcelAttestation),
        /// Optional. An SEV-SNP Attestation Report.
        #[prost(message, tag = "7")]
        SevSnpAttestation(super::SevSnpAttestation),
    }
    /// An optional device attestation report.
    #[derive(Clone, PartialEq, ::prost::Oneof)]
    pub enum DeviceAttestation {
        /// Optional. An Nvidia attestation report for GPU and NVSwitch devices.
        #[prost(message, tag = "9")]
        NvidiaAttestation(super::NvidiaAttestation),
    }
}
/// An Nvidia attestation report for GPU and NVSwitch devices.
/// Contains necessary attestation evidence that the client collects for
/// verification.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct NvidiaAttestation {
    /// The Confidential Computing feature that the attestation is for.
    #[prost(oneof = "nvidia_attestation::CcFeature", tags = "1, 2, 3")]
    pub cc_feature: ::core::option::Option<nvidia_attestation::CcFeature>,
}
/// Nested message and enum types in `NvidiaAttestation`.
pub mod nvidia_attestation {
    /// GpuInfo contains the attestation evidence for a GPU device.
    #[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
    pub struct GpuInfo {
        /// Optional. The UUID of the GPU device.
        #[prost(string, tag = "1")]
        pub uuid: ::prost::alloc::string::String,
        /// Optional. The driver version of the GPU.
        #[prost(string, tag = "2")]
        pub driver_version: ::prost::alloc::string::String,
        /// Optional. The vBIOS version of the GPU.
        #[prost(string, tag = "3")]
        pub vbios_version: ::prost::alloc::string::String,
        /// Optional. The GPU architecture type.
        #[prost(enumeration = "GpuArchitectureType", tag = "4")]
        pub gpu_architecture_type: i32,
        /// Optional. The raw attestation certificate chain for the GPU device.
        #[prost(bytes = "vec", tag = "5")]
        pub attestation_certificate_chain: ::prost::alloc::vec::Vec<u8>,
        /// Optional. The raw attestation report for the GPU device.
        /// This field contains SPDM request/response defined in
        /// <https://www.dmtf.org/sites/default/files/standards/documents/DSP0274_1.1.0.pdf>
        #[prost(bytes = "vec", tag = "6")]
        pub attestation_report: ::prost::alloc::vec::Vec<u8>,
    }
    /// SwitchInfo contains the attestation evidence for a NVSwitch device.
    #[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
    pub struct SwitchInfo {
        /// Optional. The UUID of the NVSwitch device.
        #[prost(string, tag = "1")]
        pub uuid: ::prost::alloc::string::String,
        /// Optional. The raw attestation certificate chain for the NVSwitch device.
        #[prost(bytes = "vec", tag = "2")]
        pub attestation_certificate_chain: ::prost::alloc::vec::Vec<u8>,
        /// Optional. The raw attestation report for the NvSwitch device.
        /// This field contains SPDM request/response defined in
        /// <https://www.dmtf.org/sites/default/files/standards/documents/DSP0274_1.1.0.pdf>
        #[prost(bytes = "vec", tag = "3")]
        pub attestation_report: ::prost::alloc::vec::Vec<u8>,
    }
    /// Single GPU Passthrough (SPT) attestation.
    #[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
    pub struct SinglePassthroughAttestation {
        /// Optional. Single GPU quote.
        #[prost(message, optional, tag = "1")]
        pub gpu_quote: ::core::option::Option<GpuInfo>,
    }
    /// Protected PCIe (PPCIE) attestation.
    /// Eight Hopper GPUs with Four NVSwitch Passthrough.
    #[derive(Clone, PartialEq, ::prost::Message)]
    pub struct ProtectedPcieAttestation {
        /// Optional. A list of GPU infos.
        #[prost(message, repeated, tag = "1")]
        pub gpu_quotes: ::prost::alloc::vec::Vec<GpuInfo>,
        /// Optional. A list of SWITCH infos.
        #[prost(message, repeated, tag = "2")]
        pub switch_quotes: ::prost::alloc::vec::Vec<SwitchInfo>,
    }
    /// MultiGpuSecurePassthroughAttestation contains the attestation evidence
    /// for a Multi-GPU Secure Passthrough (MPT) attestation.
    #[derive(Clone, PartialEq, ::prost::Message)]
    pub struct MultiGpuSecurePassthroughAttestation {
        /// Optional. A list of GPU quotes.
        #[prost(message, repeated, tag = "1")]
        pub gpu_quotes: ::prost::alloc::vec::Vec<GpuInfo>,
    }
    /// GpuArchitectureType enumerates the supported GPU architecture types.
    #[derive(
        Clone,
        Copy,
        Debug,
        PartialEq,
        Eq,
        Hash,
        PartialOrd,
        Ord,
        ::prost::Enumeration
    )]
    #[repr(i32)]
    pub enum GpuArchitectureType {
        /// Unspecified GPU architecture type.
        Unspecified = 0,
        /// Hopper GPU architecture type.
        Hopper = 8,
        /// Blackwell GPU architecture type.
        Blackwell = 10,
    }
    impl GpuArchitectureType {
        /// String value of the enum field names used in the ProtoBuf definition.
        ///
        /// The values are not transformed in any way and thus are considered stable
        /// (if the ProtoBuf definition does not change) and safe for programmatic use.
        pub fn as_str_name(&self) -> &'static str {
            match self {
                Self::Unspecified => "GPU_ARCHITECTURE_TYPE_UNSPECIFIED",
                Self::Hopper => "GPU_ARCHITECTURE_TYPE_HOPPER",
                Self::Blackwell => "GPU_ARCHITECTURE_TYPE_BLACKWELL",
            }
        }
        /// Creates an enum from field names used in the ProtoBuf definition.
        pub fn from_str_name(value: &str) -> ::core::option::Option<Self> {
            match value {
                "GPU_ARCHITECTURE_TYPE_UNSPECIFIED" => Some(Self::Unspecified),
                "GPU_ARCHITECTURE_TYPE_HOPPER" => Some(Self::Hopper),
                "GPU_ARCHITECTURE_TYPE_BLACKWELL" => Some(Self::Blackwell),
                _ => None,
            }
        }
    }
    /// The Confidential Computing feature that the attestation is for.
    #[derive(Clone, PartialEq, ::prost::Oneof)]
    pub enum CcFeature {
        /// Single GPU Passthrough (SPT) attestation.
        #[prost(message, tag = "1")]
        Spt(SinglePassthroughAttestation),
        /// Protected PCIe (PPCIE) attestation.
        #[prost(message, tag = "2")]
        Ppcie(ProtectedPcieAttestation),
        /// Multi-GPU Secure Passthrough (MPT) attestation.
        #[prost(message, tag = "3")]
        Mpt(MultiGpuSecurePassthroughAttestation),
    }
}
/// A TDX Attestation quote.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct TdxCcelAttestation {
    /// Optional. The Confidential Computing Event Log (CCEL) ACPI table. Formatted
    /// as described in the ACPI Specification 6.5.
    #[prost(bytes = "vec", tag = "1")]
    pub ccel_acpi_table: ::prost::alloc::vec::Vec<u8>,
    /// Optional. The CCEL event log. Formatted as described in the UEFI 2.10.
    #[prost(bytes = "vec", tag = "2")]
    pub ccel_data: ::prost::alloc::vec::Vec<u8>,
    /// Optional. An Event Log containing additional events measured into the RTMR
    /// that are not already present in the CCEL.
    #[prost(bytes = "vec", tag = "3")]
    pub canonical_event_log: ::prost::alloc::vec::Vec<u8>,
    /// Optional. The TDX attestation quote from the guest. It contains the RTMR
    /// values.
    #[prost(bytes = "vec", tag = "4")]
    pub td_quote: ::prost::alloc::vec::Vec<u8>,
}
/// An SEV-SNP Attestation Report.
/// Contains the attestation report and the certificate bundle that the client
/// collects.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct SevSnpAttestation {
    /// Optional. The SEV-SNP Attestation Report
    /// Format is in revision 1.55, §7.3 Attestation, Table 22. ATTESTATION_REPORT
    /// Structure in this document:
    /// <https://www.amd.com/content/dam/amd/en/documents/epyc-technical-docs/specifications/56860.pdf>
    #[prost(bytes = "vec", tag = "1")]
    pub report: ::prost::alloc::vec::Vec<u8>,
    /// Optional. Certificate bundle defined in the GHCB protocol definition
    /// Format is documented in GHCB revision 2.03, section 4.1.8.1 struct
    /// cert_table in this document:
    /// <https://www.amd.com/content/dam/amd/en/documents/epyc-technical-docs/specifications/56421.pdf>
    #[prost(bytes = "vec", tag = "2")]
    pub aux_blob: ::prost::alloc::vec::Vec<u8>,
}
/// A response once an attestation has been successfully verified, containing a
/// signed attestation token.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct VerifyAttestationResponse {
    /// Output only. Same as claims_token, but as a string.
    #[prost(string, tag = "2")]
    pub oidc_claims_token: ::prost::alloc::string::String,
    /// Output only. A list of messages that carry the partial error details
    /// related to VerifyAttestation.
    #[prost(message, repeated, tag = "3")]
    pub partial_errors: ::prost::alloc::vec::Vec<super::super::super::rpc::Status>,
}
/// Credentials issued by GCP which are linked to the platform attestation. These
/// will be verified server-side as part of attestaion verification.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct GcpCredentials {
    /// Same as id_tokens, but as a string.
    #[prost(string, repeated, tag = "2")]
    pub service_account_id_tokens: ::prost::alloc::vec::Vec<
        ::prost::alloc::string::String,
    >,
}
/// Options to modify claims in the token to generate custom-purpose tokens.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct TokenOptions {
    /// Optional. Optional string to issue the token with a custom audience claim.
    /// Required if one or more nonces are specified.
    #[prost(string, tag = "1")]
    pub audience: ::prost::alloc::string::String,
    /// Optional. Optional parameter to place one or more nonces in the eat_nonce
    /// claim in the output token. The minimum size for JSON-encoded EATs is 10
    /// bytes and the maximum size is 74 bytes.
    #[prost(string, repeated, tag = "2")]
    pub nonce: ::prost::alloc::vec::Vec<::prost::alloc::string::String>,
    /// Optional. Optional token type to select what type of token to return.
    #[prost(enumeration = "TokenType", tag = "3")]
    pub token_type: i32,
    /// An optional additional configuration per token type.
    #[prost(oneof = "token_options::TokenTypeOptions", tags = "4")]
    pub token_type_options: ::core::option::Option<token_options::TokenTypeOptions>,
}
/// Nested message and enum types in `TokenOptions`.
pub mod token_options {
    /// An optional additional configuration per token type.
    #[derive(Clone, PartialEq, Eq, Hash, ::prost::Oneof)]
    pub enum TokenTypeOptions {
        /// Optional. Options for AWS token type.
        #[prost(message, tag = "4")]
        AwsPrincipalTagsOptions(super::AwsPrincipalTagsOptions),
    }
}
/// Token options that only apply to the AWS Principal Tags token type.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct AwsPrincipalTagsOptions {
    /// Optional. Principal tags to allow in the token.
    #[prost(message, optional, tag = "1")]
    pub allowed_principal_tags: ::core::option::Option<
        aws_principal_tags_options::AllowedPrincipalTags,
    >,
}
/// Nested message and enum types in `AwsPrincipalTagsOptions`.
pub mod aws_principal_tags_options {
    /// Allowed principal tags is used to define what principal tags will be
    /// placed in the token.
    #[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
    pub struct AllowedPrincipalTags {
        /// Optional. Container image signatures allowed in the token.
        #[prost(message, optional, tag = "1")]
        pub container_image_signatures: ::core::option::Option<
            allowed_principal_tags::ContainerImageSignatures,
        >,
    }
    /// Nested message and enum types in `AllowedPrincipalTags`.
    pub mod allowed_principal_tags {
        /// Allowed Container Image Signatures. Key IDs are required to allow
        /// this claim to fit within the narrow AWS IAM restrictions.
        #[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
        pub struct ContainerImageSignatures {
            /// Optional. List of key ids to filter into the Principal tags. Only keys
            /// that have been validated and added to the token will be filtered into
            /// principal tags. Unrecognized key ids will be ignored.
            #[prost(string, repeated, tag = "1")]
            pub key_ids: ::prost::alloc::vec::Vec<::prost::alloc::string::String>,
        }
    }
}
/// TPM2 data containing everything necessary to validate any platform state
/// measured into the TPM.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct TpmAttestation {
    /// TPM2 PCR Quotes generated by calling TPM2_Quote on each PCR bank.
    #[prost(message, repeated, tag = "1")]
    pub quotes: ::prost::alloc::vec::Vec<tpm_attestation::Quote>,
    /// The binary TCG Event Log containing events measured into the TPM by the
    /// platform firmware and operating system. Formatted as described in the
    /// "TCG PC Client Platform Firmware Profile Specification".
    #[prost(bytes = "vec", tag = "2")]
    pub tcg_event_log: ::prost::alloc::vec::Vec<u8>,
    /// An Event Log containing additional events measured into the TPM that are
    /// not already present in the tcg_event_log. Formatted as described in the
    /// "Canonical Event Log Format" TCG Specification.
    #[prost(bytes = "vec", tag = "3")]
    pub canonical_event_log: ::prost::alloc::vec::Vec<u8>,
    /// DER-encoded X.509 certificate of the Attestation Key (otherwise known as
    /// an AK or a TPM restricted signing key) used to generate the quotes.
    #[prost(bytes = "vec", tag = "4")]
    pub ak_cert: ::prost::alloc::vec::Vec<u8>,
    /// List of DER-encoded X.509 certificates which, together with the ak_cert,
    /// chain back to a trusted Root Certificate.
    #[prost(bytes = "vec", repeated, tag = "5")]
    pub cert_chain: ::prost::alloc::vec::Vec<::prost::alloc::vec::Vec<u8>>,
}
/// Nested message and enum types in `TpmAttestation`.
pub mod tpm_attestation {
    /// Information about Platform Control Registers (PCRs) including a signature
    /// over their values, which can be used for remote validation.
    #[derive(Clone, PartialEq, ::prost::Message)]
    pub struct Quote {
        /// The hash algorithm of the PCR bank being quoted, encoded as a TPM_ALG_ID
        #[prost(int32, tag = "1")]
        pub hash_algo: i32,
        /// Raw binary values of each PCRs being quoted.
        #[prost(map = "int32, bytes", tag = "2")]
        pub pcr_values: ::std::collections::HashMap<i32, ::prost::alloc::vec::Vec<u8>>,
        /// TPM2 quote, encoded as a TPMS_ATTEST
        #[prost(bytes = "vec", tag = "3")]
        pub raw_quote: ::prost::alloc::vec::Vec<u8>,
        /// TPM2 signature, encoded as a TPMT_SIGNATURE
        #[prost(bytes = "vec", tag = "4")]
        pub raw_signature: ::prost::alloc::vec::Vec<u8>,
    }
}
/// ConfidentialSpaceInfo contains information related to the Confidential Space
/// TEE.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct ConfidentialSpaceInfo {
    /// Optional. A list of signed entities containing container image signatures
    /// that can be used for server-side signature verification.
    #[prost(message, repeated, tag = "1")]
    pub signed_entities: ::prost::alloc::vec::Vec<SignedEntity>,
}
/// SignedEntity represents an OCI image object containing everything necessary
/// to verify container image signatures.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct SignedEntity {
    /// Optional. A list of container image signatures attached to an OCI image
    /// object.
    #[prost(message, repeated, tag = "1")]
    pub container_image_signatures: ::prost::alloc::vec::Vec<ContainerImageSignature>,
}
/// ContainerImageSignature holds necessary metadata to verify a container image
/// signature.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct ContainerImageSignature {
    /// Optional. The binary signature payload following the SimpleSigning format
    /// <https://github.com/sigstore/cosign/blob/main/specs/SIGNATURE_SPEC.md#simple-signing.>
    /// This payload includes the container image digest.
    #[prost(bytes = "vec", tag = "1")]
    pub payload: ::prost::alloc::vec::Vec<u8>,
    /// Optional. A signature over the payload.
    /// The container image digest is incorporated into the signature as follows:
    ///
    /// 1. Generate a SimpleSigning format payload that includes the container
    ///    image digest.
    /// 1. Generate a signature over SHA256 digest of the payload.
    ///    The signature generation process can be represented as follows:
    ///    `Sign(sha256(SimpleSigningPayload(sha256(Image Manifest))))`
    #[prost(bytes = "vec", tag = "2")]
    pub signature: ::prost::alloc::vec::Vec<u8>,
    /// Optional. Reserved for future use.
    #[prost(bytes = "vec", tag = "3")]
    pub public_key: ::prost::alloc::vec::Vec<u8>,
    /// Optional. Reserved for future use.
    #[prost(enumeration = "SigningAlgorithm", tag = "4")]
    pub sig_alg: i32,
}
/// A request for an attestation token, providing all the necessary information
/// needed for this service to verify the platform state of the requestor.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct VerifyConfidentialSpaceRequest {
    /// Required. The name of the Challenge whose nonce was used to generate the
    /// attestation, in the format `projects/*/locations/*/challenges/*`. The
    /// provided Challenge will be consumed, and cannot be used again.
    #[prost(string, tag = "1")]
    pub challenge: ::prost::alloc::string::String,
    /// Optional. Credentials used to populate the "emails" claim in the
    /// claims_token. If not present, token will not contain the "emails" claim.
    #[prost(message, optional, tag = "2")]
    pub gcp_credentials: ::core::option::Option<GcpCredentials>,
    /// Optional. A list of signed entities containing container image signatures
    /// that can be used for server-side signature verification.
    #[prost(message, repeated, tag = "5")]
    pub signed_entities: ::prost::alloc::vec::Vec<SignedEntity>,
    /// Optional. Information about the associated Compute Engine instance.
    /// Required for td_ccel requests only - tpm_attestation requests will provide
    /// this information in the attestation.
    #[prost(message, optional, tag = "6")]
    pub gce_shielded_identity: ::core::option::Option<GceShieldedIdentity>,
    /// Optional. A collection of fields that modify the token output.
    #[prost(message, optional, tag = "7")]
    pub options: ::core::option::Option<
        verify_confidential_space_request::ConfidentialSpaceOptions,
    >,
    /// Optional. An optional Nvidia attestation report, used to populate hardware
    /// rooted claims for Nvidia devices.
    #[prost(message, optional, tag = "8")]
    pub nvidia_attestation: ::core::option::Option<NvidiaAttestation>,
    /// Required. A tee attestation report, used to populate hardware rooted
    /// claims.
    #[prost(oneof = "verify_confidential_space_request::TeeAttestation", tags = "3, 4")]
    pub tee_attestation: ::core::option::Option<
        verify_confidential_space_request::TeeAttestation,
    >,
}
/// Nested message and enum types in `VerifyConfidentialSpaceRequest`.
pub mod verify_confidential_space_request {
    /// Token options for Confidential Space attestation.
    #[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
    pub struct ConfidentialSpaceOptions {
        /// Optional. Optional string to issue the token with a custom audience
        /// claim. Required if custom nonces are specified.
        #[prost(string, tag = "1")]
        pub audience: ::prost::alloc::string::String,
        /// Optional. Optional specification for token claims profile.
        #[prost(enumeration = "super::TokenProfile", tag = "2")]
        pub token_profile: i32,
        /// Optional. Optional parameter to place one or more nonces in the eat_nonce
        /// claim in the output token. The minimum size for JSON-encoded EATs is 10
        /// bytes and the maximum size is 74 bytes.
        #[prost(string, repeated, tag = "3")]
        pub nonce: ::prost::alloc::vec::Vec<::prost::alloc::string::String>,
        /// Optional. Optional specification for how to sign the attestation token.
        /// Defaults to SIGNATURE_TYPE_OIDC if unspecified.
        #[prost(enumeration = "super::SignatureType", tag = "4")]
        pub signature_type: i32,
        /// An optional additional configuration per token type.
        #[prost(oneof = "confidential_space_options::TokenProfileOptions", tags = "5")]
        pub token_profile_options: ::core::option::Option<
            confidential_space_options::TokenProfileOptions,
        >,
    }
    /// Nested message and enum types in `ConfidentialSpaceOptions`.
    pub mod confidential_space_options {
        /// An optional additional configuration per token type.
        #[derive(Clone, PartialEq, Eq, Hash, ::prost::Oneof)]
        pub enum TokenProfileOptions {
            /// Optional. Options for the AWS token type.
            #[prost(message, tag = "5")]
            AwsPrincipalTagsOptions(super::super::AwsPrincipalTagsOptions),
        }
    }
    /// Required. A tee attestation report, used to populate hardware rooted
    /// claims.
    #[derive(Clone, PartialEq, ::prost::Oneof)]
    pub enum TeeAttestation {
        /// Input only. A TDX with CCEL and RTMR Attestation Quote.
        #[prost(message, tag = "3")]
        TdCcel(super::TdxCcelAttestation),
        /// Input only. The TPM-specific data provided by the attesting platform,
        /// used to populate any of the claims regarding platform state.
        #[prost(message, tag = "4")]
        TpmAttestation(super::TpmAttestation),
    }
}
/// GceShieldedIdentity contains information about a Compute Engine instance.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct GceShieldedIdentity {
    /// Optional. DER-encoded X.509 certificate of the Attestation Key (otherwise
    /// known as an AK or a TPM restricted signing key) used to generate the
    /// quotes.
    #[prost(bytes = "vec", tag = "1")]
    pub ak_cert: ::prost::alloc::vec::Vec<u8>,
    /// Optional. List of DER-encoded X.509 certificates which, together with the
    /// ak_cert, chain back to a trusted Root Certificate.
    #[prost(bytes = "vec", repeated, tag = "2")]
    pub ak_cert_chain: ::prost::alloc::vec::Vec<::prost::alloc::vec::Vec<u8>>,
}
/// VerifyConfidentialSpaceResponse is returned once a Confidential Space
/// attestation has been successfully verified, containing a signed token.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct VerifyConfidentialSpaceResponse {
    /// Output only. The attestation token issued by this service. It contains
    /// specific platform claims based on the contents of the provided attestation.
    #[prost(string, tag = "1")]
    pub attestation_token: ::prost::alloc::string::String,
    /// Output only. A list of messages that carry the partial error details
    /// related to VerifyConfidentialSpace. This field is populated by errors
    /// during container image signature verification, which may reflect problems
    /// in the provided image signatures. This does not block the issuing of an
    /// attestation token, but the token will not contain claims for the failed
    /// image signatures.
    #[prost(message, repeated, tag = "2")]
    pub partial_errors: ::prost::alloc::vec::Vec<super::super::super::rpc::Status>,
}
/// A request for an attestation token, providing all the necessary information
/// needed for this service to verify Confidential GKE platform state of the
/// requestor.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct VerifyConfidentialGkeRequest {
    /// Required. The name of the Challenge whose nonce was used to generate the
    /// attestation, in the format projects/*/locations/*/challenges/\*. The
    /// provided Challenge will be consumed, and cannot be used again.
    #[prost(string, tag = "1")]
    pub challenge: ::prost::alloc::string::String,
    /// Optional. A collection of fields that modify the token output.
    #[prost(message, optional, tag = "3")]
    pub options: ::core::option::Option<
        verify_confidential_gke_request::ConfidentialGkeOptions,
    >,
    /// Required. A tee attestation report, used to populate hardware rooted
    /// claims.
    #[prost(oneof = "verify_confidential_gke_request::TeeAttestation", tags = "2")]
    pub tee_attestation: ::core::option::Option<
        verify_confidential_gke_request::TeeAttestation,
    >,
}
/// Nested message and enum types in `VerifyConfidentialGkeRequest`.
pub mod verify_confidential_gke_request {
    /// Token options for Confidential GKE attestation.
    #[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
    pub struct ConfidentialGkeOptions {
        /// Optional. Optional string to issue the token with a custom audience
        /// claim. Required if custom nonces are specified.
        #[prost(string, tag = "1")]
        pub audience: ::prost::alloc::string::String,
        /// Optional. Optional parameter to place one or more nonces in the eat_nonce
        /// claim in the output token. The minimum size for JSON-encoded EATs is 10
        /// bytes and the maximum size is 74 bytes.
        #[prost(string, repeated, tag = "3")]
        pub nonce: ::prost::alloc::vec::Vec<::prost::alloc::string::String>,
        /// Optional. Optional specification for how to sign the attestation token.
        /// Defaults to SIGNATURE_TYPE_OIDC if unspecified.
        #[prost(enumeration = "super::SignatureType", tag = "4")]
        pub signature_type: i32,
    }
    /// Required. A tee attestation report, used to populate hardware rooted
    /// claims.
    #[derive(Clone, PartialEq, ::prost::Oneof)]
    pub enum TeeAttestation {
        /// The TPM-specific data provided by the attesting platform, used to
        /// populate any of the claims regarding platform state.
        #[prost(message, tag = "2")]
        TpmAttestation(super::TpmAttestation),
    }
}
/// VerifyConfidentialGkeResponse response is returened once a Confidential GKE
/// attestation has been successfully verified, containing a signed OIDC token.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct VerifyConfidentialGkeResponse {
    /// Output only. The attestation token issued by this service for Confidential
    /// GKE. It contains specific platform claims based on the contents of the
    /// provided attestation.
    #[prost(string, tag = "1")]
    pub attestation_token: ::prost::alloc::string::String,
}
/// SigningAlgorithm enumerates all the supported signing algorithms.
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord, ::prost::Enumeration)]
#[repr(i32)]
pub enum SigningAlgorithm {
    /// Unspecified signing algorithm.
    Unspecified = 0,
    /// RSASSA-PSS with a SHA256 digest.
    RsassaPssSha256 = 1,
    /// RSASSA-PKCS1 v1.5 with a SHA256 digest.
    RsassaPkcs1v15Sha256 = 2,
    /// ECDSA on the P-256 Curve with a SHA256 digest.
    EcdsaP256Sha256 = 3,
}
impl SigningAlgorithm {
    /// String value of the enum field names used in the ProtoBuf definition.
    ///
    /// The values are not transformed in any way and thus are considered stable
    /// (if the ProtoBuf definition does not change) and safe for programmatic use.
    pub fn as_str_name(&self) -> &'static str {
        match self {
            Self::Unspecified => "SIGNING_ALGORITHM_UNSPECIFIED",
            Self::RsassaPssSha256 => "RSASSA_PSS_SHA256",
            Self::RsassaPkcs1v15Sha256 => "RSASSA_PKCS1V15_SHA256",
            Self::EcdsaP256Sha256 => "ECDSA_P256_SHA256",
        }
    }
    /// Creates an enum from field names used in the ProtoBuf definition.
    pub fn from_str_name(value: &str) -> ::core::option::Option<Self> {
        match value {
            "SIGNING_ALGORITHM_UNSPECIFIED" => Some(Self::Unspecified),
            "RSASSA_PSS_SHA256" => Some(Self::RsassaPssSha256),
            "RSASSA_PKCS1V15_SHA256" => Some(Self::RsassaPkcs1v15Sha256),
            "ECDSA_P256_SHA256" => Some(Self::EcdsaP256Sha256),
            _ => None,
        }
    }
}
/// Token type enum contains the different types of token responses Confidential
/// Space supports
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord, ::prost::Enumeration)]
#[repr(i32)]
pub enum TokenType {
    /// Unspecified token type
    Unspecified = 0,
    /// OpenID Connect (OIDC) token type
    Oidc = 1,
    /// Public Key Infrastructure (PKI) token type
    Pki = 2,
    /// Limited claim token type for AWS integration
    LimitedAws = 3,
    /// Principal-tag-based token for AWS integration
    AwsPrincipaltags = 4,
}
impl TokenType {
    /// String value of the enum field names used in the ProtoBuf definition.
    ///
    /// The values are not transformed in any way and thus are considered stable
    /// (if the ProtoBuf definition does not change) and safe for programmatic use.
    pub fn as_str_name(&self) -> &'static str {
        match self {
            Self::Unspecified => "TOKEN_TYPE_UNSPECIFIED",
            Self::Oidc => "TOKEN_TYPE_OIDC",
            Self::Pki => "TOKEN_TYPE_PKI",
            Self::LimitedAws => "TOKEN_TYPE_LIMITED_AWS",
            Self::AwsPrincipaltags => "TOKEN_TYPE_AWS_PRINCIPALTAGS",
        }
    }
    /// Creates an enum from field names used in the ProtoBuf definition.
    pub fn from_str_name(value: &str) -> ::core::option::Option<Self> {
        match value {
            "TOKEN_TYPE_UNSPECIFIED" => Some(Self::Unspecified),
            "TOKEN_TYPE_OIDC" => Some(Self::Oidc),
            "TOKEN_TYPE_PKI" => Some(Self::Pki),
            "TOKEN_TYPE_LIMITED_AWS" => Some(Self::LimitedAws),
            "TOKEN_TYPE_AWS_PRINCIPALTAGS" => Some(Self::AwsPrincipaltags),
            _ => None,
        }
    }
}
/// SignatureType enumerates supported signature types for attestation tokens.
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord, ::prost::Enumeration)]
#[repr(i32)]
pub enum SignatureType {
    /// Unspecified signature type.
    Unspecified = 0,
    /// Google OIDC signature.
    Oidc = 1,
    /// Public Key Infrastructure (PKI) signature.
    Pki = 2,
}
impl SignatureType {
    /// String value of the enum field names used in the ProtoBuf definition.
    ///
    /// The values are not transformed in any way and thus are considered stable
    /// (if the ProtoBuf definition does not change) and safe for programmatic use.
    pub fn as_str_name(&self) -> &'static str {
        match self {
            Self::Unspecified => "SIGNATURE_TYPE_UNSPECIFIED",
            Self::Oidc => "SIGNATURE_TYPE_OIDC",
            Self::Pki => "SIGNATURE_TYPE_PKI",
        }
    }
    /// Creates an enum from field names used in the ProtoBuf definition.
    pub fn from_str_name(value: &str) -> ::core::option::Option<Self> {
        match value {
            "SIGNATURE_TYPE_UNSPECIFIED" => Some(Self::Unspecified),
            "SIGNATURE_TYPE_OIDC" => Some(Self::Oidc),
            "SIGNATURE_TYPE_PKI" => Some(Self::Pki),
            _ => None,
        }
    }
}
/// TokenProfile enumerates the supported token claims profiles.
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord, ::prost::Enumeration)]
#[repr(i32)]
pub enum TokenProfile {
    /// Unspecified token profile.
    Unspecified = 0,
    /// EAT claims.
    DefaultEat = 1,
    /// AWS Principal Tags claims.
    Aws = 2,
}
impl TokenProfile {
    /// String value of the enum field names used in the ProtoBuf definition.
    ///
    /// The values are not transformed in any way and thus are considered stable
    /// (if the ProtoBuf definition does not change) and safe for programmatic use.
    pub fn as_str_name(&self) -> &'static str {
        match self {
            Self::Unspecified => "TOKEN_PROFILE_UNSPECIFIED",
            Self::DefaultEat => "TOKEN_PROFILE_DEFAULT_EAT",
            Self::Aws => "TOKEN_PROFILE_AWS",
        }
    }
    /// Creates an enum from field names used in the ProtoBuf definition.
    pub fn from_str_name(value: &str) -> ::core::option::Option<Self> {
        match value {
            "TOKEN_PROFILE_UNSPECIFIED" => Some(Self::Unspecified),
            "TOKEN_PROFILE_DEFAULT_EAT" => Some(Self::DefaultEat),
            "TOKEN_PROFILE_AWS" => Some(Self::Aws),
            _ => None,
        }
    }
}
/// Generated client implementations.
pub mod confidential_computing_client {
    #![allow(
        unused_variables,
        dead_code,
        missing_docs,
        clippy::wildcard_imports,
        clippy::let_unit_value,
    )]
    use tonic::codegen::*;
    use tonic::codegen::http::Uri;
    /// Service describing handlers for resources
    #[derive(Debug, Clone)]
    pub struct ConfidentialComputingClient<T> {
        inner: tonic::client::Grpc<T>,
    }
    impl ConfidentialComputingClient<tonic::transport::Channel> {
        /// Attempt to create a new client by connecting to a given endpoint.
        pub async fn connect<D>(dst: D) -> Result<Self, tonic::transport::Error>
        where
            D: TryInto<tonic::transport::Endpoint>,
            D::Error: Into<StdError>,
        {
            let conn = tonic::transport::Endpoint::new(dst)?.connect().await?;
            Ok(Self::new(conn))
        }
    }
    impl<T> ConfidentialComputingClient<T>
    where
        T: tonic::client::GrpcService<tonic::body::Body>,
        T::Error: Into<StdError>,
        T::ResponseBody: Body<Data = Bytes> + std::marker::Send + 'static,
        <T::ResponseBody as Body>::Error: Into<StdError> + std::marker::Send,
    {
        pub fn new(inner: T) -> Self {
            let inner = tonic::client::Grpc::new(inner);
            Self { inner }
        }
        pub fn with_origin(inner: T, origin: Uri) -> Self {
            let inner = tonic::client::Grpc::with_origin(inner, origin);
            Self { inner }
        }
        pub fn with_interceptor<F>(
            inner: T,
            interceptor: F,
        ) -> ConfidentialComputingClient<InterceptedService<T, F>>
        where
            F: tonic::service::Interceptor,
            T::ResponseBody: Default,
            T: tonic::codegen::Service<
                http::Request<tonic::body::Body>,
                Response = http::Response<
                    <T as tonic::client::GrpcService<tonic::body::Body>>::ResponseBody,
                >,
            >,
            <T as tonic::codegen::Service<
                http::Request<tonic::body::Body>,
            >>::Error: Into<StdError> + std::marker::Send + std::marker::Sync,
        {
            ConfidentialComputingClient::new(InterceptedService::new(inner, interceptor))
        }
        /// Compress requests with the given encoding.
        ///
        /// This requires the server to support it otherwise it might respond with an
        /// error.
        #[must_use]
        pub fn send_compressed(mut self, encoding: CompressionEncoding) -> Self {
            self.inner = self.inner.send_compressed(encoding);
            self
        }
        /// Enable decompressing responses.
        #[must_use]
        pub fn accept_compressed(mut self, encoding: CompressionEncoding) -> Self {
            self.inner = self.inner.accept_compressed(encoding);
            self
        }
        /// Limits the maximum size of a decoded message.
        ///
        /// Default: `4MB`
        #[must_use]
        pub fn max_decoding_message_size(mut self, limit: usize) -> Self {
            self.inner = self.inner.max_decoding_message_size(limit);
            self
        }
        /// Limits the maximum size of an encoded message.
        ///
        /// Default: `usize::MAX`
        #[must_use]
        pub fn max_encoding_message_size(mut self, limit: usize) -> Self {
            self.inner = self.inner.max_encoding_message_size(limit);
            self
        }
        /// Creates a new Challenge in a given project and location.
        pub async fn create_challenge(
            &mut self,
            request: impl tonic::IntoRequest<super::CreateChallengeRequest>,
        ) -> std::result::Result<tonic::Response<super::Challenge>, tonic::Status> {
            self.inner
                .ready()
                .await
                .map_err(|e| {
                    tonic::Status::unknown(
                        format!("Service was not ready: {}", e.into()),
                    )
                })?;
            let codec = tonic_prost::ProstCodec::default();
            let path = http::uri::PathAndQuery::from_static(
                "/google.cloud.confidentialcomputing.v1.ConfidentialComputing/CreateChallenge",
            );
            let mut req = request.into_request();
            req.extensions_mut()
                .insert(
                    GrpcMethod::new(
                        "google.cloud.confidentialcomputing.v1.ConfidentialComputing",
                        "CreateChallenge",
                    ),
                );
            self.inner.unary(req, path, codec).await
        }
        /// Verifies the provided attestation info, returning a signed attestation
        /// token.
        pub async fn verify_attestation(
            &mut self,
            request: impl tonic::IntoRequest<super::VerifyAttestationRequest>,
        ) -> std::result::Result<
            tonic::Response<super::VerifyAttestationResponse>,
            tonic::Status,
        > {
            self.inner
                .ready()
                .await
                .map_err(|e| {
                    tonic::Status::unknown(
                        format!("Service was not ready: {}", e.into()),
                    )
                })?;
            let codec = tonic_prost::ProstCodec::default();
            let path = http::uri::PathAndQuery::from_static(
                "/google.cloud.confidentialcomputing.v1.ConfidentialComputing/VerifyAttestation",
            );
            let mut req = request.into_request();
            req.extensions_mut()
                .insert(
                    GrpcMethod::new(
                        "google.cloud.confidentialcomputing.v1.ConfidentialComputing",
                        "VerifyAttestation",
                    ),
                );
            self.inner.unary(req, path, codec).await
        }
        /// Verifies whether the provided attestation info is valid, returning a signed
        /// attestation token if so.
        pub async fn verify_confidential_space(
            &mut self,
            request: impl tonic::IntoRequest<super::VerifyConfidentialSpaceRequest>,
        ) -> std::result::Result<
            tonic::Response<super::VerifyConfidentialSpaceResponse>,
            tonic::Status,
        > {
            self.inner
                .ready()
                .await
                .map_err(|e| {
                    tonic::Status::unknown(
                        format!("Service was not ready: {}", e.into()),
                    )
                })?;
            let codec = tonic_prost::ProstCodec::default();
            let path = http::uri::PathAndQuery::from_static(
                "/google.cloud.confidentialcomputing.v1.ConfidentialComputing/VerifyConfidentialSpace",
            );
            let mut req = request.into_request();
            req.extensions_mut()
                .insert(
                    GrpcMethod::new(
                        "google.cloud.confidentialcomputing.v1.ConfidentialComputing",
                        "VerifyConfidentialSpace",
                    ),
                );
            self.inner.unary(req, path, codec).await
        }
        /// Verifies the provided Confidential GKE attestation info, returning a signed
        /// OIDC token.
        pub async fn verify_confidential_gke(
            &mut self,
            request: impl tonic::IntoRequest<super::VerifyConfidentialGkeRequest>,
        ) -> std::result::Result<
            tonic::Response<super::VerifyConfidentialGkeResponse>,
            tonic::Status,
        > {
            self.inner
                .ready()
                .await
                .map_err(|e| {
                    tonic::Status::unknown(
                        format!("Service was not ready: {}", e.into()),
                    )
                })?;
            let codec = tonic_prost::ProstCodec::default();
            let path = http::uri::PathAndQuery::from_static(
                "/google.cloud.confidentialcomputing.v1.ConfidentialComputing/VerifyConfidentialGke",
            );
            let mut req = request.into_request();
            req.extensions_mut()
                .insert(
                    GrpcMethod::new(
                        "google.cloud.confidentialcomputing.v1.ConfidentialComputing",
                        "VerifyConfidentialGke",
                    ),
                );
            self.inner.unary(req, path, codec).await
        }
    }
}
