@kungfu-tech/kfd 1.0.0-alpha.1 → 1.0.0-alpha.12

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -0,0 +1,332 @@
1
+ {
2
+ "$schema": "https://json-schema.org/draft/2020-12/schema",
3
+ "$id": "https://kfd.libkungfu.dev/schemas/kfd-2/release-claims.schema.json",
4
+ "title": "KFD-2 release claims",
5
+ "type": "object",
6
+ "required": [
7
+ "schemaVersion",
8
+ "contract",
9
+ "standard",
10
+ "product",
11
+ "release",
12
+ "claims"
13
+ ],
14
+ "properties": {
15
+ "schemaVersion": {
16
+ "const": 1
17
+ },
18
+ "contract": {
19
+ "const": "kfd-2-release-claims"
20
+ },
21
+ "standard": {
22
+ "const": "kfd-2"
23
+ },
24
+ "product": {
25
+ "$ref": "#/$defs/product"
26
+ },
27
+ "release": {
28
+ "$ref": "#/$defs/release"
29
+ },
30
+ "claims": {
31
+ "type": "array",
32
+ "minItems": 1,
33
+ "items": {
34
+ "$ref": "#/$defs/claim"
35
+ }
36
+ },
37
+ "schemaEvolution": {
38
+ "$ref": "#/$defs/schemaEvolution"
39
+ }
40
+ },
41
+ "additionalProperties": true,
42
+ "$defs": {
43
+ "product": {
44
+ "type": "object",
45
+ "required": [
46
+ "name"
47
+ ],
48
+ "properties": {
49
+ "name": {
50
+ "type": "string",
51
+ "minLength": 1
52
+ },
53
+ "repository": {
54
+ "type": "string",
55
+ "minLength": 1
56
+ },
57
+ "package": {
58
+ "type": "string",
59
+ "minLength": 1
60
+ }
61
+ },
62
+ "additionalProperties": true
63
+ },
64
+ "release": {
65
+ "type": "object",
66
+ "required": [
67
+ "version",
68
+ "channel"
69
+ ],
70
+ "properties": {
71
+ "version": {
72
+ "type": "string",
73
+ "minLength": 1
74
+ },
75
+ "channel": {
76
+ "type": "string",
77
+ "minLength": 1
78
+ },
79
+ "tag": {
80
+ "type": "string",
81
+ "minLength": 1
82
+ },
83
+ "sourceSha": {
84
+ "type": "string",
85
+ "minLength": 1
86
+ }
87
+ },
88
+ "additionalProperties": true
89
+ },
90
+ "claim": {
91
+ "type": "object",
92
+ "required": [
93
+ "id",
94
+ "statement",
95
+ "source",
96
+ "evidence",
97
+ "auditBoundary",
98
+ "responsibility",
99
+ "status"
100
+ ],
101
+ "properties": {
102
+ "id": {
103
+ "type": "string",
104
+ "pattern": "^[a-z0-9]+(-[a-z0-9]+)*$"
105
+ },
106
+ "statement": {
107
+ "type": "string",
108
+ "minLength": 1
109
+ },
110
+ "category": {
111
+ "enum": [
112
+ "metadata",
113
+ "schema",
114
+ "package-export",
115
+ "artifact",
116
+ "site",
117
+ "release",
118
+ "kfd-1",
119
+ "kfd-2",
120
+ "kfd-3",
121
+ "other"
122
+ ]
123
+ },
124
+ "source": {
125
+ "$ref": "#/$defs/artifactPointer"
126
+ },
127
+ "evidence": {
128
+ "type": "array",
129
+ "minItems": 1,
130
+ "items": {
131
+ "$ref": "#/$defs/evidenceBinding"
132
+ }
133
+ },
134
+ "verification": {
135
+ "$ref": "#/$defs/verification"
136
+ },
137
+ "auditBoundary": {
138
+ "$ref": "#/$defs/auditBoundary"
139
+ },
140
+ "residualRisk": {
141
+ "type": "array",
142
+ "items": {
143
+ "type": "string",
144
+ "minLength": 1
145
+ }
146
+ },
147
+ "responsibility": {
148
+ "$ref": "#/$defs/responsibilityState"
149
+ },
150
+ "status": {
151
+ "enum": [
152
+ "declared",
153
+ "audited",
154
+ "enforced",
155
+ "not-applicable"
156
+ ]
157
+ }
158
+ },
159
+ "additionalProperties": true
160
+ },
161
+ "artifactPointer": {
162
+ "type": "object",
163
+ "required": [
164
+ "kind"
165
+ ],
166
+ "properties": {
167
+ "kind": {
168
+ "enum": [
169
+ "file",
170
+ "schema",
171
+ "package-export",
172
+ "artifact",
173
+ "command",
174
+ "witness",
175
+ "passport",
176
+ "url",
177
+ "other"
178
+ ]
179
+ },
180
+ "path": {
181
+ "type": "string",
182
+ "minLength": 1
183
+ },
184
+ "specifier": {
185
+ "type": "string",
186
+ "minLength": 1
187
+ },
188
+ "url": {
189
+ "type": "string",
190
+ "format": "uri"
191
+ },
192
+ "schemaId": {
193
+ "type": "string",
194
+ "format": "uri"
195
+ },
196
+ "sha256": {
197
+ "type": "string",
198
+ "pattern": "^[0-9a-f]{64}$"
199
+ },
200
+ "digest": {
201
+ "type": "string",
202
+ "minLength": 1
203
+ }
204
+ },
205
+ "additionalProperties": true
206
+ },
207
+ "evidenceBinding": {
208
+ "type": "object",
209
+ "required": [
210
+ "type"
211
+ ],
212
+ "properties": {
213
+ "type": {
214
+ "enum": [
215
+ "file",
216
+ "schema",
217
+ "package-export",
218
+ "artifact",
219
+ "hash",
220
+ "command-result",
221
+ "witness",
222
+ "passport-section",
223
+ "url",
224
+ "other"
225
+ ]
226
+ },
227
+ "pointer": {
228
+ "$ref": "#/$defs/artifactPointer"
229
+ },
230
+ "description": {
231
+ "type": "string",
232
+ "minLength": 1
233
+ }
234
+ },
235
+ "additionalProperties": true
236
+ },
237
+ "verification": {
238
+ "type": "object",
239
+ "properties": {
240
+ "resultRef": {
241
+ "$ref": "#/$defs/artifactPointer"
242
+ },
243
+ "command": {
244
+ "type": "string",
245
+ "minLength": 1
246
+ },
247
+ "expectedResult": {
248
+ "enum": [
249
+ "pass",
250
+ "fail",
251
+ "warning",
252
+ "unverifiable"
253
+ ]
254
+ }
255
+ },
256
+ "additionalProperties": true
257
+ },
258
+ "auditBoundary": {
259
+ "type": "object",
260
+ "required": [
261
+ "scope",
262
+ "enumerability"
263
+ ],
264
+ "properties": {
265
+ "scope": {
266
+ "type": "string",
267
+ "minLength": 1
268
+ },
269
+ "enumerability": {
270
+ "enum": [
271
+ "closed-world",
272
+ "declared-open",
273
+ "sampled",
274
+ "manual"
275
+ ]
276
+ },
277
+ "exclusions": {
278
+ "type": "array",
279
+ "items": {
280
+ "type": "string",
281
+ "minLength": 1
282
+ }
283
+ }
284
+ },
285
+ "additionalProperties": true
286
+ },
287
+ "responsibilityState": {
288
+ "type": "object",
289
+ "required": [
290
+ "sourceOwner",
291
+ "verificationOwner",
292
+ "releaseDecisionOwner"
293
+ ],
294
+ "properties": {
295
+ "sourceOwner": {
296
+ "type": "string",
297
+ "minLength": 1
298
+ },
299
+ "verificationOwner": {
300
+ "type": "string",
301
+ "minLength": 1
302
+ },
303
+ "releaseDecisionOwner": {
304
+ "type": "string",
305
+ "minLength": 1
306
+ },
307
+ "escalation": {
308
+ "type": "string",
309
+ "minLength": 1
310
+ }
311
+ },
312
+ "additionalProperties": true
313
+ },
314
+ "schemaEvolution": {
315
+ "type": "object",
316
+ "required": [
317
+ "interfaceVersion",
318
+ "compatibilityRule"
319
+ ],
320
+ "properties": {
321
+ "interfaceVersion": {
322
+ "const": 1
323
+ },
324
+ "compatibilityRule": {
325
+ "type": "string",
326
+ "minLength": 1
327
+ }
328
+ },
329
+ "additionalProperties": true
330
+ }
331
+ }
332
+ }
@@ -0,0 +1,278 @@
1
+ {
2
+ "$schema": "https://json-schema.org/draft/2020-12/schema",
3
+ "$id": "https://kfd.libkungfu.dev/schemas/kfd-2/release-trust-passport.schema.json",
4
+ "title": "KFD-2 release trust passport",
5
+ "type": "object",
6
+ "required": [
7
+ "schemaVersion",
8
+ "contract",
9
+ "standard",
10
+ "product",
11
+ "release",
12
+ "releaseClaims",
13
+ "result",
14
+ "claims"
15
+ ],
16
+ "properties": {
17
+ "schemaVersion": {
18
+ "const": 1
19
+ },
20
+ "contract": {
21
+ "const": "kfd-2-release-trust-passport"
22
+ },
23
+ "standard": {
24
+ "const": "kfd-2"
25
+ },
26
+ "product": {
27
+ "$ref": "#/$defs/product"
28
+ },
29
+ "release": {
30
+ "$ref": "#/$defs/release"
31
+ },
32
+ "releaseClaims": {
33
+ "type": "object",
34
+ "required": [
35
+ "schemaId",
36
+ "digest"
37
+ ],
38
+ "properties": {
39
+ "schemaId": {
40
+ "const": "https://kfd.libkungfu.dev/schemas/kfd-2/release-claims.schema.json"
41
+ },
42
+ "path": {
43
+ "type": "string",
44
+ "minLength": 1
45
+ },
46
+ "digest": {
47
+ "type": "string",
48
+ "minLength": 1
49
+ }
50
+ },
51
+ "additionalProperties": true
52
+ },
53
+ "result": {
54
+ "enum": [
55
+ "pass",
56
+ "fail",
57
+ "warning",
58
+ "unverifiable"
59
+ ]
60
+ },
61
+ "claims": {
62
+ "type": "array",
63
+ "items": {
64
+ "$ref": "#/$defs/claimResult"
65
+ }
66
+ },
67
+ "unboundClaims": {
68
+ "type": "array",
69
+ "items": {
70
+ "type": "string",
71
+ "minLength": 1
72
+ }
73
+ },
74
+ "downgradeReasons": {
75
+ "type": "array",
76
+ "items": {
77
+ "type": "string",
78
+ "minLength": 1
79
+ }
80
+ },
81
+ "responsibility": {
82
+ "$ref": "#/$defs/responsibilityState"
83
+ },
84
+ "schemaEvolution": {
85
+ "$ref": "#/$defs/schemaEvolution"
86
+ }
87
+ },
88
+ "additionalProperties": true,
89
+ "$defs": {
90
+ "product": {
91
+ "type": "object",
92
+ "required": [
93
+ "name"
94
+ ],
95
+ "properties": {
96
+ "name": {
97
+ "type": "string",
98
+ "minLength": 1
99
+ },
100
+ "repository": {
101
+ "type": "string",
102
+ "minLength": 1
103
+ },
104
+ "package": {
105
+ "type": "string",
106
+ "minLength": 1
107
+ }
108
+ },
109
+ "additionalProperties": true
110
+ },
111
+ "release": {
112
+ "type": "object",
113
+ "required": [
114
+ "version",
115
+ "channel"
116
+ ],
117
+ "properties": {
118
+ "version": {
119
+ "type": "string",
120
+ "minLength": 1
121
+ },
122
+ "channel": {
123
+ "type": "string",
124
+ "minLength": 1
125
+ },
126
+ "tag": {
127
+ "type": "string",
128
+ "minLength": 1
129
+ },
130
+ "sourceSha": {
131
+ "type": "string",
132
+ "minLength": 1
133
+ }
134
+ },
135
+ "additionalProperties": true
136
+ },
137
+ "claimResult": {
138
+ "type": "object",
139
+ "required": [
140
+ "id",
141
+ "result",
142
+ "evidence",
143
+ "auditBoundary",
144
+ "responsibility"
145
+ ],
146
+ "properties": {
147
+ "id": {
148
+ "type": "string",
149
+ "pattern": "^[a-z0-9]+(-[a-z0-9]+)*$"
150
+ },
151
+ "result": {
152
+ "enum": [
153
+ "pass",
154
+ "fail",
155
+ "warning",
156
+ "unverifiable"
157
+ ]
158
+ },
159
+ "evidence": {
160
+ "type": "array",
161
+ "items": {
162
+ "$ref": "#/$defs/evidenceResult"
163
+ }
164
+ },
165
+ "auditBoundary": {
166
+ "$ref": "#/$defs/auditBoundary"
167
+ },
168
+ "responsibility": {
169
+ "$ref": "#/$defs/responsibilityState"
170
+ },
171
+ "residualRisk": {
172
+ "type": "array",
173
+ "items": {
174
+ "type": "string",
175
+ "minLength": 1
176
+ }
177
+ }
178
+ },
179
+ "additionalProperties": true
180
+ },
181
+ "evidenceResult": {
182
+ "type": "object",
183
+ "required": [
184
+ "type",
185
+ "result"
186
+ ],
187
+ "properties": {
188
+ "type": {
189
+ "type": "string",
190
+ "minLength": 1
191
+ },
192
+ "result": {
193
+ "enum": [
194
+ "pass",
195
+ "fail",
196
+ "warning",
197
+ "unverifiable"
198
+ ]
199
+ },
200
+ "digest": {
201
+ "type": "string",
202
+ "minLength": 1
203
+ },
204
+ "description": {
205
+ "type": "string",
206
+ "minLength": 1
207
+ }
208
+ },
209
+ "additionalProperties": true
210
+ },
211
+ "auditBoundary": {
212
+ "type": "object",
213
+ "required": [
214
+ "scope",
215
+ "enumerability"
216
+ ],
217
+ "properties": {
218
+ "scope": {
219
+ "type": "string",
220
+ "minLength": 1
221
+ },
222
+ "enumerability": {
223
+ "enum": [
224
+ "closed-world",
225
+ "declared-open",
226
+ "sampled",
227
+ "manual"
228
+ ]
229
+ }
230
+ },
231
+ "additionalProperties": true
232
+ },
233
+ "responsibilityState": {
234
+ "type": "object",
235
+ "required": [
236
+ "sourceOwner",
237
+ "verificationOwner",
238
+ "releaseDecisionOwner"
239
+ ],
240
+ "properties": {
241
+ "sourceOwner": {
242
+ "type": "string",
243
+ "minLength": 1
244
+ },
245
+ "verificationOwner": {
246
+ "type": "string",
247
+ "minLength": 1
248
+ },
249
+ "releaseDecisionOwner": {
250
+ "type": "string",
251
+ "minLength": 1
252
+ },
253
+ "escalation": {
254
+ "type": "string",
255
+ "minLength": 1
256
+ }
257
+ },
258
+ "additionalProperties": true
259
+ },
260
+ "schemaEvolution": {
261
+ "type": "object",
262
+ "required": [
263
+ "interfaceVersion",
264
+ "compatibilityRule"
265
+ ],
266
+ "properties": {
267
+ "interfaceVersion": {
268
+ "const": 1
269
+ },
270
+ "compatibilityRule": {
271
+ "type": "string",
272
+ "minLength": 1
273
+ }
274
+ },
275
+ "additionalProperties": true
276
+ }
277
+ }
278
+ }