@marinjursic/prc-linux-arm64 0.1.0 → 0.2.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/DISCLOSURE +21 -0
- package/README.md +5 -1
- package/bin/catalog/assertions/core-repository.yaml +28 -28
- package/bin/catalog/control-check-bindings.json.gz +0 -0
- package/bin/catalog/control-check-programs.json.gz +0 -0
- package/bin/catalog/control-contracts.json.gz +0 -0
- package/bin/catalog/control-id-registry.json.gz +0 -0
- package/bin/fixtures/benchmarks/core-native/suite-comprehensive.yaml +10 -1
- package/bin/fixtures/benchmarks/core-native/suite.yaml +13 -2
- package/bin/packs/core-foundation.yaml +4 -4
- package/bin/packs/core-native.yaml +10 -10
- package/bin/prc +0 -0
- package/bin/schemas/adapter-execution-v0.3.schema.json +145 -0
- package/bin/schemas/authoritative-evidence-bundle.schema.json +38 -0
- package/bin/schemas/authoritative-evidence-set.schema.json +38 -0
- package/bin/schemas/authoritative-evidence-verification.schema.json +54 -0
- package/bin/schemas/automatic-coverage.schema.json +49 -0
- package/bin/schemas/control-check-bindings.schema.json +119 -0
- package/bin/schemas/control-check-evidence-v0.1.schema.json +244 -0
- package/bin/schemas/control-check-evidence.schema.json +244 -0
- package/bin/schemas/control-check-program-catalog.schema.json +160 -0
- package/bin/schemas/control-check-program-definitions.schema.json +139 -0
- package/bin/schemas/control-check-program.schema.json +298 -0
- package/bin/schemas/control-classification-final.schema.json +64 -0
- package/bin/schemas/control-classification-review.schema.json +161 -0
- package/bin/schemas/control-classification-skeptic-review.schema.json +96 -0
- package/bin/schemas/control-classification-strength-review.schema.json +90 -0
- package/bin/schemas/control-contracts.schema.json +101 -12
- package/bin/schemas/control-review-output-v0.2.schema.json +66 -0
- package/bin/schemas/control-review-output.schema.json +22 -3
- package/bin/schemas/evidence-requirements.schema.json +144 -0
- package/bin/schemas/evidence-set-verification.schema.json +65 -0
- package/bin/schemas/provider-capabilities.schema.json +26 -0
- package/bin/schemas/run-result-v0.10.schema.json +5 -5
- package/bin/schemas/run-result-v0.11.schema.json +5 -5
- package/bin/schemas/run-result-v0.12.schema.json +270 -0
- package/bin/schemas/run-result.schema.json +166 -16
- package/bin/schemas/signature-verification.schema.json +8 -1
- package/bin/schemas/signature.schema.json +8 -1
- package/bin/schemas/trust-store.schema.json +8 -1
- package/manifest.json +1144 -5
- package/package.json +8 -3
- package/bin/LICENSE +0 -21
- package/bin/README.md +0 -335
- package/bin/catalog/control-contracts.json +0 -1
- package/bin/catalog/control-id-registry.json +0 -110470
- package/bin/docs/architecture/adapters.md +0 -380
- package/bin/docs/architecture/agent-providers.md +0 -188
- package/bin/docs/architecture/applicability.md +0 -80
- package/bin/docs/architecture/catalog-integrity.md +0 -85
- package/bin/docs/architecture/evidence-and-results.md +0 -154
- package/bin/docs/architecture/execution-plans.md +0 -61
- package/bin/docs/architecture/product-contract.md +0 -76
- package/bin/docs/architecture/publisher-trust.md +0 -68
- package/bin/docs/architecture/remediation-contract.md +0 -113
- package/bin/docs/architecture/trust-model.md +0 -95
- package/bin/docs/assets/hero.svg +0 -37
- package/bin/docs/assets/logo.svg +0 -13
- package/bin/docs/assets/production-readiness-scan-demo-poster.png +0 -0
- package/bin/docs/assets/production-readiness-scan-demo.gif +0 -0
- package/bin/docs/assets/production-readiness-scan-demo.mp4 +0 -0
- package/bin/docs/assets/social-card.png +0 -0
- package/bin/docs/assets/social-card.svg +0 -40
- package/bin/docs/engineering/source-manifest.md +0 -479
- package/bin/docs/guides/ai-assisted-review.md +0 -61
- package/bin/docs/guides/getting-started.md +0 -78
- package/bin/docs/index.md +0 -66
- package/bin/docs/prompts/evidence-challenge.md +0 -26
- package/bin/docs/prompts/full-readiness-review.md +0 -34
- package/bin/docs/prompts/release-diff-review.md +0 -31
- package/bin/docs/records/evidence-record.md +0 -42
- package/bin/docs/records/go-no-go-decision.md +0 -63
- package/bin/docs/records/release-assessment.md +0 -124
- package/bin/docs/records/risk-exception.md +0 -64
- package/bin/docs/references.md +0 -52
- package/bin/docs/scanner/ai-control-review.md +0 -208
- package/bin/docs/scanner/benchmarks.md +0 -122
- package/bin/docs/scanner/cli-contract.md +0 -130
- package/bin/docs/scanner/configuration.md +0 -101
- package/bin/docs/scanner/control-contracts.md +0 -47
- package/bin/docs/scanner/core-repository.md +0 -62
- package/bin/docs/scanner/diff-and-invalidation.md +0 -79
- package/bin/docs/scanner/doctor.md +0 -71
- package/bin/docs/scanner/getting-started.md +0 -355
- package/bin/docs/scanner/go-http-timeouts.md +0 -96
- package/bin/docs/scanner/infrastructure-policy.md +0 -64
- package/bin/docs/scanner/kubernetes-workloads.md +0 -63
- package/bin/docs/scanner/mcp-agent-integration.md +0 -138
- package/bin/docs/scanner/openapi-contracts.md +0 -75
- package/bin/docs/scanner/private-key-armor.md +0 -44
- package/bin/docs/scanner/releases.md +0 -160
- package/bin/docs/scanner/remediation.md +0 -273
- package/bin/docs/scanner/risk-exceptions.md +0 -52
- package/bin/docs/scanner/security-walkthrough.md +0 -236
- package/bin/docs/scanner/state-and-history.md +0 -113
- package/bin/docs/scanner/supply-chain.md +0 -132
- package/bin/docs/scanner/test-discovery.md +0 -60
- package/bin/docs/stylesheets/extra.css +0 -183
|
@@ -0,0 +1,119 @@
|
|
|
1
|
+
{
|
|
2
|
+
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
|
3
|
+
"$id": "https://marinjursic.github.io/production-readiness-checklist/schemas/control-check-bindings.schema.json",
|
|
4
|
+
"title": "Production Readiness Deterministic Control Check Bindings v0.1",
|
|
5
|
+
"type": "object",
|
|
6
|
+
"additionalProperties": false,
|
|
7
|
+
"required": ["schema_version", "generator_id", "registry_version", "registry_sha256", "methodology_sha256", "classification_corpus_sha256", "implementation_registry", "binding_count", "bindings"],
|
|
8
|
+
"properties": {
|
|
9
|
+
"schema_version": {"const": "prc.control-check-bindings/v0.1"},
|
|
10
|
+
"generator_id": {"const": "prc.build-control-check-bindings@0.1"},
|
|
11
|
+
"registry_version": {"type": "string", "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$"},
|
|
12
|
+
"registry_sha256": {"$ref": "#/$defs/digest"},
|
|
13
|
+
"methodology_sha256": {"$ref": "#/$defs/digest"},
|
|
14
|
+
"classification_corpus_sha256": {"$ref": "#/$defs/digest"},
|
|
15
|
+
"implementation_registry": {
|
|
16
|
+
"type": "array", "minItems": 11, "maxItems": 11,
|
|
17
|
+
"items": {"$ref": "#/$defs/implementation"}
|
|
18
|
+
},
|
|
19
|
+
"binding_count": {"type": "integer", "minimum": 1, "maximum": 100000},
|
|
20
|
+
"bindings": {
|
|
21
|
+
"type": "array", "minItems": 1, "maxItems": 100000,
|
|
22
|
+
"items": {"$ref": "#/$defs/binding"}
|
|
23
|
+
}
|
|
24
|
+
},
|
|
25
|
+
"$defs": {
|
|
26
|
+
"digest": {"type": "string", "pattern": "^[0-9a-f]{64}$"},
|
|
27
|
+
"control_id": {"type": "string", "pattern": "^(PRC-[0-9]{2}-[0-9]{3}|USEQ-[A-F0-9]{8})$"},
|
|
28
|
+
"checker_family": {
|
|
29
|
+
"enum": ["inventory_fact", "structured_document", "package_metadata", "ci_policy", "container_iac", "source_ast", "artifact_integrity", "analysis_adapter", "execution_evidence", "environment_evidence", "structured_record"]
|
|
30
|
+
},
|
|
31
|
+
"authority": {"enum": ["repository", "artifact", "executed", "environment", "external_registry", "structured_record"]},
|
|
32
|
+
"implementation": {
|
|
33
|
+
"type": "object", "additionalProperties": false,
|
|
34
|
+
"required": ["checker_family", "implementation_id", "supported_evidence_authorities", "capability_class", "external_provider_registration", "implementation_contract_sha256", "registration_state", "on_unregistered", "external_provider_claimed"],
|
|
35
|
+
"properties": {
|
|
36
|
+
"checker_family": {"$ref": "#/$defs/checker_family"},
|
|
37
|
+
"implementation_id": {"type": "string", "pattern": "^prc\\.check\\.[a-z0-9-]+@[0-9]+\\.[0-9]+$"},
|
|
38
|
+
"supported_evidence_authorities": {"type": "array", "minItems": 1, "uniqueItems": true, "items": {"$ref": "#/$defs/authority"}},
|
|
39
|
+
"capability_class": {"enum": ["read_workspace", "read_workspace_or_external_readonly", "read_workspace_or_environment_readonly", "read_artifact", "executed_evidence", "external_readonly", "structured_record_evidence"]},
|
|
40
|
+
"external_provider_registration": {"const": "required_when_authority_is_environment_or_external_registry"},
|
|
41
|
+
"implementation_contract_sha256": {"$ref": "#/$defs/digest"},
|
|
42
|
+
"registration_state": {"const": "runtime_registration_required"},
|
|
43
|
+
"on_unregistered": {"const": "blocked"},
|
|
44
|
+
"external_provider_claimed": {"const": false}
|
|
45
|
+
}
|
|
46
|
+
},
|
|
47
|
+
"applicability_contract": {
|
|
48
|
+
"type": "object", "additionalProperties": false,
|
|
49
|
+
"required": ["applicable_result", "not_applicable_requires", "unresolved_result"],
|
|
50
|
+
"properties": {
|
|
51
|
+
"applicable_result": {"const": "applicable"},
|
|
52
|
+
"not_applicable_requires": {"const": "authoritative_bounded_absence_proof"},
|
|
53
|
+
"unresolved_result": {"const": "blocked"}
|
|
54
|
+
}
|
|
55
|
+
},
|
|
56
|
+
"result_branch": {
|
|
57
|
+
"type": "object", "additionalProperties": false,
|
|
58
|
+
"required": ["result", "requires_all"],
|
|
59
|
+
"properties": {
|
|
60
|
+
"result": {"enum": ["pass", "fail"]},
|
|
61
|
+
"requires_all": {
|
|
62
|
+
"type": "array", "minItems": 1, "uniqueItems": true,
|
|
63
|
+
"items": {"type": "string", "pattern": "^[a-z0-9_]+$"}
|
|
64
|
+
}
|
|
65
|
+
}
|
|
66
|
+
},
|
|
67
|
+
"blocked_branch": {
|
|
68
|
+
"type": "object", "additionalProperties": false,
|
|
69
|
+
"required": ["result", "when_any"],
|
|
70
|
+
"properties": {
|
|
71
|
+
"result": {"const": "blocked"},
|
|
72
|
+
"when_any": {
|
|
73
|
+
"type": "array", "minItems": 1, "uniqueItems": true,
|
|
74
|
+
"items": {"type": "string", "pattern": "^[a-z0-9_]+$"}
|
|
75
|
+
}
|
|
76
|
+
}
|
|
77
|
+
},
|
|
78
|
+
"result_contract": {
|
|
79
|
+
"type": "object", "additionalProperties": false,
|
|
80
|
+
"required": ["pass", "fail", "blocked"],
|
|
81
|
+
"properties": {
|
|
82
|
+
"pass": {"$ref": "#/$defs/result_branch"},
|
|
83
|
+
"fail": {"$ref": "#/$defs/result_branch"},
|
|
84
|
+
"blocked": {"$ref": "#/$defs/blocked_branch"}
|
|
85
|
+
}
|
|
86
|
+
},
|
|
87
|
+
"clause": {
|
|
88
|
+
"type": "object", "additionalProperties": false,
|
|
89
|
+
"required": ["clause_id", "ordinal", "statement", "checker_family", "evidence_authority", "implementation_id", "implementation_contract_sha256", "implementation_registration", "provider_contract", "external_provider_claimed", "result_contract"],
|
|
90
|
+
"properties": {
|
|
91
|
+
"clause_id": {"$ref": "#/$defs/digest"},
|
|
92
|
+
"ordinal": {"type": "integer", "minimum": 1, "maximum": 50},
|
|
93
|
+
"statement": {"type": "string", "minLength": 1, "maxLength": 2000},
|
|
94
|
+
"checker_family": {"$ref": "#/$defs/checker_family"},
|
|
95
|
+
"evidence_authority": {"$ref": "#/$defs/authority"},
|
|
96
|
+
"implementation_id": {"type": "string", "pattern": "^prc\\.check\\.[a-z0-9-]+@[0-9]+\\.[0-9]+$"},
|
|
97
|
+
"implementation_contract_sha256": {"$ref": "#/$defs/digest"},
|
|
98
|
+
"implementation_registration": {"const": "required_before_execution"},
|
|
99
|
+
"provider_contract": {"const": "required_before_execution"},
|
|
100
|
+
"external_provider_claimed": {"const": false},
|
|
101
|
+
"result_contract": {"$ref": "#/$defs/result_contract"}
|
|
102
|
+
}
|
|
103
|
+
},
|
|
104
|
+
"binding": {
|
|
105
|
+
"type": "object", "additionalProperties": false,
|
|
106
|
+
"required": ["control_id", "revision", "semantic_sha256", "final_row_sha256", "route", "aggregation", "applicability_contract", "clauses"],
|
|
107
|
+
"properties": {
|
|
108
|
+
"control_id": {"$ref": "#/$defs/control_id"},
|
|
109
|
+
"revision": {"type": "integer", "minimum": 1},
|
|
110
|
+
"semantic_sha256": {"$ref": "#/$defs/digest"},
|
|
111
|
+
"final_row_sha256": {"$ref": "#/$defs/digest"},
|
|
112
|
+
"route": {"enum": ["local_static", "artifact_verification", "bounded_execution", "external_readonly_query", "structured_record_validation", "deterministic_composite"]},
|
|
113
|
+
"aggregation": {"const": "all_clauses_pass"},
|
|
114
|
+
"applicability_contract": {"$ref": "#/$defs/applicability_contract"},
|
|
115
|
+
"clauses": {"type": "array", "minItems": 1, "maxItems": 50, "items": {"$ref": "#/$defs/clause"}}
|
|
116
|
+
}
|
|
117
|
+
}
|
|
118
|
+
}
|
|
119
|
+
}
|
|
@@ -0,0 +1,244 @@
|
|
|
1
|
+
{
|
|
2
|
+
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
|
3
|
+
"$id": "https://marinjursic.github.io/production-readiness-checklist/schemas/control-check-evidence-v0.1.schema.json",
|
|
4
|
+
"title": "Normalized authoritative control-check evidence v0.1",
|
|
5
|
+
"type": "object",
|
|
6
|
+
"additionalProperties": false,
|
|
7
|
+
"required": ["schema_version", "evidence_id", "program_sha256", "control_id", "control_revision", "control_semantic_sha256", "clause_id", "clause_sha256", "implementation_contract_sha256", "subject_id", "observed_subjects", "inventory_sha256", "authority", "observed_at", "complete", "applicability", "applicability_proof_contract_sha256", "facts"],
|
|
8
|
+
"properties": {
|
|
9
|
+
"schema_version": {"const": "prc.control-check-evidence/v0.1"},
|
|
10
|
+
"evidence_id": {"$ref": "#/$defs/nonempty_string"},
|
|
11
|
+
"program_sha256": {"$ref": "#/$defs/digest"},
|
|
12
|
+
"control_id": {"$ref": "#/$defs/control_id"},
|
|
13
|
+
"control_revision": {"type": "integer", "minimum": 1},
|
|
14
|
+
"control_semantic_sha256": {"$ref": "#/$defs/digest"},
|
|
15
|
+
"clause_id": {"$ref": "#/$defs/digest"},
|
|
16
|
+
"clause_sha256": {"$ref": "#/$defs/digest"},
|
|
17
|
+
"implementation_contract_sha256": {"$ref": "#/$defs/digest"},
|
|
18
|
+
"subject_id": {"$ref": "#/$defs/nonempty_string"},
|
|
19
|
+
"observed_subjects": {"$ref": "#/$defs/string_set"},
|
|
20
|
+
"inventory_sha256": {"$ref": "#/$defs/digest"},
|
|
21
|
+
"authority": {"$ref": "#/$defs/authority"},
|
|
22
|
+
"observed_at": {"type": "string", "format": "date-time", "maxLength": 64},
|
|
23
|
+
"complete": {"type": "boolean"},
|
|
24
|
+
"contradiction_digests": {"$ref": "#/$defs/digest_set"},
|
|
25
|
+
"applicability": {"enum": ["applicable", "not_applicable", "unknown"]},
|
|
26
|
+
"applicability_proof_contract_sha256": {"$ref": "#/$defs/digest"},
|
|
27
|
+
"applicability_proof": {"$ref": "#/$defs/nonempty_string"},
|
|
28
|
+
"applicability_proof_sha256": {"$ref": "#/$defs/digest"},
|
|
29
|
+
"facts": {
|
|
30
|
+
"type": "object",
|
|
31
|
+
"maxProperties": 512,
|
|
32
|
+
"propertyNames": {"$ref": "#/$defs/fact_id"},
|
|
33
|
+
"additionalProperties": {"$ref": "#/$defs/fact"}
|
|
34
|
+
}
|
|
35
|
+
},
|
|
36
|
+
"allOf": [
|
|
37
|
+
{
|
|
38
|
+
"if": {"properties": {"applicability": {"const": "not_applicable"}}},
|
|
39
|
+
"then": {"required": ["applicability_proof", "applicability_proof_sha256"]},
|
|
40
|
+
"else": {
|
|
41
|
+
"not": {
|
|
42
|
+
"anyOf": [
|
|
43
|
+
{"required": ["applicability_proof"]},
|
|
44
|
+
{"required": ["applicability_proof_sha256"]}
|
|
45
|
+
]
|
|
46
|
+
}
|
|
47
|
+
}
|
|
48
|
+
}
|
|
49
|
+
],
|
|
50
|
+
"$defs": {
|
|
51
|
+
"digest": {"type": "string", "pattern": "^[0-9a-f]{64}$"},
|
|
52
|
+
"control_id": {"type": "string", "pattern": "^(PRC-[0-9]{2}-[0-9]{3}|USEQ-[A-F0-9]{8})$"},
|
|
53
|
+
"fact_id": {"type": "string", "minLength": 1, "maxLength": 128, "pattern": "^[A-Za-z0-9_.-]+$"},
|
|
54
|
+
"nonempty_string": {"type": "string", "minLength": 1, "maxLength": 4096},
|
|
55
|
+
"authority": {"enum": ["repository", "artifact", "executed", "environment", "external_registry", "structured_record"]},
|
|
56
|
+
"string_set": {"type": "array", "maxItems": 1024, "uniqueItems": true, "items": {"$ref": "#/$defs/nonempty_string"}},
|
|
57
|
+
"digest_set": {"type": "array", "maxItems": 1024, "uniqueItems": true, "items": {"$ref": "#/$defs/digest"}},
|
|
58
|
+
"number_map": {
|
|
59
|
+
"type": "object", "maxProperties": 1024,
|
|
60
|
+
"propertyNames": {"$ref": "#/$defs/fact_id"},
|
|
61
|
+
"additionalProperties": {"type": "number"}
|
|
62
|
+
},
|
|
63
|
+
"string_map": {
|
|
64
|
+
"type": "object", "maxProperties": 1024,
|
|
65
|
+
"propertyNames": {"$ref": "#/$defs/fact_id"},
|
|
66
|
+
"additionalProperties": {"type": "string", "maxLength": 4096}
|
|
67
|
+
},
|
|
68
|
+
"nonempty_string_map": {
|
|
69
|
+
"type": "object", "maxProperties": 1024,
|
|
70
|
+
"propertyNames": {"$ref": "#/$defs/fact_id"},
|
|
71
|
+
"additionalProperties": {"$ref": "#/$defs/nonempty_string"}
|
|
72
|
+
},
|
|
73
|
+
"digest_map": {
|
|
74
|
+
"type": "object", "maxProperties": 1024,
|
|
75
|
+
"propertyNames": {"$ref": "#/$defs/fact_id"},
|
|
76
|
+
"additionalProperties": {"$ref": "#/$defs/digest"}
|
|
77
|
+
},
|
|
78
|
+
"boolean_map": {
|
|
79
|
+
"type": "object", "maxProperties": 1024,
|
|
80
|
+
"propertyNames": {"$ref": "#/$defs/fact_id"},
|
|
81
|
+
"additionalProperties": {"type": "boolean"}
|
|
82
|
+
},
|
|
83
|
+
"directed_edge": {
|
|
84
|
+
"type": "object", "additionalProperties": false,
|
|
85
|
+
"required": ["from", "to"],
|
|
86
|
+
"properties": {
|
|
87
|
+
"from": {"$ref": "#/$defs/nonempty_string"},
|
|
88
|
+
"to": {"$ref": "#/$defs/nonempty_string"}
|
|
89
|
+
}
|
|
90
|
+
},
|
|
91
|
+
"time_map": {
|
|
92
|
+
"type": "object", "maxProperties": 1024,
|
|
93
|
+
"propertyNames": {"$ref": "#/$defs/fact_id"},
|
|
94
|
+
"additionalProperties": {"type": "string", "format": "date-time", "maxLength": 64}
|
|
95
|
+
},
|
|
96
|
+
"fact": {
|
|
97
|
+
"oneOf": [
|
|
98
|
+
{
|
|
99
|
+
"type": "object", "additionalProperties": false,
|
|
100
|
+
"required": ["type", "complete", "string"],
|
|
101
|
+
"properties": {
|
|
102
|
+
"type": {"enum": ["identity", "schema", "state"]},
|
|
103
|
+
"complete": {"type": "boolean"},
|
|
104
|
+
"string": {"$ref": "#/$defs/nonempty_string"},
|
|
105
|
+
"conflict_digests": {"$ref": "#/$defs/digest_set"}
|
|
106
|
+
}
|
|
107
|
+
},
|
|
108
|
+
{
|
|
109
|
+
"type": "object", "additionalProperties": false,
|
|
110
|
+
"required": ["type", "complete", "string"],
|
|
111
|
+
"properties": {
|
|
112
|
+
"type": {"const": "string"},
|
|
113
|
+
"complete": {"type": "boolean"},
|
|
114
|
+
"string": {"type": "string", "maxLength": 4096},
|
|
115
|
+
"conflict_digests": {"$ref": "#/$defs/digest_set"}
|
|
116
|
+
}
|
|
117
|
+
},
|
|
118
|
+
{
|
|
119
|
+
"type": "object", "additionalProperties": false,
|
|
120
|
+
"required": ["type", "complete", "string"],
|
|
121
|
+
"properties": {
|
|
122
|
+
"type": {"const": "digest"},
|
|
123
|
+
"complete": {"type": "boolean"},
|
|
124
|
+
"string": {"$ref": "#/$defs/digest"},
|
|
125
|
+
"conflict_digests": {"$ref": "#/$defs/digest_set"}
|
|
126
|
+
}
|
|
127
|
+
},
|
|
128
|
+
{
|
|
129
|
+
"type": "object", "additionalProperties": false,
|
|
130
|
+
"required": ["type", "complete", "boolean"],
|
|
131
|
+
"properties": {
|
|
132
|
+
"type": {"const": "boolean"},
|
|
133
|
+
"complete": {"type": "boolean"},
|
|
134
|
+
"boolean": {"type": "boolean"},
|
|
135
|
+
"conflict_digests": {"$ref": "#/$defs/digest_set"}
|
|
136
|
+
}
|
|
137
|
+
},
|
|
138
|
+
{
|
|
139
|
+
"type": "object", "additionalProperties": false,
|
|
140
|
+
"required": ["type", "complete", "number"],
|
|
141
|
+
"properties": {
|
|
142
|
+
"type": {"const": "number"},
|
|
143
|
+
"complete": {"type": "boolean"},
|
|
144
|
+
"number": {"type": "number"},
|
|
145
|
+
"conflict_digests": {"$ref": "#/$defs/digest_set"}
|
|
146
|
+
}
|
|
147
|
+
},
|
|
148
|
+
{
|
|
149
|
+
"type": "object", "additionalProperties": false,
|
|
150
|
+
"required": ["type", "complete", "timestamp"],
|
|
151
|
+
"properties": {
|
|
152
|
+
"type": {"const": "time"},
|
|
153
|
+
"complete": {"type": "boolean"},
|
|
154
|
+
"timestamp": {"type": "string", "format": "date-time", "maxLength": 64},
|
|
155
|
+
"conflict_digests": {"$ref": "#/$defs/digest_set"}
|
|
156
|
+
}
|
|
157
|
+
},
|
|
158
|
+
{
|
|
159
|
+
"type": "object", "additionalProperties": false,
|
|
160
|
+
"required": ["type", "complete", "strings"],
|
|
161
|
+
"properties": {
|
|
162
|
+
"type": {"const": "string_set"},
|
|
163
|
+
"complete": {"type": "boolean"},
|
|
164
|
+
"strings": {"$ref": "#/$defs/string_set"},
|
|
165
|
+
"conflict_digests": {"$ref": "#/$defs/digest_set"}
|
|
166
|
+
}
|
|
167
|
+
},
|
|
168
|
+
{
|
|
169
|
+
"type": "object", "additionalProperties": false,
|
|
170
|
+
"required": ["type", "complete", "values"],
|
|
171
|
+
"properties": {
|
|
172
|
+
"type": {"enum": ["identity_map", "schema_map", "state_map"]},
|
|
173
|
+
"complete": {"type": "boolean"},
|
|
174
|
+
"values": {"$ref": "#/$defs/nonempty_string_map"},
|
|
175
|
+
"conflict_digests": {"$ref": "#/$defs/digest_set"}
|
|
176
|
+
}
|
|
177
|
+
},
|
|
178
|
+
{
|
|
179
|
+
"type": "object", "additionalProperties": false,
|
|
180
|
+
"required": ["type", "complete", "values"],
|
|
181
|
+
"properties": {
|
|
182
|
+
"type": {"const": "digest_map"},
|
|
183
|
+
"complete": {"type": "boolean"},
|
|
184
|
+
"values": {"$ref": "#/$defs/digest_map"},
|
|
185
|
+
"conflict_digests": {"$ref": "#/$defs/digest_set"}
|
|
186
|
+
}
|
|
187
|
+
},
|
|
188
|
+
{
|
|
189
|
+
"type": "object", "additionalProperties": false,
|
|
190
|
+
"required": ["type", "complete", "values"],
|
|
191
|
+
"properties": {
|
|
192
|
+
"type": {"const": "string_map"},
|
|
193
|
+
"complete": {"type": "boolean"},
|
|
194
|
+
"values": {"$ref": "#/$defs/string_map"},
|
|
195
|
+
"conflict_digests": {"$ref": "#/$defs/digest_set"}
|
|
196
|
+
}
|
|
197
|
+
},
|
|
198
|
+
{
|
|
199
|
+
"type": "object", "additionalProperties": false,
|
|
200
|
+
"required": ["type", "complete", "booleans"],
|
|
201
|
+
"properties": {
|
|
202
|
+
"type": {"const": "boolean_map"},
|
|
203
|
+
"complete": {"type": "boolean"},
|
|
204
|
+
"booleans": {"$ref": "#/$defs/boolean_map"},
|
|
205
|
+
"conflict_digests": {"$ref": "#/$defs/digest_set"}
|
|
206
|
+
}
|
|
207
|
+
},
|
|
208
|
+
{
|
|
209
|
+
"type": "object", "additionalProperties": false,
|
|
210
|
+
"required": ["type", "complete", "edges"],
|
|
211
|
+
"properties": {
|
|
212
|
+
"type": {"const": "directed_graph"},
|
|
213
|
+
"complete": {"type": "boolean"},
|
|
214
|
+
"edges": {
|
|
215
|
+
"type": "array", "maxItems": 1024,
|
|
216
|
+
"items": {"$ref": "#/$defs/directed_edge"}
|
|
217
|
+
},
|
|
218
|
+
"conflict_digests": {"$ref": "#/$defs/digest_set"}
|
|
219
|
+
}
|
|
220
|
+
},
|
|
221
|
+
{
|
|
222
|
+
"type": "object", "additionalProperties": false,
|
|
223
|
+
"required": ["type", "complete", "numbers"],
|
|
224
|
+
"properties": {
|
|
225
|
+
"type": {"const": "number_map"},
|
|
226
|
+
"complete": {"type": "boolean"},
|
|
227
|
+
"numbers": {"$ref": "#/$defs/number_map"},
|
|
228
|
+
"conflict_digests": {"$ref": "#/$defs/digest_set"}
|
|
229
|
+
}
|
|
230
|
+
},
|
|
231
|
+
{
|
|
232
|
+
"type": "object", "additionalProperties": false,
|
|
233
|
+
"required": ["type", "complete", "timestamps"],
|
|
234
|
+
"properties": {
|
|
235
|
+
"type": {"const": "time_map"},
|
|
236
|
+
"complete": {"type": "boolean"},
|
|
237
|
+
"timestamps": {"$ref": "#/$defs/time_map"},
|
|
238
|
+
"conflict_digests": {"$ref": "#/$defs/digest_set"}
|
|
239
|
+
}
|
|
240
|
+
}
|
|
241
|
+
]
|
|
242
|
+
}
|
|
243
|
+
}
|
|
244
|
+
}
|
|
@@ -0,0 +1,244 @@
|
|
|
1
|
+
{
|
|
2
|
+
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
|
3
|
+
"$id": "https://marinjursic.github.io/production-readiness-checklist/schemas/control-check-evidence.schema.json",
|
|
4
|
+
"title": "Normalized authoritative control-check evidence v0.1",
|
|
5
|
+
"type": "object",
|
|
6
|
+
"additionalProperties": false,
|
|
7
|
+
"required": ["schema_version", "evidence_id", "program_sha256", "control_id", "control_revision", "control_semantic_sha256", "clause_id", "clause_sha256", "implementation_contract_sha256", "subject_id", "observed_subjects", "inventory_sha256", "authority", "observed_at", "complete", "applicability", "applicability_proof_contract_sha256", "facts"],
|
|
8
|
+
"properties": {
|
|
9
|
+
"schema_version": {"const": "prc.control-check-evidence/v0.1"},
|
|
10
|
+
"evidence_id": {"$ref": "#/$defs/nonempty_string"},
|
|
11
|
+
"program_sha256": {"$ref": "#/$defs/digest"},
|
|
12
|
+
"control_id": {"$ref": "#/$defs/control_id"},
|
|
13
|
+
"control_revision": {"type": "integer", "minimum": 1},
|
|
14
|
+
"control_semantic_sha256": {"$ref": "#/$defs/digest"},
|
|
15
|
+
"clause_id": {"$ref": "#/$defs/digest"},
|
|
16
|
+
"clause_sha256": {"$ref": "#/$defs/digest"},
|
|
17
|
+
"implementation_contract_sha256": {"$ref": "#/$defs/digest"},
|
|
18
|
+
"subject_id": {"$ref": "#/$defs/nonempty_string"},
|
|
19
|
+
"observed_subjects": {"$ref": "#/$defs/string_set"},
|
|
20
|
+
"inventory_sha256": {"$ref": "#/$defs/digest"},
|
|
21
|
+
"authority": {"$ref": "#/$defs/authority"},
|
|
22
|
+
"observed_at": {"type": "string", "format": "date-time", "maxLength": 64},
|
|
23
|
+
"complete": {"type": "boolean"},
|
|
24
|
+
"contradiction_digests": {"$ref": "#/$defs/digest_set"},
|
|
25
|
+
"applicability": {"enum": ["applicable", "not_applicable", "unknown"]},
|
|
26
|
+
"applicability_proof_contract_sha256": {"$ref": "#/$defs/digest"},
|
|
27
|
+
"applicability_proof": {"$ref": "#/$defs/nonempty_string"},
|
|
28
|
+
"applicability_proof_sha256": {"$ref": "#/$defs/digest"},
|
|
29
|
+
"facts": {
|
|
30
|
+
"type": "object",
|
|
31
|
+
"maxProperties": 512,
|
|
32
|
+
"propertyNames": {"$ref": "#/$defs/fact_id"},
|
|
33
|
+
"additionalProperties": {"$ref": "#/$defs/fact"}
|
|
34
|
+
}
|
|
35
|
+
},
|
|
36
|
+
"allOf": [
|
|
37
|
+
{
|
|
38
|
+
"if": {"properties": {"applicability": {"const": "not_applicable"}}},
|
|
39
|
+
"then": {"required": ["applicability_proof", "applicability_proof_sha256"]},
|
|
40
|
+
"else": {
|
|
41
|
+
"not": {
|
|
42
|
+
"anyOf": [
|
|
43
|
+
{"required": ["applicability_proof"]},
|
|
44
|
+
{"required": ["applicability_proof_sha256"]}
|
|
45
|
+
]
|
|
46
|
+
}
|
|
47
|
+
}
|
|
48
|
+
}
|
|
49
|
+
],
|
|
50
|
+
"$defs": {
|
|
51
|
+
"digest": {"type": "string", "pattern": "^[0-9a-f]{64}$"},
|
|
52
|
+
"control_id": {"type": "string", "pattern": "^(PRC-[0-9]{2}-[0-9]{3}|USEQ-[A-F0-9]{8})$"},
|
|
53
|
+
"fact_id": {"type": "string", "minLength": 1, "maxLength": 128, "pattern": "^[A-Za-z0-9_.-]+$"},
|
|
54
|
+
"nonempty_string": {"type": "string", "minLength": 1, "maxLength": 4096},
|
|
55
|
+
"authority": {"enum": ["repository", "artifact", "executed", "environment", "external_registry", "structured_record"]},
|
|
56
|
+
"string_set": {"type": "array", "maxItems": 1024, "uniqueItems": true, "items": {"$ref": "#/$defs/nonempty_string"}},
|
|
57
|
+
"digest_set": {"type": "array", "maxItems": 1024, "uniqueItems": true, "items": {"$ref": "#/$defs/digest"}},
|
|
58
|
+
"number_map": {
|
|
59
|
+
"type": "object", "maxProperties": 1024,
|
|
60
|
+
"propertyNames": {"$ref": "#/$defs/fact_id"},
|
|
61
|
+
"additionalProperties": {"type": "number"}
|
|
62
|
+
},
|
|
63
|
+
"string_map": {
|
|
64
|
+
"type": "object", "maxProperties": 1024,
|
|
65
|
+
"propertyNames": {"$ref": "#/$defs/fact_id"},
|
|
66
|
+
"additionalProperties": {"type": "string", "maxLength": 4096}
|
|
67
|
+
},
|
|
68
|
+
"nonempty_string_map": {
|
|
69
|
+
"type": "object", "maxProperties": 1024,
|
|
70
|
+
"propertyNames": {"$ref": "#/$defs/fact_id"},
|
|
71
|
+
"additionalProperties": {"$ref": "#/$defs/nonempty_string"}
|
|
72
|
+
},
|
|
73
|
+
"digest_map": {
|
|
74
|
+
"type": "object", "maxProperties": 1024,
|
|
75
|
+
"propertyNames": {"$ref": "#/$defs/fact_id"},
|
|
76
|
+
"additionalProperties": {"$ref": "#/$defs/digest"}
|
|
77
|
+
},
|
|
78
|
+
"boolean_map": {
|
|
79
|
+
"type": "object", "maxProperties": 1024,
|
|
80
|
+
"propertyNames": {"$ref": "#/$defs/fact_id"},
|
|
81
|
+
"additionalProperties": {"type": "boolean"}
|
|
82
|
+
},
|
|
83
|
+
"directed_edge": {
|
|
84
|
+
"type": "object", "additionalProperties": false,
|
|
85
|
+
"required": ["from", "to"],
|
|
86
|
+
"properties": {
|
|
87
|
+
"from": {"$ref": "#/$defs/nonempty_string"},
|
|
88
|
+
"to": {"$ref": "#/$defs/nonempty_string"}
|
|
89
|
+
}
|
|
90
|
+
},
|
|
91
|
+
"time_map": {
|
|
92
|
+
"type": "object", "maxProperties": 1024,
|
|
93
|
+
"propertyNames": {"$ref": "#/$defs/fact_id"},
|
|
94
|
+
"additionalProperties": {"type": "string", "format": "date-time", "maxLength": 64}
|
|
95
|
+
},
|
|
96
|
+
"fact": {
|
|
97
|
+
"oneOf": [
|
|
98
|
+
{
|
|
99
|
+
"type": "object", "additionalProperties": false,
|
|
100
|
+
"required": ["type", "complete", "string"],
|
|
101
|
+
"properties": {
|
|
102
|
+
"type": {"enum": ["identity", "schema", "state"]},
|
|
103
|
+
"complete": {"type": "boolean"},
|
|
104
|
+
"string": {"$ref": "#/$defs/nonempty_string"},
|
|
105
|
+
"conflict_digests": {"$ref": "#/$defs/digest_set"}
|
|
106
|
+
}
|
|
107
|
+
},
|
|
108
|
+
{
|
|
109
|
+
"type": "object", "additionalProperties": false,
|
|
110
|
+
"required": ["type", "complete", "string"],
|
|
111
|
+
"properties": {
|
|
112
|
+
"type": {"const": "string"},
|
|
113
|
+
"complete": {"type": "boolean"},
|
|
114
|
+
"string": {"type": "string", "maxLength": 4096},
|
|
115
|
+
"conflict_digests": {"$ref": "#/$defs/digest_set"}
|
|
116
|
+
}
|
|
117
|
+
},
|
|
118
|
+
{
|
|
119
|
+
"type": "object", "additionalProperties": false,
|
|
120
|
+
"required": ["type", "complete", "string"],
|
|
121
|
+
"properties": {
|
|
122
|
+
"type": {"const": "digest"},
|
|
123
|
+
"complete": {"type": "boolean"},
|
|
124
|
+
"string": {"$ref": "#/$defs/digest"},
|
|
125
|
+
"conflict_digests": {"$ref": "#/$defs/digest_set"}
|
|
126
|
+
}
|
|
127
|
+
},
|
|
128
|
+
{
|
|
129
|
+
"type": "object", "additionalProperties": false,
|
|
130
|
+
"required": ["type", "complete", "boolean"],
|
|
131
|
+
"properties": {
|
|
132
|
+
"type": {"const": "boolean"},
|
|
133
|
+
"complete": {"type": "boolean"},
|
|
134
|
+
"boolean": {"type": "boolean"},
|
|
135
|
+
"conflict_digests": {"$ref": "#/$defs/digest_set"}
|
|
136
|
+
}
|
|
137
|
+
},
|
|
138
|
+
{
|
|
139
|
+
"type": "object", "additionalProperties": false,
|
|
140
|
+
"required": ["type", "complete", "number"],
|
|
141
|
+
"properties": {
|
|
142
|
+
"type": {"const": "number"},
|
|
143
|
+
"complete": {"type": "boolean"},
|
|
144
|
+
"number": {"type": "number"},
|
|
145
|
+
"conflict_digests": {"$ref": "#/$defs/digest_set"}
|
|
146
|
+
}
|
|
147
|
+
},
|
|
148
|
+
{
|
|
149
|
+
"type": "object", "additionalProperties": false,
|
|
150
|
+
"required": ["type", "complete", "timestamp"],
|
|
151
|
+
"properties": {
|
|
152
|
+
"type": {"const": "time"},
|
|
153
|
+
"complete": {"type": "boolean"},
|
|
154
|
+
"timestamp": {"type": "string", "format": "date-time", "maxLength": 64},
|
|
155
|
+
"conflict_digests": {"$ref": "#/$defs/digest_set"}
|
|
156
|
+
}
|
|
157
|
+
},
|
|
158
|
+
{
|
|
159
|
+
"type": "object", "additionalProperties": false,
|
|
160
|
+
"required": ["type", "complete", "strings"],
|
|
161
|
+
"properties": {
|
|
162
|
+
"type": {"const": "string_set"},
|
|
163
|
+
"complete": {"type": "boolean"},
|
|
164
|
+
"strings": {"$ref": "#/$defs/string_set"},
|
|
165
|
+
"conflict_digests": {"$ref": "#/$defs/digest_set"}
|
|
166
|
+
}
|
|
167
|
+
},
|
|
168
|
+
{
|
|
169
|
+
"type": "object", "additionalProperties": false,
|
|
170
|
+
"required": ["type", "complete", "values"],
|
|
171
|
+
"properties": {
|
|
172
|
+
"type": {"enum": ["identity_map", "schema_map", "state_map"]},
|
|
173
|
+
"complete": {"type": "boolean"},
|
|
174
|
+
"values": {"$ref": "#/$defs/nonempty_string_map"},
|
|
175
|
+
"conflict_digests": {"$ref": "#/$defs/digest_set"}
|
|
176
|
+
}
|
|
177
|
+
},
|
|
178
|
+
{
|
|
179
|
+
"type": "object", "additionalProperties": false,
|
|
180
|
+
"required": ["type", "complete", "values"],
|
|
181
|
+
"properties": {
|
|
182
|
+
"type": {"const": "digest_map"},
|
|
183
|
+
"complete": {"type": "boolean"},
|
|
184
|
+
"values": {"$ref": "#/$defs/digest_map"},
|
|
185
|
+
"conflict_digests": {"$ref": "#/$defs/digest_set"}
|
|
186
|
+
}
|
|
187
|
+
},
|
|
188
|
+
{
|
|
189
|
+
"type": "object", "additionalProperties": false,
|
|
190
|
+
"required": ["type", "complete", "values"],
|
|
191
|
+
"properties": {
|
|
192
|
+
"type": {"const": "string_map"},
|
|
193
|
+
"complete": {"type": "boolean"},
|
|
194
|
+
"values": {"$ref": "#/$defs/string_map"},
|
|
195
|
+
"conflict_digests": {"$ref": "#/$defs/digest_set"}
|
|
196
|
+
}
|
|
197
|
+
},
|
|
198
|
+
{
|
|
199
|
+
"type": "object", "additionalProperties": false,
|
|
200
|
+
"required": ["type", "complete", "booleans"],
|
|
201
|
+
"properties": {
|
|
202
|
+
"type": {"const": "boolean_map"},
|
|
203
|
+
"complete": {"type": "boolean"},
|
|
204
|
+
"booleans": {"$ref": "#/$defs/boolean_map"},
|
|
205
|
+
"conflict_digests": {"$ref": "#/$defs/digest_set"}
|
|
206
|
+
}
|
|
207
|
+
},
|
|
208
|
+
{
|
|
209
|
+
"type": "object", "additionalProperties": false,
|
|
210
|
+
"required": ["type", "complete", "edges"],
|
|
211
|
+
"properties": {
|
|
212
|
+
"type": {"const": "directed_graph"},
|
|
213
|
+
"complete": {"type": "boolean"},
|
|
214
|
+
"edges": {
|
|
215
|
+
"type": "array", "maxItems": 1024,
|
|
216
|
+
"items": {"$ref": "#/$defs/directed_edge"}
|
|
217
|
+
},
|
|
218
|
+
"conflict_digests": {"$ref": "#/$defs/digest_set"}
|
|
219
|
+
}
|
|
220
|
+
},
|
|
221
|
+
{
|
|
222
|
+
"type": "object", "additionalProperties": false,
|
|
223
|
+
"required": ["type", "complete", "numbers"],
|
|
224
|
+
"properties": {
|
|
225
|
+
"type": {"const": "number_map"},
|
|
226
|
+
"complete": {"type": "boolean"},
|
|
227
|
+
"numbers": {"$ref": "#/$defs/number_map"},
|
|
228
|
+
"conflict_digests": {"$ref": "#/$defs/digest_set"}
|
|
229
|
+
}
|
|
230
|
+
},
|
|
231
|
+
{
|
|
232
|
+
"type": "object", "additionalProperties": false,
|
|
233
|
+
"required": ["type", "complete", "timestamps"],
|
|
234
|
+
"properties": {
|
|
235
|
+
"type": {"const": "time_map"},
|
|
236
|
+
"complete": {"type": "boolean"},
|
|
237
|
+
"timestamps": {"$ref": "#/$defs/time_map"},
|
|
238
|
+
"conflict_digests": {"$ref": "#/$defs/digest_set"}
|
|
239
|
+
}
|
|
240
|
+
}
|
|
241
|
+
]
|
|
242
|
+
}
|
|
243
|
+
}
|
|
244
|
+
}
|