@opensoha/contracts 0.1.7 → 0.1.8

package/plugins/companion-provenance.schema.json

@@ -0,0 +1,19 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://contracts.opensoha.dev/plugins/companion-provenance.schema.json",
+  "title": "OpenSoha Companion Provenance Statement",
+  "description": "The Ed25519 signature covers UTF-8 lines subjectSha256, builderId, sourceUri, sourceCommit, and builtAt in that order, joined with LF and without a trailing LF.",
+  "type": "object",
+  "required": ["subjectSha256", "builderId", "sourceUri", "sourceCommit", "builtAt", "signingKeyId", "signatureAlgorithm", "signature"],
+  "properties": {
+    "subjectSha256": { "type": "string", "pattern": "^sha256:[a-f0-9]{64}$" },
+    "builderId": { "type": "string", "minLength": 1, "maxLength": 512 },
+    "sourceUri": { "type": "string", "format": "uri" },
+    "sourceCommit": { "type": "string", "pattern": "^[A-Fa-f0-9]{7,64}$" },
+    "builtAt": { "type": "string", "format": "date-time" },
+    "signingKeyId": { "type": "string", "pattern": "^[a-z][a-z0-9._-]*$" },
+    "signatureAlgorithm": { "const": "ed25519" },
+    "signature": { "type": "string", "minLength": 1 }
+  },
+  "additionalProperties": false
+}

package/plugins/marketplace-catalog.schema.json

@@ -87,6 +87,7 @@
         "packageUrl": { "type": "string" },
         "checksum": { "type": "string" },
         "signature": { "type": "string" },
+        "package": { "$ref": "#/$defs/package" },
         "publishedAt": { "type": "string", "format": "date-time" },
         "deprecated": { "type": "boolean" },
         "suspended": { "type": "boolean" },
@@ -98,6 +99,25 @@
       },
       "additionalProperties": false
     },
+    "package": {
+      "type": "object",
+      "required": ["url", "contentType", "sizeBytes", "sha256"],
+      "properties": {
+        "url": { "type": "string", "format": "uri" },
+        "contentType": {
+          "type": "string",
+          "enum": ["application/zip", "application/gzip", "application/x-tar"]
+        },
+        "sizeBytes": { "type": "integer", "minimum": 1, "maximum": 268435456 },
+        "sha256": { "type": "string", "pattern": "^sha256:[a-f0-9]{64}$" },
+        "signature": { "type": "string", "minLength": 1 },
+        "signatureAlgorithm": { "type": "string", "enum": ["ed25519"] },
+        "signingKeyId": { "type": "string", "pattern": "^[a-z][a-z0-9._-]*$" },
+        "provenanceUrl": { "type": "string", "format": "uri" },
+        "sbomUrl": { "type": "string", "format": "uri" }
+      },
+      "additionalProperties": false
+    },
     "advisory": {
       "type": "object",
       "required": ["id", "severity", "summary"],

package/plugins/plugin-manifest.schema.json

@@ -28,7 +28,8 @@
         "metric-extension",
         "notification-channel",
         "identity-template",
-        "ui-extension"
+        "ui-extension",
+        "companion-pack"
       ]
     },
     "description": { "type": "string" },
@@ -123,6 +124,9 @@
       },
       "additionalProperties": false
     },
+    "companionPack": {
+      "$ref": "https://contracts.opensoha.dev/plugins/companion-pack.schema.json"
+    },
     "configSchema": { "$ref": "#/$defs/jsonSchema" },
     "extensionPoints": { "$ref": "#/$defs/extensionPoints" },
     "metadata": {
@@ -131,6 +135,20 @@
     }
   },
   "allOf": [
+    {
+      "if": {
+        "properties": { "type": { "const": "companion-pack" } },
+        "required": ["type"]
+      },
+      "then": {
+        "required": ["companionPack"],
+        "properties": {
+          "runtime": {
+            "properties": { "mode": { "const": "manifest-only" } }
+          }
+        }
+      }
+    },
     {
       "if": {
         "anyOf": [