knodin 0.5.0

package/schemas/release-attestation-v1.schema.json

@@ -0,0 +1,210 @@
+{
+	"$schema": "https://json-schema.org/draft/2020-12/schema",
+	"$id": "https://raw.githubusercontent.com/knowdin/knodin/main/schemas/release-attestation-v1.schema.json",
+	"title": "knodin release attestation",
+	"type": "object",
+	"additionalProperties": false,
+	"required": [
+		"schemaVersion",
+		"status",
+		"version",
+		"tag",
+		"sourceCommit",
+		"generatedAt",
+		"build",
+		"artifact",
+		"provenance",
+		"sbom",
+		"channels",
+		"rollback",
+		"failures"
+	],
+	"properties": {
+		"schemaVersion": { "const": 1 },
+		"status": { "enum": ["verified", "incomplete", "quarantined"] },
+		"version": { "$ref": "#/$defs/semver" },
+		"tag": { "type": "string", "pattern": "^v[0-9]", "maxLength": 129 },
+		"sourceCommit": { "$ref": "#/$defs/commit" },
+		"generatedAt": { "$ref": "#/$defs/instant" },
+		"build": { "$ref": "#/$defs/build" },
+		"artifact": { "$ref": "#/$defs/artifact" },
+		"provenance": { "$ref": "#/$defs/provenance" },
+		"sbom": { "$ref": "#/$defs/sbom" },
+		"channels": {
+			"type": "object",
+			"additionalProperties": false,
+			"required": ["public-npm", "docusign-artifactory", "github-saas", "homebrew", "ghes"],
+			"properties": {
+				"public-npm": { "$ref": "#/$defs/channel" },
+				"docusign-artifactory": { "$ref": "#/$defs/channel" },
+				"github-saas": { "$ref": "#/$defs/channel" },
+				"homebrew": { "$ref": "#/$defs/channel" },
+				"ghes": { "$ref": "#/$defs/channel" }
+			}
+		},
+		"rollback": {
+			"type": "object",
+			"additionalProperties": false,
+			"required": ["version", "targetPath", "artifactSha256"],
+			"properties": {
+				"version": { "$ref": "#/$defs/semver" },
+				"targetPath": { "$ref": "#/$defs/file" },
+				"artifactSha256": { "$ref": "#/$defs/sha256" }
+			}
+		},
+		"failures": {
+			"type": "array",
+			"maxItems": 100,
+			"items": { "type": "string", "minLength": 1, "maxLength": 512 }
+		}
+	},
+	"$defs": {
+		"semver": {
+			"type": "string",
+			"maxLength": 128,
+			"pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+(?:-[0-9A-Za-z.-]+)?(?:\\+[0-9A-Za-z.-]+)?$"
+		},
+		"commit": {
+			"type": "string",
+			"pattern": "^(?:[a-f0-9]{40}|[a-f0-9]{64})$"
+		},
+		"instant": {
+			"type": "string",
+			"maxLength": 64,
+			"pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}\\.[0-9]{3}Z$"
+		},
+		"sha256": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+		"sha512": { "type": "string", "pattern": "^[a-f0-9]{128}$" },
+		"file": {
+			"type": "string",
+			"minLength": 1,
+			"maxLength": 256,
+			"pattern": "^[A-Za-z0-9][A-Za-z0-9._+-]{0,255}$"
+		},
+		"https": {
+			"type": "string",
+			"minLength": 1,
+			"maxLength": 2048,
+			"pattern": "^https://"
+		},
+		"build": {
+			"type": "object",
+			"additionalProperties": false,
+			"required": ["repository", "workflow", "workflowRef", "runId", "runAttempt"],
+			"properties": {
+				"repository": {
+					"type": "string",
+					"pattern": "^[A-Za-z0-9_.-]{1,100}/[A-Za-z0-9_.-]{1,100}$"
+				},
+				"workflow": {
+					"type": "string",
+					"pattern": "^\\.github/workflows/[A-Za-z0-9][A-Za-z0-9._-]{0,127}\\.ya?ml$"
+				},
+				"workflowRef": { "type": "string", "pattern": "^refs/tags/v", "maxLength": 256 },
+				"runId": { "type": "string", "pattern": "^[0-9]{1,32}$" },
+				"runAttempt": { "type": "integer", "minimum": 1, "maximum": 1000 }
+			}
+		},
+		"artifact": {
+			"type": "object",
+			"additionalProperties": false,
+			"required": ["name", "length", "sha256", "sha512", "npmIntegrity"],
+			"properties": {
+				"name": { "$ref": "#/$defs/file" },
+				"length": { "type": "integer", "minimum": 1, "maximum": 536870912 },
+				"sha256": { "$ref": "#/$defs/sha256" },
+				"sha512": { "$ref": "#/$defs/sha512" },
+				"npmIntegrity": { "type": "string", "pattern": "^sha512-[A-Za-z0-9+/]+={0,2}$" }
+			}
+		},
+		"verification": {
+			"type": "object",
+			"additionalProperties": false,
+			"required": [
+				"verified",
+				"attestationId",
+				"attestationUrl",
+				"issuer",
+				"identity",
+				"verifiedAt"
+			],
+			"properties": {
+				"verified": { "type": "boolean" },
+				"attestationId": { "type": "string", "minLength": 1, "maxLength": 256 },
+				"attestationUrl": { "$ref": "#/$defs/https" },
+				"issuer": { "const": "https://token.actions.githubusercontent.com" },
+				"identity": { "$ref": "#/$defs/https" },
+				"verifiedAt": { "$ref": "#/$defs/instant" }
+			}
+		},
+		"provenance": {
+			"type": "object",
+			"additionalProperties": false,
+			"required": ["path", "length", "sha256", "verification"],
+			"properties": {
+				"path": { "$ref": "#/$defs/file" },
+				"length": { "type": "integer", "minimum": 1, "maximum": 16777216 },
+				"sha256": { "$ref": "#/$defs/sha256" },
+				"verification": { "$ref": "#/$defs/verification" }
+			}
+		},
+		"sbom": {
+			"type": "object",
+			"additionalProperties": false,
+			"required": [
+				"format",
+				"specVersion",
+				"path",
+				"length",
+				"sha256",
+				"attestationPath",
+				"attestationLength",
+				"attestationSha256",
+				"verification"
+			],
+			"properties": {
+				"format": { "const": "CycloneDX" },
+				"specVersion": { "type": "string", "minLength": 1, "maxLength": 16 },
+				"path": { "$ref": "#/$defs/file" },
+				"length": { "type": "integer", "minimum": 1, "maximum": 16777216 },
+				"sha256": { "$ref": "#/$defs/sha256" },
+				"attestationPath": { "$ref": "#/$defs/file" },
+				"attestationLength": { "type": "integer", "minimum": 1, "maximum": 16777216 },
+				"attestationSha256": { "$ref": "#/$defs/sha256" },
+				"verification": { "$ref": "#/$defs/verification" }
+			}
+		},
+		"channel": {
+			"oneOf": [
+				{
+					"type": "object",
+					"additionalProperties": false,
+					"required": ["status"],
+					"properties": { "status": { "const": "missing" } }
+				},
+				{
+					"type": "object",
+					"additionalProperties": false,
+					"required": [
+						"status",
+						"artifactLength",
+						"artifactSha256",
+						"version",
+						"sourceCommit",
+						"publishedAt",
+						"location"
+					],
+					"properties": {
+						"status": { "enum": ["verified", "mismatch"] },
+						"artifactLength": { "type": "integer", "minimum": 1, "maximum": 536870912 },
+						"artifactSha256": { "$ref": "#/$defs/sha256" },
+						"version": { "$ref": "#/$defs/semver" },
+						"sourceCommit": { "$ref": "#/$defs/commit" },
+						"publishedAt": { "$ref": "#/$defs/instant" },
+						"location": { "$ref": "#/$defs/https" }
+					}
+				}
+			]
+		}
+	}
+}