258 lines
7.1 KiB
JSON
258 lines
7.1 KiB
JSON
{
|
|
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
|
"$id": "https://stella-ops.io/schemas/evidence-pack-manifest/v1.0.0",
|
|
"title": "Release Evidence Pack Manifest",
|
|
"description": "Schema for Stella Ops Release Evidence Pack manifest.json files",
|
|
"type": "object",
|
|
"required": [
|
|
"bundleFormatVersion",
|
|
"releaseVersion",
|
|
"createdAt",
|
|
"sourceCommit",
|
|
"artifacts"
|
|
],
|
|
"properties": {
|
|
"bundleFormatVersion": {
|
|
"type": "string",
|
|
"description": "Version of the evidence pack format",
|
|
"pattern": "^\\d+\\.\\d+\\.\\d+$",
|
|
"examples": ["1.0.0"]
|
|
},
|
|
"releaseVersion": {
|
|
"type": "string",
|
|
"description": "Version of the Stella Ops release",
|
|
"examples": ["2.5.0", "1.2.3-beta.1"]
|
|
},
|
|
"createdAt": {
|
|
"type": "string",
|
|
"format": "date-time",
|
|
"description": "ISO 8601 timestamp when the evidence pack was created"
|
|
},
|
|
"sourceCommit": {
|
|
"type": "string",
|
|
"description": "Git commit SHA of the source code",
|
|
"pattern": "^[a-f0-9]{40}$"
|
|
},
|
|
"sourceDateEpoch": {
|
|
"type": "integer",
|
|
"description": "Unix timestamp used for reproducible builds (SOURCE_DATE_EPOCH)",
|
|
"minimum": 0
|
|
},
|
|
"artifacts": {
|
|
"type": "array",
|
|
"description": "List of release artifacts in this pack",
|
|
"items": {
|
|
"$ref": "#/$defs/artifactEntry"
|
|
},
|
|
"minItems": 1
|
|
},
|
|
"checksums": {
|
|
"type": "object",
|
|
"description": "Checksum files included in the pack",
|
|
"properties": {
|
|
"sha256": {
|
|
"$ref": "#/$defs/checksumEntry"
|
|
},
|
|
"sha512": {
|
|
"$ref": "#/$defs/checksumEntry"
|
|
}
|
|
}
|
|
},
|
|
"sboms": {
|
|
"type": "array",
|
|
"description": "Software Bill of Materials files",
|
|
"items": {
|
|
"$ref": "#/$defs/sbomReference"
|
|
}
|
|
},
|
|
"provenanceStatements": {
|
|
"type": "array",
|
|
"description": "SLSA v1.0 provenance statements",
|
|
"items": {
|
|
"$ref": "#/$defs/provenanceReference"
|
|
}
|
|
},
|
|
"attestations": {
|
|
"type": "array",
|
|
"description": "DSSE attestation bundles",
|
|
"items": {
|
|
"$ref": "#/$defs/attestationReference"
|
|
}
|
|
},
|
|
"rekorProofs": {
|
|
"type": "array",
|
|
"description": "Rekor transparency log inclusion proofs",
|
|
"items": {
|
|
"$ref": "#/$defs/rekorProofEntry"
|
|
}
|
|
},
|
|
"signingKeyFingerprint": {
|
|
"type": "string",
|
|
"description": "SHA-256 fingerprint of the signing public key"
|
|
},
|
|
"rekorLogId": {
|
|
"type": "string",
|
|
"description": "Rekor log ID (tree ID) for transparency log entries"
|
|
}
|
|
},
|
|
"$defs": {
|
|
"artifactEntry": {
|
|
"type": "object",
|
|
"required": ["name", "path", "sha256"],
|
|
"properties": {
|
|
"name": {
|
|
"type": "string",
|
|
"description": "Display name of the artifact"
|
|
},
|
|
"path": {
|
|
"type": "string",
|
|
"description": "Relative path within the evidence pack"
|
|
},
|
|
"sha256": {
|
|
"type": "string",
|
|
"description": "SHA-256 hash of the artifact",
|
|
"pattern": "^[a-f0-9]{64}$"
|
|
},
|
|
"sha512": {
|
|
"type": "string",
|
|
"description": "SHA-512 hash of the artifact",
|
|
"pattern": "^[a-f0-9]{128}$"
|
|
},
|
|
"signaturePath": {
|
|
"type": "string",
|
|
"description": "Relative path to the detached signature file"
|
|
},
|
|
"size": {
|
|
"type": "integer",
|
|
"description": "File size in bytes",
|
|
"minimum": 0
|
|
},
|
|
"platform": {
|
|
"type": "string",
|
|
"description": "Target platform (e.g., linux-x64, macos-arm64, windows-x64)"
|
|
},
|
|
"mediaType": {
|
|
"type": "string",
|
|
"description": "MIME type of the artifact"
|
|
}
|
|
}
|
|
},
|
|
"checksumEntry": {
|
|
"type": "object",
|
|
"required": ["path"],
|
|
"properties": {
|
|
"path": {
|
|
"type": "string",
|
|
"description": "Relative path to the checksum file"
|
|
},
|
|
"signaturePath": {
|
|
"type": "string",
|
|
"description": "Relative path to the signature of the checksum file"
|
|
}
|
|
}
|
|
},
|
|
"sbomReference": {
|
|
"type": "object",
|
|
"required": ["path", "format"],
|
|
"properties": {
|
|
"path": {
|
|
"type": "string",
|
|
"description": "Relative path to the SBOM file"
|
|
},
|
|
"format": {
|
|
"type": "string",
|
|
"description": "SBOM format",
|
|
"enum": ["cyclonedx", "spdx"]
|
|
},
|
|
"version": {
|
|
"type": "string",
|
|
"description": "SBOM format version (e.g., 1.5 for CycloneDX)"
|
|
},
|
|
"signaturePath": {
|
|
"type": "string",
|
|
"description": "Relative path to the signature file"
|
|
},
|
|
"component": {
|
|
"type": "string",
|
|
"description": "Component this SBOM describes"
|
|
}
|
|
}
|
|
},
|
|
"provenanceReference": {
|
|
"type": "object",
|
|
"required": ["path", "predicateType"],
|
|
"properties": {
|
|
"path": {
|
|
"type": "string",
|
|
"description": "Relative path to the provenance file"
|
|
},
|
|
"predicateType": {
|
|
"type": "string",
|
|
"description": "SLSA predicate type URI",
|
|
"examples": ["https://slsa.dev/provenance/v1"]
|
|
},
|
|
"signaturePath": {
|
|
"type": "string",
|
|
"description": "Relative path to the signature file"
|
|
},
|
|
"builderId": {
|
|
"type": "string",
|
|
"description": "Builder ID from the provenance"
|
|
},
|
|
"slsaLevel": {
|
|
"type": "integer",
|
|
"description": "SLSA level of this provenance (1-4)",
|
|
"minimum": 1,
|
|
"maximum": 4
|
|
}
|
|
}
|
|
},
|
|
"attestationReference": {
|
|
"type": "object",
|
|
"required": ["path", "type"],
|
|
"properties": {
|
|
"path": {
|
|
"type": "string",
|
|
"description": "Relative path to the attestation file"
|
|
},
|
|
"type": {
|
|
"type": "string",
|
|
"description": "Attestation type",
|
|
"enum": ["dsse", "sigstore-bundle", "in-toto"]
|
|
},
|
|
"predicateType": {
|
|
"type": "string",
|
|
"description": "Predicate type URI for in-toto/DSSE attestations"
|
|
}
|
|
}
|
|
},
|
|
"rekorProofEntry": {
|
|
"type": "object",
|
|
"required": ["uuid", "logIndex"],
|
|
"properties": {
|
|
"uuid": {
|
|
"type": "string",
|
|
"description": "Rekor entry UUID"
|
|
},
|
|
"logIndex": {
|
|
"type": "integer",
|
|
"description": "Index in the Rekor log",
|
|
"minimum": 0
|
|
},
|
|
"integratedTime": {
|
|
"type": "integer",
|
|
"description": "Unix timestamp when entry was added to log"
|
|
},
|
|
"inclusionProofPath": {
|
|
"type": "string",
|
|
"description": "Relative path to the inclusion proof JSON file"
|
|
},
|
|
"artifactName": {
|
|
"type": "string",
|
|
"description": "Name of the artifact this proof applies to"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|