{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://aslice.sh/schematics/advisory.schema.json",
  "title": "advisory",
  "description": "A TUF target; identity and assessment freshness require external authentication. Revisions and artifact sets are exact, not upstream-only ranges. Semantics: docs/DESIGN.md vulnerability-and-sbom-pipeline",
  "type": "object",
  "additionalProperties": false,
  "properties": {
    "format": {
      "const": 1
    },
    "repository_identity": {
      "type": "string",
      "minLength": 1
    },
    "environment": {
      "enum": [
        "dev",
        "staging",
        "prod"
      ]
    },
    "advisory_id": {
      "type": "string",
      "minLength": 1
    },
    "cve_ids": {
      "type": "array",
      "items": {
        "type": "string",
        "pattern": "^CVE-[0-9]{4}-[0-9]{4,}$"
      },
      "minItems": 0,
      "uniqueItems": true
    },
    "issued_at": {
      "type": "integer",
      "minimum": 0,
      "maximum": 9007199254740991
    },
    "expires_at": {
      "type": "integer",
      "minimum": 0,
      "maximum": 9007199254740991
    },
    "affected": {
      "type": "array",
      "items": {
        "type": "object",
        "additionalProperties": false,
        "properties": {
          "package": {
            "type": "string",
            "pattern": "^[a-z0-9][a-z0-9-]*:[a-z0-9][a-z0-9-]*$"
          },
          "version": {
            "type": "string",
            "minLength": 1
          },
          "epoch": {
            "type": "integer",
            "minimum": 0,
            "maximum": 9007199254740991
          },
          "revision": {
            "type": "integer",
            "minimum": 0,
            "maximum": 9007199254740991
          },
          "artifacts": {
            "type": "array",
            "items": {
              "type": "string",
              "pattern": "^sha256:[0-9a-f]{64}$"
            },
            "minItems": 1,
            "uniqueItems": true
          }
        },
        "required": [
          "package",
          "version",
          "epoch",
          "revision",
          "artifacts"
        ]
      },
      "minItems": 1,
      "uniqueItems": true
    },
    "fixed": {
      "type": "array",
      "items": {
        "type": "object",
        "additionalProperties": false,
        "properties": {
          "package": {
            "type": "string",
            "pattern": "^[a-z0-9][a-z0-9-]*:[a-z0-9][a-z0-9-]*$"
          },
          "version": {
            "type": "string",
            "minLength": 1
          },
          "epoch": {
            "type": "integer",
            "minimum": 0,
            "maximum": 9007199254740991
          },
          "revision": {
            "type": "integer",
            "minimum": 0,
            "maximum": 9007199254740991
          },
          "artifacts": {
            "type": "array",
            "items": {
              "type": "string",
              "pattern": "^sha256:[0-9a-f]{64}$"
            },
            "minItems": 1,
            "uniqueItems": true
          }
        },
        "required": [
          "package",
          "version",
          "epoch",
          "revision",
          "artifacts"
        ]
      },
      "minItems": 0,
      "uniqueItems": true
    },
    "platforms": {
      "type": "array",
      "items": {
        "type": "object",
        "additionalProperties": false,
        "properties": {
          "os": {
            "enum": [
              "10.11",
              "10.12",
              "10.13",
              "10.14",
              "10.15",
              "11",
              "12"
            ]
          },
          "flavor": {
            "enum": [
              "v1",
              "v2",
              "v3"
            ]
          }
        },
        "required": [
          "os",
          "flavor"
        ]
      },
      "minItems": 1,
      "uniqueItems": true
    },
    "assessments": {
      "type": "array",
      "items": {
        "type": "object",
        "additionalProperties": false,
        "properties": {
          "artifact_id": {
            "type": "string",
            "pattern": "^sha256:[0-9a-f]{64}$"
          },
          "component": {
            "anyOf": [
              {
                "type": "string",
                "minLength": 1
              },
              {
                "type": "null"
              }
            ]
          },
          "status": {
            "enum": [
              "vulnerable",
              "fixed",
              "not-affected",
              "unknown"
            ]
          },
          "evidence": {
            "type": "array",
            "items": {
              "type": "object",
              "additionalProperties": false,
              "properties": {
                "digest": {
                  "type": "string",
                  "pattern": "^sha256:[0-9a-f]{64}$"
                },
                "size": {
                  "type": "integer",
                  "minimum": 0,
                  "maximum": 9007199254740991
                }
              },
              "required": [
                "digest",
                "size"
              ]
            },
            "minItems": 1,
            "uniqueItems": true
          },
          "reason": {
            "type": "string",
            "minLength": 1
          }
        },
        "required": [
          "artifact_id",
          "component",
          "status",
          "evidence",
          "reason"
        ]
      },
      "minItems": 1,
      "uniqueItems": true
    },
    "remediation": {
      "type": "object",
      "additionalProperties": false,
      "properties": {
        "action": {
          "enum": [
            "update",
            "rebuild",
            "unavailable"
          ]
        },
        "explanation": {
          "type": "string",
          "minLength": 1
        },
        "affected_consumers": {
          "type": "array",
          "items": {
            "type": "string",
            "pattern": "^[a-z0-9][a-z0-9-]*:[a-z0-9][a-z0-9-]*$"
          },
          "minItems": 0,
          "uniqueItems": true
        },
        "unresolved_consumers": {
          "type": "array",
          "items": {
            "type": "string",
            "pattern": "^[a-z0-9][a-z0-9-]*:[a-z0-9][a-z0-9-]*$"
          },
          "minItems": 0,
          "uniqueItems": true
        }
      },
      "required": [
        "action",
        "explanation",
        "affected_consumers",
        "unresolved_consumers"
      ]
    }
  },
  "required": [
    "format",
    "repository_identity",
    "environment",
    "advisory_id",
    "cve_ids",
    "issued_at",
    "expires_at",
    "affected",
    "fixed",
    "platforms",
    "assessments",
    "remediation"
  ]
}