{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "$id": "https://confighub.com/helm-expt/schemas/installer-oci-index-signature-receipt.schema.json",
  "title": "Installer OCI Index Signature Receipt",
  "description": "A receipt binding the dated public installer-package index to its Sigstore keyless signature and verification result.",
  "type": "object",
  "additionalProperties": false,
  "required": ["apiVersion", "kind", "metadata", "spec"],
  "properties": {
    "apiVersion": { "const": "evidence.confighub.com/v1alpha1" },
    "kind": { "const": "InstallerOciIndexSignatureReceipt" },
    "metadata": {
      "type": "object",
      "additionalProperties": false,
      "required": ["name"],
      "properties": { "name": { "const": "installer-oci-packages-index" } }
    },
    "spec": {
      "type": "object",
      "additionalProperties": false,
      "required": ["observedAt", "subject", "signature", "verification", "scope"],
      "properties": {
        "observedAt": { "type": "string", "format": "date-time" },
        "subject": {
          "type": "object",
          "additionalProperties": false,
          "required": ["catalogPath", "catalogSHA256", "catalogGeneratedAt", "packageCount", "signedPackageCount"],
          "properties": {
            "catalogPath": { "const": "data/installer-oci-packages/packages.json" },
            "catalogSHA256": { "type": "string", "pattern": "^[0-9a-f]{64}$" },
            "catalogGeneratedAt": { "type": "string", "format": "date-time" },
            "packageCount": { "type": "integer", "minimum": 1 },
            "signedPackageCount": { "type": "integer", "minimum": 1 }
          }
        },
        "signature": {
          "type": "object",
          "additionalProperties": false,
          "required": ["scheme", "signerIdentity", "oidcIssuer", "bundlePath", "bundleSHA256"],
          "properties": {
            "scheme": { "const": "sigstore-keyless" },
            "signerIdentity": { "const": "helm-expt-package-signer@nth-fort-499605-q5.iam.gserviceaccount.com" },
            "oidcIssuer": { "const": "https://accounts.google.com" },
            "bundlePath": { "const": "runs/installer-oci-index-signature/packages.sigstore.json" },
            "bundleSHA256": { "type": "string", "pattern": "^[0-9a-f]{64}$" }
          }
        },
        "verification": {
          "type": "object",
          "additionalProperties": false,
          "required": ["result", "command", "outputPath", "outputSHA256", "cosignVersion"],
          "properties": {
            "result": { "const": "pass" },
            "command": { "type": "string", "minLength": 1 },
            "outputPath": { "const": "runs/installer-oci-index-signature/verification.txt" },
            "outputSHA256": { "type": "string", "pattern": "^[0-9a-f]{64}$" },
            "cosignVersion": { "const": "v3.1.3" }
          }
        },
        "scope": {
          "type": "object",
          "additionalProperties": false,
          "required": ["proves", "doesNotProve"],
          "properties": {
            "proves": { "type": "array", "minItems": 2, "items": { "type": "string" } },
            "doesNotProve": { "type": "array", "minItems": 2, "items": { "type": "string" } }
          }
        }
      }
    }
  }
}