{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "$id": "https://confighub.com/helm-expt/schemas/installer-package-signature-receipt.schema.json",
  "title": "Installer Package Signature Receipt",
  "description": "A receipt binding one public installer package manifest digest to its Sigstore keyless signature and verification result.",
  "type": "object",
  "additionalProperties": false,
  "required": ["apiVersion", "kind", "metadata", "spec"],
  "properties": {
    "apiVersion": { "const": "evidence.confighub.com/v1alpha1" },
    "kind": { "const": "InstallerPackageSignatureReceipt" },
    "metadata": {
      "type": "object",
      "additionalProperties": false,
      "required": ["name"],
      "properties": { "name": { "type": "string", "minLength": 1 } }
    },
    "spec": {
      "type": "object",
      "additionalProperties": false,
      "required": ["observedAt", "subject", "signature", "verification", "annotations", "scope"],
      "properties": {
        "observedAt": { "type": "string", "format": "date-time" },
        "subject": {
          "type": "object",
          "additionalProperties": false,
          "required": ["packagePath", "publicationReceipt", "tagReference", "manifestDigest", "immutableReference", "packageSHA256", "layerDigest"],
          "properties": {
            "packagePath": { "type": "string", "pattern": "^packages/[^/]+/[^/]+/[^/]+$" },
            "publicationReceipt": { "type": "string", "pattern": "^runs/installer-oci/.+/installer-package-publication-receipt\\.yaml$" },
            "tagReference": { "type": "string", "pattern": "^oci://.+:[^/]+$" },
            "manifestDigest": { "$ref": "#/definitions/digest" },
            "immutableReference": { "type": "string", "pattern": "^[^ ]+@sha256:[0-9a-f]{64}$" },
            "packageSHA256": { "type": "string", "pattern": "^[0-9a-f]{64}$" },
            "layerDigest": { "$ref": "#/definitions/digest" }
          }
        },
        "signature": {
          "type": "object",
          "additionalProperties": false,
          "required": ["scheme", "signerIdentity", "oidcIssuer", "bundlePath", "bundleSHA256", "payloadPath", "payloadSHA256", "registryAttached", "registryAnonymousRead"],
          "properties": {
            "scheme": { "const": "sigstore-keyless" },
            "signerIdentity": { "const": "helm-expt-package-signer@nth-fort-499605-q5.iam.gserviceaccount.com" },
            "oidcIssuer": { "const": "https://accounts.google.com" },
            "bundlePath": { "type": "string", "pattern": "^runs/installer-oci-signatures/.+/signature\\.sigstore\\.json$" },
            "bundleSHA256": { "type": "string", "pattern": "^[0-9a-f]{64}$" },
            "payloadPath": { "type": "string", "pattern": "^runs/installer-oci-signatures/.+/signature-payload\\.json$" },
            "payloadSHA256": { "type": "string", "pattern": "^[0-9a-f]{64}$" },
            "registryAttached": { "const": true },
            "registryAnonymousRead": { "const": true }
          }
        },
        "verification": {
          "type": "object",
          "additionalProperties": false,
          "required": ["result", "command", "outputPath", "outputSHA256", "payloadCommand", "payloadOutputPath", "payloadOutputSHA256", "cosignVersion"],
          "properties": {
            "result": { "const": "pass" },
            "command": { "type": "string", "minLength": 1 },
            "outputPath": { "type": "string", "pattern": "^runs/installer-oci-signatures/.+/verification\\.json$" },
            "outputSHA256": { "type": "string", "pattern": "^[0-9a-f]{64}$" },
            "payloadCommand": { "type": "string", "minLength": 1 },
            "payloadOutputPath": { "type": "string", "pattern": "^runs/installer-oci-signatures/.+/payload-verification\\.txt$" },
            "payloadOutputSHA256": { "type": "string", "pattern": "^[0-9a-f]{64}$" },
            "cosignVersion": { "const": "v3.1.3" }
          }
        },
        "annotations": {
          "type": "object",
          "additionalProperties": false,
          "required": ["confighub.com/package-path", "confighub.com/package-sha256"],
          "properties": {
            "confighub.com/package-path": { "type": "string" },
            "confighub.com/package-sha256": { "type": "string", "pattern": "^[0-9a-f]{64}$" }
          }
        },
        "scope": {
          "type": "object",
          "additionalProperties": false,
          "required": ["proves", "doesNotProve"],
          "properties": {
            "proves": { "type": "array", "minItems": 1, "items": { "type": "string" } },
            "doesNotProve": { "type": "array", "minItems": 1, "items": { "type": "string" } }
          }
        }
      }
    }
  },
  "definitions": {
    "digest": { "type": "string", "pattern": "^sha256:[0-9a-f]{64}$" }
  }
}