com.pipobscure.bundle.attestation

pipobscure.com

Documentation

A statement by the repository's owner about a bundle — that they vouch for it, or that it is bad — identified by its whole-file hash — the hash a bundle signature covers — or about a suite, identified by the hash of what it says (see com.pipobscure.bundle.suite). The record key is that hash in lowercase hex, so there is at most one attestation per account per bundle or suite, and a verifier knows which record to ask for. A good attestation of a suite counts for each bundle installed from it; a bad one refuses the suite, and does not carry over to its bundles.

main record

A statement by the repository's owner about a bundle — that they vouch for it, or that it is bad — identified by its whole-file hash — the hash a bundle signature covers — or about a suite, identified by the hash of what it says (see com.pipobscure.bundle.suite). The record key is that hash in lowercase hex, so there is at most one attestation per account per bundle or suite, and a verifier knows which record to ask for. A good attestation of a suite counts for each bundle installed from it; a bad one refuses the suite, and does not carry over to its bundles.

Record Key any Any valid record key

Properties

createdAt string datetime Required

When the attester made the attestation, by their own clock.

hash string Required

The whole-file hash as '<algorithm>:<lowercase hex>', e.g. 'sha256:3f1a…'. Must equal the algorithm the bundle's manifest declares and the record key. For a suite: 'sha256:' and the sha256 of the DAG-CBOR encoding of { members }, each member as the suite record carries it.

maxLength: 256 bytes
kind string Optional

What is being vouched for. A policy can require a particular kind from a particular attester.

maxLength: 64 bytes
Known values: published, audited, reproduced, malware, vulnerable, abandoned, permitted, prohibited
note string Optional

Context for the attestation, in the attester's own words: why they vouch for it, or what is wrong with it. Informational only; shown with the attestation wherever it is shown.

maxLength: 3000 bytesmaxGraphemes: 300 graphemes
post ref com.atproto.repo.strongRef Optional

A post that gives the context for the attestation: the attester's own, or anyone's. Optional, and informational only; shown with the attestation, as a link. Pinned to the version it names by its CID.

verdict string Optional

Whether the attester vouches for the bundle or warns against it. Absent means good. Only good verdicts count towards a requirement; a bad verdict is shown to anyone installing the bundle, and refuses it under a policy that blocks on this attester.

maxLength: 16 bytes
Known values: good, bad
View raw schema 
{
  "description": "A statement by the repository's owner about a bundle — that they vouch for it, or that it is bad — identified by its whole-file hash — the hash a bundle signature covers — or about a suite, identified by the hash of what it says (see com.pipobscure.bundle.suite). The record key is that hash in lowercase hex, so there is at most one attestation per account per bundle or suite, and a verifier knows which record to ask for. A good attestation of a suite counts for each bundle installed from it; a bad one refuses the suite, and does not carry over to its bundles.",
  "key": "any",
  "record": {
    "properties": {
      "createdAt": {
        "description": "When the attester made the attestation, by their own clock.",
        "format": "datetime",
        "type": "string"
      },
      "hash": {
        "description": "The whole-file hash as '<algorithm>:<lowercase hex>', e.g. 'sha256:3f1a…'. Must equal the algorithm the bundle's manifest declares and the record key. For a suite: 'sha256:' and the sha256 of the DAG-CBOR encoding of { members }, each member as the suite record carries it.",
        "maxLength": 256,
        "type": "string"
      },
      "kind": {
        "description": "What is being vouched for. A policy can require a particular kind from a particular attester.",
        "knownValues": [
          "published",
          "audited",
          "reproduced",
          "malware",
          "vulnerable",
          "abandoned",
          "permitted",
          "prohibited"
        ],
        "maxLength": 64,
        "type": "string"
      },
      "note": {
        "description": "Context for the attestation, in the attester's own words: why they vouch for it, or what is wrong with it. Informational only; shown with the attestation wherever it is shown.",
        "maxGraphemes": 300,
        "maxLength": 3000,
        "type": "string"
      },
      "post": {
        "description": "A post that gives the context for the attestation: the attester's own, or anyone's. Optional, and informational only; shown with the attestation, as a link. Pinned to the version it names by its CID.",
        "ref": "com.atproto.repo.strongRef",
        "type": "ref"
      },
      "verdict": {
        "description": "Whether the attester vouches for the bundle or warns against it. Absent means good. Only good verdicts count towards a requirement; a bad verdict is shown to anyone installing the bundle, and refuses it under a policy that blocks on this attester.",
        "knownValues": [
          "good",
          "bad"
        ],
        "maxLength": 16,
        "type": "string"
      }
    },
    "required": [
      "hash",
      "createdAt"
    ],
    "type": "object"
  },
  "type": "record"
}

Lexicon Garden

@