com.pipobscure.bundle.attestation

{
  "$type": "com.atproto.lexicon.schema",
  "defs": {
    "main": {
      "description": "A statement by the repository's owner about a bundle — that they vouch for it, or that it is bad — identified by its whole-file hash — the hash a bundle signature covers — or about a suite, identified by the hash of what it says (see com.pipobscure.bundle.suite). The record key is that hash in lowercase hex, so there is at most one attestation per account per bundle or suite, and a verifier knows which record to ask for. A good attestation of a suite counts for each bundle installed from it; a bad one refuses the suite, and does not carry over to its bundles.",
      "key": "any",
      "record": {
        "properties": {
          "createdAt": {
            "description": "When the attester made the attestation, by their own clock.",
            "format": "datetime",
            "type": "string"
          },
          "hash": {
            "description": "The whole-file hash as '<algorithm>:<lowercase hex>', e.g. 'sha256:3f1a…'. Must equal the algorithm the bundle's manifest declares and the record key. For a suite: 'sha256:' and the sha256 of the DAG-CBOR encoding of { members }, each member as the suite record carries it.",
            "maxLength": 256,
            "type": "string"
          },
          "kind": {
            "description": "What is being vouched for. A policy can require a particular kind from a particular attester.",
            "knownValues": [
              "published",
              "audited",
              "reproduced",
              "malware",
              "vulnerable",
              "abandoned",
              "permitted",
              "prohibited"
            ],
            "maxLength": 64,
            "type": "string"
          },
          "note": {
            "description": "Context for the attestation, in the attester's own words: why they vouch for it, or what is wrong with it. Informational only; shown with the attestation wherever it is shown.",
            "maxGraphemes": 300,
            "maxLength": 3000,
            "type": "string"
          },
          "post": {
            "description": "A post that gives the context for the attestation: the attester's own, or anyone's. Optional, and informational only; shown with the attestation, as a link. Pinned to the version it names by its CID.",
            "ref": "com.atproto.repo.strongRef",
            "type": "ref"
          },
          "verdict": {
            "description": "Whether the attester vouches for the bundle or warns against it. Absent means good. Only good verdicts count towards a requirement; a bad verdict is shown to anyone installing the bundle, and refuses it under a policy that blocks on this attester.",
            "knownValues": [
              "good",
              "bad"
            ],
            "maxLength": 16,
            "type": "string"
          }
        },
        "required": [
          "hash",
          "createdAt"
        ],
        "type": "object"
      },
      "type": "record"
    }
  },
  "id": "com.pipobscure.bundle.attestation",
  "lexicon": 1
}