Lexicon Garden

com.pipobscure.bundle.attestation

A statement by the repository's owner about a bundle — that they vouch for it, or that it is bad — identified by its whole-file hash — the hash a bundle signature covers — or about a suite, identified by the hash of what it says (see com.pipobscure.bundle.suite). The record key is that hash in lowercase hex, so there is at most one attestation per account per bundle or suite, and a verifier knows which record to ask for. A good attestation of a suite counts for each bundle installed from it; a bad one refuses the suite, and does not carry over to its bundles.

Repository @pipobscure.com did:plc:rwypz6edxmzyhob2k3rsl2fw namespace authority
Details · record, key any
Kindrecord
Record keyany
Authoritybundle.pipobscure.com
Indexed
Compare Edit in builder → Fork →

Record

record · key any

Properties

createdAt

requiredstring · datetime

When the attester made the attestation, by their own clock.

hash

requiredstring

The whole-file hash as '<algorithm>:<lowercase hex>', e.g. 'sha256:3f1a…'. Must equal the algorithm the bundle's manifest declares and the record key. For a suite: 'sha256:' and the sha256 of the DAG-CBOR encoding of { members }, each member as the suite record carries it.

  • maxLength: 256

kind

string

What is being vouched for. A policy can require a particular kind from a particular attester.

  • maxLength: 64
  • knownValues: published | audited | reproduced | malware | vulnerable | abandoned | permitted | prohibited

note

string

Context for the attestation, in the attester's own words: why they vouch for it, or what is wrong with it. Informational only; shown with the attestation wherever it is shown.

  • maxLength: 3000
  • maxGraphemes: 300

post

ref

A post that gives the context for the attestation: the attester's own, or anyone's. Optional, and informational only; shown with the attestation, as a link. Pinned to the version it names by its CID.

Reference

verdict

string

Whether the attester vouches for the bundle or warns against it. Absent means good. Only good verdicts count towards a requirement; a bad verdict is shown to anyone installing the bundle, and refuses it under a policy that blocks on this attester.

  • maxLength: 16
  • knownValues: good | bad

Similar lexicons

semantic match

Lexicons whose schemas describe something close to this one. Check them before publishing a new one that overlaps.

  • com.pipobscure.bundle.suite

    record

    A set of listed bundles the repository's owner makes available to install together, under a name: the record key. Installing the suite installs each member as it would be installed by itself, and an update follows the suite as members are added and taken out. The suite vouches for none of them: each member is reviewed and verified on its own. What it can do is set a minimum — a signer and attesters a member must carry — below which that member is refused.

  • app.certified.signature.proof

    record

    A remote attestation proof record holding the CID of attested content. Lives in the attestor's repository and is referenced from the attested record's `signatures` array via `com.atproto.repo.strongRef`. Conforms to the ATProtocol Attestation Specification.

  • com.blueyvatar.attestation

    record not from the namespace authority

    Written to the service repo. The service's result for one com.blueyvatar.claim.

  • network.attested.payment.proof

    record

    A remote attestation record stored in the attestor's repository (creator or broker). Referenced via com.atproto.repo.strongRef in the payment record's signatures array. The attestation CID is computed per the badge.blue spec from the payment record, attestation metadata, and the repository DID — meaning a record copied to a different repository automatically invalidates all its attestations.

  • monster.attest.vouch

    record not from the namespace authority

    'I know this person': the author vouches for another account. Vouching costs the voucher in trust computations. Delete to retract. Mirrors sh.tangled.graph.vouch where a subject is known there. Record key: a base32 sha256 of the subject/target, so there is one per author per subject.