Lexicon Garden

com.pipobscure.bundle.suite

A set of listed bundles the repository's owner makes available to install together, under a name: the record key. Installing the suite installs each member as it would be installed by itself, and an update follows the suite as members are added and taken out. The suite vouches for none of them: each member is reviewed and verified on its own. What it can do is set a minimum — a signer and attesters a member must carry — below which that member is refused.

Repository @pipobscure.com did:plc:rwypz6edxmzyhob2k3rsl2fw namespace authority
Details · record, key any
Kindrecord
Record keyany
Authoritybundle.pipobscure.com
Indexed
Compare Edit in builder → Fork →

Record

record · key any

Properties

createdAt

requiredstring · datetime

When the suite was first published, by the publisher's clock.

description

string

What the suite is for, in a sentence or two.

  • maxLength: 3000
  • maxGraphemes: 300

members

requiredarray

The listings installed together.

  • minLength: 1
  • maxLength: 64
itemsref
Reference

subject

requiredstring · uri

'sha256:44d3324ff44da0b4d3efde1810c8cb88bdad5e673d99b011d9072714d884670d', the sha256 of this lexicon's NSID, the same in every suite, so that a backlink index can enumerate every suite on the network.

  • maxLength: 2048

title

string

A display name; the record key stands in when it is absent.

  • maxLength: 640
  • maxGraphemes: 64

#member

object

One listed bundle in a suite, where it goes, and what it must carry.

Properties

for

string

Install it as a plugin, rather than onto the PATH: for the app installed from the listing at this at:// address, or into this scope — a package name, such as a suite's shared scope. Without it, an app's listing installs onto the PATH, and a plugin's for the app its listing names.

  • maxLength: 2048

listing

requiredstring · at-uri

The at:// address of a com.pipobscure.bundle.listing record, with the publisher's DID. It may be anyone's.

  • maxLength: 2048

require

ref
Reference

#require

object

What a member must carry to be installed at all: the suite's minimum, checked at install and at every update. Meeting it vouches for nothing; whoever installs still decides whom to accept.

Properties

attesters

array

Who must have attested it, each as '[kind@]<did>'.

  • maxLength: 32
itemsstring
  • maxLength: 2048

identity

string

The sigstore identity that must have signed it.

  • maxLength: 2048

issuer

string · uri

The OIDC issuer that must have vouched for that identity: an https URL.

  • maxLength: 2048

quorum

integer

How many of the attesters must have attested it (default: all of them).

  • minimum: 1

Similar lexicons

semantic match

Lexicons whose schemas describe something close to this one. Check them before publishing a new one that overlaps.

  • com.pipobscure.bundle.listing

    record

    A bundle the repository's owner makes available under a name: the record key, which is also what it installs as. It is an app, or a plugin for one, as its subject says. The record says only where the bundle is fetched from — a url, or a domain whose 'nzip:' TXT record names one, exactly one of the two. It vouches for nothing, and whatever is fetched is verified like any other download.

  • com.pipobscure.bundle.attestation

    record

    A statement by the repository's owner about a bundle — that they vouch for it, or that it is bad — identified by its whole-file hash — the hash a bundle signature covers — or about a suite, identified by the hash of what it says (see com.pipobscure.bundle.suite). The record key is that hash in lowercase hex, so there is at most one attestation per account per bundle or suite, and a verifier knows which record to ask for. A good attestation of a suite counts for each bundle installed from it; a b