Lexicon Garden

io.atcr.hold.scan

Vulnerability scan results for a container manifest. Stored in the hold's embedded PDS. Record key is deterministic: the manifest digest hex without the 'sha256:' prefix, so re-scans upsert the existing record.

Repository did:web:lexicon.atcr.io namespace authority
Details · record, key any
Kindrecord
Record keyany
Authorityhold.atcr.io
Indexed
Compare Edit in builder → Fork →

Record

record · key any

Properties

critical

requiredinteger

Count of critical severity vulnerabilities

  • minimum: 0

high

requiredinteger

Count of high severity vulnerabilities

  • minimum: 0

low

requiredinteger

Count of low severity vulnerabilities

  • minimum: 0

manifest

requiredstring · at-uri

AT-URI of the scanned manifest (e.g., at://did:plc:xyz/io.atcr.manifest/abc123...)

medium

requiredinteger

Count of medium severity vulnerabilities

  • minimum: 0

reason

string

Optional human-readable explanation for non-ok status (e.g. 'unscannable artifact type application/vnd.cncf.helm.config.v1+json').

  • maxLength: 256

repository

requiredstring

Repository name (e.g., myapp)

  • maxLength: 256

sbomBlob

blob

SBOM blob (SPDX JSON format) uploaded to the hold's blob storage

  • accept: application/spdx+json

scannedAt

requiredstring · datetime

RFC3339 timestamp of when the scan completed

scannerVersion

requiredstring

Version of the scanner that produced this result (e.g., atcr-scanner-v1.0.0)

  • maxLength: 64

status

string

Outcome of the scan attempt. 'ok' (or omitted, for back-compat) means the scanner produced an SBOM. 'failed' means the scanner ran but errored. 'skipped' means the scanner intentionally bypassed this artifact type (e.g. helm charts).

  • maxLength: 32
  • knownValues: ok | failed | skipped

total

requiredinteger

Total vulnerability count

  • minimum: 0

userDid

requiredstring · did

DID of the image owner

vulnReportBlob

blob

Grype vulnerability report blob (JSON) with full CVE details

  • accept: application/vnd.atcr.vulnerabilities+json

Similar lexicons

semantic match

Lexicons whose schemas describe something close to this one. Check them before publishing a new one that overlaps.

  • io.atcr.hold.subscribeScanJobs

    subscription

    Subscribe to vulnerability scan jobs via WebSocket. Scanners connect to receive pending scan jobs and send back results. Authenticated via shared secret (query parameter or X-Scanner-Secret header).