{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://usemakoto.dev/schema/v0.3/trust-policy.schema.json",
  "title": "Makoto v0.3 Consumer Trust Policy",
  "type": "object",
  "required": ["version", "keys", "rules", "handoff", "requiredProfiles", "limits"],
  "properties": {
    "version": { "const": "0.3" },
    "keys": {
      "type": "object",
      "propertyNames": { "type": "string", "minLength": 71, "maxLength": 71 },
      "additionalProperties": { "$ref": "#/$defs/key" }
    },
    "keylessIdentities": {
      "type": "object",
      "propertyNames": { "type": "string", "minLength": 71, "maxLength": 71 },
      "additionalProperties": { "$ref": "#/$defs/keylessIdentity" }
    },
    "sigstoreTrustRoot": { "$ref": "#/$defs/resourceDescriptor" },
    "rules": {
      "type": "array",
      "maxItems": 1024,
      "items": { "$ref": "#/$defs/rule" }
    },
    "handoff": { "$ref": "#/$defs/handoffRule" },
    "requiredProfiles": {
      "type": "array",
      "items": { "$ref": "#/$defs/requiredProfile" }
    },
    "verificationSummary": { "$ref": "#/$defs/verificationSummary" },
    "limits": { "$ref": "#/$defs/limits" }
  },
  "$defs": {
    "digest": {
      "type": "object",
      "required": ["sha256"],
      "properties": { "sha256": { "type": "string", "minLength": 64, "maxLength": 64 } },
      "additionalProperties": false
    },
    "timestamp": {
      "type": "string",
      "minLength": 20,
      "maxLength": 30
    },
    "mediaType": {
      "type": "string",
      "maxLength": 255
    },
    "keyIds": {
      "type": "array",
      "minItems": 1,
      "items": { "type": "string", "minLength": 71, "maxLength": 71 }
    },
    "uris": {
      "type": "array",
      "minItems": 1,
      "items": { "type": "string", "minLength": 1, "maxLength": 4096 }
    },
    "key": {
      "type": "object",
      "required": ["type", "publicKey"],
      "properties": {
        "type": { "const": "ed25519" },
        "publicKey": { "type": "string", "minLength": 60, "maxLength": 60 },
        "label": { "type": "string", "maxLength": 4096 },
        "validFrom": { "$ref": "#/$defs/timestamp" },
        "validUntil": { "$ref": "#/$defs/timestamp" }
      },
      "additionalProperties": false
    },
    "keylessIdentity": {
      "type": "object",
      "required": ["type", "issuer", "subject"],
      "properties": {
        "type": { "const": "sigstore" },
        "issuer": { "type": "string", "minLength": 1, "maxLength": 4096 },
        "subject": { "type": "string", "minLength": 1, "maxLength": 4096 },
        "githubActions": {
          "type": "object",
          "required": ["repository", "workflowRef", "event"],
          "properties": {
            "repository": { "type": "string", "minLength": 3, "maxLength": 4096 },
            "workflowRef": { "type": "string", "minLength": 3, "maxLength": 4096 },
            "event": { "type": "string", "minLength": 1, "maxLength": 255 }
          },
          "additionalProperties": false
        }
      },
      "additionalProperties": false
    },
    "profileConstraint": {
      "type": "object",
      "required": ["id", "target"],
      "properties": {
        "id": { "type": "string", "minLength": 1, "maxLength": 4096 },
        "digest": { "$ref": "#/$defs/digest" },
        "closureDigest": { "$ref": "#/$defs/digest" },
        "target": { "enum": ["statement", "predicate"] }
      },
      "oneOf": [
        { "required": ["digest", "closureDigest"] },
        {
          "properties": {
            "digest": false,
            "closureDigest": false
          }
        }
      ],
      "additionalProperties": false
    },
    "rule": {
      "type": "object",
      "required": ["id", "predicateTypes", "minimumSignatures"],
      "properties": {
        "id": { "type": "string", "minLength": 1, "maxLength": 4096 },
        "predicateTypes": { "$ref": "#/$defs/uris" },
        "authorizedKeyIds": { "$ref": "#/$defs/keyIds" },
        "authorizedIdentityIds": { "$ref": "#/$defs/keyIds" },
        "minimumSignatures": { "type": "integer", "minimum": 1 },
        "sourceKinds": { "$ref": "#/$defs/uris" },
        "sourceUris": { "$ref": "#/$defs/uris" },
        "operationTypes": { "$ref": "#/$defs/uris" },
        "profileConstraints": {
          "type": "array",
          "minItems": 1,
          "items": { "$ref": "#/$defs/profileConstraint" }
        }
      },
      "anyOf": [
        { "required": ["authorizedKeyIds"] },
        { "required": ["authorizedIdentityIds"] }
      ],
      "additionalProperties": false
    },
    "handoffRule": {
      "type": "object",
      "required": [
        "minimumSignatures",
        "requireExpectedManifest",
        "requireExpectedHead",
        "requireExpectedArtifacts",
        "requireRecipient",
        "requireNonce",
        "allowReplayableHandoff"
      ],
      "properties": {
        "authorizedKeyIds": { "$ref": "#/$defs/keyIds" },
        "authorizedIdentityIds": { "$ref": "#/$defs/keyIds" },
        "minimumSignatures": { "type": "integer", "minimum": 1 },
        "requireExpectedManifest": { "type": "boolean" },
        "requireExpectedHead": { "type": "boolean" },
        "requireExpectedArtifacts": { "type": "boolean" },
        "requireRecipient": { "type": "boolean" },
        "requireNonce": { "type": "boolean" },
        "allowReplayableHandoff": { "type": "boolean" },
        "maxAgeSeconds": { "type": "integer", "minimum": 0, "maximum": 315576000 },
        "maxFutureSkewSeconds": { "type": "integer", "minimum": 0, "maximum": 315576000 }
      },
      "allOf": [
        {
          "anyOf": [
            { "required": ["authorizedKeyIds"] },
            { "required": ["authorizedIdentityIds"] }
          ]
        },
        {
          "oneOf": [
            { "required": ["maxAgeSeconds", "maxFutureSkewSeconds"] },
            {
              "properties": {
                "maxAgeSeconds": false,
                "maxFutureSkewSeconds": false
              }
            }
          ]
        }
      ],
      "additionalProperties": false
    },
    "requiredProfile": {
      "type": "object",
      "required": ["id", "digest", "closureDigest", "target", "subjectName", "mediaType", "scope"],
      "properties": {
        "id": { "type": "string", "minLength": 1, "maxLength": 4096 },
        "digest": { "$ref": "#/$defs/digest" },
        "closureDigest": { "$ref": "#/$defs/digest" },
        "target": { "const": "artifact" },
        "subjectName": { "type": "string", "minLength": 1, "maxLength": 4096 },
        "mediaType": { "$ref": "#/$defs/mediaType" },
        "scope": { "const": "eachMatchingFinalArtifact" }
      },
      "additionalProperties": false
    },
    "resourceDescriptor": {
      "type": "object",
      "required": ["uri", "digest"],
      "properties": {
        "uri": { "type": "string", "minLength": 1, "maxLength": 4096 },
        "digest": { "$ref": "#/$defs/digest" }
      },
      "additionalProperties": false
    },
    "assessmentProfile": {
      "type": "object",
      "required": ["id", "digest", "closureDigest", "target"],
      "properties": {
        "id": { "type": "string", "minLength": 1, "maxLength": 4096 },
        "digest": { "$ref": "#/$defs/digest" },
        "closureDigest": { "$ref": "#/$defs/digest" },
        "target": { "enum": ["statement", "predicate"] }
      },
      "additionalProperties": false
    },
    "vsaVerifier": {
      "type": "object",
      "required": [
        "id", "verifierId", "authorizedKeyIds", "minimumSignatures", "policy", "resourceUri",
        "allowedVerifiedLevels", "independenceGroup"
      ],
      "properties": {
        "id": { "type": "string", "minLength": 1, "maxLength": 4096 },
        "verifierId": { "type": "string", "minLength": 1, "maxLength": 4096 },
        "authorizedKeyIds": { "$ref": "#/$defs/keyIds" },
        "minimumSignatures": { "type": "integer", "minimum": 1 },
        "policy": { "$ref": "#/$defs/resourceDescriptor" },
        "resourceUri": { "type": "string", "minLength": 1, "maxLength": 4096 },
        "allowedVerifiedLevels": {
          "type": "array",
          "minItems": 1,
          "items": {
            "enum": [
              "MAKOTO_ORIGIN_LEVEL_2", "MAKOTO_ORIGIN_LEVEL_3",
              "MAKOTO_TRANSFORM_LEVEL_2", "MAKOTO_TRANSFORM_LEVEL_3"
            ]
          }
        },
        "independenceGroup": { "type": "string", "minLength": 1, "maxLength": 4096 },
        "requiredProfiles": {
          "type": "array",
          "minItems": 1,
          "items": { "$ref": "#/$defs/assessmentProfile" }
        },
        "requiredControlEvidence": {
          "type": "array",
          "minItems": 1,
          "items": { "$ref": "#/$defs/resourceDescriptor" }
        }
      },
      "additionalProperties": false
    },
    "verificationSummary": {
      "type": "object",
      "required": [
        "resourceUri", "summaryPolicy", "requiredVerifiedLevels",
        "requiredProperties", "verifiers"
      ],
      "properties": {
        "resourceUri": { "type": "string", "minLength": 1, "maxLength": 4096 },
        "summaryPolicy": { "$ref": "#/$defs/resourceDescriptor" },
        "requiredVerifiedLevels": {
          "type": "array",
          "items": {
            "enum": [
              "MAKOTO_ORIGIN_LEVEL_1", "MAKOTO_ORIGIN_LEVEL_2",
              "MAKOTO_ORIGIN_LEVEL_3", "MAKOTO_TRANSFORM_LEVEL_1",
              "MAKOTO_TRANSFORM_LEVEL_2", "MAKOTO_TRANSFORM_LEVEL_3"
            ]
          }
        },
        "requiredProperties": {
          "type": "array",
          "items": {
            "enum": [
              "MAKOTO_AUTHORIZED", "MAKOTO_GRAPH_COMPLETE",
              "MAKOTO_FRESHNESS_ANCHORED", "MAKOTO_SCHEMA_CONFORMANT",
              "MAKOTO_REPRODUCED"
            ]
          }
        },
        "verifiers": {
          "type": "array",
          "items": { "$ref": "#/$defs/vsaVerifier" }
        }
      },
      "additionalProperties": false
    },
    "positiveInteger": { "type": "integer", "minimum": 1 },
    "limits": {
      "type": "object",
      "required": [
        "maxBundleFiles", "maxMetadataBytes", "maxArtifactBytesPerFile",
        "maxAggregateArtifactBytes", "maxSnapshotBytes", "maxArtifactValidationBytes",
        "maxJsonDepth", "maxJsonNumberChars", "maxJsonExponentMagnitude",
        "maxSchemaBytes", "maxSchemaResources", "maxSchemaEvaluationDepth",
        "maxSchemaOperations", "maxRegexLength", "profileEvaluationTimeoutSeconds",
        "profileWorkerMemoryBytes", "maxNdjsonLineBytes", "maxSignaturesTotal",
        "maxProfileEvaluations", "maxDiagnostics", "maxReportRecords", "maxReportBytes"
      ],
      "properties": {
        "maxBundleFiles": { "type": "integer", "minimum": 1, "maximum": 20000 },
        "maxMetadataBytes": { "type": "integer", "minimum": 1, "maximum": 268435456 },
        "maxArtifactBytesPerFile": { "type": "integer", "minimum": 1, "maximum": 1099511627776 },
        "maxAggregateArtifactBytes": { "type": "integer", "minimum": 1, "maximum": 2199023255552 },
        "maxSnapshotBytes": { "type": "integer", "minimum": 1, "maximum": 2199023255552 },
        "maxArtifactValidationBytes": { "type": "integer", "minimum": 1, "maximum": 1073741824 },
        "maxJsonDepth": { "type": "integer", "minimum": 8, "maximum": 256 },
        "maxJsonNumberChars": { "type": "integer", "minimum": 1, "maximum": 4096 },
        "maxJsonExponentMagnitude": { "type": "integer", "minimum": 1, "maximum": 100000 },
        "maxSchemaBytes": { "type": "integer", "minimum": 1, "maximum": 268435456 },
        "maxSchemaResources": { "type": "integer", "minimum": 1, "maximum": 4096 },
        "maxSchemaEvaluationDepth": { "type": "integer", "minimum": 1, "maximum": 1024 },
        "maxSchemaOperations": { "type": "integer", "minimum": 1, "maximum": 1000000000 },
        "maxRegexLength": { "type": "integer", "minimum": 1, "maximum": 65536 },
        "profileEvaluationTimeoutSeconds": { "type": "integer", "minimum": 1, "maximum": 60 },
        "profileWorkerMemoryBytes": { "type": "integer", "minimum": 1, "maximum": 4294967296 },
        "maxNdjsonLineBytes": { "type": "integer", "minimum": 1, "maximum": 67108864 },
        "maxSignaturesTotal": { "type": "integer", "minimum": 1, "maximum": 100000 },
        "maxProfileEvaluations": { "type": "integer", "minimum": 1, "maximum": 100000 },
        "maxDiagnostics": { "type": "integer", "minimum": 1, "maximum": 100000 },
        "maxReportRecords": { "type": "integer", "minimum": 64, "maximum": 200000 },
        "maxReportBytes": { "type": "integer", "minimum": 65536, "maximum": 268435456 }
      },
      "additionalProperties": false
    }
  },
  "additionalProperties": false
}