Schema reference

`envelope.schema.json`

The DSSE envelope. Signatures authenticate exact payload bytes and nothing about authorization.

Title: Makoto v0.2 DSSE Envelope
Identifier: https://usemakoto.dev/schema/v0.2/envelope.schema.json
Digest: sha256:49de7cf790e3a0c7bd3b83ee7322164d2a5a829648fe1407c79c07f4d74a0f66
Raw: /schema/v0.2/envelope.schema.json
Carried in: Every signed file in a bundle: attestations/<digest>.dsse.json carries one statement, and manifest.dsse.json carries the handoff.
Responsibility: DSSE transport fields, payload type, base64 payload, and signature entries.

A real instance. Read from

demos/end-to-end/artifacts/positive-bundle/attestations/1f28b72bcd4c1e9b7df71403ac6bb1670c2f2b09628ca6d76a2fa384db9a0848.dsse.json

, which validates against this schema.

{
  "payload": "eyJfdHlwZSI6Imh0dHBzOi8vaW4tdG90by5pby9TdGF0ZW1lbnQvdjEiLCJwcmVkaWNhdGUiOnsiZXZlbnQiOnsiaWQiOiJ1cm46dXVpZDoyMjIyMjIyMi0yMjIyLTQyMjItODIyMi0yMjIyMjIyMjIyMjIiLCJvY2N1cnJlZEF0IjoiMjAyNi0wOS0xNlQxNjowMDowMFoifSwiaW5wdXRzIjpbeyJkaWdlc3QiOnsic2hhMjU2IjoiNGU5MDE4MWU3Zjc1Y2NkZjBlNGQ4MWM4M2QyODFmNTM4MDZiZWQyNDE3ODdjZGM3NTFlMjJiMmQ0Y2QxOTkxOSJ9LCJuYW1lIjoicmF3IiwicHJvdmVuYW5jZSI6eyJzdGF0ZW1lbnREaWdlc3QiOnsic2hhMjU2IjoiNTZiN2JlNDM5NGZlMDljNjJlYzdhM2Q1NzYzY2VjYzI1MWU5Njk2ZjI2N2YzNWIyYWNjNzE3YjBkMTcwYTI3YSJ9LCJzdWJqZWN0TmFtZSI6ImN1c3RvbWVycy5yYXcuanNvbiJ9fV0sIm9wZXJhdGlvbiI6eyJuYW1lIjoiTm9ybWFsaXplIGN1c3RvbWVyIHJlY29yZHMiLCJ0eXBlIjoidXJuOm1ha290bzpkZW1vOm9wZXJhdGlvbjpub3JtYWxpemUifSwicHJvZmlsZXMiOltdLCJzY2hlbWFWZXJzaW9uIjoiMC4yIn0sInByZWRpY2F0ZVR5cGUiOiJodHRwczovL3VzZW1ha290by5kZXYvcHJlZGljYXRlL3YwLjIvdHJhbnNmb3JtIiwic3ViamVjdCI6W3siZGlnZXN0Ijp7InNoYTI1NiI6IjQyMWUxOWNmMDAyYWEyNWNmNmYyZjllZDc4OGUwNGM5YmFkZmQ5Y2JjNmIwMDAzMGIwYjA4OTgxMGIyYWU0ZjgifSwibmFtZSI6ImN1c3RvbWVycy5ub3JtYWxpemVkLmpzb24ifV19",
  "payloadType": "application/vnd.in-toto+json",
  "signatures": [
    {
      "keyid": "sha256:47dea58ea00fae9417ee19d76755bfef690899021132effb04fe1f9e4f0c8059",
      "sig": "WdgKRlEOVDNhGiDOeRy0UAHA9hpZQOTviOnW/sT+lOWBuHFid0EWdqF5VxB3PbFXlfEM/aPGbXppLRIdIRmGBA=="
    }
  ]
}

Fields

Top level signature

Top level#

Shape object

closed object

Field	Type	Constraints, rules, and a real value
payloadType required	string	min length 3 max length 255 `"application/vnd.in-toto+json"`
payload required	string	`"eyJfdHlwZSI6Imh0dHBzOi8vaW4tdG90by5pby9TdGF0ZW1lbnQvdjEiLCJwcmVkaWNhdGUiOnsiZXZlbnQiOnsiaWQiOi…`
signatures required	array of signature	min items 1 `[{"keyid": "sha256:47dea58ea00fae9417ee19d76755bfef690899021132effb04fe1f9e4f0c8059", "sig": "W…`

signature#

Shape object

closed object

Appears at signatures[]

Field	Type	Constraints, rules, and a real value
keyid required	string	min length 71 max length 71 `"sha256:47dea58ea00fae9417ee19d76755bfef690899021132effb04fe1f9e4f0c8059"`
sig required	string	min length 88 max length 88 `"WdgKRlEOVDNhGiDOeRy0UAHA9hpZQOTviOnW/sT+lOWBuHFid0EWdqF5VxB3PbFXlfEM/aPGbXppLRIdIRmGBA=="`

Real documents that validate

demos/end-to-end/artifacts/positive-bundle/attestations/1f28b72bcd4c1e9b7df71403ac6bb1670c2f2b09628ca6d76a2fa384db9a0848.dsse.json
demos/end-to-end/artifacts/positive-bundle/attestations/56b7be4394fe09c62ec7a3d5763cecc251e9696f267f35b2acc717b0d170a27a.dsse.json
demos/end-to-end/artifacts/positive-bundle/attestations/99aee76db46a720405da6d0015d427c791b0d4e02367b9e2bc36ce82ae812bce.dsse.json
demos/end-to-end/artifacts/positive-bundle/manifest.dsse.json

Raw JSON

The published document (943 bytes)

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://usemakoto.dev/schema/v0.2/envelope.schema.json",
  "title": "Makoto v0.2 DSSE Envelope",
  "type": "object",
  "required": ["payloadType", "payload", "signatures"],
  "properties": {
    "payloadType": {
      "type": "string",
      "minLength": 3,
      "maxLength": 255
    },
    "payload": { "type": "string" },
    "signatures": {
      "type": "array",
      "minItems": 1,
      "items": { "$ref": "#/$defs/signature" }
    }
  },
  "$defs": {
    "signature": {
      "type": "object",
      "required": ["keyid", "sig"],
      "properties": {
        "keyid": {
          "type": "string",
          "minLength": 71,
          "maxLength": 71
        },
        "sig": {
          "type": "string",
          "minLength": 88,
          "maxLength": 88
        }
      },
      "additionalProperties": false
    }
  },
  "additionalProperties": false
}

The published bytes, unmodified.