{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://tektum.github.io/verity-images/catalog.schema.json",
  "title": "Verity Images Catalog",
  "type": "object",
  "additionalProperties": false,
  "required": ["schemaVersion", "publishedAt", "source", "policy", "images"],
  "$defs": {
    "severityCounts": {
      "type": "object",
      "additionalProperties": false,
      "properties": {
        "critical": {"type": "integer", "minimum": 0},
        "high": {"type": "integer", "minimum": 0},
        "medium": {"type": "integer", "minimum": 0},
        "low": {"type": "integer", "minimum": 0},
        "negligible": {"type": "integer", "minimum": 0},
        "unknown": {"type": "integer", "minimum": 0}
      }
    },
    "deltaCounts": {
      "type": "object",
      "additionalProperties": false,
      "properties": {
        "critical": {"type": "integer"},
        "high": {"type": "integer"},
        "medium": {"type": "integer"},
        "low": {"type": "integer"},
        "negligible": {"type": "integer"},
        "unknown": {"type": "integer"}
      }
    },
    "scan": {
      "oneOf": [
        {
          "type": "object",
          "additionalProperties": false,
          "required": ["all", "fixable"],
          "properties": {
            "all": {"$ref": "#/$defs/severityCounts"},
            "fixable": {"const": 0}
          }
        },
        {
          "type": "object",
          "additionalProperties": false,
          "required": ["upstream", "final", "delta", "fixable"],
          "properties": {
            "upstream": {"$ref": "#/$defs/severityCounts"},
            "final": {"$ref": "#/$defs/severityCounts"},
            "delta": {"$ref": "#/$defs/deltaCounts"},
            "fixable": {"const": 0}
          }
        }
      ]
    }
  },
  "properties": {
    "schemaVersion": {"const": 2},
    "publishedAt": {"type": "string", "format": "date-time"},
    "source": {
      "type": "object",
      "additionalProperties": false,
      "required": ["runId", "runUrl", "commit"],
      "properties": {
        "runId": {"type": "string", "pattern": "^[0-9]+$"},
        "runUrl": {"type": "string", "format": "uri", "pattern": "^https://github.com/tektum/verity-images/actions/runs/"},
        "commit": {"type": "string", "pattern": "^[0-9a-f]{40}$"}
      }
    },
    "policy": {
      "type": "object",
      "additionalProperties": false,
      "required": ["fixableVulnerabilitiesAllowed", "sbomFormat", "cosignMinimumVersion", "certificateIdentity", "certificateIssuer"],
      "properties": {
        "fixableVulnerabilitiesAllowed": {"const": 0},
        "sbomFormat": {"const": "SPDX-JSON"},
        "cosignMinimumVersion": {"const": "3.0.6"},
        "certificateIdentity": {"type": "string", "format": "uri"},
        "certificateIssuer": {"const": "https://token.actions.githubusercontent.com"}
      }
    },
    "images": {
      "type": "array",
      "minItems": 1,
      "items": {
        "type": "object",
        "additionalProperties": false,
        "required": ["description", "digest", "name", "reference", "registry", "scan", "scanArtifact", "tags", "track", "verification", "version"],
        "properties": {
          "category": {
            "enum": [
              "Languages & Build Tools",
              "Web Servers & Proxies",
              "Databases & Caching",
              "Messaging & Streaming",
              "Kubernetes & Orchestration",
              "Service Mesh & Networking",
              "Monitoring & Observability",
              "Logging",
              "CI/CD & GitOps",
              "Security & Identity",
              "Policy & Compliance",
              "Cert Management",
              "Data & ML",
              "Base & Utilities"
            ]
          },
          "description": {"type": "string", "minLength": 1},
          "digest": {"type": "string", "pattern": "^sha256:[0-9a-f]{64}$"},
          "inputDigest": {"type": "string", "pattern": "^sha256:[0-9a-f]{64}$"},
          "name": {"type": "string", "pattern": "^[a-z0-9]+(?:[._-][a-z0-9]+)*$"},
          "reference": {"type": "string", "pattern": "^ghcr.io/tektum/[a-z0-9._-]+@sha256:[0-9a-f]{64}$"},
          "registry": {"type": "string", "pattern": "^ghcr.io/tektum/[a-z0-9._-]+$"},
          "runId": {"type": "string", "pattern": "^[0-9]+$"},
          "runUrl": {"type": "string", "format": "uri", "pattern": "^https://github.com/tektum/verity-images/actions/runs/"},
          "scan": {"$ref": "#/$defs/scan"},
          "scanArtifact": {"type": "string", "pattern": "^scan-[a-z0-9._-]+-[a-zA-Z0-9._-]+$"},
          "sourceCommit": {"type": "string", "pattern": "^[0-9a-f]{40}$"},
          "tags": {"type": "array", "minItems": 2, "uniqueItems": true, "items": {"type": "string", "minLength": 1}},
          "track": {"enum": ["wolfi", "patched"]},
          "verification": {
            "type": "object",
            "additionalProperties": false,
            "required": ["signature", "sbom", "provenance"],
            "properties": {
              "signature": {"type": "string", "minLength": 1},
              "sbom": {"type": "string", "minLength": 1},
              "provenance": {"type": "string", "minLength": 1}
            }
          },
          "validatedAt": {"type": "string", "format": "date-time"},
          "version": {"type": "string", "minLength": 1}
        }
      }
    }
  }
}