Skip to content

Commit 0773ad7

Browse files
theorytheory
committed
Add certs, JWS, payload schemas
Following [RFC 5], add new JSON schemas for a `certs` property containing JWS [JSON Serialization], supporting both the general and flattened syntaxes. The schemas are: * `certs.schema.json`: One or more certifications, with the `pgxn` property required. * `jws.schema.json`: JWS general and flattened [JSON Serialization] * `jws-header.schema.json`: JWS headers * `jwk.schema.json`: [RFC 7517] JSON Web Key (JWK) format, required by the `jwk` property of `jws-header.schema.json` * `payload.schema.json`: The PGXN release payload Include tests for each of these schemas, and fix comments for existing schema tests. [RFC 5]: pgxn/rfcs#5 [JSON Serialization]: https://datatracker.ietf.org/doc/html/rfc7515#section-7 [RFC 7517]: https://datatracker.ietf.org/doc/html/rfc7517
1 parent a5dbedd commit 0773ad7

File tree

6 files changed

+1675
-28
lines changed

6 files changed

+1675
-28
lines changed

‎schema/v2/certs.schema.json

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
{
2+
"$schema": "https://json-schema.org/draft/2020-12/schema",
3+
"$id": "https://pgxn.org/meta/v2/certs.schema.json",
4+
"title": "Certifications",
5+
"description": "One or more cryptographic signatures or certifications that attest to the authenticity or other characteristics of a distribution release.",
6+
"type": "object",
7+
"properties": {
8+
"pgxn": { "$ref": "jws.schema.json" }
9+
},
10+
"patternProperties": { "^[xX]_.": { "description": "Custom key" } },
11+
"additionalProperties": false,
12+
"required": ["pgxn"]
13+
}

‎schema/v2/jwk.schema.json

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
{
2+
"$schema": "https://json-schema.org/draft/2020-12/schema",
3+
"$id": "https://pgxn.org/meta/v2/jwk.schema.json",
4+
"title": "JSON Web Key",
5+
"description": "[RFC 7517](https://datatracker.ietf.org/doc/html/rfc7517) JSON Web Key (JWK) format. Supports both the general and flattened syntaxes.",
6+
"type": "object",
7+
"properties": {
8+
"kty": {
9+
"type": "string",
10+
"description": "Key Type: identifies the cryptographic algorithm family used with the key, such as “RSA” or “EC”."
11+
},
12+
"use": {
13+
"type": "string",
14+
"description": "Public Key Use: identifies the intended use of the public key — encrypting data (“enc”) or verifying the signature on data (“sig”)."
15+
},
16+
"key_ops": {
17+
"type": "array",
18+
"minItems": 1,
19+
"items": { "type": "string" },
20+
"description": "Key Operations: identifies the operation(s) for which the key is intended to be used, and intended for use cases in which public, private, or symmetric keys may be present."
21+
},
22+
"alg": {
23+
"type": "string",
24+
"description": "Algorithm: identifies the algorithm intended for use with the key."
25+
},
26+
"kid": {
27+
"type": "string",
28+
"description": "Key ID: used to match a specific key."
29+
},
30+
"x5u": {
31+
"type": "string",
32+
"format": "uri",
33+
"description": "X.509 URL: a URI that refers to a resource for an X.509 public key certificate or certificate chain"
34+
},
35+
"x5c": {
36+
"type": "array",
37+
"description": "X.509 Certificate Chain: contains a chain of one or more PKIX certificates",
38+
"minItems": 1,
39+
"items": {
40+
"type": "string",
41+
"pattern": "^[A-Za-z0-9+/]*={0,2}$",
42+
"description": "Base 64-encoded DER PKIX certificate value."
43+
}
44+
},
45+
"x5t": {
46+
"type": "string",
47+
"pattern": "^[A-Za-z0-9-_]{12,}$",
48+
"description": "X.509 Certificate SHA-1 Thumbprint: Base 64 URL-encoded SHA-1 thumbprint (a.k.a. digest) of the DER encoding of an X.509 certificate."
49+
},
50+
"x5t#S256": {
51+
"type": "string",
52+
"pattern": "^[A-Za-z0-9-_]{12,}$",
53+
"description": "X.509 Certificate SHA-256 Thumbprint: Base 64 URL-encoded SHA-256 thumbprint (a.k.a. digest) of the DER encoding of an X.509 certificate."
54+
}
55+
},
56+
"required": ["kty"],
57+
"examples": [
58+
{
59+
"kty": "EC",
60+
"crv": "P-256",
61+
"x": "MKBCTNIcKUSDii11ySs3526iDZ8AiTo7Tu6KPAqv7D4",
62+
"y": "4Etl6SRW2YiLUrN5vfvVHuhp7x8PxltmWWlbbM4IFyM",
63+
"use": "enc",
64+
"kid": "1"
65+
},
66+
{
67+
"kty": "RSA",
68+
"n": "0vx7agoebGcQSuuPiLJXZptN9nndrQmbXEps2aiAFbWhM78LhWx4cbbfAAtVT86zwu1RK7aPFFxuhDR1L6tSoc_BJECPebWKRXjBZCiFV4n3oknjhMstn64tZ_2W-5JsGY4Hc5n9yBXArwl93lqt7_RN5w6Cf0h4QyQ5v-65YGjQR0_FDW2QvzqY368QQMicAtaSqzs8KJZgnYb9c7d0zgdAZHzu6qMQvRL5hajrn1n91CbOpbISD08qNLyrdkt-bFTWhAI4vMQFh6WeZu0fM4lFd2NcRwr3XPksINHaQ-G_xBniIqbw0Ls1jF44-csFCur-kEgU8awapJzKnqDKgw",
69+
"e": "AQAB",
70+
"alg": "RS256",
71+
"kid": "2011-04-29"
72+
}
73+
]
74+
}

‎schema/v2/jws-header.schema.json

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
{
2+
"$schema": "https://json-schema.org/draft/2020-12/schema",
3+
"$id": "https://pgxn.org/meta/v2/jws-header.schema.json",
4+
"title": "JWS JOSE Header",
5+
"description": "[RFC 7515](https://datatracker.ietf.org/doc/html/rfc7515) JSON Web Signature (JWS) [Header](https://datatracker.ietf.org/doc/html/rfc7515#section-4) format, describing the digital signature or MAC applied to the JWS Protected Header and the JWS Payload and optionally additional properties of the JWS.",
6+
"type": "object",
7+
"properties": {
8+
"alg": {
9+
"type": "string",
10+
"description": "Algorithm: identifies the cryptographic algorithm used to secure the JWS."
11+
},
12+
"jku": {
13+
"type": "string",
14+
"format": "uri",
15+
"description": "JWK Set URL: a URI that refers to a resource for a set of JSON-encoded public keys, one of which corresponds to the key used to digitally sign the JWS."
16+
},
17+
"jwk": {
18+
"$ref": "jwk.schema.json",
19+
"description": "JSON Web Key: the public key that corresponds to the key used to digitally sign the JWS, formatted as a JSON Web Key (JWK)."
20+
},
21+
"kid": {
22+
"type": "string",
23+
"description": "Key ID: a hint indicating which key was used to secure the JWS."
24+
},
25+
"x5u": {
26+
"type": "string",
27+
"format": "uri",
28+
"description": "X.509 URL: a URI that refers to a resource for the X.509 public key certificate or certificate chain corresponding to the key used to digitally sign the JWS."
29+
},
30+
"x5c": {
31+
"type": "array",
32+
"description": "X.509 Certificate Chain: the X.509 public key certificate or certificate chain [RFC5280] corresponding to the key used to digitally sign the JWS.",
33+
"minItems": 1,
34+
"items": {
35+
"type": "string",
36+
"pattern": "^[A-Za-z0-9+/]*={0,2}$",
37+
"description": "Base 64-encoded DER PKIX certificate value."
38+
}
39+
},
40+
"x5t": {
41+
"type": "string",
42+
"pattern": "^[A-Za-z0-9-_]{12,}$",
43+
"description": "X.509 Certificate SHA-1 Thumbprint: Base 64 URL-encoded SHA-1 thumbprint (a.k.a. digest) of the DER encoding of the X.509 certificate corresponding to the key used to digitally sign the JWS."
44+
},
45+
"x5t#S256": {
46+
"type": "string",
47+
"pattern": "^[A-Za-z0-9-_]{12,}$",
48+
"description": "X.509 Certificate SHA-256 Thumbprint: Base 64 URL-encoded SHA-256 thumbprint (a.k.a. digest) of the DER encoding of the X.509 certificate corresponding to the key used to digitally sign the JWS."
49+
},
50+
"typ": {
51+
"type": "string",
52+
"description": "Type: used by JWS applications to declare the media type of this complete JWS."
53+
},
54+
"cty": {
55+
"type": "string",
56+
"description": "Content Type: used by JWS applications to declare the media type [IANA.MediaTypes](https://datatracker.ietf.org/doc/html/rfc7515#ref-IANA.MediaTypes) of the secured content (the payload)."
57+
}
58+
},
59+
"minProperties": 1,
60+
"examples": [{ "kid": "2010-12-29" }, { "typ": "JWT", "alg": "HS256" }]
61+
}

‎schema/v2/jws.schema.json

Lines changed: 91 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,91 @@
1+
{
2+
"$schema": "https://json-schema.org/draft/2020-12/schema",
3+
"$id": "https://pgxn.org/meta/v2/jws.schema.json",
4+
"title": "JWS JSON Serialization",
5+
"description": "[RFC 7515](https://datatracker.ietf.org/doc/html/rfc7515) JSON Web Signature (JWS) [JSON Serialization](https://datatracker.ietf.org/doc/html/rfc7515#section-7.2). Supports both the general and flattened syntaxes.",
6+
"type": "object",
7+
"oneOf": [
8+
{
9+
"$comment": "[General JWS JSON Serialization Syntax](https://datatracker.ietf.org/doc/html/rfc7515#section-7.2.1)",
10+
"properties": {
11+
"payload": { "$ref": "#/$defs/payload" },
12+
"signatures": {
13+
"type": "array",
14+
"description": "Encoded JWS Signature values",
15+
"minItems": 1,
16+
"items": {
17+
"type": "object",
18+
"properties": {
19+
"protected": { "$ref": "#/$defs/protected" },
20+
"header": { "$ref": "jws-header.schema.json" },
21+
"signature": { "$ref": "#/$defs/signature" }
22+
},
23+
"required": ["signature"]
24+
}
25+
}
26+
},
27+
"required": ["payload", "signatures"],
28+
"additionalProperties": true
29+
},
30+
{
31+
"$comment": "[Flattened JWS JSON Serialization Syntax](https://datatracker.ietf.org/doc/html/rfc7515#section-7.2.2)",
32+
"properties": {
33+
"payload": { "$ref": "#/$defs/payload" },
34+
"protected": { "$ref": "#/$defs/protected" },
35+
"header": { "$ref": "jws-header.schema.json" },
36+
"signature": { "$ref": "#/$defs/signature" }
37+
},
38+
"required": ["payload", "signature"],
39+
"additionalProperties": true
40+
}
41+
],
42+
"$comment": "Additional members can be present in both the JSON objects defined above; if not understood by implementations encountering them, they MUST be ignored.",
43+
"examples": [
44+
{
45+
"protected": "eyJ0eXAiOiJKV1QiLA0KICJhbGciOiJIUzI1NiJ9",
46+
"payload": "eyJpc3MiOiJqb2UiLA0KICJleHAiOjEzMDA4MTkzODAsDQogImh0dHA6Ly9leGFtcGxlLmNvbS9pc19yb290Ijp0cnVlfQ",
47+
"signature": "dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk"
48+
},
49+
{
50+
"protected": "eyJhbGciOiJSUzI1NiJ9",
51+
"payload": "eyJpc3MiOiJqb2UiLA0KICJleHAiOjEzMDA4MTkzODAsDQogImh0dHA6Ly9leGFtcGxlLmNvbS9pc19yb290Ijp0cnVlfQ",
52+
"signature": "cC4hiUPoj9Eetdgtv3hF80EGrhuB__dzERat0XF9g2VtQgr9PJbu3XOiZj5RZmh7AAuHIm4Bh-r7t1dnZcAcQjbKBYNX4BAynRFdiuBLgrnbyTyWzO75vRK5h6xBArLIARNPvkSjtQBMHlb1L07Qe7K0GarZRmB_eSN9383LcOLn6_dO--xi12jzDwusC-eOkHWEsqtFZESc6BfI7noOPqvhJ1phCnvWh6IeYI2w9QOYEUipUTI8np6LbgGY9Fs98rqVt5AXLIhWkWywlVmtVrBp0igcN_IoypGlUPQGe77Rw"
53+
},
54+
{
55+
"payload": "eyJpc3MiOiJqb2UiLA0KICJleHAiOjEzMDA4MTkzODAsDQogImh0dHA6Ly9leGFtcGxlLmNvbS9pc19yb290Ijp0cnVlfQ",
56+
"signatures": [
57+
{
58+
"protected": "eyJhbGciOiJSUzI1NiJ9",
59+
"header": {
60+
"kid": "2010-12-29"
61+
},
62+
"signature": "cC4hiUPoj9Eetdgtv3hF80EGrhuB__dzERat0XF9g2VtQgr9PJbu3XOiZj5RZmh7AAuHIm4Bh-0Qc_lF5YKt_O8W2Fp5jujGbds9uJdbF9CUAr7t1dnZcAcQjbKBYNX4BAynRFdiuB--f_nZLgrnbyTyWzO75vRK5h6xBArLIARNPvkSjtQBMHlb1L07Qe7K0GarZRmB_eSN9383LcOLn6_dO--xi12jzDwusC-eOkHWEsqtFZESc6BfI7noOPqvhJ1phCnvWh6IeYI2w9QOYEUipUTI8np6LbgGY9Fs98rqVt5AXLIhWkWywlVmtVrBp0igcN_IoypGlUPQGe77Rw"
63+
},
64+
{
65+
"protected": "eyJhbGciOiJFUzI1NiJ9",
66+
"header": {
67+
"kid": "e9bc097a-ce51-4036-9562-d2ade882db0d"
68+
},
69+
"signature": "DtEhU3ljbEg8L38VWAfUAqOyKAM6-Xx-F4GawxaepmXFCgfTjDxw5djxLa8ISlSApmWQxfKTUJqPP3-Kg6NU1Q"
70+
}
71+
]
72+
}
73+
],
74+
"$defs": {
75+
"signature": {
76+
"type": "string",
77+
"description": "Base 64 URL-encoded signature.",
78+
"pattern": "^[A-Za-z0-9-_]{32,}$"
79+
},
80+
"protected": {
81+
"type": "string",
82+
"description": "Base 64 URL-encoded protected header.",
83+
"pattern": "^[A-Za-z0-9-_]{12,}$"
84+
},
85+
"payload": {
86+
"type": "string",
87+
"description": "Base 64 URL-encoded data to be secured.",
88+
"pattern": "^[A-Za-z0-9-_]{12,}$"
89+
}
90+
}
91+
}

‎schema/v2/payload.schema.json

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
{
2+
"$schema": "https://json-schema.org/draft/2020-12/schema",
3+
"$id": "https://pgxn.org/meta/v2/payload.schema.json",
4+
"title": "PGXN Release Payload",
5+
"description": "JSON Web Signature release payload populated by PGXN.",
6+
"type": "object",
7+
"properties": {
8+
"user": {
9+
"$ref": "term.schema.json",
10+
"description": "The PGXN username for the user who released the distribution to PGXN.",
11+
"examples": ["theory", "keithf4"]
12+
},
13+
"date": {
14+
"type": "string",
15+
"format": "date-time",
16+
"description": "The release timestamp.",
17+
"examples": ["2024-09-12T19:56:49Z"]
18+
},
19+
"uri": {
20+
"type": "string",
21+
"format": "uri-reference",
22+
"pattern": "^dist/",
23+
"description": "Path to the release file relative to a PGXN base URL.",
24+
"examples": [
25+
"dist/pair/0.1.7/pair-0.1.7.zip",
26+
"dist/plv8/3.2.3/plv8-3.2.3.zip"
27+
]
28+
},
29+
"digests": {
30+
"$ref": "digests.schema.json"
31+
}
32+
},
33+
"required": ["user", "date", "uri", "digests"],
34+
"additionalProperties": false,
35+
"examples": [
36+
{
37+
"user": "theory",
38+
"date": "2024-07-20T20:34:34Z",
39+
"uri": "dist/semver/0.40.0/semver-0.40.0.zip",
40+
"digests": {
41+
"sha1": "fe8c013f991b5f537c39fb0c0b04bc955457675a"
42+
}
43+
},
44+
{
45+
"user": "theory",
46+
"date": "2024-09-13T17:32:55Z",
47+
"uri": "dist/pair/0.1.7/pair-0.1.7.zip",
48+
"digests": {
49+
"sha256": "257b71aa57a28d62ddbb301333b3521ea3dc56f17551fa0e4516b03998abb089",
50+
"sha512": "b353b5a82b3b54e95f4a2859e7a2bd0648abcb35a7c3612b126c2c75438fc2f8e8ee1f19e61f30fa54d7bb64bcf217ed1264722b497bcb613f82d78751515b67"
51+
}
52+
}
53+
]
54+
}

0 commit comments

Comments
 (0)