Skip to content

fix(schema): re-sync trace-v0.2.json with trace-spec #46

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
rajnisht7 wants to merge 2 commits into
base: main
Choose a base branch
from
+43 −3
Open

fix(schema): re-sync trace-v0.2.json with trace-spec #46

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
c848043
fix schema parity resync
rajnisht7 Sep 4, 2026
b67d6d1
fix(schema): sync the current normative confirmation-key constraints
imran-siddique Sep 6, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
46 changes: 43 additions & 3 deletions schema/trace-v0.2.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -61,8 +61,8 @@
},
"subject": {
"type": "string",
"description": "Workload identity as a SPIFFE SVID URI or DID URI.",
"pattern": "^(spiffe://|did:)"
"description": "Workload identity as a SPIFFE SVID URI or DID URI. A SPIFFE ID carries a trust domain and a workload path within it; a DID carries a lowercase method name, per DID Core section 3.1, and a method-specific identifier. A prefix alone is not an identity: spiffe://example.org names a trust domain and no workload.",
"pattern": "^(spiffe://[^/]+/.+|did:[a-z0-9]+:.+)$"
},
"model": {
"type": "object",
Expand Down Expand Up @@ -119,7 +119,7 @@
"tpm2",
"software-only"
],
"description": "Hardware platform providing the root of trust. software-only marks development-mode records with no hardware backing; they must never be treated as attested evidence."
"description": "Hardware platform providing the root of trust. software-only marks records with no hardware root of trust, for example a development-mode execution, or a record assembled from evidence produced outside the runtime (origin.kind other than self requires this value; see spec 3.1.1). Such records must never be treated as attested evidence."
},
"measurement": {
"type": "string",
Expand Down Expand Up @@ -472,6 +472,46 @@
}
}
],
"not": {
"anyOf": [
{
"required": [
"d"
]
},
{
"required": [
"p"
]
},
{
"required": [
"q"
]
},
{
"required": [
"dp"
]
},
{
"required": [
"dq"
]
},
{
"required": [
"qi"
]
},
{
"required": [
"k"
]
}
]
},
"$comment": "RFC 8747 defines cnf as a confirmation key: the public half, present so a verifier can bind the record to the key that signed it. A private member here publishes the signing key inside the signed, self-authenticating, typically anchored record, and the only remedy afterwards is to revoke the identity. Mirrors _JWK_PRIVATE_PARAMS in the reference model, which already refuses these.",
"additionalProperties": {
"$ref": "#/$defs/canonicalizableValue"
}
Expand Down
Loading