{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "$id": "https://sec.hypermedia.au/schemas/publication/v1.schema.json",
  "title": "Publication BOM v1 Schema",
  "description": "Validates one L3 Publication BOM version. Shape-only: the finalisation-version check on the catalog pin, the disclosability of composed findings, and the supersedes chain are verifier (adbom-cli) checks. Normative requirements: https://sec.hypermedia.au/standards/publication/v1",
  "type": "object",
  "required": [
    "bomFormat",
    "specVersion",
    "serialNumber",
    "version",
    "metadata",
    "components",
    "compositions",
    "signature"
  ],
  "properties": {
    "bomFormat": {
      "type": "string",
      "enum": [
        "CycloneDX"
      ]
    },
    "specVersion": {
      "type": "string",
      "const": "1.7"
    },
    "serialNumber": {
      "type": "string",
      "pattern": "^urn:uuid:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$"
    },
    "version": {
      "type": "integer",
      "minimum": 1
    },
    "metadata": {
      "type": "object",
      "required": [
        "timestamp",
        "component",
        "properties"
      ],
      "properties": {
        "timestamp": {
          "type": "string",
          "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}"
        },
        "component": {
          "type": "object",
          "required": [
            "type",
            "name"
          ],
          "properties": {
            "type": {
              "type": "string",
              "enum": [
                "data"
              ]
            },
            "name": {
              "type": "string",
              "minLength": 1
            },
            "version": {
              "type": "string"
            }
          }
        },
        "properties": {
          "type": "array",
          "items": {
            "$ref": "#/definitions/propertyEntry"
          },
          "allOf": [
            {
              "contains": {
                "type": "object",
                "properties": {
                  "name": {
                    "const": "cyberbench:caseId"
                  },
                  "value": {
                    "type": "string",
                    "minLength": 1
                  }
                },
                "required": [
                  "name",
                  "value"
                ]
              }
            },
            {
              "contains": {
                "type": "object",
                "properties": {
                  "name": {
                    "const": "cyberbench:publicationType"
                  },
                  "value": {
                    "type": "string",
                    "minLength": 1
                  }
                },
                "required": [
                  "name",
                  "value"
                ]
              },
              "description": "PUBL-002: open vocabulary, seeded exec-summary | technical-report"
            },
            {
              "contains": {
                "type": "object",
                "properties": {
                  "name": {
                    "const": "cyberbench:finalisedCatalogRef"
                  },
                  "value": {
                    "type": "string",
                    "pattern": "^urn:cdx:.+"
                  }
                },
                "required": [
                  "name",
                  "value"
                ]
              }
            }
          ]
        }
      }
    },
    "components": {
      "type": "array",
      "minItems": 1,
      "maxItems": 1,
      "items": {
        "type": "object",
        "required": [
          "bom-ref",
          "type",
          "name",
          "hashes"
        ],
        "properties": {
          "bom-ref": {
            "type": "string",
            "pattern": "^publication-.+"
          },
          "type": {
            "type": "string",
            "enum": [
              "data"
            ]
          },
          "name": {
            "type": "string",
            "minLength": 1
          },
          "hashes": {
            "type": "array",
            "minItems": 1,
            "items": {
              "type": "object",
              "required": [
                "alg",
                "content"
              ],
              "properties": {
                "alg": {
                  "type": "string",
                  "enum": [
                    "SHA-256",
                    "SHA-512",
                    "SHA3-256",
                    "SHA3-512",
                    "BLAKE3"
                  ]
                },
                "content": {
                  "type": "string",
                  "pattern": "^[a-f0-9]{64}$|^[a-f0-9]{128}$"
                }
              }
            },
            "contains": {
              "type": "object",
              "properties": {
                "alg": {
                  "const": "SHA-256"
                }
              },
              "required": [
                "alg"
              ]
            }
          }
        }
      },
      "description": "PUBL-003: exactly one data component \u2014 the rendered report with its SHA-256 hash"
    },
    "compositions": {
      "type": "array",
      "minItems": 1,
      "items": {
        "type": "object",
        "required": [
          "aggregate",
          "assemblies"
        ],
        "properties": {
          "aggregate": {
            "type": "string",
            "const": "complete"
          },
          "assemblies": {
            "type": "array",
            "minItems": 1,
            "items": {
              "type": "string",
              "pattern": "^urn:cdx:.+"
            }
          }
        }
      },
      "description": "PUBL-005: aggregate complete; assemblies = the exact finding BOM-Links disclosed"
    },
    "signature": {
      "type": "object",
      "required": [
        "algorithm",
        "certificatePath",
        "value"
      ],
      "properties": {
        "algorithm": {
          "type": "string",
          "enum": [
            "ES256",
            "ES384",
            "ES512"
          ]
        },
        "certificatePath": {
          "type": "array",
          "minItems": 1,
          "items": {
            "type": "string"
          }
        },
        "value": {
          "type": "string",
          "minLength": 1
        }
      }
    }
  },
  "if": {
    "properties": {
      "version": {
        "minimum": 2
      }
    },
    "required": [
      "version"
    ]
  },
  "then": {
    "properties": {
      "metadata": {
        "properties": {
          "properties": {
            "contains": {
              "type": "object",
              "properties": {
                "name": {
                  "const": "cyberbench:supersedes"
                },
                "value": {
                  "type": "string",
                  "pattern": "^urn:cdx:.+"
                }
              },
              "required": [
                "name",
                "value"
              ]
            }
          }
        }
      }
    },
    "description": "PUBL-002: any version > 1 must link the publication version it supersedes"
  },
  "definitions": {
    "propertyEntry": {
      "type": "object",
      "required": [
        "name",
        "value"
      ],
      "properties": {
        "name": {
          "type": "string",
          "minLength": 1
        },
        "value": {
          "type": "string"
        }
      }
    }
  }
}