Hypermedia Security: Publish Approval Requirements
v1.0Hypermedia Au
Requirements for attestations that approve ADBOMs for publication or delivery to stakeholders
APPR-001 Target ADBOM Reference MUST
The attestation MUST explicitly reference the target ADBOM by its serial number in the claim target field. The target must be in urn:uuid format and must match the serial number of the ADBOM being approved.
Explicit ADBOM targeting ensures that the approval is unambiguously linked to a specific artifact. This prevents approval misattribution and enables cryptographic verification of the approval chain.
- claim-target-format
- urn:uuid:[uuid]
- must-match-adbom-serial
- true
APPR-002 Approval Predicate MUST
The claim MUST use an explicit predicate from the approved vocabulary indicating the nature of the approval. Valid predicates are: deliverable-accepted, approved-for-publication, or ready-for-delivery.
Standardized predicates enable consistent interpretation of approval semantics across systems. The predicate vocabulary ensures that approval intent is machine-readable and unambiguous.
- allowed-predicates
- deliverable-acceptedapproved-for-publicationready-for-delivery
- must-be-in-vocabulary
- true
APPR-003 Approval Rationale MUST
The claim MUST provide reasoning in the claims.reasoning field that explains the basis for the approval decision. The rationale must be non-empty and provide meaningful context.
Human-readable rationale enables audit trails and supports governance processes. The reasoning field captures the decision context that informed the approval.
- reasoning-field
- claims.reasoning
- min-length
- 1
- must-provide-context
- true
APPR-004 Assessor Identity MUST
The attestation MUST identify the assessor who performed the approval with complete contact information including name and email address.
Assessor identification enables accountability and provides contact information for audit inquiries. The assessor's identity is linked to their cryptographic signing key.
- requires-contact
- true
- requires-email
- true
- requires-name
- true
APPR-005 Evidence Linkage MUST
Claims MUST reference supporting evidence that substantiates the approval decision. Each claim must reference at least one evidence item, and all referenced evidence must exist in the declarations.evidence array.
Evidence linkage creates a verifiable audit trail connecting claims to supporting data. This enables reviewers to assess the basis for approval decisions.
- claims-must-reference-evidence
- true
- evidence-must-exist
- true
- min-evidence-items
- 1
APPR-006 Cryptographic Signature MUST
The attestation MUST be cryptographically signed using ES256 algorithm with a valid certificate path. The signature must include both the certificate chain and the signature value.
Cryptographic signatures ensure integrity and non-repudiation of the attestation. The ES256 algorithm provides strong security with efficient verification.
- algorithm
- ES256
- requires-certificate-path
- true
- requires-signature-value
- true
- certificate-path-min-length
- 1
APPR-007 Conformance and Confidence Scoring MUST
Each requirement mapping MUST include both conformance and confidence scores in the range 0-1, along with rationale explaining each score. Scores must be numeric and rationales must be non-empty strings.
Quantitative scoring enables risk assessment and compliance monitoring. Conformance scores measure requirement satisfaction, while confidence scores indicate assessor certainty.
- conformance-score-range
- 0-1
- confidence-score-range
- 0-1
- requires-rationale
- true
- rationale-min-length
- 1
APPR-008 Timestamp Requirement MUST
The attestation MUST include an ISO8601 timestamp in the metadata.timestamp field indicating when the attestation was created. The timestamp must be in valid ISO8601 format.
Timestamps enable temporal ordering of attestations and support audit trails. ISO8601 format ensures consistent time representation across systems.
- format
- ISO8601
- field
- metadata.timestamp
- must-be-valid
- true