{ "$schema": "http://json-schema.org/draft-07/schema#", "$id": "https://gavr.gadvisory.org/schemas/gavr-record-1.0.json", "title": "GAVR Record 1.0", "description": "A GAVR record document. This schema carries the structure and every cross-field rule expressible in JSON Schema draft-07. It is necessary but NOT sufficient: 17 companion rules cannot be expressed here and are specified in prose beside it. An implementation validating against this document alone will accept records the registry refuses. The conformance corpus is what settles the verdicts.", "$ref": "#/definitions/GavrRecord", "definitions": { "Party": { "type": "object", "properties": { "kind": { "type": "string", "enum": [ "AUTHORITY", "PUBLISHER", "USER", "REGISTRY", "TOOL", "NODE", "REGULATOR" ] }, "id": { "type": "string", "minLength": 1 }, "displayName": { "type": "string" } }, "required": [ "kind", "id" ], "additionalProperties": false }, "LocalizedText": { "type": "object", "properties": { "lang": { "type": "string", "pattern": "^[a-z]{2,3}(-[a-z0-9]{2,8})*$", "description": "BCP 47 language tag, lowercase" }, "format": { "type": "string", "enum": [ "text/plain", "text/markdown; variant=gfm" ], "default": "text/plain" }, "audience": { "type": "string", "enum": [ "public", "coordinating-parties", "customers", "regulators", "internal" ], "default": "public" }, "value": { "type": "string", "minLength": 1 }, "primary": { "type": "boolean" } }, "required": [ "lang", "value" ], "additionalProperties": false, "allOf": [ { "if": { "properties": { "primary": { "const": true } }, "required": [ "primary" ] }, "then": { "anyOf": [ { "not": { "required": [ "audience" ] } }, { "properties": { "audience": { "const": "public" } } } ] } } ] }, "Identifier": { "type": "object", "properties": { "namespace": { "type": "string", "minLength": 1 }, "value": { "type": "string", "minLength": 1 }, "environment": { "type": "string", "enum": [ "prod", "test" ], "default": "prod" }, "role": { "type": "string", "enum": [ "PRIMARY", "CANONICAL", "DUPLICATE", "SUPERSEDED", "REJECTED" ], "default": "CANONICAL" }, "assignedBy": { "$ref": "#/definitions/Party" }, "assignedAt": { "type": "string", "format": "date-time", "description": "RFC 3339 timestamp" }, "supersededBy": { "type": "string", "minLength": 1 } }, "required": [ "namespace", "value" ], "additionalProperties": false }, "Relation": { "type": "object", "properties": { "type": { "type": "string", "enum": [ "same-as", "duplicate-of", "superseded-by", "supersedes", "subset-of", "superset-of", "overlaps", "related", "disputed-by", "disputes", "inherited-from", "propagates-to", "variant-of", "regression-of" ] }, "target": { "type": "string", "minLength": 1 }, "targetNamespace": { "type": "string", "minLength": 1 }, "basis": { "type": "string", "enum": [ "asserted-by-owner", "verified-by-registry", "community-reported", "automated-match" ] }, "assertedBy": { "$ref": "#/definitions/Party" }, "assertedAt": { "$ref": "#/definitions/Identifier/properties/assignedAt", "description": "RFC 3339 timestamp" }, "note": { "type": "string" } }, "required": [ "type", "target", "targetNamespace", "basis" ], "additionalProperties": false }, "ProductIdentity": { "type": "object", "properties": { "purl": { "type": "string", "minLength": 1 }, "cpes": { "type": "array", "items": { "type": "string", "minLength": 1 } }, "repository": { "type": "string", "format": "uri" }, "vendor": { "type": "string", "minLength": 1 }, "product": { "type": "string", "minLength": 1 }, "ecosystem": { "type": "string", "minLength": 1 }, "packageName": { "type": "string", "minLength": 1 }, "platforms": { "type": "array", "items": { "type": "string", "minLength": 1 } }, "skus": { "type": "array", "items": { "type": "string", "minLength": 1 } }, "modelNumbers": { "type": "array", "items": { "type": "string", "minLength": 1 } }, "hardwareRevisions": { "type": "array", "items": { "type": "string", "minLength": 1 } }, "serialNumbers": { "type": "array", "items": { "type": "string", "minLength": 1 } }, "sectors": { "type": "array", "items": { "type": "string", "minLength": 1 } }, "regions": { "type": "array", "items": { "type": "string", "minLength": 1 } } }, "additionalProperties": false, "allOf": [ { "anyOf": [ { "required": [ "purl" ] }, { "required": [ "cpes" ] }, { "required": [ "repository" ] }, { "required": [ "product" ] }, { "required": [ "packageName" ] } ] } ] }, "VersionRange": { "type": "object", "properties": { "introduced": { "type": "object", "properties": { "version": { "type": "string", "minLength": 1 }, "inclusive": { "type": "boolean" } }, "required": [ "version", "inclusive" ], "additionalProperties": false }, "fixed": { "$ref": "#/definitions/VersionRange/properties/introduced" }, "status": { "type": "string", "enum": [ "affected", "unaffected", "unknown", "affected-versions-unknown", "under-investigation" ] }, "unaffectedReason": { "type": "string", "enum": [ "code-not-present", "code-not-reachable", "component-not-present", "not-attacker-controllable", "requires-configuration", "requires-dependency", "requires-environment", "protected-by-compiler", "protected-at-runtime", "protected-at-perimeter", "inline-mitigation-present", "fixed", "out-of-support-unassessed", "not-assessed" ] }, "versionType": { "type": "string", "minLength": 1 }, "impactStatement": { "type": "array", "items": { "$ref": "#/definitions/LocalizedText" } }, "statusNotes": { "type": "array", "items": { "$ref": "#/definitions/LocalizedText" } }, "confidence": { "type": "object", "properties": { "level": { "type": "string", "enum": [ "high", "medium", "low" ] }, "basis": { "type": "string", "enum": [ "vendor-confirmed", "researcher-tested", "maintainer-confirmed", "static-analysis", "dynamic-analysis", "fuzzing", "telemetry", "formal-verification", "third-party-confirmed", "reported", "inferred" ] }, "note": { "type": "string" } }, "required": [ "level", "basis" ], "additionalProperties": false } }, "required": [ "status" ], "additionalProperties": false, "allOf": [ { "if": { "properties": { "status": { "const": "unaffected" } }, "required": [ "status" ] }, "then": { "required": [ "unaffectedReason" ] } }, { "if": { "properties": { "status": { "const": "affected-versions-unknown" } }, "required": [ "status" ] }, "then": { "allOf": [ { "not": { "required": [ "introduced" ] } }, { "not": { "required": [ "fixed" ] } } ] } } ] }, "SeverityScore": { "type": "object", "properties": { "scale": { "type": "string", "enum": [ "CVSS_V4_0", "CVSS_V3_1", "CVSS_V3_0", "CVSS_V2_0", "EPSS", "SSVC", "QUALITATIVE" ] }, "vector": { "type": "string", "minLength": 1 }, "score": { "type": "number" }, "qualitative": { "type": "string", "enum": [ "none", "low", "medium", "high", "critical" ] }, "author": { "$ref": "#/definitions/Party" }, "assessedAt": { "$ref": "#/definitions/Identifier/properties/assignedAt", "description": "RFC 3339 timestamp" }, "confidence": { "$ref": "#/definitions/VersionRange/properties/confidence" }, "rationale": { "type": "string" } }, "required": [ "scale", "author" ], "additionalProperties": false, "allOf": [ { "if": { "properties": { "scale": { "const": "QUALITATIVE" } }, "required": [ "scale" ] }, "then": { "required": [ "qualitative" ] } }, { "if": { "properties": { "scale": { "enum": [ "CVSS_V2_0", "CVSS_V3_0", "CVSS_V3_1", "CVSS_V4_0" ] } }, "required": [ "scale" ] }, "then": { "required": [ "vector" ] } }, { "if": { "properties": { "scale": { "const": "EPSS" } }, "required": [ "scale" ] }, "then": { "required": [ "score" ] } } ] }, "Remediation": { "type": "object", "properties": { "kind": { "type": "string", "enum": [ "upgrade", "patch-commit", "backport", "vendor-fix", "firmware-update", "service-side-fix", "signature-update", "configuration", "workaround", "mitigation", "optional-patch", "none-available", "no-fix-planned", "other" ] }, "description": { "type": "array", "items": { "$ref": "#/definitions/LocalizedText" } }, "fixedVersion": { "type": "string", "minLength": 1 }, "commit": { "type": "string", "minLength": 1 }, "repository": { "type": "string", "format": "uri" }, "url": { "type": "string", "format": "uri" }, "appliesTo": { "type": "array", "items": { "type": "integer", "minimum": 0 } }, "appliesToContainer": { "type": "string", "minLength": 1 }, "confidence": { "$ref": "#/definitions/VersionRange/properties/confidence" } }, "required": [ "kind" ], "additionalProperties": false, "allOf": [ { "if": { "properties": { "kind": { "const": "upgrade" } }, "required": [ "kind" ] }, "then": { "required": [ "fixedVersion" ] } }, { "if": { "properties": { "kind": { "const": "patch-commit" } }, "required": [ "kind" ] }, "then": { "required": [ "commit" ] } }, { "if": { "properties": { "kind": { "const": "other" } }, "required": [ "kind" ] }, "then": { "required": [ "description" ], "properties": { "description": { "minItems": 1 } } } } ] }, "DetectionArtifact": { "type": "object", "properties": { "kind": { "type": "string", "minLength": 1 }, "content": { "type": "string", "minLength": 1 }, "url": { "type": "string", "format": "uri" }, "description": { "type": "string" }, "intrusiveness": { "type": "string", "enum": [ "passive", "active", "disruptive" ], "default": "passive" }, "confidence": { "$ref": "#/definitions/VersionRange/properties/confidence" } }, "required": [ "kind" ], "additionalProperties": false, "allOf": [ { "anyOf": [ { "required": [ "content" ] }, { "required": [ "url" ] } ] } ] }, "TimelineEntry": { "type": "object", "properties": { "event": { "type": "string", "enum": [ "discovered", "reported", "acknowledged", "assigned", "triaged", "reproduced", "vendor-notified", "fix-started", "fixed", "fix-released", "disclosed", "embargo-set", "embargo-lifted", "embargo-broken", "exploited-in-the-wild", "exploit-published", "regulator-notified", "regulator-final-report", "ownership-offered", "ownership-transferred", "ownership-declined", "withdrawn", "restored", "other" ] }, "at": { "$ref": "#/definitions/Identifier/properties/assignedAt" }, "actor": { "$ref": "#/definitions/Party" }, "note": { "type": "string" } }, "required": [ "event", "at" ], "additionalProperties": false, "allOf": [ { "if": { "properties": { "event": { "const": "other" } }, "required": [ "event" ] }, "then": { "required": [ "note" ], "properties": { "note": { "minLength": 1 } } } } ] }, "RecordContainer": { "type": "object", "properties": { "id": { "type": "string", "minLength": 1, "maxLength": 200 }, "status": { "type": "string", "enum": [ "active", "withdrawn", "superseded" ], "default": "active" }, "author": { "$ref": "#/definitions/Party" }, "role": { "type": "string", "enum": [ "owner", "peer", "contributor", "publisher", "registry", "root", "translator", "reviewer", "regulator" ] }, "descriptions": { "type": "array", "items": { "$ref": "#/definitions/LocalizedText" }, "minItems": 1, "contains": { "type": "object", "properties": { "primary": { "const": true } }, "required": [ "primary" ] } }, "affected": { "type": "array", "items": { "type": "object", "properties": { "identity": { "$ref": "#/definitions/ProductIdentity" }, "defaultStatus": { "type": "string", "enum": [ "affected", "unaffected", "unknown", "affected-versions-unknown", "under-investigation" ], "default": "unknown" }, "ranges": { "type": "array", "items": { "$ref": "#/definitions/VersionRange" }, "default": [] }, "locations": { "type": "array", "items": { "type": "object", "properties": { "kind": { "type": "string", "enum": [ "function", "method", "symbol", "file", "module", "endpoint" ] }, "name": { "type": "string", "minLength": 1 }, "path": { "type": "string" }, "confidence": { "$ref": "#/definitions/VersionRange/properties/confidence" } }, "required": [ "kind", "name" ], "additionalProperties": false } }, "severity": { "type": "array", "items": { "$ref": "#/definitions/SeverityScore" } }, "notes": { "type": "string" } }, "required": [ "identity" ], "additionalProperties": false } }, "severity": { "type": "array", "items": { "$ref": "#/definitions/SeverityScore" } }, "weaknesses": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "minLength": 1 }, "taxonomy": { "type": "string", "minLength": 1, "default": "CWE" }, "description": { "type": "string" }, "confidence": { "$ref": "#/definitions/VersionRange/properties/confidence" } }, "required": [ "id" ], "additionalProperties": false } }, "remediations": { "type": "array", "items": { "$ref": "#/definitions/Remediation" } }, "detection": { "type": "array", "items": { "$ref": "#/definitions/DetectionArtifact" } }, "references": { "type": "array", "items": { "type": "object", "properties": { "url": { "type": "string", "format": "uri" }, "name": { "type": "string" }, "tags": { "type": "array", "items": { "type": "string", "enum": [ "broken-link", "customer-entitlement", "exploit", "government-resource", "issue-tracking", "mailing-list", "media-coverage", "mitigation", "not-applicable", "patch", "permissions-required", "product", "related", "release-notes", "signature", "technical-description", "third-party-advisory", "vdb-entry", "vendor-advisory" ] }, "minItems": 1 } }, "required": [ "url", "tags" ], "additionalProperties": false } }, "timeline": { "type": "array", "items": { "$ref": "#/definitions/TimelineEntry" } }, "credits": { "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string", "enum": [ "finder", "reporter", "analyst", "coordinator", "remediation-developer", "remediation-reviewer", "remediation-verifier", "tool", "sponsor", "other" ] }, "displayName": { "type": "string", "minLength": 1 }, "handle": { "type": "string" }, "url": { "type": "string", "format": "uri" } }, "required": [ "type", "displayName" ], "additionalProperties": false } }, "relations": { "type": "array", "items": { "$ref": "#/definitions/Relation" } }, "createdAt": { "$ref": "#/definitions/Identifier/properties/assignedAt", "description": "RFC 3339 timestamp" }, "updatedAt": { "$ref": "#/definitions/Identifier/properties/assignedAt", "description": "RFC 3339 timestamp" }, "intervention": { "$ref": "#/definitions/Intervention" }, "peerStanding": { "$ref": "#/definitions/PeerStanding" }, "coordination": { "type": "object", "properties": { "status": { "type": "string", "enum": [ "uncoordinated", "in-progress", "coordinated", "owner-unresponsive" ] } }, "required": [ "status" ], "additionalProperties": false }, "contests": { "type": "array", "items": { "type": "object", "properties": { "containerId": { "type": "string", "minLength": 1, "maxLength": 200 }, "path": { "type": "string", "minLength": 1, "maxLength": 200 }, "disposition": { "type": "string", "enum": [ "disputed", "rejected" ], "default": "disputed" }, "note": { "type": "string", "minLength": 1, "maxLength": 2000 } }, "required": [ "containerId" ], "additionalProperties": false } }, "enrichment": { "$ref": "#/definitions/Enrichment" }, "vouching": { "type": "object", "properties": { "verificationBasis": { "type": "string", "enum": [ "identity-verified", "prior-relationship", "disclosure-thread", "unverified" ] }, "affiliation": { "type": "string", "minLength": 1, "maxLength": 300 }, "contact": { "type": "string", "minLength": 1, "maxLength": 300 } }, "required": [ "verificationBasis" ], "additionalProperties": false }, "appealDecision": { "type": "object", "properties": { "appealedContainerId": { "type": "string", "minLength": 1, "maxLength": 200 }, "appealId": { "type": "string", "minLength": 1, "maxLength": 200 }, "disposition": { "type": "string", "enum": [ "upheld", "dismissed" ] }, "decidedAt": { "$ref": "#/definitions/Identifier/properties/assignedAt" } }, "required": [ "appealedContainerId", "appealId", "disposition", "decidedAt" ], "additionalProperties": false }, "translation": { "$ref": "#/definitions/Translation" }, "review": { "$ref": "#/definitions/Review" }, "regulatoryAction": { "$ref": "#/definitions/RegulatoryAction" }, "signature": {} }, "required": [ "author", "role" ], "additionalProperties": false, "allOf": [ { "if": { "properties": { "role": { "const": "root" } }, "required": [ "role" ] }, "then": { "if": { "required": [ "intervention" ] }, "then": {}, "else": { "allOf": [ { "not": { "required": [ "affected" ] } }, { "not": { "required": [ "severity" ] } }, { "not": { "required": [ "weaknesses" ] } }, { "not": { "required": [ "remediations" ] } }, { "not": { "required": [ "detection" ] } } ] } }, "else": { "not": { "required": [ "intervention" ] } } }, { "if": { "required": [ "intervention" ] }, "then": { "required": [ "id" ] } }, { "if": { "properties": { "role": { "const": "peer" } }, "required": [ "role" ] }, "then": { "required": [ "peerStanding" ] }, "else": { "not": { "required": [ "peerStanding" ] } } }, { "if": { "properties": { "role": { "const": "publisher" } }, "required": [ "role" ] }, "then": { "required": [ "enrichment" ] }, "else": { "not": { "required": [ "enrichment" ] } } }, { "if": { "properties": { "role": { "const": "contributor" } }, "required": [ "role" ] }, "then": { "required": [ "vouching" ] }, "else": { "not": { "required": [ "vouching" ] } } }, { "if": { "properties": { "role": { "const": "registry" } }, "required": [ "role" ] }, "then": { "allOf": [ { "not": { "required": [ "affected" ] } }, { "not": { "required": [ "severity" ] } }, { "not": { "required": [ "weaknesses" ] } }, { "not": { "required": [ "remediations" ] } }, { "not": { "required": [ "detection" ] } } ] }, "else": { "not": { "required": [ "appealDecision" ] } } }, { "if": { "properties": { "role": { "const": "translator" } }, "required": [ "role" ] }, "then": { "required": [ "translation" ], "allOf": [ { "not": { "required": [ "affected" ] } }, { "not": { "required": [ "severity" ] } }, { "not": { "required": [ "weaknesses" ] } }, { "not": { "required": [ "remediations" ] } }, { "not": { "required": [ "detection" ] } } ] }, "else": { "not": { "required": [ "translation" ] } } }, { "if": { "properties": { "role": { "const": "reviewer" } }, "required": [ "role" ] }, "then": { "required": [ "review" ], "allOf": [ { "not": { "required": [ "affected" ] } }, { "not": { "required": [ "severity" ] } }, { "not": { "required": [ "weaknesses" ] } }, { "not": { "required": [ "remediations" ] } }, { "not": { "required": [ "detection" ] } } ] } }, { "if": { "properties": { "role": { "enum": [ "reviewer", "root" ] } }, "required": [ "role" ] }, "else": { "not": { "required": [ "review" ] } } }, { "if": { "properties": { "role": { "const": "regulator" } }, "required": [ "role" ] }, "then": { "required": [ "regulatoryAction" ], "allOf": [ { "not": { "required": [ "affected" ] } }, { "not": { "required": [ "severity" ] } }, { "not": { "required": [ "weaknesses" ] } }, { "not": { "required": [ "remediations" ] } }, { "not": { "required": [ "detection" ] } } ] }, "else": { "not": { "required": [ "regulatoryAction" ] } } }, { "if": { "properties": { "role": { "const": "owner" } }, "required": [ "role" ] }, "else": { "properties": { "contests": { "items": { "properties": { "disposition": { "not": { "const": "rejected" } } } } } } } }, { "if": { "properties": { "role": { "enum": [ "owner", "peer", "root" ] } }, "required": [ "role" ] }, "else": { "not": { "required": [ "contests" ] } } }, { "if": { "properties": { "role": { "enum": [ "owner", "peer" ] } }, "required": [ "role" ] }, "else": { "not": { "required": [ "coordination" ] } } } ], "patternProperties": { "^x_[^.]*$": {} } }, "Intervention": { "type": "object", "properties": { "basis": { "type": "string", "enum": [ "scope-violation", "factual-error", "unresponsive-owner", "safety", "accreditation-breach", "other" ] }, "basisNote": { "type": "string", "minLength": 1, "maxLength": 2000 }, "accreditationPath": { "type": "array", "items": { "type": "string", "minLength": 1, "maxLength": 200 }, "minItems": 2 }, "restrictionId": { "type": "string", "minLength": 1, "maxLength": 200 }, "appealable": { "type": "boolean", "default": true }, "appealDeadline": { "$ref": "#/definitions/Identifier/properties/assignedAt", "description": "RFC 3339 timestamp" }, "appealId": { "type": "string", "minLength": 1, "maxLength": 200 }, "ownerNotifiedAt": { "$ref": "#/definitions/Identifier/properties/assignedAt", "description": "RFC 3339 timestamp" }, "expiresAt": { "$ref": "#/definitions/Identifier/properties/assignedAt", "description": "RFC 3339 timestamp" }, "supersedes": { "type": "string", "minLength": 1, "maxLength": 200 }, "corrects": { "type": "array", "items": { "type": "string", "minLength": 1, "maxLength": 200 }, "minItems": 1 } }, "required": [ "basis", "accreditationPath" ], "additionalProperties": false, "allOf": [ { "if": { "properties": { "basis": { "const": "other" } }, "required": [ "basis" ] }, "then": { "required": [ "basisNote" ] } }, { "if": { "properties": { "appealable": { "const": false } }, "required": [ "appealable" ] }, "then": { "anyOf": [ { "required": [ "appealId" ] }, { "required": [ "appealDeadline" ] } ] } } ] }, "PeerStanding": { "type": "object", "properties": { "basis": { "type": "string", "enum": [ "affected-vendor", "coordinator", "downstream-distributor", "independent-analysis", "open-source-steward", "other" ] }, "basisNote": { "type": "string", "minLength": 1, "maxLength": 2000 }, "ownerContactedAt": { "$ref": "#/definitions/Identifier/properties/assignedAt", "description": "RFC 3339 timestamp" } }, "required": [ "basis" ], "additionalProperties": false, "allOf": [ { "if": { "properties": { "basis": { "const": "other" } }, "required": [ "basis" ] }, "then": { "required": [ "basisNote" ] } } ] }, "Enrichment": { "type": "object", "properties": { "method": { "type": "string", "enum": [ "manual-analysis", "automated", "aggregated", "other" ] }, "methodNote": { "type": "string", "minLength": 1, "maxLength": 2000 }, "derivedFrom": { "type": "array", "items": { "type": "string", "minLength": 1, "maxLength": 500 } }, "confidence": { "$ref": "#/definitions/VersionRange/properties/confidence" } }, "required": [ "method" ], "additionalProperties": false, "allOf": [ { "if": { "properties": { "method": { "const": "other" } }, "required": [ "method" ] }, "then": { "required": [ "methodNote" ] } } ] }, "Translation": { "type": "object", "properties": { "sourceContainerId": { "type": "string", "minLength": 1, "maxLength": 200 }, "sourceLang": { "type": "string", "minLength": 1, "maxLength": 35 }, "targetLang": { "type": "string", "minLength": 1, "maxLength": 35 }, "method": { "type": "string", "enum": [ "human", "machine", "machine-post-edited" ] }, "translatedBy": { "type": "string", "minLength": 1, "maxLength": 300 } }, "required": [ "sourceContainerId", "sourceLang", "targetLang", "method" ], "additionalProperties": false }, "Review": { "type": "object", "properties": { "verdict": { "type": "string", "enum": [ "endorsed", "endorsed-with-reservations", "not-endorsed", "inconclusive" ] }, "scope": { "type": "array", "items": { "type": "string", "enum": [ "affected-products", "severity", "weaknesses", "remediation", "reproduction", "references", "whole-record" ] }, "minItems": 1 }, "reviewedContainerId": { "type": "string", "minLength": 1, "maxLength": 200 }, "note": { "type": "string", "minLength": 1, "maxLength": 2000 }, "reviewedAt": { "$ref": "#/definitions/Identifier/properties/assignedAt", "description": "RFC 3339 timestamp" } }, "required": [ "verdict", "scope" ], "additionalProperties": false, "allOf": [ { "if": { "properties": { "verdict": { "not": { "const": "endorsed" } } }, "required": [ "verdict" ] }, "then": { "required": [ "note" ] } } ] }, "RegulatoryAction": { "type": "object", "properties": { "jurisdiction": { "type": "string", "minLength": 1, "maxLength": 100 }, "instrument": { "type": "string", "minLength": 1, "maxLength": 200 }, "reportReference": { "type": "string", "minLength": 1, "maxLength": 200 }, "deadline": { "$ref": "#/definitions/Identifier/properties/assignedAt", "description": "RFC 3339 timestamp" }, "actedAt": { "$ref": "#/definitions/Identifier/properties/assignedAt", "description": "RFC 3339 timestamp" } }, "required": [ "jurisdiction", "instrument" ], "additionalProperties": false }, "Redaction": { "type": "object", "properties": { "path": { "type": "string", "minLength": 1 }, "containerId": { "type": "string", "minLength": 1, "maxLength": 200 }, "reason": { "type": "string", "enum": [ "leaked-credential", "personal-data", "embargo-violation", "legal-order", "operational-risk", "published-in-error" ] }, "redactedBy": { "$ref": "#/definitions/Party" }, "redactedAt": { "$ref": "#/definitions/Identifier/properties/assignedAt" }, "digest": { "type": "string", "pattern": "^[0-9a-f]{64}$" }, "note": { "type": "array", "items": { "$ref": "#/definitions/LocalizedText" } } }, "required": [ "path", "reason", "redactedBy", "redactedAt" ], "additionalProperties": false, "allOf": [ { "if": { "required": [ "containerId" ] }, "then": { "properties": { "reason": { "enum": [ "leaked-credential", "personal-data", "legal-order" ] } } } } ] }, "OwnershipEvent": { "type": "object", "properties": { "from": { "$ref": "#/definitions/Party" }, "to": { "$ref": "#/definitions/Party" }, "at": { "$ref": "#/definitions/Identifier/properties/assignedAt" }, "reason": { "type": "string" }, "basis": { "type": "string", "enum": [ "accepted", "reassigned-by-root", "reassigned-by-registry" ] }, "retires": { "type": "array", "items": { "type": "string", "minLength": 1, "maxLength": 200 } }, "retains": { "type": "array", "items": { "type": "string", "minLength": 1, "maxLength": 200 } } }, "required": [ "to", "at", "basis" ], "additionalProperties": false, "allOf": [ { "if": { "not": { "properties": { "basis": { "const": "accepted" } } }, "required": [ "basis" ] }, "then": { "required": [ "reason" ] } } ] }, "GavrRecord": { "type": "object", "properties": { "schemaVersion": { "type": "string", "const": "1.0" }, "id": { "type": "string", "maxLength": 255, "pattern": "^(?:GAVR-[0-9A-HJKMNP-TV-Z]{6,16}|GAVLR-(?:(?:0|[1-9][0-9]*)-){1,3}[0-9A-HJKMNP-TV-Z]{6,16})$" }, "identifiers": { "type": "array", "items": { "$ref": "#/definitions/Identifier" }, "default": [] }, "type": { "type": "string", "enum": [ "vulnerability", "hardening", "supply-chain-compromise", "malicious-package", "end-of-life", "advisory-correction" ], "default": "vulnerability" }, "state": { "type": "string", "enum": [ "RESERVED", "DRAFT", "PUBLISHED", "WITHDRAWN", "DISCARDED" ] }, "disputed": { "type": "boolean", "default": false }, "disputedReason": { "anyOf": [ { "type": "string", "minLength": 1 }, { "type": "array", "items": { "$ref": "#/definitions/LocalizedText" }, "minItems": 1 } ] }, "disputedAt": { "$ref": "#/definitions/Identifier/properties/assignedAt", "description": "RFC 3339 timestamp" }, "disputedBy": { "$ref": "#/definitions/Party" }, "wasWithdrawnOnce": { "type": "boolean", "default": false }, "embargoUntil": { "$ref": "#/definitions/Identifier/properties/assignedAt", "description": "RFC 3339 timestamp" }, "reviewState": { "type": "string", "enum": [ "NONE", "IN_REVIEW", "CHANGES_REQUESTED", "APPROVED" ], "default": "NONE" }, "owner": { "$ref": "#/definitions/Party" }, "ownershipHistory": { "type": "array", "items": { "$ref": "#/definitions/OwnershipEvent" } }, "title": { "anyOf": [ { "type": "string", "minLength": 1, "maxLength": 300 }, { "type": "array", "items": { "$ref": "#/definitions/LocalizedText" }, "minItems": 1 } ] }, "exploitation": { "type": "object", "properties": { "state": { "type": "string", "enum": [ "unknown", "none", "proof-of-concept", "weaponised", "active", "historic" ], "default": "unknown" }, "assertedBy": { "$ref": "#/definitions/Party" }, "assertedAt": { "$ref": "#/definitions/Identifier/properties/assignedAt", "description": "RFC 3339 timestamp" }, "catalogues": { "type": "array", "items": { "type": "object", "properties": { "catalogue": { "type": "string", "minLength": 1 }, "attributedBy": { "$ref": "#/definitions/Party" }, "addedAt": { "$ref": "#/definitions/Identifier/properties/assignedAt", "description": "RFC 3339 timestamp" }, "url": { "type": "string", "format": "uri" }, "dueAt": { "$ref": "#/definitions/Identifier/properties/assignedAt", "description": "RFC 3339 timestamp" } }, "required": [ "catalogue" ], "additionalProperties": false } }, "note": { "type": "string" } }, "additionalProperties": false }, "licence": { "type": "object", "properties": { "spdx": { "type": "string", "minLength": 1 }, "url": { "type": "string", "format": "uri" }, "declareNoAi": { "type": "boolean" } }, "additionalProperties": false }, "attachments": { "type": "array", "items": { "type": "object", "properties": { "name": { "type": "string", "minLength": 1 }, "url": { "type": "string", "format": "uri" }, "mediaType": { "type": "string", "minLength": 1 }, "digest": { "type": "string", "pattern": "^[0-9a-f]{64}$" }, "length": { "type": "integer", "minimum": 0 }, "description": { "type": "array", "items": { "$ref": "#/definitions/LocalizedText" } } }, "required": [ "name", "url", "mediaType", "digest" ], "additionalProperties": false } }, "redactions": { "type": "array", "items": { "$ref": "#/definitions/Redaction" } }, "containers": { "type": "array", "items": { "$ref": "#/definitions/RecordContainer" }, "default": [] }, "severityPrecedence": { "type": "object", "properties": { "preferredAuthor": { "$ref": "#/definitions/Party" }, "order": { "type": "array", "items": { "type": "string", "enum": [ "CVSS_V4_0", "CVSS_V3_1", "CVSS_V3_0", "CVSS_V2_0", "EPSS", "SSVC", "QUALITATIVE" ] } }, "note": { "type": "string" } }, "additionalProperties": false }, "quality": { "type": "object", "properties": { "grade": { "type": "string", "enum": [ "minimal", "basic", "good", "comprehensive" ] }, "missing": { "type": "array", "items": { "type": "string" }, "default": [] }, "assessedAt": { "$ref": "#/definitions/Identifier/properties/assignedAt", "description": "RFC 3339 timestamp" }, "assessedBy": { "$ref": "#/definitions/Party" }, "rulesetVersion": { "type": "string", "minLength": 1 } }, "required": [ "grade" ], "additionalProperties": false }, "createdAt": { "$ref": "#/definitions/Identifier/properties/assignedAt" }, "updatedAt": { "$ref": "#/definitions/Identifier/properties/assignedAt" }, "publishedAt": { "$ref": "#/definitions/Identifier/properties/assignedAt", "description": "RFC 3339 timestamp" }, "withdrawnAt": { "$ref": "#/definitions/Identifier/properties/assignedAt", "description": "RFC 3339 timestamp" } }, "required": [ "schemaVersion", "id", "state", "createdAt", "updatedAt" ], "additionalProperties": false, "allOf": [ { "if": { "not": { "properties": { "state": { "const": "RESERVED" } } } }, "then": { "required": [ "owner", "containers" ], "properties": { "containers": { "contains": { "properties": { "role": { "const": "owner" } }, "required": [ "role" ] } } } } }, { "if": { "properties": { "disputed": { "const": true } }, "required": [ "disputed" ] }, "then": { "required": [ "disputedReason" ] } }, { "if": { "properties": { "state": { "const": "WITHDRAWN" } }, "required": [ "state" ] }, "then": { "required": [ "withdrawnAt" ] } } ] } } }