101 lines
3.9 KiB
JSON
101 lines
3.9 KiB
JSON
|
{
|
||
|
|
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
||
|
|
"$id": "https://coulomb.social/schemas/railiance/custody-projection-contract.v1.json",
|
||
|
|
"title": "Railiance ephemeral custody projection contract v1",
|
||
|
|
"type": "object",
|
||
|
|
"additionalProperties": false,
|
||
|
|
"required": [
|
||
|
|
"interface", "version", "workplan_id", "engagement_id", "status",
|
||
|
|
"engagement_contract_sha256", "target", "runner", "window", "authority",
|
||
|
|
"identities"
|
||
|
|
],
|
||
|
|
"properties": {
|
||
|
|
"interface": {"const": "railiance.custody-projection-contract"},
|
||
|
|
"version": {"const": 1},
|
||
|
|
"workplan_id": {"const": "RAILIANCE-WP-0025"},
|
||
|
|
"engagement_id": {"type": "string", "pattern": "^[A-Z0-9][A-Z0-9._-]{7,127}$"},
|
||
|
|
"status": {"const": "approved"},
|
||
|
|
"engagement_contract_sha256": {"$ref": "#/$defs/sha256"},
|
||
|
|
"target": {
|
||
|
|
"type": "object",
|
||
|
|
"additionalProperties": false,
|
||
|
|
"required": [
|
||
|
|
"id", "namespace", "deployment", "container", "sender_external_secret", "revision",
|
||
|
|
"image_digest", "contract_sha256"
|
||
|
|
],
|
||
|
|
"properties": {
|
||
|
|
"id": {"type": "string", "minLength": 1},
|
||
|
|
"namespace": {"$ref": "#/$defs/dnsLabel"},
|
||
|
|
"deployment": {"$ref": "#/$defs/dnsLabel"},
|
||
|
|
"container": {"$ref": "#/$defs/dnsLabel"},
|
||
|
|
"sender_external_secret": {"$ref": "#/$defs/dnsLabel"},
|
||
|
|
"revision": {"type": "string", "pattern": "^[0-9a-f]{40}$"},
|
||
|
|
"image_digest": {"type": "string", "pattern": "^sha256:[0-9a-f]{64}$"},
|
||
|
|
"contract_sha256": {"$ref": "#/$defs/sha256"}
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"runner": {
|
||
|
|
"type": "object",
|
||
|
|
"additionalProperties": false,
|
||
|
|
"required": ["namespace", "service_account", "secret_name", "mount_root", "manifest_sha256"],
|
||
|
|
"properties": {
|
||
|
|
"namespace": {"$ref": "#/$defs/dnsLabel"},
|
||
|
|
"service_account": {"$ref": "#/$defs/dnsLabel"},
|
||
|
|
"secret_name": {"$ref": "#/$defs/dnsLabel"},
|
||
|
|
"mount_root": {"type": "string", "pattern": "^/"},
|
||
|
|
"manifest_sha256": {"$ref": "#/$defs/sha256"}
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"window": {
|
||
|
|
"type": "object",
|
||
|
|
"additionalProperties": false,
|
||
|
|
"required": ["starts_at", "projection_cutoff", "expires_at"],
|
||
|
|
"properties": {
|
||
|
|
"starts_at": {"type": "string", "format": "date-time"},
|
||
|
|
"projection_cutoff": {"type": "string", "format": "date-time"},
|
||
|
|
"expires_at": {"type": "string", "format": "date-time"}
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"authority": {
|
||
|
|
"type": "object",
|
||
|
|
"additionalProperties": false,
|
||
|
|
"required": [
|
||
|
|
"remote", "registry_path", "registry_field", "kv_mount", "kv_prefix",
|
||
|
|
"eso_service_account", "eso_namespace"
|
||
|
|
],
|
||
|
|
"properties": {
|
||
|
|
"remote": {"type": "string", "pattern": "^\\S+$"},
|
||
|
|
"registry_path": {"type": "string", "minLength": 1},
|
||
|
|
"registry_field": {"type": "string", "minLength": 1},
|
||
|
|
"kv_mount": {"type": "string", "pattern": "^[^/]+$"},
|
||
|
|
"kv_prefix": {"type": "string", "minLength": 1},
|
||
|
|
"eso_service_account": {"$ref": "#/$defs/dnsLabel"},
|
||
|
|
"eso_namespace": {"$ref": "#/$defs/dnsLabel"}
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"identities": {
|
||
|
|
"type": "array",
|
||
|
|
"minItems": 2,
|
||
|
|
"maxItems": 2,
|
||
|
|
"items": {
|
||
|
|
"type": "object",
|
||
|
|
"additionalProperties": false,
|
||
|
|
"required": ["handle", "role", "sender_name", "tenant", "mount_path", "may_read", "may_write"],
|
||
|
|
"properties": {
|
||
|
|
"handle": {"enum": ["token-a", "token-b"]},
|
||
|
|
"role": {"enum": ["attacker", "owner"]},
|
||
|
|
"sender_name": {"type": "string", "minLength": 1},
|
||
|
|
"tenant": {"type": "string", "minLength": 1},
|
||
|
|
"mount_path": {"type": "string", "pattern": "^/"},
|
||
|
|
"may_read": {"const": true},
|
||
|
|
"may_write": {"const": true}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"$defs": {
|
||
|
|
"sha256": {"type": "string", "pattern": "^(sha256:)?[0-9a-f]{64}$"},
|
||
|
|
"dnsLabel": {"type": "string", "pattern": "^[a-z0-9](?:[-a-z0-9]{0,61}[a-z0-9])?$"}
|
||
|
|
}
|
||
|
|
}
|