{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://genesiscode.dev/schemas/evidence-verifier-trust-policy-v0.1.json",
  "title": "GenesisCode Evidence Verifier Trust Policy v0.1",
  "type": "object",
  "additionalProperties": false,
  "required": [
    "kind",
    "version",
    "compatibilityProfile",
    "acceptedBundleProfiles",
    "requiredPredicateTypes",
    "signaturePolicy",
    "sourcePolicy",
    "networkPolicy",
    "negativeControlPolicy",
    "artifactTreePolicy",
    "compatibility",
    "limits"
  ],
  "properties": {
    "kind": {"const": "genesis/evidence-verifier-trust-policy-v0.1"},
    "version": {"const": "0.1"},
    "compatibilityProfile": {"const": "genesis-evidence-v0.1+slsa-v1+dsse-v1"},
    "acceptedBundleProfiles": {
      "type": "array",
      "minItems": 1,
      "uniqueItems": true,
      "items": {"enum": ["E1", "E2", "E3", "E4"]}
    },
    "requiredPredicateTypes": {
      "type": "array",
      "minItems": 1,
      "uniqueItems": true,
      "items": {"type": "string", "format": "uri"}
    },
    "signaturePolicy": {"$ref": "#/$defs/signaturePolicy"},
    "sourcePolicy": {
      "type": "object",
      "additionalProperties": false,
      "required": [
        "requireClean",
        "allowedDirtyPolicies",
        "expectedRepositoryUri",
        "expectedRevision",
        "expectedTreeDigest"
      ],
      "properties": {
        "requireClean": {"type": "boolean"},
        "allowedDirtyPolicies": {
          "type": "array",
          "minItems": 1,
          "uniqueItems": true,
          "items": {"enum": ["reject", "allow-declared"]}
        },
        "expectedRepositoryUri": {"type": "string", "format": "uri"},
        "expectedRevision": {"type": "string", "pattern": "^(?:[0-9a-f]{40}|[0-9a-f]{64})$"},
        "expectedTreeDigest": {"$ref": "#/$defs/digest"}
      }
    },
    "networkPolicy": {
      "type": "object",
      "additionalProperties": false,
      "required": ["requiredMode"],
      "properties": {"requiredMode": {"enum": ["deny", "declared-only"]}}
    },
    "negativeControlPolicy": {
      "type": "object",
      "additionalProperties": false,
      "required": ["requireAllPassed", "minimumCount"],
      "properties": {
        "requireAllPassed": {"type": "boolean"},
        "minimumCount": {"type": "integer", "minimum": 1}
      }
    },
    "artifactTreePolicy": {
      "type": "object",
      "additionalProperties": false,
      "required": ["required", "algorithm", "manifestDigest"],
      "properties": {
        "required": {"type": "boolean"},
        "algorithm": {"const": "sha256-merkle-v0.1"},
        "manifestDigest": {"$ref": "#/$defs/digest"}
      }
    },
    "compatibility": {"$ref": "#/$defs/compatibility"},
    "limits": {"$ref": "#/$defs/limits"}
  },
  "$defs": {
    "digest": {
      "type": "object",
      "additionalProperties": false,
      "required": ["sha256"],
      "properties": {
        "sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}
      }
    },
    "signaturePolicy": {
      "type": "object",
      "additionalProperties": false,
      "required": ["thresholdsByProfile", "predicateRoles", "trustedKeys"],
      "properties": {
        "thresholdsByProfile": {
          "type": "object",
          "minProperties": 1,
          "additionalProperties": {"type": "integer", "minimum": 1}
        },
        "predicateRoles": {
          "type": "object",
          "minProperties": 1,
          "additionalProperties": {"type": "string", "minLength": 1}
        },
        "trustedKeys": {
          "type": "array",
          "minItems": 1,
          "items": {
            "type": "object",
            "additionalProperties": false,
            "required": ["keyid", "algorithm", "publicKey", "roles"],
            "properties": {
              "keyid": {"type": "string", "pattern": "^sha256:[0-9a-f]{64}$"},
              "algorithm": {"const": "ed25519"},
              "publicKey": {
                "type": "string",
                "pattern": "^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$"
              },
              "roles": {
                "type": "array",
                "minItems": 1,
                "uniqueItems": true,
                "items": {"type": "string", "minLength": 1}
              }
            }
          }
        }
      }
    },
    "compatibility": {
      "type": "object",
      "additionalProperties": false,
      "required": [
        "allowedBuildTypes",
        "allowedBuilderIds",
        "allowedEnvironmentProfiles",
        "allowedVerifiers"
      ],
      "properties": {
        "allowedBuildTypes": {"$ref": "#/$defs/nonEmptyUniqueStrings"},
        "allowedBuilderIds": {"$ref": "#/$defs/nonEmptyUniqueStrings"},
        "allowedEnvironmentProfiles": {"$ref": "#/$defs/nonEmptyUniqueStrings"},
        "allowedVerifiers": {
          "type": "array",
          "minItems": 1,
          "items": {
            "type": "object",
            "additionalProperties": false,
            "required": ["name", "version", "artifactUri", "artifactDigest"],
            "properties": {
              "name": {"type": "string", "minLength": 1},
              "version": {"type": "string", "minLength": 1},
              "artifactUri": {"type": "string", "format": "uri"},
              "artifactDigest": {"$ref": "#/$defs/digest"}
            }
          }
        }
      }
    },
    "limits": {
      "type": "object",
      "additionalProperties": false,
      "required": [
        "maxInputBytes",
        "maxAttestations",
        "maxSignaturesPerAttestation",
        "maxSubjects",
        "maxArtifacts",
        "maxArtifactBytes"
      ],
      "properties": {
        "maxInputBytes": {"type": "integer", "minimum": 1, "maximum": 16777216},
        "maxAttestations": {"type": "integer", "minimum": 1},
        "maxSignaturesPerAttestation": {"type": "integer", "minimum": 1},
        "maxSubjects": {"type": "integer", "minimum": 1},
        "maxArtifacts": {"type": "integer", "minimum": 1},
        "maxArtifactBytes": {"type": "integer", "minimum": 1}
      }
    },
    "nonEmptyUniqueStrings": {
      "type": "array",
      "minItems": 1,
      "uniqueItems": true,
      "items": {"type": "string", "minLength": 1}
    }
  }
}