{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://iarpg.com/package-integrity-report.schema.json",
  "title": "IARPG Offline Package Integrity Report",
  "description": "Build-generated content-integrity result. A matching digest demonstrates content equality, not author identity, approval, or authenticity.",
  "type": "object",
  "additionalProperties": true,
  "required": [
    "report_id",
    "release",
    "package_id",
    "package_version",
    "verified_utc",
    "canonicalization_profile",
    "hash_algorithm",
    "manifest_status",
    "components",
    "package_digest",
    "build_attestation"
  ],
  "properties": {
    "report_id": {
      "type": "string"
    },
    "release": {
      "const": "IARPG-OPS-2"
    },
    "package_id": {
      "type": "string"
    },
    "package_version": {
      "type": "string"
    },
    "verified_utc": {
      "type": "string",
      "format": "date-time"
    },
    "canonicalization_profile": {
      "const": "IARPG-CJSON-1"
    },
    "hash_algorithm": {
      "const": "SHA-256"
    },
    "manifest_status": {
      "enum": [
        "pass",
        "fail",
        "incomplete"
      ]
    },
    "components": {
      "type": "array",
      "items": {
        "type": "object",
        "required": [
          "path",
          "expected_sha256",
          "actual_sha256",
          "status",
          "explanation"
        ]
      }
    },
    "package_digest": {
      "type": "string"
    },
    "original_package_exportable": {
      "const": true
    },
    "build_attestation": {
      "type": "object",
      "required": [
        "build_id",
        "statement",
        "not_human_signature"
      ]
    }
  }
}