{
  "$defs": {
    "Artifact": {
      "properties": {
        "arch": {
          "type": [
            "string",
            "null"
          ]
        },
        "bin": {
          "description": "Executables inside the artifact, as paths relative to the archive\nroot, or the artifact's own name when it is a bare executable. A\nconsumer puts these on PATH under `name`.",
          "items": {
            "$ref": "#/$defs/Bin"
          },
          "type": "array"
        },
        "format": {
          "type": [
            "string",
            "null"
          ]
        },
        "libc": {
          "type": [
            "string",
            "null"
          ]
        },
        "name": {
          "type": "string"
        },
        "os": {
          "type": [
            "string",
            "null"
          ]
        },
        "provenance": {
          "description": "URLs of build provenance statements (SLSA) for this artifact.",
          "items": {
            "type": "string"
          },
          "type": "array"
        },
        "requires": {
          "anyOf": [
            {
              "$ref": "#/$defs/Requires"
            },
            {
              "type": "null"
            }
          ],
          "description": "What the artifact needs from the host."
        },
        "size": {
          "format": "uint64",
          "minimum": 0,
          "type": "integer"
        },
        "url": {
          "type": [
            "string",
            "null"
          ]
        },
        "variant": {
          "description": "Tells apart artifacts that share os, arch, libc, and format:\n`fips`, `baseline`, `debug`, `installer`, `source`.",
          "type": [
            "string",
            "null"
          ]
        }
      },
      "required": [
        "name",
        "size"
      ],
      "type": "object"
    },
    "Attestor": {
      "description": "Who signed the claim.",
      "oneOf": [
        {
          "const": "vendor",
          "description": "The project's own publisher.",
          "type": "string"
        },
        {
          "const": "repackager",
          "description": "A repository or mirror describing a vendor's artifacts on the\nvendor's behalf, having checked whatever evidence the vendor gave.",
          "type": "string"
        }
      ]
    },
    "Bin": {
      "anyOf": [
        {
          "type": "string"
        },
        {
          "properties": {
            "name": {
              "type": "string"
            },
            "path": {
              "type": "string"
            }
          },
          "required": [
            "path",
            "name"
          ],
          "type": "object"
        }
      ],
      "description": "An executable inside an artifact. Serialises as the bare path when the\nPATH name is the file's own name, else as `{ \"path\", \"name\" }`."
    },
    "Digest": {
      "properties": {
        "sha256": {
          "description": "Lowercase hex.",
          "type": "string"
        },
        "sha512": {
          "description": "Lowercase hex, for consumers that want it (electron-updater,\nBalrog, Scoop).",
          "type": [
            "string",
            "null"
          ]
        }
      },
      "required": [
        "sha256"
      ],
      "type": "object"
    },
    "Evidence": {
      "description": "One thing a repackager checked. Documented kinds:\n`pkgbuild-checksums`, `checksum-file-over-tls`, `apt-release-gpg`,\n`vendor-signature`, `github-attestation`, `none`.",
      "properties": {
        "detail": {
          "description": "A key id, URL, or note that lets a reader check the claim.",
          "type": [
            "string",
            "null"
          ]
        },
        "kind": {
          "type": "string"
        }
      },
      "required": [
        "kind"
      ],
      "type": "object"
    },
    "Identity": {
      "description": "How the document is signed, so a consumer can check what it pinned\nagainst what it received.",
      "properties": {
        "issuer": {
          "description": "For `sigstore-oidc`, the OIDC issuer that vouched for the identity,\nsuch as `https://token.actions.githubusercontent.com`.",
          "type": [
            "string",
            "null"
          ]
        },
        "key_id": {
          "description": "For `sigstore-oidc`, the certificate's subject identity: the\nworkflow URI for a CI identity, or the email for a human one. For\n`sigstore-key`, the key id in uppercase hex.",
          "type": "string"
        },
        "scheme": {
          "$ref": "#/$defs/Scheme"
        }
      },
      "required": [
        "scheme",
        "key_id"
      ],
      "type": "object"
    },
    "Predicate": {
      "properties": {
        "artifacts": {
          "items": {
            "$ref": "#/$defs/Artifact"
          },
          "type": "array"
        },
        "attested_by": {
          "$ref": "#/$defs/Attestor",
          "description": "Who is making the claim: the vendor itself, or a repackager that\nchecked the vendor's evidence and signed a document about it."
        },
        "channel": {
          "description": "`stable`, `beta`, `nightly`, or whatever the vendor calls it.",
          "type": [
            "string",
            "null"
          ]
        },
        "evidence": {
          "description": "What a repackager checked before signing.",
          "items": {
            "$ref": "#/$defs/Evidence"
          },
          "type": "array"
        },
        "identity": {
          "$ref": "#/$defs/Identity"
        },
        "notes_url": {
          "type": [
            "string",
            "null"
          ]
        },
        "prerelease": {
          "description": "A release not meant for general use.",
          "type": "boolean"
        },
        "project": {
          "description": "The project's name: a host path such as `github.com/jdx/mise` or\n`mise.jdx.dev`, the way Go names modules. The host is where a\nconsumer discovers releases and, for forge hosts, what identity is\nexpected to have signed them. A tool in a monorepo adds a subpath:\n`github.com/oxc-project/oxc/oxlint`.",
          "type": "string"
        },
        "published_at": {
          "description": "RFC 3339 UTC.",
          "type": "string"
        },
        "sbom": {
          "type": [
            "string",
            "null"
          ]
        },
        "source": {
          "anyOf": [
            {
              "$ref": "#/$defs/Source"
            },
            {
              "type": "null"
            }
          ]
        },
        "supersedes": {
          "description": "The version this release replaces, for ordering.",
          "type": [
            "string",
            "null"
          ]
        },
        "version": {
          "type": "string"
        },
        "version_order": {
          "$ref": "#/$defs/VersionOrder",
          "description": "How consumers order this project's versions."
        }
      },
      "required": [
        "project",
        "version",
        "published_at",
        "artifacts",
        "identity"
      ],
      "type": "object"
    },
    "Requires": {
      "description": "Host requirements a consumer can check before installing.",
      "properties": {
        "glibc_min": {
          "description": "Minimum glibc for a `gnu` Linux build, such as `2.31`.",
          "type": [
            "string",
            "null"
          ]
        },
        "os_min": {
          "description": "Minimum OS version, in the OS's own terms: `12` for macOS Monterey,\n`10.0.17763` for Windows.",
          "type": [
            "string",
            "null"
          ]
        }
      },
      "type": "object"
    },
    "Scheme": {
      "oneOf": [
        {
          "const": "sigstore-oidc",
          "description": "A sigstore bundle signed keylessly with a workload or human OIDC\nidentity, certified by Fulcio and logged to Rekor.",
          "type": "string"
        },
        {
          "const": "sigstore-key",
          "description": "A sigstore bundle signed with a long-lived Ed25519 key, logged to\nRekor.",
          "type": "string"
        }
      ]
    },
    "Source": {
      "properties": {
        "commit": {
          "type": [
            "string",
            "null"
          ]
        },
        "repo": {
          "type": "string"
        },
        "tag": {
          "type": [
            "string",
            "null"
          ]
        }
      },
      "required": [
        "repo"
      ],
      "type": "object"
    },
    "Subject": {
      "properties": {
        "digest": {
          "$ref": "#/$defs/Digest"
        },
        "name": {
          "type": "string"
        }
      },
      "required": [
        "name",
        "digest"
      ],
      "type": "object"
    },
    "VersionOrder": {
      "description": "How a project's versions are ordered, in mise's vocabulary. The vendor\ndeclares it; consumers never infer it from the strings.",
      "oneOf": [
        {
          "const": "source",
          "description": "The order the release list gives, newest first: GitHub's releases\nendpoint, or the vendor's signed list. For date versions,\ntwo-component versions, mixed histories, and anything uncertain.",
          "type": "string"
        },
        {
          "const": "semver",
          "description": "Versions are strict `MAJOR.MINOR.PATCH` (calver such as `2026.9.1`\nincluded) and sort as semver, so the highest is the latest and\nrange constraints have meaning.",
          "type": "string"
        }
      ]
    }
  },
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "description": "An in-toto statement carrying predicate `P`.",
  "properties": {
    "_type": {
      "type": "string"
    },
    "predicate": {
      "$ref": "#/$defs/Predicate"
    },
    "predicateType": {
      "type": "string"
    },
    "subject": {
      "description": "What the predicate is about, by name and digest.",
      "items": {
        "$ref": "#/$defs/Subject"
      },
      "type": "array"
    }
  },
  "required": [
    "_type",
    "subject",
    "predicateType",
    "predicate"
  ],
  "title": "Envelope",
  "type": "object"
}