index.schema.json

{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "updated_at": {
      "type": "string",
      "format": "date-time",
      "description": "Timestamp indicating when this index.json was last updated"
    },
    "packages": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "id": {
            "type": "string",
            "pattern": "^pkg:[a-zA-Z+.-]+(/[a-zA-Z+.-]+)(/[^@]+)(\\?repository_url=[a-zA-Z0-9_/.-:]+)?$",
            "description": "Package URL (PURL) of the package, excluding version, qualifiers, and subpath. For OCI type, repository_url qualifier must be included."
          },
          "location": {
            "type": "string",
            "pattern": "^[a-zA-Z0-9_/.-]+\\.json$",
            "description": "Relative path to the VEX file for this package within the archive"
          },
          "format": {
            "type": "string",
            "enum": ["openvex", "csaf"],
            "default": "openvex",
            "description": "Format of the VEX data"
          }
        },
        "required": ["id", "location"],
        "additionalProperties": false
      },
      "minItems": 1
    }
  },
  "required": ["updated_at", "packages"],
  "additionalProperties": false
}