Publisher feed

Generated from schemas/publisher-feed.schema.json by scripts/gen-config-docs. Do not edit this page: edit the schema or the generator.

The signed document referenced by publisherFeed.file: compatible Gate One versions, external components and plugins, with their version-compatibility rules and revocation status.

Fields

FieldTypeRequiredDescription

schemaVersion

integer (fixed: 1)

yes

Feed schema version. Always 1.

kind

string (fixed: publisher-feed)

yes

Document kind. Always publisher-feed.

publisher

string

no

Publisher identity.

generatedAt

string

no

RFC 3339 timestamp of generation.

validUntil

string

no

RFC 3339 timestamp after which the feed is stale. In enforce mode a stale feed refuses new plugin loads.

hosts

array of object

no

Compatible Gate One releases.

externalComponents

array of object

no

Compatible non-Gate-One components (Redis, an IdP, …).

plugins

array of object

no

Known plugin releases and their status.

revocations

array of object

no

Revoked artefact digests or signing keys.

signature

object

yes

—

hosts

FieldTypeRequiredDescription

name

string

yes

Component name (for example gate-one).

version

string

no

Known-good version.

hostAPI

string

no

Host API constraint, for example >=1.0 <2.0.

externalComponents

FieldTypeRequiredDescription

name

string

yes

Component name (for example redis).

role

string

no

Role in the deployment (session-store, idp, …).

constraint

string

no

Supported version constraint.

plugins

FieldTypeRequiredDescription

name

string

yes

Reverse-DNS plugin name.

version

string

no

Plugin version.

digest

string

no

Artefact digest (sha256:<hex>).

publisher

string

no

Author/company that published the plugin (shown in a registry page).

distribution

string

no

URL where the plugin (artefact + signed manifest + public key) is distributed.

hostAPI

string

no

Host API constraint, for example >=1.0 <2.0.

capabilities

array of string

no

Declared capabilities.

status

string (one of: active, deprecated, revoked)

no

Release status. revoked refuses the plugin in enforce mode (when a digest is present).

requires

map of string to string

no

Version constraints on other components, for example {"gate-one": ">=1.4 <2.0"}.

revocations

FieldTypeRequiredDescription

digest

string

no

Revoked artefact digest.

keyId

string

no

Revoked signing key id.

reason

string

no

misbehaviour, key-compromise, author-request, superseded, …

severity

string

no

low, medium, high.

revokedAt

string

no

RFC 3339 timestamp.

signature

FieldTypeRequiredDescription

alg

string (fixed: ed25519)

yes

Signature algorithm. Always ed25519.

keyId

string

yes

Signing key id; must be in publisherFeed.keys.

value

string

yes

Ed25519 signature (base64 raw URL) over the JCS canonical form of the feed with the signature removed.