{"$schema":"http://json-schema.org/draft-07/schema#","$id":"https://ziro.sh/schema/record.v1.json","title":"ziro.sh record v1","type":"object","additionalProperties":false,"required":["id","kind","title","severity","affects","exploited_since","disclosed","summary","sources","review"],"properties":{"id":{"type":"string","pattern":"^(CVE-\\d{4}-\\d{4,}|ZIRO-\\d{4}-\\d{4,})$","description":"CVE id, or ZIRO-yyyy-nnnn for incidents without a CVE"},"kind":{"enum":["cve","incident"]},"title":{"type":"string","minLength":1,"maxLength":120},"severity":{"type":"object","additionalProperties":false,"required":["cvss","epss","kev"],"properties":{"cvss":{"type":["number","null"],"minimum":0,"maximum":10},"epss":{"type":["number","null"],"minimum":0,"maximum":1},"kev":{"type":"boolean"}}},"affects":{"type":"array","items":{"type":"object","additionalProperties":false,"required":["ecosystem","package","ranges","fixed"],"properties":{"ecosystem":{"type":"string","pattern":"^[a-z0-9.-]+$"},"package":{"type":"string","minLength":1},"ranges":{"type":"array","items":{"type":"string","minLength":1}},"fixed":{"type":"array","items":{"type":"string","minLength":1}}}}},"exploited_since":{"type":["string","null"],"format":"date"},"disclosed":{"type":["string","null"],"format":"date"},"summary":{"type":"string","maxLength":600},"sources":{"type":"array","minItems":1,"uniqueItems":true,"items":{"type":"string","format":"uri","pattern":"^https://"}},"review":{"type":"object","additionalProperties":false,"required":["status","by","at"],"properties":{"status":{"enum":["draft","published","withdrawn"]},"by":{"enum":["human","pipeline"]},"at":{"type":"string","format":"date-time"}}}},"if":{"type":"object","properties":{"review":{"type":"object","properties":{"status":{"const":"published"}}}}},"then":{"properties":{"summary":{"minLength":1,"type":"string"},"sources":{"minItems":2,"type":"array"},"review":{"properties":{"by":{"const":"human"}},"type":"object"}}}}