alex/backup-tool
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(v2): enforce hardened M0 contracts

Browse Source
This commit is contained in:
Alex
2026-07-27 18:59:28 +02:00
parent 92f2aaa27f
commit a0d081a4b4
9 changed files with 205 additions and 146 deletions
Download Patch File Download Diff File Expand all files Collapse all files
contracts/repository/v1/manifest.schema.json
+69 -10
View File
@@ -7,19 +7,28 @@
"required": [
"format_version", "backup_id", "repository_id", "source_id", "job_id", "execution_id",
"requested_mode", "effective_mode", "created_at", "source_consistency", "exclusion_policy",
"entries", "aggregates", "encryption_key_id", "manifest_digest"
"entries", "aggregates", "encryption_key_id", "manifest_digest", "manifest_signature"
],
"properties": {
"format_version": {"const": 1},
"backup_id": {"type": "string", "format": "uuid"},
"repository_id": {"type": "string", "format": "uuid"},
"source_id": {"type": "string", "format": "uuid"},
"job_id": {"type": "string", "format": "uuid"},
"execution_id": {"type": "string", "format": "uuid"},
"backup_id": {"$ref": "#/$defs/uuidv7"},
"repository_id": {"$ref": "#/$defs/uuidv7"},
"source_id": {"$ref": "#/$defs/uuidv7"},
"job_id": {"$ref": "#/$defs/uuidv7"},
"execution_id": {"$ref": "#/$defs/uuidv7"},
"requested_mode": {"enum": ["full", "incremental"]},
"effective_mode": {"enum": ["full", "incremental"]},
"created_at": {"type": "string", "format": "date-time"},
"source_consistency": {"type": "object"},
"created_at": {"type": "string", "format": "date-time", "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}(?:\\.[0-9]+)?Z$"},
"source_consistency": {
"type": "object",
"additionalProperties": false,
"required": ["adapter", "captured_at", "evidence"],
"properties": {
"adapter": {"enum": ["local", "ssh", "postgresql", "mysql"]},
"captured_at": {"type": "string", "format": "date-time", "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}(?:\\.[0-9]+)?Z$"},
"evidence": {"type": "object"}
}
},
"exclusion_policy": {
"type": "object",
"additionalProperties": false,
@@ -45,9 +54,24 @@
}
},
"encryption_key_id": {"type": ["string", "null"]},
"manifest_digest": {"type": "string", "pattern": "^[0-9a-f]{64}$"}
"manifest_digest": {"type": "string", "pattern": "^[0-9a-f]{64}$"},
"manifest_signature": {
"type": "object",
"additionalProperties": false,
"required": ["algorithm", "key_id", "value"],
"properties": {
"algorithm": {"const": "ed25519"},
"key_id": {"type": "string", "minLength": 1},
"value": {"type": "string", "pattern": "^[0-9a-f]{128}$"}
}
}
},
"$defs": {
"uuidv7": {
"type": "string",
"format": "uuid",
"pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$"
},
"entry": {
"type": "object",
"additionalProperties": false,
@@ -61,7 +85,42 @@
"mtime_ns": {"type": ["integer", "null"], "minimum": 0},
"link_target": {"type": ["string", "null"]},
"metadata_support": {"type": "array", "items": {"type": "string"}, "uniqueItems": true}
}
},
"allOf": [
{
"if": {"properties": {"type": {"const": "file"}}},
"then": {
"properties": {
"blob_digest": {"type": "string", "pattern": "^[0-9a-f]{64}$"},
"link_target": {"type": "null"}
}
}
},
{
"if": {"properties": {"type": {"const": "directory"}}},
"then": {
"properties": {
"blob_digest": {"type": "null"},
"link_target": {"type": "null"},
"size": {"const": 0}
}
}
},
{
"if": {"properties": {"type": {"const": "symlink"}}},
"then": {
"properties": {
"blob_digest": {"type": "null"},
"link_target": {
"type": "string",
"minLength": 1,
"pattern": "^(?!/)(?!.*(?:^|/)\\.\\.(?:/|$))(?!.*\\\\).+$"
},
"size": {"const": 0}
}
}
}
]
}
}
}