{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "type": "object",
  "additionalProperties": false,
  "properties": {
    "schema_version": {
      "const": 1
    },
    "kind": {
      "const": "cve"
    },
    "tool": {
      "type": "object",
      "additionalProperties": false,
      "required": [
        "name",
        "version"
      ],
      "properties": {
        "name": {
          "const": "amivuln"
        },
        "version": {
          "type": "string"
        }
      }
    },
    "generated_at": {
      "type": "string",
      "format": "date-time"
    },
    "host": {
      "type": "object",
      "additionalProperties": false,
      "required": [
        "os_id",
        "os_version",
        "arch"
      ],
      "properties": {
        "os_id": {
          "type": "string"
        },
        "os_version": {
          "type": "string"
        },
        "arch": {
          "type": "string"
        }
      }
    },
    "complete": {
      "type": "boolean"
    },
    "sources": {
      "type": "array",
      "items": {
        "$ref": "#/$defs/source"
      }
    },
    "answers": {
      "type": "array",
      "items": {
        "type": "object",
        "additionalProperties": false,
        "required": [
          "id",
          "state",
          "packages"
        ],
        "properties": {
          "id": {
            "type": "string"
          },
          "state": {
            "enum": [
              "affected",
              "not_affected",
              "unknown"
            ],
            "description": "unknown means the distribution data has no record of the CVE; it is not a statement that the host is safe."
          },
          "packages": {
            "type": "array",
            "items": {
              "type": "object",
              "additionalProperties": false,
              "required": [
                "package",
                "severity",
                "fixed_in",
                "kev",
                "epss"
              ],
              "properties": {
                "package": {
                  "$ref": "#/$defs/package"
                },
                "severity": {
                  "$ref": "#/$defs/severity"
                },
                "fixed_in": {
                  "type": [
                    "string",
                    "null"
                  ]
                },
                "kev": {
                  "type": "boolean"
                },
                "epss": {
                  "type": [
                    "number",
                    "null"
                  ],
                  "minimum": 0,
                  "maximum": 1
                }
              }
            }
          }
        }
      }
    },
    "suppressed": {
      "type": "array",
      "description": "Accepted findings, with the reason from the ignore file. Suppressed findings are still listed; they are excluded from --fail-on and from the score.",
      "items": {
        "type": "object",
        "additionalProperties": false,
        "required": [
          "id",
          "reason"
        ],
        "properties": {
          "id": {
            "type": "string"
          },
          "reason": {
            "type": "string"
          }
        }
      }
    }
  },
  "$defs": {
    "source": {
      "type": "object",
      "additionalProperties": false,
      "required": [
        "id",
        "status",
        "age_s",
        "required"
      ],
      "properties": {
        "id": {
          "enum": [
            "arch-tracker",
            "fedora-updateinfo",
            "bodhi",
            "osv",
            "kev",
            "epss"
          ]
        },
        "status": {
          "enum": [
            "ok",
            "stale",
            "failed",
            "skipped"
          ]
        },
        "detail": {
          "type": "string"
        },
        "age_s": {
          "type": "integer",
          "minimum": 0
        },
        "required": {
          "type": "boolean"
        }
      }
    },
    "package": {
      "type": "object",
      "additionalProperties": false,
      "required": [
        "name",
        "version",
        "arch",
        "ecosystem",
        "purl"
      ],
      "properties": {
        "name": {
          "type": "string"
        },
        "version": {
          "type": "string"
        },
        "arch": {
          "type": [
            "string",
            "null"
          ]
        },
        "ecosystem": {
          "enum": [
            "fedora",
            "arch"
          ]
        },
        "purl": {
          "type": "string",
          "pattern": "^pkg:"
        }
      }
    },
    "severity": {
      "enum": [
        "critical",
        "high",
        "medium",
        "low",
        "unknown"
      ]
    }
  },
  "$id": "https://amivuln.dev/schema/cve-v1.json",
  "title": "amivuln cve report, schema version 1",
  "required": [
    "schema_version",
    "kind",
    "tool",
    "generated_at",
    "host",
    "complete",
    "sources",
    "answers",
    "suppressed"
  ]
}