scripts/project-coordinates.schema.json

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://security.apache.org/schemas/project-coordinates.schema.json",
  "title": "Apache project security coordinates",
  "description": "Hand-maintained security coordinates for Apache projects, keyed by PMC/committee id. Consumed by scripts/project-page.py to build the projects overview and by external tools.",
  "type": "object",
  "propertyNames": {
    "pattern": "^(\\$schema|[a-z0-9][a-z0-9-]*)$"
  },
  "properties": {
    "$schema": {
      "type": "string",
      "description": "Optional reference to this schema so editors validate the file. Ignored by the site generator (keys starting with '$' are not treated as projects)."
    }
  },
  "additionalProperties": {
    "$ref": "#/$defs/pmc"
  },
  "$defs": {
    "urlOrNull": {
      "type": ["string", "null"],
      "format": "uri"
    },
    "project": {
      "type": "object",
      "description": "A named piece of software with its own security model. Used both on its own, for the individual projects a PMC ships (see 'pmc/projects'), and as the base a 'pmc' extends. This definition deliberately does not forbid extra properties: 'additionalProperties: false' only sees the properties declared alongside it, so it would reject the extra keys a 'pmc' adds on top. Each place that uses this definition closes itself with 'unevaluatedProperties: false' instead, which does account for inherited properties.",
      "required": [
        "name",
        "security_model_link",
        "security_model_source"
      ],
      "properties": {
        "name": {
          "type": "string",
          "minLength": 1,
          "description": "Human-readable project name, e.g. \"Apache Kafka\"."
        },
        "security_model_link": {
          "$ref": "#/$defs/urlOrNull",
          "description": "URL of the project's human-facing (HTML) security page or threat model, shown on the site. Null when the project has none."
        },
        "security_model_source": {
          "$ref": "#/$defs/urlOrNull",
          "description": "URL of an AI-friendly plain-text/Markdown version of the security page. Not rendered on the site; used by external tooling to fetch text instead of HTML. Null when unavailable."
        }
      }
    },
    "pmc": {
      "description": "Security coordinates for a single PMC (or podling), keyed by committee id. Extends 'project': a PMC has a name and its own security model, plus the reporting and advisory coordinates below. The six core fields are always present (null when unknown) so consumers need no per-field presence checks.",
      "allOf": [
        {
          "$ref": "#/$defs/project"
        }
      ],
      "required": [
        "name",
        "security_model_link",
        "security_model_source",
        "advisory_link",
        "contact",
        "logo_link"
      ],
      "unevaluatedProperties": false,
      "properties": {
        "advisory_link": {
          "$ref": "#/$defs/urlOrNull",
          "description": "URL of the project's published list of security advisories. Null when the project has none."
        },
        "contact": {
          "type": "string",
          "format": "email",
          "minLength": 1,
          "description": "Security reporting address. Defaults to security@apache.org when the project has no dedicated list."
        },
        "logo_link": {
          "$ref": "#/$defs/urlOrNull",
          "description": "URL of the project logo shown next to its name. Null when no logo is available."
        },
        "contributing": {
          "$ref": "#/$defs/urlOrNull",
          "description": "Optional URL of the project's contributing guide."
        },
        "dependency_advisory_triage": {
          "$ref": "#/$defs/urlOrNull",
          "description": "Optional URL of the project's dependency-advisory triage data (e.g. VEX or suppression file)."
        },
        "projects": {
          "type": "array",
          "minItems": 1,
          "description": "Optional list of the individual projects this PMC ships, for PMCs that maintain more than one. Only needed when a project publishes a security model of its own, distinct from the PMC-wide one above; the PMC's reporting and advisory coordinates cover them all.",
          "items": {
            "allOf": [
              {
                "$ref": "#/$defs/project"
              }
            ],
            "unevaluatedProperties": false
          }
        }
      }
    }
  }
}