io.atcr.hold.scan

did:web:lexicon.atcr.io

Documentation

Vulnerability scan results for a container manifest. Stored in the hold's embedded PDS. Record key is deterministic: the manifest digest hex without the 'sha256:' prefix, so re-scans upsert the existing record.

main record

Vulnerability scan results for a container manifest. Stored in the hold's embedded PDS. Record key is deterministic: the manifest digest hex without the 'sha256:' prefix, so re-scans upsert the existing record.

Record Key any Any valid record key

Properties

critical integer Required

Count of critical severity vulnerabilities

minimum: 0
high integer Required

Count of high severity vulnerabilities

minimum: 0
low integer Required

Count of low severity vulnerabilities

minimum: 0
manifest string at-uri Required

AT-URI of the scanned manifest (e.g., at://did:plc:xyz/io.atcr.manifest/abc123...)

medium integer Required

Count of medium severity vulnerabilities

minimum: 0
reason string Optional

Optional human-readable explanation for non-ok status (e.g. 'unscannable artifact type application/vnd.cncf.helm.config.v1+json').

maxLength: 256 bytes
repository string Required

Repository name (e.g., myapp)

maxLength: 256 bytes
sbomBlob blob Optional

SBOM blob (SPDX JSON format) uploaded to the hold's blob storage

scannedAt string datetime Required

RFC3339 timestamp of when the scan completed

scannerVersion string Required

Version of the scanner that produced this result (e.g., atcr-scanner-v1.0.0)

maxLength: 64 bytes
status string Optional

Outcome of the scan attempt. 'ok' (or omitted, for back-compat) means the scanner produced an SBOM. 'failed' means the scanner ran but errored. 'skipped' means the scanner intentionally bypassed this artifact type (e.g. helm charts).

maxLength: 32 bytes
Known values: ok, failed, skipped
total integer Required

Total vulnerability count

minimum: 0
userDid string did Required

DID of the image owner

vulnReportBlob blob Optional

Grype vulnerability report blob (JSON) with full CVE details

View raw schema 
{
  "description": "Vulnerability scan results for a container manifest. Stored in the hold's embedded PDS. Record key is deterministic: the manifest digest hex without the 'sha256:' prefix, so re-scans upsert the existing record.",
  "key": "any",
  "record": {
    "properties": {
      "critical": {
        "description": "Count of critical severity vulnerabilities",
        "minimum": 0,
        "type": "integer"
      },
      "high": {
        "description": "Count of high severity vulnerabilities",
        "minimum": 0,
        "type": "integer"
      },
      "low": {
        "description": "Count of low severity vulnerabilities",
        "minimum": 0,
        "type": "integer"
      },
      "manifest": {
        "description": "AT-URI of the scanned manifest (e.g., at://did:plc:xyz/io.atcr.manifest/abc123...)",
        "format": "at-uri",
        "type": "string"
      },
      "medium": {
        "description": "Count of medium severity vulnerabilities",
        "minimum": 0,
        "type": "integer"
      },
      "reason": {
        "description": "Optional human-readable explanation for non-ok status (e.g. 'unscannable artifact type application/vnd.cncf.helm.config.v1+json').",
        "maxLength": 256,
        "type": "string"
      },
      "repository": {
        "description": "Repository name (e.g., myapp)",
        "maxLength": 256,
        "type": "string"
      },
      "sbomBlob": {
        "accept": [
          "application/spdx+json"
        ],
        "description": "SBOM blob (SPDX JSON format) uploaded to the hold's blob storage",
        "type": "blob"
      },
      "scannedAt": {
        "description": "RFC3339 timestamp of when the scan completed",
        "format": "datetime",
        "type": "string"
      },
      "scannerVersion": {
        "description": "Version of the scanner that produced this result (e.g., atcr-scanner-v1.0.0)",
        "maxLength": 64,
        "type": "string"
      },
      "status": {
        "description": "Outcome of the scan attempt. 'ok' (or omitted, for back-compat) means the scanner produced an SBOM. 'failed' means the scanner ran but errored. 'skipped' means the scanner intentionally bypassed this artifact type (e.g. helm charts).",
        "knownValues": [
          "ok",
          "failed",
          "skipped"
        ],
        "maxLength": 32,
        "type": "string"
      },
      "total": {
        "description": "Total vulnerability count",
        "minimum": 0,
        "type": "integer"
      },
      "userDid": {
        "description": "DID of the image owner",
        "format": "did",
        "type": "string"
      },
      "vulnReportBlob": {
        "accept": [
          "application/vnd.atcr.vulnerabilities+json"
        ],
        "description": "Grype vulnerability report blob (JSON) with full CVE details",
        "type": "blob"
      }
    },
    "required": [
      "manifest",
      "repository",
      "userDid",
      "critical",
      "high",
      "medium",
      "low",
      "total",
      "scannerVersion",
      "scannedAt"
    ],
    "type": "object"
  },
  "type": "record"
}

Lexicon Garden

@