From cc8bdf7bcb9dd8ab9b3510530c5d4cdf9dbb8826 Mon Sep 17 00:00:00 2001 From: mrappard Date: Wed, 30 Sep 2026 12:28:49 -0400 Subject: [PATCH 1/3] Add externalValidation to entry metadata schema Adds an optional externalValidation array to entryMetadata. Each item references externally hosted validation material (e.g., benchmark results, audits) by uri and type, with an optional sha256 of the referenced content. Co-Authored-By: Claude Opus 5.5 --- softbinding-algorithm-list.schema.json | 37 +++++++++++++++++++++++++- 1 file changed, 36 insertions(+), 1 deletion(-) diff --git a/softbinding-algorithm-list.schema.json b/softbinding-algorithm-list.schema.json index 2528b61..792feec 100644 --- a/softbinding-algorithm-list.schema.json +++ b/softbinding-algorithm-list.schema.json @@ -19,7 +19,14 @@ ], "dateEntered": "2025-01-01T00:00:00Z", "contact": "contact@example.com", - "informationalUrl": "https://example.com/softbinding/alg1" + "informationalUrl": "https://example.com/softbinding/alg1", + "externalValidation": [ + { + "uri": "https://example.com/softbinding/alg1/benchmark-results.pdf", + "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", + "type": "benchmark" + } + ] }, "softBindingResolutionApis": [ "https://resolver.example.com/alg1" @@ -106,6 +113,34 @@ "type": "string", "format": "uri", "description": "A web page containing more details about the algorithm" + }, + "externalValidation": { + "type": "array", + "minItems": 1, + "description": "A list of references to externally hosted material that validates the algorithm's claimed capabilities (e.g., benchmark results, audits, certifications)", + "items": { + "type": "object", + "properties": { + "uri": { + "type": "string", + "format": "uri", + "description": "Location of the external validation material" + }, + "sha256": { + "type": "string", + "pattern": "^[a-fA-F0-9]{64}$", + "description": "Hex-encoded SHA-256 hash of the content at the referenced URI, allowing consumers to detect changes to it" + }, + "type": { + "type": "string", + "description": "The kind of external validation (e.g., `benchmark`, `audit`, `certification`)" + } + }, + "required": [ + "uri", + "type" + ] + } } }, "required": [ From 1d69fe46aae745d1ca055d649f4fd4dccfeebd80 Mon Sep 17 00:00:00 2001 From: mrappard Date: Wed, 30 Sep 2026 12:36:32 -0400 Subject: [PATCH 2/3] Rename externalValidation to externalEvidence and align with spec conventions Use url instead of uri, replace sha256 with an alg/hash pair drawn from the C2PA hash algorithm list, and require type to be an entity-specific namespaced value, following the External Reference assertion's hashed-ext-uri-map and data_types conventions. Co-Authored-By: Claude Opus 5.5 --- softbinding-algorithm-list.schema.json | 48 ++++++++++++++++++-------- 1 file changed, 33 insertions(+), 15 deletions(-) diff --git a/softbinding-algorithm-list.schema.json b/softbinding-algorithm-list.schema.json index 792feec..ebe9641 100644 --- a/softbinding-algorithm-list.schema.json +++ b/softbinding-algorithm-list.schema.json @@ -20,11 +20,12 @@ "dateEntered": "2025-01-01T00:00:00Z", "contact": "contact@example.com", "informationalUrl": "https://example.com/softbinding/alg1", - "externalValidation": [ + "externalEvidence": [ { - "uri": "https://example.com/softbinding/alg1/benchmark-results.pdf", - "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", - "type": "benchmark" + "url": "https://example.com/softbinding/alg1/benchmark-results.pdf", + "type": "com.example.evidence.benchmark", + "alg": "sha256", + "hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" } ] }, @@ -114,32 +115,49 @@ "format": "uri", "description": "A web page containing more details about the algorithm" }, - "externalValidation": { + "externalEvidence": { "type": "array", "minItems": 1, - "description": "A list of references to externally hosted material that validates the algorithm's claimed capabilities (e.g., benchmark results, audits, certifications)", + "description": "A list of references to externally hosted evidence supporting the algorithm's stated capabilities (e.g., benchmark results, audits, certifications). This evidence is provided by the entry owner and is informational only", "items": { "type": "object", "properties": { - "uri": { + "url": { "type": "string", "format": "uri", - "description": "Location of the external validation material" + "description": "Location of the external evidence" }, - "sha256": { + "type": { "type": "string", - "pattern": "^[a-fA-F0-9]{64}$", - "description": "Hex-encoded SHA-256 hash of the content at the referenced URI, allowing consumers to detect changes to it" + "pattern": "^[A-Za-z]{2,63}(?:\\.[A-Za-z0-9](?:[A-Za-z0-9-]*[A-Za-z0-9])?)+\\.?$", + "description": "The kind of evidence referenced. The format follows the entity-specific namespace as specified for C2PA Assertions labels (e.g., `org.example.evidence.benchmark`)" }, - "type": { + "alg": { + "enum": [ + "sha256", + "sha384", + "sha512" + ], + "description": "Identifier of the hash algorithm used to compute `hash`, taken from the C2PA hash algorithm list" + }, + "hash": { "type": "string", - "description": "The kind of external validation (e.g., `benchmark`, `audit`, `certification`)" + "pattern": "^[a-fA-F0-9]+$", + "description": "Hex-encoded hash of the content at `url` at the time the entry was written or last updated, computed with `alg`" } }, "required": [ - "uri", + "url", "type" - ] + ], + "dependentRequired": { + "alg": [ + "hash" + ], + "hash": [ + "alg" + ] + } } } }, From ea7a95c91e34bcf594f92204c3ee62dd9c6658d6 Mon Sep 17 00:00:00 2001 From: mrappard Date: Wed, 30 Sep 2026 12:41:57 -0400 Subject: [PATCH 3/3] Expand externalEvidence examples Show a hashed benchmark report, a signed in-toto attestation (sha384), a third-party Verifiable Credential, and an unhashed live leaderboard. Co-Authored-By: Claude Opus 5.5 --- softbinding-algorithm-list.schema.json | 20 ++++++++++++++++++-- 1 file changed, 18 insertions(+), 2 deletions(-) diff --git a/softbinding-algorithm-list.schema.json b/softbinding-algorithm-list.schema.json index ebe9641..a88a6e8 100644 --- a/softbinding-algorithm-list.schema.json +++ b/softbinding-algorithm-list.schema.json @@ -23,9 +23,25 @@ "externalEvidence": [ { "url": "https://example.com/softbinding/alg1/benchmark-results.pdf", - "type": "com.example.evidence.benchmark", + "type": "com.example.evidence.benchmark.report", "alg": "sha256", - "hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" + "hash": "799d4203122d296792b8005e2ae0dab7757ed9a0083b166bf19e0e400753bd38" + }, + { + "url": "https://example.com/softbinding/alg1/robustness.intoto.jsonl", + "type": "com.example.evidence.attestation.in-toto", + "alg": "sha384", + "hash": "7470cab1248a1af9c48f96f6917ac466e5624a06dac8b1efcdde5f33dfccb766c45fd81de0a28173e370c2c65e929190" + }, + { + "url": "https://lab.example.org/credentials/alg1-robustness.vc.json", + "type": "org.example.evidence.credential.vc", + "alg": "sha256", + "hash": "d512300b8eba83bfa9a9a0148cd7d1998f7ee81f3ed4bdadbe32d601c5b608fd" + }, + { + "url": "https://benchmark.example.org/leaderboards/image-watermarks", + "type": "org.example.evidence.benchmark.leaderboard" } ] },