Skip to content

Add externalEvidence to entry metadata #82

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
mrappard wants to merge 3 commits into
base: main
Choose a base branch
from
Draft

Add externalEvidence to entry metadata #82

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
cc8bdf7
Add externalValidation to entry metadata schema
mrappard Sep 30, 2026
1d69fe4
Rename externalValidation to externalEvidence and align with spec con…
mrappard Sep 30, 2026
ea7a95c
Expand externalEvidence examples
mrappard Sep 30, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
71 changes: 70 additions & 1 deletion softbinding-algorithm-list.schema.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,31 @@
],
"dateEntered": "2025-01-01T00:00:00Z",
"contact": "contact@example.com",
"informationalUrl": "https://example.com/softbinding/alg1"
"informationalUrl": "https://example.com/softbinding/alg1",
"externalEvidence": [
{
"url": "https://example.com/softbinding/alg1/benchmark-results.pdf",
"type": "com.example.evidence.benchmark.report",
"alg": "sha256",
"hash": "799d4203122d296792b8005e2ae0dab7757ed9a0083b166bf19e0e400753bd38"
},
{
"url": "https://example.com/softbinding/alg1/robustness.intoto.jsonl",
"type": "com.example.evidence.attestation.in-toto",
"alg": "sha384",
"hash": "7470cab1248a1af9c48f96f6917ac466e5624a06dac8b1efcdde5f33dfccb766c45fd81de0a28173e370c2c65e929190"
},
{
"url": "https://lab.example.org/credentials/alg1-robustness.vc.json",
"type": "org.example.evidence.credential.vc",
"alg": "sha256",
"hash": "d512300b8eba83bfa9a9a0148cd7d1998f7ee81f3ed4bdadbe32d601c5b608fd"
},
{
"url": "https://benchmark.example.org/leaderboards/image-watermarks",
"type": "org.example.evidence.benchmark.leaderboard"
}
]
},
"softBindingResolutionApis": [
"https://resolver.example.com/alg1"
Expand Down Expand Up @@ -106,6 +130,51 @@
"type": "string",
"format": "uri",
"description": "A web page containing more details about the algorithm"
},
"externalEvidence": {
"type": "array",
"minItems": 1,
"description": "A list of references to externally hosted evidence supporting the algorithm's stated capabilities (e.g., benchmark results, audits, certifications). This evidence is provided by the entry owner and is informational only",
"items": {
"type": "object",
"properties": {
"url": {
"type": "string",
"format": "uri",
"description": "Location of the external evidence"
},
"type": {
"type": "string",
"pattern": "^[A-Za-z]{2,63}(?:\\.[A-Za-z0-9](?:[A-Za-z0-9-]*[A-Za-z0-9])?)+\\.?$",
"description": "The kind of evidence referenced. The format follows the entity-specific namespace as specified for C2PA Assertions labels (e.g., `org.example.evidence.benchmark`)"
},
"alg": {
"enum": [
"sha256",
"sha384",
"sha512"
],
"description": "Identifier of the hash algorithm used to compute `hash`, taken from the C2PA hash algorithm list"
},
"hash": {
"type": "string",
"pattern": "^[a-fA-F0-9]+$",
"description": "Hex-encoded hash of the content at `url` at the time the entry was written or last updated, computed with `alg`"
}
Comment on lines +159 to +163

@dcondrey dcondrey Oct 5, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reuses the existing namespace pattern and the hashed-ext-uri shape correctly.

No length check on hash against alg. sha256/384/512 are fixed-length hex (64/96/128 chars) — worth enforcing so a truncated hash doesn't silently pass. Not blocking.

Concretely:

Suggested change
"hash": {
"type": "string",
"pattern": "^[a-fA-F0-9]+$",
"description": "Hex-encoded hash of the content at `url` at the time the entry was written or last updated, computed with `alg`"
}
"hash": {
"type": "string",
"pattern": "^([a-fA-F0-9]{64}|[a-fA-F0-9]{96}|[a-fA-F0-9]{128})$",
"description": "Hex-encoded hash of the content at `url` at the time the entry was written or last updated, computed with `alg`. Length must match sha256 (64), sha384 (96), or sha512 (128) hex characters"
}

Doesn't tie the length to the specific alg value (that needs an if/then at the item level), but catches a truncated or garbled hash either way.

This overlaps with #79 — both add an informational evidence array to entryMetadata, different shape. Only one should land. This one lets you pin content with a hash; #79 doesn't. Which do you want to keep?

Separately: this is generic evidence (audits, leaderboards, certifications), not robustness measurement, so it doesn't address #61 either — that issue asked for comparable, structured scored results, not a link to an owner-hosted page in arbitrary format. If this and #79 get reconciled, robustness numbers probably want to stay a separate structured field precisely so they're comparable; this shape is fine for everything else (audits, leaderboards, certifications) that isn't trying to be comparable across entries.

},
"required": [
"url",
"type"
],
"dependentRequired": {
"alg": [
"hash"
],
"hash": [
"alg"
]
}
Comment thread
mrappard marked this conversation as resolved.
}
}
},
"required": [
Expand Down
Loading