Skip to content

Conversation

magnusbaeck
Copy link
Member

@magnusbaeck magnusbaeck commented Aug 25, 2025

Applicable Issues

Fixes #375

Description of the Change

The meta.security.integrityProtection.{publicKey,signature} fields were underspecified, both in the documentation and the schema. We now describe the expected format as well as state the formal requirements for the Base64 strings. The regular expression used for validating the strings is somewhat sloppy and will allow some non-Base64 strings, but getting a 100% correct expression isn't trivial and an expression that's too strict and rejects some rare corner case could cause real problems. There doesn't appear to be a canonical regexp for Base64 strings, and relying on StackOverflow posts with terribly complicated expressions doesn't feel right.

Alternate Designs

None.

Possible Drawbacks

I can't imagine any.

Sign-off

Developer's Certificate of Origin 1.1

By making a contribution to this project, I certify that:

(a) The contribution was created in whole or in part by me and I have the right to submit it under the open source license indicated in the file; or

(b) The contribution is based upon previous work that, to the best of my knowledge, is covered under an appropriate open source license and I have the right under that license to submit that work with modifications, whether created in whole or in part by me, under the same open source license (unless I am permitted to submit under a different license), as indicated in the file; or

(c) The contribution was provided directly to me by some other person who certified (a), (b) or (c) and I have not modified it.

(d) I understand and agree that this project and the contribution are public and that a record of the contribution (including all personal information I submit with it, including my sign-off) is maintained indefinitely and may be redistributed consistent with this project or the open source license(s) involved.

Signed-off-by: Magnus Bäck <[email protected]>

The meta.security.integrityProtection.{publicKey,signature} fields
were underspecified, both in the documentation and the schema.
We now describe the expected format as well as state the formal
requirements for the Base64 strings. The regular expression used
for validating the strings is somewhat sloppy and will allow some
non-Base64 strings, but getting a 100% correct expression isn't
trivial.
@magnusbaeck magnusbaeck added the protocol All protocol changes label Aug 25, 2025
@magnusbaeck magnusbaeck requested a review from a team as a code owner August 25, 2025 14:16
@magnusbaeck
Copy link
Member Author

Output of diff_definitions.py:

--- definitions/EiffelActivityCanceledEvent/5.0.0.yml	2024-07-03 16:49:54.000000000 +0200
+++ definitions/EiffelActivityCanceledEvent/5.0.1.yml	2025-08-25 16:02:40.539279367 +0200
@@ -1,4 +1,4 @@
-# Copyright 2017-2024 Ericsson AB and others.
+# Copyright 2017-2025 Ericsson AB and others.
 # For a full list of individual contributors, please see the commit history.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -15,7 +15,7 @@
 ---
 $schema: https://json-schema.org/draft/2020-12/schema#
 _name: EiffelActivityCanceledEvent
-_version: 5.0.0
+_version: 5.0.1
 _abbrev: ActC
 _description: The EiffelActivityCanceledEvent signals that a previously
   triggered activity execution has been canceled _before it has started_.
@@ -25,7 +25,7 @@
 type: object
 properties:
   meta:
-    $ref: ../EiffelMetaProperty/4.0.0.yml
+    $ref: ../EiffelMetaProperty/4.0.1.yml
   data:
     type: object
     properties:
@@ -102,6 +102,8 @@
       types:
         - EiffelFlowContextDefinedEvent
 _history:
+  - version: 5.0.1
+    changes: Detail the expected representation of public key and signature in meta.security  (see [Issue 375](https://github.com/eiffel-community/eiffel/issues/375)).
   - version: 5.0.0
     changes: Update meta schema to Draft 2020-12 and add link validation.
   - version: 4.0.0
--- schemas/EiffelActivityCanceledEvent/5.0.0.json	2025-08-25 16:03:56.986228817 +0200
+++ schemas/EiffelActivityCanceledEvent/5.0.1.json	2025-08-25 16:03:57.017228797 +0200
@@ -18,9 +18,9 @@
         "version": {
           "type": "string",
           "enum": [
-            "5.0.0"
+            "5.0.1"
           ],
-          "default": "5.0.0"
+          "default": "5.0.1"
         },
         "time": {
           "type": "integer"
@@ -63,7 +63,10 @@
               "type": "object",
               "properties": {
                 "signature": {
-                  "type": "string"
+                  "type": "string",
+                  "pattern": "^[-A-Za-z0-9+/]*={0,3}$",
+                  "contentEncoding": "base64",
+                  "contentMediaType": "application/octet-stream"
                 },
                 "alg": {
                   "type": "string",
@@ -83,7 +86,10 @@
                   ]
                 },
                 "publicKey": {
-                  "type": "string"
+                  "type": "string",
+                  "pattern": "^[-A-Za-z0-9+/]*={0,3}$",
+                  "contentEncoding": "base64",
+                  "contentMediaType": "application/octet-stream"
                 }
               },
               "required": [
--- definitions/EiffelActivityFinishedEvent/4.1.0.yml	2025-01-03 16:13:26.000000000 +0100
+++ definitions/EiffelActivityFinishedEvent/4.1.1.yml	2025-08-25 16:02:40.540279366 +0200
@@ -1,4 +1,4 @@
-# Copyright 2017-2024 Ericsson AB and others.
+# Copyright 2017-2025 Ericsson AB and others.
 # For a full list of individual contributors, please see the commit history.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -15,7 +15,7 @@
 ---
 $schema: https://json-schema.org/draft/2020-12/schema#
 _name: EiffelActivityFinishedEvent
-_version: 4.1.0
+_version: 4.1.1
 _abbrev: ActF
 _description: The EiffelActivityFinishedEvent declares that a previously
   started activity (declared by [EiffelActivityTriggeredEvent](./EiffelActivityTriggeredEvent.md)
@@ -24,7 +24,7 @@
 type: object
 properties:
   meta:
-    $ref: ../EiffelMetaProperty/4.0.0.yml
+    $ref: ../EiffelMetaProperty/4.0.1.yml
   data:
     type: object
     properties:
@@ -128,6 +128,8 @@
       types:
         - EiffelFlowContextDefinedEvent
 _history:
+  - version: 4.1.1
+    changes: Detail the expected representation of public key and signature in meta.security  (see [Issue 375](https://github.com/eiffel-community/eiffel/issues/375)).
   - version: 4.1.0
     changes: Add `data.persistentLogs.integrityProtection.{alg, digest}` (see  [Issue 358](https://github.com/eiffel-community/eiffel/issues/358)).
   - version: 4.0.0
--- schemas/EiffelActivityFinishedEvent/4.1.0.json	2025-08-25 16:03:57.294228613 +0200
+++ schemas/EiffelActivityFinishedEvent/4.1.1.json	2025-08-25 16:03:57.333228588 +0200
@@ -18,9 +18,9 @@
         "version": {
           "type": "string",
           "enum": [
-            "4.1.0"
+            "4.1.1"
           ],
-          "default": "4.1.0"
+          "default": "4.1.1"
         },
         "time": {
           "type": "integer"
@@ -63,7 +63,10 @@
               "type": "object",
               "properties": {
                 "signature": {
-                  "type": "string"
+                  "type": "string",
+                  "pattern": "^[-A-Za-z0-9+/]*={0,3}$",
+                  "contentEncoding": "base64",
+                  "contentMediaType": "application/octet-stream"
                 },
                 "alg": {
                   "type": "string",
@@ -83,7 +86,10 @@
                   ]
                 },
                 "publicKey": {
-                  "type": "string"
+                  "type": "string",
+                  "pattern": "^[-A-Za-z0-9+/]*={0,3}$",
+                  "contentEncoding": "base64",
+                  "contentMediaType": "application/octet-stream"
                 }
               },
               "required": [
--- definitions/EiffelActivityStartedEvent/5.0.0.yml	2024-07-03 16:49:54.000000000 +0200
+++ definitions/EiffelActivityStartedEvent/5.0.1.yml	2025-08-25 16:02:40.540279366 +0200
@@ -1,4 +1,4 @@
-# Copyright 2017-2024 Ericsson AB and others.
+# Copyright 2017-2025 Ericsson AB and others.
 # For a full list of individual contributors, please see the commit history.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -15,7 +15,7 @@
 ---
 $schema: https://json-schema.org/draft/2020-12/schema#
 _name: EiffelActivityStartedEvent
-_version: 5.0.0
+_version: 5.0.1
 _abbrev: ActS
 _description: The EiffelActivityStartedEvent declares that a previously
   triggered activity (declared by [EiffelActivityTriggeredEvent](./EiffelActivityTriggeredEvent.md))
@@ -23,7 +23,7 @@
 type: object
 properties:
   meta:
-    $ref: ../EiffelMetaProperty/4.0.0.yml
+    $ref: ../EiffelMetaProperty/4.0.1.yml
   data:
     type: object
     properties:
@@ -142,6 +142,8 @@
       types:
         - EiffelActivityTriggeredEvent
 _history:
+  - version: 5.0.1
+    changes: Detail the expected representation of public key and signature in meta.security  (see [Issue 375](https://github.com/eiffel-community/eiffel/issues/375)).
   - version: 5.0.0
     changes: Update meta schema to Draft 2020-12 and add link validation.
   - version: 4.3.0
--- schemas/EiffelActivityStartedEvent/5.0.0.json	2025-08-25 16:03:57.596228413 +0200
+++ schemas/EiffelActivityStartedEvent/5.0.1.json	2025-08-25 16:03:57.635228387 +0200
@@ -18,9 +18,9 @@
         "version": {
           "type": "string",
           "enum": [
-            "5.0.0"
+            "5.0.1"
           ],
-          "default": "5.0.0"
+          "default": "5.0.1"
         },
         "time": {
           "type": "integer"
@@ -63,7 +63,10 @@
               "type": "object",
               "properties": {
                 "signature": {
-                  "type": "string"
+                  "type": "string",
+                  "pattern": "^[-A-Za-z0-9+/]*={0,3}$",
+                  "contentEncoding": "base64",
+                  "contentMediaType": "application/octet-stream"
                 },
                 "alg": {
                   "type": "string",
@@ -83,7 +86,10 @@
                   ]
                 },
                 "publicKey": {
-                  "type": "string"
+                  "type": "string",
+                  "pattern": "^[-A-Za-z0-9+/]*={0,3}$",
+                  "contentEncoding": "base64",
+                  "contentMediaType": "application/octet-stream"
                 }
               },
               "required": [
--- definitions/EiffelActivityTriggeredEvent/5.0.0.yml	2024-07-03 16:49:54.000000000 +0200
+++ definitions/EiffelActivityTriggeredEvent/5.0.1.yml	2025-08-25 16:02:40.540279366 +0200
@@ -1,4 +1,4 @@
-# Copyright 2017-2024 Ericsson AB and others.
+# Copyright 2017-2025 Ericsson AB and others.
 # For a full list of individual contributors, please see the commit history.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -15,7 +15,7 @@
 ---
 $schema: https://json-schema.org/draft/2020-12/schema#
 _name: EiffelActivityTriggeredEvent
-_version: 5.0.0
+_version: 5.0.1
 _abbrev: ActT
 _description: |-
   The EiffelActivityTriggeredEvent declares that a certain activity - typically a build, test or analysis activity - has been triggered by some factor. Note that this is crucially different from the activity execution having _started_ (as declared by [EiffelActivityStartedEvent](./EiffelActivityStartedEvent.md)).
@@ -24,7 +24,7 @@
 type: object
 properties:
   meta:
-    $ref: ../EiffelMetaProperty/4.0.0.yml
+    $ref: ../EiffelMetaProperty/4.0.1.yml
   data:
     type: object
     properties:
@@ -155,6 +155,8 @@
       types:
         - EiffelActivityTriggeredEvent
 _history:
+  - version: 5.0.1
+    changes: Detail the expected representation of public key and signature in meta.security  (see [Issue 375](https://github.com/eiffel-community/eiffel/issues/375)).
   - version: 5.0.0
     changes: Update meta schema to Draft 2020-12 and add link validation.
   - version: 4.3.0
--- schemas/EiffelActivityTriggeredEvent/5.0.0.json	2025-08-25 16:03:57.902228210 +0200
+++ schemas/EiffelActivityTriggeredEvent/5.0.1.json	2025-08-25 16:03:57.937228187 +0200
@@ -18,9 +18,9 @@
         "version": {
           "type": "string",
           "enum": [
-            "5.0.0"
+            "5.0.1"
           ],
-          "default": "5.0.0"
+          "default": "5.0.1"
         },
         "time": {
           "type": "integer"
@@ -63,7 +63,10 @@
               "type": "object",
               "properties": {
                 "signature": {
-                  "type": "string"
+                  "type": "string",
+                  "pattern": "^[-A-Za-z0-9+/]*={0,3}$",
+                  "contentEncoding": "base64",
+                  "contentMediaType": "application/octet-stream"
                 },
                 "alg": {
                   "type": "string",
@@ -83,7 +86,10 @@
                   ]
                 },
                 "publicKey": {
-                  "type": "string"
+                  "type": "string",
+                  "pattern": "^[-A-Za-z0-9+/]*={0,3}$",
+                  "contentEncoding": "base64",
+                  "contentMediaType": "application/octet-stream"
                 }
               },
               "required": [
--- definitions/EiffelAnnouncementPublishedEvent/4.0.0.yml	2024-07-03 16:49:54.000000000 +0200
+++ definitions/EiffelAnnouncementPublishedEvent/4.0.1.yml	2025-08-25 16:02:40.540279366 +0200
@@ -1,4 +1,4 @@
-# Copyright 2017-2024 Ericsson AB and others.
+# Copyright 2017-2025 Ericsson AB and others.
 # For a full list of individual contributors, please see the commit history.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -15,7 +15,7 @@
 ---
 $schema: https://json-schema.org/draft/2020-12/schema#
 _name: EiffelAnnouncementPublishedEvent
-_version: 4.0.0
+_version: 4.0.1
 _abbrev: AnnP
 _description: The EiffelAnnouncementPublishedEvent represents an announcement,
   technically regarding any topic but typically used to communicate
@@ -25,7 +25,7 @@
 type: object
 properties:
   meta:
-    $ref: ../EiffelMetaProperty/4.0.0.yml
+    $ref: ../EiffelMetaProperty/4.0.1.yml
   data:
     type: object
     properties:
@@ -114,6 +114,8 @@
       types:
         - EiffelAnnouncementPublishedEvent
 _history:
+  - version: 4.0.1
+    changes: foo bar baz
   - version: 4.0.0
     changes: Update meta schema to Draft 2020-12 and add link validation.
   - version: 3.2.0
--- schemas/EiffelAnnouncementPublishedEvent/4.0.0.json	2025-08-25 16:03:58.127228061 +0200
+++ schemas/EiffelAnnouncementPublishedEvent/4.0.1.json	2025-08-25 16:03:58.158228041 +0200
@@ -18,9 +18,9 @@
         "version": {
           "type": "string",
           "enum": [
-            "4.0.0"
+            "4.0.1"
           ],
-          "default": "4.0.0"
+          "default": "4.0.1"
         },
         "time": {
           "type": "integer"
@@ -63,7 +63,10 @@
               "type": "object",
               "properties": {
                 "signature": {
-                  "type": "string"
+                  "type": "string",
+                  "pattern": "^[-A-Za-z0-9+/]*={0,3}$",
+                  "contentEncoding": "base64",
+                  "contentMediaType": "application/octet-stream"
                 },
                 "alg": {
                   "type": "string",
@@ -83,7 +86,10 @@
                   ]
                 },
                 "publicKey": {
-                  "type": "string"
+                  "type": "string",
+                  "pattern": "^[-A-Za-z0-9+/]*={0,3}$",
+                  "contentEncoding": "base64",
+                  "contentMediaType": "application/octet-stream"
                 }
               },
               "required": [
--- definitions/EiffelArtifactCreatedEvent/4.0.1.yml	2025-01-03 16:13:26.000000000 +0100
+++ definitions/EiffelArtifactCreatedEvent/4.0.2.yml	2025-08-25 16:02:40.540279366 +0200
@@ -1,4 +1,4 @@
-# Copyright 2017-2024 Ericsson AB and others.
+# Copyright 2017-2025 Ericsson AB and others.
 # For a full list of individual contributors, please see the commit history.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -15,7 +15,7 @@
 ---
 $schema: https://json-schema.org/draft/2020-12/schema#
 _name: EiffelArtifactCreatedEvent
-_version: 4.0.1
+_version: 4.0.2
 _abbrev: ArtC
 _description: The EiffelArtifactCreatedEvent declares that a software
   artifact has been created, what its coordinates are, what it contains
@@ -23,7 +23,7 @@
 type: object
 properties:
   meta:
-    $ref: ../EiffelMetaProperty/4.0.0.yml
+    $ref: ../EiffelMetaProperty/4.0.1.yml
   data:
     type: object
     properties:
@@ -187,6 +187,8 @@
       types:
         - EiffelArtifactCreatedEvent
 _history:
+  - version: 4.0.2
+    changes: Detail the expected representation of public key and signature in meta.security  (see [Issue 375](https://github.com/eiffel-community/eiffel/issues/375)).
   - version: 4.0.1
     changes: Use common fragment for Integrity Protection.
   - version: 4.0.0
--- schemas/EiffelArtifactCreatedEvent/4.0.1.json	2025-08-25 16:03:58.520227801 +0200
+++ schemas/EiffelArtifactCreatedEvent/4.0.2.json	2025-08-25 16:03:58.564227772 +0200
@@ -18,9 +18,9 @@
         "version": {
           "type": "string",
           "enum": [
-            "4.0.1"
+            "4.0.2"
           ],
-          "default": "4.0.1"
+          "default": "4.0.2"
         },
         "time": {
           "type": "integer"
@@ -63,7 +63,10 @@
               "type": "object",
               "properties": {
                 "signature": {
-                  "type": "string"
+                  "type": "string",
+                  "pattern": "^[-A-Za-z0-9+/]*={0,3}$",
+                  "contentEncoding": "base64",
+                  "contentMediaType": "application/octet-stream"
                 },
                 "alg": {
                   "type": "string",
@@ -83,7 +86,10 @@
                   ]
                 },
                 "publicKey": {
-                  "type": "string"
+                  "type": "string",
+                  "pattern": "^[-A-Za-z0-9+/]*={0,3}$",
+                  "contentEncoding": "base64",
+                  "contentMediaType": "application/octet-stream"
                 }
               },
               "required": [
--- definitions/EiffelArtifactDeployedEvent/0.2.0.yml	2024-07-03 16:49:54.000000000 +0200
+++ definitions/EiffelArtifactDeployedEvent/0.2.1.yml	2025-08-25 16:02:40.540279366 +0200
@@ -1,4 +1,4 @@
-# Copyright 2022-2024 Axis Communications AB and others.
+# Copyright 2022-2025 Axis Communications AB and others.
 # For a full list of individual contributors, please see the commit history.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -15,7 +15,7 @@
 ---
 $schema: https://json-schema.org/draft/2020-12/schema#
 _name: EiffelArtifactDeployedEvent
-_version: 0.2.0
+_version: 0.2.1
 _abbrev: ArtD
 _description: The EiffelArtifactDeployedEvent states that a software artifact had been deployed into a specified environment or
   that the configuration of the artifact has been changed.
@@ -23,7 +23,7 @@
 type: object
 properties:
   meta:
-    $ref: ../EiffelMetaProperty/4.0.0.yml
+    $ref: ../EiffelMetaProperty/4.0.1.yml
   data:
     type: object
     properties:
@@ -121,6 +121,8 @@
       types:
         - EiffelFlowContextDefinedEvent
 _history:
+  - version: 0.2.1
+    changes: Detail the expected representation of public key and signature in meta.security  (see [Issue 375](https://github.com/eiffel-community/eiffel/issues/375)).
   - version: 0.2.0
     changes: Update meta schema to Draft 2020-12 and add link validation.
   - version: 0.1.0
--- schemas/EiffelArtifactDeployedEvent/0.2.0.json	2025-08-25 16:03:58.624227732 +0200
+++ schemas/EiffelArtifactDeployedEvent/0.2.1.json	2025-08-25 16:03:58.656227711 +0200
@@ -18,9 +18,9 @@
         "version": {
           "type": "string",
           "enum": [
-            "0.2.0"
+            "0.2.1"
           ],
-          "default": "0.2.0"
+          "default": "0.2.1"
         },
         "time": {
           "type": "integer"
@@ -63,7 +63,10 @@
               "type": "object",
               "properties": {
                 "signature": {
-                  "type": "string"
+                  "type": "string",
+                  "pattern": "^[-A-Za-z0-9+/]*={0,3}$",
+                  "contentEncoding": "base64",
+                  "contentMediaType": "application/octet-stream"
                 },
                 "alg": {
                   "type": "string",
@@ -83,7 +86,10 @@
                   ]
                 },
                 "publicKey": {
-                  "type": "string"
+                  "type": "string",
+                  "pattern": "^[-A-Za-z0-9+/]*={0,3}$",
+                  "contentEncoding": "base64",
+                  "contentMediaType": "application/octet-stream"
                 }
               },
               "required": [
--- definitions/EiffelArtifactPublishedEvent/4.0.0.yml	2024-07-03 16:49:54.000000000 +0200
+++ definitions/EiffelArtifactPublishedEvent/4.0.1.yml	2025-08-25 16:02:40.540279366 +0200
@@ -1,4 +1,4 @@
-# Copyright 2017-2024 Ericsson AB and others.
+# Copyright 2017-2025 Ericsson AB and others.
 # For a full list of individual contributors, please see the commit history.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -15,7 +15,7 @@
 ---
 $schema: https://json-schema.org/draft/2020-12/schema#
 _name: EiffelArtifactPublishedEvent
-_version: 4.0.0
+_version: 4.0.1
 _abbrev: ArtP
 _description: The EiffelArtifactPublishedEvent declares that a software
   artifact (declared by [EiffelArtifactCreatedEvent](./EiffelArtifactCreatedEvent.md))
@@ -24,7 +24,7 @@
 type: object
 properties:
   meta:
-    $ref: ../EiffelMetaProperty/4.0.0.yml
+    $ref: ../EiffelMetaProperty/4.0.1.yml
   data:
     type: object
     properties:
@@ -126,6 +126,8 @@
       types:
         - EiffelFlowContextDefinedEvent
 _history:
+  - version: 4.0.1
+    changes: Detail the expected representation of public key and signature in meta.security  (see [Issue 375](https://github.com/eiffel-community/eiffel/issues/375)).
   - version: 4.0.0
     changes: Update meta schema to Draft 2020-12 and add link validation.
   - version: 3.3.0
--- schemas/EiffelArtifactPublishedEvent/4.0.0.json	2025-08-25 16:03:58.893227554 +0200
+++ schemas/EiffelArtifactPublishedEvent/4.0.1.json	2025-08-25 16:03:58.927227531 +0200
@@ -18,9 +18,9 @@
         "version": {
           "type": "string",
           "enum": [
-            "4.0.0"
+            "4.0.1"
           ],
-          "default": "4.0.0"
+          "default": "4.0.1"
         },
         "time": {
           "type": "integer"
@@ -63,7 +63,10 @@
               "type": "object",
               "properties": {
                 "signature": {
-                  "type": "string"
+                  "type": "string",
+                  "pattern": "^[-A-Za-z0-9+/]*={0,3}$",
+                  "contentEncoding": "base64",
+                  "contentMediaType": "application/octet-stream"
                 },
                 "alg": {
                   "type": "string",
@@ -83,7 +86,10 @@
                   ]
                 },
                 "publicKey": {
-                  "type": "string"
+                  "type": "string",
+                  "pattern": "^[-A-Za-z0-9+/]*={0,3}$",
+                  "contentEncoding": "base64",
+                  "contentMediaType": "application/octet-stream"
                 }
               },
               "required": [
--- definitions/EiffelArtifactReusedEvent/4.0.0.yml	2024-07-03 16:49:54.000000000 +0200
+++ definitions/EiffelArtifactReusedEvent/4.0.1.yml	2025-08-25 16:02:40.540279366 +0200
@@ -1,4 +1,4 @@
-# Copyright 2017-2024 Ericsson AB and others.
+# Copyright 2017-2025 Ericsson AB and others.
 # For a full list of individual contributors, please see the commit history.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -15,7 +15,7 @@
 ---
 $schema: https://json-schema.org/draft/2020-12/schema#
 _name: EiffelArtifactReusedEvent
-_version: 4.0.0
+_version: 4.0.1
 _abbrev: ArtR
 _description: |-
   The EiffelArtifactReusedEvent declares that an identified [EiffelArtifactCreatedEvent](./EiffelArtifactCreatedEvent.md) has been _reused_ for an identified [EiffelCompositionDefinedEvent](./EiffelCompositionDefinedEvent.md). This means that it is logically equivalent to an artifact that would have been built from that composition, and can be used for build avoidance (see the [Build Avoidance Usage Example](../usage-examples/build-avoidance.md) for more information).
@@ -24,7 +24,7 @@
 type: object
 properties:
   meta:
-    $ref: ../EiffelMetaProperty/4.0.0.yml
+    $ref: ../EiffelMetaProperty/4.0.1.yml
   data:
     type: object
     properties:
@@ -102,6 +102,8 @@
       types:
         - EiffelArtifactCreatedEvent
 _history:
+  - version: 4.0.1
+    changes: Detail the expected representation of public key and signature in meta.security  (see [Issue 375](https://github.com/eiffel-community/eiffel/issues/375)).
   - version: 4.0.0
     changes: Update meta schema to Draft 2020-12 and add link validation.
   - version: 3.2.0
--- schemas/EiffelArtifactReusedEvent/4.0.0.json	2025-08-25 16:03:59.115227407 +0200
+++ schemas/EiffelArtifactReusedEvent/4.0.1.json	2025-08-25 16:03:59.150227384 +0200
@@ -18,9 +18,9 @@
         "version": {
           "type": "string",
           "enum": [
-            "4.0.0"
+            "4.0.1"
           ],
-          "default": "4.0.0"
+          "default": "4.0.1"
         },
         "time": {
           "type": "integer"
@@ -63,7 +63,10 @@
               "type": "object",
               "properties": {
                 "signature": {
-                  "type": "string"
+                  "type": "string",
+                  "pattern": "^[-A-Za-z0-9+/]*={0,3}$",
+                  "contentEncoding": "base64",
+                  "contentMediaType": "application/octet-stream"
                 },
                 "alg": {
                   "type": "string",
@@ -83,7 +86,10 @@
                   ]
                 },
                 "publicKey": {
-                  "type": "string"
+                  "type": "string",
+                  "pattern": "^[-A-Za-z0-9+/]*={0,3}$",
+                  "contentEncoding": "base64",
+                  "contentMediaType": "application/octet-stream"
                 }
               },
               "required": [
--- definitions/EiffelCompositionDefinedEvent/4.0.0.yml	2024-07-03 16:49:54.000000000 +0200
+++ definitions/EiffelCompositionDefinedEvent/4.0.1.yml	2025-08-25 16:02:40.540279366 +0200
@@ -1,4 +1,4 @@
-# Copyright 2017-2024 Ericsson AB and others.
+# Copyright 2017-2025 Ericsson AB and others.
 # For a full list of individual contributors, please see the commit history.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -15,7 +15,7 @@
 ---
 $schema: https://json-schema.org/draft/2020-12/schema#
 _name: EiffelCompositionDefinedEvent
-_version: 4.0.0
+_version: 4.0.1
 _abbrev: CD
 _description: The EiffelCompositionDefinedEvent declares a composition
   of items (artifacts, sources and other compositions) has been defined,
@@ -24,7 +24,7 @@
 type: object
 properties:
   meta:
-    $ref: ../EiffelMetaProperty/4.0.0.yml
+    $ref: ../EiffelMetaProperty/4.0.1.yml
   data:
     type: object
     properties:
@@ -111,6 +111,8 @@
       types:
         - EiffelCompositionDefinedEvent
 _history:
+  - version: 4.0.1
+    changes: Detail the expected representation of public key and signature in meta.security  (see [Issue 375](https://github.com/eiffel-community/eiffel/issues/375)).
   - version: 4.0.0
     changes: Update meta schema to Draft 2020-12 and add link validation.
   - version: 3.3.0
--- schemas/EiffelCompositionDefinedEvent/4.0.0.json	2025-08-25 16:03:59.374227235 +0200
+++ schemas/EiffelCompositionDefinedEvent/4.0.1.json	2025-08-25 16:03:59.410227211 +0200
@@ -18,9 +18,9 @@
         "version": {
           "type": "string",
           "enum": [
-            "4.0.0"
+            "4.0.1"
           ],
-          "default": "4.0.0"
+          "default": "4.0.1"
         },
         "time": {
           "type": "integer"
@@ -63,7 +63,10 @@
               "type": "object",
               "properties": {
                 "signature": {
-                  "type": "string"
+                  "type": "string",
+                  "pattern": "^[-A-Za-z0-9+/]*={0,3}$",
+                  "contentEncoding": "base64",
+                  "contentMediaType": "application/octet-stream"
                 },
                 "alg": {
                   "type": "string",
@@ -83,7 +86,10 @@
                   ]
                 },
                 "publicKey": {
-                  "type": "string"
+                  "type": "string",
+                  "pattern": "^[-A-Za-z0-9+/]*={0,3}$",
+                  "contentEncoding": "base64",
+                  "contentMediaType": "application/octet-stream"
                 }
               },
               "required": [
--- definitions/EiffelConfidenceLevelModifiedEvent/4.0.0.yml	2024-07-03 16:49:54.000000000 +0200
+++ definitions/EiffelConfidenceLevelModifiedEvent/4.0.1.yml	2025-08-25 16:02:40.540279366 +0200
@@ -1,4 +1,4 @@
-# Copyright 2017-2024 Ericsson AB and others.
+# Copyright 2017-2025 Ericsson AB and others.
 # For a full list of individual contributors, please see the commit history.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -15,7 +15,7 @@
 ---
 $schema: https://json-schema.org/draft/2020-12/schema#
 _name: EiffelConfidenceLevelModifiedEvent
-_version: 4.0.0
+_version: 4.0.1
 _abbrev: CLM
 _description: |-
   The EiffelConfidenceLevelModifiedEvent declares that an entity has achieved (or failed to achieve) a certain level of confidence, or in a broader sense to annotate it as being applicable or relevant to a certain case (e.g. fit for release to a certain customer segment or having passed certain criteria). This is particularly useful for promoting various engineering artifacts, such as product revisions, through the continuous integration and delivery pipeline.
@@ -24,7 +24,7 @@
 type: object
 properties:
   meta:
-    $ref: ../EiffelMetaProperty/4.0.0.yml
+    $ref: ../EiffelMetaProperty/4.0.1.yml
   data:
     type: object
     properties:
@@ -160,6 +160,8 @@
       types:
         - EiffelConfidenceLevelModifiedEvent
 _history:
+  - version: 4.0.1
+    changes: Detail the expected representation of public key and signature in meta.security  (see [Issue 375](https://github.com/eiffel-community/eiffel/issues/375)).
   - version: 4.0.0
     changes: Update meta schema to Draft 2020-12 and add link validation.
   - version: 3.4.0
--- schemas/EiffelConfidenceLevelModifiedEvent/4.0.0.json	2025-08-25 16:03:59.698227021 +0200
+++ schemas/EiffelConfidenceLevelModifiedEvent/4.0.1.json	2025-08-25 16:03:59.735226996 +0200
@@ -18,9 +18,9 @@
         "version": {
           "type": "string",
           "enum": [
-            "4.0.0"
+            "4.0.1"
           ],
-          "default": "4.0.0"
+          "default": "4.0.1"
         },
         "time": {
           "type": "integer"
@@ -63,7 +63,10 @@
               "type": "object",
               "properties": {
                 "signature": {
-                  "type": "string"
+                  "type": "string",
+                  "pattern": "^[-A-Za-z0-9+/]*={0,3}$",
+                  "contentEncoding": "base64",
+                  "contentMediaType": "application/octet-stream"
                 },
                 "alg": {
                   "type": "string",
@@ -83,7 +86,10 @@
                   ]
                 },
                 "publicKey": {
-                  "type": "string"
+                  "type": "string",
+                  "pattern": "^[-A-Za-z0-9+/]*={0,3}$",
+                  "contentEncoding": "base64",
+                  "contentMediaType": "application/octet-stream"
                 }
               },
               "required": [
--- definitions/EiffelEnvironmentDefinedEvent/4.0.0.yml	2024-07-03 16:49:54.000000000 +0200
+++ definitions/EiffelEnvironmentDefinedEvent/4.0.1.yml	2025-08-25 16:02:40.540279366 +0200
@@ -1,4 +1,4 @@
-# Copyright 2017-2024 Ericsson AB and others.
+# Copyright 2017-2025 Ericsson AB and others.
 # For a full list of individual contributors, please see the commit history.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -15,7 +15,7 @@
 ---
 $schema: https://json-schema.org/draft/2020-12/schema#
 _name: EiffelEnvironmentDefinedEvent
-_version: 4.0.0
+_version: 4.0.1
 _abbrev: ED
 _description: |-
   The EiffelEnvironmentDefinedEvent declares an environment which may be referenced from other events in order to secure traceability to the conditions under which an artifact was created or a test was executed. Depending on the technology domain, the nature of an environment varies greatly however: it may be a virtual image, a complete mechatronic system of millions of independent parts, or anything in between. Consequently, a concise yet complete and generic syntax for describing any environment is futile.
@@ -24,7 +24,7 @@
 type: object
 properties:
   meta:
-    $ref: ../EiffelMetaProperty/4.0.0.yml
+    $ref: ../EiffelMetaProperty/4.0.1.yml
   data:
     type: object
     properties:
@@ -149,6 +149,8 @@
         - EiffelArtifactCreatedEvent
         - EiffelCompositionDefinedEvent
 _history:
+  - version: 4.0.1
+    changes: Detail the expected representation of public key and signature in meta.security  (see [Issue 375](https://github.com/eiffel-community/eiffel/issues/375)).
   - version: 4.0.0
     changes: Update meta schema to Draft 2020-12 and add link validation.
   - version: 3.3.0
--- schemas/EiffelEnvironmentDefinedEvent/4.0.0.json	2025-08-25 16:03:59.991226826 +0200
+++ schemas/EiffelEnvironmentDefinedEvent/4.0.1.json	2025-08-25 16:04:00.024226804 +0200
@@ -18,9 +18,9 @@
         "version": {
           "type": "string",
           "enum": [
-            "4.0.0"
+            "4.0.1"
           ],
-          "default": "4.0.0"
+          "default": "4.0.1"
         },
         "time": {
           "type": "integer"
@@ -63,7 +63,10 @@
               "type": "object",
               "properties": {
                 "signature": {
-                  "type": "string"
+                  "type": "string",
+                  "pattern": "^[-A-Za-z0-9+/]*={0,3}$",
+                  "contentEncoding": "base64",
+                  "contentMediaType": "application/octet-stream"
                 },
                 "alg": {
                   "type": "string",
@@ -83,7 +86,10 @@
                   ]
                 },
                 "publicKey": {
-                  "type": "string"
+                  "type": "string",
+                  "pattern": "^[-A-Za-z0-9+/]*={0,3}$",
+                  "contentEncoding": "base64",
+                  "contentMediaType": "application/octet-stream"
                 }
               },
               "required": [
--- definitions/EiffelFlowContextDefinedEvent/4.0.0.yml	2024-07-03 16:49:54.000000000 +0200
+++ definitions/EiffelFlowContextDefinedEvent/4.0.1.yml	2025-08-25 16:02:40.540279366 +0200
@@ -1,4 +1,4 @@
-# Copyright 2017-2024 Ericsson AB and others.
+# Copyright 2017-2025 Ericsson AB and others.
 # For a full list of individual contributors, please see the commit history.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -15,7 +15,7 @@
 ---
 $schema: https://json-schema.org/draft/2020-12/schema#
 _name: EiffelFlowContextDefinedEvent
-_version: 4.0.0
+_version: 4.0.1
 _abbrev: FCD
 _description: |-
   The EiffelFlowContextDefinedEvent describes the context of other events, answering questions such as "Which project is this change part of?" or "Which track does this artifact belong to?". In this way it offers a method of classifying and structuring one's continuous integration and delivery system and thereby facilitating traceability and searchability.
@@ -24,7 +24,7 @@
 type: object
 properties:
   meta:
-    $ref: ../EiffelMetaProperty/4.0.0.yml
+    $ref: ../EiffelMetaProperty/4.0.1.yml
   data:
     type: object
     properties:
@@ -100,6 +100,8 @@
       types:
         - EiffelFlowContextDefinedEvent
 _history:
+  - version: 4.0.1
+    changes: Detail the expected representation of public key and signature in meta.security  (see [Issue 375](https://github.com/eiffel-community/eiffel/issues/375)).
   - version: 4.0.0
     changes: Update meta schema to Draft 2020-12 and add link validation.
   - version: 3.2.0
--- schemas/EiffelFlowContextDefinedEvent/4.0.0.json	2025-08-25 16:04:00.200226688 +0200
+++ schemas/EiffelFlowContextDefinedEvent/4.0.1.json	2025-08-25 16:04:00.229226669 +0200
@@ -18,9 +18,9 @@
         "version": {
           "type": "string",
           "enum": [
-            "4.0.0"
+            "4.0.1"
           ],
-          "default": "4.0.0"
+          "default": "4.0.1"
         },
         "time": {
           "type": "integer"
@@ -63,7 +63,10 @@
               "type": "object",
               "properties": {
                 "signature": {
-                  "type": "string"
+                  "type": "string",
+                  "pattern": "^[-A-Za-z0-9+/]*={0,3}$",
+                  "contentEncoding": "base64",
+                  "contentMediaType": "application/octet-stream"
                 },
                 "alg": {
                   "type": "string",
@@ -83,7 +86,10 @@
                   ]
                 },
                 "publicKey": {
-                  "type": "string"
+                  "type": "string",
+                  "pattern": "^[-A-Za-z0-9+/]*={0,3}$",
+                  "contentEncoding": "base64",
+                  "contentMediaType": "application/octet-stream"
                 }
               },
               "required": [
--- definitions/EiffelIssueDefinedEvent/4.0.0.yml	2024-07-03 16:49:54.000000000 +0200
+++ definitions/EiffelIssueDefinedEvent/4.0.1.yml	2025-08-25 16:02:40.540279366 +0200
@@ -1,4 +1,4 @@
-# Copyright 2017-2024 Ericsson AB and others.
+# Copyright 2017-2025 Ericsson AB and others.
 # For a full list of individual contributors, please see the commit history.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -15,7 +15,7 @@
 ---
 $schema: https://json-schema.org/draft/2020-12/schema#
 _name: EiffelIssueDefinedEvent
-_version: 4.0.0
+_version: 4.0.1
 _abbrev: ID
 _description: The EiffelIssueDefinedEvent declares that an issue has
   been created in some external issue management software. ID is semantically
@@ -25,7 +25,7 @@
 type: object
 properties:
   meta:
-    $ref: ../EiffelMetaProperty/4.0.0.yml
+    $ref: ../EiffelMetaProperty/4.0.1.yml
   data:
     type: object
     properties:
@@ -115,6 +115,8 @@
       types:
         - EiffelFlowContextDefinedEvent
 _history:
+  - version: 4.0.1
+    changes: Detail the expected representation of public key and signature in meta.security  (see [Issue 375](https://github.com/eiffel-community/eiffel/issues/375)).
   - version: 4.0.0
     changes: Update meta schema to Draft 2020-12 and add link validation.
   - version: 3.2.0
--- schemas/EiffelIssueDefinedEvent/4.0.0.json	2025-08-25 16:04:00.390226562 +0200
+++ schemas/EiffelIssueDefinedEvent/4.0.1.json	2025-08-25 16:04:00.420226542 +0200
@@ -18,9 +18,9 @@
         "version": {
           "type": "string",
           "enum": [
-            "4.0.0"
+            "4.0.1"
           ],
-          "default": "4.0.0"
+          "default": "4.0.1"
         },
         "time": {
           "type": "integer"
@@ -63,7 +63,10 @@
               "type": "object",
               "properties": {
                 "signature": {
-                  "type": "string"
+                  "type": "string",
+                  "pattern": "^[-A-Za-z0-9+/]*={0,3}$",
+                  "contentEncoding": "base64",
+                  "contentMediaType": "application/octet-stream"
                 },
                 "alg": {
                   "type": "string",
@@ -83,7 +86,10 @@
                   ]
                 },
                 "publicKey": {
-                  "type": "string"
+                  "type": "string",
+                  "pattern": "^[-A-Za-z0-9+/]*={0,3}$",
+                  "contentEncoding": "base64",
+                  "contentMediaType": "application/octet-stream"
                 }
               },
               "required": [
--- definitions/EiffelIssueVerifiedEvent/5.0.0.yml	2024-07-03 16:49:54.000000000 +0200
+++ definitions/EiffelIssueVerifiedEvent/5.0.1.yml	2025-08-25 16:02:40.540279366 +0200
@@ -1,4 +1,4 @@
-# Copyright 2017-2024 Ericsson AB and others.
+# Copyright 2017-2025 Ericsson AB and others.
 # For a full list of individual contributors, please see the commit history.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -15,7 +15,7 @@
 ---
 $schema: https://json-schema.org/draft/2020-12/schema#
 _name: EiffelIssueVerifiedEvent
-_version: 5.0.0
+_version: 5.0.1
 _abbrev: IV
 _description: |-
   The EiffelIssueVerifiedEvent declares that an issue, typically a requirement, has been verified by some means. It is different from [EiffelTestCaseFinishedEvent](./EiffelTestCaseFinishedEvent.md) in that multiple test case executions may serve as the basis for a single verification or, conversely, multiple issues may be verified based on a single test case execution.
@@ -24,7 +24,7 @@
 type: object
 properties:
   meta:
-    $ref: ../EiffelMetaProperty/4.0.0.yml
+    $ref: ../EiffelMetaProperty/4.0.1.yml
   data:
     type: object
     properties:
@@ -137,6 +137,8 @@
         - EiffelTestCaseFinishedEvent
         - EiffelTestSuiteFinishedEvent
 _history:
+  - version: 5.0.1
+    changes: Detail the expected representation of public key and signature in meta.security  (see [Issue 375](https://github.com/eiffel-community/eiffel/issues/375)).
   - version: 5.0.0
     changes: Update meta schema to Draft 2020-12 and add link validation.
   - version: 4.3.1
--- schemas/EiffelIssueVerifiedEvent/5.0.0.json	2025-08-25 16:04:00.723226341 +0200
+++ schemas/EiffelIssueVerifiedEvent/5.0.1.json	2025-08-25 16:04:00.758226318 +0200
@@ -18,9 +18,9 @@
         "version": {
           "type": "string",
           "enum": [
-            "5.0.0"
+            "5.0.1"
           ],
-          "default": "5.0.0"
+          "default": "5.0.1"
         },
         "time": {
           "type": "integer"
@@ -63,7 +63,10 @@
               "type": "object",
               "properties": {
                 "signature": {
-                  "type": "string"
+                  "type": "string",
+                  "pattern": "^[-A-Za-z0-9+/]*={0,3}$",
+                  "contentEncoding": "base64",
+                  "contentMediaType": "application/octet-stream"
                 },
                 "alg": {
                   "type": "string",
@@ -83,7 +86,10 @@
                   ]
                 },
                 "publicKey": {
-                  "type": "string"
+                  "type": "string",
+                  "pattern": "^[-A-Za-z0-9+/]*={0,3}$",
+                  "contentEncoding": "base64",
+                  "contentMediaType": "application/octet-stream"
                 }
               },
               "required": [
--- definitions/EiffelMetaProperty/4.0.0.yml	2024-06-27 17:13:18.000000000 +0200
+++ definitions/EiffelMetaProperty/4.0.1.yml	2025-08-25 16:02:40.540279366 +0200
@@ -1,4 +1,4 @@
-# Copyright 2017-2024 Ericsson AB and others.
+# Copyright 2017-2025 Ericsson AB and others.
 # For a full list of individual contributors, please see the commit history.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -15,7 +15,7 @@
 
 $schema: https://json-schema.org/draft/draft-2020-12/schema#
 _name: EiffelMetaProperty
-_version: 4.0.0
+_version: 4.0.1
 type: object
 properties:
   id:
@@ -127,7 +127,13 @@
         properties:
           signature:
             _description: The signature produced by the signing algorithm.
+            _format: >-
+              A Base64-encoded representation of the signature. How those
+              bytes should be interpreted depends on the chosen algorithm.
             type: string
+            pattern: '^[-A-Za-z0-9+/]*={0,3}$'
+            contentEncoding: base64
+            contentMediaType: application/octet-stream
           alg:
             _description: >-
               The cryptographic algorithm used to digitally sign the event.
@@ -158,7 +164,13 @@
               mechanism. Note that this property, along with the rest of the
               event, is encompassed by the integrity protection offered via
               __meta.security.integrityProtection__.
+            _format: >-
+              A Base64-encoded public key in DER (Distinguished Encoding Rules)
+              format.
             type: string
+            pattern: '^[-A-Za-z0-9+/]*={0,3}$'
+            contentEncoding: base64
+            contentMediaType: application/octet-stream
         required:
           - signature
           - alg
--- definitions/EiffelSourceChangeCreatedEvent/5.0.0.yml	2024-07-03 16:49:54.000000000 +0200
+++ definitions/EiffelSourceChangeCreatedEvent/5.0.1.yml	2025-08-25 16:02:40.541279366 +0200
@@ -1,4 +1,4 @@
-# Copyright 2017-2024 Ericsson AB and others.
+# Copyright 2017-2025 Ericsson AB and others.
 # For a full list of individual contributors, please see the commit history.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -15,7 +15,7 @@
 ---
 $schema: https://json-schema.org/draft/2020-12/schema#
 _name: EiffelSourceChangeCreatedEvent
-_version: 5.0.0
+_version: 5.0.1
 _abbrev: SCC
 _description: |-
   The EiffelSourceChangeCreatedEvent declares that a change to sources has been made, but not yet submitted (see [EiffelSourceChangeSubmittedEvent](./EiffelSourceChangeSubmittedEvent.md)). This can be used to represent a change done on a private branch, undergoing review or made in a forked repository. Unlike EiffelSourceChangeSubmittedEvent, EiffelSourceChangeCreatedEvent _describes the change_ in terms of who authored it and which issues it addressed.
@@ -24,7 +24,7 @@
 type: object
 properties:
   meta:
-    $ref: ../EiffelMetaProperty/4.0.0.yml
+    $ref: ../EiffelMetaProperty/4.0.1.yml
   data:
     type: object
     properties:
@@ -271,6 +271,8 @@
       types:
         - EiffelIssueDefinedEvent
 _history:
+  - version: 5.0.1
+    changes: Detail the expected representation of public key and signature in meta.security  (see [Issue 375](https://github.com/eiffel-community/eiffel/issues/375)).
   - version: 5.0.0
     changes: Update meta schema to Draft 2020-12 and add link validation.
   - version: 4.2.0
--- schemas/EiffelSourceChangeCreatedEvent/5.0.0.json	2025-08-25 16:04:01.089226099 +0200
+++ schemas/EiffelSourceChangeCreatedEvent/5.0.1.json	2025-08-25 16:04:01.136226068 +0200
@@ -18,9 +18,9 @@
         "version": {
           "type": "string",
           "enum": [
-            "5.0.0"
+            "5.0.1"
           ],
-          "default": "5.0.0"
+          "default": "5.0.1"
         },
         "time": {
           "type": "integer"
@@ -63,7 +63,10 @@
               "type": "object",
               "properties": {
                 "signature": {
-                  "type": "string"
+                  "type": "string",
+                  "pattern": "^[-A-Za-z0-9+/]*={0,3}$",
+                  "contentEncoding": "base64",
+                  "contentMediaType": "application/octet-stream"
                 },
                 "alg": {
                   "type": "string",
@@ -83,7 +86,10 @@
                   ]
                 },
                 "publicKey": {
-                  "type": "string"
+                  "type": "string",
+                  "pattern": "^[-A-Za-z0-9+/]*={0,3}$",
+                  "contentEncoding": "base64",
+                  "contentMediaType": "application/octet-stream"
                 }
               },
               "required": [
--- definitions/EiffelSourceChangeSubmittedEvent/4.0.0.yml	2024-07-03 16:49:54.000000000 +0200
+++ definitions/EiffelSourceChangeSubmittedEvent/4.0.1.yml	2025-08-25 16:02:40.541279366 +0200
@@ -1,4 +1,4 @@
-# Copyright 2017-2024 Ericsson AB and others.
+# Copyright 2017-2025 Ericsson AB and others.
 # For a full list of individual contributors, please see the commit history.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -15,7 +15,7 @@
 ---
 $schema: https://json-schema.org/draft/2020-12/schema#
 _name: EiffelSourceChangeSubmittedEvent
-_version: 4.0.0
+_version: 4.0.1
 _abbrev: SCS
 _description: |-
   The EiffelSourceChangeSubmittedEvent declares that a change has been integrated into to a shared source branch of interest (e.g. "master", "dev" or "mainline") as opposed to a private or local branch. Note that it does not describe what has changed, but instead uses the __CHANGE__ link type to reference [EiffelSourceChangeCreatedEvent](./EiffelSourceChangeCreatedEvent.md).
@@ -26,7 +26,7 @@
 type: object
 properties:
   meta:
-    $ref: ../EiffelMetaProperty/4.0.0.yml
+    $ref: ../EiffelMetaProperty/4.0.1.yml
   data:
     type: object
     properties:
@@ -204,6 +204,8 @@
       types:
         - EiffelSourceChangeSubmittedEvent
 _history:
+  - version: 4.0.1
+    changes: Detail the expected representation of public key and signature in meta.security  (see [Issue 375](https://github.com/eiffel-community/eiffel/issues/375)).
   - version: 4.0.0
     changes: Update meta schema to Draft 2020-12 and add link validation.
   - version: 3.2.0
--- schemas/EiffelSourceChangeSubmittedEvent/4.0.0.json	2025-08-25 16:04:01.391225899 +0200
+++ schemas/EiffelSourceChangeSubmittedEvent/4.0.1.json	2025-08-25 16:04:01.433225871 +0200
@@ -18,9 +18,9 @@
         "version": {
           "type": "string",
           "enum": [
-            "4.0.0"
+            "4.0.1"
           ],
-          "default": "4.0.0"
+          "default": "4.0.1"
         },
         "time": {
           "type": "integer"
@@ -63,7 +63,10 @@
               "type": "object",
               "properties": {
                 "signature": {
-                  "type": "string"
+                  "type": "string",
+                  "pattern": "^[-A-Za-z0-9+/]*={0,3}$",
+                  "contentEncoding": "base64",
+                  "contentMediaType": "application/octet-stream"
                 },
                 "alg": {
                   "type": "string",
@@ -83,7 +86,10 @@
                   ]
                 },
                 "publicKey": {
-                  "type": "string"
+                  "type": "string",
+                  "pattern": "^[-A-Za-z0-9+/]*={0,3}$",
+                  "contentEncoding": "base64",
+                  "contentMediaType": "application/octet-stream"
                 }
               },
               "required": [
--- definitions/EiffelTestCaseCanceledEvent/4.0.0.yml	2024-07-03 16:49:54.000000000 +0200
+++ definitions/EiffelTestCaseCanceledEvent/4.0.1.yml	2025-08-25 16:02:40.541279366 +0200
@@ -1,4 +1,4 @@
-# Copyright 2017-2024 Ericsson AB and others.
+# Copyright 2017-2025 Ericsson AB and others.
 # For a full list of individual contributors, please see the commit history.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -15,7 +15,7 @@
 ---
 $schema: https://json-schema.org/draft/2020-12/schema#
 _name: EiffelTestCaseCanceledEvent
-_version: 4.0.0
+_version: 4.0.1
 _abbrev: TCC
 _description: The EiffelTestCaseCanceledEvent declares that a previously
   triggered test case execution (represented by [EiffelTestCaseTriggeredEvent](./EiffelTestCaseTriggeredEvent.md))
@@ -25,7 +25,7 @@
 type: object
 properties:
   meta:
-    $ref: ../EiffelMetaProperty/4.0.0.yml
+    $ref: ../EiffelMetaProperty/4.0.1.yml
   data:
     type: object
     properties:
@@ -102,6 +102,8 @@
       types:
         - EiffelTestCaseTriggeredEvent
 _history:
+  - version: 4.0.1
+    changes: Detail the expected representation of public key and signature in meta.security  (see [Issue 375](https://github.com/eiffel-community/eiffel/issues/375)).
   - version: 4.0.0
     changes: Update meta schema to Draft 2020-12 and add link validation.
   - version: 3.2.0
--- schemas/EiffelTestCaseCanceledEvent/4.0.0.json	2025-08-25 16:04:01.621225746 +0200
+++ schemas/EiffelTestCaseCanceledEvent/4.0.1.json	2025-08-25 16:04:01.652225726 +0200
@@ -18,9 +18,9 @@
         "version": {
           "type": "string",
           "enum": [
-            "4.0.0"
+            "4.0.1"
           ],
-          "default": "4.0.0"
+          "default": "4.0.1"
         },
         "time": {
           "type": "integer"
@@ -63,7 +63,10 @@
               "type": "object",
               "properties": {
                 "signature": {
-                  "type": "string"
+                  "type": "string",
+                  "pattern": "^[-A-Za-z0-9+/]*={0,3}$",
+                  "contentEncoding": "base64",
+                  "contentMediaType": "application/octet-stream"
                 },
                 "alg": {
                   "type": "string",
@@ -83,7 +86,10 @@
                   ]
                 },
                 "publicKey": {
-                  "type": "string"
+                  "type": "string",
+                  "pattern": "^[-A-Za-z0-9+/]*={0,3}$",
+                  "contentEncoding": "base64",
+                  "contentMediaType": "application/octet-stream"
                 }
               },
               "required": [
--- definitions/EiffelTestCaseFinishedEvent/4.1.0.yml	2025-01-03 16:13:26.000000000 +0100
+++ definitions/EiffelTestCaseFinishedEvent/4.1.1.yml	2025-08-25 16:02:40.541279366 +0200
@@ -1,4 +1,4 @@
-# Copyright 2017-2024 Ericsson AB and others.
+# Copyright 2017-2025 Ericsson AB and others.
 # For a full list of individual contributors, please see the commit history.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -15,7 +15,7 @@
 ---
 $schema: https://json-schema.org/draft/2020-12/schema#
 _name: EiffelTestCaseFinishedEvent
-_version: 4.1.0
+_version: 4.1.1
 _abbrev: TCF
 _description: |-
   The EiffelTestCaseFinishedEvent declares that a previously started test case (declared by [EiffelTestCaseStartedEvent](./EiffelTestCaseStartedEvent.md)) has finished and reports the outcome.
@@ -26,7 +26,7 @@
 type: object
 properties:
   meta:
-    $ref: ../EiffelMetaProperty/4.0.0.yml
+    $ref: ../EiffelMetaProperty/4.0.1.yml
   data:
     type: object
     properties:
@@ -162,6 +162,8 @@
       types:
         - EiffelTestCaseTriggeredEvent
 _history:
+  - version: 4.1.1
+    changes: Detail the expected representation of public key and signature in meta.security  (see [Issue 375](https://github.com/eiffel-community/eiffel/issues/375)).
   - version: 4.1.0
     changes: Add `data.persistentLogs.integrityProtection.{alg, digest}` (see  [Issue 358](https://github.com/eiffel-community/eiffel/issues/358)).
   - version: 4.0.0
--- schemas/EiffelTestCaseFinishedEvent/4.1.0.json	2025-08-25 16:04:02.025225479 +0200
+++ schemas/EiffelTestCaseFinishedEvent/4.1.1.json	2025-08-25 16:04:02.067225451 +0200
@@ -18,9 +18,9 @@
         "version": {
           "type": "string",
           "enum": [
-            "4.1.0"
+            "4.1.1"
           ],
-          "default": "4.1.0"
+          "default": "4.1.1"
         },
         "time": {
           "type": "integer"
@@ -63,7 +63,10 @@
               "type": "object",
               "properties": {
                 "signature": {
-                  "type": "string"
+                  "type": "string",
+                  "pattern": "^[-A-Za-z0-9+/]*={0,3}$",
+                  "contentEncoding": "base64",
+                  "contentMediaType": "application/octet-stream"
                 },
                 "alg": {
                   "type": "string",
@@ -83,7 +86,10 @@
                   ]
                 },
                 "publicKey": {
-                  "type": "string"
+                  "type": "string",
+                  "pattern": "^[-A-Za-z0-9+/]*={0,3}$",
+                  "contentEncoding": "base64",
+                  "contentMediaType": "application/octet-stream"
                 }
               },
               "required": [
--- definitions/EiffelTestCaseStartedEvent/4.0.0.yml	2024-07-03 16:49:54.000000000 +0200
+++ definitions/EiffelTestCaseStartedEvent/4.0.1.yml	2025-08-25 16:02:40.541279366 +0200
@@ -1,4 +1,4 @@
-# Copyright 2017-2024 Ericsson AB and others.
+# Copyright 2017-2025 Ericsson AB and others.
 # For a full list of individual contributors, please see the commit history.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -15,7 +15,7 @@
 ---
 $schema: https://json-schema.org/draft/2020-12/schema#
 _name: EiffelTestCaseStartedEvent
-_version: 4.0.0
+_version: 4.0.1
 _abbrev: TCS
 _description: The EiffelTestCaseStartedEvent declares that the execution
   of a test case has commenced. This event SHALL be preceded by a [EiffelTestCaseTriggeredEvent](./EiffelTestCaseTriggeredEvent.md),
@@ -23,7 +23,7 @@
 type: object
 properties:
   meta:
-    $ref: ../EiffelMetaProperty/4.0.0.yml
+    $ref: ../EiffelMetaProperty/4.0.1.yml
   data:
     type: object
     properties:
@@ -143,6 +143,8 @@
       types:
         - EiffelTestCaseTriggeredEvent
 _history:
+  - version: 4.0.1
+    changes: Detail the expected representation of public key and signature in meta.security  (see [Issue 375](https://github.com/eiffel-community/eiffel/issues/375)).
   - version: 4.0.0
     changes: Update meta schema to Draft 2020-12 and add link validation.
   - version: 3.3.0
--- schemas/EiffelTestCaseStartedEvent/4.0.0.json	2025-08-25 16:04:02.301225295 +0200
+++ schemas/EiffelTestCaseStartedEvent/4.0.1.json	2025-08-25 16:04:02.335225273 +0200
@@ -18,9 +18,9 @@
         "version": {
           "type": "string",
           "enum": [
-            "4.0.0"
+            "4.0.1"
           ],
-          "default": "4.0.0"
+          "default": "4.0.1"
         },
         "time": {
           "type": "integer"
@@ -63,7 +63,10 @@
               "type": "object",
               "properties": {
                 "signature": {
-                  "type": "string"
+                  "type": "string",
+                  "pattern": "^[-A-Za-z0-9+/]*={0,3}$",
+                  "contentEncoding": "base64",
+                  "contentMediaType": "application/octet-stream"
                 },
                 "alg": {
                   "type": "string",
@@ -83,7 +86,10 @@
                   ]
                 },
                 "publicKey": {
-                  "type": "string"
+                  "type": "string",
+                  "pattern": "^[-A-Za-z0-9+/]*={0,3}$",
+                  "contentEncoding": "base64",
+                  "contentMediaType": "application/octet-stream"
                 }
               },
               "required": [
--- definitions/EiffelTestCaseTriggeredEvent/4.0.0.yml	2024-07-03 16:49:54.000000000 +0200
+++ definitions/EiffelTestCaseTriggeredEvent/4.0.1.yml	2025-08-25 16:02:40.541279366 +0200
@@ -1,4 +1,4 @@
-# Copyright 2017-2024 Ericsson AB and others.
+# Copyright 2017-2025 Ericsson AB and others.
 # For a full list of individual contributors, please see the commit history.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -15,7 +15,7 @@
 ---
 $schema: https://json-schema.org/draft/2020-12/schema#
 _name: EiffelTestCaseTriggeredEvent
-_version: 4.0.0
+_version: 4.0.1
 _abbrev: TCT
 _description: |-
   The EiffelTestCaseTriggeredEvent declares that the execution of a test case has been triggered, but not yet started. This can either be declared stand-alone or as part of an activity or test suite, using either a __CAUSE__ or a __CONTEXT__ link type, respectively.
@@ -24,7 +24,7 @@
 type: object
 properties:
   meta:
-    $ref: ../EiffelMetaProperty/4.0.0.yml
+    $ref: ../EiffelMetaProperty/4.0.1.yml
   data:
     type: object
     properties:
@@ -209,6 +209,8 @@
       types:
         - EiffelTestCaseTriggeredEvent
 _history:
+  - version: 4.0.1
+    changes: Detail the expected representation of public key and signature in meta.security  (see [Issue 375](https://github.com/eiffel-community/eiffel/issues/375)).
   - version: 4.0.0
     changes: Update meta schema to Draft 2020-12 and add link validation.
   - version: 3.5.1
--- schemas/EiffelTestCaseTriggeredEvent/4.0.0.json	2025-08-25 16:04:02.734225009 +0200
+++ schemas/EiffelTestCaseTriggeredEvent/4.0.1.json	2025-08-25 16:04:02.775224981 +0200
@@ -18,9 +18,9 @@
         "version": {
           "type": "string",
           "enum": [
-            "4.0.0"
+            "4.0.1"
           ],
-          "default": "4.0.0"
+          "default": "4.0.1"
         },
         "time": {
           "type": "integer"
@@ -63,7 +63,10 @@
               "type": "object",
               "properties": {
                 "signature": {
-                  "type": "string"
+                  "type": "string",
+                  "pattern": "^[-A-Za-z0-9+/]*={0,3}$",
+                  "contentEncoding": "base64",
+                  "contentMediaType": "application/octet-stream"
                 },
                 "alg": {
                   "type": "string",
@@ -83,7 +86,10 @@
                   ]
                 },
                 "publicKey": {
-                  "type": "string"
+                  "type": "string",
+                  "pattern": "^[-A-Za-z0-9+/]*={0,3}$",
+                  "contentEncoding": "base64",
+                  "contentMediaType": "application/octet-stream"
                 }
               },
               "required": [
--- definitions/EiffelTestExecutionRecipeCollectionCreatedEvent/5.0.0.yml	2024-07-03 16:49:54.000000000 +0200
+++ definitions/EiffelTestExecutionRecipeCollectionCreatedEvent/5.0.1.yml	2025-08-25 16:02:40.541279366 +0200
@@ -1,4 +1,4 @@
-# Copyright 2017-2024 Ericsson AB and others.
+# Copyright 2017-2025 Ericsson AB and others.
 # For a full list of individual contributors, please see the commit history.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -15,7 +15,7 @@
 ---
 $schema: https://json-schema.org/draft/2020-12/schema#
 _name: EiffelTestExecutionRecipeCollectionCreatedEvent
-_version: 5.0.0
+_version: 5.0.1
 _abbrev: TERCC
 _description: |-
   The EiffelTestExecutionRecipeCollectionCreatedEvent declares that a collection of test execution recipes has been created. In order to clarify what that means, several concepts need to be explained.
@@ -30,7 +30,7 @@
 type: object
 properties:
   meta:
-    $ref: ../EiffelMetaProperty/4.0.0.yml
+    $ref: ../EiffelMetaProperty/4.0.1.yml
   data:
     type: object
     properties:
@@ -239,6 +239,8 @@
       types:
         - EiffelFlowContextDefinedEvent
 _history:
+  - version: 5.0.1
+    changes: Detail the expected representation of public key and signature in meta.security  (see [Issue 375](https://github.com/eiffel-community/eiffel/issues/375)).
   - version: 5.0.0
     changes: Update meta schema to Draft 2020-12 and add link validation.
   - version: 4.3.1
--- schemas/EiffelTestExecutionRecipeCollectionCreatedEvent/5.0.0.json	2025-08-25 16:04:03.219224687 +0200
+++ schemas/EiffelTestExecutionRecipeCollectionCreatedEvent/5.0.1.json	2025-08-25 16:04:03.264224657 +0200
@@ -18,9 +18,9 @@
         "version": {
           "type": "string",
           "enum": [
-            "5.0.0"
+            "5.0.1"
           ],
-          "default": "5.0.0"
+          "default": "5.0.1"
         },
         "time": {
           "type": "integer"
@@ -63,7 +63,10 @@
               "type": "object",
               "properties": {
                 "signature": {
-                  "type": "string"
+                  "type": "string",
+                  "pattern": "^[-A-Za-z0-9+/]*={0,3}$",
+                  "contentEncoding": "base64",
+                  "contentMediaType": "application/octet-stream"
                 },
                 "alg": {
                   "type": "string",
@@ -83,7 +86,10 @@
                   ]
                 },
                 "publicKey": {
-                  "type": "string"
+                  "type": "string",
+                  "pattern": "^[-A-Za-z0-9+/]*={0,3}$",
+                  "contentEncoding": "base64",
+                  "contentMediaType": "application/octet-stream"
                 }
               },
               "required": [
--- definitions/EiffelTestSuiteFinishedEvent/4.1.0.yml	2025-01-03 16:13:26.000000000 +0100
+++ definitions/EiffelTestSuiteFinishedEvent/4.1.1.yml	2025-08-25 16:02:40.541279366 +0200
@@ -1,4 +1,4 @@
-# Copyright 2017-2024 Ericsson AB and others.
+# Copyright 2017-2025 Ericsson AB and others.
 # For a full list of individual contributors, please see the commit history.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -15,7 +15,7 @@
 ---
 $schema: https://json-schema.org/draft/2020-12/schema#
 _name: EiffelTestSuiteFinishedEvent
-_version: 4.1.0
+_version: 4.1.1
 _abbrev: TSF
 _description: |-
   The EiffelTestSuiteFinishedEvent declares that a previously started test suite (declared by [EiffelTestSuiteStartedEvent](./EiffelTestSuiteStartedEvent.md)) has finished and reports the outcome.
@@ -24,7 +24,7 @@
 type: object
 properties:
   meta:
-    $ref: ../EiffelMetaProperty/4.0.0.yml
+    $ref: ../EiffelMetaProperty/4.0.1.yml
   data:
     type: object
     properties:
@@ -129,6 +129,8 @@
       types:
         - EiffelTestSuiteStartedEvent
 _history:
+  - version: 4.1.1
+    changes: Detail the expected representation of public key and signature in meta.security  (see [Issue 375](https://github.com/eiffel-community/eiffel/issues/375)).
   - version: 4.1.0
     changes: Add `data.persistentLogs.integrityProtection.{alg, digest}` (see  [Issue 358](https://github.com/eiffel-community/eiffel/issues/358)).
   - version: 4.0.0
--- schemas/EiffelTestSuiteFinishedEvent/4.1.0.json	2025-08-25 16:04:03.601224434 +0200
+++ schemas/EiffelTestSuiteFinishedEvent/4.1.1.json	2025-08-25 16:04:03.645224405 +0200
@@ -18,9 +18,9 @@
         "version": {
           "type": "string",
           "enum": [
-            "4.1.0"
+            "4.1.1"
           ],
-          "default": "4.1.0"
+          "default": "4.1.1"
         },
         "time": {
           "type": "integer"
@@ -63,7 +63,10 @@
               "type": "object",
               "properties": {
                 "signature": {
-                  "type": "string"
+                  "type": "string",
+                  "pattern": "^[-A-Za-z0-9+/]*={0,3}$",
+                  "contentEncoding": "base64",
+                  "contentMediaType": "application/octet-stream"
                 },
                 "alg": {
                   "type": "string",
@@ -83,7 +86,10 @@
                   ]
                 },
                 "publicKey": {
-                  "type": "string"
+                  "type": "string",
+                  "pattern": "^[-A-Za-z0-9+/]*={0,3}$",
+                  "contentEncoding": "base64",
+                  "contentMediaType": "application/octet-stream"
                 }
               },
               "required": [
--- definitions/EiffelTestSuiteStartedEvent/4.0.0.yml	2024-07-03 16:49:54.000000000 +0200
+++ definitions/EiffelTestSuiteStartedEvent/4.0.1.yml	2025-08-25 16:02:40.541279366 +0200
@@ -1,4 +1,4 @@
-# Copyright 2017-2024 Ericsson AB and others.
+# Copyright 2017-2025 Ericsson AB and others.
 # For a full list of individual contributors, please see the commit history.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -15,7 +15,7 @@
 ---
 $schema: https://json-schema.org/draft/2020-12/schema#
 _name: EiffelTestSuiteStartedEvent
-_version: 4.0.0
+_version: 4.0.1
 _abbrev: TSS
 _description: |-
   The EiffelTestSuiteStartedEvent declares that the execution of a test suite has started. This can either be declared stand-alone or as part of an activity or other test suite, using either a __CAUSE__ or a __CONTEXT__ link type, respectively.
@@ -24,7 +24,7 @@
 type: object
 properties:
   meta:
-    $ref: ../EiffelMetaProperty/4.0.0.yml
+    $ref: ../EiffelMetaProperty/4.0.1.yml
   data:
     type: object
     properties:
@@ -184,6 +184,8 @@
       types:
         - EiffelTestExecutionRecipeCollectionCreatedEvent
 _history:
+  - version: 4.0.1
+    changes: Detail the expected representation of public key and signature in meta.security  (see [Issue 375](https://github.com/eiffel-community/eiffel/issues/375)).
   - version: 4.0.0
     changes: Update meta schema to Draft 2020-12 and add link validation.
   - version: 3.4.0
--- schemas/EiffelTestSuiteStartedEvent/4.0.0.json	2025-08-25 16:04:03.948224204 +0200
+++ schemas/EiffelTestSuiteStartedEvent/4.0.1.json	2025-08-25 16:04:03.990224176 +0200
@@ -18,9 +18,9 @@
         "version": {
           "type": "string",
           "enum": [
-            "4.0.0"
+            "4.0.1"
           ],
-          "default": "4.0.0"
+          "default": "4.0.1"
         },
         "time": {
           "type": "integer"
@@ -63,7 +63,10 @@
               "type": "object",
               "properties": {
                 "signature": {
-                  "type": "string"
+                  "type": "string",
+                  "pattern": "^[-A-Za-z0-9+/]*={0,3}$",
+                  "contentEncoding": "base64",
+                  "contentMediaType": "application/octet-stream"
                 },
                 "alg": {
                   "type": "string",
@@ -83,7 +86,10 @@
                   ]
                 },
                 "publicKey": {
-                  "type": "string"
+                  "type": "string",
+                  "pattern": "^[-A-Za-z0-9+/]*={0,3}$",
+                  "contentEncoding": "base64",
+                  "contentMediaType": "application/octet-stream"
                 }
               },
               "required": [

Copy link
Member

@m-linner-ericsson m-linner-ericsson left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Only two smaller things:

@e-backmark-ericsson
Copy link
Member

LGTM, apart from Mattias' comments

@magnusbaeck
Copy link
Member Author

The "foo bar baz" text

:-) Not sure how the sed command I ran to batch-update all files didn't replace that occurrence. Good catch!

Maybe add something in the PR text about why not using the longer regexp as described in https://stackoverflow.com/questions/475074/regex-to-parse-or-validate-base64-data. (It could be that I have misunderstood something here due to the short time for review)

I updated the PR description with an elaboratation.

@magnusbaeck
Copy link
Member Author

I'm feeling a bit paranoid over the regexp, so before merging I'll run our corpus of signed events through it to make sure nothing gets rejected.

@magnusbaeck
Copy link
Member Author

I made a custom schema with this regexp and ran it against 6M of our signed events (created by a couple of different libraries) and they all passed, so I think this should be quite safe. Merging.

@magnusbaeck magnusbaeck merged commit c177dfa into master Sep 16, 2025
4 checks passed
@magnusbaeck magnusbaeck deleted the sigrepr branch September 16, 2025 05:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
protocol All protocol changes
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Representation of public key and signature in meta.security is underspecified
3 participants