nordisk/holger

examples/secure-update-gateway/core-v1.json

{
  "schema_version": "holger.update-bundle/v1",
  "bundle_id": "acme-exampledrive-2.0.0",
  "sequence": 7,
  "created_at": "2026-07-23T09:00:00Z",
  "expires_at": "2027-07-23T09:00:00Z",
  "producer": "intake-station-01",
  "supplier": "ACME",
  "product": "ExampleDrive",
  "release_version": "2.0.0",
  "supported_hardware_models": ["ACS880"],
  "supported_hardware_revisions": ["R4"],
  "source_provenance": {
    "source_kind": "vendor-portal",
    "source_uri": "https://vendor.acme.example/downloads/exampledrive-2.0.0.bin",
    "source_repository": null,
    "source_asset_path": null,
    "fetched_at": "2026-07-23T08:55:00Z",
    "reported_size": 4194304,
    "vendor_checksum": "sha256:...",
    "vendor_signature_status": "verified",
    "tls_origin": "vendor.acme.example",
    "transfer_receipt_digest": "sha256 of evidence/source-receipt.json"
  },
  "payloads": [
    {
      "relative_path": "payload/exampledrive-2.0.0.bin",
      "media_type": "application/octet-stream",
      "size_bytes": 4194304,
      "sha256": "<sha256 of the payload>",
      "blake3": "<blake3 of the payload>"
    }
  ],
  "evidence": [
    {
      "relative_path": "evidence/sbom/exampledrive.cdx.json",
      "media_type": "application/json",
      "size_bytes": 20480,
      "sha256": "<sha256>",
      "blake3": "<blake3>",
      "evidence_kind": "sbom"
    },
    {
      "relative_path": "evidence/source-receipt.json",
      "media_type": "application/json",
      "size_bytes": 1024,
      "sha256": "<sha256>",
      "blake3": "<blake3>",
      "evidence_kind": "source-receipt"
    }
  ],
  "policy_result": {
    "policy_digest": "<sha256 of the policy the review used>",
    "advisory_snapshot_digest": null,
    "verdict": "pass",
    "non_production": true
  },
  "supersedes": ["acme-exampledrive-1.9.0"],
  "withdraws": []
}