Quality Passport predicate v0.1

A Quality Passport is an in-toto attestation that collects every record behind a release, so that a third party can verify it without access to internal tools. This page describes the predicate whose type is https://openintentschema.io/passport/v0.1.

Normative source

The normative definition is section 8 of the OIS specification v0.1, and the predicate’s JSON Schema is #/$defs/passportPredicate in the OIS JSON Schema v0.1. Where this page and the specification differ, the specification applies.

This URI is proposed as the predicate type in RFC #6. Until that RFC is decided, the working draft uses the placeholder https://ois.example/passport/v0.1.

Statement

A passport is an in-toto Statement v1. Its subject lists the released artifacts with their digests.

{
  "_type": "https://in-toto.io/Statement/v1",
  "subject": [
    { "name": "customer-portal", "digest": { "sha256": "<release digest>" } }
  ],
  "predicateType": "https://openintentschema.io/passport/v0.1",
  "predicate": { }
}

Predicate fields

Field	Type	Required	Description
ois	string	yes	Specification version, "0.1".
release	object	yes	name and version of the release, optional location (URI).
intents	array of Ref	yes	Versioned references to the intents the release delivers.
scope	array of Ref	no	Criterion references the release is meant to deliver. When present, coverage methods count only these; when absent, all criteria of the listed intents.
records	array of records	yes	Records the passport relies on, embedded. May be empty when bundles carries them.
bundles	array of object	no	External bundles whose records count as embedded, each with location (URI) and digest.
assessments	array of Measurement	no	Summary values such as intent coverage, each with its method.
issuedBy	Ref	yes	The actor that assembled the passport.
issuedAt	timestamp	yes	When the passport was assembled.

Rules

• A passport is self-contained: every reference resolves to a record inside records or inside a bundle listed in bundles. Consumers verify the digest of each listed bundle before using its records.
• records, or a listed bundle, contain at least one decision with gate release whose subject is the release, with outcome approved or passed.
• For every listed intent, records contain the approved intent version and its intent-approval decision.
• records should also include every current finding that references a listed intent, so that a passport does not hide known defects.

Signing

Passports should be wrapped in a DSSE envelope with payload type application/vnd.in-toto+json and signed; Level 3 conformance requires it. Consumers verify the signature before relying on a passport, check that the subject digests match the released artifacts, and treat a passport as signed by an actor only when the signer identity matches that actor’s identity.

Checking a passport

The reference validator checks a passport against the schema and the integrity rules:

uvx ois-validator passport.json