neiam /gitgud

// Hex registry v2 — https://github.com/hexpm/specifications/blob/main/registry-v2.md
//
// Transcribed from the message definitions compiled into hex_core
// (mix_hex_pb_names, _versions, _package, _signed), which is the
// authority `mix` itself decodes with. proto2: several fields are
// `required`, and Hex's own encoder relies on that.
//
// There is no protoc in this repo's toolchain, so the Elixir modules
// in lib/git_gud/packages/formats/hex/registry.pb.ex are written by
// hand to match. This file is the source of truth for what they mean.

syntax = "proto2";

package hex;

message Signed {
  required bytes payload = 1;
  optional bytes signature = 2;
}

message Timestamp {
  required int64 seconds = 1;
  required int32 nanos = 2;
}

message Names {
  repeated Package packages = 1;
  required string repository = 2;

  message Package {
    required string name = 1;
    optional Timestamp updated_at = 3;
  }
}

message Versions {
  repeated Package packages = 1;
  required string repository = 2;

  message Package {
    required string name = 1;
    repeated string versions = 2;
    repeated int32 retired = 3 [packed = true];
    repeated int32 with_advisories = 5 [packed = true];
  }
}

enum RetirementReason {
  RETIRED_OTHER = 0;
  RETIRED_INVALID = 1;
  RETIRED_SECURITY = 2;
  RETIRED_DEPRECATED = 3;
  RETIRED_RENAMED = 4;
}

enum AdvisorySeverity {
  SEVERITY_NONE = 0;
  SEVERITY_LOW = 1;
  SEVERITY_MEDIUM = 2;
  SEVERITY_HIGH = 3;
  SEVERITY_CRITICAL = 4;
}

message RetirementStatus {
  required RetirementReason reason = 1;
  optional string message = 2;
}

message Dependency {
  required string package = 1;
  required string requirement = 2;
  optional bool optional = 3;
  optional string app = 4;
  optional string repository = 5;
}

message SecurityAdvisory {
  required string id = 1;
  required string summary = 2;
  required string html_url = 3;
  optional AdvisorySeverity severity = 4;
  optional float cvss_score = 5;
  required string api_url = 6;
  repeated string aliases = 7;
}

message Release {
  required string version = 1;
  // SHA-256 of the *inner* tarball (contents.tar.gz).
  required bytes inner_checksum = 2;
  repeated Dependency dependencies = 3;
  optional RetirementStatus retired = 4;
  // SHA-256 of the whole published .tar.
  optional bytes outer_checksum = 5;
  repeated uint32 advisory_indexes = 6;
  optional Timestamp published_at = 7;
}

message Package {
  repeated Release releases = 1;
  required string name = 2;
  required string repository = 3;
  repeated SecurityAdvisory advisories = 4;
}