\nThe CAWG identity assertion does not currently respect this setting.\nSee
issue #1645.\n
\n\nList of host patterns that are allowed for network requests.\n\nEach pattern may include:\n- A scheme (e.g. `https://` or `http://`)\n- A hostname or IP address (e.g. `contentauthenticity.org` or `192.0.2.1`)\n - The hostname may contain a single leading wildcard (e.g. `*.contentauthenticity.org`)\n- An optional port (e.g. `contentauthenticity.org:443` or `192.0.2.1:8080`)\n\nMatching is case-insensitive. A wildcard pattern such as `*.contentauthenticity.org` matches\n`sub.contentauthenticity.org`, but does not match `contentauthenticity.org` or `fakecontentauthenticity.org`.\nIf a scheme is present in the pattern, only URIs using the same scheme are considered a match. If the scheme\nis omitted, any scheme is allowed as long as the host matches.\n\nThe behavior is as follows:\n- `None` (default) no filtering enabled.\n- `Some(vec)` where `vec` is empty, all traffic is blocked.\n- `Some(vec)` with at least one pattern, filtering enabled for only those patterns.\n\n# Examples\n\nPattern: `*.contentauthenticity.org`\n- Does match:\n - `https://sub.contentauthenticity.org`\n - `http://api.contentauthenticity.org`\n- Does **not** match:\n - `https://contentauthenticity.org` (no subdomain)\n - `https://sub.fakecontentauthenticity.org` (different host)\n\nPattern: `http://192.0.2.1:8080`\n- Does match:\n - `http://192.0.2.1:8080`\n- Does **not** match:\n - `https://192.0.2.1:8080` (scheme mismatch)\n - `http://192.0.2.1` (port omitted)\n - `http://192.0.2.2:8080` (different IP address)\n\nThese settings are applied by the SDK's HTTP resolvers to restrict network requests.\nWhen network requests occur depends on the operations being performed (reading manifests,\nvalidating credentials, timestamping, etc.).",
- "type": [
- "array",
- "null"
- ],
+ "type": ["array", "null"],
"items": {
"$ref": "#/$defs/HostPattern"
}
@@ -207,10 +180,7 @@
"properties": {
"vendor": {
"description": "The name of the vendor creating the content credential.",
- "type": [
- "string",
- "null"
- ]
+ "type": ["string", "null"]
},
"claim_generator_info": {
"description": "Claim generator info that is automatically added to the builder.\n\nNote that this information will prepend any claim generator info\nprovided explicitly to the builder.",
@@ -244,10 +214,7 @@
},
"certificate_status_should_override": {
"description": "Whether to only use [`CertificateStatus`] assertions to check certificate revocation status. If there\nis a stapled OCSP in the COSE claim of the manifest, it will be ignored. If [`Verify::ocsp_fetch`] is\nenabled, it will also be ignored.\n\nThe default value is false.\n\n[`CertificateStatus`]: crate::assertions::CertificateStatus\n[`Verify::ocsp_fetch`]: crate::settings::Verify::ocsp_fetch",
- "type": [
- "boolean",
- "null"
- ]
+ "type": ["boolean", "null"]
},
"intent": {
"description": "The default [`BuilderIntent`] for the [`Builder`].\n\nSee [`BuilderIntent`] for more information.\n\n[`BuilderIntent`]: crate::BuilderIntent\n[`Builder`]: crate::Builder",
@@ -262,31 +229,21 @@
},
"created_assertion_labels": {
"description": "Assertions with a base label included in this list will be automatically marked as a created assertion.\nAssertions not in this list will be automatically marked as gathered.\n\nNote that the label should be a **base label**, not including the assertion version nor instance.\n\nSee more information on the difference between created vs gathered assertions in the spec here:\n