Version 2

The following is an example of a signed component descriptor containing a resource, source and one component reference. It uses the v2 schema. There are no differences in the semantics between v2 and v3. “version” is used as kind of moniker for different serializing/deserializing formats (v3 has the format of Kubernetes resources).

This component is publicly available and can be inspected using the following command:

ocm componentversion get --repo ghcr.io/phoban01/ocm github.com/weaveworks/weave-gitops -oyaml
meta:
  schemaVersion: v2 # component schema version
component:
  name: github.com/weaveworks/weave-gitops # name of the component
  version: v1.0.0 # version of the component
  provider: weaveworks # component provider information
  repositoryContexts: # list of repository context the component version "lived" in, with the current one at the top 
  - baseUrl: ghcr.io
    componentNameMapping: urlPath
    subPath: phoban01/ocm
    type: OCIRegistry
  resources: # list of resources modelled by the component
  - name: image # resource name
    relation: external # resource location (external repository or internal to this repository)
    type: ociImage # resource type
    version: v0.14.1 # resource version
    access: # metadata describing how to access the resource
      type: ociArtifact # type of access information
      imageReference: ghcr.io/weaveworks/wego-app:v0.14.1
    digest: # signing metadata for the resource
      hashAlgorithm: SHA-256
      normalisationAlgorithm: ociArtifactDigest/v1
      value: efa2b9980ca2de65dc5a0c8cc05638b1a4b4ce8f6972dc08d0e805e5563ba5bb
  sources: # list of sources relevant to this component
  - name: weave-gitops # source name
    type: git # source type
    version: v0.14.1 # source version
    access: # metadata describing how to access the source
      commit: 727513969553bfcc603e1c0ae1a75d79e4132b58
      ref: refs/tags/v0.14.1
      repoUrl: github.com/weaveworks/weave-gitops
      type: gitHub
  componentReferences: # list of references to other components
  - name: prometheus # reference name
    version: v1.0.0 # reference version
    componentName: cncf.io/prometheus # referenced component name
    digest: # signing metadata for the referenced resource
      hashAlgorithm: SHA-256
      normalisationAlgorithm: jsonNormalisation/v1
      value: 04eb20b6fd942860325caf7f4415d1acf287a1aabd9e4827719328ba25d6f801
signatures: # list of signatures used for signing and verification
- name: ww-dev # name of the signature
  digest: # digest of the signature including the algorithm used
    hashAlgorithm: SHA-256
    normalisationAlgorithm: jsonNormalisation/v1
    value: 4faff7822616305ecd09284d7c3e74a64f2269dcc524a9cdf0db4b592b8cee6a
  signature: # signature including the algorithm used
    algorithm: RSASSA-PKCS1-V1_5
    mediaType: application/vnd.ocm.signature.rsa
    value: 26468587671bdbd2166cf5f69829f090c10768511b15e804294fcb26e552654316c8f4851ed396f279ec99335e5f4b11cb043feb97f1f9a42115f4fda2d31ae8b481b7303b9a913d3a4b92d446fbee9ed487c93b09e513f3f68355040ec08454675e1f407422062abbd2681f70dd5488ad29020b30cfa7e001455c550458da96166bc3243c8426977d73352aface5323fb2b5a374e9c31b272a59c160b85631231c9fc2f23c032401b80fef937029a39111cee34470c61ae86cd4942553466411a5a116159fdcc10e50fe9360c5184028e72d1fe9c7315f26e15d7b4849f62d197501b8cc6b6f1b1391ecc2fc2fc0c1290d2554594505b25fa8f9bfb28c8df24