KPAR archive validation#

This page lists the requirements Sysand Index enforces on uploaded .kpar archives.

Project metadata#

  • publisher is set in .project.json and conforms to the publisher field rules.

  • publisher in .project.json matches a username or organization in Sysand Index.

  • name is set in .project.json and conforms to the project name field rules.

  • The normalized publisher and name match the publisher and name IDs in the upload metadata sent by the client.

  • The upload version is a SemVer version string without build metadata, and version in .project.json is present, is a non-empty string, and equals it.

  • license is set in .project.json and is a valid SPDX license expression of at most 255 characters. Custom LicenseRef-* identifiers are accepted even though they are not on the SPDX license list.

  • website, when present in .project.json, is an http or https URL.

  • description, when present, is a string; maintainer and topic, when present, are lists of strings.

  • usage entries are objects whose resource is an IRI accepted by the index, with an optional string versionConstraint. The accepted IRIs are a pkg:sysand/... PURL for a project on this index or an OMG standard library .kpar URL (see usage identifiers).

Archive layout#

  • .project.json and .meta.json are present in the root of the ZIP file.

  • .meta.json contains a metamodel field matching https://www.omg.org/spec/KerML/YYYYMMXX or https://www.omg.org/spec/SysML/YYYYMMXX. The YYYYMM portion must be a valid year/month; the final two digits (XX) are an incrementing release number within that month, not a calendar day.

Note

The accepted metamodel values will grow over time. Sysand Index currently recognizes the OMG-published KerML and SysML metamodels listed above, but it is designed so additional metamodels (including community-built ones beyond the OMG specifications) can be added as the ecosystem evolves. Check this page for the current list before publishing a package that targets a non-OMG metamodel.

To request support for a community-defined metamodel, reach out at sysand@sensmetry.com.

  • LICENSES/ is present and contains a .txt file for each mentioned license.

  • LICENSES/ contains no additional .txt files other than those for the mentioned licenses.

  • Each LICENSES/*.txt file is UTF-8 encoded.

  • The KPAR contains no additional unknown files other than:

    • LICENSES/*.txt files,

    • README.md,

    • CHANGELOG.md (see Markdown support for how README.md and CHANGELOG.md are rendered),

    • .sysml and .kerml files mentioned in .meta.json.

Size limits#

  • The uploaded .kpar file is at most 1 MiB.

  • The archive contains at most 500 entries.

  • The total uncompressed size is at most 10 MiB.

  • Each file is at most 2 MiB uncompressed.

  • Each entry’s compression ratio (uncompressed to compressed) is at most 100.

Paths and ZIP structure#

  • The ZIP uses the DEFLATE compression method.

  • The ZIP contains no nested ZIP archives.

  • The ZIP contains no symlinks.

  • ZIP entry paths contain no relative path components such as . or .., no absolute paths, no backslashes, no drive-letter components, and no duplicate entry names.

File integrity#

  • Hashes of all source files are included in .meta.json.

  • Hashes use SHA256.

  • Hashes match the referenced file contents.

  • The index field in .meta.json does not mention files that are absent from the checksum field in .meta.json.

  • All files referenced in checksum and index in .meta.json are present in the archive.

  • Files referenced in index use the extension that matches the metamodel kind: .sysml for SysML and .kerml for KerML.

  • Each symbol listed in the .meta.json index field appears as text in the file it references. The index does not parse or validate the models themselves.

File safety#

  • Files in the KPAR do not have extra permissions, such as executable bits.

  • No file may begin with an executable signature (Windows, macOS, or Linux binary formats), a ZIP signature, or a #! script line, regardless of its extension.