5.2.1.  General

The structure of a Capsium package includes several key elements that organize and define the contents and functionality of the package:

5.2.2.  Folder hierarchy

The folder hierarchy is:

example-capsium-package/
├── index.html
├── styles.css
├── app.js
├── manifest.json
├── routes.json
├── http-api.json
├── storage.json
├── security.json
├── authentication.json
├── logging-monitoring.json
├── validation.json
├── LICENSE.spdx
└── README.md

Figure 1

5.3.1.  General

{
    "name": "example-capsium-package",
    "version": "1.0.0",
    "description": "A sample Capsium package that demonstrates resource bundling.",
 "guid": "example.com/example-capsium-package",
    "uuid": "123e4567-e89b-12d3-a456-426614174000",
    "author": "Your Name",
    "repository": {
        "type": "git",
        "url": "https://github.com/yourusername/example-capsium-package.git"
    },
    "dependencies": {
        "other-package.capsium": ">=1.0.0"
    },
    "license": "path/to/LICENSE.spdx",
    "readOnly": true
}

Figure 2

5.3.2.  Identifier

The GUID (Globally Unique Identifier) for a Capsium package is used for uniquely identifying the package within the ecosystem. It follows a URI (Uniform Resource Identifier) format to ensure global uniqueness and to provide a standardized way of referencing the package.

It ensures global uniqueness, readability, and consistent identification of packages.

The GUID is essential for dependency tracking, providing a reliable reference to specific packages within the ecosystem.

"guid": "capsium://example.com/package-name"

"guid": "https://example.com/packages/sample-package"

"guid": "http://myorganization.org/capsium/my-package"

"guid": "capsium://opensource.org/libs/lib-capsium"

{
    "dependencies": {
        "capsium://example.com/package-name": ">=1.0.0",
        "https://example.com/packages/another-package": "^2.1.0"
    }
}

5.3.3.  Versions

{
    "version": "1.0.0"
}

5.3.4.  Dependencies

{
    "dependencies": {
        "other-package.capsium": ">=1.0.0",
        "another-package.capsium": "^2.3.4"
    }
}

   "dependencies": {
       "capsium://example.com/package-name": ">=1.0.0"
   }

   "dependencies": {
       "https://example.com/packages/first-package": "^2.1.0",
       "capsium://another.com/second-package": "1.2.3"
   }

   "dependencies": {
       "capsium://example.org/dependency-package": ">=1.0.0 <2.0.0"
   }

   "dependencies": {
       "capsium://example.net/experimental-package": "1.0.0-beta.1"
   }

   "dependencies": {
       "https://example.com/special-package": "1.0.0+20130313144700"
   }

   "dependencies": {
       "capsium://example.org/multi-range-package": ">=1.0.0 <1.5.0 || >=2.0.0 <3.0.0"
   }

   "dependencies": {
       "capsium://example.com/wildcard-package": "*"
   }

   "dependencies": {
       "capsium://example.com/caret-package": "^1.2.3",
       "capsium://example.com/tilde-package": "~1.2.3"
   }

5.3.5.  License

   "license": "MIT"

   "license": "LICENSE.spdx"

   "license": [
       {
           "type": "MIT",
           "condition": "Default license"
       },
       {
           "type": "Apache-2.0",
           "condition": "For use in commercial environments"
       }
   ]

   "license": [
       {
           "type": "MIT",
           "condition": "Default license"
       },
       {
           "type": "Custom-License",
           "file": "custom-license.spdx",
           "condition": "For internal use only"
       }
   ]

   "license": [
       {
           "type": "GPL-3.0-only",
           "condition": "When redistributed"
       },
       {
           "type": "LGPL-3.0-only",
           "condition": "When used as a library"
       }
   ]

SPDXVersion: SPDX-2.1
DataLicense: CC0-1.0
SPDXID: SPDXRef-DOCUMENT
DocumentName: example-capsium-package
DocumentNamespace: http://spdx.org/spdxdocs/example-capsium-package-abc123
Creator: Person: John Doe
Creator: Organization: Example Organization
Creator: Tool: SPDX-Tools-Version-2.1.0
Created: 2024-05-28T12:00:00Z
LicenseID: MIT
LicenseName: MIT License
LicenseText: |
    MIT License

    Permission is hereby granted, free of charge, to any person obtaining a copy
    of this software and associated documentation files (the "Software"), to deal
    in the Software without restriction, including without limitation the rights
    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
    copies of the Software, and to permit persons to whom the Software is
    furnished to do so, subject to the following conditions:

    The above copyright notice and this permission notice shall be included in all
    copies or substantial portions of the Software.

    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
    SOFTWARE.

{
    "license": "path/to/LICENSE.spdx"
}

5.3.6.  Read-only

Capsium packages can be configured as immutable, ensuring that their content cannot be modified after creation.

This section details the requirements, specifications, and use cases for configuring a package as read-only, including value requirements and enumerations for attributes. The read-only attribute is package-wide and set inside metadata.json.

5.4.1.  General

The manifest file describes how to handle multi-format content within the package.

It includes mappings and configurations for handling different types of files and resources.

When the manifest.json file does not exist, it should be built automatically from the contents of the contents/ directory.

Example:

{
    "resources": {
        "index.html": {
            "type": "text/html",
            "version": "1.0.0"
        },
        "styles.css": {
            "type": "text/css",
            "version": "1.0.0"
        },
        "app.js": {
            "type": "application/javascript",
            "version": "1.0.0"
        },
        "dynamic-content.js": {
            "type": "application/javascript",
            "version": "1.0.0"
        },
        "mobile.css": {
            "type": "text/css",
            "version": "1.0.0"
        },
        "desktop.css": {
            "type": "text/css",
            "version": "1.0.0"
        },
        "images/small.jpg": {
            "type": "image/jpeg",
            "version": "1.0.0"
        },
        "images/medium.jpg": {
            "type": "image/jpeg",
            "version": "1.0.0"
        },
        "images/large.jpg": {
            "type": "image/jpeg",
            "version": "1.0.0"
        },
        "content/en/index.html": {
            "type": "text/html",
            "version": "1.0.0"
        },
        "content/en/about.html": {
            "type": "text/html",
            "version": "1.0.0"
        },
        "content/es/index.html": {
            "type": "text/html",
            "version": "1.0.0"
        },
        "content/es/about.html": {
            "type": "text/html",
            "version": "1.0.0"
        }
    }
}

Figure 25

5.4.2.  Content visibility

Content visibility in the Capsium package is managed through the manifest.json file, where resources can be designated as either exported or private. This designation determines whether the resource can be re-used by other packages or is restricted to the current package.

     {
         "resources": [
             {
                 "path": "scripts/main.js",
                 "visibility": "exported"
             },
             {
                 "path": "styles/theme.css",
                 "visibility": "private"
             },
             {
                 "path": "images/logo.png",
                 "visibility": "exported"
             }
         ]
     }

Figure 26

     {
         "dependencies": {
             "capsium-core": "1.0.0"
         },
         "resources": [
             {
                 "path": "node_modules/capsium-core/scripts/main.js",
                 "visibility": "exported"
             }
         ]
     }

Figure 27

By clearly defining and adhering to these visibility rules, the Capsium package ensures that resource bundling is both flexible and secure, allowing for effective re-use of assets while protecting private resources.

5.5.1.  Requirements for Root File

5.5.2.  Examples of Root File

   {
       "index": "public/index.html"
   }

Figure 28

   {
       "index": "docs/main.html"
   }

Figure 29

   {
       "index": "web/index.html"
   }

Figure 30

   {
       "index": "dist/index.html"
   }

Figure 31

   {
       "index": "index.html"
   }

Figure 32

Example:

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>Capsium Package</title>
    <link rel="stylesheet" href="styles.css">
</head>
<body>
    <h1>Welcome to the Capsium Package</h1>
    <script src="app.js"></script>
</body>
</html>

Figure 33

5.6.1.  General

Resource bundling involves packaging all necessary static and dynamic content within the Capsium package to ensure that the package is self-contained and can be served efficiently.

The content include:

Example directory structure:

example-capsium-package/
├── index.html
├── styles.css
├── app.js
├── dynamic-content.js
├── mobile.css
├── desktop.css
├── images/
│   ├── small.jpg
│   ├── medium.jpg
│   └── large.jpg
├── content/
│   ├── en/
│   │   ├── index.html
│   │   └── about.html
│   ├── es/
│   │   ├── index.html
│   │   └── about.html
├── metadata.json
├── manifest.json
├── routes.json
├── LICENSE.spdx
└── README.md

Figure 34

5.6.2.  Static Content

Static content includes files that do not change once the package is created and can be directly served to the client. These files are essential for the visual and functional aspects of the web application.

5.6.3.  Dynamic Content

Dynamic content refers to content that can change or be generated on the fly, typically handled by client-side scripts. While the package itself is primarily static, it can include references to dynamic content.

5.6.4.  Conditional Alternative Content

Conditional alternative content allows the package to include multiple versions of a resource, with the appropriate version being loaded based on specific criteria. This can enhance performance and provide a better user experience.

5.7.1.  General

Resource routing defines how requests to the Capsium package are handled and routed.

The routes.json file is the central configuration for routing within your package. It maps URL paths to resources or handlers, including both static data and dynamic HTTP API routes.

The routing file routes.json is the single source of truth for routing in the package, simplifying management and ensuring consistency. This setup covers static resource routing, dynamic API endpoints, and the essential configurations for headers and HTTP methods.

When the routes.json file doesn’t exist, automatically generate it based on the contents in the manifest. When it is an HTML file, create 2 routes, one with the file’s base name, one with the full file name. When a file of another type, generate the route relative from the content/ path.

{
    "index": "index.html",
    "routes": [
        // Static resource routes
        {
            "path": "/",
            "resource": "index.html"
        },
        {
            "path": "/styles.css",
            "resource": "styles.css"
        },
        {
            "path": "/app.js",
            "resource": "app.js"
        },
        {
            "path": "/images/small.jpg",
            "resource": "images/small.jpg"
        },
        {
            "path": "/data/users",
            "resource": "data/users.json"
        },
        {
            "path": "/data/products",
            "resource": "data/products.json"
        },

        // HTTP API routes
        {
            "path": "/api/v1/users",
            "method": "GET",
            "handler": "api/v1/users/getUsers.js"
        },
        {
            "path": "/api/v1/users",
            "method": "POST",
            "handler": "api/v1/users/createUser.js"
        },
        {
            "path": "/api/v1/users/:id",
            "method": "PUT",
            "handler": "api/v1/users/updateUser.js"
        },
        {
            "path": "/api/v1/users/:id",
            "method": "DELETE",
            "handler": "api/v1/users/deleteUser.js"
        }
    ]
}

Figure 55

In this example, the routes.json file includes routes for both static resources (like HTML, CSS, images, and data files) and dynamic HTTP API endpoints.

5.7.2.  Index route

The index key in the routes.json file designates the entry point or root file of the Capsium package. This key is crucial for defining the primary file that the system should load or execute.

   {
       "index": "public/index.html"
   }

5.7.3.  Dataset routes

Mounting routes to data sets involves configuring specific endpoints that provide access to various data sets within the package. This allows for organized and efficient data retrieval, enabling users to access the data they need through well-defined routes. All data route mounts will use the HTTP path mount point /api/v1/data/ as the root.

Dataset routes should be mounted as specified in routes.json, with each route pointing to a key dataset that is provided in storage.json.

Example of storage.json:

{
    "storage": {
        "dataSets": {
            "users": {
                "source": "db/users",
            },
            "products": {
                "source": "files/products.json",
            },
            "sales": {
                "source": "api/external/sales",
            }
        }
    }
}

Figure 57

Example of routes.json:

{
    "routes": [
        {
            "route": "/api/v1/data/users",
            "dataset": "users",
            "accessControl": {
                "roles": ["admin", "user"],
                "authenticationRequired": true
            }
        },
        {
            "route": "/api/v1/data/products",
            "dataset": "products",
            "accessControl": {
                "roles": ["admin"],
                "authenticationRequired": true
            }
        },
        {
            "route": "/api/v1/data/sales",
            "dataset": "sales",
            "accessControl": {
                "roles": ["admin"],
                "authenticationRequired": true
            }
        }
    ]
}

Figure 58

In this example, routes.json defines three routes, each pointing to a data set specified in storage.json:

5.7.4.  Attributes summary

Table 1 — Table 1: Storage Attributes

Table 2 — Table 2: DataSets Attributes (in storage.json)

Table 3 — Table 3: Routes Attributes (in routes.json)

Table 4 — Table 4: Access Control Attributes

By configuring these attributes, Capsium packages can effectively manage data storage and provide structured access to data sets through defined routes. This ensures data can be securely and efficiently retrieved by authorized users.

5.7.5.  Header responses

{
    "routes": {
        "/api/resource": {
            "GET": {
                "file": "handlers/getResource.js",
                "headers": {
                    "Content-Type": "application/json",
                    "Cache-Control": "no-cache",
                    "Access-Control-Allow-Origin": "*"
                }
            },
            "POST": {
                "file": "handlers/postResource.js",
                "headers": {
                    "Content-Type": "application/json",
                    "Access-Control-Allow-Origin": "*"
                }
            }
        }
    }
}

{
    "routes": {
        "/api/resource": {
            "GET": {
                "file": "handlers/getResource.js",
                "headersFile": "headers/getResourceHeaders.json"
            },
            "POST": {
                "file": "handlers/postResource.js",
                "headersFile": "headers/postResourceHeaders.json"
            }
        }
    }
}

{
    "Content-Type": "application/json",
    "Cache-Control": "no-cache",
    "Access-Control-Allow-Origin": "*"
}

{
    "Content-Type": "application/json",
    "Access-Control-Allow-Origin": "*"
}

5.7.6.  Route visibility

Route visibility in the Capsium package is managed through the routes.json file, where routes can be designated as either exported or private. This designation determines whether the route can be re-used by other packages or is restricted to the current package.

     {
         "routes": [
             {
                 "path": "/api/public",
                 "handler": "publicHandler",
                 "visibility": "exported"
             },
             {
                 "path": "/api/private",
                 "handler": "privateHandler",
                 "visibility": "private"
             }
         ]
     }

Figure 63

5.7.7.  Route Inheritance and Processing

The Capsium package supports inheriting routes from dependency packages, allowing for remapping, rewriting responses, enhancing response headers, or supplanting request headers. This flexibility enables packages to extend and modify the behavior of routes defined in their dependencies.

     {
         "dependencies": {
             "capsium-core": "1.0.0"
         },
         "routes": [
             {
                 "path": "/api/exported",
                 "handler": "node_modules/capsium-core/handlers/publicHandler",
                 "visibility": "exported"
             },
             {
                 "path": "/api/remapped",
                 "handler": "node_modules/capsium-core/handlers/publicHandler",
                 "visibility": "private",
                 "remap": "/api/newpath"
             },
             {
                 "path": "/api/rewritten",
                 "handler": "node_modules/capsium-core/handlers/publicHandler",
                 "visibility": "private",
                 "responseRewrite": {
                     "body": "Modified response content",
                     "headers": {
                         "X-Custom-Header": "CustomValue"
                     }
                 }
             },
             {
                 "path": "/api/enhanced",
                 "handler": "node_modules/capsium-core/handlers/publicHandler",
                 "visibility": "exported",
                 "responseHeaders": {
                     "Cache-Control": "no-cache",
                     "X-Enhanced-Header": "EnhancedValue"
                 }
             },
             {
                 "path": "/api/supplanted",
                 "handler": "node_modules/capsium-core/handlers/publicHandler",
                 "visibility": "private",
                 "requestHeaders": {
                     "Authorization": "Bearer new-token",
                     "X-Forwarded-For": "client-ip"
                 }
             }
         ]
     }

Figure 64

By clearly defining and adhering to these visibility, inheritance, and processing rules, the Capsium package ensures that resource routing is both flexible and secure, enabling effective re-use of routes while protecting private routes and allowing for extensive customization.

5.8.1.  Defining datasets

Datasets are explicitly defined, and are referred by other components, such as Clause 5.7.3.

Example:

{
    "storage": {
        "dataSets": {
            "users": {
                "source": "db/users",
            },
            "products": {
                "source": "files/products.json",
            },
            "sales": {
                "source": "api/external/sales",
            }
        }
    }
}

Figure 65

5.8.2.  Layered storage

Layered storage in the Capsium package allows for multiple storage layers to be combined into a single, unified filesystem view, similar to the functionality of “overlay FS.” This approach ensures that changes can be made in a non-destructive manner while preserving the original data.

     {
         "layers": [
             {
                 "path": "base",
                 "writable": false,
                 "visibility": "exported"
             },
             {
                 "path": "updates",
                 "writable": true,
                 "visibility": "private"
             }
         ]
     }

Figure 66

5.8.3.  Static data files

Static data files are immutable files that are served directly by the Capsium package. These files typically include assets such as images, stylesheets, and JavaScript files.

     Cache-Control: public, max-age=31536000

Figure 67

     {
         "static": {
             "path": "static",
             "url": "/static"
         }
     }

Figure 68

5.8.4.  Datasets

Datasets in the Capsium package provide structured storage for dynamic data that requires querying and transactional operations.

JSON schema or YAML schema for datasets using static files like JSON or YAML in the storage.json configuration file.

{
  "datasets": [
    {
      "datasetId": "dataset1",
      "dataFile": "/path/to/datafile.json",
      "schemaFile": "/path/to/schemafile.json",
      "schemaType": "json-schema"
    },
    {
      "datasetId": "dataset2",
      "dataFile": "/path/to/datafile.yaml",
      "schemaFile": "/path/to/schemafile.yaml",
      "schemaType": "yaml-schema"
    }
  ]
}

{
  "$schema": "link:++http://json-schema.org/draft-07/schema#"++[],
  "type": "object",
  "properties": {
    "users": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "id": { "type": "string" },
          "name": { "type": "string" },
          "email": { "type": "string", "format": "email" }
        },
        "required": ["id", "name", "email"]
      }
    }
  },
  "required": ["users"]
}

%YAML 1.2
---
$schema: "link:++http://json-schema.org/draft-07/schema#"++[]
type: "object"
properties:
  users:
    type: "array"
    items:
      type: "object"
      properties:
        id:
          type: "string"
        name:
          type: "string"
        email:
          type: "string"
          format: "email"
      required:
        - id
        - name
        - email
required:
  - users

{
  "datasets": [
    {
      "datasetId": "dataset1",
      "databaseFile": "/path/to/database.sqlite",
      "schemaFile": "/path/to/schemafile.sql",
      "schemaType": "sql-schema",
      "table": "users"
    },
    {
      "datasetId": "dataset2",
      "databaseFile": "/path/to/another_database.sqlite",
      "schemaFile": "/path/to/schemafile.json",
      "schemaType": "json-schema",
      "table": "products"
    }
  ]
}

CREATE TABLE users (
  id TEXT PRIMARY KEY,
  name TEXT NOT NULL,
  email TEXT NOT NULL UNIQUE
);

{
  "$schema": "link:++http://json-schema.org/draft-07/schema#"++[],
  "type": "object",
  "properties": {
    "id": { "type": "string" },
    "name": { "type": "string" },
    "email": { "type": "string", "format": "email" }
  },
  "required": ["id", "name", "email"]
}

5.8.5.  REST API for data access and modification

This is the HTTP REST API that the Capsium reactor offers for an activated Capsium package to the HTTP user. The following endpoints are supported for all datasets, as defined in storage.json.

{
  "datasetId": "dataset1"
}

{
  "datasetId": "dataset1",
  "dataId": "dataItem42"
}

{
  "datasetId": "dataset1",
  "data": {
    "key1": "value1",
    "key2": 123
  }
}

{
  "datasetId": "dataset1",
  "dataId": "dataItem42",
  "data": {
    "key1": "newValue",
    "key2": 456
  }
}

{
  "datasetId": "dataset1",
  "dataId": "dataItem42"
}

5.8.6.  Data Persistence

{
  "timestamp": "2024-05-28T12:34:56Z",
  "user": "user123",
  "action": "update",
  "datasetId": "dataset1",
  "dataId": "dataItem42",
  "changes": {
    "key1": "newValue"
  }
}

action-history/
  ├── 20240528T123456Z_user123_update_dataItem42.json
  ├── 20240529T101112Z_user456_add_dataItem43.json
  └── ...

{
  "version": "1.0",
  "timestamp": "2024-05-28T12:34:56Z",
  "user": "user123",
  "action": "update",
  "datasetId": "dataset1",
  "dataId": "dataItem42",
  "changes": {
    "key1": "newValue"
  }
}

{
  "originalPackageId": "capsiumPkg1",
  "newPackageId": "capsiumPkg2",
  "actionHistoryLocation": "/path/to/action-history"
}

# Collect action patches
cp /path/to/action-history/* /new-package/action-history/

# Create new package structure
mkdir /new-package
cp -r /original-package/* /new-package/

# Update metadata
jq '.packages += [{"id": "capsiumPkg2", "actionHistoryLocation": "/new-package/action-history"}]' /new-package/storage.json > /new-package/storage_tmp.json
mv /new-package/storage_tmp.json /new-package/storage.json

# Validate package
capsium-validate /new-package

capsium-check-integrity /new-package

# Capsium Package Documentation

## Package ID: capsiumPkg2
Description:: This package includes updated datasets from capsiumPkg1 with action patches applied.
Version:: 2.0
Action History Location:: /new-package/action-history

{
  "originalPackageId": "capsiumPkg1",
  "compositePackageId": "compositeCapsiumPkg1",
  "internalActionHistoryPath": "internal/action-history"
}

# Collect action patches
cp /path/to/action-history/* /composite-package/internal/action-history/

# Create composite package structure
mkdir /composite-package/internal
cp -r /original-package/* /composite-package/internal/

# Update metadata
jq '.packages += [{"id": "compositeCapsiumPkg1", "internalActionHistoryPath": "internal/action-history"}]' /composite-package/storage.json > /composite-package/storage_tmp.json
mv /composite-package/storage_tmp.json /composite-package/storage.json

# Validate package
capsium-validate /composite-package

{
  "compositePackageId": "compositeCapsiumPkg1",
  "dependencies": [
    {
      "packageId": "capsiumPkg1",
      "version": "1.0"
    }
  ],
  "internalActionHistoryPath": "internal/action-history"
}

{
  "datasetNamespaces": {
    "capsiumPkg1": "namespace1",
    "compositeCapsiumPkg1": "namespace2"
  }
}

# Test script for composite package
capsium-test /composite-package

# Validate composite package
capsium-validate /composite-package

5.9.1.  General

Security is a critical aspect of the Capsium package, ensuring data integrity and protection. This section describes the requirements and specifications for implementing security features, with detailed use cases illustrating practical applications.

Example:

{
    "security": {
        "digitalSignatures": {
            "publicKey": "path/to/public.key",
            "signatureFile": "package.sig"
        },
        "integrityChecks": {
            "checksumAlgorithm": "SHA-256",
            "checksums": {
                "index.html": "d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2",
                "styles.css": "e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3"
            }
        },
        "sandboxing": {
            "enabled": true,
            "parameters": {
                "memoryLimit": "512MB",
                "cpuLimit": "2"
            }
        }
    }
}

Figure 92

5.9.2.  Digital Signatures

{
    "security": {
        "digitalSignatures": {
            "publicKey": "path/to/public.key",
            "signatureFile": "package.sig"
        }
    }
}

Figure 93

5.9.3.  Integrity Checks

       {
           "index.html": "d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2",
           "styles.css": "e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3"
       }

Figure 94

{
    "security": {
        "integrityChecks": {
            "checksumAlgorithm": "SHA-256",
            "checksums": {
                "index.html": "d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2",
                "styles.css": "e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3"
            }
        }
    }
}

Figure 95

     sha256sum index.html > checksums.txt
     sha256sum styles.css >> checksums.txt

Figure 96

{
         "index.html": "d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2",
         "styles.css": "e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3"
     }

Figure 97

5.9.4.  Sandboxing Packaged Applications

{
    "security": {
        "sandboxing": {
            "enabled": true,
            "parameters": {
                "memoryLimit": "512MB",
                "cpuLimit": 2
            }
        }
    }
}

Figure 98

By implementing these security features, including a detailed procedure for calculating and verifying integrity hashes, the Capsium package ensures high standards of data integrity and protection, safeguarding both the package content and the systems it interacts with.

5.10.1.  General

The Capsium package can contain both encrypted and cleartext content. Encryption uses public/private keys and data encryption keys (DEK) with the OCB algorithm or OpenPGP to ensure security.

This section details the requirements and specifications for each aspect of encryption, along with relevant use cases and how encrypted files interact with routes.json and manifest.json.

Example:

{
    "encryption": {
        "publicKeyFile": "path/to/public.key",
        "encryptedFiles": [
            {
                "file": "secret.dat",
                "encryptedWith": "DEK",
                "algorithm": "OCB"
            }
        ]
    }
}

Figure 99

5.10.2.  Public Key File

{
    "encryption": {
        "publicKeyFile": "path/to/public.key"
    }
}

Figure 100

5.10.3.  Encrypted Files

{
    "encryption": {
        "encryptedFiles": [
            {
                "file": "secret.dat",
                "encryptedWith": "DEK",
                "algorithm": "OCB"
            },
            {
                "file": "confidential.txt",
                "encryptedWith": "OpenPGP",
                "algorithm": "OpenPGP"
            }
        ]
    }
}

Figure 101

5.10.4.  Interaction with routes.json and manifest.json

     {
         "routes": [
             {
                 "path": "/download/secret",
                 "file": "secret.dat",
                 "encrypted": true,
                 "decryptionMethod": "DEK"
             },
             {
                 "path": "/download/confidential",
                 "file": "confidential.txt",
                 "encrypted": true,
                 "decryptionMethod": "OpenPGP"
             }
         ]
     }

Figure 102

{
    "manifestVersion": "1.0",
    "description": "Capsium package containing both encrypted and cleartext content.",
    "files": [
        {
            "path": "secret.dat",
            "encrypted": true,
            "encryptionDetails": {
                "encryptedWith": "DEK",
                "algorithm": "OCB"
            }
        },
        {
            "path": "confidential.txt",
            "encrypted": true,
            "encryptionDetails": {
                "encryptedWith": "OpenPGP",
                "algorithm": "OpenPGP"
            }
        },
        {
            "path": "readme.txt",
            "encrypted": false
        }
    ]
}

Figure 103

5.10.5.  Detailed Use Cases and Examples

{
    "routes": [
        {
            "path": "/download/secret",
            "file": "secret.dat",
            "encrypted": true,
            "decryptionMethod": "DEK"
        },
        {
            "path": "/download/confidential",
            "file": "confidential.txt",
            "encrypted": true,
            "decryptionMethod": "OpenPGP"
        }
    ]
}

{
    "manifestVersion": "1.0",
    "description": "Capsium package containing both encrypted and cleartext content.",
    "files": [
        {
            "path": "secret.dat",
            "encrypted": true,
            "encryptionDetails": {
                "encryptedWith": "DEK",
                "algorithm": "OCB"
            }
        },
        {
            "path": "confidential.txt",
            "encrypted": true,
            "encryptionDetails": {
                "encryptedWith": "OpenPGP",
                "algorithm": "OpenPGP"
            }
        },
        {
            "path": "readme.txt",
            "encrypted": false
        }
    ]
}

5.10.6.  Value Requirements and Enumerations for Attributes

{
    "manifestVersion": "1.0",
    "description": "Capsium package containing both encrypted and cleartext content.",
    "files": [
        {
            "path": "secret.dat",
            "encrypted": true,
            "encryptionDetails": {
                "encryptedWith": "DEK",
                "algorithm": "OCB"
            }
        },
        {
            "path": "confidential.txt",
            "encrypted": true,
            "encryptionDetails": {
                "encryptedWith": "OpenPGP",
                "algorithm": "OpenPGP"
            }
        },
        {
            "path": "readme.txt",
            "encrypted": false
        }
    ]
}

5.10.7.  Detailed Example

{
    "encryption": {
        "publicKeyFile": "path/to/public.key",
        "encryptedFiles": [
            {
                "file": "secret.dat",
                "encryptedWith": "DEK",
                "algorithm": "OCB"
            },
            {
                "file": "confidential.txt",
                "encryptedWith": "OpenPGP",
                "algorithm": "OpenPGP"
            }
        ]
    }
}

{
    "routes": [
        {
            "path": "/download/secret",
            "file": "secret.dat",
            "encrypted": true,
            "decryptionMethod": "DEK"
        },
        {
            "path": "/download/confidential",
            "file": "confidential.txt",
            "encrypted": true,
            "decryptionMethod": "OpenPGP"
        },
        {
            "path": "/download/readme",
            "file": "readme.txt",
            "encrypted": false
        }
    ]
}