Entry format and signatures
The exact wire shape, 14 entry kinds, hashes, and signing profile.
Required wire fields
The canonical MarsEntry requires marsVersion, entryDid, entryType, name, version, publisherDid, publishedAt, itemSchemaUri, itemData, itemDataHash, and structured signature. Download the entry schema and signing vectors.
Entry types
The wire names are case-sensitive PascalCase:
| Family | Types |
|---|---|
| Artifacts | AgentDefinition, ToolDefinition, SkillDefinition, WorkflowDefinition, ModelDefinition, DatasetDefinition, ServiceDefinition |
| Organization and roots | OrganizationDefinition, HumanRootRecord, MultiHumanRootRecord |
| MAP | MapPlugin, MapPluginRelease, MapIntegrationSchema, MapPluginCollection |
The EntryType enum is authoritative. An older descriptive sentence inside the downloadable contract still says 10; the actual enum contains 14. Crate version is 0.1.0; marsVersion is 1.0.0.
Hash the payload
compute_item_data_hash serializes itemData with RFC 8785 JSON Canonicalization Scheme and computes SHA-256, encoded as sha256: plus lowercase hexadecimal. Hash the canonical payload, not the complete entry or the original JSON text formatting.
Sign the entry
MARS-PUBLISHER-SIGNING-V1 removes only these top-level fields before JCS serialization:
signature, sequence, updatedAt, lifecycleStatus, verifiableAttestations,
shardAssignment, anchorProjection, anchorState, anchorTxHash,
anchorBlockHeight, anchorProofEvery unlisted field remains signed, including publisherDid, bondReference, and nested fields with the same names. Use canonical_signing_bytes, then sign_entry. The signature object uses algorithm: "Ed25519", a DID key URL in keyId, and a strict unpadded base64url value encoding 64 signature bytes.
Legacy signatures made before the erratum must be re-signed; there is no dual-verification fallback. The vector contains public test-only key material, never a production key.
Structural limits
Names: 256 characters; descriptions: 4096; tags: 50, each at most 64 characters; canonical itemData: 1 MiB. Optional lineage, relationships, bond reference, and service endpoints must satisfy their own schemas. Passing JSON Schema does not replace runtime signature, ownership, capability, or trust checks.
Source authority
This page describes the checked-in implementation, not the availability of a public registry.
mars-protocol/src/entry.rsmars-protocol/src/hash.rsmars-protocol/src/signature.rsdocs/adr/0002-publisher-signing-profile-v1-erratum.md