This is one of the reasons I'm opposed to in JSON changelog/signatures and instead would just rather use git commits/notes and signatures:
TL;DR: any spec like this will let people do things a bit differently and thus wrong.
--
Kurt Seifried -- Red Hat -- Product Security -- CloudPGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993Red Hat Product Security contact: secalert@redhat.com