GAVR, the record format
A vulnerability record format in which each party signs its own words, a registry countersigns what it accepted, and any consumer can verify the whole thing offline. It is published as a specification with an open licence, and it is the part of GAdvisory that is not GAdvisory's to own.
A record with one voice cannot hold a disagreement
Existing formats give a vulnerability record one authoring party. Everything in it is that party's statement, so when a researcher disputes a severity, a downstream distributor adds affected packages, or a coordinating body records that the vendor never replied, none of it has anywhere to live except prose inside the vendor's own words.
GAVR makes the container the unit. A record holds several, each with an author, a role and its own signature, so a peer's assessment sits beside the owner's rather than replacing it, and a reader can tell who said what without trusting whoever served them the file.
Signatures that survive being copied
The document is canonicalised to a byte-exact form and signed with Ed25519. Each container carries its own signature over its own content, so lifting one out of a record and into another does not carry its attestation with it. A party that holds no key of its own can still be quoted: the container records who is vouching for the claim, which is an honest and checkable statement rather than a forged one.
When a registry accepts a record it countersigns what it accepted, covering the document, the submitting authority's signature over it, and the acceptance itself. That is what lets a mirror re-serve identical bytes and a consumer verify them years later without asking the registry anything.
Two questions, two answers
A signature proves who wrote something. It says nothing about whether they were entitled to. GAVR answers that with a chain of signed accreditations terminating at a root the reader already trusts, so verification needs no call to any central service.
A chain proves accreditation happened, not that it still holds, so it is paired with a short-lived statement of current standing issued by the accrediting party. Neither ships without the other: a chain alone would let a suspended body's records verify cleanly forever, which is worse than requiring a central registry.
Every participant serves its own records
An issuing authority is obliged to serve its own identifiers in addition to the registry, never instead of it. A consumer can then fetch the same signed bytes from two independent hosts and compare, with no code specific to either.
There is a small agent for exactly that. It holds no signing key, mints nothing and submits nothing: it mirrors, and it serves bytes verbatim rather than parsing and re-serialising them, because a re-serialised record can round-trip into something that no longer verifies while looking correct.
The specification is not ours to keep
A format whose whole premise is that third parties verify records independently cannot require our software to do it. The specification, its JSON Schema, the rules a schema cannot express, and a conformance corpus in both directions are published, and the packages that implement the format, the client and the CVE export are Apache-2.0 on npm.
That is a deliberate exception. GAdvisory itself is under the Elastic License 2.0; these three packages are Apache-2.0, because a participant on Python or Go has to be able to read and verify the format without a licence from us, and a format nobody can implement independently is not a format.
Version 1.0 is frozen. Adding a value to a closed set is a breaking change for anyone who has already implemented it, so the vocabularies are pinned and widening one costs a version, a compatibility path, and telling every participant before their validator starts refusing records.
The specification
The full specification, the schema and the conformance corpus are published on the network's own site.