Make a JSON schema for CC Certificate and Dataset objects.

7 files changed, 969 insertions, 110 deletions

diff --git a/src/sec_certs/serialization/schemas/__init__.py b/src/sec_certs/serialization/schemas/__init__.py
new file mode 100644
index 00000000..e69de29b
--- /dev/null
+++ b/src/sec_certs/serialization/schemas/__init__.py
diff --git a/src/sec_certs/serialization/schemas/cc_certificate.json b/src/sec_certs/serialization/schemas/cc_certificate.json
new file mode 100644
index 00000000..ec34cdf5
--- /dev/null
+++ b/src/sec_certs/serialization/schemas/cc_certificate.json
@@ -0,0 +1,735 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "http://sec-certs.org/schemas/cc_certificate.json",
+  "title": "CC Certificate",
+  "description": "Schema for a Common Criteria (CC) certificate.",
+  "type": "object",
+  "definitions": {
+    "cc_dgst": {
+      "type": "string",
+      "pattern": "^[0-9a-fA-F]{16}$",
+      "title": "Certificate Digest",
+      "description": "A hex string representing 8 bytes."
+    },
+    "cc_id": {
+      "type": "string",
+      "title": "Certificate ID",
+      "description": "The unique identifier of the Common Criteria certificate."
+    },
+    "cc_document_state": {
+      "type": "object",
+      "properties": {
+        "_type": {
+          "const": "sec_certs.sample.document_state.DocumentState"
+        },
+        "convert_garbage": {
+          "type": "boolean",
+          "description": "Whether the document was converted to garbage (e.g., empty or invalid content)."
+        },
+        "convert_ok": {
+          "type": "boolean",
+          "description": "Whether the document was successfully converted from PDF to text."
+        },
+        "download_ok": {
+          "type": "boolean",
+          "description": "Whether the document was successfully downloaded."
+        },
+        "extract_ok": {
+          "type": "boolean",
+          "description": "Whether keyword extraction from the document was successful."
+        },
+        "pdf_hash": {
+          "type": [
+            "string",
+            "null"
+          ],
+          "description": "SHA256 hash of the PDF document, if available."
+        },
+        "txt_hash": {
+          "type": [
+            "string",
+            "null"
+          ],
+          "description": "SHA256 hash of the text document, if available."
+        }
+      },
+      "additionalProperties": false,
+      "title": "Certificate Document State (cert, report, st)",
+      "description": "State of the document processing pipeline for cert, report, or st document."
+    },
+    "cc_document_metadata": {
+      "type": "object",
+      "properties": {
+        "pdf_file_size_bytes": {
+          "type": "integer"
+        },
+        "pdf_is_encrypted": {
+          "type": "boolean"
+        },
+        "pdf_number_of_pages": {
+          "type": "integer"
+        },
+        "pdf_hyperlinks": {
+          "type": [
+            "object",
+            "null"
+          ],
+          "properties": {
+            "_type": {
+              "const": "Set"
+            },
+            "elements": {
+              "type": "array",
+              "items": {
+                "type": "string",
+                "format": "uri"
+              },
+              "uniqueItems": true
+            }
+          }
+        }
+      },
+      "additionalProperties": true
+    },
+    "cc_document_frontpage_body": {
+      "type": "object",
+      "properties": {
+        "match_rules": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "List of matching rules that were triggered to identify the front page."
+        },
+        "cert_id": {
+          "$ref": "#/definitions/cc_id",
+          "type": [
+            "string",
+            "null"
+          ],
+          "title": "Certificate ID",
+          "description": "The unique identifier of the Common Criteria certificate."
+        },
+        "cert_item": {
+          "type": [
+            "string",
+            "null"
+          ],
+          "title": "Certified Item",
+          "description": "The certified item as extracted from the front page."
+        },
+        "developer": {
+          "type": [
+            "string",
+            "null"
+          ],
+          "title": "Developer",
+          "description": "The developer of the certified item as extracted from the front page."
+        },
+        "cert_lab": {
+          "type": [
+            "string",
+            "null"
+          ],
+          "title": "Certification Lab",
+          "description": "The lab/scheme that issued the certificate as extracted from the front page."
+        },
+        "ref_protection_profiles": {
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "cc_version": {
+          "type": [
+            "string",
+            "null"
+          ],
+          "title": "CC Version",
+          "description": "The version of the Common Criteria standard as extracted from the front page."
+        },
+        "cc_security_level": {
+          "type": [
+            "string",
+            "null"
+          ],
+          "title": "CC Security Level",
+          "description": "The security level (e.g., EAL) as extracted from the front page."
+        }
+      },
+      "additionalProperties": false
+    },
+    "cc_document_frontpage": {
+      "type": "object",
+      "properties": {
+        "AU": {
+          "$ref": "#/definitions/cc_document_frontpage_body"
+        },
+        "CA": {
+          "$ref": "#/definitions/cc_document_frontpage_body"
+        },
+        "FR": {
+          "$ref": "#/definitions/cc_document_frontpage_body"
+        },
+        "DE": {
+          "$ref": "#/definitions/cc_document_frontpage_body"
+        },
+        "IN": {
+          "$ref": "#/definitions/cc_document_frontpage_body"
+        },
+        "IT": {
+          "$ref": "#/definitions/cc_document_frontpage_body"
+        },
+        "JP": {
+          "$ref": "#/definitions/cc_document_frontpage_body"
+        },
+        "MY": {
+          "$ref": "#/definitions/cc_document_frontpage_body"
+        },
+        "NL": {
+          "$ref": "#/definitions/cc_document_frontpage_body"
+        },
+        "NO": {
+          "$ref": "#/definitions/cc_document_frontpage_body"
+        },
+        "KR": {
+          "$ref": "#/definitions/cc_document_frontpage_body"
+        },
+        "PL": {
+          "$ref": "#/definitions/cc_document_frontpage_body"
+        },
+        "SG": {
+          "$ref": "#/definitions/cc_document_frontpage_body"
+        },
+        "ES": {
+          "$ref": "#/definitions/cc_document_frontpage_body"
+        },
+        "SE": {
+          "$ref": "#/definitions/cc_document_frontpage_body"
+        },
+        "TR": {
+          "$ref": "#/definitions/cc_document_frontpage_body"
+        },
+        "US": {
+          "$ref": "#/definitions/cc_document_frontpage_body"
+        }
+      },
+      "additionalProperties": false
+    },
+    "cc_document_keywords": {
+      "type": "object",
+      "additionalProperties": true,
+      "title": "Certificate Document Keywords",
+      "description": "Extracted keywords from the certification documents.",
+      "$comment": "Consult the rules.yaml for the list of possible keywords and their structure."
+    },
+    "cc_references": {
+      "type": "object",
+      "properties": {
+        "_type": {
+          "const": "sec_certs.sample.certificate.References"
+        },
+        "directly_referenced_by": {
+          "type": [
+            "object",
+            "null"
+          ],
+          "properties": {
+            "_type": {
+              "const": "Set"
+            },
+            "elements": {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/cc_id"
+              },
+              "uniqueItems": true
+            }
+          },
+          "description": "Certificates that directly reference this certificate."
+        },
+        "directly_referencing": {
+          "type": [
+            "object",
+            "null"
+          ],
+          "properties": {
+            "_type": {
+              "const": "Set"
+            },
+            "elements": {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/cc_id"
+              },
+              "uniqueItems": true
+            }
+          },
+          "description": "Certificates that are directly referenced by this certificate."
+        },
+        "indirectly_referenced_by": {
+          "type": [
+            "object",
+            "null"
+          ],
+          "properties": {
+            "_type": {
+              "const": "Set"
+            },
+            "elements": {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/cc_id"
+              },
+              "uniqueItems": true
+            }
+          },
+          "description": "Certificates that indirectly reference this certificate."
+        },
+        "indirectly_referencing": {
+          "type": [
+            "object",
+            "null"
+          ],
+          "properties": {
+            "_type": {
+              "const": "Set"
+            },
+            "elements": {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/cc_id"
+              },
+              "uniqueItems": true
+            }
+          },
+          "description": "Certificates that are indirectly referenced by this certificate."
+        }
+      },
+      "additionalProperties": false,
+      "title": "Certificate References (report, st)",
+      "description": "References to and from other certificates, based on a document."
+    },
+    "cc_sar": {
+      "type": "object",
+      "properties": {
+        "_type": {
+          "const": "sec_certs.sample.sar.SAR"
+        },
+        "family": {
+          "type": "string",
+          "title": "SAR Family",
+          "description": "The family of the Security Assurance Requirement (SAR)."
+        },
+        "level": {
+          "type": "integer",
+          "title": "SAR Level",
+          "description": "The level of the Security Assurance Requirement (SAR)."
+        }
+      },
+      "additionalProperties": false,
+      "title": "SAR",
+      "description": "Security Assurance Requirement (SAR) as defined in Common Criteria."
+    },
+    "cve": {
+      "type": "string",
+      "pattern": "^CVE-\\d{4}-\\d{4,}$",
+      "title": "CVE",
+      "description": "Common Vulnerabilities Enumeration (CVE) identifier"
+    },
+    "cpe": {
+      "type": "string",
+      "title": "CPE",
+      "description": "Common Platform Enumeration (CPE) identifier"
+    }
+  },
+  "properties": {
+    "_type": {
+      "const": "sec_certs.sample.cc.CCCertificate"
+    },
+    "name": {
+      "type": "string",
+      "title": "Certificate Name",
+      "description": "The name of the Common Criteria certificate."
+    },
+    "category": {
+      "enum": [
+        "Access Control Devices and Systems",
+        "Boundary Protection Devices and Systems",
+        "Data Protection",
+        "Databases",
+        "Detection Devices and Systems",
+        "ICs, Smart Cards and Smart Card-Related Devices and Systems",
+        "Key Management Systems",
+        "Mobility",
+        "Multi-Function Devices",
+        "Network and Network-Related Devices and Systems",
+        "Operating Systems",
+        "Other Devices and Systems",
+        "Products for Digital Signatures",
+        "Trusted Computing",
+        "Biometric Systems and Devices"
+      ],
+      "title": "Certificate Category",
+      "description": "The category of the Common Criteria certificate."
+    },
+    "scheme": {
+      "enum": [
+        "AU",
+        "CA",
+        "FR",
+        "DE",
+        "IN",
+        "IT",
+        "JP",
+        "MY",
+        "NL",
+        "NO",
+        "KR",
+        "PL",
+        "SG",
+        "ES",
+        "SE",
+        "TR",
+        "US"
+      ],
+      "title": "Certification Scheme",
+      "description": "The certification scheme under which the certificate was issued."
+    },
+    "status": {
+      "enum": [
+        "active",
+        "archived"
+      ],
+      "title": "Certificate Status",
+      "description": "The current status of the Common Criteria certificate."
+    },
+    "not_valid_after": {
+      "type": "string",
+      "format": "date",
+      "title": "Expiry Date",
+      "description": "The date until which the certificate is valid (expiry date)."
+    },
+    "not_valid_before": {
+      "type": "string",
+      "format": "date",
+      "title": "Certification Date",
+      "description": "The date from which the certificate is valid (certification date)."
+    },
+    "cert_link": {
+      "type": [
+        "string",
+        "null"
+      ],
+      "format": "uri",
+      "title": "Certificate Link",
+      "description": "A URL linking to the official certificate document."
+    },
+    "report_link": {
+      "type": [
+        "string",
+        "null"
+      ],
+      "format": "uri",
+      "title": "Certification Report Link",
+      "description": "A URL linking to the certification report document."
+    },
+    "st_link": {
+      "type": [
+        "string",
+        "null"
+      ],
+      "format": "uri",
+      "title": "Security Target Link",
+      "description": "A URL linking to the security target document."
+    },
+    "manufacturer": {
+      "type": "string",
+      "title": "Manufacturer",
+      "description": "The name of the manufacturer of the certified product."
+    },
+    "manufacturer_web": {
+      "type": "string",
+      "format": "uri",
+      "title": "Manufacturer Website",
+      "description": "The website URL of the manufacturer."
+    },
+    "security_level": {
+      "type": "object",
+      "properties": {
+        "_type": {
+          "const": "Set"
+        },
+        "elements": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "uniqueItems": true
+        }
+      },
+      "title": "Security Level",
+      "description": "The security levels associated with the certificate."
+    },
+    "dgst": {
+      "$ref": "#/definitions/cc_dgst"
+    },
+    "heuristics": {
+      "type": "object",
+      "properties": {
+        "_type": {
+          "const": "sec_certs.sample.cc.CCCertificate.Heuristics"
+        },
+        "eal": {
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "annotated_references": {
+          "type": "null"
+        },
+        "cert_id": {
+          "$ref": "#/definitions/cc_id",
+          "type": [
+            "string",
+            "null"
+          ],
+          "title": "Certificate ID",
+          "description": "The unique identifier of the Common Criteria certificate."
+        },
+        "cert_lab": {
+          "type": [
+            "array",
+            "null"
+          ],
+          "items": {
+            "type": "string"
+          },
+          "title": "Certification Lab",
+          "description": "The lab/scheme that issued the certificate."
+        },
+        "cpe_matches": {
+          "type": [
+            "array",
+            "null"
+          ],
+          "items": {
+            "$ref": "#/definitions/cve"
+          },
+          "uniqueItems": true,
+          "title": "CPE Matches",
+          "description": "List of CPEs (Common Platform Enumerations) associated with the certificate."
+        },
+        "verified_cpe_matches": {
+          "type": [
+            "array",
+            "null"
+          ],
+          "items": {
+            "$ref": "#/definitions/cve"
+          },
+          "uniqueItems": true,
+          "title": "Verified CPE Matches",
+          "description": "List of verified CPEs (Common Platform Enumerations) associated with the certificate."
+        },
+        "related_cves": {
+          "type": [
+            "array",
+            "null"
+          ],
+          "items": {
+            "$ref": "#/definitions/cve"
+          },
+          "uniqueItems": true,
+          "title": "Related CVEs",
+          "description": "List of CVEs (Common Vulnerabilities and Exposures) likely associated with the certificate."
+        },
+        "direct_transitive_cves": {
+          "type": [
+            "array",
+            "null"
+          ],
+          "items": {
+            "$ref": "#/definitions/cve"
+          },
+          "uniqueItems": true
+        },
+        "indirect_transitive_cves": {
+          "type": [
+            "array",
+            "null"
+          ],
+          "items": {
+            "$ref": "#/definitions/cve"
+          },
+          "uniqueItems": true
+        },
+        "extracted_sars": {
+          "type": [
+            "object",
+            "null"
+          ],
+          "properties": {
+            "_type": {
+              "const": "Set"
+            },
+            "elements": {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/cc_sar"
+              },
+              "uniqueItems": true
+            }
+          },
+          "title": "Extracted SARs",
+          "description": "Security Assurance Requirements (SARs) extracted from the certification documents."
+        },
+        "extracted_versions": {
+          "type": [
+            "object",
+            "null"
+          ],
+          "properties": {
+            "_type": {
+              "const": "Set"
+            },
+            "elements": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              },
+              "uniqueItems": true
+            }
+          },
+          "title": "Extracted Versions",
+          "description": "Product versions extracted from the certification documents."
+        },
+        "prev_certificates": {
+          "type": [
+            "array",
+            "null"
+          ],
+          "items": {
+            "$ref": "#/definitions/cc_id"
+          },
+          "title": "Previous Certificates",
+          "description": "List of previous versions of the certificate in a series, if applicable."
+        },
+        "next_certificates": {
+          "type": [
+            "array",
+            "null"
+          ],
+          "items": {
+            "$ref": "#/definitions/cc_id"
+          },
+          "title": "Next Certificates",
+          "description": "List of next versions of the certificate in a series, if applicable."
+        },
+        "report_references": {
+          "$ref": "#/definitions/cc_references",
+          "title": "Report References",
+          "description": "References to and from other certificates, based on the certification report document."
+        },
+        "scheme_data": {
+          "type": [
+            "object",
+            "null"
+          ],
+          "title": "Scheme Data",
+          "description": "Scheme-specific data extracted from the scheme websites.",
+          "$comment": "This is a free-form object and can contain any properties."
+        },
+        "st_references": {
+          "$ref": "#/definitions/cc_references",
+          "title": "ST References",
+          "description": "References to and from other certificates, based on the security target document."
+        },
+        "protection_profiles": {
+          "type": [
+            "array",
+            "null"
+          ],
+          "items": {
+            "type": "string"
+          },
+          "uniqueItems": true
+        }
+      },
+      "additionalProperties": false,
+      "title": "Certificate Heuristics",
+      "description": "Heuristic data extracted from the certification documents."
+    },
+    "maintenance_updates": {
+      "type": "object"
+    },
+    "protection_profile_links": {
+      "type": "object",
+      "properties": {
+        "_type": {
+          "const": "Set"
+        },
+        "elements": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "format": "uri"
+          },
+          "uniqueItems": true
+        }
+      }
+    },
+    "pdf_data": {
+      "type": "object",
+      "properties": {
+        "_type": {
+          "const": "sec_certs.sample.cc.CCCertificate.PdfData"
+        },
+        "report_metadata": {
+          "$ref": "#/definitions/cc_document_metadata",
+          "title": "Report Metadata",
+          "description": "Metadata extracted from the certification report PDF document file."
+        },
+        "st_metadata": {
+          "$ref": "#/definitions/cc_document_metadata",
+          "title": "ST Metadata",
+          "description": "Metadata extracted from the security target PDF document file."
+        },
+        "report_keywords": {
+          "$ref": "#/definitions/cc_document_keywords",
+          "title": "Report Keywords",
+          "description": "Keywords extracted from the certification report document."
+        },
+        "st_keywords": {
+          "$ref": "#/definitions/cc_document_keywords",
+          "title": "ST Keywords",
+          "description": "Keywords extracted from the security target document."
+        }
+      },
+      "title": "Extracted PDF Data",
+      "description": "Data extracted from the certification PDF documents."
+    },
+    "state": {
+      "type": "object",
+      "properties": {
+        "_type": {
+          "const": "sec_certs.sample.cc.CCCertificate.InternalState"
+        },
+        "cert": {
+          "$ref": "#/definitions/cc_document_state"
+        },
+        "report": {
+          "$ref": "#/definitions/cc_document_state"
+        },
+        "st": {
+          "$ref": "#/definitions/cc_document_state"
+        }
+      },
+      "additionalProperties": false,
+      "title": "Certificate Document States",
+      "description": "State of the document processing pipeline for cert, report, and st documents."
+    }
+  },
+  "additionalProperties": false
+}
\ No newline at end of file
diff --git a/src/sec_certs/serialization/schemas/cc_dataset.json b/src/sec_certs/serialization/schemas/cc_dataset.json
new file mode 100644
index 00000000..51a07b72
--- /dev/null
+++ b/src/sec_certs/serialization/schemas/cc_dataset.json
@@ -0,0 +1,61 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "http://sec-certs.org/schemas/cc_dataset.json",
+  "title": "CC Dataset",
+  "description": "Schema for a Common Criteria (CC) dataset.",
+  "type": "object",
+  "properties": {
+    "_type": {
+      "const": "sec_certs.dataset.cc.CCDataset"
+    },
+    "state": {
+      "type": "object",
+      "properties": {
+        "_type": {
+          "const": "sec_certs.dataset.dataset.Dataset.DatasetInternalState"
+        },
+        "meta_sources_parsed": {
+          "type": "boolean"
+        },
+        "artifacts_downloaded": {
+          "type": "boolean"
+        },
+        "pdfs_converted": {
+          "type": "boolean"
+        },
+        "auxiliary_datasets_processed": {
+          "type": "boolean"
+        },
+        "certs_analyzed": {
+          "type": "boolean"
+        }
+      },
+      "title": "Dataset internal state"
+    },
+    "timestamp": {
+      "type": "string",
+      "format": "date-time",
+      "title": "Timestamp of the dataset creation"
+    },
+    "name": {
+      "type": "string",
+      "title": "Name of the dataset"
+    },
+    "description": {
+      "type": "string",
+      "title": "Description of the dataset"
+    },
+    "n_certs": {
+      "type": "integer",
+      "minimum": 0,
+      "title": "Number of certificates in the dataset"
+    },
+    "certs": {
+      "type": "array",
+      "items": {
+        "$ref": "/schemas/cc_certificate.json"
+      },
+      "title": "List of certificates in the dataset"
+    }
+  }
+}
\ No newline at end of file
diff --git a/tests/cc/test_cc_analysis.py b/tests/cc/test_cc_analysis.py
index 4606383c..42c97bac 100644
--- a/tests/cc/test_cc_analysis.py
+++ b/tests/cc/test_cc_analysis.py
@@ -1,14 +1,19 @@
 from __future__ import annotations
 
+import json
 import shutil
 from collections.abc import Generator
 from importlib import resources
 from pathlib import Path
+from tempfile import TemporaryDirectory
 
 import pytest
 import tests.data.cc.analysis
 import tests.data.common
+from jsonschema import Draft7Validator, validate
+from referencing import Registry, Resource
 
+import sec_certs.serialization.schemas
 from sec_certs.cert_rules import SARS_IMPLIED_FROM_EAL
 from sec_certs.dataset.auxiliary_dataset_handling import (
     CPEDatasetHandler,
@@ -258,3 +263,35 @@ def test_segment_extractor(reference_dataset: CCDataset):
     df = ReferenceSegmentExtractor()(reference_dataset.certs.values())
     assert df is not None
     assert not df.empty
+
+
+def test_schema_validate_single(reference_dataset: CCDataset):
+    with (
+        resources.open_text(sec_certs.serialization.schemas, "cc_certificate.json") as schema_file,
+        TemporaryDirectory() as tmp_dir,
+    ):
+        schema = json.load(schema_file)
+        for cert in reference_dataset:
+            fname = Path(tmp_dir) / (cert.dgst + ".json")
+            cert.to_json(fname)
+            with fname.open("r") as handle:
+                validate(instance=json.load(handle), schema=schema)
+
+
+def test_schema_validate_full(reference_dataset: CCDataset):
+    registry = Registry()
+    with (
+        resources.open_text(sec_certs.serialization.schemas, "cc_certificate.json") as cert_schema_file,
+        resources.open_text(sec_certs.serialization.schemas, "cc_dataset.json") as dataset_schema_file,
+    ):
+        cert_schema = json.load(cert_schema_file)
+        registry = Resource.from_contents(cert_schema) @ registry
+        dataset_schema = json.load(dataset_schema_file)
+        registry = Resource.from_contents(dataset_schema) @ registry
+    validator = Draft7Validator(schema={"$ref": "http://sec-certs.org/schemas/cc_dataset.json"}, registry=registry)
+
+    with TemporaryDirectory() as tmp_dir:
+        fname = Path(tmp_dir) / "dataset.json"
+        reference_dataset.to_json(fname)
+        with fname.open("r") as handle:
+            validator.validate(instance=json.load(handle))
diff --git a/tests/cc/test_cc_certificate.py b/tests/cc/test_cc_certificate.py
index d24f4c30..d53663dd 100644
--- a/tests/cc/test_cc_certificate.py
+++ b/tests/cc/test_cc_certificate.py
@@ -7,7 +7,9 @@ from pathlib import Path
 import pytest
 import tests.data.cc.analysis
 import tests.data.cc.certificate
+from jsonschema import validate
 
+import sec_certs.serialization.schemas
 from sec_certs.dataset import CCDataset
 from sec_certs.sample import CCCertificate
 
@@ -100,3 +102,11 @@ def test_cert_older_dgst(cert_one: CCCertificate):
     cert_one.report_link = None
     with pytest.raises(RuntimeError):
         cert_one.older_dgst
+
+
+def test_schema_validation(data_dir: Path):
+    with (
+        (data_dir / "fictional_cert.json").open("r") as cert,
+        resources.open_text(sec_certs.serialization.schemas, "cc_certificate.json") as schema,
+    ):
+        validate(json.load(cert), json.load(schema))
diff --git a/tests/cc/test_cc_dataset.py b/tests/cc/test_cc_dataset.py
index 3d13edeb..071f5330 100644
--- a/tests/cc/test_cc_dataset.py
+++ b/tests/cc/test_cc_dataset.py
@@ -1,10 +1,13 @@
 import json
 import shutil
+from importlib import resources
 from pathlib import Path
 from tempfile import TemporaryDirectory
 
 import pytest
+from jsonschema import validate
 
+import sec_certs.serialization.schemas
 from sec_certs import constants
 from sec_certs.configuration import config
 from sec_certs.dataset.cc import CCDataset
@@ -166,3 +169,16 @@ def test_to_pandas(toy_dataset: CCDataset):
     assert df.shape == (len(toy_dataset), len(CCCertificate.pandas_columns))
     assert df.index.name == "dgst"
     assert set(df.columns) == (set(CCCertificate.pandas_columns).union({"year_from"})) - {"dgst"}
+
+
+def test_schema_validate(toy_dataset: CCDataset):
+    with (
+        resources.open_text(sec_certs.serialization.schemas, "cc_certificate.json") as schema_file,
+        TemporaryDirectory() as tmp_dir,
+    ):
+        schema = json.load(schema_file)
+        for cert in toy_dataset:
+            fname = Path(tmp_dir) / (cert.dgst + ".json")
+            cert.to_json(fname)
+            with fname.open("r") as handle:
+                validate(instance=json.load(handle), schema=schema)
diff --git a/tests/data/cc/certificate/fictional_cert.json b/tests/data/cc/certificate/fictional_cert.json
index 327aaf46..15b7f507 100644
--- a/tests/data/cc/certificate/fictional_cert.json
+++ b/tests/data/cc/certificate/fictional_cert.json
@@ -1,116 +1,116 @@
 {
-    "_type": "sec_certs.sample.cc.CCCertificate",
-    "dgst": "8049938203b26f7b",
-    "status": "archived",
-    "category": "Sample category",
-    "name": "Sample certificate name",
-    "manufacturer": "Sample manufacturer",
-    "scheme": "Sample scheme",
-    "security_level": {
-        "_type": "Set",
-        "elements": [
-            "Sample security level"
-        ]
+  "_type": "sec_certs.sample.cc.CCCertificate",
+  "dgst": "8049938203b26f7b",
+  "status": "archived",
+  "category": "Sample category",
+  "name": "Sample certificate name",
+  "manufacturer": "Sample manufacturer",
+  "scheme": "DE",
+  "security_level": {
+    "_type": "Set",
+    "elements": [
+      "Sample security level"
+    ]
+  },
+  "not_valid_before": "1900-01-02",
+  "not_valid_after": "1900-01-03",
+  "manufacturer_web": "https://path.to/manufacturer/web",
+  "protection_profile_links": {
+    "_type": "Set",
+    "elements": [
+      "https://sample.pp"
+    ]
+  },
+  "maintenance_updates": {
+    "_type": "Set",
+    "elements": [
+      {
+        "_type": "sec_certs.sample.cc.CCCertificate.MaintenanceReport",
+        "maintenance_date": "1900-01-01",
+        "maintenance_title": "Sample maintenance",
+        "maintenance_report_link": "https://maintenance.up",
+        "maintenance_st_link": "https://maintenance.up"
+      }
+    ]
+  },
+  "state": {
+    "_type": "sec_certs.sample.cc.CCCertificate.InternalState",
+    "report": {
+      "_type": "sec_certs.sample.document_state.DocumentState",
+      "download_ok": false,
+      "convert_garbage": false,
+      "convert_ok": false,
+      "extract_ok": false,
+      "pdf_hash": null,
+      "txt_hash": null
     },
-    "not_valid_before": "1900-01-02",
-    "not_valid_after": "1900-01-03",
-    "manufacturer_web": "https://path.to/manufacturer/web",
-    "protection_profile_links": {
-            "_type": "Set",
-            "elements": [
-                "https://sample.pp"
-            ]
-        },
-    "maintenance_updates": {
-        "_type": "Set",
-        "elements": [
-            {
-                "_type": "sec_certs.sample.cc.CCCertificate.MaintenanceReport",
-                "maintenance_date": "1900-01-01",
-                "maintenance_title": "Sample maintenance",
-                "maintenance_report_link": "https://maintenance.up",
-                "maintenance_st_link": "https://maintenance.up"
-            }
-        ]
+    "st": {
+      "_type": "sec_certs.sample.document_state.DocumentState",
+      "download_ok": false,
+      "convert_garbage": false,
+      "convert_ok": false,
+      "extract_ok": false,
+      "pdf_hash": null,
+      "txt_hash": null
     },
-    "state": {
-        "_type": "sec_certs.sample.cc.CCCertificate.InternalState",
-                "report": {
-                    "_type": "sec_certs.sample.document_state.DocumentState",
-                    "download_ok": false,
-                    "convert_garbage": false,
-                    "convert_ok": false,
-                    "extract_ok": false,
-                    "pdf_hash": null,
-                    "txt_hash": null
-                },
-                "st": {
-                    "_type": "sec_certs.sample.document_state.DocumentState",
-                    "download_ok": false,
-                    "convert_garbage": false,
-                    "convert_ok": false,
-                    "extract_ok": false,
-                    "pdf_hash": null,
-                    "txt_hash": null
-                },
-                "cert": {
-                    "_type": "sec_certs.sample.document_state.DocumentState",
-                    "download_ok": false,
-                    "convert_garbage": false,
-                    "convert_ok": false,
-                    "extract_ok": false,
-                    "pdf_hash": null,
-                    "txt_hash": null
-                }
+    "cert": {
+      "_type": "sec_certs.sample.document_state.DocumentState",
+      "download_ok": false,
+      "convert_garbage": false,
+      "convert_ok": false,
+      "extract_ok": false,
+      "pdf_hash": null,
+      "txt_hash": null
+    }
+  },
+  "pdf_data": {
+    "_type": "sec_certs.sample.cc.CCCertificate.PdfData",
+    "report_metadata": null,
+    "st_metadata": null,
+    "cert_metadata": null,
+    "report_frontpage": null,
+    "st_frontpage": null,
+    "cert_frontpage": null,
+    "report_keywords": null,
+    "st_keywords": null,
+    "cert_keywords": null,
+    "report_filename": null,
+    "st_filename": null,
+    "cert_filename": null
+  },
+  "heuristics": {
+    "_type": "sec_certs.sample.cc.CCCertificate.Heuristics",
+    "extracted_versions": null,
+    "cpe_matches": null,
+    "verified_cpe_matches": null,
+    "related_cves": null,
+    "cert_lab": null,
+    "cert_id": null,
+    "annotated_references": null,
+    "extracted_sars": null,
+    "direct_transitive_cves": null,
+    "indirect_transitive_cves": null,
+    "next_certificates": null,
+    "prev_certificates": null,
+    "report_references": {
+      "_type": "sec_certs.sample.certificate.References",
+      "directly_referenced_by": null,
+      "directly_referencing": null,
+      "indirectly_referenced_by": null,
+      "indirectly_referencing": null
     },
-    "pdf_data": {
-        "_type": "sec_certs.sample.cc.CCCertificate.PdfData",
-        "report_metadata": null,
-        "st_metadata": null,
-        "cert_metadata": null,
-        "report_frontpage": null,
-        "st_frontpage": null,
-        "cert_frontpage": null,
-        "report_keywords": null,
-        "st_keywords": null,
-        "cert_keywords": null,
-        "report_filename": null,
-        "st_filename": null,
-        "cert_filename": null
+    "st_references": {
+      "_type": "sec_certs.sample.certificate.References",
+      "directly_referenced_by": null,
+      "directly_referencing": null,
+      "indirectly_referenced_by": null,
+      "indirectly_referencing": null
     },
-    "heuristics": {
-        "_type": "sec_certs.sample.cc.CCCertificate.Heuristics",
-        "extracted_versions": null,
-        "cpe_matches": null,
-        "verified_cpe_matches": null,
-        "related_cves": null,
-        "cert_lab": null,
-        "cert_id": null,
-        "annotated_references": null,
-        "extracted_sars": null,
-        "direct_transitive_cves": null,
-        "indirect_transitive_cves": null,
-        "next_certificates": null,
-        "prev_certificates": null,
-        "report_references": {
-            "_type": "sec_certs.sample.certificate.References",
-            "directly_referenced_by": null,
-            "directly_referencing": null,
-            "indirectly_referenced_by": null,
-            "indirectly_referencing": null
-        },
-        "st_references": {
-            "_type": "sec_certs.sample.certificate.References",
-            "directly_referenced_by": null,
-            "directly_referencing": null,
-            "indirectly_referenced_by": null,
-            "indirectly_referencing": null
-        },
-        "scheme_data": null,
-        "protection_profiles": null,
-        "eal": null
-    },
-    "report_link": "https://path.to/report/link",
-    "st_link": "https://path.to/st/link",
-    "cert_link": "https://path.to/cert/link"
+    "scheme_data": null,
+    "protection_profiles": null,
+    "eal": null
+  },
+  "report_link": "https://path.to/report/link",
+  "st_link": "https://path.to/st/link",
+  "cert_link": "https://path.to/cert/link"
 }