Schema for the rl-diff report format

The Spectra Assure platform supports a special format for analysis reports called rl-diff. This format provides detailed information on the compared versions and all the differences detected between them. It's particularly helpful for promptly detecting any unusual changes that might point to code tampering.

To generate reports in the rl-diff format:

with rl-secure CLI, use the rl-secure report command
with the Spectra Assure Portal APIs, use the "Export analysis report" endpoint

This page describes the full schema of the rl-diff report format.

How to read the schema?

The schema contents are displayed as a schema model and described in the order as they appear in the report.

The full rl-diff report example is displayed below the schema.

Desktop browsers: To make the schema easier to read, you can hide the navigation sidebar by selecting the << button at the bottom left of the page.

rl-diff report schema

duration required	string Indicates how long it took to complete the analysis.
schema required	number Default: 3 Version of this report schema. Version number is incremented to indicate a break of backwards compatibility.
timestamp required	string <date-time> Indicates when the software package was last analyzed in ISO-8601 time format.
version required	string Version of the analysis engine that was used to scan the software package.
catalogue required	integer Default: 1 Version of the rl-secure policy catalogue. The version should match the value specified in the catalogue.json file available in the public metadata repository.
required	object Summary of the ReversingLabs Spectra Assure analysis report.

{"duration": "00:00:02.334",
"schema": 3,
"timestamp": "2025-03-11T14:27:04+01:00",
"version": "5.3.0.112",
"catalogue": 1,
"report": {"diff": {"changes": {"action": {"change": "added",
"current": "string",
"previous": "string",
"tags": ["string"
]
},
"classification": {"change": "added",
"current": "string",
"previous": "string",
"tags": ["string"
]
},
"entropy": {"change": "added",
"current": "string",
"previous": "string",
"tags": ["string"
]
},
"format": {"change": "added",
"current": "string",
"previous": "string",
"tags": ["string"
]
},
"functionality": {"change": "added",
"current": "string",
"previous": "string",
"tags": ["string"
]
},
"hash": {"change": "added",
"current": "string",
"previous": "string",
"tags": ["string"
]
},
"indicator": {"change": "added",
"current": "string",
"previous": "string",
"tags": ["string"
]
},
"name": {"change": "added",
"current": "string",
"previous": "string",
"tags": ["string"
]
},
"policy": {"change": "added",
"current": "string",
"previous": "string",
"tags": ["string"
]
},
"size": {"change": "added",
"current": "string",
"previous": "string",
"tags": ["string"
]
},
"tag": {"change": "added",
"current": "string",
"previous": "string",
"tags": ["string"
]
},
"uri": {"change": "added",
"current": "string",
"previous": "string",
"tags": ["string"
]
},
"vulnerability": {"change": "added",
"current": "string",
"previous": "string",
"tags": ["string"
]
}
},
"file": {"allOf": null
},
"uuid": "string",
"violations": ["string"
],
"warnings": ["string"
]
},
"info": {"properties": ["string"
],
"source": {"artifact": {"classification": {"result": "",
"status": "Malicious"
},
"format": "GZIP",
"hashes": [["md5",
"ff0fd1e7a5df8a22d0c921ebe7b1b793"
],
["sha1",
"d63932d669fe6da664b4183d8e1d5a33a9492b9f"
],
["sha256",
"4430b43199a020b9a1f3bcfa9c55fcc207aea79ec4731def885e89980b8fe880"
]
],
"name": "7z1514-x64.msi",
"path": "",
"size": 210812,
"subtype": "Archive",
"type": "Binary",
"version": "Generic"
},
"rl_store": {"purl": "pkg:type/my-project/my-package@1.0",
"project": "my-project",
"package": "my-package",
"version": 1,
"qualifiers": ""
}
},
"statistics": {"applicable": 0,
"enforcements": 0,
"exclusions": 0,
"violations": 0
},
"summary": {"enforcements": 0,
"exclusions": 0,
"files_added": 0,
"files_changed": 0,
"files_removed": 0,
"repro_fails": 0,
"reproducible": "repro-check-fail",
"status": "pass",
"violations": 0
},
"target": {"artifact": {"classification": {"result": "",
"status": "Malicious"
},
"format": "GZIP",
"hashes": [["md5",
"ff0fd1e7a5df8a22d0c921ebe7b1b793"
],
["sha1",
"d63932d669fe6da664b4183d8e1d5a33a9492b9f"
],
["sha256",
"4430b43199a020b9a1f3bcfa9c55fcc207aea79ec4731def885e89980b8fe880"
]
],
"name": "7z1514-x64.msi",
"path": "",
"size": 210812,
"subtype": "Archive",
"type": "Binary",
"version": "Generic"
},
"rl_store": {"purl": "pkg:type/my-project/my-package@1.0",
"project": "my-project",
"package": "my-package",
"version": 1,
"qualifiers": ""
}
}
}
}
}

rl-diff report example

This example is for illustrative purposes only. It is used to visualize the report structure and does not represent any specific software package.

rl-diff report example
{
  "catalogue": 5,
  "duration": "00:00:00.000",
  "report": {
    "diff": [
      {
        "changes": {
          "hash": [
            {
              "change": "changed",
              "current": "23babcab045b78016e443f862363e4ab63c77d75bc715c0b3463f6134cbcf318",
              "previous": "2c266f6794adec310c4631232c1d039f46988d51082fe5e80349c52ee7ed60bb",
              "tags": []
            }
          ],
          "name": [
            {
              "change": "changed",
              "current": "7z2301-linux-x64.tar.xz",
              "previous": "7z2201-linux-x64.tar.xz",
              "tags": []
            }
          ],
          "size": [
            {
              "change": "changed",
              "current": "1527700",
              "previous": "1527036",
              "tags": []
            }
          ]
        },
        "file": {
          "format": "XZ",
          "hashes": [
            [
              "md5", 
              "394a38aef2b48d7a08214e0885443979"
            ],
            [
              "sha1", 
              "665b897e7cbfe2bb53879d113241068da5a09e9c"
            ],
            [
              "sha256",
              "2c266f6794adec310c4631232c1d039f46988d51082fe5e80349c52ee7ed60bb"
            ]
          ],
          "name": "7z2201-linux-x64.tar.xz",
          "path": "",
          "size": 1527036,
          "subtype": "Archive",
          "type": "Binary",
          "version": "Generic"
        },
        "uuid": "388fb839-a783-5a07-a9be-7abdebd52756",
        "violations": [],
        "warnings": []
      },
      {
        "changes": {
          "hash": [
            {
              "change": "changed",
              "current": "239259230ccd85be91c9ad321475aab49c0be0f9b916fe8645e2c21a279af090",
              "previous": "1ff211eaa18d8dceeb28a07dd82e0e09316d19bf68fad6b1e74467d9f9858ee6",
              "tags": []
            }
          ],
          "size": [
            {
              "change": "changed",
              "current": "6743552",
              "previous": "6833664",
              "tags": []
            }
          ]
        },
        "file": {
          "format": "TAR",
          "hashes": [
            [
              "md5", 
              "2633e2a4831e79a925d0aa02809092c9"
            ],
            [
              "sha1", 
              "c6eaa3930a1ec5092788173e472019e1f35dbbd4"
            ],
            [
              "sha256",
              "1ff211eaa18d8dceeb28a07dd82e0e09316d19bf68fad6b1e74467d9f9858ee6"
            ]
          ],
          "name": "0",
          "path": "unpacked_files/0",
          "size": 6833664,
          "subtype": "Archive",
          "type": "Binary",
          "version": "Generic"
        },
        "uuid": "2d0182df-ca2f-5aba-99b8-4b24dfe7ddb2",
        "violations": [],
        "warnings": []
      },
      {
        "changes": {
          "functionality": [
            {
              "change": "changed",
              "current": "1d596bfac33f39e1a35e5a2f19b1b53771b239fd",
              "previous": "274ee1229a515a25ad63fa9a4b5623ed27bacc94",
              "tags": []
            }
          ],
          "hash": [
            {
              "change": "changed",
              "current": "c7f8769e2bc8df6bcbfba34571ee0340670a52dec824dbac844dd3b5bd1a69e1",
              "previous": "0c771994a00ee96a0fc85902f66fbfd162c3090091e523bb828cdf4cd09a2e73",
              "tags": []
            }
          ],
          "size": [
            {
              "change": "changed",
              "current": "2763304",
              "previous": "2820648",
              "tags": []
            }
          ]
        },
        "file": {
          "format": "",
          "hashes": [
            [
              "md5", 
              "f0c58b9d8e93de4ef79b53a44fd66510"
            ],
            [
              "sha1", 
              "d003f4b47298041c983090653c881f937dbb1e94"
            ],
            [
              "sha256",
              "0c771994a00ee96a0fc85902f66fbfd162c3090091e523bb828cdf4cd09a2e73"
            ]
          ],
          "name": "7zz",
          "path": "unpacked_files/0/7zz",
          "size": 2820648,
          "subtype": "SO",
          "type": "ELF64 Little",
          "version": ""
        },
        "uuid": "e91958a1-5e96-5d4d-80a9-dfe66a506c55",
        "violations": [],
        "warnings": []
      },
      {
        "changes": {
          "hash": [
            {
              "change": "changed",
              "current": "b81c37aca9b7af945916d84235dcb27beaef519417130a594915b6583a5b1710",
              "previous": "3ed12371d214c49f990cd705e6c773ba56a68480ed5ccdbecaff9bab4e3f79e4",
              "tags": []
            }
          ],
          "size": [
            {
              "change": "changed",
              "current": "3656792",
              "previous": "3693656",
              "tags": []
            }
          ]
        },
        "file": {
          "format": "",
          "hashes": [
            [
              "md5", 
              "599288a8b39857b96ba67ab1c1b9382a"
            ],
            [
              "sha1", 
              "1f35c174043ccd189fe5539ad30eede38e5ee160"
            ],
            [
              "sha256",
              "3ed12371d214c49f990cd705e6c773ba56a68480ed5ccdbecaff9bab4e3f79e4"
            ]
          ],
          "name": "7zzs",
          "path": "unpacked_files/0/7zzs",
          "size": 3693656,
          "subtype": "Exe",
          "type": "ELF64 Little",
          "version": ""
        },
        "uuid": "44492616-6876-58cd-8ebf-51377eee24ef",
        "violations": [],
        "warnings": []
      },
      {
        "changes": {
          "hash": [
            {
              "change": "changed",
              "current": "83495c16b428d317ec3d27912c852f1af4b84526f6540e579ed34ebb66364d70",
              "previous": "24a8a7c00f0bb8ac3096f58f53bd47fa392b8d220c1c43d372100bd692c68e5f",
              "tags": []
            }
          ],
          "size": [
            {
              "change": "changed",
              "current": "58305",
              "previous": "55765",
              "tags": []
            }
          ]
        },
        "file": {
          "format": "",
          "hashes": [
            [
              "md5", 
              "b1206a5abf93bc64601a3caa2dff47d4"
            ],
            [
              "sha1", 
              "8f3ec5931b77f0841522324fb1202599b396e45a"
            ],
            [
              "sha256",
              "24a8a7c00f0bb8ac3096f58f53bd47fa392b8d220c1c43d372100bd692c68e5f"
            ]
          ],
          "name": "History.txt",
          "path": "unpacked_files/0/History.txt",
          "size": 55765,
          "subtype": "None",
          "type": "Text",
          "version": ""
        },
        "uuid": "afa7e06c-06ad-5325-bcf0-a4adfb4125a0",
        "violations": [],
        "warnings": []
      },
      {
        "changes": {
          "hash": [
            {
              "change": "changed",
              "current": "256b4d56983c2cf07c982dc00a676b54014042d30f4f85f236c7ab30c7e15f95",
              "previous": "337768fd0e8e1739e53ff3b935170e70ca935b4823b7a6cc554b267729bb0b25",
              "tags": []
            }
          ],
          "size": [
            {
              "change": "changed",
              "current": "45682",
              "previous": "44322",
              "tags": []
            }
          ]
        },
        "file": {
          "format": "HTML",
          "hashes": [
            [
              "md5", 
              "3478fb9c212b308dff3af1e11aad5f69"
            ],
            [
              "sha1", 
              "f932d5bcd10110469635f8128dff517c260971c9"
            ],
            [
              "sha256",
              "337768fd0e8e1739e53ff3b935170e70ca935b4823b7a6cc554b267729bb0b25"
            ]
          ],
          "name": "method.htm",
          "path": "unpacked_files/0/MANUAL/cmdline/switches/method.htm",
          "size": 44322,
          "subtype": "HTML",
          "type": "Text",
          "version": "Generic"
        },
        "uuid": "b000cbbb-c9ca-5f75-aeaa-f4ca6331bb27",
        "violations": [],
        "warnings": []
      },
      {
        "changes": {
          "hash": [
            {
              "change": "changed",
              "current": "eda25d67154090bf2524b63deb235c237b1e051e3fb82b08004fc492364d46a5",
              "previous": "cb4361a09099d9885c270721d0b761036c62cda9ef4ad5a29baaec30de719ea8",
              "tags": []
            }
          ]
        },
        "file": {
          "format": "",
          "hashes": [
            [
              "md5", 
              "a0adb9b82b393d058dc3bb843d4b7daf"
            ],
            [
              "sha1", 
              "501011f823bacfc081b8df7dfff5e5657e64a41b"
            ],
            [
              "sha256",
              "cb4361a09099d9885c270721d0b761036c62cda9ef4ad5a29baaec30de719ea8"
            ]
          ],
          "name": "readme.txt",
          "path": "unpacked_files/0/readme.txt",
          "size": 3866,
          "subtype": "None",
          "type": "Text",
          "version": ""
        },
        "uuid": "04bf8509-8458-541e-98ac-5bdc60df3808",
        "violations": [],
        "warnings": []
      },
      {
        "changes": {
          "hash": [
            {
              "change": "changed",
              "current": "3bd322629e2327591c4d03f236320d5b9fa7bbceb28040ef44bc9d821a2b4ea1",
              "previous": "26ba039d6f92f5e551286372ce94c7e3c98f8d9654302f75f127db2126c98f88",
              "tags": []
            }
          ],
          "size": [
            {
              "change": "changed",
              "current": "3946",
              "previous": "3936",
              "tags": []
            }
          ]
        },
        "file": {
          "format": "",
          "hashes": [
            [
              "md5", 
              "c3f8bd8878d29d458bb16e705bd5f057"
            ],
            [
              "sha1", 
              "bf58b7d2d439ef3f225631aa7e77a63838f10ef4"
            ],
            [
              "sha256",
              "26ba039d6f92f5e551286372ce94c7e3c98f8d9654302f75f127db2126c98f88"
            ]
          ],
          "name": "License.txt",
          "path": "unpacked_files/0/License.txt",
          "size": 3936,
          "subtype": "None",
          "type": "Text",
          "version": ""
        },
        "uuid": "bcd89077-836a-5b2f-88de-df54cea9fa8b",
        "violations": [],
        "warnings": []
      },
      {
        "changes": {
          "hash": [
            {
              "change": "changed",
              "current": "be9500078f65ec4ae59d92c4acba4abcf90427b4951878a48ac5bf221bf2e2d2",
              "previous": "79e0e933895ac6cf0e0de3265d6dc9c07ee4e98ded6118e22ce8f3378c96dcd1",
              "tags": []
            }
          ]
        },
        "file": {
          "format": "HTML",
          "hashes": [
            [
              "md5", 
              "e2cf73a2f7c034ff059f5d9beca96027"
            ],
            [
              "sha1", 
              "215e540d98aa6738a689944568b4f7158173186f"
            ],
            [
              "sha256",
              "79e0e933895ac6cf0e0de3265d6dc9c07ee4e98ded6118e22ce8f3378c96dcd1"
            ]
          ],
          "name": "start.htm",
          "path": "unpacked_files/0/MANUAL/start.htm",
          "size": 1174,
          "subtype": "HTML",
          "type": "Text",
          "version": "Generic"
        },
        "uuid": "21178209-47d1-5745-916a-17d1eec8bf77",
        "violations": [],
        "warnings": []
      }
    ],
    "info": {
      "properties": null,
      "source": {
        "artifact": {
          "classification": {
            "result": "",
            "status": "Goodware"
          },
          "format": "XZ",
          "hashes": [
            [
              "md5", 
              "394a38aef2b48d7a08214e0885443979"
            ],
            [
              "sha1", 
              "665b897e7cbfe2bb53879d113241068da5a09e9c"
            ],
            [
              "sha256",
              "2c266f6794adec310c4631232c1d039f46988d51082fe5e80349c52ee7ed60bb"
            ]
          ],
          "name": "7z2201-linux-x64.tar.xz",
          "path": "",
          "size": 1527036,
          "subtype": "Archive",
          "type": "Binary",
          "version": "Generic"
        },
        "rl-store": {
          "package": "7zip",
          "project": "Linux",
          "purl": "pkg:rl/Linux/7zip@22.01",
          "qualifiers": {},
          "version": "22.01"
        }
      },
      "statistics": null,
      "summary": {
        "enforcements": 0,
        "exclusions": 0,
        "files-added": 0,
        "files-changed": 9,
        "files-removed": 0,
        "repro-fails": 0,
        "reproducible": "repro-not-checked",
        "status": "pass",
        "violations": 0
      },
      "target": {
        "artifact": {
          "classification": {
            "result": "",
            "status": "Goodware"
          },
          "format": "XZ",
          "hashes": [
            [
              "md5", 
              "e6ec894ac83a6f9d203a295d5a9079e7"
            ],
            [
              "sha1", 
              "467db139c241ea04f2459a338af677cc022603ce"
            ],
            [
              "sha256",
              "23babcab045b78016e443f862363e4ab63c77d75bc715c0b3463f6134cbcf318"
            ]
          ],
          "name": "7z2301-linux-x64.tar.xz",
          "path": "",
          "size": 1527700,
          "subtype": "Archive",
          "type": "Binary",
          "version": "Generic"
        },
        "rl-store": {
          "package": "7zip",
          "project": "Linux",
          "purl": "pkg:rl/Linux/7zip@23.01",
          "qualifiers": {},
          "version": "23.01"
        }
      }
    }
  },
  "schema": 1,
  "timestamp": "2025-10-27T13:05:21+01:00",
  "version": "5.4.0.1827"
}

Schema for the rl-diff report format

How to read the schema?​

rl-diff report schema​

rl-diff report example​

How to read the schema?

rl-diff report schema

rl-diff report example