indev: make this standard-shaped

Author: tomodachi94

src/indev/package-tables.md

@@ -1,6 +1,6 @@
-**Package tables** are the primary way of setting up packages with unicornpkg. They are a Lua table or a function that returns a Lua table.
+**Package tables** are the primary way of setting up packages with unicornpkg. They MUST be a Lua table. The fields `name`, `pkgType`, and `unicornSpec` MUST be defined.
 
-The only required fields are `name` and `pkgType`, but more are recommended if you want your package to be useful.
+The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED",  "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC 2119](https://datatracker.ietf.org/doc/html/rfc2119).
 
 ## Fields
 ### `unicornSpec`
@@ -9,31 +9,33 @@ This specifies the version of the package table. This should always be set to `v
 
 ### `name`
 
+<!-- FIXME: redefine this -->
+
 This should be the same as the filename without the `.lua` extension.
 
 ### `desc`
 
-A description of the contents of the package table. Can be single-line or multiline.
+A description of the contents of the package table, as a string. Can be single-line or multiline.
 
 ### `homepage`
 
-A link to the program's homepage, if it has one.
+A link to the program's homepage, if it has one. If set, this MUST be an [absolute-URL string](https://url.spec.whatwg.org/#url-writing) as defined by the [WHATWG URL Standard](https://url.spec.whatwg.org).
 
 ### `maintainer`
 
-The name or pseudonym of the maintainer of the package table.
+The name or pseudonym of the maintainer of the package table. This MUST be expressed as a string, if set.
 
 ### `licensing`
 
-The license of the package's contents, expressed as an [SPDX License Expression](https://spdx.github.io/spdx-spec/v3.0.1/annexes/spdx-license-expressions/) as defined in the SPDX Specification, v3.0.1.
+The license of the package's contents. This MUST be expressed as an [SPDX License Expression](https://spdx.github.io/spdx-spec/v3.0.1/annexes/spdx-license-expressions/) as defined in the SPDX Specification, v3.0.1.
 
 Package definitions MAY be a different license from the license of the package's contents.
 
 #### SPDX extensions
 
 Packages MAY use `CCPL` and `MMPL` in license expressions to refer to the ComputerCraft Public License and Minecraft Mod Public License, respectively. New projects SHOULD refrain from using these licenses. If `CCPL` or `MMPL` ever become defined in the SPDX License List, those definitions MUST take precedence.
 
-Other than the exceptions above, implementations SHOULD avoid other extensions to the SPDX License List.
+Other than the exceptions above, implementations SHOULD avoid bespoke extensions to the SPDX License List.
 
 ### `version`
 
@@ -77,36 +79,40 @@ A table that contains scripts that should be called at various points in the pac
 
 #### `script.preinstall`
 
-A block of Lua source code that is called before the package table is installed.
+This value, if set, MUST be a string of Lua source code. It SHOULD be executed before the package is installed.
 
 #### `script.postinstall`
 
-A block of Lua source code that is called after the package table is installed.
+This value, if set, MUST be a string of Lua source code. It SHOULD be executed after the package is installed.
 
 #### `script.preremove`
 
-A block of Lua source code that is called before the package is removed.
+This value, if set, MUST be a string of Lua source code. It SHOULD be executed before the package is removed.
 
 #### `script.postremove`
 
-A block of Lua source code that is called after the package is removed.
+This value, if set, MUST be a string of Lua source code. It SHOULD be executed after the package is removed.
 
 ### `security`
 
 A table that contains hashes and other security-related data.
 
+Implementations MUST prevent packages with invalid hashes from being installed.
+
 #### `security.sha256`
 
-A table that contains a name of the installed file (e.g. `/bin/some-nonexistent-program.lua`) and the corresponding SHA-256 hash (e.g. `00000000000000000000000000000000000000000000000000000000000000000`).
+A table that contains a name of the installed file (e.g. `/bin/some-nonexistent-program.lua`) and the corresponding SHA-256 hash represented as a 256-bit hexadecimal string.
+
+SHA-256 hashes MUST be generated by a compliant implementation of [FIPS 180-4, Secure Hash Standard (SHS)](https://csrc.nist.gov/pubs/fips/180-4/upd1/final), or a later revision of that standard.
 
 ### `rel`
 
 A table that contains information relating to other packages.
 
 #### `rel.depends`
 
-A table that lists required packages.
+An integer-indexed table that lists required packages.
 
 #### `rel.conflicts`
 
-A numbered table that lists packages which break when they are installed with this package.
+An integer-indexed table that lists packages which break when they are installed with this package.