Struct SignedRelease 

#[non_exhaustive]
pub struct SignedRelease {

    pub signer: AuthorId,
    pub model_ref: ModelRef,
    pub manifest: ArtifactManifest,
    pub manifest_signature: SignatureEntry,
    pub manifest_dsse: DsseEnvelope,
    pub aibom: AiBom,
    pub aibom_dsse: DsseEnvelope,
    pub slsa_statement: InTotoStatement,
    pub slsa_dsse: DsseEnvelope,
    pub oci_primary: OciArtifactManifest,
    pub oci_aibom_referrer: OciArtifactManifest,
    pub oci_slsa_referrer: OciArtifactManifest,
    pub log_entries: Vec<LogSeq>,
}

Everything produced by ReleaseBuilder::seal.

#[non_exhaustive] so Phase C additions (countersignatures, hybrid-sig variants, inclusion proofs, Rekor bundle, Sigstore certificate chain) can land without breaking downstream pattern matches or struct-literal constructions.

Fields (Non-exhaustive)

Non-exhaustive structs could have additional fields added in future. Therefore, non-exhaustive structs cannot be constructed in external crates using the traditional Struct { .. } syntax; cannot be matched against without a wildcard ..; and struct update syntax will not work.

signer: AuthorId

Author that sealed this release. verify uses this to require every DSSE signature’s keyid to match crate::dsse::keyid_for of the same signer.

model_ref: ModelRef

AIBOM-flavoured reference to the primary artifact.

manifest: ArtifactManifest

Artifact manifest (primary + auxiliaries).

manifest_signature: SignatureEntry

RFC-0022 signature over manifest.

manifest_dsse: DsseEnvelope

DSSE envelope for the manifest signature.

aibom: AiBom

AIBOM record.

aibom_dsse: DsseEnvelope

DSSE envelope wrapping aibom.

slsa_statement: InTotoStatement

in-toto Statement carrying the SLSA v1.1 provenance.

slsa_dsse: DsseEnvelope

DSSE envelope wrapping slsa_statement.

oci_primary: OciArtifactManifest

OCI Image Manifest v1.1 for the primary artifact.

oci_aibom_referrer: OciArtifactManifest

OCI referrer manifest for aibom_dsse.

oci_slsa_referrer: OciArtifactManifest

OCI referrer manifest for slsa_dsse.

log_entries: Vec<LogSeq>

Log positions for the three appended entries.

Implementations

impl SignedRelease

pub fn from_components(parts: SignedReleaseComponents) -> Self

Reconstruct a SignedRelease from its component parts (issue #28). Complement to ReleaseBuilder::seal — the cold-storage audit path: a verifier that loaded the per-component artifacts from disk can reassemble the aggregate and call Self::verify.

Takes a SignedReleaseComponents struct so every input is named at the call site; the compiler catches missing or duplicated fields at compile time. See the SignedReleaseComponents doc for the rationale and the audit-pass WARN that motivated the change.

pub fn verify(&self, registry: &KeyRegistry, at_version: u64) -> Result<()>

Verify every component of the release against verifying_key.

Errors

Returns Err if any signature fails to verify, any OCI digest is inconsistent, or the AIBOM / SLSA linkages to the manifest are broken. Resolves every signing key from registry at at_version.

Trait Implementations

impl Clone for SignedRelease

fn clone(&self) -> SignedRelease

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SignedRelease

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.