rivox 1.0.0

Universal polyglot build coordination layer for Python, Rust, and Node monorepos
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41

pub mod intoto;
pub mod sigstore;
pub mod slsa;
pub mod spdx;

use crate::graph::GraphNode;
use anyhow::Result;
use serde::{Deserialize, Serialize};
use std::fs;
use std::path::{Path, PathBuf};

#[derive(Debug, Serialize, Deserialize, Clone)]
pub struct ProvenanceBundle {
    pub in_toto_statement: serde_json::Value,
    pub slsa_provenance: serde_json::Value,
    pub spdx_sbom: serde_json::Value,
    pub sigstore_rekor_ref: Option<String>,
}

impl ProvenanceBundle {
    pub fn generate_and_save(nodes: &[GraphNode], target_dir: &Path) -> Result<PathBuf> {
        let in_toto = intoto::generate_intoto_statement(nodes)?;
        let slsa = slsa::generate_slsa_l2_provenance(nodes)?;
        let sbom = spdx::generate_spdx_2_3_sbom(nodes)?;
        let sigstore_ref = sigstore::sign_and_register_rekor(&slsa)?;

        let bundle = ProvenanceBundle {
            in_toto_statement: in_toto,
            slsa_provenance: slsa,
            spdx_sbom: sbom,
            sigstore_rekor_ref: sigstore_ref,
        };

        fs::create_dir_all(target_dir)?;
        let bundle_path = target_dir.join("provenance.json");
        let content = serde_json::to_string_pretty(&bundle)?;
        fs::write(&bundle_path, content)?;

        Ok(bundle_path)
    }
}