rivox 1.0.0

Universal polyglot build coordination layer for Python, Rust, and Node monorepos
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40

use crate::graph::GraphNode;
use anyhow::Result;
use serde_json::json;

pub fn generate_slsa_l2_provenance(nodes: &[GraphNode]) -> Result<serde_json::Value> {
    let resolved_dependencies: Vec<serde_json::Value> = nodes
        .iter()
        .map(|node| {
            json!({
                "name": node.package_name,
                "version": node.resolved_version,
                "digest": {
                    "sha256": node.content_hash.trim_start_matches("sha256:")
                }
            })
        })
        .collect();

    let provenance = json!({
        "_type": "https://in-toto.io/Statement/v1",
        "predicateType": "https://slsa.dev/provenance/v1",
        "subject": resolved_dependencies,
        "predicate": {
            "buildDefinition": {
                "buildType": "https://rivox.dev/build/v1",
                "externalParameters": {},
                "internalParameters": {
                    "slsaLevel": "SLSA_BUILD_LEVEL_2"
                }
            },
            "runDetails": {
                "builder": {
                    "id": "https://github.com/aaryanrwt/rivox@v1.0.0"
                }
            }
        }
    });

    Ok(provenance)
}