sigstore-verification 0.2.4

Sigstore, Cosign, and SLSA attestation verification library
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38

use crate::api::Attestation;
use crate::sources::{ArtifactRef, AttestationSource};
use crate::{AttestationError, Result};
use async_trait::async_trait;

/// OCI registry source for fetching attestations from container registries
/// This follows the Cosign attachment specification
pub struct OciSource {
    #[allow(dead_code)]
    registry_url: String,
    // TODO: Add OCI client configuration
}

impl OciSource {
    pub fn new(registry_url: impl Into<String>) -> Self {
        Self {
            registry_url: registry_url.into(),
        }
    }
}

#[async_trait]
impl AttestationSource for OciSource {
    async fn fetch_attestations(&self, _artifact: &ArtifactRef) -> Result<Vec<Attestation>> {
        // TODO: Implement OCI registry attestation fetching
        // This would:
        // 1. Connect to the OCI registry
        // 2. Look for attestations attached to the artifact digest
        // 3. Download and parse the attestation bundles
        Err(AttestationError::Verification(
            "OCI source not yet implemented".into(),
        ))
    }

    fn source_type(&self) -> &'static str {
        "OCI"
    }
}