Struct DependencyProvenanceControl 

pub struct DependencyProvenanceControl;

Verifies that all dependencies have cryptographic provenance (Dependencies L2).

Requires every dependency to have:

• VerificationOutcome::Verified (not just ChecksumMatch)
• source_repo present (provenance links to source)

This is stricter than L1 (dependency-signature) which accepts checksum-only verification.

Registry scoping: Only evaluates dependencies from registries that support cryptographic provenance (L2+). Dependencies from checksum-only registries (e.g. crates.io) are excluded to avoid false positives. If all dependencies are from checksum-only registries, the control returns NotApplicable.

Trait Implementations

impl Control for DependencyProvenanceControl

fn id(&self) -> ControlId

Returns the unique identifier for this control.

fn description(&self) -> &'static str

Human-readable description for SARIF rule output.

fn evaluate(&self, evidence: &EvidenceBundle) -> Vec<ControlFinding>

Evaluates the evidence bundle and returns one finding per subject.

fn tsc_criteria(&self) -> &'static [&'static str]

SOC2 Trust Services Criteria this control maps to (e.g., &[“CC6.1”, “CC8.1”]). Returns empty slice for controls not mapped to SOC2.