Struct DependencySignatureControl 

pub struct DependencySignatureControl;

Verifies that all dependencies have been checked for integrity or provenance.

Distinguishes two levels of verification:

• Verified: Cryptographic signature confirmed (Sigstore, PGP, cosign)
• ChecksumMatch: Integrity hash matched (Cargo.lock checksum, npm SRI hash) — confirms download integrity but NOT authenticity

Both levels pass this control, but the rationale clearly reports the breakdown (e.g. “140 checksum, 2 sigstore”) so consumers can distinguish trust levels.

When evidence is Partial (some dependencies could not be checked), the control propagates the evidence gaps into the finding and appends a warning to the rationale.

Trait Implementations

impl Control for DependencySignatureControl

fn id(&self) -> ControlId

Returns the unique identifier for this control.

fn description(&self) -> &'static str

Human-readable description for SARIF rule output.

fn evaluate(&self, evidence: &EvidenceBundle) -> Vec<ControlFinding>

Evaluates the evidence bundle and returns one finding per subject.

fn tsc_criteria(&self) -> &'static [&'static str]

SOC2 Trust Services Criteria this control maps to (e.g., &[“CC6.1”, “CC8.1”]). Returns empty slice for controls not mapped to SOC2.