Struct DependencySignerVerifiedControl 

pub struct DependencySignerVerifiedControl;

Verifies that all dependencies have bound signer identity and transparency log (Dependencies L3).

Requires every dependency to have:

• VerificationOutcome::Verified (cryptographic signature)
• signer_identity present (who signed it)
• transparency_log_uri present (publicly auditable)

This extends L2 (dependency-provenance) by requiring the full trust chain to be inspectable: not just “signed by someone” but “signed by whom, verifiable where”.

Registry scoping: Only evaluates dependencies from registries that support the full trust chain (L3: signature + signer identity + transparency log). Currently only npm (Sigstore + Rekor) qualifies. Dependencies from L2-only or checksum-only registries are excluded.

Trait Implementations

impl Control for DependencySignerVerifiedControl

fn id(&self) -> ControlId

Returns the unique identifier for this control.

fn description(&self) -> &'static str

Human-readable description for SARIF rule output.

fn evaluate(&self, evidence: &EvidenceBundle) -> Vec<ControlFinding>

Evaluates the evidence bundle and returns one finding per subject.

fn tsc_criteria(&self) -> &'static [&'static str]

SOC2 Trust Services Criteria this control maps to (e.g., &[“CC6.1”, “CC8.1”]). Returns empty slice for controls not mapped to SOC2.