Enum RegistryProvenanceCapability 

pub enum RegistryProvenanceCapability {
    ChecksumOnly,
    CryptographicProvenance,
    FullTrustChain,
}

Provenance capability levels supported by a package registry.

Registries evolve at different speeds. This enum captures the highest SLSA Dependencies level a registry’s infrastructure can currently support, allowing controls to skip dependencies from registries that lack the required infrastructure rather than producing false positives.

Current ecosystem status (as of March 2026):

• npm (registry.npmjs.org): L3 — Sigstore keyless signing + Rekor. GA since Oct 2023, 134+ high-impact projects adopted.
• PyPI (pypi.org): L3 — Trusted Publishers + Sigstore attestations (Fulcio + Rekor, same stack as npm). 17% of uploads include attestations. Packages with attestations provide full L3: signer identity (publisher.repository + Fulcio cert SAN) and Rekor transparency log.
• Maven Central: L3 capability — Sigstore .sigstore.json validation added Jan 2025 (opt-in). PGP .asc still mandatory. Very low Sigstore adoption. No dedicated query API (URL convention only).
• crates.io: L1 only — SHA-256 checksums in Cargo.lock. Trusted Publishing (RFC #3691) covers auth only; Sigstore RFC #3403 proposed but not merged.
• Go (proxy.golang.org): L1 only — sum.golang.org provides tamper-evident checksum log but no provenance/signing.
• NuGet (nuget.org): L1 — X.509 signing exists but no Sigstore/attestation API at registry level.

Variants

ChecksumOnly

L1: integrity only (checksum). No cryptographic signing infrastructure.

CryptographicProvenance

L2: cryptographic signature + source provenance available.

FullTrustChain

L3: signature + signer identity + transparency log available.

Trait Implementations

impl Clone for RegistryProvenanceCapability

fn clone(&self) -> RegistryProvenanceCapability

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for RegistryProvenanceCapability

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Ord for RegistryProvenanceCapability

fn cmp(&self, other: &RegistryProvenanceCapability) -> Ordering

This method returns an Ordering between self and other.

fn max(self, other: Self) -> Self

where Self: Sized,

Compares and returns the maximum of two values.

fn min(self, other: Self) -> Self

where Self: Sized,

Compares and returns the minimum of two values.

fn clamp(self, min: Self, max: Self) -> Self

where Self: Sized,

Restrict a value to a certain interval.

impl PartialEq for RegistryProvenanceCapability

fn eq(&self, other: &RegistryProvenanceCapability) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl PartialOrd for RegistryProvenanceCapability

fn partial_cmp(&self, other: &RegistryProvenanceCapability) -> Option<Ordering>

This method returns an ordering between self and other values if one exists.

fn lt(&self, other: &Rhs) -> bool

Tests less than (for self and other) and is used by the < operator.

fn le(&self, other: &Rhs) -> bool

Tests less than or equal to (for self and other) and is used by the <= operator.

fn gt(&self, other: &Rhs) -> bool

Tests greater than (for self and other) and is used by the > operator.

fn ge(&self, other: &Rhs) -> bool

Tests greater than or equal to (for self and other) and is used by the >= operator.

impl Copy for RegistryProvenanceCapability

impl Eq for RegistryProvenanceCapability

impl StructuralPartialEq for RegistryProvenanceCapability