Struct SbomAttestationControl 

pub struct SbomAttestationControl;

Validates that the latest release includes an SBOM artifact (SPDX or CycloneDX).

Maps to SOC2 CC7.1: system operations monitoring. Supply chain transparency — an SBOM enables consumers to audit the dependency tree of released artifacts, supporting vulnerability triage and licence compliance.

Evaluation tiers:

• Satisfied: latest release includes an SBOM artifact
• Violated: latest release exists but contains no SBOM
• NotApplicable: no release exists (library-only or pre-release project)

Trait Implementations

impl Control for SbomAttestationControl

fn id(&self) -> ControlId

Returns the unique identifier for this control.

fn description(&self) -> &'static str

Human-readable description for SARIF rule output.

fn evaluate(&self, evidence: &EvidenceBundle) -> Vec<ControlFinding>

Evaluates the evidence bundle and returns one finding per subject.

fn tsc_criteria(&self) -> &'static [&'static str]

SOC2 Trust Services Criteria this control maps to (e.g., &[“CC6.1”, “CC8.1”]). Returns empty slice for controls not mapped to SOC2.