Struct ReleaseAssetAttestationControl 

pub struct ReleaseAssetAttestationControl;

Validates that the latest release assets have build provenance attestations (GitHub Attestations / Sigstore).

Maps to SOC2 PI1.4: processing integrity through artifact provenance. Build provenance attestations bind release binaries to the source commit and CI workflow that produced them, enabling consumers to verify that artifacts were not tampered with after build.

Evaluation tiers:

• Satisfied: release assets have attestations
• Violated: release assets exist but lack attestations
• NotApplicable: no release exists

Trait Implementations

impl Control for ReleaseAssetAttestationControl

fn id(&self) -> ControlId

Returns the unique identifier for this control.

fn description(&self) -> &'static str

Human-readable description for SARIF rule output.

fn evaluate(&self, evidence: &EvidenceBundle) -> Vec<ControlFinding>

Evaluates the evidence bundle and returns one finding per subject.

fn tsc_criteria(&self) -> &'static [&'static str]

SOC2 Trust Services Criteria this control maps to (e.g., &[“CC6.1”, “CC8.1”]). Returns empty slice for controls not mapped to SOC2.

fn remediation_hint(&self) -> Option<&'static str>

Actionable remediation hint shown when the control fails or needs review.