nordisk/heimdall

crates/heimdall-scan/src/statement.rs

// SPDX-License-Identifier: AGPL-3.0-only
//! The findings document as an in-toto Statement v1. Heimdall is a defensive
//! sandbox. The guest emits only the predicate (it holds no key); the caller
//! wraps it here and signs the Statement (DSSE) into its evidence, so a
//! one-way downstream can check it offline.

use serde_json::{json, Value};

use crate::report::Report;

/// The in-toto Statement type.
pub const STATEMENT_TYPE: &str = "https://in-toto.io/Statement/v1";
/// The predicate type of a static-scanner findings document.
pub const PREDICATE_TYPE: &str = "https://gunnar.rs/nordisk/heimdall/static-scan/v1";

/// `{"_type", "subject": [{name: purl, digest: {sha256}}], "predicateType",
/// "predicate": <report>}`.
pub fn in_toto_statement(report: &Report) -> Value {
    json!({
        "_type": STATEMENT_TYPE,
        "subject": [{
            "name": report.subject.purl,
            "digest": { "sha256": report.subject.sha256 },
        }],
        "predicateType": PREDICATE_TYPE,
        "predicate": serde_json::to_value(report).expect("a Report always serializes"),
    })
}