in-toto供应链证明与链路验证治理（Layout-Link-阈值）最佳实践

实现示例type Step = { name: string; threshold: number }

type Layout = { steps: Step[] }

type Link = { stepName: string; materials: string[]; products: string[]; sigs: string[] }

function validStep(s: Step): boolean { return !!s.name && s.threshold > 0 }

function validLink(l: Link): boolean { return !!l.stepName && l.sigs.length > 0 }

function thresholdMet(l: Link, t: number): boolean { return l.sigs.length >= t }

function align(layout: Layout, links: Link[]): { ok: boolean; errors: string[] } {

const errors: string[] = []

for (const s of layout.steps) {

if (!validStep(s)) { errors.push(`step:${s.name}`); continue }

const ls = links.filter(l => l.stepName === s.name && validLink(l))

if (ls.length === 0) { errors.push(`link:${s.name}`); continue }

const met = ls.every(l => thresholdMet(l, s.threshold) && l.materials.length > 0 && l.products.length > 0)

if (!met) errors.push(`threshold:${s.name}`)

}

return { ok: errors.length === 0, errors }

}

审计与发布治理审计步骤阈值与 link 证明；不足阈值或材料/产物缺失阻断发布。布局变更需审批与归档。