in-toto供应链证明与链路验证治理（Layout-Link-阈值）最佳实践

实现示例type Step = { name: string; threshold: number } type Layout = { steps: Step[] } type Link = { stepName: string; materials: string[]; products: string[]; sigs: string[] } function validStep(s: Step): boolean { return !!s.name && s.threshold > 0 } function validLink(l: Link): boolean { return !!l.stepName && l.sigs.length > 0 } function thresholdMet(l: Link, t: number): boolean { return l.sigs.length >= t } function align(layout: Layout, links: Link[]): { ok: boolean; errors: string[] } { const errors: string[] = [] for (const s of layout.steps) { if (!validStep(s)) { errors.push(`step:${s.name}`); continue } const ls = links.filter(l => l.stepName === s.name && validLink(l)) if (ls.length === 0) { errors.push(`link:${s.name}`); continue } const met = ls.every(l => thresholdMet(l, s.threshold) && l.materials.length > 0 && l.products.length > 0) if (!met) errors.push(`threshold:${s.name}`) } return { ok: errors.length === 0, errors } } 审计与发布治理审计步骤阈值与 link 证明；不足阈值或材料/产物缺失阻断发布。布局变更需审批与归档。