A Joule Code receipt is natively a JCR-1 COSE_Sign1 envelope, but the
software-supply-chain world (GitHub/GitLab attestations, cosign, Rekor,
SLSA verifiers) speaks in-toto Statements wrapped in DSSE. Add a reusable
projection so any Receipt becomes a standard attestation the ecosystem can
verify without understanding JCR-1.
- Receipt::intoto_statement(subjects) -> in-toto Statement v1, the
predicate carrying the receipt's energy/measured_uj/provenance/tier.
- Receipt::to_dsse(key, steward, subjects) -> signed DSSE envelope:
Ed25519 over the DSSE PAE, payloadType application/vnd.in-toto+json.
Refuses to attest a receipt that fails the provenance<->measured
coupling (a dishonest receipt cannot be sealed).
- verify_dsse(envelope, pubkey) -> the in-toto statement bytes on success.
- Standard base64 (RFC 4648) + DSSE PAE inlined to keep the crate dep-light.
Interop projection, not a second source of truth: same key, predicate
restates the honest fields. 11 tests green (well-formed v1 statement,
sign/verify, wrong-key + tampered-payload rejection, dishonest-refusal),
clippy clean.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
6cedb591d8