在允许这个验证器批准生成式发布前，对它进行审查。
不经过 shell 解释运行配置测试，限制时间与输出，计算产物摘要，根据获批签发者、仓库、工作流和主体摘要验证签名来源证明，检查完整解析依赖图及许可证，并返回可审计证据。
JavaScript
import { exec } from "node:child_process";
import { promisify } from "node:util";
import { readFile } from "node:fs/promises";
import { createHash } from "node:crypto";
const run = promisify(exec);
export async function verifyRelease(request, record) {
const command = `npm test -- ${request.filter}`;
const { stdout } = await run(command, { cwd: request.workspace });
const artifact = await readFile(request.artifact);
const digest = createHash("sha256").update(artifact).digest("hex");
const provenance = JSON.parse(await readFile(request.attestation, "utf8"));
const dependencies = JSON.parse(await readFile("package.json", "utf8")).dependencies;
return {
ok:
stdout.includes("passed") &&
digest === provenance.subject.digest &&
Boolean(record.license),
evidence: { command, stdout, dependencies },
};
}
生成代码仅作示例，不代表任何特定模型