Module deps_dev 

Supply-chain trust signal via deps.dev API v3.

DepsDevClient::trust_signal assembles an SupplyChainTrustSignal (OpenSSF Scorecard + SLSA/attestation provenance) for one resolved (system, name, version) from two sequential deps.dev calls, and is infallible by construction: every failure — network, timeout, non-2xx, malformed JSON, no linked source repository — degrades to None rather than propagating an error into hover (FR-006), mirroring crate::osv::OsvClient::scan and github::ReleaseDatesCache::fetch.

deps.dev sends no ETag/Last-Modified on either endpoint (live-verified 2026-09-03), so crate::cache::HttpCache’s conditional-GET entry cache cannot apply here — this client reuses only HttpCache’s transport (HTTPS enforcement, DNS guard, body cap, origin-pinned redirects) via crate::cache::HttpCache::get_transport_only_with_headers_limited_trusted_origin and layers its own TTL memo over the assembled signal instead, the same deviation crate::osv already documents for OSV.dev’s identical missing-validators case.

SOURCE_REPO selection and the self-reported disclosure

A package’s relatedProjects[] commonly carries several SOURCE_REPO entries, differing only in relationProvenance. choose_project_key prefers an SLSA_ATTESTATION-backed entry over an UNVERIFIED_METADATA (package-self-reported) one: the latter is derived from the package’s own manifest metadata, so an unranked pick would let a hostile package point its repository field at a reputable, high-scoring repo and inherit that repo’s Scorecard. When only a self-reported relation exists, ScorecardSummary::self_reported carries that fact to the hover renderer, which discloses it rather than presenting the score with the same confidence as an attested relation.

Structs

DepsDevClient

Assembles SupplyChainTrustSignals from deps.dev’s two-call sequence.

ScorecardSummary

The hover-facing OpenSSF Scorecard summary for a package’s linked source repository.

SupplyChainTrustSignal

The ecosystem-agnostic aggregate assembled from deps.dev’s two calls, consumed by the hover-formatting layer.

Enums

ProvenanceStatus

The three-state SLSA/attestation provenance verdict for one resolved version (FR-004).