chore(deps): update wsc-attestation requirement from 0.9 to 0.10

[dependabot]

Updates the requirements on wsc-attestation to permit the latest version.

Release notes

Sourced from wsc-attestation's releases.

wsc v0.10.0

What's Changed

• chore(deps): bump serde from 1.0.228 to 1.0.229 by @​dependabot[bot] in pulseengine/sigil#210
• feat(attestation): ToolInfo carries the toolchain layer identity by @​avrabe in pulseengine/sigil#221
• release: v0.10.0 — ToolInfo toolchain identity + honest SLSA claims by @​avrabe in pulseengine/sigil#222

Full Changelog: pulseengine/sigil@v0.9.4...v0.10.0

Changelog

Sourced from wsc-attestation's changelog.

[0.10.0] — 2026-08-07

Provenance identity and claim honesty. Records which qualified toolchain-set produced an artifact, and corrects load-bearing SLSA claims to what the cited spec actually defines — each backed by a gate so the fix can't silently rot.

Added

• ToolInfo carries the toolchain-layer identity (#217 / #221). Two optional fields — toolchain and toolchain_manifest_digest — populated from VARVE_LAYER / VARVE_LAYER_MANIFEST_DIGEST at each transformation hop via ToolInfo::with_varve_env(), so an attestation records not just which tool ran but which qualified set it came from (satisfies varve REQ-PROV-001). Backward-compatible on both sides: the fields skip_serializing_if when absent, so a non-varve attestation serializes byte-identically to before; and no deny_unknown_fields, so a v0.9.x verifier accepts a new attestation and simply ignores the added fields. Falsification: an attestation produced outside a varve dispatch is byte-for-byte unchanged; one produced under varve carries the layer identity in its signed payload, and an old signed attestation still verifies.

Changed

• Honest SLSA claims — no phantom Level 4 (#216). Docs claimed "SLSA Level 4 ✅ ACHIEVED" while citing SLSA v1.0, whose Build track defines L0–L3 only (Level 4 lived in the superseded v0.1 draft). Reframed every public surface — the README badge (SLSA-L4_provenance → SLSA-Build_L3), docs/slsa-compliance.md, the automotive/wac/research docs, and code comments — to state what we meet (Build L3) and to describe the reproducibility + offline/hardware-attestation work as "the properties SLSA v0.1 called Level 4" (beyond-L3 hardening), never as a v1.0 level. A fictional --slsa-level 4 CLI example (no such flag exists) was corrected and marked illustrative. STPA loss identifiers (L4/L5) were left untouched — a different concept. Falsification: the new claim-check gate re-derives count-max: 0 on SLSA[ -](https://github.com/pulseengine/sigil/blob/main/Level ?4|L4) across README/docs/examples/src on every commit — the claim reappearing fails the build; deleting the honest disclaimer fails a count-min presence check. Proven potent by negative control before wiring.

Fixed

• crates.io publish no longer fails red on every tag (#220, groundwork). The publish workflow had failed on every tag since v0.9.1 (v0.9.0 was the last success — hence the registry froze at 0.9.0). It's now disarmed behind vars.CRATES_PUBLISH_ENABLED — it skips cleanly rather than a perpetual red that reads as a dead gate — and re-arms with one variable once a crates.io Trusted Publisher (OIDC) or CRATES_IO_TOKEN is configured. Actually re-publishing the registry (backfilling 0.9.1→0.10.0) is tracked as REQ-22 in v0.11.0. Also fixed a latent stale wsc-crypto → wsc 0.9.0 internal pin.

Verification notes

... (truncated)

Commits

• 2e3c97a release: v0.10.0 — ToolInfo toolchain identity + honest SLSA claims (#222)
• 7617b09 feat(attestation): ToolInfo carries the toolchain layer identity (#217) (#221)
• 1986519 chore(deps): bump serde from 1.0.228 to 1.0.229 (#210)
• 71d17eb release: v0.9.4 — unbreak release + real #164 fix (#215)
• d25bd94 fix(witness): refresh MC/DC baseline 12->17 (std/dep churn, not a regression)...
• 2607571 fix(parser): raise MAX_SLICE_LEN to 256MB so large wasip2 components sign (#1...
• 7fa1c95 fix(bazel): use bare @​wsc_deps//:ureq alias (unbreaks the release) (#212)
• e131fdf chore(deps): bump taiki-e/install-action from 2 to 2.85.6 (#211)
• bb7e2d2 chore(deps): bump pulseengine/rivet from 0.28.0 to 0.30.0 (#203)
• 84af059 chore(deps): bump ureq from 3.1.2 to 3.3.0 (#209)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)