Enum PluginSource 

pub enum PluginSource {
    LocalDir {
        path: PathBuf,
    },
    LocalArchive {
        path: PathBuf,
    },
    Url {
        url: String,
        sha256: Option<String>,
        allow_unverified: bool,
        allow_untrusted_host: bool,
        allow_unsigned: bool,
        signed_by: Option<String>,
    },
}

Where a plugin’s installed bundle came from. Recorded verbatim so update/reinstall can re-fetch from the same place.

Variants

LocalDir

Installed from a local directory (copied or referenced in place — the installer decides which; either way this records the ORIGINAL path the user pointed at, not necessarily plugin_dir).

Fields

path: PathBuf

LocalArchive

Installed by unpacking a local .tar.gz archive.

Fields

path: PathBuf

Url

Installed by fetching a URL. Three trust layers, all enforced by bamboo-server’s plugin_source.rs before this record is written:

1. Host allowlist (source authorization) — was the URL’s host fetched from an operator-trusted host (allow_untrusted_host opts out).
2. Signature (publisher authenticity) — did the bundle’s .sig verify against a trusted ed25519 key (signed_by; allow_unsigned opts out of requiring one).
3. Checksum (integrity) — sha256 is the user-verified hash of the downloaded BUNDLE (the plugin.json, or the archive containing it) — Some in the normal case, confirmed against a caller-supplied expected hash BEFORE anything was extracted/trusted.

sha256 is None either when the install explicitly opted out of checksum verification (allow_unverified: true, no hash supplied), OR when a verified signature (signed_by: Some(_)) already established integrity+authenticity more strongly than a pasted checksum could — see plugin_source.rs’s module docs for why a valid signature supersedes the checksum requirement. An install refuses outright rather than silently trusting an unpinned/unsigned download from an untrusted host, so every None/false combination here always means a deliberate, recorded risk acceptance, never an oversight.

Fields

url: String

sha256: Option<String>

allow_unverified: bool

Recorded for audit: true when this install ran with allow_unverified and no sha256. #[serde(default)] so a pre-existing installed.json row (written before this field existed, back when only the per-platform binary artifact was pinned) loads as false rather than failing to deserialize.

allow_untrusted_host: bool

Recorded for audit: true when this install ran with allow_untrusted_host against a host outside plugin_trust.trusted_hosts. #[serde(default)] for backward compat with rows written before this field existed.

allow_unsigned: bool

Recorded for audit: true when this install ran with allow_unsigned (no valid signature from a trusted key). #[serde(default)] for backward compat.

signed_by: Option<String>

The label of the plugin_trust.trusted_keys entry the bundle’s .sig verified against, or None if the install proceeded unsigned (allow_unsigned: true). #[serde(default)] for backward compat with rows written before signing existed.

Trait Implementations

impl Clone for PluginSource

fn clone(&self) -> PluginSource

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for PluginSource

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for PluginSource

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for PluginSource

impl PartialEq for PluginSource

fn eq(&self, other: &PluginSource) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for PluginSource

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for PluginSource