dpcs 0.13.1

Reference implementation of the Data Pipeline Contract Standard (DPCS)
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61

//! Security metadata (SPEC Ch 24).

use serde::{Deserialize, Serialize};

use super::ExtensionMap;

/// Declarative security metadata attached to a Pipeline Contract.
///
/// Authentication, authorization, and secret-management systems remain outside
/// DPCS scope. This model records portable references and integrity pointers.
#[derive(Debug, Clone, PartialEq, Serialize, Deserialize, Default)]
#[cfg_attr(feature = "jsonschema", derive(schemars::JsonSchema))]
#[serde(rename_all = "camelCase")]
pub struct SecurityMetadata {
    /// External secret references (URIs or vault paths). Must not embed secret values.
    #[serde(default, skip_serializing_if = "Vec::is_empty")]
    pub secret_refs: Vec<SecretReference>,
    /// Integrity references (hashes, signatures, or attestation pointers).
    #[serde(default, skip_serializing_if = "Vec::is_empty")]
    pub integrity_refs: Vec<IntegrityReference>,
    /// Optional security domain / isolation annotation.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub security_domain: Option<String>,
    /// Optional audit policy identifier or reference.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub audit_policy_ref: Option<String>,
    /// Extension fields.
    #[serde(default, flatten)]
    pub extensions: ExtensionMap,
}

/// Reference to an externally managed secret.
#[derive(Debug, Clone, PartialEq, Serialize, Deserialize, Default)]
#[cfg_attr(feature = "jsonschema", derive(schemars::JsonSchema))]
#[serde(rename_all = "camelCase")]
pub struct SecretReference {
    /// Stable identifier for this secret reference.
    pub id: String,
    /// External locator (URI, vault path, or provider reference).
    pub loc: String,
    /// Optional provider hint (for example `vault` or `aws-secrets-manager`).
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub provider: Option<String>,
    /// Extension fields.
    #[serde(default, flatten)]
    pub extensions: ExtensionMap,
}

/// Integrity reference for tamper detection / attestation.
#[derive(Debug, Clone, PartialEq, Serialize, Deserialize, Default)]
#[cfg_attr(feature = "jsonschema", derive(schemars::JsonSchema))]
#[serde(rename_all = "camelCase")]
pub struct IntegrityReference {
    /// Algorithm or kind (for example `sha256` or `cosign`).
    pub kind: String,
    /// Digest, signature reference, or external locator (not an embedded key).
    pub value: String,
    /// Extension fields.
    #[serde(default, flatten)]
    pub extensions: ExtensionMap,
}