Struct SecretEntry 

pub struct SecretEntry {
    pub env_var: String,
    pub value: Zeroizing<String>,
    pub source: Option<SecretSource>,
    pub placeholder: String,
    pub allowed_hosts: Vec<HostPattern>,
    pub injection: SecretInjection,
    pub on_violation: Option<ViolationAction>,
    pub require_tls_identity: bool,
}

A single secret entry (serializable form passed to the network engine).

Fields

env_var: String

Environment variable name exposed to the sandbox (holds the placeholder).

Must be non-empty and must not contain = or NUL. microsandbox does not require shell-identifier syntax because Linux environment entries only require a NAME=value shape.

value: Zeroizing<String>

The actual secret value (never enters the sandbox).

Empty when the entry carries a source reference instead: reference-model entries resolve the value host-side at spawn time so the durable sandbox config never stores raw secret material.

Wrapped in Zeroizing so the owned plaintext copy is wiped when the entry drops. This only scrubs this in-memory copy; serde/JSON buffers that ever carried a legacy inlined value are explicitly out of scope.

source: Option<SecretSource>

Host-side source reference resolved into value at spawn time. None means value already carries the material (the inline model used by value-based secrets).

placeholder: String

Placeholder string the sandbox sees instead of the real value.

Must be non-empty, no longer than 1024 bytes, and must not contain NUL, CR, or LF.

allowed_hosts: Vec<HostPattern>

Hosts allowed to receive this secret.

injection: SecretInjection

Where the secret can be injected.

on_violation: Option<ViolationAction>

Action on secret violation for this secret.

require_tls_identity: bool

Require verified TLS identity before substituting (default: true). When true, secret is only substituted if the connection uses TLS interception (not bypass) and the SNI matches an allowed host.

Implementations

impl SecretEntry

pub fn validate(&self, secret_index: usize) -> Result<(), SecretConfigError>

Validate this secret entry.

Trait Implementations

impl Clone for SecretEntry

fn clone(&self) -> SecretEntry

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SecretEntry

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for SecretEntry

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for SecretEntry

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.