wasm_capability_contract/component/vo/artifact_provenance.rs
1//! [`ArtifactProvenance`] — where a component's `.wasm` bytes came from and how to verify them.
2
3use serde::{Deserialize, Serialize};
4
5/// Identifies and verifies the `.wasm` artifact a [`crate::ComponentManifest`] describes.
6///
7/// A real `ComponentValidator` implementor is expected to check
8/// `checksum_sha256` against the actual component bytes before ever
9/// loading them — this type only carries the claim, it does not verify it
10/// itself (verification is an adapter concern, per ADR-001's port/adapter
11/// split).
12#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
13pub struct ArtifactProvenance {
14 /// Where this artifact was built (a CI run id, a build system name, ...).
15 pub source: String,
16 /// Lowercase hex SHA-256 of the component's raw `.wasm` bytes.
17 pub checksum_sha256: String,
18 /// ISO 8601 timestamp of when the artifact was built.
19 pub built_at: String,
20}