@voxgig/sdkgen 4.8.3 → 4.10.0

package/project/.sdk/tm/rust/feature/secrets/plugins/aws.rs

@@ -0,0 +1,328 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (rust/plugins/aws/src/lib.rs)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+//! The two AWS providers - Secrets Manager and SSM Parameter Store -
+//! and the request signing they need, as voxgig/plugin definitions.
+//!
+//! SIGV4 TRAVELS WITH THEM, which is the sharpest instance of the split:
+//! the core of no port imports a hash function, and `crypto.rs` here is
+//! the only SHA-256 in this repository's Rust. A chain of built-in kinds
+//! links neither it nor the HTTP client it signs for.
+
+pub mod crypto;
+pub mod sigv4;
+
+use std::collections::BTreeMap;
+use std::rc::Rc;
+use std::time::{SystemTime, UNIX_EPOCH};
+
+use crate::feature::secrets::plugin::catalog::Definition;
+use crate::feature::secrets::sekreto::{awsparam, checkaddr, providerplugin, vaultref, Answer, Provider, SekretoError};
+use super::httpjson::json::{self, Json};
+use super::httpjson::{fetchjson, firstof, headerrefs, http, textat, trimslash, JsonResponse};
+
+pub use self::sigv4::{sigv4, Sigv4Input, Sigv4Output};
+
+/// The `YYYYMMDDTHHMMSSZ` timestamp SigV4 wants, for now.
+fn awsnow() -> String {
+    let seconds = SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .unwrap_or_default()
+        .as_secs();
+
+    let (year, month, day) = civildate((seconds / 86400) as i64);
+    let clock = seconds % 86400;
+
+    format!(
+        "{:04}{:02}{:02}T{:02}{:02}{:02}Z",
+        year,
+        month,
+        day,
+        clock / 3600,
+        clock % 3600 / 60,
+        clock % 60
+    )
+}
+
+/// Days since the epoch as a civil date - the classic era-based
+/// conversion (Howard Hinnant's `civil_from_days`), exact for any date
+/// the epoch can name.
+fn civildate(days: i64) -> (i64, u32, u32) {
+    let z = days + 719468;
+    let era = if 0 <= z { z } else { z - 146096 } / 146097;
+    let dayofera = z - era * 146097;
+    let yearofera = (dayofera - dayofera / 1460 + dayofera / 36524 - dayofera / 146096) / 365;
+    let year = yearofera + era * 400;
+    let dayofyear = dayofera - (365 * yearofera + yearofera / 4 - yearofera / 100);
+    let monthish = (5 * dayofyear + 2) / 153;
+    let day = (dayofyear - (153 * monthish + 2) / 5 + 1) as u32;
+    let month = (if monthish < 10 {
+        monthish + 3
+    } else {
+        monthish - 9
+    }) as u32;
+
+    (if month <= 2 { year + 1 } else { year }, month, day)
+}
+
+/// Region and credentials, resolved for one AWS call.
+struct AwsAuth {
+    region: String,
+    keyid: String,
+    secret: String,
+    session: String,
+}
+
+/// Region and credentials, from config first and the standard AWS_*
+/// environment variables second - those are AWS's own convention, and a
+/// pod or CI job that has them set should just work. Missing either is
+/// an error: an AWS store with no credentials could not answer.
+fn awsauth(region: &str, keyid: &str, secret: &str, session: &str) -> Answer<AwsAuth> {
+    let region = firstof(region, &["AWS_REGION", "AWS_DEFAULT_REGION"]);
+    let keyid = firstof(keyid, &["AWS_ACCESS_KEY_ID"]);
+    let secret = firstof(secret, &["AWS_SECRET_ACCESS_KEY"]);
+    let session = firstof(session, &["AWS_SESSION_TOKEN"]);
+
+    if region.is_empty() {
+        return Err(SekretoError::new(
+            "sekreto: aws: no region (set region or AWS_REGION)",
+        ));
+    }
+    if keyid.is_empty() || secret.is_empty() {
+        return Err(SekretoError::new(
+            "sekreto: aws: no credentials (set keyid/secret or AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY)",
+        ));
+    }
+
+    Ok(AwsAuth {
+        region,
+        keyid,
+        secret,
+        session,
+    })
+}
+
+/// One signed call to an AWS JSON-1.1 API.
+fn awscall(
+    addr: &str,
+    auth: &AwsAuth,
+    service: &str,
+    target: &str,
+    payload: &Json,
+) -> Answer<JsonResponse> {
+    let addr = if addr.is_empty() {
+        // The China partition lives under its own suffix; every other
+        // commercial region is plain amazonaws.com.
+        let suffix = if auth.region.starts_with("cn-") {
+            ".amazonaws.com.cn"
+        } else {
+            ".amazonaws.com"
+        };
+        format!("https://{}.{}{}", service, auth.region, suffix)
+    } else {
+        addr.to_string()
+    };
+    checkaddr(&addr)?;
+
+    let url = format!("{}/", trimslash(&addr));
+    let body = json::stringify(payload);
+
+    let mut headers = vec![
+        (
+            "content-type".to_string(),
+            "application/x-amz-json-1.1".to_string(),
+        ),
+        ("x-amz-target".to_string(), target.to_string()),
+    ];
+
+    let signed = sigv4(&Sigv4Input {
+        method: "POST".to_string(),
+        url: url.clone(),
+        headers: headers.clone(),
+        body: body.clone(),
+        service: service.to_string(),
+        region: auth.region.clone(),
+        keyid: auth.keyid.clone(),
+        secret: auth.secret.clone(),
+        session: auth.session.clone(),
+        datetime: awsnow(),
+    })?;
+
+    for (name, value) in signed {
+        headers.push((name, value));
+    }
+
+    fetchjson("POST", &url, &headerrefs(&headers), Some(&body))
+}
+
+/// Does this AWS error body name one of the not-found types? Those are
+/// a miss; every other failure is a store that could not answer.
+fn awsmiss(body: &Option<Json>, types: &[&str]) -> bool {
+    let errtype = match body.as_ref().and_then(|body| body.get("__type")) {
+        Some(Json::Str(errtype)) => errtype.clone(),
+        _ => String::new(),
+    };
+
+    types.iter().any(|name| errtype.contains(name))
+}
+
+/// AWS Secrets Manager.
+///
+/// `api.token` reads the secret named `api` (the vaultref path, so
+/// `db.pass.main` reads `db/pass`) and takes the `token` field of its
+/// JSON SecretString - the AWS idiom of one JSON map per secret. A
+/// SecretString that is not JSON is the value itself, under the
+/// conventional field `value`. Requests are SigV4-signed in-tree; see
+/// src/sigv4.rs.
+pub struct AwsSecretsProvider {
+    pub region: String,
+    pub keyid: String,
+    pub secret: String,
+    pub session: String,
+    pub addr: String,
+}
+
+impl Provider for AwsSecretsProvider {
+    fn lookup(&self, name: &str) -> Answer<Option<String>> {
+        let reference = vaultref(name)?;
+        let auth = awsauth(&self.region, &self.keyid, &self.secret, &self.session)?;
+
+        let payload = Json::Map(BTreeMap::from([(
+            "SecretId".to_string(),
+            Json::Str(reference.path.clone()),
+        )]));
+
+        let response = awscall(
+            &self.addr,
+            &auth,
+            "secretsmanager",
+            "secretsmanager.GetSecretValue",
+            &payload,
+        )?;
+
+        if 400 == response.status && awsmiss(&response.body, &["ResourceNotFoundException"]) {
+            return Ok(None);
+        }
+
+        if 200 != response.status {
+            return Err(SekretoError::new(format!(
+                "sekreto: aws secretsmanager error: {}",
+                response.status
+            )));
+        }
+
+        let text = match response.body.as_ref().and_then(|body| body.get("SecretString")) {
+            Some(Json::Str(text)) => text.clone(),
+            _ => {
+                // A binary secret has no fields to address; only the
+                // conventional `value` field can mean "the bytes
+                // themselves".
+                if "value" != reference.field {
+                    return Ok(None);
+                }
+                let bin = match response.body.as_ref().and_then(|body| body.get("SecretBinary")) {
+                    Some(Json::Str(bin)) => bin.clone(),
+                    _ => return Ok(None),
+                };
+                // A payload that will not decode was reported as None -
+                // a MISS - so the chain carried on to a weaker store. A
+                // store that answered incoherently could not answer.
+                return match http::unbase64(&bin) {
+                    Some(bytes) => Ok(Some(String::from_utf8_lossy(&bytes).to_string())),
+                    None => Err(SekretoError::new("sekreto: aws secretsmanager: undecodable secret".to_string())),
+                };
+            }
+        };
+
+        if let Some(Json::Map(fields)) = json::parse(&text) {
+            return Ok(fields
+                .get(&reference.field)
+                .filter(|value| !matches!(value, Json::Null))
+                .map(|value| value.text()));
+        }
+
+        // A plain-string secret is the whole value; it has no named fields.
+        if "value" == reference.field {
+            return Ok(Some(text));
+        }
+        Ok(None)
+    }
+
+    // Config only, never the environment: describe() feeds the spec's
+    // sources group, which must answer the same everywhere.
+    fn describe(&self) -> String {
+        format!("awssecrets:{}", self.region)
+    }
+}
+
+/// AWS SSM Parameter Store.
+///
+/// `db.pass.main` reads the parameter `/db/pass/main` (under an optional
+/// prefix path), decrypted. Parameter Store carries flat strings, so
+/// there is no field indirection.
+pub struct AwsParamsProvider {
+    pub region: String,
+    pub keyid: String,
+    pub secret: String,
+    pub session: String,
+    pub addr: String,
+    pub prefix: String,
+}
+
+impl Provider for AwsParamsProvider {
+    fn lookup(&self, name: &str) -> Answer<Option<String>> {
+        let paramname = awsparam(name, &self.prefix)?;
+        let auth = awsauth(&self.region, &self.keyid, &self.secret, &self.session)?;
+
+        let payload = Json::Map(BTreeMap::from([
+            ("Name".to_string(), Json::Str(paramname)),
+            ("WithDecryption".to_string(), Json::Bool(true)),
+        ]));
+
+        let response = awscall(&self.addr, &auth, "ssm", "AmazonSSM.GetParameter", &payload)?;
+
+        if 400 == response.status && awsmiss(&response.body, &["ParameterNotFound"]) {
+            return Ok(None);
+        }
+
+        if 200 != response.status {
+            return Err(SekretoError::new(format!(
+                "sekreto: aws ssm error: {}",
+                response.status
+            )));
+        }
+
+        Ok(textat(&response.body, &["Parameter", "Value"]))
+    }
+
+    fn describe(&self) -> String {
+        format!("awsparams:{}{}", self.region, self.prefix)
+    }
+}
+
+/// The `awssecrets` kind, as a plugin definition.
+pub fn secrets() -> Definition {
+    providerplugin("awssecrets", |spec| {
+        Ok(Rc::new(AwsSecretsProvider {
+            region: spec.region.clone(),
+            keyid: spec.keyid.clone(),
+            secret: spec.secret.clone(),
+            session: spec.session.clone(),
+            addr: spec.addr.clone(),
+        }) as Rc<dyn Provider>)
+    })
+}
+
+/// The `awsparams` kind, as a plugin definition.
+pub fn params() -> Definition {
+    providerplugin("awsparams", |spec| {
+        Ok(Rc::new(AwsParamsProvider {
+            region: spec.region.clone(),
+            keyid: spec.keyid.clone(),
+            secret: spec.secret.clone(),
+            session: spec.session.clone(),
+            addr: spec.addr.clone(),
+            prefix: spec.prefix.clone(),
+        }) as Rc<dyn Provider>)
+    })
+}

package/project/.sdk/tm/rust/feature/secrets/plugins/azuresecrets.rs

@@ -0,0 +1,184 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (rust/plugins/azuresecrets/src/lib.rs)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+//! The Azure Key Vault provider, as a voxgig/plugin definition.
+
+use std::cell::RefCell;
+use std::rc::Rc;
+use std::time::Instant;
+
+use crate::feature::secrets::plugin::catalog::Definition;
+use crate::feature::secrets::sekreto::{checkaddr, flatname, providerplugin, Answer, Provider, SekretoError};
+use super::httpjson::{
+    expiryseconds, fetchjson, http, renewdue, renewtime, textat, trimslash,
+};
+
+/// Azure Key Vault.
+///
+/// `api.token` reads secret `api-token` (dots flattened to `-`; Key
+/// Vault names allow nothing else), current version. The token comes
+/// from config, then a client-credentials login when tenant/clientid/
+/// clientsecret are given, then the IMDS managed-identity endpoint - so
+/// on Azure's own platform no credential configuration is needed.
+///
+/// As with GCP, the IMDS call is plain http to a link-local host by
+/// platform design and carries no credential; the login and vault
+/// addresses are `checkaddr`-guarded.
+#[derive(Default)]
+pub struct AzureSecretsProvider {
+    pub vault: String,
+    pub token: String,
+    pub tenant: String,
+    pub clientid: String,
+    pub clientsecret: String,
+    pub loginaddr: String,
+    pub imdsaddr: String,
+    pub apiversion: String,
+    // A configured token is kept forever; logged-in and IMDS tokens carry
+    // expires_in and are renewed shortly before they run out.
+    livetoken: RefCell<Option<String>>,
+    renewat: RefCell<Option<Instant>>,
+}
+
+/// The OAuth resource a Key Vault token is scoped to.
+const AZURERESOURCE: &str = "https://vault.azure.net";
+
+impl AzureSecretsProvider {
+    fn login(&self) -> Answer<String> {
+        if !self.token.is_empty() {
+            return Ok(self.token.clone());
+        }
+
+        if !self.tenant.is_empty() && !self.clientid.is_empty() && !self.clientsecret.is_empty() {
+            let loginaddr = if self.loginaddr.is_empty() {
+                "https://login.microsoftonline.com"
+            } else {
+                &self.loginaddr
+            };
+            checkaddr(loginaddr)?;
+
+            let url = format!("{}/{}/oauth2/v2.0/token", trimslash(loginaddr), self.tenant);
+            let form = format!(
+                "grant_type=client_credentials&client_id={}&client_secret={}&scope={}",
+                http::urlencode(&self.clientid),
+                http::urlencode(&self.clientsecret),
+                http::urlencode(&format!("{}/.default", AZURERESOURCE))
+            );
+
+            let response = fetchjson(
+                "POST",
+                &url,
+                &[("content-type", "application/x-www-form-urlencoded")],
+                Some(&form),
+            )?;
+
+            let got = textat(&response.body, &["access_token"]).unwrap_or_default();
+
+            if 200 != response.status || got.is_empty() {
+                return Err(SekretoError::new(format!(
+                    "sekreto: azure login failed: {}",
+                    response.status
+                )));
+            }
+
+            // expires_in may arrive as a string; expiryseconds reads both.
+            *self.renewat.borrow_mut() =
+                renewtime(expiryseconds(&response.body, &["expires_in"]));
+            return Ok(got);
+        }
+
+        let imds = format!(
+            "{}/metadata/identity/oauth2/token?api-version=2018-02-01&resource={}",
+            trimslash(if self.imdsaddr.is_empty() {
+                "http://169.254.169.254"
+            } else {
+                &self.imdsaddr
+            }),
+            http::urlencode(AZURERESOURCE)
+        );
+
+        let response = fetchjson("GET", &imds, &[("Metadata", "true")], None)?;
+
+        let got = textat(&response.body, &["access_token"]).unwrap_or_default();
+
+        if 200 != response.status || got.is_empty() {
+            return Err(SekretoError::new(
+                "sekreto: azure: no token, no client credentials, and IMDS did not answer",
+            ));
+        }
+
+        *self.renewat.borrow_mut() = renewtime(expiryseconds(&response.body, &["expires_in"]));
+        Ok(got)
+    }
+}
+
+impl Provider for AzureSecretsProvider {
+    fn lookup(&self, name: &str) -> Answer<Option<String>> {
+        if self.vault.is_empty() {
+            return Err(SekretoError::new("sekreto: azure: no vault"));
+        }
+
+        // Only an explicit scheme is a URL; a vault NAMED httpvault must
+        // still become https://httpvault.vault.azure.net.
+        let vaulturl = if self.vault.starts_with("http://") || self.vault.starts_with("https://") {
+            self.vault.clone()
+        } else {
+            format!("https://{}.vault.azure.net", self.vault)
+        };
+        checkaddr(&vaulturl)?;
+
+        if self.livetoken.borrow().is_none() || renewdue(&self.renewat) {
+            *self.livetoken.borrow_mut() = Some(self.login()?);
+        }
+        let livetoken = self.livetoken.borrow().clone().unwrap_or_default();
+
+        let url = format!(
+            "{}/secrets/{}?api-version={}",
+            trimslash(&vaulturl),
+            flatname(name, "-")?,
+            if self.apiversion.is_empty() {
+                "7.4"
+            } else {
+                &self.apiversion
+            }
+        );
+
+        let bearer = format!("Bearer {}", livetoken);
+        let response = fetchjson("GET", &url, &[("authorization", bearer.as_str())], None)?;
+
+        if 404 == response.status {
+            return Ok(None);
+        }
+
+        if 200 != response.status {
+            return Err(SekretoError::new(format!(
+                "sekreto: azure error: {}: {}",
+                response.status,
+                url.split('?').next().unwrap_or(&url)
+            )));
+        }
+
+        Ok(textat(&response.body, &["value"]))
+    }
+
+    fn describe(&self) -> String {
+        format!("azuresecrets:{}", self.vault)
+    }
+}
+
+/// The `azuresecrets` kind, as a plugin definition.
+pub fn plugin() -> Definition {
+    providerplugin("azuresecrets", |spec| {
+        Ok(Rc::new(AzureSecretsProvider {
+            vault: spec.vault.clone(),
+            token: spec.token.clone(),
+            tenant: spec.tenant.clone(),
+            clientid: spec.clientid.clone(),
+            clientsecret: spec.clientsecret.clone(),
+            loginaddr: spec.loginaddr.clone(),
+            imdsaddr: spec.imdsaddr.clone(),
+            apiversion: spec.apiversion.clone(),
+            ..Default::default()
+        }) as Rc<dyn Provider>)
+    })
+}

package/project/.sdk/tm/rust/feature/secrets/plugins/boru.rs

@@ -0,0 +1,172 @@
+// VENDORED: @voxgig/sekreto sdk-20260908-1556-0 (rust/plugins/boru/src/lib.rs)
+// Source: https://github.com/voxgig/sekreto @ 1267ee2e5f49566bc92695bc9eb3a60ef4924998  [tag: sdk-20260908-1556-0]
+// License: MIT (c) voxgig - see repository LICENSE. Do not edit: resync from upstream.
+//! The boru vault provider, as a voxgig/plugin definition.
+//!
+//! It is a plugin because it spawns a process and, in wire mode, opens a
+//! socket: the core does neither.
+
+use std::process::Command;
+use std::rc::Rc;
+
+use crate::feature::secrets::plugin::catalog::Definition;
+use crate::feature::secrets::sekreto::{checkaddr, checkname, providerplugin, Answer, Provider, SekretoError};
+use super::httpjson::{fetchjson, textat, trimslash};
+
+/// A boru vault (https://github.com/boru-lang/boru).
+///
+/// Two ways in, both boru's own.
+///
+/// With no `addr`, the CLI: `boru vault get --reveal <alias>` prints the
+/// secret on stdout and nothing else. The passphrase is read by boru
+/// itself from `BORU_VAULT_PASSPHRASE`; sekreto never accepts it as
+/// config and never puts it on a command line, where it would show up in
+/// the process table.
+///
+/// With an `addr`, boru's wire protocol: `boru vault serve` publishes a
+/// read-only, HashiCorp-shaped provision API (boru's
+/// design/VAULT-WIRE-PROTOCOL.0.md), authenticated by a capability token
+/// from `boru vault grant`. A sekreto name is already a valid boru
+/// alias, and boru aliases keep their dots, so `api.token` is the single
+/// path segment `api.token` - not the `api`/`token` split a HashiCorp KV
+/// gets. The value is the `value` field. A 404 is a miss; anything else
+/// the server refuses (a revoked capability, a sealed vault) is an
+/// error.
+///
+/// boru's `vault proxy` and `vault mcp` remain out of bounds: they are a
+/// credential *broker*, built precisely so the caller never receives the
+/// credential. `vault serve` is the provision endpoint, built to hand
+/// the value back - that is the one sekreto uses.
+pub struct BoruProvider {
+    pub command: String,
+    pub namespace: String,
+    pub home: String,
+    /// The wire-protocol address; empty means the CLI is used instead.
+    pub addr: String,
+    pub token: String,
+    pub mount: String,
+}
+
+impl Provider for BoruProvider {
+    fn lookup(&self, name: &str) -> Answer<Option<String>> {
+        checkname(name)?;
+
+        if !self.addr.is_empty() {
+            checkaddr(&self.addr)?;
+
+            let mount = if self.mount.is_empty() {
+                "secret"
+            } else {
+                &self.mount
+            };
+            let alias = if self.namespace.is_empty() {
+                name.to_string()
+            } else {
+                format!("{}/{}", self.namespace, name)
+            };
+            let url = format!("{}/v1/{}/data/{}", trimslash(&self.addr), mount, alias);
+
+            let response = fetchjson(
+                "GET",
+                &url,
+                &[("X-Vault-Token", self.token.as_str())],
+                None,
+            )?;
+
+            if 404 == response.status {
+                return Ok(None);
+            }
+
+            if 200 != response.status {
+                return Err(SekretoError::new(format!(
+                    "sekreto: boru serve error: {}: {}",
+                    response.status, url
+                )));
+            }
+
+            return Ok(textat(&response.body, &["data", "data", "value"]));
+        }
+
+        let alias = if self.namespace.is_empty() {
+            name.to_string()
+        } else {
+            format!("{}:{}", self.namespace, name)
+        };
+
+        let mut run = Command::new(&self.command);
+        run.args(["vault", "get", "--reveal", &alias]);
+
+        if !self.home.is_empty() {
+            run.env("BORU_HOME", &self.home);
+        }
+
+        let done = run.output().map_err(|err| {
+            SekretoError::new(format!("sekreto: cannot run {}: {}", self.command, err))
+        })?;
+
+        if done.status.success() {
+            // boru prints the value and one newline, and nothing else.
+            let out = String::from_utf8_lossy(&done.stdout).to_string();
+            return Ok(Some(
+                out.strip_suffix('\n').map(str::to_string).unwrap_or(out),
+            ));
+        }
+
+        let why = String::from_utf8_lossy(&done.stderr).trim().to_string();
+
+        // "no alias named" is boru saying it does not hold this secret, which
+        // is a miss: the chain carries on to the next provider. A locked vault
+        // or a wrong passphrase is not a miss - treating it as one would fall
+        // through to a weaker store without saying so.
+        if borumiss(&why) {
+            return Ok(None);
+        }
+
+        let reason = if why.is_empty() {
+            format!("exit {}", done.status.code().unwrap_or(-1))
+        } else {
+            why
+        };
+
+        Err(SekretoError::new(format!(
+            "sekreto: boru vault error: {}",
+            reason
+        )))
+    }
+
+    fn describe(&self) -> String {
+        if !self.addr.is_empty() {
+            return format!("boru:{}", trimslash(&self.addr));
+        }
+
+        if self.namespace.is_empty() {
+            "boru".to_string()
+        } else {
+            format!("boru:{}", self.namespace)
+        }
+    }
+}
+
+/// Does this boru failure mean "no such secret" rather than "I could not
+/// answer"? Matched on boru's own wording for a missing alias.
+fn borumiss(why: &str) -> bool {
+    why.contains("no alias named")
+}
+
+/// The `boru` kind, as a plugin definition.
+pub fn plugin() -> Definition {
+    providerplugin("boru", |spec| {
+        Ok(Rc::new(BoruProvider {
+            command: if spec.command.is_empty() {
+                "boru".to_string()
+            } else {
+                spec.command.clone()
+            },
+            namespace: spec.namespace.clone(),
+            home: spec.home.clone(),
+            addr: spec.addr.clone(),
+            token: spec.token.clone(),
+            mount: spec.mount.clone(),
+        }) as Rc<dyn Provider>)
+    })
+}