openjd-rs

A Rust implementation of the Open Job Description specification — model library, expression language, sessions runtime, job attachments snapshots, and CLI.

Crates

Crate	Status	Description
openjd-expr	Beta	Expression language: type system, ruff-based parser, bounded evaluator, range expressions, path mapping
openjd-model	Beta	Core library: template parsing, validation, job creation, parameter spaces, step dependency graphs
openjd-sessions	Beta	Session runtime: async action execution, environment lifecycle, cross-user subprocess management, structured logging
openjd-snapshots	Experimental	Job attachments: content-addressed file tree snapshots, xxHash3 hashing, manifest diffing, S3 upload/download
openjd-cli	Beta	CLI binary (openjd): check and run commands
openjd-for-js	Experimental	ECMAScript/WebAssembly bindings for openjd-model and openjd-expr

The "Beta" crates are released to crates.io via release-plz. They are still on the 0.x version line, so breaking changes are possible in minor-version bumps per Cargo's pre-1.0 semver rules. The experimental crates are under active development and their public APIs may change without notice. For openjd-snapshots, the v2025 on-disk manifest format is a draft — the v2023 format is what AWS Deadline Cloud uses and is stable. openjd-for-js is built as an npm package and is not on crates.io.

Building

cargo build --release

Usage

# Validate a template
./target/release/openjd check path/to/template.yaml

# Run a job template locally
./target/release/openjd run path/to/template.yaml -p Key=Value
./target/release/openjd run path/to/template.yaml -p file://params.yaml

Testing

Unit tests

# All crates
cargo test --workspace

# Single crate
cargo test -p openjd-sessions

The workspace has 5,300+ unit and integration tests across all crates.

Cross-user tests (Docker)

Cross-user subprocess execution (via sudo) requires a multi-user Linux environment. Docker containers provide this:

# Local users (primary)
scripts/run_cross_user_tests.sh

# LDAP-managed users (validates NSS/PAM integration)
scripts/run_cross_user_tests.sh --ldap

This runs 12 cross-user tests covering subprocess execution, signal delivery (SIGTERM/SIGKILL), process tree killing, session cleanup, and TempDir permissions. See the proposal for details.

Code coverage

scripts/coverage.sh

Current coverage: 87.3% line coverage (see COVERAGE_REPORT.md).

Conformance

Passes 100% of the OpenJD conformance test suite (1,038 tests on Linux):

Category	Tests
Template validation (base)	444
Template validation (EXPR)	202
Template validation (FEATURE_BUNDLE_1)	36
Template validation (TASK_CHUNKING)	11
Environment template validation	31
Job execution (base)	163
Job execution (EXPR)	123
Job execution (FEATURE_BUNDLE_1)	13
Job execution (TASK_CHUNKING)	7
Job execution (REDACTED_ENV_VARS)	8
Total	1,038

Architecture

The crate dependency graph:

openjd-cli
├── openjd-sessions
│   ├── openjd-model
│   │   └── openjd-expr
│   └── openjd-expr
└── openjd-model

openjd-snapshots (standalone)

Design documents are in specs/:

Document	Topic
architecture.md	Overall crate structure and design
sessions-architecture.md	Sessions runtime async design
action-message-streaming.md	Real-time stdout message streaming
parsing-walkthrough.md	Template parsing pipeline
template-validation.md	Validation rules and error reporting
model-parameters.md	Parameter type system
job-creation.md	Job instantiation from templates
format-string.md	Format string resolution
expr-implementation.md	Expression language implementation
function-library.md	Built-in function library
job-attachments-snapshots.md	Snapshot file format and operations

Security

We take all security reports seriously. When we receive such reports, we will investigate and subsequently address any potential vulnerabilities as quickly as possible. If you discover a potential security issue in this project, please notify AWS/Amazon Security via our vulnerability reporting page or directly via email to AWS Security. Please do not create a public GitHub issue in this project.

License

This project is licensed under the Apache-2.0 License or the MIT License, at your option.