Skip to content

Conversation

c-r33d
Copy link
Contributor

@c-r33d c-r33d commented Jun 17, 2025

Proposed Changes

1.) Fix key cache to store KID with algo and kasURI. Fixes the issue where we would create a conjunction of the same key given the same algo and uri.
2.) Deprecate notice for WithDataAttributeValues
3.) Update some small BaseKey error handling
4.) Update Get method on the kas_client key cache to look for a key matching the algorithm and kas url if the kid is not defined.

Checklist

  • I have added or updated unit tests
  • I have added or updated integration tests (if appropriate)
  • I have added or updated documentation

Testing Instructions

Copy link
Contributor

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric Value
Approved Decision Requests 5000
Denied Decision Requests 0
Total Time 541.358573ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric Value
Approved Decision Requests 5000
Denied Decision Requests 0
Total Time 331.635854ms

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

Metric Value
Total Decrypts 100
Successful Decrypts 100
Failed Decrypts 0
Total Time 342.856589ms
Throughput 291.67 requests/second

TDF3 Benchmark Results:

Metric Value
Total Requests 5000
Successful Requests 5000
Failed Requests 0
Concurrent Requests 50
Total Time 36.713891693s
Average Latency 365.08705ms
Throughput 136.19 requests/second

NANOTDF Benchmark Results:

Metric Value
Total Requests 5000
Successful Requests 5000
Failed Requests 0
Concurrent Requests 50
Total Time 25.670789994s
Average Latency 255.959296ms
Throughput 194.77 requests/second

Copy link
Contributor

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric Value
Approved Decision Requests 5000
Denied Decision Requests 0
Total Time 532.203347ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric Value
Approved Decision Requests 5000
Denied Decision Requests 0
Total Time 327.919267ms

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

Metric Value
Total Decrypts 100
Successful Decrypts 100
Failed Decrypts 0
Total Time 340.670732ms
Throughput 293.54 requests/second

TDF3 Benchmark Results:

Metric Value
Total Requests 5000
Successful Requests 5000
Failed Requests 0
Concurrent Requests 50
Total Time 37.049937911s
Average Latency 367.922751ms
Throughput 134.95 requests/second

NANOTDF Benchmark Results:

Metric Value
Total Requests 5000
Successful Requests 5000
Failed Requests 0
Concurrent Requests 50
Total Time 26.097076214s
Average Latency 260.082357ms
Throughput 191.59 requests/second

Copy link
Contributor

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric Value
Approved Decision Requests 5000
Denied Decision Requests 0
Total Time 517.492188ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric Value
Approved Decision Requests 5000
Denied Decision Requests 0
Total Time 504.115731ms

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

Metric Value
Total Decrypts 100
Successful Decrypts 100
Failed Decrypts 0
Total Time 344.071571ms
Throughput 290.64 requests/second

TDF3 Benchmark Results:

Metric Value
Total Requests 5000
Successful Requests 5000
Failed Requests 0
Concurrent Requests 50
Total Time 36.164458968s
Average Latency 359.206102ms
Throughput 138.26 requests/second

NANOTDF Benchmark Results:

Metric Value
Total Requests 5000
Successful Requests 5000
Failed Requests 0
Concurrent Requests 50
Total Time 24.510476576s
Average Latency 244.205862ms
Throughput 203.99 requests/second

strantalis
strantalis previously approved these changes Jun 19, 2025
Copy link
Contributor

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric Value
Approved Decision Requests 5000
Denied Decision Requests 0
Total Time 532.055749ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric Value
Approved Decision Requests 5000
Denied Decision Requests 0
Total Time 338.423565ms

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

Metric Value
Total Decrypts 100
Successful Decrypts 100
Failed Decrypts 0
Total Time 342.563684ms
Throughput 291.92 requests/second

TDF3 Benchmark Results:

Metric Value
Total Requests 5000
Successful Requests 5000
Failed Requests 0
Concurrent Requests 50
Total Time 37.963303627s
Average Latency 377.813519ms
Throughput 131.71 requests/second

NANOTDF Benchmark Results:

Metric Value
Total Requests 5000
Successful Requests 5000
Failed Requests 0
Concurrent Requests 50
Total Time 26.639982674s
Average Latency 265.422597ms
Throughput 187.69 requests/second

Copy link
Contributor

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric Value
Approved Decision Requests 5000
Denied Decision Requests 0
Total Time 540.700626ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric Value
Approved Decision Requests 5000
Denied Decision Requests 0
Total Time 330.394516ms

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

Metric Value
Total Decrypts 100
Successful Decrypts 100
Failed Decrypts 0
Total Time 376.081846ms
Throughput 265.90 requests/second

TDF3 Benchmark Results:

Metric Value
Total Requests 5000
Successful Requests 5000
Failed Requests 0
Concurrent Requests 50
Total Time 37.332067488s
Average Latency 371.127773ms
Throughput 133.93 requests/second

NANOTDF Benchmark Results:

Metric Value
Total Requests 5000
Successful Requests 5000
Failed Requests 0
Concurrent Requests 50
Total Time 25.691841261s
Average Latency 255.947102ms
Throughput 194.61 requests/second

Copy link
Contributor

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric Value
Approved Decision Requests 5000
Denied Decision Requests 0
Total Time 545.590488ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric Value
Approved Decision Requests 5000
Denied Decision Requests 0
Total Time 337.595284ms

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

Metric Value
Total Decrypts 100
Successful Decrypts 100
Failed Decrypts 0
Total Time 350.410957ms
Throughput 285.38 requests/second

TDF3 Benchmark Results:

Metric Value
Total Requests 5000
Successful Requests 5000
Failed Requests 0
Concurrent Requests 50
Total Time 36.42553478s
Average Latency 362.214697ms
Throughput 137.27 requests/second

NANOTDF Benchmark Results:

Metric Value
Total Requests 5000
Successful Requests 5000
Failed Requests 0
Concurrent Requests 50
Total Time 25.302851505s
Average Latency 252.085349ms
Throughput 197.61 requests/second

Copy link
Contributor

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric Value
Approved Decision Requests 5000
Denied Decision Requests 0
Total Time 520.469861ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric Value
Approved Decision Requests 5000
Denied Decision Requests 0
Total Time 332.193735ms

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

Metric Value
Total Decrypts 100
Successful Decrypts 100
Failed Decrypts 0
Total Time 342.840677ms
Throughput 291.68 requests/second

TDF3 Benchmark Results:

Metric Value
Total Requests 5000
Successful Requests 5000
Failed Requests 0
Concurrent Requests 50
Total Time 37.46868873s
Average Latency 372.087099ms
Throughput 133.44 requests/second

NANOTDF Benchmark Results:

Metric Value
Total Requests 5000
Successful Requests 5000
Failed Requests 0
Concurrent Requests 50
Total Time 27.012454754s
Average Latency 269.108331ms
Throughput 185.10 requests/second

@c-r33d c-r33d enabled auto-merge June 23, 2025 14:28
Copy link
Contributor

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric Value
Approved Decision Requests 5000
Denied Decision Requests 0
Total Time 503.413897ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric Value
Approved Decision Requests 5000
Denied Decision Requests 0
Total Time 336.345291ms

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

Metric Value
Total Decrypts 100
Successful Decrypts 100
Failed Decrypts 0
Total Time 344.504722ms
Throughput 290.27 requests/second

TDF3 Benchmark Results:

Metric Value
Total Requests 5000
Successful Requests 5000
Failed Requests 0
Concurrent Requests 50
Total Time 36.97475004s
Average Latency 368.328018ms
Throughput 135.23 requests/second

NANOTDF Benchmark Results:

Metric Value
Total Requests 5000
Successful Requests 5000
Failed Requests 0
Concurrent Requests 50
Total Time 26.462195563s
Average Latency 263.875905ms
Throughput 188.95 requests/second

@c-r33d c-r33d added this pull request to the merge queue Jun 23, 2025
@github-merge-queue github-merge-queue bot removed this pull request from the merge queue due to failed status checks Jun 23, 2025
@c-r33d c-r33d added this pull request to the merge queue Jun 23, 2025
Merged via the queue into main with commit 7422b15 Jun 23, 2025
29 checks passed
@c-r33d c-r33d deleted the feat/DSPX-1266-key-splits-kids branch June 23, 2025 15:45
jakedoublev pushed a commit that referenced this pull request Jun 23, 2025
### Proposed Changes

1.) Fix key cache to store KID with algo and kasURI. Fixes the issue
where we would create a conjunction of the same key given the same algo
and uri.
2.) Deprecate notice for **WithDataAttributeValues**
3.) Update some small **BaseKey** error handling
4.) Update **Get** method on the kas_client key cache to look for a key
matching the algorithm and kas url if the kid is not defined.


### Checklist

- [ ] I have added or updated unit tests
- [ ] I have added or updated integration tests (if appropriate)
- [ ] I have added or updated documentation

### Testing Instructions
github-merge-queue bot pushed a commit that referenced this pull request Jun 23, 2025
🤖 I have created a release *beep* *boop*
---


##
[0.5.0](sdk/v0.4.7...sdk/v0.5.0)
(2025-06-23)


### Features

* add system metadata assertions to TDFConfig
([#2446](#2446))
([4eb9fff](4eb9fff))
* **core:** DSPX-608 - Deprecate public_client_id
([#2185](#2185))
([0f58efa](0f58efa))
* **sdk:** adds seeker interface to TDF Reader
([#2385](#2385))
([63ccd9a](63ccd9a))
* **sdk:** Allow key splits with same algo
([#2454](#2454))
([7422b15](7422b15))
* **sdk:** autoconfig kaos with kids
([#2438](#2438))
([c272016](c272016))
* **sdk:** Enable base key support.
([#2425](#2425))
([9ff3806](9ff3806))


### Bug Fixes

* **ci:** Fix intermittent failures from auth tests
([#2345](#2345))
([395988a](395988a))
* **deps:** bump github.com/opentdf/platform/protocol/go from 0.3.6 to
0.4.0 in /sdk ([#2397](#2397))
([99e3aa4](99e3aa4))
* **deps:** bump github.com/opentdf/platform/protocol/go from 0.4.0 to
0.5.0 in /sdk ([#2471](#2471))
([e8f97e0](e8f97e0))
* **deps:** bump the external group across 1 directory with 5 updates
([#2400](#2400))
([0b7ea79](0b7ea79))
* set consistent system metadata id and schema
([#2451](#2451))
([5db3cf2](5db3cf2))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: opentdf-automation[bot] <149537512+opentdf-automation[bot]@users.noreply.github.com>
github-merge-queue bot pushed a commit that referenced this pull request Aug 26, 2025
🤖 I have created a release *beep* *boop*
---


##
[0.7.0](sdk/v0.6.1...sdk/v0.7.0)
(2025-08-25)


### ⚠ BREAKING CHANGES

* **core:** Require go 1.23+
([#1979](#1979))

### Features

* add system metadata assertions to TDFConfig
([#2446](#2446))
([4eb9fff](4eb9fff))
* **authz:** authz v2 versioning implementation
([#2173](#2173))
([557fc21](557fc21))
* **core:** adds bulk rewrap to sdk and service
([#1835](#1835))
([11698ae](11698ae))
* **core:** Adds EC withSalt options
([#2126](#2126))
([67b6fb8](67b6fb8))
* **core:** Adds ErrInvalidPerSchema
([#1860](#1860))
([456639e](456639e))
* **core:** DSPX-608 - Deprecate public_client_id
([#2185](#2185))
([0f58efa](0f58efa))
* **core:** EXPERIMENTAL: EC-wrapped key support
([#1902](#1902))
([652266f](652266f))
* **core:** Expose version info
([#1841](#1841))
([92a9f5e](92a9f5e))
* **core:** Require go 1.23+
([#1979](#1979))
([164c922](164c922))
* **core:** v2 ERS with proto updates
([#2210](#2210))
([a161ef8](a161ef8))
* **policy:** actions service RPCs should actually hit storage layer
CRUD ([#2063](#2063))
([da4faf5](da4faf5))
* **policy:** Add list key mappings rpc.
([#2533](#2533))
([fbc2724](fbc2724))
* **policy:** adds new public keys table
([#1836](#1836))
([cad5048](cad5048))
* **policy:** Allow the deletion of a key.
([#2575](#2575))
([82b96f0](82b96f0))
* **policy:** Default Platform Keys
([#2254](#2254))
([d7447fe](d7447fe))
* **policy:** DSPX-902 NDR service crud implementation (2/2)
([#2066](#2066))
([030ad33](030ad33))
* **policy:** key management crud
([#2110](#2110))
([4c3d53d](4c3d53d))
* **sdk:** Add a KAS allowlist
([#2085](#2085))
([d7cfdf3](d7cfdf3))
* **sdk:** add nanotdf plaintext policy
([#2182](#2182))
([e5c56db](e5c56db))
* **sdk:** adds seeker interface to TDF Reader
([#2385](#2385))
([63ccd9a](63ccd9a))
* **sdk:** Allow key splits with same algo
([#2454](#2454))
([7422b15](7422b15))
* **sdk:** Allow schema validation during TDF decrypt
([#1870](#1870))
([b7e6fb2](b7e6fb2))
* **sdk:** autoconfig kaos with kids
([#2438](#2438))
([c272016](c272016))
* **sdk:** bump protocol/go v0.6.0
([#2536](#2536))
([23e4c2b](23e4c2b))
* **sdk:** CreateTDF option to run with specific target schema version
([#2045](#2045))
([0976b15](0976b15))
* **sdk:** Enable base key support.
([#2425](#2425))
([9ff3806](9ff3806))
* **sdk:** Expose connectrpc wrapper codegen for re-use
([#2322](#2322))
([8b29392](8b29392))
* **sdk:** MIC-1436: User can decrypt TDF files created with
FileWatcher2.0.8 and older.
([#1833](#1833))
([f77d110](f77d110))
* **sdk:** remove hex encoding for segment hash
([#1805](#1805))
([d7179c2](d7179c2))
* **sdk:** sdk.New should validate platform connectivity and provide
precise error ([#1937](#1937))
([aa3696d](aa3696d))
* **sdk:** Use ConnectRPC in the go client
([#2200](#2200))
([fc34ee6](fc34ee6))


### Bug Fixes

* Allow parsing IPs as hostnames
([#1999](#1999))
([d54b550](d54b550))
* **ci:** Fix intermittent failures from auth tests
([#2345](#2345))
([395988a](395988a))
* **ci:** Update expired ca and certs in oauth unit tests
([#2113](#2113))
([5440fcc](5440fcc))
* **core:** Autobump sdk
([#1863](#1863))
([855cb2b](855cb2b))
* **core:** Autobump sdk
([#1873](#1873))
([085ac7a](085ac7a))
* **core:** Autobump sdk
([#1894](#1894))
([201244e](201244e))
* **core:** Autobump sdk
([#1917](#1917))
([edeeb74](edeeb74))
* **core:** Autobump sdk
([#1941](#1941))
([0a5a948](0a5a948))
* **core:** Autobump sdk
([#1948](#1948))
([4dfb457](4dfb457))
* **core:** Autobump sdk
([#1968](#1968))
([7084061](7084061))
* **core:** Autobump sdk
([#1972](#1972))
([7258f5d](7258f5d))
* **core:** Autobump sdk
([#2102](#2102))
([0315635](0315635))
* **core:** Fixes protoJSON parse bug on ec rewrap
([#1943](#1943))
([9bebfd0](9bebfd0))
* **core:** Improves errors when under heavy load
([#2132](#2132))
([4490a14](4490a14))
* **core:** Update fixtures and flattening in sdk and service
([#1827](#1827))
([d6d6a7a](d6d6a7a))
* **core:** Updates ec-wrapped to newer salt
([#1961](#1961))
([0e17968](0e17968))
* **deps:** bump github.com/docker/docker from 28.2.2+incompatible to
28.3.3+incompatible in /sdk
([#2597](#2597))
([a68d00d](a68d00d))
* **deps:** bump github.com/opentdf/platform/lib/ocrypto from 0.2.0 to
0.3.0 in /sdk ([#2502](#2502))
([3ec8b35](3ec8b35))
* **deps:** bump github.com/opentdf/platform/protocol/go from 0.3.6 to
0.4.0 in /sdk ([#2397](#2397))
([99e3aa4](99e3aa4))
* **deps:** bump github.com/opentdf/platform/protocol/go from 0.4.0 to
0.5.0 in /sdk ([#2471](#2471))
([e8f97e0](e8f97e0))
* **deps:** bump github.com/opentdf/platform/protocol/go from 0.5.0 to
0.5.1 in /sdk ([#2505](#2505))
([4edab72](4edab72))
* **deps:** bump github.com/opentdf/platform/protocol/go from 0.6.0 to
0.6.2 in /sdk ([#2586](#2586))
([4ed9856](4ed9856))
* **deps:** bump github.com/opentdf/platform/protocol/go from 0.6.2 to
0.7.0 in /sdk ([#2627](#2627))
([e775e14](e775e14))
* **deps:** bump golang.org/x/oauth2 from 0.26.0 to 0.30.0 in /sdk
([#2252](#2252))
([9b775a2](9b775a2))
* **deps:** bump google.golang.org/grpc from 1.71.0 to 1.72.1 in /sdk
([#2244](#2244))
([49484e0](49484e0))
* **deps:** bump the external group across 1 directory with 5 updates
([#2400](#2400))
([0b7ea79](0b7ea79))
* **deps:** bump toolchain in /lib/fixtures and /examples to resolve CVE
GO-2025-3563 ([#2061](#2061))
([9c16843](9c16843))
* Improve http.Client usage for security and performance
([#1910](#1910))
([e6a53a3](e6a53a3))
* **sdk:** adds connection options to getPlatformConfiguration
([#2286](#2286))
([a3af31e](a3af31e))
* **sdk:** Allow reuse of session key
([#2016](#2016))
([d48c11e](d48c11e))
* **sdk:** bump lib/ocrypto to 0.1.8
([#1938](#1938))
([53fa8ab](53fa8ab))
* **sdk:** bump protocol/go module dependencies
([#2078](#2078))
([e027f43](e027f43))
* **sdk:** Display proper error on kas rewrap failure
([#2081](#2081))
([508cbcd](508cbcd))
* **sdk:** everything is `mixedSplits` now
([#1861](#1861))
([ba78f14](ba78f14))
* **sdk:** Fix compatibility between bulk and non-bulk rewrap
([#1914](#1914))
([74abbb6](74abbb6))
* **sdk:** Fixed token expiration time
([#1854](#1854))
([c3cda1b](c3cda1b))
* **sdk:** perfsprint lint issues
([#2208](#2208))
([d36a078](d36a078))
* **sdk:** Prefer KID and Algorithm selection from key maps
([#2475](#2475))
([98fd392](98fd392))
* **sdk:** Removes unnecessary down-cast of `int`
([#1869](#1869))
([66f0c14](66f0c14))
* **sdk:** Version config fix
([#1847](#1847))
([be5d817](be5d817))
* Service utilize `httputil.SafeHttpClient`
([#1926](#1926))
([af32700](af32700))
* set consistent system metadata id and schema
([#2451](#2451))
([5db3cf2](5db3cf2))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: opentdf-automation[bot] <149537512+opentdf-automation[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
comp:sdk A software development kit, including library, for client applications and inter-service communicati external-contributor External Org Member size/l
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants