feat(sdk): add nanotdf plaintext policy #2182

jrschumacher · 2025-05-06T23:20:23Z

Proposed Changes

Add nanotdf plaintext policy support
Default to plaintext policy to align with Base TDF

Checklist

I have added or updated unit tests
I have added or updated integration tests (if appropriate)
I have added or updated documentation

Testing Instructions

sdk/nanotdf_config.go

github-actions · 2025-05-06T23:24:36Z

Benchmark results, click to expand

Benchmark Results:

Metric	Value
Approved Decision Requests	5000
Denied Decision Requests	0
Total Time	463.261635ms

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	361.70975ms
Throughput	276.46 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	1m16.845186784s
Average Latency	766.519936ms
Throughput	65.07 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	0
Failed Requests	5000
Concurrent Requests	50
Total Time	53.127907554s
Throughput	0.00 requests/second

Error Summary:

Error Message	Occurrences
ReadNanoTDF error: getNanoRewrapKey: rewrapError: Error extracting policy: Error decrypting policy body:gcm.Open failed: cipher: message authentication failed	4938 occurrences
ReadNanoTDF error: getNanoRewrapKey: rewrapError: internal: internal error rpc error: code = Internal desc = could not perform access	62 occurrences

Standard Benchmark Metrics Skipped or Failed

Copilot

Pull Request Overview

This PR introduces support for a plaintext policy mode for NanoTDF, aligning with the Base TDF default behavior. Key changes include:

Adding a policyMode field and corresponding SetPolicyMode function to NanoTDFConfig.
Updating tests in sdk/nanotdf_test.go and sdk/nanotdf_config_test.go to cover both plaintext and encrypted policy modes.
Extending the command-line encryption example to accept a --plaintext-policy flag.

Reviewed Changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
sdk/nanotdf_test.go	Adds tests for creating embedded policies in both plaintext and encrypted modes.
sdk/nanotdf_config_test.go	Introduces tests for setting the policy mode, including handling of invalid values.
sdk/nanotdf_config.go	Inserts a new policyMode field with a default to plaintext and adds SetPolicyMode method.
sdk/nanotdf.go	Updates header-writing logic to use the new policy mode and adjusts the encryption flow.
examples/cmd/encrypt.go	Adds a new --plaintext-policy flag to toggle the plaintext policy mode in encryption.

Comments suppressed due to low confidence (1)

examples/cmd/encrypt.go:152

The method 'EnablePlaintextPolicy' is called but not defined in NanoTDFConfig; consider replacing it with 'SetPolicyMode(policyTypeEmbeddedPolicyPlainText)' to correctly enable plaintext policy mode.

nanoTDFConfig.EnablePlaintextPolicy()

sdk/nanotdf_test.go

github-actions · 2025-05-07T05:15:34Z

Benchmark results, click to expand

Benchmark Results:

Metric	Value
Approved Decision Requests	5000
Denied Decision Requests	0
Total Time	465.104819ms

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	394.501063ms
Throughput	253.48 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	1m17.424527666s
Average Latency	771.283194ms
Throughput	64.58 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	0
Failed Requests	5000
Concurrent Requests	50
Total Time	52.258654164s
Throughput	0.00 requests/second

Error Summary:

Error Message	Occurrences
ReadNanoTDF error: getNanoRewrapKey: rewrapError: Error extracting policy: Error decrypting policy body:gcm.Open failed: cipher: message authentication failed	4933 occurrences
ReadNanoTDF error: getNanoRewrapKey: rewrapError: internal: internal error rpc error: code = Internal desc = could not perform access	67 occurrences

Standard Benchmark Metrics Skipped or Failed

github-actions · 2025-05-07T05:23:33Z

Benchmark results, click to expand

Benchmark Results:

Metric	Value
Approved Decision Requests	5000
Denied Decision Requests	0
Total Time	459.843911ms

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	375.646625ms
Throughput	266.21 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	1m15.16040625s
Average Latency	749.565934ms
Throughput	66.52 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	0
Failed Requests	5000
Concurrent Requests	50
Total Time	51.327824497s
Throughput	0.00 requests/second

Error Summary:

Error Message	Occurrences
ReadNanoTDF error: getNanoRewrapKey: rewrapError: Error extracting policy: Error decrypting policy body:gcm.Open failed: cipher: message authentication failed	4939 occurrences
ReadNanoTDF error: getNanoRewrapKey: rewrapError: internal: internal error rpc error: code = Internal desc = could not perform access	61 occurrences

Standard Benchmark Metrics Skipped or Failed

jrschumacher · 2025-05-07T05:38:48Z

Looks like KAS doesn't support the plaintext body as defined in the spec https://github.com/opentdf/platform/blob/main/service/kas/access/rewrap.go#L878-L900

Co-authored-by: Copilot <[email protected]>

github-actions · 2025-05-07T05:48:07Z

Benchmark results, click to expand

Benchmark Results:

Metric	Value
Approved Decision Requests	5000
Denied Decision Requests	0
Total Time	473.798742ms

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	373.93434ms
Throughput	267.43 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	1m17.499153933s
Average Latency	772.972173ms
Throughput	64.52 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	0
Failed Requests	5000
Concurrent Requests	50
Total Time	53.53168086s
Throughput	0.00 requests/second

Error Summary:

Error Message	Occurrences
ReadNanoTDF error: getNanoRewrapKey: rewrapError: Error extracting policy: Error decrypting policy body:gcm.Open failed: cipher: message authentication failed	4948 occurrences
ReadNanoTDF error: getNanoRewrapKey: rewrapError: internal: internal error rpc error: code = Internal desc = could not perform access	52 occurrences

Standard Benchmark Metrics Skipped or Failed

github-actions · 2025-05-07T06:01:51Z

Benchmark results, click to expand

Benchmark Results:

Metric	Value
Approved Decision Requests	5000
Denied Decision Requests	0
Total Time	458.487279ms

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	358.694024ms
Throughput	278.79 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	1m16.272944515s
Average Latency	760.225332ms
Throughput	65.55 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	0
Failed Requests	5000
Concurrent Requests	50
Total Time	1m6.844329628s
Throughput	0.00 requests/second

Error Summary:

Error Message	Occurrences
ReadNanoTDF error: gcm.Open failed: cipher: message authentication failed	4948 occurrences
ReadNanoTDF error: getNanoRewrapKey: rewrapError: internal: internal error rpc error: code = Internal desc = could not perform access	52 occurrences

Standard Benchmark Metrics Skipped or Failed

sdk/nanotdf_policy.go

sdk/nanotdf_config.go

github-actions · 2025-05-07T17:44:48Z

Benchmark results, click to expand

Benchmark Results:

Metric	Value
Approved Decision Requests	5000
Denied Decision Requests	0
Total Time	469.86726ms

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	370.557638ms
Throughput	269.86 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	1m18.968968356s
Average Latency	787.559224ms
Throughput	63.32 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	0
Failed Requests	5000
Concurrent Requests	50
Total Time	1m8.538442552s
Throughput	0.00 requests/second

Error Summary:

Error Message	Occurrences
ReadNanoTDF error: gcm.Open failed: cipher: message authentication failed	4963 occurrences
ReadNanoTDF error: getNanoRewrapKey: rewrapError: internal: internal error rpc error: code = Internal desc = could not perform access	37 occurrences

Standard Benchmark Metrics Skipped or Failed

github-actions · 2025-05-07T18:45:05Z

Benchmark results, click to expand

Benchmark Results:

Metric	Value
Approved Decision Requests	5000
Denied Decision Requests	0
Total Time	449.387291ms

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	370.106105ms
Throughput	270.19 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	1m20.133148308s
Average Latency	798.181188ms
Throughput	62.40 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	0
Failed Requests	5000
Concurrent Requests	50
Total Time	1m8.178879933s
Throughput	0.00 requests/second

Error Summary:

Error Message	Occurrences
ReadNanoTDF error: gcm.Open failed: cipher: message authentication failed	4940 occurrences
ReadNanoTDF error: getNanoRewrapKey: rewrapError: internal: internal error rpc error: code = Internal desc = could not perform access	60 occurrences

Standard Benchmark Metrics Skipped or Failed

github-actions · 2025-05-07T18:52:38Z

Benchmark results, click to expand

Benchmark Results:

Metric	Value
Approved Decision Requests	5000
Denied Decision Requests	0
Total Time	455.730561ms

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	374.180296ms
Throughput	267.25 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	1m15.916942522s
Average Latency	757.395678ms
Throughput	65.86 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	0
Failed Requests	5000
Concurrent Requests	50
Total Time	1m5.477446454s
Throughput	0.00 requests/second

Error Summary:

Error Message	Occurrences
ReadNanoTDF error: getNanoRewrapKey: rewrapError: internal: internal error rpc error: code = Internal desc = could not perform access	58 occurrences
ReadNanoTDF error: gcm.Open failed: cipher: message authentication failed	4942 occurrences

Standard Benchmark Metrics Skipped or Failed

github-actions · 2025-05-09T19:38:55Z

Benchmark results, click to expand

Benchmark Results:

Metric	Value
Approved Decision Requests	5000
Denied Decision Requests	0
Total Time	448.626473ms

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	377.322807ms
Throughput	265.03 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	1m15.848200999s
Average Latency	755.508335ms
Throughput	65.92 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	4948
Failed Requests	52
Concurrent Requests	50
Total Time	1m5.993374466s
Average Latency	656.031121ms
Throughput	74.98 requests/second

Error Summary:

Error Message	Occurrences
ReadNanoTDF error: getNanoRewrapKey: rewrapError: internal: internal error rpc error: code = Internal desc = could not perform access	52 occurrences

Standard Benchmark Metrics Skipped or Failed

github-actions · 2025-05-09T19:46:03Z

Benchmark results, click to expand

Benchmark Results:

Metric	Value
Approved Decision Requests	5000
Denied Decision Requests	0
Total Time	494.339064ms

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	375.745144ms
Throughput	266.14 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	1m19.619185678s
Average Latency	793.863482ms
Throughput	62.80 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	4948
Failed Requests	52
Concurrent Requests	50
Total Time	1m10.404264997s
Average Latency	700.351926ms
Throughput	70.28 requests/second

Error Summary:

Error Message	Occurrences
ReadNanoTDF error: getNanoRewrapKey: rewrapError: internal: internal error rpc error: code = Internal desc = could not perform access	52 occurrences

Standard Benchmark Metrics Skipped or Failed

github-actions · 2025-05-09T21:29:26Z

Benchmark results, click to expand

Benchmark Results:

Metric	Value
Approved Decision Requests	5000
Denied Decision Requests	0
Total Time	469.329316ms

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	369.084178ms
Throughput	270.94 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	1m17.500616145s
Average Latency	772.427787ms
Throughput	64.52 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	4948
Failed Requests	52
Concurrent Requests	50
Total Time	1m8.590684489s
Average Latency	683.01033ms
Throughput	72.14 requests/second

Error Summary:

Error Message	Occurrences
ReadNanoTDF error: getNanoRewrapKey: rewrapError: internal: internal error rpc error: code = Internal desc = could not perform access	52 occurrences

Standard Benchmark Metrics Skipped or Failed

* Add nanotdf plaintext policy support * Default to plaintext policy to align with Base TDF - [ ] I have added or updated unit tests - [ ] I have added or updated integration tests (if appropriate) - [ ] I have added or updated documentation --------- Co-authored-by: Copilot <[email protected]>

🤖 I have created a release *beep* *boop* --- ## [0.4.5](sdk/v0.4.4...sdk/v0.4.5) (2025-05-22) ### Features * **authz:** authz v2 versioning implementation ([#2173](#2173)) ([557fc21](557fc21)) * **core:** Adds EC withSalt options ([#2126](#2126)) ([67b6fb8](67b6fb8)) * **core:** v2 ERS with proto updates ([#2210](#2210)) ([a161ef8](a161ef8)) * **policy:** key management crud ([#2110](#2110)) ([4c3d53d](4c3d53d)) * **sdk:** add nanotdf plaintext policy ([#2182](#2182)) ([e5c56db](e5c56db)) * **sdk:** Use ConnectRPC in the go client ([#2200](#2200)) ([fc34ee6](fc34ee6)) ### Bug Fixes * **core:** Improves errors when under heavy load ([#2132](#2132)) ([4490a14](4490a14)) * **deps:** bump golang.org/x/oauth2 from 0.26.0 to 0.30.0 in /sdk ([#2252](#2252)) ([9b775a2](9b775a2)) * **deps:** bump google.golang.org/grpc from 1.71.0 to 1.72.1 in /sdk ([#2244](#2244)) ([49484e0](49484e0)) * **sdk:** adds connection options to getPlatformConfiguration ([#2286](#2286)) ([a3af31e](a3af31e)) * **sdk:** perfsprint lint issues ([#2208](#2208)) ([d36a078](d36a078)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: opentdf-automation[bot] <149537512+opentdf-automation[bot]@users.noreply.github.com> Co-authored-by: Elizabeth Healy <[email protected]>

🤖 I have created a release *beep* *boop* --- ## [0.5.3](service/v0.5.2...service/v0.5.3) (2025-05-22) ### Features * **authz:** authz v2 versioning implementation ([#2173](#2173)) ([557fc21](557fc21)) * **authz:** authz v2, ers v2 protos and gencode for ABAC with actions & registered resource ([#2124](#2124)) ([ea7992a](ea7992a)) * **authz:** export entity id prefix constant from entity instead of authorization service v1 ([#2261](#2261)) ([94079a9](94079a9)) * **authz:** subject mapping plugin support for ABAC with actions ([#2223](#2223)) ([d08b939](d08b939)) * bulk keycloak provisioning ([#2205](#2205)) ([59e4485](59e4485)) * **core:** add otel to opentdf services ([#1858](#1858)) ([53a7aa0](53a7aa0)) * **core:** Adds EC withSalt options ([#2126](#2126)) ([67b6fb8](67b6fb8)) * **core:** enhance db configuration options ([#2285](#2285)) ([ed9ff59](ed9ff59)) * **core:** New Key Index and Manager Plugin SPI ([#2095](#2095)) ([eb446fc](eb446fc)) * **core:** support onConfigUpdate hook when registering services ([#1992](#1992)) ([366d4dc](366d4dc)) * **core:** v2 ERS with proto updates ([#2210](#2210)) ([a161ef8](a161ef8)) * **policy:** actions crud service endpoints and proto validation ([#2037](#2037)) ([e933fa9](e933fa9)) * **policy:** actions service RPCs should actually hit storage layer CRUD ([#2063](#2063)) ([da4faf5](da4faf5)) * **policy:** add enhanced standard/custom actions protos ([#2020](#2020)) ([bbac53f](bbac53f)) * **policy:** Add platform key indexer. ([#2189](#2189)) ([861ef8d](861ef8d)) * **policy:** consume lib/identifier parse function ([#2181](#2181)) ([1cef22b](1cef22b)) * **policy:** DSPX-1018 NDR retrieval by FQN support ([#2131](#2131)) ([0001041](0001041)) * **policy:** DSPX-1057 registered resource action attribute values (DB + Service implementation) ([#2191](#2191)) ([6bf1b2e](6bf1b2e)) * **policy:** DSPX-1057 registered resource action attribute values (protos only) ([#2217](#2217)) ([6375596](6375596)) * **policy:** DSPX-893 NDR define crud protos ([#2056](#2056)) ([55a5c27](55a5c27)) * **policy:** DSPX-898 NDR database schema ([#2055](#2055)) ([2a10a6a](2a10a6a)) * **policy:** DSPX-901 NDR database crud ([#2071](#2071)) ([20e0a5f](20e0a5f)) * **policy:** DSPX-902 NDR service crud implementation (2/2) ([#2066](#2066)) ([030ad33](030ad33)) * **policy:** DSPX-902 NDR service crud protos only (1/2) ([#2092](#2092)) ([24b6cb5](24b6cb5)) * **policy:** Finish resource mapping groups ([#2224](#2224)) ([5ff754e](5ff754e)) * **policy:** GetMatchedSubjectMappings should provide value FQN ([#2151](#2151)) ([ad80044](ad80044)) * **policy:** key management crud ([#2110](#2110)) ([4c3d53d](4c3d53d)) * **policy:** Key management proto ([#2115](#2115)) ([561f853](561f853)) * **policy:** Modify get request to search for keys by kasid with keyid. ([#2147](#2147)) ([780d2e4](780d2e4)) * **policy:** Restrict KAS deletion when tied to Key ([#2144](#2144)) ([4c4ab13](4c4ab13)) * **policy:** Return KAS Key structure ([#2172](#2172)) ([7f97b99](7f97b99)) * **policy:** rotate keys rpc ([#2180](#2180)) ([0d00743](0d00743)) * **policy:** stored enhanced actions database migration, CRUD queries, SM updates ([#2040](#2040)) ([e6b7c79](e6b7c79)) * **sdk:** Add a KAS allowlist ([#2085](#2085)) ([d7cfdf3](d7cfdf3)) * **sdk:** add nanotdf plaintext policy ([#2182](#2182)) ([e5c56db](e5c56db)) * **sdk:** Use ConnectRPC in the go client ([#2200](#2200)) ([fc34ee6](fc34ee6)) ### Bug Fixes * **core:** access pdp cleanup before actions in ABAC decisioning ([#2123](#2123)) ([9b38a3c](9b38a3c)) * **core:** Autobump service ([#2080](#2080)) ([006c724](006c724)) * **core:** Autobump service ([#2104](#2104)) ([1f72cc7](1f72cc7)) * **core:** Autobump service ([#2108](#2108)) ([be5b7d7](be5b7d7)) * **core:** bump to go 1.24 and bump service proto module dependencies ([#2064](#2064)) ([94891a0](94891a0)) * **core:** Fix DPoP with grpc-gateway ([#2044](#2044)) ([4483ef2](4483ef2)) * **core:** fix service go.mod ([#2141](#2141)) ([3b98f6d](3b98f6d)) * **core:** Improves errors when under heavy load ([#2132](#2132)) ([4490a14](4490a14)) * **core:** Let legacy KAOs use new trust plugins ([#2218](#2218)) ([5aa6916](5aa6916)) * **core:** migrate from mitchellh/mapstructure to go-viper/mapstructure ([#2087](#2087)) ([0a3a82e](0a3a82e)) * **core:** update viper to 1.20.1 ([#2088](#2088)) ([09099e9](09099e9)) * **core:** Updates vulnerable dep go/x/net ([#2072](#2072)) ([11c02cd](11c02cd)) * **deps:** bump github.com/creasty/defaults from 1.7.0 to 1.8.0 in /service ([#2242](#2242)) ([86a9b46](86a9b46)) * **deps:** bump github.com/jackc/pgx/v5 from 5.5.5 to 5.7.5 in /service ([#2249](#2249)) ([d8f3b67](d8f3b67)) * **deps:** bump the internal group across 1 directory with 2 updates ([#2296](#2296)) ([7f92c70](7f92c70)) * **deps:** bump toolchain in /lib/fixtures and /examples to resolve CVE GO-2025-3563 ([#2061](#2061)) ([9c16843](9c16843)) * handle empty private and public key ctx structs ([#2272](#2272)) ([f3fc647](f3fc647)) * **policy:** remove predefined rules in actions protos ([#2069](#2069)) ([060f059](060f059)) * **policy:** return kas uri on keys for definition, namespace and values ([#2186](#2186)) ([6c55fb8](6c55fb8)) * update key_mode to provide more context ([#2226](#2226)) ([44d0805](44d0805)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: opentdf-automation[bot] <149537512+opentdf-automation[bot]@users.noreply.github.com>

🤖 I have created a release *beep* *boop* --- ## [0.7.0](sdk/v0.6.1...sdk/v0.7.0) (2025-08-25) ### ⚠ BREAKING CHANGES * **core:** Require go 1.23+ ([#1979](#1979)) ### Features * add system metadata assertions to TDFConfig ([#2446](#2446)) ([4eb9fff](4eb9fff)) * **authz:** authz v2 versioning implementation ([#2173](#2173)) ([557fc21](557fc21)) * **core:** adds bulk rewrap to sdk and service ([#1835](#1835)) ([11698ae](11698ae)) * **core:** Adds EC withSalt options ([#2126](#2126)) ([67b6fb8](67b6fb8)) * **core:** Adds ErrInvalidPerSchema ([#1860](#1860)) ([456639e](456639e)) * **core:** DSPX-608 - Deprecate public_client_id ([#2185](#2185)) ([0f58efa](0f58efa)) * **core:** EXPERIMENTAL: EC-wrapped key support ([#1902](#1902)) ([652266f](652266f)) * **core:** Expose version info ([#1841](#1841)) ([92a9f5e](92a9f5e)) * **core:** Require go 1.23+ ([#1979](#1979)) ([164c922](164c922)) * **core:** v2 ERS with proto updates ([#2210](#2210)) ([a161ef8](a161ef8)) * **policy:** actions service RPCs should actually hit storage layer CRUD ([#2063](#2063)) ([da4faf5](da4faf5)) * **policy:** Add list key mappings rpc. ([#2533](#2533)) ([fbc2724](fbc2724)) * **policy:** adds new public keys table ([#1836](#1836)) ([cad5048](cad5048)) * **policy:** Allow the deletion of a key. ([#2575](#2575)) ([82b96f0](82b96f0)) * **policy:** Default Platform Keys ([#2254](#2254)) ([d7447fe](d7447fe)) * **policy:** DSPX-902 NDR service crud implementation (2/2) ([#2066](#2066)) ([030ad33](030ad33)) * **policy:** key management crud ([#2110](#2110)) ([4c3d53d](4c3d53d)) * **sdk:** Add a KAS allowlist ([#2085](#2085)) ([d7cfdf3](d7cfdf3)) * **sdk:** add nanotdf plaintext policy ([#2182](#2182)) ([e5c56db](e5c56db)) * **sdk:** adds seeker interface to TDF Reader ([#2385](#2385)) ([63ccd9a](63ccd9a)) * **sdk:** Allow key splits with same algo ([#2454](#2454)) ([7422b15](7422b15)) * **sdk:** Allow schema validation during TDF decrypt ([#1870](#1870)) ([b7e6fb2](b7e6fb2)) * **sdk:** autoconfig kaos with kids ([#2438](#2438)) ([c272016](c272016)) * **sdk:** bump protocol/go v0.6.0 ([#2536](#2536)) ([23e4c2b](23e4c2b)) * **sdk:** CreateTDF option to run with specific target schema version ([#2045](#2045)) ([0976b15](0976b15)) * **sdk:** Enable base key support. ([#2425](#2425)) ([9ff3806](9ff3806)) * **sdk:** Expose connectrpc wrapper codegen for re-use ([#2322](#2322)) ([8b29392](8b29392)) * **sdk:** MIC-1436: User can decrypt TDF files created with FileWatcher2.0.8 and older. ([#1833](#1833)) ([f77d110](f77d110)) * **sdk:** remove hex encoding for segment hash ([#1805](#1805)) ([d7179c2](d7179c2)) * **sdk:** sdk.New should validate platform connectivity and provide precise error ([#1937](#1937)) ([aa3696d](aa3696d)) * **sdk:** Use ConnectRPC in the go client ([#2200](#2200)) ([fc34ee6](fc34ee6)) ### Bug Fixes * Allow parsing IPs as hostnames ([#1999](#1999)) ([d54b550](d54b550)) * **ci:** Fix intermittent failures from auth tests ([#2345](#2345)) ([395988a](395988a)) * **ci:** Update expired ca and certs in oauth unit tests ([#2113](#2113)) ([5440fcc](5440fcc)) * **core:** Autobump sdk ([#1863](#1863)) ([855cb2b](855cb2b)) * **core:** Autobump sdk ([#1873](#1873)) ([085ac7a](085ac7a)) * **core:** Autobump sdk ([#1894](#1894)) ([201244e](201244e)) * **core:** Autobump sdk ([#1917](#1917)) ([edeeb74](edeeb74)) * **core:** Autobump sdk ([#1941](#1941)) ([0a5a948](0a5a948)) * **core:** Autobump sdk ([#1948](#1948)) ([4dfb457](4dfb457)) * **core:** Autobump sdk ([#1968](#1968)) ([7084061](7084061)) * **core:** Autobump sdk ([#1972](#1972)) ([7258f5d](7258f5d)) * **core:** Autobump sdk ([#2102](#2102)) ([0315635](0315635)) * **core:** Fixes protoJSON parse bug on ec rewrap ([#1943](#1943)) ([9bebfd0](9bebfd0)) * **core:** Improves errors when under heavy load ([#2132](#2132)) ([4490a14](4490a14)) * **core:** Update fixtures and flattening in sdk and service ([#1827](#1827)) ([d6d6a7a](d6d6a7a)) * **core:** Updates ec-wrapped to newer salt ([#1961](#1961)) ([0e17968](0e17968)) * **deps:** bump github.com/docker/docker from 28.2.2+incompatible to 28.3.3+incompatible in /sdk ([#2597](#2597)) ([a68d00d](a68d00d)) * **deps:** bump github.com/opentdf/platform/lib/ocrypto from 0.2.0 to 0.3.0 in /sdk ([#2502](#2502)) ([3ec8b35](3ec8b35)) * **deps:** bump github.com/opentdf/platform/protocol/go from 0.3.6 to 0.4.0 in /sdk ([#2397](#2397)) ([99e3aa4](99e3aa4)) * **deps:** bump github.com/opentdf/platform/protocol/go from 0.4.0 to 0.5.0 in /sdk ([#2471](#2471)) ([e8f97e0](e8f97e0)) * **deps:** bump github.com/opentdf/platform/protocol/go from 0.5.0 to 0.5.1 in /sdk ([#2505](#2505)) ([4edab72](4edab72)) * **deps:** bump github.com/opentdf/platform/protocol/go from 0.6.0 to 0.6.2 in /sdk ([#2586](#2586)) ([4ed9856](4ed9856)) * **deps:** bump github.com/opentdf/platform/protocol/go from 0.6.2 to 0.7.0 in /sdk ([#2627](#2627)) ([e775e14](e775e14)) * **deps:** bump golang.org/x/oauth2 from 0.26.0 to 0.30.0 in /sdk ([#2252](#2252)) ([9b775a2](9b775a2)) * **deps:** bump google.golang.org/grpc from 1.71.0 to 1.72.1 in /sdk ([#2244](#2244)) ([49484e0](49484e0)) * **deps:** bump the external group across 1 directory with 5 updates ([#2400](#2400)) ([0b7ea79](0b7ea79)) * **deps:** bump toolchain in /lib/fixtures and /examples to resolve CVE GO-2025-3563 ([#2061](#2061)) ([9c16843](9c16843)) * Improve http.Client usage for security and performance ([#1910](#1910)) ([e6a53a3](e6a53a3)) * **sdk:** adds connection options to getPlatformConfiguration ([#2286](#2286)) ([a3af31e](a3af31e)) * **sdk:** Allow reuse of session key ([#2016](#2016)) ([d48c11e](d48c11e)) * **sdk:** bump lib/ocrypto to 0.1.8 ([#1938](#1938)) ([53fa8ab](53fa8ab)) * **sdk:** bump protocol/go module dependencies ([#2078](#2078)) ([e027f43](e027f43)) * **sdk:** Display proper error on kas rewrap failure ([#2081](#2081)) ([508cbcd](508cbcd)) * **sdk:** everything is `mixedSplits` now ([#1861](#1861)) ([ba78f14](ba78f14)) * **sdk:** Fix compatibility between bulk and non-bulk rewrap ([#1914](#1914)) ([74abbb6](74abbb6)) * **sdk:** Fixed token expiration time ([#1854](#1854)) ([c3cda1b](c3cda1b)) * **sdk:** perfsprint lint issues ([#2208](#2208)) ([d36a078](d36a078)) * **sdk:** Prefer KID and Algorithm selection from key maps ([#2475](#2475)) ([98fd392](98fd392)) * **sdk:** Removes unnecessary down-cast of `int` ([#1869](#1869)) ([66f0c14](66f0c14)) * **sdk:** Version config fix ([#1847](#1847)) ([be5d817](be5d817)) * Service utilize `httputil.SafeHttpClient` ([#1926](#1926)) ([af32700](af32700)) * set consistent system metadata id and schema ([#2451](#2451)) ([5db3cf2](5db3cf2)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: opentdf-automation[bot] <149537512+opentdf-automation[bot]@users.noreply.github.com>

jrschumacher requested review from a team as code owners May 6, 2025 23:20

jrschumacher commented May 6, 2025

View reviewed changes

sdk/nanotdf_config.go Outdated Show resolved Hide resolved

jakedoublev requested a review from Copilot May 6, 2025 23:36

Copilot AI reviewed May 6, 2025

View reviewed changes

sdk/nanotdf_test.go Outdated Show resolved Hide resolved

jrschumacher commented May 7, 2025

View reviewed changes

sdk/nanotdf_test.go Outdated Show resolved Hide resolved

jrschumacher and others added 7 commits May 7, 2025 00:43

feat(sdk): add nanotdf plaintext policy

7aa28ef

Remove unneeded method

e95c094

refine tests

75dfc59

Update sdk/nanotdf_test.go

c22eb37

Co-authored-by: Copilot <[email protected]>

Update sdk/nanotdf_test.go

040641d

refactor

bd35f03

Fix errors

a6f9976

jrschumacher force-pushed the iss1278-add-nanotdf-plaintext branch from b04219d to a6f9976 Compare May 7, 2025 05:43

Add support for plaintext nanotdf

18bcc4d

jrschumacher requested a review from a team as a code owner May 7, 2025 05:57

dmihalcik-virtru previously approved these changes May 7, 2025

View reviewed changes

sdk/nanotdf_policy.go Outdated Show resolved Hide resolved

dmihalcik-virtru reviewed May 7, 2025

View reviewed changes

sdk/nanotdf_config.go Outdated Show resolved Hide resolved

Address concerns

ce0b6e2

jrschumacher dismissed dmihalcik-virtru’s stale review via ce0b6e2 May 7, 2025 17:40

jrschumacher added 2 commits May 7, 2025 13:40

Fix lint issue.

4b0964a

Fix lint again

aab15af

Fix lint yet again

7950a8d

Fix defect gen sym key

6b14990

Set default to encrypted

862e43d

Update tests

0d18ccd

dmihalcik-virtru self-requested a review May 9, 2025 21:59

dmihalcik-virtru approved these changes May 9, 2025

View reviewed changes

jrschumacher enabled auto-merge May 9, 2025 22:05

jrschumacher linked an issue May 9, 2025 that may be closed by this pull request

Add plaintext support for NanoTDF within the SDK #2178

Closed

This was referenced May 9, 2025

Add support for NanoTDF plaintext policy opentdf/web-sdk#591

Open

Add support for NanoTDF plaintext policy opentdf/java-sdk#255

Open

strantalis approved these changes May 9, 2025

View reviewed changes

jrschumacher added this pull request to the merge queue May 9, 2025

Merged via the queue into main with commit e5c56db May 10, 2025
27 checks passed

jrschumacher deleted the iss1278-add-nanotdf-plaintext branch May 10, 2025 00:03

This was referenced May 10, 2025

chore(main): release sdk 0.4.5 #2133

Merged

chore(main): release service 0.5.3 #2046

Merged

opentdf-automation bot mentioned this pull request Jul 29, 2025

chore(main): release sdk 0.7.0 #2589

Merged

feat(sdk): add nanotdf plaintext policy #2182

feat(sdk): add nanotdf plaintext policy #2182

Uh oh!

Conversation

jrschumacher commented May 6, 2025

Proposed Changes

Checklist

Testing Instructions

Uh oh!

Uh oh!

github-actions bot commented May 6, 2025

Benchmark Results:

Bulk Benchmark Results

TDF3 Benchmark Results:

NANOTDF Benchmark Results:

Error Summary:

Standard Benchmark Metrics Skipped or Failed

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Uh oh!

Uh oh!

github-actions bot commented May 7, 2025

Benchmark Results:

Bulk Benchmark Results

TDF3 Benchmark Results:

NANOTDF Benchmark Results:

Error Summary:

Standard Benchmark Metrics Skipped or Failed

Uh oh!

github-actions bot commented May 7, 2025

Benchmark Results:

Bulk Benchmark Results

TDF3 Benchmark Results:

NANOTDF Benchmark Results:

Error Summary:

Standard Benchmark Metrics Skipped or Failed

Uh oh!

jrschumacher commented May 7, 2025

Uh oh!

github-actions bot commented May 7, 2025

Benchmark Results:

Bulk Benchmark Results

TDF3 Benchmark Results:

NANOTDF Benchmark Results:

Error Summary:

Standard Benchmark Metrics Skipped or Failed

Uh oh!

github-actions bot commented May 7, 2025

Benchmark Results:

Bulk Benchmark Results

TDF3 Benchmark Results:

NANOTDF Benchmark Results:

Error Summary:

Standard Benchmark Metrics Skipped or Failed

Uh oh!

Uh oh!

Uh oh!

github-actions bot commented May 7, 2025

Benchmark Results:

Bulk Benchmark Results

TDF3 Benchmark Results:

NANOTDF Benchmark Results:

Error Summary:

Standard Benchmark Metrics Skipped or Failed

Uh oh!

github-actions bot commented May 7, 2025

Benchmark Results:

Bulk Benchmark Results

TDF3 Benchmark Results:

NANOTDF Benchmark Results:

Error Summary:

Standard Benchmark Metrics Skipped or Failed

Uh oh!

github-actions bot commented May 7, 2025

Benchmark Results:

Bulk Benchmark Results