From 15a22cef494ff8b25be6851356fe0d1c98f7aded Mon Sep 17 00:00:00 2001 From: b-long Date: Sat, 31 Oct 2026 22:05:54 -0400 Subject: [PATCH 1/4] upgrade OpenTDF platform from v0.8.1 to v0.15.0 --- .github/docker-compose.platform.env | 9 +++++---- .github/docker-compose.platform.override.yaml | 5 +---- 2 files changed, 6 insertions(+), 8 deletions(-) diff --git a/.github/docker-compose.platform.env b/.github/docker-compose.platform.env index 45d2f69..20ee15a 100644 --- a/.github/docker-compose.platform.env +++ b/.github/docker-compose.platform.env @@ -2,7 +2,8 @@ # docker-compose.platform.override.yaml. Passed to `docker compose` via # --env-file so PLATFORM_VERSION only has to be declared once. # -# NanoTDF rewrap (kas ec rewrap) breaks against every platform release -# newer than this that was tried (v0.16.0 through :nightly), so we're -# pinned here for now -- see issue #26. -PLATFORM_VERSION=v0.8.1 +# v0.15.0 is the newest platform release whose opentdf-example.yaml does not +# reference hybrid post-quantum KAS keys. Newer releases need +# generate-pqc-keys (see docker-compose.platform.override.yaml) to actually +# run, so the remaining bump is tracked separately -- see issue #182. +PLATFORM_VERSION=v0.15.0 diff --git a/.github/docker-compose.platform.override.yaml b/.github/docker-compose.platform.override.yaml index 95822ac..9d4b0f8 100644 --- a/.github/docker-compose.platform.override.yaml +++ b/.github/docker-compose.platform.override.yaml @@ -6,10 +6,7 @@ # from the SAME git tag as the platform image (docker-compose.platform.yaml # already pins the image itself to PLATFORM_VERSION, declared once in # docker-compose.platform.env -- pass that file via `docker compose -# --env-file`). NanoTDF rewrap (kas ec rewrap) breaks against every -# platform release newer than that tag was tried against (v0.16.0 through -# :nightly), independent of otdfctl/SDK version, so everything is pinned -# for now. +# --env-file`). # - The Keycloak provisioning data (download-keycloak-data below) is also # patched with `directAccessGrantsEnabled: true` on the "opentdf" client # via `yq`, which our integration tests need for the OAuth2 password grant From df2bd9561ac0d5d8f002434fa6cedb81944613e6 Mon Sep 17 00:00:00 2001 From: b-long Date: Sat, 31 Oct 2026 22:21:07 -0400 Subject: [PATCH 2/4] upgrade OpenTDF platform from v0.15.0 to v0.16.0 --- .github/docker-compose.platform.env | 8 ++--- .github/docker-compose.platform.override.yaml | 33 ++++++++++++------- 2 files changed, 25 insertions(+), 16 deletions(-) diff --git a/.github/docker-compose.platform.env b/.github/docker-compose.platform.env index 20ee15a..e057715 100644 --- a/.github/docker-compose.platform.env +++ b/.github/docker-compose.platform.env @@ -2,8 +2,6 @@ # docker-compose.platform.override.yaml. Passed to `docker compose` via # --env-file so PLATFORM_VERSION only has to be declared once. # -# v0.15.0 is the newest platform release whose opentdf-example.yaml does not -# reference hybrid post-quantum KAS keys. Newer releases need -# generate-pqc-keys (see docker-compose.platform.override.yaml) to actually -# run, so the remaining bump is tracked separately -- see issue #182. -PLATFORM_VERSION=v0.15.0 +# Matches the default proto GIT_TAG (service/v0.16.0) used by +# packages/otdf-python-proto/scripts/generate_connect_proto.py. +PLATFORM_VERSION=v0.16.0 diff --git a/.github/docker-compose.platform.override.yaml b/.github/docker-compose.platform.override.yaml index 9d4b0f8..545e2a0 100644 --- a/.github/docker-compose.platform.override.yaml +++ b/.github/docker-compose.platform.override.yaml @@ -23,13 +23,8 @@ # - Every file the base compose file fetches from opentdf/platform@main is # repinned here to the same git tag as PLATFORM_VERSION (`service/`), # so nothing in this pipeline tracks main unpinned -- see download-init-script -# below. The one exception is generate-pqc-keys: the PQC keygen tool -# (service/cmd/keygen) doesn't exist yet at service/${PLATFORM_VERSION}, and -# the opentdf.yaml pinned to that tag only references the RSA/EC keys that -# generate-keys already creates, not PQC/hybrid ones -- so its output isn't -# consumed at this pin. It's turned into a no-op below instead of being -# pointed at a ref that doesn't have the tool. Revisit both when -# PLATFORM_VERSION is next bumped. +# below. That includes generate-pqc-keys, which builds the hybrid PQC KAS +# keys referenced by opentdf.yaml from service/cmd/keygen at the same tag. services: download-platform-config: command: ['wget', '-O', '/configs/opentdf.yaml', 'https://raw.githubusercontent.com/opentdf/platform/service/${PLATFORM_VERSION}/opentdf-example.yaml'] @@ -48,13 +43,29 @@ services: wget -O /configs/init-temp-keys.sh 'https://raw.githubusercontent.com/opentdf/platform/service/${PLATFORM_VERSION}/.github/scripts/init-temp-keys.sh' generate-pqc-keys: - image: alpine:3.23 - entrypoint: /bin/sh + # Same as the base service, except the sparse checkout is pulled from + # service/${PLATFORM_VERSION} instead of main. command: - -c - | - echo "Skipping PQC key generation: service/cmd/keygen doesn't exist at service/${PLATFORM_VERSION}, and its output isn't referenced by opentdf.yaml at that pin." - restart: "no" + set -e + apk add --no-cache git + WORKDIR=$$(mktemp -d) + cd "$$WORKDIR" + git init -q + git remote add origin https://github.com/opentdf/platform.git + git config core.sparseCheckout true + echo "lib/" >> .git/info/sparse-checkout + echo "service/cmd/keygen/" >> .git/info/sparse-checkout + echo "service/go.mod" >> .git/info/sparse-checkout + echo "service/go.sum" >> .git/info/sparse-checkout + echo "protocol/" >> .git/info/sparse-checkout + echo "sdk/" >> .git/info/sparse-checkout + git pull --depth 1 -q origin 'service/${PLATFORM_VERSION}' + cd service + GOWORK=off go run ./cmd/keygen -output /keys + echo "PQC keys generated successfully (service/${PLATFORM_VERSION})" + rm -rf "$$WORKDIR" download-keycloak-data: command: From 81a11a9c0674d41290dd47344d71623d466fbf25 Mon Sep 17 00:00:00 2001 From: b-long Date: Sat, 31 Oct 2026 22:32:35 -0400 Subject: [PATCH 3/4] upgrade OpenTDF platform from v0.16.0 to v0.19.0 --- .github/docker-compose.platform.env | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/docker-compose.platform.env b/.github/docker-compose.platform.env index e057715..210e81d 100644 --- a/.github/docker-compose.platform.env +++ b/.github/docker-compose.platform.env @@ -2,6 +2,6 @@ # docker-compose.platform.override.yaml. Passed to `docker compose` via # --env-file so PLATFORM_VERSION only has to be declared once. # -# Matches the default proto GIT_TAG (service/v0.16.0) used by +# Note: this is ahead of the default proto GIT_TAG (service/v0.16.0) used by # packages/otdf-python-proto/scripts/generate_connect_proto.py. -PLATFORM_VERSION=v0.16.0 +PLATFORM_VERSION=v0.19.0 From e2a150c370fe904a177d90d401a09ccff4d2a7eb Mon Sep 17 00:00:00 2001 From: b-long Date: Sat, 31 Oct 2026 22:43:16 -0400 Subject: [PATCH 4/4] upgrade OpenTDF platform from v0.19.0 to v0.29.0 --- .github/docker-compose.platform.env | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/docker-compose.platform.env b/.github/docker-compose.platform.env index 210e81d..d437fb5 100644 --- a/.github/docker-compose.platform.env +++ b/.github/docker-compose.platform.env @@ -4,4 +4,4 @@ # # Note: this is ahead of the default proto GIT_TAG (service/v0.16.0) used by # packages/otdf-python-proto/scripts/generate_connect_proto.py. -PLATFORM_VERSION=v0.19.0 +PLATFORM_VERSION=v0.29.0