dohertj2/lmxopcua
1
0
Fork 0
Code Issues 5 Pull Requests Actions Packages Projects Releases Wiki Activity

docs(validation): scadabridge-sdk-compatibility README — #121 fixed, Sign leg, trust controls, ACL switch
v2-ci / unit-tests (push) Waiting to run
Details

Browse Source 
Co-Authored-By: Claude <noreply@anthropic.com>
This commit is contained in:
Joseph Doherty
2026-11-12 07:01:24 -05:00
parent ea83fc58b2
commit 135099d722
1 changed files with 18 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/validation/scadabridge-sdk-compatibility/README.md
+18 -10
View File
@@ -24,9 +24,17 @@ python3 scripts/validation/scadabridge-sdk-compatibility/run.py \
--results /absolute/fresh-consumer-evidence
```
The helper runs four separate consumer/server pairs: each application version
with None and SignAndEncrypt. None is enabled only in its own test fixture;
the ordinary compatibility host remains strict SignAndEncrypt. The task key is
The helper runs each application version with None, Sign and SignAndEncrypt,
plus two trust negative controls per secure profile (server does not trust the
client, client does not trust the server) that must fail closed. None and Sign
are enabled only in their own test fixtures (`OPCUA_MATRIX_SERVER_SECURITY=none|sign`);
the ordinary compatibility host remains strict SignAndEncrypt. Before each secure
leg the probe's `prepare` step provisions the consumer identity through
ScadaBridge's own certificate code and exports only its public certificate, which
the runner places in the server's trusted store before the server starts.
`OPCUA_MATRIX_ACL=off` disables the server's node-ACL check; with it on, masters
after lmxopcua#808 deny the three UNS cases because this fixture creates the `Eq`
folder without a deployed generation (fixture limitation, see lmxopcua#782). The task key is
generated per process pair, issuer/trusted/rejected stores are task-local, and
server public certificates are explicitly copied. Autoaccept remains false.
Never commit an entire output directory: it contains the fixture's private PKI.
@@ -37,10 +45,10 @@ and timestamps, alarm filter/ConditionRefresh and disconnect/reconnect. History
and Part 9 acknowledgment are not exposed by the inspected consumer interfaces;
the parent Shared/CLI matrix covers those application services instead.
ScadaBridge#121 is a reproduced preexisting limitation: SignAndEncrypt fails
against **both** original and candidate servers because the consumer does not
configure an application certificate. A matching baseline failure is evidence,
not a secure-channel pass. The runner retains the nonzero result and each actual
failure; it does not loosen trust or change expected results to return success.
The current None subset and the missing secure identity must be reported
separately. No ScadaBridge production source or user PKI is modified.
ScadaBridge#121 (consumer never configured an application certificate) is
fixed in ScadaBridge `ff835447`/`36c64a6b`. Re-run 2026-11-12 with ScadaBridge
`424db155`: None, Sign and SignAndEncrypt 9/9 against the SDK 1.5.378 baseline
(`83ed880e`), the SDK 2.0.1 candidate (`ebdc5892`) and master `182fb353` with
ACL off; all trust negative controls failed closed. The runner retains the
nonzero result and each actual failure; it does not loosen trust or change
expected results to return success. No ScadaBridge production source or user PKI is modified.