Upgrade OPC Foundation SDK 1.5.378 → 2.0.x (public SecureChannelContext.PeerAddress replaces #751 reflection) #782
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
OtOpcUa pins
OPCFoundation.NetStandard.Opc.Ua.*1.5.378.106. The 2.0 line is out (2.0.1 is in the local NuGet cache) and is a major-version upgrade.Concrete driver for this issue: 2.0.1 adds a public
Opc.Ua.SecureChannelContext.PeerAddress("the observed network address of the peer, when the transport exposes one"). That is the API lmxopcua#770 item 4 has been waiting for. Todaysrc/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer/Security/SecureChannelRemoteEndpoint.cs(#751) readsTcpTransportListener.m_channels→ channelSocket→IMessageSocket.RemoteEndpointby reflection. That path is fail-soft and pinned byRemoteEndpointResolutionTests, so a 2.0 upgrade that drops those private members fails a test rather than silently degrading.Also visible in the 2.0.1 surface: the transport layer was reworked (
IUaSCByteTransport,TcpByteTransport,UaScConnectionAdmission). Expect the reflection path to break on upgrade, and expect other breaking changes across Server/Client/Configuration.Scope:
SecureChannelRemoteEndpointwithSecureChannelContext.PeerAddress, keeping null = "address unknown" semantics.Spike recorded on master:
docs/plans/2026-11-09-opcua-sdk-2.0-upgrade-spike.md(doc only; package bump reverted).ArrayOf<T>,ByteString, obsoleteVariant.Value/DataValue.Value,StatusCodeno longer converts to uint), node-manager overrides change signature and go async, the identity/certificate API is reworked (asyncUserIdentity.CreateAsync,CertificateManager), and SDK-wide nullable annotations trip warnings-as-errors.SecureChannelContext.PeerAddressis anIPAddress(no port), available atActivateSessionAsync/OperationContext.ChannelContext. It can replace the #751 reflection, but whether the method is virtual and whether the TCP transport populates it are unverified.Keeping open as the upgrade tracker; scheduling it is an owner call (p3, nothing forces it).
Owner decision 2026-11-09: park the 2.0 upgrade (keep this issue as the tracker; schedule when 1.5 reaches end of support or a feature needs it). Do the patch-level hop 1.5.378.106 → 1.5.378.182 now.
Interim hop done: OPC Foundation SDK 1.5.378.106 -> 1.5.378.182 (latest 1.5.378.x), master
2da58d03. 2.0 upgrade stays parked; this issue stays open as the 2.0 tracker.Behaviour-neutral adaptations
TreatUncertainAsBadto true. We keep ours (false; Part 13 default as recalled, not re-read).OtOpcUaSdkServer.CreateAggregateManagernow pushesServerAggregateConfigurationinto the SDK manager so live AggregateFilter subscriptions and history reads agree. The #677 parity test is now an explicit deliberate-divergence tripwire (pins ours=false, asserts the SDK default is true so a future change is noticed) plus a booted-server test (mutation-checked).FindPredefinedNode(NodeId, Type)->FindPredefinedNode<T>;ApplicationConfiguration.TraceConfigurationis obsolete (line removed).Microsoft.Extensions.Logging.Abstractions10.0.7 -> 10.0.8 (Opc.Ua.Types .182). No other floor moved.OpcUaClientDriverStallWireTests: every behavioural assertion still holds (same session, one Bad, in-place recovery, no regression). Only the positive control 'SDK late backlog flush arrives' no longer fires; .176 notes 'Preserve publish queue timestamp ordering' and 'Fix publish queue lost wake-up', so the hazard the control guards appears gone SDK-side. The wait is now best-effort (15 s); ordering check kept.Release notes .106 -> .182 (security/cert/session): .134 UserNameIdentityToken returns BadIdentityTokenInvalid on failed verification, RSA min key size honored, reconnect user-token-policy reuse; .145 certificate-validation StatusCodes filtered; .156 full cert chain sent when CA is in issuer store, issuer/CA KeyUsage (keyCertSign, cRLSign) validated (stricter: a CA cert lacking them would now be rejected), ActivateSession NRE fix; .176 unordered endpoint validation fix, Cancel scoped to current session, ValidateAsync defaults TransportQuotas, MaxNotificationsPerPublish=0 treated as unlimited; .182 bounded array/XML depth/PubSub metadata. Nothing else touching aggregates.
Tests (Release, AKKA_TEST_TIMEFACTOR=3, all 0 failed): OpcUaServer.IntegrationTests 132/132; OpcUaServer.Tests 1027 pass + 1 skip; Client.CLI 168; Client.UI 130; Client.Shared 240; Runtime 988 (+3 skip); Host.Tests 247; Host.IntegrationTests 287 (+2 skip); Driver.OpcUaClient 295 + 5 integration; Browser 19 + 5. Release build 0 warnings. Not deployed.
Labelled
blocked. The owner decided to park the 2.0 upgrade; the hop to 1.5.378.182 is done in2da58d03.Execution resumed under the owner’s explicit instruction. Review branch
codex/opcua-sdk-2is pushed (2541ef39); no deployment or release approval.Implemented exact OPC Foundation SDK 2.0.1, coherent required Microsoft.Extensions uplift, server/client/driver API migration, retained identity/key/ACL behavior, owned certificate lifecycle, single-use session/node-bound history continuation points, filtered alarm/model/audit delivery, and write-conversion/revert compatibility. Aggregate results retain the original 1.5.378.182 algorithms through a private versioned source adapter: 6,144 independently generated baseline vectors pass both directly and through the booted runtime manager, across all 37 factories. No second SDK is loaded in the application.
Latest verification: server unit 1,109 passed / 0 failed / 1 existing skip; full real server wire suite 150/150 passed; trusted mutual-DER secure-channel tests 5/5 passed (Sign and SignAndEncrypt, narrow-grant positive/revocation, invalid credentials and untrusted client); target certificate-manager/endpoint identity tests 7/7 passed. Astra reviewed the scoped application audit permission seam and verified its encrypted wire proof: one application audit reaches the Read audience, zero leak to denied readers, and ordinary SDK automatic audit remains denied. Full solution convergence and other G3/G4 gates remain in progress.
Baseline historian PercentGood parity debt was independently reproduced: original and candidate have the same ten failing tests/messages out of 275; application results and independent expected values are retained. This will be linked as explicit baseline debt, not hidden by changing aggregate policy.
Still pending: complete solution tests, cross-version separate-process matrix, real ScadaBridge/backends, performance and two-hour soak, publish/runtime smoke and final Astra release review. Existing Wonder-box remote-execution hold remains binding. Issue stays open; parked label describes an earlier owner decision superseded by the current execution request.
Implementation and evidence are pushed on
codex/opcua-sdk-2; draft PR #802 is open for review (do not merge). Latest pushed evidence commitb218321bincludes the completed CI2 counters and the failed supported-Linux RSS run. New test-only pre-assert/native/JIT/profile diagnostics are being verified before the next push.Completed local validation: solution Release build0 warnings/errors; full CI2 18,475 passed /11 failed /635 existing skips (18,486 executed, guard passed). All11 failures independently reproduced on original baseline: #796 ten PercentGood oracle cases, #798 ScriptWorker250ms timing assertion. Original application aggregate behavior retained, 6,144 independent original-SDK vectors pass directly and through booted manager. Server wire187, unit1,115+1 existing skip, Shared324, final security17/17. Separate-process original/candidate Shared plus actual driver/CLI matrix62/62. Real SQLServer195 and QuestDB233+1 existing skip pass on each version. Four self-contained Host/CLI publishes; actual Linux Host two clean start/stop cycles preserve PKI and pass HMAC/strict-peer checks.
Actual unchanged ScadaBridge:18 None/API-key cases pass; secure setup fails equally on old/new because its own application certificate is unconfigured (ScadaBridge#121). The narrow opaque scripted alarm grant defect is baseline behavior tracked separately in #797.
Astra independently reviewed integrated source at
aa9af0dc: no new must-fix migration source/security finding. It explicitly withheld release approval. #799 now records failed unchanged-cap combined client/server RSS workloads on BOTH macOS (~17min) and Linux (~15min); cause unresolved, no budget waiver or speculative production patch. Native attribution and matched Linux baseline profiling continue. The separate actual production Shared/driver/live-reinitialize/browser two-hour Linux run remains active; no pass is claimed yet.Windows actual runtime/service gate #800 and approved live AVEVA/consumer/paired-cluster gate #801 remain pending. Wonder-box remote-execution hold is respected; no deployment or master merge performed. #782 remains open; external gate issues do not convert the failed software resource gate into a pass.
Execution update: candidate and complete evidence pushed through
ed60970f, draft PR #802 remains HOLD. Final integrated build has zero warnings/errors. CI4 executes 18,489 tests: 18,478 passed / 11 independently reproduced baseline failures / 635 existing skips, test1/guard0. The extra CI3 fixture/test-ordering failures are resolved and pass in this same final run; original failed attempts are retained.Completed two-hour actual production client/driver/browser lifecycle: 5,420 cycles, 43,360 verified manager disposals, zero weak survivors/PKI descriptors. Fresh HG1.0 four publishes and actual Linux two-start/stop smoke passed. Historiangw#131 is closed on consumer master230cef4e; baseline test repair #805 is closed on master52d1373e; both merged into candidate. No SDK2 master merge/deployment.
Astra source/security review closed with no new must-fix finding. Release remains on HOLD: #799 cold RSS failed, despite the bounded canonical factory-saturation diagnostic meeting its selected criterion; the original adapter honestly records partial proof and unsupported ownership/process-memory parity. No warmed acceptance baseline, cap waiver or production workaround was approved. #800/#801/ScadaBridge#121 remain external gates; #796/#798 baseline failures and #797/#806 baseline functionality gaps remain linked.
Execution evidence, operator runbook. The scadaproj main index/history was updated and pushed with actual consumer versions and gate limits. #782 remains OPEN; software/release completion is not claimed.