SDK2 deploy gate: Windows native install and reused-PKI restart validation #800

New Issue

2026-11-10T13:11:07-05:00

dohertj2 commented

2026-11-10 13:11:07 -05:00

Required by #782 Task12/G4. Linux ARM64 and Windows x64 Host/CLI self-contained publishes succeeded with runtime10.0.14 and exact OPC UA2.0.1; package/native inventories and hashes are recorded. Actual full Linux Host booted/stopped twice with unchanged application certificate, healthy web checks, strict peer/API-key positives and negatives, and encrypted CLI reads. Cross-publishing is not Windows runtime evidence.

Owner: repository owner / approved Windows operator. Before accepting Windows support, use the candidate branch artifacts and docs/plans/2026-11-10-opcua-sdk-2-rollout.md to stage separately from the existing installation. Preserve config/LocalDb/PKI with original permissions and thumbprints; use task-only API keys/ports, validate strict trusted secure channels and invalid credentials, start/stop twice through the repository-supported service installation, verify ScriptWorker package/pipe ACL/firewall requirements, health/ServiceLevel and redacted logs, and prove the complete known-good rollback. Link exact source/artifact hashes, commands and results here and #782.

The OtOpcUa repository’s Wonder-box hold remains binding: no WinRM, psbridge or replacement remote-exec on vd03/vq03/vq04 without a cleared channel. No Windows install or remote service command was performed. Do not use the successful Linux run or Windows publish as a substitute. #793 pre-upgrade ConfigDb checks and #794 existing ScriptWorker isolation gate remain separate prerequisites. Keep this gate open until an approved operator records real results.

Required by #782 Task12/G4. Linux ARM64 and Windows x64 Host/CLI self-contained publishes succeeded with runtime10.0.14 and exact OPC UA2.0.1; package/native inventories and hashes are recorded. Actual full Linux Host booted/stopped twice with unchanged application certificate, healthy web checks, strict peer/API-key positives and negatives, and encrypted CLI reads. Cross-publishing is not Windows runtime evidence. Owner: repository owner / approved Windows operator. Before accepting Windows support, use the candidate branch artifacts and docs/plans/2026-11-10-opcua-sdk-2-rollout.md to stage separately from the existing installation. Preserve config/LocalDb/PKI with original permissions and thumbprints; use task-only API keys/ports, validate strict trusted secure channels and invalid credentials, start/stop twice through the repository-supported service installation, verify ScriptWorker package/pipe ACL/firewall requirements, health/ServiceLevel and redacted logs, and prove the complete known-good rollback. Link exact source/artifact hashes, commands and results here and #782. The OtOpcUa repository’s Wonder-box hold remains binding: no WinRM, psbridge or replacement remote-exec on vd03/vq03/vq04 without a cleared channel. No Windows install or remote service command was performed. Do not use the successful Linux run or Windows publish as a substitute. #793 pre-upgrade ConfigDb checks and #794 existing ScriptWorker isolation gate remain separate prerequisites. Keep this gate open until an approved operator records real results.

dohertj2 added the type:deploy-gate priority:p1 blocked labels 2026-11-10 13:11:07 -05:00

dohertj2 referenced this issue

2026-11-10 13:11:08 -05:00

SDK2 live gate: AVEVA history, consumer compatibility and paired-cluster rollout #801

dohertj2 referenced this issue

2026-11-10 13:30:50 -05:00

WIP: Upgrade OPC UA SDK to 2.0.1 preserving application contracts #802

dohertj2 referenced this issue

2026-11-10 13:31:57 -05:00

Upgrade OPC Foundation SDK 1.5.378 → 2.0.x (public SecureChannelContext.PeerAddress replaces #751 reflection) #782

Sign in to join this conversation.