Joseph Doherty
135099d722
v2-ci / unit-tests (push) Waiting to run
Co-Authored-By: Claude <noreply@anthropic.com>
55 lines
3.1 KiB
Markdown
55 lines
3.1 KiB
Markdown
# Actual ScadaBridge consumer compatibility
|
|
|
|
This isolated process references the real ScadaBridge `OpcUaDataConnection` and
|
|
`RealOpcUaClient`, with their own dependency graph. It never loads the candidate
|
|
SDK into that process. The verified consumer source is
|
|
`0e89966da670e289bd875166295bb0e85d8cf8b2`, pinned to SDK 1.5.378.106.
|
|
|
|
Build with an explicit clean consumer checkout:
|
|
|
|
```sh
|
|
dotnet build scripts/validation/scadabridge-sdk-compatibility/Probe.csproj \
|
|
-c Release -p:ScadaBridgeSourceRoot=/absolute/ScadaBridge
|
|
```
|
|
|
|
First build the separate application hosts with the parent
|
|
`scripts/e2e/test-opcua-sdk-compatibility.ps1` harness. Then choose a new output
|
|
directory and pass its original and candidate `ProcessHost.dll` paths:
|
|
|
|
```sh
|
|
python3 scripts/validation/scadabridge-sdk-compatibility/run.py \
|
|
--baseline-host /absolute/matrix/build-baseline/bin/Release/net10.0/ProcessHost.dll \
|
|
--candidate-host /absolute/matrix/build-candidate/bin/Release/net10.0/ProcessHost.dll \
|
|
--probe scripts/validation/scadabridge-sdk-compatibility/bin/Release/net10.0/Probe.dll \
|
|
--results /absolute/fresh-consumer-evidence
|
|
```
|
|
|
|
The helper runs each application version with None, Sign and SignAndEncrypt,
|
|
plus two trust negative controls per secure profile (server does not trust the
|
|
client, client does not trust the server) that must fail closed. None and Sign
|
|
are enabled only in their own test fixtures (`OPCUA_MATRIX_SERVER_SECURITY=none|sign`);
|
|
the ordinary compatibility host remains strict SignAndEncrypt. Before each secure
|
|
leg the probe's `prepare` step provisions the consumer identity through
|
|
ScadaBridge's own certificate code and exports only its public certificate, which
|
|
the runner places in the server's trusted store before the server starts.
|
|
`OPCUA_MATRIX_ACL=off` disables the server's node-ACL check; with it on, masters
|
|
after lmxopcua#808 deny the three UNS cases because this fixture creates the `Eq`
|
|
folder without a deployed generation (fixture limitation, see lmxopcua#782). The task key is
|
|
generated per process pair, issuer/trusted/rejected stores are task-local, and
|
|
server public certificates are explicitly copied. Autoaccept remains false.
|
|
Never commit an entire output directory: it contains the fixture's private PKI.
|
|
|
|
The consumed subset covers API-key activation, raw/UNS scalar and Int32[]
|
|
roundtrips, durable hierarchical browse including the native alarm, data quality
|
|
and timestamps, alarm filter/ConditionRefresh and disconnect/reconnect. History
|
|
and Part 9 acknowledgment are not exposed by the inspected consumer interfaces;
|
|
the parent Shared/CLI matrix covers those application services instead.
|
|
|
|
ScadaBridge#121 (consumer never configured an application certificate) is
|
|
fixed in ScadaBridge `ff835447`/`36c64a6b`. Re-run 2026-11-12 with ScadaBridge
|
|
`424db155`: None, Sign and SignAndEncrypt 9/9 against the SDK 1.5.378 baseline
|
|
(`83ed880e`), the SDK 2.0.1 candidate (`ebdc5892`) and master `182fb353` with
|
|
ACL off; all trust negative controls failed closed. The runner retains the
|
|
nonzero result and each actual failure; it does not loosen trust or change
|
|
expected results to return success. No ScadaBridge production source or user PKI is modified.
|