lmxopcua/scripts/validation/historiangw-131/README.md

HistorianGateway consumer TLS migration — issue 131

consumer-1.0.0.patch is a future consumer change, kept separate from the buildable application while the paired Client/Contracts 1.0.0 packages are being released. The application in this checkout remains pinned to published 0.4.0.

The patch changes both central package pins to 1.0.0 and maps the new option as:

AllowUntrustedServerCertificate = options.UseTls && options.AllowUntrustedServerCertificate,

The old inverse-mapping and obsolete h2c-history comments are removed. The existing h2c construction test now includes a stale opt-out as well as a stale CA path. Three new bounded local wire tests verify behavior through the real adapter and published client API, without reflection or replacing the transport handler:

• TLS with normal defaults rejects a self-signed server before the metadata RPC.
• Explicit opt-out permits that self-signed server shape and executes one RPC.
• Plaintext with stale opt-out and CA settings executes one RPC, proving TLS-only settings were not forwarded to the client's validating options.

The local server uses an ephemeral loopback port and a fresh short-lived self-signed certificate. RPC completion is bounded to 15 seconds; the consumer call timeout is two seconds. No gateway, deployment, or global trust store is used.

Before applying the patch, query the live Gitea NuGet version indexes for BOTH packages and require actual stable 1.0.0. Source main having the new API is not a package release. At initial inspection, both feed indexes listed exactly 0.4.0, 0.3.0, 0.2.0, 0.1.0, and the new API was only in Unreleased at HG commit e4321915ebc5e0704a68ecad21b85c1cc1c80d6b.

git apply --check scripts/validation/historiangw-131/consumer-1.0.0.patch
git apply scripts/validation/historiangw-131/consumer-1.0.0.patch
# From the consumer checkout, using a fresh run/results directory:
dotnet test tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Historian.Gateway.Tests \
  -c Release --logger trx --results-directory /absolute/fresh/results
# Preserve dotnet test's exit; run the repository execution-count guard separately.
MIN_EXECUTED=1 bash scripts/ci/assert-not-all-skipped.sh /absolute/fresh/results/*.trx

Published-package verification must use the real 1.0.0 packages, preserve all test and guard exits, run the full owning project, and complete the consumer solution build/review before issue 131 is closed. The patch is transport-only and can be applied independently of the OPC UA SDK 2 rollout.

If release availability lags, validate only in an archived staging copy: materialize exact HG commit e432191 with git archive, pack both packages with the local-only version 1.0.0-validation.131, set an isolated NUGET_PACKAGES, and map only those two package IDs to a task-local feed. Apply the future patch to a separate consumer archive, then replace ONLY its two package pins with the validation prerelease. Never pack/build the user's HG checkout, publish these validation packages, place them in the normal NuGet cache, or pass prerelease validation off as stable-release verification. Local validation and release availability results are recorded in RESULTS.md when the run completes.