Joseph Doherty
57 lines
3.2 KiB
Markdown
57 lines
3.2 KiB
Markdown
# HistorianGateway consumer TLS migration — issue 131
|
|
|
|
`consumer-1.0.0.patch` is a future consumer change, kept separate from the buildable
|
|
application while the paired Client/Contracts 1.0.0 packages are being released.
|
|
The application in this checkout remains pinned to published 0.4.0.
|
|
|
|
The patch changes both central package pins to 1.0.0 and maps the new option as:
|
|
|
|
```csharp
|
|
AllowUntrustedServerCertificate = options.UseTls && options.AllowUntrustedServerCertificate,
|
|
```
|
|
|
|
The old inverse-mapping and obsolete h2c-history comments are removed. The existing
|
|
h2c construction test now includes a stale opt-out as well as a stale CA path.
|
|
Three new bounded local wire tests verify behavior through the real adapter and
|
|
published client API, without reflection or replacing the transport handler:
|
|
|
|
- TLS with normal defaults rejects a self-signed server before the metadata RPC.
|
|
- Explicit opt-out permits that self-signed server shape and executes one RPC.
|
|
- Plaintext with stale opt-out and CA settings executes one RPC, proving TLS-only
|
|
settings were not forwarded to the client's validating options.
|
|
|
|
The local server uses an ephemeral loopback port and a fresh short-lived
|
|
self-signed certificate. RPC completion is bounded to 15 seconds; the consumer
|
|
call timeout is two seconds. No gateway, deployment, or global trust store is used.
|
|
|
|
Before applying the patch, query the live Gitea NuGet version indexes for BOTH
|
|
packages and require actual stable 1.0.0. Source `main` having the new API is not a
|
|
package release. At initial inspection, both feed indexes listed exactly
|
|
0.4.0, 0.3.0, 0.2.0, 0.1.0, and the new API was only in Unreleased at HG commit
|
|
`e4321915ebc5e0704a68ecad21b85c1cc1c80d6b`.
|
|
|
|
```bash
|
|
git apply --check scripts/validation/historiangw-131/consumer-1.0.0.patch
|
|
git apply scripts/validation/historiangw-131/consumer-1.0.0.patch
|
|
# From the consumer checkout, using a fresh run/results directory:
|
|
dotnet test tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Historian.Gateway.Tests \
|
|
-c Release --logger trx --results-directory /absolute/fresh/results
|
|
# Preserve dotnet test's exit; run the repository execution-count guard separately.
|
|
MIN_EXECUTED=1 bash scripts/ci/assert-not-all-skipped.sh /absolute/fresh/results/*.trx
|
|
```
|
|
|
|
Published-package verification must use the real 1.0.0 packages, preserve all test
|
|
and guard exits, run the full owning project, and complete the consumer solution
|
|
build/review before issue 131 is closed. The patch is transport-only and can be
|
|
applied independently of the OPC UA SDK 2 rollout.
|
|
|
|
If release availability lags, validate only in an archived staging copy: materialize
|
|
exact HG commit e432191 with `git archive`, pack both packages with the local-only
|
|
version `1.0.0-validation.131`, set an isolated `NUGET_PACKAGES`, and map only those
|
|
two package IDs to a task-local feed. Apply the future patch to a separate consumer
|
|
archive, then replace ONLY its two package pins with the validation prerelease.
|
|
Never pack/build the user's HG checkout, publish these validation packages, place
|
|
them in the normal NuGet cache, or pass prerelease validation off as stable-release
|
|
verification. Local validation and release availability results are recorded in
|
|
`RESULTS.md` when the run completes.
|