From a6d4d0d903a77120ffc1263d8bc80dd19b50ead7 Mon Sep 17 00:00:00 2001 From: Joseph Doherty Date: Thu, 12 Nov 2026 11:39:24 -0500 Subject: [PATCH] docs(otopcua-history): #879 EnabledSecurityProfiles replaces the default (a83bf1fa), consumer impact Claude-Session: https://claude.ai/code/session_01GT67ACmpMR7b9LGRPLijMi --- .claude/skills/sister-project-history/otopcua.md | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.claude/skills/sister-project-history/otopcua.md b/.claude/skills/sister-project-history/otopcua.md index 70eee85..f144b37 100644 --- a/.claude/skills/sister-project-history/otopcua.md +++ b/.claude/skills/sister-project-history/otopcua.md @@ -499,3 +499,8 @@ its Galaxy acks fail against mxaccessgw `2b13564e` did not apply to this box's d - **Rig check (docker-dev, `3fff439b`):** all three pairs read 250/240. A rejoining node reads 0 → 240 and never goes above 240. Record: lmxopcua#801 comment 11855. - **ScadaBridge consumer impact: none.** Its OPC UA failover is endpoint-level and doesn't read ServiceLevel. Generic clients that pick the highest ServiceLevel now get Primary preference back. - **Deployed boxes:** DEV vd03 (`5fb4b4db`, SDK 2.0.1, single node) still advertises 255 instead of 250, and would show 255 for a Stale 200, until it's redeployed with master. QA vq03/vq04 (SDK 1.5, `b8b4c18f`) are unaffected. This was the blocker for the QA SDK 2 rollout under #801. + +- **2026-11-12 master `a83bf1fa` (#879, not deployed): `OpcUa:EnabledSecurityProfiles` now replaces the default, so `None` can finally be dropped.** The .NET configuration binder appends configured array items to a pre-filled list, so the `[None, Sign, SignAndEncrypt]` default was always advertised and the documented "drop `None`" hardening was a no-op on every build (SDK 1.5 `efb9197a` and SDK 2 alike). Found by the #800 Windows service gate. The property is now null by default and `ResolveEnabledSecurityProfiles()` applies the same three-profile default only when nothing is configured; a set-but-empty list fails startup validation and `BuildSecurityPolicies` throws on empty input (it used to fall back to a `None` endpoint). **Defaults unchanged: a node with no `OpcUa:EnabledSecurityProfiles` still serves all three.** Sweep: no other options class has a non-empty pre-filled collection default. + - **What changes on a deployed box:** only a box that already lists `EnabledSecurityProfiles` in its appsettings or env. Before, it still advertised `None` and so everything kept working; after, `None` really goes. No checked-in config, deploy record or the vd03 upgrade record (`docs/deploy/vd03-upgrade-b8b4c18f-to-master.md`, deployed-appsettings diff) sets it, and no QA record does either, so none of DEV vd03 or QA vq03/vq04 is known to rely on the append behaviour. The service environment on the boxes was not inspected (no ad-hoc WinRM); check `OpcUa__EnabledSecurityProfiles__*` on a box before its redeploy. + - **ScadaBridge consumer impact: none today, a hard constraint if `None` is ever dropped.** ScadaBridge's OPC UA adapter connects with `None` + API key (18 cases pass against SDK 1.5 and SDK 2 servers) and has no client certificate, so its encrypted attempts fail before activation (ScadaBridge#121). On a node whose profile list omits `None`, that link would be refused with `BadSecurityPolicyRejected`. Do not drop `None` on any node ScadaBridge connects to until #121 is done. vd03 ScadaBridge has no OPC UA link to OtOpcUa, so vd03 could drop `None` safely; QA is not checked. + - **Evidence:** options binding (indexed, JSON array and env forms, default, empty, unknown name) 8 tests; booted-server wire test (secure-only config advertises no `None`, a `None` session is refused with `BadSecurityPolicyRejected`, a SignAndEncrypt session works; the default-config case is the control and does connect on `None`). Mutation (re-adding the pre-filled default) fails the wire test and 5 of the 8 binding tests.