From ab1ad689dfd47835488fd00654668111a3e2c141 Mon Sep 17 00:00:00 2001 From: Joseph Doherty Date: Mon, 9 Nov 2026 22:30:57 -0500 Subject: [PATCH] =?UTF-8?q?chore(secrets):=20deprecate=20Replicator.Grpc?= =?UTF-8?q?=20=E2=80=94=20out=20of=20the=20build=20and=20pack=20(scadaproj?= =?UTF-8?q?#8)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Owner chose option (b). ZB.MOM.WW.Secrets.Replicator.Grpc has had no consumer since ScadaBridge retired the gRPC secrets hub (2026-09-28); OtOpcUa never used it. - removed the project and its test project from ZB.MOM.WW.Secrets.slnx, so the family build/test and build/push.sh's `dotnet pack` skip it; - csproj IsPackable=false (a direct pack of the project yields nothing); - SecretsGrpcHubServerExtensions / SecretsGrpcHubClientExtensions [Obsolete]; - README, CHANGELOG (0.6.6 Deprecated), CLAUDE.md and clustered-secrets.md say so. Source + tests stay in the tree and still build/run standalone (test csproj suppresses CS0618): 200/200. Feed versions 0.4.1-0.6.3 are left for the owner to unlist. Also zeroes the solution's pre-existing warnings: CA1416 on two Unix-only permission tests (guarded by Skip.IfNot, which the analyzer cannot see — now [UnsupportedOSPlatform("windows")]) and two xUnit2031 Assert.Single(Where). Build 0 warnings; tests 429 passed / 21 skipped / 0 failed; pack = 5 nupkgs. Claude-Session: https://claude.ai/code/session_01GT67AEHd2Acv1YPwGfXEoV --- ZB.MOM.WW.Secrets/CHANGELOG.md | 12 ++++++++++++ ZB.MOM.WW.Secrets/CLAUDE.md | 6 ++++-- ZB.MOM.WW.Secrets/Directory.Packages.props | 3 ++- ZB.MOM.WW.Secrets/README.md | 2 +- ZB.MOM.WW.Secrets/ZB.MOM.WW.Secrets.slnx | 2 -- .../docs/operations/clustered-secrets.md | 6 +++++- .../SecretsGrpcHubClientExtensions.cs | 1 + .../SecretsGrpcHubServerExtensions.cs | 1 + .../ZB.MOM.WW.Secrets.Replicator.Grpc.csproj | 9 +++++++-- .../ZB.MOM.WW.Secrets.Replicator.Grpc.Tests.csproj | 5 +++++ .../Cli/Interactive/Flows/BundleFlowTests.cs | 2 ++ .../Cli/Interactive/Flows/KekDoctorFlowTests.cs | 2 ++ .../Configuration/SecretsStorePathRulesTests.cs | 4 ++-- 13 files changed, 44 insertions(+), 11 deletions(-) diff --git a/ZB.MOM.WW.Secrets/CHANGELOG.md b/ZB.MOM.WW.Secrets/CHANGELOG.md index c531d4f..5d5d74b 100644 --- a/ZB.MOM.WW.Secrets/CHANGELOG.md +++ b/ZB.MOM.WW.Secrets/CHANGELOG.md @@ -10,6 +10,18 @@ one of them. Fixes the scadaproj#15 code-review findings (`code-reviews/Secrets/findings.md`): six P2s (scadaproj#30–#35), the P3 batch (scadaproj#45: Secrets-004–009, 011, 012, 014–016, 018, 019) and the scadaproj#49 follow-ups. +### Deprecated + +- **`ZB.MOM.WW.Secrets.Replicator.Grpc` is deprecated** (scadaproj#8, owner decision 2026-11-09). The + pull-only `secrets_hub.v1` hub has had no consumer since ScadaBridge retired it (2026-09-28, site + secrets now ride its artifact deploy); OtOpcUa never used it (Akka pair-local). The project and its + test project are removed from `ZB.MOM.WW.Secrets.slnx`, so the family build, test run and pack + (`build/push.sh`) no longer include it, and the csproj is `IsPackable=false`. `SecretsGrpcHubServerExtensions` + (`AddZbSecretsGrpcHub`, `MapZbSecretsHub`) and `SecretsGrpcHubClientExtensions` (`AddZbSecretsGrpcHubClient`) + are `[Obsolete]`. **No `0.6.6` of this package will be published**; `0.4.1`–`0.6.3` stay on the feed + until the owner unlists them. Source and tests stay in the tree and still build standalone + (`dotnet test tests/ZB.MOM.WW.Secrets.Replicator.Grpc.Tests`). + ### scadaproj#52 follow-ups - **The CLI reference audit reports malformed `${secret:}` tokens.** New `ReferenceStatus.Malformed`: diff --git a/ZB.MOM.WW.Secrets/CLAUDE.md b/ZB.MOM.WW.Secrets/CLAUDE.md index c129c2b..f005f06 100644 --- a/ZB.MOM.WW.Secrets/CLAUDE.md +++ b/ZB.MOM.WW.Secrets/CLAUDE.md @@ -1,8 +1,10 @@ # ZB.MOM.WW.Secrets -Shared encrypted secret store + `${secret:}` resolution for the **ZB.MOM.WW SCADA family** (5 packages + the `secret` CLI; replicators for SqlServer / AkkaDotNet / Grpc). Build/test from this directory: `dotnet test`. Component spec + gaps: `../components/secrets/`. Operator runbooks under `docs/operations/`. +Shared encrypted secret store + `${secret:}` resolution for the **ZB.MOM.WW SCADA family** (5 packages + the `secret` CLI; replicators for SqlServer / AkkaDotNet; the Grpc replicator is deprecated — scadaproj#8). Build/test from this directory: `dotnet test`. Component spec + gaps: `../components/secrets/`. Operator runbooks under `docs/operations/`. -**Backlog / open work:** lives in Gitea issues on `dohertj2/scadaproj` (`tea issues list --repo dohertj2/scadaproj`) — currently #7 (ignitionoee router pins), #8 (Replicator.Grpc / `0.6.3` fate), #18 (migrator retry jitter). The history below is a record, not a status tracker; file new follow-ups as issues. +**Backlog / open work:** lives in Gitea issues on `dohertj2/scadaproj` (`tea issues list --repo dohertj2/scadaproj`) — currently #7 (ignitionoee router pins), #18 (migrator retry jitter). The history below is a record, not a status tracker; file new follow-ups as issues. + +**`ZB.MOM.WW.Secrets.Replicator.Grpc` — DEPRECATED (2026-11-09, scadaproj#8, owner chose option (b)):** removed from `ZB.MOM.WW.Secrets.slnx` together with its test project (so build/test/`build/push.sh` skip it), csproj `IsPackable=false`, both hub DI extension classes `[Obsolete]`; README/CHANGELOG/`docs/operations/clustered-secrets.md` say so. Source + tests stay in the tree and build standalone (the test csproj suppresses CS0618). No consumer: ScadaBridge retired the hub 2026-09-28, OtOpcUa never used it. Feed versions `0.4.1`–`0.6.3` are left for the owner to unlist. **`0.6.6` — built, NOT published (2026-11-09, scadaproj#30–#35, #45, #49):** every scadaproj#15 review finding resolved (Secrets-001–019; 0 open) plus the #49 follow-ups (CLI default `SqlitePath`, plain-root reload gap documented) — see `CHANGELOG.md` and `../code-reviews/Secrets/findings.md`. Behaviour changes worth knowing before adopting: store paths through symlinks into the content root now fail validation, malformed `${secret:}` tokens fail startup, UI Reveal fails closed on audit failure. diff --git a/ZB.MOM.WW.Secrets/Directory.Packages.props b/ZB.MOM.WW.Secrets/Directory.Packages.props index 522ae47..57830d6 100644 --- a/ZB.MOM.WW.Secrets/Directory.Packages.props +++ b/ZB.MOM.WW.Secrets/Directory.Packages.props @@ -30,7 +30,8 @@ - - true + false ZB.MOM.WW.Secrets.Replicator.Grpc ZB.MOM.WW - Central-hosted gRPC secrets hub (pull-only) for the ZB.MOM.WW SCADA family — site nodes follow central, ciphertext-only. + DEPRECATED (scadaproj#8) — central-hosted gRPC secrets hub (pull-only) for the ZB.MOM.WW SCADA family — site nodes follow central, ciphertext-only. https://gitea.dohertylan.com/dohertj2/scadaproj/src/branch/main/ZB.MOM.WW.Secrets https://gitea.dohertylan.com/dohertj2/scadaproj diff --git a/ZB.MOM.WW.Secrets/tests/ZB.MOM.WW.Secrets.Replicator.Grpc.Tests/ZB.MOM.WW.Secrets.Replicator.Grpc.Tests.csproj b/ZB.MOM.WW.Secrets/tests/ZB.MOM.WW.Secrets.Replicator.Grpc.Tests/ZB.MOM.WW.Secrets.Replicator.Grpc.Tests.csproj index beb86e7..f32400b 100644 --- a/ZB.MOM.WW.Secrets/tests/ZB.MOM.WW.Secrets.Replicator.Grpc.Tests/ZB.MOM.WW.Secrets.Replicator.Grpc.Tests.csproj +++ b/ZB.MOM.WW.Secrets/tests/ZB.MOM.WW.Secrets.Replicator.Grpc.Tests/ZB.MOM.WW.Secrets.Replicator.Grpc.Tests.csproj @@ -1,7 +1,12 @@ + false + $(NoWarn);CS0618 diff --git a/ZB.MOM.WW.Secrets/tests/ZB.MOM.WW.Secrets.Tests/Cli/Interactive/Flows/BundleFlowTests.cs b/ZB.MOM.WW.Secrets/tests/ZB.MOM.WW.Secrets.Tests/Cli/Interactive/Flows/BundleFlowTests.cs index 2b50a3d..8a1c369 100644 --- a/ZB.MOM.WW.Secrets/tests/ZB.MOM.WW.Secrets.Tests/Cli/Interactive/Flows/BundleFlowTests.cs +++ b/ZB.MOM.WW.Secrets/tests/ZB.MOM.WW.Secrets.Tests/Cli/Interactive/Flows/BundleFlowTests.cs @@ -233,6 +233,8 @@ public sealed class BundleFlowTests : IDisposable } [SkippableFact] + // Skip.IfNot is invisible to CA1416; this states the platform guard the analyzer can see. + [System.Runtime.Versioning.UnsupportedOSPlatform("windows")] public async Task Import_source_key_file_permission_denied_renders_friendly_error_without_importing() { Skip.IfNot(!OperatingSystem.IsWindows(), "Unix permission bits are exercised via UnixFileMode."); diff --git a/ZB.MOM.WW.Secrets/tests/ZB.MOM.WW.Secrets.Tests/Cli/Interactive/Flows/KekDoctorFlowTests.cs b/ZB.MOM.WW.Secrets/tests/ZB.MOM.WW.Secrets.Tests/Cli/Interactive/Flows/KekDoctorFlowTests.cs index 00e419d..ccb048b 100644 --- a/ZB.MOM.WW.Secrets/tests/ZB.MOM.WW.Secrets.Tests/Cli/Interactive/Flows/KekDoctorFlowTests.cs +++ b/ZB.MOM.WW.Secrets/tests/ZB.MOM.WW.Secrets.Tests/Cli/Interactive/Flows/KekDoctorFlowTests.cs @@ -227,6 +227,8 @@ public sealed class KekDoctorFlowTests : IAsyncLifetime, IDisposable } [SkippableFact] + // Skip.IfNot is invisible to CA1416; this states the platform guard the analyzer can see. + [System.Runtime.Versioning.UnsupportedOSPlatform("windows")] public async Task File_old_key_source_permission_denied_renders_friendly_error_and_still_re_diagnoses() { Skip.IfNot(!OperatingSystem.IsWindows(), "Unix permission bits are exercised via UnixFileMode."); diff --git a/ZB.MOM.WW.Secrets/tests/ZB.MOM.WW.Secrets.Tests/Configuration/SecretsStorePathRulesTests.cs b/ZB.MOM.WW.Secrets/tests/ZB.MOM.WW.Secrets.Tests/Configuration/SecretsStorePathRulesTests.cs index 6ad7433..ba9e885 100644 --- a/ZB.MOM.WW.Secrets/tests/ZB.MOM.WW.Secrets.Tests/Configuration/SecretsStorePathRulesTests.cs +++ b/ZB.MOM.WW.Secrets/tests/ZB.MOM.WW.Secrets.Tests/Configuration/SecretsStorePathRulesTests.cs @@ -214,8 +214,8 @@ public sealed class SecretsStorePathRulesTests services.AddZbSecrets(config, "Secrets"); services.AddZbSecrets(config, "Secrets"); - Assert.Single(services.Where(d => d.ServiceType == typeof(SecretsOptionsValidator))); - Assert.Single(services.Where(d => d.ServiceType == typeof(IValidateOptions))); + Assert.Single(services, d => d.ServiceType == typeof(SecretsOptionsValidator)); + Assert.Single(services, d => d.ServiceType == typeof(IValidateOptions)); } [Fact]