fix(sdk): reject a chunked split naming a KAS with no resolved public key by dmihalcik-virtru · Pull Request #3942 · opentdf/platform

dmihalcik-virtru · 2026-09-01T02:57:28Z

Part 13 of 20 in the DSPX-2604 re-cut. Base branch: dspx-2604-12-getmanifest-lock.

This stack replaces #3782 / #3865 / #3921, which stay open and untouched
until it lands. Nothing here is a rebase of those branches — the work was
re-cut from the ticket so each PR stands on its own.

Proposed Changes

buildChunkedKeyAccessObjects skipped any KAS URL that a split named but
SplitResult.KASPublicKeys had no entry for. That silently drops the only
key access object that would have let that KAS unwrap the share. In an
OR-group the TDF still decrypts, just against a smaller set of KAS servers
than the policy asked for -- and nothing in the output says so. If every
URL on a split is unresolved the share is unrecoverable outright, and the
failure surfaces much later as a generic "no valid key access objects
generated", or not at all if some other split still produced KAOs.

Treats a missing entry the same way an entry with an empty PEM was already
treated: errKasPubKeyMissing, naming the split and the URL. A splitter
that cannot resolve a key it referenced has a bug, and creation time is
where it should be reported.

Checklist

I have added or updated unit tests
I have added or updated integration tests (if appropriate)
I have added or updated documentation

Testing Instructions

cd sdk && go test ./... -race

The full DSPX-2604 stack — 20 PRs

#	PR	Based on
01	#3930 chore: bump go.work toolchain to go1.25.12 and simplify an rt_test condition	`main`
02	#3931 feat(sdk): make the zipstream clock injectable for deterministic ZIP output	`main`
03	#3932 fix(sdk): reject a zipstream write set that omits segment 0	#3931
04	#3933 fix(sdk): map ReadAt plaintext offsets from cumulative segment sizes	`main`
05	#3934 chore(sdk): extract integrityAlgorithmString, createPolicyBinding, signAssertions	`main`
06	#3935 chore(sdk): add direct tests for createKeyAccess, encryptMetadata and tdfSalt	`main`
07	#3936 fix(sdk): fill each segment with io.ReadFull and size the buffer to the input	`main`
08	#3937 chore(cli): move streaming IO helpers into pkg	`main`
09	#3938 fix(cli): stream encrypt instead of buffering the whole payload	#3937
10	#3939 fix(cli): stream decrypt and inspect instead of buffering	#3938
11	#3940 feat(sdk): add a chunked segment writer (experimental)	`dspx-2604-base-11` = #3932 + #3934 + #3935
12	#3941 fix(sdk): stop GetManifest from splitting the key under the lock	#3940
13	#3942 fix(sdk): reject a chunked split naming a KAS with no resolved public key	#3941
14	#3943 chore(sdk): alias experimental/tdf manifest and assertion types	#3942
15	#3944 fix(sdk): emit spec-compliant key access in experimental/tdf and delegate Writer	#3943
16	#3945 feat(sdk): accept io.Reader in CreateTDF and drop the 64 GB payload cap	#3936
17	#3946 chore(sdk): rewrite CreateTDF on top of the chunked writer	`dspx-2604-base-17` = #3944 + #3945
18	#3947 chore(sdk): drop dead TDFConfig fields and deprecate the TDFFormat enum	#3946
19	#3948 fix(cli): drop the encrypt-side stdin spool	`dspx-2604-base-19` = #3947 + #3939
20	#3949 feat(sdk): graduate the chunked writer to stable API	#3948

Reviewable in parallel right now, since they sit directly on main and depend on
nothing else: 01, 02, 04, 05, 06, 07, 08.

Why three PRs have a dspx-2604-base-* base. A GitHub PR takes one base branch,
but 11, 17 and 19 each build on more than one parent. The base-* branches are empty
merge commits that exist only to join those parents so the PR diff shows exactly its
own change and nothing else. They contain no code, have no PR of their own, and go
away once their parents land — retarget the child onto main at that point.

Wants a cross-SDK xtest run before merge: 15, 17 (and therefore 20). They touch
the KAS wire format.

Red checks you may see are network flakes, not this stack. Four distinct ones hit
this batch and all clear on re-run: golangci-lint config verify timing out on
https://golangci-lint.run/.../golangci.v2.8.jsonschema.json (fails the whole go (<module>) job and fail-fast cancels its siblings), the bats installer getting a 403,
Docker Hub timing out on keycloak/keycloak:26.4, and buf reporting "the server
hosted at that remote is unavailable" while the Java SDK generates sources. The
govulncheck step also emits ##[error] annotations against the go1.25.11 stdlib, but
it is continue-on-error: true and never fails a job — 01 bumps the toolchain and
clears those annotations.

coderabbitai · 2026-09-01T02:57:38Z

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Team

Run ID: 201edc08-fd03-4a34-a4ef-2fa91a48360b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-09-01T03:02:44Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	246.551667ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	145.218025ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	425.658356ms
Throughput	234.93 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	47.334828509s
Average Latency	472.489112ms
Throughput	105.63 requests/second

github-actions · 2026-09-01T03:11:43Z

github-actions · 2026-09-01T03:37:05Z

X-Test Failure Report

github-actions · 2026-09-01T03:42:45Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	241.738176ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	125.629198ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	453.643263ms
Throughput	220.44 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	41.92365173s
Average Latency	418.349583ms
Throughput	119.26 requests/second

github-actions · 2026-09-01T03:42:56Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	244.956606ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	137.870492ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	429.717174ms
Throughput	232.71 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	43.969703894s
Average Latency	438.855574ms
Throughput	113.71 requests/second

github-actions · 2026-09-01T03:53:01Z

github-actions · 2026-09-01T04:40:57Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	268.950312ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	134.093561ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	423.782455ms
Throughput	235.97 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	43.167593665s
Average Latency	430.743576ms
Throughput	115.83 requests/second

github-actions · 2026-09-01T04:55:08Z

github-actions · 2026-09-01T05:16:42Z

github-actions · 2026-09-01T15:15:14Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	200.831597ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	106.620319ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	424.380821ms
Throughput	235.64 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	40.536150225s
Average Latency	404.688811ms
Throughput	123.35 requests/second

github-actions · 2026-09-01T15:22:38Z

github-actions · 2026-09-03T14:13:33Z

X-Test Failure Report

… key `buildChunkedKeyAccessObjects` skipped any KAS URL that a split named but `SplitResult.KASPublicKeys` had no entry for. That silently drops the only key access object that would have let that KAS unwrap the share. In an OR-group the TDF still decrypts, just against a smaller set of KAS servers than the policy asked for -- and nothing in the output says so. If every URL on a split is unresolved the share is unrecoverable outright, and the failure surfaces much later as a generic "no valid key access objects generated", or not at all if some other split still produced KAOs. Treats a missing entry the same way an entry with an empty PEM was already treated: `errKasPubKeyMissing`, naming the split and the URL. A splitter that cannot resolve a key it referenced has a bug, and creation time is where it should be reported. Signed-off-by: Dave Mihalcik <dmihalcik@virtru.com>

github-actions · 2026-09-03T14:18:14Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	224.711453ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	130.326841ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	443.549383ms
Throughput	225.45 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	59.058833073s
Average Latency	589.10467ms
Throughput	84.66 requests/second

github-actions · 2026-09-03T14:18:21Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	238.122303ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	127.816104ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	453.191121ms
Throughput	220.66 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	1m2.11773705s
Average Latency	619.903349ms
Throughput	80.49 requests/second

github-actions · 2026-09-03T14:32:20Z

X-Test Results

✅ go@pull-3942-pull-3942
✅ go@main-main
✅ go@pull-3942-main
✅ go@main-pull-3942
bats-test-results
✅ go@main-v0.9.0
✅ go@pull-3942-v0.9.0
✅ java@main-pull-3942
✅ java@main-main
cukes-report
✅ js@main-v0.9.0
✅ java@main-v0.9.0
✅ js@main-pull-3942
✅ js@main-main
opentdf~~platform~~4OBOU4.dockerbuild
govulncheck-failure-3
govulncheck-failure-8
govulncheck-failure-1

github-actions · 2026-09-03T14:39:29Z

X-Test Failure Report

github-actions · 2026-09-03T14:44:56Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	180.718863ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	103.886231ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	344.767032ms
Throughput	290.05 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	47.290730066s
Average Latency	472.018139ms
Throughput	105.73 requests/second

github-actions · 2026-09-03T14:45:23Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	241.328039ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	134.617223ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	428.442886ms
Throughput	233.40 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	59.775809277s
Average Latency	596.322308ms
Throughput	83.65 requests/second

github-actions · 2026-09-03T14:48:13Z

⚠️ Govulncheck found vulnerabilities ⚠️

The following modules have known vulnerabilities:

otdfctl
service
tests-bdd

See the workflow run for details.

github-actions · 2026-09-03T14:54:46Z

X-Test Results

bats-test-results
✅ go@pull-3942-pull-3942
✅ go@pull-3942-main
✅ go@main-main
✅ go@main-pull-3942
✅ go@pull-3942-v0.9.0
✅ js@main-pull-3942
✅ go@main-v0.9.0
✅ js@main-main
✅ java@main-pull-3942
✅ java@main-main
✅ java@main-v0.9.0
cukes-report
✅ js@main-v0.9.0
govulncheck-failure-3
opentdf~~platform~~UTJEAP.dockerbuild
govulncheck-failure-8
govulncheck-failure-1

dmihalcik-virtru requested review from a team as code owners September 1, 2026 02:57

github-actions Bot added the comp:sdk A software development kit, including library, for client applications and inter-service communicati label Sep 1, 2026

github-actions Bot added the size/s label Sep 1, 2026

dmihalcik-virtru force-pushed the dspx-2604-12-getmanifest-lock branch from 912b24c to e7d3d2d Compare September 1, 2026 03:36

dmihalcik-virtru force-pushed the dspx-2604-13-unresolved-kas branch from 7f0cb1b to fd974c3 Compare September 1, 2026 03:36

dmihalcik-virtru force-pushed the dspx-2604-13-unresolved-kas branch from fd974c3 to ec6e9b8 Compare September 1, 2026 15:08

dmihalcik-virtru force-pushed the dspx-2604-12-getmanifest-lock branch from 41aaa77 to bf79736 Compare September 3, 2026 14:13

dmihalcik-virtru force-pushed the dspx-2604-13-unresolved-kas branch from ec6e9b8 to 1fd4e22 Compare September 3, 2026 14:13

dmihalcik-virtru force-pushed the dspx-2604-12-getmanifest-lock branch from bf79736 to 89d49b0 Compare September 3, 2026 14:39

dmihalcik-virtru force-pushed the dspx-2604-13-unresolved-kas branch from 1fd4e22 to 6b6edef Compare September 3, 2026 14:39

Uh oh!

Conversation

dmihalcik-virtru commented Sep 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Proposed Changes

Checklist

Testing Instructions

Uh oh!

coderabbitai Bot commented Sep 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

github-actions Bot commented Sep 1, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Sep 1, 2026

X-Test Results

Uh oh!

github-actions Bot commented Sep 1, 2026

X-Test Failure Report

Uh oh!

github-actions Bot commented Sep 1, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Sep 1, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Sep 1, 2026

X-Test Results

Uh oh!

github-actions Bot commented Sep 1, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Sep 1, 2026

X-Test Failure Report

Uh oh!

github-actions Bot commented Sep 1, 2026

X-Test Results

Uh oh!

github-actions Bot commented Sep 1, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Sep 1, 2026

X-Test Failure Report

Uh oh!

github-actions Bot commented Sep 3, 2026

X-Test Failure Report

Uh oh!

github-actions Bot commented Sep 3, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Sep 3, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

dmihalcik-virtru commented Sep 1, 2026 •

edited

Loading

coderabbitai Bot commented Sep 1, 2026 •

edited

Loading