From 6a92b7155ecdd6e6c75bce6b8865d21ab1579d1f Mon Sep 17 00:00:00 2001 From: Dave Mihalcik Date: Mon, 31 Aug 2026 22:35:34 -0400 Subject: [PATCH] chore(sdk): drop dead TDFConfig fields and deprecate the TDFFormat enum TDFConfig.enableEncryption was set to true at construction and never read again; nothing could turn it off and nothing branched on it. tdfFormat was likewise fixed at JSONFormat forever. readActionName was a leftover constant with no references. All three are gone. rootIntegrityAlg and segmentIntegrityAlg go with them: once CreateTDF delegates to the chunked writer, which emits an HS256 root and GMAC segments unconditionally, nothing reads either field and no exported option ever set one. The defaults they carried were exactly those two algorithms, so the manifest is unchanged. TestIntegrityAlgDefaults asserted on the fields; the same invariant is now asserted on a manifest CreateTDF actually produced, in TDFSuite.testEncrypt, so every encrypt case in the suite checks it. TDFFormat, JSONFormat, and XMLFormat are exported, so they are deprecated rather than deleted. XML manifests were never implemented and the enum has no remaining consumer inside the SDK. Signed-off-by: Dave Mihalcik wip: resolve conflict 18 --- sdk/tdf.go | 1 - sdk/tdf_config.go | 14 ++++++-------- sdk/tdf_helpers_test.go | 9 --------- sdk/tdf_test.go | 6 ++++++ 4 files changed, 12 insertions(+), 18 deletions(-) diff --git a/sdk/tdf.go b/sdk/tdf.go index 552605e51b..99ac2348e6 100644 --- a/sdk/tdf.go +++ b/sdk/tdf.go @@ -53,7 +53,6 @@ const ( kAssertionSignature = "assertionSig" kAssertionHash = "assertionHash" hexSemverThreshold = "4.3.0" - readActionName = "read" // maxPayloadSegments caps the segment count a declared input size may imply. // The archive writer counts segments with an int, so the count has to fit one diff --git a/sdk/tdf_config.go b/sdk/tdf_config.go index cb2def9a3b..186ba0d36c 100644 --- a/sdk/tdf_config.go +++ b/sdk/tdf_config.go @@ -27,10 +27,16 @@ const ( inputSizeUnknown = -1 ) +// TDFFormat once selected a manifest serialization. Only JSON was ever +// implemented, and nothing reads this. +// +// Deprecated: unused; the manifest is always JSON. type TDFFormat = int const ( + // Deprecated: unused; the manifest is always JSON. JSONFormat = iota + // Deprecated: never implemented. XMLFormat ) @@ -138,12 +144,8 @@ type TDFConfig struct { autoconfigure bool defaultSegmentSize int64 inputSize int64 - enableEncryption bool - tdfFormat TDFFormat metaData string mimeType string - rootIntegrityAlg RootIntegrityAlg - segmentIntegrityAlg SegmentIntegrityAlg assertions []AssertionConfig attributes []AttributeValueFQN attributeValues []*policy.Value @@ -161,10 +163,6 @@ func newTDFConfig(opt ...TDFOption) (*TDFConfig, error) { autoconfigure: true, defaultSegmentSize: defaultSegmentSize, inputSize: inputSizeUnknown, - enableEncryption: true, - tdfFormat: JSONFormat, - rootIntegrityAlg: RootHS256, - segmentIntegrityAlg: SegmentGMAC, addDefaultAssertion: false, } diff --git a/sdk/tdf_helpers_test.go b/sdk/tdf_helpers_test.go index a4b6d46b76..cdcd090b17 100644 --- a/sdk/tdf_helpers_test.go +++ b/sdk/tdf_helpers_test.go @@ -108,15 +108,6 @@ func TestRootIntegrityRejectsNonHS256(t *testing.T) { assert.Equal(t, hex.EncodeToString(ocrypto.CalculateSHA256Hmac(key, aggregate)), legacySig) } -// Closing the root off to GMAC must not move the defaults: HS256 root, GMAC -// segments, which is what every writer has been emitting all along. -func TestIntegrityAlgDefaults(t *testing.T) { - def, err := newTDFConfig() - require.NoError(t, err) - assert.Equal(t, RootHS256, def.rootIntegrityAlg) - assert.Equal(t, SegmentGMAC, def.segmentIntegrityAlg) -} - // The deprecated constants stay numerically where they were, so an existing // caller that converts one into the new types lands on the same algorithm. func TestDeprecatedIntegrityAlgorithmConstants(t *testing.T) { diff --git a/sdk/tdf_test.go b/sdk/tdf_test.go index 373a447e80..c4fdb7ea80 100644 --- a/sdk/tdf_test.go +++ b/sdk/tdf_test.go @@ -2912,6 +2912,12 @@ func (s *TDFSuite) testEncrypt(sdk *SDK, encryptOpts []TDFOption, plainTextFilen tdfObj, err := sdk.CreateTDF(fileWriter, readSeeker, encryptOpts...) s.Require().NoError(err) + // Every TDF this SDK writes carries an HS256 root over the aggregate hash + // and GMAC segment hashes. Nothing configures either, so assert it here + // rather than in one test: this runs on every encrypt case there is. + s.Equal(hmacIntegrityAlgorithm, tdfObj.manifest.Algorithm) + s.Equal(gmacIntegrityAlgorithm, tdfObj.manifest.SegmentHashAlgorithm) + s.InDelta(float64(test.tdfFileSize), float64(tdfObj.size), .04*float64(test.tdfFileSize)) return tdfObj }