Repository navigation
fix(kas): accept spec-compliant policy bindings - #4223
Merged
Merged
Conversation
The spec defines the policy binding as Base64(HMAC), but no released KAS can decode that form. #2095 added a dual-accept branch and it has never worked: base64.DecodedLen over-allocates, so a 44-character binding decodes 32 bytes into a 33-byte buffer. Only the hex branch replaced that buffer with a right-sized slice; the raw branch passed the untrimmed 33 bytes to VerifyBinding, which compares with hmac.Equal -- length sensitive, so it always failed. Extract decodePolicyBinding, trimmed to the bytes actually decoded, and use it on the rewrap path. Legacy hex stays accepted indefinitely; TDFs are archival. This only widens what KAS accepts and changes no output, so it is safe to deploy on its own. It is a prerequisite for fixing the SDK writer, which is deliberately left for a follow-up: nothing may emit raw bindings until a KAS that can read them is deployed. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Signed-off-by: Paul Flynn <pflynn-virtru@users.noreply.github.com>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
📝 Walkthrough
Merge Risk: ⚪ Minimal · up to
|
| Check name | Status | Explanation | Resolution |
|---|---|---|---|
| Docstring Coverage |  |
Docstring coverage is 33.33% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 6 functions across 2 files. | Write docstrings for the functions missing them to satisfy the coverage threshold. |
-
Check name Status Explanation Description Check Check skipped - CodeRabbit’s high-level summary is enabled. Title check The title clearly and concisely describes the main change: KAS now accepts spec-compliant policy bindings while preserving legacy support. Linked Issues check Check skipped because no linked issues were found for this pull request. Out of Scope Changes check Check skipped because no linked issues were found for this pull request.
- Fix all pre-merge checks with AI
✨ Finishing Touches: 💡 1
-
📝 Generate docstrings: 💡
-
- Commit to this branch
- Create a new PR
🧪 Generate unit tests (beta)
-
- Commit to this branch
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
A rabbit checks each encoded byte,
Raw HMACs decode just right.
Old hex paths still pass the test,
Bad input gets a clear request.
Then onward hops each KAO,
While carrots wait below.
Comment @coderabbitai help to get the list of available commands.
github-actions
Bot
added
comp:sdk
pflynn-virtru
force-pushed
the
fix/policy-binding-backcompat
branch
from
October 14, 2026 19:04
d73c7fa to
cae7caa
Compare
pflynn-virtru
changed the title
Contributor
Contributor
Benchmark results, click to expandBulk Benchmark Results
TDF3 Benchmark Results
|
pflynn-virtru
marked this pull request as ready for review
October 14, 2026 19:07
Contributor
Benchmark results, click to expandBulk Benchmark Results
TDF3 Benchmark Results
|
Contributor
|
Contributor
pflynn-virtru
added a commit
to opentdf/tests
that referenced
this pull request
Oct 14, 2026
The point is to show that a real KAS -- the current release and main -- rejects an on-spec policy binding. A force-only gate skipped exactly those cells, so drop it. The test fails until a platform carrying opentdf/platform#4223 is under test. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Signed-off-by: Paul Flynn <pflynn-virtru@users.noreply.github.com>
dmihalcik-virtru
approved these changes
Oct 15, 2026
This was referenced Oct 15, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
KAS now accepts both
Base64(HMAC)(spec) and legacyBase64(hex(HMAC)). Service-only; no output changes.Fixes the raw-binding path broken since #2095, which compared an untrimmed 33-byte buffer against the 32-byte HMAC, so no released KAS accepted the spec form.
🤖 Generated with Claude Code
Summary by CodeRabbit