fix(cli): DSPX-4168 allow Linux profile authentication by jakedoublev · Pull Request #4235 · opentdf/platform

jakedoublev · 2026-10-16T03:50:21Z

Remove the blanket Linux auth block while preserving encrypted profile storage. Document Secret Service requirements and headless credential flags, and cover Linux profile authentication and logout with BATS.

Summary by CodeRabbit

Documentation
- Added Linux guidance explaining that profile encryption requires an available, unlocked Secret Service keyring in the current D-Bus session. For headless systems without one, the guide describes using client-credentials authentication with --host for platform commands.
Bug Fixes
- Linux authentication commands no longer display the keyring-availability warning.
- Added a Linux authentication regression check for environments with a D-Bus session.

Signed-off-by: jakedoublev <jake.vanvorhis@virtru.com>

coderabbitai · 2026-10-16T03:50:30Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI
Review profile: ASSERTIVE
Plan: Advanced
Run ID: 0bc0b7cd-b650-4487-8a4b-97bc7fc98783

📥 Commits

Reviewing files that changed from the base of the PR and between b048476 and 178c53c.

📒 Files selected for processing: 4

otdfctl/README.md
otdfctl/cmd/auth/auth.go
otdfctl/cmd/auth/auth_test.go
otdfctl/e2e/auth.bats

💤 Files with no reviewable changes: 1

otdfctl/cmd/auth/auth_test.go

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Walkthrough

The auth command no longer installs a Linux keyring warning hook. A Linux end-to-end test checks authentication behavior, and the README documents profile keyring requirements and a headless-system workaround.

Changes: Linux authentication

Layer / File(s)	Summary
Authentication behavior and guidance `otdfctl/cmd/auth/auth.go`, `otdfctl/cmd/auth/auth_test.go`, `otdfctl/e2e/auth.bats`, `otdfctl/README.md`	The auth command no longer installs a Linux keyring warning hook. The Linux end-to-end test checks client-credential login and logout without the warning. The README documents profile keyring requirements and headless-system usage.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Suggested reviewers: alkalescent

Merge Risk: ⚪ Minimal · up to 178c5

The Linux test runner provisions an unlocked keyring, and the documented headless platform-command flow avoids keyring-backed profiles. No actionable merge-blocking risk was identified.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 2 files. (1 skipped: 1 …	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely identifies the main change: enabling Linux profile authentication.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 2 files. (1 skipped: 1 unsupported.)

Fix all pre-merge checks with AI

✨ Finishing Touches: 💡 2

📝 Generate docstrings: 💡

Commit to this branch
Create a new PR

🛠️ Fix failing CI checks: 💡

Commit to this branch
Create a new PR

🧪 Generate unit tests (beta)

Commit to this branch
Create a new PR

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{A rabbit checks the keyring door
Then tests the login path once more
The warning hops out of the way
The README shows a headless way
And logout closes out the day}

_{Comment @coderabbitai help to get the list of available commands.}

Signed-off-by: jakedoublev <jake.vanvorhis@virtru.com>

github-actions · 2026-10-16T03:54:59Z

Benchmark results, click to expand

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	353.693851ms
Throughput	282.73 requests/second

TDF3 Benchmark Results

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	37.7047516s
Average Latency	376.258893ms
Throughput	132.61 requests/second

Signed-off-by: jakedoublev <jake.vanvorhis@virtru.com>

github-actions · 2026-10-16T03:55:15Z

X-Test Failure Report

govulncheck-failure-2
govulncheck-failure-0
govulncheck-failure-4
opentdf~~platform~~JYD2LJ.dockerbuild
govulncheck-failure-7
govulncheck-failure-1

github-actions · 2026-10-16T03:55:48Z

X-Test Failure Report

govulncheck-failure-4

github-actions · 2026-10-16T03:58:28Z

Benchmark results, click to expand

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	235.999222ms
Throughput	423.73 requests/second

TDF3 Benchmark Results

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	26.097346403s
Average Latency	260.37439ms
Throughput	191.59 requests/second

github-actions · 2026-10-16T03:58:33Z

Benchmark results, click to expand

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	335.729575ms
Throughput	297.86 requests/second

TDF3 Benchmark Results

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	33.729183076s
Average Latency	336.65329ms
Throughput	148.24 requests/second

github-actions · 2026-10-16T04:04:18Z

⚠️ Govulncheck found vulnerabilities ⚠️

The following modules have known vulnerabilities:

otdfctl
sdk
service
lib/fixtures
tests-bdd

See the workflow run for details.

github-actions · 2026-10-16T04:09:20Z

c-r33d · 2026-10-19T14:47:03Z

Seems fine, if the goal is to unblock non-headless systems where customers have the identified system config.

fix(otdfctl): allow Linux profile authentication

245d357

Signed-off-by: jakedoublev <jake.vanvorhis@virtru.com>

github-actions Bot added the size/s label Oct 16, 2026

refactor(otdfctl): drop framework-only auth test

b55631b

Signed-off-by: jakedoublev <jake.vanvorhis@virtru.com>

refactor(otdfctl): drop root flag validation test

178c53c

Signed-off-by: jakedoublev <jake.vanvorhis@virtru.com>

jakedoublev changed the title ~~fix(otdfctl): allow Linux profile authentication~~ fix(cli): DSPX-4168 allow Linux profile authentication Oct 16, 2026

jakedoublev marked this pull request as ready for review October 16, 2026 03:57

jakedoublev requested a review from a team as a code owner October 16, 2026 03:57

c-r33d approved these changes Oct 19, 2026

View reviewed changes

jakedoublev added this pull request to the merge queue Oct 19, 2026

Merged via the queue into main with commit 118e11c Oct 19, 2026
48 of 50 checks passed

jakedoublev deleted the fix/otdfctl-linux-auth branch October 19, 2026 14:53

opentdf-automation Bot mentioned this pull request Oct 19, 2026

chore(main): release otdfctl 0.39.0 #4101

Open

Navigation Menu

Repository navigation

fix(cli): DSPX-4168 allow Linux profile authentication - #4235

fix(cli): DSPX-4168 allow Linux profile authentication#4235
jakedoublev merged 3 commits into
mainfrom
fix/otdfctl-linux-auth

jakedoublev commented Oct 16, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Oct 16, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 16, 2026

Bulk Benchmark Results

TDF3 Benchmark Results

Uh oh!

github-actions Bot commented Oct 16, 2026

Uh oh!

github-actions Bot commented Oct 16, 2026

Uh oh!

github-actions Bot commented Oct 16, 2026

Bulk Benchmark Results

TDF3 Benchmark Results

Uh oh!

github-actions Bot commented Oct 16, 2026

Bulk Benchmark Results

TDF3 Benchmark Results

Uh oh!

github-actions Bot commented Oct 16, 2026

Uh oh!

github-actions Bot commented Oct 16, 2026

Uh oh!

c-r33d commented Oct 19, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

jakedoublev commented Oct 16, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Oct 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 16, 2026

Bulk Benchmark Results

TDF3 Benchmark Results

Uh oh!

github-actions Bot commented Oct 16, 2026

X-Test Failure Report

Uh oh!

github-actions Bot commented Oct 16, 2026

X-Test Failure Report

Uh oh!

github-actions Bot commented Oct 16, 2026

Bulk Benchmark Results

TDF3 Benchmark Results

Uh oh!

github-actions Bot commented Oct 16, 2026

Bulk Benchmark Results

TDF3 Benchmark Results

Uh oh!

github-actions Bot commented Oct 16, 2026

⚠️ Govulncheck found vulnerabilities ⚠️

Uh oh!

github-actions Bot commented Oct 16, 2026

X-Test Results

Uh oh!

c-r33d commented Oct 19, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

jakedoublev commented Oct 16, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Oct 16, 2026 •

edited

Loading