From cfb4515c7d8f85eaf7db9b7e949f97c0c9004929 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marc-Andr=C3=A9=20Tremblay?= <1619947+marctrem@users.noreply.github.com> Date: Tue, 13 Oct 2026 14:16:22 -0400 Subject: [PATCH] Remove the unsigned attestation field from SignedRequest Nothing set or read field 5, and it sat outside the signed bytes. Reserve the number and name. Regenerate gen/, which also picks up the revision type change already on main. --- .../requestsigning/v1/signed_request_pb.ts | 11 +----- .../v1/base_resource_attributes_pb.ts | 11 +++--- .../requestsigning/v1/signed_request.pb.go | 37 ++++++------------- .../v1/base_resource_attributes.pb.go | 11 +++--- .../requestsigning/v1/signed_request.proto | 5 +-- 5 files changed, 27 insertions(+), 48 deletions(-) diff --git a/gen/es/proto/splitsecure/requestsigning/v1/signed_request_pb.ts b/gen/es/proto/splitsecure/requestsigning/v1/signed_request_pb.ts index adf7acc..56d8232 100644 --- a/gen/es/proto/splitsecure/requestsigning/v1/signed_request_pb.ts +++ b/gen/es/proto/splitsecure/requestsigning/v1/signed_request_pb.ts @@ -6,8 +6,6 @@ import type { GenFile, GenMessage } from "@bufbuild/protobuf/codegenv2"; import { fileDesc, messageDesc } from "@bufbuild/protobuf/codegenv2"; import type { Any, Timestamp } from "@bufbuild/protobuf/wkt"; import { file_google_protobuf_any, file_google_protobuf_timestamp } from "@bufbuild/protobuf/wkt"; -import type { Generic } from "../../attestation/v1/generic_pb"; -import { file_splitsecure_attestation_v1_generic } from "../../attestation/v1/generic_pb"; import type { Graph } from "../../delegationgraph/v1/graph_pb"; import { file_splitsecure_delegationgraph_v1_graph } from "../../delegationgraph/v1/graph_pb"; import type { Signature } from "../../hybridkeyset/v1/signature_pb"; @@ -18,7 +16,7 @@ import type { Message } from "@bufbuild/protobuf"; * Describes the file splitsecure/requestsigning/v1/signed_request.proto. */ export const file_splitsecure_requestsigning_v1_signed_request: GenFile = /*@__PURE__*/ - fileDesc("CjJzcGxpdHNlY3VyZS9yZXF1ZXN0c2lnbmluZy92MS9zaWduZWRfcmVxdWVzdC5wcm90bxIdc3BsaXRzZWN1cmUucmVxdWVzdHNpZ25pbmcudjEi1AIKDVNpZ25lZFJlcXVlc3QSFAoMcmVxdWVzdG9yX2lkGAIgASgMEjQKBWdyYXBoGAMgASgLMiUuc3BsaXRzZWN1cmUuZGVsZWdhdGlvbmdyYXBoLnYxLkdyYXBoEjkKCXNpZ25hdHVyZRgEIAEoCzImLnNwbGl0c2VjdXJlLmh5YnJpZGtleXNldC52MS5TaWduYXR1cmUSOAoLYXR0ZXN0YXRpb24YBSABKAsyIy5zcGxpdHNlY3VyZS5hdHRlc3RhdGlvbi52MS5HZW5lcmljEhUKDWF1dGhlbnRpY2F0ZWQYASABKAwaawoNQXV0aGVudGljYXRlZBIqCgxiYXNlX3JlcXVlc3QYASABKAsyFC5nb29nbGUucHJvdG9idWYuQW55Ei4KCmNyZWF0ZWRfb24YAiABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wQqYCCiFjb20uc3BsaXRzZWN1cmUucmVxdWVzdHNpZ25pbmcudjFCElNpZ25lZFJlcXVlc3RQcm90b1ABWldnaXRodWIuY29tL3NwbGl0c2VjdXJlL2FwaXMvZ2VuL2dvL3Byb3RvL3NwbGl0c2VjdXJlL3JlcXVlc3RzaWduaW5nL3YxO3JlcXVlc3RzaWduaW5ndjGiAgNTUliqAh1TcGxpdHNlY3VyZS5SZXF1ZXN0c2lnbmluZy5WMcoCHVNwbGl0c2VjdXJlXFJlcXVlc3RzaWduaW5nXFYx4gIpU3BsaXRzZWN1cmVcUmVxdWVzdHNpZ25pbmdcVjFcR1BCTWV0YWRhdGHqAh9TcGxpdHNlY3VyZTo6UmVxdWVzdHNpZ25pbmc6OlYxYgZwcm90bzM", [file_google_protobuf_any, file_google_protobuf_timestamp, file_splitsecure_attestation_v1_generic, file_splitsecure_delegationgraph_v1_graph, file_splitsecure_hybridkeyset_v1_signature]); + fileDesc("CjJzcGxpdHNlY3VyZS9yZXF1ZXN0c2lnbmluZy92MS9zaWduZWRfcmVxdWVzdC5wcm90bxIdc3BsaXRzZWN1cmUucmVxdWVzdHNpZ25pbmcudjEirQIKDVNpZ25lZFJlcXVlc3QSFAoMcmVxdWVzdG9yX2lkGAIgASgMEjQKBWdyYXBoGAMgASgLMiUuc3BsaXRzZWN1cmUuZGVsZWdhdGlvbmdyYXBoLnYxLkdyYXBoEjkKCXNpZ25hdHVyZRgEIAEoCzImLnNwbGl0c2VjdXJlLmh5YnJpZGtleXNldC52MS5TaWduYXR1cmUSFQoNYXV0aGVudGljYXRlZBgBIAEoDBprCg1BdXRoZW50aWNhdGVkEioKDGJhc2VfcmVxdWVzdBgBIAEoCzIULmdvb2dsZS5wcm90b2J1Zi5BbnkSLgoKY3JlYXRlZF9vbhgCIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXBKBAgFEAZSC2F0dGVzdGF0aW9uQqYCCiFjb20uc3BsaXRzZWN1cmUucmVxdWVzdHNpZ25pbmcudjFCElNpZ25lZFJlcXVlc3RQcm90b1ABWldnaXRodWIuY29tL3NwbGl0c2VjdXJlL2FwaXMvZ2VuL2dvL3Byb3RvL3NwbGl0c2VjdXJlL3JlcXVlc3RzaWduaW5nL3YxO3JlcXVlc3RzaWduaW5ndjGiAgNTUliqAh1TcGxpdHNlY3VyZS5SZXF1ZXN0c2lnbmluZy5WMcoCHVNwbGl0c2VjdXJlXFJlcXVlc3RzaWduaW5nXFYx4gIpU3BsaXRzZWN1cmVcUmVxdWVzdHNpZ25pbmdcVjFcR1BCTWV0YWRhdGHqAh9TcGxpdHNlY3VyZTo6UmVxdWVzdHNpZ25pbmc6OlYxYgZwcm90bzM", [file_google_protobuf_any, file_google_protobuf_timestamp, file_splitsecure_delegationgraph_v1_graph, file_splitsecure_hybridkeyset_v1_signature]); /** * @generated from message splitsecure.requestsigning.v1.SignedRequest @@ -41,13 +39,6 @@ export type SignedRequest = Message<"splitsecure.requestsigning.v1.SignedRequest */ signature?: Signature | undefined; - /** - * attestation present only if request comes from an enclave - * - * @generated from field: splitsecure.attestation.v1.Generic attestation = 5; - */ - attestation?: Generic | undefined; - /** * contains SignedRequest_Authenticated * diff --git a/gen/es/proto/splitsecure/teamresource/v1/base_resource_attributes_pb.ts b/gen/es/proto/splitsecure/teamresource/v1/base_resource_attributes_pb.ts index 8a37367..2ece8b7 100644 --- a/gen/es/proto/splitsecure/teamresource/v1/base_resource_attributes_pb.ts +++ b/gen/es/proto/splitsecure/teamresource/v1/base_resource_attributes_pb.ts @@ -14,7 +14,7 @@ import type { Message } from "@bufbuild/protobuf"; * Describes the file splitsecure/teamresource/v1/base_resource_attributes.proto. */ export const file_splitsecure_teamresource_v1_base_resource_attributes: GenFile = /*@__PURE__*/ - fileDesc("CjpzcGxpdHNlY3VyZS90ZWFtcmVzb3VyY2UvdjEvYmFzZV9yZXNvdXJjZV9hdHRyaWJ1dGVzLnByb3RvEhtzcGxpdHNlY3VyZS50ZWFtcmVzb3VyY2UudjEirAIKFkJhc2VSZXNvdXJjZUF0dHJpYnV0ZXMSDAoEbmFtZRgBIAEoCRITCgtkZXNjcmlwdGlvbhgCIAEoCRJMChNub3RpZmljYXRpb25fcG9saWN5GAMgASgOMi8uc3BsaXRzZWN1cmUudGVhbXJlc291cmNlLnYxLk5vdGlmaWNhdGlvblBvbGljeRJECgtzZW5zaXRpdml0eRgEIAEoCzIvLnNwbGl0c2VjdXJlLnRlYW1yZXNvdXJjZS52MS5BY2NvdW50U2Vuc2l0aXZpdHkSEwoLcHJvcG9zYWxfaWQYBSABKAwSIAoYcmVxdWVzdGVkX3BhcmVudF9ub2RlX2lkGAYgASgJEhIKCmxpbmVhZ2VfaWQYByABKAwSEAoIcmV2aXNpb24YCCABKARCoQIKH2NvbS5zcGxpdHNlY3VyZS50ZWFtcmVzb3VyY2UudjFCG0Jhc2VSZXNvdXJjZUF0dHJpYnV0ZXNQcm90b1ABWlNnaXRodWIuY29tL3NwbGl0c2VjdXJlL2FwaXMvZ2VuL2dvL3Byb3RvL3NwbGl0c2VjdXJlL3RlYW1yZXNvdXJjZS92MTt0ZWFtcmVzb3VyY2V2MaICA1NUWKoCG1NwbGl0c2VjdXJlLlRlYW1yZXNvdXJjZS5WMcoCG1NwbGl0c2VjdXJlXFRlYW1yZXNvdXJjZVxWMeICJ1NwbGl0c2VjdXJlXFRlYW1yZXNvdXJjZVxWMVxHUEJNZXRhZGF0YeoCHVNwbGl0c2VjdXJlOjpUZWFtcmVzb3VyY2U6OlYxYgZwcm90bzM", [file_splitsecure_teamresource_v1_account_sensitivity, file_splitsecure_teamresource_v1_notification_policy]); + fileDesc("CjpzcGxpdHNlY3VyZS90ZWFtcmVzb3VyY2UvdjEvYmFzZV9yZXNvdXJjZV9hdHRyaWJ1dGVzLnByb3RvEhtzcGxpdHNlY3VyZS50ZWFtcmVzb3VyY2UudjEirAIKFkJhc2VSZXNvdXJjZUF0dHJpYnV0ZXMSDAoEbmFtZRgBIAEoCRITCgtkZXNjcmlwdGlvbhgCIAEoCRJMChNub3RpZmljYXRpb25fcG9saWN5GAMgASgOMi8uc3BsaXRzZWN1cmUudGVhbXJlc291cmNlLnYxLk5vdGlmaWNhdGlvblBvbGljeRJECgtzZW5zaXRpdml0eRgEIAEoCzIvLnNwbGl0c2VjdXJlLnRlYW1yZXNvdXJjZS52MS5BY2NvdW50U2Vuc2l0aXZpdHkSEwoLcHJvcG9zYWxfaWQYBSABKAwSIAoYcmVxdWVzdGVkX3BhcmVudF9ub2RlX2lkGAYgASgJEhIKCmxpbmVhZ2VfaWQYByABKAwSEAoIcmV2aXNpb24YCCABKA1CoQIKH2NvbS5zcGxpdHNlY3VyZS50ZWFtcmVzb3VyY2UudjFCG0Jhc2VSZXNvdXJjZUF0dHJpYnV0ZXNQcm90b1ABWlNnaXRodWIuY29tL3NwbGl0c2VjdXJlL2FwaXMvZ2VuL2dvL3Byb3RvL3NwbGl0c2VjdXJlL3RlYW1yZXNvdXJjZS92MTt0ZWFtcmVzb3VyY2V2MaICA1NUWKoCG1NwbGl0c2VjdXJlLlRlYW1yZXNvdXJjZS5WMcoCG1NwbGl0c2VjdXJlXFRlYW1yZXNvdXJjZVxWMeICJ1NwbGl0c2VjdXJlXFRlYW1yZXNvdXJjZVxWMVxHUEJNZXRhZGF0YeoCHVNwbGl0c2VjdXJlOjpUZWFtcmVzb3VyY2U6OlYxYgZwcm90bzM", [file_splitsecure_teamresource_v1_account_sensitivity, file_splitsecure_teamresource_v1_notification_policy]); /** * BaseResourceAttributes holds the common metadata shared by all managed resources. @@ -77,13 +77,14 @@ export type BaseResourceAttributes = Message<"splitsecure.teamresource.v1.BaseRe lineageId: Uint8Array; /** - * revision counts supersessions within a lineage: 0 at genesis, and the + * revision counts supersessions within a lineage: 1 at genesis, and the * enclave stamps predecessor.revision + 1 into the signed bytes of each - * superseding CREATE. Callers never set this directly. + * superseding CREATE. Callers never set this directly. Never 0 — 0 is the + * "latest" sentinel the read lanes use to select a revision. * - * @generated from field: uint64 revision = 8; + * @generated from field: uint32 revision = 8; */ - revision: bigint; + revision: number; }; /** diff --git a/gen/go/proto/splitsecure/requestsigning/v1/signed_request.pb.go b/gen/go/proto/splitsecure/requestsigning/v1/signed_request.pb.go index edb82b8..87ed993 100644 --- a/gen/go/proto/splitsecure/requestsigning/v1/signed_request.pb.go +++ b/gen/go/proto/splitsecure/requestsigning/v1/signed_request.pb.go @@ -7,7 +7,6 @@ package requestsigningv1 import ( - v12 "github.com/splitsecure/apis/gen/go/proto/splitsecure/attestation/v1" v1 "github.com/splitsecure/apis/gen/go/proto/splitsecure/delegationgraph/v1" v11 "github.com/splitsecure/apis/gen/go/proto/splitsecure/hybridkeyset/v1" protoreflect "google.golang.org/protobuf/reflect/protoreflect" @@ -32,8 +31,6 @@ type SignedRequest struct { RequestorId []byte `protobuf:"bytes,2,opt,name=requestor_id,json=requestorId,proto3" json:"requestor_id,omitempty"` Graph *v1.Graph `protobuf:"bytes,3,opt,name=graph,proto3" json:"graph,omitempty"` Signature *v11.Signature `protobuf:"bytes,4,opt,name=signature,proto3" json:"signature,omitempty"` - // attestation present only if request comes from an enclave - Attestation *v12.Generic `protobuf:"bytes,5,opt,name=attestation,proto3" json:"attestation,omitempty"` // contains SignedRequest_Authenticated Authenticated []byte `protobuf:"bytes,1,opt,name=authenticated,proto3" json:"authenticated,omitempty"` unknownFields protoimpl.UnknownFields @@ -91,13 +88,6 @@ func (x *SignedRequest) GetSignature() *v11.Signature { return nil } -func (x *SignedRequest) GetAttestation() *v12.Generic { - if x != nil { - return x.Attestation - } - return nil -} - func (x *SignedRequest) GetAuthenticated() []byte { if x != nil { return x.Authenticated @@ -161,17 +151,16 @@ var File_splitsecure_requestsigning_v1_signed_request_proto protoreflect.FileDes const file_splitsecure_requestsigning_v1_signed_request_proto_rawDesc = "" + "\n" + - "2splitsecure/requestsigning/v1/signed_request.proto\x12\x1dsplitsecure.requestsigning.v1\x1a\x19google/protobuf/any.proto\x1a\x1fgoogle/protobuf/timestamp.proto\x1a(splitsecure/attestation/v1/generic.proto\x1a*splitsecure/delegationgraph/v1/graph.proto\x1a+splitsecure/hybridkeyset/v1/signature.proto\"\xa8\x03\n" + + "2splitsecure/requestsigning/v1/signed_request.proto\x12\x1dsplitsecure.requestsigning.v1\x1a\x19google/protobuf/any.proto\x1a\x1fgoogle/protobuf/timestamp.proto\x1a*splitsecure/delegationgraph/v1/graph.proto\x1a+splitsecure/hybridkeyset/v1/signature.proto\"\xf4\x02\n" + "\rSignedRequest\x12!\n" + "\frequestor_id\x18\x02 \x01(\fR\vrequestorId\x12;\n" + "\x05graph\x18\x03 \x01(\v2%.splitsecure.delegationgraph.v1.GraphR\x05graph\x12D\n" + - "\tsignature\x18\x04 \x01(\v2&.splitsecure.hybridkeyset.v1.SignatureR\tsignature\x12E\n" + - "\vattestation\x18\x05 \x01(\v2#.splitsecure.attestation.v1.GenericR\vattestation\x12$\n" + + "\tsignature\x18\x04 \x01(\v2&.splitsecure.hybridkeyset.v1.SignatureR\tsignature\x12$\n" + "\rauthenticated\x18\x01 \x01(\fR\rauthenticated\x1a\x83\x01\n" + "\rAuthenticated\x127\n" + "\fbase_request\x18\x01 \x01(\v2\x14.google.protobuf.AnyR\vbaseRequest\x129\n" + "\n" + - "created_on\x18\x02 \x01(\v2\x1a.google.protobuf.TimestampR\tcreatedOnB\xa6\x02\n" + + "created_on\x18\x02 \x01(\v2\x1a.google.protobuf.TimestampR\tcreatedOnJ\x04\b\x05\x10\x06R\vattestationB\xa6\x02\n" + "!com.splitsecure.requestsigning.v1B\x12SignedRequestProtoP\x01ZWgithub.com/splitsecure/apis/gen/go/proto/splitsecure/requestsigning/v1;requestsigningv1\xa2\x02\x03SRX\xaa\x02\x1dSplitsecure.Requestsigning.V1\xca\x02\x1dSplitsecure\\Requestsigning\\V1\xe2\x02)Splitsecure\\Requestsigning\\V1\\GPBMetadata\xea\x02\x1fSplitsecure::Requestsigning::V1b\x06proto3" var ( @@ -192,21 +181,19 @@ var file_splitsecure_requestsigning_v1_signed_request_proto_goTypes = []any{ (*SignedRequest_Authenticated)(nil), // 1: splitsecure.requestsigning.v1.SignedRequest.Authenticated (*v1.Graph)(nil), // 2: splitsecure.delegationgraph.v1.Graph (*v11.Signature)(nil), // 3: splitsecure.hybridkeyset.v1.Signature - (*v12.Generic)(nil), // 4: splitsecure.attestation.v1.Generic - (*anypb.Any)(nil), // 5: google.protobuf.Any - (*timestamppb.Timestamp)(nil), // 6: google.protobuf.Timestamp + (*anypb.Any)(nil), // 4: google.protobuf.Any + (*timestamppb.Timestamp)(nil), // 5: google.protobuf.Timestamp } var file_splitsecure_requestsigning_v1_signed_request_proto_depIdxs = []int32{ 2, // 0: splitsecure.requestsigning.v1.SignedRequest.graph:type_name -> splitsecure.delegationgraph.v1.Graph 3, // 1: splitsecure.requestsigning.v1.SignedRequest.signature:type_name -> splitsecure.hybridkeyset.v1.Signature - 4, // 2: splitsecure.requestsigning.v1.SignedRequest.attestation:type_name -> splitsecure.attestation.v1.Generic - 5, // 3: splitsecure.requestsigning.v1.SignedRequest.Authenticated.base_request:type_name -> google.protobuf.Any - 6, // 4: splitsecure.requestsigning.v1.SignedRequest.Authenticated.created_on:type_name -> google.protobuf.Timestamp - 5, // [5:5] is the sub-list for method output_type - 5, // [5:5] is the sub-list for method input_type - 5, // [5:5] is the sub-list for extension type_name - 5, // [5:5] is the sub-list for extension extendee - 0, // [0:5] is the sub-list for field type_name + 4, // 2: splitsecure.requestsigning.v1.SignedRequest.Authenticated.base_request:type_name -> google.protobuf.Any + 5, // 3: splitsecure.requestsigning.v1.SignedRequest.Authenticated.created_on:type_name -> google.protobuf.Timestamp + 4, // [4:4] is the sub-list for method output_type + 4, // [4:4] is the sub-list for method input_type + 4, // [4:4] is the sub-list for extension type_name + 4, // [4:4] is the sub-list for extension extendee + 0, // [0:4] is the sub-list for field type_name } func init() { file_splitsecure_requestsigning_v1_signed_request_proto_init() } diff --git a/gen/go/proto/splitsecure/teamresource/v1/base_resource_attributes.pb.go b/gen/go/proto/splitsecure/teamresource/v1/base_resource_attributes.pb.go index a8543b5..4a9ad72 100644 --- a/gen/go/proto/splitsecure/teamresource/v1/base_resource_attributes.pb.go +++ b/gen/go/proto/splitsecure/teamresource/v1/base_resource_attributes.pb.go @@ -48,10 +48,11 @@ type BaseResourceAttributes struct { // its own signed issuance bytes (genesis IS its own lineage). Callers // never set this directly; it is enclave-derived only. LineageId []byte `protobuf:"bytes,7,opt,name=lineage_id,json=lineageId,proto3" json:"lineage_id,omitempty"` - // revision counts supersessions within a lineage: 0 at genesis, and the + // revision counts supersessions within a lineage: 1 at genesis, and the // enclave stamps predecessor.revision + 1 into the signed bytes of each - // superseding CREATE. Callers never set this directly. - Revision uint64 `protobuf:"varint,8,opt,name=revision,proto3" json:"revision,omitempty"` + // superseding CREATE. Callers never set this directly. Never 0 — 0 is the + // "latest" sentinel the read lanes use to select a revision. + Revision uint32 `protobuf:"varint,8,opt,name=revision,proto3" json:"revision,omitempty"` unknownFields protoimpl.UnknownFields sizeCache protoimpl.SizeCache } @@ -135,7 +136,7 @@ func (x *BaseResourceAttributes) GetLineageId() []byte { return nil } -func (x *BaseResourceAttributes) GetRevision() uint64 { +func (x *BaseResourceAttributes) GetRevision() uint32 { if x != nil { return x.Revision } @@ -157,7 +158,7 @@ const file_splitsecure_teamresource_v1_base_resource_attributes_proto_rawDesc = "\x18requested_parent_node_id\x18\x06 \x01(\tR\x15requestedParentNodeId\x12\x1d\n" + "\n" + "lineage_id\x18\a \x01(\fR\tlineageId\x12\x1a\n" + - "\brevision\x18\b \x01(\x04R\brevisionB\xa1\x02\n" + + "\brevision\x18\b \x01(\rR\brevisionB\xa1\x02\n" + "\x1fcom.splitsecure.teamresource.v1B\x1bBaseResourceAttributesProtoP\x01ZSgithub.com/splitsecure/apis/gen/go/proto/splitsecure/teamresource/v1;teamresourcev1\xa2\x02\x03STX\xaa\x02\x1bSplitsecure.Teamresource.V1\xca\x02\x1bSplitsecure\\Teamresource\\V1\xe2\x02'Splitsecure\\Teamresource\\V1\\GPBMetadata\xea\x02\x1dSplitsecure::Teamresource::V1b\x06proto3" var ( diff --git a/proto/splitsecure/requestsigning/v1/signed_request.proto b/proto/splitsecure/requestsigning/v1/signed_request.proto index 0038c70..fda0eab 100644 --- a/proto/splitsecure/requestsigning/v1/signed_request.proto +++ b/proto/splitsecure/requestsigning/v1/signed_request.proto @@ -3,7 +3,6 @@ package splitsecure.requestsigning.v1; import "google/protobuf/any.proto"; import "google/protobuf/timestamp.proto"; -import "splitsecure/attestation/v1/generic.proto"; import "splitsecure/delegationgraph/v1/graph.proto"; import "splitsecure/hybridkeyset/v1/signature.proto"; @@ -14,8 +13,8 @@ message SignedRequest { splitsecure.delegationgraph.v1.Graph graph = 3; splitsecure.hybridkeyset.v1.Signature signature = 4; - // attestation present only if request comes from an enclave - splitsecure.attestation.v1.Generic attestation = 5; + reserved 5; + reserved "attestation"; // contains SignedRequest_Authenticated bytes authenticated = 1;