Release 2.8.0 (2023-12-07)

### Features

* [reporting] Add noiser and bucketer for noising reporting inputs
* [reporting] Pass  modeling signals through noiser before being input to reportWin
* Add ps verbosity tf var
* Add scoring support for PAS
* Add support for new OHTTP request format.
* build PyTorch from source for B&A inference server.
* Collector script for performance testing
* **component auction:** Auction server passes top-level seller to scoreAd
* **component auction:** Auction service parses output and skips allowComponentAuctions = false ads
* **component auction:** Bidding server passes top-level seller to generateBid
* **component auction:** Bidding service parses output and skips allowComponentAuctions = false bids
* **component auction:** BuyerFrontEnd Service accepts and forwards top level seller
* **component auction:** Return error for Android device orchestrated component auctions
* **component auction:** SellerFrontEnd service accepts and forwards top level seller
* **component auction:** SFE service parses output cbor encodes for chrome
* includes git info tag for gcp docker images
* monitor key fetch metrics for B&A servers
* Partition request fail metric by the status message
* Upgrade functionaltest-system to v0.11.0

### Bug Fixes

* Add check for correct key ID in select_ad_reactor tests.
* consented logger memory leak
* Fixes test failures in select ad app reactor
* log missing key id in grpc status
* match copybara strip style for PyTorch build from source
* refactor gcp artifact build scripts to be more modular
* Remove local platform for common repo and update CloudPlatform
* Remove unnecessary reporting flags in gcp config
* update GCP build to write image_digest, not image id

### Dependencies

* **deps:** Upgrade data-plane-shared to commit 115edb3 2023-11-16

Bug: N/A
GitOrigin-RevId: 39dfbccd5ffb707d6ce6ddde5e5623f49f5a3827
Change-Id: I22fd9ec27ae480c0b7f7dec7cee9438777067b21

Author: dankocoj-google

.bazelrc

@@ -32,16 +32,12 @@ build:instance_aws --//:instance=aws
 build:instance_aws --@google_privacysandbox_servers_common//:instance=aws
 
 build:platform_local --//:platform=local
-build:platform_local --@google_privacysandbox_servers_common//:platform=local
-build:platform_local --@google_privacysandbox_servers_common//scp/cc/public/cpio/interface:platform=local
 
 build:platform_aws --//:platform=aws
 build:platform_aws --@google_privacysandbox_servers_common//:platform=aws
-build:platform_aws --@google_privacysandbox_servers_common//scp/cc/public/cpio/interface:platform=aws
 
 build:platform_gcp --//:platform=gcp
 build:platform_gcp --@google_privacysandbox_servers_common//:platform=gcp
-build:platform_gcp --@google_privacysandbox_servers_common//scp/cc/public/cpio/interface:platform=gcp
 
 build:local_aws --config=instance_local
 build:local_aws --config=platform_aws
@@ -58,6 +54,15 @@ build:local_local --config=platform_local
 build:aws_aws --config=instance_aws
 build:aws_aws --config=platform_aws
 
+build:non_prod --//:build_flavor=non_prod
+build:non_prod --@google_privacysandbox_servers_common//:build_flavor=non_prod
+build:prod --//:build_flavor=prod
+build:prod --@google_privacysandbox_servers_common//:build_flavor=prod
+
+build:inference_non_prod --//:build_flavor=non_prod
+build:inference_non_prod --//:inference_build=yes
+build:inference_non_prod --@google_privacysandbox_servers_common//:build_flavor=non_prod
+
 # Address sanitizer, set action_env to segregate cache entries
 build:asan --action_env=PRIVACY_SANDBOX_SERVERS_ASAN=1
 build:asan --strip=never
@@ -121,4 +126,4 @@ test:all-tests --build_tests_only
 test:all-tests --test_summary=detailed
 
 try-import %workspace%/builders/.coverage.bazelrc
-coverage --test_tag_filters=-nocoverage,small
+coverage --test_tag_filters=-flaky

.gitignore

@@ -14,9 +14,6 @@
 # Tar files
 *.tar
 
-# Specifically excluding presubmit.sh, though including its two versions
-ci/local/presubmit.sh
-
 # Terraform gitignore entries are taken from
 #  https://github.com/github/gitignore/blob/main/Terraform.gitignore
 

.pre-commit-config.yaml

@@ -51,9 +51,7 @@ repos:
   hooks:
   - id: git-check
   - id: script-must-not-have-extension
-    exclude: '(?x)^(
-        ci/local/presubmit_for_(local|docker)_bazel/presubmit.sh
-        )$'
+    exclude: production/packaging/gcp/build_and_test.sh
   - id: script-must-have-extension
   - id: require-ascii
     exclude: ^(CHANGELOG|.*RELEASE)\.md$

BUILD

@@ -133,3 +133,20 @@ config_setting(
     },
     visibility = ["//visibility:public"],
 )
+
+string_flag(
+    name = "build_for_test",
+    build_setting_default = "non_test",
+    values = [
+        "non_test",
+        "e2e",
+    ],
+)
+
+config_setting(
+    name = "e2e_build",
+    flag_values = {
+        ":build_for_test": "e2e",
+    },
+    visibility = ["//visibility:public"],
+)

CHANGELOG.md

@@ -2,6 +2,49 @@
 
 All notable changes to this project will be documented in this file. See [commit-and-tag-version](https://github.com/absolute-version/commit-and-tag-version) for commit guidelines.
 
+## 2.8.0 (2023-12-07)
+
+
+### Features
+
+* [reporting] Add noiser and bucketer for noising reporting inputs
+* [reporting] Pass  modeling signals through noiser before being input to reportWin
+* Add ps verbosity tf var
+* Add scoring support for PAS
+* Add support for new OHTTP request format.
+* build PyTorch from source for B&A inference server.
+* Collector script for performance testing
+* **component auction:** Auction server passes top-level seller to scoreAd
+* **component auction:** Auction service parses output and skips allowComponentAuctions = false ads
+* **component auction:** Bidding server passes top-level seller to generateBid
+* **component auction:** Bidding service parses output and skips allowComponentAuctions = false bids
+* **component auction:** BuyerFrontEnd Service accepts and forwards top level seller
+* **component auction:** Return error for Android device orchestrated component auctions
+* **component auction:** SellerFrontEnd service accepts and forwards top level seller
+* **component auction:** SFE service parses output cbor encodes for chrome
+* includes git info tag for gcp docker images
+* monitor key fetch metrics for B&A servers
+* Partition request fail metric by the status message
+* Upgrade functionaltest-system to v0.11.0
+
+
+### Bug Fixes
+
+* Add check for correct key ID in select_ad_reactor tests.
+* consented logger memory leak
+* Fixes test failures in select ad app reactor
+* log missing key id in grpc status
+* match copybara strip style for PyTorch build from source
+* refactor gcp artifact build scripts to be more modular
+* Remove local platform for common repo and update CloudPlatform
+* Remove unnecessary reporting flags in gcp config
+* update GCP build to write image_digest, not image id
+
+
+### Dependencies
+
+* **deps:** Upgrade data-plane-shared to commit 115edb3 2023-11-16
+
 ## 2.7.0 (2023-11-08)
 
 

WORKSPACE

@@ -1,22 +1,17 @@
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 
-### Git Submodules
-local_repository(
-    name = "google_privacysandbox_functionaltest_system",
-    path = "testing/functionaltest-system",
-)
-
 ### register Python toolchain -- note this toolchain defines the path to a specific version of python
 load("//builders/bazel:deps.bzl", "python_deps")
 
 python_deps("//builders/bazel")
 
 http_archive(
     name = "google_privacysandbox_servers_common",
-    sha256 = "2a00867b1d58f007f6aa26a8af3cda0b07f13976686775e468d997e8a5f9d2d3",
-    strip_prefix = "data-plane-shared-libraries-092c2f39d29144b6bd69e8ececb238e63fc7a82b",
+    # commit 5adea70 2023-11-27
+    sha256 = "307527d32534b2b77a70eff78ce405bcc749a31b90e4fbe4ca867634bcd6b2ca",
+    strip_prefix = "data-plane-shared-libraries-5adea7007167fc0bbff27f58217530e9f84ba333",
     urls = [
-        "https://github.com/privacysandbox/data-plane-shared-libraries/archive/092c2f39d29144b6bd69e8ececb238e63fc7a82b.zip",
+        "https://github.com/privacysandbox/data-plane-shared-libraries/archive/5adea7007167fc0bbff27f58217530e9f84ba333.zip",
     ],
 )
 
@@ -47,35 +42,10 @@ load("//third_party:container_deps.bzl", "container_deps")
 
 container_deps()
 
-load("@google_privacysandbox_servers_common//scp/build_defs/shared:rpm.bzl", rpmpack_repositories = "rpm")
-
-rpmpack_repositories()
-
 load("@com_github_google_rpmpack//:deps.bzl", "rpmpack_dependencies")
 
 rpmpack_dependencies()
 
-# Load the googleapis dependency.
-http_archive(
-    name = "com_google_googleapis",
-    build_file = "//third_party:googleapis.BUILD",
-    patch_args = ["-p1"],
-    # Scaffolding for patching googleapis after download. For example:
-    #   patches = ["googleapis.patch"]
-    # NOTE: This should only be used while developing with a new
-    # protobuf message. No changes to `patches` should ever be
-    # committed to the main branch.
-    patch_tool = "patch",
-    patches = [],
-    sha256 = "3e48e5833fcd2e1fcb8b6a5b7a88e18503b670e8636b868cdb5ac32e00fbdafb",
-    strip_prefix = "googleapis-2da477b6a72168c65fdb4245530cfa702cc4b029",
-    urls = [
-        "https://storage.googleapis.com/cloud-cpp-community-archive/com_google_googleapis/2da477b6a72168c65fdb4245530cfa702cc4b029.tar.gz",
-        "https://github.com/googleapis/googleapis/archive/2da477b6a72168c65fdb4245530cfa702cc4b029.tar.gz",
-    ],
-)
-
-# libcbor
 http_archive(
     name = "libcbor",
     build_file = "//third_party:libcbor.BUILD",
@@ -87,17 +57,10 @@ http_archive(
 )
 
 http_archive(
-    name = "com_google_differential_privacy",
-    sha256 = "b2e9afb2ea9337bb7c6302545b72e938707e8cdb3558ef38ce5cdd12fe2f182c",
-    strip_prefix = "differential-privacy-2.1.0",
-    url = "https://github.com/google/differential-privacy/archive/refs/tags/v2.1.0.tar.gz",
-)
-
-http_archive(
-    name = "com_google_cc_differential_privacy",
-    patch_args = ["-p1"],
-    patches = ["//third_party:differential_privacy.patch"],
-    sha256 = "b2e9afb2ea9337bb7c6302545b72e938707e8cdb3558ef38ce5cdd12fe2f182c",
-    strip_prefix = "differential-privacy-2.1.0/cc",
-    urls = ["https://github.com/google/differential-privacy/archive/refs/tags/v2.1.0.tar.gz"],
+    name = "service_value_key_fledge_privacysandbox",
+    # commit 1eee8e79e44f3ca735cfab0b716e57f81d95bd46 2023-10-26
+    strip_prefix = "fledge-key-value-service-1eee8e79e44f3ca735cfab0b716e57f81d95bd46",
+    urls = [
+        "https://github.com/privacysandbox/fledge-key-value-service/archive/1eee8e79e44f3ca735cfab0b716e57f81d95bd46.zip",
+    ],
 )

api/bidding_auction_servers.proto

@@ -277,8 +277,12 @@ message AuctionResult {
   // Type of the winning ad.
   AdType ad_type = 14;
 
-  // Top level seller name/domain returned for component auctions.
+  // Optional name/domain for top-level seller in case this
+  // is a component auction.
   string top_level_seller = 15;
+
+  // Arbitrary metadata to pass to the top-level seller.
+  string ad_metadata = 16;
 }
 
 // SellerFrontEnd service (also known as SFE) operated by SSP / Seller.

production/deploy/aws/terraform/environment/demo/seller/seller.tf

@@ -92,10 +92,10 @@ module "seller" {
     #     "protectedAppSignalsBuyerReportWinJsUrls": {"https://buyerA_origin.com":"https://buyerA.com/generateBid.js"}
 
     #  }"
-    JS_NUM_WORKERS      = "" # Example: "48" Must be <=vCPUs in auction_enclave_cpu_count.
-    JS_WORKER_QUEUE_LEN = "" # Example: "100".
-    ROMA_TIMEOUT_MS     = "" # Example: "10000"
-
+    JS_NUM_WORKERS                  = "" # Example: "48" Must be <=vCPUs in auction_enclave_cpu_count.
+    JS_WORKER_QUEUE_LEN             = "" # Example: "100".
+    ROMA_TIMEOUT_MS                 = "" # Example: "10000"
+    ENABLE_REPORT_WIN_INPUT_NOISING = "" # Example: "false"
     # Reach out to the Privacy Sandbox B&A team to enroll with Coordinators and update the following flag values.
     # More information on enrollment can be found here: https://github.com/privacysandbox/fledge-docs/blob/main/bidding_auction_services_api.md#enroll-with-coordinators
     # Coordinator-based attestation flags:

production/deploy/aws/terraform/services/iam_role_policies/main.tf

@@ -41,7 +41,7 @@ data "aws_iam_policy_document" "instance_policy_doc" {
   }
   statement {
     sid       = "AllowInstancesToReadParameters"
-    actions   = ["ssm:GetParameters"]
+    actions   = ["ssm:GetParameter"]
     effect    = "Allow"
     resources = ["*"]
   }

production/deploy/gcp/terraform/environment/demo/buyer/buyer.tf

@@ -88,9 +88,10 @@ module "buyer" {
     ENABLE_OTEL_BASED_LOGGING = "" # Example: "false"
     CONSENTED_DEBUG_TOKEN     = "" # Example: "<unique_id>"
 
-    # Reach out to the Privacy Sandbox B&A team to enroll with Coordinators and update the following flag values.
+    # Coordinator-based attestation flags.
+    # These flags are production-ready and you do not need to change them.
+    # Reach out to the Privacy Sandbox B&A team to enroll with Coordinators.
     # More information on enrollment can be found here: https://github.com/privacysandbox/fledge-docs/blob/main/bidding_auction_services_api.md#enroll-with-coordinators
-    # Coordinator-based attestation flags:
     PUBLIC_KEY_ENDPOINT                           = "https://publickeyservice.pa.gcp.privacysandboxservices.com/.well-known/protected-auction/v1/public-keys"
     PRIMARY_COORDINATOR_PRIVATE_KEY_ENDPOINT      = "https://privatekeyservice-a.pa-1.gcp.privacysandboxservices.com/v1alpha/encryptionKeys"
     SECONDARY_COORDINATOR_PRIVATE_KEY_ENDPOINT    = "https://privatekeyservice-b.pa-2.gcp.privacysandboxservices.com/v1alpha/encryptionKeys"