Skip to content
This repository was archived by the owner on Mar 24, 2026. It is now read-only.

Commit 87b9dd9

Browse files
mittalprakharmittalprakhar
committed
Release 4.9.0 (2025-04-16)
### ⚠ BREAKING CHANGES * Non-Production builds: Adtechs running non-prod builds must upgrade both the buyer and seller non-prod stacks to 4.9. Note: This change does not impact production environments. ### Features * [Azure] Add azure to otel zone and region config * [Azure] Add support for azure build bazel build flags * [Azure] Add comment to Azure documentation * [Azure] Add more descriptive comments * [Azure] Add Parc ConfigMap Hash to the backend service deployment * [Azure] B&A docker image build scripts for azure * [Azure] Create Kubernetes Services to enable traffic to bidding and auction servers pods via IaC (Terraform) * [Azure] Create region-specific virtual network and subnets with dynamic delegation via IaC (Terraform) * [Azure] Create scalable and customizable multi-region and multi-buyer stacks via IaC (Terraform) * [Azure] Create namespace within AKS cluster * [Azure] Deploy Virtual ACI Nodes to provide Confidential Compute via IaC (Terraform) * [Azure] Enable Horizontal Pod Autoscaling on bidding and auction servers via IaC (Terraform) * [Azure] Enable TLS encryption and offloading to the AKS Cluster and a Frontend Health Check Policy via IaC (Terraform) * [Azure] Implement buyer and seller modules to cohesively run all of the components as needed via IaC (Terraform) * [Azure] Implement Kubernetes Deployments for bidding and auction servers via IaC (Terraform) * [Azure] Implement OTel Collector service, deployment, and ConfigMap for telemetry data collection via IaC (Terraform) * [Azure] Implement Parc service, deployment, and ConfigMap for getParameter integration via IaC (Terraform) * [Azure] Provision AKS cluster with Log Analytics and Key Vault integration for bidding and auction servers via IaC (Terraform) * [Azure] Provision IAM roles for virtual nodes, application gateway for containers, and TLS certificates via IaC (Terraform) * [Azure] Provision regional application gateway for containers (AGfC) and integrate with traffic manager and AKS via IaC (Terraform) * [Azure] Several small improvements and fixes * [fDO] Add libtld library to extract eTLD+1 from fDO urls * [fDO] Add enable_sampled_debug_reporting flag * [fDO] Add forDebuggingOnlyInCooldownOrLockout to generateBid() * [fDO] Add forDebuggingOnlyInCooldownOrLockout to scoreAd() * [fDO] Default enable_debug_reporting to true for requests from browser * [fDO] Only consider debug urls sent from Auction to SFE for MAX_ALLOWED_SIZE_ALL_DEBUG_URLS_KB check * [fDO] Partition bidding.business_logic.debug_url_count by status * [fDO] Populate sampled debug reports for single-seller auctions in client response * [fDO] Sample buyer debug urls for component auctions in SFE * [fDO] Sample buyer debug urls in Bidding * [fDO] Sample seller debug urls for component auctions in Auction service * [fDO] Sample seller debug urls for single-seller auctions in Auction service * Add AWS log based metric for errors and crashes * Add chaffing v2 changes on seller side * Add GCP log based metric for errors and crashes * Add GCP/AWS alert on server request failure rate * Add request age metric on SFE * Add roma dashboard for AWS * Add roma metrics dashboard for GCP * Add roma metrics to bidding server * Add roma queue duration metric in AWS * Add roma queue duration metric in GCP * Add terraform variables to force AWS availability zones (credit to fhoering) * Add udf initialization duration metric to track retry time * Add support for PAS Ghost candidates in top level auction * Allow setting DNS records in separate GCP project (credit to davidae) * Allow to use Intel AMX/TDX for bidding server in GCP * Enable prod_debug flag for Android request debugging * PARC blob storage client migration * PARC param fetcher * Parse multiple bids per IG to support K-Anonymity with BYOB * Publish metric if invalid component auctions in top level auction input * Remove old SFE <> BFE request/response format code paths * Skip chaffing for 99% of requests on SFE * Support custom gcp ssl policies in frontend load balancer (credit to maciejkowalczyk) * Support proto in new request parser and tensorflow parser * Update GCP Cloud Build to build local testing image * Upgrade google terraform plugin to 5.36.0 ### Bug Fixes * Add prefix to parc param fetch * Better documentation for GCP service account naming * BYOB flags for local testing * Check ok() on StatusOr in prev_wins_ms code path * Disable bash xtrace for Dockerfile.libtld bazel target * Disable BYOB in prod build * Fix asan warning for model reset * Fix incorrect param position * Fix incorrect test suite naming for the ONNX sidecar * Fix inference.request.duration_ms_by_model graph in GCP dashboard * Fix multiple logging of roma metrics * Fix a potential race in BFE * Reinstate blocking counter for cpio param fetch * Stop processing on failure to decrypt response * Typo in k-anon microbenchmark BUILD rule * Update GCP inference dashboard * Update GCP seller dashboard * Use to fix local tests ### Documentation * AWS Enclave CPU and Mem Reqs in TF Config Bug: N/A GitOrigin-RevId: 2094f124f35953f011dbc4a21fd967bc65cf2eec Change-Id: I0836576efaca644c57ef1e7d11d5cfb9cc1cb0ac
1 parent 9dda7b4 commit 87b9dd9

470 files changed

Lines changed: 28135 additions & 6016 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.gitignore‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,8 @@ terraform.rc
5757

5858
# Python
5959
**/__pycache__/*
60+
.venv
61+
venv/
6062

6163
# Docker
6264
docker-buildx-*.log
@@ -65,3 +67,5 @@ core
6567

6668
# Local Server built/temporary files for Protected Audience integration tests
6769
tools/debug/pa-integration-tests/local-servers/*.pem
70+
downloads/chrome*
71+
downloads/manifest.txt

‎.markdown-link-check.json‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,9 @@
66
{
77
"pattern": "^http://go/"
88
},
9+
{
10+
"pattern": "^http://shortn/"
11+
},
912
{
1013
"pattern": "^/tools/"
1114
},

‎.pre-commit-config.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,7 @@ repos:
3939
- id: check-merge-conflict
4040
- id: check-yaml
4141
entry: check-yaml --allow-multiple-documents
42+
exclude: production/deploy/azure/terraform/components/tls/tls-chart
4243
- id: check-json
4344
- id: check-symlinks
4445
- id: check-added-large-files

‎BUILD‎

Lines changed: 25 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -16,16 +16,6 @@ load("@bazel_skylib//rules:common_settings.bzl", "string_flag")
1616

1717
package(default_visibility = ["//visibility:public"])
1818

19-
string_flag(
20-
name = "instance",
21-
build_setting_default = "aws",
22-
values = [
23-
"gcp",
24-
"aws",
25-
"local",
26-
],
27-
)
28-
2919
genrule(
3020
name = "precommit-hooks",
3121
outs = ["run_precommit_hooks.bin"],
@@ -112,6 +102,31 @@ config_setting(
112102
visibility = ["//visibility:public"],
113103
)
114104

105+
string_flag(
106+
name = "enable_parc",
107+
build_setting_default = "false",
108+
values = [
109+
"false",
110+
"true",
111+
],
112+
)
113+
114+
config_setting(
115+
name = "parc_disabled",
116+
flag_values = {
117+
":enable_parc": "false",
118+
},
119+
visibility = ["//:__subpackages__"],
120+
)
121+
122+
config_setting(
123+
name = "parc_enabled",
124+
flag_values = {
125+
":enable_parc": "true",
126+
},
127+
visibility = ["//:__subpackages__"],
128+
)
129+
115130
string_flag(
116131
name = "inference_build",
117132
build_setting_default = "no",

‎CHANGELOG.md‎

Lines changed: 100 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,104 @@
22

33
All notable changes to this project will be documented in this file. See [commit-and-tag-version](https://github.com/absolute-version/commit-and-tag-version) for commit guidelines.
44

5+
## 4.9.0 (2025-04-16)
6+
7+
8+
### ⚠ BREAKING CHANGES
9+
10+
* Non-Production builds: Adtechs running non-prod builds must upgrade both the buyer and seller non-prod stacks to 4.9.
11+
12+
Note: This change does not impact production environments.
13+
14+
### Features
15+
16+
* [Azure] Add azure to otel zone and region config
17+
* [Azure] Add support for azure build bazel build flags
18+
* [Azure] Add comment to Azure documentation
19+
* [Azure] Add more descriptive comments
20+
* [Azure] Add Parc ConfigMap Hash to the backend service deployment
21+
* [Azure] B&A docker image build scripts for azure
22+
* [Azure] Create Kubernetes Services to enable traffic to bidding and auction servers pods via IaC (Terraform)
23+
* [Azure] Create region-specific virtual network and subnets with dynamic delegation via IaC (Terraform)
24+
* [Azure] Create scalable and customizable multi-region and multi-buyer stacks via IaC (Terraform)
25+
* [Azure] Create namespace within AKS cluster
26+
* [Azure] Deploy Virtual ACI Nodes to provide Confidential Compute via IaC (Terraform)
27+
* [Azure] Enable Horizontal Pod Autoscaling on bidding and auction servers via IaC (Terraform)
28+
* [Azure] Enable TLS encryption and offloading to the AKS Cluster and a Frontend Health Check Policy via IaC (Terraform)
29+
* [Azure] Implement buyer and seller modules to cohesively run all of the components as needed via IaC (Terraform)
30+
* [Azure] Implement Kubernetes Deployments for bidding and auction servers via IaC (Terraform)
31+
* [Azure] Implement OTel Collector service, deployment, and ConfigMap for telemetry data collection via IaC (Terraform)
32+
* [Azure] Implement Parc service, deployment, and ConfigMap for getParameter integration via IaC (Terraform)
33+
* [Azure] Provision AKS cluster with Log Analytics and Key Vault integration for bidding and auction servers via IaC (Terraform)
34+
* [Azure] Provision IAM roles for virtual nodes, application gateway for containers, and TLS certificates via IaC (Terraform)
35+
* [Azure] Provision regional application gateway for containers (AGfC) and integrate with traffic manager and AKS via IaC (Terraform)
36+
* [Azure] Several small improvements and fixes
37+
* [fDO] Add libtld library to extract eTLD+1 from fDO urls
38+
* [fDO] Add enable_sampled_debug_reporting flag
39+
* [fDO] Add forDebuggingOnlyInCooldownOrLockout to generateBid()
40+
* [fDO] Add forDebuggingOnlyInCooldownOrLockout to scoreAd()
41+
* [fDO] Default enable_debug_reporting to true for requests from browser
42+
* [fDO] Only consider debug urls sent from Auction to SFE for MAX_ALLOWED_SIZE_ALL_DEBUG_URLS_KB check
43+
* [fDO] Partition bidding.business_logic.debug_url_count by status
44+
* [fDO] Populate sampled debug reports for single-seller auctions in client response
45+
* [fDO] Sample buyer debug urls for component auctions in SFE
46+
* [fDO] Sample buyer debug urls in Bidding
47+
* [fDO] Sample seller debug urls for component auctions in Auction service
48+
* [fDO] Sample seller debug urls for single-seller auctions in Auction service
49+
* Add AWS log based metric for errors and crashes
50+
* Add chaffing v2 changes on seller side
51+
* Add GCP log based metric for errors and crashes
52+
* Add GCP/AWS alert on server request failure rate
53+
* Add request age metric on SFE
54+
* Add roma dashboard for AWS
55+
* Add roma metrics dashboard for GCP
56+
* Add roma metrics to bidding server
57+
* Add roma queue duration metric in AWS
58+
* Add roma queue duration metric in GCP
59+
* Add terraform variables to force AWS availability zones (credit to fhoering)
60+
* Add udf initialization duration metric to track retry time
61+
* Add support for PAS Ghost candidates in top level auction
62+
* Allow setting DNS records in separate GCP project (credit to davidae)
63+
* Allow to use Intel AMX/TDX for bidding server in GCP
64+
* Enable prod_debug flag for Android request debugging
65+
* PARC blob storage client migration
66+
* PARC param fetcher
67+
* Parse multiple bids per IG to support K-Anonymity with BYOB
68+
* Publish metric if invalid component auctions in top level auction input
69+
* Remove old SFE <> BFE request/response format code paths
70+
* Skip chaffing for 99% of requests on SFE
71+
* Support custom gcp ssl policies in frontend load balancer (credit to maciejkowalczyk)
72+
* Support proto in new request parser and tensorflow parser
73+
* Update GCP Cloud Build to build local testing image
74+
* Upgrade google terraform plugin to 5.36.0
75+
76+
77+
### Bug Fixes
78+
79+
* Add prefix to parc param fetch
80+
* Better documentation for GCP service account naming
81+
* BYOB flags for local testing
82+
* Check ok() on StatusOr in prev_wins_ms code path
83+
* Disable bash xtrace for Dockerfile.libtld bazel target
84+
* Disable BYOB in prod build
85+
* Fix asan warning for model reset
86+
* Fix incorrect param position
87+
* Fix incorrect test suite naming for the ONNX sidecar
88+
* Fix inference.request.duration_ms_by_model graph in GCP dashboard
89+
* Fix multiple logging of roma metrics
90+
* Fix a potential race in BFE
91+
* Reinstate blocking counter for cpio param fetch
92+
* Stop processing on failure to decrypt response
93+
* Typo in k-anon microbenchmark BUILD rule
94+
* Update GCP inference dashboard
95+
* Update GCP seller dashboard
96+
* Use `cquery` to fix local tests
97+
98+
99+
### Documentation
100+
101+
* AWS Enclave CPU and Mem Reqs in TF Config
102+
5103
## 4.8.0 (2025-03-06)
6104

7105

@@ -11,7 +109,7 @@ All notable changes to this project will be documented in this file. See [commit
11109
* Add BYOB functional support for AWS
12110
* Add DOCKER_IMAGE_URI param to local startup scripts
13111
* Add ENABLE_BUYER_CACHING flag to Terraform
14-
* Add hybrid logic for buyers ([04229da]( )), closes [/github.com/WICG/turtledove/blob/692ad8825e9b7e6b1b1347b9b0d38ee1fdaadf63/FLEDGE_Key_Value_Server_API.md#query-api-version-1]( ) [/github.com/WICG/turtledove/blob/main/FLEDGE_Key_Value_Server_API.md#query-api-version-2]( )
112+
* Add hybrid logic for buyers
15113
* Add invoked buyers cache on SFE
16114
* Implement support for PAS top level auction in SFE
17115
* Migrate B&A repo off of BatchExecute
@@ -30,7 +128,7 @@ All notable changes to this project will be documented in this file. See [commit
30128
* Mount roots.pem for SFE
31129
* Rename /etc/roots.pem to default location
32130
* Revert use of confidential_instance_type in terraform-provider-google
33-
* terraform plan less noisy for blob load status dashboard (gh issue [#35]( ))
131+
* terraform plan less noisy for blob load status dashboard
34132
* Use default event engine for K-Anon/invoked buyer cache
35133
* Validate gRPC headers on SFE/BFE/Bidding services
36134

‎WORKSPACE‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -15,11 +15,11 @@ python_register_toolchains("//builders/bazel")
1515

1616
http_archive(
1717
name = "google_privacysandbox_servers_common",
18-
# 2025-02-11
19-
sha256 = "96ad94b628d009e229e2fd58d6cb117e29331e1e5bccc19fccf9634eb5943fe6",
20-
strip_prefix = "data-plane-shared-libraries-b442136d9cbe2872d8d55da95d176fd9a2d77b68",
18+
# 2025-03-31
19+
sha256 = "228ed540020538ec53eb6970361b9a8b7869755e5ddc0a2390b6685a43c9b0a7",
20+
strip_prefix = "data-plane-shared-libraries-e0b338db5d354d5f93d821733d0b1f7d98564384",
2121
urls = [
22-
"https://github.com/privacysandbox/data-plane-shared-libraries/archive/b442136d9cbe2872d8d55da95d176fd9a2d77b68.zip",
22+
"https://github.com/privacysandbox/data-plane-shared-libraries/archive/e0b338db5d354d5f93d821733d0b1f7d98564384.zip",
2323
],
2424
)
2525

‎api/BUILD‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -101,3 +101,25 @@ cc_proto_builder_library(
101101
cc_proto_library_deps = [":k_anon_query_cc_proto"],
102102
proto = ["**"],
103103
)
104+
105+
proto_library(
106+
name = "attestation_proto",
107+
srcs = ["attestation.proto"],
108+
)
109+
110+
proto_descriptor_set(
111+
name = "attestation_descriptor_set",
112+
deps = [":attestation_proto"],
113+
)
114+
115+
cc_proto_library(
116+
name = "attestation_cc_proto",
117+
deps = [":attestation_proto"],
118+
)
119+
120+
buf_lint_test(
121+
name = "attestation_proto_lint",
122+
size = "small",
123+
config = ":buf.yaml",
124+
targets = [":attestation_proto"],
125+
)

‎api/attestation.proto‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
// Copyright 2025 Google LLC
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
//
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
15+
syntax = "proto3";
16+
17+
package wireless.android.adservices.mdd.adtech_enrollment.chrome;
18+
19+
enum PrivacySandboxAttestationsGatedAPIProto {
20+
UNKNOWN = 0;
21+
TOPICS = 1;
22+
PROTECTED_AUDIENCE = 2;
23+
PRIVATE_AGGREGATION = 3;
24+
ATTRIBUTION_REPORTING = 4;
25+
SHARED_STORAGE = 5;
26+
FENCED_STORAGE_READ = 6;
27+
}
28+
29+
message PrivacySandboxAttestationsProto {
30+
message PrivacySandboxAttestedAPIsProto {
31+
repeated PrivacySandboxAttestationsGatedAPIProto attested_apis = 1;
32+
}
33+
34+
// A definition of what "all APIs" means for the current version.
35+
repeated PrivacySandboxAttestationsGatedAPIProto all_apis = 1;
36+
37+
// A list of sites attested for all APIs.
38+
repeated string sites_attested_for_all_apis = 2;
39+
40+
// A map from sites to lists of attested APIs. (Should only be used for sites
41+
// that are not attested for all APIs.)
42+
map<string, PrivacySandboxAttestedAPIsProto> site_attestations = 3;
43+
}

0 commit comments

Comments
 (0)