Skip to content
This repository was archived by the owner on Mar 24, 2026. It is now read-only.

Commit 3af6c72

Browse files
Privacy Sandbox Teamcopybara-github
Privacy Sandbox Team
authored and
copybara-github
committed
Release version v1.28.0-rc01
GitOrigin-RevId: fb01c883e4b8a72fa4e53652a83417a867dae9bb
1 parent 8b81e42 commit 3af6c72

107 files changed

Lines changed: 1147 additions & 8723 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.tflint.hcl‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
# Copyright 2025 Google LLC
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
plugin "terraform" {
16+
enabled = true
17+
preset = "recommended"
18+
}
19+
20+
plugin "aws" {
21+
enabled = true
22+
version = "0.40.0"
23+
source = "github.com/terraform-linters/tflint-ruleset-aws"
24+
}
25+
26+
plugin "google" {
27+
enabled = true
28+
version = "0.34.0"
29+
source = "github.com/terraform-linters/tflint-ruleset-google"
30+
}
31+
32+
plugin "opa" {
33+
enabled = true
34+
version = "0.8.0"
35+
source = "github.com/terraform-linters/tflint-ruleset-opa"
36+
}
37+
38+
config {
39+
# Don't expand modules when linting. Modules are linted directly.
40+
call_module_type = "none"
41+
}
42+
43+
rule "terraform_required_version" {
44+
enabled = false
45+
}
46+
47+
rule "terraform_required_providers" {
48+
enabled = false
49+
}
50+
51+
rule "terraform_comment_syntax" {
52+
enabled = true
53+
}
54+
55+
rule "terraform_naming_convention" {
56+
enabled = true
57+
format = "snake_case"
58+
}
59+
60+
rule "aws_iam_policy_attachment_exclusive_attachment" {
61+
enabled = true
62+
}
63+
64+
rule "aws_iam_role_deprecated_policy_attributes" {
65+
enabled = true
66+
}

‎CHANGELOG.md‎

Lines changed: 24 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,29 @@
11
# Changelog
22

3-
## For next release
3+
## [1.28.0](https://github.com/privacysandbox/coordinator-services-and-shared-libraries/compare/v1.27.0...v1.28.0) (2025-07-07)
4+
### Important notes
5+
[GCP]
6+
- The shared/ directory found under `coordinator/terraform/gcp/environments_mp_(primary|secondary)` has been removed.
7+
[CA]
8+
- Infastructure has been upgraded to use Terraform version v1.12.1. Please upgrade to Terraform version 1.12.X before executing any terraform commands. Terraform code will only be backwards compatible with v1.2.3 for this release only.
9+
10+
### Changes
11+
- INFRA
12+
- [GCP] Remove `shared/` terraform directory
13+
- MPKGDS
14+
- [GCP] Add the legacy AWS public key path to GCP request handler map to
15+
support old version of Chrome client
16+
- [GCP] Allow specifying KeyDB name suffix
17+
- [GCP] Enable specifying Spanner edition
18+
- BUILD
19+
- [CA] Update container dependencies
20+
- PBS
21+
- [CA] Cleanup C++ uses of
22+
`google_scp_pbs_migration_enable_budget_consumer_migration`
23+
- [CA] Clean cout statements in http2 connection pool test
24+
- [GCP] Allow specifying database name suffixes
25+
- [GCP] Enable specifying Spanner instance config and edition
26+
- [GCP] Removed unused VPC from Terraform
427

528
## [1.27.0](https://github.com/privacysandbox/coordinator-services-and-shared-libraries/compare/v1.26.0...v1.27.0) (2025-06-24)
629
### Important notes
@@ -25,7 +48,6 @@
2548
- [GCP] Remove unused variables in terraform configuration of `distributedpbs_alarms`, `distributedpbs_application`, `distributedpbs_base`
2649

2750
## [1.26.0](https://github.com/privacysandbox/coordinator-services-and-shared-libraries/compare/v1.25.0...v1.26.0) (2025-06-10)
28-
2951
### Changes
3052
- INFRA
3153
- [CA] Remove terraform version constraint in child modules

‎MODULE.bazel‎

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -152,8 +152,18 @@ http_archive(
152152
package(default_visibility = ["//visibility:public"])
153153
exports_files(["terraform"])
154154
""",
155-
sha256 = "728b6fbcb288ad1b7b6590585410a98d3b7e05efe4601ef776c37e15e9a83a96",
156-
url = "https://releases.hashicorp.com/terraform/1.2.3/terraform_1.2.3_linux_amd64.zip",
155+
sha256 = "dcaf8ba801660a431a6769ec44ba53b66c1ad44637512ef3961f7ffe4397ef7c",
156+
url = "https://releases.hashicorp.com/terraform/1.12.1/terraform_1.12.1_linux_amd64.zip",
157+
)
158+
159+
http_archive(
160+
name = "tflint",
161+
build_file_content = """
162+
package(default_visibility = ["//visibility:public"])
163+
exports_files(["tflint"])
164+
""",
165+
sha256 = "1e8ccdf3e4b57ba154545b4343621bf46f25ca8f5cc97e36432469752f7ef0c0",
166+
url = "https://github.com/terraform-linters/tflint/releases/download/v0.58.0/tflint_linux_amd64.zip",
157167
)
158168

159169
http_archive(

‎build-scripts/DEBIAN_CONTAINER_DIGEST‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
sha256:f957d7d19c4171aded89330899c1501c03707d879f200001aa47af87d98b3c70
1+
sha256:28c1e76b454bb65a9138a2562708e7fa3a937ae88a36b30fe8a12e3e1d447ce3

‎build-scripts/gcp/build_coordinator_services.sh‎

Lines changed: 5 additions & 64 deletions
Original file line numberDiff line numberDiff line change
@@ -25,10 +25,14 @@ IMAGE_TAG=$6
2525
TAR_BUCKET=$7
2626
TAR_PATH=$8
2727
PBS_IMAGE_NAME=${9:-privacy-budget-service}
28+
FORCE_COORDINATOR_VERSION=${10:-}
2829

2930
BUILD_LOG=$(pwd)/buildlog.txt
3031
cp cc/tools/build/build_container_params.bzl.prebuilt cc/tools/build/build_container_params.bzl
3132
COORDINATOR_VERSION=$(cat version.txt)
33+
if [[ -n ${FORCE_COORDINATOR_VERSION} ]]; then
34+
COORDINATOR_VERSION="${FORCE_COORDINATOR_VERSION}"
35+
fi
3236

3337
bazel run //coordinator/keygeneration/gcp:key_generation_app_mp_gcp_image_prod \
3438
--sandbox_writable_path=$HOME/.docker \
@@ -70,71 +74,8 @@ COORDINATOR_TAR_FILE="$(bazel info bazel-bin)/coordinator/terraform/gcp/multipar
7074
TAR_MANIPULATION_TMP_DIR=$(mktemp -d -t ci-XXXXXXXXXX)
7175
gunzip < "${COORDINATOR_TAR_FILE}" > "${TAR_MANIPULATION_TMP_DIR}/scp-multiparty-coordinator-${COORDINATOR_VERSION}.tar"
7276

73-
pushd $TAR_MANIPULATION_TMP_DIR
74-
# Generate the image_params.auto.tfvars file with service container images for mpkhs_primary
75-
mkdir -p environments_mp_primary/shared/mpkhs_primary/ && mkdir -p environments_mp_primary/demo/mpkhs_primary/
76-
cat <<EOT >> environments_mp_primary/shared/mpkhs_primary/image_params.auto.tfvars
77-
########################################################################
78-
# Prefiled values for container image lookup based on released version #
79-
########################################################################
80-
81-
key_generation_image = "${IMAGE_REPO_PATH}/${KEYGEN_IMAGE_NAME}:${IMAGE_TAG}"
82-
private_key_service_image = "${IMAGE_REPO_PATH}/${ENCKEYSVC_IMAGE_NAME}:${IMAGE_TAG}"
83-
public_key_service_image = "${IMAGE_REPO_PATH}/${PUBKEYSVC_IMAGE_NAME}:${IMAGE_TAG}"
84-
EOT
85-
ln -s ../../shared/mpkhs_primary/image_params.auto.tfvars environments_mp_primary/demo/mpkhs_primary/image_params.auto.tfvars
86-
87-
# Generate the image_params.auto.tfvars file with service container images for mpkhs_secondary
88-
mkdir -p environments_mp_secondary/shared/mpkhs_secondary/ && mkdir -p environments_mp_secondary/demo/mpkhs_secondary/
89-
cat <<EOT >> environments_mp_secondary/shared/mpkhs_secondary/image_params.auto.tfvars
90-
########################################################################
91-
# Prefiled values for container image lookup based on released version #
92-
########################################################################
93-
94-
key_storage_service_image = "${IMAGE_REPO_PATH}/${KEYSTRSVC_IMAGE_NAME}:${IMAGE_TAG}"
95-
private_key_service_image = "${IMAGE_REPO_PATH}/${ENCKEYSVC_IMAGE_NAME}:${IMAGE_TAG}"
96-
public_key_service_image = "${IMAGE_REPO_PATH}/${PUBKEYSVC_IMAGE_NAME}:${IMAGE_TAG}"
97-
EOT
98-
ln -s ../../shared/mpkhs_secondary/image_params.auto.tfvars environments_mp_secondary/demo/mpkhs_secondary/image_params.auto.tfvars
99-
100-
# Generate the image_params.auto.tfvars file with service container images for distributedpbs_application primary
101-
mkdir -p environments_mp_primary/shared/distributedpbs_application/ && mkdir -p environments_mp_primary/demo/distributedpbs_application/
102-
cat <<EOT >> environments_mp_primary/shared/distributedpbs_application/image_params.auto.tfvars
103-
########################################################################
104-
# Prefiled values for container image lookup based on released version #
105-
########################################################################
106-
107-
pbs_image_override = "${IMAGE_REPO_PATH}/${PBS_IMAGE_NAME}:${IMAGE_TAG}"
108-
EOT
109-
ln -s ../../shared/distributedpbs_application/image_params.auto.tfvars environments_mp_primary/demo/distributedpbs_application/image_params.auto.tfvars
110-
111-
# Generate the image_params.auto.tfvars file with service container images for distributedpbs_application secondary
112-
mkdir -p environments_mp_secondary/shared/distributedpbs_application/ && mkdir -p environments_mp_secondary/demo/distributedpbs_application/
113-
cat <<EOT >> environments_mp_secondary/shared/distributedpbs_application/image_params.auto.tfvars
114-
########################################################################
115-
# Prefiled values for container image lookup based on released version #
116-
########################################################################
117-
118-
pbs_image_override = "${IMAGE_REPO_PATH}/${PBS_IMAGE_NAME}:${IMAGE_TAG}"
119-
EOT
120-
ln -s ../../shared/distributedpbs_application/image_params.auto.tfvars environments_mp_secondary/demo/distributedpbs_application/image_params.auto.tfvars
121-
122-
123-
tar --append --file=scp-multiparty-coordinator-${COORDINATOR_VERSION}.tar \
124-
./environments_mp_primary/shared/mpkhs_primary/image_params.auto.tfvars \
125-
./environments_mp_primary/demo/mpkhs_primary/image_params.auto.tfvars \
126-
./environments_mp_secondary/shared/mpkhs_secondary/image_params.auto.tfvars \
127-
./environments_mp_secondary/demo/mpkhs_secondary/image_params.auto.tfvars \
128-
./environments_mp_primary/shared/distributedpbs_application/image_params.auto.tfvars \
129-
./environments_mp_primary/demo/distributedpbs_application/image_params.auto.tfvars \
130-
./environments_mp_secondary/shared/distributedpbs_application/image_params.auto.tfvars \
131-
./environments_mp_secondary/demo/distributedpbs_application/image_params.auto.tfvars
132-
tar --list --file=scp-multiparty-coordinator-${COORDINATOR_VERSION}.tar
133-
134-
popd
135-
13677
TAR_NAME="ps-gcp-multiparty-coordinator-${COORDINATOR_VERSION}.tgz"
13778
gzip < $TAR_MANIPULATION_TMP_DIR/scp-multiparty-coordinator-${COORDINATOR_VERSION}.tar > ${TAR_NAME}
13879
rm -rf $TAR_MANIPULATION_TMP_DIR && unset TAR_MANIPULATION_TMP_DIR
13980

140-
gsutil cp ${TAR_NAME} gs://${TAR_BUCKET}/${TAR_PATH}/$(cat version.txt)/
81+
gsutil cp ${TAR_NAME} gs://${TAR_BUCKET}/${TAR_PATH}/${COORDINATOR_VERSION}/

‎build-scripts/gcp/cloudbuild.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ steps:
1919
$_OUTPUT_IMAGE_REPO_PATH $_OUTPUT_KEYGEN_IMAGE_NAME \
2020
$_OUTPUT_PUBKEYSVC_IMAGE_NAME $_OUTPUT_ENCKEYSVC_IMAGE_NAME \
2121
$_OUTPUT_KEYSTRSVC_IMAGE_NAME $_OUTPUT_IMAGE_TAG \
22-
$_TAR_PUBLISH_BUCKET $_TAR_PUBLISH_BUCKET_PATH $_OUTPUT_PBS_IMAGE_NAME \
22+
$_TAR_PUBLISH_BUCKET $_TAR_PUBLISH_BUCKET_PATH $_OUTPUT_PBS_IMAGE_NAME $_FORCE_COORDINATOR_VERSION \
2323
automapSubstitutions: true
2424
options:
2525
logging: CLOUD_LOGGING_ONLY

‎build_defs/shared/terraform.bzl‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,6 @@ def terraform():
2323
package(default_visibility = ["//visibility:public"])
2424
exports_files(["terraform"])
2525
""",
26-
sha256 = "728b6fbcb288ad1b7b6590585410a98d3b7e05efe4601ef776c37e15e9a83a96",
27-
url = "https://releases.hashicorp.com/terraform/1.2.3/terraform_1.2.3_linux_amd64.zip",
26+
sha256 = "dcaf8ba801660a431a6769ec44ba53b66c1ad44637512ef3961f7ffe4397ef7c",
27+
url = "https://releases.hashicorp.com/terraform/1.12.1/terraform_1.12.1_linux_amd64.zip",
2828
)

‎cc/core/http2_client/test/http2_connection_pool_test.cc‎

Lines changed: 0 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -156,8 +156,6 @@ TEST_F(HttpConnectionPoolTest,
156156
auto connection = std::make_shared<MockHttpConnection>(
157157
async_executor, host, service, is_https, metric_router_.get());
158158
if (create_connection_counter % 2 != 0) {
159-
std::cout << "Dropping connection at " << create_connection_counter
160-
<< std::endl;
161159
connection->SetIsDropped();
162160
connection->SetIsNotReady();
163161
// Set the override for recycle connection to check if this Dropped
@@ -172,8 +170,6 @@ TEST_F(HttpConnectionPoolTest,
172170
};
173171
}
174172
} else {
175-
std::cout << "Connection at " << create_connection_counter
176-
<< " is ready" << std::endl;
177173
connection->SetIsNotDropped();
178174
connection->SetIsReady();
179175
}
@@ -212,13 +208,9 @@ TEST_F(HttpConnectionPoolTest,
212208
auto connection = std::make_shared<MockHttpConnection>(
213209
async_executor, host, service, is_https, metric_router_.get());
214210
if (create_connection_counter % 2 != 0) {
215-
std::cout << "Dropping connection at " << create_connection_counter
216-
<< " and the connection is not ready yet" << std::endl;
217211
connection->SetIsDropped();
218212
connection->SetIsNotReady();
219213
} else {
220-
std::cout << "Connection at " << create_connection_counter
221-
<< " is ready" << std::endl;
222214
connection->SetIsNotDropped();
223215
connection->SetIsReady();
224216
}
@@ -255,13 +247,9 @@ TEST_F(HttpConnectionPoolTest,
255247
auto connection = std::make_shared<MockHttpConnection>(
256248
async_executor, host, service, is_https, metric_router_.get());
257249
if (create_connection_counter % 2 != 0) {
258-
std::cout << "Dropping connection at " << create_connection_counter
259-
<< " and the connection is not ready yet" << std::endl;
260250
connection->SetIsDropped();
261251
connection->SetIsNotReady();
262252
} else {
263-
std::cout << "Connection at " << create_connection_counter
264-
<< " is ready" << std::endl;
265253
connection->SetIsNotDropped();
266254
connection->SetIsNotReady();
267255
}

‎cc/core/telemetry/src/authentication/grpc_id_token_authenticator.cc‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -24,9 +24,12 @@
2424

2525
namespace privacy_sandbox::pbs_common {
2626

27-
// Token validity
28-
// Defaults to 1hr
29-
// https://cloud.google.com/docs/authentication/token-types#id-lifetime
27+
// ID token validity duration, in seconds.
28+
//
29+
// Google Cloud ID tokens are valid for up to 3600 seconds (1 hour).
30+
// This value is set to 3000 seconds (50 minutes) to ensure tokens are
31+
// refreshed before they expire.
32+
// See: https://cloud.google.com/docs/authentication/token-types#id-lifetime
3033
inline constexpr std::int32_t kIdTokenValidity = 3000;
3134

3235
/**

0 commit comments

Comments
 (0)