feat: krypton plugins

.github/workflows/buf-ci.yaml

@@ -13,5 +13,5 @@ jobs:
   buf:
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: bufbuild/buf-action@v1

.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "0.10.0"
+  ".": "0.15.0"
 }

CHANGELOG.md

@@ -1,5 +1,87 @@
 # Changelog
 
+## [0.15.0](https://github.com/openkcm/plugin-sdk/compare/v0.14.0...v0.15.0) (2026-08-18)
+
+
+### Features
+
+* add get key versions to keystore proto ([#172](https://github.com/openkcm/plugin-sdk/issues/172)) ([7f45e03](https://github.com/openkcm/plugin-sdk/commit/7f45e031d5a62bbfdb6ac89a3da504f015a9f6ef))
+
+
+### Bug Fixes
+
+* **deps:** bump buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go from 1.36.11-20260415201107-50325440f8f2.1 to 1.36.11-20260709200747-435963d16310.1 ([#169](https://github.com/openkcm/plugin-sdk/issues/169)) ([315b18c](https://github.com/openkcm/plugin-sdk/commit/315b18c71cc1b303d44e32561256dae6ca6e6f84))
+* **deps:** bump github.com/google/cel-go from 0.28.0 to 0.29.0 ([#170](https://github.com/openkcm/plugin-sdk/issues/170)) ([9a6cdc2](https://github.com/openkcm/plugin-sdk/commit/9a6cdc2227b6dce6a85bf65fccd88517959514ca))
+* **deps:** bump golang.org/x/net from 0.53.0 to 0.55.0 ([#166](https://github.com/openkcm/plugin-sdk/issues/166)) ([32bb58e](https://github.com/openkcm/plugin-sdk/commit/32bb58e9980cc7d8b130e50b4b27ba5fe54d6232))
+* **deps:** bump google.golang.org/grpc from 1.82.0 to 1.82.1 in the gomod-group group ([#168](https://github.com/openkcm/plugin-sdk/issues/168)) ([78856d9](https://github.com/openkcm/plugin-sdk/commit/78856d9edf71b65d3cb54d0db53e0238e76d23c3))
+* **deps:** bump the gomod-group group across 1 directory with 2 updates ([#167](https://github.com/openkcm/plugin-sdk/issues/167)) ([ea06ed6](https://github.com/openkcm/plugin-sdk/commit/ea06ed64c60d8f9e2a9a515d4240cb60ff34d46a))
+* **deps:** bump the gomod-group group across 1 directory with 4 updates ([#173](https://github.com/openkcm/plugin-sdk/issues/173)) ([45e950e](https://github.com/openkcm/plugin-sdk/commit/45e950e0d93ee237733563d80bfb73c1b6c07f3e))
+
+## [0.14.0](https://github.com/openkcm/plugin-sdk/compare/v0.13.0...v0.14.0) (2026-07-02)
+
+
+### Features
+
+* update keystore role ([#163](https://github.com/openkcm/plugin-sdk/issues/163)) ([48b567f](https://github.com/openkcm/plugin-sdk/commit/48b567f2056129749e4fba32432adea5b40d651b))
+
+
+### Bug Fixes
+
+* **deps:** bump actions/checkout from 6 to 7 ([#161](https://github.com/openkcm/plugin-sdk/issues/161)) ([8df5e9c](https://github.com/openkcm/plugin-sdk/commit/8df5e9c9fa635d0eb1982a6bd8295eb87a36add8))
+* **deps:** bump golang.org/x/sys from 0.45.0 to 0.46.0 in the gomod-group group ([#160](https://github.com/openkcm/plugin-sdk/issues/160)) ([e182aa6](https://github.com/openkcm/plugin-sdk/commit/e182aa69a7e08d6e7570bd03595b798a5026014e))
+
+## [0.13.0](https://github.com/openkcm/plugin-sdk/compare/v0.12.0...v0.13.0) (2026-06-09)
+
+
+### Features
+
+* add grant/remove trust for keystore management plugin ([#157](https://github.com/openkcm/plugin-sdk/issues/157)) ([24dc562](https://github.com/openkcm/plugin-sdk/commit/24dc562a8d7dbed36112992ad5d367a7a91e1ff2))
+
+
+### Bug Fixes
+
+* **deps:** bump the gomod-group group across 1 directory with 2 updates ([#156](https://github.com/openkcm/plugin-sdk/issues/156)) ([dc441bb](https://github.com/openkcm/plugin-sdk/commit/dc441bba13b1debdaf518c67c05cb32be6fffae1))
+
+## [0.12.0](https://github.com/openkcm/plugin-sdk/compare/v0.11.1...v0.12.0) (2026-05-22)
+
+
+### Features
+
+* generic key error ([#154](https://github.com/openkcm/plugin-sdk/issues/154)) ([63acb38](https://github.com/openkcm/plugin-sdk/commit/63acb3819240ea0c132ade82f670fd32fb70c8cf))
+
+
+### Bug Fixes
+
+* **deps:** bump the gomod-group group across 1 directory with 3 updates ([#152](https://github.com/openkcm/plugin-sdk/issues/152)) ([acdcf18](https://github.com/openkcm/plugin-sdk/commit/acdcf189790ef2f895f05f27f312c6f035e6a6e0))
+
+## [0.11.1](https://github.com/openkcm/plugin-sdk/compare/v0.11.0...v0.11.1) (2026-05-14)
+
+
+### Bug Fixes
+
+* **deps:** bump the gomod-group group across 1 directory with 2 updates ([#146](https://github.com/openkcm/plugin-sdk/issues/146)) ([db2696d](https://github.com/openkcm/plugin-sdk/commit/db2696db14dd763a999e3ef7c652ccbcebc88219))
+
+## [0.11.0](https://github.com/openkcm/plugin-sdk/compare/v0.10.2...v0.11.0) (2026-04-15)
+
+
+### Features
+
+* get user details on identity manager ([#144](https://github.com/openkcm/plugin-sdk/issues/144)) ([60a8a80](https://github.com/openkcm/plugin-sdk/commit/60a8a8097cf61645c782b9c77ba520f0b5db77c3))
+
+## [0.10.2](https://github.com/openkcm/plugin-sdk/compare/v0.10.1...v0.10.2) (2026-03-24)
+
+
+### Bug Fixes
+
+* revert managed keys ([#142](https://github.com/openkcm/plugin-sdk/issues/142)) ([5052979](https://github.com/openkcm/plugin-sdk/commit/5052979fa14ecfb4baaf2e499801ee9c98bb14ce))
+
+## [0.10.1](https://github.com/openkcm/plugin-sdk/compare/v0.10.0...v0.10.1) (2026-03-18)
+
+
+### Bug Fixes
+
+* **deps:** bump the gomod-group group with 2 updates ([#134](https://github.com/openkcm/plugin-sdk/issues/134)) ([d2a4eb9](https://github.com/openkcm/plugin-sdk/commit/d2a4eb9329ecf59d73df6414596be6ecf3027f00))
+
 ## [0.10.0](https://github.com/openkcm/plugin-sdk/compare/v0.9.9...v0.10.0) (2026-03-12)
 
 

Makefile

@@ -1,35 +1,107 @@
 .PHONY: generate
+generate: fetch-protos format-proto go-gen internal-go-gen
 
-generate: patch-swagger-doc format
-	go mod tidy
-	go mod vendor
+.PHONY: clean-proto
+clean-proto:
+	@find ./proto -type f -name '*.go' -exec rm {} +
 
-patch-swagger-doc: buf-gen internal-buf-gen
-	#./scripts/update_swagger.sh docs/openapiv2/apidocs.swagger.json
+.PHONY: clean-proto-internal
+clean-proto-internal:
+	@find ./internal/proto -type f -name '*.go' -exec rm {} +
 
-init-git-hooks:
-	git config --local core.hooksPath .githooks/
+.PHONY: fetch-protos
+fetch-protos:
+	@protofetch -o vendor-proto fetch
 
-buf-gen: init-git-hooks
-	buf dep update
-	./buf.gen.yaml
-	find . -name \*.go -not -path '.git/*' -exec goimports -local github.com/openkcm/plugin-sdk -w {} \;
+.PHONY: go-gen
+go-gen: clean-proto
+	@find ./proto -type f -iname '*.proto' -exec \
+		protoc -I./proto -I./vendor-proto \
+		--go_out=./proto \
+		--go_opt=paths=import \
+		--go_opt=module=github.com/openkcm/plugin-sdk/proto \
+		--go-grpc_out=./proto \
+		--go-grpc_opt=paths=import \
+		--go-grpc_opt=module=github.com/openkcm/plugin-sdk/proto \
+		--go-extension_out=./proto \
+		--go-extension_opt=module=github.com/openkcm/plugin-sdk/proto \
+		--go-extension_opt=submodule=github.com/openkcm/plugin-sdk/proto/service/common \
+		--go-extension_opt=kind=service \
+		--grpc-gateway_out=./proto \
+		--grpc-gateway_opt=paths=import \
+		--grpc-gateway_opt=module=github.com/openkcm/plugin-sdk/proto \
+		--grpc-gateway_opt=logtostderr=true \
+		{} +
 
-internal-buf-gen:
-	buf dep update
-	./internal-buf.gen.yaml
+	@find ./proto -type f -iname '*.proto' -exec \
+		protoc -I./proto -I./vendor-proto \
+		--go-extension_out=./proto \
+		--go-extension_opt=module=github.com/openkcm/plugin-sdk/proto \
+		--go-extension_opt=submodule=github.com/openkcm/plugin-sdk/proto/plugin \
+		--go-extension_opt=kind=plugin \
+		{} +
 
-format: buf-gen
-	buf format -w
+.PHONY: internal-go-gen
+internal-go-gen: clean-proto-internal
+	@find ./internal/proto -type f -iname '*.proto' -exec \
+		protoc -I./internal/proto -I./proto -I./vendor-proto \
+		--go_out=./internal/proto \
+		--go_opt=paths=import \
+		--go_opt=module=github.com/openkcm/plugin-sdk/internal/proto \
+		--go-grpc_out=./internal/proto \
+		--go-grpc_opt=paths=import \
+		--go-grpc_opt=module=github.com/openkcm/plugin-sdk/internal/proto \
+		--go-extension_out=./internal/proto \
+		--go-extension_opt=module=github.com/openkcm/plugin-sdk/internal/proto \
+		--go-extension_opt=submodule=github.com/openkcm/plugin-sdk/internal/proto/service \
+		--go-extension_opt=kind=service \
+		--grpc-gateway_out=./internal/proto \
+		--grpc-gateway_opt=paths=import \
+		--grpc-gateway_opt=module=github.com/openkcm/plugin-sdk/internal/proto \
+		--grpc-gateway_opt=logtostderr=true \
+		{} +
 
+.PHONY: format-proto
+format-proto:
+	@buf format -w
+
+.PHONY: format
+format: format-proto
+
+.PHONY: validate-proto
+validate-proto: format-proto lint-proto breaking
+
+.PHONY: lint-proto
+lint-proto:
+	@buf lint
+
+.PHONY: breaking
+breaking:
+	@buf breaking --against https://github.com/openkcm/plugin-sdk.git#branch=main
+
+.PHONY: install-proto-tools
+install-proto-tools:
+	brew install protobuf
+	go install \
+		google.golang.org/protobuf/cmd/protoc-gen-go@latest \
+		google.golang.org/grpc/cmd/protoc-gen-go-grpc@latest \
+		github.com/grpc-ecosystem/grpc-gateway/v2/protoc-gen-grpc-gateway@latest \
+		github.com/grpc-ecosystem/grpc-gateway/v2/protoc-gen-openapiv2@latest \
+		./cmd/protoc-gen-go-extension
+	brew install bufbuild/buf/buf
+	npm install -g @coralogix/protofetch
+
+.PHONY: lint-install
 lint-install:
 	go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@latest
 
-lint:
+.PHONY: lint
+lint: lint-proto
 	golangci-lint run -v --fix
 
+.PHONY: goimports
 goimports:
-	find . -name \*.go -not -path '.git/*' -exec goimports -local github.com/openkcm/plugin-sdk -w {} \;
+	find ./ -name \*.go -not -path '.git/*' -exec goimports -local github.com/openkcm/plugin-sdk -w {} +
 
 .PHONY: test
 test:

README.md

@@ -13,6 +13,67 @@ External plugins are separate processes and use
 
 KMS communicates with plugins over gRPC. As such, the various interfaces are defined via gRPC service definitions.
 
+## Pre-requisites
+
+Several tools are required to generate the code:
+
+1. **`protoc compiler`**: see the instruction on the official [web site](https://protobuf.dev/installation) or install using homebrew `brew install protobuf`.
+2. **`protoc-gen-go`**: install via `go install google.golang.org/protobuf/cmd/protoc-gen-go@latest`.
+3. **`protoc-gen-go-grpc`**: install via `go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@latest`.
+4. **`protoc-gen-grpc-gateway`**: install via `go install github.com/grpc-ecosystem/grpc-gateway/v2/protoc-gen-grpc-gateway`.
+5. **`protoc-gen-openapiv2`**: install via `go install github.com/grpc-ecosystem/grpc-gateway/v2/protoc-gen-openapiv2`.
+6. **`protofetch`**: download from the [releases page](https://github.com/coralogix/protofetch/releases/latest) of [the GitHub repository](https://github.com/coralogix/protofetch) or install via `cargo install protofetch` or `npm install -g @coralogix/protofetch`, or using any similar tool compatible with the npm registry.
+
+## Optional tools
+
+Optionally, the [`buf` CLI](https://github.com/bufbuild/buf) tool can be used to validate, detect breaking changes, and format `.proto` files:
+
+- **`buf breaking --against https://github.com/openkcm/api-sdk.git#branch=main`**: detect breaking changes against the main branch of the remote repository.
+- **`buf format -w`**: format `.proto` files.
+- **`buf lint`**: lint `.proto` files.
+
+## Makefile
+
+There are several `make` targets defined in the `Makefile`:
+
+- **`fetch-protos`**: download `.proto` dependencies using `protofetch`.
+- **`generate`**: fetches `.proto` dependencies, formats `.proto` files, and generates Go code.
+- **`install-proto-tools`**: installs the tools (including optional) from the following sources: Homebrew, Go registry (via `go install`), NPM registry (via `npm install -g`). See the target definition for the details.
+- **`validate-proto`**: formats and lints `.proto` files, detects breaking changes.
+
+For the rest `make` targets see `Makefile`.
+
+## Dependencies
+
+`.proto` dependencies are managed with the [`protofetch`](https://github.com/coralogix/protofetch) tool. This tool downloads `.proto` files from a specified location of a git repository and places them into the `vendor-proto` directory. The dependencies are specified in the `protofetch.toml` file.
+
+For instance, a dependency on the [`protovalidate`](https://github.com/bufbuild/protovalidate) proto definitions can be specified as follow:
+
+``` toml
+name = "github.com/openkcm/plugin-sdk"
+description = "Plugins SDK of the OpenKCM project"
+
+[protovalidate]
+url = "github.com/bufbuild/protovalidate"
+revision = "v1.1.1"
+content_roots = ["/proto/protovalidate"]
+allow_policies = ["buf/validate/*"]
+```
+
+In order to fetch dependencies, execute:
+
+``` sh
+$ protofetch -o vendor-proto fetch
+```
+
+## Generate Go code from the .proto definitions
+
+The code can be generated with executing the following Make target
+
+```sh 
+$ make generate
+```
+
 ## Support, Feedback, Contributing
 
 This project is open to feature requests/suggestions, bug reports etc. via [GitHub issues](https://github.com/openkcm/plugin-sdk/issues). Contribution and feedback are encouraged and always welcome. For more information about how to contribute, the project structure, as well as additional contribution information, see our [Contribution Guidelines](CONTRIBUTING.md).
@@ -27,3 +88,5 @@ We as members, contributors, and leaders pledge to make participation in our com
 ## Licensing
 
 Copyright 2025 SAP SE or an SAP affiliate company and OpenKCM contributors. Please see our [LICENSE](LICENSE) for copyright and license information. Detailed information including third-party components and their licensing/copyright information is available [via the REUSE tool](https://api.reuse.software/info/github.com/openkcm/plugin-sdk).
+
+<p align="center"><img alt="Bundesministerium für Wirtschaft und Klimaschutz (BMWK)-EU funding logo" src="https://apeirora.eu/assets/img/BMWK-EU.png" width="400"/></p>

Taskfile.yaml

@@ -5,5 +5,5 @@ includes:
     taskfile: hack/common/Taskfile_library.yaml
     flatten: true
     vars:
-      CODE_DIRS: '{{.ROOT_DIR}}/pkg/... {{.ROOT_DIR}}/proto/... {{.ROOT_DIR}}/internal/bootstrap/... {{.ROOT_DIR}}/internal/consts/... {{.ROOT_DIR}}/internal/slog2hclog/... {{.ROOT_DIR}}/api/...'
+      CODE_DIRS: '{{.ROOT_DIR}}/pkg/... {{.ROOT_DIR}}/internal/bootstrap/... {{.ROOT_DIR}}/internal/consts/... {{.ROOT_DIR}}/internal/slog2hclog/... {{.ROOT_DIR}}/api/...'
       GENERATE_DOCS_INDEX: "false"

buf.yaml

@@ -1,14 +1,15 @@
 version: v2
-deps:
-  - buf.build/bufbuild/protovalidate
 modules:
   - path: proto
   - path: internal/proto
+  - path: vendor-proto
 lint:
   use:
     - STANDARD
   except:
     - SERVICE_SUFFIX
+  ignore:
+    - vendor-proto
 breaking:
   use:
     - FILE

cmd/protoc-gen-go-extension/main.go

@@ -99,7 +99,7 @@ func generateServiceBridges(g *protogen.GeneratedFile, serviceName, serviceFullN
 	g.P()
 	g.P("const (")
 	if isPlugin {
-		g.P("	Type = ", strconv.Quote(serviceName))
+		g.P("	Type = ", strconv.Quote(strings.TrimSuffix(serviceName, "Service")))
 	}
 	g.P("	GRPCServiceFullName = ", strconv.Quote(serviceFullName))
 	g.P(")")