#1185 Move the Santa sync server to the stable v1 protos Pull request opened by javuto Move the Santa sync server to the stable v1 protos Closes #1184 Problem osctrl's Santa sync server was built on

syncv2

from

buf.build/gen/go/northpolesec/protos

. North Pole Security has said that v2 is their internal protocol, "not supported for external users", and that they are removing it from the published protos (northpolesec/santa#1270). After that, the next update of the protos dependency will break osctrl's build. v1 is the stable protocol for third-party sync servers. North Pole Security will list osctrl as a sync server in the Santa docs once it uses v1. Change • In

pkg/santa/sync.go

and

cmd/tls/handlers/santa.go

, plus their tests, switch the import from

.../protocolbuffers/go/syncv2

to

.../protocolbuffers/go/sync

(package

syncv1

). • `pkg/santa/README.md`: the endpoint now says it serves Santa sync protocol v1. No behaviour changes for Santa clients. They already talk v1 to osctrl, and osctrl used no v2-only fields.

go.mod

is unchanged because v1 and v2 come from the same module. Compatibility • Stored data: v1 and v2 share the same enum names and numbers for everything osctrl stores (

SyncType

,

ClientMode

,

Policy

,

RuleType

,

Decision

), so existing rules, modes and pending sync types need no migration. • v2-only enum values: two no longer exist. The

SEATBELT

policy was never offered in the UI and is now rejected by the API. The CEL-fallback decisions (

ALLOW_CEL_FALLBACK

,

BLOCK_CEL_FALLBACK

) are not sent by v1 clients. Security / operational impact None. Auth (

X-Osctrl-Santa-Token

), body limits, UUID validation and node/environment ownership checks are untouched. Validation •

go build ./...

•

go vet ./pkg/santa ./cmd/tls/...

•

go test ./pkg/santa/... ./cmd/tls/...

pass •

grep -r syncv2 pkg cmd

is empty • Not yet verified with a stock Santa client running a full sync against this build Follow-up After release, reply on northpolesec/santa#1270 so osctrl can be listed as a sync server. jmpsec/osctrl