Skip to content

BSL v2.0 Release Plan

Madeline Farina edited this page Jul 31, 2026 · 12 revisions

The associated repository milestones are BSL v1.1.1 and BSL v2.0.0.

Identification of Products

AMMOS Configuration ID Program Set Name Program Set Version Number
681.4 Bundle Protocol Security Library 2.0

Release Overview

This release includes the following categories of changes:

  • Updates to support integration of ION 4.2.0-a.1
  • CRIT-2 and CRIT-3 bug fixes
  • MockBPA test fixture updates for testing purposes
  • Addition of the BPSec COSE context

Note that there will be an incremental release (v1.1) for the BSL in June 2026 and a standard release (v2.0) in October 2026. There was also a release plan revision in June 2026 for v2.0 to de-scope certain RLIs and add in other RLIs, as per the guidelines described in the Process Deviations section below.

Release Customers

This will affect the APL COR (Common Overlay Router) project and the JPL ION project who both wish to use the v1.1 release of BSL. In terms of additional users, we also have the Unibo-BP project by the DTN research group (DEI/ARCES) at the University of Bologna.

Controlling Documents

Please refer to the BSL Document repository for all publicly accessible BSL documentation.

Process Deviations

Given that the development of BSL is subcontracted to the Applied Physics Lab (APL), labor rates are proprietary. Individual line-item work estimates will not be provided as such estimates could potentially be used to "back out" labor rates for this task. In addition, this task is tracked in a Github wiki, and this information should not be publicly accessible. APL and AEM will monitor costs and immediately notify the Business Office if any concerns arise.

Moreover, if higher priority RLIs take more resources than originally estimated, lower priority items will be de-scoped to stay within budget via an approved release plan deviation. Any issues will be relayed to the Business Office as soon as possible.

Delivery Risks

None.

Dependencies

The BSL strives to avoid excessive reliance on third-party libraries and a long software supply chain. A few third-party libraries are required, however, to provide dynamic data structures for this C codebase, a unit-test driver, a CODEC for CBOR-encoded Bundle blocks, and implementations of cryptographic algorithms. These third-party open-source libraries respectively are m*lib, Unity, QCBOR, and OpenSSL. The following table lists all BSL dependencies, as well as the associated version, and any relevant licensing information.

Dependency Version License Purpose
QCBOR 1.5.3 Open source build dependency, a CODEC for CBOR-encoded Bundle blocks(required)
m*lib 0.7.4 Open source build dependency for heap-allocated data containers (required)
Unity 2.6.1 Open source build dependency for unit test fixtures (required)
OpenSSL 3.5.5 Open source build dependency for cryptographic functions (required)
Jansson 2.14 Open source build dependency (required)
cmake 3.31.8 Open source build dependency (required)
ninja-build 1.10.2 Open source build dependency (required)
ruby 4.0.2 Open source build dependency (required)
gcc 11.5.0 Open source build dependency (required)
valgrind 3.26.0 Open Source build dependency (required)
doxygen 1.16.1 Open source generating documentation (optional)
graphviz 15.1.4 Open source generating documentation (optional)
plantuml 1.2026.2 Open source generating documentation (optional)
bibtex 0.99e Open source generating documentation (optional)
asciidoctor 2.0.26 Open source generating documentation (optional)

Release Activities

Milestone Scheduled Date
Development Period of Performance 27 March 2026 - 31 July 2026
BSL v1.1 Incremental Release Available 05 June 2026
TRR Documentation Freeze 06 August 2026
Test Readiness Review 13 August 2026
DDR Documentation Freeze 01 October 2026
Delivery and Deployment Review 08 October 2026

Current Release Line Items

Requirements

No specific issues.

Improvements

Specific issues with enhancement label:

Ticket Customer Security-related Release Deviation
#47 Mock BPA add warnings about transmitted or received bundle constraints no v1.1
#61 get_target_block_id will not work if there are multiple blocks of target type no v1.1
#69 Separate notions of "Param" vs "Options" no v2.0
#71 Clean up / Remove "ResponseSet" no v2.0
#75 Clean up initializer lists in unit tests no v2.0
#76 Create Init functions for structs in unit tests no v1.1
#81 BSLP_PolicyProvider_t Should have an Init/API no v1.1
#109 Refactor JSON to only parse file(s) once in MockBPA ION no v1.1
#110 Better managing of keys in Crypto Library key registry no v1.1
#132 Support for BPSec COSE context no v2.0
#135 Add option for integration into ION ION no v1.1
#184 Call security context validate functions in backend security context implementation no v2.0 new
#201 Add pkg-config file to support version detection ION no v2.0 new

Total: 13

  • Total for v1.1: 8
  • Total for v2.0: 5

Note that if an RLI has "new" in the Deviation column, that indicates it was added during the release plan revision in June 2026.

Defect Repairs

Specific issues with bug label:

Ticket Customer Security-related Criticality Release Deviation
#123 Move log writer thread into host/Mock BPA ION no CRIT-3 v1.1
#133 Support memory management through callbacks ION no CRIT-3 v1.1
#134 Add ifndef checks to CHK* #defines ION no CRIT-3 v1.1
#151 Fix BCB verifier role yes CRIT-2 v1.1 new
#197 Fix finalize call in BCB decrypt yes CRIT-2 v1.1 new

Total: 5

Sustaining Activities

Specific issues with sustainment label:

Ticket Customer Security-related Release Deviation
#24 Remove block count limit in mock BPA no v1.1
#36 bsl_mock_encode_bundle() should not be sorting blocks no v1.1
#67 SHA Variant should be uint64_t, not size_t no v1.1
#125 RPM packaging discrepancies no v1.1
#126 Improve format consistency no v2.0
#130 Move test keys out of source tree no v1.1
#152 BCB source should set sec block number in sec oper no v1.1 new
#153 Update MockBPA tests to send to overlayer socket; update test policy to appin loc no v1.1 new
#164 Move JSON policy parsing out of Mock BPA to Sample PP no v1.1 new
#176 Tidying and Housekeeping of CryptoInterface.h no v2.0 new
#178 Replace Mock BPA crc16 and crc32 functions no v2.0 new
#181 Consider if block should be created by inspect function or backend security context no v2.0 new

Total: 12

  • Total for v1.1: 8
  • Total for v2.0: 4

Documentation

Specific issues with documentation label (and documentation label only):

Ticket Customer Security-related Release
#136 Product Guide Updates no v1.1
#146 Update SRD no v2.0
#147 Update User Guide no v2.0

Total: 3

Other documents:

  • TRR presentation
  • DDR presentation

There are additional BSL documents that will be updated this release cycle that are not found in the publicly available bsl-docs repository, so they are not listed here. This release plan only refers to publicly available information, which is also why no document numbers have been included. Note that no tickets were created to track the effort of making new TRR and DDR presentations, as it was determined to be unnecessary.

Other

None.

Deviations

The following RLIs were de-scoped as of June 2026:

Ticket Customer Security-related (Intended) Release Type
#33 Bind BPA HostDescriptors to a BSL Context no v2.0 enhancement
#35 QCBOR FinishGetSize does not set needed encoding size on small buffers no v2.0 enhancement
#37 Many index-based walking of linked lists no v2.0 enhancement
#49 Optimize SecOps to combine into single Sec Blocks when possible no v2.0 enhancement
#54 Sample Policy Provider SecOp ordering creates intermediate list before appending to Action no v2.0 enhancement
#66 Move function headers from Private.h to respective .h no v2.0 enhancement
#68 Index "Realized" SecOps & Existing Bundle SecOps in policy provider no v2.0 enhancement
#87 The BSL decodes the ASB multiple times for the same security block no v2.0 sustainment
#122 Better handling of Valgrind false-positive no v1.1 sustainment

Total: 9

Aside from #37 and #122 which were closed as OBE/Not Planned, these RLIs were determined to be unnecessary for either release, and none were needed by any customer or user.

Likewise, the following table contains the RLIs that were added to the revised RP but not in the original, approved RP (i.e., any RLI marked as "new" in Deviation column of the previous tables):

Ticket Customer Security-related Release Type
#151 Fix BCB verifier role yes v1.1 bug (CRIT-2)
#152 BCB source should set sec block number in sec oper no v1.1 sustainment
#153 Update MockBPA tests to send to overlayer socket; update test policy to appin loc no v1.1 sustainment
#164 Move JSON policy parsing out of Mock BPA to Sample PP no v1.1 sustainment
#176 Tidying and Housekeeping of CryptoInterface.h no v2.0 sustainment
#178 Replace Mock BPA crc16 and crc32 functions no v2.0 sustainment
#181 Consider if block should be created by inspect function or backend security context no v2.0 sustainment
#184 Call security context validate functions in backend security context implementation no v2.0 enhancement
#197 Fix finalize call in BCB decrypt yes v1.1 bug (CRIT-2)
#201 Add pkg-config file to support version detection ION no v2.0 enhancement

Total: 10

Release Plan Revision

Commitments Improvements Defect Repairs Sustaining Activities Documentation Other
First Approval (MGSSAITS-1665) 0 18 3 8 3 0
Second Approval 0 13 5 12 3 0
TRR
DDR

Clone this wiki locally