chore(deps): OpenTDFKit 5.0.1, whose policy binding is the OpenTDF spec form

[arkavo-com]

Summary

• Require OpenTDFKit from: "5.0.1". 5.0.0 can't be resolved by version because it pinned ZIPFoundation to a revision; 5.0.1, from fix(deps): require ZIPFoundation by version so consumers can resolve OpenTDFKit OpenTDFKit#58, requires 0.9.20 by version.
• Resolved graph:
  • OpenTDFKit 5.0.1 (3512e27)
  • CryptoSwift 1.10.0 (f2a627b)
  • ZIPFoundation 0.9.20 (22787ff)
  • SwiftCBOR 0.6.0
  • swift-argument-parser 1.7.0

Behaviour change: the policy binding is now the spec form

OpenTDFKit 5 writes keyAccess.policyBinding.hash as base64(HMAC-SHA256(DEK, base64(policy))), the raw 32-byte digest. Version 4 wrote the legacy base64(hex(HMAC)).

• HLSTDFPackager, StandardTDFSegmentCrypto and StandardTDFKeyProvider take their binding from TDFCrypto.policyBinding, so their manifests now carry the spec form.
• Rewrap needs a KAS with fix(kas): accept spec-compliant policy bindings opentdf/platform#4081. platform.arkavo.net has it, through fix(kas): accept spec-compliant policy bindings opentdf-platform#54.
• The FairPlay (fMP4) path already wrote the spec form itself (FairPlayPolicy.binding) and is unchanged.

Tests

• HLSTDFPackagerPolicyTests decode the binding as base64 of the raw digest (44 characters, 32 bytes), and assert that it isn't the legacy hex form.
• New FairPlayPolicyTests.openTDFKitBindingMatchesGolden: OpenTDFKit's binding equals the arks golden fixture, so the HLS and fMP4 paths agree.
• swift test: all 233 tests in 41 suites pass.

This will be released as 0.2.0. Consumers' KASes need opentdf/platform#4081.

🤖 Generated with Claude Code

https://claude.ai/code/session_01TTtgscNah3Wk739yom9NPF

[gitar-bot]

Code Review ✅ Approved

🔴 High risk · Switching policyBinding hashes to the raw-digest spec form could make rewrap fail on KAS versions lacking #4081.

Bumps OpenTDFKit to 5.0.1 so dependencies resolve by version, and switches the policy binding in HLS manifests to the OpenTDF spec form (base64 of the raw HMAC-SHA256 digest). No issues found.

Auto-approved: No blocking issues found.
Please see Auto-approve Docs for details on setting custom approval criteria.

Review coverage

🤖 Auto-approval Approved

📋 Rules No rules evaluated

🧪 Functional validation Not enabled · Set up

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Counting what did not apply, without listing it.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[gitar-bot]

Gitar has auto-approved this PR (configure)