From 846acaf80da3005c29bf23d70c831d19d8166445 Mon Sep 17 00:00:00 2001
From: Pavol Loffay
Date: Mon, 31 Mar 2025 15:46:39 +0200
Subject: [PATCH 1/3] Initial implementation for TPM extension
Signed-off-by: Pavol Loffay
---
extension/tpmextension/README.md | 17 +++++
extension/tpmextension/config.go | 19 ++++-
extension/tpmextension/extension.go | 105 ++++++++++++++++++++++++++--
extension/tpmextension/go.mod | 4 ++
extension/tpmextension/go.sum | 8 +++
5 files changed, 147 insertions(+), 6 deletions(-)
diff --git a/extension/tpmextension/README.md b/extension/tpmextension/README.md
index 63cb33b25afa3..94e6f986d78c5 100644
--- a/extension/tpmextension/README.md
+++ b/extension/tpmextension/README.md
@@ -15,12 +15,29 @@
The Trusted Platform Module (TPM) extension retrieves TLS certificates from the TPM device.
+The extension implements `extensionauth.HTTPClient` interface therefore it can be used only with HTTP exporters (e.g. otlphttp exporter).
+
## Configuration
+* `path` (required): The path to the TPM device. For example, `/dev/tpmrm0`.
+* `key_file` (required): The path to the client TSS2 private key file.
+* `cert_file` (required): The path to the client certificate file.
+* `ca_file` (required): The path to the CA certificate file.
+* `server_name_override` (optional): The server name override for the TLS connection. This is useful when the server name does not match the certificate.
+* `owner_auth` (optional): The owner authorization password for the TPM device. This is required if the TPM device is protected by a password.
+* `auth` (optional): The password for the TPM device. This is required if the TPM device is protected by a password.
+
Example:
```yaml
extensions:
tpm:
+ path: /dev/tpmrm0
+ key_file: client_key.key
+ cert_file: server.crt
+ ca_file: ca.crt
+ server_name_override: example.com
+ owner_auth: tpm-password
+ auth: password
```
diff --git a/extension/tpmextension/config.go b/extension/tpmextension/config.go
index af6913a88cd6b..270a39efe1390 100644
--- a/extension/tpmextension/config.go
+++ b/extension/tpmextension/config.go
@@ -4,15 +4,32 @@
package tpmextension // import "github.com/open-telemetry/opentelemetry-collector-contrib/extension/tpmextension"
import (
+ "errors"
+
"go.opentelemetry.io/collector/component"
)
-type Config struct{}
+type Config struct {
+ // The path to the TPM device or Unix domain socket.
+ // For instance /dev/tpm0 or /dev/tpmrm0.
+ Path string `mapstructure:"path"`
+ // TSS2 key file
+ ClientKeyFile string `mapstructure:"key_file"`
+ ClientCertFile string `mapstructure:"cert_file"`
+ CaFile string `mapstructure:"ca_file"`
+ ServerName string `mapstructure:"server_name_override"`
+
+ OwnerAuth string `mapstructure:"owner_auth"`
+ Auth string `mapstructure:"auth"`
+}
func createDefaultConfig() component.Config {
return &Config{}
}
func (cfg *Config) Validate() error {
+ if cfg.Path == "" {
+ return errors.New("path must be non-empty")
+ }
return nil
}
diff --git a/extension/tpmextension/extension.go b/extension/tpmextension/extension.go
index e2e8dfd1ae40f..0b4f556fa68a2 100644
--- a/extension/tpmextension/extension.go
+++ b/extension/tpmextension/extension.go
@@ -5,37 +5,132 @@ package tpmextension // import "github.com/open-telemetry/opentelemetry-collecto
import (
"context"
+ "crypto/tls"
+ "crypto/x509"
+ "encoding/pem"
+ "fmt"
+ "net/http"
+ "os"
+
+ keyfile "github.com/foxboron/go-tpm-keyfiles"
+ "github.com/google/go-tpm/tpm2/transport"
+ "github.com/google/go-tpm/tpmutil"
"go.opentelemetry.io/collector/component"
"go.opentelemetry.io/collector/extension"
+ "go.opentelemetry.io/collector/extension/extensionauth"
)
-type tpmExtension struct {
+type TPMExtension struct {
config *Config
cancel context.CancelFunc
telemetrySettings component.TelemetrySettings
+
+ tlsConfig *tls.Config
}
-var _ extension.Extension = (*tpmExtension)(nil)
+var (
+ _ extension.Extension = (*TPMExtension)(nil)
+ _ extensionauth.HTTPClient = (*TPMExtension)(nil)
+ //_ extensionauth.GRPCClient = (*TPMExtension)(nil)
+)
+
+var _ extension.Extension = (*TPMExtension)(nil)
func newTPMExtension(extensionCfg *Config, settings extension.Settings) (extension.Extension, error) {
- settingsExtension := &tpmExtension{
+ settingsExtension := &TPMExtension{
config: extensionCfg,
telemetrySettings: settings.TelemetrySettings,
}
return settingsExtension, nil
}
-func (extension *tpmExtension) Start(_ context.Context, _ component.Host) error {
+func (extension *TPMExtension) Start(_ context.Context, _ component.Host) error {
extension.telemetrySettings.Logger.Info("starting up tpm extension")
+ tpm, err := tpmutil.OpenTPM(extension.config.Path)
+ if err != nil {
+ return err
+ }
+ c, err := os.ReadFile(extension.config.ClientKeyFile)
+ if err != nil {
+ return err
+ }
+ tss2Key, err := keyfile.Decode(c)
+ if err != nil {
+ return fmt.Errorf("failed to load %s: %w", extension.config.ClientKeyFile, err)
+ }
+ clientCert, err := loadCert(extension.config.ClientCertFile)
+ if err != nil {
+ return fmt.Errorf("failed to load %s: %w", extension.config.ClientCertFile, err)
+ }
+ caCert, err := loadCert(extension.config.CaFile)
+ if err != nil {
+ return fmt.Errorf("failed to load %s: %w", extension.config.CaFile, err)
+ }
+
+ caCertPool := x509.NewCertPool()
+ caCertPool.AddCert(caCert)
+
+ signer, err := tss2Key.Signer(transport.FromReadWriteCloser(tpm), []byte(extension.config.OwnerAuth), []byte(extension.config.Auth))
+ if err != nil {
+ return fmt.Errorf("failed to create TPM signer: %w", err)
+ }
+
+ tlsCert := tls.Certificate{
+ Certificate: [][]byte{clientCert.Raw},
+ PrivateKey: signer,
+ Leaf: clientCert,
+ }
+ tlsCfg := &tls.Config{
+ Certificates: []tls.Certificate{tlsCert},
+ RootCAs: caCertPool,
+ ServerName: extension.config.ServerName,
+ }
+
+ extension.tlsConfig = tlsCfg
return nil
}
-func (extension *tpmExtension) Shutdown(_ context.Context) error {
+func (extension *TPMExtension) Shutdown(_ context.Context) error {
extension.telemetrySettings.Logger.Info("shutting down tmp extension")
if extension.cancel != nil {
extension.cancel()
}
return nil
}
+
+func (extension *TPMExtension) RoundTripper(base http.RoundTripper) (http.RoundTripper, error) {
+ return &TPMRoundTripper{
+ baseTransport: base,
+ tpmTLSTransport: &http.Transport{
+ TLSClientConfig: extension.tlsConfig,
+ },
+ }, nil
+}
+
+type TPMRoundTripper struct {
+ baseTransport http.RoundTripper
+ tpmTLSTransport *http.Transport
+}
+
+// RoundTrip modifies the original request and adds Bearer token Authorization headers. Incoming requests support multiple tokens, but outgoing requests only use one.
+func (interceptor *TPMRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
+ return interceptor.tpmTLSTransport.RoundTrip(req)
+}
+
+func loadCert(cert string) (*x509.Certificate, error) {
+ certPEM, err := os.ReadFile(cert)
+ if err != nil {
+ return nil, err
+ }
+ certDER, _ := pem.Decode(certPEM)
+ if certDER == nil {
+ return nil, err
+ }
+ leafCert, err := x509.ParseCertificate(certDER.Bytes)
+ if err != nil {
+ return nil, err
+ }
+ return leafCert, nil
+}
diff --git a/extension/tpmextension/go.mod b/extension/tpmextension/go.mod
index d7ac3fb268664..a8e25032c8671 100644
--- a/extension/tpmextension/go.mod
+++ b/extension/tpmextension/go.mod
@@ -14,10 +14,12 @@ require (
require (
github.com/davecgh/go-spew v1.1.1 // indirect
+ github.com/foxboron/go-tpm-keyfiles v0.0.0-20250323135004-b31fac66206e // indirect
github.com/go-logr/logr v1.4.2 // indirect
github.com/go-logr/stdr v1.2.2 // indirect
github.com/go-viper/mapstructure/v2 v2.2.1 // indirect
github.com/gogo/protobuf v1.3.2 // indirect
+ github.com/google/go-tpm v0.9.3 // indirect
github.com/google/uuid v1.6.0 // indirect
github.com/hashicorp/go-version v1.7.0 // indirect
github.com/knadh/koanf/maps v0.1.1 // indirect
@@ -27,6 +29,7 @@ require (
github.com/mitchellh/reflectwalk v1.0.2 // indirect
github.com/pmezard/go-difflib v1.0.0 // indirect
go.opentelemetry.io/auto/sdk v1.1.0 // indirect
+ go.opentelemetry.io/collector/extension/extensionauth v0.122.1 // indirect
go.opentelemetry.io/collector/featuregate v1.28.2-0.20250319144947-41a9ea7f7402 // indirect
go.opentelemetry.io/collector/pdata v1.28.2-0.20250319144947-41a9ea7f7402 // indirect
go.opentelemetry.io/otel v1.35.0 // indirect
@@ -36,6 +39,7 @@ require (
go.opentelemetry.io/otel/trace v1.35.0 // indirect
go.uber.org/multierr v1.11.0 // indirect
go.uber.org/zap v1.27.0 // indirect
+ golang.org/x/crypto v0.36.0 // indirect
golang.org/x/net v0.37.0 // indirect
golang.org/x/sys v0.31.0 // indirect
golang.org/x/text v0.23.0 // indirect
diff --git a/extension/tpmextension/go.sum b/extension/tpmextension/go.sum
index 82af5240fb041..e45a254ae07ea 100644
--- a/extension/tpmextension/go.sum
+++ b/extension/tpmextension/go.sum
@@ -1,5 +1,7 @@
github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/foxboron/go-tpm-keyfiles v0.0.0-20250323135004-b31fac66206e h1:2jjYsGgM13xId2Ku+UGDQTO5It50LhT6lljiVJvBj1Y=
+github.com/foxboron/go-tpm-keyfiles v0.0.0-20250323135004-b31fac66206e/go.mod h1:uAyTlAUxchYuiFjTHmuIEJ4nGSm7iOPaGcAyA81fJ80=
github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY=
github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
@@ -13,6 +15,8 @@ github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek
github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
+github.com/google/go-tpm v0.9.3 h1:+yx0/anQuGzi+ssRqeD6WpXjW2L/V0dItUayO0i9sRc=
+github.com/google/go-tpm v0.9.3/go.mod h1:h9jEsEECg7gtLis0upRBQU+GhYVH6jMjrFxI8u6bVUY=
github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
github.com/hashicorp/go-version v1.7.0 h1:5tqGy27NaOTB8yJKUZELlFAS/LTKJkrmONwQKeRZfjY=
@@ -51,6 +55,8 @@ go.opentelemetry.io/collector/confmap v1.28.2-0.20250319144947-41a9ea7f7402 h1:j
go.opentelemetry.io/collector/confmap v1.28.2-0.20250319144947-41a9ea7f7402/go.mod h1:2aJggo/KQl7uynFyMNNMbl7jvKkSD7CniOVEpCbjRng=
go.opentelemetry.io/collector/extension v1.28.2-0.20250319144947-41a9ea7f7402 h1:pywGzFN4fmOBFVkUTHHYJ6Cb3X2Aad7CK385bDNLz6w=
go.opentelemetry.io/collector/extension v1.28.2-0.20250319144947-41a9ea7f7402/go.mod h1:IaovGuJib5XGgLejcBmpgwFS5/mCV4xnW/J2Towy5lM=
+go.opentelemetry.io/collector/extension/extensionauth v0.122.1 h1:rYzI7OpHVxtEftsBC++ob/mkZr03/xjUnzuzFje64tY=
+go.opentelemetry.io/collector/extension/extensionauth v0.122.1/go.mod h1:OMZA2hlWIL2uRvCLR954qKvDOjTB/tvHwdhPIkjro60=
go.opentelemetry.io/collector/extension/extensiontest v0.122.2-0.20250319144947-41a9ea7f7402 h1:/+Msl3614Hw5VFIeDAB+RJneCLGJ3qYUK2Q7guWqdgc=
go.opentelemetry.io/collector/extension/extensiontest v0.122.2-0.20250319144947-41a9ea7f7402/go.mod h1:fdsJ3X45rU5CeCWk8hscVrbr7u5MdO3DnnKCVWTMDEc=
go.opentelemetry.io/collector/featuregate v1.28.2-0.20250319144947-41a9ea7f7402 h1:myljH56zRxUJskSre+Qq8BUDMZkn8rYmtisG5wVQJ/c=
@@ -76,6 +82,8 @@ go.uber.org/zap v1.27.0/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
+golang.org/x/crypto v0.36.0 h1:AnAEvhDddvBdpY+uR+MyHmuZzzNqXSe/GvuDeob5L34=
+golang.org/x/crypto v0.36.0/go.mod h1:Y4J0ReaxCR1IMaabaSMugxJES1EpwhBHhv2bDHklZvc=
golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
From 20fd283d9e97904da06b9b7e01fcf4b2d708317c Mon Sep 17 00:00:00 2001
From: Pavol Loffay
Date: Mon, 31 Mar 2025 16:00:21 +0200
Subject: [PATCH 2/3] cleanup
Signed-off-by: Pavol Loffay
---
extension/tpmextension/go.mod | 6 +++---
extension/tpmextension/go.sum | 4 ++++
2 files changed, 7 insertions(+), 3 deletions(-)
diff --git a/extension/tpmextension/go.mod b/extension/tpmextension/go.mod
index a8e25032c8671..e5c9ccde41461 100644
--- a/extension/tpmextension/go.mod
+++ b/extension/tpmextension/go.mod
@@ -3,23 +3,24 @@ module github.com/open-telemetry/opentelemetry-collector-contrib/extension/tpmex
go 1.23.0
require (
+ github.com/foxboron/go-tpm-keyfiles v0.0.0-20250323135004-b31fac66206e
+ github.com/google/go-tpm v0.9.3
github.com/stretchr/testify v1.10.0
go.opentelemetry.io/collector/component v1.28.2-0.20250319144947-41a9ea7f7402
go.opentelemetry.io/collector/component/componenttest v0.122.2-0.20250319144947-41a9ea7f7402
go.opentelemetry.io/collector/confmap v1.28.2-0.20250319144947-41a9ea7f7402
go.opentelemetry.io/collector/extension v1.28.2-0.20250319144947-41a9ea7f7402
+ go.opentelemetry.io/collector/extension/extensionauth v0.122.1
go.opentelemetry.io/collector/extension/extensiontest v0.122.2-0.20250319144947-41a9ea7f7402
go.uber.org/goleak v1.3.0
)
require (
github.com/davecgh/go-spew v1.1.1 // indirect
- github.com/foxboron/go-tpm-keyfiles v0.0.0-20250323135004-b31fac66206e // indirect
github.com/go-logr/logr v1.4.2 // indirect
github.com/go-logr/stdr v1.2.2 // indirect
github.com/go-viper/mapstructure/v2 v2.2.1 // indirect
github.com/gogo/protobuf v1.3.2 // indirect
- github.com/google/go-tpm v0.9.3 // indirect
github.com/google/uuid v1.6.0 // indirect
github.com/hashicorp/go-version v1.7.0 // indirect
github.com/knadh/koanf/maps v0.1.1 // indirect
@@ -29,7 +30,6 @@ require (
github.com/mitchellh/reflectwalk v1.0.2 // indirect
github.com/pmezard/go-difflib v1.0.0 // indirect
go.opentelemetry.io/auto/sdk v1.1.0 // indirect
- go.opentelemetry.io/collector/extension/extensionauth v0.122.1 // indirect
go.opentelemetry.io/collector/featuregate v1.28.2-0.20250319144947-41a9ea7f7402 // indirect
go.opentelemetry.io/collector/pdata v1.28.2-0.20250319144947-41a9ea7f7402 // indirect
go.opentelemetry.io/otel v1.35.0 // indirect
diff --git a/extension/tpmextension/go.sum b/extension/tpmextension/go.sum
index e45a254ae07ea..52643db8a4d34 100644
--- a/extension/tpmextension/go.sum
+++ b/extension/tpmextension/go.sum
@@ -2,6 +2,8 @@ github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
github.com/foxboron/go-tpm-keyfiles v0.0.0-20250323135004-b31fac66206e h1:2jjYsGgM13xId2Ku+UGDQTO5It50LhT6lljiVJvBj1Y=
github.com/foxboron/go-tpm-keyfiles v0.0.0-20250323135004-b31fac66206e/go.mod h1:uAyTlAUxchYuiFjTHmuIEJ4nGSm7iOPaGcAyA81fJ80=
+github.com/foxboron/swtpm_test v0.0.0-20230726224112-46aaafdf7006 h1:50sW4r0PcvlpG4PV8tYh2RVCapszJgaOLRCS2subvV4=
+github.com/foxboron/swtpm_test v0.0.0-20230726224112-46aaafdf7006/go.mod h1:eIXCMsMYCaqq9m1KSSxXwQG11krpuNPGP3k0uaWrbas=
github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY=
github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
@@ -17,6 +19,8 @@ github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
github.com/google/go-tpm v0.9.3 h1:+yx0/anQuGzi+ssRqeD6WpXjW2L/V0dItUayO0i9sRc=
github.com/google/go-tpm v0.9.3/go.mod h1:h9jEsEECg7gtLis0upRBQU+GhYVH6jMjrFxI8u6bVUY=
+github.com/google/go-tpm-tools v0.4.4 h1:oiQfAIkc6xTy9Fl5NKTeTJkBTlXdHsxAofmQyxBKY98=
+github.com/google/go-tpm-tools v0.4.4/go.mod h1:T8jXkp2s+eltnCDIsXR84/MTcVU9Ja7bh3Mit0pa4AY=
github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
github.com/hashicorp/go-version v1.7.0 h1:5tqGy27NaOTB8yJKUZELlFAS/LTKJkrmONwQKeRZfjY=
From 0539d53a1e08a7ef0de3017854be410db204442e Mon Sep 17 00:00:00 2001
From: Pavol Loffay
Date: Mon, 31 Mar 2025 17:54:42 +0200
Subject: [PATCH 3/3] cleanup
Signed-off-by: Pavol Loffay
---
extension/tpmextension/go.mod | 2 +-
extension/tpmextension/go.sum | 1 +
2 files changed, 2 insertions(+), 1 deletion(-)
diff --git a/extension/tpmextension/go.mod b/extension/tpmextension/go.mod
index e5c9ccde41461..27818ed076c87 100644
--- a/extension/tpmextension/go.mod
+++ b/extension/tpmextension/go.mod
@@ -10,7 +10,7 @@ require (
go.opentelemetry.io/collector/component/componenttest v0.122.2-0.20250319144947-41a9ea7f7402
go.opentelemetry.io/collector/confmap v1.28.2-0.20250319144947-41a9ea7f7402
go.opentelemetry.io/collector/extension v1.28.2-0.20250319144947-41a9ea7f7402
- go.opentelemetry.io/collector/extension/extensionauth v0.122.1
+ go.opentelemetry.io/collector/extension/extensionauth v0.122.2-0.20250319144947-41a9ea7f7402
go.opentelemetry.io/collector/extension/extensiontest v0.122.2-0.20250319144947-41a9ea7f7402
go.uber.org/goleak v1.3.0
)
diff --git a/extension/tpmextension/go.sum b/extension/tpmextension/go.sum
index 52643db8a4d34..6eeb15263e25a 100644
--- a/extension/tpmextension/go.sum
+++ b/extension/tpmextension/go.sum
@@ -61,6 +61,7 @@ go.opentelemetry.io/collector/extension v1.28.2-0.20250319144947-41a9ea7f7402 h1
go.opentelemetry.io/collector/extension v1.28.2-0.20250319144947-41a9ea7f7402/go.mod h1:IaovGuJib5XGgLejcBmpgwFS5/mCV4xnW/J2Towy5lM=
go.opentelemetry.io/collector/extension/extensionauth v0.122.1 h1:rYzI7OpHVxtEftsBC++ob/mkZr03/xjUnzuzFje64tY=
go.opentelemetry.io/collector/extension/extensionauth v0.122.1/go.mod h1:OMZA2hlWIL2uRvCLR954qKvDOjTB/tvHwdhPIkjro60=
+go.opentelemetry.io/collector/extension/extensionauth v0.122.2-0.20250319144947-41a9ea7f7402/go.mod h1:VZGnKEwLI/UpuH32ZaXOs274fsmNec+0bVvkcOK8b98=
go.opentelemetry.io/collector/extension/extensiontest v0.122.2-0.20250319144947-41a9ea7f7402 h1:/+Msl3614Hw5VFIeDAB+RJneCLGJ3qYUK2Q7guWqdgc=
go.opentelemetry.io/collector/extension/extensiontest v0.122.2-0.20250319144947-41a9ea7f7402/go.mod h1:fdsJ3X45rU5CeCWk8hscVrbr7u5MdO3DnnKCVWTMDEc=
go.opentelemetry.io/collector/featuregate v1.28.2-0.20250319144947-41a9ea7f7402 h1:myljH56zRxUJskSre+Qq8BUDMZkn8rYmtisG5wVQJ/c=