## Overview - This epic covers extending the [PMDB Distribution Service](https://gitlab.com/gitlab-org/security-products/license-db/pmdb-distribution-service) to distribute PMDB v3 license data to GitLab instances. The goal is to use the same distribution model and v3 archive contract as GLAM: - PMDB publishes: - manifest - full dataset - incremental delta archives - GitLab Rails uses checkpoints to fetch the data it needs - PDS provides the distribution boundary between GitLab instances and the PMDB export storage. ## Notes - As a starting point, the license data will be published to a **public GCP** bucket - We should use one PDS service serves both datasets. [Load testing](https://gitlab.com/gitlab-org/gitlab/-/work_items/602708) has shown the existing service can absorb the licenses traffic, so a second Runway deployment is not justified. - The PDS licenses endpoints are **authenticated**, using the same Cloud Connector instance JWT as malware but a separate licenses-specific scope. ## Why Use PDS for v3 Licenses? Using PDS as the distribution boundary provides the following benefits: * **Keep Rails agnostic to storage:** Rails does not need to know whether the data is stored in a public / private bucket, or whether the storage provider is Cloudflare R2 / GCP. This avoids coupling the Rails sync implementation to a specific storage choice and avoids maintaining an old bucket for two years solely because the transport is embedded in Rails. * **Reuse the v3 distribution logic**. PDS already contains the manifest, full-dataset, delta, archive URL, and related v3 distribution logic for the GLAM path. Adding licenses to the same distribution layer avoids implementing and maintaining a second delivery mechanism. * **Preserve a path to private distribution**. If license data moves from a public bucket to private storage in the future, PDS is already the natural boundary for authentication, authorization, and URL signing. ## Facts * PDS should first use the public bucket so no signed urls * When we are ready to migrate to a private bucket we will introduce signed urls ## Related * The Rails-side ingestion epic: https://gitlab.com/groups/gitlab-org/-/work_items/22880+s * PMDB epic: https://gitlab.com/groups/gitlab-org/-/work_items/18346+s * Parent: https://gitlab.com/groups/gitlab-org/-/work_items/16801+s