Repository navigation
feat: did:scid signers, VTCs and bridge identities - #168
Merged
Merged
Conversation
…by identity A did:scid:vh:1 identity is the DID; its ?src= is where its log is found (VTI-KEY-160). The Signed-by-DID claim used to drop every query, so a did:scid signer's claim reached verify-trust as a bare DID that a stranger's resolver holds no source for, and every commit it signed was UnresolvedSigner. vgi_core::signer_did now keeps a did:scid's ?src= (only when it is the sole query) and strips everything else as before. same_signer compares two claims by identity, which conflicting_signer_dids, did-git-sign's committer guard and the bridge's re-sign checks use, so a trailer with ?src= and a committer without it agree. A did:scid and the did:webvh of its log stay different signers (VTI-KEY-164). verify-trust asks the registry about the bare identity, for the signer and the VTC alike. vgi-core takes affinidi-did-common (default features off) for the rule, which needs 0.4.4 (the scid module). Signed-off-by: Glenn Gore <glenn.g@affinidi.com>
…, --owner and --registry These values are written into the repository for its verifier to resolve, so a did:scid:vh:1 is taken as its DID URL with ?src= and nothing else, and a bare did:scid:vh:1 is refused with a message naming the form to give (VTI-KEY-163). Every other DID is held to the DID-core production as before. Signed-off-by: Glenn Gore <glenn.g@affinidi.com>
… DID is presented init gains --did-method (webvh|scid) and --scid-also-known-as. A DID created there goes through vta/webvh/dids/create 1.2 when either is given. A DID signs as its did:scid identity when asked, or when its context's primary DID is that did:scid; the key id is then given with the ?src= a verifier needs (did:scid:vh:1:<scid>?src=…#key-N). Signing as did:scid refuses a log that does not list the alias (VTI-KEY-166). Also adds the wildcard arms vta-sdk's #[non_exhaustive] VtaEvent and DiagStatus need (verifiable-trust-infrastructure #2196). Signed-off-by: Glenn Gore <glenn.g@affinidi.com>
…ID as one setup gains --did-method and --scid-also-known-as for a DID minted into the bridge's context (vta/webvh/dids/create 1.2 when either is given). A bridge presented as did:scid is addressed by its DID URL with ?src=. For a did:scid identity the VTA names key records by the did:webvh log's method ids and exports secrets under the bare did:scid, and the resolved document lists keys under the bare DID (VTI-KEY-161). Key fingerprints, key ages, reconcile and listed_keys now match by the bare identity and map log-named records to their did:scid ids. Trust Task proofs and the Signed-by-DID trailer name the signing key with the identity's ?src=, so issuer and verificationMethod are in one form (VTI-KEY-163); DIDComm secrets keep the document's bare ids. Also adds the wildcard arm vta-sdk's #[non_exhaustive] DiagStatus needs (#2196). The end-to-end proof test is ignored until trust-tasks-proof ships the did:scid src fix (dtgwg-trust-tasks-tf 6c893c09e). Signed-off-by: Glenn Gore <glenn.g@affinidi.com>
…d:scid-aware trust-tasks-proof Signed-off-by: Glenn Gore <glenn.g@affinidi.com>
clippy 1.99's collapsible_match flags the nested `if let` on `VtaEvent::Connected`; the pattern moves into the match arm. Signed-off-by: Glenn Gore <glenn.g@affinidi.com>
…0 and trust-tasks 0.34; release 0.25.0 vta-sdk 0.73 is the release that admits a did:scid identity, which did-git-sign and the bridge now sign as. It is on trust-tasks 0.34, affinidi-tdk 0.32 and affinidi-messaging-sdk 0.40 (TSP 1.0), so those floors move with it, together with affinidi-did-common 0.4.4 (the `scid` module), affinidi-did-resolver-cache-sdk 0.8.43 (native did:scid), didwebvh-rs 0.8.2, trust-tasks-proof 0.34.2 and the test mediator 0.45. trql-client 0.27, still the registry's latest release, declares trust-tasks ^0.32, so verify-trust's TrqlTransport impls name its TrustTask through a `trust-tasks-trql` alias, as for the 0.56 move. No trust-tasks type crosses from verify-trust into vta-sdk or the bridge, and did-git-sign has no trql-client edge. The alias goes when a trql-client on trust-tasks 0.34 is published. Workspace and internal crate versions 0.24.0 -> 0.25.0; bridge.example.toml pins v0.25.0. Signed-off-by: Glenn Gore <glenn.g@affinidi.com>
stormer78
force-pushed
the
feat/did-scid
branch
from
October 26, 2026 03:58
0789f14 to
ca246e7
Compare
stormer78
marked this pull request as ready for review
October 26, 2026 03:58
…ge built alone compiles affinidi-did-common 0.4.4 does not compile with its default features off: `KeyMaterial::generate` calls the per-curve generators unconditionally. The whole workspace builds because affinidi-tdk turns them on, but `cargo test -p vgi-forge-forgejo` resolves features for that package alone, and the Forgejo integration job failed to compile. Signed-off-by: Glenn Gore <glenn.g@affinidi.com>
…ffinidi stack The bridge image's release build on vta-sdk 0.73, affinidi-tdk 0.32 and trust-tasks 0.34 outgrew the runner's 7 GB. The runner was shut down mid compile with exit code 143 and no compiler error. A 16 GB swapfile lets the peaks spill to disk, as affinidi-messaging-mediator's image build does. Signed-off-by: Glenn Gore <glenn.g@affinidi.com>
On vta-sdk 0.73, affinidi-tdk 0.32 and trust-tasks 0.34, Clippy and MSRV outgrew the runner's 7 GB. The runner was shut down mid compile with exit code 143 and no compiler error. Clippy, Test, MSRV and the Forgejo integration job now get a 16 GB swapfile, as the bridge image build does. Signed-off-by: Glenn Gore <glenn.g@affinidi.com>
This was referenced Oct 26, 2026
stormer78
added a commit
that referenced
this pull request
Oct 26, 2026
… again (#180) 0.4.5 (affinidi-tdk-rs #974) compiles with `default-features = false`, so VGI goes back to taking only the identifier helpers. #168 had kept the default features on because 0.4.4 did not build without them, and `cargo test -p vgi-forge-forgejo` failed. Every package still checks on its own (`cargo check -p <pkg> --tests`). Signed-off-by: Glenn Gore <glenn.g@affinidi.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
did:scid in VGI (spec trustoverip/dtgwg-vti-spec#75).
Signed-by-DIDkeeps a did:scid's?src=so verifiers can resolve it;same_signer/signer_identity; registry queried with the bare identity.--vtc/--owner/--registryaccept a did:scid DID URL whose only query issrc; bare did:scid refused.init --did-method/--scid-also-known-asviacreate_did_webvh_presented; signs as did:scid only when the log lists the alias.setup --did-method/--scid-also-known-as; keys, ages, reconcile matched by identity; Trust Task proofs name the key in the issuer's form.Dependencies (all published): vta-sdk 0.73, affinidi-tdk 0.32, affinidi-messaging-sdk 0.40, trust-tasks-rs / trust-tasks-proof 0.34.2, affinidi-did-common 0.4.4 (
scidmodule), affinidi-did-resolver-cache-sdk 0.8.43 (native did:scid), didwebvh-rs 0.8.2, affinidi-messaging-test-mediator 0.45. Workspace version 0.24.0 -> 0.25.0 (bridge.example.tomlpins v0.25.0).Known split: trql-client 0.27, still the registry's latest release, requires trust-tasks ^0.32. verify-trust's
TrqlTransportimpls name itsTrustTaskthrough atrust-tasks-trqlalias, as was done for the 0.56 move. No trust-tasks type crosses into vta-sdk or the bridge, and did-git-sign has no trql-client edge. The alias goes when a trql-client on trust-tasks 0.34 is published.Also: one collapsible_match clippy fix (clippy 1.99) in did-git-sign's provisioning event loop.
Tests:
cargo test --workspace --all-features: 842 passed, 0 failed. fmt, clippy (-D warnings, default and all features) andcargo audit --deny warningsare clean.