transmute-industries / vc.js

https://transmute-industries.github.io/vc.js/
Other
17 stars 6 forks source link

Divergence from jsonld-signatures #64

Open JaceHensley opened 3 years ago

JaceHensley commented 3 years ago

I was testing compatibility between linked-data-proof and jsonld-signatures and noticed some divergence here https://github.com/transmute-industries/vc.js/blob/master/packages/linked-data-proof/src/ProofSet.ts#L150 and here https://github.com/digitalbazaar/jsonld-signatures/blob/master/lib/ProofSet.js#L188. I believe the fix would be:

+ const context = document['@context'] || constants.SECURITY_CONTEXT_URL
  const proofSet = proofSet.map((proof: any) => ({
-   '@context': constants.SECURITY_CONTEXT_URL,
+   '@context': context,
    ...proof,
  }));

When testing that out I also noticed that vc.js will need to be updated too: https://github.com/transmute-industries/vc.js/blob/master/packages/vc.js/src/vc-ld/purposes/CredentialIssuancePurpose.ts#L62. The fix here I think would be:

  const issuer = jsonld.getValues(
    document,
-   'https://www.w3.org/2018/credentials#issuer'
+   'issuer'
  );
+ const issuerId = const issuerId = typeof issuer[0] === 'string' ? issuer[0] : issuer[0].id;
-  if (result.controller.id !== issuer[0].id) {
+  if (result.controller.id !== issuerId) {
    throw new Error(
      'Credential issuer must match the verification method controller.'
    );
  }

I tried to create a PR that fixes and tests these things but to do so I needed a signing suite that wasn't supported by sec-v2 context I tried using https://github.com/digitalbazaar/ed25519-signature-2020 but that requires the latest jsonld-signatures and that has other changes that impact compatibility (no more compact proof support)

OR13 commented 3 years ago

stumbled on this again today.

The main changes seem to be:

  1. SEC_V2 is not longer required when verifying / issuing
  2. documentLoader does dereference instead of resolve now.