search

w3c / vc-data-model

W3C Verifiable Credentials v2.0 Specification
https://w3c.github.io/vc-data-model/
Other
299 stars 106 forks source link

Add section on Context Validation. #1535

Closed msporny closed 3 months ago

msporny commented 4 months ago

This PR attempts to address issue #1529 by adding normative text requiring verifiers to implement context validation.

Preview | Diff

TallTed commented 4 months ago

There's a lot of repeated text, here and in https://github.com/w3c/vc-data-integrity/pull/291, which needs similar if not identical changes (which suggestions from myself and others do not currently reflect), possibly being adjusted to be said in one place, and referenced in the other.

msporny commented 4 months ago

@TallTed wrote:

There's a lot of repeated text, here and in w3c/vc-data-integrity#291, which needs similar if not identical changes (which suggestions from myself and others do not currently reflect), possibly being adjusted to be said in one place, and referenced in the other.

Yep, I had considered these issues:

  1. We duplicate this text in DI and VC JOSE COSE (because the VC JOSE COSE folks have historically not wanted to refer to DI and also because it would be weird for DI or VC JOSE COSE, which don't reference each other for anything, to cross-reference either way on this particular point... and then VCDM needs to pick one of those places to point to?
  2. We have DI and VC JOSE COSE point to the language in this VCDM PR, which would be a bit of a strange layering violation since they're both at a lower architectural level than VCDM (it would be weird to ref "up" to VCDM from DI).
  3. DI stands on it's own... you don't have to use it with VCDM, but this guidance is generally applicable to any JSON-LD document secured using DI, so it should probably exist over there even if it didn't exist in VCDM.

So, the solution seems to be to put it in both places, even though most of the text is duplicated, OR, if we can get past the "VC JOSE COSE needs to be at the same level as DI", we could just ref DI from VCDM (at least). I don't think we will get to consensus on that approach, so duplicating the text in VCDM and DI is the best I think we can achieve.

That said, happy to not duplicate the text, though the only reasonable path I see for that is to put this in DI (or maybe the JSON-LD spec, which you've raised as a concern @TallTed... but that doesn't happen before we get the VCWG specs to REC, IMHO).

Anyone else see a better way through this?

longpd commented 4 months ago

There's a lot of repeated text, here and in w3c/vc-data-integrity#291, which needs similar if not identical changes (which suggestions from myself and others do not currently reflect), possibly being adjusted to be said in one place, and referenced in the other.

So where @TallTed should the core changes be made, e.g., in (https://github.com/w3c/vc-data-integrity/pull/291) or (https://github.com/w3c/vc-data-model/pull/1535) with the pointer from the other?

longpd commented 4 months ago

So, the solution seems to be to put it in both places, even though most of the text is duplicated, OR, if we can get past the "VC JOSE COSE needs to be at the same level as DI", we could just ref DI from VCDM (at least). I don't think we will get to consensus on that approach, so duplicating the text in VCDM and DI is the best I think we can achieve.

That looks like the most pragmatic thing to do, that is, see if we can get consensus on referencing DI from VCDM, and if that's not possible then duplicating the text in VCDM and DI makes sense. We'll just have to insure (as best we can) that any changes to text VCDM are propagated to DI (and vice-versa) to they stay in sync.

msporny commented 4 months ago

@longpd wrote:

We'll just have to insure (as best we can) that any changes to text VCDM are propagated to DI (and vice-versa) to they stay in sync.

Update... the text across both PRs are now wildly out of sync (which only underscores @TallTed's concern)! Let's try to focus getting the language right on the DI PR and I'll update the VCDM PR (this one) once the DI text settles. It's largely the algorithm that changed (and is improved in the DI PR).

msporny commented 3 months ago

@longpd wrote:

See if we can get consensus on referencing DI from VCDM, and if that's not possible then duplicating the text in VCDM and DI makes sense.

Alright, that is what this PR now does. The spec text asserting that context validation MUST happen was already in the spec. This PR now just points to the DI spec, whose Context Validation section is quite thorough now with an explanation and a normative algorithm, to say how to do it. This doesn't change the normative reference to DI (we already had that). IOW, this is now an editorial PR and I'm merging it as such.

If folks object to that, we can duplicate the text in the DI spec into the VCDM spec.

msporny commented 3 months ago

Editorial, multiple reviews, changes requested and made, no objections, merging.