Skip to content

Update deps. #844

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
masv3971 merged 3 commits into from
Oct 22, 2026
Merged

Update deps. #844

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
d308647
Update deps.
masv3971 Oct 22, 2026
f9f5b04
model: drop keyUsage expectation from WRPAC profile tests
masv3971 Oct 22, 2026
ce4a9f2
deps: bump chromedp to v0.21.0 and cdproto to v0.158.2
masv3971 Oct 22, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
The table of contents is too big for display.
Diff view
Diff view
  •  
  •  
  •  
2 changes: 1 addition & 1 deletion .devcontainer/devcontainer.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@
"build": {
"dockerfile": "Dockerfile",
"args": {
"GO_VERSION": "1.27.0"
"GO_VERSION": "1.27.3"
}
},
"customizations": {
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/docker-build-push.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -277,7 +277,7 @@ jobs:

- name: Upload Trivy results to Security tab
if: ${{ !cancelled() }}
uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
continue-on-error: true
with:
sarif_file: trivy-results.sarif
Expand Down
2 changes: 1 addition & 1 deletion dockerfiles/gobuild
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@
# already present (see dockerfiles/worker).
# Pinned to -bookworm so glibc matches distroless/cc-debian12 at runtime.
# Keep this tag aligned with GOBUILD_IMAGE default in dockerfiles/worker.
FROM golang:1.27.1-bookworm
FROM golang:1.27.3-bookworm

WORKDIR /go/src/app

Expand Down
2 changes: 1 addition & 1 deletion dockerfiles/worker
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@
# toolchains — the tool-install steps below no-op when they detect the
# tools are already present.
# Keep the golang tag aligned with dockerfiles/gobuild's FROM.
ARG GOBUILD_IMAGE=golang:1.27.1-bookworm
ARG GOBUILD_IMAGE=golang:1.27.3-bookworm
FROM ${GOBUILD_IMAGE} AS gobuild
WORKDIR /go/src/app
COPY Makefile .
Expand Down
20 changes: 10 additions & 10 deletions docs/CONFIGURATION.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1550,12 +1550,12 @@ When KeyConfig is unset the issuer falls back to signing metadata with the
credential key, logging a warning. That keeps an existing single-key
deployment booting across an upgrade rather than failing on start.

| Field | Type | Description | Example | Default | Required |
| --------------------- | ---------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------- | ------- | -------- |
| `validate` | `bool` | Validate enforces the WRPAC certificate profile at startup: keyUsage must include nonRepudiation (contentCommitment), subjectAltName must carry contact information (URI or email), and certificatePolicies must contain a WRPAC policy OID. Startup fails when the certificate does not conform. | - | - | No |
| `allowed_policy_oids` | `[]string` | AllowedPolicyOIDs optionally narrows which WRPAC certificate policy OIDs are accepted, for a deployment that must assert a specific assurance level. When empty, all four TS 119 411-8 WRPAC policy OIDs are accepted. | `["0.4.0.194118.1.3","0.4.0.194118.1.4"]` | - | No |
| `key_config` | `object` | Signing key and certificate chain for the access certificate. When set, issuer metadata is signed with this key and the chain is advertised in the JWT's x5c header; credentials continue to be signed with Issuer.KeyConfig. | - | - | No |
| `revocation` | `object` | Checking this certificate against the CRL distribution points it names. A certificate naming none cannot be checked, which reads as "could not determine" rather than as "not revoked". | - | - | No |
| Field | Type | Description | Example | Default | Required |
| --------------------- | ---------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------- | ------- | -------- |
| `validate` | `bool` | Validate enforces the WRPAC certificate profile at startup: subjectAltName must carry contact information (URI or email), and certificatePolicies must contain a WRPAC policy OID. Startup fails when the certificate does not conform. | - | - | No |
| `allowed_policy_oids` | `[]string` | AllowedPolicyOIDs optionally narrows which WRPAC certificate policy OIDs are accepted, for a deployment that must assert a specific assurance level. When empty, all four TS 119 411-8 WRPAC policy OIDs are accepted. | `["0.4.0.194118.1.3","0.4.0.194118.1.4"]` | - | No |
| `key_config` | `object` | Signing key and certificate chain for the access certificate. When set, issuer metadata is signed with this key and the chain is advertised in the JWT's x5c header; credentials continue to be signed with Issuer.KeyConfig. | - | - | No |
| `revocation` | `object` | Checking this certificate against the CRL distribution points it names. A certificate naming none cannot be checked, which reads as "could not determine" rather than as "not revoked". | - | - | No |

### `bbs`

Expand Down Expand Up @@ -1632,10 +1632,10 @@ with - it does not introduce a second certificate. Deployments not
participating in an ARF trust framework can leave it disabled and are
unaffected.

| Field | Type | Description | Example | Default | Required |
| --------------------- | ---------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------- | ------- | -------- |
| `validate` | `bool` | Validate enforces the WRPAC certificate profile at startup: keyUsage must include nonRepudiation (contentCommitment), subjectAltName must carry contact information (URI or email), and certificatePolicies must contain a WRPAC policy OID. Startup fails when the certificate does not conform. | - | - | No |
| `allowed_policy_oids` | `[]string` | AllowedPolicyOIDs optionally narrows which WRPAC certificate policy OIDs are accepted, for a deployment that must assert a specific assurance level (e.g. only the qualified policies). When empty, all four TS 119 411-8 WRPAC policy OIDs are accepted. | `["0.4.0.194118.1.3","0.4.0.194118.1.4"]` | - | No |
| Field | Type | Description | Example | Default | Required |
| --------------------- | ---------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------- | ------- | -------- |
| `validate` | `bool` | Validate enforces the WRPAC certificate profile at startup: subjectAltName must carry contact information (URI or email), and certificatePolicies must contain a WRPAC policy OID. Startup fails when the certificate does not conform. | - | - | No |
| `allowed_policy_oids` | `[]string` | AllowedPolicyOIDs optionally narrows which WRPAC certificate policy OIDs are accepted, for a deployment that must assert a specific assurance level (e.g. only the qualified policies). When empty, all four TS 119 411-8 WRPAC policy OIDs are accepted. | `["0.4.0.194118.1.3","0.4.0.194118.1.4"]` | - | No |

### `preferred_vp_formats`

Expand Down
32 changes: 14 additions & 18 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,15 +1,15 @@
module github.com/SUNET/vc

go 1.27.2
go 1.27.3

require (
filippo.io/edwards25519 v1.2.0
github.com/IBM/sarama v1.61.1
github.com/PaesslerAG/jsonpath v0.1.1
github.com/beevik/etree v1.8.1
github.com/biter777/countries v1.7.5
github.com/chromedp/cdproto v0.0.0-20260719223732-95f6af754cfe
github.com/chromedp/chromedp v0.16.0
github.com/chromedp/cdproto v0.158.2
github.com/chromedp/chromedp v0.21.0
github.com/coreos/go-oidc/v3 v3.21.0
github.com/creasty/defaults v1.11.0
github.com/crewjam/saml v0.5.1
Expand All @@ -25,6 +25,7 @@ require (
github.com/go-logr/zapr v1.3.0
github.com/go-playground/validator/v10 v10.30.5
github.com/go-sql-driver/mysql v1.10.1
github.com/goccy/go-yaml v1.19.2
github.com/golang-jwt/jwt/v5 v5.3.1
github.com/golang-migrate/migrate/v4 v4.20.1
github.com/google/uuid v1.6.0
Expand All @@ -50,7 +51,7 @@ require (
github.com/russellhaering/goxmldsig v1.6.1
github.com/sirosfoundation/go-cryptoutil v0.7.2
github.com/sirosfoundation/go-spocp v0.1.0
github.com/sirosfoundation/go-trust v0.24.1
github.com/sirosfoundation/go-trust v0.26.0
github.com/sirosfoundation/go-ts11client v0.0.0-20260821071625-a8d5997107d0
github.com/skip2/go-qrcode v0.0.0-20200617195104-da1b6568686e
github.com/stretchr/testify v1.12.1
Expand All @@ -74,6 +75,7 @@ require (
go.opentelemetry.io/otel/trace v1.47.0
go.uber.org/zap v1.28.0
golang.org/x/crypto v0.58.0
golang.org/x/net v0.61.0
golang.org/x/oauth2 v0.37.0
golang.org/x/sync v0.24.0
golang.org/x/time v0.16.0
Expand All @@ -92,12 +94,11 @@ require (
github.com/beorn7/perks v1.0.1 // indirect
github.com/bytedance/gopkg v0.1.4 // indirect
github.com/bytedance/sonic v1.15.4 // indirect
github.com/bytedance/sonic/loader v0.5.2 // indirect
github.com/bytedance/sonic/loader v0.5.3 // indirect
github.com/cayleygraph/quad v1.3.0 // indirect
github.com/cenkalti/backoff/v4 v4.3.0 // indirect
github.com/cenkalti/backoff/v5 v5.0.3 // indirect
github.com/cespare/xxhash/v2 v2.3.0 // indirect
github.com/chromedp/sysutil v1.1.0 // indirect
github.com/cloudwego/base64x v0.1.7 // indirect
github.com/containerd/errdefs v1.0.0 // indirect
github.com/containerd/errdefs/pkg v0.3.0 // indirect
Expand All @@ -109,9 +110,9 @@ require (
github.com/docker/go-connections v0.8.2 // indirect
github.com/docker/go-units v0.5.0 // indirect
github.com/eapache/go-resiliency v1.7.0 // indirect
github.com/ebitengine/purego v0.11.1 // indirect
github.com/ebitengine/purego v0.11.2 // indirect
github.com/felixge/httpsnoop v1.1.0 // indirect
github.com/gabriel-vasile/mimetype v1.4.15 // indirect
github.com/gabriel-vasile/mimetype v1.4.16 // indirect
github.com/gin-contrib/sse v1.1.2 // indirect
github.com/go-jose/go-jose/v3 v3.0.5 // indirect
github.com/go-logr/stdr v1.2.2 // indirect
Expand All @@ -128,11 +129,7 @@ require (
github.com/go-openapi/swag/yamlutils v0.29.2 // indirect
github.com/go-playground/locales v0.14.2 // indirect
github.com/go-playground/universal-translator v0.18.2 // indirect
github.com/gobwas/httphead v0.1.0 // indirect
github.com/gobwas/pool v0.2.1 // indirect
github.com/gobwas/ws v1.4.0 // indirect
github.com/goccy/go-json v0.11.2 // indirect
github.com/goccy/go-yaml v1.19.2 // indirect
github.com/golang-jwt/jwt/v4 v4.5.2 // indirect
github.com/google/go-cmp v0.7.0 // indirect
github.com/gorilla/context v1.1.2 // indirect
Expand All @@ -150,7 +147,7 @@ require (
github.com/jonboulle/clockwork v0.5.0 // indirect
github.com/json-iterator/go v1.1.12 // indirect
github.com/kaptinlin/jsonpointer v0.4.28 // indirect
github.com/klauspost/cpuid/v2 v2.4.0 // indirect
github.com/klauspost/cpuid/v2 v2.4.1 // indirect
github.com/leodido/go-urn v1.5.0 // indirect
github.com/lestrrat-go/blackmagic v1.0.4 // indirect
github.com/lestrrat-go/dsig v1.4.0 // indirect
Expand Down Expand Up @@ -190,11 +187,11 @@ require (
github.com/prometheus/otlptranslator v1.0.0 // indirect
github.com/prometheus/procfs v0.22.0 // indirect
github.com/quic-go/qpack v0.6.0 // indirect
github.com/quic-go/quic-go v0.63.0 // indirect
github.com/quic-go/quic-go v0.64.1 // indirect
github.com/rcrowley/go-metrics v0.0.0-20250401214520-65e299d6c5c9 // indirect
github.com/segmentio/asm v1.2.1 // indirect
github.com/shirou/gopsutil/v4 v4.26.9 // indirect
github.com/shopspring/decimal v1.5.0 // indirect
github.com/shopspring/decimal v1.6.0 // indirect
github.com/sirosfoundation/g119612 v0.7.0 // indirect
github.com/sirupsen/logrus v1.10.2 // indirect
github.com/tklauser/go-sysconf v0.4.0 // indirect
Expand All @@ -218,12 +215,11 @@ require (
go.yaml.in/yaml/v3 v3.0.5 // indirect
golang.org/x/arch v0.32.0 // indirect
golang.org/x/mod v0.42.0 // indirect
golang.org/x/net v0.61.0 // indirect
golang.org/x/sys v0.49.0 // indirect
golang.org/x/text v0.43.0 // indirect
golang.org/x/tools v0.52.0 // indirect
google.golang.org/genproto/googleapis/api v0.0.0-20261012220534-4341edf3f941 // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20261012220534-4341edf3f941 // indirect
google.golang.org/genproto/googleapis/api v0.0.0-20261019180522-ce908d29299b // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20261019180522-ce908d29299b // indirect
)

replace github.com/russellhaering/goxmldsig => github.com/sirosfoundation/goxmldsig v1.6.1-siros1
Loading
Loading