[leifj]

gdc runs exactly this branch (2026-10-21), and every pinned image below is a LOCAL BUILD OF UNMERGED PULL REQUESTS. This PR records the pins and what went into each build, so the team can see it. It contains and supersedes #79 (nym_auth verifier config + circuit artifact overlay) and #80 (verifier dNSName in the signing cert, opt-in, same key and root): review and merge this one and close those two, or merge them first and rebase this one. Nothing here is merged upstream; each pin must be re-pinned to a released image when its PRs land.

Pins (also written as a PIN PROVENANCE comment block at the top of images: in environments/gdc.yaml)

image	tag / digest	built from
vc-verifier	local-1792603698 / sha256:96c41f16dd9324da6890c76b9faa7810d4c8259cf142ffd16360e413c8ca8945	sirosfoundation/vc integration/gdc-nymauth-v5 @ a56c4be9ec42ef394d536f5ea08d80b50f2a95a0 (merge base SUNET/vc main 4bba38e614e1), zknative, + the circuit artifact overlay
vc-apigw / vc-issuer / vc-registry	local-1792473614 / apigw sha256:6d532929…eb27, issuer sha256:c0efa58f…8b58, registry sha256:458cb70c…3268	sirosfoundation/vc integration/gdc-nymauth-v4 @ 5e546b2d61d4756f04b39ea84d26cf6b18b830ba
wallet-backend (engine)	local-1792564143 / sha256:285a7ca4ee1eaa27cacbe45435965ba08b15e2e98b680636a29ee5073da97749	go-wallet-backend local/gdc-nymauth-integration-3 @ 9cb6e57d8498f0a1efa024254a6e99e2dbf278ab, a LOCAL branch that is never pushed; base origin/main cb42861b6d640ea17166e6491f69761f58a5f172
pdp	ghcr.io/sirosfoundation/go-trust:0.26.0 (released; index digest sha256:73d994eaabcf27d68837c12ef42cbb16072c87562c6abe5cf7e2332a8068cf1e)	v0.26.0 @ 621b03f4 = merge of sirosfoundation/go-trust#218 (verifier_ids from the whitelist, system_cert_pool and mdoc_rical registries); the policies for the two verifier actions are in values.pdp.extraConfig; deployed 2026-10-21

What is in each build (PR heads that were built)

Verifier (vc v5): SUNET/vc#827 @ 80d6ee9ef, SUNET/vc#829 @ 55a8c9d7f, SUNET/vc#830 @ 770885f31 (incl. the allow-all-PDP fix), SUNET/vc#831 @ deb0c19b6, SUNET/vc#832 @ 6649047e4 (all open), plus the rulebook v0.4 port, the verifier UI fixes (fn_id in req-schema.js; posted req vs wire _req) and the meta.source_format fix, on that integration branch. ZK libs https://github.com/sirosfoundation/zk-cred-longfellow v0.1.2 @ 58de20f0, https://github.com/sirosfoundation/zk-cred-vega v0.0.7 @ 8e7be172; matcher https://github.com/sirosfoundation/siros-dc-matcher v0.11.0; circuit catalog https://github.com/sirosfoundation/go-zk-circuits release v0.1.0-release.16 served from zk-circuits.fly.dev.

Issuer side (vc v4): SUNET/vc#793 @ 3bfa96b6e (seed-backed commitments; merged upstream since), SUNET/vc#821 @ fd078a057 (seed delivery; open), SUNET/vc#813 @ 2e69dd2b4, SUNET/vc#796 @ 62c93fa01 and SUNET/vc#820 @ 6db9dd19b (closed; superseded), on SUNET/vc main as of 2026-10-20 (so also upstream #809 and #790).

Engine: signed --no-ff merges on origin/main of sirosfoundation/go-wallet-backend#469 @ e4e0bc3b (credential request encryption), sirosfoundation/go-wallet-backend#471 @ f1362658 (client_metadata / verifier trust context, incl. the fail-closed fix of sirosfoundation/go-wallet-backend#473), sirosfoundation/go-wallet-backend#163 @ 71a07f80 (WMP, go-wmp v0.7.0), sirosfoundation/go-wallet-backend#472 @ be69e2e7 (sign-stage refusal). Human review pending on all; sirosfoundation/go-wallet-backend#470 is not included. Rollback pins are kept in the comments.

Config in this branch (from #79 and #80)

verifier.nym_auth (allowlist from zk-cred-longfellow profile.rs, artifact baked in by dockerfiles/verifier-nymauth.Dockerfile), preferred_vp_formats.zkp_req, verifier_id = x509_san_dns:sirosid-gdc-vc-verifier.fly.dev (scopes every pseudonym; changing it changes every pseudonym), presets nym_auth_pseudonym and nym_auth_pseudonym_age, and the opt-in signingCertDnsSan (re-issues the signing leaf from the same key and root). No engine config key changed.

Verified live on gdc after the verifier deploy

Startup clean; GET / in a headless browser lists both presets (the page was a spinner with the previous image); POST /ui/interaction with a preset-derived query yields a request object with client_id x509_san_dns:sirosid-gdc-vc-verifier.fly.dev, response_mode direct_post.jwt, an x5c leaf with the dNSName sirosid-gdc-vc-verifier.fly.dev, and a dcql credential of format zkp_req with meta {doctype_value, source_format: mso_mdoc} and _req carrying the pseudonym (and, for the age preset, age_check) items. Issuer /.well-known is advertisement-only. Three Pixel issuance rounds (seed delivered, /notification 204, engine forwarded, /v1/evaluate true) ran on earlier pins. A real wallet presentation is expected to fail until the proof's verification time T is agreed between wallet and verifier.

PDP verified live (2026-10-21, after the 0.26.0 deploy)

Replays against the live PDP: verifier path (x509_san_dns:sirosid-gdc-vc-verifier.fly.dev, the gdc x5c chain) for credential-verifier and verifier return decision true from the Fly whitelist and context.verifier_ids = [{x509_san_dns, sirosid-gdc-vc-verifier.fly.dev, basis client-id-binding}]; issuer mdoc-issuer and mdoc-issuer-auth (mDOC IACA registry) and credential-issuer (whitelist pid-issuers) are true with no verifier_ids, identical to 0.25.0 (also compared locally against 0.25.0 with the same rendered config); a self-signed chain with the same dNSName is false.

Not done here

WMP discovery on gdc (engine_url, the proxy route for /.well-known/wmp-configuration, proxy_buffering off for SSE) is a follow-up for when an SDK uses WMP.
🤖 Generated with Claude Code