gdc: pins to the current integration builds, with what went into each (supersedes #79 and #80)

.gitignore

@@ -84,3 +84,6 @@ fixtures/wrpac-clients/*.issued/
 
 # bootmgr editable install metadata (make install)
 *.egg-info/
+
+# nym_auth circuit artifact (decompressed, ~1 MB): a build input for dockerfiles/verifier-nymauth.Dockerfile
+fixtures/nym-auth-circuits/*.bin

README.md

@@ -471,7 +471,7 @@ The verifier has matching presentation-request templates in
 `eu.europa.ec.eudi.nym_auth.1`, carrying `birth_date` (full-date, tag 1004),
 `ssc` - SHA-256 of a 16-byte `secret_seed` the issuer and the prover share -
 and optionally `psc` (SHA-256 of a prover-only seed). It exists for
-`circuit_zk` presentations: pseudonyms and age predicates proven in zero
+`zkp_req` presentations (called `circuit_zk` before rulebook v0.4): pseudonyms and age predicates proven in zero
 knowledge, never disclosed. `fixtures/vc-metadata/nym_auth.mdoc.json` is a
 byte-for-byte copy of the rulebook's schema until registry.siros.org
 publishes it (mdoc types stay vendored even with `REGISTRY=external`).
@@ -517,6 +517,20 @@ in:** holder-supplied commitments (the `known-offender-matching-psc` configurati
 lands, REMOVE the fixed `psc` from `nym_auth*.json`: the issuer refuses any document that already carries a value
 for a configured commitment claim.
 
+**Verifying a pseudonym (gdc config; image comes with vc's verifier release).** `environments/gdc.yaml`
+`values.verifier.extraConfig` carries `verifier.nym_auth` (SUNET/vc#832): the allowlist entry
+`known-offender-matching-ssc` (circuit ids, Ligero block parameters, artifact size and SHA-256 from
+zk-cred-longfellow `src/nymauth/profile.rs`; do not copy the digest from vc's `docs/CONFIGURATION.md`, whose
+example has 52 zeros in the middle) and `preferred_vp_formats.zkp_req` (`system_id_values`, `proof_system_values`; rulebook v0.4 names). The ~1 MB decompressed artifact cannot
+travel as a Fly secret and is not in the vc repo, so `dockerfiles/verifier-nymauth.Dockerfile` bakes it into the
+verifier image at `/etc/vc/circuits/nym_auth-ssc.bin`, checking size and digest at build time (build input:
+`fixtures/nym-auth-circuits/nym_auth-ssc.bin`, gitignored; the recipe is in the file). The verifier needs the
+`zknative` build and refuses to start without `trust.pdp_url`: it takes the issuer key from the HOLDER's own
+chain, so the PDP is the only check that key belongs to an issuer (here: action `mdoc-issuer`, the mDOC IACA
+registry; a self-signed chain with the same SAN gets decision false). **`verifier_id` is the verifier's client_id exactly as published,
+`x509_san_dns:<host of public_url>` with the prefix (rulebook v0.4; the bare host was the rule before), and scopes every
+pseudonym: changing it changes every pseudonym this verifier reports.**
+
 ### Service Architecture
 
 ```

chart/templates/04-verifier.yaml

@@ -30,7 +30,7 @@ common:
   branding:
     favicon_path: /branding-assets/favicon.png
     logo_path: /branding-assets/logo.png
-  credential_metadata: {{- include "siros-id.vc.credentialMetadata" . | nindent 4 }}
+  credential_metadata: {{- include "siros-id.vc.credentialMetadataVerifier" . | nindent 4 }}
 verifier:
   public_url: https://{{ $hostnameVerifier }}
   api_server:

chart/templates/_helpers.tpl

@@ -144,18 +144,31 @@ the file extension is what distinguishes them on disk.
        concern of the issuer-apigw alone, so it is rendered only by the ...Apigw variant below: the other
        services have no seed source and must not be handed a block that names one. */ -}}
 {{- define "siros-id.vc.credentialMetadata" -}}
-{{- include "siros-id.vc.credentialMetadata.render" (list . false) -}}
+{{- include "siros-id.vc.credentialMetadata.render" (list . false false) -}}
 {{- end -}}
 
 {{- define "siros-id.vc.credentialMetadataApigw" -}}
-{{- include "siros-id.vc.credentialMetadata.render" (list . true) -}}
+{{- include "siros-id.vc.credentialMetadata.render" (list . true false) -}}
+{{- end -}}
+
+{{/*
+The verifier's credential_metadata: the same block WITHOUT the pre-authorized offer twins (`<type>_offer`,
+authProvider: preauth). A twin is an issuance-only scope, so listing it in the verifier doubled every entry of
+its /ui/metadata and picker. Nothing verifier-side resolves a scope by its `_offer` name; the base scope (nym_auth
+included, whose zkp_req presets take source_format and doctype_value from it) stays. The issuer keeps its twins: an
+offer's credential_configuration_id is resolved against credential_configurations_supported.
+*/}}
+{{- define "siros-id.vc.credentialMetadataVerifier" -}}
+{{- include "siros-id.vc.credentialMetadata.render" (list . false true) -}}
 {{- end -}}
 
 {{- define "siros-id.vc.credentialMetadata.render" -}}
 {{- $root := index . 0 -}}
 {{- $withCommitments := index . 1 -}}
+{{- $skipPreauth := index . 2 -}}
 {{- $_ := required "You must define credential types in the value features.credentialTypes" $root.Values.features.credentialTypes -}}
 {{- range $id, $data := $root.Values.features.credentialTypes }}
+{{- if not (and $skipPreauth (eq (default "" $data.issuance.authProvider) "preauth")) }}
 {{ $id | quote }}:
   {{- /* A pre-authorized twin reads its source's metadata file (see features.credentialTypes.<id>_offer). */}}
   {{- $file := $data.metadataFrom | default $id }}
@@ -181,6 +194,7 @@ the file extension is what distinguishes them on disk.
   {{- end }}
   {{- end }}
 {{- end }}
+{{- end }}
 {{- end -}}
 
 {{/*

dockerfiles/verifier-nymauth.Dockerfile

@@ -0,0 +1,34 @@
+# The vc verifier image plus the nym_auth circuit artifact, for environments that verify nym_auth pseudonym proofs
+# (environments/gdc.yaml, verifier.nym_auth).
+#
+# The artifact is the DECOMPRESSED Longfellow circuit (1,062,842 bytes). It cannot travel as a Fly file secret
+# (base64 of it exceeds the ~1 MiB machine config body) and the vc repo does not carry it, so it is baked in here.
+# The size and digest are checked at build time against the values the allowlist entry in environments/gdc.yaml
+# states, which are in turn the ones zk-cred-longfellow's src/nymauth/profile.rs ships; vc re-checks both at startup
+# and refuses anything else, so a wrong file fails the build rather than the first presentation.
+#
+#   zstd -dc <archive>/longfellow/mdoc/circuits.zst > fixtures/nym-auth-circuits/nym_auth-ssc.bin   # gitignored
+#   docker build -f dockerfiles/verifier-nymauth.Dockerfile \
+#     --build-arg BASE=registry.fly.io/sirosid-gdc-vc-verifier:<the vc verifier build, zknative> \
+#     -t registry.fly.io/sirosid-gdc-vc-verifier:local-<epoch> .
+#
+# The source archive is ours (no repository yet): ~/.cache/nymzip/nym-auth-circuits/longfellow/mdoc/circuits.zst
+# (395,608 bytes, sha256 6c4b96ed431ee547a3a2e5b62621943a9a0a44646267653bf2db0fcc269b5c3b). Fetch it from its
+# repository once there is one.
+ARG BASE
+FROM alpine:3.20 AS check
+ARG ARTIFACT_BYTES=1062842
+ARG ARTIFACT_SHA256=92dd42fdf99673249eec33c7d07850bd9da66fbdab01ef26391e04c8341c1b7f
+COPY fixtures/nym-auth-circuits/nym_auth-ssc.bin /nym_auth-ssc.bin
+RUN set -e; \
+    [ "$(wc -c < /nym_auth-ssc.bin)" = "${ARTIFACT_BYTES}" ] || { echo "artifact is not ${ARTIFACT_BYTES} bytes (decompressed?)"; exit 1; }; \
+    echo "${ARTIFACT_SHA256}  /nym_auth-ssc.bin" | sha256sum -c -
+
+# Staged with its directories here: a distroless runtime has no shell to chmod with, and `COPY --chmod` gives the
+# directories it creates the FILE's mode (0444: no x bit), which makes the artifact unreadable to the non-root user
+# ("open /etc/vc/circuits/nym_auth-ssc.bin: permission denied" at startup).
+RUN mkdir -p /out/etc/vc/circuits && cp /nym_auth-ssc.bin /out/etc/vc/circuits/nym_auth-ssc.bin \
+    && chmod 0755 /out/etc /out/etc/vc /out/etc/vc/circuits && chmod 0444 /out/etc/vc/circuits/nym_auth-ssc.bin
+
+FROM ${BASE}
+COPY --from=check /out/ /