diff --git a/docs/NYMAUTH-TESTING.md b/docs/NYMAUTH-TESTING.md index 56366f2..ebf567a 100644 --- a/docs/NYMAUTH-TESTING.md +++ b/docs/NYMAUTH-TESTING.md @@ -181,7 +181,7 @@ URL, x5c = the DS leaf) is true from the mDOC IACA registry with the leaf alone. | component | pin | built from | |---|---|---| | vc-verifier / apigw / issuer / registry | `registry.fly.io/sirosid-gdc-vc-:local-1792609658` | vc `integration/gdc-nymauth-v5` @ `c8c5b1ea` (includes #840; verifier + circuit-artifact overlay) | -| wallet-backend (engine) | `registry.fly.io/sirosid-gdc-wallet-backend:local-1792564143` | go-wallet-backend local branch @ `9cb6e57` (#469, #471, #163, #472; #473 inside #471) | +| wallet-backend (engine) | `registry.fly.io/sirosid-gdc-wallet-backend:local-1792625654` | go-wallet-backend local branch @ `1d0708b` (#469, #471, #163, #472 + two local commits; go-wmp v0.9.1): the CLIENT does the encryption, so a client without that support fails issuance and direct_post.jwt | | pdp | `ghcr.io/sirosfoundation/go-trust:0.26.0` | released (go-trust#218) | The previously PROVEN vc build was `a56c4be9e` (verifier `local-1792603698`) with apigw/issuer/registry `local-1792473614`; the current pins diff --git a/environments/gdc.yaml b/environments/gdc.yaml index 3e30f97..c1c9e6f 100644 --- a/environments/gdc.yaml +++ b/environments/gdc.yaml @@ -80,22 +80,31 @@ images: # previous pins: verifier local-1792603698 (vc a56c4be9e, PROVEN flow); apigw/issuer/registry local-1792473614 (vc v4 # 5e546b2d: #793, #821, #813, #796, #820); older verifier builds local-1792542047, -1792532233, -1792523015 # - # wallet-backend (the ENGINE) registry.fly.io/sirosid-gdc-wallet-backend:local-1792564143 - # digest sha256:285a7ca4ee1eaa27cacbe45435965ba08b15e2e98b680636a29ee5073da97749 - # source go-wallet-backend `local/gdc-nymauth-integration-3` @ 9cb6e57d8498f0a1efa024254a6e99e2dbf278ab: a LOCAL branch, - # NEVER pushed (fetched by full SHA from a worktree); VERSION 0.24.0-nymauth.9cb6e57, GIT_REF empty. Base - # origin/main cb42861b6d640ea17166e6491f69761f58a5f172, plus signed --no-ff merges of: - # PRs https://github.com/sirosfoundation/go-wallet-backend/pull/469 @ e4e0bc3bd1fd800a7507a50d33b1703c6224100b - # (OID4VCI credential request encryption) - # https://github.com/sirosfoundation/go-wallet-backend/pull/471 @ f1362658c9891e1cbbbb2642898f9c6413fcc531 - # (client_metadata / verifier_jwk_thumbprint / verifier trust context, incl. the fail-closed verifier-trust fix - # of https://github.com/sirosfoundation/go-wallet-backend/pull/473) - # https://github.com/sirosfoundation/go-wallet-backend/pull/163 @ 71a07f8037c00c0faf139f23707c26a207ab7a8c - # (WMP, go-wmp v0.7.0) + # wallet-backend (the ENGINE) registry.fly.io/sirosid-gdc-wallet-backend:local-1792625654 + # digest sha256:dbf1813070d62d66640afd6d5501fff1addc3152cb3b9eca78a0c18504ff1afe + # source go-wallet-backend `local/gdc-nymauth-integration-4` @ 1d0708b13f7afe4752250f8e9fe04e0ab719c98f: a LOCAL branch, + # NEVER pushed (fetched by full SHA from a worktree); VERSION 0.24.0-nymauth.1d0708b, GIT_REF empty. Base origin/main + # cb42861b6d640ea17166e6491f69761f58a5f172, go-wmp v0.9.1, plus these merges (heads that were built): + # PRs https://github.com/sirosfoundation/go-wallet-backend/pull/469 @ 4539967d51244bfc5d109859dd996fea421830c4 + # (issuance half of the client-side / blind encryption) + # https://github.com/sirosfoundation/go-wallet-backend/pull/471 @ cd6875bbbd902a066d1dcfc8b70f824112f8bf53 + # (presentation half, verified_request, trust context; includes the fail-closed verifier-trust fix of + # https://github.com/sirosfoundation/go-wallet-backend/pull/473) + # https://github.com/sirosfoundation/go-wallet-backend/pull/163 @ b4f33e8f6572e2a3a721e3048c3576a17ae74209 + # (WMP, go-wmp v0.9.1; includes the empty-DCQL-id fix of the #439 line, e71e0c0) # https://github.com/sirosfoundation/go-wallet-backend/pull/472 @ be69e2e70a7d00e7bdef85ea99792d7651cd2ec5 # (sign-stage refusal) - # none merged; human review pending. NOT included: https://github.com/sirosfoundation/go-wallet-backend/pull/470. - # rollback pins: local-1792560364 (faa5e63), local-1792473614 (#469 only, e4e0bc3) + # plus TWO local-only commits in no PR: a25df83 (the sign refusal wins over response_jwe; client-controlled error text + # is never relayed) and 1d0708b (integration glue: wmphandler.go copies the new sign params over WMP + a translation test) + # none merged; human review pending. NOT included: https://github.com/sirosfoundation/go-wallet-backend/pull/470, and + # a Copilot finding on #469 (an encrypted HTTP 202 deferred response is not relayed) that is being fixed: a follow-up + # rebuild will carry it. + # BREAKING for clients: the engine relies on the CLIENT for encryption. OLD CLIENTS FAIL encrypted issuance + # (generate_proof / decrypt_credential_response, flow_complete without credential values) and direct_post.jwt + # presentations (sign_presentation with response_encryption + verified_request; the client returns response_jwe) until the + # SDKs land. Accepted by the user for gdc. Config: no key added, renamed or removed. + # rollback pins: local-1792564143 (9cb6e57, server-side encryption: works with the current Pixel APK), local-1792560364 (faa5e63), + # local-1792473614 (#469 only) # # pdp (go-trust) ghcr.io/sirosfoundation/go-trust:0.26.0 (RELEASED, tag v0.26.0, commit 621b03f4) # index digest sha256:73d994eaabcf27d68837c12ef42cbb16072c87562c6abe5cf7e2332a8068cf1e @@ -216,7 +225,7 @@ images: # NOT configured here: server.external_urls.engine_url, so /.well-known/wmp-configuration returns 503 (startup warns), # and the wallet-proxy routes only /api/v2/wallet to the engine port, so the discovery path is not routed either. # Re-pin to the released go-wallet-backend image once those PRs are merged and released. - wallet-backend: registry.fly.io/sirosid-gdc-wallet-backend:local-1792564143 + wallet-backend: registry.fly.io/sirosid-gdc-wallet-backend:local-1792625654 # previous pins: faa5e63 = local-1792560364; PR 469 only = local-1792473614 # The rest of the SIROS components, at the last RELEASED version as of 2026-10-08. Pinned here, not in diff --git a/environments/nymauth.yaml b/environments/nymauth.yaml index c45df4f..cdf8f25 100644 --- a/environments/nymauth.yaml +++ b/environments/nymauth.yaml @@ -43,7 +43,7 @@ images: vc-apigw: registry.fly.io/sirosid-gdc-vc-apigw:local-1792609658 # vc c8c5b1ea (seed delivery, #840) vc-issuer: registry.fly.io/sirosid-gdc-vc-issuer:local-1792609658 vc-registry: registry.fly.io/sirosid-gdc-vc-registry:local-1792609658 - wallet-backend: registry.fly.io/sirosid-gdc-wallet-backend:local-1792564143 # engine 9cb6e57 (#469/#471/#163/#472) + wallet-backend: registry.fly.io/sirosid-gdc-wallet-backend:local-1792625654 # engine 1d0708b (client-side encryption) pdp: ghcr.io/sirosfoundation/go-trust:0.26.0 # released; verifier_ids (go-trust#218) wallet-frontend: ghcr.io/sirosfoundation/wallet-frontend:0.5.0-1-sirosid.11