Skip to content

gdc and nymauth: engine with client-side encryption (1d0708b), deployed #89

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
leifj merged 1 commit into from
Oct 21, 2026
Merged

gdc and nymauth: engine with client-side encryption (1d0708b), deployed #89

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion docs/NYMAUTH-TESTING.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -181,7 +181,7 @@ URL, x5c = the DS leaf) is true from the mDOC IACA registry with the leaf alone.
| component | pin | built from |
|---|---|---|
| vc-verifier / apigw / issuer / registry | `registry.fly.io/sirosid-gdc-vc-<svc>:local-1792609658` | vc `integration/gdc-nymauth-v5` @ `c8c5b1ea` (includes #840; verifier + circuit-artifact overlay) |
| wallet-backend (engine) | `registry.fly.io/sirosid-gdc-wallet-backend:local-1792564143` | go-wallet-backend local branch @ `9cb6e57` (#469, #471, #163, #472; #473 inside #471) |
| wallet-backend (engine) | `registry.fly.io/sirosid-gdc-wallet-backend:local-1792625654` | go-wallet-backend local branch @ `1d0708b` (#469, #471, #163, #472 + two local commits; go-wmp v0.9.1): the CLIENT does the encryption, so a client without that support fails issuance and direct_post.jwt |
| pdp | `ghcr.io/sirosfoundation/go-trust:0.26.0` | released (go-trust#218) |

The previously PROVEN vc build was `a56c4be9e` (verifier `local-1792603698`) with apigw/issuer/registry `local-1792473614`; the current pins
Expand Down
39 changes: 24 additions & 15 deletions environments/gdc.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -80,22 +80,31 @@ images:
# previous pins: verifier local-1792603698 (vc a56c4be9e, PROVEN flow); apigw/issuer/registry local-1792473614 (vc v4
# 5e546b2d: #793, #821, #813, #796, #820); older verifier builds local-1792542047, -1792532233, -1792523015
#
# wallet-backend (the ENGINE) registry.fly.io/sirosid-gdc-wallet-backend:local-1792564143
# digest sha256:285a7ca4ee1eaa27cacbe45435965ba08b15e2e98b680636a29ee5073da97749
# source go-wallet-backend `local/gdc-nymauth-integration-3` @ 9cb6e57d8498f0a1efa024254a6e99e2dbf278ab: a LOCAL branch,
# NEVER pushed (fetched by full SHA from a worktree); VERSION 0.24.0-nymauth.9cb6e57, GIT_REF empty. Base
# origin/main cb42861b6d640ea17166e6491f69761f58a5f172, plus signed --no-ff merges of:
# PRs https://github.com/sirosfoundation/go-wallet-backend/pull/469 @ e4e0bc3bd1fd800a7507a50d33b1703c6224100b
# (OID4VCI credential request encryption)
# https://github.com/sirosfoundation/go-wallet-backend/pull/471 @ f1362658c9891e1cbbbb2642898f9c6413fcc531
# (client_metadata / verifier_jwk_thumbprint / verifier trust context, incl. the fail-closed verifier-trust fix
# of https://github.com/sirosfoundation/go-wallet-backend/pull/473)
# https://github.com/sirosfoundation/go-wallet-backend/pull/163 @ 71a07f8037c00c0faf139f23707c26a207ab7a8c
# (WMP, go-wmp v0.7.0)
# wallet-backend (the ENGINE) registry.fly.io/sirosid-gdc-wallet-backend:local-1792625654
# digest sha256:dbf1813070d62d66640afd6d5501fff1addc3152cb3b9eca78a0c18504ff1afe
# source go-wallet-backend `local/gdc-nymauth-integration-4` @ 1d0708b13f7afe4752250f8e9fe04e0ab719c98f: a LOCAL branch,
# NEVER pushed (fetched by full SHA from a worktree); VERSION 0.24.0-nymauth.1d0708b, GIT_REF empty. Base origin/main
# cb42861b6d640ea17166e6491f69761f58a5f172, go-wmp v0.9.1, plus these merges (heads that were built):
# PRs https://github.com/sirosfoundation/go-wallet-backend/pull/469 @ 4539967d51244bfc5d109859dd996fea421830c4
# (issuance half of the client-side / blind encryption)
# https://github.com/sirosfoundation/go-wallet-backend/pull/471 @ cd6875bbbd902a066d1dcfc8b70f824112f8bf53
# (presentation half, verified_request, trust context; includes the fail-closed verifier-trust fix of
# https://github.com/sirosfoundation/go-wallet-backend/pull/473)
# https://github.com/sirosfoundation/go-wallet-backend/pull/163 @ b4f33e8f6572e2a3a721e3048c3576a17ae74209
# (WMP, go-wmp v0.9.1; includes the empty-DCQL-id fix of the #439 line, e71e0c0)
# https://github.com/sirosfoundation/go-wallet-backend/pull/472 @ be69e2e70a7d00e7bdef85ea99792d7651cd2ec5
# (sign-stage refusal)
# none merged; human review pending. NOT included: https://github.com/sirosfoundation/go-wallet-backend/pull/470.
# rollback pins: local-1792560364 (faa5e63), local-1792473614 (#469 only, e4e0bc3)
# plus TWO local-only commits in no PR: a25df83 (the sign refusal wins over response_jwe; client-controlled error text
# is never relayed) and 1d0708b (integration glue: wmphandler.go copies the new sign params over WMP + a translation test)
# none merged; human review pending. NOT included: https://github.com/sirosfoundation/go-wallet-backend/pull/470, and
# a Copilot finding on #469 (an encrypted HTTP 202 deferred response is not relayed) that is being fixed: a follow-up
# rebuild will carry it.
# BREAKING for clients: the engine relies on the CLIENT for encryption. OLD CLIENTS FAIL encrypted issuance
# (generate_proof / decrypt_credential_response, flow_complete without credential values) and direct_post.jwt
# presentations (sign_presentation with response_encryption + verified_request; the client returns response_jwe) until the
# SDKs land. Accepted by the user for gdc. Config: no key added, renamed or removed.
# rollback pins: local-1792564143 (9cb6e57, server-side encryption: works with the current Pixel APK), local-1792560364 (faa5e63),
# local-1792473614 (#469 only)
#
# pdp (go-trust) ghcr.io/sirosfoundation/go-trust:0.26.0 (RELEASED, tag v0.26.0, commit 621b03f4)
# index digest sha256:73d994eaabcf27d68837c12ef42cbb16072c87562c6abe5cf7e2332a8068cf1e
Expand Down Expand Up @@ -216,7 +225,7 @@ images:
# NOT configured here: server.external_urls.engine_url, so /.well-known/wmp-configuration returns 503 (startup warns),
# and the wallet-proxy routes only /api/v2/wallet to the engine port, so the discovery path is not routed either.
# Re-pin to the released go-wallet-backend image once those PRs are merged and released.
wallet-backend: registry.fly.io/sirosid-gdc-wallet-backend:local-1792564143
wallet-backend: registry.fly.io/sirosid-gdc-wallet-backend:local-1792625654
# previous pins: faa5e63 = local-1792560364; PR 469 only = local-1792473614

# The rest of the SIROS components, at the last RELEASED version as of 2026-10-08. Pinned here, not in
Expand Down
2 changes: 1 addition & 1 deletion environments/nymauth.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,7 +43,7 @@ images:
vc-apigw: registry.fly.io/sirosid-gdc-vc-apigw:local-1792609658 # vc c8c5b1ea (seed delivery, #840)
vc-issuer: registry.fly.io/sirosid-gdc-vc-issuer:local-1792609658
vc-registry: registry.fly.io/sirosid-gdc-vc-registry:local-1792609658
wallet-backend: registry.fly.io/sirosid-gdc-wallet-backend:local-1792564143 # engine 9cb6e57 (#469/#471/#163/#472)
wallet-backend: registry.fly.io/sirosid-gdc-wallet-backend:local-1792625654 # engine 1d0708b (client-side encryption)
pdp: ghcr.io/sirosfoundation/go-trust:0.26.0 # released; verifier_ids (go-trust#218)
wallet-frontend: ghcr.io/sirosfoundation/wallet-frontend:0.5.0-1-sirosid.11

Expand Down