archetech / archon
87%

DEFAULT BRANCH: main
Repo Added
Token VKRdMqMwqPTOZprp4p5Cb3v3uLt6LWUtk regen
Build 2849 Last
Files 3
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

LAST BUILD ON BRANCH main
branch: SELECT
CHANGE BRANCH
x
Sync Branches

coverage: 86.667%. Remained the same
36477011198

push

github

web-flow 
fix(keymaster): make Python challenge responses interoperable with TypeScript (#1301)

* fix(keymaster): make Python challenge responses interoperable with TypeScript

Python create_response now presents each credential through its own
presentation DID carrying the credential's cipher_hash, and
verify_response applies the TypeScript checks: live credential and
presentation, matching hashes, a valid issuer proof, and the challenge's
schema and issuer list. Entries that embed the credential instead of
naming a presentation DID are not counted in either port.

Cross-port fixtures, generated by running both keymasters against one
Gatekeeper, let each unit suite verify the other port's responses.

Closes #1300

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix(keymaster): bind verified credentials to their issuer, asset and request

Response verification in both ports now counts a presented credential
only when both envelopes carry equal cipher hashes, the credential has a
valid proof by its declared issuer, it lives at the presented DID (its
signed id, or issuer control of the asset for credentials without one),
and it names a schema an unsatisfied challenge request accepts. Each
request is satisfied once, each credential DID counts once, and match
means every request is satisfied.

Each case was reachable with real signed operations before this change:
a holder could self-sign a credential naming a trusted issuer, copy a
revoked credential to a new asset, present a schema-less or unhashed
credential, or repeat one credential to satisfy several requests.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix(keymaster): pair challenge requests and credentials by maximum matching

Holders chose each request's credential independently or first-fit, so
TypeScript presented one credential for repeated requests, which the
verifier now counts once, and both ports could spend a credential on a
broad request that a narrower one needed. Verif... (continued)

66 of 76 branches covered (86.84%)

Branch coverage included in aggregate %.

12 of 14 relevant lines covered (85.71%)

12.57 hits per line

Relevant lines Covered
14 RELEVANT LINES 12 COVERED LINES
12.57 HITS PER LINE
Source Files on main

Recent builds

Builds Branch Commit Type Ran Committer Via Coverage
36477011198 main fix(keymaster): make Python challenge responses interoperable with TypeScript (#1301) * fix(keymaster): make Python challenge responses interoperable with TypeScript Python create_response now presents each credential through its own presentatio... push web-flow github
86.67
36475910928 fix/python-response-interop fix(keymaster): pair challenge requests and credentials by maximum matching Holders chose each request's credential independently or first-fit, so TypeScript presented one credential for repeated requests, which the verifier now counts once, and ... Pull #1301 macterra github
86.67
36473646044 fix/python-response-interop fix(keymaster): bind verified credentials to their issuer, asset and request Response verification in both ports now counts a presented credential only when both envelopes carry equal cipher hashes, the credential has a valid proof by its declare... Pull #1301 macterra github
86.67
36471025945 fix/python-response-interop fix(keymaster): make Python challenge responses interoperable with TypeScript Python create_response now presents each credential through its own presentation DID carrying the credential's cipher_hash, and verify_response applies the TypeScript c... Pull #1301 macterra github
86.67
36468173206 main feat(keymaster): support historical verification of credential responses (#1299) * feat(keymaster): support historical verification of credential responses verifyResponse accepts versionTime, which resolves the response, challenge, credential an... push web-flow github
86.67
36466931835 feat/historical-verify-response fix(keymaster): reject year zero in versionTime in both ports Python's validator accepted 0000 and then failed to parse it with a raw ValueError, while TypeScript parsed it. Both now require a year of at least 1. Co-Authored-By: Claude Opus 5.5 ... Pull #1299 macterra github
86.67
36465569461 feat/historical-verify-response test(cli): verify historical response selectors against each service pairing Runs verify-response with --version-time and --version-sequence through the Keymaster service and a real Gatekeeper, so the CI matrix covers the Python keymaster and the... Pull #1299 macterra github
86.67
36464886910 feat/historical-verify-response fix(keymaster): validate response selectors strictly and reject revoked challenges Both ports now require an RFC 3339 date-time with an offset for versionTime, rejecting formats Date.parse or fromisoformat accept and impossible dates. Python veri... push macterra github
86.67
36461753274 feat/historical-verify-response feat(keymaster): support historical verification of credential responses verifyResponse accepts versionTime, which resolves the response, challenge, credential and presentation DIDs (including decryption reads) as of that time, and versionSequenc... Pull #1299 macterra github
86.67
36437136188 main chore(deps): update Kubo to v0.43.1 (#1298) push web-flow github
86.67
See All Builds (2842)