oydid 0.6.4 → 0.6.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e048d33455d4b2b305d1905b1acea54c0f87f7a871998fa5a294b0669a245112
-  data.tar.gz: 0ff2fabe31fe7352062e93ef8bce6c74dfa6afd7004db0f53ccfb13912b7e9d5
+  metadata.gz: 3e47064181aee5338fa3fde2af77f2955cbcb6e5a4b19f8586882183056f1070
+  data.tar.gz: d601a5b9151f57af747e1ea42d464549b115cd36eb25cfc42d77385f9c8222a3
 SHA512:
-  metadata.gz: be4ef04a7f885cf2cbd870126a45fc97ec84444426dca4341102256dddbe17eddd3975e63ccd02687527fb43099cda7b1eba70e655cf5ecee4c64b21499237ca
-  data.tar.gz: f4c305a56ce2952dc72632d9a3fdc13ee9282eefd40dc8fda65f5233bd8e82409a3ba90a64a4964503cb6ba3825cf89c24143311b6051630148fd21d51ef1a60
+  metadata.gz: f40852d750dd966b86b0c7cc7efac6c6a24feac83b9e581284adaa7ebc5231571f790e9c8fccc18c54316b48e7563d9b4e3ec4ee36442184fcafd6e22ac296b6
+  data.tar.gz: 0f145b61b4ddd8794316cfc4a5bb653212b1e5be1332dcd24726d30783fbd2448b726cf0cec3a0e2b8f9893d60a8f9605ea591350993ac609f80df6edc262518

data/VERSION

@@ -1 +1 @@
-0.6.4
+0.6.6

data/lib/oydid/basic.rb

@@ -1012,14 +1012,23 @@ class Oydid
         end
     end
 
-    # build an OYDID multibase-encoded private key from a raw hex-encoded key
-    # (e.g. an externally generated P-256 or Ed25519 key). The key type is taken
-    # from options[:key_type] (default 'ed25519').
-    def self.private_key_from_hex(hex, options = {})
+    # normalize and validate hex input shared by the hex-based converters below:
+    # strips whitespace and an optional '0x' prefix and rejects anything that is
+    # not an even number of hex digits. Returns [normalized_hex, ""] or [nil, msg].
+    def self.normalize_hex(hex)
         hex = hex.to_s.strip.delete_prefix("0x").delete_prefix("0X")
         unless hex =~ /\A[0-9a-fA-F]+\z/ && hex.length.even?
             return [nil, "invalid hex input"]
         end
+        return [hex, ""]
+    end
+
+    # build an OYDID multibase-encoded private key from a raw hex-encoded key
+    # (e.g. an externally generated P-256 or Ed25519 key). The key type is taken
+    # from options[:key_type] (default 'ed25519').
+    def self.private_key_from_hex(hex, options = {})
+        hex, msg = normalize_hex(hex)
+        return [nil, msg] if hex.nil?
         raw = [hex].pack("H*")
         key_type = options[:key_type].to_s
         key_type = "ed25519" if key_type == ""
@@ -1047,6 +1056,63 @@ class Oydid
         return multi_encode([code, length, raw].pack("SCa#{length}"), options)
     end
 
+    # counterpart to private_key_from_hex for public keys.
+    #
+    # NOTE on the p256 length check: multicodec 0x1200 ('p256-pub') is specified
+    # for compressed points, but Oydid.public_key() emits uncompressed ones
+    # (OpenSSL's default point_conversion_form), so both forms are accepted here
+    # to stay compatible with keys this library produces itself.
+    def self.public_key_from_hex(hex, options = {})
+        hex, msg = normalize_hex(hex)
+        return [nil, msg] if hex.nil?
+        raw = [hex].pack("H*")
+        key_type = options[:key_type].to_s
+        key_type = "ed25519" if key_type == ""
+        case key_type
+        when "p256"
+            unless [33, 65].include?(raw.bytesize)
+                return [nil, "p256 public key must be 33 (compressed) or 65 (uncompressed) bytes"]
+            end
+            # the length alone says nothing: verify that the input actually
+            # decodes to a point on prime256v1 (this also rejects a wrong
+            # leading byte), otherwise an unusable key would be encoded happily
+            begin
+                OpenSSL::PKey::EC::Point.new(
+                    OpenSSL::PKey::EC::Group.new("prime256v1"),
+                    OpenSSL::BN.new(hex, 16))
+            rescue StandardError
+                return [nil, "p256 public key is not a valid point on the curve"]
+            end
+            code = Multicodecs["p256-pub"].code
+        when "ed25519"
+            unless raw.bytesize == 32
+                return [nil, "ed25519 public key must be 32 bytes (64 hex characters)"]
+            end
+            # there is no cheap point validation for ed25519 (Ed25519::VerifyKey
+            # accepts any 32 bytes), and a private key has the same length - so
+            # passing a *private* key with --public silently yields a public key
+            # multibase. Callers have to know what they hand in.
+            code = Multicodecs["ed25519-pub"].code
+        else
+            return [nil, "unsupported key type"]
+        end
+        return multi_encode(Multibases::DecodedByteArray.new((to_varint(code) << raw.bytes).flatten).to_s(Encoding::BINARY), options)
+    end
+
+    # convert raw hex data (no multicodec prefix, e.g. a signature) to Multibase
+    def self.hex_to_multibase(hex, options = {})
+        hex, msg = normalize_hex(hex)
+        return [nil, msg] if hex.nil?
+        # the multibases gem cannot represent an all-zero byte string: packing
+        # raises NoMethodError and unpacking the correct base58btc form ("z1111")
+        # raises RangeError. Leading zero bytes in otherwise non-zero input are
+        # handled correctly, so only the all-zero case has to be rejected.
+        if hex.delete("0") == ""
+            return [nil, "all-zero input is not supported by the multibase encoder"]
+        end
+        return multi_encode([hex].pack("H*"), options)
+    end
+
     # reverse of private_key_from_hex / public_key encoding:
     # decode an OYDID Multibase-encoded key (private or public) back to raw hex.
     def self.key_to_hex(key_encoded, options = {})

data/lib/oydid/log.rb

@@ -141,6 +141,7 @@ class Oydid
         terminate_entries = 0
         terminate_overall = 0
         terminate_index = nil
+        revoked_terminate_found = false
         logs.each do |el|
             if el["op"].to_i == 0 # TERMINATE
                 if dag.vertices[i].successors.length == 0
@@ -154,6 +155,7 @@ class Oydid
                     dag.vertices[i].predecessors.each do |l|
                         if logs[l[:id]]["op"].to_i == 0 # TERMINATE
                             terminate_index = l[:id]
+                            revoked_terminate_found = true
                         end
                     end
                 end
@@ -161,11 +163,18 @@ class Oydid
             i += 1
         end unless logs.nil?
 
+        # NOTE: this is a structural check on the log and must not depend on how
+        # verbose the caller wants to be. Suppressing it under :silent returned a
+        # DID document for logs that cannot be resolved.
         if terminate_entries != 1 && !options[:log_complete] && !options[:followAlsoKnownAs]
-            if options[:silent].nil? || !options[:silent]
+            # a revoked DID has no tangling TERMINATE entry (its TERMINATE is
+            # followed by the REVOKE record). That is not a broken log: continue
+            # so that dag_update can report the revocation - or apply DID
+            # Rotation - instead of the unspecific "cannot resolve DID".
+            unless terminate_entries == 0 && revoked_terminate_found
                 return [nil, nil, nil, "cannot resolve DID" ]
             end
-        end 
+        end
 
         # create actual edges between vertices (but only use last terminate index for delegates)
         dag = DAG.new
@@ -254,8 +263,14 @@ class Oydid
         result.uniq
     end
 
+    # a DID is revoked when the REVOCATION record referenced by the current
+    # TERMINATE record has been published and no UPDATE record follows it
+    REVOKED_ERROR_CODE = 410
+
     def self.dag_update(currentDID, options)
         i = 0
+        revoked = false
+        rotation_performed = false
         doc_location = options[:doc_location].to_s
         initial_did = currentDID["did"].to_s.dup
         initial_did = initial_did.delete_prefix("did:oyd:")
@@ -501,6 +516,12 @@ class Oydid
                         end
                     end
 
+                    # the revocation record is published and no UPDATE record
+                    # builds on it: this DID is revoked. The verdict is only
+                    # acted upon after the log has been walked completely, so
+                    # that DID Rotation (handled in the REVOKE entry below) can
+                    # still take precedence.
+                    revoked = !update_term_found
                 else
                     if verification_output
                         currentDID["verification"] += "Revocation reference in log record: " + revoc_term.to_s + "\n"
@@ -538,6 +559,7 @@ class Oydid
                                     # 2) das new DID reference back original DID
                                     currentDID["did"] = rotate_DID
                                     currentDID["doc"]["doc"] = rotate_ddoc
+                                    rotation_performed = true
                                     if verification_output
                                         currentDID["verification"] += "DID rotation to: " + rotate_DID.to_s + "\n"
                                         currentDID["verification"] += "✅ original DID (" + did_orig + ") revoked and referenced in alsoKnownAs\n"
@@ -563,6 +585,13 @@ class Oydid
             end
             i += 1
         end unless currentDID["log"].nil?
+
+        # fail closed: a revoked DID has no resolvable DID Document unless the
+        # controller rotated it to another DID via alsoKnownAs
+        if revoked && !rotation_performed
+            currentDID["error"] = REVOKED_ERROR_CODE
+            currentDID["message"] = "revoked"
+        end
         return currentDID
     end
 end

data/spec/oydid_spec.rb

@@ -238,6 +238,82 @@ describe "OYDID handling" do
     expect(Oydid.key_to_hex("not-a-key", {}).first).to be_nil
   end
 
+  # hex2mb: public keys (--public)
+  it "encodes an ed25519 public key from hex identically to public_key()" do
+    privkey, _ = Oydid.private_key_from_hex("aa" * 32, {key_type: "ed25519"})
+    pub_mb, _  = Oydid.public_key(privkey, {})
+    pub_hex, _ = Oydid.key_to_hex(pub_mb, {})
+    from_hex, msg = Oydid.public_key_from_hex(pub_hex, {key_type: "ed25519"})
+    expect(msg).to eq ""
+    expect(from_hex).to eq pub_mb
+    expect(Oydid.get_keytype(from_hex)).to eq "ed25519-pub"
+  end
+  it "encodes a p256 public key from hex identically to public_key()" do
+    privkey, _ = Oydid.private_key_from_hex(
+      "96fe0f41947d645c7a1858c48c7a0560e7e5bd3d45125b57a611a3a9a103626b",
+      {key_type: "p256"})
+    pub_mb, _  = Oydid.public_key(privkey, {})
+    pub_hex, _ = Oydid.key_to_hex(pub_mb, {})
+    from_hex, msg = Oydid.public_key_from_hex(pub_hex, {key_type: "p256"})
+    expect(msg).to eq ""
+    expect(from_hex).to eq pub_mb
+    expect(Oydid.get_keytype(from_hex)).to eq "p256-pub"
+  end
+  it "round-trips a public key hex -> mb -> hex" do
+    hex = "e734ea6c2b6257de72355e472aa05a4c487e6b463c029ed306df2f01b5636b58"
+    mb, _   = Oydid.public_key_from_hex(hex, {key_type: "ed25519"})
+    back, _ = Oydid.key_to_hex(mb, {})
+    expect(back).to eq hex
+  end
+  it "accepts a compressed p256 public key" do
+    hex = "03bcad0c43ac859d0552d95b639156073f9c1c4fb1aa9490f3639a8cf0a2aaadaa"
+    mb, msg = Oydid.public_key_from_hex(hex, {key_type: "p256"})
+    expect(msg).to eq ""
+    expect(Oydid.get_keytype(mb)).to eq "p256-pub"
+  end
+  it "rejects a p256 public key that is not a point on the curve" do
+    mb, msg = Oydid.public_key_from_hex("04" + "11" * 64, {key_type: "p256"})
+    expect(mb).to be_nil
+    expect(msg).to match(/not a valid point/)
+  end
+  it "rejects malformed public key hex" do
+    expect(Oydid.public_key_from_hex("xyz", {key_type: "ed25519"}).first).to be_nil
+    expect(Oydid.public_key_from_hex("aa" * 31, {key_type: "ed25519"}).first).to be_nil
+    expect(Oydid.public_key_from_hex("aa" * 32, {key_type: "p256"}).first).to be_nil
+    expect(Oydid.public_key_from_hex("aa" * 32, {key_type: "secp256k1"}).first).to be_nil
+  end
+  it "defaults to ed25519 when no key type is given for a public key" do
+    hex = "e734ea6c2b6257de72355e472aa05a4c487e6b463c029ed306df2f01b5636b58"
+    expect(Oydid.get_keytype(Oydid.public_key_from_hex(hex, {}).first)).to eq "ed25519-pub"
+  end
+
+  # hex2mb: raw data (--raw)
+  it "encodes raw hex data to multibase without a multicodec prefix" do
+    mb, msg = Oydid.hex_to_multibase("deadbeef", {})
+    expect(msg).to eq ""
+    expect(Oydid.multi_decode(mb).first.unpack1("H*")).to eq "deadbeef"
+    # no multicodec prefix -> deliberately not readable back as a key
+    expect(Oydid.key_to_hex(mb, {}).first).to be_nil
+  end
+  it "preserves leading zero bytes in raw hex data" do
+    mb, _ = Oydid.hex_to_multibase("00deadbeef", {})
+    expect(Oydid.multi_decode(mb).first.unpack1("H*")).to eq "00deadbeef"
+  end
+  it "accepts a 0x prefix and surrounding whitespace in raw hex data" do
+    expect(Oydid.hex_to_multibase(" 0xdeadbeef\n", {}).first).to \
+      eq Oydid.hex_to_multibase("deadbeef", {}).first
+  end
+  it "rejects all-zero raw hex data with a specific message" do
+    mb, msg = Oydid.hex_to_multibase("00" * 4, {})
+    expect(mb).to be_nil
+    expect(msg).to match(/all-zero/)
+  end
+  it "rejects malformed raw hex data" do
+    expect(Oydid.hex_to_multibase("xyz", {}).first).to be_nil
+    expect(Oydid.hex_to_multibase("abc", {}).first).to be_nil
+    expect(Oydid.hex_to_multibase("", {}).first).to be_nil
+  end
+
   # storage functions
   it "should create 'filename' and put/read 'text'" do
     @buffer = StringIO.new()

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: oydid
 version: !ruby/object:Gem::Version
-  version: 0.6.4
+  version: 0.6.6
 platform: ruby
 authors:
 - Christoph Fabianek
 bindir: bin
 cert_chain: []
-date: 2026-06-27 00:00:00.000000000 Z
+date: 2026-08-19 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: simple_dag
@@ -415,14 +415,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 3.2.8
+      version: 3.0.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.15
+rubygems_version: 4.0.12
 specification_version: 4
 summary: Own Your Decentralized Identifier for Ruby.
 test_files: