oydid 0.6.5 → 0.6.7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7cd355cc4bdc04a3d149199467cbbe4263ace619676422c722485fc6d459c83b
-  data.tar.gz: 85f8930282e7cbee45997d65a5cca1be2bea78f853cce44152d6b93808e1a923
+  metadata.gz: e8b1fc642be72b8b9a92b137f995360b5d4e68742b5a9744b59b3e88649976bb
+  data.tar.gz: 291e766737dec1b5756de3408097f5f243b02d3119ab3be2a29444957e82e9af
 SHA512:
-  metadata.gz: e04e8cd58b7a29bb9e7dabffffcf613c9459c18ece1254b8cc1ad60b4d19d073276f18bd0f9c36b7cd6786340e1f81fb9be320f8964a182d5b861bfab9d5825f
-  data.tar.gz: 370d28f6c8614238b734a9a0dc8410de4007923c6ac7e464190ad36bd82bbba5f28def3e46d05c74d882b5ba5559f11cadf2a4a26b2ea0045ea87acd8a6503bb
+  metadata.gz: 04bf2f70fcfe5200ed15417dbcd57734b3fe33603bb36eb4dc5007821d6c27af135a3b37552fd75c42a9a1feb02453411a47106340b9abb836496df679ec7b99
+  data.tar.gz: fd8d594757ecf3119c409b0d6169e607a823b1a575fcb1b5599625c2f305f580e51dee886a3112217272695b69e1da9ca65d1b3b1599a5908f916bce12aaacc1

data/VERSION

@@ -1 +1 @@
-0.6.5
+0.6.7

data/lib/oydid/basic.rb

@@ -791,9 +791,13 @@ class Oydid
         rescue
             return [nil, "cannot read file"]
         end
-        key_type = get_keytype(key_encoded) || options[:key_type] rescue options[:key_type]
+        # get_keytype raises for anything that is not a valid key, and the
+        # inline rescue below only guards the assignment - so key_type can end up
+        # nil when the caller passes no :key_type either. Coerce to a string
+        # instead of calling String methods on nil (raised NoMethodError before).
+        key_type = (get_keytype(key_encoded) || options[:key_type] rescue options[:key_type]).to_s
         if key_type.include?('-')
-            key_type = key_type.split('-').first || options[:key_type] rescue options[:key_type]
+            key_type = (key_type.split('-').first || options[:key_type]).to_s
         end
         if key_type == 'p256'
             begin
@@ -1012,14 +1016,23 @@ class Oydid
         end
     end
 
-    # build an OYDID multibase-encoded private key from a raw hex-encoded key
-    # (e.g. an externally generated P-256 or Ed25519 key). The key type is taken
-    # from options[:key_type] (default 'ed25519').
-    def self.private_key_from_hex(hex, options = {})
+    # normalize and validate hex input shared by the hex-based converters below:
+    # strips whitespace and an optional '0x' prefix and rejects anything that is
+    # not an even number of hex digits. Returns [normalized_hex, ""] or [nil, msg].
+    def self.normalize_hex(hex)
         hex = hex.to_s.strip.delete_prefix("0x").delete_prefix("0X")
         unless hex =~ /\A[0-9a-fA-F]+\z/ && hex.length.even?
             return [nil, "invalid hex input"]
         end
+        return [hex, ""]
+    end
+
+    # build an OYDID multibase-encoded private key from a raw hex-encoded key
+    # (e.g. an externally generated P-256 or Ed25519 key). The key type is taken
+    # from options[:key_type] (default 'ed25519').
+    def self.private_key_from_hex(hex, options = {})
+        hex, msg = normalize_hex(hex)
+        return [nil, msg] if hex.nil?
         raw = [hex].pack("H*")
         key_type = options[:key_type].to_s
         key_type = "ed25519" if key_type == ""
@@ -1047,6 +1060,63 @@ class Oydid
         return multi_encode([code, length, raw].pack("SCa#{length}"), options)
     end
 
+    # counterpart to private_key_from_hex for public keys.
+    #
+    # NOTE on the p256 length check: multicodec 0x1200 ('p256-pub') is specified
+    # for compressed points, but Oydid.public_key() emits uncompressed ones
+    # (OpenSSL's default point_conversion_form), so both forms are accepted here
+    # to stay compatible with keys this library produces itself.
+    def self.public_key_from_hex(hex, options = {})
+        hex, msg = normalize_hex(hex)
+        return [nil, msg] if hex.nil?
+        raw = [hex].pack("H*")
+        key_type = options[:key_type].to_s
+        key_type = "ed25519" if key_type == ""
+        case key_type
+        when "p256"
+            unless [33, 65].include?(raw.bytesize)
+                return [nil, "p256 public key must be 33 (compressed) or 65 (uncompressed) bytes"]
+            end
+            # the length alone says nothing: verify that the input actually
+            # decodes to a point on prime256v1 (this also rejects a wrong
+            # leading byte), otherwise an unusable key would be encoded happily
+            begin
+                OpenSSL::PKey::EC::Point.new(
+                    OpenSSL::PKey::EC::Group.new("prime256v1"),
+                    OpenSSL::BN.new(hex, 16))
+            rescue StandardError
+                return [nil, "p256 public key is not a valid point on the curve"]
+            end
+            code = Multicodecs["p256-pub"].code
+        when "ed25519"
+            unless raw.bytesize == 32
+                return [nil, "ed25519 public key must be 32 bytes (64 hex characters)"]
+            end
+            # there is no cheap point validation for ed25519 (Ed25519::VerifyKey
+            # accepts any 32 bytes), and a private key has the same length - so
+            # passing a *private* key with --public silently yields a public key
+            # multibase. Callers have to know what they hand in.
+            code = Multicodecs["ed25519-pub"].code
+        else
+            return [nil, "unsupported key type"]
+        end
+        return multi_encode(Multibases::DecodedByteArray.new((to_varint(code) << raw.bytes).flatten).to_s(Encoding::BINARY), options)
+    end
+
+    # convert raw hex data (no multicodec prefix, e.g. a signature) to Multibase
+    def self.hex_to_multibase(hex, options = {})
+        hex, msg = normalize_hex(hex)
+        return [nil, msg] if hex.nil?
+        # the multibases gem cannot represent an all-zero byte string: packing
+        # raises NoMethodError and unpacking the correct base58btc form ("z1111")
+        # raises RangeError. Leading zero bytes in otherwise non-zero input are
+        # handled correctly, so only the all-zero case has to be rejected.
+        if hex.delete("0") == ""
+            return [nil, "all-zero input is not supported by the multibase encoder"]
+        end
+        return multi_encode([hex].pack("H*"), options)
+    end
+
     # reverse of private_key_from_hex / public_key encoding:
     # decode an OYDID Multibase-encoded key (private or public) back to raw hex.
     def self.key_to_hex(key_encoded, options = {})

data/spec/fixtures/http/did2-data-container-doc.json

@@ -0,0 +1 @@
+{"doc":{"location":"non-default"},"key":"z6MutdYiDqv5kiJ79KXhcSyD38RZTRRhHYkhBo16891QsVmV:z6Mv8NqXsiUXeHVgJGCeX3JSnGwD17JKxMHep47SfSEy4u8Y","log":"zQmQwzGTZk1Me6GKWe6egJXGtRmoR3dfymVci4yqePqS8SN@https://did2.data-container.net"}

data/spec/fixtures/http/manifest.json

@@ -0,0 +1,56 @@
+[
+  {
+    "url": "https://did2.data-container.net/doc/did:oyd:zQmNauTUUdkpi5TcrTZ2524SKM8dJAzuuw4xfW13iHrtY1W",
+    "status": 200,
+    "content_type": "application/json; charset=utf-8",
+    "body": "did2-data-container-doc.json"
+  },
+  {
+    "url": "https://oydid.ownyourdata.eu/doc/",
+    "status": 404,
+    "content_type": "application/json; charset=utf-8",
+    "body": "oydid-doc-empty.json"
+  },
+  {
+    "url": "https://oydid.ownyourdata.eu/doc/did:oyd:zQmaBZTghndXTgxNwfbdpVLWdFf6faYE4oeuN2zzXdQt1kh",
+    "status": 200,
+    "content_type": "application/json; charset=utf-8",
+    "body": "oydid-doc-did-zQmaBZ.json"
+  },
+  {
+    "url": "https://oydid.ownyourdata.eu/log/zQmZEP95SPr699GjBeN82cspsZww8RKKHLR9UChbZxKw3H7",
+    "status": 200,
+    "content_type": "application/json; charset=utf-8",
+    "body": "oydid-log-zQmZEP.json"
+  },
+  {
+    "url": "https://www.orf.at/log/zQmZEP95SPr699GjBeN82cspsZww8RKKHLR9UChbZxKw3H",
+    "status": 404,
+    "content_type": "text/html;charset=utf-8",
+    "body": "orf-at-log.html"
+  },
+  {
+    "url": "https://oydid.ownyourdata.eu/doc/zQmaBZTghndXTgxNwfbdpVLWdFf6faYE4oeuN2zzXdQt1kh",
+    "status": 200,
+    "content_type": "application/json; charset=utf-8",
+    "body": "oydid-doc-zQmaBZ.json"
+  },
+  {
+    "url": "https://oydid.ownyourdata.eu/log/zQmVwMvovLy5KNYHHVHQ1wv8J7y9L6UPE8eyU4tzypFWtYe",
+    "status": 200,
+    "content_type": "application/json; charset=utf-8",
+    "body": "oydid-log-zQmVwM.json"
+  },
+  {
+    "url": "https://oydid.ownyourdata.eu/doc_raw/zQmaBZTghndXTgxNwfbdpVLWdFf6faYE4oeuN2zzXdQt1kh",
+    "status": 200,
+    "content_type": "application/json; charset=utf-8",
+    "body": "oydid-doc-raw-zQmaBZ.json"
+  },
+  {
+    "url": "https://oydid.ownyourdata.eu/log/zQmaBZTghndXTgxNwfbdpVLWdFf6faYE4oeuN2zzXdQt1kh",
+    "status": 200,
+    "content_type": "application/json; charset=utf-8",
+    "body": "oydid-log-zQmaBZ.json"
+  }
+]

data/spec/fixtures/http/oydid-doc-did-zQmaBZ.json

@@ -0,0 +1 @@
+{"doc":{"simple":"example"},"key":"z6MusYB5iT5krCHYsZ76EzBaTdRwGKsaBhMcSbrXaPJgkuRQ:z6Mv7EYihbAat6Wq7GsjNsjcxt58dZT8fmsRjQGTkYamYrjB","log":"zQmVwMvovLy5KNYHHVHQ1wv8J7y9L6UPE8eyU4tzypFWtYe"}

data/spec/fixtures/http/oydid-doc-empty.json

@@ -0,0 +1 @@
+{"error":"invalid path"}

data/spec/fixtures/http/oydid-doc-raw-zQmaBZ.json

@@ -0,0 +1 @@
+{"doc":{"doc":{"simple":"example"},"key":"z6MusYB5iT5krCHYsZ76EzBaTdRwGKsaBhMcSbrXaPJgkuRQ:z6Mv7EYihbAat6Wq7GsjNsjcxt58dZT8fmsRjQGTkYamYrjB","log":"zQmVwMvovLy5KNYHHVHQ1wv8J7y9L6UPE8eyU4tzypFWtYe"},"log":[{"ts":1641224736,"op":2,"doc":"zQmaBZTghndXTgxNwfbdpVLWdFf6faYE4oeuN2zzXdQt1kh","sig":"z3Kb5qeReCqr3ftxpf2i5UypUwrzrVkyspMtaDcb6e9YdHVSptcAFgvwbgk3qWqspTcGiKDYKXZZh8g6XyM2WPmNp","previous":[]},{"ts":1641224736,"op":0,"doc":"zQmT8SG7a238bF7wdV7LdrEAQpimqhKGor7CQsjtCYdZdTS","sig":"z63hu8LseptBrvB2kEDwhPP35sBj7JDDJsEDW85cjRkrjjac9ZV3HxPW9NVKewHcQYwrVLVsnDCcm1RjbEARE5rJU","previous":[]}]}

data/spec/fixtures/http/oydid-doc-zQmaBZ.json

@@ -0,0 +1 @@
+{"doc":{"simple":"example"},"key":"z6MusYB5iT5krCHYsZ76EzBaTdRwGKsaBhMcSbrXaPJgkuRQ:z6Mv7EYihbAat6Wq7GsjNsjcxt58dZT8fmsRjQGTkYamYrjB","log":"zQmVwMvovLy5KNYHHVHQ1wv8J7y9L6UPE8eyU4tzypFWtYe"}

data/spec/fixtures/http/oydid-log-zQmVwM.json

@@ -0,0 +1 @@
+[{"ts":1641224736,"op":2,"doc":"zQmaBZTghndXTgxNwfbdpVLWdFf6faYE4oeuN2zzXdQt1kh","sig":"z3Kb5qeReCqr3ftxpf2i5UypUwrzrVkyspMtaDcb6e9YdHVSptcAFgvwbgk3qWqspTcGiKDYKXZZh8g6XyM2WPmNp","previous":[]},{"ts":1641224736,"op":0,"doc":"zQmT8SG7a238bF7wdV7LdrEAQpimqhKGor7CQsjtCYdZdTS","sig":"z63hu8LseptBrvB2kEDwhPP35sBj7JDDJsEDW85cjRkrjjac9ZV3HxPW9NVKewHcQYwrVLVsnDCcm1RjbEARE5rJU","previous":[]}]

data/spec/fixtures/http/oydid-log-zQmZEP.json

@@ -0,0 +1 @@
+[{"ts":0,"op":2,"doc":"zQmZEP95SPr699GjBeN82cspsZww8RKKHLR9UChbZxKw3H7","sig":"z2vESePysjyywnUpVZbftZzh34j4GwPknfvtZms5BqmE4j7v72KHpBPrW5QxK22kWVoVbcxHanL2qwVd32MFRzDfM","previous":[]},{"ts":0,"op":0,"doc":"zQmReRus2QnsapBdVBqhYRddh2PyTRF1hDbUfJS44izyiex","sig":"zsxdDbaakXCj3tWLMf8m9UsYLNuisUD2jErcBdfSgjkLpA4CxZirJQpJahiC2Yxu5oqoTG2G7vvv9EPJhozVF4jE","previous":[]}]

data/spec/fixtures/http/oydid-log-zQmaBZ.json

@@ -0,0 +1 @@
+[{"ts":1641224736,"op":2,"doc":"zQmaBZTghndXTgxNwfbdpVLWdFf6faYE4oeuN2zzXdQt1kh","sig":"z3Kb5qeReCqr3ftxpf2i5UypUwrzrVkyspMtaDcb6e9YdHVSptcAFgvwbgk3qWqspTcGiKDYKXZZh8g6XyM2WPmNp","previous":[]},{"ts":1641224736,"op":0,"doc":"zQmT8SG7a238bF7wdV7LdrEAQpimqhKGor7CQsjtCYdZdTS","sig":"z63hu8LseptBrvB2kEDwhPP35sBj7JDDJsEDW85cjRkrjjac9ZV3HxPW9NVKewHcQYwrVLVsnDCcm1RjbEARE5rJU","previous":[]}]

data/spec/output/basic/sample3_retrieve_document.doc

@@ -1 +1 @@
-[null, "invalid response from https://oydid.ownyourdata.eu/doc/"]
+[null,"invalid path"]

data/spec/output/basic/sample_invalid_verify.doc

@@ -1 +1 @@
-[null, "unsupported key codec"]
+[null,"unknown key codec"]

data/spec/output/basic/sample_valid_privkey.doc

@@ -1 +1 @@
-["z6Mv8s3VfPPUKRTx7fDKs7MKYDRghzfVxYjk6MdAXBvFNL6o", ""]
+["z6MkvkE1Gw5shxc8S6wNpfr8YNZWxgiUs6Yp6n45qdgTMoUF",""]

data/spec/output/log/sample_addhash.doc

@@ -1 +1 @@
-[{"hello":"world","entry-hash":"zQmYGx7Wzqe5prvEsTSzYBQN8xViYUM9qsWJSF5EENLcNmM"}]
+[{"hello":"world","entry-hash":"zQmSvPd3sHK7iWgZuW47fyLy4CaZQe2DwxvRhrJ39VpBVMK"}]

data/spec/output/log/sample_op1_addhash.doc

@@ -1 +1 @@
-[{"entry-hash": "zQmdEMAFX7jFuURk9AkDTg5EFAKMNxd3Wx5aXdbhcMv43Rq", "hello": "world", "op": 1, "sub-entry-hash": "zQmdEMAFX7jFuURk9AkDTg5EFAKMNxd3Wx5aXdbhcMv43Rq"}]
+[{"hello":"world","op":1,"entry-hash":"zQmemaqk7duDBUQZud3FahCPe83kMC5kxqKxkxgSUpzVhq1","sub-entry-hash":"zQmemaqk7duDBUQZud3FahCPe83kMC5kxqKxkxgSUpzVhq1"}]

data/spec/output/main/sample0_read.doc

@@ -1 +1 @@
-[{"did":"zQmaBZTghndXTgxNwfbdpVLWdFf6faYE4oeuN2zzXdQt1kh","doc":{"doc":{"simple":"example"},"key":"z6MusYB5iT5krCHYsZ76EzBaTdRwGKsaBhMcSbrXaPJgkuRQ:z6Mv7EYihbAat6Wq7GsjNsjcxt58dZT8fmsRjQGTkYamYrjB","log":"zQmVwMvovLy5KNYHHVHQ1wv8J7y9L6UPE8eyU4tzypFWtYe"},"log":[{"ts":1641224736,"op":2,"doc":"zQmaBZTghndXTgxNwfbdpVLWdFf6faYE4oeuN2zzXdQt1kh","sig":"z3Kb5qeReCqr3ftxpf2i5UypUwrzrVkyspMtaDcb6e9YdHVSptcAFgvwbgk3qWqspTcGiKDYKXZZh8g6XyM2WPmNp","previous":[]},{"ts":1641224736,"op":0,"doc":"zQmT8SG7a238bF7wdV7LdrEAQpimqhKGor7CQsjtCYdZdTS","sig":"z63hu8LseptBrvB2kEDwhPP35sBj7JDDJsEDW85cjRkrjjac9ZV3HxPW9NVKewHcQYwrVLVsnDCcm1RjbEARE5rJU","previous":[]}],"doc_log_id":0,"termination_log_id":1,"error":0,"message":"","verification":"identifier: zQmaBZTghndXTgxNwfbdpVLWdFf6faYE4oeuN2zzXdQt1kh\n✅ is hash of DID Document:\n{\n  \"doc\": {\n    \"simple\": \"example\"\n  },\n  \"key\": \"z6MusYB5iT5krCHYsZ76EzBaTdRwGKsaBhMcSbrXaPJgkuRQ:z6Mv7EYihbAat6Wq7GsjNsjcxt58dZT8fmsRjQGTkYamYrjB\",\n  \"log\": \"zQmVwMvovLy5KNYHHVHQ1wv8J7y9L6UPE8eyU4tzypFWtYe\"\n}\n(Details: https://ownyourdata.github.io/oydid/#calculate_hash)\n\n'log' reference in DID Document: zQmVwMvovLy5KNYHHVHQ1wv8J7y9L6UPE8eyU4tzypFWtYe\n✅ is hash of TERMINATE log record:\n{\n  \"ts\": 1641224736,\n  \"op\": 0,\n  \"doc\": \"zQmT8SG7a238bF7wdV7LdrEAQpimqhKGor7CQsjtCYdZdTS\",\n  \"sig\": \"z63hu8LseptBrvB2kEDwhPP35sBj7JDDJsEDW85cjRkrjjac9ZV3HxPW9NVKewHcQYwrVLVsnDCcm1RjbEARE5rJU\",\n  \"previous\": [\n\n  ]\n}\n(Details: https://ownyourdata.github.io/oydid/#calculate_hash)\n\nRevocation reference in log record: zQmT8SG7a238bF7wdV7LdrEAQpimqhKGor7CQsjtCYdZdTS\n✅ cannot find revocation record searching at\n- https://oydid.ownyourdata.eu\n(Details: https://ownyourdata.github.io/oydid/#retrieve_log)\n\n"}, ""]
+[{"did":"zQmaBZTghndXTgxNwfbdpVLWdFf6faYE4oeuN2zzXdQt1kh","doc":{"doc":{"simple":"example"},"key":"z6MusYB5iT5krCHYsZ76EzBaTdRwGKsaBhMcSbrXaPJgkuRQ:z6Mv7EYihbAat6Wq7GsjNsjcxt58dZT8fmsRjQGTkYamYrjB","log":"zQmVwMvovLy5KNYHHVHQ1wv8J7y9L6UPE8eyU4tzypFWtYe"},"log":[{"ts":1641224736,"op":2,"doc":"zQmaBZTghndXTgxNwfbdpVLWdFf6faYE4oeuN2zzXdQt1kh","sig":"z3Kb5qeReCqr3ftxpf2i5UypUwrzrVkyspMtaDcb6e9YdHVSptcAFgvwbgk3qWqspTcGiKDYKXZZh8g6XyM2WPmNp","previous":[]},{"ts":1641224736,"op":0,"doc":"zQmT8SG7a238bF7wdV7LdrEAQpimqhKGor7CQsjtCYdZdTS","sig":"z63hu8LseptBrvB2kEDwhPP35sBj7JDDJsEDW85cjRkrjjac9ZV3HxPW9NVKewHcQYwrVLVsnDCcm1RjbEARE5rJU","previous":[]}],"doc_log_id":0,"termination_log_id":1,"error":0,"message":"","verification":"identifier: zQmaBZTghndXTgxNwfbdpVLWdFf6faYE4oeuN2zzXdQt1kh\n✅ is hash of DID Document:\n{\n  \"doc\": {\n    \"simple\": \"example\"\n  },\n  \"key\": \"z6MusYB5iT5krCHYsZ76EzBaTdRwGKsaBhMcSbrXaPJgkuRQ:z6Mv7EYihbAat6Wq7GsjNsjcxt58dZT8fmsRjQGTkYamYrjB\",\n  \"log\": \"zQmVwMvovLy5KNYHHVHQ1wv8J7y9L6UPE8eyU4tzypFWtYe\"\n}\n(Details: https://ownyourdata.github.io/oydid/#calculate_hash)\n\n'log' reference in DID Document: zQmVwMvovLy5KNYHHVHQ1wv8J7y9L6UPE8eyU4tzypFWtYe\n✅ is hash of TERMINATE log record:\n{\n  \"ts\": 1641224736,\n  \"op\": 0,\n  \"doc\": \"zQmT8SG7a238bF7wdV7LdrEAQpimqhKGor7CQsjtCYdZdTS\",\n  \"sig\": \"z63hu8LseptBrvB2kEDwhPP35sBj7JDDJsEDW85cjRkrjjac9ZV3HxPW9NVKewHcQYwrVLVsnDCcm1RjbEARE5rJU\",\n  \"previous\": []\n}\n(Details: https://ownyourdata.github.io/oydid/#calculate_hash)\n\nRevocation reference in log record: zQmT8SG7a238bF7wdV7LdrEAQpimqhKGor7CQsjtCYdZdTS\n✅ cannot find revocation record searching at\n- https://oydid.ownyourdata.eu\n(Details: https://ownyourdata.github.io/oydid/#retrieve_log)\n\n","full_log":[{"ts":1641224736,"op":2,"doc":"zQmaBZTghndXTgxNwfbdpVLWdFf6faYE4oeuN2zzXdQt1kh","sig":"z3Kb5qeReCqr3ftxpf2i5UypUwrzrVkyspMtaDcb6e9YdHVSptcAFgvwbgk3qWqspTcGiKDYKXZZh8g6XyM2WPmNp","previous":[]},{"ts":1641224736,"op":0,"doc":"zQmT8SG7a238bF7wdV7LdrEAQpimqhKGor7CQsjtCYdZdTS","sig":"z63hu8LseptBrvB2kEDwhPP35sBj7JDDJsEDW85cjRkrjjac9ZV3HxPW9NVKewHcQYwrVLVsnDCcm1RjbEARE5rJU","previous":[]}]},""]

data/spec/oydid_spec.rb

@@ -123,7 +123,9 @@ describe "OYDID handling" do
     it "generates #{input.split('/').last}" do
       expected = File.read(input.sub('input', 'output'))
       data = File.read(input)
-      expect(Oydid.generate_private_key(data, {}).first).to eq expected
+      # signature is (input, method, options) - passing options as the 2nd
+      # argument made this resolve the codec {} and always return nil
+      expect(Oydid.generate_private_key(data, "ed25519-priv", {}).first).to eq expected
     end
   end
   it "handles unknown key codec" do
@@ -238,6 +240,82 @@ describe "OYDID handling" do
     expect(Oydid.key_to_hex("not-a-key", {}).first).to be_nil
   end
 
+  # hex2mb: public keys (--public)
+  it "encodes an ed25519 public key from hex identically to public_key()" do
+    privkey, _ = Oydid.private_key_from_hex("aa" * 32, {key_type: "ed25519"})
+    pub_mb, _  = Oydid.public_key(privkey, {})
+    pub_hex, _ = Oydid.key_to_hex(pub_mb, {})
+    from_hex, msg = Oydid.public_key_from_hex(pub_hex, {key_type: "ed25519"})
+    expect(msg).to eq ""
+    expect(from_hex).to eq pub_mb
+    expect(Oydid.get_keytype(from_hex)).to eq "ed25519-pub"
+  end
+  it "encodes a p256 public key from hex identically to public_key()" do
+    privkey, _ = Oydid.private_key_from_hex(
+      "96fe0f41947d645c7a1858c48c7a0560e7e5bd3d45125b57a611a3a9a103626b",
+      {key_type: "p256"})
+    pub_mb, _  = Oydid.public_key(privkey, {})
+    pub_hex, _ = Oydid.key_to_hex(pub_mb, {})
+    from_hex, msg = Oydid.public_key_from_hex(pub_hex, {key_type: "p256"})
+    expect(msg).to eq ""
+    expect(from_hex).to eq pub_mb
+    expect(Oydid.get_keytype(from_hex)).to eq "p256-pub"
+  end
+  it "round-trips a public key hex -> mb -> hex" do
+    hex = "e734ea6c2b6257de72355e472aa05a4c487e6b463c029ed306df2f01b5636b58"
+    mb, _   = Oydid.public_key_from_hex(hex, {key_type: "ed25519"})
+    back, _ = Oydid.key_to_hex(mb, {})
+    expect(back).to eq hex
+  end
+  it "accepts a compressed p256 public key" do
+    hex = "03bcad0c43ac859d0552d95b639156073f9c1c4fb1aa9490f3639a8cf0a2aaadaa"
+    mb, msg = Oydid.public_key_from_hex(hex, {key_type: "p256"})
+    expect(msg).to eq ""
+    expect(Oydid.get_keytype(mb)).to eq "p256-pub"
+  end
+  it "rejects a p256 public key that is not a point on the curve" do
+    mb, msg = Oydid.public_key_from_hex("04" + "11" * 64, {key_type: "p256"})
+    expect(mb).to be_nil
+    expect(msg).to match(/not a valid point/)
+  end
+  it "rejects malformed public key hex" do
+    expect(Oydid.public_key_from_hex("xyz", {key_type: "ed25519"}).first).to be_nil
+    expect(Oydid.public_key_from_hex("aa" * 31, {key_type: "ed25519"}).first).to be_nil
+    expect(Oydid.public_key_from_hex("aa" * 32, {key_type: "p256"}).first).to be_nil
+    expect(Oydid.public_key_from_hex("aa" * 32, {key_type: "secp256k1"}).first).to be_nil
+  end
+  it "defaults to ed25519 when no key type is given for a public key" do
+    hex = "e734ea6c2b6257de72355e472aa05a4c487e6b463c029ed306df2f01b5636b58"
+    expect(Oydid.get_keytype(Oydid.public_key_from_hex(hex, {}).first)).to eq "ed25519-pub"
+  end
+
+  # hex2mb: raw data (--raw)
+  it "encodes raw hex data to multibase without a multicodec prefix" do
+    mb, msg = Oydid.hex_to_multibase("deadbeef", {})
+    expect(msg).to eq ""
+    expect(Oydid.multi_decode(mb).first.unpack1("H*")).to eq "deadbeef"
+    # no multicodec prefix -> deliberately not readable back as a key
+    expect(Oydid.key_to_hex(mb, {}).first).to be_nil
+  end
+  it "preserves leading zero bytes in raw hex data" do
+    mb, _ = Oydid.hex_to_multibase("00deadbeef", {})
+    expect(Oydid.multi_decode(mb).first.unpack1("H*")).to eq "00deadbeef"
+  end
+  it "accepts a 0x prefix and surrounding whitespace in raw hex data" do
+    expect(Oydid.hex_to_multibase(" 0xdeadbeef\n", {}).first).to \
+      eq Oydid.hex_to_multibase("deadbeef", {}).first
+  end
+  it "rejects all-zero raw hex data with a specific message" do
+    mb, msg = Oydid.hex_to_multibase("00" * 4, {})
+    expect(mb).to be_nil
+    expect(msg).to match(/all-zero/)
+  end
+  it "rejects malformed raw hex data" do
+    expect(Oydid.hex_to_multibase("xyz", {}).first).to be_nil
+    expect(Oydid.hex_to_multibase("abc", {}).first).to be_nil
+    expect(Oydid.hex_to_multibase("", {}).first).to be_nil
+  end
+
   # storage functions
   it "should create 'filename' and put/read 'text'" do
     @buffer = StringIO.new()

data/spec/spec_helper.rb

@@ -25,6 +25,9 @@ end
 
 require 'oydid'
 
+# spec/support/http_stubs.rb keeps the suite off the network
+Dir[File.expand_path("support/**/*.rb", __dir__)].sort.each { |f| require f }
+
 ::RSpec.configure do |c|
   c.filter_run focus: true
   c.run_all_when_everything_filtered = true

data/spec/support/http_stubs.rb

@@ -0,0 +1,43 @@
+# Keeps the suite off the public internet.
+#
+# Seven examples used to resolve DID documents and logs over HTTP against
+# oydid.ownyourdata.eu and did2.data-container.net. That made the suite depend
+# on production staying reachable and on data from 2022 never changing - a CI
+# failure then said nothing about the code.
+#
+# The recorded responses live in spec/fixtures/http; manifest.json maps each URL
+# to its status, content type and body file. To refresh one, fetch the URL and
+# overwrite the body file - the expectations under spec/output must then be
+# checked, not blindly regenerated.
+#
+# disable_net_connect! makes any unstubbed request fail loudly, so a newly added
+# network call cannot slip in unnoticed.
+
+require "json"
+require "webmock/rspec"
+
+WebMock.disable_net_connect!(allow_localhost: false)
+
+module HttpFixtures
+  DIR = File.expand_path("../fixtures/http", __dir__)
+
+  def self.entries
+    @entries ||= JSON.parse(File.read(File.join(DIR, "manifest.json")))
+  end
+
+  def self.body(entry)
+    File.read(File.join(DIR, entry["body"]))
+  end
+end
+
+RSpec.configure do |config|
+  config.before(:each) do
+    HttpFixtures.entries.each do |entry|
+      stub_request(:get, entry["url"]).to_return(
+        status: entry["status"],
+        body: HttpFixtures.body(entry),
+        headers: { "Content-Type" => entry["content_type"] },
+      )
+    end
+  end
+end

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: oydid
 version: !ruby/object:Gem::Version
-  version: 0.6.5
+  version: 0.6.7
 platform: ruby
 authors:
 - Christoph Fabianek
 bindir: bin
 cert_chain: []
-date: 2026-08-18 00:00:00.000000000 Z
+date: 2026-08-19 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: simple_dag
@@ -261,6 +261,15 @@ files:
 - lib/oydid/didcomm.rb
 - lib/oydid/log.rb
 - lib/oydid/vc.rb
+- spec/fixtures/http/did2-data-container-doc.json
+- spec/fixtures/http/manifest.json
+- spec/fixtures/http/oydid-doc-did-zQmaBZ.json
+- spec/fixtures/http/oydid-doc-empty.json
+- spec/fixtures/http/oydid-doc-raw-zQmaBZ.json
+- spec/fixtures/http/oydid-doc-zQmaBZ.json
+- spec/fixtures/http/oydid-log-zQmVwM.json
+- spec/fixtures/http/oydid-log-zQmZEP.json
+- spec/fixtures/http/oydid-log-zQmaBZ.json
 - spec/input/basic/arrays.json
 - spec/input/basic/french.json
 - spec/input/basic/sample2_get_location.doc
@@ -400,6 +409,7 @@ files:
 - spec/output/main/sample0_read.doc
 - spec/oydid_spec.rb
 - spec/spec_helper.rb
+- spec/support/http_stubs.rb
 homepage: http://github.com/ownyourdata/oydid
 licenses:
 - Apache-2.0
@@ -415,17 +425,26 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 3.0.0
+      version: 3.2.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.15
+rubygems_version: 4.0.12
 specification_version: 4
 summary: Own Your Decentralized Identifier for Ruby.
 test_files:
+- spec/fixtures/http/did2-data-container-doc.json
+- spec/fixtures/http/manifest.json
+- spec/fixtures/http/oydid-doc-did-zQmaBZ.json
+- spec/fixtures/http/oydid-doc-empty.json
+- spec/fixtures/http/oydid-doc-raw-zQmaBZ.json
+- spec/fixtures/http/oydid-doc-zQmaBZ.json
+- spec/fixtures/http/oydid-log-zQmVwM.json
+- spec/fixtures/http/oydid-log-zQmZEP.json
+- spec/fixtures/http/oydid-log-zQmaBZ.json
 - spec/input/basic/arrays.json
 - spec/input/basic/french.json
 - spec/input/basic/sample2_get_location.doc
@@ -565,3 +584,4 @@ test_files:
 - spec/output/main/sample0_read.doc
 - spec/oydid_spec.rb
 - spec/spec_helper.rb
+- spec/support/http_stubs.rb