oydid 0.9.1 → 0.9.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9c74b5cd9e592efe1514c9110cff25a131ddc0a45727e035d48656bc0c20d2f8
-  data.tar.gz: bd936eb03e018e15ae334907c7087629f48f17c2cc54bdeebb8a81542e2f2af9
+  metadata.gz: b941c83aec6492dfb37d272fd83a77f1b036902b70aab64634fed657d1ccaf6a
+  data.tar.gz: 0ba0f288c5c30e2cd7d7d831bd072ef0c4924082d70fba44634e1412578a8dc7
 SHA512:
-  metadata.gz: 8fddcdf2ce2328ba9329263b1de2826cec3c3d4947c7cd5e599972798cffb10887e8bf2205d208961494a7296a818c90a4fea679f2b9b1c01109645c8fde59bf
-  data.tar.gz: fdaab3ac52a14b4313db2d7d52058a41bdd6b72b2ca580441f5620a246d73d2fdf753a0530aef76d44520d8347573852aa6e3ae27d173371d54b09eeb86c874c
+  metadata.gz: ddc6020c44371fee58f2e527513e4d94974ee5d4a3ebabd22a01b5cc039f5c91cfe1a0ab0f4046c50a356ab0784db6a626c971c5ee18e10b076e03625250605e
+  data.tar.gz: eaba43282881c1239cde7af7733707d5beff7670b27388327926b4e7a5c739e9c221c1f9b70565a629adb3e7b4ee43dd3ebb3cb977bf6b2dd885ff6f55a34e93

data/VERSION

@@ -1 +1 @@
-0.9.1
+0.9.3

data/lib/oydid/basic.rb

@@ -338,7 +338,7 @@ class Oydid
                 return [nil, msg]
                 exit
             end
-            pubKey = did_document["doc"]["key"].split(":").first rescue nil
+            pubKey = did_document["doc"]["key"].split(":")[0] rescue nil
             if pubKey.nil?
                 return [nil, "cannot resolve " + did.to_s]
             else
@@ -367,9 +367,9 @@ class Oydid
         # get current public key
         case key_type
         when "doc"
-            keys = [did_document["doc"]["key"].split(":").first] rescue nil
+            keys = [did_document["doc"]["key"].split(":")[0]] rescue nil
         when "rev"
-            keys = [did_document["doc"]["key"].split(":").last] rescue nil
+            keys = [did_document["doc"]["key"].split(":")[1]] rescue nil
         else
             return [nil, "invalid key type: " + key_type]
         end
@@ -1248,6 +1248,30 @@ class Oydid
         end
     end
 
+    # Marks a failure of the queried repository itself (HTTP 5xx) as opposed to
+    # a DID that is simply not stored there. Without the distinction a caller
+    # turns a broken upstream into "not found", which claims the identifier
+    # never existed - see upstream_error?.
+    UPSTREAM_ERROR_PREFIX = "upstream error"
+
+    def self.upstream_error?(message)
+        message.to_s.start_with?(UPSTREAM_ERROR_PREFIX)
+    end
+
+    # Failure message for a non-200 response: the repository's own error field
+    # when it sent one, otherwise a message naming status and URL. A 5xx gets
+    # the prefix above so callers can tell it apart from a missing DID.
+    def self.http_error_message(response, url)
+        msg = (response.parsed_response["error"].to_s rescue "")
+        return msg unless msg.to_s == ""
+        code = response.code.to_i rescue 0
+        if code >= 500
+            UPSTREAM_ERROR_PREFIX + " " + code.to_s + " from " + url.to_s
+        else
+            "invalid response from " + url.to_s
+        end
+    end
+
     def self.retrieve_document(doc_identifier, doc_file, doc_location, options)
         # in-process callers can supply the DID document directly (e.g. read from
         # a local database) to avoid any HTTP/file lookup
@@ -1271,11 +1295,7 @@ class Oydid
             end
             retVal = HTTParty.get(doc_location + "/doc/" + doc_identifier + option_str)
             if retVal.code != 200
-                msg = retVal.parsed_response["error"].to_s rescue ""
-                if msg.to_s == ""
-                    msg = "invalid response from " + doc_location.to_s + "/doc/" + doc_identifier.to_s
-                end
-                return [nil, msg]
+                return [nil, http_error_message(retVal, doc_location.to_s + "/doc/" + doc_identifier.to_s)]
             end
             if options.transform_keys(&:to_s)["trace"]
                 if options[:silent].nil? || !options[:silent]
@@ -1324,8 +1344,7 @@ class Oydid
             doc_location = doc_location.sub("%3A%2F%2F","://").sub("%3A", ":")
             retVal = HTTParty.get(doc_location + "/doc_raw/" + doc_hash)
             if retVal.code != 200
-                msg = retVal.parsed_response("error").to_s rescue "invalid response from " + doc_location.to_s + "/doc/" + doc_hash.to_s
-                return [nil, msg]
+                return [nil, http_error_message(retVal, doc_location.to_s + "/doc_raw/" + doc_hash.to_s)]
             end
             if options.transform_keys(&:to_s)["trace"]
                 if options[:silent].nil? || !options[:silent]

data/lib/oydid/log.rb

@@ -44,10 +44,7 @@ class Oydid
             log_location = log_location.gsub("%2F%2F","//")
             retVal = HTTParty.get(log_location + "/log/" + did_hash)
             if retVal.code != 200
-                msg = retVal.parsed_response("error").to_s rescue 
-                        "invalid response from " + log_location.to_s + "/log/" + did_hash.to_s
-
-                return [nil, msg]
+                return [nil, http_error_message(retVal, log_location.to_s + "/log/" + did_hash.to_s)]
             end
             if options.transform_keys(&:to_s)["trace"]
                 if options[:silent].nil? || !options[:silent]
@@ -79,9 +76,7 @@ class Oydid
             log_location = log_location.gsub("%2F%2F","//")
             retVal = HTTParty.get(log_location + "/log/" + log_hash + "/item")
             if retVal.code != 200
-                msg = retVal.parsed_response("error").to_s rescue 
-                        "invalid response from " + log_location.to_s + "/log/" + log_hash.to_s + "/item"
-                return [nil, msg]
+                return [nil, http_error_message(retVal, log_location.to_s + "/log/" + log_hash.to_s + "/item")]
             end
             if options.transform_keys(&:to_s)["trace"]
                 if options[:silent].nil? || !options[:silent]
@@ -361,7 +356,7 @@ class Oydid
                     currentDID["verification"] += JSON.pretty_generate(doc) + "\n"
                     currentDID["verification"] += "(Details: https://ownyourdata.github.io/oydid/#calculate_hash)" + "\n\n"
                 end
-                current_public_doc_key = currentDID["doc"]["key"].split(":").first rescue ""
+                current_public_doc_key = currentDID["doc"]["key"].split(":")[0] rescue ""
 
             when 0 # TERMINATE
                 currentDID["termination_log_id"] = i
@@ -506,7 +501,7 @@ class Oydid
                                             return currentDID
                                         end
                                         next_doc = next_doc.first["doc"]
-                                        if pubKeys.include?(next_doc["key"].split(":").first)
+                                        if pubKeys.include?(next_doc["key"].split(":")[0])
                                             currentDID["verification"] += "⚠️  no key rotation in updated DID Document" + "\n"
                                         end
                                         currentDID["verification"] += "\n"
@@ -558,9 +553,22 @@ class Oydid
                 # handle DID Rotation
                 if (i == (currentDID["log"].length-1))
                     if options[:followAlsoKnownAs]
+                        # the payload of a DID Document is arbitrary JSON: an
+                        # Array or a scalar is valid and simply carries no
+                        # alsoKnownAs, so only a Hash can be inspected for it.
+                        # Without this guard a revoked DID whose document holds
+                        # e.g. [5] raised NoMethodError here, the repository
+                        # answered 500 with an empty body, and the resolver
+                        # degraded that to "not found" instead of "deactivated".
                         current_doc = currentDID["doc"]
-                        if current_doc["doc"].transform_keys(&:to_s).has_key?("alsoKnownAs")
-                            rotate_DID = current_doc["doc"].transform_keys(&:to_s)["alsoKnownAs"]
+                        doc_payload = current_doc.is_a?(Hash) ? current_doc["doc"] : nil
+                        doc_payload = doc_payload.transform_keys(&:to_s) if doc_payload.is_a?(Hash)
+                        if doc_payload.is_a?(Hash) && doc_payload.has_key?("alsoKnownAs")
+                            # DID Core defines alsoKnownAs as a set; older
+                            # documents wrote a bare String
+                            rotate_DID = doc_payload["alsoKnownAs"]
+                            rotate_DID = rotate_DID.first if rotate_DID.is_a?(Array)
+                            rotate_DID = rotate_DID.to_s
                             if rotate_DID.start_with?("did:")
                                 rotate_DID_method = rotate_DID.split(":").take(2).join(":")
                                 did_orig = currentDID["did"]
@@ -586,8 +594,14 @@ class Oydid
                                         currentDID["verification"] += "(Details: https://ownyourdata.github.io/oydid/#did_rotation)" + "\n\n"
                                     end
                                 when "did:oyd"
-                                    puts "try to resolve did:oyd with our own resolver"
-                                    puts "add verification text"
+                                    # DID Rotation to another did:oyd identifier
+                                    # is not implemented yet: resolving it needs
+                                    # a second pass through this resolver.
+                                    if verification_output
+                                        currentDID["verification"] += "DID rotation to: " + rotate_DID.to_s + "\n"
+                                        currentDID["verification"] += "⚠️ rotation to another did:oyd identifier is not supported yet\n"
+                                        currentDID["verification"] += "(Details: https://ownyourdata.github.io/oydid/#did_rotation)" + "\n\n"
+                                    end
                                 else
                                     # do nothing: DID Rotation is not supported for this DID method yet
                                 end

data/lib/oydid.rb

@@ -383,8 +383,8 @@ class Oydid
                 old_privateKey = nil
                 old_revocationKey = nil
                 old_did_key = did_info["doc"]["key"].to_s
-                old_publicDocKey = old_did_key.split(":").first.to_s
-                old_publicRevKey = old_did_key.split(":").last.to_s
+                old_publicDocKey = old_did_key.split(":")[0].to_s
+                old_publicRevKey = old_did_key.split(":")[1].to_s
 
                 verified, vmsg = verify_revocation_log(did_info, options[:log_revoke_old],
                                                        "log_revoke_old", options)
@@ -460,6 +460,16 @@ class Oydid
             publicKey = public_key(privateKey, options).first
             pubRevoKey = public_key(revocationKey, options).first
         end
+        # The "key" field is the control field of a did:oyd: it names who may
+        # update the document (slot 0) and who may revoke it (slot 1) - nothing
+        # else. Keys that are content rather than control (key agreement above
+        # all) belong in the payload as verification methods, where they are
+        # covered by the identifier hash just the same.
+        #
+        # The field is positional and has exactly two slots. Readers must use an
+        # explicit index; .last would silently return the wrong key if a third
+        # slot were ever appended, and the mistake would only surface at
+        # revocation time. A spec enforces this across the repository.
         did_key = publicKey + ":" + pubRevoKey
 
         # the document is assembled once, in the first phase of a CMSM flow -
@@ -512,6 +522,10 @@ class Oydid
         end
 
         if revocationKey.to_s == ""
+            if options[:cmsm]
+                err = cmsm_verify_signature(subDidHash, cmsm_sig_rev, pubRevoKey, "key-rev")
+                return [nil, nil, nil, err] if !err.nil?
+            end
             signedSubDidHash = cmsm_sig_rev
         else
             signedSubDidHash = sign(subDidHash, revocationKey, LOG_HASH_OPTIONS).first
@@ -534,6 +548,8 @@ class Oydid
                                       cmsm_sig_rev, cmsm_sig_doc, cmsm_sig_create,
                                   did_old, cmsm_log_revoke_old), options)
             end
+            err = cmsm_verify_signature(l2_doc, cmsm_sig_doc, publicKey, "key-doc")
+            return [nil, nil, nil, err] if !err.nil?
             l2_sig = cmsm_sig_doc
         else
             l2_sig = sign(l2_doc, privateKey, options).first
@@ -595,6 +611,8 @@ class Oydid
                                           cmsm_sig_rev, cmsm_sig_doc, cmsm_sig_create,
                                           did_old, cmsm_log_revoke_old), options)
                 end
+                err = cmsm_verify_signature(l1_doc, cmsm_sig_create, old_publicDocKey, "key-doc-old")
+                return [nil, nil, nil, err] if !err.nil?
                 l1_sig = cmsm_sig_create
             else
                 l1_sig = sign(l1_doc, old_privateKey, options).first
@@ -628,6 +646,8 @@ class Oydid
                                           cmsm_sig_rev, cmsm_sig_doc, cmsm_sig_create,
                                   did_old, cmsm_log_revoke_old), options)
                 end
+                err = cmsm_verify_signature(l1_doc, cmsm_sig_create, publicKey, "key-doc")
+                return [nil, nil, nil, err] if !err.nil?
                 l1_sig = cmsm_sig_create
             else
                 l1_sig = sign(l1_doc, privateKey, options).first
@@ -736,7 +756,7 @@ class Oydid
         end
 
         did_key = did_info["doc"]["key"].to_s
-        pubRevKey = did_key.split(":").last.to_s
+        pubRevKey = did_key.split(":")[1].to_s
         subDid = {"doc": did_info["doc"]["doc"], "key": did_key}.to_json
         subDidHash = multi_hash(canonical(subDid), LOG_HASH_OPTIONS).first
 
@@ -776,6 +796,23 @@ class Oydid
     # state of a CMSM flow that has to survive between phases. Deliberately only
     # inputs and collected signatures - no derived hashes: every phase recomputes
     # r1 / l2_doc / the DID from these values, so there is nothing to keep in sync.
+    # A signature collected in a CMSM phase is only worth something if it was
+    # really made with the key the challenge named. Without this check the flow
+    # takes anything: the log entries are built from whatever the client sent and
+    # only fail on resolution - by which point the DID exists and has claimed the
+    # public key, which lets anyone permanently burn a key they do not hold.
+    #
+    # The message starts with "CMSM " so that the REST layers report it as a
+    # client error (400), not as a server fault.
+    def self.cmsm_verify_signature(value, signature, public_key, with)
+        if public_key.to_s == ""
+            return "CMSM cannot verify the " + with.to_s + " signature: no public key in session"
+        end
+        success, _msg = (verify(value, signature, public_key) rescue [false, ""])
+        return nil if success == true
+        "CMSM signature for " + with.to_s + " is invalid"
+    end
+
     def self.cmsm_state(publicKey, pubRevoKey, revocationKey, did_doc, ts, doc_location, sig_rev, sig_doc, sig_create, did_old = nil, log_revoke_old = nil)
         {
             publicKey: publicKey,

data/spec/oydid_spec.rb

@@ -519,6 +519,65 @@ describe "OYDID handling" do
   #   end
   # end
 
+  # regression: the payload of a DID Document is arbitrary JSON, not
+  # necessarily an object. A revoked DID whose payload is an Array used to
+  # raise NoMethodError in the alsoKnownAs lookup - the repository then
+  # answered 500 with an empty body and the resolver reported "not found"
+  # instead of "deactivated".
+  describe "dag_update with a non-object DID Document payload" do
+    def revoked_state(payload)
+      { "did" => "did:oyd:zQmPyjnkL52gQxBBhPuCFkf167MzpCKquqbu5Qt5ia2JGTr",
+        "doc" => { "doc" => payload, "key" => "", "log" => "" },
+        "log" => [{ "ts" => 1647732475, "op" => 1, "doc" => "zQmcVLwEtzU8By7TTeRFGvVUKm7HhZS6GgRTDFt51QNnans",
+                    "sig" => "", "previous" => [] }] }
+    end
+
+    it "does not raise for an Array payload" do
+      expect {
+        Oydid.dag_update(revoked_state([5]), { followAlsoKnownAs: true })
+      }.not_to raise_error
+    end
+
+    it "does not raise for a scalar payload" do
+      expect {
+        Oydid.dag_update(revoked_state("plain"), { followAlsoKnownAs: true })
+      }.not_to raise_error
+    end
+
+    it "accepts alsoKnownAs written as a set" do
+      state = revoked_state({ "alsoKnownAs" => ["did:oyd:zQmaBZTghndXTgxNwfbdpVLWdFf6faYE4oeuN2zzXdQt1kh"] })
+      expect {
+        Oydid.dag_update(state, { followAlsoKnownAs: true })
+      }.not_to raise_error
+    end
+  end
+
+  # a broken repository (5xx) has to stay distinguishable from a DID that is
+  # not stored there - otherwise the caller reports "not found" and thereby
+  # claims the identifier never existed
+  describe "failure messages for non-200 responses" do
+    it "marks a 5xx as an upstream error" do
+      reply = double(code: 500, parsed_response: "")
+      msg = Oydid.http_error_message(reply, "https://oydid.ownyourdata.eu/doc/zQmXY")
+      expect(Oydid.upstream_error?(msg)).to be true
+      expect(msg).to include("500")
+    end
+
+    it "passes the repository's own error through" do
+      reply = double(code: 410, parsed_response: { "error" => "revoked" })
+      msg = Oydid.http_error_message(reply, "https://oydid.ownyourdata.eu/doc/zQmXY")
+      expect(msg).to eq "revoked"
+      expect(Oydid.upstream_error?(msg)).to be false
+    end
+
+    it "does not mark a 4xx without an error field as upstream error" do
+      reply = double(code: 404, parsed_response: nil)
+      msg = Oydid.http_error_message(reply, "https://oydid.ownyourdata.eu/doc/zQmXY")
+      expect(msg).to start_with("invalid response from")
+      expect(Oydid.upstream_error?(msg)).to be false
+    end
+  end
+
   # main functionds
   Dir.glob(File.expand_path("../input/main/*_read.doc", __FILE__)).each do |input|
     it "execute read for #{input.split('/').last}" do
@@ -807,6 +866,51 @@ describe "OYDID handling" do
   # Which identifier a resolved DID document announces as its own. An update
   # mints a new did:oyd, but the identifier a relying party holds is the one it
   # asked for - that is the one the document has to carry.
+  # The "key" field is positional: "<public document key>:<public revocation key>".
+  # Reading it with .first/.last works only as long as it has exactly two slots -
+  # the day a third one is added (e.g. a key agreement key), .last silently
+  # returns the wrong key and the error only surfaces at revocation time.
+  # Every read must therefore use an explicit index.
+  describe "positional access to the key field" do
+    repo_root = File.expand_path("../../..", __FILE__)
+    sources = %w[
+      ruby-gem/lib
+      cli
+      repository/app
+      uni-registrar-driver-did-oyd/app
+    ].map { |d| File.join(repo_root, d) }.select { |d| File.directory?(d) }
+
+    ruby_files = sources.flat_map { |d| Dir.glob(File.join(d, "**", "*.rb")) }
+
+    it "finds sources to scan" do
+      skip "running outside the repository checkout" if ruby_files.empty?
+      expect(ruby_files).not_to be_empty
+    end
+
+    it "never reads a split key field with .last" do
+      skip "running outside the repository checkout" if ruby_files.empty?
+      offenders = ruby_files.flat_map do |file|
+        File.readlines(file).each_with_index.filter_map do |line, i|
+          "#{file.sub(repo_root + "/", "")}:#{i + 1}" if line =~ /split\((["'])\:\1\)\.last/
+        end
+      end
+      expect(offenders).to eq []
+    end
+
+    it "never reads a split key field with .first" do
+      skip "running outside the repository checkout" if ruby_files.empty?
+      offenders = ruby_files.flat_map do |file|
+        File.readlines(file).each_with_index.filter_map do |line, i|
+          next unless line =~ /split\((["'])\:\1\)\.first/
+          # the DID identifier itself is also colon-separated and legitimately
+          # read with .first - only the key field is at issue here
+          "#{file.sub(repo_root + "/", "")}:#{i + 1}" if line.include?('"key"') || line.include?("'key'") || line =~ /_key(s)?\.split/
+        end
+      end
+      expect(offenders).to eq []
+    end
+  end
+
   describe "document_id" do
     let(:first_did)  { "zQmSE1hzumtZ7AoK1qhHf4t5kiKsujMsJSHqoXtWrdd7K7W" }
     let(:second_did) { "zQmfEb3KgYZjZUPLTHPmFPdcV6peF5itB5NmJ9N6gaxxE8K" }
@@ -858,4 +962,103 @@ describe "OYDID handling" do
     end
   end
 
+
+  describe "CMSM signature verification" do
+    # An in-memory stand-in for the session store the repository provides, so
+    # these examples run without a database and without the network.
+    class MemoryCmsmStore
+      def initialize; @data = {}; end
+      def set(session, payload); @data[session] = payload; end
+      def get(session); @data[session]; end
+      def delete(session); @data.delete(session); end
+    end
+
+    let(:store) { MemoryCmsmStore.new }
+    let(:priv)  { Oydid.generate_private_key("", "ed25519-priv", {}).first }
+    let(:pub)   { Oydid.public_key(priv, {}).first }
+
+    def cmsm_options(extra = {})
+      { cmsm: true, key_type: "ed25519", cmsm_store: store,
+        return_secrets: true, skip_publish: true }.merge(extra)
+    end
+
+    # phase 1: hand over the public key, receive session and value to sign
+    def start_flow
+      status, msg = Oydid.create({ "key" => pub }, cmsm_options)
+      expect(msg).to eq("cmsm")
+      status.transform_keys(&:to_s)
+    end
+
+    describe "cmsm_verify_signature" do
+      it "accepts a signature made with the named key" do
+        signature = Oydid.sign("hello", priv, {}).first
+        expect(Oydid.cmsm_verify_signature("hello", signature, pub, "key-doc")).to be_nil
+      end
+
+      it "rejects a signature over a different value" do
+        signature = Oydid.sign("hello", priv, {}).first
+        msg = Oydid.cmsm_verify_signature("goodbye", signature, pub, "key-doc")
+        expect(msg).to eq("CMSM signature for key-doc is invalid")
+      end
+
+      it "rejects a signature made with a different key" do
+        other = Oydid.generate_private_key("", "ed25519-priv", {}).first
+        signature = Oydid.sign("hello", other, {}).first
+        expect(Oydid.cmsm_verify_signature("hello", signature, pub, "key-doc")).not_to be_nil
+      end
+
+      it "rejects nonsense instead of raising" do
+        expect(Oydid.cmsm_verify_signature("hello", "not-a-signature", pub, "key-doc")).not_to be_nil
+      end
+
+      it "refuses to verify without a public key" do
+        signature = Oydid.sign("hello", priv, {}).first
+        msg = Oydid.cmsm_verify_signature("hello", signature, "", "key-doc")
+        expect(msg).to include("no public key in session")
+      end
+
+      # the message is what the REST layers match on to answer 400 instead of 500
+      it "phrases failures as client errors" do
+        msg = Oydid.cmsm_verify_signature("hello", "zBogus", pub, "key-rev")
+        expect(msg).to start_with("CMSM ")
+      end
+    end
+
+    describe "a running flow" do
+      it "advances when the signature is correct" do
+        phase1 = start_flow
+        signature = Oydid.sign(phase1["sign"], priv, {}).first
+
+        status, msg = Oydid.create({}, cmsm_options(cmsm_session: phase1["session"], sig: signature))
+
+        expect(msg).to eq("cmsm")
+        expect(status.transform_keys(&:to_s)["session"]).to eq(phase1["session"])
+      end
+
+      # Before this check the flow took any signature, built the log entries from
+      # it and answered 200. The DID did not resolve, but it had claimed the
+      # public key - so anyone could burn a key they did not hold.
+      it "refuses a signature the client cannot have made" do
+        phase1 = start_flow
+        forged = Oydid.sign(phase1["sign"],
+                            Oydid.generate_private_key("", "ed25519-priv", {}).first, {}).first
+
+        status, msg = Oydid.create({}, cmsm_options(cmsm_session: phase1["session"], sig: forged))
+
+        expect(status).to be_nil
+        expect(msg).to eq("CMSM signature for key-doc is invalid")
+      end
+
+      it "refuses a signature over a value from another flow" do
+        phase1 = start_flow
+        other  = start_flow
+        signature = Oydid.sign(other["sign"], priv, {}).first
+
+        status, msg = Oydid.create({}, cmsm_options(cmsm_session: phase1["session"], sig: signature))
+
+        expect(status).to be_nil
+        expect(msg).to start_with("CMSM ")
+      end
+    end
+  end
 end

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: oydid
 version: !ruby/object:Gem::Version
-  version: 0.9.1
+  version: 0.9.3
 platform: ruby
 authors:
 - Christoph Fabianek
 bindir: bin
 cert_chain: []
-date: 2026-08-26 00:00:00.000000000 Z
+date: 2026-08-29 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: simple_dag