openbadgeslib 1.3.0__tar.gz → 3.0.0__tar.gz

{openbadgeslib-1.3.0 → openbadgeslib-3.0.0}/Changelog.txt

@@ -4,6 +4,75 @@ OpenBadgesLib - Changelog
 Newest first. Dates are ISO 8601 (YYYY-MM-DD).
 
 
+* v3.0.0 - 2026-07-01
+
+  - BREAKING: the pre-2.0 wire format previously shipped as `-V 2` is relabelled
+    OpenBadges 1.0 (`-V 1`) and frozen in the new `openbadgeslib.ob1` package (no
+    @context/type, a `uid`, a `verify` object, string `hashed`, Unix-timestamp
+    dates). `from openbadgeslib.ob2 import Signer/Verifier/Badge` no longer
+    resolves — import from `openbadgeslib.ob1` (the top-level
+    `openbadgeslib.signer` / `verifier` / `badge` shims still work).
+
+  - BREAKING: the default `-V` is now `3` (was `2`) for openbadges-signer,
+    -verifier, -publish and -keygenerator. Pass `-V 2` / `-V 1` explicitly for
+    the older generations.
+
+  - feat(ob2): new strict, spec-conformant Open Badges 2.0 implementation
+    (`openbadgeslib.ob2`). Assertions are valid JSON-LD Badge Objects with
+    `@context`, `type`, an IRI `id` (`urn:uuid:` for signed, the hosting URL for
+    hosted), a boolean `hashed`, ISO 8601 dates, and a `verification` object.
+    New `OB2Signer`, `OB2Verifier`, and dataclasses `Assertion`, `BadgeClass`,
+    `Profile`, `CryptographicKey`, `RevocationList`.
+
+  - feat(ob2): real HostedBadge verification — the assertion is fetched from its
+    own `id` over HTTPS and scope-checked against the issuer origin (default
+    same-origin, or the issuer's `startsWith` / `allowedOrigins`); the baked JWS
+    is non-gating defence-in-depth. Select it with `openbadges-signer -V 2 -H`.
+
+  - feat(ob2): SignedBadge verification resolves `verification.creator` to a
+    published `CryptographicKey` and checks its `owner` / `publicKey` back-link
+    to the issuer Profile.
+
+  - feat(publish): `openbadges-publish -V 2` emits conformant hosted metadata —
+    an issuer Profile with a `publicKey` array, a `BadgeClass` and a
+    `CryptographicKey` (`key.json`) per badge, and a `RevocationList`.
+
+  - feat(config): new optional badge keys `crypto_key` and
+    `hosted_assertions_base` for the OB 2.0 signed / hosted flows.
+
+  - OpenBadges 3.0 is unchanged.
+
+
+* v2.0.0 - 2026-07-01
+
+  - BREAKING (OB3): OpenBadges 3.0 credentials are now secured with the native
+    OB 3.0 VC-JWT (spec §8.2): the JWT payload IS the credential (its members at
+    the top level, no 'vc' claim wrapper), validFrom maps to 'nbf' (there is no
+    'iat'), and the JOSE header carries the issuer's public key as a 'jwk'.
+    Tokens issued by 1.x (the VCDM-1.1-style 'vc'-wrapper) are NOT compatible.
+
+  - BREAKING (OB3): baked images use the OB 3.0 document-format identifiers —
+    the PNG iTXt keyword 'openbadgecredential' and the SVG element
+    <openbadges:credential> (namespace https://purl.imsglobal.org/ob/v3p0). OB3
+    images baked by 1.x (OB2 identifiers) are not read by this verifier.
+
+  - OB3 verifier now accepts credentials that are valid per the spec schema but
+    were previously rejected: the AchievementCredential type alias, an issuer
+    given as a string IRI (not only a Profile object), and a credentialSubject
+    without an 'id' (identity conveyed via 'identifier').
+
+  - OB3 verifier now enforces required structure it previously ignored: the
+    @context (VC 2.0 + OB v3p0 pair) is validated, and the registered claims
+    'iss' and 'nbf' are required (with 'sub' required when the subject has an id).
+
+  - OB3 credentialStatus now honors statusPurpose: 'suspension' is reported
+    distinctly from 'revocation', a non-revocation/suspension purpose (e.g.
+    'message') no longer fails verification, and the entry's purpose is
+    cross-checked against the fetched status list's declared purpose.
+
+  - OpenBadges 2.0 is unchanged; only the OB3 path is affected.
+
+
 * v1.3.0 - 2026-07-01
 
   - SECURITY: download_file() now blocks server-side request forgery. The URLs

{openbadgeslib-1.3.0/openbadgeslib.egg-info → openbadgeslib-3.0.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: openbadgeslib
-Version: 1.3.0
+Version: 3.0.0
 Summary: A library to sign and verify OpenBadges
 Author-email: Luis González Fernández <luisgf@luisgf.es>, Jesús Cea Avión <jcea@jcea.es>
 License: LGPLv3
@@ -48,12 +48,13 @@ Dynamic: license-file
 
 A Python library and CLI for signing and verifying
 [Open Badges](https://www.imsglobal.org/activity/digital-badges) embedded in SVG
-and PNG image files. It supports both **OpenBadges 2.0** (JWS compact
-serialisation) and **OpenBadges 3.0** (W3C Verifiable Credentials / JWT-VC).
+and PNG image files. It supports strict **OpenBadges 2.0** (JWS / hosted
+assertions) and **OpenBadges 3.0** (W3C Verifiable Credentials / JWT-VC), plus a
+frozen **OpenBadges 1.0** legacy format — selected with `-V {1,2,3}` (default `3`).
 
 ## Features
 
-- Sign badge images (SVG and PNG) with a JWS assertion (OB 2.0)
+- Sign badge images (SVG and PNG) as strict OB 2.0 JWS / hosted assertions (with a frozen OB 1.0 legacy format)
 - Issue and verify OpenBadges 3.0 JWT-VC credentials
 - Bake OB 3.0 JWT tokens into SVG and PNG badge images
 - RSA 2048-bit (RS256), ECC NIST P-256 (ES256), and Ed25519 (EdDSA) key support
@@ -93,58 +94,52 @@ openbadges-init ./config/
 # 2. Generate a key pair for a badge
 openbadges-keygenerator -c ./config/config.ini -g 1
 
-# 3a. Sign a badge — OpenBadges 2.0 (default)
+# 3a. Sign a badge — OpenBadges 3.0 (default)
 openbadges-signer -c ./config/config.ini -b 1 -r recipient@example.com -o /tmp/ -E
 
-# 3b. Sign a badge — OpenBadges 3.0
-openbadges-signer -c ./config/config.ini -b 1 -r recipient@example.com -o /tmp/ -E -V 3
+# 3b. Sign a badge — strict OpenBadges 2.0
+openbadges-signer -c ./config/config.ini -b 1 -r recipient@example.com -o /tmp/ -E -V 2
 
-# 4a. Verify — OpenBadges 2.0 (pin a trusted key with -l/--local or -k/--pubkey)
+# 4a. Verify — OpenBadges 3.0
 openbadges-verifier -i /tmp/badge_1_recipient@example.com.svg \
-    -r recipient@example.com -l 1
+    -r recipient@example.com -V 3 -k ./config/keys/verify_rsa_key_1.pem
 
-# 4b. Verify — OpenBadges 3.0
+# 4b. Verify — strict OpenBadges 2.0 (pin a trusted key with -l/--local or -k/--pubkey)
 openbadges-verifier -i /tmp/badge_1_recipient@example.com.svg \
-    -r recipient@example.com -V 3 -k ./config/keys/verify_rsa_key_1.pem
+    -r recipient@example.com -V 2 -l 1
 ```
 
 See the [Quick Start](https://github.com/luisgf/openbadgeslib/wiki/Quick-Start)
 and [CLI Reference](https://github.com/luisgf/openbadgeslib/wiki/CLI-Reference)
 wiki pages for the full walkthrough and every flag.
 
-## Using the library — OpenBadges 2.0
+## Using the library — OpenBadges 2.0 (strict)
 
 ```python
-from openbadgeslib.ob2 import Badge, BadgeImgType, BadgeType, Signer
-from openbadgeslib.keys import KeyType
+from datetime import datetime, timezone
+from openbadgeslib.ob2 import OB2Signer, Assertion, IdentityObject, Verification
 
 with open('sign.pem', 'rb') as f:
     priv_pem = f.read()
-with open('verify.pem', 'rb') as f:
-    pub_pem = f.read()
 with open('badge.svg', 'rb') as f:
     image = f.read()
 
-badge = Badge(
-    ini_name='my_badge',
-    name='My Badge',
-    description='Awarded for excellence',
-    image_type=BadgeImgType.SVG,
-    image=image,
-    image_url='https://example.com/badge.svg',
-    criteria_url='https://example.com/criteria.html',
-    json_url='https://example.com/badge.json',
-    verify_key_url='https://example.com/verify.pem',
-    key_type=KeyType.RSA,
-    privkey_pem=priv_pem,
-    pubkey_pem=pub_pem,
+assertion = Assertion(
+    recipient=IdentityObject.create('recipient@example.com', salt='s4lt3d'),
+    badge='https://example.com/badge_1/badge.json',
+    verification=Verification(type='SignedBadge',
+                              creator='https://example.com/badge_1/key.json'),
+    issued_on=datetime(2026, 1, 1, tzinfo=timezone.utc),
 )
 
-signer = Signer(identity='recipient@example.com', badge_type=BadgeType.SIGNED)
-signed = signer.sign_badge(badge)
-signed.save_to_file('/tmp/signed_badge.svg')
+signer = OB2Signer(privkey_pem=priv_pem, algorithm='RS256')
+baked_svg = signer.sign_into_svg(assertion, image)
+with open('/tmp/signed_badge.svg', 'wb') as f:
+    f.write(baked_svg)
 ```
 
+For the frozen OpenBadges 1.0 legacy API (`Badge` / `Signer` / `Verifier`), import from `openbadgeslib.ob1` instead.
+
 ## Using the library — OpenBadges 3.0 (JWT-VC)
 
 ```python

{openbadgeslib-1.3.0 → openbadgeslib-3.0.0}/README.md

@@ -7,12 +7,13 @@
 
 A Python library and CLI for signing and verifying
 [Open Badges](https://www.imsglobal.org/activity/digital-badges) embedded in SVG
-and PNG image files. It supports both **OpenBadges 2.0** (JWS compact
-serialisation) and **OpenBadges 3.0** (W3C Verifiable Credentials / JWT-VC).
+and PNG image files. It supports strict **OpenBadges 2.0** (JWS / hosted
+assertions) and **OpenBadges 3.0** (W3C Verifiable Credentials / JWT-VC), plus a
+frozen **OpenBadges 1.0** legacy format — selected with `-V {1,2,3}` (default `3`).
 
 ## Features
 
-- Sign badge images (SVG and PNG) with a JWS assertion (OB 2.0)
+- Sign badge images (SVG and PNG) as strict OB 2.0 JWS / hosted assertions (with a frozen OB 1.0 legacy format)
 - Issue and verify OpenBadges 3.0 JWT-VC credentials
 - Bake OB 3.0 JWT tokens into SVG and PNG badge images
 - RSA 2048-bit (RS256), ECC NIST P-256 (ES256), and Ed25519 (EdDSA) key support
@@ -52,58 +53,52 @@ openbadges-init ./config/
 # 2. Generate a key pair for a badge
 openbadges-keygenerator -c ./config/config.ini -g 1
 
-# 3a. Sign a badge — OpenBadges 2.0 (default)
+# 3a. Sign a badge — OpenBadges 3.0 (default)
 openbadges-signer -c ./config/config.ini -b 1 -r recipient@example.com -o /tmp/ -E
 
-# 3b. Sign a badge — OpenBadges 3.0
-openbadges-signer -c ./config/config.ini -b 1 -r recipient@example.com -o /tmp/ -E -V 3
+# 3b. Sign a badge — strict OpenBadges 2.0
+openbadges-signer -c ./config/config.ini -b 1 -r recipient@example.com -o /tmp/ -E -V 2
 
-# 4a. Verify — OpenBadges 2.0 (pin a trusted key with -l/--local or -k/--pubkey)
+# 4a. Verify — OpenBadges 3.0
 openbadges-verifier -i /tmp/badge_1_recipient@example.com.svg \
-    -r recipient@example.com -l 1
+    -r recipient@example.com -V 3 -k ./config/keys/verify_rsa_key_1.pem
 
-# 4b. Verify — OpenBadges 3.0
+# 4b. Verify — strict OpenBadges 2.0 (pin a trusted key with -l/--local or -k/--pubkey)
 openbadges-verifier -i /tmp/badge_1_recipient@example.com.svg \
-    -r recipient@example.com -V 3 -k ./config/keys/verify_rsa_key_1.pem
+    -r recipient@example.com -V 2 -l 1
 ```
 
 See the [Quick Start](https://github.com/luisgf/openbadgeslib/wiki/Quick-Start)
 and [CLI Reference](https://github.com/luisgf/openbadgeslib/wiki/CLI-Reference)
 wiki pages for the full walkthrough and every flag.
 
-## Using the library — OpenBadges 2.0
+## Using the library — OpenBadges 2.0 (strict)
 
 ```python
-from openbadgeslib.ob2 import Badge, BadgeImgType, BadgeType, Signer
-from openbadgeslib.keys import KeyType
+from datetime import datetime, timezone
+from openbadgeslib.ob2 import OB2Signer, Assertion, IdentityObject, Verification
 
 with open('sign.pem', 'rb') as f:
     priv_pem = f.read()
-with open('verify.pem', 'rb') as f:
-    pub_pem = f.read()
 with open('badge.svg', 'rb') as f:
     image = f.read()
 
-badge = Badge(
-    ini_name='my_badge',
-    name='My Badge',
-    description='Awarded for excellence',
-    image_type=BadgeImgType.SVG,
-    image=image,
-    image_url='https://example.com/badge.svg',
-    criteria_url='https://example.com/criteria.html',
-    json_url='https://example.com/badge.json',
-    verify_key_url='https://example.com/verify.pem',
-    key_type=KeyType.RSA,
-    privkey_pem=priv_pem,
-    pubkey_pem=pub_pem,
+assertion = Assertion(
+    recipient=IdentityObject.create('recipient@example.com', salt='s4lt3d'),
+    badge='https://example.com/badge_1/badge.json',
+    verification=Verification(type='SignedBadge',
+                              creator='https://example.com/badge_1/key.json'),
+    issued_on=datetime(2026, 1, 1, tzinfo=timezone.utc),
 )
 
-signer = Signer(identity='recipient@example.com', badge_type=BadgeType.SIGNED)
-signed = signer.sign_badge(badge)
-signed.save_to_file('/tmp/signed_badge.svg')
+signer = OB2Signer(privkey_pem=priv_pem, algorithm='RS256')
+baked_svg = signer.sign_into_svg(assertion, image)
+with open('/tmp/signed_badge.svg', 'wb') as f:
+    f.write(baked_svg)
 ```
 
+For the frozen OpenBadges 1.0 legacy API (`Badge` / `Signer` / `Verifier`), import from `openbadgeslib.ob1` instead.
+
 ## Using the library — OpenBadges 3.0 (JWT-VC)
 
 ```python

{openbadgeslib-1.3.0 → openbadgeslib-3.0.0}/openbadgeslib/__init__.py

@@ -21,14 +21,23 @@
         License along with this library.
 """
 
-# ── OpenBadges 2.0 ─────────────────────────────────────────────────────────────
-from .ob2 import (  # noqa: F401
+# ── OpenBadges 1.0 (legacy) ─────────────────────────────────────────────────────
+# The classes formerly exposed as "OpenBadges 2.0" are the pre-2.0 wire format
+# (no @context/type, uid, verify{}, Unix timestamps). They are re-exported here
+# unchanged for backward compatibility; the strict OB 2.0 implementation lives
+# in openbadgeslib.ob2 (OB2Signer/OB2Verifier).
+from .ob1 import (  # noqa: F401
     Signer, Verifier, VerifyInfo,
     Badge, BadgeSigned, Assertion,
     BadgeStatus, BadgeImgType, BadgeType,
     extract_svg_assertion, extract_png_assertion,
 )
 
+# ── OpenBadges 2.0 (strict) ──────────────────────────────────────────────────
+from .ob2 import (  # noqa: F401
+    OB2Signer, OB2Verifier, OB2VerificationError,
+)
+
 # ── OpenBadges 3.0 ─────────────────────────────────────────────────────────────
 from .ob3 import (  # noqa: F401
     OB3Signer, OB3Verifier, OB3VerificationError,

{openbadgeslib-1.3.0 → openbadgeslib-3.0.0}/openbadgeslib/badge.py

@@ -1,5 +1,5 @@
-"""OpenBadges 2.0 badge objects — compatibility shim, re-exports from openbadgeslib.ob2."""
-from .ob2.badge import (
+"""OpenBadges 1.0 (legacy) badge objects — compatibility shim, re-exports from openbadgeslib.ob1."""
+from .ob1.badge import (
     BadgeStatus, BadgeImgType, BadgeType,
     Assertion, Badge, BadgeSigned,
     extract_svg_assertion, extract_png_assertion,

{openbadgeslib-1.3.0 → openbadgeslib-3.0.0}/openbadgeslib/baking.py

@@ -34,8 +34,16 @@ from typing import List, Optional, Tuple, Union
 from defusedxml.minidom import parseString
 from png import Reader, signature as _png_signature
 
+# OB 2.0 document-format identifiers.
 ITXT_KEYWORD = b'openbadges'
 SVG_ELEMENT = 'openbadges:assertion'
+SVG_NS = 'http://openbadges.org'
+
+# OB 3.0 document-format identifiers (differ from OB 2.0). Selected via the
+# keyword-only args below so OB2 and OB3 bake/extract their own carriers.
+ITXT_KEYWORD_OB3 = b'openbadgecredential'
+SVG_ELEMENT_OB3 = 'openbadges:credential'
+SVG_NS_OB3 = 'https://purl.imsglobal.org/ob/v3p0'
 
 # Maximum bytes a compressed iTXt token is allowed to inflate to. A JWS/JWT-VC
 # is a few KB; this cap stops a crafted zlib bomb from exhausting memory during
@@ -47,9 +55,9 @@ class DecompressionLimitExceeded(Exception):
     """Raised when a compressed iTXt token inflates beyond the allowed size."""
 
 
-def _split_openbadges_itxt(data: bytes) -> Optional[bytes]:
-    keyword, sep, rest = data.partition(b'\x00')
-    if sep != b'\x00' or keyword != ITXT_KEYWORD or len(rest) < 2:
+def _split_openbadges_itxt(data: bytes, keyword: bytes = ITXT_KEYWORD) -> Optional[bytes]:
+    chunk_keyword, sep, rest = data.partition(b'\x00')
+    if sep != b'\x00' or chunk_keyword != keyword or len(rest) < 2:
         return None
     return rest
 
@@ -66,14 +74,16 @@ def _bounded_inflate(data: bytes, limit: int = MAX_ITXT_DECOMPRESSED) -> bytes:
 
 # ── SVG ─────────────────────────────────────────────────────────────────────
 
-def bake_svg(image_bytes: bytes, token: str, comment: Optional[str] = None) -> bytes:
-    """Return *image_bytes* with an ``<openbadges:assertion verify=token>``
-    element (and an optional XML comment) appended to the root ``<svg>``."""
+def bake_svg(image_bytes: bytes, token: str, comment: Optional[str] = None, *,
+             element: str = SVG_ELEMENT, namespace: str = SVG_NS) -> bytes:
+    """Return *image_bytes* with an ``<element verify=token>`` node (and an
+    optional XML comment) appended to the root ``<svg>``. *element*/*namespace*
+    default to the OB 2.0 identifiers; OB 3.0 passes its own."""
     svg_doc = parseString(image_bytes)
     try:
         svg_tag = svg_doc.getElementsByTagName('svg').item(0)
-        node = svg_doc.createElement(SVG_ELEMENT)
-        node.attributes['xmlns:openbadges'] = 'http://openbadges.org'
+        node = svg_doc.createElement(element)
+        node.attributes['xmlns:openbadges'] = namespace
         node.attributes['verify'] = token
         svg_tag.appendChild(node)
         if comment:
@@ -83,24 +93,24 @@ def bake_svg(image_bytes: bytes, token: str, comment: Optional[str] = None) -> b
         svg_doc.unlink()
 
 
-def has_svg(image_bytes: bytes) -> bool:
-    """Return True if *image_bytes* already carries an OpenBadges assertion."""
+def has_svg(image_bytes: bytes, *, element: str = SVG_ELEMENT) -> bool:
+    """Return True if *image_bytes* already carries an *element* node."""
     svg_doc = parseString(image_bytes)
     try:
-        return bool(svg_doc.getElementsByTagName(SVG_ELEMENT))
+        return bool(svg_doc.getElementsByTagName(element))
     finally:
         svg_doc.unlink()
 
 
-def extract_svg(image_bytes: bytes) -> Optional[str]:
-    """Return the embedded token string, or None if there is no assertion node.
+def extract_svg(image_bytes: bytes, *, element: str = SVG_ELEMENT) -> Optional[str]:
+    """Return the embedded token string, or None if there is no *element* node.
 
     Raises on malformed XML (left to the caller to map to its own error type).
     """
     svg_doc = None
     try:
         svg_doc = parseString(image_bytes)
-        nodes = svg_doc.getElementsByTagName(SVG_ELEMENT)
+        nodes = svg_doc.getElementsByTagName(element)
         if not nodes:
             return None
         return nodes[0].attributes['verify'].nodeValue
@@ -124,28 +134,31 @@ def _serialize_png(chunks: List[Tuple[Union[str, bytes], bytes]]) -> bytes:
     return out
 
 
-def bake_png(image_bytes: bytes, token: str, text_comment: Optional[str] = None) -> bytes:
-    """Return *image_bytes* with the token stored in an ``openbadges`` iTXt
-    chunk (and an optional ``tEXt`` comment chunk) inserted before IEND."""
+def bake_png(image_bytes: bytes, token: str, text_comment: Optional[str] = None, *,
+             keyword: bytes = ITXT_KEYWORD) -> bytes:
+    """Return *image_bytes* with the token stored in a *keyword* iTXt chunk (and
+    an optional ``tEXt`` comment chunk) inserted before IEND. *keyword* defaults
+    to the OB 2.0 identifier; OB 3.0 passes ``openbadgecredential``."""
     chunks = list(Reader(bytes=image_bytes).chunks())
-    itxt_data = ITXT_KEYWORD + pack('BBBBB', 0, 0, 0, 0, 0) + token.encode('utf-8')
+    itxt_data = keyword + pack('BBBBB', 0, 0, 0, 0, 0) + token.encode('utf-8')
     chunks.insert(len(chunks) - 1, ('iTXt', itxt_data))
     if text_comment:
         chunks.insert(len(chunks) - 1, ('tEXt', text_comment.encode('utf-8')))
     return _serialize_png(chunks)
 
 
-def has_png(image_bytes: bytes) -> bool:
-    """Return True if *image_bytes* already carries an OpenBadges iTXt chunk."""
+def has_png(image_bytes: bytes, *, keyword: bytes = ITXT_KEYWORD) -> bool:
+    """Return True if *image_bytes* already carries a *keyword* iTXt chunk."""
     for tag, data in Reader(bytes=image_bytes).chunks():
         tag_str = tag.decode('ascii') if isinstance(tag, bytes) else tag
-        if tag_str == 'iTXt' and _split_openbadges_itxt(data) is not None:
+        if tag_str == 'iTXt' and _split_openbadges_itxt(data, keyword) is not None:
             return True
     return False
 
 
-def extract_png(image_bytes: bytes, max_decompressed: int = MAX_ITXT_DECOMPRESSED) -> Optional[str]:
-    """Return the embedded token string, or None if there is no openbadges
+def extract_png(image_bytes: bytes, max_decompressed: int = MAX_ITXT_DECOMPRESSED, *,
+                keyword: bytes = ITXT_KEYWORD) -> Optional[str]:
+    """Return the embedded token string, or None if there is no *keyword*
     iTXt chunk.
 
     Parses the iTXt structure (keyword, compression flag/method, language tag,
@@ -159,7 +172,7 @@ def extract_png(image_bytes: bytes, max_decompressed: int = MAX_ITXT_DECOMPRESSE
         if tag_str != 'iTXt':
             continue
 
-        rest = _split_openbadges_itxt(data)
+        rest = _split_openbadges_itxt(data, keyword)
         if rest is None:
             continue
         compression_flag = rest[0]

{openbadgeslib-1.3.0 → openbadgeslib-3.0.0}/openbadgeslib/config.ini.example

@@ -42,6 +42,12 @@ image       = https://www.issuer.badge/issuer/badge_1/badge1.svg
 criteria    = https://www.issuer.badge/issuer/badge_1/criteria.html
 verify_key  = https://www.issuer.badge/issuer/badge_1/verify_rsa_key.pem
 badge       = https://www.issuer.badge/issuer/badge_1/badge.json
+; OpenBadges 2.0 (-V 2): URL of this badge's CryptographicKey JSON-LD document
+; (published by openbadges-publish as <badge>/key.json). Used as verification.creator.
+crypto_key  = https://www.issuer.badge/issuer/badge_1/key.json
+; OpenBadges 2.0 hosted mode (openbadges-signer -V 2 -H): base URL under which
+; per-recipient hosted assertion JSON files are published for verification.
+hosted_assertions_base = https://www.issuer.badge/issuer/badge_1/assertions/
 private_key = ${paths:base_key}/sign_rsa_key_1.pem
 public_key  = ${paths:base_key}/verify_rsa_key_1.pem
 ; key_type selects the algorithm for openbadges-keygenerator: RSA (default), ECC, or ED25519
@@ -58,6 +64,8 @@ image       = https://www.issuer.badge/issuer/badge_2/badge2.svg
 criteria    = https://www.issuer.badge/issuer/badge_2/criteria.html
 verify_key  = https://www.issuer.badge/issuer/badge_2/verify_rsa_key.pem
 badge       = https://www.issuer.badge/issuer/badge_2/badge.json
+crypto_key  = https://www.issuer.badge/issuer/badge_2/key.json
+hosted_assertions_base = https://www.issuer.badge/issuer/badge_2/assertions/
 private_key = ${paths:base_key}/sign_rsa_key_2.pem
 public_key  = ${paths:base_key}/verify_rsa_key_2.pem
 key_type    = RSA

{openbadgeslib-1.3.0 → openbadgeslib-3.0.0}/openbadgeslib/mail.py

@@ -30,7 +30,7 @@ from email.mime.multipart import MIMEMultipart
 from email.mime.text import MIMEText
 from email.utils import formatdate
 from email.header import Header
-from .ob2 import BadgeImgType
+from .ob1 import BadgeImgType
 from .errors import BadgeImgFormatUnsupported
 
 

openbadgeslib-3.0.0/openbadgeslib/ob2/__init__.py

@@ -0,0 +1,41 @@
+"""
+        OpenBadges Library
+
+        Copyright (c) 2014-2026, Luis González Fernández, luisgf@luisgf.es
+        Copyright (c) 2014-2026, Jesús Cea Avión, jcea@jcea.es
+
+        All rights reserved.
+
+        This library is free software; you can redistribute it and/or
+        modify it under the terms of the GNU Lesser General Public
+        License as published by the Free Software Foundation; either
+        version 3.0 of the License, or (at your option) any later version.
+
+        This library is distributed in the hope that it will be useful,
+        but WITHOUT ANY WARRANTY; without even the implied warranty of
+        MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+        Lesser General Public License for more details.
+
+        You should have received a copy of the GNU Lesser General Public
+        License along with this library.
+"""
+
+# Strict OpenBadges 2.0 (JWS-signed / hosted Assertions with conformant
+# JSON-LD Badge Objects). The legacy pre-2.0 format lives in openbadgeslib.ob1.
+
+from .models import (
+    OB2_CONTEXT,
+    Assertion, IdentityObject, Verification,
+    BadgeClass, Profile, CryptographicKey, RevocationList,
+    hash_identity,
+)
+from .signer import OB2Signer
+from .verifier import OB2Verifier, OB2VerificationError
+
+__all__ = [
+    'OB2_CONTEXT',
+    'Assertion', 'IdentityObject', 'Verification',
+    'BadgeClass', 'Profile', 'CryptographicKey', 'RevocationList',
+    'hash_identity',
+    'OB2Signer', 'OB2Verifier', 'OB2VerificationError',
+]