openbadgeslib 2.0.0__tar.gz → 3.0.0__tar.gz

{openbadgeslib-2.0.0 → openbadgeslib-3.0.0}/Changelog.txt

@@ -4,6 +4,45 @@ OpenBadgesLib - Changelog
 Newest first. Dates are ISO 8601 (YYYY-MM-DD).
 
 
+* v3.0.0 - 2026-07-01
+
+  - BREAKING: the pre-2.0 wire format previously shipped as `-V 2` is relabelled
+    OpenBadges 1.0 (`-V 1`) and frozen in the new `openbadgeslib.ob1` package (no
+    @context/type, a `uid`, a `verify` object, string `hashed`, Unix-timestamp
+    dates). `from openbadgeslib.ob2 import Signer/Verifier/Badge` no longer
+    resolves — import from `openbadgeslib.ob1` (the top-level
+    `openbadgeslib.signer` / `verifier` / `badge` shims still work).
+
+  - BREAKING: the default `-V` is now `3` (was `2`) for openbadges-signer,
+    -verifier, -publish and -keygenerator. Pass `-V 2` / `-V 1` explicitly for
+    the older generations.
+
+  - feat(ob2): new strict, spec-conformant Open Badges 2.0 implementation
+    (`openbadgeslib.ob2`). Assertions are valid JSON-LD Badge Objects with
+    `@context`, `type`, an IRI `id` (`urn:uuid:` for signed, the hosting URL for
+    hosted), a boolean `hashed`, ISO 8601 dates, and a `verification` object.
+    New `OB2Signer`, `OB2Verifier`, and dataclasses `Assertion`, `BadgeClass`,
+    `Profile`, `CryptographicKey`, `RevocationList`.
+
+  - feat(ob2): real HostedBadge verification — the assertion is fetched from its
+    own `id` over HTTPS and scope-checked against the issuer origin (default
+    same-origin, or the issuer's `startsWith` / `allowedOrigins`); the baked JWS
+    is non-gating defence-in-depth. Select it with `openbadges-signer -V 2 -H`.
+
+  - feat(ob2): SignedBadge verification resolves `verification.creator` to a
+    published `CryptographicKey` and checks its `owner` / `publicKey` back-link
+    to the issuer Profile.
+
+  - feat(publish): `openbadges-publish -V 2` emits conformant hosted metadata —
+    an issuer Profile with a `publicKey` array, a `BadgeClass` and a
+    `CryptographicKey` (`key.json`) per badge, and a `RevocationList`.
+
+  - feat(config): new optional badge keys `crypto_key` and
+    `hosted_assertions_base` for the OB 2.0 signed / hosted flows.
+
+  - OpenBadges 3.0 is unchanged.
+
+
 * v2.0.0 - 2026-07-01
 
   - BREAKING (OB3): OpenBadges 3.0 credentials are now secured with the native

{openbadgeslib-2.0.0/openbadgeslib.egg-info → openbadgeslib-3.0.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: openbadgeslib
-Version: 2.0.0
+Version: 3.0.0
 Summary: A library to sign and verify OpenBadges
 Author-email: Luis González Fernández <luisgf@luisgf.es>, Jesús Cea Avión <jcea@jcea.es>
 License: LGPLv3
@@ -48,12 +48,13 @@ Dynamic: license-file
 
 A Python library and CLI for signing and verifying
 [Open Badges](https://www.imsglobal.org/activity/digital-badges) embedded in SVG
-and PNG image files. It supports both **OpenBadges 2.0** (JWS compact
-serialisation) and **OpenBadges 3.0** (W3C Verifiable Credentials / JWT-VC).
+and PNG image files. It supports strict **OpenBadges 2.0** (JWS / hosted
+assertions) and **OpenBadges 3.0** (W3C Verifiable Credentials / JWT-VC), plus a
+frozen **OpenBadges 1.0** legacy format — selected with `-V {1,2,3}` (default `3`).
 
 ## Features
 
-- Sign badge images (SVG and PNG) with a JWS assertion (OB 2.0)
+- Sign badge images (SVG and PNG) as strict OB 2.0 JWS / hosted assertions (with a frozen OB 1.0 legacy format)
 - Issue and verify OpenBadges 3.0 JWT-VC credentials
 - Bake OB 3.0 JWT tokens into SVG and PNG badge images
 - RSA 2048-bit (RS256), ECC NIST P-256 (ES256), and Ed25519 (EdDSA) key support
@@ -93,58 +94,52 @@ openbadges-init ./config/
 # 2. Generate a key pair for a badge
 openbadges-keygenerator -c ./config/config.ini -g 1
 
-# 3a. Sign a badge — OpenBadges 2.0 (default)
+# 3a. Sign a badge — OpenBadges 3.0 (default)
 openbadges-signer -c ./config/config.ini -b 1 -r recipient@example.com -o /tmp/ -E
 
-# 3b. Sign a badge — OpenBadges 3.0
-openbadges-signer -c ./config/config.ini -b 1 -r recipient@example.com -o /tmp/ -E -V 3
+# 3b. Sign a badge — strict OpenBadges 2.0
+openbadges-signer -c ./config/config.ini -b 1 -r recipient@example.com -o /tmp/ -E -V 2
 
-# 4a. Verify — OpenBadges 2.0 (pin a trusted key with -l/--local or -k/--pubkey)
+# 4a. Verify — OpenBadges 3.0
 openbadges-verifier -i /tmp/badge_1_recipient@example.com.svg \
-    -r recipient@example.com -l 1
+    -r recipient@example.com -V 3 -k ./config/keys/verify_rsa_key_1.pem
 
-# 4b. Verify — OpenBadges 3.0
+# 4b. Verify — strict OpenBadges 2.0 (pin a trusted key with -l/--local or -k/--pubkey)
 openbadges-verifier -i /tmp/badge_1_recipient@example.com.svg \
-    -r recipient@example.com -V 3 -k ./config/keys/verify_rsa_key_1.pem
+    -r recipient@example.com -V 2 -l 1
 ```
 
 See the [Quick Start](https://github.com/luisgf/openbadgeslib/wiki/Quick-Start)
 and [CLI Reference](https://github.com/luisgf/openbadgeslib/wiki/CLI-Reference)
 wiki pages for the full walkthrough and every flag.
 
-## Using the library — OpenBadges 2.0
+## Using the library — OpenBadges 2.0 (strict)
 
 ```python
-from openbadgeslib.ob2 import Badge, BadgeImgType, BadgeType, Signer
-from openbadgeslib.keys import KeyType
+from datetime import datetime, timezone
+from openbadgeslib.ob2 import OB2Signer, Assertion, IdentityObject, Verification
 
 with open('sign.pem', 'rb') as f:
     priv_pem = f.read()
-with open('verify.pem', 'rb') as f:
-    pub_pem = f.read()
 with open('badge.svg', 'rb') as f:
     image = f.read()
 
-badge = Badge(
-    ini_name='my_badge',
-    name='My Badge',
-    description='Awarded for excellence',
-    image_type=BadgeImgType.SVG,
-    image=image,
-    image_url='https://example.com/badge.svg',
-    criteria_url='https://example.com/criteria.html',
-    json_url='https://example.com/badge.json',
-    verify_key_url='https://example.com/verify.pem',
-    key_type=KeyType.RSA,
-    privkey_pem=priv_pem,
-    pubkey_pem=pub_pem,
+assertion = Assertion(
+    recipient=IdentityObject.create('recipient@example.com', salt='s4lt3d'),
+    badge='https://example.com/badge_1/badge.json',
+    verification=Verification(type='SignedBadge',
+                              creator='https://example.com/badge_1/key.json'),
+    issued_on=datetime(2026, 1, 1, tzinfo=timezone.utc),
 )
 
-signer = Signer(identity='recipient@example.com', badge_type=BadgeType.SIGNED)
-signed = signer.sign_badge(badge)
-signed.save_to_file('/tmp/signed_badge.svg')
+signer = OB2Signer(privkey_pem=priv_pem, algorithm='RS256')
+baked_svg = signer.sign_into_svg(assertion, image)
+with open('/tmp/signed_badge.svg', 'wb') as f:
+    f.write(baked_svg)
 ```
 
+For the frozen OpenBadges 1.0 legacy API (`Badge` / `Signer` / `Verifier`), import from `openbadgeslib.ob1` instead.
+
 ## Using the library — OpenBadges 3.0 (JWT-VC)
 
 ```python

{openbadgeslib-2.0.0 → openbadgeslib-3.0.0}/README.md

@@ -7,12 +7,13 @@
 
 A Python library and CLI for signing and verifying
 [Open Badges](https://www.imsglobal.org/activity/digital-badges) embedded in SVG
-and PNG image files. It supports both **OpenBadges 2.0** (JWS compact
-serialisation) and **OpenBadges 3.0** (W3C Verifiable Credentials / JWT-VC).
+and PNG image files. It supports strict **OpenBadges 2.0** (JWS / hosted
+assertions) and **OpenBadges 3.0** (W3C Verifiable Credentials / JWT-VC), plus a
+frozen **OpenBadges 1.0** legacy format — selected with `-V {1,2,3}` (default `3`).
 
 ## Features
 
-- Sign badge images (SVG and PNG) with a JWS assertion (OB 2.0)
+- Sign badge images (SVG and PNG) as strict OB 2.0 JWS / hosted assertions (with a frozen OB 1.0 legacy format)
 - Issue and verify OpenBadges 3.0 JWT-VC credentials
 - Bake OB 3.0 JWT tokens into SVG and PNG badge images
 - RSA 2048-bit (RS256), ECC NIST P-256 (ES256), and Ed25519 (EdDSA) key support
@@ -52,58 +53,52 @@ openbadges-init ./config/
 # 2. Generate a key pair for a badge
 openbadges-keygenerator -c ./config/config.ini -g 1
 
-# 3a. Sign a badge — OpenBadges 2.0 (default)
+# 3a. Sign a badge — OpenBadges 3.0 (default)
 openbadges-signer -c ./config/config.ini -b 1 -r recipient@example.com -o /tmp/ -E
 
-# 3b. Sign a badge — OpenBadges 3.0
-openbadges-signer -c ./config/config.ini -b 1 -r recipient@example.com -o /tmp/ -E -V 3
+# 3b. Sign a badge — strict OpenBadges 2.0
+openbadges-signer -c ./config/config.ini -b 1 -r recipient@example.com -o /tmp/ -E -V 2
 
-# 4a. Verify — OpenBadges 2.0 (pin a trusted key with -l/--local or -k/--pubkey)
+# 4a. Verify — OpenBadges 3.0
 openbadges-verifier -i /tmp/badge_1_recipient@example.com.svg \
-    -r recipient@example.com -l 1
+    -r recipient@example.com -V 3 -k ./config/keys/verify_rsa_key_1.pem
 
-# 4b. Verify — OpenBadges 3.0
+# 4b. Verify — strict OpenBadges 2.0 (pin a trusted key with -l/--local or -k/--pubkey)
 openbadges-verifier -i /tmp/badge_1_recipient@example.com.svg \
-    -r recipient@example.com -V 3 -k ./config/keys/verify_rsa_key_1.pem
+    -r recipient@example.com -V 2 -l 1
 ```
 
 See the [Quick Start](https://github.com/luisgf/openbadgeslib/wiki/Quick-Start)
 and [CLI Reference](https://github.com/luisgf/openbadgeslib/wiki/CLI-Reference)
 wiki pages for the full walkthrough and every flag.
 
-## Using the library — OpenBadges 2.0
+## Using the library — OpenBadges 2.0 (strict)
 
 ```python
-from openbadgeslib.ob2 import Badge, BadgeImgType, BadgeType, Signer
-from openbadgeslib.keys import KeyType
+from datetime import datetime, timezone
+from openbadgeslib.ob2 import OB2Signer, Assertion, IdentityObject, Verification
 
 with open('sign.pem', 'rb') as f:
     priv_pem = f.read()
-with open('verify.pem', 'rb') as f:
-    pub_pem = f.read()
 with open('badge.svg', 'rb') as f:
     image = f.read()
 
-badge = Badge(
-    ini_name='my_badge',
-    name='My Badge',
-    description='Awarded for excellence',
-    image_type=BadgeImgType.SVG,
-    image=image,
-    image_url='https://example.com/badge.svg',
-    criteria_url='https://example.com/criteria.html',
-    json_url='https://example.com/badge.json',
-    verify_key_url='https://example.com/verify.pem',
-    key_type=KeyType.RSA,
-    privkey_pem=priv_pem,
-    pubkey_pem=pub_pem,
+assertion = Assertion(
+    recipient=IdentityObject.create('recipient@example.com', salt='s4lt3d'),
+    badge='https://example.com/badge_1/badge.json',
+    verification=Verification(type='SignedBadge',
+                              creator='https://example.com/badge_1/key.json'),
+    issued_on=datetime(2026, 1, 1, tzinfo=timezone.utc),
 )
 
-signer = Signer(identity='recipient@example.com', badge_type=BadgeType.SIGNED)
-signed = signer.sign_badge(badge)
-signed.save_to_file('/tmp/signed_badge.svg')
+signer = OB2Signer(privkey_pem=priv_pem, algorithm='RS256')
+baked_svg = signer.sign_into_svg(assertion, image)
+with open('/tmp/signed_badge.svg', 'wb') as f:
+    f.write(baked_svg)
 ```
 
+For the frozen OpenBadges 1.0 legacy API (`Badge` / `Signer` / `Verifier`), import from `openbadgeslib.ob1` instead.
+
 ## Using the library — OpenBadges 3.0 (JWT-VC)
 
 ```python

{openbadgeslib-2.0.0 → openbadgeslib-3.0.0}/openbadgeslib/__init__.py

@@ -21,14 +21,23 @@
         License along with this library.
 """
 
-# ── OpenBadges 2.0 ─────────────────────────────────────────────────────────────
-from .ob2 import (  # noqa: F401
+# ── OpenBadges 1.0 (legacy) ─────────────────────────────────────────────────────
+# The classes formerly exposed as "OpenBadges 2.0" are the pre-2.0 wire format
+# (no @context/type, uid, verify{}, Unix timestamps). They are re-exported here
+# unchanged for backward compatibility; the strict OB 2.0 implementation lives
+# in openbadgeslib.ob2 (OB2Signer/OB2Verifier).
+from .ob1 import (  # noqa: F401
     Signer, Verifier, VerifyInfo,
     Badge, BadgeSigned, Assertion,
     BadgeStatus, BadgeImgType, BadgeType,
     extract_svg_assertion, extract_png_assertion,
 )
 
+# ── OpenBadges 2.0 (strict) ──────────────────────────────────────────────────
+from .ob2 import (  # noqa: F401
+    OB2Signer, OB2Verifier, OB2VerificationError,
+)
+
 # ── OpenBadges 3.0 ─────────────────────────────────────────────────────────────
 from .ob3 import (  # noqa: F401
     OB3Signer, OB3Verifier, OB3VerificationError,

{openbadgeslib-2.0.0 → openbadgeslib-3.0.0}/openbadgeslib/badge.py

@@ -1,5 +1,5 @@
-"""OpenBadges 2.0 badge objects — compatibility shim, re-exports from openbadgeslib.ob2."""
-from .ob2.badge import (
+"""OpenBadges 1.0 (legacy) badge objects — compatibility shim, re-exports from openbadgeslib.ob1."""
+from .ob1.badge import (
     BadgeStatus, BadgeImgType, BadgeType,
     Assertion, Badge, BadgeSigned,
     extract_svg_assertion, extract_png_assertion,

{openbadgeslib-2.0.0 → openbadgeslib-3.0.0}/openbadgeslib/config.ini.example

@@ -42,6 +42,12 @@ image       = https://www.issuer.badge/issuer/badge_1/badge1.svg
 criteria    = https://www.issuer.badge/issuer/badge_1/criteria.html
 verify_key  = https://www.issuer.badge/issuer/badge_1/verify_rsa_key.pem
 badge       = https://www.issuer.badge/issuer/badge_1/badge.json
+; OpenBadges 2.0 (-V 2): URL of this badge's CryptographicKey JSON-LD document
+; (published by openbadges-publish as <badge>/key.json). Used as verification.creator.
+crypto_key  = https://www.issuer.badge/issuer/badge_1/key.json
+; OpenBadges 2.0 hosted mode (openbadges-signer -V 2 -H): base URL under which
+; per-recipient hosted assertion JSON files are published for verification.
+hosted_assertions_base = https://www.issuer.badge/issuer/badge_1/assertions/
 private_key = ${paths:base_key}/sign_rsa_key_1.pem
 public_key  = ${paths:base_key}/verify_rsa_key_1.pem
 ; key_type selects the algorithm for openbadges-keygenerator: RSA (default), ECC, or ED25519
@@ -58,6 +64,8 @@ image       = https://www.issuer.badge/issuer/badge_2/badge2.svg
 criteria    = https://www.issuer.badge/issuer/badge_2/criteria.html
 verify_key  = https://www.issuer.badge/issuer/badge_2/verify_rsa_key.pem
 badge       = https://www.issuer.badge/issuer/badge_2/badge.json
+crypto_key  = https://www.issuer.badge/issuer/badge_2/key.json
+hosted_assertions_base = https://www.issuer.badge/issuer/badge_2/assertions/
 private_key = ${paths:base_key}/sign_rsa_key_2.pem
 public_key  = ${paths:base_key}/verify_rsa_key_2.pem
 key_type    = RSA

{openbadgeslib-2.0.0 → openbadgeslib-3.0.0}/openbadgeslib/mail.py

@@ -30,7 +30,7 @@ from email.mime.multipart import MIMEMultipart
 from email.mime.text import MIMEText
 from email.utils import formatdate
 from email.header import Header
-from .ob2 import BadgeImgType
+from .ob1 import BadgeImgType
 from .errors import BadgeImgFormatUnsupported
 
 

openbadgeslib-3.0.0/openbadgeslib/ob2/__init__.py

@@ -0,0 +1,41 @@
+"""
+        OpenBadges Library
+
+        Copyright (c) 2014-2026, Luis González Fernández, luisgf@luisgf.es
+        Copyright (c) 2014-2026, Jesús Cea Avión, jcea@jcea.es
+
+        All rights reserved.
+
+        This library is free software; you can redistribute it and/or
+        modify it under the terms of the GNU Lesser General Public
+        License as published by the Free Software Foundation; either
+        version 3.0 of the License, or (at your option) any later version.
+
+        This library is distributed in the hope that it will be useful,
+        but WITHOUT ANY WARRANTY; without even the implied warranty of
+        MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+        Lesser General Public License for more details.
+
+        You should have received a copy of the GNU Lesser General Public
+        License along with this library.
+"""
+
+# Strict OpenBadges 2.0 (JWS-signed / hosted Assertions with conformant
+# JSON-LD Badge Objects). The legacy pre-2.0 format lives in openbadgeslib.ob1.
+
+from .models import (
+    OB2_CONTEXT,
+    Assertion, IdentityObject, Verification,
+    BadgeClass, Profile, CryptographicKey, RevocationList,
+    hash_identity,
+)
+from .signer import OB2Signer
+from .verifier import OB2Verifier, OB2VerificationError
+
+__all__ = [
+    'OB2_CONTEXT',
+    'Assertion', 'IdentityObject', 'Verification',
+    'BadgeClass', 'Profile', 'CryptographicKey', 'RevocationList',
+    'hash_identity',
+    'OB2Signer', 'OB2Verifier', 'OB2VerificationError',
+]