openbadgeslib 3.1.1__tar.gz → 3.3.0__tar.gz

{openbadgeslib-3.1.1 → openbadgeslib-3.3.0}/Changelog.txt

@@ -4,6 +4,69 @@ OpenBadgesLib - Changelog
 Newest first. Dates are ISO 8601 (YYYY-MM-DD).
 
 
+* v3.3.0 - 2026-07-04
+
+  - feat(ob3): issuance of OB 3.0 credentials secured with a W3C Data
+    Integrity proof (eddsa-rdfc-2022) — new `OB3LdpSigner` and low-level
+    `add_data_integrity_proof`, the signing counterparts of the verifiers
+    shipped in 3.2.0, sharing their canonicalization core and reproducing
+    the official W3C vc-di-eddsa test vector byte for byte. Ed25519 keys
+    only; requires the `[ldp]` extra, which now covers both directions.
+
+  - feat(cli): `openbadges-signer -P/--proof-format {vc-jwt,ldp}` (OB3
+    only) plus an optional per-badge `proof_format` config key (flag wins;
+    default vc-jwt). With `[issuer] did` configured the proof names the
+    `did:web:...#badge_N` verification method `openbadges-publish -V 3`
+    publishes (trusted via `--resolve-did`); otherwise it falls back to a
+    self-asserted did:key derived from the signing key and tells the
+    operator so. LDP-signed badges are tagged `PROOF ldp` in the signer
+    audit log. Status lists stay VC-JWT regardless of the badge's proof
+    format.
+
+  - feat(ob3): multikey/did:key encoders in `ob3.did` —
+    `multikey_from_pem` (publicKeyMultibase) and `did_key_from_pem`,
+    the exact inverses of the resolvers, for Ed25519 and NIST P-256.
+
+  - fix(cli): `Badge.create_from_conf` rejected `key_type = ED25519`
+    outright, so the CLI could never sign with the keys
+    `openbadges-keygenerator -t ED25519` produces; Ed25519 key material
+    now loads, and the legacy OB 1.0 path (`-V 1`) refuses non-RSA/ECC
+    keys with a clean message instead of failing mid-JWS.
+
+
+* v3.2.0 - 2026-07-03
+
+  - feat(ob3): verification of OB 3.0 credentials secured with a W3C Data
+    Integrity proof (the Linked Data Proof format), cryptosuite
+    eddsa-rdfc-2022 — new `OB3LdpVerifier` and low-level
+    `verify_data_integrity_proof`, validated against the official W3C
+    vc-di-eddsa test vectors. Verify-only: issuing stays JWT-VC. Requires
+    the new optional extra: `pip install "openbadgeslib[ldp]"` (pyld);
+    everything else works without it.
+
+  - feat(ob3): JSON-LD @context documents are never fetched from the
+    network — the exact context files ship pinned inside the wheel behind
+    an exact-match allowlist (fail-closed on unknown contexts), and Data
+    Integrity documents are capped at 256 KiB before canonicalization.
+
+  - feat(ob3): `resolve_verification_method` resolves the exact
+    verificationMethod URL a proof names (did:key fragment validation;
+    did:web entry selected by id, fail-closed on no match).
+
+  - feat(baking): OB 3.0 §5.3 text-content carrier for Data Integrity
+    credentials — `bake_svg(..., as_text=True)` and an opt-in
+    `extract_svg(..., text_fallback=True)`; the OB3 extraction returns
+    either a compact JWT or the credential JSON. PNG needed no change.
+
+  - feat(cli): `openbadges-verifier -V 3` autodetects the baked payload
+    (JWT-VC vs Data Integrity) with the same trust flags, reports
+    `proof_format` in `--json`, and hints at the missing `[ldp]` extra.
+
+  - feat(api): `OpenBadgeCredential.from_vc_document` reconstructs a
+    credential from its JSON-LD document shape (same validation as the
+    JWT payload path).
+
+
 * v3.1.1 - 2026-07-03
 
   - docs(packaging): discoverability metadata — a descriptive PyPI summary,

{openbadgeslib-3.1.1/openbadgeslib.egg-info → openbadgeslib-3.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: openbadgeslib
-Version: 3.1.1
+Version: 3.3.0
 Summary: Production-ready Python library & CLI for Open Badges 3.0 (W3C Verifiable Credentials): issue, verify, and revoke JWT-VC credentials with Bitstring Status Lists and did:web — plus strict OB 2.0 and legacy OB 1.0.
 Author-email: Luis González Fernández <luisgf@luisgf.es>, Jesús Cea Avión <jcea@jcea.es>
 License: LGPLv3
@@ -9,7 +9,7 @@ Project-URL: Documentation, https://github.com/luisgf/openbadgeslib/wiki
 Project-URL: API Reference, https://luisgf.github.io/openbadgeslib/
 Project-URL: Source, https://github.com/luisgf/openbadgeslib
 Project-URL: Changelog, https://github.com/luisgf/openbadgeslib/blob/master/Changelog.txt
-Keywords: openbadges,open-badges,verifiable-credentials,vc-jwt,w3c-vc,digital-credentials,did,did-web,bitstring-status-list,revocation,ob3,credentials,ed25519,cryptography
+Keywords: openbadges,open-badges,verifiable-credentials,vc-jwt,w3c-vc,digital-credentials,did,did-web,bitstring-status-list,revocation,ob3,credentials,ed25519,cryptography,data-integrity,eddsa
 Classifier: Development Status :: 5 - Production/Stable
 Classifier: Intended Audience :: Developers
 Classifier: Intended Audience :: Education
@@ -34,6 +34,8 @@ Requires-Dist: pypng>=0.20220715.0
 Requires-Dist: PyJWT[crypto]>=2.8
 Requires-Dist: cryptography>=42
 Requires-Dist: defusedxml>=0.7
+Provides-Extra: ldp
+Requires-Dist: pyld>=2.0.4; extra == "ldp"
 Provides-Extra: dev
 Requires-Dist: pytest>=8.0; extra == "dev"
 Requires-Dist: pytest-cov>=5.0; extra == "dev"
@@ -52,7 +54,8 @@ Dynamic: license-file
 
 **A production-ready Python library & CLI for the full Open Badges 3.0 issuer
 lifecycle** — issue [W3C Verifiable Credentials](https://www.w3.org/TR/vc-data-model-2.0/)
-as JWT-VC, bake them into SVG/PNG, verify them, and **revoke or suspend** them
+as JWT-VC or W3C Data Integrity (LDP) proofs, bake them into SVG/PNG, verify them,
+and **revoke or suspend** them
 with W3C Bitstring Status Lists and `did:web`. It also ships strict
 **OpenBadges 2.0** (JWS / hosted assertions) and a frozen **OpenBadges 1.0**
 legacy format, selected with `-V {1,2,3}` (default `3`).
@@ -61,12 +64,14 @@ legacy format, selected with `-V {1,2,3}` (default `3`).
 
 - Sign badge images (SVG and PNG) as strict OB 2.0 JWS / hosted assertions (with a frozen OB 1.0 legacy format)
 - Issue and verify OpenBadges 3.0 JWT-VC credentials
-- Bake OB 3.0 JWT tokens into SVG and PNG badge images
+- Bake OB 3.0 credentials (JWT-VC or Data Integrity JSON-LD) into SVG and PNG badge images
 - RSA 2048-bit (RS256), ECC NIST P-256 (ES256), and Ed25519 (EdDSA) key support
 - SHA-256 hashed recipient identity with salt (OB 2.0)
 - Expiration and revocation checking
 - Issuer-side OB 3.0 revocation and suspension: W3C Bitstring Status List
   publication and `--revoke` / `--suspend` / `--unsuspend` management
+- Issue and verify OB 3.0 W3C Data Integrity credentials (`eddsa-rdfc-2022`,
+  optional `[ldp]` extra) in addition to JWT-VC
 - did:web issuer identity: `did.json` generation and DID resolution
 - Five command-line tools included
 
@@ -75,8 +80,10 @@ legacy format, selected with `-V {1,2,3}` (default `3`).
 - **The complete OB 3.0 issuer lifecycle in Python** — not just issuing, but
   publishing trust artefacts (`did:web`) and revoking/suspending credentials via
   Bitstring Status Lists, driven from the CLI or the library.
-- **Native VC-JWT** signing with RSA (RS256), ECC P-256 (ES256) and Ed25519
-  (EdDSA), and offline verification.
+- **Native VC-JWT signing** with RSA (RS256), ECC P-256 (ES256) and Ed25519
+  (EdDSA) — *plus* native **W3C Data Integrity / LDP** signing
+  (`eddsa-rdfc-2022`, Ed25519, optional `[ldp]` extra). Both proof formats
+  issue *and* verify offline, no external service.
 - **Lean and typed** — `mypy --strict`, CI on Python 3.10–3.13, a small
   dependency set, dataclasses + explicit validation (no Pydantic).
 - **Dual-licensed** LGPLv3 (library) / BSD-2-Clause (CLI tools).
@@ -84,23 +91,39 @@ legacy format, selected with `-V {1,2,3}` (default `3`).
 ### How it compares
 
 Best-effort comparison from each project's public documentation as of July 2026;
-"not documented" is shown as `—`. Corrections welcome via issue/PR.
-
-| Capability | **openbadgeslib** | [PyOpenBadges](https://github.com/CoopCodeCommun/pyopenbadges) |
-| --- | --- | --- |
-| Open Badges versions | 1.0, 2.0, **3.0** | 3.0 (v2→v3 planned) |
-| OB 3.0 proof: VC-JWT (JOSE) | ✅ RS/ES/EdDSA | roadmap |
-| OB 3.0 proof: Data Integrity / LDP | — (verify-first, planned) | JSON-LD signing (format unspecified) |
-| Revocation / suspension (Bitstring Status List) | ✅ issue + publish + manage | — |
-| `did:web` (generate + resolve) | ✅ | — |
-| Image baking (SVG + PNG) | ✅ | roadmap |
-| Command-line tools | ✅ 5 tools | — |
-| Typing / CI | `mypy --strict`, CI 3.10–3.13 | — |
-| Validation | dataclasses + explicit checks | Pydantic |
-
-For OB 2.0 validation the reference implementation is 1EdTech's Node
-[`openbadges-validator`](https://github.com/1EdTech/openbadges-validator); this
-table focuses on the OB 3.0 Python landscape.
+"not documented" is shown as `—`. Corrections welcome via issue/PR. The Python
+Open Badges landscape splits into three groups: 1EdTech's **verify-only** OB 2.0
+reference validator, heavyweight **Django server platforms** (the Badgr lineage),
+and a thin tail of **standalone libraries** — of which openbadgeslib is the only
+actively-maintained, pip-installable, offline one that covers all three OB
+versions and both OB 3.0 proof formats.
+
+| Capability | **openbadgeslib** | [validator-core](https://github.com/1EdTech/openbadges-validator-core) | [Badgr / mint-o-badges](https://github.com/mint-o-badges/badgr-server) (a) | [pyopenbadges](https://github.com/CoopCodeCommun/pyopenbadges) | [didkit](https://github.com/spruceid/didkit-python) (b) |
+| --- | --- | --- | --- | --- | --- |
+| Open Badges versions | 1.0, 2.0, **3.0** | 0.5–2.0 | 1.1, 2.0, 3.0 | 3.0 only | generic VC |
+| Issue / verify | ✅ both | verify only | issue; partial verify | both | both (VC + VP) |
+| OB 3.0 proof: VC-JWT (JOSE) | ✅ RS/ES/EdDSA | — | — | roadmap | ✅ not OB-aware |
+| OB 3.0 proof: Data Integrity / LDP | ✅ issue + verify (`eddsa-rdfc-2022`) | — | issue only (Ed25519) | home-grown, non-conformant | older suites; no `rdfc-2022` in wheel |
+| Revocation / suspension | ✅ W3C Bitstring Status List | hosted check | `1EdTechRevocationList` | ad-hoc flag | — |
+| `did:web` (generate + resolve) | ✅ | — | — | — | resolve only |
+| Image baking (SVG + PNG) | ✅ | unbake only | ✅ | — | — |
+| Form factor | library + 5 CLI tools | library + CLI | Django server | library | binding |
+| Typing / CI | `mypy --strict`, CI 3.10–3.13 | — | — | Pydantic | — |
+| License | LGPLv3 / BSD-2 | Apache-2.0 | AGPL-3.0 | MIT/LGPL | Apache-2.0 |
+
+(a) The actively-maintained community fork (open-educational-badges): it
+genuinely issues OB 3.0 Data Integrity credentials, but only as a server (not a
+pip library) and only with Ed25519 (no VC-JWT). The classic Concentric Sky
+`badgr-server` is OB 2.0 and its canonical repo is gone; SURF's
+`edubadges-server` delegates OB 3.0 signing to external agents.
+(b) Generic W3C VC/DID toolkit (Rust `ssi` bindings), not Open Badges-aware, and
+archived (read-only since July 2025).
+
+For authoritative OB 2.0 *validation* semantics, 1EdTech's Python
+[`openbadges-validator-core`](https://github.com/1EdTech/openbadges-validator-core)
+and Node [`openbadges-validator`](https://github.com/1EdTech/openbadges-validator)
+remain the reference; openbadgeslib focuses on the full issuer lifecycle across
+all three OB versions.
 
 ## Requirements
 
@@ -187,7 +210,15 @@ with open('/tmp/signed_badge.svg', 'wb') as f:
 
 For the frozen OpenBadges 1.0 legacy API (`Badge` / `Signer` / `Verifier`), import from `openbadgeslib.ob1` instead.
 
-## Using the library — OpenBadges 3.0 (JWT-VC)
+## Using the library — OpenBadges 3.0
+
+OB 3.0 credentials can be secured with either of the two proof formats the
+spec allows: a compact **VC-JWT** (`OB3Signer`, RS256/ES256/EdDSA) or an
+embedded **Data Integrity** proof (`OB3LdpSigner`, cryptosuite
+`eddsa-rdfc-2022`, Ed25519 only — needs the `[ldp]` extra). Both bake into
+the same SVG/PNG carriers and the verifier auto-detects the format.
+
+### VC-JWT (JOSE)
 
 ```python
 from openbadgeslib.ob3 import (
@@ -223,6 +254,35 @@ restored = verifier.verify(token, expected_recipient='recipient@example.com')
 print('Recipient:', restored.recipient_id)
 ```
 
+### Data Integrity (LDP)
+
+Same credential, an embedded JSON-LD proof instead of a JWT. Requires an
+Ed25519 signing key and the `[ldp]` extra (`pip install openbadgeslib[ldp]`).
+Reuse the `credential` built above:
+
+```python
+from openbadgeslib.ob3 import OB3LdpSigner, OB3LdpVerifier
+
+with open('sign_ed25519.pem', 'rb') as f:
+    priv_pem = f.read()
+
+# Bake a credential carrying an eddsa-rdfc-2022 DataIntegrityProof into an SVG
+signer = OB3LdpSigner(priv_pem)
+with open('badge.svg', 'rb') as f:
+    baked_svg = signer.sign_into_svg(credential, f.read())
+
+# Verify (the LDP credential travels as JSON in the baked image)
+with open('verify_ed25519.pem', 'rb') as f:
+    verifier = OB3LdpVerifier(pubkey_pem=f.read())
+document = OB3Verifier.extract_token_from_svg(baked_svg)
+restored = verifier.verify(document, expected_recipient='recipient@example.com')
+print('Recipient:', restored.recipient_id)
+```
+
+From the CLI, select the format with `openbadges-signer -P ldp` (OB 3.0 only),
+or set `proof_format = ldp` in the badge's INI section; the default stays
+`vc-jwt`. Status lists remain VC-JWT regardless of the badge's proof format.
+
 ## Documentation
 
 - **User & developer guide** — the project [**Wiki**](https://github.com/luisgf/openbadgeslib/wiki):

{openbadgeslib-3.1.1 → openbadgeslib-3.3.0}/README.md

@@ -7,7 +7,8 @@
 
 **A production-ready Python library & CLI for the full Open Badges 3.0 issuer
 lifecycle** — issue [W3C Verifiable Credentials](https://www.w3.org/TR/vc-data-model-2.0/)
-as JWT-VC, bake them into SVG/PNG, verify them, and **revoke or suspend** them
+as JWT-VC or W3C Data Integrity (LDP) proofs, bake them into SVG/PNG, verify them,
+and **revoke or suspend** them
 with W3C Bitstring Status Lists and `did:web`. It also ships strict
 **OpenBadges 2.0** (JWS / hosted assertions) and a frozen **OpenBadges 1.0**
 legacy format, selected with `-V {1,2,3}` (default `3`).
@@ -16,12 +17,14 @@ legacy format, selected with `-V {1,2,3}` (default `3`).
 
 - Sign badge images (SVG and PNG) as strict OB 2.0 JWS / hosted assertions (with a frozen OB 1.0 legacy format)
 - Issue and verify OpenBadges 3.0 JWT-VC credentials
-- Bake OB 3.0 JWT tokens into SVG and PNG badge images
+- Bake OB 3.0 credentials (JWT-VC or Data Integrity JSON-LD) into SVG and PNG badge images
 - RSA 2048-bit (RS256), ECC NIST P-256 (ES256), and Ed25519 (EdDSA) key support
 - SHA-256 hashed recipient identity with salt (OB 2.0)
 - Expiration and revocation checking
 - Issuer-side OB 3.0 revocation and suspension: W3C Bitstring Status List
   publication and `--revoke` / `--suspend` / `--unsuspend` management
+- Issue and verify OB 3.0 W3C Data Integrity credentials (`eddsa-rdfc-2022`,
+  optional `[ldp]` extra) in addition to JWT-VC
 - did:web issuer identity: `did.json` generation and DID resolution
 - Five command-line tools included
 
@@ -30,8 +33,10 @@ legacy format, selected with `-V {1,2,3}` (default `3`).
 - **The complete OB 3.0 issuer lifecycle in Python** — not just issuing, but
   publishing trust artefacts (`did:web`) and revoking/suspending credentials via
   Bitstring Status Lists, driven from the CLI or the library.
-- **Native VC-JWT** signing with RSA (RS256), ECC P-256 (ES256) and Ed25519
-  (EdDSA), and offline verification.
+- **Native VC-JWT signing** with RSA (RS256), ECC P-256 (ES256) and Ed25519
+  (EdDSA) — *plus* native **W3C Data Integrity / LDP** signing
+  (`eddsa-rdfc-2022`, Ed25519, optional `[ldp]` extra). Both proof formats
+  issue *and* verify offline, no external service.
 - **Lean and typed** — `mypy --strict`, CI on Python 3.10–3.13, a small
   dependency set, dataclasses + explicit validation (no Pydantic).
 - **Dual-licensed** LGPLv3 (library) / BSD-2-Clause (CLI tools).
@@ -39,23 +44,39 @@ legacy format, selected with `-V {1,2,3}` (default `3`).
 ### How it compares
 
 Best-effort comparison from each project's public documentation as of July 2026;
-"not documented" is shown as `—`. Corrections welcome via issue/PR.
-
-| Capability | **openbadgeslib** | [PyOpenBadges](https://github.com/CoopCodeCommun/pyopenbadges) |
-| --- | --- | --- |
-| Open Badges versions | 1.0, 2.0, **3.0** | 3.0 (v2→v3 planned) |
-| OB 3.0 proof: VC-JWT (JOSE) | ✅ RS/ES/EdDSA | roadmap |
-| OB 3.0 proof: Data Integrity / LDP | — (verify-first, planned) | JSON-LD signing (format unspecified) |
-| Revocation / suspension (Bitstring Status List) | ✅ issue + publish + manage | — |
-| `did:web` (generate + resolve) | ✅ | — |
-| Image baking (SVG + PNG) | ✅ | roadmap |
-| Command-line tools | ✅ 5 tools | — |
-| Typing / CI | `mypy --strict`, CI 3.10–3.13 | — |
-| Validation | dataclasses + explicit checks | Pydantic |
-
-For OB 2.0 validation the reference implementation is 1EdTech's Node
-[`openbadges-validator`](https://github.com/1EdTech/openbadges-validator); this
-table focuses on the OB 3.0 Python landscape.
+"not documented" is shown as `—`. Corrections welcome via issue/PR. The Python
+Open Badges landscape splits into three groups: 1EdTech's **verify-only** OB 2.0
+reference validator, heavyweight **Django server platforms** (the Badgr lineage),
+and a thin tail of **standalone libraries** — of which openbadgeslib is the only
+actively-maintained, pip-installable, offline one that covers all three OB
+versions and both OB 3.0 proof formats.
+
+| Capability | **openbadgeslib** | [validator-core](https://github.com/1EdTech/openbadges-validator-core) | [Badgr / mint-o-badges](https://github.com/mint-o-badges/badgr-server) (a) | [pyopenbadges](https://github.com/CoopCodeCommun/pyopenbadges) | [didkit](https://github.com/spruceid/didkit-python) (b) |
+| --- | --- | --- | --- | --- | --- |
+| Open Badges versions | 1.0, 2.0, **3.0** | 0.5–2.0 | 1.1, 2.0, 3.0 | 3.0 only | generic VC |
+| Issue / verify | ✅ both | verify only | issue; partial verify | both | both (VC + VP) |
+| OB 3.0 proof: VC-JWT (JOSE) | ✅ RS/ES/EdDSA | — | — | roadmap | ✅ not OB-aware |
+| OB 3.0 proof: Data Integrity / LDP | ✅ issue + verify (`eddsa-rdfc-2022`) | — | issue only (Ed25519) | home-grown, non-conformant | older suites; no `rdfc-2022` in wheel |
+| Revocation / suspension | ✅ W3C Bitstring Status List | hosted check | `1EdTechRevocationList` | ad-hoc flag | — |
+| `did:web` (generate + resolve) | ✅ | — | — | — | resolve only |
+| Image baking (SVG + PNG) | ✅ | unbake only | ✅ | — | — |
+| Form factor | library + 5 CLI tools | library + CLI | Django server | library | binding |
+| Typing / CI | `mypy --strict`, CI 3.10–3.13 | — | — | Pydantic | — |
+| License | LGPLv3 / BSD-2 | Apache-2.0 | AGPL-3.0 | MIT/LGPL | Apache-2.0 |
+
+(a) The actively-maintained community fork (open-educational-badges): it
+genuinely issues OB 3.0 Data Integrity credentials, but only as a server (not a
+pip library) and only with Ed25519 (no VC-JWT). The classic Concentric Sky
+`badgr-server` is OB 2.0 and its canonical repo is gone; SURF's
+`edubadges-server` delegates OB 3.0 signing to external agents.
+(b) Generic W3C VC/DID toolkit (Rust `ssi` bindings), not Open Badges-aware, and
+archived (read-only since July 2025).
+
+For authoritative OB 2.0 *validation* semantics, 1EdTech's Python
+[`openbadges-validator-core`](https://github.com/1EdTech/openbadges-validator-core)
+and Node [`openbadges-validator`](https://github.com/1EdTech/openbadges-validator)
+remain the reference; openbadgeslib focuses on the full issuer lifecycle across
+all three OB versions.
 
 ## Requirements
 
@@ -142,7 +163,15 @@ with open('/tmp/signed_badge.svg', 'wb') as f:
 
 For the frozen OpenBadges 1.0 legacy API (`Badge` / `Signer` / `Verifier`), import from `openbadgeslib.ob1` instead.
 
-## Using the library — OpenBadges 3.0 (JWT-VC)
+## Using the library — OpenBadges 3.0
+
+OB 3.0 credentials can be secured with either of the two proof formats the
+spec allows: a compact **VC-JWT** (`OB3Signer`, RS256/ES256/EdDSA) or an
+embedded **Data Integrity** proof (`OB3LdpSigner`, cryptosuite
+`eddsa-rdfc-2022`, Ed25519 only — needs the `[ldp]` extra). Both bake into
+the same SVG/PNG carriers and the verifier auto-detects the format.
+
+### VC-JWT (JOSE)
 
 ```python
 from openbadgeslib.ob3 import (
@@ -178,6 +207,35 @@ restored = verifier.verify(token, expected_recipient='recipient@example.com')
 print('Recipient:', restored.recipient_id)
 ```
 
+### Data Integrity (LDP)
+
+Same credential, an embedded JSON-LD proof instead of a JWT. Requires an
+Ed25519 signing key and the `[ldp]` extra (`pip install openbadgeslib[ldp]`).
+Reuse the `credential` built above:
+
+```python
+from openbadgeslib.ob3 import OB3LdpSigner, OB3LdpVerifier
+
+with open('sign_ed25519.pem', 'rb') as f:
+    priv_pem = f.read()
+
+# Bake a credential carrying an eddsa-rdfc-2022 DataIntegrityProof into an SVG
+signer = OB3LdpSigner(priv_pem)
+with open('badge.svg', 'rb') as f:
+    baked_svg = signer.sign_into_svg(credential, f.read())
+
+# Verify (the LDP credential travels as JSON in the baked image)
+with open('verify_ed25519.pem', 'rb') as f:
+    verifier = OB3LdpVerifier(pubkey_pem=f.read())
+document = OB3Verifier.extract_token_from_svg(baked_svg)
+restored = verifier.verify(document, expected_recipient='recipient@example.com')
+print('Recipient:', restored.recipient_id)
+```
+
+From the CLI, select the format with `openbadges-signer -P ldp` (OB 3.0 only),
+or set `proof_format = ldp` in the badge's INI section; the default stays
+`vc-jwt`. Status lists remain VC-JWT regardless of the badge's proof format.
+
 ## Documentation
 
 - **User & developer guide** — the project [**Wiki**](https://github.com/luisgf/openbadgeslib/wiki):

{openbadgeslib-3.1.1 → openbadgeslib-3.3.0}/openbadgeslib/baking.py

@@ -75,16 +75,26 @@ def _bounded_inflate(data: bytes, limit: int = MAX_ITXT_DECOMPRESSED) -> bytes:
 # ── SVG ─────────────────────────────────────────────────────────────────────
 
 def bake_svg(image_bytes: bytes, token: str, comment: Optional[str] = None, *,
-             element: str = SVG_ELEMENT, namespace: str = SVG_NS) -> bytes:
+             element: str = SVG_ELEMENT, namespace: str = SVG_NS,
+             as_text: bool = False) -> bytes:
     """Return *image_bytes* with an ``<element verify=token>`` node (and an
     optional XML comment) appended to the root ``<svg>``. *element*/*namespace*
-    default to the OB 2.0 identifiers; OB 3.0 passes its own."""
+    default to the OB 2.0 identifiers; OB 3.0 passes its own.
+
+    With ``as_text=True`` the token is stored as the element's text content
+    instead of the ``verify`` attribute — the OB 3.0 carrier for credentials
+    secured with a Data Integrity proof, whose payload is a JSON document
+    rather than a compact JWT (OB 3.0 §5.3).
+    """
     svg_doc = parseString(image_bytes)
     try:
         svg_tag = svg_doc.getElementsByTagName('svg').item(0)
         node = svg_doc.createElement(element)
         node.attributes['xmlns:openbadges'] = namespace
-        node.attributes['verify'] = token
+        if as_text:
+            node.appendChild(svg_doc.createTextNode(token))
+        else:
+            node.attributes['verify'] = token
         svg_tag.appendChild(node)
         if comment:
             svg_tag.appendChild(svg_doc.createComment(comment))
@@ -102,12 +112,18 @@ def has_svg(image_bytes: bytes, *, element: str = SVG_ELEMENT) -> bool:
         svg_doc.unlink()
 
 
-def extract_svg(image_bytes: bytes, *, element: str = SVG_ELEMENT) -> Optional[str]:
+def extract_svg(image_bytes: bytes, *, element: str = SVG_ELEMENT,
+                text_fallback: bool = False) -> Optional[str]:
     """Return the embedded token string, or None if the badge carries no token.
 
     None covers both a missing *element* node and a present element with no
     ``verify`` attribute (a well-formed SVG that simply isn't a signed badge).
     Malformed XML still raises (left to the caller to map to its own error type).
+
+    With ``text_fallback=True``, an element without a ``verify`` attribute
+    falls back to its text content — where OB 3.0 §5.3 bakes a credential
+    secured with a Data Integrity proof (a JSON document, not a compact JWT).
+    An empty/whitespace-only text content still yields None.
     """
     svg_doc = None
     try:
@@ -116,7 +132,15 @@ def extract_svg(image_bytes: bytes, *, element: str = SVG_ELEMENT) -> Optional[s
         if not nodes:
             return None
         attrs = nodes[0].attributes
-        return attrs['verify'].nodeValue if 'verify' in attrs else None
+        if 'verify' in attrs:
+            return attrs['verify'].nodeValue
+        if not text_fallback:
+            return None
+        text = ''.join(
+            child.data for child in nodes[0].childNodes
+            if child.nodeType in (child.TEXT_NODE, child.CDATA_SECTION_NODE)
+        ).strip()
+        return text or None
     finally:
         if svg_doc is not None:
             svg_doc.unlink()

{openbadgeslib-3.1.1 → openbadgeslib-3.3.0}/openbadgeslib/config.ini.example

@@ -58,6 +58,10 @@ private_key = ${paths:base_key}/sign_rsa_key_1.pem
 public_key  = ${paths:base_key}/verify_rsa_key_1.pem
 ; key_type selects the algorithm for openbadges-keygenerator: RSA (default), ECC, or ED25519
 key_type    = RSA
+; OpenBadges 3.0 proof format: vc-jwt (compact JWT-VC, the default) or ldp
+; (embedded W3C Data Integrity proof, cryptosuite eddsa-rdfc-2022). ldp needs
+; key_type = ED25519 and the [ldp] extra (pip install openbadgeslib[ldp]).
+;proof_format = vc-jwt
 ; OpenBadges 3.0 credential status (opt-in). When set, openbadges-signer -V 3
 ; attaches credentialStatus entries for these purposes (comma-separated subset
 ; of: revocation, suspension) and openbadges-publish -V 3 generates the signed

{openbadgeslib-3.1.1 → openbadgeslib-3.3.0}/openbadgeslib/confparser.py

@@ -79,6 +79,25 @@ def ob3_issuer_id(conf: ConfigParser) -> str:
         "[issuer] did must be 'auto' or a did:... identifier, got %r" % did)
 
 
+#: Proof formats an OB3 credential can be issued with — the same vocabulary
+#: openbadges-verifier reports in its JSON output.
+OB3_PROOF_FORMATS = ('vc-jwt', 'ldp')
+
+
+def ob3_proof_format(conf: ConfigParser, badge_section: str) -> str:
+    """Return the proof format OB3 credentials of *badge_section* use:
+    ``vc-jwt`` (compact JWT-VC, the default) or ``ldp`` (embedded Data
+    Integrity proof, cryptosuite eddsa-rdfc-2022 — needs an Ed25519 key and
+    the [ldp] extra). Raises ValueError for anything else.
+    """
+    value = (conf[badge_section].get('proof_format') or 'vc-jwt').strip()
+    if value in OB3_PROOF_FORMATS:
+        return value
+    raise ValueError(
+        "[%s] proof_format must be one of %s, got %r"
+        % (badge_section, ', '.join(OB3_PROOF_FORMATS), value))
+
+
 @dataclass
 class OB3StatusConfig:
     """Resolved per-badge OB3 credential status configuration."""

{openbadgeslib-3.1.1 → openbadgeslib-3.3.0}/openbadgeslib/ob1/badge.py

@@ -145,6 +145,25 @@ class Badge():
                     self.priv_key = SigningKey.from_pem(self.privkey_pem)
                 except Exception as exc:
                     raise PrivateKeyReadError('Unable to read ECC private key: %s' % exc) from exc
+        elif self.key_type is KeyType.ED25519:
+            from cryptography.hazmat.primitives.serialization import (
+                load_pem_private_key, load_pem_public_key)
+            if self.pubkey_pem:
+                try:
+                    pub_pem = self.pubkey_pem.encode('utf-8') \
+                        if isinstance(self.pubkey_pem, str) else self.pubkey_pem
+                    self.pub_key = load_pem_public_key(pub_pem)
+                except Exception as exc:
+                    raise PublicKeyReadError(
+                        'Unable to read Ed25519 public key: %s' % exc) from exc
+            if self.privkey_pem:
+                try:
+                    priv_pem = self.privkey_pem.encode('utf-8') \
+                        if isinstance(self.privkey_pem, str) else self.privkey_pem
+                    self.priv_key = load_pem_private_key(priv_pem, password=None)
+                except Exception as exc:
+                    raise PrivateKeyReadError(
+                        'Unable to read Ed25519 private key: %s' % exc) from exc
         elif self.key_type is not None:
             # key_type=None is a valid "no key material yet" state; any other
             # value is an unsupported key type and must fail loudly.

{openbadgeslib-3.1.1 → openbadgeslib-3.3.0}/openbadgeslib/ob3/__init__.py

@@ -23,26 +23,36 @@
 from .credential import Achievement, Issuer, OpenBadgeCredential
 from .signer import OB3Signer
 from .verifier import OB3VerificationError, OB3Verifier
+from .ldp import (OB3LdpSigner, OB3LdpVerifier, add_data_integrity_proof,
+                  verify_data_integrity_proof)
 from .status import check_credential_status
 from .status_list import (build_status_list_credential, encode_bitstring,
                           sign_status_list_credential, status_entry)
 from .status_registry import StatusRegistry
-from .did import build_did_document, did_web_from_url, resolve_did
+from .did import (build_did_document, did_key_from_pem, did_web_from_url,
+                  multikey_from_pem, resolve_did, resolve_verification_method)
 
 __all__ = [
     'Achievement',
     'Issuer',
     'OpenBadgeCredential',
+    'OB3LdpSigner',
+    'OB3LdpVerifier',
     'OB3Signer',
     'OB3Verifier',
     'OB3VerificationError',
+    'add_data_integrity_proof',
+    'verify_data_integrity_proof',
     'StatusRegistry',
     'build_did_document',
     'build_status_list_credential',
     'check_credential_status',
+    'did_key_from_pem',
     'did_web_from_url',
     'encode_bitstring',
+    'multikey_from_pem',
     'resolve_did',
+    'resolve_verification_method',
     'sign_status_list_credential',
     'status_entry',
 ]