openbadgeslib 3.2.0__tar.gz → 3.3.0__tar.gz

{openbadgeslib-3.2.0 → openbadgeslib-3.3.0}/Changelog.txt

@@ -4,6 +4,36 @@ OpenBadgesLib - Changelog
 Newest first. Dates are ISO 8601 (YYYY-MM-DD).
 
 
+* v3.3.0 - 2026-07-04
+
+  - feat(ob3): issuance of OB 3.0 credentials secured with a W3C Data
+    Integrity proof (eddsa-rdfc-2022) — new `OB3LdpSigner` and low-level
+    `add_data_integrity_proof`, the signing counterparts of the verifiers
+    shipped in 3.2.0, sharing their canonicalization core and reproducing
+    the official W3C vc-di-eddsa test vector byte for byte. Ed25519 keys
+    only; requires the `[ldp]` extra, which now covers both directions.
+
+  - feat(cli): `openbadges-signer -P/--proof-format {vc-jwt,ldp}` (OB3
+    only) plus an optional per-badge `proof_format` config key (flag wins;
+    default vc-jwt). With `[issuer] did` configured the proof names the
+    `did:web:...#badge_N` verification method `openbadges-publish -V 3`
+    publishes (trusted via `--resolve-did`); otherwise it falls back to a
+    self-asserted did:key derived from the signing key and tells the
+    operator so. LDP-signed badges are tagged `PROOF ldp` in the signer
+    audit log. Status lists stay VC-JWT regardless of the badge's proof
+    format.
+
+  - feat(ob3): multikey/did:key encoders in `ob3.did` —
+    `multikey_from_pem` (publicKeyMultibase) and `did_key_from_pem`,
+    the exact inverses of the resolvers, for Ed25519 and NIST P-256.
+
+  - fix(cli): `Badge.create_from_conf` rejected `key_type = ED25519`
+    outright, so the CLI could never sign with the keys
+    `openbadges-keygenerator -t ED25519` produces; Ed25519 key material
+    now loads, and the legacy OB 1.0 path (`-V 1`) refuses non-RSA/ECC
+    keys with a clean message instead of failing mid-JWS.
+
+
 * v3.2.0 - 2026-07-03
 
   - feat(ob3): verification of OB 3.0 credentials secured with a W3C Data

{openbadgeslib-3.2.0/openbadgeslib.egg-info → openbadgeslib-3.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: openbadgeslib
-Version: 3.2.0
+Version: 3.3.0
 Summary: Production-ready Python library & CLI for Open Badges 3.0 (W3C Verifiable Credentials): issue, verify, and revoke JWT-VC credentials with Bitstring Status Lists and did:web — plus strict OB 2.0 and legacy OB 1.0.
 Author-email: Luis González Fernández <luisgf@luisgf.es>, Jesús Cea Avión <jcea@jcea.es>
 License: LGPLv3
@@ -9,7 +9,7 @@ Project-URL: Documentation, https://github.com/luisgf/openbadgeslib/wiki
 Project-URL: API Reference, https://luisgf.github.io/openbadgeslib/
 Project-URL: Source, https://github.com/luisgf/openbadgeslib
 Project-URL: Changelog, https://github.com/luisgf/openbadgeslib/blob/master/Changelog.txt
-Keywords: openbadges,open-badges,verifiable-credentials,vc-jwt,w3c-vc,digital-credentials,did,did-web,bitstring-status-list,revocation,ob3,credentials,ed25519,cryptography
+Keywords: openbadges,open-badges,verifiable-credentials,vc-jwt,w3c-vc,digital-credentials,did,did-web,bitstring-status-list,revocation,ob3,credentials,ed25519,cryptography,data-integrity,eddsa
 Classifier: Development Status :: 5 - Production/Stable
 Classifier: Intended Audience :: Developers
 Classifier: Intended Audience :: Education
@@ -54,7 +54,8 @@ Dynamic: license-file
 
 **A production-ready Python library & CLI for the full Open Badges 3.0 issuer
 lifecycle** — issue [W3C Verifiable Credentials](https://www.w3.org/TR/vc-data-model-2.0/)
-as JWT-VC, bake them into SVG/PNG, verify them, and **revoke or suspend** them
+as JWT-VC or W3C Data Integrity (LDP) proofs, bake them into SVG/PNG, verify them,
+and **revoke or suspend** them
 with W3C Bitstring Status Lists and `did:web`. It also ships strict
 **OpenBadges 2.0** (JWS / hosted assertions) and a frozen **OpenBadges 1.0**
 legacy format, selected with `-V {1,2,3}` (default `3`).
@@ -63,14 +64,14 @@ legacy format, selected with `-V {1,2,3}` (default `3`).
 
 - Sign badge images (SVG and PNG) as strict OB 2.0 JWS / hosted assertions (with a frozen OB 1.0 legacy format)
 - Issue and verify OpenBadges 3.0 JWT-VC credentials
-- Bake OB 3.0 JWT tokens into SVG and PNG badge images
+- Bake OB 3.0 credentials (JWT-VC or Data Integrity JSON-LD) into SVG and PNG badge images
 - RSA 2048-bit (RS256), ECC NIST P-256 (ES256), and Ed25519 (EdDSA) key support
 - SHA-256 hashed recipient identity with salt (OB 2.0)
 - Expiration and revocation checking
 - Issuer-side OB 3.0 revocation and suspension: W3C Bitstring Status List
   publication and `--revoke` / `--suspend` / `--unsuspend` management
-- Verify OB 3.0 W3C Data Integrity credentials (`eddsa-rdfc-2022`, optional
-  `[ldp]` extra) in addition to JWT-VC
+- Issue and verify OB 3.0 W3C Data Integrity credentials (`eddsa-rdfc-2022`,
+  optional `[ldp]` extra) in addition to JWT-VC
 - did:web issuer identity: `did.json` generation and DID resolution
 - Five command-line tools included
 
@@ -79,8 +80,10 @@ legacy format, selected with `-V {1,2,3}` (default `3`).
 - **The complete OB 3.0 issuer lifecycle in Python** — not just issuing, but
   publishing trust artefacts (`did:web`) and revoking/suspending credentials via
   Bitstring Status Lists, driven from the CLI or the library.
-- **Native VC-JWT** signing with RSA (RS256), ECC P-256 (ES256) and Ed25519
-  (EdDSA), and offline verification.
+- **Native VC-JWT signing** with RSA (RS256), ECC P-256 (ES256) and Ed25519
+  (EdDSA) — *plus* native **W3C Data Integrity / LDP** signing
+  (`eddsa-rdfc-2022`, Ed25519, optional `[ldp]` extra). Both proof formats
+  issue *and* verify offline, no external service.
 - **Lean and typed** — `mypy --strict`, CI on Python 3.10–3.13, a small
   dependency set, dataclasses + explicit validation (no Pydantic).
 - **Dual-licensed** LGPLv3 (library) / BSD-2-Clause (CLI tools).
@@ -88,23 +91,39 @@ legacy format, selected with `-V {1,2,3}` (default `3`).
 ### How it compares
 
 Best-effort comparison from each project's public documentation as of July 2026;
-"not documented" is shown as `—`. Corrections welcome via issue/PR.
-
-| Capability | **openbadgeslib** | [PyOpenBadges](https://github.com/CoopCodeCommun/pyopenbadges) |
-| --- | --- | --- |
-| Open Badges versions | 1.0, 2.0, **3.0** | 3.0 (v2→v3 planned) |
-| OB 3.0 proof: VC-JWT (JOSE) | ✅ RS/ES/EdDSA | roadmap |
-| OB 3.0 proof: Data Integrity / LDP | ✅ verify (`eddsa-rdfc-2022`, `[ldp]` extra) | JSON-LD signing (format unspecified) |
-| Revocation / suspension (Bitstring Status List) | ✅ issue + publish + manage | — |
-| `did:web` (generate + resolve) | ✅ | — |
-| Image baking (SVG + PNG) | ✅ | roadmap |
-| Command-line tools | ✅ 5 tools | — |
-| Typing / CI | `mypy --strict`, CI 3.10–3.13 | — |
-| Validation | dataclasses + explicit checks | Pydantic |
-
-For OB 2.0 validation the reference implementation is 1EdTech's Node
-[`openbadges-validator`](https://github.com/1EdTech/openbadges-validator); this
-table focuses on the OB 3.0 Python landscape.
+"not documented" is shown as `—`. Corrections welcome via issue/PR. The Python
+Open Badges landscape splits into three groups: 1EdTech's **verify-only** OB 2.0
+reference validator, heavyweight **Django server platforms** (the Badgr lineage),
+and a thin tail of **standalone libraries** — of which openbadgeslib is the only
+actively-maintained, pip-installable, offline one that covers all three OB
+versions and both OB 3.0 proof formats.
+
+| Capability | **openbadgeslib** | [validator-core](https://github.com/1EdTech/openbadges-validator-core) | [Badgr / mint-o-badges](https://github.com/mint-o-badges/badgr-server) (a) | [pyopenbadges](https://github.com/CoopCodeCommun/pyopenbadges) | [didkit](https://github.com/spruceid/didkit-python) (b) |
+| --- | --- | --- | --- | --- | --- |
+| Open Badges versions | 1.0, 2.0, **3.0** | 0.5–2.0 | 1.1, 2.0, 3.0 | 3.0 only | generic VC |
+| Issue / verify | ✅ both | verify only | issue; partial verify | both | both (VC + VP) |
+| OB 3.0 proof: VC-JWT (JOSE) | ✅ RS/ES/EdDSA | — | — | roadmap | ✅ not OB-aware |
+| OB 3.0 proof: Data Integrity / LDP | ✅ issue + verify (`eddsa-rdfc-2022`) | — | issue only (Ed25519) | home-grown, non-conformant | older suites; no `rdfc-2022` in wheel |
+| Revocation / suspension | ✅ W3C Bitstring Status List | hosted check | `1EdTechRevocationList` | ad-hoc flag | — |
+| `did:web` (generate + resolve) | ✅ | — | — | — | resolve only |
+| Image baking (SVG + PNG) | ✅ | unbake only | ✅ | — | — |
+| Form factor | library + 5 CLI tools | library + CLI | Django server | library | binding |
+| Typing / CI | `mypy --strict`, CI 3.10–3.13 | — | — | Pydantic | — |
+| License | LGPLv3 / BSD-2 | Apache-2.0 | AGPL-3.0 | MIT/LGPL | Apache-2.0 |
+
+(a) The actively-maintained community fork (open-educational-badges): it
+genuinely issues OB 3.0 Data Integrity credentials, but only as a server (not a
+pip library) and only with Ed25519 (no VC-JWT). The classic Concentric Sky
+`badgr-server` is OB 2.0 and its canonical repo is gone; SURF's
+`edubadges-server` delegates OB 3.0 signing to external agents.
+(b) Generic W3C VC/DID toolkit (Rust `ssi` bindings), not Open Badges-aware, and
+archived (read-only since July 2025).
+
+For authoritative OB 2.0 *validation* semantics, 1EdTech's Python
+[`openbadges-validator-core`](https://github.com/1EdTech/openbadges-validator-core)
+and Node [`openbadges-validator`](https://github.com/1EdTech/openbadges-validator)
+remain the reference; openbadgeslib focuses on the full issuer lifecycle across
+all three OB versions.
 
 ## Requirements
 
@@ -191,7 +210,15 @@ with open('/tmp/signed_badge.svg', 'wb') as f:
 
 For the frozen OpenBadges 1.0 legacy API (`Badge` / `Signer` / `Verifier`), import from `openbadgeslib.ob1` instead.
 
-## Using the library — OpenBadges 3.0 (JWT-VC)
+## Using the library — OpenBadges 3.0
+
+OB 3.0 credentials can be secured with either of the two proof formats the
+spec allows: a compact **VC-JWT** (`OB3Signer`, RS256/ES256/EdDSA) or an
+embedded **Data Integrity** proof (`OB3LdpSigner`, cryptosuite
+`eddsa-rdfc-2022`, Ed25519 only — needs the `[ldp]` extra). Both bake into
+the same SVG/PNG carriers and the verifier auto-detects the format.
+
+### VC-JWT (JOSE)
 
 ```python
 from openbadgeslib.ob3 import (
@@ -227,6 +254,35 @@ restored = verifier.verify(token, expected_recipient='recipient@example.com')
 print('Recipient:', restored.recipient_id)
 ```
 
+### Data Integrity (LDP)
+
+Same credential, an embedded JSON-LD proof instead of a JWT. Requires an
+Ed25519 signing key and the `[ldp]` extra (`pip install openbadgeslib[ldp]`).
+Reuse the `credential` built above:
+
+```python
+from openbadgeslib.ob3 import OB3LdpSigner, OB3LdpVerifier
+
+with open('sign_ed25519.pem', 'rb') as f:
+    priv_pem = f.read()
+
+# Bake a credential carrying an eddsa-rdfc-2022 DataIntegrityProof into an SVG
+signer = OB3LdpSigner(priv_pem)
+with open('badge.svg', 'rb') as f:
+    baked_svg = signer.sign_into_svg(credential, f.read())
+
+# Verify (the LDP credential travels as JSON in the baked image)
+with open('verify_ed25519.pem', 'rb') as f:
+    verifier = OB3LdpVerifier(pubkey_pem=f.read())
+document = OB3Verifier.extract_token_from_svg(baked_svg)
+restored = verifier.verify(document, expected_recipient='recipient@example.com')
+print('Recipient:', restored.recipient_id)
+```
+
+From the CLI, select the format with `openbadges-signer -P ldp` (OB 3.0 only),
+or set `proof_format = ldp` in the badge's INI section; the default stays
+`vc-jwt`. Status lists remain VC-JWT regardless of the badge's proof format.
+
 ## Documentation
 
 - **User & developer guide** — the project [**Wiki**](https://github.com/luisgf/openbadgeslib/wiki):

{openbadgeslib-3.2.0 → openbadgeslib-3.3.0}/README.md

@@ -7,7 +7,8 @@
 
 **A production-ready Python library & CLI for the full Open Badges 3.0 issuer
 lifecycle** — issue [W3C Verifiable Credentials](https://www.w3.org/TR/vc-data-model-2.0/)
-as JWT-VC, bake them into SVG/PNG, verify them, and **revoke or suspend** them
+as JWT-VC or W3C Data Integrity (LDP) proofs, bake them into SVG/PNG, verify them,
+and **revoke or suspend** them
 with W3C Bitstring Status Lists and `did:web`. It also ships strict
 **OpenBadges 2.0** (JWS / hosted assertions) and a frozen **OpenBadges 1.0**
 legacy format, selected with `-V {1,2,3}` (default `3`).
@@ -16,14 +17,14 @@ legacy format, selected with `-V {1,2,3}` (default `3`).
 
 - Sign badge images (SVG and PNG) as strict OB 2.0 JWS / hosted assertions (with a frozen OB 1.0 legacy format)
 - Issue and verify OpenBadges 3.0 JWT-VC credentials
-- Bake OB 3.0 JWT tokens into SVG and PNG badge images
+- Bake OB 3.0 credentials (JWT-VC or Data Integrity JSON-LD) into SVG and PNG badge images
 - RSA 2048-bit (RS256), ECC NIST P-256 (ES256), and Ed25519 (EdDSA) key support
 - SHA-256 hashed recipient identity with salt (OB 2.0)
 - Expiration and revocation checking
 - Issuer-side OB 3.0 revocation and suspension: W3C Bitstring Status List
   publication and `--revoke` / `--suspend` / `--unsuspend` management
-- Verify OB 3.0 W3C Data Integrity credentials (`eddsa-rdfc-2022`, optional
-  `[ldp]` extra) in addition to JWT-VC
+- Issue and verify OB 3.0 W3C Data Integrity credentials (`eddsa-rdfc-2022`,
+  optional `[ldp]` extra) in addition to JWT-VC
 - did:web issuer identity: `did.json` generation and DID resolution
 - Five command-line tools included
 
@@ -32,8 +33,10 @@ legacy format, selected with `-V {1,2,3}` (default `3`).
 - **The complete OB 3.0 issuer lifecycle in Python** — not just issuing, but
   publishing trust artefacts (`did:web`) and revoking/suspending credentials via
   Bitstring Status Lists, driven from the CLI or the library.
-- **Native VC-JWT** signing with RSA (RS256), ECC P-256 (ES256) and Ed25519
-  (EdDSA), and offline verification.
+- **Native VC-JWT signing** with RSA (RS256), ECC P-256 (ES256) and Ed25519
+  (EdDSA) — *plus* native **W3C Data Integrity / LDP** signing
+  (`eddsa-rdfc-2022`, Ed25519, optional `[ldp]` extra). Both proof formats
+  issue *and* verify offline, no external service.
 - **Lean and typed** — `mypy --strict`, CI on Python 3.10–3.13, a small
   dependency set, dataclasses + explicit validation (no Pydantic).
 - **Dual-licensed** LGPLv3 (library) / BSD-2-Clause (CLI tools).
@@ -41,23 +44,39 @@ legacy format, selected with `-V {1,2,3}` (default `3`).
 ### How it compares
 
 Best-effort comparison from each project's public documentation as of July 2026;
-"not documented" is shown as `—`. Corrections welcome via issue/PR.
-
-| Capability | **openbadgeslib** | [PyOpenBadges](https://github.com/CoopCodeCommun/pyopenbadges) |
-| --- | --- | --- |
-| Open Badges versions | 1.0, 2.0, **3.0** | 3.0 (v2→v3 planned) |
-| OB 3.0 proof: VC-JWT (JOSE) | ✅ RS/ES/EdDSA | roadmap |
-| OB 3.0 proof: Data Integrity / LDP | ✅ verify (`eddsa-rdfc-2022`, `[ldp]` extra) | JSON-LD signing (format unspecified) |
-| Revocation / suspension (Bitstring Status List) | ✅ issue + publish + manage | — |
-| `did:web` (generate + resolve) | ✅ | — |
-| Image baking (SVG + PNG) | ✅ | roadmap |
-| Command-line tools | ✅ 5 tools | — |
-| Typing / CI | `mypy --strict`, CI 3.10–3.13 | — |
-| Validation | dataclasses + explicit checks | Pydantic |
-
-For OB 2.0 validation the reference implementation is 1EdTech's Node
-[`openbadges-validator`](https://github.com/1EdTech/openbadges-validator); this
-table focuses on the OB 3.0 Python landscape.
+"not documented" is shown as `—`. Corrections welcome via issue/PR. The Python
+Open Badges landscape splits into three groups: 1EdTech's **verify-only** OB 2.0
+reference validator, heavyweight **Django server platforms** (the Badgr lineage),
+and a thin tail of **standalone libraries** — of which openbadgeslib is the only
+actively-maintained, pip-installable, offline one that covers all three OB
+versions and both OB 3.0 proof formats.
+
+| Capability | **openbadgeslib** | [validator-core](https://github.com/1EdTech/openbadges-validator-core) | [Badgr / mint-o-badges](https://github.com/mint-o-badges/badgr-server) (a) | [pyopenbadges](https://github.com/CoopCodeCommun/pyopenbadges) | [didkit](https://github.com/spruceid/didkit-python) (b) |
+| --- | --- | --- | --- | --- | --- |
+| Open Badges versions | 1.0, 2.0, **3.0** | 0.5–2.0 | 1.1, 2.0, 3.0 | 3.0 only | generic VC |
+| Issue / verify | ✅ both | verify only | issue; partial verify | both | both (VC + VP) |
+| OB 3.0 proof: VC-JWT (JOSE) | ✅ RS/ES/EdDSA | — | — | roadmap | ✅ not OB-aware |
+| OB 3.0 proof: Data Integrity / LDP | ✅ issue + verify (`eddsa-rdfc-2022`) | — | issue only (Ed25519) | home-grown, non-conformant | older suites; no `rdfc-2022` in wheel |
+| Revocation / suspension | ✅ W3C Bitstring Status List | hosted check | `1EdTechRevocationList` | ad-hoc flag | — |
+| `did:web` (generate + resolve) | ✅ | — | — | — | resolve only |
+| Image baking (SVG + PNG) | ✅ | unbake only | ✅ | — | — |
+| Form factor | library + 5 CLI tools | library + CLI | Django server | library | binding |
+| Typing / CI | `mypy --strict`, CI 3.10–3.13 | — | — | Pydantic | — |
+| License | LGPLv3 / BSD-2 | Apache-2.0 | AGPL-3.0 | MIT/LGPL | Apache-2.0 |
+
+(a) The actively-maintained community fork (open-educational-badges): it
+genuinely issues OB 3.0 Data Integrity credentials, but only as a server (not a
+pip library) and only with Ed25519 (no VC-JWT). The classic Concentric Sky
+`badgr-server` is OB 2.0 and its canonical repo is gone; SURF's
+`edubadges-server` delegates OB 3.0 signing to external agents.
+(b) Generic W3C VC/DID toolkit (Rust `ssi` bindings), not Open Badges-aware, and
+archived (read-only since July 2025).
+
+For authoritative OB 2.0 *validation* semantics, 1EdTech's Python
+[`openbadges-validator-core`](https://github.com/1EdTech/openbadges-validator-core)
+and Node [`openbadges-validator`](https://github.com/1EdTech/openbadges-validator)
+remain the reference; openbadgeslib focuses on the full issuer lifecycle across
+all three OB versions.
 
 ## Requirements
 
@@ -144,7 +163,15 @@ with open('/tmp/signed_badge.svg', 'wb') as f:
 
 For the frozen OpenBadges 1.0 legacy API (`Badge` / `Signer` / `Verifier`), import from `openbadgeslib.ob1` instead.
 
-## Using the library — OpenBadges 3.0 (JWT-VC)
+## Using the library — OpenBadges 3.0
+
+OB 3.0 credentials can be secured with either of the two proof formats the
+spec allows: a compact **VC-JWT** (`OB3Signer`, RS256/ES256/EdDSA) or an
+embedded **Data Integrity** proof (`OB3LdpSigner`, cryptosuite
+`eddsa-rdfc-2022`, Ed25519 only — needs the `[ldp]` extra). Both bake into
+the same SVG/PNG carriers and the verifier auto-detects the format.
+
+### VC-JWT (JOSE)
 
 ```python
 from openbadgeslib.ob3 import (
@@ -180,6 +207,35 @@ restored = verifier.verify(token, expected_recipient='recipient@example.com')
 print('Recipient:', restored.recipient_id)
 ```
 
+### Data Integrity (LDP)
+
+Same credential, an embedded JSON-LD proof instead of a JWT. Requires an
+Ed25519 signing key and the `[ldp]` extra (`pip install openbadgeslib[ldp]`).
+Reuse the `credential` built above:
+
+```python
+from openbadgeslib.ob3 import OB3LdpSigner, OB3LdpVerifier
+
+with open('sign_ed25519.pem', 'rb') as f:
+    priv_pem = f.read()
+
+# Bake a credential carrying an eddsa-rdfc-2022 DataIntegrityProof into an SVG
+signer = OB3LdpSigner(priv_pem)
+with open('badge.svg', 'rb') as f:
+    baked_svg = signer.sign_into_svg(credential, f.read())
+
+# Verify (the LDP credential travels as JSON in the baked image)
+with open('verify_ed25519.pem', 'rb') as f:
+    verifier = OB3LdpVerifier(pubkey_pem=f.read())
+document = OB3Verifier.extract_token_from_svg(baked_svg)
+restored = verifier.verify(document, expected_recipient='recipient@example.com')
+print('Recipient:', restored.recipient_id)
+```
+
+From the CLI, select the format with `openbadges-signer -P ldp` (OB 3.0 only),
+or set `proof_format = ldp` in the badge's INI section; the default stays
+`vc-jwt`. Status lists remain VC-JWT regardless of the badge's proof format.
+
 ## Documentation
 
 - **User & developer guide** — the project [**Wiki**](https://github.com/luisgf/openbadgeslib/wiki):

{openbadgeslib-3.2.0 → openbadgeslib-3.3.0}/openbadgeslib/config.ini.example

@@ -58,6 +58,10 @@ private_key = ${paths:base_key}/sign_rsa_key_1.pem
 public_key  = ${paths:base_key}/verify_rsa_key_1.pem
 ; key_type selects the algorithm for openbadges-keygenerator: RSA (default), ECC, or ED25519
 key_type    = RSA
+; OpenBadges 3.0 proof format: vc-jwt (compact JWT-VC, the default) or ldp
+; (embedded W3C Data Integrity proof, cryptosuite eddsa-rdfc-2022). ldp needs
+; key_type = ED25519 and the [ldp] extra (pip install openbadgeslib[ldp]).
+;proof_format = vc-jwt
 ; OpenBadges 3.0 credential status (opt-in). When set, openbadges-signer -V 3
 ; attaches credentialStatus entries for these purposes (comma-separated subset
 ; of: revocation, suspension) and openbadges-publish -V 3 generates the signed

{openbadgeslib-3.2.0 → openbadgeslib-3.3.0}/openbadgeslib/confparser.py

@@ -79,6 +79,25 @@ def ob3_issuer_id(conf: ConfigParser) -> str:
         "[issuer] did must be 'auto' or a did:... identifier, got %r" % did)
 
 
+#: Proof formats an OB3 credential can be issued with — the same vocabulary
+#: openbadges-verifier reports in its JSON output.
+OB3_PROOF_FORMATS = ('vc-jwt', 'ldp')
+
+
+def ob3_proof_format(conf: ConfigParser, badge_section: str) -> str:
+    """Return the proof format OB3 credentials of *badge_section* use:
+    ``vc-jwt`` (compact JWT-VC, the default) or ``ldp`` (embedded Data
+    Integrity proof, cryptosuite eddsa-rdfc-2022 — needs an Ed25519 key and
+    the [ldp] extra). Raises ValueError for anything else.
+    """
+    value = (conf[badge_section].get('proof_format') or 'vc-jwt').strip()
+    if value in OB3_PROOF_FORMATS:
+        return value
+    raise ValueError(
+        "[%s] proof_format must be one of %s, got %r"
+        % (badge_section, ', '.join(OB3_PROOF_FORMATS), value))
+
+
 @dataclass
 class OB3StatusConfig:
     """Resolved per-badge OB3 credential status configuration."""

{openbadgeslib-3.2.0 → openbadgeslib-3.3.0}/openbadgeslib/ob1/badge.py

@@ -145,6 +145,25 @@ class Badge():
                     self.priv_key = SigningKey.from_pem(self.privkey_pem)
                 except Exception as exc:
                     raise PrivateKeyReadError('Unable to read ECC private key: %s' % exc) from exc
+        elif self.key_type is KeyType.ED25519:
+            from cryptography.hazmat.primitives.serialization import (
+                load_pem_private_key, load_pem_public_key)
+            if self.pubkey_pem:
+                try:
+                    pub_pem = self.pubkey_pem.encode('utf-8') \
+                        if isinstance(self.pubkey_pem, str) else self.pubkey_pem
+                    self.pub_key = load_pem_public_key(pub_pem)
+                except Exception as exc:
+                    raise PublicKeyReadError(
+                        'Unable to read Ed25519 public key: %s' % exc) from exc
+            if self.privkey_pem:
+                try:
+                    priv_pem = self.privkey_pem.encode('utf-8') \
+                        if isinstance(self.privkey_pem, str) else self.privkey_pem
+                    self.priv_key = load_pem_private_key(priv_pem, password=None)
+                except Exception as exc:
+                    raise PrivateKeyReadError(
+                        'Unable to read Ed25519 private key: %s' % exc) from exc
         elif self.key_type is not None:
             # key_type=None is a valid "no key material yet" state; any other
             # value is an unsupported key type and must fail loudly.

{openbadgeslib-3.2.0 → openbadgeslib-3.3.0}/openbadgeslib/ob3/__init__.py

@@ -23,29 +23,34 @@
 from .credential import Achievement, Issuer, OpenBadgeCredential
 from .signer import OB3Signer
 from .verifier import OB3VerificationError, OB3Verifier
-from .ldp import OB3LdpVerifier, verify_data_integrity_proof
+from .ldp import (OB3LdpSigner, OB3LdpVerifier, add_data_integrity_proof,
+                  verify_data_integrity_proof)
 from .status import check_credential_status
 from .status_list import (build_status_list_credential, encode_bitstring,
                           sign_status_list_credential, status_entry)
 from .status_registry import StatusRegistry
-from .did import (build_did_document, did_web_from_url, resolve_did,
-                  resolve_verification_method)
+from .did import (build_did_document, did_key_from_pem, did_web_from_url,
+                  multikey_from_pem, resolve_did, resolve_verification_method)
 
 __all__ = [
     'Achievement',
     'Issuer',
     'OpenBadgeCredential',
+    'OB3LdpSigner',
     'OB3LdpVerifier',
     'OB3Signer',
     'OB3Verifier',
     'OB3VerificationError',
+    'add_data_integrity_proof',
     'verify_data_integrity_proof',
     'StatusRegistry',
     'build_did_document',
     'build_status_list_credential',
     'check_credential_status',
+    'did_key_from_pem',
     'did_web_from_url',
     'encode_bitstring',
+    'multikey_from_pem',
     'resolve_did',
     'resolve_verification_method',
     'sign_status_list_credential',

{openbadgeslib-3.2.0 → openbadgeslib-3.3.0}/openbadgeslib/ob3/did.py

@@ -117,6 +117,62 @@ def _read_varint(data: bytes) -> Any:
     raise OB3VerificationError("truncated multicodec varint")
 
 
+def _b58btc_encode(data: bytes) -> str:
+    num = int.from_bytes(data, 'big')
+    out = ''
+    while num > 0:
+        num, rem = divmod(num, 58)
+        out = _B58_ALPHABET[rem] + out
+    n_pad = len(data) - len(data.lstrip(b'\x00'))   # leading 0x00 => leading '1'
+    return '1' * n_pad + out
+
+
+def _write_varint(code: int) -> bytes:
+    if code < 0:
+        raise ValueError('varint codes are unsigned, got %d' % code)
+    out = bytearray()
+    while True:
+        byte = code & 0x7f
+        code >>= 7
+        out.append(byte | 0x80 if code else byte)
+        if not code:
+            return bytes(out)
+
+
+def multikey_from_pem(pubkey_pem: Any) -> str:
+    """Encode a public key PEM as a Multikey ``publicKeyMultibase`` string:
+    'z' + base58btc(multicodec varint + raw key bytes) — the exact inverse of
+    the did:key/publicKeyMultibase decoding above. Supports Ed25519 (0xed)
+    and NIST P-256 (0x1200, compressed point); raises ValueError otherwise
+    (this runs issuer-side, on the operator's own key material).
+    """
+    if isinstance(pubkey_pem, str):
+        pubkey_pem = pubkey_pem.encode('utf-8')
+    pub = _serialization.load_pem_public_key(pubkey_pem)
+    if isinstance(pub, Ed25519PublicKey):
+        prefixed = _write_varint(_MULTICODEC_ED25519_PUB) + pub.public_bytes(
+            _serialization.Encoding.Raw, _serialization.PublicFormat.Raw)
+    elif isinstance(pub, ec.EllipticCurvePublicKey) \
+            and isinstance(pub.curve, ec.SECP256R1):
+        prefixed = _write_varint(_MULTICODEC_P256_PUB) + pub.public_bytes(
+            _serialization.Encoding.X962,
+            _serialization.PublicFormat.CompressedPoint)
+    else:
+        raise ValueError('multikey encoding supports Ed25519 and NIST P-256 '
+                         'public keys, got %s' % type(pub).__name__)
+    return 'z' + _b58btc_encode(prefixed)
+
+
+def did_key_from_pem(pubkey_pem: Any) -> str:
+    """Derive the did:key identifier of a public key PEM (Ed25519 or P-256).
+
+    Self-certifying: the key IS the identifier, so resolving the returned DID
+    with :func:`resolve_did` yields the same key back. Raises ValueError for
+    unsupported key types.
+    """
+    return 'did:key:' + multikey_from_pem(pubkey_pem)
+
+
 # ── did:web ──────────────────────────────────────────────────────────────────
 
 def _resolve_did_web(did: str, fetch: Any) -> bytes: