openbadgeslib 3.4.2__tar.gz → 3.5.1__tar.gz

{openbadgeslib-3.4.2 → openbadgeslib-3.5.1}/Changelog.txt

@@ -4,6 +4,73 @@ OpenBadgesLib - Changelog
 Newest first. Dates are ISO 8601 (YYYY-MM-DD).
 
 
+* v3.5.1 - 2026-07-07
+
+  - fix(ob3): a naive datetime passed as the issuance/expiration date is now
+    assumed UTC (matching status_registry._iso_z), not local time — so
+    validFrom/validUntil no longer silently shift by the host's offset and
+    stay consistent with the nbf/exp JWT claims.
+
+  - fix(ob3): the JWT verifier now cross-checks the `jti` claim against the
+    credential `id` (OB3 §8.2 binds them). A validly signed token whose jti
+    disagrees with — or omits — the credential id is rejected, alongside the
+    existing iss/nbf/sub checks.
+
+  - fix(ob3): `_b58btc_decode` bounds its input to 128 characters before the
+    O(n^2) base58 decode, so a hostile did:key / publicKeyMultibase in a
+    fetched did:web or Data Integrity document (up to 5 MiB / 256 KiB) can no
+    longer burn CPU. No real multikey exceeds ~70 characters.
+
+  - fix(ob2): an `evidence` array (which OB 2.0 permits) is preserved when
+    parsing an Assertion instead of being silently dropped — `_iri_or_none`
+    returned None for a list. A single value still collapses to its IRI.
+
+  - fix(cli): `openbadges-signer -M/--mail-badge` now prints a clear notice
+    on the default OB3 path (it was a silent no-op there); the stale
+    `openbadges-keygenerator -t ED25519` hint on the LDP path is corrected to
+    the real `key_type = ED25519` config key; and the OB1 mail path reads its
+    `[smtp]` config inside the try, so a missing `[smtp]` section is reported
+    cleanly after signing instead of raising a traceback.
+
+  - fix(publish): `openbadges-publish -V 3` no longer aborts mid-loop when a
+    badge has an unreadable key or corrupt registry — it skips that badge
+    with a notice (like the did.json path already did), regenerates the
+    others, and exits non-zero with a summary. An urgent revocation is no
+    longer masked by an unrelated half-configured badge.
+
+  - refactor(keygen): `openbadges-keygenerator` uses `enable_debug_logging`
+    instead of the legacy `Logger` class (now removed from logs.py), so key
+    generation no longer requires the `[paths]`/`[logs]` config sections just
+    to emit console lines (they raised a raw KeyError/FileNotFoundError), and
+    a missing `[issuer] name` degrades gracefully.
+
+
+* v3.5.0 - 2026-07-07
+
+  - fix(status): serialise status-registry writes with an exclusive
+    inter-process lock. Concurrent `openbadges-signer` runs (or a signer
+    overlapping `openbadges-publish --revoke`) each did load→mutate→save with
+    no lock, so the second `save()` clobbered the first's new entry — and a
+    delivered credential missing from the registry can never be revoked. Both
+    mutation paths now run inside the new `StatusRegistry.locked(path)` context
+    manager, which holds a POSIX `fcntl` lock on a sibling `<registry>.lock`
+    file across the whole load→mutate→save (a dedicated lock file, because
+    `save()` renames the JSON and a lock on its inode would be orphaned). The
+    revoke path searches unlocked and reloads the winning registry under the
+    lock before mutating. Where `fcntl` is unavailable (non-POSIX) it degrades
+    to the previous unlocked behaviour, so single-operator use is unchanged.
+
+  - feat(eudi): the SD-JWT VC track now also signs with NIST **P-384**
+    (ES384) keys, not only Ed25519 and P-256. `issue_badge_sd_jwt` reads the
+    ECDSA curve from the key and picks openvc-core's matching backend
+    (`P256SigningKey`/`P384SigningKey`), stamping an `alg: ES384` issuer JWT
+    for a P-384 PEM; verification was already curve-agnostic. Other curves
+    (e.g. P-521) and RSA are still rejected with an actionable message. New
+    `openbadgeslib.keys.ec_curve_from_pem` helper. Note: HAIP profiles the
+    P-256 family, so P-384 badges may be refused by HAIP-strict EUDI wallets
+    — P-256 remains the recommended default.
+
+
 * v3.4.2 - 2026-07-07
 
   - build(eudi): the `[eudi]` extra now tracks `openvc-core>=1.8,<2` (was

{openbadgeslib-3.4.2/openbadgeslib.egg-info → openbadgeslib-3.5.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: openbadgeslib
-Version: 3.4.2
+Version: 3.5.1
 Summary: Production-ready Python library & CLI for Open Badges 3.0 (W3C Verifiable Credentials): issue, verify, and revoke JWT-VC credentials with Bitstring Status Lists and did:web — plus strict OB 2.0 and legacy OB 1.0.
 Author-email: Luis González Fernández <luisgf@luisgf.es>, Jesús Cea Avión <jcea@jcea.es>
 License: LGPLv3
@@ -111,7 +111,7 @@ additive EUDI SD-JWT VC wallet track.
 | Issue / verify | ✅ both | verify only | issue; partial verify | both | both (VC + VP) |
 | OB 3.0 proof: VC-JWT (JOSE) | ✅ RS/ES/EdDSA | — | — | roadmap | ✅ not OB-aware |
 | OB 3.0 proof: Data Integrity / LDP | ✅ issue + verify (`eddsa-rdfc-2022`) | — | issue only (Ed25519) | home-grown, non-conformant | older suites; no `rdfc-2022` in wheel |
-| OB 3.0 as EUDI SD-JWT VC (selective disclosure) | ✅ issue + verify (Ed25519/P-256, `[eudi]` extra) | — | — | — | — |
+| OB 3.0 as EUDI SD-JWT VC (selective disclosure) | ✅ issue + verify (Ed25519/P-256/P-384, `[eudi]` extra) | — | — | — | — |
 | Revocation / suspension | ✅ W3C Bitstring Status List | hosted check | `1EdTechRevocationList` | ad-hoc flag | — |
 | `did:web` (generate + resolve) | ✅ | — | — | — | resolve only |
 | Image baking (SVG + PNG) | ✅ | unbake only | ✅ | — | — |
@@ -306,7 +306,9 @@ crypto to the generic [`openvc-core`](https://pypi.org/project/openvc-core/)
 library. It does not touch the native VC-JWT / Data Integrity issuance above:
 it is a separate credential format for wallet flows, not a third image proof.
 Needs the `[eudi]` extra (`pip install "openbadgeslib[eudi]"`) and an Ed25519
-(EdDSA) or NIST P-256 (ES256) key — SD-JWT's algorithm set (RSA is rejected).
+(EdDSA), NIST P-256 (ES256) or P-384 (ES384) key — SD-JWT's algorithm set (RSA
+is rejected). HAIP profiles the P-256 family, so P-256 stays the safe default
+for EUDI wallets; P-384 may be refused by HAIP-strict verifiers.
 The achievement is always disclosed; the recipient identity is *selectively
 disclosable*, so a holder can prove the badge while withholding who they are.
 

{openbadgeslib-3.4.2 → openbadgeslib-3.5.1}/README.md

@@ -60,7 +60,7 @@ additive EUDI SD-JWT VC wallet track.
 | Issue / verify | ✅ both | verify only | issue; partial verify | both | both (VC + VP) |
 | OB 3.0 proof: VC-JWT (JOSE) | ✅ RS/ES/EdDSA | — | — | roadmap | ✅ not OB-aware |
 | OB 3.0 proof: Data Integrity / LDP | ✅ issue + verify (`eddsa-rdfc-2022`) | — | issue only (Ed25519) | home-grown, non-conformant | older suites; no `rdfc-2022` in wheel |
-| OB 3.0 as EUDI SD-JWT VC (selective disclosure) | ✅ issue + verify (Ed25519/P-256, `[eudi]` extra) | — | — | — | — |
+| OB 3.0 as EUDI SD-JWT VC (selective disclosure) | ✅ issue + verify (Ed25519/P-256/P-384, `[eudi]` extra) | — | — | — | — |
 | Revocation / suspension | ✅ W3C Bitstring Status List | hosted check | `1EdTechRevocationList` | ad-hoc flag | — |
 | `did:web` (generate + resolve) | ✅ | — | — | — | resolve only |
 | Image baking (SVG + PNG) | ✅ | unbake only | ✅ | — | — |
@@ -255,7 +255,9 @@ crypto to the generic [`openvc-core`](https://pypi.org/project/openvc-core/)
 library. It does not touch the native VC-JWT / Data Integrity issuance above:
 it is a separate credential format for wallet flows, not a third image proof.
 Needs the `[eudi]` extra (`pip install "openbadgeslib[eudi]"`) and an Ed25519
-(EdDSA) or NIST P-256 (ES256) key — SD-JWT's algorithm set (RSA is rejected).
+(EdDSA), NIST P-256 (ES256) or P-384 (ES384) key — SD-JWT's algorithm set (RSA
+is rejected). HAIP profiles the P-256 family, so P-256 stays the safe default
+for EUDI wallets; P-384 may be refused by HAIP-strict verifiers.
 The achievement is always disclosed; the recipient identity is *selectively
 disclosable*, so a holder can prove the badge while withholding who they are.
 

{openbadgeslib-3.4.2 → openbadgeslib-3.5.1}/openbadgeslib/keys.py

@@ -253,6 +253,32 @@ def public_jwk_from_pem(pubkey_pem: Union[str, bytes]) -> dict:
     return json.loads(jwk_json)
 
 
+def ec_curve_from_pem(pem_data: Union[str, bytes]) -> Optional[str]:
+    """Return the NIST curve name of an elliptic-curve key PEM, else ``None``.
+
+    The name is ``cryptography``'s (``'secp256r1'`` for P-256, ``'secp384r1'``
+    for P-384, …); ``None`` if the PEM is not an EC key (RSA, Ed25519 or
+    unreadable). Accepts a public or private PEM. The SD-JWT VC (EUDI) track
+    uses this to pick the ES256 vs ES384 signing backend — the ECDSA curve
+    fixes the JOSE algorithm.
+    """
+    from cryptography.hazmat.primitives.asymmetric import ec
+    data = _pem_bytes(pem_data)
+    for load in (
+        lambda: _crypto_serialization.load_pem_public_key(data),
+        lambda: _crypto_serialization.load_pem_private_key(data, password=None),
+    ):
+        try:
+            key = load()
+        except Exception:
+            continue
+        if isinstance(key, (ec.EllipticCurvePublicKey,
+                            ec.EllipticCurvePrivateKey)):
+            return key.curve.name
+        return None                                   # readable, but not EC
+    return None
+
+
 def _is_ed25519_pem(pem_data: Union[str, bytes]) -> bool:
     """True if pem_data is an Ed25519 public or private key.
 

openbadgeslib-3.5.1/openbadgeslib/logs.py

@@ -0,0 +1,41 @@
+#!/usr/bin/env python3
+"""
+        OpenBadges Library
+
+        Copyright (c) 2014-2026, Luis González Fernández, luisgf@luisgf.es
+        Copyright (c) 2014-2026, Jesús Cea Avión, jcea@jcea.es
+
+        All rights reserved.
+
+        This library is free software; you can redistribute it and/or
+        modify it under the terms of the GNU Lesser General Public
+        License as published by the Free Software Foundation; either
+        version 3.0 of the License, or (at your option) any later version.
+
+        This library is distributed in the hope that it will be useful,
+        but WITHOUT ANY WARRANTY; without even the implied warranty of
+        MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+        Lesser General Public License for more details.
+
+        You should have received a copy of the GNU Lesser General Public
+        License along with this library.
+"""
+
+import logging
+from typing import Any
+
+
+def enable_debug_logging(debug: bool = False) -> None:
+    """Route library log messages to the console for the CLI tools.
+
+    With ``debug=True`` DEBUG-level messages are shown; otherwise only INFO and
+    above. Idempotent — safe to call once per CLI invocation (it will not stack
+    duplicate console handlers).
+    """
+    root = logging.getLogger()
+    if not any(getattr(h, '_obl_console', False) for h in root.handlers):
+        handler: Any = logging.StreamHandler()
+        handler.setFormatter(logging.Formatter("%(levelname)s - %(message)s"))
+        handler._obl_console = True
+        root.addHandler(handler)
+    root.setLevel(logging.DEBUG if debug else logging.INFO)

{openbadgeslib-3.4.2 → openbadgeslib-3.5.1}/openbadgeslib/ob2/models.py

@@ -32,7 +32,7 @@
 import uuid
 from dataclasses import dataclass, field
 from datetime import datetime, timezone
-from typing import Any, List, Optional
+from typing import Any, List, Optional, Union
 
 from ..util import hash_email
 
@@ -122,6 +122,25 @@ def _iri_or_none(value: Any) -> Optional[str]:
     return None
 
 
+def _iri_or_iris(value: Any) -> Optional[Union[str, List[str]]]:
+    """Like :func:`_iri_or_none`, but keep an array instead of dropping it.
+
+    OB 2.0 lets ``evidence`` be a bare IRI, an object with an ``id``, or an
+    array of either. A single value collapses to its IRI string (unchanged
+    behaviour); an array yields the list of IRIs it carries. None when nothing
+    usable is present — so a conformant multi-evidence assertion is no longer
+    silently discarded on parse.
+    """
+    if isinstance(value, list):
+        iris = []
+        for item in value:
+            iri = _iri_or_none(item)
+            if iri is not None:
+                iris.append(iri)
+        return iris or None
+    return _iri_or_none(value)
+
+
 def hash_identity(email: str, salt: Optional[str]) -> str:
     """Return the ``sha256$<hex>`` IdentityHash for an email plus optional salt."""
     return "sha256$" + hash_email(email, salt if salt is not None else "").decode("ascii")
@@ -209,7 +228,7 @@ class Assertion:
     issued_on: Optional[datetime] = None   # defaults to now (UTC)
     expires: Optional[datetime] = None
     image: Optional[str] = None
-    evidence: Optional[str] = None
+    evidence: Optional[Union[str, List[str]]] = None
     narrative: Optional[str] = None
 
     def __post_init__(self) -> None:
@@ -265,7 +284,7 @@ class Assertion:
             issued_on=issued_on,
             expires=expires,
             image=_iri_or_none(d.get("image")),
-            evidence=_iri_or_none(d.get("evidence")),
+            evidence=_iri_or_iris(d.get("evidence")),
             narrative=d.get("narrative") if isinstance(d.get("narrative"), str) else None,
         )
 

{openbadgeslib-3.4.2 → openbadgeslib-3.5.1}/openbadgeslib/ob3/credential.py

@@ -56,7 +56,14 @@ def _validate_context(ctx: Any) -> None:
 
 
 def _iso(dt: datetime) -> str:
-    """Return a datetime as an ISO 8601 string with Z suffix."""
+    """Return a datetime as an ISO 8601 string with Z suffix.
+
+    A naive datetime is assumed to be UTC (matching status_registry._iso_z),
+    not local time — so validFrom/validUntil never silently shift by the host's
+    offset and stay consistent with the nbf/exp JWT claims.
+    """
+    if dt.tzinfo is None:
+        dt = dt.replace(tzinfo=timezone.utc)
     return dt.astimezone(timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ")
 
 
@@ -131,6 +138,14 @@ class OpenBadgeCredential:
             self.id = f"urn:uuid:{uuid.uuid4()}"
         if self.issuance_date is None:
             self.issuance_date = datetime.now(timezone.utc)
+        elif self.issuance_date.tzinfo is None:
+            # A naive datetime is assumed UTC, so validFrom (string) and nbf
+            # (epoch int) agree instead of diverging by the host's offset.
+            self.issuance_date = self.issuance_date.replace(tzinfo=timezone.utc)
+        if self.expiration_date is not None \
+                and self.expiration_date.tzinfo is None:
+            self.expiration_date = self.expiration_date.replace(
+                tzinfo=timezone.utc)
         if self.name is None:
             self.name = self.achievement.name
 

{openbadgeslib-3.4.2 → openbadgeslib-3.5.1}/openbadgeslib/ob3/did.py

@@ -95,7 +95,17 @@ def _multicodec_pubkey_to_pem(data: bytes) -> bytes:
     raise OB3VerificationError("unsupported did:key multicodec 0x%x" % code)
 
 
+#: Bound on base58btc input length. Decoding is O(n^2) in the length (big-int
+#: accumulation), and a hostile did:key / publicKeyMultibase in a fetched
+#: document could be hundreds of KB; no real multikey exceeds ~70 characters.
+_MAX_B58_LEN = 128
+
+
 def _b58btc_decode(value: str) -> bytes:
+    if len(value) > _MAX_B58_LEN:
+        raise OB3VerificationError(
+            "base58btc value too long: %d characters (max %d)"
+            % (len(value), _MAX_B58_LEN))
     num = 0
     for ch in value:
         idx = _B58_INDEX.get(ch)

{openbadgeslib-3.4.2 → openbadgeslib-3.5.1}/openbadgeslib/ob3/eudi.py

@@ -31,14 +31,15 @@
 # withholding their identity.
 #
 # Requires the optional ``[eudi]`` extra (``pip install openbadgeslib[eudi]``),
-# which pulls ``openvc-core``. SD-JWT allows only Ed25519 (EdDSA) and NIST P-256
-# (ES256) keys — RSA is not in its algorithm set.
+# which pulls ``openvc-core``. SD-JWT allows only Ed25519 (EdDSA) and the NIST
+# curves P-256 (ES256) / P-384 (ES384) — RSA is not in its algorithm set.
 
 from typing import Any, Iterable, Optional
 
 from .credential import OpenBadgeCredential
 from ..errors import LibOpenBadgesException
-from ..keys import KeyType, detect_key_type, public_jwk_from_pem
+from ..keys import (
+    KeyType, detect_key_type, ec_curve_from_pem, public_jwk_from_pem)
 
 # A vct (Verifiable Credential Type) for Open Badges expressed as SD-JWT VC.
 OB3_SD_JWT_VCT = "https://purl.imsglobal.org/spec/ob/v3p0#OpenBadgeCredential"
@@ -58,24 +59,37 @@ class EudiError(LibOpenBadgesException):
 def _require_openvc() -> Any:
     """Import the openvc-core pieces, or raise with an actionable hint."""
     try:
-        from openvc.keys import Ed25519SigningKey, P256SigningKey
+        from openvc.keys import (
+            Ed25519SigningKey, P256SigningKey, P384SigningKey)
         from openvc.proof.sd_jwt import SdJwtVcProofSuite
     except ImportError as exc:
         raise EudiError(_INSTALL_HINT) from exc
-    return Ed25519SigningKey, P256SigningKey, SdJwtVcProofSuite
+    return Ed25519SigningKey, P256SigningKey, P384SigningKey, SdJwtVcProofSuite
 
 
 def _signing_key(privkey_pem: Any, kid: str) -> Any:
-    """Build the openvc SigningKey matching the PEM's key type (Ed25519 / P-256)."""
-    Ed25519SigningKey, P256SigningKey, _ = _require_openvc()
+    """Build the openvc SigningKey matching the PEM's key type / curve.
+
+    Ed25519 -> EdDSA; NIST P-256 -> ES256; NIST P-384 -> ES384. The ECDSA
+    curve is read from the key itself, since it fixes the JOSE algorithm.
+    """
+    Ed25519SigningKey, P256SigningKey, P384SigningKey, _ = _require_openvc()
     key_type = detect_key_type(privkey_pem)
     if key_type is KeyType.ED25519:
         return Ed25519SigningKey.from_pem(privkey_pem, kid=kid)
-    if key_type is KeyType.ECC:                       # NIST P-256 -> ES256
-        return P256SigningKey.from_pem(privkey_pem, kid=kid)
+    if key_type is KeyType.ECC:                       # NIST curve -> ES256/ES384
+        curve = ec_curve_from_pem(privkey_pem)
+        if curve == "secp256r1":                      # P-256 -> ES256
+            return P256SigningKey.from_pem(privkey_pem, kid=kid)
+        if curve == "secp384r1":                      # P-384 -> ES384
+            return P384SigningKey.from_pem(privkey_pem, kid=kid)
+        raise EudiError(
+            "SD-JWT VC over ECDSA needs a NIST P-256 (ES256) or P-384 (ES384) "
+            "key; got curve %r." % curve)
     raise EudiError(
-        "SD-JWT VC allows only Ed25519 (EdDSA) or NIST P-256 (ES256) keys; got "
-        "%s (RSA is not in the SD-JWT algorithm set)." % key_type.value)
+        "SD-JWT VC allows only Ed25519 (EdDSA) or NIST P-256/P-384 (ES256/"
+        "ES384) keys; got %s (RSA is not in the SD-JWT algorithm set)."
+        % key_type.value)
 
 
 def badge_to_sd_jwt_claims(credential: OpenBadgeCredential) -> dict:
@@ -117,9 +131,9 @@ def issue_badge_sd_jwt(
     Returns the compact SD-JWT (``<issuer-jwt>~<disclosure>~…``). Only claims in
     *disclosable* that are actually present are made selectively disclosable.
     Pass *holder_jwk* to bind the credential to a holder key (``cnf``) for a later
-    Key-Binding presentation. Ed25519 / P-256 keys only.
+    Key-Binding presentation. Ed25519, P-256 or P-384 keys only.
     """
-    _, _, SdJwtVcProofSuite = _require_openvc()
+    _, _, _, SdJwtVcProofSuite = _require_openvc()
     signing_key = _signing_key(privkey_pem, kid or ("%s#key-1" % credential.issuer.id))
     claims = badge_to_sd_jwt_claims(credential)
     present = [name for name in disclosable if name in claims]
@@ -149,7 +163,7 @@ def verify_badge_sd_jwt(
     Pass *audience*/*nonce* (and ``require_key_binding=True``) to check a Key
     Binding JWT from a holder presentation.
     """
-    _, _, SdJwtVcProofSuite = _require_openvc()
+    _, _, _, SdJwtVcProofSuite = _require_openvc()
     try:
         public_key_jwk = public_jwk_from_pem(pubkey_pem)
         return SdJwtVcProofSuite().verify(

{openbadgeslib-3.4.2 → openbadgeslib-3.5.1}/openbadgeslib/ob3/status_registry.py

@@ -32,14 +32,20 @@
 # leave a truncated registry behind, because a lost registry makes every
 # outstanding credential unrevocable.
 
+import contextlib
 import json
 import os
 import secrets
 import tempfile
 
+try:
+    import fcntl                    # POSIX advisory file locking
+except ImportError:                 # pragma: no cover - non-POSIX (e.g. Windows)
+    fcntl = None                    # type: ignore[assignment]
+
 from dataclasses import dataclass
 from datetime import datetime, timezone
-from typing import Dict, List, Optional, Set
+from typing import Dict, Iterator, List, Optional, Set
 
 from ..errors import (
     AlreadyRevoked,
@@ -59,6 +65,35 @@ _SCHEMA_VERSION = 1
 _MAX_RANDOM_TRIES = 1000
 
 
+@contextlib.contextmanager
+def _exclusive_file_lock(lock_path: str) -> Iterator[None]:
+    """Hold an exclusive inter-process lock for the duration of the block.
+
+    Backed by POSIX ``fcntl.flock`` on a dedicated lock file. Where ``fcntl``
+    is unavailable (non-POSIX platforms) it degrades to no locking — the same
+    behaviour as before this guard existed — so single-process use is
+    unaffected and nothing regresses; concurrent writers are simply not
+    serialised there.
+    """
+    directory = os.path.dirname(lock_path) or '.'
+    umask = os.umask(0o077)
+    try:
+        os.makedirs(directory, exist_ok=True)
+        fd = os.open(lock_path, os.O_CREAT | os.O_RDWR, 0o600)
+    finally:
+        os.umask(umask)
+    try:
+        if fcntl is not None:
+            fcntl.flock(fd, fcntl.LOCK_EX)        # blocks until the lock frees
+        yield
+    finally:
+        try:
+            if fcntl is not None:
+                fcntl.flock(fd, fcntl.LOCK_UN)
+        finally:
+            os.close(fd)
+
+
 @dataclass
 class StatusEvent:
     """A revocation or suspension, with when and (optionally) why."""
@@ -148,6 +183,26 @@ class StatusRegistry:
             raise RegistryCorrupt('%s: %s' % (path, exc)) from exc
         return registry
 
+    @classmethod
+    @contextlib.contextmanager
+    def locked(cls, path: str,
+               size_bits: int = DEFAULT_SIZE_BITS) -> Iterator['StatusRegistry']:
+        """Load the registry under an exclusive inter-process lock, yield it.
+
+        The lock (a sibling ``<path>.lock`` file) is held for the whole block,
+        so a ``load → allocate/revoke/… → save()`` sequence inside it is
+        atomic against other processes. This closes the race where two
+        concurrent writers both load, and the second :meth:`save` clobbers the
+        first's new entry — leaving a delivered credential unrevocable. Call
+        :meth:`save` inside the block; the lock releases on exit.
+
+        A dedicated lock file (not the registry JSON) is used on purpose:
+        :meth:`save` replaces the JSON via ``os.rename``, so a lock held on the
+        JSON inode would be orphaned by the first write.
+        """
+        with _exclusive_file_lock(path + '.lock'):
+            yield cls.load(path, size_bits)
+
     def save(self) -> None:
         """Write the registry atomically (temp file + rename) under a
         restrictive umask; the file names recipients and is issuer-private."""

{openbadgeslib-3.4.2 → openbadgeslib-3.5.1}/openbadgeslib/ob3/verifier.py

@@ -311,6 +311,15 @@ class OB3Verifier:
             raise OB3VerificationError("JWT payload is missing the required 'sub' claim")
         if sub is not None and sub != subject_id:
             raise OB3VerificationError("JWT 'sub' does not match the credentialSubject id")
+        # jti is the registered claim bound to the credential id (OB3 §8.2); the
+        # signer always emits it. Require it whenever the body carries an id, and
+        # reject any mismatch, so a token cannot claim one id and carry another.
+        jti = payload.get("jti")
+        vc_id = vc.get("id")
+        if vc_id is not None and jti is None:
+            raise OB3VerificationError("JWT payload is missing the required 'jti' claim")
+        if jti is not None and jti != vc_id:
+            raise OB3VerificationError("JWT 'jti' does not match the credential id")
 
         return credential
 

{openbadgeslib-3.4.2 → openbadgeslib-3.5.1}/openbadgeslib/openbadges_keygenerator.py

@@ -30,14 +30,17 @@
 """
 
 import argparse
+import logging
 import os
 import sys
 
-from .logs import Logger
+from .logs import enable_debug_logging
 from .keys import KeyFactory, KeyType
 from .confparser import read_config_or_exit, resolve_badge_section
 from .util import __version__
 
+logger = logging.getLogger(__name__)
+
 # Entry Point
 
 
@@ -100,15 +103,17 @@ def main() -> None:
             print('[!] Key file is present at %s' % i)
             sys.exit(1)
 
-    log = Logger(base_log=conf['paths']['base_log'],
-                 general=conf['logs']['general'],
-                 signer=conf['logs']['signer'],
-                 show_debug=args.debug)
+    # Key generation must not require [paths]/[logs]/[issuer]: the legacy Logger
+    # opened general.log/signer.log (KeyError/FileNotFoundError on an incomplete
+    # config) just to emit these console lines. The module logger needs none.
+    enable_debug_logging(args.debug)
 
-    log.console.debug("key_type=%s private=%s public=%s"
-                      % (key_type.name, private_key, public_key))
-    log.console.info("Generating OpenBadges %s %s key pair for issuer '%s'"
-                     % (args.ob_version, key_type.name, conf['issuer']['name']))
+    logger.debug("key_type=%s private=%s public=%s",
+                 key_type.name, private_key, public_key)
+    issuer_name = (conf['issuer'].get('name', '?')
+                   if conf.has_section('issuer') else '?')
+    logger.info("Generating OpenBadges %s %s key pair for issuer '%s'",
+                args.ob_version, key_type.name, issuer_name)
 
     kf = KeyFactory(key_type)
     priv_key_pem, pub_key_pem = kf.generate_keypair()
@@ -116,8 +121,8 @@ def main() -> None:
     _write_pem_file(private_key, priv_key_pem, 0o600)
     _write_pem_file(public_key, pub_key_pem, 0o644)
 
-    log.console.info('Private key saved at: %s' % private_key)
-    log.console.info('Public key saved at: %s' % public_key)
+    logger.info('Private key saved at: %s', private_key)
+    logger.info('Public key saved at: %s', public_key)
 
 
 if __name__ == '__main__':

{openbadgeslib-3.4.2 → openbadgeslib-3.5.1}/openbadgeslib/openbadges_publish.py

@@ -200,19 +200,25 @@ def _publish_ob3(args: argparse.Namespace, parser: argparse.ArgumentParser) -> N
             sys.exit(-1)
 
         name, registry, entry = matches[0]
+        jti = entry.jti
         now = datetime.now(tz=timezone.utc)
+        # The search above is an unlocked best-effort locator; the mutation
+        # reloads the winning registry under an exclusive lock so it is atomic
+        # against a concurrent signer or revoke (see StatusRegistry.locked).
         try:
-            if op == 'revoke':
-                registry.revoke(entry.jti, now, args.reason)
-            elif op == 'suspend':
-                registry.suspend(entry.jti, now, args.reason)
-            else:
-                registry.unsuspend(entry.jti)
-            registry.save()
-        except StatusError as exc:
+            with StatusRegistry.locked(registry.path,
+                                       registry.size_bits) as registry:
+                if op == 'revoke':
+                    registry.revoke(jti, now, args.reason)
+                elif op == 'suspend':
+                    registry.suspend(jti, now, args.reason)
+                else:
+                    registry.unsuspend(jti)
+                registry.save()
+        except (StatusError, OSError) as exc:
             print('[!] %s' % exc)
             sys.exit(-1)
-        print('[+] %s %s %s (index %d)' % (verb, name, entry.jti, entry.index))
+        print('[+] %s %s %s (index %d)' % (verb, name, jti, entry.index))
 
     # ── regenerate every managed artefact from the registries ───────────────
     publish_url = conf['issuer']['publish_url']
@@ -225,6 +231,7 @@ def _publish_ob3(args: argparse.Namespace, parser: argparse.ArgumentParser) -> N
             print('[!] Cannot derive a did:web identifier: %s' % exc)
             sys.exit(-1)
 
+    failures = []                 # badges skipped (unreadable key / registry)
     umask = os.umask(0o077)  # rwx------
     try:
         os.makedirs(args.output, exist_ok=True)
@@ -258,8 +265,13 @@ def _publish_ob3(args: argparse.Namespace, parser: argparse.ArgumentParser) -> N
                 with open(conf[name]['private_key'], 'rb') as key:
                     priv_pem = key.read()
             except (StatusError, OSError) as exc:
-                print('[!] %s' % exc)
-                sys.exit(-1)
+                # Isolate a per-badge failure (unreadable key, corrupt registry)
+                # like the did.json skip above: don't abort the whole publish —
+                # a badge_2 mid-configuration must not make an urgent badge_1
+                # revocation appear to fail after its list was already written.
+                print('[!] Skipping [%s] status lists — %s' % (name, exc))
+                failures.append(name)
+                continue
             algorithm = alg_for_key_type(detect_key_type(priv_pem))
 
             badge_dir = os.path.join(args.output, name)
@@ -279,8 +291,13 @@ def _publish_ob3(args: argparse.Namespace, parser: argparse.ArgumentParser) -> N
     finally:
         os.umask(umask)
 
+    if failures:
+        print('[!] %d badge(s) skipped (see above): %s — their status lists '
+              'were NOT regenerated' % (len(failures), ', '.join(failures)))
     print('Please configure your Web server to publish the folder %s as %s' %
           (args.output, publish_url))
+    if failures:
+        sys.exit(1)
     print('[i] Issuer DID: %s' % did)
     if ':' not in did[len('did:web:'):]:
         print('[i] A bare-host did:web resolves at '