openbadgeslib 4.0.0__tar.gz → 4.1.0__tar.gz

{openbadgeslib-4.0.0 → openbadgeslib-4.1.0}/Changelog.txt

@@ -4,6 +4,134 @@ OpenBadgesLib - Changelog
 Newest first. Dates are ISO 8601 (YYYY-MM-DD).
 
 
+* v4.1.0 - 2026-07-27
+
+  The EUDI SD-JWT VC track becomes revocable (IETF Token Status List) and
+  advertisable over OpenID4VCI, on top of a security & correctness hardening
+  pass (audit-bot).
+
+  - fix(build): stop git's EOL conversion from defeating the bundled contexts'
+    recorded SHA-256 provenance on Windows. Without a `.gitattributes` entry git
+    checks the JSON-LD contexts out with CRLF on a Windows clone, so the bytes on
+    disk are not the bytes the digests in ob3/contexts/__init__.py cover — the
+    control that makes the fail-closed context allowlist meaningful could not be
+    evaluated on that platform at all, and the `test (windows)` CI leg had been
+    red since the gate landed (which also blocks releases: `publish` is
+    `needs: test`). The contexts are now marked `-text`, and a gate asserts that
+    attribute stays. Wheel/sdist installs were never affected (#274).
+  - fix(keys): a failed PEM load lands in the library's exception taxonomy on
+    every supported `cryptography`, and the floor moves to >=45. cryptography
+    v47 changed the contract — loading a key of an unsupported algorithm now
+    raises `UnsupportedAlgorithm`, which is NOT a ValueError — while
+    `KeyRSA`/`KeyECC.read_private_key`/`read_public_key` and the Ed25519 loaders
+    caught nothing at all, so a corrupt or unsupported key PEM escaped as a raw
+    crypto traceback (the `Badge` entry point was already guarded; these direct
+    callers were not). All PEM loading now goes through one guarded helper that
+    maps both contracts onto `PrivateKeyReadError` / `PublicKeyReadError`,
+    keeping the original exception as `__cause__`; `detect_key_type` /
+    `ec_curve_from_pem` stay total. `KeyRSA.generate_keypair` maps the v48
+    1024-bit floor to `GenPrivateKeyError` instead of a raw ValueError. The
+    floor is 45 (openvc-core's own pin, so the extras resolve one range) rather
+    than 47: both contracts are handled and tested, so requiring an April-2026
+    release would buy nothing (#244).
+  - feat(eudi): build the OpenID4VCI credential configuration entry for an Open
+    Badge issued as SD-JWT VC. `badge_credential_configuration()` returns the
+    `credential_configurations_supported` entry a wallet reads to request the
+    badge — `format: dc+sd-jwt`, the `vct`, signing/proof algorithms (ES256, the
+    HAIP floor), `cryptographic_binding_methods_supported`, `claims` and
+    `display` — derived from the same `badge_type_metadata()` document the
+    issuer serves at that `vct`, so the advertised claim set and the served Type
+    Metadata cannot drift apart (the drift makes a wallet reject the credential
+    or display nothing). Pure-Python, no `[eudi]` extra. The enclosing
+    `/.well-known/openid-credential-issuer` document, the Credential Offer and
+    the endpoints stay the application's: they are deployment policy, one per
+    tenant (#271).
+  - feat(eudi): SD-JWT VC badges are revocable, via the IETF OAuth Token Status
+    List. `issue_badge_sd_jwt(..., status=...)` takes the reference
+    `openvc.status.issue.build_token_status_reference(uri=…, index=…)` builds and
+    emits it as a `status` claim that is **always disclosed** — never selectively
+    disclosable, whatever `disclosable=` says, since a holder able to withhold
+    the pointer could present a revoked badge as an unrevokable one. On the
+    verify side both trust paths (pinned key and x5c) now take
+    `require_status` / `resolve_status_list_token`: a badge whose bit says
+    revoked or suspended raises `EudiError`, and every way of not knowing the
+    status fails closed — an unresolvable, wrongly-signed, expired or
+    URL-swapped list raises rather than reading as "not revoked". The new
+    `status_list_token_resolver(pubkey_pem=…)` builds the safe default resolver
+    (HTTPS fetch + openvc-core's `verify_status_list_token`, including the IETF
+    anti-swap `sub` check). Encoding, signing and packing stay openvc-core's;
+    the `[eudi]` floor moves to >=1.23. This closes the #226 irrevocability
+    boundary for this track. Two formats, two lists: a credential carrying a
+    W3C `credentialStatus` (Bitstring) is still refused at SD-JWT issuance
+    rather than silently mapped onto a different wire format — a badge issued
+    on both tracks needs an index in each list (#245, #270).
+  - security(ob2): make the fetched copy of a HostedBadge authoritative for the
+    whole document. `_verify_hosted` reconciled only `id`, `recipient`, `badge`,
+    `issuedOn` and `expires` and then kept the copy baked into the image, so
+    `image`, `evidence` and `narrative` stayed holder-controlled on a badge
+    reported valid AND trusted — and the baked JWS is deliberately non-gating for
+    a hosted badge, so re-baking costs the holder nothing. `verify()` now returns
+    the assertion parsed from the HTTPS fetch, and the non-gating JWS check
+    resolves `verification.creator` from that copy instead of a holder-chosen
+    URL. The equality checks stay (they still catch a local copy claiming an `id`
+    that hosts something else). Narrow behaviour change: the served document must
+    itself parse as a strict OB 2.0 Assertion — it is the assertion now (#257).
+  - fix(cli): never report `"trusted": true` for a badge that failed to verify.
+    `openbadges-verifier --json` seeded the OB2/OB3 result with `trusted` True
+    before verifying anything, so every failure emitted it next to
+    `"valid": false`; the OB1 path seeded no `trusted` at all and set it only on
+    a successful parse, so a malformed OB1 badge emitted a payload missing the
+    documented common field entirely. All three paths (and the missing-file
+    early exit) now seed both booleans False and raise them only on a verdict,
+    so `trusted` is always present and `trusted => valid` holds. Exit statuses
+    are unchanged — they already keyed on `valid` first (#258).
+  - ci: derive the openvc-core floor the `eudi` job tests from pyproject.toml
+    instead of restating it. The pin drifted: 677f4ed raised the [eudi]/[ldp-sd]
+    floors to >=1.21 and touched only pyproject.toml, so the job's authoritative
+    (non-continue-on-error) `floor` leg kept installing openvc-core 1.18 —
+    downgrading below the package's own constraint and leaving the version users
+    actually resolve at the bottom of the range tested by nothing. A gate in
+    tests/test_docs.py now fails if a literal pin comes back (#264).
+  - fix(build): stop the documented conda setup from reinstating the dropped
+    pycryptodome / python-ecdsa. `environment.yml` still listed both as runtime
+    dependencies although the #167 port moved every key path to `cryptography`
+    and v4.0.0 removed the last soft-import shim — so `conda env create` brought
+    back a package the project dropped partly for its permanent pip-audit flag
+    (CVE-2024-23342, "Minerva"), one the weekly Audit job believes is gone. Its
+    `pyjwt` floor was also stale at >=2.8, below the >=2.13 security floor. Both
+    corrected, and a gate in tests/test_docs.py now fails if environment.yml's
+    runtime block and the pyproject dependencies ever disagree again (#265).
+  - security(ob3): enforce the bundled JSON-LD contexts against their recorded
+    SHA-256 provenance. The module header of ob3/contexts/__init__.py records a
+    digest per pinned @context — the control that makes the fail-closed
+    allowlist meaningful, since RDF canonicalization resolves each context and
+    the bundled document therefore decides what a Data Integrity proof covers —
+    but nothing checked it: the scheduled context-drift job compares against
+    UPSTREAM over the network, a different property that cannot run on a PR. Two
+    offline gates now assert every bundled file matches its digest and that no
+    context ships without one (#266).
+  - fix(ob3): raise RegistryCorrupt, not a raw AttributeError, for a status
+    registry whose `entries` is not a JSON object. `StatusRegistry.load` guarded
+    (KeyError, TypeError, ValueError) but called `.items()` on the value
+    unchecked, so `"entries": []` (or a string) escaped as an AttributeError
+    past every caller — openbadges-publish, `openbadges status` and the signer
+    all trap StatusError/LibOpenBadgesException — turning a corrupt-registry
+    message into a traceback. The registry object and its `entries` are now
+    shape-checked with named messages, and AttributeError joined the caught
+    tuple as belt and braces (#259).
+  - docs(api): publish the issuance/verification facades in the API reference.
+    `issue_from_conf`, `verify_badge`, `IssuanceError` and `SignResult` were
+    listed in the top-level `__all__` "for pdoc" but resolved lazily through
+    `__getattr__`, and pdoc reads the module dict — so it warned that each was
+    unresolvable and published a content-free stub with no signature, type or
+    docstring, while `openbadgeslib.issue` / `.verify` got no page at all. The
+    recommended modern API was therefore absent from the canonical reference. All
+    four are now imported eagerly and both modules are exported (additions to
+    `__all__`, so no contract is broken), which costs ~1.7 ms on an ~80 ms import
+    that already pulls ob2/ob3/keys. A gate in tests/test_public_api.py fails if
+    an `__all__` name becomes lazily-resolved again (#267).
+
+
 * v4.0.0 - 2026-07-22
 
   Grouped breaking release (#170) — freeze the declared public contract and

{openbadgeslib-4.0.0 → openbadgeslib-4.1.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: openbadgeslib
-Version: 4.0.0
+Version: 4.1.0
 Summary: Production-ready Python library & CLI for Open Badges 3.0 (W3C Verifiable Credentials): issue, verify, and revoke JWT-VC credentials with Bitstring Status Lists and did:web — plus strict OB 2.0 and legacy OB 1.0.
 Author-email: Luis González Fernández <luisgf@luisgf.es>, Jesús Cea Avión <jcea@jcea.es>
 License: LGPLv3
@@ -31,12 +31,12 @@ Description-Content-Type: text/markdown
 License-File: LICENSE.txt
 Requires-Dist: pypng>=0.20220715.0
 Requires-Dist: PyJWT[crypto]>=2.13
-Requires-Dist: cryptography>=42
+Requires-Dist: cryptography>=45
 Requires-Dist: defusedxml>=0.7
 Provides-Extra: ldp
 Requires-Dist: pyld>=2.0.4; extra == "ldp"
 Provides-Extra: eudi
-Requires-Dist: openvc-core<2,>=1.21; extra == "eudi"
+Requires-Dist: openvc-core<2,>=1.23; extra == "eudi"
 Provides-Extra: ldp-sd
 Requires-Dist: openvc-core[data-integrity]<2,>=1.21; extra == "ldp-sd"
 Provides-Extra: dev
@@ -66,7 +66,7 @@ with W3C Bitstring Status Lists and `did:web`. It also ships strict
 **OpenBadges 2.0** (JWS / hosted assertions) and a frozen **OpenBadges 1.0**
 legacy format, selected with `-V {1,2,3}` (default `3`).
 
-> **Heads-up — 4.0.0 is coming.** Timed to Python 3.10's end of life (2026-10), the next major groups a few breaking changes: Python 3.10 is dropped (`requires-python >= 3.11`), the CLIs unify on one `0/1/2` exit-code contract, and the legacy pycryptodome/python-ecdsa compat shim is removed. OpenBadges 1.0 and the `openbadges-<command>` scripts stay. See **[Upgrading to 4.0](https://github.com/luisgf/openbadgeslib/wiki/Upgrading-to-4.0)** before pinning a major.
+> **4.0.0 is released** (2026-07-22). It groups the breaking changes so upgrades stay rare: every CLI unifies on one `0/1/2` exit-code contract (a valid-but-untrusted badge now exits `2`, and the 255s are gone), and the legacy pycryptodome/python-ecdsa compat shim is removed — a live key **object** from either is no longer accepted, though key *files* are plain PEM and round-trip unchanged. OpenBadges 1.0 and the `openbadges-<command>` scripts stay, and a new unified `openbadges <command>` front-end joins them. **Python 3.10 is still supported** (`requires-python >= 3.10`, tested in CI on 3.10–3.14); dropping it is deferred to its end of life. See **[Upgrading to 4.0](https://github.com/luisgf/openbadgeslib/wiki/Upgrading-to-4.0)** before pinning a major.
 
 ## Features
 

{openbadgeslib-4.0.0 → openbadgeslib-4.1.0}/README.md

@@ -13,7 +13,7 @@ with W3C Bitstring Status Lists and `did:web`. It also ships strict
 **OpenBadges 2.0** (JWS / hosted assertions) and a frozen **OpenBadges 1.0**
 legacy format, selected with `-V {1,2,3}` (default `3`).
 
-> **Heads-up — 4.0.0 is coming.** Timed to Python 3.10's end of life (2026-10), the next major groups a few breaking changes: Python 3.10 is dropped (`requires-python >= 3.11`), the CLIs unify on one `0/1/2` exit-code contract, and the legacy pycryptodome/python-ecdsa compat shim is removed. OpenBadges 1.0 and the `openbadges-<command>` scripts stay. See **[Upgrading to 4.0](https://github.com/luisgf/openbadgeslib/wiki/Upgrading-to-4.0)** before pinning a major.
+> **4.0.0 is released** (2026-07-22). It groups the breaking changes so upgrades stay rare: every CLI unifies on one `0/1/2` exit-code contract (a valid-but-untrusted badge now exits `2`, and the 255s are gone), and the legacy pycryptodome/python-ecdsa compat shim is removed — a live key **object** from either is no longer accepted, though key *files* are plain PEM and round-trip unchanged. OpenBadges 1.0 and the `openbadges-<command>` scripts stay, and a new unified `openbadges <command>` front-end joins them. **Python 3.10 is still supported** (`requires-python >= 3.10`, tested in CI on 3.10–3.14); dropping it is deferred to its end of life. See **[Upgrading to 4.0](https://github.com/luisgf/openbadgeslib/wiki/Upgrading-to-4.0)** before pinning a major.
 
 ## Features
 

{openbadgeslib-4.0.0 → openbadgeslib-4.1.0}/openbadgeslib/__init__.py

@@ -24,11 +24,11 @@
 from typing import Any
 
 # ── Submodule entry points ───────────────────────────────────────────────────
-# Bind ob2 / ob3 / errors as attributes so they are part of the explicit public
-# surface (and `from openbadgeslib import *`): ob2 (strict OB 2.0), ob3 (OB 3.0,
-# incl. ob3.eudi and ob3.OB3Ldp*), and the errors hierarchy rooted at
-# LibOpenBadgesException.
-from . import ob2, ob3, errors  # noqa: F401
+# Bind ob2 / ob3 / errors / issue / verify as attributes so they are part of the
+# explicit public surface (and `from openbadgeslib import *`): ob2 (strict
+# OB 2.0), ob3 (OB 3.0, incl. ob3.eudi and ob3.OB3Ldp*), the errors hierarchy
+# rooted at LibOpenBadgesException, and the issuance/verification facades.
+from . import ob2, ob3, errors, issue, verify  # noqa: F401
 
 # ── OpenBadges 2.0 (strict) ──────────────────────────────────────────────────
 from .ob2 import (  # noqa: F401
@@ -55,13 +55,20 @@ from ._ob1_api import OB1_API as _OB1_API  # noqa: F401
 # ── Issuance / verification API ──────────────────────────────────────────────
 # "Issue badge X to Y per config" / "verify this badge" as library calls — the
 # orchestration the CLIs wrap, returning a SignResult / VerifyResult instead of
-# doing I/O (openbadgeslib.issue, openbadgeslib.verify). Resolved lazily (PEP
-# 562, below) so a bare `import openbadgeslib` stays lightweight;
-# `from openbadgeslib.issue import ...` / `.verify import ...` work directly.
-_ISSUE_API = {
-    'IssuanceError': 'issue', 'SignResult': 'issue', 'issue_from_conf': 'issue',
-    'verify_badge': 'verify',
-}
+# doing I/O (openbadgeslib.issue, openbadgeslib.verify).
+#
+# Imported eagerly, unlike the OB1 names below. These were resolved lazily (PEP
+# 562) to keep a bare `import openbadgeslib` light, and listed in __all__ "for
+# pdoc" — but pdoc reads the module dict, so it could not resolve them and
+# published each as a content-free stub with no signature, type or docstring,
+# while openbadgeslib.issue / .verify got no page at all (#267). The laziness
+# bought ~1.7 ms against an ~80 ms import that already pulls ob2, ob3 and keys
+# (hence cryptography) — inside the run-to-run noise — so the documentation of
+# the recommended modern API is worth more than it.
+from .issue import (  # noqa: F401
+    IssuanceError, SignResult, issue_from_conf,
+)
+from .verify import verify_badge  # noqa: F401
 
 
 # ── OpenBadges 1.0 (legacy) ──────────────────────────────────────────────────
@@ -75,12 +82,6 @@ _ISSUE_API = {
 
 
 def __getattr__(name: str) -> Any:
-    if name in _ISSUE_API:
-        # The modern issuance / verification API — lazy so a bare import stays
-        # lightweight, but warning-free (unlike the OB1 names below).
-        import importlib
-        return getattr(
-            importlib.import_module('.' + _ISSUE_API[name], __name__), name)
     module = _OB1_API.get(name)
     if module is None:
         raise AttributeError(
@@ -99,12 +100,12 @@ def __getattr__(name: str) -> Any:
 # The stable, supported top-level surface (the "public contract" — see the
 # "Stable API vs internals" wiki/doc page). Everything else (the ob1.* legacy
 # names resolved lazily above, and any underscore-prefixed name) is internal.
-# The issuance/verification facades are resolved lazily by __getattr__ but are
-# part of the contract, so they are listed here for pdoc and `import *`.
+# Every name here is a real module attribute, so pdoc documents all of them —
+# see tests/test_public_api.py, which fails if one becomes unresolvable again.
 __all__ = [
     '__version__',
-    # Subpackage entry points.
-    'ob2', 'ob3', 'errors',
+    # Subpackage / module entry points.
+    'ob2', 'ob3', 'errors', 'issue', 'verify',
     # OpenBadges 2.0 (strict).
     'OB2Signer', 'OB2Verifier', 'OB2VerificationError',
     # OpenBadges 3.0.
@@ -112,6 +113,6 @@ __all__ = [
     'OpenBadgeCredential', 'Achievement', 'Issuer',
     # Keys (KeyEd25519 is the recommended OB 3.0 / LDP key type).
     'KeyFactory', 'KeyRSA', 'KeyECC', 'KeyEd25519',
-    # Programmatic issue / verify facades (resolved lazily).
+    # Programmatic issue / verify facades.
     'issue_from_conf', 'verify_badge', 'IssuanceError', 'SignResult',
 ]

{openbadgeslib-4.0.0 → openbadgeslib-4.1.0}/openbadgeslib/config.ini.example

@@ -45,6 +45,12 @@ revocationList = revoked.json
 ; issuer. 'auto': derive a did:web DID from publish_url (openbadges-publish
 ; -V 3 generates the matching did.json). An explicit did:web:... is used as-is.
 ;did            = auto
+; EUDI SD-JWT VC track (optional): an issuer-hosted vct URL, which must live
+; under publish_url. openbadges-publish -V 3 then writes its SD-JWT VC Type
+; Metadata into the published folder so wallets can resolve and validate
+; SD-JWT badges. Unset: nothing is published and badges use the default
+; imsglobal vct.
+;sd_jwt_vct     = ${publish_url}vct/openbadge
 
 ;Badge configuration sections.
 [badge_1]
@@ -53,6 +59,10 @@ description = Given to any user that install this library
 local_image = image_badge1.svg
 image       = https://www.issuer.badge/issuer/badge_1/badge1.svg
 criteria    = https://www.issuer.badge/issuer/badge_1/criteria.html
+; OpenBadges 3.0 achievement criteria narrative (free text). Falls back to the
+; 'criteria' URL above when unset, which is rarely what you want in a
+; credential a human reads.
+;criteria_narrative = Awarded to anyone who installs this library
 verify_key  = https://www.issuer.badge/issuer/badge_1/verify_rsa_key.pem
 badge       = https://www.issuer.badge/issuer/badge_1/badge.json
 ; OpenBadges 2.0 (-V 2): URL of this badge's CryptographicKey JSON-LD document
@@ -88,8 +98,6 @@ key_type    = RSA
 ; lapses; pick a cadence you can sustain (e.g. 7 => weekly). Unset = no bound
 ; (offline-friendly, but publishes a loud warning).
 ;status_validity_days = 7
-;alignement  =
-;tags        =
 ;mail        = ${paths:base}/badge_1_mail.txt
 
 [badge_2]
@@ -105,6 +113,4 @@ hosted_assertions_base = https://www.issuer.badge/issuer/badge_2/assertions/
 private_key = ${paths:base_key}/sign_rsa_key_2.pem
 public_key  = ${paths:base_key}/verify_rsa_key_2.pem
 key_type    = RSA
-;alignement =
-;tags       =
 ;mail       = ${paths:base}/badge_2_mail.txt

{openbadgeslib-4.0.0 → openbadgeslib-4.1.0}/openbadgeslib/keys.py

@@ -29,7 +29,9 @@
 # ``key_to_pem`` now takes only ``cryptography`` key objects and PEM bytes/str.
 
 from typing import Any, Optional, Tuple, Union, cast
-from .errors import PublicKeyReadError, UnknownKeyType
+from .errors import (
+    GenPrivateKeyError, PrivateKeyReadError, PublicKeyReadError, UnknownKeyType)
+from cryptography.exceptions import UnsupportedAlgorithm
 from cryptography.hazmat.primitives import serialization as _crypto_serialization
 from cryptography.hazmat.primitives.asymmetric import ec, rsa
 from cryptography.hazmat.primitives.asymmetric.ed25519 import (
@@ -38,6 +40,32 @@ from enum import Enum
 import logging
 logger = logging.getLogger(__name__)
 
+# What a failed PEM load raises depends on the `cryptography` version: up to v46
+# an unsupported key algorithm came back as ValueError; **v47 changed the
+# contract** to UnsupportedAlgorithm (which is NOT a ValueError). Our floor
+# spans that change, so both are caught in one place and mapped onto the
+# library's own taxonomy — a caller must never have to know which cryptography
+# it resolved, and a raw crypto exception must never escape as a traceback.
+_PEM_LOAD_ERRORS = (ValueError, TypeError, UnsupportedAlgorithm)
+
+
+def _load_private_pem(data: bytes) -> Any:
+    """Load a private key PEM, mapping any load failure to PrivateKeyReadError."""
+    try:
+        return _crypto_serialization.load_pem_private_key(data, password=None)
+    except _PEM_LOAD_ERRORS as exc:
+        raise PrivateKeyReadError(
+            'Unable to read private key PEM: %s' % exc) from exc
+
+
+def _load_public_pem(data: bytes) -> Any:
+    """Load a public key PEM, mapping any load failure to PublicKeyReadError."""
+    try:
+        return _crypto_serialization.load_pem_public_key(data)
+    except _PEM_LOAD_ERRORS as exc:
+        raise PublicKeyReadError(
+            'Unable to read public key PEM: %s' % exc) from exc
+
 
 class KeyType(Enum):
     RSA = 'RSA 2048'
@@ -100,20 +128,26 @@ class KeyRSA(KeyBase):
 
     def generate_keypair(self) -> Tuple[bytes, bytes]:
         """ Generate a RSA Key, returning in PEM Format """
-        self.priv_key = rsa.generate_private_key(
-            public_exponent=65537, key_size=self._key_size)
+        try:
+            self.priv_key = rsa.generate_private_key(
+                public_exponent=65537, key_size=self._key_size)
+        except (ValueError, UnsupportedAlgorithm) as exc:
+            # cryptography v48 enforces a 1024-bit floor on key_size; below it
+            # (and on any other refused parameter) this must be a library error,
+            # not a raw traceback out of the CLI.
+            raise GenPrivateKeyError(
+                'Unable to generate a %d-bit RSA key: %s'
+                % (self._key_size, exc)) from exc
         self.pub_key = self.priv_key.public_key()
         return self.get_priv_key_pem(), self.get_pub_key_pem()
 
     def read_private_key(self, key_pem: Any = None) -> None:
         """ Read the private key from param in PEM format """
-        self.priv_key = _crypto_serialization.load_pem_private_key(
-            _pem_bytes(key_pem), password=None)
+        self.priv_key = _load_private_pem(_pem_bytes(key_pem))
 
     def read_public_key(self, key_pem: Any = None) -> None:
         """ Read the public key from param in PEM format """
-        self.pub_key = _crypto_serialization.load_pem_public_key(
-            _pem_bytes(key_pem))
+        self.pub_key = _load_public_pem(_pem_bytes(key_pem))
 
     def get_priv_key_pem(self) -> bytes:
         return _private_pem(self.priv_key)
@@ -137,13 +171,11 @@ class KeyECC(KeyBase):
 
     def read_private_key(self, key_pem: Any = None) -> None:
         """ Read the private key from param in PEM format """
-        self.priv_key = _crypto_serialization.load_pem_private_key(
-            _pem_bytes(key_pem), password=None)
+        self.priv_key = _load_private_pem(_pem_bytes(key_pem))
 
     def read_public_key(self, key_pem: Any = None) -> None:
         """ Read the public key from param in PEM format """
-        self.pub_key = _crypto_serialization.load_pem_public_key(
-            _pem_bytes(key_pem))
+        self.pub_key = _load_public_pem(_pem_bytes(key_pem))
 
     def get_priv_key_pem(self) -> bytes:
         return _private_pem(self.priv_key)
@@ -155,7 +187,7 @@ class KeyECC(KeyBase):
 def _load_ed25519_private_key(key_pem: Optional[Union[str, bytes]]) -> Ed25519PrivateKey:
     if key_pem is None:
         raise UnknownKeyType('No Ed25519 private key PEM provided')
-    key = _crypto_serialization.load_pem_private_key(_pem_bytes(key_pem), password=None)
+    key = _load_private_pem(_pem_bytes(key_pem))
     if not isinstance(key, Ed25519PrivateKey):
         raise UnknownKeyType('PEM is not an Ed25519 private key')
     return key
@@ -164,7 +196,7 @@ def _load_ed25519_private_key(key_pem: Optional[Union[str, bytes]]) -> Ed25519Pr
 def _load_ed25519_public_key(key_pem: Optional[Union[str, bytes]]) -> Ed25519PublicKey:
     if key_pem is None:
         raise UnknownKeyType('No Ed25519 public key PEM provided')
-    key = _crypto_serialization.load_pem_public_key(_pem_bytes(key_pem))
+    key = _load_public_pem(_pem_bytes(key_pem))
     if not isinstance(key, Ed25519PublicKey):
         raise UnknownKeyType('PEM is not an Ed25519 public key')
     return key
@@ -249,7 +281,7 @@ def public_jwk_from_pem(pubkey_pem: Union[str, bytes]) -> dict[str, Any]:
     import json
     from jwt.algorithms import ECAlgorithm, OKPAlgorithm, RSAAlgorithm
     try:
-        pub = _crypto_serialization.load_pem_public_key(_pem_bytes(pubkey_pem))
+        pub = _load_public_pem(_pem_bytes(pubkey_pem))
         if isinstance(pub, rsa.RSAPublicKey):
             jwk_json = RSAAlgorithm.to_jwk(pub)
         elif isinstance(pub, ec.EllipticCurvePublicKey):
@@ -277,12 +309,9 @@ def ec_curve_from_pem(pem_data: Union[str, bytes]) -> Optional[str]:
     fixes the JOSE algorithm.
     """
     data = _pem_bytes(pem_data)
-    for load in (
-        lambda: _crypto_serialization.load_pem_public_key(data),
-        lambda: _crypto_serialization.load_pem_private_key(data, password=None),
-    ):
+    for load in (_load_public_pem, _load_private_pem):
         try:
-            key = load()
+            key = load(data)
         except Exception:
             continue
         if isinstance(key, (ec.EllipticCurvePublicKey,
@@ -302,12 +331,9 @@ def detect_key_type(pem_data: Union[str, bytes]) -> 'KeyType':
     """
     data = _pem_bytes(pem_data)
     key: Any = None
-    for load in (
-        lambda: _crypto_serialization.load_pem_public_key(data),
-        lambda: _crypto_serialization.load_pem_private_key(data, password=None),
-    ):
+    for load in (_load_public_pem, _load_private_pem):
         try:
-            key = load()
+            key = load(data)
             break
         except Exception:
             continue

{openbadgeslib-4.0.0 → openbadgeslib-4.1.0}/openbadgeslib/ob2/verifier.py

@@ -60,7 +60,8 @@ class OB2Verifier:
     * **HostedBadge** — the assertion is fetched over HTTPS from its own ``id``;
       that retrieval (scoped to the issuer's origin) is the trust anchor, per
       the OB 2.0 hosted model. The baked JWS is verified as non-gating
-      defence-in-depth only.
+      defence-in-depth only, so the fetched document — not the baked one — is
+      what every check runs on and what ``verify()`` returns.
 
     Args:
         pubkey_pem: Optional PEM-encoded trusted public key. When supplied it is
@@ -86,7 +87,11 @@ class OB2Verifier:
         """Verify a compact-JWS OB 2.0 assertion token.
 
         Returns the decoded :class:`~openbadgeslib.ob2.models.Assertion` on
-        success; raises :class:`OB2VerificationError` on any failure.
+        success; raises :class:`OB2VerificationError` on any failure. For a
+        HostedBadge the returned assertion is the one **fetched from its id**
+        (the trust anchor), not the copy baked into the image — so a member the
+        baked copy alone carried, such as ``evidence`` or ``narrative``, never
+        reaches the caller.
 
         ``expected_recipient`` (an email) additionally binds the assertion to a
         recipient by re-hashing it with the embedded salt. ``check_revocation``
@@ -100,7 +105,10 @@ class OB2Verifier:
             raise OB2VerificationError("Malformed OB 2.0 assertion: %s" % exc) from exc
 
         if assertion.verification.type == "HostedBadge":
-            self._verify_hosted(assertion, token)
+            # The fetched copy is the trust anchor, so it replaces the local one:
+            # every check below (and the returned object) must speak for the
+            # document the issuer serves, not the one baked into the image.
+            assertion = self._verify_hosted(assertion, token)
         else:
             self._verify_signed(assertion, token)
 
@@ -164,14 +172,25 @@ class OB2Verifier:
 
     # ── hosted path ──────────────────────────────────────────────────────────────
 
-    def _verify_hosted(self, assertion: Assertion, token: str) -> None:
-        """Verify a HostedBadge assertion by fetching its ``id`` over HTTPS.
+    def _verify_hosted(self, assertion: Assertion, token: str) -> Assertion:
+        """Verify a HostedBadge assertion by fetching its ``id`` over HTTPS and
+        return the AUTHORITATIVE assertion parsed from that fetch.
 
         The fetched document is the authoritative copy; its origin must fall
         within the issuer's scope (default: same origin as the issuer Profile
         ``id``; or the issuer's ``verification.startsWith`` / ``allowedOrigins``
         when declared). The baked JWS is verified only as non-gating
         defence-in-depth.
+
+        Returning the fetched assertion — rather than reconciling a fixed list
+        of members and keeping the local one — is what makes "the hosted copy is
+        the trust anchor" true for the *whole* document. Only id/recipient/badge/
+        issuedOn/expires used to be compared, so ``image``, ``evidence`` and
+        ``narrative`` stayed holder-controlled on a badge reported valid and
+        trusted (the baked JWS is non-gating here, so a re-baked local copy costs
+        the holder nothing). The equality checks below stay: they still catch a
+        local copy claiming an ``id`` that legitimately hosts something else.
+        Consequence: the served document must itself be a valid OB 2.0 Assertion.
         """
         assert assertion.id is not None
         fetched = self._fetch_json(assertion.id, "hosted assertion")
@@ -217,22 +236,36 @@ class OB2Verifier:
                 "Hosted assertion at %s does not match the badge's local "
                 "claims (field 'expires' differs)" % (assertion.id,))
 
-        issuer = self._fetch_issuer(assertion)
+        # Everything reconciled: adopt the served document as the assertion this
+        # verification speaks for. It must parse as a strict OB 2.0 Assertion —
+        # it IS the assertion, not a copy of it.
+        try:
+            authoritative = Assertion.from_dict(fetched)
+        except ValueError as exc:
+            raise OB2VerificationError(
+                "Hosted assertion at %s is not a valid OpenBadges 2.0 Assertion: %s"
+                % (assertion.id, exc)) from exc
+
+        issuer = self._fetch_issuer(authoritative)
+        # assertion.id is the fetched id (proven equal above) and is known
+        # non-None, which authoritative.id is only by from_dict's contract.
         self._check_hosted_scope(assertion.id, issuer)
 
         # Defence-in-depth: if the baked token also carries a resolvable key,
         # verify it, but never fail the hosted verdict on it (a hosted badge is
-        # not required to be signed at all).
+        # not required to be signed at all). The creator comes from the
+        # authoritative copy, so this never dereferences a holder-chosen URL.
         try:
             if self.trusted_pubkey_pem is not None:
                 self._verify_jws(token, self.trusted_pubkey_pem)
-            elif assertion.verification.creator:
-                key = self._resolve_creator(assertion.verification.creator)
+            elif authoritative.verification.creator:
+                key = self._resolve_creator(authoritative.verification.creator)
                 self._verify_jws(token, key.public_key_pem.encode('utf-8'))
         except OB2VerificationError as exc:
             logger.debug("Hosted assertion %s: baked JWS did not verify (%s); "
                          "hosted trust comes from the HTTPS fetch, not the signature.",
                          assertion.id, exc)
+        return authoritative
 
     def _check_hosted_scope(self, assertion_id: str, issuer: dict[str, Any]) -> None:
         """Enforce the OB 2.0 hosted-verification scope for ``assertion_id``."""