openbadgeslib 4.4.3__tar.gz → 4.5.0__tar.gz

{openbadgeslib-4.4.3 → openbadgeslib-4.5.0}/Changelog.txt

@@ -4,6 +4,59 @@ OpenBadgesLib - Changelog
 Newest first. Dates are ISO 8601 (YYYY-MM-DD).
 
 
+* v4.5.0 - 2026-09-12
+
+  - feat(ob3): public `decode_encoded_list(encoded) -> bytes` and
+    `set_indices(bitstring) -> frozenset[int]` for a published Bitstring
+    Status List `encodedList` (#322). Same multibase `u` / base64url /
+    bounded-gzip (5 MiB) / MSB-first decode the verifier already uses;
+    the private `_decode_encoded_list` name remains as a thin alias.
+
+  - feat(ob3): `build_status_list_credential(..., ttl=)` writes Bitstring
+    Status List §2.2 `ttl` (milliseconds) on `credentialSubject`, never at
+    the top level — `ttl` is a JSON-LD term scoped to `BitstringStatusList`,
+    so a top-level copy would not be signed (#321). Negative values raise
+    `ValueError`.
+
+  - feat(ob3): native CLR 2.0 `ClrCredential` builder (`build_clr_credential`,
+    `sign_clr_credential`) with the versioned `context-2.0.1.json` bundled
+    and hash-pinned (`CLR_CONTEXT_SHA256`) (#323). Identifier objects and
+    member credentials are copied as given — email hashing and member-count
+    caps stay downstream. Signing injects the pinned context via
+    `extra_contexts` (requires `[ldp]`).
+
+  - feat(ob2): `OB2Verifier.verify_hosted(document)` verifies a hosted
+    assertion JSON document (dict or JSON string) without synthesizing a
+    dummy JWS. The HTTPS fetcher is injectable via
+    `OB2Verifier(..., download=)`.
+
+
+* v4.4.4 - 2026-09-10
+
+  - security(baking): SVG baking strips ``<script>`` / ``foreignObject`` /
+    event-handler attributes and ``javascript:`` / hostile ``data:`` URLs
+    from the carrier so a source image cannot turn a baked badge into an
+    XSS gadget.
+  - security(ob3): ``ecdsa-sd-2023`` presentations that omit ``validUntil``
+    or ``credentialStatus`` fail closed — a holder can no longer hide expiry
+    or revocation behind selective disclosure.
+  - security(oid4vci): explicit ``credential_endpoint`` / ``token_endpoint``
+    / ``nonce_endpoint`` overrides must be absolute ``https://`` URLs, not
+    plaintext HTTP.
+  - security(cli): ``signer.log`` is created and kept at mode ``0600``
+    (recipient emails); a file inherited from a permissive umask is
+    tightened on the next append.
+  - security(ci): wiki-sync authenticates clone/push with an HTTP extraheader
+    instead of embedding ``GITHUB_TOKEN`` in the git remote URL.
+  - security(mail): SMTP connections time out after 30 s; plaintext SMTP to
+    a non-loopback host is upgraded with STARTTLS (validating context).
+  - security(util): ``allow_insecure=True`` HTTP downloads pin the connect
+    IP the same way HTTPS already did (DNS rebinding).
+  - security(oid4vci): a live PIN-gated offer presented without ``tx_code``
+    returns the same ``invalid_grant`` as an unknown code, so the token
+    endpoint is not an oracle for which offers are PIN-gated.
+
+
 * v4.4.3 - 2026-08-18
 
   - security(oid4vci): an issuer that advertises

{openbadgeslib-4.4.3 → openbadgeslib-4.5.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: openbadgeslib
-Version: 4.4.3
+Version: 4.5.0
 Summary: Production-ready Python library & CLI for Open Badges 3.0 (W3C Verifiable Credentials): issue, verify, and revoke JWT-VC credentials with Bitstring Status Lists and did:web — plus strict OB 2.0 and legacy OB 1.0.
 Author-email: Luis González Fernández <luisgf@luisgf.es>, Jesús Cea Avión <jcea@jcea.es>
 License: LGPLv3

{openbadgeslib-4.4.3 → openbadgeslib-4.5.0}/openbadgeslib/baking.py

@@ -29,7 +29,7 @@
 from struct import pack
 from zlib import crc32
 
-from typing import List, Optional, Tuple, Union, cast
+from typing import Any, List, Optional, Tuple, Union, cast
 
 from defusedxml.minidom import parseString
 from png import Reader, signature as _png_signature
@@ -76,6 +76,66 @@ def _bounded_inflate(data: bytes, limit: int = MAX_ITXT_DECOMPRESSED) -> bytes:
 
 # ── SVG ─────────────────────────────────────────────────────────────────────
 
+# Active content stripped from the carrier at bake time. A baked badge is an
+# image a recipient may open in a browser; leaving <script>, on* handlers or
+# javascript: URLs in the source SVG would execute in that context (#328).
+# `opacity` is the one SVG presentation attribute whose local name starts
+# with "on" and is not an event handler.
+_ACTIVE_SVG_ELEMENTS = frozenset({
+    'script', 'foreignobject', 'iframe', 'embed', 'object', 'handler',
+})
+_URL_ATTRS = frozenset({'href', 'src', 'action'})
+_SAFE_DATA_IMAGE_TYPES = (
+    'image/png', 'image/jpeg', 'image/jpg', 'image/gif', 'image/webp',
+)
+
+
+def _svg_local_name(node: Any) -> str:
+    return str(node.tagName).split(':')[-1].lower()
+
+
+def _iter_svg_elements(node: Any) -> List[Any]:
+    found: List[Any] = []
+    if getattr(node, 'nodeType', None) == node.ELEMENT_NODE:
+        found.append(node)
+        for child in list(node.childNodes):
+            found.extend(_iter_svg_elements(child))
+    return found
+
+
+def _is_active_url(value: str) -> bool:
+    """True for javascript:/vbscript: and for data: that is not a raster image."""
+    lowered = value.strip().lower()
+    if lowered.startswith('javascript:') or lowered.startswith('vbscript:'):
+        return True
+    if not lowered.startswith('data:'):
+        return False
+    payload = lowered[5:]
+    return not any(payload.startswith(kind) for kind in _SAFE_DATA_IMAGE_TYPES)
+
+
+def _strip_svg_active_content(root: Any) -> None:
+    """Drop script-class elements, on* handlers and active URLs under *root*."""
+    if root is None:
+        return
+    for el in _iter_svg_elements(root):
+        if _svg_local_name(el) in _ACTIVE_SVG_ELEMENTS:
+            parent = el.parentNode
+            if parent is not None:
+                parent.removeChild(el)
+    for el in _iter_svg_elements(root):
+        attrs = el.attributes
+        if attrs is None:
+            continue
+        for name in list(attrs.keys()):
+            local = name.split(':')[-1].lower()
+            if local.startswith('on') and local != 'opacity':
+                el.removeAttribute(name)
+                continue
+            if local in _URL_ATTRS and _is_active_url(attrs[name].value):
+                el.removeAttribute(name)
+
+
 def bake_svg(image_bytes: bytes, token: str, comment: Optional[str] = None, *,
              element: str = SVG_ELEMENT, namespace: str = SVG_NS,
              as_text: bool = False) -> bytes:
@@ -87,10 +147,15 @@ def bake_svg(image_bytes: bytes, token: str, comment: Optional[str] = None, *,
     instead of the ``verify`` attribute — the OB 3.0 carrier for credentials
     secured with a Data Integrity proof, whose payload is a JSON document
     rather than a compact JWT (OB 3.0 §5.3).
+
+    Active content in the source SVG (``<script>``, event-handler attributes,
+    ``javascript:`` / hostile ``data:`` URLs) is stripped before the token is
+    attached, so the baked carrier is not an XSS gadget (#328).
     """
     svg_doc = parseString(image_bytes)
     try:
         svg_tag = svg_doc.getElementsByTagName('svg').item(0)
+        _strip_svg_active_content(svg_tag)
         node = svg_doc.createElement(element)
         node.attributes['xmlns:openbadges'] = namespace
         if as_text:

{openbadgeslib-4.4.3 → openbadgeslib-4.5.0}/openbadgeslib/confparser.py

@@ -305,7 +305,15 @@ def oid4vci_config(conf: ConfigParser) -> OID4VCIConfig:
 
     def endpoint(key: str, default_path: str) -> str:
         explicit = (section.get(key) or '').strip() if section else ''
-        return explicit or urljoin(endpoint_base, default_path)
+        url = explicit or urljoin(endpoint_base, default_path)
+        # Derived endpoints inherit https from credential_issuer; an explicit
+        # override can be any string, and a plaintext http URL would advertise
+        # a token/credential/nonce endpoint wallets POST secrets to (#328).
+        if not url.startswith('https://'):
+            raise ConfigError(
+                "[oid4vci] %s must be an absolute https URL, got %r"
+                % (key, url))
+        return url
 
     store_path = (section.get('store_path') if section else None) or \
         os.path.join(conf['paths']['base'], 'oid4vci.sqlite3')

{openbadgeslib-4.4.3 → openbadgeslib-4.5.0}/openbadgeslib/mail.py

@@ -33,6 +33,18 @@ from email.header import Header
 from .badge_model import BadgeImgType   # version-neutral model (was ob1.badge)
 from .errors import BadgeImgFormatUnsupported
 
+#: Per-operation socket timeout for SMTP connect/read/write. smtplib's
+#: default is None (block forever).
+SMTP_TIMEOUT_SECONDS = 30
+
+
+def _smtp_is_loopback(host: str) -> bool:
+    """True for the hostnames/addresses operators use for a local MTA."""
+    name = host.strip().lower()
+    if name.startswith('[') and name.endswith(']'):
+        name = name[1:-1]
+    return name in ('localhost', '127.0.0.1', '::1')
+
 
 class BadgeMail():
     def __init__(self, smtp_server: str = 'localhost', smtp_port: int = 25,
@@ -83,9 +95,17 @@ class BadgeMail():
                 # CERT_NONE), which would let an on-path attacker intercept the
                 # connection and capture the AUTH credentials sent below.
                 smtp = SMTP_SSL(self.smtp_server, self.smtp_port,
+                                timeout=SMTP_TIMEOUT_SECONDS,
                                 context=ssl.create_default_context())
             else:
-                smtp = SMTP(self.smtp_server, self.smtp_port)
+                smtp = SMTP(self.smtp_server, self.smtp_port,
+                            timeout=SMTP_TIMEOUT_SECONDS)
+                # Plain SMTP to a non-loopback host is upgraded with STARTTLS
+                # so the message (and any later AUTH) is not sent in the
+                # clear. localhost is left alone: a local MTA often has no
+                # TLS listener on :25 (#328).
+                if not _smtp_is_loopback(self.smtp_server):
+                    smtp.starttls(context=ssl.create_default_context())
 
             if self.username:
                 smtp.login(self.username, self.password)

{openbadgeslib-4.4.3 → openbadgeslib-4.5.0}/openbadgeslib/ob2/verifier.py

@@ -22,7 +22,7 @@
 
 import logging
 from datetime import datetime, timezone
-from typing import Any, List, Optional, Union
+from typing import Any, Callable, List, Optional, Union
 from urllib.parse import urlparse
 
 from .models import Assertion, CryptographicKey, hash_identity, _parse_iso
@@ -67,10 +67,16 @@ class OB2Verifier:
         pubkey_pem: Optional PEM-encoded trusted public key. When supplied it is
                     used to verify SignedBadge assertions and skips resolving the
                     badge-declared key.
+        download: Optional ``url -> bytes`` fetcher used by hosted verification
+                  (assertion id, BadgeClass, issuer Profile, revocation list).
+                  Defaults to :func:`download_file` (HTTPS-only, size-capped).
     """
 
-    def __init__(self, pubkey_pem: Optional[Any] = None) -> None:
+    def __init__(self, pubkey_pem: Optional[Any] = None, *,
+                 download: Optional[Callable[[str], bytes]] = None) -> None:
         self.trusted_pubkey_pem: Optional[Union[str, bytes]] = None
+        self._download: Callable[[str], bytes] = (
+            download if download is not None else download_file)
         if pubkey_pem is not None:
             pem = key_to_pem(pubkey_pem)
             try:
@@ -122,6 +128,67 @@ class OB2Verifier:
 
         return assertion
 
+    def verify_hosted(self, document: Union[str, dict[str, Any]], *,
+                      expected_recipient: Optional[str] = None,
+                      check_revocation: bool = False) -> Assertion:
+        """Verify a hosted OB 2.0 assertion JSON document (not a compact JWS).
+
+        *document* is the assertion as a dict or a JSON string. The hosted
+        model is fetch-from-id: the copy served at ``assertion.id`` is the
+        trust anchor (scoped to the issuer Profile), so this does not
+        synthesize a dummy JWS. Defence-in-depth JWS verification inside
+        :meth:`_verify_hosted` is skipped when there is no token.
+
+        ``expected_recipient`` and ``check_revocation`` behave as in
+        :meth:`verify`. Raises :class:`OB2VerificationError` if the document
+        is not a HostedBadge assertion or if any check fails.
+        """
+        parsed = self._hosted_document(document)
+        try:
+            assertion = Assertion.from_dict(parsed)
+        except ValueError as exc:
+            raise OB2VerificationError(
+                "Malformed OB 2.0 assertion: %s" % exc) from exc
+        if assertion.verification.type != "HostedBadge":
+            raise OB2VerificationError(
+                "verify_hosted() requires verification.type HostedBadge, got %r"
+                % assertion.verification.type)
+
+        assertion = self._verify_hosted(assertion, "")
+
+        self._check_expiration(assertion)
+
+        if expected_recipient is not None:
+            self._check_identity(assertion, expected_recipient)
+
+        if check_revocation:
+            self._check_revocation(assertion)
+
+        return assertion
+
+    @staticmethod
+    def _hosted_document(document: Union[str, dict[str, Any]]) -> dict[str, Any]:
+        """Parse a hosted assertion from a dict or JSON string (never a JWS)."""
+        if isinstance(document, str):
+            text = document.strip()
+            if text.count('.') == 2 and not text.startswith('{'):
+                raise OB2VerificationError(
+                    "verify_hosted() expects a hosted assertion JSON document, "
+                    "not a compact JWS; use verify() for SignedBadge tokens")
+            try:
+                parsed = jws_utils.from_json(text)
+            except Exception as exc:
+                raise OB2VerificationError(
+                    "hosted assertion is not valid JSON: %s" % exc) from exc
+        elif isinstance(document, dict):
+            parsed = document
+        else:
+            raise OB2VerificationError(
+                "hosted assertion must be a dict or JSON string")
+        if not isinstance(parsed, dict):
+            raise OB2VerificationError("hosted assertion is not a JSON object")
+        return parsed
+
     # ── signed path ──────────────────────────────────────────────────────────────
 
     def _verify_signed(self, assertion: Assertion, token: str) -> None:
@@ -255,16 +322,18 @@ class OB2Verifier:
         # verify it, but never fail the hosted verdict on it (a hosted badge is
         # not required to be signed at all). The creator comes from the
         # authoritative copy, so this never dereferences a holder-chosen URL.
-        try:
-            if self.trusted_pubkey_pem is not None:
-                self._verify_jws(token, self.trusted_pubkey_pem)
-            elif authoritative.verification.creator:
-                key = self._resolve_creator(authoritative.verification.creator)
-                self._verify_jws(token, key.public_key_pem.encode('utf-8'))
-        except OB2VerificationError as exc:
-            logger.debug("Hosted assertion %s: baked JWS did not verify (%s); "
-                         "hosted trust comes from the HTTPS fetch, not the signature.",
-                         assertion.id, exc)
+        # verify_hosted() passes an empty token (there is no JWS); skip then.
+        if token:
+            try:
+                if self.trusted_pubkey_pem is not None:
+                    self._verify_jws(token, self.trusted_pubkey_pem)
+                elif authoritative.verification.creator:
+                    key = self._resolve_creator(authoritative.verification.creator)
+                    self._verify_jws(token, key.public_key_pem.encode('utf-8'))
+            except OB2VerificationError as exc:
+                logger.debug("Hosted assertion %s: baked JWS did not verify (%s); "
+                             "hosted trust comes from the HTTPS fetch, not the signature.",
+                             assertion.id, exc)
         return authoritative
 
     def _check_hosted_scope(self, assertion_id: str, issuer: dict[str, Any]) -> None:
@@ -373,7 +442,7 @@ class OB2Verifier:
 
     def _fetch_json(self, url: str, where: str) -> dict[str, Any]:
         try:
-            raw = download_file(url)
+            raw = self._download(url)
         except Exception as exc:
             raise OB2VerificationError(
                 "Could not fetch %s at %s: %s" % (where, url, exc)) from exc

{openbadgeslib-4.4.3 → openbadgeslib-4.5.0}/openbadgeslib/ob3/__init__.py

@@ -27,9 +27,12 @@ from .verifier import (OB3VerificationError, OB3Verifier,
                        verify_endorsement_jwt)
 from .ldp import (OB3LdpSigner, OB3LdpVerifier, add_data_integrity_proof,
                   verify_data_integrity_proof)
-from .status import check_credential_status
+from .status import check_credential_status, decode_encoded_list, set_indices
 from .status_list import (build_status_list_credential, encode_bitstring,
                           sign_status_list_credential, status_entry)
+from .clr import (CLR_CONTEXT_SHA256, CLR_CONTEXT_URL, OB_V3_CONTEXT,
+                  VCDM_V2_CONTEXT, build_clr_credential, bundled_clr_contexts,
+                  sign_clr_credential)
 from .status_registry import StatusRegistry
 from .did import (build_did_document, did_jwk_from_jwk, did_key_from_pem,
                   did_web_from_url, multikey_from_pem, resolve_did,
@@ -68,16 +71,25 @@ __all__ = [
     'verify_data_integrity_proof',
     'StatusRegistry',
     'build_did_document',
+    'build_clr_credential',
     'build_status_list_credential',
+    'bundled_clr_contexts',
     'check_credential_status',
+    'CLR_CONTEXT_SHA256',
+    'CLR_CONTEXT_URL',
+    'decode_encoded_list',
     'did_jwk_from_jwk',
     'did_key_from_pem',
     'did_web_from_url',
     'encode_bitstring',
     'multikey_from_pem',
+    'OB_V3_CONTEXT',
     'resolve_did',
     'resolve_verification_method',
+    'set_indices',
+    'sign_clr_credential',
     'sign_status_list_credential',
     'status_entry',
+    'VCDM_V2_CONTEXT',
     'verify_endorsement_jwt',
 ]

openbadgeslib-4.5.0/openbadgeslib/ob3/clr.py

@@ -0,0 +1,176 @@
+"""
+        OpenBadges Library
+
+        Copyright (c) 2014-2026, Luis González Fernández, luisgf@luisgf.es
+        Copyright (c) 2014-2026, Jesús Cea Avión, jcea@jcea.es
+
+        All rights reserved.
+
+        This library is free software; you can redistribute it and/or
+        modify it under the terms of the GNU Lesser General Public
+        License as published by the Free Software Foundation; either
+        version 3.0 of the License, or (at your option) any later version.
+
+        This library is distributed in the hope that it will be useful,
+        but WITHOUT ANY WARRANTY; without even the implied warranty of
+        MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+        Lesser General Public License for more details.
+
+        You should have received a copy of the GNU Lesser General Public
+        License along with this library.
+"""
+
+# 1EdTech Comprehensive Learner Record 2.0 (Final v1.1) ClrCredential assembly.
+#
+# Builds an unsigned JSON-LD envelope whose credentialSubject.verifiableCredential
+# array embeds already-signed member documents by value. Email hashing and
+# member-count caps are product policy and stay downstream: this module copies
+# the identifier objects and members it is given.
+#
+# The CLR JSON-LD context is pinned to the VERSIONED 2.0.1 revision. 1EdTech's
+# unversioned …/clr/v2p0/context.json endpoint serves a stub whose ClrSubject
+# scope defines no ``identifier`` term — signing against it silently drops the
+# learner binding from the RDF. The versioned bytes are bundled next to the
+# other contexts and hash-checked on every load so a bad bundle fails closed.
+
+import copy
+import hashlib
+import json
+
+from datetime import datetime, timezone
+from importlib import resources
+from typing import Any, Mapping, Optional, Sequence, Union
+
+from ..errors import LibOpenBadgesException
+from . import contexts as _contexts
+from .credential import _iso
+
+VCDM_V2_CONTEXT = "https://www.w3.org/ns/credentials/v2"
+OB_V3_CONTEXT = "https://purl.imsglobal.org/spec/ob/v3p0/context-3.0.3.json"
+CLR_CONTEXT_URL = "https://purl.imsglobal.org/spec/clr/v2p0/context-2.0.1.json"
+CLR_CONTEXT_SHA256 = "880f1902d4158f2f33ce06af41b90719977cd1ea337a9de2e41edb3ff5e543d6"
+
+_CLR_CONTEXT_RESOURCE = "clr_context_2.0.1.json"
+_ENVELOPE_CONTEXTS = (VCDM_V2_CONTEXT, OB_V3_CONTEXT, CLR_CONTEXT_URL)
+
+
+def _bundled_context_bytes() -> bytes:
+    """Raw bytes of the bundled CLR context file (split out so tests can stub)."""
+    return resources.files(_contexts).joinpath(_CLR_CONTEXT_RESOURCE).read_bytes()
+
+
+def bundled_clr_contexts() -> dict[str, dict[str, Any]]:
+    """Pinned CLR 2.0.1 context mapping for Data Integrity ``extra_contexts``.
+
+    Hashes the bundled file's raw bytes against :data:`CLR_CONTEXT_SHA256` on
+    every call and raises :class:`LibOpenBadgesException` if they do not match
+    — a context is signing input, so a bad bundle must fail closed.
+    """
+    try:
+        raw = _bundled_context_bytes()
+    except (OSError, FileNotFoundError) as exc:
+        raise LibOpenBadgesException(
+            "bundled CLR context is unreadable") from exc
+    if hashlib.sha256(raw).hexdigest() != CLR_CONTEXT_SHA256:
+        raise LibOpenBadgesException(
+            "bundled CLR context does not match its pinned hash")
+    document = json.loads(raw)
+    if not isinstance(document, dict):
+        raise LibOpenBadgesException("bundled CLR context is not an object")
+    return {CLR_CONTEXT_URL: document}
+
+
+def build_clr_credential(
+        issuer: Union[str, Mapping[str, Any]],
+        identifier: Sequence[Mapping[str, Any]],
+        members: Sequence[Mapping[str, Any]],
+        *,
+        credential_id: str,
+        valid_from: Optional[datetime] = None,
+        valid_until: Optional[datetime] = None,
+        status: Optional[Mapping[str, Any]] = None) -> dict[str, Any]:
+    """Build an unsigned CLR 2.0 ``ClrCredential`` JSON-LD document.
+
+    *identifier* is a list of IdentityObject dicts (already hashed — this
+    function does not hash emails). *members* are already-signed member
+    credential documents, copied into ``credentialSubject.verifiableCredential``.
+    *issuer* may be a Profile dict or a string URL. *status*, when given, is
+    copied onto ``credentialStatus``.
+
+    Raises ValueError if *members* is not a non-empty list of dicts, if
+    *credential_id* is empty, or if both *valid_from* and *valid_until* are
+    timezone-aware and *valid_until* is not strictly after *valid_from*.
+    """
+    if not isinstance(credential_id, str) or not credential_id:
+        raise ValueError("credential_id must be a non-empty string")
+    if not isinstance(members, list) or not members:
+        raise ValueError("members must be a non-empty list of credential dicts")
+    if not isinstance(identifier, list):
+        raise ValueError("identifier must be a list of IdentityObject dicts")
+
+    issued = valid_from if valid_from is not None else datetime.now(timezone.utc)
+    if (valid_until is not None
+            and issued.tzinfo is not None and valid_until.tzinfo is not None
+            and valid_until <= issued):
+        raise ValueError("validUntil must be after validFrom")
+
+    if isinstance(issuer, str):
+        if not issuer:
+            raise ValueError("issuer must be a non-empty string or a dict")
+        issuer_value: Union[str, dict[str, Any]] = issuer
+    elif isinstance(issuer, dict):
+        issuer_value = copy.deepcopy(dict(issuer))
+    else:
+        raise ValueError("issuer must be a string URL or a dict")
+
+    copied_ids: list[dict[str, Any]] = []
+    for i, item in enumerate(identifier):
+        if not isinstance(item, dict):
+            raise ValueError("identifier[%d] must be a JSON object" % i)
+        copied_ids.append(copy.deepcopy(item))
+
+    issuer_id = issuer_value if isinstance(issuer_value, str) else issuer_value.get("id")
+    copied_members: list[dict[str, Any]] = []
+    for i, member in enumerate(members):
+        if not isinstance(member, dict):
+            raise ValueError("members[%d] must be a JSON object" % i)
+        member_id = member.get("id", member.get("@id"))
+        if isinstance(member_id, str) and member_id in (credential_id, issuer_id):
+            raise ValueError(
+                "members[%d] id collides with the CLR envelope or issuer id" % i)
+        copied_members.append(copy.deepcopy(member))
+
+    document: dict[str, Any] = {
+        "@context": list(_ENVELOPE_CONTEXTS),
+        "type": ["VerifiableCredential", "ClrCredential"],
+        "id": credential_id,
+        "issuer": issuer_value,
+        "validFrom": _iso(issued),
+        "credentialSubject": {
+            "type": "ClrSubject",
+            "identifier": copied_ids,
+            "verifiableCredential": copied_members,
+        },
+    }
+    if valid_until is not None:
+        document["validUntil"] = _iso(valid_until)
+    if status is not None:
+        if not isinstance(status, dict):
+            raise ValueError("credentialStatus must be a JSON object")
+        document["credentialStatus"] = copy.deepcopy(dict(status))
+    return document
+
+
+def sign_clr_credential(document: dict[str, Any], signing_key_pem: Any,
+                        verification_method: str) -> dict[str, Any]:
+    """Sign a ``ClrCredential`` with an eddsa-rdfc-2022 Data Integrity proof.
+
+    Thin wrapper around :func:`add_data_integrity_proof` that injects the
+    hash-pinned CLR context via ``extra_contexts`` — the library never fetches
+    remote contexts, so without this injection canonicalization cannot see the
+    CLR terms. Requires the optional ``[ldp]`` extra.
+    """
+    from .ldp import add_data_integrity_proof
+    return add_data_integrity_proof(
+        document, signing_key_pem, verification_method,
+        extra_contexts=bundled_clr_contexts())

{openbadgeslib-4.4.3 → openbadgeslib-4.5.0}/openbadgeslib/ob3/contexts/__init__.py

@@ -51,6 +51,9 @@
 #   https://w3id.org/security/multikey/v1
 #     security-multikey-v1.json
 #     ba2c182de2d92f7e47184bcca8fcf0beaee6d3986c527bf664c195bbc7c58597
+#   https://purl.imsglobal.org/spec/clr/v2p0/context-2.0.1.json  (captured 2026-08-01)
+#     clr_context_2.0.1.json
+#     880f1902d4158f2f33ce06af41b90719977cd1ea337a9de2e41edb3ff5e543d6
 #
 # This module deliberately does NOT import pyld: it only hands out plain dicts
 # in the shape pyld's documentLoader expects, so it works (and is tested)

openbadgeslib-4.5.0/openbadgeslib/ob3/contexts/clr_context_2.0.1.json

@@ -0,0 +1,62 @@
+{
+  "@context": {
+    "id": "@id",
+    "type": "@type",
+    "ClrCredential": {
+      "@id": "https://purl.imsglobal.org/spec/vc/clr/vocab.html#ClrCredential",
+      "@context": {
+        "id": "@id",
+        "type": "@type",
+        "partial": {
+          "@id": "https://purl.imsglobal.org/spec/vc/clr/vocab.html#partial",
+          "@type": "xsd:boolean"
+        }
+      }
+    },
+    "ClrSubject": {
+      "@id": "https://purl.imsglobal.org/spec/vc/clr/vocab.html#ClrSubject",
+      "@context": {
+        "id": "@id",
+        "type": "@type",
+        "cred": "https://www.w3.org/2018/credentials#",
+        "obi": "https://purl.imsglobal.org/spec/vc/ob/vocab.html#",
+        "achievement": {
+          "@id": "https://purl.imsglobal.org/spec/vc/clr/vocab.html#achievement",
+          "@type": "obi:Achievement",
+          "@container": "@set"
+        },
+        "association": {
+          "@id": "https://purl.imsglobal.org/spec/vc/clr/vocab.html#association",
+          "@type": "https://purl.imsglobal.org/spec/vc/clr/vocab.html#Association",
+          "@container": "@set"
+        },
+        "verifiableCredential": {
+          "@id": "https://purl.imsglobal.org/spec/vc/clr/vocab.html#verifiableCredential",
+          "@type": "cred:verifiableCredential",
+          "@container": "@set"
+        },
+        "identifier": {
+          "@id": "https://purl.imsglobal.org/spec/vc/clr/vocab.html#identifier-1",
+          "@type": "obi:Identifier",
+          "@container": "@set"
+        }
+      }
+    },
+    "Association": {
+      "@id": "https://purl.imsglobal.org/spec/vc/clr/vocab.html#Association",
+      "@context": {
+        "associationType": {
+          "@id": "https://purl.imsglobal.org/spec/vc/clr/vocab.html#AssociationType"
+        },
+        "sourceId": {
+          "@id": "https://purl.imsglobal.org/spec/vc/clr/vocab.html#sourceId",
+          "@type": "xsd:anyURI"
+        },
+        "targetId": {
+          "@id": "https://purl.imsglobal.org/spec/vc/clr/vocab.html#targetId",
+          "@type": "xsd:anyURI"
+        }
+      }
+    }
+  }
+}