openbadgeslib 4.4.4__tar.gz → 4.5.0__tar.gz

{openbadgeslib-4.4.4 → openbadgeslib-4.5.0}/Changelog.txt

@@ -4,6 +4,33 @@ OpenBadgesLib - Changelog
 Newest first. Dates are ISO 8601 (YYYY-MM-DD).
 
 
+* v4.5.0 - 2026-09-12
+
+  - feat(ob3): public `decode_encoded_list(encoded) -> bytes` and
+    `set_indices(bitstring) -> frozenset[int]` for a published Bitstring
+    Status List `encodedList` (#322). Same multibase `u` / base64url /
+    bounded-gzip (5 MiB) / MSB-first decode the verifier already uses;
+    the private `_decode_encoded_list` name remains as a thin alias.
+
+  - feat(ob3): `build_status_list_credential(..., ttl=)` writes Bitstring
+    Status List §2.2 `ttl` (milliseconds) on `credentialSubject`, never at
+    the top level — `ttl` is a JSON-LD term scoped to `BitstringStatusList`,
+    so a top-level copy would not be signed (#321). Negative values raise
+    `ValueError`.
+
+  - feat(ob3): native CLR 2.0 `ClrCredential` builder (`build_clr_credential`,
+    `sign_clr_credential`) with the versioned `context-2.0.1.json` bundled
+    and hash-pinned (`CLR_CONTEXT_SHA256`) (#323). Identifier objects and
+    member credentials are copied as given — email hashing and member-count
+    caps stay downstream. Signing injects the pinned context via
+    `extra_contexts` (requires `[ldp]`).
+
+  - feat(ob2): `OB2Verifier.verify_hosted(document)` verifies a hosted
+    assertion JSON document (dict or JSON string) without synthesizing a
+    dummy JWS. The HTTPS fetcher is injectable via
+    `OB2Verifier(..., download=)`.
+
+
 * v4.4.4 - 2026-09-10
 
   - security(baking): SVG baking strips ``<script>`` / ``foreignObject`` /

{openbadgeslib-4.4.4 → openbadgeslib-4.5.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: openbadgeslib
-Version: 4.4.4
+Version: 4.5.0
 Summary: Production-ready Python library & CLI for Open Badges 3.0 (W3C Verifiable Credentials): issue, verify, and revoke JWT-VC credentials with Bitstring Status Lists and did:web — plus strict OB 2.0 and legacy OB 1.0.
 Author-email: Luis González Fernández <luisgf@luisgf.es>, Jesús Cea Avión <jcea@jcea.es>
 License: LGPLv3

{openbadgeslib-4.4.4 → openbadgeslib-4.5.0}/openbadgeslib/ob2/verifier.py

@@ -22,7 +22,7 @@
 
 import logging
 from datetime import datetime, timezone
-from typing import Any, List, Optional, Union
+from typing import Any, Callable, List, Optional, Union
 from urllib.parse import urlparse
 
 from .models import Assertion, CryptographicKey, hash_identity, _parse_iso
@@ -67,10 +67,16 @@ class OB2Verifier:
         pubkey_pem: Optional PEM-encoded trusted public key. When supplied it is
                     used to verify SignedBadge assertions and skips resolving the
                     badge-declared key.
+        download: Optional ``url -> bytes`` fetcher used by hosted verification
+                  (assertion id, BadgeClass, issuer Profile, revocation list).
+                  Defaults to :func:`download_file` (HTTPS-only, size-capped).
     """
 
-    def __init__(self, pubkey_pem: Optional[Any] = None) -> None:
+    def __init__(self, pubkey_pem: Optional[Any] = None, *,
+                 download: Optional[Callable[[str], bytes]] = None) -> None:
         self.trusted_pubkey_pem: Optional[Union[str, bytes]] = None
+        self._download: Callable[[str], bytes] = (
+            download if download is not None else download_file)
         if pubkey_pem is not None:
             pem = key_to_pem(pubkey_pem)
             try:
@@ -122,6 +128,67 @@ class OB2Verifier:
 
         return assertion
 
+    def verify_hosted(self, document: Union[str, dict[str, Any]], *,
+                      expected_recipient: Optional[str] = None,
+                      check_revocation: bool = False) -> Assertion:
+        """Verify a hosted OB 2.0 assertion JSON document (not a compact JWS).
+
+        *document* is the assertion as a dict or a JSON string. The hosted
+        model is fetch-from-id: the copy served at ``assertion.id`` is the
+        trust anchor (scoped to the issuer Profile), so this does not
+        synthesize a dummy JWS. Defence-in-depth JWS verification inside
+        :meth:`_verify_hosted` is skipped when there is no token.
+
+        ``expected_recipient`` and ``check_revocation`` behave as in
+        :meth:`verify`. Raises :class:`OB2VerificationError` if the document
+        is not a HostedBadge assertion or if any check fails.
+        """
+        parsed = self._hosted_document(document)
+        try:
+            assertion = Assertion.from_dict(parsed)
+        except ValueError as exc:
+            raise OB2VerificationError(
+                "Malformed OB 2.0 assertion: %s" % exc) from exc
+        if assertion.verification.type != "HostedBadge":
+            raise OB2VerificationError(
+                "verify_hosted() requires verification.type HostedBadge, got %r"
+                % assertion.verification.type)
+
+        assertion = self._verify_hosted(assertion, "")
+
+        self._check_expiration(assertion)
+
+        if expected_recipient is not None:
+            self._check_identity(assertion, expected_recipient)
+
+        if check_revocation:
+            self._check_revocation(assertion)
+
+        return assertion
+
+    @staticmethod
+    def _hosted_document(document: Union[str, dict[str, Any]]) -> dict[str, Any]:
+        """Parse a hosted assertion from a dict or JSON string (never a JWS)."""
+        if isinstance(document, str):
+            text = document.strip()
+            if text.count('.') == 2 and not text.startswith('{'):
+                raise OB2VerificationError(
+                    "verify_hosted() expects a hosted assertion JSON document, "
+                    "not a compact JWS; use verify() for SignedBadge tokens")
+            try:
+                parsed = jws_utils.from_json(text)
+            except Exception as exc:
+                raise OB2VerificationError(
+                    "hosted assertion is not valid JSON: %s" % exc) from exc
+        elif isinstance(document, dict):
+            parsed = document
+        else:
+            raise OB2VerificationError(
+                "hosted assertion must be a dict or JSON string")
+        if not isinstance(parsed, dict):
+            raise OB2VerificationError("hosted assertion is not a JSON object")
+        return parsed
+
     # ── signed path ──────────────────────────────────────────────────────────────
 
     def _verify_signed(self, assertion: Assertion, token: str) -> None:
@@ -255,16 +322,18 @@ class OB2Verifier:
         # verify it, but never fail the hosted verdict on it (a hosted badge is
         # not required to be signed at all). The creator comes from the
         # authoritative copy, so this never dereferences a holder-chosen URL.
-        try:
-            if self.trusted_pubkey_pem is not None:
-                self._verify_jws(token, self.trusted_pubkey_pem)
-            elif authoritative.verification.creator:
-                key = self._resolve_creator(authoritative.verification.creator)
-                self._verify_jws(token, key.public_key_pem.encode('utf-8'))
-        except OB2VerificationError as exc:
-            logger.debug("Hosted assertion %s: baked JWS did not verify (%s); "
-                         "hosted trust comes from the HTTPS fetch, not the signature.",
-                         assertion.id, exc)
+        # verify_hosted() passes an empty token (there is no JWS); skip then.
+        if token:
+            try:
+                if self.trusted_pubkey_pem is not None:
+                    self._verify_jws(token, self.trusted_pubkey_pem)
+                elif authoritative.verification.creator:
+                    key = self._resolve_creator(authoritative.verification.creator)
+                    self._verify_jws(token, key.public_key_pem.encode('utf-8'))
+            except OB2VerificationError as exc:
+                logger.debug("Hosted assertion %s: baked JWS did not verify (%s); "
+                             "hosted trust comes from the HTTPS fetch, not the signature.",
+                             assertion.id, exc)
         return authoritative
 
     def _check_hosted_scope(self, assertion_id: str, issuer: dict[str, Any]) -> None:
@@ -373,7 +442,7 @@ class OB2Verifier:
 
     def _fetch_json(self, url: str, where: str) -> dict[str, Any]:
         try:
-            raw = download_file(url)
+            raw = self._download(url)
         except Exception as exc:
             raise OB2VerificationError(
                 "Could not fetch %s at %s: %s" % (where, url, exc)) from exc

{openbadgeslib-4.4.4 → openbadgeslib-4.5.0}/openbadgeslib/ob3/__init__.py

@@ -27,9 +27,12 @@ from .verifier import (OB3VerificationError, OB3Verifier,
                        verify_endorsement_jwt)
 from .ldp import (OB3LdpSigner, OB3LdpVerifier, add_data_integrity_proof,
                   verify_data_integrity_proof)
-from .status import check_credential_status
+from .status import check_credential_status, decode_encoded_list, set_indices
 from .status_list import (build_status_list_credential, encode_bitstring,
                           sign_status_list_credential, status_entry)
+from .clr import (CLR_CONTEXT_SHA256, CLR_CONTEXT_URL, OB_V3_CONTEXT,
+                  VCDM_V2_CONTEXT, build_clr_credential, bundled_clr_contexts,
+                  sign_clr_credential)
 from .status_registry import StatusRegistry
 from .did import (build_did_document, did_jwk_from_jwk, did_key_from_pem,
                   did_web_from_url, multikey_from_pem, resolve_did,
@@ -68,16 +71,25 @@ __all__ = [
     'verify_data_integrity_proof',
     'StatusRegistry',
     'build_did_document',
+    'build_clr_credential',
     'build_status_list_credential',
+    'bundled_clr_contexts',
     'check_credential_status',
+    'CLR_CONTEXT_SHA256',
+    'CLR_CONTEXT_URL',
+    'decode_encoded_list',
     'did_jwk_from_jwk',
     'did_key_from_pem',
     'did_web_from_url',
     'encode_bitstring',
     'multikey_from_pem',
+    'OB_V3_CONTEXT',
     'resolve_did',
     'resolve_verification_method',
+    'set_indices',
+    'sign_clr_credential',
     'sign_status_list_credential',
     'status_entry',
+    'VCDM_V2_CONTEXT',
     'verify_endorsement_jwt',
 ]

openbadgeslib-4.5.0/openbadgeslib/ob3/clr.py

@@ -0,0 +1,176 @@
+"""
+        OpenBadges Library
+
+        Copyright (c) 2014-2026, Luis González Fernández, luisgf@luisgf.es
+        Copyright (c) 2014-2026, Jesús Cea Avión, jcea@jcea.es
+
+        All rights reserved.
+
+        This library is free software; you can redistribute it and/or
+        modify it under the terms of the GNU Lesser General Public
+        License as published by the Free Software Foundation; either
+        version 3.0 of the License, or (at your option) any later version.
+
+        This library is distributed in the hope that it will be useful,
+        but WITHOUT ANY WARRANTY; without even the implied warranty of
+        MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+        Lesser General Public License for more details.
+
+        You should have received a copy of the GNU Lesser General Public
+        License along with this library.
+"""
+
+# 1EdTech Comprehensive Learner Record 2.0 (Final v1.1) ClrCredential assembly.
+#
+# Builds an unsigned JSON-LD envelope whose credentialSubject.verifiableCredential
+# array embeds already-signed member documents by value. Email hashing and
+# member-count caps are product policy and stay downstream: this module copies
+# the identifier objects and members it is given.
+#
+# The CLR JSON-LD context is pinned to the VERSIONED 2.0.1 revision. 1EdTech's
+# unversioned …/clr/v2p0/context.json endpoint serves a stub whose ClrSubject
+# scope defines no ``identifier`` term — signing against it silently drops the
+# learner binding from the RDF. The versioned bytes are bundled next to the
+# other contexts and hash-checked on every load so a bad bundle fails closed.
+
+import copy
+import hashlib
+import json
+
+from datetime import datetime, timezone
+from importlib import resources
+from typing import Any, Mapping, Optional, Sequence, Union
+
+from ..errors import LibOpenBadgesException
+from . import contexts as _contexts
+from .credential import _iso
+
+VCDM_V2_CONTEXT = "https://www.w3.org/ns/credentials/v2"
+OB_V3_CONTEXT = "https://purl.imsglobal.org/spec/ob/v3p0/context-3.0.3.json"
+CLR_CONTEXT_URL = "https://purl.imsglobal.org/spec/clr/v2p0/context-2.0.1.json"
+CLR_CONTEXT_SHA256 = "880f1902d4158f2f33ce06af41b90719977cd1ea337a9de2e41edb3ff5e543d6"
+
+_CLR_CONTEXT_RESOURCE = "clr_context_2.0.1.json"
+_ENVELOPE_CONTEXTS = (VCDM_V2_CONTEXT, OB_V3_CONTEXT, CLR_CONTEXT_URL)
+
+
+def _bundled_context_bytes() -> bytes:
+    """Raw bytes of the bundled CLR context file (split out so tests can stub)."""
+    return resources.files(_contexts).joinpath(_CLR_CONTEXT_RESOURCE).read_bytes()
+
+
+def bundled_clr_contexts() -> dict[str, dict[str, Any]]:
+    """Pinned CLR 2.0.1 context mapping for Data Integrity ``extra_contexts``.
+
+    Hashes the bundled file's raw bytes against :data:`CLR_CONTEXT_SHA256` on
+    every call and raises :class:`LibOpenBadgesException` if they do not match
+    — a context is signing input, so a bad bundle must fail closed.
+    """
+    try:
+        raw = _bundled_context_bytes()
+    except (OSError, FileNotFoundError) as exc:
+        raise LibOpenBadgesException(
+            "bundled CLR context is unreadable") from exc
+    if hashlib.sha256(raw).hexdigest() != CLR_CONTEXT_SHA256:
+        raise LibOpenBadgesException(
+            "bundled CLR context does not match its pinned hash")
+    document = json.loads(raw)
+    if not isinstance(document, dict):
+        raise LibOpenBadgesException("bundled CLR context is not an object")
+    return {CLR_CONTEXT_URL: document}
+
+
+def build_clr_credential(
+        issuer: Union[str, Mapping[str, Any]],
+        identifier: Sequence[Mapping[str, Any]],
+        members: Sequence[Mapping[str, Any]],
+        *,
+        credential_id: str,
+        valid_from: Optional[datetime] = None,
+        valid_until: Optional[datetime] = None,
+        status: Optional[Mapping[str, Any]] = None) -> dict[str, Any]:
+    """Build an unsigned CLR 2.0 ``ClrCredential`` JSON-LD document.
+
+    *identifier* is a list of IdentityObject dicts (already hashed — this
+    function does not hash emails). *members* are already-signed member
+    credential documents, copied into ``credentialSubject.verifiableCredential``.
+    *issuer* may be a Profile dict or a string URL. *status*, when given, is
+    copied onto ``credentialStatus``.
+
+    Raises ValueError if *members* is not a non-empty list of dicts, if
+    *credential_id* is empty, or if both *valid_from* and *valid_until* are
+    timezone-aware and *valid_until* is not strictly after *valid_from*.
+    """
+    if not isinstance(credential_id, str) or not credential_id:
+        raise ValueError("credential_id must be a non-empty string")
+    if not isinstance(members, list) or not members:
+        raise ValueError("members must be a non-empty list of credential dicts")
+    if not isinstance(identifier, list):
+        raise ValueError("identifier must be a list of IdentityObject dicts")
+
+    issued = valid_from if valid_from is not None else datetime.now(timezone.utc)
+    if (valid_until is not None
+            and issued.tzinfo is not None and valid_until.tzinfo is not None
+            and valid_until <= issued):
+        raise ValueError("validUntil must be after validFrom")
+
+    if isinstance(issuer, str):
+        if not issuer:
+            raise ValueError("issuer must be a non-empty string or a dict")
+        issuer_value: Union[str, dict[str, Any]] = issuer
+    elif isinstance(issuer, dict):
+        issuer_value = copy.deepcopy(dict(issuer))
+    else:
+        raise ValueError("issuer must be a string URL or a dict")
+
+    copied_ids: list[dict[str, Any]] = []
+    for i, item in enumerate(identifier):
+        if not isinstance(item, dict):
+            raise ValueError("identifier[%d] must be a JSON object" % i)
+        copied_ids.append(copy.deepcopy(item))
+
+    issuer_id = issuer_value if isinstance(issuer_value, str) else issuer_value.get("id")
+    copied_members: list[dict[str, Any]] = []
+    for i, member in enumerate(members):
+        if not isinstance(member, dict):
+            raise ValueError("members[%d] must be a JSON object" % i)
+        member_id = member.get("id", member.get("@id"))
+        if isinstance(member_id, str) and member_id in (credential_id, issuer_id):
+            raise ValueError(
+                "members[%d] id collides with the CLR envelope or issuer id" % i)
+        copied_members.append(copy.deepcopy(member))
+
+    document: dict[str, Any] = {
+        "@context": list(_ENVELOPE_CONTEXTS),
+        "type": ["VerifiableCredential", "ClrCredential"],
+        "id": credential_id,
+        "issuer": issuer_value,
+        "validFrom": _iso(issued),
+        "credentialSubject": {
+            "type": "ClrSubject",
+            "identifier": copied_ids,
+            "verifiableCredential": copied_members,
+        },
+    }
+    if valid_until is not None:
+        document["validUntil"] = _iso(valid_until)
+    if status is not None:
+        if not isinstance(status, dict):
+            raise ValueError("credentialStatus must be a JSON object")
+        document["credentialStatus"] = copy.deepcopy(dict(status))
+    return document
+
+
+def sign_clr_credential(document: dict[str, Any], signing_key_pem: Any,
+                        verification_method: str) -> dict[str, Any]:
+    """Sign a ``ClrCredential`` with an eddsa-rdfc-2022 Data Integrity proof.
+
+    Thin wrapper around :func:`add_data_integrity_proof` that injects the
+    hash-pinned CLR context via ``extra_contexts`` — the library never fetches
+    remote contexts, so without this injection canonicalization cannot see the
+    CLR terms. Requires the optional ``[ldp]`` extra.
+    """
+    from .ldp import add_data_integrity_proof
+    return add_data_integrity_proof(
+        document, signing_key_pem, verification_method,
+        extra_contexts=bundled_clr_contexts())

{openbadgeslib-4.4.4 → openbadgeslib-4.5.0}/openbadgeslib/ob3/contexts/__init__.py

@@ -51,6 +51,9 @@
 #   https://w3id.org/security/multikey/v1
 #     security-multikey-v1.json
 #     ba2c182de2d92f7e47184bcca8fcf0beaee6d3986c527bf664c195bbc7c58597
+#   https://purl.imsglobal.org/spec/clr/v2p0/context-2.0.1.json  (captured 2026-08-01)
+#     clr_context_2.0.1.json
+#     880f1902d4158f2f33ce06af41b90719977cd1ea337a9de2e41edb3ff5e543d6
 #
 # This module deliberately does NOT import pyld: it only hands out plain dicts
 # in the shape pyld's documentLoader expects, so it works (and is tested)

openbadgeslib-4.5.0/openbadgeslib/ob3/contexts/clr_context_2.0.1.json

@@ -0,0 +1,62 @@
+{
+  "@context": {
+    "id": "@id",
+    "type": "@type",
+    "ClrCredential": {
+      "@id": "https://purl.imsglobal.org/spec/vc/clr/vocab.html#ClrCredential",
+      "@context": {
+        "id": "@id",
+        "type": "@type",
+        "partial": {
+          "@id": "https://purl.imsglobal.org/spec/vc/clr/vocab.html#partial",
+          "@type": "xsd:boolean"
+        }
+      }
+    },
+    "ClrSubject": {
+      "@id": "https://purl.imsglobal.org/spec/vc/clr/vocab.html#ClrSubject",
+      "@context": {
+        "id": "@id",
+        "type": "@type",
+        "cred": "https://www.w3.org/2018/credentials#",
+        "obi": "https://purl.imsglobal.org/spec/vc/ob/vocab.html#",
+        "achievement": {
+          "@id": "https://purl.imsglobal.org/spec/vc/clr/vocab.html#achievement",
+          "@type": "obi:Achievement",
+          "@container": "@set"
+        },
+        "association": {
+          "@id": "https://purl.imsglobal.org/spec/vc/clr/vocab.html#association",
+          "@type": "https://purl.imsglobal.org/spec/vc/clr/vocab.html#Association",
+          "@container": "@set"
+        },
+        "verifiableCredential": {
+          "@id": "https://purl.imsglobal.org/spec/vc/clr/vocab.html#verifiableCredential",
+          "@type": "cred:verifiableCredential",
+          "@container": "@set"
+        },
+        "identifier": {
+          "@id": "https://purl.imsglobal.org/spec/vc/clr/vocab.html#identifier-1",
+          "@type": "obi:Identifier",
+          "@container": "@set"
+        }
+      }
+    },
+    "Association": {
+      "@id": "https://purl.imsglobal.org/spec/vc/clr/vocab.html#Association",
+      "@context": {
+        "associationType": {
+          "@id": "https://purl.imsglobal.org/spec/vc/clr/vocab.html#AssociationType"
+        },
+        "sourceId": {
+          "@id": "https://purl.imsglobal.org/spec/vc/clr/vocab.html#sourceId",
+          "@type": "xsd:anyURI"
+        },
+        "targetId": {
+          "@id": "https://purl.imsglobal.org/spec/vc/clr/vocab.html#targetId",
+          "@type": "xsd:anyURI"
+        }
+      }
+    }
+  }
+}

{openbadgeslib-4.4.4 → openbadgeslib-4.5.0}/openbadgeslib/ob3/status.py

@@ -142,7 +142,7 @@ def _check_entry(entry: dict[str, Any], download: Callable[[str], bytes],
         encoded = subject.get("encodedList")
         if not isinstance(encoded, str) or not encoded:
             raise OB3VerificationError("status list credential has no encodedList")
-        bitstring = _decode_encoded_list(encoded)
+        bitstring = decode_encoded_list(encoded)
         list_purposes = set(_as_list(subject.get("statusPurpose")))
     except OB3VerificationError:
         raise
@@ -320,20 +320,68 @@ def _b64url_decode(value: str) -> bytes:
     return base64.urlsafe_b64decode(value)
 
 
-def _decode_encoded_list(encoded: str) -> bytes:
-    """Decode encodedList: optional multibase base64url ('u') prefix, base64url,
-    then a bounded GZIP inflate to the raw bitstring."""
-    if encoded.startswith('u'):          # multibase base64url-no-pad (Bitstring SL)
-        encoded = encoded[1:]
-    compressed = _b64url_decode(encoded)
-    inflator = zlib.decompressobj(wbits=31)   # 31 => gzip framing
-    out = inflator.decompress(compressed, MAX_STATUS_LIST_BYTES)
+def decode_encoded_list(encoded: str) -> bytes:
+    """Decode a Bitstring Status List ``encodedList`` to the raw bitstring.
+
+    Accepts the multibase base64url prefix ``u`` (Bitstring Status List v1.0)
+    or a bare base64url string, then inflates the GZIP payload. The
+    decompressed bitstring is capped at :data:`MAX_STATUS_LIST_BYTES` (5 MiB)
+    so a crafted gzip bomb cannot exhaust memory — the list is fetched from a
+    URL named in an untrusted credential.
+
+    Raises:
+        ValueError: *encoded* is not a non-empty string, or is not valid
+            base64url / gzip.
+        OB3VerificationError: the inflated bitstring exceeds the 5 MiB cap.
+    """
+    if not isinstance(encoded, str) or not encoded:
+        raise ValueError("encodedList must be a non-empty string")
+    payload = encoded[1:] if encoded.startswith('u') else encoded
+    if not payload:
+        raise ValueError("encodedList is missing base64url data")
+    try:
+        compressed = _b64url_decode(payload)
+        if not compressed:
+            raise ValueError("encodedList is not valid base64url")
+        inflator = zlib.decompressobj(wbits=31)   # 31 => gzip framing
+        out = inflator.decompress(compressed, MAX_STATUS_LIST_BYTES)
+    except OB3VerificationError:
+        raise
+    except Exception as exc:
+        raise ValueError("invalid encodedList: %s" % exc) from exc
     if inflator.unconsumed_tail:
         raise OB3VerificationError(
             "status list bitstring exceeds the %d-byte limit" % MAX_STATUS_LIST_BYTES)
+    if not inflator.eof:
+        raise ValueError("invalid encodedList: truncated gzip")
     return out
 
 
+def _decode_encoded_list(encoded: str) -> bytes:
+    """Private alias of :func:`decode_encoded_list` (kept for existing tests)."""
+    return decode_encoded_list(encoded)
+
+
+def set_indices(bitstring: bytes) -> frozenset[int]:
+    """Return the indices of bits that are set in an MSB-first bitstring.
+
+    The bit order matches :func:`_bit_set` / Bitstring Status List v1.0:
+    index 0 is the high bit of the first byte. Pair with
+    :func:`decode_encoded_list` to recover the set of revoked/suspended
+    indices from a published ``encodedList``.
+    """
+    if not isinstance(bitstring, (bytes, bytearray)):
+        raise ValueError("bitstring must be bytes")
+    total = len(bitstring) * 8
+    rendered = format(int.from_bytes(bitstring, "big"), "0%db" % total)
+    found: set[int] = set()
+    index = rendered.find("1")
+    while index != -1:
+        found.add(index)
+        index = rendered.find("1", index + 1)
+    return frozenset(found)
+
+
 def _bit_set(bitstring: bytes, index: int) -> bool:
     """Return the bit at *index* in a big-endian (MSB-first) bitstring, matching
     the Bitstring Status List / StatusList2021 bit ordering."""

{openbadgeslib-4.4.4 → openbadgeslib-4.5.0}/openbadgeslib/ob3/status_list.py

@@ -78,7 +78,8 @@ def build_status_list_credential(issuer_id: str, url: str, purpose: str,
                                  set_indices: Iterable[int],
                                  size_bits: int = DEFAULT_SIZE_BITS,
                                  issued: Optional[datetime] = None,
-                                 valid_until: Optional[datetime] = None
+                                 valid_until: Optional[datetime] = None,
+                                 ttl: Optional[int] = None
                                  ) -> dict[str, Any]:
     """Build an (unsigned) BitstringStatusListCredential document.
 
@@ -96,10 +97,27 @@ def build_status_list_credential(issuer_id: str, url: str, purpose: str,
     authentic older copy (with fewer revocations) passes the window unchecked.
     openbadges-publish warns loudly when it does this; issuers of revocable
     badges should set ``status_validity_days`` and republish on that cadence.
+
+    *ttl*, when given, is Bitstring Status List §2.2's refresh hint in
+    milliseconds. It is written on ``credentialSubject`` (the JSON-LD term is
+    scoped to ``BitstringStatusList``); a top-level copy would be dropped
+    during expansion and would not be covered by a Data Integrity proof.
     """
     if purpose not in STATUS_PURPOSES:
         raise ValueError("statusPurpose must be one of %r, got %r"
                          % (STATUS_PURPOSES, purpose))
+    if ttl is not None and (isinstance(ttl, bool) or not isinstance(ttl, int)
+                            or ttl < 0):
+        raise ValueError("ttl must be a non-negative integer (milliseconds), "
+                         "got %r" % (ttl,))
+    subject: dict[str, Any] = {
+        "id": url + "#list",
+        "type": "BitstringStatusList",
+        "statusPurpose": purpose,
+        "encodedList": encode_bitstring(set_indices, size_bits),
+    }
+    if ttl is not None:
+        subject["ttl"] = ttl
     vc: dict[str, Any] = {
         "@context": [_VC2_CONTEXT],
         "id": url,
@@ -107,12 +125,7 @@ def build_status_list_credential(issuer_id: str, url: str, purpose: str,
         "issuer": issuer_id,
         "validFrom": _iso(issued if issued is not None
                           else datetime.now(tz=timezone.utc)),
-        "credentialSubject": {
-            "id": url + "#list",
-            "type": "BitstringStatusList",
-            "statusPurpose": purpose,
-            "encodedList": encode_bitstring(set_indices, size_bits),
-        },
+        "credentialSubject": subject,
     }
     if valid_until is not None:
         vc["validUntil"] = _iso(valid_until)

{openbadgeslib-4.4.4 → openbadgeslib-4.5.0}/openbadgeslib/util.py

@@ -21,7 +21,7 @@
         License along with this library.
 """
 
-__version__ = '4.4.4'
+__version__ = '4.5.0'
 
 import contextlib
 import hashlib

{openbadgeslib-4.4.4 → openbadgeslib-4.5.0}/openbadgeslib.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: openbadgeslib
-Version: 4.4.4
+Version: 4.5.0
 Summary: Production-ready Python library & CLI for Open Badges 3.0 (W3C Verifiable Credentials): issue, verify, and revoke JWT-VC credentials with Bitstring Status Lists and did:web — plus strict OB 2.0 and legacy OB 1.0.
 Author-email: Luis González Fernández <luisgf@luisgf.es>, Jesús Cea Avión <jcea@jcea.es>
 License: LGPLv3

{openbadgeslib-4.4.4 → openbadgeslib-4.5.0}/openbadgeslib.egg-info/SOURCES.txt

@@ -49,6 +49,7 @@ openbadgeslib/ob2/models.py
 openbadgeslib/ob2/signer.py
 openbadgeslib/ob2/verifier.py
 openbadgeslib/ob3/__init__.py
+openbadgeslib/ob3/clr.py
 openbadgeslib/ob3/credential.py
 openbadgeslib/ob3/did.py
 openbadgeslib/ob3/eudi.py
@@ -60,6 +61,7 @@ openbadgeslib/ob3/status_list.py
 openbadgeslib/ob3/status_registry.py
 openbadgeslib/ob3/verifier.py
 openbadgeslib/ob3/contexts/__init__.py
+openbadgeslib/ob3/contexts/clr_context_2.0.1.json
 openbadgeslib/ob3/contexts/credentials-v2.json
 openbadgeslib/ob3/contexts/ob-v3p0-context-3.0.1.json
 openbadgeslib/ob3/contexts/ob-v3p0-context-3.0.2.json
@@ -108,6 +110,7 @@ tests/test_ob2_error_branches.py
 tests/test_ob2_models.py
 tests/test_ob2_signer.py
 tests/test_ob2_verifier.py
+tests/test_ob3_clr.py
 tests/test_ob3_conformance_schema.py
 tests/test_ob3_contexts.py
 tests/test_ob3_credential.py
@@ -150,6 +153,7 @@ tests/conformance/Dockerfile.ob3
 tests/conformance/README.md
 tests/conformance/conftest.py
 tests/conformance/docker-compose.yml
+tests/conformance/relax-danubetech-checksums.awk
 tests/conformance/test_official_validators.py
 tests/fixtures/ob_schemas/README.md
 tests/fixtures/ob_schemas/ob_v3p0_achievementcredential_schema.json