Problem with blockcerts certificates validation

[antonellopasella]

We have a problem validating a (we think) valid blockcerts certificate but the LD validator fails.

blockchain-certificates/blockcerts-verifier#1878 (comment)

The problem now that this certificate

jsonld.ValidationError: Safe mode validation error. { "type": [ "JsonLdEvent" ], "code": "invalid property", "level": "warning", "message": "Dropping property that did not expand into an absolute IRI or keyword.", "details": { "property": "chain", "expandedProperty": "chain" } }

The chain value is ethereumMainnet that seems correct as merkelproof specs states:

Chain is an optional field introduced by Blockcerts to help during verification. Current supported values are:

• bitcoinMainnet
• bitcoinTestnet
• bitcoinRegtest
  - ethereumMainnet
• ethereumRopsten
• mockchain

[dlongley]

It looks like the property chain is not defined in the context (https://www.blockcerts.org/schema/2.0/context.json) used to describe the document. (Note that "chain" does not appear in that context document.)

Notably, it doesn't matter what the value of "chain" is -- since the property itself is undefined, which is what the error is reporting here. When this document was signed previously, it was probably signed without safe mode which allowed "chain" to be dropped from the input to the signature since it was undefined. The digital signature standards published as recommendations require compliant software to raise an error if there are undefined values detected in an input document. This prevents signatures from being generated that might omit important information by accident, encouraging the document author to fix their mistake before reattempting to sign.

Therefore, the value covered by the signature likely omits "chain". You could delete the "chain" property and perhaps the signature would then verify, noting that the past behavior of whatever software was used to perform the signature did not prevent the signature from being generated when the input wasn't fully defined.

[dlongley]

A possible solution going forward for this problem -- assuming a newer context has already been issued that properly defines all values that appear in blockcerts (if not, this should be done right away) -- would be for a "blockcerts verifier" that sees the old context to re-attempt verification after removing erroneously undefined terms and then to print a warning that those fields are unprotected by the signature.