Skip to content

v0.13.0 — every token body, whole and exact

Choose a tag to compare

View all tags
@xgreenx xgreenx released this 20 Sep 09:39
· 400 commits to main since this release
v0.13.0
f22d860
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

GitHub's token request is revealed whole, and every token body is held to its profile's exact form.

What changed

  • GitHub reveals its exchange whole (#44). The github/v1 layout is one revealed run from offset zero to the signed length and no commitment; client_secret is a public application credential and is in the clear. A record built with the old committed suffix no longer verifies. ceremonyVersion stays 1: no ceremony Platform Verifier is registered on any network yet.
  • No token request commits anything (#45). _tokenBody requires one revealed run and zero commitments for every profile; the _tokenSentCommitments hook, *_TOKEN_SENT_COMMITMENTS and the profile field secretField are gone.
  • Every token body is held to its exact form (#47). CeremonyFields.requireExactForm walks the body once: the profile's field names in order, =, nonempty values in the form serializer's output alphabet, & between pairs, nothing after the last. X: grant_type, client_id, code, redirect_uri, code_verifier; GitHub: client_id, code, redirect_uri, code_verifier, client_secret. Acceptance no longer depends on either platform rejecting a malformed or duplicate form. The verifier reads only what it compares: code_verifier, client_id, and for X grant_type.
  • Comments follow the public client (#46).

API

  • libid-profiles: TokenSession loses secret_field and gains token_fields: &'static [&'static str].
  • @libid/contracts: TokenSession.secretField removed, tokenFields added.
  • Solidity: CeremonyProfile.X_TOKEN_FIELDS / GITHUB_TOKEN_FIELDS; TlsNotaryVerifierBase._tokenFields() replaces _tokenSentCommitments(); errors CeremonyFields.MalformedForm(uint256 at) and EmptyFormValue(string name).

Fixtures

github-ceremony-session.json and github-ceremony-real.json regenerated for the new layout; the X fixtures are byte-identical to 0.12.0.

Specification

GitHub follows libID#35 (REQ-PLAT-61). X is held to the same rule ahead of its specification; libID#43 carries REQ-PLAT-63.

Assets 2
Loading