Skip to content

v1.20.2

Choose a tag to compare

View all tags
@luisgf luisgf released this 16 Jul 08:13
· 36 commits to main since this release
v1.20.2
44d044b

Two fail-closed conformance fixes, each surfaced by holding the code to real third-party artifacts instead of self-recorded round-trips.

Fixed

  • XAdES trust-list verifier now accepts real EU trusted lists (#114). The v1.20.0 1-reference pin rejected every genuine XAdES-BASELINE signature — the EU LOTL and national TLs sign the enveloped document plus their own SignedProperties (two references). Coverage is now anchored on the enveloped URI="" reference resolving to the trust-list root (plus optional SignedProperties / co-signed ds:KeyInfo). Anchoring on URI="" — not on the resolved element's tag — is what defeats XML-Signature-Wrapping; an adversarial review of the initial fix caught a tag-equality gap (a by-Id relocation attack), now pinned by a regression test.
  • Bitstring Status List encodedList is multibase-conformant on both sides (#115). The W3C v1.0 REC mandates a multibase (u-prefixed) encodedList, but the codec used bare base64url: decode_bitstring could not consume a spec-conformant (or any real third-party) list, and encode_bitstring issued non-conformant ones. decode_bitstring now tolerates the u prefix (legacy prefix-less lists still decode) and encode_bitstring emits it.

Added

  • Real Commission-signed golden fixtures — the EU LOTL (seq 388) and Spanish national TL (seq 187), verified end to end through the XAdES verifier (#114).
  • Third-party interop vectors — an SD-JWT VC from RFC 9901 Appendix A.3 (verified against the published A.5 key) and a real EUDI reference PID (ES256, x5c), plus W3C Bitstring encodedList decode vectors (the REC's Example 3 + a Digital Bazaar list) (#115).

Verified: full test matrix (py3.10–3.14), flake8, mypy, and twine check all green on the tag; published to PyPI via Trusted Publishing.

PyPI: pip install openvc-core==1.20.2

Assets 2
Loading