Repository navigation
fix: verify did:webvh SCID over the published log entry - #290
Merged
marat-affinidi merged 1 commit intoJun 30, 2026
Merged
marat-affinidi merged 1 commit into
marat-affinidi merged 1 commit into
Conversation
maratsh
force-pushed
the
fix/webvh-scid-verification-over-published-entry
branch
from
June 13, 2026 18:56
462ea42 to
b4f698e
Compare
SCID and entry-hash verification rebuilt the first log entry from the typed
DidWebVhLogEntry via toJson() before canonicalizing and hashing it. The
did:webvh 1.0 spec (SCID Generation and Verification) requires hashing the
log entry as published ("treat the resulting log entry as a string"), and
the typed round-trip does not preserve every value verbatim. In particular a
DID document service whose `type` is a single-element array, e.g.
`"type": ["DIDCommMessaging"]`, is collapsed to the string
`"type": "DIDCommMessaging"`. After JCS canonicalization an array and a
string are distinct values, so the recomputed SCID no longer matches the
published one and resolution fails for a spec-valid DID.
DID Core permits service `type` to be a string or an array of strings, and
the array form is produced by didwebvh-rs (the reference Rust implementation)
among others, so these DIDs were unresolvable.
Retain the entry's published JSON on parse and canonicalize that for SCID and
entry-hash verification, so the hash is computed over the bytes the
controller signed regardless of how the typed model serializes them.
Adds a regression test using a real didwebvh-rs-minted entry whose DID
document service type is a single-element array; it fails before this change
and passes after.
maratsh
force-pushed
the
fix/webvh-scid-verification-over-published-entry
branch
from
June 13, 2026 19:12
b4f698e to
248dca9
Compare
IVIR3zaM
added a commit
to decentralized-identity/didwebvh-dart
that referenced
this pull request
Jun 14, 2026
…dart#290) Add regression tests ensuring a single-element service.type array (e.g. ["DIDCommMessaging"]) survives SCID and entry-hash verification. Upstream affinidi/affinidi-ssi-dart#290 fixed a bug where rebuilding a log entry from a typed DID-document model collapsed single-element arrays to scalars, changing the JCS bytes and breaking verification. This port keeps the DID document `state` as a verbatim map and was never affected; these tests lock that behaviour in so a future refactor can't regress it. Document the guarantee in the root and package 8000 changelogs.
marat-affinidi
approved these changes
Jun 30, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
SCID and entry-hash verification rebuilt the first log entry from the typed DidWebVhLogEntry via toJson() before canonicalizing and hashing it. The did:webvh 1.0 spec (SCID Generation and Verification) requires hashing the log entry as published ("treat the resulting log entry as a string"), and the typed round-trip does not preserve every value verbatim. In particular a DID document service whose
typeis a single-element array, e.g."type": ["DIDCommMessaging"], is collapsed to the string"type": "DIDCommMessaging". After JCS canonicalization an array and a string are distinct values, so the recomputed SCID no longer matches the published one and resolution fails for a spec-valid DID.DID Core permits service
typeto be a string or an array of strings, and the array form is produced by didwebvh-rs (the reference Rust implementation) among others, so these DIDs were unresolvable.Retain the entry's published JSON on parse and canonicalize that for SCID and entry-hash verification, so the hash is computed over the bytes the controller signed regardless of how the typed model serializes them.
Adds a regression test using a real didwebvh-rs-minted entry whose DID document service type is a single-element array; it fails before this change and passes after.