# v0.7.0 (dev)

## Upgrading

- The `wia_trust_anchors` configuration parameter of all services that issue
  credentials has been renamed to `wptl_trust_anchors`. Additionally, the
  `wallet_provider` configuration has had parameters added, among which are the
  Key Attestation private key and certificate. This certificate should validate
  under one of the `wptl_trust_anchors`, just like the WIA certificate does.
  Note that the trust anchor under which these certificates are issued need not
  be the same for the same Wallet Provider.
- The PID, as issued by the `pid_issuer`, was updated to match the EUDI PID
  Rulebook. Some mdoc attribute identifiers now differ from their previous
  names: `birthdate` is now `birth_date`, `nationalities` is now `nationality`,
  and `street_address`, `postal_code`, `locality`, and `country` are now
  `resident_street`, `resident_postal_code`, `resident_city`, and
  `resident_country` respectively. `house_number` is included as part of
  `resident_street`. `place_of_birth` is now an object with `country` and
  `locality` properties. The mdoc `doctype` identifier was changed to match the
  EUDI PID Rulebook. The attribute `age_over_18` has been removed.
  `issuing_country`, `issuing_authority` and `sex` are added as new attributes.
  `birthdate` is now encoded as a `full-date` (CBOR tag 1004). The
  `issuing_country` and `issuing_authority` must be configured in the PID issuer
  settings. The NL-specific mdoc attributes `bsn` and `recovery_code` have moved
  to the domestic `eu.europa.ec.eudi.pid.nl.1` namespace, as required for
  attributes not defined in the Rulebook. The `pid_attributes` paths in the
  wallet configuration and any Relying Party requests or registration
  certificates for these attributes must be updated accordingly.
- As part of OpenID4VCI Key Attestations, the Wallet Provider now serves a
  Status List Token for its Key Storage. In order to facilitate this, it has had
  the following parameters added to its configuration:
    - The main section of the configuration has a `public_url` parameter, which
      should contain the URL at which the Wallet Provider is publicly reachable.
    - The `key_storage_status_list` section has the combination of
      `key_identifier` and `key_certificate`, where the latter should contain
      the public key corresponding to the private in the HSM to which the former
      parameter points.
    - Also present in the `key_storage_status_list` are the optional
      `expiry_in_hours` and `tracking_validity_in_days` parameters, both of
      which dictate expiration periods as included in the Key Storage Status
      List Token.
- The `wallet_client_ids` setting has been removed from the verification server
  configuration. It was used to verify the issuer of the Proof of Association
  (PoA), which has been removed.

## New features

- Issuers have a new optional setting `credential_preview_endpoint` (default
  `true`). When set to `false`, the issuer does not serve the non-standard
  Credential Preview Endpoint, behaving like a standard OpenID4VCI issuer. This
  is intended for testing the wallet against such issuers; note that the wallet
  still requires previews for PID and disclosure based issuance.
- Wallet supports X509 certificates with ES384 and RSA (min 2048) keys.

## Interoperability improvements

- The `attestation` proof type has been implemented according to OpenID4VCI,
  HAIP and TS3. Both the Issuer and the WSCD have switched to this proof type
  instead of `jwt`. NB: The `jwt` proof type has not yet been updated to conform
  to OpenID4VCI 1.0 and its implementation is now effectively dead code.
- The wallet now also accepts a registration certificate in JWT format that is
  included in `verifier_info` or `issuer_info` as a compact JWT, without the
  additional base64url encoding required by ETSI TS 119 472-2.
- The PID, as issued by the `pid_issuer`, was updated to match the EUDI PID
  Rulebook. Note that `portrait`, even though being mandatory, is not included
  at all because the BRP does not provide it. `place_of_birth` is also not
  marked as mandatory because our implementation cannot handle that yet.
- The JPEG 2000 image format, which may be included in the mDL, is now
  supported.

## Bug fixes

- The wallet accepts wallet configurations fetched from the configuration server
  again. Since v0.6.0, it required the `typ` header of the configuration JWT to
  be exactly `JWT`, while the configuration is signed with `jwt`. The `typ`
  header of all JWTs is now compared case-insensitively, as required by
  RFC 7515.
- The wallet now only stores the `ETag` of a wallet configuration after
  accepting it. Previously, a rejected configuration was considered unmodified
  on every subsequent fetch, so it was never evaluated again.