# v0.7.1 (dev) ## Upgrading - The `wia_trust_anchors` configuration parameter of all services that issue credentials has been renamed to `wptl_trust_anchors`. Additionally, the `wallet_provider` configuration has had parameters added, among which are the Key Attestation private key and certificate. This certificate should validate under one of the `wptl_trust_anchors`, just like the WIA certificate does. Note that the trust anchor under which these certificates are issued need not be the same for the same Wallet Provider. - The PID, as issued by the `pid_issuer`, was updated to match the EUDI PID Rulebook. Some mdoc attribute identifiers now differ from their previous names: `birthdate` is now `birth_date`, `nationalities` is now `nationality`, and `street_address`, `postal_code`, `locality`, and `country` are now `resident_street`, `resident_postal_code`, `resident_city`, and `resident_country` respectively. `house_number` is included as part of `resident_street`. `place_of_birth` is now an object with `country` and `locality` properties. The mdoc `doctype` identifier was changed to match the EUDI PID Rulebook. The attribute `age_over_18` has been removed. `issuing_country`, `issuing_authority` and `sex` are added as new attributes. `birthdate` is now encoded as a `full-date` (CBOR tag 1004). The `issuing_country` and `issuing_authority` must be configured in the PID issuer settings. The NL-specific mdoc attributes `bsn` and `recovery_code` have moved to the domestic `eu.europa.ec.eudi.pid.nl.1` namespace, as required for attributes not defined in the Rulebook. The `pid_attributes` paths in the wallet configuration and any Relying Party requests or registration certificates for these attributes must be updated accordingly. - As part of OpenID4VCI Key Attestations, the Wallet Provider now serves a Status List Token for its Key Storage. In order to facilitate this, it has had the following parameters added to its configuration: - The main section of the configuration has a `public_url` parameter, which should contain the URL at which the Wallet Provider is publicly reachable. - The `key_storage_status_list` section has the combination of `key_identifier` and `key_certificate`, where the latter should contain the public key corresponding to the private in the HSM to which the former parameter points. - Also present in the `key_storage_status_list` are the optional `expiry_in_hours` and `tracking_validity_in_days` parameters, both of which dictate expiration periods as included in the Key Storage Status List Token. - The `wallet_client_ids` setting has been removed from the verification server configuration. It was used to verify the issuer of the Proof of Association (PoA), which has been removed. - Credential Rquest encryption is implemented in both the Wallet and Issuer and is mandatory for all issuing services. These have all had the `credential_request_encryption_key` setting added to their configurations, which should contain a Base64-encoded P-256 ECDH secret key in PKCS 8 format. - The iOS wallet app now needs the numeric App Store id of the app to link to its App Store page from the update screens. It is passed to the Flutter build as `--dart-define=APP_STORE_ID=`. The Fastlane `ios build` and `ios build_simulator` lanes read it from the `APP_STORE_ID` environment variable and fail when it is not set, so every iOS build pipeline must now provide it. Android builds do not need it. When the app was installed through TestFlight, the update screens open TestFlight instead. ## New features - Issuers have a new optional setting `credential_preview_endpoint` (default `true`). When set to `false`, the issuer does not serve the non-standard Credential Preview Endpoint, behaving like a standard OpenID4VCI issuer. This is intended for testing the wallet against such issuers; note that the wallet still requires previews for PID and disclosure based issuance. - Wallet supports X509 certificates with ES384 and RSA (min 2048) keys. - Wallet supports CWT certificates with ES384 and RSA (min 2048) keys. - The issuance server now also publish their status lists in CWT format, as required for mdoc credentials by the draft second edition of ISO 18013-5. When serving a status list, the format is chosen based on the `Accept` header of the request (`application/statuslist+jwt` or `application/statuslist+cwt`). - Wallet now requires the Wallet Configuration to have a key identifier (`kid`). The `kid` is used as the path component on the configured base url when downloading the Wallet Configuration. ## Interoperability improvements - The `attestation` proof type has been implemented according to OpenID4VCI, HAIP and TS3. Both the Issuer and the WSCD have switched to this proof type instead of `jwt`. NB: The `jwt` proof type has not yet been updated to conform to OpenID4VCI 1.0 and its implementation is now effectively dead code. - The wallet now also accepts a registration certificate in JWT format that is included in `verifier_info` or `issuer_info` as a compact JWT, without the additional base64url encoding required by ETSI TS 119 472-2. - The wallet now also accepts a registration certificate in `verifier_info` or `issuer_info` whose base64url encoding includes padding. - The PID, as issued by the `pid_issuer`, was updated to match the EUDI PID Rulebook. Note that `portrait`, even though being mandatory, is not included at all because the BRP does not provide it. `place_of_birth` is also not marked as mandatory because our implementation cannot handle that yet. - The JPEG 2000 image format, which may be included in the mDL, is now supported. - The wallet now supports disclosure requests that ask for credentials in different formats (mdoc and SD-JWT) in the same DCQL query. Previously, the wallet aborted the session when receiving such a request. ## Bug fixes - The wallet accepts wallet configurations fetched from the configuration server again. Since v0.6.0, it required the `typ` header of the configuration JWT to be exactly `JWT`, while the configuration is signed with `jwt`. The `typ` header of all JWTs is now compared case-insensitively, as required by RFC 7515. - The wallet now only stores the `ETag` of a wallet configuration after accepting it. Previously, a rejected configuration was considered unmodified on every subsequent fetch, so it was never evaluated again. - The wallet app no longer gets stuck on the splash screen when the wallet configuration contains a maintenance window. The maintenance screen now also shows the window in local time instead of UTC. ## Wallet app improvements - Update to Flutter 3.47.8. ## Admin portal improvements - The `admin-portal` now uses the task management API of the Wallet Provider, so that administrators can create, withdraw and review tasks. The task lists show open tasks, the user's own open tasks and the task history, and a new details page shows a task and its review and execution result. - Tasks to revoke wallets can now be created: administrators search for wallets by Wallet ID and add them to a list. Wallets that are already revoked can not be added. Tasks to (de)block users or revoke the wallet solution are not supported yet. - Users without the required privileges now see a dedicated forbidden page. - The `admin-portal` Helm chart has a new optional `environment` setting. Its value is shown in the sidebar and on the login page, and is hidden when empty.