v0.7.1 (dev)

Upgrading

  • The wia_trust_anchors configuration parameter of all services that issue credentials has been renamed to wptl_trust_anchors. Additionally, the wallet_provider configuration has had parameters added, among which are the Key Attestation private key and certificate. This certificate should validate under one of the wptl_trust_anchors, just like the WIA certificate does. Note that the trust anchor under which these certificates are issued need not be the same for the same Wallet Provider.

  • The PID, as issued by the pid_issuer, was updated to match the EUDI PID Rulebook. Some mdoc attribute identifiers now differ from their previous names: birthdate is now birth_date, nationalities is now nationality, and street_address, postal_code, locality, and country are now resident_street, resident_postal_code, resident_city, and resident_country respectively. house_number is included as part of resident_street. place_of_birth is now an object with country and locality properties. The mdoc doctype identifier was changed to match the EUDI PID Rulebook. The attribute age_over_18 has been removed. issuing_country, issuing_authority and sex are added as new attributes. birthdate is now encoded as a full-date (CBOR tag 1004). The issuing_country and issuing_authority must be configured in the PID issuer settings. The NL-specific mdoc attributes bsn and recovery_code have moved to the domestic eu.europa.ec.eudi.pid.nl.1 namespace, as required for attributes not defined in the Rulebook. The pid_attributes paths in the wallet configuration and any Relying Party requests or registration certificates for these attributes must be updated accordingly.

  • As part of OpenID4VCI Key Attestations, the Wallet Provider now serves a Status List Token for its Key Storage. In order to facilitate this, it has had the following parameters added to its configuration:

    • The main section of the configuration has a public_url parameter, which should contain the URL at which the Wallet Provider is publicly reachable.

    • The key_storage_status_list section has the combination of key_identifier and key_certificate, where the latter should contain the public key corresponding to the private in the HSM to which the former parameter points.

    • Also present in the key_storage_status_list are the optional expiry_in_hours and tracking_validity_in_days parameters, both of which dictate expiration periods as included in the Key Storage Status List Token.

  • The wallet_client_ids setting has been removed from the verification server configuration. It was used to verify the issuer of the Proof of Association (PoA), which has been removed.

  • Credential Rquest encryption is implemented in both the Wallet and Issuer and is mandatory for all issuing services. These have all had the credential_request_encryption_key setting added to their configurations, which should contain a Base64-encoded P-256 ECDH secret key in PKCS 8 format.

  • The iOS wallet app now needs the numeric App Store id of the app to link to its App Store page from the update screens. It is passed to the Flutter build as --dart-define=APP_STORE_ID=<id>. The Fastlane ios build and ios build_simulator lanes read it from the APP_STORE_ID environment variable and fail when it is not set, so every iOS build pipeline must now provide it. Android builds do not need it. When the app was installed through TestFlight, the update screens open TestFlight instead.

New features

  • Issuers have a new optional setting credential_preview_endpoint (default true). When set to false, the issuer does not serve the non-standard Credential Preview Endpoint, behaving like a standard OpenID4VCI issuer. This is intended for testing the wallet against such issuers; note that the wallet still requires previews for PID and disclosure based issuance.

  • Wallet supports X509 certificates with ES384 and RSA (min 2048) keys.

  • Wallet supports CWT certificates with ES384 and RSA (min 2048) keys.

  • The issuance server now also publish their status lists in CWT format, as required for mdoc credentials by the draft second edition of ISO 18013-5. When serving a status list, the format is chosen based on the Accept header of the request (application/statuslist+jwt or application/statuslist+cwt).

  • Wallet now requires the Wallet Configuration to have a key identifier (kid). The kid is used as the path component on the configured base url when downloading the Wallet Configuration.

Interoperability improvements

  • The attestation proof type has been implemented according to OpenID4VCI, HAIP and TS3. Both the Issuer and the WSCD have switched to this proof type instead of jwt. NB: The jwt proof type has not yet been updated to conform to OpenID4VCI 1.0 and its implementation is now effectively dead code.

  • The wallet now also accepts a registration certificate in JWT format that is included in verifier_info or issuer_info as a compact JWT, without the additional base64url encoding required by ETSI TS 119 472-2.

  • The wallet now also accepts a registration certificate in verifier_info or issuer_info whose base64url encoding includes padding.

  • The PID, as issued by the pid_issuer, was updated to match the EUDI PID Rulebook. Note that portrait, even though being mandatory, is not included at all because the BRP does not provide it. place_of_birth is also not marked as mandatory because our implementation cannot handle that yet.

  • The JPEG 2000 image format, which may be included in the mDL, is now supported.

  • The wallet now supports disclosure requests that ask for credentials in different formats (mdoc and SD-JWT) in the same DCQL query. Previously, the wallet aborted the session when receiving such a request.

Bug fixes

  • The wallet accepts wallet configurations fetched from the configuration server again. Since v0.6.0, it required the typ header of the configuration JWT to be exactly JWT, while the configuration is signed with jwt. The typ header of all JWTs is now compared case-insensitively, as required by RFC 7515.

  • The wallet now only stores the ETag of a wallet configuration after accepting it. Previously, a rejected configuration was considered unmodified on every subsequent fetch, so it was never evaluated again.

  • The wallet app no longer gets stuck on the splash screen when the wallet configuration contains a maintenance window. The maintenance screen now also shows the window in local time instead of UTC.

Wallet app improvements

  • Update to Flutter 3.47.8.

Admin portal improvements

  • The admin-portal now uses the task management API of the Wallet Provider, so that administrators can create, withdraw and review tasks. The task lists show open tasks, the user’s own open tasks and the task history, and a new details page shows a task and its review and execution result.

  • Tasks to revoke wallets can now be created: administrators search for wallets by Wallet ID and add them to a list. Wallets that are already revoked can not be added. Tasks to (de)block users or revoke the wallet solution are not supported yet.

  • Users without the required privileges now see a dedicated forbidden page.

  • The admin-portal Helm chart has a new optional environment setting. Its value is shown in the sidebar and on the login page, and is hidden when empty.