Verifiable Credentials Working Group Telco — Minutes

Date: 2023-07-05

See also the Agenda and the IRC Log

Attendees

Present: Kristina Yasuda, Shigeya Suzuki, Michael Jones, Manu Sporny, Joe Andrieu, Gabe Cohen, Greg Bernstein, Phillip Long, Chris Abernethy, Kevin Griffin, David Chadwick, Will Abramson, Ted Thibodeau Jr., David Waite, Brent Zundel, Orie Steele

Regrets:

Guests:

Chair: Kristina Yasuda

Scribe(s): Michael Jones, Manu Sporny

Content:

Kristina Yasuda: Agenda: work item updates and PRs.

1. Work item updates and PRs.

Kristina Yasuda: Call out items that need attention.

Manu Sporny: https://github.com/w3c/vc-data-model/pulls.

Manu Sporny: There are a lot of new VCDM pull requests.
… We’re getting good review from people that normally review PRs.
… Some WG members may not be aware of them.
… Some are blocked.
… We need to figure out what we’re going to do with #1100 and #1101.
… Confidence is blocked in the CCG.
… The bottom 6 or 7 are currently blocked.
… For Data Integrity, we’ve been marking issues.
… and PRs.
… Definitely keep an eye on the issues and PRs there.

1.1. Add confidenceMethod to table of reserved terms and v2 @context (pr vc-data-model#1142)

See github pull request vc-data-model#1142.

Michael Prorock: If no one is stepping up to do #1142 maybe we can close it and pick it up later if need be.

Manu Sporny: I’d be a +1 to close the PR, but we should link to specs that exist.

Manu Sporny: agree that we shouldn’t close w/o Oliver being here.

Kristina Yasuda: Oliver’s not on the call so we can’t close now.

Michael Prorock: I didn’t mean close right now. I just don’t want it to hang out indefinitely.

2. issue discussion.

Kristina Yasuda: https://github.com/w3c/vc-data-model/issues?q=is%3Aissue+is%3Aopen+-label%3Abefore-CR+-label%3A%22pending+close%22+sort%3Aupdated-asc.

2.1. need resourceIntegrity in vocab and under w3c (issue vc-data-model#1152)

See github issue vc-data-model#1152.

Manu Sporny: This is definitely pre-candidate rec.

Michael Prorock: I’m fine raising the PR. I may be delayed two weeks due to travel.

2.2. test approach for resource integrity (issue vc-data-model#1153)

See github issue vc-data-model#1153.

Manu Sporny: This is definitely pre-CR.
… It’s about knowing how the group will test the feature.
… We need thoughts from Mike P. on how to test the feature. Then we can close the issue.

Michael Prorock: +1 manu.

Manu Sporny: It need to be there until there’s an agreed upon plan.

Michael Prorock: Assign me the issue.

2.3. Transfer respec-vc to W3C VCWG? (issue vc-data-model#1154)

See github issue vc-data-model#1154.

Manu Sporny: This is a post-CR thing.

Kristina Yasuda: Why didn’t this already happen? What’s the IPR status?

Manu Sporny: This just didn’t happen. I believe it’s Open Source.

Phillip Long: +1 to transferring - BSD is good!

Kristina Yasuda: It’s currently a BSD 3 clause license.
… The licensing needs to be addressed.
… The next three are horizontal review. I’ll skip them. We don’t have horizontal review responses yet.

2.4. NIST defines “credential” differently (issue vc-data-model#1047)

See github issue vc-data-model#1047.

Orie Steele: all the terms needs better grounding.

Kristina Yasuda: I think it’s ready for PR.

Orie Steele: possible that the normative “vocab” can help with this.

Brent Zundel: regardless, this is post-cr, yes?

Kristina Yasuda: Last time Charles agreed to be assigned - three months ago.

Orie Steele: vocab is normative now though right?

Manu Sporny: It depends upon what the PR does. I could be pre or post CR.
… Vocab is now normative, Orie.

Orie Steele: if vocab is normative, and terms are not consistent with vocab, its pre CR.

Kristina Yasuda: It may be that we will align the definition with NIST.
… What do you want to happen here, Orie?

Orie Steele: I would like to see a PR that updates the related terms.

Manu Sporny: In what way?

Orie Steele: and leverages our ability to provide citations and remove confusion.

Brent Zundel: The most conservative thing to do is to mark it pre-CR.

Kristina Yasuda: I’ll mark it before CR.

2.5. Media Types and HTTP (issue vc-data-model#1118)

See github issue vc-data-model#1118.

Manu Sporny: I think we have clear media types in the spec now.
… That’s what this issue was attempting to resolve.
… We could mark it pending close.
… I’d be interested to hear from Orie.

Orie Steele: This issue is specific to HTTP.
… At least some basic guidance on where you expect them to show up is needed to close this issue.
… We need a sentence about registering types with IANA.
… It could show up in the content type or accept header.

Manu Sporny: What Orie is asking for is to say somewhere that it is expected that HTTP endpoints use accept headers, etc.

Orie Steele: +1 manu.

Orie Steele: explain how to use the requested registrations.

Manu Sporny: This wouldn’t go in the IANA Considerations.
… This is ready for PR.

Orie Steele: +1 selfissued and manu.

Michael Prorock: +1.

Michael Jones: No, it doesn’t go in the IANA registration, it goes in text in the body of the specification describing how we expect to use the media types. I’ve registered a lot of media types, none of them say what you use them for in the registration.

Kristina Yasuda: I’m assigning Orie.

2.6. Determine interoperable way for Holder to make claims directly in VPs (issue vc-data-model#860)

See github issue vc-data-model#860.

Kristina Yasuda: This is about self-signed VCs, right?

Orie Steele: Brent has a raised a PR that addresses a lot of this issue.
… Pull 1181.
… PR 1181 doesn’t currently reflect what you can do with a VP.
… Brent, can you please revise per the comments.

See github pull request vc-data-model#1181.

Orie Steele: it could address that issue.

Brent Zundel: I don’t remember if I tried to address the comments or not yet, but I definitely can.

Kristina Yasuda: I’ve assigned this to you, Brent.

Joe Andrieu: present?

2.7. (issue vc-data-model#928)

See github issue vc-data-model#928.

Orie Steele: I suggest closing, we have addressed this in the reserved terms table.

Manu Sporny: +1 to close, agree w/ Orie, we’re done here.

Kristina Yasuda: I don’t understand why this is dependent on a PR 1142.

Orie Steele: I will drop the confidenceMethod part of https://github.com/w3c/vc-data-model/pull/1142 if CCG does not adopt the proposal.

Orie Steele: +1 manu, it adds links.

Brent Zundel: The PR does both confidence method and render method.

Manu Sporny: This issue is about adding render method to VCDM.
… I think we can close this issue.

Kristina Yasuda: Render method is already in as a reserved property.
… Closing it.

Manu Sporny: That’s the PR we added renderMethod reservation in https://github.com/w3c/vc-data-model/pull/1108.

2.8. How should we refer to the Securing specifications? (issue vc-data-model#1105)

See github issue vc-data-model#1105.

Kevin Griffin: The queue is for issue #1105.
… I think the language that was merged in PR #1086 is fine. I agree with Brent.

Manu Sporny: +1 to what brent said, no further action needed, close it.

Orie Steele: -1.

Kristina Yasuda: You’re agreeing with Brent’s comment to close with no action, right?

Orie Steele: +1 to closing.

Kristina Yasuda: Manu agrees.
… I’m closing it.

Orie Steele: Brent mentions that proof can be used for things that are not Data Integrity.
… We will still have to describe proof and what to do when you get a different kind of proof.
… We are not citing any securing spec for non Data Integrity uses.
… I’d like that to be made more explicit.

Manu Sporny: It would be good to highlight that.
… proof is not just for Data Integrity.
… The object that’s pointed to needs to have a type.

Orie Steele: The vocab defines proof as being specific to JSON-LD… but afaik, its not required to be of type “DataIntegrityProof”.

Orie Steele: implementers might need to understand that.

Kristina Yasuda: We want Brent’s PR to address this.

Orie Steele: I don’t think Brent’s PR can address this.
… We need a standalone PR enumerating the two securing specifications.
… We need to say how to use it with the Vocabulary we have.
… Proof is arbitrary JSON-LD.
… You’d better know what you’re doing.
… As a security person, this scares me.
… We need to address the challenges of conflating the securing methods with the VCDM.

Brent Zundel: We need a different PR.

Manu Sporny: I can take a shot at this.

Orie Steele: thank you manu!

2.9. Arrays of Arrays are problematic in VCDM (issue vc-data-model#1132)

See github issue vc-data-model#1132.

Orie Steele: Lets add an example that has a matrix in it :).

Kristina Yasuda: We can’t find text in @context that defines how to do that.

Orie Steele: I object,.

Kristina Yasuda: Arrays of arrays are not valid JSON-LD.
… I’m going to put pending close unless there are objections.

Orie Steele: it needs to be explained in the spec.

Michael Prorock: +1 orie.

Orie Steele: Having answered this question many times, if our Core DM is JSON-LD, we’re obliged to describe this detail.
… If people try to do what works in JSON they will be really unhappy.
… We should describe @list and @type and ordering.
… That kind of guidance needs to be in our spec.

Orie Steele: We could recommend @type, @json, @list.

Kristina Yasuda: Could you take a stab at this, Orie?

Orie Steele: etc…

Orie Steele: I think it would be better for someone more experienced in JSON-LD to do that.

Manu Sporny: You can do arrays of arrays and arrays of lists.

Orie Steele: +1 Manu, it would be good to comment on “how” to do the things… and how to use @context to do them.

Manu Sporny: We need a concrete use cases.
… I’m fine to keep it open.
… If someone wants to expose an array of ordered arrays that can do it one way and if they want RDF semantics they can do it another way.
… I’m not volunteering to do it.
… We need someone who knows what we’re trying to accomplish.

Orie Steele: +1 to providing guidance on how to model things in JSON-LD.

Manu Sporny: There’s lots of other things we can do that we’re not providing guidance for in the spec.

Orie Steele: especially the comment about how to model arrays or arrays, and maps of maps.

Manu Sporny: If you want JSON semantics, use @json.

Michael Prorock: A common example is arrays of arrays of (longitude, latitude) or (longitude, latitude, altitude).

Orie Steele: +1 to pointing to geojsonld when providing guidance on locations in JSON-LD.

Michael Prorock: See https://geojson.org/geojson-ld/.

Manu Sporny: There’s a Geo JSON-LD spec.

Michael Prorock: This would be a very helpful example.

2.10. Normative guidance regarding @context is not clear (issue vc-data-model#1090)

See github issue vc-data-model#1090.

Orie Steele: saddly not enough.

Manu Sporny: Brent said this should be addressed if PR 1158 is merged. Orie agreed.

Orie Steele: It answers the question about the literal @context value being normative. It doesn’t say what to do with the value.
… We could close this issue.
… But we need to explain why we made @context normative.
… Documents are compacted by default. Expanding is something you do with @context.
… We should be clear on what processors do and what to do if errors occur when processing.

Michael Jones: Orie and friends, is there an issue to mark that we do need to describe what you do with @context, and if not, can one be filed?

Orie Steele: I think there is not one that addresses it directly…

Kristina Yasuda: We could leave this open or file a new issue.
… What do you want to do, Orie?

Orie Steele: I will file a new issue and mark this one pending close.

2.11. Evidence extension point (was: Improve tests for Evidence) (issue vc-data-model#870)

See github issue vc-data-model#870.

Kristina Yasuda: Is this addressed by evidence being in the reserved properties, Orie?

Orie Steele: Sort of.
… It’s pretty bad form to reserve something that you can’t find any interoperable implementations of.
… If there’s a stronger evidence type, that would be better to revert to.

Kristina Yasuda: I think that EBSI and Kerry in EDU are using evidence.

Orie Steele: right, but each party using evidence is using the predicate and AFAIK, the type has no interop?

Phillip Long: In the education community, it’s often used with assertions of skills and confidences.

Greg Bernstein: Phil is evidence in the new clr 2 spec?

Phillip Long: @GregB - lemme look.

Greg Bernstein: CLR 2.0 https://www.imsglobal.org/spec/clr/v2p0#evidence.

Phillip Long: @GregB it’s used frequently in the CLRv2: see https://www.imsglobal.org/node/205106#evidence, and, https://www.imsglobal.org/node/205106#evidence-0 for examples.

Manu Sporny: I see that Gabe is saying that TBD will be using it.
… The OpenID eKYC-IDA spec uses it.

Orie Steele: fwiw, i dont think anyone is using it in any interoperable way… and 2, we have no ability to encourage interop based on what we have been doing.

Manu Sporny: We need to see some level of interop demonstration.
… I believe you need at least 2 interoperable implementations to reserve a term.
… There are a number of people using it in some capacity.
… But interop has yet to be demonstrated.

David Chadwick: You can test that 2 implementations will work with the evidence property.
… Testing the business logic is another thing altogether.
… I don’t think our spec specifies the business logic.

Manu Sporny: That was the model we were working under in the V1 and V1.1 WGs.
… It seems like the V2 WG is upping the bar.
… It seems to be what people are pushing towards.

Orie Steele: +1 Manu.

Manu Sporny: Several accepted PRs have asked for more.

Kristina Yasuda: What does that mean in terms of the spec text or directory?

David Chadwick: I don’t see how you can put those conformance tests into the VCDM test suite.
… There are different applications that will have different specifications of evidence.
… They will be specific to those groups of users and won’t be generic.

Orie Steele: If the VCDM defines the evidence property and it’s defined in the normative @context then there are positive and negative data model tests than can be applied to it.
… even if what the property means is completely untestable.

David Chadwick: +1 to Orie.

Kristina Yasuda: I’m leaving this open. The IRC comments will be reflected in the issue.

Orie Steele: can we cite IMS global normatively?

Phillip Long: @Orie - yes, they have six implementers as I recall.

Orie Steele: maybe good to do that, when keeping the property.

Manu Sporny: The next step for this issue should be to refer to Phil’s citations above.

Phillip Long: I can be assigned this issue. I will add citations to the issue.

Kristina Yasuda: Brent will chair next week.
… We will probably cancel in two weeks.