Verifiable Credentials Working Group Telco — Minutes

Date: 2025-01-29

See also the Agenda and the IRC Log

Attendees

Present: Brent Zundel, Ivan Herman, Ted Thibodeau Jr., Mahmoud Alkhraishi, Michael Jones, Rene Leveille, Kevin Dean, Benjamin Young, Dave Longley, David Chadwick, Hiroyuki Sano, Joe Andrieu, Will Abramson, Dmitri Zagidulin, Jennie Meier

Regrets:

Guests:

Chair: Brent Zundel

Scribe(s): Michael Jones, Mahmoud Alkhraishi

Content:

Ivan Herman: CR of CID will go out tomorrow.
… There is a preference to have one big request for PRs rather than separate ones.
… We have 7 or possibly 9 documents.
… Idea is to submit them all to management at the same time.
… VC-JOSE-COSE and (another document) are dependent upon IETF standards.
… Yes, we can publish them provided that the dependencies are technically stable.
… Then we can take them to standard with the rest.
… Of course, the other normal requirements for PR need to be done.

Brent Zundel: SD-JWT is on the verge of that state.
… Latest requests for changes are only to the privacy considerations section.
… SD-JWT is close to the state where we can go to proposed PR.
… I’m not sure of the state of BBS.

Michael Jones: BBS remains a CFRG WD, there are still reviews happening. It is not stable.

Ivan Herman: This is the dependency: https://www.w3.org/TR/vc-di-bbs/.

Will Abramson: This is the github - https://github.com/w3c/vc-di-bbs.

Michael Jones: we cannot claim the dependency is stable.

Brent Zundel: See this is the IETF document for BBS.

Ivan Herman: It is never to early to think about having the W3C issue a press release when we go to REC.
… We should have a clear yes or no about wanting a press release.

1. VC JOSE COSE.

Brent Zundel: VC-JOSE-COSE next on our agenda.

Brent Zundel: https://github.com/w3c/vc-jose-cose/issues.

1.1. Is there a copy-paste error in the examples of 3.1.2? (issue vc-jose-cose#325)

See github issue vc-jose-cose#325.

Michael Jones: I reviewed it this morning, hoping to get a PR done, I agree with the suggestion about the Cut + paste error. I don’t know how gabe was signing the JWTs given that we haven’t published the keys, the signature is kind of irrelevant. I will try to investigate how we have signed other examples.

Ivan Herman: we have a respec extension that allows us to sign, Benjamin was maintaining it he should be able to let us know.
… There’s a respec extension that generates signatures for VC-JOSE-COSE. I’ve used it before.

1.2. How this differs from JWT VC Presentation Profile? (issue vc-jose-cose#320)

See github issue vc-jose-cose#320.

Michael Jones: what he is talking about is that there is differences between the two specs, I believe the DIF profile is obsolete but I propose close the issue on that basis.

Brent Zundel: anyone opposed to adding pending close? no opposition, adding.
… Would anyone be opposed to me adding a “pending close” label and potentially closing in a week?

Michael Jones: (There were no objections).

1.3. edits lost in squash merges (issue vc-jose-cose#310)

See github issue vc-jose-cose#310.

Brent Zundel: This was raised by you, Ted.
… What is the action that would satisfy this issue, Ted?

Ted Thibodeau Jr.: There is no good action.
… All I can do is review the whole document and look for commits that were lost.
… Squash merges can apparently lose commits.

Brent Zundel: Do you want to keep this open until you’ve completed the review or close it?

Ted Thibodeau Jr.: It might as well be closed.

Brent Zundel: I will close it after the call.

2. VC JSON Schema.

Brent Zundel: We will have a discussion on 11th-hour editorship.

Michael Jones: Block no longer exists.

Michael Jones: Mike Prorock no longer attends these calls.

Brent Zundel: Mahmoud has recently added a number of edits.
… Should we add Mahmoud as an editor?

Dave Longley: +1 to Mahmoud.

Ivan Herman: +1 to mahmoud.

Mahmoud Alkhraishi: I am willing to do this.

Brent Zundel: Mahmoud - Please raise a PR adding yourself as an editor.

Mahmoud Alkhraishi: I have raised PRs for the things that I could.

Brent Zundel: We will go through PRs first, then issues.

Brent Zundel: get to issueshttps://github.com/w3c/vc-json-schema/pulls.

2.1. remove references to older schema drafts (pr vc-json-schema#243)

See github pull request vc-json-schema#243.

Ivan Herman: +1 to remove older schemas.

Brent Zundel: This is a straightforward PR. I encourage people to view it.
… Our standard work mode is if there are no concerns raised after a week, the PR can be merged.

Michael Jones: Don’t we also require a few approvals?

Brent Zundel: Yes.
… If anyone has concerns after a PR has been merged, we can always unmerge it.

Ivan Herman: Mahmoud, when you create the PR adding yourself as an editor, please also update the code owners.

2.2. update credentialSchema id to align with spec text (pr vc-json-schema#242)

See github pull request vc-json-schema#242.

Brent Zundel: This is the tiniest of PRs and I would be surprised if there is opposition to it.

2.3. update media types (pr vc-json-schema#241)

See github pull request vc-json-schema#241.

Brent Zundel: This changes the media types to align with what we’ve registered.
… Ted, if you could re-review, that would be appreciated.

2.4. add ref example (pr vc-json-schema#240)

See github pull request vc-json-schema#240.

Brent Zundel: A comment will result in updates to the PR.
… It does what it says in the title.

Mahmoud Alkhraishi: Ted’s comment appears in a few other areas. I will fix all the occurrences.
… I would like to merge them all in the same PR.

Brent Zundel: That makes sense to me.

Ted Thibodeau Jr.: +1 for mkhraisha’s plan.

Brent Zundel: This PR will add an example and fix the HTML.
… Those are the PRs.

2.5. https://github.com/w3c/vc-json-schema/issues.

Brent Zundel: We’re going to move to the issues.

2.6. Problematic support of multiple schema versions when using JsonSchemaCredential (issue vc-json-schema#239)

See github issue vc-json-schema#239.

Brent Zundel: Will be fixed by the PR removing additional schema versions.

2.7. Invalid credentialSchema.id for JsonSchemaCredential (issue vc-json-schema#238)

See github issue vc-json-schema#238.

Brent Zundel: Will be addressed when the PR is merged.

2.8. Update media types to conform to the VC Data Model (issue vc-json-schema#236)

See github issue vc-json-schema#236.

Brent Zundel: We have a PR that does that.

2.9. Question regarding JsonSchemaCredential (issue vc-json-schema#235)

See github issue vc-json-schema#235.

Brent Zundel: A PR has been raised that addresses this.

Mahmoud Alkhraishi: I would love it if we could get more implementers.
… I’m going to be working on the JSON Schema suite as well.

Ivan Herman: You don’t have to be a W3C member to participate in the testing.

2.10. Monitor the JSON Schema organization for publication of a long term support JSON Schema spec (issue vc-json-schema#183)

See github issue vc-json-schema#183.

Brent Zundel: In my opinion, this should continue to be marked future.
… Once (something) exists, we should update this spec to reference it.

Ivan Herman: There are three or four different versions of schemas.
… Ideally there should be only one.

Brent Zundel: The JSON Schema org has stable versions we can point to.
… They haven’t officially finalized anything.
… If they do, we should point to that.

Ivan Herman: This would be a maintenance change.

2.11. Add examples of validating VC-JWT and Linked Data Proof credentials (issue vc-json-schema#143)

See github issue vc-json-schema#143.

Brent Zundel: We are currently in CR with this.
… Currently assigned to someone not actively participating. Hopefully Mahmoud can pick this up.
… Post-CR is now. Future is for another group in the future.

Ivan Herman: +1 for one of each.

Dave Longley: +1 to one of each being sufficient.

Brent Zundel: When this was raised, we weren’t fully stable with VC-JWT and Linked Data Proofs. They are now stable, and so this becomes actionable.

Mahmoud Alkhraishi: How do we find the keys used?

Brent Zundel: I’m not aware of any ways of finding these keys. So using your own setup is fine.

Ivan Herman: +1.

Brent Zundel: Thank you Mahmoud for stepping forward to work on this.

Mahmoud Alkhraishi: thank you!

3. Implementation Concerns.

Brent Zundel: We have plenty of implementations for VC-DATA-MODEL.
… We have implementations for VC-DATA-INTEGRITY and some of the signing specs, but possibly not BBS.

Dave Longley: The IETF has recently updated their APIs for BBS.

Ivan Herman: Do we have 2 independent implementations of the BBS specification.

Dave Longley: We have at least 2. We may have more than that.

Benjamin Young: We have 5 implementations of the BBS specification.

Brent Zundel: BitstringStatusList: we are looking for implementations supporting multiple statuses in the same list.
… I know that measur.io has an implementation.
… I know that there are two. Whether the test suite report shows that is another question.

Ivan Herman: If there are implementations that have difficulty integrating with the test suite, we can amend the report to include their own assertions of compliance.
… If there are two implementations, we should amend the report to say that so we can proceed.

Benjamin Young: We have 7 implementations on Bitstring Status List: https://w3c.github.io/vc-bitstring-status-list-test-suite/.

biggluehat: What difficulties are being faced?
… There are sections where there are no implementations of the features.

Dave Longley: +1 to get self-attested reports from implementations if we need to rely on them for any feature.

Brent Zundel: It’s less ability to integrate than capacity and resources to do so.
… There are aspects of some of the test suites that my implementers have pushed back on.
… Integration would require implementation of features we don’t plan to add to our products.

Benjamin Young: The test suite has a pretty minimal http API.
… We’ve tried to make it as simple as possible.

Ivan Herman: Looking at the implementation report there are large sections not implemented.
… Does that mean we will need to remove these features?

Benjamin Young: Some of the tests are “if-implemented”.
… I’m not sure how at-risk plays out for optional features that are not implemented.

Brent Zundel: VC-JOSE-COSE test suite.
… We have a single independent implementation for all features. I know that there are more.
… It’s for editors of the spec and myself to evangelize that the test suite is ready for people to interact with it.
… Mahmoud, we’re meeting with Gabe to do some work on it.

Mahmoud Alkhraishi: Yes.

Brent Zundel: Is it time to reach out to implementers I know of?

Michael Jones: I would assert that it’s time to reach out.

Dave Longley: if we’re still lagging on one or more of these by the time the others go to PR we should not delay those others, but as ivan said, it would be good to have them all together.

Brent Zundel: There was concern that the one independent implementation is Gabe’s, who wrote the test suite.
… Those are the implementation consideration concerns I’m aware of for all our specs.

Ivan Herman: What do we do for CID?
… CID isn’t something that should be tested separately.
… We have to report it in some manner.

Brent Zundel: That is an excellent question.
… My suggestion is to make that a primary topic for our call next week.

Benjamin Young: Patrick St. Louis and I are working on creating a JSON Schema based validator for CID documents.
… If that’s not necessary, we can drop it.

Brent Zundel: I think that’s sufficient.
… That’s better than arguing that it’s tested elsewhere.
… Thanks all for coming.
… Thanks Mahmoud for assuming editorship of VC JSON Schema to get it over the line.