15:18:05 RRSAgent has joined #vcwg-special 15:18:09 logging to https://www.w3.org/2023/12/12-vcwg-special-irc 15:18:10 RRSAgent, make logs Public 15:18:41 please title this meeting ("meeting: ..."), ivan 15:18:41 Meeting: Verifiable Credentials Working Group Special Topic Call on Outstanding PRs 15:18:41 Date: 2023-12-12 15:18:41 chair: brent 15:18:41 Agenda: https://www.w3.org/events/meetings/f6342df0-f7b5-4fc9-babd-61e55dc5fc2f/20231212T110000/ 15:48:02 brent has joined #vcwg-special 15:58:09 present+ 15:59:01 present+ brent 16:01:30 present+ 16:02:00 present+ bigbluehat 16:02:24 present+ JoeAndrieu 16:02:34 present+ dlongley 16:02:55 dmitriz has joined #vcwg-special 16:03:11 present+ TallTed 16:03:22 present+ dmitriz 16:04:08 andres has joined #vcwg-special 16:04:15 present+ 16:04:31 present+ pauld, identitywoman 16:04:42 present+ andres 16:04:44 pauld_gs1 has joined #vcwg-special 16:04:52 present+ 16:04:56 JoeAndrieu has joined #vcwg-special 16:04:59 present+ 16:05:01 scribe+ 16:05:13 brent: Welcome everyone. 16:05:29 ... Today: pull requests 16:06:06 manu: I need to migrate the respec-vc and maybe respec-mermaid repos to W3C. 16:06:11 ... just a heads up 16:06:24 ivan: You know what I have to do? 16:06:27 manu: yep. 16:06:44 ... also Orie requested we update the tooling to show the latest VC-COSE-JOSE as well as DI specs 16:06:58 ... We'll do that once we move it over to W3C 16:06:59 q+ 16:07:17 ack ivan 16:07:17 ivan: the echidna is set up? 16:07:26 manu: I believe so... 16:07:42 ivan: for DI spec, it has to say CRD as status, then you can update as we go 16:08:15 manu: just a heads up, we have two CR events triggering. If we can get that on the agenda to review on a future meeting. 16:08:22 brent: yep, a good future meeting (Jan) 16:08:30 q+ 16:08:33 manu: can I submit a PR that would trigger a second PR? 16:08:45 brent: perhaps Ican can help wrt process 16:08:48 s/second PR/second CR/ 16:08:57 ... as soon as any normative changes are made to the CR document, doesn't that ... 16:08:57 q+ 16:09:03 ... can we merge those without new CR phase? 16:09:09 ivan: Not sure I understood. 16:09:21 ... The CR process is such that we can republish CR drafts at any moment. 16:09:26 ... That is a "CR Snapshot" 16:09:57 ... When changes are such that test implementations have to be redone because of normative change, then CR snapshots must use old publishing mechanism (not echidna) 16:10:22 ... So do not merge if you would trigger a snapshot, so we can turn off echidna and do the snapshot 16:10:34 brent: certainly possible to create another branch. 16:10:37 ivan: yeah. 16:10:39 ack ivan 16:10:42 ack manu 16:10:48 manu: Sorry, I'm doing a bad job explaining. 16:10:56 ... [sharing screen] 16:11:13 ... Currently Jeffrey Yaskin has requested that we define an interface in all of the securing specifications 16:11:21 ... His change requests (and another by Greg) 16:11:30 ... If we adopt those changes will trigger a second CR 16:11:40 ivan: to be precise, it triggers a CR snapsho 16:11:46 manu: not sure that's true 16:11:55 ... Can I merge this into the CR draft? 16:12:00 ... I thought I could. 16:12:10 ... Then we would have to remember to do a snapshot 16:12:27 ... So we can do the changes, we just have to remember that we will need a second CR snapshot (TBD later) 16:12:33 ivan: yes. that can be done. 16:12:45 ... If we have lots of drafts, there are supposed to be a new CR 16:13:00 ... I don't know the details of those PRs, so I'm not sure if they would invalidate 16:13:12 manu: there are so many changes, it would be hard to argue they don't 16:13:31 ivan: wait. maybe better: if there are any patent issues, would these PRs create new ones? 16:13:47 ... any time we have a CR snapshot, it triggers a new IP review 16:13:58 ... Are these changes such that we need a new review in this respect 16:14:08 manu: probably not, but it's hard to say because of so many changes 16:14:28 ivan: if you aren't sure, but its not visibly a new feature, that probably works 16:14:47 ... but if we critically change stuff or add new feature, I would be uneasy publishing that as draft 16:15:01 manu: to be clear, this PR fixes a bug. Jeffrey's PRs modified the interface 16:15:07 ... between the VCDM and DI spec 16:15:16 ivan: these do not require immediate snapsho 16:15:28 manu: next fixes a bug (#70) 16:15:37 ivan: that's editorial. I don't see any problems with those 16:15:59 ... One more thing: document every change. There should be a clear section that says "Since the last CR snapshot, these changes happenedn" 16:16:16 manu: so the only thing from the group, No one is objecting to these normative changes? 16:16:35 brent: I'm assuming on the PRs you have reviewed conversation and all of that? 16:16:49 ... Would anyone want to state an objection to processing as Manu proposed? 16:16:55 ... [crickets] 16:17:01 ... You care good to proceed, Manu. 16:17:06 Topic: PRs 16:17:08 https://github.com/w3c/vc-data-model/pulls?q=is%3Apr+is%3Aopen+label%3Abefore-CR+sort%3Aupdated-asc 16:17:32 subtopic: https://github.com/w3c/vc-data-model/pull/1370 16:17:35 scribe+ 16:17:38 ... First up, 1370 16:18:06 brent: Looks like Joe is opposed. 16:18:19 ... We don't have consensus on this. Looking to close. 16:18:30 ... happy to take comments. if folks are opposed, we can timebox a conversation 16:18:31 q+ 16:18:36 ack manu 16:19:02 manu: As a heads up, I curated the PRs and put pending close on any thing that has an objection without a work-around 16:19:11 ... we need to get more aggressive about closing 16:19:31 ... Just an explanation about why things are marked pending closed 16:19:48 ... Another thing to ask is whether or not the objector would make an FO on this change 16:20:22 ... My concern about this PR is that if we don't put Related Resource will not have a way of adding a hash for a JSON LD context in addition to the base context 16:20:35 ... It has been asserted that you don't have to do that if you have static contexts 16:20:52 ... Orie's not here, who might be objecting 16:21:09 q+ 16:21:33 scribe+ manu 16:21:56 JoeAndrieu: Yes, I am opposed to this, I would Formally Object, I think this is a huge layer violation. It creates an opportunity for surveillance through related resource, I think we can solve context securing in a different way. 16:22:19 ack ivan 16:22:19 JoeAndrieu: Manu, noted that VC-JOSE-COSE folks want to use JSON-LD Contexts... they should just use JSON-LD. 16:22:37 scribe- 16:22:39 ivan: I'm neutral on the original thing. but what was just proposed to Joe seems the wrong thing to do 16:22:55 q+ to say there is no consensus and ask about closing 16:22:56 ... saying that it can only be used for certain purposes sounds bad 16:23:09 ... that requires additional restrictions through new properties 16:23:12 ack brent 16:23:13 brent, you wanted to say there is no consensus and ask about closing 16:23:14 FWIW, I agree with Ivan, I was just trying to find a way through this where we don't end up w/ FOs. 16:23:16 ... I can't object, but I don't like it. 16:23:27 brent: I'm seeing no consensus here. 16:23:35 ... We don't have Orie, so we can't ask him. 16:23:45 ... based on the information we have, we should close this PR 16:24:02 ... I'd like to close it now, but we just put the pending close label on this three days ago 16:24:03 q+ to note our way through a FO if this becomes an issue 16:24:14 ack manu 16:24:14 manu, you wanted to note our way through a FO if this becomes an issue 16:24:32 manu: note, if Orie is going to formally object (because you can't secure context) 16:24:34 q+ 16:24:43 q- 16:24:47 ... our way through this would be to have a "relatedContext" property 16:24:49 q+ 16:25:00 ack ivan 16:25:04 ... I think Joe would not be opposed to that. And maybe Orie would find that ok 16:25:18 ivan: I want to remind people that there was a feature freeze a while ago. 16:25:29 ... what you just proposed feels like a new feature. It's just too late. 16:25:35 ... We can't work that way or we'll never finish. 16:25:49 brent: appreciate the reminders. 16:25:50 subtopic: https://github.com/w3c/vc-data-model/pull/1369 16:25:52 ... moving on to next PR 16:26:18 q+ 16:26:22 scribe+ 16:26:36 ack JoeAndrieu 16:27:21 JoeAndrieu: I've had a shift in this whole verification thing... I haven't made it through Manu's edits w/ his new PRs and verification/validation... shift, which aligns w/ Andres, Verification defined "not cryptographically", but steps that can be done generically w/o business rules... so service provider can do that for you. 16:27:34 expiry is business rules, tho 16:27:38 but I like this phrasing 16:27:42 JoeAndrieu: It could check status, expiry, well-formed-ness, so I want to queue up Manu... how does that float into latest language? At least for me, I have a lot more movement on this topic. 16:27:46 q+ 16:27:49 s/tho/too/ 16:27:49 scribe- 16:27:51 ack manu 16:28:01 +1 to the framing being closer to what i think works / people can agree with 16:28:11 manu: good news is that many people are granting leeway than before. that's good 16:28:33 ... I think there is strong push back on putting validation in scope 16:28:41 present+ smccown 16:28:57 ... I think Orie has wanted us to say we are both verifying and validating. but once we put one validation thing in there, it's a slippery slope 16:29:22 ... I think Orie is aligned with an idea from Dave: these calls to validating any of the extension points, you just get a yes/no answer 16:29:35 ... that seems aligned with what Joe was saying 16:29:55 q+ to propose having different terms for the 3 concepts that are being discussed 16:29:59 ... I think there's some language we could get to 16:30:07 q+ 16:30:26 manu: we could make another attempt at this, but I'd rather not do it. 16:30:39 ... we probably don't need this defined 16:30:50 ... I can try another variation 16:30:54 ... but this PR should die 16:31:07 ack andres 16:31:07 andres, you wanted to propose having different terms for the 3 concepts that are being discussed 16:31:10 brent: if anyone is opposed to this PR dying, speak up 16:31:32 andres: If its not in the spec, we should agree to use three different words for what we mean 16:31:45 ... "verification", "validation", but there's a third 16:31:52 ... One is cryptographic securing mechanism 16:32:08 ... Second is what Joe just alluded to, the status checking 16:32:14 ... Third is business validation 16:32:30 ... if we start using a different term that could help 16:32:31 q+ 16:32:34 scribe+ 16:32:39 ack JoeAndrieu 16:32:49 what is the current consensus re where well-formedness (required fields, etc) belongs? verification? 16:33:23 JoeAndrieu: One thing I wanted to note, in different PR, shift about "validation" that we don't validate what the roles do... even though it's expected that a verifier validates... there isn't software that we can test to be conformant. We say what conformant implementations do, not what conformant roles do (there still exists some sloppy language). 16:33:32 q+ to say i don't think we have three different terms, we just need to better split some things that are currently "both" ... verification gets you the information you need to make a decision, validation is making a decision about what verification returns 16:33:58 JoeAndrieu: Manu, you said verification should be 'yes/no' w/ subjects. I want to make sure metadata is returned so validation can be done by validation. Everything should bubble back up so business rules can be done/provided. 16:34:03 ack manu 16:34:13 manu: yes. that's the slippery slope I'm worried about 16:34:26 smccown has joined #vcwg-special 16:34:37 will has joined #vcwg-special 16:34:39 ... if we could define all that... it's not just expiry, it's also schema 16:34:53 ... So, depending on the detail that Jeffrey is asking for 16:35:34 present+ will 16:35:38 ... For example, the interface for securing mechanisms took six weeks. At best, 3 weeks 16:35:54 ... that means we don't get to JOSE-COSE and unlinkability 16:36:11 ... Unless that interface can be handwavey... 16:36:20 ... What you want Joe, is great, but we are out of time 16:36:37 ... unless we can solve it in the next week or two 16:37:05 q+ to say I'm not sure my approach is the problem. It's whether or not we can satisfy Jeffrey 16:37:13 q+ 16:37:25 ... Bikeshedding, etc. is a recipe for us just not completing 16:37:33 brent: thank you, Manu. I agree with your concerns 16:37:47 brent: what about this PR 16:37:50 ack dlongley 16:37:50 dlongley, you wanted to say i don't think we have three different terms, we just need to better split some things that are currently "both" ... verification gets you the 16:37:54 ... information you need to make a decision, validation is making a decision about what verification returns 16:37:58 zakim, close the queue 16:37:59 ok, brent, the speaker queue is closed 16:38:13 dlongley: I think we might not need 3 terms 16:38:21 ... we just need to split these up better 16:38:31 ... Verification is getting you the information you need to make a decision 16:38:37 ack JoeAndrieu 16:38:37 JoeAndrieu, you wanted to say I'm not sure my approach is the problem. It's whether or not we can satisfy Jeffrey 16:38:38 ... Validation is making that decision 16:38:42 scribe+ 16:38:45 JoeAndrieu: I get the time thing 16:39:17 JoeAndrieu: My concern is not whether or not we do this, I appreciate the time concern and that we want to do this, I think Jeffrey is asking for an answer and we need to figure out the level of detail to assuage his concerns. If we don't define it in this way, what way could we meet it? 16:39:25 ack dmitriz 16:39:44 dmitriz: I want to get a sense where the current consensus is wrt conforming documents and well-formedness 16:39:53 q+ 16:39:54 i think we're only defining the securing mechanism portion of verification and we can say that other interfaces can be used for other extension points to get secured information from them -- and then after all that, validation (business rules) can be applied 16:40:07 ... does checking that an object has required field, that timestamp is proper format, do those belong in verification or validation 16:40:51 @manu - what were you going to say? 16:40:51 brent: next PR 16:40:51 subtopic: https://github.com/w3c/vc-data-model/pull/1382 16:40:56 q+ 16:40:57 zakim, open the queue 16:40:58 ok, brent, the speaker queue is open 16:41:01 q+ 16:41:22 ack manu 16:41:36 manu: I thought Ted was a minus .99 and I agree 16:41:46 q+ 16:41:49 ... I don't like this PR. I raised it because Orie asked 16:41:59 ... I think the group just shouldn't say anything about it. 16:42:11 ... Why are we telling people not to do something that people might find useful. 16:42:12 +1 to Ted's rationale and Manu's support of it ... i think we're trying to say more than we need to here. 16:42:23 ... This feels like a time sync 16:42:43 ... Orie has said this would let us subprofile 16:42:52 ... But, please, let's not do that. Feels like a bad direction 16:43:11 ... Also, "+JSON+LD" would let you sub-profile, so we should 16:43:20 s/time sync/time sink/ 16:43:24 ... But I don't think we have a good use for it in this group. 16:43:32 q+ 16:43:59 manu: suggestion is to close this PR 16:44:03 +1 to closing the PR, do nothing. 16:44:13 +1 to Manu's suggestion to close the PR 16:44:13 ack TallTed 16:44:14 it was done in response to a mis-interpretation of Orie's comment 16:44:16 q- 16:44:18 ... if someone wants to profile the VCDM, they should do that and get implementation experience 16:44:26 TallTed: Yes, please lets close this 16:44:37 brent: dmitriz also noted he was +1 to close 16:44:47 ... I'm adding a pending close label to this PR 16:45:15 brent: next up 1383 16:45:17 subtopic: https://github.com/w3c/vc-data-model/pull/1383 16:45:33 q+ 16:45:41 ack manu 16:45:41 ... a few comments. mostly editorial concerns raised. 16:45:49 manu: this PR looks like it will make it. 16:46:06 ... To clarify, we are now taking a normative dependence on INFRA, limited to the algorithm section 16:46:17 q+ 16:46:20 ... We are NOT planning on rewriting the entire spec. We could later. 16:46:22 +1 to Manu on infra 16:46:25 ack TallTed 16:46:28 ... But for now, just the algorithm section 16:46:48 TallTed: my comment lines 588-596 are changed twice. 16:46:49 q+ 16:46:55 ... conversation at 1381 is the same 16:47:04 ... So this should be rebased 16:47:05 ack manu 16:47:19 manu: plus one. that's probably a mistake on my part. I'll remove it from the PR. Not meant to be in there. 16:47:41 brent: so this PR is looking like it will be approved. So, in five days from now, it will likely be merged. 16:47:59 ivan: to be precise, pending changes are still expected 16:48:02 Agree with Ivan, things need to change in this PR to go in. 16:48:09 brent: now to 1381 16:48:10 subtopic: https://github.com/w3c/vc-data-model/pull/1381 16:48:21 q+ 16:48:37 ack manu 16:48:38 ... remove document checking section 16:48:56 manu: Orie requested changes on the verification algorithm, specifically that part that checked document conformance 16:49:07 ... It did it in a way to call out every single property to check 16:49:13 ... That's what Jeffrey asked for. 16:49:54 ... Orie disagreed and wants it to be restored 16:49:54 ... So, basically "read the doc, do the MUSTs" 16:50:07 ... Jeffrey was ok with that. This PR does that by becoming much more concise, accurate, about what a conforming document is or is not. 16:50:35 manu: document: must be compact JSON-LD that follows all of the MUST statements in the specification, pointing to the sections with those MUST sections 16:50:43 ... and it does a few more things TallTed is worried about 16:51:04 ... it also aligns the discussion about "Big Tent" into the credential type specific processing section 16:51:45 ... Also, "you may, transmit and store a conforming document in a variety of serialization formats" as long you can bring that back 16:52:01 Manu, look at https://github.com/w3c/vc-data-model/pull/1381#discussion_r1424109226 for possible bike shedding on terminology 16:52:03 ... that invites others to profile VCs 16:52:08 q+ 16:52:16 ack TallTed 16:52:36 TallTed: I don't see the path to resolving my concerns. My comments said the definition change is substantial. 16:52:40 q+ to pose path forward. 16:52:49 ... The degree of substantialness... 16:53:04 ... yes you can wrap it, but since you have to bring it back, what's the point 16:53:07 q+ to agree 16:53:17 TallTed: I'm not understanding the motivations 16:53:37 ack manu 16:53:37 manu, you wanted to pose path forward. 16:53:42 brent: would it be fair to say since a conforming document is well described why talk about other serializations? 16:54:00 manu: one path is to remove the language about serializations. because it should be obvious 16:54:11 i think we need to assuage the concerns of people who want to transform/envelope/whatever as long as you can come back again (even if it's obvious you can do that) 16:54:29 ... but we spent a long time discussing that, so maybe we should put it in there, even though it's blindingly obvious 16:54:34 +1 to Manu, it's been a concern from others. 16:55:16 ack JoeAndrieu 16:55:16 JoeAndrieu, you wanted to agree 16:55:20 scribe+ 16:56:02 "Deterministic and 100% reversible transformation to or encapsulation in other media types is permissible." 16:56:05 JoeAndrieu: I share TallTed's concerns, I appreciate we want to have roadmarkers for conversations we've had before, we should have language that says "other serializations" are not VCs. I think we need to make it clear that those other things aren't VCs. I don't want people to think that they can call those other things VCs. 16:56:27 brent: note we do say that "serialization must be ..." we already say that. 16:56:38 ... what we can say, we have already agreed on and said 16:56:49 ... So I'm leaning towards just keeping what we have 16:56:56 manu: that language is being deleted in this PR 16:57:02 brent: can we not delete it? 16:57:13 manu: yes. that's an option. 16:57:19 ... people are saying reasonable things 16:57:33 brent: looks like we have a path forward for 1381 16:57:38 "another serialization that transforms a conforming document is not a conforming document itself... and it must be (bi-directional, yada-yada)" maybe 16:58:27 brent: please review 1380 and 1379. those are the hot tickets 16:58:57 ... PRs marked pending closed will be closed without some sort of hail mary. The associated issues will also be closed. 16:59:06 rrsagent, draft minutes 16:59:07 I have made the request to generate https://www.w3.org/2023/12/12-vcwg-special-minutes.html ivan 17:00:06 rrsagent, bye 17:00:06 I see no action items