Repository navigation
docs(issuers): fix issuer, operations, registry and reference docs against vc v0.7.23 - #79
Merged
Merged
Conversation
…ference index Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…, SAML/OIDC examples Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
… API page Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
There was a problem hiding this comment.
🟡 Changes recommended
Several security and operational claims remain inaccurate, and the documented PKI setup cannot start as written.
6 open findings
What changed in this PR
Updates SIROS ID documentation to align issuer, registry, operations, and API guidance with vc v0.7.23.
Changes:
- Corrects deployment topology, configuration, endpoints, and credential formats.
- Updates authentication, revocation, status-list, and registry guidance.
- Refreshes examples for OIDC, SAML, Keycloak, Docker, and APIs.
| File | Description |
|---|---|
registry/registry-cli.md |
Updates CLI options and container usage. |
registry/index.md |
Documents VC registry consumption. |
reference/vctm-registry.md |
Clarifies registry roles. |
reference/token-status-lists.md |
Revises status-list and revocation behavior. |
reference/standards.md |
Updates implemented standards and endpoints. |
reference/index.md |
Adds production PDP guidance. |
reference/api.mdx |
Corrects API service descriptions. |
operations/docker-images.md |
Updates images and deployment topology. |
operations/admin-api.md |
Documents admin authentication and configuration. |
issuers/saml-idp.md |
Corrects SAML configuration and mappings. |
issuers/oidc-op.md |
Corrects OIDC configuration and secrets. |
issuers/keycloak_issuer.md |
Updates Keycloak integration. |
issuers/issuer.md |
Revises issuer capabilities and deployment. |
issuers/deployment.md |
Adds the complete issuer stack configuration. |
issuers/concepts.md |
Updates credential formats and architecture. |
issuers/api-integration.md |
Corrects offers, revocation, and gRPC guidance. |
🧠 Review effort: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| ``` | ||
|
|
||
| Verifiers checking the Token Status List will see the credential as revoked. | ||
| To revoke an issued credential, update its status entry in the registry, either through the registry admin GUI (`registry.admin_gui`, `POST /admin/status`) or by calling the registry's `TokenStatusListUpdateStatus` gRPC method directly. Verifiers checking the Token Status List then see the credential as revoked. |
Comment on lines
+223
to
+226
| openssl ecparam -name prime256v1 -genkey -noout -out pki/signing_ec_private.pem | ||
|
|
||
| # RSA 2048 key (alternative) | ||
| openssl genrsa -out pki/issuer_key.pem 2048 | ||
| openssl genrsa -out pki/signing_ec_private.pem 2048 |
| ### OpenAPI Specification | ||
|
|
||
| The complete OpenAPI 3.1.0 specification is available at: | ||
| The complete OpenAPI specification (version 1.1.0) is available at: |
| Credential status is changed in the registry. apigw has no revoke endpoint and does not update statuses itself (deleting a document through the datastore API does not revoke credentials already issued). Two interfaces exist: | ||
|
|
||
| - the **admin GUI**, enabled with `registry.admin_gui.enable` (plus `username` and `password`), which updates a status through `POST /admin/status`; | ||
| - the registry's **gRPC** `TokenStatusListUpdateStatus` method, protected by mTLS (`registry.grpc_server.tls`). |
| "sub": "https://registry.example.org/status/list-001", | ||
| "sub": "https://registry.example.org/statuslists/1", | ||
| "iat": 1708963200, | ||
| "exp": 1708966800, |
| Registry->>Registry: Mark index as revoked | ||
| Note over Registry: Next refresh generates<br/>new status list token | ||
| Registry->>Registry: Refresh the affected section in the background | ||
| Note over Registry: New status list token<br/>is generated immediately |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Strict-parse and validation of all YAML against vc v0.7.23. Fixes deploy compose (apigw+issuer+registry), transform -> derivations, endpoint paths, admin API auth, status lists, docker images, registry-cli. Admin bind issue: go-wallet-backend#444.
PDP wording: a PDP (
trust.pdp_url) is required for production; running without one may work but is not supported (dev/test only).Part of a docs-vs-code audit. Build passes locally when generated pages are present.
🤖 Generated with Claude Code