Implement ID v4 version#55
Conversation
There was a problem hiding this comment.
Before delving into this, I wanted to ask a question: Have you considered using veraison/rust-cmw?
If so, what made you decide against it?
(I can see how a minimalist implementation of CMW could be a sensible choice in this case. However, I wanted to make sure that you had considered the alternatives.)
There was a problem hiding this comment.
Oh. I did not even realize that there is a rust crate there. Let me take a try and get some response to you
There was a problem hiding this comment.
Looks like the CMW struct defined by rust-cmw has its own serialzie/deserialize implementations, s.t. marshal_json and unmarshal_json. At the same time, the ear crate requires the members to implement serde::{Serialize, Deserialize} for cmw, if the cmw struct is used as a member of ear struct.
So maybe an "elegant" way to my side is to firstly support serde::{Serialize, Deserialize} for cmw in rust-cmw, and then use rust-cmw in this PR. Wdyt?
There was a problem hiding this comment.
Sounds great to me.
@ionut-arm, can you think of any reasons why this wouldn’t be beneficial?
There was a problem hiding this comment.
Yess, @Xynnn007 - that would be a great addition. Since the serde traits don't take an explicit output format, there's a need for the CMW to already have its format defined internally when serializing. At the moment there's no clear way to create a CMW "by hand" and set the expected output format, but that shouldn't be a big addition.
AFAICT deserialize is already implemented and can probably be reused.
There was a problem hiding this comment.
Added a simple PR for this veraison/rust-cmw#6
There was a problem hiding this comment.
@ionut-arm I put another PR veraison/rust-cmw#8
There was a problem hiding this comment.
This is an awesome initiative. Thanks very much for this.
There was a problem hiding this comment.
Please remove this. This information should be part of the message for the commit making the changes, and not in a random file in the repo (that will in all likelihood future contributions will forget to update). GitHub will automatically generate a changelog for each release from pull requests and commits. There is absolutely no need to maintain one by hand.
There was a problem hiding this comment.
Following @setrofim 's suggestion, removed
85e484d to
42a8f6a
Compare
|
I force pushed with my own repo rev. If veraison/rust-cmw#6 gets merged, I can update the rev. |
Update claim names, CBOR keys, and public APIs to match draft-04, including CMW-based raw evidence, standardized attester and verifier claims, optional top-level status and topology, and the ietf EAR profile URI. Changed: - Align EAR JSON/CBOR claim names and mappings with draft-ietf-rats-ear-04. - Update default EAR profile URI to tag:ietf.org,2026:rats/ear#04. - Update top-level verifier claim from ear.verifier-id to ear_verifier_id (CBOR key 1004). - Update raw evidence claim from ear.raw-evidence to ear_raw_evidence (CBOR key 1002), encoded as a Record CMW array. - Update appraisal claim names to draft-04 forms: ear_status (1000), ear_trustworthiness_vector (1001), ear_appraisal_policy_ids (1003). - Replace Veraison extension-style claims with standardized draft-04 claims: annotated_evidence / ear.veraison.annotated-evidence -> attester_claims / ear_attester_claims (1005) policy_claims / ear.veraison.policy-claims -> verifier_claims / ear_verifier_claims (1006) - Add optional top-level EAR fields: status (ear_status, 1000) and topology (ear_device_topology, 1007). - Keep Veraison key attestation extension as ear_veraison_key_attestation (-70002) and align naming in JSON examples; fix JSON serialization of key_attestation that was previously deserialize-only. Added: - Depend on the cmw crate for Record CMW handling in ear_raw_evidence. raw_evidence is (de)serialized as a CMW directly through serde for both JSON and CBOR, relying on cmw's serde support for both encodings (>= 0.2.0); no format-specific handling is needed in this crate. - Export EAR_PROFILE constant from crate root. - Add tests that deserialize draft-04-aligned JSON examples and validate updated claim names/keys, including a JSON<->CBOR round-trip of ear_raw_evidence. Also fix an elided-lifetime clippy lint in TrustClaim::value_desc. Breaking Changes: - Ear.raw_evidence type changed from Option<Bytes> to Option<cmw::CMW>. - Appraisal fields renamed: annotated_evidence -> attester_claims, policy_claims -> verifier_claims. - JSON claim names moved from dotted forms (for example ear.status) to underscore forms (for example ear_status) per draft-04. - Tokens produced with legacy profile or legacy dotted claim names are not wire-compatible with draft-04 tokens. Migration Notes: - Use EAR_PROFILE (tag:ietf.org,2026:rats/ear#04) when creating new EAR tokens. - Build raw evidence with the cmw crate, for example: CMW::from_json_value(&serde_json::json!(["application/vnd.evidence", "<base64>"])) or CMW::Monad(Monad::new_media_type(mime, bytes, None)?) - Update downstream parsers/policies to consume ear_* claim names instead of ear.* names. Signed-off-by: Xynnn007 <xynnn@linux.alibaba.com> Co-authored-by: Cursor <cursoragent@cursor.com>
Update the cargo-rdme README to match the revised lib.rs examples. Signed-off-by: Xynnn007 <xynnn@linux.alibaba.com> Co-authored-by: Cursor <cursoragent@cursor.com>
Signed-off-by: Xynnn007 <xynnn@linux.alibaba.com> Co-authored-by: Cursor <cursoragent@cursor.com>
4 participants
Close #54